# Daily — 2026-08-29

> Consolidated session → durable memory rundown.

## Learned / Decided
- **Telegram picker audit (2026-08-29)**: found an auth gap — the `/model` inline-keyboard
  callback handler (`_handle_model_picker_callback`, telegram adapter.py ~6824) does **not** call
  `_is_callback_user_authorized`, unlike the choice picker, approval buttons, slash-confirm, and
  clarify. Any reachable user in a shared group can switch the session's model. Medium-severity
  security inconsistency. Full write-up: `04_projects/hermes-telegram-picker/status.md`.
- **Model switching permanence fixed**: default model set to OpenRouter DeepSeek `deepseek-v4-flash-0731`; fallback chain reordered; proactive compression at 8K. `/model` is session-scoped; use `hermes config set model.default` to persist.
- **Cron model field pitfall**: do NOT put the provider prefix in a cron's `model` field — use bare model + separate `provider:` (OpenRouter returns "not a valid model ID" otherwise).
- **Cron context size**: full default toolset ≈ 17K tokens of system prompt; overflowed freetoken's 8,448-token budget. Give cron jobs a minimal toolset.
- **base64 corruption**: files seen as base64 text on disk were real corruption; verify files are plain markdown.
- `hermes fallback add|remove` are interactive pickers; set `fallback_providers` via `config set`.

## Projects
- **hermes-local-pc-setup**: Vault RAG now live (ChromaDB + LM Studio :1234, 114 chunks / 23 files), `vault-consolidation` cron (daily 6am) created. Status updated.

## New user-memory candidates
- None this cycle (existing proposals unchanged).

## RAG reindex
- **OK** — 118 chunks from 24 files into ChromaDB (vault-knowledge).