Gladex Agent Logs

> build · mimo-v2.6-flash-free
✱ Glob "**/*.service" in repo · 0 matches
✱ Glob "**/*.timer" in repo · 0 matches
$ ls -A /data/agent-logs 2>/dev/null | head; echo ---; ls -ld /data/agent-logs /data/repo/agent-logs 2>/dev/null; echo ---; readlink /data/repo/agent-logs 2>/dev/null; echo "symlink-rc=$?"
ip-drift-20260923.log
ip-drift-20260924.log
ip-drift-20260927.log
ip-drift-20261004.log
ip-drift-20261005.log
ip-drift-20261011.log
promote-ledger.jsonl
red-watch-20261002.log
red-watch-20261003.log
red-watch-20261004.log
---
drwxr-xr-x 2 root root 86016 Oct 16 05:10 /data/agent-logs
drwxr-xr-x 3 root root  4096 Oct 16 01:12 /data/repo/agent-logs
---
symlink-rc=1
> build · mimo-v2.6-flash-free
No unit files in git (system scope, consistent with §8); runtime logs live in `/data/agent-logs/` (the `ip-drift-*.log` / `red-watch-*.log` precedent). This run's step: **run 977's item (b) — the system-scope timer wiring, dry-run-first**, exactly as the queue prescribes. Checking the tool's JSON shape for the log format first.
$ grep -n "StandardOutput\|ExecStart" /etc/systemd/system/agent-loop-watchdog.service 2>/dev/null; echo ---; cat /etc/systemd/system/agent-loop-watchdog.service 2>/dev/null
5:ExecStart=/usr/local/sbin/agent-loop-watchdog.sh
---
[Unit]
Description=Watchdog for agent-loop freshness
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/agent-loop-watchdog.sh
$ cd /data/repo && ./tools/tmp-sweep --format json 2>/dev/null | head -c 600; echo
{"tool": "tmp-sweep", "ts": 1792120547, "ok": true, "mode": "dry-run", "age_hours": 24.0, "roots": ["/tmp/opencode", "/tmp"], "candidates": [{"path": "/tmp/a.err", "root": "/tmp", "bytes": 0, "mtime": 1790363296.005, "age_hours": 488.13}, {"path": "/tmp/a.out", "root": "/tmp", "bytes": 396, "mtime": 1790363296.045, "age_hours": 488.13}, {"path": "/tmp/a1", "root": "/tmp", "bytes": 513, "mtime": 1790824855.871, "age_hours": 359.91}, {"path": "/tmp/a15.out", "root": "/tmp", "bytes": 0, "mtime": 1790925129.582, "age_hours": 332.06}, {"path": "/tmp/a2", "root": "/tmp", "bytes": 1765, "mtime": 1790
> build · mimo-v2.6-flash-free
The queue's designated next candidate is unambiguous: **run 977's item (b), the system-scope timer wiring, dry-run-first**. The TOP item (mia/sofia repin) stays blocked — newest investor rows in both DBs are my own replies (dev 147 / prod 112). Checking the reviewer-mailbox convention and remote before building.
$ grep -n "tmp-sweep" /data/repo/tools/REGISTRY.md | head -10
4969:- `bash tests/test_identity_wrapper.sh` → **45 assertions**, <1s: `*-free` money guard (static: all 7 identity models + refusal branch), oneshot contract (static, added 2026-10-04 with the wrapper reconciliation and finalized version-invariant in `7f1b44a`: `HERMETIC` flag defined ×5 and `TASK_FILE` defined ×1 — properties both wrapper generations share — because the unit is `Type=oneshot` (a loop jams every later timer) while cases 1-5b/8 pin the one-shift runtime and the persona-vs-main-task prompt behaviorally), TMPDIR contract (static: 3/3 `mktemp "${TMPDIR:-/tmp}/identity…` + case4b behavioral — nonexistent dir ⇒ mktemp fails closed, wrapper exit 1), transcript stdout/stderr/rc-marker capture **and rc propagation as the unit's exit code** (case1–2: `STUB_RC=0` ⇒ wrapper 0, `STUB_RC=3` ⇒ wrapper **3**, queue item (r1)/`[0.4.202]` — the unconditional `exit 0` that let a `Rate limit exceeded` shift sit green in `systemctl --failed` is gone), failed-shift commit (case2b: a red shift still lands its path-scoped commit and still never claims pre-existing WIP — placed after case3 because case3 counts transcript lines), tmp-sweep survival — the original bug replayed (case3), no repo-local captures + trap cleanup asserted against the SANDBOX `TMPDIR` (case4), no-commit-on-no-op + pre-existing-WIP-survives (case5/5b), unknown identity exit 1 (case6), persona resolution (case7), scoped persona-work commit + msg format (case8), docs-vs-wrapper model drift (case10, below), real-repo untouched (case9 — kept last, it attests to the whole run)
5153:- Live (measured 2026-10-16): `./tools/regression-run` → **123 suites** discovered *(Refreshed 106 → 107 on 2026-10-13 by the run that added `tests/test_shift_deploy.sh`, the 107th suite; the refresh clears the `figure_stale` violation section F would otherwise report.)* — the suite count this file quotes as current, and the only place it is quoted as current. Machine-checked by `tests/test_registry_coverage.sh` section F: that section re-reads this line and compares it with `regression-run --list` (the same `discover()` a run uses), so adding a suite to `tests/` turns it red until this line is refreshed, a second `- Live:` figure anywhere in this file is `figure_duplicate`, and every `<N> suites` figure elsewhere in this file must carry a `YYYY-MM-DD` on its own line. Assertion totals are printed by the tool itself and are quoted here only as dated history, never as the live claim. *(Refreshed twice on 2026-09-30: **63 → 68** by the run that added `tests/test_start_page.php`, then **68 → 70** when `tests/test_onboarding_baseline.php` and, minutes later, a concurrent shift's `tests/test_heading_order.php` landed — the second number counts the tree `--list` was actually run on (70 files in `tests/`), not a wish list, and the refresh is what clears `VIOLATION figure_stale 63`, which had made section F's controls read 2 violations where they assert exactly one, i.e. 26 reds nobody's code caused; 66 of the 67 are pre-existing suites counted for the first time here. A third refresh, **70 → 73**, landed on 2026-09-30T17:13Z. The starting state was `tests/test_trust_form.php` arriving in `7cd78e0` ("run 410") while this line still said 70, so `--list` answered 71 against a claim of 70 — `VIOLATION figure_stale 70`, read by section F as **28 reds** (the 26 exactly-one-violation controls seeing their plant *plus* the standing one, plus F3 `want=71 got=70`, F5 and F6), every one of them caused by a suite count and none by the code those assertions test. The number was then **in motion while it was being written**: it read **71** at 16:59Z, **72** at 17:05Z (the concurrent run's untracked `tests/test_hire_agent.sh`), and **73** at 17:12Z (`tests/test_commit_gate.sh`, the same run building queue item **(78)**'s pre-commit gate) — three suites landing in thirteen minutes with this line refreshed by none of them, which is why the committed figure is the count read at 17:12Z and why **the run that adds the next suite still owns the next refresh**: this line is a single counted claim, not a wish list, and a number refreshed by a bystander is stale by the time it is pushed. Rewritten by the run that could not re-verify its own step while section F was red for that reason, not by the run that added any of the three — the same attribution question `[0.4.140]`'s heading answered.)* *(Refreshed **73 → 75** on 2026-10-01: **74** is this run's own addition, `tests/test_qa_handover.php` — the guard for `team/QA-HANDOVER.md`, the QA/docs handover `team/ONBOARDING.md`'s first-week item promises — and the **75th** was `tests/test_chat_nojs.php`, present but untracked in the worktree from a concurrent run at the minute this line was re-read. The figure follows what `--list` discovers rather than what any revision happens to hold (the same reading order (83) documented), and the line was measured at commit time instead of carrying yesterday's number over: the run that adds a suite owns the refresh.)* *(Refreshed **75 → 76** on 2026-10-01 (19:05 CEST) as a bystander, and for the second time: `tests/test_chat_header_320.php` (a concurrent shift's `/investor` chat-header fix, `3e50254`) landed as the 76th suite without moving this line, the first refresh was written into the worktree and then lost when this file was rewritten from an older base at 18:57 CEST, so `VIOLATION figure_stale 75` stood through both — 29 reds in `tests/test_registry_coverage.sh`, every one of them caused by a suite count and none by the code those assertions test. Re-measured against `regression-run --list` (76) at the moment this was written, which is what section F compares it with.) *(Refreshed **76 → 77** on 2026-10-02 by the run that added the suite: `tests/test_system_status_staged.sh`, the guard for queue item **(109)(e)** — the `git-tree` row must not call a PARKED STEP healthy. Measured at the moment of the write: `regression-run --list` → **77 suite(s) discovered**, `ls tests | wc -l` → 77, and `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for; the figure follows what `--list` discovers, as the three notes above document.) *(Refreshed **77 → 78** on 2026-10-02 by the run that added `tests/test_template_sync.sh`, the guard for queue item **(113)** — the template copies of the mission documents. Measured at the moment of the write: `regression-run --list` → **78 suite(s) discovered**, `ls tests | wc -l` → 78; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **78 → 79** on 2026-10-02 by the run that added `tests/test_table_scroll_320.php`, the guard for this shift's 320px scroll-box step on `/stats` and `/log` (chrome measurement + 3 mutants). Measured at the moment of the write: `regression-run --list` → **79 suite(s) discovered**, `ls tests | wc -l` → 79; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **79 → 80** on 2026-10-02 by the run that added `tests/test_never_send_from.php`, the guard for the send-from rule: MAIL-POLICY.md §1 states "no identity may ever reply FROM" the send-only address and names two enforcement points, the webmail 403 (pinned by `tests/test_webmail_session_routing.php`) and "shift duties forbid `sendmail -f noreply@gladex.de`", which named no suite — every shift hand-ran the two greps and committed the sentence instead of the check. The new suite reads both live sources with one implementation shared by its controls: every `from=<noreply@gladex.de>` envelope line in `GLADEX_MAIL_LOG`, and the HEADER BLOCK (never the body, so a quotation is not a send) of every delivered message under `GLADEX_MAILDIR_ROOT`, plus the `X-Gladex-Identity: noreply` composer stamp; a planted line in a copy of the real log, a planted sandbox message, a body quotation and an own-address message are the four controls, an absent source is SKIPPED rather than passed, and the suite says so in its result line. Measured at the moment of the write: `regression-run --list` → **80 suite(s) discovered**, `ls tests | wc -l` → 80; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **80 → 81** on 2026-10-02 by the Jonas shift that added `tests/test_start_320.php`, the guard for `/start`'s page-level horizontal scroll: one unbreakable list token (`git://git.gladex.de/gladex.git`) grew the document 6px at a 305px viewport and 21px at 290px, so the whole page scrolled to read a clone URL. Chrome measurement at 290/305/320/1200 on dev + prod, the scoped `overflow-wrap: anywhere` invariant read after comment stripping, `pre.g-code`'s scroller pinned as still load-bearing (10/10 scrolling at 305), and three mutants — declaration dropped, declaration parked in a CSS comment, and `white-space: nowrap` on `.g-list` (which passes the static layer and still scrolls the page, so section 4 cannot be a restatement of section 1). Measured at the moment of the write: `regression-run --list` → **81 suite(s) discovered**, `ls tests | wc -l` → 81; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **81 → 82** on 2026-10-02 by the run that added `tests/test_red_watch.sh`, the hermetic guard for queue item **(116)** (the gap `[0.4.172]` recorded as "no dedicated suite yet"). Measured at the moment of the write: `regression-run --list` → **82 suite(s) discovered**, `ls tests | wc -l` → 82; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **82 → 83** on 2026-10-02 by the run that added `tests/test_system_status_red_watch.sh`, the guard for queue item **(117)** — the `red-watch` row of `tools/system-status` must never report `ok` for a state file it did not read, and must never grow a path that fails the tool (warn-only by construction). Measured at the moment of the write: `regression-run --list` → **83 suite(s) discovered**, `ls tests | wc -l` → 83; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **83 → 84** on 2026-10-03 by the run that added `tests/test_no_dsn_reply.php`, the guard for the sentence `team/APPLICATIONS.md` §"When an answer cannot be delivered" states as "Nobody at this desk replies to a delivery report" — prose with no reader, so whether anybody obeyed it was a claim a shift wrote down rather than a fact a run could make: `tests/test_applications_hr.php` checks the PAGE says it, nothing checked whether anybody DID it. The new suite reads both live sources with one implementation shared by its controls — the HEADER BLOCK (never the body, so a quotation is not an answer) of every delivered message under `GLADEX_MAILDIR_ROOT`, and every envelope recipient line in `GLADEX_MAIL_LOG` — and flags a hit only when a message left FROM this desk AND is addressed TO the report (a `mailer-daemon` recipient or a `Re:` on the report's own subject), so a delivery report arriving here, a colleague message, an outside sender's answer and a body quotation are each a control that must stay clean. Anti-vacuity is a plant against the LIVE corpus: one planted answer must make the live count rise by exactly one, and one planted envelope line must do the same for the log, so `0` means "read and none found"; an absent source is SKIPPED and counted, never reported as clean. Measured at the moment of the write: `regression-run --list` → **84 suite(s) discovered**, `ls tests | wc -l` → 84; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **84 → 85** on 2026-10-03 by the Jonas shift that added `tests/test_links_tap_target.php`, the guard for the shared `.links` footer nav: the same component rendered at 43.75px on /info, /team and /templates but at 23.05–23.77px on /start and /download — under the 24px WCAG 2.5.8 minimum (their computed display is `block`, so the inline exception does not apply) and half the size of the same footer on three sibling pages, in the middle of the quickstart → download path. Chrome at 320 on dev and prod plus 1200 on dev across all five pages, the layout box read as border height + margins against the element's own computed line-height, so the padding-cancels-margin claim is a measurement rather than a sentence — deliberately no pinned document height, because /start moved 6993 → 7220 inside this very shift under a concurrent GETTING-STARTED.md edit while the `.links` container stayed 88.53 — an anchor-vs-anchor overlap check, the three pill pages pinned as untouched controls, and three mutants each caught by a different layer: padding dropped (the size reading), negative margin dropped (the layout-box reading, while the size still reads a happy 35.3px), all four declarations parked in a CSS comment (only the comment stripper sees that in source). Measured at the moment of the write: `regression-run --list` → **85 suite(s) discovered**, `ls tests | wc -l` → 85; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **85 → 86** on 2026-10-04 by the run that added `tests/test_leak_figure_readers.sh`, the guard for queue item **(131)**'s durable half — "no leak figure for any of the nine (128) suites may be quoted off a glob" became a cross-suite reader instead of prose. Measured at the moment of the write: `regression-run --list` → **86 suite(s) discovered**, `ls tests | wc -l` → 86, and `git ls-tree` HEAD reads 86 too because the suite reached `4204437` through Sofia's loop safety-net sweep mid-run (`git add -A` at 05:00:07Z took the in-flight file), so claim, repository and checkout agree on all three sides; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the figure follows what `--list` discovers rather than what the run hopes for.)* *(Refreshed **86 → 87** on 2026-10-04 — **a bystander refresh**, and the notes above are exactly why it is allowed: `tests/test_verify_landing.sh` landed as the 87th suite in `ed006cf` (jonas's 09:35 CEST shift) without moving this line, so `VIOLATION figure_stale 86` stood on the live tree and read as section A's **A1** and **A3**, section F's **F3/F5/F6**, and **48** of this suite's "exactly one violation" controls red — **53 reds in total, every one of them caused by a suite count and none by the code those assertions test** (the same shape the four notes above each record). Measured at the moment of the write: `regression-run --list` → **87 suite(s) discovered**, `ls tests | wc -l` → 87, `git ls-tree HEAD tests/` → 87 — all three sides agree. The run that lands the 88th suite owns the next refresh.)* *(Refreshed **87 → 89** on 2026-10-04 — a bystander refresh, the second this line has needed today: `tests/test_version_check.sh` landed as the 88th suite in `959bfda` (run 687, 16:32Z) and `tests/test_system_status_failed_units.sh` as the 89th in `eda56bd` (dispatcher shift, 16:59Z), neither moving this line, so `VIOLATION figure_stale 87` stood on the live tree and read as section A's **A1/A3**, section F's **F3/F5/F6** and 48 of this suite's exactly-one-violation controls — **53 reds in `tests/test_registry_coverage.sh` (411 passed / 53 failed), every one of them caused by a suite count and none by the code those assertions test** (the same shape each note above records). Measured at the moment of the write: `regression-run --list` → **89 suite(s) discovered**, `ls tests/test_*` → 89, `git ls-tree -r --name-only HEAD tests/` → 89 — all three sides agree. The run that lands the 90th suite owns the next refresh.)* *(Refreshed **89 → 90** on 2026-10-04 by the run that added `tests/test_system_status_ip_drift.sh`, the guard for this shift's queue item **(d)** — the `ip-drift` row of `tools/system-status`, which put the weekly `tools/ip-drift-cron` verdict on a dashboard that read neither its dated logs nor its ALERTS channel (section 7 of `tests/test_ip_drift_cron.sh` had measured the writer as the only code in `tools/` naming a live ip-drift channel). Measured at the moment of the write: `./tools/regression-run --list` → **90 suite(s) discovered**, `ls tests/test_*` → **90**; `git ls-tree -r --name-only HEAD tests/` → **89** because this suite is still untracked and reaches `HEAD` through this very commit (re-read after it lands, as every note above is), and `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for — the figure follows what `--list` discovers, not what any revision happens to hold.) *(Refreshed **90 → 92** on 2026-10-07 by the run that added `tests/test_healthcheck.sh`, the guard for `tools/healthcheck` — the only one of the 26 tools with no suite of its own (`grep -rln healthcheck tests/` → 6 files, every one a mention of some OTHER subject), written after that run repaired the answered-500 exit-code collapse (an endpoint that ANSWERED `500` was reported as `service not reachable`: exit 3, `status_code` null, `response` null). Measured at the moment of the write: `./tools/regression-run --list` → **92 suite(s) discovered**, `ls tests/test_*` → **92**, `git ls-tree -r --name-only HEAD tests/` → **91** because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for — the figure follows what `--list` discovers, not what any revision happens to hold, and the run that lands the 93rd suite owns the next refresh.)* (Refreshed **92 → 93** on 2026-10-08 by the run that added `tests/test_cache_show.sh`, the guard for `tools/cache-show` — the read-only twin of `disk-show` and the home queue item **(ax)** gave to the access-time cut `/` needed on 2026-10-08. Measured at the moment of the write: `./tools/regression-run --list` → **93 suite(s) discovered**; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the run that lands the 94th suite owns the next refresh.)* *(Refreshed **93 → 94** on 2026-10-09 by the run that added `tests/test_tmp_lock.sh`, the guard for `tools/tmp-lock` — the mutex queue item **(ag)** built so two desks never cut the same `/tmp/opencode` prune list at the same instant. Measured at the moment of the write: `./tools/regression-run --list` → **94 suite(s) discovered**, `ls tests/test_*` → 94, `git ls-tree -r --name-only HEAD tests/` → 93 because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for — the figure follows what `--list` discovers, not what any revision happens to hold, and the run that lands the 95th suite owns the next refresh.)* *(Refreshed **94 → 95** on 2026-10-09 by the run that added `tests/test_monitor_cascade.sh`, the guard for queue item **(r1b)** — the system-status cascade half: one `failed-units` root cause must cost one family red (the derived `sysverdict` probe + A30's row), not the six A12/A13/A16/A17/A18/A30 reds five encodings of one claim produced. Measured at the moment of the write: `./tools/regression-run --list` → **95 suite(s) discovered**, `ls tests/test_*` → 95, `git ls-tree -r --name-only HEAD tests/` → 94 because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for — the figure follows what `--list` discovers, not what any revision happens to hold, and the run that lands the 96th suite owns the next refresh.)* *(Refreshed **95 → 96** on 2026-10-10 by the run that added `tests/test_go_compile_drift_verify.sh` — the guard for `tools/go-compile-drift-verify`, measured before this line moved as the last registered tool with no suite of its own (`grep -rln go-compile-drift-verify tests/` → 2 files, both naming it in passing). Measured at the moment of the write: `./tools/regression-run --list` → **96 suite(s) discovered**, `ls tests/test_*` → 96, `git ls-tree -r --name-only HEAD tests/` → 95 because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for — the figure follows what `--list` discovers, not what any revision happens to hold, and the run that lands the 97th suite owns the next refresh.)* *(Refreshed **96 → 97** on 2026-10-10 by the run that added `tests/test_report_demo.sh` — the reader for `REPORT.md` §11's demo block, which no suite read (`grep -rln demo tests/` → nothing): it extracts the `**5-minute getting started**:` fence verbatim, runs its nine commands line by line in a sandbox with its own `HOME`, pins the byte figure and the step line §11 quotes plus the `/investor` URL claim, keeps the three `[0.4.285]` controls green (nameless step refused, missing-file push failed, nothing written outside the sandbox), and replays a planted PRE-FIX §11 out of tree — **21 failed / 46 passed, exit 1** — so a green run proves the guard would reddens rather than that it finishes. Measured at the moment of the write: `./tools/regression-run --list` → **97 suite(s) discovered**, `ls tests/test_*` → 97, `git ls-tree -r --name-only HEAD tests/` → 96 because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for — the figure follows what `--list` discovers, and the run that lands the 98th suite owns the next refresh.)* *(Refreshed **97 → 98** on 2026-10-10 by the run that added `tests/test_getting_started.sh` — the reader for `GETTING-STARTED.md`, the guide the public `/start` page serves: running its own fences verbatim in a fresh workspace had **9 of 34 runnable commands exit non-zero** (the pushes read files a fresh workspace does not have, which then took `context pull` and both `workflow run`s down with them), so the guide now seeds its own sample files and this suite executes every fence — 98 passed / 0 failed, with the pre-fix guide as its negative control (≥5 non-zero exits and the `failed to read ./src/**/*.go` payload) and the install/`serve`/`mcp` fences classified EXCLUDED rather than started. Measured at the moment of the write: `./tools/regression-run --list` → **98 suite(s) discovered**, `ls tests/test_*` → 98, `git ls-tree -r --name-only HEAD tests/` → 97 because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for — the figure follows what `--list` discovers, and the run that lands the 99th suite owns the next refresh.)* *(Refreshed **98 → 99** on 2026-10-10 by the run that added `tests/test_readme_fences.sh` — the reader for `README.md`, the third instance of the class `[0.4.285]`/`[0.4.286]` closed for `REPORT.md` §11 and `[0.4.287]` for `GETTING-STARTED.md`: the repository's front door was the one document none of the three reading suites executed (`grep -rln README tests/` → three files before this run, all passing mentions: `test_cli_version.php`, `test_repo_lint.sh`, `test_report_demo.sh`). Extracting its eight bash fences verbatim and running them in a fresh workspace made **8 of its 29 runnable commands exit non-zero** and left **4 lines unclassified**, and the four were the interesting ones — `gladex context pull`'s *illustrative output* pasted into the "Complete Workflow" fence as live shell (`// file: src/api/server.go`, `package main`, `...`, `// Just the content, no header/footer`), which a pasting reader runs as shell: twice `//: Is a directory` (126), twice `command not found` (127) — beside the two `context push`es that read files a fresh workspace does not have (`./src/**/*.ts`, `./src/api/*.go`) and the inline "Workflow Execution" definition still on the legacy flat step schema, which `workflow create` refuses with `invalid workflow (7 problems)`. The README now seeds both file pushes (a plain shell has no `globstar`, so the sample sits where `./src/**/*.ts` actually matches), comments that output instead of running it, and writes the current per-step `name`/`config` schema behind `--allow-shell`; the suite is green at **135 passed / 0 failed, exit 0, ~2.3 s**, with the pre-fix README as its negative control (**8 of 29 non-zero, 4 UNCLASSIFIED**, payloads `failed to read ./src/**/*.ts`, `failed to read ./src/api/*.go`, `invalid workflow`, `context 'backend' not found`) and a behavioural control for the flag (the definition README writes, run without `--allow-shell` → exit 1 `shell step requires --allow-shell flag`, then with it → exit 0). Measured at the moment of the write: `./tools/regression-run --list` → **99 suite(s) discovered**, `ls tests/test_*` → 99, `git ls-tree -r --name-only HEAD tests/` → 98 because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for — the figure follows what `--list` discovers, not what any revision happens to hold, and the run that lands the 100th suite owns the next refresh.)**(Refreshed **99 → 100** on 2026-10-11 as a bystander, the third this line has needed: `tests/test_build_sh.sh` landed in `4c1c6ee` (leon shift, 08:27 CEST) without moving this line, so `VIOLATION figure_stale 99` stood on the live tree and read as section A's A1/A3, section F's F3/F5/F6 and 51 of this suite's exactly-one-violation controls — **53 reds (411 passed / 53 failed)**, every one of them caused by a suite count and none by the code those assertions test (the same shape each note above records, and measured as pre-existing at the parent commit `4038cb7` before this run's own change was committed). Measured at the moment of the write: `./tools/regression-run --list` → **100 suite(s) discovered**, `ls tests/test_*` → **100**, `git ls-tree -r --name-only HEAD tests/` → **100** — all three sides agree; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the run that lands the 101st suite owns the next refresh.)* *(Refreshed **100 → 102** on 2026-10-12 by the run that added `tests/test_download_colours.php` — run 910's queued colour-fidelity suite for `/download`, the Medium finding of `VERDICT-20261012T071910Z-download-php-design-system-deploy.md`. TWO suites landed without moving this line: `tests/test_download_counter.php` (run 912, the 101st, whose entry records no refresh) and this one (the 102nd), so `figure_stale 100` stood on the live tree and read as section A's A1/A3, section F's F3/F5/F6 and this suite's exactly-one-violation controls (C32h measured `want=1 got=2` at 10:47 CEST) — every one of them caused by a suite count and none by the code those assertions test. Measured at the moment of the write: `./tools/regression-run --list` → **102 discovered**, `ls tests/test_*` → **102**, `git ls-tree -r --name-only HEAD tests/` → **101** because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for — the figure follows what `--list` discovers, not what any revision happens to hold, and the run that lands the 103rd suite owns the next refresh.)* *(Refreshed **102 → 103** on 2026-10-12 by the run that added `tests/test_download_stats.sh` — the guard for `tools/download-stats`, the read-only summariser over `<env>/logs/downloads.log` that `[0.4.313]`'s counter writes, taken from run 912's queue as this run's step. Measured at the moment of the write: `./tools/regression-run --list` → **103 suite(s) discovered**, `ls tests/test_*` → **103**, `git ls-tree -r --name-only HEAD tests/` → **102** because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for — the figure follows what `--list` discovers, not what any revision happens to hold, and the run that lands the 104th suite owns the next refresh.)* *(Refreshed **103 → 104** on 2026-10-12 by the run that added `tests/test_shift_tally.sh` — the guard for `tools/shift-tally`, the dedicated `tests/` follow-up the tool's own registry section and CHANGELOG `[0.4.318]` both named as deliberate, taken from run 919's queue. Measured at the moment of the write: `./tools/regression-run --list` → **104 suite(s) discovered**, `ls tests | wc -l` → **104**, `git ls-tree -r --name-only HEAD tests/` → **103** because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for — the figure follows what `--list` discovers, not what any revision happens to hold, and the run that lands the 105th suite owns the next refresh.)*(Refreshed **104 → 105** on 2026-10-12 by the run that added `tests/test_live_version_consistency.php` — the guard for the LIVE half of the version-train invariant (`test_app_version.php` covers the static side): it parses the changelog's first `## [x.y.z]` heading and asserts every HTTP surface on dev (:8000) and prod (:8001) — `/healthz`, `/api/version`, the `/docs` footer and the first `/api/changelog` entry — reports exactly it, plus a mutation layer (a tampered payload is detected, the comparator is not vacuous). It exists because the 2026-10-05 investor correction ("production is 0.4.28, not 0.4.29") showed the confusion class: the newest APPENDED heading is not the train. Measured at the moment of the write: `./tools/regression-run --list` → **105 suite(s) discovered**, `ls tests | wc -l` → **105**, `git ls-tree -r --name-only HEAD tests/` → **104** because this suite is untracked until this commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for — the figure follows what `--list` discovers, not what any revision happens to hold, and the run that lands the 106th suite owns the next refresh.)* *(Bystander repair, 2026-10-12: the refresh above for the 105th suite was appended as a trailing note on this line but never moved the claim position, so the checker read `figure_stale 104` against the 105 `test_*` files `regression-run --list` discovers and reddened 25 controls of `tests/test_registry_coverage.sh` — measured pre-existing at `HEAD`, the repairing run’s diff carrying neither this file nor a new suite, so nothing here was caused by it. The claim position now says what the note appended to it already said; the 106th suite owns the next refresh as before.)* *(Refreshed **105 → 106** on 2026-10-13 by the run that added `tests/test_deploy_ledger.sh` — the guard for run 933's `deploy-path recurrence` queue line: the LIVE `promote-dev-to-prod --ledger-check` assertion over the real /opt/startup trees plus sandbox controls replaying the 2026-10-13 direct-copy incident. Measured at the moment of the write: `./tools/regression-run --list` → **106 suite(s) discovered**, `ls tests/test_*` → **106**, `git ls-tree -r --name-only HEAD tests/` → **105** because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the run that lands the 107th suite owns the next refresh.)* *(Refreshed **107 → 108** on 2026-10-13 by the run that added `tests/test_shift_census.sh` — the guard for `tools/shift-census`, the durable post-fire census (failed set + in-flight probe + per-unit class) that run 936 queued with two requirements of its own: the transcript-never-journal SOURCE DECISION and the IN-FLIGHT GUARD, so an empty failed set with a shift running reads `in-flight` (exit 4) instead of the measured 8 m 17 s false-green. Measured at the moment of the write: `./tools/regression-run --list` → **108 suite(s) discovered**, `ls tests/test_*` → **108**, `git ls-tree -r --name-only HEAD tests/` → **107** because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the run that lands the 109th suite owns the next refresh.)* *(Refreshed **108 → 109** on 2026-10-14 by the run that added `tests/test_registry_figure_readers.sh`, the 109th suite — the cross-suite REGISTRY assertion-figure reader carrying run 931's recovered line, with its own `## test_registry_figure_readers.sh` section added in the same commit; the census it prints (`17 figure sections, 1 read` before its own section landed) is REPORTED, never pinned, so this refresh is the only suite-count claim this run moves. Measured at the moment of the write: `./tools/regression-run --list` → **109 suite(s) discovered**, `ls tests/test_*` → **109**, `git ls-tree -r --name-only HEAD tests/` → **108** because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the run that lands the 110th suite owns the next refresh.)* *(Bystander refresh **109 → 110**, 2026-10-14, run 952: `tests/test_info_contrast.php` — the 110th suite, a `/info` WCAG-contrast guard — landed in `114086d` (08:17 CEST) without moving the claim above, so `VIOLATION figure_stale 109` stood on the live tree and read as section A's **A1/A3**, section F's **F3/F5/F6** and this suite's exactly-one-violation controls (**C1e** measured `want=1 got=2`); measured **pre-existing at this run's start commit `2bb572e`**, whose `tests/` already held **110** `test_*` files against this line's **109**, so nothing here was caused by the run that repaired it (the same shape each note above records, and the same attribution question they each answered). Measured at the moment of the write: `./tools/regression-run --list` → **110 suite(s) discovered**, `ls tests/test_*` → **110**, `git ls-tree -r --name-only HEAD tests/` → **110** — all three sides agree; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the run that lands the 111th suite owns the next refresh.)* *(Refreshed **110 → 111** on 2026-10-14 by run 954 as a **bystander refresh** — the third this line has needed: `tests/test_landing_contrast.php`, the 111th suite (a `/landing` WCAG-contrast guard), landed in `4a61dce` at 13:18 CEST without moving this line while run 954 was mid-verification, so `VIOLATION figure_stale 110` stood on the live tree and read as **32 reds in `tests/test_registry_coverage.sh` (465 passed / 32 failed)** — every one a family-C exactly-N-violation control reporting one violation more than it planted, none caused by the code those assertions test. Measured **pre-existing at this run's start commit `6b9721f`**: its `tests/` held **110** `test_*` files against this line's **110** (run 953 recorded `497 / 0` there), so nothing here was caused by the run that repaired it. Measured at the moment of the write: `./tools/regression-run --list` → **111 suite(s) discovered**, `ls tests/test_*` → **111**, `git ls-tree -r --name-only HEAD tests/` → **111** — all three sides agree; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the run that lands the 112th suite owns the next refresh.)* *(Refreshed **111 → 114** on 2026-10-14 by run 959 — **three suites landed without moving this line**: `tests/test_download_contrast.php` (the 112nd, `/download` colour-fidelity + the version-badge contrast fix, `b460155`), `tests/test_version_correction.php` (the 113rd, the version-correction regression test, `6895a58`) and `tests/test_attribution_gap.sh` (the 114th, run 959's own suite, which reached HEAD through a concurrent identity's `git add -A` safety-net sweep at `c2ee73f` while its tool reached it at `ee266f7` — the same mid-run sweep class the 85 → 86 note records), so `VIOLATION figure_stale 111` stood on the live tree until this refresh. Measured at the moment of the write: `./tools/regression-run --list` → **114 suite(s) discovered**, `ls tests/test_*` → **114**, `git ls-tree -r --name-only HEAD tests/` → **114** — all three sides agree; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the run that lands the 115th suite owns the next refresh.)* *(Refreshed **114 → 115** on 2026-10-15 by the run that added `tests/test_coverage_guard.sh`, the 115th suite — the hermetic guard for `tools/coverage-guard`, run 963's re-queued trend guard (`[0.4.353]`), whose `## coverage-guard` and `## test_coverage_guard.sh` sections landed in the same commit. Measured at the moment of the write: `./tools/regression-run --list` → **115 suite(s) discovered**, `ls tests/test_*` → **115**, `git ls-tree -r --name-only HEAD tests/` → **114** because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the run that lands the 116th suite owns the next refresh.)* *(Refreshed **115 → 116** on 2026-10-15 by the run that added `tests/test_baseline_stale.sh`, the 116th suite — the hermetic guard for `tools/baseline-stale`, run 964's re-queued baseline reader (`[0.4.353]`), whose `## baseline-stale` and `## test_baseline_stale.sh` sections landed in the same commit. Measured at the moment of the write: `./tools/regression-run --list` → **116 suite(s) discovered**, `ls tests/test_*` → **116**, `git ls-tree -r --name-only HEAD tests/` → **115** because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the run that lands the 117th suite owns the next refresh.)* *(Refreshed **116 → 117** on 2026-10-15 by the run that added `tests/test_system_status_baseline_stale.sh` (at the moment of this first write the 117th, renumbered the 119th by the `117 → 119` refresh below) — the guard for the `baseline-stale` row of `tools/system-status` (run 964's re-queued row, `[0.4.355]`), whose `## system-status` bullet, hook entry, Tests bullet and `## test_system_status_baseline_stale.sh` section landed in the same commit. Measured at the moment of the write: `./tools/regression-run --list` → **117 suite(s) discovered**, `ls tests/test_*` → **117**, `git ls-tree -r --name-only HEAD tests/` → **116** because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for; superseded minutes later by the `117 → 119` refresh below, which re-measured the same tree.)* *(Refreshed **117 → 119** on 2026-10-15 — a **bystander-plus-own refresh**: `tests/test_gladex_binary.sh` (the 118th suite, a binary smoke test, `7807966`) landed from a concurrent Leon shift mid-run without moving this line, and `tests/test_system_status_baseline_stale.sh` (the 119th, this run's suite) is untracked, so `VIOLATION figure_stale 117` stood on the live tree and read as section F's F3 (`want=118 got=117` at the moment the batch measured it), F5, F6 and this suite's exactly-one-violation controls (`C7d` etc. measured `want=1 got=2`) — **56 reds in `tests/test_registry_coverage.sh` (441 passed / 56 failed)**, every one of them caused by a suite count and none by the code those assertions test (the same shape each note above records). Measured at the moment of the write: `./tools/regression-run --list` → **119 suite(s) discovered**, `ls tests/test_*` → 119, `git ls-tree -r --name-only HEAD tests/` → 118 because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the run that lands the 120th suite owns the next refresh.)* *(Refreshed **119 → 120** on 2026-10-15 by the run that added `tests/test_system_status_coverage_guard.sh`, the 120th suite — the guard for the `coverage-guard` row of `tools/system-status` (run 967's re-queued finding, `[0.4.357]`), whose `## system-status` bullet, hook entry, Tests bullet and `## test_system_status_coverage_guard.sh` section landed in the same commit. Measured at the moment of the write: `./tools/regression-run --list` → **120 suite(s) discovered**, `ls tests/test_*` → 120, `git ls-tree -r --name-only HEAD tests/` → 119 because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the run that lands the 121st suite owns the next refresh.)* *(Refreshed **120 → 121** on 2026-10-15 by the run that added `tests/test_cross_reader_agreement.sh`, the 121st suite — the cross-reader agreement guard for run 968's re-queued line (one child reading must yield the same count and the same identity list on the `system-status` row and in `red-watch`), whose own `## test_cross_reader_agreement.sh` section landed in the same commit. Measured at the moment of the write: `./tools/regression-run --list` → **121 suite(s) discovered**, `ls tests/test_*` → **121**, `git ls-tree -r --name-only HEAD tests/` → **120** because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the run that lands the 122nd suite owns the next refresh.)* *(Bystander refresh **121 → 122**, 2026-10-15, run 970: `tests/test_docs_contrast.php` — the 122nd suite, a `/docs` WCAG-contrast guard — landed in `49b22cf` (18:21 CEST) without moving the claim above, so `VIOLATION figure_stale 121` stood on the live tree and read as section F's **F3** (`want=122 got=121`), **F5**, **F6**, **C39d** and every exactly-N-violation control that counts live violations — **55 reds in `tests/test_registry_coverage.sh` (442 passed / 55 failed)**, every one of them caused by a suite count and none by the code those assertions test (the same shape each note above records). Measured **pre-existing at this run's start commit**: its `tests/` already held **122** `test_*` files against this line's **121**, so nothing here was caused by the run that repaired it. Measured at the moment of the write: `./tools/regression-run --list` → **122 suite(s) discovered**, `ls tests/test_*` → **122**, `git ls-tree -r --name-only HEAD tests/` → **122** — all three sides agree; `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the run that lands the 123rd suite owns the next refresh.)* *(Refreshed **122 → 123** on 2026-10-16 by the run that added `tests/test_tmp_sweep.sh`, the 123rd suite — the hermetic guard for `tools/tmp-sweep`, run 977's queued durable half of the hand sweep (“a periodic age-based /tmp sweep … so a SIGKILL orphan cannot pile up for days again”), whose own `## tmp-sweep` and `## test_tmp_sweep.sh` sections landed in the same commit. Measured at the moment of the write: `./tools/regression-run --list` → **123 suite(s) discovered**, `ls tests/test_*` → 123, `git ls-tree -r --name-only HEAD tests/` → 122 because this suite is untracked until its commit lands (re-read after it lands, as every note above is); `tests/test_registry_coverage.sh` section F is the reader this line is refreshed for, and the run that lands the 124th suite owns the next refresh.)*
9718:## tmp-sweep
9733:**Location**: `/data/repo/tools/tmp-sweep` (extensionless, python3 shebang →
9738:tmp-sweep [--format {json,human}] [--age-hours HOURS] [--apply]
9865:**Purpose**: the hermetic guard for `tools/tmp-sweep` — the durable half of
9904:GLADEX_TMP_SWEEP_TOOL=/path/to/tmp-sweep bash tests/test_tmp_sweep.sh
9912:- `GLADEX_TMP_SWEEP_TOOL` - the `tmp-sweep` copy under test (mutant runs point it at a planted copy; default `<repo>/tools/tmp-sweep`)
9929:`## tmp-sweep` lands in that same commit.
$ ls /data/repo/mailboxes/main-to-reviewer/ | tail -5; echo ---; ls /data/repo/mailboxes/reviewer-to-main/ | tail -5; echo ---; cd /data/repo && git remote -v
REVIEW-20261015T162500Z-download-templates-deploy.md
REVIEW-20261015T205000Z-hire-agent-screen-rule.md
REVIEW-20261015T222317Z-build-sh-scratch-root.md
REVIEW-20261016T090000Z-tmp-sweep.md
REVIEW-20261016T130000Z-tmp-sweep-protected-cache.md
---
VERDICT-20261015T164500Z-download-templates-deploy-r2.md
VERDICT-20261015T205000Z-hire-agent-screen-rule.md
VERDICT-20261015T222317Z-build-sh-scratch-root.md
VERDICT-20261016T090000Z-tmp-sweep.md
VERDICT-20261016T130000Z-tmp-sweep-protected-cache.md
---
origin	git://git.gladex.de/gladex.git (fetch)
origin	git://git.gladex.de/gladex.git (push)
> build · mimo-v2.6-flash-free
Survey complete. This run's step is the queue's designated next candidate: **run 977's item (b) — the system-scope timer wiring for `tools/tmp-sweep`, dry-run-first**. The mia/sofia repin stays blocked (newest investor rows in both DBs are my own replies, dev 147 / prod 112).
$ cd /data/repo && ./tools/tmp-sweep --format json | wc -l; ./tools/tmp-sweep --format json | wc -c
1
78864
> build · mimo-v2.6-flash-free
One line of JSON, ~79 KB — fine for an append-only JSONL ledger like the `promote-ledger.jsonl` precedent. Building the two units now, dry-run-first as the queue mandates.
← Write /etc/systemd/system/tmp-sweep.service
Created file successfully: /etc/systemd/system/tmp-sweep.service
← Write /etc/systemd/system/tmp-sweep.timer
Created file successfully: /etc/systemd/system/tmp-sweep.timer
> build · mimo-v2.6-flash-free
$ systemctl daemon-reload && systemctl enable --now tmp-sweep.timer && systemctl start tmp-sweep.service; echo "start-rc=$?"; systemctl is-active tmp-sweep.timer; systemctl list-timers tmp-sweep.timer --no-pager
Created symlink /etc/systemd/system/timers.target.wants/tmp-sweep.timer → /etc/systemd/system/tmp-sweep.timer.
start-rc=0
active
NEXT                         LEFT LAST PASSED UNIT            ACTIVATES
Sat 2026-10-17 00:00:34 CEST  18h -         - tmp-sweep.timer tmp-sweep.service

1 timers listed.
Pass --all to see loaded but inactive timers, too.
> build · mimo-v2.6-flash-free
Timer active, service ran green once. Verifying the log line it produced and that it removed nothing.
$ ls -A /tmp/opencode | wc -l; ls /tmp/gopath >/dev/null 2>&1 && echo "gopath still present (good)"; systemctl status tmp-sweep.service --no-pager -n0 | head -6
60
gopath still present (good)
○ tmp-sweep.service - Dry-run plan of tools/tmp-sweep (age-gated /tmp orphan sweeper)
     Loaded: loaded (/etc/systemd/system/tmp-sweep.service; static)
     Active: inactive (dead) since Fri 2026-10-16 05:19:19 CEST; 10s ago
TriggeredBy: ● tmp-sweep.timer
       Docs: file:///data/repo/tools/REGISTRY.md
    Process: 3281606 ExecStart=/data/repo/tools/tmp-sweep --format json (code=exited, status=0/SUCCESS)
$ wc -l /data/agent-logs/tmp-sweep-plans.jsonl; tail -1 /data/agent-logs/tmp-sweep-plans.jsonl | python3 -c "import json,sys; d=json.load(sys.stdin); print('mode:', d['mode'], '| ok:', d['ok'], '| candidates:', len(d['candidates']), '| roots:', d['roots'], '| age_hours:', d['age_hours'])"
1 /data/agent-logs/tmp-sweep-plans.jsonl
mode: dry-run | ok: True | candidates: 724 | roots: ['/tmp/opencode', '/tmp'] | age_hours: 24.0
> build · mimo-v2.6-flash-free
Service green: exit 0, one valid JSON line, `mode: dry-run`, 724 candidates planned, **nothing removed** (`/tmp/opencode` still 60 entries, `gopath` still present). Now the reviewer gate the queue requires for this system-scope step.
← Write repo/mailboxes/main-to-reviewer/REVIEW-20261016T052000Z-tmp-sweep-timer.md
Created file successfully: repo/mailboxes/main-to-reviewer/REVIEW-20261016T052000Z-tmp-sweep-timer.md
> build · mimo-v2.6-flash-free
✓ Review tmp-sweep timer wiring Reviewer Agent
> build · mimo-v2.6-flash-free
The reviewer ran out of steps mid-verification. Continuing the same reviewer session to finish checks 3–8 and write the verdict.
✓ Finish review checks 3-8 Reviewer Agent
> build · mimo-v2.6-flash-free
Reviewer verified checks 1–3 (PASS, with its own measurements: 60 entries unchanged, gopath present, 2 valid dry-run JSON lines). Checks 4–7 remain. I'll update `STRUCTURE.md` first so check 4 has something to verify, then send the reviewer one final compact continuation.
← Edit repo/STRUCTURE.md
Index: repo/STRUCTURE.md
===================================================================
--- repo/STRUCTURE.md
+++ repo/STRUCTURE.md
@@ -162,9 +162,17 @@
 | `git-daemon.service` | Persistent | Git remote on :9418 | ✅ |
 | `identity-run@.service` | oneshot (template) | Runs one persona shift via `/usr/local/sbin/identity-run.sh` | ✅ 2026-09-23 |
 | `identity-run@{lena,jonas,mia,leon,aylin,dispatcher,sofia}.timer` | 3x daily (08/13/18 `:50`+`RandomizedDelaySec=90`, `Persistent=true`) | Triggers each persona shift | ✅ 2026-09-23 (sofia added 2026-09-29) |
 | `public-redirect.service` | Disabled | ~~nft: 80→8000, 443→8001~~ superseded by Apache | ❌ retired |
+| `tmp-sweep.service` | On-demand (oneshot) | Runs `tools/tmp-sweep --format json` (**dry-run, no `--apply`**) → appends one JSON line to `/data/agent-logs/tmp-sweep-plans.jsonl` | ✅ 2026-10-16 (run 977's item (b), dry-run-first) |
+| `tmp-sweep.timer` | Daily (`OnCalendar=daily`, `RandomizedDelaySec=1800`, `Persistent=true`) | Triggers the dry-run sweep plan | ✅ 2026-10-16 — enabled |
 
+**tmp-sweep timer design note (run 980):** the service is deliberately **dry-run-only** —
+ExecStart omits `--apply` so a scheduled run can only print a plan, never remove anything;
+switching the timer to `--apply` is a separate, reviewer-gated step and must not be done
+without one. The JSONL grows ~79 KB/day (~29 MB/yr) and has no rotation yet (queued).
+Unit files are system-scope (in `/etc/systemd/system/`, not in git) per §8.
+
 **Note**: agent-loop-watchdog is a safety net only. Primary work happens in agent runs.
 Never disable it — it catches silent stalls. Record in STRUCTURE.md, do not modify.
 
 ## Scheduled Personas (identity-run, live since 2026-09-23)

> build · mimo-v2.6-flash-free
→ Read repo/STRUCTURE.md [limit=15, offset=425]
> build · mimo-v2.6-flash-free
`STRUCTURE.md` updated (the port table at line 425+ is network services — tmp-sweep has no port, so only the systemd table gets the rows). Sending the reviewer the final compact continuation.
✓ Complete verdict checks 4-7 Reviewer Agent
> build · mimo-v2.6-flash-free
→ Read repo/mailboxes/reviewer-to-main/VERDICT-20261016T052000Z-tmp-sweep-timer.md 
> build · mimo-v2.6-flash-free
VERDICT: APPROVE with all 8 checks re-measured. Now the pre-commit checks, then the PROGRESS entry (appended BEFORE the commit, per close protocol).
$ cd /data/repo && ./tools/inbox-status; echo "rc=$?"; ./tools/version-check; ./tools/queue-source-check 2>&1 | head -3
inbox-status — STEP 0 investor duty

  messages unread : dev 0 / prod 0 / total 0
  last reply      : dev 147 / prod 112
  INBOX.md        : 80 entries, 80 handled, 0 open

verdict: OK - nothing owed (0 unread, 0 open entries all replied)
rc=0
OK: dev=0.4.28 prod=0.4.28 (match)
queue-source-check: OK - one queue: [0.4.364] pointer-only, 111 item line(s) frozen across 318 section(s), 203 PROGRESS bullet(s), 2 path token(s)
$ cd /data/repo && bash tests/test_gladex_monitor.sh 2>&1 | tail -15
(no output)

Command exceeded timeout of 120000 ms. Retry with a larger timeout if the command is expected to take longer.
> build · mimo-v2.6-flash-free
The monitor suite needs longer than 120s — running it in the background while I write the PROGRESS entry.
$ cd /data/repo && bash tests/test_gladex_monitor.sh > /tmp/opencode/monitor-run980.out 2>&1; echo "rc=$?" >> /tmp/opencode/monitor-run980.out
Command moved to the background (shell ID: sh_142c1d29d001B2Bxp5pYRwQKFl).
Output is streaming to: /root/.local/share/opencode/shell/fa3e85b2145a60c127b5c9261e76a7ba6d520299/sh_142c1d29d001B2Bxp5pYRwQKFl.out
> build · mimo-v2.6-flash-free
While the monitor runs, writing the PROGRESS entry — appended BEFORE the commit per close protocol. This run adds no CHANGELOG heading (system-scope units + docs, same precedent as run 977), so R8's newest heading stays `[0.4.364]` and I name it in the entry.
$ cd /data/repo && tail -c 300 agent-logs/PROGRESS.md | cat -A | tail -3
git rev-list --count origin/main..main` M-bM-^FM-^R **0**. **No `/tmp` file was removed by this run at any point** M-bM-^@M-^T every live invocation of the tool, its own and the suite's H9/H10, was a dry-run, and every `--apply` carried a fixture root. Spend **0.00**, free `*-free` models only; the run stops here.$
> build · mimo-v2.6-flash-free
$ cd /data/repo && cat >> agent-logs/PROGRESS.md <<'EOF'

## Builder — run 980 — **run 977's item (b) lands as the system-scope half: `tmp-sweep.timer` (daily, `OnCalendar=daily` + `RandomizedDelaySec=1800` + `Persistent=true`, enabled) triggers `tmp-sweep.service` (oneshot, `Nice=10`, `IOSchedulingClass=idle`, `NoNewPrivileges=yes`) which runs `tools/tmp-sweep --format json` WITHOUT `--apply` — dry-run-first exactly as run 979's queue prescribed, appending one JSON line per fire to `/data/agent-logs/tmp-sweep-plans.jsonl` (2 valid `mode: dry-run` lines measured, `/tmp/opencode` 60 entries and `/tmp/gopath` untouched by both fires) — reviewer VERDICT APPROVE (8/8 re-measured): 0 unread at STEP 0, no repo tool/tests/app file touched, no promote, dev+prod at 0.4.28**

- **STEP 0, paid first and re-read at the close — owed nothing, no row written.** `SELECT COUNT(*) … WHERE direction='investor_to_agent' AND read=0` → **0 dev / 0 prod** at orientation; `./tools/inbox-status` → **rc 0**, `OK - nothing owed (0 unread, 0 open entries all replied)`, last reply **dev 147 / prod 112**; `INBOX.md` → **80 entries / 80 handled / 0 open**. Re-read specifically for an answer to run 971's repin ask (dev 147 / prod 112): the newest row in each DB is **my own reply** (`agent_to_investor`, id dev 147 / prod 112) — **the mia/sofia model repin is still unanswered**, so **A12/A30 stay standing and blocked on the investor** exactly as queued and `identity-run.sh` stays untouched. **Production is 0.4.28** (the investor's 2026-10-05 correction stands, the wrong figure quoted nowhere): `./tools/version-check` → `OK: dev=0.4.28 prod=0.4.28 (match)`; `./tools/budget-show` → **2026-10, allowance 5.00 / spent 0.00 / remaining 5.00**; `/healthz` → **200 on :8000 and :8001**; `hiring/queue/` → **2 files, both `status: "proposed"`** — items **(93)**/**(97)(a)** remain investor-gated. Spend **0.00**, free `*-free` models only, no key configured, **no secret or PII in any prompt, file or commit**.

- **Queue read, and the step taken: run 977's item (b), the system-scope timer wiring — the exact next candidate run 979's close named as "now SAFE to take".** The TOP queue item (mia/sofia repin) was re-read first and is still BLOCKED-ON-INVESTOR, so it was not taken. The timer went live **dry-run-first**, as the queue mandated: the service's `ExecStart=/data/repo/tools/tmp-sweep --format json` carries **no `--apply`**, so a scheduled fire can only print a plan — switching the timer to `--apply` is a **separate, reviewer-gated later step** and must not be done without one (the unit file says so in its own comment).

- **The wiring, and its measured proof (2026-10-16).** Two system-scope unit files (in `/etc/systemd/system/`, not in git, per §8): `tmp-sweep.service` (`Type=oneshot`, `StandardOutput=append:/data/agent-logs/tmp-sweep-plans.jsonl`, `StandardError=journal`, `Nice=10`, `IOSchedulingClass=idle`, `NoNewPrivileges=yes`) and `tmp-sweep.timer` (`OnCalendar=daily`, `RandomizedDelaySec=1800`, `Persistent=true`, `WantedBy=timers.target`). `systemctl daemon-reload && enable --now` → symlink created, `is-active` → **active**, `list-timers` → first fire **Sat 2026-10-17 00:00:34 CEST**. Manual first fire: **exit 0/SUCCESS**; the log file holds **2 valid JSON lines** (mine + the reviewer's own verification fire), each parsed as `mode: dry-run, ok: True, candidates: ~724, roots: ['/tmp/opencode','/tmp'], age_hours: 24.0`. **Nothing removed by either fire**: `/tmp/opencode` **60 entries before and after**, `/tmp/gopath` (the `protected-cache` entry) **still present**. `systemctl --failed` → the same two investor-gated units (mia + sofia) before and after — **no new failed unit**.

- **Reviewer gate, run and passed (three sessions — the reviewer agent hit its step limit twice mid-verification and was continued, never restarted from zero, so checks 1–3 carry the first session's own measurements and 4–8 the final one's).** Request `mailboxes/main-to-reviewer/REVIEW-20261016T052000Z-tmp-sweep-timer.md`; verdict `mailboxes/reviewer-to-main/VERDICT-20261016T052000Z-tmp-sweep-timer.md` → **`VERDICT: APPROVE`**, 8/8: ExecStart no `--apply` (read directly), timer enabled/active with the 2026-10-17 fire, two valid dry-run JSON lines with `/tmp/opencode` unchanged and `gopath` present, `STRUCTURE.md` rows + design note matching the units on disk, `git status` in-scope only, inbox-status rc 0 / version-check 0.4.28 / healthz 200+200, `systemctl --failed` = mia + sofia only. Residual notes recorded, none blocking: the JSONL has **no rotation yet** (~79 KB/day ≈ 29 MB/yr, queued), the `ismount`-in-`measure()` check stays queued **with the future `--apply` step** (the dry-run timer does not need it to be safe), and the timer must not be switched to `--apply` without a reviewer gate.

- **Scope and safety, one line each:** this run's commit carries **exactly four files — `STRUCTURE.md` (systemd table rows + design note), this file, and the REVIEW request + VERDICT above** — staged by **explicit pathspec** read from `git status --porcelain` immediately before staging, **never `git add -A`** on this shared index; the unit files themselves are system-scope in `/etc/systemd/system/` and are **not in git** (§8), with `STRUCTURE.md` carrying their design; **no file under `tools/`, `tests/`, `app/`, `hiring/queue/`, `app/src/php` or `examples/workflows` was touched** → **no promote needed and none taken**, dev and prod untouched at **0.4.28**; **no live `/tmp` file removed at any point** (the tool's scheduled and manual runs were dry-runs by construction — no `--apply` exists in the unit); **no `systemctl` change beyond the two new units** — no `reset-failed`, no restart of any existing unit, mia's and sofia's failed units left standing on purpose; **no live messages-DB write** (STEP 0 owed nothing → no `agent_to_investor` row, nothing marked read); no DNS write, no mail sent, no paid API, no API key configured; **`/usr/local/sbin/identity-run.sh` untouched**; **`hiring/queue/` read-only**; **never `git stash`** in this tree (run 959's measured loss); spend **0.00**, free `*-free` models only.

- **Queue — next small step (read this first):** **STEP 0 first every run** (today **0 unread dev / 0 prod**, `INBOX.md` **80/80/0 open**). **TOP, still BLOCKED-ON-INVESTOR and unchanged: the mia/sofia model repin** — re-read the investor's reply to **dev 147 / prod 112** first; if they pick an option, the run that picks it up edits **only** the two `MODEL=` lines in `/usr/local/sbin/identity-run.sh` (mia, sofia), then re-reads `systemctl --failed` → **empty** and monitor **A12/A30 cleared** on the units' own first green fire (never a `reset-failed` from this desk); if they do not answer, the two reds stay standing and the queue line must **not** revert to the stale 504 wording. **ITEM (b) IS NOW FULLY DISCHARGED: both halves landed** — the tools/ half (run 978) and the system-scope half (this run, dry-run-first). **NEXT CANDIDATE: read `/data/agent-logs/tmp-sweep-plans.jsonl` after a few timer fires (first scheduled fire 2026-10-17 00:00 CEST) and then decide, in its own reviewer-gated step, whether to switch the timer to `--apply`** — the decision must re-read the JSONL's candidate lists first (never switch blind), carry the queued `ismount`-in-`measure()` fix with it, and keep `/tmp/gopath` (`protected-cache`) and a live concurrent run's fresh files out of any apply. **Also still open, unchanged:** run 977's item **(a)** — the regenerable Go caches in `/tmp` (`gomodcache` 882 M is a hardlink duplicate of the now-protected `gopath`, `/tmp/gocache` 326 M and `/data/gocache` 42 G are deliberately unprotected, `/tmp/chs` 263 M + `chs.zip` 115 M remain valid candidates) — re-measure before anyone sweeps; **JSONL rotation** for `/data/agent-logs/tmp-sweep-plans.jsonl` (~29 MB/yr, this run's own residual note); **`coverage-guard --record`** (**green only**) remains the human act the live `fall: 3` / `stale: 4` waits on (handoff: `agent-logs/coverage-fall-attribution-2026-10-15.md`); the **log-truncation** standing WARN stays unreopened; run 952's **(i)** future-dated-footer guard *only on a measured future-dated marker* (still **0**) and **(iii)** A12 wording *only on a measured A12 misread*; **(93)**/**(97)(a)** first if the investor answers `hiring/queue/*.json` (**2 proposals**); **(2'')** the day the `GETTING_STARTED.md` keep/fold/retire answer arrives; **§14 renewal** cadence, the LAN-only A/B/C, **SOA MNAME** and Pip's mail-policy research stay NEEDS-INVESTOR; **(av)(d)** after the `REPORT.md` §14 sign-off; **(i)** until the prune lands; **(113)**'s two `cp`s operator-blocked; **2026-10-20** §10 #6 re-read with `./tools/download-stats --format json`; **V14b** (`shift-deploy` 132 vs 127) stays a standing load-dependent environmental red; the live fall set (aylin, dispatcher, leon) stays other seats' to fix. The **`- Live:`** line stays at **123** and the run that lands the 124th suite owns the next refresh — this run added no suite. **No `CHANGELOG.md` heading was added** (systemd units are system scope and the repo-side change is docs-only, the run 977 precedent), so queue-source R8's newest heading stays **`[0.4.364]`**.

- **Close-state:** this entry is appended **before** the commit that carries it (CLOSE PROTOCOL rule 1) and is never `git checkout --`-ed, staged-only or parked in `/tmp` (rules 2–3); the stop-state check is `git status --porcelain` **not listing `agent-logs/PROGRESS.md`** after the commit. This run makes **one content commit** (the four files above, explicit pathspec), then pushes; **if** a second commit follows (post-push re-reads), this entry's close-correction bullet is **re-appended before commit #2** (rule 2). The close ends with `git rev-list --count origin/main..main` → **0**. No app version moved — the top changelog heading stays **`0.4.28`**. Spend **0.00**, free `*-free` models only.
EOF
echo appended; tail -c 120 agent-logs/PROGRESS.md
appended
*0**. No app version moved — the top changelog heading stays **`0.4.28`**. Spend **0.00**, free `*-free` models only.
> build · mimo-v2.6-flash-free
Entry appended before the commit. Checking `git status` for the explicit pathspec and the background monitor's state.
$ cd /data/repo && git status --porcelain
M STRUCTURE.md
 M agent-logs/PROGRESS.md
?? mailboxes/main-to-reviewer/REVIEW-20261016T052000Z-tmp-sweep-timer.md
?? mailboxes/reviewer-to-main/VERDICT-20261016T052000Z-tmp-sweep-timer.md
> build · mimo-v2.6-flash-free
Exactly the four in-scope files, nothing else. Waiting for the background monitor run to finish before committing (its pre-commit reading is part of the verification).
$ cat /tmp/opencode/monitor-run980.out 2>/dev/null | tail -8; echo "---lines: $(wc -l < /tmp/opencode/monitor-run980.out 2>/dev/null)"
---lines: 0
> build · mimo-v2.6-flash-free
The monitor suite is still running in the background. I'll wait for its completion notification before the commit (the pre-commit red attribution is part of the record). 

Current state: STEP 0 paid (0/0, nothing owed), timer wiring live and reviewer-approved (VERDICT: APPROVE, 8/8), PROGRESS entry appended, `git status` shows exactly the four in-scope files.
exit=0

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Fri Oct 16 06:01:32 2026] 127.0.0.1:46008 Accepted
[Fri Oct 16 06:01:32 2026] 127.0.0.1:46008 Closing
[Fri Oct 16 06:01:32 2026] 127.0.0.1:46010 Accepted
[Fri Oct 16 06:01:32 2026] 127.0.0.1:46010 Closing
[Fri Oct 16 06:01:32 2026] 127.0.0.1:46020 Accepted
[Fri Oct 16 06:01:32 2026] 127.0.0.1:46020 Closing
[Fri Oct 16 06:01:32 2026] 127.0.0.1:46036 Accepted
[Fri Oct 16 06:01:32 2026] 127.0.0.1:46036 Closing
[Fri Oct 16 06:01:32 2026] 127.0.0.1:46040 Accepted
[Fri Oct 16 06:01:32 2026] 127.0.0.1:46040 Closing
[Fri Oct 16 06:01:32 2026] 127.0.0.1:46052 Accepted
[Fri Oct 16 06:01:32 2026] 127.0.0.1:46052 Closing
[Fri Oct 16 06:01:32 2026] 127.0.0.1:46066 Accepted
[Fri Oct 16 06:01:33 2026] 127.0.0.1:46066 Closing
[Fri Oct 16 06:01:33 2026] 127.0.0.1:46082 Accepted
[Fri Oct 16 06:01:33 2026] 127.0.0.1:46082 Closing
[Fri Oct 16 06:03:38 2026] 127.0.0.1:60818 Accepted
[Fri Oct 16 06:03:38 2026] 127.0.0.1:60818 Closing
[Fri Oct 16 06:15:23 2026] 127.0.0.1:43440 Accepted
[Fri Oct 16 06:15:23 2026] 127.0.0.1:43440 Closing
[Fri Oct 16 06:15:23 2026] 127.0.0.1:43444 Accepted
[Fri Oct 16 06:15:23 2026] 127.0.0.1:43444 Closing
[Fri Oct 16 06:15:23 2026] 127.0.0.1:43456 Accepted
[Fri Oct 16 06:15:23 2026] 127.0.0.1:43456 Closing
[Fri Oct 16 06:15:23 2026] 127.0.0.1:43464 Accepted
[Fri Oct 16 06:15:23 2026] 127.0.0.1:43464 Closing
[Fri Oct 16 06:15:23 2026] 127.0.0.1:43478 Accepted
[Fri Oct 16 06:15:23 2026] 127.0.0.1:43478 Closing
[Fri Oct 16 06:15:23 2026] 127.0.0.1:43482 Accepted
[Fri Oct 16 06:15:23 2026] 127.0.0.1:43482 Closing
[Fri Oct 16 06:15:23 2026] 127.0.0.1:43494 Accepted
[Fri Oct 16 06:15:24 2026] 127.0.0.1:43494 Closing
[Fri Oct 16 06:15:24 2026] 127.0.0.1:43498 Accepted
[Fri Oct 16 06:15:24 2026] 127.0.0.1:43498 Closing
[Fri Oct 16 06:15:24 2026] 127.0.0.1:43514 Accepted
[Fri Oct 16 06:15:24 2026] 127.0.0.1:43514 Closing
[Fri Oct 16 06:15:24 2026] 127.0.0.1:43528 Accepted
[Fri Oct 16 06:15:24 2026] 127.0.0.1:43528 Closing
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60872 Accepted
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60872 Closing
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60876 Accepted
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60876 Closing
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60886 Accepted
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60886 Closing
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60892 Accepted
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60892 Closing
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60900 Accepted
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60900 Closing
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60904 Accepted
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60904 Closing
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60914 Accepted
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60914 Closing
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60918 Accepted
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60918 Closing
[Fri Oct 16 06:16:32 2026] 127.0.0.1:60930 Accepted
[Fri Oct 16 06:16:33 2026] 127.0.0.1:60930 Closing
[Fri Oct 16 06:16:33 2026] 127.0.0.1:60940 Accepted
[Fri Oct 16 06:16:33 2026] 127.0.0.1:60940 Closing
[Fri Oct 16 06:19:59 2026] 127.0.0.1:47152 Accepted

Other app logs: downloads.log