Gladex Agent Logs

PASS: T8: the bracketed counters did not move — a second rule, not a
PASS: T8: the failure carries lang changelog, so promote renders it as
PASS: T9: the bracketed spelling of the same claim still exits 1
PASS: T9: it reports through citations_missing, and the bare list stay
PASS: T9: and its message is the original one, byte for byte
PASS: T10: a bare token in an OLDER series exits 0 (the current-series
PASS: T10: counted, inside the fence, and NOT in the missing list
PASS: T10: the bracketed twin in that same older series is still judge
PASS: T10: only the bare half is narrower — the bracketed list holds
PASS: T11: a lockfile's own in-series version exits 0 (never judged)
PASS: T11: counted as bare and current, kept out of missing by the pat
PASS: T11: the same token in PROSE exits 1 — the fence is the path, 
PASS: T11: and it is named as a bare cite
PASS: T12: a tree containing an IP address exits 0
PASS: T12: the bare census did not move (1 -> 1): 10.7.1.5 contributed
PASS: T13: that address is not a claim — exit 0
PASS: T13: the census did not move (1 -> 1): no backtracked token was 
PASS: T13: and the machine channel says the same (exit 0)
PASS: T13: and nothing was judged from it
PASS: T14: --help exits 0
PASS: T14: the exit-code contract says deleting the brackets changes n
PASS: T14: the gate section says plainly that removing them is not a f
PASS: T15: sandbox clean again after the section
PASS: T15: both missing lists empty and the gate ok
> build · mimo-v2.6-flash-free
$ cd /tmp/opencode && awk '
/^PASS: M25 / {m25++}
/^PASS: M26 / {m26++}
/^PASS: M17 / {m17++}
/^PASS: M[0-9]+ / {allm++}
/^PASS: M1[0-9] / {mm++}
END {printf "M25=%d M26=%d M17=%d allM=%d\n", m25, m26, m17, allm}' repolint87.log
grep '^PASS: M2[56] \|^PASS: M17 ' repolint87.log | cut -c1-90
M25=4 M26=6 M17=4 allM=106
PASS: M17 precondition: the bracketed existence test is the ONLY one that matches this nee
PASS: M17 caught: real=1 mutant=0 — the mutant lints green over a claim nobody wrote
PASS: M17 surgical: the mutant still counts and classifies the citation — only the missi
PASS: M17 surgical 2: the bare rule still judges the same claim with the brackets removed 
PASS: M25 precondition: the bare-token collection occurs exactly once
PASS: M25 planted: the census is emptied, the fences are not weakened
PASS: M25 caught: real=1 mutant=0 — the claim is still written, it is simply never read
PASS: M25 surgical: bare census 0 while the bracketed counters still grow — one rule mis
PASS: M26 precondition: the current-series test occurs exactly once
PASS: M26 planted: only the series condition is gone, not the path fence
PASS: M26 caught: real=0 mutant=1 — without the fence an old series' prose is a defect
PASS: M26 surgical: the mutant judges exactly 6.9.9 through the BARE list — the brackete
PASS: M26 surgical: the lockfile fence is a different line — real=0 mutant=0, exempt on 
PASS: M26 surgical: the bracketed rule judged 6.9.9 BEFORE this mutation and still does (1
> build · mimo-v2.6-flash-free
Now updating `tools/REGISTRY.md`'s repo-lint section.
← Edit repo/tools/REGISTRY.md
Index: repo/tools/REGISTRY.md
===================================================================
--- repo/tools/REGISTRY.md
+++ repo/tools/REGISTRY.md
@@ -2656,10 +2656,12 @@
 **Go compile gate**: if the committed tree has a `go.mod`, the module is **rebuilt from git blobs at `--sha`** into `tempfile.mkdtemp()` *outside the repo* (the worktree is never read — `git show <sha>:<path>` for `go.mod`, `go.sum` and every `*.go` under the module dir) and compiled with `go test -exec=true ./... -run '^$' -count=1`: each test binary is **built and linked, then handed to `/bin/true`** — a compile, never a test run (a future `TestMain` cannot execute, slow it, or touch the net). Always `GOPROXY=off`. The shallowest `go.mod` wins. **Attribution rule**: a go output line becomes a `failure` only if it names a file this commit ships (path resolved relative to the module root; absolute temp paths stripped). Anything else is `cannot verify`. `.go` files with no `go.mod` are `no_go_module` — reported, not guessed.
 
 **CHANGELOG version-identity gate**: `version` is the key `/api/changelog` hands its consumers and several identities append to `CHANGELOG.md`, so a remembered rule cannot hold — hence a gate. The **committed blob at `--sha`** (never the worktree; same `git show <sha>:<path>` basis as everything else here) is scanned for `## [x.y.z]` headings: every **repeated token** becomes a `failure` (exit 1) blamed on the **later** heading's line, with `first at line N` naming the earlier one — so a tree carrying two `## [0.4.49]` can never be linted green again, and the check follows `--sha`, not HEAD. A `##` line that does not parse as a version is **counted** (`unparseable`), never entered and never a verdict — the changelog API skips such headings too. **Absence is neither**: no `CHANGELOG.md` in the tree → `attempted: false, reason: no_changelog` (a check that never ran is not a pass, and a repo with nothing to be unique is not broken).
 
-**Citation rule** (`[0.4.82]`, queue item (26)): the same committed CHANGELOG is the **rulebook for prose elsewhere in the tree** — every committed *text* blob is scanned for `[x.y.z]` **before the extension dispatch** (so `.md`, which is never linted as code, is in scope, as are extensionless tools), and a token whose `x.y` belongs to a series this changelog has a heading for, while the exact token is not one of them, is a `failure` (`lang: changelog`, exit 1) blamed on the **citing** file's line: `cites [N.N.N] but CHANGELOG.md has no such heading`. **Scope is a fence, not a nicety**: only series the changelog already has headings for are judged (`series`), because committed fixtures are full of version-shaped tokens that were never about this file — measured on the live tree, an *unfenced* build reports **43 failures / exit 1** (its `1.0.0`, `1.2.5`, `9.9.9` and friends, quoted in fixtures and in `CHANGELOG.md`'s own prose) where the fenced build reports **2289 checked, 2246 in series, 0 missing, exit 0**. A citation in a series no heading belongs to (a first `0.5.0` written before the first 0.5 entry) is therefore **out of scope by construction** and visible only as `citations_seen − citations_in_series`, never as a verdict — the same token shape as a fixture, with nothing to tell them apart. Tokens are counted even when there is **no** `CHANGELOG.md` (`citations_seen` grows, `series` stays `[]`, nothing is judged); fixture versions for this rule must use a series the changelog has never used, or the rule fails the repo that hosts its own test.
+**Citation rule** (`[0.4.82]`, queue item (26)): the same committed CHANGELOG is the **rulebook for prose elsewhere in the tree** — every committed *text* blob is scanned for `[x.y.z]` **before the extension dispatch** (so `.md`, which is never linted as code, is in scope, as are extensionless tools), and a token whose `x.y` belongs to a series this changelog has a heading for, while the exact token is not one of them, is a `failure` (`lang: changelog`, exit 1) blamed on the **citing** file's line: `cites [N.N.N] but CHANGELOG.md has no such heading`.
 
+**Bare-citation rule** (`[0.4.146]`, queue item **(87)**): the same claim written **without brackets** is still the claim — queue item (87)'s instance was a commit that went green by *deleting* the two brackets from one citation, i.e. exit 0 was reachable by hiding a report instead of satisfying it. `CHANGELOG_BARE_RE` (`(?<![\[.\d])(\d+\.\d+\.\d+)(?!\d)(?!\.\d)`, matched against the blob bytes) collects every `x.y.z` token from the same pre-dispatch walk, and the gate judges it through `bare_hits()` — **the two spellings stay two paths** (`citations_missing` vs `citations_bare_missing`, both emitted as `lang: changelog` failures) rather than one rule renamed, and the message says what it read: `bare cite of N.N.N (brackets removed) but CHANGELOG.md has no such heading`. **The bare scope is deliberately NARROWER than the bracketed one, and the live numbers are why**: judged only in the **current series** (the series of the changelog's highest heading) and **never for lockfile paths** (`LOCKFILE_NAMES` — machine-written dependency pins make no claims; npm's own `0.2.x` collided with this repo's old `0.2` series). Measured on the live tree, a naive full-fence build reports **13 reds** where the shipped build reports **2** — 11 of the 13 being a lockfile or a dependency named in prose (`vectors 0.2.1`), the other 2 the deliberate quotes this rule is about. The lookarounds are the shape of the false claim, not taste: `(?<![\[.\d])` rejects IP octets (`10.2.3.1`'s `0.2.3`) and the `[` that marks the bracketed spelling, `(?!\d)(?!\.\d)` rejects a backtracked match (`7.1.55.9` → `7.1.5`, `10.100.66.156` → `10.100.6`) — so an address in the current series is never a claim. Every bare token is **counted everywhere** regardless of fences (`citations_bare` grows even with no changelog), and the human summary appends `, N bare token(s) counted`. Both renderings of the contract say it plainly: `deleting the brackets changes the spelling, never the verdict` (exit-code 1) and `Removing the brackets is not a fix` (the gate section), each rendered from the one docstring copy. **Scope is a fence, not a nicety**: only series the changelog already has headings for are judged (`series`), because committed fixtures are full of version-shaped tokens that were never about this file — measured on the live tree, an *unfenced* build reports **43 failures / exit 1** (its `1.0.0`, `1.2.5`, `9.9.9` and friends, quoted in fixtures and in `CHANGELOG.md`'s own prose) where the fenced build reports **2289 checked, 2246 in series, 0 missing, exit 0**. A citation in a series no heading belongs to (a first `0.5.0` written before the first 0.5 entry) is therefore **out of scope by construction** and visible only as `citations_seen − citations_in_series`, never as a verdict — the same token shape as a fixture, with nothing to tell them apart. Tokens are counted even when there is **no** `CHANGELOG.md` (`citations_seen` grows, `series` stays `[]`, nothing is judged); fixture versions for this rule must use a series the changelog has never used, or the rule fails the repo that hosts its own test.
+
 **Exit codes**:
 - `0` - every linted file parses cleanly **and the committed Go module compiles** **and no `CHANGELOG.md` version token repeats** **and every version the tree cites exists in it**
 - `1` - at least one COMMITTED file fails to parse, **does not compile**, **or repeats a changelog version**, **or cites one the committed `CHANGELOG.md` never wrote** (`failures[]` names it: `FAIL <path>:<line> [<lang>] <message>`, where `lang` is `php|bash|python|go|json|go-compile|changelog`)
 - `2` - invalid arguments (argparse: bad `--format`, `--timeout 0`, `--go-timeout 0`, empty `--sha`). **Under `--format json` that is still ONE JSON object on stdout** carrying `exit_code: 2` with `error` naming the bad argument — bad argv must never read as "cannot verify" (3), and a `| jq` consumer must get our diagnosis rather than empty stdin; human mode keeps argparse's usage prose on stderr unchanged (`[0.4.62]`)

> build · mimo-v2.6-flash-free
← Edit repo/tools/REGISTRY.md
Index: repo/tools/REGISTRY.md
===================================================================
--- repo/tools/REGISTRY.md
+++ repo/tools/REGISTRY.md
@@ -2635,9 +2635,9 @@
 **Status**: Green ✅ 2026-09-26 (48/48; pre-fix replay against the committed suite — md5 `b9d7dcd3c2aa159c33f5f7144cdbfb5a`, suite md5 `261ad2b7608334b20743bfa25b926bcb`, `/tmp/opencode/contrastfix/pre-fix-final.log` — → **33 passed / 15 failed**, and 33 + 15 = 48 closes exactly; mutations **M1** else dropped → caught by 10, **M2** guard weakened → caught by 9, all inside **F2** because **F1 cannot distinguish the two guards**)
 
 ## repo-lint
 
-**Purpose**: Parse-check every lintable file of a COMMITTED tree — git blobs at a pinned `--sha` (default HEAD), never the working tree — and, when the committed tree is a Go module, **compile** it; it also enforces the **identity of every `## [x.y.z]` heading in the committed `CHANGELOG.md`**, and that a `[x.y.z]` **cited anywhere in the committed tree exists** as one of those headings (`[0.4.82]`). Four defects this tool exists for: commit `219fd8f` shipped `tests/test_mailbox_a11y.php` with a PHP parse error while HEAD was broken and every worktree-based suite stayed green (disk lints are blind to the commit and hostage to concurrent shifts mid-edit); commit `395b9b5` shipped `app/src/go/cmd/gladex/commands/status_test.go` with `import "json"`, which **parses** — so this tool answered *"all 105 linted file(s) parse clean" (exit 0)* — while `go test` could not build the package at all; on 2026-09-25 commits `6c98b18` + `6e61874` shipped **two `## [0.4.49]` headings**, so `/api/changelog`'s version-keyed read yielded **54 keys for 55 entries** (one entry unreachable BY VERSION, victim decided by file order) while every suite stayed green; and on 2026-09-26 commit `c020b29` shipped a test header **citing a `## [x.y.z]` heading nobody had written yet** (queue item (26)) — invisible by construction, because the gate read headings only and `.md` prose is never linted as code.
+**Purpose**: Parse-check every lintable file of a COMMITTED tree — git blobs at a pinned `--sha` (default HEAD), never the working tree — and, when the committed tree is a Go module, **compile** it; it also enforces the **identity of every `## [x.y.z]` heading in the committed `CHANGELOG.md`**, and that a `[x.y.z]` **cited anywhere in the committed tree exists** as one of those headings (`[0.4.82]`) — and, since `[0.4.146]` (queue item **(87)**), that a **bare `x.y.z`** token making the same claim exists too, so a citation whose brackets were deleted is still a citation. Four defects this tool exists for: commit `219fd8f` shipped `tests/test_mailbox_a11y.php` with a PHP parse error while HEAD was broken and every worktree-based suite stayed green (disk lints are blind to the commit and hostage to concurrent shifts mid-edit); commit `395b9b5` shipped `app/src/go/cmd/gladex/commands/status_test.go` with `import "json"`, which **parses** — so this tool answered *"all 105 linted file(s) parse clean" (exit 0)* — while `go test` could not build the package at all; on 2026-09-25 commits `6c98b18` + `6e61874` shipped **two `## [0.4.49]` headings**, so `/api/changelog`'s version-keyed read yielded **54 keys for 55 entries** (one entry unreachable BY VERSION, victim decided by file order) while every suite stayed green; and on 2026-09-26 commit `c020b29` shipped a test header **citing a `## [x.y.z]` heading nobody had written yet** (queue item (26)) — invisible by construction, because the gate read headings only and `.md` prose is never linted as code.
 
 **Location**: `/data/repo/tools/repo-lint`
 
 **Usage**:

> build · mimo-v2.6-flash-free
← Edit repo/tools/REGISTRY.md
Index: repo/tools/REGISTRY.md
===================================================================
--- repo/tools/REGISTRY.md
+++ repo/tools/REGISTRY.md
@@ -2661,10 +2661,10 @@
 
 **Bare-citation rule** (`[0.4.146]`, queue item **(87)**): the same claim written **without brackets** is still the claim — queue item (87)'s instance was a commit that went green by *deleting* the two brackets from one citation, i.e. exit 0 was reachable by hiding a report instead of satisfying it. `CHANGELOG_BARE_RE` (`(?<![\[.\d])(\d+\.\d+\.\d+)(?!\d)(?!\.\d)`, matched against the blob bytes) collects every `x.y.z` token from the same pre-dispatch walk, and the gate judges it through `bare_hits()` — **the two spellings stay two paths** (`citations_missing` vs `citations_bare_missing`, both emitted as `lang: changelog` failures) rather than one rule renamed, and the message says what it read: `bare cite of N.N.N (brackets removed) but CHANGELOG.md has no such heading`. **The bare scope is deliberately NARROWER than the bracketed one, and the live numbers are why**: judged only in the **current series** (the series of the changelog's highest heading) and **never for lockfile paths** (`LOCKFILE_NAMES` — machine-written dependency pins make no claims; npm's own `0.2.x` collided with this repo's old `0.2` series). Measured on the live tree, a naive full-fence build reports **13 reds** where the shipped build reports **2** — 11 of the 13 being a lockfile or a dependency named in prose (`vectors 0.2.1`), the other 2 the deliberate quotes this rule is about. The lookarounds are the shape of the false claim, not taste: `(?<![\[.\d])` rejects IP octets (`10.2.3.1`'s `0.2.3`) and the `[` that marks the bracketed spelling, `(?!\d)(?!\.\d)` rejects a backtracked match (`7.1.55.9` → `7.1.5`, `10.100.66.156` → `10.100.6`) — so an address in the current series is never a claim. Every bare token is **counted everywhere** regardless of fences (`citations_bare` grows even with no changelog), and the human summary appends `, N bare token(s) counted`. Both renderings of the contract say it plainly: `deleting the brackets changes the spelling, never the verdict` (exit-code 1) and `Removing the brackets is not a fix` (the gate section), each rendered from the one docstring copy. **Scope is a fence, not a nicety**: only series the changelog already has headings for are judged (`series`), because committed fixtures are full of version-shaped tokens that were never about this file — measured on the live tree, an *unfenced* build reports **43 failures / exit 1** (its `1.0.0`, `1.2.5`, `9.9.9` and friends, quoted in fixtures and in `CHANGELOG.md`'s own prose) where the fenced build reports **2289 checked, 2246 in series, 0 missing, exit 0**. A citation in a series no heading belongs to (a first `0.5.0` written before the first 0.5 entry) is therefore **out of scope by construction** and visible only as `citations_seen − citations_in_series`, never as a verdict — the same token shape as a fixture, with nothing to tell them apart. Tokens are counted even when there is **no** `CHANGELOG.md` (`citations_seen` grows, `series` stays `[]`, nothing is judged); fixture versions for this rule must use a series the changelog has never used, or the rule fails the repo that hosts its own test.
 
 **Exit codes**:
-- `0` - every linted file parses cleanly **and the committed Go module compiles** **and no `CHANGELOG.md` version token repeats** **and every version the tree cites exists in it**
-- `1` - at least one COMMITTED file fails to parse, **does not compile**, **or repeats a changelog version**, **or cites one the committed `CHANGELOG.md` never wrote** (`failures[]` names it: `FAIL <path>:<line> [<lang>] <message>`, where `lang` is `php|bash|python|go|json|go-compile|changelog`)
+- `0` - every linted file parses cleanly **and the committed Go module compiles** **and no `CHANGELOG.md` version token repeats** **and every version the tree cites exists in it — bracketed `[x.y.z]` or bare `x.y.z` alike** (`[0.4.146]`)
+- `1` - at least one COMMITTED file fails to parse, **does not compile**, **or repeats a changelog version**, **or cites one the committed `CHANGELOG.md` never wrote — with its brackets or without them** (`failures[]` names it: `FAIL <path>:<line> [<lang>] <message>`, where `lang` is `php|bash|python|go|json|go-compile|changelog`; the bare spelling adds its own message, `bare cite of N.N.N (brackets removed) …`)
 - `2` - invalid arguments (argparse: bad `--format`, `--timeout 0`, `--go-timeout 0`, empty `--sha`). **Under `--format json` that is still ONE JSON object on stdout** carrying `exit_code: 2` with `error` naming the bad argument — bad argv must never read as "cannot verify" (3), and a `| jq` consumer must get our diagnosis rather than empty stdin; human mode keeps argparse's usage prose on stderr unchanged (`[0.4.62]`)
 - `3` - cannot verify: not a git repo / unknown revision / a linter binary missing or timed out — **a language dispatched to with no linter wired for it** (`EXT_LANG`/`SHEBANG_LANG` can grow an entry before `lint()`'s `cmd` dict has one → `errors[]` gets `no linter wired for lang: <lang>`, never a `KeyError` and never a silent skip — `[0.4.86]`) — **including `go` missing, module or build cache cold (`GOPROXY=off`), toolchain unfetchable, and any go failure that implicates no committed file**, plus a `CHANGELOG.md` that exists but could not be read (`reason: changelog_unreadable`), plus **a docstring section the epilog is built from that is missing or empty** (`[0.4.60]`'s refusal, raised at **import** — before argparse exists — so no invocation reaches a renderer that would print a label over nothing; the message names each offending pair **on stderr in human format, and in json format as `die()`'s standard error object** — `[0.4.61]`, see *The refusal is machine-readable too* below). A lint that did not run is never a pass; an environment failure is never a verdict on a file we did not write.
 
 **The human closing line is derived, not assumed** (`[0.4.83]`, queue item (29)): human format ends with one sentence a reader acts on — `result: …`, and since `[0.4.52]` that sentence was a **constant**, `result: N file(s) fail to parse (exit 1)`, written when exit 1 could only mean a parse error. The duplicate-heading rule then the citation rule joined the same exit code, so the last line of a red run kept naming the one cause it could no longer rule out: a reader sent to hunt a syntax error in `PLAN.md`, a Markdown file nothing parses. `_result_line(failures, exit_code, n_linted)` now derives it from **`failures[].lang`**, the same field `promote-dev-to-prod` derives the exit-7 refusal from (`[0.4.53]`), with three shapes: no failure → the unchanged `all N linted file(s) parse clean (exit 0)`; every failure a syntax/compile lang (`_SYNTAX_LANGS` = `php bash python json go go-compile`) → `result: N file(s) fail to parse or compile (exit 1)`, the specific diagnosis and the parent's own vocabulary; anything else → `result: N file(s) fail lint (<kinds>) (exit 1)` with the sorted, de-duplicated rule names, so a **mixed** run names both kinds instead of accusing one (a reader who fixes half the tree must not re-run into the same wall). A failure carrying no `lang` reads as `unknown`, which is not in the syntax set — an unlabelled failure is never promoted into a parse error. The counts and the exit code are unchanged; only the claim moved, and `main()` prints the derived line exactly once (no second literal beside it).

> build · mimo-v2.6-flash-free
← Edit repo/tools/REGISTRY.md
Index: repo/tools/REGISTRY.md
===================================================================
--- repo/tools/REGISTRY.md
+++ repo/tools/REGISTRY.md
@@ -2674,9 +2674,9 @@
 **The number in `N file(s)` counts DISTINCT PATHS, not `failures`** (`[0.4.84]`, queue item (30)): the sentence's noun is *files*, and one file can fail more than once — `changelog_gate` emits one entry per duplicated heading **beyond the first**, so a `CHANGELOG.md` carrying three `## [7.1.1]` headings produces **two failures on one path**. Measured before the fix: two `FAIL CHANGELOG.md:…` lines above `result: 2 file(s) fail lint (changelog) (exit 1)`, a number the reader must reconcile with the lines above it before they can act. `n_files = len({f.get("path") for f in failures})` feeds **both** branches; `kinds` stays **per failure**, so a single file tripping two rules is still told both — the two counts differ by design and the *subject of the sentence* decides which is printed. `f.get("path")` (not `["path"]`) keeps a future failure that forgot the field from raising inside the formatter — every one of the four producers sets it today (parse, `go-compile`, duplicate heading, citation — read this run; V2 asserts the changelog pair rather than trusting the read). The clean line's `n_linted` was already a file count (`sum(linted.values())`), so both halves of the sentence now mean the same thing.
 
 : the argparse epilog has no prose of its own — `EPILOG` is a tuple of `(short label, docstring heading)` pairs joined by `"\n\n"`, and each section's bytes come from `docstring_section(heading)` (finds the heading in `__doc__`, reads to the first blank line, dedents 4), so `--help` and the module docstring are the same bytes and cannot drift. The seven pairs are `exit codes:` → `Exit codes:`, `languages:` → `Languages (by extension):`, `go compile gate:` → `Go COMPILE gate (why a parse lint is not enough):`, `changelog version gate:` → `CHANGELOG version-identity gate (why a test is not a gate):`, `reads GIT BLOBS:` → `Why blobs, not the worktree:`, `env:` → `Environment:`, `examples:` → `Examples:`. It started as one section: the exit-code contract was two hand-maintained copies in one file, the docstring one still reading `0 - every linted file parses cleanly` / `1 - at least one COMMITTED file fails to parse` (the contract from **before** the Go compile and CHANGELOG version gates existed) while the epilog already named all three rules — and `[0.4.59]` finished the class, finding five more hand-copied sections plus a hand-written blob paragraph, one of them **already drifted**: the docstring's `Usage:` synopsis omitted `-h` and wrote `human|json` where argparse renders `{human,json}`. That fifth pair was resolved by **deletion, not synchronisation** — argparse *generates* the synopsis from the argument definitions, so the docstring now says so and carries no second copy, while the examples moved into the docstring as `Examples:` (one copy, rendered). Section **P** pins the contract pair and section **Q** the other six: P1/Q-source count each section's text in the source (exactly 1) and P4/Q-render compare `--help`'s section to the docstring block **byte for byte** (the epilog runs under `RawDescriptionHelpFormatter`, which preserves blocks verbatim, so a difference is always a real second copy, never a rewrap). Two checks, because they see different mutants: M12 hides a copy `--help` never renders (render check stays green), M13 misattributes a rendered section (source count stays green).
 
-**JSON**: the top-level key set is pinned by the suite — `tool, timestamp, repo_root, requested_sha, sha_resolved, error, files_total, linted, skipped, failures, errors, go_compile, changelog_version, ok, exit_code` (`rc == exit_code`). `go_compile` = `{attempted, go_mod, files, ok, reason, summary, duration_s}` with `reason` ∈ `no_go_module | no_go_files | go_tool_failed` (null on success); `changelog_version` = `{attempted, path, entries, unique, unparseable, duplicates, citations_seen, citations_in_series, citations_missing, series, ok, reason, summary}` with `reason` ∈ `no_changelog | changelog_unreadable` (null when the file was read), `duplicates` an ordered list of the repeated version tokens, `citations_seen`/`citations_in_series`/`citations_missing` (list of `{path, line, version}`, added `[0.4.82]`) and `series` (ordered list of the changelog's `x.y` series, `[]` when there is no changelog) the citation rule's own counters, and `ok` `null` when nothing was checked (otherwise "no duplicates **and** no missing citations"); the **top-level** key set stays 15 — the four keys live *inside* the object that owns the changelog, so no consumer's byte-pinned contract moved. `die()` emits `go_compile: null` **and** `changelog_version: null` so both keys are always present. **`[0.4.61]` closed the one open exception**: the import-time epilog refusal used to emit nothing under `--format json` (stderr only, exit 3) — empty stdin for a `| jq` consumer — and now routes through `die()`, so **every** refusal and every cannot-verify path yields the same 15-key object with `ok false`. **`[0.4.62]` closed the last one**: a usage error was the sole remaining path with no object (`--format json --timeout abc` → exit 2, usage on stderr, **empty stdout**, so a consumer met *jq's* parse error instead of our diagnosis), and it now routes through `die()` too, with **`exit_code: 2`** — the number is what keeps "you typed a bad flag" distinct from "this could not be verified" (3), so a consumer never retries a typo. **Every `--format json` run now yields exactly one 15-key object**, whatever went wrong: verdict (0/1), refusal or environment failure (3), bad argv (2); suite S6 pins the key set of the usage object against a normal run's byte for byte. The format that decides the channel is read by **argparse** from a parser carrying *only* `--format` (`_format_of`), so the read survives the very `--timeout` that broke the parse — a full pre-parse would abort first and answer `human` whenever the failing token came first (S9). Where **no** format can be read at all — an invalid choice, a bare `--format`, anything after `--` — the channel stays human, asserted in S13–S15 rather than assumed; and `--help` still prints argparse's help on stdout with exit 0, a success path where `error()` is never called (queued as its own decision).
+**JSON**: the top-level key set is pinned by the suite — `tool, timestamp, repo_root, requested_sha, sha_resolved, error, files_total, linted, skipped, failures, errors, go_compile, changelog_version, ok, exit_code` (`rc == exit_code`). `go_compile` = `{attempted, go_mod, files, ok, reason, summary, duration_s}` with `reason` ∈ `no_go_module | no_go_files | go_tool_failed` (null on success); `changelog_version` = `{attempted, path, entries, unique, unparseable, duplicates, citations_seen, citations_in_series, citations_missing, citations_bare, citations_bare_in_series, citations_bare_current, citations_bare_missing, series, ok, reason, summary}` with `reason` ∈ `no_changelog | changelog_unreadable` (null when the file was read), `duplicates` an ordered list of the repeated version tokens, `citations_seen`/`citations_in_series`/`citations_missing` (list of `{path, line, version}`, added `[0.4.82]`), the four `citations_bare*` counters of `[0.4.146]` (total bare tokens seen / inside any series of this changelog / in the **current** series / judged and missing — the last a list of the same `{path, line, version}` shape, so a consumer can tell "counted" from "judged" without re-deriving the fences) and `series` (ordered list of the changelog's `x.y` series, `[]` when there is no changelog) the citation rule's own counters, and `ok` `null` when nothing was checked (otherwise "no duplicates **and** no missing citations"); the **top-level** key set stays 15 — the four keys live *inside* the object that owns the changelog, so no consumer's byte-pinned contract moved. `die()` emits `go_compile: null` **and** `changelog_version: null` so both keys are always present. **`[0.4.61]` closed the one open exception**: the import-time epilog refusal used to emit nothing under `--format json` (stderr only, exit 3) — empty stdin for a `| jq` consumer — and now routes through `die()`, so **every** refusal and every cannot-verify path yields the same 15-key object with `ok false`. **`[0.4.62]` closed the last one**: a usage error was the sole remaining path with no object (`--format json --timeout abc` → exit 2, usage on stderr, **empty stdout**, so a consumer met *jq's* parse error instead of our diagnosis), and it now routes through `die()` too, with **`exit_code: 2`** — the number is what keeps "you typed a bad flag" distinct from "this could not be verified" (3), so a consumer never retries a typo. **Every `--format json` run now yields exactly one 15-key object**, whatever went wrong: verdict (0/1), refusal or environment failure (3), bad argv (2); suite S6 pins the key set of the usage object against a normal run's byte for byte. The format that decides the channel is read by **argparse** from a parser carrying *only* `--format` (`_format_of`), so the read survives the very `--timeout` that broke the parse — a full pre-parse would abort first and answer `human` whenever the failing token came first (S9). Where **no** format can be read at all — an invalid choice, a bare `--format`, anything after `--` — the channel stays human, asserted in S13–S15 rather than assumed; and `--help` still prints argparse's help on stdout with exit 0, a success path where `error()` is never called (queued as its own decision).
 
 **The refusal is machine-readable too** (`[0.4.61]`): the epilog refusal fires while `EPILOG` is still being built, i.e. before `main()` can construct the parser that would normally decide `--format` and `--sha`. The queue offered *"detect `--format json` in `sys.argv`"* — **rejected**: a hand-rolled scan is argparse's rules written out a second time (prefix matching, `--flag=value`, `--` termination, last-wins), the exact defect class this tool has been removing since `[0.4.53]`. Instead the four options live in **`_add_flags(p)`** (ONE definition), called by `main()`'s parser *and* by a throwaway `ArgumentParser(add_help=False)` whose `parse_known_args(sys.argv[1:])` reads the argv pre-parse: same definitions, same library, agreement **by construction** rather than by a test that remembers to compare. Three consequences, all pinned: `die()`, `_now()` and `default_repo()` now sit **above** the epilog build (at import none of them existed yet — `die` was defined 150 lines below the code that needs it, and `p` arrives as `None` because the parser does not exist); argparse's own rejections are swallowed during the scan (`redirect_stderr`) so the refusal stays the whole diagnosis — the defaults it falls back to are the honest answer for an argv that never got parsed; and the human line gained `die`'s prefix — `repo-lint: ERROR refusing to run - …` — while keeping its wording, its stream (stderr) and exit 3.
 
 **Test hooks (env)**: `GLADEX_REPO_DIR` — repo to lint (default: this script's parent repo, `realpath`'d so the documented `/data/tools` symlink resolves to `/data/repo`); `GLADEX_GO_GOPATH` (default `/tmp/gopath`, shared with `system-status` so the module cache is warm; `GOMODCACHE` = `$GLADEX_GO_GOPATH/pkg/mod`); `GLADEX_GO_GOCACHE` (default `/tmp/gocache`).

> build · mimo-v2.6-flash-free
← Edit repo/tools/REGISTRY.md
Index: repo/tools/REGISTRY.md
===================================================================
--- repo/tools/REGISTRY.md
+++ repo/tools/REGISTRY.md
@@ -2685,9 +2685,9 @@
 
 **Dependencies**: python3 (stdlib only: argparse, contextlib, io, json, os, re, shutil, subprocess, sys, tempfile, time, datetime), git; php/bash/gofmt for their respective languages, `go` for the compile gate (any missing binary → exit 3, fail closed — never a silent pass).
 
 **Tests**:
-- `bash tests/test_repo_lint.sh` → **420 assertions**, hermetic (throwaway git repos under `${TMPDIR:-/tmp}/opencode`, trap-cleaned): clean→0 with exact per-language/skip counts (`files_total = linted + skipped`), all five languages caught with path+line, the 219fd8f incident replayed **both directions** (bad worktree/clean commit → 0; clean worktree/bad commit → 1), arg/env exit contracts, exact JSON key set (now including `changelog_version`), symlink invocation (sandbox + real `/data/tools`), missing-binary→3 and hung-linter→3, read-only status proof on the live repo — plus **section R**, the epilog refusal and its machine-readable form, **section S**, the usage error's, **section T**, the citation rule, **section U**, the human closing line (its **U7** + M23 also prove every lang the tool can *emit* is classified), **section V**, the number inside it, **section W**, a lang with no linter wired for it, and **section X**, a *mixed* run — `cannot verify` may not swallow a verified failure.
+- `bash tests/test_repo_lint.sh` → **461 assertions**, hermetic (throwaway git repos under `${TMPDIR:-/tmp}/opencode`, trap-cleaned): clean→0 with exact per-language/skip counts (`files_total = linted + skipped`), all five languages caught with path+line, the 219fd8f incident replayed **both directions** (bad worktree/clean commit → 0; clean worktree/bad commit → 1), arg/env exit contracts, exact JSON key set (now including `changelog_version`), symlink invocation (sandbox + real `/data/tools`), missing-binary→3 and hung-linter→3, read-only status proof on the live repo — plus **section R**, the epilog refusal and its machine-readable form, **section S**, the usage error's, **section T**, the citation rule **and, since `[0.4.146]`, its bare-token twin (T8–T15, 30 of these 461)**, **section U**, the human closing line (its **U7** + M23 also prove every lang the tool can *emit* is classified), **section V**, the number inside it, **section W**, a lang with no linter wired for it, and **section X**, a *mixed* run — `cannot verify` may not swallow a verified failure. **461 = 420 (2026-09-30, before this step) + 30 in T8–T15 + 10 in M25/M26 + 1 in M17's second surgical check**; section T now holds **54** of the 461.
 - **Section N — the compile gate** (its own stdlib-only module in a separate throwaway repo; `$SB/repo`'s `main.go`-without-`go.mod` is case N10): clean module → 0 with `go_compile.ok`; **the 395b9b5 shape verbatim → 1** naming `pkg/a_test.go:4 [go-compile]` *and* asserting `all(f['lang'] != 'go')` + `linted == {'go': 2}` — the per-file gate passed, proving the parse gate is blind rather than merely not reached; blob basis (worktree fix invisible → 1; committed fix → 0); broken *ancestor* `--sha` → 1 while HEAD is clean; `GLADEX_GO_GOCACHE=/dev/null/x` → **3 with `failures == []`** (cannot verify ≠ broken ≠ pass); missing `go` → 3 naming it; `--go-timeout 0.001` → 3 and `--go-timeout 0` → 2; `--help` documents the gate. Live, **content-addressed so it can never flake**: `--sha 395b9b5` must exit 1 blaming `app/src/go/cmd/gladex/commands/status_test.go:5` as `go-compile` and nothing else; `--sha 219fd8f` still exactly one failure (the PHP parse error) **with a passing Go gate**; HEAD `go_compile.go_mod == app/src/go/go.mod`, `files > 40`.
 - **Section O — the CHANGELOG version-identity gate** (`$SB/repo`'s own changelog): no `CHANGELOG.md` → `attempted false / no_changelog / ok null`, exit 0 and **no** failure or error from the absent file, human line `changelog-version: no CHANGELOG.md`; duplicate-free → exit 0 with `entries == unique`, `path == CHANGELOG.md`, human verdict `changelog-version: 2 changelog version heading(s), 2 unique`; **the defect shape → exit 1 with the twin deliberately three entries away from its twin** (a consecutive-line comparison would find only adjacent repeats), `duplicates == ['1.0.0']`, `entries 4 / unique 3`, the failure blaming `CHANGELOG.md:9 [changelog]` with `first at line 3`, and `ok false / exit_code 1`; **blob basis** (twin committed, worktree fixed → still 1; after the fix commit → 0); **`--sha` basis** (a duplicated *ancestor* → 1 while HEAD is clean, `requested_sha` echoed, clean HEAD → 0); a non-version `## Random section` heading → `unparseable 1`, `entries 2`, exit 0 and `failures == []` (counted, never a verdict); `--help` documents the gate by name and by rule.
 - **Section T — the citation rule** (`[0.4.82]`, queue item (26); 24 assertions): a citation of an **existing** heading → exit 0 with `citations_seen`/`citations_in_series` counted, `citations_missing == []`, `series == ['7.1']`; **the defect** → exit 1 with `FAIL PLAN.md:2 [changelog]`, the message `cites [7.1.5] but CHANGELOG.md has no such heading`, `citations_missing == [{'path','line','version'}]`, `lang: changelog` (so `promote`'s `_lint_failure_verdict` keeps rendering it as *a rule, not a parse*), `ok`/`exit_code` flipped, and a human summary ending `citation(s) checked, 1 missing`; **blob basis** (claim committed, worktree fixed → still 1; after the fix commit → 0); **the fence** → a `[9.9.4]` token is *counted* (`seen 4`) but *not judged* (`in_series 3`, `missing []`, exit 0) with the human line `… 4 citation(s) checked, 0 missing`; **no `CHANGELOG.md`** → `seen 2, in_series 0, missing [], series []`, exit 0, no failure and no error (tokens read, nothing judged); **the contract** → the rule appears in the docstring block *and* in what `--help` renders (derived, byte-for-byte) together with the `SCOPE` sentence; **cleanup** → the section leaves the sandbox green so a later mutant's clean-run assertion cannot fail for its own reason. Fixtures use series **`7.1`** and write the missing token into a *fixture file*, never into this suite — a literal in-series version committed here would be a citation in the REAL tree and the rule would fail the repo that hosts its own test (that constraint is documented in the tool's `SCOPE` paragraph too).
 - **Section U — the human closing line** (`[0.4.83]`, queue item (29); 20 assertions): **U1** a missing citation → exit 1 with `result: 1 file(s) fail lint (changelog) (exit 1)` and **no** `fail to parse` anywhere in the output, `json_exit_code` mirroring the process and the failure's `lang` shown to be the field the line is derived from; **U2** a broken PHP file → `result: 1 file(s) fail to parse or compile (exit 1)` with **no** `fail lint (`, i.e. the specific diagnosis does not regress to vagueness; **U3** both at once → `result: 2 file(s) fail lint (changelog, php) (exit 1)` (sorted, de-duplicated, both kinds named); **U4** `_SYNTAX_LANGS` in `tools/repo-lint` and in `tools/promote-dev-to-prod` are **the same set**, extracted by regex from both files rather than imported (a child must not import its parent, and prose agreement is what drifted in `[0.4.53]`); **U5** the function is defined exactly once and `main()` prints it exactly once (no hand-rolled second literal — P/Q's shape applied to a runtime line); **U6** the section leaves the sandbox green so a later mutant's clean-run assertion cannot fail for its own reason; **U7** (`[0.4.85]`, queue item (31)) — U4 compares two *declarations* to each other and never asks whether either covers what the tool **emits**, so `u7_classify <path>` derives four sets from that file's own source (the `EXT_LANG` and `SHEBANG_LANG` dict values, the `_SYNTAX_LANGS` frozenset, every literal `"lang": "…"` the gates hand to `failures[]`) and asserts three things: **U7-1** it read four non-empty sets (an extraction that reads nothing would pass every subtraction below vacuously — the same "cannot verify is not a pass" discipline the tool itself has), **U7-2** every dispatch lang is classified as syntax, **U7-3** every emittable lang is syntax **or one of a DECLARED rule set** (`RULE_LANGS = {"changelog"}` — declared rather than derived as `gate − syntax`, which would absorb a new rule automatically and make the check tautological), **U7-4** `rules_match=YES`, that declaration compared back against the gate in **both** directions so it may not drift either. The same function runs against `$TOOL` and, in M23, against a copy carrying one extra `EXT_LANG` entry.

> build · mimo-v2.6-flash-free
← Edit repo/tools/REGISTRY.md
Index: repo/tools/REGISTRY.md
===================================================================
--- repo/tools/REGISTRY.md
+++ repo/tools/REGISTRY.md
@@ -2688,9 +2688,9 @@
 **Tests**:
 - `bash tests/test_repo_lint.sh` → **461 assertions**, hermetic (throwaway git repos under `${TMPDIR:-/tmp}/opencode`, trap-cleaned): clean→0 with exact per-language/skip counts (`files_total = linted + skipped`), all five languages caught with path+line, the 219fd8f incident replayed **both directions** (bad worktree/clean commit → 0; clean worktree/bad commit → 1), arg/env exit contracts, exact JSON key set (now including `changelog_version`), symlink invocation (sandbox + real `/data/tools`), missing-binary→3 and hung-linter→3, read-only status proof on the live repo — plus **section R**, the epilog refusal and its machine-readable form, **section S**, the usage error's, **section T**, the citation rule **and, since `[0.4.146]`, its bare-token twin (T8–T15, 30 of these 461)**, **section U**, the human closing line (its **U7** + M23 also prove every lang the tool can *emit* is classified), **section V**, the number inside it, **section W**, a lang with no linter wired for it, and **section X**, a *mixed* run — `cannot verify` may not swallow a verified failure. **461 = 420 (2026-09-30, before this step) + 30 in T8–T15 + 10 in M25/M26 + 1 in M17's second surgical check**; section T now holds **54** of the 461.
 - **Section N — the compile gate** (its own stdlib-only module in a separate throwaway repo; `$SB/repo`'s `main.go`-without-`go.mod` is case N10): clean module → 0 with `go_compile.ok`; **the 395b9b5 shape verbatim → 1** naming `pkg/a_test.go:4 [go-compile]` *and* asserting `all(f['lang'] != 'go')` + `linted == {'go': 2}` — the per-file gate passed, proving the parse gate is blind rather than merely not reached; blob basis (worktree fix invisible → 1; committed fix → 0); broken *ancestor* `--sha` → 1 while HEAD is clean; `GLADEX_GO_GOCACHE=/dev/null/x` → **3 with `failures == []`** (cannot verify ≠ broken ≠ pass); missing `go` → 3 naming it; `--go-timeout 0.001` → 3 and `--go-timeout 0` → 2; `--help` documents the gate. Live, **content-addressed so it can never flake**: `--sha 395b9b5` must exit 1 blaming `app/src/go/cmd/gladex/commands/status_test.go:5` as `go-compile` and nothing else; `--sha 219fd8f` still exactly one failure (the PHP parse error) **with a passing Go gate**; HEAD `go_compile.go_mod == app/src/go/go.mod`, `files > 40`.
 - **Section O — the CHANGELOG version-identity gate** (`$SB/repo`'s own changelog): no `CHANGELOG.md` → `attempted false / no_changelog / ok null`, exit 0 and **no** failure or error from the absent file, human line `changelog-version: no CHANGELOG.md`; duplicate-free → exit 0 with `entries == unique`, `path == CHANGELOG.md`, human verdict `changelog-version: 2 changelog version heading(s), 2 unique`; **the defect shape → exit 1 with the twin deliberately three entries away from its twin** (a consecutive-line comparison would find only adjacent repeats), `duplicates == ['1.0.0']`, `entries 4 / unique 3`, the failure blaming `CHANGELOG.md:9 [changelog]` with `first at line 3`, and `ok false / exit_code 1`; **blob basis** (twin committed, worktree fixed → still 1; after the fix commit → 0); **`--sha` basis** (a duplicated *ancestor* → 1 while HEAD is clean, `requested_sha` echoed, clean HEAD → 0); a non-version `## Random section` heading → `unparseable 1`, `entries 2`, exit 0 and `failures == []` (counted, never a verdict); `--help` documents the gate by name and by rule.
-- **Section T — the citation rule** (`[0.4.82]`, queue item (26); 24 assertions): a citation of an **existing** heading → exit 0 with `citations_seen`/`citations_in_series` counted, `citations_missing == []`, `series == ['7.1']`; **the defect** → exit 1 with `FAIL PLAN.md:2 [changelog]`, the message `cites [7.1.5] but CHANGELOG.md has no such heading`, `citations_missing == [{'path','line','version'}]`, `lang: changelog` (so `promote`'s `_lint_failure_verdict` keeps rendering it as *a rule, not a parse*), `ok`/`exit_code` flipped, and a human summary ending `citation(s) checked, 1 missing`; **blob basis** (claim committed, worktree fixed → still 1; after the fix commit → 0); **the fence** → a `[9.9.4]` token is *counted* (`seen 4`) but *not judged* (`in_series 3`, `missing []`, exit 0) with the human line `… 4 citation(s) checked, 0 missing`; **no `CHANGELOG.md`** → `seen 2, in_series 0, missing [], series []`, exit 0, no failure and no error (tokens read, nothing judged); **the contract** → the rule appears in the docstring block *and* in what `--help` renders (derived, byte-for-byte) together with the `SCOPE` sentence; **cleanup** → the section leaves the sandbox green so a later mutant's clean-run assertion cannot fail for its own reason. Fixtures use series **`7.1`** and write the missing token into a *fixture file*, never into this suite — a literal in-series version committed here would be a citation in the REAL tree and the rule would fail the repo that hosts its own test (that constraint is documented in the tool's `SCOPE` paragraph too).
+- **Section T — the citation rule** (`[0.4.82]`, queue item (26), widened by `[0.4.146]` for the bare half; 54 assertions): a citation of an **existing** heading → exit 0 with `citations_seen`/`citations_in_series` counted, `citations_missing == []`, `series == ['7.1']`; **the defect** → exit 1 with `FAIL PLAN.md:2 [changelog]`, the message `cites [7.1.5] but CHANGELOG.md has no such heading`, `citations_missing == [{'path','line','version'}]`, `lang: changelog` (so `promote`'s `_lint_failure_verdict` keeps rendering it as *a rule, not a parse*), `ok`/`exit_code` flipped, and a human summary ending `citation(s) checked, 1 missing`; **blob basis** (claim committed, worktree fixed → still 1; after the fix commit → 0); **the fence** → a `[9.9.4]` token is *counted* (`seen 4`) but *not judged* (`in_series 3`, `missing []`, exit 0) with the human line `… 4 citation(s) checked, 0 missing`; **no `CHANGELOG.md`** → `seen 2, in_series 0, missing [], series []`, exit 0, no failure and no error (tokens read, nothing judged); **the contract** → the rule appears in the docstring block *and* in what `--help` renders (derived, byte-for-byte) together with the `SCOPE` sentence; **cleanup** → the section leaves the sandbox green so a later mutant's clean-run assertion cannot fail for its own reason. Fixtures use series **`7.1`** and write the missing token into a *fixture file*, never into this suite — a literal in-series version committed here would be a citation in the REAL tree and the rule would fail the repo that hosts its own test (that constraint is documented in the tool's `SCOPE` paragraph too).
 - **Section U — the human closing line** (`[0.4.83]`, queue item (29); 20 assertions): **U1** a missing citation → exit 1 with `result: 1 file(s) fail lint (changelog) (exit 1)` and **no** `fail to parse` anywhere in the output, `json_exit_code` mirroring the process and the failure's `lang` shown to be the field the line is derived from; **U2** a broken PHP file → `result: 1 file(s) fail to parse or compile (exit 1)` with **no** `fail lint (`, i.e. the specific diagnosis does not regress to vagueness; **U3** both at once → `result: 2 file(s) fail lint (changelog, php) (exit 1)` (sorted, de-duplicated, both kinds named); **U4** `_SYNTAX_LANGS` in `tools/repo-lint` and in `tools/promote-dev-to-prod` are **the same set**, extracted by regex from both files rather than imported (a child must not import its parent, and prose agreement is what drifted in `[0.4.53]`); **U5** the function is defined exactly once and `main()` prints it exactly once (no hand-rolled second literal — P/Q's shape applied to a runtime line); **U6** the section leaves the sandbox green so a later mutant's clean-run assertion cannot fail for its own reason; **U7** (`[0.4.85]`, queue item (31)) — U4 compares two *declarations* to each other and never asks whether either covers what the tool **emits**, so `u7_classify <path>` derives four sets from that file's own source (the `EXT_LANG` and `SHEBANG_LANG` dict values, the `_SYNTAX_LANGS` frozenset, every literal `"lang": "…"` the gates hand to `failures[]`) and asserts three things: **U7-1** it read four non-empty sets (an extraction that reads nothing would pass every subtraction below vacuously — the same "cannot verify is not a pass" discipline the tool itself has), **U7-2** every dispatch lang is classified as syntax, **U7-3** every emittable lang is syntax **or one of a DECLARED rule set** (`RULE_LANGS = {"changelog"}` — declared rather than derived as `gate − syntax`, which would absorb a new rule automatically and make the check tautological), **U7-4** `rules_match=YES`, that declaration compared back against the gate in **both** directions so it may not drift either. The same function runs against `$TOOL` and, in M23, against a copy carrying one extra `EXT_LANG` entry.
 - **Section V — the NUMBER in the closing line counts files** (`[0.4.84]`, queue item (30); 14 assertions): U's two branches are both **one-failure** fixtures, so every assertion in U is satisfied by a counter that never counted files at all — V supplies the case where the two counts disagree. **V1** three `## [7.1.1]` headings → **two `FAIL CHANGELOG.md:` lines** with `result: 1 file(s) fail lint (changelog) (exit 1)` and **no** `result: 2 file(s)` anywhere (the defect, reproduced in the harness rather than quoted from a run); **V2** the same run in JSON, `len(failures) == 2` and `len({f['path'] …}) == 1`, both paths `CHANGELOG.md` — the two figures the sentence must *choose* between, asserted to differ so the fix cannot be "right" by coincidence; **V3** the opposite direction, two distinct broken PHP files → still `result: 2 file(s) fail to parse or compile (exit 1)`, so a fix that collapsed the number to 1 is caught too; **V4** the source shape, three counts (the derivation occurs once, both branch strings are fed `{n_files}`, `{len(failures)} file(s) fail` occurs zero times) — a later edit cannot silently hand the label a failure count again; **V5** the sandbox left green. `kinds` is deliberately **not** de-duplicated per file: one file tripping two rules must still be told both, so the noun decides the number while the list stays per failure.
 - **Section W — a lang with no linter wired is "cannot verify", never a crash** (`[0.4.86]`, queue item (33); 25 assertions): three independent tables decide what a committed file means — `EXT_LANG`, `SHEBANG_LANG` and `lint()`'s `cmd` dict (plus `LINE_RE`), so the first can grow an entry the second has never heard of. Measured before the fix (throwaway repo, one committed `app.ts`, each variant a copy of the tool with only the `.ts` entry added): **no cmd → `KeyError` at `cmd = {`, exit 1, stdout 0 bytes, traceback**; **no `LINE_RE` → `KeyError` at `LINE_RE[lang].search(msg)`, the same signature** — exit 1 is the code *defined* to carry `result: …` and it carried nothing, so a machine reader cannot tell "these files fail lint" from "the linter crashed". Both dispatches are `.get()` now, and the two failures are deliberately **not** treated alike: **no cmd → `errors[]` + exit 3** (`no linter wired for lang: <lang>`, since no check ran — and a silent `unsupported_ext`-style skip would render "nobody wired it" as "nothing to do"), **no line parser → `failures[]` with `line: null` + exit 1** (the linter *did* run and did say no; demoting a verified failure to exit 3 would hide a real breakage behind an environment problem). **W0** asserts the real tool cannot reproduce this at all (`.ts` is `unsupported_ext` there → exit 0), so the section's fixtures are the *future* edit: `w_build <out> <mode>` copies `$TOOL` and adds the `.ts` entry plus a `cmd` entry (`noline`/`wired`) and a `LINE_RE` entry (`wired`), each needle **counted** in an embedded python builder, with the cmd anchor accepting **both** spellings (`}.get(lang)` and the pre-step `}[lang]`) so a pre-fix replay fails on behaviour rather than on a build. **W2** (no cmd) = exit 3, empty stderr, no traceback, one `errors[]` entry naming `app.ts`/`typescript`, `failures == []`, the same **15-key** object any run emits, both human lines; **W3** (cmd, no parser) = exit 1, empty stderr, `line: null` with the message kept, `errors == []`, both human lines; **W4** is the over-correction guard (a wired `LINE_RE` still reports `line == 7`); **W5** pins the source shape (one `.get` per table, zero surviving subscripts, `--help` naming the new exit-3 cause — first draft reflowed because the phrase straddled a line break and W5's own needle could not match it); **W6** leaves the sandbox green. **No new mutant**: M23 already plants the unclassified `EXT_LANG` entry and catches it *analytically* because nothing runs that copy — W executes that copy now, so `M24` would re-plant what W2 runs; the index stays at **23**, and the suite's **header** (stopping at `M16` / `Section S`) is untouched, because extending a copy nothing checks is items (5)/(32) rather than their fix.
 - **Section X — a *mixed* run: `cannot verify` may not swallow the verified failure** (`[0.4.89]`, queue item (34); 17 assertions): M5's two fixtures are errors-only and failures-only, so the **middle** case — an unwired linter *and* a real `php -l` failure in the same run — was asserted nowhere, and there the closing line was built from `errors[]` alone: `result: cannot verify - 1 lint error(s) (exit 3)` printed directly under a `FAIL app.php:2 [php]` line it never mentioned, the last sentence a reader acts on naming only the half that is not a verdict. **X1** the fixture is a **copy** of the real tool (section W's `w_build … nocmd`, which adds the `.ts` `EXT_LANG` entry with no linter behind it — the real tool cannot produce this run at all), never `$TOOL`; **X2** the JSON never lied (`failures[0].path == 'app.php'`, `errors[0].path == 'app.ts'`, `exit_code 3`, `ok false`) and `exit_code 3` is asserted a second time as **M5 intact** — the wording fix must not move a verdict; **X3** THE defect: exit 3 preserved, stderr empty, the **LAST** line byte-exact at `result: cannot verify - 1 lint error(s), and 1 file(s) fail to parse or compile (exit 3)` with the `FAIL` and `ERROR` halves both present above it; **X4** the over-correction guard — fix the PHP file, keep the unwired linter, and the line must return to `result: cannot verify - 1 lint error(s) (exit 3)` **byte-identical to the pre-step form** (W2's own needle) with no `, and ` invented where there is no failure, because the clause is added by the presence of `failures` and by nothing else; **X5** the source shape — `def _failure_clause(failures) -> str:` defined exactly **once**, named exactly **three** times (1 definition + 2 callers) and the cannot-verify literal `result: cannot verify - {len(errors)} lint error(s){clause}` occurring exactly **once**, i.e. the fix had to be reached by *quoting* one derivation rather than by writing a second copy of the failure wording (the copy is what broke); **X6** the sandbox left green. **V4's needle moved with it**: `grep -cF 'result: {n_files} file(s) fail'` → `grep -cF '{n_files} file(s) fail'`, still wanting **2**, because the `result: ` prefix is now added by whichever caller composes the line while the clause it quotes is shared — the invariant (two branches, both fed the distinct-path count) is unchanged and the needle was narrowed to the part that is still one thing.

> build · mimo-v2.6-flash-free
← Edit repo/tools/REGISTRY.md
Index: repo/tools/REGISTRY.md
===================================================================
--- repo/tools/REGISTRY.md
+++ repo/tools/REGISTRY.md
@@ -2688,9 +2688,9 @@
 **Tests**:
 - `bash tests/test_repo_lint.sh` → **461 assertions**, hermetic (throwaway git repos under `${TMPDIR:-/tmp}/opencode`, trap-cleaned): clean→0 with exact per-language/skip counts (`files_total = linted + skipped`), all five languages caught with path+line, the 219fd8f incident replayed **both directions** (bad worktree/clean commit → 0; clean worktree/bad commit → 1), arg/env exit contracts, exact JSON key set (now including `changelog_version`), symlink invocation (sandbox + real `/data/tools`), missing-binary→3 and hung-linter→3, read-only status proof on the live repo — plus **section R**, the epilog refusal and its machine-readable form, **section S**, the usage error's, **section T**, the citation rule **and, since `[0.4.146]`, its bare-token twin (T8–T15, 30 of these 461)**, **section U**, the human closing line (its **U7** + M23 also prove every lang the tool can *emit* is classified), **section V**, the number inside it, **section W**, a lang with no linter wired for it, and **section X**, a *mixed* run — `cannot verify` may not swallow a verified failure. **461 = 420 (2026-09-30, before this step) + 30 in T8–T15 + 10 in M25/M26 + 1 in M17's second surgical check**; section T now holds **54** of the 461.
 - **Section N — the compile gate** (its own stdlib-only module in a separate throwaway repo; `$SB/repo`'s `main.go`-without-`go.mod` is case N10): clean module → 0 with `go_compile.ok`; **the 395b9b5 shape verbatim → 1** naming `pkg/a_test.go:4 [go-compile]` *and* asserting `all(f['lang'] != 'go')` + `linted == {'go': 2}` — the per-file gate passed, proving the parse gate is blind rather than merely not reached; blob basis (worktree fix invisible → 1; committed fix → 0); broken *ancestor* `--sha` → 1 while HEAD is clean; `GLADEX_GO_GOCACHE=/dev/null/x` → **3 with `failures == []`** (cannot verify ≠ broken ≠ pass); missing `go` → 3 naming it; `--go-timeout 0.001` → 3 and `--go-timeout 0` → 2; `--help` documents the gate. Live, **content-addressed so it can never flake**: `--sha 395b9b5` must exit 1 blaming `app/src/go/cmd/gladex/commands/status_test.go:5` as `go-compile` and nothing else; `--sha 219fd8f` still exactly one failure (the PHP parse error) **with a passing Go gate**; HEAD `go_compile.go_mod == app/src/go/go.mod`, `files > 40`.
 - **Section O — the CHANGELOG version-identity gate** (`$SB/repo`'s own changelog): no `CHANGELOG.md` → `attempted false / no_changelog / ok null`, exit 0 and **no** failure or error from the absent file, human line `changelog-version: no CHANGELOG.md`; duplicate-free → exit 0 with `entries == unique`, `path == CHANGELOG.md`, human verdict `changelog-version: 2 changelog version heading(s), 2 unique`; **the defect shape → exit 1 with the twin deliberately three entries away from its twin** (a consecutive-line comparison would find only adjacent repeats), `duplicates == ['1.0.0']`, `entries 4 / unique 3`, the failure blaming `CHANGELOG.md:9 [changelog]` with `first at line 3`, and `ok false / exit_code 1`; **blob basis** (twin committed, worktree fixed → still 1; after the fix commit → 0); **`--sha` basis** (a duplicated *ancestor* → 1 while HEAD is clean, `requested_sha` echoed, clean HEAD → 0); a non-version `## Random section` heading → `unparseable 1`, `entries 2`, exit 0 and `failures == []` (counted, never a verdict); `--help` documents the gate by name and by rule.
-- **Section T — the citation rule** (`[0.4.82]`, queue item (26), widened by `[0.4.146]` for the bare half; 54 assertions): a citation of an **existing** heading → exit 0 with `citations_seen`/`citations_in_series` counted, `citations_missing == []`, `series == ['7.1']`; **the defect** → exit 1 with `FAIL PLAN.md:2 [changelog]`, the message `cites [7.1.5] but CHANGELOG.md has no such heading`, `citations_missing == [{'path','line','version'}]`, `lang: changelog` (so `promote`'s `_lint_failure_verdict` keeps rendering it as *a rule, not a parse*), `ok`/`exit_code` flipped, and a human summary ending `citation(s) checked, 1 missing`; **blob basis** (claim committed, worktree fixed → still 1; after the fix commit → 0); **the fence** → a `[9.9.4]` token is *counted* (`seen 4`) but *not judged* (`in_series 3`, `missing []`, exit 0) with the human line `… 4 citation(s) checked, 0 missing`; **no `CHANGELOG.md`** → `seen 2, in_series 0, missing [], series []`, exit 0, no failure and no error (tokens read, nothing judged); **the contract** → the rule appears in the docstring block *and* in what `--help` renders (derived, byte-for-byte) together with the `SCOPE` sentence; **cleanup** → the section leaves the sandbox green so a later mutant's clean-run assertion cannot fail for its own reason. Fixtures use series **`7.1`** and write the missing token into a *fixture file*, never into this suite — a literal in-series version committed here would be a citation in the REAL tree and the rule would fail the repo that hosts its own test (that constraint is documented in the tool's `SCOPE` paragraph too).
+- **Section T — the citation rule** (`[0.4.82]`, queue item (26), widened by `[0.4.146]` for the bare half; 54 assertions): a citation of an **existing** heading → exit 0 with `citations_seen`/`citations_in_series` counted, `citations_missing == []`, `series == ['7.1']`; **the defect** → exit 1 with `FAIL PLAN.md:2 [changelog]`, the message `cites [7.1.5] but CHANGELOG.md has no such heading`, `citations_missing == [{'path','line','version'}]`, `lang: changelog` (so `promote`'s `_lint_failure_verdict` keeps rendering it as *a rule, not a parse*), `ok`/`exit_code` flipped, and a human summary ending `citation(s) checked, 1 missing`; **blob basis** (claim committed, worktree fixed → still 1; after the fix commit → 0); **the fence** → a `[9.9.4]` token is *counted* (`seen 4`) but *not judged* (`in_series 3`, `missing []`, exit 0) with the human line `… 4 citation(s) checked, 0 missing`; **no `CHANGELOG.md`** → `seen 2, in_series 0, missing [], series []`, exit 0, no failure and no error (tokens read, nothing judged); **the contract** → the rule appears in the docstring block *and* in what `--help` renders (derived, byte-for-byte) together with the `SCOPE` sentence; **cleanup** → the section leaves the sandbox green so a later mutant's clean-run assertion cannot fail for its own reason. Fixtures use series **`7.1`** and write the missing token into a *fixture file*, never into this suite — a literal in-series version committed here would be a citation in the REAL tree and the rule would fail the repo that hosts its own test (that constraint is documented in the tool's `SCOPE` paragraph too). **T8–T15 (`[0.4.146]`, queue item (87), 30 assertions)** — the same claim with its brackets deleted: **T8** the defect itself → exit 1 with `FAIL PLAN.md:2 [changelog]`, the message `bare cite of 7.1.5 (brackets removed) …`, `citations_bare_missing == [{'path','line','version'}]`, **`citations_missing` still empty** (a second rule, not a relabelling) and `lang: changelog` so `promote` still renders it as a rule; **T9** the bracketed twin of the same claim → still its original message byte for byte, bare list empty; **T10** the **narrower fence** → a bare token in an *older* series exits 0 and never enters the missing list, while its bracketed twin in that same series is still judged (same series, same token, opposite verdict — the asymmetry the docstring declares), with the 13-vs-2 live measurement quoted as the reason; **T11** the **path fence** → a lockfile's in-series `7.1.9` exits 0 (`citations_bare_current ≥ 1`, missing empty) and the same token written as prose exits 1, so the fence is the path and not the number; **T12/T13** the two guards on the regex — `10.7.1.5` and `7.1.55.9` each leave the bare census **byte-identical** (asserted as a census comparison, not an exit code, because both trees exit 0 anyway) with `citations_bare_missing == []`; **T14** the contract's own words in what `--help` renders — `deleting the brackets changes the spelling, never the verdict` and `Removing the brackets is not a fix`, asserted against a **whitespace-flattened** rendering because both sentences sit inside blocks the source hard-wraps (a literal substring test would have missed on the *wrap*, which is exactly how it failed on its first run); **T15** the section leaves the sandbox green so a later mutant's clean-run assertion cannot fail for its own reason.
 - **Section U — the human closing line** (`[0.4.83]`, queue item (29); 20 assertions): **U1** a missing citation → exit 1 with `result: 1 file(s) fail lint (changelog) (exit 1)` and **no** `fail to parse` anywhere in the output, `json_exit_code` mirroring the process and the failure's `lang` shown to be the field the line is derived from; **U2** a broken PHP file → `result: 1 file(s) fail to parse or compile (exit 1)` with **no** `fail lint (`, i.e. the specific diagnosis does not regress to vagueness; **U3** both at once → `result: 2 file(s) fail lint (changelog, php) (exit 1)` (sorted, de-duplicated, both kinds named); **U4** `_SYNTAX_LANGS` in `tools/repo-lint` and in `tools/promote-dev-to-prod` are **the same set**, extracted by regex from both files rather than imported (a child must not import its parent, and prose agreement is what drifted in `[0.4.53]`); **U5** the function is defined exactly once and `main()` prints it exactly once (no hand-rolled second literal — P/Q's shape applied to a runtime line); **U6** the section leaves the sandbox green so a later mutant's clean-run assertion cannot fail for its own reason; **U7** (`[0.4.85]`, queue item (31)) — U4 compares two *declarations* to each other and never asks whether either covers what the tool **emits**, so `u7_classify <path>` derives four sets from that file's own source (the `EXT_LANG` and `SHEBANG_LANG` dict values, the `_SYNTAX_LANGS` frozenset, every literal `"lang": "…"` the gates hand to `failures[]`) and asserts three things: **U7-1** it read four non-empty sets (an extraction that reads nothing would pass every subtraction below vacuously — the same "cannot verify is not a pass" discipline the tool itself has), **U7-2** every dispatch lang is classified as syntax, **U7-3** every emittable lang is syntax **or one of a DECLARED rule set** (`RULE_LANGS = {"changelog"}` — declared rather than derived as `gate − syntax`, which would absorb a new rule automatically and make the check tautological), **U7-4** `rules_match=YES`, that declaration compared back against the gate in **both** directions so it may not drift either. The same function runs against `$TOOL` and, in M23, against a copy carrying one extra `EXT_LANG` entry.
 - **Section V — the NUMBER in the closing line counts files** (`[0.4.84]`, queue item (30); 14 assertions): U's two branches are both **one-failure** fixtures, so every assertion in U is satisfied by a counter that never counted files at all — V supplies the case where the two counts disagree. **V1** three `## [7.1.1]` headings → **two `FAIL CHANGELOG.md:` lines** with `result: 1 file(s) fail lint (changelog) (exit 1)` and **no** `result: 2 file(s)` anywhere (the defect, reproduced in the harness rather than quoted from a run); **V2** the same run in JSON, `len(failures) == 2` and `len({f['path'] …}) == 1`, both paths `CHANGELOG.md` — the two figures the sentence must *choose* between, asserted to differ so the fix cannot be "right" by coincidence; **V3** the opposite direction, two distinct broken PHP files → still `result: 2 file(s) fail to parse or compile (exit 1)`, so a fix that collapsed the number to 1 is caught too; **V4** the source shape, three counts (the derivation occurs once, both branch strings are fed `{n_files}`, `{len(failures)} file(s) fail` occurs zero times) — a later edit cannot silently hand the label a failure count again; **V5** the sandbox left green. `kinds` is deliberately **not** de-duplicated per file: one file tripping two rules must still be told both, so the noun decides the number while the list stays per failure.
 - **Section W — a lang with no linter wired is "cannot verify", never a crash** (`[0.4.86]`, queue item (33); 25 assertions): three independent tables decide what a committed file means — `EXT_LANG`, `SHEBANG_LANG` and `lint()`'s `cmd` dict (plus `LINE_RE`), so the first can grow an entry the second has never heard of. Measured before the fix (throwaway repo, one committed `app.ts`, each variant a copy of the tool with only the `.ts` entry added): **no cmd → `KeyError` at `cmd = {`, exit 1, stdout 0 bytes, traceback**; **no `LINE_RE` → `KeyError` at `LINE_RE[lang].search(msg)`, the same signature** — exit 1 is the code *defined* to carry `result: …` and it carried nothing, so a machine reader cannot tell "these files fail lint" from "the linter crashed". Both dispatches are `.get()` now, and the two failures are deliberately **not** treated alike: **no cmd → `errors[]` + exit 3** (`no linter wired for lang: <lang>`, since no check ran — and a silent `unsupported_ext`-style skip would render "nobody wired it" as "nothing to do"), **no line parser → `failures[]` with `line: null` + exit 1** (the linter *did* run and did say no; demoting a verified failure to exit 3 would hide a real breakage behind an environment problem). **W0** asserts the real tool cannot reproduce this at all (`.ts` is `unsupported_ext` there → exit 0), so the section's fixtures are the *future* edit: `w_build <out> <mode>` copies `$TOOL` and adds the `.ts` entry plus a `cmd` entry (`noline`/`wired`) and a `LINE_RE` entry (`wired`), each needle **counted** in an embedded python builder, with the cmd anchor accepting **both** spellings (`}.get(lang)` and the pre-step `}[lang]`) so a pre-fix replay fails on behaviour rather than on a build. **W2** (no cmd) = exit 3, empty stderr, no traceback, one `errors[]` entry naming `app.ts`/`typescript`, `failures == []`, the same **15-key** object any run emits, both human lines; **W3** (cmd, no parser) = exit 1, empty stderr, `line: null` with the message kept, `errors == []`, both human lines; **W4** is the over-correction guard (a wired `LINE_RE` still reports `line == 7`); **W5** pins the source shape (one `.get` per table, zero surviving subscripts, `--help` naming the new exit-3 cause — first draft reflowed because the phrase straddled a line break and W5's own needle could not match it); **W6** leaves the sandbox green. **No new mutant**: M23 already plants the unclassified `EXT_LANG` entry and catches it *analytically* because nothing runs that copy — W executes that copy now, so `M24` would re-plant what W2 runs; the index stays at **23**, and the suite's **header** (stopping at `M16` / `Section S`) is untouched, because extending a copy nothing checks is items (5)/(32) rather than their fix.
 - **Section X — a *mixed* run: `cannot verify` may not swallow the verified failure** (`[0.4.89]`, queue item (34); 17 assertions): M5's two fixtures are errors-only and failures-only, so the **middle** case — an unwired linter *and* a real `php -l` failure in the same run — was asserted nowhere, and there the closing line was built from `errors[]` alone: `result: cannot verify - 1 lint error(s) (exit 3)` printed directly under a `FAIL app.php:2 [php]` line it never mentioned, the last sentence a reader acts on naming only the half that is not a verdict. **X1** the fixture is a **copy** of the real tool (section W's `w_build … nocmd`, which adds the `.ts` `EXT_LANG` entry with no linter behind it — the real tool cannot produce this run at all), never `$TOOL`; **X2** the JSON never lied (`failures[0].path == 'app.php'`, `errors[0].path == 'app.ts'`, `exit_code 3`, `ok false`) and `exit_code 3` is asserted a second time as **M5 intact** — the wording fix must not move a verdict; **X3** THE defect: exit 3 preserved, stderr empty, the **LAST** line byte-exact at `result: cannot verify - 1 lint error(s), and 1 file(s) fail to parse or compile (exit 3)` with the `FAIL` and `ERROR` halves both present above it; **X4** the over-correction guard — fix the PHP file, keep the unwired linter, and the line must return to `result: cannot verify - 1 lint error(s) (exit 3)` **byte-identical to the pre-step form** (W2's own needle) with no `, and ` invented where there is no failure, because the clause is added by the presence of `failures` and by nothing else; **X5** the source shape — `def _failure_clause(failures) -> str:` defined exactly **once**, named exactly **three** times (1 definition + 2 callers) and the cannot-verify literal `result: cannot verify - {len(errors)} lint error(s){clause}` occurring exactly **once**, i.e. the fix had to be reached by *quoting* one derivation rather than by writing a second copy of the failure wording (the copy is what broke); **X6** the sandbox left green. **V4's needle moved with it**: `grep -cF 'result: {n_files} file(s) fail'` → `grep -cF '{n_files} file(s) fail'`, still wanting **2**, because the `result: ` prefix is now added by whichever caller composes the line while the clause it quotes is shared — the invariant (two branches, both fed the distinct-path count) is unchanged and the needle was narrowed to the part that is still one thing.

> build · mimo-v2.6-flash-free
← Edit repo/tools/REGISTRY.md
Index: repo/tools/REGISTRY.md
===================================================================
--- repo/tools/REGISTRY.md
+++ repo/tools/REGISTRY.md
@@ -2704,9 +2704,9 @@
 - **Section Q — EVERY epilog section derived, not copied** (`[0.4.59]`): Q applies P's two checks to the six remaining docstring/epilog pairs (`languages`, `go compile gate`, `changelog version gate`, `reads GIT BLOBS`, `env`, `examples`). **Q-render** (Q1–Q6) runs `--help` and compares each labelled section to its docstring block **byte for byte**, requiring the docstring side to be non-empty (a heading that no longer exists in the docstring cannot pass by rendering nothing); **Q-source** (Q7–Q12) counts each section's distinctive text in the tool source and requires **exactly one** — the check that sees a copy `--help` never renders. **Q13** requires the hand-written `Usage:` synopsis to be *gone* (needle `[--sha SHA] [--format human|json]`, count 0): argparse generates the synopsis from the argument definitions, and the docstring's copy had already drifted from it (no `-h`, `human|json` vs `{human,json}`), so the fifth pair the queue named was closed by deletion rather than by keeping two things in step. Guards: `--help` exits 0 and its `usage:` line is argparse's own.
 - **Section R — the epilog REFUSES to build a label over nothing** (`[0.4.60]`, widened by `[0.4.61]`): derivation made the epilog correct, but `docstring_section` still returned `""` for a heading it could not find and `"\n\n".join` does not complain about `""`, so a renamed or deleted docstring heading produced `env:` printed above a blank line with `--help` exiting **0** — and only Q-render's non-empty requirement stood in the way, i.e. a defect that was *tested* rather than *prevented*, covering only the heading someone named. **R1–R3** are guards on the healthy tool (exit 0, no refusal on stderr, all seven labels rendering a non-empty body); **R4–R9** cover a heading **renamed away** while the tuple still names it (refuse with exit 3; name the pair `'env:' -> 'Environment:'`; nothing on stdout; name **only** the broken pair), and R9 points `GLADEX_REPO_DIR` at the real sandbox repo for the same reason it always did — run from `$SB` the mutant's default repo is not a git repo and it exited 3 for *that* reason, a false pass the red had to be read to catch. **R10–R12b** cover a heading that **exists but whose block is empty** — `docstring_section` stops at the first blank line, so "found" must not mean "fine". **R9's original assertion was written inverted and is corrected in `[0.4.61]`**: it required *no* parseable JSON from the refusing tool — which is exactly the defect (`| jq` meeting empty stdin), so it passed for it. It now asserts the contract, and the block grew accordingly: **R9b** one object on stdout with `ok false`/`exit 3`; **R9c** it names the broken pair; **R9d** it is an ERROR not a verdict (`failures`/`errors` empty, `sha_resolved` null); **R9e** `go_compile`/`changelog_version` null (die()'s shape); **R9f** stderr clean in json mode; **R9g** its **key set is byte-equal to a normal run's** — the shape-level proof that the refusal is the contract and not an exception to it.
 - **Section R, argv parity — the refusal's reading of argv must BE argparse's** (`[0.4.61]`): it fires before argparse exists, so it reads argv with a throwaway parser built from the **same `_add_flags`** definitions; each assertion below is the first place a hand-rolled `sys.argv` scan would diverge. **R13** one definition, two call sites (source count); **R14/R14b** the `--format=json` equals form; **R15/R15b** argparse's unique-prefix rule (`--form json`) with **R15c** as the guard that argparse really does accept it; **R16/R16b** `--sha probe-r9` echoed by the refusal with **R16c/R16d** as the parity reference — the *healthy* tool must report the same `requested_sha`, one expectation read by two code paths; **R17/R17b/R17c** `--` termination (the scan stops there and emits no JSON, while argparse itself rejects the same argv with exit 2); **R18/R18b/R18c/R18d** an argv argparse rejects (refusal still fires, still names the pair, no `usage:` noise leaked, stdout still empty in human mode) with **R19** as the guard that argparse keeps ownership of validation (invalid choice alone → exit 2). **R17b, R18c and R18d are vacuously green before the fix** — with no scan in existence nothing could print or leak — and they only begin testing something once it exists; disclosed as guards, not findings. **Guards that passed against the pre-fix tool and thereby identify themselves**: R1–R8, R10–R12b, the exit-3 half of R9/R14/R15/R16, R15c, R16c/R16d, R17, R17c, R18, R18b, R19.
 - **Section S — a usage error under `--format json` is still ONE JSON object** (`[0.4.62]`): `repo-lint --format json --timeout abc` used to exit 2 with usage prose on stderr and an **empty stdout**, so a `| jq` consumer got jq's own parse error and could not tell a mistyped flag from a crash — the last path with no object after `[0.4.61]`, and reachable on a perfectly healthy tool. **S1 is the human guard** (usage on stderr, empty stdout, exit 2 — passes before *and* after, which is what makes it a guard rather than a finding, and what M16 leaves green while S3 goes red); **S2–S8** the defect itself (exit 2 preserved; stdout non-empty; one object with `ok false`/`exit_code 2`; `error` names the bad argument; **key set byte-equal to a normal run's** — the shape-level proof that the usage object *is* the contract; not a verdict — `failures[]`/`errors[]` empty, `sha_resolved` null; stderr clean); **S9–S11** argv forms a hand-rolled scan gets wrong — the failing token **before** `--format` (a full pre-parse aborts first and would answer `human`), `--format=json`, `--form json`; **S12** the tool's own `p.error()` checks take the same route as argparse's rejections (both are inside one `try`); **S13–S15** the three argv shapes where **no** format can be read (`--format yaml`, a bare `--format`, anything after `--`) → human, asserted not assumed; **S16/S16b** exactly one `add_argument("--format", …)` and two readers of it (`_add_format_flag` feeds `_add_flags` and `_format_of` — splitting the flag out must not become a second choices list); **S17/S18** guards that a healthy json run still exits 0 and `--help` still exits 0. The section captures **stdout and stderr separately** throughout (`run_tool` merges them) because *which stream* is half of what it asserts, which is why it also needed `assert_empty`/`assert_nonempty`: `assert_not_contains` takes its needle as argument 2, so an empty needle matches every haystack and "this stream is empty" could not be expressed without failing by construction.
-- **Mutation**: 24, each precondition-asserted to occur exactly once, caught by a divergence assertion, and surgically checked — M1 exit gate defeated (`(1 if failures else 0)` → 0); M2 `--sha` ignored (always lints HEAD); M3 `.php` dropped from `EXT_LANG` (mutant still catches broken sh); **M4** `failures.extend(gentries)` → `extend([])` (the 395b9b5 defect returns: a build-breaking commit reports 0; mutant still 0 on a compiling commit); **M5** `3 if errors` → `1 if errors` (an environment failure reads as "broken file": real=3/mutant=1; mutant still 1 on broken php); **M6** the gate's blob read → `open(<worktree path>)` (the 219fd8f class applied to Go: a fixed worktree hides a broken commit; mutant still 1 when the worktree is broken too); **M7** `failures.extend(cl_failures)` → `extend([])` (the hand-off dies while the JSON still names the twin — `ok false`, `duplicates == ['1.0.0']`, `exit_code 0`; mutant still exits 1 on broken php); **M8** `if ver in first_seen:` → `if False:` (the test itself dies: `duplicates == []` and `ok true` where the real tool reports a twin; mutant still green on a clean changelog); **M9** the changelog blob read pinned to `HEAD` instead of `--sha` while the existence probe still uses `--sha` (an ancestor's twin vanishes — real=1/mutant=0; mutant still 0 on a clean HEAD); **M10** the CHANGELOG rule dropped from the tool's one contract (the `[0.4.56]` defect itself planted) — caught by P2/P5 while **P1 and P4 stay green**: the docstring and `--help` still agree because they are one copy, so they lost the rule *together*; surgical checks are the agreement holding, the parse rule surviving, and `--help` still exiting 0; **M11** a second copy of the contract planted as a source comment `--help` never renders — caught by **P1 alone**, with P4 deliberately asserted **green** (what `--help` prints is still byte-identical to the docstring), proving the source-level count is not redundant with the render-level check; **M12** the same shape for a *derived* section (a source-comment second copy of the go-gate text) — caught by **Q-source**, with **Q-render asserted green** on the mutant (`--help` still equals the docstring, so the byte comparison provably cannot see it) and `--help` still exiting 0; **M13** the inverse — `("env:", "Environment:")` repointed to the languages heading, so `env:` renders a different docstring block — caught by **Q-render**, with **Q-source asserted green** (the Environment text still occurs exactly once, so the count cannot see a misattribution) and the `exit codes:` pair still agreeing (one pair misattributed, not the whole epilog). M12/M13 are complementary by construction, exactly as M10/M11 are: each one's green assertions are what prove the other's necessity; **M14** the pre-`[0.4.60]` state reproduced — R's trigger (the docstring heading renamed to `Environment (renamed):` while the tuple still says `Environment:`) **in the same copy as** the refusal's condition defeated (`if missing:` → `if False:`). Two edits deliberately: defeating the guard **alone** changes nothing, because a healthy docstring still yields seven full sections — I built it that way first and the mutant came out **green**, which is the finding rather than a flaw in the mutation: the guard is not the defect, it is what makes an always-available trigger loud. With both halves present `--help` exits 0 over a label printed on nothing, stderr silent — caught by R's refusal assertions and by `r_labels` (R3's own check, run against the mutant) going red at **exactly** `env:` — while an unrelated section still byte-equals its docstring (surgical: one condition defeated, not the derivation); **M15** the machine channel dropped (`[0.4.61]`): R's trigger **in the same copy as** the fix reverted (`raise SystemExit(die(None, default_repo(), message, sha, fmt))` → the bare `sys.stderr.write(message)` + `SystemExit(EXIT_CANNOT)`), i.e. the refusal output as it stood before this step. Two edits for the same reason M14 needs two — with a healthy docstring nothing refuses, so the dropped channel is unobservable (I planted the revert alone first and the mutant came out green, **exit 0**: the second time this mutation taught its own lesson) — and the catch is the point: **every human assertion stays GREEN** (exit still 3, pair still named, `--help` still refusing with an empty stdout) while **R9b** sees the empty stdout. The old suite asserted the *absence* of JSON, so the defect passed it. **M16** the usage-error channel dropped (`[0.4.62]`): `if fmt == "json":` → `if False:` in `_Parser.error`, i.e. the pre-step state exactly — argparse always prints usage to stderr and exits 2, so `--format json --timeout abc` gives a jq pipeline empty stdin again. **One edit where M14 and M15 each needed two, and the difference is the finding**: those needed a *trigger* because a healthy docstring never refuses, whereas here the argv that says json is supplied **by the test**, so the trigger and the defect are the same line. Caught by **S3** (stdout empty again) with **every human assertion staying GREEN** — exit still 2, usage still on stderr, `--help` still 0, the healthy json run still 0 — because the human path never had the check; that asymmetry is the argument for having written S1/S13/S14/S15 as guards. **M17–M19 (the citation rule, `[0.4.82]`)** — three ways to lint green over a version nobody wrote, each with a surgical value that says *which* one: **M17** the existence test → `if False` → the token is still **counted and classified in series** but never judged (`seen ≥ 3, in_series ≥ 3, missing [], exit 0`), caught `real=1 mutant=0`; **M18** the **series fence** dropped (`in_series = list(citations)`) → the one excluded token becomes the defect (`in_series 4`, `missing ['9.9.4']`), caught `real=0 mutant=1`, i.e. red on a fixture the real rule calls clean — and its replace runs through python with `t.count(old) == 1` asserted **inside** the script, because a sed pattern of brackets and quotes that matches the wrong line edits a path no fixture exercises and comes back green; **M19** the **collection** dropped (`citations.extend([])`) → `citations_seen == 0`, nothing was scanned at all, caught `real=1 mutant=0`. M17 vs M19 is the pair that matters: both exit 0 over the defect, and only `citations_seen` (counted-but-unjudged vs never-scanned) tells them apart. Every mutant file is `[ -f ]`-checked before it is run, so a build that produced nothing cannot be reported as a catch. **M20/M21 (`[0.4.83]`, the closing line)** — the two halves of one judgement call, both planted in `_result_line`'s syntax-set test by exact-string replace with `t.count(old) == 1` asserted inside the script: **M20** `if all(…)` → `if True:` (every failure called a parse/compile failure — the pre-step constant with the count still derived) is caught by **U1** while the exit code stays **1 on both sides**, and its surgical check is a *real* syntax failure where mutant and tool say exactly the same sentence; **M21** `if all(…)` → `if False:` (a rule failure never reported as a rule) is caught by **U2** with a *syntax* fixture, and its surgical check is a rule fixture where the inverted mutant is **indistinguishable** from the real tool — which is precisely why only a wording pin on the other branch can catch it. Neither mutant changes any verdict, so no exit-code assertion sees either: the section U pins are the only thing that does. **M22 (`[0.4.84]`, the count)** — the pre-step defect planted in the one expression that decides the number: `n_files = len({f.get("path") for f in failures})` → `n_files = len(failures)`, planted by the same exact-string replace with `t.count(old) == 1` asserted inside the script. Exit code, `kinds` and `failures[]` all stay put, so **every verdict assertion in the suite is green over it**; caught by **V1** with `real_rc == mut_rc == 1` and only the digits telling them apart (`real: 1 file(s)`, `mutant: 2 file(s)`), and its surgical check is V3's fixture — one failure per file, where failures and files are equal and the mutant is **indistinguishable** from the real tool, which is precisely why V1's fixture has to separate them. **M23 (`[0.4.85]`, the coverage)** — an `EXT_LANG` entry nothing classifies (`".ts": "typescript"` planted by exact-string replace with `t.count(old) == 1` asserted inside the script). Nothing RUNS this copy, deliberately: a bare new extension lang dies in `lint()` at `cmd = {...}[lang]` with an **uncaught KeyError** (measured 2026-09-27 in a throwaway repo — traceback, exit 1, no result line; that is a separate defect class, queued as (33)), so the defect cannot be caught through an exit code at all. The catch is therefore the **analyser diverging between two sources** — the same `u7_classify` reports `dispatch_unclassified=NONE` on the tool and `dispatch_unclassified=typescript` on the mutant — which is exactly U7's shape: it reads a file, so the mutant hands it a different file. Its surgical check is that `gate=changelog,go-compile`, `rules_match=YES` and the whole `syntax=` set are byte-identical between the two sources with `emittable_unclassified=typescript` naming **one** lang, i.e. one missing classification rather than a wrecked read.
+- **Mutation**: 26, each precondition-asserted to occur exactly once, caught by a divergence assertion, and surgically checked — M1 exit gate defeated (`(1 if failures else 0)` → 0); M2 `--sha` ignored (always lints HEAD); M3 `.php` dropped from `EXT_LANG` (mutant still catches broken sh); **M4** `failures.extend(gentries)` → `extend([])` (the 395b9b5 defect returns: a build-breaking commit reports 0; mutant still 0 on a compiling commit); **M5** `3 if errors` → `1 if errors` (an environment failure reads as "broken file": real=3/mutant=1; mutant still 1 on broken php); **M6** the gate's blob read → `open(<worktree path>)` (the 219fd8f class applied to Go: a fixed worktree hides a broken commit; mutant still 1 when the worktree is broken too); **M7** `failures.extend(cl_failures)` → `extend([])` (the hand-off dies while the JSON still names the twin — `ok false`, `duplicates == ['1.0.0']`, `exit_code 0`; mutant still exits 1 on broken php); **M8** `if ver in first_seen:` → `if False:` (the test itself dies: `duplicates == []` and `ok true` where the real tool reports a twin; mutant still green on a clean changelog); **M9** the changelog blob read pinned to `HEAD` instead of `--sha` while the existence probe still uses `--sha` (an ancestor's twin vanishes — real=1/mutant=0; mutant still 0 on a clean HEAD); **M10** the CHANGELOG rule dropped from the tool's one contract (the `[0.4.56]` defect itself planted) — caught by P2/P5 while **P1 and P4 stay green**: the docstring and `--help` still agree because they are one copy, so they lost the rule *together*; surgical checks are the agreement holding, the parse rule surviving, and `--help` still exiting 0; **M11** a second copy of the contract planted as a source comment `--help` never renders — caught by **P1 alone**, with P4 deliberately asserted **green** (what `--help` prints is still byte-identical to the docstring), proving the source-level count is not redundant with the render-level check; **M12** the same shape for a *derived* section (a source-comment second copy of the go-gate text) — caught by **Q-source**, with **Q-render asserted green** on the mutant (`--help` still equals the docstring, so the byte comparison provably cannot see it) and `--help` still exiting 0; **M13** the inverse — `("env:", "Environment:")` repointed to the languages heading, so `env:` renders a different docstring block — caught by **Q-render**, with **Q-source asserted green** (the Environment text still occurs exactly once, so the count cannot see a misattribution) and the `exit codes:` pair still agreeing (one pair misattributed, not the whole epilog). M12/M13 are complementary by construction, exactly as M10/M11 are: each one's green assertions are what prove the other's necessity; **M14** the pre-`[0.4.60]` state reproduced — R's trigger (the docstring heading renamed to `Environment (renamed):` while the tuple still says `Environment:`) **in the same copy as** the refusal's condition defeated (`if missing:` → `if False:`). Two edits deliberately: defeating the guard **alone** changes nothing, because a healthy docstring still yields seven full sections — I built it that way first and the mutant came out **green**, which is the finding rather than a flaw in the mutation: the guard is not the defect, it is what makes an always-available trigger loud. With both halves present `--help` exits 0 over a label printed on nothing, stderr silent — caught by R's refusal assertions and by `r_labels` (R3's own check, run against the mutant) going red at **exactly** `env:` — while an unrelated section still byte-equals its docstring (surgical: one condition defeated, not the derivation); **M15** the machine channel dropped (`[0.4.61]`): R's trigger **in the same copy as** the fix reverted (`raise SystemExit(die(None, default_repo(), message, sha, fmt))` → the bare `sys.stderr.write(message)` + `SystemExit(EXIT_CANNOT)`), i.e. the refusal output as it stood before this step. Two edits for the same reason M14 needs two — with a healthy docstring nothing refuses, so the dropped channel is unobservable (I planted the revert alone first and the mutant came out green, **exit 0**: the second time this mutation taught its own lesson) — and the catch is the point: **every human assertion stays GREEN** (exit still 3, pair still named, `--help` still refusing with an empty stdout) while **R9b** sees the empty stdout. The old suite asserted the *absence* of JSON, so the defect passed it. **M16** the usage-error channel dropped (`[0.4.62]`): `if fmt == "json":` → `if False:` in `_Parser.error`, i.e. the pre-step state exactly — argparse always prints usage to stderr and exits 2, so `--format json --timeout abc` gives a jq pipeline empty stdin again. **One edit where M14 and M15 each needed two, and the difference is the finding**: those needed a *trigger* because a healthy docstring never refuses, whereas here the argv that says json is supplied **by the test**, so the trigger and the defect are the same line. Caught by **S3** (stdout empty again) with **every human assertion staying GREEN** — exit still 2, usage still on stderr, `--help` still 0, the healthy json run still 0 — because the human path never had the check; that asymmetry is the argument for having written S1/S13/S14/S15 as guards. **M17–M19 (the citation rule, `[0.4.82]`)** — three ways to lint green over a version nobody wrote, each with a surgical value that says *which* one: **M17** the existence test → `if False` → the token is still **counted and classified in series** but never judged (`seen ≥ 3, in_series ≥ 3, missing [], exit 0`), caught `real=1 mutant=0`; **M18** the **series fence** dropped (`in_series = list(citations)`) → the one excluded token becomes the defect (`in_series 4`, `missing ['9.9.4']`), caught `real=0 mutant=1`, i.e. red on a fixture the real rule calls clean — and its replace runs through python with `t.count(old) == 1` asserted **inside** the script, because a sed pattern of brackets and quotes that matches the wrong line edits a path no fixture exercises and comes back green; **M19** the **collection** dropped (`citations.extend([])`) → `citations_seen == 0`, nothing was scanned at all, caught `real=1 mutant=0`. M17 vs M19 is the pair that matters: both exit 0 over the defect, and only `citations_seen` (counted-but-unjudged vs never-scanned) tells them apart. Every mutant file is `[ -f ]`-checked before it is run, so a build that produced nothing cannot be reported as a catch. **M20/M21 (`[0.4.83]`, the closing line)** — the two halves of one judgement call, both planted in `_result_line`'s syntax-set test by exact-string replace with `t.count(old) == 1` asserted inside the script: **M20** `if all(…)` → `if True:` (every failure called a parse/compile failure — the pre-step constant with the count still derived) is caught by **U1** while the exit code stays **1 on both sides**, and its surgical check is a *real* syntax failure where mutant and tool say exactly the same sentence; **M21** `if all(…)` → `if False:` (a rule failure never reported as a rule) is caught by **U2** with a *syntax* fixture, and its surgical check is a rule fixture where the inverted mutant is **indistinguishable** from the real tool — which is precisely why only a wording pin on the other branch can catch it. Neither mutant changes any verdict, so no exit-code assertion sees either: the section U pins are the only thing that does. **M22 (`[0.4.84]`, the count)** — the pre-step defect planted in the one expression that decides the number: `n_files = len({f.get("path") for f in failures})` → `n_files = len(failures)`, planted by the same exact-string replace with `t.count(old) == 1` asserted inside the script. Exit code, `kinds` and `failures[]` all stay put, so **every verdict assertion in the suite is green over it**; caught by **V1** with `real_rc == mut_rc == 1` and only the digits telling them apart (`real: 1 file(s)`, `mutant: 2 file(s)`), and its surgical check is V3's fixture — one failure per file, where failures and files are equal and the mutant is **indistinguishable** from the real tool, which is precisely why V1's fixture has to separate them. **M23 (`[0.4.85]`, the coverage)** — an `EXT_LANG` entry nothing classifies (`".ts": "typescript"` planted by exact-string replace with `t.count(old) == 1` asserted inside the script). Nothing RUNS this copy, deliberately: a bare new extension lang dies in `lint()` at `cmd = {...}[lang]` with an **uncaught KeyError** (measured 2026-09-27 in a throwaway repo — traceback, exit 1, no result line; that is a separate defect class, queued as (33)), so the defect cannot be caught through an exit code at all. The catch is therefore the **analyser diverging between two sources** — the same `u7_classify` reports `dispatch_unclassified=NONE` on the tool and `dispatch_unclassified=typescript` on the mutant — which is exactly U7's shape: it reads a file, so the mutant hands it a different file. Its surgical check is that `gate=changelog,go-compile`, `rules_match=YES` and the whole `syntax=` set are byte-identical between the two sources with `emittable_unclassified=typescript` naming **one** lang, i.e. one missing classification rather than a wrecked read.
 - Live: HEAD → exit 0 (176 files — **174 → 176 with `[0.4.65]`**, its own `tools/regression-run` + `tests/test_regression_run.sh` going from untracked to tracked (`linted.bash` 24 → 25, `linted.python` 11 → 12), following **173 → 174 with `[0.4.64]`**; the pre-commit run reads **174** with `bash 24` / `python 11` because those blobs are not there yet — the stale-live-number class, re-read after the commit below — 45 module files compile clean in ~1.6s. **`[0.4.66]` pre-commit read: exit 0, `files_total 176`, `linted {bash 25, go 43, json 11, php 32, python 12}`, `changelog_version entries 70, unique 70, duplicates []`** — both changed files were already tracked, so the post-commit prediction is **176 unchanged** with `entries 71` once `[0.4.66]` lands, re-read after the commit rather than carried. **`[0.4.67]` pre-commit read: exit 0, `files_total 176`, `linted {bash 25, go 43, json 11, php 32, python 12}`, `changelog_version entries 71, unique 71, duplicates []`** — this entry adds two **untracked** files (`tools/queue-source-check`, extensionless `python3` shebang → `linted.python`; `tests/test_queue_source.sh`, `.sh` → `linted.bash`) plus its own heading, so the post-commit prediction is **178** with `bash 26`, `python 13` and `entries 72`, re-read after the commit rather than carried) with `changelog_version` = `attempted true, entries 70, unique 70, unparseable 0, duplicates [], ok true` (**69 → 70 with `[0.4.65]`**, following **68 → 69 with `[0.4.64]`**: the count is read from the COMMITTED blob, so it is re-read after the append commits rather than carried over — it read 68 while `[0.4.64]` was still uncommitted, which is the whole point of re-reading; the working-tree count was verified the anchored way, `grep -c '^## \['` → 69 with `uniq -d` empty, because the greedy `sed 's/.*\[\([^]]*\)\].*/\1/'` form reports **5 phantom duplicates** on this tree — 0.4.31/0.4.40/0.4.44/0.4.49/0.4.62 — by taking the last bracket in a heading that cites other versions. The **file** count is 173, not the 171 drafted mid-run: `[0.4.63]`'s own two mailbox files were untracked when that number was written and tracked once it committed, so 171 → 173 is this entry's own movement rather than a count carried); `--sha 219fd8f` → exit 1 naming `tests/test_mailbox_a11y.php:208 [php]`; `--sha 395b9b5` → exit 1 naming `.../status_test.go:5 [go-compile]`; unknown rev / non-repo → exit 3; `--sha probe-r9` → exit 3 with `requested_sha: probe-r9` (the R16 parity reference, live); `--format yaml` → exit 2 with **usage on stderr and an empty stdout** (no format could be read, so none is invented — `[0.4.62]`); **`--format json` + a bad argv → exit 2 with a 384-byte 15-key object on stdout and 0 bytes on stderr** (`--timeout abc`, `--nonsense`, `--timeout 0`, empty `--sha`, and the failing token placed *before* `--format`), while the same argv in human mode still gives argparse's `usage:`+`error:` with **stdout 0 bytes**; `--help` (**106 lines**, was 57 before the epilog stopped carrying its own prose, 102 before the exit-3 clause widened, 103 through `[0.4.61]`, **+3 for `[0.4.62]`'s widened exit-2 clause**) renders all seven docstring blocks verbatim under their labels; a copy with a heading renamed → `repo-lint: ERROR refusing to run - docstring section missing or empty …` + `  'env:' -> 'Environment:'` → **exit 3**, stderr only, and under `--format json` the **same refusal as an object** — `ok false`, `exit_code 3`, `error` naming the pair, **stderr 0 bytes** — which is the `| jq` consumer `[0.4.60]`'s queue described, now parsing (`--format=json` → 3; `--form json` → 3; `-- --format json` → no JSON on stdout; `--format yaml` on the broken copy → refusal only, no `usage:` leak) — **and on that same broken copy `--format json --timeout abc` now yields the 458-byte refusal object with `exit_code 3` instead of falling back to `human`**, which is `[0.4.61]`'s own queue item struck as actioned. **`[0.4.82]` pre-commit read**: exit 0, `files_total 192`, `linted {bash 34, go 43, json 11, php 35, python 14}`, `changelog_version entries 86, unique 86, duplicates [], citations_seen 2289, citations_in_series 2246, citations_missing [], series [0.1, 0.2, 0.3, 0.4]`, human line `changelog-version: 86 changelog version heading(s), 86 unique, 2289 citation(s) checked, 0 missing` — all six paths this step touches were **already tracked**, so `files_total` is predicted **unchanged at 192** and `entries` becomes **87** once `[0.4.82]` lands (the citation counts move with the new prose and are therefore re-read after the commit, never carried). **Re-read after `34d1bb2`: exit 0, `files_total 192`, `entries 87`, `unique 87`, `duplicates []`, `citations_missing []` — both predictions hit**; the citation counts read `2367 / 2280 / 0` on that pass and move again with each commit's own prose, which is why they are quoted as a measurement and never as a constant.
 - Pre-fix replay: the **then-`HEAD` suite against the then-`HEAD` tool** → **88 passed / 28 failed** (including `L: 395b9b5 … (want rc=1 got=0)`) for the Go gate of `[0.4.3x]`; for the changelog gate the *new* suite against the pre-fix tool (md5 `3a4e09176e24ca3414366952467d4944`, log `/tmp/opencode/changelog-gate/pre-fix.log`, suite md5 `9e352394d02096183adef92d55fc5a73`) → **125 passed / 22 failed**: the exact key-set pin plus every O1–O7 finding red, and M7/M8/M9 unplantable (0 matching lines) — while the six guard-style assertions inside O (absent file adds no failure; fixed commit → 0) already passed, which is what identifies them as guards rather than findings. For `[0.4.56]` the new section P against the pre-fix tool (tool md5 `3ebcf0b4ae7e290796fbed12c57e422b`, suite md5 `a50e16d7a5643bdfd18b667752e50d2c`, log `/tmp/opencode/exitcodes/pre-fix.log`) → **166 passed / 6 failed**: P1 (the contract text occurs **twice**), P2 ×2 (Go rule and CHANGELOG rule both absent from the docstring), P4 (the docstring block and `--help`'s section differ), M10's agreement surgical check (pre-fix both copies still exist, so the mutant's docstring and `--help` disagree), and M11's precondition (already 2 occurrences → unplantable, so its other three assertions could not run pre-fix — hence 172 counted pre-fix against 175 post-fix). Guards that passed pre-fix and thereby identify themselves: P2's parse rule, P3 (all four codes), P4's `--help exits 0`, and all three P5 rules — the epilog was the copy that was right. Baseline re-verified on a checkout of the same commit before the fix: **155/156 then 156/156 twice**, the single red being `L: real repo status changed during a run` (a concurrent identity committed mid-run), not this change. For `[0.4.59]` the new section Q against the pre-fix tool (tool md5 `f17563d67064a79f313ef2bab376cd66`, suite md5 `9217e2653fbed256afb704d0a01fd359`, log `/tmp/opencode/epilogderive/pre-fix.log`; baseline of the *old* suite against the old tool was **175/0** first) → **186 passed / 9 failed**: the seven findings are Q1–Q6 (every pair renders different bytes) and Q13 (the drifted synopsis still present), plus **M12's surgical render check** — which fails pre-fix only because the two renderings differ by definition, i.e. it restates Q2 — and **M13's precondition unplantable** (the derivation tuple does not exist yet, so its other three assertions could not run: hence 186 counted pre-fix against 198 post-fix). **Guards passed pre-fix and thereby identify themselves**: all six Q-source counts (each section's text already occurred exactly once — the copies differed, they were not duplicated line-for-line), `--help exits 0`, the generated-usage line, and M12's precondition plus its "caught" assertion. For `[0.4.60]` the new section R against the pre-fix tool (old tool md5 `4e6c58ffc86441a5745054a4ea45d084`, final suite md5 `e126f791dbcd4b1d9ae0bd0626022d82`, log `/tmp/opencode/epilogrefuse/pre-fix.log`; baseline of the old suite against the old tool was **198/0** first) → **203 passed / 10 failed**, captured **inside a clone of the repo** rather than from `/tmp`: pointing `REPO_LINT_BIN` at a copy outside `tools/` makes section L's live checks fail for *path* reasons, because `default_repo()` resolves relative to the script, so the tool reported `repo_root: /tmp/...` and exited 3 — a harness artifact that cost a second capture to get a red meaning what it says. **Nine of the ten are real**: **R5, R6, R7, R9 ×2, R11, R12, R12b** plus **M14's precondition unplantable** (the refusal does not exist yet, so its other five assertions could not run — hence 213 counted pre-fix against 218 post-fix); the tenth is `L: live json structurally sound`, whose `d['repo_root'] == '/data/repo'` is true in the real repo and false in a clone — disclosed as an artifact of my cloning rather than counted as a finding. **Guards passed pre-fix and thereby identify themselves**: R1 (healthy tool exits 0), R2 (no refusal on stderr), R3 (all seven labels non-empty), R4 and R10 (both mutant preconditions), R8 (the refusal names only the broken pair — pre-fix stderr is empty, so it passes vacuously, which is what makes it a guard rather than a finding). For `[0.4.61]` the widened section R against the pre-fix tool (old tool md5 `d6b50e6dcf68df6dccb5a46dfe06e5a0`, **final** suite md5 `b71b64db24d64fa65263e3867e45ba97`, log `/tmp/opencode/jsonrefuse/pre-fix.log`; baseline of the committed suite against the committed tool was **218/218** first) → **230 passed / 12 failed**, again **inside a clone** for the same path reason. **Eleven are real**: **R9b, R9c, R9d, R9e, R9f, R9g** (one cause — stdout empty, refusal on stderr), **R13** (`_add_flags` does not exist yet), **R14b, R15b, R16b** (same empty-stdout cause) and **M15's precondition unplantable** (the die()-routing line does not exist, so its five other assertions could not run — hence **242 counted pre-fix against 247 post-fix**). The twelfth is again `L: live json structurally sound` (`repo_root` is the clone, not `/data/repo`) — disclosed as a cloning artifact, not counted. **Guards passed pre-fix and thereby identify themselves**: R1–R8, R10–R12b, the exit-3 half of R9/R14/R15/R16, **R15c** (argparse really accepts `--form`), **R16c/R16d** (the healthy tool already echoed `requested_sha: probe-r9` — the reference both readers must match), R17, R17c, R18, R18b, R19; and **R17b, R18c, R18d are vacuously green** (nothing could print before a scan existed) — disclosed as guards, not findings. Two first-draft defects of mine are recorded in the CHANGELOG: R9c's predicate used `->` outside a string (the *checker* raised SyntaxError — a red meaning the wrong thing), and M15 was first planted without its trigger (mutant exited **0** and was "NOT caught", because nothing refuses when the docstring is healthy). For `[0.4.62]` the new section S against the pre-fix tool (tool md5 `f42b33e34ab28588334b5f616a551798`, **final** suite md5 `4acbd04968016e319778dda544c6596e`, log `/tmp/opencode/usagejson/pre-fix.log`; baseline of the committed suite against the committed tool was **247/247** first) → **268 passed / 16 failed** of 284, captured **in place rather than in a clone** — the tool was still unmodified at its real path, so section L's `repo_root == '/data/repo'` check passed on its own; the clone was only ever needed because a copy *outside* `tools/` changes `default_repo()`. **All sixteen are real**: **S3–S8** (one cause — stdout empty, usage on stderr), **S9b, S9c, S10b, S10c, S11b** (same cause, one per argv form), **S12b, S12c, S12e, S12f** (same cause, via our own `p.error()`), **S16b** (`_add_format_flag` does not exist yet — hence 268 counted pre-fix against 291 post-fix). **Guards passed pre-fix and thereby identify themselves**: **S1** (the human channel was already exactly right — the strongest evidence this was a *channel* defect, not a validation one), S2, S9a, S10a, S11a, S12a, S12d, **S13a–S15b** (no-format-readable argv), **S16** (the `--format` definition was already single), **S17, S18**. Two first-draft defects of mine are recorded in the CHANGELOG: S17b read `$OUT` where `s_run` wrote `$S_OUT` (a **stale** object, so the assertion failed against the *old* tool for an unrelated reason — caught as the 17th red and fixed before the tool was touched, the capture then re-taken honestly at 16), and S16b's predicate `grep -c '_add_format_flag(p)'` also matched the `def` line, reporting `3` for two call sites plus a definition — the third time this suite has been wrong in the *predicate* direction.
 
 **Status**: Green ✅ on 2026-09-27 (**348/348**; full regression that day: **52 suites / 4267 assertions / 0 failed / 0 skipped, exit 0** — 29 shell = 2892, 23 PHP = 1375. Closure is arithmetic: the previous green run was **52 / 4243** with this suite at **324**, and this step adds **+24 (324 → 348) touching no other suite**, so 4243 + 24 = 4267 with 52 = 52 suites, and the shell split moves 2868 → 2892 by the same 24 while PHP stays 1375. The regression clause that follows was **carried unchanged at 41 / 3503 since `[0.4.67]`** — the tree had already reached 52 / 4210 by `[0.4.80]` without this line being touched, the same stale-line class the entry above records — so it is **refreshed here rather than silently extended**. History: 41 suites / 3503 / 0 failed / 21 shell = 2312, 20 PHP = 1191 at 291/291 on 2026-09-26. Was 40 / 3396 / 20 shell = 2205 with `[0.4.66]`; **`[0.4.67]` adds `tests/test_queue_source.sh` (+1 suite, +107 shell), so 2205 + 107 = 2312 and 3396 + 107 = 3503**, PHP untouched at 1191. Before that, `[0.4.66]` grew `tests/test_regression_run.sh` (+0 suites, +83 shell: 110 → 193), so 2122 + 83 = 2205 and 3313 + 83 = 3396, and `[0.4.65]` added that suite (+1 suite, +110 shell) — 2012 + 110 = 2122, 3203 + 110 = 3313. This line was itself two runs stale at `[0.4.64]` — `[0.4.63]` added `test_app_contrast.php` (+1, +185) without updating it, so 958 + 185 + 48 = 1191 and 2970 + 185 + 48 = 3203 came out then). Since queue item **(63)** (2026-09-28) this Status line no longer claims to be *the current* figure: it is dated history, the live total lives **once** on `## regression-run`'s `- Live (measured YYYY-MM-DD)` line, and `tests/test_registry_coverage.sh` section F reads that line and compares it with `regression-run --list` — so a second copy of the number here would be a second truth nobody compared, which is the (55)/(57)/(59) shape one child further along)

> build · mimo-v2.6-flash-free

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Wed Sep 30 23:31:10 2026] 127.0.0.1:42576 Closing
[Wed Sep 30 23:31:11 2026] 127.0.0.1:42580 Accepted
[Wed Sep 30 23:31:11 2026] 127.0.0.1:42580 Closed without sending a request; it was probably just an unused speculative preconnection
[Wed Sep 30 23:31:11 2026] 127.0.0.1:42580 Closing
[Wed Sep 30 23:31:42 2026] 127.0.0.1:34782 Accepted
[Wed Sep 30 23:31:42 2026] 127.0.0.1:34782 Closed without sending a request; it was probably just an unused speculative preconnection
[Wed Sep 30 23:31:42 2026] 127.0.0.1:34782 Closing
[Wed Sep 30 23:31:43 2026] 127.0.0.1:34786 Accepted
[Wed Sep 30 23:31:43 2026] 127.0.0.1:34786 Closed without sending a request; it was probably just an unused speculative preconnection
[Wed Sep 30 23:31:43 2026] 127.0.0.1:34786 Closing
[Wed Sep 30 23:34:11 2026] 127.0.0.1:53798 Accepted
[Wed Sep 30 23:34:11 2026] 127.0.0.1:53798 Closing
[Wed Sep 30 23:38:05 2026] 127.0.0.1:50696 Accepted
[Wed Sep 30 23:38:05 2026] 127.0.0.1:50696 Closing
[Wed Sep 30 23:38:06 2026] 127.0.0.1:50708 Accepted
[Wed Sep 30 23:38:06 2026] 127.0.0.1:50708 Closing
[Wed Sep 30 23:38:14 2026] 127.0.0.1:50710 Accepted
[Wed Sep 30 23:38:14 2026] 127.0.0.1:50710 Closing
[Wed Sep 30 23:38:14 2026] 127.0.0.1:50716 Accepted
[Wed Sep 30 23:38:14 2026] 127.0.0.1:50716 Closing
[Wed Sep 30 23:38:25 2026] 127.0.0.1:37480 Accepted
[Wed Sep 30 23:38:25 2026] 127.0.0.1:37480 Closing
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37494 Accepted
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37494 Closing
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37504 Accepted
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37504 Closing
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37516 Accepted
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37516 Closing
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37522 Accepted
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37522 Closing
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37538 Accepted
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37538 Closing
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37544 Accepted
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37544 Closing
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37554 Accepted
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37554 Closing
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37556 Accepted
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37556 Closing
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37564 Accepted
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37564 Closing
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37570 Accepted
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37570 Closing
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37578 Accepted
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37578 Closing
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37580 Accepted
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37580 Closing
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37582 Accepted
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37582 Closing
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37588 Accepted
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37588 Closing
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37602 Accepted
[Wed Sep 30 23:38:26 2026] 127.0.0.1:37602 Closing
[Wed Sep 30 23:38:27 2026] 127.0.0.1:37610 Accepted
[Wed Sep 30 23:38:27 2026] 127.0.0.1:37610 Closing
[Wed Sep 30 23:38:27 2026] 127.0.0.1:37618 Accepted
[Wed Sep 30 23:38:27 2026] 127.0.0.1:37618 Closing
[Wed Sep 30 23:38:27 2026] 127.0.0.1:37624 Accepted
[Wed Sep 30 23:38:27 2026] 127.0.0.1:37624 Closing
[Wed Sep 30 23:51:39 2026] 127.0.0.1:51962 Accepted