@oneie/claude 0.8.0 → 0.9.0

package/scripts/factory-emit.sh

@@ -0,0 +1,211 @@
+#!/usr/bin/env bash
+# factory-emit.sh — ONE factory stage, onto the run/event stream every viewer reads.
+#
+# manifest: needs-env
+#   Reads GATEWAY_API_KEY through ONE_ENV_FILE (default one.ie/web/.env, plus the
+#   monorepo fallbacks do-signal.sh walks). No credential is exit 3 by name —
+#   never a quiet success, never a skipped stage that reads as a stage that ran.
+#
+# WHY IT EXISTS. .claude/workflows/factory-executor.js writes to the substrate
+# exactly TWICE per job: tasks:claim at Claim and tasks:notes+tasks:status at
+# Close. Ready · Build · Review · Prove emit nothing, so no surface can draw a
+# job DURING. This is the call that closes that gap: one FactoryEventPayload
+# (one.ie/web/src/lib/factory/event.ts) per stage boundary, posted to the
+# factory:event receiver, which maps it onto the same run/event stream RunTrack
+# already reads.
+#
+# USAGE
+#   factory-emit.sh --job <tid> --stage <stage> --status <start|ok|fail>
+#                   [--slug <workspace>] [--model <rung>] [--reason <text>]
+#                   [--detail k=v]... [--env dev] [--dry-run]
+#   factory-emit.sh --self-test        # local red proofs, no network
+#
+#   stage : ready | claim | build | review | prove | close   (FACTORY_SPINE_STEPS)
+#   status: start | ok | fail                                (FactoryStageStatus)
+#
+# EXITS  0 emitted (or --dry-run printed) · 2 bad arguments · 3 no credential
+#        4 the receiver refused — its own words on stderr · 5 jq missing
+#
+# THE REFUSAL IS THE WHOLE POINT — both measured against prod 2026-09-06:
+#   unknown receiver → HTTP 200 {"outcome":"dissolved","reason":"unknown_receiver",...}
+#   forbidden call   → HTTP 200 {"outcome":"result","result":{"ok":false,"error":"forbidden: ..."}}
+# A caller that reads curl's exit code, the HTTP status, or `outcome` alone
+# records a stage that never landed. Success is ONE shape and nothing else:
+#   .outcome == "result"  AND  .result.ok == true
+#
+# ENV  FACTORY_EMIT_URL   default $ONE_API_URL, else https://one.ie
+#      FACTORY_EVENT_RECEIVER   default factory:event
+#      ONE_ENV_FILE / DO_ENV_FILE   the credential file
+#      FACTORY_EMIT_SKIP_FALLBACKS=1  ONE_ENV_FILE is the WHOLE ladder. Without
+#          it the no-credential state is unreachable from inside the monorepo
+#          (the fallbacks resolve to a tree that carries a real .env), so exit 3
+#          could not be driven red. Same reason, same shape, as
+#          DO_SIGNAL_SKIP_FALLBACKS in do-signal.sh.
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ONE_ENV_FILE="${ONE_ENV_FILE:-${DO_ENV_FILE:-one.ie/web/.env}}"
+URL="${FACTORY_EMIT_URL:-${ONE_API_URL:-https://one.ie}}"
+RECEIVER="${FACTORY_EVENT_RECEIVER:-factory:event}"
+TIMEOUT="${FACTORY_EMIT_TIMEOUT:-8}"
+
+die() { printf 'factory-emit: %s\n' "$1" >&2; exit "$2"; }
+
+# ---------------------------------------------------------------------------
+# --self-test — every LOCAL refusal, driven for real. No network, no credential.
+# A stage this script would have posted anyway is the frame nobody meant, so
+# each refusal is asserted by its EXIT CODE, never by its message.
+# ---------------------------------------------------------------------------
+self_test() {
+  local me="${BASH_SOURCE[0]}" fails=0 rc out
+  _case() {  # $1 label, $2 expected rc, rest: argv (run with no credential ladder)
+    local label="$1" want="$2"; shift 2
+    out="$(ONE_ENV_FILE=/dev/null FACTORY_EMIT_SKIP_FALLBACKS=1 bash "$me" "$@" 2>&1)"; rc=$?
+    if [ "$rc" = "$want" ]; then
+      printf '  ok   %-46s exit %s\n' "$label" "$rc"
+    else
+      printf '  FAIL %-46s exit %s, wanted %s\n     %s\n' "$label" "$rc" "$want" "$(printf '%s' "$out" | head -1)" >&2
+      fails=$((fails + 1))
+    fi
+  }
+  printf '== factory-emit --self-test\n'
+  # THE broken shape this test exists for: factoryEventToRunEvent returns null
+  # for a stage outside the six, and a null posted anyway is a lie on the stream.
+  _case 'unknown stage is REFUSED before the wire' 2 --job task:selftest --stage warm --status ok
+  _case 'unknown status is REFUSED'                2 --job task:selftest --stage build --status green
+  _case 'missing --job is REFUSED'                 2 --stage build --status ok
+  _case 'missing --stage is REFUSED'               2 --job task:selftest --status ok
+  _case 'malformed --detail is REFUSED'            2 --job t --stage build --status ok --detail nokv
+  _case 'unknown argument is REFUSED'              2 --job t --stage build --status ok --wat
+  # No credential must be a NAMED exit 3, never a quiet skip that reads as a
+  # stage that ran. Reachable only because SKIP_FALLBACKS exists.
+  _case 'no credential is exit 3, not a quiet pass' 3 --job task:selftest --stage build --status start
+  # --dry-run precedes the credential read, so it stays 0 with no key at all.
+  _case '--dry-run needs no credential'             0 --job task:selftest --stage prove --status ok --dry-run
+
+  # And the dry-run payload must actually carry the three required fields plus
+  # an optional one, or a green emit could be an empty frame.
+  local pl
+  pl="$(ONE_ENV_FILE=/dev/null FACTORY_EMIT_SKIP_FALLBACKS=1 bash "$me" \
+        --job task:selftest --stage review --status fail --slug one --model opus \
+        --reason 'refuted' --detail lens=urls --dry-run 2>/dev/null)"
+  if printf '%s' "$pl" | jq -e '.data.job == "task:selftest" and .data.stage == "review"
+        and .data.status == "fail" and .data.slug == "one" and .data.model == "opus"
+        and .data.reason == "refuted" and .data.detail.lens == "urls"' >/dev/null 2>&1; then
+    printf '  ok   %-46s\n' 'dry-run payload carries every named field'
+  else
+    printf '  FAIL %-46s\n     %s\n' 'dry-run payload is incomplete' "$pl" >&2
+    fails=$((fails + 1))
+  fi
+
+  # The optional fields must be ABSENT rather than empty strings — zod strips
+  # undeclared keys silently, and an empty `slug` is not the same as no slug.
+  pl="$(ONE_ENV_FILE=/dev/null FACTORY_EMIT_SKIP_FALLBACKS=1 bash "$me" \
+        --job t --stage ready --status start --dry-run 2>/dev/null)"
+  if printf '%s' "$pl" | jq -e '(.data | has("slug") | not) and (.data | has("detail") | not)' >/dev/null 2>&1; then
+    printf '  ok   %-46s\n' 'unset optional fields are absent, not empty'
+  else
+    printf '  FAIL %-46s\n     %s\n' 'unset optional fields leaked into the payload' "$pl" >&2
+    fails=$((fails + 1))
+  fi
+
+  if [ "$fails" -eq 0 ]; then
+    printf 'factory-emit --self-test: PASS (10 checks)\n'; return 0
+  fi
+  printf 'factory-emit --self-test: RED — %s check(s) failed\n' "$fails" >&2; return 1
+}
+
+JOB=""; STAGE=""; STATUS=""; SLUG=""; MODEL=""; REASON=""; ENVW=""; DETAILS=""; DRY=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --job)     JOB="${2:-}";    shift 2 ;;
+    --stage)   STAGE="${2:-}";  shift 2 ;;
+    --status)  STATUS="${2:-}"; shift 2 ;;
+    --slug)    SLUG="${2:-}";   shift 2 ;;
+    --model)   MODEL="${2:-}";  shift 2 ;;
+    --reason)  REASON="${2:-}"; shift 2 ;;
+    --env)     ENVW="${2:-}";   shift 2 ;;
+    --detail)  DETAILS="${DETAILS}${DETAILS:+$'\n'}${2:-}"; shift 2 ;;
+    --dry-run) DRY=1; shift ;;
+    --self-test) command -v jq >/dev/null 2>&1 || die "jq not found" 5; self_test; exit $? ;;
+    -h|--help) sed -n '2,42p' "${BASH_SOURCE[0]}"; exit 0 ;;
+    *) die "unknown argument: $1" 2 ;;
+  esac
+done
+
+command -v jq >/dev/null 2>&1 || die "jq not found — this script builds and reads JSON with it, and a hand-rolled parser is how a refusal becomes a pass" 5
+[ -n "$JOB" ] || die "--job <tid> is required — it is the run key (factory:<tid>, event.ts factoryRunKey)" 2
+case "$STAGE" in
+  ready|claim|build|review|prove|close) ;;
+  *) die "--stage must be one of ready claim build review prove close (got '$STAGE') — factoryEventToRunEvent returns NULL for anything else, and a null that is posted anyway is a frame nobody meant" 2 ;;
+esac
+case "$STATUS" in
+  start|ok|fail) ;;
+  *) die "--status must be start|ok|fail (got '$STATUS')" 2 ;;
+esac
+
+detail_json='{}'
+if [ -n "$DETAILS" ]; then
+  while IFS= read -r kv; do
+    [ -n "$kv" ] || continue
+    case "$kv" in *=*) ;; *) die "--detail wants k=v, got: $kv" 2 ;; esac
+    detail_json="$(jq -n --argjson d "$detail_json" --arg k "${kv%%=*}" --arg v "${kv#*=}" '$d + {($k): $v}')" \
+      || die "could not build --detail object" 2
+  done <<EOF
+$DETAILS
+EOF
+fi
+
+payload="$(jq -n \
+  --arg job "$JOB" --arg stage "$STAGE" --arg status "$STATUS" \
+  --arg slug "$SLUG" --arg model "$MODEL" --arg reason "$REASON" --arg env "$ENVW" \
+  --argjson detail "$detail_json" '
+  {data: ({job: $job, stage: $stage, status: $status}
+    + (if $slug   != "" then {slug:   $slug}   else {} end)
+    + (if $model  != "" then {model:  $model}  else {} end)
+    + (if $reason != "" then {reason: $reason} else {} end)
+    + (if $env    != "" then {env:    $env}    else {} end)
+    + (if ($detail | length) > 0 then {detail: $detail} else {} end))}')" \
+  || die "could not build the payload" 2
+
+if [ "$DRY" = 1 ]; then printf '%s\n' "$payload"; exit 0; fi
+
+# The key never reaches argv (ps) and never reaches stdout. --config, chmod 600,
+# removed on every path. Same shape as do-signal.sh.
+_gateway_key() {
+  local f v
+  for f in "$ONE_ENV_FILE" "$ROOT/one.ie/web/.env" "$ROOT/one.ie/web/.dev.vars" "$ROOT/.env"; do
+    [ -f "$f" ] || continue
+    if [ "${FACTORY_EMIT_SKIP_FALLBACKS:-0}" = "1" ] && [ "$f" != "$ONE_ENV_FILE" ]; then continue; fi
+    v="$(grep -E '^GATEWAY_API_KEY=' "$f" 2>/dev/null | head -1 | sed 's/^[^=]*=//;s/^"//;s/"$//')"
+    [ -n "$v" ] && { printf '%s' "$v"; return 0; }
+  done
+  printf ''
+}
+
+KEYVAL="$(_gateway_key)"
+[ -n "$KEYVAL" ] || die "no GATEWAY_API_KEY in $ONE_ENV_FILE (or the monorepo fallbacks) — an unauthenticated emit is refused at the door and would look exactly like a stage that never happened" 3
+
+cfg="$(mktemp)"; chmod 600 "$cfg"
+trap 'rm -f "$cfg"' EXIT INT TERM
+printf 'header = "Authorization: Bearer %s"\n' "$KEYVAL" > "$cfg"
+
+resp="$(curl -sS -X POST "$URL/api/ask/$RECEIVER" \
+  -H 'content-type: application/json' --config "$cfg" \
+  --max-time "$TIMEOUT" -d "$payload" -w $'\n%{http_code}' 2>&1)"; rc=$?
+rm -f "$cfg"; trap - EXIT INT TERM
+
+code="$(printf '%s' "$resp" | tail -1)"
+body="$(printf '%s' "$resp" | sed '$d')"
+ok="$(printf '%s' "$body" | jq -r 'if (.outcome == "result" and (.result.ok == true)) then "yes" else "no" end' 2>/dev/null)"
+
+if [ "$rc" -ne 0 ] || [ "$ok" != "yes" ]; then
+  why="$(printf '%s' "$body" | jq -r '.reason // .result.error // .error // .hint // empty' 2>/dev/null)"
+  [ -n "$why" ] || why="curl rc=$rc http=${code:-none} body=$(printf '%s' "$body" | head -c 200)"
+  printf 'factory-emit: RED job=%s stage=%s status=%s http=%s — %s\n' \
+    "$JOB" "$STAGE" "$STATUS" "${code:-none}" "$why" >&2
+  exit 4
+fi
+
+printf 'factory-emit: ok job=%s stage=%s status=%s receiver=%s\n' "$JOB" "$STAGE" "$STATUS" "$RECEIVER"
+exit 0

package/scripts/factory-executor-check.mjs

@@ -0,0 +1,353 @@
+#!/usr/bin/env node
+// classification: portable
+// Red proof for factory-executor.js — the trace, the slug and the close.
+//
+// WHY THIS IS DIFFERENT FROM factory-review-check.mjs: that checker defines OLD
+// and NEW as two inline string copies and never opens the executor, so it stays
+// green whether or not the file is fixed. It proves a shape. THIS one READS THE
+// FILE for every assertion, and lifts the two behavioural tables (slugFor, the
+// close status re-parse) OUT of the source with new Function so they cannot
+// drift from what ships. Revert any one of the three fixes and this goes red.
+//
+// Usage:  node .claude/scripts/factory-executor-check.mjs [path]
+// Exit 0 = all green. Exit 1 = at least one assertion failed.
+
+import { readFileSync } from 'node:fs'
+
+const F = process.argv[2] || '.claude/workflows/factory-executor.js'
+const src = readFileSync(F, 'utf8')
+
+const fails = []
+function check(name, pass, detail) {
+  if (!pass) fails.push(name)
+  console.log(`  ${pass ? ' ok ' : 'RED '}  ${name}${detail ? `  — ${detail}` : ''}`)
+}
+
+// Lift a `const <name> = ...` block out of the source by balanced braces, so the
+// behavioural tables below exercise THE FILE and not a copy of it.
+function lift(startPat) {
+  const i = src.search(startPat)
+  if (i < 0) return null
+  const open = src.indexOf('{', i)
+  if (open < 0) return null
+  let depth = 0
+  for (let j = open; j < src.length; j++) {
+    if (src[j] === '{') depth++
+    else if (src[j] === '}') { depth--; if (depth === 0) return src.slice(i, j + 1) }
+  }
+  return null
+}
+
+console.log(`factory-executor-check: ${F}\n`)
+
+// ── 1. THE TRACE — the emit is issued at both boundaries of all six stages ──
+//
+// ON THE NUMBER: the brief asked for "12 factory-emit.sh occurrences". That is
+// the plan's RUNTIME boundary count per job (6 stages × start/end, minus Ready's
+// start, minus Prove's when the review refutes, plus the repair's build+review
+// pair) mis-stated as a static grep. Statically there is exactly ONE
+// `factory-emit.sh` literal — inside the emitStage helper — and N emitStage CALL
+// SITES. Inlining the curl twelve times to satisfy a grep would reintroduce the
+// very divergence the slugFor fix removes: one command, many renderings. So the
+// count is reported, and COVERAGE is what is asserted.
+console.log('1. the trace — stage emit coverage')
+
+const EMIT_CALL = /emitStage\(\s*[^,]+,\s*'(\w+)'\s*,\s*([\s\S]*?),\s*\{/g
+
+// COVERAGE IS PER CODE PATH, NOT PER STAGE NAME. A union over the stage name
+// scores `build` as covered when the MAIN path has lost its fail emit but the
+// REPAIR path still carries one — absent evidence defaulting to benign, in the
+// checker written to stop that. So each emitting path gets its own lane, keyed
+// off the options object: `repair:` (the repair build), `pass: N` (review pass 1
+// vs 2), else `main`. Every lane must carry both boundaries.
+function optionsAfter(idx) {
+  let depth = 0
+  for (let j = idx; j < src.length; j++) {
+    if (src[j] === '{') depth++
+    else if (src[j] === '}') { depth--; if (depth === 0) return src.slice(idx, j + 1) }
+  }
+  return ''
+}
+const lanes = new Map()
+let m
+while ((m = EMIT_CALL.exec(src))) {
+  const [, stage, statusExpr] = m
+  const opts = optionsAfter(src.lastIndexOf('{', EMIT_CALL.lastIndex))
+  const lane = /\brepair:/.test(opts) ? 'repair' : (opts.match(/\bpass:\s*(\d+)/) || [, null])[1] ? `pass${opts.match(/\bpass:\s*(\d+)/)[1]}` : 'main'
+  const key = `${stage}:${lane}`
+  if (!lanes.has(key)) lanes.set(key, new Set())
+  for (const st of (statusExpr.match(/'(start|ok|fail)'/g) || []).map((q) => q.slice(1, -1))) lanes.get(key).add(st)
+}
+
+// FAIL CLOSED on a partial parse. If the regex misses a call, coverage would be
+// computed from a subset and a missing boundary could read as present-elsewhere.
+const rawCalls = (src.match(/emitStage\(/g) || []).length - 1 // minus the definition
+const parsedCalls = (src.match(EMIT_CALL) || []).length
+check(
+  'every emitStage call site was parsed (a partial parse cannot score coverage)',
+  rawCalls > 0 && parsedCalls === rawCalls,
+  `${parsedCalls} parsed of ${rawCalls} call site(s)`,
+)
+
+// The invariant is one EXECUTED rendering, not one mention: the name also
+// appears in a comment, a schema description and the operator hint in EMITS
+// DARK. What must never be duplicated is the line that BUILDS AND RUNS the
+// command — two of those is the slugFor disease with a different subject.
+const runSites = (src.match(/factory-emit\.sh \$\{parts\.join/g) || []).length
+check('exactly one EXECUTED factory-emit.sh rendering — one command, one builder', runSites === 1,
+  `${runSites} executed of ${(src.match(/factory-emit\.sh/g) || []).length} total mention(s) (the rest are comments, a schema description and the DARK hint)`)
+
+// Every lane the pipeline actually has. Named explicitly so a lane that
+// DISAPPEARS is red too — a missing key cannot be scored by iterating what is
+// present.
+const REQUIRED_LANES = [
+  ['claim:main', 'the claim'],
+  ['build:main', 'the first build'],
+  ['build:repair', 'the repair build'],
+  ['review:pass1', 'review pass 1'],
+  ['review:pass2', 'review pass 2 (after the repair)'],
+  ['prove:main', 'the walk'],
+  ['close:main', 'the close'],
+]
+for (const [key, what] of REQUIRED_LANES) {
+  const s = lanes.get(key)
+  check(`${key}: start + ok + fail  (${what})`, !!s && s.has('start') && s.has('ok') && s.has('fail'), s ? `[${[...s].sort().join(' ')}]` : 'LANE ABSENT')
+}
+// Ready is the deliberate asymmetry: the read happens BEFORE any tid is known,
+// so a per-job `start` would be invented rather than observed.
+const ready = lanes.get('ready:main') || new Set()
+check('ready: ok, and NO start (a start before any tid is known is invented, not observed)', ready.has('ok') && !ready.has('start'), `[${[...ready].sort().join(' ')}]`)
+
+// A stage that did not run must be ABSENT — there is no `skip` in the vocabulary.
+const refutedBranch = lift(/if \(review\.refuted\) \{/)
+check('the refuted-review branch emits NO prove frame (absent, never "skipped")', refutedBranch !== null && !refutedBranch.includes('emitStage'))
+
+check('EMITS DARK is keyed on attempts, not only on failures', /emitStats\.pushed === 0/.test(src) && /EMITS DARK/.test(src),
+  'zero pushed and zero failed must not read as a clean turn')
+
+// ── 2. THE CLOSE — status is a copy out of a script line, never a belief ────
+console.log('\n2. the close — status is read back, not asserted')
+
+const closeSchema = lift(/const CLOSE_SCHEMA = /)
+check('CLOSE_SCHEMA exists', closeSchema !== null)
+check("CLOSE_SCHEMA requires 'checkLine'", !!closeSchema && /required:\s*\[[^\]]*'checkLine'[^\]]*\]/.test(closeSchema))
+check('CLOSE_SCHEMA still requires tagged + status (no field lost)',
+  !!closeSchema && /'tagged'/.test(closeSchema) && /'status'/.test(closeSchema))
+check('closePrompt tells the agent to run factory-close-check.sh', /factory-close-check\.sh/.test(src))
+
+// A stage agent that THROWS propagates out of the stage; the item is then dropped
+// by `out.filter(Boolean)` and lands in NEITHER results NOR skipped — a job that
+// built, reviewed and walked disappears from the turn's own summary. Both agents
+// that can throw after work has been done must be caught.
+check('the Close agent is .catch()-guarded (a thrown Close must not vanish the job)',
+  /schema: CLOSE_SCHEMA \}\)\s*\n\s*\.catch\(\(\) => null\)/.test(src))
+check('the repair agent is .catch()-guarded (a thrown repair must not leave the row picked with no close)',
+  /repairPrompt\(t, b, r1\.findings\)[\s\S]{0,220}?\.catch\(\(\) => null\)/.test(src))
+
+// Lift the executor's OWN four-line derivation and drive it. The first factory
+// run is the fixture: task:01a07591e5c350a306c93933 is still `picked` while the
+// Close agent returned {"status":"done"}.
+const deriveSrc = src.match(/ +const line = c &&[\s\S]*?const status = [^\n]*\n/)
+check('the status derivation is present in the file and liftable', deriveSrc !== null)
+if (deriveSrc) {
+  const NEW = new Function('c', `${deriveSrc[0]}\nreturn status`)
+  const OLD = (c) => (c && c.status) || 'unknown' // the pre-fix line
+  const cases = [
+    ['THE BUG: agent said done, board said picked', { status: 'done', checkLine: 'CLOSE tid=task:01a07591e5c350a306c93933 lane=none verdict=red status=picked' }, 'unverified'],
+    ['an honest close: both say done', { status: 'done', checkLine: 'CLOSE tid=x lane=fast verdict=ok status=done' }, 'done'],
+    ['the script failed, no CLOSE line', { status: 'unverified', checkLine: 'factory-close-check.sh: row not found' }, 'unverified'],
+    ['checkLine absent entirely', { status: 'done' }, 'unverified'],
+    ['the close agent was lost', null, 'unverified'],
+  ]
+  let oldFails = 0, newFails = 0
+  for (const [name, input, want] of cases) {
+    const o = OLD(input), n = NEW(input)
+    if (o !== want) oldFails++
+    if (n !== want) newFails++
+    console.log(`         ${name.padEnd(46)} want=${String(want).padEnd(11)} OLD=${String(o).padEnd(11)} NEW=${n}${n === want ? '' : '   <-- NEW WRONG'}`)
+  }
+  check('the pre-fix line fails the cases this fix exists for', oldFails > 0, `OLD: ${oldFails} failure(s) — must be > 0 or the proof is worthless`)
+  check("the file's own derivation passes every case", newFails === 0, `NEW: ${newFails} failure(s)`)
+}
+
+// ── 3. THE SLUG — one function, zero re-derivations ────────────────────────
+console.log('\n3. the slug — one function, no second sanitiser')
+
+check('exactly one slugFor definition', (src.match(/const slugFor\s*=/g) || []).length === 1)
+// NOTE THE SCOPING: `${t.tid}` legitimately appears in labels, receiver payloads
+// and prompt prose. What must be zero is the RENDERED SLUG — the git/branch/
+// worktree/receipt-path shape the first run's builder had to hand-patch.
+const rawSlugSites = (src.match(/task-\$\{t\.tid\}/g) || []).length
+check('zero raw `task-${t.tid}` renderings in the git/branch/worktree lines', rawSlugSites === 0, `${rawSlugSites} found (was 8 across 6 lines)`)
+check('the prompts render the slug through slugFor', (src.match(/\$\{slugFor\(t\.tid\)\}/g) || []).length >= 8)
+
+const slugSrc = lift(/const slugFor = /)
+check('slugFor is liftable from the file', slugSrc !== null)
+if (slugSrc) {
+  const slugFor = new Function(`${slugSrc}\nreturn slugFor`)()
+  const cases = [
+    // The directory the first run ACTUALLY built in.
+    ['task:01a07591e5c350a306c93933', 'task-01a07591e5c350a306c93933', 'the first run’s own tid'],
+    ['01a07591e5c350a306c93933', 'task-01a07591e5c350a306c93933', 'a bare id gets the prefix once'],
+    ['task/abc', 'task-abc', 'a slash separator'],
+    ['task:a b:c', 'task-a-b-c', 'spaces and colons collapse'],
+  ]
+  let bad = 0
+  for (const [tid, want, why] of cases) {
+    const got = slugFor(tid)
+    if (got !== want) bad++
+    console.log(`         slugFor(${JSON.stringify(tid).padEnd(30)}) = ${String(got).padEnd(30)} want ${want}${got === want ? '' : '   <-- WRONG'}   (${why})`)
+  }
+  check('slugFor maps every case to the directory the walk will be told to check', bad === 0)
+  // Empty is a stop, not a default: `task-` shared by N jobs is one worktree,
+  // one branch and one receipt for all of them, silently.
+  let threw = false
+  try { slugFor(':::') } catch { threw = true }
+  check('a tid with no slug-safe characters THROWS (it must not collapse to `task-`)', threw)
+}
+
+// ── 4. THE ARITHMETIC — one site, and this workstream did not move it ──────
+// The hoist is the point: pass 1 and pass 2 must not be able to disagree.
+console.log('\n4. the review jury — one arithmetic site, so two passes cannot drift')
+const arith = src.match(/const refuted = votes[^\n]*/g) || []
+check('exactly one vote-arithmetic site', arith.length === 1, arith.length === 1 ? arith[0].trim() : `${arith.length} sites`)
+
+// ── 5. THE CLOSE STATUS TABLE — the board status the close ASKED FOR ───────
+// `closeOk = w.verdict === 'ok' && status !== 'unverified'` accepted ANY board
+// status the read-back reported honestly. The shape that got through: a NON-UI
+// task, verdict ok, `tasks:status` refused, factory-close-check.sh prints
+// `status=picked`, the agent copies `picked`, both words agree → closeOk true →
+// close emits `ok` → event.ts writes **workflow:done** on a row the board reads
+// `picked`. The expected status is a function of (verdict, t.ui) and is known at
+// the call site, so this drives THE FILE's own derivation against that table.
+console.log('\n5. the close — expected status is derived from (verdict, ui), and tagged:false is not a close')
+
+// Lifted through `const closeOk`, and it returns ONLY closeOk on purpose: a body
+// that returns {status, expectedStatus, tagged} would THROW on the pre-fix file
+// (`expectedStatus is not defined`) and the RED rows would arrive as a crash
+// instead of as a wrong answer. A crash is not a red proof; a wrong answer is.
+const closeSrc = src.match(/ +const line = c &&[\s\S]*?\n +const closeOk = [^\n]*\n/)
+check('the closeOk derivation is liftable from the file (a lift miss must be RED, never skipped)', closeSrc !== null)
+if (closeSrc) {
+  const NEW = new Function('c', 'w', 't', `${closeSrc[0]}\nreturn closeOk`)
+  // The pre-fix line, verbatim from a60084d09.
+  const OLD = (c, w) => {
+    const line = c && typeof c.checkLine === 'string' ? c.checkLine : ''
+    const m = /\bstatus=([a-z]+)\b/.exec(line)
+    const claimed = (c && typeof c.status === 'string' && c.status) || ''
+    const status = m && m[1] === claimed ? m[1] : 'unverified'
+    return w.verdict === 'ok' && status !== 'unverified'
+  }
+  const cl = (st) => ({ status: st, checkLine: `CLOSE tid=x lane=fast verdict=ok status=${st}`, tagged: true })
+  const cases = [
+    // THE FINDING, as reported: non-UI, walk ok, board still picked.
+    ['non-UI ok, board says picked — tasks:status was refused', cl('picked'), { verdict: 'ok' }, { ui: false }, false],
+    // A UI task is SUPPOSED to stay picked: a person has not looked yet.
+    ['UI ok, board says picked — that is the asked-for status', cl('picked'), { verdict: 'ok' }, { ui: true }, true],
+    // tagged:false is tasks:notes refusing — the row carries no lane/verdict.
+    ['non-UI ok, board says done, but tagged:false', { status: 'done', checkLine: 'CLOSE tid=x lane=fast verdict=ok status=done', tagged: false }, { verdict: 'ok' }, { ui: false }, false],
+    // The honest close, which must stay green or the fix has broken the loop.
+    ['non-UI ok, board says done, tagged true', cl('done'), { verdict: 'ok' }, { ui: false }, true],
+    // A UI task must never be counted closed on `done`: nobody looked.
+    ['UI ok, board says done — nobody looked, so that is wrong too', cl('done'), { verdict: 'ok' }, { ui: true }, false],
+    // A red verdict closes `fail` whatever the row says (event.ts: a close ok is
+    // workflow:done, so a red that emits ok makes the trace contradict the board).
+    ['red verdict, board says picked', cl('picked'), { verdict: 'red' }, { ui: false }, false],
+    // `tagged` unsaid is not `tagged:false` — it must not read as a refusal.
+    ['non-UI ok, done, tagged unsaid (agent omitted it)', { status: 'done', checkLine: 'CLOSE tid=x lane=fast verdict=ok status=done' }, { verdict: 'ok' }, { ui: false }, true],
+    // The original divergence fixture: the words disagree → status unverified.
+    ['agent said done, board said picked', { status: 'done', checkLine: 'CLOSE tid=task:01a07591e5c350a306c93933 lane=none verdict=red status=picked', tagged: true }, { verdict: 'ok' }, { ui: false }, false],
+    // A lost Close agent: no line, nothing known.
+    ['the close agent was lost', null, { verdict: 'ok' }, { ui: false }, false],
+  ]
+  let oldFails = 0, newFails = 0
+  for (const [name, c, w, t, want] of cases) {
+    let o, n
+    try { o = OLD(c, w) } catch (e) { o = `threw:${e.message}` }
+    try { n = NEW(c, w, t) } catch (e) { n = `threw:${e.message}` }
+    if (o !== want) oldFails++
+    if (n !== want) newFails++
+    console.log(`         ${name.padEnd(58)} want=${String(want).padEnd(6)} OLD=${String(o).padEnd(6)} NEW=${n}${n === want ? '' : '   <-- NEW WRONG'}`)
+  }
+  check('the pre-fix closeOk line fails the rows this fix exists for', oldFails > 0,
+    `OLD: ${oldFails} failure(s) — must be > 0 or the proof is worthless`)
+  check("the file's own closeOk derivation passes every row", newFails === 0, `NEW: ${newFails} failure(s)`)
+}
+
+// The reason line has to NAME the two words, or a `fail` frame is unactionable.
+check('the close fail reason names expected vs actual board status',
+  /expected \$\{expectedStatus\}/.test(src), 'the frame must say which status it wanted')
+check('status, expectedStatus, tagged and closeOk are carried into the result',
+  /status, expectedStatus, tagged, closeOk, checkLine: line,/.test(src))
+check('the turn line counts closeOk, not the walk verdict',
+  /const ok = results\.filter\(\(r\) => r\.closeOk\)\.length/.test(src),
+  'a green walk whose close was refused is not an ok job')
+check('a walked-ok-but-unclosed job is counted, not lost between ok and red',
+  /const held = results\.filter\(\(r\) => r\.verdict === 'ok' && !r\.closeOk\)\.length/.test(src))
+
+// ── 6. THE LOST JURY — zero survivors is not a green review step ───────────
+// `runReview` does `.filter(Boolean)`, so a lens that throws leaves lenses:0 —
+// and the vote line computes `0 * 2 > Math.max(1, 0)` = false, i.e. NOT refuted
+// (measured; a repair-pass finding asserted the opposite). The review emit then
+// recorded `step:done` with reason undefined and detail {lenses:0, attempted:1}.
+// Fixed at the emit, both passes, without touching the arithmetic (§4).
+console.log('\n6. the review emit — a jury with zero survivors emits fail, both passes')
+
+const lostSites = src.match(/'review',\s*r(\d)\.refuted \|\| r\1\.lenses === 0 \? 'fail' : 'ok'/g) || []
+check('both review emit sites fail closed on lenses === 0', lostSites.length === 2,
+  `${lostSites.length} of 2 site(s) — pass 1 and pass 2 must not disagree about what a lost jury is`)
+const lostReasons = src.match(/no lens survived \(\$\{r\d\.attempted\} attempted\)/g) || []
+check("the reason names the lost jury — 'no lens survived (N attempted)'", lostReasons.length === 2,
+  `${lostReasons.length} of 2 reason(s)`)
+// The arithmetic itself FAILS CLOSED: zero survivors ⇒ refuted, `>=` on the tie.
+// The previous version of this check asserted the line was UNTOUCHED — a scope
+// guard that kept `0*2 > 1` fail-open through two merges on 2026-09-06. The
+// behavioural proof lives in factory-review-check.mjs, which lifts this line
+// out of the file; here we only assert the fail-open shape is gone.
+const arith2 = src.match(/const refuted = votes[^\n]*/g) || []
+check('the vote arithmetic fails closed (zero survivors ⇒ refuted; no Math.max(1, …) fail-open shape)',
+  arith2.length === 1 && /votes\.length === 0 \? true/.test(arith2[0]) && !/Math\.max\(1, votes\.length\)/.test(arith2[0]),
+  arith2[0] || 'no `const refuted = votes…` line found')
+
+// ── 7. THE EMIT CONTRACT — factory-emit.sh takes --detail k=v, not JSON ────
+// Measured 2026-09-06 against the merged script: `--detail '{"slug":"x"}'` dies
+// `--detail wants k=v` at EXIT 2, because its parser is
+// `case "$kv" in *=*)` and a JSON blob carries no `=`. Every emit with a detail
+// object — Build, Review, Prove, Close — wrote NO frame and was counted as a
+// receiver rejection. A newline inside a value splits the script's own
+// newline-joined heredoc and kills the whole emit the same way.
+console.log('\n7. the emit contract — read off .claude/scripts/factory-emit.sh')
+
+check('no JSON blob is passed to --detail (the script refuses it, exit 2)',
+  !/--detail \$\{shq\(JSON\.stringify/.test(src))
+check('--detail is rendered as repeated k=v pairs', /--detail \$\{shq\(`\$\{k\}=\$\{val\}`\)\}/.test(src))
+check('detail values are whitespace-collapsed (a newline splits the script\'s heredoc and kills the emit)',
+  src.includes("String(v).replace(/\\s+/g, ' ').trim()"))
+check('an empty detail value is dropped, not posted as `k=`', /if \(!val\) continue/.test(src))
+check('a detail key that would mis-split is dropped BY NAME, not silently',
+  /dropped detail key/.test(src))
+check('the header comment states the real flag set, not `--detail <json>`',
+  /\[--detail k=v\]\.\.\./.test(src) && !/\[--detail <json>\]/.test(src))
+check('EMIT_SCHEMA names factory-emit.sh\'s own exit codes', /0 emitted · 2 bad arguments · 3 no credential · 4 the receiver refused/.test(src))
+
+// ── 8. READY — one frame per turn, and the slug guard runs first ───────────
+// The emits were pushed one per row, before round 1 and before the slugFor
+// guard: `agent()` is eager and these sit outside `parallel`, so a full page
+// (200 rows) spawned 200 haiku agents ahead of the barrier that prices memory —
+// and a turn about to throw on a malformed tid had already written N `ready ok`
+// frames for jobs that never started.
+console.log('\n8. ready — one frame per turn, after the slug guard')
+
+const readyCalls = src.match(/emitStage\([^\n]*'ready'[^\n]*/g) || []
+check('exactly one ready emit site', readyCalls.length === 1, `${readyCalls.length} site(s)`)
+check('the ready emit is NOT inside a per-row loop', readyCalls.length === 1 && !/^for \(/.test(readyCalls[0].trim()),
+  readyCalls.length === 1 ? readyCalls[0].trim().slice(0, 80) : 'unparsed')
+check('the ready frame carries the row count', readyCalls.length === 1 && /count: tasks\.length/.test(readyCalls[0]))
+const guardIdx = src.indexOf('for (const t of tasks) slugFor(t.tid)')
+const readyIdx = readyCalls.length === 1 ? src.indexOf(readyCalls[0]) : -1
+check('the slugFor guard runs BEFORE the ready emit (a turn that throws must not have emitted first)',
+  guardIdx > 0 && readyIdx > guardIdx, `guard@${guardIdx} ready@${readyIdx}`)
+
+console.log(`\nfactory-executor-check: ${fails.length ? `${fails.length} RED` : 'all green'}`)
+if (fails.length) for (const f of fails) console.log(`  RED  ${f}`)
+process.exit(fails.length ? 1 : 0)