# The diary starts writing (P1.1 of the coherence journal)

This is the build half of the spec you approved tonight: every machine now actually KEEPS the diary. Three kinds of entries get written automatically — "this conversation was placed/moved here (and why)", "a work session opened/closed/was reaped", and "an autonomous run started/stopped here, its files are at these paths". Nothing reads them across machines yet (that's the next two PRs: the question-answering API, then machine-to-machine swapping) — this PR is the foundation that makes those possible: reliable, cheap, tamper-resistant local diaries.

The seatbelts from the review are all real code now, each with a named test: writing a diary line never touches the disk in the hot path (it's an instant memory hand-off; a background helper saves batches four times a second — a fault-injection test wedges the disk and proves the hand-off still returns instantly). A crash can only lose the last quarter-second, and a half-written line is repaired and COUNTED on restart. Restore-from-backup is detected precisely (the "edition number" mechanism — an ordinary crash can never false-trigger it, proven by a test that kills the writer at the exact worst moment). Only one process on a machine may write (a second one locks out, loudly — visible in status, not silently). Every line must match a strict template; free text, secrets, oversized entries, and path-escape tricks are rejected at the door.

Three things make the wiring trustworthy rather than hopeful: (1) session open/close events are derived at the ONE place every status change already passes through, so no future code can forget to record one; (2) every one of the 8 places that can change "which machine owns this conversation" is paired with its diary write, and a NEW build-time check fails CI if anyone ever adds a 9th without the pairing — it caught a site I'd missed within seconds of existing; (3) autonomous runs are watched by a small once-a-minute observer, so even a run that dies by crash or reboot gets its "stopped" line — no phantom forever-running jobs.

Also in this PR: the census from P0 becomes machine-readable (all 66 state categories) with its own CI check — new code that writes durable state without declaring it in the registry fails the build. That's the "nothing becomes invisible-machine-local by accident again" guarantee, live.

Ships dark on the fleet, live on me. Existing agents get the config automatically on update. One honest note: a stop issued through the Telegram path gets its diary line from the observer (up to a minute late) rather than instantly — the direct hookup there needs a wider change that rides the next PR.
