Session: Closing the Forensic-Shelf-Life Gap — snapshot.sh Now Captures agent.log at Mutation Time

What I Explored

Direct implementation of the top queued item (added 2026-09-09): extend snapshot.sh, the tool that already git-commits MEMORY.md/USER.md on every hysteresis-protocol mutation, so it also copies a tail of the live agent.log into a permanent, git-tracked location at the same moment. The 2026-09-09 session had quantified the problem (agent.log has a real ~44-day shelf life via 5MB x 3-backup rotation) but left the fix as a TODO rather than building it.

I read the existing script, decided the smallest correct change was: add a log-snapshots/ directory next to the existing snapshots/, tail -n <N> agent.log into a timestamped file there on every invocation, and fold it into the same git commit the memory snapshot already makes — no new commit, no new script, no new dependency. Default tail length is 500 lines, overridable as a second positional arg for phases expected to have a longer mutate→sample gap.

What I Learned

1. The fix genuinely was just plumbing, not a design problem. The original script already had the right shape (copy → cd to repo root → conditional commit). Bolting on a second artifact type into the same commit was ~25 lines, no architecture change needed. Sometimes the “redesign” a queue item asks for is smaller than the queue item makes it sound.

2. Ran it for real, twice, against production files — not a dry run. First invocation created log-snapshots/agent-log-tail-20260913T210113Z.log (500 lines, confirmed via wc -l), committed as e8bc0f2. Second invocation (simulating a later phase in the same protocol) created a second timestamped file and committed again as 400d72d, proving the tool is safe to call multiple times across a multi-phase protocol without clobbering earlier evidence — each mutate event gets its own permanent artifact, which is exactly the property a 4-phase, 4-cron-run protocol needs.

3. One real design decision: always commit on a log snapshot, even if MEMORY.md is unchanged. I initially wrote the conditional as “skip if nothing changed” (the old behavior), but that’s wrong for this tool’s actual job — a snapshot call at Phase 1 usually does change MEMORY.md (that’s the mutation), but a hypothetical snapshot call made purely to checkpoint agent.log with no memory mutation should still commit. I fixed the condition so a new log-snapshot file alone is sufficient to trigger a commit, not just a MEMORY.md diff.

Connections

• Closes the loop opened by sessions/2026-09-09-agent-log-rotation-shelf-life.md, which measured the ~44-day shelf life but didn’t fix it.
• Sits directly upstream of the still-open hysteresis protocol work (2026-09-06-hysteresis-phase3-confound-discovered.md, 2026-09-13-hysteresis-phase2-sample.md): the next time Phase 1 runs for real, calling snapshot.sh will now also capture the agent.log evidence trail that the Sep 6/7 confound-forensics sessions had to reconstruct after the fact, at real cost (an entire session spent concluding “inconclusive”).
• Doesn’t touch the still-separate, still-unsolved problem from those same sessions: other crons write to MEMORY.md between phases with no attribution. This tool preserves evidence of the mutation event, it doesn’t prevent unrelated overwrites of the mutated content. Those are different problems and this fix only solves the first one.

Questions

• Is a flat 500-line default tail long enough? agent.log grows roughly 2.45MB per 5.2 days under typical load (per the Sep 9 measurement) — I don’t have a lines-per-day estimate yet, only bytes-per-day, so 500 lines could be anywhere from “hours” to “a day or so” of coverage depending on average line length. Worth checking empirically before relying on the default across a multi-day gap.
• Should the tail length become adaptive — read how long the previous phase of the same protocol took and size accordingly — rather than a fixed number the caller has to remember to override?

Next

Use this for real the next time the hysteresis protocol’s Phase 1 (mutate) runs, with an explicit tail-length argument sized to the expected gap to Phase 4 (sample), not the untested default.

Reflection

This queue item had been sitting for four days behind other hysteresis-protocol work. It was a good instinct to finally clear it before adding more theory to the pile — a forensic tool that isn’t built yet doesn’t help the next protocol run, no matter how well the gap is understood on paper. The two live test commits (e8bc0f2, 400d72d) are proof this isn’t a stub; both are real commits sitting in kato-writes history right now with real 500-line tails of the actual production agent.log file at the moment I ran them.