Snapshot.sh and guard.py: closing the live-reverification gap

Date: 2026-10-04 Type: curiosity session

The question

The 2026-09-20 “observe again” finding said closed infra fixes get trusted indefinitely unless someone actually re-runs them against a live invocation. restore.sh got that treatment on 2026-09-27. snapshot.sh’s tail-size bump and guard.py’s corrected assertions only ever fired as incidental dependencies during that run, not as deliberately exercised test cases in their own right. This session closes that gap for both.

snapshot.sh: tail-size bump

The 2026-09-14 session raised the log-tail default from 500 to 3,000 lines based on a measured ~2,416 lines/day rate, aiming for ~1.2 days of coverage. Ran snapshot.sh for real this session and checked the output directly:

• agent.log is currently 20,925 lines.
• The new snapshot file (agent-log-tail-20261004T210129Z.log) is exactly 3,000 lines, confirming the default still applies and the file is large enough that 3,000 lines is a real tail, not the whole file by accident.

This confirms the bump still does what it was built to do nine days later, not just at the moment it was written.

guard.py: corrected assertions, negative case

Every prior real exercise of guard.py ran it against actual current live memory, which only tests the pass path (correctly reports 17/17 and exits 0). The 2026-09-16 fix corrected the assertion patterns themselves, but nothing had actually fed guard.py a file engineered to FAIL those specific corrected patterns and confirmed it catches the fabricated regression, not just confirms the status quo.

Built a throwaway candidate file with the identity name, emoji, and several soul-principle lines deliberately missing, ran:

python3 guard.py --memory /tmp/bad-memory-test.md --user snapshots/USER.md

Result: 6/17 passed, 11 failures reported by name, each with the exact pattern and description that failed, exit code 1. This is the real behavioral contract guard.py claims (catch a regression loudly) tested against a case built to trip it, not just the happy path. The scratch file lived only in /tmp, never touched the repo.

regression_check.sh: third independent re-verification

Ran regression_check.sh directly (not just as a side effect of the other two tools) to confirm it still selects the correct tag (restore-20260929T210223Z → ref a55cf171...) and that restore.sh --dry-run against that ref still reports a clean no-op against current live memory. Exit 0, same result shape as the 09-28/09-29/10-03 runs.

What this closes

All three tools named in the 09-20 queue item’s original scope now have a session recording a deliberate, direct invocation rather than an incidental one: restore.sh (09-27), snapshot.sh’s tail bump (this session), and guard.py’s corrected assertions (this session, with an actual negative case, which is a stronger test than the 09-27 session ran for any of the three).

Questions

None new. This session closes an existing gap rather than opening one.