Gladex Agent Logs

18761:- **Blindness measured before a line was written, not asserted — and the defect's real shape found by writing the reader, not by reading the file.** Bas
18763:- **The step: section I plus C46, 485 → 497.** `i_reg_pair()` returns `<assertion figure>|<control figure>` from the `## test_registry_coverage.sh` sect
18771:- **Queue — next small step (read this first):** **one unnumbered follow-up closed (run 930's unpinned-figures gap), none invented.** Next, in order: **
=== closed-by phrasing after run 931 ===
24:- **Queue — next small step (read this first):** **(a‴) CLOSED by this run** — taken, read, census updated, no state change made. Next, in order: **(a⁗)** the **first run starting after sofia's failed state is
47:- **Queue — next small step (read this first):** **the `deploy-path` item is CLOSED by this run** — 8 → 0 unattested files, row green, root cause named. Next, in order: **(a⁗)** the **first run starting after 
70:- **Queue — next small step (read this first):** **the `deploy-path recurrence` item is CLOSED by this run** — the recurrence now has an executing reader, proven able to redden in both directions, rather than a re
116:- **Queue — next small step (read this first):** **(a⁗) CLOSED by this run** — the post-fire read was taken, it was still red, the census was updated from her own fresh markers, and no state was changed. Next, 
137:- **Queue — next small step (read this first):** **(a⁵) unchanged and NOT consumed by this run** — the first run starting after sofia's fire at **Tue 2026-10-13 18:55:10 CEST** (or earlier if `sofia-watch` star
162:- **Queue — next small step (read this first):** **(a⁵) unchanged and NOT consumed by this run** — the first run starting after sofia's fire at **Tue 2026-10-13 18:55:10 CEST** (or earlier if `sofia-watch` star
192:- **Queue — next small step (read this first):** **(a⁵) unchanged and NOT consumed by this run** — the first run starting after sofia's fire at **Tue 2026-10-13 18:55:10 CEST** (or earlier if `sofia-watch` star
220:- **Queue — next small step (read this first):** **(a⁵) is now LIVE and owned by the next run** — sofia's fire at **18:55:10 CEST has passed** (this run started before it, so it is not the owner): **one** `syst
238:- **Queue — next small step (read this first):** **(a⁵) is CONSUMED by this run** (started 19:25 CEST, after the 18:55:10 fire; both ordered reads taken, the still-red branch executed, comparisons recorded above)
266:- **Queue — next small step (read this first):** **(a⁶) NEW and dated — the lena re-read, re-specified by this entry** (run 941's item, *not* consumed here): the next builder run *starting after* lena's timer *
286:- **Queue — next small step (read this first):** **(a⁶) unchanged and NOT consumed by this run** — the next builder run *starting after* lena's timer **Wed 2026-10-14 08:05:17 CEST** runs `./tools/shift-census 
315:- **Queue — next small step (read this first):** **(a⁶) unchanged and NOT consumed by this run** — the next builder run *starting after* lena's timer **Wed 2026-10-14 08:05:17 CEST** runs `./tools/shift-census 
347:- **Queue — next small step (read this first):** **(a⁶) unchanged and NOT consumed by this run** — the next builder run *starting after* lena's timer **Wed 2026-10-14 08:05:17 CEST** runs `./tools/shift-census 
368:- **Queue — next small step (read this first):** **(a⁶) unchanged and NOT consumed by this run** — the next builder run *starting after* lena's timer **Wed 2026-10-14 08:05:17 CEST** runs `./tools/shift-census
> build · mimo-v2.6-flash-free
$ cd /data/repo && grep -n "unnumbered" agent-logs/PROGRESS.md | awk -F: '$1>18900' | cut -c1-300
18908:- **Queue — next small step (read this first):** **(a⁵) unchanged and NOT consumed by this run** — the first run starting after sofia's fire at **Tue 2026-10-13 18:55:10 CEST** (or earlier if `sofia-watch` starts her on new mail) owns **one** `systemctl --failed` read **plus the in-fligh
18963:- **Queue — next small step (read this first):** **(a⁵) unchanged and NOT consumed by this run** — the first run starting after sofia's fire at **Tue 2026-10-13 18:55:10 CEST** (or earlier if `sofia-watch` starts her on new mail) owns **one** `systemctl --failed` read **plus** the in-fli
19031:- **One new unnumbered follow-up, deliberately not numbered: `work=` cannot answer the question its own comment says it exists for.** The `[0.4.299]` block states *"the work field says whether that red cost anything"* and builds on a measured triad (1664 insertions committed then a non-zero rc
19139:- **Queue — next small step (read this first):** **(a⁶) unchanged and NOT consumed by this run** — the next builder run *starting after* lena's timer **Wed 2026-10-14 08:05:17 CEST** runs `./tools/shift-census --format json` **and** `./tools/system-status` **and** `git show --numstat <th
$ cd /data/repo && awk 'NR>18771 && /shift-tally/ {print NR": "substr($0,1,300)}' agent-logs/PROGRESS.md | tail -20; echo "=== count of shift-tally mentions after 18771 ==="; awk 'NR>18771 && /shift-tally/' agent-logs/PROGRESS.md | wc -l
19139: - **Queue — next small step (read this first):** **(a⁶) unchanged and NOT consumed by this run** — the next builder run *starting after* lena's timer **Wed 2026-10-14 08:05:17 CEST** runs `./tools/shift-census --format json` **and** `./tools/system-status` **and** `git show --numstat <the in-window 
=== count of shift-tally mentions after 18771 ===
1
> build · mimo-v2.6-flash-free
$ cd /data/repo && ./tools/inbox-status >/dev/null 2>&1; echo "inbox rc=$?"; ./tools/version-check; ./tools/budget-show; ./tools/healthcheck 2>&1 | tail -5; echo "=== red-watch state ==="; tail -c 600 /data/agent-logs/red-watch.state 2>/dev/null || ls /data/agent-logs/ | head
inbox rc=0
OK: dev=0.4.28 prod=0.4.28 (match)
=== Budget Status ===
Month:       2026-10
Allowance:   5.00 €
Spent:       0.00 € (no October charge in any file — MEASURED 2026-10-12: no public registry source can date a renewal (DENIC RDAP publishes only a "last changed" event, and does so for every .de domain; DENIC whois has no expiry field; the IANA RDAP bootstrap has no "de" entry), so the one open unknown is your billing cadence: monthly 1.50 as brief §4 states, or annual at the 2027-09-20 registration anniversary? Still NEEDS-INVESTOR, REPORT.md §14)
Remaining:   5.00 €

Log:
  - 2026-09-20: init, no domains ordered yet
  - 2026-09-20: investor APPROVED gladex.de (1.50/mo). Awaiting registrar purchase + DNS creds.
  - 2026-09-20: purchase completed same day — RDAP status active (changed 2026-09-20T11:10:57+02:00), DNS wired via pdns wrapper (A apex/dev/git/info/stats/log/team -> 77.90.15.49, MX 10 gladex.de), dig-verified; DOMAIN.md holds evidence.
  - 2026-09-24: ledger narrative corrected — spent-line still said "purchase pending at registrar" 4 days after registration (queued candidate #1); numbers unchanged (1.50/3.50, no money moved), log history above kept verbatim.
  - 2026-10-01: month rolled per brief §4 (balance resets to 5.00 on the 1st, unspent does NOT roll over). September history above is kept verbatim; September closed at spent 1.50 / remaining 3.50.
  - 2026-10-02: October opened at spent 0.00 / remaining 5.00 because no October charge exists in any file on this box — while gladex.de is a known 1.50/mo recurring cost with NO renewal date recorded anywhere. Figure to be corrected the moment the investor answers REPORT.md §14.
  - 2026-10-12: renewal date MEASURED instead of left open, figure unchanged (0.00 / 5.00, no money moved): (1) DENIC RDAP rdap.denic.de/domain/gladex.de returns exactly ONE event — "last changed 2026-09-20T11:10:57+02:00", i.e. the purchase day already on file — and NO registration/expiration event; (2) controls denic.de ("last changed 2024-12-19T13:33:43+01:00") and bund.de ("last changed 2026-06-17T13:11:54+02:00") return the same one-event shape, so this is how DENIC answers for EVERY .de domain, not a gap in ours; (3) DENIC whois (port 43) prints only "Domain: gladex.de" + "Status: connect" — no expiry field; (4) the IANA RDAP bootstrap (data.iana.org/rdap/dns.json, 592 services) contains no "de" entry and no "denic" service, so the standard bootstrap path rdap.org/domain/gladex.de answers 404 (control: example.com answers 302). Conclusion: NO public registry source can date a renewal — only the investor's registrar account can, so REPORT.md §14 stays open with its question narrowed to the billing cadence. Registry-side, the only anchor on file is registration 2026-09-20 (this log line of 2026-09-20, corroborated by the RDAP timestamp), whose first anniversary falls 2027-09-20 — so no registry-side event lands in October 2026.
  HTTP: 200
  Response: {"status":"ok","service":"gladex-investor-app","env":"dev","timestamp":1791939134,"version":"0.4.28"}
prod: HEALTHY
  HTTP: 200
  Response: {"status":"ok","service":"gladex-investor-app","env":"prod","timestamp":1791939134,"version":"0.4.28"}
=== red-watch state ===
state=red
since=1791893840
failed=2
fails=FAIL A12 system-status verdict - checks in error: failed-units (kind=is key=sysverdict) ;; FAIL A30 no unit is left in systemctl --failed (kind=contains key=sys)
updated=2026-10-14T00:45:01Z
$ cd /data/repo && awk 'NR>18771 && /section I|C46|registry coverage figures/ {print NR": "substr($0,1,240)}' agent-logs/PROGRESS.md | head; echo "=== last commit touching test_shift_tally ==="; git log -3 --format='%h %ad %s' --date=short -- tests/test_shift_tally.sh; echo "=== queue-source-check baseline ==="; ./tools/queue-source-check; echo "rc=$?"
18837: - **Suites, all run on this tree, none inherited.** `bash tests/test_deploy_ledger.sh` → **44 passed / 0 failed, rc 0**; `php tests/test_changelog_mobile.php` → **125 / 0**; `php tests/test_changelog_api.php` → **86 / 0** (the reference par
=== last commit touching test_shift_tally ===
48a1053 2026-10-13 run 928: section N pins the --format default claim and the registry's third copy of both default claims, 187 -> 203; both docs-only plants measured green on the committed suite first
52e72c8 2026-10-13 run 927: section L pins help/behavior agreement on the default (the option-help claim vs the epilog claim vs the flagless run), 171 -> 187; both docs-only plants measured green on the old suite first
60ff42e 2026-10-13 run 1087: 2026-10-13T01:53Z model=opencode/mimo-v2.6-flash-free
=== queue-source-check baseline ===
queue-source-check: OK - one queue: [0.4.338] pointer-only, 111 item line(s) frozen across 292 section(s), 203 PROGRESS bullet(s), 2 path token(s)
rc=0
> build · mimo-v2.6-flash-free
$ cd /data/repo && grep -n "follow-up\|queued\|deliberate" tests/test_shift_tally.sh | cut -c1-200; echo "=== REGISTRY shift-tally section follow-ups ==="; awk '/^## shift-tally/,/^## [a-z]/' tools/REGISTRY.md | grep -n "follow-up\|mutant\|queued" | cut -c1-260
5:# deliberate follow-up, and the run that lands the 104th suite owns the `- Live`
31:#   * the DEFAULT mode (run 925's queued gap): `--dedup both` is the flag's
38:#   * the help/behavior AGREEMENT on that default (run 926's queued gap):
48:#     claims (run 927's queued gap): `--format`'s `(default: human)` is read
686:# `first_ts` / `last_ts`. Run 924 queued exactly that, and the blindness was
768:# Run 925 queued exactly this: `--dedup both` is the parser's default
902:# Run 926 queued exactly this: K and M10 pin the BEHAVIOR of the default
986:# Run 927 queued exactly this, one flag over from section L. Two claims are
=== REGISTRY shift-tally section follow-ups ===
$ cd /data/repo && grep -rn "shift-tally" tools/REGISTRY.md | grep -i "follow\|mutant" | cut -c1-300; echo "=== ls tests count ==="; ls tests | wc -l; ./tools/regression-run --list 2>/dev/null | tail -2
4987:- Live (measured 2026-10-13): `./tools/regression-run` → **108 suites** discovered *(Refreshed 106 → 107 on 2026-10-13 by the run that added `tests/test_shift_deploy.sh`, the 107th suite; the refresh clears the `figure_stale` violation section F would otherwise report.)* — the suite count
=== ls tests count ===
108
  test_webmail_session_routing.php
result: 108 suite(s) discovered, none run (exit 0)
> build · mimo-v2.6-flash-free
$ cd /data/repo && grep -rln "i_reg_pair" tests/ tools/; echo "=== who reads another suite's REGISTRY section figures ==="; grep -rn "REGISTRY_SECTION\|_REGISTRY=" tests/*.sh | cut -c1-180 | head -20; echo "=== assertion-figure readers in tests ==="; grep -rln "assertion(s)\? .*figure\|figure.*assertion" tests/ | head
tests/test_registry_coverage.sh
=== who reads another suite's REGISTRY section figures ===
tests/test_registry_coverage.sh:1840:        REGISTRY_COVERAGE_REGISTRY="$d/tools/REGISTRY.md" \
tests/test_registry_coverage.sh:1869:      REGISTRY_COVERAGE_REGISTRY="$cov_registry" \
=== assertion-figure readers in tests ===
tests/test_regression_run.sh
tests/test_registry_coverage.sh
$ cd /data/repo && awk 'NR>18771' agent-logs/PROGRESS.md | grep -c "i_reg_pair"; awk 'NR>18771' agent-logs/PROGRESS.md | grep -o "the two figures[^.]\{0,160\}" | head; echo "=== run 932 queue head ==="; sed -n '18777,18780p' agent-logs/PROGRESS.md | cut -c1-300
0
=== run 932 queue head ===
## Builder — run 932 — queue line (a‴) taken: the one post-fire read shows **1 failed unit** (mia cleared to green, sofia's is fresh) — census updated from sofia's own error string `Upstream request failed: Endpoint is unavailable.` and classified **work kept** at `work=853ins/1files`, again

- **STEP 0, paid first, before the queue was read — owed nothing, no row written.** Schema re-checked first (table `messages`, direction in its `direction` column), then `SELECT COUNT(*) FROM messages WHERE direction='investor_to_agent' AND read=0` → **0 dev / 0 prod**; `./tools/inbox-status` �
> build · mimo-v2.6-flash-free
$ cd /data/repo && grep -n "^  [0-9]\{3\} assertions\|→ \*\*[0-9]\{3\} assertions\|assertions\*\*" tools/REGISTRY.md | head -20; echo "=== sections with figures ==="; grep -nE "^- \`bash tests/[a-z_]+\.sh\` → \*\*[0-9]+ assertions" tools/REGISTRY.md | head -20
131:- `bash tests/test_domain_availability.sh` → **140 assertions**, hermetic (dig/curl/whois are scenario-driven stubs on PATH — no network touched — plus one offline case inside `unshare -n`, a network namespace with no routes, which is deterministic precisely because it has none): arg/`--help` contract incl. the exit-code table, `--timeout` validation (`0`/negative → 2), happy path + JSONL/human contracts and the new top-level keys, source evidence (DENIC vs rdap.org URL, `--max-time`/`+time`/`+tries` reaching each tool), the **exit-code contract `3` vs `4`** (all lookups failing and the offline machine → `4`, never `0` + `AVAILABLE`; DNS-only positives with failed checks downgraded; authoritative verdicts still deciding `0`/`3` with failures visible), failure classification per source (`timeout`/`network`/`tool_missing`/`bad_response`/`http_error`), **`--timeout` honored** (a check hanging 6s is cut near the deadline → `4`), static guards (no `getaddrinfo`, every dig call carries `+time=`, no paid-API/credential strings, contract fields documented here), **5 mutations** — M1 folds exit 4 back into 3, M2/M3 stop passing `--max-time`/`+time` to curl/dig, M4 lets failed checks vote again (the original defect), M5 defeats the positive-verdict downgrade — each precondition-asserted to occur exactly once, must RUN and give the wrong verdict, and be re-checked as surgical on a clean run.
133:- `bash tests/test_dig_tools_transport.sh` → **80 assertions** (shared with `dns-verify` and `ip-drift-check`): three dig transport shapes against this tool with **RDAP and whois deliberately failing** so DNS is the *only* completed check and its reading decides the verdict — `transport`/`transport-err`/`masked` each → exit **4**, `available` `null`, `checks_failed` 3, `checks.dns.dns.error` in (`timeout`,`network`) and **no `;;` anywhere in `checks.dns.dns.records`** (pre-fix the masked shape stored the complaint as an NS record and answered **TAKEN, exit 3**), plus mutant M3 which must reproduce exactly that.
197:- `bash tests/test_budget_show.sh` → **89 assertions**, hermetic (fixtures in a throwaway sandbox under `${TMPDIR:-/tmp}/opencode/`, trap-cleaned; only one case reads the real ledger, read-only and content-agnostic so a future approved purchase cannot spuriously fail it): hook honored (fixture month ≠ live month proves it), JSON key-set + numeric `spent` + `spent_note` split, human format (currency glued to amount), every ledger violation → exit 1 with the field named (empty / missing `remaining:` / non-numeric / trailing text / math mismatch / overspend / bad month / missing file), **month freshness (112)**: fresh → `warnings: []` and no `WARN:` row, stale → exit **0** with one warning naming both months and the numbers intact, the **real ledger forced stale by the hook** → still exit 0, `GLADEX_CURRENT_MONTH=September` → exit **2** *before* the ledger is read, `--help` documents both hooks + exit codes, arg contract 0/2, static no-write guard, **3 mutations** (M1 validation gate defeated, M2 `_math_ok` forced true, **M3** the freshness comparison forced true — each precondition-asserted to occur exactly once; M2/M3 re-checked to stay surgical: still reject the empty ledger, still accept the valid one, and M3 must keep exiting 0 while going silent); **section Z** (queue item (128), 6th of 9: the `SB_ALL` ledger — the one factory's every `mktemp` is recorded on the line *after* it succeeds, `cleanup()` iterates the ledger and ends `return 0`, and Z1–Z10 read the EXIT trap's claim while the run is still alive: **Z1** the accounting derived from this file (`3 entries = 1 new_sandbox section call + these 2`, the count read by `grep -c '^new_sandbox$'` so Z's own suffixed calls fall outside it), **Z2** no directory recorded twice, **Z3/Z4** both fresh sandboxes on disk and in the ledger in creation order, **Z5** one `cleanup()` removed every recorded directory, **Z6** the pre-fix one-liner reproduced on purpose (it removes only the last `$SB`, leaving the first of a pair standing — the N-minus-one leak this suite could not see while its factory ran once), **Z7** every factory in the file records into the ledger (both counts derived from the source, neither reader able to count its own source — the recorder pattern carries an escaped dollar so its own line cannot match itself; 1 factory today, so a future second one cannot hide), **Z8/Z9** the leak reader counts directories never files (a directory and a file sharing the `bs.*` prefix side by side: 1 vs 2, then 0 vs 1), **Z10** one `cleanup()` leaves zero ledger directories on disk, read with the same directory reader)
263:- `bash tests/test_dns_verify.sh` → **40 assertions**, hermetic (<5s, scenario-driven `dig` stub on PATH: `ok`/`empty`/`netfail`/`sleep`; one case runs with a PATH containing only python3 to simulate a missing `dig` — live DNS never touched): arg/`--help` contract, type + domain rejection (`2`), happy path + JSONL/human/`--format` contracts, default 7-type query, **exit-code contract `3` vs `4`** (unreachable resolver and missing `dig` both → `4`, not `3`), **`--timeout` honored** (`+time=N` reaches dig, a 5s-hung dig is cut at ~3s → `4`, `--timeout 0` → `2`), `--server` pass-through, **2 mutations** (M1 folds network errors back into `exit 3`; M2 defeats the type guard — both must RUN and give the wrong verdict, each precondition-asserted to be surgical)
265:- `bash tests/test_dig_tools_transport.sh` → **80 assertions** (shared with `domain-availability-check` and `ip-drift-check`), hermetic (scenario `dig`/`curl`/`whois` stubs + a `127.0.0.1` IP-echo server): the dig transport-shape contract in three shapes — `transport` (measured: `;;` on stdout, stderr empty, rc 9), `transport-err` (`;;` on stderr, rc 9), `masked` (`;;` on stdout with rc 0, the wrapper-masked shape real dig does not produce) — asserting exit **4** and `network_errors=7` in every one, **no `;;` in `records`**, the complaint reaching the caller as an *error* (JSON and human, quoted only under `Network errors:` with no `Records:` section), harness sanity that pins the stub itself to the measurement (stdout diagnostics + **stderr empty** + rc 9), `no-json` never counting as "no `;;`", and **4 mutants** (drop `or diagnostics`, stop rejecting `;;` lines, and their two siblings) each precondition-asserted surgical, byte-different and non-empty-output. Pre-fix replay against the `HEAD` blobs → **58 passed / 13 failed** (7 of them this tool: 2 wrong-stream detail + 5 masked-shape).
309:- `bash tests/test_healthcheck.sh` → **122 assertions, exit 0** (suite added 2026-10-07: the arg contract with every refusal's stream, the live reading of both envs, five hermetic endpoint worlds on local ephemeral ports, and four plants — this section's four bullets were the whole of the tool's testing until then, hand-run and never re-run). Every input of those four plants has a reader since `[0.4.259]`: the M3 plant's dead port short-circuited to a bare `fi`, so an empty `free_port` skipped both M3 assertions and the suite still exited 0 — now an `elif … bad` guard, proven by an 11-shape probe that read **10 / 11 caught** before the pin and **11 / 11** after.
651:- `tests/test_deploy_ledger.sh` → **44 assertions**, the LIVE standing assertion for
665:- `tests/test_promote_gate.sh` → **129 assertions**, hermetic sandbox, **5 mutations**
724:- `tests/test_promote_lint_gate.sh` → **199 assertions**, hermetic sandbox, **16 mutations**
869:- `tests/test_promote_json.sh` → **183 assertions** (the **175** this suite always
1056:- `bash tests/test_ip_drift_check.sh` → **133 assertions**, hermetic: a scenario-driven IP-echo server on `127.0.0.1` (via `IPDRIFT_IP_URLS`, per-path scenarios: ok / html / empty / IPv6 / CGNAT / 500 / JSON-without-ip) plus a scenario `dig` stub on PATH (`ok`/`cname`/`nodata`/`netfail`/`sleep`) — no network is touched and no real service sees our egress IP. Covers the arg/`--help` contract (`--timeout 0`/`-1`/`abc` → `2`, invalid `--domain`/`--dns-server` → `2`, stdout empty on arg errors), the JSON/human contracts and key set, **unvalidated answers never deciding** (HTML → `3` not `1`, failover to the next service, empty/500 handling), **IPv6 → `3` not `1`** while **CGNAT stays a verdict**, **`dig` answers filtered to IPv4 literals** (a CNAME target → `no_a_records`, never drift), the **`no_a_records` vs `dns_lookup_failed`** split (plus missing `dig`), `--timeout` reaching dig as `+time=N +tries=1` and bounding a hanging lookup, `--dns-server` pass-through (single call, `@server`), static read-only/docs guards and the REGISTRY contract, one guarded live case, and **6 mutations** (M1 timeout gate, M2 domain gate, M3 IP-literal gate, M4 address-family gate, M5 IPv4-only DNS filter, M6 failure classification) — each precondition-asserted to occur exactly once, must RUN and give the wrong verdict, with a surgical control on the happy path.
1057:- `bash tests/test_dig_tools_transport.sh` → **80 assertions** (shared with `dns-verify` and `domain-availability-check`): three dig transport shapes against this tool with the public-IP leg served from `127.0.0.1` — all three → exit **3**, `error_code` `dns_lookup_failed`, `drift` `null`, **no `;;` in `dns_records` and none echoed into the output**. Pre-fix the rc-9 shapes already passed (the `returncode != 0` gate plus the IPv4-literal filter were sound); the masked shape reported `no_a_records` = *"query completed with no answer"* for a query that never completed, which mutant M4 must reproduce.
1113:- `bash tests/test_pdns_api.sh` → **175 assertions**, hermetic: a fake PowerDNS API (python3 stdlib on `127.0.0.1`, scenario file drives 200/204/401/422/garbage/scalar/wrapped/drop/hang) plus the `PDNS_*` hooks — the live zone is never contacted and `/root/.pdns-token` is never read. The suite **refuses to run (exit 2)** against a tool that hardcodes the live credential paths without the hooks, because replaying the pre-fix code would have aimed every dangerous write at the real zone. Covers: usage/`--help` contract (exit 0, works with no credentials); credential contract (missing/empty/base-not-a-URL → exit 1, path named, no traceback, **key never in output**, key observed in the `X-API-Key` header); read and write payload contracts (`rrsets[0].name/type/ttl/content/disabled`, default TTL 3600, apex `@`); the **`set-txt` regression** (payload carries the real text, quoted for PowerDNS presentation format, no double-quoting, inner quotes escaped, a stray second word → exit 2 not a traceback); every safety gate refusing with exit 2 and **zero requests** (TTL 86400/0/-5/`soon`, all forbidden types, foreign zone for `set-a`/`delete`/`records`); API/network failures → exit 1 with empty stdout and no traceback (401, 422, dropped connection, connection refused, a hang cut off by `PDNS_TIMEOUT`); static guards (no key-printing path, no credential literal, py_compile) and the REGISTRY contract above.
1227:- `bash tests/test_ip_drift_cron.sh` → **340 assertions** (measured 2026-10-06; was **307**
1381:  verdict, with a clean control); **581 assertions** measured 2026-10-07 (the
2442:- `bash tests/test_verify_landing.sh` → **55+ assertions**, hermetic (stub curl
2521:- `bash tests/test_disk_show.sh` → **90 assertions**, hermetic (everything but case J runs against fixture files in a throwaway sandbox under `${TMPDIR:-/tmp}/opencode/`, trap-cleaned; no network, no DNS, no services, nothing outside the sandbox written): the arg contract (**8** ways to reach exit 2, stdout empty on each), the JSON key-set and `ok ⇔ exit 0`, the breach through `GLADEX_DISK_FIXTURE` (95 % → **3**, 10 % → **0**) and the **boundary** (90 % at `--threshold 90` → **3**, so the comparison is `>=`), precedence **2 > 1 > 4 > 3 > 0** with a fixture path and a real `statvfs` path both reaching exit 4, the reclaimable table through `GLADEX_DISK_PATHS_FILE` (exact bytes for a 1000-byte file, absent path reported not hidden, `reclaimable_bytes` closing against the rows), four broken-hook shapes → exit 1 with empty stdout, static guards (no delete/write API, no child left behind, no network API), **2 precondition-asserted mutations** — the exit-3 decision defeated and the `>=` boundary flipped to `>` — each must RUN and wrongly exit 0, each re-checked surgical (still 4 for cannot-verify / still 3 on a real 95 % breach), and **section Z** (queue item (128), 7th of 9: the `SB_ALL` ledger — the one factory's every `mktemp` is recorded on the line *after* it succeeds, `cleanup()` iterates the ledger and ends `return 0`, and Z1–Z10 read the EXIT trap's claim while the run is still alive: **Z1** the accounting derived from this file (`3 entries = 1 new_sandbox section call + these 2`, the count read by `grep -c '^new_sandbox$'` so Z's own suffixed calls fall outside it), **Z2** no directory recorded twice, **Z3/Z4** both fresh sandboxes on disk and in the ledger in creation order, **Z5** one `cleanup()` removed every recorded directory, **Z6** the pre-fix one-liner reproduced on purpose (it removes only the last `$SB`, leaving the first of a pair standing — the N-minus-one leak this suite could not see while its factory ran once), **Z7** every factory in the file records into the ledger (both counts derived from the source, neither reader able to count its own source; 1 factory today, so a future second one cannot hide), **Z8/Z9** the leak reader counts directories never files (a directory and a file sharing the `ds.*` prefix side by side: 1 vs 2, then 0 vs 1 — this suite's standing `/tmp/opencode` inventory is the disagreement in the wild: **1 glob match, 0 directories**), **Z10** one `cleanup()` leaves zero ledger directories on disk, read with the same directory reader)
3496:- `bash tests/test_system_status_unread.sh` → **24 assertions**, hermetic and <1s
3521:- `bash tests/test_system_status_mx_soa.sh` → **31 assertions**, hermetic and <1s
3596:- `bash tests/test_system_status_go_compile.sh` → **109 assertions, 6 mutations**,
=== sections with figures ===
131:- `bash tests/test_domain_availability.sh` → **140 assertions**, hermetic (dig/curl/whois are scenario-driven stubs on PATH — no network touched — plus one offline case inside `unshare -n`, a network namespace with no routes, which is deterministic precisely because it has none): arg/`--help` contract incl. the exit-code table, `--timeout` validation (`0`/negative → 2), happy path + JSONL/human contracts and the new top-level keys, source evidence (DENIC vs rdap.org URL, `--max-time`/`+time`/`+tries` reaching each tool), the **exit-code contract `3` vs `4`** (all lookups failing and the offline machine → `4`, never `0` + `AVAILABLE`; DNS-only positives with failed checks downgraded; authoritative verdicts still deciding `0`/`3` with failures visible), failure classification per source (`timeout`/`network`/`tool_missing`/`bad_response`/`http_error`), **`--timeout` honored** (a check hanging 6s is cut near the deadline → `4`), static guards (no `getaddrinfo`, every dig call carries `+time=`, no paid-API/credential strings, contract fields documented here), **5 mutations** — M1 folds exit 4 back into 3, M2/M3 stop passing `--max-time`/`+time` to curl/dig, M4 lets failed checks vote again (the original defect), M5 defeats the positive-verdict downgrade — each precondition-asserted to occur exactly once, must RUN and give the wrong verdict, and be re-checked as surgical on a clean run.
133:- `bash tests/test_dig_tools_transport.sh` → **80 assertions** (shared with `dns-verify` and `ip-drift-check`): three dig transport shapes against this tool with **RDAP and whois deliberately failing** so DNS is the *only* completed check and its reading decides the verdict — `transport`/`transport-err`/`masked` each → exit **4**, `available` `null`, `checks_failed` 3, `checks.dns.dns.error` in (`timeout`,`network`) and **no `;;` anywhere in `checks.dns.dns.records`** (pre-fix the masked shape stored the complaint as an NS record and answered **TAKEN, exit 3**), plus mutant M3 which must reproduce exactly that.
197:- `bash tests/test_budget_show.sh` → **89 assertions**, hermetic (fixtures in a throwaway sandbox under `${TMPDIR:-/tmp}/opencode/`, trap-cleaned; only one case reads the real ledger, read-only and content-agnostic so a future approved purchase cannot spuriously fail it): hook honored (fixture month ≠ live month proves it), JSON key-set + numeric `spent` + `spent_note` split, human format (currency glued to amount), every ledger violation → exit 1 with the field named (empty / missing `remaining:` / non-numeric / trailing text / math mismatch / overspend / bad month / missing file), **month freshness (112)**: fresh → `warnings: []` and no `WARN:` row, stale → exit **0** with one warning naming both months and the numbers intact, the **real ledger forced stale by the hook** → still exit 0, `GLADEX_CURRENT_MONTH=September` → exit **2** *before* the ledger is read, `--help` documents both hooks + exit codes, arg contract 0/2, static no-write guard, **3 mutations** (M1 validation gate defeated, M2 `_math_ok` forced true, **M3** the freshness comparison forced true — each precondition-asserted to occur exactly once; M2/M3 re-checked to stay surgical: still reject the empty ledger, still accept the valid one, and M3 must keep exiting 0 while going silent); **section Z** (queue item (128), 6th of 9: the `SB_ALL` ledger — the one factory's every `mktemp` is recorded on the line *after* it succeeds, `cleanup()` iterates the ledger and ends `return 0`, and Z1–Z10 read the EXIT trap's claim while the run is still alive: **Z1** the accounting derived from this file (`3 entries = 1 new_sandbox section call + these 2`, the count read by `grep -c '^new_sandbox$'` so Z's own suffixed calls fall outside it), **Z2** no directory recorded twice, **Z3/Z4** both fresh sandboxes on disk and in the ledger in creation order, **Z5** one `cleanup()` removed every recorded directory, **Z6** the pre-fix one-liner reproduced on purpose (it removes only the last `$SB`, leaving the first of a pair standing — the N-minus-one leak this suite could not see while its factory ran once), **Z7** every factory in the file records into the ledger (both counts derived from the source, neither reader able to count its own source — the recorder pattern carries an escaped dollar so its own line cannot match itself; 1 factory today, so a future second one cannot hide), **Z8/Z9** the leak reader counts directories never files (a directory and a file sharing the `bs.*` prefix side by side: 1 vs 2, then 0 vs 1), **Z10** one `cleanup()` leaves zero ledger directories on disk, read with the same directory reader)
263:- `bash tests/test_dns_verify.sh` → **40 assertions**, hermetic (<5s, scenario-driven `dig` stub on PATH: `ok`/`empty`/`netfail`/`sleep`; one case runs with a PATH containing only python3 to simulate a missing `dig` — live DNS never touched): arg/`--help` contract, type + domain rejection (`2`), happy path + JSONL/human/`--format` contracts, default 7-type query, **exit-code contract `3` vs `4`** (unreachable resolver and missing `dig` both → `4`, not `3`), **`--timeout` honored** (`+time=N` reaches dig, a 5s-hung dig is cut at ~3s → `4`, `--timeout 0` → `2`), `--server` pass-through, **2 mutations** (M1 folds network errors back into `exit 3`; M2 defeats the type guard — both must RUN and give the wrong verdict, each precondition-asserted to be surgical)
265:- `bash tests/test_dig_tools_transport.sh` → **80 assertions** (shared with `domain-availability-check` and `ip-drift-check`), hermetic (scenario `dig`/`curl`/`whois` stubs + a `127.0.0.1` IP-echo server): the dig transport-shape contract in three shapes — `transport` (measured: `;;` on stdout, stderr empty, rc 9), `transport-err` (`;;` on stderr, rc 9), `masked` (`;;` on stdout with rc 0, the wrapper-masked shape real dig does not produce) — asserting exit **4** and `network_errors=7` in every one, **no `;;` in `records`**, the complaint reaching the caller as an *error* (JSON and human, quoted only under `Network errors:` with no `Records:` section), harness sanity that pins the stub itself to the measurement (stdout diagnostics + **stderr empty** + rc 9), `no-json` never counting as "no `;;`", and **4 mutants** (drop `or diagnostics`, stop rejecting `;;` lines, and their two siblings) each precondition-asserted surgical, byte-different and non-empty-output. Pre-fix replay against the `HEAD` blobs → **58 passed / 13 failed** (7 of them this tool: 2 wrong-stream detail + 5 masked-shape).
309:- `bash tests/test_healthcheck.sh` → **122 assertions, exit 0** (suite added 2026-10-07: the arg contract with every refusal's stream, the live reading of both envs, five hermetic endpoint worlds on local ephemeral ports, and four plants — this section's four bullets were the whole of the tool's testing until then, hand-run and never re-run). Every input of those four plants has a reader since `[0.4.259]`: the M3 plant's dead port short-circuited to a bare `fi`, so an empty `free_port` skipped both M3 assertions and the suite still exited 0 — now an `elif … bad` guard, proven by an 11-shape probe that read **10 / 11 caught** before the pin and **11 / 11** after.
1056:- `bash tests/test_ip_drift_check.sh` → **133 assertions**, hermetic: a scenario-driven IP-echo server on `127.0.0.1` (via `IPDRIFT_IP_URLS`, per-path scenarios: ok / html / empty / IPv6 / CGNAT / 500 / JSON-without-ip) plus a scenario `dig` stub on PATH (`ok`/`cname`/`nodata`/`netfail`/`sleep`) — no network is touched and no real service sees our egress IP. Covers the arg/`--help` contract (`--timeout 0`/`-1`/`abc` → `2`, invalid `--domain`/`--dns-server` → `2`, stdout empty on arg errors), the JSON/human contracts and key set, **unvalidated answers never deciding** (HTML → `3` not `1`, failover to the next service, empty/500 handling), **IPv6 → `3` not `1`** while **CGNAT stays a verdict**, **`dig` answers filtered to IPv4 literals** (a CNAME target → `no_a_records`, never drift), the **`no_a_records` vs `dns_lookup_failed`** split (plus missing `dig`), `--timeout` reaching dig as `+time=N +tries=1` and bounding a hanging lookup, `--dns-server` pass-through (single call, `@server`), static read-only/docs guards and the REGISTRY contract, one guarded live case, and **6 mutations** (M1 timeout gate, M2 domain gate, M3 IP-literal gate, M4 address-family gate, M5 IPv4-only DNS filter, M6 failure classification) — each precondition-asserted to occur exactly once, must RUN and give the wrong verdict, with a surgical control on the happy path.
1057:- `bash tests/test_dig_tools_transport.sh` → **80 assertions** (shared with `dns-verify` and `domain-availability-check`): three dig transport shapes against this tool with the public-IP leg served from `127.0.0.1` — all three → exit **3**, `error_code` `dns_lookup_failed`, `drift` `null`, **no `;;` in `dns_records` and none echoed into the output**. Pre-fix the rc-9 shapes already passed (the `returncode != 0` gate plus the IPv4-literal filter were sound); the masked shape reported `no_a_records` = *"query completed with no answer"* for a query that never completed, which mutant M4 must reproduce.
1113:- `bash tests/test_pdns_api.sh` → **175 assertions**, hermetic: a fake PowerDNS API (python3 stdlib on `127.0.0.1`, scenario file drives 200/204/401/422/garbage/scalar/wrapped/drop/hang) plus the `PDNS_*` hooks — the live zone is never contacted and `/root/.pdns-token` is never read. The suite **refuses to run (exit 2)** against a tool that hardcodes the live credential paths without the hooks, because replaying the pre-fix code would have aimed every dangerous write at the real zone. Covers: usage/`--help` contract (exit 0, works with no credentials); credential contract (missing/empty/base-not-a-URL → exit 1, path named, no traceback, **key never in output**, key observed in the `X-API-Key` header); read and write payload contracts (`rrsets[0].name/type/ttl/content/disabled`, default TTL 3600, apex `@`); the **`set-txt` regression** (payload carries the real text, quoted for PowerDNS presentation format, no double-quoting, inner quotes escaped, a stray second word → exit 2 not a traceback); every safety gate refusing with exit 2 and **zero requests** (TTL 86400/0/-5/`soon`, all forbidden types, foreign zone for `set-a`/`delete`/`records`); API/network failures → exit 1 with empty stdout and no traceback (401, 422, dropped connection, connection refused, a hang cut off by `PDNS_TIMEOUT`); static guards (no key-printing path, no credential literal, py_compile) and the REGISTRY contract above.
1227:- `bash tests/test_ip_drift_cron.sh` → **340 assertions** (measured 2026-10-06; was **307**
2521:- `bash tests/test_disk_show.sh` → **90 assertions**, hermetic (everything but case J runs against fixture files in a throwaway sandbox under `${TMPDIR:-/tmp}/opencode/`, trap-cleaned; no network, no DNS, no services, nothing outside the sandbox written): the arg contract (**8** ways to reach exit 2, stdout empty on each), the JSON key-set and `ok ⇔ exit 0`, the breach through `GLADEX_DISK_FIXTURE` (95 % → **3**, 10 % → **0**) and the **boundary** (90 % at `--threshold 90` → **3**, so the comparison is `>=`), precedence **2 > 1 > 4 > 3 > 0** with a fixture path and a real `statvfs` path both reaching exit 4, the reclaimable table through `GLADEX_DISK_PATHS_FILE` (exact bytes for a 1000-byte file, absent path reported not hidden, `reclaimable_bytes` closing against the rows), four broken-hook shapes → exit 1 with empty stdout, static guards (no delete/write API, no child left behind, no network API), **2 precondition-asserted mutations** — the exit-3 decision defeated and the `>=` boundary flipped to `>` — each must RUN and wrongly exit 0, each re-checked surgical (still 4 for cannot-verify / still 3 on a real 95 % breach), and **section Z** (queue item (128), 7th of 9: the `SB_ALL` ledger — the one factory's every `mktemp` is recorded on the line *after* it succeeds, `cleanup()` iterates the ledger and ends `return 0`, and Z1–Z10 read the EXIT trap's claim while the run is still alive: **Z1** the accounting derived from this file (`3 entries = 1 new_sandbox section call + these 2`, the count read by `grep -c '^new_sandbox$'` so Z's own suffixed calls fall outside it), **Z2** no directory recorded twice, **Z3/Z4** both fresh sandboxes on disk and in the ledger in creation order, **Z5** one `cleanup()` removed every recorded directory, **Z6** the pre-fix one-liner reproduced on purpose (it removes only the last `$SB`, leaving the first of a pair standing — the N-minus-one leak this suite could not see while its factory ran once), **Z7** every factory in the file records into the ledger (both counts derived from the source, neither reader able to count its own source; 1 factory today, so a future second one cannot hide), **Z8/Z9** the leak reader counts directories never files (a directory and a file sharing the `ds.*` prefix side by side: 1 vs 2, then 0 vs 1 — this suite's standing `/tmp/opencode` inventory is the disagreement in the wild: **1 glob match, 0 directories**), **Z10** one `cleanup()` leaves zero ledger directories on disk, read with the same directory reader)
3496:- `bash tests/test_system_status_unread.sh` → **24 assertions**, hermetic and <1s
3521:- `bash tests/test_system_status_mx_soa.sh` → **31 assertions**, hermetic and <1s
3533:- `bash tests/test_system_status_mx_soa_transport.sh` → **76 assertions, 4
3558:- `bash tests/test_system_status_go_tests.sh` → **92 assertions, 6 mutations**,
3596:- `bash tests/test_system_status_go_compile.sh` → **109 assertions, 6 mutations**,
3663:- `bash tests/test_system_status_promote_gates.sh` → **346 assertions, 39 mutations**,
3976:- `bash tests/test_system_status_tls_expiry.sh` → **60 assertions, 3 mutations**,
3993:- `bash tests/test_system_status_dns.sh` → **49 assertions, 4 mutations**,
4017:- `bash tests/test_system_status_dig_single_point.sh` → **49 assertions, 4
$ cd /data/repo && grep -rn "203 assertions\|497 assertions\|136 assertions" tests/ | cut -c1-160; echo "---"; grep -rn "REGISTRY" tests/*.sh | grep -v "registry_coverage" | cut -c1-160 | head -15
tests/test_registry_coverage.sh:638:# produces (`**497 assertions**`) and how many negative controls the file
---
tests/test_budget_show.sh:11:# despite REGISTRY documenting "1 - General error (…, parse error)".
tests/test_detached_children.sh:16:#   K  the eighteen mutation controls — the thirteen tools/REGISTRY.md has
tests/test_detached_children.sh:111:REGISTRY="$TOOLS_DIR/REGISTRY.md"
tests/test_detached_children.sh:158:if [ ! -f "$REGISTRY" ]; then
tests/test_detached_children.sh:159:  echo "FAIL: registry not found: $REGISTRY"
tests/test_detached_children.sh:217:    [ "$name" = "REGISTRY.md" ] && continue
tests/test_detached_children.sh:473:ALL=$(grep -E '^## ' "$REGISTRY" | sed 's/^## //' | grep -v '^test_')
tests/test_detached_children.sh:950:# Queue item (100). Until now every mutation control tools/REGISTRY.md records
tests/test_detached_children.sh:1025:    # name the cause, exit 1 — tools/REGISTRY.md documents rc 1 as "a refusal
tests/test_domain_availability.sh:33:REGISTRY="$REPO/tools/REGISTRY.md"
tests/test_domain_availability.sh:411:REG="$(cat "$REGISTRY" 2>/dev/null)"
tests/test_domain_availability.sh:413:assert_has "REGISTRY documents the network_error field" "network_error" "$REGSEC"
tests/test_domain_availability.sh:414:assert_has "REGISTRY documents the coverage field" "coverage" "$REGSEC"
tests/test_domain_availability.sh:415:assert_has "REGISTRY documents exit 4 as undetermined" "4" "$REGSEC"
tests/test_gladex_monitor.sh:67:# (tools/REGISTRY.md excluded — it IS the docs) must carry a changelog behind
> build · mimo-v2.6-flash-free
Measurements are in. Run 947's only unnumbered non-gated queue line is stale by 26 runs, and run 931's equivalent line was dropped from the carried list. Writing the entry (before the commit, per CLOSE PROTOCOL rule 1):
$ cd /data/repo && date -Is && git status --porcelain && echo "(porcelain end)" && tail -c 400 agent-logs/PROGRESS.md
2026-10-14T02:56:05+02:00
(porcelain end)
th `updated=2026-10-14T00:15:01Z`, i.e. exactly what this entry reports, and **(a⁶)** still owns both. Spend **0.00**, free `*-free` models only, no secret or PII in any prompt, file or commit. **Stop-state: `git status --porcelain` does not list `agent-logs/PROGRESS.md`** after commit #2 — this bullet is carried by that commit, not staged-only, not `git checkout --`-ed, not parked in `/tmp`.
> build · mimo-v2.6-flash-free
$ cd /data/repo && cat >> agent-logs/PROGRESS.md <<'ENTRY'

## Builder — run 948 — run 947's only unnumbered non-gated queue line is stale by 26 runs: *"the shift-tally mutant-coverage follow-up (run 920's, unnumbered)"* was closed by **run 921** (M4 + its own fixture) and the live suite runs **203 passed / 0 failed / 0 skipped** carrying **M1–M15** — closed by measurement, no code touched; the opposite defect found on the way (**run 931's** line was *dropped*, not kept) and recovered

- **STEP 0, paid first — owed nothing, no row written.** Schema re-checked first (table `messages`, `direction` in its own column), then `SELECT COUNT(*) FROM messages WHERE direction='investor_to_agent' AND read=0` → **0 dev / 0 prod**; `./tools/inbox-status` → **rc 0**, `OK - nothing owed (0 unread, 0 open entries all replied)`, last reply **dev 146 / prod 111**; `INBOX.md` **80 `##` entries / 80 with the `~~HANDLED~~` marker / 0 open**. The prompt's `=== UNREAD INVESTOR MESSAGES ===` block was **empty** and both `=== RECENT INBOX ===` entries (2026-09-30 hiring workflow; 2026-10-05 prod-version correction) are already `~~HANDLED~~`. **No `agent_to_investor` row inserted in either database, nothing marked read, `INBOX.md` untouched** — an empty inbox is answered by the measurement, not by a status row. **Production is 0.4.28** (the investor's own correction of the earlier misquote stands; the wrong figure is not repeated here) — `./tools/version-check` → `OK: dev=0.4.28 prod=0.4.28 (match)`; `./tools/healthcheck` → **dev + prod HEALTHY, HTTP 200**; `./tools/budget-show` → **2026-10, allowance 5.00 / spent 0.00 / remaining 5.00**; `./tools/queue-source-check` baseline → **rc 0**, `one queue: [0.4.338] pointer-only, 111 item line(s) frozen across 292 section(s), 203 PROGRESS bullet(s), 2 path token(s)`; spend **0.00**, free `*-free` models only, no key configured, **no secret or PII in any prompt, file or commit**.

- **The queue read, and why (a⁶) is not mine — one pre-fire read disclosed, exactly as runs 931/947 disclosed theirs.** This run started **02:48:54 CEST** (`date` → `Wed Oct 14 02:48:54 CEST 2026`), i.e. **before** lena's timer **Wed 2026-10-14 08:05:17 CEST** (`systemctl list-timers 'identity-run@lena.timer'` → `NEXT Wed 2026-10-14 08:05:17 CEST … PASSED Tue 2026-10-13 18:06:29 CEST 8h ago`), so dated item **(a⁶) stays unowned and unopened**. **Disclosed, not smoothed over:** one pre-fire `systemctl list-units --state=failed --no-legend --plain` read WAS taken during orientation (it printed exactly one line, `identity-run@lena.service`, the unit the census already carries) and the red-watch **state file** was read (`state=red, failed=2, fails = A12 + A30, updated=2026-10-14T00:45:01Z`) — both read-only state readings of the kind runs 945/946/947 also took, and **no state change of any kind followed**: no `reset-failed`, no restart, no unit or timer change, no `identity-run.sh`/`sofia-watch` edit, and **no (a⁶) census** — no `shift-census` update, no `system-status` attribution, no `git show --numstat` of an in-window identity shift commit. That leaves run 947's handover as the guide: take (a⁶) if after the fire, otherwise *"a standing line it can measure without inventing work."* Run 947's carried list contains exactly **one** such line — **"the shift-tally mutant-coverage follow-up (run 920's, unnumbered)"** — everything else on it is investor-gated, dated, operator-blocked or NEEDS-INVESTOR. So that line is this run's, and measuring it is the whole step.

- **The measurement: four readings, all taken before this entry was written, and the line fails all of them.** (1) **The closure already exists, verbatim.** `agent-logs/PROGRESS.md` run 921's queue bullet reads: *"**Closed by this run: run 920's unnumbered mutant-coverage follow-up** — M4 plus its own fixture, over a gap I first reproduced on the suite's own fixtures."* (2) **The gap run 920 described is M4's own subject**, quoted from run 921's restatement of it: *"the **mutant** coverage the suite does not yet have — it proves three defects would be caught, but a fourth class (e.g. the `global` de-dup collapsing on `(ts, model)` without `code`) has no mutation pinning it, so the file-vs-global divergence could in principle be broken by a mutant that still passes."* — and the live file says the same thing in its own header comment: `tests/test_shift_tally.sh:503-505` → `# M4 — the `global` key without its `code` component: de-duplication collapsing` / `# on (ts, model) alone. The suite's own fixtures CANNOT see this mutant … so M4`. (3) **The coverage is in the tree and has grown eight mutants past it:** `grep -oE '^# M[0-9]+ —' tests/test_shift_tally.sh` → **15 section headers, M1 … M15**, `grep -c M4` → **24** lines naming it. (4) **The suite runs green right now:** `bash tests/test_shift_tally.sh` → **`203 passed, 0 failed, 0 skipped`, exit 0** (last pin `M15 THE PIN: the reader reports the DISAGREEMENT with --help … not two equal empties`). Nothing was planted, no fixture edited, no tool run outside its own suite.

- **Why the stale line survived run 946's sixteen-line audit, and what that says about the handover rather than the suite.** `awk 'NR>18771 && /shift-tally/' agent-logs/PROGRESS.md | wc -l` → **1**, and the single hit is **line 19139 = run 947's own queue bullet** (line 18771 is run 931's queue bullet, the last entry before the shift-tally chain ended). So after run 931 the phrase *shift-tally* appears in the queue **nowhere except where run 947 wrote it**: the line was **introduced by run 947**, twenty-six runs after run 921 closed it — which is why run 946's audit of all sixteen carried lines could not catch it (the line did not exist yet when that audit ran), and why run 947's own closing claim ("every remaining line is gated (investor), dated, operator-blocked or NEEDS-INVESTOR") was true of its list and false of this one member of it. This is the same defect class runs 945/946/947 each named — *a carried queue line nobody re-read against the bytes it describes* — one layer out: not a stale line inherited silently, but a **freshly invented one**, so the audit-by-re-reading has to happen against run 921's closure sentence and the live suite, not only against the previous handover. **Verdict: the line is CLOSED (run 921, M4 + its fixture; live at M1–M15 / 203-0-0).** It is struck from the carried list below. **No code touched, no new item invented in its place.**

- **The opposite defect, found while checking whether this run's finding was complete: a line that was *dropped* instead of *kept*.** Run 931's queue bullet ends with its own unnumbered follow-up — *"**One new unnumbered follow-up, deliberately not numbered:** `i_reg_pair()` reads exactly the two figures this suite's own section carries, and no other suite's"* — and that line has **no successor**: `awk 'NR>18771' agent-logs/PROGRESS.md | grep -c i_reg_pair` → **0** (every later handover, runs 932–947, is inside that range), and no entry anywhere uses a *closed* phrasing for it either, so it was neither carried forward nor closed. Its shape still holds on a spot check, measured this run: `grep -rln 'i_reg_pair' tests/ tools/` → **only `tests/test_registry_coverage.sh`** (run 931's reader, scoped to its own section by its own design), and `grep -rn '203 assertions\|497 assertions\|136 assertions' tests/` → **one hit, `tests/test_registry_coverage.sh:638`** — i.e. no suite reads *another* suite's REGISTRY assertion figure, which is exactly the blind state run 931 named. **Not planted, not attempted, not numbered by me** — it is *recovered* into the carried queue below as run 931's line, because a line that was queued and then lost is a queue-integrity defect of the same family as the one this run closed, and restoring it costs no invention. Honesty of the scope: I measured that nobody recorded a closure and that the reader's scope is unchanged; I did **not** run a plant against `tests/test_registry_coverage.sh` (≈10 min) to prove the gap still reddens on nothing, so "open" here means *no closure on record plus an unchanged shape*, not a reproduced blindness.

- **Scope and safety, one line each:** this run's commit is by **explicit pathspec** (`agent-logs/PROGRESS.md` only — the sole repo file this run changed; `git status --porcelain` **empty** at 02:56 CEST before this append). **`rm` only inside `/tmp/opencode`** — none needed, nothing created; **no live messages-DB write**, no DNS write, no mail sent, no paid API, no API key configured; **`hiring/queue/` read-only** — 2 proposals `status=proposed`, the investor's seat; **no `systemctl reset-failed`, no restart, no unit or timer change, no `identity-run.sh`/`sofia-watch` edit**; **no `tools/`, `tests/`, `app/` or `CHANGELOG.md` file changed** → no reviewer gate, nothing to promote, no changelog pairing, **`[0.4.338]` unchanged**, the `- Live:` figure **stays 108** (no suite added; the 109th suite owns the next refresh), dev and prod untouched, both **0.4.28**; spend **0.00**, free `*-free` models only.

- **Queue — next small step (read this first):** **(a⁶) unchanged and NOT consumed by this run** — the next builder run *starting after* lena's timer **Wed 2026-10-14 08:05:17 CEST** runs `./tools/shift-census --format json` **and** `./tools/system-status` **and** `git show --numstat <the in-window identity lena shift commit>` — **clean shift** = the follow-up closes itself; **second consecutive `no-error-line` with shift-authored insertions `0`** = escalate in PROGRESS as the identity-run observability gap and put it on the operator/`identity-run.sh` seat (**still never edit `identity-run.sh` myself**), comparing against **run 942's corrected baseline (1 unit / 1 class `no-error-line` / marker `18:19:03` / `work=1061ins/3files` = 1058 + 2 + 1, shift-authored 0)** plus run 944's live `ownlog=`/`other=` split — both still reproduce live as of run 946. **Closed by this run: run 947's "shift-tally mutant-coverage follow-up (run 920's, unnumbered)"** — stale by 26 runs, closed by run 921, verified live at M1–M15 / 203-0-0 (four readings above). **Recovered by this run: run 931's unnumbered line** (`i_reg_pair()` reads only its own section's two figures; no closure on record since run 931, shape unchanged on spot check) — **queued, not attempted, not renumbered**: it is the first standing non-gated line after (a⁶) if the next run starts before the fire, and its natural home is `tests/test_registry_coverage.sh` with its own plant. Then: **(b)** **STEP 0 first every run** (today: **0 unread dev / 0 prod**, `INBOX.md` **80/80/0 open**); **A28 must stay clear** — this commit carries only this file and cites no changelog pairing; **A3 clears with this entry's commit + push**; **A12/A30** remain lena's unreset unit (`identity-run@lena.service`), owned by **(a⁶)** — red-watch reads them at `failed=2` with `updated=2026-10-14T00:45:01Z`, and **no tick was waited for this run**: a `PROGRESS.md`-only commit cannot move the monitor's failing set; **the `- Live:` figure stays 108 — no suite was added; the 109th suite owns the next refresh**; **the `[0.4.258]` citation watch stays discharged** (re-armed by run 947's `REGISTRY.md` edit and discharged in-run; this run makes no `REGISTRY.md` edit); **`shift-census` is 1.0.0 and `shift-deploy` 1.3.0 — a JSON-shape change owns the next bump of either**; **still queued as previously recorded:** the in-flight-guard follow-up only if the live fleet falsifies it (**last measured `in_flight=[]`**), **(93)**/**(97)(a)** first if the investor answers `hiring/queue/*.json` (**2 proposals**, unchanged since 2026-10-04 / 2026-09-30), **(2'')** the day the `GETTING_STARTED.md` keep/fold/retire answer arrives, **§14 renewal** cadence NEEDS-INVESTOR (no DENIC/whois/IANA re-probe), the LAN-only A/B/C (figures **110 messages / 189,209 bytes**), NUL-blob watch on a measured harm only, **(av)(d)** after the `REPORT.md` §14 sign-off (**still no `rm` without it**), **(i)** until the prune lands, SOA MNAME and Pip's mail-policy research NEEDS-INVESTOR, **(113)**'s two `cp`s operator-blocked, **2026-10-20** §10 #6 re-read against `downloads.log`, the `/stats` display row closed with its `/api/stats` mirror unqueued, the shift-tally mutant-coverage line (**struck — closed by run 921**), and **(ax)**, **(e)**, the drift-verify line, **(aw)**, the `promote-gates` verdict watch (never `--force` a stale verdict) and run 915's "repo vs both envs" monitor (**closed by run 947 as A31/A32**) closed/queued exactly as previously recorded — with the honest state after this closure: **every remaining line is gated (investor), dated, operator-blocked, NEEDS-INVESTOR, or (a⁶)-owned**, plus the one recovered line above, so the next run takes **(a⁶)** if it starts after the fire, otherwise run 931's recovered line, otherwise a standing line it can measure without inventing work.

- **Close-state:** this entry is appended **before** the commit that carries it (CLOSE PROTOCOL rule 1) and is never `git checkout --`-ed, staged-only or parked in `/tmp` (rules 2–3); the stop-state check is `git status --porcelain` **not listing `agent-logs/PROGRESS.md`** after the commit. The push must leave `git rev-list --count origin/main..main` → **0**. Post-commit re-reads (`queue-source-check`, `repo-lint`, `test_shift_tally`, `inbox-status`, `version-check`, `budget-show`, `healthcheck`, `git status --porcelain`, `rev-list`) are recorded in the **close-correction** bullet appended before commit #2 if one is made (rule 2).
ENTRY
echo "appended, lines now: $(wc -l < agent-logs/PROGRESS.md)"; git status --porcelain
appended, lines now: 19160
 M agent-logs/PROGRESS.md
> build · mimo-v2.6-flash-free
$ cd /data/repo && ./tools/queue-source-check; echo "rc=$?"
queue-source-check: OK - one queue: [0.4.338] pointer-only, 111 item line(s) frozen across 292 section(s), 203 PROGRESS bullet(s), 2 path token(s)
rc=0
> build · mimo-v2.6-flash-free
$ cd /data/repo && git add agent-logs/PROGRESS.md && git commit -m "run 948: run 947's only unnumbered non-gated queue line measured stale by 26 runs (shift-tally mutant-coverage follow-up closed by run 921; live M1-M15, 203/0/0) and closed; run 931's dropped line recovered" -- agent-logs/PROGRESS.md && git status --porcelain; echo "---"; git log -1 --format='%h %s'
[main a3872f5] run 948: run 947's only unnumbered non-gated queue line measured stale by 26 runs (shift-tally mutant-coverage follow-up closed by run 921; live M1-M15, 203/0/0) and closed; run 931's dropped line recovered
 1 file changed, 18 insertions(+)
---
a3872f5 run 948: run 947's only unnumbered non-gated queue line measured stale by 26 runs (shift-tally mutant-coverage follow-up closed by run 921; live M1-M15, 203/0/0) and closed; run 931's dropped line recovered

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Wed Oct 14 02:41:06 2026] 127.0.0.1:49084 Accepted
[Wed Oct 14 02:41:06 2026] 127.0.0.1:49084 Closing
[Wed Oct 14 02:41:22 2026] 127.0.0.1:43490 Accepted
[Wed Oct 14 02:41:22 2026] 127.0.0.1:43490 Closing
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35148 Accepted
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35148 Closing
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35154 Accepted
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35154 Closing
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35166 Accepted
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35166 Closing
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35180 Accepted
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35180 Closing
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35196 Accepted
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35196 Closing
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35206 Accepted
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35206 Closing
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35214 Accepted
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35214 Closing
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35224 Accepted
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35224 Closing
[Wed Oct 14 02:45:20 2026] 127.0.0.1:35240 Accepted
[Wed Oct 14 02:45:21 2026] 127.0.0.1:35240 Closing
[Wed Oct 14 02:45:21 2026] 127.0.0.1:35254 Accepted
[Wed Oct 14 02:45:21 2026] 127.0.0.1:35254 Closing
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37822 Accepted
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37822 Closing
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37830 Accepted
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37830 Closing
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37842 Accepted
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37842 Closing
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37844 Accepted
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37844 Closing
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37860 Accepted
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37860 Closing
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37868 Accepted
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37868 Closing
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37872 Accepted
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37872 Closing
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37880 Accepted
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37880 Closing
[Wed Oct 14 02:46:25 2026] 127.0.0.1:37892 Accepted
[Wed Oct 14 02:46:26 2026] 127.0.0.1:37892 Closing
[Wed Oct 14 02:46:26 2026] 127.0.0.1:37904 Accepted
[Wed Oct 14 02:46:26 2026] 127.0.0.1:37904 Closing
[Wed Oct 14 02:48:13 2026] 127.0.0.1:48522 Accepted
[Wed Oct 14 02:48:13 2026] 127.0.0.1:48522 Closing
[Wed Oct 14 02:52:14 2026] 127.0.0.1:33836 Accepted
[Wed Oct 14 02:52:14 2026] 127.0.0.1:33836 Closing
[Wed Oct 14 02:52:14 2026] 127.0.0.1:33838 Accepted
[Wed Oct 14 02:52:14 2026] 127.0.0.1:33838 Closing
[Wed Oct 14 02:55:41 2026] 127.0.0.1:46042 Accepted
[Wed Oct 14 02:55:41 2026] 127.0.0.1:46042 Closing
[Wed Oct 14 02:55:41 2026] 127.0.0.1:46058 Accepted
[Wed Oct 14 02:55:41 2026] 127.0.0.1:46058 Closing
[Wed Oct 14 02:57:03 2026] 127.0.0.1:44138 Accepted
[Wed Oct 14 02:57:03 2026] 127.0.0.1:44138 Closing
[Wed Oct 14 02:57:03 2026] 127.0.0.1:44154 Accepted
[Wed Oct 14 02:57:03 2026] 127.0.0.1:44154 Closing
[Wed Oct 14 02:57:52 2026] 127.0.0.1:58910 Accepted

Other app logs: downloads.log