start: pre-checks (disk, gig-log, autoroute service, routing, portal
token), screen capture on the default sink's monitor, arm, then a
per-orbit verify that never kills the video. State written before
verify, values quoted (the session path has a space). stop: SIGINT
sweep by output filename for the sandboxed recorder, transport halt,
take summary. Camera opt-in (--cam); no notification on the happy path.

Verify reads the capture files, never a self-report: missing or flat
per orbit. Never binds UDP 3820 (gig-log owns Ardour's OSC feedback);
reads gig-log's rec lines instead. The master-rec toggle is only sent
when that stream says OFF, the orbit list comes from the session XML,
and halt stops the transport a stop must never forget.

algolia devcon26: gig folder — intro loop (4K + portrait w/ audio), header art, jingle wav, extracted palette

Everything from 2026-09-25 is committed and the suite is green, so nothing
here is half-applied. What is left is one loose edit outside this repo (the
sound-browser fix, which I could not commit), three restarts and a Pulsar
window reload to collect work already built, two things that need hands in
Ardour, three design questions with no code behind them yet, and the OSC arm
lens.

The 200 ms audition chop is recorded as UNRESOLVED with the one test that
settles it, not as fixed. All three sample-bank surfaces were ruled out: the
Foundry was not serving, La Cale has no index to load, and the sound browser
has no loop or timer on its click path. `paplay` on the same file decides
whether it is the audio path or Pulsar, and that is worth more than another
guess.

66318b6e's comment and test docstring both claimed PLN heard the polled-loop
stutter. He did not. The Foundry server was not running: port 8765 was
another project's http.server, established two steps after the fix landed.
The bug is real and of exactly the reported shape, and it stays fixed - but
attributing a fix to a symptom it did not cause is how a wrong diagnosis
becomes documentation, which is this morning's -inf-faders mistake again.
Both places now say where it came from. The commit message is history and is
left alone.

And check-mix's --arm table called an unarmed `Mix` route "not recorded, by
choice" while --mix blocks on precisely that. Two modes of one tool must not
disagree about the same route.

Detection stopped being the problem at 6a94b47b. What failed on 2026-09-24 is
that every dot was green and nobody was looking at any of them: at T-2 the
eyes are on Pulsar and the hands are on the LCXL, and neither surface said a
word. So this is attention routing, not checking.

Three principles, then the shape. One source of truth (check-gig --json; no
surface grows its own check). An alert lands on the surface the eyes are
already on, which is a different surface at T-30, T-5 and T-2. And a wizard
is ordered and blocking where a dashboard is neither: one blocker, its fix,
a re-check of that ONE probe because the full gate costs 16 s and a
16-second wait per fix is how a wizard gets skipped.

It never converges on its own. Arming a track, raising a fader and saving are
things only PLN's hands in Ardour can do, and a tool that edits the session
he is performing from is a tool that fights him.

Also records the one alert that earns the right to interrupt a set - Ardour
not recording while Tidal plays - and pins it to the FILES lens, because the
OSC surface claimed arm:false for all 76 minutes it was actually recording.

Three open questions left for PLN rather than answered here: which surface
the T-2 alert lands on, whether an at-my-own-risk skip is acceptable, and
how long the during-set silence window is. The last one needs one rehearsal,
not an opinion.

Retention and the Mix audit are marked done in the belt-and-braces list, and
Tidal 08 is ticked: PLN armed it at 17:38 and the saved session now reads
rec-enable=1 on all twelve.

The black box writes ~72 MB/hour into a gitignored directory and nothing
deleted anything, so it only grew: a rehearsal week is >5 GB and the repo's
">500 MB is reported or deleted, never silent" line bites after one.

An automatic sweep is the wrong shape here. A timer or an ExecStopPost is the
one mechanism that could delete the take nobody meant to keep, which is the
entire reason the recorder exists. So: `prune [DAYS]`, dry by default. It
prints what it would remove and removes nothing until --yes.

Three things are never candidates, in the order they would hurt:

  * whatever the running recorder holds open, read from /proc/PID/fd rather
    than guessed from mtime — after a segment roll the newest file is not the
    one being written, and a long session's current segment can easily be
    older than the window. A held-back file is named BEFORE the
    nothing-to-do line, or the report would be a lie about the one file that
    matters most (the test that found this).
  * anything that is not a %Y-%m-%d_%H%M%S.opus segment, so a slice_*
    excerpt cut on purpose is not swept up with the raw capture.
  * anything inside KEEP_DAYS (14, overridable).

OUT_DIR is overridable with GIG_RECORD_DIR for one reason: a delete command
whose tests cannot run without pointing at real takes is a delete command
nobody tests. The six new tests assert what it REFUSES to delete, including
a real process holding a real fd.

The gate advises at 500 MB and names the command. It never prunes.

The notifications package auto-hides a notification after 5 s only when it
is NOT dismissable. Everything raised through addError/addFatalError is
dismissable, so every error waits for a click forever, at 450 px of pale-red
fill with near-black text over a dark theme — and a fatal one SHAKES, three
times, which is punitive UX with an actual keyframe.

Nothing is lost by hiding them: the same package keeps a timestamped log of
every notification, reachable with notifications:toggle-log. That is what
makes a timeout safe rather than careless — it hides the interruption, not
the information.

notifications.js gives every dismissable notification a life, longer the
worse it is (4 s info to 25 s fatal). Hovering pauses it, because reading is
not dismissing. Clicking cancels it for good, because a click means "I am
working on this". Notifications the package already auto-hides are left
alone: one owner per behaviour.

notifications.less makes the panel dark, translucent and blurred so the code
underneath stays readable, moves the type into the colour of the icon strip
instead of a wall of fill, deletes the shake, and draws a 2 px countdown bar
from the same duration the script used — read through a custom property, so
the bar cannot disagree with the timer. Ship's Bridge tokens, so the editor
and the armada UIs say "error" in the same colour.

They live here rather than in ~/.pulsar so the reasoning is in git; the
dotfiles hold one require and one @import. The stylesheet was compiled
before landing. init.js needs a window reload to take effect; styles.less is
live on save.

Master is a bus. It has no rec-enable, so Ardour can never record it, so an
unarmed orbit has nothing to fall back to — the whole cost of the 24th. The
answer inside Ardour is a `Mix` TRACK fed from Master/audio_out 1+2, armed:
stem grade, same take, same sample clock as the orbits.

`--mix` audits it, and exits 4 when there is no such route, because absence
is a choice and the gate must tell "you have not built the net" apart from
"your net is broken". Absent prints the 30-second Add Track recipe rather
than nagging. Once it exists, four things make it a net that looks present
and records nothing, and they are checked in the order they bite:

  1. output wired back to Master — a unity-gain FEEDBACK LOOP through the PA,
     which is the state you get by following Ardour's Add Track dialog and
     stopping, since a new track goes to Master by default;
  2. not armed — the Tidal 08 failure one route further out;
  3. input not on Master, or only half on it — one channel the mix and the
     other an orbit reads as a healthy file and is unusable;
  4. fader off unity while the route is DiskIOPostFader — the fader is IN the
     recording, and at -inf the file is digital silence.

Two gate probes, split the way the gig-record pair is: "mix track" ADVISES
that there is none, "mix track wired" BLOCKS on one that is broken.

Ten new tests. The mutated fixtures each break exactly one thing, so a
failure names the fault; ExtConnection is asserted NOT to count as an
in-session link, or a correctly wired track would report a feedback loop.

The loops panel looped an <audio> element from a `timeupdate` listener:
`if (currentTime >= end) currentTime = start`. `timeupdate` fires at most
about every 250 ms, and analyze_chops offers slices of 0.25-2.0 s
(engine/loops.py:322) — the poll interval was the same length as the thing
being looped. Playback overshot `end` by up to a whole region and only
snapped back on the next tick, and every snap was a seek on a streamed
element, which rebuffers and gaps the seam. Audible result: a stutter at
4 Hz, reported as "play/pause toggle every 200ms". It was.

No poll rate fixes a 250 ms region, so the fix is a deletion. An
AudioBufferSourceNode with loop/loopStart/loopEnd loops in the audio thread:
sample-accurate, gapless, no polling and no seeking, correct for a chop and
for a 30 s loop alike. The AudioBuffer is already decoded because drawWave
needs it, so audition is now instant after the waveform appears, and the
context is resumed on the click that needs it.

tests/test_audition_loop.py is a mechanical guard on the served page: three
of its four assertions fail against the previous version, verified.

Two bugs I introduced or left standing in the two commits before this one.

SELECT PLUS READLINE DRAINS ONE LINE PER EVENT. readline() on a
TextIOWrapper pulls a whole chunk off the fd and hands back one line; the
rest sits in the wrapper's decoded buffer, where select() on the fd cannot
see it. A fader sweep is 100+ lines a second arriving in bursts, so the
tail of a gesture would be logged only when the NEXT gesture arrived,
stamped with the wrong second. Measured on a real pipe: 1 of 50 lines,
against 50 of 50 once the reader owns its own byte buffer. The old
blocking iterator never had this; select made it possible and nothing
tested it, because the fake pipe never wrote anything.

Same file: a rebind left the old aseqdump running. Harmless while rebinds
only happened after the stream ended -- and the previous commit made them
ordinary, since the driver restarted six times that night. The
steady-state check now also reuses one 'aseqdump -l' for both questions.

RUNNING IS NOT LISTENING. gig_record resolves its sink once, at start, and
gig-up starts units BEFORE it opens Ardour -- so in the flow that is
actually pressed it resolves while Ardour is closed, falls back to the
default sink, and if the laptop speakers are then cut (correct on stage)
the black box records a sink nothing reaches. 'gig_record.sh check' asks
whether what it HEARS is still where Master GOES, read off the running
process rather than recomputed; a new ADVISE probe runs it and skips when
Ardour is closed. "Not running" stays the other probe's question.

The master_sink awk now has tests, including the state the gig was in with
Master linked to two sinks at once -- it takes the first, which is a real
choice and not a good one, so the script names the sink it picked and the
test makes the ambiguity visible instead of silent.

Captured at task close, not reconstructed. The learning worth keeping is
that a green light is a claim about liveness and liveness was never the
question — and that a test in this repo had pinned the MIDI re-resolve
design so firmly that 'cheap by construction: an idle surface costs
nothing at all' went un-re-examined until an idle surface cost a gig.

PLN, 2026-09-25: "a better 'tableau de bord' to confirm all is armed".

The Bridge answered liveness: units active, processes alive, surface
connected. On 2026-09-24 all of that was green while Tidal 08 was
unarmed, gig-log's MIDI lens held a dead subscription and the black box
had never run. None of those are liveness questions, so no number of
green process dots could have shown them.

The panel renders tools/check-gig.py --json and decides nothing itself.
Severity, wording and — the part that matters on a screen — the FIX all
come from the probe that owns the question, so a probe added to check-gig
appears here for free. A bespoke "armed" tile would have been a third
place the truth lives, which is the failure this rig keeps paying for.

Read-only by construction: check-gig is fenced by gig_gate.mutations()
and tested for it, so unlike RIG UP this button changes nothing and makes
no sound. It runs off the request thread like _Converge, because the repo
layer takes ~40s and holding a poll open reads as a hung dashboard.

Also: two failing rows said nothing useful. gig_gate._detail() shows a
probe's LAST line, and check-mix ended on a paragraph — so the dashboard
read "is tools/gig_record.sh." and "which looks exactly like Tidal
emitting nothing. It isn't." Both now end on the fact: "1 orbit(s) NOT
ARMED — Tidal 08" and "9 route(s) cannot be heard — Tidal 02, ...". A
verdict is read standing up, in a field.

Verified against a throwaway instance on a spare port: 43 checks, NO-GO,
ardour armed at the top naming Tidal 08.

tools/gig_record.sh has existed since OPAL, is item 9 of RUNBOOK.md's
checklist, and had never run once on this machine — no unit, no row in
rig_units.py, so nothing in the authored inventory knew it existed and no
converge asserted it. Precisely gig-log's own story, which is why
CosmicFest has no session log.

The cost this time: 2026-09-24 lost 17m44s off the head of a 94-minute
set (REC at 18:27:41, set from 18:09:57), so salut_nu and love_first
exist in no recording at all. Orbit 08 went with them for every track,
and Ardour cannot help — Master is a BUS, no playlist, no rec-enable, so
the DAW cannot record the mix even in principle. One stereo opus of the
master bus makes both losses survivable.

It no longer records the default sink. That sink was the laptop card on
the 24th while Ardour's Master had been hand-linked to the UMC, so the
net would only have caught the show because TODO_GIG step 4 was never
done — do that step and the black box records silence, which is the worst
failure a black box has, because it looks like it is working. It now
follows whatever sink ardour:Master/audio_out 1 is linked to, falls back
to the default when Ardour is closed, pins to GIG_RECORD_TARGET when told,
and says out loud which road it took.

on-demand, not login: ~72 MB/hour, so gig-up starts it and idle hours are
not recorded. PROOF stays None because 'pgrep -x ffmpeg' would be
satisfied by any stranger's transcode; its liveness is a recent segment
mtime, the same assertion the gig-log probe makes.

The probe ADVISES rather than blocks — a missing net does not stop a set.

Also: nothing checked that rig_units.SERVICES and rig-install.sh's
UNIT_SRC name the same units, which is the 'list lived in three places'
failure this module was written to end. Three tests now do, shrink-only
on perf-tray's $HOME-only unit. Verified they fail when the new row is
removed.

Zero control moves were logged for the whole 2026-09-24 set, and every
cheap check said fine. Two independent faults, both found by looking:

THE CHECK RAN ON TRAFFIC, NOT ON A CLOCK. The re-resolve lived inside
'for line in self._proc.stdout', so it only ran after a line ARRIVED. A
bound port that goes quiet blocks that iterator forever, and aseqdump does
not exit — so the loop parked on a blocking read from 01:01 through a
94-minute set. Now a timed select: the liveness question is asked every
UPGRADE_S whether or not the board said anything. The old test asserted
this the other way round, on the reasoning that running in the read loop
was 'cheap by construction: an idle surface costs nothing at all'. An idle
surface cost the gig. 'Costs nothing when idle' and 'notices when idle'
are the same code path and only one can be true.

A NAME AND AN ADDRESS ARE BOTH USELESS HERE. 38 hours after the set, 133:0
'ParVagues LCXL3' still resolved to that exact address under that exact
name — so neither 'is it gone' nor 'did it move' could see anything. What
happened is the third thing: lcxl3-driver restarted repeatedly between
00:34 and 10:27, and the kernel handed each new sequencer client the same
number. Our subscription died with the old one. Verified live: client 133
was 'Connecting To: 129:0, 14:0' and gig-log's aseqdump, client 135, was
not in the list.

So subscription_alive() asks the kernel's own wiring table, matching the
CHILD's pid — the same discrimination lcxl3-driver's board_link_alive
makes, for the same reason. It reads False on the real dead link and True
on SuperCollider, which is wired to the same port; 'cannot tell' is None,
never False, so a box where aconnect differs does not thrash.

gig-log status now names the binding, its subscription state and the
session's control-event count. It used to answer 'is it writing', which
was true and useless on the night the file grew at 1 Hz with nothing in
it. A dashboard that shows LIVE while a whole lens is dead is the green
check this rig has learned not to trust.

Note: tools/tests/test_one_tidal_parser.py fails at HEAD too, on
fold-orbits.py. Untouched here.

Twelve tools audit this rig's faders, mutes, routing, ghosts, preload,
samples and thermals. None audited arm state, and on 2026-09-24 Tidal 08
sat at rec-enable=0 for the whole set — alone among the twelve — so Ardour
never created the file. Eleven stems, and that orbit was in all fifteen
tracks' control maps.

Arm lives in the same mixer, in the same XML, under the same verb, so it
goes in check-mix rather than a new screw. Only the Tidal NN routes block:
Master has no rec-enable at all, which is how Ardour says 'bus' — reported
as n/a, because sending PLN hunting a button that does not exist is worse
than saying nothing. Mic and Keys are reported, never gated.

A new 'ardour armed' probe carries its own fix (click record + Ctrl+S, not
raise + Ctrl+S), and 'ardour faders' now passes --no-arm so neither probe
reports the other's failure. Run against the session as it stands, the gate
says NO-GO and names Tidal 08.

The disk caveat cuts both ways and the docstring says which: this proves
the session BOOTS armed. It is exactly right for the Tidal 08 case, where
saved and live agreed all night. Nothing here reads Ardour's OSC surface —
that surface reported arm:false for all 76 minutes it was recording.

PLN, from the stage: "moving from track X to Y, i had to press states like
^42 twice to 'apply their state'? was weird". ^42 is row E, column 2 — a
driver-owned latch.

carry_values deliberately emits no CC for buttons, because a 0 into a midiOn
gate is someCyclesBy 0 and the stream stops playing. It also cleared the
driver's latch, on the reasoning that LEDs should stop lying across a change.
Those two halves contradict: nothing is sent, so Tidal's bus still holds 127,
while the driver now believes 0. The next press computes 'not False' = ON and
re-sends 127 into a bus already at 127 — inaudible — and the press after it
closes the gate he was trying to open.

Not a hypothesis. The lcxl3-driver journal logged 37 of these across 14 of
the 2026-09-24 set's 15 track changes, and the service runs without
--no-latch, with Midi Through cut, so the doubled-CC path is not involved.

The fix is a deletion: the latch IS what Tidal sees, so it survives exactly
as the CC value does. Row F stays momentary — its release travels the generic
path and really does send 0. A carried latch now paints lit under the new
track's label, which is true, and doubles as the ghost-gate indicator this
surface never had.

The test's own assertions are checked against the pre-fix code: both fail
there.

Corrections and additions to the Thu-24 reconstruction, all from sources
that should have been read first.

The fader claim was wrong on cause: I blamed the LCXL lap reset, but every
one of those journal lines says 'effect knobs -> 0' and '(no CC sent)' —
Tidal params, not Ardour gain. The 2026-08-14 forensics had already settled
it as a faithful save of faders in motion. Same verdict now reached from
the audio side, which is the new part.

Verified rather than assumed: dN == Ardour 'Tidal NN', from BootTidal.hs,
fold-orbits.py and check-mix.py independently. That is what makes the
missing stem d8.

New: all nine off-map orbits were declared by the immediately preceding
track, so #68's ghost mechanism is now measured in audio, with levels —
take_5_drops ran its whole 8m43s under piment_bresilien's orbit 04 at 99%
active. And the answer to 'why no Master to recover from': Master is a bus
Ardour cannot arm, while the out-of-Ardour net gig_record.sh has no unit
and no inventory entry, so nothing ever asserts it.

Dropped: a killed-recorder verdict that was an artifact of reporting on a
sliced log, a laptop-speaker inference the data does not support, and a
13-of-15 peak count that should have been 12 of the 13 captured.

Reconstruct 2026-09-24 from four independent lenses: gig-log eval, the
lcxl3-driver journal, gig-log focus, and full-resolution per-second levels
off the eleven Ardour stems. Eval and the surface journal agree to the
second on all fifteen boundaries, so nothing here is a statistical guess
the way CosmicFest's recovery had to be.

What the numbers say: 94 minutes, all fourteen planned tracks in order plus
sunny_side_up sixth, five xruns, zero throttle events. REC landed 17m44s
into the set, so salut_nu and love_first have no audio at all. Orbit 08 was
never record-armed and the control map lists it in every track. Neither
MIDI recorder captured a single control move.

Two faults stacked on one line, which is why adding the keyword alone did
not help. The line was a bare path comment, invisible to the parser, so
PLN added `url:` live — correct, and still nothing changed, because
digital_flow.gif is 17MB against the 8MB still/gif guard. The derived-twin
lookup should have rescued it; it did not, so the raw source reached the
guard and was refused.

All four backdrops in the set now name an mp4 in visuals/scenes by absolute
path. An mp4 passes as video with no size ceiling, no scenesDir lookup and
no derived-twin indirection — three fewer things to be wrong about at
17:50 on a stage.

Mid-soundcheck, 17:40: the decolle backdrop stayed up through Salut Nu and
Chere Mireille. Not a stale scene — Chere Mireille does declare one, and it
parses fine quoted or bare. Its FILE was gone: both PerfectSunriseLoop.gif
and rose_bloom.gif had been cleaned out of ~/Downloads, so the resolver
returned nothing and the HUD kept painting the last scene that worked.

The converted mp4s were never lost — they live in visuals/scenes, which is
where scene-ingest writes them. Repointed chere_mireille, sept1 and
rose_rouge at those, by absolute path: an mp4 passes the guard as video with
no size limit and no derived-twin lookup, where the raw gif would have been
refused anyway (decolle.gif is 797MB).

Downloads is a staging area, not a source of truth. A backdrop that lives
there dies the next time it is tidied.

On stage, 15:05. The interface enumerated fine — USB bus, ALSA card 3 — and
the graph still had no trace of it, because PipeWire had it on the
input:analog-stereo profile: zero sinks, microphone ports only. Presence
was never the question.

pro-audio is the only profile on this device that carries a sink at all, so
there was no choice to make. Switched, and Master linked to it by hand;
check-audio-graph now passes its own monitor-path test and reports the
interface clocking at realtime across three samples.

Master still feeds the laptop too, deliberately, until the PA is confirmed
audible. Both the cut command and the durable Ardour-side fix are on the
card, because hand-made links do not survive a restart.

The set was rewritten this afternoon — 17 down to 14, 8m30 each, the START
and the closer dropped and Rose Rouge moved to the end. setlist_thu24.txt
still held Sunday's seventeen, and the gig card I wrote an hour ago still
said "17 tracks", so both were quietly wrong about tonight.

All fourteen re-verified cold with silent-eval --seeded: 14/14, every
declared orbit emits. Two BPM labels in backlog disagree with what the
files declare via setcps — Cafe Tiede and Force Motrice are 125, not 124 —
so the file carries the measurement and says which it is.

The dropped three stay as comments rather than vanishing, and the empty
encore slot carries the one measured candidate for it.

1101 lines of diagnosis had accumulated on top of each other, oldest first,
so the only live content — tonight's clock and the four things left to do —
sat at the very bottom under forty headings dated Sunday. A checklist you
have to scroll to is not a checklist.

Rewritten as one screen: the clock, five numbered actions in the order they
happen, four symptom-to-fix recoveries, four things never to run tonight,
and the measured rig state. Short lines, plain words, no jargon that needs
a lookup at showtime.

The week's notes are not lost and not duplicated — the file's own footer
carries `git show 50adcf43:TODO_GIG.md`, verified to restore it byte-exact.

Qt hides the window the instant setWindowFlag runs; the re-show guard ran
after the call and always read False, so t dismissed the lens for good
(PLN: 'it does kill it, risky'). The check now happens before.

PLN: 'stuck to left wall, should fit in d1 cell so have same margin as
cell'. The fit is honest: probe core-only ink (the glow inflated the
measurement), shrink the type to the span — never squash, never clip —
crop to true ink, clamp to the cell's outer rect. Glow trimmed another
notch: 'less blurry still neon but somewhat less'.

PLN: 'dont HL when d1-d12 controls are at zero volume (so D1 at 0 kills
d1 HLs, A1 at 0 kills d9, etc)'. A trigger the mix cannot hear is not a
picture the lens should paint. Only a KNOWN zero gates — a fader never
touched is unknown, not silent. Existing glow decays naturally instead of
vanishing mid-note.