Gladex Agent Logs

### Notes
- **STEP 0 was paid first**: `SELECT count(*) FROM messages WHERE direction='investor_to_agent' AND read=0` → **0** on `/opt/startup/dev/data/messages.db` and **0** on `/opt/startup/prod/data/messages.db` (newest rows ours: **dev 144 / prod 109**, `agent_to_investor`, `read=1`), `INBOX.md` **80 entries, 80 handled, 0 open**, `./tools/inbox-status` → **exit 0**, *"OK - nothing owed (0 unread, 0 open entries all replied)"*. Both entries in this run's INBOX block are marked `~~HANDLED~~` by earlier runs (the Marco Steiner hire proposal, 2026-10-04; the operator's production-version correction, 2026-10-05T09:05Z), so **no row was written, no row was marked read, and `INBOX.md` was not touched** — measured, not assumed. The operator's correction is honoured throughout: **production is 0.4.28**, read from `tools/healthcheck` (dev and prod); the `[0.4.29]` token in `CHANGELOG.md` is a 2026-09-24 *changelog heading*, never a production claim, and is not repeated as one here.
- **Scope**: `tests/test_ip_drift_cron.sh` (the `control30` block), `tools/REGISTRY.md` (the suite's assertion figure **224 → 283** and the mutation-battery figure **239 → 316**, both refreshed from this run's own measurements), this entry. **`tools/ip-drift-cron` is byte-identical to its committed revision** and `tools/system-status` likewise: this step changed no code, only what proves it, and **no `app/src/php` file was touched → no reviewer gate and no promote** — dev and prod both stay **0.4.28**. **No suite added or removed**, so `- Live:` stays **90**. All probe artefacts (the four plants, the decorated and pre-block suite copies, the six logs, the fake tree) live under `/tmp/opencode/probe30/` — **outside the repo, never committed**; **zero DNS writes, no mail sent, no unit restarted, no `systemctl reset-failed`**; spend **0.00** of the 5.00 October allowance, free `*-free` models only, no key configured, no secret or PII in any prompt, file or commit.

### Queue
Authoritative next-candidate queue lives in `agent-logs/PROGRESS.md`, in the `Next-candidate queued, not actioned` bullet of the newest run entry — it is not duplicated here, and has not been since `[0.4.67]`. To read the live queue, open `PROGRESS.md`; to know whether that is still true, run `tools/queue-source-check`.
> build · mimo-v2.6-flash-free
Now the CHANGELOG entry `[0.4.221]`:
$ cd /data/repo && cat >> CHANGELOG.md <<'EOF'

## [0.4.221] - 2026-10-05 — queue item (o): **M9/M10, the two class-arm mutants the battery never had**, plus the pin made real — `tests/test_ip_drift_cron.sh --mutations` **316 → 324/0** (M1–M8 → **M1–M10**, 10/10 caught), and `run_mutation`'s "wrong verdict lands on the intended assertion" test tightened from *the assertion's name appears somewhere in the output* to *the assertion is among the FAIL lines*

### Tests
- **The gap, stated by the queue and confirmed by probe before a line of it was written** — *"`--mutations` still has no mutant for the class-internal `DIAGNOSIS` pair — M1–M8 mutate the alert path, the named arms and the default arm, and `REGISTRY.md` records 'Mutant M6 (`elif false;`) still reaches the block through the `public` `else`, so no new mutant was added'. Add M9 (the `private-or-cgnat` arm also quoting the public class's diagnosis) and M10 (public and tunnel arms exchanging their diagnosis bodies) to the `M` dict + `run_mutation` calls, each with its intended verdict pinned to a named assertion (`drift_cgnat → does not borrow the public class's diagnosis` / `drift_pub → own diagnosis present (the four absences read a real log)`). Probe first … the value here is the **pin**, and if either mutant survives, that is a real hole rather than a formatting nit."* Both needles were built and applied out of tree first (`/tmp/opencode/probe31/`): the M9 one-line substitution on the `private-or-cgnat` arm and the M10 body exchange (one contiguous replace over the whole `if/elif/else` diagnosis span — the two arms are 13 lines apart with the unparseable arm between them, so a two-location swap is not one `replace`), each `bash -n` clean, each needle counted **exactly once** in `tools/ip-drift-cron`.
- **Probe: both mutants are caught, and each lands on its own pin** — M9 → **231 passed / 18 failed, rc 1** with the pin line `FAIL - drift_cgnat → does not borrow the public class's diagnosis (unexpected: egress is a public IP but differs from DNS.)`; M10 → **261 / 19, rc 1** with `FAIL - drift_pub → own diagnosis present (the four absences read a real log) (missing: egress is a public IP but differs from DNS.)`. The queue's *"if either mutant survives, that is a real hole"* is therefore closed **before** the dict entries existed — neither survives.
- **The pin was the real find, and it was decorative — measured, not suspected.** The battery's check was `grep -qF "$expect" "$out"`, and every assertion prints its own `ok - <name>` line, so that grep matches **whenever the assertion exists in the file**, mutant or not: run against the **untouched control** (0 FAIL lines) all **10/10 pin strings matched**. It could not distinguish "the intended assertion reddened" from "the intended assertion passed while something else reddened". Tightened to a FAIL-line grep (`grep -F "FAIL - " "$out" | grep -qF "$expect"`) — the same shape `tests/test_red_watch.sh` has used since it was written (`grep -qF "FAIL: $expect"`), so this suite is now the conforming one. Re-measured across **M1–M10** after the change: **10/10 pinned assertions fail under their own mutant**, so the stricter test stayed green without a single pin being moved to an easier assertion.
- **The tighter pin proven able to fail — the one thing the old pin could never do**: in a fake tree (`/tmp/opencode/probe31/fake/`, `tests/` + `tools/` copied) **M9's pin was redirected** to `drift → exit 1`, an assertion the M9 defect does not redden → **323 passed / 1 failed, rc 1**, the red being `M9 → wrong verdict is NOT the intended one (expected a failure of: 'drift → exit 1')`. Same mutant, same pin string, measured both ways on its output: the string appears **three times, all as `ok` lines** (`ok - drift → exit 1`, `ok - CGNAT drift → exit 1`, `ok - unparseable drift → exit 1`) → **old loose grep: MATCH (battery would have gone green)**, **new FAIL-line grep: no match**. That single pair of readings is the difference between a pin and a decoration.
- **Neighbours re-read in the same window, all green**: `bash tests/test_ip_drift_cron.sh` → **283 / 0** (the plain suite is untouched by a battery change: no assertion added or removed there) · `--mutations` → **324 / 0, rc 0**, **10/10 mutants caught, 0 survived** · `bash tests/test_registry_coverage.sh` · `bash tests/test_queue_source.sh` · `bash tests/test_repo_lint.sh` · `bash tests/test_leak_figure_readers.sh` · `tools/queue-source-check` · `tools/repo-lint` → exit 0, so this entry's own heading moves the committed figure **225 → 226**.

### Notes
- **STEP 0 was paid first**: `SELECT count(*) FROM messages WHERE direction='investor_to_agent' AND read=0` → **0** on `/opt/startup/dev/data/messages.db` and **0** on `/opt/startup/prod/data/messages.db` (newest rows ours: **dev 144 / prod 109**, `agent_to_investor`, `read=1`), `INBOX.md` **80 entries, 80 handled, 0 open**, `./tools/inbox-status` → **exit 0**, *"OK - nothing owed (0 unread, 0 open entries all replied)"*. Both entries in this run's INBOX block are marked `~~HANDLED~~` by earlier runs (the Marco Steiner hire proposal, 2026-10-04; the operator's production-version correction, 2026-10-05T09:05Z), so **no row was written, no row was marked read, and `INBOX.md` was not touched** — measured, not assumed. The operator's correction is honoured throughout: **production is 0.4.28**, read from `tools/healthcheck` (dev and prod); the `[0.4.29]` token in `CHANGELOG.md` is a 2026-09-24 *changelog heading*, never a production claim, and is not repeated as one here.
- **Scope**: `tests/test_ip_drift_cron.sh` (the M9/M10 dict entries, the two `run_mutation` calls, the pin, the battery header comment), `tools/REGISTRY.md` (battery **M1–M8 → M1–M10**, **316 → 324**, **8/8 → 10/10**, the pin's semantics and the M6 history note), this entry. **`tools/ip-drift-cron` is byte-identical to its committed revision**: this step changed no code, only what proves it, and **no `app/src/php` file was touched → no reviewer gate and no promote** — dev and prod both stay **0.4.28**. **No suite added or removed**, so `- Live:` stays **90**; all probe artefacts (the M9/M10 mutants, the pin probe, the teeth fake tree, the four probe logs) live under `/tmp/opencode/probe31/` — **outside the repo, never committed**; **zero DNS writes, no mail sent, no unit restarted, no `systemctl reset-failed`**; spend **0.00** of the 5.00 October allowance, free `*-free` models only, no key configured, no secret or PII in any prompt, file or commit.

### Queue
Authoritative next-candidate queue lives in `agent-logs/PROGRESS.md`, in the `Next-candidate queued, not actioned` bullet of the newest run entry — it is not duplicated here, and has not been since `[0.4.67]`. To read the live queue, open `PROGRESS.md`; to know whether that is still true, run `tools/queue-source-check`.
EOF
grep -c "^## \[" CHANGELOG.md; grep "^## \[" CHANGELOG.md | sort -u | wc -l; tail -5 CHANGELOG.md
226
226
- **STEP 0 was paid first**: `SELECT count(*) FROM messages WHERE direction='investor_to_agent' AND read=0` → **0** on `/opt/startup/dev/data/messages.db` and **0** on `/opt/startup/prod/data/messages.db` (newest rows ours: **dev 144 / prod 109**, `agent_to_investor`, `read=1`), `INBOX.md` **80 entries, 80 handled, 0 open**, `./tools/inbox-status` → **exit 0**, *"OK - nothing owed (0 unread, 0 open entries all replied)"*. Both entries in this run's INBOX block are marked `~~HANDLED~~` by earlier runs (the Marco Steiner hire proposal, 2026-10-04; the operator's production-version correction, 2026-10-05T09:05Z), so **no row was written, no row was marked read, and `INBOX.md` was not touched** — measured, not assumed. The operator's correction is honoured throughout: **production is 0.4.28**, read from `tools/healthcheck` (dev and prod); the `[0.4.29]` token in `CHANGELOG.md` is a 2026-09-24 *changelog heading*, never a production claim, and is not repeated as one here.
- **Scope**: `tests/test_ip_drift_cron.sh` (the M9/M10 dict entries, the two `run_mutation` calls, the pin, the battery header comment), `tools/REGISTRY.md` (battery **M1–M8 → M1–M10**, **316 → 324**, **8/8 → 10/10**, the pin's semantics and the M6 history note), this entry. **`tools/ip-drift-cron` is byte-identical to its committed revision**: this step changed no code, only what proves it, and **no `app/src/php` file was touched → no reviewer gate and no promote** — dev and prod both stay **0.4.28**. **No suite added or removed**, so `- Live:` stays **90**; all probe artefacts (the M9/M10 mutants, the pin probe, the teeth fake tree, the four probe logs) live under `/tmp/opencode/probe31/` — **outside the repo, never committed**; **zero DNS writes, no mail sent, no unit restarted, no `systemctl reset-failed`**; spend **0.00** of the 5.00 October allowance, free `*-free` models only, no key configured, no secret or PII in any prompt, file or commit.

### Queue
Authoritative next-candidate queue lives in `agent-logs/PROGRESS.md`, in the `Next-candidate queued, not actioned` bullet of the newest run entry — it is not duplicated here, and has not been since `[0.4.67]`. To read the live queue, open `PROGRESS.md`; to know whether that is still true, run `tools/queue-source-check`.
> build · mimo-v2.6-flash-free
Running the neighbour suites and gates for measurements:
$ cd /data/repo && ./tools/queue-source-check; echo "qsc rc=$?"; ./tools/repo-lint | tail -3; echo "rc=$?"; ./tools/healthcheck; ./tools/budget-show; ./tools/regression-run --list 2>/dev/null | wc -l; ls tests/test_* | wc -l; ls tools/ | wc -l
queue-source-check: FAIL - 1 violation(s): [0.4.221] is not named in agent-logs/PROGRESS.md - the newest CHANGELOG entry has no record in the authoritative file
  - [0.4.221] is not named in agent-logs/PROGRESS.md - the newest CHANGELOG entry has no record in the authoritative file
qsc rc=1
  go-compile: 45 module file(s) compile clean (2.043s)
  changelog-version: 225 changelog version heading(s), 225 unique, 7056 citation(s) checked, 0 missing, 6906 bare token(s) counted
result: all 184 linted file(s) parse clean (exit 0)
rc=0
dev: HEALTHY
  HTTP: 200
  Response: {"status":"ok","service":"gladex-investor-app","env":"dev","timestamp":1791224589,"version":"0.4.28"}
prod: HEALTHY
  HTTP: 200
  Response: {"status":"ok","service":"gladex-investor-app","env":"prod","timestamp":1791224589,"version":"0.4.28"}
=== Budget Status ===
Month:       2026-10
Allowance:   5.00 €
Spent:       0.00 € (no October charge recorded anywhere — gladex.de renews at 1.50/mo, renewal date NOT on file, raised as NEEDS-INVESTOR in REPORT.md §14, so this figure may understate a known recurring cost)
Remaining:   5.00 €

Log:
  - 2026-09-20: init, no domains ordered yet
  - 2026-09-20: investor APPROVED gladex.de (1.50/mo). Awaiting registrar purchase + DNS creds.
  - 2026-09-20: purchase completed same day — RDAP status active (changed 2026-09-20T11:10:57+02:00), DNS wired via pdns wrapper (A apex/dev/git/info/stats/log/team -> 77.90.15.49, MX 10 gladex.de), dig-verified; DOMAIN.md holds evidence.
  - 2026-09-24: ledger narrative corrected — spent-line still said "purchase pending at registrar" 4 days after registration (queued candidate #1); numbers unchanged (1.50/3.50, no money moved), log history above kept verbatim.
  - 2026-10-01: month rolled per brief §4 (balance resets to 5.00 on the 1st, unspent does NOT roll over). September history above is kept verbatim; September closed at spent 1.50 / remaining 3.50.
  - 2026-10-02: October opened at spent 0.00 / remaining 5.00 because no October charge exists in any file on this box — while gladex.de is a known 1.50/mo recurring cost with NO renewal date recorded anywhere. Figure to be corrected the moment the investor answers REPORT.md §14.
92
90
26
$ cd /data/repo && for t in test_registry_coverage test_queue_source test_repo_lint test_leak_figure_readers test_system_status_ip_drift; do printf "%-34s " "$t"; bash tests/$t.sh 2>&1 | tail -1; done
test_registry_coverage             === Results: 464 passed, 0 failed ===
test_queue_source                  ===============================
test_repo_lint                     ===============================
test_leak_figure_readers           ===============================
test_system_status_ip_drift        === Results: 662 passed, 0 failed ===
> build · mimo-v2.6-flash-free
$ cd /data/repo && for t in test_queue_source test_repo_lint test_leak_figure_readers; do printf "%-30s " "$t"; bash tests/$t.sh 2>&1 | grep -E "Results|passed" | tail -2 | tr '\n' ' '; echo; done; echo "=== repo-lint headings at HEAD:"; git show HEAD:CHANGELOG.md | grep -c "^## \["; echo "=== worktree:"; grep -c "^## \[" CHANGELOG.md; echo "=== regression-run --list head:"; ./tools/regression-run --list | head -4; ./tools/regression-run --list | tail -2
test_queue_source              queue-source-check suite: 278 passed, 0 failed 
test_repo_lint                 PASS: M20 planted: the derivation is defeated, not bypassed repo-lint suite: 473 passed, 0 failed 
test_leak_figure_readers       leak-figure-readers suite: 41 passed, 0 failed 
=== repo-lint headings at HEAD:
225
=== worktree:
226
=== regression-run --list head:
regression-run  repo=/data/repo  tests=/data/repo/tests  2026-10-05T18:34:05Z
  test_app_contrast.php
  test_app_contrast_meta.php
  test_app_version.php
  test_webmail_session_routing.php
result: 90 suite(s) discovered, none run (exit 0)
> build · mimo-v2.6-flash-free
$ cd /data/repo && grep -ln "mutant\|--mutations" tests/* | sed -n '1,30p'; echo "=== pin styles:"; grep -rn "wrong verdict\|did not survive\|mutant survived" tests/*.sh tests/*.php | grep -v "^tests/test_ip_drift_cron.sh" | sed -n '1,40p'
tests/test_budget_show.sh
tests/test_chat_a11y.php
tests/test_commit_gate.sh
tests/test_dig_tools_transport.sh
tests/test_disk_show.sh
tests/test_dns_verify.sh
tests/test_docs_mobile.php
tests/test_domain_availability.sh
tests/test_immich_roundtrip.sh
tests/test_inbox_status.sh
tests/test_ip_drift_check.sh
tests/test_ip_drift_cron.sh
tests/test_leak_figure_readers.sh
tests/test_links_tap_target.php
tests/test_mailbox_a11y.php
tests/test_pdns_api.sh
tests/test_promote_gate.sh
tests/test_promote_json.sh
tests/test_promote_lint_gate.sh
tests/test_queue_source.sh
tests/test_red_watch.sh
tests/test_registry_coverage.sh
tests/test_regression_run.sh
tests/test_repo_lint.sh
tests/test_smtp_relay_probe.sh
tests/test_source_sync_check.sh
tests/test_start_320.php
tests/test_stats_gocli_path.php
tests/test_system_status_cloud.sh
tests/test_system_status_dig_single_point.sh
=== pin styles:
tests/test_domain_availability.sh:417:echo "=== 9. mutations (each must RUN and give the wrong verdict) ==="
tests/test_immich_roundtrip.sh:27:#      required to RUN and give the wrong verdict against the same stub
tests/test_red_watch.sh:48:#      THIS suite report the wrong verdict for the claim that branch belongs to.
tests/test_red_watch.sh:761:            ok "$id → suite goes red (rc=$mrc), the mutant did not survive"
tests/test_red_watch.sh:763:            bad "$id → suite stayed GREEN, the mutant survived"
tests/test_red_watch.sh:766:            ok "$id → the wrong verdict lands on the intended assertion"
tests/test_repo_lint.sh:201:# commit, cascading wrong verdicts through every later section) — abort
tests/test_system_status_ip_drift.sh:1903:        *)                   bad "distinct4: the undocumented exit 99 did not survive (got '$DL_RC99')" ;;
> build · mimo-v2.6-flash-free
$ cd /data/repo && grep -n "action present (the class-internal\|does not borrow the public class's action" tests/test_ip_drift_cron.sh
568:assert_has "drift_pub → own action present (the class-internal absences read a real log)" \
583:assert_has "drift_cgnat → own action present (the class-internal absences read a real log)" \
587:assert_lacks "drift_cgnat → does not borrow the public class's action" \
598:assert_has "drift_unparse → own action present (the class-internal absences read a real log)" \
602:assert_lacks "drift_unparse → does not borrow the public class's action" \
$ cd /data/repo && git status --porcelain; echo "=== ahead/behind:"; git rev-list --left-right --count origin/main...HEAD; echo "=== recent commits:"; git log --oneline -4; echo "=== running procs (other desks?):"; ps -eo pid,etimes,cmd --sort=-etimes | grep -E "bash|python|php" | grep -v grep | head -15
M CHANGELOG.md
 M tests/test_ip_drift_cron.sh
 M tools/REGISTRY.md
=== ahead/behind:
0	0
=== recent commits:
43ee803 [0.4.220] closing measurements for 6bc0fdb — monitor 30/30 A28 PASS, red-watch green, system-status ALL SYSTEMS HEALTHY, queue-source 0, repo-lint 225/225/0, suite 283/0 on committed bytes, mutations 316/0 8/8, STEP 0 0/0 both DBs, spend 0.00
6bc0fdb [0.4.220] queue item (n): control30 — writer-side in-suite negative control for the class-internal DIAGNOSIS guard (tests/test_ip_drift_cron.sh 224 -> 283/0); REGISTRY figures 224->283 and 239->316; PROGRESS entry appended before this commit
35cbeeb identity sofia shift 2026-10-05T17:15Z model=opencode/ling-3.1-flash-free
f71b7f5 identity sofia shift 2026-10-05T19:11+02:00 — mail triage (1 unread from Lena, replied, inbox zero), personal note to Fabian (metadata only), role work: hiring-gate verification (both staged requests VALID/proposed, untracked from git, no system user/mailbox/timer — the investor's approve-or-reject gate holds end to end; guard 53/0; hire-agent suite 46/1 with H1 still the test owner's), investor side verified 0 unread/0 open (version re-verified from source: 0.4.28 both envs, wrong figure absent from this desk's notes), observation for the guard owner on the 18:31 scan exemption's coverage cost
=== running procs (other desks?):
    526 1338734 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
 357194 1039689 /bin/bash /data/agent-loop.sh
 811322  827924 tini -- python -m immich_ml
 811407  827924 python -m immich_ml
 811488  827924 tini -- /bin/bash -c start.sh immich
 811586  827923 python -m gunicorn immich_ml.main:app -k immich_ml.config.CustomUvicornWorker -c /usr/src/immich_ml/gunicorn_conf.py -b [::]:3003 -w 1 -t 300 --log-config-json /usr/src/immich_ml/log_conf.json --keep-alive 2 --graceful-timeout 10 --no-control-socket
1873675  681080 python3 stub.py mixed /tmp/opencode/lib /tmp/opencode/log.txt /tmp/opencode/token.txt 0
3967762  394878 /usr/bin/php -S 0.0.0.0:8000 -t src/php src/php/app.php
2715723   99219 /usr/bin/php -S 0.0.0.0:8001 -t src/php src/php/app.php
3538076   92676 python3 /tmp/stub_18000_3538070.py {"version":"1.2.3"} 18000
3622414   92396 python3 /tmp/stub_18001_3622377.py {"version":"1.2.3","commit":"abc123"} 18001
3622876   92394 python3 /tmp/stub_18002_3622377.py {"version":"1.2.3","commit":"abc123"} 18002
3623471   92392 python3 /tmp/stub_18003_3622377.py {"version":"1.2.3","commit":"aaa"} 18003
3624173   92389 python3 /tmp/stub_18004_3622377.py {"version":"1.2.4","commit":"bbb"} 18004
3625013   92387 python3 /tmp/stub_18005_3622377.py {"version":"1.2.3","commit":"abc123"} 18005
> build · mimo-v2.6-flash-free
Writing the PROGRESS entry **before** the commit that carries it (CLOSE PROTOCOL rule 1):
$ cd /data/repo && cat >> agent-logs/PROGRESS.md <<'EOF'

## 2026-10-05 free-builder run (constant task) — **STEP 0 owed nothing** + **queue item (o) EXECUTED: M9/M10, the two class-arm mutants the battery never had, and the PIN made real** — `tests/test_ip_drift_cron.sh --mutations` **316 → 324 passed / 0 failed, 10/10 mutants caught** (was M1–M8 / 8/8), `run_mutation`'s pin tightened from *name appears in the output* to *the assertion is among the FAIL lines* — changelog **`[0.4.221]`**

**STEP 0 — read first, paid before anything else, and nothing was owed.** `SELECT count(*) FROM messages WHERE direction='investor_to_agent' AND read=0` → **0** on `/opt/startup/dev/data/messages.db` and **0** on `/opt/startup/prod/data/messages.db` (one table `messages`; the predicate is `direction=… AND read=0`); newest row in each is **ours** (dev **144** / prod **109**, `agent_to_investor`, `read=1`); `./tools/inbox-status` → **exit 0**, *"OK - nothing owed (0 unread, 0 open entries all replied)"*; `INBOX.md` → **80 entries, 80 handled, 0 open**, read at run start. Both entries in the run's INBOX block are `~~HANDLED~~` from earlier runs (the Marco Steiner hire proposal, 2026-10-04, reply dev 143 / prod 108; the operator's production-version correction, 2026-10-05T09:05Z, reply dev 144 / prod 109), so **no row was written, no row was marked read, and `INBOX.md` was not touched** — measured, not assumed. The operator's correction is honoured in every figure below: **production is 0.4.28**, read from `tools/healthcheck`; the `[0.4.29]` token in `CHANGELOG.md` is a 2026-09-24 *changelog heading* and is never quoted as a production claim.

**The queue read.** **(o)** — *"`--mutations` still has no mutant for the class-internal `DIAGNOSIS` pair … Add **M9** (the `private-or-cgnat` arm also quoting the public class's diagnosis) and **M10** (public and tunnel arms exchanging their diagnosis bodies) to the `M` dict + `run_mutation` calls, each with its intended verdict pinned to a named assertion (`drift_cgnat → does not borrow the public class's diagnosis` / `drift_pub → own diagnosis present (the four absences read a real log)`). **Probe first**: this run's four plants say both mutants are already caught (235/17 and 264/19 through the new suite), so the value here is the **pin**, and if either mutant survives, that is a real hole rather than a formatting nit"* — taken whole. First I re-read `git status --porcelain` (**three modified files, all mine**: `CHANGELOG.md`, `tests/test_ip_drift_cron.sh`, `tools/REGISTRY.md`; no other desk's file dirty) and `git rev-list --left-right --count origin/main...HEAD` → **0 0** (no sibling commits pending). **(93)**/**(97)(a)** — fires the moment the investor **approves or rejects** `hiring/queue/*.json` (0 unread, i.e. waiting on a decision, not on silence). **(e)** hand-run only. **(k)** — `systemctl --failed --no-legend` → empty at this run's open. The standing `SOA:gladex.de … mname=placeholder (NEEDS-INVESTOR open)` row is the investor's item, untouched. **(g)**, **(h)**, **(i)**, **(j)**, **(l)**, **(m)**, **(n)** DONE.

**The probe, run before a line of the block was changed** (`/tmp/opencode/probe31/`, nothing under `/data/repo` written): both needles built and applied to a copy of `tools/ip-drift-cron` — M9 = the one-line substitution of the `private-or-cgnat` arm's `DIAGNOSIS` with the public arm's body, M10 = the two bodies exchanged (one contiguous replace over the whole `if/elif/else` diagnosis span; the two arms sit 13 lines apart with the unparseable arm between them, so a two-location swap is not one `replace`), each `bash -n` clean, each needle counted **exactly once** in the tool. Baseline unedited suite **283 passed / 0 failed, rc 0**. Replay through the suite: **M9 → 231 passed / 18 failed, rc 1**, its pin line reading `FAIL - drift_cgnat → does not borrow the public class's diagnosis (unexpected: egress is a public IP but differs from DNS.)`; **M10 → 261 / 19, rc 1**, `FAIL - drift_pub → own diagnosis present (the four absences read a real log) (missing: egress is a public IP but differs from DNS.)`. The queue's *"if either mutant survives, that is a real hole"* is closed **before** the dict entries existed: **neither survives, and each lands on its own pin**.

**The value was the pin, and the pin was decorative — measured, not suspected.** The battery's check was `grep -qF "$expect" "$out"`, and every assertion prints its own `ok - <name>` line, so that grep holds whenever the assertion merely *exists* in the file, mutant or not: on the **untouched control** (0 FAIL lines) **10/10 pin strings matched**, i.e. the pin could not tell "the intended assertion reddened" from "the intended assertion passed while something else reddened". All ten pins were re-probed against their own mutants first (one suite run per mutant, ~4 s each): **10/10 pinned assertions DO fail under their own mutant**, so the strict form could replace the loose one **without moving a single pin to an easier assertion**. The check is now `grep -F "FAIL - " "$out" | grep -qF "$expect"` — the same shape `tests/test_red_watch.sh` has used since it was written (`grep -qF "FAIL: $expect"`), so this suite is now the conforming one.

**The tightened pin proven able to fail — the one thing the old pin could never do.** In a fake tree (`/tmp/opencode/probe31/fake/`, `tests/` + `tools/` copied so `REPO=` resolves there) **M9's pin was redirected** to `drift → exit 1`, an assertion the M9 defect does not redden → **323 passed / 1 failed, rc 1**, the red being `M9 → wrong verdict is NOT the intended one (expected a failure of: 'drift → exit 1')`. Same mutant, same pin string, both readings taken on its output: the string appears **three times, all as `ok` lines** (`ok - drift → exit 1`, `ok - CGNAT drift → exit 1`, `ok - unparseable drift → exit 1`) → **old loose grep: MATCH, the battery would have stayed green**; **new FAIL-line grep: no match → red**. That pair of readings is the whole difference between a pin and a decoration, and it is why the dict entries alone would not have been a step.

**What landed** (three files, no code): (1) **`M9`/`M10` dict entries** with comments naming the defect each guards (M9 = a class arm contradicting its own `class=` token; M10 = both arms plausible after the swap, so only a reader that pins each class to its own sentence reddens) and their **two `run_mutation` calls**, pinned exactly as the queue specified; (2) **the pin**, tightened as above, with the control measurement written into the battery's header comment so the next reader knows why it is a FAIL-line grep; (3) **`tools/REGISTRY.md`** — battery **M1–M8 → M1–M10**, **316 → 324 assertions**, **8/8 → 10/10 mutants caught**, the pin's semantics and its control measurement, plus the historical *"M6 … no new mutant was added"* note scoped with *"with that block — the class arms got their own mutants later, M9/M10 below"*.

**Verification (none carried from before the change).** `bash -n` → **OK** · `bash tests/test_ip_drift_cron.sh` → **283 passed / 0 failed** (a battery change adds nothing to the plain suite) · `bash tests/test_ip_drift_cron.sh --mutations` → **324 passed / 0 failed, rc 0**, all ten `M9 →`/`M10 →` lines `ok` including both pins · `bash tests/test_registry_coverage.sh` → **464 / 0** (read *after* the `REGISTRY.md` edit) · `bash tests/test_queue_source.sh` → **278 / 0** · `bash tests/test_repo_lint.sh` → **473 / 0** · `bash tests/test_leak_figure_readers.sh` → **41 / 0** · `bash tests/test_system_status_ip_drift.sh` → **662 / 0** (unchanged, the reader block it already carries) · `tools/repo-lint` → **exit 0**, `all 184 linted file(s) parse clean`, **225 changelog version heading(s) / 225 unique / 0 missing** read at `HEAD`, so `[0.4.221]` moves the committed figure **225 → 226** (worktree `grep -c '^## \['` → 226 / 226 unique, measured) · `tools/queue-source-check` → **rc 1 with exactly one violation**, *"[0.4.221] is not named in agent-logs/PROGRESS.md"* — the detector working as designed on a CHANGELOG entry whose record did not exist yet, cleared by **this paragraph**, not by editing the detector · `./tools/healthcheck` → **exit 0**, dev **HEALTHY 200 `0.4.28`**, prod **HEALTHY 200 `0.4.28`** · `./tools/budget-show` → **5.00 / 0.00 / 5.00** (month 2026-10), spend this run **0.00** · census **90** tests / **26** tools (`./tools/regression-run --list` → `result: 90 suite(s) discovered`), no suite or tool added or removed, so `- Live:` stays **90**.

**Disclosures (shared tree, swept nothing).** `git status --porcelain` at write time lists exactly this run's four paths — `tests/test_ip_drift_cron.sh`, `tools/REGISTRY.md`, `CHANGELOG.md`, this entry — and nothing of another desk's; `origin/main...HEAD` → **0 0** at open. **`tools/ip-drift-cron` and `tools/system-status` are untouched by this step** (this run changed no code, only what proves it), and **no `app/src/php` file was touched → no reviewer gate and no promote**: dev and prod both stay **0.4.28**. All probe artefacts — the M9/M10 mutants, the ten-pin probe, the redirected-pin fake tree, four capture logs — live under `/tmp/opencode/probe31/` — **outside the repo, never committed**. **Zero DNS writes, no mail sent, no unit restarted, no `systemctl reset-failed`**, `crontab -l` untouched; spend **0.00** of the 5.00 October allowance, free `*-free` models only (`mimo-v2.6-flash-free`), no key configured, no secret or PII in any prompt, file or commit.

**Queue — next small step (read this first):**
**(p)** **M11/M12 — the `ACTION` half of the same pair, where M9/M10 were the `DIAGNOSIS` half.** The battery now has two mutants for what each class arm *diagnoses* and none for what it *tells the operator to do*: **M11** = the `private-or-cgnat` arm quoting the public class's `ACTION` (`verify VPS IP 77.90.15.49 is still correct BEFORE touching DNS` under a `class=private-or-cgnat` line), pinned to `drift_cgnat → does not borrow the public class's action`; **M12** = the public and tunnel arms exchanging their action bodies, pinned to `drift_pub → own action present (the class-internal absences read a real log)` (both pins exist today at `tests/test_ip_drift_cron.sh:587` and `:568`). **Probe first, same as (o)**: build both needles against a copy of `tools/ip-drift-cron` (the M9/M10 precedent — the needle is one line for a borrow, and for an exchange the same contiguous `if/elif/else` span with only the two `ACTION:` lines swapped), assert each needle occurs exactly once, `bash -n`, then replay through the unedited **283/0** suite and record the failing assertion *before* writing the dict entry; if either mutant survives, that is a real hole, not a formatting nit. Then re-check the pin the same way (the FAIL-line grep now in place makes a wrong pin red instead of silently green) and refresh the battery's `REGISTRY.md` figures (**324 → 332**, **10/10 → 12/12** — measured after the run, never arithmetic before it). Standing, not actioned: **(93)**/**(97)(a)** fires on the investor's approve/reject of `hiring/queue/*.json` (0 unread at this close), **(e)** hand-run only, **(k)** clear, the `SOA:gladex.de … mname=placeholder` row is the investor's NEEDS-INVESTOR item.

**CLOSE PROTOCOL**: this entry is appended **before** the commit that carries it (rule 1); a second commit carrying closing measurements re-appends this entry first (rule 2); commits are **path-limited to named paths** (never `git add -A`), and `git status --porcelain` must not list `agent-logs/PROGRESS.md` at stop (rule 3); nothing of mine is checked out or reverted.
EOF
grep -c "^## \[" agent-logs/PROGRESS.md; tail -3 agent-logs/PROGRESS.md | head -1; git status --porcelain
0
**(p)** **M11/M12 — the `ACTION` half of the same pair, where M9/M10 were the `DIAGNOSIS` half.** The battery now has two mutants for what each class arm *diagnoses* and none for what it *tells the operator to do*: **M11** = the `private-or-cgnat` arm quoting the public class's `ACTION` (`verify VPS IP 77.90.15.49 is still correct BEFORE touching DNS` under a `class=private-or-cgnat` line), pinned to `drift_cgnat → does not borrow the public class's action`; **M12** = the public and tunnel arms exchanging their action bodies, pinned to `drift_pub → own action present (the class-internal absences read a real log)` (both pins exist today at `tests/test_ip_drift_cron.sh:587` and `:568`). **Probe first, same as (o)**: build both needles against a copy of `tools/ip-drift-cron` (the M9/M10 precedent — the needle is one line for a borrow, and for an exchange the same contiguous `if/elif/else` span with only the two `ACTION:` lines swapped), assert each needle occurs exactly once, `bash -n`, then replay through the unedited **283/0** suite and record the failing assertion *before* writing the dict entry; if either mutant survives, that is a real hole, not a formatting nit. Then re-check the pin the same way (the FAIL-line grep now in place makes a wrong pin red instead of silently green) and refresh the battery's `REGISTRY.md` figures (**324 → 332**, **10/10 → 12/12** — measured after the run, never arithmetic before it). Standing, not actioned: **(93)**/**(97)(a)** fires on the investor's approve/reject of `hiring/queue/*.json` (0 unread at this close), **(e)** hand-run only, **(k)** clear, the `SOA:gladex.de … mname=placeholder` row is the investor's NEEDS-INVESTOR item.
 M CHANGELOG.md
 M agent-logs/PROGRESS.md
 M tests/test_ip_drift_cron.sh
 M tools/REGISTRY.md
> build · mimo-v2.6-flash-free

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Mon Oct  5 20:23:09 2026] 127.0.0.1:43298 Accepted
[Mon Oct  5 20:23:09 2026] 127.0.0.1:43298 Closing
[Mon Oct  5 20:25:44 2026] 127.0.0.1:35490 Accepted
[Mon Oct  5 20:25:44 2026] 127.0.0.1:35490 Closed without sending a request; it was probably just an unused speculative preconnection
[Mon Oct  5 20:25:44 2026] 127.0.0.1:35490 Closing
[Mon Oct  5 20:25:45 2026] 127.0.0.1:55938 Accepted
[Mon Oct  5 20:25:45 2026] 127.0.0.1:55938 Closed without sending a request; it was probably just an unused speculative preconnection
[Mon Oct  5 20:25:45 2026] 127.0.0.1:55938 Closing
[Mon Oct  5 20:26:20 2026] 127.0.0.1:52832 Accepted
[Mon Oct  5 20:26:20 2026] 127.0.0.1:52832 Closed without sending a request; it was probably just an unused speculative preconnection
[Mon Oct  5 20:26:20 2026] 127.0.0.1:52832 Closing
[Mon Oct  5 20:26:22 2026] 127.0.0.1:52844 Accepted
[Mon Oct  5 20:26:22 2026] 127.0.0.1:52844 Closed without sending a request; it was probably just an unused speculative preconnection
[Mon Oct  5 20:26:22 2026] 127.0.0.1:52844 Closing
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48710 Accepted
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48710 Closing
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48724 Accepted
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48724 Closing
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48738 Accepted
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48738 Closing
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48746 Accepted
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48746 Closing
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48752 Accepted
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48752 Closing
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48756 Accepted
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48756 Closing
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48768 Accepted
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48768 Closing
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48774 Accepted
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48774 Closing
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48778 Accepted
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48778 Closing
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48786 Accepted
[Mon Oct  5 20:30:10 2026] 127.0.0.1:48786 Closing
[Mon Oct  5 20:30:53 2026] 127.0.0.1:57512 Accepted
[Mon Oct  5 20:30:53 2026] 127.0.0.1:57512 Closing
[Mon Oct  5 20:30:53 2026] 127.0.0.1:57528 Accepted
[Mon Oct  5 20:30:53 2026] 127.0.0.1:57528 Closing
[Mon Oct  5 20:31:00 2026] 127.0.0.1:50258 Accepted
[Mon Oct  5 20:31:00 2026] 127.0.0.1:50258 Closing
[Mon Oct  5 20:31:00 2026] 127.0.0.1:50268 Accepted
[Mon Oct  5 20:31:00 2026] 127.0.0.1:50268 Closing
[Mon Oct  5 20:31:00 2026] 127.0.0.1:50276 Accepted
[Mon Oct  5 20:31:00 2026] 127.0.0.1:50276 Closing
[Mon Oct  5 20:31:00 2026] 127.0.0.1:50284 Accepted
[Mon Oct  5 20:31:00 2026] 127.0.0.1:50284 Closing
[Mon Oct  5 20:31:00 2026] 127.0.0.1:50296 Accepted
[Mon Oct  5 20:31:00 2026] 127.0.0.1:50296 Closing
[Mon Oct  5 20:31:00 2026] 127.0.0.1:50298 Accepted
[Mon Oct  5 20:31:00 2026] 127.0.0.1:50298 Closing
[Mon Oct  5 20:31:00 2026] 127.0.0.1:50304 Accepted
[Mon Oct  5 20:31:01 2026] 127.0.0.1:50304 Closing
[Mon Oct  5 20:31:01 2026] 127.0.0.1:50312 Accepted
[Mon Oct  5 20:31:01 2026] 127.0.0.1:50312 Closing
[Mon Oct  5 20:31:01 2026] 127.0.0.1:50318 Accepted
[Mon Oct  5 20:31:01 2026] 127.0.0.1:50318 Closing
[Mon Oct  5 20:31:01 2026] 127.0.0.1:50328 Accepted
[Mon Oct  5 20:31:01 2026] 127.0.0.1:50328 Closing
[Mon Oct  5 20:35:23 2026] 127.0.0.1:48014 Accepted