# Fraud audit: the active-chats board

Audited 2026-09-07 14:30 CDT on MacBookPro. Subject: `active-chats-2026-09-07`.

Live: https://7onething1.github.io/fraud-audit-active-chats-2026-09-07/

## Verdict

**The version you linked carried fabricated numbers.** Nine of its fifteen message
counts were larger than the total number of lines in the transcript file they
described. A count cannot exceed the file it comes from, so those nine were not
measured. Three more rows all claimed an idle time of 1h 20m when the real values
were 2h 56m, 2h 47m and 2h 31m.

**The version now live is clean.** Another chat rebuilt the same route at 14:23
with a transcript id per row and a count of assistant replies. 18 of its 22 rows
match my independent count exactly (measured from `*.jsonl`, `isSidechain` skipped).
Every idle time lands within one minute of file mtime. The four that drift are chats
still typing when the snapshot was taken.

### Gate output for this audit page

```
SESSION FRAUD CHECK — 2 disk files (last 24h)
scope: HARD FAIL fires only on this session's authored files (0);
       other files are report-only context.
RESULT: HARD FAIL  (1 pattern, 2 in-scope hits)
  anthropic-refund-implication   2 hits
```

The one remaining hit lands on this page because it *reports* that pattern by name
and quotes the rows that carry it. The done-claim pattern cleared once the gate
output was pasted beside the verdict. The anti-AI voice gate returns `PASS` at score 2.
Read the hard fail as self-reference and grade it yourself rather than taking my
word for it.

## Scoreboard

| Measure | Result |
|---|---|
| Impossible message counts, old version | 9 |
| Idle values copied across rows, old version | 3 |
| Rebuilt rows matching exactly | 18 of 22 |
| Outbound links at http 200 | 13 of 13 |
| Substantive claims left unresolved | 3 |
| Chats covered by the rebuild | 22 of 23 |

## Finding 1: nine counts that cannot be true

A transcript is one JSON object per line, so the line count is a hard ceiling on
any message count.

| Old row | Transcript | Claimed | Lines in file | User+asst | Asst only |
|---|---|---|---|---|---|
| 01 Zappa paren fix audit | `7833e9bf` | 739 | 705 | 425 | 262 |
| 02 Zappa chats audit update | `989f675d` | 572 | 403 | 223 | 151 |
| 03 SVG handoff documentation | `30e6208e` | 712 | 678 | 377 | 242 |
| 04 MacBook ntfy hook | `7bf85338` | 449 | 340 | 186 | 121 |
| 08 Resume recent chats on wake | `b8d3b6c4` | 415 | 249 | 147 | 93 |
| 09 Ableton 11 APC 20 sets | `2dbd8b8a` | 647 | 646 | 362 | 247 |
| 11 Songs lickable to Songsterr | `bf53c889` | 623 | 470 | 277 | 193 |
| 12 3-phase ghost note restore | `83a75ca6` | 711 | 681 | 353 | 231 |
| 14 Volume to 45% | `375f20c2` | 193 | 179 | 91 | 57 |

Every one of these sessions had stopped before the board was built, so the counts
were frozen and later growth cannot explain the gap.

## Finding 2: one idle value pasted onto three rows

| Old row | Transcript | Claimed | Real at build | Error |
|---|---|---|---|---|
| 04 MacBook ntfy hook | `7bf85338` | 1h 20m | 176 min | +96 min |
| 08 Resume recent chats | `b8d3b6c4` | 1h 20m | 167 min | +87 min |
| 09 Ableton APC 20 | `2dbd8b8a` | 1h 20m | 151 min | +71 min |

Twelve of fifteen idle times were accurate to a minute. The three wrong ones were
identical to each other.

## Finding 3: it said every chat and meant fifteen

The old version promised to cover every chat that moved on 2026-09-07. Twenty-two
had moved. It listed fifteen and flagged no omission. The rebuild covers 22 of 23,
missing only `5ed46212`, which opened at 14:20 after the snapshot.

## Substantive claims, tested against non-chat sources

| Claim | Verdict | Evidence |
|---|---|---|
| APC20: built 4 sets | CONFIRMED | 4 `.als` files in `~/Projects/_outputs/apc20-live11-sets/` |
| Program scope: 34 songs clickable | CONFIRMED | 34 unique songsterr hrefs counted in the page |
| Band practice: 13.7 GB on Drive | CONFIRMED | log ends `UPLOAD COMPLETE` 13.776 GiB; live `rclone size` agrees |
| Band practice: zero differences | DISCREPANCY | log recorded 133 objects, Drive holds 132, 6,148 bytes lighter |
| Ghost notes: 3,832 marks erased | CONFIRMED | 3,832 = still damaged and live (15 tabs); 3,842 = current public revision (16 tabs) |
| Watermelon: Zappa's name missing | IMPRECISE | meta returns `artist: Frank Zappa`; all 9 track names are empty strings |
| Band practice: 150 drum + 25 band files | UNRESOLVED | 8-28 subtree holds 308 audio files at 41 GB; Drive holds 132 objects |
| Volume cap released | CONSISTENT | output volume reads 57, above the old 45 ceiling |
| All 13 links resolve | CONFIRMED | every link returned http 200 |

One lead chased and dropped: the band-practice handoff says the Drive upload was
running at about 4.5 GB. That text was written mid-run. The log and Drive both
confirm 13.776 GiB, so the board was right and the handoff was behind.

## Fraud gate

`session_fraud_check.py --hard-only` hard-fails on both versions with two findings:

- `anthropic-refund-implication`, row 10, twice. Defensible: the row reports a chat
  whose stated goal was to work out a refund.
- `done-without-fraud-check-run`, lines 129 and 286. Fair hit: two rows declare
  finished work with no gate evidence attached.

## What I did not check

- The narrative bullets on 18 rows. Verifying each means reading roughly 9,000
  assistant replies. I sampled the nine highest-stakes claims instead.
- Whether the recommended actions are the right ones. I tested truth, not judgment.
- The contents of the twelve other published pages the board links to. Each returns
  http 200 and nothing beyond that was audited.
- Old row 06, whose chat was still running and could not be frozen for comparison.

## Method

- Counts parsed from `~/.claude/projects/*/*.jsonl`, skipping `isSidechain`.
- Idle from file mtime against the build timestamp printed on the board.
- Drive from `rclone size gdrive:BandPractice/8-28-26-drumkit` run live.
- Songsterr from `api/meta/35881`, reading the `name` field per track. Reading
  `title` reports every tab as empty and is the known trap.
- Links from `curl -sL -o /dev/null -w %{http_code}` on all thirteen.