Gladex Agent Logs

All 19 sites measured. Now checking the current changelog/queue state before landing the fix:
$ cd /tmp/opencode/probe794bc && python3 - <<'EOF'
import json, glob, os
rows = {}
for f in glob.glob("out/results_*.json"):
    for r in json.load(open(f)):
        rows[r["id"]] = r
for line in open("out/results.jsonl"):
    r = json.loads(line); rows[r["id"]] = r
order = sorted(rows)
for k in order:
    r = rows[k]
    print(f"{r['id']:24} rc={r['rc']} {r['passed']}/{r['failed']} {r['secs']}s")
print("count:", len(rows))
print("missing B01-B11 (from first run stdout):", [k for k in ["B01_budget_350","B02_cache_359","B03_cache_381","B04_cache_386","B05_disk_358","B06_disk_363","B07_disk_368","B08_ssc_154","B09_ssc_159","B10_smtp_233","B11_pdns_597"] if k not in rows])
EOF
A1_budget_srcvar         rc=0 89/0 2.2s
A2_cache_srcvar          rc=1 101/4 3.2s
A3_disk_srcvar           rc=0 90/0 5.9s
A4_ssc_srcvar            rc=0 40/0 1.0s
A5_pdns_srcvar           rc=1 171/4 7.4s
A6_unread_srcvar         rc=1 24/2 6.8s
B12_pdns_602             rc=0 175/0 7.4s
B13_unread_203           rc=0 26/0 7.5s
B14_ipdrift_1127         rc=0 759/0 62.5s
B15_ipdrift_1262         rc=0 759/0 62.1s
B16_ipdrift_2018         rc=0 759/0 61.9s
B17_ipdrift_2960         rc=0 759/0 62.1s
B18_vhost_226            rc=0 85/0 2.6s
B18s_vhost_226shared     rc=1 84/1 2.8s
B19_vhost_254            rc=0 85/0 2.8s
S1_smtp_toolfile         rc=1 4/34 3.1s
S2_unread_toolfile       rc=1 5/21 0.8s
S3_pdns_toolfile         rc=1 65/100 1.7s
S4_ipdrift_wlogsrc       rc=1 733/26 62.0s
count: 19
missing B01-B11 (from first run stdout): ['B01_budget_350', 'B02_cache_359', 'B03_cache_381', 'B04_cache_386', 'B05_disk_358', 'B06_disk_363', 'B07_disk_368', 'B08_ssc_154', 'B09_ssc_159', 'B10_smtp_233', 'B11_pdns_597']
$ cd /data/repo && grep -n '^## \[0\.4\.' CHANGELOG.md | head -4; echo "=== qsc baseline ==="; ./tools/queue-source-check; echo "rc=$?"; echo "=== version-check ==="; ./tools/version-check; echo "=== git log head ==="; git log --oneline -3; git status --porcelain
9:## [0.4.28] - 2026-09-24 — Go CLI joins the single version train: build.sh derives its version from this changelog (was a hardcoded 0.2.0), download badge + docs CLI mentions follow, all four binaries rebuilt
23:## [0.4.27] - 2026-09-24 — version drift closed: nine stale `0.3.0` literals across app+docs collapse into one `GLADEX_APP_VERSION` constant sourced from this changelog
40:## [0.4.26] - 2026-09-24 — smtp-relay-probe now ASSERTS the 220 greeting (exit 4): a one-endpoint :25-greeting regression could no longer pass green
87:## [0.4.25] - 2026-09-24 — new `source-sync-check` guard caught 16 drifted files live: dev+prod shipped the pre-0.4.11 broken workflow templates
=== qsc baseline ===
queue-source-check: OK - one queue: [0.4.260] pointer-only, 111 item line(s) frozen across 215 section(s), 202 PROGRESS bullet(s), 3 path token(s)
rc=0
=== version-check ===
OK: dev=0.4.28 prod=0.4.28 (match)
=== git log head ===
fb5da25 run 793 (close): post-commit readings for 1f6990e — qsc rc 0 111/215/202/3 [0.4.260] pointer-only, test_queue_source 278/0, repo-lint rc 0 190 files 265 headings 8289 citations 0 missing (264->265 = this run's own heading; repo-lint reads the committed CHANGELOG), system-status rc 1 Overall 1 FAILED with git-tree OK clean + queue-source OK + go-compile OK commit 1f6990e + go-tests OK passing (worktree) + investor-duty/messages OK, single FAIL failed-units 2 (dispatcher+mia, other desks, no reset-failed), red-watch state=red 23/7 all others-or-no-push, disk-show rc 0 worst 78.2%, version-check 0.4.28=0.4.28, inbox-status STEP 0 re-read 0/0 + INBOX 80/80 nothing owed no row written, budget 5.00/0.00/5.00; one path committed
1f6990e run 793: queue item (bb) CLOSED BY PROBE + ONE PIN — the silent-skip class enumerated across all 48 .sh suites (two static passes: 127 &&-condition statements + 68 bare-command guards = 75 hand-read candidates) and exactly one live site was un-teeth'd: B16 in tests/test_detached_children.sh, whose inverted [ -n "$F3A" ] && kill -0 guard put the ok in the else, so an unwritten pid file short-circuited past the probe and printed PASS while measuring nothing — pinned with the non-vacuity arm assert_dead already carries, proven by a four-tree out-of-tree experiment (healthy 155/0 rc0, F3A="" 155/0 rc0 with B16 still PASS, empty+pin rc 1, healthy+pin 155/0 rc0) — changelog [0.4.260], landed suite 155/0 unchanged (REGISTRY's pinned 155 holds), regcov 464/0, qsc rc 0 111/215/202/3, test_queue_source 278/0, repo-lint rc 0 190 files 264 headings 8283 citations 0 missing; three families rejected by reading (plant/mutate/make_copy teethed in-helper at 5 definitions, teeth-in-condition x2, counters+heredoc fixtures), the second family (19 text-scan guards) measured un-teeth'd on budget_show SRC="" 89/0 rc0 and queued as (bc); disclosed: this run's symlinked probe layout let ctl_copy cp -a four live tools through the K-series plants — git checkout restored all four byte-identical to HEAD, no commit carried the damage, guard queued as (bd); STEP 0 0/0 unread + INBOX 80/80 nothing owed no row written, production 0.4.28 never 0.4.29, spend 0.00, no push
8827686 run 792 (close): post-commit readings for 51ee878 — qsc rc 0 111/214/202/3 [0.4.259] pointer-only, test_queue_source 278/0, repo-lint rc 0 190 files 264 headings 8280 citations 0 missing, system-status rc 1 Overall 1 FAILED with git-tree OK clean + queue-source OK + go-compile OK commit 51ee878 + go-tests OK passing (worktree) + investor-duty/messages OK, single FAIL failed-units 2 (dispatcher+mia, other desks, no reset-failed), red-watch 24/8 all others-or-push, disk-show rc 0 worst 78.2%, version-check 0.4.28=0.4.28, inbox-status STEP 0 re-read 0/0 + INBOX 80/80 nothing owed, budget 5.00/0.00/5.00; one path committed
> build · mimo-v2.6-flash-free
$ cd /data/repo && head -30 CHANGELOG.md; echo "..."; grep -n '^## \[0\.4\.2[5-6][0-9]\]' CHANGELOG.md | head -20; echo "=== total lines ==="; wc -l CHANGELOG.md
# Changelog

All notable changes to Gladex are documented here.

Format: `[version] - YYYY-MM-DD — description`

**Which version heading is "newest"? Three readings, three answers — never infer one from another.** The *first* heading below is the app version train: it is what `app/src/go/build.sh` parses, what `const GLADEX_APP_VERSION` must equal, and what `/api/changelog` returns first — that endpoint reads the file in order and does not sort — so it moves only when an entry is written at the top of this file. The *last* heading is the most recently written entry, because everything since the legacy block is appended to the bottom. The *highest* version is what a human reader wants and what the `/changelog` page's "Latest 5 releases" digest leads with, because that digest sorts with `version_compare`. This file is legacy-descending at the top and append-ascending at the bottom, so those three readings are three different numbers today — pick the one your reader needs on purpose.

## [0.4.28] - 2026-09-24 — Go CLI joins the single version train: build.sh derives its version from this changelog (was a hardcoded 0.2.0), download badge + docs CLI mentions follow, all four binaries rebuilt

### Fixed
- **Go CLI version train** (queued at 0.4.27): `app/src/go/build.sh` hardcoded `VERSION="0.2.0"`, so every rebuild reported **0.2.0** while the product train had moved to 0.4.x — the downloaded binary, the `/download` badge (`$version = '0.2.0'`) and two `/docs` mentions (`Go CLI binary (v0.2.0)` and the ASCII diagram's `gladex v0.2.0`) advertised numbers ~26 entries behind this changelog: exactly the drift class 0.4.27 closed for the app's nine stale `0.3.0` literals, just on the CLI side. `build.sh` also ignored the README-documented `VERSION=x.y.z ./build.sh` override (silently clobbered by the literal).
- **`gladex version --remote` was structurally incoherent**: it compares the local binary against `https://gladex.de/api/version` (the **app** train), so a CLI pinned at 0.2.0 reported "update available" against every already-current download — and would keep reporting it at whatever stale number the train stopped at. After this fix the check compares like with like: changelog top = app const = binary `version --json` = download badge = docs mentions.
- Fix: `build.sh` parses the top `## [x.y.z]` entry out of `CHANGELOG.md` (`VERSION=` env override preserved — README's documented custom-version invocation now actually works instead of being ignored); `/download`'s badge reads `GLADEX_APP_VERSION` instead of a literal; the two `/docs` CLI mentions carry the current train number and are now **guarded by a test** (they were unguarded, i.e. permanently stale-prone). App train moved to **0.4.28** with it (`GLADEX_APP_VERSION` + `/docs` payloads/footer, repo+dev+prod byte-identical). `build.sh` also `cd`s into its own directory first — module resolution starts at the CWD, so invoking it from anywhere but `app/src/go` (the repo root, `/tmp`) died with `go: cannot find main module` even though every other path in the script was already `SCRIPT_DIR`-relative; guarded behaviourally by building from the repo root.
- Rebuilt all four copies — `app/bin/gladex`, `app/src/go/gladex`, dev, prod — md5-identical, reporting `0.4.28`.

### Tests
- **`tests/test_cli_version.php`** (35 assertions, 3 mutations): `build.sh` derives from the changelog with no hardcoded `VERSION="x.y.z"` literal, keeps the env override and `cd`s to its script dir (behavioural: built from the repo root — the cwd trap — reporting the changelog top, and from `/tmp` with `VERSION=9.9.9` where the override must win); `download.php` has no version literal (token scan; comments don't count) and renders the badge from the const (behavioural: const `9.9.9` → badge `v9.9.9`, proving wiring not coincidence; standalone-without-const → `0.0.0` sentinel); the two `/docs` CLI mentions parse and equal the changelog top (stale number → FAIL); all four binaries report the changelog top via `version --json` with a real commit sha and are md5-identical. Mutations that MUST be detected: reintroduced `$version = '0.2.0'` (static + behavioural), reintroduced `VERSION="0.2.0"` in build.sh, stale `gladex v0.1.0` docs mention.

### Notes
- Trains are now ONE. `version.go`'s `0.1.0-dev` fallback (plain `go build`, no ldflags) is deliberate and unchanged — README documents it as the quick-build default. Binary `commit:` embeds the source commit (built after commit 1 of this run, before the binary commit).

## [0.4.27] - 2026-09-24 — version drift closed: nine stale `0.3.0` literals across app+docs collapse into one `GLADEX_APP_VERSION` constant sourced from this changelog

### Added
- **`const GLADEX_APP_VERSION`** (top of `app/src/php/app.php`) — the single place the app version lives: `/healthz`, `/api/version`, `/api/health`, `/api/changelog` and `/api/endpoints` all report it instead of five duplicated literals; CHANGELOG.md is the version train, the constant must equal its top entry.
- **`gladex_app_version_of($path)`** in `app/src/php/db.php` (included by both callers) — reads the version out of a *deployed* `app.php` copy without executing it: prefers `const GLADEX_APP_VERSION`, falls back to the old `'version' => '...'` pattern so a half-synced env copy reports its old-but-correct value instead of `unknown`. Used by the `/stats` page dev/prod rows and the `/api/stats` payload.
- **`tests/test_app_version.php`** (39 assertions, 3 mutations): constant declared exactly once and equal to the changelog top entry; five endpoint usages; no stray `'version' => 'x.y.z'` literals in app.php (the `gladex-stats` payload schema `0.1.0` is the allowlisted exception); the `db.php` helper resolves new-style, old-style, missing (`null`) and unparseable (`unknown`) fixtures plus the real file; `/docs` example payloads + footer match the constant; repo+dev+prod copies all agree with the changelog top; `php -l` on the four touched files. Mutations that MUST be detected: stale constant value, reintroduced stray literal, stale docs footer.

### Fixed
...
8471:## [0.4.250] - 2026-10-07 — queue item (aq): **M52/M53 — `PY30PLANT`'s `BODIES` map, step 2's borrow-planting WRITER at line 909, the last un-named `BODIES` in this file, given teeth in this file's opt-in battery: a disclosed nine-red on M52 (the uncaught-`KeyError` traceback shape no `SystemExit` path can print), a disclosed four-red on M53 (the public class carrying the cgnat DIAGNOSIS body), and an enumeration proving no single-red shape exists for this input at all** — `tests/test_ip_drift_cron.sh` `--mutations` **556 → 566/0**, default run unchanged at **340/0**
8493:## [0.4.251] - 2026-10-07 — queue item (aq) CLOSED: **the M52/M53 record its own shift never wrote — the block, its registry paragraph and `[0.4.250]` all reached HEAD (`78aea49` code+registry, `02581ad` changelog) while `agent-logs/identity-lena.md` ends `Rate limit exceeded … exit=1`, leaving `queue-source-check` red on R8 *and* R10; this run re-measured every (aq) number on the committed bytes, re-planted both shapes from its own derived needles, reproduced the pre-install blindness, and carries the queue record in ONE commit with this entry** — no suite, tool or code file changed, `tests/test_ip_drift_cron.sh` byte-identical to `78aea49`
8508:## [0.4.252] - 2026-10-07 — queue item (ar): **M54/M55 — `LINE`, the `DIAGNOSIS` FORMAT STRING both step-2 heredocs define byte-identically (`PY30PLANT` line 915, `PY30SWAP` line 970), the last un-named input of either writer, given teeth in this file's opt-in battery: a disclosed nine-red on M54 (the count-0 `SystemExit` no traceback can be confused with), a disclosed four-red on M55 (the rotation's own `0/0/0` guard), and an ENUMERATION showing no single-red shape exists for either input** — `tests/test_ip_drift_cron.sh` `--mutations` **566 → 576/0**, default run unchanged at **340/0**
8529:## [0.4.253] - 2026-10-07 — queue item (as): **`ORDER`, the `public_report_class` return order `('public', 'private-or-cgnat', 'unparseable')` this file's step-2 heredoc (`tests/test_ip_drift_cron.sh:914`) carries, judged by measurement before it was planted — the pure reorder SURVIVES and is recorded as a survivor (not planted), the ENTRY DROP reddens 2 and is caught as M56** — `tests/test_ip_drift_cron.sh` `--mutations` **576 → 581/0** plain, **573 → 578/0** live-free, default run unchanged at **340/0**
8549:## [0.4.254] - 2026-10-08 — the **(at) RECORD**: queue item (at)'s `M23`/`M24` and the sweep's second undocumented change (`tools/healthcheck`'s answered-500 repair plus its new `tests/test_healthcheck.sh`) are documented together, three commits after `[0.4.253]`, every figure re-taken on committed bytes — red-watch **A28**'s window closes with this heading, and **this run changed no code**
8568:## [0.4.255] - 2026-10-08 — queue item (au): **the (at) step-(4) TEETH reading moved in-file, beside the two pins it proves, and the reader suite's stale header lead corrected** — `nine mutants of THIS FILE's own source` → `eleven … : nine` (the nine src pins M14–M22 **plus** the two ORDER pins M23/M24 = the eleven `--help` has always documented), comment and wording only: default run unchanged at **759 / 0**, `--mutations` re-taken after both edits at **824 / 0** (65 `ok` rows for M12–M24, **0** FAIL), teeth re-run from scratch → clean **759 / 0** with each redirected target printed **once** and battery **822 / 2** with both reds on the redirected pins, targets still lines **974** / **1358**
8585:## [0.4.256] - 2026-10-08 — queue item (av): **the root filesystem pulled back from the brink by an ACCESS-TIME cut of the Go build cache — `/` 97.1 % / 2,898,161,664 B free → 75.2 % / 24,677,494,784 B free** — `find /tmp/gocache -type f -atime +2 -delete` removed **108,378 files / 20,783 MiB** and kept the 48 h working set (**16.6 GB**); `go test ./... -count=1 -short` re-taken *after* the cut → **rc 0 in 28 s**; `disk-show` → **rc 0** (was **rc 3, BREACH**); `system-status` → **rc 0** with `go-tests [OK] passing (worktree)` and `go-compile [OK] 46 module file(s)`; `version-check` → **dev=0.4.28 prod=0.4.28 (match)**
8613:## [0.4.257] - 2026-10-08 — queue item (ax): **the access-time cut gets a home — `tools/cache-show` (new tool) measures the Go build cache's cold half, the growth that undoes the trim and the day `/` reaches the threshold, and prints the prune command instead of leaving the next run to re-derive it** — one `find` pass over 119,106 files / 26,891,002,127 B in **0.54 s** reports **10,461,521,958 B cold** (not read in 48 h, 46,335 files), **7,065,323,144 B/day** written and **2.7 days** to 90 % of `/` at today's growth; `tests/test_cache_show.sh` (new suite) → **105 / 0** with all three mutations diverging; `tests/test_registry_coverage.sh` → **464 / 0** after three deliberate scope refreshes (Live suite figure **92 → 93**, C28g **23 → 24**, G38 **22 → 24**)
8639:## [0.4.258] - 2026-10-08 — queue item (ii): **the Go build cache default moves off the root disk onto the SSD — `GLADEX_GO_GOCACHE` `/tmp/gocache` → `/data/gocache` in both consumers, `cache-show`'s cache+mount pair moved with it, and `disk-show`'s reclaimable table gained the live directory instead of losing the legacy one** — the move the queue said to "take or reject with the number in hand" was taken; `./tools/system-status` → **rc 0**, `go-tests [OK] passing (worktree)` in a **52.684 s** wall run (then **51.21 s**), against `GO_TIMEOUT` 120; `./tools/cache-show` → **rc 0** on the new pair `/data` **6.6 %** / `/data/gocache` **381,882,734 B**, **298.3 days** to 90 %, while `--cache-dir /tmp/gocache --mount /` still reports the legacy cache at **27,943,514,195 B** and **2.3 days**; `/tmp/gocache` last written **06:14:41Z** and untouched since
8671:## [0.4.259] - 2026-10-08 — queue item (aw): **the teeth family moves to `tests/test_healthcheck.sh`: section D's last un-teeth'd input is the M3 plant's DEAD PORT, and it was the only input of that section that could vanish with the suite still green** — a probe of **11 shapes** over the section's four plants read **10 caught / 1 survivor** before anything was written (`DEAD_PORT=""` → **120 passed, 0 failed, rc 0**); the pin is an `elif … bad` guard, and the same 11 shapes re-read **11 / 11 caught** with the survivor flipped to **120 / 1, rc 1** — `tests/test_healthcheck.sh` **122 / 0** unchanged, `tools/healthcheck` byte-identical
8709:## [0.4.260] - 2026-10-08 — queue item (bb): **the silent-skip class is enumerated across all 48 `.sh` suites — 75 guard candidates read by hand, one live site (`B16`) measured un-teeth'd and pinned, and a second family of 19 text-scan guards measured un-teeth'd on its first probe and handed to (bc) with that measurement instead of a prediction** — `tests/test_detached_children.sh` **155 / 0** unchanged on the healthy path (the pin adds no assertion, so `tools/REGISTRY.md`'s *155 assertions, exit 0* stays true), `tests/test_registry_coverage.sh` **464 / 0**
=== total lines ===
8741 CHANGELOG.md
> build · mimo-v2.6-flash-free
All 19 sites measured. Now landing the fix — the three suites whose source-level probe stayed green (budget, disk, source-sync-check):
← Edit repo/tests/test_budget_show.sh
Index: repo/tests/test_budget_show.sh
===================================================================
--- repo/tests/test_budget_show.sh
+++ repo/tests/test_budget_show.sh
@@ -346,9 +346,17 @@
 json_ok "the REAL ledger's own month is named in its own warning" 'd["month"] in d["warnings"][0]'
 
 # --- M: static — the tool is read-only by construction ---------------------------
 SRC=$(cat "$TOOL")
-if printf '%s' "$SRC" | grep -Eq "os\.(remove|unlink|rename|mkdir|makedirs)|shutil\.|subprocess|os\.system|open\([^)]*,[[:space:]]*[\"'][wa+][\"']"; then
+# Non-vacuity arm (queue item (bc), 2026-10-08): $SRC is the ONLY input this
+# guard reads, and the healthy branch is the `else`, so an empty read took the
+# same path a clean tool takes and printed ok without measuring anything —
+# measured out of tree: SRC="" -> 89 passed / 0 failed / rc 0, this line's own
+# PASS still printed. The arm fires only on an empty source, so the healthy
+# count is untouched (still 89).
+if [ -z "$SRC" ]; then
+  fail "static guard: tool source is EMPTY — this guard would print ok without reading anything"
+elif printf '%s' "$SRC" | grep -Eq "os\.(remove|unlink|rename|mkdir|makedirs)|shutil\.|subprocess|os\.system|open\([^)]*,[[:space:]]*[\"'][wa+][\"']"; then
   fail "static guard: tool contains a write/exec API"
 else
   ok "static guard: tool contains no write/exec API"
 fi

> build · mimo-v2.6-flash-free
← Edit repo/tests/test_disk_show.sh
Index: repo/tests/test_disk_show.sh
===================================================================
--- repo/tests/test_disk_show.sh
+++ repo/tests/test_disk_show.sh
@@ -354,19 +354,30 @@
 json_ok "J5 it watches exactly the path asked for" 'd["mounts"][0]["path"]=="/"'
 
 # --- K: static guards --------------------------------------------------------
 SRC=$(cat "$TOOL")
-if printf '%s' "$SRC" | grep -Eq "os\.(remove|unlink|rename|mkdir|makedirs)|shutil\.|rmtree|os\.system|open\([^)]*,[[:space:]]*[\"'][wa+][\"']"; then
+# Non-vacuity arms (queue item (bc), 2026-10-08): all three guards below read
+# ONLY $SRC and all three take the `else` on a clean tool, so an empty read was
+# indistinguishable from a clean one — measured out of tree: SRC="" ->
+# 90 passed / 0 failed / rc 0 with K1, K2 and K3 all still printing PASS. Each
+# arm fires only on an empty source, so the healthy count is untouched (90).
+if [ -z "$SRC" ]; then
+  fail "K1 static guard: tool source is EMPTY — K1 would print ok without reading anything"
+elif printf '%s' "$SRC" | grep -Eq "os\.(remove|unlink|rename|mkdir|makedirs)|shutil\.|rmtree|os\.system|open\([^)]*,[[:space:]]*[\"'][wa+][\"']"; then
   fail "K1 static guard: the tool contains a delete/write API"
 else
   ok "K1 static guard: the tool contains no delete/write API"
 fi
-if printf '%s' "$SRC" | grep -Eq "\bsetsid\b|\bnohup\b|\bdisown\b|start_new_session|os\.fork|&[[:space:]]*(#.*)?$"; then
+if [ -z "$SRC" ]; then
+  fail "K2 static guard: tool source is EMPTY — K2 would print ok without reading anything"
+elif printf '%s' "$SRC" | grep -Eq "\bsetsid\b|\bnohup\b|\bdisown\b|start_new_session|os\.fork|&[[:space:]]*(#.*)?$"; then
   fail "K2 static guard: the tool can leave a child behind (the (74)/(80) class)"
 else
   ok "K2 static guard: the tool leaves no child behind"
 fi
-if printf '%s' "$SRC" | grep -Eq "\bsocket\b|urllib|requests\.|http\.client|urlopen"; then
+if [ -z "$SRC" ]; then
+  fail "K3 static guard: tool source is EMPTY — K3 would print ok without reading anything"
+elif printf '%s' "$SRC" | grep -Eq "\bsocket\b|urllib|requests\.|http\.client|urlopen"; then
   fail "K3 static guard: the tool opens a network connection"
 else
   ok "K3 static guard: the tool is local-only"
 fi

> build · mimo-v2.6-flash-free
← Edit repo/tests/test_source_sync_check.sh
Index: repo/tests/test_source_sync_check.sh
===================================================================
--- repo/tests/test_source_sync_check.sh
+++ repo/tests/test_source_sync_check.sh
@@ -150,14 +150,23 @@
 assert_contains "missing dir reported as MISSING-DIR" "MISSING-DIR" "$OUT"
 
 # --- L: static read-only guard (tool must never write/exec) --------------------
 SRC=$(cat "$TOOL")
-if printf '%s' "$SRC" | grep -Eq "os\.(remove|unlink|rename|mkdir|makedirs)|shutil\.|subprocess|os\.system|open\([^)]*,[[:space:]]*[\"'][wa+][\"']"; then
+# Non-vacuity arms (queue item (bc), 2026-10-08): both guards below read ONLY
+# $SRC and both take the `else` on a clean tool, so an empty read was
+# indistinguishable from a clean one — measured out of tree: SRC="" ->
+# 40 passed / 0 failed / rc 0 with BOTH guards still printing PASS. Each arm
+# fires only on an empty source, so the healthy count is untouched (40).
+if [ -z "$SRC" ]; then
+  fail "static guard: tool source is EMPTY — the write/exec guard would print ok without reading anything"
+elif printf '%s' "$SRC" | grep -Eq "os\.(remove|unlink|rename|mkdir|makedirs)|shutil\.|subprocess|os\.system|open\([^)]*,[[:space:]]*[\"'][wa+][\"']"; then
   fail "static guard: tool contains a write/exec API"
 else
   ok "static guard: tool contains no write/exec API (read-only by construction)"
 fi
-if printf '%s' "$SRC" | grep -q "rsync\|cp -\|> /opt/startup"; then
+if [ -z "$SRC" ]; then
+  fail "static guard: tool source is EMPTY — the copy/deploy guard would print ok without reading anything"
+elif printf '%s' "$SRC" | grep -q "rsync\|cp -\|> /opt/startup"; then
   fail "static guard: tool contains a copy/deploy command"
 else
   ok "static guard: tool contains no copy/deploy command"
 fi

> build · mimo-v2.6-flash-free

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Thu Oct  8 12:26:21 2026] 127.0.0.1:56184 Accepted
[Thu Oct  8 12:26:21 2026] 127.0.0.1:56184 Closing
[Thu Oct  8 12:26:21 2026] 127.0.0.1:56192 Accepted
[Thu Oct  8 12:26:21 2026] 127.0.0.1:56192 Closing
[Thu Oct  8 12:26:21 2026] 127.0.0.1:56208 Accepted
[Thu Oct  8 12:26:21 2026] 127.0.0.1:56208 Closing
[Thu Oct  8 12:26:22 2026] 127.0.0.1:56212 Accepted
[Thu Oct  8 12:26:22 2026] 127.0.0.1:56212 Closing
[Thu Oct  8 12:26:22 2026] 127.0.0.1:56216 Accepted
[Thu Oct  8 12:26:22 2026] 127.0.0.1:56216 Closing
[Thu Oct  8 12:26:22 2026] 127.0.0.1:56222 Accepted
[Thu Oct  8 12:26:22 2026] 127.0.0.1:56222 Closing
[Thu Oct  8 12:26:22 2026] 127.0.0.1:56236 Accepted
[Thu Oct  8 12:26:22 2026] 127.0.0.1:56236 Closing
[Thu Oct  8 12:29:29 2026] 127.0.0.1:53552 Accepted
[Thu Oct  8 12:29:29 2026] 127.0.0.1:53552 Closing
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40018 Accepted
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40018 Closing
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40032 Accepted
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40032 Closing
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40038 Accepted
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40038 Closing
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40044 Accepted
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40044 Closing
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40046 Accepted
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40046 Closing
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40052 Accepted
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40052 Closing
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40068 Accepted
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40068 Closing
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40082 Accepted
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40082 Closing
[Thu Oct  8 12:30:10 2026] 127.0.0.1:40098 Accepted
[Thu Oct  8 12:30:11 2026] 127.0.0.1:40098 Closing
[Thu Oct  8 12:30:11 2026] 127.0.0.1:40100 Accepted
[Thu Oct  8 12:30:11 2026] 127.0.0.1:40100 Closing
[Thu Oct  8 12:31:01 2026] 127.0.0.1:47598 Accepted
[Thu Oct  8 12:31:01 2026] 127.0.0.1:47598 Closing
[Thu Oct  8 12:31:01 2026] 127.0.0.1:47608 Accepted
[Thu Oct  8 12:31:01 2026] 127.0.0.1:47608 Closing
[Thu Oct  8 12:31:01 2026] 127.0.0.1:47618 Accepted
[Thu Oct  8 12:31:01 2026] 127.0.0.1:47618 Closing
[Thu Oct  8 12:31:01 2026] 127.0.0.1:47630 Accepted
[Thu Oct  8 12:31:01 2026] 127.0.0.1:47630 Closing
[Thu Oct  8 12:31:01 2026] 127.0.0.1:47636 Accepted
[Thu Oct  8 12:31:01 2026] 127.0.0.1:47636 Closing
[Thu Oct  8 12:31:01 2026] 127.0.0.1:47646 Accepted
[Thu Oct  8 12:31:01 2026] 127.0.0.1:47646 Closing
[Thu Oct  8 12:31:01 2026] 127.0.0.1:47660 Accepted
[Thu Oct  8 12:31:02 2026] 127.0.0.1:47660 Closing
[Thu Oct  8 12:31:02 2026] 127.0.0.1:47670 Accepted
[Thu Oct  8 12:31:02 2026] 127.0.0.1:47670 Closing
[Thu Oct  8 12:31:02 2026] 127.0.0.1:47674 Accepted
[Thu Oct  8 12:31:02 2026] 127.0.0.1:47674 Closing
[Thu Oct  8 12:31:02 2026] 127.0.0.1:47688 Accepted
[Thu Oct  8 12:31:02 2026] 127.0.0.1:47688 Closing
[Thu Oct  8 12:31:02 2026] 127.0.0.1:47700 Accepted
[Thu Oct  8 12:31:02 2026] 127.0.0.1:47700 Closing
[Thu Oct  8 12:31:42 2026] 127.0.0.1:39334 Accepted