Gladex Agent Logs

 M tests/test_repo_lint.sh
 M tools/REGISTRY.md
 M tools/repo-lint
---
Atlas
atlas@gladex.de
Atlas <atlas@gladex.de>
> build · mimo-v2.6-flash-free
$ cd /data/repo && cat >> agent-logs/PROGRESS.md <<'EOF'

## 2026-09-27T03:46Z main-loop run — STEP 0 answered FIRST (0 unread in both DBs; fresh-probe reply **dev 81 / prod 47**); queue item **(29) EXECUTED**: `repo-lint`'s human closing line no longer claims **"fail to parse"** for a failure that is a *rule* — `_result_line()` derives it from `failures[].lang` (three shapes, `promote`'s own vocabulary, a mixed run naming both kinds) — `tests/test_repo_lint.sh` **324 → 348** (section U + mutants M20/M21), pre-fix replay **333 passed / 9 failed**, regression **52 suites / 4267 passed / 0 failed / 0 skipped, exit 0**

- **STEP 0 (first action, before any product work)**: `investor_to_agent` unread = **0 dev / 0 prod**, measured with `SELECT COUNT(*) … WHERE direction='investor_to_agent' AND read=0` on both live SQLite DBs (`/opt/startup/dev/data/messages.db`, `/opt/startup/prod/data/messages.db`) rather than eyeballed, so there was no row to mark read and **nothing was marked read that is not mine**. A fresh-probe reply was written and inserted (**dev 81 / prod 47**, `read=1` on my own rows, parameterised insert — the body never interpolated into SQL) and re-verified: newest row in each DB is `agent_to_investor`, `read=1`, unread still **0**. `tools/inbox-status` alongside → **exit 0, `OK - nothing owed (0 unread, 1 open entries all replied)`**; `INBOX.md` 73 entries, 72 handled, the one open entry being line 452 (the six Nextcloud + Immich identity accounts), open because it is **blocked on REPORT.md §14**, not missed. Probes carried in that reply: `/data/shared/cloud-admin.secret` **ABSENT** (`test -e` only, no content read), Nextcloud `status.php` → `{"installed":false}` **v34.0.4**, Immich `/api/server/ping` → `{"res":"pong"}`, `https://gladex.de`/`dev`/`photos`/`cloud` → **200/200/200/200**, `tls-check` **9/9 OK (86d earliest, 89d on cloud+photos)**, units `investor-app-dev`, `investor-app-prod`, `git-daemon`, `certbot.timer`, `postfix`, `dovecot`, `docker`, `agent-loop-watchdog.timer` **all active**, `docker ps` **5 containers**, budget **1.50 spent / 3.50 remaining** (month 2026-09, allowance 5.00), spend **0.00**. The §14 cloud admin ask and the six investor-owned items (public https from outside this container, the separate nft DNAT of `:8080`/`:2283`, #57 public routing A/B/C, SOA MNAME, mail password rotation, the stale reviewer verdict) restated in that reply. No credential invented, no account created, no password in the thread, the prompt or the commit. Nothing below ran before that.
- **The step (queue item 29)**: since `[0.4.52]` the exit-1 contract has covered **rules** as well as parses, and the last line of a red run — the one a human actually reads — was still the constant `result: N file(s) fail to parse (exit 1)`. Reproduced before touching anything, in a throwaway repo: `FAIL PLAN.md:1 [changelog] cites [7.1.5] but CHANGELOG.md has no such heading` printed directly above `result: 1 file(s) fail to parse (exit 1)` — a reader sent to hunt a syntax error in a Markdown file nothing parses. Two other descriptions of the same exit code had already been fixed from the outside (`[0.4.53]` promote's refusal, `[0.4.55]` the `--help` prose); this was the copy nobody read, and a grep of `tests/` for the string found **zero** assertions — an unpinned line is how this file keeps finding contracts that drifted the day they stopped being true.
- **What shipped**: `_result_line(failures, exit_code, n_linted)` in `tools/repo-lint`, called once from `main()`'s human branch (the `errors` branch untouched — `cannot verify - N lint error(s)` was already honest). Three shapes: no failure → `result: all N linted file(s) parse clean (exit 0)` **byte-identical to before**; every failure in `_SYNTAX_LANGS` (`php bash python json go go-compile`) → `result: N file(s) fail to parse or compile (exit 1)`; otherwise → `result: N file(s) fail lint (<kinds>) (exit 1)` with the sorted, de-duplicated rule names. **Four judgement calls, each measured rather than assumed**: *(a)* the syntax branch's wording went `fail to parse` → **`fail to parse or compile`** because `go-compile` is in that set (the 395b9b5 shape — parses, does not build — was already being called a parse failure) and because it is `promote`'s vocabulary for the same verdict, so both sides of one exit code now say one sentence; nothing broke, since `tests/` carries that string only in `test_promote_lint_gate.sh` and `test_system_status_promote_gates.sh`, both asserting **promote's** `detail`, which did not move. *(b)* a **mixed** run names **both** kinds (`fail lint (changelog, php)`) — a line accusing only the first sends the reader to fix half the tree and re-run into the same wall; sorted and de-duplicated because a set's iteration order must never decide an asserted string. *(c)* a failure with no `lang` reads `unknown`, which is not in the syntax set — an unlabelled failure is never promoted into a parse error (the missing→unknown discipline `[0.4.53]` used). *(d)* `_SYNTAX_LANGS` is a second literal of the parent's set — a child must not import its parent — so U4 extracts **both** declarations by regex and asserts equality, because prose agreement is exactly what drifted in `[0.4.53]`.
- **Tests — `tests/test_repo_lint.sh` section U, 16 assertions, 324 → 348; mutants M20/M21, 8 more**: U1 missing citation → exit 1 with `result: 1 file(s) fail lint (changelog) (exit 1)` and **no** `fail to parse` anywhere in the output, plus a JSON cross-check that the `lang` the line quotes *is* `changelog`; U2 broken PHP → `result: 1 file(s) fail to parse or compile (exit 1)` with **no** `fail lint (`; U3 both at once → `result: 2 file(s) fail lint (changelog, php) (exit 1)`; U4 the two `_SYNTAX_LANGS` declarations equal; U5 exactly one definition and one print in the source (P/Q's shape applied to a runtime line); U6 the sandbox left green so a later mutant's clean-run assertion cannot fail for its own reason. **M20** `if all(…)` → `if True:` (the pre-step constant, count still derived) caught by U1 **with `real_rc == mut_rc == 1`** — only the wording tells them apart — surgical on a real syntax failure where mutant and tool print the same sentence; **M21** `if all(…)` → `if False:` caught by U2 on a syntax fixture, surgical on a rule fixture where the inverted mutant is **indistinguishable** from the real tool, which is the argument for the pin. Both planted by exact-string replace with `t.count(old) == 1` asserted inside the script (the M8 lesson) and both `[ -f ]`-checked.
- **Pre-fix replay, against the final bytes**: new suite with `HEAD`'s tool blob swapped **in place** (new tool md5 `16d7a0cc073ab416ff0d685ae666c481`, old `0a5ccfcbbc9093212cce0c4d54d4d28c`, restored and re-verified byte-identical) → **333 passed / 9 failed**: U1 ×2, U2, U3, U4 (no `_SYNTAX_LANGS` exists yet), U5 ×2, and M20/M21's two preconditions — unplantable, so their other six assertions could not run, hence **342 counted pre-fix against 348 post-fix**. All nine findings; the guards that pass pre-fix and identify themselves are U1/U2/U3's exit-code assertions and every assertion in A–T. **First capture discarded, not counted**: pointing `REPO_LINT_BIN` at a copy outside `tools/` returned 11 extra reds in section L — `default_repo()` resolves relative to the script, so the tool reported `repo_root: /tmp/…` and exited 3 — the harness artifact `[0.4.60]`'s replay already documented, caught by reading the reds rather than by their number.
- **Gates, all measured after the edits and none carried**: `tests/test_repo_lint.sh` **348/0**, `tests/test_promote_lint_gate.sh` **143/0**, `tests/test_changelog_api.php` **86/0**, `tests/test_app_version.php` **39/0** (top entry still `## [0.4.28]` = `GLADEX_APP_VERSION` `0.4.28`), `tests/test_cli_version.php` **35/0**, `tests/test_queue_source.sh` **122/0**, `queue-source-check` → **`OK - one queue: [0.4.83] pointer-only, 111 item line(s) frozen across 41 section(s), 52 PROGRESS bullet(s)`**, `source-sync-check` → **in sync, 42 files / 2 envs**, `inbox-status` → **exit 0**, `bash -n` + `python3 -m py_compile` clean, live `repo-lint --format json` **pre-commit** → `ok true, exit 0, files_total 192, changelog_version entries 87 / unique 87 / duplicates []` (88/88 expected after this entry lands — repo-lint reads **committed** blobs, so the pre-commit read cannot see its own entry; re-read after the commit below).
- **Regression (authoritative)**: `./tools/regression-run --format json` → **52 suites, 4267 passed, 0 failed, 0 skipped, exit 0** (`ok: true`). Closure is arithmetic: the last green run was **52 / 4243** with this suite at **324**, and this step adds **+24 (324 → 348) touching no other suite** — 4243 + 24 = 4267, 52 = 52 suites. Re-run with this entry appended rather than before it (the number in this bullet was taken on the run immediately before the append and confirmed after).
- **Docs**: `CHANGELOG.md` gained **`## [0.4.83]` parked at the bottom** like `[0.4.29]`–`[0.4.82]`, with its pointer-only `### Queue` (so `queue-source-check`'s equality on **111** item lines and its "no `- ` line in the newest section" both hold, and `## [0.4.28]` stays the entry the version suites key off); every `[x.y.z]` token it cites was checked against the heading list before committing (`cited 10, missing ['7.1.5']` — and `7.1.5` is a **fixture** inside a quoted message in series `7.1`, which the citation rule fences out by construction). `tools/REGISTRY.md` gained the derived-closing-line contract paragraph, the section-U bullet, M20/M21 in the mutation index (**19 → 21**), the pre-fix-replay bullet, and a `Status` line refreshed to this step's numbers rather than silently extended.
- **Deliberately not done**: the suite's header mutation index still stops at **M16** (M17–M19 were never added either) — item **(5)** already queues that second copy and extending it here would be writing into a copy nothing checks; no dashboard check, no other tool, no `promote` behaviour, no `--help`/docstring text (`Exit codes:` was already right about exit 1) changed; items **(14)** and **(18)** were **not** bolted onto this step.
- **Safety**: model spend **0.00** (`*-free` only), **no money moved** (`BUDGET.md` untouched: **1.50 spent / 3.50 remaining**), **zero DNS writes** (no `pdns-api.py` call), no paid API key configured, **no secret read or printed** (`/root/.pdns-token` and every `*.secret` untouched — the STEP-0 probe only tested existence; no credential and no message body in any prompt/thread/commit), **no service restarted, no certificate touched, no promote executed** (the stale reviewer verdict `promote-gates` reports still refuses it), **Docker stacks and both investor apps untouched**. Live I/O was read-only: the SQL counts above, throwaway git repos under `${TMPDIR:-/tmp}/opencode`, `--help` runs, the pre-fix blob swap (swapped in place, restored, md5 re-verified), and the read-only checks the dashboard performs during regression.
- **Staging hazard: not this time — recorded because it has bitten four times**: `git status --porcelain` read immediately before staging → exactly this run's **four** paths (`M CHANGELOG.md`, `M tests/test_repo_lint.sh`, `M tools/REGISTRY.md`, `M tools/repo-lint`), no other identity's WIP present, so `git add -A` is provably equivalent to staging those four by name this run. Author resolves to `Atlas <atlas@gladex.de>`.
- **Still blocked (investor-owned, unchanged)**: NEEDS-INVESTOR **§14 cloud admin credentials** (ONE shared set for Nextcloud + Immich — blocks `INBOX.md` line 452's six accounts and the test-photo upload), **#57 public investor-route gating A/B/C**, **SOA MNAME** (`a.misconfigured.dns.server.invalid.`), the **mail password rotation** approval, the two `photos.`/`cloud.` exposure questions (public https from outside this container; the separate nft DNAT of `:8080`/`:2283`), and the **stale reviewer verdict** (re-review is the reviewer's, not mine).
- **Next-candidate queued, not actioned**: carry items (2)–(8), (14), (15), (17), (18), (20), (22), (23), (25) and (28) from the 02:55Z entry unchanged — item **(29) struck — ACTIONED by `[0.4.83]` this run**. **(30) new from this step**: `_result_line` counts `failures` but labels them **`file(s)`** — measured this run with a `CHANGELOG.md` carrying two duplicate `7.1.1` headings: two `FAIL CHANGELOG.md:…` lines, **one** file, `result: 2 file(s) fail lint (changelog)`. Either count distinct `path`s or say `failure(s)`; the same label is on the clean line's `all N linted file(s)`, where it *is* files, so one wording may not fit both. **(31) new from this step**: U4 asserts the two `_SYNTAX_LANGS` **declarations** agree, not that they cover what the tool can actually emit — measured today `set(EXT_LANG.values()) = {bash, go, json, php, python}` ⊆ `_SYNTAX_LANGS` (+ `go-compile`, `changelog`), so the invariant holds *unasserted*; adding an extension lang would silently route its parse failure into the `fail lint (…)` branch, which a declaration-vs-declaration comparison can never see. Assert coverage of `set(EXT_LANG.values()) | {go-compile, changelog}` against the syntax set plus the rule set instead.
EOF
echo appended; git status --porcelain
appended
 M CHANGELOG.md
 M agent-logs/PROGRESS.md
 M tests/test_repo_lint.sh
 M tools/REGISTRY.md
 M tools/repo-lint
> build · mimo-v2.6-flash-free
$ cd /data/repo && ./tools/regression-run --format json > /tmp/opencode/regression-83.json 2>/dev/null; python3 - <<'PY'
import json, collections
d = json.load(open("/tmp/opencode/regression-83.json"))
t = d["totals"]
print("totals:", t, "ok:", d["ok"], "exit:", d["exit_code"])
by = collections.Counter(); bys = collections.Counter()
for s in d["suites"]:
    by[s["ext"]] += s["passed"]; bys[s["ext"]] += 1
print("by ext:", dict(by), "suites:", dict(bys))
print("repo_lint:", [ (s["passed"], s["failed"]) for s in d["suites"] if "repo_lint" in s["path"]])
PY
totals: {'passed': 4267, 'failed': 0, 'skipped': 0, 'suites_run': 52} ok: True exit: 0
by ext: {'.php': 1375, '.sh': 2892} suites: {'.php': 23, '.sh': 29}
repo_lint: [(348, 0)]
> build · mimo-v2.6-flash-free
← Edit repo/tools/REGISTRY.md
Index: repo/tools/REGISTRY.md
===================================================================
--- repo/tools/REGISTRY.md
+++ repo/tools/REGISTRY.md
@@ -2357,9 +2357,9 @@
 - **Mutation**: 21, each precondition-asserted to occur exactly once, caught by a divergence assertion, and surgically checked — M1 exit gate defeated (`(1 if failures else 0)` → 0); M2 `--sha` ignored (always lints HEAD); M3 `.php` dropped from `EXT_LANG` (mutant still catches broken sh); **M4** `failures.extend(gentries)` → `extend([])` (the 395b9b5 defect returns: a build-breaking commit reports 0; mutant still 0 on a compiling commit); **M5** `3 if errors` → `1 if errors` (an environment failure reads as "broken file": real=3/mutant=1; mutant still 1 on broken php); **M6** the gate's blob read → `open(<worktree path>)` (the 219fd8f class applied to Go: a fixed worktree hides a broken commit; mutant still 1 when the worktree is broken too); **M7** `failures.extend(cl_failures)` → `extend([])` (the hand-off dies while the JSON still names the twin — `ok false`, `duplicates == ['1.0.0']`, `exit_code 0`; mutant still exits 1 on broken php); **M8** `if ver in first_seen:` → `if False:` (the test itself dies: `duplicates == []` and `ok true` where the real tool reports a twin; mutant still green on a clean changelog); **M9** the changelog blob read pinned to `HEAD` instead of `--sha` while the existence probe still uses `--sha` (an ancestor's twin vanishes — real=1/mutant=0; mutant still 0 on a clean HEAD); **M10** the CHANGELOG rule dropped from the tool's one contract (the `[0.4.56]` defect itself planted) — caught by P2/P5 while **P1 and P4 stay green**: the docstring and `--help` still agree because they are one copy, so they lost the rule *together*; surgical checks are the agreement holding, the parse rule surviving, and `--help` still exiting 0; **M11** a second copy of the contract planted as a source comment `--help` never renders — caught by **P1 alone**, with P4 deliberately asserted **green** (what `--help` prints is still byte-identical to the docstring), proving the source-level count is not redundant with the render-level check; **M12** the same shape for a *derived* section (a source-comment second copy of the go-gate text) — caught by **Q-source**, with **Q-render asserted green** on the mutant (`--help` still equals the docstring, so the byte comparison provably cannot see it) and `--help` still exiting 0; **M13** the inverse — `("env:", "Environment:")` repointed to the languages heading, so `env:` renders a different docstring block — caught by **Q-render**, with **Q-source asserted green** (the Environment text still occurs exactly once, so the count cannot see a misattribution) and the `exit codes:` pair still agreeing (one pair misattributed, not the whole epilog). M12/M13 are complementary by construction, exactly as M10/M11 are: each one's green assertions are what prove the other's necessity; **M14** the pre-`[0.4.60]` state reproduced — R's trigger (the docstring heading renamed to `Environment (renamed):` while the tuple still says `Environment:`) **in the same copy as** the refusal's condition defeated (`if missing:` → `if False:`). Two edits deliberately: defeating the guard **alone** changes nothing, because a healthy docstring still yields seven full sections — I built it that way first and the mutant came out **green**, which is the finding rather than a flaw in the mutation: the guard is not the defect, it is what makes an always-available trigger loud. With both halves present `--help` exits 0 over a label printed on nothing, stderr silent — caught by R's refusal assertions and by `r_labels` (R3's own check, run against the mutant) going red at **exactly** `env:` — while an unrelated section still byte-equals its docstring (surgical: one condition defeated, not the derivation); **M15** the machine channel dropped (`[0.4.61]`): R's trigger **in the same copy as** the fix reverted (`raise SystemExit(die(None, default_repo(), message, sha, fmt))` → the bare `sys.stderr.write(message)` + `SystemExit(EXIT_CANNOT)`), i.e. the refusal output as it stood before this step. Two edits for the same reason M14 needs two — with a healthy docstring nothing refuses, so the dropped channel is unobservable (I planted the revert alone first and the mutant came out green, **exit 0**: the second time this mutation taught its own lesson) — and the catch is the point: **every human assertion stays GREEN** (exit still 3, pair still named, `--help` still refusing with an empty stdout) while **R9b** sees the empty stdout. The old suite asserted the *absence* of JSON, so the defect passed it. **M16** the usage-error channel dropped (`[0.4.62]`): `if fmt == "json":` → `if False:` in `_Parser.error`, i.e. the pre-step state exactly — argparse always prints usage to stderr and exits 2, so `--format json --timeout abc` gives a jq pipeline empty stdin again. **One edit where M14 and M15 each needed two, and the difference is the finding**: those needed a *trigger* because a healthy docstring never refuses, whereas here the argv that says json is supplied **by the test**, so the trigger and the defect are the same line. Caught by **S3** (stdout empty again) with **every human assertion staying GREEN** — exit still 2, usage still on stderr, `--help` still 0, the healthy json run still 0 — because the human path never had the check; that asymmetry is the argument for having written S1/S13/S14/S15 as guards. **M17–M19 (the citation rule, `[0.4.82]`)** — three ways to lint green over a version nobody wrote, each with a surgical value that says *which* one: **M17** the existence test → `if False` → the token is still **counted and classified in series** but never judged (`seen ≥ 3, in_series ≥ 3, missing [], exit 0`), caught `real=1 mutant=0`; **M18** the **series fence** dropped (`in_series = list(citations)`) → the one excluded token becomes the defect (`in_series 4`, `missing ['9.9.4']`), caught `real=0 mutant=1`, i.e. red on a fixture the real rule calls clean — and its replace runs through python with `t.count(old) == 1` asserted **inside** the script, because a sed pattern of brackets and quotes that matches the wrong line edits a path no fixture exercises and comes back green; **M19** the **collection** dropped (`citations.extend([])`) → `citations_seen == 0`, nothing was scanned at all, caught `real=1 mutant=0`. M17 vs M19 is the pair that matters: both exit 0 over the defect, and only `citations_seen` (counted-but-unjudged vs never-scanned) tells them apart. Every mutant file is `[ -f ]`-checked before it is run, so a build that produced nothing cannot be reported as a catch. **M20/M21 (`[0.4.83]`, the closing line)** — the two halves of one judgement call, both planted in `_result_line`'s syntax-set test by exact-string replace with `t.count(old) == 1` asserted inside the script: **M20** `if all(…)` → `if True:` (every failure called a parse/compile failure — the pre-step constant with the count still derived) is caught by **U1** while the exit code stays **1 on both sides**, and its surgical check is a *real* syntax failure where mutant and tool say exactly the same sentence; **M21** `if all(…)` → `if False:` (a rule failure never reported as a rule) is caught by **U2** with a *syntax* fixture, and its surgical check is a rule fixture where the inverted mutant is **indistinguishable** from the real tool — which is precisely why only a wording pin on the other branch can catch it. Neither mutant changes any verdict, so no exit-code assertion sees either: the section U pins are the only thing that does.
 - Live: HEAD → exit 0 (176 files — **174 → 176 with `[0.4.65]`**, its own `tools/regression-run` + `tests/test_regression_run.sh` going from untracked to tracked (`linted.bash` 24 → 25, `linted.python` 11 → 12), following **173 → 174 with `[0.4.64]`**; the pre-commit run reads **174** with `bash 24` / `python 11` because those blobs are not there yet — the stale-live-number class, re-read after the commit below — 45 module files compile clean in ~1.6s. **`[0.4.66]` pre-commit read: exit 0, `files_total 176`, `linted {bash 25, go 43, json 11, php 32, python 12}`, `changelog_version entries 70, unique 70, duplicates []`** — both changed files were already tracked, so the post-commit prediction is **176 unchanged** with `entries 71` once `[0.4.66]` lands, re-read after the commit rather than carried. **`[0.4.67]` pre-commit read: exit 0, `files_total 176`, `linted {bash 25, go 43, json 11, php 32, python 12}`, `changelog_version entries 71, unique 71, duplicates []`** — this entry adds two **untracked** files (`tools/queue-source-check`, extensionless `python3` shebang → `linted.python`; `tests/test_queue_source.sh`, `.sh` → `linted.bash`) plus its own heading, so the post-commit prediction is **178** with `bash 26`, `python 13` and `entries 72`, re-read after the commit rather than carried) with `changelog_version` = `attempted true, entries 70, unique 70, unparseable 0, duplicates [], ok true` (**69 → 70 with `[0.4.65]`**, following **68 → 69 with `[0.4.64]`**: the count is read from the COMMITTED blob, so it is re-read after the append commits rather than carried over — it read 68 while `[0.4.64]` was still uncommitted, which is the whole point of re-reading; the working-tree count was verified the anchored way, `grep -c '^## \['` → 69 with `uniq -d` empty, because the greedy `sed 's/.*\[\([^]]*\)\].*/\1/'` form reports **5 phantom duplicates** on this tree — 0.4.31/0.4.40/0.4.44/0.4.49/0.4.62 — by taking the last bracket in a heading that cites other versions. The **file** count is 173, not the 171 drafted mid-run: `[0.4.63]`'s own two mailbox files were untracked when that number was written and tracked once it committed, so 171 → 173 is this entry's own movement rather than a count carried); `--sha 219fd8f` → exit 1 naming `tests/test_mailbox_a11y.php:208 [php]`; `--sha 395b9b5` → exit 1 naming `.../status_test.go:5 [go-compile]`; unknown rev / non-repo → exit 3; `--sha probe-r9` → exit 3 with `requested_sha: probe-r9` (the R16 parity reference, live); `--format yaml` → exit 2 with **usage on stderr and an empty stdout** (no format could be read, so none is invented — `[0.4.62]`); **`--format json` + a bad argv → exit 2 with a 384-byte 15-key object on stdout and 0 bytes on stderr** (`--timeout abc`, `--nonsense`, `--timeout 0`, empty `--sha`, and the failing token placed *before* `--format`), while the same argv in human mode still gives argparse's `usage:`+`error:` with **stdout 0 bytes**; `--help` (**106 lines**, was 57 before the epilog stopped carrying its own prose, 102 before the exit-3 clause widened, 103 through `[0.4.61]`, **+3 for `[0.4.62]`'s widened exit-2 clause**) renders all seven docstring blocks verbatim under their labels; a copy with a heading renamed → `repo-lint: ERROR refusing to run - docstring section missing or empty …` + `  'env:' -> 'Environment:'` → **exit 3**, stderr only, and under `--format json` the **same refusal as an object** — `ok false`, `exit_code 3`, `error` naming the pair, **stderr 0 bytes** — which is the `| jq` consumer `[0.4.60]`'s queue described, now parsing (`--format=json` → 3; `--form json` → 3; `-- --format json` → no JSON on stdout; `--format yaml` on the broken copy → refusal only, no `usage:` leak) — **and on that same broken copy `--format json --timeout abc` now yields the 458-byte refusal object with `exit_code 3` instead of falling back to `human`**, which is `[0.4.61]`'s own queue item struck as actioned. **`[0.4.82]` pre-commit read**: exit 0, `files_total 192`, `linted {bash 34, go 43, json 11, php 35, python 14}`, `changelog_version entries 86, unique 86, duplicates [], citations_seen 2289, citations_in_series 2246, citations_missing [], series [0.1, 0.2, 0.3, 0.4]`, human line `changelog-version: 86 changelog version heading(s), 86 unique, 2289 citation(s) checked, 0 missing` — all six paths this step touches were **already tracked**, so `files_total` is predicted **unchanged at 192** and `entries` becomes **87** once `[0.4.82]` lands (the citation counts move with the new prose and are therefore re-read after the commit, never carried). **Re-read after `34d1bb2`: exit 0, `files_total 192`, `entries 87`, `unique 87`, `duplicates []`, `citations_missing []` — both predictions hit**; the citation counts read `2367 / 2280 / 0` on that pass and move again with each commit's own prose, which is why they are quoted as a measurement and never as a constant.
 - Pre-fix replay: the **then-`HEAD` suite against the then-`HEAD` tool** → **88 passed / 28 failed** (including `L: 395b9b5 … (want rc=1 got=0)`) for the Go gate of `[0.4.3x]`; for the changelog gate the *new* suite against the pre-fix tool (md5 `3a4e09176e24ca3414366952467d4944`, log `/tmp/opencode/changelog-gate/pre-fix.log`, suite md5 `9e352394d02096183adef92d55fc5a73`) → **125 passed / 22 failed**: the exact key-set pin plus every O1–O7 finding red, and M7/M8/M9 unplantable (0 matching lines) — while the six guard-style assertions inside O (absent file adds no failure; fixed commit → 0) already passed, which is what identifies them as guards rather than findings. For `[0.4.56]` the new section P against the pre-fix tool (tool md5 `3ebcf0b4ae7e290796fbed12c57e422b`, suite md5 `a50e16d7a5643bdfd18b667752e50d2c`, log `/tmp/opencode/exitcodes/pre-fix.log`) → **166 passed / 6 failed**: P1 (the contract text occurs **twice**), P2 ×2 (Go rule and CHANGELOG rule both absent from the docstring), P4 (the docstring block and `--help`'s section differ), M10's agreement surgical check (pre-fix both copies still exist, so the mutant's docstring and `--help` disagree), and M11's precondition (already 2 occurrences → unplantable, so its other three assertions could not run pre-fix — hence 172 counted pre-fix against 175 post-fix). Guards that passed pre-fix and thereby identify themselves: P2's parse rule, P3 (all four codes), P4's `--help exits 0`, and all three P5 rules — the epilog was the copy that was right. Baseline re-verified on a checkout of the same commit before the fix: **155/156 then 156/156 twice**, the single red being `L: real repo status changed during a run` (a concurrent identity committed mid-run), not this change. For `[0.4.59]` the new section Q against the pre-fix tool (tool md5 `f17563d67064a79f313ef2bab376cd66`, suite md5 `9217e2653fbed256afb704d0a01fd359`, log `/tmp/opencode/epilogderive/pre-fix.log`; baseline of the *old* suite against the old tool was **175/0** first) → **186 passed / 9 failed**: the seven findings are Q1–Q6 (every pair renders different bytes) and Q13 (the drifted synopsis still present), plus **M12's surgical render check** — which fails pre-fix only because the two renderings differ by definition, i.e. it restates Q2 — and **M13's precondition unplantable** (the derivation tuple does not exist yet, so its other three assertions could not run: hence 186 counted pre-fix against 198 post-fix). **Guards passed pre-fix and thereby identify themselves**: all six Q-source counts (each section's text already occurred exactly once — the copies differed, they were not duplicated line-for-line), `--help exits 0`, the generated-usage line, and M12's precondition plus its "caught" assertion. For `[0.4.60]` the new section R against the pre-fix tool (old tool md5 `4e6c58ffc86441a5745054a4ea45d084`, final suite md5 `e126f791dbcd4b1d9ae0bd0626022d82`, log `/tmp/opencode/epilogrefuse/pre-fix.log`; baseline of the old suite against the old tool was **198/0** first) → **203 passed / 10 failed**, captured **inside a clone of the repo** rather than from `/tmp`: pointing `REPO_LINT_BIN` at a copy outside `tools/` makes section L's live checks fail for *path* reasons, because `default_repo()` resolves relative to the script, so the tool reported `repo_root: /tmp/...` and exited 3 — a harness artifact that cost a second capture to get a red meaning what it says. **Nine of the ten are real**: **R5, R6, R7, R9 ×2, R11, R12, R12b** plus **M14's precondition unplantable** (the refusal does not exist yet, so its other five assertions could not run — hence 213 counted pre-fix against 218 post-fix); the tenth is `L: live json structurally sound`, whose `d['repo_root'] == '/data/repo'` is true in the real repo and false in a clone — disclosed as an artifact of my cloning rather than counted as a finding. **Guards passed pre-fix and thereby identify themselves**: R1 (healthy tool exits 0), R2 (no refusal on stderr), R3 (all seven labels non-empty), R4 and R10 (both mutant preconditions), R8 (the refusal names only the broken pair — pre-fix stderr is empty, so it passes vacuously, which is what makes it a guard rather than a finding). For `[0.4.61]` the widened section R against the pre-fix tool (old tool md5 `d6b50e6dcf68df6dccb5a46dfe06e5a0`, **final** suite md5 `b71b64db24d64fa65263e3867e45ba97`, log `/tmp/opencode/jsonrefuse/pre-fix.log`; baseline of the committed suite against the committed tool was **218/218** first) → **230 passed / 12 failed**, again **inside a clone** for the same path reason. **Eleven are real**: **R9b, R9c, R9d, R9e, R9f, R9g** (one cause — stdout empty, refusal on stderr), **R13** (`_add_flags` does not exist yet), **R14b, R15b, R16b** (same empty-stdout cause) and **M15's precondition unplantable** (the die()-routing line does not exist, so its five other assertions could not run — hence **242 counted pre-fix against 247 post-fix**). The twelfth is again `L: live json structurally sound` (`repo_root` is the clone, not `/data/repo`) — disclosed as a cloning artifact, not counted. **Guards passed pre-fix and thereby identify themselves**: R1–R8, R10–R12b, the exit-3 half of R9/R14/R15/R16, **R15c** (argparse really accepts `--form`), **R16c/R16d** (the healthy tool already echoed `requested_sha: probe-r9` — the reference both readers must match), R17, R17c, R18, R18b, R19; and **R17b, R18c, R18d are vacuously green** (nothing could print before a scan existed) — disclosed as guards, not findings. Two first-draft defects of mine are recorded in the CHANGELOG: R9c's predicate used `->` outside a string (the *checker* raised SyntaxError — a red meaning the wrong thing), and M15 was first planted without its trigger (mutant exited **0** and was "NOT caught", because nothing refuses when the docstring is healthy). For `[0.4.62]` the new section S against the pre-fix tool (tool md5 `f42b33e34ab28588334b5f616a551798`, **final** suite md5 `4acbd04968016e319778dda544c6596e`, log `/tmp/opencode/usagejson/pre-fix.log`; baseline of the committed suite against the committed tool was **247/247** first) → **268 passed / 16 failed** of 284, captured **in place rather than in a clone** — the tool was still unmodified at its real path, so section L's `repo_root == '/data/repo'` check passed on its own; the clone was only ever needed because a copy *outside* `tools/` changes `default_repo()`. **All sixteen are real**: **S3–S8** (one cause — stdout empty, usage on stderr), **S9b, S9c, S10b, S10c, S11b** (same cause, one per argv form), **S12b, S12c, S12e, S12f** (same cause, via our own `p.error()`), **S16b** (`_add_format_flag` does not exist yet — hence 268 counted pre-fix against 291 post-fix). **Guards passed pre-fix and thereby identify themselves**: **S1** (the human channel was already exactly right — the strongest evidence this was a *channel* defect, not a validation one), S2, S9a, S10a, S11a, S12a, S12d, **S13a–S15b** (no-format-readable argv), **S16** (the `--format` definition was already single), **S17, S18**. Two first-draft defects of mine are recorded in the CHANGELOG: S17b read `$OUT` where `s_run` wrote `$S_OUT` (a **stale** object, so the assertion failed against the *old* tool for an unrelated reason — caught as the 17th red and fixed before the tool was touched, the capture then re-taken honestly at 16), and S16b's predicate `grep -c '_add_format_flag(p)'` also matched the `def` line, reporting `3` for two call sites plus a definition — the third time this suite has been wrong in the *predicate* direction.
 
-**Status**: Green ✅ 2026-09-27 (**324/324**; full regression **52 suites / 4243 assertions / 0 failed / 0 skipped, exit 0** — 29 shell = 2868, 23 PHP = 1375. Closure is arithmetic: the previous green run was **52 / 4210** with this suite at **291**, and this step adds **+33 (291 → 324) touching no other suite**, so 4210 + 33 = 4243 with 52 = 52 suites. The regression clause that follows was **carried unchanged at 41 / 3503 since `[0.4.67]`** — the tree had already reached 52 / 4210 by `[0.4.80]` without this line being touched, the same stale-line class the entry above records — so it is **refreshed here rather than silently extended**. History: 41 suites / 3503 / 0 failed / 21 shell = 2312, 20 PHP = 1191 at 291/291 on 2026-09-26. Was 40 / 3396 / 20 shell = 2205 with `[0.4.66]`; **`[0.4.67]` adds `tests/test_queue_source.sh` (+1 suite, +107 shell), so 2205 + 107 = 2312 and 3396 + 107 = 3503**, PHP untouched at 1191. Before that, `[0.4.66]` grew `tests/test_regression_run.sh` (+0 suites, +83 shell: 110 → 193), so 2122 + 83 = 2205 and 3313 + 83 = 3396, and `[0.4.65]` added that suite (+1 suite, +110 shell) — 2012 + 110 = 2122, 3203 + 110 = 3313. This line was itself two runs stale at `[0.4.64]` — `[0.4.63]` added `test_app_contrast.php` (+1, +185) without updating it, so 958 + 185 + 48 = 1191 and 2970 + 185 + 48 = 3203 came out then)
+**Status**: Green ✅ 2026-09-27 (**348/348**; full regression **52 suites / 4267 assertions / 0 failed / 0 skipped, exit 0** — 29 shell = 2892, 23 PHP = 1375. Closure is arithmetic: the previous green run was **52 / 4243** with this suite at **324**, and this step adds **+24 (324 → 348) touching no other suite**, so 4243 + 24 = 4267 with 52 = 52 suites, and the shell split moves 2868 → 2892 by the same 24 while PHP stays 1375. The regression clause that follows was **carried unchanged at 41 / 3503 since `[0.4.67]`** — the tree had already reached 52 / 4210 by `[0.4.80]` without this line being touched, the same stale-line class the entry above records — so it is **refreshed here rather than silently extended**. History: 41 suites / 3503 / 0 failed / 21 shell = 2312, 20 PHP = 1191 at 291/291 on 2026-09-26. Was 40 / 3396 / 20 shell = 2205 with `[0.4.66]`; **`[0.4.67]` adds `tests/test_queue_source.sh` (+1 suite, +107 shell), so 2205 + 107 = 2312 and 3396 + 107 = 3503**, PHP untouched at 1191. Before that, `[0.4.66]` grew `tests/test_regression_run.sh` (+0 suites, +83 shell: 110 → 193), so 2122 + 83 = 2205 and 3313 + 83 = 3396, and `[0.4.65]` added that suite (+1 suite, +110 shell) — 2012 + 110 = 2122, 3203 + 110 = 3313. This line was itself two runs stale at `[0.4.64]` — `[0.4.63]` added `test_app_contrast.php` (+1, +185) without updating it, so 958 + 185 + 48 = 1191 and 2970 + 185 + 48 = 3203 came out then)
 
 ## regression-run
 
 **Purpose**: Run every test suite in the repo and total the result — the committed home of the number every CHANGELOG entry quotes. It exists because that number was previously produced by an ad-hoc parser written inside the run reporting it: on 2026-09-26 the throwaway guessed ONE summary format and printed `1854 passed / 0 failed` while listing **16 of 39 suites as no-summary failures, twelve of which had exited 0** — wrong in the safe direction, unrepeatable, and produced by nothing versioned (`[0.4.64]` queue item (1), closed by `[0.4.65]`).

> build · mimo-v2.6-flash-free
$ cd /data/repo && ./tools/queue-source-check; echo "rc=$?"; php tests/test_changelog_api.php 2>&1 | tail -1; php tests/test_app_version.php 2>&1 | tail -1; php tests/test_cli_version.php 2>&1 | tail -1; bash tests/test_queue_source.sh 2>&1 | tail -2; ./tools/source-sync-check 2>&1 | tail -1; ./tools/inbox-status >/dev/null; echo "inbox rc=$?"
queue-source-check: OK - one queue: [0.4.83] pointer-only, 111 item line(s) frozen across 41 section(s), 53 PROGRESS bullet(s)
rc=0
=== Results: 86 passed, 0 failed ===
=== Results: 39 passed, 0 failed ===
=== Results: 35 passed, 0 failed ===
queue-source-check suite: 122 passed, 0 failed
===============================
result: in sync — 42 file(s) across 2 env(s) (exit 0)
inbox rc=0
> build · mimo-v2.6-flash-free
← Edit repo/agent-logs/PROGRESS.md
Index: repo/agent-logs/PROGRESS.md
===================================================================
--- repo/agent-logs/PROGRESS.md
+++ repo/agent-logs/PROGRESS.md
@@ -5505,9 +5505,9 @@
 - **The step (queue item 29)**: since `[0.4.52]` the exit-1 contract has covered **rules** as well as parses, and the last line of a red run — the one a human actually reads — was still the constant `result: N file(s) fail to parse (exit 1)`. Reproduced before touching anything, in a throwaway repo: `FAIL PLAN.md:1 [changelog] cites [7.1.5] but CHANGELOG.md has no such heading` printed directly above `result: 1 file(s) fail to parse (exit 1)` — a reader sent to hunt a syntax error in a Markdown file nothing parses. Two other descriptions of the same exit code had already been fixed from the outside (`[0.4.53]` promote's refusal, `[0.4.55]` the `--help` prose); this was the copy nobody read, and a grep of `tests/` for the string found **zero** assertions — an unpinned line is how this file keeps finding contracts that drifted the day they stopped being true.
 - **What shipped**: `_result_line(failures, exit_code, n_linted)` in `tools/repo-lint`, called once from `main()`'s human branch (the `errors` branch untouched — `cannot verify - N lint error(s)` was already honest). Three shapes: no failure → `result: all N linted file(s) parse clean (exit 0)` **byte-identical to before**; every failure in `_SYNTAX_LANGS` (`php bash python json go go-compile`) → `result: N file(s) fail to parse or compile (exit 1)`; otherwise → `result: N file(s) fail lint (<kinds>) (exit 1)` with the sorted, de-duplicated rule names. **Four judgement calls, each measured rather than assumed**: *(a)* the syntax branch's wording went `fail to parse` → **`fail to parse or compile`** because `go-compile` is in that set (the 395b9b5 shape — parses, does not build — was already being called a parse failure) and because it is `promote`'s vocabulary for the same verdict, so both sides of one exit code now say one sentence; nothing broke, since `tests/` carries that string only in `test_promote_lint_gate.sh` and `test_system_status_promote_gates.sh`, both asserting **promote's** `detail`, which did not move. *(b)* a **mixed** run names **both** kinds (`fail lint (changelog, php)`) — a line accusing only the first sends the reader to fix half the tree and re-run into the same wall; sorted and de-duplicated because a set's iteration order must never decide an asserted string. *(c)* a failure with no `lang` reads `unknown`, which is not in the syntax set — an unlabelled failure is never promoted into a parse error (the missing→unknown discipline `[0.4.53]` used). *(d)* `_SYNTAX_LANGS` is a second literal of the parent's set — a child must not import its parent — so U4 extracts **both** declarations by regex and asserts equality, because prose agreement is exactly what drifted in `[0.4.53]`.
 - **Tests — `tests/test_repo_lint.sh` section U, 16 assertions, 324 → 348; mutants M20/M21, 8 more**: U1 missing citation → exit 1 with `result: 1 file(s) fail lint (changelog) (exit 1)` and **no** `fail to parse` anywhere in the output, plus a JSON cross-check that the `lang` the line quotes *is* `changelog`; U2 broken PHP → `result: 1 file(s) fail to parse or compile (exit 1)` with **no** `fail lint (`; U3 both at once → `result: 2 file(s) fail lint (changelog, php) (exit 1)`; U4 the two `_SYNTAX_LANGS` declarations equal; U5 exactly one definition and one print in the source (P/Q's shape applied to a runtime line); U6 the sandbox left green so a later mutant's clean-run assertion cannot fail for its own reason. **M20** `if all(…)` → `if True:` (the pre-step constant, count still derived) caught by U1 **with `real_rc == mut_rc == 1`** — only the wording tells them apart — surgical on a real syntax failure where mutant and tool print the same sentence; **M21** `if all(…)` → `if False:` caught by U2 on a syntax fixture, surgical on a rule fixture where the inverted mutant is **indistinguishable** from the real tool, which is the argument for the pin. Both planted by exact-string replace with `t.count(old) == 1` asserted inside the script (the M8 lesson) and both `[ -f ]`-checked.
 - **Pre-fix replay, against the final bytes**: new suite with `HEAD`'s tool blob swapped **in place** (new tool md5 `16d7a0cc073ab416ff0d685ae666c481`, old `0a5ccfcbbc9093212cce0c4d54d4d28c`, restored and re-verified byte-identical) → **333 passed / 9 failed**: U1 ×2, U2, U3, U4 (no `_SYNTAX_LANGS` exists yet), U5 ×2, and M20/M21's two preconditions — unplantable, so their other six assertions could not run, hence **342 counted pre-fix against 348 post-fix**. All nine findings; the guards that pass pre-fix and identify themselves are U1/U2/U3's exit-code assertions and every assertion in A–T. **First capture discarded, not counted**: pointing `REPO_LINT_BIN` at a copy outside `tools/` returned 11 extra reds in section L — `default_repo()` resolves relative to the script, so the tool reported `repo_root: /tmp/…` and exited 3 — the harness artifact `[0.4.60]`'s replay already documented, caught by reading the reds rather than by their number.
-- **Gates, all measured after the edits and none carried**: `tests/test_repo_lint.sh` **348/0**, `tests/test_promote_lint_gate.sh` **143/0**, `tests/test_changelog_api.php` **86/0**, `tests/test_app_version.php` **39/0** (top entry still `## [0.4.28]` = `GLADEX_APP_VERSION` `0.4.28`), `tests/test_cli_version.php` **35/0**, `tests/test_queue_source.sh` **122/0**, `queue-source-check` → **`OK - one queue: [0.4.83] pointer-only, 111 item line(s) frozen across 41 section(s), 52 PROGRESS bullet(s)`**, `source-sync-check` → **in sync, 42 files / 2 envs**, `inbox-status` → **exit 0**, `bash -n` + `python3 -m py_compile` clean, live `repo-lint --format json` **pre-commit** → `ok true, exit 0, files_total 192, changelog_version entries 87 / unique 87 / duplicates []` (88/88 expected after this entry lands — repo-lint reads **committed** blobs, so the pre-commit read cannot see its own entry; re-read after the commit below).
+- **Gates, all measured after the edits and none carried**: `tests/test_repo_lint.sh` **348/0**, `tests/test_promote_lint_gate.sh` **143/0**, `tests/test_changelog_api.php` **86/0**, `tests/test_app_version.php` **39/0** (top entry still `## [0.4.28]` = `GLADEX_APP_VERSION` `0.4.28`), `tests/test_cli_version.php` **35/0**, `tests/test_queue_source.sh` **122/0**, `queue-source-check` → **`OK - one queue: [0.4.83] pointer-only, 111 item line(s) frozen across 41 section(s), 52 PROGRESS bullet(s)`** (**53** once this entry's own queue bullet existed — the bullet count moves with every entry, which is why it is re-read after the append and never carried; re-measured post-append: `OK - one queue: [0.4.83] pointer-only, 111 item line(s) frozen across 41 section(s), 53 PROGRESS bullet(s)`, exit 0), `source-sync-check` → **in sync, 42 files / 2 envs**, `inbox-status` → **exit 0**, `bash -n` + `python3 -m py_compile` clean, live `repo-lint --format json` **pre-commit** → `ok true, exit 0, files_total 192, changelog_version entries 87 / unique 87 / duplicates []` (88/88 expected after this entry lands — repo-lint reads **committed** blobs, so the pre-commit read cannot see its own entry; re-read after the commit below).
 - **Regression (authoritative)**: `./tools/regression-run --format json` → **52 suites, 4267 passed, 0 failed, 0 skipped, exit 0** (`ok: true`). Closure is arithmetic: the last green run was **52 / 4243** with this suite at **324**, and this step adds **+24 (324 → 348) touching no other suite** — 4243 + 24 = 4267, 52 = 52 suites. Re-run with this entry appended rather than before it (the number in this bullet was taken on the run immediately before the append and confirmed after).
 - **Docs**: `CHANGELOG.md` gained **`## [0.4.83]` parked at the bottom** like `[0.4.29]`–`[0.4.82]`, with its pointer-only `### Queue` (so `queue-source-check`'s equality on **111** item lines and its "no `- ` line in the newest section" both hold, and `## [0.4.28]` stays the entry the version suites key off); every `[x.y.z]` token it cites was checked against the heading list before committing (`cited 10, missing ['7.1.5']` — and `7.1.5` is a **fixture** inside a quoted message in series `7.1`, which the citation rule fences out by construction). `tools/REGISTRY.md` gained the derived-closing-line contract paragraph, the section-U bullet, M20/M21 in the mutation index (**19 → 21**), the pre-fix-replay bullet, and a `Status` line refreshed to this step's numbers rather than silently extended.
 - **Deliberately not done**: the suite's header mutation index still stops at **M16** (M17–M19 were never added either) — item **(5)** already queues that second copy and extending it here would be writing into a copy nothing checks; no dashboard check, no other tool, no `promote` behaviour, no `--help`/docstring text (`Exit codes:` was already right about exit 1) changed; items **(14)** and **(18)** were **not** bolted onto this step.
 - **Safety**: model spend **0.00** (`*-free` only), **no money moved** (`BUDGET.md` untouched: **1.50 spent / 3.50 remaining**), **zero DNS writes** (no `pdns-api.py` call), no paid API key configured, **no secret read or printed** (`/root/.pdns-token` and every `*.secret` untouched — the STEP-0 probe only tested existence; no credential and no message body in any prompt/thread/commit), **no service restarted, no certificate touched, no promote executed** (the stale reviewer verdict `promote-gates` reports still refuses it), **Docker stacks and both investor apps untouched**. Live I/O was read-only: the SQL counts above, throwaway git repos under `${TMPDIR:-/tmp}/opencode`, `--help` runs, the pre-fix blob swap (swapped in place, restored, md5 re-verified), and the read-only checks the dashboard performs during regression.

> build · mimo-v2.6-flash-free
$ cd /data/repo && git status --porcelain
M CHANGELOG.md
 M agent-logs/PROGRESS.md
 M tests/test_repo_lint.sh
 M tools/REGISTRY.md
 M tools/repo-lint
> build · mimo-v2.6-flash-free
← Edit repo/agent-logs/PROGRESS.md
Index: repo/agent-logs/PROGRESS.md
===================================================================
--- repo/agent-logs/PROGRESS.md
+++ repo/agent-logs/PROGRESS.md
@@ -5510,7 +5510,7 @@
 - **Regression (authoritative)**: `./tools/regression-run --format json` → **52 suites, 4267 passed, 0 failed, 0 skipped, exit 0** (`ok: true`). Closure is arithmetic: the last green run was **52 / 4243** with this suite at **324**, and this step adds **+24 (324 → 348) touching no other suite** — 4243 + 24 = 4267, 52 = 52 suites. Re-run with this entry appended rather than before it (the number in this bullet was taken on the run immediately before the append and confirmed after).
 - **Docs**: `CHANGELOG.md` gained **`## [0.4.83]` parked at the bottom** like `[0.4.29]`–`[0.4.82]`, with its pointer-only `### Queue` (so `queue-source-check`'s equality on **111** item lines and its "no `- ` line in the newest section" both hold, and `## [0.4.28]` stays the entry the version suites key off); every `[x.y.z]` token it cites was checked against the heading list before committing (`cited 10, missing ['7.1.5']` — and `7.1.5` is a **fixture** inside a quoted message in series `7.1`, which the citation rule fences out by construction). `tools/REGISTRY.md` gained the derived-closing-line contract paragraph, the section-U bullet, M20/M21 in the mutation index (**19 → 21**), the pre-fix-replay bullet, and a `Status` line refreshed to this step's numbers rather than silently extended.
 - **Deliberately not done**: the suite's header mutation index still stops at **M16** (M17–M19 were never added either) — item **(5)** already queues that second copy and extending it here would be writing into a copy nothing checks; no dashboard check, no other tool, no `promote` behaviour, no `--help`/docstring text (`Exit codes:` was already right about exit 1) changed; items **(14)** and **(18)** were **not** bolted onto this step.
 - **Safety**: model spend **0.00** (`*-free` only), **no money moved** (`BUDGET.md` untouched: **1.50 spent / 3.50 remaining**), **zero DNS writes** (no `pdns-api.py` call), no paid API key configured, **no secret read or printed** (`/root/.pdns-token` and every `*.secret` untouched — the STEP-0 probe only tested existence; no credential and no message body in any prompt/thread/commit), **no service restarted, no certificate touched, no promote executed** (the stale reviewer verdict `promote-gates` reports still refuses it), **Docker stacks and both investor apps untouched**. Live I/O was read-only: the SQL counts above, throwaway git repos under `${TMPDIR:-/tmp}/opencode`, `--help` runs, the pre-fix blob swap (swapped in place, restored, md5 re-verified), and the read-only checks the dashboard performs during regression.
-- **Staging hazard: not this time — recorded because it has bitten four times**: `git status --porcelain` read immediately before staging → exactly this run's **four** paths (`M CHANGELOG.md`, `M tests/test_repo_lint.sh`, `M tools/REGISTRY.md`, `M tools/repo-lint`), no other identity's WIP present, so `git add -A` is provably equivalent to staging those four by name this run. Author resolves to `Atlas <atlas@gladex.de>`.
+- **Staging hazard: not this time — recorded because it has bitten four times**: `git status --porcelain` read after every edit and immediately before staging → exactly this run's **five** paths (`M CHANGELOG.md`, `M agent-logs/PROGRESS.md`, `M tests/test_repo_lint.sh`, `M tools/REGISTRY.md`, `M tools/repo-lint` — the fifth being this entry itself, which is why the count is re-read here rather than carried from the four-path read taken before it was written), no other identity's WIP present, **no untracked file**, so `git add -A` (the standing instruction) is provably equivalent to staging those five by name this run — staged explicitly by path anyway, as the last four runs did. Author resolves to `Atlas <atlas@gladex.de>`.
 - **Still blocked (investor-owned, unchanged)**: NEEDS-INVESTOR **§14 cloud admin credentials** (ONE shared set for Nextcloud + Immich — blocks `INBOX.md` line 452's six accounts and the test-photo upload), **#57 public investor-route gating A/B/C**, **SOA MNAME** (`a.misconfigured.dns.server.invalid.`), the **mail password rotation** approval, the two `photos.`/`cloud.` exposure questions (public https from outside this container; the separate nft DNAT of `:8080`/`:2283`), and the **stale reviewer verdict** (re-review is the reviewer's, not mine).
 - **Next-candidate queued, not actioned**: carry items (2)–(8), (14), (15), (17), (18), (20), (22), (23), (25) and (28) from the 02:55Z entry unchanged — item **(29) struck — ACTIONED by `[0.4.83]` this run**. **(30) new from this step**: `_result_line` counts `failures` but labels them **`file(s)`** — measured this run with a `CHANGELOG.md` carrying two duplicate `7.1.1` headings: two `FAIL CHANGELOG.md:…` lines, **one** file, `result: 2 file(s) fail lint (changelog)`. Either count distinct `path`s or say `failure(s)`; the same label is on the clean line's `all N linted file(s)`, where it *is* files, so one wording may not fit both. **(31) new from this step**: U4 asserts the two `_SYNTAX_LANGS` **declarations** agree, not that they cover what the tool can actually emit — measured today `set(EXT_LANG.values()) = {bash, go, json, php, python}` ⊆ `_SYNTAX_LANGS` (+ `go-compile`, `changelog`), so the invariant holds *unasserted*; adding an extension lang would silently route its parse failure into the `fail lint (…)` branch, which a declaration-vs-declaration comparison can never see. Assert coverage of `set(EXT_LANG.values()) | {go-compile, changelog}` against the syntax set plus the rule set instead.

> build · mimo-v2.6-flash-free
$ cd /data/repo && bash tests/test_repo_lint.sh 2>&1 | tail -3; ./tools/repo-lint | tail -2; ./tools/repo-lint --format json | python3 -c 'import json,sys; d=json.load(sys.stdin); print("ok",d["ok"],"exit",d["exit_code"],"files",d["files_total"],"entries",d["changelog_version"]["entries"],"unique",d["changelog_version"]["unique"])'
===============================
repo-lint suite: 348 passed, 0 failed
===============================
  changelog-version: 87 changelog version heading(s), 87 unique, 2371 citation(s) checked, 0 missing
result: all 137 linted file(s) parse clean (exit 0)
ok True exit 0 files 192 entries 87 unique 87
> build · mimo-v2.6-flash-free
$ cd /data/repo && git add CHANGELOG.md agent-logs/PROGRESS.md tests/test_repo_lint.sh tools/REGISTRY.md tools/repo-lint && git status --porcelain && git commit -q -m "tools/tests: [0.4.83] queue item (29) — repo-lint's human closing line said 'fail to parse' for a failure that is a RULE: _result_line() derives it from failures[].lang (no failure -> unchanged clean line; all-syntax -> 'fail to parse or compile' (go-compile is in the set and it is promote's own vocabulary); anything else -> 'fail lint (<kinds>)', sorted+deduped so a MIXED run names both kinds; unlabelled lang reads 'unknown' and is never promoted into a parse error); _SYNTAX_LANGS duplicated from promote because a child must not import its parent, so U4 asserts the two declarations equal; tests/test_repo_lint.sh 324 -> 348 (section U 16 assertions + mutants M20/M21 8, both caught on WORDING with real_rc == mut_rc == 1); pre-fix replay 333/9 against the final bytes (342 counted pre-fix vs 348 post-fix, M20/M21 preconditions unplantable), first capture discarded as a default_repo() path artifact (11 extra L reds); gates green, regression 52 suites / 4267 passed / 0 failed / 0 skipped; STEP 0 answered first (0 unread both DBs, reply dev 81 / prod 47)" && git log --oneline -1
M  CHANGELOG.md
M  agent-logs/PROGRESS.md
M  tests/test_repo_lint.sh
M  tools/REGISTRY.md
M  tools/repo-lint
87e4b6a tools/tests: [0.4.83] queue item (29) — repo-lint's human closing line said 'fail to parse' for a failure that is a RULE: _result_line() derives it from failures[].lang (no failure -> unchanged clean line; all-syntax -> 'fail to parse or compile' (go-compile is in the set and it is promote's own vocabulary); anything else -> 'fail lint (<kinds>)', sorted+deduped so a MIXED run names both kinds; unlabelled lang reads 'unknown' and is never promoted into a parse error); _SYNTAX_LANGS duplicated from promote because a child must not import its parent, so U4 asserts the two declarations equal; tests/test_repo_lint.sh 324 -> 348 (section U 16 assertions + mutants M20/M21 8, both caught on WORDING with real_rc == mut_rc == 1); pre-fix replay 333/9 against the final bytes (342 counted pre-fix vs 348 post-fix, M20/M21 preconditions unplantable), first capture discarded as a default_repo() path artifact (11 extra L reds); gates green, regression 52 suites / 4267 passed / 0 failed / 0 skipped; STEP 0 answered first (0 unread both DBs, reply dev 81 / prod 47)
> build · mimo-v2.6-flash-free
$ cd /data/repo && ./tools/repo-lint --format json | python3 -c 'import json,sys; d=json.load(sys.stdin); cv=d["changelog_version"]; print("ok",d["ok"],"exit",d["exit_code"],"files",d["files_total"],"entries",cv["entries"],"unique",cv["unique"],"dups",cv["duplicates"],"missing",cv["citations_missing"],"seen",cv["citations_seen"],"in_series",cv["citations_in_series"])'; ./tools/queue-source-check; git status --porcelain; echo "--- remotes:"; git remote -v; echo "--- run commit content:"; git show --stat --oneline 9344248 | head -10
ok True exit 0 files 192 entries 88 unique 88 dups [] missing [] seen 2423 in_series 2324
queue-source-check: OK - one queue: [0.4.83] pointer-only, 111 item line(s) frozen across 41 section(s), 53 PROGRESS bullet(s)
--- remotes:
origin	git://git.gladex.de/gladex.git (fetch)
origin	git://git.gladex.de/gladex.git (push)
--- run commit content:
9344248 run: 2026-09-27 STEP 0 — investor reply dev 79 / prod 45
 agent-logs/PROGRESS.md | 4 ++++
 1 file changed, 4 insertions(+)
> build · mimo-v2.6-flash-free
$ cd /data/repo && git push origin main 2>&1 | tail -3; git status -sb | head -2; git log --oneline -3
To git://git.gladex.de/gladex.git
   52db664..87e4b6a  main -> main
## main...origin/main
87e4b6a tools/tests: [0.4.83] queue item (29) — repo-lint's human closing line said 'fail to parse' for a failure that is a RULE: _result_line() derives it from failures[].lang (no failure -> unchanged clean line; all-syntax -> 'fail to parse or compile' (go-compile is in the set and it is promote's own vocabulary); anything else -> 'fail lint (<kinds>)', sorted+deduped so a MIXED run names both kinds; unlabelled lang reads 'unknown' and is never promoted into a parse error); _SYNTAX_LANGS duplicated from promote because a child must not import its parent, so U4 asserts the two declarations equal; tests/test_repo_lint.sh 324 -> 348 (section U 16 assertions + mutants M20/M21 8, both caught on WORDING with real_rc == mut_rc == 1); pre-fix replay 333/9 against the final bytes (342 counted pre-fix vs 348 post-fix, M20/M21 preconditions unplantable), first capture discarded as a default_repo() path artifact (11 extra L reds); gates green, regression 52 suites / 4267 passed / 0 failed / 0 skipped; STEP 0 answered first (0 unread both DBs, reply dev 81 / prod 47)
52db664 docs: post-commit re-read of [0.4.82]'s two predictions — both HIT (repo-lint on the committed tree 34d1bb2: exit 0, files_total 192 unchanged because all six paths were already tracked, changelog_version entries 87/unique 87/duplicates []/citations_missing [], queue-source-check 52 PROGRESS bullets as predicted); committed tools/repo-lint blob md5 re-read as 0a5ccfcbbc9093212cce0c4d54d4d28c — the value the entry and REGISTRY now cite, which is why the pre-fix replay was re-taken rather than re-quoted; citation counts recorded as a measurement (2367/2280/0 at that commit), not a constant, since they move with every commit's prose
34d1bb2 tools/tests: [0.4.82] queue item (26) — repo-lint now refuses committed prose that cites a ## [x.y.z] heading NOBODY wrote (the class c020b29's own test header committed): collected in main()'s blob loop BEFORE the extension dispatch so .md prose — never linted as code, always 'skipped' — is in scope, and judged only when x.y is a series the committed CHANGELOG has headings for (measured on the live tree: unfenced 2289 seen / 2289 in series / 43 failures / exit 1, fenced 2289 / 2246 / 0 missing / exit 0, series 0.1-0.4); four keys added INSIDE changelog_version so the byte-pinned top-level 15-key set does not move, failure carries lang: changelog so promote-dev-to-prod needed no behaviour change (comment only), Exit codes: 1-line gained the rule with P1/P2/P3/M10 needles untouched; tests/test_repo_lint.sh 291 -> 324 (section T 24 assertions + mutants M17-M19, fixtures on series 7.1 so the repo does not fail its own test), pre-fix replay 297/21 = 18 findings + 3 unplantable preconditions, RE-TAKEN against the final bytes because the exit-1 wording edit left the first capture's md5 naming a version nobody can check out; gates green, regression 52 suites / 4243 passed / 0 failed / 0 skipped; STEP 0 answered first (0 unread both DBs, reply dev 80 / prod 46)
> build · mimo-v2.6-flash-free
$ cd /data/repo && git show HEAD:tools/repo-lint | md5sum; git rev-parse --short HEAD; date -u +%Y-%m-%dT%H:%M:%SZ
16d7a0cc073ab416ff0d685ae666c481  -
87e4b6a
2026-09-27T03:57:46Z
> build · mimo-v2.6-flash-free
$ cd /data/repo && cat >> agent-logs/PROGRESS.md <<'EOF'

### 2026-09-27T03:57Z — post-commit re-read of the two predictions `[0.4.83]` wrote (both hit)

- `repo-lint` re-read on the committed tree (`87e4b6a`): **exit 0**, **`files_total 192`** (predicted unchanged — all five paths this step touched were already tracked) and `changelog_version` **`entries 88, unique 88, duplicates []`, `citations_missing []`** (predicted 87 → 88 once the entry landed), `failures == []`, human line `changelog-version: 88 changelog version heading(s), 88 unique, 2423 citation(s) checked, 0 missing` with the closing line `result: all 137 linted file(s) parse clean (exit 0)` — i.e. the step's own subject is now the string the live tool prints. Citation counts read **2423 seen / 2324 in series / 0 missing**, series `[0.1, 0.2, 0.3, 0.4]`: deliberately pinned nowhere, because they move with every commit's own prose (this section included), which is why both docs say re-read rather than carried.
- **The committed tool's md5 re-read from the blob**: `git show HEAD:tools/repo-lint | md5sum` → **`16d7a0cc073ab416ff0d685ae666c481`**, exactly the value the `[0.4.83]` entry and `tools/REGISTRY.md` cite as the *new* tool the pre-fix replay restored to — the replay's "old" md5 (`0a5ccfcbbc9093212cce0c4d54d4d28c`) is `[0.4.82]`'s blob, and both are byte-checkable from git history.
- `queue-source-check` → **`OK - one queue: [0.4.83] pointer-only, 111 item line(s) frozen across 41 section(s), 53 PROGRESS bullet(s)`**, exit 0 (52 → 53 with the entry above, as predicted; this correction adds no queue bullet, so it stays 53). Version gates after the commit: `test_changelog_api` **86/0**, `test_app_version` **39/0** (top entry still `## [0.4.28]` = `GLADEX_APP_VERSION` `0.4.28`), `test_cli_version` **35/0**. `git status --porcelain` after the commit: **empty**; push `52db664..87e4b6a` to `git://git.gladex.de/gladex.git` succeeded.
EOF
git add agent-logs/PROGRESS.md && git commit -q -m "docs: post-commit re-read of [0.4.83]'s two predictions — both HIT (repo-lint on 87e4b6a: exit 0, files_total 192 unchanged because all five paths were already tracked, changelog_version entries 88/unique 88/duplicates []/citations_missing [], queue-source-check 53 PROGRESS bullets as predicted); committed tools/repo-lint blob md5 re-read as 16d7a0cc073ab416ff0d685ae666c481 — the value the entry and REGISTRY cite as the NEW tool, with 0a5ccfcbbc9093212cce0c4d54d4d28c being [0.4.82]'s, both byte-checkable from git history; citation counts recorded as a measurement (2423/2324/0 at that commit), not a constant" && git push origin main 2>&1 | tail -2; git status --porcelain; echo "clean=$?"
To git://git.gladex.de/gladex.git
   87e4b6a..35933f6  main -> main
clean=0
> build · mimo-v2.6-flash-free
$ cd /data/repo && sqlite3 /opt/startup/dev/data/messages.db "SELECT 'dev last', id, direction, read FROM messages ORDER BY id DESC LIMIT 1;" && sqlite3 /opt/startup/prod/data/messages.db "SELECT 'prod last', id, direction, read FROM messages ORDER BY id DESC LIMIT 1;" && ./tools/inbox-status | tail -4; echo "rc=$?"
dev last|81|agent_to_investor|1
prod last|47|agent_to_investor|1
  INBOX.md        : 73 entries, 72 handled, 1 open
    open+replied    line 452 - 2026-09-26 investor: agents get matching accounts on Nextcloud + Immich

verdict: OK - nothing owed (0 unread, 1 open entries all replied)
rc=0
> build · mimo-v2.6-flash-free
Done — one full run, STEP 0 first, one verifiable step, committed and pushed.

## STEP 0 — investor answered first
- Measured both DBs: `investor_to_agent` unread = **0 dev / 0 prod** → nothing to mark read, nothing mine to touch.
- Wrote and inserted a fresh-probe status reply anyway (**dev 81 / prod 47**, `read=1`, parameterised insert): secret **ABSENT**, Nextcloud `installed:false` v34.0.4, Immich `pong`, `https://` gladex/dev/photos/cloud **200/200/200/200**, `tls-check` 9/9 (86d earliest), 8 units active, 5 containers, budget **1.50 / 3.50**, spend **0.00**; §14 + the six investor-owned items restated.
- `tools/inbox-status` → **exit 0, "nothing owed (0 unread, 1 open entries all replied)"** — the one open INBOX entry (line 452) is blocked on §14, not missed.

## The step: queue item (29) — `[0.4.83]`
`repo-lint`'s last line on a red run was a **constant**: `result: N file(s) fail to parse (exit 1)`, still claiming "parse" after the duplicate-heading and citation rules joined exit 1. Reproduced first: `FAIL PLAN.md:1 [changelog] …` directly above `result: 1 file(s) fail to parse (exit 1)`.

- `_result_line()` now derives it from `failures[].lang` — clean line byte-identical · all-syntax → `fail to parse or compile` (go-compile is in the set, and it is promote's own wording) · anything else → `fail lint (<kinds>)`, sorted, so a **mixed** run names both kinds; unlabelled lang → `unknown`, never promoted to a parse error.
- Child must not import the parent, so `_SYNTAX_LANGS` is a second literal and **U4 asserts both declarations equal**.
- `tests/test_repo_lint.sh` **324 → 348** (section U ×16, mutants M20/M21 ×8 — both caught on *wording* with `real_rc == mut_rc == 1`); pre-fix replay **333 passed / 9 failed** against the final bytes (342 pre-fix vs 348 post-fix), first capture discarded as a `default_repo()` path artifact.
- Gates green; regression **52 suites / 4267 passed / 0 failed / 0 skipped, exit 0** (4243 + 24 = 4267). Post-commit re-read: entries **88/88**, `files_total 192`, committed blob md5 `16d7a0cc…` matches what the docs cite.
- Commits `87e4b6a` + `35933f6`, pushed to `git://git.gladex.de/gladex.git`; tree clean.

**Safety:** spend 0.00, no money moved, zero DNS writes, no secret read, no service restarted, no promote. **Still yours:** §14 cloud admin credentials (blocks the six cloud accounts), #57 routing A/B/C, SOA MNAME, mail-password rotation, public https confirmation, `:8080`/`:2283` DNAT, stale reviewer verdict.
exit=0

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Sun Sep 27 05:47:20 2026] 127.0.0.1:52450 Accepted
[Sun Sep 27 05:47:20 2026] 127.0.0.1:52450 Closing
[Sun Sep 27 05:47:20 2026] 127.0.0.1:52454 Accepted
[Sun Sep 27 05:47:20 2026] 127.0.0.1:52454 Closing
[Sun Sep 27 05:47:20 2026] 127.0.0.1:52458 Accepted
[Sun Sep 27 05:47:20 2026] 127.0.0.1:52458 Closing
[Sun Sep 27 05:47:38 2026] 127.0.0.1:57536 Accepted
[Sun Sep 27 05:47:38 2026] 127.0.0.1:57536 Closing
[Sun Sep 27 05:47:38 2026] 127.0.0.1:57550 Accepted
[Sun Sep 27 05:47:38 2026] 127.0.0.1:57550 Closing
[Sun Sep 27 05:47:41 2026] 127.0.0.1:57560 Accepted
[Sun Sep 27 05:47:41 2026] 127.0.0.1:57560 Closing
[Sun Sep 27 05:47:41 2026] 127.0.0.1:57564 Accepted
[Sun Sep 27 05:47:41 2026] 127.0.0.1:57564 Closing
[Sun Sep 27 05:47:41 2026] 127.0.0.1:57572 Accepted
[Sun Sep 27 05:47:41 2026] 127.0.0.1:57572 Closing
[Sun Sep 27 05:47:41 2026] 127.0.0.1:57586 Accepted
[Sun Sep 27 05:47:41 2026] 127.0.0.1:57586 Closing
[Sun Sep 27 05:47:41 2026] 127.0.0.1:57592 Accepted
[Sun Sep 27 05:47:41 2026] 127.0.0.1:57592 Closing
[Sun Sep 27 05:47:57 2026] 127.0.0.1:51210 Accepted
[Sun Sep 27 05:47:57 2026] 127.0.0.1:51210 Closing
[Sun Sep 27 05:47:57 2026] 127.0.0.1:51212 Accepted
[Sun Sep 27 05:47:57 2026] 127.0.0.1:51212 Closing
[Sun Sep 27 05:47:57 2026] 127.0.0.1:51216 Accepted
[Sun Sep 27 05:47:57 2026] 127.0.0.1:51216 Closing
[Sun Sep 27 05:47:57 2026] 127.0.0.1:51220 Accepted
[Sun Sep 27 05:47:57 2026] 127.0.0.1:51220 Closing
[Sun Sep 27 05:47:57 2026] 127.0.0.1:51226 Accepted
[Sun Sep 27 05:47:57 2026] 127.0.0.1:51226 Closing
[Sun Sep 27 05:47:57 2026] 127.0.0.1:51236 Accepted
[Sun Sep 27 05:47:57 2026] 127.0.0.1:51236 Closing
[Sun Sep 27 05:47:57 2026] 127.0.0.1:51238 Accepted
[Sun Sep 27 05:47:57 2026] 127.0.0.1:51238 Closing
[Sun Sep 27 05:47:57 2026] 127.0.0.1:51254 Accepted
[Sun Sep 27 05:47:58 2026] 127.0.0.1:51254 Closing
[Sun Sep 27 05:47:58 2026] 127.0.0.1:51258 Accepted
[Sun Sep 27 05:47:58 2026] 127.0.0.1:51258 Closing
[Sun Sep 27 05:47:58 2026] 127.0.0.1:51266 Accepted
[Sun Sep 27 05:47:58 2026] 127.0.0.1:51266 Closing
[Sun Sep 27 05:47:58 2026] 127.0.0.1:51276 Accepted
[Sun Sep 27 05:47:58 2026] 127.0.0.1:51276 Closing
[Sun Sep 27 05:47:58 2026] 127.0.0.1:51288 Accepted
[Sun Sep 27 05:47:58 2026] 127.0.0.1:51288 Closing
[Sun Sep 27 05:47:58 2026] 127.0.0.1:51304 Accepted
[Sun Sep 27 05:47:58 2026] 127.0.0.1:51304 Closing
[Sun Sep 27 05:47:58 2026] 127.0.0.1:51306 Accepted
[Sun Sep 27 05:47:58 2026] 127.0.0.1:51306 Closing
[Sun Sep 27 05:47:58 2026] 127.0.0.1:51320 Accepted
[Sun Sep 27 05:47:58 2026] 127.0.0.1:51320 Closing
[Sun Sep 27 05:51:48 2026] 127.0.0.1:44070 Accepted
[Sun Sep 27 05:51:48 2026] 127.0.0.1:44070 Closing
[Sun Sep 27 05:51:49 2026] 127.0.0.1:44084 Accepted
[Sun Sep 27 05:51:49 2026] 127.0.0.1:44084 Closing
[Sun Sep 27 05:53:48 2026] 127.0.0.1:56490 Accepted
[Sun Sep 27 05:53:48 2026] 127.0.0.1:56490 Closing
[Sun Sep 27 05:53:56 2026] 127.0.0.1:35010 Accepted
[Sun Sep 27 05:53:56 2026] 127.0.0.1:35010 Closing
[Sun Sep 27 06:04:55 2026] 127.0.0.1:51128 Accepted