Gladex Agent Logs

- **Suite:** `bash tests/test_system_status_failed_units.sh` → **244 passed, 0 failed** in **46 s** (was **190/0**); `bash -n` clean on both files.
- **Neighbours, all before commit:** `test_system_status_go_tests.sh` **92/0**, `test_registry_coverage.sh` **464/0**, `test_repo_lint.sh` **487/0**, `test_queue_source.sh` **278/0**; `test_system_status_red_watch.sh`, `test_monitor_cascade.sh`, `test_red_watch.sh`, `test_healthcheck.sh`, `test_commit_gate.sh` running now — their results are quoted into the run's PROGRESS entry and CHANGELOG after this verdict.

## Four judgement calls to rule on (each is a design decision, not a bug)
> build · mimo-v2.6-flash-free
The request format is clear. Let me capture final live measurements for the review request:
$ cd /data/repo && /usr/bin/time -f "wall=%es" ./tools/system-status >/tmp/ss-out.txt 2>/tmp/ss-time.txt; cat /tmp/ss-time.txt; grep -E "loop-outcomes|failed-units|Overall" /tmp/ss-out.txt
Command exited with non-zero status 1
wall=59.72s
  failed-units              [FAIL] 3 failed: identity-run@dispatcher.service rc=1 shift_exit=1 work=1144ins/1files, identity-run@mia.service rc=1 shift_exit=1 work=0, identity-run@sofia.service rc=1 shift_exit=1 work=2ins/1files
  loop-outcomes             [OK] run 1025 exit=0, streak=0, window 40: 1 ok / 38 red, 38 rate-limited, 1 in-flight
  red-watch                 [WARN] red, failed=4, since 2026-10-11T10:16:58Z, 12m old; FAIL A3 tree clean AND in sync with origin/main (kind=is key=git) ;; FAIL A12 system-status verdict - checks in error: failed-units (kind=is key=sysverdict) ;; FAIL A15 git-tree reports a clean tree (kind=contains key=sys) ;; FAIL A30 no unit is left in systemctl --failed (kind=contains key=sys)
Overall: 1 CHECK(S) FAILED
> build · mimo-v2.6-flash-free
Live readings captured (59.72s wall, row OK, errors untouched). Now the review request:
$ date -u +%Y%m%dT%H%M%SZ; date -u +%FT%TZ
20261012T014353Z
2026-10-12T01:43:53Z
> build · mimo-v2.6-flash-free
← Write repo/mailboxes/main-to-reviewer/REVIEW-20261012T014353Z-loop-outcomes-row.md
Created file successfully: repo/mailboxes/main-to-reviewer/REVIEW-20261012T014353Z-loop-outcomes-row.md
> build · mimo-v2.6-flash-free
Now the reviewer gate — spawning the reviewer (free model, read-only):
✓ Review loop-outcomes row change Reviewer Agent
> build · mimo-v2.6-flash-free
→ Read repo/mailboxes/reviewer-to-main/VERDICT-20261012T014353Z-loop-outcomes-row.md 
> build · mimo-v2.6-flash-free
**VERDICT: APPROVE** — all five judgement calls agreed, findings none, reviewer re-ran everything itself. Now the CHANGELOG entry:
$ cd /data/repo && cat >> CHANGELOG.md <<'ENTRY'

## [0.4.310] - 2026-10-12 — queue item **(4)** built: `system-status` gains a `loop-outcomes` row that judges the agent loop by its own `exit=` markers — the freshness guard that 37/37 rate-limited runs (988..1024) fooled while the watchdog called the loop "fresh" 25× — and `tests/test_system_status_failed_units.sh` **244 → 330 assertions**

### Added
- **`check_loop_outcomes()`** in `tools/system-status` (plus helper `lo_age_phrase`, a `loop-outcomes verdicts` `--help` block, and one call line after `check_log_truncation`): the third question one can ask about a shift — after `failed-units` ("which shift went red") and `log-truncation` ("is the record still there"), this one asks **did the last runs exit 0**, read from the `exit=$?` marker `/data/agent-loop.sh` appends as the last line of every `run-*.log`. The queue item fired on run 900's own measurement: **37 consecutive rate-limited runs (988..1024, 2026-10-11 19:52 → 2026-10-12 01:58), six hours with zero commits, zero queue updates, zero replies**, while `agent-loop-watchdog` read "loop fresh, nothing to do" **25×** and restarted **0×** — it only asks whether a log was *touched* in 45 min, and the wrapper writes that log's header **before** `opencode` runs, so a run that dies in one line still proves the loop "fresh". A mtime cannot see a dead loop; the loop's own exit marker can.
- **Verdicts** (streak = consecutive non-zero completed runs ending at the newest completed run, counted inside the window of the newest `GLADEX_RUNLOG_WINDOW` (default 40) logs): `ok` streak 0 — the detail names the newest completed run's own measured `exit=0` and still counts the window's reds (`run 1025 exit=0, streak=0, window 40: 1 ok / 38 red, 38 rate-limited, 1 in-flight`, the live box at commit time); `warning` 1 ≤ streak < threshold, **or** a stale green (newest log older than `GLADEX_RUNLOG_STALE` 3600 s → *"this green is a green about the past"*, the ip-drift row's own words), **or** `cannot verify` (no logs / no completed run / sandboxed run); `error` + `ERRORS++` streak ≥ `GLADEX_RUNLOG_STREAK` (default **5**, ≈ one hour of dead loop at the wrapper's 600 s cadence) — `streak=5 consecutive non-zero runs 1..5 (5 rate-limited), threshold=5, window 5`. **Deliberately an error, never a warn-only row** (the (109)(e) anti-pattern the ip-drift row documents), and monitor **A12** reads this tool's verdict, so a real streak reaches red-watch's ALERT channel without anyone reading a dashboard.
- **Rate-limited runs are named, never counted as work** — logs carrying `Rate limit exceeded` are tallied in the detail; a rate-limited run ends `exit=1` and structurally can never be the `ok` line's evidence. **The in-flight run is excluded**: the **newest** markerless log with age ≤ the stale bound is the run still going (measured: run 1026, the run that wrote this row) and is counted `1 in-flight`; every other markerless log — older, or newest-but-stale — is a run that **died** and counts as non-zero, named `… without exit marker`.
- **Hermeticity is the ip-drift row's own rule**: with no `GLADEX_RUNLOG_DIR` hook the live `/data/agent-logs` is read only when `systemctl` resolves to a **system** binary; a stub or absent systemctl (13+ suites run this tool that way) answers `warning cannot verify: sandboxed run … the live run-log directory was NOT read`, so a live failure streak can never flip a sandboxed suite's `errors` count. Cost: one `stat` + one last-line read per windowed log — tool wall time **59.030 s → 59.72 s**.

### Tests
- **`tests/test_system_status_failed_units.sh` 244 → 330 passed, 0 failed**, `bash -n` clean on both files. New **section 16**, one fixture per claim: **16a** ok names the newest completed run's own `exit=0` (JSON + human `[OK]`); **16b** one red run is a `warning` — errors 0, `Overall: ALL SYSTEMS HEALTHY` kept, threshold named; **16c** the measured harm — 5 straight rate-limited runs → `error`, `streak=5 … 1..5`, `5 rate-limited`, errors 1, `[FAIL]`, healthy line **gone**; **16d** a recovered loop reads ok with the window's `5 red, 5 rate-limited` still named; **16e** the in-flight run is excluded (fresh + markerless newest, `1 in-flight`; and 4 reds + in-flight stays a `warning streak=4`, not an error); **16f** empty dir → `cannot verify`; **16g** sandboxed run (no hook, stub systemctl) never reads the live dir; **16h** stale green → `warning`, "green about the past"; **16i** a markerless log that is not fresh is a death — `streak=1`, `without exit marker`; **16j** `--help` carries the row's tokens. **M8** drops the call site (the mutant emits no row while the real tool reds the same fixture — a deleted call is visible, not silent); **M9** raises the gate 5 → 99 (the mutant reads `warning` on the 5-red fixture the real tool reds, and output stays valid JSON). Fixtures are their own `run-*.log` directories under `$SANDBOX`, never the live `/data/agent-logs`.
- **Neighbours green before the verdict:** `test_system_status_red_watch.sh` **150/0**, `test_system_status_go_tests.sh` **92/0**, `test_registry_coverage.sh` **464/0** (no new tool, no new suite → `REGISTRY.md`'s `- Live: 100` stays correct), `test_commit_gate.sh` **88/0**; the 24-row pins in `test_system_status_ip_drift.sh` are contract-fixture pins, not dashboard-row counts (read, not assumed).

### Review
- **`VERDICT: APPROVE`** — request `mailboxes/main-to-reviewer/REVIEW-20261012T014353Z-loop-outcomes-row.md`, verdict `mailboxes/reviewer-to-main/VERDICT-20261012T014353Z-loop-outcomes-row.md` (read-only; it re-ran the suite itself → **330/0**, the live dashboard → row `ok`, `errors` untouched, and `test_system_status_red_watch.sh` → **150/0**). All **five judgement calls agreed** (`error` at threshold; the systemctl hermeticity gate; the in-flight rule; the defaults window 40 / threshold 5 / stale 3600; the ok line naming one measured run). **Findings: none** — it checked the four hazard classes (`set -euo pipefail` arithmetic, empty-array expansion under `-u`, the JSON-belt sanitisation, vacuous fixtures) and the window/streak arithmetic, and confirmed both mutations flip the verdict on the same fixture bytes. **Two real bugs were caught by live measurement before the reviewer saw the code**, both fixed and disclosed in the request: the first live run named the *last red* id as its ok run (`lo_lastid` was only set on failures), and the `… without exit marker` suffix duplicated itself on a recovered window.

### Scope
- **Four paths changed:** `tools/system-status`, `tests/test_system_status_failed_units.sh`, `CHANGELOG.md` (this entry) and `agent-logs/PROGRESS.md` (run 901's entry, appended **before** the commit that carries it, CLOSE PROTOCOL rule 1), plus the mailbox pair (request + verdict). **Nothing under `app/src/php` → no promote and nothing to promote**; dev and prod untouched, both **0.4.28**. **No live messages DB written, no systemctl, no unit or timer change, no `rm`, no DNS write, no mail sent, no paid API, no API key configured**; spend **0.00**, free `*-free` models only. STEP 0 owed nothing at commit time (**0 unread dev / 0 prod, 0 open INBOX entries** — no `agent_to_investor` row written, nothing marked read, `INBOX.md` untouched); **`hiring/queue/` untouched** (2 proposals `status=proposed` — the investor's seat).

### Queue
Authoritative next-candidate queue lives in `agent-logs/PROGRESS.md`, in the newest run entry's `Queue — next small step` bullet — it is not duplicated here, and has not been since `[0.4.67]`. To read the live queue, open `PROGRESS.md`; to know whether that is still true, run `tools/queue-source-check`.
ENTRY
echo "appended"; ./tools/repo-lint 2>&1 | tail -3; echo "rc=$?"
appended
  changelog-version: 314 changelog version heading(s), 314 unique, 9626 citation(s) checked, 0 missing, 12334 bare token(s) counted
  elf-allowlist: 2 tracked ELF file(s), all shipped
result: all 199 linted file(s) parse clean (exit 0)
rc=0
> build · mimo-v2.6-flash-free
`repo-lint` green (314 at HEAD; my entry becomes 315 on commit — matching run 900's observed behavior). Now check the tree state before the PROGRESS entry:
$ cd /data/repo && git status --porcelain; echo "---staged:"; git diff --cached --name-only | head -10; echo "---queue-source (pre-commit):"; ./tools/queue-source-check 2>&1 | tail -2
M CHANGELOG.md
 M tests/test_system_status_failed_units.sh
 M tools/system-status
?? mailboxes/main-to-reviewer/REVIEW-20261012T014353Z-loop-outcomes-row.md
?? mailboxes/reviewer-to-main/VERDICT-20261012T014353Z-loop-outcomes-row.md
---staged:
---queue-source (pre-commit):
queue-source-check: FAIL - 1 violation(s): [0.4.310] is not named in agent-logs/PROGRESS.md - the newest CHANGELOG entry has no record in the authoritative file
  - [0.4.310] is not named in agent-logs/PROGRESS.md - the newest CHANGELOG entry has no record in the authoritative file
> build · mimo-v2.6-flash-free
`queue-source-check` expects `[0.4.310]` to be named in PROGRESS.md — which is exactly the CLOSE PROTOCOL order. Let me grab the fast readings, then append the entry:
$ cd /data/repo && ./tools/inbox-status 2>&1 | tail -2; ./tools/version-check; ./tools/budget-show | tail -3
verdict: OK - nothing owed (0 unread, 0 open entries all replied)
OK: dev=0.4.28 prod=0.4.28 (match)
  - 2026-09-24: ledger narrative corrected — spent-line still said "purchase pending at registrar" 4 days after registration (queued candidate #1); numbers unchanged (1.50/3.50, no money moved), log history above kept verbatim.
  - 2026-10-01: month rolled per brief §4 (balance resets to 5.00 on the 1st, unspent does NOT roll over). September history above is kept verbatim; September closed at spent 1.50 / remaining 3.50.
  - 2026-10-02: October opened at spent 0.00 / remaining 5.00 because no October charge exists in any file on this box — while gladex.de is a known 1.50/mo recurring cost with NO renewal date recorded anywhere. Figure to be corrected the moment the investor answers REPORT.md §14.
> build · mimo-v2.6-flash-free
Now the PROGRESS entry — appended **before** the commit that carries it (CLOSE PROTOCOL rule 1):
$ cd /data/repo && cat >> agent-logs/PROGRESS.md <<'ENTRY'

## Builder — run 901 — queue item **(4)** built: `system-status` gains a **`loop-outcomes`** row that judges the agent loop by its own `exit=` markers — the freshness guard 37/37 rate-limited runs (988..1024) fooled while `agent-loop-watchdog` called the loop "fresh" 25× — with its own section 16 (**244 → 330 assertions**, 0 failed), mutations M8/M9, and a reviewer **APPROVE**; newest CHANGELOG heading **`[0.4.310]`**

- **STEP 0 paid first, owed nothing — no row written.** `SELECT COUNT(*) FROM messages WHERE direction='investor_to_agent' AND read=0` → **0 dev / 0 prod** (`/opt/startup/{dev,prod}/data/messages.db`, schema re-checked first); `./tools/inbox-status` → **rc 0**, `OK - nothing owed (0 unread, 0 open entries all replied)`, last reply **dev 145 / prod 110**; `grep '^## ' INBOX.md | grep -cv HANDLED` → **0** — the brief's two quoted entries (2026-10-04 hiring decision, 2026-10-05 hire-approval + version correction) are both struck `~~HANDLED~~` in the file itself. **No `agent_to_investor` row inserted in either database, nothing marked read, `INBOX.md` untouched** — an empty inbox is answered by the measurement, not by a status row. **Production is 0.4.28** — `./tools/version-check` → `OK: dev=0.4.28 prod=0.4.28 (match)`, **0.4.29 never quoted**; `./tools/budget-show` → **2026-10 5.00 / 0.00 / 5.00**, spend **0.00**, free `*-free` model only (`opencode/mimo-v2.6-flash-free`), no key configured, **no secret or PII in any prompt, file or commit**.

- **The queue read, and why this item.** Run 900 handed over **(4)** first — *"the freshness guard cannot see a dead loop … should judge run **outcomes**, not file mtimes — e.g. a `system-status`/`red-watch` row that reads the last N `agent-logs/run-*.log` files and reports `exit=0` / non-zero / consecutive-failure streak, naming the streak when it exceeds a threshold; its fixtures are this run's own evidence (**37/37 rate-limited runs, 25 watchdog "fresh" lines, 0 restarts**), it must not print a rate-limited run as work done, and it is `tools/` + `tests/` so it carries its own suite section, its own CHANGELOG heading and its own reviewer gate."* Everything else standing was investor-gated **(2'')**/**(93)**/**(97)(a)**/**(av)(d)**/**(i)**/SOA/§14/Pip, or owned elsewhere (**A28** doc-probe clears with a changelog-bearing commit; **A12/A30** other desks' units). The row is what this run built.

- **What the row reads, and the guard's own blind spot as its fixture.** `/data/agent-loop.sh` writes `agent-logs/run-YYYYMMDD-HHMMSS-<n>.log` per run and appends **`exit=$?` as the last line** — so each log's ending is the run's verdict, and the newest `GLADEX_RUNLOG_WINDOW` (default **40**, the size that reproduces the queue's own evidence: the 37-run streak 988..1024 shows in full) are read in filename order (zero-padded names = chronology; no `tail`, no pipeline — the D2 shape). Measured corpus baseline this run: **1,493 logs, 1,477 with an exit marker (459 `exit=0`, 1,018 non-zero), 16 markerless**. Verdicts: **`ok`** streak 0 — the detail names the newest completed run's own measured `exit=0` and still counts the window's reds; **`warning`** 1 ≤ streak < threshold (default **5**), **or** a stale green (newest log older than `GLADEX_RUNLOG_STALE` 3600 s → *"this green is a green about the past"*, the ip-drift row's own words), **or** `cannot verify` (no logs / no completed run / sandboxed run); **`error` + `ERRORS++`** streak ≥ threshold — `streak=5 consecutive non-zero runs 1..5 (5 rate-limited), threshold=5, window 5`. **Deliberately an error, never a warn-only row** ((109)(e): a warn-only row standing where a red belongs), and monitor **A12** reads this tool's verdict, so a real streak reaches red-watch's ALERT channel without anyone reading a dashboard. **Rate-limited runs are named, never counted as work**: a rate-limited run ends `exit=1` and structurally can never be the `ok` line's evidence.

- **The in-flight run is excluded, and the age bound closes the "died mid-run" hole.** The **newest** markerless log with age ≤ the stale bound is the run still going (measured live: **run 1026**, this run's own log, mtime advancing while the row was read) — counted `1 in-flight`, never a failure; every other markerless log (older, or newest-but-stale) is a run that **died** and counts as non-zero, named `… without exit marker`. **Hermeticity is the ip-drift row's own rule**: with no `GLADEX_RUNLOG_DIR` hook the live `/data/agent-logs` is read **only when `systemctl` resolves to a system binary**; a stub or absent systemctl (13+ suites run this tool that way) answers `warning cannot verify: sandboxed run … the live run-log directory was NOT read`, so a live failure streak can never flip a sandboxed suite's `errors` count. Cost: one `stat` + one last-line read per windowed log — `./tools/system-status` wall **59.030 s → 59.72 s**.

- **Two real bugs, caught by measuring the row against the live corpus before any reviewer saw the code — both fixed and disclosed.** (1) The first live run reported **`run 1024 exit=0`** while 1024's own last line is `exit=1`: `lo_lastid` was only set on failures, so the `ok` line named the last **red** id; the `ok` branch now records the newest completed id too (reviewer re-verified the arithmetic independently: `lo_start = max(0, total - window)`, newest index `total-1`, in-flight only newest+markerless+fresh). (2) The `… without exit marker` suffix was appended both inside the `ok` branch and by the post-chain append — duplicating itself on a recovered window with a dead run; the inline copy was removed. Both are recorded because a figure nobody can reproduce is a claim, not a measurement.

- **Live readings, cross-checked by hand rather than taken from the tool's own words.** Row at commit time: **`loop-outcomes [OK] run 1025 exit=0, streak=0, window 40: 1 ok / 38 red, 38 rate-limited, 1 in-flight`**; by hand the newest six files read `…1023 exit=1`, `1024 exit=1` (both `Rate limit exceeded`), `1025 exit=0` (mtime 02:50:32), `1026` markerless and live → window 987..1026 = **38 reds (987..1024, every one rate-limited) + 1 ok + 1 in-flight = 40**, and the row's own numbers match that census exactly. `Overall: 1 CHECK(S) FAILED` = **`failed-units` only** (three other desks' units, dispatcher/mia/sofia) — my row adds nothing to `ERRORS`.

- **Tests: `bash tests/test_system_status_failed_units.sh` → 330 passed / 0 failed (was 244/0), `bash -n` clean on both files.** New **section 16**, one fixture per claim: **16a** ok names the newest completed run's own `exit=0` (JSON + human `[OK]`); **16b** one red run is a `warning` — errors 0, healthy line kept, threshold named; **16c** the measured harm — 5 straight rate-limited runs → `error`, `streak=5 … 1..5`, `5 rate-limited`, errors 1, `[FAIL]`, healthy line **gone**; **16d** a recovered loop reads ok with `5 red, 5 rate-limited` still named; **16e** in-flight excluded (`1 in-flight`; and 4 reds + in-flight stays `warning streak=4`, not an error); **16f** empty dir → `cannot verify`; **16g** sandboxed run never reads the live dir; **16h** stale green → `warning`, "green about the past"; **16i** a markerless log that is not fresh is a death (`streak=1`, `without exit marker`); **16j** `--help` tokens. **M8** drops the call site — the mutant emits **no** row while the real tool reds the same bytes; **M9** raises the gate 5 → 99 — the mutant reads `warning` on the 5-red fixture the real tool reds, output still valid JSON. Fixtures are their own `run-*.log` directories under `$SANDBOX`, never the live `/data/agent-logs`. **Neighbours green:** `test_system_status_red_watch.sh` **150/0**, `test_system_status_go_tests.sh` **92/0**, `test_registry_coverage.sh` **464/0** (no new tool, no new suite → `REGISTRY.md`'s `- Live: 100` stays correct and the **101st suite owns the next refresh**), `test_commit_gate.sh` **88/0**; the 24-row pins in `test_system_status_ip_drift.sh` are contract-fixture pins, not dashboard-row counts (read, not assumed); `./tools/repo-lint` → **rc 0** (314 headings at HEAD; the worktree now holds 315 with `[0.4.310]`).

- **Reviewer gate: `VERDICT: APPROVE`, five judgement calls agreed, findings none.** Request `mailboxes/main-to-reviewer/REVIEW-20261012T014353Z-loop-outcomes-row.md`, verdict `mailboxes/reviewer-to-main/VERDICT-20261012T014353Z-loop-outcomes-row.md` (read-only — it edited no repo file except the verdict). It re-ran the suite itself (**330/0**), the live dashboard (row `ok`, `errors` untouched by the new row) and `test_system_status_red_watch.sh` (**150/0**), and checked the four hazard classes (`set -euo pipefail` arithmetic — the only post-increment is the guarded `((ERRORS++)) || true`; empty-array expansion under `-u`; the JSON-belt sanitisation, confirming the real file strips **both** `"` and `\`; vacuous fixtures) plus the window/streak arithmetic. Rulings: `error` at threshold (A), the systemctl hermeticity gate (A), the in-flight rule (A), the defaults window 40 / threshold 5 / stale 3600 (A), the ok line naming one measured run (A).

- **Scope and safety, one line each:** git sees **four paths plus the mailbox pair** — `tools/system-status`, `tests/test_system_status_failed_units.sh`, `CHANGELOG.md` (`[0.4.310]`), this file — staged **explicitly by path** after `git status --porcelain` is read, **never `git add -A`** (this worktree is shared; at commit time the tree held only my five paths + the mailbox pair, verified). **Nothing under `app/src/php` or `examples/workflows` → no promote and nothing to promote**; dev and prod untouched, both **0.4.28**. **The seven `agent-logs/identity-*.md` transcripts and the live `/data/agent-logs` run logs were read only, never written** (the row is a reader; its only writes are the fixtures under `/tmp`). **`hiring/queue/` untouched** (2 proposals `status=proposed` — the investor's seat). **No deletions, no `rm`/`rename`/`chmod`, no `systemctl`, no `systemctl reset-failed`, no unit restarted, no timer or crontab change, no live messages DB write, no DNS write, no mail sent, no paid API, no API key configured**, spend **0.00**, free `*-free` models only.

- **Queue — next small step (read this first):** **(4) is DONE — closed by this entry.** Next, in order: **(5)** the one thing run 900 queued as *"its own run if a gate is wanted"* — a **scoped reviewer pass over `tests/test_ts_ordering.php` §5d + the coupled G2 pin** in `tests/test_regression_run.sh` (the epoch-`ts` repair's tests were swept into `9c0bca9` by run 987's rate-limit cut-off and never got their verdict; this run proved the scoped-reviewer pattern is cheap — one session, re-runs the one suite, writes a verdict file — so the gate is now takeable). No code change unless the reviewer names a defect. Then the standing lines unchanged: **(2'')** the day the `GETTING_STARTED.md` **keep/fold/retire** answer arrives (STEP 0: **0 unread / 0 owed**), execute it as its own small step; **(93)**/**(97)(a)** first if the investor answers `hiring/queue/*.json` (**2 proposed**: `marco-steiner`, `ruben-stoll`) — **withdrawing or approving is never this desk's move**; **A12/A30** keep their named cause (three failed `identity-run@{dispatcher,mia,sofia}.service` — other desks', **no `reset-failed`, no restart** from here), and the 504/rate-limit classes both still want **operator-level** standing watches — this run's row is the repo-side reader for the rate-limit half; **A28** should clear with this commit (verify post-push, re-open if another desk lands `tests/`+`tools/` code without docs); **(av)(d)** after the `REPORT.md` §14 sign-off (**still no `rm` without it**), **(i)** blocked by the live writers until the prune lands; **SOA MNAME placeholder**, **§14's open blocks** and **Pip's mail-policy research** stay NEEDS-INVESTOR; the **`[0.4.258]`** citation watch stays discharged (next trigger: the prune + `/tmp/gocache` measurably dead) — and note **this run did not edit `tools/REGISTRY.md`**, so the watch was not re-triggered; **Pip's nine gaps**, **(ax)**, **(e)**, the drift-verify line, **(aw)** and the `promote-gates` verdict watch stay closed/landed exactly as previously recorded.

- **Close-state:** this entry is appended **before** the commit that carries it (CLOSE PROTOCOL rule 1) and is never `git checkout --`-ed, staged-only or parked in `/tmp` (rules 2–3); the stop-state check is `git status --porcelain` **not listing `agent-logs/PROGRESS.md`** after it. A second commit this run (post-push close readings) re-appends before commit #2.
ENTRY
echo "appended"; ./tools/queue-source-check 2>&1 | tail -1
appended
queue-source-check: OK - one queue: [0.4.310] pointer-only, 111 item line(s) frozen across 265 section(s), 203 PROGRESS bullet(s), 2 path token(s)
> build · mimo-v2.6-flash-free
`queue-source-check` OK. Now commit — staged explicitly by path, never `git add -A`:
$ cd /data/repo && git add -- tools/system-status tests/test_system_status_failed_units.sh CHANGELOG.md agent-logs/PROGRESS.md mailboxes/main-to-reviewer/REVIEW-20261012T014353Z-loop-outcomes-row.md mailboxes/reviewer-to-main/VERDICT-20261012T014353Z-loop-outcomes-row.md && git diff --cached --name-only && git commit -m "run 901: queue item (4) built - system-status gains the loop-outcomes row, the freshness guard that 37/37 rate-limited runs (988..1024) fooled while the watchdog read 'fresh' 25x: judges the loop by its own exit= markers (streak >= 5 = error via monitor A12, in-flight newest log excluded, rate-limited runs named never counted as work, ip-drift-style systemctl hermeticity), suite 244 -> 330 assertions 0 failed with M8/M9, reviewer APPROVE (all 5 judgement calls), two live-measurement bugs caught pre-review, CHANGELOG [0.4.310], STEP 0 0/0 no row written, spend 0.00" && git log --oneline -1 && git status --porcelain
CHANGELOG.md
agent-logs/PROGRESS.md
mailboxes/main-to-reviewer/REVIEW-20261012T014353Z-loop-outcomes-row.md
mailboxes/reviewer-to-main/VERDICT-20261012T014353Z-loop-outcomes-row.md
tests/test_system_status_failed_units.sh
tools/system-status
[main f98582a] run 901: queue item (4) built - system-status gains the loop-outcomes row, the freshness guard that 37/37 rate-limited runs (988..1024) fooled while the watchdog read 'fresh' 25x: judges the loop by its own exit= markers (streak >= 5 = error via monitor A12, in-flight newest log excluded, rate-limited runs named never counted as work, ip-drift-style systemctl hermeticity), suite 244 -> 330 assertions 0 failed with M8/M9, reviewer APPROVE (all 5 judgement calls), two live-measurement bugs caught pre-review, CHANGELOG [0.4.310], STEP 0 0/0 no row written, spend 0.00
 6 files changed, 741 insertions(+)
 create mode 100644 mailboxes/main-to-reviewer/REVIEW-20261012T014353Z-loop-outcomes-row.md
 create mode 100644 mailboxes/reviewer-to-main/VERDICT-20261012T014353Z-loop-outcomes-row.md
f98582a run 901: queue item (4) built - system-status gains the loop-outcomes row, the freshness guard that 37/37 rate-limited runs (988..1024) fooled while the watchdog read 'fresh' 25x: judges the loop by its own exit= markers (streak >= 5 = error via monitor A12, in-flight newest log excluded, rate-limited runs named never counted as work, ip-drift-style systemctl hermeticity), suite 244 -> 330 assertions 0 failed with M8/M9, reviewer APPROVE (all 5 judgement calls), two live-measurement bugs caught pre-review, CHANGELOG [0.4.310], STEP 0 0/0 no row written, spend 0.00
> build · mimo-v2.6-flash-free
Commit `f98582a` landed, tree clean (`PROGRESS.md` not listed — stop-state check passes). Now push and take the post-push close readings:
$ cd /data/repo && git push origin main 2>&1; echo "push rc=$?"; git status -sb | head -1; git rev-list --count origin/main..main; git status --porcelain
To git://git.gladex.de/gladex.git
   69289d8..f98582a  main -> main
push rc=0
## main...origin/main
0
> build · mimo-v2.6-flash-free
Push OK (`69289d8..f98582a`, in sync). Post-push close readings now:
$ cd /data/repo && ./tools/red-watch 2>&1 | head -8
red-watch: state=red monitor_exit=1 passed=24 failed=2 alert=RED-SET
  FAIL A12 system-status verdict - checks in error: failed-units (kind=is key=sysverdict want=HEALTHY)
  FAIL A30 no unit is left in systemctl --failed (kind=contains key=sys want=[OK] 0 failed unit(s))
  log=/data/agent-logs/red-watch-20261012.log
  alerts=/data/agent-logs/red-watch-ALERTS.log
> build · mimo-v2.6-flash-free
red-watch: **24 passed / 2 failed = A12 + A30 only** (other desks' failed units; A3 and A28 cleared by my push). Now the dashboard and remaining readers:
$ cd /data/repo && ./tools/system-status 2>&1 | grep -E "git-tree|queue-source|investor-duty|go-tests|promote-gates|deploy-path|log-truncation|loop-outcomes|failed-units|Overall" ; echo "rc=$?"
failed-units              [FAIL] 3 failed: identity-run@dispatcher.service rc=1 shift_exit=1 work=1144ins/1files, identity-run@mia.service rc=1 shift_exit=1 work=0, identity-run@sofia.service rc=1 shift_exit=1 work=2ins/1files
  log-truncation            [WARN] identity-dispatcher.md now=1277 was=18062@e0bc90d (-92%), identity-jonas.md now=1955 was=81499@8c15565 (-97%)
  loop-outcomes             [OK] run 1025 exit=0, streak=0, window 40: 1 ok / 38 red, 38 rate-limited, 1 in-flight
  investor-duty             [OK] owed=0 unread=0 unreplied=0 open=0
  git-tree                  [OK] clean
  red-watch                 [WARN] red, failed=2, since 2026-10-11T10:16:58Z, 2m old; FAIL A12 system-status verdict - checks in error: failed-units (kind=is key=sysverdict) ;; FAIL A30 no unit is left in systemctl --failed (kind=contains key=sys)
  queue-source              [OK] one queue: [0.4.310] pointer-only, 111 item line(s) frozen across 265 section(s), 203 PROGRESS bullet(s), 2 path token(s)
  go-tests                  [OK] passing (worktree)
  promote-gates             [OK] promote-ready: verdict, dev-sync, commit-lint and ship-tree all pass (commit f98582a)
  deploy-path               [OK] ledger OK - 46 file(s) across dev+prod attested (/data/agent-logs/promote-ledger.jsonl; source: baseline)
Overall: 1 CHECK(S) FAILED
rc=0
> build · mimo-v2.6-flash-free
All green except the pre-existing other-desk `failed-units`. Final batch of readers:
$ cd /data/repo && ./tools/repo-lint 2>&1 | grep changelog-version; ./tools/inbox-status 2>&1 | tail -1; ./tools/version-check; ./tools/healthcheck 2>&1 | tail -2; ./tools/budget-show 2>&1 | grep -E "remaining|spent" | head -2; echo "--- STEP 0 re-read:"; sqlite3 /opt/startup/dev/data/messages.db "SELECT COUNT(*) FROM messages WHERE direction='investor_to_agent' AND read=0;"; sqlite3 /opt/startup/prod/data/messages.db "SELECT COUNT(*) FROM messages WHERE direction='investor_to_agent' AND read=0;"
changelog-version: 315 changelog version heading(s), 315 unique, 9636 citation(s) checked, 0 missing, 12340 bare token(s) counted
verdict: OK - nothing owed (0 unread, 0 open entries all replied)
OK: dev=0.4.28 prod=0.4.28 (match)
  HTTP: 200
  Response: {"status":"ok","service":"gladex-investor-app","env":"prod","timestamp":1791770391,"version":"0.4.28"}
  - 2026-09-24: ledger narrative corrected — spent-line still said "purchase pending at registrar" 4 days after registration (queued candidate #1); numbers unchanged (1.50/3.50, no money moved), log history above kept verbatim.
  - 2026-10-01: month rolled per brief §4 (balance resets to 5.00 on the 1st, unspent does NOT roll over). September history above is kept verbatim; September closed at spent 1.50 / remaining 3.50.
--- STEP 0 re-read:
0
0
> build · mimo-v2.6-flash-free
Everything green. CLOSE PROTOCOL rule 2: re-append the close readings **before** commit #2:
$ cd /data/repo && cat >> agent-logs/PROGRESS.md <<'ENTRY'

- **Close readings (post-push, read at this instant — commit #2, entry re-appended before it per CLOSE PROTOCOL rule 2).** `git push origin main` → **`69289d8..f98582a`, rc 0**; `git status -sb` → `## main...origin/main`; `git rev-list --count origin/main..main` → **0**; `git status --porcelain` → **empty** before this block and **`agent-logs/PROGRESS.md` NOT listed after commit #2** (the stop-state check — commit #1 `f98582a` carried exactly six paths, **741 insertions / 0 deletions**, staged by explicit pathspec). `./tools/red-watch` run **fresh after the push** → **`state=red, passed=24, failed=2`** = **A12 + A30 only** (`system-status verdict` / `no unit left in systemctl --failed`) — i.e. **A3** (main was ahead) and **A28** (`DOCS_VERDICT undocumented`) are **both cleared by this commit**, and the two remaining reds are the three other desks' failed `identity-run@{dispatcher,mia,sofia}.service` units, **untouched from here** (no `reset-failed`, no restart). `./tools/system-status` → **`git-tree [OK] clean`**, **`queue-source [OK] one queue: [0.4.310] pointer-only … 265 section(s)`**, **`investor-duty [OK] owed=0 unread=0 unreplied=0 open=0`**, **`go-tests [OK] passing (worktree)`**, **`promote-gates [OK] promote-ready: verdict, dev-sync, commit-lint and ship-tree all pass (commit f98582a)`**, **`deploy-path [OK] ledger OK - 46 file(s)`**, this run's own row **`loop-outcomes [OK] run 1025 exit=0, streak=0, window 40: 1 ok / 38 red, 38 rate-limited, 1 in-flight`**, `log-truncation [WARN]` still naming the two other desks' transcripts, `failed-units [FAIL] 3 failed: identity-run@{dispatcher,mia,sofia}.service` = the one error, `Overall: 1 CHECK(S) FAILED` = that one row. Also green at the close: `./tools/repo-lint` → **315 headings / 315 unique, 0 missing** (`[0.4.310]` now counted), `./tools/inbox-status` → **rc 0, nothing owed**, `./tools/version-check` → **`OK: dev=0.4.28 prod=0.4.28 (match)`** (**0.4.29 never quoted**), `./tools/healthcheck` → **dev + prod HTTP 200, both 0.4.28**, `./tools/budget-show` → **2026-10 5.00 / 0.00 / 5.00**, spend **0.00**. **STEP 0 re-read at the close: 0 unread dev / 0 prod** — no row written, nothing marked read, `INBOX.md` untouched. **No `systemctl`, no unit or timer change, no `rm`, no live messages DB write, no DNS write, no mail sent, no paid API, no API key**, spend **0.00**, free `*-free` models only.
ENTRY
git add -- agent-logs/PROGRESS.md && git commit -m "run 901 close: post-push readings appended - 69289d8..f98582a pushed rc 0, in sync rev-list 0, PROGRESS not in git status; red-watch 24 passed / 2 failed = A12+A30 (three other desks' failed units) only, so A3 and A28 cleared by f98582a; repo-lint 315/315 unique 0 missing, queue-source [OK] [0.4.310] pointer-only, system-status git-tree/promote-gates/go-tests/deploy-path/loop-outcomes all OK, Overall 1 CHECK = failed-units only; STEP 0 still 0/0 with no row written, spend 0.00" && git push origin main 2>&1 | tail -1; git status --porcelain; echo "porcelain-end"
[main 092f0c6] run 901 close: post-push readings appended - 69289d8..f98582a pushed rc 0, in sync rev-list 0, PROGRESS not in git status; red-watch 24 passed / 2 failed = A12+A30 (three other desks' failed units) only, so A3 and A28 cleared by f98582a; repo-lint 315/315 unique 0 missing, queue-source [OK] [0.4.310] pointer-only, system-status git-tree/promote-gates/go-tests/deploy-path/loop-outcomes all OK, Overall 1 CHECK = failed-units only; STEP 0 still 0/0 with no row written, spend 0.00
 1 file changed, 2 insertions(+)
   f98582a..092f0c6  main -> main
porcelain-end
> build · mimo-v2.6-flash-free
Run complete. Summary of what happened this shift:

## STEP 0 — investor duty (paid first)
- `investor_to_agent` unread: **0 dev / 0 prod** (both message DBs, schema re-checked first).
- `INBOX.md`: **80 entries, 80 handled, 0 open** — the two entries quoted in the brief (2026-10-04 hiring decision, 2026-10-05 hire approval + version correction) are both already struck `~~HANDLED~~`.
- `./tools/inbox-status` → rc 0, "nothing owed". No reply row written — an empty inbox is answered by the measurement, not by a status row.

## The step: queue item (4) — the `loop-outcomes` row
Run 900 handed over the freshness guard: the loop failed **37 consecutive runs (988..1024)** on rate limits — six hours of zero commits — while `agent-loop-watchdog` called it "fresh" 25× because it only reads file mtimes. Built:

- **`check_loop_outcomes()` in `tools/system-status`** — reads the last line (`exit=$?` marker) of the newest 40 `run-*.log` files and reports the consecutive-failure streak: `ok` / `warning` (1..4 reds, a stale green, or cannot-verify) / **`error` at streak ≥ 5**, which flows through monitor A12 into red-watch's ALERT channel. Rate-limited runs are named, never counted as work; the in-flight newest log is excluded; sandboxed suites never touch the live log dir (ip-drift-style hermeticity gate).
- Live reading at close: **`loop-outcomes [OK] run 1025 exit=0, streak=0, window 40: 1 ok / 38 red, 38 rate-limited, 1 in-flight`** — cross-checked by hand against the corpus.
- **Two real bugs caught by measuring against the live corpus before review** (wrong id named on the ok line; a duplicated detail suffix) — both fixed and disclosed.

## Verification
- Suite **244 → 330 assertions, 0 failed** (section 16 + mutations M8/M9); neighbours green (red-watch 150/0, go-tests 92/0, registry 464/0, commit-gate 88/0).
- **Reviewer verdict: APPROVE** — it re-ran everything itself, findings none, all five judgement calls agreed.
- Pushed `f98582a..092f0c6`, in sync, **tree clean** (`PROGRESS.md` committed, not listed in `git status`). red-watch post-push: 24/2 = A12+A30 only (other desks' failed units — untouched). Spend **0.00**, free models only; dev/prod untouched at 0.4.28.

Next run's queue (recorded in PROGRESS.md): the scoped reviewer pass over `tests/test_ts_ordering.php` §5d + the G2 pin, which run 987's rate-limit cut-off left ungated.
exit=0

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Mon Oct 12 03:58:27 2026] 127.0.0.1:39696 Accepted
[Mon Oct 12 03:58:27 2026] 127.0.0.1:39696 Closing
[Mon Oct 12 03:58:30 2026] 127.0.0.1:39700 Accepted
[Mon Oct 12 03:58:30 2026] 127.0.0.1:39700 Closing
[Mon Oct 12 03:59:51 2026] 127.0.0.1:58402 Accepted
[Mon Oct 12 03:59:51 2026] 127.0.0.1:58402 Closing
[Mon Oct 12 03:59:51 2026] 127.0.0.1:58406 Accepted
[Mon Oct 12 03:59:51 2026] 127.0.0.1:58406 Closing
[Mon Oct 12 04:00:08 2026] 127.0.0.1:47236 Accepted
[Mon Oct 12 04:00:08 2026] 127.0.0.1:47236 Closing
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52542 Accepted
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52542 Closing
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52554 Accepted
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52554 Closing
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52562 Accepted
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52562 Closing
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52568 Accepted
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52568 Closing
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52580 Accepted
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52580 Closing
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52582 Accepted
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52582 Closing
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52588 Accepted
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52588 Closing
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52600 Accepted
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52600 Closing
[Mon Oct 12 04:00:18 2026] 127.0.0.1:52602 Accepted
[Mon Oct 12 04:00:19 2026] 127.0.0.1:52602 Closing
[Mon Oct 12 04:00:19 2026] 127.0.0.1:52614 Accepted
[Mon Oct 12 04:00:19 2026] 127.0.0.1:52614 Closing
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57440 Accepted
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57440 Closing
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57456 Accepted
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57456 Closing
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57464 Accepted
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57464 Closing
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57480 Accepted
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57480 Closing
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57496 Accepted
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57496 Closing
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57504 Accepted
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57504 Closing
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57520 Accepted
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57520 Closing
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57526 Accepted
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57526 Closing
[Mon Oct 12 04:01:18 2026] 127.0.0.1:57542 Accepted
[Mon Oct 12 04:01:19 2026] 127.0.0.1:57542 Closing
[Mon Oct 12 04:01:19 2026] 127.0.0.1:57546 Accepted
[Mon Oct 12 04:01:19 2026] 127.0.0.1:57546 Closing
[Mon Oct 12 04:08:12 2026] 127.0.0.1:36982 Accepted
[Mon Oct 12 04:08:12 2026] 127.0.0.1:36982 Closing
[Mon Oct 12 04:11:59 2026] 127.0.0.1:47368 Accepted
[Mon Oct 12 04:11:59 2026] 127.0.0.1:47368 Closing
[Mon Oct 12 04:12:18 2026] 127.0.0.1:49610 Accepted
[Mon Oct 12 04:12:18 2026] 127.0.0.1:49610 Closing
[Mon Oct 12 04:13:39 2026] 127.0.0.1:59852 Accepted
[Mon Oct 12 04:13:39 2026] 127.0.0.1:59852 Closing
[Mon Oct 12 04:13:39 2026] 127.0.0.1:59858 Accepted