---
title: Agent Operations — Remediation Backlog
tags: [agent-operations, problems, backlog, remediation]
scope: shared
generated: 2026-10-06
source: HermesHost/diagnostics/backfill/all-v1/backlog.json
---

# Agent Operations — Remediation Backlog

> Derived from [[problems-registry]] (2026-10-06). Priorities: **P0** blocks automation/work, **P1** high-frequency hygiene, **P2** recurring friction, **P3** noise.
> Owners: **Agent behavior** (fix via skill/memory/instructions) · **Config** (env/`hermes config`) · **Infra (Tony)** (external/manual). Effort: S/M/L.

**Totals:** 8 P0 · 9 P1 · 18 P2 · 2 P3

## P0

### T01 — timeouts  ·  P0 · effort M · owner: Agent behavior
- **Signal:** 715 occurrences across 35 finding(s) · profiles: default, jimmy, leonard, verimail
- **Root cause:** Commands routinely exceed default timeouts and the agent neither raises timeout= nor backgrounds long jobs, so downloads, model startups and pings die mid-run.
- **Action:** Default long/threshold-crossing commands to terminal(background=true, notify=true); set explicit timeout= only for genuine short waits. Add a pre-flight rule: 'probably >30s? background it.'
- **Evidence:** `default:20260829_075244_4ffe68a7#3428`, `default:20260828_144747_49a94d46#1621`, `default:20260830_140032_70edf88c#21543`, `default:20260901_210256_6c1c52da#26838`

### T06 — git remote / auth  ·  P0 · effort M · owner: Infra (Tony)
- **Signal:** 105 occurrences across 5 finding(s) · profiles: default, jimmy, leonard
- **Root cause:** Git remotes are misconfigured (bad Gitea hostname, missing/expired HTTPS credentials, unsupported ssl-no-revoke flag) and pushes race with remote updates.
- **Action:** Standardize the Gitea remote URL + token; drop unsupported flags (ssl-no-revoke); pull/rebase before push.
- **Evidence:** `default:20260901_210256_6c1c52da#26833`, `default:20260901_210256_6c1c52da#26844`, `default:20260901_210256_6c1c52da#33282`, `jimmy:20260903_072353_f46f323c#422`

### T12 — approval / consent block  ·  P0 · effort M · owner: Config (Tony)
- **Signal:** 51 occurrences across 10 finding(s) · profiles: default, jimmy, leonard
- **Root cause:** The agent keeps attempting to read .env/credential stores and to hand-edit Hermes config, all of which are blocked by design.
- **Action:** Unattended runs (cron, -q) must not raise approval prompts. Add a non-interactive allowlist / pre-approval policy, and have the agent detect unattended context before prompting.
- **Evidence:** `default:20260831_154908_9c27060c#22127`, `default:20260828_165853_0ff9f889#2225`, `default:20260829_135124_84d145aa#4288`, `jimmy:20261003_161554_b72b50c7#25376`

### T17 — tailnet / SSH / VPS  ·  P0 · effort M · owner: Infra (Tony)
- **Signal:** 20 occurrences across 3 finding(s) · profiles: default, jimmy, leonard
- **Root cause:** The user could not get the Tailnet Watchdog reminder stopped (the stop action/job lookup failed), repeating the request many times.
- **Action:** Re-auth the Tailscale node (correct `tailscale up`, no --force-reauth on headless), fix the jump-host/SSH key so VPS work unblocks.
- **Evidence:** `default:20260901_061717_10e875f4#24639`, `default:20260901_061717_10e875f4#24647`, `default:20260901_061717_10e875f4#24730`, `jimmy:20260905_173250_ca1a2ee5#5318`

### T18 — uv trampoline  ·  P0 · effort S · owner: Config
- **Signal:** 20 occurrences across 1 finding(s) · profiles: default
- **Root cause:** uv's managed-Python trampoline cannot find or spawn the Python child process (os error 2), breaking every Python invocation routed through uv.
- **Action:** Pin a concrete interpreter or set UV_PYTHON to a real python.exe; stop routing through the uv managed-install trampoline.
- **Evidence:** `default:20260919_133653_cfea5b#37254`, `default:20260919_133653_cfea5b#37258`, `default:20260919_133653_cfea5b#37331`, `default:20260919_133653_cfea5b#37663`

### T22 — local model load/serve  ·  P0 · effort M · owner: Config
- **Signal:** 14 occurrences across 4 finding(s) · profiles: jimmy, leonard
- **Root cause:** llama-server is invoked with a missing model file and malformed args/paths (backslashes stripped, producing 'C:llamallama-server.exe').
- **Action:** Persist a known-good llama.cpp serve config (valid n_gpu_layers within free VRAM, validated JSON); pre-flight validate before every restart.
- **Evidence:** `jimmy:20260903_153357_b3175c#1520`, `jimmy:20260903_153357_b3175c#1518`, `jimmy:20260903_153357_b3175c#1538`, `jimmy:20260903_153357_b3175c#1526`

### T29 — Telegram gateway down  ·  P0 · effort M · owner: Infra (Tony)
- **Signal:** 10 occurrences across 4 finding(s) · profiles: jimmy, leonard
- **Root cause:** The Telegram gateway service dies/regresses repeatedly across sessions without a durable fix.
- **Action:** Add a supervisor/health-check that restarts the gateway on failure (run the messaging-channel-diagnostics skill); recurring breakage spans weeks.
- **Evidence:** `jimmy:20260907_213044_a4748a#8059`, `jimmy:20260907_213044_a4748a#8071`, `jimmy:20260906_095449_6093b4#8493`, `jimmy:20260926_102836_24ab5d#20785`

### T30 — memory_search zg binary missing  ·  P0 · effort S · owner: Config
- **Signal:** 10 occurrences across 1 finding(s) · profiles: jimmy
- **Root cause:** The zg/zvec memory-search backend binary is not installed or not on PATH, so memory_search fails every call.
- **Action:** Set jimmy's zvec `zg_bin` to the full path of zg.cmd so memory_search stops failing (already a known memory fact — apply it).
- **Evidence:** `jimmy:20260910_230923_8a32a942#10979`, `jimmy:20260912_065518_7410d52d#11620`, `jimmy:20260912_122538_385e3988#12355`

## P1

### T03 — path / file not found  ·  P1 · effort S · owner: Agent behavior
- **Signal:** 205 occurrences across 13 finding(s) · profiles: default, jimmy, leonard, verimail
- **Root cause:** The agent repeatedly issues MSYS/Linux-style or otherwise wrong paths on Windows (and wrong working directories), so file and cd operations fail.
- **Action:** Resolve paths before use: search_files/ls to discover, forward-slash native paths for native tools, verify existence before read/cd.
- **Evidence:** `default:20260828_165853_0ff9f889#2009`, `default:20260901_210256_6c1c52da#26668`, `default:20260830_140032_70edf88c#15170`, `default:20260918_124517_372cda#36420`

### T04 — python runtime tracebacks  ·  P1 · effort S · owner: Agent behavior
- **Signal:** 187 occurrences across 7 finding(s) · profiles: default, jimmy, leonard
- **Root cause:** The agent writes Python (in execute_code and inline python) that throws syntax/name/shape errors, repeatedly burning turns on self-inflicted exceptions.
- **Action:** Smaller execute_code snippets, print intermediates, validate before long batches; run project scripts from the package root / with PYTHONPATH.
- **Evidence:** `default:20260830_100546_480c392f#9553`, `default:20260830_100546_480c392f#9762`, `default:20260830_100546_480c392f#10158`, `default:20260901_210256_6c1c52da#31880`

### T07 — terminal background/notify misuse  ·  P1 · effort S · owner: Agent behavior
- **Signal:** 105 occurrences across 7 finding(s) · profiles: default, jimmy, leonard
- **Root cause:** The agent shells out with '&' or passes notify to foreground terminal calls instead of using the tool's background/notify parameters.
- **Action:** Never use '&'/nohup/notify on foreground calls; use the terminal tool's background + notify_on_complete params.
- **Evidence:** `default:20260828_132734_85f729e5#1434`, `default:20260830_140032_70edf88c#13074`, `default:20260829_095319_cc8f7496#3860`, `default:20260919_133653_cfea5b#37645`

### T08 — patch old_string / escape drift  ·  P1 · effort S · owner: Agent behavior
- **Signal:** 85 occurrences across 6 finding(s) · profiles: default, jimmy, leonard
- **Root cause:** The agent calls patch without required args or with stale/whitespace-mismatched old_string, so edits silently fail to apply.
- **Action:** Read the exact current region immediately before patching; copy a unique anchor; do not re-escape backslashes; prefer patch over full rewrite.
- **Evidence:** `default:20260830_100546_480c392f#8180`, `default:20260830_100546_480c392f#10654`, `default:20260829_152634_04e12a4d#5620`, `default:20260909_075338_59a09d17#36333`

### T10 — memory at capacity  ·  P1 · effort S · owner: Config (Tony)
- **Signal:** 68 occurrences across 7 finding(s) · profiles: default, jimmy, leonard
- **Root cause:** User memory is at its character limit and the agent submits invalid memory actions (None/view, replace without old_text).
- **Action:** Raise the memory budget, or make the agent consolidate/evict before adding. Store is full and rejecting writes.
- **Evidence:** `default:20260831_154908_9c27060c#22341`, `default:20260829_135124_84d145aa#5008`, `default:20260828_215950_6f0dd002#3185`, `default:20260919_150025_acc966#37911`

### T13 — user friction (corrections)  ·  P1 · effort M · owner: Agent behavior
- **Signal:** 32 occurrences across 7 finding(s) · profiles: default, jimmy, leonard
- **Root cause:** The agent kept re-engaging/returning to the Thornhill project after the user repeatedly said to drop it, forcing ~20 identical corrections.
- **Action:** Treat 'disregard X' as persistent for the session; verify mechanism/entity before asserting; enumerate+fix all on 'fix all' in one pass.
- **Evidence:** `default:20260901_210256_6c1c52da#25862`, `default:20260901_210256_6c1c52da#26149`, `default:20260901_210256_6c1c52da#27075`, `default:20260830_100546_480c392f#10281`

### T14 — tool_call batching / bridge misuse  ·  P1 · effort S · owner: Agent behavior
- **Signal:** 27 occurrences across 6 finding(s) · profiles: jimmy, leonard
- **Root cause:** Multiple or mixed local tool calls were submitted in a single tool_call batch.
- **Action:** One local tool per tool_call entry; never route already-listed/bridge tools through tool_call; validate arg types.
- **Evidence:** `jimmy:20261002_082642_504214#24650`, `jimmy:20260907_095044_75fc0e#6873`, `jimmy:20260907_102215_9626de50#7144`, `jimmy:20260907_210950_e5d3c500#8193`

### T20 — cron jobs / reminders  ·  P1 · effort M · owner: Agent behavior
- **Signal:** 17 occurrences across 2 finding(s) · profiles: default, leonard
- **Root cause:** The agent uses unsupported cron actions ('stop'), wrong job identifiers, and absolute script paths, so cron management calls fail.
- **Action:** Make recurring jobs report only on change; provide reliable stop-by-name; don't schedule reminders the user didn't ask for.
- **Evidence:** `default:20260901_061717_10e875f4#24643`, `default:20260901_061717_10e875f4#24677`, `default:20260830_140032_70edf88c#15076`, `leonard:20260921_224902_f1884ecf#4658`

### T27 — model/output identity errors  ·  P1 · effort S · owner: Agent behavior
- **Signal:** 10 occurrences across 5 finding(s) · profiles: jimmy
- **Root cause:** Name-only search matched the wrong Google Business Profile, producing an incorrect business identity before address verification.
- **Action:** Verify proper nouns and Google Business Profile by address/place URL, not name-only search, before building an answer.
- **Evidence:** `jimmy:20260903_131512_23f3ecc7#968`, `jimmy:20260905_120132_7fcffe#5034`, `jimmy:20260905_120132_7fcffe#5037`, `jimmy:20260910_201835_005658c2#10811`

## P2

### T05 — config key churn / bad subcommands  ·  P2 · effort S · owner: Agent behavior
- **Signal:** 141 occurrences across 4 finding(s) · profiles: default, jimmy
- **Root cause:** The agent runs POSIX tools (python3, dig, sshpass, expect) absent from the Windows bash, and emits cmd.exe/PowerShell syntax (taskkill, Restart-Service, quotes) that bash misparses.
- **Action:** Check `hermes config show` before get/set; use only supported subcommands. (Rule may over-capture; re-scope before acting.)
- **Evidence:** `default:20260901_210256_6c1c52da#27257`, `default:20260901_210256_6c1c52da#26102`, `default:20260830_140032_70edf88c#16099`, `default:20260829_135124_84d145aa#4310`

### T09 — ripgrep / search_files  ·  P2 · effort S · owner: Agent behavior
- **Signal:** 71 occurrences across 11 finding(s) · profiles: default, jimmy, leonard, verimail
- **Root cause:** Search invoked with nonexistent/incorrect paths or patterns that ripgrep could not process.
- **Action:** Escape/validate regex (or use literal mode); exclude cache/state-snapshot dirs and unreadable paths.
- **Evidence:** `default:20260909_075338_59a09d17#36322`, `jimmy:20261002_225522_3a575121#25229`, `jimmy:20261004_213907_6161c54d#25757`, `jimmy:20261004_213907_6161c54d#25758`

### T11 — skill description budget  ·  P2 · effort S · owner: Agent behavior
- **Signal:** 61 occurrences across 7 finding(s) · profiles: default, jimmy, leonard
- **Root cause:** The agent submits malformed skill_manage operations and references skill names that don't exist in the profile.
- **Action:** Keep skill descriptions to one short trigger sentence within the budget.
- **Evidence:** `default:20260901_111119_3fb7ce3f#25178`, `default:20260901_210256_6c1c52da#30612`, `default:20260829_152634_04e12a4d#5559`, `jimmy:20261002_082642_504214#24211`

### T15 — skill_manage malformed / skill not found  ·  P2 · effort S · owner: Agent behavior
- **Signal:** 27 occurrences across 6 finding(s) · profiles: jimmy
- **Root cause:** Agent references skill names and linked files that no longer exist.
- **Action:** Validate operations schema (name/action/frontmatter); list skills before referencing them.
- **Evidence:** `jimmy:20260903_082924_ee9d9f9b#559`, `jimmy:20260903_082924_ee9d9f9b#698`, `jimmy:20260905_120132_7fcffe#4860`, `jimmy:20260905_120132_7fcffe#4864`

### T16 — command not found  ·  P2 · effort S · owner: Agent behavior
- **Signal:** 26 occurrences across 6 finding(s) · profiles: default, jimmy, leonard
- **Root cause:** himalaya and python3 are not installed or not on the shell PATH in this environment (python3 reported missing system-wide).
- **Action:** Probe with `command -v` first; on this Windows box use `python` not `python3`; avoid cmd/PowerShell-only tools in bash.
- **Evidence:** `default:20260919_142434_7cb946#37817`, `default:20260919_150025_acc966#37918`, `default:20260919_150025_acc966#37955`, `jimmy:20260903_080446_2f43283a#462`

### T19 — PowerShell/cmd syntax in bash  ·  P2 · effort S · owner: Agent behavior
- **Signal:** 18 occurrences across 2 finding(s) · profiles: jimmy
- **Root cause:** Complex quoting and PowerShell one-liners embedded in bash `eval` lines break on nested quotes/parentheses.
- **Action:** Do not emit cmdlet/TASKKILL syntax into bash; translate to POSIX or invoke powershell.exe explicitly with correct quoting.
- **Evidence:** `jimmy:20260915_111917_cc2921ae#15759`, `jimmy:20260912_065518_7410d52d#11756`, `jimmy:20260917_123729_e9614fe8#17162`, `jimmy:20260917_135440_f2b27db0#17407`

### T21 — missing python module  ·  P2 · effort S · owner: Agent behavior
- **Signal:** 15 occurrences across 3 finding(s) · profiles: jimmy
- **Root cause:** Ad-hoc Python scripts assumed modules (yaml/ruamel.yaml) and internal APIs that were not present in the executing interpreter.
- **Action:** Install/verify deps and run in the correct venv before invoking scripts.
- **Evidence:** `jimmy:20261004_213907_6161c54d#25762`, `jimmy:20261004_213907_6161c54d#25864`, `jimmy:20261002_082642_504214#24692`, `jimmy:20260903_080446_2f43283a#466`

### T23 — Hermes config write refused  ·  P2 · effort S · owner: Agent behavior
- **Signal:** 14 occurrences across 3 finding(s) · profiles: jimmy
- **Root cause:** Agent repeatedly reads Hermes credential stores and patches security-sensitive config files, which defense-in-depth blocks.
- **Action:** Use `hermes config set`/`edit`; never patch config files directly.
- **Evidence:** `jimmy:20260902_110459_eb6003#47`, `jimmy:20260903_082924_ee9d9f9b#527`, `jimmy:20260903_222951_274ed782#1993`, `jimmy:20260903_172646_b9fc938d#1794`

### T24 — browser_exec / CDP hangs  ·  P2 · effort M · owner: Config
- **Signal:** 13 occurrences across 2 finding(s) · profiles: jimmy, leonard
- **Root cause:** Backslashes/spaces in Windows paths were stripped by shell quoting, producing invalid cwd/package names.
- **Action:** Standardize Chrome launch with a fixed --remote-debugging-port; readiness-check the CDP endpoint; retry before failing.
- **Evidence:** `jimmy:20260919_210613_826bba58#18854`, `jimmy:20260923_112841_2aedda1f#19705`, `jimmy:20260923_112841_2aedda1f#19760`, `jimmy:20260919_210613_826bba58#18865`

### T25 — detector false positives  ·  P2 · effort S · owner: Agent behavior
- **Signal:** 12 occurrences across 1 finding(s) · profiles: default
- **Root cause:** The failure classifier matches on substrings inside otherwise-successful command output (env dumps, sent-message previews, file content), producing false-positive tool failures.
- **Action:** (Miner already tightened.) Keep keying failures on explicit markers/exit codes, not error-like text in successful output.
- **Evidence:** `default:20260918_141823_9eed89#36924`, `default:20260918_141823_9eed89#36972`, `default:20260919_142434_7cb946#37828`, `default:20260919_142434_7cb946#37843`

### T26 — memory tool misuse  ·  P2 · effort S · owner: Agent behavior
- **Signal:** 12 occurrences across 2 finding(s) · profiles: jimmy
- **Root cause:** skill_manage ops are missing required content or descriptions exceed the frontmatter budget.
- **Action:** Use valid actions + matching old_text; pass required fields; consolidate in the same batch.
- **Evidence:** `jimmy:20260905_120132_7fcffe#4830`, `jimmy:20260905_120132_7fcffe#4834`, `jimmy:20260910_201835_005658c2#10663`, `jimmy:20260907_213044_a4748a#8098`

### T28 — process_manage  ·  P2 · effort S · owner: Agent behavior
- **Signal:** 10 occurrences across 2 finding(s) · profiles: jimmy
- **Root cause:** A process(action='poll', ...) tool call is serialized into the terminal command stream instead of being dispatched as a tool.
- **Action:** Capture background session_id before polling; re-list processes instead of reusing stale IDs.
- **Evidence:** `jimmy:20260906_095449_6093b4#6458`, `jimmy:20260906_095449_6093b4#6474`, `jimmy:20260906_095449_6093b4#6466`, `jimmy:20260924_205652_a3b4ea51#20774`

### T31 — unwanted voice / TTS  ·  P2 · effort S · owner: Config
- **Signal:** 9 occurrences across 2 finding(s) · profiles: jimmy, leonard
- **Root cause:** Audio output was produced/enabled by default and had to be manually stopped by the user.
- **Action:** Default TTS to off in this profile, or confirm intent before emitting audio.
- **Evidence:** `jimmy:20261002_225522_3a575121#25301`, `jimmy:20261003_161554_b72b50c7#25381`, `leonard:20260913_092836_48cdb0d8#888`, `leonard:20260913_092836_48cdb0d8#902`

### T32 — shell quoting / eval errors  ·  P2 · effort S · owner: Agent behavior
- **Signal:** 7 occurrences across 3 finding(s) · profiles: default, jimmy, leonard
- **Root cause:** Multi-line/single-quoted shell commands are malformed, leaving unbalanced quotes that break bash parsing.
- **Action:** Write scripts to a file instead of long inline quoted one-liners.
- **Evidence:** `default:20260918_124517_372cda#36710`, `default:20260918_124517_372cda#36880`, `jimmy:20261002_082642_504214#23681`, `jimmy:20261002_225522_3a575121#25244`

### T33 — Docker  ·  P2 · effort S · owner: Infra (Tony)
- **Signal:** 6 occurrences across 2 finding(s) · profiles: jimmy, leonard
- **Root cause:** Docker Desktop daemon was not reachable and compose/build configs were stale or used unsupported features.
- **Action:** Start/verify Docker Desktop before builds; drop the obsolete compose `version` key.
- **Evidence:** `jimmy:20260923_112841_2aedda1f#19707`, `jimmy:20260923_112841_2aedda1f#19725`, `jimmy:20260923_112841_2aedda1f#19703`, `jimmy:20260924_144306_45473ab6#20176`

### T34 — vision_analyze  ·  P2 · effort S · owner: Agent behavior
- **Signal:** 6 occurrences across 2 finding(s) · profiles: jimmy, leonard
- **Root cause:** vision_analyze is called with a zero-area region [0,0,0,0] instead of valid pixel bounds.
- **Action:** Pass a valid region (or omit for full image); route to a vision-capable provider.
- **Evidence:** `jimmy:20260927_081444_46159a5f#21271`, `jimmy:20260927_081444_46159a5f#21272`, `jimmy:20260927_081444_46159a5f#21296`, `leonard:20260919_222213_f5f35580#4069`

### T35 — write_file overwrite guard  ·  P2 · effort S · owner: Agent behavior
- **Signal:** 4 occurrences across 1 finding(s) · profiles: jimmy
- **Root cause:** The agent attempted full-file writes on files it had only partially read or never fully read, tripping the overwrite-safety guard.
- **Action:** Read the full file (every page) or use `patch` before overwriting.
- **Evidence:** `jimmy:20261002_225522_3a575121#25153`, `jimmy:20261002_225522_3a575121#25157`, `jimmy:20261005_221424_59c8c77f#25938`, `jimmy:20261005_221424_59c8c77f#25944`

### T36 — secret/credential read refused  ·  P2 · effort S · owner: Agent behavior
- **Signal:** 4 occurrences across 1 finding(s) · profiles: jimmy
- **Root cause:** Required API keys were not present in the environment/credential store for the invoked provider or subcommand.
- **Action:** Use provider tools / `hermes config`; never read .env or credential stores directly.
- **Evidence:** `jimmy:20260924_140422_dca6ec#20045`, `jimmy:20260924_140422_dca6ec#20060`, `jimmy:20260924_140422_dca6ec#20043`, `jimmy:20260919_210613_826bba58#18975`

## P3

### T02 — generic exit codes  ·  P3 · effort S · owner: Noise
- **Signal:** 444 occurrences across 8 finding(s) · profiles: default, jimmy, leonard
- **Root cause:** Command exits with non-zero codes reported without a descriptive error message.
- **Action:** Mostly signal noise (bare exit_code with no stderr). Capture stderr on non-zero exit; suppress in the delta.
- **Evidence:** `default:20260828_144747_49a94d46#1619`, `default:20260828_201637_807fd2ff#2548`, `default:20260828_201637_807fd2ff#2643`, `jimmy:20260903_131512_23f3ecc7#983`

### T37 — other  ·  P3 · effort S · owner: Noise
- **Signal:** 2 occurrences across 1 finding(s) · profiles: leonard
- **Root cause:** the agent misidentified its execution host (treated the machine as remote/other) when it was actually running on the user's own PC.
- **Action:** Uncategorised single item; review if it recurs.
- **Evidence:** `leonard:20260915_094133_975cbcdc#1713`, `leonard:20260915_094133_975cbcdc#1729`


---

## Status — 2026-10-06 "fix all" sweep

**Fixed (behavioral, always-on):** T01 T03 T04 T07 T08 T13 T14 T19
→ new `[DISCIPLINE]` memory rule + a "Defects confirmed by the 2026-08→10 trace backfill"
block in the `hermes-windows-local-setup` skill (python3 vs python, cmd/PowerShell-in-bash,
native paths, background long commands, patch/write_file guard).

**Fixed (environment/memory accuracy):** T10 mitigated (memory consolidated 2196→2192/2200);
stale tailnet identity corrected in memory (this box = `tonyb` @ 100.96.158.89, not
`desktop-81cbtv2`).

**Verified already resolved (live check):**
- T30 memory_search / zg binary — `memory_search` returns hits; `zg_bin` correct.
- T31 unwanted TTS — `voice.auto_tts: false` on disk.
- T22 local model serve — gemma12 answering on `127.0.0.1:1923`.
- T06 git remote/auth — `agent-os` origin correct, gitea HTTP 200, publish job `last_status: ok`.
- T29 Telegram gateway — all platforms `connected` (was recurring historically; see below).

**Open — needs Tony / investigation:**
- T12 approval/consent block in unattended (-q / cron) runs → needs a non-interactive
  allowlist/approval policy (config).
- T18 uv trampoline permanent fix → edit `home` in the install venv `pyvenv.cfg`
  (file change → approval). Workaround already documented in the skill.
- T17 tailnet — peers offline (`desktop-81cbtv2*` 56/70d, `muse-1` 3d); node re-auth is manual.
- T29 recurring Telegram gateway — root-cause in code; **do NOT add a watchdog** (the repo's
  documented principle: fix the command, not the environment around it).
- T10 deeper fix → raise `memory.memory_char_limit` 2200→3000 in `/hermes/config.yaml`
  (global; affects all profiles) — one-line change, awaiting go.
- T02 generic exit codes — noise bucket, monitored not fixed.


### T29 root cause (2026-10-06)
Recurring Telegram breakage = **IPv6 enabled but non-functional** on this box:
`ms_tcpip6` binding True on Ethernet/Wi-Fi, **no global IPv6 address** (link-local only),
**no `::/0` route** — yet DNS returns an AAAA for `api.telegram.org`. Every hostname connect
burns a cycle on the black-holed IPv6 path (`ConnectError('')`) before falling back to IPv4
(which works: `curl -4` 5/5, 302, 0.16 s). `logs/gateway.log` shows the flap loop; 294
`telegram_network` events, 121 reconnects; clusters 09-01/02/05, 10-03/05.
**Fix (admin/UAC, not applied):** `Disable-NetAdapterBinding -Name Ethernet -ComponentID ms_tcpip6`
(+ `Wi-Fi`); keep the Tailscale adapter's IPv6. **Not a watchdog** — root-cause per the repo principle.
Evidence: `curl -4/-6`, `Get-NetAdapterBinding`, `Get-NetRoute -AddressFamily IPv6 -DestinationPrefix '::/0'`.

### T10 (2026-10-06)
`memory.memory_char_limit` raised 2200 → 3000 in `/hermes/config.yaml` (backup:
`config.yaml.bak-memlimit-20261005-235840`). Effective for NEW sessions; the running session
cached 2200 at startup.