Gladex Agent Logs

`in_sync`, `live_dir`, `template_dir`, `files[]`, `warnings[]`, `remedy[]`.
Each `files[]` entry carries `name`, `in_sync`, `live_md5`, `template_md5`,
`live_bytes`, `template_bytes`, `writable`. Both key sets are **fixed** (the
suite asserts them exactly), and `warnings`/`remedy` are `[]` — never `null` —
when the copies match, so a consumer never has to test for a key that might be
missing.

**Verdicts** (four, all fixture-proven):
- `in_sync` — both template copies are byte-identical to the live pair
- `drifted` — a copy differs **or is missing** from an existing template
  directory (a copy nobody made is drift: the remedy is the same `cp`)
- exit `3` — the template directory itself is absent, or a live source cannot
  be read; stderr only
- `writable` (per file) — measured with `os.access` against the real uid/gid:
  an existing file must be writable itself, a not-yet-existing one needs a
  writable directory. It is what makes *"not writable by this process"* a
  reading rather than a story about namespaces

**Remedy**: one `cp` per drifted copy, with any path under `/data` rewritten to
this deployment's host path (`/mnt/ssd-startup-builder/data`, AGENT_BRIEF §0),
so the output is runnable **on the host**, which is the only place it can run
today. Paths outside `/data` (fixtures, another checkout) are left alone — a
remedy naming a path nobody can reach would be worse than none.

**Test hooks (env)**: `GLADEX_LIVE_DIR` (default: the repository this script
lives in — `realpath`, because `/data/tools` is a symlink), `GLADEX_TEMPLATE_DIR`
(default: `<parent of the live dir>/homelab/projects/startup-builder/agent`).

**Tests**: `bash tests/test_template_sync.sh` → **105 assertions, 4 mutants**,
hermetic (sandbox under `${TMPDIR:-/tmp}/opencode/`, trap-removed; only one
section reads the live deployment, read-only). Covers: the `--help` contract
(both hooks, all three exit codes, why drift is not an error), the argv
contract (bad value / unknown flag / missing value / stray positional → exit 2
with **empty stdout**), all four verdicts on fixtures, the exact JSON key sets
at both levels, the host-path rewrite (a `/data` source becomes
`/mnt/ssd-startup-builder/data/...` and the container path never appears as the
remedy's source), a static read-only check (no `write_text`, `unlink`, `mkdir`,
`subprocess`, `os.system`), a **verdict-agnostic live cross-check** that
compares `status` with an independent `cmp` of the two pairs (green whether or
not the operator has copied the files yet, and never green over a tool that
lies), and four precondition-asserted mutants: M1 the byte comparison defeated ·
M2 the remedy dropped · M3 the drift warning dropped · M4 `exit 3` downgraded to
`exit 0` — each diverging on its own probe and staying surgical elsewhere.

**Dependencies**: python3 stdlib (`argparse`, `hashlib`, `json`, `os`, `sys`,
`datetime`, `pathlib`); no network, no git, no services.

**Status**: Green ✅ 2026-10-02 (105/105; closes `[0.4.169]`'s queue item
(113) — the sync itself is **blocked on the host** and handed over, this is
the detector that keeps the drift from going unnoticed for another 20 runs)
> build · mimo-v2.6-flash-free
$ cd /data/repo && grep -n '^## test_' tools/REGISTRY.md | tail -4; echo "=== test_template_sync section ==="; sed -n "$(grep -n '^## test_template_sync.sh' tools/REGISTRY.md | cut -d: -f1),\$p" tools/REGISTRY.md
4517:## test_start_page.php
4641:## test_onboarding_baseline.php
4680:## test_commit_gate.sh
4754:## test_qa_handover.php
=== test_template_sync section ===
sed: -e expression #1, char 1: unknown command: `,'
> build · mimo-v2.6-flash-free
$ cd /data/repo && grep -n '78' tools/REGISTRY.md | head -20; echo "=== diff ==="; git diff tools/REGISTRY.md | head -60
650:  `152e7ec85e2963a4780eb5ee426b82e9`, log
660:  `[0.4.93]`** (tool md5 `0c93193cff93238c85f7dcd789548581`, log
670:  no-marker-on-a-short-list checks. **169 + 9 = 178 = 189 − 13 (M15's 7 +
1696:  8894894f178db8ed97691f6b132855bd> bash tests/test_system_status_go_compile.sh`
2853:- Live: HEAD → exit 0 (176 files — **174 → 176 with `[0.4.65]`**, its own `tools/regression-run` + `tests/test_regression_run.sh` going from untracked to tracked (`linted.bash` 24 → 25, `linted.python` 11 → 12), following **173 → 174 with `[0.4.64]`**; the pre-commit run reads **174** with `bash 24` / `python 11` because those blobs are not there yet — the stale-live-number class, re-read after the commit below — 45 module files compile clean in ~1.6s. **`[0.4.66]` pre-commit read: exit 0, `files_total 176`, `linted {bash 25, go 43, json 11, php 32, python 12}`, `changelog_version entries 70, unique 70, duplicates []`** — both changed files were already tracked, so the post-commit prediction is **176 unchanged** with `entries 71` once `[0.4.66]` lands, re-read after the commit rather than carried. **`[0.4.67]` pre-commit read: exit 0, `files_total 176`, `linted {bash 25, go 43, json 11, php 32, python 12}`, `changelog_version entries 71, unique 71, duplicates []`** — this entry adds two **untracked** files (`tools/queue-source-check`, extensionless `python3` shebang → `linted.python`; `tests/test_queue_source.sh`, `.sh` → `linted.bash`) plus its own heading, so the post-commit prediction is **178** with `bash 26`, `python 13` and `entries 72`, re-read after the commit rather than carried) with `changelog_version` = `attempted true, entries 70, unique 70, unparseable 0, duplicates [], ok true` (**69 → 70 with `[0.4.65]`**, following **68 → 69 with `[0.4.64]`**: the count is read from the COMMITTED blob, so it is re-read after the append commits rather than carried over — it read 68 while `[0.4.64]` was still uncommitted, which is the whole point of re-reading; the working-tree count was verified the anchored way, `grep -c '^## \['` → 69 with `uniq -d` empty, because the greedy `sed 's/.*\[\([^]]*\)\].*/\1/'` form reports **5 phantom duplicates** on this tree — 0.4.31/0.4.40/0.4.44/0.4.49/0.4.62 — by taking the last bracket in a heading that cites other versions. The **file** count is 173, not the 171 drafted mid-run: `[0.4.63]`'s own two mailbox files were untracked when that number was written and tracked once it committed, so 171 → 173 is this entry's own movement rather than a count carried); `--sha 219fd8f` → exit 1 naming `tests/test_mailbox_a11y.php:208 [php]`; `--sha 395b9b5` → exit 1 naming `.../status_test.go:5 [go-compile]`; unknown rev / non-repo → exit 3; `--sha probe-r9` → exit 3 with `requested_sha: probe-r9` (the R16 parity reference, live); `--format yaml` → exit 2 with **usage on stderr and an empty stdout** (no format could be read, so none is invented — `[0.4.62]`); **`--format json` + a bad argv → exit 2 with a 384-byte 15-key object on stdout and 0 bytes on stderr** (`--timeout abc`, `--nonsense`, `--timeout 0`, empty `--sha`, and the failing token placed *before* `--format`), while the same argv in human mode still gives argparse's `usage:`+`error:` with **stdout 0 bytes**; `--help` (**106 lines**, was 57 before the epilog stopped carrying its own prose, 102 before the exit-3 clause widened, 103 through `[0.4.61]`, **+3 for `[0.4.62]`'s widened exit-2 clause**) renders all seven docstring blocks verbatim under their labels; a copy with a heading renamed → `repo-lint: ERROR refusing to run - docstring section missing or empty …` + `  'env:' -> 'Environment:'` → **exit 3**, stderr only, and under `--format json` the **same refusal as an object** — `ok false`, `exit_code 3`, `error` naming the pair, **stderr 0 bytes** — which is the `| jq` consumer `[0.4.60]`'s queue described, now parsing (`--format=json` → 3; `--form json` → 3; `-- --format json` → no JSON on stdout; `--format yaml` on the broken copy → refusal only, no `usage:` leak) — **and on that same broken copy `--format json --timeout abc` now yields the 458-byte refusal object with `exit_code 3` instead of falling back to `human`**, which is `[0.4.61]`'s own queue item struck as actioned. **`[0.4.82]` pre-commit read**: exit 0, `files_total 192`, `linted {bash 34, go 43, json 11, php 35, python 14}`, `changelog_version entries 86, unique 86, duplicates [], citations_seen 2289, citations_in_series 2246, citations_missing [], series [0.1, 0.2, 0.3, 0.4]`, human line `changelog-version: 86 changelog version heading(s), 86 unique, 2289 citation(s) checked, 0 missing` — all six paths this step touches were **already tracked**, so `files_total` is predicted **unchanged at 192** and `entries` becomes **87** once `[0.4.82]` lands (the citation counts move with the new prose and are therefore re-read after the commit, never carried). **Re-read after `34d1bb2`: exit 0, `files_total 192`, `entries 87`, `unique 87`, `duplicates []`, `citations_missing []` — both predictions hit**; the citation counts read `2367 / 2280 / 0` on that pass and move again with each commit's own prose, which is why they are quoted as a measurement and never as a constant.
2854:- Pre-fix replay: the **then-`HEAD` suite against the then-`HEAD` tool** → **88 passed / 28 failed** (including `L: 395b9b5 … (want rc=1 got=0)`) for the Go gate of `[0.4.3x]`; for the changelog gate the *new* suite against the pre-fix tool (md5 `3a4e09176e24ca3414366952467d4944`, log `/tmp/opencode/changelog-gate/pre-fix.log`, suite md5 `9e352394d02096183adef92d55fc5a73`) → **125 passed / 22 failed**: the exact key-set pin plus every O1–O7 finding red, and M7/M8/M9 unplantable (0 matching lines) — while the six guard-style assertions inside O (absent file adds no failure; fixed commit → 0) already passed, which is what identifies them as guards rather than findings. For `[0.4.56]` the new section P against the pre-fix tool (tool md5 `3ebcf0b4ae7e290796fbed12c57e422b`, suite md5 `a50e16d7a5643bdfd18b667752e50d2c`, log `/tmp/opencode/exitcodes/pre-fix.log`) → **166 passed / 6 failed**: P1 (the contract text occurs **twice**), P2 ×2 (Go rule and CHANGELOG rule both absent from the docstring), P4 (the docstring block and `--help`'s section differ), M10's agreement surgical check (pre-fix both copies still exist, so the mutant's docstring and `--help` disagree), and M11's precondition (already 2 occurrences → unplantable, so its other three assertions could not run pre-fix — hence 172 counted pre-fix against 175 post-fix). Guards that passed pre-fix and thereby identify themselves: P2's parse rule, P3 (all four codes), P4's `--help exits 0`, and all three P5 rules — the epilog was the copy that was right. Baseline re-verified on a checkout of the same commit before the fix: **155/156 then 156/156 twice**, the single red being `L: real repo status changed during a run` (a concurrent identity committed mid-run), not this change. For `[0.4.59]` the new section Q against the pre-fix tool (tool md5 `f17563d67064a79f313ef2bab376cd66`, suite md5 `9217e2653fbed256afb704d0a01fd359`, log `/tmp/opencode/epilogderive/pre-fix.log`; baseline of the *old* suite against the old tool was **175/0** first) → **186 passed / 9 failed**: the seven findings are Q1–Q6 (every pair renders different bytes) and Q13 (the drifted synopsis still present), plus **M12's surgical render check** — which fails pre-fix only because the two renderings differ by definition, i.e. it restates Q2 — and **M13's precondition unplantable** (the derivation tuple does not exist yet, so its other three assertions could not run: hence 186 counted pre-fix against 198 post-fix). **Guards passed pre-fix and thereby identify themselves**: all six Q-source counts (each section's text already occurred exactly once — the copies differed, they were not duplicated line-for-line), `--help exits 0`, the generated-usage line, and M12's precondition plus its "caught" assertion. For `[0.4.60]` the new section R against the pre-fix tool (old tool md5 `4e6c58ffc86441a5745054a4ea45d084`, final suite md5 `e126f791dbcd4b1d9ae0bd0626022d82`, log `/tmp/opencode/epilogrefuse/pre-fix.log`; baseline of the old suite against the old tool was **198/0** first) → **203 passed / 10 failed**, captured **inside a clone of the repo** rather than from `/tmp`: pointing `REPO_LINT_BIN` at a copy outside `tools/` makes section L's live checks fail for *path* reasons, because `default_repo()` resolves relative to the script, so the tool reported `repo_root: /tmp/...` and exited 3 — a harness artifact that cost a second capture to get a red meaning what it says. **Nine of the ten are real**: **R5, R6, R7, R9 ×2, R11, R12, R12b** plus **M14's precondition unplantable** (the refusal does not exist yet, so its other five assertions could not run — hence 213 counted pre-fix against 218 post-fix); the tenth is `L: live json structurally sound`, whose `d['repo_root'] == '/data/repo'` is true in the real repo and false in a clone — disclosed as an artifact of my cloning rather than counted as a finding. **Guards passed pre-fix and thereby identify themselves**: R1 (healthy tool exits 0), R2 (no refusal on stderr), R3 (all seven labels non-empty), R4 and R10 (both mutant preconditions), R8 (the refusal names only the broken pair — pre-fix stderr is empty, so it passes vacuously, which is what makes it a guard rather than a finding). For `[0.4.61]` the widened section R against the pre-fix tool (old tool md5 `d6b50e6dcf68df6dccb5a46dfe06e5a0`, **final** suite md5 `b71b64db24d64fa65263e3867e45ba97`, log `/tmp/opencode/jsonrefuse/pre-fix.log`; baseline of the committed suite against the committed tool was **218/218** first) → **230 passed / 12 failed**, again **inside a clone** for the same path reason. **Eleven are real**: **R9b, R9c, R9d, R9e, R9f, R9g** (one cause — stdout empty, refusal on stderr), **R13** (`_add_flags` does not exist yet), **R14b, R15b, R16b** (same empty-stdout cause) and **M15's precondition unplantable** (the die()-routing line does not exist, so its five other assertions could not run — hence **242 counted pre-fix against 247 post-fix**). The twelfth is again `L: live json structurally sound` (`repo_root` is the clone, not `/data/repo`) — disclosed as a cloning artifact, not counted. **Guards passed pre-fix and thereby identify themselves**: R1–R8, R10–R12b, the exit-3 half of R9/R14/R15/R16, **R15c** (argparse really accepts `--form`), **R16c/R16d** (the healthy tool already echoed `requested_sha: probe-r9` — the reference both readers must match), R17, R17c, R18, R18b, R19; and **R17b, R18c, R18d are vacuously green** (nothing could print before a scan existed) — disclosed as guards, not findings. Two first-draft defects of mine are recorded in the CHANGELOG: R9c's predicate used `->` outside a string (the *checker* raised SyntaxError — a red meaning the wrong thing), and M15 was first planted without its trigger (mutant exited **0** and was "NOT caught", because nothing refuses when the docstring is healthy). For `[0.4.62]` the new section S against the pre-fix tool (tool md5 `f42b33e34ab28588334b5f616a551798`, **final** suite md5 `4acbd04968016e319778dda544c6596e`, log `/tmp/opencode/usagejson/pre-fix.log`; baseline of the committed suite against the committed tool was **247/247** first) → **268 passed / 16 failed** of 284, captured **in place rather than in a clone** — the tool was still unmodified at its real path, so section L's `repo_root == '/data/repo'` check passed on its own; the clone was only ever needed because a copy *outside* `tools/` changes `default_repo()`. **All sixteen are real**: **S3–S8** (one cause — stdout empty, usage on stderr), **S9b, S9c, S10b, S10c, S11b** (same cause, one per argv form), **S12b, S12c, S12e, S12f** (same cause, via our own `p.error()`), **S16b** (`_add_format_flag` does not exist yet — hence 268 counted pre-fix against 291 post-fix). **Guards passed pre-fix and thereby identify themselves**: **S1** (the human channel was already exactly right — the strongest evidence this was a *channel* defect, not a validation one), S2, S9a, S10a, S11a, S12a, S12d, **S13a–S15b** (no-format-readable argv), **S16** (the `--format` definition was already single), **S17, S18**. Two first-draft defects of mine are recorded in the CHANGELOG: S17b read `$OUT` where `s_run` wrote `$S_OUT` (a **stale** object, so the assertion failed against the *old* tool for an unrelated reason — caught as the 17th red and fixed before the tool was touched, the capture then re-taken honestly at 16), and S16b's predicate `grep -c '_add_format_flag(p)'` also matched the `def` line, reporting `3` for two call sites plus a definition — the third time this suite has been wrong in the *predicate* direction.
2919:- **Mutations (14 total, copies under `/tmp`, tool md5 unchanged before/after)**. The original **6**: M1 `no_summary` dropped from the exit precedence → caught by 2; M2 tie-break defeated → caught by **4** (`want=12 got=999`); M3 a `no_summary` suite counted in `totals.suites_run` → caught by 2; M4 crash detection defeated → caught by 3; M5 epilog refusal defeated → caught by **6**; M6 the pre-parser's stderr suppression dropped → caught by 2. **The baseline 7** (`/tmp/opencode/mutate_baseline.sh`, tool md5 `cd6b13e23777853c85773f803652958a` identical before/after all seven): **closure made trivially true** → 3 red, all in section I (I32 mismatch false, I36/I37 mismatch lines); **exit code flipped by any movement** → **4 red** (I18, I33, I44, I69 — every "the baseline never changes the verdict" assertion); **both `kind` and `format` refusals dropped** → 4 red (I60, I61, I62c, I62d); **`lost` not reported** → 3 red (I27, I28, I30); **added/removed dropped** → 2 red (I38, I39); **`contrib` applied asymmetrically** (baseline side hand-counted regardless of status) → **1 red, I49 — caught by the closure check**, which is the design's own safety net catching the exact hazard the single-`contrib` rule exists to prevent; **the `format` check dropped** → 2 red (I62c, I62d). Each mutant's reds are confined to section I. **The termination 1** (`[0.4.124]`, `REGRESSION_RUN_BIN=/tmp/opencode/mut74`, only `install_termination_guard()`'s call removed) → **7 red in section J** (J2, J4, J6, J7, J8, J9, J11), 244 passed / 7 failed, and the live tool's md5 identical before and after; **J10 stays green there by construction** — the copy still *defines* the guard and lost only the call, which is the surgical difference between a plant and pre-fix code (the pre-fix replay, which has neither, reddens J10 too: 243 / 8). Both mutant runs close on **251 = 255 − 4**, the four being section G's `SKIP G6` shipped-location assertions, absent from any run whose `$TOOL` is not the shipped binary — and the same four are *still* the whole subtraction since `[0.4.154]` (total **331 → 327** at that entry and **338 → 334** at `[0.4.155]`, both measured 2026-10-01), because that entry put G7–G11 behind the shipped *location*, outside this shipped-*binary* condition; since `[0.4.157]` those same four are also **counted** rather than dropped, so a mutant run reads `340 passed, 0 failed, 4 skipped` and "the whole subtraction" is a printed column instead of an inference from two totals.
2920:- Live (measured 2026-10-02): `./tools/regression-run` → **78 suites** discovered — the suite count this file quotes as current, and the only place it is quoted as current. Machine-checked by `tests/test_registry_coverage.sh` section F: that section re-reads this line and compares it with `regression-run --list` (the same `discover()` a run uses), so adding a suite to `tests/` turns it red until this line is refreshed, a second `- Live:` figure anywhere in this file is `figure_duplicate`, and every `<N> suites` figure elsewhere in this file must carry a `YYYY-MM-DD` on its own line. Assertion totals are printed by the tool itself and are quoted here only as dated history, never as the live claim. *(Refreshed twice on 2026-09-30: **63 → 68** by the run that added `tests/test_start_page.php`, then **68 → 70** when `tests/test_onboarding_baseline.php` and, minutes later, a concurrent shift's `tests/test_heading_order.php` landed — the second number counts the tree `--list` was actually run on (70 files in `tests/`), not a wish list, and the refresh is what clears `VIOLATION figure_stale 63`, which had made section F's controls read 2 violations where they assert exactly one, i.e. 26 reds nobody's code caused; 66 of the 67 are pre-existing suites counted for the first time here. A third refresh, **70 → 73**, landed on 2026-09-30T17:13Z. The starting state was `tests/test_trust_form.php` arriving in `7cd78e0` ("run 410") while this line still said 70, so `--list` answered 71 against a claim of 70 — `VIOLATION figure_stale 70`, read by section F as **28 reds** (the 26 exactly-one-violation controls seeing their plant *plus* the standing one, plus F3 `want=71 got=70`, F5 and F6), every one of them caused by a suite count and none by the code those assertions test. The number was then **in motion while it was being written**: it read **71** at 16:59Z, **72** at 17:05Z (the concurrent run's untracked `tests/test_hire_agent.sh`), and **73** at 17:12Z (`tests/test_commit_gate.sh`, the same run building queue item **(78)**'s pre-commit gate) — three suites landing in thirteen minutes with this line refreshed by none of them, which is why the committed figure is the count read at 17:12Z and why **the run that adds the next suite still owns the next refresh**: this line is a single counted claim, not a wish list, and a number refreshed by a bystander is stale by the time it is pushed. Rewritten by the run that could not re-verify its own step while section F was red for that reason, not by the run that added any of the three — the same attribution question `[0.4.140]`'s heading answered.)* *(Refreshed **73 → 75** on 2026-10-01: **74** is this run's own addition, `tests/test_qa_handover.php` — the guard for `team/QA-HANDOVER.md`, the QA/docs handover `team/ONBOARDING.md`'s first-week item promises — and the **75th** was `tests/test_chat_nojs.php`, present but untracked in the worktree from a concurrent run at the minute this line was re-read. The figure follows what `--list` discovers rather than what any revision happens to hold (the same reading order (83) documented), and the line was measured at commit time instead of carrying yesterday's number over: the run that adds a suite owns the refresh.)* *(Refreshed **75 → 76** on 2026-10-01 (19:05 CEST) as a bystander, and for the second time: `tests/test_chat_header_320.php` (a concurrent shift's `/investor` chat-header fix, `3e50254`) landed as the 76th suite without moving this line, the first refresh was written into the worktree and then lost when this file was rewritten from an older base at 18:57 CEST, so `VIOLATION figure_stale 75` stood through both — 29 reds in `tests/test_registry_coverage.sh`, every one of them caused by a suite count and none by the code those assertions test. Re-measured against `regression-run --list` (76) at the moment this was written, which is what section F compares it with.) *(Refreshed **76 → 77** on 2026-10-02 by the run that added the suite: `tests/test_system_status_staged.sh`, the guard for queue item **(109)(e)** — the `git-tree` row must not call a PARKED STEP healthy. Measured at the moment of the write: `regression-run --list` → **77 suite(s) discovered**, `ls tests | wc -l` → 77, and `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for; the figure follows what `--list` discovers, as the three notes above document.) *(Refreshed **77 → 78** on 2026-10-02 by the run that added `tests/test_template_sync.sh`, the guard for queue item **(113)** — the template copies of the mission documents. Measured at the moment of the write: `regression-run --list` → **78 suite(s) discovered**, `ls tests | wc -l` → 78; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)*
4682:**Purpose**: the permanent proof of queue item **(78)** — *"a partial run can
=== diff ===
diff --git a/tools/REGISTRY.md b/tools/REGISTRY.md
index 3720c7d..fa9de09 100644
--- a/tools/REGISTRY.md
+++ b/tools/REGISTRY.md
@@ -2917,7 +2917,7 @@ regression-run [--help] [--format human|json] [--tests-dir DIR] [--only SUBSTR]
 - **Test hook**: `REGRESSION_RUN_BIN` points the suite at a mutant copy of the tool.
 - **Recursion guard**: the suite must never point the tool at the live `tests/` (it would run itself from inside itself). Three invocation helpers, each pinned: `run_sandbox` injects `--tests-dir "$SB/`, `run_live`/`run_default` never name a tests dir at all, and every `run_live`/`run_default` **call site** carries `--only` or `--list`. Extracted **by function** (`helper_line`) so the needles cannot match their own assertion text — the first draft's guard did exactly that and could only ever fail. Section I runs **entirely through `run_sandbox`/`jrun`**, so even its error-path checks carry `--tests-dir`.
 - **Mutations (14 total, copies under `/tmp`, tool md5 unchanged before/after)**. The original **6**: M1 `no_summary` dropped from the exit precedence → caught by 2; M2 tie-break defeated → caught by **4** (`want=12 got=999`); M3 a `no_summary` suite counted in `totals.suites_run` → caught by 2; M4 crash detection defeated → caught by 3; M5 epilog refusal defeated → caught by **6**; M6 the pre-parser's stderr suppression dropped → caught by 2. **The baseline 7** (`/tmp/opencode/mutate_baseline.sh`, tool md5 `cd6b13e23777853c85773f803652958a` identical before/after all seven): **closure made trivially true** → 3 red, all in section I (I32 mismatch false, I36/I37 mismatch lines); **exit code flipped by any movement** → **4 red** (I18, I33, I44, I69 — every "the baseline never changes the verdict" assertion); **both `kind` and `format` refusals dropped** → 4 red (I60, I61, I62c, I62d); **`lost` not reported** → 3 red (I27, I28, I30); **added/removed dropped** → 2 red (I38, I39); **`contrib` applied asymmetrically** (baseline side hand-counted regardless of status) → **1 red, I49 — caught by the closure check**, which is the design's own safety net catching the exact hazard the single-`contrib` rule exists to prevent; **the `format` check dropped** → 2 red (I62c, I62d). Each mutant's reds are confined to section I. **The termination 1** (`[0.4.124]`, `REGRESSION_RUN_BIN=/tmp/opencode/mut74`, only `install_termination_guard()`'s call removed) → **7 red in section J** (J2, J4, J6, J7, J8, J9, J11), 244 passed / 7 failed, and the live tool's md5 identical before and after; **J10 stays green there by construction** — the copy still *defines* the guard and lost only the call, which is the surgical difference between a plant and pre-fix code (the pre-fix replay, which has neither, reddens J10 too: 243 / 8). Both mutant runs close on **251 = 255 − 4**, the four being section G's `SKIP G6` shipped-location assertions, absent from any run whose `$TOOL` is not the shipped binary — and the same four are *still* the whole subtraction since `[0.4.154]` (total **331 → 327** at that entry and **338 → 334** at `[0.4.155]`, both measured 2026-10-01), because that entry put G7–G11 behind the shipped *location*, outside this shipped-*binary* condition; since `[0.4.157]` those same four are also **counted** rather than dropped, so a mutant run reads `340 passed, 0 failed, 4 skipped` and "the whole subtraction" is a printed column instead of an inference from two totals.
-- Live (measured 2026-10-02): `./tools/regression-run` → **77 suites** discovered — the suite count this file quotes as current, and the only place it is quoted as current. Machine-checked by `tests/test_registry_coverage.sh` section F: that section re-reads this line and compares it with `regression-run --list` (the same `discover()` a run uses), so adding a suite to `tests/` turns it red until this line is refreshed, a second `- Live:` figure anywhere in this file is `figure_duplicate`, and every `<N> suites` figure elsewhere in this file must carry a `YYYY-MM-DD` on its own line. Assertion totals are printed by the tool itself and are quoted here only as dated history, never as the live claim. *(Refreshed twice on 2026-09-30: **63 → 68** by the run that added `tests/test_start_page.php`, then **68 → 70** when `tests/test_onboarding_baseline.php` and, minutes later, a concurrent shift's `tests/test_heading_order.php` landed — the second number counts the tree `--list` was actually run on (70 files in `tests/`), not a wish list, and the refresh is what clears `VIOLATION figure_stale 63`, which had made section F's controls read 2 violations where they assert exactly one, i.e. 26 reds nobody's code caused; 66 of the 67 are pre-existing suites counted for the first time here. A third refresh, **70 → 73**, landed on 2026-09-30T17:13Z. The starting state was `tests/test_trust_form.php` arriving in `7cd78e0` ("run 410") while this line still said 70, so `--list` answered 71 against a claim of 70 — `VIOLATION figure_stale 70`, read by section F as **28 reds** (the 26 exactly-one-violation controls seeing their plant *plus* the standing one, plus F3 `want=71 got=70`, F5 and F6), every one of them caused by a suite count and none by the code those assertions test. The number was then **in motion while it was being written**: it read **71** at 16:59Z, **72** at 17:05Z (the concurrent run's untracked `tests/test_hire_agent.sh`), and **73** at 17:12Z (`tests/test_commit_gate.sh`, the same run building queue item **(78)**'s pre-commit gate) — three suites landing in thirteen minutes with this line refreshed by none of them, which is why the committed figure is the count read at 17:12Z and why **the run that adds the next suite still owns the next refresh**: this line is a single counted claim, not a wish list, and a number refreshed by a bystander is stale by the time it is pushed. Rewritten by the run that could not re-verify its own step while section F was red for that reason, not by the run that added any of the three — the same attribution question `[0.4.140]`'s heading answered.)* *(Refreshed **73 → 75** on 2026-10-01: **74** is this run's own addition, `tests/test_qa_handover.php` — the guard for `team/QA-HANDOVER.md`, the QA/docs handover `team/ONBOARDING.md`'s first-week item promises — and the **75th** was `tests/test_chat_nojs.php`, present but untracked in the worktree from a concurrent run at the minute this line was re-read. The figure follows what `--list` discovers rather than what any revision happens to hold (the same reading order (83) documented), and the line was measured at commit time instead of carrying yesterday's number over: the run that adds a suite owns the refresh.)* *(Refreshed **75 → 76** on 2026-10-01 (19:05 CEST) as a bystander, and for the second time: `tests/test_chat_header_320.php` (a concurrent shift's `/investor` chat-header fix, `3e50254`) landed as the 76th suite without moving this line, the first refresh was written into the worktree and then lost when this file was rewritten from an older base at 18:57 CEST, so `VIOLATION figure_stale 75` stood through both — 29 reds in `tests/test_registry_coverage.sh`, every one of them caused by a suite count and none by the code those assertions test. Re-measured against `regression-run --list` (76) at the moment this was written, which is what section F compares it with.) *(Refreshed **76 → 77** on 2026-10-02 by the run that added the suite: `tests/test_system_status_staged.sh`, the guard for queue item **(109)(e)** — the `git-tree` row must not call a PARKED STEP healthy. Measured at the moment of the write: `regression-run --list` → **77 suite(s) discovered**, `ls tests | wc -l` → 77, and `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for; the figure follows what `--list` discovers, as the three notes above document.)
+- Live (measured 2026-10-02): `./tools/regression-run` → **78 suites** discovered — the suite count this file quotes as current, and the only place it is quoted as current. Machine-checked by `tests/test_registry_coverage.sh` section F: that section re-reads this line and compares it with `regression-run --list` (the same `discover()` a run uses), so adding a suite to `tests/` turns it red until this line is refreshed, a second `- Live:` figure anywhere in this file is `figure_duplicate`, and every `<N> suites` figure elsewhere in this file must carry a `YYYY-MM-DD` on its own line. Assertion totals are printed by the tool itself and are quoted here only as dated history, never as the live claim. *(Refreshed twice on 2026-09-30: **63 → 68** by the run that added `tests/test_start_page.php`, then **68 → 70** when `tests/test_onboarding_baseline.php` and, minutes later, a concurrent shift's `tests/test_heading_order.php` landed — the second number counts the tree `--list` was actually run on (70 files in `tests/`), not a wish list, and the refresh is what clears `VIOLATION figure_stale 63`, which had made section F's controls read 2 violations where they assert exactly one, i.e. 26 reds nobody's code caused; 66 of the 67 are pre-existing suites counted for the first time here. A third refresh, **70 → 73**, landed on 2026-09-30T17:13Z. The starting state was `tests/test_trust_form.php` arriving in `7cd78e0` ("run 410") while this line still said 70, so `--list` answered 71 against a claim of 70 — `VIOLATION figure_stale 70`, read by section F as **28 reds** (the 26 exactly-one-violation controls seeing their plant *plus* the standing one, plus F3 `want=71 got=70`, F5 and F6), every one of them caused by a suite count and none by the code those assertions test. The number was then **in motion while it was being written**: it read **71** at 16:59Z, **72** at 17:05Z (the concurrent run's untracked `tests/test_hire_agent.sh`), and **73** at 17:12Z (`tests/test_commit_gate.sh`, the same run building queue item **(78)**'s pre-commit gate) — three suites landing in thirteen minutes with this line refreshed by none of them, which is why the committed figure is the count read at 17:12Z and why **the run that adds the next suite still owns the next refresh**: this line is a single counted claim, not a wish list, and a number refreshed by a bystander is stale by the time it is pushed. Rewritten by the run that could not re-verify its own step while section F was red for that reason, not by the run that added any of the three — the same attribution question `[0.4.140]`'s heading answered.)* *(Refreshed **73 → 75** on 2026-10-01: **74** is this run's own addition, `tests/test_qa_handover.php` — the guard for `team/QA-HANDOVER.md`, the QA/docs handover `team/ONBOARDING.md`'s first-week item promises — and the **75th** was `tests/test_chat_nojs.php`, present but untracked in the worktree from a concurrent run at the minute this line was re-read. The figure follows what `--list` discovers rather than what any revision happens to hold (the same reading order (83) documented), and the line was measured at commit time instead of carrying yesterday's number over: the run that adds a suite owns the refresh.)* *(Refreshed **75 → 76** on 2026-10-01 (19:05 CEST) as a bystander, and for the second time: `tests/test_chat_header_320.php` (a concurrent shift's `/investor` chat-header fix, `3e50254`) landed as the 76th suite without moving this line, the first refresh was written into the worktree and then lost when this file was rewritten from an older base at 18:57 CEST, so `VIOLATION figure_stale 75` stood through both — 29 reds in `tests/test_registry_coverage.sh`, every one of them caused by a suite count and none by the code those assertions test. Re-measured against `regression-run --list` (76) at the moment this was written, which is what section F compares it with.) *(Refreshed **76 → 77** on 2026-10-02 by the run that added the suite: `tests/test_system_status_staged.sh`, the guard for queue item **(109)(e)** — the `git-tree` row must not call a PARKED STEP healthy. Measured at the moment of the write: `regression-run --list` → **77 suite(s) discovered**, `ls tests | wc -l` → 77, and `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for; the figure follows what `--list` discovers, as the three notes above document.) *(Refreshed **77 → 78** on 2026-10-02 by the run that added `tests/test_template_sync.sh`, the guard for queue item **(113)** — the template copies of the mission documents. Measured at the moment of the write: `regression-run --list` → **78 suite(s) discovered**, `ls tests | wc -l` → 78; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)*
 - History (dated): 2026-09-26 → `40 suites, 3396 passed, 0 failed, 0 skipped`, exit 0, 4m30s, shape histogram `bare=2, fence=30, results=2, suite=6` — the figure this bullet was still showing on 2026-09-28, i.e. five suites stale, which is the defect queue item (63) closed. The movement over `[0.4.65]`'s **3313 closes exactly: +83 = `test_regression_run.sh` 110 → 193**, no other suite moved. **`[0.4.67]`'s movement (re-read after the run, not carried): `40 · 3396 + 107 = 41 · 3503`, whole delta `test_queue_source.sh` 0 → 107, shape `suite` → histogram `bare=2, fence=30, results=2, suite=7`.** Baseline live on the real tree: `--only regression_run --save-baseline` → record of 193; the same suite again → *"no movement; 1 of 1 shared suite(s) unchanged"*, closure OK; `--only ts_ordering --baseline` against that record → `added test_ts_ordering.php`, `removed test_regression_run.sh`, **`totals delta -186` = `attributed -186`** (−193 + 7), `CLOSURE OK`, exit 0.
 
 **Status**: Built ✅ 2026-09-26 (193/193; closes `[0.4.65]`'s PROGRESS queue item (1) — the full-regression figure this line used to quote lives only on the dated `- Live:` line above since (63))
@@ -4781,3 +4781,101 @@ naming that path; the onboarding item unticked → 1 red; a planted address →
 1 red; a planted birth-year date → 2 red (the outside-2026 assertion and the
 creation-date one, since the plant replaced the creation date itself); a
 deleted section heading → 1 red naming it.
+
+---
+
+## template-sync-check
+
+**Purpose**: Detect drift between the two copies of the mission documents that
+AGENT_BRIEF §7 keeps **by hand** — the live `AGENT_BRIEF.md` / `AGENT_TASK.md`
+in the repo root and their TEMPLATE twins under
+`homelab/projects/startup-builder/agent/` — and print a remedy that runs where
+those templates are writable. It exists because nothing read them: measured
+2026-10-02, both copies were **~20 runs stale** (no `STEP 0`, no `CLOSE
+PROTOCOL`, no §7 — so a freshly provisioned agent could not even learn the rule
+that says *keep both in step* — no §11 PIVOT, a Phase 1 still aimed at the
+homelab market the investor had forbidden, and six paths still pointing at
+`/data/tools/` from before the repo moved to `/data/repo`) while **every gate
+in the tree stayed green**. Deliberately read-only: the templates are owned by
+the host user and this container's uid map (`0 1000000 1000000000`) does not
+contain that uid, so `touch` / append / `cp` all fail on them (measured
+2026-10-02) while the same commands succeed on `/data/repo`'s own files — so
+the tool *reports* and *hands over*, instead of pretending a copy happened.
+
+**Location**: `/data/repo/tools/template-sync-check`
+
+**Usage**:
+```
+template-sync-check [--format human|json]
+```
+
+**Options**:
+- `--format human|json` - Output format (default: `human`)
+- `--help` - Show help (both test hooks and all three exit codes are in it)
+
+**Exit codes**:
+- `0` - **The comparison was made**: `in_sync` *or* `drifted`. Drift prints
+  `WARN:` rows plus a `cp` remedy and still exits 0, on purpose — only the host
+  can write those files, and a gate that reddens for something no run may fix
+  would redden every later run for a reason none of them can clear (the same
+  reasoning that put `budget-show`'s month freshness on a WARN row in
+  `[0.4.168]`, and that keeps `system-status`'s two NEEDS-INVESTOR findings as
+  warnings). Read `status` / `in_sync` / `warnings` / `remedy`, never the exit
+  code alone; the suite pins exactly that with mutants M1–M3
+- `2` - Invalid arguments. An invalid argv prints **empty stdout**: no object a
+  consumer could read as a verdict
> build · mimo-v2.6-flash-free
$ sleep 60; wc -c /tmp/opencode/cov2.log; tail -3 /tmp/opencode/cov2.log; pgrep -f test_registry_coverage >/dev/null && echo RUNNING || echo DONE
4569 /tmp/opencode/cov2.log
PASS: C16g exactly one violation - the plant, and nothing else
PASS: C17a plant: the undated figure line is present
PASS: C17b plant: and THAT line carries no date
RUNNING
> build · mimo-v2.6-flash-free
$ cd /data/repo && grep -c 'CHANGELOG' tests/test_registry_coverage.sh; grep -n 'CHANGELOG' tests/test_registry_coverage.sh | head
0
> build · mimo-v2.6-flash-free
$ cd /data/repo && grep -nE 'PROGRESS|REPORT\.md|BUDGET' tests/test_registry_coverage.sh | head
(no output)
> build · mimo-v2.6-flash-free
→ Read repo/REPORT.md [offset=340, limit=25]
> build · mimo-v2.6-flash-free
← Edit repo/REPORT.md
Index: repo/REPORT.md
===================================================================
--- repo/REPORT.md
+++ repo/REPORT.md
@@ -361,4 +361,34 @@
 one-time registration, not monthly"* — then the `1.50/mo` rule in `rules:` is wrong and I
 correct it; (c) *"leave it"* — the `0.00` figure stays with its caveat. Until one arrives,
 the ledger is arithmetically valid and factually incomplete, and the caveat is printed in
 the `spent:` note the investor-facing `/budget` page renders.
+
+### OPERATOR HANDOFF (opened 2026-10-02): the two stale template copies of the mission brief — one `cp` each, on the HOST
+Not a question — a **blocked action**. The TEMPLATE twins of `AGENT_BRIEF.md` / `AGENT_TASK.md`
+that AGENT_BRIEF §7 keeps by hand under `homelab/projects/startup-builder/agent/` are **~20 runs
+stale**: no `STEP 0`, no `CLOSE PROTOCOL`, no §7 (so a freshly provisioned agent could not even
+learn the rule that says *keep both in step*), no §11 PIVOT, a Phase 1 still aimed at the homelab
+market, and paths still pointing at `/data/tools/`. Every gate in the tree stayed green over it
+because nothing read those files.
+
+I cannot fix it from here, measured rather than assumed: those two files belong to the **host
+user**, whose uid is not in this container's uid map (`0 1000000 1000000000`), so `touch`,
+append and `cp` all fail with `EACCES`/`EPERM` on them **even as uid 0**, while the same
+commands succeed on `/data/repo`'s own files. So `tools/template-sync-check` reports the drift
+and prints the remedy instead of pretending a copy happened.
+
+**Exact commands, run as the host user on the HOST** (pre-state measured 2026-10-02):
+`AGENT_BRIEF.md` 6319 B md5 `af87d34f58ee2bb9e31121799a6e079c` vs live 9820 B md5
+`2e070e2f29f69d3db9a1178dbc2e15ee`; `AGENT_TASK.md` 1386 B md5
+`60dbefd6a0b2688fd7f878ecb8234641` vs live 2813 B md5 `834429df11dab060f33b5b9b86282c26`.
+
+```
+cp /mnt/ssd-startup-builder/data/repo/AGENT_BRIEF.md /mnt/ssd-startup-builder/data/homelab/projects/startup-builder/agent/AGENT_BRIEF.md
+cp /mnt/ssd-startup-builder/data/repo/AGENT_TASK.md  /mnt/ssd-startup-builder/data/homelab/projects/startup-builder/agent/AGENT_TASK.md
+```
+
+**Verify**: `tools/template-sync-check` → `status: in_sync` (before the copy it reports
+`drifted`, exit **0** on purpose — only the host can write those files, so a gate that reddened
+for it would redden every later run for a reason none of them can clear). Until then the item is
+**blocked on the operator**, and the detector is what keeps the drift from going unnoticed for
+another 20 runs.

> build · mimo-v2.6-flash-free
$ sleep 45; tail -3 /tmp/opencode/cov2.log; pgrep -f test_registry_coverage >/dev/null && echo RUNNING || echo DONE; cd /data/repo && git status --porcelain
PASS: C27k while the widened reader still sees every pair the live tree does
PASS: C28a plant: the usage row really names no flag (it says only [OPTIONS])
PASS: C28b plant: and the tool is CORRECT - a missing value still exits 2, so (72) has nothing to find
RUNNING
 M REPORT.md
 M tests/test_registry_coverage.sh
 M tools/REGISTRY.md
?? tests/test_template_sync.sh
?? tools/template-sync-check
> build · mimo-v2.6-flash-free

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Fri Oct  2 07:28:57 2026] 127.0.0.1:53834 Accepted
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53834 Closing
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53842 Accepted
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53842 Closing
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53856 Accepted
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53856 Closing
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53866 Accepted
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53868 Accepted
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53866 Closing
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53868 Closing
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53886 Accepted
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53886 Closing
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53888 Accepted
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53888 Closing
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53894 Accepted
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53908 Accepted
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53894 Closing
[Fri Oct  2 07:28:57 2026] 127.0.0.1:53908 Closing
[Fri Oct  2 07:43:25 2026] 127.0.0.1:42916 Accepted
[Fri Oct  2 07:43:25 2026] 127.0.0.1:42916 Closed without sending a request; it was probably just an unused speculative preconnection
[Fri Oct  2 07:43:25 2026] 127.0.0.1:42916 Closing
[Fri Oct  2 07:43:26 2026] 127.0.0.1:42928 Accepted
[Fri Oct  2 07:43:26 2026] 127.0.0.1:42928 Closed without sending a request; it was probably just an unused speculative preconnection
[Fri Oct  2 07:43:26 2026] 127.0.0.1:42928 Closing
[Fri Oct  2 07:44:01 2026] 127.0.0.1:45272 Accepted
[Fri Oct  2 07:44:01 2026] 127.0.0.1:45272 Closed without sending a request; it was probably just an unused speculative preconnection
[Fri Oct  2 07:44:01 2026] 127.0.0.1:45272 Closing
[Fri Oct  2 07:44:03 2026] 127.0.0.1:45288 Accepted
[Fri Oct  2 07:44:03 2026] 127.0.0.1:45288 Closed without sending a request; it was probably just an unused speculative preconnection
[Fri Oct  2 07:44:03 2026] 127.0.0.1:45288 Closing
[Fri Oct  2 07:46:23 2026] 127.0.0.1:49158 Accepted
[Fri Oct  2 07:46:23 2026] 127.0.0.1:49158 Closed without sending a request; it was probably just an unused speculative preconnection
[Fri Oct  2 07:46:23 2026] 127.0.0.1:49158 Closing
[Fri Oct  2 07:46:24 2026] 127.0.0.1:49162 Accepted
[Fri Oct  2 07:46:24 2026] 127.0.0.1:49162 Closed without sending a request; it was probably just an unused speculative preconnection
[Fri Oct  2 07:46:24 2026] 127.0.0.1:49162 Closing
[Fri Oct  2 07:46:57 2026] 127.0.0.1:36892 Accepted
[Fri Oct  2 07:46:57 2026] 127.0.0.1:36892 Closed without sending a request; it was probably just an unused speculative preconnection
[Fri Oct  2 07:46:57 2026] 127.0.0.1:36892 Closing
[Fri Oct  2 07:46:59 2026] 127.0.0.1:36898 Accepted
[Fri Oct  2 07:46:59 2026] 127.0.0.1:36898 Closed without sending a request; it was probably just an unused speculative preconnection
[Fri Oct  2 07:46:59 2026] 127.0.0.1:36898 Closing
[Fri Oct  2 07:49:15 2026] 127.0.0.1:38910 Accepted
[Fri Oct  2 07:49:15 2026] 127.0.0.1:38910 Closing
[Fri Oct  2 07:59:50 2026] 127.0.0.1:48052 Accepted
[Fri Oct  2 07:59:50 2026] 127.0.0.1:48052 Closed without sending a request; it was probably just an unused speculative preconnection
[Fri Oct  2 07:59:50 2026] 127.0.0.1:48052 Closing
[Fri Oct  2 07:59:51 2026] 127.0.0.1:48060 Accepted
[Fri Oct  2 07:59:51 2026] 127.0.0.1:48060 Closed without sending a request; it was probably just an unused speculative preconnection
[Fri Oct  2 07:59:51 2026] 127.0.0.1:48060 Closing
[Fri Oct  2 08:00:24 2026] 127.0.0.1:37104 Accepted
[Fri Oct  2 08:00:24 2026] 127.0.0.1:37104 Closed without sending a request; it was probably just an unused speculative preconnection
[Fri Oct  2 08:00:24 2026] 127.0.0.1:37104 Closing
[Fri Oct  2 08:00:26 2026] 127.0.0.1:53040 Accepted
[Fri Oct  2 08:00:26 2026] 127.0.0.1:53040 Closed without sending a request; it was probably just an unused speculative preconnection
[Fri Oct  2 08:00:26 2026] 127.0.0.1:53040 Closing
[Fri Oct  2 08:02:01 2026] 127.0.0.1:40320 Accepted
[Fri Oct  2 08:02:01 2026] 127.0.0.1:40320 Closing
[Fri Oct  2 08:02:02 2026] 127.0.0.1:40332 Accepted