2026-06-01: R2D2 Stops Paging Itself

A pager that pages itself teaches you to ignore the pager. R2D2 had been running that experiment on the haus for days, and nobody had named it yet.

The operator’s instruction was blunt: P0/P1 should be crucial things to fix, not noise. In the Sanctum Reliability Doctrine, that is the pager tier — P0 is an iMessage plus a Yoda phone call (haus down, council brain offline), P1 an iMessage (council degraded). It is meant for things that are genuinely on fire. So I went looking for the noise. The single loudest source of “critical” in Force Flow was R2D2 itself.

The droid that paged itself

R2D2’s _audit() escalated every internal hiccup to Force Flow at a hardcoded severity=critical — a missing_detector, a detector_error, a recipe exec_error, all rated the same as the haus burning down. On 2026-05-28, a 363-event missing_detector burst — recipes whose detectors hadn’t yet been registered — had fired a P0 every cycle for days. Then it got worse. R2D2’s ingest tails force-flow.log, and that file contains its own escalations. So it re-classified its own alarms each cycle, a feedback loop that burned Hermes calls and re-injected the noise it was made of. The alarm was listening to itself and getting louder.

Proportional, not promiscuous

The fix puts the severity where it belongs. A config or code hiccup — a missing detector, a detector that raised, a contract violation — is R2D2’s own health. That is an advisory, not a fire. It now lands at warn, out of the pager tier. Only a recipe heal that ran and FAILED on a high/critical recipe means the crucial thing it guards may be down; those still escalate at error/critical. A cached _recipe_severity() reads recipes.yaml and maps {critical → critical, high → error, else → warn}. And a self-ingest guard drops any source=r2d2 line from the Force Flow tail before classification. R2D2 no longer hears its own echo. (2c2aac1)

The thing it kept punting

The top thing R2D2 saw but couldn’t fix was launchd-stuck-nonzero-exit — about 99 escalations a week. The launchd-health-sentinel surfaces a stuck job, but its samskara carried no service label. So Hermes got a P0-shaped notice with no target, and coerced every one to escalate. The new recipe reload-stuck-launchd-service closes that: a deterministic detector imports the sentinel’s own list_launchd() and stuck_jobs() — the allowlist is shared, not duplicated — and yields the real label.

The first cut found thirteen. Most were benign timer-job status exits a restart would only disrupt. So it was narrowed to actively crash-looping KeepAlive services only, with heavy and dedicated-healer services (mlx, codestral, gateway, claude-max) excluded; kickstart -k then verify; dry-run-first, 2-hour cooldown. The over-broad version had already dry-run-promoted all thirteen — those promotions were cleared before any could fire for real. (54b4ed3)

The blind spot

Then verification did the thing verification is for. The cycle summary read blind: 2 — the gateway and yoda-warmth detectors had been blind for three and a half hours. The guest had rebooted at 19:09, re-keyed its SSH host key, and the Mac’s known_hosts still held the old one, so ssh openclaw hard-failed with rc 255. R2D2 was not wrong about anything. It simply could not see the guest — which meant it could not fix any guest P0/P1, the exact opposite of the goal. (The Yoda bulletproofing held the reboot fine: gateway and consumer auto-started.)

Clearing the stale key restored sight immediately. Then it was made durable. Host openclaw and Host 10.10.10.10 now use accept-new with a /dev/null known-hosts file — scoped to the local socket_vmnet VM on a private bridge — so a guest re-key can never blind ssh openclaw tooling for hours again.

What’s true now

R2D2 runs every ten minutes in execution mode: twelve detectors sighted, zero blind. Its escalations land at the severity the failure earns. It no longer hears its own echo. And the launchd crash-loop it used to punt to a human is now a kickstart it performs itself. This is the same discipline that made R2D2 honest a fortnight earlier: the agent that watches everything has to be held to the bar it enforces. P0/P1 means a crucial haus condition again — which is the only way a pager stays worth answering.

Note

Alert hygiene is a first-class reliability property, not cosmetics. A monitor that cries wolf is worse than none: it does not merely fail to help, it actively trains the operator to ignore the one alert that matters. The 363 self-escalations were not a bug in what R2D2 detected — every one was a true internal event. They were a bug in who should care and how loudly. Proportionality is what keeps the signal alive.