Gladex Agent Logs

20523:- **Queue — next small step (read this first):** **STEP 0 first every run** (today **0 unread dev / 0 prod**, `INBOX.md` **80/80/0**; table `messages`, column `direction`; last reply **dev 150 / prod 115**). **NEXT RUN'S OWN STEP, new this run and NOT mine to fix today: `loop-outcomes` went red — `streak=39 consecutive non-zero runs 2145..2183 (0 rate-limited), threshold=5, window 40`, the fourth `system-status` error and new since run 1007's `errors: 3`.** Read the loop run-logs (`GLADEX_RUNLOG_DIR` / the `run-*.log` directory `tools/system-status` names at line ~1171) and establish *why* the loop's own exit markers have been non-zero for 39 consecutive runs before touching anything: it is the loop's health, not this repo's, and a misread there would be as bad as the `+short` misread fixed today. **INCIDENT, OPEN and still the top non-gated item: the apex repoint awaits the investor's answer to dev 150 / prod 115** — until they answer, **do not touch the zone and do not re-derive the evidence** (`DOMAIN.md` `## INCIDENT 2026-10-24`); re-read the row's two branches: *(a)* deliberate → correct **REPORT §11 and §7**'s public URLs to `https://dev.gladex.de/…` and record the new owner of apex+mail; *(b)* not deliberate → `@ / www / mail → 77.90.15.49` (TTL 3600) **at the provider, by the investor/operator**, then both authoritative NS must answer `77.90.15.49` and port 25 must greet again. **The `dns-verify` SERVFAIL fix is DONE (`[0.4.373]`) and the `ip-drift-check` rcode fix is DONE THIS RUN — do not re-queue either.** **Also still open, unchanged:** the **mia/aylin repin** (folded into dev 150 — do **not** send a fifth standalone row; edit only the two `MODEL=` lines in `/usr/local/sbin/identity-run.sh` when an answer arrives, watching `failed-units-classify` go `class_a=2 → 0`); the **coverage** human act (`--record` green-only, human; `fall: 1`, `baseline-stale 5`); the **log-truncation** standing WARN stays unreopened; run 952's **(i)** only on a measured future-dated marker and **(iii)** only on a measured A12 misread; **(93)**/**(97)(a)** first if the investor answers `hiring/queue/*.json` (**2 proposals**); **(2'')**, **§14 renewal** cadence, **LAN-only A/B/C**, **SOA MNAME**, **Pip's mail-policy D1–D4** and the **`77.90.15.49` PTR** stay NEEDS-INVESTOR; **`jsonl-rotate` built but unscheduled**; the **git-author fix** operator-owned / investor-nod; **V7b/V10b/V13b** in the figure reader remain the concurrent-repin and no-DNS-egress reds (V13b now `want=152 got=150`, the documented §9 gap). The figure-reader fallback stays **EXHAUSTED** (17/18 read), the `- Live:` line stays **125** (no suite added), and **V14b**, the §14 prune ask, the Class-B follow-up and §10 #6's dated re-read stay **discharged**.
20548:- **Queue — next small step (read this first):** **STEP 0 first every run** (today **0 unread dev / 0 prod**, `INBOX.md` **80/80/0**; table `messages`, column `direction`; last reply **dev 150 / prod 115**). **NEXT RUN'S OWN STEP, new this run: fix the in-flight echo defect in `loop-outcomes`** — a run log whose **last line** merely *looks like* `exit=<n>` (a transcript that `cat`s another log, as this run did at 02:10) is counted as a completed run and produced a transient false `streak=1 … 2185`; make the loop write a marker a transcript cannot forge (e.g. `agent-loop-exit=<n>` as the last line of `/data/agent-loop.sh`'s run, **accepted alongside the legacy `exit=`** so all **2,652** historical logs still read), keep the in-flight/stale rules exactly as they are, and pin it in `tests/test_system_status_failed_units.sh` §16 with a fixture whose transcript **ends in an echoed `exit=1`** — one tool + the loop script, one suite, **no promote**; read the loop's own log-writing code and the running instance's semantics before touching `agent-loop.sh`. **INCIDENT, OPEN and still the top non-gated item: the apex repoint awaits the investor's answer to dev 150 / prod 115** — until they answer, **do not touch the zone and do not re-derive the evidence** (`DOMAIN.md` `## INCIDENT 2026-10-24`); re-read the row's two branches: *(a)* deliberate → correct **REPORT §11 and §7**'s public URLs to `https://dev.gladex.de/…` and record the new owner of apex+mail; *(b)* not deliberate → `@ / www / mail → 77.90.15.49` (TTL 3600) **at the provider, by the investor/operator**, then both authoritative NS must answer `77.90.15.49` and port 25 must greet again. **The `dns-verify` rcode fix (`[0.4.373]`), the `ip-drift-check` rcode fix (`[0.4.374]`) and this run's `loop-outcomes` needle fix (`[0.4.375]`) are DONE — do not re-queue any of them.** **Also still open, unchanged:** the **mia/aylin repin** (folded into dev 150 — do **not** send a fifth standalone row; edit only the two `MODEL=` lines in `/usr/local/sbin/identity-run.sh` when an answer arrives, watching `failed-units-classify` go `class_a=2 → 0`); the **coverage** human act (`--record` green-only, human; `fall: 1`, `baseline-stale 5`); the **log-truncation** standing WARN stays unreopened; run 952's **(i)** only on a measured future-dated marker and **(iii)** only on a measured A12 misread; **(93)**/**(97)(a)** first if the investor answers `hiring/queue/*.json` (**2 proposals**); **(2'')**, **§14 renewal** cadence, **LAN-only A/B/C**, **SOA MNAME**, **Pip's mail-policy D1–D4** and the **`77.90.15.49` PTR** stay NEEDS-INVESTOR; **`jsonl-rotate` built but unscheduled**; the **git-author fix** operator-owned / investor-nod; **V7b/V10b/V13b** in the figure reader remain the concurrent-repin and no-DNS-egress reds. The figure-reader fallback stays **EXHAUSTED** (17/18 read), the `- Live:` line stays **125** (no suite added — this run extended an existing one), and **V14b**, the §14 prune ask, the Class-B follow-up and §10 #6's dated re-read stay **discharged**.
===
20548
20551 /data/repo/agent-logs/PROGRESS.md
===
11167:## [0.4.371] - 2026-10-17 — `failed-units-classify` stops printing "(no failed units)" behind a cold catalog: a CANNOT-VERIFY refusal now lists the units it saw as Class C, so the guard can no longer hide a real outage behind a comforting blank
11185:## [0.4.372] - 2026-10-24 — `system-status`'s `download` row stops writing the counter it reports: the dashboard's own probe is a HEAD now (it had been the source of 3,002 of prod's 3,018 counter lines = 99.5 %), `check_endpoint` grows a METHOD argument where an unknown method is a red row that issues NO request, and the counter's suite pins both halves with an argv-recording curl stub + a neutered-`-I` mutant (85 → 106 assertions)
11206:## [0.4.373] - 2026-10-25 — `dns-verify` stops calling a SERVFAIL "no records": dig is now asked WITHOUT `+short` (which prints nothing on a server failure — measured: empty stdout, rc 0, while the raw query said `status: SERVFAIL, ANSWER: 0`), so the header's rcode decides the verdict — only NOERROR/NXDOMAIN complete a query (exit 3); SERVFAIL/REFUSED/NOTIMP/… are exit 4 with `status: <RCODE>` in `errors` (suite 40 → 64 assertions, +M3 rcode-classifier and +M4 structural-comment-filter mutants)
11225:## [0.4.374] - 2026-10-26 — `ip-drift-check` stops reading a SERVFAIL as "a query completed and the answer was empty": dig is now asked WITHOUT `+short` (the header is what carries the rcode), so `dns_lookup_failed` and `no_a_records` separate on `status: NOERROR|NXDOMAIN` instead of on rc 0 (suite 134 → 150 assertions on this box, registry figure 136 → 152, +2 mutants M7/M8)
11244:## [0.4.375] - 2026-10-26 — `loop-outcomes` stops hiding the CAUSE of a failure streak: the rate-limited count now matches the provider's CURRENT refusal (`Free usage limit reached`) as well as the 2026-10-11 wording (`Rate limit exceeded`), through one helper — measured on the 39-run streak 2145..2183, which was 39/39 the new wording and 0/39 the old (suite 369 → 399 assertions, +1 mutant M10)
===
78824f1 docs: run 1009 close-correction — post-push readings on 95bf1fd
95bf1fd fix/tools: loop-outcomes counts BOTH provider refusals (Free usage limit reached too) — the 39-run streak was 39/39 the current wording and 0/39 the legacy needle, which printed (0 rate-limited) [0.4.375]
82ae58a docs: run 1008 close-correction — post-push readings on b9a9566
b9a9566 fix/tools: ip-drift-check asks dig WITHOUT +short and classifies on the header rcode — a SERVFAIL is dns_lookup_failed, never no_a_records [0.4.374]
fbfcdca identity sofia shift 2026-10-25T17:56Z model=opencode/nemotron-3-ultra-free
> build · mimo-v2.6-flash-free
$ git -C /data/repo status --porcelain; echo "RC=$?"; echo ===; sed -n '20525,20551p' /data/repo/agent-logs/PROGRESS.md
RC=0
===
- **Close-state:** this entry is appended **before** the commit that carries it (CLOSE PROTOCOL rule 1) and is never `git checkout --`-ed, staged-only or parked in `/tmp` (rules 2–3); the stop-state check is `git status --porcelain` **not listing `agent-logs/PROGRESS.md`** after the commit. This run makes **one content commit** (five paths, explicit pathspec) and pushes; **if** a second commit follows (post-push re-reads), this entry's close-correction bullet is **re-appended before commit #2** (rule 2). No app version moved — the served version stays **`0.4.28`** (quoted nowhere as 0.4.29). Spend **0.00**, free `*-free` models only.
- **Close-correction — post-push re-reads on the pushed tree; the run stops here with a clean tree.** Commit #1 → **`b9a9566`**, staged by **explicit pathspec** after `git status --porcelain` was read in the same breath and showed **exactly the five intended paths** (`CHANGELOG.md`, `agent-logs/PROGRESS.md`, `tests/test_ip_drift_check.sh`, `tools/REGISTRY.md`, `tools/ip-drift-check`); `git status --porcelain` was **empty immediately after the commit**, i.e. this file was committed, not parked (CLOSE PROTOCOL rule 3). Push **`78260d7..b9a9566`** → **rc 0**, no force, no lease override; `git rev-list --left-right --count main...origin/main` → **`0 0`**; `git ls-remote origin refs/heads/main` → **`b9a9566`**. Post-push, every reading taken on the pushed tree: `./tools/inbox-status` → **rc 0, "OK - nothing owed (0 unread, 0 open entries all replied)"**, `INBOX.md` **80/80/0**, last reply **dev 150 / prod 115** (STEP 0 re-paid at the close, **no `agent_to_investor` row written and nothing marked read**) · `./tools/version-check` → **OK dev=0.4.28 prod=0.4.28 (match)** · `./tools/healthcheck` → **dev + prod HEALTHY, HTTP 200, both `"version":"0.4.28"`** · `./tools/source-sync-check --env both` → **in sync, 48 file(s) across 2 env(s), rc 0** → **no promote exists to take** · `./tools/queue-source-check` → **rc 0, one queue `[0.4.374]` pointer-only, 111 item line(s) across 328 section(s), 203 PROGRESS bullet(s)** — R8 clear on this run's own heading after the push · `./tools/repo-lint` → **rc 0, `all 236 linted file(s) parse clean`, 379 changelog version headings / 379 unique / 10,342 citations / 0 missing / 12,989 bare tokens** — the pre-commit bullet's **379 / 379 / 0 missing** prediction confirmed (it was 378 pre-commit because the tool reads HEAD blobs; citations +11 = this entry's own path tokens, discharged by `0 missing`) · `./tools/red-watch` → **`state=red passed=26 failed=2`, `alert=RED-SET`** — **A3 and A15 cleared with the push** (they were this run's own dirty tree), leaving the standing **A12 + A30**, A12's detail `checks in error: failed-units,loop-outcomes,DNS:gladex.de,ip-drift` · `./tools/system-status --format json` → **`overall: error`, `errors: 4`** = `failed-units` (7), **`loop-outcomes` (the NEW row, `streak=39 … threshold=5`)**, `DNS:gladex.de` (incident), `ip-drift` (22h old no-egress CHECK-ERROR) · suites re-run **on the pushed tree**: `bash tests/test_ip_drift_check.sh` → **150 passed / 0 failed**, `bash tests/test_dig_tools_transport.sh` → **80 passed / 0 failed** (file unmodified, M1–M4 pins re-verified). Commit #2 stages **`agent-logs/PROGRESS.md` by explicit pathspec only**, and the stop-state after it is `git status --porcelain` **not listing `agent-logs/PROGRESS.md`**. No app version moved (**0.4.28**, quoted nowhere as 0.4.29), no `systemctl` change, no messages-DB write, no DNS/zone write, no mail, no API key, spend **0.00**, free `*-free` models only.

## Builder — run 1009 — small verifiable step: **the queue's own question answered and closed as a reporting defect — `loop-outcomes` counted 39 red runs and printed `(0 rate-limited)` because its needle was the 2026-10-11 wording while every one of those 39 logs carried the provider's CURRENT wording `Free usage limit reached` (measured 39/39 vs 0/39)**, so the rate-limited count now matches **either** refusal through one helper `lo_rate_limited` (one grep, two `-e` needles, both call sites), live proof `1 ok / 38 red, 1 in-flight` → `1 ok / 38 red, **38 rate-limited**, 1 in-flight`; suite `tests/test_system_status_failed_units.sh` **369 → 399 passed / 0 failed** with §16k (three shapes) and mutant **M10** reproducing the pre-fix `(0 rate-limited)`; the streak itself is **provider-side, not ours**, loop self-recovered at run 2184; CHANGELOG **`[0.4.375]`**; dev+prod **0.4.28**, spend **0.00**

- **STEP 0, paid first — owed nothing.** `SELECT COUNT(*) FROM messages WHERE direction='investor_to_agent' AND read=0` → **0 dev / 0 prod** (table `messages`, column `direction`); `./tools/inbox-status` → **rc 0, "OK - nothing owed (0 unread, 0 open entries all replied)"**, `INBOX.md` **80/80/0** (both brief entries — 2026-09-30 hiring, 2026-10-05 prod-version correction — already ~~HANDLED~~), last reply **dev 150 / prod 115**; **no `agent_to_investor` row written** (nothing owed; the apex incident's row is still unread and awaiting the investor, the mia/aylin repin still folded into dev 150 — **no fifth standalone row**). **Production is 0.4.28**: `./tools/version-check` → **OK dev=0.4.28 prod=0.4.28 (match)**, `./tools/healthcheck` → **dev + prod HEALTHY, HTTP 200, both `"version":"0.4.28"`**, `0.4.29` quoted nowhere; `./tools/budget-show` → 2026-10, allowance **5.00 / spent 0.00 / remaining 5.00**; `./tools/source-sync-check --env both` → **in sync, 48 file(s) across 2 env(s), rc 0** → **no promote exists to take**.

- **Why this step: it is the exact line run 1008 queued — *establish WHY the loop's own exit markers were non-zero for 39 consecutive runs before touching anything*.** Answer, counted log by log over run 1008's own range rather than sampled: **`run-*.log` ids 2145..2183 = 39 logs, 39/39 contain `Error: Free usage limit reached. Free models work in OpenCode (https://opencode.ai); subscribe to OpenCode Go to keep going: …`, 0/39 contain `Rate limit exceeded`, 39/39 end `exit=1`** — window **2026-10-25 18:23:17+01:00 → 2026-10-26 00:50:51+01:00** (one run per ~10 min, ~6 h 28 m), every header `model=opencode/mimo-v2.6-flash-free`, and the loop **recovered by itself**: run **2184** (01:01:03, same model) `exit=0`, this run **2185** in flight. So the streak was a **provider-side free-usage limit, not a defect in this repo**, and no `systemctl`/timer/loop file needed touching — which is what the queue demanded before any edit.

- **The defect this row then had, and the fix.** The row tallies rate-limited runs with `grep -qF "Rate limit exceeded"` — the wording of the 2026-10-11 incident it was built on — and the provider stopped using that wording: **0/39 of those logs match it**, so the detail printed `streak=39 … (**0 rate-limited**)`, right about the streak and silent about the one fact the next reader needs (the same class as the two `+short` fixes in `[0.4.373]`/`[0.4.374]`: a tool that reads the wrong signal and returns a confident number). Fix = **one helper, two needles**: `lo_rate_limited()` holds `grep -qF -e "Rate limit exceeded" -e "Free usage limit reached" -- "$1"` and **both** call sites (the completed-`exit=N` branch and the markerless branch) call it, so the list cannot drift between them and the suite's mutant can pin it at a single point (needle asserted to occur **exactly once**). Nothing else moved: streak arithmetic, thresholds, the in-flight exclusion, `ERRORS++`, the sanitiser and both renderers are byte-for-byte untouched — the needle changes the *cause count*, never a verdict. Help text and the row's own source comment now name both wordings with the 39/39 measurement behind them.

- **Live proof, same box, same window, both directions**: **pre-fix** (the `HEAD` blob carries zero occurrences of the new wording) → `loop-outcomes` **`ok`, `run 2184 exit=0, streak=0, window 40: 1 ok / 38 red, 1 in-flight`** with no rate-limited count at all; **post-fix** → **`ok, run 2184 exit=0, streak=0, window 40: 1 ok / 38 red, 38 rate-limited, 1 in-flight`**. `system-status --format json` still **`overall: error, errors: 3`** in both — unchanged rows: `failed-units` (7), `DNS:gladex.de` (the apex incident), `ip-drift` (23 h old `public_ip_unavailable`, the no-egress class).

- **A SECOND defect found while working this one: QUEUED, NOT FIXED, and the evidence is exact.** The row takes a log's **last line** as its verdict, so an **in-flight** run whose transcript happens to end with an `exit=N` line is counted as a COMPLETED run. Measured **2026-10-26 02:10** on the live box: this run's own first `system-status` reported **`streak=1 consecutive non-zero runs 2185 (0 rate-limited)`** — 2185 is *this* run, then in flight, and the `exit=1` sitting on its last line was **the transcript echoing other logs** (`cat run-20261025-182317-2145.log` prints that log's `exit=1`; the in-flight log also holds three such lines at 417/421/425 and an `exit=0` at 617, all echoes). Minutes later the identical read was **`run 2184 exit=0, streak=0, … 1 in-flight`** — i.e. a transient false streak that can reach monitor A12 and red-watch's ALERT. The fix belongs to the loop's own marker shape (a token a transcript cannot forge, e.g. an `agent-loop-exit=` prefix, with the legacy `exit=` still accepted for the **2,652** historical logs) and **`/data/agent-loop.sh` is not to be edited blind mid-run** — so it is queued below, not folded into this run's step.

- **Tests: `bash tests/test_system_status_failed_units.sh` → 399 passed / 0 failed (was 369).** `plant_run` grew a third refusal mode printing the provider's **verbatim current wording**, copied out of run 2145's own log, beside the legacy one; new **§16k** pins it in three shapes — five free-usage reds → `error` + `5 rate-limited` **plus a dedicated assertion that the detail is never `(0 rate-limited)` when every red carried a refusal**; the same five with a trailing `exit=0` → the `ok` line still names `5 red, 5 rate-limited`; a mixed window of both wordings → `5 rate-limited` (the needle is a list, not a string swap). **Mutant M10** collapses the helper to the legacy needle alone (count = 1) and is caught four ways: the real tool counts 5 on those same bytes, the mutant reproduces the pre-fix `(0 rate-limited)`, **both still read `error`** (verdict unmoved — surgical about what it does *not* change), and the legacy fixture still counts 5 through the mutant (the 2026-10-11 path stays green). M8/M9 re-verified.

- **PROCESS ORDERING, RE-MEASURED THIS RUN (run 1005's note is a correctness rule, not a formality).** The readings batch was run **before** this entry existed and came back red in three suites — `test_system_status_dns` **47/2** ("healthy run exits 0 (got 1)"), `test_system_status_go_tests` **91/1** ("live: tool exits 0 (got 1)"), `test_system_status_investor_duty` **42/8** — each reproduced sequentially, and **not** caused by the tool edit: the tool diff is exactly help-text + comment + helper + two call sites, and the `HEAD` blob run against the same worktree gave dns **49/0** and go_tests **92/0**. The one extra error was read directly out of a hand-built "clean baseline": **`error queue-source :: 1 violation(s): [0.4.375] is not named in agent-logs/PROGRESS.md`** — a CHANGELOG heading with no record in the authoritative file, i.e. **this entry had not been appended yet**. After the append those suites are re-run and recorded in the close-correction bullet below.

- **Registry and changelog moved with the code.** `tools/REGISTRY.md` `## system-status` gained a **`- Loop outcomes:`** bullet (the row was documented nowhere in the registry): last-line verdict rule, the in-flight exclusion, the three verdicts and their hooks, and the **two-sided needle with the 39/39 vs 0/39 measurement and its `[0.4.375]` citation**, plus the suite figure **399 assertions / 0 failed measured 2026-10-26, 369 before §16k**. **CHANGELOG `[0.4.375]`** appended at the bottom (tool behaviour + assertions moved → a heading is owed), so queue-source R8's newest is **`[0.4.375]`** and **this entry names it**.

- **Scope and safety, one line each:** the commit carries **exactly five paths — `tools/system-status`, `tests/test_system_status_failed_units.sh`, `tools/REGISTRY.md`, `CHANGELOG.md` — plus `agent-logs/PROGRESS.md` (this entry)**, staged by **explicit pathspec** read from `git status --porcelain` immediately before staging, **never `git add -A`** on this shared index · **no `app/`, `src/`, `dev/`, `prod/` file touched** → **no promote needed and none was taken**, dev and prod untouched at **0.4.28**, and a CHANGELOG heading **IS** added (`[0.4.375]`) exactly as queue-source R8's pointer exists for · **`/data/agent-loop.sh` NOT edited** (the queued marker fix belongs to the loop, mid-run) · **no `systemctl` change of any kind** — the 7 failed units were read, never touched · **no live messages-DB write** (STEP 0 owed nothing) · **the DNS path stayed read-only** (`tools/pdns-api.py` never invoked, the zone untouched, the apex incident stays with the investor) · no `rm`, `hiring/queue/` read-only (**2 proposals `status=proposed`**), no mail, no paid API, no API key configured, **never `git stash`**. Spend **0.00**, free `*-free` models only.

- **Queue — next small step (read this first):** **STEP 0 first every run** (today **0 unread dev / 0 prod**, `INBOX.md` **80/80/0**; table `messages`, column `direction`; last reply **dev 150 / prod 115**). **NEXT RUN'S OWN STEP, new this run: fix the in-flight echo defect in `loop-outcomes`** — a run log whose **last line** merely *looks like* `exit=<n>` (a transcript that `cat`s another log, as this run did at 02:10) is counted as a completed run and produced a transient false `streak=1 … 2185`; make the loop write a marker a transcript cannot forge (e.g. `agent-loop-exit=<n>` as the last line of `/data/agent-loop.sh`'s run, **accepted alongside the legacy `exit=`** so all **2,652** historical logs still read), keep the in-flight/stale rules exactly as they are, and pin it in `tests/test_system_status_failed_units.sh` §16 with a fixture whose transcript **ends in an echoed `exit=1`** — one tool + the loop script, one suite, **no promote**; read the loop's own log-writing code and the running instance's semantics before touching `agent-loop.sh`. **INCIDENT, OPEN and still the top non-gated item: the apex repoint awaits the investor's answer to dev 150 / prod 115** — until they answer, **do not touch the zone and do not re-derive the evidence** (`DOMAIN.md` `## INCIDENT 2026-10-24`); re-read the row's two branches: *(a)* deliberate → correct **REPORT §11 and §7**'s public URLs to `https://dev.gladex.de/…` and record the new owner of apex+mail; *(b)* not deliberate → `@ / www / mail → 77.90.15.49` (TTL 3600) **at the provider, by the investor/operator**, then both authoritative NS must answer `77.90.15.49` and port 25 must greet again. **The `dns-verify` rcode fix (`[0.4.373]`), the `ip-drift-check` rcode fix (`[0.4.374]`) and this run's `loop-outcomes` needle fix (`[0.4.375]`) are DONE — do not re-queue any of them.** **Also still open, unchanged:** the **mia/aylin repin** (folded into dev 150 — do **not** send a fifth standalone row; edit only the two `MODEL=` lines in `/usr/local/sbin/identity-run.sh` when an answer arrives, watching `failed-units-classify` go `class_a=2 → 0`); the **coverage** human act (`--record` green-only, human; `fall: 1`, `baseline-stale 5`); the **log-truncation** standing WARN stays unreopened; run 952's **(i)** only on a measured future-dated marker and **(iii)** only on a measured A12 misread; **(93)**/**(97)(a)** first if the investor answers `hiring/queue/*.json` (**2 proposals**); **(2'')**, **§14 renewal** cadence, **LAN-only A/B/C**, **SOA MNAME**, **Pip's mail-policy D1–D4** and the **`77.90.15.49` PTR** stay NEEDS-INVESTOR; **`jsonl-rotate` built but unscheduled**; the **git-author fix** operator-owned / investor-nod; **V7b/V10b/V13b** in the figure reader remain the concurrent-repin and no-DNS-egress reds. The figure-reader fallback stays **EXHAUSTED** (17/18 read), the `- Live:` line stays **125** (no suite added — this run extended an existing one), and **V14b**, the §14 prune ask, the Class-B follow-up and §10 #6's dated re-read stay **discharged**.

- **Close-state:** this entry is appended **before** the commit that carries it (CLOSE PROTOCOL rule 1) and is never `git checkout --`-ed, staged-only or parked in `/tmp` (rules 2–3); the stop-state check is `git status --porcelain` **not listing `agent-logs/PROGRESS.md`** after the commit. This run makes **one content commit** (five paths, explicit pathspec) and pushes; **if** a second commit follows (post-push re-reads), this entry's close-correction bullet is **re-appended before commit #2** (rule 2). No app version moved — the served version stays **`0.4.28`** (quoted nowhere as 0.4.29). Spend **0.00**, free `*-free` models only.
- **Close-correction — post-push re-reads on the pushed tree; the run stops here with a clean tree.** Commit #1 → **`95bf1fd`**, staged by **explicit pathspec** after `git status --porcelain` was read in the same breath and showed **exactly the five intended paths** (`CHANGELOG.md`, `agent-logs/PROGRESS.md`, `tests/test_system_status_failed_units.sh`, `tools/REGISTRY.md`, `tools/system-status`); `git status --porcelain` was **empty immediately after the commit**, i.e. this file was committed, not parked (CLOSE PROTOCOL rule 3). Push **`82ae58a..95bf1fd`** → **rc 0**, no force, no lease override; `git rev-list --left-right --count main...origin/main` → **`0 0`**; `git ls-remote origin refs/heads/main` → **`95bf1fd4fb39344796b38f598f4d7c59c19a1c53`**. Post-push, every reading taken on the pushed tree: `./tools/inbox-status` → **rc 0, "OK - nothing owed (0 unread, 0 open entries all replied)"**, `INBOX.md` **80/80/0**, last reply **dev 150 / prod 115** (STEP 0 re-paid at the close, **no `agent_to_investor` row written and nothing marked read**) · `./tools/version-check` → **OK dev=0.4.28 prod=0.4.28 (match)** · `./tools/healthcheck` → **dev + prod HEALTHY, HTTP 200, both `"version":"0.4.28"`** · `./tools/source-sync-check --env both` → **in sync, 48 file(s) across 2 env(s), rc 0** → **no promote exists to take** · `./tools/queue-source-check` → **rc 0, one queue `[0.4.375]` pointer-only, 111 item line(s) frozen across 329 section(s), 203 PROGRESS bullet(s), 2 path token(s)** — R8 clear **on this run's own heading, after the push** · `./tools/repo-lint` → **rc 0, `all 236 linted file(s) parse clean`, **380** changelog version headings / **380** unique / 10,357 citations / **0 missing** / 13,005 bare tokens** — the pre-commit bullet's **380 / 380 / 0 missing** prediction confirmed (it was **379** pre-commit because the tool reads HEAD blobs; citations 10,343 → 10,357 = this entry's own path tokens, discharged by `0 missing`) · `./tools/red-watch` → **`state=red passed=26 failed=2`** — **A3 and A15 cleared with the push** (they were this run's own dirty tree), leaving the standing **A12 + A30**, A12's detail `checks in error: failed-units,DNS:gladex.de,ip-drift` unchanged · `./tools/system-status --format json` → **`overall: error`, `errors: 3`** = `failed-units` (7), `DNS:gladex.de` (the apex incident), `ip-drift` (24 h old no-egress CHECK-ERROR) — and the row this run fixed: **`loop-outcomes ok, run 2184 exit=0, streak=0, window 40: 1 ok / 38 red, **38 rate-limited**, 1 in-flight`**, the count that read `(0 rate-limited)` before · `./tools/failed-units-classify` → first call **CANNOT-VERIFY** (`opencode models` returned an EMPTY catalog, rc 0 with no model ids) and re-run warm → **PERSISTENT, catalog 69, `class_a=2`** (aylin `muse-spark-1.3-contributor-free` ABSENT, mia `ling-3.1-flash-free` ABSENT) and **`class_b=5`** (nemotron-3-ultra-free still listed → provider-side) — no movement since run 1008 · the six stub-baseline suites **re-run after the entry and green**: `test_system_status_dns` **49 / 0**, `test_system_status_go_tests` **92 / 0**, `test_system_status_investor_duty` **50 / 0**, `test_system_status_mx_soa` **31 / 0**, `test_system_status_mx_soa_transport` **76 / 0**, `test_system_status_tls_expiry` **60 / 0** (the pre-append 47/2, 91/1, 42/8, 28/3, 73/3, 48/12 were **the `queue-source` row reading `[0.4.375]` with no PROGRESS record**, measured and named above — never this diff) · `bash tests/test_registry_coverage.sh` → **497 / 0** · `bash tests/test_registry_figure_readers.sh` → **41 passed / 3 failed** = the standing **V7b** (`want=45 got=44`, concurrent sofia repin), **V10b** (`want=340 got=338`, live arm, no DNS egress) and **V13b** (`want=152 got=150`, the documented §9 gap) — **none this change's** · `bash tests/test_system_status_staged.sh` → **57 / 0**, `bash tests/test_system_status_red_watch.sh` → **150 / 0**, `bash tests/test_monitor_cascade.sh` → **49 / 0**, `bash tests/test_cross_reader_agreement.sh` → **64 / 0**, and on the pushed tree `bash tests/test_system_status_failed_units.sh` → **399 passed / 0 failed**. Commit #2 stages **`agent-logs/PROGRESS.md` by explicit pathspec only**, and the stop-state after it is `git status --porcelain` **not listing `agent-logs/PROGRESS.md`**. No app version moved (**0.4.28**, quoted nowhere as 0.4.29), no `systemctl` change, no messages-DB write, no DNS/zone write, no mail, no API key, no `agent-loop.sh` edit, spend **0.00**, free `*-free` models only.
> build · mimo-v2.6-flash-free
Working tree is clean and the queue bullet matches this run's step exactly. Now the critical safety check: **which other suites plant run logs** (my reader change could affect them):
$ sed -n '1191,1216p' /data/repo/tests/test_system_status_failed_units.sh; echo ===16j===; sed -n '1450,1465p' /data/repo/tests/test_system_status_failed_units.sh; echo ===16f===; sed -n '1408,1450p' /data/repo/tests/test_system_status_failed_units.sh
echo "=== 16. loop-outcomes [0.4.310]: the agent loop's own exit markers, and the streak a mtime guard cannot see ==="
# Queue item (4)'s measured harm, and the only question this row answers: the
# loop failed 37 consecutive runs (988..1024, 2026-10-11 19:52 -> 2026-10-12
# 01:58), every log ending `exit=1`, six hours with zero commits and zero
# replies, while agent-loop-watchdog read "loop fresh" 25x — it only asks
# whether a log was TOUCHED in 45 min, and the wrapper writes the header
# before opencode runs, so a run that dies in one line still looks fresh.
# The pins that matter:
#   a. the ok line names the newest COMPLETED run's own measured exit=0;
#   b. one red run is a warning, not a dead loop (errors 0, exit 0);
#   c. streak >= threshold is an ERROR (errors >= 1, overall error, exit 1)
#      and the detail names the streak, its run range and the rate-limited
#      count — a rate-limited run is never printed as work done;
#   d. a recovered loop reads ok, with the window's reds still named;
#   e. the in-flight run (newest log, no exit marker, fresh) is EXCLUDED —
#      it cannot pad a streak to the threshold;
#   f/g. nothing measured is never ok: no logs at all, and a sandboxed run
#      (stub systemctl, no hook) that must NOT read the live directory;
#   h. a green about the past is a warning: the newest log older than the
#      stale bound downgrades ok;
#   i. a markerless log that is NOT the newest, or is the newest and STALE,
#      is a run that died mid-way: it counts as non-zero, named as such.
#   k. the provider's CURRENT refusal wording (`Free usage limit reached`, the
#      2026-10-25 streak 2145..2183: 39/39 logs, 0/39 carrying the legacy
#      needle) counts as rate-limited in every shape the row prints it, and
#      both wordings count inside one window - the needle is a list.
===16j===
esac

echo "--- 16j. the help text must describe the row that exists ---"
HELP=$("$TOOL" --help 2>/dev/null)
for tok in "loop-outcomes verdicts" "queue item (4)" "GLADEX_RUNLOG_STREAK"; do
    printf '%s' "$HELP" | grep -qF "$tok" \
        && ok "16j help: documents '$tok'" \
        || bad "16j help: documents '$tok'"
done

echo "--- 16k. the provider's CURRENT refusal is rate-limited too: the 39-run streak must not read '(0 rate-limited)' ---"
# Measured 2026-10-26 on the live box: streak runs 2145..2183 (39 logs) all
# end `exit=1` with `Free usage limit reached` as their only content, and 0/39
# carry the legacy `Rate limit exceeded` needle - so the row named the streak
# and hid its cause. Two shapes, both wordings:
LK="$SANDBOX/runlogs-k"
===16f===
echo "--- 16f. nothing measured is never ok: a directory with no run logs ---"
LF="$SANDBOX/runlogs-f"
mkdir -p "$LF"
lexpect "16f-empty" "$LF" "warning" "cannot verify: no run-*.log" "0" "ok" "0"

echo "--- 16g. a sandboxed run (no hook, stub systemctl) must NOT read the live directory ---"
OUT=$(env PATH="$STUB:$PATH" GLADEX_REPO_DIR="$REPOF" \
      GLADEX_DEV_DB="$SANDBOX/no.db" GLADEX_PROD_DB="$SANDBOX/no.db" \
      GLADEX_GO_BIN="$STUB/go" GLADEX_GO_TIMEOUT=3 \
      GLADEX_REDWATCH_STATE="$SANDBOX/no-red-watch-state" \
      "$TOOL" --format json 2>/dev/null || true)
case "$(lstatus_of "$OUT")" in
    warning) ok "16g-sandbox: row warns in a sandboxed run" ;;
    *)       bad "16g-sandbox: row should warn in a sandboxed run (got '$(lstatus_of "$OUT")')" ;;
esac
case "$(ldetail_of "$OUT")" in
    *"sandboxed run"*) ok "16g-sandbox: the detail says the live directory was NOT read" ;;
    *)                 bad "16g-sandbox: the detail should say the live dir was not read (got '$(ldetail_of "$OUT")')" ;;
esac

echo "--- 16h. a green about the past is a warning: the newest log past the stale bound ---"
LH="$SANDBOX/runlogs-h"
plant_run "$LH" 1 0
plant_run "$LH" 2 0
touch -d '2 hours ago' "$LH"/run-*.log
lexpect "16h-stale" "$LH" "warning" "stale: newest run log" "0" "ok" "0"
OUT=$(loop_run "$LH")
case "$(ldetail_of "$OUT")" in
    *"green about the past"*) ok "16h-stale: the detail says what kind of green it is" ;;
    *)                        bad "16h-stale: the detail should say 'green about the past' (got '$(ldetail_of "$OUT")')" ;;
esac

echo "--- 16i. a markerless log that is not fresh is a run that DIED, not one that lives ---"
LI="$SANDBOX/runlogs-i"
plant_run "$LI" 1 0
plant_run "$LI" 2        # no marker, and stale below: died mid-run
touch -d '2 hours ago' "$LI"/run-20261012-000002-2.log
lexpect "16i-dead-midrun" "$LI" "warning" "streak=1 consecutive non-zero runs 2" "0" "ok" "0"
OUT=$(loop_run "$LI")
case "$(ldetail_of "$OUT")" in
    *"without exit marker"*) ok "16i-dead-midrun: the dead run is named as such" ;;
    *)                       bad "16i-dead-midrun: the dead run should be named (got '$(ldetail_of "$OUT")')" ;;
esac
$ grep -rln "GLADEX_RUNLOG_DIR" /data/repo/tests/ | sort; echo ===; grep -rn "run-2026\|exit=0\\\\n\|printf 'exit=" /data/repo/tests/ --include='*.sh' -l | sort
/data/repo/tests/test_cross_reader_agreement.sh
/data/repo/tests/test_system_status_failed_units.sh
===
/data/repo/tests/test_system_status_failed_units.sh
> build · mimo-v2.6-flash-free
`test_cross_reader_agreement.sh` also consumes this row — I must check its fixtures before changing the reader:
$ grep -n "GLADEX_RUNLOG_DIR\|run-2026\|exit=\|plant\|loop-outcomes" /data/repo/tests/test_cross_reader_agreement.sh | head -50
44:#   MUTANTS: four plants (two per reader) each reddened by its OWN agreement
249:        GLADEX_RUNLOG_DIR="$SANDBOX/runlogs" GLADEX_RUNLOG_WINDOW=3 \
439:    GLADEX_CLOUD_DOCKER_BIN="$SANDBOX/no-docker" GLADEX_RUNLOG_DIR="$SANDBOX/runlogs" \
494:echo "=== M. mutants: each plant reddens its OWN agreement assertion ==="
495:# plant <src> <old> <new> <dst> — applies exactly once or refuses to plant.
496:plant() {
510:# A plant only COUNTS as caught when the planted copy still runs: a copy that
526:plant "$RW_TOOL" 'fall_n = counts.get("unexplained") if counts else None' \
528:    && ok "M1 plant applies exactly once" || bad "M1 plant applies exactly once"
533:    bad "M1 (red-watch count ignored) is CAUGHT by the agreement (the planted copy did not run)"
540:plant "$RW_TOOL" 'v.get("state") == "unexplained-fall"' \
542:    && ok "M2 plant applies exactly once" || bad "M2 plant applies exactly once"
546:    bad "M2 (red-watch ids re-derived) is CAUGHT by the agreement (the planted copy did not run)"
553:plant "$SS_BIN" 'v.get("state") == "unexplained-fall"' \
555:    && ok "M3 plant applies exactly once" || bad "M3 plant applies exactly once"
558:    bad "M3 (row ids re-derived) is CAUGHT by the agreement (the planted copy did not run: '$SS_L')"
565:plant "$SS_BIN" 'verdict_rc = rc in (0, 1)' 'verdict_rc = rc in (0, 1, 3)' \
567:    && ok "M4 plant applies exactly once" || bad "M4 plant applies exactly once"
570:    bad "M4 (widened rc gate on the row) is CAUGHT by the agreement (the planted copy did not run: '$SS_L')"
575:    assert_eq "M4 the defeated gate really does render a refusal as a pass (the bug the plant proves is real)" \
> build · mimo-v2.6-flash-free
$ grep -n "runlogs" /data/repo/tests/test_cross_reader_agreement.sh | head; echo ===; grep -rn "mkdir -p \"\$SANDBOX/runlogs\"\|runlogs" /data/repo/tests/test_cross_reader_agreement.sh | head -5; echo ===; sed -n '240,260p' /data/repo/tests/test_cross_reader_agreement.sh; echo ===; grep -rn "run-.*log\b" /data/repo/tests/test_red_watch.sh /data/repo/tests/test_monitor_cascade.sh 2>/dev/null | head
149:mkdir -p "$SANDBOX/runlogs"
249:        GLADEX_RUNLOG_DIR="$SANDBOX/runlogs" GLADEX_RUNLOG_WINDOW=3 \
439:    GLADEX_CLOUD_DOCKER_BIN="$SANDBOX/no-docker" GLADEX_RUNLOG_DIR="$SANDBOX/runlogs" \
===
149:mkdir -p "$SANDBOX/runlogs"
249:        GLADEX_RUNLOG_DIR="$SANDBOX/runlogs" GLADEX_RUNLOG_WINDOW=3 \
439:    GLADEX_CLOUD_DOCKER_BIN="$SANDBOX/no-docker" GLADEX_RUNLOG_DIR="$SANDBOX/runlogs" \
===
        GLADEX_REPO_DIR="$R_BASE" \
        GLADEX_DEV_DB="$SANDBOX/no.db" GLADEX_PROD_DB="$SANDBOX/no.db" \
        GLADEX_INBOX_BIN="$STUB/inbox" GLADEX_INBOX_TIMEOUT=5 \
        GLADEX_GO_BIN="$STUB/go" GLADEX_GO_TIMEOUT=3 \
        GLADEX_REPO_LINT_BIN="$STUB/repo-lint" GLADEX_GO_LINT_TIMEOUT=5 \
        GLADEX_PROMOTE_BIN="$SANDBOX/no-promote" GLADEX_PROMOTE_TIMEOUT=5 \
        GLADEX_SOURCE_SYNC_BIN="$SANDBOX/no-sync" \
        GLADEX_DEPLOY_LEDGER_BIN="$SANDBOX/no-ledger" \
        GLADEX_CLOUD_DOCKER_BIN="$SANDBOX/no-docker" GLADEX_CLOUD_TIMEOUT=3 \
        GLADEX_RUNLOG_DIR="$SANDBOX/runlogs" GLADEX_RUNLOG_WINDOW=3 \
        GLADEX_REDWATCH_STATE="$SANDBOX/no.state" \
        GLADEX_BASELINE_STALE_BIN="$STUB/bs" GLADEX_BASELINE_STALE_TIMEOUT=5 \
        GLADEX_BASELINE_STALE_BASELINE="$BASE_R" \
        GLADEX_COVERAGE_GUARD_BIN="$replay" GLADEX_COVERAGE_GUARD_TIMEOUT=5 \
        GLADEX_COVERAGE_GUARD_BASELINE="$BASE_R" \
        "$tool" --format json 2>/dev/null)
    printf '%s' "$out" | python3 -c '
import json, re, sys
raw = sys.stdin.read()
try:
    d = json.loads(raw)
===
> build · mimo-v2.6-flash-free

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Mon Oct 26 04:38:17 2026] 127.0.0.1:56602 Accepted
[Mon Oct 26 04:38:17 2026] 127.0.0.1:56602 Closing
[Mon Oct 26 04:38:17 2026] 127.0.0.1:56614 Accepted
[Mon Oct 26 04:38:17 2026] 127.0.0.1:56614 Closing
[Mon Oct 26 04:38:18 2026] 127.0.0.1:56620 Accepted
[Mon Oct 26 04:38:18 2026] 127.0.0.1:56620 Closing
[Mon Oct 26 04:38:18 2026] 127.0.0.1:56636 Accepted
[Mon Oct 26 04:38:18 2026] 127.0.0.1:56636 Closing
[Mon Oct 26 04:38:18 2026] 127.0.0.1:56652 Accepted
[Mon Oct 26 04:38:18 2026] 127.0.0.1:56652 Closing
[Mon Oct 26 04:38:18 2026] 127.0.0.1:56662 Accepted
[Mon Oct 26 04:38:18 2026] 127.0.0.1:56662 Closing
[Mon Oct 26 04:38:19 2026] 127.0.0.1:56670 Accepted
[Mon Oct 26 04:38:19 2026] 127.0.0.1:56672 Accepted
[Mon Oct 26 04:38:19 2026] 127.0.0.1:56670 Closing
[Mon Oct 26 04:38:19 2026] 127.0.0.1:56672 Closing
[Mon Oct 26 04:38:19 2026] 127.0.0.1:56680 Accepted
[Mon Oct 26 04:38:19 2026] 127.0.0.1:56680 Closing
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56442 Accepted
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56442 Closing
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56458 Accepted
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56458 Closing
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56464 Accepted
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56464 Closing
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56476 Accepted
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56476 Closing
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56492 Accepted
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56492 Closing
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56500 Accepted
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56500 Closing
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56510 Accepted
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56510 Closing
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56522 Accepted
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56522 Closing
[Mon Oct 26 04:45:27 2026] 127.0.0.1:56536 Accepted
[Mon Oct 26 04:45:28 2026] 127.0.0.1:56536 Closing
[Mon Oct 26 04:45:28 2026] 127.0.0.1:56550 Accepted
[Mon Oct 26 04:45:28 2026] 127.0.0.1:56550 Closing
[Mon Oct 26 04:46:39 2026] 127.0.0.1:40722 Accepted
[Mon Oct 26 04:46:39 2026] 127.0.0.1:40722 Closing
[Mon Oct 26 04:46:39 2026] 127.0.0.1:40726 Accepted
[Mon Oct 26 04:46:39 2026] 127.0.0.1:40726 Closing
[Mon Oct 26 04:46:39 2026] 127.0.0.1:40734 Accepted
[Mon Oct 26 04:46:39 2026] 127.0.0.1:40734 Closing
[Mon Oct 26 04:46:39 2026] 127.0.0.1:40748 Accepted
[Mon Oct 26 04:46:39 2026] 127.0.0.1:40748 Closing
[Mon Oct 26 04:46:39 2026] 127.0.0.1:40758 Accepted
[Mon Oct 26 04:46:39 2026] 127.0.0.1:40758 Closing
[Mon Oct 26 04:46:39 2026] 127.0.0.1:40768 Accepted
[Mon Oct 26 04:46:39 2026] 127.0.0.1:40768 Closing
[Mon Oct 26 04:46:39 2026] 127.0.0.1:40778 Accepted
[Mon Oct 26 04:46:39 2026] 127.0.0.1:40778 Closing
[Mon Oct 26 04:46:39 2026] 127.0.0.1:40788 Accepted
[Mon Oct 26 04:46:39 2026] 127.0.0.1:40788 Closing
[Mon Oct 26 04:46:40 2026] 127.0.0.1:40794 Accepted
[Mon Oct 26 04:46:40 2026] 127.0.0.1:40794 Closing
[Mon Oct 26 04:46:40 2026] 127.0.0.1:40810 Accepted
[Mon Oct 26 04:46:40 2026] 127.0.0.1:40810 Closing
[Mon Oct 26 04:46:57 2026] 127.0.0.1:53484 Accepted

Other app logs: downloads.log