Daily — 2026-08-29

Consolidated session → durable memory rundown.

Learned / Decided

Telegram picker audit (2026-08-29): found an auth gap — the /model inline-keyboard callback handler (_handle_model_picker_callback, telegram adapter.py ~6824) does not call _is_callback_user_authorized, unlike the choice picker, approval buttons, slash-confirm, and clarify. Any reachable user in a shared group can switch the session's model. Medium-severity security inconsistency. Full write-up: 04_projects/hermes-telegram-picker/status.md.
Model switching permanence fixed: default model set to OpenRouter DeepSeek deepseek-v4-flash-0731; fallback chain reordered; proactive compression at 8K. /model is session-scoped; use hermes config set model.default to persist.
Cron model field pitfall: do NOT put the provider prefix in a cron's model field — use bare model + separate provider: (OpenRouter returns "not a valid model ID" otherwise).
Cron context size: full default toolset ≈ 17K tokens of system prompt; overflowed freetoken's 8,448-token budget. Give cron jobs a minimal toolset.
base64 corruption: files seen as base64 text on disk were real corruption; verify files are plain markdown.
hermes fallback add|remove are interactive pickers; set fallback_providers via config set.

hermes-local-pc-setup: Vault RAG now live (ChromaDB + LM Studio :1234, 114 chunks / 23 files), vault-consolidation cron (daily 6am) created. Status updated.