@agentsfleet/orly 0.6.4 → 0.6.6

package/audits/agents-md.md

@@ -222,7 +222,7 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 
 | # | Question | Expected |
 |---|---|---|
-| 17.1 | Does `conn.query()` require `.drain()` in the same function before `deinit()`, with `make lint-governance` verifying (it wraps `_lint_zig_pg_drain`, the drain check that actually exists)? | YES |
+| 17.1 | Does `conn.query()` require `.drain()` in the same function before `deinit()`, with the repository's own convention gate verifying it? | YES |
 | 17.2 | Is `conn.exec()` the prescribed alternative when no rows are needed? | YES |
 
 ### Scenario 18 — Commit/push hygiene & worktree isolation

package/audits/ufs.sh

@@ -4,6 +4,12 @@
 # Dispatch façade: dispatch/write_any.md (UFS Gate)
 # Fires in: make lint, CONFORM.
 #
+# Languages read: Zig, TypeScript, JavaScript, Rust, Go (see `is_source`, which
+# carries the pack that owns each extension and the reasons `.py` / `.sh` are
+# held out). The set is pinned against the dispatch facade by the engine
+# dispatch-coverage audit — a facade that fires on a language its leaf cannot
+# read is a gate that prints green over an unscanned file.
+#
 # Generic detection — no manifest of known literals, so the audit scales
 # as the codebase grows. Three classes of violation:
 #
@@ -15,9 +21,11 @@
 #
 # Carve-out: any `// pin test: literal is the contract` comment on or
 # above the offending line excludes that line from numeric-suspect.
-# A `const` / `pub const` / `export const` declaration line is likewise
-# exempt for both per-file checks (is_const_decl + its string-dup mirror
-# below) — binding the literal to a name on a const line clears the hit.
+# A `const` / `pub const` / `export const` / `static` declaration line is
+# likewise exempt for both per-file checks (is_const_decl + its string-dup
+# mirror below) — binding the literal to a name on that line clears the hit.
+# Go states the keyword once for a whole `const ( ... )` group; the string-dup
+# lane tracks the group so its members are read as the declarations they are.
 #
 # Staged-scope semantics: --staged narrows WHICH FILES are scanned, not
 # how much of each — a staged file is audited in FULL, so staging a file
@@ -69,14 +77,34 @@ ok()     { printf "OK:   %s\n" "$*"; }
 
 # ── File scope ──────────────────────────────────────────────────────────────
 
+# The extension set is the CONTRACT the dispatch façade already advertises:
+# dispatch/write_any.sh's `dispatch_init "ANY" ...` list is what fires the gate,
+# and this list is what the gate then reads. When the two disagree the façade
+# runs, prints green, and has scanned nothing — which is exactly how a Rust
+# crate carried `const S_PING = "PING"` past a gate that claimed to cover it.
+# The engine fails its own dispatch-coverage audit on that drift now, so a
+# language added to the façade must land here, or be named out of scope with a
+# reason, before that audit goes green again.
+#
+#   .zig                     language.zig
+#   .ts .tsx                 language.typescript
+#   .js .jsx                 language.javascript
+#   .rs                      language.rust
+#   .go                      language.go
+#
+# Out of scope, deliberately — the engine keeps the machine-readable twin of
+# this list: `.py` (single-quoted literals dominate and the
+# double-quote matcher below would report partial coverage as full), `.sh`
+# (a repeated `"$var"` is interpolation, not a magic string — measured at 59%
+# of hits on a real tree), `.sql` (its own gate, dispatch/write_sql.sh).
 is_source() {
   local f="$1"
   case "$f" in
     vendor/*|third_party/*|.zig-cache/*|*/node_modules/*|evals/dispatch/fixtures/*|*.tsbuildinfo) return 1 ;;
-    *_test.zig|*.test.ts|*.test.tsx|*.test.js|*.test.jsx|*.unit.test.js|*.spec.ts) ;; # tests in scope
+    *_test.zig|*.test.ts|*.test.tsx|*.test.js|*.test.jsx|*.unit.test.js|*.spec.ts|*_test.go) ;; # tests in scope
   esac
   case "$f" in
-    *.zig|*.ts|*.tsx|*.js|*.jsx) return 0 ;;
+    *.zig|*.ts|*.tsx|*.js|*.jsx|*.rs|*.go) return 0 ;;
     *) return 1 ;;
   esac
 }
@@ -112,9 +140,21 @@ while IFS= read -r row; do
 done < <(awk '
   FNR == 1 {
     prev_file = FILENAME
+    # Language lane. Each lane below carves out what its syntax makes
+    # UNFIXABLE — a literal a named const cannot legally replace. Anything
+    # a const CAN replace stays in scope, in every language.
+    lang = "other"
+    if (FILENAME ~ /\.zig$/)             lang = "zig"
+    else if (FILENAME ~ /\.rs$/)         lang = "rust"
+    else if (FILENAME ~ /\.go$/)         lang = "go"
     # Test files: repetition is fixture data, not magic strings.
     # Skip string-dup-file for tests; other checks still apply.
-    is_test = (FILENAME ~ /(_test\.zig|\.test\.|\.spec\.|\.unit\.test|\.integration\.test|\/test\/|\/tests\/)/)
+    is_test = (FILENAME ~ /(_test\.zig|_test\.go|\.test\.|\.spec\.|\.unit\.test|\.integration\.test|\/test\/|\/tests\/)/)
+    # Directory-shaped test and benchmark trees. Rust puts both at the CRATE
+    # ROOT (`tests/`, `benches/`) with no leading slash, so the `\/tests\/`
+    # form above — which needs a parent directory — walked straight past them
+    # and audited 100 fixture hits as production literals.
+    if (FILENAME ~ "(^|/)(test|tests|benches|__tests__)/") is_test = 1
   }
   is_test { next }
   # ui/ files: extracting class-strings or short literals to file-local
@@ -126,7 +166,7 @@ done < <(awk '
   # ("nonterminated character class"); use a dynamic-regex STRING — identical
   # match on gawk, portable on BWK awk (the macOS default). Do not re-inline.
   FILENAME ~ "^ui/packages/[^/]+/(src|app|tests|components|lib|hooks)/" { next }
-  FNR == 1 { in_test_block = 0; test_depth = 0; in_block_comment = 0 }
+  FNR == 1 { in_test_block = 0; test_depth = 0; in_block_comment = 0; in_rs_test = 0; rs_open = 0; rs_depth = 0; in_go_const = 0 }
   {
     line = $0
     # Block-comment exclusion (TS/JS/Zig non-applicable): skip lines inside /* ... */
@@ -139,9 +179,9 @@ done < <(awk '
       next
     }
     # Zig multi-line string literal — lines start with `\\` after whitespace.
-    if (FILENAME ~ /\.zig$/ && line ~ /^[[:space:]]*\\\\/) next
+    if (lang == "zig" && line ~ /^[[:space:]]*\\\\/) next
     # Inline-test exclusion (Zig): track depth across `test "..." {` blocks.
-    if (FILENAME ~ /\.zig$/) {
+    if (lang == "zig") {
       if (in_test_block) {
         test_depth += gsub(/\{/, "{", line) - gsub(/\}/, "}", line)
         if (test_depth <= 0) in_test_block = 0
@@ -156,6 +196,54 @@ done < <(awk '
         next
       }
     }
+    # Inline-test exclusion (Rust): Rust keeps its unit tests INSIDE the file
+    # they cover, under `#[cfg(test)] mod tests { ... }`, so without this the
+    # fixture keys of a well-tested module read as the worst literal debt in
+    # the production half of that same file — a real crate reported `"key1"`
+    # 15 times from one such block. Same brace-depth shape as the Zig branch.
+    if (lang == "rust") {
+      if (in_rs_test) {
+        tmp = line
+        rs_depth += gsub(/\{/, "{", tmp) - gsub(/\}/, "}", tmp)
+        if (!rs_open && index(line, "{") > 0) rs_open = 1
+        if (rs_open && rs_depth <= 0) in_rs_test = 0
+        else if (!rs_open && line ~ /;[[:space:]]*$/) in_rs_test = 0
+        next
+      }
+      # Three ways Rust marks a block as fixture data, not shipped behaviour:
+      # `#[cfg(test)]`, a `#[test]`/`#[tokio::test]` function, and a
+      # FEATURE-GATED test seam — `#[cfg(feature = "test-util")]`, the
+      # convention for a helper that must compile into the crate so an
+      # integration test in a sibling file can call it (a `one_of_each_kind`
+      # error-surface enumerator is the usual shape). The feature name is
+      # matched narrowly, `test` as a whole word or a `-`/`_` segment, so a
+      # production gate like `#[cfg(feature = "redis")]` still counts and
+      # `"latest"` is not mistaken for a test seam.
+      if (line ~ /^[[:space:]]*#\[cfg\(test\)\]/ ||
+          line ~ /^[[:space:]]*#\[[A-Za-z_:]*test\]/ ||
+          line ~ /^[[:space:]]*#\[cfg\(.*feature[[:space:]]*=[[:space:]]*"([A-Za-z0-9]+[-_])?test(ing)?([-_][A-Za-z0-9_-]+)?"/) {
+        in_rs_test = 1; rs_open = 0; rs_depth = 0
+        next
+      }
+      # Attribute literals are UNFIXABLE, not undisciplined. `#[serde(rename =
+      # "...")]`, `#[cfg(feature = "...")]` and `#[doc = "..."]` take a literal
+      # token by language rule — a const is not accepted there, so naming one
+      # cannot resolve the hit and reporting it only teaches people to ignore
+      # the gate. Ordered after the cfg(test) branch, which is also a `#[`.
+      if (line ~ /^[[:space:]]*#!?\[/) next
+    }
+    # Grouped-const exclusion (Go): `const ( ... )` states the binding keyword
+    # ONCE, on the opening line, so a member like `metaKeyQoS = "conf_..."` is
+    # a definition carrying no `const` for the binding carve-out below to see.
+    # `var (` groups are deliberately NOT tracked — the carve-out is const-only
+    # in every other language and widening it here would be a silent divergence.
+    if (lang == "go") {
+      if (in_go_const) {
+        if (line ~ /^[[:space:]]*\)/) { in_go_const = 0; next }
+        if (line ~ /^[[:space:]]*[A-Za-z_][A-Za-z0-9_]*([[:space:]]+[A-Za-z0-9_.\[\]*]+)?[[:space:]]*=/) next
+      }
+      else if (line ~ /^[[:space:]]*const[[:space:]]*\([[:space:]]*$/) { in_go_const = 1; next }
+    }
     sub(/\/\/.*$/, "", line)
     # Strip single-line /* ... */ inline block comments (jsdoc/etc) so
     # literals inside them are not counted.
@@ -171,11 +259,23 @@ done < <(awk '
     # like any other use. (A prior line-level skip exempted those too and silently
     # gutted the check for most Zig code; the ufs_dup_string eval fixture pins the
     # binding-level semantic.)
-    if (line ~ /(^|[[:space:]])(pub[[:space:]]+const|export[[:space:]]+const|const)[[:space:]]+[A-Za-z_$][A-Za-z0-9_$]*([[:space:]]*:[^=]*)?[[:space:]]*=[[:space:]]*"((\\.)|[^\\"])+"[[:space:]]*(as[[:space:]]+const)?[[:space:]]*[;,]?[[:space:]]*$/) next
+    # `static` joins the keyword set for Rust: `static NAME: &str = "..."` binds
+    # a literal to a name exactly as `const` does, and the leading
+    # `(^|[[:space:]])` anchor already carries the `pub`/`pub(crate)` prefixes.
+    # The second type slot belongs to Go, which spells the type with no colon
+    # (`const name string = "..."`), which the colon-only slot could not see.
+    if (line ~ /(^|[[:space:]])(pub[[:space:]]+const|export[[:space:]]+const|const|static)[[:space:]]+[A-Za-z_$][A-Za-z0-9_$]*([[:space:]]*:[^=]*|[[:space:]]+[A-Za-z_][A-Za-z0-9_.\[\]*]*)?[[:space:]]*=[[:space:]]*"((\\.)|[^\\"])+"[[:space:]]*(as[[:space:]]+const)?[[:space:]]*[;,]?[[:space:]]*$/) next
     rest = line
     # Strip Zig identifier-escape syntax @"name" — body is an identifier,
     # not a string literal, but the regex below would otherwise match it.
     gsub(/@"[^"]*"/, "", rest)
+    # Strip Go backtick runs. They are overwhelmingly struct tags
+    # (`json:"id" yaml:"id"`), whose quoted halves are tag SYNTAX addressed by
+    # reflection — a const cannot appear inside one, so the repeat is unfixable.
+    # This also drops single-line Go raw strings, which is the accepted cost:
+    # the alternative reports every `json:"id"` in a wire struct as a violation.
+    # A backtick run spanning lines is not tracked (best-effort, as documented).
+    if (lang == "go") gsub(/`[^`]*`/, "", rest)
     # Strip empty string literals so the regex below cannot fuse
     # two adjacent Zig literals through their inner gap.
     gsub(/""/, "", rest)
@@ -229,7 +329,7 @@ done < <(awk -v re="$NUMERIC_RE" '
     line = $0
     is_pin_now   = (line ~ /pin test: literal is the contract/)
     is_pin_above = (prev ~ /pin test: literal is the contract/)
-    is_const_decl = (line ~ /(^|[[:space:]])(pub[[:space:]]+const|export[[:space:]]+const|const)[[:space:]]/)
+    is_const_decl = (line ~ /(^|[[:space:]])(pub[[:space:]]+const|export[[:space:]]+const|const|static)[[:space:]]/)
     stripped = line
     sub(/\/\/.*$/, "", stripped)
     sub(/#.*$/, "", stripped)

package/dispatch/lifecycle.md

@@ -31,7 +31,9 @@ own Bun project needing install + build. `git worktree add` fires
 into the tree; on 🟠 run `provision-env-1password`, re-link. Post-merge:
 `git worktree remove ../agentsfleet-mNN-name`.
 
-**agentsfleet Test Baseline counter:** `make _lint_zig_test_depth`.
+**Test Baseline counter.** A repository whose declared `verify.unit` does not
+print a total names its own counter here. Without one, record the count the
+declared command reports.
 
 **agentsfleet CHORE(close) paths:** the `<Update>` lands in
 `~/Projects/docs/changelog.mdx` (template + version-bump matrix:

package/dispatch/verify.md

@@ -11,8 +11,8 @@ edit. (This is the former Verification gate absorbed into the dispatch model.)
 
 - 🤔 DECIDE — judgment-only; the agent must run the targets below and report
   honestly. No script gates this — it blocks the *turn*, not a commit.
-- 🟣 delegated — the `make` targets themselves live in the product repo; dotfiles
-  carries only the discipline of *which* targets are canonical and when.
+- 🟣 delegated — the `make` targets themselves live in the product repository;
+  this pack carries only the discipline of *which* targets are canonical and when.
 
 ## Trigger
 
@@ -27,35 +27,35 @@ pass".
 
 ## Why `make` is canonical
 
-Package-scoped runners (`bun run test`, `vitest <file>`, `zig build test` without
-the integration tier) are **not** verification — they skip cross-package lint,
-cross-compile, pg-drain, and integration. `make` targets are the canonical gates.
+Package-scoped runners (`bun run test`, `vitest <file>`, `cargo test -p <crate>`)
+are **not** verification — they skip every other package's lint and tests and the
+cross-language gates. The declared `make` targets are the canonical gates.
 
 ## Required runs
 
 | Target | When |
 |---|---|
-| `make lint` | Always. |
-| `make test` | Always (tier 1, unit-only by definition). |
-| `make test-integration` | Tier 2: diff touches HTTP handlers, schema, DB code, Redis code, or any `_integration_test.zig`. Focused subsets: `make test-integration-db` / `make test-integration-redis`. |
-| `make test-integration` | Tier 3: at least once per branch before declaring ship-ready, from a clean state (e.g. after `make down`) when tier 2 is intermittent — fresh DB proves no state carry-over. |
-| `make memleak` | Server lifecycle (`src/http/**`, `src/cmd/serve.zig`), allocator wiring, cross-thread heap ownership. |
+| `make lint-all` | Always. The declared `verify.lint`. |
+| `make test-unit-all` | Always. The declared `verify.unit` — the cargo workspace plus every package coverage gate. |
+| `make harness-verify` | Always. The declared `conform` — the deterministic gate audit. |
+| `make check-version` | Always. The declared `verify.version`. |
+| `make wire-fixtures` | The `/v1/runners` wire types changed. Regenerate, then review the diff — a changed fixture IS the wire change. |
 | `make bench` (local) | Diff touches request-path code, allocator wiring, or startup/shutdown sequencing. |
 | `API_BENCH_URL=https://api-dev.agentsfleet.net/healthz make bench` | After branch deploys to dev. |
-| Cross-compile `x86_64-linux` + `aarch64-linux` | Whenever `*.zig` touched. |
-| `make check-pg-drain` | Whenever `*.zig` touched. |
 | `/orly-write-integration-test` (skill) | With `/orly-write-unit-test` at VERIFY when the diff crosses module boundaries with real I/O; otherwise record `N/A — <reason>`. |
-| Acceptance e2e (product repo's live tier) | Diff touches a surface the live/acceptance tier covers — relevant acceptance suites green, or their opt-in skip matrix recorded. |
+| Acceptance e2e (live tier) | Diff touches a surface the live/acceptance tier covers — relevant suites green, or their opt-in skip matrix recorded. |
 
-`make test` never substitutes for tier 2/3. Tier 2 passing but tier 3 failing
-means state pollution — fix isolation before shipping.
+There is no slow tier. The Zig integration and memory-leak lanes retired with the
+rest of the Zig gating, so nothing a developer runs needs live Postgres or Redis.
+A package-scoped runner (`cargo test -p afd_wire`, `bun run test` inside a
+package) proves that package and never the repository.
 
-## Memleak evidence rule
+## Wire-fixture evidence rule
 
-Before CHORE(close) reports green, paste the final `make memleak` result line into
-the PR Session Notes block OR cite the CI memleak job URL. Branches touching
-`src/http/**`, `src/cmd/serve.zig`, or allocator wiring MUST include the last 3
-lines verbatim. No "I ran it, trust me."
+A diff that regenerates `samples/fixtures/wire-v2/` carries the regenerated
+fixtures in the same commit as the type change, and the PR Session Notes say what
+moved. A fixture diff with no type change beside it means someone hand-edited
+generated output; a type change with no fixture diff means the emitter never ran.
 
 ## Coverage discipline
 
@@ -73,7 +73,7 @@ lines verbatim. No "I ran it, trust me."
 **Success:**
 
 ```
-✅ Verified: 🧪 lint ✓ · 🧪 test ✓ <N>p/<M>s · 🧩 test-integration ✓ (or N/A — no handler/schema/redis) · 🎯 cross-compile ✓ (zig only)
+✅ Verified: 🧪 lint-all ✓ · 🧪 test-unit-all ✓ <N>p/<M>s · 🔆 harness-verify ✓ · 🔆 check-version ✓
 ```
 
 **Failure (any required target failed):**
@@ -107,5 +107,4 @@ missing from the table counts as ❌.
 | 🟠 | Skipped per environment constraint — read the reason |
 | 🧪 | Lint / unit / integration test |
 | 🧩 | Integration test (cross-process) |
-| 🎯 | Cross-compile target |
 | 🔆 | Informational note (does not affect verdict) |

package/dispatch/write_any.md

@@ -343,7 +343,13 @@ ERROR REGISTRY GATE: <file>
 **Family:** Constant discipline. **Source:** `AGENTS.md` conformance enforcement
 + the selected language façade's Uniform Free Strings (UFS) clauses.
 
-**Triggers** — every `Edit`/`Write` to source files under `src/`, `ui/packages/*/src/`, `ui/packages/*/app/`, `ui/packages/*/lib/`, `ui/packages/*/components/`, `ui/packages/*/pages/`, `ui/packages/*/tests/`, `agentsfleet/src/`, `agentsfleet/test/` matching `*.zig`, `*.ts`, `*.tsx`, `*.js`, `*.jsx`. Excluded: `vendor/`, `third_party/`, `.zig-cache/`, `node_modules/`, `*.tsbuildinfo`.
+**Triggers** — every `Edit`/`Write` to a source file under the repository's own source surfaces — the `surfaces.user` prefixes it declares in `.oracle/orly.json`, or its source roots where it declares none — matching `*.zig`, `*.ts`, `*.tsx`, `*.js`, `*.jsx`, `*.rs`, `*.go`. Excluded: `vendor/`, `third_party/`, `.zig-cache/`, `node_modules/`, `*.tsbuildinfo`. `*.py` and `*.sh` fire this façade but are held out of the UFS leaf — see Scope. Each repository binds its own prefixes; naming one repository's layout here is what sends every other repository a trigger list it cannot match.
+
+<!-- oracle-packs:start product.agentsfleet -->
+In this repository those surfaces are `src/` (Zig), `rustd/crates/*/src/` (Rust), `cli/src/` and `ui/packages/*/{src,app,lib,components,pages,tests}/` (TypeScript).
+
+`agentsfleet/src/` and `agentsfleet/test/` were listed here until they stopped existing. A trigger path that resolves to nothing is the same silent green this card's gate exists to prevent — and the identical stale prefix in `ufs.sh`'s cross-runtime parity scan means its JavaScript half reads zero files today.
+<!-- oracle-packs:end -->
 
 **Override:** `UFS GATE: SKIPPED per user override (reason: ...)` immediately preceding the edit. **User-only**; auto-mode does not cover.
 
@@ -376,12 +382,16 @@ Before saving an edit that introduces or relocates a literal:
 
 1. **Same-file repeat?** Grep within the file for the literal value. If it appears ≥1 time already, define a const at the top of the file (or in the module's `constants.ts`/`constants.zig`) and replace all occurrences.
 
-2. **Same-module repeat?** Grep within the module/package (`ui/packages/app/`, `agentsfleet/src/`, `src/`). If repeated, define in the module's canonical types/constants file (`lib/types.ts`, `src/state/<topic>.zig`, `agentsfleet/src/constants/<topic>.js`).
+2. **Same-module repeat?** Grep within the module or package that owns the file. If repeated, define it in that module's canonical constants file and replace every occurrence.
 
-3. **Cross-runtime sibling?** When the literal is a wire-format string or unit-conversion numeric, grep all three runtimes for an existing matching name. If found, reuse the name. If not, define in every runtime that uses the same value, same commit.
+3. **Cross-runtime sibling?** When the literal is a wire-format string or unit-conversion numeric, grep **every runtime this repository ships** for an existing matching name. If found, reuse it verbatim. If not, define it in each runtime that carries the value, same commit. A single-runtime repository answers this in one grep — the check is about the runtimes that exist, not a fixed count.
 
 4. **Carve-out check?** If the literal IS the contract a pin test verifies, write the `// pin test: literal is the contract` comment on or above the line. Otherwise, name it.
 
+<!-- oracle-packs:start product.agentsfleet -->
+Concretely here: modules are `src/` (Zig), `rustd/crates/*/` (Rust), `cli/src/` and `ui/packages/*/` (TypeScript), and their canonical constants files are `src/state/<topic>.zig`, the crate's own `constants.rs`, and `lib/types.ts`. The runtimes to grep in step 3 are Zig, TypeScript and Rust.
+<!-- oracle-packs:end -->
+
 #### Required output (per Edit/Write — one line by default)
 
 > [DETERMINISTIC → UFS]
@@ -411,6 +421,19 @@ The previous `--diff` (`BASE...HEAD`) default was retired with M70. The forcing
 
 `--all` is accepted as a back-compat alias for the default. `--diff` is rejected with exit 2 + a pointer to this section.
 
+**Languages the leaf reads.** Zig, TypeScript, JavaScript, Rust and Go. The rule is one rule, but each language hides its literals differently, so each gets a lane in `is_source` + the string-dup pass:
+
+| Language | Held out of the count, and why |
+|---|---|
+| Rust | `#[cfg(test)]` / `#[test]` blocks (unit tests live *inside* the file they cover), feature-gated test seams (`#[cfg(feature = "test-util")]` — a helper that must compile into the crate so a sibling integration test can call it), `#[…]` attribute literals (`#[serde(rename = "…")]` takes a literal token by language rule — no const is legal there), `static` bindings alongside `const` |
+| Go | `const ( … )` group members (the keyword is stated once, on the opening line), backtick struct tags (`json:"id"` is read by reflection; a const cannot appear inside one) |
+
+The test-seam match is deliberately narrow — `test` as a whole word or a `-`/`_` segment — so a production gate like `#[cfg(feature = "redis")]` still counts and `"latest"` is not mistaken for a seam. `ufs_feature_gate.rs` pins that: widening it turns the fixture green.
+
+`*.py` and `*.sh` are **out of scope on purpose**, and the engine pins the reason in its own dispatch-coverage audit: Python writes ~14% of its literals in single quotes the matcher does not read, so it would report partial coverage as full; and a repeated `"$var"` in shell is interpolation, not a magic string — 59% of hits on a real tree, with no `const` to bind to. Adding either means building its lane first, not widening the glob.
+
+**A façade that fires on a language its leaf cannot read is a silent green.** `write_any.sh` has declared `*.rs` and `*.go` since those packs existed while `ufs.sh` read neither, so the gate printed a green UFS row over a file it never opened — and a Rust crate shipped a bare, twice-spelled wire verb under it. The engine now fails its dispatch-coverage audit on that divergence: every extension the façade claims is read by the leaf, or carries a written reason it is not.
+
 #### Self-audit (end-of-turn / CONFORM)
 
 > [DETERMINISTIC → UFS]

package/dispatch/write_zig.md

@@ -56,7 +56,7 @@ For every commit that touches `*.zig`, the agent runs the workflow below — no
 > [DETERMINISTIC → DRAIN]
 
 - Run `make lint`, `make test`, and `gitleaks detect` before any commit that includes Zig changes.
-- Run `TEST_DATABASE_URL=postgres://agentsfleet:agentsfleet@localhost:5432/agentsfleetdb make test-integration-db` when touching DB-backed handlers, proposal flows, or temp-table-based Zig tests.
+- Run the repository's database-backed integration lane, with `TEST_DATABASE_URL` pointed at its test database, when touching DB-backed handlers, proposal flows, or temp-table-based Zig tests.
 - Read this file before creating any new `*.zig` file.
 - Use `conn.exec()` for INSERT / UPDATE / DDL whenever possible.
 - Drain early-exit `conn.query()` results before `deinit()`.
@@ -270,7 +270,7 @@ Canonical source: `src/http/test_harness.zig`. Every `*_http_integration_test.zi
 
 - **Do not** define a local `TestServer` / `RunningServer` struct, local `startTestServer()` / `startServer()`, local `sendReq()` / `sendRequest()`, or local `waitForServer()`. These are provided by `TestHarness` with a fluent Request/Response API.
 - **Do** wire middleware via `Config.configureRegistry: fn(*MiddlewareRegistry, *TestHarness) anyerror!void`. The harness is policy-agnostic; each suite supplies only the middleware it exercises.
-- **Integration tests run against the LIVE test DB** — never `CREATE TEMP TABLE` in an integration test. Fixtures go through the real schema so the code under test sees production-shaped rows. The `make test-integration` gate resets schemas via `_reset-test-db`; individual tests clean up their own rows explicitly in the test body (not via `defer`) because deferred cleanup leaks pool connections at `pool.deinit()`.
+- **Integration tests run against the LIVE test DB** — never `CREATE TEMP TABLE` in an integration test. Fixtures go through the real schema so the code under test sees production-shaped rows. The integration lane resets schemas before the suite; individual tests clean up their own rows explicitly in the test body (not via `defer`) because deferred cleanup leaks pool connections at `pool.deinit()`.
 - **Test fixtures live in a sibling `*_test_fixtures.zig`** beside the integration file, or in a shared fixture module — not inlined. See `src/http/webhook_test_fixtures.zig` for the pattern.
 - **Skip gracefully when DB is absent** — `TestHarness.start` returns `error.SkipZigTest` when `TEST_DATABASE_URL` is unset; tests just propagate it.
 - New file registration: add `_ = @import("..._test.zig")` to the `test {}` block at the bottom of `src/http/server.zig` (not `src/main.zig`). Integration tests discover from there.
@@ -281,9 +281,9 @@ Canonical source: `src/http/test_harness.zig`. Every `*_http_integration_test.zi
 
 - `make lint`
 - `make test`
-- `TEST_DATABASE_URL=postgres://agentsfleet:agentsfleet@localhost:5432/agentsfleetdb make test-integration-db`
+- The database-backed integration lane, with `TEST_DATABASE_URL` pointed at the test database
 - `gitleaks detect`
-- `make check-pg-drain` — static check: every `conn.query()` must have `.drain()` in the same function. Run this when touching any file that calls `conn.query()`. See `lint-zig.py`.
+- Connection-drain audit — a static check that every `conn.query()` has `.drain()` in the same function. Run the repository's lane for it when touching any file that calls `conn.query()`.
 
 ## Zig 0.15.2 API Gotchas (M3_001)
 
@@ -497,8 +497,8 @@ Rules:
 
 > [DETERMINISTIC → XCOMPILE]
 
-- Verification commands are defined in `make` targets and CI runs `make`. Use `make test` (tier 1) and `make test-integration` (tier 2) for verification — **not** `zig build test` standalone. `zig build test` runs only the Zig unit set and silently skips the website / app / agentsfleet unit tests + cross-language gates that the verification gate is defined against. Use `zig build` directly only for compilation, never for "did my change pass tests".
-- `make memleak` is required when the diff touches server lifecycle, allocator wiring, or cross-thread heap ownership. The macOS `leaks` tool prints a "not debuggable" line under System Integrity Protection — that is expected; the authoritative signal is the allocator-leak phase across `std.testing.allocator`-wrapped tests.
+- Verification runs the repository's DECLARED commands (`.oracle/orly.json`), never `zig build test` standalone. `zig build test` runs only the Zig unit set and silently skips every other language's tests and the cross-language gates the declared commands cover. Use `zig build` for compilation, never for "did my change pass tests".
+- A memory-leak lane, where the repository declares one, is required when the diff touches server lifecycle, allocator wiring, or cross-thread heap ownership. The macOS `leaks` tool prints a "not debuggable" line under System Integrity Protection — that is expected; the authoritative signal is the allocator-leak phase across `std.testing.allocator`-wrapped tests.
 
 ## Doc-Comments and Inline Comments
 

package/docs/REST_API_DESIGN_GUIDELINES.md

@@ -45,7 +45,7 @@ Run this checklist as part of `CHORE(close)` (per `~/.claude/CLAUDE.md` lifecycl
 - [ ] **Tests** — happy path + one error per `hx.fail` + idempotency double-PATCH + `Idempotency-Key` replay (where applicable) + ETag mismatch (§10)
 - [ ] **Logging** — sensitive ID values are DEBUG-only or carry `// log-id-allowed:` comment; secret-shaped fields are write-only or one-time-read (§11)
 - [ ] **`make check-openapi` clean** — bundle in sync, redocly lint, error-schema + URL-shape checks pass (§6)
-- [ ] **`make test-unit-agentsfleetd` clean** — `route_scopes.zig`'s exhaustive switch + `route_scopes_test.zig` assertions cover the auth gate matrix (§10)
+- [ ] **The repository's declared `verify.unit` command is clean** — the route-scope table's exhaustive match and its tests cover the auth gate matrix (§10)
 - [ ] **No file over 350 lines** (§10)
 - [ ] **`gitleaks detect` clean** (§10)
 
@@ -577,7 +577,7 @@ When in doubt, mirror an existing handler:
 
 ## §8 — Handler signature rule
 
-Every HTTP handler in `agentsfleetd` follows this shape. Enforced by `make lint-zig` and by the dispatcher in `src/agentsfleetd/http/server.zig::dispatchMatchedRoute()`, which builds the per-request arena, runs the middleware chain, constructs `Hx`, and calls the route's invoke shim (§7) — a handler never constructs any of this itself.
+Every HTTP handler in `agentsfleetd` follows this shape. Enforced by the repository's declared `verify.lint` command and by the dispatcher in `src/agentsfleetd/http/server.zig::dispatchMatchedRoute()`, which builds the per-request arena, runs the middleware chain, constructs `Hx`, and calls the route's invoke shim (§7) — a handler never constructs any of this itself.
 
 ```zig
 pub fn innerMyEndpoint(hx: Hx, req: *httpz.Request, ...path_params) void {
@@ -705,10 +705,10 @@ Before opening a PR touching any handler:
 
 - [ ] `zig build` clean
 - [ ] `zig build test` passes
-- [ ] `make test-unit-agentsfleetd` passes — `route_scopes.zig`'s exhaustive switch + `route_scopes_test.zig` cover the auth gate matrix
-- [ ] `make test-integration` passes (HTTP + DB + Redis E2E)
+- [ ] the declared `verify.unit` command passes — the route-scope match and its tests cover the auth gate matrix
+- [ ] the repository's integration suite passes end to end against real datastores, where it declares one
 - [ ] Cross-compile: `zig build -Dtarget=x86_64-linux && zig build -Dtarget=aarch64-linux`
-- [ ] `make lint-zig` — all Zig gates pass (350-line file cap, `check-pg-drain`, zlint)
+- [ ] the declared `verify.lint` command passes — every language gate the repository declares
 - [ ] Handler file ≤ 350 lines; split if it grows
 - [ ] Integration test covers the happy path AND at least one error path per `hx.fail` call in the handler
 - [ ] PATCH endpoints have an idempotency test: same body issued twice → identical 200 + identical row state. Skip only if the spec's "Failure Modes" explicitly declares non-idempotent PATCH with a reason (§2)

package/docs/VERIFY_TIERS.md

@@ -1,57 +1,67 @@
-# VERIFY — Tiers, performance, hygiene
+# Verification tiers — `agentsfleet`
 
-> Parent: [`../AGENTS.md`](../AGENTS.md) §VERIFY. Verification Gate (`dispatch/verify.md`) enforces; `make` targets are canonical.
+The exact commands VERIFY runs, and the block it emits. The generic discipline —
+when the gate fires, what a skip must say — lives in `dispatch/verify.md`; this
+page carries only what is specific to this repository.
 
-**FIRST: `/orly-write-unit-test`** — audits diff coverage vs spec's Test Specification (or changed surface when no spec). Iterate until clean. Skipping = CHORE(close) violation.
-
-## Correctness tiers (do not skip)
+## Tiers
 
 | Tier | Command | When |
 |---|---|---|
-| 1 | `make test-unit-all` | Every EXECUTE iteration; start of VERIFY. Unit-only — never substitutes for 2/3. Zig-only fast loop: `make test-unit-agentsfleetd`. |
-| 2 | `make test-integration` | Diff touches `src/agentsfleetd/http/**`, `src/agentsfleetd/db/**`, `src/agentsfleetd/fleet/**`, `src/agentsfleetd/observability/**`, `*_integration_test.zig`, schema, migrations. Before COMMIT. |
-| 3 | `make test-integration` | ≥1× per branch from clean state (after `make down`) before ship-ready. Mandatory when schema changes pre-v2.0. Tier 2 passing + 3 failing = state pollution; fix isolation. |
+| conform | `make harness-verify` | Always, after EXECUTE and before the rest. Any 🔴 returns to EXECUTE. |
+| lint | `make lint-all` | Always. Rust rides `lint-rustd` (rustfmt + Clippy, warnings are errors); script self-tests ride `lint-scripts`. |
+| unit | `make test-unit-all` | Always. The cargo workspace plus every TypeScript package coverage gate. |
+| version | `make check-version` | Always. `VERSION` against `build.zig.zon`, `cli/package.json` and both `rustd/Cargo.toml` sites. |
 
-## Test delta — VERIFY ends by reporting coverage growth
+These four are exactly what `.oracle/orly.json` declares and exactly what
+`orly gate` runs, so the rubric and the mechanical gate grade one boundary.
 
-CHORE(open) recorded the branch-point counts in the spec header (`**Test Baseline:** unit=<N> integration=<M>`, from `make _lint_zig_test_depth`, which also writes `.tmp/agentsfleetd-test-depth.txt`). VERIFY ends with the same command and this required row in the verification block:
+There is no slow tier. The Zig integration and memory-leak lanes retired with the
+rest of the Zig gating, so no lane a developer runs needs live Postgres or Redis.
 
-```
-Test Delta: unit <N₀>→<N₁> (+x) · integration <M₀>→<M₁> (+y) vs CHORE(open) baseline
-Lacking:    <changed surfaces whose tests did not grow, or "none">
-```
+## Test Baseline
 
-- **Delta is deterministic; Lacking is judgment (🤔)** — walk the diff's changed modules and name every one whose coverage did not move (e.g. "EgressScope Linux paths — integration lane pending"). "none" must be earned, not defaulted.
-- **Zero/negative unit delta while the diff adds non-trivial code** → justify in the row (pure refactor, test consolidation) or return to EXECUTE. Deleting tests to go green is a violation, not a justification.
-- Spec predates this rule (no `Test Baseline:` line) → reconstruct from the branch point (run the counter at the CHORE(open) commit or on `origin/main`) and add the line to the spec in the same commit as the VERIFY report.
+`make test-unit-all` reports its own counts per target. Record the cargo
+workspace total in the spec header at CHORE(open) as
+`**Test Baseline:** unit=<N>`, and compare against it in VERIFY's Test Delta row.
+Zero or negative growth on a code-adding diff needs justification or a return to
+EXECUTE.
 
-## Performance / leak (before PR)
+## Wire fixtures
 
-| Gate | Command | When |
-|---|---|---|
-| Leak | `make memleak` | Server lifecycle (`src/agentsfleetd/http/**`, `src/agentsfleetd/cmd/serve.zig`), allocator wiring, cross-thread heap ownership. |
-| Bench (local) | `make bench` | When the diff touches request-path code, allocator wiring, or startup/shutdown sequencing. |
-| Bench (dev) | `API_BENCH_URL=https://api-dev.agentsfleet.net/healthz make bench` | After deploy to dev. |
+`make wire-fixtures` regenerates `samples/fixtures/wire-v2/` from
+`src/lib/contract` — the Zig module that still defines the `/v1/runners` wire.
+Run it whenever a wire type changes, and commit the regenerated fixtures in the
+same commit as the type change.
 
-**Zig coverage.** `make test-coverage-zig` runs the daemon, runner, and three shared-library unit binaries under kcov. Each component must produce a non-empty Cobertura report. The merged report lives under `coverage/zig/merged` and must meet `ZIG_COVERAGE_MIN_LINES`.
+The fixtures are the parity oracle for the Rust port: Zig generates, Rust
+conforms, and the suite compares BYTES. Never hand-edit one. A fixture diff with
+no type change beside it means someone edited generated output; a type change
+with no fixture diff means the emitter never ran.
 
-**Integration roots.** `make test-unit-agentsfleetd` runs `src/agentsfleetd/tests.zig`. `make test-integration` prepares isolated services once and runs `src/agentsfleetd/integration_tests.zig`, which owns the live PostgreSQL, Redis, and QStash imports. The runner's Linux kernel root remains independently selectable.
+## Coverage
 
-**Memleak lanes.** `make memleak` leak-gates all three test graphs concurrently, each named in its own lane prefix: **`agentsfleetd`** (daemon), **`runner`** (`build_runner.zig` unit tests — integration tests fork real children and are excluded), and **`lib`** (three `src/lib` binaries). Component failures are collected and reported before the final lifecycle proof. On Linux, Valgrind is blocking and propagates its exit code. On macOS, the Zig testing allocator is blocking. The advisory `leaks` rerun happens only when one lightweight preflight proves that the host can inspect child processes. `-Dopenssl=false` is a root-graph option only; the runner graph links no OpenSSL and rejects the flag. A final **`boot-drain`** lane migrates the test database, exports the integration environment, runs the filtered daemon lifecycle test under the blocking gate, and requires its run-proof marker.
+One bar, everywhere: **100%**, project-wide and per flag.
 
-Knobs (`make/test-bench.mk`): `API_BENCH_METHOD`, `_DURATION_SEC`, `_CONCURRENCY`, `_TIMEOUT_MS`, `_MAX_ERROR_RATE`, `_MAX_P95_MS`, `_MAX_RSS_GROWTH_MB`.
+| Flag | Paths | Target |
+|---|---|---|
+| `rust-afd` | `rustd/crates/` | 100% |
+| `typescript` | `app`, `website`, `cli` | 100% |
+
+Every threshold is 0%: the target IS the bar. The Rust crates carry no
+input/output, no runtime and no external dependency, so every line is reachable
+from a test; the TypeScript packages are pinned at 100 by their own runners.
 
-**Memleak evidence:** paste final `make memleak` line into PR Session Notes OR cite CI URL. Branches touching `src/agentsfleetd/http/**`/`src/agentsfleetd/cmd/serve.zig`/allocator wiring → last 3 lines verbatim. No "trust me".
+The Zig tree is in Codecov's `ignore` list. It still compiles and the revision
+built from it serves `api-dev`, but nothing measures it.
 
-## Hygiene (always, before PR)
+## Required output
 
-`make lint-all` (hard); `make _lint_zig_pg_drain` (also folded into `make lint-all` via `lint-zig`) + cross-compile `x86_64-linux` + `aarch64-linux` (any `*.zig` touched); cross-layer orphan sweep (RULE ORP — every renamed/deleted symbol → 0 hits across schema/Zig/JS/tests/docs in non-historical files); `gitleaks detect` before any Zig-including commit; 350-line / 50-fn-line check via:
+Paste the deciding line, not the exit code. A gate that reports a number — a size
+against a cap, a count against a budget — is owed that number in the done message.
 
-```bash
-git diff --name-only origin/main \
-  | grep -v -E '\.md$|^vendor/|_test\.|\.test\.|\.spec\.|/tests?/' \
-  | xargs -I{} sh -c 'wc -l "{}"' \
-  | awk '$1 > 350'
+```
+✅ Verified: 🧪 lint-all ✓ · 🧪 test-unit-all ✓ <N>p/<M>s · 🔆 harness-verify ✓ · 🔆 check-version ✓
 ```
 
-**Other:** after refactors, list newly dead code before removing — `NEWLY UNREACHABLE: <symbol/file> — <why now dead>. Remove? Confirm.` **Greptile learning capture:** each finding → "Could this recur?" If yes, add compact rule (Rule/Why/Tags/Ref) to RULES.md same commit. Never defer.
+A skipped target is surfaced as 🟠 with its reason, never dressed as a pass.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@agentsfleet/orly",
-  "version": "0.6.4",
-  "description": "Repository-scoped engineering harness: renders agent rules, materialises the gates that enforce them, and proves the PR boundary — for any coding agent.",
+  "version": "0.6.6",
+  "description": "Repository-scoped engineering harness: renders agent rules, materialises the gates that enforce them, and proves the PR boundary \u2014 for any coding agent.",
   "license": "MIT",
   "type": "module",
   "scripts": {

package/packs/language/go/rules.md

@@ -20,5 +20,13 @@ a working value.
 Table-driven tests are the default shape. Concurrency work needs a `-race` run,
 and a deterministic contention test rather than a sleep.
 
+A string literal repeated in one file becomes a named constant — `audits/ufs.sh`
+reads `*.go` and enforces it. Two Go shapes are held out, because no rename can
+fix them: members of a `const ( … )` group, which state the binding keyword once
+on the opening line rather than per member, and backtick struct tags, whose
+quoted halves (`json:"id"`) are addressed by reflection and cannot hold a const.
+Both are carve-outs for what the *language* makes unfixable, not permission —
+a flag name or a label spelled inline twice is still the rule.
+
 The repository owns formatting, vet, lint, build, and test commands — it
 declares them in `.oracle/orly.json`.

package/packs/language/rust/rules.md

@@ -31,6 +31,35 @@ Local convention wins on conflict, but the divergence is named in the review
 output. Refresh the copy when the user asks or a cited rule looks stale
 (re-run the fetch; upstream updates continuously).
 
+## Constant discipline (RULE UFS)
+
+`audits/ufs.sh` reads `*.rs`. It did not until this pack said so, and the cost
+was concrete: a crate spelled a wire verb inline twice — `pong == "PONG" ||
+pong.contains("PONG")` — while `write_any.sh` printed a green UFS row over the
+file, because the façade had always declared `*.rs` and the leaf had never read
+it. Bind the repeated literal to a `const` or `static` and use the name.
+
+Four Rust shapes are held out of the count, because no rename can fix them:
+
+- **`#[cfg(test)]` and `#[test]` blocks.** Rust keeps unit tests inside the file
+  they cover, so fixture keys would otherwise read as that file's worst debt.
+- **Feature-gated test seams** — `#[cfg(feature = "test-util")]`. A helper that
+  hands a sibling integration test one of each error kind has to compile into
+  the crate, which is the only reason it is not behind `cfg(test)`; its contents
+  are fixture data all the same. The match is narrow on purpose: `test` as a
+  whole word or a `-`/`_` segment, so `#[cfg(feature = "redis")]` still counts.
+- **Attribute literals** — `#[serde(rename = "…")]`, `#[cfg(feature = "…")]`,
+  `#[doc = "…"]`. An attribute takes a literal token by language rule; a const
+  is not accepted in that position.
+- **`tests/` and `benches/`** at the crate root, which are fixture trees.
+
+Everything else counts, including `examples/` — not because it compiles, but
+because what repeats there is coupling, not demonstration. A cache namespace
+declared at the top of a walkthrough and matched ninety lines below it, or a
+fixture id that is both the fake store's match arm and the key five call sites
+pass, breaks silently when one end moves. That is the drift RULE UFS exists to
+catch, and example code is where a reader copies it from.
+
 ## Evolution
 
 This pack is young next to the Zig façade and grows the same way: a Rust

package/skills/orly-write-integration-test/SKILL.md

@@ -35,7 +35,7 @@ If a test answers (1) but mocks the dep, demote it to a unit test.
 
 ## What belongs here
 
-A test belongs in the integration suite (`make test-integration` / `pytest -m integration` / `cargo test --test 'integration_*'`) if **any** of:
+A test belongs in the integration suite — whatever the repository calls that lane (`pytest -m integration`, `cargo test --test 'integration_*'`, a dedicated make target) — if **any** of:
 
 - **Real Postgres** — schema applied, real connection pool, real extensions if used
 - **Real Redis** — actual pub/sub, streams, KV, lease semantics
@@ -214,7 +214,7 @@ every request; this is the regression that proof exists to catch.
 ### T6 — Resource lifecycle
 
 Proofs the system doesn't bleed:
-- **Drain audit** — `make check-pg-drain` (or equivalent) green after suite. Every `conn.query()` paired with `.drain()` before `deinit()`.
+- **Drain audit** — the repository's connection-drain check green after the suite. Every `conn.query()` paired with `.drain()` before `deinit()`.
 - **Connection leak** — open count before == after across N requests
 - **Memory leak** — Zig: `std.testing.allocator` over full request lifecycle. Rust: `dhat`/`heaptrack` over N iters. Python: `objgraph`/`gc` over N iters.
 - **FD leak** — `lsof -p $$ | wc -l` before/after holds
@@ -232,7 +232,7 @@ Proofs the system doesn't bleed:
   deterministic proof every `errdefer` is correct; exhaustive over alloc sites ⇒ invariant.
 - **No cross-request growth:** drive N requests and assert outstanding-bytes / high-water
   does not grow monotonically (a slow leak shows as linear growth).
-- **Gate:** `make memleak` → **0 leaks** + `make check-pg-drain` clean, both pasted into PR
+- **Gate:** the memory-leak lane → **0 leaks**, and the drain audit clean; both pasted into the PR
   Session Notes; cross-compile both targets before declaring done.
 
 **Complexity / latency budget under load (counters over clocks).**
@@ -331,9 +331,9 @@ Both make every downstream test a lie — fix them before adding coverage. A gre
 | Stage | What runs | Why |
 |---|---|---|
 | **PR** | Smoke mode on changed surface + randomised order | Fast feedback, catches obvious wiring breaks |
-| **Pre-merge** | Standard mode on changed module + 1× full suite from clean (`make down && make up && make test-integration`) | Detects state pollution between tests |
+| **Pre-merge** | Standard mode on changed module + 1× full suite from a CLEAN datastore (tear the services down, bring them up, run the integration lane) | Detects state pollution between tests |
 | **Nightly** | Hardening mode + chaos pass (random failure injection across deps) | Catches rare-path bugs |
-| **Pre-release** | Full Hardening + `make memleak` + `make bench` + cross-platform | Final sign-off |
+| **Pre-release** | Full Hardening + the memory-leak lane + a benchmark run + cross-platform | Final sign-off |
 
 Suite passes shared but fails clean = state pollution, not a bug. Fix isolation before re-running.
 
@@ -367,8 +367,8 @@ Every claim → ≥1 test. Untestable claims → flag `needs infra`, never silen
 
 | Stack | Suite runner | Real PG | Real Redis | Drain/leak | Concurrency |
 |---|---|---|---|---|---|
-| Zig (agentsfleet) | `make test-integration` | `make up` container | `make up` container | `std.testing.allocator` + `make check-pg-drain` | `std.Thread.spawn` |
-| Zig runner (client daemon) | `make test-integration` (protocol loop vs a harness/real control plane) | via the control plane (runner holds none) | via the control plane | `std.testing.allocator` over parent + forked child | `fork` + `kill -9` / fake-clock past lease TTL for reclaim |
+| Zig | the integration lane | containerized datastore | containerized datastore | `std.testing.allocator` + the drain audit | `std.Thread.spawn` |
+| Zig client daemon | the integration lane (protocol loop against a harness or a real control plane) | via the control plane (the daemon holds none) | via the control plane | `std.testing.allocator` over parent + forked child | `fork` + `kill -9` / fake-clock past lease TTL for reclaim |
 | Python | `pytest -m integration` | `testcontainers-python` | `testcontainers-python` | `gc` + `objgraph` over N iters | `asyncio.gather` / `ThreadPoolExecutor` |
 | Rust | `cargo test --test 'integration_*'` | `testcontainers-rs` / `sqlx::test` | `testcontainers-rs` | `dhat-rs`; `Drop` checks | `tokio::spawn` + `loom` for races |
 | Node/Bun | `bun test --integration` | `testcontainers-node` | `testcontainers-node` | manual handle counting | `Promise.all` |
@@ -425,7 +425,7 @@ Mode:        Smoke | Standard | Hardening
 Scenario axis: positive ✅ · negative ✅ · invalid 🟡 · flaky-conn ✅ · kill/restart ✅ · concurrency ✅
 Harness:     ✅ port bind-and-hold · ✅ teardown catalog-derived (survives a new schema)
 DoD:         9/12  — return to EXECUTE before declaring done
-Drain audit: ✅ make check-pg-drain clean
+Drain audit: ✅ clean
 Leak audit:  🔴 std.testing.allocator reported 2 leaks across 100 requests
 Shuffle:     ✅ pass under --shuffle
 Clean run:   ✅ pass after make down && make up
@@ -444,17 +444,17 @@ Block the change if any are missing on touched surface:
 - [ ] Every changed handler/service/repo has ≥1 T1+T2+T3 happy-path test
 - [ ] Every `catch`/`orelse`/`except`/`Err` in the request path has a T4 injection test
 - [ ] Every concurrent-write or idempotency claim has a T5 test
-- [ ] Drain audit (`make check-pg-drain`) clean post-suite
+- [ ] Drain audit clean post-suite
 - [ ] Leak audit clean post-suite (Zig: `std.testing.allocator`; Rust: `dhat`; Python: `objgraph`)
 - [ ] Suite passes under randomised execution order
-- [ ] Suite passes from clean state (`make down && make up && make test-integration`)
+- [ ] Suite passes from a clean datastore — services down, up, then the integration lane
 - [ ] No mocking of DB, Redis, or internal modules
 - [ ] Test names read as documentation
 - [ ] OpenAPI / protobuf breaking-change check (`oasdiff` / `buf breaking`) clean
 - [ ] If streaming touched: T7 incremental-delivery test present
 - [ ] Failure-injection mechanism named for every T4/T7 test (no fiction)
 - [ ] **Partial completion:** every operation touching multiple systems or acquiring the same resource more than once carries a matrix with one row per ordered failure point; each row selects workflow and boundary-call ordinals, failure timing / remote outcome, scopes a concurrency-safe failpoint to one operation, and asserts durable, external, user-visible, and retry residual state; every external mutation proves acknowledgement-loss remote state plus exactly one effect on retry; the completed matrix is pasted into PR Session Notes
-- [ ] PR Session Notes paste final `make test-integration` + `make memleak` lines
+- [ ] PR Session Notes paste the final result line from the integration lane and the memory-leak lane
 - [ ] **≥100-connection** test proves exactly-once + parallelism (peak-concurrency/lock-wait counter, or wall-time < R×), passes K runs
 - [ ] **Zig error-path leak:** allocating handlers/repos proven by `std.testing.checkAllAllocationFailures`; no cross-request high-water growth over N requests
 - [ ] **Complexity under load:** N+1 round-trips ruled out (count at n vs 10n); work-counter ladder asserts the O-bound; p95 within budget vs pinned baseline
@@ -463,8 +463,8 @@ Block the change if any are missing on touched surface:
 - [ ] **Harness hygiene:** server binds-and-holds its port (no rebind race, no `listen()` panic); teardown/reset is catalog-derived (proven by adding a throwaway schema and re-running teardown — it must still reach zero)
 - [ ] **Client daemon (if present, T9):** sudden SIGKILL mid-lease → reclaim + re-fence + exactly-once + stale report fenced; restart → re-register + resume, no duplicate, no orphan lease; flaky control-plane link → backoff without crash + un-acked redelivery + idempotent report retry; forked child always reaped + scope always destroyed on every exit path
 
-100% required before declaring `make test-integration` done.
+100% required before declaring the integration suite done.
 
 ## Validation gate
 
-Run `make test-integration` (or stack equivalent) twice — once shared, once from clean (`make down && make up`). Run once more under randomised order. Report pass/fail/skip counts, drain audit, leak audit, the coverage table above, and the DoD checklist. Do not declare done until DoD is 100%.
+Run the integration lane twice — once against shared services, once from a clean datastore. Run once more under randomised order. Report pass/fail/skip counts, drain audit, leak audit, the coverage table above, and the DoD checklist. Do not declare done until DoD is 100%.

package/skills/orly-write-unit-test/SKILL.md

@@ -308,7 +308,7 @@ Reject the change if any are missing on touched code:
 - [ ] Golden-file drift, if any, has a written explanation
 - [ ] Branch coverage ≥80%, error-path 100% on touched code
 - [ ] **Performance:** counter-based complexity proof on the n-ladder (O-bound asserted) + median-of-K latency vs pinned baseline; N+1 round-trips ruled out
-- [ ] **Zig zero-leak:** `make memleak` 0 leaks; every alloc-with-error-path proven by `std.testing.checkAllAllocationFailures`; no cross-request high-water growth over N iters
+- [ ] **Zig zero-leak:** the memory-leak lane reports 0 leaks; every alloc-with-error-path proven by `std.testing.checkAllAllocationFailures`; no cross-request high-water growth over N iters
 - [ ] **Concurrency:** ≥100-connection barrier-started test proves exactly-once + parallelism (peak-concurrency/lock-wait counter, or wall-time < R×); passes K runs + race detector clean
 - [ ] **Refactor escalation:** any super-linear or serialization finding on touched code carries a refactor proposal (root cause + target design + patch alternative + recommendation) surfaced for decision — not silently band-aided
 - [ ] **Diff ledger** resolved 100% — every changed unit has a test or an explicit `won't-test`/`needs-infra`; ledger pasted into PR Session Notes
@@ -361,7 +361,7 @@ enumerate) over sampling.
   arena acquire → use → reset) for N iterations and assert outstanding-bytes /
   high-water does **not** grow monotonically. A slow leak the single-shot test misses
   shows up here as linear growth.
-- **Gate:** `make memleak` → **0 leaks**, output pasted into PR Session Notes; cross-compile
+- **Gate:** the memory-leak lane → **0 leaks**, output pasted into PR Session Notes; cross-compile
   both targets first (`x86_64-linux`, `aarch64-linux`) — stdlib alloc paths differ from macOS.
 
 ### Proof 2 — Concurrency proven at ≥100 connections (no hidden global lock)

package/src/pack_hygiene.test.ts

@@ -0,0 +1,104 @@
+import { describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { PRODUCT_ONLY_TARGETS, productLeakErrors, shippedFiles } from "./pack_hygiene";
+
+const registryFor = (pack: string, source: string) => ({
+  packs: { [pack]: { documents: [{ source, target: source }] } },
+});
+
+describe("productLeakErrors", () => {
+  test("flags a product-only target named by a generic pack", async () => {
+    const output = mkdtempSync(join(tmpdir(), "orly-hygiene-"));
+    try {
+      mkdirSync(join(output, "docs"));
+      await Bun.write(join(output, "docs/GUIDE.md"), "Run `make test-integration` before you ship.\n");
+
+      const errors = await productLeakErrors(output, registryFor("domain.http", "docs/GUIDE.md"));
+
+      expect(errors).toHaveLength(1);
+      expect(errors[0]).toContain("docs/GUIDE.md:1");
+      expect(errors[0]).toContain("domain.http");
+      expect(errors[0]).toContain("make test-integration");
+    } finally {
+      rmSync(output, { recursive: true, force: true });
+    }
+  });
+
+  test("allows the same target inside a product-scoped pack", async () => {
+    const output = mkdtempSync(join(tmpdir(), "orly-hygiene-"));
+    try {
+      mkdirSync(join(output, "docs"));
+      await Bun.write(join(output, "docs/GUIDE.md"), "Run `make test-integration` before you ship.\n");
+
+      const errors = await productLeakErrors(output, registryFor("product.agentsfleet", "docs/GUIDE.md"));
+
+      expect(errors).toBeEmpty();
+    } finally {
+      rmSync(output, { recursive: true, force: true });
+    }
+  });
+
+  test("does not fire on English that begins with 'make'", async () => {
+    const output = mkdtempSync(join(tmpdir(), "orly-hygiene-"));
+    try {
+      mkdirSync(join(output, "docs"));
+      await Bun.write(
+        join(output, "docs/GUIDE.md"),
+        "Make it obvious. This will make the reader stop.\nDo not make an exception here.\n",
+      );
+
+      const errors = await productLeakErrors(output, registryFor("universal.authoring", "docs/GUIDE.md"));
+
+      expect(errors).toBeEmpty();
+    } finally {
+      rmSync(output, { recursive: true, force: true });
+    }
+  });
+
+  test("reports the most specific target, not its prefix", async () => {
+    const output = mkdtempSync(join(tmpdir(), "orly-hygiene-"));
+    try {
+      mkdirSync(join(output, "docs"));
+      await Bun.write(join(output, "docs/GUIDE.md"), "Run `make test-integration-db` for the DB half.\n");
+
+      const errors = await productLeakErrors(output, registryFor("domain.sql", "docs/GUIDE.md"));
+
+      expect(errors).toHaveLength(1);
+      expect(errors[0]).toContain("make test-integration-db");
+    } finally {
+      rmSync(output, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("shippedFiles", () => {
+  test("tags each source with the pack that ships it", () => {
+    const files = shippedFiles({
+      packs: {
+        "domain.http": { documents: [{ source: "docs/A.md" }] },
+        "product.agentsfleet": { documents: [{ source: "docs/B.md" }] },
+      },
+      core_documents: [{ source: "docs/C.md" }],
+    });
+
+    expect(files).toContainEqual({ source: "docs/A.md", pack: "domain.http" });
+    expect(files).toContainEqual({ source: "docs/B.md", pack: "product.agentsfleet" });
+    expect(files).toContainEqual({ source: "docs/C.md", pack: "core" });
+  });
+});
+
+describe("the real corpus", () => {
+  test("no generic pack names a product-only make target", async () => {
+    const registry = await Bun.file("registry.json").json();
+    const errors = await productLeakErrors(".", registry);
+
+    expect(errors).toEqual([]);
+  });
+
+  test("every denied target is spelled once", () => {
+    expect(new Set(PRODUCT_ONLY_TARGETS).size).toBe(PRODUCT_ONLY_TARGETS.length);
+  });
+});

package/src/pack_hygiene.ts

@@ -0,0 +1,109 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+
+/**
+ * Make targets that belong to ONE consuming repository.
+ *
+ * A generic pack — anything not `product.*` — must never name these. A repository
+ * that renames or retires one gets a managed file citing a target it does not
+ * have, and if it gates on cited targets resolving, the only way to go green is
+ * to edit a managed file, which the next `orly update` reverts. That loop is the
+ * bug this list exists to prevent.
+ *
+ * Generic prose says what the target IS — "the declared `verify.unit` command",
+ * "the repository's integration lane" — and lets each repository bind the name.
+ *
+ * Deliberately a denylist, not "no `make` citations at all": English says "make
+ * it", "make the", "make an", so a blanket pattern fires on prose and gets
+ * carved out until it means nothing.
+ */
+export const PRODUCT_ONLY_TARGETS: readonly string[] = [
+  "lint-zig",
+  "lint-governance",
+  "check-pg-drain",
+  "memleak",
+  "test-integration",
+  "test-integration-db",
+  "test-integration-redis",
+  "test-integration-kernel",
+  "test-unit-agentsfleetd",
+  "test-unit-agentsfleet-runner",
+  "test-unit-agentsfleet-lib",
+  "test-coverage-zig",
+  "test-coverage-grade",
+  "_lint_zig_test_depth",
+];
+
+/**
+ * Pack label for files the registry ships outside any pack — core documents and
+ * rules. Not a pack id, so it never matches the `product.` prefix and is held to
+ * the generic standard, which is what core documents are.
+ */
+const CORE_PACK = "core";
+
+/** A file shipped by a pack, with the pack that ships it. */
+export interface ShippedFile {
+  readonly source: string;
+  readonly pack: string;
+}
+
+/** Collects every `source` a registry node ships, tagged with its pack. */
+export function shippedFiles(registry: unknown): ShippedFile[] {
+  const out: ShippedFile[] = [];
+  const walk = (node: unknown, pack: string): void => {
+    if (Array.isArray(node)) {
+      for (const item of node) walk(item, pack);
+      return;
+    }
+    if (node === null || typeof node !== "object") return;
+    const record = node as Record<string, unknown>;
+    if (typeof record.source === "string") out.push({ source: record.source, pack });
+    for (const value of Object.values(record)) walk(value, pack);
+  };
+
+  const root = registry as Record<string, unknown>;
+  const packs = (root.packs ?? {}) as Record<string, unknown>;
+  for (const [name, pack] of Object.entries(packs)) walk(pack, name);
+  walk(root.core_documents, CORE_PACK);
+  walk(root.rules, CORE_PACK);
+  return out;
+}
+
+/**
+ * Reports every product-only make target named by a file a GENERIC pack ships.
+ *
+ * Returns one line per offending citation, empty when clean.
+ */
+export async function productLeakErrors(root: string, registry: unknown): Promise<string[]> {
+  const errors: string[] = [];
+  const seen = new Set<string>();
+
+  for (const { source, pack } of shippedFiles(registry)) {
+    if (pack.startsWith("product.")) continue;
+    if (!source.endsWith(".md")) continue;
+    if (seen.has(source)) continue;
+    seen.add(source);
+
+    let text: string;
+    try {
+      text = await readFile(join(root, source), "utf8");
+    } catch {
+      continue; // absent sources are the reference gate's business, not ours
+    }
+
+    text.split("\n").forEach((line, index) => {
+      for (const target of PRODUCT_ONLY_TARGETS) {
+        // Word-boundary on the tail so `test-integration` does not swallow
+        // `test-integration-db`'s own, more specific, report.
+        const pattern = new RegExp(`make ${target}(?![a-z0-9_-])`);
+        if (pattern.test(line)) {
+          errors.push(
+            `${source}:${index + 1}: pack '${pack}' is not product-scoped but names \`make ${target}\`, ` +
+              `which only one repository defines — say what the command IS instead`,
+          );
+        }
+      }
+    });
+  }
+  return errors;
+}