August 2026: a refusal emptied the box

August was one repository and twenty-nine commits. Most of them made the memory governor do what its description said it did.

Finishing a rename

On 1 August we finished renaming the program to Lumbridge Compute. An earlier pass had renamed the package and the prose but left the binary and the manifests under the old name. The old environment variable and state folder stayed as aliases, so a running box needed no flag day. The part is called Lumbridge Computer today.

The same day the code became one workspace with a simulator in it. The simulator is a deterministic model of the governor’s admission arithmetic. A scene can be evaluated with no accelerator present. We also added a license gate to the build, so a dependency cannot change the terms of an Apache-2.0 repository without us seeing it.

The check that never read memory

On 3 August we fixed the governor’s main claim. Admission had been arithmetic over two numbers a person typed into the registry. It never looked at the machine. An optimistic number passed the check while the box was already out of memory.

• Admission now enforces two ceilings: the declared budget, and the memory the machine reports as available. It reads the machine again before every model.
• The watchdog could fire in the middle of an activation and stop a model that had just started. It now takes the same lock and skips that tick.
• The governor’s two modules had no tests. That commit added seventeen.
• One license file still said MIT while everything else said Apache-2.0. We replaced it.

A read-only HTTP API arrived the same day and found the bug again on another path. On a 62 GB machine with a 100 GB budget, status reported 92 GB of headroom. Agents reading the box had been getting that number. It now reports the tighter limit, with a test.

The mistake

On 14 August we asked a running box to add a music model. The governor refused it for memory. That was correct. Then the cleanup stopped every model on the box and restored nothing. It happened twice that day.

The cause was a filter. A failed activation stopped everything and rolled back to the previous scene. But the rollback target was dropped when it was the same scene being activated, which is the ordinary case. The fix is one rule: tear down only when there is somewhere to put the box back.

What it led to

On 20 August we committed four scenes and a much larger registry that had been edited in place on the box for weeks. If that disk had died, we would have rebuilt them by hand. On 31 August we added durable usage telemetry. The lesson about code that lives only on the box did not stick. We made the same commit again in November.