[runyourempire]

What

Two defects found in a live check of the rebuilt operator app (main 4d257b9).

1. The brief stated facts from the previous session's inventory

Brief #421 (claude-sonnet-5, 09:51:10 UTC) said "ammonia (4da/src-tauri) also newly flagged: bump to >= 4.2.4 (cargo add ammonia@4.2.4)". Cargo.lock has carried 4.2.4 since #980.

The actual ordering, from data/logs/fourda.log.2026-10-18:

UTC	event
09:50:46	Preemption startup warm. The feed was computed from the stored inventory; ammonia 4.2.0 → 4.2.4 is still in it.
09:50:56	Frontend auto brief (trigger="auto", from the post-analysis effect). "Auto-trigger regenerating — the facts changed".
09:51:10	Brief #421 written.
09:51:40	Startup ACE scan rewrites user_dependencies.
09:53:49	Lockfile walk report.
09:54:16	"ACE context scan complete".

The startup ACE scan (initialize_ace_on_startup) waits for first light and a grace period, then walks every project, which took about 8 minutes here. Nothing told the readers of dependency facts that the stored inventory was stale until it finished. The same applies to the startup catch-up morning briefing (app_setup, 3 s after start), which builds its notification from the Preemption feed.

Fix: a real "inventory fresh" signal (inventory_freshness.rs, a tokio::sync::watch gate; no polling):

• The gate can never stay shut (review B1). begin_startup_refresh() shuts it when the startup ACE scan is scheduled and returns a RefreshGuard, which is moved into the scan task. The gate reopens, exactly once, on whichever comes first:

  • the guard drops: the scan finished, failed, or its task panicked (release builds unwind);
  • a hard 15-minute deadline passes (a hung walk, such as an unreachable network share), with a warn log.

  Reopening rebuilds the Preemption feed (refresh_preemption_cache_after_cycle) and emits inventory-fresh.

• Brief (generate_briefing_internal, which covers the IPC command and the background auto-brief job): while the gate is shut it builds no facts and returns {success:false, error:"inventory_refreshing", inventory_refreshing:true} at once (review S6). Nothing is taken from the model call's share of the UI's 120 s timeout.

  • The UI shows a neutral pending state (review S5): role=status, a spinner and secondary text, no Retry, not the red error banner or "generate failed". The text is "Your projects are being rescanned. The brief will be written as soon as the scan finishes." (13 locales).
  • The UI generates the brief once, on inventory-fresh. The listener asks once more right after it registers, because the event can fire before it exists, and removes itself after firing (review S4).

• Background auto-brief job: when deferred, it logs and generates once the gate reopens, instead of waiting for the next scheduler pass.

• Startup catch-up morning briefing: waits for the gate (bounded at the deadline + 1 min), otherwise skips.

• Scheduler tick (review S3): the check runs only when a briefing is due, before the stale-results reset (so that wait isn't restarted every tick), and logs at debug. The briefing is not marked sent, so the next tick delivers it.

• With no context directories, no scan is scheduled and nothing waits. Only the startup rescan of the current session is gated.

2. The model's own working leaked into the brief

The same brief ended a bullet with "— medium severity, listed under Also Open rather than critical, noting it here since it's NEW."

• Prompt (one line, kept separate from fix(advisories): a Maven-only project is not ready; the Brief names what it did not check (W5a) #987's coverage wording): never write about the brief itself (where a line is listed, why it is or is not in a section) or use the FACTS block's labels (ACT NOW, ALSO OPEN, NEW, UNCHANGED). An ALSO OPEN fact goes only in the "Lower severity" line, even when it is NEW.
• Post-filter briefing_meta::strip_meta_commentary, applied after the dev-tag filter. It is conservative (review B2), because a false positive deletes a finding:
  • a leading FACTS label ("Also open: braces (navcal), …") loses only the label, never the bullet;
  • a clause is removed only when it carries a marker that only ever describes the brief itself ("listed under", "noting it here", "also open", "facts block", "this brief", "since it's NEW", …) and names no package from the brief's facts;
  • markers match whole words ("also open" never matches inside "also openssl").

Tests

• inventory_freshness:
  • a fresh gate never waits;
  • a pending refresh reopens on drop and runs its finish once;
  • a waiter wakes when the refresh finishes;
  • a guard dropped by a panic reopens the gate;
  • a hung scan releases the gate at the deadline, and the late drop is a no-op;
  • a_brief_requested_during_the_rescan_states_no_facts.
• briefing_meta:
  • the exact live sentence becomes "- ammonia (4da/src-tauri) also newly flagged: bump to >= 4.2.4 (cargo add ammonia@4.2.4) — medium severity.";
  • real findings and headings are untouched;
  • a meta-only line is dropped;
  • "as listed in the FACTS block" is removed;
  • false positives:
    • "- Also open: braces (navcal), uuid (4da-ledger)" keeps both packages;
    • "- ammonia 4.2.3 (listed under RUSTSEC-2026-0373): bump to >= 4.2.4" is kept whole;
    • "New minor release", openssl / openapi-types / newrelic.
• briefing_prompt_tests::prompt_forbids_talking_about_the_briefs_own_structure.
• Frontend:
  • the briefing slice sets the pending state, not an error;
  • briefing-inventory-retry.test.ts: the listener is armed once, re-asks on registration, fires once, and removes itself.
• Runs:
  • Rust: inventory_freshness briefing digest_commands monitoring gives 264 passed, 0 failed.
  • Frontend: the touched suites give 34 passed; tsc is clean.

Not done / notes

• The Preemption tab can still show the startup-warm feed (or a restored snapshot) for the few minutes before the rescan finishes. It is now rebuilt as soon as the rescan finishes, where before it waited for the next engine cycle (09:58 in the log). No notification or brief is built from it in that window.
• Not verified live in the app: that needs a cold start of the operator app with a changed lockfile. The ordering above is from the live log, and the gates are unit-tested.
• briefing_prompt.rs is also claimed by fix/severity-parity, and fix(advisories): a Maven-only project is not ready; the Brief names what it did not check (W5a) #987 edits the same prompt. This PR adds one rule line next to the existing meta-commentary rule.

🤖 Generated with Claude Code

https://claude.ai/code/session_018hjX3pEMmC7CHfG41PiPj7