Gladex Agent Logs

Index: repo/tools/REGISTRY.md
===================================================================
--- repo/tools/REGISTRY.md
+++ repo/tools/REGISTRY.md
@@ -2346,9 +2346,9 @@
 - **Section Q — EVERY epilog section derived, not copied** (`[0.4.59]`): Q applies P's two checks to the six remaining docstring/epilog pairs (`languages`, `go compile gate`, `changelog version gate`, `reads GIT BLOBS`, `env`, `examples`). **Q-render** (Q1–Q6) runs `--help` and compares each labelled section to its docstring block **byte for byte**, requiring the docstring side to be non-empty (a heading that no longer exists in the docstring cannot pass by rendering nothing); **Q-source** (Q7–Q12) counts each section's distinctive text in the tool source and requires **exactly one** — the check that sees a copy `--help` never renders. **Q13** requires the hand-written `Usage:` synopsis to be *gone* (needle `[--sha SHA] [--format human|json]`, count 0): argparse generates the synopsis from the argument definitions, and the docstring's copy had already drifted from it (no `-h`, `human|json` vs `{human,json}`), so the fifth pair the queue named was closed by deletion rather than by keeping two things in step. Guards: `--help` exits 0 and its `usage:` line is argparse's own.
 - **Section R — the epilog REFUSES to build a label over nothing** (`[0.4.60]`, widened by `[0.4.61]`): derivation made the epilog correct, but `docstring_section` still returned `""` for a heading it could not find and `"\n\n".join` does not complain about `""`, so a renamed or deleted docstring heading produced `env:` printed above a blank line with `--help` exiting **0** — and only Q-render's non-empty requirement stood in the way, i.e. a defect that was *tested* rather than *prevented*, covering only the heading someone named. **R1–R3** are guards on the healthy tool (exit 0, no refusal on stderr, all seven labels rendering a non-empty body); **R4–R9** cover a heading **renamed away** while the tuple still names it (refuse with exit 3; name the pair `'env:' -> 'Environment:'`; nothing on stdout; name **only** the broken pair), and R9 points `GLADEX_REPO_DIR` at the real sandbox repo for the same reason it always did — run from `$SB` the mutant's default repo is not a git repo and it exited 3 for *that* reason, a false pass the red had to be read to catch. **R10–R12b** cover a heading that **exists but whose block is empty** — `docstring_section` stops at the first blank line, so "found" must not mean "fine". **R9's original assertion was written inverted and is corrected in `[0.4.61]`**: it required *no* parseable JSON from the refusing tool — which is exactly the defect (`| jq` meeting empty stdin), so it passed for it. It now asserts the contract, and the block grew accordingly: **R9b** one object on stdout with `ok false`/`exit 3`; **R9c** it names the broken pair; **R9d** it is an ERROR not a verdict (`failures`/`errors` empty, `sha_resolved` null); **R9e** `go_compile`/`changelog_version` null (die()'s shape); **R9f** stderr clean in json mode; **R9g** its **key set is byte-equal to a normal run's** — the shape-level proof that the refusal is the contract and not an exception to it.
 - **Section R, argv parity — the refusal's reading of argv must BE argparse's** (`[0.4.61]`): it fires before argparse exists, so it reads argv with a throwaway parser built from the **same `_add_flags`** definitions; each assertion below is the first place a hand-rolled `sys.argv` scan would diverge. **R13** one definition, two call sites (source count); **R14/R14b** the `--format=json` equals form; **R15/R15b** argparse's unique-prefix rule (`--form json`) with **R15c** as the guard that argparse really does accept it; **R16/R16b** `--sha probe-r9` echoed by the refusal with **R16c/R16d** as the parity reference — the *healthy* tool must report the same `requested_sha`, one expectation read by two code paths; **R17/R17b/R17c** `--` termination (the scan stops there and emits no JSON, while argparse itself rejects the same argv with exit 2); **R18/R18b/R18c/R18d** an argv argparse rejects (refusal still fires, still names the pair, no `usage:` noise leaked, stdout still empty in human mode) with **R19** as the guard that argparse keeps ownership of validation (invalid choice alone → exit 2). **R17b, R18c and R18d are vacuously green before the fix** — with no scan in existence nothing could print or leak — and they only begin testing something once it exists; disclosed as guards, not findings. **Guards that passed against the pre-fix tool and thereby identify themselves**: R1–R8, R10–R12b, the exit-3 half of R9/R14/R15/R16, R15c, R16c/R16d, R17, R17c, R18, R18b, R19.
 - **Section S — a usage error under `--format json` is still ONE JSON object** (`[0.4.62]`): `repo-lint --format json --timeout abc` used to exit 2 with usage prose on stderr and an **empty stdout**, so a `| jq` consumer got jq's own parse error and could not tell a mistyped flag from a crash — the last path with no object after `[0.4.61]`, and reachable on a perfectly healthy tool. **S1 is the human guard** (usage on stderr, empty stdout, exit 2 — passes before *and* after, which is what makes it a guard rather than a finding, and what M16 leaves green while S3 goes red); **S2–S8** the defect itself (exit 2 preserved; stdout non-empty; one object with `ok false`/`exit_code 2`; `error` names the bad argument; **key set byte-equal to a normal run's** — the shape-level proof that the usage object *is* the contract; not a verdict — `failures[]`/`errors[]` empty, `sha_resolved` null; stderr clean); **S9–S11** argv forms a hand-rolled scan gets wrong — the failing token **before** `--format` (a full pre-parse aborts first and would answer `human`), `--format=json`, `--form json`; **S12** the tool's own `p.error()` checks take the same route as argparse's rejections (both are inside one `try`); **S13–S15** the three argv shapes where **no** format can be read (`--format yaml`, a bare `--format`, anything after `--`) → human, asserted not assumed; **S16/S16b** exactly one `add_argument("--format", …)` and two readers of it (`_add_format_flag` feeds `_add_flags` and `_format_of` — splitting the flag out must not become a second choices list); **S17/S18** guards that a healthy json run still exits 0 and `--help` still exits 0. The section captures **stdout and stderr separately** throughout (`run_tool` merges them) because *which stream* is half of what it asserts, which is why it also needed `assert_empty`/`assert_nonempty`: `assert_not_contains` takes its needle as argument 2, so an empty needle matches every haystack and "this stream is empty" could not be expressed without failing by construction.
-- **Mutation**: 16, each precondition-asserted to occur exactly once, caught by a divergence assertion, and surgically checked — M1 exit gate defeated (`(1 if failures else 0)` → 0); M2 `--sha` ignored (always lints HEAD); M3 `.php` dropped from `EXT_LANG` (mutant still catches broken sh); **M4** `failures.extend(gentries)` → `extend([])` (the 395b9b5 defect returns: a build-breaking commit reports 0; mutant still 0 on a compiling commit); **M5** `3 if errors` → `1 if errors` (an environment failure reads as "broken file": real=3/mutant=1; mutant still 1 on broken php); **M6** the gate's blob read → `open(<worktree path>)` (the 219fd8f class applied to Go: a fixed worktree hides a broken commit; mutant still 1 when the worktree is broken too); **M7** `failures.extend(cl_failures)` → `extend([])` (the hand-off dies while the JSON still names the twin — `ok false`, `duplicates == ['1.0.0']`, `exit_code 0`; mutant still exits 1 on broken php); **M8** `if ver in first_seen:` → `if False:` (the test itself dies: `duplicates == []` and `ok true` where the real tool reports a twin; mutant still green on a clean changelog); **M9** the changelog blob read pinned to `HEAD` instead of `--sha` while the existence probe still uses `--sha` (an ancestor's twin vanishes — real=1/mutant=0; mutant still 0 on a clean HEAD); **M10** the CHANGELOG rule dropped from the tool's one contract (the `[0.4.56]` defect itself planted) — caught by P2/P5 while **P1 and P4 stay green**: the docstring and `--help` still agree because they are one copy, so they lost the rule *together*; surgical checks are the agreement holding, the parse rule surviving, and `--help` still exiting 0; **M11** a second copy of the contract planted as a source comment `--help` never renders — caught by **P1 alone**, with P4 deliberately asserted **green** (what `--help` prints is still byte-identical to the docstring), proving the source-level count is not redundant with the render-level check; **M12** the same shape for a *derived* section (a source-comment second copy of the go-gate text) — caught by **Q-source**, with **Q-render asserted green** on the mutant (`--help` still equals the docstring, so the byte comparison provably cannot see it) and `--help` still exiting 0; **M13** the inverse — `("env:", "Environment:")` repointed to the languages heading, so `env:` renders a different docstring block — caught by **Q-render**, with **Q-source asserted green** (the Environment text still occurs exactly once, so the count cannot see a misattribution) and the `exit codes:` pair still agreeing (one pair misattributed, not the whole epilog). M12/M13 are complementary by construction, exactly as M10/M11 are: each one's green assertions are what prove the other's necessity; **M14** the pre-`[0.4.60]` state reproduced — R's trigger (the docstring heading renamed to `Environment (renamed):` while the tuple still says `Environment:`) **in the same copy as** the refusal's condition defeated (`if missing:` → `if False:`). Two edits deliberately: defeating the guard **alone** changes nothing, because a healthy docstring still yields seven full sections — I built it that way first and the mutant came out **green**, which is the finding rather than a flaw in the mutation: the guard is not the defect, it is what makes an always-available trigger loud. With both halves present `--help` exits 0 over a label printed on nothing, stderr silent — caught by R's refusal assertions and by `r_labels` (R3's own check, run against the mutant) going red at **exactly** `env:` — while an unrelated section still byte-equals its docstring (surgical: one condition defeated, not the derivation); **M15** the machine channel dropped (`[0.4.61]`): R's trigger **in the same copy as** the fix reverted (`raise SystemExit(die(None, default_repo(), message, sha, fmt))` → the bare `sys.stderr.write(message)` + `SystemExit(EXIT_CANNOT)`), i.e. the refusal output as it stood before this step. Two edits for the same reason M14 needs two — with a healthy docstring nothing refuses, so the dropped channel is unobservable (I planted the revert alone first and the mutant came out green, **exit 0**: the second time this mutation taught its own lesson) — and the catch is the point: **every human assertion stays GREEN** (exit still 3, pair still named, `--help` still refusing with an empty stdout) while **R9b** sees the empty stdout. The old suite asserted the *absence* of JSON, so the defect passed it. **M16** the usage-error channel dropped (`[0.4.62]`): `if fmt == "json":` → `if False:` in `_Parser.error`, i.e. the pre-step state exactly — argparse always prints usage to stderr and exits 2, so `--format json --timeout abc` gives a jq pipeline empty stdin again. **One edit where M14 and M15 each needed two, and the difference is the finding**: those needed a *trigger* because a healthy docstring never refuses, whereas here the argv that says json is supplied **by the test**, so the trigger and the defect are the same line. Caught by **S3** (stdout empty again) with **every human assertion staying GREEN** — exit still 2, usage still on stderr, `--help` still 0, the healthy json run still 0 — because the human path never had the check; that asymmetry is the argument for having written S1/S13/S14/S15 as guards.
+- **Mutation**: 19, each precondition-asserted to occur exactly once, caught by a divergence assertion, and surgically checked — M1 exit gate defeated (`(1 if failures else 0)` → 0); M2 `--sha` ignored (always lints HEAD); M3 `.php` dropped from `EXT_LANG` (mutant still catches broken sh); **M4** `failures.extend(gentries)` → `extend([])` (the 395b9b5 defect returns: a build-breaking commit reports 0; mutant still 0 on a compiling commit); **M5** `3 if errors` → `1 if errors` (an environment failure reads as "broken file": real=3/mutant=1; mutant still 1 on broken php); **M6** the gate's blob read → `open(<worktree path>)` (the 219fd8f class applied to Go: a fixed worktree hides a broken commit; mutant still 1 when the worktree is broken too); **M7** `failures.extend(cl_failures)` → `extend([])` (the hand-off dies while the JSON still names the twin — `ok false`, `duplicates == ['1.0.0']`, `exit_code 0`; mutant still exits 1 on broken php); **M8** `if ver in first_seen:` → `if False:` (the test itself dies: `duplicates == []` and `ok true` where the real tool reports a twin; mutant still green on a clean changelog); **M9** the changelog blob read pinned to `HEAD` instead of `--sha` while the existence probe still uses `--sha` (an ancestor's twin vanishes — real=1/mutant=0; mutant still 0 on a clean HEAD); **M10** the CHANGELOG rule dropped from the tool's one contract (the `[0.4.56]` defect itself planted) — caught by P2/P5 while **P1 and P4 stay green**: the docstring and `--help` still agree because they are one copy, so they lost the rule *together*; surgical checks are the agreement holding, the parse rule surviving, and `--help` still exiting 0; **M11** a second copy of the contract planted as a source comment `--help` never renders — caught by **P1 alone**, with P4 deliberately asserted **green** (what `--help` prints is still byte-identical to the docstring), proving the source-level count is not redundant with the render-level check; **M12** the same shape for a *derived* section (a source-comment second copy of the go-gate text) — caught by **Q-source**, with **Q-render asserted green** on the mutant (`--help` still equals the docstring, so the byte comparison provably cannot see it) and `--help` still exiting 0; **M13** the inverse — `("env:", "Environment:")` repointed to the languages heading, so `env:` renders a different docstring block — caught by **Q-render**, with **Q-source asserted green** (the Environment text still occurs exactly once, so the count cannot see a misattribution) and the `exit codes:` pair still agreeing (one pair misattributed, not the whole epilog). M12/M13 are complementary by construction, exactly as M10/M11 are: each one's green assertions are what prove the other's necessity; **M14** the pre-`[0.4.60]` state reproduced — R's trigger (the docstring heading renamed to `Environment (renamed):` while the tuple still says `Environment:`) **in the same copy as** the refusal's condition defeated (`if missing:` → `if False:`). Two edits deliberately: defeating the guard **alone** changes nothing, because a healthy docstring still yields seven full sections — I built it that way first and the mutant came out **green**, which is the finding rather than a flaw in the mutation: the guard is not the defect, it is what makes an always-available trigger loud. With both halves present `--help` exits 0 over a label printed on nothing, stderr silent — caught by R's refusal assertions and by `r_labels` (R3's own check, run against the mutant) going red at **exactly** `env:` — while an unrelated section still byte-equals its docstring (surgical: one condition defeated, not the derivation); **M15** the machine channel dropped (`[0.4.61]`): R's trigger **in the same copy as** the fix reverted (`raise SystemExit(die(None, default_repo(), message, sha, fmt))` → the bare `sys.stderr.write(message)` + `SystemExit(EXIT_CANNOT)`), i.e. the refusal output as it stood before this step. Two edits for the same reason M14 needs two — with a healthy docstring nothing refuses, so the dropped channel is unobservable (I planted the revert alone first and the mutant came out green, **exit 0**: the second time this mutation taught its own lesson) — and the catch is the point: **every human assertion stays GREEN** (exit still 3, pair still named, `--help` still refusing with an empty stdout) while **R9b** sees the empty stdout. The old suite asserted the *absence* of JSON, so the defect passed it. **M16** the usage-error channel dropped (`[0.4.62]`): `if fmt == "json":` → `if False:` in `_Parser.error`, i.e. the pre-step state exactly — argparse always prints usage to stderr and exits 2, so `--format json --timeout abc` gives a jq pipeline empty stdin again. **One edit where M14 and M15 each needed two, and the difference is the finding**: those needed a *trigger* because a healthy docstring never refuses, whereas here the argv that says json is supplied **by the test**, so the trigger and the defect are the same line. Caught by **S3** (stdout empty again) with **every human assertion staying GREEN** — exit still 2, usage still on stderr, `--help` still 0, the healthy json run still 0 — because the human path never had the check; that asymmetry is the argument for having written S1/S13/S14/S15 as guards.
 - Live: HEAD → exit 0 (176 files — **174 → 176 with `[0.4.65]`**, its own `tools/regression-run` + `tests/test_regression_run.sh` going from untracked to tracked (`linted.bash` 24 → 25, `linted.python` 11 → 12), following **173 → 174 with `[0.4.64]`**; the pre-commit run reads **174** with `bash 24` / `python 11` because those blobs are not there yet — the stale-live-number class, re-read after the commit below — 45 module files compile clean in ~1.6s. **`[0.4.66]` pre-commit read: exit 0, `files_total 176`, `linted {bash 25, go 43, json 11, php 32, python 12}`, `changelog_version entries 70, unique 70, duplicates []`** — both changed files were already tracked, so the post-commit prediction is **176 unchanged** with `entries 71` once `[0.4.66]` lands, re-read after the commit rather than carried. **`[0.4.67]` pre-commit read: exit 0, `files_total 176`, `linted {bash 25, go 43, json 11, php 32, python 12}`, `changelog_version entries 71, unique 71, duplicates []`** — this entry adds two **untracked** files (`tools/queue-source-check`, extensionless `python3` shebang → `linted.python`; `tests/test_queue_source.sh`, `.sh` → `linted.bash`) plus its own heading, so the post-commit prediction is **178** with `bash 26`, `python 13` and `entries 72`, re-read after the commit rather than carried) with `changelog_version` = `attempted true, entries 70, unique 70, unparseable 0, duplicates [], ok true` (**69 → 70 with `[0.4.65]`**, following **68 → 69 with `[0.4.64]`**: the count is read from the COMMITTED blob, so it is re-read after the append commits rather than carried over — it read 68 while `[0.4.64]` was still uncommitted, which is the whole point of re-reading; the working-tree count was verified the anchored way, `grep -c '^## \['` → 69 with `uniq -d` empty, because the greedy `sed 's/.*\[\([^]]*\)\].*/\1/'` form reports **5 phantom duplicates** on this tree — 0.4.31/0.4.40/0.4.44/0.4.49/0.4.62 — by taking the last bracket in a heading that cites other versions. The **file** count is 173, not the 171 drafted mid-run: `[0.4.63]`'s own two mailbox files were untracked when that number was written and tracked once it committed, so 171 → 173 is this entry's own movement rather than a count carried); `--sha 219fd8f` → exit 1 naming `tests/test_mailbox_a11y.php:208 [php]`; `--sha 395b9b5` → exit 1 naming `.../status_test.go:5 [go-compile]`; unknown rev / non-repo → exit 3; `--sha probe-r9` → exit 3 with `requested_sha: probe-r9` (the R16 parity reference, live); `--format yaml` → exit 2 with **usage on stderr and an empty stdout** (no format could be read, so none is invented — `[0.4.62]`); **`--format json` + a bad argv → exit 2 with a 384-byte 15-key object on stdout and 0 bytes on stderr** (`--timeout abc`, `--nonsense`, `--timeout 0`, empty `--sha`, and the failing token placed *before* `--format`), while the same argv in human mode still gives argparse's `usage:`+`error:` with **stdout 0 bytes**; `--help` (**106 lines**, was 57 before the epilog stopped carrying its own prose, 102 before the exit-3 clause widened, 103 through `[0.4.61]`, **+3 for `[0.4.62]`'s widened exit-2 clause**) renders all seven docstring blocks verbatim under their labels; a copy with a heading renamed → `repo-lint: ERROR refusing to run - docstring section missing or empty …` + `  'env:' -> 'Environment:'` → **exit 3**, stderr only, and under `--format json` the **same refusal as an object** — `ok false`, `exit_code 3`, `error` naming the pair, **stderr 0 bytes** — which is the `| jq` consumer `[0.4.60]`'s queue described, now parsing (`--format=json` → 3; `--form json` → 3; `-- --format json` → no JSON on stdout; `--format yaml` on the broken copy → refusal only, no `usage:` leak) — **and on that same broken copy `--format json --timeout abc` now yields the 458-byte refusal object with `exit_code 3` instead of falling back to `human`**, which is `[0.4.61]`'s own queue item struck as actioned.
 - Pre-fix replay: the **then-`HEAD` suite against the then-`HEAD` tool** → **88 passed / 28 failed** (including `L: 395b9b5 … (want rc=1 got=0)`) for the Go gate of `[0.4.3x]`; for the changelog gate the *new* suite against the pre-fix tool (md5 `3a4e09176e24ca3414366952467d4944`, log `/tmp/opencode/changelog-gate/pre-fix.log`, suite md5 `9e352394d02096183adef92d55fc5a73`) → **125 passed / 22 failed**: the exact key-set pin plus every O1–O7 finding red, and M7/M8/M9 unplantable (0 matching lines) — while the six guard-style assertions inside O (absent file adds no failure; fixed commit → 0) already passed, which is what identifies them as guards rather than findings. For `[0.4.56]` the new section P against the pre-fix tool (tool md5 `3ebcf0b4ae7e290796fbed12c57e422b`, suite md5 `a50e16d7a5643bdfd18b667752e50d2c`, log `/tmp/opencode/exitcodes/pre-fix.log`) → **166 passed / 6 failed**: P1 (the contract text occurs **twice**), P2 ×2 (Go rule and CHANGELOG rule both absent from the docstring), P4 (the docstring block and `--help`'s section differ), M10's agreement surgical check (pre-fix both copies still exist, so the mutant's docstring and `--help` disagree), and M11's precondition (already 2 occurrences → unplantable, so its other three assertions could not run pre-fix — hence 172 counted pre-fix against 175 post-fix). Guards that passed pre-fix and thereby identify themselves: P2's parse rule, P3 (all four codes), P4's `--help exits 0`, and all three P5 rules — the epilog was the copy that was right. Baseline re-verified on a checkout of the same commit before the fix: **155/156 then 156/156 twice**, the single red being `L: real repo status changed during a run` (a concurrent identity committed mid-run), not this change. For `[0.4.59]` the new section Q against the pre-fix tool (tool md5 `f17563d67064a79f313ef2bab376cd66`, suite md5 `9217e2653fbed256afb704d0a01fd359`, log `/tmp/opencode/epilogderive/pre-fix.log`; baseline of the *old* suite against the old tool was **175/0** first) → **186 passed / 9 failed**: the seven findings are Q1–Q6 (every pair renders different bytes) and Q13 (the drifted synopsis still present), plus **M12's surgical render check** — which fails pre-fix only because the two renderings differ by definition, i.e. it restates Q2 — and **M13's precondition unplantable** (the derivation tuple does not exist yet, so its other three assertions could not run: hence 186 counted pre-fix against 198 post-fix). **Guards passed pre-fix and thereby identify themselves**: all six Q-source counts (each section's text already occurred exactly once — the copies differed, they were not duplicated line-for-line), `--help exits 0`, the generated-usage line, and M12's precondition plus its "caught" assertion. For `[0.4.60]` the new section R against the pre-fix tool (old tool md5 `4e6c58ffc86441a5745054a4ea45d084`, final suite md5 `e126f791dbcd4b1d9ae0bd0626022d82`, log `/tmp/opencode/epilogrefuse/pre-fix.log`; baseline of the old suite against the old tool was **198/0** first) → **203 passed / 10 failed**, captured **inside a clone of the repo** rather than from `/tmp`: pointing `REPO_LINT_BIN` at a copy outside `tools/` makes section L's live checks fail for *path* reasons, because `default_repo()` resolves relative to the script, so the tool reported `repo_root: /tmp/...` and exited 3 — a harness artifact that cost a second capture to get a red meaning what it says. **Nine of the ten are real**: **R5, R6, R7, R9 ×2, R11, R12, R12b** plus **M14's precondition unplantable** (the refusal does not exist yet, so its other five assertions could not run — hence 213 counted pre-fix against 218 post-fix); the tenth is `L: live json structurally sound`, whose `d['repo_root'] == '/data/repo'` is true in the real repo and false in a clone — disclosed as an artifact of my cloning rather than counted as a finding. **Guards passed pre-fix and thereby identify themselves**: R1 (healthy tool exits 0), R2 (no refusal on stderr), R3 (all seven labels non-empty), R4 and R10 (both mutant preconditions), R8 (the refusal names only the broken pair — pre-fix stderr is empty, so it passes vacuously, which is what makes it a guard rather than a finding). For `[0.4.61]` the widened section R against the pre-fix tool (old tool md5 `d6b50e6dcf68df6dccb5a46dfe06e5a0`, **final** suite md5 `b71b64db24d64fa65263e3867e45ba97`, log `/tmp/opencode/jsonrefuse/pre-fix.log`; baseline of the committed suite against the committed tool was **218/218** first) → **230 passed / 12 failed**, again **inside a clone** for the same path reason. **Eleven are real**: **R9b, R9c, R9d, R9e, R9f, R9g** (one cause — stdout empty, refusal on stderr), **R13** (`_add_flags` does not exist yet), **R14b, R15b, R16b** (same empty-stdout cause) and **M15's precondition unplantable** (the die()-routing line does not exist, so its five other assertions could not run — hence **242 counted pre-fix against 247 post-fix**). The twelfth is again `L: live json structurally sound` (`repo_root` is the clone, not `/data/repo`) — disclosed as a cloning artifact, not counted. **Guards passed pre-fix and thereby identify themselves**: R1–R8, R10–R12b, the exit-3 half of R9/R14/R15/R16, **R15c** (argparse really accepts `--form`), **R16c/R16d** (the healthy tool already echoed `requested_sha: probe-r9` — the reference both readers must match), R17, R17c, R18, R18b, R19; and **R17b, R18c, R18d are vacuously green** (nothing could print before a scan existed) — disclosed as guards, not findings. Two first-draft defects of mine are recorded in the CHANGELOG: R9c's predicate used `->` outside a string (the *checker* raised SyntaxError — a red meaning the wrong thing), and M15 was first planted without its trigger (mutant exited **0** and was "NOT caught", because nothing refuses when the docstring is healthy). For `[0.4.62]` the new section S against the pre-fix tool (tool md5 `f42b33e34ab28588334b5f616a551798`, **final** suite md5 `4acbd04968016e319778dda544c6596e`, log `/tmp/opencode/usagejson/pre-fix.log`; baseline of the committed suite against the committed tool was **247/247** first) → **268 passed / 16 failed** of 284, captured **in place rather than in a clone** — the tool was still unmodified at its real path, so section L's `repo_root == '/data/repo'` check passed on its own; the clone was only ever needed because a copy *outside* `tools/` changes `default_repo()`. **All sixteen are real**: **S3–S8** (one cause — stdout empty, usage on stderr), **S9b, S9c, S10b, S10c, S11b** (same cause, one per argv form), **S12b, S12c, S12e, S12f** (same cause, via our own `p.error()`), **S16b** (`_add_format_flag` does not exist yet — hence 268 counted pre-fix against 291 post-fix). **Guards passed pre-fix and thereby identify themselves**: **S1** (the human channel was already exactly right — the strongest evidence this was a *channel* defect, not a validation one), S2, S9a, S10a, S11a, S12a, S12d, **S13a–S15b** (no-format-readable argv), **S16** (the `--format` definition was already single), **S17, S18**. Two first-draft defects of mine are recorded in the CHANGELOG: S17b read `$OUT` where `s_run` wrote `$S_OUT` (a **stale** object, so the assertion failed against the *old* tool for an unrelated reason — caught as the 17th red and fixed before the tool was touched, the capture then re-taken honestly at 16), and S16b's predicate `grep -c '_add_format_flag(p)'` also matched the `def` line, reporting `3` for two call sites plus a definition — the third time this suite has been wrong in the *predicate* direction.
 
 **Status**: Green ✅ 2026-09-26 (291/291; full regression 41 suites, 3503 assertions, 0 failed — 21 shell = 2312, 20 PHP = 1191. Was 40 / 3396 / 20 shell = 2205 with `[0.4.66]`; **`[0.4.67]` adds `tests/test_queue_source.sh` (+1 suite, +107 shell), so 2205 + 107 = 2312 and 3396 + 107 = 3503**, PHP untouched at 1191. Before that, `[0.4.66]` grew `tests/test_regression_run.sh` (+0 suites, +83 shell: 110 → 193), so 2122 + 83 = 2205 and 3313 + 83 = 3396, and `[0.4.65]` added that suite (+1 suite, +110 shell) — 2012 + 110 = 2122, 3203 + 110 = 3313. This line was itself two runs stale at `[0.4.64]` — `[0.4.63]` added `test_app_contrast.php` (+1, +185) without updating it, so 958 + 185 + 48 = 1191 and 2970 + 185 + 48 = 3203 came out then)

> build · mimo-v2.6-flash-free
← Edit repo/tools/REGISTRY.md
Index: repo/tools/REGISTRY.md
===================================================================
--- repo/tools/REGISTRY.md
+++ repo/tools/REGISTRY.md
@@ -2346,9 +2346,9 @@
 - **Section Q — EVERY epilog section derived, not copied** (`[0.4.59]`): Q applies P's two checks to the six remaining docstring/epilog pairs (`languages`, `go compile gate`, `changelog version gate`, `reads GIT BLOBS`, `env`, `examples`). **Q-render** (Q1–Q6) runs `--help` and compares each labelled section to its docstring block **byte for byte**, requiring the docstring side to be non-empty (a heading that no longer exists in the docstring cannot pass by rendering nothing); **Q-source** (Q7–Q12) counts each section's distinctive text in the tool source and requires **exactly one** — the check that sees a copy `--help` never renders. **Q13** requires the hand-written `Usage:` synopsis to be *gone* (needle `[--sha SHA] [--format human|json]`, count 0): argparse generates the synopsis from the argument definitions, and the docstring's copy had already drifted from it (no `-h`, `human|json` vs `{human,json}`), so the fifth pair the queue named was closed by deletion rather than by keeping two things in step. Guards: `--help` exits 0 and its `usage:` line is argparse's own.
 - **Section R — the epilog REFUSES to build a label over nothing** (`[0.4.60]`, widened by `[0.4.61]`): derivation made the epilog correct, but `docstring_section` still returned `""` for a heading it could not find and `"\n\n".join` does not complain about `""`, so a renamed or deleted docstring heading produced `env:` printed above a blank line with `--help` exiting **0** — and only Q-render's non-empty requirement stood in the way, i.e. a defect that was *tested* rather than *prevented*, covering only the heading someone named. **R1–R3** are guards on the healthy tool (exit 0, no refusal on stderr, all seven labels rendering a non-empty body); **R4–R9** cover a heading **renamed away** while the tuple still names it (refuse with exit 3; name the pair `'env:' -> 'Environment:'`; nothing on stdout; name **only** the broken pair), and R9 points `GLADEX_REPO_DIR` at the real sandbox repo for the same reason it always did — run from `$SB` the mutant's default repo is not a git repo and it exited 3 for *that* reason, a false pass the red had to be read to catch. **R10–R12b** cover a heading that **exists but whose block is empty** — `docstring_section` stops at the first blank line, so "found" must not mean "fine". **R9's original assertion was written inverted and is corrected in `[0.4.61]`**: it required *no* parseable JSON from the refusing tool — which is exactly the defect (`| jq` meeting empty stdin), so it passed for it. It now asserts the contract, and the block grew accordingly: **R9b** one object on stdout with `ok false`/`exit 3`; **R9c** it names the broken pair; **R9d** it is an ERROR not a verdict (`failures`/`errors` empty, `sha_resolved` null); **R9e** `go_compile`/`changelog_version` null (die()'s shape); **R9f** stderr clean in json mode; **R9g** its **key set is byte-equal to a normal run's** — the shape-level proof that the refusal is the contract and not an exception to it.
 - **Section R, argv parity — the refusal's reading of argv must BE argparse's** (`[0.4.61]`): it fires before argparse exists, so it reads argv with a throwaway parser built from the **same `_add_flags`** definitions; each assertion below is the first place a hand-rolled `sys.argv` scan would diverge. **R13** one definition, two call sites (source count); **R14/R14b** the `--format=json` equals form; **R15/R15b** argparse's unique-prefix rule (`--form json`) with **R15c** as the guard that argparse really does accept it; **R16/R16b** `--sha probe-r9` echoed by the refusal with **R16c/R16d** as the parity reference — the *healthy* tool must report the same `requested_sha`, one expectation read by two code paths; **R17/R17b/R17c** `--` termination (the scan stops there and emits no JSON, while argparse itself rejects the same argv with exit 2); **R18/R18b/R18c/R18d** an argv argparse rejects (refusal still fires, still names the pair, no `usage:` noise leaked, stdout still empty in human mode) with **R19** as the guard that argparse keeps ownership of validation (invalid choice alone → exit 2). **R17b, R18c and R18d are vacuously green before the fix** — with no scan in existence nothing could print or leak — and they only begin testing something once it exists; disclosed as guards, not findings. **Guards that passed against the pre-fix tool and thereby identify themselves**: R1–R8, R10–R12b, the exit-3 half of R9/R14/R15/R16, R15c, R16c/R16d, R17, R17c, R18, R18b, R19.
 - **Section S — a usage error under `--format json` is still ONE JSON object** (`[0.4.62]`): `repo-lint --format json --timeout abc` used to exit 2 with usage prose on stderr and an **empty stdout**, so a `| jq` consumer got jq's own parse error and could not tell a mistyped flag from a crash — the last path with no object after `[0.4.61]`, and reachable on a perfectly healthy tool. **S1 is the human guard** (usage on stderr, empty stdout, exit 2 — passes before *and* after, which is what makes it a guard rather than a finding, and what M16 leaves green while S3 goes red); **S2–S8** the defect itself (exit 2 preserved; stdout non-empty; one object with `ok false`/`exit_code 2`; `error` names the bad argument; **key set byte-equal to a normal run's** — the shape-level proof that the usage object *is* the contract; not a verdict — `failures[]`/`errors[]` empty, `sha_resolved` null; stderr clean); **S9–S11** argv forms a hand-rolled scan gets wrong — the failing token **before** `--format` (a full pre-parse aborts first and would answer `human`), `--format=json`, `--form json`; **S12** the tool's own `p.error()` checks take the same route as argparse's rejections (both are inside one `try`); **S13–S15** the three argv shapes where **no** format can be read (`--format yaml`, a bare `--format`, anything after `--`) → human, asserted not assumed; **S16/S16b** exactly one `add_argument("--format", …)` and two readers of it (`_add_format_flag` feeds `_add_flags` and `_format_of` — splitting the flag out must not become a second choices list); **S17/S18** guards that a healthy json run still exits 0 and `--help` still exits 0. The section captures **stdout and stderr separately** throughout (`run_tool` merges them) because *which stream* is half of what it asserts, which is why it also needed `assert_empty`/`assert_nonempty`: `assert_not_contains` takes its needle as argument 2, so an empty needle matches every haystack and "this stream is empty" could not be expressed without failing by construction.
-- **Mutation**: 19, each precondition-asserted to occur exactly once, caught by a divergence assertion, and surgically checked — M1 exit gate defeated (`(1 if failures else 0)` → 0); M2 `--sha` ignored (always lints HEAD); M3 `.php` dropped from `EXT_LANG` (mutant still catches broken sh); **M4** `failures.extend(gentries)` → `extend([])` (the 395b9b5 defect returns: a build-breaking commit reports 0; mutant still 0 on a compiling commit); **M5** `3 if errors` → `1 if errors` (an environment failure reads as "broken file": real=3/mutant=1; mutant still 1 on broken php); **M6** the gate's blob read → `open(<worktree path>)` (the 219fd8f class applied to Go: a fixed worktree hides a broken commit; mutant still 1 when the worktree is broken too); **M7** `failures.extend(cl_failures)` → `extend([])` (the hand-off dies while the JSON still names the twin — `ok false`, `duplicates == ['1.0.0']`, `exit_code 0`; mutant still exits 1 on broken php); **M8** `if ver in first_seen:` → `if False:` (the test itself dies: `duplicates == []` and `ok true` where the real tool reports a twin; mutant still green on a clean changelog); **M9** the changelog blob read pinned to `HEAD` instead of `--sha` while the existence probe still uses `--sha` (an ancestor's twin vanishes — real=1/mutant=0; mutant still 0 on a clean HEAD); **M10** the CHANGELOG rule dropped from the tool's one contract (the `[0.4.56]` defect itself planted) — caught by P2/P5 while **P1 and P4 stay green**: the docstring and `--help` still agree because they are one copy, so they lost the rule *together*; surgical checks are the agreement holding, the parse rule surviving, and `--help` still exiting 0; **M11** a second copy of the contract planted as a source comment `--help` never renders — caught by **P1 alone**, with P4 deliberately asserted **green** (what `--help` prints is still byte-identical to the docstring), proving the source-level count is not redundant with the render-level check; **M12** the same shape for a *derived* section (a source-comment second copy of the go-gate text) — caught by **Q-source**, with **Q-render asserted green** on the mutant (`--help` still equals the docstring, so the byte comparison provably cannot see it) and `--help` still exiting 0; **M13** the inverse — `("env:", "Environment:")` repointed to the languages heading, so `env:` renders a different docstring block — caught by **Q-render**, with **Q-source asserted green** (the Environment text still occurs exactly once, so the count cannot see a misattribution) and the `exit codes:` pair still agreeing (one pair misattributed, not the whole epilog). M12/M13 are complementary by construction, exactly as M10/M11 are: each one's green assertions are what prove the other's necessity; **M14** the pre-`[0.4.60]` state reproduced — R's trigger (the docstring heading renamed to `Environment (renamed):` while the tuple still says `Environment:`) **in the same copy as** the refusal's condition defeated (`if missing:` → `if False:`). Two edits deliberately: defeating the guard **alone** changes nothing, because a healthy docstring still yields seven full sections — I built it that way first and the mutant came out **green**, which is the finding rather than a flaw in the mutation: the guard is not the defect, it is what makes an always-available trigger loud. With both halves present `--help` exits 0 over a label printed on nothing, stderr silent — caught by R's refusal assertions and by `r_labels` (R3's own check, run against the mutant) going red at **exactly** `env:` — while an unrelated section still byte-equals its docstring (surgical: one condition defeated, not the derivation); **M15** the machine channel dropped (`[0.4.61]`): R's trigger **in the same copy as** the fix reverted (`raise SystemExit(die(None, default_repo(), message, sha, fmt))` → the bare `sys.stderr.write(message)` + `SystemExit(EXIT_CANNOT)`), i.e. the refusal output as it stood before this step. Two edits for the same reason M14 needs two — with a healthy docstring nothing refuses, so the dropped channel is unobservable (I planted the revert alone first and the mutant came out green, **exit 0**: the second time this mutation taught its own lesson) — and the catch is the point: **every human assertion stays GREEN** (exit still 3, pair still named, `--help` still refusing with an empty stdout) while **R9b** sees the empty stdout. The old suite asserted the *absence* of JSON, so the defect passed it. **M16** the usage-error channel dropped (`[0.4.62]`): `if fmt == "json":` → `if False:` in `_Parser.error`, i.e. the pre-step state exactly — argparse always prints usage to stderr and exits 2, so `--format json --timeout abc` gives a jq pipeline empty stdin again. **One edit where M14 and M15 each needed two, and the difference is the finding**: those needed a *trigger* because a healthy docstring never refuses, whereas here the argv that says json is supplied **by the test**, so the trigger and the defect are the same line. Caught by **S3** (stdout empty again) with **every human assertion staying GREEN** — exit still 2, usage still on stderr, `--help` still 0, the healthy json run still 0 — because the human path never had the check; that asymmetry is the argument for having written S1/S13/S14/S15 as guards.
+- **Mutation**: 19, each precondition-asserted to occur exactly once, caught by a divergence assertion, and surgically checked — M1 exit gate defeated (`(1 if failures else 0)` → 0); M2 `--sha` ignored (always lints HEAD); M3 `.php` dropped from `EXT_LANG` (mutant still catches broken sh); **M4** `failures.extend(gentries)` → `extend([])` (the 395b9b5 defect returns: a build-breaking commit reports 0; mutant still 0 on a compiling commit); **M5** `3 if errors` → `1 if errors` (an environment failure reads as "broken file": real=3/mutant=1; mutant still 1 on broken php); **M6** the gate's blob read → `open(<worktree path>)` (the 219fd8f class applied to Go: a fixed worktree hides a broken commit; mutant still 1 when the worktree is broken too); **M7** `failures.extend(cl_failures)` → `extend([])` (the hand-off dies while the JSON still names the twin — `ok false`, `duplicates == ['1.0.0']`, `exit_code 0`; mutant still exits 1 on broken php); **M8** `if ver in first_seen:` → `if False:` (the test itself dies: `duplicates == []` and `ok true` where the real tool reports a twin; mutant still green on a clean changelog); **M9** the changelog blob read pinned to `HEAD` instead of `--sha` while the existence probe still uses `--sha` (an ancestor's twin vanishes — real=1/mutant=0; mutant still 0 on a clean HEAD); **M10** the CHANGELOG rule dropped from the tool's one contract (the `[0.4.56]` defect itself planted) — caught by P2/P5 while **P1 and P4 stay green**: the docstring and `--help` still agree because they are one copy, so they lost the rule *together*; surgical checks are the agreement holding, the parse rule surviving, and `--help` still exiting 0; **M11** a second copy of the contract planted as a source comment `--help` never renders — caught by **P1 alone**, with P4 deliberately asserted **green** (what `--help` prints is still byte-identical to the docstring), proving the source-level count is not redundant with the render-level check; **M12** the same shape for a *derived* section (a source-comment second copy of the go-gate text) — caught by **Q-source**, with **Q-render asserted green** on the mutant (`--help` still equals the docstring, so the byte comparison provably cannot see it) and `--help` still exiting 0; **M13** the inverse — `("env:", "Environment:")` repointed to the languages heading, so `env:` renders a different docstring block — caught by **Q-render**, with **Q-source asserted green** (the Environment text still occurs exactly once, so the count cannot see a misattribution) and the `exit codes:` pair still agreeing (one pair misattributed, not the whole epilog). M12/M13 are complementary by construction, exactly as M10/M11 are: each one's green assertions are what prove the other's necessity; **M14** the pre-`[0.4.60]` state reproduced — R's trigger (the docstring heading renamed to `Environment (renamed):` while the tuple still says `Environment:`) **in the same copy as** the refusal's condition defeated (`if missing:` → `if False:`). Two edits deliberately: defeating the guard **alone** changes nothing, because a healthy docstring still yields seven full sections — I built it that way first and the mutant came out **green**, which is the finding rather than a flaw in the mutation: the guard is not the defect, it is what makes an always-available trigger loud. With both halves present `--help` exits 0 over a label printed on nothing, stderr silent — caught by R's refusal assertions and by `r_labels` (R3's own check, run against the mutant) going red at **exactly** `env:` — while an unrelated section still byte-equals its docstring (surgical: one condition defeated, not the derivation); **M15** the machine channel dropped (`[0.4.61]`): R's trigger **in the same copy as** the fix reverted (`raise SystemExit(die(None, default_repo(), message, sha, fmt))` → the bare `sys.stderr.write(message)` + `SystemExit(EXIT_CANNOT)`), i.e. the refusal output as it stood before this step. Two edits for the same reason M14 needs two — with a healthy docstring nothing refuses, so the dropped channel is unobservable (I planted the revert alone first and the mutant came out green, **exit 0**: the second time this mutation taught its own lesson) — and the catch is the point: **every human assertion stays GREEN** (exit still 3, pair still named, `--help` still refusing with an empty stdout) while **R9b** sees the empty stdout. The old suite asserted the *absence* of JSON, so the defect passed it. **M16** the usage-error channel dropped (`[0.4.62]`): `if fmt == "json":` → `if False:` in `_Parser.error`, i.e. the pre-step state exactly — argparse always prints usage to stderr and exits 2, so `--format json --timeout abc` gives a jq pipeline empty stdin again. **One edit where M14 and M15 each needed two, and the difference is the finding**: those needed a *trigger* because a healthy docstring never refuses, whereas here the argv that says json is supplied **by the test**, so the trigger and the defect are the same line. Caught by **S3** (stdout empty again) with **every human assertion staying GREEN** — exit still 2, usage still on stderr, `--help` still 0, the healthy json run still 0 — because the human path never had the check; that asymmetry is the argument for having written S1/S13/S14/S15 as guards. **M17–M19 (the citation rule, `[0.4.82]`)** — three ways to lint green over a version nobody wrote, each with a surgical value that says *which* one: **M17** the existence test → `if False` → the token is still **counted and classified in series** but never judged (`seen ≥ 3, in_series ≥ 3, missing [], exit 0`), caught `real=1 mutant=0`; **M18** the **series fence** dropped (`in_series = list(citations)`) → the one excluded token becomes the defect (`in_series 4`, `missing ['9.9.4']`), caught `real=0 mutant=1`, i.e. red on a fixture the real rule calls clean — and its replace runs through python with `t.count(old) == 1` asserted **inside** the script, because a sed pattern of brackets and quotes that matches the wrong line edits a path no fixture exercises and comes back green; **M19** the **collection** dropped (`citations.extend([])`) → `citations_seen == 0`, nothing was scanned at all, caught `real=1 mutant=0`. M17 vs M19 is the pair that matters: both exit 0 over the defect, and only `citations_seen` (counted-but-unjudged vs never-scanned) tells them apart. Every mutant file is `[ -f ]`-checked before it is run, so a build that produced nothing cannot be reported as a catch.
 - Live: HEAD → exit 0 (176 files — **174 → 176 with `[0.4.65]`**, its own `tools/regression-run` + `tests/test_regression_run.sh` going from untracked to tracked (`linted.bash` 24 → 25, `linted.python` 11 → 12), following **173 → 174 with `[0.4.64]`**; the pre-commit run reads **174** with `bash 24` / `python 11` because those blobs are not there yet — the stale-live-number class, re-read after the commit below — 45 module files compile clean in ~1.6s. **`[0.4.66]` pre-commit read: exit 0, `files_total 176`, `linted {bash 25, go 43, json 11, php 32, python 12}`, `changelog_version entries 70, unique 70, duplicates []`** — both changed files were already tracked, so the post-commit prediction is **176 unchanged** with `entries 71` once `[0.4.66]` lands, re-read after the commit rather than carried. **`[0.4.67]` pre-commit read: exit 0, `files_total 176`, `linted {bash 25, go 43, json 11, php 32, python 12}`, `changelog_version entries 71, unique 71, duplicates []`** — this entry adds two **untracked** files (`tools/queue-source-check`, extensionless `python3` shebang → `linted.python`; `tests/test_queue_source.sh`, `.sh` → `linted.bash`) plus its own heading, so the post-commit prediction is **178** with `bash 26`, `python 13` and `entries 72`, re-read after the commit rather than carried) with `changelog_version` = `attempted true, entries 70, unique 70, unparseable 0, duplicates [], ok true` (**69 → 70 with `[0.4.65]`**, following **68 → 69 with `[0.4.64]`**: the count is read from the COMMITTED blob, so it is re-read after the append commits rather than carried over — it read 68 while `[0.4.64]` was still uncommitted, which is the whole point of re-reading; the working-tree count was verified the anchored way, `grep -c '^## \['` → 69 with `uniq -d` empty, because the greedy `sed 's/.*\[\([^]]*\)\].*/\1/'` form reports **5 phantom duplicates** on this tree — 0.4.31/0.4.40/0.4.44/0.4.49/0.4.62 — by taking the last bracket in a heading that cites other versions. The **file** count is 173, not the 171 drafted mid-run: `[0.4.63]`'s own two mailbox files were untracked when that number was written and tracked once it committed, so 171 → 173 is this entry's own movement rather than a count carried); `--sha 219fd8f` → exit 1 naming `tests/test_mailbox_a11y.php:208 [php]`; `--sha 395b9b5` → exit 1 naming `.../status_test.go:5 [go-compile]`; unknown rev / non-repo → exit 3; `--sha probe-r9` → exit 3 with `requested_sha: probe-r9` (the R16 parity reference, live); `--format yaml` → exit 2 with **usage on stderr and an empty stdout** (no format could be read, so none is invented — `[0.4.62]`); **`--format json` + a bad argv → exit 2 with a 384-byte 15-key object on stdout and 0 bytes on stderr** (`--timeout abc`, `--nonsense`, `--timeout 0`, empty `--sha`, and the failing token placed *before* `--format`), while the same argv in human mode still gives argparse's `usage:`+`error:` with **stdout 0 bytes**; `--help` (**106 lines**, was 57 before the epilog stopped carrying its own prose, 102 before the exit-3 clause widened, 103 through `[0.4.61]`, **+3 for `[0.4.62]`'s widened exit-2 clause**) renders all seven docstring blocks verbatim under their labels; a copy with a heading renamed → `repo-lint: ERROR refusing to run - docstring section missing or empty …` + `  'env:' -> 'Environment:'` → **exit 3**, stderr only, and under `--format json` the **same refusal as an object** — `ok false`, `exit_code 3`, `error` naming the pair, **stderr 0 bytes** — which is the `| jq` consumer `[0.4.60]`'s queue described, now parsing (`--format=json` → 3; `--form json` → 3; `-- --format json` → no JSON on stdout; `--format yaml` on the broken copy → refusal only, no `usage:` leak) — **and on that same broken copy `--format json --timeout abc` now yields the 458-byte refusal object with `exit_code 3` instead of falling back to `human`**, which is `[0.4.61]`'s own queue item struck as actioned.
 - Pre-fix replay: the **then-`HEAD` suite against the then-`HEAD` tool** → **88 passed / 28 failed** (including `L: 395b9b5 … (want rc=1 got=0)`) for the Go gate of `[0.4.3x]`; for the changelog gate the *new* suite against the pre-fix tool (md5 `3a4e09176e24ca3414366952467d4944`, log `/tmp/opencode/changelog-gate/pre-fix.log`, suite md5 `9e352394d02096183adef92d55fc5a73`) → **125 passed / 22 failed**: the exact key-set pin plus every O1–O7 finding red, and M7/M8/M9 unplantable (0 matching lines) — while the six guard-style assertions inside O (absent file adds no failure; fixed commit → 0) already passed, which is what identifies them as guards rather than findings. For `[0.4.56]` the new section P against the pre-fix tool (tool md5 `3ebcf0b4ae7e290796fbed12c57e422b`, suite md5 `a50e16d7a5643bdfd18b667752e50d2c`, log `/tmp/opencode/exitcodes/pre-fix.log`) → **166 passed / 6 failed**: P1 (the contract text occurs **twice**), P2 ×2 (Go rule and CHANGELOG rule both absent from the docstring), P4 (the docstring block and `--help`'s section differ), M10's agreement surgical check (pre-fix both copies still exist, so the mutant's docstring and `--help` disagree), and M11's precondition (already 2 occurrences → unplantable, so its other three assertions could not run pre-fix — hence 172 counted pre-fix against 175 post-fix). Guards that passed pre-fix and thereby identify themselves: P2's parse rule, P3 (all four codes), P4's `--help exits 0`, and all three P5 rules — the epilog was the copy that was right. Baseline re-verified on a checkout of the same commit before the fix: **155/156 then 156/156 twice**, the single red being `L: real repo status changed during a run` (a concurrent identity committed mid-run), not this change. For `[0.4.59]` the new section Q against the pre-fix tool (tool md5 `f17563d67064a79f313ef2bab376cd66`, suite md5 `9217e2653fbed256afb704d0a01fd359`, log `/tmp/opencode/epilogderive/pre-fix.log`; baseline of the *old* suite against the old tool was **175/0** first) → **186 passed / 9 failed**: the seven findings are Q1–Q6 (every pair renders different bytes) and Q13 (the drifted synopsis still present), plus **M12's surgical render check** — which fails pre-fix only because the two renderings differ by definition, i.e. it restates Q2 — and **M13's precondition unplantable** (the derivation tuple does not exist yet, so its other three assertions could not run: hence 186 counted pre-fix against 198 post-fix). **Guards passed pre-fix and thereby identify themselves**: all six Q-source counts (each section's text already occurred exactly once — the copies differed, they were not duplicated line-for-line), `--help exits 0`, the generated-usage line, and M12's precondition plus its "caught" assertion. For `[0.4.60]` the new section R against the pre-fix tool (old tool md5 `4e6c58ffc86441a5745054a4ea45d084`, final suite md5 `e126f791dbcd4b1d9ae0bd0626022d82`, log `/tmp/opencode/epilogrefuse/pre-fix.log`; baseline of the old suite against the old tool was **198/0** first) → **203 passed / 10 failed**, captured **inside a clone of the repo** rather than from `/tmp`: pointing `REPO_LINT_BIN` at a copy outside `tools/` makes section L's live checks fail for *path* reasons, because `default_repo()` resolves relative to the script, so the tool reported `repo_root: /tmp/...` and exited 3 — a harness artifact that cost a second capture to get a red meaning what it says. **Nine of the ten are real**: **R5, R6, R7, R9 ×2, R11, R12, R12b** plus **M14's precondition unplantable** (the refusal does not exist yet, so its other five assertions could not run — hence 213 counted pre-fix against 218 post-fix); the tenth is `L: live json structurally sound`, whose `d['repo_root'] == '/data/repo'` is true in the real repo and false in a clone — disclosed as an artifact of my cloning rather than counted as a finding. **Guards passed pre-fix and thereby identify themselves**: R1 (healthy tool exits 0), R2 (no refusal on stderr), R3 (all seven labels non-empty), R4 and R10 (both mutant preconditions), R8 (the refusal names only the broken pair — pre-fix stderr is empty, so it passes vacuously, which is what makes it a guard rather than a finding). For `[0.4.61]` the widened section R against the pre-fix tool (old tool md5 `d6b50e6dcf68df6dccb5a46dfe06e5a0`, **final** suite md5 `b71b64db24d64fa65263e3867e45ba97`, log `/tmp/opencode/jsonrefuse/pre-fix.log`; baseline of the committed suite against the committed tool was **218/218** first) → **230 passed / 12 failed**, again **inside a clone** for the same path reason. **Eleven are real**: **R9b, R9c, R9d, R9e, R9f, R9g** (one cause — stdout empty, refusal on stderr), **R13** (`_add_flags` does not exist yet), **R14b, R15b, R16b** (same empty-stdout cause) and **M15's precondition unplantable** (the die()-routing line does not exist, so its five other assertions could not run — hence **242 counted pre-fix against 247 post-fix**). The twelfth is again `L: live json structurally sound` (`repo_root` is the clone, not `/data/repo`) — disclosed as a cloning artifact, not counted. **Guards passed pre-fix and thereby identify themselves**: R1–R8, R10–R12b, the exit-3 half of R9/R14/R15/R16, **R15c** (argparse really accepts `--form`), **R16c/R16d** (the healthy tool already echoed `requested_sha: probe-r9` — the reference both readers must match), R17, R17c, R18, R18b, R19; and **R17b, R18c, R18d are vacuously green** (nothing could print before a scan existed) — disclosed as guards, not findings. Two first-draft defects of mine are recorded in the CHANGELOG: R9c's predicate used `->` outside a string (the *checker* raised SyntaxError — a red meaning the wrong thing), and M15 was first planted without its trigger (mutant exited **0** and was "NOT caught", because nothing refuses when the docstring is healthy). For `[0.4.62]` the new section S against the pre-fix tool (tool md5 `f42b33e34ab28588334b5f616a551798`, **final** suite md5 `4acbd04968016e319778dda544c6596e`, log `/tmp/opencode/usagejson/pre-fix.log`; baseline of the committed suite against the committed tool was **247/247** first) → **268 passed / 16 failed** of 284, captured **in place rather than in a clone** — the tool was still unmodified at its real path, so section L's `repo_root == '/data/repo'` check passed on its own; the clone was only ever needed because a copy *outside* `tools/` changes `default_repo()`. **All sixteen are real**: **S3–S8** (one cause — stdout empty, usage on stderr), **S9b, S9c, S10b, S10c, S11b** (same cause, one per argv form), **S12b, S12c, S12e, S12f** (same cause, via our own `p.error()`), **S16b** (`_add_format_flag` does not exist yet — hence 268 counted pre-fix against 291 post-fix). **Guards passed pre-fix and thereby identify themselves**: **S1** (the human channel was already exactly right — the strongest evidence this was a *channel* defect, not a validation one), S2, S9a, S10a, S11a, S12a, S12d, **S13a–S15b** (no-format-readable argv), **S16** (the `--format` definition was already single), **S17, S18**. Two first-draft defects of mine are recorded in the CHANGELOG: S17b read `$OUT` where `s_run` wrote `$S_OUT` (a **stale** object, so the assertion failed against the *old* tool for an unrelated reason — caught as the 17th red and fixed before the tool was touched, the capture then re-taken honestly at 16), and S16b's predicate `grep -c '_add_format_flag(p)'` also matched the `def` line, reporting `3` for two call sites plus a definition — the third time this suite has been wrong in the *predicate* direction.
 
 **Status**: Green ✅ 2026-09-26 (291/291; full regression 41 suites, 3503 assertions, 0 failed — 21 shell = 2312, 20 PHP = 1191. Was 40 / 3396 / 20 shell = 2205 with `[0.4.66]`; **`[0.4.67]` adds `tests/test_queue_source.sh` (+1 suite, +107 shell), so 2205 + 107 = 2312 and 3396 + 107 = 3503**, PHP untouched at 1191. Before that, `[0.4.66]` grew `tests/test_regression_run.sh` (+0 suites, +83 shell: 110 → 193), so 2122 + 83 = 2205 and 3313 + 83 = 3396, and `[0.4.65]` added that suite (+1 suite, +110 shell) — 2012 + 110 = 2122, 3203 + 110 = 3313. This line was itself two runs stale at `[0.4.64]` — `[0.4.63]` added `test_app_contrast.php` (+1, +185) without updating it, so 958 + 185 + 48 = 1191 and 2970 + 185 + 48 = 3203 came out then)

> build · mimo-v2.6-flash-free
← Edit repo/tools/REGISTRY.md
Index: repo/tools/REGISTRY.md
===================================================================
--- repo/tools/REGISTRY.md
+++ repo/tools/REGISTRY.md
@@ -296,10 +296,13 @@
 --sha HEAD` (read-only, before any mutating step) and refuses with **exit 7** when:
 - at least one committed file fails to parse **or** a committed Go file does not
   compile (`failures[]` is named in the refusal — same git-blob check
   `system-status`'s `go-compile` row reports, so the dashboard and the promote agree)
-  **or** repo-lint's **CHANGELOG version-identity rule** fires (a repeated
-  `## [x.y.z]` token — see `repo-lint`'s own exit-1 contract);
+  **or** repo-lint's **CHANGELOG version-identity rule** fires — a repeated
+  `## [x.y.z]` token, or a `[x.y.z]` **cited in the tree that the committed
+  changelog never wrote** (`[0.4.82]`; both report `lang: changelog`, so the
+  refusal below already reads them as *rules*, not syntax errors — see
+  `repo-lint`'s own exit-1 contract);
 - `repo-lint` exits `3` (**cannot verify**: not a git repo, unknown revision, linter
   missing/timed out), exits `2`, or cannot be run at all;
 - the child's output is not readable JSON, the binary is missing, or the run exceeds
   `GLADEX_LINT_TIMEOUT` (default **240 s** — `repo-lint`'s own Go compile gate may take

> build · mimo-v2.6-flash-free
$ cd /data/repo && grep -rn "hunting for a syntax error\|duplicate-version rule\|repeats a version token" tests/ | head; echo "---"; grep -c "repeats a version token" tools/promote-dev-to-prod
tests/test_repo_lint.sh:722:  "CHANGELOG.md repeats a version token" "$P_DOC"
tests/test_repo_lint.sh:749:  "CHANGELOG.md repeats a version token" "$OUT"
tests/test_repo_lint.sh:1549:n=$(grep -cF 'or the committed CHANGELOG.md repeats a version token' "$TOOL")
tests/test_repo_lint.sh:1552:  sed 's|or the committed CHANGELOG.md repeats a version token|or a committed file is unreadable|' "$TOOL" > "$SB/mut10"
tests/test_repo_lint.sh:1558:      *"CHANGELOG.md repeats a version token"*)
tests/test_repo_lint.sh:1607:      *"CHANGELOG.md repeats a version token"*)
tests/test_promote_lint_gate.sh:97:# CHANGELOG.md repeats a version token". These three modes pin that contract.
---
1
> build · mimo-v2.6-flash-free
← Edit repo/tools/promote-dev-to-prod
Index: repo/tools/promote-dev-to-prod
===================================================================
--- repo/tools/promote-dev-to-prod
+++ repo/tools/promote-dev-to-prod
@@ -545,12 +545,14 @@
 
 
 # repo-lint's `failures[].lang` values that mean "this file did not parse, or
 # this file did not compile". Everything else is a lint RULE, not a syntax
-# error — today that is `changelog`, repo-lint's duplicate-version rule, which
-# also exits 1 (see repo-lint's own EPILOG: exit 1 covers "the committed
-# CHANGELOG.md repeats a version token"). Calling that a parse/compile failure
-# sends the reader hunting for a syntax error in a Markdown file.
+# error — today that is `changelog`, which carries BOTH of repo-lint's
+# changelog rules and also exits 1 (see repo-lint's own EPILOG: exit 1 covers
+# "the committed CHANGELOG.md repeats a version token" and, since [0.4.82],
+# "a committed file cites a version that token never wrote"). Calling that a
+# parse/compile failure sends the reader hunting for a syntax error in a
+# Markdown file.
 _SYNTAX_LANGS = frozenset({"php", "bash", "python", "json", "go", "go-compile"})
 
 
 def _lint_failure_verdict(payload) -> str:

> build · mimo-v2.6-flash-free
← Edit repo/tools/repo-lint
Index: repo/tools/repo-lint
===================================================================
--- repo/tools/repo-lint
+++ repo/tools/repo-lint
@@ -108,10 +108,10 @@
     0 - every linted file parses cleanly (and the committed Go module compiles
         and every changelog version it cites exists in the committed
         CHANGELOG.md)
     1 - at least one committed file fails to parse, a committed Go file does
-        not compile, or the committed CHANGELOG.md repeats a version token
-        or a committed file cites a version that token never wrote
+        not compile, or the committed CHANGELOG.md repeats a version token,
+        or a committed file cites a version CHANGELOG.md never wrote
         (see failures[])
     2 - invalid arguments; under `--format json` that is still ONE JSON object
         on stdout (exit_code 2, error naming the bad argument) - never empty
         stdin for a machine reader - while human mode keeps argparse's usage

> build · mimo-v2.6-flash-free
$ cd /data/repo && grep -n "cites a version that token never wrote" tests/test_repo_lint.sh tools/promote-dev-to-prod tools/repo-lint
tests/test_repo_lint.sh:1233:  "cites a version that token never wrote" "$T_DOC"
tests/test_repo_lint.sh:1235:  "cites a version that token never wrote" "$OUT"
tools/promote-dev-to-prod:552:# "a committed file cites a version that token never wrote"). Calling that a
> build · mimo-v2.6-flash-free
← Edit repo/tests/test_repo_lint.sh
Index: repo/tests/test_repo_lint.sh
===================================================================
--- repo/tests/test_repo_lint.sh
+++ repo/tests/test_repo_lint.sh
@@ -1229,11 +1229,11 @@
 run_tool "$SB/repo" --help
 assert_rc "T6: --help exits 0" 0 "$RC"
 T_DOC=$(awk '/^Exit codes:$/{f=1;next} f&&/^$/{exit} f{sub(/^    /,"");print}' "$TOOL")
 assert_contains "T6: the docstring contract names the citation rule" \
-  "cites a version that token never wrote" "$T_DOC"
+  "cites a version CHANGELOG.md never wrote" "$T_DOC"
 assert_contains "T6: --help renders the same sentence (one copy, derived)" \
-  "cites a version that token never wrote" "$OUT"
+  "cites a version CHANGELOG.md never wrote" "$OUT"
 assert_contains "T6: the gate section documents the series fence that keeps fixtures out" \
   "SCOPE is the judgment call" "$OUT"
 
 # T7: leave the sandbox in a state no later section inherits a violation

> build · mimo-v2.6-flash-free
✗ Edit repo/tests/test_repo_lint.sh failed
Error: Could not find oldString in /data/repo/tests/test_repo_lint.sh. It must match exactly, including whitespace and indentation.
> build · mimo-v2.6-flash-free
$ cd /data/repo && grep -n "T6:" tests/test_repo_lint.sh
1227:# T6: the rule is part of the ONE exit-code contract --help renders (derived,
1230:assert_rc "T6: --help exits 0" 0 "$RC"
1232:assert_contains "T6: the docstring contract names the citation rule" \
1234:assert_contains "T6: --help renders the same sentence (one copy, derived)" \
1236:assert_contains "T6: the gate section documents the series fence that keeps fixtures out" \
> build · mimo-v2.6-flash-free
← Edit repo/tools/promote-dev-to-prod
Index: repo/tools/promote-dev-to-prod
===================================================================
--- repo/tools/promote-dev-to-prod
+++ repo/tools/promote-dev-to-prod
@@ -548,9 +548,9 @@
 # this file did not compile". Everything else is a lint RULE, not a syntax
 # error — today that is `changelog`, which carries BOTH of repo-lint's
 # changelog rules and also exits 1 (see repo-lint's own EPILOG: exit 1 covers
 # "the committed CHANGELOG.md repeats a version token" and, since [0.4.82],
-# "a committed file cites a version that token never wrote"). Calling that a
+# "a committed file cites a version CHANGELOG.md never wrote"). Calling that a
 # parse/compile failure sends the reader hunting for a syntax error in a
 # Markdown file.
 _SYNTAX_LANGS = frozenset({"php", "bash", "python", "json", "go", "go-compile"})
 

> build · mimo-v2.6-flash-free
$ cd /data/repo && bash tests/test_promote_lint_gate.sh 2>&1 | grep -E "^FAIL|suite|passed" | tail -5
promote commit-lint gate suite: 143 passed, 0 failed
$ cd /data/repo && python3 -m py_compile tools/repo-lint && bash -n tests/test_repo_lint.sh && echo "syntax ok" && bash tests/test_repo_lint.sh 2>&1 | grep -E "^FAIL|suite:"
syntax ok
repo-lint suite: 324 passed, 0 failed
> build · mimo-v2.6-flash-free
$ cd /data/repo && echo "== repo-lint live =="; tools/repo-lint --format json | python3 -c "import json,sys;d=json.load(sys.stdin);cv=d['changelog_version'];print('exit',d['exit_code'],'files',d['files_total'],'entries',cv['entries'],'seen',cv['citations_seen'],'in_series',cv['citations_in_series'],'missing',len(cv['citations_missing']),'series',cv['series'])"; echo "== queue-source-check =="; tools/queue-source-check; echo "rc=$?"; echo "== source-sync-check =="; tools/source-sync-check; echo "rc=$?"; echo "== inbox-status =="; tools/inbox-status | tail -3
== repo-lint live ==
exit 0 files 192 entries 86 seen 2289 in_series 2246 missing 0 series ['0.1', '0.2', '0.3', '0.4']
== queue-source-check ==
queue-source-check: OK - one queue: [0.4.82] pointer-only, 111 item line(s) frozen across 40 section(s), 51 PROGRESS bullet(s)
rc=0
== source-sync-check ==
source-sync-check  repo=/data/repo  env=both  2026-09-27T02:33:15Z
  dev  examples/workflows       8 files  OK
  dev  src/php                 13 files  OK
  prod examples/workflows       8 files  OK
  prod src/php                 13 files  OK
result: in sync — 42 file(s) across 2 env(s) (exit 0)
rc=0
== inbox-status ==
    open+replied    line 452 - 2026-09-26 investor: agents get matching accounts on Nextcloud + Immich

verdict: OK - nothing owed (0 unread, 1 open entries all replied)
$ cd /data/repo && for t in test_changelog_api.php test_app_version.php test_cli_version.php test_queue_source.sh; do printf "%s: " "$t"; if [[ $t == *.php ]]; then out=$(php tests/$t 2>&1); else out=$(bash tests/$t 2>&1); fi; echo "$out" | tail -2 | tr '\n' ' '; echo; done
test_changelog_api.php:  === Results: 86 passed, 0 failed === 
test_app_version.php:  === Results: 39 passed, 0 failed === 
test_cli_version.php:  === Results: 35 passed, 0 failed === 
test_queue_source.sh: queue-source-check suite: 122 passed, 0 failed ===============================
> build · mimo-v2.6-flash-free

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Sun Sep 27 04:31:41 2026] 127.0.0.1:42900 Accepted
[Sun Sep 27 04:31:41 2026] 127.0.0.1:42900 Closing
[Sun Sep 27 04:33:21 2026] 127.0.0.1:44354 Accepted
[Sun Sep 27 04:33:21 2026] 127.0.0.1:44354 Closing
[Sun Sep 27 04:33:31 2026] 127.0.0.1:40850 Accepted
[Sun Sep 27 04:33:31 2026] 127.0.0.1:40850 Closing
[Sun Sep 27 04:33:31 2026] 127.0.0.1:40866 Accepted
[Sun Sep 27 04:33:31 2026] 127.0.0.1:40866 Closing
[Sun Sep 27 04:33:31 2026] 127.0.0.1:40872 Accepted
[Sun Sep 27 04:33:31 2026] 127.0.0.1:40872 Closing
[Sun Sep 27 04:33:31 2026] 127.0.0.1:40884 Accepted
[Sun Sep 27 04:33:31 2026] 127.0.0.1:40884 Closing
[Sun Sep 27 04:33:36 2026] 127.0.0.1:35116 Accepted
[Sun Sep 27 04:33:36 2026] 127.0.0.1:35116 Closing
[Sun Sep 27 04:33:50 2026] 127.0.0.1:56840 Accepted
[Sun Sep 27 04:33:50 2026] 127.0.0.1:56840 Closing
[Sun Sep 27 04:33:50 2026] 127.0.0.1:56854 Accepted
[Sun Sep 27 04:33:50 2026] 127.0.0.1:56854 Closing
[Sun Sep 27 04:33:53 2026] 127.0.0.1:56856 Accepted
[Sun Sep 27 04:33:53 2026] 127.0.0.1:56856 Closing
[Sun Sep 27 04:33:53 2026] 127.0.0.1:56868 Accepted
[Sun Sep 27 04:33:53 2026] 127.0.0.1:56868 Closing
[Sun Sep 27 04:33:53 2026] 127.0.0.1:56872 Accepted
[Sun Sep 27 04:33:53 2026] 127.0.0.1:56872 Closing
[Sun Sep 27 04:33:53 2026] 127.0.0.1:56882 Accepted
[Sun Sep 27 04:33:53 2026] 127.0.0.1:56882 Closing
[Sun Sep 27 04:33:53 2026] 127.0.0.1:56890 Accepted
[Sun Sep 27 04:33:53 2026] 127.0.0.1:56890 Closing
[Sun Sep 27 04:34:08 2026] 127.0.0.1:44584 Accepted
[Sun Sep 27 04:34:08 2026] 127.0.0.1:44584 Closing
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44592 Accepted
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44592 Closing
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44606 Accepted
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44606 Closing
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44620 Accepted
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44620 Closing
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44632 Accepted
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44632 Closing
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44638 Accepted
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44638 Closing
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44644 Accepted
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44644 Closing
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44650 Accepted
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44650 Closing
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44658 Accepted
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44658 Closing
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44666 Accepted
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44666 Closing
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44676 Accepted
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44676 Closing
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44688 Accepted
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44688 Closing
[Sun Sep 27 04:34:09 2026] 127.0.0.1:44696 Accepted
[Sun Sep 27 04:34:10 2026] 127.0.0.1:44696 Closing
[Sun Sep 27 04:34:10 2026] 127.0.0.1:44704 Accepted
[Sun Sep 27 04:34:10 2026] 127.0.0.1:44704 Closing
[Sun Sep 27 04:34:10 2026] 127.0.0.1:44710 Accepted
[Sun Sep 27 04:34:10 2026] 127.0.0.1:44710 Closing
[Sun Sep 27 04:35:41 2026] 127.0.0.1:42560 Accepted