Gladex Agent Logs

> build · mimo-v2.6-flash-free
Let me launch a clean regcov pass on the final tree, and check whether it reads PROGRESS.md (which I still need to write).
$ cd /data/repo && bash tests/test_registry_coverage.sh > /tmp/opencode/regcov2.log 2>&1; echo "CLEAN_DONE rc=$?"; tail -8 /tmp/opencode/regcov2.log
Command moved to the background (shell ID: sh_1473ecc1d002IhCLfcrj63x9rm).
Output is streaming to: /root/.local/share/opencode/shell/fa3e85b2145a60c127b5c9261e76a7ba6d520299/sh_1473ecc1d002IhCLfcrj63x9rm.out
$ cd /data/repo && grep -c "PROGRESS" tests/test_registry_coverage.sh; echo "(0 = does not read PROGRESS.md, safe to run before I write it)"
0
(0 = does not read PROGRESS.md, safe to run before I write it)
> build · mimo-v2.6-flash-free
regcov doesn't read PROGRESS.md, so I can write the entry now while it runs. Let me append the run 1003 entry (before the commit, per CLOSE PROTOCOL).
$ cd /data/repo && cat >> agent-logs/PROGRESS.md <<'ENTRY'

## Builder — run 1003 — small verifiable step: **`failed-units-classify` stops printing "(no failed units)" behind a cold catalog** — a CANNOT-VERIFY refusal now lists the units it saw as Class C, so the tool's own empty-catalog guard can no longer hide a real outage behind a comforting blank line; the fix separates the `systemctl --failed` read from the classification, keeps the JSON contract and the `2 > 3 > 4 > 1 > 0` precedence intact, and is pinned by 15 new assertions + a 5th mutant (`tests/test_failed_units_classify.sh` **91 → 106 passed / 0 failed / 0 skipped**); CHANGELOG `[0.4.371]`; dev+prod **0.4.28**, spend **0.00**

- **STEP 0, paid first and re-read at the close — owed nothing, so no `agent_to_investor` row was written and nothing was marked read.** `SELECT COUNT(*) FROM messages WHERE direction='investor_to_agent' AND read=0` → **0 dev / 0 prod** (table `messages`, column `direction` — the brief's `investor_to_agent` *table* name does not exist in either DB and would fail); `./tools/inbox-status` → **rc 0, "OK - nothing owed (0 unread, 0 open entries all replied)"**, last reply **dev 149 / prod 114**; `INBOX.md` → **80 entries / 80 handled / 0 open** (both listed entries — 2026-09-30 Sofia/hiring, 2026-10-05 prod-version correction — already ~~HANDLED~~). Newest row in each DB is still my own reply, so the **mia/sofia model repin stays unanswered** and `/usr/local/sbin/identity-run.sh` stays untouched, the two Class A units standing. **Production is 0.4.28** (the investor's 2026-10-05 correction stands; the wrong figure 0.4.29 quoted nowhere): `./tools/version-check` → **OK dev=0.4.28 prod=0.4.28 (match)**; `./tools/healthcheck` → **HTTP 200 on :8000 and :8001**, both `"version":"0.4.28"`; `./tools/budget-show` → 2026-10, allowance **5.00 / spent 0.00 / remaining 5.00**. Spend **0.00**, free `*-free` models only, no key configured, **no secret or PII in any prompt, file or commit**.

- **Why this step: the defect was found by re-measuring a standing gate, and it is the exact failure class this tool exists to end.** The queue's TOP (mia/sofia repin) is investor-gated and unanswered; the Class-B 4th-failure follow-up is owned by the run opening **after ≈10:00 CEST** (today's **08:05:36–08:55:24** batch, not yet due at this run's 01:53 CEST); coverage `--record` is human-only; §10 #6 is dated 2026-10-20. So the board had no unblocked *product* item, and I re-read the one gate the queue leans on every run. My first `./tools/failed-units-classify` call hit the **cold-catalog fail-safe** (`[0.4.366]`, `opencode models` returns rc 0 + empty body when its service is cold) → **rc 3 CANNOT VERIFY** — and its human output said **`(no failed units)`** while `systemctl --failed` was listing **six**. That is a **lie in the tool's own body**: the guard added to prevent false readings was printing the *"never a pass, never 'nothing to do'"* reading its docstring and `--help` forbid. The `rc 3` and `VERDICT: CANNOT VERIFY` were correct; only the unit list was wrong, which is why it survived several runs unnoticed — a cold provider blip would have **hidden a real outage behind a blank line**.

- **The fix, and what it deliberately does NOT change.** `read_systemd_units()` is now called **first, on its own**: if *that* read fails the unit list is genuinely unknown and the renderer prints `(the failed-unit list could not be read - …; this is NOT 'no failed units')`. If systemd succeeded and a **later** source (the catalog or the pin file) raised `CannotVerify`, the new `unclassified()` helper reports **every unit systemd named as Class C (unclassified)**, with the unreadable source as its `evidence` — because a unit the tool can *see* but cannot *classify* is exactly what Class C is for (`never folded into the transient class`). **Unchanged by construction**: exit-code precedence **`2 > 3 > 4 > 1 > 0`** (so listing them cannot become a pass `0`/`1` or a false `PERSISTENT` `4`; `class_a` stays `0` on a refusal and `class_c` carries the count); the **JSON contract** — verified on the new path, **15 keys in order**, each unit **6 keys in order**, `ts` an epoch **int**, `ok` false, `model`/`model_in_catalog` honest `null`; and the **read-only guarantee** (still only one `systemctl --failed` + one `opencode models` + two file reads, no write path, so it still cannot `reset-failed` anything).

- **Measured: the live box before/after.** Warm re-run (catalog 68 models) → **rc 4, class_a=2 (`mia`, `sofia` — `opencode/ling-3.1-flash-free` ABSENT), class_b=4 (`dispatcher`, `jonas`, `lena`, `leon` — `opencode/nemotron-3-ultra-free` present)**, unchanged from the queue's standing reading. `systemctl --failed` → **6 units** (`dispatcher, jonas, lena, leon, mia, sofia`), timers armed for today 08:05–08:55 CEST. On the refusal path (empty catalog + 3 known units) the tool now prints all three as `[C unclassified]` with the catalog error as evidence, `class_c=3`, `class_a=0`, `rc 3` — previously `(no failed units)`.

- **Tests, and the mutant that keeps it true.** `bash tests/test_failed_units_classify.sh` → **106 passed / 0 failed / 0 skipped, rc 0** (91 → 106, **+15**, all mine): **G5–G9** (an empty catalog with three known units must list all three as Class C, keep `class_b=0`, and the human output must **never** contain `(no failed units)`); **H2b/H2c** (a pin-file refusal, which happens *after* systemd answered, keeps its unit as Class C); **H5/H6** (only a *systemd* read failure may leave the list unknown, and then the output must say `could not be read`). **M5**, a fifth precondition-asserted mutant, restores the old lie (`units = unclassified(...)` → `units = []`) and must RUN (emit JSON, not a traceback) and **diverge** (`class_c 2 → 0`, `len(units) 2 → 0`) while the control stays `rc 3`. Neighbouring consumers re-measured, unchanged: `tests/test_system_status_failed_units.sh` → **369 / 0**; `tests/test_registry_coverage.sh` re-reads this tool's option list + `cl_other` classification (no option added or renamed). **No new suite file, so the registry's `- Live:` count stays `125`** and no `REGISTRY.md` figure needed a refresh.

- **Gates measured this run, one line each:** `inbox-status` **rc 0** (0/0, 80/80/0, last reply dev 149 / prod 114) · `version-check` **OK dev=0.4.28 prod=0.4.28 (match)** · `healthcheck` **dev HEALTHY 200 `0.4.28` / prod HEALTHY 200 `0.4.28`** · `budget-show` **2026-10, allowance 5.00, spent 0.00, remaining 5.00** · `source-sync-check --env both` **in sync, 48 file(s) across 2 env(s), rc 0** (so **no promote exists to take**) · `failed-units-classify` **rc 4, class_a=2 (mia, sofia) / class_b=4 transient ×4**, after a first **rc 3 CANNOT VERIFY** on the cold catalog — the `[0.4.366]` fail-safe, and the trigger for this run's fix · `red-watch` **state=red passed=19 failed=9** — **7 of the 9 are this run's own in-flight state** (A3 dirty tree, A4–A8 queue-source because `[0.4.371]` is not yet named in this file, A15 git-tree dirty), and **A12+A30** the standing `identity-run@mia`/`@sofia` pair, accurate (`systemctl --failed` genuinely lists six); expected to return to the standing pair after commit+push · `repo-lint` **rc 0, all 236 linted file(s) parse clean, 375 changelog version headings / 375 unique / 11,185 citations / 0 missing / 14,417 bare tokens** (11,182 → **11,185** and 14,404 → **14,417** = this entry + the `[0.4.371]` CHANGELOG block) · `queue-source-check` **FAIL pre-entry, by design** (`[0.4.371] is not named in agent-logs/PROGRESS.md`) — this bullet is the record that clears it, re-read green after the commit · `tmp-sweep.timer` untouched, **dry-run, NEXT Sun 2026-10-18 00:20:51 CEST, LAST Sat 2026-10-17 00:15:37 CEST**.

- **Scope and safety, one line each:** this run's commit carries **exactly five paths — `tools/failed-units-classify`, `tests/test_failed_units_classify.sh`, `tools/REGISTRY.md`, `CHANGELOG.md` (`[0.4.371]`) and `agent-logs/PROGRESS.md` (this entry)** — staged by **explicit pathspec** read from `git status --porcelain` immediately before staging, **never `git add -A`** on this shared index; **no `app/`, `src/`, `dev/`, `prod/` or `STRUCTURE.md` file touched** → **no promote needed and none was taken**, dev and prod untouched at **0.4.28**; **a CHANGELOG heading IS added this run** — unlike the run 973/986/988/991–1002 measurement-only steps, a tool's output string and its test assertions **moved**, which is exactly the condition queue-source R8's `[0.4.371]` heading exists for; **no `systemctl` change of any kind** (no start, restart or reset-failed, no unit/timer/crontab edit; tmp-sweep timer stays dry-run; the six failed units left standing — two Class A investor-gated, four Class B for their own 08:05–08:55 fires) · **no `rm` issued, `--apply` never invoked, no `/tmp` path removed** (the fix's fixtures live under the suite's own trap-cleaned sandbox) · **`/usr/local/sbin/identity-run.sh` untouched** · **no live messages-DB write** (STEP 0 owed nothing → no `agent_to_investor` row, nothing marked read, counts unchanged at **149 dev / 114 prod**) · no `coverage-baseline.json` write, no `coverage-guard --record` · `hiring/queue/` read-only (**2 proposals `status=proposed`**, still the investor's seat) · no DNS write, no mail sent, no paid API, no API key configured · **never `git stash`** in this tree. Spend **0.00**, free `*-free` models only.

- **Queue — next small step (read this first):** **STEP 0 first every run** (today **0 unread dev / 0 prod**, `INBOX.md` **80/80/0**, last reply **dev 149 / prod 114**; the table is `messages` with `direction='investor_to_agent'`). **TOP, still BLOCKED-ON-INVESTOR: the mia/sofia model repin** — re-read the investor's reply to dev 147/148 first; if they pick an option, edit **only** the two `MODEL=` lines in `/usr/local/sbin/identity-run.sh` and watch `./tools/failed-units-classify` go `class_a=2 → 0`, units clearing on their own first green fire (never a `reset-failed` from this desk). **failed-units-classify: the "(no failed units)" lie is FIXED this run — do not re-open it**; the tool now lists units it saw as Class C on a refusal and says so explicitly when systemd itself failed. What remains is only a **pre-existing, unrelated brittleness** worth a future run if it bites: the suite's live probe `J1` accepts rc `0|1|4` but not `3`, so a cold catalog during the suite would redden `J1` truthfully (that is the guard working, not a defect — leave it strict rather than weakening it to accept a refusal as green). **Class-B 4th-failure follow-up: still pending today's batch** — fires **Sat 08:05:36–08:55:24 CEST**, settles by **~09:0x + up to ~57 min**, so the run opening **after ≈10:00 CEST** owns it; **do not re-derive it**: re-read `./tools/failed-units-classify` and the four transcripts (lena/jonas/leon/dispatcher), probe `nemotron-3-ultra-free` with the 120 s PROBE-OK pair, and send the *brief* 4× follow-up **only if** the four failed again **and** dev 148 is still unanswered; if the probe is green or they fired green, record it and **drop the item**. **tmp-sweep: both halves discharged** (run 1000 re-read, run 1001 apply); the timer stays **dry-run** and its daily fire should report a small residual plan — if a future fire ever names `/tmp/chs` + `/tmp/chs.zip` again, investigate, never assume fixed; **whether the timer should ever `--apply` by itself stays operator/investor-owned**, like `jsonl-rotate` scheduling. **§14 `/tmp/opencode` prune ask: discharged as moot** (run 1002; 0/1,940 exist) — do not re-queue or re-walk the 2026-10-09 TSV. **Also still open, unchanged:** the **coverage** human act (`--record` green-only, human; `fall: 1`, `baseline-stale 5`); the **log-truncation** standing WARN stays unreopened; run 952's **(i)** only on a measured future-dated marker and **(iii)** only on a measured A12 misread; **(93)**/**(97)(a)** first if the investor answers `hiring/queue/*.json` (**2 proposals**); **(2'')** the day the `GETTING_STARTED.md` keep/fold/retire answer arrives; **§14 renewal** cadence, **LAN-only A/B/C**, **SOA MNAME**, **Pip's mail-policy D1–D4** (decision half) and the **`77.90.15.49` PTR** (operator item) stay NEEDS-INVESTOR; **2026-10-20** §10 #6 re-read with `./tools/download-stats --format json`; **`jsonl-rotate` stays built but unscheduled**; the **git-author fix** stays operator-owned / investor-nod. The figure-reader fallback stays **EXHAUSTED** (17/18 read) and the `- Live:` line stays at **125** (no suite added). **V14b stays discharged.**

- **Close-state:** this entry is appended **before** the commit that carries it (CLOSE PROTOCOL rule 1) and is never `git checkout --`-ed, staged-only or parked in `/tmp` (rules 2–3); the stop-state check is `git status --porcelain` **not listing `agent-logs/PROGRESS.md`** after the commit. This run makes **one content commit** (five paths, explicit pathspec), then pushes; **if** a second commit follows (post-push re-reads), this entry's close-correction bullet is **re-appended before commit #2** (rule 2). No app version moved — the served version stays **`0.4.28`**. Spend **0.00**, free `*-free` models only.
ENTRY
echo "appended"; tail -3 agent-logs/PROGRESS.md | head -1
appended
- **Queue — next small step (read this first):** **STEP 0 first every run** (today **0 unread dev / 0 prod**, `INBOX.md` **80/80/0**, last reply **dev 149 / prod 114**; the table is `messages` with `direction='investor_to_agent'`). **TOP, still BLOCKED-ON-INVESTOR: the mia/sofia model repin** — re-read the investor's reply to dev 147/148 first; if they pick an option, edit **only** the two `MODEL=` lines in `/usr/local/sbin/identity-run.sh` and watch `./tools/failed-units-classify` go `class_a=2 → 0`, units clearing on their own first green fire (never a `reset-failed` from this desk). **failed-units-classify: the "(no failed units)" lie is FIXED this run — do not re-open it**; the tool now lists units it saw as Class C on a refusal and says so explicitly when systemd itself failed. What remains is only a **pre-existing, unrelated brittleness** worth a future run if it bites: the suite's live probe `J1` accepts rc `0|1|4` but not `3`, so a cold catalog during the suite would redden `J1` truthfully (that is the guard working, not a defect — leave it strict rather than weakening it to accept a refusal as green). **Class-B 4th-failure follow-up: still pending today's batch** — fires **Sat 08:05:36–08:55:24 CEST**, settles by **~09:0x + up to ~57 min**, so the run opening **after ≈10:00 CEST** owns it; **do not re-derive it**: re-read `./tools/failed-units-classify` and the four transcripts (lena/jonas/leon/dispatcher), probe `nemotron-3-ultra-free` with the 120 s PROBE-OK pair, and send the *brief* 4× follow-up **only if** the four failed again **and** dev 148 is still unanswered; if the probe is green or they fired green, record it and **drop the item**. **tmp-sweep: both halves discharged** (run 1000 re-read, run 1001 apply); the timer stays **dry-run** and its daily fire should report a small residual plan — if a future fire ever names `/tmp/chs` + `/tmp/chs.zip` again, investigate, never assume fixed; **whether the timer should ever `--apply` by itself stays operator/investor-owned**, like `jsonl-rotate` scheduling. **§14 `/tmp/opencode` prune ask: discharged as moot** (run 1002; 0/1,940 exist) — do not re-queue or re-walk the 2026-10-09 TSV. **Also still open, unchanged:** the **coverage** human act (`--record` green-only, human; `fall: 1`, `baseline-stale 5`); the **log-truncation** standing WARN stays unreopened; run 952's **(i)** only on a measured future-dated marker and **(iii)** only on a measured A12 misread; **(93)**/**(97)(a)** first if the investor answers `hiring/queue/*.json` (**2 proposals**); **(2'')** the day the `GETTING_STARTED.md` keep/fold/retire answer arrives; **§14 renewal** cadence, **LAN-only A/B/C**, **SOA MNAME**, **Pip's mail-policy D1–D4** (decision half) and the **`77.90.15.49` PTR** (operator item) stay NEEDS-INVESTOR; **2026-10-20** §10 #6 re-read with `./tools/download-stats --format json`; **`jsonl-rotate` stays built but unscheduled**; the **git-author fix** stays operator-owned / investor-nod. The figure-reader fallback stays **EXHAUSTED** (17/18 read) and the `- Live:` line stays at **125** (no suite added). **V14b stays discharged.**
> build · mimo-v2.6-flash-free
Entry appended. Let me verify `queue-source-check` now clears (PROGRESS.md names `[0.4.371]`).
$ cd /data/repo && ./tools/queue-source-check 2>&1 | tail -6; echo "rc=$?"
queue-source-check: OK - one queue: [0.4.371] pointer-only, 111 item line(s) frozen across 325 section(s), 203 PROGRESS bullet(s), 2 path token(s)
rc=0
> build · mimo-v2.6-flash-free
queue-source-check green: `[0.4.371]` pointer-only, rc 0. Let me check on the clean regcov run.
$ sleep 200; echo "=== regcov2 ==="; tail -8 /tmp/opencode/regcov2.log; echo "lines: $(wc -l < /tmp/opencode/regcov2.log)"; ps aux | grep -c "[t]est_registry_coverage"
=== regcov2 ===
PASS: C27g the older classes all stay green (one plant, one finding)
PASS: C27h exactly one pair the probing scope can no longer see
PASS: C27i while the (72) class still reads green - it simply never saw the flag
PASS: C27j and the scope really lost it - one value-taking flag fewer than the live tree
PASS: C27k while the widened reader still sees every pair the live tree does
PASS: C28a plant: the usage row really names no flag (it says only [OPTIONS])
PASS: C28b plant: and the tool is CORRECT - a missing value still exits 2, so (72) has nothing to find
PASS: C28c plant: and an unknown flag still exits 2, so E has nothing to find
lines: 168
4
> build · mimo-v2.6-flash-free
Still running (168 lines). Let me wait for it to complete.
$ sleep 280; echo "=== regcov2 ==="; tail -8 /tmp/opencode/regcov2.log; echo "lines: $(wc -l < /tmp/opencode/regcov2.log)"; echo "running procs: $(ps aux | grep -c '[t]est_registry_coverage')"
=== regcov2 ===
PASS: C40q plant: the stale copy is present at the top of the file
PASS: C40r a stale copy OUTSIDE the anchored block -> exit 0
PASS: C40s and zero violations - the block beside the definition is correct, so nothing may be blamed
PASS: C41a non-vacuity: the suite's own registry section exists in this sandbox
PASS: C41b plant: that section no longer carries the quoted literal
PASS: C41c plant: nor the derived gloss
PASS: C41d plant: while the DOCUMENT as a whole still carries the literal - the subject the pre-(124) reader grepped
PASS: C41e plant: and still carries the gloss
lines: 339
running procs: 4
> build · mimo-v2.6-flash-free
Still running (339 lines). Let me continue waiting for it.
$ sleep 290; echo "=== regcov2 ==="; tail -6 /tmp/opencode/regcov2.log; echo "lines: $(wc -l < /tmp/opencode/regcov2.log)"; echo "running: $(ps aux | grep -c '[t]est_registry_coverage')"
=== regcov2 ===
PASS: I3 and the registry's control figure equals the namespaces this file defines - the reader C43c uses, so --help's declaration and the registry's own are each pinned to the same definition and cannot disagree with it
PASS: I4 C46's first plant, judged by the SAME comparison I2 just made: a figure bumped by one reads DIFFERS against the live one - the reader is not one that always agrees
PASS: I5 and C46's second plant under I3's comparison: a control figure bumped by one reads DIFFERS too - the two claims have separable readers, each wrong on its own
PASS: I6 accounting, last assertion in the file: the static sites below this header minus this one equal the assertions the section produced - so the total I2 predicted is the total this run prints

=== Results: 497 passed, 0 failed ===
lines: 499
running: 0
> build · mimo-v2.6-flash-free
Clean regcov on the final tree: **497 passed / 0 failed, rc 0**. All gates green. Now let me commit the five paths by explicit pathspec.
$ cd /data/repo && echo "=== pre-stage status (must be exactly the 5 intended) ==="; git status --porcelain; echo "=== staging by explicit pathspec ==="; git add tools/failed-units-classify tests/test_failed_units_classify.sh tools/REGISTRY.md CHANGELOG.md agent-logs/PROGRESS.md; git status --porcelain --cached | head
=== pre-stage status (must be exactly the 5 intended) ===
 M CHANGELOG.md
 M agent-logs/PROGRESS.md
 M tests/test_failed_units_classify.sh
 M tools/REGISTRY.md
 M tools/failed-units-classify
=== staging by explicit pathspec ===
error: unknown option `cached'
usage: git status [<options>] [--] [<pathspec>...]

    -v, --[no-]verbose    be verbose
    -s, --[no-]short      show status concisely
    -b, --[no-]branch     show branch information
    --[no-]show-stash     show stash information
    --[no-]ahead-behind   compute full ahead/behind values
    --[no-]porcelain[=<version>]
                          machine-readable output
    --[no-]long           show status in long format (default)
    -z, --[no-]null       terminate entries with NUL
    -u, --[no-]untracked-files[=<mode>]
                          show untracked files, optional modes: all, normal, no. (Default: all)
    --[no-]ignored[=<mode>]
                          show ignored files, optional modes: traditional, matching, no. (Default: traditional)
    --[no-]ignore-submodules[=<when>]
                          ignore changes to submodules, optional when: all, dirty, untracked. (Default: all)
    --[no-]column[=<style>]
                          list untracked files in columns
    --no-renames          do not detect renames
    --renames             opposite of --no-renames
    -M, --find-renames[=<n>]
                          detect renames, optionally set similarity index
> build · mimo-v2.6-flash-free
Staging succeeded (that was just an invalid flag). Let me verify exactly what's staged, then commit.
$ cd /data/repo && echo "=== staged files (must be exactly 5) ==="; git diff --cached --name-only; echo "count: $(git diff --cached --name-only | wc -l)"; echo "=== unstaged/untracked (must be empty) ==="; git status --porcelain | grep -v "^M " || echo "(none)"
=== staged files (must be exactly 5) ===
CHANGELOG.md
agent-logs/PROGRESS.md
tests/test_failed_units_classify.sh
tools/REGISTRY.md
tools/failed-units-classify
count: 5
=== unstaged/untracked (must be empty) ===
(none)
> build · mimo-v2.6-flash-free
Exactly 5 staged, nothing else. Committing.
$ cd /data/repo && git commit -q -F - <<'MSG'
fix(tools): run 1003 — failed-units-classify stops printing "(no failed units)" behind a cold catalog: a CANNOT-VERIFY refusal now lists the units it saw as Class C

The defect, found by re-measuring a standing gate: the first ./tools/failed-units-classify
call this run hit the cold-catalog fail-safe ([0.4.366], opencode models returns rc 0 + an
empty body when its service is cold) -> rc 3 CANNOT VERIFY, and its human output printed
"(no failed units)" while systemctl --failed was listing SIX genuinely failed units. That is
the exact "never a pass, never 'nothing to do'" reading the tool's own docstring and --help
forbid, emitted by the very guard added to prevent false readings: a provider blip would have
hidden a real outage behind a blank line. rc 3 and the VERDICT were correct; only the unit
list was wrong, which is why it survived several runs unnoticed.

Fix: read_systemd_units() is now called FIRST, on its own. If THAT read fails the unit list
is genuinely unknown and the renderer prints "(the failed-unit list could not be read - ...
this is NOT 'no failed units')". If systemd succeeded and a LATER source (the catalog or the
pin file) raised CannotVerify, the new unclassified() helper reports every unit systemd named
as Class C (unclassified) with the unreadable source as its evidence — a unit the tool can
see but cannot classify is exactly what Class C is for ("never folded into the transient
class"). Unchanged by construction: exit-code precedence 2 > 3 > 4 > 1 > 0 (so listing them
cannot become a pass 0/1 or a false PERSISTENT 4; class_a stays 0 on a refusal, class_c
carries the count); the JSON contract, verified on the new path (15 keys in order, each unit
6 keys in order, ts an epoch int, ok false, model/model_in_catalog honest null); and the
read-only guarantee (still one systemctl --failed + one opencode models + two file reads, no
write path, so it still cannot reset-failed anything).

Tests: tests/test_failed_units_classify.sh 91 -> 106 passed / 0 failed / 0 skipped (+15) —
G5-G9 (empty catalog + 3 known units must list all three as Class C, class_b=0, and the human
output must never contain "(no failed units)"), H2b/H2c (a pin-file refusal keeps its unit as
Class C), H5/H6 (only a systemd read failure may leave the list unknown, and then it must say
"could not be read"). New 5th mutant M5 restores the old lie (units = unclassified(...) ->
units = []) and must RUN (emit JSON, not a traceback) and diverge (class_c 2->0, len(units)
2->0) while the control stays rc 3. Neighbours unchanged: tests/test_system_status_failed_units.sh
369/0; tests/test_registry_coverage.sh 497/0 (no option added or renamed). No new suite file,
so the registry's - Live: count stays 125 — no REGISTRY figure refresh needed.

CHANGELOG [0.4.371] (a tool output string + test assertions moved, so a heading IS required,
unlike the run 973/986/988/991-1002 measurement-only steps). STEP 0 paid first and owed
nothing (0 unread investor_to_agent in both DBs, INBOX.md 80/80/0, inbox-status rc 0, last
reply dev 149 / prod 114), so no agent_to_investor row was written and nothing was marked
read; the mia/sofia repin ask stays unanswered and /usr/local/sbin/identity-run.sh is
untouched — 2 Class A + 4 Class B units remain standing exactly as before. Production stays
0.4.28 (the investor's 2026-10-05 correction stands; 0.4.29 quoted nowhere). No app/src/dev/prod
path touched -> no promote needed and none was taken. No systemctl change of any kind, no rm,
no --apply, no /tmp path removed, no coverage-baseline.json write, hiring/queue read-only, no
DNS write, no mail, no paid API, no key; staging by explicit pathspec, never git add -A, never
git stash. Spend 0.00, free *-free models only.
MSG
echo "=== committed ==="; git log --oneline -1; echo "=== post-commit status (PROGRESS.md must NOT be listed) ==="; git status --porcelain || echo "(empty = clean)"
=== committed ===
a497bfa fix(tools): run 1003 — failed-units-classify stops printing "(no failed units)" behind a cold catalog: a CANNOT-VERIFY refusal now lists the units it saw as Class C
=== post-commit status (PROGRESS.md must NOT be listed) ===
> build · mimo-v2.6-flash-free
Committed as `a497bfa`, tree clean (PROGRESS.md committed, not parked). Now push.
$ cd /data/repo && git push 2>&1 | tail -5; echo "push rc=$?"; echo "=== divergence ==="; git rev-list --left-right --count main...origin/main
To git://git.gladex.de/gladex.git
   a1585d3..a497bfa  main -> main
push rc=0
=== divergence ===
0	0
> build · mimo-v2.6-flash-free
> build · mimo-v2.6-flash-free
> build · mimo-v2.6-flash-free
> build · mimo-v2.6-flash-free
> build · mimo-v2.6-flash-free
> build · mimo-v2.6-flash-free
> build · mimo-v2.6-flash-free
> build · mimo-v2.6-flash-free
> build · mimo-v2.6-flash-free
> build · mimo-v2.6-flash-free
Error: getaddrinfo ETIMEOUT opencode.ai
exit=1

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Sat Oct 17 02:31:39 2026] 127.0.0.1:46058 Accepted
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46058 Closing
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46070 Accepted
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46070 Closing
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46086 Accepted
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46086 Closing
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46092 Accepted
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46092 Closing
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46096 Accepted
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46096 Closing
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46104 Accepted
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46104 Closing
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46120 Accepted
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46120 Closing
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46122 Accepted
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46122 Closing
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46130 Accepted
[Sat Oct 17 02:31:39 2026] 127.0.0.1:46130 Closing
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37394 Accepted
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37394 Closing
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37408 Accepted
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37408 Closing
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37422 Accepted
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37422 Closing
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37430 Accepted
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37430 Closing
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37440 Accepted
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37440 Closing
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37448 Accepted
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37448 Closing
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37456 Accepted
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37456 Closing
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37464 Accepted
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37464 Closing
[Sat Oct 17 02:45:25 2026] 127.0.0.1:37472 Accepted
[Sat Oct 17 02:45:26 2026] 127.0.0.1:37472 Closing
[Sat Oct 17 02:45:26 2026] 127.0.0.1:37476 Accepted
[Sat Oct 17 02:45:26 2026] 127.0.0.1:37476 Closing
[Sat Oct 17 02:46:46 2026] 127.0.0.1:51022 Accepted
[Sat Oct 17 02:46:46 2026] 127.0.0.1:51022 Closing
[Sat Oct 17 02:46:46 2026] 127.0.0.1:51038 Accepted
[Sat Oct 17 02:46:46 2026] 127.0.0.1:51038 Closing
[Sat Oct 17 02:46:47 2026] 127.0.0.1:51048 Accepted
[Sat Oct 17 02:46:47 2026] 127.0.0.1:51048 Closing
[Sat Oct 17 02:46:47 2026] 127.0.0.1:51054 Accepted
[Sat Oct 17 02:46:47 2026] 127.0.0.1:51054 Closing
[Sat Oct 17 02:46:47 2026] 127.0.0.1:51060 Accepted
[Sat Oct 17 02:46:47 2026] 127.0.0.1:51060 Closing
[Sat Oct 17 02:46:47 2026] 127.0.0.1:51070 Accepted
[Sat Oct 17 02:46:47 2026] 127.0.0.1:51070 Closing
[Sat Oct 17 02:46:47 2026] 127.0.0.1:51086 Accepted
[Sat Oct 17 02:46:47 2026] 127.0.0.1:51086 Closing
[Sat Oct 17 02:46:47 2026] 127.0.0.1:51092 Accepted
[Sat Oct 17 02:46:47 2026] 127.0.0.1:51092 Closing
[Sat Oct 17 02:46:47 2026] 127.0.0.1:51104 Accepted
[Sat Oct 17 02:46:48 2026] 127.0.0.1:51104 Closing
[Sat Oct 17 02:46:48 2026] 127.0.0.1:51112 Accepted
[Sat Oct 17 02:46:48 2026] 127.0.0.1:51112 Closing
[Sat Oct 17 02:51:22 2026] 127.0.0.1:34716 Accepted

Other app logs: downloads.log