The success line was specific. After hermes profile create labclone --no-alias --clone-from labsource, Hermes printed that it had cloned config, .env, SOUL.md, and skills from labsource. It did not mention memory. memories/MEMORY.md and memories/USER.md were on the clone anyway, and their SHA-256 hashes matched the source byte for byte.

That gap is the check worth running before a second always-on agent is pointed at the new profile. The files that moved are the agent’s identity. The sentence that reported the copy is not the inventory.

A support router that asks a chat model to “reply with JSON” still has to parse a string. Jev is built for the other shape. You send the ticket as state, name the questions, and the client returns a choice or a probability. The application, not the model, decides whether to file the ticket, hold it, or page someone.

This host does not have a TypeSafe key, so the Jev call stopped before the network. The OpenAI platform key on the same host can list models, including gpt-6-luna, and then refuses inference because the credit balance is exhausted. The code below is the call that was constructed, the errors that came back, and the gate that still runs on a fixture of the same answer shape.

grok inspect printed yaml-yes and literal-true on consecutive lines. Both lines ended with the word project. Neither line said that one of those skills is not a slash command. The JSON report for the same directory said userInvocable was false for yaml-yes and true for literal-true. The frontmatter difference was one token: yes versus true.

That is the check a copied Claude skill needs before anyone binds /yaml-yes in a script or tells a teammate the command exists. The human summary that the installed guide offers first does not make the check. On Grok 1.0.67, an untrusted folder makes the same summary say the skill is absent, which is a different mistake.

curl --version printed brotli/1.1.0 while the loaded decoder was Debian’s security update, and it printed the same token while the loaded decoder was the unpatched trixie archive build. Both files are named libbrotlidec.so.1.1.0. Both are 51376 bytes. Both answer BrotliDecoderVersion() with 0x1001000. A rule that treats 1.1.0 as “older than 1.1.1” flags the fixed package. A rule that treats brotli/1.1.0 as proof of the fix accepts the vulnerable package. Neither rule can see the upload that actually closed CVE-2026-111497 on Debian 13.

A build line that still says ./Configure linux-x86_64 no-ecdsa does not reach gcc on OpenSSL 4.1.0. Configure exits 255, prints Unsupported options: no-ecdsa, and says the build file was not produced. The same line on the 4.0.3 tree exits 0 and writes a Makefile. That success is not evidence that ECDSA left the library. The generated header defines OPENSSL_NO_ECDSA, and the Makefile still compiles crypto/ec/ecdsa_ossl.c.

OpenSSL 4.1.0, released 23 October 2026, dropped no-ecdsa and no-ecdh from Configure. The release notes say those options did not really disable the implementations, and that no-ec is the option that disables elliptic-curve support. The notes do not show the exit status, the exact error text, or the Makefile rule that remains after a 4.0.3 configure. Those are the checks a build job has to make before it treats a green Configure as a disabled algorithm.

A script that reads only stdout from duckdb -c "SELECT 42 AS answer;" cannot see the line that says agent mode is on. That line goes to stderr. The stdout it does see is either a box table whose type row says int32, or a Markdown row whose header says answer:INTEGER. Both are exit 0. Both contain 42. A parser that splits on the box-drawing character will miss every row of the second form and still report a clean exit.

Valkey 9.1.3 and 9.1.2 split on three ordinary commands. A hash key named fields could not be written with HSETEX on 9.1.2. The same command wrote the field on 9.1.3. ZADD rejected the score 0x10 on 9.1.2 and stored 16 on 9.1.3. LSET with the index 4294967296 returned success on 9.1.2 and replaced the first list element. On 9.1.3 that index returned an error and the list stayed as it was.

A second download with curl --no-clobber --output report.csv did not create report.csv.1. The first file was still the original copy. The new file was report-1.csv. The same command on curl 8.22.0, and on the Debian 13 client, created report.csv.1 and left report-1.csv absent.

That is the check a download job has to make before it is pointed at 8.23.0. The 14 October 2026 release is the one that published the spare-name change, and it is also the release that dropped SMB and SMBS. The man page shipped with 8.23.0 says an extension is preserved as image-1.jpg, then image-2.jpg, and that numbering continues up to filename.9999. The binary followed the extension rule. It did not create the 9999 name. The highest spare file it wrote was image-9998.jpg.

A migration added a column named rowid, and the next query did not read the integer alias. On SQLite 3.46.1 the statement ALTER TABLE t ADD COLUMN rowid TEXT succeeded. After UPDATE t SET rowid = 'legacy', SELECT rowid returned the text legacy. SELECT oid on the same row returned the integer 1. SQLite 3.54.1 opened that file and returned the same pair. It would not add the column, and it would not drop it either.

php -v on the official php:8.3.36-cli-bookworm image printed PHP 8.3.36 (cli) (built: Oct 21 2026 15:59:51) (NTS). The same process reported session.upload_progress.enabled as 1. ini_set() could not change that value. A .user.ini in the working directory that set it to 0 changed the FPM response and left the CLI reading 1. The 21 October security release fixed two remote-code-execution bugs. It did not change this default. A version check also does not show whether the worker that is serving traffic loaded the setting before it accepted the next request.