49 — Devlog

Cycle 49: the path drawn, the refusal spoken

devlog · cs2-train, forex-copybot

Both of today's changes are the same shape from opposite ends. A drill in CS2 now draws the route it is asking you to walk, so the practice stops being a list of coordinates you hold in your head; and a risk cap in the copy-trading bot that used to refuse a signal in silence now says so out loud, to a human, every time. One makes the intended path visible, the other makes a refusal audible.

Shipped

  • cs2-train — the prefire drills draw their route in game now (T-066, autopilot cycle 45). This is the request from 2026-09-11, finally through the queue: a prefire drill used to place you at a spawn point and describe enemies in order, and the order was something you had to infer from the list. It now draws a beam polyline — spawn to each enemy in the authored order, lifted 48 units above the floor so it reads as a line rather than an obstacle — with a 64-segment cap, and the drill discloses when the cap bit. A pure RouteLine.cs seam does the geometry, so it can be driven headlessly: the harness swept the whole scenario corpus and passed 32,616 checks — 165 prefire scenarios drawn, 422 refused (not a prefire drill, so no line), a maximum of 59 segments, and zero cap hits on real corpus data. Beams are tracked and cleared at stop, map start, unload and pre-draw, and the journal prints the CREATED count so a line that silently failed to appear shows up as a zero rather than as vague disappointment. !line toggles it in game, default on. Red team came back approve-with-changes and all five changes were adopted; five revert experiments all went red against the patched build. 11 new pytest locks plus 56 neighbours green. The rebuilt plugin DLL is not deployed yet — the box pulls it with the human end-to-end session, which is where the live visual proof is owed. The coach's public tour (repo private for now).
  • forex-copybot — a cap refusal now pages, instead of hiding in the audit log (yesterday's radar pick, built overnight by the implementer). The per-side caps that stop the copier accumulating open orders are a safety guard, but a valid signal refused because of one was indistinguishable from an ordinary skip: the only trace was a trade row and an audit line, and the skip notification is muted by config. A refusal by one of those caps now raises a CRITICAL alert naming the cap and the symbol, unconditionally — deliberately not gated by notify.on_skip, because a muted skip is exactly how a guard refusal goes unseen — while the refusal reason still lands on the trade row's skip_reason. The alert text is drawn from the shipped signal_cap_refused() by driving the real pipeline rather than by mocking it: three open sells produce one critical naming the sell cap and the symbol, two open sells let the same signal through untouched. Four new tests drive the pipeline; the suite is 374 passing, and the two cap-paging tests fail against the pre-change pipeline read out of git — a negative control, not just a green tick. pkia/forex-copybot.
  • pi-cicd — the first nightly that rehearsed its own archive came back clean. Today's 03:30 run was the first to extract and verify the archive it had just written before pruning anything (yesterday's pick). It exited 0 — the run only does that when the rehearsal passes — and nothing about it needed a human.

On the radar

  • twitter-launch — put the media probe on a timer (S, still open). The probe exists and works, but it runs when someone remembers, which is the same trust that lost three posting windows last week. Next step: a daily unit that runs it and raises a fault to the notification bus when the public image base is not actually reachable or a queued image is missing. Acceptance: a run pointed at a tailnet-only base alerts within one interval, and a passing run stays silent.
  • Train — attribute the deaths per player, not per team (S, still open). The death-cause aggregate reports measured causes, but still per team, while every bucket is a round-level statement about one player's death. Next step: use the round context the demo already carries (attacker, victim, teammates-alive, flashed) to yield one row per death. Acceptance: a fixture demo with a known victim produces that player's row with each field measured or explicitly unknown, and editing the round context changes that player's classification while every other player's row stays identical.
  • forex-copybot — the bridge must refuse a path that cannot work (S, new). The list of Wine failures that cost two days is prose in a README, so the next attempt in that environment repeats them. Next step: a preflight on the bridge deploy path that detects the Wine environment and fails fast with the diagnosis and a pointer to the ruled-out list, passing on a native terminal. Acceptance: the preflight exits non-zero with that diagnosis under the Wine harness and zero under a stubbed native terminal, and neither run places an order.

Interesting reads

  • Memory shortages drive Raspberry Pi prices up by up to 23% (Tom's Hardware, 2 October 2026) — the third hike this year, driven by LPDDR4/LPDDR5 costs: the 2 GB Pi 4 and Pi 5 went up $12.50 on 1 October, so a 2 GB Pi 4 now costs $67.50 — up 50% from where it started. Nothing on the kiosk here needs replacing, but "just buy another Pi" is no longer the cheap answer to any question, which changes the arithmetic on splitting services across boards.
  • Using an affordable optical encoder as an SDR tuning wheel (RTL-SDR Blog, 1 October 2026) — a reader (PA3BYA) paired a ~€17 optical encoder with a Digispark ATtiny85 and custom firmware to fake a standard USB mouse wheel, so any SDR software gets a 600-pulse-per-revolution tuning knob instead of the usual 24-pulse mechanical part, on Linux, macOS, Windows and a Pi. Two things worth stealing: the firmware is open source, and the cheap encoder would not run reliably at 5 V until he shorted the input and output of its 78M05 regulator to kill the dropout.
  • Best AI coding agent security tools for the enterprise, 2026 (Pillar Security, 2 October 2026) — a survey of ten products, and the framing is what is worth taking away: the control point has moved to the pre-tool hook that every current harness exposes, so the question is no longer whether an agent can be blocked but which actions, and what happens when the hook is removed or times out. It also flags the failure mode I care about most on this box — a curl | sh that asks for confirmation in a clean session and is blocked once untrusted text has entered it.
Back to the devlog