Progress update, 2 Sept 2026

Updates are bullet-point summaries generated with AI from my commits and build notes, then checked by me. Project articles and learning notes are written by me.

One of four cover prompts kept failing its own integrity check, and it was the only one containing an en dash. The instruction said “read the file”, which PowerShell is free to satisfy with a default-codepage read that decodes UTF-8 as cp1252, so one character arrived as three and a paid generation was discarded every time. The check was right; the read was wrong. The instruction now prescribes the exact command.
With the read fixed, the dash was still coming back as an ASCII hyphen, same length, one code point for one. Tightening the instruction to forbid normalisation did not stop it across three more renders. The fix was to stop echoing text at all: the attestation is now a SHA-256 digest, which crosses a Unicode serialisation boundary unchanged. Same trust limitation as before, minus a channel that had already failed three times.
Potential exposure is 331 of 4,285 guide sections with non-ASCII headings. It had never been seen because none of the six articles generated so far happened to contain one.
A format rule nearly shipped as dead code. Validating “is this 64 hex characters” inside the comparison killed no test when deleted, because an exact digest comparison already rejects every malformed value. Split out with its own error message, both mutations now fail: removing the comparison breaks 5 tests, removing the format rule breaks 2.
The deprioritise-recently-skipped fix ran for real for the first time and worked: three runs, three different sections, where before run 2 would have re-selected run 1’s section and stalled. Codex was the stricter reviewer in all three.
First cover under the new recipe derived model years 2002-2010, the whole first generation, which is exactly the fault it was built to fix. Accepted first candidate.
Installed a standing rule: comments say what the code does or why a non-obvious choice was made, and nothing is signed (no attribution trailers, no tool names in commit messages or headers), with an explicit carve-out so provider names used as functional identifiers in code are never renamed.