Tepna v2.26.0

Added

• Write a source-hashed manifest for every archived capture night at copy time. (INFRA-STATE-2026-10-31-BRIEF.md)
• Each GitHub Release now attaches the 11 owned bundles as separate downloads.
• Publish the sample rate, the rate before correction and the correction verdict in the shared timing block.
• tools/unit-health.mjs reports a failed, stopped or overdue user timer to board thread 7.
• Record in a published table’s provenance stamp which fold produced the nights it read, so a later re-fold names the numbers it invalidates.
• Hold every consensusBeats call site to a polarity decision a gate can read, and declare the nine sites that stand behind the shipped one.
• Report drift between installed systemd units and their tracked copies. (INFRA-STATE-2026-10-31-BRIEF.md)
• Two new suite gates over the host-axis export blocks.
• Add tools/mutation-draft-py.mjs, the python lane's survivor drafter. The model proposes only the fixture. The harness records every expected value from the real module. It writes a draft only after proving that the draft kills its mutant and keeps the suite green.
• Measure how far the PAT consensus foot set moves when the pinned-span refusal reads the spans parsePPG already publishes. The refusal waits for a _PPGRUNS.txt companion today.
• Hold every declared port to the source text a person last read it against, so a copy cannot keep claiming it is its source.
• Write a shared producerCommitNote into every published-number producer, so each record states what its commit sha is worth.
• Read the radio-clock sidecar and classify each device stream against the brief's pre-stated bands, so a (RADIO-CLOCK-SIDECAR-2026-09-07-BRIEF.md)
• tools/residue-cite-drift.mjs gains a --base <ref> mode and runs under npm run check.
• A source-reading census classifies every open python survivor into six named states. It proves which ones no input can kill, and names the published field a fixture must assert.
• The survivor ledger gains a stale-line state for an entry whose recorded line has grown under it. The closer reads today's source and refuses any other state, and the ratchet excludes the entry instead of counting it as open debt.
• Red a .length read of a validate result, and make the five dead guards fire.
• The PR walker posts one signed comment on each PR it readies, re-runs, rebases, updates or merges, with the UTC time and the reason.
• Let a CLAIM marker name a constant that lives in code, and red a number two mechanisms pin at once.

Changed

• Re-attribute the stage lab's formula terms to what their sources define, add 25 Crossref-verified DOIs to the ledger, and update the oximeter-staging paper's comparators.
• Name, per unstamped trio night, whether any recorded fold ever planned it, so the era census says which nights a re-fold can reach.
• Show each night as one row on the Nights page, and list each recording in that row with its own start and end.
• Tell the survivor drafter which reported field the mutated line feeds, and drain the embed backlog before the model loads.
• Name the fleet walker as the actor at the start of its signature comment, as in "The fleet walker re-ran the failed required jobs".
• Move the capture-host mutation gate to mutmut 3.8.1 and pytest 9.2.0 together, which discharges the 9.1.1 hold at its source. Assert that the two mutmut== pins agree.
• Default an unstamped O2Ring finger recording to the host-disciplined timebase, and publish timebaseSource so a consumer can tell a stamped decision from that default. (RING-TIMEBASE-ECG-TEST-2026-10-29-BRIEF.md)
• Publish the Verity harmonic gate's HR ratio beside its verdict on the trio night page, badged apart from it.

Fixed

• Vigil push alerts now carry their Where/Handle footer.
• Drop the deprecated asyncio policy call from two test helpers and arm a tripwire against its return.
• The board's closure reader no longer derives file names from its own comments or from the import strings its selftest plants.
• The hourly index tick embeds again, and new board posts reach search within minutes.
• The CPAP inventory reads the decoded spool and the live stream's night folders, so it flags only nights that one source lacks.
• ECGDex forwards the spine's inert and drawn reasons, so its exports quote the measured sentence instead of the fallback.
• The mutation gate reads the survivor record at its base. A survivor main already owns no longer fails the PR that touched its function.
• The idle Qwen driver runs in the primary checkout again. It pointed at a retired worktree and failed every 5 min from 2026-10-26.
• Two rig tools stop filling the rig's memory. tools/hook-contract.mjs removes its scratch directories in /tmp when it exits. Before this fix, 3107 of them held 11 GB of the tmpfs. tools/board.mjs gives ccusage a slim copy of the session logs. The board child then holds 0.49 GB, against 4.7 to 6.0 GB before, and the copy gives the same block costs.
• State a reason when the host axis ran and found a drawn counter or an inert host column.
• The PR walker unions its required-context mirror into the degraded path and reports the mirror's drift from branch protection.
• pr-compliance reads a Dependabot PR that touches only dependency manifests as NOT_APPLICABLE. A bot cannot write a Rule 0: line, a trailer or a changeset, so the gate failed #4238, #4239 and #4240 by construction. The exemption keys on the author that GitHub sets in the event and on a manifest-only diff.
• The survivor ledger now reads a recorded line through one home and names six states. An edited line asks for a re-recorded mutant id, and a module-level twin of its text no longer retires the entry.
• Stop false sensor alarms after a daemon restart and for a device on its charger.
• Gate the archive copy on whether a night's device data is still arriving, not on whether any
• Point the corpus archive link and the fold rescorer at the vigil copy that still grows. A rig reader read a tree frozen on 2026-10-07.
• The capture box no longer reports a night ended while it is itself downloading from that device.
• Run the covscope gate leg in CI as well as locally. Hold every blocking leg of capture-host/check.sh to a declared step in the workflow.
• The host-axis bakeoff and the geometry scan publish the population each one-file selection was drawn from.
• The python-lane drafter keeps a fixture that kills every mutant on a key, each by its own path. It no longer demands one path shared by them all.
• The ECG fold tells an unread blanking sidecar from an absent one, and carries the refusal reason onto the merged record.
• Read the ECG sidecar's channel column against the file's own declaration, so recorded blanking runs reach consumers. (SAMPLE-VALIDITY-ENVELOPE-2026-09-17-BRIEF.md)
• Name an unread ECG validity sidecar on the ECGDex node-export. The key annotates coverage rather than refusing a value, and a clean export still carries no key at all.
• Stop the connected-but-silent alert from firing while the box itself explains the silence. A device in an offline-recording op or off the body now reads like one on its charger.
• Refuse an unknown flag in the python-lane drafter and print its usage, so a typo no longer starts the night model run.
• Hold every held-back provenance field to a residue row the ledger still reads as open, so settling a row cannot orphan the exemption it excused.
• PpgDex and ECGDex forward hostAxis.ok into recording.hostAxis. Both blocks ship only when the gate
• Rule 0 now de-ranks a memory lesson that declares its successor. tools/memory-supersession.mjs reports every lesson whose lead cites a board post the fleet replaced.
• Each mutation gate's pre-stated criterion now names its own scope and its own count. The Python diff gate emits blocking_survivors_in_changed_functions, since entry_matches_function selects whole functions. Its bound takes what split_inherited and classify leave. The JS diff gate emits blocking_survivors_on_changed_lines, because tools/mutate.mjs filters each mutant through the touched line set. The old survivors_on_changed_lines over-stated the count in both lanes and misnamed the scope in one. A pin in each lane now holds its name beside the reason the two differ (residue 2026-10-31-the-mutation-verdicts-criterion-names-lines-not-functions).
• The capture box sends one "night ended" note per device. A night-long stream that stops in the morning no longer raises "sensor offline". An ntfy topic shows an alert as text, not as raw JSON.
• The survivor ledger retires an entry whose mutated line is gone from the source. The close path checks that itself and refuses the flag on a line that is still there.
• Read the measured per-sample axis at each sub-sample PPG foot in the two PAT analysis tools.
• Read the drawn and independent verdicts before quoting a host-axis rate, so the published reason names the real refusal. (PPGDEX-SUBFLOOR-RATE-TEST-2026-10-29-BRIEF.md)
• The python drafter runs its machine check inside the attempt loop and hands each retry the measured reason it rejected the last fixture.
• Push true civil time to the ring's onboard RTC. A capture session that absorbs a DST relabelling no longer stamps the ring's own stored header an hour ahead.
• Open a nights recording only from a non-empty file that an analyzer reads. Clock logs, link logs and empty charger sessions then make no rows.
• Stop the held-open alert when the box rewrites its own verdict files in a finished night.
• Correct the archive-pull header, which denied a NAS push the box makes nightly, and gate the
• Give the CPAP a night-ended alert, plus fixes for three false or misleading sensor alerts.
• Let a caller pin the timestamp the ring auth frame carries, so a byte-for-byte test stops racing the clock.
• The source-equivalence census splits not-an-initialiser into the three answers a fixture can act on, so one class no longer counts o...

Tepna v2.25.0

Added

• Add trio-batch --check-markers, which runs the production resolver against every .superseded marker under a root and reports one verdict.
• Restore the ring's recording state after a host restart, with the counter the close measured. (O2RING-BOOT-RECOVERY-DECISION-2026-10-28-BRIEF.md)
• Confirm the ring's recording close against the pulled session's own declared duration. (O2RING-BOOT-RECOVERY-DECISION-2026-10-28-BRIEF.md)
• Give the paper's per-epoch rMSSD bias, SDNN bias and jitter-budget k-fit a committed producer. Re-cut the published panels from it. The jitter model does not reproduce, so the paper retracts it.
• Publish PpgDex's offset segmentation on the analysis result and in the node-export, so a reader can see it.
• Census the ring host axis per raw fragment behind every folded night.
• Decompose each ring night's published host-axis rate into five named causes.
• Every node-export now carries recording.timing, nine keys built by one function (DEVICE-TIME-HANDLING-2026-10-29-BRIEF.md)
• DexClock.hostAxis publishes spanMs and spanPpm beside its ppm, and PpgDex and ECGDex forward
• Add a shared clock-seam tripwire and wire it into OxyDex and PulseDex, refusing windows a mid-file step crosses. (DEVICE-TIME-HANDLING-2026-10-29-BRIEF.md)
• Drive each flag-exit census tool past the statement its health flag skips, and exclude the three it cannot drive with a measured reason.
• Measure which tools exit a health flag above module-scope evaluation it never reaches, and ratchet the count.
• Add a radioclock verb to the capture-host restart helper, which restarts the radio-clock collector alone and reports its journal line.
• Add rebase-safe --resolve <path>, which takes the ref's bytes only for a path a builder
• Add an opt-in --tree walk to secret-scan.mjs. Every verdict now names its walk, so a diff green states no claim about the tree.
• Commit a PpgDex twin whose host column is an independent clock, so a fixture pins the disciplined axis.

Changed

• Publish the enumeration each of the three CPAP-corpus readers walked. Name the members nothing scored, and exit 2 on a run that scored nothing.
• Remove every home-directory path from the tracked tree. Executable code reads homedir(), $HOME or Path.home(), and tools/home-paths.mjs holds one definition and one selftest for each default. Docs, briefs and the dated audit records carry a ~/ prefix instead. Behaviour on this machine is unchanged, and git history is untouched.
• OxyDex publishes its retracted respiration rate as a null with a named reason, proxy-uninformative, in the export and on reload. The estimate reads r = 0.046 against two inductance belts, so it publishes no number. The reason lets a reader tell a withheld value from an unmeasured one.
• Publish the trio night population behind the four readers that score over it, and exit 2 when a run enumerated nothing or scored nothing.
• Give the journal severity prefix one owner, so both capture-host units express the same scale.
• MotionDex now disciplines its device counter against the host column. It detected a counter resync and corrected nothing. Every position it published rode the device crystal, because relSecOf divides relNs by 1e9 and reads nothing else. (DEVICE-TIME-HANDLING-2026-10-29-BRIEF.md)
• PpgDex publishes rate, rateReason and rateApplied beside the host axis ppm, so a reader sees (PPGDEX-SUBFLOOR-RATE-TEST-2026-10-29-BRIEF.md)
• Pin the shared timing block's sanitisers at the edges the mutation lane found unexamined. (DEVICE-TIME-HANDLING-2026-10-29-BRIEF.md)
• Give witness-baseline a declared --max-probes budget and --state-dir, so the flag-exit drive reaches its risk line.

Fixed

• A journal clock record reaches both A5 arms when it names the device by address.
• State how many journal clock records named only an address, so the A5 record set stops reporting a source that matched nothing.
• Pair the H10 chest ACC with its …_ACCRUNS.txt sidecar by exact name, and refuse every respiratory window that leans on a recorded blank span. (SAMPLE-VALIDITY-ENVELOPE-2026-09-17-BRIEF.md)
• Mark a board post the board itself replaced. Read the claim protocol and an active reference. Print the abstentions beside the marks.
• Shell the board renderer's own copy of each tool, so a pinned renderer runs current release and usage code.
• Compare each renderer file in the tree it would load from. An import loads from the board's own tree and a shelled tool from the checkout it reports on. Name the tree beside every drifted file. Report a derived name that resolves nowhere as the reader's artifact.
• Read the brief guard's verdict off the write target, not off the write verb. A program that names a guarded doc inside the data it writes elsewhere no longer denies. The scan resolves one level of literal assignment, so a target behind a variable still denies. An unresolved target, a shell-out and an unreadable literal all fail closed.
• Measure the era census against every reader triple, not only the three the fold itself writes. (FOLD-ERA-STAMP-CONTRACT-2026-10-28-BRIEF.md)
• Five single-root capture readers now publish the files they walked, name the remainder they left unread, and refuse a root they cannot enumerate.
• Four fold-and-cohort corpus readers publish the population they walked.
• Say which recorded fields the fold held each .superseded marker to, and count the markers it held to none.
• Hold the capture daemon out of needrestart, so an apt upgrade stops restarting it mid-night.
• Report the night population four corpus walkers read, and refuse an unreadable root instead of reporting zero nights.
• Point eleven corpus runs at the shared NIGHT_RE instead of a hard-coded year, so each one scores a night from any year.
• Publish the record population the three NSRR cohort readers walked, and refuse where they scored nothing.
• Publish one population object per unit from tools/oxy-hr-bias.mjs: the O2Ring CSV files under
• Pair each PAT waveform with its …RUNS.txt validity sidecar by exact stamp. Refuse the R-peaks and PPG feet inside a recorded span. Divide the leg's rate by the time it measured. (SAMPLE-VALIDITY-ENVELOPE-2026-09-17-BRIEF.md)
• Publish the file population pin-coverage scored over, summed across every --dir root by file set, and keep the throw count a resume inherits.
• Name the condition behind the re-judge tear: the bracket's work ran in the capture process before #3554.
• Sink a board post the board itself replaced below its unmarked peers in both Rule 0 lanes, and name the successor that replaced it.
• The ring's signal witness now reads its counter by header name, and after a stall it reads the settled (SOLID-NIGHT-2026-09-23-BRIEF.md)
• Five single-root corpus enumerators publish the population they walked, each through the primitive that matches its unit. An unreadable root now refuses.
• Place each timeline bar at its stream's first landed row when the acquisition sidecar states it, and name the source of every start.
• Four recursive corpus walkers publish the tree they walked. Three name the files their one root offered and refuse a root they cannot enumerate. edge-settle.mjs counts every night directory the walk offers, rather than dividing by the nights that survived its read.
• Carry the offset segmentation and the clock resyncs of every ring fragment into the folded night, on the merged axis.
• The trio fold now reads the validity sidecars the box writes. tools/trio-batch.mjs hands _ECGRUNS.txt to the H10 ECG parse and _PPGRUNS.txt to the Verity and the ring PPG parses. Before this change a blanking run the box recorded reached ECGDex and PpgDex as signal. (SAMPLE-VALIDITY-ENVELOPE-2026-09-17-BRIEF.md)
• Collapse the walked root at both population publish boundaries, so no committed verdict carries a home directory.
• The PpgDex app now corrects its sample rate against the host clock. PpgDex.src.html inlines clock.js, so the typeof DexClock guards in ppgdex-dsp.js reach DexClock.hostAxis in the browser. Before this change the app refused the axis with no clock spine in this bundle and kept the device rate. The fold and the test suite loaded clock.js and corrected the rate. So the app and the corpus disagreed on every Verity night and every host-disciplined ring night. An unstamped finger night stays on the 125 Hz crystal by design (ppgdex-dsp.js:1446). (DEVICE-TIME-HANDLING-2026-10-29-BRIEF.md)
• Scope the published AS11 clock offset to the capture session, so it no longer medians two months of anchors. (DEVICE-TIME-HANDLING-2026-10-29-BRIEF.md)
• Close the CPAP link when the live stream ends on its own.
• Read the flag-exit census risk outside every function body, so a declaration counts as no load.
• Deny a stale-brief write whose target the program reads from argv, when the interpreter's arguments name a guarded doc.
• Deny a stale-brief write whose target the program builds from literal pieces, when the join names a guarded doc.
• Teach the mutation hygiene scan the read that names its module only through an import alias.
• Open the O2Ring PPG from the Nights table when the Verity recorded nothing.
• PpgDex's rateApplied now reads the published rate, so a correction the 0.01 Hz rounding erases reports false.
• Read a controller's address from the kernel when sysfs publishes none.
• Refuse an unknown argv token in rebase-safe.mjs instead of reading it as nothing and rebasing.
• Run the rebase-safe checkout refusal on a CLI run only, so an import survives.
• Give the regex escaper one home in the tools tree, and import it at every site.
• Escape every metacharacter in a function name the adoption gate puts into a regex, not only the dollar sign.
• Sweep selftest-all.mjs as a member of its own population, so the local gate runs the
• Stamp the night directories a webmon fixture compares, so its control no longer rides fil...

Tepna v2.24.0

Added

• Record the absorbed civil shift in the per-night host-clock sidecar, so a night states how wrong its absolute stamps are.
• Mark a residue citation as a CORRECTION in the pickup listing, and name the verb it cannot attribute.
• Measure the year a declared night rule stops scoring, and red the day the corpus crosses it. Eleven shipped rules under tools/ refuse every night outside the corpus year. The gate names the earliest horizon and the tools that carry it. The reader compiles each rule and probes it, and it fails closed on a site it cannot resolve.
• Publish the PpgDex clock seam on the node-export, so a folded artifact can count seams rather than only bound them. A seamless night omits the key, and the entries carry the device step with the phone delta present as null when nobody measured it.
• Add the one-night Verity SDK-mode trial. The owner reads the runbook, then runs a CLI that writes two config keys and proves only those two moved. The decisions it runs on sit inside the coverage floor.
• Re-derive the census of files that read a 14-digit filename stamp from a computed predicate, and route two sleep-night filters through the stamp owner.
• Measure which trio exports carry a recorded code era, so the exports sitting in a night the fold
• tools/board-share.mjs measures how much of Rule 0's top five the agent board takes, so the owner
• Add tools/checkout-advance.mjs — rank what blocks a fast-forward of a checkout, naming which blockers are byte-identical no-ops.
• Add corpus-scope.mjs --nights, a recursive census of the corpus size. It counts night-shaped directories and distinct names apart, and states its walk depth and rule beside the figure.
• Publish who held the event loop beside the stall bin, from the two instruments the daemon already carries. An instrument that was not armed says so by name.

Changed

• Carry the enclosing function in an equivalence entry's key, so an edit above a recorded mutant no longer detaches its excuse. (MUTATION-PROGRAM-2026-08-09-BRIEF.md)
• Decide the residue citation drift tool's --strict exit on the three classes it ranks as defects, and never on a moved line hint.
• Record the night keying the sensor-trio paper's real-data section rode. A re-run of the (FILENAME-STAMP-JS-CONSUMERS-2026-10-20-BRIEF.md)
• Void the mutants a write landed inside, rather than annotating a whole sweep whose input moved.
• Lift the O2Ring data callback out of run_oxyii into three typed module-level functions.
• Re-cut the six cohort-pinned papers on today's code, replace the published numbers,
• The population half of corpus-scope.mjs moves into corpus-scope-core.mjs, which writes, execs and fetches nothing. The commit read now parses .git instead of shelling out. The old git rev-parse reader stays beside the selftest as its oracle. Every delegating tool points at the core, so the probe-safe population grows from 41 tools to 67 with nothing lost.
• Close the detector-drift papers row and the sweep-seam row, and log the absent
• Delete every equivalence entry whose mutation the generator no longer produces and whose text its file no longer holds. Settle each multi-candidate drifted entry against a probe of every site it could name. Grant a function qualifier only where exactly one generated mutant carries that identity. (EQUIVALENCE-ORPHAN-RULING-2026-10-28-BRIEF.md)
• Close two residue rows against the citers that corrected their figures, and log
• Answer the daemon RSS climb row with ten box nights after the QC scan moved to a child.
• Delete the sixteen capture-host literal defaults that no call ever takes, so those parameters become required. Each deleted default now has a test that observes the value where the code hands it over. nightqc.constant_runs walks its samples with enumerate, so the mutation gate can decide its mutants.

Fixed

• Date a live Polar artifact by the arrival of its first landed row. The session start keeps its own name in the envelope's provenance.
• Stop citing a mutation batch label as a residue key: 31 pointers now name the pull request that made them.
• Stamp an absent code identity with the reason the lookup itself reported. A failed rev-parse inside a checkout no longer reads like a run with no tree.
• Split the cite-drift tool's missing-file bin by evidence. A path whose spellings appear nowhere in
• Name the corpus entries no night rule counted, so a record-keyed root is no longer published as an emptied corpus.
• Cancel the cpap poller inside its loop, so the leg naming the shielded teardown counts that release and not the entry sweep's.
• Say what releases the CPAP card when the poller's teardown runs under a cancellation. The executor
• Make the stale-brief denial name the arm that fired and where each candidate path came from.
• Derive the default-rule answer at the two snapshots that asserted it. Red a hand-written answer that contradicts the rule beside it.
• Name the cause each unwalked hop actually has. The measurement walk reported an absent input whenever a guard needing two things lost either one. The hop's NOT_RUN state now rides a flag rather than the word absent in its own sentence.
• Stop an entries-walk snapshot from answering a night-rule question nobody asked of it.
• Name the lister that chose a non-night population, and publish that name in the verdict instead of dropping the caller's one selection decision.
• Four corpus enumerators report the file population they walked, through a named lister and a
• Read the harness under the defect-shape bans through a second derived population over tests/*.mjs.
• A night-shaped directory the oracle's own year rule refuses no longer reads as a flat root. The
• The PAT feasibility page keys a night on the first data row. The stamp in a capture filename is (FILENAME-STAMP-JS-CONSUMERS-2026-10-20-BRIEF.md)
• Re-anchor the drifted mutation-equivalence entries, each one probed at its new address.
• Name the rows and pointers behind the unanchored and beyond-eof citation verdicts, so a reader can chase the classes the report only counted.
• Compare the four runtime floors in capture-host/requirements.txt against the gate's interpreter, which no gate did before, and name the declaring file on every row.
• Skip the equivalence-ledger qualifier checks where the JS lane is absent. A mutation sandbox no longer reads this lane's own ledger under the JS lane's name.
• Deny a guarded brief path in interpreter program text unless a read form stands beside it. A write shape the guard never enumerated no longer passes.
• Let the stale-ledger guard allow a command that only prints the ledger path, or names it in a commit message. Every read, write and redirect stays denied.
• Read a declared night rule as code. A rule bound one line earlier and passed by name was invisible
• Name the axis the published reference rode, and say so when the record states none. The card printed the corner axis as a complete provenance clause while the record carried nothing about the reference's own axis. A ratchet now detects a published record that outlives a producer field.
• The night judge now annotates an axis segment too thin to measure. It judges the segments it can, rather than taking the whole device to UNKNOWN.
• Say what the literal-default scan read. An uncovered default is one that no test call omits, and
• Read a changes/<key>.md filename as a path rather than as a residue citation, and red when a
• PpgDex publishes a tri-state drawn-axis verdict. An unmeasured delta concentration now reports null rather than false, so an uncounted column no longer earns the top timing tier. The node-export reshape forwards applied as well, which a drift reader needs before it counts this node's absorbed rate correction twice.
• The fleet board's plan pace no longer spans a weekly reset. The pace is now measured between two readings carrying the same resets stamp. A week holding one reading refuses with a named reason instead of publishing a negative rate. The evaluation parser now accepts a heading written with a Markdown prefix. A new tripwire names the running checkout when its copy of tools/board.mjs differs from origin/main.
• The fleet board's solid-night streak now skips a night whose verdict predates the end of its own band. Such a night neither extends nor resets the streak, and the card names it as pending. The reader of the band is the verdict's own result.scope.band, so no rule keys on the folder date any more. A verdict stamped after its band ended still counts. A PASS carrying no band, or none of its own verdict time, stops the streak with a named reason.
• Give the re-anchor census a verdict the contract accepts. A run told not to probe is
• Resolve five code citations of a residue key: two gain a row, two name the row they
• Bound the digit run in CPAPDex's two node-local filename-stamp readers, so a fourteen-digit window inside a longer token stops parsing as an instant.
• Take the instant in five filename-stamp readers from the one stamp owner, so an out-of-range
• Name why a folded night carries no stamp. Separate a night whose third device never recorded from one a failure left half-written. Record the reason, the nodes the night had input for, and the exports on disk in the run ledger.
• Score a mutation run the harness killed as INVALID in both runners, so a verdict stops depending on the load on the box.
• Measure whether the fast-forward the hook-liveness reader prints can run. Name the paths whose uncommitted lines block it. Report whether the measured checkout carries the reader.
• Pick each equivalence probe's target with the key the plan decided with. A sibling mutant on the same line can no longer stand in for the entry.
• Date the live O2Ring acquisition envelope by the SpO2 CSV's first row, never by the capture process start. A resumed file reports neither a start nor a sample count.
• Offer the one command that makes a behind ch...

Tepna v2.23.0

Added

• Record the corpus tree a published number came from, proven against the record's own digest. A squash merge does not keep the commit a record names.
• Record which corpus FOLD a published number was cut from, and re-resolve it afterwards.
• Report which copy of each guard hook would actually run. tools/hook-liveness.mjs reads every script named in .claude/settings.json three ways. It digests the bytes on disk, the bytes at the live tree's HEAD, and the bytes at the ref. So a checkout that has not pulled a landed fix reads apart from a hook someone edited in place.
• • A new tool, tools/board-note.mjs, lints a board note and posts it. Chained onto a finishing command, it clears the finish hook.
• Add a Batteries card to the capture-host monitor, a push alert at 20 %, and a push plus email at 10 %.
• Publish what the daemon:event-loop stall bin covers in LOSS-AUDIT.json and in the night verdict. The object names the daemon's two thresholds and its limiter period, and it keeps the suppression count null with a reason.
• Two corpus enumerators now report the population they walked. The gap-bridge scan reports it in files: the O2Ring*_PPG.txt name is the selection, and --top narrows the scan rather than the offer. The comb sweep reports it in night folders under its own wide rule, which names the non-night folders it counts. Each one names the members it did not score, and each emits the verdict alone for the adoption gate.
• The residue pickup listing names the rows that cite each open row, and it reports the state each citing row carries.
• Gate whether a residue key cited in code resolves to a row, over one pre-stated ladder.
• Give the four tch- corpus readers a --verdict-sample flag that exits before the first corpus read. Each one now adopts the verdict contract with a corpus-free command, and the two that decided in prose alone print their population object beside it.

Changed

• Update the text of the about page.
• The acquisition-evidence envelope refuses a word no reader knows. The module declared five vocabularies as bare string constants and validated none of them. A producer could write host_only, and every consumer would read that as unknown. Each vocabulary is now a tuple derived from those constants. Construction refuses an unlisted word, and UNKNOWN stays legal in all five. The one production producer that assembled outside a guard now carries one. (ACQ-EVIDENCE-CONTRACT-2026-08-24-BRIEF.md)
• A tool that declares its own night rule now names what the rule refused and what it swallowed. The rule ran inside the walk, so the population it narrowed left no trace.
• Give every published control in the apnea harness its own night count.
• Report the night population every collocation run covered, and name the nights it could not score. Pin the solver's 2-fold ambiguity with known answers.
• Report the night population each PAT run covered in four more analysis tools. A named-night tool now separates a night the root never offered from a night that offered no usable pair.
• Report the night population four PAT and movement runs covered. Name the selected nights each one scored nothing over.
• Report the night population the offset-constancy and matchRate runs covered, and name the nights they skipped.
• Report the night population the fiducial and ACC shortlist comparisons covered, and name the nights they skipped.
• Name the nights a read removed from one place. Both device oracles carried their own copy of that set arithmetic, and only the sentence about what the night lacked differed. tools/corpus-scope.mjs now exports the namer beside ruleLine, which is the walk half of the same account. Each oracle keeps its own sentence and its own acceptance legs over its own row shape. A re-duplication now reds in the suite.
• Make the corpus-tier run print the memory it holds.
• Pin that the fold plans one child under the shipped 4 G fence on an 8 GB box and on the (VIGIL-SELF-SUSTAINED-FOLDING-2026-09-01-BRIEF.md)

Removed

• Hold every file to one lint standard. biome.json no longer lowers noUnusedVariables for synth-gen.js, and this drops the two sites that exemption covered. The suite reds any override that lowers a rule the top level makes an error.

Fixed

• Read the path a tool WALKS, not only its text. A repo-rooted walk under uploads/ now joins the hazard set. The class repo-corpus owes a population verdict or a named row.
• Write a settable device clock before PMD start, and name the cause when the watchdog declines a clock.
• Let wt-done retire a worktree whose branch adds no commit to origin/main. A branch that rebased to nothing adds no identifier, so the strongest proof scored lowest. The tool now measures emptiness on the merged path too, and --list reports the same decision the run makes.
• Resolve an enumeration argument through the binding in force, so a corpus path bound to a variable counts as a corpus read.
• Test the five-second bound the exit drain uses when no caller names one, and drop the equivalence entry that called that default untestable.
• Hold the fixture verifier's whole program behind its CLI entry guard. An import of the file now runs no fixture and stamps no provenance fragment.
• Register a helper written as const f = function (…) as a local function, so the corpus scan follows a flag read into its body.
• Read a dashed flag from the raw text, so a path a run supplies is not a repo walk. The helper the file does not declare is the shape that used to clear.
• Pair every module-scope --selftest read with the CLI entry guard, so importing a tool no longer runs its selftest on the importer's flags.
• Separate a directory that was never a night from a night whose fold never finished.
• Assert in the mutation crawl's selftest that its planted process tree is gone once the bounded call returns. The plant now announces its pids, self-destructs after 300 s, and runs in a scratch directory, so an escapee holds no worktree open.
• Name the PR whose rollup reads green while a second, non-success run holds a required context, and print the run ids that clear it.
• Decide a dotted call on its parts before the repo name rule. A flag-supplied path is no longer a repo walk.
• State device for a stored O2Ring pull instead of UNKNOWN, and carry the trailer's own start stamp into the envelope. (ACQ-EVIDENCE-CONTRACT-2026-08-24-BRIEF.md)
• Enrol a tool by the selftest it declares, not by how it spells its flag read. Four tools no gate ran now run in the sweep, and three of them carry a real flag refusal.
• Name the anchor a stale source scan looked for. The idioms it replaces either raise an index error naming nothing, or widen the window to the end of the module.
• Refuse to remove a worktree an installed systemd unit names, because a periodic consumer holds no process between its runs.
• Stop stamping an absent code identity under a cause the run never checked. The night population primitive reads its own commit, and a reason appears only when that read fails.
• The board reads the tag, the ledgers and the roster from origin/main, and a finished release-land run no longer reads as stuck.
• Publish a NOT_RUN verdict with the night population when oracle-ecg-firmware-rr.mjs finds no H10 ECG+RR pair. An absent root and a root holding no pair then stop reading alike. A run that scored nothing exits 2.
• Keep a ring file set with no row in the worn interval from deciding the night judge's completeness band.
• The monitor's night chooser reads per-file capture writes rather than the night folder's mtime, which an append never moves.
• Publish a NOT_RUN verdict with the night population when oracle-ppg-device-beats.mjs finds no ring session file. An absent root and a root holding no _PPG.txt then stop reading alike. The verdict's population now counts nights, matching the unit of its own floor, and a run that scored nothing exits 2.
• Report the night population when tch-reference-validation.mjs refuses an absent nightly volume, and exit 2 when it scores no epoch.
• Stop clearing a corpus reader on a population verdict it builds only for its sample flag. Blank the sample and selftest helper bodies before the census asks.
• Twenty-eight capture-host source scans now name the anchor that moved, and one of them had widened to its whole window in silence.
• Report the night population each trio-root run covers, and refuse a run that covered none. tools/ecg-apnea-correlate.mjs, tools/deep-vlf-probe.mjs and tools/pb-agreement.mjs now snapshot the root before the walk and again after it. Each publishes that comparison as a corpus-population verdict and names every offered night its read removed. tools/corpus-scope.mjs answers NOT_RUN for a readable root that offers no night, where it used to throw at its own caller.
• Drop deferred-after-pause from the SOLID-NIGHT A5 record set, because that word records no clock write and 968 corpus rows carry it.
• Enumerate the adoption population by publication over comment-blanked source: a wrapper-built verdict now joins it, a word inside a comment no longer does. (VERDICT-CONTRACT-2026-09-21-BRIEF.md)
• Derive the live CPAP envelope's clock_status from the raw record's own facts, so the rail names the clocks that stamped it instead of declaring UNKNOWN. (BLE-TIMEBASE-EDGE-STAMP-FOLLOWUPS-2026-10-25-BRIEF.md)
• Type the three acquisition-evidence count fields as a count or UNKNOWN. A strange word now reds mypy, so a producer learns at type-check time rather than a night later.
• Publish the night population each of five corpus runs walked, so a figure no longer stands over an unstated set.
• Verify that the kernel honoured the peak reset, and name the refusal when a write landed and changed nothing.
• Feed the mutation scratch's root-read stager from the traced manifest as well as the static scan. The one dotted read the suite has then reaches the scratch, and t...

Tepna v2.22.0

Added

• • Add tools/argv-reads.mjs. It reads every line of a tool that touches process.argv and says whether an unknown token could reach the work. It proves 142 of 258 tools blind to a token nobody named. It names 7 that could consume one into a path, and abstains on 82 with a reason.
• Publish the BLE op counters as a journal series and a monitor card, with the
• Red the capture-host gate when a tools/*.py sits outside the coverage report with no pinned reason. An unmeasured file no longer reads as 100 %.
• Draw the daemon memory series on the monitor Storage view, one line per daemon process, from the daemon journal lines.
• A new PROPOSED brief measures the cost of generated trees in PR diffs and states the sequence for a batching merge queue. (GENERATED-OUT-OF-PRS-2026-10-20-BRIEF.md)
• Measure what moves the chest strap's per-session ECG rate. A new tool reads every exported stream. The two axes' guard asymmetry accounts for none of it.
• Add verify:hook-contract. The gate reads every Claude Code hook three ways.
• Derive an AHI per recording from the two annotated open mirrors with tools/derive-open-ahi.mjs. It reads its own xlsx, counts only scored sleep stages, and refuses an absent scoring by name. (OPEN-DATASET-AHI-DERIVATION-2026-10-12-BRIEF.md)
• Add CPython arena counts, held bytes and live bytes to the daemon memory journal line.
• Give tools/residue-ids.mjs an --open mode that reads the ledger from origin/main and names every row whose state on disk disagrees. A read it cannot resolve refuses by name.
• Enumerate every literal default whose only coverage reads a signature. Such a read passes under every mutant, so the default is unmeasured.
• tools/secret-scan.mjs scans the commits a PR adds for credentials, private and shared addresses, home-directory paths and the private literals in the TEPNA_PRIVATE_TERMS secret. The secret-scan workflow runs it with a pinned scanner, verified by checksum. The check is not required yet.
• Add a --reference-axis flag that places the firmware-reference beat clock on the corner's own corrected axis. Carry that axis through the ledger key, every row and every verdict. Decide the published H10 gap with a pre-stated axis-match verdict. (TCH-REFERENCE-AXIS-MATCH-2026-10-20-BRIEF.md)
• Observe two worn-verdict properties the suite could not see: the level detector's rate, and an abstention beside a verdict.
• Draw the per-device BLE error-backoff rate as a curve on the monitor Devices view, one line per
• Classify every tool that reads the capture corpus. Wire pat-dip-index.mjs to report the night population it covered. Pin the 41 enumerators that still report none by name, never by count.
• Measure the night population a corpus-backed run covers, and say so when it moves mid-run. tools/corpus-scope.mjs gains a snapshot of the night set, an intersection and a corpus-population verdict. The firmware-reference tool takes one snapshot before it enumerates and one after it scores, and reports its figure over the intersection.
• Count the string-literal mutants the mutation gate excuses, over the verdicts CI already uploaded. Name the share that reach an interface.
• Mark each OPEN residue row that a later code commit names in the --open pickup listing, as a lead and never a close.
• Give every live Polar stream artifact an acquisition-evidence envelope, with the clock word derived from the artifact's own header. (ACQ-EVIDENCE-CONTRACT-2026-08-24-BRIEF.md)
• Carry an acquisition-evidence envelope in the sidecar of a Polar onboard recording pulled over PS-FTP. The stored half now states what the pull verified about the bytes, whether the device's listing answered, and which clock stamped the samples. (ACQ-EVIDENCE-CONTRACT-2026-08-24-BRIEF.md)
• Deny a read of the residue ledger in a checkout whose row states disagree with origin/main.

Changed

• Show the owner decisions only in their own board card, and cut them from the daily evaluation card.
• Report the distinct-subject pooled figures beside the all-files ones, so nobody quotes three repeated ISRUC workbooks as three subjects. (OPEN-DATASET-AHI-DERIVATION-2026-10-12-BRIEF.md)
• Report every ISRUC event token the AHI derivation cannot name, and decline Cheyne-Stokes breathing by name. (OPEN-DATASET-AHI-DERIVATION-2026-10-12-BRIEF.md)
• Record what the JS diff-mutation job costs on CI, so a diff sizes against a measured factor. Name the run its step cap already stopped.
• Tally every iSleeps Event name the AHI derivation cannot place, and separate a measured zero from an unexamined set.
• Document one pickup path for a residue row: read the ledger from origin/main, never from the working copy. CLAUDE.md §📌 gains the rule, and the rationale records the four wrong reads behind it.
• Re-measure the sigma paper's folder-ingest population under the widened classifier, and record the result beside the figure it supersedes.

Removed

• OxyDex's legacy profile form path is gone: the shell carries none of the eleven prof* ids it read or wrote. The noUnusedVariables downgrade that hid it now covers one file instead of four.

Fixed

• Record the 0x03 reply's [0:4] header word per reply in probe_oxyii_0x03.py, and correct the three source claims that still called the field unexamined. (RING-POLL-SPLIT-2026-10-04-BRIEF.md)
• Every tool's unknown-argv refusal now runs behind IS_CLI. Importing one of the eleven module-scope adopters no longer refuses the IMPORTER's flags. A suite tripwire reds the next call written at module scope.
• Refuse an unknown argv token in the seven tools that took one as data.
• ble_visibility.visibility now tests the type of each persisted map, not its truth. A record whose adapters, adapter entry or targets is not a map no longer crashes the digest.
• The gap mask PpgDex's CVHR detector runs on now leaves the node. analyze published (PPGDEX-ALGORITHM-DEEP-DIVE-2026-07-21-BRIEF.md)
• Refuse an absent, empty or mis-aimed capture directory by name, instead of a stack trace or an empty table.
• • tools/edge-settle.mjs reads each night's .trio-stamp and measures the nights the fold folded. It walked every directory under uploads/trio before. A night the fold REJECTS keeps the exports of whenever it last passed, so the walk pooled two code eras. (EDGE-SETTLE-FLOOR-2026-10-18-BRIEF.md)
• Read an equivalence key the way a diff writes one, so a module-level line stops reporting ORPHANED. A committed check now names any entry whose before text has left its module. The diff-scoped mutation gate can reach a verdict on this module again. The leg that needs a git base version now skips inside mutmut's scratch copy. Failing there took the whole run's stats with it.
• Deny a depth-limited git fetch or git pull in the shared-tree guard, because it writes .git/shallow for every worktree and stops each session's npm run check.
• Drain a hook's stdin with a builtin before its early exits, so a hatch release no longer leaves the harness holding a closed pipe. Two self-tests gain the leg that watches the writer.
• Attribute a capture gap that opens inside a job the box declared for itself to that job. A ring gap the daemon's own re-judge tore now names the program, not nobody.
• Bind mutate_diff.py's retry counter beside the other names emit reads, so the three early returns emit their verdict instead of raising NameError.
• Price the mutation gate's cost projection over the mutants a diff run will actually test, not every mutant in the file.
• Re-run a mutant that hit the per-mutant clock once at mutmut's own wider bound. A mutant whose cost is a wait then reads killed or surviving, never UNDECIDED.
• Fail the capture-host gate when the mypy count rises above its baseline, which has been zero since 2026-10-09. The CI ratchet now reads that baseline from the constant, not from a comment quoting an old value. The gate's verdict object also carries a contract for the blocking format leg. (PYTHON-TYPES-AND-FORMAT-2026-08-27-BRIEF.md)
• Write the semantic tag in PpgDex's app export and route the upload filename to a key that means a filename. (EXPORT-SOURCE-KEY-KINDS-2026-10-20-BRIEF.md)
• The three PulseDex dispersion helpers answer null for an input too short to measure, not 0.
• Name each DIRTY PR in queue-doctor as a display artifact or a real conflict, from a local merge probe.
• Ask each regenerator which fixtures it owns, so rebase-safe rebuilds a reproducible uploads/ fixture and holds the rest with the reason named.
• The seal scratch fixture copies verify-seals.mjs's import closure instead of a hand list, so a tool
• Drain the SessionStart payload in session-tailnet.sh before its two early exits, so that a payload over the pipe buffer cannot kill the writer.
• Pin each SignalSpec resolver object to the namespace its emit shim reads, so that a drift between GLUDSP and GlucoDex reds the suite.
• The sigma-no-reference hat now reads the capture-host filenames. Its classifier took the phone-app layout only, so it indexed 337 of the corpus's 28,958 recordings and 31 nights. It now takes both layouts under one rule per role, which reaches 7,329 recordings and 123 eligible nights. That eligible count matches the sibling hat exactly. The function now carries the name classify, so the capture-host test table indexes this page too.
• Give the trio fold a verdict over its outcome, so a night with a failed node reads FAIL, not PASS.
• The tri-device HR walk now reads the capture-host’s validity companion at all three of its sample
• • Two pages now group a dropped folder into nights on each file's FIRST DATA ROW. The 14-digit stamp in its name no longer decides. The capture-host writes that name when it OPENS the session, before the connect. A stream that starts hours later still carries the earlier name. (RESIDUE.md)
• Say that a PMD settings read returned no rate menu. The old line called it...

Tepna v2.21.0

Added

• OverDex now routes a Polar ACC file to MotionDex as its own node. The new polar-acc adapter reads the H10 chest ACC and the Verity Sense arm ACC with MotionDex's own parser and its validity sidecar. OverDex folds a chest and an arm ACC from the same night into one MotionDex run, so the Integrator receives one MotionDex export. The ACC also stays an ECG and PPG companion, so ECGDex posture and motion gating are unchanged.
• Pull the CPAP stored spool 300 s after each retained therapy session, and retry the next minute when another actor holds the link.
• tools/defect-pin-census.mjs enumerates every in-tree annotation of a test that once asserted a defect. tests/defect-pin-inventory.json carries one entry per annotation, with its mechanism and one line of why. The gate reds on an annotation with no entry, and on an entry whose annotation moved. It reads the annotations rather than the tests, so its counts bound the class.
• The Integrator cell on the box's Nights page opens OverDex with the night's raw files and presses Run & fuse. OverDex runs each analyzer on those files and fuses the exports with the Integrator's engine. OverDex keeps Run & fuse disabled until it has read and classified the files.
• The OxyDex night view shows six charts of the night:
• PAT Feasibility now draws the three legs across the night three ways. Chart a keeps the raw receive stamps. Chart b (PAT-FEASIBILITY-2026-07-08-BRIEF.md)
• Land the sleep-stage lab's research record, paper draft and ECG-HRV feature block. The brief carries every pre-stated (STAGE-LAB-2026-09-27-BRIEF.md)
• Publish the hat's reference check as a record of pooled figures only. The trio card now composes its validation note from that record. No night count and no σ on the card survives as a typed literal. (TCH-REFERENCE-POPULATIONS-2026-10-13-BRIEF.md)
• Measure whether repairing the sensor's autogain level steps before filtering would move the exported (PPGDEX-ALGORITHM-DEEP-DIVE-2026-07-21-BRIEF.md)
• Compare every dev-tool floor requirements-dev.txt declares with the version the gate's own interpreter has installed, and name each shortfall. The leg is advisory: check.sh reports the comparison, nothing blocks on it yet.
• A new measurement tool asks what it would cost to exclude a CVHR decision whose support window reaches (CVHR-HOLE-EDGE-EXCLUSION-2026-10-19-BRIEF.md)
• The capture-host mutation sweep emits one tepna.verdict/1 object at its deciding exit, over the same read of its records that prints the NOTHING DECIDED lines.
• Name the nights whose admissibility depends on which half the PAT oracle estimated its mode from. The mode decides whether the oracle scores a night at all, and the design estimates it on the first half. So every verdict now carries an admissibility class, the run counts the classes, and result.halvesAdmissibility carries the counts. The selftest counts its own assertions instead of printing a typed total. (PAT-FORENSICS-WINDOW-ORACLE-2026-08-28-BRIEF.md)
• Commit the ECG half of a paired night, plus a fixture computed from both halves. A reproducible artifact now pins the SpO₂-plus-ECG fusion block, where before only hand-built nights did. The block mapping moves out of oxydex-app.js into oxydex-fusion.js, which is what brings it within a headless regeneration's reach. (RESIDUE.md)
• Give oxydex-dsp.js its first probe battery, so a surviving mutant in four rows-taking functions answers to execution.
• Name the job that held the event loop: a watchdog thread samples every thread's stack while the stall is (O2RING-FREEZE-SURVIVAL-2026-10-13-BRIEF.md)
• Carry the sniffer timer's state in the adapter-hci verdict. A reader of a PASS night now learns that no radio sniffs, and that owner decision D2 ruled it so.
• Run the capture-host suite in one ordered process on a rig timer, and name every failing test that passes alone.
• verify:analysis now reads the served page.

Changed

• Label a night by the noon-to-noon window it starts in, so no session falls between two nights. The daytime flag now carries its own 10:00 to 18:00 edges. (NIGHT-IS-THE-RECORDING-2026-10-05-BRIEF.md)

Fixed

• Correct two drifted capture-host runtime versions in THIRD-PARTY.md and add the eleven-package transitive closure. Give the four declared libraries their own SOUP-list section instead of the developer-tooling table.
• End the live CPAP stream when the flow value freezes after therapy, at any idle offset.
• Scale the ECG Waveform Explorer's y-axis to the window on screen, clipped at p0.5/p99.5, so one
• The extreme-mutate.mjs selftest no longer calls its arrow-const blindness a limitation that it shares with functionRange. That peer resolves arrow consts since §8. The comment now states that any population this tool surveys, including §11's 543 functions, excludes every arrow const. (MUTATION-PROGRAM-FOLLOWUPS-2026-08-11-BRIEF.md)
• The format guard's BLOCKED message prints the Biome it just ran, with the directory to run it from. It replaces an npx --no-install biome line that resolves npx's cache. The same run now passes --colors=off, so a filename in that message carries no ANSI escape into the shell.
• The brief-header gate now masks a bare month-day such as 09-25 before it looks for counts. A date fragment no longer reads as a count that needs a source. The change retires the 35 baseline entries that were date fragments, so the baseline holds 747 entries. (BRIEF-HEADER-CLAIM-RATCHET-2026-10-17-BRIEF.md)
• Build every night band edge in the floating frame the capture stamps are in. A session now reaches that frame by an explicit conversion rather than by accident, so a night lands in the same band in every zone.
• A click on a device cell in the box's Nights page hands over the night's unstamped CPAP files only when that app reads them. A click on the O2Ring cell gave OxyDex five CPAP EDF files, and OxyDex listed each one as a parse issue.
• OxyDex derived every cumulative-time figure by counting rows and calling each one a second. A 1.015 s cadence therefore under-reported T90 by 1.5 %, and a doubled stamp added a second no sample covered.
• Restore the process timezone after every capture-host test. A teardown that drops TZ left the C library on the box's own zone. A suite launched TZ=UTC then ran every later file in that zone.
• Let the deploy restart the daemon when the only held BLE links belong to devices on their charger.
• Refuse a spectral band the covered span cannot resolve, and report the span beside the bands it keeps. (PPGDEX-ALGORITHM-DEEP-DIVE-2026-07-21-BRIEF.md)
• The fleet board reads the solid-night verdicts again. tools/board.mjs now sends its verdict reader to the capture box over ssh stdin. The box's reboot on 2026-10-18 wiped the old copy in its /tmp, and every board pass after that read "solid-night read failed".
• Order the boot catch-up against the end already harvested, so a restart cannot re-harvest an

• check.sh refuses an interpreter that lacks its own tools

• The filename stamp gets one owner: DexClock.fileStamp (RESIDUE.md)

• Resolve a test-suite input over every corpus rail per file, instead of picking one directory per run, so (FIXTURE-CORPUS-REACHABILITY-2026-08-09-BRIEF.md)
• Count the CPAP frames read after an unsolicited link drop, so the last unmeasured loss category has a writer and COMPLETE becomes reachable. (CPAP-ACQ-P3-GAP-ACCOUNTING-2026-09-18-BRIEF.md)
• Give the CPAP stalls counter the detector it cited. The continuity tracker already computes the sample each frame owes, so compare every frame against it. A mid-session break is a spec §30 STREAM_STALL, and the acquisition evidence surface sums a measured one as known loss beside sink_errors. post_drop_tail stays null: the drop instant it needs never reaches this layer.
• Give each CPAP session-boundary witness a named fallback. A device that reports _ZLE once leaves that edge absent, so the delta against our own trigger read null. The therapy-status rows answered the same question and sat unread in the sidecar. Each boundary now falls back per edge, and the snapshot names which witness the delta used.
• PpgDex's CVHR detector now takes the per-second gap mask ECGDex already had, so the (PPGDEX-ALGORITHM-DEEP-DIVE-2026-07-21-BRIEF.md)
• The nights page on capture-host flagged every row as "daytime, not judged" and hid the stored solid-night verdicts. The flag read only the first session start of a recording. On vigil the daemon writes a session file every hour, so each recording chained from an afternoon start into the night. The flag now marks a recording as daytime only when every session in it starts inside the daytime window. A read-only run on vigil's own captures gives daytime false for the nine newest rows, so their verdicts show again.
• Keep the equivalence ledger's own indent when --emit writes it, so a seven-entry addition diffs as seven entries.
• The Integrator page now names a dropped fusion export. Before, a file from the Integrator's own Export or from the OverDex "download fused" button read as "unrecognized format, no events found". The new message says the file is a fusion export with no events to fuse. It also lists the node exports that the file was built from.
• Observe the journal-shape bars at their exact value and every rounding digit the record publishes. Split the adoption sample's night layout out so a test can measure its bytes. Make a lost LINK row name the sidecar it was lost from. Assert that the sample's two writes pass encoding=, which kills four mutants no decoded byte can tell apart. Record the one survivor that no input distinguishes in the equivalence ledger, with its probe.
• Count the mutants mutate_diff sets aside. A string-literal exclusion lands in result.notRequired with the mutant named, an empty diff in result.emptyDiff. result.decided now counts only killed and surviving mutants, never a...

Tepna v2.20.0

Added

• Stage every loaded OxyDex night with the stage-lab control net from a user-loaded weights file, shown as a hypnogram card marked "control model — not shipped".
• The first of the five §2 figures publishes its attribution. tools/pat-three-corner.mjs --verdict (VERDICT-CONTRIBUTIONS-2026-10-04-BRIEF.md)
• A hybrid search hit names the lines of its passage (tools/xerj-load.mjs, tools/xerj-query.mjs). The hit reads file:812-840 and not [chunk 34/259]. (XERJ-HYBRID-SEARCH-2026-10-10-BRIEF.md)
• Record every trio fold in a declared provenance/trio-fold.json run fragment: which nights, from which files, on which volumes, under which code digest. Red the gate when that fragment is absent, unreadable or malformed.
• Score an AHI surrogate refit per harmonized definition under the owner's ratified rank-correlation band. (AHI-SURROGATE-REFIT-PAPER-2026-10-13-BRIEF.md)
• Four house rules read the syntax tree, and every hit on main is allow-listed with a reason.
• Publish the capture daemon's resident memory, both glibc allocator views and the gc counters on every status tick. A journal line at mem.log_sec keeps the series.
• Build the frozen defect benchmark from closed residue rows. A task enters the set only with a proven fail-then-pass pair. Each oracle stores its test ids as an array, and cmd quotes them for a shell. (DEFECT-BENCHMARK-2026-10-12-BRIEF.md)
• Add the benchmark's solver runner. It scores a local model's patch against each task's own oracle. (DEFECT-BENCHMARK-2026-10-12-BRIEF.md)
• THIRD-PARTY.md gains a "Development tools (not shipped)" section: nineteen
• The three mutation ledgers merge over entry ids, and a duplicated id stops the merge.
• Name the scoring pool's hold-out order. --seed sets it, and the old literal is the default. (AHI-SURROGATE-REFIT-SIZING-2026-10-12-BRIEF.md)
• tools/pr-walker.mjs with tepna-pr-walker.{service,timer}: the landing pipeline runs itself. The walker classifies every open PR each pass as held, conflict, red, pending, stuck, unknown or green. It marks green drafts ready under the cap of four, oldest first. It re-runs a red required check once per head SHA. It rebases a conflicting fleet branch with rebase-safe once per head SHA.
• Score each device's continuity from co-wear and report the earlier gaps as pre_cowear. Exclude a gap the box's own restart caused. Declare a probe night NOT_APPLICABLE from the journal or a monitor toggle. (SOLID-NIGHT-COWEAR-AND-PROBE-2026-10-13-BRIEF.md)
• Record every API coder lane verdict of 2026-10-13 in a brief and a ledger, with the proof state of each patch. (API-LANE-FINDINGS-2026-10-13-BRIEF.md)
• Make the mutation lane resumable: per-group-coverage checkpoints each completed group, and mutation-suite gains --until-done.
• Define the nadir clock rule: a desaturation nadir timestamp follows elapsed clock time, not sample position. detectDesats accepts spanSec and reports nadirSec/startSec/endSec. Without spanSec the times are null.
• Gate a count-shaped assertion in a brief **Status:** header: freeze today's 782 tuples as a baseline that may only shrink. A header that gains a count must source it with CLAIM <name> = <value> FROM <path>#<pointer>, or the gate reds. (BRIEF-HEADER-CLAIM-RATCHET-2026-10-17-BRIEF.md)
• The OxyDex known-answer fixture now drives the real DSP helpers. One new test group builds parsed rows from tests/fixtures/oxydex-math-known-answer.json. It asserts the hand-computed values against computeStats and computeCTprecise through OxyDex._bare: 20 assertions in both lanes. The fixture shipped in #3590 with only a shape check as its consumer.
• A new full-tree mode in the residue id tool reads every merged commit for a close claim. It compares each claim with that row's state cell. A claim over a row that still reads OPEN, or over no row, fails the gate. The mode runs as a step in the full check and in CI.
• Add the 31-day stitched results page and monitor integration. The page shows per-device sigma medians with 95 percent CIs, per-night charts, and gap accounting for each fused tool. The monitor gains 31-day buttons in the fused tool headers. The page fetches precomputed RESULT.json files through a new API route.
• A hook gives each fleet session its new board entries on every turn. A timer prompts an idle session with unread entries every 3 hours.
• Decode the committed AS11 Summary spool rounds to one JSON line per day and compare usage with the SD card STR.edf. (CPAP-AS11-BLE-WIRE-NOW-2026-09-07-BRIEF.md)
• A new tool measures how long each sensor needs to settle at the start and the end of a session. It also finds the window that every sensor covers with clean signal. It reads the trio node exports and emits a verdict.
• Adds a mutation-kill test group pinning four processNight boundary survivors. Each test passes on the original code and fails on its mutant. The L6321 hd90 survivor is a genuine equivalent and carries no test.
• Add two instruments: the OxyDex emitter cost over five real nights, and a filename's current holders.
• Two gates now hold the validity sidecar to its readers. (SAMPLE-VALIDITY-ENVELOPE-2026-09-17-BRIEF.md)
• Give the HR three-cornered-hat reference check an --axis host|wall switch, a --solid night stratum and one verdict per population. Each run then names its nights, and the host-axis discipline becomes a measured leg. (TCH-REFERENCE-POPULATIONS-2026-10-13-BRIEF.md)
• Fold a box night inside its own memory fence. A tepna-fold systemd unit and a daytime timer cap the fold at the brief's pre-stated bar. (VIGIL-SELF-SUSTAINED-FOLDING-2026-09-01-BRIEF.md)
• Rule 0 now names what each code file in its hits declares and exposes.

Changed

• Raise the diff-scoped JS mutation job's cap from 25 to 45 minutes, by the owner's call, so the one PR
• Make the unweighted three-cornered hat the canonical trio estimator and retire the fused-weight hat to a diagnostic. Withdraw every published σ the fused weighting produced. (TCH-FUSED-DEGENERACY-MECHANISM-2026-10-12-BRIEF.md)
• Every node-export and the Integrator read one shared allow-list, and the scrub names every key it dropped. (EXPORT-SCRUB-ALLOWLIST-2026-10-07-BRIEF.md)
• Run the fixture-currency check as a blocking step of npm run check, where its one reader holds the corpus.
• Replace every real SHHS record identifier with a synthetic one outside the cohort range. Drop each per-record value that sat beside one. Keep the aggregate. Rebuild the one analysis tool that inlines the carriers.
• Carry the NSRR acknowledgement in six root sources. Name both cohort citations beside each SHHS measurement. Re-bundle the carriers.
• Run the loss audit, the SOLID-NIGHT verdict and the wear scan in the QC poll's spawned child. The capture daemon then keeps neither their CPU nor their peak.
• The sentinel pattern in the project conventions names the waiter that outlives its producer.
• The Rule 0 search now reads the decisions, handoffs, findings and answers on the agent board. A new tool writes one Markdown file per entry, and the hourly index tick runs it first.
• The fleet board on port 8766 gets its modern layout back. The layout lived only in an uncommitted copy of tools/board.mjs. This change carries it from that copy.
• CLAUDE.md: the PR that discharges a brief item now stamps that brief in the same diff.
• Replace the mutation gate's 2.0 pre-work trace factor with a measured per-module stats pass. (MUTATION-AUDIT-RUNBOOK-2026-08-03-BRIEF.md)

Removed

• Biome now reports an unused variable as an error, after the removal of the dead code it flagged.

Fixed

• Write a generated README-SIDECARS.txt beside the box-wide sidecars.
• Drain three capture-host residue rows. A dark room no longer reads as skin. The kill helper reaches a forking child's whole group. Twelve new tests read what the 0x03 probe emits.
• tools/pr-compliance.mjs now reads the PR's own changes from the merge base.
• Report three absences as absences. A non-finite clock-seam step is now null beside a named reason. The mutation verdict counts an undecided mutant against the mutants it generated. A PPI stream gets no coverage figure at all.
• End a capture child's whole process group, and record a loss verdict before replacing it.
• Six RESIDUE rows close. Each patch came from the API coder lane. A local re-run proved each one: the new (RESIDUE.md)
• The journal template count in loss_audit.py carries a tally reason, so verify:astgrep passes on main again.
• Six guard hooks drain stdin before any hatch exits, so the harness writer never takes SIGPIPE. Each hook's test script watches the writer's exit code over a 100 KB payload. (RESIDUE.md)
• Six RESIDUE defects close, each with a test that fails on main and passes with the fix.
• Fourteen residue defects close from the API lane, each proven red on main and green with its patch.
• Read the four harmonized nsrr_ahi_* columns, each named from the NSRR data dictionary. Key every row by its visit, so a pooled file cannot hand one night's AHI to another. Honour quoted fields, which a free-text column ahead of the AHI columns makes load-bearing. Stamp each scored row with its exact column name. (AHI-SURROGATE-REFIT-SIZING-2026-10-12-BRIEF.md)
• Night QC publishes the bound of the gap measure it reports, places a zero-length session by
• Ask tools/tools-index.mjs which docs/ file it owns, so a conflict there auto-resolves. Keep docs/MUTATION-INVENTORY.md as source, because its builder stamps today and reads untracked journals. Fail closed when either builder cannot answer.
• The trim hook declares a command ceiling under MAX_ARG_STRLEN and passes a longer command through with no jq noise. Its rewriting path is linear in the command length, because the quadratic last-stage expansion is gone. (RESIDUE.md)
• The headless fold loads export-schema.js before dex-export.js. Since #3543 the s...

Tepna v2.19.0

Added

• Add a fleet board — a static page regenerated every 10 minutes outside any checkout — carrying fresh tokens per bird with cache reads beside, the model split, the weekly-pool band, release watch with a banner for a due-and-stalled cut, open PRs with walker order, main CI, the herder, Rule 0 stamp age and the owner-decision queue; doc-search prints its three-line summary after every search.
• Add nine hand-written Claude Code skills under .claude/skills for the recurring fleet procedures, each auto-invoked by its description and citing the slip that motivated it, so a session spends fewer tokens rediscovering a sequence than it did getting it wrong. (TOKEN-DIET-2026-10-11-BRIEF.md)
• Deny a trailer-less git commit in a Claude Code session, so a missing Fleet-Session line costs one command now instead of an empty commit and a second CI round-trip later.
• tools/fleet-turns.mjs — turns, tool calls per turn and narration per session, from the local transcripts. The measure behind the fleet rule "fewer turns" (owner, 2026-10-11). Measured on the week to 2026-10-11: three of four birds narrate on 56–60 % of their tool turns at 0.87–0.97 tool calls per turn. The brief carries the five diet rules, the proposed CLAUDE.md text and the handoff-file contract. No bundle moves. (TOKEN-DIET-2026-10-11-BRIEF.md)
• A command that prints thousands of lines now reaches the transcript as 101 lines. trim-output.sh is
• Require every workflow job to declare timeout-minutes, and set the twelve that lacked one from each job's own measured p95 and max duration, so a hung step fails in minutes instead of inheriting GitHub's 360-minute default.
• tools/zotero-fill.mjs — the citation ledger mirrored into the owner's reference library, one record per DOI, idempotent. (LITERATURE-USE-POLICY-2026-07-11-BRIEF.md)
• Red a PR body that puts a GitHub closing keyword next to a still-open PR number, because Kodiak squashes the body into the commit message and GitHub acts on the phrase there.
• Propose a frozen benchmark of past defects, built from closed RESIDUE rows whose fix commit carries a test. (DEFECT-BENCHMARK-2026-10-12-BRIEF.md)
• A new consumer that decides on hostAxis.independent instead of deviceDrawn now reds the suite.
• Add four more fleet skills under .claude/skills — sweeping every realm a shared module reaches, reading a CI result without reading a tail, landing a PR through Kodiak's queue, and reporting a measurement with its population — and correct residue-row, whose description and body still said a fix PR must not touch the ledger after the ruling that a row logged and closed as fixed #<that same PR> belongs with its fix. (TOKEN-DIET-2026-10-11-BRIEF.md)
• The three-cornered hat now says which leg moved a corner. analysis-stats.js gains hatContributions, which builds the tepna.verdict/1 contributions block for one corner by the analytic method. It also gains patHatContributions, which builds all three blocks on the brief's own leg keys in ms². The classic hat is a closed form, so each leg's term is its own partial of ±½ times its own variance. The three terms then sum to the corner exactly, and the suite asserts that identity over 900 corners against threeCorneredHat itself. (VERDICT-CONTRIBUTIONS-2026-10-04-BRIEF.md)
• tools/null-fuzz.mjs — the null-injection fuzzer for the DSP absence contract (§∅): P1 an all-null night yields null metrics, P2 nulls are ignored, never zeroed; targets oxydex, pulsedex, glucodex and the shared machinery; tepna.verdict/1 per target; adopted in tools/verdict-adoption.json via --verdict-sample. Built 2026-10-06, its findings landed through #3321 and siblings while the tool stayed in a worktree; landed now on the owner's order to adopt or delete unlanded work.
• tools/pr-compliance.mjs check 8: a tepna.verdict/1 object quoted in a PR body must come from this PR's current code. The check reads the object's producedBy.commit and places it against the base and the head. It fails when a non-Markdown file that the PR changes moved after the run. It also fails when the commit left the PR history, does not resolve, or is absent. A verdict on a base commit is evidence about main and passes. A merge from main does not stale a verdict, because the check reads only the PR's own files.
• A red PR is an event once, written to a file, not a journal line every ten minutes.
• Every source file, its functions and its exports — one map, and it decides nothing.
• Give the residue ledger a fifth closing state, answered <ref>, on the owner's ruling of 2026-10-12. A row that asked for a measurement and got it can claim neither a repair nor a refutation. So it sat OPEN, and an OPEN row says the ledger still owes work. The <ref> names where the answer lives: the recording PR, a ledger key, or a brief. docs-ledger check8b fixes the shape and rejects a bare answered, and the new check8j resolves the pointer. Close 35 audited rows with it and with fixed #NNNN, state cells only. (RESIDUE-ABSENCE-EVIDENCE-SWEEP-2026-09-18-BRIEF.md)
• Measure the ring night in SAMPLES as well as in seconds. Each run states its delivered PPG count, its ratio per device-second and its shortfall. The nominal rate of 125.000 states the denominator. The pair sits beside the time-based witness and grades nothing.
• Run the stage-lab control net (TCN + biGRU + Viterbi) in dependency-free JS with a PyTorch-exact parity harness that emits a pre-stated tepna.verdict/1.
• Land the sleep-stage lab's feature core (SpO₂ / pulse / motion blocks, harmonisation, context, GBDT, HMM, κ) as a pure ES module with its formula registry and ledger citations, so the OxyDex stager can be built on the code the control net was trained with.
• The hook names a file that no longer parses, while the edit is still in view.
• Install drifted /etc and helper files on vigil without a password, from a clone of GitHub main, never from the checkout. (VIGIL-AUTO-UPDATE-FOLLOWUPS-2026-08-14-BRIEF.md)
• Measure which corner the fused three-cornered hat drives negative, and refute the predicted one. (TCH-FUSED-DEGENERACY-MECHANISM-2026-10-12-BRIEF.md)
• Launch one Claude session on one work unit from a handoff file — tools/unit-launch.sh reads handoffs/<slug>.md, cuts the worktree and branch, opens a tab, starts the session and prompts it, then records the pane and session id.
• The token table names every bird on the roster, reads the capture box's sessions, and shows the API lane on its own line. (USAGE-GUARD-2026-10-11-BRIEF.md)
• verify:verdict-adoption gains a contributions leg, and its population is a brief table rather (VERDICT-CONTRIBUTIONS-2026-10-04-BRIEF.md)
• Add one optional contributions block to tepna.verdict/1, so a fused figure can say which (VERDICT-CONTRIBUTIONS-2026-10-04-BRIEF.md)
• A skill carries the STE structure rules, the linter commands and the measured traps.
• tools/xerj-query.mjs refuses a query when both halves of the hybrid search are weak. The top cosine is below 0.8075 and the top BM25 score is below 27. A refused search prints "no prior work" with the two scores and the weak paths, without passages. An absent half never refuses. doc-search.mjs shows the refusal in its hybrid lane.
• Every Integrator key declares whether it reaches a card or only the export. (INTEGRATOR-SURFACE-2026-10-11-BRIEF.md)
• The writing rules, checked — and an approved-word layer that is ours.

Changed

• Sessions compact at 20 % of the context window instead of near its end (CLAUDE_AUTOCOMPACT_PCT_OVERRIDE=20 in the project settings' env).
• Rebuild the monitor's Nights page as the owner-approved design: a last-31-nights overview led by the box's solid-night verdict, one row per night with a column per device (H10, Verity, O2Ring, AirSense, Muse, CGM) showing hours, fragments and the share lost, a Fused & derived tab, older months folded, and every cell opening its analyzer with the night loaded.
• tools/fleet-turns.mjs prints the two owner targets (tools/turn ≥ 2.0, ctx/turn median ≤ 300k) and names every bird that misses one. The token-diet brief gains rules 6 (window cap) and 7 (tools per turn) with the 2026-10-11 turn-trigger measurement behind them. (TOKEN-DIET-2026-10-11-BRIEF.md)
• The trim-output hook is wired, last in the Bash PreToolUse list (.claude/settings.json). #3450 shipped the hook inert; the entry was pasted by the owner by hand after two sessions' classifiers refused the edit as self-modification. Last so every guard reads the original command text. A session picks it up at its next start. No bundle moves.
• Ratchet the XSS backlog on unescaped SINKS (210 of 314) instead of files (42), because a file leaves the list only when its last sink is escaped — so the old baseline could not see a merged security fix.
• Carry the NSRR acknowledgement and both SHHS cohort citations on every surface publishing an SHHS number.
• The residue-row skill keeps a closing keyword away from a number in prose. Kodiak squashes the body into the commit message, and GitHub acts on the phrase there.
• The files that every session reads at start now pass the writing rules.
• The writing rules bite: a finding is a red, and the compliance gate reads every PR body.
• The writing rules bind each new Markdown file, and the linter stops flagging about 4,300 false findings.
• Re-fold the trio corpus under the closure that carries the null-blind fix, and re-derive the pooled-hat table over the same 90 nights.
• The write-in-ste skill names the new-file rule that #3510 added.
• brief-gaps v2 — the criterion re-stated as a share, the pooling moved to chunk pairs. PASS. (BRIEF-GAPS-2026-10-11-BRIEF.md)
• SPINE: dex-escape.js into the six bundles that lacked it.

Fixed

• The loss audit examined ONE folder's files while the judge grouped by the RECORDING, so a night whose (`NIGHT-IS-THE-REC...

Tepna v2.18.0

Added

• A new SOLID-NIGHT band, rtc: the device's onboard RTC judged against the host clock that disciplines (SOLID-NIGHT-RTC-2026-10-04-BRIEF.md)
• E12's timer half: a tepna-trio-fold unit pair that folds the box nights the corpus does not hold yet, (NIGHT-0928-ERRORS-2026-09-29-BRIEF.md)
• A second reader for mutation survivors, on exactly the form Codex was given, after Codex's free tier was exhausted. The reader is handed a survivor list and returns, per mutant, one concrete distinguishing input or an equivalence argument citing line numbers — never test code, and it decides nothing: every claim is verified against original and mutant by hand before any test is written. The key is read from the environment or from a 0600 file the owner places, and the tool refuses with a named reason when neither exists or when that file is group- or world-readable; the value is never logged and is stripped from every error text, including stack traces, because an exception that interpolates a request URL is the leak. Gemini has no working directory, which is the one place this cannot copy Codex literally: Codex read the export itself under a read-only sandbox, so for an HTTP reader the source must be sent instead, and the corpus boundary moves from the sandbox to this tool's refusal to read a byte from anywhere except an export built by tools/codex-export.mjs — verified by its marker files and by the absence of the data trees, so that a plain checkout, which would carry uploads/, is refused rather than read. (GEMINI-SECOND-READER-2026-10-05-BRIEF.md)
• The capture host records its UTC offset per session in STARTS.csv, so a reader no longer has to infer (SESSION-SPAN-WRITER-OFFSET-2026-09-28-BRIEF.md)
• A gate asserts that every registry id has a DECLARED binding — emitted by name, a *_DEFS entry with its get: accessor, or an explicit dormant: true — with the 163 ids that have none published as a ratcheting baseline, so a new phantom id reds instead of silently carrying a tier.
• commit-shape refuses a commit that adds a 0-byte file at the repo root — the spaced-path trap that splits Data Unifier.html — with the three historical instances declared as a shrink-only baseline, and deletes the 0-byte Unifier.html that had been on main since 2026-09-24.
• Add four CI gates: PR body + changeset compliance (Rule 0 line, Fleet-Session trailer, corpus sentence on computeHash movers), absence-regression (diff-based, fails on new tMs/|| 0 fabrications), xss-sink-gate (diff-based, fails on new unescaped innerHTML sinks), docs-constants (CLAUDE.md numeric claims match code). The rebuild-consistency gate (#1) already existed via build.mjs --check.
• Make the capture box a stratum-1 clock on its own u-blox M10 GPS, the LAN's standard way: a PPS line-discipline (VIGIL-GPS-STRATUM1-2026-10-10-BRIEF.md)
• Add a measured hybrid-search trial: tools/xerj-load.mjs writes doc-search's existing chunks and cached bge-m3 vectors into a xerj index, doc-search.mjs --hybrid queries it and prints the enclosing passage (Rule 0's default path unchanged), and tools/xerj-bench.mjs scores it against doc-search on 52 real past Rule-0 queries — 94.2 % vs 82.7 % hit@5 with 16x fewer bytes to an answer.
• Give the two diff-scoped scanners a --full-tree mode (base = the empty tree) with a shrink-only backlog ledger and a nightly timer, never a PR gate — the first reading found 42 files with an unescaped innerHTML sink and 1 absence fabrication, and the CodeQL control exposed a scanner defect that had been hiding multi-line assignments as safe.
• Add three user units so the local hybrid-search lane survives a reboot — a loopback-bound index server with Restart=on-failure, plus a reload service and timer that follow the hourly re-embed at :20 rather than racing it — with a setup doc the owner enables from; restart survival is measured (54,180 documents in, 54,180 served after a kill, and a kNN query afterwards to prove the vectors persisted and not just the row count).
• Gate the evidence-tier vocabulary where §🎫's rule actually binds — on the 523 evidence: grades in the eight node registries, which nothing asserted — rather than on identifier names, where a gate would fire on correct code.
• tools/usage-guard.mjs — what the fleet has spent, measured from each session's own transcript and each API reader run, and what no program here can read, said as UNKNOWN. (USAGE-GUARD-2026-10-11-BRIEF.md)
• An anthropic provider row in the second-reader, and a truncation bug it would have inherited.
• A text-network gap detector over the briefs — built, measured, SHORTFALL. (BRIEF-GAPS-2026-10-11-BRIEF.md)
• The untimed-group ratchet, and three CI comments that had drifted ~2x.

Changed

• Record 35 OxyDex ABSENCE-SURVEY findings (12 DSP, 23 render) as already fixed by the PRs that landed after the survey, each traced to its commit; open findings: 217 of 290. (ABSENCE-SURVEY-2026-09-22-BRIEF.md)
• The capture-host wiring scanner counts names in one pass instead of one search per name, giving identical results five times faster; the capture-host test suite runs about 30 % faster. (ABSENCE-SURVEY-2026-09-22-BRIEF.md)
• AirSense 11 pairing follows the device's documented pairing sequence: one chosen radio, a Find CPAP scan, 30 s connect and reply bounds, the pre-notify reads, and a post-pair session check on a fresh link.
• The four #3368 CI gates each emit one tepna.verdict/1 and carry a --selftest with a planted violation and its controls, and all four are binned decides/adopted — replacing three word-only/exempt rows whose stated reason (the exit code is the machine-readable result) the verdict contract rejects, and adding xss-sink-gate, which was not binned at all.
• doc-search.mjs answers from the hybrid lane by default, falling back to the semantic lane when the index does not answer. (XERJ-HYBRID-SEARCH-2026-10-10-BRIEF.md)
• Measure the O2Ring not-worn pull against the ring's awake tail: it fires at +50 s on every night (PASS, 7/7); the one miss was a BlueZ refusal with no in-window retry. (OXYII-DAT-AUTO-HARVEST-REFINEMENT-2026-08-24-BRIEF.md)
• Other projects' names out of the tree, and a gate that keeps them out.

Fixed

• The night timeline finds the ring's accelerometer again, and stops dropping the head of a session that began before midnight. A configured stream can legitimately be written under more than one file tag — acc arrives as _ACC. from the chest strap and _ACCRAW. from the ring — and the timeline compared the file tag against the stream name upper-cased, so a 10 MB _ACCRAW.txt matched nothing and that device's whole night was painted idle, which reads as a finding rather than a miss. The tag set now comes from nightqc.stream_file_tags, which already owned that mapping and its reasoning, rather than a second copy that could drift from it; a bare string is still accepted, so every existing caller is unchanged. Separately, the gate that decides whether to pool the previous day's folder was exclusive at its upper bound while merge_sessions — the authority on what one session is — measures the same question from the running coverage's end, which a session crossing midnight pushes past 00:00. A night opening exactly one session gap after midnight was therefore refused, and a measured 3669 s continuous session published as a 9 s window with no error and no refusal, reading as a short recording rather than a truncated one. The bound is now inclusive. That closes the boundary and not the class — a previous day running to 01:30 still merges with a 02:00 session this gate never looks for — so the remaining narrowness is recorded as an open residue row rather than described as fixed.
• The mutation gate no longer instructs you to delete a correct equivalence claim because a contended run lost track of its mutant. REFUTED — the one verdict here that destroys work, since it tells a reader the recorded claim is false — was derived from ABSENCE: a mutant that mutmut generated and that did not come back a survivor was called killed. A reaped worker, a partial run and a shard that never reported all look exactly like that. Worse, mutmut's own status map records pytest's INTERNAL ERROR as a kill (3: "killed" # internal error in pytest means a kill), and contention produces that exit on a tree whose every test passes — so a loaded run could report entries refuted with no timeouts to show for it, while a quiet run on the same tree reported the same mutants surviving. Three things change. Absence can no longer reach refuted by any path: membership in the survivors and in the kills are both positive observations and are tested as such, and a mutant the run never settled is reported as unmeasured with the run reading UNKNOWN rather than FAIL. A kill is read from the raw pytest exit code rather than mutmut's status word, so only "tests ran and failed" counts as a test having observed the mutant, and anything else — including an exit code nobody has met yet — is not a detection. And a refutation must be corroborated by re-running that one mutant in isolation, with the re-run judged for load on the same terms, because it meets the same contention and "not a survivor on the second try" is not agreement. A real distinguishing input still reaches refuted, which is what keeps the gate able to report a stale claim at all.
• The ring's opcode-sweep probe now marks an opcode's effect as unverified, and stops, when it cannot read the ring back after sending it, instead of recording "nothing changed". Its tests may no longer start a real process. Open ABSENCE-SURVEY findings: 253 of 290. (ABSENCE-SURVEY-2026-09-22-BRIEF.md)
• The Polar opcode-sweep probe no longer reports "nothing left running" when its final status read goes unanswered; it reports that the state is unknown and sends no stop command blind. Open ABSENCE-SURVEY findings: 252 of 290. (`ABSENCE...

Tepna v2.17.0

Added

• Two more band-less tools emit exactly one tepna.verdict/1 each, criteria pre-stated with their sources —
• The PAT hat rows now render what the solver actually decided per corner, and the drift-removed hat gets (PAT-HAT-DRIFT-DIFFERENCED-2026-09-27-BRIEF.md)
• npm run gates:browser:local — one command for the browser lane, and --label to prove a named
• The PAT three-cornered hat now says which kind of negative corner it found, and adds a drift-removed (PAT-HAT-DRIFT-DIFFERENCED-2026-09-27-BRIEF.md)
• A mutation survivor no longer lives and dies with one PR. tools/mutation-survivors.mjs records every survivor a gate run reports into a committed ledger keyed on lane, module, function and the mutant's own diff pair — content, never a mutmut index — with the PR that reported it and its state, and its open count is a two-sided ratchet in the repo check. Ingest refuses a run it cannot attribute to a PR, refuses to read an absent measurement as an empty survivor list, and flags a survivor list as a lower bound while mutants went undecided. The first twelve entries are the real unanswered findings on loss_audit.py::_has_worn_evidence, re-derived because the only record of them had already drifted. (MUTATION-SURVIVOR-LEDGER-2026-09-28-BRIEF.md)
• Every unmeasurable PAT quantity now carries its own reason beside the null — the same sentence in the
• Pin the treatment-response qualifying cohort at the paper's stated configuration, decomposed so a moved yield names whether the generator or the detectors moved.
• SOLID-NIGHT §A5's unrecorded-shift tripwire is built, and with it the timebase band can PASS. Until now (SOLID-NIGHT-2026-09-23-BRIEF.md)
• audits/ABSENCE-SURVEY-2026-09-22.json had 290 confirmed findings and nowhere to record what happened
• The night-loss verdict judges worn-but-not-recorded against the owner's 1 % bar instead of reporting it as UNKNOWN.
• **Seven nights folded into the committed trio corpus — 2026-09-22 … 2026-09-28 — closing a backlog that
• The journal's clock-event lines now travel with the night. LOSS-AUDIT.json has always carried (SOLID-NIGHT-2026-09-23-BRIEF.md)
• The diff-scoped mutation gate can now be told, once and in writing, that a function's measurement cost is not the diff's: a declared bounded list of exact module.py::function keys — each carrying a reason, a date and a cost whose provenance is required — lets the gate report NOT_APPLICABLE instead of an UNKNOWN that every future PR on that function rediscovers. The declaration is allowed exactly one transition, UNKNOWN → NOT_APPLICABLE: it can never rewrite a FAIL, never yields PASS, short-circuits while any survivor is blocking, requires every refused function in the run to be declared, and fails closed on a refusal line it cannot decode exactly. Functions the gate refused are also ingested into an unmeasured ledger with a growth gate, so a function that was never mutated leaves a trace where the survivor ledger — which records survivors — can hold none. (MUTATION-DECLARED-EXCLUSION-2026-10-03-BRIEF.md)
• The capture-host test fixtures now say where their bytes came from: one registry classifies every test file that carries a timestamp, a long hex literal or a data fixture as captured, derived, format, synthetic or authored, and a test holds it equal to the tree. tools/codex-export.mjs builds the source-only export an external code reader may see, omitting the data and record trees and every captured or derived fixture, and refuses if any remain.
• The PAT three-cornered hat is solved on three arrival-FLOOR axes instead of raw receive stamps: E11's (PAT-HAT-RING-FLOOR-2026-10-04-BRIEF.md)
• **The O2Ring's 156 rows are its own beat detections, and PpgDex now reports agreement between its
• **The O2Ring's PPG frames now land on the SAME arrival sidecar the Polars use, so the finger finally has
• A config-selectable ring wave-poll mode, o2ring.wave_poll_mode, default OFF (dual is byte-identical (RING-POLL-SPLIT-2026-10-04-BRIEF.md)
• trio-batch reads a .superseded marker before refusing a night as ambiguous (owner ruling 2026-10-04).
• tools/withdraw-fragment-verdict.mjs withdraws a verdict that judged a FRAGMENT of one recording, with (NIGHT-IS-THE-RECORDING-2026-10-05-BRIEF.md)

Changed

• The 82 stamped uploads/trio nights are re-folded under the current compute closure, on the owner's 2026-09-28 ruling prompted by #3162 closing the integrator-dsp.js omission in CODE_DIGEST. 82/82 folded from the capture root the committed stamps themselves record (/srv/data/tepna-corpus, read from trio-batch-verdicts.json's evidence rather than assumed). Every night moved and integrator-dsp.js explains none of it: that file has zero commits since 2026-09-22, so the owner's control — nights whose integrator-dsp.js was unchanged since their stamp must be byte-identical — holds for all 82, and all 82 moved anyway. The cause is the rest of the closure, oxydex-dsp.js (10 commits since 2026-09-22), ecgdex-dsp.js (8) and ppgdex-dsp.js (2), which were never omitted from the digest; shown by digest rather than argued, since 2026-08-19's committed stamp (7b44db6fbd394099) matches neither today's closure (7fb220f140806c93) nor the closure without integrator-dsp.js (acb667efbc3941e6), so it predates the node-DSP work and the omission could not have been what staled it. #3162's fix is therefore prospective — it makes a future integrator-dsp.js edit stale the stamps, which is the hole it closed — and the re-fold was overdue on its own merits. What the movement consists of is mostly measurement provenance the old exports did not carry: measured, measuredSec, recoveredCount, nsiComponents and readinessBasis.weightTotal appear as new keys across all 82 nights, and "recovery": 0 becomes null where a zero had stood for "not measured" — §∅ corrections reaching the corpus, which is the argument the re-fold paid for itself whatever the digest did. Scope is held at the 82: the 58 unstamped night directories are not folded here, because with no prior stamp there is nothing for a byte-identical control to compare against, so they are a first fold with their own acceptance and their own residue row.
• The capture-host tree is ruff format clean — 423 of 471 files reformatted under the owner's 2026-09-28 ruling, with no logic change: every file is structurally AST-identical and the only semantic movement is thirteen docstrings re-indented by one constant each. The mutation ledgers travel with it rather than being orphaned by it: every equivalence and survivor entry whose keyed text moved is re-keyed from its pre-format mutant to its post-format one by content, arguments untouched, so the reformat creates no new orphans and no answered mutant becomes an unclassified survivor under the now-required gate.
• The mutation gate's declared exclusion becomes one module-level declaration, checked before any work starts (owner ruling). The cost it records is a property of the module — mutmut applies a glob when it runs mutants and never when it generates them, so every capture.py diff pays for the whole module's population whatever it touched — so a list of function keys each citing the same module-level measurement stated one fact as many. The gate now consults the declaration at selection rather than after spending the budget, turning a 7693 s run that reached no mutant into a verdict in seconds, and it prints on every run how many functions the declaration covers (measured from the module's AST, not quoted) and how many of this diff's functions fell under it, so the size of the blind spot is re-counted per PR. Two defects in the first version are fixed with it: the substitution never fired when a diff's entire scope was one declared function, because that case reports NOT_RUN rather than UNKNOWN; and the skipped functions stopped reaching the unmeasured ledger once the check moved earlier, which would have removed the record of what the gate no longer measures. (MUTATION-DECLARED-EXCLUSION-2026-10-03-BRIEF.md)
• **The committed trio corpus is re-folded under the per-segment host axis, and the published
• capture-host/check.sh's format leg is now BLOCKING and checks the WHOLE TREE, on the owner's

Fixed

• tools/pat-drift-attribution.mjs no longer spends a DRAWN device axis as a second clock: effectivePpm (KNOWN-CLOCK-ADVERSARIAL-CAPTURE-2026-08-14-BRIEF.md)
• An H10 lying off the body is no longer held worn by the heart rate its own algorithm reads out of (CAPTURE-LOSS-PRECEDENCE-AUDIT-2026-09-22-BRIEF.md)
• **Both hat rows on PAT Classic vs Fused.html have rendered REFUSED on every night since the page
• The diff-scoped mutation gate runs from a worktree (interpreter resolved from an override, then the primary checkout, refusing with the paths it tried), stops emitting PASS over a population of zero, no longer double-counts survivors across globs, and asserts its own result block is possible.
• mutation_diff.py's pre-existing mutation survivors drained 73 to 8 — the selftest's twenty-two duplicated failure paths become one that its fault-injection tests actually reach, the literal scan's quote-adjacent boundaries are pinned by searched cases, and the eight that remain are recorded as equivalent with the probe that establishes each; the audit tool also gains the worktree interpreter resolution the gate got in #3171.
• The fourteen mutation survivors on #3181's new lines are drained: the wall-cap arithmetic is extracted as cap_remaining with a named floor so it can be asserted as numbers rather than through a clock that cannot afford a one-second bound, the abandoned reader is pinned as a daemon with a bounded join (an unbounded one would turn a refusal that just fired into a hang), and the post-kill reap's bound is asserted; one survivor, a one-second change to the join bound on an already-finished thread, i...