Gladex Agent Logs

  FAIL A18 json channel says zero errors (kind=contains key=sysj want="errors":0)
  log=/data/agent-logs/red-watch-20261005.log
  alerts=/data/agent-logs/red-watch-ALERTS.log
red rc=0
=== Gladex System Status ===

  investor-app-dev          [OK] active
  investor-app-prod         [OK] active
  git-daemon                [OK] active
  apache2                   [OK] active
  certbot-renew             [OK] active
  watchdog                  [OK] active
  failed-units              [OK] 0 failed unit(s)
  healthz-dev               [OK] 200
  healthz-prod              [OK] 200
  download                  [OK] 200
  api-health                [OK] 200
  api-uptime                [OK] 200
  api-endpoints             [OK] 200
  api-changelog             [OK] 200
  api-stats                 [OK] 200
  page-info                 [OK] 200
  page-stats                [OK] 200
  page-team                 [OK] 200
  cloud                     [OK] nextcloud 200 installed=true; immich 200 pong; 5/5 containers up
  DNS:gladex.de             [OK] 77.90.15.49 on 1.1.1.1+8.8.8.8
  DNS:dev.gladex.de         [OK] 77.90.15.49 on 1.1.1.1+8.8.8.8
  DNS:git.gladex.de         [OK] 77.90.15.49 on 1.1.1.1+8.8.8.8
  DNS:info.gladex.de        [OK] 77.90.15.49 on 1.1.1.1+8.8.8.8
  DNS:stats.gladex.de       [OK] 77.90.15.49 on 1.1.1.1+8.8.8.8
  DNS:team.gladex.de        [OK] 77.90.15.49 on 1.1.1.1+8.8.8.8
  DNS:log.gladex.de         [OK] 77.90.15.49 on 1.1.1.1+8.8.8.8
  MX:gladex.de              [OK] 10 gladex.de. on 1.1.1.1+8.8.8.8
  SOA:gladex.de             [WARN] serial=2026092602 consistent on 1.1.1.1+8.8.8.8; mname=placeholder (NEEDS-INVESTOR open)
  ip-drift                  [OK] [2026-10-05T11:09:59Z] OK: No drift (egress matches DNS A record) (11h old)
  tls-cert-expiry           [OK] 77d left
  tls-cert-expiry-photos    [OK] 80d left
  investor-messages         [OK] 0 unread dev=0 prod=0
  investor-duty             [OK] owed=0 unread=0 unreplied=0 open=0
  git-tree                  [WARN] 3 uncommitted changes
  red-watch                 [WARN] red, failed=12, since 2026-10-05T22:01:47Z, 1m old; FAIL A3 tree clean AND in sync with origin/main (kind=is key=git) ;; FAIL A4 queue-source-check exits 0 (kind=rc key=qsc) ;; FAIL A5 queue has exactly one home (kind=contains key=qsc) ;; FAIL A6 newest CHANGELOG queue is pointer-only (kind=contains key=qsc) ;; FAIL A7 queue-source-check json exits 0 (kind=rc key=qscj) ;; FAIL A8 queue-source-check reports no violations (kind=contains key=qscj) ;; 
  queue-source              [FAIL] 1 violation(s): [0.4.225] is not named in agent-logs/PROGRESS.md - the newest CHANGELOG entry has no record in the authoritative file
  go-tests                  [OK] passing (worktree)
  go-compile                [OK] 45 module file(s) compile clean (1.839s) (commit 2ee9bef)
  promote-gates             [WARN] not promotable since 2026-10-04T15:00:25Z (1d 7h ago): verdict REFUSED: verdict VERDICT-20261004T150009-promote-footer-version-and-focus-visible.md is STALE (promoted source [app/src/php, examples/workflows] changed 91070s after it | dev-sync REFUSED: dev tree differs from the repo in 2 file(s): src/php/landing.php (differs), src/php/templates.php (differs) \u2014 this promotion copies REPO -> prod, so

Overall: 1 CHECK(S) FAILED
sys rc=1
> build · mimo-v2.6-flash-free
$ cd /data/repo && grep -n "err_ip → does not borrow the vanished-A diagnosis\|err_no_a → does not borrow the dead-lookup diagnosis\|err_dns → named arm diagnosis says the lookup never completed" tests/test_ip_drift_cron.sh; echo "---"; grep -n "run_mutation M1[78]" tests/test_ip_drift_cron.sh; wc -l agent-logs/PROGRESS.md; md5sum tests/test_ip_drift_cron.sh tools/REGISTRY.md CHANGELOG.md
405:assert_lacks "err_no_a → does not borrow the dead-lookup diagnosis" \
441:assert_has "err_dns → named arm diagnosis says the lookup never completed" \
474:assert_lacks "err_ip → does not borrow the vanished-A diagnosis" \
1640:    run_mutation M18 'err_dns → named arm diagnosis says the lookup never completed'
---
1639:    run_mutation M17 'err_dns → does not borrow the missing-egress diagnosis'
1640:    run_mutation M18 'err_dns → named arm diagnosis says the lookup never completed'
10944 agent-logs/PROGRESS.md
ab7e6d852fc7483d605c3a106243f081  tests/test_ip_drift_cron.sh
60216e7a17a36448348f2785cf45d00a  tools/REGISTRY.md
52835e7e307b5c231ce60efc73e829ee  CHANGELOG.md
> build · mimo-v2.6-flash-free
Appending the PROGRESS entry **before** commit #1 (CLOSE PROTOCOL rule 1).
$ cd /data/repo && cat >> agent-logs/PROGRESS.md <<'EOF'

## 2026-10-05 free-builder run (constant task) — **STEP 0 owed nothing** + **queue item (s) EXECUTED: M17/M18, the `case`-arm half — the two `exit 3` arms that had never borrowed, and the battery's first `case`-block exchange** — `tests/test_ip_drift_cron.sh --mutations` **348 → 356 passed / 0 failed, 18/18 mutants caught, 0 survived** — changelog **`[0.4.225]`**

**STEP 0 — read first, paid before anything else, and nothing was owed.** `SELECT count(*) FROM messages WHERE direction='investor_to_agent' AND read=0` → **0** on `/opt/startup/dev/data/messages.db` and **0** on `/opt/startup/prod/data/messages.db` (one table `messages`; the predicate is `direction=… AND read=0` — the earlier probe against a table named `investor_to_agent` returned `no such table`, so the schema was read before the count, not guessed); newest row in each DB is **ours** (dev **144** / prod **109**, `agent_to_investor`, `read=1`); `./tools/inbox-status` → **exit 0**, *"OK - nothing owed (0 unread, 0 open entries all replied)"*; `INBOX.md` → **80 entries, 80 handled, 0 open** (`grep '^## ' | grep -vc HANDLED` → **0**), read at run start. Both entries in the run's INBOX block are `~~HANDLED~~` from earlier runs (the Marco Steiner hire proposal, 2026-10-04, reply dev 143 / prod 108; the operator's production-version correction, 2026-10-05T09:05Z, reply dev 144 / prod 109), so **no row was written, no row was marked read, and `INBOX.md` was not touched** — measured, not assumed. The operator's correction is honoured in every figure below: **production is 0.4.28**, read from `tools/healthcheck` (dev and prod, HTTP 200 both); the `[0.4.29]` token in `CHANGELOG.md` is a 2026-09-24 *changelog heading* and is never quoted as a production claim.

**The queue read.** **(s)** — *"**M17** = the `dns_lookup_failed` arm quoting the `public_ip_unavailable` pair (`DIAGNOSIS="no public IPv4 could be determined (every echo service rejected)."` + `ACTION="check egress; no drift verdict can be trusted until this clears."` under `dns_lookup_failed)`), pinned to `err_dns → does not borrow the missing-egress diagnosis` (exists at `tests/test_ip_drift_cron.sh:447`); and **M18** = the `dns_lookup_failed` and `public_ip_unavailable` arms **exchanging their whole `DIAGNOSIS`/`ACTION` pair** over the contiguous `case` span (the `no_a_records` arm above and the `*)` default below both left alone — what keeps M18 from collapsing into M17 and from re-running M8), pinned to `err_dns → named arm diagnosis says the lookup never completed` (exists at `:441`; its twin `err_ip → named arm diagnosis says no public IPv4 could be found` at `:470` should redden too — an exchange reddens both directions, the asymmetry M14 measured). **Probe first, exactly as (o)/(p)/(q)/(r)** … **Then the teeth re-check** … and refresh `REGISTRY.md`'s figures **measured after the run** (348 → 356, 16/16 → 18/18 — arithmetic only after the run says it)"* — taken whole, both pins found where the queue said them (**:447** and **:441**; the `err_ip` twin **:470** verified too). `git status --porcelain` at this run's open → **clean**, `git rev-list --left-right --count origin/main...HEAD` → **0 0**. **(93)**/**(97)(a)** — fires the moment the investor **approves or rejects** `hiring/queue/*.json` (0 unread, i.e. waiting on a decision, not on silence). **(e)** hand-run only. **(k)** — `systemctl --failed --no-legend` → **empty** at this run's open (rc 0); `crontab -l` still carries its two standing lines (weekly `ip-drift-cron`, 15-min `red-watch`), read, never edited. The standing `SOA:gladex.de … mname=placeholder (NEEDS-INVESTOR open)` row is the investor's item, untouched. **(r)** DONE.

**The probe, run out of tree before a line of the block existed** (`/tmp/opencode/probe35/`, `build.py` reading `tools/ip-drift-cron` once and asserting the three named-arm `DIAGNOSIS="…"` bodies each occur **exactly once** before either needle was built — `no_a_records` 1, `dns_lookup_failed` 1, `public_ip_unavailable` 1, verified not assumed — nothing under `/data/repo` written): each needle counted **exactly once**, both copies `bash -n` clean and **`chmod +x`'d at build time**, control copy md5 **`2816126cb8bad48aabd03be621c2a60c`** byte-identical to the tool. Control **280 passed / 0 failed** under `IPDRIFT_NO_LIVE=1` (the env, not the tree), then:

```
M17 (dns_lookup_failed arm quotes the public_ip pair)  276 passed, 4 failed, rc 1
    FAIL - err_dns → does not borrow the missing-egress diagnosis (unexpected: no public IPv4 could be determined)
    FAIL - err_dns → named arm diagnosis says the lookup never completed (missing: … the lookup never completed …)
    (+ both action twins)
M18 (dns_lookup_failed <-> public_ip_unavailable exchange)  272 passed, 8 failed, rc 1
    FAIL - err_dns → named arm diagnosis says the lookup never completed (…)
    FAIL - err_ip  → named arm diagnosis says no public IPv4 could be found (missing: …)
    (+ the four action/absence twins: the err_dns and err_ip pairs in BOTH directions)
```

The queue's *"if either survives, that is a real hole"* is closed **before the dict entries existed**: **neither survives, and each lands on its own pin** — and M18's eight reds are the predicted both-directions reading, its `err_ip` twin reddening exactly as the queue said it should.

**What landed — four files, no code.** (1) **`M17`** dict entry (the whole label+`DIAGNOSIS`+`ACTION` triple substituted, its comment naming why **M8** does not cover it: M8 makes `no_a_records` the borrower, so `dns_lookup_failed`/`public_ip_unavailable` had *never* been the borrowing arm — and the `public_ip_unavailable` arm below left alone, what keeps M17 from collapsing into M8's rotated copy) + **`M18`** dict entry (the contiguous two-arm `case` span with only their `DIAGNOSIS=`/`ACTION=` pairs swapped; `no_a_records` above and `*)` below untouched — what keeps M18 from collapsing into M17 and from re-running M8), and their **two `run_mutation` calls** (`M17` → `err_dns → does not borrow the missing-egress diagnosis`, `M18` → `err_dns → named arm diagnosis says the lookup never completed`) pinned exactly as the queue specified; (2) **the battery header comment** extended with the fifth teeth reading and its `Re-measured across M1–M16: … (16/16)` line recounted **M1–M18 / 18/18**; (3) **`tools/REGISTRY.md`** — battery **M1–M16 → M1–M18**, **348 → 356** (the chain `… 340 → 348 with [0.4.224], and 348 → 356 with [0.4.225]`), **16/16 → 18/18**, M17/M18's defects, pins, probe numbers (276/4, 272/8, control 280/0, control md5 equal) and the fifth teeth reading; (4) **`CHANGELOG.md`** — `## [0.4.225]`, appended at the bottom per the file's append-ascending rule.

**The teeth, read a fifth time (the queue's "re-check the pin the same way").** In a fake tree (`/tmp/opencode/probe35/fake/`, `tests/` + `tools` copied so `REPO=` resolves there) **both** M17's and M18's pins were redirected to `no drift → nothing appended to ALERTS` — an assertion both defects leave green which still prints its own `ok - …` line (counted **once** in a clean run of that tree, which read **280 passed / 0 failed**, so the redirect tests the pin and not a duplicate) → **351 passed / 2 failed, rc 1**, both reds `M17 →/M18 → wrong verdict is NOT the intended one (expected a failure of: 'no drift → nothing appended to ALERTS')`. Total **361? no — 353** under `IPDRIFT_NO_LIVE=1` against **356** without it — the same 3-assertion env gap, re-measured rather than carried (the unmutated in-tree battery under the env was run separately: **353 passed / 0 failed, rc 0**, 18 pins landed).

**Verification (none carried from before the change).** `bash -n` → **OK** · `bash tests/test_ip_drift_cron.sh` → **283 passed / 0 failed** (a battery change adds nothing to the plain suite) · `bash tests/test_ip_drift_cron.sh --mutations` → **356 passed / 0 failed, rc 0**, **18** `run_mutation` calls counted (`grep -c "^    run_mutation M"` → **18**), **18/18 mutants caught, 0 survived** (each `wrong verdict lands on the intended assertion` line green; `suite stayed GREEN`/`precondition`/`does not parse` counts all **0**), read after the header-comment edit · `bash tests/test_registry_coverage.sh` → **464 / 0** (read *after* the `REGISTRY.md` edit) · `bash tests/test_queue_source.sh` → **278 / 0** · `bash tests/test_repo_lint.sh` → **473 / 0** · `bash tests/test_leak_figure_readers.sh` → **41 / 0** · `tools/repo-lint` → **exit 0**, `all 184 linted file(s) parse clean`, **229 changelog version heading(s) / 229 unique / 7116 citations / 0 missing** read at `HEAD` (`sha=2ee9beff95`), worktree `grep -c '^## \[' CHANGELOG.md` → **230 / 230 unique**, so `[0.4.225]` moves the committed figure **229 → 230** · `tools/queue-source-check` → **rc 1 with exactly one violation**, *"[0.4.225] is not named in agent-logs/PROGRESS.md"* — the detector working as designed on a CHANGELOG entry whose record did not exist yet, cleared by **this paragraph**, not by editing the detector · `./tools/healthcheck` → **exit 0**, dev **HEALTHY 200 `0.4.28`**, prod **HEALTHY 200 `0.4.28`** · `./tools/budget-show` → **5.00 / 0.00 / 5.00** (month 2026-10), spend this run **0.00** · census **90** suites / **26** tools, no suite or tool added or removed, so `- Live:` stays **90**.

**Dashboard read MID-RUN, every red named — all are this run's own deliberate half-finished state**: `tools/system-status` → **rc 1, `Overall: 1 CHECK(S) FAILED`**, `git-tree [WARN] 3 uncommitted changes`, `queue-source [FAIL] [0.4.225] …`, `red-watch [WARN] red, failed=12` (**A3** tree clean, **A4–A8** queue-source rc/violations, **A12/A13/A15–A18** its own system-status reads — every one downstream of those two) · `./tools/red-watch` → the same 12, `rc=0` · `bash tests/test_gladex_monitor.sh` → **18 passed / 12 failed** (the same A3/A4–A8/A12–A18 window). The two WARNs that are **not** this run's: `SOA:gladex.de … mname=placeholder (NEEDS-INVESTOR open)` (the investor's standing item) and the pre-existing `promote-gates` staleness (another desk's pending promotion — `dev tree differs from the repo in 2 file(s): src/php/landing.php, src/php/templates.php`, **not touched by this run**). Re-read after commit #1 in the closing memorandum below.

**Disclosures (shared tree, swept nothing).** `git status --porcelain` at write time lists exactly this run's four paths — `CHANGELOG.md`, `tests/test_ip_drift_cron.sh`, `tools/REGISTRY.md`, this entry — and nothing of another desk's; `origin/main...HEAD` → **0 0** at open. **`tools/ip-drift-cron` is byte-identical to its committed revision** (md5 **`2816126cb8bad48aabd03be621c2a60c`**, worktree and `git show HEAD:` read and equal) and `tools/system-status` likewise: **this run changed no code, only what proves it**, and **no `app/src/php` file was touched → no reviewer gate and no promote**: dev and prod both stay **0.4.28**. All probe artefacts — `build.py`, the M17/M18 mutants, the control/M17/M18/teeth/clean captures, the redirected-pin fake tree — live under `/tmp/opencode/probe35/` — **outside the repo, never committed**. **Zero DNS writes, no mail sent, no unit restarted, no `systemctl reset-failed`**, `crontab -l` untouched; spend **0.00** of the 5.00 October allowance, free `*-free` models only (`mimo-v2.6-flash-free`), no key configured, no secret or PII in any prompt, file or commit.

**Queue — next small step (read this first):**
**(t)** **M19/M20 — the last never-borrowed `case` arm and the second `case`-block exchange, over the two arms (s) left alone.** After (s), **M7** made the default arm borrow, **M8** made `no_a_records` borrow, **M17** made `dns_lookup_failed` borrow — so **`public_ip_unavailable` has still never been the borrowing arm** — and the only `case` exchange is (s)'s dns↔ip pair, so **`no_a_records` has never exchanged with anything** (every arm it touches today is a borrow: M8's no_a→dns_lookup). Add **M19** = the `public_ip_unavailable` arm quoting the `no_a_records` pair (`DIAGNOSIS="the DNS A record for ${DOMAIN} is GONE (query completed, no answer)."` + `ACTION="inspect the zone with 'pdns-api.py records'; do NOT rewrite DNS from here."` under `public_ip_unavailable)`), pinned to `err_ip → does not borrow the vanished-A diagnosis` (exists at `tests/test_ip_drift_cron.sh:474`) — a "no public IPv4" run then claims the A record is gone, answering the wrong question with the same confidence; and **M20** = the `no_a_records` and `dns_lookup_failed` arms **exchanging their whole `DIAGNOSIS`/`ACTION` pair** over the contiguous `case` span (the `public_ip_unavailable` arm below and the `*)` default below *that* both left alone — the choice that keeps M20 from collapsing into M19), pinned to `err_no_a → does not borrow the dead-lookup diagnosis` (exists at `:405`), with `err_dns → named arm diagnosis says the lookup never completed` (`:441`) reddening too: **the distinction from M8 is the untouched arm** — under M8 (a one-arm borrow) every `err_dns` assertion stays green, under M20 (an exchange) it reddens, which is exactly the borrow/exchange separation (s) applied to the other pair. **Probe first**, exactly as (o)/(p)/(q)/(r): build both needles against a copy of `tools/ip-drift-cron` in a fresh `/tmp/opencode/probe36/`, assert each occurs exactly once (the three named `DIAGNOSIS="…"` bodies each occur once today — verify, don't assume), `bash -n`, **`chmod +x` the copies**, replay through the suite under `IPDRIFT_NO_LIVE=1` (control **280/0**) and write the failing assertion down **before** touching the `M{}` dict; if either survives, that is a real hole, not a formatting nit. Then the teeth re-check (redirect both pins to an assertion neither reddens → expect a `351/2`-shaped pair of `wrong verdict is NOT the intended one` reds under the same env, totals **364** without it / **361** with it) and refresh `REGISTRY.md`'s figures **measured after the run** (356 → 364, 18/18 → 20/20 — arithmetic only after the run says it). Standing, not actioned: **(93)**/**(97)(a)** fires on the investor's approve/reject of `hiring/queue/*.json` (0 unread at this close), **(e)** hand-run only, **(k)** clear, the `SOA:gladex.de … mname=placeholder` row is the investor's NEEDS-INVESTOR item.

**CLOSE PROTOCOL**: this entry is appended **before** the commit that carries it (rule 1); a second commit carrying closing measurements re-appends this entry first (rule 2); commits are **path-limited to named paths** (never `git add -A`), and `git status --porcelain` must not list `agent-logs/PROGRESS.md` at stop (rule 3); nothing of mine is checked out or reverted.
EOF
echo "appended"; tail -3 agent-logs/PROGRESS.md | head -1; git status --porcelain
appended
**(t)** **M19/M20 — the last never-borrowed `case` arm and the second `case`-block exchange, over the two arms (s) left alone.** After (s), **M7** made the default arm borrow, **M8** made `no_a_records` borrow, **M17** made `dns_lookup_failed` borrow — so **`public_ip_unavailable` has still never been the borrowing arm** — and the only `case` exchange is (s)'s dns↔ip pair, so **`no_a_records` has never exchanged with anything** (every arm it touches today is a borrow: M8's no_a→dns_lookup). Add **M19** = the `public_ip_unavailable` arm quoting the `no_a_records` pair (`DIAGNOSIS="the DNS A record for ${DOMAIN} is GONE (query completed, no answer)."` + `ACTION="inspect the zone with 'pdns-api.py records'; do NOT rewrite DNS from here."` under `public_ip_unavailable)`), pinned to `err_ip → does not borrow the vanished-A diagnosis` (exists at `tests/test_ip_drift_cron.sh:474`) — a "no public IPv4" run then claims the A record is gone, answering the wrong question with the same confidence; and **M20** = the `no_a_records` and `dns_lookup_failed` arms **exchanging their whole `DIAGNOSIS`/`ACTION` pair** over the contiguous `case` span (the `public_ip_unavailable` arm below and the `*)` default below *that* both left alone — the choice that keeps M20 from collapsing into M19), pinned to `err_no_a → does not borrow the dead-lookup diagnosis` (exists at `:405`), with `err_dns → named arm diagnosis says the lookup never completed` (`:441`) reddening too: **the distinction from M8 is the untouched arm** — under M8 (a one-arm borrow) every `err_dns` assertion stays green, under M20 (an exchange) it reddens, which is exactly the borrow/exchange separation (s) applied to the other pair. **Probe first**, exactly as (o)/(p)/(q)/(r): build both needles against a copy of `tools/ip-drift-cron` in a fresh `/tmp/opencode/probe36/`, assert each occurs exactly once (the three named `DIAGNOSIS="…"` bodies each occur once today — verify, don't assume), `bash -n`, **`chmod +x` the copies**, replay through the suite under `IPDRIFT_NO_LIVE=1` (control **280/0**) and write the failing assertion down **before** touching the `M{}` dict; if either survives, that is a real hole, not a formatting nit. Then the teeth re-check (redirect both pins to an assertion neither reddens → expect a `351/2`-shaped pair of `wrong verdict is NOT the intended one` reds under the same env, totals **364** without it / **361** with it) and refresh `REGISTRY.md`'s figures **measured after the run** (356 → 364, 18/18 → 20/20 — arithmetic only after the run says it). Standing, not actioned: **(93)**/**(97)(a)** fires on the investor's approve/reject of `hiring/queue/*.json` (0 unread at this close), **(e)** hand-run only, **(k)** clear, the `SOA:gladex.de … mname=placeholder` row is the investor's NEEDS-INVESTOR item.
 M CHANGELOG.md
 M agent-logs/PROGRESS.md
 M tests/test_ip_drift_cron.sh
 M tools/REGISTRY.md
> build · mimo-v2.6-flash-free
Fixing a garbled figure in the teeth paragraph before commit.
← Edit repo/agent-logs/PROGRESS.md
Index: repo/agent-logs/PROGRESS.md
===================================================================
--- repo/agent-logs/PROGRESS.md
+++ repo/agent-logs/PROGRESS.md
@@ -10965,9 +10965,9 @@
 The queue's *"if either survives, that is a real hole"* is closed **before the dict entries existed**: **neither survives, and each lands on its own pin** — and M18's eight reds are the predicted both-directions reading, its `err_ip` twin reddening exactly as the queue said it should.
 
 **What landed — four files, no code.** (1) **`M17`** dict entry (the whole label+`DIAGNOSIS`+`ACTION` triple substituted, its comment naming why **M8** does not cover it: M8 makes `no_a_records` the borrower, so `dns_lookup_failed`/`public_ip_unavailable` had *never* been the borrowing arm — and the `public_ip_unavailable` arm below left alone, what keeps M17 from collapsing into M8's rotated copy) + **`M18`** dict entry (the contiguous two-arm `case` span with only their `DIAGNOSIS=`/`ACTION=` pairs swapped; `no_a_records` above and `*)` below untouched — what keeps M18 from collapsing into M17 and from re-running M8), and their **two `run_mutation` calls** (`M17` → `err_dns → does not borrow the missing-egress diagnosis`, `M18` → `err_dns → named arm diagnosis says the lookup never completed`) pinned exactly as the queue specified; (2) **the battery header comment** extended with the fifth teeth reading and its `Re-measured across M1–M16: … (16/16)` line recounted **M1–M18 / 18/18**; (3) **`tools/REGISTRY.md`** — battery **M1–M16 → M1–M18**, **348 → 356** (the chain `… 340 → 348 with [0.4.224], and 348 → 356 with [0.4.225]`), **16/16 → 18/18**, M17/M18's defects, pins, probe numbers (276/4, 272/8, control 280/0, control md5 equal) and the fifth teeth reading; (4) **`CHANGELOG.md`** — `## [0.4.225]`, appended at the bottom per the file's append-ascending rule.
 
-**The teeth, read a fifth time (the queue's "re-check the pin the same way").** In a fake tree (`/tmp/opencode/probe35/fake/`, `tests/` + `tools` copied so `REPO=` resolves there) **both** M17's and M18's pins were redirected to `no drift → nothing appended to ALERTS` — an assertion both defects leave green which still prints its own `ok - …` line (counted **once** in a clean run of that tree, which read **280 passed / 0 failed**, so the redirect tests the pin and not a duplicate) → **351 passed / 2 failed, rc 1**, both reds `M17 →/M18 → wrong verdict is NOT the intended one (expected a failure of: 'no drift → nothing appended to ALERTS')`. Total **361? no — 353** under `IPDRIFT_NO_LIVE=1` against **356** without it — the same 3-assertion env gap, re-measured rather than carried (the unmutated in-tree battery under the env was run separately: **353 passed / 0 failed, rc 0**, 18 pins landed).
+**The teeth, read a fifth time (the queue's "re-check the pin the same way").** In a fake tree (`/tmp/opencode/probe35/fake/`, `tests/` + `tools` copied so `REPO=` resolves there) **both** M17's and M18's pins were redirected to `no drift → nothing appended to ALERTS` — an assertion both defects leave green which still prints its own `ok - …` line (counted **once** in a clean run of that tree, which read **280 passed / 0 failed**, so the redirect tests the pin and not a duplicate) → **351 passed / 2 failed, rc 1**, both reds `M17 →/M18 → wrong verdict is NOT the intended one (expected a failure of: 'no drift → nothing appended to ALERTS')`. Total **353** under `IPDRIFT_NO_LIVE=1` against **356** without it — the same 3-assertion env gap, re-measured rather than carried (the unmutated in-tree battery under the env was run separately: **353 passed / 0 failed, rc 0**, 18 pins landed).
 
 **Verification (none carried from before the change).** `bash -n` → **OK** · `bash tests/test_ip_drift_cron.sh` → **283 passed / 0 failed** (a battery change adds nothing to the plain suite) · `bash tests/test_ip_drift_cron.sh --mutations` → **356 passed / 0 failed, rc 0**, **18** `run_mutation` calls counted (`grep -c "^    run_mutation M"` → **18**), **18/18 mutants caught, 0 survived** (each `wrong verdict lands on the intended assertion` line green; `suite stayed GREEN`/`precondition`/`does not parse` counts all **0**), read after the header-comment edit · `bash tests/test_registry_coverage.sh` → **464 / 0** (read *after* the `REGISTRY.md` edit) · `bash tests/test_queue_source.sh` → **278 / 0** · `bash tests/test_repo_lint.sh` → **473 / 0** · `bash tests/test_leak_figure_readers.sh` → **41 / 0** · `tools/repo-lint` → **exit 0**, `all 184 linted file(s) parse clean`, **229 changelog version heading(s) / 229 unique / 7116 citations / 0 missing** read at `HEAD` (`sha=2ee9beff95`), worktree `grep -c '^## \[' CHANGELOG.md` → **230 / 230 unique**, so `[0.4.225]` moves the committed figure **229 → 230** · `tools/queue-source-check` → **rc 1 with exactly one violation**, *"[0.4.225] is not named in agent-logs/PROGRESS.md"* — the detector working as designed on a CHANGELOG entry whose record did not exist yet, cleared by **this paragraph**, not by editing the detector · `./tools/healthcheck` → **exit 0**, dev **HEALTHY 200 `0.4.28`**, prod **HEALTHY 200 `0.4.28`** · `./tools/budget-show` → **5.00 / 0.00 / 5.00** (month 2026-10), spend this run **0.00** · census **90** suites / **26** tools, no suite or tool added or removed, so `- Live:` stays **90**.
 
 **Dashboard read MID-RUN, every red named — all are this run's own deliberate half-finished state**: `tools/system-status` → **rc 1, `Overall: 1 CHECK(S) FAILED`**, `git-tree [WARN] 3 uncommitted changes`, `queue-source [FAIL] [0.4.225] …`, `red-watch [WARN] red, failed=12` (**A3** tree clean, **A4–A8** queue-source rc/violations, **A12/A13/A15–A18** its own system-status reads — every one downstream of those two) · `./tools/red-watch` → the same 12, `rc=0` · `bash tests/test_gladex_monitor.sh` → **18 passed / 12 failed** (the same A3/A4–A8/A12–A18 window). The two WARNs that are **not** this run's: `SOA:gladex.de … mname=placeholder (NEEDS-INVESTOR open)` (the investor's standing item) and the pre-existing `promote-gates` staleness (another desk's pending promotion — `dev tree differs from the repo in 2 file(s): src/php/landing.php, src/php/templates.php`, **not touched by this run**). Re-read after commit #1 in the closing memorandum below.

> build · mimo-v2.6-flash-free
$ cd /data/repo && git add -- CHANGELOG.md tests/test_ip_drift_cron.sh tools/REGISTRY.md agent-logs/PROGRESS.md && git commit -q -m "[0.4.225] queue item (s): M17/M18 — the case-arm borrow and the battery's first case-block exchange (mutations 348 -> 356/0, 18/18 caught; probe 276/4 and 272/8 recorded before the dict entries existed, control 280/0 md5-equal) plus the teeth re-read a fifth time, 351/2 when both pins are redirected; PROGRESS entry appended before this commit" -- CHANGELOG.md tests/test_ip_drift_cron.sh tools/REGISTRY.md agent-logs/PROGRESS.md && git push origin main 2>&1 | tail -2; echo "push rc=$?"; git status --porcelain; git status -sb | head -1; git log --oneline -2
To git://git.gladex.de/gladex.git
   2ee9bef..b41d719  main -> main
push rc=0
## main...origin/main
b41d719 [0.4.225] queue item (s): M17/M18 — the case-arm borrow and the battery's first case-block exchange (mutations 348 -> 356/0, 18/18 caught; probe 276/4 and 272/8 recorded before the dict entries existed, control 280/0 md5-equal) plus the teeth re-read a fifth time, 351/2 when both pins are redirected; PROGRESS entry appended before this commit
2ee9bef [0.4.224] closing measurements for c5ae0a6 — suite 283/0 + mutations 348/0 (16/16) on committed bytes md5 0eee2def, monitor 30/30 A28 PASS, red-watch green, system-status ALL SYSTEMS HEALTHY git-tree clean, queue-source 0, repo-lint 229/229/7113, healthcheck 0.4.28 both, budget 5.00/0.00/5.00, STEP 0 0/0 both DBs, spend 0.00
> build · mimo-v2.6-flash-free
Commit #1 `b41d719` pushed, tree clean. Now the closing measurements on committed bytes.
$ cd /data/repo && tools/queue-source-check; echo "qsc rc=$?"; tools/repo-lint | tail -3; echo "rl rc=$?"; ./tools/regression-run --list | tail -2; ./tools/inbox-status; echo "in rc=$?"
queue-source-check: OK - one queue: [0.4.225] pointer-only, 111 item line(s) frozen across 180 section(s), 198 PROGRESS bullet(s), 1 path token(s)
qsc rc=0
  go-compile: 45 module file(s) compile clean (1.994s)
  changelog-version: 230 changelog version heading(s), 230 unique, 7129 citation(s) checked, 0 missing, 6955 bare token(s) counted
result: all 184 linted file(s) parse clean (exit 0)
rl rc=0
  test_webmail_session_routing.php
result: 90 suite(s) discovered, none run (exit 0)
inbox-status — STEP 0 investor duty

  messages unread : dev 0 / prod 0 / total 0
  last reply      : dev 144 / prod 109
  INBOX.md        : 80 entries, 80 handled, 0 open

verdict: OK - nothing owed (0 unread, 0 open entries all replied)
in rc=0
$ cd /data/repo && md5sum tests/test_ip_drift_cron.sh; git show HEAD:tests/test_ip_drift_cron.sh | md5sum; bash -n tests/test_ip_drift_cron.sh && echo "bash -n OK"; bash tests/test_ip_drift_cron.sh 2>&1 | tail -1; bash tests/test_ip_drift_cron.sh --mutations 2>&1 | tail -1; bash tests/test_ip_drift_cron.sh --mutations 2>&1 | grep -c "wrong verdict lands on the intended assertion"
ab7e6d852fc7483d605c3a106243f081  tests/test_ip_drift_cron.sh
ab7e6d852fc7483d605c3a106243f081  -
bash -n OK
=== Results: 283 passed, 0 failed ===
=== Results: 356 passed, 0 failed ===
18
> build · mimo-v2.6-flash-free
$ cd /data/repo && ./tools/system-status >/tmp/opencode/probe35/sys2.out 2>&1; echo "sys rc=$?"; grep -E "git-tree|queue-source|red-watch|investor|failed-units|Overall|SOA|promote-gates" /tmp/opencode/probe35/sys2.out; ./tools/healthcheck | grep -E "HEALTHY|version"; ./tools/budget-show | sed -n 2,5p; systemctl --failed --no-legend; echo "failed rc=$?"
sys rc=0
  investor-app-dev          [OK] active
  investor-app-prod         [OK] active
  failed-units              [OK] 0 failed unit(s)
  SOA:gladex.de             [WARN] serial=2026092602 consistent on 1.1.1.1+8.8.8.8; mname=placeholder (NEEDS-INVESTOR open)
  investor-messages         [OK] 0 unread dev=0 prod=0
  investor-duty             [OK] owed=0 unread=0 unreplied=0 open=0
  git-tree                  [OK] clean
  red-watch                 [WARN] red, failed=12, since 2026-10-05T22:01:47Z, 4m old; FAIL A3 tree clean AND in sync with origin/main (kind=is key=git) ;; FAIL A4 queue-source-check exits 0 (kind=rc key=qsc) ;; FAIL A5 queue has exactly one home (kind=contains key=qsc) ;; FAIL A6 newest CHANGELOG queue is pointer-only (kind=contains key=qsc) ;; FAIL A7 queue-source-check json exits 0 (kind=rc key=qscj) ;; FAIL A8 queue-source-check reports no violations (kind=contains key=qscj) ;; 
  queue-source              [OK] one queue: [0.4.225] pointer-only, 111 item line(s) frozen across 180 section(s), 198 PROGRESS bullet(s), 1 path token(s)
  promote-gates             [WARN] not promotable since 2026-10-04T15:00:25Z (1d 7h ago): verdict REFUSED: verdict VERDICT-20261004T150009-promote-footer-version-and-focus-visible.md is STALE (promoted source [app/src/php, examples/workflows] changed 91070s after it | dev-sync REFUSED: dev tree differs from the repo in 2 file(s): src/php/landing.php (differs), src/php/templates.php (differs) \u2014 this promotion copies REPO -> prod, so
Overall: ALL SYSTEMS HEALTHY
dev: HEALTHY
  Response: {"status":"ok","service":"gladex-investor-app","env":"dev","timestamp":1791238813,"version":"0.4.28"}
prod: HEALTHY
  Response: {"status":"ok","service":"gladex-investor-app","env":"prod","timestamp":1791238813,"version":"0.4.28"}
Month:       2026-10
Allowance:   5.00 €
Spent:       0.00 € (no October charge recorded anywhere — gladex.de renews at 1.50/mo, renewal date NOT on file, raised as NEEDS-INVESTOR in REPORT.md §14, so this figure may understate a known recurring cost)
Remaining:   5.00 €
failed rc=0
$ cd /data/repo && for t in test_registry_coverage test_queue_source test_repo_lint test_leak_figure_readers; do printf "%s: " "$t"; bash tests/$t.sh 2>&1 | grep -E "Results:|passed, [0-9]+ failed" | tail -1; done; echo "== monitor"; bash tests/test_gladex_monitor.sh 2>&1 | tail -3; echo "== red-watch"; ./tools/red-watch; echo "rc=$?"
test_registry_coverage: === Results: 464 passed, 0 failed ===
test_queue_source: queue-source-check suite: 278 passed, 0 failed
test_repo_lint: repo-lint suite: 473 passed, 0 failed
test_leak_figure_readers: leak-figure-readers suite: 41 passed, 0 failed
== monitor
passed: 30
failed: 0
summary: 30 assertions, 30 passed, 0 failed
== red-watch
red-watch: state=green monitor_exit=0 passed=30 failed=0 alert=RECOVERED
  log=/data/agent-logs/red-watch-20261005.log
  alerts=/data/agent-logs/red-watch-ALERTS.log
rc=0
> build · mimo-v2.6-flash-free

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Tue Oct  6 00:30:43 2026] 127.0.0.1:48920 Accepted
[Tue Oct  6 00:30:43 2026] 127.0.0.1:48920 Closing
[Tue Oct  6 00:30:43 2026] 127.0.0.1:48928 Accepted
[Tue Oct  6 00:30:43 2026] 127.0.0.1:48928 Closing
[Tue Oct  6 00:30:43 2026] 127.0.0.1:48940 Accepted
[Tue Oct  6 00:30:43 2026] 127.0.0.1:48940 Closing
[Tue Oct  6 00:30:43 2026] 127.0.0.1:48946 Accepted
[Tue Oct  6 00:30:43 2026] 127.0.0.1:48946 Closing
[Tue Oct  6 00:30:43 2026] 127.0.0.1:48954 Accepted
[Tue Oct  6 00:30:43 2026] 127.0.0.1:48954 Closing
[Tue Oct  6 00:30:43 2026] 127.0.0.1:48970 Accepted
[Tue Oct  6 00:30:44 2026] 127.0.0.1:48970 Closing
[Tue Oct  6 00:30:44 2026] 127.0.0.1:48980 Accepted
[Tue Oct  6 00:30:44 2026] 127.0.0.1:48980 Closing
[Tue Oct  6 00:30:44 2026] 127.0.0.1:48990 Accepted
[Tue Oct  6 00:30:44 2026] 127.0.0.1:48990 Closing
[Tue Oct  6 00:30:44 2026] 127.0.0.1:48996 Accepted
[Tue Oct  6 00:30:44 2026] 127.0.0.1:48996 Closing
[Tue Oct  6 00:31:00 2026] 127.0.0.1:51862 Accepted
[Tue Oct  6 00:31:00 2026] 127.0.0.1:51862 Closing
[Tue Oct  6 00:31:00 2026] 127.0.0.1:51870 Accepted
[Tue Oct  6 00:31:00 2026] 127.0.0.1:51870 Closing
[Tue Oct  6 00:31:00 2026] 127.0.0.1:51880 Accepted
[Tue Oct  6 00:31:00 2026] 127.0.0.1:51880 Closing
[Tue Oct  6 00:31:00 2026] 127.0.0.1:51884 Accepted
[Tue Oct  6 00:31:00 2026] 127.0.0.1:51884 Closing
[Tue Oct  6 00:31:00 2026] 127.0.0.1:51896 Accepted
[Tue Oct  6 00:31:00 2026] 127.0.0.1:51896 Closing
[Tue Oct  6 00:31:00 2026] 127.0.0.1:51910 Accepted
[Tue Oct  6 00:31:00 2026] 127.0.0.1:51910 Closing
[Tue Oct  6 00:31:00 2026] 127.0.0.1:51922 Accepted
[Tue Oct  6 00:31:01 2026] 127.0.0.1:51922 Closing
[Tue Oct  6 00:31:01 2026] 127.0.0.1:51926 Accepted
[Tue Oct  6 00:31:01 2026] 127.0.0.1:51926 Closing
[Tue Oct  6 00:31:01 2026] 127.0.0.1:51932 Accepted
[Tue Oct  6 00:31:01 2026] 127.0.0.1:51932 Closing
[Tue Oct  6 00:31:01 2026] 127.0.0.1:51942 Accepted
[Tue Oct  6 00:31:01 2026] 127.0.0.1:51942 Closing
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41904 Accepted
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41904 Closing
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41918 Accepted
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41918 Closing
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41928 Accepted
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41928 Closing
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41932 Accepted
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41932 Closing
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41946 Accepted
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41946 Closing
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41958 Accepted
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41958 Closing
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41964 Accepted
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41964 Closing
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41976 Accepted
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41976 Closing
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41980 Accepted
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41980 Closing
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41992 Accepted
[Tue Oct  6 00:31:39 2026] 127.0.0.1:41992 Closing
[Tue Oct  6 00:31:53 2026] 127.0.0.1:37264 Accepted