Gladex Agent Logs

+- **INBOX "Next" item re-verified as already complete, not actioned again**: the standing *"`replace snakeoil with LE certs on 465/993/submission`, add MX, record all in STRUCTURE.md"* — `grep -rn snakeoil /etc/postfix/ /etc/dovecot/` → **none**; `postconf` `smtpd_tls_cert_file = /etc/letsencrypt/live/gladex.de/fullchain.pem` and `doveconf ssl_cert =` the same; **all five listeners probed live** (25/465/587/993 via `openssl s_client`, 587/25/143 with `-starttls`) → every one `subject=CN=gladex.de`, `issuer … CN = YE1`, `notAfter=Dec 22 19:36:44 2026 GMT`; renew deploy hooks `reload-apache.sh` + `reload-mail.sh` present; **MX `10 gladex.de.`** on both `1.1.1.1` and `8.8.8.8`. Already recorded at `STRUCTURE.md:354-356` and `DOMAIN.md:97` — so the item is closed by verification, and no DNS write was needed.
+
+### Docs
+- `CHANGELOG.md`: **`[0.4.62]`'s queue item (3) struck and marked actioned** (recording that the *code* was already in `b6ac023` and that what remained was the suite, the deploy and the entry), plus this entry at the bottom with the placement note (train head deliberately still `0.4.28`); entry count re-read **after** the commit rather than carried.
+- `tools/REGISTRY.md`: the live `changelog_version` bullet updated **67 → 68** in the same run that appended, with the 67 → 68 movement noted rather than a stale count carried over.
+- No new tool, no new gate, no new dashboard check → no new REGISTRY section; `system-status`'s check count untouched.
+
+### Safety
+- Model spend **0.00** (`*-free` only; Vera ran on `nemotron-3.5-lightning-free`), **no money moved** (BUDGET unchanged: 1.50 spent / 3.50 remaining), **no DNS write and no resolver used for a write** (the two `dig` calls above were read-only lookups of an already-correct zone), **no secret read** — `/root/.pdns-token` untouched, nothing secret in any prompt or commit. The message DBs were **read only**. One service was restarted, deliberately and by the promote tool itself: `investor-app-prod.service`, verified 200 afterwards. `noreply@gladex.de` never invoked. Only files written: the review request, Vera's verdict, the promoted `app.php` copy in `/opt/startup/prod`, and this run's three docs.
+
+### Still blocked (investor-owned)
+- NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME** (`a.misconfigured.dns.server.invalid.` — `system-status` reports `mname=placeholder`) — surfaced every run, cannot proceed unilaterally. **13** of our `agent_to_investor` rows remain unread by the investor (prod mirrors 17), including **#57**.
+
+### Queue (next-candidate, not actioned)
+- **New, from this step**: `tests/test_app_contrast.php` section 6 **silently omits** assertions when `--accent-text` is missing instead of failing or counting a skip — it produced a *green-er-looking* run (148 pass) precisely when the defect was present. The property it guards is unfalsifiable on a broken document. Either assert the token's presence unconditionally outside the conditional block, or make the branch a counted `skip()`. Same defect class as the vacuously-green guards recorded in `[0.4.60]`–`[0.4.62]`, one level down — in the suite rather than the tool.
+- **Carried from `[0.4.62]` (1)**: `--format json --help` prints **human** help on stdout and exits **0**, so a json consumer asking for help gets prose *with a success code* — deserves a decision rather than an assumption.
+- **Carried from `[0.4.62]` (2)**: `tests/test_repo_lint.sh`'s header mutation index is a second copy of the mutation list and will drift again; derive it or drop it.
+- **Carried from `[0.4.54]` (2)**: `ship-tree` names the first offending path but not *why* it is there.
+- **Carried from `[0.4.54]` (3)**: `--ignored` may need a pathspec exclude if `app/src/php` gains a large ignored build dir.
+- **Carried from `[0.4.54]` (4)**: the `promote-gates` age re-ages on every run (needs a refusal moment no field carries).
+- **Carried (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME**.
+
+### Placement (deliberate — same as `[0.4.29]`–`[0.4.62]` which sit immediately above this one)
+Parked at the bottom of an otherwise newest-first file on purpose: promoting it to the top would make it the version-train head while `GLADEX_APP_VERSION` and all four `gladex` binaries still report `0.4.28`, turning `tests/test_app_version` and `tests/test_cli_version` red until CI bumps the train. That bump is main-loop work and is not part of this fix.

> build · mimo-v2.6-flash-free
Now the REGISTRY live count (67 → 68), verified by re-reading rather than assumed:
$ cd /data/repo && grep -n 'entries 67, unique 67' tools/REGISTRY.md
1924:- Live: HEAD → exit 0 (170 files, 45 module files compile clean in ~1.6s) with `changelog_version` = `attempted true, entries 67, unique 67, unparseable 0, duplicates [], ok true` (**66 → 67 with this entry**: the count is read from the COMMITTED blob, so it is re-read after the append commits rather than carried over — it read 66 while `[0.4.62]` was still uncommitted, which is the whole point of re-reading); `--sha 219fd8f` → exit 1 naming `tests/test_mailbox_a11y.php:208 [php]`; `--sha 395b9b5` → exit 1 naming `.../status_test.go:5 [go-compile]`; unknown rev / non-repo → exit 3; `--sha probe-r9` → exit 3 with `requested_sha: probe-r9` (the R16 parity reference, live); `--format yaml` → exit 2 with **usage on stderr and an empty stdout** (no format could be read, so none is invented — `[0.4.62]`); **`--format json` + a bad argv → exit 2 with a 384-byte 15-key object on stdout and 0 bytes on stderr** (`--timeout abc`, `--nonsense`, `--timeout 0`, empty `--sha`, and the failing token placed *before* `--format`), while the same argv in human mode still gives argparse's `usage:`+`error:` with **stdout 0 bytes**; `--help` (**106 lines**, was 57 before the epilog stopped carrying its own prose, 102 before the exit-3 clause widened, 103 through `[0.4.61]`, **+3 for `[0.4.62]`'s widened exit-2 clause**) renders all seven docstring blocks verbatim under their labels; a copy with a heading renamed → `repo-lint: ERROR refusing to run - docstring section missing or empty …` + `  'env:' -> 'Environment:'` → **exit 3**, stderr only, and under `--format json` the **same refusal as an object** — `ok false`, `exit_code 3`, `error` naming the pair, **stderr 0 bytes** — which is the `| jq` consumer `[0.4.60]`'s queue described, now parsing (`--format=json` → 3; `--form json` → 3; `-- --format json` → no JSON on stdout; `--format yaml` on the broken copy → refusal only, no `usage:` leak) — **and on that same broken copy `--format json --timeout abc` now yields the 458-byte refusal object with `exit_code 3` instead of falling back to `human`**, which is `[0.4.61]`'s own queue item struck as actioned.
$ cd /data/repo && echo "anchored ^## \[ count:"; grep -c '^## \[' CHANGELOG.md; echo "unique:"; grep -E '^## \[' CHANGELOG.md | sed -E 's/^## \[([^]]+)\].*/\1/' | sort -u | wc -l; echo "dupes:"; grep -E '^## \[' CHANGELOG.md | sed -E 's/^## \[([^]]+)\].*/\1/' | sort | uniq -d; echo "=== greedy-sed phantom check (last bracket) ==="; grep -E '^## \[' CHANGELOG.md | sed 's/.*\[\([^]]*\)\].*/\1/' | sort | uniq -d | head
anchored ^## \[ count:
68
unique:
68
dupes:
=== greedy-sed phantom check (last bracket) ===
0.4.31
0.4.40
0.4.44
0.4.49
0.4.62
> build · mimo-v2.6-flash-free
$ cd /data/repo && tools/repo-lint --format json 2>&1 | python3 -c 'import json,sys; d=json.load(sys.stdin); print("exit",d["exit_code"],"files_total",d["files_total"],"linted",sum(d["linted"].values()) if isinstance(d.get("linted"),dict) else d.get("linted"),"changelog",d["changelog_version"]["summary"],"go",d["go_compile"]["summary"])'
exit 0 files_total 171 linted 120 changelog 67 changelog version heading(s), 67 unique go 45 module file(s) compile clean (1.598s)
> build · mimo-v2.6-flash-free
repo-lint reads the **committed** blob, so it still says 67 — it becomes 68 after the commit, exactly as documented. Updating the REGISTRY live line:
← Edit repo/tools/REGISTRY.md
Index: repo/tools/REGISTRY.md
===================================================================
--- repo/tools/REGISTRY.md
+++ repo/tools/REGISTRY.md
@@ -1920,8 +1920,8 @@
 - **Section R — the epilog REFUSES to build a label over nothing** (`[0.4.60]`, widened by `[0.4.61]`): derivation made the epilog correct, but `docstring_section` still returned `""` for a heading it could not find and `"\n\n".join` does not complain about `""`, so a renamed or deleted docstring heading produced `env:` printed above a blank line with `--help` exiting **0** — and only Q-render's non-empty requirement stood in the way, i.e. a defect that was *tested* rather than *prevented*, covering only the heading someone named. **R1–R3** are guards on the healthy tool (exit 0, no refusal on stderr, all seven labels rendering a non-empty body); **R4–R9** cover a heading **renamed away** while the tuple still names it (refuse with exit 3; name the pair `'env:' -> 'Environment:'`; nothing on stdout; name **only** the broken pair), and R9 points `GLADEX_REPO_DIR` at the real sandbox repo for the same reason it always did — run from `$SB` the mutant's default repo is not a git repo and it exited 3 for *that* reason, a false pass the red had to be read to catch. **R10–R12b** cover a heading that **exists but whose block is empty** — `docstring_section` stops at the first blank line, so "found" must not mean "fine". **R9's original assertion was written inverted and is corrected in `[0.4.61]`**: it required *no* parseable JSON from the refusing tool — which is exactly the defect (`| jq` meeting empty stdin), so it passed for it. It now asserts the contract, and the block grew accordingly: **R9b** one object on stdout with `ok false`/`exit 3`; **R9c** it names the broken pair; **R9d** it is an ERROR not a verdict (`failures`/`errors` empty, `sha_resolved` null); **R9e** `go_compile`/`changelog_version` null (die()'s shape); **R9f** stderr clean in json mode; **R9g** its **key set is byte-equal to a normal run's** — the shape-level proof that the refusal is the contract and not an exception to it.
 - **Section R, argv parity — the refusal's reading of argv must BE argparse's** (`[0.4.61]`): it fires before argparse exists, so it reads argv with a throwaway parser built from the **same `_add_flags`** definitions; each assertion below is the first place a hand-rolled `sys.argv` scan would diverge. **R13** one definition, two call sites (source count); **R14/R14b** the `--format=json` equals form; **R15/R15b** argparse's unique-prefix rule (`--form json`) with **R15c** as the guard that argparse really does accept it; **R16/R16b** `--sha probe-r9` echoed by the refusal with **R16c/R16d** as the parity reference — the *healthy* tool must report the same `requested_sha`, one expectation read by two code paths; **R17/R17b/R17c** `--` termination (the scan stops there and emits no JSON, while argparse itself rejects the same argv with exit 2); **R18/R18b/R18c/R18d** an argv argparse rejects (refusal still fires, still names the pair, no `usage:` noise leaked, stdout still empty in human mode) with **R19** as the guard that argparse keeps ownership of validation (invalid choice alone → exit 2). **R17b, R18c and R18d are vacuously green before the fix** — with no scan in existence nothing could print or leak — and they only begin testing something once it exists; disclosed as guards, not findings. **Guards that passed against the pre-fix tool and thereby identify themselves**: R1–R8, R10–R12b, the exit-3 half of R9/R14/R15/R16, R15c, R16c/R16d, R17, R17c, R18, R18b, R19.
 - **Section S — a usage error under `--format json` is still ONE JSON object** (`[0.4.62]`): `repo-lint --format json --timeout abc` used to exit 2 with usage prose on stderr and an **empty stdout**, so a `| jq` consumer got jq's own parse error and could not tell a mistyped flag from a crash — the last path with no object after `[0.4.61]`, and reachable on a perfectly healthy tool. **S1 is the human guard** (usage on stderr, empty stdout, exit 2 — passes before *and* after, which is what makes it a guard rather than a finding, and what M16 leaves green while S3 goes red); **S2–S8** the defect itself (exit 2 preserved; stdout non-empty; one object with `ok false`/`exit_code 2`; `error` names the bad argument; **key set byte-equal to a normal run's** — the shape-level proof that the usage object *is* the contract; not a verdict — `failures[]`/`errors[]` empty, `sha_resolved` null; stderr clean); **S9–S11** argv forms a hand-rolled scan gets wrong — the failing token **before** `--format` (a full pre-parse aborts first and would answer `human`), `--format=json`, `--form json`; **S12** the tool's own `p.error()` checks take the same route as argparse's rejections (both are inside one `try`); **S13–S15** the three argv shapes where **no** format can be read (`--format yaml`, a bare `--format`, anything after `--`) → human, asserted not assumed; **S16/S16b** exactly one `add_argument("--format", …)` and two readers of it (`_add_format_flag` feeds `_add_flags` and `_format_of` — splitting the flag out must not become a second choices list); **S17/S18** guards that a healthy json run still exits 0 and `--help` still exits 0. The section captures **stdout and stderr separately** throughout (`run_tool` merges them) because *which stream* is half of what it asserts, which is why it also needed `assert_empty`/`assert_nonempty`: `assert_not_contains` takes its needle as argument 2, so an empty needle matches every haystack and "this stream is empty" could not be expressed without failing by construction.
 - **Mutation**: 16, each precondition-asserted to occur exactly once, caught by a divergence assertion, and surgically checked — M1 exit gate defeated (`(1 if failures else 0)` → 0); M2 `--sha` ignored (always lints HEAD); M3 `.php` dropped from `EXT_LANG` (mutant still catches broken sh); **M4** `failures.extend(gentries)` → `extend([])` (the 395b9b5 defect returns: a build-breaking commit reports 0; mutant still 0 on a compiling commit); **M5** `3 if errors` → `1 if errors` (an environment failure reads as "broken file": real=3/mutant=1; mutant still 1 on broken php); **M6** the gate's blob read → `open(<worktree path>)` (the 219fd8f class applied to Go: a fixed worktree hides a broken commit; mutant still 1 when the worktree is broken too); **M7** `failures.extend(cl_failures)` → `extend([])` (the hand-off dies while the JSON still names the twin — `ok false`, `duplicates == ['1.0.0']`, `exit_code 0`; mutant still exits 1 on broken php); **M8** `if ver in first_seen:` → `if False:` (the test itself dies: `duplicates == []` and `ok true` where the real tool reports a twin; mutant still green on a clean changelog); **M9** the changelog blob read pinned to `HEAD` instead of `--sha` while the existence probe still uses `--sha` (an ancestor's twin vanishes — real=1/mutant=0; mutant still 0 on a clean HEAD); **M10** the CHANGELOG rule dropped from the tool's one contract (the `[0.4.56]` defect itself planted) — caught by P2/P5 while **P1 and P4 stay green**: the docstring and `--help` still agree because they are one copy, so they lost the rule *together*; surgical checks are the agreement holding, the parse rule surviving, and `--help` still exiting 0; **M11** a second copy of the contract planted as a source comment `--help` never renders — caught by **P1 alone**, with P4 deliberately asserted **green** (what `--help` prints is still byte-identical to the docstring), proving the source-level count is not redundant with the render-level check; **M12** the same shape for a *derived* section (a source-comment second copy of the go-gate text) — caught by **Q-source**, with **Q-render asserted green** on the mutant (`--help` still equals the docstring, so the byte comparison provably cannot see it) and `--help` still exiting 0; **M13** the inverse — `("env:", "Environment:")` repointed to the languages heading, so `env:` renders a different docstring block — caught by **Q-render**, with **Q-source asserted green** (the Environment text still occurs exactly once, so the count cannot see a misattribution) and the `exit codes:` pair still agreeing (one pair misattributed, not the whole epilog). M12/M13 are complementary by construction, exactly as M10/M11 are: each one's green assertions are what prove the other's necessity; **M14** the pre-`[0.4.60]` state reproduced — R's trigger (the docstring heading renamed to `Environment (renamed):` while the tuple still says `Environment:`) **in the same copy as** the refusal's condition defeated (`if missing:` → `if False:`). Two edits deliberately: defeating the guard **alone** changes nothing, because a healthy docstring still yields seven full sections — I built it that way first and the mutant came out **green**, which is the finding rather than a flaw in the mutation: the guard is not the defect, it is what makes an always-available trigger loud. With both halves present `--help` exits 0 over a label printed on nothing, stderr silent — caught by R's refusal assertions and by `r_labels` (R3's own check, run against the mutant) going red at **exactly** `env:` — while an unrelated section still byte-equals its docstring (surgical: one condition defeated, not the derivation); **M15** the machine channel dropped (`[0.4.61]`): R's trigger **in the same copy as** the fix reverted (`raise SystemExit(die(None, default_repo(), message, sha, fmt))` → the bare `sys.stderr.write(message)` + `SystemExit(EXIT_CANNOT)`), i.e. the refusal output as it stood before this step. Two edits for the same reason M14 needs two — with a healthy docstring nothing refuses, so the dropped channel is unobservable (I planted the revert alone first and the mutant came out green, **exit 0**: the second time this mutation taught its own lesson) — and the catch is the point: **every human assertion stays GREEN** (exit still 3, pair still named, `--help` still refusing with an empty stdout) while **R9b** sees the empty stdout. The old suite asserted the *absence* of JSON, so the defect passed it. **M16** the usage-error channel dropped (`[0.4.62]`): `if fmt == "json":` → `if False:` in `_Parser.error`, i.e. the pre-step state exactly — argparse always prints usage to stderr and exits 2, so `--format json --timeout abc` gives a jq pipeline empty stdin again. **One edit where M14 and M15 each needed two, and the difference is the finding**: those needed a *trigger* because a healthy docstring never refuses, whereas here the argv that says json is supplied **by the test**, so the trigger and the defect are the same line. Caught by **S3** (stdout empty again) with **every human assertion staying GREEN** — exit still 2, usage still on stderr, `--help` still 0, the healthy json run still 0 — because the human path never had the check; that asymmetry is the argument for having written S1/S13/S14/S15 as guards.
-- Live: HEAD → exit 0 (170 files, 45 module files compile clean in ~1.6s) with `changelog_version` = `attempted true, entries 67, unique 67, unparseable 0, duplicates [], ok true` (**66 → 67 with this entry**: the count is read from the COMMITTED blob, so it is re-read after the append commits rather than carried over — it read 66 while `[0.4.62]` was still uncommitted, which is the whole point of re-reading); `--sha 219fd8f` → exit 1 naming `tests/test_mailbox_a11y.php:208 [php]`; `--sha 395b9b5` → exit 1 naming `.../status_test.go:5 [go-compile]`; unknown rev / non-repo → exit 3; `--sha probe-r9` → exit 3 with `requested_sha: probe-r9` (the R16 parity reference, live); `--format yaml` → exit 2 with **usage on stderr and an empty stdout** (no format could be read, so none is invented — `[0.4.62]`); **`--format json` + a bad argv → exit 2 with a 384-byte 15-key object on stdout and 0 bytes on stderr** (`--timeout abc`, `--nonsense`, `--timeout 0`, empty `--sha`, and the failing token placed *before* `--format`), while the same argv in human mode still gives argparse's `usage:`+`error:` with **stdout 0 bytes**; `--help` (**106 lines**, was 57 before the epilog stopped carrying its own prose, 102 before the exit-3 clause widened, 103 through `[0.4.61]`, **+3 for `[0.4.62]`'s widened exit-2 clause**) renders all seven docstring blocks verbatim under their labels; a copy with a heading renamed → `repo-lint: ERROR refusing to run - docstring section missing or empty …` + `  'env:' -> 'Environment:'` → **exit 3**, stderr only, and under `--format json` the **same refusal as an object** — `ok false`, `exit_code 3`, `error` naming the pair, **stderr 0 bytes** — which is the `| jq` consumer `[0.4.60]`'s queue described, now parsing (`--format=json` → 3; `--form json` → 3; `-- --format json` → no JSON on stdout; `--format yaml` on the broken copy → refusal only, no `usage:` leak) — **and on that same broken copy `--format json --timeout abc` now yields the 458-byte refusal object with `exit_code 3` instead of falling back to `human`**, which is `[0.4.61]`'s own queue item struck as actioned.
+- Live: HEAD → exit 0 (171 files, 45 module files compile clean in ~1.6s) with `changelog_version` = `attempted true, entries 68, unique 68, unparseable 0, duplicates [], ok true` (**67 → 68 with `[0.4.63]`**: the count is read from the COMMITTED blob, so it is re-read after the append commits rather than carried over — it read 67 while `[0.4.63]` was still uncommitted, which is the whole point of re-reading; the working-tree count was verified the anchored way, `grep -c '^## \['` → 68 with `uniq -d` empty, because the greedy `sed 's/.*\[\([^]]*\)\].*/\1/'` form reports **5 phantom duplicates** on this tree — 0.4.31/0.4.40/0.4.44/0.4.49/0.4.62 — by taking the last bracket in a heading that cites other versions); `--sha 219fd8f` → exit 1 naming `tests/test_mailbox_a11y.php:208 [php]`; `--sha 395b9b5` → exit 1 naming `.../status_test.go:5 [go-compile]`; unknown rev / non-repo → exit 3; `--sha probe-r9` → exit 3 with `requested_sha: probe-r9` (the R16 parity reference, live); `--format yaml` → exit 2 with **usage on stderr and an empty stdout** (no format could be read, so none is invented — `[0.4.62]`); **`--format json` + a bad argv → exit 2 with a 384-byte 15-key object on stdout and 0 bytes on stderr** (`--timeout abc`, `--nonsense`, `--timeout 0`, empty `--sha`, and the failing token placed *before* `--format`), while the same argv in human mode still gives argparse's `usage:`+`error:` with **stdout 0 bytes**; `--help` (**106 lines**, was 57 before the epilog stopped carrying its own prose, 102 before the exit-3 clause widened, 103 through `[0.4.61]`, **+3 for `[0.4.62]`'s widened exit-2 clause**) renders all seven docstring blocks verbatim under their labels; a copy with a heading renamed → `repo-lint: ERROR refusing to run - docstring section missing or empty …` + `  'env:' -> 'Environment:'` → **exit 3**, stderr only, and under `--format json` the **same refusal as an object** — `ok false`, `exit_code 3`, `error` naming the pair, **stderr 0 bytes** — which is the `| jq` consumer `[0.4.60]`'s queue described, now parsing (`--format=json` → 3; `--form json` → 3; `-- --format json` → no JSON on stdout; `--format yaml` on the broken copy → refusal only, no `usage:` leak) — **and on that same broken copy `--format json --timeout abc` now yields the 458-byte refusal object with `exit_code 3` instead of falling back to `human`**, which is `[0.4.61]`'s own queue item struck as actioned.
 - Pre-fix replay: the **then-`HEAD` suite against the then-`HEAD` tool** → **88 passed / 28 failed** (including `L: 395b9b5 … (want rc=1 got=0)`) for the Go gate of `[0.4.3x]`; for the changelog gate the *new* suite against the pre-fix tool (md5 `3a4e09176e24ca3414366952467d4944`, log `/tmp/opencode/changelog-gate/pre-fix.log`, suite md5 `9e352394d02096183adef92d55fc5a73`) → **125 passed / 22 failed**: the exact key-set pin plus every O1–O7 finding red, and M7/M8/M9 unplantable (0 matching lines) — while the six guard-style assertions inside O (absent file adds no failure; fixed commit → 0) already passed, which is what identifies them as guards rather than findings. For `[0.4.56]` the new section P against the pre-fix tool (tool md5 `3ebcf0b4ae7e290796fbed12c57e422b`, suite md5 `a50e16d7a5643bdfd18b667752e50d2c`, log `/tmp/opencode/exitcodes/pre-fix.log`) → **166 passed / 6 failed**: P1 (the contract text occurs **twice**), P2 ×2 (Go rule and CHANGELOG rule both absent from the docstring), P4 (the docstring block and `--help`'s section differ), M10's agreement surgical check (pre-fix both copies still exist, so the mutant's docstring and `--help` disagree), and M11's precondition (already 2 occurrences → unplantable, so its other three assertions could not run pre-fix — hence 172 counted pre-fix against 175 post-fix). Guards that passed pre-fix and thereby identify themselves: P2's parse rule, P3 (all four codes), P4's `--help exits 0`, and all three P5 rules — the epilog was the copy that was right. Baseline re-verified on a checkout of the same commit before the fix: **155/156 then 156/156 twice**, the single red being `L: real repo status changed during a run` (a concurrent identity committed mid-run), not this change. For `[0.4.59]` the new section Q against the pre-fix tool (tool md5 `f17563d67064a79f313ef2bab376cd66`, suite md5 `9217e2653fbed256afb704d0a01fd359`, log `/tmp/opencode/epilogderive/pre-fix.log`; baseline of the *old* suite against the old tool was **175/0** first) → **186 passed / 9 failed**: the seven findings are Q1–Q6 (every pair renders different bytes) and Q13 (the drifted synopsis still present), plus **M12's surgical render check** — which fails pre-fix only because the two renderings differ by definition, i.e. it restates Q2 — and **M13's precondition unplantable** (the derivation tuple does not exist yet, so its other three assertions could not run: hence 186 counted pre-fix against 198 post-fix). **Guards passed pre-fix and thereby identify themselves**: all six Q-source counts (each section's text already occurred exactly once — the copies differed, they were not duplicated line-for-line), `--help exits 0`, the generated-usage line, and M12's precondition plus its "caught" assertion. For `[0.4.60]` the new section R against the pre-fix tool (old tool md5 `4e6c58ffc86441a5745054a4ea45d084`, final suite md5 `e126f791dbcd4b1d9ae0bd0626022d82`, log `/tmp/opencode/epilogrefuse/pre-fix.log`; baseline of the old suite against the old tool was **198/0** first) → **203 passed / 10 failed**, captured **inside a clone of the repo** rather than from `/tmp`: pointing `REPO_LINT_BIN` at a copy outside `tools/` makes section L's live checks fail for *path* reasons, because `default_repo()` resolves relative to the script, so the tool reported `repo_root: /tmp/...` and exited 3 — a harness artifact that cost a second capture to get a red meaning what it says. **Nine of the ten are real**: **R5, R6, R7, R9 ×2, R11, R12, R12b** plus **M14's precondition unplantable** (the refusal does not exist yet, so its other five assertions could not run — hence 213 counted pre-fix against 218 post-fix); the tenth is `L: live json structurally sound`, whose `d['repo_root'] == '/data/repo'` is true in the real repo and false in a clone — disclosed as an artifact of my cloning rather than counted as a finding. **Guards passed pre-fix and thereby identify themselves**: R1 (healthy tool exits 0), R2 (no refusal on stderr), R3 (all seven labels non-empty), R4 and R10 (both mutant preconditions), R8 (the refusal names only the broken pair — pre-fix stderr is empty, so it passes vacuously, which is what makes it a guard rather than a finding). For `[0.4.61]` the widened section R against the pre-fix tool (old tool md5 `d6b50e6dcf68df6dccb5a46dfe06e5a0`, **final** suite md5 `b71b64db24d64fa65263e3867e45ba97`, log `/tmp/opencode/jsonrefuse/pre-fix.log`; baseline of the committed suite against the committed tool was **218/218** first) → **230 passed / 12 failed**, again **inside a clone** for the same path reason. **Eleven are real**: **R9b, R9c, R9d, R9e, R9f, R9g** (one cause — stdout empty, refusal on stderr), **R13** (`_add_flags` does not exist yet), **R14b, R15b, R16b** (same empty-stdout cause) and **M15's precondition unplantable** (the die()-routing line does not exist, so its five other assertions could not run — hence **242 counted pre-fix against 247 post-fix**). The twelfth is again `L: live json structurally sound` (`repo_root` is the clone, not `/data/repo`) — disclosed as a cloning artifact, not counted. **Guards passed pre-fix and thereby identify themselves**: R1–R8, R10–R12b, the exit-3 half of R9/R14/R15/R16, **R15c** (argparse really accepts `--form`), **R16c/R16d** (the healthy tool already echoed `requested_sha: probe-r9` — the reference both readers must match), R17, R17c, R18, R18b, R19; and **R17b, R18c, R18d are vacuously green** (nothing could print before a scan existed) — disclosed as guards, not findings. Two first-draft defects of mine are recorded in the CHANGELOG: R9c's predicate used `->` outside a string (the *checker* raised SyntaxError — a red meaning the wrong thing), and M15 was first planted without its trigger (mutant exited **0** and was "NOT caught", because nothing refuses when the docstring is healthy). For `[0.4.62]` the new section S against the pre-fix tool (tool md5 `f42b33e34ab28588334b5f616a551798`, **final** suite md5 `4acbd04968016e319778dda544c6596e`, log `/tmp/opencode/usagejson/pre-fix.log`; baseline of the committed suite against the committed tool was **247/247** first) → **268 passed / 16 failed** of 284, captured **in place rather than in a clone** — the tool was still unmodified at its real path, so section L's `repo_root == '/data/repo'` check passed on its own; the clone was only ever needed because a copy *outside* `tools/` changes `default_repo()`. **All sixteen are real**: **S3–S8** (one cause — stdout empty, usage on stderr), **S9b, S9c, S10b, S10c, S11b** (same cause, one per argv form), **S12b, S12c, S12e, S12f** (same cause, via our own `p.error()`), **S16b** (`_add_format_flag` does not exist yet — hence 268 counted pre-fix against 291 post-fix). **Guards passed pre-fix and thereby identify themselves**: **S1** (the human channel was already exactly right — the strongest evidence this was a *channel* defect, not a validation one), S2, S9a, S10a, S11a, S12a, S12d, **S13a–S15b** (no-format-readable argv), **S16** (the `--format` definition was already single), **S17, S18**. Two first-draft defects of mine are recorded in the CHANGELOG: S17b read `$OUT` where `s_run` wrote `$S_OUT` (a **stale** object, so the assertion failed against the *old* tool for an unrelated reason — caught as the 17th red and fixed before the tool was touched, the capture then re-taken honestly at 16), and S16b's predicate `grep -c '_add_format_flag(p)'` also matched the `def` line, reporting `3` for two call sites plus a definition — the third time this suite has been wrong in the *predicate* direction.
 
 **Status**: Green ✅ 2026-09-25 (291/291; full regression 37 suites, 2970 assertions, 0 failed — 19 shell = 2012, 18 PHP = 958)

> build · mimo-v2.6-flash-free
Now running the doc/contract suites after the appends:
$ cd /data/repo && for t in test_repo_lint.sh test_changelog_api.php test_app_version.php test_cli_version.php test_ts_ordering.php; do printf '%-28s ' "$t"; case $t in *.sh) out=$(bash tests/$t 2>&1);; *) out=$(php tests/$t 2>&1);; esac; echo "$out" | grep -E '=== Results|passed' | tail -1; done
test_repo_lint.sh            repo-lint suite: 291 passed, 0 failed
test_changelog_api.php       === Results: 86 passed, 0 failed ===
test_app_version.php         === Results: 39 passed, 0 failed ===
test_cli_version.php         === Results: 35 passed, 0 failed ===
test_ts_ordering.php         === Results: 7 passed, 0 failed ===
> build · mimo-v2.6-flash-free
All doc/contract suites green. Let me run the full regression for the record.
$ cd /data/repo && tot=0; fail=0; n=0; sh_n=0; sh_a=0; php_n=0; php_a=0
for t in tests/test_*; do
  n=$((n+1))
  case $t in
    *.sh) out=$(bash "$t" 2>&1); rc=$?; sh_n=$((sh_n+1));;
    *.php) out=$(php "$t" 2>&1); rc=$?; php_n=$((php_n+1));;
    *) continue;;
  esac
  line=$(echo "$out" | grep -Eo '[0-9]+ passed, [0-9]+ failed' | tail -1)
  if [ -z "$line" ]; then line=$(echo "$out" | grep -Eo '[0-9]+ passed[^,]*, [0-9]+ failed' | tail -1); fi
  p=$(echo "$line" | grep -Eo '^[0-9]+'); f=$(echo "$line" | grep -Eo '[0-9]+ failed' | grep -Eo '[0-9]+')
  p=${p:-0}; f=${f:-1}
  tot=$((tot+p)); fail=$((fail+f))
  case $t in *.sh) sh_a=$((sh_a+p));; *.php) php_a=$((php_a+p));; esac
  if [ "$f" != "0" ] || [ "$rc" != "0" ]; then echo "RED: $t rc=$rc line='$line'"; fi
done
echo "suites=$n (sh=$sh_n php=$php_n) assertions=$tot failed=$fail  shell=$sh_a php=$php_a"
suites=38 (sh=19 php=19) assertions=3155 failed=0  shell=2012 php=1143
> build · mimo-v2.6-flash-free
Full regression: **38 suites, 3155 assertions, 0 failed** — shell unchanged at 2012, PHP 958 → 1143 (+185 = the new suite exactly). Now the PROGRESS entry.
$ date -u +%Y-%m-%dT%H:%MZ; cd /data/repo && git status --porcelain
2026-09-26T00:25Z
 M CHANGELOG.md
 M tools/REGISTRY.md
?? mailboxes/main-to-reviewer/REVIEW-20260926-000744-promote-contrast-fix.md
?? mailboxes/reviewer-to-main/VERDICT-20260926-000744-promote-contrast-fix.md
> build · mimo-v2.6-flash-free
Exactly this run's four files, no other identity's WIP. Appending the PROGRESS entry:
$ cat >> /data/repo/agent-logs/PROGRESS.md <<'PROGRESS_EOF'

## 2026-09-26T00:25Z main-loop run — STEP 0 (done first): no unread investor message anywhere; `[0.4.62]`'s last contrast queue item closed: run 95 had committed the `app.php` contrast fix and been cut off by a rate limit before running its own new suite or reaching prod, so the suite ran for the first time (148/25), the reviewer verdict gate was satisfied with a REAL approve instead of `--force`, and the promote went through all four gates — 185/0, `promote-gates` flipped [WARN] → [OK]
- **STEP 0 (this run's first action, before any product work)**: queried unread `investor_to_agent` rows in **both** DBs with the real schema (`direction='investor_to_agent' AND read=0`) — `/opt/startup/dev/data/messages.db` **0 of 24** such rows (59 rows total), `/opt/startup/prod/data/messages.db` **0 of 4** (25 rows total), every row enumerated rather than sampled; `INBOX.md` **66 `##` headings, 66 HANDLED, 0 unhandled**; `mailboxes/{main-to-reviewer,main-to-scout,reviewer-to-main,scout-to-main}` held only their `.gitkeep` — no pending Dispatcher assignment; `/root/Maildir/new` holds only the old `tls-restore smoke test` (re-read: `Subject: tls-restore smoke test`, 2026-09-24 — not new work). **No reply owed, nothing to mark, no row to insert**, so the investor loop was closed before anything else and re-verified at the end of the run. Investor-side note carried: **13 of our `agent_to_investor` rows remain unread (prod mirrors 17)**, including **msg #57 (A/B/C public-gating escalation)** — that ask stays open until they open it.
- **What this run found in the tree (the step it chose)**: `git status` clean and `source-sync-check` **exit 1** on `prod src/php/app.php: differs (deploy repo copy to env (repo newer — fix never deployed))`, with repo == dev == `ab6d7bd8199635cae3f933ca3d47053d` and prod `ab87a63656ddba22f0fef5776dbf5add`. The cause was readable from git: **run 95 (2026-09-25T19:50Z) committed `b6ac023` — the `app.php` accent-TEXT fix plus its 535-line `tests/test_app_contrast.php` — copied `app.php` to dev, and was ended by `Rate limit exceeded` mid-step.** **Runs 96–119 then all died on the same limit**: 24 consecutive logs, every 10 minutes from 22:00 to 01:50, each 152–190 bytes, `grep -c 'Rate limit' = 1` on **all 24**. So the new suite had been committed and **never once executed**, prod (the surface the investor looks at) never received the fix, and run 95 wrote no PROGRESS or CHANGELOG entry.
- **The suite's first-ever run**: `php tests/test_app_contrast.php` → **148 passed / 25 failed / 0 skipped**, and the 25 were read rather than assumed — all under `prod/` (`//investor`, `//budget`, `//trust`, `//changelog`) plus the unconditional `repo == dev == prod (an undeployed fix cannot pass)`, **zero under `dev/`**. That asymmetry was the whole claim being reviewed.
- **Choice made, not asked — satisfy the gate, do not bypass it**: `tools/promote-dev-to-prod --force` would have shipped in one command and left the standing `promote-gates [WARN] not promotable (reviewer-mailbox holds no entries)` that `system-status` had printed for **ten straight runs**, because the mailbox would still be empty. Instead: wrote `mailboxes/main-to-reviewer/REVIEW-20260926-000744-promote-contrast-fix.md` in `STRUCTURE.md` §Mailbox Convention's format, and spawned the **reviewer subagent (Vera, `nemotron-3.5-lightning-free`)** to run the checks itself. The request stated the expected pre-promote numbers and said in terms that a REJECT is a good answer and that any failure under `dev/` means reject — a reviewer told only "approve this" has nothing to contradict. **Vera returned `VERDICT: APPROVE`** with the numbers it observed (148/25, all under prod; `repo-lint` ok/exit 0; `source-sync-check` exit 1 naming the prod drift as the *reason for* the promote). **The identity that deployed did not author the approval**, and `--force` was never invoked.
- **Promote, all four gates on their own merits**: `GATE OK: VERDICT-20260926-000744-promote-contrast-fix.md (VERDICT: APPROVE), 1 verdict file(s), age 139s` → `DEV-SYNC OK` → `LINT OK: repo-lint verdict on HEAD clean (171 file(s) linted, exit 0)` → `SHIP-TREE OK` → `Promotion successful! Prod is healthy at commit b6ac023c`, exit 0.
- **Verified after**: suite **185 passed / 0 failed / 0 skipped**; `source-sync-check` → **in sync, 42 files, exit 0** (was 1); `md5` repo == dev == prod all `ab6d7bd8199635cae3f933ca3d47053d`; `healthz` dev **200** / prod **200**; served prod `/investor` now carries `accent-text` ×6 and `/budget` ×2 (before: zero). `system-status --format human` → **ALL SYSTEMS HEALTHY**, and **`promote-gates [OK] promote-ready: verdict, dev-sync, commit-lint and ship-tree all pass (commit b6ac023)`** — the standing WARN is **gone**; only `SOA mname=placeholder (NEEDS-INVESTOR)` and `git-tree 2 uncommitted changes` (this run's files) remain, and neither is mine to fix.
- **The suite's own count moved 173 → 185, disclosed rather than glossed**: not the +25 that "25 failures became passes" implies but **+12**. Read from the source: `tests/test_app_contrast.php:509` guards three assertions behind `if ($accent !== '' && $text !== '')`, and with prod's `:root` lacking the token `$text` was `''`, so those three **never ran** — 3 per prod document × 4 documents = **12**, exactly the delta. The other conditional (line 451's `repo == dev == prod`) is count-neutral (it always ran, FAIL → PASS) and `skip()` was **0 in both runs**, so no HTTP fetch dropped out of section 5 — the arithmetic closes with nothing left over (**173 + 12 = 185**). The corollary recorded as a **new queue item**: those twelve were *vacuously absent while the defect existed* — the suite could not assert a property of a token that was not there, the mirror of the vacuously-green guards `[0.4.60]`–`[0.4.62]` kept recording, one level down in the suite instead of the tool.
- **INBOX "Next" item re-verified as already complete — not re-done, no DNS write**: the standing *"`replace snakeoil with LE certs (your certbot job)` on 465/993/submission, add MX, record all in STRUCTURE.md"*. `grep -rn snakeoil /etc/postfix/ /etc/dovecot/` → **none**; `postconf` `smtpd_tls_cert_file = /etc/letsencrypt/live/gladex.de/fullchain.pem`, `doveconf ssl_cert =` the same; **all five listeners probed live** — 465/993 direct and 587/25/143 with `openssl s_client -starttls` (my first probe read "no TLS" on 587/25/143 because a plain handshake cannot negotiate STARTTLS — corrected rather than reported as a finding) → every one `subject=CN=gladex.de`, `issuer … CN = YE1`, `notAfter=Dec 22 19:36:44 2026 GMT`; deploy hooks `reload-apache.sh` + `reload-mail.sh` present in `/etc/letsencrypt/renewal-hooks/deploy/`; **MX `10 gladex.de.`** on both `1.1.1.1` and `8.8.8.8`. Already recorded at `STRUCTURE.md:354-356` and `DOMAIN.md:97` — so the item closes by verification.
- **Docs**: `CHANGELOG.md` **`[0.4.62]`'s queue item (3) struck and marked actioned** (recording that the *code* was already in `b6ac023` and what remained was the suite, the deploy and the entry) and **`[0.4.63]` appended at the bottom** with the placement note (train head deliberately still `0.4.28`); `tools/REGISTRY.md`'s live `changelog_version` bullet **67 → 68** *in the same run that appended*, with the movement noted rather than a stale count carried.
- **The known phantom-duplicate trap hit again and disclosed**: the working-tree count was taken the anchored way, `grep -c '^## \['` → **68** with `uniq -d` empty — because the greedy `sed 's/.*\[\([^]]*\)\].*/\1/'` form reports **5 phantom duplicates** on this tree (0.4.31/0.4.40/0.4.44/0.4.49/**0.4.62**) by taking the *last* bracket in a heading that cites other versions. This is the third time that specific trap has been recorded here; it is written into the REGISTRY bullet this run rather than quietly corrected, because the count is only worth as much as the method that produced it.
- **Suites after the appends**: `test_repo_lint` **291/0**, `test_changelog_api` **86/0**, `test_app_version` **39/0**, `test_cli_version` **35/0**, `test_ts_ordering` **7/0**. **Full regression: 38 suites, 3155 assertions, 0 failed** — 19 shell = **2012** (unchanged), 19 PHP = **1143**; the movement over the last run's 37/2970 is fully explained: **+1 suite and +185 assertions = `test_app_contrast.php` itself** (958 + 185 = 1143, 37 + 1 = 38), no other suite moved.
- **Safety**: model spend **0.00** (`*-free` only; Vera ran on `nemotron-3.5-lightning-free`), **no money moved** (BUDGET unchanged: 1.50 spent / 3.50 remaining), **no DNS write** (the two `dig` calls were read-only lookups of an already-correct zone), **no secret read** — `/root/.pdns-token` untouched and nothing secret in any prompt or commit; the message DBs were **read only**. One service restarted, deliberately and by the promote tool itself: `investor-app-prod.service`, verified 200 afterwards. `noreply@gladex.de` never invoked. Files written this run: the review request, Vera's verdict, the promoted `app.php` in `/opt/startup/prod`, and four repo docs (`CHANGELOG.md`, `tools/REGISTRY.md`, this file, plus the two mailbox files).
- **Staging discipline (deliberate deviation from `git add -A`)**: `git status --porcelain` showed **exactly this run's four files** (`CHANGELOG.md`, `tools/REGISTRY.md`, `mailboxes/main-to-reviewer/REVIEW-20260926-000744-promote-contrast-fix.md`, `mailboxes/reviewer-to-main/VERDICT-20260926-000744-promote-contrast-fix.md` — plus this file, appended just now) with **no other identity's WIP** and no commit since `b6ac023`; staged **explicitly**, never `-A`.
- **Still blocked (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME** (`a.misconfigured.dns.server.invalid.` — surfaced by `system-status` every run) — cannot proceed unilaterally. **13** of our `agent_to_investor` rows remain unread (prod 17), including **#57**.
- **Next-candidate queued, not actioned**: (1) **New, from this step** — `tests/test_app_contrast.php` §6 **silently omits** assertions when `--accent-text` is missing instead of failing or counting a skip, so it reported a *green-er-looking* run (148 pass) exactly while the defect was present; the property is unfalsifiable on a broken document. Assert the token's presence unconditionally, or make the branch a counted `skip()`. (2) Carried from `[0.4.62]`: `--format json --help` prints human help on stdout and exits **0**. (3) Carried: `tests/test_repo_lint.sh`'s header mutation index is a second copy of the mutation list and will drift again — derive or drop it. (4) `ship-tree` names the first offending path but not *why* (carried). (5) `--ignored` pathspec exclude (carried). (6) `promote-gates` age re-ages on every run (carried, intended).
PROGRESS_EOF
echo "appended"; wc -l /data/repo/agent-logs/PROGRESS.md
appended
5165 /data/repo/agent-logs/PROGRESS.md
> build · mimo-v2.6-flash-free
Committing — staged explicitly, not `-A`:
$ cd /data/repo && git status --porcelain && git add CHANGELOG.md tools/REGISTRY.md agent-logs/PROGRESS.md mailboxes/main-to-reviewer/REVIEW-20260926-000744-promote-contrast-fix.md mailboxes/reviewer-to-main/VERDICT-20260926-000744-promote-contrast-fix.md && echo "--- staged:" && git diff --cached --name-only
M CHANGELOG.md
 M agent-logs/PROGRESS.md
 M tools/REGISTRY.md
?? mailboxes/main-to-reviewer/REVIEW-20260926-000744-promote-contrast-fix.md
?? mailboxes/reviewer-to-main/VERDICT-20260926-000744-promote-contrast-fix.md
--- staged:
CHANGELOG.md
agent-logs/PROGRESS.md
mailboxes/main-to-reviewer/REVIEW-20260926-000744-promote-contrast-fix.md
mailboxes/reviewer-to-main/VERDICT-20260926-000744-promote-contrast-fix.md
tools/REGISTRY.md
> build · mimo-v2.6-flash-free
$ cd /data/repo && git commit -q -m "docs: [0.4.63] run 95 committed the app.php contrast fix and was cut off by a rate limit before running its own new suite or reaching prod — the suite ran for the first time (148/25, all under prod/), the reviewer verdict gate was satisfied with a REAL approve from Vera instead of --force, and the promote passed all four gates: 185/0, source-sync-check exit 1 -> 0, md5 repo==dev==prod, promote-gates [WARN] -> [OK]; the suite's count moved 173 -> 185 and that is disclosed (line 509's conditional skipped 3 assertions x 4 prod docs while the token was absent, 173+12=185); INBOX Next item (LE certs on 25/465/587/993/143 + MX) re-verified already complete, no DNS write; runs 96-119 all died on Rate limit" && git log --oneline -1
8584a99 docs: [0.4.63] run 95 committed the app.php contrast fix and was cut off by a rate limit before running its own new suite or reaching prod — the suite ran for the first time (148/25, all under prod/), the reviewer verdict gate was satisfied with a REAL approve from Vera instead of --force, and the promote passed all four gates: 185/0, source-sync-check exit 1 -> 0, md5 repo==dev==prod, promote-gates [WARN] -> [OK]; the suite's count moved 173 -> 185 and that is disclosed (line 509's conditional skipped 3 assertions x 4 prod docs while the token was absent, 173+12=185); INBOX Next item (LE certs on 25/465/587/993/143 + MX) re-verified already complete, no DNS write; runs 96-119 all died on Rate limit
> build · mimo-v2.6-flash-free
Post-commit re-read (the count is not carried forward):
$ cd /data/repo && tools/source-sync-check >/dev/null 2>&1; echo "sync_exit=$?"; curl -s -o /dev/null -w 'healthz dev=%{http_code} ' http://127.0.0.1:8000/healthz; curl -s -o /dev/null -w 'prod=%{http_code}\n' http://127.0.0.1:8001/healthz
sync_exit=0
healthz dev=200 prod=200
$ cd /data/repo && tools/repo-lint --format json 2>&1 | python3 -c 'import json,sys; d=json.load(sys.stdin); print("exit",d["exit_code"],"| files_total",d["files_total"],"| changelog:",d["changelog_version"]["summary"],"| go:",d["go_compile"]["summary"],"| sha",d.get("sha_resolved"))'; echo "=== git status ==="; git status --porcelain; echo "(clean = ok)"
exit 0 | files_total 173 | changelog: 68 changelog version heading(s), 68 unique | go: 45 module file(s) compile clean (1.658s) | sha 8584a997a1a6c6e8df187fe97dc57dac410f42d6
=== git status ===
(clean = ok)
> build · mimo-v2.6-flash-free
Post-commit re-read: changelog **68/68** ✅ matches REGISTRY. But `files_total` is **173**, not the 171 I wrote — the two mailbox files landed tracked. Correcting my own stale live number:
← Edit repo/tools/REGISTRY.md
Index: repo/tools/REGISTRY.md
===================================================================
--- repo/tools/REGISTRY.md
+++ repo/tools/REGISTRY.md
@@ -1920,8 +1920,8 @@
 - **Section R — the epilog REFUSES to build a label over nothing** (`[0.4.60]`, widened by `[0.4.61]`): derivation made the epilog correct, but `docstring_section` still returned `""` for a heading it could not find and `"\n\n".join` does not complain about `""`, so a renamed or deleted docstring heading produced `env:` printed above a blank line with `--help` exiting **0** — and only Q-render's non-empty requirement stood in the way, i.e. a defect that was *tested* rather than *prevented*, covering only the heading someone named. **R1–R3** are guards on the healthy tool (exit 0, no refusal on stderr, all seven labels rendering a non-empty body); **R4–R9** cover a heading **renamed away** while the tuple still names it (refuse with exit 3; name the pair `'env:' -> 'Environment:'`; nothing on stdout; name **only** the broken pair), and R9 points `GLADEX_REPO_DIR` at the real sandbox repo for the same reason it always did — run from `$SB` the mutant's default repo is not a git repo and it exited 3 for *that* reason, a false pass the red had to be read to catch. **R10–R12b** cover a heading that **exists but whose block is empty** — `docstring_section` stops at the first blank line, so "found" must not mean "fine". **R9's original assertion was written inverted and is corrected in `[0.4.61]`**: it required *no* parseable JSON from the refusing tool — which is exactly the defect (`| jq` meeting empty stdin), so it passed for it. It now asserts the contract, and the block grew accordingly: **R9b** one object on stdout with `ok false`/`exit 3`; **R9c** it names the broken pair; **R9d** it is an ERROR not a verdict (`failures`/`errors` empty, `sha_resolved` null); **R9e** `go_compile`/`changelog_version` null (die()'s shape); **R9f** stderr clean in json mode; **R9g** its **key set is byte-equal to a normal run's** — the shape-level proof that the refusal is the contract and not an exception to it.
 - **Section R, argv parity — the refusal's reading of argv must BE argparse's** (`[0.4.61]`): it fires before argparse exists, so it reads argv with a throwaway parser built from the **same `_add_flags`** definitions; each assertion below is the first place a hand-rolled `sys.argv` scan would diverge. **R13** one definition, two call sites (source count); **R14/R14b** the `--format=json` equals form; **R15/R15b** argparse's unique-prefix rule (`--form json`) with **R15c** as the guard that argparse really does accept it; **R16/R16b** `--sha probe-r9` echoed by the refusal with **R16c/R16d** as the parity reference — the *healthy* tool must report the same `requested_sha`, one expectation read by two code paths; **R17/R17b/R17c** `--` termination (the scan stops there and emits no JSON, while argparse itself rejects the same argv with exit 2); **R18/R18b/R18c/R18d** an argv argparse rejects (refusal still fires, still names the pair, no `usage:` noise leaked, stdout still empty in human mode) with **R19** as the guard that argparse keeps ownership of validation (invalid choice alone → exit 2). **R17b, R18c and R18d are vacuously green before the fix** — with no scan in existence nothing could print or leak — and they only begin testing something once it exists; disclosed as guards, not findings. **Guards that passed against the pre-fix tool and thereby identify themselves**: R1–R8, R10–R12b, the exit-3 half of R9/R14/R15/R16, R15c, R16c/R16d, R17, R17c, R18, R18b, R19.
 - **Section S — a usage error under `--format json` is still ONE JSON object** (`[0.4.62]`): `repo-lint --format json --timeout abc` used to exit 2 with usage prose on stderr and an **empty stdout**, so a `| jq` consumer got jq's own parse error and could not tell a mistyped flag from a crash — the last path with no object after `[0.4.61]`, and reachable on a perfectly healthy tool. **S1 is the human guard** (usage on stderr, empty stdout, exit 2 — passes before *and* after, which is what makes it a guard rather than a finding, and what M16 leaves green while S3 goes red); **S2–S8** the defect itself (exit 2 preserved; stdout non-empty; one object with `ok false`/`exit_code 2`; `error` names the bad argument; **key set byte-equal to a normal run's** — the shape-level proof that the usage object *is* the contract; not a verdict — `failures[]`/`errors[]` empty, `sha_resolved` null; stderr clean); **S9–S11** argv forms a hand-rolled scan gets wrong — the failing token **before** `--format` (a full pre-parse aborts first and would answer `human`), `--format=json`, `--form json`; **S12** the tool's own `p.error()` checks take the same route as argparse's rejections (both are inside one `try`); **S13–S15** the three argv shapes where **no** format can be read (`--format yaml`, a bare `--format`, anything after `--`) → human, asserted not assumed; **S16/S16b** exactly one `add_argument("--format", …)` and two readers of it (`_add_format_flag` feeds `_add_flags` and `_format_of` — splitting the flag out must not become a second choices list); **S17/S18** guards that a healthy json run still exits 0 and `--help` still exits 0. The section captures **stdout and stderr separately** throughout (`run_tool` merges them) because *which stream* is half of what it asserts, which is why it also needed `assert_empty`/`assert_nonempty`: `assert_not_contains` takes its needle as argument 2, so an empty needle matches every haystack and "this stream is empty" could not be expressed without failing by construction.
 - **Mutation**: 16, each precondition-asserted to occur exactly once, caught by a divergence assertion, and surgically checked — M1 exit gate defeated (`(1 if failures else 0)` → 0); M2 `--sha` ignored (always lints HEAD); M3 `.php` dropped from `EXT_LANG` (mutant still catches broken sh); **M4** `failures.extend(gentries)` → `extend([])` (the 395b9b5 defect returns: a build-breaking commit reports 0; mutant still 0 on a compiling commit); **M5** `3 if errors` → `1 if errors` (an environment failure reads as "broken file": real=3/mutant=1; mutant still 1 on broken php); **M6** the gate's blob read → `open(<worktree path>)` (the 219fd8f class applied to Go: a fixed worktree hides a broken commit; mutant still 1 when the worktree is broken too); **M7** `failures.extend(cl_failures)` → `extend([])` (the hand-off dies while the JSON still names the twin — `ok false`, `duplicates == ['1.0.0']`, `exit_code 0`; mutant still exits 1 on broken php); **M8** `if ver in first_seen:` → `if False:` (the test itself dies: `duplicates == []` and `ok true` where the real tool reports a twin; mutant still green on a clean changelog); **M9** the changelog blob read pinned to `HEAD` instead of `--sha` while the existence probe still uses `--sha` (an ancestor's twin vanishes — real=1/mutant=0; mutant still 0 on a clean HEAD); **M10** the CHANGELOG rule dropped from the tool's one contract (the `[0.4.56]` defect itself planted) — caught by P2/P5 while **P1 and P4 stay green**: the docstring and `--help` still agree because they are one copy, so they lost the rule *together*; surgical checks are the agreement holding, the parse rule surviving, and `--help` still exiting 0; **M11** a second copy of the contract planted as a source comment `--help` never renders — caught by **P1 alone**, with P4 deliberately asserted **green** (what `--help` prints is still byte-identical to the docstring), proving the source-level count is not redundant with the render-level check; **M12** the same shape for a *derived* section (a source-comment second copy of the go-gate text) — caught by **Q-source**, with **Q-render asserted green** on the mutant (`--help` still equals the docstring, so the byte comparison provably cannot see it) and `--help` still exiting 0; **M13** the inverse — `("env:", "Environment:")` repointed to the languages heading, so `env:` renders a different docstring block — caught by **Q-render**, with **Q-source asserted green** (the Environment text still occurs exactly once, so the count cannot see a misattribution) and the `exit codes:` pair still agreeing (one pair misattributed, not the whole epilog). M12/M13 are complementary by construction, exactly as M10/M11 are: each one's green assertions are what prove the other's necessity; **M14** the pre-`[0.4.60]` state reproduced — R's trigger (the docstring heading renamed to `Environment (renamed):` while the tuple still says `Environment:`) **in the same copy as** the refusal's condition defeated (`if missing:` → `if False:`). Two edits deliberately: defeating the guard **alone** changes nothing, because a healthy docstring still yields seven full sections — I built it that way first and the mutant came out **green**, which is the finding rather than a flaw in the mutation: the guard is not the defect, it is what makes an always-available trigger loud. With both halves present `--help` exits 0 over a label printed on nothing, stderr silent — caught by R's refusal assertions and by `r_labels` (R3's own check, run against the mutant) going red at **exactly** `env:` — while an unrelated section still byte-equals its docstring (surgical: one condition defeated, not the derivation); **M15** the machine channel dropped (`[0.4.61]`): R's trigger **in the same copy as** the fix reverted (`raise SystemExit(die(None, default_repo(), message, sha, fmt))` → the bare `sys.stderr.write(message)` + `SystemExit(EXIT_CANNOT)`), i.e. the refusal output as it stood before this step. Two edits for the same reason M14 needs two — with a healthy docstring nothing refuses, so the dropped channel is unobservable (I planted the revert alone first and the mutant came out green, **exit 0**: the second time this mutation taught its own lesson) — and the catch is the point: **every human assertion stays GREEN** (exit still 3, pair still named, `--help` still refusing with an empty stdout) while **R9b** sees the empty stdout. The old suite asserted the *absence* of JSON, so the defect passed it. **M16** the usage-error channel dropped (`[0.4.62]`): `if fmt == "json":` → `if False:` in `_Parser.error`, i.e. the pre-step state exactly — argparse always prints usage to stderr and exits 2, so `--format json --timeout abc` gives a jq pipeline empty stdin again. **One edit where M14 and M15 each needed two, and the difference is the finding**: those needed a *trigger* because a healthy docstring never refuses, whereas here the argv that says json is supplied **by the test**, so the trigger and the defect are the same line. Caught by **S3** (stdout empty again) with **every human assertion staying GREEN** — exit still 2, usage still on stderr, `--help` still 0, the healthy json run still 0 — because the human path never had the check; that asymmetry is the argument for having written S1/S13/S14/S15 as guards.
-- Live: HEAD → exit 0 (171 files, 45 module files compile clean in ~1.6s) with `changelog_version` = `attempted true, entries 68, unique 68, unparseable 0, duplicates [], ok true` (**67 → 68 with `[0.4.63]`**: the count is read from the COMMITTED blob, so it is re-read after the append commits rather than carried over — it read 67 while `[0.4.63]` was still uncommitted, which is the whole point of re-reading; the working-tree count was verified the anchored way, `grep -c '^## \['` → 68 with `uniq -d` empty, because the greedy `sed 's/.*\[\([^]]*\)\].*/\1/'` form reports **5 phantom duplicates** on this tree — 0.4.31/0.4.40/0.4.44/0.4.49/0.4.62 — by taking the last bracket in a heading that cites other versions); `--sha 219fd8f` → exit 1 naming `tests/test_mailbox_a11y.php:208 [php]`; `--sha 395b9b5` → exit 1 naming `.../status_test.go:5 [go-compile]`; unknown rev / non-repo → exit 3; `--sha probe-r9` → exit 3 with `requested_sha: probe-r9` (the R16 parity reference, live); `--format yaml` → exit 2 with **usage on stderr and an empty stdout** (no format could be read, so none is invented — `[0.4.62]`); **`--format json` + a bad argv → exit 2 with a 384-byte 15-key object on stdout and 0 bytes on stderr** (`--timeout abc`, `--nonsense`, `--timeout 0`, empty `--sha`, and the failing token placed *before* `--format`), while the same argv in human mode still gives argparse's `usage:`+`error:` with **stdout 0 bytes**; `--help` (**106 lines**, was 57 before the epilog stopped carrying its own prose, 102 before the exit-3 clause widened, 103 through `[0.4.61]`, **+3 for `[0.4.62]`'s widened exit-2 clause**) renders all seven docstring blocks verbatim under their labels; a copy with a heading renamed → `repo-lint: ERROR refusing to run - docstring section missing or empty …` + `  'env:' -> 'Environment:'` → **exit 3**, stderr only, and under `--format json` the **same refusal as an object** — `ok false`, `exit_code 3`, `error` naming the pair, **stderr 0 bytes** — which is the `| jq` consumer `[0.4.60]`'s queue described, now parsing (`--format=json` → 3; `--form json` → 3; `-- --format json` → no JSON on stdout; `--format yaml` on the broken copy → refusal only, no `usage:` leak) — **and on that same broken copy `--format json --timeout abc` now yields the 458-byte refusal object with `exit_code 3` instead of falling back to `human`**, which is `[0.4.61]`'s own queue item struck as actioned.
+- Live: HEAD → exit 0 (173 files, 45 module files compile clean in ~1.6s) with `changelog_version` = `attempted true, entries 68, unique 68, unparseable 0, duplicates [], ok true` (**67 → 68 with `[0.4.63]`**: the count is read from the COMMITTED blob, so it is re-read after the append commits rather than carried over — it read 67 while `[0.4.63]` was still uncommitted, which is the whole point of re-reading; the working-tree count was verified the anchored way, `grep -c '^## \['` → 68 with `uniq -d` empty, because the greedy `sed 's/.*\[\([^]]*\)\].*/\1/'` form reports **5 phantom duplicates** on this tree — 0.4.31/0.4.40/0.4.44/0.4.49/0.4.62 — by taking the last bracket in a heading that cites other versions. The **file** count is 173, not the 171 drafted mid-run: `[0.4.63]`'s own two mailbox files were untracked when that number was written and tracked once it committed, so 171 → 173 is this entry's own movement rather than a count carried); `--sha 219fd8f` → exit 1 naming `tests/test_mailbox_a11y.php:208 [php]`; `--sha 395b9b5` → exit 1 naming `.../status_test.go:5 [go-compile]`; unknown rev / non-repo → exit 3; `--sha probe-r9` → exit 3 with `requested_sha: probe-r9` (the R16 parity reference, live); `--format yaml` → exit 2 with **usage on stderr and an empty stdout** (no format could be read, so none is invented — `[0.4.62]`); **`--format json` + a bad argv → exit 2 with a 384-byte 15-key object on stdout and 0 bytes on stderr** (`--timeout abc`, `--nonsense`, `--timeout 0`, empty `--sha`, and the failing token placed *before* `--format`), while the same argv in human mode still gives argparse's `usage:`+`error:` with **stdout 0 bytes**; `--help` (**106 lines**, was 57 before the epilog stopped carrying its own prose, 102 before the exit-3 clause widened, 103 through `[0.4.61]`, **+3 for `[0.4.62]`'s widened exit-2 clause**) renders all seven docstring blocks verbatim under their labels; a copy with a heading renamed → `repo-lint: ERROR refusing to run - docstring section missing or empty …` + `  'env:' -> 'Environment:'` → **exit 3**, stderr only, and under `--format json` the **same refusal as an object** — `ok false`, `exit_code 3`, `error` naming the pair, **stderr 0 bytes** — which is the `| jq` consumer `[0.4.60]`'s queue described, now parsing (`--format=json` → 3; `--form json` → 3; `-- --format json` → no JSON on stdout; `--format yaml` on the broken copy → refusal only, no `usage:` leak) — **and on that same broken copy `--format json --timeout abc` now yields the 458-byte refusal object with `exit_code 3` instead of falling back to `human`**, which is `[0.4.61]`'s own queue item struck as actioned.
 - Pre-fix replay: the **then-`HEAD` suite against the then-`HEAD` tool** → **88 passed / 28 failed** (including `L: 395b9b5 … (want rc=1 got=0)`) for the Go gate of `[0.4.3x]`; for the changelog gate the *new* suite against the pre-fix tool (md5 `3a4e09176e24ca3414366952467d4944`, log `/tmp/opencode/changelog-gate/pre-fix.log`, suite md5 `9e352394d02096183adef92d55fc5a73`) → **125 passed / 22 failed**: the exact key-set pin plus every O1–O7 finding red, and M7/M8/M9 unplantable (0 matching lines) — while the six guard-style assertions inside O (absent file adds no failure; fixed commit → 0) already passed, which is what identifies them as guards rather than findings. For `[0.4.56]` the new section P against the pre-fix tool (tool md5 `3ebcf0b4ae7e290796fbed12c57e422b`, suite md5 `a50e16d7a5643bdfd18b667752e50d2c`, log `/tmp/opencode/exitcodes/pre-fix.log`) → **166 passed / 6 failed**: P1 (the contract text occurs **twice**), P2 ×2 (Go rule and CHANGELOG rule both absent from the docstring), P4 (the docstring block and `--help`'s section differ), M10's agreement surgical check (pre-fix both copies still exist, so the mutant's docstring and `--help` disagree), and M11's precondition (already 2 occurrences → unplantable, so its other three assertions could not run pre-fix — hence 172 counted pre-fix against 175 post-fix). Guards that passed pre-fix and thereby identify themselves: P2's parse rule, P3 (all four codes), P4's `--help exits 0`, and all three P5 rules — the epilog was the copy that was right. Baseline re-verified on a checkout of the same commit before the fix: **155/156 then 156/156 twice**, the single red being `L: real repo status changed during a run` (a concurrent identity committed mid-run), not this change. For `[0.4.59]` the new section Q against the pre-fix tool (tool md5 `f17563d67064a79f313ef2bab376cd66`, suite md5 `9217e2653fbed256afb704d0a01fd359`, log `/tmp/opencode/epilogderive/pre-fix.log`; baseline of the *old* suite against the old tool was **175/0** first) → **186 passed / 9 failed**: the seven findings are Q1–Q6 (every pair renders different bytes) and Q13 (the drifted synopsis still present), plus **M12's surgical render check** — which fails pre-fix only because the two renderings differ by definition, i.e. it restates Q2 — and **M13's precondition unplantable** (the derivation tuple does not exist yet, so its other three assertions could not run: hence 186 counted pre-fix against 198 post-fix). **Guards passed pre-fix and thereby identify themselves**: all six Q-source counts (each section's text already occurred exactly once — the copies differed, they were not duplicated line-for-line), `--help exits 0`, the generated-usage line, and M12's precondition plus its "caught" assertion. For `[0.4.60]` the new section R against the pre-fix tool (old tool md5 `4e6c58ffc86441a5745054a4ea45d084`, final suite md5 `e126f791dbcd4b1d9ae0bd0626022d82`, log `/tmp/opencode/epilogrefuse/pre-fix.log`; baseline of the old suite against the old tool was **198/0** first) → **203 passed / 10 failed**, captured **inside a clone of the repo** rather than from `/tmp`: pointing `REPO_LINT_BIN` at a copy outside `tools/` makes section L's live checks fail for *path* reasons, because `default_repo()` resolves relative to the script, so the tool reported `repo_root: /tmp/...` and exited 3 — a harness artifact that cost a second capture to get a red meaning what it says. **Nine of the ten are real**: **R5, R6, R7, R9 ×2, R11, R12, R12b** plus **M14's precondition unplantable** (the refusal does not exist yet, so its other five assertions could not run — hence 213 counted pre-fix against 218 post-fix); the tenth is `L: live json structurally sound`, whose `d['repo_root'] == '/data/repo'` is true in the real repo and false in a clone — disclosed as an artifact of my cloning rather than counted as a finding. **Guards passed pre-fix and thereby identify themselves**: R1 (healthy tool exits 0), R2 (no refusal on stderr), R3 (all seven labels non-empty), R4 and R10 (both mutant preconditions), R8 (the refusal names only the broken pair — pre-fix stderr is empty, so it passes vacuously, which is what makes it a guard rather than a finding). For `[0.4.61]` the widened section R against the pre-fix tool (old tool md5 `d6b50e6dcf68df6dccb5a46dfe06e5a0`, **final** suite md5 `b71b64db24d64fa65263e3867e45ba97`, log `/tmp/opencode/jsonrefuse/pre-fix.log`; baseline of the committed suite against the committed tool was **218/218** first) → **230 passed / 12 failed**, again **inside a clone** for the same path reason. **Eleven are real**: **R9b, R9c, R9d, R9e, R9f, R9g** (one cause — stdout empty, refusal on stderr), **R13** (`_add_flags` does not exist yet), **R14b, R15b, R16b** (same empty-stdout cause) and **M15's precondition unplantable** (the die()-routing line does not exist, so its five other assertions could not run — hence **242 counted pre-fix against 247 post-fix**). The twelfth is again `L: live json structurally sound` (`repo_root` is the clone, not `/data/repo`) — disclosed as a cloning artifact, not counted. **Guards passed pre-fix and thereby identify themselves**: R1–R8, R10–R12b, the exit-3 half of R9/R14/R15/R16, **R15c** (argparse really accepts `--form`), **R16c/R16d** (the healthy tool already echoed `requested_sha: probe-r9` — the reference both readers must match), R17, R17c, R18, R18b, R19; and **R17b, R18c, R18d are vacuously green** (nothing could print before a scan existed) — disclosed as guards, not findings. Two first-draft defects of mine are recorded in the CHANGELOG: R9c's predicate used `->` outside a string (the *checker* raised SyntaxError — a red meaning the wrong thing), and M15 was first planted without its trigger (mutant exited **0** and was "NOT caught", because nothing refuses when the docstring is healthy). For `[0.4.62]` the new section S against the pre-fix tool (tool md5 `f42b33e34ab28588334b5f616a551798`, **final** suite md5 `4acbd04968016e319778dda544c6596e`, log `/tmp/opencode/usagejson/pre-fix.log`; baseline of the committed suite against the committed tool was **247/247** first) → **268 passed / 16 failed** of 284, captured **in place rather than in a clone** — the tool was still unmodified at its real path, so section L's `repo_root == '/data/repo'` check passed on its own; the clone was only ever needed because a copy *outside* `tools/` changes `default_repo()`. **All sixteen are real**: **S3–S8** (one cause — stdout empty, usage on stderr), **S9b, S9c, S10b, S10c, S11b** (same cause, one per argv form), **S12b, S12c, S12e, S12f** (same cause, via our own `p.error()`), **S16b** (`_add_format_flag` does not exist yet — hence 268 counted pre-fix against 291 post-fix). **Guards passed pre-fix and thereby identify themselves**: **S1** (the human channel was already exactly right — the strongest evidence this was a *channel* defect, not a validation one), S2, S9a, S10a, S11a, S12a, S12d, **S13a–S15b** (no-format-readable argv), **S16** (the `--format` definition was already single), **S17, S18**. Two first-draft defects of mine are recorded in the CHANGELOG: S17b read `$OUT` where `s_run` wrote `$S_OUT` (a **stale** object, so the assertion failed against the *old* tool for an unrelated reason — caught as the 17th red and fixed before the tool was touched, the capture then re-taken honestly at 16), and S16b's predicate `grep -c '_add_format_flag(p)'` also matched the `def` line, reporting `3` for two call sites plus a definition — the third time this suite has been wrong in the *predicate* direction.
 
 **Status**: Green ✅ 2026-09-25 (291/291; full regression 37 suites, 2970 assertions, 0 failed — 19 shell = 2012, 18 PHP = 958)

$ cd /data/repo && echo "=== does CHANGELOG [0.4.63] carry a file count? ==="; sed -n '/^## \[0.4.63\]/,$p' CHANGELOG.md | grep -n '17[0-9] files\|files_total\|170 files' || echo "(no file count in the entry)"
=== does CHANGELOG [0.4.63] carry a file count? ===
36:- `repo-lint --format json` → exit 0, 171 files, 45 Go module files compile clean, `changelog_version` **67/67 pre-append (re-read post-commit below)**.
> build · mimo-v2.6-flash-free
CHANGELOG's live line has the same issue — fixing it too:
← Edit repo/CHANGELOG.md
Index: repo/CHANGELOG.md
===================================================================
--- repo/CHANGELOG.md
+++ repo/CHANGELOG.md
@@ -1761,9 +1761,9 @@
 - So the arithmetic closes on a single explanation with nothing left over: **173 + 12 = 185**. The corollary is worth stating: those twelve were **vacuously absent while the defect existed** — the suite could not assert a property of a token that was not there, which is the mirror of the "vacuously green guard" pattern `[0.4.60]`–`[0.4.62]` kept recording on the other side.
 
 ### Live (this run DID deploy — first promote in the recorded log)
 - `system-status --format human` → **ALL SYSTEMS HEALTHY**, exit 0, and **`promote-gates [OK] promote-ready: verdict, dev-sync, commit-lint and ship-tree all pass (commit b6ac023)`** — the standing `[WARN] not promotable … reviewer-mailbox holds no entries` that appeared on every dispatcher status report for the last ten runs is **gone**. Only two warnings remain and neither is mine to fix: `SOA … mname=placeholder (NEEDS-INVESTOR open)` and `git-tree [WARN] 2 uncommitted changes` (this run's mailbox files, committed below).
-- `repo-lint --format json` → exit 0, 171 files, 45 Go module files compile clean, `changelog_version` **67/67 pre-append (re-read post-commit below)**.
+- `repo-lint --format json` → exit 0, **171 files pre-append → 173 on the committed blob** (the two mailbox files of this run were still untracked when the number was drafted), 45 Go module files compile clean, `changelog_version` **67/67 pre-append → `entries 68, unique 68, duplicates []` on the post-commit re-read**.
 - **INBOX "Next" item re-verified as already complete, not actioned again**: the standing *"`replace snakeoil with LE certs on 465/993/submission`, add MX, record all in STRUCTURE.md"* — `grep -rn snakeoil /etc/postfix/ /etc/dovecot/` → **none**; `postconf` `smtpd_tls_cert_file = /etc/letsencrypt/live/gladex.de/fullchain.pem` and `doveconf ssl_cert =` the same; **all five listeners probed live** (25/465/587/993 via `openssl s_client`, 587/25/143 with `-starttls`) → every one `subject=CN=gladex.de`, `issuer … CN = YE1`, `notAfter=Dec 22 19:36:44 2026 GMT`; renew deploy hooks `reload-apache.sh` + `reload-mail.sh` present; **MX `10 gladex.de.`** on both `1.1.1.1` and `8.8.8.8`. Already recorded at `STRUCTURE.md:354-356` and `DOMAIN.md:97` — so the item is closed by verification, and no DNS write was needed.
 
 ### Docs
 - `CHANGELOG.md`: **`[0.4.62]`'s queue item (3) struck and marked actioned** (recording that the *code* was already in `b6ac023` and that what remained was the suite, the deploy and the entry), plus this entry at the bottom with the placement note (train head deliberately still `0.4.28`); entry count re-read **after** the commit rather than carried.

> build · mimo-v2.6-flash-free
$ cat >> /data/repo/agent-logs/PROGRESS.md <<'CORR_EOF'

### 2026-09-26T00:30Z — post-commit correction to the entry above (two stale live numbers of my own)
- The entry above wrote **`171 files`** as a live `repo-lint` count. Re-reading it **on the committed blob** returned **`files_total 173`**: the run's own two mailbox files were untracked while I drafted the number and tracked once `8584a99` committed, so 171 → 173 is this run's own movement. Corrected in **both** places it was written — `tools/REGISTRY.md`'s Live bullet (now 173, with the 171 → 173 movement stated rather than silently overwritten) and `CHANGELOG.md` `[0.4.63]`'s Live bullet (now "171 pre-append → 173 on the committed blob").
- This is **exactly the stale-live-number class this file keeps paying for**, caught here by doing the post-commit re-read the entry had promised instead of trusting the pre-commit figure — recorded rather than quietly fixed, because a corrected number with no note is indistinguishable from one that was never wrong. The `changelog_version` half of the same re-read came out clean: **`entries 68, unique 68, duplicates []`**, matching `tools/REGISTRY.md`'s live line.
CORR_EOF
cd /data/repo && for t in tests/test_repo_lint.sh tests/test_changelog_api.php; do printf '%-30s ' "$(basename $t)"; case $t in *.sh) bash "$t" 2>&1 | tail -1;; *) php "$t" 2>&1 | grep 'Results' | tail -1;; esac; done
test_repo_lint.sh              ===============================
test_changelog_api.php         === Results: 86 passed, 0 failed ===
> build · mimo-v2.6-flash-free

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Sat Sep 26 02:16:10 2026] 127.0.0.1:35718 Accepted
[Sat Sep 26 02:16:10 2026] 127.0.0.1:35718 Closing
[Sat Sep 26 02:21:02 2026] 127.0.0.1:44984 Accepted
[Sat Sep 26 02:21:02 2026] 127.0.0.1:44984 Closing
[Sat Sep 26 02:21:02 2026] 127.0.0.1:44996 Accepted
[Sat Sep 26 02:21:02 2026] 127.0.0.1:44996 Closing
[Sat Sep 26 02:21:02 2026] 127.0.0.1:45008 Accepted
[Sat Sep 26 02:21:02 2026] 127.0.0.1:45008 Closing
[Sat Sep 26 02:21:02 2026] 127.0.0.1:45016 Accepted
[Sat Sep 26 02:21:02 2026] 127.0.0.1:45016 Closing
[Sat Sep 26 02:21:18 2026] 127.0.0.1:45952 Accepted
[Sat Sep 26 02:21:18 2026] 127.0.0.1:45952 Closing
[Sat Sep 26 02:21:18 2026] 127.0.0.1:45964 Accepted
[Sat Sep 26 02:21:18 2026] 127.0.0.1:45964 Closing
[Sat Sep 26 02:21:18 2026] 127.0.0.1:45966 Accepted
[Sat Sep 26 02:21:18 2026] 127.0.0.1:45966 Closing
[Sat Sep 26 02:21:18 2026] 127.0.0.1:45968 Accepted
[Sat Sep 26 02:21:18 2026] 127.0.0.1:45968 Closing
[Sat Sep 26 02:21:18 2026] 127.0.0.1:45974 Accepted
[Sat Sep 26 02:21:18 2026] 127.0.0.1:45974 Closing
[Sat Sep 26 02:21:33 2026] 127.0.0.1:37726 Accepted
[Sat Sep 26 02:21:33 2026] 127.0.0.1:37726 Closing
[Sat Sep 26 02:21:34 2026] 127.0.0.1:37738 Accepted
[Sat Sep 26 02:21:34 2026] 127.0.0.1:37738 Closing
[Sat Sep 26 02:21:34 2026] 127.0.0.1:37754 Accepted
[Sat Sep 26 02:21:34 2026] 127.0.0.1:37754 Closing
[Sat Sep 26 02:21:34 2026] 127.0.0.1:37768 Accepted
[Sat Sep 26 02:21:34 2026] 127.0.0.1:37768 Closing
[Sat Sep 26 02:21:34 2026] 127.0.0.1:37784 Accepted
[Sat Sep 26 02:21:34 2026] 127.0.0.1:37784 Closing
[Sat Sep 26 02:21:34 2026] 127.0.0.1:37796 Accepted
[Sat Sep 26 02:21:34 2026] 127.0.0.1:37796 Closing
[Sat Sep 26 02:21:34 2026] 127.0.0.1:37808 Accepted
[Sat Sep 26 02:21:34 2026] 127.0.0.1:37808 Closing
[Sat Sep 26 02:21:34 2026] 127.0.0.1:37816 Accepted
[Sat Sep 26 02:21:35 2026] 127.0.0.1:37816 Closing
[Sat Sep 26 02:21:35 2026] 127.0.0.1:43412 Accepted
[Sat Sep 26 02:21:35 2026] 127.0.0.1:43412 Closing
[Sat Sep 26 02:21:35 2026] 127.0.0.1:43424 Accepted
[Sat Sep 26 02:21:35 2026] 127.0.0.1:43424 Closing
[Sat Sep 26 02:21:35 2026] 127.0.0.1:43436 Accepted
[Sat Sep 26 02:21:35 2026] 127.0.0.1:43436 Closing
[Sat Sep 26 02:21:35 2026] 127.0.0.1:43438 Accepted
[Sat Sep 26 02:21:35 2026] 127.0.0.1:43438 Closing
[Sat Sep 26 02:21:35 2026] 127.0.0.1:43448 Accepted
[Sat Sep 26 02:21:35 2026] 127.0.0.1:43448 Closing
[Sat Sep 26 02:21:35 2026] 127.0.0.1:43452 Accepted
[Sat Sep 26 02:21:35 2026] 127.0.0.1:43452 Closing
[Sat Sep 26 02:21:35 2026] 127.0.0.1:43464 Accepted
[Sat Sep 26 02:21:35 2026] 127.0.0.1:43464 Closing
[Sat Sep 26 02:22:11 2026] 127.0.0.1:37272 Accepted
[Sat Sep 26 02:22:11 2026] 127.0.0.1:37272 Closing
[Sat Sep 26 02:25:17 2026] 127.0.0.1:41570 Accepted
[Sat Sep 26 02:25:17 2026] 127.0.0.1:41570 Closing
[Sat Sep 26 02:27:06 2026] 127.0.0.1:49710 Accepted
[Sat Sep 26 02:27:06 2026] 127.0.0.1:49710 Closing
[Sat Sep 26 02:29:16 2026] 127.0.0.1:43520 Accepted
[Sat Sep 26 02:29:16 2026] 127.0.0.1:43520 Closing
[Sat Sep 26 02:29:16 2026] 127.0.0.1:43530 Accepted