@agentsfleet/orly 0.9.2 → 0.9.4

package/audits/cross-tier-rates.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # cross-tier-rates.sh — pin numeric parity of the rate constants
-# across Zig + three TypeScript surfaces.
+# across the daemon + three TypeScript surfaces.
 #
 # RULE UFS extension. The shipped billing surface depends on these constants
 # having identical numeric values everywhere they appear:
@@ -16,13 +16,13 @@
 #
 # Files (one definition site per constant per file):
 #
-#   src/agentsfleetd/state/tenant_billing.zig       — server enforces the charge
+#   rustd/crates/afd_billing/src/nanos.rs   — server enforces the charge
 #   ui/packages/website/src/lib/rates.ts    — pricing page display
 #   ui/packages/app/lib/types.ts            — dashboard display
 #   cli/src/constants/billing.ts    — `agentsfleet doctor --json` billing block
 #
 # A drift between any two = a billing-display lie or a server-vs-CLI disagreement.
-# Zig is the source of truth (server enforces); the three TS surfaces echo it.
+# The daemon is the source of truth (server enforces); the three TS surfaces echo it.
 #
 # Fires in: make harness-verify, make harness-verify-all.
 # Exits 0 clean, 1 on any drift.
@@ -37,7 +37,7 @@ readonly NAMES=(
 )
 
 readonly FILES=(
-  src/agentsfleetd/state/tenant_billing.zig
+  rustd/crates/afd_billing/src/nanos.rs
   ui/packages/website/src/lib/rates.ts
   ui/packages/app/lib/types.ts
   cli/src/constants/billing.ts
@@ -96,7 +96,7 @@ if [[ $FAIL -ne 0 ]]; then
     printf "  %s\n" "$v" >&2
   done
   printf "\nFix: align all four files on the canonical Zig value\n" >&2
-  printf "     (src/agentsfleetd/state/tenant_billing.zig is the server-side enforcer).\n" >&2
+  printf "     (rustd/crates/afd_billing/src/nanos.rs is the server-side enforcer).\n" >&2
   exit 1
 fi
 

package/audits/deinit-pairs.sh

@@ -60,11 +60,14 @@ note() { printf "NOTE: %s\n" "$*"; }
 # ---------------------------------------------------------------------------
 case "$MODE" in
   --staged|staged)
-    mapfile -t FILES < <(git diff --cached --name-only --diff-filter=ACMRT \
+    # while read, not mapfile — bash-3.2 portability (see scripts/run-playbook-tests.sh).
+    FILES=()
+    while IFS= read -r f; do FILES+=("$f"); done < <(git diff --cached --name-only --diff-filter=ACMRT \
       | grep -E '^src/.*\.zig$' || true)
     ;;
   --all|all)
-    mapfile -t FILES < <(find src -type f -name '*.zig' 2>/dev/null || true)
+    FILES=()
+    while IFS= read -r f; do FILES+=("$f"); done < <(find src -type f -name '*.zig' 2>/dev/null || true)
     ;;
   *)
     printf "usage: %s [--staged|--all]\n" "$0" >&2
@@ -106,10 +109,13 @@ done
 # M70 perf: pre-compute file sets in batched greps instead of one grep
 # per file (~760 forks → 2 forks). Reads as "membership sets" for the
 # per-init loop below.
-declare -A files_with_cleanup=()
+# A membership set as a newline-delimited string, not declare -A: associative
+# arrays are bash 4+ and macOS ships 3.2. Lookup is a substring test on
+# \n<file>\n, which filenames cannot fake.
+files_with_cleanup=$'\n'
 if [[ ${#present_files[@]} -gt 0 ]]; then
   while IFS= read -r f; do
-    [[ -n "$f" ]] && files_with_cleanup["$f"]=1
+    [[ -n "$f" ]] && files_with_cleanup="${files_with_cleanup}${f}"$'\n'
   done < <(grep -lE "$CLEANUP_RE" "${present_files[@]}" 2>/dev/null || true)
 fi
 
@@ -151,7 +157,7 @@ if [[ -n "$inits_list" ]]; then
     fi
 
     inits_requires_cleanup=$((inits_requires_cleanup + 1))
-    if [[ -z "${files_with_cleanup[$f]+x}" ]]; then
+    if [[ "$files_with_cleanup" != *$'\n'"$f"$'\n'* ]]; then
       inits_unpaired=$((inits_unpaired + 1))
       reason=""
       [[ $heap -eq 1 ]] && reason="heap-return"

package/audits/error-codes.sh

@@ -1,60 +1,51 @@
 #!/usr/bin/env bash
-# error-codes.sh — orphan + dead code detection against the canonical
-# error registry at src/agentsfleetd/errors/error_registry.zig, plus a raw-literal check
-# enforcing that UZ-<CAT>-<NNN> strings only appear in registry/allowlist
-# files (every other call site must reference the registry symbol).
+# error-codes.sh — orphan + dead code detection against a repository's canonical
+# error registry, plus a raw-literal check enforcing that <PREFIX>-<CAT>-<NNN>
+# strings only appear in registry/allowlist files (every other call site must
+# reference the registry symbol).
 #
 # Dispatch façade: dispatch/write_any.md (Error Registry Gate)
-# Fires in: CONFORM (via `make harness-verify` in `agentsfleet`).
+# Fires in: CONFORM (via the repository's declared `conform` command).
 #
-# TECHNICAL DEBT (acknowledged on migration to dotfiles, 2026-05-11):
-# The script hard-codes:
-#   - `UZ-` as the error-code prefix (agentsfleet schema)
-#   - `src/agentsfleetd/errors/error_registry.zig` as the canonical registry path
-#   - The raw-literal allowlist below (src/agentsfleetd/errors/**, src/runner/engine/client_errors.zig)
-# A parameterised version that reads prefix + registry path + allowlist
-# from a per-project config (e.g. `.audit-error-codes.toml`) is the right
-# long-term shape; not done yet. Today, this script lives in dotfiles so
-# the gate body and the audit binary stay co-located.
+# WHAT IS CONFIGURED, AND WHY IT IS NOT A PATH IN THIS FILE.
+# This script used to hard-code one repository's registry path, source globs and
+# allowlist. That repository retired the runtime those paths named, and the gate
+# then pointed at nothing — the same silent-green failure the UFS parity check
+# was fixed for. Every one of them is now resolved at run time, and the file
+# names no repository's layout:
+#
+#   ORLY_ERROR_PREFIX     code prefix                (default: UZ)
+#   ORLY_ERROR_REGISTRY   registry file(s), a glob   (default: autodetected)
+#   ORLY_ERROR_SOURCES    where codes may be USED    (default: by runtime)
+#   ORLY_ERROR_ALLOWLIST  extra raw-literal paths    (regex, appended)
+#
+# AUTODETECTION picks the runtime that actually declares codes:
+#   Rust — a file declaring `ErrorCode::declare("<PREFIX>-…")`; sources are the
+#          crate tree's `*.rs`.
+#   Zig  — a file named `error_registry.zig`; sources are `src/**/*.zig`.
+# A repository with neither SKIPS with a reason and exits 0. It does not fail,
+# and it does not pass by scanning nothing and calling that clean.
 #
 # Definitions:
-#   - DECLARED  — every UZ-<CAT>-<NNN> string literal in error_registry.zig
-#   - USED      — every UZ-<CAT>-<NNN> reference in src/**/*.zig (excluding
-#                  the registry itself). agentsfleet/src/** is intentionally
-#                  out of scope — the CLI consumes server-emitted UZ-* codes
-#                  as opaque strings from API responses; the dispatcher's
-#                  typed CliError variants are the CLI's named surface.
+#   - DECLARED  — every <PREFIX>-<CAT>-<NNN> literal in the registry
+#   - USED      — every such reference in the source set, minus the registry
 #   - ORPHAN    — USED but not DECLARED  (BLOCKING)
 #   - DEAD      — DECLARED but not USED  (INFORMATIONAL)
-#   - RAW LEAK  — UZ-<CAT>-<NNN> string literal in a source file outside
-#                  the registry/allowlist (BLOCKING — RULE UFS at the error
-#                  surface; non-allowlisted call sites must use a registry
-#                  symbol, never duplicate the literal).
-#
-# Raw-literal allowlist (files where UZ-* literals are legitimate):
-#   - src/agentsfleetd/errors/**            (canonical registry + entry tables)
-#   - src/runner/engine/client_errors.zig   (the runner engine's own mirror file
-#                                            — see file header for build-module
-#                                            isolation rationale; deliberate
-#                                            duplication, all other executor
-#                                            sources import from there)
-#   - **/*_test.zig                         (tests)
-#   - src/zbench_fixtures.zig               (benchmark fixture seeds)
-#   - src/agentsfleetd/http/test_harness.zig (HTTP test harness)
-#   - lines starting with `//`              (comments)
-#   - lines annotated `// audit-error-codes: intentional-fake`
+#   - RAW LEAK  — a code literal in a source file outside the registry and the
+#                 allowlist (BLOCKING — RULE UFS at the error surface)
 #
-# Tests INCLUDED for orphan detection — same code-registry rules apply to
-# test code. A test referencing a fake code (e.g. UZ-FAKE-999) for
-# negative-path testing must annotate the line:
-# `// audit-error-codes: intentional-fake` and the audit will skip it.
+# Raw-literal allowlist: the registry files themselves, anything test-shaped
+# (`*_test.zig`, `*_test.rs`, a `tests/` directory, a test harness), plus
+# whatever `ORLY_ERROR_ALLOWLIST` adds. Lines starting `//` are comments, and a
+# line annotated `// audit-error-codes: intentional-fake` skips itself and the
+# line below it — which is how a negative test names a code that must not exist.
 #
 # Modes:
 #   --staged   diff-scope: only files in `git diff --cached` are checked
 #              for new orphan refs (registry checked unconditionally)
 #   --all      (default) full repo scan
 #
-# Exits 0 clean, 1 on orphans or raw leaks (DEAD findings never block).
+# Exits 0 clean or skipped, 1 on orphans or raw leaks (DEAD never blocks).
 
 set -euo pipefail
 
@@ -62,8 +53,54 @@ MODE="${1:-${SCOPE:-all}}"
 ROOT="$(git rev-parse --show-toplevel)"
 cd "$ROOT"
 
-REGISTRY="src/agentsfleetd/errors/error_registry.zig"
-[[ -f "$REGISTRY" ]] || { printf "FAIL: registry missing: %s\n" "$REGISTRY" >&2; exit 1; }
+PREFIX="${ORLY_ERROR_PREFIX:-UZ}"
+CODE_RE="${PREFIX}-[A-Z][A-Z0-9]*-[0-9]{3,}"
+
+# Registry files, then the runtime whose sources may reference them. Resolved
+# together: the source set follows from what declares the codes, so a repository
+# cannot end up scanning one runtime's files for another runtime's registry.
+REGISTRY_PATHS=()
+RUNTIME=""
+if [[ -n "${ORLY_ERROR_REGISTRY:-}" ]]; then
+  while IFS= read -r f; do [[ -n "$f" ]] && REGISTRY_PATHS+=("$f"); done < <(
+    git ls-files -- $ORLY_ERROR_REGISTRY 2>/dev/null || true)
+  [[ ${#REGISTRY_PATHS[@]} -gt 0 ]] || {
+    printf "FAIL: ORLY_ERROR_REGISTRY matched no tracked file: %s\n" "$ORLY_ERROR_REGISTRY" >&2
+    exit 1
+  }
+  case "${REGISTRY_PATHS[0]}" in *.rs) RUNTIME=rust ;; *.zig) RUNTIME=zig ;; *) RUNTIME=other ;; esac
+else
+  while IFS= read -r f; do [[ -n "$f" ]] && REGISTRY_PATHS+=("$f"); done < <(
+    git grep -l -E "ErrorCode::declare\(\"${PREFIX}-" -- '*.rs' 2>/dev/null \
+      | grep -vE "_tests?\.rs$|(^|/)tests?/|(^|/)tests?\.rs$" | sort || true)
+  if [[ ${#REGISTRY_PATHS[@]} -gt 0 ]]; then
+    RUNTIME=rust
+  else
+    while IFS= read -r f; do [[ -n "$f" ]] && REGISTRY_PATHS+=("$f"); done < <(
+      git ls-files -- '*error_registry.zig' 2>/dev/null | sort || true)
+    [[ ${#REGISTRY_PATHS[@]} -gt 0 ]] && RUNTIME=zig
+  fi
+fi
+
+if [[ ${#REGISTRY_PATHS[@]} -eq 0 ]]; then
+  printf "OK:   audit-error-codes: skipped — no %s-* registry found, so this repository has no source of truth to compare against\n" "$PREFIX"
+  exit 0
+fi
+
+# Where a code may legitimately be REFERENCED.
+if [[ -n "${ORLY_ERROR_SOURCES:-}" ]]; then
+  SOURCE_GLOB="$ORLY_ERROR_SOURCES"
+elif [[ "$RUNTIME" = "rust" ]]; then
+  SOURCE_GLOB='*.rs'
+else
+  SOURCE_GLOB='*.zig'
+fi
+
+# The registry files are their own allowlist, joined with the test-shaped paths
+# every runtime spells differently, plus whatever the caller adds.
+REGISTRY_RE="$(printf '%s\n' "${REGISTRY_PATHS[@]}" | sed 's|[.[\*^$/]|\\&|g' | paste -sd'|' -)"
+ALLOWLIST_RE="^(${REGISTRY_RE})$|_tests?\\.(zig|rs)$|(^|/)tests?/|(^|/)tests?\\.rs$|/_?test_harness\\.[a-z]+$|_test_fixtures\\.[a-z]+$"
+[[ -n "${ORLY_ERROR_ALLOWLIST:-}" ]] && ALLOWLIST_RE="${ALLOWLIST_RE}|${ORLY_ERROR_ALLOWLIST}"
 
 FAIL=0
 fail() { printf "FAIL: %s\n" "$*" >&2; FAIL=1; }
@@ -78,9 +115,9 @@ note() { printf "NOTE: %s\n" "$*"; }
 #    the entire UZ-UUIDV7-* family (its category ends in a digit), leaving those
 #    codes invisible to the orphan/dead/used passes below.
 # ---------------------------------------------------------------------------
-declared_codes=$(grep -oE 'UZ-[A-Z][A-Z0-9]*-[0-9]{3,}\b' "$REGISTRY" | sort -u)
+declared_codes=$(grep -hoE "${CODE_RE}\b" "${REGISTRY_PATHS[@]}" | sort -u)
 if [[ -z "$declared_codes" ]]; then
-  fail "no codes declared in $REGISTRY (registry empty?)"
+  fail "no codes declared in ${REGISTRY_PATHS[*]} (registry empty?)"
   exit 1
 fi
 declared_count=$(printf '%s\n' "$declared_codes" | wc -l | tr -d ' ')
@@ -93,13 +130,12 @@ declared_count=$(printf '%s\n' "$declared_codes" | wc -l | tr -d ' ')
 gather_used_paths() {
   case "$MODE" in
     --staged|staged)
-      git diff --cached --name-only --diff-filter=ACMRT \
-        | grep -E '^src/' \
-        | grep -vE '^src/agentsfleetd/errors/error_registry\.zig$' || true
+      git diff --cached --name-only --diff-filter=ACMRT -- $SOURCE_GLOB 2>/dev/null \
+        | grep -vE "^(${REGISTRY_RE})$" || true
       ;;
     --all|all)
-      find src -type f -name '*.zig' 2>/dev/null \
-        | grep -vE '^src/agentsfleetd/errors/error_registry\.zig$'
+      git ls-files -- $SOURCE_GLOB 2>/dev/null \
+        | grep -vE "^(${REGISTRY_RE})$" || true
       ;;
     *)
       printf "usage: %s [--staged|--all]\n" "$0" >&2
@@ -108,24 +144,49 @@ gather_used_paths() {
   esac
 }
 
-mapfile -t USED_PATHS < <(gather_used_paths)
+# `while read` rather than mapfile: mapfile is bash 4+ and macOS ships 3.2 —
+# the portability rule scripts/run-playbook-tests.sh already records.
+USED_PATHS=()
+while IFS= read -r p; do USED_PATHS+=("$p"); done < <(gather_used_paths)
 if [[ ${#USED_PATHS[@]} -eq 0 ]]; then
   ok "no source files in scope ($MODE)"
   exit 0
 fi
 
-used_codes=$(awk '
+used_codes=$(awk -v prefix="$PREFIX" '
   # Reset per-file so a trailing intentional-fake marker in the previous
   # file cannot carry skip_next=1 into the first line of the next file.
-  FNR == 1 { skip_next = 0 }
+  FNR == 1 { skip_next = 0; in_rs_test = 0; rs_open = 0; rs_depth = 0 }
+  # Rust keeps its unit tests INSIDE the file they cover, under
+  # `#[cfg(test)] mod tests { ... }`, so a negative test naming a code it
+  # expects to be refused reads as a raw literal in the production half of
+  # that same file. Same brace-depth shape as audits/ufs.sh.
+  FILENAME ~ /\.rs$/ {
+    if (in_rs_test) {
+      tmp = $0
+      rs_depth += gsub(/\{/, "{", tmp) - gsub(/\}/, "}", tmp)
+      if (!rs_open && index($0, "{") > 0) rs_open = 1
+      if (rs_open && rs_depth <= 0) in_rs_test = 0
+      next
+    }
+    if ($0 ~ /^[[:space:]]*#\[cfg\(test\)\]/ ||
+        $0 ~ /^[[:space:]]*#\[[A-Za-z_:]*test\]/) {
+      in_rs_test = 1; rs_open = 0; rs_depth = 0
+      next
+    }
+  }
   # Skip the line carrying the marker AND the next non-blank line (the
   # marker sits on the comment line above the code line in Zig style).
   /audit-error-codes: intentional-fake/ { skip_next = 1; next }
+  # A code NAMED in prose is a reference to history, not a call site: Rust doc
+  # comments routinely say which code a path used to return. Skipping them here
+  # matches the raw-literal scan below, which has always skipped comments.
+  /^[[:space:]]*\/\// { next }
   /^[[:space:]]*$/ { next }
   skip_next { skip_next = 0; next }
   {
     line = $0;
-    while (match(line, /UZ-[A-Z][A-Z0-9]*-[0-9][0-9][0-9][0-9]*/)) {
+    while (match(line, prefix "-[A-Z][A-Z0-9]*-[0-9][0-9][0-9][0-9]*")) {
       m = substr(line, RSTART, RLENGTH);
       # Reject codes whose digit run is followed by a word char (rejects
       # placeholder forms like UZ-INTERNAL-00X that grep would truncate).
@@ -150,7 +211,7 @@ used_count=0
 # ---------------------------------------------------------------------------
 orphans=$(comm -23 <(printf '%s\n' "$used_codes") <(printf '%s\n' "$declared_codes") | grep -v '^$' || true)
 if [[ -n "$orphans" ]]; then
-  fail "orphan codes (used but not declared in $REGISTRY):"
+  fail "orphan codes (used but not declared in ${REGISTRY_PATHS[*]}):"
   while IFS= read -r code; do
     [[ -z "$code" ]] && continue
     printf "        %s  refs:\n" "$code" >&2
@@ -185,20 +246,37 @@ fi
 #       2-segment pattern. We don't want a "UZ-X-Y-NNN" code reintroduced
 #      via a local const that the orphan pass silently ignores.
 # ---------------------------------------------------------------------------
-raw_leaks=$(awk '
-  FNR == 1 { skip_next = 0 }
+raw_leaks=$(awk -v prefix="$PREFIX" '
+  FNR == 1 { skip_next = 0; in_rs_test = 0; rs_open = 0; rs_depth = 0 }
+  # Rust keeps its unit tests INSIDE the file they cover, under
+  # `#[cfg(test)] mod tests { ... }`, so a negative test naming a code it
+  # expects to be refused reads as a raw literal in the production half of
+  # that same file. Same brace-depth shape as audits/ufs.sh.
+  FILENAME ~ /\.rs$/ {
+    if (in_rs_test) {
+      tmp = $0
+      rs_depth += gsub(/\{/, "{", tmp) - gsub(/\}/, "}", tmp)
+      if (!rs_open && index($0, "{") > 0) rs_open = 1
+      if (rs_open && rs_depth <= 0) in_rs_test = 0
+      next
+    }
+    if ($0 ~ /^[[:space:]]*#\[cfg\(test\)\]/ ||
+        $0 ~ /^[[:space:]]*#\[[A-Za-z_:]*test\]/) {
+      in_rs_test = 1; rs_open = 0; rs_depth = 0
+      next
+    }
+  }
   # Skip the line carrying the marker AND the next non-blank line.
   /audit-error-codes: intentional-fake/ { skip_next = 1; next }
   /^[[:space:]]*\/\// { next }
   /^[[:space:]]*$/ { next }
   skip_next { skip_next = 0; next }
   # Match any "UZ-XXX(-YYY)*-NNN" string literal.
-  /"UZ-[A-Z][A-Z0-9-]*-[0-9]+"/ {
+  $0 ~ "\"" prefix "-[A-Z][A-Z0-9-]*-[0-9]+\"" {
     print FILENAME ":" FNR ":" $0;
   }
 ' $(printf '%s\n' "${USED_PATHS[@]}" | grep -vE \
-    '^src/agentsfleetd/errors/|/_?test_harness\.zig$|_test\.zig$|^src/runner/engine/client_errors\.zig$|^src/zbench_fixtures\.zig$' \
-    || true) 2>/dev/null || true)
+    "$ALLOWLIST_RE" || true) 2>/dev/null || true)
 
 if [[ -n "$raw_leaks" ]]; then
   fail "raw UZ-* literals found outside the registry allowlist (must reference a registry symbol):"
@@ -212,7 +290,7 @@ fi
 # ---------------------------------------------------------------------------
 # 5. Verdict.
 # ---------------------------------------------------------------------------
-ok "registry: $declared_count declared, $used_count used"
+ok "registry (${RUNTIME:-unknown}): $declared_count declared, $used_count used"
 if [[ $FAIL -ne 0 ]]; then
   printf "\n🔴 ERROR REGISTRY GATE: violations found. Reference the registry symbol (e.g. \`error_codes.ERR_X\` or \`client_errors.ERR_X\` for the executor crate) instead of duplicating the literal.\n" >&2
   exit 1

package/audits/logging.sh

@@ -110,7 +110,10 @@ gather_paths() {
   esac
 }
 
-mapfile -t FILES < <(gather_paths)
+# `while read` rather than mapfile: mapfile is bash 4+ and macOS ships 3.2 —
+# the portability rule scripts/run-playbook-tests.sh already records.
+FILES=()
+while IFS= read -r p; do FILES+=("$p"); done < <(gather_paths)
 if [[ ${#FILES[@]} -eq 0 ]]; then
   ok "no source files in scope ($MODE)"
   exit 0
@@ -139,7 +142,9 @@ for f in "${FILES[@]}"; do
 done
 
 if [[ ${#rust_nontest[@]} -gt 0 ]]; then
-  mapfile -t rust_candidates < <(grep -lE '(^|[^[:alnum:]_])(println|eprintln|dbg)!|tracing::(error|warn|info|debug|trace)!' "${rust_nontest[@]}" 2>/dev/null || true)
+  rust_candidates=()
+  while IFS= read -r p; do rust_candidates+=("$p"); done \
+    < <(grep -lE '(^|[^[:alnum:]_])(println|eprintln|dbg)!|tracing::(error|warn|info|debug|trace)!' "${rust_nontest[@]}" 2>/dev/null || true)
 fi
 
 # ---------------------------------------------------------------------------
@@ -388,12 +393,17 @@ fi
 # ---------------------------------------------------------------------------
 scoped_hits=0
 scoped_eligible=()
-for f in "${zig_nontest[@]}"; do
-  case "$f" in
-    src/logging/*) continue ;;
-  esac
-  scoped_eligible+=("$f")
-done
+# Guarded like every sibling loop: bash 3.2 under `set -u` treats "${empty[@]}"
+# as unbound (fixed only in 4.4), so an unguarded expansion aborts the audit in
+# any repository with no Zig sources. macOS ships 3.2.
+if [[ ${#zig_nontest[@]} -gt 0 ]]; then
+  for f in "${zig_nontest[@]}"; do
+    case "$f" in
+      src/logging/*) continue ;;
+    esac
+    scoped_eligible+=("$f")
+  done
+fi
 if [[ ${#scoped_eligible[@]} -gt 0 ]]; then
   while IFS= read -r line; do
     [[ -z "$line" ]] && continue

package/audits/spec-template.sh

@@ -48,13 +48,17 @@ note() { printf "NOTE: %s\n" "$*"; }
 # Discover spec files in scope.
 case "$MODE" in
   --staged|staged)
-    mapfile -t SPECS < <(git diff --cached --name-only --diff-filter=ACMRT | grep -E '^docs/v[0-9]+/(pending|active|done)/.*\.md$' || true)
+    # while read, not mapfile — bash-3.2 portability (see scripts/run-playbook-tests.sh).
+    SPECS=()
+    while IFS= read -r s; do SPECS+=("$s"); done < <(git diff --cached --name-only --diff-filter=ACMRT | grep -E '^docs/v[0-9]+/(pending|active|done)/.*\.md$' || true)
     ;;
   --all|all)
-    mapfile -t SPECS < <(find docs/v[0-9]* -type f -name '*.md' 2>/dev/null | grep -E '/(pending|active)/' || true)
+    SPECS=()
+    while IFS= read -r s; do SPECS+=("$s"); done < <(find docs/v[0-9]* -type f -name '*.md' 2>/dev/null | grep -E '/(pending|active)/' || true)
     ;;
   --include-done|include-done)
-    mapfile -t SPECS < <(find docs/v[0-9]* -type f -name '*.md' 2>/dev/null | grep -E '/(pending|active|done)/' || true)
+    SPECS=()
+    while IFS= read -r s; do SPECS+=("$s"); done < <(find docs/v[0-9]* -type f -name '*.md' 2>/dev/null | grep -E '/(pending|active|done)/' || true)
     ;;
   --file|file)
     # Single named spec, both families — the lifecycle engine's spec.gate

package/audits/sql-mod.sh

@@ -46,10 +46,13 @@ added_hit() {
 
 case "$MODE" in
   --staged|staged)
-    mapfile -t FILES < <(git diff --cached --name-only --diff-filter=ACMRT -- '*.zig' || true)
+    # while read, not mapfile — bash-3.2 portability (see scripts/run-playbook-tests.sh).
+    FILES=()
+    while IFS= read -r f; do FILES+=("$f"); done < <(git diff --cached --name-only --diff-filter=ACMRT -- '*.zig' || true)
     STAGED=1 ;;
   --all|all)
-    mapfile -t FILES < <(find src -type f -name '*.zig' 2>/dev/null || true)
+    FILES=()
+    while IFS= read -r f; do FILES+=("$f"); done < <(find src -type f -name '*.zig' 2>/dev/null || true)
     STAGED=0 ;;
   *)
     printf "usage: %s [--staged|--all]\n" "$0" >&2

package/audits/ufs.sh

@@ -116,7 +116,12 @@ if [ "$MODE" = "--staged" ]; then
 else
   scope_files() { git ls-files; }
 fi
-mapfile -t FILES < <(scope_files | while read -r f; do
+# `while read` rather than mapfile: mapfile is bash 4+ and macOS ships 3.2 —
+# the portability rule scripts/run-playbook-tests.sh already records.
+FILES=()
+while IFS= read -r f; do
+  FILES+=("$f")
+done < <(scope_files | while read -r f; do
   is_source "$f" && echo "$f"
 done)
 
@@ -344,9 +349,13 @@ done < <(awk -v re="$NUMERIC_RE" '
 
 # ── 3. cross-runtime-orphan ─────────────────────────────────────────────────
 # Full-tree ERR_* parity. Scoped to the ERR_* prefix because that is the
-# cross-runtime contract surface — server error codes a client consumes. Zig is
-# the source of truth: every client-side ERR_* must have a matching Zig
-# `pub const ERR_*`. Zig-only codes are fine; a server-internal code needs no
+# cross-runtime contract surface — server error codes a client consumes. The
+# daemon is the source of truth. A Rust daemon declares its codes through a
+# registry — `ErrorCode::declare("…")` — and the contract a client holds is
+# that STRING, so parity is checked on the string: every client
+# `export const ERR_X = "…"` must name a code the registry declares. Where no
+# registry exists and Zig does, the Zig `pub const ERR_*` NAMES are the
+# oracle instead. Daemon-only codes are fine; a server-internal code needs no
 # client mirror.
 #
 # Scoped BY RUNTIME, not by one repository's directory names. The previous form
@@ -381,11 +390,29 @@ parity_codes() {
     | grep -oE 'ERR_[A-Z][A-Z0-9_]+' | sort -u || true
 }
 
+# The Rust registry outranks a Zig mirror: a runner that keeps a Zig subset of
+# the daemon's codes for its own use is a client, not the oracle. `record`
+# mutates globals, so the loop runs in this shell over a here-string — never on
+# the right of a pipe, which would run it in a subshell and drop every finding.
+rust_codes=$(git ls-files -z -- '*.rs' 2>/dev/null \
+  | { grep -zvE "$PARITY_EXCLUDE" || true; } \
+  | { xargs -0 grep -hoE 'ErrorCode::declare\("[^"]+"\)' 2>/dev/null || true; } \
+  | { grep -oE '"[^"]+"' || true; } | tr -d '"' | sort -u)
 zig_err=$(parity_codes '^pub const ERR_[A-Z][A-Z0-9_]+[[:space:]]*=' '*.zig')
 client_err=$(parity_codes '^export const ERR_[A-Z][A-Z0-9_]+[[:space:]]*=' '*.js' '*.jsx' '*.ts' '*.tsx')
 
-if [ -z "$zig_err" ]; then
-  ok "audit-ufs: cross-runtime parity skipped — no Zig ERR_* declared, so this repository has no source of truth to compare against"
+if [ -n "$rust_codes" ]; then
+  client_decls=$(git ls-files -z -- '*.js' '*.jsx' '*.ts' '*.tsx' 2>/dev/null \
+    | { grep -zvE "$PARITY_EXCLUDE" || true; } \
+    | { xargs -0 grep -hE '^export const ERR_[A-Z][A-Z0-9_]+[[:space:]]*=[[:space:]]*"[^"]+"' 2>/dev/null || true; })
+  while IFS= read -r line; do
+    [ -n "$line" ] || continue
+    name=$(printf '%s' "$line" | grep -oE 'ERR_[A-Z][A-Z0-9_]+' | head -1)
+    code=$(printf '%s' "$line" | sed -E 's/^[^=]*=[[:space:]]*"([^"]+)".*/\1/')
+    echo "$rust_codes" | grep -qxF -- "$code" || record "cross-runtime-orphan $name ($code) absent-in-daemon"
+  done <<<"$client_decls"
+elif [ -z "$zig_err" ]; then
+  ok "audit-ufs: cross-runtime parity skipped — no Rust registry and no Zig ERR_* declared, so this repository has no source of truth to compare against"
 else
   # Every client-side ERR_* must exist in Zig.
   for c in $client_err; do

package/dispatch/lib.sh

@@ -53,7 +53,10 @@ DISPATCH_RC=0
 # Rule-code gloss map — canonical short expansions (full text in RULES.md legend).
 # Keep in sync with RULES.md; dispatch-coverage.sh fails on a code with no
 # gloss entry. snake-of-record: CODE → "Short Gloss".
-declare -A DISPATCH_GLOSS=(
+# A heredoc of `[CODE]="Gloss"` lines, not declare -A: associative arrays are
+# bash 4+ and macOS ships 3.2. The line shape is load-bearing —
+# evals/dispatch/coverage.sh greps lib.sh for it (checks f and g).
+DISPATCH_GLOSS="$(cat <<'GLOSS'
   [NDC]="No Dead Code"
   [NLR]="No Legacy Retained (touch-it-fix-it)"
   [NLG]="No Legacy compat shims (pre-v2.0.0)"
@@ -83,10 +86,17 @@ declare -A DISPATCH_GLOSS=(
   [ERR-RS]="Rust ERror discipline (one type per crate, Result alias, no stringified cause)"
   [GRP]="GREptile rule audit (diff vs greptile-learnings/RULES.md codes)"
   [LDC]="Legacy-Design Consult (A remove / B patch / C keep)"
-)
+GLOSS
+)"
 
 # Look up a gloss; empty string if the code is unknown (audit will catch it).
-dispatch_gloss() { printf '%s' "${DISPATCH_GLOSS[$1]:-}"; }
+# Pure parameter expansion — no fork per finding. `[` is escaped so the code
+# is matched literally, not as a glob class.
+dispatch_gloss() {
+  local rest; rest="${DISPATCH_GLOSS#*\[$1\]=\"}"
+  [[ "$rest" == "$DISPATCH_GLOSS" ]] && return 0
+  printf '%s' "${rest%%\"*}"
+}
 
 dispatch_init() {
   DISPATCH_LANG="$1"; shift

package/dispatch/write_any.sh

@@ -33,12 +33,12 @@ dispatch_run_helper "LOG"  "logging.sh"      "--staged"
 dispatch_run_helper "MSID" "msid-ui.sh"      "--staged"
 
 # ── delegations (run only in the product repo — need state absent from dotfiles) ──
-# ERR's leaf hard-exits if src/agentsfleetd/errors/error_registry.zig is absent (it
+# ERR's leaf hard-exits if the product repo's error registry is absent (it
 # cross-references emitted codes against the registry), unlike UFS/LOG/MSID which
 # pass gracefully on empty input. So it can't run in dotfiles — delegate it; the
 # product repo's `make harness-verify` runs error-codes.sh against the real
 # registry. The .md keeps [DETERMINISTIC → ERR]: deterministic, just not run here.
-dispatch_delegate "ERR" "make harness-verify (error-codes.sh — needs src/agentsfleetd/errors/error_registry.zig)"
+dispatch_delegate "ERR" "make harness-verify (error-codes.sh — needs the product repo's error registry)"
 
 # ── judgment gates (no script can decide; agent states verdict in chat) ──
 dispatch_judgment "GRP" "per-iteration (diff langs change) + end-of-turn: audit the diff against docs/greptile-learnings/RULES.md — one row per applicable code (UFS/ORP/TST-NAM/PRI/EMS/…); \"it's just a label\" is not an exception"

package/dispatch/write_zig.md

@@ -480,7 +480,7 @@ Rules:
 
 New production Zig modules must not define SQL statement text inline. Put query
 text in a domain-local `sql.zig` and import it from the state/handler/service
-module. This mirrors `src/agentsfleetd/fleet_bundle/sql.zig`: table names and
+module. The shape is a domain-local `sql.zig` beside the module it serves: table names and
 query statements stay grepable in one place, while the public module owns row
 mapping, allocator ownership, and error translation.
 

package/docs/CHANGELOG_VOICE.md

@@ -14,5 +14,5 @@ Editing `~/Projects/docs/changelog.mdx` or any other Mintlify `<Update>` block.
 - **Internal cleanup / refactor entries get the most aggressive trimming.** One lead paragraph + one bullet list. Skip "Test coverage" sections unless the test count is the headline. Indy's exact direction: *"Keep internal code cleanup, refactor to a minimal."*
 - **Never drop load-bearing facts.** Error codes (`UZ-AUTH-003`), endpoint paths + method + body shape + status code, env var names + defaults, schema column / table names, CLI subcommand + flag names, migration steps, money amounts. Tighten prose, not meaning.
 - **Historical entries are archives.** Brevity-pass them; never rewrite the past. A typo correction (e.g. `$0.001` → `$0.01` when it was never true) is allowed and must be called out in the commit message.
-- **Rate constants flow through three pinned files only:** `src/agentsfleetd/state/tenant_billing.zig`, `ui/packages/website/src/lib/rates.ts`, `~/Projects/docs/snippets/rates.mdx`. Bumping a rate requires a paired Pull Request (PR) across the docs repo — there is no automated guard. In `*.mdx`, use `import { STARTER_CREDIT, EVENT_RATE, STAGE_RATE } from "/snippets/rates.mdx"` instead of hand-typing `$5`.
+- **Rate constants flow through three pinned files only:** `rustd/crates/afd_billing/src/nanos.rs`, `ui/packages/website/src/lib/rates.ts`, `~/Projects/docs/snippets/rates.mdx`. Bumping a rate requires a paired Pull Request (PR) across the docs repo — there is no automated guard. In `*.mdx`, use `import { STARTER_CREDIT, EVENT_RATE, STAGE_RATE } from "/snippets/rates.mdx"` instead of hand-typing `$5`.
 - **The Mintlify reference Indy pasted (May 1 / May 8 entries) is canonical voice.** Mirror its rhythm, not its product nouns.

package/docs/EXECUTE_DOC_READS.md

@@ -22,7 +22,7 @@ Every triggered document requires one `📖 DOC READ: <path>` proof-line **per t
 | `*.mdx` | `dispatch/write_mdx.md` — structure, front matter, links, code fences, accessibility, and Mintlify isolation. | <!-- oracle-packs:language.mdx -->
 | Log emit (any language; see LOGGING GATE triggers) | `docs/LOGGING_STANDARD.md` — wire format (logfmt), severity ladder, error-code embedding, scope/event discipline, PII redaction, §10A tightenings. LOGGING GATE per edit. |
 | Lifecycle method in `*.zig` (`init|deinit|close|release|destroy|shutdown|dispose|free`) | `docs/LIFECYCLE_PATTERNS.md` — init/deinit pairing, errdefer placement, allocator ownership, defer/errdefer mutual exclusion, §10A tightenings. LIFECYCLE GATE per edit. |
-| `src/agentsfleetd/http/handlers/**` or `public/openapi/**` | `docs/REST_API_DESIGN_GUIDELINES.md` — Quick Checklist; §1–§5 (URL/method/body/response/error), §6 (OpenAPI), §7 (6-place route registration), §8 (`Hx` handler interface), §10 (pre-PR gates). |
+| `rustd/crates/afd_api*/src/handler/**` or `public/openapi/**` | `docs/REST_API_DESIGN_GUIDELINES.md` — Quick Checklist; §1–§5 (URL/method/body/response/error), §6 (OpenAPI), §7 (6-place route registration), §8 (`Hx` handler interface), §10 (pre-PR gates). |
 | `ui/packages/**/*.{tsx,jsx,css}`, `app/**/*.{tsx,jsx,css}`, `components/**/*.{tsx,jsx,css}`, repo-root `globals.css`, or any file changing visual tokens / motion / typography | `DESIGN.md` (repo root) or `docs/DESIGN_SYSTEM.md` — whichever the repo carries. Design system source of truth: typography stack, color tokens, the single accent and its currency rule, motion signature, spacing/density, component principles, CLI palette mapping. DOC READ proof-line per turn. |
 | `*.tsx` / `*.jsx` under `ui/packages/{app,website}/` | `dispatch/write_ts_adhere_bun.md` (Design Tokens) — token-utility table (text/tracking/leading/max-w/min-w/spacing/motion/radius/color). DESIGN TOKEN GATE fires per edit; audit via project-side `audits/design-tokens.sh`. |
 | Auth-flow | `docs/AUTH.md`. |

package/docs/LOGGING_STANDARD.md

@@ -35,7 +35,7 @@ Documented honestly, not aspirationally. Pre-M62 baseline (the fix-pass converge
 
 - The named module `log` (source: `src/lib/logging/mod.zig`) exposes `scoped(.tag)` returning a logger struct with `.err` / `.warn` / `.info` / `.debug` methods. M62 removed the older free-function helpers (`logErr` / `logErrWithHint` / `logWarnErr`) — there is no compat shim.
 - TypeScript (`cli/src/**`) calls `console.log`/`console.error` directly. No structure. No scope. No severity beyond err vs out.
-- Error-code embedding (`UZ-XXX-NNN`) appears on some `err` lines but not others. The registry (`src/agentsfleetd/errors/error_registry.zig`) is the source of truth, but enforcement is voluntary.
+- Error-code embedding (`UZ-XXX-NNN`) appears on some `err` lines but not others. The registry (`rustd/crates/afd_core/src/error_code.rs`) is the source of truth, but enforcement is voluntary.
 - No collector-friendly format. Logs are a mix of free-form English and ad-hoc `key={value}` fragments.
 
 The proposed standard below is what every new emit must conform to and what the fix-pass converges existing emits toward.
@@ -168,7 +168,7 @@ Log the source (`source=env:OPENAI_API_KEY`), never the value, at every level.
 
 > [DETERMINISTIC → LOG]
 
-Every `err` and `warn` record that maps to a domain error MUST carry `error_code=UZ-XXX-NNN` where `UZ-XXX-NNN` is declared in `src/agentsfleetd/errors/error_registry.zig`.
+Every `err` and `warn` record that maps to a domain error MUST carry `error_code=UZ-XXX-NNN` where `UZ-XXX-NNN` is declared in `rustd/crates/afd_core/src/error_code.rs`.
 
 - **Used-but-undeclared** (`UZ-FAKE-999` appearing in code, no entry in registry): **blocking** in `make lint`.
 - **Declared-but-unreferenced** (registry has `UZ-LEGACY-007`, no code references it): **informational**. Deletion may be deferred to a sweep milestone.