Gladex Agent Logs

+++ repo/tools/REGISTRY.md
@@ -682,9 +682,10 @@
 `child` path and `mailbox` evidence fields added 2026-09-25; `mailbox.age_seconds`
 re-dated from the report's own `timestamp` 2026-09-25, CHANGELOG `[0.4.45]`;
 **ship-tree gate (exit 8) added 2026-09-25, CHANGELOG `[0.4.47]`**; exit-7 refusal
 worded from `failures[].lang` instead of assumed from the exit code 2026-09-25,
-CHANGELOG `[0.4.53]`; **the `--help`/docstring commit-lint prose widened to all three
+CHANGELOG `[0.4.53]`; exit-7 reasons attributed per file (`path: message`, never a
+bare reason) 2026-09-25, CHANGELOG `[0.4.54]`; **the `--help`/docstring commit-lint prose widened to all three
 of repo-lint's rules, with `tools/repo-lint --help` named as the list's home, 2026-09-25,
 CHANGELOG `[0.4.55]`**)
 
 ---

> build · mimo-v2.6-flash-free
Now the CHANGELOG — marking `[0.4.54]`'s queue item actioned, then appending `[0.4.55]`:
← Edit repo/CHANGELOG.md
Index: repo/CHANGELOG.md
===================================================================
--- repo/CHANGELOG.md
+++ repo/CHANGELOG.md
@@ -1371,9 +1371,9 @@
 - No new tool, no new gate, no new dashboard check: wording inside the existing `commit-lint` gate, so REGISTRY gains no section and `system-status`'s "29 checks" is untouched. Four gates, four exit codes, the JSON key set and `gates[].child` all unchanged.
 - The **first** test in the repo for the `(+N more)` bound: `_lint_failure_paths` has carried it since the gate existed and nothing asserted it — `many-reasons` now pins both halves at once.
 
 ### Queue (next-candidate, not actioned)
-- **New**: `--help`'s *Commit lint gate* prose still says the committed tree must show "every linted file parses and the committed Go module compiles", which `[0.4.52]`'s CHANGELOG rule also fails — the same "wrapper restates a contract it does not re-read" shape `[0.4.53]` fixed for the exit-7 line, this time in the prose block. Widening it is its own help contract (queued, not slipped in).
+- ~~**New**: `--help`'s *Commit lint gate* prose still says the committed tree must show "every linted file parses and the committed Go module compiles", which `[0.4.52]`'s CHANGELOG rule also fails — the same "wrapper restates a contract it does not re-read" shape `[0.4.53]` fixed for the exit-7 line, this time in the prose block. Widening it is its own help contract (queued, not slipped in).~~ — **actioned by `[0.4.55]`** (both copies of the prose state the three rules and name `tools/repo-lint --help` as the list's home).
 - **Carried from `[0.4.53]` (2)**: `ship-tree` names the first offending path but not *why* it is there (stray editor file vs a real new source file awaiting `git add`).
 - **Carried from `[0.4.53]` (3)**: `--ignored` makes `git status` walk ignored content; a large ignored build dir under `app/src/php` would cost the 30 s `GLADEX_SHIP_TIMEOUT` on every promote *and* every dashboard row.
 - **Carried from `[0.4.53]` (4)**: the `promote-gates` age re-ages on every dashboard run (needs a refusal moment no field carries).
 - **Carried (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME** (`a.misconfigured.dns.server.invalid.`) — surfaced as a warning by `system-status` on every run, cannot proceed unilaterally.

> build · mimo-v2.6-flash-free
$ cd /data/repo && cat >> CHANGELOG.md <<'MDEOF'

## [0.4.55] - 2026-09-25 — promote's `--help` defined a "clean COMMITTED tree" as parse+compile only, the contract repo-lint had BEFORE its CHANGELOG rule: both copies of the commit-lint prose now state all three rules and name the child's own help as the list's home

### Why
Queue item **(1)** from `[0.4.54]`, verbatim: *"`--help`'s *Commit lint gate* prose still says the committed tree must show "every linted file parses and the committed Go module compiles", which `[0.4.52]`'s CHANGELOG rule also fails — the same "wrapper restates a contract it does not re-read" shape `[0.4.53]` fixed for the exit-7 line, this time in the prose block. Widening it is its own help contract (queued, not slipped in)."*

Harm, stated concretely: `--help` is the only copy of "clean" an operator sees without opening the child, and that copy was true when it was written — before repo-lint could exit 1 on a Markdown file. `[0.4.53]` already proved the runtime half of this (`committed file(s) fail to parse or compile: CHANGELOG.md`), but the refusal was only half the lie: the help *beside* it still implied that a parse or a compile failure was the only road to exit 7, so a duplicate `## [1.0.0]` refused a promotion with no sentence anywhere in the tool that could explain why.

A second copy of the same promise was broken differently: the module docstring's gate list has said `3. Commit lint gate (exit 7) — see below.` since the gate existed, and the docstring carries a section per gate — reviewer verdict, `Dev-sync gate (step 0b)`, `Ship-tree gate (step 0d)` — **except 0c**. The pointer had no target: "see below" pointed at the ship-tree section.

### Contract now
- **Epilog** (what `--help` renders): a clean COMMITTED tree is *a committed file that fails to parse, a committed Go file that does not compile, or a changelog version token that repeats* — repo-lint's three rules **as this prose was written** — and the authoritative list is named as `tools/repo-lint --help`, *which this copy follows rather than replaces*. Naming the child's help is the anti-drift device: a fourth rule lands in the child, and this sentence tells the reader where the truth lives instead of implying the list above is complete forever.
- **Module docstring**: gained the missing `Commit lint gate (step 0c, also before any mutating step)` section between 0b and 0d — it says this tool does not decide what "clean" means (it takes the CHILD's verdict), when it refuses (not clean / not obtainable / not verifiable — fail closed), and that the three rules are repo-lint's contract documented once in `tools/repo-lint --help`, named here only to say what today's exit 7 can mean.
- Unchanged: exit codes, the JSON key set, `gates[].child`, gate order, `--force`. No new tool, no new gate, so `system-status`'s "29 checks" is untouched.

### Verification (test-first)
- Assertions written **before** the tool was touched; pre-fix red captured (tool md5 `3911bdccaa03846ee4d8bba55801e94a`, suite md5 `8573a43b48a5b4a71460cb53895582ff`, log `/tmp/opencode/helpcontract/pre-fix.log`) → **130 passed / 9 failed**: **8 behavioural** (the epilog's three rules, the `tools/repo-lint --help` pointer, the stale parse+compile sentence still present, the docstring's missing section, that rule absent there too, and the 0b → 0c → 0d position) plus **M13 unplantable** (`plant matched 0 line(s)` — the line it would revert did not exist yet). The **guards passed pre-fix**, which is what identifies them as guards: the entire 129-assertion baseline, and `Commit lint gate (exit 7) — see below.` — the promise, present while its target was not.
- **Assertions run on whitespace-flattened help** (`tr '\n' ' ' | tr -s ' '`): the epilog is hand-wrapped, so a needle spanning a line break would pass or fail for the wrong reason — this is the first suite in the repo to pin prose that way.
- **One first-draft defect of mine, caught by running it**: the docstring assertions were written against the whole file, and `CHANGELOG version-identity rule` **passed pre-fix** — `check_lint_gate`'s own docstring already said it, three screens below. The assertion would have gone green while the promised section was still missing. Re-scoped to the **module docstring slice** (awk between the first and second `"""`), which is what made it a finding; recorded here because "the copy I was testing was not the copy I meant" is the same defect class this entry exists for.
- **Mutation 12 → 13, caught**: **M13** the changelog rule dropped from the epilog — *the defect itself, planted*. Both help runs still exit 0 and every other sentence survives, so the red can only be in the text (real states `changelog version token that repeats`; mutant does not, and never says `changelog` at all, while rule 2 still reads `does not compile` — surgical).

### Live (no restart, no deploy, no promote)
- `promote-dev-to-prod --help` now renders the three rules and the pointer; `repo-lint --help`'s own `exit codes:` block names the same three (`1 … fails to parse, a committed Go file does not compile, or the committed CHANGELOG.md repeats a version token`) — parent and child agree, and the parent now says which one is authoritative.
- `repo-lint --format json` (real HEAD) → exit 0, `ok true`, 168 files, `changelog_version` = `entries 59, unique 59, unparseable 0, duplicates []`.
- `system-status --format human` → **ALL SYSTEMS HEALTHY**, exit 0; `promote-gates … dev-sync OK | commit-lint OK | ship-tree OK (commit 6fb2c62)` unchanged (the only warnings are the two known ones: empty reviewer mailbox, SOA MNAME — plus `git-tree: 3 uncommitted changes`, this run's own files).

### Full regression (run after the code, before the doc appends)
**35 suites, 2696 assertions, 0 failed** — 19 shell = **1877** (**+14** over 1863, exactly `test_promote_lint_gate` 129 → 143, no other suite moved), 16 PHP = **819**, unmoved. Doc/contract suites after the appends: `test_repo_lint` **156/0**, `test_changelog_api` **86/0**, `test_app_version` **39/0**, `test_cli_version` **35/0**, `test_ts_ordering` **7/0**; `CHANGELOG.md` version tokens `sort | uniq -d` → **0** (checked after this entry was written — no line in it begins with `## [` other than its own heading).

### Notes
- No new tool, no new gate, no new dashboard check: two prose blocks inside an existing tool, so REGISTRY gains no section and "29 checks" is untouched. REGISTRY §promote gains the J-b description, M13, this pre-fix replay, and a paragraph recording that the prose follows the child; its `**Status**` line also picked up the `[0.4.54]` entry it was missing (reasons attributed per file) — a one-clause correction to a running list, made in the same line this entry was editing, not a rewrite of anyone's words.
- The suite's `--help` section is now the only place that would notice if the prose drifted again; M13 is what proves that notice is real rather than assumed.

### Queue (next-candidate, not actioned)
- **New**: `repo-lint`'s **module docstring** exit-codes block is stale in the same way — `0 - every linted file parses cleanly` / `1 - at least one COMMITTED file fails to parse (failures[] says which)` omits **both** the Go compile gate (since `[0.4.3x]`) and the CHANGELOG rule. Its `--help` epilog is correct, so nobody reading the tool is misled today, but it is the child's own copy of the child's own contract — the source-only twin of this entry. Queued, not slipped in.
- **Carried from `[0.4.54]` (2)**: `ship-tree` names the first offending path but not *why* it is there (stray editor file vs a real new source file awaiting `git add`).
- **Carried from `[0.4.54]` (3)**: `--ignored` makes `git status` walk ignored content; a large ignored build dir under `app/src/php` would cost the 30 s `GLADEX_SHIP_TIMEOUT` on every promote *and* every dashboard row.
- **Carried from `[0.4.54]` (4)**: the `promote-gates` age re-ages on every dashboard run (needs a refusal moment no field carries).
- **Carried (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME** (`a.misconfigured.dns.server.invalid.`) — surfaced as a warning by `system-status` on every run, cannot proceed unilaterally.

### Placement (deliberate — same as `[0.4.29]`–`[0.4.54]` which sit immediately above this one)
Parked at the bottom of an otherwise newest-first file on purpose: promoting it to the top would make it the version-train head while `GLADEX_APP_VERSION` and all four `gladex` binaries still report `0.4.28`, turning `tests/test_app_version` and `tests/test_cli_version` red until CI bumps the train. That bump is main-loop work and is not part of this fix.
MDEOF
grep -c '^## \[' CHANGELOG.md; grep '^## \[' CHANGELOG.md | sort | uniq -d; echo "dupes above (empty=none)"
60
dupes above (empty=none)
> build · mimo-v2.6-flash-free
$ cd /data/repo && for f in tests/test_repo_lint.sh tests/test_changelog_api.php tests/test_app_version.php tests/test_cli_version.php tests/test_ts_ordering.php; do case "$f" in *.php) out=$(php "$f" 2>&1);; *) out=$(bash "$f" 2>&1);; esac; line=$(printf '%s\n' "$out" | grep -Eo '[0-9]+ passed, [0-9]+ failed' | tail -1); printf '%-40s %s\n' "$f" "$line"; done; echo "=== live changelog"; tools/repo-lint --format json | python3 -c "import json,sys;d=json.load(sys.stdin);print('changelog_version',d['changelog_version'])"
tests/test_repo_lint.sh                  156 passed, 0 failed
tests/test_changelog_api.php             86 passed, 0 failed
tests/test_app_version.php               39 passed, 0 failed
tests/test_cli_version.php               35 passed, 0 failed
tests/test_ts_ordering.php               7 passed, 0 failed
=== live changelog
changelog_version {'attempted': True, 'path': 'CHANGELOG.md', 'entries': 59, 'unique': 59, 'unparseable': 0, 'duplicates': [], 'ok': True, 'reason': None, 'summary': '59 changelog version heading(s), 59 unique'}
> build · mimo-v2.6-flash-free
$ cd /data/repo && date -u +%Y-%m-%dT%H:%MZ; git status --porcelain; echo "=== remotes"; git remote -v; git branch --show-current
2026-09-25T15:53Z
 M CHANGELOG.md
 M agent-logs/PROGRESS.md
 M tests/test_promote_lint_gate.sh
 M tools/REGISTRY.md
 M tools/promote-dev-to-prod
=== remotes
origin	git://git.gladex.de/gladex.git (fetch)
origin	git://git.gladex.de/gladex.git (push)
main
> build · mimo-v2.6-flash-free
$ cd /data/repo && cat >> agent-logs/PROGRESS.md <<'MDEOF'

## 2026-09-25T15:55Z main-loop run — STEP 0 clear (recorded first, above); promote's `--help` defined a "clean COMMITTED tree" as parse+compile only, the contract repo-lint had *before* its CHANGELOG rule, and the docstring's "see below" for gate 0c pointed at nothing: both copies now state all three rules and name `tools/repo-lint --help` as the list's home — suite 129 → 143, mutations 12 → 13
- **STEP 0 (done first, re-verified at run end)**: the standalone entry above (15:44Z) was this run's first action — **0 unread `investor_to_agent` on both DBs** (dev 0 of 59, prod 0 of 25, every row read), `INBOX.md` **66/66 HANDLED**, `mailboxes/*` only `.gitkeep`, `/root/Maildir/new` only the old `tls-restore smoke test`. **No reply owed, nothing to mark** — recorded there so the investor loop closes explicitly. Re-checked at run end: still 0 unread on both. Investor-side note carried: **13 of our `agent_to_investor` rows remain unread (prod mirrors 17)**, including **msg #57 (A/B/C public-gating escalation)**.
- **Defect class this step exists for (queue item (1) from `[0.4.54]`, 1st of a new series — "a prose block restates a contract it does not re-read")**: verbatim — *"`--help`'s *Commit lint gate* prose still says the committed tree must show 'every linted file parses and the committed Go module compiles', which `[0.4.52]`'s CHANGELOG rule also fails."* Same harm shape as the twenty-two before it, with the arbiter present and *correct* but nobody reading it: `repo-lint --help` has said `1 … fails to parse, a committed Go file does not compile, or the committed CHANGELOG.md repeats a version token` since `[0.4.52]`, while promote's epilog — the only copy an operator sees without opening the child — still carried the two-rule sentence it was written with. `[0.4.53]` fixed the *runtime* half of this (the refusal wording); the help beside it still implied a parse or a compile failure was the only road to exit 7, so a duplicate `## [1.0.0]` could refuse a promotion with no sentence in the tool that explained why. **Found by inspection while reading the queue, not queued from a failure** — which is exactly what the queue said it was.
- **A second copy of the same promise was broken differently, and it is in this step because it is the same gate**: the module docstring's list has promised `3. Commit lint gate (exit 7) — see below.` since the gate existed, and the docstring has a section per gate — reviewer verdict, `Dev-sync gate (step 0b)`, `Ship-tree gate (step 0d)` — **except 0c**. "See below" pointed at the ship-tree section: a pointer with no target, which is the same defect one level down (the prose existed; the contract behind it did not).
- **Choice made, not asked**: the fix does **not** merely widen the enumeration. Both copies now state today's three rules **and name `tools/repo-lint --help` as the authoritative list** (*"which this copy follows rather than replaces"*), because a fourth rule in the child would silently stale any enumeration again — the anti-drift device is the pointer, and the enumeration beside it is there so `--help` stays useful on its own. Docstring section worded the same way: it says this tool does not decide what "clean" means (it takes the child's verdict), and that the three rules are repo-lint's contract, named only to say what today's exit 7 can mean.
- **Step taken (test-first)**: assertions written **before** the tool was touched — `tests/test_promote_lint_gate.sh` gained **section J-b** (five epilog assertions on **whitespace-flattened help** — the epilog is hand-wrapped, so a needle spanning a line break would pass or fail for the wrong reason; plus three docstring assertions on the **module-docstring slice** and a positional check pinning 0c between 0b and 0d) and **M13**. Pre-fix red captured (tool md5 `3911bdccaa03846ee4d8bba55801e94a`, suite md5 `8573a43b48a5b4a71460cb53895582ff`, log `/tmp/opencode/helpcontract/pre-fix.log`) → **130 passed / 9 failed**: 8 behavioural + **M13 unplantable** (`plant matched 0 line(s)` — the line it would revert did not exist yet). Guards that passed pre-fix and thereby identify themselves: the **entire 129-assertion baseline**, and `Commit lint gate (exit 7) — see below.` — the promise, present while its target was not.
- **One first-draft defect of mine, caught by running it rather than by reading it**: the docstring assertions were first written against the **whole file**, and `CHANGELOG version-identity rule` **passed pre-fix** — `check_lint_gate`'s own docstring says it three screens below. That assertion would have gone green while the promised section was still missing: the copy under test was not the copy under discussion, which is the very class this run fixes. Re-scoped to the module-docstring slice (`awk` between the first and second `"""`), after which it failed pre-fix as it should have. Recorded because the correction is the evidence the scoping matters.
- **Fix**: epilog's *Commit lint gate* block rewritten (three rules + the pointer); module docstring gained the `Commit lint gate (step 0c, also before any mutating step)` paragraph between 0b and 0d. Post-fix → **143 passed / 0 failed** (**129 → 143**, **+14**); `bash -n` clean on the suite, `ast.parse` clean on the tool.
- **Mutation (1 new, planted on a copy — the real tool is never edited; precondition-asserted exactly once, `ast`-validated)**: **M13** the changelog rule dropped from the epilog — *the defect itself, planted*. Both `--help` runs exit 0 and every other sentence survives, so the red can only be in the text: real says `changelog version token that repeats`, mutant never says `changelog` at all while rule 2 still reads `does not compile` (surgical, not wholesale). **Caught** (12 → 13).
- **Live** (no restart, no deploy, no promote): `promote-dev-to-prod --help` renders the three rules and the pointer; `repo-lint --help`'s own `exit codes:` block names the same three — parent and child agree, and the parent now says which one is authoritative. `repo-lint --format json` on real HEAD → exit 0, `ok true`, 168 files, `changelog_version` 59/59 unique, `duplicates []`. `system-status --format human` → **ALL SYSTEMS HEALTHY**, exit 0, `promote-gates … dev-sync OK | commit-lint OK | ship-tree OK (commit 6fb2c62)` unchanged (the only warnings are the two known ones — empty reviewer mailbox, SOA MNAME — plus `git-tree: 3 uncommitted changes`, this run's own files).
- **Full regression (run after the code, before the doc appends): 35 suites, 2696 assertions, 0 failed** — 19 shell = **1877** (**+14** over 1863, exactly `test_promote_lint_gate` 129 → 143, no other suite moved), 16 PHP = **819**, unmoved. Doc/contract suites after the appends: `test_repo_lint` **156/0**, `test_changelog_api` **86/0**, `test_app_version` **39/0**, `test_cli_version` **35/0**, `test_ts_ordering` **7/0**; `CHANGELOG.md` **60 entries, `sort | uniq -d` → 0**.
- **Docs**: CHANGELOG `[0.4.55]` parked at the **bottom** with the placement note (train head stays `0.4.28`), `[0.4.54]`'s queue item (1) struck and marked **actioned**; `tools/REGISTRY.md` §promote-dev-to-prod — suite bullet **129 → 143** / **12 → 13** mutations with M13, the **section J-b** description (including the flattened-help and docstring-slice scoping), the `[0.4.55]` pre-fix replay **130/9**, a new paragraph under the step-0c gate documenting that the prose follows the child, and the `**Status**` line — which also picked up the `[0.4.54]` clause it was missing (*reasons attributed per file*), a one-clause correction to a running list made in the line I was already editing, not a rewrite of anyone's words (recorded in CHANGELOG too). **No tool/gate added → no new REGISTRY section**, `system-status`'s "29 checks" untouched.
- **Safety**: model spend **0.00** (`*-free` only), no secrets/personal data in prompts or commits, **no money moved** (BUDGET unchanged: 1.50 spent / 3.50 remaining), **no DNS write** (no resolver queried this run), **no service restart**, **no promote** — `/opt/startup/{dev,prod}` untouched except the read-only STEP 0 queries; the message DBs were **read only** (no reply owed); `/root/.pdns-token` never read; no `noreply@` sendmail invoked. All mutation work ran on copies under the suite's sandbox.
- **Staging discipline**: `git add` explicit — the working tree held exactly this run's 5 files (`tools/promote-dev-to-prod`, `tests/test_promote_lint_gate.sh`, `tools/REGISTRY.md`, `CHANGELOG.md`, `agent-logs/PROGRESS.md`); never `git add -A` while another identity's WIP could sit in the tree.
- **Still blocked (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME** (`a.misconfigured.dns.server.invalid.`) — surfaced as a warning by `system-status` on every run, cannot proceed unilaterally. 13 of our `agent_to_investor` rows remain unread by the investor, including **#57**.
- **Next-candidate queued, not actioned**: (1) **New**: `repo-lint`'s **module docstring** exit-codes block is stale the same way — `0 - every linted file parses cleanly` / `1 - at least one COMMITTED file fails to parse` omits **both** the Go compile gate and the CHANGELOG rule; its `--help` epilog is correct, so nobody reading the tool is misled today, but it is the source-only twin of this step's defect. (2) `ship-tree` names the first offending path but not *why* it is there (carried from `[0.4.49]`). (3) `--ignored` may need a pathspec exclude if `app/src/php` gains a large ignored build dir — the cost is paid on every promote *and* every dashboard row (carried). (4) The `promote-gates` age re-ages on every run (carried, intended).
MDEOF
echo "appended"; grep -c '^## ' agent-logs/PROGRESS.md
appended
136
> build · mimo-v2.6-flash-free
$ cd /data/repo && for f in tests/test_repo_lint.sh tests/test_changelog_api.php tests/test_app_version.php tests/test_cli_version.php tests/test_ts_ordering.php; do case "$f" in *.php) out=$(php "$f" 2>&1);; *) out=$(bash "$f" 2>&1);; esac; line=$(printf '%s\n' "$out" | grep -Eo '[0-9]+ passed, [0-9]+ failed' | tail -1); printf '%-40s %s\n' "$f" "$line"; done; echo "=== changelog dup check"; grep '^## \[' CHANGELOG.md | sort | uniq -d; echo "(empty above = unique)"; git status --porcelain
tests/test_repo_lint.sh                  156 passed, 0 failed
tests/test_changelog_api.php             86 passed, 0 failed
tests/test_app_version.php               39 passed, 0 failed
tests/test_cli_version.php               35 passed, 0 failed
tests/test_ts_ordering.php               7 passed, 0 failed
=== changelog dup check
(empty above = unique)
 M CHANGELOG.md
 M agent-logs/PROGRESS.md
 M tests/test_promote_lint_gate.sh
 M tools/REGISTRY.md
 M tools/promote-dev-to-prod
> build · mimo-v2.6-flash-free
All suites green. Committing:
$ cd /data/repo && git add tools/promote-dev-to-prod tests/test_promote_lint_gate.sh tools/REGISTRY.md CHANGELOG.md agent-logs/PROGRESS.md && git status --porcelain && git commit -q -F - <<'MSGEOF'
promote: --help called a 'clean COMMITTED tree' parse+compile only — the contract repo-lint had BEFORE its CHANGELOG rule; both prose copies now state all three rules and name `tools/repo-lint --help` as the list's home (queue item 1 from 0.4.54): epilog rewritten + the module docstring's gate-3 'see below' finally given its step-0c section between 0b and 0d; test-first, pre-fix 130/9 (8 behavioural + M13 unplantable) vs tool md5 3911bdccaa03846ee4d8bba55801e94a / suite md5 8573a43b48a5b4a71460cb53895582ff, new section J-b (five epilog assertions on whitespace-flattened help, three docstring assertions on the module-docstring slice — the whole-file draft passed pre-fix for the wrong reason, matched check_lint_gate's own docstring — plus the 0b/0c/0d positional check), mutations 12 -> 13 (M13 = the changelog rule dropped from the epilog, the defect itself planted), post-fix 143/0 (+14); live: promote --help vs repo-lint --help now agree and the parent says which is authoritative, repo-lint exit 0 (168 files, changelog 59/59 unique), system-status ALL SYSTEMS HEALTHY; full regression 35 suites / 2696 assertions / 0 failed (shell 1863 -> 1877, exactly this suite, PHP 819 unmoved), doc suites after appends 156/86/39/35/7 all 0, CHANGELOG 60 entries unique; CHANGELOG 0.4.55 parked at the bottom + 0.4.54 queue item (1) struck/actioned, REGISTRY suite bullet + M13 + J-b + pre-fix replay + step-0c prose-follows-the-child paragraph + status line (also picking up the missing 0.4.54 clause), PROGRESS; STEP 0 first: 0 unread investor_to_agent on both DBs (dev 0 of 59, prod 0 of 25), INBOX 66/66 HANDLED, no reply owed; new queue item: repo-lint's own module docstring omits both the Go gate and the changelog rule; no tool/gate added so '29 checks' untouched; no money, no DNS write, no restart, no promote
MSGEOF
git log --oneline -1 | head -c 300; echo; echo "=== pushed?"; git push origin main 2>&1 | tail -3
M  CHANGELOG.md
M  agent-logs/PROGRESS.md
M  tests/test_promote_lint_gate.sh
M  tools/REGISTRY.md
M  tools/promote-dev-to-prod
86081f7 promote: --help called a 'clean COMMITTED tree' parse+compile only — the contract repo-lint had BEFORE its CHANGELOG rule; both prose copies now state all three rules and name `tools/repo-lint --help` as the list's home (queue item 1 from 0.4.54): epilog rewritten + the module docstring's 
=== pushed?
To git://git.gladex.de/gladex.git
   6fb2c62..86081f7  main -> main
> build · mimo-v2.6-flash-free
$ cd /data/repo && tools/repo-lint --format json | python3 -c "import json,sys;d=json.load(sys.stdin);print('repo-lint exit',d['exit_code'],'ok',d['ok'],'changelog',d['changelog_version']['entries'],'entries /',d['changelog_version']['unique'],'unique / dupes',d['changelog_version']['duplicates'])"; echo "=== STEP 0 re-verified at run end"; for db in /opt/startup/dev/data/messages.db /opt/startup/prod/data/messages.db; do echo -n "$db unread: "; sqlite3 "$db" "SELECT COUNT(*) FROM messages WHERE direction='investor_to_agent' AND read=0;"; done; echo -n "INBOX headings/HANDLED: "; echo "$(grep -c '^## ' INBOX.md)/$(grep -c '^## .*~~HANDLED' INBOX.md)"; echo "=== tree"; git status --porcelain; echo "(empty = clean)"; git log --oneline -3 | cut -c1-70
repo-lint exit 0 ok True changelog 60 entries / 60 unique / dupes []
=== STEP 0 re-verified at run end
/opt/startup/dev/data/messages.db unread: 0
/opt/startup/prod/data/messages.db unread: 0
INBOX headings/HANDLED: 66/66
=== tree
(empty = clean)
86081f7 promote: --help called a 'clean COMMITTED tree' parse+compile 
6fb2c62 promote: exit-7 refusal named every failing file and NO reason
1bc106c promote: exit-7 refusal worded from failures[].lang, not from
> build · mimo-v2.6-flash-free
$ cd /data/repo && tools/system-status --format human 2>&1 | grep -E "git-tree|promote-gates|investor-messages|Overall" ; echo "exit=$?"
investor-messages         [OK] 0 unread dev=0 prod=0
  git-tree                  [OK] clean
  promote-gates             [WARN] not promotable (reviewer-mailbox holds no entries): verdict REFUSED: no verdict in /data/repo/mailboxes/reviewer-to-main (expected VERDICT-YYYYMMDD-HHMMSS-<slug>.md containing 'VERDICT: APPROVE') | dev-sync OK | commit-lint OK | ship-tree OK (commit 86081f7)
Overall: ALL SYSTEMS HEALTHY
exit=0
> build · mimo-v2.6-flash-free
Run complete. Summary:

## STEP 0 (first action, before any work)
No unread investor messages anywhere — recorded in `agent-logs/PROGRESS.md` as a standalone entry before touching product code:
- `/opt/startup/dev/data/messages.db`: **0 unread** of 59 rows
- `/opt/startup/prod/data/messages.db`: **0 unread** of 25 rows
- `INBOX.md`: **66 headings, 66 HANDLED, 0 unhandled**
- `mailboxes/*`: only `.gitkeep` (no Dispatcher assignment), `/root/Maildir/new`: only the old smoke test
- Re-verified at run end: still 0/0/66/66 → **no reply owed**

Carried investor-side note: 13 of our `agent_to_investor` rows remain unread by the investor, incl. **#57 (A/B/C public-gating escalation)** — still blocked on them, plus **SOA MNAME**.

## The step: queued item (1) from `[0.4.54]`
`promote-dev-to-prod --help` defined a "clean COMMITTED tree" as *"every linted file parses and the committed Go module compiles"* — repo-lint's contract from **before** its CHANGELOG version-identity rule existed, so an exit 7 on a duplicate `## [1.0.0]` had no sentence in the tool that could explain it. A second copy of the same promise was broken differently: the module docstring's gate list promised `Commit lint gate (exit 7) — see below.` with **no 0c section** (it pointed at ship-tree).

- **Fix**: epilog states all three rules **and names `tools/repo-lint --help` as the authoritative list** (the anti-drift device — a 4th rule in the child no longer silently stales the copy); docstring gained the missing `step 0c` section between 0b and 0d.
- **Test-first**: pre-fix red **130 passed / 9 failed** (tool md5 `3911bdcc…`); my first draft had one assertion passing **for the wrong reason** (whole-file match hit `check_lint_gate`'s docstring) — caught by running it, re-scoped to the docstring slice.
- **Mutations 12 → 13**: M13 = the changelog rule dropped from the epilog (the defect itself), **caught**.
- **Post-fix 143/0** (+14); **full regression 35 suites / 2696 assertions / 0 failed** (shell 1863 → 1877, PHP 819 unmoved); doc suites after appends 156/86/39/35/7 all 0; CHANGELOG **60 entries, 60 unique**.
- **Live**: parent and child `--help` now agree, `repo-lint` exit 0 (60/60 unique), `system-status` → **ALL SYSTEMS HEALTHY** (`git-tree clean`, `commit-lint OK | ship-tree OK (commit 86081f7)`).
- **Docs**: CHANGELOG `[0.4.55]` at the bottom (train head stays `0.4.28`), `[0.4.54]` queue item struck/actioned, REGISTRY (suite bullet, M13, J-b, pre-fix replay, status line), PROGRESS.
- **New queue item**: `repo-lint`'s own module docstring omits both the Go gate and the changelog rule — queued, not slipped in.

**Safety**: spend 0.00, BUDGET unchanged (1.50/3.50), no money, no DNS write, no restart, no promote, no secrets in prompts or commits. Committed `86081f7` with explicit `git add` (exactly this run's 5 files) and pushed to `origin`.
exit=0

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Fri Sep 25 18:10:54 2026] 127.0.0.1:37342 Accepted
[Fri Sep 25 18:10:54 2026] 127.0.0.1:37342 Closing
[Fri Sep 25 18:10:54 2026] 127.0.0.1:37350 Accepted
[Fri Sep 25 18:10:54 2026] 127.0.0.1:37350 Closing
[Fri Sep 25 18:10:54 2026] 127.0.0.1:37358 Accepted
[Fri Sep 25 18:10:54 2026] 127.0.0.1:37358 Closing
[Fri Sep 25 18:10:54 2026] 127.0.0.1:37362 Accepted
[Fri Sep 25 18:10:54 2026] 127.0.0.1:37362 Closing
[Fri Sep 25 18:10:54 2026] 127.0.0.1:37364 Accepted
[Fri Sep 25 18:10:54 2026] 127.0.0.1:37364 Closing
[Fri Sep 25 18:10:54 2026] 127.0.0.1:37368 Accepted
[Fri Sep 25 18:10:54 2026] 127.0.0.1:37368 Closing
[Fri Sep 25 18:10:54 2026] 127.0.0.1:37376 Accepted
[Fri Sep 25 18:10:54 2026] 127.0.0.1:37376 Closing
[Fri Sep 25 18:11:11 2026] 127.0.0.1:52704 Accepted
[Fri Sep 25 18:11:12 2026] 127.0.0.1:52704 Closing
[Fri Sep 25 18:11:12 2026] 127.0.0.1:52712 Accepted
[Fri Sep 25 18:11:12 2026] 127.0.0.1:52712 Closing
[Fri Sep 25 18:11:13 2026] 127.0.0.1:52722 Accepted
[Fri Sep 25 18:11:13 2026] 127.0.0.1:52722 Closing
[Fri Sep 25 18:11:13 2026] 127.0.0.1:52732 Accepted
[Fri Sep 25 18:11:13 2026] 127.0.0.1:52732 Closing
[Fri Sep 25 18:11:14 2026] 127.0.0.1:52736 Accepted
[Fri Sep 25 18:11:14 2026] 127.0.0.1:52736 Closing
[Fri Sep 25 18:11:14 2026] 127.0.0.1:52750 Accepted
[Fri Sep 25 18:11:14 2026] 127.0.0.1:52750 Closing
[Fri Sep 25 18:11:14 2026] 127.0.0.1:54350 Accepted
[Fri Sep 25 18:11:15 2026] 127.0.0.1:54350 Closing
[Fri Sep 25 18:11:15 2026] 127.0.0.1:54352 Accepted
[Fri Sep 25 18:11:15 2026] 127.0.0.1:54352 Closing
[Fri Sep 25 18:11:15 2026] 127.0.0.1:54366 Accepted
[Fri Sep 25 18:11:16 2026] 127.0.0.1:54366 Closing
[Fri Sep 25 18:11:16 2026] 127.0.0.1:54380 Accepted
[Fri Sep 25 18:11:16 2026] 127.0.0.1:54380 Closing
[Fri Sep 25 18:11:16 2026] 127.0.0.1:54388 Accepted
[Fri Sep 25 18:11:17 2026] 127.0.0.1:54388 Closing
[Fri Sep 25 18:11:17 2026] 127.0.0.1:54398 Accepted
[Fri Sep 25 18:11:17 2026] 127.0.0.1:54398 Closing
[Fri Sep 25 18:11:17 2026] 127.0.0.1:54414 Accepted
[Fri Sep 25 18:11:18 2026] 127.0.0.1:54414 Closing
[Fri Sep 25 18:11:18 2026] 127.0.0.1:54426 Accepted
[Fri Sep 25 18:11:18 2026] 127.0.0.1:54426 Closing
[Fri Sep 25 18:11:18 2026] 127.0.0.1:54440 Accepted
[Fri Sep 25 18:11:19 2026] 127.0.0.1:54440 Closing
[Fri Sep 25 18:11:19 2026] 127.0.0.1:54444 Accepted
[Fri Sep 25 18:11:19 2026] 127.0.0.1:54444 Closing
[Fri Sep 25 18:11:19 2026] 127.0.0.1:54454 Accepted
[Fri Sep 25 18:11:20 2026] 127.0.0.1:54454 Closing
[Fri Sep 25 18:11:20 2026] 127.0.0.1:54456 Accepted
[Fri Sep 25 18:11:20 2026] 127.0.0.1:54456 Closing
[Fri Sep 25 18:11:20 2026] 127.0.0.1:54460 Accepted
[Fri Sep 25 18:11:21 2026] 127.0.0.1:54460 Closing
[Fri Sep 25 18:11:21 2026] 127.0.0.1:54472 Accepted
[Fri Sep 25 18:11:21 2026] 127.0.0.1:54472 Closing
[Fri Sep 25 18:12:47 2026] 127.0.0.1:57094 Accepted
[Fri Sep 25 18:12:47 2026] 127.0.0.1:57094 Closing
[Fri Sep 25 18:12:54 2026] 127.0.0.1:57096 Accepted
[Fri Sep 25 18:12:54 2026] 127.0.0.1:57096 Closing
[Fri Sep 25 18:16:14 2026] 127.0.0.1:51130 Accepted