Fable 5 Review — Session Index (2026-07-02)

One entry point for the morning review. Everything below is committed on branch voice-capability-hierarchy (pushed to origin, ~22 commits ahead of main), tested, and codex-reviewed. Open the linked HTML reports for detail.

What shipped (key commits on `main`)

Commit	Work
`42dd6850`	`control_event` §1.1 wire gate hardened (fail-closed envelope validation + per-client dedupe)
`46b2b03d`	Remote-control transport-swap shadow slice — live decision-epoch + `InputArbiter` comparison, flag-off, byte-identical
`025fd753`	Two mutation-verified shadow regression guards
`b503b348`	Deterministic calendar/scheduler simulator + tests + finding B-CAL-1
`e9dce83b`	propose→recovery→book coverage (calendar suite → 122 tests)
`f0d3e5e1`	Whole-repo aggregate integration check
`9430dcf4`	`control_router` — the §1.3 validity-ladder composition (remote-control item 2: control_event → dedupe → capability → arbiter), built + tested ahead of the live WS wiring
`7faa0034`	B-CAL-1 FIXED — the calendar simulator caught a real slot-conflict retry bug, then validated its fix (re-offer fresh slots on a same-slot race); full-suite regression diff shows zero new failures
`72c75b19`	B-CAL-2 FIXED — edge-hunting off the B-CAL-1 fix surfaced a second bug (repeat consecutive conflicts left the caller unable to book, via the required-tool latch); fixed + validated (zero new failures)
`8fd0136f`	Space Channel: "text follow along" — advertised the companion text-link option in the menu + return to the main menu after sending; tested, zero repo-wide regressions (isolation-confirmed). Optional follow-up: regenerate the prerendered companion-outcome WAVs so their spoken wording matches — behavior is already correct.
`58a3b6cf`, `8e42f092`	Scheduler handoff docs for Fable 5 — `scheduler-demo-problem-statement` (why the live book path escalates) + `scheduler-use-cases-and-capability-scope` (~37 use-case taxonomy + "several ways" matrix → input for the v0 design)
`34fbf68b`	Scheduler P1 — time_range fast-path FIXED (Fable-5 §6 steps 1-2). The live demo escalated whenever the LLM emitted a `time_range` the slot-mapper rejected (range / ISO datetime / `2-4pm`); `_coerce_time_range` now strips ISO decoration + splits ranges to the window-start instead of raising into a handoff. Ambiguous bare ranges still re-ask. Validated 43/43 slot_mapper (incl. isolation), codex SAFE, full-suite net −4 vs clean HEAD (the 2 "new" proven flaky). Flips acceptance-criterion #3 + the 3 xfails → concrete passing assertions.

Later this session (calendar shift-left + companion + humanness)

Commit	Work
`7145d86a`	Humanness fix — a live-call review of `tutorial_book_appointment` (session voice-1783015078520) caught the agent SPEAKING `"(internal) booking now"` / `"(internal) fetching available slots"` placeholders to the caller (act-state `entry.line` is voiced). Replaced with natural fillers. Validated: book_appointment I-1..I-5 + slot_mapper 52 passed; triage suites identical to clean HEAD (zero new). 4 more humanness defects reviewed + reported (premature "you're booked", raw-ISO double read-back) — deferred pending eval validation.
`f0f23910`	Remote-control item 2 — companion-WS control wire + hardening. A tap on the texted companion page routes through the proven §1.3 ladder (`route_control_event`). Flag-gated (`RIFF_COMPANION_CONTROL`, default OFF). All 4 codex concurrency findings fixed + tested (send-race lock, per-call route-lock, bounded store + pre-parse gate, call_id-rotation defense). 28 tests.
`21195e1b`	Calendar shift-left — first load-time guardrail. A state declaring a `calendar.modify`/`calendar.cancel` effect now fails to load unless it declares `caller_verified` precondition AND the flow has a verification tool — so one caller can never move/cancel another's appointment, caught at BUILD not runtime (sibling of I-5). Sound + non-breaking (broad flow-load regression zero-new). 9 tests.
`7ff2c8dc`, `ea405211`, `89b63d6e`, `1ef97bc3`	Calendar design docs — the concierge/actions spec (codex plan-reviewed; §2a precompiler-enforced owner identity), the read-only live offer-mirror companion design, the newcomer calendar flows & tutorials walkthrough; `F-364` RunRecord filed as GATED behind the calendar work + a Bezos review.
`7a3ea0cc`	Old-code cleanup — fixed the drifted `10-book-appointment` tutorial (documented removed `TRIAGE/DAY_PICK/TIME_PICK` states; now the production booking engine). Doc-test alignment passes.
`7da5d765`, `0360a8d4`	Live phone — hidden "schedule" jump on the Space Channel line: say "schedule"/"book" (not announced) → composed `book_appointment_v1` booking flow. 14 regression tests; riffc golden + slot ratchet regenerated (zero-new).
`a5334beb`, `84f3bece`	Live phone — consolidated `demo_hub` on the California number (`+15102160079`): a menu → book / verify(OTP) / text-follow-along (real composed flows; verify + text loop back to the menu). Both numbers live simultaneously via `RIFF_DIALED_ROUTING_TABLE_JSON`. 13 tests, riffc 0 hard errors, not flagged by the safety gate. List/delete are next (gated on the owner-marker decision).

Headline results

Aggregate (final, both B-CAL fixes integrated): 7,622 passed / 108 failed / 183 xfailed / 5 errors. Net effect of the whole session vs the pre-work baseline (42dd6850: 7,467 passed / 110 failed): +155 passing, −2 failing, and zero new failures introduced — every remaining failure is pre-existing, confirmed by clean-HEAD regression diffs on each source change.
Two real scheduling bugs (B-CAL-1, B-CAL-2) caught AND fixed by the simulator — the harness that caught them also validated the fixes.
Remote-control shadow slice: zero production risk (flag off → arbiter not even imported; proven byte-identical by a per-slice isolation diff across 7,500+ tests). The risky refactor is done before the live call so regressions are attributable.
Calendar simulator: 122 deterministic permutation tests over the offer→book loop — a path the existing sim harness deliberately skipped. Caught a real bug on day one (B-CAL-1).
Scheduler demo unblocked (P1): the live book_appointment_v1 path no longer hard-escalates on well-intentioned time phrasing — the exact three formats that broke the demo ("12:00 to 15:00", "2026-07-02T14:00:00-05:00", "2-4pm") now normalize to a bookable window-start; genuinely-ambiguous phrasing re-asks instead of dropping to a human. This is the interim fast-path; the durable fix (Fable-5 #20 "offers are quotes", where the LLM never hand-formats a time) is scoped in the problem statement.
Rigor note (how every "zero-new" claim was verified): each source change was diffed as a failure set against a clean-HEAD full-suite run, not by absolute count — the suite carries ~110 pre-existing flaky live/network/creds failures whose count drifts run-to-run. For the P1 fix the delta was −4 net, and the 2 apparent "new" failures were each reproduced in isolation to be flaky (one passes alone; one is a DashScope network probe with no connectivity), not caused by the change. A first pass of that same diff was rejected because it had read the wrong output file (showed an implausible "clean HEAD passes 100%, change breaks 109") — investigated and corrected rather than trusted.

The two reports to open

remote-control-transport-swap-quality-report.html — the shadow slice: three review-and-harden cycles, all findings + fixes, the isolation method (including the worktree/editable-install trap I caught and corrected), mutation-checked guards, known limitations. Companion: remote-control-transport-swap-handoff.html — the turnkey live-call sequence.
calendar-scheduler-sim-report.html — the calendar simulator, its coverage matrix, and finding B-CAL-1 with the recommended fix.

Transport-swap live validation — flip RIFF_INPUT_ARBITER=1 on a real OTA call, watch shadow agreement, add audio-start stamping (required before A2 can be claimed), then make the arbiter authoritative. Needs the operator + a live call.
B-CAL-1 — caught AND fixed (7faa0034). The simulator caught a real slot-conflict retry bug on the cascade path (caller re-confirmed the same dead slot instead of getting fresh offers; live path unaffected; never fabricated a booking). Two reverted attempts localized it to inside dispatch_required_tools' post-book walk; the fix clears the dead selection there so slot_busy re-offers fresh slots. Validated: sim 125 green, targeted scheduling+live diff zero-new, full suite same failure count +15 passing. The harness that caught the bug also validated its fix.

Scope discipline

Gated goals — scheduler #20 ("offers are quotes" redesign) and quality-contract #21 — were not started; the P1 time_range fix is a deliberately-scoped interim fast-path (Fable-5 §6 steps 1-2) that unblocks the demo without pre-empting the #20 redesign it points to. The parallel surface-emission WIP (riffc.py, types.py, loader.py, surface.py) was not touched — commits were staged file-by-file to keep it isolated. codex was used as the review proxy throughout (one approved plan + several diff reviews, including the P1 fix → verdict SAFE); agy was not run headless.