Gladex Agent Logs

1749: derives it from the report's own `timestamp − newest` (`stamp()`/`render_age()`),
1750: renders `3d 8h` above a day and minutes below, and has an honest state for every
1751: case the subtraction cannot be made — no mailbox, no entries, no readable stamps,
1752: an entry postdating the report, and a child age contradicting its own stamps
1753: (`age not trusted`, both numbers) — CHANGELOG `[0.4.45]`;
1754: the divergence guard now covers **both** pairs: the row runs
1755: `source-sync-check --env dev` itself (`GLADEX_SOURCE_SYNC_BIN`/`_TIMEOUT`) and
1756: contradicts `gates[dev-sync]` only on `ok`+`drift` / `refused`+`in_sync` —
1757: agreement silent, `unknown` (no run, garbage, timeout, exit 3, no recorded
1758: child) never a claim, evidence named through the same `child_phrase()` —
1759: CHANGELOG `[0.4.46]`;
1760: the `promote-gates` row now requires **four** gates: `ship-tree` (exit 8) joined
1761: `verdict`/`dev-sync`/`commit-lint` in `EXPECTED`, the ready line enumerates all
1762: four by name, a fourth-gate refusal is named with its reason instead of being
1763: re-read as *the child contradicting itself*, and its `NOT-EVALUATED` state is
1764: printed like every other gate's — CHANGELOG `[0.4.47]`;
1765: the divergence guard now covers **all three** pairs: the row runs
1766: `git -C <repo> status --porcelain --ignored -- <PROMOTED_TREES>` itself
1767: (`GLADEX_GIT_BIN`/`GLADEX_SHIP_TIMEOUT`, promote's own hook names and budget)
1768: and contradicts `gates[ship-tree]` only on `ok`+`dirty` / `refused`+`clean` —
1769: agreement silent, `unknown` (a `SHIP_RC` that was never set, a non-zero git
1770: exit, a budget kill) never a claim, evidence named through the same
1771: `child_phrase()`, and the tree set pinned cross-file against promote's own
1772: `PROMOTED_TREES` — CHANGELOG `[0.4.49]`;
1773: 35 checks: the **second Let's Encrypt lineage** is a row too —
1774: `tls-cert-expiry-photos` (SNI `photos.gladex.de`) joins `tls-cert-expiry`,
1775: whose SNI had been hard-coded to `gladex.de`, so the `cloud.`+`photos.` cert
1776: issued 2026-09-26 could have run down to zero days behind an ALL-SYSTEMS-HEALTHY
1777: dashboard; each row now also proves the certificate it read **covers its own
1778: SNI** (a wrong-name cert is an `error` naming the served SANs, an unreadable SAN
1779: list keeps the date verdict and says `identity not checked`) — CHANGELOG
1780: `[0.4.72]`**)
1781: 
1782: ---
1783: 
1784: ## version-check
1785: 
1786: **Purpose**: Verify dev and prod environments serve the same version via /api/version endpoint.
1787: 
1788: **Location**: `/data/repo/tools/version-check`
1789: 
1790: **Usage**:
> build · mimo-v2.6-flash-free
← Edit repo/tools/REGISTRY.md
Index: repo/tools/REGISTRY.md
===================================================================
--- repo/tools/REGISTRY.md
+++ repo/tools/REGISTRY.md
@@ -1776,9 +1776,18 @@
 issued 2026-09-26 could have run down to zero days behind an ALL-SYSTEMS-HEALTHY
 dashboard; each row now also proves the certificate it read **covers its own
 SNI** (a wrong-name cert is an `error` naming the served SANs, an unreadable SAN
 list keeps the date verdict and says `identity not checked`) — CHANGELOG
-`[0.4.72]`**)
+`[0.4.72]`;
+the **DNS:A rows decide nothing they have not classified**: `dns_query` separates
+an *answer* from *dig's transport diagnostics* (which dig prints to **stdout**
+and exits 9, so the old `$(dig … 2>/dev/null | head -1)` read them as the record's
+value — one blip in eight runs published `got ;; communications error …, expected
+77.90.15.49` and took the tool to exit 1), both public resolvers are asked the
+way `MX:`/`SOA:` already were, one unreachable resolver is a loud `warning` at
+exit 0 instead of a false red, both unreachable is `error … DNS UNVERIFIED`, and
+`set -euo pipefail` can no longer let a failed `dig` end the run with no output
+at all (exit 9 leaking past 0/1/2) — CHANGELOG `[0.4.73]`**)
 
 ---
 
 ## version-check

> build · mimo-v2.6-flash-free
$ cd /data/repo && grep -n "Next-candidate queued" agent-logs/PROGRESS.md | tail -8
5258:- **`tools/system-status --format human` → ALL SYSTEMS HEALTHY, exit 0**: `git-tree [OK] clean`, `queue-source [OK] one queue: [0.4.67] pointer-only, 111 item line(s) frozen across 26 section(s), **39 PROGRESS bullet(s)**`, `go-compile [OK] 45 module file(s) compile clean (1.624s) (commit dc819a5)`, `promote-gates [OK] promote-ready: verdict, dev-sync, commit-lint and ship-tree all pass (commit dc819a5)`. **The bullet count moved 37 → 39, not the 38 one bullet per run would give**: this entry added its `Next-candidate queued` bullet *and* one prose mention of the same phrase inside its own R5 description, and the check counts raw occurrences (`pg_text.count("Next-candidate queued")`). R5 only requires ≥ 1, so the number is informational rather than a limit — recorded because "one per run" was the assumption the figure had appeared to confirm, and it does not hold.
5277:- **Live health (all measured this run, none carried)**: `tools/repo-lint --format json` → **exit 0**, `ok true`, `files_total 178`, `linted {bash 26, go 43, json 11, php 32, python 13}`, `failures []`, `changelog_version` **72 headings / 72 unique**. `tools/source-sync-check` → **in sync, 42 files across 2 envs, exit 0**. `tools/queue-source-check` → **exit 0**, `111 item line(s) frozen across 26 section(s)`. The bullet figure was **re-measured instead of carried**: the tool read **43** immediately *before* this entry was appended and **44** after (my own bullet adds exactly one substring), while `grep -c 'Next-candidate queued'` counts **41 lines** and `grep -c '^- \*\*Next-candidate queued'` counts **33 actual bullet lines** — so the tool's `progress_bullets` currently says `44 bullet(s)` where 33 bullets exist. Item (9)'s counting bug, reproduced by simply writing an entry; **this is the corrected version of a figure I first wrote as "41 → 43" from memory, caught by running the tool again instead of trusting the draft.** `tools/system-status --format human` → **ALL SYSTEMS HEALTHY, exit 0**, 30 checks, standing warnings only: `SOA:gladex.de [WARN] mname=placeholder (NEEDS-INVESTOR open)` and `git-tree [WARN] 1 uncommitted changes` (= `INBOX.md`, this run's). `investor-messages [OK] 0 unread dev=0 prod=0`.
5283:- **Next-candidate queued, not actioned** (items (3)–(9) stand; item (2) **reproduced this run, not actioned** — see below; item (10) new from this step): (1) ~~the two queues drifted~~ — **ACTIONED by `[0.4.67]`**. (2) **Carried, now with a second live witness** — the safety-net `git add -A` claims any path dirtied during its window (`0a50492` took `[0.4.67]`'s six files; **`10d2811` took this run's `STRUCTURE.md`+`REPORT.md`, 117 of 133 lines, under a subject about mail logins**). Narrow it to what the actor actually authored, or at minimum make the commit body carry a `SWEEP:` manifest of claimed paths and warn loudly when it is non-empty — a mislabelled sweep is invisible today because nothing in the commit says it was a sweep. (3) `--baseline` records counts but not *why* — a `--note "text"` on `--save-baseline`. (4) `--format json --help` prints **human** help and exits **0**. (5) `tests/test_repo_lint.sh`'s header mutation index is a second copy of the mutation list — derive or drop it. (6) `ship-tree` names the first offending path but not *why*. (7) `--ignored` pathspec exclude. (8) the `promote-gates` age re-ages every run (intended). (9) `queue-source-check`'s `progress_bullets` counts raw occurrences, not bullet lines (**41 → 43** this run, purely from wording). (10) **New, from this step** — **nothing health-checks the cloud stacks**: `system-status` has 30 rows and not one of them knows whether Nextcloud/Immich are up, so the two newest production surfaces can die silently while the dashboard says ALL SYSTEMS HEALTHY. Add a `cloud` row (HTTP `status.php` + `/api/server/ping`, container states, `restart` counts) with the same `GLADEX_*_BIN` hermetic-hook pattern.
5294:- **Next-candidate queued, not actioned**: carry items (2)–(10) from the 04:45Z entry unchanged — including (10) the missing `system-status` `cloud` row — plus **(11) new from this step**: `INBOX.md` has no tooling that distinguishes "replied" from "executed", so a heading with a reply note and no `~~HANDLED~~` strike is the only mechanism keeping 437/444 alive for the next run; a `tools/inbox-status` (unhandled count, replied-but-open list, exit non-zero when a reply was never sent) would make the STEP 0 obligation machine-checkable instead of convention.
5309:- **Next-candidate queued, not actioned**: carry items (2)–(11) from the 05:14Z entry unchanged — including (10) the missing `system-status` `cloud` row — plus **(12) new from this step**: **`tls-check`'s `DEFAULT_DOMAINS` still lists only the 7 SANs of the `gladex.de` lineage, so the brand-new `photos.gladex.de` lineage (the cert `system-status`'s `tls-cert-expiry` row now represents as a single "87d left") is unmonitored** — a cert issued today would expire silently in 90 days while the row stays OK. Closing it is a genuine multi-file step (`DEFAULT_DOMAINS` 7 → 9, `tests/test_tls_check.sh` pins "7" in ≥5 places **including the M4 mutation precondition**, plus docstring, `REGISTRY.md`, CHANGELOG version bump), so it was queued rather than bolted onto the end of an already-large run.
5323:- **Next-candidate queued, not actioned**: carry items (2)–(11) from the 05:14Z entry unchanged — including (10) the missing `system-status` `cloud` row — item (12) **struck — ACTIONED by `[0.4.68]` this run**; plus **(13) new from this step**: **`system-status`'s `tls-cert-expiry` row still hand-shakes `127.0.0.1:443` with SNI hard-coded to `gladex.de`**, so the dashboard's single TLS row shows only the old lineage's date while the new cert (now covered by `tls-check`) is invisible there — a second row with the same <7d/<30d thresholds and its own suite is the natural follow-on, and it was not bolted onto this step.
5349:- **Next-candidate queued, not actioned**: carry items (2)–(9), (11) and **(13)** from the 06:47Z entry unchanged — **(13)** is the one I had queued for this run before the red baseline outranked it: `system-status`'s `tls-cert-expiry` row still hand-shakes `127.0.0.1:443` with **SNI hard-coded to `gladex.de`**, so the dashboard's single TLS row (`87d left`, measured again this run) still cannot show the `photos.`/`cloud.` cert that `tls-check` now watches; plus **(10)** the `system-status` `cloud` row (struck — done) and **(12)** `tls-check` 7→9 (struck — done). **(14) new from this step**: nothing enforces *where* a new `## [x.y.z]` entry goes — `repo-lint`'s changelog gate checks uniqueness, and only the two **version test suites** catch a top-inserted entry, i.e. after the fact and in CI rather than at lint time; a `repo-lint` rule ("the newest heading by file order must also be the highest version, or the top entry must equal `GLADEX_APP_VERSION`") would have turned this 15-assertion red into a lint refusal at commit time.
5366:- **Next-candidate queued, not actioned**: carry items (2)–(9), (11) and (14) from the 14:10Z entry unchanged — item (13) **struck — ACTIONED by `[0.4.72]` this run** ((10) and (12) were already struck). **(15) new from this step**: the dashboard still has **no witness that renewal *works*** — `certbot-renew` is only a systemd *timer-active* row, and `tls-check` plus both TLS rows read only what is being served right now, so a certificate that will fail to renew on 2026-12-22 stays green until it is too late; a `renewal-dry-run` row carrying `certbot renew --dry-run`'s last result and age (via a deploy hook writing a timestamp) is the missing check, and the proof it *can* work already exists — this morning's `--force-renewal` dry run reported *"all simulated renewals succeeded"*.
> build · mimo-v2.6-flash-free
Now the PROGRESS entry:
$ cd /data/repo && cat >> agent-logs/PROGRESS.md <<'EOF'
- **The defect, and how it was found (measured, not assumed)**: while taking those probes the dashboard answered **three different ways in one minute** — first call `overall=error / errors=1`, five seconds later `overall=ok / errors=0`, and a fourth loop iteration produced no output before my 120s command budget expired. I reported that to the investor *as* instability with a hang in it, and **part of that report was wrong — corrected here and in the next reply rather than left standing**: the "hang" was not a hang. Eight timed runs later, each invocation takes **32–38s**, so the earlier loop's runs 1–3 had already consumed ~99s and its 4th was simply cut by my own budget. **No invocation of this tool has ever exceeded 40s.** The real defect was narrower and is now localized: `run 6 of 8 → DNS:git.gladex.de error "got ;; communications error to 1.1.1.1#53: timed out, expected 77.90.15.49"`, runs 1-5/7/8 green on an unchanged tree — one upstream blip in eight, reported as DNS drift.
- **Why the code structurally could not see it**: `actual=$(dig @1.1.1.1 +short "$domain" A 2>/dev/null | head -1 || echo "NXDOMAIN")`. dig writes its transport diagnostics to **stdout** and exits 9 — verified directly (`dig @203.0.113.99 +short …` → four `;; …` lines on stdout, `rc=9`) — so `2>/dev/null` discards the wrong stream; and `|| echo NXDOMAIN` never fires, because `head` is the pipeline's last command and exits 0 whatever dig concluded. What reached `detail` was neither "the record is wrong" nor "no answer" but an *answer-shaped* string nobody measured, printed as `got <it>, expected <ip>`.
- **The change (`tools/system-status`, `[0.4.73]`)**: a `dns_query <resolver> <type> <name>` helper that **classifies** before anyone reads — `answer` (a usable line, *including the empty one*, because "no such record" is an answer: empty value, exit 0) vs `transport` (diagnostics and/or a failed dig: no reading at all); a `;;` line is never a value. `check_dns` now asks **both** public resolvers, the double sighting `check_mx` and `check_soa_serial` already performed and it alone did not. Four verdicts, each with a reason to exist: `ok` `<ip> on 1.1.1.1+8.8.8.8` (every answering resolver agreed, both named) · **`warning`** `<ip> on 1.1.1.1 (8.8.8.8 unreachable - single-resolver reading)` (one witness, loud, **exit 0** — the false red is gone without going green on a thin reading) · **`error`** `… both resolvers unreachable … DNS UNVERIFIED` (nothing measured → nothing claimed → nothing passes) · **`error`** `<resolver> answered '<ip>', expected <ip>` (drift is still drift, now attributed). `--help` gained a `dns verdicts` section stating all four and the dig property that makes the classifier necessary. Check count unchanged at **35**.
- **A defect my own first draft shipped, caught by the suite's non-vacuity guard and recorded rather than smoothed over**: the tool runs under `set -euo pipefail`, so `out=$(dig …)` **aborted the entire dashboard the moment a resolver failed** — no output at all, exit 9 (dig's code leaking past the documented 0/1/2), `rc=$?` never reached — and `first=$(… | grep -v '^;;' | head -1)` died the same way, because when every line is a diagnostic `grep` selects nothing, exits 1 and `pipefail` promotes it. Evidence: the suite's **16 failures, every one `mutant produced no output`**. That guard is the `[0.4.72]` lesson applied prospectively — an assertion whose subject is dead is vacuous — and it turned what would have been a false green into a red on the first run. Both substitutions are now guarded (`|| rc=$?`, `|| true`). Worth writing down: the old one-liner was errexit-safe *by accident* (`|| echo` made the pipeline succeed), and that accident was load-bearing for a line nobody had tested under a real timeout.
- **Tests — `tests/test_system_status_dns.sh` (49 assertions, 4 mutations)**, hermetic, with a dig stub **scenario-driven per resolver** (`STUB_A_{11,88}_{MODE,VALUE}` = `ok|wrong|nxdomain|transport`) that models dig's **real** failure shape (four `;;` lines on stdout + exit 9) — a stub that failed politely would never have found the errexit defect. Sections: both-answering `ok`/exit 0; **the regression itself** (1.1.1.1 down + 8.8.8.8 correct → `warning`, no `communications error` anywhere in the detail, all **seven** rows warn so one green row cannot hide it, exit 0, plus the mirror case); both down → `error` + `DNS UNVERIFIED` + exit 1; drift on one → `error` naming it + exit 1; drift on both; NXDOMAIN reported as an *answer*, never as an unreachable resolver; all seven names through `dns_query` with the old one-liner asserted **gone**; three `--help` needles; **dig's exit 9 asserted never to reach the caller**. Mutations M1–M4 (transport branch removed, both-unreachable guard removed, `;;` filter removed — i.e. the defect itself, verbatim — drift guard inverted), each asserting **non-empty mutant output first**.
- **Regression (authoritative)**: `./tools/regression-run --format json` → **46 suites, 3748 passed, 0 failed, 0 skipped, exit 0**. Closure is arithmetic: **45 + 1 = 46** suites and **3699 + 49 = 3748**, i.e. exactly this suite added and **not one assertion moved in any other suite** — the expected result for a step that touched one tool, its `--help` and three markdown files.
- **Live health (all measured after the change, none carried)**: three consecutive runs → `overall ok, errors 0`, every `DNS:*` row `77.90.15.49 on 1.1.1.1+8.8.8.8`, exit 0, ~34s each; `system-status --format json` → **35 checks, errors 0**; `repo-lint --format json` → `ok true, files_total 184, failures []`; `source-sync-check` → in sync, 42 files / 2 envs; `queue-source-check` → `ok`, `[0.4.73]` pointer-only, 111 item lines frozen across 31 sections; `tls-check` → 9/9 (87d + 89d); all five units active. Standing warnings only: `cloud` (`installed=false` — the §14 block), `SOA:gladex.de` (mname placeholder, investor-owned), `promote-gates` (reviewer verdict stale).
- **Docs**: `CHANGELOG.md` gained **`[0.4.73]` parked at the bottom** like `[0.4.29]`–`[0.4.72]` (78 headings), pointer-only `### Queue` so `queue-source-check` stays green and `## [0.4.28]` remains the top entry the two version suites key off; `tools/REGISTRY.md` §system-status — the DNS bullet rewritten to the classify-both-resolvers/four-verdict contract, the new suite added under Tests, and a `[0.4.73]` clause appended to the Status history.
- **Safety**: model spend **0.00** (`*-free` only), **no money moved** (`BUDGET.md` untouched: **1.50 spent / 3.50 remaining**), **zero DNS writes** (no `pdns-api.py` call — `dns_query` reads the *public* resolvers only), no paid API key configured, **no secret read or printed** (`/root/.pdns-token` untouched, no credential in any prompt/thread/commit), **no service restarted, no certificate touched, Docker stacks and both investor apps untouched**. The only live I/O: read-only `dig` against 1.1.1.1/8.8.8.8, the read-only probes in the STEP-0 reply, and `system-status`'s own checks.
- **Staging discipline (the documented hazard, applied)**: `git status --porcelain` read immediately before staging → exactly this run's five paths (`M CHANGELOG.md`, `M tools/REGISTRY.md`, `M tools/system-status`, `M agent-logs/PROGRESS.md`, `?? tests/test_system_status_dns.sh`), no other identity's WIP present; staged **explicitly by path, never `git add -A`**.
- **Still blocked (investor-owned, unchanged)**: NEEDS-INVESTOR **§14 cloud admin credentials** (ONE shared set for Nextcloud + Immich — blocks INBOX line 452's six accounts and the test-photo upload), **#57 public investor-route gating A/B/C**, **SOA MNAME** (`a.misconfigured.dns.server.invalid.`), the **mail password rotation** approval, and the two `photos.`/`cloud.` exposure questions (public https from outside this container; the separate nft DNAT of `:8080`/`:2283`).
- **Next-candidate queued, not actioned**: carry items (2)–(9), (11), (14) and (15) from the 14:59Z entry unchanged — **(16) new from this step**: `check_mx` and `check_soa_serial` have the **same** transport-quoting defect this entry fixed in `check_dns` — both build their `detail` straight out of `$(dig …)`, so an unreachable resolver reads `got ';; communications error …'@1.1.1.1 …` and `insane serial 'to'@1.1.1.1 …`, and both treat *one* unreachable resolver as an error where `check_dns` now warns. Same class, but they carry `test_system_status_mx_soa.sh` and the investor's standing MX rule ("any answer that is not the expected one on EITHER resolver is an error"), so their verdicts deserve their own step rather than a ride-along; **(17) new from this step**: the dashboard's wall clock is **~34s** end to end (seven serial `check_dns` lookups among them), which is what made a 4×33s loop look like a hang from the outside — worth either batching the DNS block or documenting the expected duration, so the next reader measures it instead of inferring it.
EOF
echo appended; ./tools/queue-source-check --format json | python3 -c "import json,sys; d=json.load(sys.stdin); print('ok',d['ok'],d['detail'])"
appended
ok True one queue: [0.4.73] pointer-only, 111 item line(s) frozen across 31 section(s), 52 PROGRESS bullet(s)
> build · mimo-v2.6-flash-free
$ cd /data/repo && ./tools/repo-lint --format json 2>&1 | python3 -c "import json,sys; d=json.load(sys.stdin); print('ok',d['ok'],'files',d.get('files_total'),'changelog',d.get('changelog_version'),'failures',d['failures'])"; echo "--- status"; ./tools/system-status --format json 2>&1 | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['overall'],'checks',len(d['checks']),'errors',d['errors'])"; echo "--- git status"; git status --porcelain
ok True files 184 changelog {'attempted': True, 'path': 'CHANGELOG.md', 'entries': 77, 'unique': 77, 'unparseable': 0, 'duplicates': [], 'ok': True, 'reason': None, 'summary': '77 changelog version heading(s), 77 unique'} failures []
--- status
ok checks 35 errors 0
--- git status
 M CHANGELOG.md
 M agent-logs/PROGRESS.md
 M tools/REGISTRY.md
 M tools/system-status
?? tests/test_system_status_dns.sh
> build · mimo-v2.6-flash-free
$ cd /data/repo && ./tools/regression-run --format json 2>&1 | python3 -c "
import json,sys
d=json.load(sys.stdin)
print('ok',d['ok'],'exit',d['exit_code'],'totals',d['totals'])
for s in d['suites']:
    if s['failed']: print('FAILED', s.get('name'), s['failed'])
"
ok True exit 0 totals {'passed': 3748, 'failed': 0, 'skipped': 0, 'suites_run': 46}
> build · mimo-v2.6-flash-free
$ cd /data/repo && git add CHANGELOG.md agent-logs/PROGRESS.md tools/REGISTRY.md tools/system-status tests/test_system_status_dns.sh && git status --porcelain && git -c user.name="Atlas" -c user.email="atlas@gladex.de" commit -q -m "fix/tools: system-status DNS rows classify dig's transport diagnostics instead of quoting them as the record's value — one blip in eight runs published 'got ;; communications error to 1.1.1.1#53: timed out, expected 77.90.15.49' and took the dashboard to exit 1; both public resolvers now asked, unreachable = loud warning (exit 0) / both unreachable = DNS UNVERIFIED error, guarded against set -e killing the run outright; test_system_status_dns 49 assertions + 4 mutations; CHANGELOG [0.4.73] parked bottom; regression 46 suites / 3748 passed / 0 failed" && git log --oneline -2 && git show --stat --oneline HEAD | tail -8
M  CHANGELOG.md
M  agent-logs/PROGRESS.md
A  tests/test_system_status_dns.sh
M  tools/REGISTRY.md
M  tools/system-status
df567ec fix/tools: system-status DNS rows classify dig's transport diagnostics instead of quoting them as the record's value — one blip in eight runs published 'got ;; communications error to 1.1.1.1#53: timed out, expected 77.90.15.49' and took the dashboard to exit 1; both public resolvers now asked, unreachable = loud warning (exit 0) / both unreachable = DNS UNVERIFIED error, guarded against set -e killing the run outright; test_system_status_dns 49 assertions + 4 mutations; CHANGELOG [0.4.73] parked bottom; regression 46 suites / 3748 passed / 0 failed
bd31ca8 feat/tools: system-status gains a second TLS row (photos./cloud. lineage), 34 -> 35 checks, each row verifying the cert it reads covers its own SNI; test_system_status_tls_expiry 60/35 run log: STEP 0 first (0 unread dev/prod, fresh-probe reply dev 70 / prod 36), regression 45 suites / 3699 passed / 0 failed / 0 skipped
df567ec fix/tools: system-status DNS rows classify dig's transport diagnostics instead of quoting them as the record's value — one blip in eight runs published 'got ;; communications error to 1.1.1.1#53: timed out, expected 77.90.15.49' and took the dashboard to exit 1; both public resolvers now asked, unreachable = loud warning (exit 0) / both unreachable = DNS UNVERIFIED error, guarded against set -e killing the run outright; test_system_status_dns 49 assertions + 4 mutations; CHANGELOG [0.4.73] parked bottom; regression 46 suites / 3748 passed / 0 failed
 CHANGELOG.md                    |  29 ++++
 agent-logs/PROGRESS.md          |  16 ++
 tests/test_system_status_dns.sh | 365 ++++++++++++++++++++++++++++++++++++++++
 tools/REGISTRY.md               |  53 +++++-
 tools/system-status             | 118 ++++++++++++-
 5 files changed, 572 insertions(+), 9 deletions(-)
> build · mimo-v2.6-flash-free
$ cd /data/repo && git push -q origin main 2>&1 | tail -5; echo "push_rc=$?"; git ls-remote origin main 2>&1 | head -2; git rev-parse HEAD
push_rc=0
df567ec618d89dd799a0f2263462194e9d3f7e46	refs/heads/main
df567ec618d89dd799a0f2263462194e9d3f7e46
> build · mimo-v2.6-flash-free
Pushed (`origin main` = `df567ec`). Now correcting my earlier investor claim — I told them "one of them a hang", which was wrong:
← Write /tmp/step0-body2.txt
Created file successfully: /tmp/step0-body2.txt
> build · mimo-v2.6-flash-free
$ python3 - <<'PY'
import sqlite3, os
body = open('/tmp/step0-body2.txt', encoding='utf-8').read()
ts = '2026-09-26T16:05:00Z'
for db in ('/opt/startup/dev/data/messages.db', '/opt/startup/prod/data/messages.db'):
    con = sqlite3.connect(db)
    cur = con.execute("INSERT INTO messages (ts, direction, body, read) VALUES (?, 'agent_to_investor', ?, 0)", (ts, body))
    con.commit()
    nid = cur.lastrowid
    unread = con.execute("SELECT count(*) FROM messages WHERE direction='investor_to_agent' AND read=0").fetchone()[0]
    tot = con.execute("SELECT count(*) FROM messages").fetchone()[0]
    print(os.path.basename(os.path.dirname(os.path.dirname(db))), 'inserted id', nid, 'total', tot, 'unread_i2a', unread)
    con.close()
PY
rm -f /tmp/step0-body2.txt
echo "--- final checks"
cd /data/repo && git status --porcelain; git log --oneline -1; ./tools/system-status --format json 2>/dev/null | python3 -c "import json,sys; d=json.load(sys.stdin); print('system-status:',d['overall'],len(d['checks']),'checks, errors',d['errors'])"
dev inserted id 72 total 72 unread_i2a 0
prod inserted id 38 total 38 unread_i2a 0
--- final checks
df567ec fix/tools: system-status DNS rows classify dig's transport diagnostics instead of quoting them as the record's value — one blip in eight runs published 'got ;; communications error to 1.1.1.1#53: timed out, expected 77.90.15.49' and took the dashboard to exit 1; both public resolvers now asked, unreachable = loud warning (exit 0) / both unreachable = DNS UNVERIFIED error, guarded against set -e killing the run outright; test_system_status_dns 49 assertions + 4 mutations; CHANGELOG [0.4.73] parked bottom; regression 46 suites / 3748 passed / 0 failed
system-status: ok 35 checks, errors 0
> build · mimo-v2.6-flash-free
Run complete.

## STEP 0 (first, before anything else)
- **Unread `investor_to_agent` = 0 in both DBs** (dev 0 / prod 0, measured — only two `messages.db` exist on the box). Nothing to mark read, nothing marked that wasn't mine.
- `INBOX.md` read: every entry struck `~~HANDLED~~` except line 452 (the six identity accounts) — open because it's **blocked** on REPORT.md §14, not missed.
- Replied anyway with *this run's* probes: **dev 71 / prod 37**, then a **correction + results** at **dev 72 / prod 38**. Both noted in `PROGRESS.md` first.

## This run's step: `system-status` was lying about DNS
Measured 8 consecutive runs on an unchanged tree — runs 1-5/7/8 green, **run 6 → `DNS:git.gladex.de error "got ;; communications error to 1.1.1.1#53: timed out, expected 77.90.15.49"`, exit 1**.

Root cause: dig writes its "resolver unreachable" text to **stdout** and exits 9, so `$(dig ... 2>/dev/null | head -1)` read the diagnostic as the record's value — and `|| echo NXDOMAIN` never fired because `head` was the pipeline's last command.

Fix (`CHANGELOG [0.4.73]`, commit `df567ec`):
- `dns_query` classifies **answer vs transport** before anyone reads; `;;` lines are never a value.
- `check_dns` now asks **both** 1.1.1.1 and 8.8.8.8 (the double sighting MX/SOA already had).
- Verdicts: both agree → `ok` · one answers → **`warning`** (loud, exit 0, never silently green) · neither → **`error … DNS UNVERIFIED`** · a resolver that *did* answer disagrees → still a hard error, now attributed.

**A second defect my own test caught before it shipped**: under `set -euo pipefail` my first draft killed the whole dashboard on a timeout (no output, exit 9). The suite's non-vacuity guard reported **16 × "mutant produced no output"** — an assertion whose subject is dead is vacuous, exactly the `[0.4.72]` lesson, applied prospectively.

## Verification
- `tests/test_system_status_dns.sh` → **49 passed / 0 failed**, 4 mutations all detected, each proven to have produced output first.
- Full regression → **46 suites, 3748 passed, 0 failed, exit 0** (45+1=46, 3699+49=3748 — arithmetic closure).
- Live ×3 → `overall ok, errors 0`, all seven rows `77.90.15.49 on 1.1.1.1+8.8.8.8`, exit 0.
- `repo-lint` ok · `source-sync` in sync · `queue-source` ok · `system-status` 35 checks / 0 errors · `tls-check` 9/9.
- Committed by explicit path (no `git add -A`), **pushed**: `origin main` = `df567ec`.

**Safety**: spend 0.00 (`*-free` only), budget untouched (1.50/3.50), **zero DNS writes**, no key read, no service restarted, no cert touched.

**Correction sent**: my earlier reply claimed "one of them a hang" — wrong. Runs take 32–38s; the 4th was cut by my own 120s budget. Corrected in the investor thread rather than left standing.

**Queued (not actioned)**: (16) `check_mx`/`check_soa_serial` share the same transport-quoting defect — they carry a pinned suite and the investor's MX rule, so they get their own step; (17) the dashboard's ~34s wall clock, worth documenting so the next reader measures it instead of inferring a hang.
exit=0

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Sat Sep 26 17:50:53 2026] 127.0.0.1:35328 Closing
[Sat Sep 26 17:50:53 2026] 127.0.0.1:35340 Accepted
[Sat Sep 26 17:50:53 2026] 127.0.0.1:35340 Closing
[Sat Sep 26 17:51:01 2026] 127.0.0.1:51328 Accepted
[Sat Sep 26 17:51:01 2026] 127.0.0.1:51328 Closing
[Sat Sep 26 17:51:01 2026] 127.0.0.1:51342 Accepted
[Sat Sep 26 17:51:01 2026] 127.0.0.1:51342 Closing
[Sat Sep 26 17:51:01 2026] 127.0.0.1:51350 Accepted
[Sat Sep 26 17:51:01 2026] 127.0.0.1:51350 Closing
[Sat Sep 26 17:52:01 2026] 127.0.0.1:45010 Accepted
[Sat Sep 26 17:52:01 2026] mailbox: sent id=leon to=mia@gladex.de
[Sat Sep 26 17:52:01 2026] 127.0.0.1:45010 Closing
[Sat Sep 26 17:52:01 2026] 127.0.0.1:45022 Accepted
[Sat Sep 26 17:52:01 2026] 127.0.0.1:45022 Closing
[Sat Sep 26 17:52:01 2026] 127.0.0.1:45038 Accepted
[Sat Sep 26 17:52:01 2026] 127.0.0.1:45038 Closing
[Sat Sep 26 17:52:01 2026] 127.0.0.1:45050 Accepted
[Sat Sep 26 17:52:01 2026] 127.0.0.1:45050 Closing
[Sat Sep 26 17:52:06 2026] 127.0.0.1:55948 Accepted
[Sat Sep 26 17:52:06 2026] 127.0.0.1:55948 Closing
[Sat Sep 26 17:52:06 2026] 127.0.0.1:55952 Accepted
[Sat Sep 26 17:52:06 2026] 127.0.0.1:55952 Closing
[Sat Sep 26 17:52:06 2026] 127.0.0.1:55954 Accepted
[Sat Sep 26 17:52:06 2026] 127.0.0.1:55954 Closing
[Sat Sep 26 17:52:07 2026] 127.0.0.1:55966 Accepted
[Sat Sep 26 17:52:07 2026] 127.0.0.1:55966 Closing
[Sat Sep 26 17:52:07 2026] 127.0.0.1:55982 Accepted
[Sat Sep 26 17:52:07 2026] 127.0.0.1:55982 Closing
[Sat Sep 26 17:52:07 2026] 127.0.0.1:55990 Accepted
[Sat Sep 26 17:52:07 2026] 127.0.0.1:55990 Closing
[Sat Sep 26 17:53:53 2026] 127.0.0.1:34330 Accepted
[Sat Sep 26 17:53:53 2026] 127.0.0.1:34330 Closing
[Sat Sep 26 17:54:45 2026] 127.0.0.1:38634 Accepted
[Sat Sep 26 17:54:45 2026] 127.0.0.1:38634 Closing
[Sat Sep 26 17:54:45 2026] 127.0.0.1:38650 Accepted
[Sat Sep 26 17:54:45 2026] 127.0.0.1:38650 Closing
[Sat Sep 26 17:54:45 2026] 127.0.0.1:38652 Accepted
[Sat Sep 26 17:54:45 2026] 127.0.0.1:38652 Closing
[Sat Sep 26 17:54:45 2026] 127.0.0.1:38654 Accepted
[Sat Sep 26 17:54:45 2026] 127.0.0.1:38654 Closing
[Sat Sep 26 17:54:45 2026] 127.0.0.1:38664 Accepted
[Sat Sep 26 17:54:45 2026] 127.0.0.1:38664 Closing
[Sat Sep 26 17:54:45 2026] 127.0.0.1:38672 Accepted
[Sat Sep 26 17:54:45 2026] 127.0.0.1:38672 Closing
[Sat Sep 26 17:54:45 2026] 127.0.0.1:38684 Accepted
[Sat Sep 26 17:54:46 2026] 127.0.0.1:38684 Closing
[Sat Sep 26 17:54:46 2026] 127.0.0.1:38694 Accepted
[Sat Sep 26 17:54:46 2026] 127.0.0.1:38694 Closing
[Sat Sep 26 17:54:46 2026] 127.0.0.1:38700 Accepted
[Sat Sep 26 17:54:46 2026] 127.0.0.1:38700 Closing
[Sat Sep 26 17:54:46 2026] 127.0.0.1:38716 Accepted
[Sat Sep 26 17:54:46 2026] 127.0.0.1:38716 Closing
[Sat Sep 26 17:54:57 2026] 127.0.0.1:36108 Accepted
[Sat Sep 26 17:54:57 2026] 127.0.0.1:36108 Closing
[Sat Sep 26 17:55:07 2026] 127.0.0.1:52738 Accepted
[Sat Sep 26 17:55:07 2026] 127.0.0.1:52738 Closing
[Sat Sep 26 17:56:37 2026] 127.0.0.1:45006 Accepted
[Sat Sep 26 17:56:37 2026] 127.0.0.1:45006 Closing
[Sat Sep 26 17:56:38 2026] 127.0.0.1:45022 Accepted