@agentsfleet/orly 0.10.13 → 0.11.0

package/audits/rust-error.sh

@@ -42,6 +42,10 @@
 
 set -euo pipefail
 
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
+audit_scope_init --all "$@"
+audit_index_snapshot "$@"
+
 MODE_STAGED="--staged"
 MODE_ALL="--all"
 RULE="ERR-RS"
@@ -63,7 +67,8 @@ for arg in "$@"; do
       printf 'usage: %s [--staged|--all]\n' "$0"
       exit 0
       ;;
-    *) printf 'unknown arg: %s\n' "$arg" >&2; exit 64 ;;
+    -*) printf 'unknown arg: %s\n' "$arg" >&2; exit 2 ;;
+    *) MODE=explicit ;;
   esac
 done
 
@@ -83,18 +88,11 @@ is_non_runtime_rust_path() {
 }
 
 gather_paths() {
-  case "$MODE" in
-    "$MODE_STAGED")
-      git diff --cached --name-only --diff-filter=ACMRT -- '*.rs' || true
-      ;;
-    "$MODE_ALL")
-      git ls-files --cached --others --exclude-standard -- '*.rs' || true
-      ;;
-  esac
+  audit_scope_paths '*.rs'
 }
 
 FILES=()
-while IFS= read -r path; do
+while IFS= read -r -d '' path; do
   [[ -n "$path" && -f "$path" ]] || continue
   is_non_runtime_rust_path "$path" && continue
   FILES+=("$path")
@@ -204,17 +202,24 @@ crate_root_of() {
 }
 
 alias_count=0
-checked_crates=""
+checked_crates=()
 for path in ${error_type_files[@]+"${error_type_files[@]}"}; do
   crate=""
   crate_root_of "$path" > /dev/null 2>&1 && crate="$(crate_root_of "$path")"
   # A .rs file outside any Cargo crate has no crate to carry the alias; the
   # lossy-map_err half still judged it.
   [[ -n "$crate" ]] || continue
-  case " $checked_crates " in *" $crate "*) continue ;; esac
-  checked_crates="$checked_crates $crate"
-  if ! git ls-files --cached --others --exclude-standard -- "$crate/*.rs" \
-       | xargs grep -lE "$RESULT_ALIAS_PATTERN" 2>/dev/null | grep -q .; then
+  already_checked=0
+  for checked in ${checked_crates[@]+"${checked_crates[@]}"}; do
+    [ "$checked" != "$crate" ] || already_checked=1
+  done
+  [ "$already_checked" -eq 0 ] || continue
+  checked_crates+=("$crate")
+  alias_found=0
+  while IFS= read -r -d '' alias_path; do
+    if grep -qE "$RESULT_ALIAS_PATTERN" "$alias_path"; then alias_found=1; break; fi
+  done < <(git ls-files --cached --others --exclude-standard -z -- "$crate/*.rs")
+  if [ "$alias_found" -eq 0 ]; then
     alias_count=$((alias_count + 1))
     fail "$path  $RULE: crate '$crate' declares a public Error type with no \`pub type Result<T, E = Error>\` beside it — a reader must not have to check WHICH error a signature returns."
   fi

package/audits/scope.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# Shared filename scope and coherent index reads for deterministic scanners.
+
+AUDIT_HOME="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+audit_scope_init() {
+  AUDIT_MODE="${SCOPE:-$1}"; shift
+  AUDIT_TARGETS=()
+  local arg selected=0 literal=0
+  for arg in "$@"; do
+    if [ "$literal" -eq 1 ]; then AUDIT_TARGETS+=("$arg"); continue; fi
+    case "$arg" in
+      --) literal=1 ;;
+      --staged|staged|--all|all)
+        [ "$selected" -eq 0 ] || { printf 'choose one audit mode\n' >&2; return 2; }
+        AUDIT_MODE="$arg"; selected=1 ;;
+      --strict)
+        [ "${0##*/}" = logging.sh ] || { printf 'unsupported audit option: %s\n' "$arg" >&2; return 2; } ;;
+      -h|--help) printf 'usage: %s [--all|--staged] | file [...]\n' "$0"; exit 0 ;;
+      -*) printf 'unknown audit option: %s\n' "$arg" >&2; return 2 ;;
+      *) AUDIT_TARGETS+=("$arg") ;;
+    esac
+  done
+  if [ "${#AUDIT_TARGETS[@]}" -gt 0 ]; then
+    [ "$selected" -eq 0 ] || { printf 'audit modes and explicit files cannot be mixed\n' >&2; return 2; }
+    AUDIT_MODE=explicit
+  fi
+  case "$AUDIT_MODE" in
+    staged|--staged) AUDIT_MODE=--staged ;;
+    all|--all) AUDIT_MODE=--all ;;
+    explicit) ;;
+    *) printf 'unknown audit scope: %s\n' "$AUDIT_MODE" >&2; return 2 ;;
+  esac
+}
+
+# Source and dependencies share a copied index. Git's object store is read-only;
+# the index copy and checked-out files belong to this invocation alone.
+audit_index_snapshot() {
+  [ "$AUDIT_MODE" = --staged ] || return 0
+  local gitdir index
+  AUDIT_SNAPSHOT_ROOT="$(mktemp -d "${TMPDIR:-/tmp}/orly-index.XXXXXX")" || return 1
+  trap 'rm -rf -- "$AUDIT_SNAPSHOT_ROOT"' EXIT
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+  gitdir="$(git rev-parse --absolute-git-dir)" || exit 1
+  index="$(git rev-parse --git-path index)" || exit 1
+  cp "$index" "$AUDIT_SNAPSHOT_ROOT/index" || exit 1
+  export GIT_DIR="$gitdir" GIT_INDEX_FILE="$AUDIT_SNAPSHOT_ROOT/index" GIT_OPTIONAL_LOCKS=0
+  export GIT_WORK_TREE="$AUDIT_SNAPSHOT_ROOT/tree"
+  mkdir "$GIT_WORK_TREE" || exit 1
+  git checkout-index --all --prefix="$GIT_WORK_TREE/" || exit 1
+  cd "$GIT_WORK_TREE" || exit 1
+  [ -z "${TARGET_ROOT:-}" ] || TARGET_ROOT="$GIT_WORK_TREE"
+  audit_index_links || exit 2
+}
+
+audit_index_links() {
+  local entry path
+  git ls-files --stage -z > "$AUDIT_SNAPSHOT_ROOT/entries" || return 1
+  while IFS= read -r -d '' entry; do
+    case "$entry" in 120000*) ;; *) continue ;; esac
+    path="${entry#*$'\t'}"
+    bun -e 'import {realpathSync} from "node:fs";
+      import {relative, isAbsolute} from "node:path";
+      try {
+        const p = relative(process.cwd(), realpathSync(process.argv[1]));
+        if (p === ".." || p.startsWith("../") || isAbsolute(p)) throw new Error("escaping index link");
+      } catch { console.error("unsafe indexed symbolic link: " + process.argv[1]); process.exit(2); }' "$path" || return 2
+  done < "$AUDIT_SNAPSHOT_ROOT/entries"
+}
+
+# Zero-delimited throughout: spaces, tabs, quotes and newlines are filenames.
+audit_scope_paths() {
+  local path pattern matched
+  if [ "$AUDIT_MODE" = explicit ]; then
+    for path in "${AUDIT_TARGETS[@]}"; do
+      matched=0
+      for pattern in "$@"; do
+        case "$path" in $pattern) matched=1 ;; esac
+      done
+      [ "$matched" -eq 0 ] || printf '%s\0' "$path"
+    done
+  elif [ "$AUDIT_MODE" = --staged ]; then
+    git diff --cached --name-only -z --diff-filter=ACMRT -- "$@"
+  else
+    git ls-files --cached --others --exclude-standard -z -- "$@"
+  fi
+}

package/audits/spec-template.sh

@@ -14,7 +14,7 @@
 #      half that makes a spec "built for the agent".
 #   2b. DECLARED-COMMAND PARITY — a pending/active spec's Acceptance Rubric
 #      must quote the repository's declared conform + applicable verify.* commands
-#      (.oracle/orly.json) verbatim: the rubric and `orly gate` grade one
+#      (.orly/orly.json) verbatim: the rubric and `orly gate` grade one
 #      boundary. Staged/file scope only; done/ specs stay historical.
 #
 # Dispatch façade: dispatch/write_spec.md (SPEC TEMPLATE GATE)
@@ -51,7 +51,7 @@ case "$MODE" in
   --staged|staged)
     # while read, not mapfile — bash-3.2 portability (see scripts/run-playbook-tests.sh).
     SPECS=()
-    while IFS= read -r s; do SPECS+=("$s"); done < <(git diff --cached --name-only --diff-filter=ACMRT | grep -E '^docs/v[0-9]+/(pending|active|done)/.*\.md$' || true)
+    while IFS= read -r s; do SPECS+=("$s"); done < <(git diff --cached --name-only --diff-filter=ACMRT | grep -E '^docs/v[0-9]+(\.[0-9]+)*/(pending|active|done)/.*\.md$' || true)
     ;;
   --all|all)
     SPECS=()

package/audits/spec-template.ts

@@ -6,7 +6,7 @@ type MarkdownNode = string | MarkdownElement;
 type Section = { title: string; nodes: MarkdownNode[] };
 type Commands = Record<string, string[][]>;
 
-const CONFIG_PATH = ".oracle/orly.json";
+const CONFIG_PATH = ".orly/orly.json";
 const SPEC_LINE_LIMIT = 320;
 const BACKTICK = "`";
 const EMPTY = "";

package/audits/sql-mod.sh

@@ -23,6 +23,10 @@
 
 set -euo pipefail
 
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
+audit_scope_init --all "$@"
+audit_index_snapshot "$@"
+
 MODE="${1:-${SCOPE:---all}}"
 ROOT="$(git rev-parse --show-toplevel)"
 cd "$ROOT"
@@ -44,20 +48,13 @@ added_hit() {
     | grep -nE "$DEF_RE|$BODY_RE" | head -1 || true
 }
 
-case "$MODE" in
-  --staged|staged)
-    # while read, not mapfile — bash-3.2 portability (see scripts/run-playbook-tests.sh).
-    FILES=()
-    while IFS= read -r f; do FILES+=("$f"); done < <(git diff --cached --name-only --diff-filter=ACMRT -- '*.zig' || true)
-    STAGED=1 ;;
-  --all|all)
-    FILES=()
-    while IFS= read -r f; do FILES+=("$f"); done < <(find src -type f -name '*.zig' 2>/dev/null || true)
-    STAGED=0 ;;
-  *)
-    printf "usage: %s [--staged|--all]\n" "$0" >&2
-    exit 64 ;;
-esac
+MODE="$AUDIT_MODE"
+FILES=()
+while IFS= read -r -d '' f; do
+  [ ! -f "$f" ] || FILES+=("$f")
+done < <(audit_scope_paths '*.zig')
+STAGED=0
+[ "$MODE" != --staged ] || STAGED=1
 
 if [[ ${#FILES[@]} -eq 0 ]]; then
   ok "no zig source files in scope ($MODE)"

package/audits/ufs-strings.awk

@@ -0,0 +1,164 @@
+# Extracted intact; the owning shell scanner supplies the filename scope.
+  FNR == 1 {
+    prev_file = FILENAME
+    # Language lane. Each lane below carves out what its syntax makes
+    # UNFIXABLE — a literal a named const cannot legally replace. Anything
+    # a const CAN replace stays in scope, in every language.
+    lang = "other"
+    if (FILENAME ~ /\.zig$/)             lang = "zig"
+    else if (FILENAME ~ /\.rs$/)         lang = "rust"
+    else if (FILENAME ~ /\.go$/)         lang = "go"
+    # Test files: repetition is fixture data, not magic strings.
+    # Skip string-dup-file for tests; other checks still apply.
+    is_test = (FILENAME ~ /(_test\.zig|_test\.go|\.test\.|\.spec\.|\.unit\.test|\.integration\.test|\/test\/|\/tests\/)/)
+    # Directory-shaped test and benchmark trees. Rust puts both at the CRATE
+    # ROOT (`tests/`, `benches/`) with no leading slash, so the `\/tests\/`
+    # form above — which needs a parent directory — walked straight past them
+    # and audited 100 fixture hits as production literals.
+    if (FILENAME ~ "(^|/)(test|tests|benches|__tests__)/") is_test = 1
+  }
+  is_test { next }
+  # ui/ files: extracting class-strings or short literals to file-local
+  # consts is fragile in TypeScript (type-position uses widen string|
+  # literal types, and the cleanup belongs in a UI-aware spec). Skip
+  # string-dup-file for ui/packages/*/src; cross-runtime-orphan still
+  # runs against ui/ to catch ERR_* parity drift.
+  # macOS/BSD awk aborts on a `/` inside a `[...]` class in a regex *literal*
+  # ("nonterminated character class"); use a dynamic-regex STRING — identical
+  # match on gawk, portable on BWK awk (the macOS default). Do not re-inline.
+  FILENAME ~ "^ui/packages/[^/]+/(src|app|tests|components|lib|hooks)/" { next }
+  FNR == 1 { in_test_block = 0; test_depth = 0; in_block_comment = 0; in_rs_test = 0; rs_open = 0; rs_depth = 0; in_go_const = 0 }
+  {
+    line = $0
+    # Block-comment exclusion (TS/JS/Zig non-applicable): skip lines inside /* ... */
+    if (in_block_comment) {
+      if (line ~ /\*\//) in_block_comment = 0
+      next
+    }
+    if (line ~ /\/\*/ && line !~ /\*\//) {
+      in_block_comment = 1
+      next
+    }
+    # Zig multi-line string literal — lines start with `\\` after whitespace.
+    if (lang == "zig" && line ~ /^[[:space:]]*\\\\/) next
+    # Inline-test exclusion (Zig): track depth across `test "..." {` blocks.
+    if (lang == "zig") {
+      if (in_test_block) {
+        test_depth += gsub(/\{/, "{", line) - gsub(/\}/, "}", line)
+        if (test_depth <= 0) in_test_block = 0
+        line = $0  # restore
+        next
+      }
+      if (line ~ /^test[[:space:]]+"/) {
+        in_test_block = 1
+        tmp = line
+        test_depth = gsub(/\{/, "{", tmp) - gsub(/\}/, "}", tmp)
+        if (test_depth <= 0) in_test_block = 0
+        next
+      }
+    }
+    # Inline-test exclusion (Rust): Rust keeps its unit tests INSIDE the file
+    # they cover, under `#[cfg(test)] mod tests { ... }`, so without this the
+    # fixture keys of a well-tested module read as the worst literal debt in
+    # the production half of that same file — a real crate reported `"key1"`
+    # 15 times from one such block. Same brace-depth shape as the Zig branch.
+    if (lang == "rust") {
+      if (in_rs_test) {
+        tmp = line
+        rs_depth += gsub(/\{/, "{", tmp) - gsub(/\}/, "}", tmp)
+        if (!rs_open && index(line, "{") > 0) rs_open = 1
+        if (rs_open && rs_depth <= 0) in_rs_test = 0
+        else if (!rs_open && line ~ /;[[:space:]]*$/) in_rs_test = 0
+        next
+      }
+      # Three ways Rust marks a block as fixture data, not shipped behaviour:
+      # `#[cfg(test)]`, a `#[test]`/`#[tokio::test]` function, and a
+      # FEATURE-GATED test seam — `#[cfg(feature = "test-util")]`, the
+      # convention for a helper that must compile into the crate so an
+      # integration test in a sibling file can call it (a `one_of_each_kind`
+      # error-surface enumerator is the usual shape). The feature name is
+      # matched narrowly, `test` as a whole word or a `-`/`_` segment, so a
+      # production gate like `#[cfg(feature = "redis")]` still counts and
+      # `"latest"` is not mistaken for a test seam.
+      if (line ~ /^[[:space:]]*#\[cfg\(test\)\]/ ||
+          line ~ /^[[:space:]]*#\[[A-Za-z_:]*test\]/ ||
+          line ~ /^[[:space:]]*#\[cfg\(.*feature[[:space:]]*=[[:space:]]*"([A-Za-z0-9]+[-_])?test(ing)?([-_][A-Za-z0-9_-]+)?"/) {
+        in_rs_test = 1; rs_open = 0; rs_depth = 0
+        next
+      }
+      # Attribute literals are UNFIXABLE, not undisciplined. `#[serde(rename =
+      # "...")]`, `#[cfg(feature = "...")]` and `#[doc = "..."]` take a literal
+      # token by language rule — a const is not accepted there, so naming one
+      # cannot resolve the hit and reporting it only teaches people to ignore
+      # the gate. Ordered after the cfg(test) branch, which is also a `#[`.
+      if (line ~ /^[[:space:]]*#!?\[/) next
+    }
+    # Grouped-const exclusion (Go): `const ( ... )` states the binding keyword
+    # ONCE, on the opening line, so a member like `metaKeyQoS = "conf_..."` is
+    # a definition carrying no `const` for the binding carve-out below to see.
+    # `var (` groups are deliberately NOT tracked — the carve-out is const-only
+    # in every other language and widening it here would be a silent divergence.
+    if (lang == "go") {
+      if (in_go_const) {
+        if (line ~ /^[[:space:]]*\)/) { in_go_const = 0; next }
+        if (line ~ /^[[:space:]]*[A-Za-z_][A-Za-z0-9_]*([[:space:]]+[A-Za-z0-9_.\[\]*]+)?[[:space:]]*=/) next
+      }
+      else if (line ~ /^[[:space:]]*const[[:space:]]*\([[:space:]]*$/) { in_go_const = 1; next }
+    }
+    sub(/\/\/.*$/, "", line)
+    # Strip single-line /* ... */ inline block comments (jsdoc/etc) so
+    # literals inside them are not counted.
+    gsub(/\/\*[^*]*\*+([^\/*][^*]*\*+)*\//, "", line)
+    # Const-BINDING carve-out (narrower than the numeric-suspect is_const_decl
+    # exemption below — deliberately): a literal that IS the right-hand side of a
+    # `const`/`pub const`/`export const` binding is its single-source DEFINITION,
+    # not a magic-string use. Two distinct named constants may legitimately share
+    # a value across domains (e.g. a runner status and a lease status both
+    # "active") — RULE UFS targets UN-named repetition, and both sites there are
+    # already named. But a literal passed as a CALL ARGUMENT on a const line
+    # (`const x = foo("lit");`) is NOT named by that const — it counts and flags
+    # like any other use. (A prior line-level skip exempted those too and silently
+    # gutted the check for most Zig code; the ufs_dup_string eval fixture pins the
+    # binding-level semantic.)
+    # `static` joins the keyword set for Rust: `static NAME: &str = "..."` binds
+    # a literal to a name exactly as `const` does, and the leading
+    # `(^|[[:space:]])` anchor already carries the `pub`/`pub(crate)` prefixes.
+    # The second type slot belongs to Go, which spells the type with no colon
+    # (`const name string = "..."`), which the colon-only slot could not see.
+    if (line ~ /(^|[[:space:]])(pub[[:space:]]+const|export[[:space:]]+const|const|static)[[:space:]]+[A-Za-z_$][A-Za-z0-9_$]*([[:space:]]*:[^=]*|[[:space:]]+[A-Za-z_][A-Za-z0-9_.\[\]*]*)?[[:space:]]*=[[:space:]]*"((\\.)|[^\\"])+"[[:space:]]*(as[[:space:]]+const)?[[:space:]]*[;,]?[[:space:]]*$/) next
+    rest = line
+    # Strip Zig identifier-escape syntax @"name" — body is an identifier,
+    # not a string literal, but the regex below would otherwise match it.
+    gsub(/@"[^"]*"/, "", rest)
+    # Strip Go backtick runs. They are overwhelmingly struct tags
+    # (`json:"id" yaml:"id"`), whose quoted halves are tag SYNTAX addressed by
+    # reflection — a const cannot appear inside one, so the repeat is unfixable.
+    # This also drops single-line Go raw strings, which is the accepted cost:
+    # the alternative reports every `json:"id"` in a wire struct as a violation.
+    # A backtick run spanning lines is not tracked (best-effort, as documented).
+    if (lang == "go") gsub(/`[^`]*`/, "", rest)
+    # Strip empty string literals so the regex below cannot fuse
+    # two adjacent Zig literals through their inner gap.
+    gsub(/""/, "", rest)
+    # Match a quoted string literal honouring \" escapes: open quote,
+    # then runs of (backslash+any-char) | (non-backslash-non-quote),
+    # then close quote. Min 3 chars total ensures literal body ≥1 char
+    # (back-compat with the {2,} body-min from the prior regex).
+    while (match(rest, /"((\\.)|[^\\"])+"/)) {
+      lit = substr(rest, RSTART, RLENGTH)
+      rest = substr(rest, RSTART + RLENGTH)
+      if (length(lit) < 4) continue
+      if (lit ~ /^"(http|https|file|\/|\\\\|\\\\n)/) continue
+      key = FILENAME "\034" lit
+      count[key]++
+      file_of[key] = FILENAME
+      lit_of[key] = lit
+    }
+  }
+  END {
+    for (k in count) {
+      if (count[k] >= 2) {
+        printf "string-dup-file %s %s %d\n", file_of[k], lit_of[k], count[k]
+      }
+    }
+  }

package/audits/ufs.sh

@@ -53,20 +53,15 @@
 
 set -euo pipefail
 
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
+audit_scope_init --all "$@"
+audit_index_snapshot "$@"
+
 # Default: full-codebase scan (`--all` is an explicit alias). `--staged` is the
 # pre-commit lens — it narrows the per-file checks to `git diff --cached`. The
 # retired `--diff` (BASE...HEAD) mode stays rejected; `--staged` reads the index
 # and so is not blind to staged-but-uncommitted fixes (M70's concern).
-MODE="${1:-}"
-case "$MODE" in
-  ""|--all|all)    MODE="--all" ;;
-  --staged|staged) MODE="--staged" ;;
-  *)
-    printf "usage: %s [--all|--staged]\n" "$0" >&2
-    printf "note: --diff was retired in M70 — see dispatch/write_any.md (UFS Gate → Scope). Use --staged for the pre-commit (index) lens.\n" >&2
-    exit 2
-    ;;
-esac
+MODE="$AUDIT_MODE"
 ROOT="$(git rev-parse --show-toplevel)"
 cd "$ROOT"
 
@@ -111,19 +106,10 @@ is_source() {
 
 # Per-file check scope (string-dup-file, numeric-suspect). --staged narrows to
 # the commit; cross-runtime-orphan (below) always scans the full tree.
-if [ "$MODE" = "--staged" ]; then
-  scope_files() { git diff --cached --name-only --diff-filter=ACMRT; }
-else
-  scope_files() { git ls-files; }
-fi
-# `while read` rather than mapfile: mapfile is bash 4+ and macOS ships 3.2 —
-# the portability rule scripts/run-playbook-tests.sh already records.
 FILES=()
-while IFS= read -r f; do
-  FILES+=("$f")
-done < <(scope_files | while read -r f; do
-  is_source "$f" && echo "$f"
-done)
+while IFS= read -r -d '' f; do
+  if is_source "$f" && [ -f "$f" ]; then FILES+=("$f"); fi
+done < <(audit_scope_paths '*.zig' '*.ts' '*.tsx' '*.js' '*.jsx' '*.rs' '*.go')
 
 [ "${#FILES[@]}" -eq 0 ] && { ok "audit-ufs: no source files in scope"; exit 0; }
 
@@ -142,171 +128,7 @@ done)
 # a subshell and silently dropped violations.
 while IFS= read -r row; do
   record "$row"
-done < <(awk '
-  FNR == 1 {
-    prev_file = FILENAME
-    # Language lane. Each lane below carves out what its syntax makes
-    # UNFIXABLE — a literal a named const cannot legally replace. Anything
-    # a const CAN replace stays in scope, in every language.
-    lang = "other"
-    if (FILENAME ~ /\.zig$/)             lang = "zig"
-    else if (FILENAME ~ /\.rs$/)         lang = "rust"
-    else if (FILENAME ~ /\.go$/)         lang = "go"
-    # Test files: repetition is fixture data, not magic strings.
-    # Skip string-dup-file for tests; other checks still apply.
-    is_test = (FILENAME ~ /(_test\.zig|_test\.go|\.test\.|\.spec\.|\.unit\.test|\.integration\.test|\/test\/|\/tests\/)/)
-    # Directory-shaped test and benchmark trees. Rust puts both at the CRATE
-    # ROOT (`tests/`, `benches/`) with no leading slash, so the `\/tests\/`
-    # form above — which needs a parent directory — walked straight past them
-    # and audited 100 fixture hits as production literals.
-    if (FILENAME ~ "(^|/)(test|tests|benches|__tests__)/") is_test = 1
-  }
-  is_test { next }
-  # ui/ files: extracting class-strings or short literals to file-local
-  # consts is fragile in TypeScript (type-position uses widen string|
-  # literal types, and the cleanup belongs in a UI-aware spec). Skip
-  # string-dup-file for ui/packages/*/src; cross-runtime-orphan still
-  # runs against ui/ to catch ERR_* parity drift.
-  # macOS/BSD awk aborts on a `/` inside a `[...]` class in a regex *literal*
-  # ("nonterminated character class"); use a dynamic-regex STRING — identical
-  # match on gawk, portable on BWK awk (the macOS default). Do not re-inline.
-  FILENAME ~ "^ui/packages/[^/]+/(src|app|tests|components|lib|hooks)/" { next }
-  FNR == 1 { in_test_block = 0; test_depth = 0; in_block_comment = 0; in_rs_test = 0; rs_open = 0; rs_depth = 0; in_go_const = 0 }
-  {
-    line = $0
-    # Block-comment exclusion (TS/JS/Zig non-applicable): skip lines inside /* ... */
-    if (in_block_comment) {
-      if (line ~ /\*\//) in_block_comment = 0
-      next
-    }
-    if (line ~ /\/\*/ && line !~ /\*\//) {
-      in_block_comment = 1
-      next
-    }
-    # Zig multi-line string literal — lines start with `\\` after whitespace.
-    if (lang == "zig" && line ~ /^[[:space:]]*\\\\/) next
-    # Inline-test exclusion (Zig): track depth across `test "..." {` blocks.
-    if (lang == "zig") {
-      if (in_test_block) {
-        test_depth += gsub(/\{/, "{", line) - gsub(/\}/, "}", line)
-        if (test_depth <= 0) in_test_block = 0
-        line = $0  # restore
-        next
-      }
-      if (line ~ /^test[[:space:]]+"/) {
-        in_test_block = 1
-        tmp = line
-        test_depth = gsub(/\{/, "{", tmp) - gsub(/\}/, "}", tmp)
-        if (test_depth <= 0) in_test_block = 0
-        next
-      }
-    }
-    # Inline-test exclusion (Rust): Rust keeps its unit tests INSIDE the file
-    # they cover, under `#[cfg(test)] mod tests { ... }`, so without this the
-    # fixture keys of a well-tested module read as the worst literal debt in
-    # the production half of that same file — a real crate reported `"key1"`
-    # 15 times from one such block. Same brace-depth shape as the Zig branch.
-    if (lang == "rust") {
-      if (in_rs_test) {
-        tmp = line
-        rs_depth += gsub(/\{/, "{", tmp) - gsub(/\}/, "}", tmp)
-        if (!rs_open && index(line, "{") > 0) rs_open = 1
-        if (rs_open && rs_depth <= 0) in_rs_test = 0
-        else if (!rs_open && line ~ /;[[:space:]]*$/) in_rs_test = 0
-        next
-      }
-      # Three ways Rust marks a block as fixture data, not shipped behaviour:
-      # `#[cfg(test)]`, a `#[test]`/`#[tokio::test]` function, and a
-      # FEATURE-GATED test seam — `#[cfg(feature = "test-util")]`, the
-      # convention for a helper that must compile into the crate so an
-      # integration test in a sibling file can call it (a `one_of_each_kind`
-      # error-surface enumerator is the usual shape). The feature name is
-      # matched narrowly, `test` as a whole word or a `-`/`_` segment, so a
-      # production gate like `#[cfg(feature = "redis")]` still counts and
-      # `"latest"` is not mistaken for a test seam.
-      if (line ~ /^[[:space:]]*#\[cfg\(test\)\]/ ||
-          line ~ /^[[:space:]]*#\[[A-Za-z_:]*test\]/ ||
-          line ~ /^[[:space:]]*#\[cfg\(.*feature[[:space:]]*=[[:space:]]*"([A-Za-z0-9]+[-_])?test(ing)?([-_][A-Za-z0-9_-]+)?"/) {
-        in_rs_test = 1; rs_open = 0; rs_depth = 0
-        next
-      }
-      # Attribute literals are UNFIXABLE, not undisciplined. `#[serde(rename =
-      # "...")]`, `#[cfg(feature = "...")]` and `#[doc = "..."]` take a literal
-      # token by language rule — a const is not accepted there, so naming one
-      # cannot resolve the hit and reporting it only teaches people to ignore
-      # the gate. Ordered after the cfg(test) branch, which is also a `#[`.
-      if (line ~ /^[[:space:]]*#!?\[/) next
-    }
-    # Grouped-const exclusion (Go): `const ( ... )` states the binding keyword
-    # ONCE, on the opening line, so a member like `metaKeyQoS = "conf_..."` is
-    # a definition carrying no `const` for the binding carve-out below to see.
-    # `var (` groups are deliberately NOT tracked — the carve-out is const-only
-    # in every other language and widening it here would be a silent divergence.
-    if (lang == "go") {
-      if (in_go_const) {
-        if (line ~ /^[[:space:]]*\)/) { in_go_const = 0; next }
-        if (line ~ /^[[:space:]]*[A-Za-z_][A-Za-z0-9_]*([[:space:]]+[A-Za-z0-9_.\[\]*]+)?[[:space:]]*=/) next
-      }
-      else if (line ~ /^[[:space:]]*const[[:space:]]*\([[:space:]]*$/) { in_go_const = 1; next }
-    }
-    sub(/\/\/.*$/, "", line)
-    # Strip single-line /* ... */ inline block comments (jsdoc/etc) so
-    # literals inside them are not counted.
-    gsub(/\/\*[^*]*\*+([^\/*][^*]*\*+)*\//, "", line)
-    # Const-BINDING carve-out (narrower than the numeric-suspect is_const_decl
-    # exemption below — deliberately): a literal that IS the right-hand side of a
-    # `const`/`pub const`/`export const` binding is its single-source DEFINITION,
-    # not a magic-string use. Two distinct named constants may legitimately share
-    # a value across domains (e.g. a runner status and a lease status both
-    # "active") — RULE UFS targets UN-named repetition, and both sites there are
-    # already named. But a literal passed as a CALL ARGUMENT on a const line
-    # (`const x = foo("lit");`) is NOT named by that const — it counts and flags
-    # like any other use. (A prior line-level skip exempted those too and silently
-    # gutted the check for most Zig code; the ufs_dup_string eval fixture pins the
-    # binding-level semantic.)
-    # `static` joins the keyword set for Rust: `static NAME: &str = "..."` binds
-    # a literal to a name exactly as `const` does, and the leading
-    # `(^|[[:space:]])` anchor already carries the `pub`/`pub(crate)` prefixes.
-    # The second type slot belongs to Go, which spells the type with no colon
-    # (`const name string = "..."`), which the colon-only slot could not see.
-    if (line ~ /(^|[[:space:]])(pub[[:space:]]+const|export[[:space:]]+const|const|static)[[:space:]]+[A-Za-z_$][A-Za-z0-9_$]*([[:space:]]*:[^=]*|[[:space:]]+[A-Za-z_][A-Za-z0-9_.\[\]*]*)?[[:space:]]*=[[:space:]]*"((\\.)|[^\\"])+"[[:space:]]*(as[[:space:]]+const)?[[:space:]]*[;,]?[[:space:]]*$/) next
-    rest = line
-    # Strip Zig identifier-escape syntax @"name" — body is an identifier,
-    # not a string literal, but the regex below would otherwise match it.
-    gsub(/@"[^"]*"/, "", rest)
-    # Strip Go backtick runs. They are overwhelmingly struct tags
-    # (`json:"id" yaml:"id"`), whose quoted halves are tag SYNTAX addressed by
-    # reflection — a const cannot appear inside one, so the repeat is unfixable.
-    # This also drops single-line Go raw strings, which is the accepted cost:
-    # the alternative reports every `json:"id"` in a wire struct as a violation.
-    # A backtick run spanning lines is not tracked (best-effort, as documented).
-    if (lang == "go") gsub(/`[^`]*`/, "", rest)
-    # Strip empty string literals so the regex below cannot fuse
-    # two adjacent Zig literals through their inner gap.
-    gsub(/""/, "", rest)
-    # Match a quoted string literal honouring \" escapes: open quote,
-    # then runs of (backslash+any-char) | (non-backslash-non-quote),
-    # then close quote. Min 3 chars total ensures literal body ≥1 char
-    # (back-compat with the {2,} body-min from the prior regex).
-    while (match(rest, /"((\\.)|[^\\"])+"/)) {
-      lit = substr(rest, RSTART, RLENGTH)
-      rest = substr(rest, RSTART + RLENGTH)
-      if (length(lit) < 4) continue
-      if (lit ~ /^"(http|https|file|\/|\\\\|\\\\n)/) continue
-      key = FILENAME "\034" lit
-      count[key]++
-      file_of[key] = FILENAME
-      lit_of[key] = lit
-    }
-  }
-  END {
-    for (k in count) {
-      if (count[k] >= 2) {
-        printf "string-dup-file %s %s %d\n", file_of[k], lit_of[k], count[k]
-      }
-    }
-  }
-' "${FILES[@]}")
+done < <(awk -f "$AUDIT_HOME/ufs-strings.awk" "${FILES[@]}")
 
 # ── 2. numeric-suspect ──────────────────────────────────────────────────────
 # Flag bare power-of-ten and unit-factor numerics in expressions.
@@ -321,7 +143,7 @@ done < <(awk '
 # Boundaries are capturing groups, not \b: macOS/BSD awk treats \b as a backspace,
 # so word-boundary anchors silently match nothing. The leading/trailing boundary
 # chars are trimmed back off the extracted token below (see RSTART/RLENGTH use).
-NUMERIC_RE='(^|[^0-9A-Za-z_])(1[_e]?0{3,12}|1_000(_000)*|10_000_000|100_000|1024|1048576|3600|86400)([^0-9A-Za-z_]|$)'
+NUMERIC_RE='(^|[^0-9A-Za-z_])(1[_e]?0{3,12}|1_000(_000)*|10_000_000|100_000|1024|1048576|60|3600|86400)([^0-9A-Za-z_]|$)'
 
 # Perf (M70): single awk across all files; FNR == 1 detects file boundary
 # so the "prev line carve-out" stays per-file. Process substitution keeps