@techierathore/techieflow 1.0.2 → 1.0.3

package/.tfcore/utils/tf-doc-check.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# tf-doc-check.sh — check TechieFlow human documents against their template schemas.
+#
+#   bash .tfcore/utils/tf-doc-check.sh docs/MyApp-BRD.md [more.md ...]
+#   bash .tfcore/utils/tf-doc-check.sh --app MyApp            # every document of the app + PROJECT-STATUS.md
+#   bash .tfcore/utils/tf-doc-check.sh --app MyApp --warn     # report mode: findings as WARN, exit 0
+#   bash .tfcore/utils/tf-doc-check.sh --size Medium docs/MyApp-BRD.md
+#
+# Each template under .tfcore/templates/v4custom/ opens with a `<!-- tf-schema -->`
+# block (required sections in order, budgets per size, row rules). This script
+# prints one line per problem — FAIL blocks the phase, WARN does not — and exits
+# 0 when nothing FAILs, 1 when something does, 2 when it could not run.
+#
+# Run by the status gate (_status-update-gate.md) on every human document a
+# command wrote, before the HTML render. Readable version of the rules:
+# docs/TechieFlow-Document-Schemas.md.
+#
+# Thin wrapper over tf-doc-check.py, matching the tf-render-html.sh idiom.
+# Python 3 standard library only.
+set -uo pipefail
+
+SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+if ! command -v python3 >/dev/null 2>&1; then
+  echo "tf-doc-check: python3 is required (standard library only)." >&2
+  exit 2
+fi
+
+exec python3 "$SELF_DIR/tf-doc-check.py" "$@"

package/.tfcore/utils/tf-emit.sh

@@ -19,6 +19,8 @@
 #   tf-emit.sh --amend MISS-App-20260828-01 why_missed missing-checklist-item
 #                                               # fills a field that is still null on a miss already on
 #                                               # the stream (SCHEMA.md §5.5.7). Never overwrites.
+#   tf-emit.sh --origin-of REQ-UI-014           # prints "<started> <cmd> <agent>" of the last build or fix
+#                                               # run that touched the row, nothing when there is none
 #   tf-emit.sh --where                          # prints the resolved docs/metrics dir
 #
 # STREAMS: runs | gates | sessions | commits | misses   (anything else is dropped)
@@ -131,6 +133,39 @@ PY
   exit 0
 fi
 
+# --- read helper: which run caused a row's defect ------------------------
+# Prints "<started> <cmd> <agent>" for the most recent non-backfilled build-phase
+# or fix-issues run whose reqs_touched holds the REQ, nothing when there is none
+# (the caller then leaves origin_run_id out and the record is marked inferred).
+# Used by tf-log-miss.sh and tf-triage.sh (Sitting 4c, 2026-09-06).
+if [[ "$1" == "--origin-of" ]]; then
+  REQ="$2"
+  [[ -n "$REQ" ]] || exit 0
+  python3 - "$MET_DIR/runs.jsonl" "$REQ" 2>"$TF_ERR" <<'PY2' || true
+import json, sys
+path, req = sys.argv[1], sys.argv[2].upper()
+best = None
+try:
+    with open(path, "r", encoding="utf-8") as fh:
+        for line in fh:
+            try:
+                r = json.loads(line)
+            except Exception:
+                continue
+            if r.get("kind") != "run" or r.get("backfilled") or r.get("cmd") not in ("build-phase", "fix-issues"):
+                continue
+            if req in [str(x).upper() for x in (r.get("reqs_touched") or [])]:
+                if best is None or r.get("started", "") >= best.get("started", ""):
+                    best = r
+except FileNotFoundError:
+    pass
+if best:
+    subs = best.get("subagents") or []
+    print(best.get("started", ""), best.get("cmd"), subs[0] if subs else "flow-master")
+PY2
+  exit 0
+fi
+
 # --- read helper: next RUN attempt number for a cmd + REQ set ------------
 # run attempt = 1 + count of prior NON-BACKFILLED `run` records with the same
 # cmd whose reqs_touched intersects the given REQ IDs. Same counting rule that
@@ -170,9 +205,10 @@ fi
 # `miss-fix`, and a collision would silently merge two defects into one lifecycle.
 if [[ "$1" == "--next-miss-id" ]]; then
   python3 - "$MET_DIR/misses.jsonl" "$ROOT" 2>"$TF_ERR" <<'PY' || true
-import datetime, glob, json, os, sys
+import datetime, glob, json, os, re, sys
 path, root = sys.argv[1], sys.argv[2]
-hits = glob.glob(os.path.join(root, "docs", "*-Checklist.md"))
+hits = [h for h in glob.glob(os.path.join(root, "docs", "*-Checklist.md"))
+        if not re.search(r"-(Deployment|P\d+)-Checklist\.md$", h)]  # only the phase-1 work list names the app
 app = (os.path.basename(hits[0])[: -len("-Checklist.md")] if len(hits) == 1
        else os.path.basename(os.path.abspath(root)))
 day = datetime.datetime.now(datetime.timezone.utc).strftime("%Y%m%d")
@@ -304,6 +340,9 @@ AMENDABLE = {
     "why_missed": ("missing-checklist-item", "insufficient-verify-method",
                    "code-audit-limitation", "ambiguous-acceptance",
                    "dependency-not-declared", "instruction-ignored", "other"),
+    # whose gap it was, the four-question sort (FR-32, Session 5): a judgement a reader can
+    # still make later, so a miss logged before the field existed can be sorted now.
+    "sort": ("spec", "unsaid", "weak-check", "ignored"),
 }
 if fld not in AMENDABLE:
     print("REFUSED %s is not an amendable field (SCHEMA.md §5.5.7)" % fld); raise SystemExit(0)
@@ -360,7 +399,7 @@ esac
 # The program is captured into a variable rather than fed on stdin — a heredoc
 # on `python3 -` would REPLACE the caller's piped JSON and silently drop every event.
 TF_PROG="$(cat <<'PY'
-import json, os, sys, datetime, glob, re
+import json, os, sys, datetime, glob, re, time
 
 met_dir, stream, root = sys.argv[1], sys.argv[2], sys.argv[3]
 dbg = os.environ.get("TF_METRICS_DEBUG")
@@ -456,11 +495,8 @@ def _detect_harness():
     # the OTHER harness inherits that harness's markers (e.g. OpenCode started
     # from a Claude Code bash still carries CLAUDE_PROJECT_DIR).
     tf = os.environ.get("TF_HARNESS")
-    if tf in ("claude-code", "opencode", "codex"):
+    if tf in ("claude-code", "opencode"):
         return tf
-    for k in ("CODEX_THREAD_ID", "CODEX_SESSION_ID"):
-        if os.environ.get(k):
-            return "codex"
     for k in ("CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "CLAUDE_CODE_SESSION_ID",
               "CLAUDE_PROJECT_DIR"):
         if os.environ.get(k):
@@ -488,8 +524,6 @@ def _detect_harness():
                     name, ppid = os.path.basename(parts[0]), int(parts[1])
             if name and "opencode" in name.lower():
                 return "opencode"
-            if name and "codex" in name.lower():
-                return "codex"
             if name and "claude" in name.lower():
                 return "claude-code"
             pid = ppid
@@ -505,7 +539,11 @@ except Exception:
 # app name — inferred from the one checklist, else the repo directory name
 def _app_name():
     try:
-        hits = glob.glob(os.path.join(root, "docs", "*-Checklist.md"))
+        # The Deployment Checklist and a Large project's phase-n checklists share the suffix;
+        # only <App>-Checklist.md names the app, else a copy such as TfLens-oc was recorded
+        # under its folder name (MISS-TechieFlow-20260906-04).
+        hits = [h for h in glob.glob(os.path.join(root, "docs", "*-Checklist.md"))
+                if not re.search(r"-(Deployment|P\d+)-Checklist\.md$", h)]
         if len(hits) == 1:
             return os.path.basename(hits[0])[: -len("-Checklist.md")]
     except Exception:
@@ -524,6 +562,54 @@ def enrich(rec):
     DECISIONS.md 2026-08-20)."""
     rec.setdefault("v", 1)
     rec.setdefault("ts", NOW)
+    # A run record says whether YOLO was on (D-12, FR-35; Sitting 4c, 2026-09-06): the task
+    # never has to remember it. TF_YOLO=1 (the supervisor) or a live .tfcore/.session/yolo.json.
+    if rec.get("kind") == "run" and "yolo" not in rec:
+        on = os.environ.get("TF_YOLO") == "1"
+        if not on:
+            try:
+                fl = os.path.join(root, ".tfcore", ".session", "yolo.json")
+                on = os.path.isfile(fl) and (time.time() - os.path.getmtime(fl)) < 24 * 3600
+            except Exception:
+                on = False
+        rec["yolo"] = bool(on)
+    # A run record without `started` takes it from the command marker written by
+    # tf-phase.sh start (step 0 of every task), when the marker names the same command.
+    if rec.get("kind") == "run" and not rec.get("started"):
+        try:
+            with open(os.path.join(root, ".tfcore", ".session", "phase.json"), encoding="utf-8") as fh:
+                mk = json.load(fh) or {}
+            if mk.get("started") and (not rec.get("cmd") or mk.get("cmd") == rec.get("cmd")):
+                rec["started"] = mk["started"]
+                rec.setdefault("ended", NOW)
+                sys.stdout.write("tf-emit: started taken from the command marker (%s)\n" % mk["started"])
+        except Exception:
+            pass
+    # A run's `ended` is when the record is written, never a guess: an ended in the
+    # future (more than a minute past now) or before started is replaced with now and
+    # duration_s recomputed (MISS-TechieFlow-20260905-11: a day-1 run wrote 17:05 at 16:40).
+    # The same rule the other way round: a run record with NO `ended` was silently
+    # accepted and could never be costed — the effort-per-phase figure just lost it
+    # (MISS-TechieFlow-20260907-09, the session-6 record itself). `ended` is when the
+    # record is written, so an absent one is filled in, never left empty.
+    if rec.get("kind") == "run" and not isinstance(rec.get("ended"), str):
+        rec["ended"] = NOW
+    if rec.get("kind") == "run" and isinstance(rec.get("ended"), str):
+        t_end, t_now = _iso_ms(rec["ended"]), _iso_ms(NOW)
+        t_start = _iso_ms(rec["started"]) if isinstance(rec.get("started"), str) else None
+        if t_end is not None and t_now is not None and (t_end > t_now + 60_000 or (t_start is not None and t_end < t_start)):
+            sys.stdout.write("tf-emit: ended %s is not a measurement (it lies %s); set to now, %s\n"
+                             % (rec["ended"], "in the future" if t_end > t_now else "before started", NOW))
+            rec["ended"] = NOW
+            if t_start is not None and "duration_s" in rec:
+                rec["duration_s"] = max(0, (t_now - t_start) // 1000)
+    # A run record that omits duration_s gets it from started and ended (the devguide and
+    # refresh-status records of 2026-09-06 had none; MISS-TechieFlow-20260906-10).
+    if rec.get("kind") == "run" and "duration_s" not in rec and rec.get("started") and rec.get("ended"):
+        try:
+            rec["duration_s"] = max(0, (_iso_ms(rec["ended"]) - _iso_ms(rec["started"])) // 1000)
+        except Exception:
+            pass
     if "project_type" not in rec:
         if PTYPE:
             rec["project_type"] = PTYPE
@@ -531,7 +617,10 @@ def enrich(rec):
             # Default, but NEVER silently — the report labels these unclassified.
             rec["project_type"] = "app"
             rec["project_type_inferred"] = True
-    rec.setdefault("harness", HARNESS)
+    if HARNESS:
+        rec["harness"] = HARNESS          # detected, never declared (SCHEMA.md §1)
+    else:
+        rec.setdefault("harness", None)
     rec.setdefault("app", APP)
     return rec
 
@@ -771,7 +860,7 @@ def enrich_run(rec):
             tier = ROUTING["phases"].get(cmd)
             if tier and tier != "inherit":
                 rec["tier"] = tier
-                key = {"claude-code": "claude", "opencode": "opencode", "codex": "codex"}.get(HARNESS)
+                key = {"claude-code": "claude", "opencode": "opencode"}.get(HARNESS)
                 tm = ROUTING["tiers"].get(tier, {}).get(key) if key else None
                 if tm:
                     rec["tier_model"] = tm
@@ -891,6 +980,7 @@ _AMENDABLE = {
     "why_missed": ("missing-checklist-item", "insufficient-verify-method",
                    "code-audit-limitation", "ambiguous-acceptance",
                    "dependency-not-declared", "instruction-ignored", "other"),
+    "sort": ("spec", "unsaid", "weak-check", "ignored"),
 }
 
 def _amend_ok(rec):
@@ -952,6 +1042,14 @@ _MISS_ENUMS = {
     "why_missed": ("missing-checklist-item", "insufficient-verify-method",
                    "code-audit-limitation", "ambiguous-acceptance",
                    "dependency-not-declared", "instruction-ignored", "other"),
+    # whose gap (FR-32, Session 5 2026-09-07): spec = the app's spec did not say it (fix the
+    # checklist line) · unsaid = the framework never said it (a requirement line plus a check) ·
+    # weak-check = a check existed and did not catch it (fix the check) · ignored = it was written
+    # and not followed (a hook, or delete the rule)
+    "sort": ("spec", "unsaid", "weak-check", "ignored"),
+}
+_REVIEW_ENUMS = {
+    "phase": ("day1-review", "build-review", "verify-review", "handoff-review"),
 }
 _FIX_ENUMS = {
     "verdict_after": ("Verified", "Needs re-verify", "FAIL", "deferred", "wont-fix"),
@@ -975,6 +1073,72 @@ def _enums_ok(rec, table):
     return True
 
 
+# --- shape check (added 2026-09-05, reset Sitting 4a) ------------------------
+# A record may carry only the fields SCHEMA.md defines for its kind (plus the
+# ones this script injects). A `miss` must carry a miss_id from --next-miss-id.
+# Anything else is REFUSED on stdout and never appended, the same choice as
+# _enums_ok(): a field nobody defined is a field no report can read.
+_COMMON = {"v", "ts", "kind", "app", "project_type", "project_type_inferred", "harness", "backfilled"}
+_ALLOWED = {
+    ("runs", "run"): {"cmd", "mode", "yolo", "started", "ended", "duration_s", "reqs_touched", "reqs_count",
+                      "subagents", "files_written", "build_result", "tier", "tier_model", "model", "models",
+                      "routed", "tokens_in", "tokens_out", "tokens_cache_read", "tokens_cache_write",
+                      "cost_usd", "tokens_scope", "attempt", "subagent_runs", "tokens_out_subagents",
+                      "model_tokens_out", "session_id", "usage_start_event_ts", "usage_end_event_ts"},
+    ("gates", "gate"): {"run_id", "req_id", "req_class", "attempt", "verdict", "gate", "gates_run",
+                        "failure_class", "prior_verdict", "proof", "escaped", "phase", "result", "detail", "at",
+                        "tier", "tier_model", "model", "models", "tokens_in", "tokens_out", "tokens_cache_read",
+                        "tokens_cache_write", "cost_usd", "tokens_scope", "model_tokens_out", "routed",
+                        "subagent_runs", "tokens_out_subagents", "session_id"},
+    ("sessions", "session"): {"session_id", "model", "duration_s", "input_tokens", "output_tokens",
+                              "cache_read_tokens", "cache_creation_tokens", "cost_usd", "children_sessions"},
+    ("commits", "commit"): {"sha", "files", "insertions", "deletions", "subject_prefix", "branch"},
+    ("misses", "miss"): {"miss_id", "req_id", "req_class", "miss_class", "artifact", "severity", "origin_phase",
+                         "origin_agent", "origin_run_id", "origin_model", "origin_harness", "origin_confidence",
+                         "why_missed", "found_by", "found_phase", "found_gate", "found_run_id", "failure_class",
+                         "what", "sort"},
+    ("misses", "miss-fix"): {"miss_id", "req_id", "fix_run_id", "fix_cmd", "fix_attempt", "verdict_after",
+                             "reopened", "cost_attribution", "tokens_in", "tokens_out", "tokens_cache_read",
+                             "tokens_cache_write", "cost_usd", "tokens_scope", "model"},
+    ("misses", "miss-amend"): {"miss_id", "field", "value"},
+    # an owner review of a phase's output (FR-36, built 2026-09-06): how many corrections were
+    # given, what producing the reviewed output cost, what applying the corrections cost. The two
+    # costs are copied from the runs named by reviewed_run_id and correction_run_id (their `started`).
+    ("misses", "review"): {"phase", "reviewed_run_id", "correction_run_id", "corrections", "what",
+                           "tokens_produce", "tokens_correct", "cost_produce_usd", "cost_correct_usd",
+                           "model_produce", "model_correct"},
+}
+# Fields the emitter derives for runs/gates: a caller's value is discarded.
+_DERIVED = ("harness", "tier", "tier_model", "model", "models", "model_tokens_out", "routed",
+            "tokens_in", "tokens_out", "tokens_cache_read", "tokens_cache_write", "cost_usd",
+            "tokens_scope", "subagent_runs", "tokens_out_subagents")
+
+
+def _shape_ok(rec):
+    kind = rec.get("kind")
+    if not isinstance(rec, dict) or not kind:
+        sys.stdout.write("tf-emit: REFUSED — record has no \"kind\" (SCHEMA.md §1). Nothing was appended.\n")
+        return False
+    allowed = _ALLOWED.get((stream, kind))
+    if allowed is None:
+        sys.stdout.write("tf-emit: REFUSED — kind %r is not a record kind of the %s stream. Nothing was appended.\n" % (kind, stream))
+        return False
+    unknown = sorted(set(rec) - allowed - _COMMON)
+    if unknown:
+        sys.stdout.write("tf-emit: REFUSED — field(s) not in SCHEMA.md for a %s record: %s. Add the field to the schema first, or drop it. Nothing was appended.\n" % (kind, ", ".join(unknown)))
+        return False
+    if kind == "run" and rec.get("build_result") not in (None, "pass", "fail", "not-run"):
+        sys.stdout.write("tf-emit: REFUSED — build_result must be pass, fail or not-run (SCHEMA.md §2); got %r. Put the detail in the checklist Remarks or Known blockers, not here. Nothing was appended.\n" % (rec.get("build_result"),))
+        return False
+    if kind == "miss" and not rec.get("miss_id"):
+        sys.stdout.write("tf-emit: REFUSED — a miss record needs a miss_id; get one with: bash .tfcore/utils/tf-emit.sh --next-miss-id. Nothing was appended.\n")
+        return False
+    if stream in ("runs", "gates") and not rec.get("backfilled"):
+        for f in _DERIVED:
+            rec.pop(f, None)
+    return True
+
+
 def enrich_miss(rec):
     if stream != "misses":
         return rec
@@ -984,6 +1148,21 @@ def enrich_miss(rec):
         return None
     if rec.get("kind") == "miss-fix" and not _enums_ok(rec, _FIX_ENUMS):
         return None
+    if rec.get("kind") == "review":
+        if not _enums_ok(rec, _REVIEW_ENUMS):
+            return None
+        if not isinstance(rec.get("corrections"), int) or rec["corrections"] < 0:
+            sys.stdout.write("tf-emit: REFUSED — a review record needs \"corrections\", a whole number of corrections the owner gave. Nothing was appended.\n")
+            return None
+        for f in ("tokens_produce", "tokens_correct", "cost_produce_usd", "cost_correct_usd", "model_produce", "model_correct"):
+            rec.pop(f, None)            # derived, never a caller's figure
+        runs = _runs_by_start()
+        for side, key in (("produce", "reviewed_run_id"), ("correct", "correction_run_id")):
+            src = runs.get(rec.get(key)) if rec.get(key) else None
+            rec["tokens_" + side] = src.get("tokens_out") if src else None
+            rec["cost_" + side + "_usd"] = src.get("cost_usd") if src else None
+            rec["model_" + side] = src.get("model") if src else None
+        return rec
     try:
         kind = rec.get("kind")
         runs = _runs_by_start()
@@ -1003,9 +1182,11 @@ def enrich_miss(rec):
                 rec["origin_harness"] = None
         elif kind == "miss-fix":
             src = runs.get(rec.get("fix_run_id")) if rec.get("fix_run_id") else None
+            for f in _COST_FIELDS:
+                rec.pop(f, None)            # a caller's cost figure is never kept
             if src:
                 for f in _COST_FIELDS:
-                    if f in src and f not in rec:
+                    if f in src:
                         rec[f] = src[f]
                 if "cost_attribution" not in rec:
                     touched = src.get("reqs_touched") or []
@@ -1048,6 +1229,8 @@ def enrich_miss(rec):
 # .gitattributes block pins to LF. These files are LF on every platform.
 lines = []
 for rec in records:
+    if not _shape_ok(rec):
+        continue
     out = enrich_miss(enrich_run(stamp_attempt(enrich(rec))))
     if out is None:                 # a refused miss-amend (§5.5.7) — dropped, never appended
         continue
@@ -1072,4 +1255,11 @@ PY
 )"
 python3 -c "$TF_PROG" "$MET_DIR" "$STREAM" "$ROOT" 2>"$TF_ERR"
 
+# The readable miss list beside the record (FR-31, Session 5 2026-09-07): after any write to the
+# misses stream, docs/<App>-Misses.md and its HTML are rebuilt from the stream, so the file is
+# never older than the record. Best effort, like everything else here.
+if [[ "$STREAM" == "misses" ]]; then
+  python3 "$(dirname "${BASH_SOURCE[0]}")/tf-misses-md.py" --root "$ROOT" --quiet 2>"$TF_ERR" || true
+fi
+
 exit 0

package/.tfcore/utils/tf-fix-close.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# tf-fix-close.sh — the telemetry a fix owes when it lands (Sitting 4c, 2026-09-06; D-15).
+#
+#   bash .tfcore/utils/tf-fix-close.sh <App> [--started <ISO>] [--reqs REQ-UI-009,REQ-FN-014]
+#                                            [--subagents trblazeui,builder] [--build pass|fail|not-run] [--files N]
+#
+# Emits, in this order, through tf-emit.sh only:
+#   1. the fix-issues run record (cmd fix-issues, mode fix, the rows touched) — first, because the
+#      miss-fix records below carry no numbers of their own: the emitter copies this run's token window
+#   2. one miss-fix per row that has an open miss, with verdict_after taken from the verify ledger
+#      docs/.last-verify.json written by the verify the fix chained, mapped to a checklist status (PASS →
+#      Verified; FAIL → FAIL; any other failing verdict or an absent row → Needs re-verify). A row with no open miss is listed,
+#      not invented: a fix on a defect nobody logged is a triage gap, so open it first with tf-triage.sh
+#      demote or tf-log-miss.sh, then re-run this.
+# --reqs defaults to every row in the ledger. Telemetry never blocks: refusals are printed, exit 0.
+set -u
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+[[ $# -ge 1 && "$1" != "-h" && "$1" != "--help" ]] || { sed -n '2,17p' "$0" | sed 's/^# \{0,1\}//'; exit 3; }
+APP="$1"; shift
+STARTED=""; REQS=""; SUBS=""; BUILD="pass"; FILES=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --started) STARTED="${2:-}"; shift 2 ;;
+    --reqs) REQS="${2:-}"; shift 2 ;;
+    --subagents) SUBS="${2:-}"; shift 2 ;;
+    --build) BUILD="${2:-}"; shift 2 ;;
+    --files) FILES="${2:-}"; shift 2 ;;
+    *) echo "tf-fix-close: unknown argument $1" >&2; exit 3 ;;
+  esac
+done
+[[ -z "$STARTED" ]] && STARTED="$(bash "$HERE/tf-phase.sh" show 2>/dev/null | sed -n 's/.*"started":"\([^"]*\)".*/\1/p')"
+TF_APP="$APP" TF_STARTED="$STARTED" TF_REQS="$REQS" TF_SUBS="$SUBS" TF_BUILD="$BUILD" TF_FILES="$FILES" TF_EMIT="$HERE/tf-emit.sh" python3 - <<'PY'
+import datetime, json, os, subprocess
+EMIT = os.environ["TF_EMIT"]; app = os.environ["TF_APP"]; started = os.environ["TF_STARTED"]
+now = datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+def q(*a): return subprocess.run(["bash", EMIT, *a], capture_output=True, text=True).stdout.strip()
+def emit(stream, rec):
+    p = subprocess.run(["bash", EMIT, stream], input=json.dumps(rec), capture_output=True, text=True)
+    msg = (p.stdout + p.stderr).strip(); ok = p.returncode == 0 and "refus" not in msg.lower() and "error" not in msg.lower()
+    if not ok: print(f"  {stream}: not written — {msg.splitlines()[0][:160] if msg else 'no reason printed'}")
+    return ok
+ledger = {}
+try:
+    ledger = json.load(open(os.path.join("docs", ".last-verify.json"), encoding="utf-8"))
+except Exception:
+    pass
+rows = ledger.get("rows") or {}
+reqs = [r.strip().upper() for r in os.environ["TF_REQS"].split(",") if r.strip()] or sorted(rows)
+subs = [s.strip() for s in os.environ["TF_SUBS"].split(",") if s.strip()]
+files = os.environ["TF_FILES"]
+run = {"kind": "run", "app": app, "cmd": "fix-issues", "mode": "fix", "ended": now, "reqs_touched": reqs, "reqs_count": len(reqs),
+       "subagents": subs, "files_written": int(files) if files.isdigit() else len(reqs), "build_result": os.environ["TF_BUILD"]}
+if started: run["started"] = started
+# one run record per start: a close called twice must not count the fix twice
+runs_path = os.path.join(q("--where") or "docs/metrics", "runs.jsonl")
+already = False
+if started and os.path.isfile(runs_path):
+    for line in open(runs_path, encoding="utf-8", errors="replace"):
+        if '"cmd":"fix-issues"' in line and f'"started":"{started}"' in line:
+            already = True
+            break
+ok = True if already else emit("runs", run)
+if already:
+    print(f"fix-issues: run record for start {started} already exists; not written again")
+closed, none = 0, []
+for rid in reqs:
+    opened = q("--open-miss", rid)
+    if not opened:
+        none.append(rid); continue
+    mid = opened.split()[0]
+    fa = q("--next-fix-attempt", mid) or "1"
+    v = rows.get(rid)
+    # verdict_after takes a checklist status (SCHEMA §5.5): the ledger's verdict is mapped, never passed raw
+    # (MISS-TechieFlow-20260906-25: RENDER-FAIL was refused and twenty miss-fix records never landed)
+    after = ("Verified" if v == "PASS" else "FAIL" if v in ("FAIL", "BUILD-FAIL") else "Needs re-verify")
+    rec = {"kind": "miss-fix", "miss_id": mid, "req_id": rid, "fix_cmd": "fix-issues", "fix_attempt": int(fa) if fa.isdigit() else 1,
+           "verdict_after": after, "reopened": False}
+    if started: rec["fix_run_id"] = started
+    if emit("misses", rec): closed += 1
+print(f"fix-issues: run record {'already there' if already else 'written' if ok else 'not written'}; {closed} miss-fix record(s) with the verifier's verdict"
+      + (f"; no open miss on {', '.join(none)} (log it first, then re-run)" if none else ""))
+PY
+exit 0