@agentsfleet/orly 0.14.3 → 0.14.5

package/AGENTS.md

@@ -16,7 +16,7 @@ You are this repository's coding agent: deterministic, autonomous, command-line-
 
 **The human is Kishore** — casual handle **Indy**; either name, any case, addresses him. Ambiguous "the user" / "they" here = Kishore. The agent is **Oracle**, casual handle **Aiwa**. `orly` names the agentsfleet CLI only (`orly gate`, `orly init`, `orly update`, and the `Orly-Override` trailer it writes).
 
-**Address tags.** Kishore: **🤠 Indy**; agent: **🦉 Aiwa** (`Oracle`). **Project name:** `agentsfleet` (domains → `agentsfleet.net`). Write product as `agentsfleet` (inline code), never bare; stale legacy-brand reps → flag, replace when in scope, inform Indy. Products: `agentsfleet` / `agentsfleetd` / `agentsfleet-runner`; entities/API: `fleet`, `fleet_id`, `/fleets`, `core.fleet_*`. Keep: `agentsfleet.dev`, `github.com/agentsfleet/agentsfleet`, `@agentsfleet/*`, `~/Projects/agentsfleet`.
+**Address tags.** Kishore: **🤠 Indy**; agent: **🦉 Aiwa** (`Oracle`). **Project name:** `agentsfleet` (domains → `agentsfleet.net`). Write product as `agentsfleet` (inline code), never bare; stale legacy-brand reps → flag, replace when in scope, inform Indy. Products: `agentsfleet` / `agentsfleetd` / `agentsfleet-runner`; entities/API: `fleet`, `fleet_id`, `/fleets`, `fleet.*`. Keep: `agentsfleet.dev`, `github.com/agentsfleet/agentsfleet`, `@agentsfleet/*`, `~/Projects/agentsfleet`.
 
 MacBook. Languages: Python, Go, Rust, TypeScript, Zig. Tooling: `mise` first, `brew` fallback. Forges: `gh`/`glab`. Commit identity from `git config`, never here.
 

package/README.md

@@ -78,7 +78,7 @@ TypeSafe's Jev model supplies runtime advice through explicit `orly judge` reque
 
 See [releases](https://github.com/agentsfleet/orly/releases) for published versions.
 The install commands below fetch the published package.
-The release workflow publishes 0.14.3 after its version change merges to `main`.
+The release workflow publishes 0.14.5 after its version change merges to `main`.
 
 ---
 

package/audits/agents-md.md

@@ -179,7 +179,7 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 
 | # | Question | Expected |
 |---|---|---|
-| 11.1 | Only under the explicit `product.agentsfleet` pack, is its pre-v0.30.0 removal flow rm-file + rm-embed + rm-migration-array with no markers, while independent repositories retain their own live-data policy and destructive-change approval? | YES |
+| 11.1 | Only under the explicit `product.agentsfleet` pack, is its pre-v0.30.0 removal flow rm-file + rm-migration-array with no markers, while independent repositories retain their own live-data policy and destructive-change approval? | YES |
 | 11.2 | Are static strings in SQL schema a **no-override** ban across every literal that names a value or identifier the application also names — `DEFAULT`, `CHECK (col IN (…))`, trigger-body comparisons against a column, `current_setting()` parameter names, and `RAISE EXCEPTION` text a caller matches on — not just `DEFAULT`/`CHECK`? | YES |
 
 ### Scenario 12 — Auto-mode boundary (added)

package/audits/msid-ui.sh

@@ -99,7 +99,23 @@ case "$MODE" in
     EXPLICIT=("$@"); POST_REF=""; LABEL="explicit files" ;;
 esac
 
-# Single awk pass; reads stdin (the unified diff).
+# --staged/--diff: one git diff piped into one awk — the scan itself costs
+# two processes however large the staged set, plus at most one `git show`
+# per file holding a candidate hit line (zero for a clean diff). Explicit
+# mode keeps a per-file scan so the reported path is the caller's own argv
+# string (git's --no-index headers strip the leading slash of absolute
+# paths, which would misreport the hit and misread the post-image).
+# This gate runs inside a 30-minute pre-commit budget that the previous
+# per-file fork loop blew through at 1,628 staged files.
+#
+# The awk learns the current file from the diff's own `+++ b/<path>` header
+# instead of a shell loop variable. That parse is made safe on purpose:
+#   * `--src-prefix=a/ --dst-prefix=b/` pins the prefixes, because user config
+#     (diff.noprefix, diff.mnemonicPrefix) may rename them.
+#   * git C-quotes paths containing control characters, `"` or `\` (and with
+#     the default core.quotePath, non-ASCII bytes — hence `-c
+#     core.quotePath=false` on the git calls), so the header is unquoted in
+#     awk. git terminates the header path with one TAB, quoted or not.
 #
 # Carve-out recognition reads the preceding line from the SOURCE, not from the
 # diff. Every carve-out here — the two override markers and the design-system
@@ -112,29 +128,21 @@ esac
 # override comment stopped covering the line it sits above the moment that line
 # was next touched.
 #
-# The hunk header carries the post-image line number, so `line_above` can fetch
-# the neighbouring line out of the post-image the mode named. Same shape as
-# audits/design-tokens.sh, which has always read its override out of the file.
+# The hunk header carries the post-image line number, so `line_above` answers
+# from the post-image the mode named. The post-image is slurped once per file —
+# on the file's first *candidate* hit line, since only candidates (a line
+# matching the MS-ID or UI regexes in a scoped file) ever read the neighbour —
+# and dropped when the next file's `diff --git` section opens. One `git show`
+# per candidate file, zero for a clean diff, and memory bounded by one file.
 scan_diff() {
-ORLY_AUDIT_PATH="$1" awk -v post_ref="$POST_REF" '
+awk -v post_ref="$POST_REF" '
   # BWK awk (macOS) has no gensub and no --posix quoting help; APOSTROPHE is
   # built rather than written, because this program is inside single quotes.
-  BEGIN { APOSTROPHE = sprintf("%c", 39); f = ENVIRON["ORLY_AUDIT_PATH"] }
-
-  # The source line above line `n` of `path`, from the post-image, or "" when
-  # there is none. Cached: a hunk may ask about the same neighbour repeatedly,
-  # and each miss costs a fork.
-  function line_above(path, n,    key, cmd, out) {
-    if (n <= 1) return ""
-    key = path SUBSEP n
-    if (key in above) return above[key]
-    above[key] = ""
-    if (post_ref == "") cmd = "sed -n " (n - 1) "p " shell_quote(path)
-    else cmd = "git show " shell_quote(post_ref path) " 2>/dev/null | sed -n " (n - 1) "p"
-    if ((cmd | getline out) > 0) above[key] = out
-    close(cmd)
-    return above[key]
-  }
+  # Explicit mode names its file through the environment (see the driver) and
+  # the header parse below then never overrides it; the diff modes pass an
+  # empty value and every `+++` header re-attributes f.
+  BEGIN { APOSTROPHE = sprintf("%c", 39); in_hunk = 0; loaded = 0; imgn = 0
+          f = ENVIRON["ORLY_AUDIT_PATH"]; fixed_f = (f != "") }
 
   function shell_quote(s,    i,c,out) {
     out = APOSTROPHE
@@ -145,23 +153,113 @@ ORLY_AUDIT_PATH="$1" awk -v post_ref="$POST_REF" '
     }
     return out APOSTROPHE
   }
+
+  # The post-image path a `+++ ` header names: C-quote resolved (git wraps
+  # the whole "b/<path>" in quotes), the pinned b/ prefix removed. /dev/null
+  # maps to the empty path, which matches no scope below.
+  function dst_path(header,    rest,out,i,c,nxt,q,oct,v,j) {
+    rest = substr(header, 5)
+    if (rest == "/dev/null") return ""
+    if (substr(rest, 1, 1) == "\"") {
+      q = 0
+      for (i = length(rest); i >= 2; i--) if (substr(rest, i, 1) == "\"") { q = i; break }
+      rest = substr(rest, 2, q - 2)
+      out = ""
+      i = 1
+      while (i <= length(rest)) {
+        c = substr(rest, i, 1)
+        if (c == "\\") {
+          nxt = substr(rest, i + 1, 1)
+          if (nxt ~ /[0-7]/) {
+            # \ooo octal escape, one to three digits (only control bytes reach
+            # here: core.quotePath=false passes non-ASCII through raw).
+            oct = nxt
+            while (length(oct) < 3 && substr(rest, i + 1 + length(oct), 1) ~ /[0-7]/)
+              oct = oct substr(rest, i + 1 + length(oct), 1)
+            v = 0
+            for (j = 1; j <= length(oct); j++) v = v * 8 + substr(oct, j, 1)
+            out = out sprintf("%c", v)
+            i += 1 + length(oct)
+          } else {
+            if (nxt == "a") out = out sprintf("%c", 7)
+            else if (nxt == "b") out = out sprintf("%c", 8)
+            else if (nxt == "f") out = out "\f"
+            else if (nxt == "n") out = out "\n"
+            else if (nxt == "r") out = out "\r"
+            else if (nxt == "t") out = out "\t"
+            else if (nxt == "v") out = out "\v"
+            else out = out nxt
+            i += 2
+          }
+        } else { out = out c; i++ }
+      }
+      rest = out
+    } else {
+      # Unquoted: drop the single trailing TAB git appends to the header
+      # path. A literal tab in a filename forces C-quoting, so a trailing
+      # tab here is never name content; a trailing SPACE is, and is kept.
+      sub(/\t$/, "", rest)
+    }
+    sub(/^b\//, "", rest)
+    return rest
+  }
+
+  function load_postimage(    cmd,l) {
+    imgn = 0
+    if (post_ref == "") {
+      while ((getline l < f) > 0) { imgn++; img[imgn] = l }
+      close(f)
+    } else {
+      cmd = "git show " shell_quote(post_ref f) " 2>/dev/null"
+      while ((cmd | getline l) > 0) { imgn++; img[imgn] = l }
+      close(cmd)
+    }
+    loaded = 1
+  }
+
+  # The source line above post-image line `n` of the current file, or "" when
+  # there is none. Reads the slurped post-image; the slurp happens at most
+  # once per file section.
+  function line_above(n) {
+    if (n <= 1) return ""
+    if (!loaded) load_postimage()
+    if (n - 1 > imgn) return ""
+    return img[n - 1]
+  }
+
+  # A new file section: reset hunk state and drop the previous post-image —
+  # lookups only ever concern the file of the open section.
+  /^diff --git / {
+    in_hunk = 0
+    if (loaded) { for (i = 1; i <= imgn; i++) delete img[i]; imgn = 0; loaded = 0 }
+    next
+  }
+  !in_hunk && /^\+\+\+ / { if (!fixed_f) f = dst_path($0); next }
   /^\+\+\+/ { next }
   # `@@ -a,b +c,d @@` — $3 is the post-image start line for this hunk.
-  /^@@/ { start=$3; sub(/^\+/,"",start); split(start,parts,","); nl=parts[1]+0; next }
+  /^@@/ { in_hunk = 1; start=$3; sub(/^\+/,"",start); split(start,parts,","); nl=parts[1]+0; next }
   /^[^+]/ { next }
   /^\+/ {
     line=$0
     sub(/^\+/,"",line)
-    prev = line_above(f, nl)
+    # The line above is fetched only for candidate hits: every reader of
+    # `prev` sits behind one of these two guards, so a line that matches
+    # neither regex never pays for the post-image.
+    msid_cand = f ~ /\.(zig|sql|ts|tsx|js|jsx|py|rs|go|sh|toml|yaml|json)$/ &&
+                f !~ /^(docs|node_modules|vendor|third_party)\// &&
+                match(line, /M[0-9]+_[0-9]+|§[0-9]+(\.[0-9]+)+|(^|[^A-Za-z0-9_])T[0-9]+([^A-Za-z0-9_]|$)|(^|[^A-Za-z0-9_])dim [0-9]+\.[0-9]+([^A-Za-z0-9_]|$)/)
+    ui_cand = f ~ /^ui\/packages\/app\/.*\.(tsx|jsx)$/ &&
+              line ~ /<(section|button|input|dialog|article|nav|header|form)[ \t>\/]/
+    if (msid_cand || ui_cand) {
+      prev = line_above(nl)
+      ms_id_override = (prev ~ /MILESTONE ID ALLOWED per user override/)
+      ui_override = (prev ~ /UI GATE: SKIPPED per user override/)
+    } else {
+      prev = ""; ms_id_override = 0; ui_override = 0
+    }
     nl++
-    ms_id_override = (prev ~ /MILESTONE ID ALLOWED per user override/)
-    ui_override = (prev ~ /UI GATE: SKIPPED per user override/)
-    if (!ms_id_override &&
-        f ~ /\.(zig|sql|ts|tsx|js|jsx|py|rs|go|sh|toml|yaml|json)$/ &&
-        f !~ /^(docs|node_modules|vendor|third_party)\//) {
-      if (match(line, /M[0-9]+_[0-9]+|§[0-9]+(\.[0-9]+)+|(^|[^A-Za-z0-9_])T[0-9]+([^A-Za-z0-9_]|$)|(^|[^A-Za-z0-9_])dim [0-9]+\.[0-9]+([^A-Za-z0-9_]|$)/)) {
-        print "MS-ID  " f ": " line
-      }
+    if (msid_cand && !ms_id_override) {
+      print "MS-ID  " f ": " line
     }
     # react-hook-form caveat: its prescribed shape is a raw
     # <form onSubmit={form.handleSubmit(...)}> inside the design-system <Form>
@@ -179,9 +277,7 @@ ORLY_AUDIT_PATH="$1" awk -v post_ref="$POST_REF" '
     # is above it in the file whether or not this diff touched it. A
     # bare/unwrapped <section> still trips.
     ds_section = (line ~ /<section[ \t]/ && prev ~ /<Section asChild>/)
-    if (!ui_override && !rhf_form && !ds_section &&
-        f ~ /^ui\/packages\/app\/.*\.(tsx|jsx)$/ &&
-        line ~ /<(section|button|input|dialog|article|nav|header|form)[ \t>\/]/) {
+    if (ui_cand && !ui_override && !rhf_form && !ds_section) {
       print "UI     " f ": " line
     }
   }
@@ -193,12 +289,14 @@ hits=$(
     for path in "${EXPLICIT[@]}"; do
       [ -f "$path" ] || continue
       # diff returns one for differences; that is expected input here.
-      { git diff --no-index --no-ext-diff -U0 -- /dev/null "$path" || [ "$?" -eq 1 ]; } | scan_diff "$path"
+      { git -c core.quotePath=false diff --no-index --no-ext-diff -U0 --src-prefix=a/ --dst-prefix=b/ -- /dev/null "$path" || [ "$?" -eq 1 ]; } | ORLY_AUDIT_PATH="$path" scan_diff
     done
   else
-    while IFS= read -r -d '' path; do
-      git diff --no-ext-diff -U0 "${DIFF_ARGS[@]}" -- "$path" | scan_diff "$path"
-    done < <(git diff --name-only -z --diff-filter=ACMRT "${DIFF_ARGS[@]}")
+    # --no-renames pins a rename to its delete+add shape: this gate scores
+    # added lines, and its verdicts are defined over renamed files being
+    # re-scanned as whole-file additions. Rename detection would silently
+    # stop scanning their contents.
+    git -c core.quotePath=false diff --no-ext-diff -U0 --no-renames --diff-filter=ACMRT --src-prefix=a/ --dst-prefix=b/ "${DIFF_ARGS[@]}" | ORLY_AUDIT_PATH="" scan_diff
   fi
 )
 

package/audits/spec-template.ts

@@ -7,7 +7,7 @@ type Section = { title: string; nodes: MarkdownNode[] };
 type Commands = Record<string, string[][]>;
 
 const CONFIG_PATH = ".orly/orly.json";
-const SPEC_LINE_LIMIT = 320;
+const SPEC_LINE_LIMIT = 500;
 const BACKTICK = "`";
 const EMPTY = "";
 const PIPE_OUTPUT = "pipe";

package/core/operating-model.md

@@ -11,7 +11,7 @@ You are this repository's coding agent: deterministic, autonomous, command-line-
 
 **The human is Kishore** — casual handle **Indy**; either name, any case, addresses him. Ambiguous "the user" / "they" here = Kishore. The agent is **Oracle**, casual handle **Aiwa**. `orly` names the agentsfleet CLI only (`orly gate`, `orly init`, `orly update`, and the `Orly-Override` trailer it writes).
 
-**Address tags.** Kishore: **🤠 Indy**; agent: **🦉 Aiwa** (`Oracle`). **Project name:** `agentsfleet` (domains → `agentsfleet.net`). Write product as `agentsfleet` (inline code), never bare; stale legacy-brand reps → flag, replace when in scope, inform Indy. Products: `agentsfleet` / `agentsfleetd` / `agentsfleet-runner`; entities/API: `fleet`, `fleet_id`, `/fleets`, `core.fleet_*`. Keep: `agentsfleet.dev`, `github.com/agentsfleet/agentsfleet`, `@agentsfleet/*`, `~/Projects/agentsfleet`.
+**Address tags.** Kishore: **🤠 Indy**; agent: **🦉 Aiwa** (`Oracle`). **Project name:** `agentsfleet` (domains → `agentsfleet.net`). Write product as `agentsfleet` (inline code), never bare; stale legacy-brand reps → flag, replace when in scope, inform Indy. Products: `agentsfleet` / `agentsfleetd` / `agentsfleet-runner`; entities/API: `fleet`, `fleet_id`, `/fleets`, `fleet.*`. Keep: `agentsfleet.dev`, `github.com/agentsfleet/agentsfleet`, `@agentsfleet/*`, `~/Projects/agentsfleet`.
 
 MacBook. Languages: Python, Go, Rust, TypeScript, Zig. Tooling: `mise` first, `brew` fallback. Forges: `gh`/`glab`. Commit identity from `git config`, never here.
 

package/dispatch/write_sql.md

@@ -57,7 +57,6 @@ The **Schema Table Removal Guard** card dissolves into this façade; its prose i
 **Triggers** — before any of these, run `cat VERSION` and print the guard output. `0.30.0` is the anchor: below it the datastore is rebuilt from empty, from it the datastore is live production. Compare the version field by field, never as a string — `0.29.0` is under the anchor and `0.30.0` is not, while a lexical compare puts `0.30.0` under `0.9.0` and reads the era backwards.
 
 - Creating, editing, or deleting any file under `schema/*.sql`.
-- Editing `schema/embed.zig` (any `@embedFile` constant).
 - Editing the canonical migration array in `rustd/crates/afd_db/src/migration.rs`.
 - Writing `DROP TABLE`, `ALTER TABLE`, or `SELECT 1;` into any SQL file.
 - Accepting a spec dimension prescribing a "DROP migration", "ALTER migration", or "version marker".
@@ -73,8 +72,7 @@ The era runs while `VERSION` is under `0.30.0`, and it ends there — the develo
 To remove a table:
 
 1. `rm schema/NNN_foo.sql`
-2. Remove `@embedFile` from `schema/embed.zig`
-3. Remove the entry from the migration array in `rustd/crates/afd_db/src/migration.rs` and update its registration tests.
+2. Remove the entry from the migration array in `rustd/crates/afd_db/src/migration.rs` and update its registration tests.
 
 **Forbidden:** `ALTER TABLE`, `DROP TABLE`, `SELECT 1;` markers, comment-only files, "keep file for slot numbering". Slot gaps are fine — the DB is wiped on rebuild.
 
@@ -91,11 +89,10 @@ The teardown path is closed. Every schema change assumes a live datastore holdin
 ```
 SCHEMA GUARD: VERSION=<v> (<0.30.0 ? teardown : migrate)
   rm:schema/<file>.sql
-  rm-embed:<const>
   rm-migration:v<N>
 ```
 
-Below `0.30.0`, all three rm- lines appear. From `0.30.0`, replace them with `migration:schema/<NNN>_<change>.sql`.
+Below `0.30.0`, both rm- lines appear. From `0.30.0`, replace them with `migration:schema/<NNN>_<change>.sql`.
 <!-- oracle-packs:end -->
 
 ## Companion SQL rules (retained in `docs/greptile-learnings/RULES.md`)

package/dispatch/write_sql.sh

@@ -18,7 +18,7 @@
 # (retained) and the GREPTILE GATE enforces them by review until a leaf exists.
 # SCH's teardown-era forbidden-token floor (no ALTER/DROP/SELECT 1; in schema/*.sql) is
 # itself a build-the-check (TODO-CHECK) candidate; the teardown-vs-ALTER disposition
-# call above it stays JUDGMENT (which file to rm, which @embedFile, which migration index).
+# call above it stays JUDGMENT (which file to rm, which migration index).
 
 source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
@@ -30,7 +30,7 @@ dispatch_header
 dispatch_length_gate 350                                       # FLL — file ≤ 350
 
 # ── judgment gates (no script can decide; agent states verdict in chat) ──
-dispatch_judgment "SCH" "removing/altering a table? cat VERSION and compare field by field, not as a string — below 0.30.0 = full teardown (rm schema/NNN.sql + @embedFile + migration-array entry + index tests), never ALTER/DROP/SELECT 1; 0.30.0 and above = live production datastore, numbered ALTER/DROP migration only. print the SCHEMA GUARD block"
+dispatch_judgment "SCH" "removing/altering a table? cat VERSION and compare field by field, not as a string — below 0.30.0 = full teardown (rm schema/NNN.sql + migration-array entry + index tests), never ALTER/DROP/SELECT 1; 0.30.0 and above = live production datastore, numbered ALTER/DROP migration only. print the SCHEMA GUARD block"
 dispatch_judgment "ITF" "integration test touching a production table? seed via src/db/test_fixtures_<scope>.zig against the real schema — never CREATE TEMP TABLE mocking the production shape"
 
 dispatch_verdict

package/docs/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.14.5 — 2026-10-17
+
+agentsfleet's schema conventions carry the owner-signed Postgres rules, and specs may run to 500 lines.
+
+- **Schema conventions** — placement in owned schemas, key and counter naming, RULE STS in full, timestamp categories, runtime SQL in `PREPARE`-checked `.sql` files, and SQLx's `Migrator` inside a bounded lock. Entities are named `fleet.*`.
+- **Spec cap** — the spec template gate allows 500 lines, up from 320.
+- **Schema guard** — the teardown flow no longer names the retired `schema/embed.zig`.
+
+## 0.14.4 — 2026-10-16
+
+The milestone-ID and UI-substitution audit no longer forks per staged file. A pre-commit stage of ~1,600 files that ran over 27 minutes now finishes in about two seconds, with verdicts unchanged.
+
+- **Scan** — one `git diff` and one `awk` cover the whole staged set. Reading the line above an added line now costs at most one `git show` per file with a candidate hit, down from one fork pair per added line.
+- **Compatibility** — verdicts, hit order and exit codes match 0.14.3 byte-for-byte across staged, `--diff` and explicit-file modes, including spaced, quoted and non-ASCII filenames, renames re-scanned as whole-file additions, and absolute explicit paths.
+
 ## 0.14.3 — 2026-10-15
 
 The REST API guide carries agentsfleet's conversation and reviewed-setup exceptions, and the TypeScript rules name how timestamps are labelled.

package/docs/RULE_ENFORCEMENT.md

@@ -8,13 +8,13 @@ regenerates this file and fails on any difference. To update it, run
 |---|---|--:|--:|--:|---|
 | `docs/LOGGING_STANDARD.md` | `LOG` → `logging.sh` | 10 | 13 | 30/30 | mechanical |
 | `docs/REST_API_DESIGN_GUIDELINES.md` | — | 0 | 0 | 0/69 | mechanical |
-| `docs/SCHEMA_CONVENTIONS.md` | — | 0 | 0 | 0/17 | mechanical |
+| `docs/SCHEMA_CONVENTIONS.md` | — | 0 | 0 | 0/12 | mechanical |
 | `docs/DOCUMENTATION_RULES.md` | — | 0 | 0 | 0/22 | latent |
 | `docs/LIFECYCLE_PATTERNS.md` | — | 0 | 0 | 0/22 | mechanical |
 | `docs/CHANGELOG_VOICE.md` | — | 0 | 0 | 0/3 | latent |
 | `docs/VERIFY_TIERS.md` | — | 0 | 0 | 0/4 | uncited |
 | `docs/greptile-learnings/RULES.md` | — | 0 | 0 | 0/115 | mechanical |
-| **corpus** | | | | **30/282** | |
+| **corpus** | | | | **30/277** | |
 
 ## How to read this
 

package/docs/SCHEMA_CONVENTIONS.md

@@ -13,102 +13,115 @@ with the real schema through shared fixture helpers.
 Keep migration registration and position assertions synchronized with each edit.
 
 <!-- oracle-packs:start product.agentsfleet -->
-Canonical reference for `agentsfleet` database schema patterns. All new tables **must** follow these conventions. Existing tables are brought into compliance when rebuilt.
+Canonical reference for `agentsfleet` database schema patterns. All new tables **must** follow these conventions. The table-by-table layout lives in the product repository's `docs/architecture/postgres_schemas.md`; this section carries the rules that layout follows.
 
 ## Migration Model
 
-**Teardown-rebuild is in force for the M154 rebuild (owner decision, Indy, Jul 31, 2026).** The development database is being dropped and re-created from empty while production is undeployed, so slots `001`–`046` are **retired wholesale** and the schema is re-authored by dependency layer. During this rebuild the frozen-slot rule below does not apply, and `ALTER`/`DROP` statements are forbidden rather than required — a change belongs in the base statement it would have patched. This is the posture RULE SCH already specifies for `VERSION < 0.30.0`; the Jul 22 additive model was the deviation.
+**Additive at `VERSION >= 0.30.0`.** Every schema change is a new numbered slot; shipped slots are frozen history. Destructive changes (`DROP TABLE`, `DROP COLUMN`, type rewrites) need an explicit owner decision per change. A from-empty rebuild past `0.30.0` happens only under an owner-recorded `SCHEMA GUARD: SKIPPED per user override (reason: …)` with the database dropped first — the M229 rebuild (Oct 17, 2026) is the precedent.
 
-**Additive migrations resume at `VERSION >= 0.30.0`, as RULE SCH specifies.**
-Completing the rebuild alone does not change the version boundary.
-Every subsequent schema change is a new numbered migration file; shipped slots
-are frozen history. Migrations are tracked incrementally through
-`agentsfleetd doctor --schema-gate`; use `IF NOT EXISTS` where appropriate for
-fresh bootstrap and an already provisioned database.
+## Migrator
 
-Destructive changes (`DROP TABLE`, `DROP COLUMN`, type rewrites) require an explicit owner decision per change — additive is the default an agent may author alone.
-
-> Historical note: slots `001`–`031` predate the additive model (teardown-rebuild with inline DDL edits, enforced by a since-removed `check-schema-gate` lint target). M154 retires them along with everything up to `046`.
+SQLx's `Migrator` applies the slots from the explicit list in `rustd/crates/afd_db/src/migration.rs` (`Migrator::with_migrations`; the `migrate` feature only, `macros` stays off). It keeps checksums, so an edited applied slot is refused, and records the ledger in the `audit` schema. Locking is ours: SQLx's lock is off (`set_locking(false)`) and a bounded `pg_try_advisory_lock` poll wraps the run, so a held lock fails loudly instead of hanging a deploy. Migrate refuses to start while a ledger from an older migrator exists.
 
 ## Schema File Organization
 
-- Each SQL file must be **≤100 lines** and **single-concern** (one table, one logical group, or one additive change).
-- Files are numbered sequentially: `001_core_foundation.sql`, `002_core_workflow.sql`, etc. New migrations append the next number; shipped numbers are never reused or slid.
-- Every SQL file must be registered in `schema/embed.zig` (compile-time embed) and `rustd/crates/afd_db/src/migration.rs` (migration version array).
-- Below `0.30.0`, remove obsolete slots and their registrations completely;
-  no-op markers are forbidden. At and above `0.30.0`, preserve shipped slots and
-  apply changes through new migrations.
+- One slot per table: the table, its local constraints, indexes and grants together; each file **≤100 lines**.
+- Slots are ordered by foreign key — a table follows every table it references, across schemas. A foreign key that closes a cycle (a head pointer, for example) gets its own registered slot after both tables exist, `DEFERRABLE INITIALLY DEFERRED`.
+- Every slot is registered in `rustd/crates/afd_db/src/migration.rs`; the `rust-migration-list` lint compares the list to the tracked files.
+- Shipped numbers are never reused or slid.
+
+## Placement and naming
+
+1. **Placement.** A table lives in the schema of the product area that owns it (`identity`, `authoring`, `fleet`, `runner`, `connector`, `model`, `billing`, `vault`, `memory`). Its name is a plural noun that never repeats the schema name: `authoring.drafts`, not `authoring.authoring_drafts`. A singleton is named for its one row and says so in its slot.
+2. **Foreign keys** end `_id` and name the table they point at (`user_id`, `draft_id`). A prefix names the role when the column alone would not say it (`invited_by_user_id`, `active_grant_id`, `last_runner_id`). A deliberately missing foreign key is explained in the slot comment.
+3. **Status** columns are named `status`; categories are `<thing>_type`. RULE STS applies in full and without override: no literal that names a value or identifier the application also names — a `DEFAULT`, a `CHECK (col IN (…))` list, a trigger comparison against a column, a `current_setting()` parameter name, or `RAISE EXCEPTION` text a caller matches on. A predicate that needs a state reads a NULL marker column; a privileged path (a purge, for example) is a grant, not a session setting. The only literals left are structural ones nothing in the application names: the UUID version nibble `'7'`, `TG_OP` values, and exception text no caller matches on.
+4. **Timestamps.** Every table has `created_at`; every table whose rows change has `updated_at`. Any other time column is one of: (a) a deadline named `*expires_at`; (b) a NULL marker an index or trigger reads; (c) a domain instant the API returns that `updated_at` cannot carry; (d) an accounting cursor billing reads.
+5. **One fact, one home.** No JSON blob copies a column; no counter restates another table's number. Named exceptions, each with its consistency rule in the slot: an aggregate maintained under the same lock or trigger as its source; a delivery snapshot that must outlive its source; a non-secret projection of encrypted content; a scope copy a restricted role needs to filter alone.
+6. **Retry keys** (`operation_id` plus a request digest) live only in receipt tables.
+7. **Every column names its reader** before it is created. Accounting and audit records are exempt when the slot names the export or verification that reads them.
+8. **A new table** carries a written answer to "why not a column, or an existing table".
+9. **Immutable tables** carry no `updated_at`, no UPDATE grant, and a trigger that refuses UPDATE. DELETE stays governed by grants and the deletion matrix, so cascades keep working.
+
+### Counter and pointer names
+
+| Kind | Name |
+|---|---|
+| Position within a parent (1, 2, 3…) | `sequence` |
+| Pointer to another table's position | `<thing>_sequence` |
+| Highest position so far | `last_<thing>_sequence` |
+| "Everything up to N" watermark | `<verb>_through_sequence` |
+| Global insertion order | `sequence` (identity column) |
+| Frozen content version | `revision`; pointer `<x>_revision_id`; the live one `head_revision_id` |
+| Compare-and-swap edit counter | `resource_version`, or `<scope>_version` when it covers one action |
+| Lease epoch | `fencing_token` |
+| Tally | `<thing>_count` |
+| Deadline | `*expires_at` |
+
+Wire field names (API and runner protocol) are not renamed by these rules.
+
+## Deletion matrix
+
+Every root a user or operator can delete — draft, user, Library card, fleet, workspace, tenant — has a stated row in the product's deletion matrix: what goes with it, what stays, and what is scrubbed at once. Money records (charges, settlements, the attempts they hang off) never cascade from an erasable owner; they keep opaque identifiers. Private text is scrubbed on every erasure path, not only the one that purges drafts.
 
 ## SQL Qualification
 
-- Use schema-qualified table names in SQL (`core.platform_llm_keys`, `core.workspaces`, etc.) for new queries and handlers.
+- Use schema-qualified table names in SQL (`identity.workspaces`, `fleet.fleets`).
 - Do not rely on session `search_path` defaults for correctness.
-- Legacy unqualified queries may remain temporarily, but touched paths should be migrated to schema-qualified names.
+
+## Runtime SQL
+
+- Every static statement lives in a `.sql` file beside the use case that runs it (for example `library/sql/list.sql`), loaded with `include_str!` and bound by a typed Rust function that states its parameters, authorization and locks.
+- Rows decode into named `FromRow` types selected by explicit column lists; `Json<T>` is for real JSON columns only; storage rows stay separate from wire types. No `to_jsonb(<row>)` whole-row reads.
+- One integration test `PREPARE`s every `.sql` file against the rebuilt schema, so a stale table or column fails before merge. A statement that must be assembled at run time is named in its module and covered by its own test.
+- Domain stores take the caller's connection or transaction; there is no generic repository trait.
+- Every pooled runtime connection carries `lock_timeout` and `statement_timeout` named constants; the migrate connection carries neither.
 
 ## Schema-Backed Runtime Defaults
 
-- If a numeric schema default is also used in runtime fallback or provisioning logic, define it once in Zig as a named constant and import that constant in runtime code.
-- Keep the database DDL value unchanged unless the product default is intentionally changing; the Zig constant mirrors the schema default for drift detection.
-- Add an adjacent `Canonical constant:` SQL comment next to each shared numeric default so reviewers can verify the linkage quickly.
+- A numeric schema default also used in runtime fallback or provisioning logic is defined once as a Rust named constant in the owning crate and referenced by the slot comment (`Canonical constant: crate::path::NAME`).
+- Keep the DDL value unchanged unless the product default is intentionally changing.
 
 ## Identity Column
 
-**One identity column per table, named `id` (owner decision, Indy, Jul 31, 2026 — M154).** The earlier `uid` rule paired a generated `uid` primary key with a duplicate twin column (`id`, `tenant_id`, `workspace_id`, …) holding the same value under its own `UNIQUE` constraint. That shape is retired.
+**One identity column per table, named `id` (owner decision, Indy, Jul 31, 2026 — M154).**
 
-- **Column:** `id`
-- **Type:** Universally Unique Identifier (UUID) `PRIMARY KEY`
-- **Generation:** Application-side UUID version 7 (UUIDv7) via `rustd/crates/afd_core/src/id.rs`, never `gen_random_uuid()`.
-- **No second unique key on the same value.** This is a correctness rule, not only a storage one: `ON CONFLICT` can arbitrate exactly one constraint, so a table carrying two unique keys over the same value makes two sessions inserting a brand-new row race to a duplicate-key error on the *other* index instead of taking the update arm. `schema/043_runner_lifetime_counters.sql` recorded this before the rule was generalised.
+- **Type:** Universally Unique Identifier (UUID) `PRIMARY KEY`, application-minted UUID version 7 (UUIDv7) through `afd_core::id`, never `gen_random_uuid()`.
+- **No second unique key on the same value.** `ON CONFLICT` arbitrates exactly one constraint, so two unique keys over one value make concurrent inserts race to a duplicate-key error on the other index.
 - **Foreign keys reference the primary key**, never a secondary unique constraint.
-- **Constraint:** every table carries a UUIDv7 CHECK:
-  ```sql
-  CONSTRAINT ck_{table}_id_uuidv7 CHECK (substring(id::text from 15 for 1) = '7')
-  ```
-- **Adding a new table:** add a `generate{TableName}Id()` function to `rustd/crates/afd_core/src/id.rs`.
-- **API shape:** unchanged — public fields keep exposing `id`, `tenant_id`, `workspace_id` and the other documented names. The column now *is* the public name in most tables, so the aliasing the old rule required mostly disappears; where a public field differs from `id`, alias at the boundary rather than renaming client-facing payloads.
-- **Exceptions,** each stated in the slot that creates the table: a curated catalogue keyed by a stable slug (`core.fleet_library`) and a singleton keyed by a pinned integer (`core.model_catalogue_revision`) carry no UUID.
+- **Constraint:** every UUID-keyed table carries `CONSTRAINT ck_{table}_id_uuidv7 CHECK (substring(id::text from 15 for 1) = '7')`.
+- **Exceptions,** each stated in its slot: a row that exists at most once per parent is keyed by the parent (`fleet.sessions`, `fleet.activity_counters`, `runner.fleet_slots`, `runner.lifetime_counters`, `billing.wallets`, `model.tenant_selections`); a singleton keyed by a pinned integer (`model.catalogue_version`); a natural key addressed by every statement (`model.platform_defaults` by `provider`).
 
 ## Timestamps
 
-- **Type:** `BIGINT NOT NULL` — milliseconds since Unix epoch.
-- **Generation:** `std.time.milliTimestamp()` in Zig application code.
-- **Never** use `TIMESTAMPTZ`, `TIMESTAMP`, or `DEFAULT now()`.
+- **Type:** `BIGINT NOT NULL` — milliseconds since the Unix epoch, from the application clock (`afd_core::clock::UnixMillis`).
+- **Never** `TIMESTAMPTZ`, `TIMESTAMP` or `DEFAULT now()`.
 
 ## Standard Columns
 
-Every table must have:
-
 | Column | Type | Required | Notes |
 |--------|------|----------|-------|
-| `id` | `UUID PRIMARY KEY` | Yes | UUIDv7, app-generated; the table's only identity column |
+| `id` | `UUID PRIMARY KEY` | Yes | UUIDv7, application-minted |
 | `created_at` | `BIGINT NOT NULL` | Yes | Set once at INSERT |
-| `updated_at` | `BIGINT NOT NULL` | If mutable | Set at INSERT and every UPDATE |
-
-**Naming is uniform.** `created_at` and `updated_at` are the only names for row lifecycle time — not `recorded_at`, `created_at_ms`, or `updated_at_ms`. A column carrying *domain* time distinct from row birth (for example the originating event's creation instant on a money row) is named for that domain meaning and documented in its slot.
-
-**Mutable tables** (any table where UPDATE is a valid operation) must have `updated_at`.
-
-**Append-only/event tables** (where UPDATE is blocked by trigger or by design) are exempt from `updated_at`.
+| `updated_at` | `BIGINT NOT NULL` | If the row ever changes | Set at INSERT and every UPDATE |
 
 ## Audit Pattern
 
-- **Actor tracking:** Use `actor TEXT` in event/transition tables (e.g., `policy_events`, `usage_ledger`).
-- **No `updated_by` column.** Changes to mutable tables are tracked via separate event-sourced audit tables (e.g., `workspace_billing_audit`, `harness_change_log`), not inline `updated_by`.
-- **Append-only enforcement:** Tables that must never be updated should have a trigger:
+- **Actor tracking:** `actor TEXT` in event and transition tables.
+- **No `updated_by` column.** Changes to mutable tables are tracked in event tables, not inline.
+- **Append-only enforcement:** an immutable table refuses UPDATE by trigger; DELETE follows grants and the deletion matrix.
   ```sql
-  CREATE OR REPLACE FUNCTION core.{table}_append_only() RETURNS trigger AS $$
+  CREATE OR REPLACE FUNCTION {schema}.{table}_refuse_update() RETURNS trigger AS $$
   BEGIN
-      RAISE EXCEPTION '{table} is append-only — UPDATE and DELETE are not permitted';
+      RAISE EXCEPTION '{table} is append-only';
   END;
   $$ LANGUAGE plpgsql;
 
-  CREATE TRIGGER trg_{table}_append_only
-      BEFORE UPDATE OR DELETE ON core.{table}
-      FOR EACH ROW EXECUTE FUNCTION core.{table}_append_only();
+  CREATE TRIGGER trg_{table}_refuse_update
+      BEFORE UPDATE ON {schema}.{table}
+      FOR EACH ROW EXECUTE FUNCTION {schema}.{table}_refuse_update();
   ```
 
-## RNG
+## Randomness
 
-- **Always** use `std.crypto.random` (via `allocUuidV7` in `id_format.zig`).
-- **Never** use custom RNG implementations or `std.rand`.
+- Identifiers and secrets come from `afd_core::id` and the operating system's cryptographic source; never a custom random number generator.
 <!-- oracle-packs:end -->

package/docs/TEMPLATE.md

@@ -17,7 +17,7 @@ Three markup classes appear below the divider. The gate tells them apart mechani
 | `tpl:` guidance comment | How to fill the section — written for the authoring agent only | **Deleted after filling.** The gate BLOCKs any survivor. |
 | SPEC AUTHORING RULES banner comment | Standing constraints on the instance | The one comment that survives, verbatim. |
 
-Everything else — headings, table skeletons, the standard rubric rows — is kept and filled. The result: the executing agent reads **100% instance content, zero template noise**, and the 320-line budget buys signal, not boilerplate.
+Everything else — headings, table skeletons, the standard rubric rows — is kept and filled. The result: the executing agent reads **100% instance content, zero template noise**, and the 500-line budget buys signal, not boilerplate.
 
 ## What a spec pins
 
@@ -89,7 +89,7 @@ A milestone is not complete until evidence is captured: commands, logs, screensh
 
 ## Guardrails
 
-- **Length — hard upper bound 320 lines for the filled spec** (after `tpl:` comment deletion). Typical specs 150–300. Past the bound before the Acceptance Rubric → scope is two specs sharing one file; split.
+- **Length — hard upper bound 500 lines for the filled spec** (after `tpl:` comment deletion). Typical specs 150–350. Past the bound before the Acceptance Rubric → scope is two specs sharing one file; split.
 - **Sections** — 3–9. **Workstreams** — ≤4 (5th cross-cutting only).
 - **File naming** — `docs/v{N}/{pending|active|done}/M{N}_{NNN}_P{Priority}_{CATEGORIES}_{NAME}.md` (e.g. `M40_001_P0_API_WORKER_SUBSTRATE.md`). Categories alphabetised.
 

package/docs/greptile-learnings/RULES.md

@@ -409,7 +409,7 @@ another product's version number never authorizes a rebuild here.
 
 <!-- oracle-packs:start product.agentsfleet -->
 
-**Rule:** While `cat VERSION` < 0.30.0 (teardown-rebuild era), removing tables MUST be a full teardown: (1) delete the SQL file (`rm schema/NNN_foo.sql`), (2) remove the `@embedFile` constant from `schema/embed.zig`, (3) remove the migration array entry from `rustd/crates/afd_db/src/migration.rs` and update its registration tests. Never write ALTER TABLE, DROP TABLE, or `SELECT 1;` placeholders. Never keep version-marker files. Migration slot numbers are not sacred pre-v0.30 — the DB is wiped on every rebuild, and gaps in numbering are fine. From VERSION >= 0.30.0 the datastore is live production data, so every removal or reshape is a numbered ALTER/DROP migration and the teardown path is closed. **Compare the version field by field, never as a string:** `0.29.0` is under the anchor, `0.30.0` is not, and a lexical compare puts `0.30.0` below `0.9.0` — the anchor moved off a major-number boundary precisely so the minor field decides.
+**Rule:** While `cat VERSION` < 0.30.0 (teardown-rebuild era), removing tables MUST be a full teardown: (1) delete the SQL file (`rm schema/NNN_foo.sql`), (2) remove the migration array entry from `rustd/crates/afd_db/src/migration.rs` and update its registration tests. Never write ALTER TABLE, DROP TABLE, or `SELECT 1;` placeholders. Never keep version-marker files. Migration slot numbers are not sacred pre-v0.30 — the DB is wiped on every rebuild, and gaps in numbering are fine. From VERSION >= 0.30.0 the datastore is live production data, so every removal or reshape is a numbered ALTER/DROP migration and the teardown path is closed. **Compare the version field by field, never as a string:** `0.29.0` is under the anchor, `0.30.0` is not, and a lexical compare puts `0.30.0` below `0.9.0` — the anchor moved off a major-number boundary precisely so the minor field decides.
 **Why:** Markers accumulate dead code and still force CI to splitter-parse them. Below 0.30.0 the development database is dropped and re-created from empty, so there is no production data to protect and full removal leaves no false grep hits or stale migration slots. At 0.30.0 that stops being true: the deployment holds data nobody can re-create, which is what makes an in-place migration the only safe shape from then on.
 **Tags:** sql, process
 **Example:** harness teardown — supersedes prior "replace with `SELECT 1;`" guidance. Under the old rule, comment-only markers broke CI (apostrophe in "slots" opened unterminated string in splitter); full deletion avoids the marker problem entirely.
@@ -1004,7 +1004,7 @@ Never infer the absence of deployed clients from another product's version.
 - RPC / handler signature changes → edit the existing struct + every caller in the same commit. No `Foo` and `FooV2`.
 - "Versioned" / "additive optional fields" framing in a spec is fine — what's banned is a *parallel* type, not nullable extensions on the existing one.
 - Removing a behavior → delete the function, the call sites, and any dispatch arm that selected it. Tests of the removed path go too.
-- Schema removals already covered by the Schema Table Removal Guard (rm file, rm `@embedFile`, rm migration array entry) — that's this rule applied to SQL.
+- Schema removals already covered by the Schema Table Removal Guard (rm file, rm migration array entry) — that's this rule applied to SQL.
 - Legacy-Design Consult Guard still fires when you find a *pre-existing* legacy shim left over from the v1→v2 teardown. This rule says: don't create new ones.
 - Command-line renames follow the same rule: if the product verb moves to `create`, do not add `add` as an alias. If a flag or command spelling changes, use the new spelling only unless Indy explicitly asks for a compatibility alias in the same session.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsfleet/orly",
-  "version": "0.14.3",
+  "version": "0.14.5",
   "description": "Repository-scoped engineering harness: renders agent rules, materialises the gates that enforce them, and proves the PR boundary \u2014 for any coding agent.",
   "license": "MIT",
   "type": "module",

package/src/install_packs.test.ts

@@ -44,7 +44,7 @@ describe("opt-in pack selection", () => {
     const installed = await Promise.all(pages.map((path) => Bun.file(join(repo, ".orly", path)).text()));
     for (const content of installed) {
       expect(content).not.toContain("playbooks/founding/");
-      expect(content).not.toContain("schema/embed.zig");
+      expect(content).not.toContain("rustd/crates/afd_db/src/migration.rs");
       expect(content).not.toContain("src/cmd/common.zig");
       expect(content).not.toContain("build_runner.zig");
       expect(content).not.toContain("~/Projects/docs/");
@@ -73,7 +73,7 @@ describe("opt-in pack selection", () => {
     const sql = await Bun.file(join(repo, ".orly/dispatch/write_sql.md")).text();
     const zig = await Bun.file(join(repo, ".orly/dispatch/write_zig.md")).text();
     expect(sql).toContain("0.30.0");
-    expect(sql).toContain("schema/embed.zig");
+    expect(sql).toContain("rustd/crates/afd_db/src/migration.rs");
     expect(sql).toContain("**Forbidden:**");
     expect(zig).toContain("build_runner.zig");
   });

package/src/scanner_scope.test.ts

@@ -30,6 +30,10 @@ const ERROR_TYPE = "pub struct Error;\n";
 const VALUE_INIT = "pub fn init() Self { return .{}; }\n";
 const ALLOCATING_INIT = "pub fn init(a: std.mem.Allocator) !Self { const owned = try a.alloc(u8, COUNT); return .{ .owned = owned }; }\n";
 const DIFF = "--diff";
+const SPACED = "lib/has space.ts";
+const TRAILING_SPACE = "lib/trail .ts";
+const OVERRIDE = "MILESTONE ID ALLOWED per user override (reason: pin)";
+const MARKED_T = 'const t = "T' + '7";\n';
 const SCANNERS = ["ufs.sh", "logging.sh", "deinit-pairs.sh", "sql-mod.sh", "error-codes.sh", "rust-error.sh", "design-tokens.sh"];
 
 setDefaultTimeout(TEST_TIMEOUT_MS);
@@ -189,6 +193,39 @@ test("diff marker explicit files use working bytes and missing comparisons refus
   expect(missing.text).toContain("comparison revision is missing: missing-revision");
 });
 
+test("diff markers survive spaced and trailing-space filenames", async () => {
+  const project = newRepository();
+  await staged(project, SPACED, MARKED);
+  await staged(project, TRAILING_SPACE, MARKED);
+  const result = scan(project, "audits/msid-ui.sh", [STAGED]);
+  expect(result.code).toBe(1);
+  expect(result.text).toContain(`MS-ID  ${SPACED}: // ${MARKER}`);
+  expect(result.text).toContain(`MS-ID  ${TRAILING_SPACE}: // ${MARKER}`);
+});
+
+test("pure rename re-scans the file as a whole-file addition", async () => {
+  const project = newRepository();
+  await staged(project, "lib/old.ts", MARKED);
+  git(project, COMMIT, "-qm", "test: seed rename");
+  git(project, "mv", "lib/old.ts", "lib/new.ts");
+  const result = scan(project, "audits/msid-ui.sh", [STAGED]);
+  expect(result.code).toBe(1);
+  expect(result.text).toContain(`MS-ID  lib/new.ts: // ${MARKER}`);
+});
+
+test("explicit absolute paths keep the caller path and read its post-image", async () => {
+  const project = newRepository();
+  const absolute = join(temporaryDirectory(), "outside.ts");
+  await Bun.write(absolute, `// ${OVERRIDE}\n${MARKED_T}`);
+  const suppressed = scan(project, "audits/msid-ui.sh", [absolute]);
+  expect(suppressed.code).toBe(0);
+  expect(suppressed.text).toContain("0 hits");
+  await Bun.write(absolute, MARKED_T);
+  const flagged = scan(project, "audits/msid-ui.sh", [absolute]);
+  expect(flagged.code).toBe(1);
+  expect(flagged.text).toContain(`MS-ID  ${absolute}: const t = "T` + `7";`);
+});
+
 test("indexed source links cannot read outside their owned snapshot", async () => {
   const project = newRepository();
   const external = join(temporaryDirectory(), "owner.ts");

package/src/spec_template.test.ts

@@ -104,6 +104,13 @@ describe("spec content readiness", () => {
   });
 
   test("oversize specs report their measured size against the cap", () => {
-    expect(validateSpec(`${VALID}\n${"line\n".repeat(320)}`, COMMANDS, EXISTS).join("\n")).toMatch(/spec has \d+ lines; cap 320/);
+    expect(validateSpec(`${VALID}\n${"line\n".repeat(500)}`, COMMANDS, EXISTS).join("\n")).toMatch(/spec has \d+ lines; cap 500/);
+  });
+
+  test("a spec at the cap passes and one line over fails", () => {
+    const base = VALID.trimEnd();
+    const padded = (lines: number) => `${base}\n${Array(lines - base.split(/\r?\n/).length).fill("line").join("\n")}`;
+    expect(validateSpec(padded(500), COMMANDS, EXISTS).join("\n")).not.toMatch(/cap 500/);
+    expect(validateSpec(padded(501), COMMANDS, EXISTS)).toContain("spec has 501 lines; cap 500");
   });
 });