@techierathore/techieflow 1.0.4 → 1.1.0

package/.tfcore/utils/tf-build-list.py

@@ -7,10 +7,11 @@ Reads the phase's checklist (appPhase in core-config.yaml, or --phase) and print
   - the mode: FIX (rows FAIL / PARTIAL / In Progress / Needs re-verify exist, and they
     come FIRST in the list), FRESH (nothing failing), or NOTHING (every row terminal or
     Blocked). The working list is every open row in both FIX and FRESH: the mode says
-    what to build first, never what to leave out.
+    what to build first, never what to leave out. A roadmap row (tf_roadmap.py) is not
+    open: it is counted and named apart, never built.
   - the working list, grouped into clusters by the checklist's page section, each
-    naming its builder from the row prefix: REQ-UI -> trblazeui, REQ-RAG -> techierag,
-    REQ-FN / REQ-NFR -> builder
+    naming its builder from the row prefix: REQ-UI -> trblazeui when the project uses
+    TrBlazeUI (else builder), REQ-RAG -> techierag, REQ-FN / REQ-NFR -> builder
   - with --prompts, one ready sub-agent prompt per cluster, filled from
     .tfcore/templates/v4custom/build-subagent-prompt.md with the rows, their acceptance
     lines, their mockups and the two standing rules.
@@ -20,7 +21,9 @@ import os
 import re
 import sys
 
-TERMINAL = {"verified", "done (pre-existing)", "n/a"}
+# norm() drops a bracketed tail ("Verified (2026-09-01)"), so "Done (pre-existing)" arrives as "done":
+# only the bracketed spelling was listed, and AppManager's 18 finished rows went on the working list (TF-003)
+TERMINAL = {"verified", "done", "done (pre-existing)", "n/a"}
 FIX = {"fail", "partial", "in progress", "needs re-verify"}
 BLOCKED = {"blocked"}
 BUILDER = {"UI": "trblazeui", "RAG": "techierag", "FN": "builder", "NFR": "builder"}
@@ -51,6 +54,44 @@ def norm(s):
     return re.sub(r"\s*\(.*$", "", s).strip()
 
 
+def ui_builder(app):
+    """-> (builder, why) for the UI clusters: trblazeui only when the project uses TrBlazeUI.
+
+    The framework gives every project `.trblazeui/`, whether it uses the library or not, so that
+    folder says nothing: AppManager, which does not use it, had its UI rows sent to the trblazeui
+    sub-agent (TF-008). The project's own files decide: a TrBlazeUI package or project reference in
+    a .csproj or .props. Before any such file exists (a first build), the Architecture document
+    naming it decides. tests/regression/run.sh am_008."""
+    skip = {"bin", "obj", "node_modules", ".git", ".tfcore", ".claude", ".opencode", ".trblazeui",
+            ".techierag", ".artifacts"}
+    seen = 0
+    for root, dirs, files in os.walk("."):
+        dirs[:] = sorted(d for d in dirs if d not in skip)
+        for fn in sorted(files):
+            if not fn.endswith((".csproj", ".props")):
+                continue
+            seen += 1
+            p = os.path.join(root, fn)
+            if re.search(r'Include="[^"]*\bTrBlazeUI[\w.]*(?:\.csproj)?"', read(p), re.I):
+                return "trblazeui", f"{os.path.relpath(p)} references TrBlazeUI"
+    if seen:
+        return "builder", f"none of the {seen} .csproj/.props file(s) references TrBlazeUI"
+    arch = os.path.join("docs", f"{app}-Architecture.md")
+    if os.path.isfile(arch) and re.search(r"\bTrBlazeUI\b", read(arch)):
+        return "trblazeui", f"no project file yet; {arch} names TrBlazeUI"
+    return "builder", "no project file yet, and the Architecture document does not name TrBlazeUI"
+
+
+def usage_guide(app):
+    """The guide the project really has, UsageGuide or Usage-Guide: tf-verify-list.py's reader. The prompt
+    named the first spelling only, a file AppManager does not have (TF-022). tests/regression/run.sh am_022."""
+    import importlib.util
+    spec = importlib.util.spec_from_file_location("tf_verify_list", os.path.join(os.path.dirname(os.path.abspath(__file__)), "tf-verify-list.py"))
+    vl = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(vl)
+    return vl.usage_guide(app)
+
+
 def rows_of(text):
     rows = []
     for line in text.splitlines():
@@ -112,9 +153,14 @@ def main(argv):
     if not rows:
         die(f"{cl} has no REQ rows")
     ent = entries_of(text)
+    sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+    import tf_roadmap
+    import tf_defect
+    marked = tf_roadmap.ids(text)
+    roadmap = [r for r in rows if r["id"].upper() in marked and r["status"] not in TERMINAL | BLOCKED]
 
-    fix_rows = [r for r in rows if r["status"] in FIX]
-    open_rows = [r for r in rows if r["status"] not in TERMINAL | BLOCKED]
+    fix_rows = [r for r in rows if r["status"] in FIX and r not in roadmap]
+    open_rows = [r for r in rows if r["status"] not in TERMINAL | BLOCKED and r not in roadmap]
     # Repair before new work, but never INSTEAD of it. A row can sit at `Needs re-verify`
     # permanently -- TfLens REQ-FN-067 and -070 need a repository that emits events.ndjson
     # and none exists, so every honest verify run re-confirms that gate rather than clearing
@@ -130,17 +176,27 @@ def main(argv):
         mode, work = "FRESH", open_rows
     else:
         mode, work = "NOTHING", []
+    # A row in FIX mode is on the list for a defect its acceptance line rarely names; a builder given
+    # only that line finds the row working and fixes nothing (AppManager TF-020). The defect rides with
+    # the row: its ⚠ clauses, else a FAIL/PARTIAL row's whole Remarks. tests/regression/run.sh am_020.
+    for r in rows:
+        r["defects"] = (tf_defect.clauses(r["remarks"]) or ([r["remarks"]] if r["status"] in {"fail", "partial"}
+                        and r["remarks"] else [])) if r in fix_rows else []
     terminal = sum(1 for r in rows if r["status"] in TERMINAL)
     blocked = [r for r in rows if r["status"] in BLOCKED]
     print(f"# tf-build-list — {app} — {cl} — phase {phase}")
-    print(f"Mode: {mode} — {len(work)} row(s) to build; {terminal} terminal, {len(blocked)} Blocked, {len(rows)} total"
+    print(f"Mode: {mode} — {len(work)} row(s) to build; {terminal} terminal, {len(blocked)} Blocked, "
+          f"{len(roadmap)} roadmap, {len(rows)} total"
           + (f" — {', '.join(r['id'] for r in work[:8])}{' …' if len(work) > 8 else ''}" if work else ""))
-    # Every row is in exactly one of the four counts, and the arithmetic is printed so a
+    # Every row is in exactly one of the five counts, and the arithmetic is printed so a
     # reader can check it rather than trust it. A row missing from all of them is the
     # failure this line exists to make impossible.
-    if len(work) + terminal + len(blocked) != len(rows):
-        print(f"⚠ {len(rows) - len(work) - terminal - len(blocked)} row(s) are in no category — "
+    if len(work) + terminal + len(blocked) + len(roadmap) != len(rows):
+        print(f"⚠ {len(rows) - len(work) - terminal - len(blocked) - len(roadmap)} row(s) are in no category — "
               "the checklist carries a status this script does not know; fix the row or the script")
+    if roadmap:
+        print("Roadmap, not in this phase's scope (not built; the owner moves them with *amend-docs): "
+              + ", ".join(r["id"] for r in roadmap))
     if fix_rows and len(work) > len(fix_rows):
         print(f"Order: {len(fix_rows)} failing row(s) first ({', '.join(r['id'] for r in fix_rows)}), "
               f"then {len(work) - len(fix_rows)} not yet started")
@@ -151,10 +207,14 @@ def main(argv):
         return 0
 
     clusters = {}
+    builder = dict(BUILDER)
+    if any(r["id"].upper().startswith("REQ-UI-") for r in work):
+        builder["UI"], why = ui_builder(app)
+        print(f"UI rows go to: {builder['UI']} — {why}")
     for r in work:
         sec, acc, mock, brd = ent.get(r["id"].upper(), ("Other", "", "", ""))
         cls = re.match(r"REQ-(UI|FN|RAG|NFR)-", r["id"]).group(1)
-        key = ("Non-functional" if cls == "NFR" else "RAG" if cls == "RAG" else sec, BUILDER[cls])
+        key = ("Non-functional" if cls == "NFR" else "RAG" if cls == "RAG" else sec, builder[cls])
         clusters.setdefault(key, []).append((r, acc, mock, brd))
     print()
     print("## Clusters (one sub-agent each; spawn them all in one turn)")
@@ -174,6 +234,8 @@ def main(argv):
             print(f"- {r['id']} [{label}/{builder}] {r['title']} — {r['status']}{todo}")
             if acc:
                 print(f"    Acceptance: {acc}")
+            for x in r["defects"]:
+                print(f"    Defect: {x}")
             if mock:
                 print(f"    Mockup: {mock}")
     if not prompts:
@@ -184,18 +246,24 @@ def main(argv):
         die(f"template {TPL} does not exist at its literal path")
     tpl = read(TPL)
     tpl = re.sub(r"<!--.*?-->\s*", "", tpl, flags=re.S)
+    guide = usage_guide(app)
     for label, sec, builder, items in named:
         lines = []
         for r, acc, mock, brd in items:
             lines.append(f"- {r['id']} — {r['title']}" + (f" ({brd})" if brd else ""))
             lines.append(f"  Acceptance: {acc or 'MISSING — refuse the row and report it'}")
+            lines.extend(f"  Defect: {x}" for x in r["defects"])
             if mock:
                 lines.append(f"  Mockup: {mock}")
+        if any(r["defects"] for r, *_ in items):
+            lines.append("\nA row with a Defect line is on this list for that defect. Fix every one at the file and "
+                         "line it names, keep the acceptance line true, and replace the row's Remarks: a row that "
+                         "already passes its acceptance line is not done while its defect stands.")
         mocks = sorted({m for _r, _a, m, _b in items if m})
         body = (tpl.replace("{App}", app).replace("{Cluster}", label).replace("{Builder}", builder)
                 .replace("{Section}", sec).replace("{Rows}", "\n".join(lines))
                 .replace("{Mockups}", ", ".join(mocks) if mocks else "none (not a UI cluster)")
-                .replace("{Checklist}", cl))
+                .replace("{Checklist}", cl).replace("{UsageGuide}", guide))
         print()
         print(f"## Prompt for cluster {label} [{builder}]")
         print(body.strip())

package/.tfcore/utils/tf-build-list.sh

@@ -9,7 +9,8 @@
 # PARTIAL / In Progress / Needs re-verify make it FIX mode, which puts those rows FIRST and
 # then lists every other open row; FRESH is the same list when nothing is failing; Blocked rows
 # pass through. Clusters follow the checklist's page sections,
-# each with its builder from the prefix (UI -> trblazeui, RAG -> techierag, FN/NFR -> builder).
+# each with its builder from the prefix (UI -> trblazeui when the project references TrBlazeUI,
+# else builder; RAG -> techierag; FN/NFR -> builder).
 # Prompts are filled from .tfcore/templates/v4custom/build-subagent-prompt.md.
 # Writes nothing. Thin wrapper over tf-build-list.py; Python 3 stdlib only.
 set -uo pipefail

package/.tfcore/utils/tf-build.sh

@@ -6,7 +6,9 @@
 #   bash .tfcore/utils/tf-build.sh [build] [<target>] [-- <extra dotnet args>]
 #   bash .tfcore/utils/tf-build.sh test  [<target>] [-- <extra dotnet args>]
 #   bash .tfcore/utils/tf-build.sh run   <project>  [-- <extra dotnet args>]
+#   bash .tfcore/utils/tf-build.sh publish <project> -- -o <dir> [-c <config>]   # tf-verify-boot.sh's
 #   bash .tfcore/utils/tf-build.sh probe                 # print the platform and the rungs, run nothing
+#   bash .tfcore/utils/tf-build.sh --print [build|test]  # print the command this repository uses, run nothing
 #
 # <target> is a .sln, .slnx or .csproj relative to the current folder (default: the one
 # solution or project found here). Output goes to tests/.artifacts/build/<UTC time>.log.
@@ -27,14 +29,28 @@
 # A workload / SDK-missing error (NETSDK1178, Microsoft.iOS/Android/MacCatalyst.Sdk, Workload ID,
 # WindowsAppSDK, command not found) means the wrong rung: the next one is tried, nothing is logged
 # as a blocker. A CS#### error means the code is wrong: the rung stays and the script exits 1.
+# A locked output file (MSB3021, MSB3027, "being used by another process") is neither: the same
+# rung waits and tries again, then says NOT-RUN naming the lock; it never falls to the next rung
+# (TF-035). On WSL a build that changes side -- a WSL rung, then a Windows one, over the same obj/,
+# in this run or since the last -- first clears obj/**/scopedcss: a Blazor build names each scoped
+# stylesheet by a hash of the path, the two sides hash differently, and the incremental target
+# kept the old names, so every page's own styles stopped applying (TfLens, 2026-09-11).
+# One build, test or publish at a time per repository: a second one waits for the first
+# (tests/.artifacts/build/.lock names who holds it). Builders side by side each rebuilt the same
+# obj/ under the others: a running app lost its stylesheet or its process, and a publish carried a
+# dll older than its own source (TF-043). A lock whose process has gone is taken over.
 set -u
+# mapfile and the other bash-4 / GNU-only spellings go through the shim (a stock Mac has bash 3.2).
+source "$(dirname "${BASH_SOURCE[0]}")/tf-portable.sh"
 
-MODE="build"; TARGET=""; EXTRA=()
+MODE="build"; TARGET=""; EXTRA=(); PRINT=0
+[[ "${1:-}" == "--print" ]] && { PRINT=1; shift; }   # print the resolved command, run nothing (TfLens TF-049)
 case "${1:-}" in
-  build|test|run|probe) MODE="$1"; shift ;;
+  build|test|run|publish|probe) MODE="$1"; shift ;;
 esac
 while [[ $# -gt 0 ]]; do
   if [[ "$1" == "--" ]]; then shift; EXTRA=("$@"); break; fi
+  if [[ "$1" == "--print" ]]; then PRINT=1; shift; continue; fi
   TARGET="$1"; shift
 done
 
@@ -48,10 +64,11 @@ elif [[ "$U" == Linux* ]]; then
   fi
 elif [[ "$U" == windows || "$U" == MINGW* || "$U" == MSYS* || "$U" == CYGWIN* ]]; then PLATFORM="windows"
 fi
+PLATFORM="${TF_BUILD_PLATFORM:-$PLATFORM}"   # the self-tests only
 
 # ---- target ---------------------------------------------------------------------------
 if [[ -z "$TARGET" && "$MODE" != "probe" ]]; then
-  mapfile -t CANDS < <(ls -1 *.slnx *.sln 2>/dev/null; ls -1 *.csproj 2>/dev/null)
+  tf_read_lines CANDS < <(ls -1 *.slnx *.sln 2>/dev/null; ls -1 *.csproj 2>/dev/null)
   if [[ ${#CANDS[@]} -eq 1 ]]; then TARGET="${CANDS[0]}"
   elif [[ ${#CANDS[@]} -gt 1 ]]; then echo "NOT-RUN more than one solution or project here; name one: ${CANDS[*]}"; exit 2
   fi
@@ -63,14 +80,14 @@ projects=()
 if [[ -n "$TARGET" ]]; then
   case "$TARGET" in
     *.csproj) projects=("$TARGET") ;;
-    *.sln)  mapfile -t projects < <(grep -oE '"[^"]+\.csproj"' "$TARGET" 2>/dev/null | tr -d '"' | tr '\\' '/') ;;
-    *.slnx) mapfile -t projects < <(grep -oE 'Path="[^"]+\.csproj"' "$TARGET" 2>/dev/null | sed 's/Path="//; s/"$//' | tr '\\' '/') ;;
+    *.sln)  tf_read_lines projects < <(grep -oE '"[^"]+\.csproj"' "$TARGET" 2>/dev/null | tr -d '"' | tr '\\' '/') ;;
+    *.slnx) tf_read_lines projects < <(grep -oE 'Path="[^"]+\.csproj"' "$TARGET" 2>/dev/null | sed 's/Path="//; s/"$//' | tr '\\' '/') ;;
   esac
   base="$(dirname "$TARGET")"
-  for p in "${projects[@]}"; do
+  for p in ${projects[@]+"${projects[@]}"}; do   # the +form: an empty array under set -u (bash 3.2)
     f="$p"; [[ -f "$f" ]] || f="$base/$p"
     [[ -f "$f" ]] || continue
-    if grep -qiE '<UseMaui>\s*true|Microsoft\.NET\.Sdk\.Maui|net[0-9.]+-(android|ios|maccatalyst|windows10)' "$f"; then maui=1; fi
+    if grep -qiE '<UseMaui>[[:space:]]*true|Microsoft\.NET\.Sdk\.Maui|net[0-9.]+-(android|ios|maccatalyst|windows10)' "$f"; then maui=1; fi
   done
 fi
 
@@ -96,10 +113,53 @@ verb="$MODE"
 args=("$verb")
 [[ -n "$TARGET" ]] && args+=("$TARGET")
 [[ "$MODE" == "run" ]] && args=("run" "--project" "$TARGET")
-args+=("${EXTRA[@]}")
+args+=(${EXTRA[@]+"${EXTRA[@]}"})
+[[ $PRINT -eq 1 ]] && { echo "dotnet ${args[*]}"; exit 0; }
 
 mkdir -p tests/.artifacts/build
-LOG="tests/.artifacts/build/$(date -u +%Y%m%dT%H%M%SZ)-$MODE.log"
+LOG="tests/.artifacts/build/$(date -u +%Y%m%dT%H%M%SZ)-$MODE-$$.log"   # two builds in one second never share a log
+
+# ---- one build or browser check at a time (TF-043, TF-048): tf-lock.sh. `run` does not take it.
+source "$(dirname "${BASH_SOURCE[0]}")/tf-lock.sh"
+LOCK="$TF_LOCK"
+[[ "$MODE" != "run" ]] && tf_take_lock "$MODE"
+LOCKED='error MSB302[17]|being used by another process|Access to the path .* is denied'
+# which side of a WSL machine a rung builds on, and the project folders whose obj/ it writes
+side_of() { case "$1" in winrun|cmd.exe|powershell.exe) echo windows ;; *) echo wsl ;; esac; }
+# the projects the target builds, and every project they reference: a web head's static assets come
+# from the library it references, whose obj/ the other side may have written (AppManager TF-004)
+tf_read_lines pdirs < <(python3 - "${base:-.}" ${projects[@]+"${projects[@]}"} <<'PY'
+import os, re, sys
+base, todo, seen = sys.argv[1], [], []
+for p in sys.argv[2:]:
+    todo.append(p if os.path.isfile(p) else os.path.join(base, p))
+while todo:
+    f = os.path.normpath(todo.pop())
+    if not os.path.isfile(f) or os.path.dirname(f) in seen:
+        continue
+    seen.append(os.path.dirname(f) or ".")
+    for ref in re.findall(r'<ProjectReference\s+Include="([^"]+)"', open(f, encoding="utf-8", errors="replace").read()):
+        todo.append(os.path.join(os.path.dirname(f), ref.replace("\\", "/")))
+print("\n".join(seen))
+PY
+)
+cross_side() { # side: clear what another side built with its own paths in it, then mark this side
+  local d cleared=0
+  for d in ${pdirs[@]+"${pdirs[@]}"}; do
+    [[ -d "$d/obj" ]] || continue
+    if [[ "$(cat "$d/obj/.tf-build-side" 2>/dev/null)" != "$1" ]]; then
+      # the scoped stylesheets (TF-035) and the static web asset lists: each side writes its own absolute
+      # paths into those, and a Windows-written one (461 C:\ paths in AppManagerUI's) stopped the WSL
+      # host at startup with "The path must be absolute (Parameter 'root')" (AppManager TF-004)
+      if [[ -n "$(find "$d/obj" -type d -name scopedcss -print -quit 2>/dev/null)" || -n "$(find "$d/obj" "$d/bin" -name '*staticwebassets*.json' -print -quit 2>/dev/null)" ]]; then
+        find "$d/obj" -type d -name scopedcss -prune -exec rm -rf {} + 2>/dev/null
+        find "$d/obj" "$d/bin" -name '*staticwebassets*.json' -delete 2>/dev/null; cleared=1
+      fi
+    fi
+    echo "$1" > "$d/obj/.tf-build-side"
+  done
+  [[ $cleared -eq 1 ]] && echo "note  the scoped stylesheets and static asset lists were built on the other side of this machine; cleared so the $1 build writes them itself"
+}
 WRONG_RUNG='NETSDK1178|Microsoft\.(iOS|Android|MacCatalyst|tvOS)\.Sdk|Workload ID|not recognized|WindowsAppSDK|command not found|No such file or directory|is not recognized as an internal or external command|The term .* is not recognized|workload.*not installed|Inadequate permissions'
 
 tried=()
@@ -114,9 +174,15 @@ for r in "${rungs[@]}"; do
     powershell.exe)  cmd=(powershell.exe -Command "dotnet ${args[*]}"); label="powershell.exe dotnet" ;;
   esac
   tried+=("$label")
-  { echo "### rung $n: ${cmd[*]}"; "${cmd[@]}" 2>&1; echo "### exit $?"; } >> "$LOG" 2>&1
-  rc="$(tail -1 "$LOG" | sed 's/### exit //')"
-  seg="$(awk -v n="### rung $n:" 'index($0,n)==1{p=1} p' "$LOG")"
+  [[ "$PLATFORM" == "wsl" ]] && cross_side "$(side_of "$r")"
+  for attempt in $(seq 0 "${TF_BUILD_LOCK_RETRIES:-2}"); do
+    from=1; [[ -f "$LOG" ]] && from=$(( $(wc -l < "$LOG") + 1 ))   # the redirection itself fails on a log not yet written (TF-037)
+    { echo "### rung $n: ${cmd[*]}"; "${cmd[@]}" 2>&1; echo "### exit $?"; } >> "$LOG" 2>&1
+    rc="$(tail -1 "$LOG" | sed 's/### exit //')"
+    seg="$(tail -n +"$from" "$LOG")"      # this attempt's lines only
+    [[ "$rc" != "0" ]] && grep -qE "$LOCKED" <<<"$seg" || break
+    [[ $attempt -lt ${TF_BUILD_LOCK_RETRIES:-2} ]] && sleep "${TF_BUILD_LOCK_WAIT:-15}"
+  done
   if [[ "$rc" == "0" ]]; then
     warns="$(grep -cE 'warning [A-Z]+[0-9]+' <<<"$seg" || true)"
     echo "PASS  $MODE on $PLATFORM via $label (rung $n) — $warns warning line(s); log $LOG"
@@ -127,16 +193,23 @@ for r in "${rungs[@]}"; do
   # taken for a wrong rung and reported NOT-RUN "host issue" (MISS-TechieFlow-20260906-03).
   if grep -qE 'error (CS|RZ|BL|XC|XLS)[0-9]{3,5}|error MSB[0-9]{4}: .*(does not exist|could not be found)|error NU1' <<<"$seg" && ! grep -qE "$WRONG_RUNG" <<<"$seg"; then
     errs="$(grep -cE 'error (CS|RZ|BL|XC|XLS|MSB|NU)[0-9]+' <<<"$seg" || true)"
-    first="$(grep -E 'error (CS|RZ|BL|XC|XLS|MSB|NU)[0-9]+' <<<"$seg" | head -1 | sed 's/^\s*//' | cut -c1-160)"
+    first="$(grep -E 'error (CS|RZ|BL|XC|XLS|MSB|NU)[0-9]+' <<<"$seg" | head -1 | sed 's/^[[:space:]]*//' | cut -c1-160)"
     echo "FAIL  real errors on $PLATFORM via $label (rung $n): $errs error line(s), first: $first; log $LOG"
-    grep -E 'error (CS|RZ|BL|XC|XLS|MSB|NU)[0-9]+' <<<"$seg" | sed 's/^\s*//' | sort -u | head -10
+    grep -E 'error (CS|RZ|BL|XC|XLS|MSB|NU)[0-9]+' <<<"$seg" | sed 's/^[[:space:]]*//' | sort -u | head -10
     exit 1
   fi
-  if [[ "$MODE" == "test" ]] && grep -qE 'Failed!|Failed:\s+[1-9]|Tests? failed' <<<"$seg"; then
+  if [[ "$MODE" == "test" ]] && grep -qE 'Failed!|Failed:[[:space:]]+[1-9]|Tests? failed' <<<"$seg"; then
     echo "FAIL  tests failed on $PLATFORM via $label (rung $n); log $LOG"
     grep -E 'Failed |Failed!|Error Message|Total tests|Passed!' <<<"$seg" | head -12
     exit 1
   fi
+  # a locked output file: the rung is right and the code is fine; another rung over the same obj/
+  # is exactly what broke the stylesheets (TF-035), so stop here and name the lock
+  if grep -qE "$LOCKED" <<<"$seg"; then
+    first="$(grep -E "$LOCKED" <<<"$seg" | head -1 | sed 's/^[[:space:]]*//' | cut -c1-200)"
+    echo "NOT-RUN the build output is held by a running process (still after $((${TF_BUILD_LOCK_RETRIES:-2} + 1)) tries on $label): $first. Stop that app -- bash .tfcore/utils/tf-verify-boot.sh stop --port <its port> -- and build again. Not a code error; log $LOG"
+    exit 2
+  fi
   # anything else (workload, wrong rung, tool absent): try the next rung
 done
 echo "NOT-RUN no rung could $MODE on $PLATFORM; tried: ${tried[*]}. This is a host issue, never a project blocker; log $LOG"