Ultron — Implementation Ledger

First turn of a new conversation now writes conversations.model (was guarding on the null request id), so Allegro stays Allegro across refresh. DB-verified.

The URL-sync effect no longer clobbers a real ?c=<id> on first mount (a Next 14.2 replaceState→useSearchParams feedback loop). User-confirmed smooth.

lite→Kimi, smart→DeepSeek V4 Pro (Azure, new OpenAI adapter), deep→Opus. No Sonnet. Was silently forcing every sub-agent through the Kimi bridge. Proven: [subagent] parent_tier=smart -> deepseek, real shell tool-call worked through the adapter.

A flagged scrape logged a sanitized event (593→292 chars). The 8s→20s timeout fix stopped it from silently fail-opening.

An injection scrape logged injection_pattern [ignore-previous, role-reassign]; the model returned only the facts and ignored the embedded deploy_wfp/send_email.

fire → settle → bg_trigger wake → resume, with no manual nudge. The phantom messages.user_id column was the "not waking up" bug; now fixed.

DeepSeek orchestrator, 3 CF build jobs, auto-woke twice, pushed a real branch, ~$0.49, telemetry captured. Survived client disconnect (headless durability).

When a user turn ends asking-to-continue with no job pending, fires exactly one self-correcting nudge; the bg_trigger nudge is never re-nudged (hard bound, no loop). Correctly silent on two real clean completions.

chat-v2 used to check credits once then run ~120 unbounded rounds. A loop-head guard now trips on a cost ceiling ($10 default, env-overridable) or 4 all-failing rounds, ends the turn cleanly, and logs to guardrail_events. Verified live: a real turn tripped cost_ceiling at round 1 ($0.0123 vs a test $0.001 ceiling) and stopped.

One isTerminalJobStatus()/isTerminalRawStatus() replaces 8 drifting sites; typed tool-flags scaffold (fail-closed). tsc-clean, behaviour-inert.

The lying RUNNING leaf chip now reads neutral "launched" instead of spinning forever; running monitor cards capped at 3 + "+N more". Code-verified (UI — needs a browser to see).

Nightly memory-consolidation + failure-audit fires /api/cron/dream daily 08:00 UTC via the ultron-cron worker.

Pre-commit render-harness, PR gate, and an @ultron GitHub action.

An outward/destructive tool fired after untrusted-content ingest is LOGGED to guardrail_events (concurrency-safe per-turn guardState), not yet enforced. Flip to enforce once the false-positive rate is known.

Drop fat tool bodies on bg_trigger / scheduled re-entries after a long idle. Cheap deterministic win.

Only one cache_control today (system prompt); add tool + history breakpoints. Anthropic-only → helps the deep/Opus path.

25 real app errors (mostly a missing IconPlaceholder import) + a tsconfig exclude for chrome-extension, then drop ignoreBuildErrors so type bugs can't ship.

Hide the 🌙 Dream conversation from the session list; OnError-persist + other hook gaps; telemetry /api/summary + analytics card.

Anthropic balance empty until Monday. The deep→Opus routing CODE is correct; the whole Forte tier (orchestrator + sub-agents + title-gen, all Anthropic) is down until top-up. Smart (DeepSeek) and Lite (Kimi) unaffected.