# Auditor response — 2026-04-25 — scanner started + 30-min health-check live

## Scanner running

| Detail | Value |
|---|---|
| PID | 287996 |
| Process | `node src/scan.mjs` (running as user `arb`) |
| Start time | 2026-04-25 11:25:51 UTC (= 21:25 Melbourne) |
| 48-hour stop target | 2026-04-27 11:25 UTC (= 21:25 Melb, Monday Apr 27) |
| Data files | `/srv/projects/arb/tools/inefficiency-scanner/data/scan-YYYY-MM-DD.jsonl` (rotates at UTC midnight) and `events-YYYY-MM-DD.jsonl` (created lazily when first event fires) |
| Stdout/stderr | `/tmp/inefficiency-scanner.log` |
| Verified | 180 rows in first 17 sec = exactly 5 polls × 36 (venue,pair) — match |
| Effective config | venues=kraken,coinbase,binance,okx,bybit,gateio | pairs=BTC,ETH,SOL,XRP,DOGE,AVAX | thresholds: 4σ z-score / 50 bps min / 60 min window / 60 sec cooldown |

Disk projection: ~7 MB/h × 48h ≈ 330 MB total scan JSONL. Well below disk concerns. Events file should stay ≤1 MB even on a busy run.

## 30-min health check live

| | |
|---|---|
| Cron job ID | `2d754b3e` |
| Schedule | `*/30 * * * *` (fires at :00 and :30 every hour) |
| Lifetime | session-only — dies if this Claude session ends. Tell auditor to "persist across restarts" if needed. |
| Cancel | `CronDelete 2d754b3e` (or "cancel scanner polling") |

Each fire prints either:
- `HEALTHY @ <time> | scan_rows=<N> | events=<N> | <last summary>` — healthy
- `WARNING` / `ERROR` block with diagnostic + recommended action — anything wrong

Per the standing publish-everything rule, warnings/errors will also be published as r-NNN.md and latest.md.

## Manual check at +17 sec

Process alive (PID 287996, status Sl, ~96 MB RSS). 180 scan rows. Zero events (expected — rolling window not yet warm). All 6 venues responding.

## Next 48 hours

Auditor will monitor via the 30-min cron. Three natural review points:
1. **+1h** — first `[summary 1m]` confirmations across all minutes
2. **+24h** — first daily summary; reasonable to peek at events count and decide whether to tune thresholds before the second day
3. **+48h** (Mon Apr 27, 21:25 Melb) — auditor stops the scanner cleanly (`kill -TERM 287996`), runs `npm run report`, delivers the simple-English call

If thresholds are clearly miscalibrated (e.g., 1000+ events/day flooding the file, or 0 events after 24h indicating thresholds too strict), auditor will propose mid-run config tweak before continuing.

## Open

Nothing requires operator input. Scanner runs unattended for 48h.