Windchime

Shown at the Gray Area Cultural Incubator Showcase in San Francisco, August 5–7, with a talk of under five minutes on how agency splits between artist, model and visitor.

Customer value. The first public audience, in a working venue rather than a test room.

• The venue hardening build: offline, guarded devices, public safe text
• A presenter deck and script, practiced to under five minutes
• The agency diagram: artist, model and visitor

For a hostile venue.

Customer value. Offline, on chosen devices, never showing visitor phrasing.

• Vendored runtime
• Offline default, supervised guard
• Guard holds chosen input and output
• Wedged mic detection, clean exit
• Word boundary text filter
• Runbook with no internet path
• Frequency to loudness audit

Risks

• Device identifiers can shift on reenumeration

93 of 406 stems lack a usable loudness measurement.

Impact. Too loud or too quiet, heard as bad mixing, not bad data.

Detection. A full corpus audit, stem by stem.

Root cause. A fixed window near each file's start misses later audio, which gets a neutral correction.

Fix. Not yet fixed: prefer the existing full file measurement when the window finds nothing.

Followups

• Fall back to the full file measurement (open)

Blameless note. The embedding side already fixed this bug class; the lesson did not travel.

With a live spectrum feed.

Customer value. Balance the room in minutes; textures stop swamping percussion.

• Install defaults
• Nongenerated beds loudness levelled
• Endpoint gain levels sequence beds
• Presence trim for continuous stems

Risks

• Some stems lack a loudness measurement

Editing the list changed nothing.

Impact. Corpus judgements that assumed exclusions used the unfiltered library.

Detection. A call site search during the corpus audit.

Root cause. Unit tested in isolation and never called; passing tests is why nothing flagged them.

Fix. Not yet fixed; wiring it into selection is scheduled.

Followups

• Wire in, verify with a real generation (open)

Blameless note. A test proves a function works, never that anything calls it.

Capture silently dies: two software faults.

Impact. An unattended piece faces visitors it cannot hear.

Detection. Operator reports, then a device versus stream diagnostic.

Root cause. A cached device list lets a hotplug silently repoint capture at the internal mic; a lock order inversion can deadlock the stop path, hanging every mic endpoint.

Fix. Reenumeration revives a dead input without a replug; a device guard holds the chosen one. The open deadlock clears on restart (per process audio context).

Followups

• Work around the stop path deadlock (open)
• Test silent capture detection deliberately (open)

Blameless note. Watchdogs guarded output, not capture; a health endpoint must never take the lock it reports on.

Across grid and arc.

Customer value. Sessions get an arc; every scene rewards hardware exploration.

• Per prompt mode sequences, install default
• Shared page and chord gestures
• Depth on all install families
• Per scene rotation LED feedback
• Thinking bed before first audio

Risks

• Dead arc encoder switch blocks chords

Silent, exactly like a mapping bug.

Impact. Its press gestures, including a two encoder page flip chord, are unreachable.

Detection. Six paired marker attempts: 28 turns, zero key events.

Root cause. Hardware: the code path treats both encoders identically.

Fix. No software fix by design: gestures moved off it, and the hardware needs repair.

Followups

• Repair or replace the controller (open)

Blameless note. Pair an unobservable null result with an observable action, so silence becomes evidence.

Later visitors' tours began midthought.

Impact. The one moment meant to orient a stranger broke.

Detection. Heard in rehearsal, weeks after round one was assumed correct.

Root cause. During a fade, a gain still reads its starting level, so the guard thought narration audible and skipped the restore.

Fix. Cancel pending automation and set the value outright; the race had two orderings, both fixed.

Blameless note. It hid until automation ran, since settled values read correctly; partial fixes can disguise a second cause.

Retrieval straight to playback.

Customer value. A fraction of a second, not several, with no model needed.

• Planner dropdown option
• Limiter and watchdog still apply
• Teardown on stop
• Latency by backend and mode

Risks

• Bypass plays denser than templates
• Latency gap hinders blind comparison

Built by playbook, not improvisation.

Customer value. Visitors rarely see a world twice.

• Six waves: registry 69 to 135
• Playbook: briefs, dispatch, gating, verification
• Host rendering facts verified
• Registry wide regression gates green

Risks

• Per family tuning now costs more

Show and curate from one build.

Customer value. It shows cleanly; curation stays in the interface.

• Fullscreen hides developer navigation
• Click and hold stem audition
• Curation lock
• Wedge watchdog
• Latent map labels model, tracks selection
• Wider prompt pools
• Attract repeat fixed

One studio batch, up from 369.

Customer value. More to reach, and an audit honest at any size.

• Batch reembedded per configuration
• Size read from the DB
• Index epoch recorded
• Notebook projection explorer

Risks

• All time counts favour older stems

Repeatable and auditable.

Customer value. More varied, better labelled material.

• Batches sorted by category
• Idempotent reingest via skip sentinel
• Reembed runbook, every backend
• Index history per reindex

Risks

• Fair comparison means reembedding every backend

Four waves, 69 families.

Customer value. Place rooted originals: expressive clicks, LED acknowledgement, the whole grid alive.

• O1 and O2: abstract, kinetic
• O3 and O4: recording location cities
• Authoring guide codifies monome rules
• Regression gates green corpus wide

Beside p5, one runtime per session.

Customer value. A direct fidelity comparison; hardware and interaction unchanged.

• Selector before renderer or audio init
• URL pin for kiosk boots
• Second host sharing params, LED flush, mount
• p5 families ported to Three.js
• Original 3D scenes
• Per runtime dynamic imports

Risks

• Newest scenes need audition and tuning
• Hardware pass pending; twin verified only

Shipped in one day.

Customer value. Orientation, and sound between visits.

• Mic VU meter
• Narrated tour, pregenerated clips
• Hosted or local LLM planner, safe revert
• Grid+Arc families, 38 to 43
• Header status pills
• Alternating attract beds
• Sidechained tutorial bed
• Idle bed after visits

Audio stranded in the wrong phase.

Impact. No operator would clear it, defeating the self resetting lifecycle.

Detection. The soak's abrupt page exits, which manual tests rarely reach.

Root cause. Only a graceful showcase exit cleared the gate.

Fix. Exit posts an idle phase, and a pagehide beacon (which survives teardown) hits a reset endpoint.

Followups

• Cover future kiosk autoboot paths (open)

Blameless note. Long unattended runs hit abrupt page death; short manual tests miss it.

Twice: a watchdog rescue, then gain masked voices.

Impact. Trailing audio spoiled the quiet between visitors.

Detection. Session cycling; the second cause surfaced a week later, in the install features pass.

Root cause. Both assumed silence meant stopped: the watchdog rescued intentional silence, and stop() masked gain over voices that returned at volume reset.

Fix. The watchdog honours an intentional silence flag; stop() purges the audio graph.

Blameless note. Safety systems need "this silence is on purpose"; stops must make the state true, not inaudible.

Each session records variant, model, sound mode and layer cap.

Customer value. No reconstructing state from logs.

• Condition capture in the eval app
• Backend aware experimenter recap
• Balanced, versioned audit prompt set

Repairs stems with a silent index window.

Customer value. Wash to tight response; phrases reach content, not silence.

• Retrieval and playback presets
• Live preset toggle
• Loudness sidecar precompute
• Has audio flag
• Clip gain
• Best window
• Compromised rows reembedded per backend
• Append only epoch provenance

Risks

• Per clip gain not yet applied per sample

Repair an index whose fixed window hit silence; log each measurement's epoch.

Insights

• Silent openings embed as near nothing
• Representative windows limit repair to compromised rows

Published as process only. Results stay private while under review.

Harness retired after one fix.

Customer value. Reliability, proven on the exact gallery build.

• Playwright synthetic visitors
• Environment gated data isolation
• Six hour health and memory telemetry
• Negative radius bug fixed, reverified
• Two low severity followups documented

Risks

• Live audio path excluded: the top gap

The soak's one real bug.

Impact. One frame, under rapid cycling; no visitor saw it.

Detection. Six logged across nearly 2,000 synthetic generations.

Root cause. An elapsed time radius went briefly negative when two clocks disagreed by under a frame.

Fix. A one line lower bound guard: six to zero on the next run.

Followups

• Document what it did NOT patch: memory creep, a rare dropped start (done)
• Soak the audio and mic paths (open)

Blameless note. One small bug in a clean soak is a success; memory stayed flat.

Armed to attract: the full kiosk lifecycle.

Customer value. All day, no operator: oriented, a bounded turn, an automatic reset.

• Staged states with explicit bounds
• TTS narrated onboarding tour
• Per visitor volume reset
• Mic VU meter
• Record gating
• Idle attract board

Risks

• Slow multiday server memory creep

Three layers; a 1 Hz watchdog.

Customer value. Speakers stay safe; the sound recovers itself.

• Compressor into NaN proof ceiling
• Voice ring out bounds
• Effect and gain caps
• Soft and deep watchdog rescue
• Optional wild mode texture

Risks

• The soak harness skips the audio path

Not feedback: unbounded voice accumulation.

Impact. A loud buildup, then dead speakers until a reload.

Detection. Manual testing, then deterministic replay.

Root cause. Multiminute stems retriggered every cycle: about 870 source nodes by 18 minutes, and a render clock at a few percent of real time yet "running". The roar was hard clipping.

Fix. NaN proof master limiter, ring out clamps, and a 1 Hz watchdog that rescues NaN, clock collapse or silence.

Followups

• Replay after the fix (done)
• Optional wild mode keeps the texture (done)
• Soak the audio path (open)

Blameless note. A reasonable default met an unreasonable rate: bound resources under repetition.

One interface, many models.

Customer value. Stable for visitors while the ALM varies.

• Model independent corpus DB
• Offline audio embedding per configuration
• Text only sidecar for heavy models
• Runtime toggle, liveness probe, autorevert
• Multilingual configuration
• Offline distributional audit harness

Risks

• Research licensed model: offline audit only
• Warm backends cost memory

Hold the installation constant, vary only the ALM, and compare behaviour.

Insights

• One interface makes the model a toggle
• Distributional metrics need no ground truth labels

Published as process only. Results stay private while under review.

With a closing recap.

Customer value. Polished talks and visits; playback survives screen recording.

• Branded overlay, logo reveal
• Intro and outro flashes
• Demo set picker
• Section beds
• Header mode and transition selectors
• Operator controls
• Presentation theme

Risks

• Manual flow; unattended lifecycle came later

Two days of porting the sibling engine.

Customer value. One parameter contract, played by hand, audio or autoperformer.

• Param model bridge, shared parameter vector
• Layered target smoothing
• Device adaptive monome twin
• ~30 audio reactive families, 24 new
• Off / Auto / Listen autoperformer
• UMAP / PCA / t-SNE map
• Sketch upload
• Responsive canvas, mode theming

Warm amber.

Customer value. One instrument, not four developer tools; later modes build on it.

• Tokens across all four surfaces
• Survey theme matched
• Submodule remote migration
• Umbrella pin updates

serialosc kept the other app's prefix.

Impact. Dead until a manual daemon restart.

Detection. Switching to another monome app and back.

Root cause. serialosc persists each device's prefix across app exits and daemon restarts, and the bridge's literal prefix matcher dropped every message.

Fix. Suffix matching accepts any persisted prefix; a self healing regrab reasserts Windchime's.

Blameless note. Shared hardware means shared daemon state; assume any prefix.

The first build someone else could run.

Customer value. Consent, orientation and mic recovery need no operator.

• Dev / participant toggle
• One click trials
• Two stage consent, same origin
• Stuck mic detection, recovery
• Audio activity meter
• Master volume
• Transcript panel
• Six prompt trials

A replug left it detached until a bridge restart.

Impact. A bumped cable would drop it for the whole show.

Detection. Hardware testing: no input or LEDs after reattaching.

Root cause. The bridge armed device notifications once and deduplicated advertisements, so returning devices were never repointed.

Fix. It rearms on every attach and detach, with a periodic repoll as backup: replugs reattach within seconds.

Followups

• Tolerate another app's prefix (done)
• Recover audio input after USB reenumeration (done)

Blameless note. First plugs always work; gallery hardware gets bumped.

Silence after the first stop.

Impact. Blocked the first participant trials, with no error.

Detection. Same day runs: transcript and visuals moved in a silent room.

Root cause. Each stop suspended the AudioContext, resumed from an SSE handler without a user gesture; a cross origin unlock gap compounded it.

Fix. The context now runs all session, the engine loads eagerly, and an unlock banner verifies the resume.

Blameless note. Autoplay policy is part of the runtime contract; the durable fix needs no resume.

The first umbrella.

Customer value. One command runs it all on a laptop.

• Four services as submodules
• One launcher for all four
• Dev UI shell
• End to end smoke target
• Control bus, livecode to animation

Risks

• Localhost only trust; needed an Origin allowlist

Another open page could trigger generation.

Impact. A malicious page could start the mic or spend model API budget; none observed.

Detection. A security review during the umbrella unification.

Root cause. Open cross origin settings block reading, not sending, a cross site POST; nothing checked Origin.

Fix. Endpoints check Origin against the installation's own URLs; scripts and the mic runtime send none and pass.

Followups

• Sync the port list and Origin allowlist (open)
• Token or authenticating proxy before nonloopback exposure (open)

Blameless note. Proportionate for localhost, and documented for review.

Built in one day.

Customer value. Sessions capture themselves; no experimenter transcribes anything.

• Protocol and consent as data
• Standardized usability scale
• Construct grouped instruments
• Automatic session and event logs
• Survey UI
• Review dashboard
• Same day sibling integration
• Remote trial stop

Standardized UX questionnaire, construct grouped items, per trial ratings, semistructured interview; counterbalanced, distribution first.

Insights

• Validated and construct grouped items cover both facets
• Per trial ratings catch what one form blurs

Published as process only. Results stay private while under review.

One database connection reused across threads.

Impact. Bringup stalled after one query, blocking browser tests.

Detection. The second generate raised a driver thread ownership error.

Root cause. The connection enforces same thread use by default, and one engine was shared across worker threads.

Fix. The same thread check is disabled, safe because the engine is read only after construction.

Followups

• Confirm the shared engine stays read only (done)
• Keep retrieval in process (done)

Blameless note. Match connection settings to the threading model.