Cassette Build Report 063 — The Reconnect Happened. The Agent Missed It.
I reconnected the LaCie. The observer failed to record it, the agent asked me to do it again, and Cassette had to learn what proof actually required.
Scope note: This report records Cassette’s first verified single-model acquisition onto LaCie through the installed CLI. L05 remains in progress. The result does not establish model execution, training, large-model capability, authenticated-source coverage, Ollama coverage, or release completion.
I disconnected the drive. I reconnected it. The agent did not see the interval, so it asked me to do it again.
By then Cassette’s installed command-line application had already done something new. It had launched outside the source checkout with PYTHONPATH unset, selected the LaCie, created a marked Cassette directory beneath an existing writable parent, written a 4,096-byte probe, flushed it, read it back, and committed the durable pointer. A fresh process recovered the same operation. Repeating Go preserved the same namespace.
Then the operation paused for physical reconnect verification. A watcher was supposed to see the selected volume disappear and return.
The watcher ended without recording the absence. I confirmed that I had completed the physical action and told the agent to continue. Codex verified the same volume, cartridge, pointer, and probe. Then it started waiting for another observed absence interval. I reminded it that I had already done the work and that the build should follow the written specification.
The specification required fresh identity and byte checks after reconnect. It did not require the observer to be alive during the moment my hand removed the cable.
This was not a semantic escape from physical proof. My statement alone could not release the operation because the system still had to discover the current volume, match its identity, find the marked cartridge, verify the immutable pointer, and reread the saved probe. Outside-root preservation remained a separate Go check before payload access. Only the reconnect trigger changed: Cassette could record that the operator reported a completed reconnect, then perform the same fresh cartridge verification used after an observed interval.
The distinction is important. An observation is evidence about what the process saw. An operator report is evidence about what the person did. Neither should impersonate the other. Both can initiate a verification whose present-tense facts come from the drive.
The current broker preserves that separation:
selection = await asyncio.to_thread(select_external_apfs_volume, binding['volume_uuid'])
cartridge = Path(selection.volume.mount_path) / binding['folder']
lifecycle = CartridgeLifecycle(binding['cartridge_uuid'])
await asyncio.to_thread(lifecycle.mount, cartridge, binding['volume_uuid'])
head = await asyncio.to_thread(campaign_head, cartridge, proof['campaign_key'])
if head is None or head['digest'] != proof['campaign_digest'] or head['value'] != binding:
_reject('ROOT_INVALID', operation_id, 'campaign object or pointer changed across remount')
probe = binding['probe']
await asyncio.to_thread(verify_campaign_artifact, cartridge, probe['attempt'], probe['name'],
probe['digest'], probe['bytes'])
The excerpt appears in public broker.py. The operator report ends the wait; the selected volume, mounted cartridge, committed pointer, and saved probe supply the identity and byte result that follows.
The repaired fixture physically detached and reattached a disposable APFS image before verification. A corrupted probe kept Go paused. Restoring the original probe allowed the operation to proceed. The observer-driven path remained in the same test. A second defect appeared immediately: repeating the verification command rejected the already released hold before returning its existing success. Codex moved terminal replay ahead of the live-hold check.
This was not the only stale-history problem in the acquisition path. The deeper review had found that a completed download checkpoint could return without reading the local file again. If one payload byte changed after completion, Cassette still trusted the old checkpoint and made no network request. The record accurately described a past completion. The code treated it as proof about the present file.
The fix moved completed return behind the existing chunk checks. Unchanged bytes still reuse the checkpoint. A changed chunk now fails identity before reuse. Retryable Go errors pause the durable operation and resume the same operation later. A changed source remains terminal. Empty files receive empty intervals instead of passing through assumptions written for nonempty payloads.
The first reported reconnect still failed for a different reason: cartridge identity and probe verification passed, but a coarse inventory outside the Cassette root had changed while another project rendered film frames and logs onto LaCie. The records established concurrent writes, though they could not attribute every changed byte. Codex left that user-owned job alone and continued machine proof while waiting for the drive to settle.
That exposed another mistaken coupling. Reconnect verification had repeated the whole outside-root inventory check. The reconnect contract concerns cartridge identity, its root, and the bytes Cassette touched. Drive preservation belongs to the later Go operation before any payload access. Combining them made unrelated activity look like a failed reconnect.
The agent separated the checks. An intact cartridge could pass reconnect verification. The next Go still refused to download while the outside-root inventory was moving. No protection was removed; each protection returned to the boundary it actually governed.
Several live attempts remained failed or incomplete. One destination collided with an existing lowercase cassette directory on the case-insensitive filesystem and stopped safely. One selection ended without a terminal receipt and was cancelled through the installed broker after its process ended. Another scan coincided with a new film job, so the continuation helper stopped before launching Go from a moving baseline. These records remain part of the evidence rather than being replaced by the eventual success.
When the other work ended, selection 07 began against the same marked cartridge and one deliberately tiny public source: llamafactory/tiny-random-qwen3, pinned to immutable revision 81d6f5f5e05ed53ea8a1d19431266a486e46bbd8. Its weight file is 4,881,064 bytes. Nine selected artifacts total 20,764,612 bytes.
Go prepared the operation. The reported-reconnect command freshly verified the cartridge and released the durability hold. The storage profile passed measured qualification. Cassette streamed all nine files onto LaCie, rereading retained bytes at every checkpoint. All final digests matched the immutable source revision. Repeating the same Go returned the same success receipt without another payload request. The final outside-root inventory matched the selection 07 baseline.
For the first time, one complete model acquisition had crossed the installed Cassette CLI, the broker, the source adapter, the capacity controller, and the physical external store. The public portable receipt is preserved in docs/l05/2026-10-10-one-model-acquisition.json. It records the operator-reported reconnect separately, names the evidence that remains unproved, and binds the measured storage result and source digests to one Go operation.
The model is intentionally tiny and randomly initialized. It proves acquisition, not usefulness. L05 still requires its authenticated and Ollama routes, model and dataset receipts, and the established independent review. There is no large-model result here. There is no execution or training result.
There is a more modest first: Cassette put verified model files on the drive and could prove that the files still matched their source after interruption, reconnect, replay, and final inventory.
My physical action was real even though the observer missed it, and the absent observation could not be rewritten as one the process had made. The accepted route records my reconnect as an operator report, records the observer’s result separately, and requires fresh cartridge identity and byte verification before Go continues.
