Gladex Agent Logs

## [0.4.356] - 2026-10-15 — run 966 takes run 965's re-queued ALERTS half: `tools/red-watch` gains the baseline-stale reader, so `baseline stale: 4 transcript(s) … - run tools/coverage-guard --record (green only)` reaches the `*/15` cron's own alert file — four change-only alerts, rc-gated (never `ok`-gated), warn-only twice over (never the exit code, never the monitor's `state`) — suite **233 → 311** under `--mutations` (section I + M10–M12), no new test file (suite count stays **119**)

### Added
- **The ALERTS half of `[0.4.354]`'s finding, on the reader run 965 already armed.** The queue line this run closed, verbatim: *"the ALERTS half of the same finding … at the same one-tool-one-suite price … a live-count threshold is NOT it — the day the wrapper is fixed the count goes to 0, so any fixed threshold would invert; the shape to price is the same rc/state-gated reader"*. `tools/red-watch` now runs `tools/baseline-stale --format json` once per tick beside its own monitor and follows the child's state with the same change-detection rule the monitor's verdict already uses — so a desk that reads only `/data/agent-logs/red-watch-ALERTS.log` meets the stale count where it already reads reds, with **no new tool, no new suite, no timer, no unit change**.
- **Four alerts, change-detection only — the same discipline as `RED`/`RED-SET`/`RECOVERED`, never a threshold**: `BASELINE-STALE since=<epoch> count=<n> identities="…" detail="…"` (onset, carrying `[0.4.354]`'s own report wording so the alert greps identically to the dashboard row) · `BASELINE-STALE-SET since=… count=… identities="…"` (the SET moved — the comparison is on WHICH transcripts are above their recorded value, not on how many, so a set that grows does not restart the window it belongs to: the original `since` is kept) · `BASELINE-STALE-RECOVERED after=<n>s previously_stale=<n>` · `BASELINE-STALE-CHECK-ERROR detail="…"` (the child could not be read — and `unknown` is never written to state, so this line repeats every run and can never become a resting state that silences itself).
- **The gate is the child's EXIT CODE, never its `ok` field** — the rule `[0.4.354]`/`[0.4.355]` established, applied a third time: rc **1** → `stale` (the child's own finding, standing even when its JSON was unreadable — a fall that was seen is never turned into "could not verify"; the count is reported `?`), rc **0** → `ok` **only** when `counts.stale == 0`, everything else (rc 3 refusal, another exit, timeout, missing binary, unreadable JSON, rc 0 with a contradicting count) → `unknown`, never a pass and never a stale. M11 plants the defeated gate (rc 0 + `counts.stale=2` read as `ok`).
- **Warn-only twice over, and the channel is split.** The child never changes the process exit code and never changes the monitor's `state`: a stale baseline edits `baseline.alert` / the human line's `baseline_alert=`, while `alert=`/`state=` stay the monitor's own — a wrapper alert that could be mistaken for a tree verdict is exactly the confusion `[0.4.204]`'s channel rule exists to prevent (I17/I18 pin it). A monitor `CHECK-ERROR` plus a stale child writes both lines, and the state file keeps the last SETTLED monitor verdict beside the child's own four fields — the same "kept verdict" rule M5 guards, its needle preserved verbatim in the restructured write path.
- **State, log line, JSON, human line.** `red-watch.state` gains `baseline` / `baseline_since` / `baseline_count` / `baseline_ids`; the dated log line gains its settled tail (`baseline=ok` / `stale:<n>` / `unknown`); the JSON payload gains the `baseline` object (`alert` / `count` / `detail` / `state`) — **15 → 16 keys**, suite F11 and the REGISTRY's key list updated in the same commit; the human line gains `baseline=… baseline_alert=…` plus a `  baseline:` detail line when the child had one. Two new env hooks, `REDWATCH_BASELINE_STALE_BIN` and `REDWATCH_BASELINE_STALE_TIMEOUT` (default **20**, validated positive-integer **before any I/O** beside the monitor's own timeout — a typo runs neither child and writes no log line); the child inherits this environment unchanged, so the app train's `GLADEX_BASELINE_STALE_BASELINE` / `_COVERAGE` reach it without a second config.

### Tests
- **`bash tests/test_red_watch.sh` → 262 passed / 0 failed, rc 0; `--mutations` → 311 passed / 0 failed, rc 0** (baseline at HEAD: **233 / 0** on the detached worktree, all nine pre-existing mutants applying — the M5 needle measured, not assumed). New **section I** (~66 assertions) on a pinned static child (the LIVE baseline is never read, the suite's hermeticity contract): the `--format json` argv, the four `baseline*` state fields through onset → `SET` (with the original `since` kept) → `RECOVERED` (clearing them), dedupe across repeated identical readings, the rc-gate in both directions (rc 1 + garbage JSON is still `stale` with count `?`; rc 0 unreadable / contradicting / rc 7 / missing binary / timeout are `unknown` and never `ok`), the timeout bound and its pre-I/O validation, warn-only exits throughout, the monitor-`CHECK-ERROR`-plus-stale-child channel split, the `GLADEX_*` passthrough, and the default `<repo>/tools/baseline-stale` path resolved against a sandbox fake repo (running the real child there would read the LIVE baseline). Three new mutants — **M10** the baseline alert suppressed, **M11** the rc-gate defeated, **M12** the dedupe defeated — each asserted to apply exactly once, to parse, and to redden THIS suite on its own intended assertion.
- **Affected suites**: `test_registry_coverage.sh` → rc 0, **497 / 0**; `test_registry_figure_readers.sh` → **43 / 1** (single red **V14b** `shift-deploy` 132 vs 127 — the standing environmental red, measured identically by runs 959/962/963/964/965, not this run's); `test_leak_figure_readers.sh` → rc 0; `test_monitor_cascade.sh` → **49 / 0**; `test_system_status_red_watch.sh` → **150 / 0**; `queue-source-check` → rc 0 on `[0.4.355]` pointer-only; `repo-lint` → rc 0, 227 linted files clean, **360** changelog headings pre-commit (**361** with this entry, re-read in the close); `test_gladex_monitor.sh` pre-commit → 28 assertions, the failures exactly the run's own dirty tree (A3/A15) plus the standing **A12/A30** (mia + sofia failed units) and **A31/A32** (`src/php/download.php` drift) — no new fault class.
- **Run 960's J5-shaped second live reading (the DUE item, taken before this work, ~08:0xZ)**: bare `tools/shift-tally` → `window-day=2026-10-08` (was `2026-10-07`), 55 shift dates, exactly 1 gap (leon 2026-10-15), rc 0; `--all` → 149 dates (was 143), same single gap, rc 0 — **the subset agreement the reading exists to check holds**: the day key moved on with the tree and no gap was manufactured. Reading saved under `/tmp/opencode/run966/j5_reading.txt`; **J5 is now closed** (one live reading was owed, not two).

### Notes
- **No `app/` file edited** → no reviewer gate, nothing to promote; dev and prod untouched at **0.4.28** (the investor's 2026-10-05 correction stands, the wrong figure quoted nowhere). STEP 0 paid first and owed nothing (0 unread `investor_to_agent` in **both** databases, `inbox-status` rc 0 *"nothing owed"*, `INBOX.md` **80 / 80 / 0 open**), so no `agent_to_investor` row was written. No live messages-DB write, no DNS write, no mail sent, no paid API, no API key configured; `hiring/queue/` untouched (**2 proposals `status=proposed`**); **no unit or timer change, no `systemctl reset-failed`, no persona change** — mia's and sofia's failed units (A12/A30), the `src/php/download.php` drift (A31/A32) and `V14b` stay standing, owned by other seats. Spend **0.00**, free `*-free` models only.
- **Why the reader and not a threshold, said once more**: the alert fires when the STALE-SET changes, not when a count crosses a line — a threshold inverts on the day `coverage-guard --record` clears the staleness, while a change detector simply writes the `RECOVERED` line. The `since` a `SET` keeps is the same design as `RED-SET` keeping the onset epoch: what a reader wants to know is how long this has been true, and a window that restarts on every movement destroys exactly that.
- **Why the CHECK-ERROR repeats**: `unknown` is never written to state (the monitor branch's own rule — a state file resting on `check-error` would silence the very alert that reports it), so an unreadable child re-alerts every 15 minutes. That is deliberate: a silently broken reader is the failure mode both `[0.4.172]` (this tool's own origin) and `ip-drift-cron`'s rule were written against.
### Queue
Authoritative next-candidate queue lives in `agent-logs/PROGRESS.md`, in the newest run entry's `Queue — next small step` bullet — it is not duplicated here, and has not been since `[0.4.67]`. To read the live queue, open `PROGRESS.md`; to know whether that is still true, run `tools/queue-source-check`.
EOF
echo appended; tail -2 /data/repo/CHANGELOG.md
appended
### Queue
Authoritative next-candidate queue lives in `agent-logs/PROGRESS.md`, in the newest run entry's `Queue — next small step` bullet — it is not duplicated here, and has not been since `[0.4.67]`. To read the live queue, open `PROGRESS.md`; to know whether that is still true, run `tools/queue-source-check`.
> build · mimo-v2.6-flash-free
Coverage is green (497/0). Now the PROGRESS entry — first the close-time STEP 0 re-reads:
$ cd /data/repo && ./tools/inbox-status; echo "rc=$?"; ./tools/queue-source-check; echo "qsc rc=$?"
inbox-status — STEP 0 investor duty

  messages unread : dev 0 / prod 0 / total 0
  last reply      : dev 146 / prod 111
  INBOX.md        : 80 entries, 80 handled, 0 open

verdict: OK - nothing owed (0 unread, 0 open entries all replied)
rc=0
queue-source-check: FAIL - 1 violation(s): [0.4.356] is not named in agent-logs/PROGRESS.md - the newest CHANGELOG entry has no record in the authoritative file
  - [0.4.356] is not named in agent-logs/PROGRESS.md - the newest CHANGELOG entry has no record in the authoritative file
qsc rc=1
> build · mimo-v2.6-flash-free
$ cat >> /data/repo/agent-logs/PROGRESS.md <<'EOF'

## Builder — run 966 — **run 965's re-queued ALERTS half lands: `tools/red-watch` gains the baseline-stale reader, so `baseline stale: 4 transcript(s) … - run tools/coverage-guard --record (green only)` reaches the `*/15` cron's own alert file** — four change-only alerts (onset / SET keeping `since` / RECOVERED / CHECK-ERROR repeating), rc-gated (never `ok`-gated), warn-only twice over (never the exit code, never the monitor's `state`) — suite **233 → 311** under `--mutations` (section I + M10–M12), no new test file (suite count stays **119**, `- Live:` untouched), `CHANGELOG.md` **[0.4.356]**; the five step files are still uncommitted at append time, so this run's own commit carries them **plus** this file (pathspec-staged, never `git add -A`), no `app/` file

- **STEP 0, paid first and re-read at the close — owed nothing, no row written.** `SELECT COUNT(*) … WHERE direction='investor_to_agent' AND read=0` → **0 dev / 0 prod** at orientation and again before this entry; `./tools/inbox-status` → **rc 0**, `OK - nothing owed (0 unread, 0 open entries all replied)`, last reply **dev 146 / prod 111**; `INBOX.md` → **80 entries / 80 handled / 0 open**. No `agent_to_investor` row inserted in either database, nothing marked read, `INBOX.md` untouched — an empty inbox is answered by the measurement, not by a status row. **Production is 0.4.28** (the investor's 2026-10-05 correction stands, the wrong figure quoted nowhere): `./tools/version-check` → `OK: dev=0.4.28 prod=0.4.28 (match)`; `./tools/budget-show` → **2026-10, allowance 5.00 / spent 0.00 / remaining 5.00**; `./tools/queue-source-check` before this entry → **rc 1 with exactly the one R8 violation**, `[0.4.356] is not named in agent-logs/PROGRESS.md` — predicted (the changelog lands in the same commit) and **cleared by this entry**. Spend **0.00**, free `*-free` models only, no key configured, **no secret or PII in any prompt, file or commit**.

- **The DUE item paid first: run 960's J5-shaped second live reading, taken ~08:0xZ 2026-10-15 (≥ the 07:00Z due time) — J5 is now closed.** Bare `tools/shift-tally` → **rc 0**, `window-day=2026-10-08` (the first reading's `2026-10-07` moved on with the tree), **55 shift dates**, exactly **1 gap** (`leon` 2026-10-15, today's own section not yet written); `tools/shift-tally --all` → **rc 0**, **149 dates** (was 143 — the concurrent shifts' new sections), the **same single gap**. The property the second reading exists to check — **the `--all` superset's gap set equals the bare run's** — **holds**: the day key moved without a manufactured gap, i.e. no persona's section writes a future- or missing-dated footer since `[0.4.344]`'s rule. Reading saved `/tmp/opencode/run966/j5_reading.txt`; one live reading was owed, not two.

- **Queue read, and the step taken: run 965's re-queued "the ALERTS half of the same finding", priced at the same one-tool-one-suite price with the same discipline.** The queue line, verbatim: *"the ALERTS half of the same finding — the row now surfaces staleness on the dashboard, but a desk that reads only `red-watch-ALERTS.log` still does not meet it … a live-count threshold is NOT it — the day the wrapper is fixed the count goes to 0, so any fixed threshold would invert; the shape to price is the same rc/state-gated reader"*. Alternatives measured out: a second scheduled tool (the queue priced one reader, and `red-watch` IS the scheduled reader this box has); a `system-status`-only fix (already done in `[0.4.355]` — this is the other channel); a threshold (inverts on the day `--record` clears the staleness — the queue's own words). **No new tool, no new suite, no timer, no unit change**: the reader rides the `*/15` cron that already exists.

- **The change: `tools/red-watch` runs `tools/baseline-stale --format json` once per tick and follows its state with the monitor's own change-detection rule, on a split channel.** **rc-GATED, never `ok`-gated** (the child prints `ok:false` for both rc 1 and rc 3): rc **1** → `stale` (its own finding, standing even when its JSON was unreadable — count reported `?`), rc **0** → `ok` **only** when `counts.stale == 0`, anything else (rc 3, another exit, timeout, missing binary, unreadable JSON, rc 0 with a contradicting count) → `unknown`, never a pass. **Warn-only twice over**: the child never changes the exit code and never the monitor's `state` — `baseline.alert` / `baseline_alert=` is the reader's own field beside the monitor's `alert=`, so a wrapper alert can never be mistaken for a tree verdict (the `[0.4.204]` channel rule, one field over). Four change-only alerts, **no threshold**: `BASELINE-STALE since=… count=… identities="…" detail="…"` (onset, carrying `[0.4.354]`'s report wording verbatim so the alert greps like the dashboard row) · `BASELINE-STALE-SET` (compared on WHICH transcripts moved, `since` kept — the `RED-SET` design) · `BASELINE-STALE-RECOVERED after=Ns previously_stale=N` · `BASELINE-STALE-CHECK-ERROR` **repeating every run**, because `unknown` is never written to state (the monitor branch's own rule — a state file resting on it would silence the very alert that reports it). State file gains `baseline` / `baseline_since` / `baseline_count` / `baseline_ids`; the JSON payload gains the `baseline` object — **15 → 16 keys** (suite F11 + the REGISTRY key list moved in the same commit); the dated log line gains ` baseline=ok|stale:<n>|unknown`; two new hooks `REDWATCH_BASELINE_STALE_BIN` / `_TIMEOUT` (default 20) validated **before any I/O** beside the monitor's own; the child inherits this environment, so the app train's `GLADEX_BASELINE_STALE_*` pass through untouched.

- **Suite 233 → 311 under `--mutations` (262 assertions on a normal run), all on a PINNED static child — the LIVE baseline is never read.** New **section I** (~66 assertions) over ten stub children (ok / stale / stale3 / refuse / garbage / contradict / rc7 / stale-garbage / slow / missing): the `--format json` argv, the four state fields through onset → SET (`since` kept, ids expanded) → RECOVERED (cleared), dedupe across repeats, the gate in both directions, the timeout bound + its pre-I/O validation (`invocations` empty, log dir uncreated), warn-only exits, the monitor-`CHECK-ERROR`-plus-stale-child split (both alerts, last settled verdict KEPT — M5's needle preserved verbatim in the restructured write path), the `GLADEX_BASELINE_STALE_BASELINE` passthrough proven on a marker file, and the default `<repo>/tools/baseline-stale` path resolved against a sandbox fake repo (running the real child there would read the LIVE baseline — hermeticity). Three new mutants, each applied-exactly-once, parse-checked and caught on its own intended assertion: **M10** the baseline alert suppressed → I15 · **M11** the rc-gate defeated (rc 0 + `counts.stale=2` read as `ok`) → I43 · **M12** the dedupe defeated → I23. **The M5 needle was measured at HEAD first** (the base worktree battery: **233 / 0**, all nine pre-existing mutants applying) before the write path was restructured — the first draft had removed it and the measurement caught it.

- **Verification, all on this tree, all taken before this entry.** `bash tests/test_red_watch.sh` → **262 / 0, rc 0**; `--mutations` → **311 / 0, rc 0**; `bash tests/test_registry_coverage.sh` → **rc 0, 497 / 0** with every REGISTRY edit in place (C28g **32**, G38 **27**, `- Live:` **119** all untouched — env hooks are not a `--flag TOKEN` pair); `bash tests/test_registry_figure_readers.sh` → **43 / 1**, the single red **V14b** `shift-deploy` 132 vs 127 — the standing environmental red, measured identically by runs 959/962/963/964/965, **not** this run's; `bash tests/test_leak_figure_readers.sh` → **rc 0**; `bash tests/test_monitor_cascade.sh` → **49 / 0**; `bash tests/test_system_status_red_watch.sh` → **150 / 0**; `./tools/queue-source-check` → **rc 0** on `[0.4.355]` pointer-only (pre-changelog); `./tools/repo-lint` → **rc 0, `all 227 linted file(s) parse clean`**, **360 headings / 10820 citations / 0 missing** — **361** with `[0.4.356]` and still 227 linted files (no new file), the post-commit reading re-taken in the close rather than carried; `bash tests/test_gladex_monitor.sh` pre-commit → 28 assertions, failures exactly **A3/A15** (this run's dirty tree) + the standing **A12/A30** (`identity-run@mia.service` + `identity-run@sofia.service`) and **A31/A32** (`src/php/download.php` drift, `b460155` still reaching no environment) — **no new fault class**. The live box at the write: `./tools/system-status` still warns `baseline stale: 4 transcript(s) above their recorded value` (dispatcher 0.17, lena 2.87, mia 2.19, sofia 2.23), i.e. **the first `*/15` tick after this push should write the first `BASELINE-STALE` onset line** — waited for in the close correction.

- **Scope and safety, one line each:** commit by **explicit pathspec** — `tools/red-watch`, `tests/test_red_watch.sh`, `tools/REGISTRY.md`, `CHANGELOG.md`, `agent-logs/PROGRESS.md` (read from `git status --porcelain` immediately before staging) — **never `git add -A`** on this shared index; **`rm` only inside `/tmp/opencode`** (the `run966/` smoke dir and the `git worktree` base at `/tmp/opencode/run966/base`, removed in the close); **no live messages-DB write**, no DNS write, no mail sent, no paid API, no API key configured; **`hiring/queue/` read-only** (2 proposals `status=proposed`, the investor's seat); **no `systemctl reset-failed`, no restart, no unit or timer change, no `identity-run.sh`/`sofia-watch` edit** — mia's and sofia's failed units left standing on purpose and read only; **`coverage-guard --record` was NOT run** — the live baseline and every transcript were READ ONLY, and the reader this run built has no write path at all; **`tests/test_registry_coverage.sh` NOT edited this run** and no REGISTRY heading added/renamed/moved; **never `git stash` / `git stash pop`** in this tree (run 959's measured loss); **no `app/` file edited** → no reviewer gate, nothing to promote, dev and prod untouched at **0.4.28**; spend **0.00**, free `*-free` models only.

- **Queue — next small step (read this first):** **STEP 0 first every run** (today **0 unread dev / 0 prod**, `INBOX.md` **80/80/0 open** — an empty inbox is answered by the measurement). **This run closed run 965's re-queued ALERTS half** (the baseline-stale reader in `tools/red-watch`, suite section I + M10–M12) **and run 960's J5-shaped second live reading** (the DUE item — window-day moved to 2026-10-08, 55/149 dates, the single gap unchanged, subset agreement holds; **J5 closed**, one reading was owed). **NEW, re-queued unnumbered: nothing new is owed from this run's own finding** — the three readers (`shift-tally` a level, `coverage-guard` a fall, `baseline-stale` a rise) plus the dashboard row and the ALERTS channel now all point at the one remaining act: **`coverage-guard --record` (green only) after the wrapper fix** — a human act on any green run, and the only writer; the honest next step, if any, is whichever reader-side gap the NEXT measurement exposes, not a second writer this seat may not build. **Also still open:** run 952's **(i)** future-dated-footer guard *only on a measured future-dated marker* (this run's J5 re-read: **1 gap, the same one**, no future-dated marker — still not due) and **(iii)** A12 wording *only on a measured A12 misread* (the row already names mia + sofia and the `work/ownlog/other` split); **(93)**/**(97)(a)** first if the investor answers `hiring/queue/*.json` (**2 proposals**, unchanged since 2026-10-04 / 2026-09-30); **(2'')** the day the `GETTING_STARTED.md` keep/fold/retire answer arrives; **§14 renewal** cadence NEEDS-INVESTOR; the LAN-only A/B/C; NUL-blob watch on a measured harm only; **(av)(d)** after the `REPORT.md` §14 sign-off; **(i)** until the prune lands; SOA MNAME and Pip's mail-policy research NEEDS-INVESTOR; **(113)**'s two `cp`s operator-blocked; **2026-10-20** §10 #6 re-read; the `/stats` display row; and **(ax)**, **(e)**, the drift-verify line, **(aw)**, the `promote-gates` verdict watch, and run 915's monitor item — **A31/A32 now waiting on `b460155`'s `src/php/download.php` reaching dev and prod** (the dev-sync desk's, from `7f3166e`; this run promoted nothing). **V14b** (`shift-deploy` 132 vs 127) stays a **standing environmental red** owned by the stale-verdict gate, disclosed above. **A12/A30 remain `identity-run@mia.service` + `identity-run@sofia.service`**, cleared only by those units' own next fire, **never** by a `reset-failed` from this seat. Note also the **live baseline is still stale (4 identities above)** — `--record` (green only) clears it, and until then the new ALERTS line reports it once and then stays quiet until the set moves.

- **Close-state:** this entry is appended **before** the commit that carries it (CLOSE PROTOCOL rule 1) and is never `git checkout --`-ed, staged-only or parked in `/tmp` (rules 2–3); the stop-state check is `git status --porcelain` **not listing `agent-logs/PROGRESS.md`** after the commit. The push must leave `git rev-list --count origin/main..main` → **0**. Post-push re-reads (`queue-source-check` → rc 0 on `[0.4.356]` pointer-only, `repo-lint` → 361 headings / 227 linted files / 0 missing, `test_red_watch.sh` **262/0** and `--mutations` **311/0**, regcov **497/0**, `registry_figure_readers` (V14b standing), the monitor, `inbox-status`, `version-check`, `budget-show`, live `system-status` json, `git status --porcelain`, `rev-list`) plus the first `*/15` red-watch tick after the push — **watched for the first live `BASELINE-STALE` onset line, which the live stale count of 4 guarantees** — are recorded in the **close-correction** bullet appended before any close commit (rule 2).
EOF
cd /data/repo && ./tools/queue-source-check; echo "qsc rc=$?"
queue-source-check: OK - one queue: [0.4.356] pointer-only, 111 item line(s) frozen across 310 section(s), 203 PROGRESS bullet(s), 2 path token(s)
qsc rc=0
> build · mimo-v2.6-flash-free
R8 cleared. Now stage, commit, push:
$ cd /data/repo && git status --porcelain
M CHANGELOG.md
 M agent-logs/PROGRESS.md
 M tests/test_red_watch.sh
 M tools/REGISTRY.md
 M tools/red-watch
> build · mimo-v2.6-flash-free
$ cd /data/repo && git add CHANGELOG.md agent-logs/PROGRESS.md tests/test_red_watch.sh tools/REGISTRY.md tools/red-watch && git diff --cached --name-only && git diff --cached --stat | tail -2
CHANGELOG.md
agent-logs/PROGRESS.md
tests/test_red_watch.sh
tools/REGISTRY.md
tools/red-watch
 tools/red-watch         | 269 ++++++++++++++++++++++++++++++++++++++-
 5 files changed, 707 insertions(+), 37 deletions(-)
> build · mimo-v2.6-flash-free
$ cd /data/repo && git commit -m "run 966: red-watch gains the baseline-stale reader - run 965's re-queued ALERTS half reaches the */15 cron's alert file; four change-only alerts (onset/SET keeping since/RECOVERED/CHECK-ERROR repeating), rc-gated never ok-gated, warn-only twice over (never the exit code, never the monitor's state); suite 233 -> 311 under --mutations (section I + M10-M12), 16-key JSON, two new REDWATCH_BASELINE_STALE_* hooks; J5 second live reading taken and closed; CHANGELOG [0.4.356]" && git log --oneline -1 && git status --porcelain
[main b415a67] run 966: red-watch gains the baseline-stale reader - run 965's re-queued ALERTS half reaches the */15 cron's alert file; four change-only alerts (onset/SET keeping since/RECOVERED/CHECK-ERROR repeating), rc-gated never ok-gated, warn-only twice over (never the exit code, never the monitor's state); suite 233 -> 311 under --mutations (section I + M10-M12), 16-key JSON, two new REDWATCH_BASELINE_STALE_* hooks; J5 second live reading taken and closed; CHANGELOG [0.4.356]
 5 files changed, 707 insertions(+), 37 deletions(-)
b415a67 run 966: red-watch gains the baseline-stale reader - run 965's re-queued ALERTS half reaches the */15 cron's alert file; four change-only alerts (onset/SET keeping since/RECOVERED/CHECK-ERROR repeating), rc-gated never ok-gated, warn-only twice over (never the exit code, never the monitor's state); suite 233 -> 311 under --mutations (section I + M10-M12), 16-key JSON, two new REDWATCH_BASELINE_STALE_* hooks; J5 second live reading taken and closed; CHANGELOG [0.4.356]
> build · mimo-v2.6-flash-free
$ cd /data/repo && git push origin main && git rev-list --count origin/main..main && git status --porcelain; echo "status-end"
To git://git.gladex.de/gladex.git
   12481e3..b415a67  main -> main
0
status-end
> build · mimo-v2.6-flash-free
Pushed `12481e3..b415a67`, rev-list → 0, tree clean. Now the close protocol — post-push re-reads:
$ cd /data/repo && date -u; ./tools/queue-source-check; ./tools/inbox-status | tail -2; ./tools/version-check; ./tools/budget-show | head -4; ./tools/healthcheck | tail -3
Thu Oct 15 09:37:08 UTC 2026
queue-source-check: OK - one queue: [0.4.356] pointer-only, 111 item line(s) frozen across 310 section(s), 203 PROGRESS bullet(s), 2 path token(s)

verdict: OK - nothing owed (0 unread, 0 open entries all replied)
OK: dev=0.4.28 prod=0.4.28 (match)
=== Budget Status ===
Month:       2026-10
Allowance:   5.00 €
Spent:       0.00 € (no October charge in any file — MEASURED 2026-10-12: no public registry source can date a renewal (DENIC RDAP publishes only a "last changed" event, and does so for every .de domain; DENIC whois has no expiry field; the IANA RDAP bootstrap has no "de" entry), so the one open unknown is your billing cadence: monthly 1.50 as brief §4 states, or annual at the 2027-09-20 registration anniversary? Still NEEDS-INVESTOR, REPORT.md §14)
prod: HEALTHY
  HTTP: 200
  Response: {"status":"ok","service":"gladex-investor-app","env":"prod","timestamp":1792057028,"version":"0.4.28"}
$ cd /data/repo && ./tools/repo-lint 2>&1 | tail -2; ./tools/system-status --format json 2>/dev/null | python3 -c 'import json,sys; d=json.load(sys.stdin); print("errors", d.get("errors")); print([c for c in d.get("checks",[]) if "baseline" in str(c)])' 2>/dev/null || ./tools/system-status | grep -i baseline
elf-allowlist: 2 tracked ELF file(s), all shipped
result: all 227 linted file(s) parse clean (exit 0)
errors 1
[{'name': 'deploy-path', 'status': 'ok', 'detail': 'ledger OK - 48 file(s) across dev+prod attested (/data/agent-logs/promote-ledger.jsonl; source: baseline+promote)'}, {'name': 'baseline-stale', 'status': 'warning', 'detail': 'baseline stale: 4 transcript(s) above their recorded value - run tools/coverage-guard --record (green only)'}]
> build · mimo-v2.6-flash-free
$ cd /data/repo && bash tests/test_registry_coverage.sh > /tmp/opencode/run966/regcov_post.log 2>&1; echo "rc=$?"; tail -1 /tmp/opencode/run966/regcov_post.log
Command moved to the background (shell ID: sh_13eee1442001csQyNENS4HmtlT).
Output is streaming to: /root/.local/share/opencode/shell/fa3e85b2145a60c127b5c9261e76a7ba6d520299/sh_13eee1442001csQyNENS4HmtlT.out
$ cd /data/repo && ./tools/repo-lint 2>&1 | grep 'changelog-version'
changelog-version: 361 changelog version heading(s), 361 unique, 10851 citation(s) checked, 0 missing, 13437 bare token(s) counted
$ cd /data/repo && bash tests/test_red_watch.sh 2>&1 | tail -1; bash tests/test_registry_figure_readers.sh 2>&1 | grep '^FAIL'; bash tests/test_gladex_monitor.sh 2>&1 | tail -1; bash tests/test_gladex_monitor.sh 2>&1 | grep '^FAIL'
=== Results: 262 passed, 0 failed ===
FAIL: V14b shift-deploy: the registry's figure equals what tests/test_shift_deploy.sh produced (child rc=0) (want=132 got=127)
summary: 28 assertions, 24 passed, 4 failed
FAIL A12 system-status verdict - checks in error: failed-units (kind=is key=sysverdict want=HEALTHY)
FAIL A30 no unit is left in systemctl --failed (kind=contains key=sys want=[OK] 0 failed unit(s))
FAIL A31 source-sync-check exits 0 (kind=rc key=sync want=0)
FAIL A32 the committed tree reached dev AND prod (kind=contains key=sync want=in sync)
> build · mimo-v2.6-flash-free
$ cd /data/repo && bash tests/test_red_watch.sh --mutations 2>&1 | tail -1
=== Results: 311 passed, 0 failed ===
> build · mimo-v2.6-flash-free
$ date -u; tail -3 /data/agent-logs/red-watch-cron.log 2>/dev/null; tail -3 /data/agent-logs/red-watch-ALERTS.log
Thu Oct 15 09:51:43 UTC 2026
  FAIL A32 the committed tree reached dev AND prod (kind=contains key=sync want=in sync)
  log=/data/agent-logs/red-watch-20261015.log
  alerts=/data/agent-logs/red-watch-ALERTS.log
2026-10-15T08:30:01Z RED-SET since=1791893840 monitor_exit=1 passed=22 failed=6 fails="FAIL A3 tree clean AND in sync with origin/main (kind=is key=git want=## main...origin/main) | FAIL A12 system-status verdict - checks in error: failed-units (kind=is key=sysverdict want=HEALTHY) | FAIL A15 git-tree reports a clean tree (kind=contains key=sys want=[OK] clean) | FAIL A30 no unit is left in systemctl --failed (kind=contains key=sys want=[OK] 0 failed unit(s)) | FAIL A31 source-sync-check exits 0 (kind=rc key=sync want=0) | FAIL A32 the committed tree reached dev AND prod (kind=contains key=sync want=in sync)"
2026-10-15T08:30:01Z BASELINE-STALE since=1792053145 count=4 identities="dispatcher lena mia sofia" detail="baseline stale: 4 transcript(s) above their recorded value - run tools/coverage-guard --record (green only)"
2026-10-15T09:45:01Z RED-SET since=1791893840 monitor_exit=1 passed=24 failed=4 fails="FAIL A12 system-status verdict - checks in error: failed-units (kind=is key=sysverdict want=HEALTHY) | FAIL A30 no unit is left in systemctl --failed (kind=contains key=sys want=[OK] 0 failed unit(s)) | FAIL A31 source-sync-check exits 0 (kind=rc key=sync want=0) | FAIL A32 the committed tree reached dev AND prod (kind=contains key=sync want=in sync)"
> build · mimo-v2.6-flash-free
The reader is live — and the onset actually fired earlier than the push (the cron runs the working tree). Verify:
$ tail -2 /data/agent-logs/red-watch-20261015.log; echo ===; cat /data/agent-logs/red-watch.state; echo ===; grep -c 'BASELINE-STALE' /data/agent-logs/red-watch-ALERTS.log
2026-10-15T09:30:01Z state=red monitor_exit=1 passed=22 failed=6 alert=none fails="FAIL A3 tree clean AND in sync with origin/main (kind=is key=git want=## main...origin/main) | FAIL A12 system-status verdict - checks in error: failed-units (kind=is key=sysverdict want=HEALTHY) | FAIL A15 git-tree reports a clean tree (kind=contains key=sys want=[OK] clean) | FAIL A30 no unit is left in systemctl --failed (kind=contains key=sys want=[OK] 0 failed unit(s)) | FAIL A31 source-sync-" baseline=stale:4
2026-10-15T09:45:01Z state=red monitor_exit=1 passed=24 failed=4 alert=RED-SET fails="FAIL A12 system-status verdict - checks in error: failed-units (kind=is key=sysverdict want=HEALTHY) | FAIL A30 no unit is left in systemctl --failed (kind=contains key=sys want=[OK] 0 failed unit(s)) | FAIL A31 source-sync-check exits 0 (kind=rc key=sync want=0) | FAIL A32 the committed tree reached dev AND prod (kind=contains key=sync want=in sync)" baseline=stale:4
===
state=red
since=1791893840
failed=4
fails=FAIL A12 system-status verdict - checks in error: failed-units (kind=is key=sysverdict) ;; FAIL A30 no unit is left in systemctl --failed (kind=contains key=sys) ;; FAIL A31 source-sync-check exits 0 (kind=rc key=sync) ;; FAIL A32 the committed tree reached dev AND prod (kind=contains key=sync)
updated=2026-10-15T09:45:01Z
baseline=stale
baseline_since=1792053145
baseline_count=4
baseline_ids=dispatcher lena mia sofia
===
1
> build · mimo-v2.6-flash-free
The full close protocol is green. Remove the temp worktree and append the close correction:
$ cd /data/repo && git worktree remove /tmp/opencode/run966/base && git worktree list
/data/repo                     b415a67 [main]
/tmp/opencode/head86           28e87d5 (detached HEAD)
/tmp/opencode/nf-prefix-04304  197f7b0 (detached HEAD)
> build · mimo-v2.6-flash-free
$ cat >> /data/repo/agent-logs/PROGRESS.md <<'EOF'
- **Close correction (appended before the close commit — CLOSE PROTOCOL rule 2): `b415a67` pushed, fourteen post-push re-reads green except the four standing reds this run does not own, and the `BASELINE-STALE` onset line was waited for and FOUND — it fired at `08:30:01Z`, the first `*/15` tick after the edited tool landed on the working tree, and the two later stale ticks wrote NOTHING (dedupe holds).** `git push origin main` → **rc 0, `12481e3..b415a67`**; `git rev-list --count origin/main..main` → **0**. Commit #1 by **explicit pathspec** — `git status --porcelain` read immediately before staging showed exactly the five paths (` M CHANGELOG.md`, ` M agent-logs/PROGRESS.md`, ` M tests/test_red_watch.sh`, ` M tools/REGISTRY.md`, ` M tools/red-watch`), `git diff --cached --name-only` after `git add <those five>` was those same five and nothing else — **never `git add -A`** on this shared index → **`b415a67`**, **5 files changed, 707 insertions(+), 37 deletions(-)**; `git status --porcelain` → **empty straight after it** (the entry is carried by commit #1, not left staged, not `git checkout --`-ed, not parked in `/tmp` — rules 1 and 3 hold, and `agent-logs/PROGRESS.md` is **not** in that reading). The temp worktree `/tmp/opencode/run966/base` (the 233/0 pre-edit mutation baseline) was removed in the close.
- **Post-push re-reads, all on the pushed tree `b415a67`:** `./tools/queue-source-check` → **rc 0**, `one queue: [0.4.356] pointer-only, 111 item line(s) frozen across 310 section(s), 203 PROGRESS bullet(s), 2 path token(s)` — **R8 clear on both counts**; `./tools/repo-lint` → **rc 0, `all 227 linted file(s) parse clean`**, **`361 changelog version heading(s), 361 unique, 10851 citation(s) checked, 0 missing`** — **360 → 361 with `[0.4.356]`, re-read not carried**, linted files unchanged (no new file this run); `bash tests/test_red_watch.sh` → **rc 0, 262 passed / 0 failed** and `bash tests/test_red_watch.sh --mutations` → **rc 0, 311 passed / 0 failed, 12/12 mutants applied-and-caught** (the figures this run owns); `bash tests/test_registry_coverage.sh` → **rc 0, 497 passed / 0 failed** — `- Live:` **119**, C28g **32**, G38 **27** all as this commit left them; `bash tests/test_registry_figure_readers.sh` → **rc 1, 43 passed / 1 failed**, the single red **V14b** `shift-deploy` want=132 got=127 — the standing environmental red, measured identically pre-push; `bash tests/test_gladex_monitor.sh` → **28 assertions, 24 passed, 4 failed**, the four exactly **A12, A30, A31, A32** (A3/A15/A28 cleared by the push); `./tools/inbox-status` → **rc 0, `nothing owed`** — **STEP 0 still paid at the close, no `agent_to_investor` row written**; `./tools/version-check` → `OK: dev=0.4.28 prod=0.4.28 (match)`; `./tools/healthcheck` → **prod HEALTHY, HTTP 200**, payload `version 0.4.28`; `./tools/budget-show` → **2026-10, allowance 5.00 / spent 0.00 / remaining 5.00**; live `./tools/system-status --format json` → **errors 1** (the standing `failed-units` only) with the `baseline-stale` row **`warning baseline stale: 4 transcript(s) above their recorded value - run tools/coverage-guard --record (green only)`**; `git status --porcelain` → **empty**; `git rev-list --count origin/main..main` → **0**.
- **The live ALERTS channel, read after the ticks:** `/data/agent-logs/red-watch-ALERTS.log` now carries exactly **one** `BASELINE-STALE` line — **`2026-10-15T08:30:01Z BASELINE-STALE since=1792053145 count=4 identities="dispatcher lena mia sofia" detail="baseline stale: 4 transcript(s) above their recorded value - run tools/coverage-guard --record (green only)"`** — written by the 08:30 tick against the edited working tree (the cron runs the tree, not the commit: the tool file was final on disk before the commit landed at ≈09:35Z), i.e. **the first possible tick after the change, exactly as the entry predicted**; the 09:30 and 09:45 ticks both read the still-stale baseline and wrote **no second line** (`grep -c BASELINE-STALE` → **1** — the dedupe, live). The dated lines carry the tail **` baseline=stale:4`** and the state file carries all four fields (`baseline=stale`, `baseline_since=1792053145`, `baseline_count=4`, `baseline_ids=dispatcher lena mia sofia`) beside the kept monitor verdict (`state=red`, the A12/A30/A31/A32 set) — the channel split and the kept-verdict rule both visible on the box itself. `alert=RED-SET` at 09:45 is the monitor's own standing set, unchanged by this run. **Stop-state: `git status --porcelain` does not list `agent-logs/PROGRESS.md` after this commit; the close ends with `git rev-list --count origin/main..main` → 0.** Spend **0.00**, free `*-free` models only.
EOF
cd /data/repo && git add agent-logs/PROGRESS.md && git diff --cached --name-only && git commit -m "run 966 close correction: push b415a67, 14 post-push re-reads green (qsc rc 0 on [0.4.356], 361 headings/227 linted/0 missing, red_watch 262/0 + mutations 311/0, regcov 497/0, monitor+figure standing reds only), first BASELINE-STALE onset line 08:30:01Z found with dedupe holding" && git push origin main && git rev-list --count origin/main..main && git status --porcelain; echo end
agent-logs/PROGRESS.md
[main d841717] run 966 close correction: push b415a67, 14 post-push re-reads green (qsc rc 0 on [0.4.356], 361 headings/227 linted/0 missing, red_watch 262/0 + mutations 311/0, regcov 497/0, monitor+figure standing reds only), first BASELINE-STALE onset line 08:30:01Z found with dedupe holding
 1 file changed, 3 insertions(+)
To git://git.gladex.de/gladex.git
   b415a67..d841717  main -> main
0
end
> build · mimo-v2.6-flash-free
Run 966 is closed. Full summary:

## What landed

**The queue line closed:** run 965's re-queued "ALERTS half of the same finding" — `tools/red-watch` now runs `tools/baseline-stale --format json` once per `*/15` tick and follows its state with the monitor's own change-detection rule, on a split channel (`baseline.alert` / `baseline_alert=` never masquerade as the monitor's `alert=`).

- **rc-gated, never `ok`-gated**: rc 1 → `stale` (stands even with unreadable JSON, count `?`); rc 0 → `ok` only if `counts.stale == 0`; everything else → `unknown`, never a pass.
- **Four change-only alerts, no threshold**: `BASELINE-STALE` onset · `-SET` (compared on *which* transcripts moved, `since` kept) · `-RECOVERED after=Ns previously_stale=N` · `-CHECK-ERROR` (repeats every run — `unknown` is never written to state).
- **Warn-only twice over**: never the exit code, never the monitor's `state`; the state file keeps the last *settled* verdict beside the four new `baseline*` fields (M5's needle preserved verbatim).
- Two new hooks `REDWATCH_BASELINE_STALE_BIN` / `_TIMEOUT` (validated before any I/O); JSON payload 15 → **16 keys**.

**Suite:** section I (~66 assertions, pinned static child — the live baseline is never read) + mutants M10–M12 → `tests/test_red_watch.sh` **262/0**, `--mutations` **311/0** (baseline at HEAD: 233/0). No new test file, suite count stays 119.

**Also this run:** STEP 0 paid first and owed nothing (0 unread both DBs, INBOX 80/80/0); run 960's **J5 second live reading** taken and closed (window-day → 2026-10-08, 55/149 dates, single gap unchanged, subset agreement holds).

## Close protocol
- Commits `b415a67` (5 files, 707+/37−) and `d841717` (PROGRESS close correction) — both pushed by explicit pathspec, `rev-list` → **0**, tree clean, PROGRESS never listed in `git status`.
- 14 post-push re-reads green except the four standing reds (A12/A30 mia+sofia units, A31/A32 download.php drift, V14b) — none owned by this run.
- **The live ALERTS channel:** the first `BASELINE-STALE` onset line fired at `08:30:01Z` with the exact run-965 wording, `count=4 identities="dispatcher lena mia sofia"` — and the two later stale ticks wrote **nothing** (`grep -c` → 1: the dedupe, live on the box). The dated lines carry ` baseline=stale:4`; the state file carries all four fields beside the kept monitor verdict.
- Temp worktree removed; spend 0.00, free models only, no `app/` file touched (dev/prod stay 0.4.28).
exit=0

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Thu Oct 15 12:30:56 2026] 127.0.0.1:39426 Accepted
[Thu Oct 15 12:30:56 2026] 127.0.0.1:39426 Closing
[Thu Oct 15 12:30:56 2026] 127.0.0.1:39434 Accepted
[Thu Oct 15 12:30:56 2026] 127.0.0.1:39434 Closing
[Thu Oct 15 12:30:56 2026] 127.0.0.1:39438 Accepted
[Thu Oct 15 12:30:56 2026] 127.0.0.1:39438 Closing
[Thu Oct 15 12:30:56 2026] 127.0.0.1:39444 Accepted
[Thu Oct 15 12:30:56 2026] 127.0.0.1:39444 Closing
[Thu Oct 15 12:30:56 2026] 127.0.0.1:39458 Accepted
[Thu Oct 15 12:30:56 2026] 127.0.0.1:39458 Closing
[Thu Oct 15 12:30:56 2026] 127.0.0.1:39464 Accepted
[Thu Oct 15 12:30:56 2026] 127.0.0.1:39464 Closing
[Thu Oct 15 12:30:56 2026] 127.0.0.1:39478 Accepted
[Thu Oct 15 12:30:56 2026] 127.0.0.1:39478 Closing
[Thu Oct 15 12:30:56 2026] 127.0.0.1:39492 Accepted
[Thu Oct 15 12:30:57 2026] 127.0.0.1:39492 Closing
[Thu Oct 15 12:30:57 2026] 127.0.0.1:39498 Accepted
[Thu Oct 15 12:30:57 2026] 127.0.0.1:39498 Closing
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57070 Accepted
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57070 Closing
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57080 Accepted
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57080 Closing
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57082 Accepted
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57082 Closing
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57084 Accepted
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57084 Closing
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57088 Accepted
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57088 Closing
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57092 Accepted
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57092 Closing
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57106 Accepted
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57106 Closing
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57110 Accepted
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57110 Closing
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57124 Accepted
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57124 Closing
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57126 Accepted
[Thu Oct 15 12:31:36 2026] 127.0.0.1:57126 Closing
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40620 Accepted
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40620 Closing
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40636 Accepted
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40636 Closing
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40646 Accepted
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40646 Closing
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40654 Accepted
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40654 Closing
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40660 Accepted
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40660 Closing
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40674 Accepted
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40674 Closing
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40688 Accepted
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40688 Closing
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40702 Accepted
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40702 Closing
[Thu Oct 15 12:32:02 2026] 127.0.0.1:40714 Accepted
[Thu Oct 15 12:32:03 2026] 127.0.0.1:40714 Closing
[Thu Oct 15 12:32:03 2026] 127.0.0.1:40724 Accepted
[Thu Oct 15 12:32:03 2026] 127.0.0.1:40724 Closing
[Thu Oct 15 12:34:51 2026] 127.0.0.1:51388 Accepted

Other app logs: downloads.log