@agentsfleet/orly 0.9.1 → 0.9.3

package/audits/cross-tier-rates.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # cross-tier-rates.sh — pin numeric parity of the rate constants
-# across Zig + three TypeScript surfaces.
+# across the daemon + three TypeScript surfaces.
 #
 # RULE UFS extension. The shipped billing surface depends on these constants
 # having identical numeric values everywhere they appear:
@@ -16,13 +16,13 @@
 #
 # Files (one definition site per constant per file):
 #
-#   src/agentsfleetd/state/tenant_billing.zig       — server enforces the charge
+#   rustd/crates/afd_billing/src/nanos.rs   — server enforces the charge
 #   ui/packages/website/src/lib/rates.ts    — pricing page display
 #   ui/packages/app/lib/types.ts            — dashboard display
 #   cli/src/constants/billing.ts    — `agentsfleet doctor --json` billing block
 #
 # A drift between any two = a billing-display lie or a server-vs-CLI disagreement.
-# Zig is the source of truth (server enforces); the three TS surfaces echo it.
+# The daemon is the source of truth (server enforces); the three TS surfaces echo it.
 #
 # Fires in: make harness-verify, make harness-verify-all.
 # Exits 0 clean, 1 on any drift.
@@ -37,7 +37,7 @@ readonly NAMES=(
 )
 
 readonly FILES=(
-  src/agentsfleetd/state/tenant_billing.zig
+  rustd/crates/afd_billing/src/nanos.rs
   ui/packages/website/src/lib/rates.ts
   ui/packages/app/lib/types.ts
   cli/src/constants/billing.ts
@@ -96,7 +96,7 @@ if [[ $FAIL -ne 0 ]]; then
     printf "  %s\n" "$v" >&2
   done
   printf "\nFix: align all four files on the canonical Zig value\n" >&2
-  printf "     (src/agentsfleetd/state/tenant_billing.zig is the server-side enforcer).\n" >&2
+  printf "     (rustd/crates/afd_billing/src/nanos.rs is the server-side enforcer).\n" >&2
   exit 1
 fi
 

package/audits/deinit-pairs.sh

@@ -60,11 +60,14 @@ note() { printf "NOTE: %s\n" "$*"; }
 # ---------------------------------------------------------------------------
 case "$MODE" in
   --staged|staged)
-    mapfile -t FILES < <(git diff --cached --name-only --diff-filter=ACMRT \
+    # while read, not mapfile — bash-3.2 portability (see scripts/run-playbook-tests.sh).
+    FILES=()
+    while IFS= read -r f; do FILES+=("$f"); done < <(git diff --cached --name-only --diff-filter=ACMRT \
       | grep -E '^src/.*\.zig$' || true)
     ;;
   --all|all)
-    mapfile -t FILES < <(find src -type f -name '*.zig' 2>/dev/null || true)
+    FILES=()
+    while IFS= read -r f; do FILES+=("$f"); done < <(find src -type f -name '*.zig' 2>/dev/null || true)
     ;;
   *)
     printf "usage: %s [--staged|--all]\n" "$0" >&2
@@ -106,10 +109,13 @@ done
 # M70 perf: pre-compute file sets in batched greps instead of one grep
 # per file (~760 forks → 2 forks). Reads as "membership sets" for the
 # per-init loop below.
-declare -A files_with_cleanup=()
+# A membership set as a newline-delimited string, not declare -A: associative
+# arrays are bash 4+ and macOS ships 3.2. Lookup is a substring test on
+# \n<file>\n, which filenames cannot fake.
+files_with_cleanup=$'\n'
 if [[ ${#present_files[@]} -gt 0 ]]; then
   while IFS= read -r f; do
-    [[ -n "$f" ]] && files_with_cleanup["$f"]=1
+    [[ -n "$f" ]] && files_with_cleanup="${files_with_cleanup}${f}"$'\n'
   done < <(grep -lE "$CLEANUP_RE" "${present_files[@]}" 2>/dev/null || true)
 fi
 
@@ -151,7 +157,7 @@ if [[ -n "$inits_list" ]]; then
     fi
 
     inits_requires_cleanup=$((inits_requires_cleanup + 1))
-    if [[ -z "${files_with_cleanup[$f]+x}" ]]; then
+    if [[ "$files_with_cleanup" != *$'\n'"$f"$'\n'* ]]; then
       inits_unpaired=$((inits_unpaired + 1))
       reason=""
       [[ $heap -eq 1 ]] && reason="heap-return"

package/audits/error-codes.sh

@@ -108,7 +108,10 @@ gather_used_paths() {
   esac
 }
 
-mapfile -t USED_PATHS < <(gather_used_paths)
+# `while read` rather than mapfile: mapfile is bash 4+ and macOS ships 3.2 —
+# the portability rule scripts/run-playbook-tests.sh already records.
+USED_PATHS=()
+while IFS= read -r p; do USED_PATHS+=("$p"); done < <(gather_used_paths)
 if [[ ${#USED_PATHS[@]} -eq 0 ]]; then
   ok "no source files in scope ($MODE)"
   exit 0

package/audits/logging.sh

@@ -110,7 +110,10 @@ gather_paths() {
   esac
 }
 
-mapfile -t FILES < <(gather_paths)
+# `while read` rather than mapfile: mapfile is bash 4+ and macOS ships 3.2 —
+# the portability rule scripts/run-playbook-tests.sh already records.
+FILES=()
+while IFS= read -r p; do FILES+=("$p"); done < <(gather_paths)
 if [[ ${#FILES[@]} -eq 0 ]]; then
   ok "no source files in scope ($MODE)"
   exit 0
@@ -139,7 +142,9 @@ for f in "${FILES[@]}"; do
 done
 
 if [[ ${#rust_nontest[@]} -gt 0 ]]; then
-  mapfile -t rust_candidates < <(grep -lE '(^|[^[:alnum:]_])(println|eprintln|dbg)!|tracing::(error|warn|info|debug|trace)!' "${rust_nontest[@]}" 2>/dev/null || true)
+  rust_candidates=()
+  while IFS= read -r p; do rust_candidates+=("$p"); done \
+    < <(grep -lE '(^|[^[:alnum:]_])(println|eprintln|dbg)!|tracing::(error|warn|info|debug|trace)!' "${rust_nontest[@]}" 2>/dev/null || true)
 fi
 
 # ---------------------------------------------------------------------------
@@ -388,12 +393,17 @@ fi
 # ---------------------------------------------------------------------------
 scoped_hits=0
 scoped_eligible=()
-for f in "${zig_nontest[@]}"; do
-  case "$f" in
-    src/logging/*) continue ;;
-  esac
-  scoped_eligible+=("$f")
-done
+# Guarded like every sibling loop: bash 3.2 under `set -u` treats "${empty[@]}"
+# as unbound (fixed only in 4.4), so an unguarded expansion aborts the audit in
+# any repository with no Zig sources. macOS ships 3.2.
+if [[ ${#zig_nontest[@]} -gt 0 ]]; then
+  for f in "${zig_nontest[@]}"; do
+    case "$f" in
+      src/logging/*) continue ;;
+    esac
+    scoped_eligible+=("$f")
+  done
+fi
 if [[ ${#scoped_eligible[@]} -gt 0 ]]; then
   while IFS= read -r line; do
     [[ -z "$line" ]] && continue

package/audits/spec-template.sh

@@ -48,13 +48,17 @@ note() { printf "NOTE: %s\n" "$*"; }
 # Discover spec files in scope.
 case "$MODE" in
   --staged|staged)
-    mapfile -t SPECS < <(git diff --cached --name-only --diff-filter=ACMRT | grep -E '^docs/v[0-9]+/(pending|active|done)/.*\.md$' || true)
+    # while read, not mapfile — bash-3.2 portability (see scripts/run-playbook-tests.sh).
+    SPECS=()
+    while IFS= read -r s; do SPECS+=("$s"); done < <(git diff --cached --name-only --diff-filter=ACMRT | grep -E '^docs/v[0-9]+/(pending|active|done)/.*\.md$' || true)
     ;;
   --all|all)
-    mapfile -t SPECS < <(find docs/v[0-9]* -type f -name '*.md' 2>/dev/null | grep -E '/(pending|active)/' || true)
+    SPECS=()
+    while IFS= read -r s; do SPECS+=("$s"); done < <(find docs/v[0-9]* -type f -name '*.md' 2>/dev/null | grep -E '/(pending|active)/' || true)
     ;;
   --include-done|include-done)
-    mapfile -t SPECS < <(find docs/v[0-9]* -type f -name '*.md' 2>/dev/null | grep -E '/(pending|active|done)/' || true)
+    SPECS=()
+    while IFS= read -r s; do SPECS+=("$s"); done < <(find docs/v[0-9]* -type f -name '*.md' 2>/dev/null | grep -E '/(pending|active|done)/' || true)
     ;;
   --file|file)
     # Single named spec, both families — the lifecycle engine's spec.gate

package/audits/sql-mod.sh

@@ -46,10 +46,13 @@ added_hit() {
 
 case "$MODE" in
   --staged|staged)
-    mapfile -t FILES < <(git diff --cached --name-only --diff-filter=ACMRT -- '*.zig' || true)
+    # while read, not mapfile — bash-3.2 portability (see scripts/run-playbook-tests.sh).
+    FILES=()
+    while IFS= read -r f; do FILES+=("$f"); done < <(git diff --cached --name-only --diff-filter=ACMRT -- '*.zig' || true)
     STAGED=1 ;;
   --all|all)
-    mapfile -t FILES < <(find src -type f -name '*.zig' 2>/dev/null || true)
+    FILES=()
+    while IFS= read -r f; do FILES+=("$f"); done < <(find src -type f -name '*.zig' 2>/dev/null || true)
     STAGED=0 ;;
   *)
     printf "usage: %s [--staged|--all]\n" "$0" >&2

package/audits/ufs.sh

@@ -116,7 +116,12 @@ if [ "$MODE" = "--staged" ]; then
 else
   scope_files() { git ls-files; }
 fi
-mapfile -t FILES < <(scope_files | while read -r f; do
+# `while read` rather than mapfile: mapfile is bash 4+ and macOS ships 3.2 —
+# the portability rule scripts/run-playbook-tests.sh already records.
+FILES=()
+while IFS= read -r f; do
+  FILES+=("$f")
+done < <(scope_files | while read -r f; do
   is_source "$f" && echo "$f"
 done)
 
@@ -344,9 +349,13 @@ done < <(awk -v re="$NUMERIC_RE" '
 
 # ── 3. cross-runtime-orphan ─────────────────────────────────────────────────
 # Full-tree ERR_* parity. Scoped to the ERR_* prefix because that is the
-# cross-runtime contract surface — server error codes a client consumes. Zig is
-# the source of truth: every client-side ERR_* must have a matching Zig
-# `pub const ERR_*`. Zig-only codes are fine; a server-internal code needs no
+# cross-runtime contract surface — server error codes a client consumes. The
+# daemon is the source of truth. A Rust daemon declares its codes through a
+# registry — `ErrorCode::declare("…")` — and the contract a client holds is
+# that STRING, so parity is checked on the string: every client
+# `export const ERR_X = "…"` must name a code the registry declares. Where no
+# registry exists and Zig does, the Zig `pub const ERR_*` NAMES are the
+# oracle instead. Daemon-only codes are fine; a server-internal code needs no
 # client mirror.
 #
 # Scoped BY RUNTIME, not by one repository's directory names. The previous form
@@ -381,11 +390,29 @@ parity_codes() {
     | grep -oE 'ERR_[A-Z][A-Z0-9_]+' | sort -u || true
 }
 
+# The Rust registry outranks a Zig mirror: a runner that keeps a Zig subset of
+# the daemon's codes for its own use is a client, not the oracle. `record`
+# mutates globals, so the loop runs in this shell over a here-string — never on
+# the right of a pipe, which would run it in a subshell and drop every finding.
+rust_codes=$(git ls-files -z -- '*.rs' 2>/dev/null \
+  | { grep -zvE "$PARITY_EXCLUDE" || true; } \
+  | { xargs -0 grep -hoE 'ErrorCode::declare\("[^"]+"\)' 2>/dev/null || true; } \
+  | { grep -oE '"[^"]+"' || true; } | tr -d '"' | sort -u)
 zig_err=$(parity_codes '^pub const ERR_[A-Z][A-Z0-9_]+[[:space:]]*=' '*.zig')
 client_err=$(parity_codes '^export const ERR_[A-Z][A-Z0-9_]+[[:space:]]*=' '*.js' '*.jsx' '*.ts' '*.tsx')
 
-if [ -z "$zig_err" ]; then
-  ok "audit-ufs: cross-runtime parity skipped — no Zig ERR_* declared, so this repository has no source of truth to compare against"
+if [ -n "$rust_codes" ]; then
+  client_decls=$(git ls-files -z -- '*.js' '*.jsx' '*.ts' '*.tsx' 2>/dev/null \
+    | { grep -zvE "$PARITY_EXCLUDE" || true; } \
+    | { xargs -0 grep -hE '^export const ERR_[A-Z][A-Z0-9_]+[[:space:]]*=[[:space:]]*"[^"]+"' 2>/dev/null || true; })
+  while IFS= read -r line; do
+    [ -n "$line" ] || continue
+    name=$(printf '%s' "$line" | grep -oE 'ERR_[A-Z][A-Z0-9_]+' | head -1)
+    code=$(printf '%s' "$line" | sed -E 's/^[^=]*=[[:space:]]*"([^"]+)".*/\1/')
+    echo "$rust_codes" | grep -qxF -- "$code" || record "cross-runtime-orphan $name ($code) absent-in-daemon"
+  done <<<"$client_decls"
+elif [ -z "$zig_err" ]; then
+  ok "audit-ufs: cross-runtime parity skipped — no Rust registry and no Zig ERR_* declared, so this repository has no source of truth to compare against"
 else
   # Every client-side ERR_* must exist in Zig.
   for c in $client_err; do

package/dispatch/lib.sh

@@ -53,7 +53,10 @@ DISPATCH_RC=0
 # Rule-code gloss map — canonical short expansions (full text in RULES.md legend).
 # Keep in sync with RULES.md; dispatch-coverage.sh fails on a code with no
 # gloss entry. snake-of-record: CODE → "Short Gloss".
-declare -A DISPATCH_GLOSS=(
+# A heredoc of `[CODE]="Gloss"` lines, not declare -A: associative arrays are
+# bash 4+ and macOS ships 3.2. The line shape is load-bearing —
+# evals/dispatch/coverage.sh greps lib.sh for it (checks f and g).
+DISPATCH_GLOSS="$(cat <<'GLOSS'
   [NDC]="No Dead Code"
   [NLR]="No Legacy Retained (touch-it-fix-it)"
   [NLG]="No Legacy compat shims (pre-v2.0.0)"
@@ -83,10 +86,17 @@ declare -A DISPATCH_GLOSS=(
   [ERR-RS]="Rust ERror discipline (one type per crate, Result alias, no stringified cause)"
   [GRP]="GREptile rule audit (diff vs greptile-learnings/RULES.md codes)"
   [LDC]="Legacy-Design Consult (A remove / B patch / C keep)"
-)
+GLOSS
+)"
 
 # Look up a gloss; empty string if the code is unknown (audit will catch it).
-dispatch_gloss() { printf '%s' "${DISPATCH_GLOSS[$1]:-}"; }
+# Pure parameter expansion — no fork per finding. `[` is escaped so the code
+# is matched literally, not as a glob class.
+dispatch_gloss() {
+  local rest; rest="${DISPATCH_GLOSS#*\[$1\]=\"}"
+  [[ "$rest" == "$DISPATCH_GLOSS" ]] && return 0
+  printf '%s' "${rest%%\"*}"
+}
 
 dispatch_init() {
   DISPATCH_LANG="$1"; shift

package/dispatch/lifecycle.md

@@ -199,8 +199,11 @@ version-sync check passes where defined; branch contains `origin/main` HEAD
 **`orly gate pr` follows the spec through the close.** A spec moved to `done/`
 on this branch is still discovered — its `Branch:` header names the branch —
 and every spec criterion runs against it; skip-pass is only for genuinely
-spec-less branches. Mechanical criteria: `spec.moved` (`Status: DONE` ⇒ the
-spec sits under `done/` and was moved on this branch) · `spec.baseline`
+spec-less branches. A deliberately folded spec retains the exact branch header
+and adds `**Folded-into:** \`M178_001\`` naming the owning spec. Discovery
+validates that relation and gates the sole non-folded owner; two non-folded
+specs on one branch remain a hard error. Mechanical criteria: `spec.moved`
+(`Status: DONE` ⇒ the spec sits under `done/` and was moved on this branch) · `spec.baseline`
 (`Test Baseline:` recorded) · `spec.ordering` (the branch's first commit
 carries the spec — no code before CHORE(open)) · `spec.deferrals` (a deferral
 claim needs the `> Indy (` ack quote in the spec). An Indy-acked deferral that

package/dispatch/write_any.sh

@@ -33,12 +33,12 @@ dispatch_run_helper "LOG"  "logging.sh"      "--staged"
 dispatch_run_helper "MSID" "msid-ui.sh"      "--staged"
 
 # ── delegations (run only in the product repo — need state absent from dotfiles) ──
-# ERR's leaf hard-exits if src/agentsfleetd/errors/error_registry.zig is absent (it
+# ERR's leaf hard-exits if the product repo's error registry is absent (it
 # cross-references emitted codes against the registry), unlike UFS/LOG/MSID which
 # pass gracefully on empty input. So it can't run in dotfiles — delegate it; the
 # product repo's `make harness-verify` runs error-codes.sh against the real
 # registry. The .md keeps [DETERMINISTIC → ERR]: deterministic, just not run here.
-dispatch_delegate "ERR" "make harness-verify (error-codes.sh — needs src/agentsfleetd/errors/error_registry.zig)"
+dispatch_delegate "ERR" "make harness-verify (error-codes.sh — needs the product repo's error registry)"
 
 # ── judgment gates (no script can decide; agent states verdict in chat) ──
 dispatch_judgment "GRP" "per-iteration (diff langs change) + end-of-turn: audit the diff against docs/greptile-learnings/RULES.md — one row per applicable code (UFS/ORP/TST-NAM/PRI/EMS/…); \"it's just a label\" is not an exception"

package/dispatch/write_zig.md

@@ -480,7 +480,7 @@ Rules:
 
 New production Zig modules must not define SQL statement text inline. Put query
 text in a domain-local `sql.zig` and import it from the state/handler/service
-module. This mirrors `src/agentsfleetd/fleet_bundle/sql.zig`: table names and
+module. The shape is a domain-local `sql.zig` beside the module it serves: table names and
 query statements stay grepable in one place, while the public module owns row
 mapping, allocator ownership, and error translation.
 

package/docs/CHANGELOG_VOICE.md

@@ -14,5 +14,5 @@ Editing `~/Projects/docs/changelog.mdx` or any other Mintlify `<Update>` block.
 - **Internal cleanup / refactor entries get the most aggressive trimming.** One lead paragraph + one bullet list. Skip "Test coverage" sections unless the test count is the headline. Indy's exact direction: *"Keep internal code cleanup, refactor to a minimal."*
 - **Never drop load-bearing facts.** Error codes (`UZ-AUTH-003`), endpoint paths + method + body shape + status code, env var names + defaults, schema column / table names, CLI subcommand + flag names, migration steps, money amounts. Tighten prose, not meaning.
 - **Historical entries are archives.** Brevity-pass them; never rewrite the past. A typo correction (e.g. `$0.001` → `$0.01` when it was never true) is allowed and must be called out in the commit message.
-- **Rate constants flow through three pinned files only:** `src/agentsfleetd/state/tenant_billing.zig`, `ui/packages/website/src/lib/rates.ts`, `~/Projects/docs/snippets/rates.mdx`. Bumping a rate requires a paired Pull Request (PR) across the docs repo — there is no automated guard. In `*.mdx`, use `import { STARTER_CREDIT, EVENT_RATE, STAGE_RATE } from "/snippets/rates.mdx"` instead of hand-typing `$5`.
+- **Rate constants flow through three pinned files only:** `rustd/crates/afd_billing/src/nanos.rs`, `ui/packages/website/src/lib/rates.ts`, `~/Projects/docs/snippets/rates.mdx`. Bumping a rate requires a paired Pull Request (PR) across the docs repo — there is no automated guard. In `*.mdx`, use `import { STARTER_CREDIT, EVENT_RATE, STAGE_RATE } from "/snippets/rates.mdx"` instead of hand-typing `$5`.
 - **The Mintlify reference Indy pasted (May 1 / May 8 entries) is canonical voice.** Mirror its rhythm, not its product nouns.

package/docs/EXECUTE_DOC_READS.md

@@ -22,7 +22,7 @@ Every triggered document requires one `📖 DOC READ: <path>` proof-line **per t
 | `*.mdx` | `dispatch/write_mdx.md` — structure, front matter, links, code fences, accessibility, and Mintlify isolation. | <!-- oracle-packs:language.mdx -->
 | Log emit (any language; see LOGGING GATE triggers) | `docs/LOGGING_STANDARD.md` — wire format (logfmt), severity ladder, error-code embedding, scope/event discipline, PII redaction, §10A tightenings. LOGGING GATE per edit. |
 | Lifecycle method in `*.zig` (`init|deinit|close|release|destroy|shutdown|dispose|free`) | `docs/LIFECYCLE_PATTERNS.md` — init/deinit pairing, errdefer placement, allocator ownership, defer/errdefer mutual exclusion, §10A tightenings. LIFECYCLE GATE per edit. |
-| `src/agentsfleetd/http/handlers/**` or `public/openapi/**` | `docs/REST_API_DESIGN_GUIDELINES.md` — Quick Checklist; §1–§5 (URL/method/body/response/error), §6 (OpenAPI), §7 (6-place route registration), §8 (`Hx` handler interface), §10 (pre-PR gates). |
+| `rustd/crates/afd_api*/src/handler/**` or `public/openapi/**` | `docs/REST_API_DESIGN_GUIDELINES.md` — Quick Checklist; §1–§5 (URL/method/body/response/error), §6 (OpenAPI), §7 (6-place route registration), §8 (`Hx` handler interface), §10 (pre-PR gates). |
 | `ui/packages/**/*.{tsx,jsx,css}`, `app/**/*.{tsx,jsx,css}`, `components/**/*.{tsx,jsx,css}`, repo-root `globals.css`, or any file changing visual tokens / motion / typography | `DESIGN.md` (repo root) or `docs/DESIGN_SYSTEM.md` — whichever the repo carries. Design system source of truth: typography stack, color tokens, the single accent and its currency rule, motion signature, spacing/density, component principles, CLI palette mapping. DOC READ proof-line per turn. |
 | `*.tsx` / `*.jsx` under `ui/packages/{app,website}/` | `dispatch/write_ts_adhere_bun.md` (Design Tokens) — token-utility table (text/tracking/leading/max-w/min-w/spacing/motion/radius/color). DESIGN TOKEN GATE fires per edit; audit via project-side `audits/design-tokens.sh`. |
 | Auth-flow | `docs/AUTH.md`. |

package/docs/LOGGING_STANDARD.md

@@ -35,7 +35,7 @@ Documented honestly, not aspirationally. Pre-M62 baseline (the fix-pass converge
 
 - The named module `log` (source: `src/lib/logging/mod.zig`) exposes `scoped(.tag)` returning a logger struct with `.err` / `.warn` / `.info` / `.debug` methods. M62 removed the older free-function helpers (`logErr` / `logErrWithHint` / `logWarnErr`) — there is no compat shim.
 - TypeScript (`cli/src/**`) calls `console.log`/`console.error` directly. No structure. No scope. No severity beyond err vs out.
-- Error-code embedding (`UZ-XXX-NNN`) appears on some `err` lines but not others. The registry (`src/agentsfleetd/errors/error_registry.zig`) is the source of truth, but enforcement is voluntary.
+- Error-code embedding (`UZ-XXX-NNN`) appears on some `err` lines but not others. The registry (`rustd/crates/afd_core/src/error_code.rs`) is the source of truth, but enforcement is voluntary.
 - No collector-friendly format. Logs are a mix of free-form English and ad-hoc `key={value}` fragments.
 
 The proposed standard below is what every new emit must conform to and what the fix-pass converges existing emits toward.
@@ -168,7 +168,7 @@ Log the source (`source=env:OPENAI_API_KEY`), never the value, at every level.
 
 > [DETERMINISTIC → LOG]
 
-Every `err` and `warn` record that maps to a domain error MUST carry `error_code=UZ-XXX-NNN` where `UZ-XXX-NNN` is declared in `src/agentsfleetd/errors/error_registry.zig`.
+Every `err` and `warn` record that maps to a domain error MUST carry `error_code=UZ-XXX-NNN` where `UZ-XXX-NNN` is declared in `rustd/crates/afd_core/src/error_code.rs`.
 
 - **Used-but-undeclared** (`UZ-FAKE-999` appearing in code, no entry in registry): **blocking** in `make lint`.
 - **Declared-but-unreferenced** (registry has `UZ-LEGACY-007`, no code references it): **informational**. Deletion may be deferred to a sweep milestone.

package/docs/ORLY_ARCHITECTURE.md

@@ -115,7 +115,7 @@ surfaces:
 {
   "commands": { "conform": [["make", "harness-verify"]],
                 "verify.unit": [["make", "test-unit-all"]] },
-  "surfaces": { "user": ["src/agentsfleetd/http/", "cli/src/"],
+  "surfaces": { "user": ["src/http/", "cli/src/"],
                 "docs": ["docs/"] }
 }
 ```

package/docs/REST_API_DESIGN_GUIDELINES.md

@@ -44,7 +44,6 @@ Run this checklist as part of `CHORE(close)` (per `~/.claude/CLAUDE.md` lifecycl
 - [ ] **Versioning** — added/renamed/removed surface listed in PR description; deprecation uses `Deprecation` + `Sunset` headers; new response fields declare `x-stability` (§9)
 - [ ] **Tests** — happy path + one error per `hx.fail` + idempotency double-PATCH + `Idempotency-Key` replay (where applicable) + ETag mismatch (§10)
 - [ ] **Logging** — sensitive ID values are DEBUG-only or carry `// log-id-allowed:` comment; secret-shaped fields are write-only or one-time-read (§11)
-- [ ] **`make check-openapi` clean** — bundle in sync, redocly lint, error-schema + URL-shape checks pass (§6)
 - [ ] **The repository's declared `verify.unit` command is clean** — the route-scope table's exhaustive match and its tests cover the auth gate matrix (§10)
 - [ ] **No file over 350 lines** (§10)
 - [ ] **`gitleaks detect` clean** (§10)
@@ -410,8 +409,6 @@ Don't invent other extensions without amending this doc.
 
 ## §6 — OpenAPI editing
 
-**`public/openapi.json` is a build artifact.** Never edit it directly. Edits get wiped on `make check-openapi` and CI's bundle-in-sync gate fails the PR.
-
 The source of truth lives under `public/openapi/`:
 
 ```
@@ -428,8 +425,7 @@ public/openapi/
 
 1. Edit the relevant YAML under `public/openapi/paths/<tag>.yaml`.
 2. Add / rename / remove the corresponding `match()` arm in `src/agentsfleetd/http/router.zig`.
-3. Run `make check-openapi` — bundles YAML → JSON, runs Redocly lint, runs `check_openapi_errors.py`, runs `check_openapi_url_shape.py` (REST §1).
-4. Commit YAML + bundled JSON + `router.zig` together. Splitting these across commits leaves CI red.
+3. Commit YAML + bundled JSON + `router.zig` together. Splitting these across commits leaves CI red.
 
 **Router ↔ openapi.json parity is reviewer-enforced.** There is no mechanical gate cross-checking that every `router.match()` arm has a documented openapi path or vice versa. When you add, rename, or remove a route, both surfaces must move in the same diff and the reviewer must verify it. The previous Python parity gate (`audits/check_openapi_sync.py`) and its data file (`route_manifest.zig`, deleted) were retired in M61_002.
 
@@ -715,7 +711,6 @@ Before opening a PR touching any handler:
 - [ ] POST endpoints accepting `Idempotency-Key` have a replay test: same key + same body → cached response; same key + different body → 4xx (§2)
 - [ ] Mutable resources have an ETag/`If-Match` test: stale `If-Match` → 412 with current `etag` returned (§4)
 - [ ] OpenAPI updated — endpoint definition, request/response schemas, error responses
-- [ ] `make check-openapi` — bundle in sync, redocly lint, error-schema + URL-shape checks, router parity
 - [ ] `gitleaks detect` clean
 - [ ] No new file over 350 lines
 

package/docs/RULE_ENFORCEMENT.md

@@ -7,14 +7,14 @@ regenerates this file and fails on any difference. To update it, run
 | Rule document | enforced by | judged | acknowledged | classified | trigger |
 |---|---|--:|--:|--:|---|
 | `docs/LOGGING_STANDARD.md` | `LOG` → `logging.sh` | 11 | 13 | 30/30 | mechanical |
-| `docs/REST_API_DESIGN_GUIDELINES.md` | — | 0 | 0 | 0/74 | mechanical |
+| `docs/REST_API_DESIGN_GUIDELINES.md` | — | 0 | 0 | 0/73 | mechanical |
 | `docs/SCHEMA_CONVENTIONS.md` | — | 0 | 0 | 0/16 | mechanical |
 | `docs/DOCUMENTATION_RULES.md` | — | 0 | 0 | 0/22 | latent |
 | `docs/LIFECYCLE_PATTERNS.md` | — | 0 | 0 | 0/22 | mechanical |
 | `docs/CHANGELOG_VOICE.md` | — | 0 | 0 | 0/3 | latent |
 | `docs/VERIFY_TIERS.md` | — | 0 | 0 | 0/7 | uncited |
 | `docs/greptile-learnings/RULES.md` | — | 0 | 0 | 0/114 | mechanical |
-| **corpus** | | | | **30/288** | |
+| **corpus** | | | | **30/287** | |
 
 ## How to read this
 

package/docs/SCHEMA_CONVENTIONS.md

@@ -16,7 +16,7 @@ Destructive changes (`DROP TABLE`, `DROP COLUMN`, type rewrites) require an expl
 
 - Each SQL file must be **≤100 lines** and **single-concern** (one table, one logical group, or one additive change).
 - Files are numbered sequentially: `001_core_foundation.sql`, `002_core_workflow.sql`, etc. New migrations append the next number; shipped numbers are never reused or slid.
-- Every SQL file must be registered in `schema/embed.zig` (compile-time embed) and `src/agentsfleetd/cmd/common.zig` (migration version array).
+- Every SQL file must be registered in `schema/embed.zig` (compile-time embed) and `rustd/crates/afd_db/src/migration.rs` (migration version array).
 - No-op stub files (e.g., columns folded into earlier files) are kept for version history but excluded from the migrations array.
 
 ## SQL Qualification
@@ -37,14 +37,14 @@ Destructive changes (`DROP TABLE`, `DROP COLUMN`, type rewrites) require an expl
 
 - **Column:** `id`
 - **Type:** Universally Unique Identifier (UUID) `PRIMARY KEY`
-- **Generation:** Application-side UUID version 7 (UUIDv7) via `src/agentsfleetd/types/id_format.zig`, never `gen_random_uuid()`.
+- **Generation:** Application-side UUID version 7 (UUIDv7) via `rustd/crates/afd_core/src/id.rs`, never `gen_random_uuid()`.
 - **No second unique key on the same value.** This is a correctness rule, not only a storage one: `ON CONFLICT` can arbitrate exactly one constraint, so a table carrying two unique keys over the same value makes two sessions inserting a brand-new row race to a duplicate-key error on the *other* index instead of taking the update arm. `schema/043_runner_lifetime_counters.sql` recorded this before the rule was generalised.
 - **Foreign keys reference the primary key**, never a secondary unique constraint.
 - **Constraint:** every table carries a UUIDv7 CHECK:
   ```sql
   CONSTRAINT ck_{table}_id_uuidv7 CHECK (substring(id::text from 15 for 1) = '7')
   ```
-- **Adding a new table:** add a `generate{TableName}Id()` function to `src/agentsfleetd/types/id_format.zig`.
+- **Adding a new table:** add a `generate{TableName}Id()` function to `rustd/crates/afd_core/src/id.rs`.
 - **API shape:** unchanged — public fields keep exposing `id`, `tenant_id`, `workspace_id` and the other documented names. The column now *is* the public name in most tables, so the aliasing the old rule required mostly disappears; where a public field differs from `id`, alias at the boundary rather than renaming client-facing payloads.
 - **Exceptions,** each stated in the slot that creates the table: a curated catalogue keyed by a stable slug (`core.fleet_library`) and a singleton keyed by a pinned integer (`core.model_catalogue_revision`) carry no UUID.
 

package/docs/TEMPLATE.md

@@ -100,6 +100,7 @@ SPEC AUTHORING RULES (load-bearing — the one comment that survives):
 **Categories:** {API | CLI | UI | SKILL | DOCS | OBS | INFRA — alphabetised, one or more}
 **Batch:** B{1-4} — {parallel execution context}
 **Branch:** {feat/mNN-name — added at CHORE(open)}
+<!-- A deliberately folded workstream adds Folded-into metadata per dispatch/lifecycle.md. -->
 **Test Baseline:** set at CHORE(open) — `unit=<N> integration=<M>` from the repository's declared `verify.*` commands (`.oracle/orly.json`)
 **Depends on:** {M{N}_{NNN} (one-line reason), …}
 **Provenance:** human-written | LLM-drafted ({model}, {date}) | agent-generated (pre-spec, {source doc})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsfleet/orly",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "Repository-scoped engineering harness: renders agent rules, materialises the gates that enforce them, and proves the PR boundary \u2014 for any coding agent.",
   "license": "MIT",
   "type": "module",

package/skills/orly-write-integration-test/SKILL.md

@@ -80,7 +80,7 @@ Spec asserts "503 on Redis down", code returns 200 → test the spec, flag the c
 | **Standard** | New service method, new Redis stream/key, schema change with logic | + T4 + T5 + T6 |
 | **Hardening** | Auth / payment / lease / migration / streaming / anything in the data-loss radius | + T7 (if applicable) + T8 + chaos pass |
 
-Auto-detect from diff: `src/auth/**`, `src/agent/leases/**`, `src/runner/**` + `src/agentsfleetd/fleet/**` (the lease/reclaim/fence + client-daemon surface → T9), schema migrations, streaming handlers → Hardening. CRUD-only against existing schema → Smoke. Default → Standard.
+Auto-detect from diff: `src/auth/**`, `src/agent/leases/**`, `src/runner/**` + `rustd/crates/afd_fleet/**` (the lease/reclaim/fence + client-daemon surface → T9), schema migrations, streaming handlers → Hardening. CRUD-only against existing schema → Smoke. Default → Standard.
 
 Any operation that touches multiple systems or acquires the same resource more than once is **Standard at minimum** and must run T4, even when the endpoint is otherwise CRUD-only.
 

package/src/cli.ts

@@ -15,6 +15,8 @@ type CliResult = { exitCode: number; gate?: string; failedCriterion?: string };
 const PASS_RESULT = "pass";
 const NOT_REQUIRED_RESULT = "not-required";
 const ACCEPT_DIRTY_FLAG = "--accept-dirty";
+const HELP_FLAG = "--help";
+const SHORT_HELP_FLAG = "-h";
 const REASON_FLAG = "--reason";
 const PIPE_OUTPUT = "pipe";
 const PACKAGE_MANIFEST = "package.json";
@@ -59,7 +61,7 @@ async function execute(engineRoot: string, args: string[]): Promise<CliResult> {
 
 async function run(model: RulesModel, args: string[]): Promise<CliResult> {
   const [command, ...rest] = args;
-  if (!command || command === "--help" || command === "-h") {
+  if (!command || command === HELP_FLAG || command === SHORT_HELP_FLAG) {
     printHelp();
     return cliResult(command ? 0 : 1);
   }
@@ -84,6 +86,10 @@ async function run(model: RulesModel, args: string[]): Promise<CliResult> {
 // Read-only: run every gate in order (stop at the first red group), or one
 // named gate. Nothing is ever written.
 function gate(model: RulesModel, args: string[]): CliResult {
+  if (args.includes(HELP_FLAG) || args.includes(SHORT_HELP_FLAG)) {
+    printHelp();
+    return cliResult(0);
+  }
   const acceptDirty = args.includes(ACCEPT_DIRTY_FLAG);
   const named = args.find((argument) => !argument.startsWith("-"));
   if (named !== undefined && !isGateName(named)) throw new OrlyError(`unknown gate: ${named} (work, verify, pr)`);

package/src/gates.ts

@@ -1,5 +1,5 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { join, relative } from "node:path";
+import { basename, join, relative } from "node:path";
 
 import { criteriaFor, CriterionContext, CriterionResult } from "./criteria";
 import { UNSCOPED_ENVIRONMENT } from "./git_env";
@@ -14,7 +14,8 @@ const GIT = "git";
 const DOCS_DIRECTORY = "docs";
 const ACTIVE_DIRECTORY = "active";
 const DONE_DIRECTORY = "done";
-const BRANCH_HEADER = "Branch:";
+const BRANCH_HEADER = "Branch";
+const FOLDED_INTO_HEADER = "Folded-into";
 const DEFAULT_BRANCHES = ["main", "master"];
 const UTF8 = "utf8";
 // Accept every real layout: docs/v1/, docs/v2/, docs/v0.9.2/ — cache-kit
@@ -22,6 +23,8 @@ const UTF8 = "utf8";
 const PROTOTYPE_PATTERN = /^v\d+(\.\d+)*$/;
 const MARKDOWN_EXTENSION = ".md";
 const NEWLINE = "\n";
+const MARKDOWN_HEADER_TOKEN_PATTERN = /^\s*\*\*([^*]+):\*\*\s*`([^`]+)`/;
+const SPEC_IDENTIFIER_PATTERN = /^(M\d+_\d+)(?:_|\.md$)/;
 // Strict trailer shape: "Orly-Override: <criterion> (<reason>)". A trailer
 // that does not parse is not an override — the gate stays red rather than
 // guessing what a malformed waiver meant.
@@ -36,6 +39,12 @@ export type GateReport = {
 };
 
 export type Override = { criterion: string; reason: string };
+type ClosedSpec = {
+  path: string;
+  identifier: string | undefined;
+  branch: string | undefined;
+  foldedInto: string | undefined;
+};
 
 // Run one gate: evaluate its criteria fresh from git + the working tree.
 // A red criterion with a matching Orly-Override trailer on the branch is
@@ -110,10 +119,22 @@ export function activeSpecPath(root: string): string | undefined {
 export function closedSpecPath(root: string): string | undefined {
   const branch = gitOutput(root, ["rev-parse", "--abbrev-ref", "HEAD"]);
   if (!branch || DEFAULT_BRANCHES.includes(branch)) return undefined;
-  const specs = specPathsUnder(root, DONE_DIRECTORY).filter((path) => branchNamed(path, branch));
+  const specs = specPathsUnder(root, DONE_DIRECTORY)
+    .map(closedSpec)
+    .filter((spec): spec is ClosedSpec => spec !== undefined && spec.branch === branch);
   if (specs.length === 0) return undefined;
-  if (specs.length > 1) throw new OrlyError(`more than one done/ spec names branch ${branch} — one stream per worktree:${NEWLINE}${specs.join(NEWLINE)}`);
-  return specs[0];
+  const owners = specs.filter((spec) => spec.foldedInto === undefined);
+  if (owners.length === 0) throw new OrlyError(`every done/ spec naming branch ${branch} is folded — one owning stream is required:${NEWLINE}${specs.map((spec) => spec.path).join(NEWLINE)}`);
+  if (owners.length > 1) throw new OrlyError(`more than one done/ spec names branch ${branch} — one stream per worktree:${NEWLINE}${owners.map((spec) => spec.path).join(NEWLINE)}`);
+  const owner = owners[0];
+  if (!owner) throw new OrlyError(`done/ spec ownership could not be resolved for branch ${branch}`);
+  const folded = specs.filter((spec) => spec.foldedInto !== undefined);
+  if (folded.length > 0 && !owner.identifier) throw new OrlyError(`the owning done/ spec for branch ${branch} has no milestone and workstream identifier: ${owner.path}`);
+  const selfFolds = folded.filter((spec) => spec.identifier === spec.foldedInto);
+  if (selfFolds.length > 0) throw new OrlyError(`folded done/ specs naming branch ${branch} cannot fold into themselves:${NEWLINE}${selfFolds.map((spec) => spec.path).join(NEWLINE)}`);
+  const invalidFolds = folded.filter((spec) => spec.foldedInto !== owner.identifier);
+  if (invalidFolds.length > 0) throw new OrlyError(`folded done/ specs naming branch ${branch} must name their owner ${owner.identifier}:${NEWLINE}${invalidFolds.map((spec) => spec.path).join(NEWLINE)}`);
+  return owner.path;
 }
 
 // An in-flight (active/) spec wins; otherwise the branch's closed spec gates.
@@ -124,11 +145,23 @@ export function specPathFor(root: string): { path: string; closed: boolean } | u
   return closed ? { path: closed, closed: true } : undefined;
 }
 
-function branchNamed(path: string, branch: string): boolean {
+function closedSpec(path: string): ClosedSpec | undefined {
   try {
-    return readFileSync(path, UTF8).split(/\r?\n/).some((line) => line.includes(BRANCH_HEADER) && line.includes(branch));
+    const metadata: ClosedSpec = {
+      path,
+      identifier: basename(path).match(SPEC_IDENTIFIER_PATTERN)?.[1],
+      branch: undefined,
+      foldedInto: undefined,
+    };
+    for (const line of readFileSync(path, UTF8).split(/\r?\n/)) {
+      if (line.startsWith("## ")) break;
+      const match = line.match(MARKDOWN_HEADER_TOKEN_PATTERN);
+      if (match?.[1] === BRANCH_HEADER) metadata.branch = match[2];
+      if (match?.[1] === FOLDED_INTO_HEADER) metadata.foldedInto = match[2];
+    }
+    return metadata;
   } catch {
-    return false;
+    return undefined;
   }
 }
 

package/src/gates_spec.test.ts

@@ -2,10 +2,10 @@ import { afterEach, describe, expect, test } from "bun:test";
 import { mkdirSync } from "node:fs";
 import { join } from "node:path";
 
-import { activeSpecPath, runGate } from "./gates";
+import { activeSpecPath, closedSpecPath, runGate } from "./gates";
 import {
-  cleanupTemporaryDirectories, closedSpecRepository, git, modelFor,
-  newRepository, newSpecRepository, SPEC_RELATIVE, specFixture,
+  cleanupTemporaryDirectories, closedSpecRepository, fixtureRegistry, git, modelFor,
+  newRepository, newSpecRepository, orly, SPEC_RELATIVE, specFixture,
 } from "./gates_test_support";
 
 afterEach(cleanupTemporaryDirectories);
@@ -39,6 +39,78 @@ describe("spec discovery", () => {
 });
 
 describe("closed-spec follow-through", () => {
+  test("two owning specs naming one branch remain a hard error", async () => {
+    const project = closedSpecRepository("feat/shared");
+    mkdirSync(join(project, "docs/v2/done"), { recursive: true });
+    await Bun.write(join(project, "docs/v2/done/M100_001_P2_CLI_SECOND.md"), specFixture("DONE", "feat/shared"));
+
+    expect(() => closedSpecPath(project)).toThrow("one stream per worktree");
+  });
+
+  test("a folded spec yields ownership to the spec it names", async () => {
+    const project = closedSpecRepository("feat/shared");
+    mkdirSync(join(project, "docs/v2/done"), { recursive: true });
+    await Bun.write(
+      join(project, "docs/v2/done/M100_001_P2_CLI_FOLDED.md"),
+      specFixture("DONE", "feat/shared", ["**Folded-into:** `M99_001`"]),
+    );
+
+    expect(closedSpecPath(project)).toEndWith("M99_001_P2_CLI_FIXTURE.md");
+  });
+
+  test("a folded spec must name the exact owner on its branch", async () => {
+    const project = closedSpecRepository("feat/shared");
+    mkdirSync(join(project, "docs/v2/done"), { recursive: true });
+    await Bun.write(
+      join(project, "docs/v2/done/M100_001_P2_CLI_FOLDED.md"),
+      specFixture("DONE", "feat/shared", ["**Folded-into:** `M404_001`"]),
+    );
+
+    expect(() => closedSpecPath(project)).toThrow("must name their owner M99_001");
+  });
+
+  test("a folded spec cannot name itself", async () => {
+    const project = closedSpecRepository("feat/shared");
+    mkdirSync(join(project, "docs/v2/done"), { recursive: true });
+    await Bun.write(
+      join(project, "docs/v2/done/M100_001_P2_CLI_FOLDED.md"),
+      specFixture("DONE", "feat/shared", ["**Folded-into:** `M100_001`"]),
+    );
+
+    expect(() => closedSpecPath(project)).toThrow("cannot fold into themselves");
+  });
+
+  test("a branch name is not a prefix match", async () => {
+    const project = newRepository();
+    git(project, "checkout", "-q", "-b", "feat/foo");
+    mkdirSync(join(project, "docs/v1/done"), { recursive: true });
+    await Bun.write(join(project, "docs/v1/done/M99_001_P2_CLI_OTHER.md"), specFixture("DONE", "feat/foo-2"));
+
+    expect(closedSpecPath(project)).toBeUndefined();
+  });
+
+  test("prose mentioning a branch does not declare ownership", async () => {
+    const project = newRepository();
+    git(project, "checkout", "-q", "-b", "feat/foo");
+    mkdirSync(join(project, "docs/v1/done"), { recursive: true });
+    await Bun.write(
+      join(project, "docs/v1/done/M99_001_P2_CLI_OTHER.md"),
+      specFixture("DONE", undefined, ["**Branch:** folded into `feat/foo` rather than taken as its own tree"]),
+    );
+
+    expect(closedSpecPath(project)).toBeUndefined();
+  });
+
+  test("gate help does not discover specs", async () => {
+    const project = closedSpecRepository("feat/shared");
+    mkdirSync(join(project, "docs/v2/done"), { recursive: true });
+    await Bun.write(join(project, "docs/v2/done/M100_001_P2_CLI_SECOND.md"), specFixture("DONE", "feat/shared"));
+
+    const result = orly(project, fixtureRegistry(project), "gate", "--help");
+    expect(result.code).toBe(0);
+    expect(result.output).toContain("orly gate");
+  });
+
   test("a spec closed to done/ is discovered by its Branch: header and still gated", async () => {
     const project = closedSpecRepository("feat/closed");
     const model = await modelFor(project);