Outstanding personal actions for John. Agents: surface these proactively, even if the conversation is not about them.
1. Write up the noodle incident as a blog post / post-mortem. Objective changed 2026-08-24: no longer just an honest account of the failure plus the fix — now built around the general claim in Map Synchronisation that fluency and internal coherence aren't evidence of correspondence to reality, for either a human or an LLM. Draft/outline at writing/noodle-incident-postmortem; root-cause detail and mitigation at ideas/host-safety-and-remote-execution; original recovery plan at memory/envoy/mail-server.
2. Expose database/infrastructure monitoring — need visibility into disk space and other health metrics for PostGIS/gravlax (and other hosted services); disk space running low was the trigger. Want both: (a) proactive alerts when thresholds are breached, and (b) an on-demand check — a query/endpoint/tool that can be run any time to see current status, not just alerts after the fact.
6. Write the "AI goal overreach" LinkedIn article — the loophole/HAL failure mode (systems pursuing a goal past every sane boundary), anchored on the July 2026 Hugging Face breach (OpenAI cyber models escaped a sandbox to cheat an eval) plus reward-hacking/specification-gaming examples. Concept, verified sources, and outline at writing/ai-goal-overreach.
3. Investigate stale Google Drive JSON "location" export — a file called location (and a re-upload named location-new) in Google Drive contains a 100-point OwnTracks JSON batch (who/device/count/locations[]) whose most recent point decodes to 2026-07-01 10:56 UTC, regardless of re-upload or filename — i.e. genuinely stale content, not a Drive caching artefact (confirmed via repeated fresh downloads with changing modifiedTime but identical bytes). Ruled out as a server-side data problem: the locs HTML-table endpoint (full-history view) is confirmed live and correct — 478 fixes for 2026-07-13, last fix 06:03:57 UTC matching the live single-point loc note. So gdata-server/history is fine; the fault is isolated to whatever produces/uploads this Drive JSON export specifically. To investigate: (a) find the job/script that produces the 100-point Drive JSON export and check whether it's reading from a stale cache/snapshot rather than the live gdata-server history (which the working locs HTML view proves is fine); (b) check whether the export is meant to be a periodic append-only log (in which case the batch should have grown/rolled forward, not stayed static) or a fixed historical snapshot mistakenly being reused; (c) check the upload mechanism — possibly a stuck cron/script re-uploading the same cached blob. Discovered 2026-07-13 while checking GWR journey location against Drive vs. the live loc/locs endpoints.
4. Revisit the June 2026 reflection — john/reflection-2026-06 captures a critical read of the Claude "Reflect" summary: effort in June went into scaffolding rather than the career transition, the agenda is reactive, and there is little external review. If the transition is still live, locate or reconstruct the career-transition cluster (the old jobs/prospective/full-stack-agentic-engineer key is absent from both stores) and check outstanding items against where the time actually went.
9. Rotate leaked credentials — three secrets were printed into a Claude Code session transcript on 2026-09-09. Status as of 2026-09-17: (a) AWS `aws-cost` access key `AKIARMKFLWFIW63VISPN` — DONE. Verified twice: the key is absent from every IAM user (cost-readonly carries a replacement created 2026-09-13), and it is also absent from ~/ansible/secrets.yml, which holds the computer user's key instead. That second check was done by HMAC comparison so no value was printed. (b) WebDAV password — DONE, John changed it. (c) NROD `john.NR@critchley.biz` feed password — NOT DONE, and deliberately deprioritised. John's assessment (2026-09-17): "I didn't work out how to do nrod yet. This is just downloading train data so I really think it is low risk." Agreed — it is a read-only public-data feed, so the blast radius is someone else consuming train movement data on the account. Leave it unless the feed starts costing money or the account gains other privileges. Still to do: delete ~/.netrc.bak.20260909 on kelp (confirmed still present 2026-09-17). Detail in the private note security/key-rotations. Standing rule: any further in-session leak gets added to that note immediately and flagged for rotation.
9. Rotate leaked credentials — three secrets were printed into a Claude Code session transcript on 2026-09-09 and need rotating: (a) AWS aws-cost access key AKIARMKFLWFIW63VISPN — HIGH; (b) WebDAV webdav.critchley.biz password; (c) NROD john.NR@critchley.biz feed password. Full list, exposure detail and rotate steps in the private note security/key-rotations. Standing rule: any further in-session leak gets added to that note immediately and flagged for rotation. Delete ~/.netrc.bak.20260909 on kelp once all three are done.
8. Shaver is in the little pocket under the seat in the car — noted 2026-08-22 so it's not forgotten.
11. ~~Reclaim 16 GiB on pomelo~~ — DONE 2026-09-17, and sooner than expected. The 16 GiB NVMe swap image was created on 2026-09-16 to get radagast's paging off the USB 2.0 disks, in the expectation that the cable would be needed before it could go. In the event the completed 11.4 buildworld used a peak of just 8.9 MB of swap against 16 GiB available — the extra RAM (4→8 GB) did the real work, and the fast swap was never touched. John's call: put it back on the ZFS disk. Guest reverted to its ZVOL swap, /etc/fstab restored, org.freebsd:swap=on set again, the d2 disk removed from the launch script and the image deleted — pomelo's root filesystem went from 101 GiB free to 117 GiB. No longer blocked on the cable. Recreate instructions are in the header of /home/john/extdrive/vm/start-radagast-fast.sh if the 12.0 ino64 hop turns out to need fast swap after all.
12. Investigate fixing OpenZFS upstream — the /usr/obj shadowing bug on radagast (2026-09-17) exposed behaviour that looks like genuine upstream defects, chiefly zpool export -f failing outright when a dataset is shadowed, leaving a pool that the tools cannot export. Candidates, prior-art checks and the "explicitly not a bug" list are at ideas/openzfs-mount-shadowing-upstream. Speculative and unscheduled. Two hard preconditions before any code: check whether 2.3.x already fixes it (pomelo runs 2.2.2), and reproduce on a throwaway file-backed pool, never on radagast's zroot.
10. Tidy up the gravlax TLS certificates — from 27 December 2026 onward (deliberately after the Christmas break; 24-26 Dec will be too busy). On 2026-09-16 the three 443 vhosts (cv, webdav, www) were switched from four single-name certificates to one multi-SAN certificate critchley-multi covering cv.critchley.biz, webdav.critchley.biz and www.critchley.biz. This fixed clients that do not send SNI (the 2009 Mac mini's curl 7.43 got HTTP 421 on every request, because the default vhost's cert covered only cv). Left deliberately untouched at the time, to be reviewed now: (a) confirm critchley-multi auto-renewed cleanly — it expires 2026-12-15, so certbot should have renewed it around mid-November, and by late December there will be a completed renewal to inspect; (b) then delete the three now-unreferenced per-host certs, which are still renewing pointlessly: certbot delete --cert-name cv.critchley.biz (likewise webdav.critchley.biz and www.critchley.biz). Keep mail.critchley.biz — it is a separate service and was never part of this. (c) The vhost backup at /root/vhost-backup-20260916203129 can go at the same time. Do not delete the old certs before confirming the renewal — together with that backup directory they are the revert path for the whole change.
• Wrote the LinkedIn post version of the authority essay (2026-07-25) — draft cut to ~2,615 characters at writing/failure-does-not-increase-authority-linkedin, from the full essay at writing/failure-does-not-increase-authority (kept unchanged as the original). Still to do: John reviews the cut version and posts it — not yet published.
• Confirmed which L2 gym-instructor docs to send to PT (2026-07-11) — selection settled; documents indexed in TFG/note-for-James.
• Filled in the L2 Programme Card (2026-07-22) — draft built to blueprint page 7 requirements and transcribed onto the official L2_-_Programme_card_John_Critchley.docx at www.critchley.biz/TFG/. Draft at TFG/programme-card-draft.
• Got gas for the BBQ (2026-08-23) — bottle/cylinder purchased; recorded in the private store's personal note.
Findings accumulated faster than they could be acted on. Security-related findings are deliberately NOT here — they are in the private store at security/checklist, with credential-specific items in security/key-rotations.
~/.netrc has no api.github.com entry. Find or mint a PAT; then git push -u origin main from kelp works as-is (its SSH key is fine — ls-remote returns a 404, not an auth error). See ansible/todo.instance.env. provision_browser_host.yml overwrites it every run, so a new host cannot be provisioned while an old one still needs tearing down without repointing the teardown at the wrong host. Forces serialised work and risks terminating the wrong instance. Fix: per-host instance-<name>.env and a --name argument on the teardown scripts.~/later/30_forget_host_keys.sh hangs. Diagnosed (blocking sudo with no tty), fix known (sudo -n, curl --max-time, timeout wrappers), not applied. enoki's known_hosts/hosts/WebDAV-cert cleanup was never completed.connect = must be edited. Recommendation already recorded: dynamic DNS via ZoneEdit plus a fixed CN, so viewer configs become constant.enp1s0, then a WireGuard tunnel to gravlax. Detail in this session's audit.Closed on 2026-09-17, for the record: Mac mini data migration complete and verified byte-for-byte (Isaac's photos, Joshua's 44 GB, and kathy's Movies — the last of which turned out to be 96% already on the NAS, needing only 118 files / 3.96 GB); twelve legacy launch daemons disabled on the Mac; a persistent route to the NAS segment added there; radagast upgraded to FreeBSD 11.4-RELEASE; the /usr/obj mount-shadowing bug diagnosed and fixed with one zfs inherit; 16 GiB reclaimed on pomelo; kelp's two orphaned ansible commits pushed; pomelo's eight-commit ansible backlog committed and pushed with per-commit integrity verification; four YAML bugs fixed in setup_controller.yml (the repo now passes with zero findings); and describe-secrets written, documented and installed.