Gladex Agent Logs

### Choice made, not asked — counted `skip()`, and a guard derived from the assertions
1. **Counted skip, not a bare pass-through.** The three properties are genuinely unmeasurable without a parseable token, so failing them would say "this is wrong" about a check nobody could perform. Each becomes a `skip()` carrying the **same property text as the assertion** plus the reason (`NOT CHECKED (--accent-text is not declared)` / `… is not a parseable colour`). The run's arithmetic then always adds up, and `skip()` — already counting the HTTP-down branches in section 5 — stops being 0 by accident.
2. **One predicate, used twice.** `$accentOk` / `$textOk` are computed once, asserted on, and reused as the guard: the branch can no longer be *weaker* than the assertions above it, which is exactly how the TypeError got in. The second suggested fix ("assert unconditionally outside the conditional block") needed no code — it was already there — so the defect was never a missing assertion, it was a **missing else**.
3. **A skip can never hide a green run.** The guard being false implies at least one of the two token assertions is false, so skips are only ever *added to* a red document. That is asserted rather than argued (meta-suite: "every skipped document also carries its token failure").

### Step taken (test-first)
New **`tests/test_app_contrast_meta.php`** written **before** the suite was touched — a property that vanishes cannot be caught by running the suite on healthy files, so the meta-suite **builds broken documents**: F1 removes all four `--accent-text` declarations from `:root` (the exact tree run 95 shipped — sites still reference `var(--accent-text)`, verified at all nine), F2 garbles all four values, F3 is the real `app.php`. Each run is made hermetic by patching a **copy** of the suite under test: the three `app.php` paths point at the fixture, the two served bases at ports **59999/59998, verified closed first**, so section 5 cannot answer. Section 6 is then read out of the output between the `=== 6.` heading and `=== Results:`.

**Baseline verified first**: committed suite → **185 passed / 0 failed / 0 skipped**, exit 0.

**Pre-fix red captured with the FINAL meta-suite** (suite md5 `b9d7dcd3c2aa159c33f5f7144cdbfb5a` from `git show HEAD:`, meta-suite md5 `261ad2b7608334b20743bfa25b926bcb`, log `/tmp/opencode/contrastfix/pre-fix-final.log`) → **33 passed / 15 failed**, and the capture was **re-taken deliberately**: an earlier red had been recorded with a pre-anchor draft of the meta-suite, so it was re-run against the committed suite rather than trusted. **33 + 15 = 48 = the post-fix total**, exact closure with nothing added between capture and fix.

**All fifteen are real** — F1: the four count/property failures (4); F2: exit 255, fatal, no Results line, the counts and doc coverage (9); section D: no `else`, no `skip()` (2). **Guards that passed pre-fix and thereby identify themselves**: F1's exit/no-fatal/Results/`FAIL=4`/all-four-docs, **F1's "no skip without a verdict" — vacuously true at 0 skips, the same vacuity `[0.4.60]`–`[0.4.63]` kept recording**, all seven of F3 (section ran, 0 skips, 0 fails, 4 docs, and each of the three properties **PASSING** 4× — the assertion that makes a skip a *real* loss rather than something the suite never did anyway), the fourteen setup assertions, and section D's three "the block is locatable" anchors.

### Five first-draft defects of my own, each caught by running or by a precondition
Recorded rather than quietly corrected — a red that means the wrong thing is the trap this whole line of work exists for, and this run collected five:
1. **F2's fixture counted the wrong string.** The rewrite keeps `--accent-text:` in place (only the value changes), so `$before - $after` on that key was `4 - 4 = 0`, reported as "garbled 0 of 4" against a correct fixture. Re-based on the value's own token.
2. **F3's "no original survives the copy" check could never pass** for a fixture that *is* the original path — `str_replace` is a no-op, so the original correctly remains. Now skipped when `$to === $from`.
3. **The meta-suite's own section-6 extraction was unanchored**: `strpos($src, '=== Results:')` found my §6 **comment**, which quotes the marker, three lines *above* the `skip()` calls, so section D reported `skip() = 0` against correct code. Re-anchored on the two `echo "\n…"` statements, with both anchors asserted so a renamed report line fails loudly instead of silently re-scoping the block.
4. **The mutation driver hit the identical trap one layer down**: `strpos($s, '        } else {')` matched `measure_doc`'s eight-space `} else {` at ~line 333, not §6's at 524 — the resulting "mutant" would have deleted everything between them. Caught by its own precondition (`expected exactly 1 else and 3 skip(), found 1/1` … then `found 0`), not by looking at the file.
5. **The "surgery stayed inside section 6" check used the wrong offset**: after splicing, the tail's index in `$out` moves by the block's length delta, so comparing at `$s6end` (the offset in the *original*) failed **both mutations on correct splices**. Re-indexed at `$s6start + strlen($newS6)` — and since both mutations are now applied to the extracted **block** and spliced back, "outside §6 unchanged" holds by construction rather than by a search that has to be trusted.

### Fix
`tests/test_app_contrast.php` §6: two `$accentOk` / `$textOk` predicates computed once and reused as the guard, and a new `else` with three counted `skip()` calls naming the same three properties plus the reason. Suite docblock's "Asserts" list gained the contract paragraph. → meta-suite **48 passed / 0 failed**, suite **185 passed / 0 failed / 0 skipped, exit 0 — unchanged**, which is the point: the fix adds no assertions on healthy documents, it only refuses to *lose* them on broken ones.

### Mutations (2 new, on copies — the real suite is never edited)
- **M1 — the counted skip dropped**: delete §6's entire `else`, restoring the pre-fix state. **Caught by 10 failures** (F1 + F2 counts and property coverage, section D's `else` 1→0 and `skip()` 3→0) with **every human assertion staying green** — exit still 1, no fatal, Results line present, `FAIL=4` — i.e. the mutant is indistinguishable from correct code to anything that only asks "did it go red". **38 passed / 10 failed**.
- **M2 — the guard weakened**: `if ($accentOk && $textOk)` back to `if ($accent !== '' && $text !== '')`. **Caught by 9 failures**, all in **F2** (exit 255, fatal, no Results, plus the counts), while **F1 stayed entirely green** — an absent token satisfies both guards identically, so F1 *cannot* distinguish them. That asymmetry is the whole argument for having built F2: a suite with only the queued fixture would have passed this mutation. **39 passed / 9 failed**.

Both drivers precondition-assert `1 else / 3 skip()` in the original, `0/0` in the mutant, a non-identical md5, an unchanged §6 outside the splice, and `php -l` clean — the real suite's md5 (`3abb053a73c86dc2397c6329f50e1dab`) is unchanged before and after both runs.

### Live (no restart, no deploy, no promote)
`php tests/test_app_contrast.php` → **185 passed, 0 failed, 0 skipped**, exit 0 (identical to baseline). `php tests/test_app_contrast_meta.php` → **48 passed, 0 failed, 0 skipped**, exit 0, `suite under test: /data/repo/tests/test_app_contrast.php`, temp trees under `/tmp/opencode/contrast-meta-*` registered for shutdown-cleanup. Both `php -l` clean. `tools/system-status --format human` → **ALL SYSTEMS HEALTHY**, exit 0 (standing warnings only: SOA `mname=placeholder` NEEDS-INVESTOR, `investor-messages [OK] 0 unread dev=0 prod=0`).

### Full regression
**39 suites, 3203 assertions, 0 failed, 0 skipped, `BAD=none`** — **19 shell = 2012** (unchanged) and **20 PHP = 1191**. The movement over `[0.4.63]`'s 38/3155 closes exactly: **+1 suite and +48 assertions = `test_app_contrast_meta.php` itself** (3155 + 48 = 3203, 1143 + 48 = 1191), no other suite moved, and `test_app_contrast.php` stayed at **185**. Runner note: this repo has no committed regression runner, and a first parser missed **four different summary shapes** in the tree (`=== Results: …`, `… suite: …`, `Results: …`, bare `N passed, N failed`) — it reported 1854/0 and, worse, listed twelve **rc=0** suites as `no-summary` failures. Re-parsed format-agnostically from each suite's own summary line rather than by one guessed format.

### Docs
- `CHANGELOG.md`: `[0.4.63]`'s queue item (1) **struck and marked actioned**, recording that the *"assert unconditionally"* half was already satisfied and that the guard's own predicate was the bigger find; **`[0.4.64]` appended at the bottom** with the placement note (train head deliberately still `0.4.28`).
- `tools/REGISTRY.md`: live `changelog_version` bullet **68 → 69** in the same run that appended, with the movement noted rather than a stale count carried; **new `## test_app_contrast_meta.php` section** (purpose, the five-string copy patching and the closed-port trick, `APP_CONTRAST_SUITE` hook, exit codes, dependencies, the 48-assertion breakdown, both mutation outcomes) — following the `## test_identity_wrapper.sh` precedent, since a suite whose whole point is how it is *run* is exactly what a registry is for; and §repo-lint's `**Status**` line corrected **37 suites / 2970 / 18 PHP = 958 → 39 / 3203 / 20 PHP = 1191**, disclosed as **two runs stale**: `[0.4.63]` had added `test_app_contrast.php` (+1 suite, +185) without touching it.
- **No new tool, no new gate, no new dashboard check** → `system-status`'s check count untouched.
> build · mimo-v2.6-flash-free
$ cd /data/repo; awk '/^## \[0.4.64\]/{f=1} f' CHANGELOG.md | grep -n 'queue\|Queued\|Next-candidate' | head; echo "=== REGISTRY changelog_version live bullet ==="; grep -n 'changelog_version.*69\|68 → 69\|entries 69' tools/REGISTRY.md | head
3:### Defect (the queue item `[0.4.63]` left behind, verbatim)
10:### What running it found — broader than queued
17:→ **exit 255, no `=== Results:` line, 1 of 4 documents reported**. A suite that aborts is strictly worse than one that omits: the consumer gets neither a verdict nor a count, and the exit code says "crashed" rather than "the document is broken". The queue described a *quiet* loss; the guard could also produce a *loud* one.
46:- **M2 — the guard weakened**: `if ($accentOk && $textOk)` back to `if ($accent !== '' && $text !== '')`. **Caught by 9 failures**, all in **F2** (exit 255, fatal, no Results, plus the counts), while **F1 stayed entirely green** — an absent token satisfies both guards identically, so F1 *cannot* distinguish them. That asymmetry is the whole argument for having built F2: a suite with only the queued fixture would have passed this mutation. **39 passed / 9 failed**.
57:- `CHANGELOG.md`: `[0.4.63]`'s queue item (1) **struck and marked actioned**, recording that the *"assert unconditionally"* half was already satisfied and that the guard's own predicate was the bigger find; **`[0.4.64]` appended at the bottom** with the placement note (train head deliberately still `0.4.28`).
=== REGISTRY changelog_version live bullet ===
1949:- Live: HEAD → exit 0 (174 files — **173 → 174 with `[0.4.64]`**, this run's own `tests/test_app_contrast_meta.php` going from untracked to tracked, and `linted.php` 31 → 32 with it; the pre-commit run reads 173/31 because the blob is not there yet — the stale-live-number class, re-read after the commit below — 45 module files compile clean in ~1.6s) with `changelog_version` = `attempted true, entries 69, unique 69, unparseable 0, duplicates [], ok true` (**68 → 69 with `[0.4.64]`**: the count is read from the COMMITTED blob, so it is re-read after the append commits rather than carried over — it read 68 while `[0.4.64]` was still uncommitted, which is the whole point of re-reading; the working-tree count was verified the anchored way, `grep -c '^## \['` → 69 with `uniq -d` empty, because the greedy `sed 's/.*\[\([^]]*\)\].*/\1/'` form reports **5 phantom duplicates** on this tree — 0.4.31/0.4.40/0.4.44/0.4.49/0.4.62 — by taking the last bracket in a heading that cites other versions. The **file** count is 173, not the 171 drafted mid-run: `[0.4.63]`'s own two mailbox files were untracked when that number was written and tracked once it committed, so 171 → 173 is this entry's own movement rather than a count carried); `--sha 219fd8f` → exit 1 naming `tests/test_mailbox_a11y.php:208 [php]`; `--sha 395b9b5` → exit 1 naming `.../status_test.go:5 [go-compile]`; unknown rev / non-repo → exit 3; `--sha probe-r9` → exit 3 with `requested_sha: probe-r9` (the R16 parity reference, live); `--format yaml` → exit 2 with **usage on stderr and an empty stdout** (no format could be read, so none is invented — `[0.4.62]`); **`--format json` + a bad argv → exit 2 with a 384-byte 15-key object on stdout and 0 bytes on stderr** (`--timeout abc`, `--nonsense`, `--timeout 0`, empty `--sha`, and the failing token placed *before* `--format`), while the same argv in human mode still gives argparse's `usage:`+`error:` with **stdout 0 bytes**; `--help` (**106 lines**, was 57 before the epilog stopped carrying its own prose, 102 before the exit-3 clause widened, 103 through `[0.4.61]`, **+3 for `[0.4.62]`'s widened exit-2 clause**) renders all seven docstring blocks verbatim under their labels; a copy with a heading renamed → `repo-lint: ERROR refusing to run - docstring section missing or empty …` + `  'env:' -> 'Environment:'` → **exit 3**, stderr only, and under `--format json` the **same refusal as an object** — `ok false`, `exit_code 3`, `error` naming the pair, **stderr 0 bytes** — which is the `| jq` consumer `[0.4.60]`'s queue described, now parsing (`--format=json` → 3; `--form json` → 3; `-- --format json` → no JSON on stdout; `--format yaml` on the broken copy → refusal only, no `usage:` leak) — **and on that same broken copy `--format json --timeout abc` now yields the 458-byte refusal object with `exit_code 3` instead of falling back to `human`**, which is `[0.4.61]`'s own queue item struck as actioned.
$ cd /data/repo; grep -n 'changelog_version' tools/REGISTRY.md | head -20; echo "=== live bullets ==="; grep -n '^\*\*Live\*\*\|^- Live\|^\*\*Status\*\*' tools/REGISTRY.md | head -30
1929:**JSON**: the top-level key set is pinned by the suite — `tool, timestamp, repo_root, requested_sha, sha_resolved, error, files_total, linted, skipped, failures, errors, go_compile, changelog_version, ok, exit_code` (`rc == exit_code`). `go_compile` = `{attempted, go_mod, files, ok, reason, summary, duration_s}` with `reason` ∈ `no_go_module | no_go_files | go_tool_failed` (null on success); `changelog_version` = `{attempted, path, entries, unique, unparseable, duplicates, ok, reason, summary}` with `reason` ∈ `no_changelog | changelog_unreadable` (null when the file was read), `duplicates` an ordered list of the repeated version tokens and `ok` `null` when nothing was checked; `die()` emits `go_compile: null` **and** `changelog_version: null` so both keys are always present. **`[0.4.61]` closed the one open exception**: the import-time epilog refusal used to emit nothing under `--format json` (stderr only, exit 3) — empty stdin for a `| jq` consumer — and now routes through `die()`, so **every** refusal and every cannot-verify path yields the same 15-key object with `ok false`. **`[0.4.62]` closed the last one**: a usage error was the sole remaining path with no object (`--format json --timeout abc` → exit 2, usage on stderr, **empty stdout**, so a consumer met *jq's* parse error instead of our diagnosis), and it now routes through `die()` too, with **`exit_code: 2`** — the number is what keeps "you typed a bad flag" distinct from "this could not be verified" (3), so a consumer never retries a typo. **Every `--format json` run now yields exactly one 15-key object**, whatever went wrong: verdict (0/1), refusal or environment failure (3), bad argv (2); suite S6 pins the key set of the usage object against a normal run's byte for byte. The format that decides the channel is read by **argparse** from a parser carrying *only* `--format` (`_format_of`), so the read survives the very `--timeout` that broke the parse — a full pre-parse would abort first and answer `human` whenever the failing token came first (S9). Where **no** format can be read at all — an invalid choice, a bare `--format`, anything after `--` — the channel stays human, asserted in S13–S15 rather than assumed; and `--help` still prints argparse's help on stdout with exit 0, a success path where `error()` is never called (queued as its own decision).
1940:- `bash tests/test_repo_lint.sh` → **291 assertions**, hermetic (throwaway git repos under `${TMPDIR:-/tmp}/opencode`, trap-cleaned): clean→0 with exact per-language/skip counts (`files_total = linted + skipped`), all five languages caught with path+line, the 219fd8f incident replayed **both directions** (bad worktree/clean commit → 0; clean worktree/bad commit → 1), arg/env exit contracts, exact JSON key set (now including `changelog_version`), symlink invocation (sandbox + real `/data/tools`), missing-binary→3 and hung-linter→3, read-only status proof on the live repo — plus **section R**, the epilog refusal and its machine-readable form, and **section S**, the usage error's.
1945:- **Section R — the epilog REFUSES to build a label over nothing** (`[0.4.60]`, widened by `[0.4.61]`): derivation made the epilog correct, but `docstring_section` still returned `""` for a heading it could not find and `"\n\n".join` does not complain about `""`, so a renamed or deleted docstring heading produced `env:` printed above a blank line with `--help` exiting **0** — and only Q-render's non-empty requirement stood in the way, i.e. a defect that was *tested* rather than *prevented*, covering only the heading someone named. **R1–R3** are guards on the healthy tool (exit 0, no refusal on stderr, all seven labels rendering a non-empty body); **R4–R9** cover a heading **renamed away** while the tuple still names it (refuse with exit 3; name the pair `'env:' -> 'Environment:'`; nothing on stdout; name **only** the broken pair), and R9 points `GLADEX_REPO_DIR` at the real sandbox repo for the same reason it always did — run from `$SB` the mutant's default repo is not a git repo and it exited 3 for *that* reason, a false pass the red had to be read to catch. **R10–R12b** cover a heading that **exists but whose block is empty** — `docstring_section` stops at the first blank line, so "found" must not mean "fine". **R9's original assertion was written inverted and is corrected in `[0.4.61]`**: it required *no* parseable JSON from the refusing tool — which is exactly the defect (`| jq` meeting empty stdin), so it passed for it. It now asserts the contract, and the block grew accordingly: **R9b** one object on stdout with `ok false`/`exit 3`; **R9c** it names the broken pair; **R9d** it is an ERROR not a verdict (`failures`/`errors` empty, `sha_resolved` null); **R9e** `go_compile`/`changelog_version` null (die()'s shape); **R9f** stderr clean in json mode; **R9g** its **key set is byte-equal to a normal run's** — the shape-level proof that the refusal is the contract and not an exception to it.
1949:- Live: HEAD → exit 0 (174 files — **173 → 174 with `[0.4.64]`**, this run's own `tests/test_app_contrast_meta.php` going from untracked to tracked, and `linted.php` 31 → 32 with it; the pre-commit run reads 173/31 because the blob is not there yet — the stale-live-number class, re-read after the commit below — 45 module files compile clean in ~1.6s) with `changelog_version` = `attempted true, entries 69, unique 69, unparseable 0, duplicates [], ok true` (**68 → 69 with `[0.4.64]`**: the count is read from the COMMITTED blob, so it is re-read after the append commits rather than carried over — it read 68 while `[0.4.64]` was still uncommitted, which is the whole point of re-reading; the working-tree count was verified the anchored way, `grep -c '^## \['` → 69 with `uniq -d` empty, because the greedy `sed 's/.*\[\([^]]*\)\].*/\1/'` form reports **5 phantom duplicates** on this tree — 0.4.31/0.4.40/0.4.44/0.4.49/0.4.62 — by taking the last bracket in a heading that cites other versions. The **file** count is 173, not the 171 drafted mid-run: `[0.4.63]`'s own two mailbox files were untracked when that number was written and tracked once it committed, so 171 → 173 is this entry's own movement rather than a count carried); `--sha 219fd8f` → exit 1 naming `tests/test_mailbox_a11y.php:208 [php]`; `--sha 395b9b5` → exit 1 naming `.../status_test.go:5 [go-compile]`; unknown rev / non-repo → exit 3; `--sha probe-r9` → exit 3 with `requested_sha: probe-r9` (the R16 parity reference, live); `--format yaml` → exit 2 with **usage on stderr and an empty stdout** (no format could be read, so none is invented — `[0.4.62]`); **`--format json` + a bad argv → exit 2 with a 384-byte 15-key object on stdout and 0 bytes on stderr** (`--timeout abc`, `--nonsense`, `--timeout 0`, empty `--sha`, and the failing token placed *before* `--format`), while the same argv in human mode still gives argparse's `usage:`+`error:` with **stdout 0 bytes**; `--help` (**106 lines**, was 57 before the epilog stopped carrying its own prose, 102 before the exit-3 clause widened, 103 through `[0.4.61]`, **+3 for `[0.4.62]`'s widened exit-2 clause**) renders all seven docstring blocks verbatim under their labels; a copy with a heading renamed → `repo-lint: ERROR refusing to run - docstring section missing or empty …` + `  'env:' -> 'Environment:'` → **exit 3**, stderr only, and under `--format json` the **same refusal as an object** — `ok false`, `exit_code 3`, `error` naming the pair, **stderr 0 bytes** — which is the `| jq` consumer `[0.4.60]`'s queue described, now parsing (`--format=json` → 3; `--form json` → 3; `-- --format json` → no JSON on stdout; `--format yaml` on the broken copy → refusal only, no `usage:` leak) — **and on that same broken copy `--format json --timeout abc` now yields the 458-byte refusal object with `exit_code 3` instead of falling back to `human`**, which is `[0.4.61]`'s own queue item struck as actioned.
=== live bullets ===
56:- Live: `domain-availability-check gladex.de` → exit 3 (taken); a free `.de` → exit 0; `--format human gladex.de` → `TAKEN` with all three sources listed.
104:- Live: `budget-show` → 0; `--format json` → balanced 5.00 − 1.50 = 3.50; `/api/budget` on :8000/:8001 → same numbers (PHP parses the ledger independently)
106:**Status**: Built ✅
164:- Live: `dns-verify gladex.de` → exit 0, `gladex.de BOGUSTYPE` → exit 2 (was 0 + fabricated record), `--server 203.0.113.1 --timeout 1` → exit 4 (was 3), `this-domain-should-be-available-12345.de` → exit 3 (no records), `--format human … NS` → human-readable NS records
166:**Status**: Built ✅ (exit-code/`--timeout`/type-validation contract hardened 2026-09-24)
167:**Status**: Built ✅
213:**Status**: Built ✅
657:- Live (2026-09-25, after this step): `promote-dev-to-prod --dry-run --force --format json` →
664:- Live: `promote-dev-to-prod --dry-run` → exit 5 while `reviewer-to-main/` is empty
669:- Live (2026-09-25, `[0.4.47]`): `promote-dev-to-prod --dry-run --force --format json`
678:**Status**: Built ✅ (verdict gate implemented 2026-09-24; promoted-tree set widened to
752:- Live: `ip-drift-check --format json --domain gladex.de` → exit 0, `drift:false` (tunnel up); `--help` → 0.
754:**Status**: Built ✅ (hardened 2026-09-24: validated answers + arg contract + first test suite)
813:**Status**: Built ✅
923:**Status**: Built ✅ (hardened 2026-09-24: CHECK-ERROR alerting + hooks + first behavioural suite)
964:**Status**: Built ✅
1631:**Status**: Built ✅ (2026-09-24: counts both DBs, `timeout 30` → `120`, + MX/SOA
1716:**Status**: Built ✅
1754:**Status**: Built ✅ (hardened 2026-09-24: exit-code collapse + undescribed rejects + 5-of-7 defaults fixed, first test suite added)
1791:- Live: `smtp-relay-probe` → exit 0; `:587` `:465` deny `554 5.7.1`, public path denies `454 4.7.1`, all four endpoints `banner_ok=true`; `--format human` → per-endpoint verdict + rcpt reply
1794:**Status**: Built ✅ (2026-09-24; closes the "live relay probe blocked by :25-greeting bug" follow-up — 220 banner verified answering on :25 via 40/40 probes + nc + strace, live relay probe exit 0)
1842:- Live: `source-sync-check` → `exit 0`, 42 files across dev+prod in sync (after the 2026-09-24 drift fix); same via `/data/tools` → `repo=/data/repo`, exit 0 (was exit 3)
1844:**Status**: Built ✅ (2026-09-24; first live run caught 16 drifted workflow files — see CHANGELOG 0.4.25)
1871:**Status**: Green ✅ 2026-09-24 (28/28 twice: clean run + concurrent-shift decoy run)
1896:**Status**: Green ✅ 2026-09-26 (48/48; pre-fix replay against the committed suite — md5 `b9d7dcd3c2aa159c33f5f7144cdbfb5a`, suite md5 `261ad2b7608334b20743bfa25b926bcb`, `/tmp/opencode/contrastfix/pre-fix-final.log` — → **33 passed / 15 failed**, and 33 + 15 = 48 closes exactly; mutations **M1** else dropped → caught by 10, **M2** guard weakened → caught by 9, all inside **F2** because **F1 cannot distinguish the two guards**)
1949:- Live: HEAD → exit 0 (174 files — **173 → 174 with `[0.4.64]`**, this run's own `tests/test_app_contrast_meta.php` going from untracked to tracked, and `linted.php` 31 → 32 with it; the pre-commit run reads 173/31 because the blob is not there yet — the stale-live-number class, re-read after the commit below — 45 module files compile clean in ~1.6s) with `changelog_version` = `attempted true, entries 69, unique 69, unparseable 0, duplicates [], ok true` (**68 → 69 with `[0.4.64]`**: the count is read from the COMMITTED blob, so it is re-read after the append commits rather than carried over — it read 68 while `[0.4.64]` was still uncommitted, which is the whole point of re-reading; the working-tree count was verified the anchored way, `grep -c '^## \['` → 69 with `uniq -d` empty, because the greedy `sed 's/.*\[\([^]]*\)\].*/\1/'` form reports **5 phantom duplicates** on this tree — 0.4.31/0.4.40/0.4.44/0.4.49/0.4.62 — by taking the last bracket in a heading that cites other versions. The **file** count is 173, not the 171 drafted mid-run: `[0.4.63]`'s own two mailbox files were untracked when that number was written and tracked once it committed, so 171 → 173 is this entry's own movement rather than a count carried); `--sha 219fd8f` → exit 1 naming `tests/test_mailbox_a11y.php:208 [php]`; `--sha 395b9b5` → exit 1 naming `.../status_test.go:5 [go-compile]`; unknown rev / non-repo → exit 3; `--sha probe-r9` → exit 3 with `requested_sha: probe-r9` (the R16 parity reference, live); `--format yaml` → exit 2 with **usage on stderr and an empty stdout** (no format could be read, so none is invented — `[0.4.62]`); **`--format json` + a bad argv → exit 2 with a 384-byte 15-key object on stdout and 0 bytes on stderr** (`--timeout abc`, `--nonsense`, `--timeout 0`, empty `--sha`, and the failing token placed *before* `--format`), while the same argv in human mode still gives argparse's `usage:`+`error:` with **stdout 0 bytes**; `--help` (**106 lines**, was 57 before the epilog stopped carrying its own prose, 102 before the exit-3 clause widened, 103 through `[0.4.61]`, **+3 for `[0.4.62]`'s widened exit-2 clause**) renders all seven docstring blocks verbatim under their labels; a copy with a heading renamed → `repo-lint: ERROR refusing to run - docstring section missing or empty …` + `  'env:' -> 'Environment:'` → **exit 3**, stderr only, and under `--format json` the **same refusal as an object** — `ok false`, `exit_code 3`, `error` naming the pair, **stderr 0 bytes** — which is the `| jq` consumer `[0.4.60]`'s queue described, now parsing (`--format=json` → 3; `--form json` → 3; `-- --format json` → no JSON on stdout; `--format yaml` on the broken copy → refusal only, no `usage:` leak) — **and on that same broken copy `--format json --timeout abc` now yields the 458-byte refusal object with `exit_code 3` instead of falling back to `human`**, which is `[0.4.61]`'s own queue item struck as actioned.
1952:**Status**: Green ✅ 2026-09-26 (291/291; full regression 39 suites, 3203 assertions, 0 failed — 19 shell = 2012, 20 PHP = 1191. Was 37 suites / 2970 / 18 PHP = 958 at `[0.4.62]`; **this line was two runs stale when `[0.4.64]` re-read it** — `[0.4.63]` added `test_app_contrast.php` (+1 suite, +185) and did not update it, and `[0.4.64]` adds `test_app_contrast_meta.php` (+1 suite, +48), so 958 + 185 + 48 = 1191 and 2970 + 185 + 48 = 3203)
> build · mimo-v2.6-flash-free
Now the docs. Checking the CHANGELOG tail convention first:
$ cd /data/repo; tail -8 CHANGELOG.md; echo "=== count ==="; grep -c '^## \[' CHANGELOG.md; echo "=== phantom dupes (greedy sed) ==="; sed 's/.*\[\([^]]*\)\].*/\1/' <(grep '^## \[' CHANGELOG.md) | sort | uniq -d; echo "=== anchored ==="; grep '^## \[' CHANGELOG.md | sed 's/^## \[\([^]]*\)\].*/\1/' | sort | uniq -d; echo "(empty above = no real dupes)"; echo "=== head ==="; grep -n '^## \[' CHANGELOG.md | head -2
- **New, from this step**: this repo still has **no committed regression runner** — the counts in every entry depend on a throwaway parser, and this run's first parser mis-parsed **16 of 39 suites** (four summary shapes) while showing `0 failed`. Make it a tool with a `--help` and a REGISTRY entry, so "39 suites, 3203 assertions" is produced by something versioned.
- **Carried from `[0.4.54]` (2)**: `ship-tree` names the first offending path but not *why* it is there.
- **Carried from `[0.4.54]` (3)**: `--ignored` may need a pathspec exclude if `app/src/php` gains a large ignored build dir.
- **Carried from `[0.4.54]` (4)**: the `promote-gates` age re-ages on every run (needs a refusal moment no field carries).
- **Carried (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME**.

### Placement (deliberate — same as `[0.4.29]`–`[0.4.63]` which sit immediately above this one)
Parked at the bottom of an otherwise newest-first file on purpose: promoting it to the top would make it the version-train head while `GLADEX_APP_VERSION` and all four `gladex` binaries still report `0.4.28`, turning `tests/test_app_version` and `tests/test_cli_version` red until CI bumps the train. That bump is main-loop work and is not part of this fix.
=== count ===
69
=== phantom dupes (greedy sed) ===
0.4.31
0.4.40
0.4.44
0.4.49
0.4.62
=== anchored ===
(empty above = no real dupes)
=== head ===
7:## [0.4.28] - 2026-09-24 — Go CLI joins the single version train: build.sh derives its version from this changelog (was a hardcoded 0.2.0), download badge + docs CLI mentions follow, all four binaries rebuilt
21:## [0.4.27] - 2026-09-24 — version drift closed: nine stale `0.3.0` literals across app+docs collapse into one `GLADEX_APP_VERSION` constant sourced from this changelog
> build · mimo-v2.6-flash-free
`[0.4.64]`'s queue item (1) is exactly what this run closed. Striking it, then appending `[0.4.65]`:
← Edit repo/CHANGELOG.md
Index: repo/CHANGELOG.md
===================================================================
--- repo/CHANGELOG.md
+++ repo/CHANGELOG.md
@@ -1859,9 +1859,9 @@
 
 ### Queue (next-candidate, not actioned)
 - **Carried from `[0.4.63]` (2)**: `--format json --help` prints **human** help on stdout and exits **0**, so a json consumer asking for help gets prose *with a success code* — deserves a decision rather than an assumption.
 - **Carried from `[0.4.63]` (3)**: `tests/test_repo_lint.sh`'s header mutation index is a second copy of the mutation list and will drift again; derive it or drop it.
-- **New, from this step**: this repo still has **no committed regression runner** — the counts in every entry depend on a throwaway parser, and this run's first parser mis-parsed **16 of 39 suites** (four summary shapes) while showing `0 failed`. Make it a tool with a `--help` and a REGISTRY entry, so "39 suites, 3203 assertions" is produced by something versioned.
+- ~~**New, from this step**: this repo still has **no committed regression runner** — the counts in every entry depend on a throwaway parser, and this run's first parser mis-parsed **16 of 39 suites** (four summary shapes) while showing `0 failed`. Make it a tool with a `--help` and a REGISTRY entry, so "39 suites, 3203 assertions" is produced by something versioned.~~ **ACTIONED in `[0.4.65]`** — `tools/regression-run` + `tests/test_regression_run.sh`, registered, 6 mutations.
 - **Carried from `[0.4.54]` (2)**: `ship-tree` names the first offending path but not *why* it is there.
 - **Carried from `[0.4.54]` (3)**: `--ignored` may need a pathspec exclude if `app/src/php` gains a large ignored build dir.
 - **Carried from `[0.4.54]` (4)**: the `promote-gates` age re-ages on every run (needs a refusal moment no field carries).
 - **Carried (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME**.

> build · mimo-v2.6-flash-free
$ cat >> /data/repo/CHANGELOG.md <<'ENTRY'

## [0.4.65] - 2026-09-26 — the regression total was produced by an uncommitted parser that guessed ONE summary format and reported `1854 passed / 0 failed` while listing 16 of 39 suites (twelve of them rc=0) as no-summary failures: `tools/regression-run` commits that parser, reads numbers rather than a format, and refuses to count an unparseable suite as green; suite 0 → 110, total 39/3203 → 40/3313

### Defect (the queue item `[0.4.64]` left behind, verbatim)
> "this repo still has **no committed regression runner** — the counts in every entry depend on a throwaway parser, and this run's first parser mis-parsed **16 of 39 suites** (four summary shapes) while showing `0 failed`. Make it a tool with a `--help` and a REGISTRY entry, so '39 suites, 3203 assertions' is produced by something versioned."

The number every entry quotes was never produced by anything in the repo. It was written by whatever ad-hoc parser the reporting run happened to throw together, so the totals were unverifiable in the specific sense that no two runs had to agree — and the one that went wrong was wrong in the *safe* direction (`1854 / 0 failed` reads green), which is the direction nobody re-checks.

### What building it found in the tree
The four shapes are real and all four are live today: `=== Results: 185 passed, 0 failed, 0 skipped ===` (29), `repo-lint suite: 291 passed, 0 failed` (6), `Results: 19 passed, 0 failed` (2), and the bare `11 passed, 0 failed` (2). But "parse each suite's last *line*" — the obvious reading — is wrong: **seven suites print trailing noise after their summary**, six a `====` banner and `test_pdns_api.sh` a shell `Killed` message. So the rule is the last **match**, and matches are then ranked: a hit on an assertion line (`PASS:`/`FAIL:`/`SKIP:`/`ok`/`-`/`*`) loses to a hit on any other line, so a PASS line quoting numbers cannot steal the verdict. Both halves are pinned, because the first is wrong on 7 of 39 suites and the second would be wrong the day a suite logs a big number after its own summary.

Measured, not assumed: across all 39 suites there is currently **exactly one match per file**, so today the tie-break never fires — recorded as such rather than presented as a finding.

### Choice made, not asked — silence is exit 4, and the exit codes are precedence-ordered
1. **A suite with no summary contributes nothing** and is `no_summary` → exit **4**. It is not `0 failed` and it is not a small number: the whole defect was a parser that reported green while unable to read a third of the tree.
2. **Verdicts are separated from the environment.** A suite that *reports* failures and exits 1 is `failed` (exit 1); a suite that reports none and exits non-zero is `crashed` (exit **3**), because its verdict cannot be trusted. Timeout (3) and an unknown extension (3) sit on the same side: "could not be verified" is never a pass and never a failure on files we did not read. Precedence `2 > 3 > 4 > 1 > 0`, with every suite's row printed regardless of which code wins.
3. **Sequential on purpose, no `--jobs`.** Several suites take locks, ports and git state (`test_php_busy_timeout` holds a SQLite handle; the promote suites touch the envs). Trading a reproducible total for a flaky one is the wrong trade for the tool whose whole job is reproducibility.
4. **The epilog has no prose of its own** — all four sections are `docstring_section()`-derived from the module docstring, following `repo-lint`, so `--help` and the docstring cannot drift; a missing or empty heading **refuses** (exit 3, naming the pair) rather than printing a label over nothing. One defect this run hit live: the `Summary parsing (…)` heading was written without its trailing colon while `EPILOG_PAIRS` carried one, and the refusal caught it on the first `--help`.
5. **One JSON key set, 13 keys, every path** — verdict, usage error and refusal — enforced by `emit_json`, which raises rather than printing a drifted shape.

### Live reproduction (the tool's own proof)
Against the tree *before* this change: **39 suites, 3203 passed, 0 failed, 0 skipped**, exit 0 — the independently derived `[0.4.64]` figure, reproduced by a committed tool rather than re-derived by hand, with the shape histogram `bare=2, fence=29, results=2, suite=6`. After adding this suite: **40 suites, 3313 passed, 0 failed**, and the movement closes exactly — 3203 + 110 = 3313, `fence` 29 → 30, no other suite moved. Wall time 4m24s.

### Six first-draft defects of my own, caught by running it
Recorded rather than quietly corrected:
1. **`format_of` leaked argparse's `usage:` + `error:` to stderr** for an unreadable `--format` — the exact leak `repo-lint`'s S section pinned. Now `redirect_stderr`-swallowed; stderr is one diagnosis line (E10–E12).
2. **The suite passed help *text* where `help_section` wanted a file**, so `awk` opened a paragraph as a filename and every A5 byte-comparison silently compared against nothing — a green-looking check that measured nothing. Now reads stdin.
3. **`jget` used `print(d)`**, so a dict field came back as Python's `{'fence': 1}` and a bool as `True` — not JSON. Now `str` raw, everything else `json.dumps`, so booleans read `true`/`false` (C9/C11/C12/D5/D8 assert the JSON spelling).
4. **The recursion guard was self-matching**: its own needle text sat in the assertion line it was scanning, so it could only ever fail. Replaced by extraction *by function* (`helper_line`) — the guard can no longer see itself.
5. **The G section was path-dependent**: `default_repo()` resolves relative to the script, so every mutant copied to `/tmp` reported `repo=/tmp/opencode`, found no suites and exited 5 — four reds per mutation that were **harness artifacts, not catches**. Fixed with `GLADEX_REPO_DIR` for the behavioral checks, while the path resolution itself is pinned separately (G6, shipped-binary only).
6. **The mutation driver's precondition used `grep -F` on a multi-line needle**, which `grep -F` splits into one pattern per line — it reported 3 occurrences of a genuinely unique needle and declared m3 unplantable. Counted in python instead.

Also hardened at the source: a status carrying no summary must not deposit a `None` key into `shapes`, because `sorted(shapes.items())` in the human report would raise on it.

### Mutations (6, each on a copy under `/tmp` — `tools/regression-run` md5 `1d8a556fdd762d7e5c55f0c1f8e36da9` identical before and after)
- **M1** `no_summary` removed from the exit precedence → caught by **2** (B9 `silent -> 4 (want=4 got=0)`, B23 precedence `want=4 got=1`).
- **M2** the tie-break defeated (`preferred = list(matches)`) → caught by **4** (C1 `want=12 got=999`, C2, C4, C5).
- **M3** a `no_summary` suite counted in `totals.suites_run` → caught by **2** (B12b `want=0 got=1`, B26 `want=4 got=5`). This is the original harm, one level down in the totals instead of the exit code.
- **M4** crash detection defeated (`elif rec["rc"] != 0:` → `elif False:`) → caught by **3** (B14, B15, B16).
- **M5** the epilog refusal defeated → caught by **6** (F1–F6, including `--help` producing 2270 bytes where 0 were allowed).
- **M6** the pre-parser's stderr suppression dropped → caught by **2** (E10, E11 `want=1 got=3`).

Each mutant's reds are **confined to its own section** — the M-fix above is what made that true; before it, every mutant also lit up G1–G4 for path reasons. `m3`'s needle was first declared UNPLANTABLE by its own precondition (the same condition text appears in the human-report formatter); the needle was widened to two lines rather than the precondition relaxed.

### Test suite
New **`tests/test_regression_run.sh` → 110 assertions**, hermetic (throwaway fixtures under `/tmp/opencode/trr.*`, trap-cleaned): the `--help`/docstring byte-comparison for all four sections, the full exit-code contract (`0/1/2/3/4/5`) with precedence, all four parsing rules, the 13-key JSON contract including the usage-error and refusal objects, the flag contract (including "stderr is exactly one line"), the epilog refusal in both channels, live read-only proof, and the recursion guard. Test hook `REGRESSION_RUN_BIN` points the suite at a mutant copy.

### Docs
- `tools/REGISTRY.md`: **new `## regression-run` and `## test_regression_run.sh` sections**; §repo-lint `**Status**` line moved **39 / 3203 / 19 shell = 2012 → 40 / 3313 / 20 shell = 2122** (20 PHP = 1191 unchanged); Live bullet's `files_total` **174 → 176** and `changelog_version` **69 → 70**, both written as *pre-commit predictions* and re-read after the commit rather than carried.
- `CHANGELOG.md`: `[0.4.64]`'s queue item (1) struck and marked actioned; **`[0.4.65]` appended at the bottom** with the placement note (train head deliberately still `0.4.28`).
- **No new gate, no new dashboard check** → `system-status`'s check count untouched.

### Live (no restart, no deploy, no promote)
`./tools/regression-run` → **40 suites, 3313 passed, 0 failed, 0 skipped**, exit 0. `tools/repo-lint` → exit 0, `files_total 174`, `linted {bash 24, go 43, json 11, php 32, python 11}`, `changelog_version entries 69, unique 69, duplicates []` (all pre-commit). `tools/source-sync-check` → in sync, 42 files, exit 0. `tools/system-status --format human` → **ALL SYSTEMS HEALTHY**.

### Queue (next candidates, not actioned)
- **New, from this step**: `regression-run` has no `--jobs` **by design**, so a full run costs ~4m24s wall; if that ever becomes a problem, the constraint to solve is *which* suites may run concurrently, not a flag.
- **Carried from `[0.4.64]` (2)**: `--format json --help` prints human help on stdout and exits 0.
- **Carried from `[0.4.64]` (3)**: `tests/test_repo_lint.sh`'s header mutation index is a second copy of the mutation list and will drift again.
- **Carried from `[0.4.54]` (2)**: `ship-tree` names the first offending path but not *why* it is there.
- **Carried from `[0.4.54]` (3)**: `--ignored` may need a pathspec exclude if `app/src/php` gains a large ignored build dir.
- **Carried from `[0.4.54]` (4)**: the `promote-gates` age re-ages on every run.
- **Carried (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME**.

### Placement (deliberate — same as `[0.4.29]`–`[0.4.64]` which sit immediately above this one)
Parked at the bottom of an otherwise newest-first file on purpose: promoting it to the top would make it the version-train head while `GLADEX_APP_VERSION` and all four `gladex` binaries still report `0.4.28`, turning `tests/test_app_version` and `tests/test_cli_version` red until CI bumps the train. That bump is main-loop work and is not part of this fix.
ENTRY
echo "appended; count now: $(grep -c '^## \[' /data/repo/CHANGELOG.md)"; grep '^## \[' /data/repo/CHANGELOG.md | sed 's/^## \[\([^]]*\)\].*/\1/' | sort | uniq -d; echo "(no dupes above)"
appended; count now: 70
(no dupes above)
> build · mimo-v2.6-flash-free

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Sat Sep 26 04:02:09 2026] 127.0.0.1:56618 Accepted
[Sat Sep 26 04:02:09 2026] 127.0.0.1:56618 Closing
[Sat Sep 26 04:02:09 2026] 127.0.0.1:56626 Accepted
[Sat Sep 26 04:02:09 2026] 127.0.0.1:56626 Closing
[Sat Sep 26 04:02:45 2026] 127.0.0.1:43494 Accepted
[Sat Sep 26 04:02:45 2026] 127.0.0.1:43494 Closing
[Sat Sep 26 04:02:45 2026] 127.0.0.1:43510 Accepted
[Sat Sep 26 04:02:45 2026] 127.0.0.1:43510 Closing
[Sat Sep 26 04:02:45 2026] 127.0.0.1:43514 Accepted
[Sat Sep 26 04:02:45 2026] 127.0.0.1:43514 Closing
[Sat Sep 26 04:02:45 2026] 127.0.0.1:43524 Accepted
[Sat Sep 26 04:02:45 2026] 127.0.0.1:43524 Closing
[Sat Sep 26 04:03:01 2026] 127.0.0.1:48392 Accepted
[Sat Sep 26 04:03:01 2026] 127.0.0.1:48392 Closing
[Sat Sep 26 04:03:01 2026] 127.0.0.1:48408 Accepted
[Sat Sep 26 04:03:01 2026] 127.0.0.1:48408 Closing
[Sat Sep 26 04:03:01 2026] 127.0.0.1:48416 Accepted
[Sat Sep 26 04:03:01 2026] 127.0.0.1:48416 Closing
[Sat Sep 26 04:03:01 2026] 127.0.0.1:48426 Accepted
[Sat Sep 26 04:03:01 2026] 127.0.0.1:48426 Closing
[Sat Sep 26 04:03:01 2026] 127.0.0.1:48432 Accepted
[Sat Sep 26 04:03:01 2026] 127.0.0.1:48432 Closing
[Sat Sep 26 04:03:17 2026] 127.0.0.1:49240 Accepted
[Sat Sep 26 04:03:17 2026] 127.0.0.1:49240 Closing
[Sat Sep 26 04:03:17 2026] 127.0.0.1:49252 Accepted
[Sat Sep 26 04:03:17 2026] 127.0.0.1:49252 Closing
[Sat Sep 26 04:03:17 2026] 127.0.0.1:49256 Accepted
[Sat Sep 26 04:03:17 2026] 127.0.0.1:49256 Closing
[Sat Sep 26 04:03:17 2026] 127.0.0.1:49272 Accepted
[Sat Sep 26 04:03:17 2026] 127.0.0.1:49272 Closing
[Sat Sep 26 04:03:17 2026] 127.0.0.1:49288 Accepted
[Sat Sep 26 04:03:17 2026] 127.0.0.1:49288 Closing
[Sat Sep 26 04:03:17 2026] 127.0.0.1:49304 Accepted
[Sat Sep 26 04:03:17 2026] 127.0.0.1:49304 Closing
[Sat Sep 26 04:03:17 2026] 127.0.0.1:49318 Accepted
[Sat Sep 26 04:03:17 2026] 127.0.0.1:49318 Closing
[Sat Sep 26 04:03:17 2026] 127.0.0.1:49320 Accepted
[Sat Sep 26 04:03:18 2026] 127.0.0.1:49320 Closing
[Sat Sep 26 04:03:18 2026] 127.0.0.1:49336 Accepted
[Sat Sep 26 04:03:18 2026] 127.0.0.1:49336 Closing
[Sat Sep 26 04:03:18 2026] 127.0.0.1:49342 Accepted
[Sat Sep 26 04:03:18 2026] 127.0.0.1:49342 Closing
[Sat Sep 26 04:03:18 2026] 127.0.0.1:49354 Accepted
[Sat Sep 26 04:03:18 2026] 127.0.0.1:49354 Closing
[Sat Sep 26 04:03:18 2026] 127.0.0.1:49368 Accepted
[Sat Sep 26 04:03:18 2026] 127.0.0.1:49368 Closing
[Sat Sep 26 04:03:18 2026] 127.0.0.1:49376 Accepted
[Sat Sep 26 04:03:18 2026] 127.0.0.1:49376 Closing
[Sat Sep 26 04:03:18 2026] 127.0.0.1:49392 Accepted
[Sat Sep 26 04:03:18 2026] 127.0.0.1:49392 Closing
[Sat Sep 26 04:03:18 2026] 127.0.0.1:49404 Accepted
[Sat Sep 26 04:03:18 2026] 127.0.0.1:49404 Closing
[Sat Sep 26 04:05:38 2026] 127.0.0.1:51472 Accepted
[Sat Sep 26 04:05:38 2026] 127.0.0.1:51472 Closing
[Sat Sep 26 04:05:43 2026] 127.0.0.1:51484 Accepted
[Sat Sep 26 04:05:43 2026] 127.0.0.1:51484 Closing
[Sat Sep 26 04:07:05 2026] 127.0.0.1:47664 Accepted
[Sat Sep 26 04:07:05 2026] 127.0.0.1:47664 Closing
[Sat Sep 26 04:09:37 2026] 127.0.0.1:35548 Accepted