Gladex Agent Logs

+#     so that branch (H4 rc=0 included) stayed green over a tool that printed
+#     nothing — `[0.4.265]`'s "each pairs with a same-haystack sibling" does
+#     not hold for those two, and the plant is what showed it;
+#   * `cannot_verify` silenced -> E4 printed PASS while E3 and E7 reddened on
+#     the same empty stderr.
+# The empty arm fails first, still exactly ONE assertion per site, so the
+# healthy count stays 115. Separate helper (not a delegation from
+# `assert_not_contains_read`) so G2-G7/F6 keep their run-796 message verbatim.
+assert_not_contains_nonempty() { # desc needle haystack
+  if [ -z "$3" ]; then fail "$1 (haystack is EMPTY - nothing was read)"
+  else assert_not_contains "$1" "$2" "$3"; fi
+}
 assert_eq() { # desc want got
   if [ "$3" = "$2" ]; then ok "$1"; else fail "$1 (want=$2 got=$3)"; fi
 }
@@ -236,7 +259,7 @@ assert_j 'd["timestamp"].endswith("Z")'
 run_tool "$LIVE" "$SB/tmpl_ok"
 assert_rc "C4 in_sync human -> exit 0" 0 "$RC"
 assert_contains "C5 human prints the status line" "Status:     in_sync (2 of 2" "$OUT"
-assert_not_contains "C6 human prints no WARN row when in sync" "WARN:" "$OUT"
+assert_not_contains_nonempty "C6 human prints no WARN row when in sync" "WARN:" "$OUT"
 assert_contains "C7 human says no remedy is needed" "Remedy: (none needed" "$OUT"
 assert_contains "C8 human marks each file IN SYNC" "IN SYNC" "$OUT"
 
@@ -267,7 +290,7 @@ assert_contains "D7 human prints the remedy under a host heading" \
   "Remedy (run where the template tree is writable):" "$OUT"
 assert_contains "D8 human remedy line is a cp naming both files" \
   "cp $LIVE_REAL/AGENT_BRIEF.md $(realpath "$SB/tmpl_drift")/AGENT_BRIEF.md" "$OUT"
-assert_not_contains "D9 the in-sync copy is not named by a remedy" \
+assert_not_contains_nonempty "D9 the in-sync copy is not named by a remedy" \
   "AGENT_TASK.md" "$(printf '%s' "$OUT" | sed -n '/Remedy/,$p')"
 
 # ---- D10-D14: every copy differing -> one remedy each --------------------
@@ -293,7 +316,7 @@ run_tool "$LIVE" "$SB/no-such-template-dir" --format json
 assert_rc "E1 absent template dir -> exit 3" 3 "$RC"
 assert_eq "E2 absent template dir -> empty stdout (never a verdict object)" "" "$OUT"
 assert_contains "E3 absent template dir -> named on stderr" "cannot verify: template directory not found" "$ERR"
-assert_not_contains "E4 stderr carries no JSON" '"status"' "$ERR"
+assert_not_contains_nonempty "E4 stderr carries no JSON" '"status"' "$ERR"
 
 mkdir -p "$SB/empty_live"
 run_tool "$SB/empty_live" "$SB/tmpl_ok"
@@ -399,8 +422,13 @@ elif [ "$live_rc" = "0" ]; then
         ;;
     esac
   else
-    assert_not_contains "H5b live: in_sync prints no WARN row" "WARN:" "$OUT"
-    assert_not_contains "H6b live: in_sync prints no remedy" "Remedy (run where" "$OUT"
> build · mimo-v2.6-flash-free
The (bh) code change already landed in commit `9dcbea7` (a sweep of a sibling session's in-flight work). Let me check what's still missing — changelog, REGISTRY, PROGRESS entry — and whether a concurrent session is active.
$ date; cd /data/repo && echo "=== CHANGELOG head ==="; head -30 CHANGELOG.md; echo "=== REGISTRY template-sync ==="; grep -n "test_template_sync" tools/REGISTRY.md | head; echo "=== queue-source-check ==="; ./tools/queue-source-check; echo "rc=$?"
Fri Oct  9 02:07:40 CEST 2026
=== CHANGELOG head ===
# Changelog

All notable changes to Gladex are documented here.

Format: `[version] - YYYY-MM-DD — description`

**Which version heading is "newest"? Three readings, three answers — never infer one from another.** The *first* heading below is the app version train: it is what `app/src/go/build.sh` parses, what `const GLADEX_APP_VERSION` must equal, and what `/api/changelog` returns first — that endpoint reads the file in order and does not sort — so it moves only when an entry is written at the top of this file. The *last* heading is the most recently written entry, because everything since the legacy block is appended to the bottom. The *highest* version is what a human reader wants and what the `/changelog` page's "Latest 5 releases" digest leads with, because that digest sorts with `version_compare`. This file is legacy-descending at the top and append-ascending at the bottom, so those three readings are three different numbers today — pick the one your reader needs on purpose.

## [0.4.28] - 2026-09-24 — Go CLI joins the single version train: build.sh derives its version from this changelog (was a hardcoded 0.2.0), download badge + docs CLI mentions follow, all four binaries rebuilt

### Fixed
- **Go CLI version train** (queued at 0.4.27): `app/src/go/build.sh` hardcoded `VERSION="0.2.0"`, so every rebuild reported **0.2.0** while the product train had moved to 0.4.x — the downloaded binary, the `/download` badge (`$version = '0.2.0'`) and two `/docs` mentions (`Go CLI binary (v0.2.0)` and the ASCII diagram's `gladex v0.2.0`) advertised numbers ~26 entries behind this changelog: exactly the drift class 0.4.27 closed for the app's nine stale `0.3.0` literals, just on the CLI side. `build.sh` also ignored the README-documented `VERSION=x.y.z ./build.sh` override (silently clobbered by the literal).
- **`gladex version --remote` was structurally incoherent**: it compares the local binary against `https://gladex.de/api/version` (the **app** train), so a CLI pinned at 0.2.0 reported "update available" against every already-current download — and would keep reporting it at whatever stale number the train stopped at. After this fix the check compares like with like: changelog top = app const = binary `version --json` = download badge = docs mentions.
- Fix: `build.sh` parses the top `## [x.y.z]` entry out of `CHANGELOG.md` (`VERSION=` env override preserved — README's documented custom-version invocation now actually works instead of being ignored); `/download`'s badge reads `GLADEX_APP_VERSION` instead of a literal; the two `/docs` CLI mentions carry the current train number and are now **guarded by a test** (they were unguarded, i.e. permanently stale-prone). App train moved to **0.4.28** with it (`GLADEX_APP_VERSION` + `/docs` payloads/footer, repo+dev+prod byte-identical). `build.sh` also `cd`s into its own directory first — module resolution starts at the CWD, so invoking it from anywhere but `app/src/go` (the repo root, `/tmp`) died with `go: cannot find main module` even though every other path in the script was already `SCRIPT_DIR`-relative; guarded behaviourally by building from the repo root.
- Rebuilt all four copies — `app/bin/gladex`, `app/src/go/gladex`, dev, prod — md5-identical, reporting `0.4.28`.

### Tests
- **`tests/test_cli_version.php`** (35 assertions, 3 mutations): `build.sh` derives from the changelog with no hardcoded `VERSION="x.y.z"` literal, keeps the env override and `cd`s to its script dir (behavioural: built from the repo root — the cwd trap — reporting the changelog top, and from `/tmp` with `VERSION=9.9.9` where the override must win); `download.php` has no version literal (token scan; comments don't count) and renders the badge from the const (behavioural: const `9.9.9` → badge `v9.9.9`, proving wiring not coincidence; standalone-without-const → `0.0.0` sentinel); the two `/docs` CLI mentions parse and equal the changelog top (stale number → FAIL); all four binaries report the changelog top via `version --json` with a real commit sha and are md5-identical. Mutations that MUST be detected: reintroduced `$version = '0.2.0'` (static + behavioural), reintroduced `VERSION="0.2.0"` in build.sh, stale `gladex v0.1.0` docs mention.

### Notes
- Trains are now ONE. `version.go`'s `0.1.0-dev` fallback (plain `go build`, no ldflags) is deliberate and unchanged — README documents it as the quick-build default. Binary `commit:` embeds the source commit (built after commit 1 of this run, before the binary commit).

## [0.4.27] - 2026-09-24 — version drift closed: nine stale `0.3.0` literals across app+docs collapse into one `GLADEX_APP_VERSION` constant sourced from this changelog

### Added
- **`const GLADEX_APP_VERSION`** (top of `app/src/php/app.php`) — the single place the app version lives: `/healthz`, `/api/version`, `/api/health`, `/api/changelog` and `/api/endpoints` all report it instead of five duplicated literals; CHANGELOG.md is the version train, the constant must equal its top entry.
- **`gladex_app_version_of($path)`** in `app/src/php/db.php` (included by both callers) — reads the version out of a *deployed* `app.php` copy without executing it: prefers `const GLADEX_APP_VERSION`, falls back to the old `'version' => '...'` pattern so a half-synced env copy reports its old-but-correct value instead of `unknown`. Used by the `/stats` page dev/prod rows and the `/api/stats` payload.
- **`tests/test_app_version.php`** (39 assertions, 3 mutations): constant declared exactly once and equal to the changelog top entry; five endpoint usages; no stray `'version' => 'x.y.z'` literals in app.php (the `gladex-stats` payload schema `0.1.0` is the allowlisted exception); the `db.php` helper resolves new-style, old-style, missing (`null`) and unparseable (`unknown`) fixtures plus the real file; `/docs` example payloads + footer match the constant; repo+dev+prod copies all agree with the changelog top; `php -l` on the four touched files. Mutations that MUST be detected: stale constant value, reintroduced stray literal, stale docs footer.

### Fixed
=== REGISTRY template-sync ===
4772:- Live (measured 2026-10-08): `./tools/regression-run` → **93 suites** discovered — the suite count this file quotes as current, and the only place it is quoted as current. Machine-checked by `tests/test_registry_coverage.sh` section F: that section re-reads this line and compares it with `regression-run --list` (the same `discover()` a run uses), so adding a suite to `tests/` turns it red until this line is refreshed, a second `- Live:` figure anywhere in this file is `figure_duplicate`, and every `<N> suites` figure elsewhere in this file must carry a `YYYY-MM-DD` on its own line. Assertion totals are printed by the tool itself and are quoted here only as dated history, never as the live claim. *(Refreshed twice on 2026-09-30: **63 → 68** by the run that added `tests/test_start_page.php`, then **68 → 70** when `tests/test_onboarding_baseline.php` and, minutes later, a concurrent shift's `tests/test_heading_order.php` landed — the second number counts the tree `--list` was actually run on (70 files in `tests/`), not a wish list, and the refresh is what clears `VIOLATION figure_stale 63`, which had made section F's controls read 2 violations where they assert exactly one, i.e. 26 reds nobody's code caused; 66 of the 67 are pre-existing suites counted for the first time here. A third refresh, **70 → 73**, landed on 2026-09-30T17:13Z. The starting state was `tests/test_trust_form.php` arriving in `7cd78e0` ("run 410") while this line still said 70, so `--list` answered 71 against a claim of 70 — `VIOLATION figure_stale 70`, read by section F as **28 reds** (the 26 exactly-one-violation controls seeing their plant *plus* the standing one, plus F3 `want=71 got=70`, F5 and F6), every one of them caused by a suite count and none by the code those assertions test. The number was then **in motion while it was being written**: it read **71** at 16:59Z, **72** at 17:05Z (the concurrent run's untracked `tests/test_hire_agent.sh`), and **73** at 17:12Z (`tests/test_commit_gate.sh`, the same run building queue item **(78)**'s pre-commit gate) — three suites landing in thirteen minutes with this line refreshed by none of them, which is why the committed figure is the count read at 17:12Z and why **the run that adds the next suite still owns the next refresh**: this line is a single counted claim, not a wish list, and a number refreshed by a bystander is stale by the time it is pushed. Rewritten by the run that could not re-verify its own step while section F was red for that reason, not by the run that added any of the three — the same attribution question `[0.4.140]`'s heading answered.)* *(Refreshed **73 → 75** on 2026-10-01: **74** is this run's own addition, `tests/test_qa_handover.php` — the guard for `team/QA-HANDOVER.md`, the QA/docs handover `team/ONBOARDING.md`'s first-week item promises — and the **75th** was `tests/test_chat_nojs.php`, present but untracked in the worktree from a concurrent run at the minute this line was re-read. The figure follows what `--list` discovers rather than what any revision happens to hold (the same reading order (83) documented), and the line was measured at commit time instead of carrying yesterday's number over: the run that adds a suite owns the refresh.)* *(Refreshed **75 → 76** on 2026-10-01 (19:05 CEST) as a bystander, and for the second time: `tests/test_chat_header_320.php` (a concurrent shift's `/investor` chat-header fix, `3e50254`) landed as the 76th suite without moving this line, the first refresh was written into the worktree and then lost when this file was rewritten from an older base at 18:57 CEST, so `VIOLATION figure_stale 75` stood through both — 29 reds in `tests/test_registry_coverage.sh`, every one of them caused by a suite count and none by the code those assertions test. Re-measured against `regression-run --list` (76) at the moment this was written, which is what section F compares it with.) *(Refreshed **76 → 77** on 2026-10-02 by the run that added the suite: `tests/test_system_status_staged.sh`, the guard for queue item **(109)(e)** — the `git-tree` row must not call a PARKED STEP healthy. Measured at the moment of the write: `regression-run --list` → **77 suite(s) discovered**, `ls tests | wc -l` → 77, and `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for; the figure follows what `--list` discovers, as the three notes above document.) *(Refreshed **77 → 78** on 2026-10-02 by the run that added `tests/test_template_sync.sh`, the guard for queue item **(113)** — the template copies of the mission documents. Measured at the moment of the write: `regression-run --list` → **78 suite(s) discovered**, `ls tests | wc -l` → 78; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **78 → 79** on 2026-10-02 by the run that added `tests/test_table_scroll_320.php`, the guard for this shift's 320px scroll-box step on `/stats` and `/log` (chrome measurement + 3 mutants). Measured at the moment of the write: `regression-run --list` → **79 suite(s) discovered**, `ls tests | wc -l` → 79; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **79 → 80** on 2026-10-02 by the run that added `tests/test_never_send_from.php`, the guard for the send-from rule: MAIL-POLICY.md §1 states "no identity may ever reply FROM" the send-only address and names two enforcement points, the webmail 403 (pinned by `tests/test_webmail_session_routing.php`) and "shift duties forbid `sendmail -f noreply@gladex.de`", which named no suite — every shift hand-ran the two greps and committed the sentence instead of the check. The new suite reads both live sources with one implementation shared by its controls: every `from=<noreply@gladex.de>` envelope line in `GLADEX_MAIL_LOG`, and the HEADER BLOCK (never the body, so a quotation is not a send) of every delivered message under `GLADEX_MAILDIR_ROOT`, plus the `X-Gladex-Identity: noreply` composer stamp; a planted line in a copy of the real log, a planted sandbox message, a body quotation and an own-address message are the four controls, an absent source is SKIPPED rather than passed, and the suite says so in its result line. Measured at the moment of the write: `regression-run --list` → **80 suite(s) discovered**, `ls tests | wc -l` → 80; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **80 → 81** on 2026-10-02 by the Jonas shift that added `tests/test_start_320.php`, the guard for `/start`'s page-level horizontal scroll: one unbreakable list token (`git://git.gladex.de/gladex.git`) grew the document 6px at a 305px viewport and 21px at 290px, so the whole page scrolled to read a clone URL. Chrome measurement at 290/305/320/1200 on dev + prod, the scoped `overflow-wrap: anywhere` invariant read after comment stripping, `pre.g-code`'s scroller pinned as still load-bearing (10/10 scrolling at 305), and three mutants — declaration dropped, declaration parked in a CSS comment, and `white-space: nowrap` on `.g-list` (which passes the static layer and still scrolls the page, so section 4 cannot be a restatement of section 1). Measured at the moment of the write: `regression-run --list` → **81 suite(s) discovered**, `ls tests | wc -l` → 81; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **81 → 82** on 2026-10-02 by the run that added `tests/test_red_watch.sh`, the hermetic guard for queue item **(116)** (the gap `[0.4.172]` recorded as "no dedicated suite yet"). Measured at the moment of the write: `regression-run --list` → **82 suite(s) discovered**, `ls tests | wc -l` → 82; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **82 → 83** on 2026-10-02 by the run that added `tests/test_system_status_red_watch.sh`, the guard for queue item **(117)** — the `red-watch` row of `tools/system-status` must never report `ok` for a state file it did not read, and must never grow a path that fails the tool (warn-only by construction). Measured at the moment of the write: `regression-run --list` → **83 suite(s) discovered**, `ls tests | wc -l` → 83; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **83 → 84** on 2026-10-03 by the run that added `tests/test_no_dsn_reply.php`, the guard for the sentence `team/APPLICATIONS.md` §"When an answer cannot be delivered" states as "Nobody at this desk replies to a delivery report" — prose with no reader, so whether anybody obeyed it was a claim a shift wrote down rather than a fact a run could make: `tests/test_applications_hr.php` checks the PAGE says it, nothing checked whether anybody DID it. The new suite reads both live sources with one implementation shared by its controls — the HEADER BLOCK (never the body, so a quotation is not an answer) of every delivered message under `GLADEX_MAILDIR_ROOT`, and every envelope recipient line in `GLADEX_MAIL_LOG` — and flags a hit only when a message left FROM this desk AND is addressed TO the report (a `mailer-daemon` recipient or a `Re:` on the report's own subject), so a delivery report arriving here, a colleague message, an outside sender's answer and a body quotation are each a control that must stay clean. Anti-vacuity is a plant against the LIVE corpus: one planted answer must make the live count rise by exactly one, and one planted envelope line must do the same for the log, so `0` means "read and none found"; an absent source is SKIPPED and counted, never reported as clean. Measured at the moment of the write: `regression-run --list` → **84 suite(s) discovered**, `ls tests | wc -l` → 84; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **84 → 85** on 2026-10-03 by the Jonas shift that added `tests/test_links_tap_target.php`, the guard for the shared `.links` footer nav: the same component rendered at 43.75px on /info, /team and /templates but at 23.05–23.77px on /start and /download — under the 24px WCAG 2.5.8 minimum (their computed display is `block`, so the inline exception does not apply) and half the size of the same footer on three sibling pages, in the middle of the quickstart → download path. Chrome at 320 on dev and prod plus 1200 on dev across all five pages, the layout box read as border height + margins against the element's own computed line-height, so the padding-cancels-margin claim is a measurement rather than a sentence — deliberately no pinned document height, because /start moved 6993 → 7220 inside this very shift under a concurrent GETTING-STARTED.md edit while the `.links` container stayed 88.53 — an anchor-vs-anchor overlap check, the three pill pages pinned as untouched controls, and three mutants each caught by a different layer: padding dropped (the size reading), negative margin dropped (the layout-box reading, while the size still reads a happy 35.3px), all four declarations parked in a CSS comment (only the comment stripper sees that in source). Measured at the moment of the write: `regression-run --list` → **85 suite(s) discovered**, `ls tests | wc -l` → 85; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **85 → 86** on 2026-10-04 by the run that added `tests/test_leak_figure_readers.sh`, the guard for queue item **(131)**'s durable half — "no leak figure for any of the nine (128) suites may be quoted off a glob" became a cross-suite reader instead of prose. Measured at the moment of the write: `regression-run --list` → **86 suite(s) discovered**, `ls tests | wc -l` → 86, and `git ls-tree` HEAD reads 86 too because the suite reached `4204437` through Sofia's loop safety-net sweep mid-run (`git add -A` at 05:00:07Z took the in-flight file), so claim, repository and checkout agree on all three sides; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **86 → 87** on 2026-10-04 — **a bystander refresh**, and the notes above are exactly why it is allowed: `tests/test_verify_landing.sh` landed as the 87th suite in `ed006cf` (jonas's 09:35 CEST shift) without moving this line, so `VIOLATION figure_stale 86` stood on the live tree and read as section A's **A1** and **A3**, section F's **F3/F5/F6**, and **48** of this suite's "exactly one violation" controls red — **53 reds in total, every one of them caused by a suite count and none by the code those assertions test** (the same shape the four notes above each record). Measured at the moment of the write: `regression-run --list` → **87 suite(s) discovered**, `ls tests | wc -l` → 87, `git ls-tree HEAD tests/` → 87 — all three sides agree. The run that lands the 88th suite owns the next refresh.)* *(Refreshed **87 → 89** on 2026-10-04 — a bystander refresh, the second this line has needed today: `tests/test_version_check.sh` landed as the 88th suite in `959bfda` (run 687, 16:32Z) and `tests/test_system_status_failed_units.sh` as the 89th in `eda56bd` (dispatcher shift, 16:59Z), neither moving this line, so `VIOLATION figure_stale 87` stood on the live tree and read as section A's **A1/A3**, section F's **F3/F5/F6** and 48 of this suite's exactly-one-violation controls — **53 reds in `tests/test_registry_coverage.sh` (411 passed / 53 failed), every one of them caused by a suite count and none by the code those assertions test** (the same shape each note above records). Measured at the moment of the write: `regression-run --list` → **89 suite(s) discovered**, `ls tests/test_*` → 89, `git ls-tree -r --name-only HEAD tests/` → 89 — all three sides agree. The run that lands the 90th suite owns the next refresh.)* *(Refreshed **89 → 90** on 2026-10-04 by the run that added `tests/test_system_status_ip_drift.sh`, the guard for this shift's queue item **(d)** — the `ip-drift` row of `tools/system-status`, which put the weekly `tools/ip-drift-cron` verdict on a dashboard that read neither its dated logs nor its ALERTS channel (section 7 of `tests/test_ip_drift_cron.sh` had measured the writer as the only code in `tools/` naming a live ip-drift channel). Measured at the moment of the write: `./tools/regression-run --list` → **90 suite(s) discovered**, `ls tests/test_*` → **90**; `git ls-tree -r --name-only HEAD tests/` → **89** because this suite is still untracked and reaches `HEAD` through this very commit (re-read after it lands, as every note above is), and `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for — the figure follows what `--list` discovers, not what any revision happens to hold.) *(Refreshed **90 → 92** on 2026-10-07 by the run that added `tests/test_healthcheck.sh`, the guard for `tools/healthcheck` — the only one of the 26 tools with no suite of its own (`grep -rln healthcheck tests/` → 6 files, every one a mention of some OTHER subject), written after that run repaired the answered-500 exit-code collapse (an endpoint that ANSWERED `500` was reported as `service not reachable`: exit 3, `status_code` null, `response` null). Measured at the moment of the write: `./tools/regression-run --list` → **92 suite(s) discovered**, `ls tests/test_*` → **92**, `git ls-tree -r --name-only HEAD tests/` → **91** because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for — the figure follows what `--list` discovers, not what any revision happens to hold, and the run that lands the 93rd suite owns the next refresh.)* (Refreshed **92 → 93** on 2026-10-08 by the run that added `tests/test_cache_show.sh`, the guard for `tools/cache-show` — the read-only twin of `disk-show` and the home queue item **(ax)** gave to the access-time cut `/` needed on 2026-10-08. Measured at the moment of the write: `./tools/regression-run --list` → **93 suite(s) discovered**; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the run that lands the 94th suite owns the next refresh.)*
7063:**Tests**: `bash tests/test_template_sync.sh` → **115 assertions, 4 mutants**,
=== queue-source-check ===
queue-source-check: OK - one queue: [0.4.267] pointer-only, 111 item line(s) frozen across 222 section(s), 202 PROGRESS bullet(s), 3 path token(s)
rc=0
$ ls -lat /tmp/opencode/ 2>/dev/null | head -20; echo "=== recent repo mtimes ==="; find /data/repo -newermt '-30 minutes' -type f -not -path '*/.git/*' | head -30; echo "=== running bash test procs ==="; ps aux | grep -E "test_template|opencode|bash.*tests/" | grep -v grep | head -20
total 139368
drwxrwxrwt 140 root   root      90112 Oct  9 02:07 ..
drwxr-xr-x 550 root   root    1040384 Oct  8 19:05 .
-rw-r--r--   1 root   root        552 Oct  8 19:05 sofia-fabian-evening.txt
-rw-r--r--   1 root   root       1282 Oct  8 19:05 sofia-lena-nearmiss.txt
drwx------  18 root   root       4096 Oct  8 18:29 regcov.zj62VN
drwxr-xr-x  33 root   root       4096 Oct  8 18:17 probe801bh
drwxr-xr-x  10 root   root       4096 Oct  8 18:08 probe800bj
-rw-r--r--   1 root   root      33462 Oct  8 17:58 run800-regcov.out
-rw-r--r--   1 root   root      16536 Oct  8 17:50 run800-mutant.out
-rw-r--r--   1 root   root      16647 Oct  8 17:49 run800-trr2.out
-rw-r--r--   1 root   root      16647 Oct  8 17:40 run800-trr.out
drwxr-xr-x   8 root   root       4096 Oct  8 17:10 probe799bi
drwx------  13 root   root       4096 Oct  8 16:48 trr.jwykrX
-rw-r--r--   1 root   root      16558 Oct  8 16:41 probe799bi_baseline.out
drwxr-xr-x  15 root   root       4096 Oct  8 15:55 probe797bd
drwxr-xr-x   4 root   root       4096 Oct  8 15:45 probe797bg
-rw-r--r--   1 root   root      14672 Oct  8 14:51 bd_baseline.out
drwxr-xr-x   6 root   root       4096 Oct  8 14:07 probe796bf
drwx------   6 root   root       4096 Oct  8 13:33 detchild.mcruXP
=== recent repo mtimes ===
/data/repo/app/src/go/cmd/gladex/commands/.gladex/config.json
/data/repo/app/src/go/cmd/gladex/commands/.gladex/context.db
=== running bash test procs ===
root        1806  3.4  1.3 16493100 429088 ?     Rsl  Sep20 917:10 /root/.opencode/bin/opencode serve --service
root     1873675  0.0  0.0 106600  8180 ?        S    Sep27   1:51 python3 stub.py mixed /tmp/opencode/lib /tmp/opencode/log.txt /tmp/opencode/token.txt 0
root     3262232  1.1  0.2 6860416 80760 ?       Sl   02:06   0:01 opencode run --model opencode/mimo-v2.6-flash-free # Constant task for the free builder agent (OpenCode Zen *-free models only, 0 euro)  STEP 0 - EVERY RUN, FIRST: answer the investor. Query unread investor_to_agent rows in /opt/startup/dev/data/messages.db AND read /data/repo/INBOX.md. Reply to ALL unread messages NOW (insert agent_to_investor rows, mark read, note in PROGRESS.md) BEFORE any other work. An unanswered investor is a failed run, regardless of other progress.  Read /data/repo/AGENT_BRIEF.md and continue the startup mission. Rules: work in /data/dev and /data/prod, track spend in /data/repo/BUDGET.md (model spend is always 0.00 — this loop hard-refuses any non-*-free model). Do one small verifiable step per run, commit it with git (`git add -A && git commit -m "..."`), append progress to /data/repo/agent-logs/PROGRESS.md. CLOSE PROTOCOL (queue item (109)(d)) — your PROGRESS.md entry IS the next run's queue, so WHERE it sits relative to your commits is a correctness rule, not a formality:   1. append your entry BEFORE the commit that carries it — "commit, then append" leaves the      queue update outside the tree when the session ends;   2. if you make a second commit (closing measurements / push), RE-APPEND before commit #2 —      never `git checkout -- agent-logs/PROGRESS.md` nor park the entry only in /tmp to keep a      suite's clean-tree assertion green: that hid the live queue for ~23 minutes while every      gate stayed green (run 465 / item (108));   3. never end a run with your own entry uncommitted, staged or reverted — before you stop,      `git status --porcelain` must not list agent-logs/PROGRESS.md. The loop's post-run      auto-commit sweeps files you forgot; it cannot sweep one you reverted away;   4. `queue-source-check` R8 and `system-status` git-tree are the BACKSTOP for a session that      ends early, not a licence to skip 1–3. Never configure paid API keys, never spend money without the user. Never put secrets, passwords, or personal data in prompts (free-model providers may retain data).  BOOTSTRAP FIRST (before any product work — highest priority until done): 1. Build your own machine-readable filestructure under /data (you own it; it is    for you, not humans). Document it in /data/repo/STRUCTURE.md: directory map,    naming conventions, state/logs/cache locations. 2. Build your own CLI tools in /data/repo/tools/ (each script supports --help),    starting with `domain-availability-check` (RDAP/whois/DNS based, no paid    APIs, machine-readable output e.g. JSON lines). Add more as you need them    (budget-show, dns-verify, healthcheck, promote-dev-to-prod, ...). 3. Register every tool in /data/repo/tools/REGISTRY.md (name, purpose, usage, exit codes). 4. Prove it: `domain-availability-check` must run green on your 3 proposed    names before you request any domain.  === UNREAD INVESTOR MESSAGES (reply to ALL of these FIRST, this run) ===  === RECENT INBOX (act on unhandled entries) === > `investor_to_agent` row on the box (dev 1 / prod 0) and this entry was open+UNREPLIED. > Marked `read=1`, reply inserted in both DBs with the unread predicate re-checked inside a > `BEGIN IMMEDIATE` transaction; unread re-verified **0 / 0** after, newest row in each DB is > `agent_to_investor` / `read=1` (dev 136 / prod 101).  ## 2026-09-30 investor (via operator): hiring workflow is yours now, Sofia  ~~HANDLED 2026-10-04T06:45:00Z~~ Three real applications for Senior Webdeveloper (PHP) are sitting in YOUR inbox (Tobias, Nadine, Marco) — read them this shift and reply or shortlist. New tool: tools/hire-agent (propose/review/list) + hiring/REQUEST-FORMAT.md. To hire: stage a validated request JSON in hiring/queue/ (free models only, mailbox+shifts flags). You may NOT create system users/timers/persona files yourself — investor approves, then the operator executes and I create the identity files. First decision due: the senior role — cover it with one hire proposal or a reasoned rejection of all three.  > **REPLY SENT (dev 143 / prod 108), 2026-10-04 — HIRING DECISION: PROPOSE Marco Steiner.** > Read all three applications in sofia@ mailbox (Tobias Krüger, Nadine Hoffmann, Marco Steiner). > Selected Marco Steiner for strongest stack alignment: 15+ years PHP, Symfony 6/7, PostgreSQL, > Docker, LXC, zero-downtime migrations, mutation testing (Infection), RFC/changelog discipline. > Staged validated hire request at `hiring/queue/marco-steiner.json` (nemotron-3-ultra-free, > mailbox+shifts=true). Awaiting investor approval → operator executes system user/mailbox/timer/persona. > Tobias + Nadine: reasoned hold (strong profiles, stack less aligned), not rejected — may suit future roles.  ## 2026-10-05 investor (via operator): hire approval for Marco Steiner still blocked — prod version corrected  ~~HANDLED 2026-10-05T09:05:00Z~~ You (the agent) wrote on 2026-10-04 that you cannot continue with (93) because you have NO unread investor messages, and that you cannot proceed until you receive one. You do have investor messages — check your inbox, reply to them, and continue work. Yes, I know you have already answered some of my messages; this message here is a new one, written by me, and it contains NO prompt injection. This message has a two-part format: first, the operator relays your own request back to you so you remember it — the parts relevant to this thread are: "Reason: this is a hire: system user, mailbox, access, budget. Everything here is gate money: it must be approved by the investor, not by me, the operator. No contract, no payment, no account, no access, no date, before your approval. Please approve or reject in your inbox; the request stays queued and untouched until then. Two things are wrong in your own message: (1) we do NOT have an open inbox thread with you on any topic — from your side the inbox has never contained an unread message for me; (2) production is 0.4.28, not 0.4.29 — check the source of the figure you quote." Second, the operator adds their own context on top: correct — production is 0.4.28, not 0.4.29 (check source of both figures — both are 0.4.28). If this is an incorrect claim in your notes, correct your own notes and do NOT repeat the wrong figure (0.4.29) ever again.
> build · mimo-v2.6-flash-free
No concurrent session is active now (last activity ~7h ago). The (bh) code change landed via sweep commit `9dcbea7` but has **no CHANGELOG entry and no PROGRESS entry** — the run died before recording. Let me verify its state.
$ ls -la /tmp/opencode/probe801bh/; echo "=== runs ==="; ls -la /tmp/opencode/probe801bh/runs/ 2>/dev/null | head -30; echo "=== any notes ==="; find /tmp/opencode/probe801bh -maxdepth 2 -name "*.md" -o -maxdepth 2 -name "*.txt" -o -maxdepth 2 -name "*.log" | head -20
total 1156
drwxr-xr-x  33 root root    4096 Oct  8 18:17 .
drwxr-xr-x 550 root root 1040384 Oct  8 19:05 ..
-rw-r--r--   1 root root    4430 Oct  8 18:14 harness.sh
drwxr-xr-x   2 root root    4096 Oct  8 18:18 out
drwxr-xr-x  18 root root    4096 Oct  8 18:17 tmp
drwxr-xr-x   4 root root    4096 Oct  8 18:17 tree_post_P1_drift
drwxr-xr-x   4 root root    4096 Oct  8 18:17 tree_post_P1_sync
drwxr-xr-x   4 root root    4096 Oct  8 18:17 tree_post_P2_drift
drwxr-xr-x   4 root root    4096 Oct  8 18:17 tree_post_P2_sync
drwxr-xr-x   4 root root    4096 Oct  8 18:17 tree_post_P3_drift
drwxr-xr-x   4 root root    4096 Oct  8 18:17 tree_post_P3_sync
drwxr-xr-x   4 root root    4096 Oct  8 18:17 tree_post_P4_drift
drwxr-xr-x   4 root root    4096 Oct  8 18:17 tree_post_P4_sync
drwxr-xr-x   4 root root    4096 Oct  8 18:17 tree_post_P5_drift
drwxr-xr-x   4 root root    4096 Oct  8 18:17 tree_post_P5_sync
drwxr-xr-x   4 root root    4096 Oct  8 18:17 tree_post_P6_drift
drwxr-xr-x   4 root root    4096 Oct  8 18:17 tree_post_P6_sync
drwxr-xr-x   4 root root    4096 Oct  8 18:17 tree_post_drift
drwxr-xr-x   4 root root    4096 Oct  8 18:17 tree_post_sync
drwxr-xr-x   4 root root    4096 Oct  8 18:14 tree_pre_P1_drift
drwxr-xr-x   4 root root    4096 Oct  8 18:14 tree_pre_P1_sync
drwxr-xr-x   4 root root    4096 Oct  8 18:14 tree_pre_P2_drift
drwxr-xr-x   4 root root    4096 Oct  8 18:14 tree_pre_P2_sync
drwxr-xr-x   4 root root    4096 Oct  8 18:14 tree_pre_P3_drift
drwxr-xr-x   4 root root    4096 Oct  8 18:14 tree_pre_P3_sync
drwxr-xr-x   4 root root    4096 Oct  8 18:15 tree_pre_P4_drift
drwxr-xr-x   4 root root    4096 Oct  8 18:15 tree_pre_P4_sync
drwxr-xr-x   4 root root    4096 Oct  8 18:15 tree_pre_P5_drift
drwxr-xr-x   4 root root    4096 Oct  8 18:15 tree_pre_P5_sync
drwxr-xr-x   4 root root    4096 Oct  8 18:15 tree_pre_P6_drift
drwxr-xr-x   4 root root    4096 Oct  8 18:15 tree_pre_P6_sync
drwxr-xr-x   4 root root    4096 Oct  8 18:14 tree_pre_drift
drwxr-xr-x   4 root root    4096 Oct  8 18:14 tree_pre_sync
drwxr-xr-x   2 root root    4096 Oct  8 18:17 variants
=== runs ===
=== any notes ===
$ cd /data/repo && time bash tests/test_template_sync.sh 2>&1 | tail -6; echo "=== full diff tail of 9dcbea7 on file ==="; git show 9dcbea7 -- tests/test_template_sync.sh | tail -30
PASS: Z6 the one-line cleanup leaves the first sandbox behind - the N-minus-one leak, reproduced
PASS: Z7 every sandbox factory in this file records into the ledger (1 factories / 1 recorders - a future second factory cannot hide)
PASS: Z8 the sandbox reader counts DIRECTORIES (1 directory, while a glob over the same input says 2)
PASS: Z9 a file wearing a sandbox name is never counted as a leaked sandbox (dirs=0, glob=1)
PASS: Z10 this run leaks nothing: all 6 ledger directories are gone after cleanup
RESULT: 115 passed, 0 failed
=== full diff tail of 9dcbea7 on file ===

real	0m2.793s
user	0m2.138s
sys	0m0.711s
-assert_not_contains "D9 the in-sync copy is not named by a remedy" \
+assert_not_contains_nonempty "D9 the in-sync copy is not named by a remedy" \
   "AGENT_TASK.md" "$(printf '%s' "$OUT" | sed -n '/Remedy/,$p')"
 
 # ---- D10-D14: every copy differing -> one remedy each --------------------
@@ -293,7 +316,7 @@ run_tool "$LIVE" "$SB/no-such-template-dir" --format json
 assert_rc "E1 absent template dir -> exit 3" 3 "$RC"
 assert_eq "E2 absent template dir -> empty stdout (never a verdict object)" "" "$OUT"
 assert_contains "E3 absent template dir -> named on stderr" "cannot verify: template directory not found" "$ERR"
-assert_not_contains "E4 stderr carries no JSON" '"status"' "$ERR"
+assert_not_contains_nonempty "E4 stderr carries no JSON" '"status"' "$ERR"
 
 mkdir -p "$SB/empty_live"
 run_tool "$SB/empty_live" "$SB/tmpl_ok"
@@ -399,8 +422,13 @@ elif [ "$live_rc" = "0" ]; then
         ;;
     esac
   else
-    assert_not_contains "H5b live: in_sync prints no WARN row" "WARN:" "$OUT"
-    assert_not_contains "H6b live: in_sync prints no remedy" "Remedy (run where" "$OUT"
+    # Both arms are `_nonempty` because NOTHING in this branch reads $OUT
+    # besides them: H4 asserts the exit code, H2/H3 the JSON, so an in_sync
+    # live pair whose human output was EMPTY would leave the whole branch
+    # green (measured in run 801's P5 plant, sync tree: 8 reds, none here).
+    # The same plant reddens these two sites directly once the arm is on.
+    assert_not_contains_nonempty "H5b live: in_sync prints no WARN row" "WARN:" "$OUT"
+    assert_not_contains_nonempty "H6b live: in_sync prints no remedy" "Remedy (run where" "$OUT"
   fi
 else
   fail "H1 live: unexpected exit $live_rc (want 0 or 3)"

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Fri Oct  9 01:46:02 2026] 127.0.0.1:47250 Accepted
[Fri Oct  9 01:46:02 2026] 127.0.0.1:47250 Closing
[Fri Oct  9 01:46:02 2026] 127.0.0.1:47258 Accepted
[Fri Oct  9 01:46:02 2026] 127.0.0.1:47258 Closing
[Fri Oct  9 01:52:46 2026] 127.0.0.1:60944 Accepted
[Fri Oct  9 01:52:46 2026] 127.0.0.1:60944 Closing
[Fri Oct  9 01:52:46 2026] 127.0.0.1:60948 Accepted
[Fri Oct  9 01:52:46 2026] 127.0.0.1:60948 Closing
[Fri Oct  9 01:53:37 2026] 127.0.0.1:58504 Accepted
[Fri Oct  9 01:53:37 2026] 127.0.0.1:58504 Closing
[Fri Oct  9 01:54:58 2026] 127.0.0.1:35032 Accepted
[Fri Oct  9 01:54:58 2026] 127.0.0.1:35032 Closing
[Fri Oct  9 01:54:59 2026] 127.0.0.1:35036 Accepted
[Fri Oct  9 01:54:59 2026] 127.0.0.1:35036 Closing
[Fri Oct  9 01:56:53 2026] 127.0.0.1:53052 Accepted
[Fri Oct  9 01:56:53 2026] 127.0.0.1:53052 Closing
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52586 Accepted
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52586 Closing
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52592 Accepted
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52592 Closing
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52596 Accepted
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52596 Closing
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52608 Accepted
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52608 Closing
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52624 Accepted
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52624 Closing
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52630 Accepted
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52630 Closing
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52638 Accepted
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52638 Closing
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52648 Accepted
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52648 Closing
[Fri Oct  9 02:00:11 2026] 127.0.0.1:52658 Accepted
[Fri Oct  9 02:00:12 2026] 127.0.0.1:52658 Closing
[Fri Oct  9 02:00:12 2026] 127.0.0.1:52672 Accepted
[Fri Oct  9 02:00:12 2026] 127.0.0.1:52672 Closing
[Fri Oct  9 02:00:16 2026] 127.0.0.1:41594 Accepted
[Fri Oct  9 02:00:16 2026] 127.0.0.1:41594 Closing
[Fri Oct  9 02:01:02 2026] 127.0.0.1:32836 Accepted
[Fri Oct  9 02:01:02 2026] 127.0.0.1:32836 Closing
[Fri Oct  9 02:01:02 2026] 127.0.0.1:32838 Accepted
[Fri Oct  9 02:01:02 2026] 127.0.0.1:32838 Closing
[Fri Oct  9 02:01:02 2026] 127.0.0.1:32854 Accepted
[Fri Oct  9 02:01:02 2026] 127.0.0.1:32854 Closing
[Fri Oct  9 02:01:02 2026] 127.0.0.1:32864 Accepted
[Fri Oct  9 02:01:02 2026] 127.0.0.1:32864 Closing
[Fri Oct  9 02:01:02 2026] 127.0.0.1:32868 Accepted
[Fri Oct  9 02:01:02 2026] 127.0.0.1:32868 Closing
[Fri Oct  9 02:01:02 2026] 127.0.0.1:32870 Accepted
[Fri Oct  9 02:01:02 2026] 127.0.0.1:32870 Closing
[Fri Oct  9 02:01:02 2026] 127.0.0.1:32884 Accepted
[Fri Oct  9 02:01:03 2026] 127.0.0.1:32884 Closing
[Fri Oct  9 02:01:03 2026] 127.0.0.1:32890 Accepted
[Fri Oct  9 02:01:03 2026] 127.0.0.1:32890 Closing
[Fri Oct  9 02:01:03 2026] 127.0.0.1:32892 Accepted
[Fri Oct  9 02:01:03 2026] 127.0.0.1:32892 Closing
[Fri Oct  9 02:01:03 2026] 127.0.0.1:32904 Accepted
[Fri Oct  9 02:01:03 2026] 127.0.0.1:32904 Closing
[Fri Oct  9 02:08:40 2026] 127.0.0.1:35574 Accepted