The recorder resolves its sink once, at start. Master following the default
output would otherwise leave it recording the old sink's monitor: silence,
reported as RUNNING. try-restart only touches a recorder that is already
running.

The gig-record probe was ADVISE; the unit was not installed and two hours of
playing were recorded nowhere. A missed gig recording cannot be recovered and
an unneeded one costs 72 MB an hour, so with SuperDirt running it blocks (a
cold rig still skips). It now names the not-installed case instead of a bare
rc.

gig-record was on-demand, meaning only if a converge remembered; on 2026-10-11
it never ran and its unit was not even installed. parvagues-sc now Wants it
(a recorder that cannot start must never stop the sound), and it is PartOf the
sound so it is not left recording silence after the rig is down.

master_sink() took the first thing Master was linked to, so a spectrogram tap
listed before the real sink pointed the recorder at a source that does not
exist: RUNNING while capturing nothing. Only alsa_output/bluez_output count.
It also quit awk at the first hit, so under pipefail a large pw-link graph
gave SIGPIPE (141) and killed 'check' and, by the same race, 'start'.

Ardour's real binary is ardour-8.4.0~ds1 and its process name is ArdourGUI. The
launcher's exe pattern could not match the Debian ~ds1 suffix, so it believed
Ardour was down and spawned a second instance on the same session (the 09-05
duplicate, recorded as 'not reproducible', was never measured against this
build). The gate's pgrep -x names never matched either, so its 'Ardour is open'
precondition was always false and SC -> Ardour and gig-record-on-target were
skipped on every run.

Master tracks the default sink (HDMI, the jack, a Bluetooth headset) only while
its wiring is the one autoroute made; anything else (qjackctl, several sinks)
is custom and left alone, and disconnecting all of Master's outputs hands
control back. The new link is made before the old one is cut. The default-sink
lookup runs every 2nd tick, not every tick.

SuperDirt takes no mic: capture -> SuperCollider:in_* links are cut, with
TIDAL_AUTOROUTE_SC_MICS=1 to keep them, documented in the script header.

Only rule 4's own start calls are capped; once started, the unit's
Restart=always retries forever by design. The first drill would have 'failed'
for the right reason (the repairer beats the observer's debounce), so it now
stops the repairer first.

Linking it to the default speaker as well would leak the whole set into the room
when monitoring on a headset.

A Bluetooth headset (bluez_output.*) now counts as a hardware clock, so
monitoring on it no longer raises a permanent critical. When pw-top goes quiet
the clock check is WARN, never NA: cannot-measure is a third state. 'Recovered'
is only said for a real recovery (not when the rig closed or the probe went
blind). A health.json left by a gig-log that died uncleanly reads as not
observed instead of aging into a red stale dot on every day it is not running.

Sprint 12 entry, one learning line, and the follow-ups: the two owner decisions
(Master sinks, built-in mics), the witnessed drills, the work blocked on
uncommitted changes in gig-up.sh and rig_units.py, and the measured idle CPU of
the watchers.

health_item() turns the health.json gig-log publishes into one more panel item,
through the same tray_summary() the tray renders, so the two faces cannot
disagree. A stale observer is 'broken', no observer is 'absent'; neither can
read as up.

Reads the health.json gig-log publishes and renders tray_summary(): a red dot
for down or a stale observer, amber for degraded, nothing when healthy. A
single owner-unit action (start lcxl3-driver) appears only while the surface
check fails; the tray never writes the graph. A missing file reads as 'not
observed', never as ok.

Four faults on 2026-10-11 fell between the gate and the per-unit watchdogs, each
leaving every unit active. rig_health judges the signal path from what gig-log
already reads: the pw-top stream (are Ardour/SuperCollider clocked by a sound
card or by the MIDI bridge), /proc/asound (raw LCXL3 present but no driver
port), and the gear sample (sclang up, scsynth dead). Hysteresis, atomic
health.json with a heartbeat, notify + evidence snapshot only on a failure
transition. Steady state adds no fork.

The loop re-issued all 24 orbit links every 2 s and every pw-link connects to
the PipeWire daemon: 12 min of CPU in 85 min, about 15% of a core at idle.
Index the existing links from the one snapshot in pure bash and link only the
absent pairs.

A sink node re-created under a running Ardour left Master with no hardware
output: every unit active, the rig silent. Additive only (never prunes), off
switch TIDAL_AUTOROUTE_MASTER=0, ports taken from the graph not assumed FL/FR.
The control-surface assertion used an old PipeWire port spelling and was a
silent no-op on 1.0.5; resolve it from the live graph. One pw-link snapshot per
tick instead of three.

Bash regex instead of a grep fork, and the driver's own virtual port as proof
of service so systemctl is only asked when the raw board is present without
it.

gig-up picks the painter once at launch; a board that enumerates later never
got one and no fader reached Ardour. The unit stays manual (it crash-loops and
Conflicts= the v2 painter on a v2-only box), so the loop that already knows
which generation is plugged in re-runs the chooser: start, not restart, raw
kernel client only, never the v2 painter, bounded retries with a cooldown.

The LCXL LEDs probe exits 0 with no surface on the bus, so its only failure
is hardware present and its translator down: no faders reach Ardour, no paint.
That is 'there is no gig', not advice. It sat as one WARN among eleven under
two stale FAILs and went unread.

Rung 1 (epp=balance_power, ceiling 65%) is the pilot's resting posture, so
the fixed 'must be 100%' check turned every launch into a NO-GO whose fixes
fought the pilot. Pass when the knobs match the declared rung; FAIL only when
they disagree (a second writer). Stale or absent state keeps the old strict
behaviour.

start: pre-checks (disk, gig-log, autoroute service, routing, portal
token), screen capture on the default sink's monitor, arm, then a
per-orbit verify that never kills the video. State written before
verify, values quoted (the session path has a space). stop: SIGINT
sweep by output filename for the sandboxed recorder, transport halt,
take summary. Camera opt-in (--cam); no notification on the happy path.

Verify reads the capture files, never a self-report: missing or flat
per orbit. Never binds UDP 3820 (gig-log owns Ardour's OSC feedback);
reads gig-log's rec lines instead. The master-rec toggle is only sent
when that stream says OFF, the orbit list comes from the session XML,
and halt stops the transport a stop must never forget.

algolia devcon26: gig folder — intro loop (4K + portrait w/ audio), header art, jingle wav, extracted palette

Everything from 2026-09-25 is committed and the suite is green, so nothing
here is half-applied. What is left is one loose edit outside this repo (the
sound-browser fix, which I could not commit), three restarts and a Pulsar
window reload to collect work already built, two things that need hands in
Ardour, three design questions with no code behind them yet, and the OSC arm
lens.

The 200 ms audition chop is recorded as UNRESOLVED with the one test that
settles it, not as fixed. All three sample-bank surfaces were ruled out: the
Foundry was not serving, La Cale has no index to load, and the sound browser
has no loop or timer on its click path. `paplay` on the same file decides
whether it is the audio path or Pulsar, and that is worth more than another
guess.

66318b6e's comment and test docstring both claimed PLN heard the polled-loop
stutter. He did not. The Foundry server was not running: port 8765 was
another project's http.server, established two steps after the fix landed.
The bug is real and of exactly the reported shape, and it stays fixed - but
attributing a fix to a symptom it did not cause is how a wrong diagnosis
becomes documentation, which is this morning's -inf-faders mistake again.
Both places now say where it came from. The commit message is history and is
left alone.

And check-mix's --arm table called an unarmed `Mix` route "not recorded, by
choice" while --mix blocks on precisely that. Two modes of one tool must not
disagree about the same route.

Detection stopped being the problem at 6a94b47b. What failed on 2026-09-24 is
that every dot was green and nobody was looking at any of them: at T-2 the
eyes are on Pulsar and the hands are on the LCXL, and neither surface said a
word. So this is attention routing, not checking.

Three principles, then the shape. One source of truth (check-gig --json; no
surface grows its own check). An alert lands on the surface the eyes are
already on, which is a different surface at T-30, T-5 and T-2. And a wizard
is ordered and blocking where a dashboard is neither: one blocker, its fix,
a re-check of that ONE probe because the full gate costs 16 s and a
16-second wait per fix is how a wizard gets skipped.

It never converges on its own. Arming a track, raising a fader and saving are
things only PLN's hands in Ardour can do, and a tool that edits the session
he is performing from is a tool that fights him.

Also records the one alert that earns the right to interrupt a set - Ardour
not recording while Tidal plays - and pins it to the FILES lens, because the
OSC surface claimed arm:false for all 76 minutes it was actually recording.

Three open questions left for PLN rather than answered here: which surface
the T-2 alert lands on, whether an at-my-own-risk skip is acceptable, and
how long the during-set silence window is. The last one needs one rehearsal,
not an opinion.

Retention and the Mix audit are marked done in the belt-and-braces list, and
Tidal 08 is ticked: PLN armed it at 17:38 and the saved session now reads
rec-enable=1 on all twelve.

The black box writes ~72 MB/hour into a gitignored directory and nothing
deleted anything, so it only grew: a rehearsal week is >5 GB and the repo's
">500 MB is reported or deleted, never silent" line bites after one.

An automatic sweep is the wrong shape here. A timer or an ExecStopPost is the
one mechanism that could delete the take nobody meant to keep, which is the
entire reason the recorder exists. So: `prune [DAYS]`, dry by default. It
prints what it would remove and removes nothing until --yes.

Three things are never candidates, in the order they would hurt:

  * whatever the running recorder holds open, read from /proc/PID/fd rather
    than guessed from mtime — after a segment roll the newest file is not the
    one being written, and a long session's current segment can easily be
    older than the window. A held-back file is named BEFORE the
    nothing-to-do line, or the report would be a lie about the one file that
    matters most (the test that found this).
  * anything that is not a %Y-%m-%d_%H%M%S.opus segment, so a slice_*
    excerpt cut on purpose is not swept up with the raw capture.
  * anything inside KEEP_DAYS (14, overridable).

OUT_DIR is overridable with GIG_RECORD_DIR for one reason: a delete command
whose tests cannot run without pointing at real takes is a delete command
nobody tests. The six new tests assert what it REFUSES to delete, including
a real process holding a real fd.

The gate advises at 500 MB and names the command. It never prunes.

The notifications package auto-hides a notification after 5 s only when it
is NOT dismissable. Everything raised through addError/addFatalError is
dismissable, so every error waits for a click forever, at 450 px of pale-red
fill with near-black text over a dark theme — and a fatal one SHAKES, three
times, which is punitive UX with an actual keyframe.

Nothing is lost by hiding them: the same package keeps a timestamped log of
every notification, reachable with notifications:toggle-log. That is what
makes a timeout safe rather than careless — it hides the interruption, not
the information.

notifications.js gives every dismissable notification a life, longer the
worse it is (4 s info to 25 s fatal). Hovering pauses it, because reading is
not dismissing. Clicking cancels it for good, because a click means "I am
working on this". Notifications the package already auto-hides are left
alone: one owner per behaviour.

notifications.less makes the panel dark, translucent and blurred so the code
underneath stays readable, moves the type into the colour of the icon strip
instead of a wall of fill, deletes the shake, and draws a 2 px countdown bar
from the same duration the script used — read through a custom property, so
the bar cannot disagree with the timer. Ship's Bridge tokens, so the editor
and the armada UIs say "error" in the same colour.

They live here rather than in ~/.pulsar so the reasoning is in git; the
dotfiles hold one require and one @import. The stylesheet was compiled
before landing. init.js needs a window reload to take effect; styles.less is
live on save.