Gladex Agent Logs

 M tests/test_repo_lint.sh
 M tools/REGISTRY.md
 M tools/repo-lint
--- current HEAD ---
1db4008 docs: refresh the live changelog count in the same run that appended to it — repo-lint read 63 entries before [0.4.59] was written and 64/64 on the committed tree after it, so REGISTRY's live bullet, the CHANGELOG entry's Live section and PROGRESS now all record 64 with the 63→64 movement noted rather than a count that went stale mid-run (the stale-live-number class this repo keeps paying for); the doc/contract suites were re-run after the edit: test_repo_lint 198/0, test_changelog_api 86/0, test_app_version 39/0, test_cli_version 35/0, test_ts_ordering 7/0, version tokens 64 unique (0 duplicates)
> build · mimo-v2.6-flash-free
Working tree holds exactly my 4 files. Writing the PROGRESS entry:
$ cd /data/repo && cat >> agent-logs/PROGRESS.md <<'PROGRESS_EOF'

## 2026-09-25T17:46Z main-loop run — STEP 0 (done first, re-verified at end): no unread investor message anywhere; `[0.4.59]`'s queue item (1): the derived epilog could still print a label over nothing — `docstring_section` returned `""` for a heading it could not find and `"\n\n".join` does not object, so the refusal now happens at import (exit 3, naming the pair), suite 198 → 218, mutations 13 → 14
- **STEP 0 (this run's first action, before any product work)**: queried unread `investor_to_agent` rows in **both** DBs with the real schema (`direction='investor_to_agent' AND read=0`) — `/opt/startup/dev/data/messages.db` **0 of 59 rows**, `/opt/startup/prod/data/messages.db` **0 of 25 rows** (every row read, not just a count); `INBOX.md` **66 `##` headings, 66 HANDLED, 0 unhandled**; `mailboxes/{main-to-reviewer,main-to-scout,reviewer-to-main,scout-to-main}` hold only their folder scaffolding — no pending Dispatcher assignment; `/root/Maildir/new` holds only the old `tls-restore smoke test` (headers re-read this run: `Subject: tls-restore smoke test`, 2026-09-24 — not new work). **No reply owed, nothing to mark** — recorded here first so the run closes the investor loop explicitly. **Re-checked at run end**: still 0 unread on both DBs, INBOX still 66/66. Investor-side note carried: **13 of our `agent_to_investor` rows remain unread (prod mirrors 17)**, including **msg #57 (A/B/C public-gating escalation)** — that ask stays open until they open it.
- **Defect class this step exists for (queue item (1) from `[0.4.59]`, verbatim)**: *"`docstring_section` silently returns `""` for a heading it cannot find — the derivation fails **quietly**, and only Q-render's "docstring side must be non-empty" assertion stands between that and an epilog section that prints a label over nothing. A guard inside the tool (raise/fall back at import time if any `_EPILOG_SECTIONS` heading is missing) would make it impossible rather than merely tested; queued, not slipped in."* Same harm shape as the twenty-five before it but inverted: every earlier step removed a **second copy** that could drift, and `[0.4.59]` made all seven sections derived — yet the derivation itself was written to degrade *silently*. An empty string joins without complaint, so a renamed or deleted heading produced `env:` above a blank line with `--help` still exiting **0**. The only thing in the way was a **test**, and a test covers only the heading someone remembered to name: an eighth pair added to `_EPILOG_SECTIONS` tomorrow with a typo'd heading would have passed **every assertion in this suite**.
- **Choice made, not asked — REFUSE, never fall back**: the queue's own wording offered "raise/**fall back**", and the fallback was **rejected** — a fallback has to *invent* something to render (an empty string *is* the defect; a hand-written stub is a second copy of prose nobody derives), so the only honest answers are "run with the correct section" or "do not run". **Exit 3, not 1**: the ladder is already written in this tool's contract — *"a lint that did not run is never a pass"* — and exit 1 means **a file** failed to parse, spelled out in `failures[]`; reporting a broken *tool* there would make it look like a broken *repo*, and exit 0 would be the actual bug. The `Exit codes:` line for 3 gained one clause, a single-copy edit because that block *is* the source, so `--help` picked it up with no second place to update. **At import, not at `--help`**: `EPILOG` builds at module scope before argparse exists, so no invocation gets past it — the difference between "the tool cannot help you" and "the tool cannot run".
- **Step taken (test-first)**: assertions written **before** the tool was touched — new **section R** in `tests/test_repo_lint.sh`: **R1–R3** guards on the healthy tool (exit 0, no refusal on stderr, all seven labels rendering a non-empty body); **R4–R9** the heading **renamed away** while the tuple still names it (refuse exit 3; name `'env:' -> 'Environment:'`; nothing on stdout; name **only** the broken pair; under `--format json` also refuse and produce **no** JSON verdict); **R10–R12b** a heading that **exists but whose block is empty** — `docstring_section` stops at the first blank line, so "found" must not be allowed to mean "fine". **Baseline verified first**: committed suite vs committed tool → **198/198**.
- **A false pass in my OWN harness, caught by reading the red rather than by the suite**: R9 first ran the mutant with `env -u GLADEX_REPO_DIR`, and the mutant lives at `$SB/mutr_a`, so its default repo was `$SB` — **not a git repo** — and it exited 3 for *that* reason. The assertion went green while proving nothing: the right code for the wrong cause, which is precisely the trap this step is about. Fixed by pointing `GLADEX_REPO_DIR` at the real sandbox repo so the refusal is the only possible cause of a 3, with a comment in the test so the next reader does not "simplify" it back. Same class of artifact bit the **pre-fix capture** too: running the new suite against a tool copy placed in `/tmp` makes section L's live checks fail on path reasons (`default_repo()` resolves relative to the script → `repo_root: /tmp/...` → exit 3), so the first pre-fix log was **192/21** — mostly my own harness, not findings. **Re-captured inside a clone of the repo**, where the old tool sits at its real relative path.
- **Pre-fix red captured** (old tool md5 `4e6c58ffc86441a5745054a4ea45d084`, final suite md5 `e126f791dbcd4b1d9ae0bd0626022d82`, log `/tmp/opencode/epilogrefuse/pre-fix.log`) → **203 passed / 10 failed**. **Nine are real**: **R5, R6, R7, R9 ×2, R11, R12, R12b** plus **M14's precondition unplantable** (the refusal does not exist yet, so its other five assertions could not run — hence **213 counted pre-fix against 218 post-fix**). The tenth, `L: live json structurally sound`, asserts `d['repo_root'] == '/data/repo'`, which is true in the real repo and false in a clone at `/tmp/...` — an artifact of my cloning, disclosed rather than counted as a finding. **Guards that passed pre-fix and thereby identify themselves**: R1, R2, R3, R4, R8, R10.
- **Fix**: docstring `Exit codes:` 3 widened by one clause; the "single copy" paragraph gained the paragraph saying why `""` is a broken contract; `_refuse_empty_epilog()` + `_build_epilog()` replace the bare `"\n\n".join(...)` — the emptiness check now runs **once, over every pair in the tuple**, so a heading added to `_EPILOG_SECTIONS` is covered the moment it is added (the guard's scope is the tuple, not a list of headings someone maintains). → **218 passed / 0 failed** (**198 → 218**, **+20**); `bash -n` clean on the suite, `ast.parse` + `py_compile` clean on the tool.
- **Mutation (1 new, on a copy — the real tool is never edited)**: **M14 = the pre-`[0.4.60]` state reproduced** — R's trigger (heading renamed while the tuple still names it) **in the same copy as** the refusal's condition defeated (`if missing:` → `if False:`). **Two edits deliberately, and the reason is the finding**: defeating the guard **alone** changes nothing — I built it that way first and the mutant came out **green**, because a healthy docstring still yields seven full sections. That is not a flaw in the mutation, it is the argument: **the guard was never the defect, it is what makes an always-available trigger loud** (renaming a heading is one keystroke; what changed is that it used to be tolerated). With both halves present `--help` exits 0 over a label printed on nothing and stderr is silent — caught by R's refusal assertions and by `r_labels` (R3's own check, run against the mutant) going red at **exactly** the `env:` label, while an unrelated section still byte-equals its docstring (surgical). **13 → 14.**
- **Live** (no restart, no deploy, no promote): `repo-lint --help` → exit 0, **103 lines** (was 102 — the widened exit-3 clause), `exit codes:` rendering the new clause verbatim from the docstring; refusal demonstrated live on a copy with the heading renamed → `repo-lint: refusing to run - docstring section missing or empty (the epilog would print a label over nothing):` / `  'env:' -> 'Environment:'` → **exit 3**; `repo-lint --format json` (real HEAD) → **exit 0**, 170 files, 119 linted, `changelog_version` `entries 65, unique 65, duplicates []`, `sha_resolved 1db4008b`; `tools/source-sync-check` → in sync (42 files, exit 0); `tools/system-status --format human` → **ALL SYSTEMS HEALTHY**, exit 0 (standing warnings only: SOA MNAME `placeholder` NEEDS-INVESTOR, reviewer mailbox empty so promote-gates refuses, `git-tree: 2 uncommitted changes` = this run's files, plus `investor-messages [OK] 0 unread dev=0 prod=0`).
- **Full regression (run after the code, before the doc appends): 37 suites, 2897 assertions, 0 failed** — 19 shell = **1939** (**+20** over 1919, exactly `test_repo_lint` 198 → 218, no other shell suite moved), 18 PHP = **958**, unmoved. Doc/contract suites **after** the appends: `test_repo_lint` **218/0**, `test_changelog_api` **86/0**, `test_app_version` **39/0**, `test_cli_version` **35/0**, `test_ts_ordering` **7/0**; `CHANGELOG.md` **65 headings, 65 unique, `uniq -d` → 0**.
- **One tool-side number caught mid-run by my own laziness**: my first duplicate check used `sed 's/.*\[\([^]]*\)\].*/\1/'`, whose greedy `.*\[` takes the **last** bracket on the line and reported four phantom duplicates (`0.4.31 0.4.40 0.4.44 0.4.49`). Anchored at `^## \[` instead — 65/65, 0 duplicates. Same trap this repo recorded for `[0.4.59]`; noted so the count in the entry is one I actually verified with the right method.
- **Docs**: CHANGELOG **`[0.4.60]` parked at the bottom** with the placement note (train head deliberately still `0.4.28`) and **`[0.4.59]`'s queue item (1) struck and marked actioned**, recording that its "raise/fall back" wording was resolved as **refuse-only**. `tools/REGISTRY.md` §repo-lint: exit-**3** bullet widened by the new clause (pointing at §JSON so no reference dangles), §JSON gained the **open-exception** note it pointed at, new **"Section R — the epilog REFUSES to build a label over nothing"** bullet, suite bullet **198 → 218**, **M14** in the mutation list (**13 → 14**), the `[0.4.60]` pre-fix replay with why it had to be captured in a clone, a refreshed live line (**170** files, **65** changelog entries, **103**-line help, the live refusal), and the `**Status**` line → 218/218 + the 37-suite regression. **No new tool, no new gate, no new dashboard check** → no new REGISTRY section, `system-status`'s "29 checks" untouched.
- **Safety**: model spend **0.00** (`*-free` only), no secrets/personal data in prompts or commits, **no money moved** (BUDGET unchanged: 1.50 spent / 3.50 remaining), **no DNS write** (no resolver queried this run), **no service restart**, **no promote** — `/opt/startup/{dev,prod}` untouched except the read-only STEP 0 queries; the message DBs were **read only** (0 unread, no reply owed); `/root/.pdns-token` never read; no `noreply@` sendmail invoked. Every mutation ran on a copy under the suite's sandbox; the pre-fix tool is kept at `/tmp/opencode/epilogrefuse/old-repo-lint` for replay, and the pre-fix capture ran in a throwaway clone so `/data/repo` was never reverted even for a moment.
- **Staging discipline (deliberate deviation from `git add -A`)**: `git status --porcelain` was checked first and showed **exactly this run's four files** (`CHANGELOG.md`, `tests/test_repo_lint.sh`, `tools/REGISTRY.md`, `tools/repo-lint`) with no other identity's WIP — staged **explicitly**, plus this file, rather than sweeping the tree while other shifts work in it. The standing rule ("never `git add -A` while another identity's WIP could sit in the tree") is the tighter reading of the loop's own instruction.
- **Still blocked (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME** (`a.misconfigured.dns.server.invalid.`) — surfaced by `system-status` every run, cannot proceed unilaterally. 13 of our `agent_to_investor` rows remain unread, including **#57**.
- **Next-candidate queued, not actioned**: (1) **New, found by doing this step** — under `--format json` the refusal writes to stderr and raises **before argparse exists**, so `repo-lint --format json | jq` gets **empty stdin and a jq parse error**, while the tool's documented JSON contract is that `die()` always emits an object carrying `go_compile: null` and `changelog_version: null`. Refusing is right; undecided is whether a pre-argparse refusal is the one documented exception (then say so in the §JSON bullet) or must also emit a JSON error object (then detect `--format json` in `sys.argv` before refusing). Today it is *neither* — a third, undocumented behaviour. (2) `app.php`'s chat-header accent-TEXT contrast at 3.55:1 across four documents (from `[0.4.58]`). (3) `ship-tree` names the first offending path but not *why* it is there (carried from `[0.4.54]`). (4) `--ignored` pathspec exclude (carried). (5) The `promote-gates` age re-ages on every run (carried, intended).
PROGRESS_EOF
echo "appended; PROGRESS lines: $(wc -l < agent-logs/PROGRESS.md)"
appended; PROGRESS lines: 5105
> build · mimo-v2.6-flash-free
Committing — checking the tree state first, then staging explicitly per the repo's documented staging discipline:
$ cd /data/repo && echo "=== tree state ==="; git status --porcelain; echo "=== staging explicitly ==="; git add tools/repo-lint tests/test_repo_lint.sh tools/REGISTRY.md CHANGELOG.md agent-logs/PROGRESS.md && git status --porcelain --cached | head; echo "=== staged ==="; git diff --cached --stat
=== tree state ===
 M CHANGELOG.md
 M agent-logs/PROGRESS.md
 M tests/test_repo_lint.sh
 M tools/REGISTRY.md
 M tools/repo-lint
=== staging explicitly ===
error: unknown option `cached'
usage: git status [<options>] [--] [<pathspec>...]

    -v, --[no-]verbose    be verbose
    -s, --[no-]short      show status concisely
    -b, --[no-]branch     show branch information
    --[no-]show-stash     show stash information
    --[no-]ahead-behind   compute full ahead/behind values
    --[no-]porcelain[=<version>]
                          machine-readable output
    --[no-]long           show status in long format (default)
    -z, --[no-]null       terminate entries with NUL
    -u, --[no-]untracked-files[=<mode>]
                          show untracked files, optional modes: all, normal, no. (Default: all)
    --[no-]ignored[=<mode>]
                          show ignored files, optional modes: traditional, matching, no. (Default: traditional)
    --[no-]ignore-submodules[=<when>]
                          ignore changes to submodules, optional when: all, dirty, untracked. (Default: all)
    --[no-]column[=<style>]
                          list untracked files in columns
    --no-renames          do not detect renames
    --renames             opposite of --no-renames
    -M, --find-renames[=<n>]
                          detect renames, optionally set similarity index

=== staged ===
 CHANGELOG.md            |  54 +++++++++++++++++-
 agent-logs/PROGRESS.md  |  18 ++++++
 tests/test_repo_lint.sh | 149 ++++++++++++++++++++++++++++++++++++++++++++++++
 tools/REGISTRY.md       |  15 ++---
 tools/repo-lint         |  73 ++++++++++++++++++++++--
 5 files changed, 295 insertions(+), 14 deletions(-)
> build · mimo-v2.6-flash-free
Staged exactly my 5 files. Committing:
$ cd /data/repo && git commit -q -F - <<'MSG'
repo-lint: the derived epilog could still print a label over nothing — docstring_section returned "" for a heading it could not find and "\n\n".join does not object, so a renamed docstring heading printed `env:` above a blank line with --help exiting 0; the refusal now happens at import (exit 3, naming each offending pair), suite 198 → 218, mutations 13 → 14

Queue item (1) from [0.4.59], verbatim: "docstring_section silently returns "" for a heading it cannot find — the derivation fails quietly, and only Q-render's 'docstring side must be non-empty' assertion stands between that and an epilog section that prints a label over nothing. A guard inside the tool (raise/fall back at import time if any _EPILOG_SECTIONS heading is missing) would make it impossible rather than merely tested; queued, not slipped in." Same shape as the twenty-five defects before it but inverted: every earlier step REMOVED a second copy that could drift, and [0.4.59] made all seven sections derived — yet the derivation was itself written to degrade silently. The only thing in the way was a test, and a test covers only the heading someone remembered to name: an eighth pair added to _EPILOG_SECTIONS tomorrow with a typo'd heading would have passed every assertion in this suite.

Choice made, not asked — REFUSE, never fall back: the queue's wording offered "raise/fall back" and the fallback was rejected, because a fallback has to INVENT something to render (an empty string IS the defect; a hand-written stub is a second copy of prose nobody derives). Exit 3, not 1: the contract already says "a lint that did not run is never a pass", exit 1 means A FILE failed to parse as spelled out in failures[] (a broken TOOL must not read as a broken REPO), and exit 0 would be the actual bug. At import, not at --help: EPILOG builds at module scope before argparse exists, so no invocation gets past it — the difference between "the tool cannot help you" and "the tool cannot run". Exit codes' line 3 gained one clause, a single-copy edit since that block IS the source, so --help picked it up with no second place to update.

Test-first: new section R written before the tool was touched — R1-R3 guards on the healthy tool (exit 0, no refusal, all seven labels non-empty); R4-R9 the heading renamed away while the tuple still names it (refuse 3, name 'env:' -> 'Environment:', nothing on stdout, name ONLY the broken pair, and under --format json also refuse producing no JSON verdict); R10-R12b a heading that exists but whose block is EMPTY (docstring_section stops at the first blank line, so "found" must not mean "fine"). Baseline verified first: 198/198.

Two harness artifacts caught by READING the red, not by the suite, and both disclosed rather than counted: (a) R9 first ran the mutant with GLADEX_REPO_DIR unset, so its default repo was $SB — not a git repo — and it exited 3 for THAT reason, a green assertion proving nothing (right code, wrong cause, the exact trap this step is about); fixed by pointing GLADEX_REPO_DIR at the real sandbox repo, with a comment so it is not "simplified" back. (b) the pre-fix capture ran the new suite against a tool copy in /tmp, where section L's live checks fail on PATH reasons (default_repo() resolves relative to the script → repo_root /tmp/... → exit 3), giving a misleading 192/21; re-captured inside a clone of the repo where the old tool sits at its real relative path → 203 passed / 10 failed, of which NINE are real (R5, R6, R7, R9 x2, R11, R12, R12b + M14's precondition unplantable, hence 213 counted pre-fix against 218 post-fix) and the tenth is L's d['repo_root'] == '/data/repo', true in the real repo and false in a clone. Guards passing pre-fix and thereby identifying themselves: R1, R2, R3, R4, R8, R10.

Fix: _refuse_empty_epilog() + _build_epilog() replace the bare "\n\n".join — the emptiness check runs ONCE over every pair in the tuple, so a heading added to _EPILOG_SECTIONS is covered the moment it is added (the guard's scope is the tuple, not a list of headings someone maintains). 198 → 218 (+20); bash -n clean, ast.parse + py_compile clean.

M14 (new, on a copy; the real tool is never edited) = the pre-[0.4.60] state reproduced: R's trigger AND the refusal's condition defeated (`if missing:` → `if False:`) in the SAME copy. Two edits deliberately — defeating the guard alone changes nothing, because a healthy docstring still yields seven full sections; I built it that way first and the mutant came out GREEN, which is the finding rather than a mutation flaw: the guard was never the defect, it is what makes an always-available trigger loud (renaming a heading is one keystroke; what changed is that it used to be tolerated). Both halves → --help exits 0 over a label printed on nothing, stderr silent, caught by R's refusals and by R3's own check going red at exactly `env:`, with an unrelated section still byte-equal (surgical).

Live (no restart, no deploy, no promote): --help 103 lines (was 102), refusal demonstrated on a renamed copy → exit 3 naming the pair; repo-lint --format json on HEAD → exit 0, 170 files, changelog 65/65 unique, sha 1db4008b; source-sync-check in sync (42 files); system-status → ALL SYSTEMS HEALTHY (standing warnings only). Full regression after the code and before the doc appends: 37 suites, 2897 assertions, 0 failed — 19 shell = 1939 (+20, exactly test_repo_lint, no other shell suite moved), 18 PHP = 958 unmoved; doc suites after the appends test_repo_lint 218/0, test_changelog_api 86/0, test_app_version 39/0, test_cli_version 35/0, test_ts_ordering 7/0, CHANGELOG 65 headings 65 unique (a first duplicate check used a greedy `.*\[` that takes the LAST bracket and reported four phantom dups — anchored at ^## \[ instead; same trap recorded for [0.4.59]).

Docs: CHANGELOG [0.4.60] parked at the bottom (train head deliberately still 0.4.28) with [0.4.59]'s queue item (1) struck and actioned, noting its "raise/fall back" wording resolved as refuse-only; REGISTRY §repo-lint — exit-3 bullet widened (pointing at §JSON so no reference dangles), §JSON gained the open-exception note it points at, new Section R bullet, suite 198 → 218, M14 in the mutation list (13 → 14), the [0.4.60] pre-fix replay, refreshed live line (170 files / 65 entries / 103-line help / the live refusal), Status → 218/218 + the 37-suite regression. No new tool, no new gate, no new dashboard check → no new REGISTRY section, system-status's "29 checks" untouched.

Newly queued (not slipped in): under --format json the refusal raises BEFORE argparse exists, so `repo-lint --format json | jq` gets empty stdin and a jq parse error, while the documented JSON contract is that die() always emits an object carrying go_compile/changelog_version null — refusing is decided, whether a pre-argparse refusal should still emit a JSON error object is not (today it is neither, i.e. a third undocumented behaviour).

Safety: spend 0.00 (*-free only), no secrets/personal data in prompts or commits, no money moved (BUDGET unchanged 1.50 spent / 3.50 remaining), no DNS write, no restart, no promote; /opt/startup/{dev,prod} untouched except read-only STEP 0 queries (0 unread on both DBs, INBOX 66/66 handled, no reply owed, re-verified at run end); /root/.pdns-token never read; no noreply@ sendmail invoked. Every mutation ran on a copy in the suite sandbox; pre-fix tool kept at /tmp/opencode/epilogrefuse/old-repo-lint for replay. Staged explicitly (git status showed exactly this run's 5 files, no other identity's WIP) rather than git add -A while other shifts work in the tree.
MSG
echo "=== committed ==="; git log --oneline -1; echo; git show --stat HEAD | head -20
=== committed ===
dacd5d1 repo-lint: the derived epilog could still print a label over nothing — docstring_section returned "" for a heading it could not find and "\n\n".join does not object, so a renamed docstring heading printed `env:` above a blank line with --help exiting 0; the refusal now happens at import (exit 3, naming each offending pair), suite 198 → 218, mutations 13 → 14

commit dacd5d15e59c7602704e56712ac87a92f3d6db69
Author: startup-agent <agent@startup-builder.local>
Date:   Fri Sep 25 19:47:27 2026 +0200

    repo-lint: the derived epilog could still print a label over nothing — docstring_section returned "" for a heading it could not find and "\n\n".join does not object, so a renamed docstring heading printed `env:` above a blank line with --help exiting 0; the refusal now happens at import (exit 3, naming each offending pair), suite 198 → 218, mutations 13 → 14
    
    Queue item (1) from [0.4.59], verbatim: "docstring_section silently returns "" for a heading it cannot find — the derivation fails quietly, and only Q-render's 'docstring side must be non-empty' assertion stands between that and an epilog section that prints a label over nothing. A guard inside the tool (raise/fall back at import time if any _EPILOG_SECTIONS heading is missing) would make it impossible rather than merely tested; queued, not slipped in." Same shape as the twenty-five defects before it but inverted: every earlier step REMOVED a second copy that could drift, and [0.4.59] made all seven sections derived — yet the derivation was itself written to degrade silently. The only thing in the way was a test, and a test covers only the heading someone remembered to name: an eighth pair added to _EPILOG_SECTIONS tomorrow with a typo'd heading would have passed every assertion in this suite.
    
    Choice made, not asked — REFUSE, never fall back: the queue's wording offered "raise/fall back" and the fallback was rejected, because a fallback has to INVENT something to render (an empty string IS the defect; a hand-written stub is a second copy of prose nobody derives). Exit 3, not 1: the contract already says "a lint that did not run is never a pass", exit 1 means A FILE failed to parse as spelled out in failures[] (a broken TOOL must not read as a broken REPO), and exit 0 would be the actual bug. At import, not at --help: EPILOG builds at module scope before argparse exists, so no invocation gets past it — the difference between "the tool cannot help you" and "the tool cannot run". Exit codes' line 3 gained one clause, a single-copy edit since that block IS the source, so --help picked it up with no second place to update.
    
    Test-first: new section R written before the tool was touched — R1-R3 guards on the healthy tool (exit 0, no refusal, all seven labels non-empty); R4-R9 the heading renamed away while the tuple still names it (refuse 3, name 'env:' -> 'Environment:', nothing on stdout, name ONLY the broken pair, and under --format json also refuse producing no JSON verdict); R10-R12b a heading that exists but whose block is EMPTY (docstring_section stops at the first blank line, so "found" must not mean "fine"). Baseline verified first: 198/198.
    
    Two harness artifacts caught by READING the red, not by the suite, and both disclosed rather than counted: (a) R9 first ran the mutant with GLADEX_REPO_DIR unset, so its default repo was $SB — not a git repo — and it exited 3 for THAT reason, a green assertion proving nothing (right code, wrong cause, the exact trap this step is about); fixed by pointing GLADEX_REPO_DIR at the real sandbox repo, with a comment so it is not "simplified" back. (b) the pre-fix capture ran the new suite against a tool copy in /tmp, where section L's live checks fail on PATH reasons (default_repo() resolves relative to the script → repo_root /tmp/... → exit 3), giving a misleading 192/21; re-captured inside a clone of the repo where the old tool sits at its real relative path → 203 passed / 10 failed, of which NINE are real (R5, R6, R7, R9 x2, R11, R12, R12b + M14's precondition unplantable, hence 213 counted pre-fix against 218 post-fix) and the tenth is L's d['repo_root'] == '/data/repo', true in the real repo and false in a clone. Guards passing pre-fix and thereby identifying themselves: R1, R2, R3, R4, R8, R10.
    
    Fix: _refuse_empty_epilog() + _build_epilog() replace the bare "\n\n".join — the emptiness check runs ONCE over every pair in the tuple, so a heading added to _EPILOG_SECTIONS is covered the moment it is added (the guard's scope is the tuple, not a list of headings someone maintains). 198 → 218 (+20); bash -n clean, ast.parse + py_compile clean.
    
    M14 (new, on a copy; the real tool is never edited) = the pre-[0.4.60] state reproduced: R's trigger AND the refusal's condition defeated (`if missing:` → `if False:`) in the SAME copy. Two edits deliberately — defeating the guard alone changes nothing, because a healthy docstring still yields seven full sections; I built it that way first and the mutant came out GREEN, which is the finding rather than a mutation flaw: the guard was never the defect, it is what makes an always-available trigger loud (renaming a heading is one keystroke; what changed is that it used to be tolerated). Both halves → --help exits 0 over a label printed on nothing, stderr silent, caught by R's refusals and by R3's own check going red at exactly `env:`, with an unrelated section still byte-equal (surgical).
    
    Live (no restart, no deploy, no promote): --help 103 lines (was 102), refusal demonstrated on a renamed copy → exit 3 naming the pair; repo-lint --format json on HEAD → exit 0, 170 files, changelog 65/65 unique, sha 1db4008b; source-sync-check in sync (42 files); system-status → ALL SYSTEMS HEALTHY (standing warnings only). Full regression after the code and before the doc appends: 37 suites, 2897 assertions, 0 failed — 19 shell = 1939 (+20, exactly test_repo_lint, no other shell suite moved), 18 PHP = 958 unmoved; doc suites after the appends test_repo_lint 218/0, test_changelog_api 86/0, test_app_version 39/0, test_cli_version 35/0, test_ts_ordering 7/0, CHANGELOG 65 headings 65 unique (a first duplicate check used a greedy `.*\[` that takes the LAST bracket and reported four phantom dups — anchored at ^## \[ instead; same trap recorded for [0.4.59]).
> build · mimo-v2.6-flash-free
Committed as `dacd5d1`. Now post-commit verification — **re-reading live counts on the committed tree**, as the repo's own discipline requires:
$ cd /data/repo && echo "=== remotes ==="; git remote -v; echo "=== ahead/behind ==="; git status -sb | head -2; echo "=== ls-remote ==="; timeout 25 git ls-remote origin main 2>&1 | head -3
=== remotes ===
origin	git://git.gladex.de/gladex.git (fetch)
origin	git://git.gladex.de/gladex.git (push)
=== ahead/behind ===
## main...origin/main [ahead 1]
=== ls-remote ===
1db4008b93d5ead1b770cfbf95966f699c24ec7d	refs/heads/main
$ cd /data/repo && echo "=== repo-lint on committed HEAD ==="; tools/repo-lint --format json > /tmp/opencode/epilogrefuse/post.json 2>&1; echo "rc=$?"; python3 -c "
import json
d=json.load(open('/tmp/opencode/epilogrefuse/post.json'))
cv=d['changelog_version']
print('sha', d['sha_resolved'][:8], '| files_total', d['files_total'], '| linted', sum(d['linted'].values()))
print('changelog: entries %s unique %s duplicates %s ok %s' % (cv['entries'], cv['unique'], cv['duplicates'], cv['ok']))
print('ok', d['ok'], 'exit_code', d['exit_code'])
"; echo "=== committed suite vs committed tool ==="; bash tests/test_repo_lint.sh 2>&1 | grep "suite:"; echo "=== working tree clean? ==="; git status --porcelain || true; echo "(empty above = clean)"
=== repo-lint on committed HEAD ===
rc=0
sha dacd5d15 | files_total 170 | linted 119
changelog: entries 65 unique 65 duplicates [] ok True
ok True exit_code 0
=== committed suite vs committed tool ===
repo-lint suite: 218 passed, 0 failed
=== working tree clean? ===
(empty above = clean)
> build · mimo-v2.6-flash-free
All green on the committed tree. Pushing to the self-hosted remote (standing instruction):
$ cd /data/repo && timeout 60 git push origin main 2>&1 | tail -5; echo "push rc=$?"; echo "=== verify ==="; timeout 25 git ls-remote origin main; git status -sb | head -1
To git://git.gladex.de/gladex.git
   1db4008..dacd5d1  main -> main
push rc=0
=== verify ===
dacd5d15e59c7602704e56712ac87a92f3d6db69	refs/heads/main
## main...origin/main
> build · mimo-v2.6-flash-free
Pushed and in sync. Final STEP 0 re-check and system status to close the run:
$ cd /data/repo && echo "=== FINAL STEP 0 RE-CHECK ==="; echo "dev  unread: $(sqlite3 /opt/startup/dev/data/messages.db "SELECT count(*) FROM messages WHERE direction='investor_to_agent' AND read=0;") (of $(sqlite3 /opt/startup/dev/data/messages.db 'SELECT count(*) FROM messages;') rows)"; echo "prod unread: $(sqlite3 /opt/startup/prod/data/messages.db "SELECT count(*) FROM messages WHERE direction='investor_to_agent' AND read=0;") (of $(sqlite3 /opt/startup/prod/data/messages.db 'SELECT count(*) FROM messages;') rows)"; echo "INBOX unhandled: $(grep '^## ' INBOX.md | grep -cv 'HANDLED') of $(grep -c '^## ' INBOX.md) headings"; echo "Dispatcher mailbox files: $(find mailboxes -type f ! -name '.gitkeep' | wc -l)"; echo "=== budget ==="; grep -m4 -E "allowance|spent|remaining|month" BUDGET.md | head -6
=== FINAL STEP 0 RE-CHECK ===
dev  unread: 0 (of 59 rows)
prod unread: 0 (of 25 rows)
INBOX unhandled: 0 of 66 headings
Dispatcher mailbox files: 0
=== budget ===
month: 2026-09
allowance: 5.00
spent: 1.50 (gladex.de — registered + DNS live since 2026-09-20, 1.50/mo)
remaining: 3.50
$ cd /data/repo && tools/system-status --format human 2>&1 | tail -8; echo "rc=$?"
tls-cert-expiry           [OK] 88d left
  investor-messages         [OK] 0 unread dev=0 prod=0
  git-tree                  [OK] clean
  go-tests                  [OK] passing (worktree)
  go-compile                [OK] 45 module file(s) compile clean (1.632s) (commit dacd5d1)
  promote-gates             [WARN] not promotable (reviewer-mailbox holds no entries): verdict REFUSED: no verdict in /data/repo/mailboxes/reviewer-to-main (expected VERDICT-YYYYMMDD-HHMMSS-<slug>.md containing 'VERDICT: APPROVE') | dev-sync OK | commit-lint OK | ship-tree OK (commit dacd5d1)

Overall: ALL SYSTEMS HEALTHY
rc=0
> build · mimo-v2.6-flash-free
Run complete. Summary:

## STEP 0 — investor loop (done first, re-verified at end)
**Zero unread investor messages** — dev 0 of 59, prod 0 of 25 (every row read, not just counted), `INBOX.md` 66/66 handled, no Dispatcher assignment pending, `/root/Maildir/new` holds only the old TLS smoke test. **No reply was owed**, so nothing to insert or mark; recorded in `PROGRESS.md` first and re-checked at run end.

## The step: queue item (1) from `[0.4.59]`
`repo-lint`'s derived epilog could still **print a label over nothing**. `docstring_section` returned `""` for a heading it could not find, and `"\n\n".join` doesn't object — so a renamed docstring heading rendered `env:` above a blank line with `--help` exiting **0**. The only barrier was a *test*, covering only the heading someone remembered to name.

- **Chose refuse, not fall back** (the queue offered both): a fallback must invent prose — an empty string *is* the defect. **Exit 3, not 1**: exit 1 means *a file* failed to parse; a broken tool must not read as a broken repo. **At import, not at `--help`** — the tool cannot run, not merely cannot help.
- **Test-first**: section R written before touching the tool; baseline verified 198/198 first.
- **Two harness false-passes of my own, caught by reading the red** (both disclosed, not counted): R9 went green because the mutant's default repo wasn't a git repo (right code, wrong cause); and the first pre-fix capture showed 192/21 mostly from running the tool off-path. Re-captured in a clone → **203/10, nine real findings** + one disclosed clone artifact.
- **M14**: building the mutation with the guard alone defeated produced a *green* mutant — recorded as the finding, not a flaw: the guard isn't the defect, it's what makes an always-available trigger loud.
- **Result**: suite **198 → 218**, mutations **13 → 14**, **37 suites / 2897 assertions / 0 failed**; `system-status` **ALL SYSTEMS HEALTHY**, `git-tree` clean.

**Committed `dacd5d1` and pushed** to `git://git.gladex.de/gladex.git` (origin/main verified in sync).

**Safety**: spend **0.00** (`*-free` only), budget unchanged (1.50 spent / 3.50 remaining), **no DNS write, no restart, no promote**; message DBs read-only, `/root/.pdns-token` never read, no `noreply@` invoked. Staged explicitly rather than `git add -A` (tree verified to hold only this run's 5 files).

**Still blocked (investor-owned)**: NEEDS-INVESTOR **#57 public-gating A/B/C** and **SOA MNAME**. **Newly queued (not slipped in)**: under `--format json` the pre-argparse refusal emits *nothing*, so `| jq` gets empty stdin — refusing is decided, whether it should also emit a JSON error object is not.
exit=0

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Fri Sep 25 19:42:35 2026] 127.0.0.1:51418 Accepted
[Fri Sep 25 19:42:35 2026] 127.0.0.1:51418 Closing
[Fri Sep 25 19:42:35 2026] 127.0.0.1:51432 Accepted
[Fri Sep 25 19:42:35 2026] 127.0.0.1:51432 Closing
[Fri Sep 25 19:42:35 2026] 127.0.0.1:51440 Accepted
[Fri Sep 25 19:42:35 2026] 127.0.0.1:51440 Closing
[Fri Sep 25 19:42:43 2026] 127.0.0.1:51450 Accepted
[Fri Sep 25 19:42:43 2026] 127.0.0.1:51450 Closing
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41148 Accepted
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41148 Closing
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41156 Accepted
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41156 Closing
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41170 Accepted
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41170 Closing
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41178 Accepted
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41178 Closing
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41186 Accepted
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41186 Closing
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41200 Accepted
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41200 Closing
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41210 Accepted
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41210 Closing
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41214 Accepted
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41214 Closing
[Fri Sep 25 19:42:49 2026] 127.0.0.1:41224 Accepted
[Fri Sep 25 19:42:50 2026] 127.0.0.1:41224 Closing
[Fri Sep 25 19:42:50 2026] 127.0.0.1:41226 Accepted
[Fri Sep 25 19:42:50 2026] 127.0.0.1:41226 Closing
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35240 Accepted
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35240 Closing
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35244 Accepted
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35244 Closing
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35246 Accepted
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35246 Closing
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35254 Accepted
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35254 Closing
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35270 Accepted
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35270 Closing
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35284 Accepted
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35284 Closing
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35294 Accepted
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35294 Closing
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35308 Accepted
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35308 Closing
[Fri Sep 25 19:48:17 2026] 127.0.0.1:35310 Accepted
[Fri Sep 25 19:48:18 2026] 127.0.0.1:35310 Closing
[Fri Sep 25 19:48:18 2026] 127.0.0.1:35316 Accepted
[Fri Sep 25 19:48:18 2026] 127.0.0.1:35316 Closing
[Fri Sep 25 19:55:59 2026] 127.0.0.1:35984 Accepted
[Fri Sep 25 19:55:59 2026] 127.0.0.1:35984 Closing
[Fri Sep 25 19:56:40 2026] 127.0.0.1:37378 Accepted
[Fri Sep 25 19:56:40 2026] 127.0.0.1:37378 Closing
[Fri Sep 25 19:58:50 2026] 127.0.0.1:44550 Accepted
[Fri Sep 25 19:58:50 2026] 127.0.0.1:44550 Closing
[Fri Sep 25 19:58:50 2026] 127.0.0.1:44554 Accepted
[Fri Sep 25 19:58:50 2026] 127.0.0.1:44554 Closing
[Fri Sep 25 20:04:37 2026] 127.0.0.1:39124 Accepted
[Fri Sep 25 20:04:37 2026] 127.0.0.1:39124 Closing
[Fri Sep 25 20:12:16 2026] 127.0.0.1:60694 Accepted