# Overdeck activity-source inventory (measured 2026-08-07/08)

Legend: V=verified by me, S=subagent-reported unverified.

## A. Durable append-only timestamped histories

| # | source | path | format | ts | ids | append | retention / real span NOW | volume |
|---|--------|------|--------|----|-----|--------|---------------------------|--------|
|A1|collector journal|~/.overdeck/items.jsonl|JSONL Item+tombstone|ISO `ts`|source, project?, reconciliationScope?|append-only|NO rotation code anywhere; 2026-07-01T13:17Z→now = 37.2d|162,125 ln / 38.2 MB → ~4,362 rec/d, ~1.02 MB/d (V)|
|A2|action audit|~/.overdeck/actions.jsonl|JSONL {ts,verb,args,requestedBy,result,rc}|ISO|requestedBy only, no project/session|append-only|2026-07-18→2026-08-07|15 ln / 2.8 KB, ~0.76/d (V)|
|A3|controller job dispatch|~/.config/overdeck/controller/events.jsonl|JSONL {ts,job,repo,host,snapshot,attempt,stage,reason,rc,durationSeconds}|ISO|job+repo+host|append-only|2026-07-21T02:42Z→2026-08-07T17:25Z|3,225 ln / 709 KB, ~190/d (V) **best remote-build source**|
|A4|controller db|~/.config/overdeck/controller/state.sqlite(+wal)|sqlite|yes|job/host|`events`,`transition_journal` append; `idempotency` pruned 24h; `queue_tickets` transient|same as A3|1.08 MB (V)|
|A5|run-plan run logs|{Projects/overdeck,~/.overdeck/harness}/runstate/<slug>.log.jsonl|JSONL {v:"runlog/v1",runId,slug,ts,concurrency,kind,…}|ISO+tz|runId+slug (=plan, not project)|append-only|2026-07-17T18:29+07→now|per-slug (V)|
|A6|land queue|<repo>/.git/harness/landq/log|JSONL {ticket,branch,gate_class,queue_depth_at_arrival,at}|`at`|ticket,branch|append-only|feature brand-new: 2026-08-07T13:23Z→17:04Z (3.7h)|58 ln; only overdeck has one (V)|
|A7|agent reaper|~/.claude/run/agent-reaper.log|JSONL|unix float|root/tree/agent_pid/child_pid; **no project/host/session**|append-only|no rotation; 2026-07-17→2026-08-07 (21.0d)|804 ln / 677 KB → 38 ln/d, 32 KB/d (V)|
|A8|pids-guard|~/.local/state/pids-guard/events.log|plaintext|yes|cgroup scope|append-only|2026-08-07 10:35→2026-08-08 00:13|16 ln (V)|
|A9|mem-guard|~/.local/state/mem-guard/events.log|plaintext|yes|—|append-only|2026-07-09→2026-08-05, **stale 2d+**|74 ln (V)|
|A10|fleet harden ledger|~/.overdeck/fleet/harden-ledger.jsonl|JSONL {ts,changeId,host,event}|ISO|host|append|2026-08-07 only|26 ln (V)|
|A11|toolgap|~/.overdeck/sandbox/toolgap.jsonl|JSONL|ISO|—|append|1 record|1 ln (V)|
|A12|factory control events|~/.overdeck/factory/.factory-control-events.jsonl|JSONL|ISO|—|append|1 record|1 ln (V)|
|A13|remote-agent writeback|~/.claude/run/remote-agent/remote-agent.log|plaintext `<ISO> write-back-applied epoch=…`|ISO|epoch|append|247 B total|negligible (V)|
|A14|build nice sweep|~/.claude/run/build-nice-sweep.log|plaintext|yes|pid|append|last write 2026-08-04|2.33 MB (V)|
|A15|factory sssf|~/.overdeck/factory/sssf.db|sqlite WAL|yes|session/phase/agent_session|append tables|**rolling ~2.4d** 2026-08-05→08-07|sessions 12, phases 24, events 330, gate_results 6, agent_sessions 7, decisions 2 (V). collector opens READONLY|
|A16|GH Actions run history|~/.overdeck/ghci-run-history.json|JSON: {repo:{runs:[GH run objects],lastSyncedAt}} — **rewritten whole-file but IS history**|created_at/run_started_at/updated_at|repo, head_branch, head_sha, actor, workflow|array append + cap|multideal 500 (CAP HIT) 2026-07-29→08-07; mod 175 2026-07-15→08-05; zync.is 58 2026-07-13→08-07; overdeck 6; press.zone/mega-plan-harness 0|11.3 MB (V) **cap truncates the busy repo to 9d**|
|A17|deploy history (reflog)|~/.local/share/overdeck/deploy/.git reflog|git reflog|ISO per entry|sha only, no outcome/duration|append (gc.reflogExpire default 90d)|2026-07-19T23:50+07 clone → 2026-08-08T00:07+07|370 entries → ~19/d (V) **only deploy trail that exists**|
|A18|git commit history|each repo .git|git log|author/commit date|repo+author+branch|append|full repo life|30d: overdeck 5240, multideal 602, invariantum 320, zync.is 67, ~/.claude 55, fewtok 21, slopgate 20, vibeflare 15, Botmaster 7 (S)|
|A19|Claude transcripts|~/.claude/projects/<slug>/*.jsonl|JSONL|`.timestamp`|cwd, sessionId, gitBranch, project=dir slug|append per session|`cleanupPeriodDays:36500` (disabled) + daily rsync backup; oldest 2025-12-31|592 dirs, 16,175 files, 556 MB; 227–595 files/d recently (S)|
|A20|Claude prompt history|~/.claude/history.jsonl|JSONL {display,project,timestamp(ms)}|ms epoch|project|append|none; back to **2025-09-30** = deepest per-project horizon|21,457 ln (S)|
|A21|codex (cdx) sessions|~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl|JSONL, first rec `session_meta`|ISO|id, cwd, originator, cli_version, git.repository_url|append, date-partitioned|no pruning; **2025-09-19**→now|10,607 files, ~7.1 GB (S)|
|A22|cursor-agent transcripts|~/.cursor/projects/<repo-slug>/agent-transcripts/<uuid>/<uuid>.jsonl|JSONL|yes|repo-slug + agent uuid|append|~2026-04-22→now|101 dirs, 4,335 files, 1.55 GB (S)|
|A23|handoffs / jobs|~/.claude/handoffs/<project>/sessions.jsonl; ~/.claude/jobs/<id>/timeline.jsonl|JSONL|yes|project / job id|append|—|57 + 9 dirs (S)|
|A24|harness v1 runs|~/.harness/runs/<runId>--<slug>.json|JSON per run|yes|runId+slug|one file per run|~4.2 GB under ~/.harness|91 files (S)|
|A25|kernel OOM kills|journalctl -k 'Killed process'|journald|yes|pid/comm|append|**journald 4.4d cap**|12 events, all 2026-08-04/05, none since (V)|

## B. Current-state only — need a sampler to ever chart

parity `~/.claude/run/buildbox-parity/state.json` (782 B, overwritten q10min by buildbox-parity.timer) · buildbox-watch `state.json` (141 B, q1min) · **notif-gate `~/.local/state/notif-gate/pending.json`** — per-source AGGREGATE {program,summary_template,count,first,last}, whole-file rewrite; 47 sources / 251 attempts / 2026-08-07 12:09→23:51 +07 only; **no per-attempt record exists anywhere** · collector in-memory `panels` map + `adapterMeta` (**never journaled — lost on restart**) · `landq/queue`, `queue.lock`, `ticket.*.verdict` (~3) · `~/.overdeck/seat-remote/remote-health-*.json` · `~/.claude/run/remote-agent/remote-health-*.json` · `~/.overdeck/cutover/*.json` · `~/.local/state/system-monitor/agent-guard.json` (baselines) · `.buildslot-status-*` · agent-guard socket · frozen `/var/lib/node_exporter/textfile/*.prom` · `~/.local/state/agent-sessions/sessions/*.json` (rewritten in place, but 1 file/session ⇒ usable ledger; 770 files, **only ~1d** oldest ledgerId 20260807T021258Z; runtime: codex 434, claude 211, cursor-agent 111, runplan 5, grok 5, opencode 2, kiro-cli 1, agy 1 — **only normalized cross-CLI `runtime` field on the box**)

## C. No trail at all
deploy-local.sh (only /tmp build log + one stdout JSON line) · cpu-guard (zero logging) · buildslot (status overwrite + stderr) · stall-guard (per-invocation $XDG_RUNTIME_DIR file, ephemeral) · local-gate (14,233 lock/epoch files, no events) · claudex/dyn-wf (~/.claudex/proxy.log = 14-line static banner, no ts) · ~/.bash_history (578 ln, no HISTTIMEFORMAT) · gate runs (gates.ts reads only point-in-time confirmed.json 128 B + precision_records.json 1548 B) · mem-pressure-notify (unit `not-found`, binary absent) · botmaster-proxy (in-memory cache, zero disk writes; history only remotely via GET /api/metrics?limit≤5000, /api/bots/:id/logs?since=&limit≤500 on 127.0.0.1:31340)

## D. Retention infra
journald Storage=persistent but SystemMaxUse=500M binds before MaxRetentionSec=3month → 488.8M used, oldest entry 2026-08-03 = **4.4 days** (caps every journal-only source) · systemd-oomd running, **0 kill events** · Prometheus live 127.0.0.1:9090, /var/lib/prometheus 413M, **no retention flag ⇒ 15d default**, oldest block 2026-07-24, targets only node+self, 681 metric names, **0 custom families**; node_exporter textfile dir /var/lib/node_exporter/textfile **frozen since 2026-07-12** · Grafana disabled/dead · no pushgateway/loki/promtail/victoria/influx · opensnitch db 495 MB / 164,014 conns but daemon inactive, data 2026-08-04 20:50→08-05 15:03 (18h)

## E. Defects found (report only)
- agent-guard poll broken: cluster.ts:94-127 writes {"type":"poll"} and awaits reply; daemon.py socket is one-way ingest → collector errors every poll, daemon logs bad_ipc ~q30s. Panel permanently empty. cluster.ts default path /tmp/system-monitor/agent-guard.sock doesn't exist either.
- items.jsonl `append()` dedupes unchanged serialization ⇒ it is a STATE-CHANGE log, not an activity log. Skew: systray-ai 69,064 / botmaster 31,918 / prometheus 18,013 / ghci 17,706 / offload 12,204 / gates 6,255 / tombstone 3,316 / harness 2,262 / agent-sessions 1,429 / factory 11 / permissions 5 / toolgap 1.
- ~/.harness/v2/runs NOT inventoried — runplan-blocking-gate denies any listing.
- subagent C created+deleted /home/user/scratch_cursor_ts.txt (871 KB) during a read-only scope.

## F. Coverage floors (all-time chart must show per-source "no data before X")
codex 2025-09-19 · claude history 2025-09-30 · claude transcripts 2025-12-31 · cursor 2026-04-22 · items.jsonl 2026-07-01 · runstate 2026-07-17 · deploy reflog 2026-07-19 · controller 2026-07-21 · reaper 2026-07-17 · journald 2026-08-03 · factory sssf 2026-08-05 · agent-sessions ledger 2026-08-07 · landq 2026-08-07 13:23

## G. Three answers
1. No single store spans all. Closest = items.jsonl (37d, 12 adapter sources, never rotated, right schema) but it covers only collector-adapter state changes — no guards, transcripts, deploys, cdx/claudex runs. A unifying event store is new work. What is NOT new: the read path — the history is already on disk; `Journal.load()` collapses it to Map<id,Item> and GET /items serves only that snapshot. A range query over the journal unlocks 37 days immediately.
2. See §B (+ everything in §C, which needs an emitter before a sampler).
3. Prometheus is running and the textfile mechanism is proven — but it cannot serve this: 15d default retention (owner asked 30d + all-time), per-project/per-session lines = high-cardinality antipattern, textfile pipeline dead since 2026-07-12. Split: Prometheus for host/system rollups (repair textfile + raise retention first); new append-only event store for activity, modeled on the two patterns already working here (collector journal.ts, controller events.jsonl).