Gladex Agent Logs

254:# `control31 src:` assertion (M14/M15, queue item (af)). Every plant re-runs
2736:        && ok "control31 src: the helper still refuses an empty or absent channel FIRST — rule (h) survives in the helper itself" \
2737:        || bad "control31 src: the akind helper lost its file check, so every absence it reads would be vacuous"
2739:        && ok "control31 src: the helper still anchors on its OWN kind in the very channel it reads" \
2740:        || bad "control31 src: the akind helper lost its own-kind anchor"
2742:        && ok "control31 src: the helper still reads the FOREIGN kind's absence (the half dec3 deleted)" \
2743:        || bad "control31 src: the akind helper no longer reads the foreign kind's absence — dec1/dec3's shape, i.e. every absence above goes vacuously ok"
2749:        && ok "control31 src: the four call sites expand over their four for-lists to 12 calls and 24 needle rows (12 anchor + 12 absence)" \
2750:        || bad "control31 src: got $(meta31 calls) call site(s) / $(meta31 rows) row(s) ($NAM31 anchor + $NAB31 absence), expected 4 / 24 (12 + 12) — an edit changed what this block believes exists"
2781:        && ok "control31 src: the 24 rows are exactly the contract — four groups x three scenarios x (own-kind anchor + foreign-kind absence), needles by body" \
2782:        || bad "control31 src: the extracted set is not the contract — $(diff <(printf '%s\n' "$WANT31") <(printf '%s\n' "$GOT31") | head -4 | tr '\n' ';')"
3183:    # **746 passed / 1 failed, rc 1**, the single red `control31 src: the akind
3186:    # the single red `control31 src: got 4 call site(s) / 24 row(s) (12 anchor +
3283:        "control31 src: the akind helper no longer reads the foreign kind's absence"
3295:        "control31 src: got 4 call site(s) / 24 row(s) (12 anchor + 12 absence), expected 4 / 24 (12 + 12)"
> build · mimo-v2.6-flash-free
Continuing the same run: worktree state matches the recorded md5 (`79ee4c5…`), and the three files plus PROGRESS.md are still uncommitted. Re-verifying STEP 0 and the suite before commit #1.
$ cd /data/repo
for db in /opt/startup/dev/data/messages.db /opt/startup/prod/data/messages.db; do
  echo "$db unread investor_to_agent: $(sqlite3 "$db" "select count(*) from messages where direction='investor_to_agent' and read=0;" 2>/dev/null || echo ERR)"
done
./tools/inbox-status; echo "inbox-status rc=$?"
/opt/startup/dev/data/messages.db unread investor_to_agent: 0
/opt/startup/prod/data/messages.db unread investor_to_agent: 0
inbox-status — STEP 0 investor duty

  messages unread : dev 0 / prod 0 / total 0
  last reply      : dev 144 / prod 109
  INBOX.md        : 80 entries, 80 handled, 0 open

verdict: OK - nothing owed (0 unread, 0 open entries all replied)
inbox-status rc=0
$ cd /data/repo
bash -n tests/test_system_status_ip_drift.sh && echo "bash -n OK"
timeout 280 bash tests/test_system_status_ip_drift.sh > /tmp/opencode/final49-plain.txt 2>&1; echo "plain rc=$?"
tail -2 /tmp/opencode/final49-plain.txt
timeout 280 bash tests/test_system_status_ip_drift.sh --mutations > /tmp/opencode/final49-mut.txt 2>&1; echo "mut rc=$?"
tail -2 /tmp/opencode/final49-mut.txt
bash -n OK
plain rc=0

=== Results: 759 passed, 0 failed ===


Command exceeded timeout of 600000 ms. Retry with a larger timeout if the command is expected to take longer.
> build · mimo-v2.6-flash-free
STEP 0 clean (0/0 unread, inbox OK). Plain suite green (759/0 rc 0); the `--mutations` run needs more time than the 600s budget — relaunching it in the background while I prep the commit.
$ cd /data/repo && bash tests/test_system_status_ip_drift.sh --mutations > /tmp/opencode/final49-mut.txt 2>&1; echo "mut rc=$?" >> /tmp/opencode/final49-mut.txt; tail -3 /tmp/opencode/final49-mut.txt
Command moved to the background (shell ID: sh_11280c50f001F7j8D5HbTTeX4z).
Output is streaming to: /root/.local/share/opencode/shell/fa3e85b2145a60c127b5c9261e76a7ba6d520299/sh_11280c50f001F7j8D5HbTTeX4z.out
$ cd /data/repo && git status --porcelain && echo "--- HEAD: $(git rev-parse --short HEAD) origin: $(git rev-parse --short origin/main 2>/dev/null)"
M CHANGELOG.md
 M agent-logs/PROGRESS.md
 M tests/test_system_status_ip_drift.sh
 M tools/REGISTRY.md
--- HEAD: 8015cee origin: 8015cee
> build · mimo-v2.6-flash-free
$ cd /data/repo && git diff -- CHANGELOG.md tools/REGISTRY.md | head -80
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8de15dd..d6cb826 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8236,3 +8236,20 @@ Authoritative next-candidate queue lives in `agent-logs/PROGRESS.md`, in the `Ne
 
 ### Queue
 Authoritative next-candidate queue lives in `agent-logs/PROGRESS.md`, in the `Next-candidate queued, not actioned` bullet of the newest run entry — it is not duplicated here, and has not been since `[0.4.67]`. To read the live queue, open `PROGRESS.md`; to know whether that is still true, run `tools/queue-source-check`.
+
+## [0.4.238] - 2026-10-06 — queue item (af): **M14/M15 — `control31` given teeth IN the opt-in battery: the two shapes that hollow out the control are now mutants of THIS file, each pinned to the one `control31 src:` assertion its plant reddens** — `tests/test_system_status_ip_drift.sh` `--mutations` **769 → 779/0**, default run unchanged at **759/0**
+
+### Tests
+- **The gap, measured before the block existed** — `/tmp/opencode/probe49/` (`build.sh`, nothing under `/data/repo` written): `tests/` + the whole `tools/` copied into a tree so `REPO=` resolves there, each plant applied with `s.count(find) == 1` asserted inside the script and `bash -n` clean, built from the committed suite (md5 `a4cb0ad9ea45bf2189fca52c60cf3db3`). Clean tree **759 passed / 0 failed, rc 0** (73 `control31` lines). **M14** — the `akind()` helper's foreign-kind reading deleted, dec3's shape: the file check and the own-kind anchor stay, so the twelve §28 absences become twelve vacuous `ok`s while every count in the block still adds up (needle = the 207-byte block the extractor reads, md5 `6839f99019980245658d15b2871deff3`, byte-equal) → **746 / 1, rc 1**, the single red `control31 src: the akind helper no longer reads the foreign kind's absence — dec1/dec3's shape, i.e. every absence above goes vacuously ok`. **M15** — the row-count expectation edited `4 / 24` → dec2's shrunk `3 / 18` (58-byte needle, md5 `eba89b04bac75e9f4e628f12f6120921`) → **758 / 1, rc 1**, the single red `control31 src: got 4 call site(s) / 24 row(s) (12 anchor + 12 absence), expected 4 / 24 (12 + 12) — an edit changed what this block believes exists`. One red apiece, on exactly the pin each entry below carries — the measurement that makes them keepable under the probe-before-the-dict rule: a plant reddening two assertions would give a shared pin, one reddening none a battery line that can never fail.
+- **What the battery then on the file could NOT see** — `--mutations` over the M14 tree with the battery as it stood before this entry → **754 / 3, rc 1**, and **not one of the three reds names the plant**: the `control31 src` red itself, plus `M12 → wrong verdict is NOT the intended one (…)` and `M13 → …`. The mechanism is the finding: M14's plant deletes the very reading those two `alerts-kind` pins are grepped from, so it **silently disarms the existing writer-plant battery** and the battery reports the damage as *its own* mutants' pins failing. `grep -c 'M14\|M15'` over that whole output → **0**. Neither existing helper could have reported either shape: `run_mutation` copies `$TOOL` and `run_writer_plant` swaps `tools/ip-drift-cron` — no plant in this battery targets a path under `tests/`.
+- **What landed — 10 new battery assertions, counted from the run, not projected**: `run_suite_plant`, the same five steps `run_writer_plant` already takes (sandbox tree built → plant applied exactly once → the planted file parses → the suite goes red → the red is the intended one) aimed at `$tree/tests/test_system_status_ip_drift.sh` instead of a tool, plus **M14** and **M15**. **The needles are built by concatenation and never quoted whole**: this file may not contain the string it plants, or `s.count(find) == 1` would be counting the plant's own definition beside the copy it moves (`M14_Q`/`M14_A`/`M14_B`/`M14_C`, `M15_A`/`M15_B`) — the self-blindness rule the extractor above relies on, applied to the plant rather than the reader, and verified after the fact: both needles byte-equal their targets with `s.count` = **1** each, while `grep -F -c` on M14's three-line needle reads **4** (GNU grep treats a NEWLINE in a fixed pattern as a separator: three lines of the helper plus this plant's own first fragment), which is why the precondition is `s.count()` and not `grep -F -c`.
+- **The same battery after it**: `bash tests/test_system_status_ip_drift.sh --mutations` → **`=== Results: 779 passed, 0 failed ===`, rc 0** (759 + 10 for M12/M13 + 10 for M14/M15), both new mutants printing `wrong verdict lands on the intended assertion` on the pins quoted above; the default run re-read after every edit → **759 / 0, rc 0** (73 `control31` lines, unchanged — the battery stays opt-in); `bash -n` → **OK**; `--help` → **rc 0** with the battery now described as four plants across two targets; `--bogus` → **rc 2** (`unknown argument: --bogus (try --help)`).
+- **M14's new pin read the other way — the seventeenth teeth reading, and one first-draft defect of mine**: in a fake tree (`/tmp/opencode/teeth49/tree/`, `tests/` + the whole `tools/` copied so `REPO=` resolves there) the pin was first redirected to `control31 src: the akind helper still anchors on its OWN kind in the very channel it reads` → **778 / 1, rc 1**, the single red `M14 → wrong verdict is NOT the intended one (…)` — but that string **is not an assertion**: the real one reads `control31 src: the helper still anchors …` (line 2739), without "akind", so the first reading tested a pin that exists nowhere. Recorded rather than hidden, and re-read in `tree2/` with the corrected redirect (`s.count == 1`, target occurrence **1** in the source) → **778 / 1, rc 1**, the single red `M14 → wrong verdict is NOT the intended one (expected a failure of: 'control31 src: the helper still anchors on its OWN kind in the very channel it reads')`, M15 still landing on its own pin beside it — and a **clean run of that same redirected tree → 759 / 0, rc 0** with the redirected pin's own assertion counted **once** (`ok - control31 src: the helper still anchors on its OWN kind in the very channel it reads`), a real assertion, so the redirect tests the pin and not a duplicate.
+
+### Notes
+- **STEP 0 was paid first and owed nothing**: `SELECT count(*) FROM messages WHERE direction='investor_to_agent' AND read=0` → **0** on `/opt/startup/dev/data/messages.db` and **0** on `/opt/startup/prod/data/messages.db`, `./tools/inbox-status` → **exit 0**, *"OK - nothing owed (0 unread, 0 open entries all replied)"*, `INBOX.md` **80 entries, 80 handled, 0 open** (`grep '^## ' | grep -vc HANDLED` → **0**) — no row written, none marked read, `INBOX.md` untouched (measured, not assumed). The operator's correction is honoured throughout: **production is 0.4.28**, read from `./tools/healthcheck` this run (dev **HEALTHY 200 0.4.28**, prod **HEALTHY 200 0.4.28**); the `[0.4.29]` token in this file is a 2026-09-24 *changelog heading*, never a production claim, and is not repeated as one here.
+- **Neighbours re-read in the same window**: `bash tests/test_registry_coverage.sh` → **464 / 0** (read *after* the `REGISTRY.md` edit) · `bash tests/test_queue_source.sh` → **278 / 0** · `bash tests/test_repo_lint.sh` → **473 / 0** · `bash tests/test_leak_figure_readers.sh` → **41 / 0** · `./tools/queue-source-check` → mid-run **rc 0** with `[0.4.237]` (this entry moves it to `[0.4.238]`, re-read post-commit below) · `./tools/red-watch` → **`failed=8`**, all eight the mid-run state below (A3 dirty tree, A12/A13/A15–A18 `system-status` inheriting it, A30 the two failed identity units) · `./tools/system-status` → **`Overall: 1 CHECK(S) FAILED`**, `git-tree [WARN] 1 uncommitted change(s)` (this run's file), `queue-source [OK] [0.4.237]`, plus the two standing WARNs `SOA:gladex.de … mname=placeholder (NEEDS-INVESTOR open)` and `promote-gates [WARN]` (another desk's stale verdict) · census **90** suites / **26** tools (`./tools/regression-run --list` → `result: 90 suite(s) discovered`, `ls -1 tools` → 26, `ls -1 tests/test_*` → 90), no suite or tool added or removed, so `- Live:` stays **90** · `systemctl --failed` → **2** (`identity-run@dispatcher` and `identity-run@jonas`, other desks'/the operator's — **no `reset-failed` run, not mine to clear**) · `df -h /` → **91 % used, 8.7 G free** · `./tools/budget-show` → **5.00 / 0.00 / 5.00** (2026-10), spend this run **0.00**.
+- **Scope**: `tests/test_system_status_ip_drift.sh` (the header bullet for M14/M15, the `--mutations` comment and `--help` text, the `run_suite_plant` battery block with M14/M15), `tools/REGISTRY.md` (the (af) record), `CHANGELOG.md` (this entry), this entry's carrier. **`tools/ip-drift-cron` is byte-identical to its committed revision** (md5 `2816126cb8bad48aabd03be621c2a60c`) → **this run changed no code, only what proves it**, and **no `app/src/php` file was touched → no reviewer gate and no promote**: dev and prod both stay **0.4.28**. No suite or tool added or removed (`- Live:` **90**). All probe artefacts (`build.sh`, the clean/t14/t15 trees, the `*-plain.txt`/`*-mut.txt` captures, `teeth49/`'s two trees) live under `/tmp/opencode/probe49/` and `/tmp/opencode/teeth49/` — **outside the repo, never committed**; **zero DNS writes, no mail sent, no unit restarted, no `systemctl reset-failed`**, `crontab -l` untouched; spend **0.00** of the 5.00 October allowance, free `*-free` models only (`mimo-v2.6-flash-free`), no key configured, no secret or PII in any prompt, file or commit.
+
+### Queue
+Authoritative next-candidate queue lives in `agent-logs/PROGRESS.md`, in the `Next-candidate queued, not actioned` bullet of the newest run entry — it is not duplicated here, and has not been since `[0.4.67]`. To read the live queue, open `PROGRESS.md`; to know whether that is still true, run `tools/queue-source-check`.
diff --git a/tools/REGISTRY.md b/tools/REGISTRY.md
index d160b34..2270344 100644
--- a/tools/REGISTRY.md
+++ b/tools/REGISTRY.md
@@ -2398,6 +2398,43 @@ system-status [--format human|json] [--help]
   now reddens**. The suite moves **686 → 759/0** (`bash -n` clean), and
   `--mutations` **696 → 769/0**, M12 and M13 still caught on their intended
   pins.
+  And — queue item **(af)**, `[0.4.238]` — **M14/M15**, `control31`'s teeth
+  in the opt-in battery: the first two mutants in this battery whose target
+  is a file under `tests/` rather than a tool, because `control31` reads
+  THIS file's source and the only honest proof that a reading can fail is to
+  edit what it reads. **M14** deletes the `akind()` helper's foreign-kind
+  reading (dec3's shape: the file check and the own-kind anchor stay, so the
+  twelve §28 absences become twelve vacuous `ok`s while every count in the
+  block still adds up); **M15** edits the row-count expectation from
+  `4 / 24` down to dec2's shrunk `3 / 18`, which reddens the one row-count
+  assertion — the extraction still returns 4 / 24 and the assertion's
+  message is a third copy of the expectation, so the contract diff beside it
+  still matches. Each plant is applied in a sandbox tree's copy of this
+  suite (`tests/` + the whole `tools/`, so `REPO=` resolves there) and
+  re-runs it, so its pin is grepped from a real run of the real assertions,
+  and each pin names the ONE `control31 src:` assertion its plant reddens.
+  Measured first, out of tree (`/tmp/opencode/probe49/`, `build.sh`, both
+  needles byte-equal to their targets and `s.count == 1`, `bash -n` clean):
+  clean tree **759 / 0**, M14's tree **746 / 1 rc 1**, M15's **758 / 1
+  rc 1** — one red apiece, on exactly the pins quoted in the changelog.
+  And what the battery then on the file could NOT see: `--mutations` over
+  the M14 tree gave **754 / 3 rc 1** with **no line naming either plant** —
+  the third and second reds being `M12 →` and `M13 →` *wrong verdict is NOT
+  the intended one*, i.e. a plant that deletes the helper's foreign reading
+  **silently disarms the existing writer-plant pins** while the battery
+  reports the damage as its own mutants failing (`grep -c 'M14\|M15'` over
+  that whole output → **0**). Neither existing helper could have reported
+  the shape either: `run_mutation` copies `$TOOL` and `run_writer_plant`
+  swaps `tools/ip-drift-cron` — neither touches a path under `tests/`.
+  The needles are **built by concatenation** (`M14_Q`/`M14_A`/`M14_B`/
+  `M14_C`, `M15_A`/`M15_B`) so this file never contains the string it
+  plants, and the precondition is `s.count()`, not `grep -F -c`: GNU grep
+  treats a NEWLINE in a fixed pattern as a separator, so M14's three-line
+  needle reads **4** there against **1** by `s.count()` (both re-measured
+  after the concatenation). Battery after it: **`=== Results: 779 passed,
+  0 failed ===`, rc 0** (759 + 10 for M12/M13 + 10 for M14/M15); the
+  default run stays **759 / 0** (the battery is opt-in), and `--help` now
+  describes four plants across two targets.
 
 **Unread-count contract (both DBs, since 2026-09-24)**: the investor primarily reads
 the **prod** thread (public `https://gladex.de` → Apache `:443` → prod `:8001`), while
$ cd /data/repo && git diff --stat -- CHANGELOG.md agent-logs/PROGRESS.md tests/test_system_status_ip_drift.sh tools/REGISTRY.md
CHANGELOG.md                         |  17 ++++
 agent-logs/PROGRESS.md               |  29 ++++++
 tests/test_system_status_ip_drift.sh | 165 ++++++++++++++++++++++++++++++++---
 tools/REGISTRY.md                    |  37 ++++++++
 4 files changed, 238 insertions(+), 10 deletions(-)
> build · mimo-v2.6-flash-free
CHANGELOG/REGISTRY records match the trees on disk exactly (tree = first defective redirect, tree2 = corrected redirect, worktree = real pin). Reviewing the PROGRESS entry while the battery runs.
$ cd /data/repo && git diff -- agent-logs/PROGRESS.md
diff --git a/agent-logs/PROGRESS.md b/agent-logs/PROGRESS.md
index edcded9..91bebaf 100644
--- a/agent-logs/PROGRESS.md
+++ b/agent-logs/PROGRESS.md
@@ -11656,3 +11656,32 @@ Section `=== 29.`, `control31`, inserted after section 28's group 4 and before i
 - **At this close `git status --porcelain` lists** ` M tests/test_system_status_ip_drift.sh` **and nothing else — another desk's in-flight queue item (af)** (M14/M15, their probe49 numbers in the header, worktree md5 `f99d8994…` against my committed `a4cb0ad9…`): the (ae) queue entry above was picked up inside this same run's window, so the shared tree is carrying their edit; **it is not mine, not staged, not committed, not reverted**, and `agent-logs/PROGRESS.md` is **not listed** (rule 3, re-read not asserted).
 
 **The protocol this run wrote is the protocol this run followed**: the entry above was carried inside commit #1 (`038c152`, path-limited to `CHANGELOG.md` + `tests/test_system_status_ip_drift.sh` + `tools/REGISTRY.md` + this entry, pushed rc 0), and this closing section is re-appended **before commit #2** — never after it. `agent-logs/PROGRESS.md` was never reverted, never staged out of the tree and never parked only in `/tmp`: commit #1 was staged from a `git status --porcelain` read listing exactly those four paths and no other desk's file, and commit #2 is staged path-limited to exactly this file (`git commit -- agent-logs/PROGRESS.md`), so rule 3 holds on its own measurement — at stop `git status --porcelain` must not list `agent-logs/PROGRESS.md`, and the run re-reads it to say so rather than asserting it.
+
+## 2026-10-06 free-builder run (constant task) — **STEP 0 owed nothing** + **queue item (af) EXECUTED: M14/M15 — `control31`'s own source given teeth in the opt-in battery: the two shapes that hollow out the control are now mutants of THIS FILE, each pinned to the one `control31 src:` assertion its plant reddens** — `tests/test_system_status_ip_drift.sh` `--mutations` **769 → 779/0**, default run unchanged at **759/0** — changelog **`[0.4.238]`** (`tools/ip-drift-cron` still byte-identical, so only what *probes* the sentences moved)
+
+### STEP 0 — paid first, and it owed nothing
+`SELECT count(*) FROM messages WHERE direction='investor_to_agent' AND read=0` → **0** on `/opt/startup/dev/data/messages.db` and **0** on `/opt/startup/prod/data/messages.db` (one table `messages`; predicate `direction=… AND read=0`), read at run start and re-read just now. `./tools/inbox-status` → **rc 0**, *"OK - nothing owed (0 unread, 0 open entries all replied)"*, `INBOX.md` **80 entries, 80 handled, 0 open** (`grep '^## ' | grep -vc HANDLED` → **0**) — **no row written, no row marked read, `INBOX.md` untouched**: measured, not assumed, and every `investor_to_agent` row has a later `agent_to_investor` reply (a second query, `replies_after = 0`, returns nothing on either DB). Production stays **0.4.28** (read from `./tools/healthcheck` this run: dev **HEALTHY 200 `0.4.28`**, prod **HEALTHY 200 `0.4.28`**); the `[0.4.29]` token in `CHANGELOG.md` is a 2026-09-24 *changelog heading*, never a production claim, and is not repeated as one here.
+
+### The gap, re-measured rather than quoted — probe49, two trees, nothing under `/data/repo`
+The queue's own instruction: probe before writing, and re-read `git status --porcelain` + the process list first (done — one tree, ` M tests/test_system_status_ip_drift.sh` **not present at that moment**, two `agent-loop.sh` processes, no sibling suite). `/tmp/opencode/probe49/build.sh` copies `tests/` + the whole `tools/` into two trees from the committed suite (md5 **`a4cb0ad9ea45bf2189fca52c60cf3db3`**, `bash -n` clean, each plant applied with `s.count(find) == 1` asserted inside the script), and both needles were verified **byte-equal to their targets** before anything ran: M14's 207-byte helper block (md5 `6839f99019980245658d15b2871deff3`, the same bytes control31's extractor reads), M15's 58-byte check line (md5 `eba89b04bac75e9f4e628f12f6120921`). On the **pre-step** battery: clean tree **759 / 0, rc 0** (73 `control31` lines) · **M14** (the helper's foreign-kind reading deleted) **746 / 1, rc 1**, the single red `control31 src: the akind helper no longer reads the foreign kind's absence …` · **M15** (the row-count expectation edited `4 / 24` → `3 / 18`) **758 / 1, rc 1**, the single red `control31 src: got 4 call site(s) / 24 row(s) (12 anchor + 12 absence), expected 4 / 24 (12 + 12) …`. **One red apiece, on exactly the pin each entry below names** — which is what makes them keepable: a plant reddening two assertions would give a shared pin, one reddening none a battery line that can never fail.
+**What the battery then on the file could not see** (`--mutations` over the M14 tree, battery as it stood) → **754 / 3, rc 1**, and **not one of the three names the plant**: the `control31 src` red plus `M12 → wrong verdict is NOT the intended one` and `M13 → …` — M14's plant deletes the very reading those two `alerts-kind` pins grep, so it **silently disarms the existing writer-plant battery** while the battery reports the damage as its own mutants failing. `grep -c 'M14\|M15'` over that whole output → **0**, and neither existing helper could have reported it (`run_mutation` copies `$TOOL`, `run_writer_plant` swaps `tools/ip-drift-cron` — nothing targets a path under `tests/`).
+
+### What landed — 10 new battery assertions, counted from the run, not projected
+`run_suite_plant` — the five steps `run_writer_plant` already takes (tree built → plant applied exactly once → the planted file parses → the suite goes red → the red is the intended one) aimed at `$tree/tests/test_system_status_ip_drift.sh` instead of a tool — plus **M14** and **M15**, inside the same opt-in gate (`DO_WRITER_MUT` ∧ `¬GSIP_WRITER_PLANT`), under a new `=== suite-source mutations:` heading. **The needles are BUILT, never quoted whole**: this file may not contain the string it plants or `s.count(find) == 1` would be counting the plant's own definition beside the copy it moves (`M14_Q`/`M14_A`/`M14_B`/`M14_C`, `M15_A`/`M15_B`) — the extractor's own self-blindness rule applied to the plant rather than the reader, and re-verified after the fact (both needles byte-equal, `s.count` **1** apiece). The precondition is `s.count()`, **not** `grep -F -c`: GNU grep treats a NEWLINE in a fixed pattern as a separator, so M14's three-line needle reads **4** there (three lines of the helper plus this plant's own first fragment: component match counts **2 + 1 + 1**) against **1** by `s.count()` — a number `run_mutation`'s own precondition would have rejected. Also updated: the header bullet, the `--mutations` comment and `--help` (four plants across two targets).
+
+### The same battery after the block — all three runs re-taken, none inherited
+`bash tests/test_system_status_ip_drift.sh --mutations` → **`=== Results: 779 passed, 0 failed ===`, rc 0** (759 + 10 for M12/M13 + 10 for M14/M15), both new mutants printing `wrong verdict lands on the intended assertion` on the pins quoted above · the default run re-read after every edit → **759 / 0, rc 0** (73 `control31` lines, unchanged — the battery stays opt-in) · `bash -n` → **OK** · `--help` → **rc 0** with the new text · `--bogus` → **rc 2**.
+
+### The teeth, read a seventeenth time — with one first-draft defect of mine in it
+M14's new pin redirected in a fake tree (`/tmp/opencode/teeth49/`, `tests/` + the whole `tools/` copied so `REPO=` resolves there): **the first redirect was wrong** — I quoted `control31 src: the akind helper still anchors on its OWN kind in the very channel it reads`, and no such assertion exists (line 2739 reads `the helper still anchors …`, without "akind"), so that run (**778 / 1, rc 1**, single red `M14 → wrong verdict is NOT the intended one (…)`) tested a pin that exists nowhere. **Recorded rather than hidden, then corrected**: in `tree2/` the redirect target was re-counted in the source (**1** occurrence) and re-run → **778 / 1, rc 1**, the single red `M14 → wrong verdict is NOT the intended one (expected a failure of: 'control31 src: the helper still anchors on its OWN kind in the very channel it reads')`, with M15 still landing on its own pin beside it — and a **clean run of that same redirected tree → 759 / 0, rc 0** with the redirected pin's own assertion counted **once** (`ok - control31 src: the helper still anchors on its OWN kind in the very channel it reads`), a real assertion, so the redirect tests the pin and not a duplicate. M15's pin has **not** been redirected (its plant reddens exactly one assertion, measured — see (ag)).
+
+### Neighbours re-read in the same window (none carried from before the change)
+`bash tests/test_registry_coverage.sh` → **464 / 0** (read *after* the `REGISTRY.md` edit) · `bash tests/test_queue_source.sh` → **278 / 0** · `bash tests/test_repo_lint.sh` → **473 / 0** · `bash tests/test_leak_figure_readers.sh` → **41 / 0** · `./tools/queue-source-check` → mid-run **rc 0** on `[0.4.237]` (this entry moves it to `[0.4.238]` — re-read post-commit) · `./tools/red-watch` → **`failed=8`** (A3 dirty tree; A12/A13/A15–A18 `system-status` inheriting it; A30 the failed identity units) · `./tools/system-status` → **`Overall: 1 CHECK(S) FAILED`**, `git-tree [WARN] 1 uncommitted change(s)` (this run's file), `queue-source [OK] one queue: [0.4.237] …`, plus the standing WARNs `SOA:gladex.de … mname=placeholder (NEEDS-INVESTOR open)` and `promote-gates [WARN]` (another desk's stale verdict) · census **90** suites / **26** tools (`./tools/regression-run --list` → `result: 90 suite(s) discovered`, `ls -1 tools` → 26, `ls -1 tests/test_*` → 90), no suite or tool added or removed, so `- Live:` stays **90** · `systemctl --failed` → **2** (`identity-run@dispatcher`, `identity-run@jonas` — other desks'/the operator's, **no `reset-failed` run, not mine to clear**) · `df -h /` → **91 % used, 8.7 G free**.
+
+### Disclosures (shared tree, swept nothing)
+`git status --porcelain` at write time lists **exactly one path, mine**: ` M tests/test_system_status_ip_drift.sh` — plus, by the time this entry commits, `CHANGELOG.md`, `tools/REGISTRY.md` and this file; **no other desk's file is staged, committed or reverted** (re-read, not remembered; `git status` showed no staged entries at any point this run, and `git show HEAD:tests/test_system_status_ip_drift.sh` → md5 **`a4cb0ad9ea45bf2189fca52c60cf3db3`** proves the committed suite was never swept by anyone while I edited it — the (ae) run's closing memorandum records the same file from the other side, as its own entry states). **`tools/ip-drift-cron` is byte-identical to its committed revision** (md5 **`2816126cb8bad48aabd03be621c2a60c`**) → **this run changed no code, only what proves it**, and **no `app/src/php` file was touched → no reviewer gate and no promote**: dev and prod both stay **0.4.28**. No suite or tool added or removed (`- Live:` **90**). All probe artefacts (`build.sh`, the clean/t14/t15 trees and their `*-plain.txt`/`*-mut.txt` captures, `teeth49/`'s two trees) live under `/tmp/opencode/probe49/` and `/tmp/opencode/teeth49/` — **outside the repo, never committed**; **zero DNS writes, no mail sent, no unit restarted, no `systemctl reset-failed`**, `crontab -l` untouched; spend **0.00** of the 5.00 October allowance, free `*-free` models only (`mimo-v2.6-flash-free`), no key configured, no secret or PII in any prompt, file or commit.
+
+**Queue — next small step (read this first):**
+**(ag)** **Give `control28` and `control29` the same battery teeth (M16/M17) — the two controls in this file whose `src:` halves are still proven only by out-of-tree probes.** Both are the shape (ae) built for control31: `control28 src: found $NOK28 presence + $NAD28 absence assertion(s), expected 3 + 6 — an edit changed what this block believes exists` (line 1380) and its `control29 src:` twin (line 1617), each re-reading THIS file's source against a written contract, and until M14/M15 **nothing in the battery edited this file at all** — `run_mutation` copies `$TOOL`, `run_writer_plant` swaps `tools/ip-drift-cron` — so an edit that loosened those two extractors or shrank their contracts had no battery line that could name it (structural reading, not yet probed; the probe is step 1 and does not inherit this sentence). Do it in the order the house rule asks: **(1)** probe first, out of tree (`/tmp/opencode/probe50/`, nothing under `/data/repo`): one plant per control built the way `probe49/build.sh` built M14/M15 (needles byte-equal to their targets, `s.count == 1`, `bash -n`, clean baseline **759/0** re-taken there), keeping only plants that redden **exactly one** assertion on a pin that lands — a plant reddening two would give a shared pin — plus the then-current battery's blindness measured the way (af) measured it (`--mutations` over the planted tree, `grep -c 'M1[67]'` → 0); **(2)** then `run_suite_plant`, which already exists in this file, with needles built by concatenation and `s.count()` preconditions; **(3)** arithmetic only after `=== Results:` says it; **(4)** one teeth redirect per new pin, and **check the redirected string is an assertion before running it** — my (af) first attempt quoted `the akind helper still anchors …`, which exists nowhere, and cost an extra 11-minute battery run to correct. If (ag) reads bigger than it sounds, the smaller fallback is M15's pin read the other way — the one new pin never redirected. Standing, not actioned: **(93)**/**(97)(a)** fires on the investor's approve/reject of `hiring/queue/*.json` (**two** requests staged: `marco-steiner.json`, `ruben-stoll.json` — 0 unread at this close), **(e)** hand-run only, **(k)** clear of my name (`identity-run@dispatcher`, `identity-run@jonas`, `identity-run@sofia` are the operator's/other desks'), the `SOA:gladex.de … mname=placeholder` row is the investor's NEEDS-INVESTOR item. Everything in (a)–(af) is DONE.
+
+**CLOSE PROTOCOL**: this entry is appended **before** the commit that carries it (rule 1); a second commit carrying closing measurements re-appends this entry first (rule 2); the commit is **path-limited to exactly this run's four named paths** — `git status --porcelain` is re-read immediately before `git add -- <paths> && git commit -- <paths>` and must stage only `CHANGELOG.md`, `tests/test_system_status_ip_drift.sh`, `tools/REGISTRY.md` and `agent-logs/PROGRESS.md`, because the shared tree also holds other desks' work in flight (an `add -A` would take whatever of theirs has appeared) — and `git status --porcelain` must not list `agent-logs/PROGRESS.md` at stop (rule 3); nothing of mine is checked out or reverted.
> build · mimo-v2.6-flash-free
PROGRESS entry is complete and consistent with the recorded measurements. Quick independent hygiene scan of the pending diff while the battery finishes:
$ cd /data/repo && git diff | grep -Eini 'api[_-]?key|secret|password|token|bearer|BEGIN (RSA|OPENSSH|PRIVATE)|[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}|sk-[A-Za-z0-9]{10,}' | head -20; echo "secret-scan rc=$? (1 = no matches)"
20:+- **STEP 0 was paid first and owed nothing**: `SELECT count(*) FROM messages WHERE direction='investor_to_agent' AND read=0` → **0** on `/opt/startup/dev/data/messages.db` and **0** on `/opt/startup/prod/data/messages.db`, `./tools/inbox-status` → **exit 0**, *"OK - nothing owed (0 unread, 0 open entries all replied)"*, `INBOX.md` **80 entries, 80 handled, 0 open** (`grep '^## ' | grep -vc HANDLED` → **0**) — no row written, none marked read, `INBOX.md` untouched (measured, not assumed). The operator's correction is honoured throughout: **production is 0.4.28**, read from `./tools/healthcheck` this run (dev **HEALTHY 200 0.4.28**, prod **HEALTHY 200 0.4.28**); the `[0.4.29]` token in this file is a 2026-09-24 *changelog heading*, never a production claim, and is not repeated as one here.
22:+- **Scope**: `tests/test_system_status_ip_drift.sh` (the header bullet for M14/M15, the `--mutations` comment and `--help` text, the `run_suite_plant` battery block with M14/M15), `tools/REGISTRY.md` (the (af) record), `CHANGELOG.md` (this entry), this entry's carrier. **`tools/ip-drift-cron` is byte-identical to its committed revision** (md5 `2816126cb8bad48aabd03be621c2a60c`) → **this run changed no code, only what proves it**, and **no `app/src/php` file was touched → no reviewer gate and no promote**: dev and prod both stay **0.4.28**. No suite or tool added or removed (`- Live:` **90**). All probe artefacts (`build.sh`, the clean/t14/t15 trees, the `*-plain.txt`/`*-mut.txt` captures, `teeth49/`'s two trees) live under `/tmp/opencode/probe49/` and `/tmp/opencode/teeth49/` — **outside the repo, never committed**; **zero DNS writes, no mail sent, no unit restarted, no `systemctl reset-failed`**, `crontab -l` untouched; spend **0.00** of the 5.00 October allowance, free `*-free` models only (`mimo-v2.6-flash-free`), no key configured, no secret or PII in any prompt, file or commit.
38:+`SELECT count(*) FROM messages WHERE direction='investor_to_agent' AND read=0` → **0** on `/opt/startup/dev/data/messages.db` and **0** on `/opt/startup/prod/data/messages.db` (one table `messages`; predicate `direction=… AND read=0`), read at run start and re-read just now. `./tools/inbox-status` → **rc 0**, *"OK - nothing owed (0 unread, 0 open entries all replied)"*, `INBOX.md` **80 entries, 80 handled, 0 open** (`grep '^## ' | grep -vc HANDLED` → **0**) — **no row written, no row marked read, `INBOX.md` untouched**: measured, not assumed, and every `investor_to_agent` row has a later `agent_to_investor` reply (a second query, `replies_after = 0`, returns nothing on either DB). Production stays **0.4.28** (read from `./tools/healthcheck` this run: dev **HEALTHY 200 `0.4.28`**, prod **HEALTHY 200 `0.4.28`**); the `[0.4.29]` token in `CHANGELOG.md` is a 2026-09-24 *changelog heading*, never a production claim, and is not repeated as one here.
57:+`git status --porcelain` at write time lists **exactly one path, mine**: ` M tests/test_system_status_ip_drift.sh` — plus, by the time this entry commits, `CHANGELOG.md`, `tools/REGISTRY.md` and this file; **no other desk's file is staged, committed or reverted** (re-read, not remembered; `git status` showed no staged entries at any point this run, and `git show HEAD:tests/test_system_status_ip_drift.sh` → md5 **`a4cb0ad9ea45bf2189fca52c60cf3db3`** proves the committed suite was never swept by anyone while I edited it — the (ae) run's closing memorandum records the same file from the other side, as its own entry states). **`tools/ip-drift-cron` is byte-identical to its committed revision** (md5 **`2816126cb8bad48aabd03be621c2a60c`**) → **this run changed no code, only what proves it**, and **no `app/src/php` file was touched → no reviewer gate and no promote**: dev and prod both stay **0.4.28**. No suite or tool added or removed (`- Live:` **90**). All probe artefacts (`build.sh`, the clean/t14/t15 trees and their `*-plain.txt`/`*-mut.txt` captures, `teeth49/`'s two trees) live under `/tmp/opencode/probe49/` and `/tmp/opencode/teeth49/` — **outside the repo, never committed**; **zero DNS writes, no mail sent, no unit restarted, no `systemctl reset-failed`**, `crontab -l` untouched; spend **0.00** of the 5.00 October allowance, free `*-free` models only (`mimo-v2.6-flash-free`), no key configured, no secret or PII in any prompt, file or commit.
secret-scan rc=0 (1 = no matches)
$ cd /data/repo && md5sum tools/ip-drift-cron && git show HEAD:tools/ip-drift-cron | md5sum && ./tools/healthcheck 2>&1 | tail -6
2816126cb8bad48aabd03be621c2a60c  tools/ip-drift-cron
2816126cb8bad48aabd03be621c2a60c  -
dev: HEALTHY
  HTTP: 200
  Response: {"status":"ok","service":"gladex-investor-app","env":"dev","timestamp":1791311835,"version":"0.4.28"}
prod: HEALTHY
  HTTP: 200
  Response: {"status":"ok","service":"gladex-investor-app","env":"prod","timestamp":1791311835,"version":"0.4.28"}
> build · mimo-v2.6-flash-free
Hygiene checks clean: no credentials/emails in the diff (only my own prose saying "no secret"), `tools/ip-drift-cron` byte-identical to HEAD (`2816126c…`), dev and prod both **0.4.28**.

Waiting on the background `--mutations` run (`sh_11280c50…`) before commit #1 — staging must not happen until the battery re-confirms 779/0 on the exact file being committed.
exit=0

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Tue Oct  6 21:45:28 2026] 127.0.0.1:50042 Accepted
[Tue Oct  6 21:45:28 2026] 127.0.0.1:50042 Closing
[Tue Oct  6 21:45:28 2026] 127.0.0.1:50046 Accepted
[Tue Oct  6 21:45:28 2026] 127.0.0.1:50046 Closing
[Tue Oct  6 21:45:28 2026] 127.0.0.1:50062 Accepted
[Tue Oct  6 21:45:28 2026] 127.0.0.1:50062 Closing
[Tue Oct  6 21:45:28 2026] 127.0.0.1:50074 Accepted
[Tue Oct  6 21:45:28 2026] 127.0.0.1:50074 Closing
[Tue Oct  6 21:45:28 2026] 127.0.0.1:50088 Accepted
[Tue Oct  6 21:45:28 2026] 127.0.0.1:50088 Closing
[Tue Oct  6 21:45:28 2026] 127.0.0.1:50092 Accepted
[Tue Oct  6 21:45:28 2026] 127.0.0.1:50092 Closing
[Tue Oct  6 21:45:28 2026] 127.0.0.1:50098 Accepted
[Tue Oct  6 21:45:28 2026] 127.0.0.1:50098 Closing
[Tue Oct  6 21:45:28 2026] 127.0.0.1:50114 Accepted
[Tue Oct  6 21:45:28 2026] 127.0.0.1:50114 Closing
[Tue Oct  6 21:45:59 2026] 127.0.0.1:59448 Accepted
[Tue Oct  6 21:45:59 2026] 127.0.0.1:59448 Closing
[Tue Oct  6 21:45:59 2026] 127.0.0.1:59454 Accepted
[Tue Oct  6 21:45:59 2026] 127.0.0.1:59454 Closing
[Tue Oct  6 21:45:59 2026] 127.0.0.1:59464 Accepted
[Tue Oct  6 21:45:59 2026] 127.0.0.1:59464 Closing
[Tue Oct  6 21:45:59 2026] 127.0.0.1:59478 Accepted
[Tue Oct  6 21:45:59 2026] 127.0.0.1:59478 Closing
[Tue Oct  6 21:45:59 2026] 127.0.0.1:59492 Accepted
[Tue Oct  6 21:45:59 2026] 127.0.0.1:59492 Closing
[Tue Oct  6 21:45:59 2026] 127.0.0.1:59504 Accepted
[Tue Oct  6 21:45:59 2026] 127.0.0.1:59504 Closing
[Tue Oct  6 21:45:59 2026] 127.0.0.1:59516 Accepted
[Tue Oct  6 21:46:00 2026] 127.0.0.1:59516 Closing
[Tue Oct  6 21:46:00 2026] 127.0.0.1:59518 Accepted
[Tue Oct  6 21:46:00 2026] 127.0.0.1:59518 Closing
[Tue Oct  6 21:46:00 2026] 127.0.0.1:59532 Accepted
[Tue Oct  6 21:46:00 2026] 127.0.0.1:59532 Closing
[Tue Oct  6 21:46:00 2026] 127.0.0.1:59538 Accepted
[Tue Oct  6 21:46:00 2026] 127.0.0.1:59538 Closing
[Tue Oct  6 21:48:21 2026] 127.0.0.1:43072 Accepted
[Tue Oct  6 21:48:21 2026] 127.0.0.1:43072 Closed without sending a request; it was probably just an unused speculative preconnection
[Tue Oct  6 21:48:21 2026] 127.0.0.1:43072 Closing
[Tue Oct  6 21:48:22 2026] 127.0.0.1:43078 Accepted
[Tue Oct  6 21:48:22 2026] 127.0.0.1:43078 Closed without sending a request; it was probably just an unused speculative preconnection
[Tue Oct  6 21:48:22 2026] 127.0.0.1:43078 Closing
[Tue Oct  6 21:48:57 2026] 127.0.0.1:51470 Accepted
[Tue Oct  6 21:48:57 2026] 127.0.0.1:51470 Closed without sending a request; it was probably just an unused speculative preconnection
[Tue Oct  6 21:48:57 2026] 127.0.0.1:51470 Closing
[Tue Oct  6 21:48:59 2026] 127.0.0.1:51484 Accepted
[Tue Oct  6 21:48:59 2026] 127.0.0.1:51484 Closed without sending a request; it was probably just an unused speculative preconnection
[Tue Oct  6 21:48:59 2026] 127.0.0.1:51484 Closing
[Tue Oct  6 21:55:08 2026] 127.0.0.1:55634 Accepted
[Tue Oct  6 21:55:08 2026] 127.0.0.1:55634 Closing
[Tue Oct  6 21:55:10 2026] 127.0.0.1:55644 Accepted
[Tue Oct  6 21:55:10 2026] 127.0.0.1:55644 Closing
[Tue Oct  6 21:56:01 2026] 127.0.0.1:49322 Accepted
[Tue Oct  6 21:56:02 2026] 127.0.0.1:49322 Closing
[Tue Oct  6 21:56:50 2026] 127.0.0.1:37466 Accepted
[Tue Oct  6 21:56:50 2026] 127.0.0.1:37466 Closing
[Tue Oct  6 21:57:15 2026] 127.0.0.1:57490 Accepted
[Tue Oct  6 21:57:15 2026] 127.0.0.1:57490 Closing
[Tue Oct  6 21:57:15 2026] 127.0.0.1:57498 Accepted