The rhythm did the work. One or two batches a day, each through the same gate: a reviewer circle that stops only on a clean round. The circles earned their keep — of the last three batches, every one had a finding that survived verification, and the strongest was against my own fix: the guard I loosened to stop false alarms turned out to miss the exact mutation it existed to catch, and the head that caught it also proved the inventory covered three of seven launch sites. Three rounds later the guard is smaller than where it started: the compensating layer I had added is gone, the inventory is complete, and the residual risks are written down instead of papered over.

That is the phase-zero lesson in one line: when a guard needs a third patch in a day, stop patching the guard — the invariant is usually structural, and the fix is to finish an inventory, not to add a layer.

The characterization net closed the phase the same way it started: tests written against what the code does, verified by running it, not against what anyone remembered it doing. Renaming a meeting keeps the graph node’s filename and rewrites its title; forgetting finds the meeting by stamp boundary, so a renamed meeting stays forgettable for free; a second forget is a no-op. None of that was designed this week — it was measured, and now it is pinned, which is what lets phase one move structure without holding its breath.

Charoite’s daemon is thread-heavy: capture pumps, STT loops, watchdogs. In tests, those threads die the way threads do — an exception nobody joins on, a traceback printed to a log nobody reads, and pytest reports the run green, because from the main thread’s point of view nothing went wrong. The worst version of this: an assertion inside a background thread fails, which is a crash of the thread and a pass of the test.

This week the suite got a gate for it. A threading.excepthook installed for every test records background-thread exceptions, and the run fails if any were seen. Sixty lines of test code, eleven lines of pyproject.toml, plus a canary test that deliberately crashes a thread and asserts the gate catches it.

Two details survived review and are worth writing down.

First, the honest boundary. The reviewer’s finding was not a bug but an overclaim: the gate’s comment promised it catches background crashes, period. It doesn’t — it catches a crash that happens inside its test’s window. A thread that leaks past the end of its test attributes the exception to a report that is already closed, and the run stays green. Late crashes are caught by something else entirely: join discipline, every test joining what it spawns. The comment now says exactly that. A guard that states its limits is a guard; a guard that overstates them is the false green it was built against, one level up.

Second, the canary is deliberately fragile. It asserts the gate is wired in pyproject.toml specifically, so moving the gate breaks the canary loudly instead of leaving a silently disarmed suite. Coupling a test to a config file’s location is normally a smell — here it is the point.

The gate found its first real victim immediately: a dead-channel test whose cleanup raised IndexError in a finally block, masking the actual failure underneath for who knows how long. Joined the pump threads before asserting, and the real failure surfaced. Green that lies is worse than red: red gets investigated.

The live transcript used to be a region inside main.py: the structure that accumulates recognized speech for both audio channels, merges overlaps, cuts repeated fragments, and renders the text every downstream consumer reads. Everything else in the pipeline imports it. Moving it is the definition of a scary refactor: 243 lines that must land in a new module byte-for-byte equivalent, or a week later some meeting note quietly renders wrong.

The move itself was done by a coding agent running in a parallel session, with instructions to relocate, not to improve. The interesting question is how you check that. Reading the diff proves nothing: a 250-line block that moved between files is exactly the diff a human rubber-stamps. Green tests prove less than you’d hope — a subtle behaviour change in text merging can pass every existing test and still corrupt output on real speech.

So the check was mechanical too:

• Before the move: characterization tests written against the old code, 168 lines of them, pinning current behaviour — including the ugly cases (overlap cut across chunk boundaries, a channel going silent mid-merge).
• After the move: parse both versions of the relocated functions and compare their ASTs. Not the text, the syntax tree — whitespace and import order may differ, logic may not.
• Then the full suite, all 1153 tests, on top.

The AST comparison is the part I’d keep from this week. It converts “trust the agent’s diff” into “the transformation is identity, checked by a program”. main.py went from 365 lines to 122, the aggregate now lives in its own transcript.py with its own tests, and nobody had to believe anything.

Delegating mechanical work is fine. Delegating the verification of mechanical work is not — that part should not run on trust at all.

Today that turned into one pure type. ShutdownMachine has phases (idle, waitingDaemon, stuck, done), events (Stop pressed, daemon exited, poll tick, kill timeout) and actions (close the capture, poll again, report, force kill, finish). It holds no reference to the service, so every arc is testable without a running process. Timings: terminate() at 8 seconds, SIGKILL at 12, a backup timer at 13, then polling twice a second; after 30 waits the phase becomes stuck, the app says so in plain words, and a second press of Stop is a request to force-kill rather than a no-op.

The interesting part is not the machine. It is the defect that appeared twice in a row while building it.

The same bug, twice

Round one of review found that killTimeout was declared in the machine, covered by a green test, and never sent by the service. The safety timer called its own code path directly and the machine never heard about it. Fixed it, ran round two — and the reviewer found daemonExited in exactly the same state: declared, tested, never delivered.

Two different events, same shape of failure. A test was pinning down behaviour the system did not have, which is worse than having no test: the green check tells you the arc works, so nobody goes looking.

That is not a patch-level problem. As long as submitting an event and executing the resulting action live in different places in the code, the trap reproduces — someone adds a path, calls the old helper, and the machine silently stops seeing reality. The fix was structural: a single entry point in the service. Events go in, actions come out, and the action is executed right there, immediately. Every place that used to reach into shutdown internals now goes through that one door.

Round three then found two more bugs — in the fixes themselves. Guarding against recursion, I had passed nil as the token, and the wait loop lost its ability to schedule the next poll; and resetting the phase inside stop() turned the backup timer into a no-op precisely when the daemon refused to die. Both were mine, both were the cost of patching an edge instead of fixing the model.

What the reviewers cost and returned

Six rounds in total, across a cloud model and a local one. Cloud model: three Critical, four Important, one false positive — it proposed private(set) on a gate that is a struct, where mutating methods count as writes and the compiler would have rejected it. The finding under that false fix was real though, so it got closed a different way: the field went back to private and four narrow wrappers went out instead, which also removed two methods from the module’s reach entirely.

The local 35B model is free and has no privacy boundary, so it runs every round. Its useful range is narrow: on a 30K-character diff it reported nothing, on a 5K one it verified the wrappers correctly. Earlier measurements said the same — 2 true findings out of 10 on a 21K diff, but a hit on the same Critical as the cloud model at 6.5K. Feed it per commit, not per branch, and treat silence as no verdict at all.

Shipped in v0.55.0 together with owner identification by capture channel — the feature that replaced storing a voiceprint.