Gladex Agent Logs

SH test_promote_json.sh                          rc=0 promote --format json suite: 127 passed, 0 failed
SH test_promote_lint_gate.sh                     rc=0 promote commit-lint gate suite: 60 passed, 0 failed
SH test_repo_lint.sh                             rc=0 repo-lint suite: 120 passed, 0 failed
SH test_smtp_relay_probe.sh                      rc=0 === Results: 38 passed, 0 failed ===
SH test_source_sync_check.sh                     rc=0 source-sync-check suite: 30 passed, 0 failed
SH test_system_status_go_compile.sh              rc=0 === Results: 82 passed, 0 failed, 0 skipped ===
SH test_system_status_go_tests.sh                rc=0 === Results: 66 passed, 0 failed, 0 skipped ===
SH test_system_status_mx_soa.sh                  rc=0 === Results: 31 passed, 0 failed ===
SH test_system_status_promote_gates.sh           rc=0 === Results: 176 passed, 0 failed, 0 skipped ===
SH test_system_status_unread.sh                  rc=0 === Results: 24 passed, 0 failed ===
SH test_tls_check.sh                             rc=0 === Results: 99 passed, 0 failed ===
> build · mimo-v2.6-flash-free
> build · mimo-v2.6-flash-free
> build · mimo-v2.6-flash-free
> build · mimo-v2.6-flash-free
$ cd /data/repo && total=0; for f in tests/test_*.php; do out=$(php "$f" 2>&1); rc=$?; line=$(printf '%s\n' "$out" | grep -iE "passed|OK" | tail -1); printf 'PHP %-40s rc=%s %s\n' "$(basename $f)" "$rc" "$line"; done
PHP test_app_version.php                     rc=0 === Results: 39 passed, 0 failed ===
PHP test_changelog_api.php                   rc=0 === Results: 78 passed, 0 failed ===
PHP test_chat_a11y.php                       rc=0 === Results: 38 passed, 0 failed ===
PHP test_chat_frontend.php                   rc=0 11 passed, 0 failed
PHP test_cli_version.php                     rc=0 === Results: 35 passed, 0 failed ===
PHP test_ip_drift_safety.php                 rc=0 === Results: 16 passed, 0 failed ===
PHP test_lan_middleware.php                  rc=0 === Results: 49 passed, 0 failed ===
PHP test_mailbox_a11y.php                    rc=0 === Results: 42 passed, 0 failed, 0 skipped ===
PHP test_page_lang.php                       rc=0 === Results: 15 passed, 0 failed ===
PHP test_php_busy_timeout.php                rc=0 Results: 19 passed, 0 failed
PHP test_stats_dbpath.php                    rc=0 === Results: 16 passed, 0 failed ===
PHP test_stats_gocli_path.php                rc=0 === Results: 14 passed, 0 failed ===
PHP test_templates_gallery.php               rc=0 === Results: 27 passed, 0 failed ===
PHP test_ts_ordering.php                     rc=0 === Results: 7 passed, 0 failed ===
PHP test_webmail_session_routing.php         rc=0 75 passed, 0 failed, 0 skipped
> build · mimo-v2.6-flash-free
← Edit repo/CHANGELOG.md
Index: repo/CHANGELOG.md
===================================================================
--- repo/CHANGELOG.md
+++ repo/CHANGELOG.md
@@ -1055,9 +1055,9 @@
 - **`tests/test_promote_json.sh` 118 → 127 assertions, 10 → 13 mutations, written FIRST**: **L6** writes a `VERDICT-*` at *now*, lets the lint gate sleep 3 s, and asserts the shipped age is `≥ 2` **and exactly equal** to `timestamp − newest` recomputed by the suite from the report's two stamps; **L7** ages an entry 10 minutes into the **future** and asserts `newest` is recorded while `age_seconds` is `null`; `--help` gains a "dated by this report" needle. Mutations **M11** (age ships null — the staleness the field exists to surface is gone), **M12** (age bucketed to minutes before it is written — no longer the report's arithmetic; planted so the scenario's age is minutes-sensitive, since a 2 h old entry buckets to itself and would sail through), **M13** (a postdating entry shipping its negative age).
 - **`tests/test_system_status_promote_gates.sh` 155 → 176 assertions, 18 → 23 mutations, written FIRST**: the stub gained self-consistent stamps (`calendar`/`NEWEST`/`iso_add`, `STUB_PG_TS` override `""`/`NULL`/`BEFORE`/<ISO>, `STUB_PG_MB` += `BADTS`), **18b** re-contracted (`NOAGE` now *derives* 96 m from the report's stamps instead of reporting the child's missing age), and new **section 18c** drives all five new states (mismatch, no timestamp, unparseable entry stamp, postdating, `3d 8h`) plus three `--help` needles. **M18 re-pinned** to `render_age()`'s minute line (the plant's old inline target no longer exists — the day unit was added above it, the minutes below it unchanged). **M19** the row prints the child's number again · **M20** a self-contradicting age accepted as *the* age · **M21** the day unit dropped · **M22** the postdating state dropped · **M23** the no-stamps state misattributed to the child. **All 5 caught.**
 - **Fixture bug found while writing them**: `touch -d "$(date -u …)"` parses the plain string as **local** time (a 2 h skew here), which silently dated the fixtures hours from the gates they were compared against — every new fixture now sets mtime by **epoch** (`touch -d @$(date +%s)`), and the L6/L7 comments say why, so the next person does not reintroduce it.
 - **Pre-fix replay (both final suites vs. their `HEAD:` blobs)**: `test_promote_json.sh` → **120 passed / 7 failed** (the `--help` needle, both L6 assertions — the old tool shipped `1s` for a 3 s gate sleep —, L7's `0` instead of a null, M11–M13 unplantable); `test_system_status_promote_gates.sh` → **156 passed / 20 failed / 0 skipped** (three `--help` needles, `NOAGE`, all five 18c states — the day scenario printed exactly `4803m old` —, M18–M23 unplantable). Both suites after the fix: **127 / 0** and **176 / 0**. `bash -n` + `ast.parse` clean.
-- **Full regression: 34 suites, 2029 + 60 = 2089 assertions, 0 failed** — see PROGRESS for the per-suite tally after this append (`test_changelog_api` 78, `test_app_version` 39, `test_cli_version` 35 run against this entry).
+- **Full regression: 34 suites, 2059 assertions, 0 failed** (19 shell = 1578 — **+30** over the 2,029 baseline, exactly promote-json's +9 and promote-gates's +21 — plus 15 PHP = 481, unmoved); `test_changelog_api` 78/0, `test_app_version` 39/0, `test_cli_version` 35/0 all run against this entry.
 - **Live**: `promote-dev-to-prod --dry-run --force --format json` → `"mailbox": {"newest": null, "age_seconds": null}` (only the `.gitkeep` is present, so there is nothing to date — and a null is never a guessed age) with `timestamp` stamped; `system-status --format human` → `promote-gates [WARN] not promotable (reviewer-mailbox holds no entries): verdict REFUSED: no verdict in /data/repo/mailboxes/reviewer-to-main … | dev-sync OK | commit-lint OK (commit b601fcd)` under **ALL SYSTEMS HEALTHY**, exit 0; both `--help`s render the new contract. Every invocation `--dry-run`, nothing promoted, no service restarted.
 - Read-only: no DNS write, no service restart, `/opt/startup/{dev,prod}` untouched, no money moved (BUDGET unchanged: 1.50 spent / 3.50 remaining), model spend **0.00** (`*-free` only).
 
 ### Queue (next-candidate, not actioned)

> build · mimo-v2.6-flash-free
$ cd /data/repo && tail -60 agent-logs/PROGRESS.md
- **Docs**: REGISTRY §promote-dev-to-prod rewritten (three gates, the exit-7 contract with its evidence rules, the two new hooks, the new suite + its 6 mutations + pre-fix replay + live transcript, the stub note on `test_promote_gate.sh`); CHANGELOG `[0.4.40]` parked at the **bottom** with the placement note (train head stays `0.4.28` → version tests stay green); PROGRESS (this entry).
- **Safety**: model spend **0.00** (`*-free` only), no secrets/personal data in prompts or commits, **no money moved** (BUDGET unchanged: 1.50 spent / 3.50 remaining), **no DNS write**, **no service restart** (every suite invocation is `--dry-run`), `/opt/startup/dev` and `/opt/startup/prod` untouched (repo-side tool only; `source-sync-check` 30/30).
- **Still blocked (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME** (`a.misconfigured.dns.server.invalid.` → surfaced as a warning by `system-status` on every run) — cannot proceed unilaterally.
- **Next-candidate queued, not actioned**: `system-status` could carry the promote gates' state (e.g. a `promote-gates` row from `--dry-run`) so "can we ship right now?" is one dashboard read instead of running the promote tool by hand; plus a **divergence guard** asserting `system-status`'s `go_compile.ok` (worktree-dashboard row, `[0.4.39]`) agrees with this gate's `repo-lint --sha HEAD` verdict — they now run the same child on the same sha and should stay ONE check, not two.

## 2026-09-25T00:17Z main-loop run — STEP 0 clear; system-status could not say "can we ship right now?" because the promote gates lived only inside the promote tool — `promote-gates` row (28 → 29 checks) fed by a new `--format json` gate report, 84+84-assertion hermetic suites, 6 mutations each

- **STEP 0 (done first)**: **0 unread `investor_to_agent` rows on BOTH DBs** (dev 0 of 58 rows, prod 0 of 23 — every row read); `INBOX.md` 65 `##` entries, **65 HANDLED, 0 unhandled**; `mailboxes/*` 0 pending Dispatcher assignments (only `.gitkeep`). No reply owed, nothing to mark — recorded here so the run still closes the investor loop explicitly. Investor-side note: **12 of our own `agent_to_investor` rows are still unread by the investor**, including **msg #57 (A/B/C public-gating escalation)** — that ask stays open until they open it.
- **Defect class this step exists for (13th of the series: system-status, dns-verify, budget-show, tls-check, domain-availability-check, pdns-api, ip-drift-check, ip-drift-cron, repo-lint, go-tests, go-compile, promote-gates)**: the queued next-candidate from the previous run, verbatim — *"`system-status` could carry the promote gates' state too (e.g. a `promote-gates` row from `--dry-run`), so 'can we ship right now?' is one dashboard read instead of running the promote tool by hand"*. Running it by hand has two problems the row fixes: it is a separate, easy-to-forget step, and a plain `--dry-run` **stops at the first refusing gate**, so you learn *one* blocker, never the state of all three. The gates' verdicts were also only ever printed as human lines — no tool could *ask* them.
- **Contract now**: (a) `promote-dev-to-prod --format {human,json}` — **one machine-readable gate report on stdout**, human chatter rerouted to stderr, `human` default byte-identical to before, **exit codes unchanged (0/1/2/5/6/7)**. `GATE_REPORT`/`_record_gate()` records each gate's **true code at every decision point** (verdict ×4, dev-sync ×5, lint ×2, plus both human-message sites), `promote()` wraps `_promote()` with a `finally` that emits exactly one JSON object on **every** path (ready, refusal, exception), and `_build_report()` derives `ready`, `blocked_by`, `sha`, `performed`, `exit_code`, `probe` from those codes — so a gate bypassed by `--force` is still reported as having refused, because the verdicts are recorded **before** the bypass. (b) `GLADEX_GATE_PROBE=1` forces `--dry-run` inside `main()` — defence in depth: the dashboard pins it *and* passes `--dry-run`, and both must fail before anything could ship. (c) a **`promote-gates` row** after `go-compile` runs `--dry-run --force --format json` + the probe and reports `ok 'promote-ready'` only when verdict, dev-sync **and** commit-lint pass; a refused gate is **`warning 'not promotable'`** naming every gate (`verdict REFUSED: … | dev-sync OK | commit-lint OK (commit 71c1709)`) and **never `error`** — a declined promotion is not a broken system, tool stays exit 0; anything unverifiable (unreadable report, no gates, `dry_run` not true, `ready` contradicting its own gates, timeout, missing child) is `warning 'cannot verify'` — never a pass. (d) **divergence guard**: the row reads its own `go_compile` state for the same child and sha and reports `cannot verify` if commit-lint says OK while `go-compile` says refused/error — one check seen twice, not two checks that can quietly disagree. New hooks `GLADEX_PROMOTE_BIN` (default `<reported repo>/tools/promote-dev-to-prod`, so suites without this row get "not found" → `cannot verify`) / `GLADEX_PROMOTE_TIMEOUT` (120); `--help` carries the new verdict table and both hooks.
- **Step taken (test-first, two suites)**: `tests/test_promote_json.sh` — **84 assertions, 6 mutations**; **pre-fix replay against the `HEAD:tools/promote-dev-to-prod` blob → 13 passed / 71 failed**. `tests/test_system_status_promote_gates.sh` — **84 assertions, 6 mutations**; **pre-fix replay against `HEAD:tools/system-status` → 16 passed / 68 failed** (the row simply did not exist). Both hermetic: a scenario promote stub in the dashboard suite **captures the child's argv/env**, so the suite asserts `--dry-run --force --format json` and `GLADEX_GATE_PROBE=1` were actually passed (M2/M3 are argv mutations and could not be caught by reading output alone).
- **Mutations (6 per suite, planted on copies — the real tools are never edited; precondition-asserted by GREPPING THE SEARCH STRING for exactly one occurrence, `ast.parse`/`bash -n`-validated so the red can only come from behaviour, each run against the one scenario it targets)**: promote suite — M1 JSON emitted but gates bypassed · M2 report only on success (a refusal prints nothing) · M3 human chatter back on stdout (stdout stops being parseable) · M4 the probe flag ignored · M5 dev-sync OK not recorded · M6 exit code flattened to 0. Dashboard suite — M1 row always `ok` (false green) · M2 `--dry-run` dropped from the child argv · M3 the `GLADEX_GATE_PROBE=1` pin dropped · M4 the `dry_run` check dropped · M5 the divergence guard dropped · M6 the row dropped entirely. **All 12 caught.**
- **The four existing `system-status` suites grew the `[0.4.39]` stub pattern**: `export GLADEX_PROMOTE_BIN="$STUB/promote-dev-to-prod-not-under-test"` so they exercise the missing-child path (fast, no promote tool in the loop); all four re-run green unchanged (unread 24, mx_soa 31, go_tests 66, go_compile 82). `test_promote_gate.sh` (67) and `test_promote_lint_gate.sh` (60) stayed green through the `promote()`/`_promote()` split — the point of the split.
- **Live**: `promote-dev-to-prod --dry-run --force --format json` → 3 gates, `ready:false`, `sha:71c1709`, exit 5 preserved on the unforced path; `system-status` → `promote-gates [WARN] not promotable: verdict REFUSED: no verdict in /data/repo/mailboxes/reviewer-to-main … | dev-sync OK | commit-lint OK (commit 71c1709)` under **ALL SYSTEMS HEALTHY**, exit 0, 30.1s (was ~27s).
- **Full regression: 34 suites, 1924 assertions, 0 failed** (19 shell = 1443: budget 49, dns 40, domain 140, identity 28, ip-drift-check 133, ip-drift-cron 93, pdns 175, promote 67, **promote-json 84**, promote-lint 60, repo-lint 120, smtp 38, source-sync 30, go-compile 82, go-tests 66, mx_soa 31, **promote-gates 84**, unread 24, tls 99 + 15 PHP = 481) — **+168 over last run's 1,756**, no other suite moved. `bash -n` + `py_compile` clean; `test_changelog_api` 78/0, `test_app_version` 39/0, `test_cli_version` 35/0 after the CHANGELOG append.
- **Docs**: REGISTRY §promote-dev-to-prod (usage/options, the JSON report contract with a sample object, `GLADEX_GATE_PROBE`, new hook, new suite + 6 mutations + pre-fix replay, status); REGISTRY §system-status (29 checks, `promote-gates` verdict table + both hooks, new suite + 6 mutations + pre-fix replay + live transcript, stub note now "four suites"); CHANGELOG `[0.4.41]` parked at the **bottom** with the placement note (train head stays `0.4.28` → version tests stay green); PROGRESS (this entry).
- **Safety**: model spend **0.00** (`*-free` only), no secrets/personal data in prompts or commits, **no money moved** (BUDGET unchanged: 1.50 spent / 3.50 remaining), **no DNS write**, **no service restart** (every suite invocation is `--dry-run`; the probe forces it inside the child too), `/opt/startup/dev` and `/opt/startup/prod` untouched.
- **Still blocked (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME** (`a.misconfigured.dns.server.invalid.` → surfaced as a warning by `system-status` on every run) — cannot proceed unilaterally.
- **Next-candidate queued, not actioned**: the divergence guard only compares the two rows *as this run sees them* — a check that `system-status`'s `go_compile` row and the promote gate's commit-lint gate agree **across** runs (same recorded sha, same child invocation) would pin the stronger claim that they stay one check; plus surfacing **how stale** the promote decision is (minutes since the newest mailbox entry), so the row reads "not promotable since …" instead of just "not promotable".

## 2026-09-25T01:05Z main-loop run — STEP 0 clear; the `promote-gates` divergence guard asserted "same child, same sha" while NEITHER row recorded a sha — commit evidence on both sides (same commit / different commits / unread), suite 84 → 120 assertions, 6 → 12 mutations

- **STEP 0 (done first)**: **0 unread `investor_to_agent` rows on BOTH DBs** (dev 0 of 58 rows, prod 0 of 23 — every row read); `INBOX.md` 65 `##` entries, **65 HANDLED, 0 unhandled**; `mailboxes/*` 0 pending Dispatcher assignments (only `.gitkeep`). No reply owed, nothing to mark — recorded here so the run still closes the investor loop explicitly. Investor-side note: **12 of our own `agent_to_investor` rows are still unread by the investor** (prod mirrors 16), including **msg #57 (A/B/C public-gating escalation)** — that ask stays open until they open it.
- **Defect class this step exists for (14th of the series: system-status, dns-verify, budget-show, tls-check, domain-availability-check, pdns-api, ip-drift-check, ip-drift-cron, repo-lint, go-tests, go-compile, promote-gates + its JSON report)**: the queued next-candidate from the previous run, verbatim — *"the divergence guard only compares the two rows as this run sees them … (same recorded sha, same child invocation) would pin the stronger claim that they stay one check."* The guard's **entire thesis was a sentence nobody had measured**: `SS_GCC_STATUS` was the only thing it ever read from the other row, yet both its comment and its printed detail claimed the two rows ran *"the same repo-lint on the same sha"*. Both children resolve HEAD **themselves** — the `go-compile` row with `repo-lint --sha HEAD`, the promote gate with its own `_head_sha()` — and one dashboard run lasts ~30 s, so a commit landing in between made the claim false in exactly the direction that matters: **drift (two checks of two different commits) was diagnosed as a structural disagreement about one commit**, with a "same sha" the tool had never read. The mirror failure existed too: a contradiction with no readable sha on either side still said "same sha". Pre-fix evidence captured against blob `HEAD:tools/system-status` (md5 `cca0ab15713e91db875def74a46e8121`): the guard's own block, `SS_GCC_STATUS` the sole cross-row input, and the suite replay at **99 passed / 21 failed** (every demand for a measured commit red, no drift/unknown diagnosis, no `--help` contract, M7–M12 unplantable at 0 matching lines).
- **Contract now**: the `go-compile` row exports the commit it measured (`repo-lint`'s `sha_resolved`; `""` when the child recorded none) as `sha` on its row JSON and hands it over as `SS_GCC_SHA`; the guard normalises **both** that and the report's `sha` through `measured()` — empty or the symbolic `HEAD` is *not* a commit → `unknown`, so two blanks can never compare equal (a match on two unread values would be the same unmeasured claim in new clothes). Only then does it decide, and the detail always names which case it found: **same commit** → `both measured commit <sha>, so the two children differ (binary or env)` (a real divergence — debug the children); **different commits** → `the two checks measured DIFFERENT commits (go-compile <a>, commit-lint <b>): HEAD moved between them, drift not disagreement` (wait for HEAD, nobody contradicted one commit); **unread** → `the commit each check measured is unknown (go-compile ?, commit-lint ?)`. All three stay `warning` (still never an `error`, still 0 incremented), all three carry the gate summary, and the guard still fires **only** on a genuine contradiction — two green checks on two commits invent nothing. `same child` is dropped from the wording on purpose: neither row records the child *binary*, so it is the one part still unmeasured and the one part no longer claimed. `--help` documents the evidence contract.
- **Step taken**: `tools/system-status` (row `SHA_FIELD`/`"sha"` + `GC_SHA` hand-off + rewritten guard + `--help`), `tests/test_system_status_promote_gates.sh` (**section 14b**, both children turned into scenario knobs `STUB_RL_SHA` (`""` → `sha_resolved: null`) and `STUB_PG_SHA` (`NULL` → no sha), section 14's needle updated from the unmeasured claim to the measured one, `--help` assertion), **mutations M7–M12**. Suite **84 → 120 assertions, 6 → 12 mutations**; pre-fix replay **99/21/0**, after the fix **120/120**, ~11 s.
- **Mutations (6 new, planted on copies — the real tool is never edited — precondition-asserted by grepping the search string for exactly one occurrence, `bash -n`-validated, each run against the one scenario it targets)**: M7 the drift branch never taken (drift re-reported as a same-commit divergence) · M8 the unknown-commit branch dropped (two blanks read as a match) · M9 `SS_GCC_SHA=""` at the call site (the guard blind by construction) · M10 `"sha": ""` in the row (same blindness, produced one step earlier) · M11 the reverse contradiction missed — **false green**: a commit that does not compile reports `promote-ready` · M12 `if contradiction and g_sha == r_sha` (drift skips the guard, the row silently falls back to its ordinary verdict). **All 6 caught.** M9/M10 deliberately fail on the *same* assertion: the row and its hand-off are one chain and either link breaking must read as "the commit was never recorded".
- **Live**: `system-status --format human` → `go-compile [OK] 45 module file(s) compile clean (1.646s) (commit e83aa62)` beside `promote-gates [WARN] not promotable: verdict REFUSED: … | dev-sync OK | commit-lint OK (commit e83aa62)` — the two rows naming the **same** commit, which is exactly the pair the guard now compares — under **ALL SYSTEMS HEALTHY**, exit 0, 30.5 s.
- **Full regression: 34 suites, 1960 assertions, 0 failed** (19 shell = 1479: budget 49, dns 40, domain 140, identity 28, ip-drift-check 133, ip-drift-cron 93, pdns 175, promote 67, promote-json 84, promote-lint 60, repo-lint 120, smtp 38, source-sync 30, go-compile 82, go-tests 66, mx_soa 31, **promote-gates 120**, unread 24, tls 99 + 15 PHP = 481) — **+36 over last run's 1,924 baseline**, no other suite moved. `bash -n` clean; `test_changelog_api` 78, `test_app_version` 39, `test_cli_version` 35 after the CHANGELOG append.
- **Docs**: REGISTRY §system-status (verdict-table row rewritten around the three evidence cases, suite paragraph 84→120 / M1–M12 with the section-14b contract, new pre-fix replay + live transcript, status line); CHANGELOG `[0.4.42]` parked at the **bottom** with the placement note (train head stays `0.4.28` → version tests stay green); PROGRESS (this entry).
- **Safety**: model spend **0.00** (`*-free` only), no secrets/personal data in prompts or commits, **no money moved** (BUDGET unchanged: 1.50 spent / 3.50 remaining), **no DNS write**, **no service restart**, `/opt/startup/dev` and `/opt/startup/prod` untouched (repo-side tool only; `source-sync-check` 30/30).
- **Still blocked (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME** (`a.misconfigured.dns.server.invalid.` → surfaced as a warning by `system-status` on every run) — cannot proceed unilaterally.
- **Next-candidate queued, not actioned**: the **other half of `[0.4.41]`'s queue** — surface **how stale** the promote decision is (minutes since the newest mailbox entry), so the row reads `not promotable since …` instead of just `not promotable`; plus the last gap this run made explicit: the guard now says *the two children differ (binary or env)* but cannot name **which**, because neither row records its `repo-lint` path — recording the child identity in the promote gate's `commit-lint` detail would close it.

## 2026-09-25T02:09Z main-loop run — STEP 0 clear; the `promote-gates` row refused without saying for how long, and the divergence guard blamed "the two children" without naming either — dated refusal (`mailbox` evidence) + per-gate `child` identity, suites 84 → 108 and 120 → 155 assertions, 8 → 18 mutations

- **STEP 0 (done first)**: **0 unread `investor_to_agent` rows on BOTH DBs** (dev 0 of 24 rows, prod 0 of 3 — every row read); `INBOX.md` 65 `##` entries, **65 HANDLED, 0 unhandled** (verified per-entry with awk: no `## ` heading without a `HANDLED` marker); `mailboxes/*` 0 pending Dispatcher assignments (four dirs, only `.gitkeep`). `/root/Maildir/new` holds exactly one message, a **self-sent** `Subject: tls-restore smoke test` from `root@startup-builder.lxd` — not investor traffic. **No reply owed, nothing to mark**, recorded here so the run still closes the investor loop explicitly. Investor-side note: **12 of our own `agent_to_investor` rows are still unread by the investor** (prod mirrors 16), including **msg #57 (A/B/C public-gating escalation)** — that ask stays open until they open it.
- **Defect class this step exists for (15th of the series: system-status, dns-verify, budget-show, tls-check, domain-availability-check, pdns-api, ip-drift-check, ip-drift-cron, repo-lint, go-tests, go-compile, promote-gates + its JSON report)**: both queued next-candidate items from `[0.4.42]`, verbatim — *"(1) surface **how stale** the promote decision is (minutes since the newest mailbox entry), so the row reads `not promotable since …` instead of just `not promotable`"* and *"(2) the guard now says the two children differ (binary or env) but still cannot name **which** — neither row records its `repo-lint` path."* Both are the same defect as the last fourteen: **a sentence the tool could not measure**. (1) `not promotable: verdict REFUSED: …` is identical whether the reviewer mailbox changed four seconds or four days ago, and nothing on the promote side recorded *when* the human evidence landed — so the one fact a dashboard reader needs to distinguish "waiting on a person" from "this decision is dead" was never computed. (2) `[0.4.42]` had just made the guard measure the **commit**, but its same-commit branch still ended `the two children differ (binary or env)` — a coin-flip between two hypotheses, offered precisely because neither row recorded the path of the `repo-lint` it ran; the unmeasured claim *was* the sentence's content, and the mirror branch said `same child` where sameness had never been compared. Pre-fix evidence captured this run against the `HEAD:` blobs (md5 `ef86ad55534293064f6eac219ab48a61` promote, `1e4b5d04ed472d029c2abd1902baff3b` system-status, both byte-identical to the committed files): no `mailbox` key exists in the report, no `gates[].child`, the guard's `binary or env` line, the undated `not promotable:` header, and **0 matching lines** for every one of the eight new mutation plants.
- **Contract now**: (a) **`promote-dev-to-prod` records two evidence fields.** `_mailbox_state(repo_root)` (`timespec="seconds"`, computed in `promote()` **beside `sha`, before any gate runs** so an early refusal still carries it) → `mailbox: {dir, newest (UTC ISO), age_seconds (int|null)}`; **every** file counts, not only `VERDICT-*` (an emptied mailbox is a state worth dating) and `null` is never a guessed age. `_record_gate(..., child=…)` → `gates[].child`, written **only after `subprocess.run` returns** — `commit-lint` → `repo-lint`, `dev-sync` → `source-sync-check`; a timeout, a missing helper or an `isfile()`-only path records **nothing** (a child that never came back did not identify itself), and the verdict gate — which executes nothing — records none. Both are documented in `--help`'s epilog. (b) **`system-status` dates the refusal, as a PREFIX.** `refusal_header(doc)` renders four honest states: `not promotable (newest reviewer-mailbox entry <ts>, <N>m old)`, `(reviewer-mailbox holds no entries)`, `(reviewer-mailbox age not recorded by this child)`, `(reviewer-mailbox entry <ts>, age not recorded)`. Prefix rather than suffix because the detail is re-extracted through `clean()`'s **400-char truncation** — anything appended after a long verdict message is exactly what gets cut. Minutes (`int(round(age / 60.0))`) because the row is read at a glance; the header appears **only on a refusal** (a `promote-ready` row gains no decoration). (c) **The guard names which child ran.** `BIN_FIELD`/`SS_RL_BIN` → the `go-compile` row's `bin`, `GC_BIN` → `SS_GCC_BIN` hand-off, `child_path()`/`child_phrase()` on the promote side; the same-commit branch now states one of three measured outcomes: `both ran <path> - the same child, so the difference is in the environment` · `they ran DIFFERENT children (go-compile …, commit-lint …)` · `the child each check ran is not BOTH recorded (go-compile …, commit-lint ?)` with a literal `?`. `binary or env` is gone: with both paths it is no longer a guess, with one missing the honest answer is the question mark — never a claim of sameness. Still `warning`, still 0 incremented errors, still fires only on a genuine contradiction.
- **Step taken (test-first)**: assertions written **before** either fix, then `tools/promote-dev-to-prod` (`_record_gate(child=…)`, `_mailbox_state()`, report wiring, `--help`) and `tools/system-status` (`BIN_FIELD`/`SS_GCC_BIN`/`GC_BIN`, `child_path()`, `child_phrase()`, `refusal_header()`, both `not promotable` sites, contract comment, `--help`). Suites: `tests/test_promote_json.sh` **section L** (+24 assertions → 108) and `tests/test_system_status_promote_gates.sh` **sections 14c and 18b** (+35 → 155) with two new scenario knobs — `STUB_PG_CHILD` (the report's `commit-lint` child) and `STUB_PG_MB` (`minutes` → entry+age, `""` → *holds no entries*, `NULL` → no `mailbox` key) — so the real tool and every mutant always run the *same* scenario. **Pre-fix replay with the final suites: 91/16 (promote) and 130/25/0 (system-status).** After the fix → **108/108** and **155/155**.
- **Mutations (8 new — M7/M8 on the promote tool, M13–M18 on the dashboard — planted on copies, the real tools never edited; precondition-asserted by grepping the search string for exactly one occurrence, `bash -n`/`py_compile`-validated, each run against the one scenario it targets)**: M7 the gate's `child` identity never recorded · M8 the `mailbox` state never recorded · M13 the refusal loses its date (`refusal_header()` reverted to a bare `not promotable:`) · M14 two *differing* binaries claimed as one child · M15 the `go-compile` row's binary never handed off (`SS_GCC_BIN=""`) · M16 the report's `commit-lint` child never read (`r_bin = ""`) · M17 an unrecorded child reported as `the same child (unmeasured)` · M18 the age rendered in **seconds** instead of the queued minutes. **All 8 caught.** M15/M16 deliberately fail on the *same* assertion (row→hand-off and report→guard are one chain: either link breaking must read as "the child was never recorded"), and M16's plant had to be rewritten mid-run because the emission line it targets moved when `refusal_header()` landed — a plant that cannot fire is not a caught mutation.
- **Live**: `promote-dev-to-prod --dry-run --force --format json` → `ready:false`, `sha:01f35e5`, `gates[dev-sync].child=/data/repo/tools/source-sync-check`, `gates[commit-lint].child=/data/repo/tools/repo-lint`, `gates[verdict]` with **no** `child`, `mailbox.newest=2026-09-21T18:29:21Z` + `age_seconds`; `system-status --format human` → `promote-gates [WARN] not promotable (newest reviewer-mailbox entry 2026-09-21T18:29:21Z, 4771m old): verdict REFUSED: no verdict in /data/repo/mailboxes/reviewer-to-main … | dev-sync OK | commit-lint OK (commit 01f35e5)` beside `go-compile [OK] … (commit 01f35e5)` — the two rows naming the same commit *and* the refusal naming its own age — under **ALL SYSTEMS HEALTHY**, exit 0, 30.5 s. Promotion stays refused in practice (exit 5, `reviewer-to-main/` holds no `VERDICT-*`); every invocation was `--dry-run`.
- **Full regression: 34 suites, 2019 assertions, 0 failed** (19 shell = 1538: budget 49, dns 40, domain 140, identity 28, ip-drift-check 133, ip-drift-cron 93, pdns 175, promote 67, **promote-json 108**, promote-lint 60, repo-lint 120, smtp 38, source-sync 30, go-compile 82, go-tests 66, mx_soa 31, **promote-gates 155**, unread 24, tls 99 + 15 PHP = 481) — **+59 over last run's 1,960 baseline** (= +24 + +35, exactly the two suites that grew), no other suite moved. `bash -n` clean on `tools/system-status`, `py_compile` clean on `tools/promote-dev-to-prod`; `test_changelog_api` 78/0, `test_app_version` 39/0, `test_cli_version` 35/0 after the CHANGELOG append.
- **Docs**: REGISTRY §promote-dev-to-prod (`gates[].child` + `mailbox` documented with the sample JSON corrected, `--help` epilog, suite bullet 84 → 108 / 6 → 8 mutations + this step's pre-fix replay + live transcript); REGISTRY §system-status (verdict table now shows the **dated** refusal and the guard's four child-identity outcomes, two new subsections for the mailbox state and the child identity, suite bullet 120 → 155 / M1–M18 with sections 14c + 18b, pre-fix replay 130/25, live transcript, status line); CHANGELOG `[0.4.43]` parked at the **bottom** with the placement note (train head stays `0.4.28` → version tests stay green) and `[0.4.42]`'s queue marked actioned; PROGRESS (this entry).
- **Safety**: model spend **0.00** (`*-free` only), no secrets/personal data in prompts or commits, **no money moved** (BUDGET unchanged: 1.50 spent / 3.50 remaining), **no DNS write**, **no service restart**, `/opt/startup/dev` and `/opt/startup/prod` untouched (repo-side tool only; `source-sync-check` 30/30; the live message DBs were read only for STEP 0's counts).
- **Still blocked (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME** (`a.misconfigured.dns.server.invalid.` → surfaced as a warning by `system-status` on every run) — cannot proceed unilaterally.
- **Next-candidate queued, not actioned**: (1) the age is **recomputed at read time** — `mailbox.age_seconds` is measured when the report is generated, so `4771m old` re-ages on every dashboard run even though nothing changed; dating the refusal from the report's own `timestamp` would make "old" mean "old when this report was made". (2) `4771m old` is arithmetic a reader must do (above a day `2d 23h` would be glanceable) — pinned as a contract by M18 today, so it needs a deliberate change, not a slip. (3) only one of the three gates' children is ever compared: `dev-sync`'s `source-sync-check` path is now recorded but nothing reads it — the same "one check seen twice" guard applied to that second pair.

## 2026-09-25T03:28Z main-loop run — STEP 0 clear; the `promote-gates` row dated its refusal from the mailbox's own `.gitkeep` placeholder — a "newest entry" timestamp beside the gate's "no verdict" on the same line — suite 108 → 118 assertions, 8 → 10 mutations
- **STEP 0 (done first, re-verified at run end)**: **0 unread `investor_to_agent` rows on BOTH DBs** (dev 0 of 24 rows, prod 0 of 3 — every row read); `INBOX.md` 65 `##` entries, **65 HANDLED, 0 unhandled** (verified per-entry with awk: no `## ` heading without a `HANDLED` marker); `mailboxes/*` 0 pending Dispatcher assignments (four dirs, only `.gitkeep`). No reply owed, nothing to mark — recorded here so the run still closes the investor loop explicitly. Investor-side note: **12 of our own `agent_to_investor` rows are still unread by the investor** (prod mirrors 16), including **msg #57 (A/B/C public-gating escalation)** — that ask stays open until they open it.
- **Defect class this step exists for (16th of the series: system-status, dns-verify, budget-show, tls-check, domain-availability-check, pdns-api, ip-drift-check, ip-drift-cron, repo-lint, go-tests, go-compile, promote-gates + its JSON report)**: found **while triaging** the queue rather than being the queue. The three queued next-candidates from `[0.4.43]` all concern the `mailbox.age_seconds` contract, so the run started by reading it — and the live report contradicted itself: `_mailbox_state()` counted **every** file in `mailboxes/reviewer-to-main`, whose only file is the committed `.gitkeep` (0 bytes, written when the mailbox dir was created in commit `6b9fbaa`, never touched by the reviewer). So the row printed `not promotable (newest reviewer-mailbox entry 2026-09-21T18:29:21Z, 4803m old): verdict REFUSED: no verdict in /data/repo/mailboxes/reviewer-to-main` — **an entry timestamp beside the verdict gate's own claim that there is none**, and one that re-aged on every dashboard run (4771m → 4803m across two runs) with nothing changing in the mailbox, because the "evidence" was a placeholder's fixed mtime. The gate filters `VERDICT-YYYYMMDD-HHMMSS-<slug>.md`; the mailbox scan filtered nothing — the two halves of one line disagreed about whether the mailbox held anything. The suite stayed **108/108 green through the defect** because `new_sandbox()` creates `mailboxes/reviewer-to-main` **without** `.gitkeep`: no test ever exercised the placeholder path, which is exactly the gap L5 closes. Pre-fix evidence captured: live baseline `system-status` line above (4803m), and the final suite against the `HEAD:tools/promote-dev-to-prod` blob → **111 passed / 7 failed**.
- **Contract now**: `_mailbox_state()` skips any name starting with `.` — the placeholder is creation-time scaffolding, not a reviewer touch — while **every other file still counts** (a stray non-verdict file still marks the last time the reviewer side was touched, per the original rationale, now scoped to files a person could have dropped). An empty or placeholder-only mailbox reports `newest`/`age_seconds` **null**, never a guessed number; the docstring that asserted "Every FILE counts (not only VERDICT-*)" now states the rule it actually implements, and `--help`'s mailbox epilog names `.gitkeep` as a non-entry. **`system-status` needed no change**: its `refusal_header()` already had an honest state for `newest == null`, so the live row became `not promotable (reviewer-mailbox holds no entries): verdict REFUSED: no verdict in /data/repo/mailboxes/reviewer-to-main … | dev-sync OK | commit-lint OK (commit d997229)` — both halves now agreeing.
- **Step taken (test-first)**: assertions written **before** the fix — `tests/test_promote_json.sh` **section L5** (placeholder-only mailbox → `newest`/`age_seconds` null, dir still named: 4 assertions; a `.gitkeep` *newer* than the newest verdict must not win the age — `mailbox.newest` must equal the verdict's exact UTC stamp and age in the 500..900 s window, not ~0 s: 3 assertions; `--help` names `.gitkeep`: 1) plus section L1's older sibling swapped from `.gitkeep` to a real `VERDICT-*` (its "newest wins over whatever listdir returns first" intent needs a file the mailbox counts). Red run pre-fix → **111 passed / 7 failed** (the five behavioral assertions + both new plants at 0 matching lines — the skip line did not exist yet); then `tools/promote-dev-to-prod` (skip + docstring + `--help`) → **118/118**.
- **Mutations (2 new, planted on copies — the real tool is never edited — precondition-asserted by grepping the search string for exactly one occurrence, `ast`-validated, each run against the one scenario it targets)**: **M9** the skip removed (`if False:` — the placeholder is counted again and the row prints its own 42 s age for a file nobody dated) · **M10** the skip over-broadened (`fn.startswith(".") or fn.startswith("VERDICT-")` — a real verdict entry dropped, so an "honest" null would come from a blind scan instead of an empty mailbox). **Both caught.**
- **Live**: `promote-dev-to-prod --dry-run --force --format json` → `"mailbox": {"newest": null, "age_seconds": null}` (only the `.gitkeep` is there); `system-status --format human` → the *holds no entries* row above under **ALL SYSTEMS HEALTHY**, exit 0 — the timestamp-versus-"no verdict" contradiction gone. Promotions remain refused in practice (exit 5, no `VERDICT-*` written) and nothing was promoted: every invocation is `--dry-run`.
- **Full regression: 34 suites, 2029 assertions, 0 failed** (19 shell = 1548: budget 49, dns 40, domain 140, identity 28, ip-drift-check 133, ip-drift-cron 93, pdns 175, promote 67, **promote-json 118**, promote-lint 60, repo-lint 120, smtp 38, source-sync 30, go-compile 82, go-tests 66, mx_soa 31, **promote-gates 155**, unread 24, tls 99 + 15 PHP = 481) — **+10 over last run's 2,019 baseline** (= exactly promote-json's growth), no other suite moved. A first pass reported `go-compile 81 passed` with a non-zero exit **while a live `system-status` overlapped it**; three standalone re-runs and the clean second pass were 82/0 — load contention from that overlap, not this change. `bash -n` + `py_compile` clean; `test_changelog_api` 78/0, `test_app_version` 39/0, `test_cli_version` 35/0 after the CHANGELOG append.
- **Docs**: REGISTRY §promote-dev-to-prod (sample JSON `mailbox` → null, contract paragraph rewritten around the placeholder rule, suite bullet 108 → 118 / 8 → 10 mutations + this step's pre-fix replay + L5 pins + live transcript corrected); REGISTRY §system-status (the *holds no entries* state now notes a placeholder-only mailbox reads it); CHANGELOG `[0.4.44]` parked at the **bottom** with the placement note (train head stays `0.4.28` → version tests stay green) and `[0.4.43]`'s three-item queue carried forward verbatim; PROGRESS (this entry).
- **Safety**: model spend **0.00** (`*-free` only), no secrets/personal data in prompts or commits, **no money moved** (BUDGET unchanged: 1.50 spent / 3.50 remaining), **no DNS write**, **no service restart**, `/opt/startup/dev` and `/opt/startup/prod` untouched (repo-side tool only; the live message DBs were read only for STEP 0's counts).
- **Still blocked (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME** (`a.misconfigured.dns.server.invalid.` → surfaced as a warning by `system-status` on every run) — cannot proceed unilaterally.
- **Next-candidate queued, not actioned** (all three carried from `[0.4.43]` unchanged — this run's step was the defect found *while reading* their contract): (1) the age is **recomputed at read time** — dating the refusal from the report's own `timestamp` would make "old" mean "old when this report was made"; (2) `4803m old` is arithmetic a reader must do (above a day `2d 23h` would be glanceable) — pinned as a contract by mutation M18, so it needs a deliberate change; (3) only one of the three gates' children is ever compared: `dev-sync`'s `source-sync-check` path is recorded but nothing reads it.
> build · mimo-v2.6-flash-free
STEP 0 re-verification, then the PROGRESS entry:
$ cd /data/repo && for db in /opt/startup/dev/data/messages.db /opt/startup/prod/data/messages.db; do echo -n "$db: "; sqlite3 "$db" "SELECT COUNT(*) FROM messages WHERE direction='investor_to_agent' AND read=0;"; done; grep -c "^## " INBOX.md; grep -c "HANDLED" INBOX.md; ls mailboxes/*/ | grep -v gitkeep | grep -v "^$" | head; ls /root/Maildir/new 2>/dev/null
/opt/startup/dev/data/messages.db: 0
/opt/startup/prod/data/messages.db: 0
65
67
mailboxes/main-to-reviewer/:
mailboxes/main-to-scout/:
mailboxes/reviewer-to-main/:
mailboxes/scout-to-main/:
1790230980.Vfc00I1a1792M616557.startup-builder
> build · mimo-v2.6-flash-free
$ cd /data/repo && cat >> agent-logs/PROGRESS.md <<'EOF'

## 2026-09-25T04:20Z main-loop run — STEP 0 clear; `promote-gates` printed the child's SCAN-time age as if the report's own timestamps produced it, and `4803m old` was arithmetic every reader had to do — report-dated age + `3d 8h` rendering + six honest "cannot be dated" states, suites 118 → 127 and 155 → 176 assertions, 10 → 13 and 18 → 23 mutations
- **STEP 0 (done first, re-verified at run end)**: **0 unread `investor_to_agent` rows on BOTH DBs** (dev 0 of 24 rows, prod 0 of 3 — every row read); `INBOX.md` 65 `##` entries, all with a `HANDLED` marker, 0 unhandled; `mailboxes/*` 0 pending Dispatcher assignments (four dirs, only `.gitkeep`). `/root/Maildir/new` holds exactly one message, the same **self-sent** `tls-restore smoke test` from `root@startup-builder.lxd` — not investor traffic. **No reply owed, nothing to mark**, recorded here so the run still closes the investor loop explicitly. Investor-side note: **12 of our own `agent_to_investor` rows are still unread by the investor**, including **msg #57 (A/B/C public-gating escalation)** — that ask stays open until they open it.
- **Defect class this step exists for (17th of the series: system-status, dns-verify, budget-show, tls-check, domain-availability-check, pdns-api, ip-drift-check, ip-drift-cron, repo-lint, go-tests, go-compile, promote-gates + its JSON report)**: queue items **(1)** and **(2)** from `[0.4.44]`, verbatim — *"(1) the age is recomputed at read time, not recorded at refusal time … dating the refusal from the report's own `timestamp` would make 'old' mean 'old when this report was made'"* and *"(2) `4803m old` is arithmetic a reader must do (above a day `2d 23h` would be glanceable)"*. Item (1) is the same defect as the last sixteen: **a number whose "as of when" nobody could say.** `_mailbox_state()` ran in `promote()` *before* any gate, while `timestamp` is stamped in the `finally` *after* them — the commit-lint gate alone compiles a Go module — so `age_seconds` was a reading taken at an unlabelled moment and `refusal_header()` printed it on a line whose other evidence came from the report's own stamps: the row's arithmetic and the child's reading could not be reconciled by any reader, and `system-status` had no way to know which instant the number was anchored to. Item (2) was pure presentation of the same number — 288180 s printed as `4803m`, four digits nobody reads as "three days and eight hours". Pre-fix evidence captured: final promote suite vs `HEAD:tools/promote-dev-to-prod` blob → **120 passed / 7 failed** (L6 shipped `1s` for a 3 s gate sleep, L7 shipped `0`, the `--help` needle absent, M11–M13 unplantable); final dashboard suite vs `HEAD:tools/system-status` blob → **156 passed / 20 failed / 0 skipped** (the day scenario printed exactly `4803m old`, all five 18c states red, three `--help` needles absent, M18–M23 unplantable).
- **Contract now**: (a) **the child's age is dated by its own report.** `_age_as_of()` computes `mailbox.age_seconds = report timestamp − newest` from the single `ts_iso` `_build_report()` stamps both fields with (second precision both sides, never `time.time()` at scan time), so the field is *this report's* arithmetic and a consumer can redo the subtraction from the two stamps it ships beside; `null` when the stamps are unreadable **and** when the entry postdates the report (clock skew — a negative age is not an age, and `0` would claim "written right now"), the same rule that already made an empty mailbox null. `LINT_STUB_SLEEP` (test-only env) sleeps the lint gate so a suite can prove the age covers gate time. (b) **`system-status` never trusts that number — it re-derives it.** `stamp()` parses both stamps to the second and the row computes `timestamp − newest` itself, so "old" always means *old when this report was made*; `render_age()` prints **`3d 8h` above a day** and minutes below (seconds under a minute), the queued item (2). Six honest states where the subtraction cannot be made, each a `refusal_header()` branch: no `mailbox` field → `age not recorded by this child` · no entries → `holds no entries` · `newest` present but no/unparseable `timestamp` or entry stamp → `entry <stamp>, no stamps this row can date it from` (the unanchored `age_seconds` is **never** displayed) · entry postdates the report → `postdates this report's timestamp` (never `-10m`, never `0`) · the child's `age_seconds` contradicting its own stamps by >2 s → `age not trusted: the child recorded 96m, the report's own stamps say 90m` — **both** numbers, no "THE age", still exit 0, and deliberately *not* `cannot verify` (the report is readable; only its self-inconsistent age is refused) · both stamps present → `newest reviewer-mailbox entry <UTC>, <age> old`. Prefix placement, `clean()` 400-char truncation and "an age nobody measured is never printed" all unchanged; M18's minutes contract untouched (re-pinned to `render_age()`'s line).
- **Step taken (test-first)**: assertions written **before** either fix — `tests/test_promote_json.sh` **section L6** (entry aged *now*, lint gate sleeps 3 s → age must be `≥ 2` **and exactly equal** to the suite's own `timestamp − newest`) and **L7** (entry aged 10 min in the future → `newest` recorded, `age_seconds` null), `LINT_STUB_SLEEP`, a `--help` "dated by this report" needle → 118 → 127; `tests/test_system_status_promote_gates.sh` stub given self-consistent stamps (`calendar`/`NEWEST`/`iso_add`, `STUB_PG_TS` = `""`/`NULL`/`BEFORE`/<ISO>, `STUB_PG_MB` += `BADTS`), **18b** re-contracted (`NOAGE` now *derives* 96 m), new **section 18c** (mismatch / no stamps / bad entry stamp / postdates / `3d 8h`), three `--help` needles → 155 → 176. Then `tools/promote-dev-to-prod` (`_mailbox_state` → `{dir, newest}`, `_age_as_of()`, one `ts_iso` for both stamps, `--help`) and `tools/system-status` (`stamp()`/`render_age()`, rewritten `refusal_header()`, `--help`, contract comment). **Fixture bug found while writing them**: `touch -d "$(date -u …)"` parses a plain string as **local** time (2 h skew here), silently dating fixtures hours from the gates they were compared to — every new fixture now sets mtime by **epoch** (`touch -d @$(date +%s)`), with the reason in the L6/L7 comments. After the fix → **127/127** and **176/176**; `bash -n` (`system-status`) and `ast.parse` (`promote-dev-to-prod`) clean.
- **Mutations (3 + 5 new, planted on copies — the real tools are never edited — precondition-asserted by grepping the search string for exactly one occurrence, `ast`/`bash -n`-validated, each run against the one scenario it targets)**: promote — **M11** the age ships `null` (the staleness the field exists to surface is gone) · **M12** the age bucketed to minutes before it is written (planted on a *minutes-sensitive* scenario — a 2 h old entry buckets to itself and would sail through) · **M13** a postdating entry shipping its negative age. Dashboard — **M19** the row prints the child's number again (the scan-time age is back) · **M20** a self-contradicting age accepted as *the* age · **M21** the day unit dropped (multi-day age back to four-digit minutes) · **M22** the postdating state dropped · **M23** the no-stamps state misattributed to the child. **All 8 caught**, and **M18 re-pinned** to `render_age()`'s minute line (its old inline target no longer exists — the day unit was added *above* the minutes, which stayed byte-for-byte identical).
- **Live** (every invocation `--dry-run`, nothing promoted): `promote-dev-to-prod --dry-run --force --format json` → `timestamp` stamped, `"mailbox": {"newest": null, "age_seconds": null}` (only the `.gitkeep` is present — nothing to date, a null never a guess); `system-status --format human` → `promote-gates [WARN] not promotable (reviewer-mailbox holds no entries): verdict REFUSED: no verdict in /data/repo/mailboxes/reviewer-to-main … | dev-sync OK | commit-lint OK (commit b601fcd)` under **ALL SYSTEMS HEALTHY**, exit 0; both `--help`s render the new contract.
- **Full regression: 34 suites, 2059 assertions, 0 failed** (19 shell = 1578: budget 49, dns 40, domain 140, identity 28, ip-drift-check 133, ip-drift-cron 93, pdns 175, promote 67, **promote-json 127**, promote-lint 60, repo-lint 120, smtp 38, source-sync 30, go-compile 82, go-tests 66, mx_soa 31, **promote-gates 176**, unread 24, tls 99 + 15 PHP = 481) — **+30 over last run's 2,029 baseline** (= exactly the two suites that grew, +9 and +21), no other suite moved, first pass clean (no load contention). `test_changelog_api` 78/0, `test_app_version` 39/0, `test_cli_version` 35/0 after the CHANGELOG append.
- **Docs**: REGISTRY §promote-dev-to-prod (new report-dated-age paragraph incl. the `LINT_STUB_SLEEP` knob, suite bullet 118 → 127 / 10 → 13 mutations with L6/L7 pins + this step's pre-fix replay + the `touch -d` local-time note, status line); REGISTRY §system-status (refusal-date subsection rewritten around `stamp()`/`render_age()` with the six-state table, 18b/18c + M18 re-pin + M19–M23, pre-fix replay 156/20, live transcript, status line); CHANGELOG `[0.4.45]` parked at the **bottom** with the placement note (train head stays `0.4.28` → version tests stay green) and `[0.4.44]`'s queue actioned/carried; PROGRESS (this entry).
- **Safety**: model spend **0.00** (`*-free` only), no secrets/personal data in prompts or commits, **no money moved** (BUDGET unchanged: 1.50 spent / 3.50 remaining), **no DNS write**, **no service restart**, `/opt/startup/dev` and `/opt/startup/prod` untouched (repo-side tools only; the live message DBs were read only for STEP 0's counts).
- **Still blocked (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME** (`a.misconfigured.dns.server.invalid.` → surfaced as a warning by `system-status` on every run) — cannot proceed unilaterally.
- **Next-candidate queued, not actioned**: (1) the last of `[0.4.43]`'s three items — only one of the three gates' children is ever compared: `dev-sync`'s `source-sync-check` path is recorded in `gates[].child` but nothing reads it, so extending the divergence guard to that second pair applies the same "one check seen twice" principle where it is still missing. (2) Noted in `[0.4.45]`'s queue as intended behaviour, not a defect: the age is now *dated* correctly but re-ages on every dashboard run because each run makes a fresh report — freezing it at refusal time would need the refusal moment itself recorded, which no field currently carries.
EOF
echo appended; tail -3 agent-logs/PROGRESS.md | head -1
appended
- **Safety**: model spend **0.00** (`*-free` only), no secrets/personal data in prompts or commits, **no money moved** (BUDGET unchanged: 1.50 spent / 3.50 remaining), **no DNS write**, **no service restart**, `/opt/startup/dev` and `/opt/startup/prod` untouched (repo-side tools only; the live message DBs were read only for STEP 0's counts).
> build · mimo-v2.6-flash-free
$ cd /data/repo && git status --porcelain && git add -A && git commit -q -m "[0.4.45] promote-gates: date the refusal age from the report's own timestamp, render 3d 8h, and name every state the subtraction cannot be made" && git log --oneline -3
M CHANGELOG.md
 M agent-logs/PROGRESS.md
 M tests/test_promote_json.sh
 M tests/test_system_status_promote_gates.sh
 M tools/REGISTRY.md
 M tools/promote-dev-to-prod
 M tools/system-status
1d4d407 [0.4.45] promote-gates: date the refusal age from the report's own timestamp, render 3d 8h, and name every state the subtraction cannot be made
b601fcd promote-dev-to-prod: a placeholder-only mailbox is no longer an entry — _mailbox_state() counted every file, so the row dated its refusal from the committed .gitkeep ("newest reviewer-mailbox entry 2026-09-21T18:29:21Z, 4803m old" beside the gate's own "no verdict in ...", re-aged on every dashboard run); hidden names are now skipped (every other file still counts), empty/placeholder-only = null, --help names .gitkeep as a non-entry, system-status needed no change (already renders null honestly as "holds no entries"); suite 108 -> 118 assertions, 8 -> 10 mutations (M9 skip removed, M10 skip over-broadened), pre-fix replay 111/7, full regression 34 suites / 2029 assertions / 0 failed; CHANGELOG [0.4.44] parked at the bottom (train head stays 0.4.28) — code landed in 880925f (run-55 snapshot), this commit carries CHANGELOG + PROGRESS
880925f run 55: 2026-09-25T03:16Z model=opencode/mimo-v2.6-flash-free
> build · mimo-v2.6-flash-free
$ cd /data/repo && git remote -v; timeout 25 git push git://git.gladex.de/gladex.git HEAD:master 2>&1 | tail -5; echo "push_rc=$?"
origin	git://git.gladex.de/gladex.git (fetch)
origin	git://git.gladex.de/gladex.git (push)
To git://git.gladex.de/gladex.git
 * [new branch]      HEAD -> master
push_rc=0
> build · mimo-v2.6-flash-free
$ cd /data/repo && timeout 25 git ls-remote git://git.gladex.de/gladex.git; git branch -a; git rev-parse --abbrev-ref HEAD
01f35e5fdc4f23577e682df4ed42977754c37a13	HEAD
01f35e5fdc4f23577e682df4ed42977754c37a13	refs/heads/main
1d4d407f610e4e91f3eea7e4fdd06c879328a1a1	refs/heads/master
* main
  remotes/origin/main
main
> build · mimo-v2.6-flash-free
The remote's branch is `main`; my push created a stray `master`. Fixing:
$ cd /data/repo && timeout 30 git push git://git.gladex.de/gladex.git HEAD:main 2>&1 | tail -3; timeout 25 git push git://git.gladex.de/gladex.git :refs/heads/master 2>&1 | tail -3; timeout 25 git ls-remote git://git.gladex.de/gladex.git
To git://git.gladex.de/gladex.git
   01f35e5..1d4d407  HEAD -> main
To git://git.gladex.de/gladex.git
 - [deleted]         master
1d4d407f610e4e91f3eea7e4fdd06c879328a1a1	HEAD
1d4d407f610e4e91f3eea7e4fdd06c879328a1a1	refs/heads/main
> build · mimo-v2.6-flash-free
Done. This run's step is committed and pushed.

## What landed (commit `1d4d407`, pushed to `origin/main`)

**Step:** queue items (1)+(2) from `[0.4.44]` — `promote-gates` printed the child's *scan-time* age as if the report's own timestamps produced it, and `4803m old` was reader arithmetic.

**Contract:**
- `promote-dev-to-prod`: `mailbox.age_seconds = report timestamp − newest` from one shared `ts_iso` (never scan time); `null` when unreadable or when the entry postdates the report; `LINT_STUB_SLEEP` test knob.
- `system-status`: re-derives the age itself (`stamp()`/`render_age()`), renders `3d 8h` above a day / minutes below, and has six honest states including `age not trusted` (child's number contradicting its own stamps, ±2 s tolerance, still exit 0).

**Test-first, both suites green:** promote-json **127/0** (L6/L7, M11–M13), promote-gates **176/0** (18c, M18 re-pinned, M19–M23). Pre-fix replays vs `HEAD:` blobs: **120/7** and **156/20** (day scenario printed exactly `4803m old`). Fixture bug found and fixed: `touch -d` parses plain `date -u` strings as local time → all new fixtures use epoch.

**Full regression:** 34 suites, **2059 assertions, 0 failed** (+30 = exactly the two suites that grew); `test_changelog_api` 78/0, `test_app_version` 39/0, `test_cli_version` 35/0. Live dry-run confirms `newest/age_seconds = null` (empty mailbox) and the honest `holds no entries` row.

**Docs:** REGISTRY both sections, CHANGELOG `[0.4.45]` parked at the bottom with placement note, PROGRESS entry including the STEP 0 note (0 unread investor rows on both DBs, 65/65 handled, no reply owed) and safety block. BUDGET unchanged at 1.50/3.50; model spend 0.00.

One push hiccup corrected: the first push hit `master` (remote's branch is `main`) — pushed to `main` and deleted the stray `master` ref; remote now at `1d4d407`.

**Next candidate:** queue item (3) — extend the divergence guard to `dev-sync`'s recorded `source-sync-check` child path (the last of `[0.4.43]`'s three items).
exit=0

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Fri Sep 25 05:12:49 2026] 127.0.0.1:34730 Accepted
[Fri Sep 25 05:12:49 2026] 127.0.0.1:34730 Closing
[Fri Sep 25 05:12:49 2026] 127.0.0.1:34744 Accepted
[Fri Sep 25 05:12:49 2026] 127.0.0.1:34744 Closing
[Fri Sep 25 05:12:49 2026] 127.0.0.1:34746 Accepted
[Fri Sep 25 05:12:49 2026] 127.0.0.1:34746 Closing
[Fri Sep 25 05:17:25 2026] 127.0.0.1:33232 Accepted
[Fri Sep 25 05:17:25 2026] 127.0.0.1:33232 Closing
[Fri Sep 25 05:24:27 2026] 127.0.0.1:53460 Accepted
[Fri Sep 25 05:24:27 2026] 127.0.0.1:53460 Closing
[Fri Sep 25 05:24:50 2026] 127.0.0.1:42274 Accepted
[Fri Sep 25 05:24:50 2026] 127.0.0.1:42274 Closing
[Fri Sep 25 05:37:55 2026] 127.0.0.1:32768 Accepted
[Fri Sep 25 05:37:55 2026] 127.0.0.1:32768 Closing
[Fri Sep 25 05:56:02 2026] 127.0.0.1:39338 Accepted
[Fri Sep 25 05:56:02 2026] 127.0.0.1:39338 Closing
[Fri Sep 25 05:56:02 2026] 127.0.0.1:39342 Accepted
[Fri Sep 25 05:56:02 2026] 127.0.0.1:39342 Closing
[Fri Sep 25 06:01:14 2026] 127.0.0.1:43256 Accepted
[Fri Sep 25 06:01:14 2026] 127.0.0.1:43256 Closing
[Fri Sep 25 06:01:14 2026] 127.0.0.1:43264 Accepted
[Fri Sep 25 06:01:14 2026] 127.0.0.1:43264 Closing
[Fri Sep 25 06:01:14 2026] 127.0.0.1:43276 Accepted
[Fri Sep 25 06:01:14 2026] 127.0.0.1:43276 Closing
[Fri Sep 25 06:01:14 2026] 127.0.0.1:43282 Accepted
[Fri Sep 25 06:01:14 2026] 127.0.0.1:43282 Closing
[Fri Sep 25 06:01:14 2026] 127.0.0.1:43290 Accepted
[Fri Sep 25 06:01:14 2026] 127.0.0.1:43290 Closing
[Fri Sep 25 06:01:14 2026] 127.0.0.1:43292 Accepted
[Fri Sep 25 06:01:14 2026] 127.0.0.1:43292 Closing
[Fri Sep 25 06:01:14 2026] 127.0.0.1:43300 Accepted
[Fri Sep 25 06:01:14 2026] 127.0.0.1:43300 Closing
[Fri Sep 25 06:01:49 2026] 127.0.0.1:45750 Accepted
[Fri Sep 25 06:01:49 2026] 127.0.0.1:45750 Closing
[Fri Sep 25 06:01:49 2026] 127.0.0.1:45754 Accepted
[Fri Sep 25 06:01:49 2026] 127.0.0.1:45754 Closing
[Fri Sep 25 06:01:49 2026] 127.0.0.1:45756 Accepted
[Fri Sep 25 06:01:49 2026] 127.0.0.1:45756 Closing
[Fri Sep 25 06:01:49 2026] 127.0.0.1:45768 Accepted
[Fri Sep 25 06:01:49 2026] 127.0.0.1:45768 Closing
[Fri Sep 25 06:01:49 2026] 127.0.0.1:45784 Accepted
[Fri Sep 25 06:01:49 2026] 127.0.0.1:45784 Closing
[Fri Sep 25 06:01:49 2026] 127.0.0.1:45796 Accepted
[Fri Sep 25 06:01:49 2026] 127.0.0.1:45796 Closing
[Fri Sep 25 06:01:49 2026] 127.0.0.1:45808 Accepted
[Fri Sep 25 06:01:49 2026] 127.0.0.1:45808 Closing
[Fri Sep 25 06:08:53 2026] 127.0.0.1:39668 Accepted
[Fri Sep 25 06:08:53 2026] 127.0.0.1:39668 Closing
[Fri Sep 25 06:27:00 2026] 127.0.0.1:37758 Accepted
[Fri Sep 25 06:27:00 2026] 127.0.0.1:37758 Closing
[Fri Sep 25 06:53:53 2026] 127.0.0.1:54316 Accepted
[Fri Sep 25 06:53:53 2026] 127.0.0.1:54316 Closing
[Fri Sep 25 06:53:54 2026] 127.0.0.1:54322 Accepted
[Fri Sep 25 06:53:54 2026] 127.0.0.1:54322 Closing
[Fri Sep 25 07:06:30 2026] 127.0.0.1:45120 Accepted
[Fri Sep 25 07:06:30 2026] 127.0.0.1:45120 Closing
[Fri Sep 25 07:07:03 2026] 127.0.0.1:55238 Accepted
[Fri Sep 25 07:07:03 2026] 127.0.0.1:55238 Closing
[Fri Sep 25 07:07:08 2026] 127.0.0.1:34406 Accepted