DIRECTOR_RUNBOOK.md

pipelines/DIRECTOR_RUNBOOK.md

THE DIRECTOR RUNBOOK — the end-to-end operating loop for the desktop seat (ACTIVE v1.0, 2026-08-10)

T99-operational. Sets no world canon. This is the ONE document the Saturday director boots into,

written so the next seat never re-derives the operating loop. It does not restate doctrine that

already has a home — it points at the home and says when to open it.

Doctrine homes this file defers to, never duplicates:

• Capacity and rotation: build/ops/CAPACITY_ROTATION.md — the truth table (:15-26), the pacing

constant (:52-58), the burn law (:60-66), the balancing protocol (:68-86), and the 2026-08-10

reporting-direction tail (:110-125).

• The standing build plan: docs/ROADMAP_VERTICAL_SLICE_2026-08.md §6 (:796-861) — steady-state

seat duties, burn targets, and the wave-close ritual.

• The seat charter and open work-orders: docs/HANDOFF_2026-08-05_ACCOUNT_SWITCH.md §8.15

(:4249) → §8.15a stand-down (:4275) → §8.15b/c/d/e work-orders (:4289, :4329, :4468, :4480).

• The rulings themselves: the project memory dir — monitoring-never-wakes-premium-sessions,

permanent-orchestrator-usage-rotation, session-boot-capped-reorientation,

decision-analysis-standing-protocol, agent-frame-claims-need-director-reread,

boards-publish-phone-first, creation-first-law-gate-moratorium,

fable-flags-ch2-content-route-to-opus, cross-repo-state-build-repo-is-authority.

Why this document exists — the five failures it is built against

Each is a named test case. A change to this runbook that reopens one of them is a defect.

• F1 THE BURN. The premium desktop seat spent 20%+ of a weekly limit on ~25 monitor wakes that

acknowledged routine seat heartbeats. Closed by §2 (the NEVER list) and §5 (the only wake trigger).

• F2 THE PATH DEATH. All three runner loops failed silently every 30 minutes for 3.5 hours

because the bare name claude fell out of their PATH snapshot; nothing detected it. Closed by the

absolute path now in C:\Users\joshu\claude-accounts\runner-loop.cmd:56 (the claude.exe invocation) and by §2's liveness

triad. STILL OPEN in one place — see §7 DEFECT 1.

• F3 THE INVISIBLE L12. A seat scored an L12 into repo records and its commit said the site was

deployed with it; the live site still showed the stale refusal text. Josh looked, found nothing,

and was right. Closed by §2's site-staleness check and §3's on-the-site rule.

• F4 THE SILENT DEBT. An owed deploy was recorded ONLY in a commit message. No surface tracked

it. Closed by §2 (owed items live on a surface) and §5 (the escalation channel).

• F5 UNRELIABLE PUSHES. Josh, verbatim: "the website pushes have been entirely unreliable."

Closed by §2's deploy-record test, which is the only claim about the site the director trusts.

1 · BOOT, CAPPED

Boot is a VERIFY, never a re-derivation (memory: session-boot-capped-reorientation; switches and

compactions have burned 20%+ on re-challenging settled state). Read these five, in this order, and

nothing else until a decision actually demands a sixth file:

1. docs/HANDOFF_2026-08-05_ACCOUNT_SWITCH.md — the tail block only, from §8.15 (:4249) to the

end of file. That is the state-of-the-board plus every live work-order. Do not read the file.

2. build/ops/WORK_ORDERS.md — the board of record for open seat work-orders: every standing

order, its status, its claimant, and evidence a reader can open. It landed 2026-08-10 as the

successor to the ad-hoc §8.15b-e handoff appends, which stay as the orders' provenance. When the

board and the handoff disagree about STATUS the board wins; about INTENT, the handoff's original

wording wins. *(This entry read docs/WORK_ORDERS.md until 2026-08-10 — a path that has never

existed. A boot step that opens nothing reads exactly like a boot step with nothing to say.)*

3. build/ops/SEAT_REPORTS.md — the tail, newest blocks last; read the last block per seat, not

the file. Each block is one turn close: time, seat, commits with hashes, blocked-on.

4. build/ops/usage_status.md — the meter. Read the LIVE METERS block and each loop's

LIMIT STATE. Read §7 DEFECT 1 before trusting the live-meter lines.

5. build/ops/NEEDS_DIRECTOR.md — every line is a genuine escalation awaiting a ruling. This is

the work; §5 is how it is discharged.

Then, and only then, one command for orientation the files cannot give:

git -C C:/dev/humanity-forgotten log --oneline -12
git -C C:/dev/humanity-forgotten rev-parse --short HEAD

Not in the boot set, deliberately: seat logs, the roadmap body, the pipeline ledger, DOC_MAP, any

docs/pipeline_review/ dossier, any 3D or audio evidence JSON. Each is opened only when a specific

decision names it. docs/START_HERE.md:22-29 remains the ▶ NOW pointer for anyone who needs the

corpus map — the director does not, at boot.

2 · THE TOUCHPOINT LOOP

The director is not a service that runs. It is a seat that WAKES for three reasons and reads only

what the wake is for.

2.1 The three legitimate wakes

• A Josh message. Anything he says is the highest-priority interrupt. Read what his message

names, act, and answer him in his own register (§3).

• An escalation wake. A new line in build/ops/NEEDS_DIRECTOR.md, or an unhealable failure

signature (PATH, auth, hang). Nothing else in the system is permitted to wake the director

(build/ops/CAPACITY_ROTATION.md:120-124).

• THE DIRECTOR'S OWN wave boundary. Its own wave lands — that is when briefs, capacity

re-targeting, and the site check happen. A SEAT's close is not a wake. Three seats close

every few minutes; a subscription to that beat is F1 exactly, and F1 cost 20% of a weekly limit

in one night acknowledging heartbeats. Seat closes are READ at a touchpoint the director is

already awake for, never delivered to it (build/ops/COMMS_PROTOCOL.md §6: "only when it is

already awake for real work"). If a monitor exists at all, its filter emits **additions to

NEEDS_DIRECTOR.md and nothing else** — healthy path, zero events, zero wakes.

There is no automated wake today, and that is a stated state rather than a gap to paper over.

The channel is PULL: escalations are seen at the next boot or touchpoint (§1 item 5). What closes

the latency for the failures that cost money is not a wake — it is peer recovery

(build/ops/COMMS_PROTOCOL.md §8): a mechanically dead seat is relaunched by whichever seat is

still up, within a turn, with no premium session involved at all. Only rulings, credentials and

logins actually wait for the director.

2.2 What gets read at each wake — and nothing more

• Josh message: the artifact or surface he named. If he says a thing is missing, the FIRST read

is the live surface he was looking at, not the repo record that claims it exists (F3).

• Escalation: the NEEDS_DIRECTOR line, the seat's last SEAT_REPORTS block, and the one artifact

the decision turns on. Three reads, typically.

• Wave boundary: SEAT_REPORTS tail → usage_status.md → git log --oneline since the last

boundary → the deploy-record check below. Four reads, all cheap.

2.3 The three standing checks, each one command

THE SITE-STALENESS CHECK (closes F3/F5). One command, and it reads PRODUCTION rather than a

record of production:

python harness/site/site_ritual.py --check

Exit 0 = production already IS this build, proven against the live bytes. Exit 6 = the gates

pass and production is behind — a deploy is owed, and the ritual has already written the OPEN block

to build/ops/SITE_DEBTS.md. Exit 2/3/4 = a refusal, also now on that surface. Nothing is deployed

by --check and the local mirror is held aside and put back.

Why not the record alone. build/site_deploy_record.json is written only on a successful deploy

(harness/site/build_progress_site.py:3795 land_on_disk), so it describes the last deploy that

worked and says nothing about the refusals since — that is F5's exact shape. And a zero exit from

wrangler pages deploy without --branch main lands a PREVIEW while production keeps serving the

old build (build_progress_site.py:3831-3834), which is F3's. The record's sha is still a useful

cheap glance —

python -c "import json;print(json.load(open('build/site_deploy_record.json'))['canon_sha'])"
git rev-parse --short HEAD

— but read it as a floor, never as proof: a commit message is not evidence (F4), and disk is not

either, because a lane once deployed from a worktree so disk lied about production

(harness/site/build_progress_site.py:3761). At this writing the record reads 6cdb86b3 against

HEAD c4ea97e1 — 22 commits behind, which is the F3 shape, live, right now. Full contract:

docs/pipeline_review/SITE_RELIABILITY.md.

THE LIVENESS CHECK (closes F2). The director does not correlate seat state by hand any more —

a zero-model watchdog does it every ten minutes and escalates only what a loop cannot heal

(C:\Users\joshu\claude-accounts\watchdog.ps1; the six reasons are listed in

build/ops/COMMS_PROTOCOL.md §3). So the director's check is on the watcher, not the seats:

type C:\Users\joshu\claude-accounts\watchdog_heartbeat.json

No file at all = it has never run for real — a -DryRun writes only the self-log, and that is

precisely the state the red team found it in on 2026-08-10: the script existed, the scheduled task

had never been registered, and a whole reliability wave had assumed otherwise. A beat older than

~15 minutes = the scheduled task is down. Older than ~35 minutes = the runner loops are not firing

it either (they each run it at the top of every turn), which means no seat is looping. Fix it

before reading anything else — §8 item 3 is the one command.

The old hand-correlated triad (limit banner + turn count + report freshness) is what the watchdog

now automates; keep it only as the manual fallback when the heartbeat is missing and you need an

answer before the watch is back up. A loop whose turn count climbs while SEAT_REPORTS stays

frozen is F2's exact signature.

THE OWED-WORK CHECK (closes F4). Every SEAT_REPORTS block's blocked-on line, plus every open

NEEDS_DIRECTOR line, is owed work. Owed work lives on a surface — SEAT_REPORTS, NEEDS_DIRECTOR,

WORK_ORDERS, or the site. A debt mentioned only in a commit message does not exist, and the

director's response to finding one is to put it on a surface, not to remember it.

2.4 THE NEVER LIST — hard, no exceptions

• NEVER tail seat logs (C:\Users\joshu\claude-accounts\logs\*.log). The seats report up; the

director does not consume down. This is Josh's ruling, verbatim: "Updates should be coming from

those terminals to you not you consuming everything."

• NEVER subscribe a monitor to turn-start / turn-complete beats. That exact pattern is F1. A

monitor's filter emits only NEEDS_DIRECTOR additions and unhealable failures. Healthy path = zero

events = zero wakes.

• NEVER wake for routine progress. "Still fine" is never worth a wake. Same law for any

scheduled task or cron: no wake whose only job is to confirm health.

• NEVER wake for a usage wall or a backoff. Walls are self-healing by construction — the runner

loop backs off 30 minutes and retries (runner-loop.cmd:57-59, the errorlevel 1 branch), and the burn law says a wall costs

nothing (build/ops/CAPACITY_ROTATION.md:63-66).

• NEVER re-verify what a seat's evidence already proves. Spot-check, never re-derive. If a seat

landed a scored artifact with its evidence path, the director checks that the path exists and the

number matches — it does not re-run the instrument.

• NEVER volume-code. The director orchestrates, adjudicates, integrates, and lands (§6).
• NEVER git add -A. Explicit paths only; multiple lanes share this tree.
• NEVER poll /usage per seat in a loop. Read the meter file; probe live only before an actual

launch decision (build/ops/CAPACITY_ROTATION.md:69-72).

The one named exception to spot-checking: claims about how something LOOKS or PLAYS. The

director re-reads the deciding frames itself rather than accepting an agent's description of them

(memory: agent-frame-claims-need-director-reread; docs/ROADMAP_VERTICAL_SLICE_2026-08.md:804-807).

That is a read of the image, not a re-derivation of the pipeline — it stays cheap.

3 · JOSH BRIEFS

A brief is produced at a wave boundary, when Josh asks, or when a READY-FOR-JOSH gate goes green. It

is short, it is finished work only, and it has pictures.

3.1 The format

• COMPLETED — what actually landed. One line per item: the thing, in plain words, with its

commit hash. Nothing in-flight, nothing "in progress," nothing that needs a caveat to be true.

• PICTURES. SendUserFile the actual renders, sheets, before/afters, or screenshots — the

visible-delta KPI (docs/HANDOFF_2026-08-05_ACCOUNT_SWITCH.md:4338-4341): a wave close that puts

no new visible artifact in front of Josh is un-DONE regardless of how many instruments it armed.

Site links are for depth; the pictures come to him.

• THE METER — one line per account: account, percent used, hours to its reset, and whether a

seat is on it right now. Four lines, always in the same order (workhorse, josh.milks, jmilks3790,

joshua.milks90).

• IN YOUR COURT. Only things that genuinely cannot move without him, each with what one action

unblocks it. Currently standing: his three open music reviews (the Tyrant boss pair + the Flores

Finality phase-3 morph edit) — nothing else. *(Two items closed 2026-08-10 by the remote director

sitting: the ElevenLabs downloads Allow was executed directly — a per-profile automatic-downloads

allow for [*.]elevenlabs.io written into all four Chrome profiles on Milks5090, Chrome

restarted with session restore, plus the pacing law that no two download triggers ever fire in

the same second. The 5c9ce40e two-clicks item was SUPERSEDED by Josh's ruling — no review.

subdomain at all; the site lives at the apex humanityrpg.com (+www) with /review as a

path — and executed in-browser: the review.humanityrpg.com custom domain and its CNAME are

removed, apex + www + /review verified 200. **The apex carries NO Access wall by that same

ruling: every site surface is PUBLIC and no publish-gate waiver may rely on a wall** — that

posture stands until Josh orders a wall. The handoff §8.16 and the DECISIONS tail carry the

record.)* *(The older standing item here — "the one-time Cloudflare MCP OAuth that unblocks the

review domain", build/ops/CAPACITY_ROTATION.md:94-99 — is STALE and was removed 2026-08-10:

the custom domains have been live and answering 200 unauthenticated all along; it is the

pages.dev URL that is Access-walled. docs/pipeline_review/SITE_RELIABILITY.md carries the

verification.)*

• NEXT GATE. The single next thing that will change what he can see, and when.

3.2 The anti-patterns — every one of these is from tonight

• No claim language. "The L12 is on record," "the deploy landed," "the site is current" — these

are claims. Run the §2.3 checks and state the checked fact, or say nothing. Josh's answer to a

claim he could not see was "I dont see an L12 on record. The site fucking sucks."

• Nothing is "on the record" that is not on the site. A score that lives only in a JSON record

does not exist for Josh (:4336-4337). If the site is stale by the §2.3 check, deploy before

briefing or name the staleness in the brief.

• No pipeline jargon. No "rows exited," no "instruments armed," no "refusals landed as

refusals," no "the lens floors cleared," no gate names, no lane letters, no seat numbers. Say what

a person would see. Internal routing vocabulary never reaches a Josh surface.

• No progress narration. He is not briefed on effort, attempts, blockers overcome, or how hard

something was. Completed work and pictures.

• No buried debt. If something is owed, it is an IN YOUR COURT line or a NEXT GATE line — never

a parenthetical, never only in a commit.

• Honest tier in every sentence. Structure claims never borrow greybox language; greybox claims

never borrow final language (docs/ROADMAP_VERTICAL_SLICE_2026-08.md:858-861).

4 · CAPACITY MATH

4.1 The board

The truth table is build/ops/CAPACITY_ROTATION.md:15-26 and it wins over any conflicting line

anywhere (including §7 DEFECT 2):

The pool is per ACCOUNT, not per seat. Every seat on an account draws the same weekly limit —

and so does Josh's own desktop use of that account (build/ops/CAPACITY_ROTATION.md:24-26). Through

this week Josh drives each account to ~50% himself while the loops burn the same pools; the Saturday

director inherits the sum, not his half (:4275-4288).

4.2 The constant, and the only formula the director needs

Josh's math (build/ops/CAPACITY_ROTATION.md:52-58): 15.6% of a 5-hour limit per session, and 500%

of 5-hour limits equals 100% weekly. Therefore **one seat running continuously delivers about 0.62%

of an account's weekly pool per hour** — which is what lands 100% on a Max x20 running 24/7.

required rate  =  remaining %  ÷  hours to that account's reset
seats needed   =  required rate ÷ 0.62

Ranked launch priority is simply the highest required rate first — that is the routing rule

(:74-76) made computable. Worked at the Saturday 1am boot, assuming each inherited account sits at

~50% (RECOMPUTE against the real meter; this is the method, not the answer):

Reading: josh.milks is the tightest window and takes volume FIRST and WIDEST — one loop cannot

reach its floor by Sunday night, so it needs a second seat or heavier per-wave fan-out. The workhorse

looks comfortable but shares its pool with the director's own spend, so its ~1.0 is really "one loop

plus a thin director" — every hour the director spends on it must come off a loop's width.

4.3 Launch and hold decisions

• Launch when the account's required rate exceeds what its current seats deliver, and the wave

can land before that account's wall.

• Hold only when a launch would strand the work, never to be cautious. The floor is 95% used per

account per week; the target is 99-100% (docs/ROADMAP_VERTICAL_SLICE_2026-08.md:829-831).

• The defect is stranded budget, not a hit ceiling. Near a reset, spend to the floor — a wall at

the reset boundary costs nothing (build/ops/CAPACITY_ROTATION.md:63-66). Never thin a wave to

avoid a limit.

• Zero-token work never waits. GPU, CPU, and RAM stay at max regardless of model budget: kit

building, carving, rendering, baking, indexing, measuring (:61-62).

• The director's own spend is the last thing funded. Its budget buys rulings, integration, and

briefs; anything else on that pool is a loop's width taken away.

5 · ESCALATION HANDLING

IN. build/ops/NEEDS_DIRECTOR.md — one line per genuine escalation, written by the seat that is

blocked. It is the only thing that wakes a director. A seat's routine progress belongs in

SEAT_REPORTS, never here.

OUT. A decision-protocol brief — never a bare question (CLAUDE.md decision protocol; memory

decision-analysis-standing-protocol). Steelmanned alternatives including the status quo, each

grounded and adversarially checked, presented with pros, cons, reasoning, a RECOMMENDATION, and the

strongest objection to it. Two destinations:

• Creative-within-vision, or operational → the director RULES, applies it, and shows the path.

It does not go to Josh. Only genuine ambiguity, cardinal canon, or a vision fork does (memory:

no-veto-lists-only-genuine-forks).

• Cardinal canon — chapter/numerical/naming/hard-line/§17 — → the full brief goes to Josh, in

the §3 register, still never a bare question.

ACK. The ruling is written BACK into build/ops/NEEDS_DIRECTOR.md on the line it answers —

appended to that line, never on a new one — and it ends with the uppercase token RESOLVED:

... | blocks: <what was stopped> | RULED <date> — <the ruling in one sentence> — landed at <sha> | RESOLVED

Both halves are load-bearing and they do different jobs. RULED: is the human register and carries

the ruling; RESOLVED is the machine token and is the only thing that moves the item out of the

site's open list (harness/site/seats.py:99 _NEEDS_CLOSED; the other accepted closers are CLOSED,

ANSWERED, WITHDRAWN, DISCHARGED, SUPERSEDED, uppercase by design). RULED alone is NOT a

closer. The line stays in the file as history; it is never deleted.

This was got wrong within an hour of the rule being written, so it is worth the extra sentence.

The apex-exposure ruling of 2026-08-10 (5c9ce40e) landed as a NEW flush-left line beginning

- RULED (director...). A flush-left line is a NEW escalation to the parser, and neither line

carried a closer — so a discharged escalation rendered on Josh's status feed as two open items,

and would have woken the next director for a question already answered. Repaired in place. If the

ruling leaves a residual action for Josh, that action moves to IN YOUR COURT (§3.1); it does not

justify leaving the escalation open.

SAME-DAY. Escalations are discharged the day they appear. A seat that escalated is a seat that

is blocked, and a blocked seat is stranded budget on a metered account.

NOT AN ESCALATION. If a line is routine progress, a usage wall, or a self-healing backoff, ack it

NOT AN ESCALATION — <why> | WITHDRAWN and fix the source: the seat's close duty is defined in the

runner prompt (C:\Users\joshu\claude-accounts\runner-loop.cmd:56), and the bar for this file

belongs there.

NOT THE DIRECTOR'S AT ALL. A WATCHDOG line reading PATH_BROKEN, LOOP_SILENT or

LOG_MISSING is a mechanically dead seat, and the live seats recover it themselves within a turn

(build/ops/COMMS_PROTOCOL.md §8) — ack-first, relaunch, confirm, close. If one is still open when

the director boots, peer recovery did not happen and THAT is the thing to fix. AUTH_FAILED is

genuinely the director's: it needs a human login.

6 · THE MODEL SEATS LAW (restated, binding)

Full statement: CLAUDE.md "Model seats" and build/ops/CAPACITY_ROTATION.md:77-79; memory

fable-flags-ch2-content-route-to-opus.

• Fable = the director seat ONLY — orchestration, contested adjudication, frame re-reads, final

integration, landings, and canon-sensitive authoring. The director never volume-codes.

• Every fan-out sets model explicitly to the top Opus. Nothing inherits a premium session

model. One 8-agent inherited fan-out once cost ~20% of a weekly limit.

• Mechanical work goes to deterministic scripts first, then the cheapest model that works.

Monitoring, format triage, and registry applies are script-tier — never a model wake (F1).

• Efficiency is TIERING, never thinness. Quality is protected by the bar — deterministic gates

plus fresh-context adversarial critics stay at full strength always. Never skip verification to

save budget.

• Fan out when the work touches more than one target, makes a claim needing independent

verification, or is volume authoring. Everything else stays inline.

7 · KNOWN DEFECTS AT THE TIME OF WRITING — verify before trusting the meter

DEFECT 1 — the meter is dark, and it is F2 again. harness/ops/usage_monitor.ps1:17 invokes the

CLI by bare name (& claude -p "/usage"), the same PATH assumption that killed all three runner

loops. All four LIVE METERS lines in build/ops/usage_status.md:5-11 currently read

poll failed: The term 'claude' is not recognized. Fix: the absolute path already proven in

runner-loop.cmd:56 — C:\Users\joshu\.local\bin\claude.exe. Until it lands, the live-meter block

is worthless and only the per-loop LIMIT STATE banners (usage_status.md:13-28, scraped from the

logs) carry information. This surface was unclaimed and clean at 02:02 when this runbook was

written; it belongs to whichever lane owns harness/ops/.

DEFECT 2 — a monitor line contradicts the truth table. harness/ops/usage_monitor.ps1:40

hardcodes "jmilks3790 Sun ~10pm ET; josh.milks Tue ~3am ET" and stamps it into

build/ops/usage_status.md:137 as "Reset schedule of record." Those two accounts are swapped

relative to the Josh-corrected truth table (build/ops/CAPACITY_ROTATION.md:17-22, corroborated by

runner-loop.cmd:15-17). The truth table wins. A director that routes volume off line 137 will aim

a wave at the wrong wall.

DEFECT 3 — the watchdog is WRITTEN but was never REGISTERED. *(Updated 2026-08-10 by the

failure red-team, which is how it was caught.)* The zero-model, OS-level watchdog now exists at

C:\Users\joshu\claude-accounts\watchdog.ps1 and it works — but the scheduled task it needs was

never created: schtasks /Query /TN HumanityFactory-SeatWatchdog returned "cannot find the file

specified", there was no watchdog_heartbeat.json on disk, and its self-log carried nothing but two

-DryRun passes. A staged watchdog watches nothing, and the reliability wave that built it had

already been described as closing F2. The one command, run once, on the box:

C:\Users\joshu\claude-accounts\install-watchdog.cmd

It dry-runs first and refuses to register if the dry run is unclean. Two mitigations landed with

this finding, so the class does not recur: **every runner loop now fires the watchdog itself at the

top of every turn** (runner-loop.cmd:47-55), which means the watch survives the scheduled task

dying and only fails when no seat is looping at all; and concurrent runs take an atomic lock, so

the four callers cannot corrupt each other's dedupe state. The install remains worth doing — it is

what watches the seats when every loop is walled.

DEFECT 4 — the prescribed pull silently ate escalation lines. `pull --rebase --autostash

-X theirs (docs/HANDOFF_2026-08-05_ACCOUNT_SWITCH.md:109`) resolved a two-seat append conflict by

discarding one side — reproduced on a scratch repo 2026-08-10, seat A's escalation gone with no

conflict and exit zero. Closed by merge=union on the three ops channels in .gitattributes; the

detail and the fixture are in build/ops/COMMS_PROTOCOL.md §7. **Never resolve a WORK_ORDERS.md

conflict with -X theirs** — there the conflict is the feature, and the rule is first-committed-wins.

8 · THE SATURDAY CHECKLIST — the first five actions at the 1am reset, in order

1. BOOT CAPPED. The five reads of §1, in order, and stop. Do not open the roadmap body, the

ledger, or any evidence dossier yet. Budget: minutes, not a context window.

2. REPAIR THE METER. Apply DEFECT 1 and DEFECT 2 (§7) — the absolute CLI path and the corrected

reset line — then re-run harness/ops/usage_monitor.ps1 and read a real number for all four

accounts. Every capacity decision below this line is guesswork until this passes.

3. CONFIRM THE WATCH — and do not accept a script on disk as a watch. Two commands, in order:

   schtasks /Query /TN HumanityFactory-SeatWatchdog
   type C:\Users\joshu\claude-accounts\watchdog_heartbeat.json

Either one failing means nothing is watching the seats (§7 DEFECT 3 — this is exactly how the

red team found the task had never been registered). Register it with

C:\Users\joshu\claude-accounts\install-watchdog.cmd, which dry-runs first and refuses on an

unclean run, then re-read the heartbeat and confirm every seat is listed. A wave launched under

a dead watch repeats F2.

4. PROVE THE SITE, DO NOT ASSUME IT. python harness/site/site_ritual.py --check (§2.3). Exit 6

means a deploy is owed — run python harness/site/site_ritual.py and let it PROVE the push is

live against the deployed bytes; exit 5 means treat the push as unlanded no matter what wrangler

said. Production was 22 commits behind at this writing. The first brief of the day must describe

a site Josh can actually open, so the scored L12 and every other landed result stop being

invisible (F3). Then read build/ops/SITE_DEBTS.md: an ## OPEN block is a push production

still owes.

5. DO THE CAPACITY MATH AND LAUNCH. Fill §4.2's table with the real percentages from step 2,

rank by required rate, and launch volume in that order — josh.milks first on the current board,

its wall being the nearest. Then discharge every open NEEDS_DIRECTOR line same-day (§5), and brief

Josh in the §3 format with pictures.

9 · THE COST MODEL — what this loop costs, priced

Every figure below is measured off disk on 2026-08-10 at ~06:20 local, or off the runner logs, which

are zero-token evidence. Byte counts are facts; token counts are bytes ÷ 4, the working

convention for markdown prose in this repo — stated so a later reader can re-derive rather than

trust. Where a number is an estimate rather than a measurement it says so on its face.

The purpose of this section is not thrift. It is F1: the burn happened because nobody had priced a

wake, so ~25 of them looked free. A cost that is written down can be refused.

9.1 The director's boot, itemised

The §1 five reads, at their real sizes:

Add what the session is charged before it reads anything at all — the preamble is not free and is

not optional:

BOOT TOTAL ≈ 32,000–36,000 tokens. Call it 34k. That is the whole price of arriving oriented,

and it is paid once per cold session.

Two boot defects were found here, and both were repaired on 2026-08-10; they are kept as the

record of a class that recurs:

• §1 item 2 named docs/WORK_ORDERS.md, which has never existed. The file is

build/ops/WORK_ORDERS.md (183 lines, board table at :34-43). A boot read that misses is a boot

that re-derives the board from the handoff — the exact cost §1 exists to avoid. Fixed in place.

• Anchors into the runner script go stale every time that script is edited, and it is edited

more often than this runbook. They were stale by ~7 lines when this section was written, and the

red-team's own change (firing the watchdog per turn) moved them again the same night. As of

2026-08-10 the absolute CLI path and the seat's close duty are one line —

C:\Users\joshu\claude-accounts\runner-loop.cmd:56 — the watchdog call is :47-55, and the

30-minute backoff is :57-59. Cite the symbol, not the number, and treat any runner-loop.cmd:NN

in this file as advisory: the durable anchors are :loop, the claude.exe invocation, and the

errorlevel 1 branch.

The board table alone is 1,050 bytes (~260 tokens). A director that reads §1 item 2 as "the

board table plus the body of any row a decision turns on" pays ~600 tokens instead of 2,880 and

loses nothing, because the row bodies are reference text for the seat executing them.

9.2 The touchpoints, priced

The wave boundary is the cheapest useful thing the director does: **four reads, ~2k tokens, and it

answers "is the factory healthy and where is the budget" completely.** That is the number that makes

the NEVER list affordable — the director does not need to consume the seats, because 2k buys the

same knowledge that tailing three logs would buy for fifty times the price.

9.3 The director's week

Steady state, SAT 1am → SAT 1am, three loops running:

Rulings, contested adjudication, integration, and landings are excluded deliberately — that is the

director's JOB, not its overhead. This line prices only the cost of *running the system*.

The healthy-path wake count is ZERO and that is a hard requirement, not a target. A monitor that

emits on turn-start, turn-complete, a usage wall, or a backoff has reopened F1 regardless of how

cheap each event looks. The only two emitters are a new NEEDS_DIRECTOR.md line and an unhealable

watchdog signature.

9.4 The ratio against tonight

The one measured anchor is Josh's own observation, F1: **~25 monitor wakes acknowledging routine

seat heartbeats cost 20%+ of a weekly limit.** Everything below is derived from it.

• Unit cost of a full-context wake: 20% ÷ 25 = 0.8% of a weekly limit per wake (measured).
• Implied weekly pool: a full-context wake on a large session runs ~150–200k tokens, so 25 wakes ≈

3.8–5.0M tokens ≈ 20% → weekly pool ≈ 19–25M tokens. Working figure: 20M. (Derived, not

measured; it is the one soft number in this section, and every ratio below moves with it.)

• The new system's ENTIRE WEEK of director overhead — 395k — is therefore **≈ 2.0% of an account's

weekly pool.**

The third row is the real one. The first two price a system; the third prices a law. Twenty-five

wakes bought zero rulings — every one of them was the director paying to be told nothing was wrong.

9.5 The seat side — where the same burn is happening now

Measured from the runner logs for the night of 2026-08-09 23:00 → 2026-08-10 06:16 (zero-token

evidence; C:\Users\joshu\claude-accounts\logs\*.log, turn-start/turn-complete markers written by

runner-loop.cmd:56,61):

claude-hf is not broken — it is at its weekly wall, banner resets Aug 11, 3am, and has spawned

117 processes that each die in ~2 seconds at zero model cost. That is the backoff working. It

does mean the account behind it (jmilks3790, per runner-loop.cmd:16-19) is spent, not half-spent.

Turn rate: 22 completed turns across two seats in 6.6 hours = ~1.65 turns/hour/seat. At three

live seats that is ~120 turns/day, and every one of them is a cold -p process that pays the

whole boot again:

120 turns/day × 25k = ~3.0M tokens/day of pure re-boot, best case; ~7.0M/day naive. Against a

~20M weekly pool per account, boot is the single largest line item in the whole factory — larger

than any wave it precedes.

And it multiplies. The injected preamble is charged to **every fan-out lane as well as every seat

turn** — verifiable directly: a subagent's opening context carries the full project CLAUDE.md and

the full MEMORY.md index before it reads one file. Commit 8c18537f ran nine lanes wide; that

wave paid ~106k tokens of preamble before any lane opened anything.

The ranked fixes, highest leverage first. Each is a one-file edit; none touches a gate, a critic,

or the quality bar (§6: efficiency is tiering, never thinness):

1. Trim the always-injected preamble. CLAUDE.md is 26,716 bytes and marks its own §"Next

session — start here" as historical; MEMORY.md's index is 16,601 bytes. Cut to current law

(~8k + ~6k) with the history moved to a linked file. Saves ~7,300 tokens on **every seat turn and

every fan-out lane** — ~0.9M/day at the seat level alone, several times that across lanes.

2. Anchor the handoff read and cap it. runner-loop.cmd:56 says "the handoff tail" with no line

and no N against a 386,522-byte file. Name the command in the prompt — the last ~120 lines — and

the wrong-end failure disappears with ~4,600 tokens/turn.

3. Stop re-reading COMMS_PROTOCOL every turn. The prompt says "read it once, follow it every

turn" and build/ops/COMMS_PROTOCOL.md:184 says "do not re-read it every turn" — both are

unexecutable, because a -p turn is a fresh process with no memory of the last one. Put the

15-line close-block template inline in the runner prompt; keep the protocol file as the reference

for whoever changes the parser. Saves 3,170 tokens/turn and removes the failure where a seat

skips the read and files an unparseable block.

4. Read the board, not the whole board file. Board table + the claimed row's body ≈ 900 tokens

against 2,880.

Together: boot falls from ~25k to ~7.9k, a 3.2× cut, ~2.0M tokens/day recovered at the seat

level before counting lanes.

9.6 Cadence, collisions, and the free meter

120 seconds between turns is right; leave it. At a 21–24 minute mean turn it is 8.0–8.4% of wall

clock. Shortening it buys back ~6% of throughput and spends it immediately on more cold boots at 25k

each — the lever is LONGER turns, not shorter gaps. The cadence is not the defect.

The collision is the defect, and it is structural. runner-loop.cmd:56 hardcodes the same

PRIMARY MISSION — WO-07 and WO-08 — into all three seats, so all three boot aimed at the same two

rows and the losers spend their opening minutes claiming and yielding. Tonight's record, in one

52-minute window: 392f4a55 (05:24) "finds the board saturated and stands down… touches nothing

else" — a whole turn, no artifact; 3f7e92ea (05:45) claim → 20e08cd5 (05:48) claim →

ddc291cf (05:51) "yields three minutes too late"; 662562c5 (06:10) "yields the ladders it was

sent for and picks the surface off the floor". Roughly **three of six seat turns in that window

produced no new artifact.** At ~22 minutes and ~1.65 turns/hour, a yielded turn is not a rounding

error — it is 40% of that account's hour, on a metered week, against Josh's "no seat idle while

budget remains".

The fix is one sentence in the prompt: the mission line points at the BOARD ("claim the

highest-priority OPEN row you can hold; the board's order is the priority"), plus a per-seat

preferred-surface hint so three seats aim at three surfaces by default and collide only when the

board is genuinely narrow. Priority then lives in WORK_ORDERS.md, where it can be changed without

editing three scripts.

The meter is already free, and DEFECT 1 is paying for it. The logs carry the exact reset stamps

the director needs — resets Aug 11, 3am, resets 4:30am, resets 3:40am — and the monitor already

scrapes them into build/ops/usage_status.md:13-28. The broken /usage poll

(harness/ops/usage_monitor.ps1:17) is spending model calls to buy what the banners give for

nothing. Scrape the banner, stamp DARK UNTIL <reset> per seat, and the live-meter block becomes

zero-cost and honest.

Two corollaries, both cheap:

• A weekly wall should back off to its stamped reset, not 30 minutes. claude-hf has spawned 117

processes since 08-06 for a wall that clears Aug 11. It costs no tokens, but it inflates the

turns attempted counter that §2.3's liveness triad reads as evidence of life.

• usage_status.md:137 mislabels the one measured banner. It reads "josh@humanityrpg Tue Aug 11

3am ET (measured)", but that banner came from the claude-hf log, which is jmilks3790

(runner-loop.cmd:16-19); josh@humanityrpg resets SAT 1am. A director routing off that line aims

the workhorse's volume at the wrong wall — DEFECT 2's failure, now with a third mislabel on the

same line. The §4.1 truth table wins, always.

Generated by harness/site/structure_site.py — the URL path is the repo path. review root