cohorte 2.7.0 → 2.9.0

package/scripts/test-dashboard.mjs

@@ -184,7 +184,7 @@ console.log("doctor.js — the /cohorte-doctor port");
   writeFileSync(join(d, ".claude", "gate-config.json"), JSON.stringify(gate));
   writeFileSync(join(d, ".mcp.json"), JSON.stringify({ mcpServers: { serena: {} } }));
   mkdirSync(join(d, ".claude", "workflows"), { recursive: true });
-  for (const w of ["review.js", "audit.js", "refactor.js"]) {
+  for (const w of ["review.js", "audit.js", "refactor.js", "loop.js"]) {
     writeFileSync(join(d, ".claude", "workflows", w), "x");
   }
   writeFileSync(join(d, ".claude", "agents", "profile-reader.md"), "x");
@@ -464,12 +464,60 @@ console.log("doctor.js — a non-Claude runtime layout");
   check("nothing is reported broken on a healthy non-Claude install",
     s.summary.bad === 0 && s.summary.warn === 0, JSON.stringify(s.summary));
 
-  // The metrics sink follows `<state>` too.
+  // The metrics sink follows `<state>` too — and workflow-stamped `tokens` aggregate
+  // per feature/phase while token-less conversational lines read as 0, not NaN.
   writeFileSync(join(d, ".cohorte", "pipeline-metrics.jsonl"),
     JSON.stringify({ ts: "2026-01-01T00:00:00Z", feature: "f", phase: "build", seconds: 10,
-      surfaces: { api: "ok" } }) + "\n");
-  check("metrics are read from the runtime's state dir",
-    metrics({ projectRoot: d, globalDir: g }).batches === 1);
+      tokens: 12000, surfaces: { api: "ok" } }) + "\n" +
+    JSON.stringify({ ts: "2026-01-01T01:00:00Z", feature: "f", phase: "review", seconds: 5,
+      surfaces: { api: "SHIP:0" } }) + "\n");
+  const m = metrics({ projectRoot: d, globalDir: g });
+  check("metrics are read from the runtime's state dir", m.batches === 2);
+  check("workflow tokens aggregate; token-less lines count as 0",
+    m.features[0].totalTokens === 12000 && m.features[0].phases.build.tokens === 12000
+      && m.features[0].phases.review.tokens === 0,
+    JSON.stringify(m.features[0] && { t: m.features[0].totalTokens, p: m.features[0].phases }));
+}
+
+// ── runtime.js — stale absolute registry paths (a cloned/moved bundled core) ─
+// runtimes.json records install-time ABSOLUTE paths. A committed core cloned to
+// another machine (or a checkout simply moved) still carries the original paths;
+// taken verbatim, every check went red on a healthy install.
+console.log("runtime.js — registry paths survive a clone/move");
+{
+  const { layouts } = require(join(root, "dashboard/server/runtime.js"));
+  const d = scratch();
+  const core = join(d, ".claude");
+  mkdirSync(join(core, "pipeline"), { recursive: true });
+  const theirRoot = join("/Users", "somebody-else", "their-checkout");
+  writeFileSync(join(core, "pipeline", "runtimes.json"), JSON.stringify({
+    claude: {
+      label: "Claude Code", scope: "project", core_version: "9.9.9",
+      paths: {
+        core: join(theirRoot, ".claude"),
+        commands: join(theirRoot, ".claude", "commands"),
+        agents: join(theirRoot, ".claude", "agents"),
+        hooks_config: join(theirRoot, ".claude", "settings.json"),
+        state: ".claude",
+      },
+    },
+  }));
+  const [l] = layouts({ projectRoot: d, globalDir: join(d, "no-global") });
+  check("agents re-rooted onto the probed checkout",
+    l.agents === join(d, ".claude", "agents"), l.agents);
+  check("hooks config re-rooted too",
+    l.hooksConfig === join(d, ".claude", "settings.json"), l.hooksConfig);
+  // A path OUTSIDE the recorded project root (a genuine machine-local absolute,
+  // e.g. a global agents dir) must pass through untouched.
+  writeFileSync(join(core, "pipeline", "runtimes.json"), JSON.stringify({
+    claude: {
+      label: "Claude Code", scope: "project", core_version: "9.9.9",
+      paths: { core: join(theirRoot, ".claude"), agents: "/opt/shared-agents", state: ".claude" },
+    },
+  }));
+  const [l2] = layouts({ projectRoot: d, globalDir: join(d, "no-global") });
+  check("an absolute path outside the recorded root is untouched",
+    l2.agents === "/opt/shared-agents", l2.agents);
 }
 
 for (const d of tmps) { try { rmSync(d, { recursive: true, force: true }); } catch { /* best effort */ } }

package/scripts/test-gate.mjs

@@ -112,6 +112,12 @@ console.log("gate.py — Bash command gating");
     run(bash("node   ace    migration:run"), at()).decision === "ask");
   check("deny wins over ask on the same segment",
     run(bash("node ace migration:fresh"), at()).decision === "deny");
+  // Deny must win ACROSS segments too: with segment-order scanning, the benign ask
+  // surfaced first and the human's one confirm ran the hard-denied command behind it.
+  check("deny in a LATER segment wins over an earlier ask segment",
+    run(bash("node ace migration:run && node ace migration:fresh"), at()).decision === "deny");
+  check("deny in a later segment wins over an earlier branch-gated ask",
+    run(bash("git commit -m x && node ace db:wipe"), at()).decision === "deny");
   // Matching is substring-on-the-whole-pattern, so a partial overlap is NOT a
   // match — `migration:run` alone does not trigger `node ace migration:run`.
   check("a partial overlap of a pattern does not gate",

package/scripts/test-workflows.mjs

@@ -49,13 +49,17 @@ const finding = (over = {}) => ({
 });
 
 // Run one workflow script with a `reply(prompt, opts) => value` stub in place of
-// every agent call. Returns { result, calls }.
-async function run(script, reply, args = { feature: "feat-x" }) {
+// every agent call, and an optional `wf(name, args)` stub in place of nested
+// workflow() calls (loop.js runs the review workflow as a child). Returns
+// { result, calls, prompts } — prompts keyed by label, for byte-identity asserts.
+async function run(script, reply, args = { feature: "feat-x" }, wf, budgetStub) {
   const text = readFileSync(join(root, "core/workflows", script), "utf8")
     .replace(/^export const meta/m, "const meta");
   const calls = [];
+  const prompts = {};
   const agent = async (prompt, opts = {}) => {
     calls.push(opts.label || "(unlabelled)");
+    prompts[opts.label || "(unlabelled)"] = prompt;
     return reply(prompt, opts, calls);
   };
   // Mirrors the runtime's contract: a thunk that throws resolves to null, the
@@ -76,10 +80,18 @@ async function run(script, reply, args = { feature: "feat-x" }) {
     "agent", "parallel", "pipeline", "phase", "log", "args", "budget", "workflow", text);
   const result = await fn(
     agent, parallel, pipeline, () => {}, () => {}, args,
-    { total: null, spent: () => 0, remaining: () => Infinity }, async () => {});
-  return { result, calls };
+    budgetStub || { total: null, spent: () => 0, remaining: () => Infinity },
+    wf || (async () => {}));
+  return { result, calls, prompts };
 }
 
+// A budget stub whose spent() grows with every agent/workflow call — what the runtime's
+// counter does — so token deltas in the scripts come out non-zero and orderable.
+const tickingBudget = () => {
+  let n = 0;
+  return { total: null, spent: () => (n += 1000), remaining: () => Infinity };
+};
+
 // A reply table keyed by label prefix; the first matching prefix wins.
 const replier = table => (prompt, opts) => {
   const label = opts.label || "";
@@ -156,7 +168,7 @@ console.log("review.js");
     problem: "p", fix: "f", outOfScope: "predates this feature; diff never touched it",
   }];
   let stagePrompt = "";
-  const { result } = await run("review.js", (prompt, opts) => {
+  const { result, calls } = await run("review.js", (prompt, opts) => {
     const label = opts.label || "";
     if (label.startsWith("review:")) return { verdict: "SHIP", findings: [], deferred };
     if (label === "stage-report") { stagePrompt = prompt; return "done"; }
@@ -172,7 +184,8 @@ console.log("review.js");
     /refactor-backlog\.md/.test(stagePrompt) && /deferred:feat-x/.test(stagePrompt),
     stagePrompt.slice(0, 200));
   check("deferred are never cross-checked (no verify agent spawned)",
-    !/verify:/.test(String(result.criticals)) && result.refutedByCrossCheck === 0);
+    !calls.some(c => c.startsWith("verify:")) && result.refutedByCrossCheck === 0,
+    calls.join(","));
 }
 {
   const { result } = await run("review.js", replier([
@@ -344,6 +357,402 @@ console.log("audit.js / refactor.js");
     result.skipped && result.skipped.backend === 2, JSON.stringify(result));
 }
 
+// ── review.js — the machine verdict contract the loop reduces on ─────────────
+console.log("review.js verdict contract");
+{
+  const { result } = await run("review.js", replier([
+    ["preflight", { pass: false, tail: "boom" }], ...BASE_REVIEW,
+  ]));
+  check("red preflight ⇒ aborted: 'preflight' (what a driver branches on)",
+    result.aborted === "preflight", JSON.stringify(result.aborted));
+}
+{
+  // The empty-diff SHIP certified nothing (no review, no stamp) — its `next` must not
+  // read as "run /cohorte-ship", which would point a driver at a gate that refuses.
+  const { result } = await run("review.js", replier([
+    ["stage-diff", { surfaces: [] }], ...BASE_REVIEW,
+  ]));
+  check("empty-diff SHIP ⇒ next warns nothing was reviewed, never '/cohorte-ship'",
+    result.verdict === "SHIP" && !String(result.next).startsWith("/cohorte-ship") && /no review|nothing to ship/i.test(result.next),
+    result.next);
+}
+{
+  // blocking = CRITICAL + security counted once; blocking_items = identity, not wording:
+  // surface | file WITHOUT :line | first 8 words of the problem, lowercased, collapsed.
+  const crit = finding({ severity: "CRITICAL", file: "apps/api/a.ts:41",
+    problem: "Missing auth-check on POST /orders endpoint here now" });
+  let stagePrompt = "";
+  const { result } = await run("review.js", (prompt, opts) => {
+    const label = opts.label || "";
+    if (label.startsWith("verify:")) return { refuted: false, reason: "holds" };
+    if (label.startsWith("review:backend")) return { verdict: "REVISE", findings: [crit] };
+    if (label.startsWith("review:")) return { verdict: "SHIP", findings: [] };
+    if (label === "stage-report") { stagePrompt = prompt; return "done"; }
+    return replier(BASE_REVIEW)(prompt, opts);
+  });
+  check("blocking counts CRITICAL+security, each once", result.blocking === 1, `got ${result.blocking}`);
+  check("blockingItems: surface|file-no-line|8-word normalized problem",
+    (result.blockingItems || [])[0] === "backend|apps/api/a.ts|missing auth check on post orders endpoint here",
+    JSON.stringify(result.blockingItems));
+  check("verdict.json is staged, fingerprint computed in Bash (sha256), never by hand",
+    /verdict\.json/.test(stagePrompt) && /sha256sum/.test(stagePrompt), stagePrompt.slice(0, 200));
+}
+{
+  // The cross-check exists so a refuted CRITICAL cannot force a fix loop — and so an
+  // unrefuted one still does. Both directions, plus security ⇒ BLOCK.
+  const crit = finding({ severity: "CRITICAL" });
+  const withVerify = refuted => (prompt, opts) => {
+    const label = opts.label || "";
+    if (label.startsWith("verify:")) return { refuted, reason: refuted ? "a guard covers it" : "holds" };
+    if (label.startsWith("review:backend")) return { verdict: "REVISE", findings: [crit] };
+    if (label.startsWith("review:")) return { verdict: "SHIP", findings: [] };
+    return replier(BASE_REVIEW)(prompt, opts);
+  };
+  const kept = await run("review.js", withVerify(false));
+  check("unrefuted CRITICAL ⇒ REVISE, cross-check ran",
+    kept.result.verdict === "REVISE" && kept.calls.some(c => c.startsWith("verify:")),
+    JSON.stringify([kept.result.verdict, kept.result.blocking]));
+  const refutedRun = await run("review.js", withVerify(true));
+  check("refuted CRITICAL ⇒ SHIP, not a fix loop",
+    refutedRun.result.verdict === "SHIP" && refutedRun.result.refutedByCrossCheck === 1 && refutedRun.result.blocking === 0,
+    JSON.stringify([refutedRun.result.verdict, refutedRun.result.refutedByCrossCheck]));
+  const sec = await run("review.js", (prompt, opts) => {
+    const label = opts.label || "";
+    if (label.startsWith("verify:")) return { refuted: false, reason: "holds" };
+    if (label.startsWith("review:backend")) return { verdict: "REVISE", findings: [finding({ severity: "HIGH", kind: "security" })] };
+    if (label.startsWith("review:")) return { verdict: "SHIP", findings: [] };
+    return replier(BASE_REVIEW)(prompt, opts);
+  });
+  check("surviving security finding ⇒ BLOCK, counted blocking",
+    sec.result.verdict === "BLOCK" && sec.result.blocking === 1,
+    JSON.stringify([sec.result.verdict, sec.result.blocking]));
+  // A dead cross-check verifier must KEEP the finding (a real CRITICAL must not die
+  // on a transport error), never silently drop it.
+  const deadVerify = await run("review.js", (prompt, opts) => {
+    const label = opts.label || "";
+    if (label.startsWith("verify:")) return null;
+    if (label.startsWith("review:backend")) return { verdict: "REVISE", findings: [crit] };
+    if (label.startsWith("review:")) return { verdict: "SHIP", findings: [] };
+    return replier(BASE_REVIEW)(prompt, opts);
+  });
+  check("dead verifier ⇒ the CRITICAL is kept, verdict REVISE",
+    deadVerify.result.verdict === "REVISE" && deadVerify.result.blocking === 1,
+    JSON.stringify([deadVerify.result.verdict, deadVerify.result.blocking]));
+}
+
+// ── refactor.js — args scoping + the retry round's cleared accumulation ──────
+console.log("refactor.js retry & args");
+{
+  // Bare-string shorthand names a DOMAIN — it must never widen to 'all' (that
+  // dispatched code-editing implementers on every big domain).
+  let backlogPrompt = "";
+  await run("refactor.js", (prompt, opts) => {
+    const label = opts.label || "";
+    if (label === "profile") return PROFILE;
+    if (label === "read-backlog") { backlogPrompt = prompt; return { domains: [] }; }
+    return "ok";
+  }, "backend");
+  check("bare-string args scope to that domain, not 'all'",
+    /Requested domains: backend/.test(backlogPrompt) && !/Requested domains: all/.test(backlogPrompt),
+    backlogPrompt.slice(-140));
+}
+{
+  // The re-verify covers only the retried items; round 1's verified clears must
+  // survive the merge or the backlog un-ticks finished work.
+  const items = ["- [ ] a", "- [ ] b", "- [ ] c", "- [ ] d", "- [ ] e"];
+  let tickPrompt = "";
+  const { result } = await run("refactor.js", (prompt, opts) => {
+    const label = opts.label || "";
+    if (label === "profile") return PROFILE;
+    if (label === "read-backlog") return { domains: [{ key: "backend", items }] };
+    if (label === "verify:backend") return { cleared: items.slice(0, 3), remaining: items.slice(3), gatesGreen: true };
+    if (label === "reverify:backend") return { cleared: items.slice(3), remaining: [], gatesGreen: true };
+    if (label === "tick-backlog") { tickPrompt = prompt; return "done"; }
+    return "handoff";
+  }, { domains: "all" });
+  check("retry round keeps round-1 clears (5/5, not 2/5)",
+    result.domains.backend.cleared === 5 && result.domains.backend.remaining === 0,
+    JSON.stringify(result.domains));
+  check("all five cleared items reach the ticker", items.every(i => tickPrompt.includes(i)),
+    tickPrompt.slice(0, 160));
+}
+{
+  // A dead re-verifier loses only the retry round's claim: round 1's clears stay
+  // cleared, the retried items stay open — never reset to all-five-open.
+  const items = ["- [ ] a", "- [ ] b", "- [ ] c", "- [ ] d", "- [ ] e"];
+  const { result } = await run("refactor.js", (prompt, opts) => {
+    const label = opts.label || "";
+    if (label === "profile") return PROFILE;
+    if (label === "read-backlog") return { domains: [{ key: "backend", items }] };
+    if (label === "verify:backend") return { cleared: items.slice(0, 3), remaining: items.slice(3), gatesGreen: true };
+    if (label === "reverify:backend") return null;
+    if (label === "tick-backlog") return "done";
+    return "handoff";
+  }, { domains: "all" });
+  check("dead re-verifier ⇒ round-1 clears kept, retried items open",
+    result.domains.backend.cleared === 3 && result.domains.backend.remaining === 2,
+    JSON.stringify(result.domains));
+}
+{
+  // Gates red with everything cleared: the retry must NOT re-open verified items —
+  // with a dead re-verifier the same lines once sat in `cleared` AND `remaining`
+  // (ticked off the backlog while reported open).
+  const items = ["- [ ] a", "- [ ] b", "- [ ] c", "- [ ] d", "- [ ] e"];
+  const { result } = await run("refactor.js", (prompt, opts) => {
+    const label = opts.label || "";
+    if (label === "profile") return PROFILE;
+    if (label === "read-backlog") return { domains: [{ key: "backend", items }] };
+    if (label === "verify:backend") return { cleared: items, remaining: [], gatesGreen: false, failures: "lint red" };
+    if (label === "reverify:backend") return null;
+    if (label === "tick-backlog") return "done";
+    return "handoff";
+  }, { domains: "all" });
+  check("gates-red + all cleared + dead re-verifier ⇒ no cleared/remaining overlap",
+    result.domains.backend.cleared === 5 && result.domains.backend.remaining === 0,
+    JSON.stringify(result.domains));
+}
+
+// ── loop.js — build → review → [fix → review]*, unattended ──────────────────
+// The reducer's facts come from stubs, but the DECISIONS under test (freshness,
+// precondition gates, exit ordering, treading water) all live in script code —
+// which is exactly why they live there and not in an agent prompt.
+console.log("loop.js");
+
+const loopFacts = (over = {}) => ({
+  now: { epoch: 1000000, iso: "2026-08-22T00:00:00Z" },
+  spec: { exists: true, status: "frozen", kind: "", mtimeEpoch: 500, designFiles: [] },
+  readiness: { exists: true, mtimeEpoch: 600, verdict: "READY", gaps: [], surfaces: ["backend", "frontend"] },
+  contractFile: { exists: true },
+  build: { exists: false },
+  loop: { exists: false },
+  ...over,
+});
+const FRESH_BUILD = { exists: true, mtimeEpoch: 600, dead: [] };
+const loopReply = (facts, over = {}) => (prompt, opts) => {
+  const label = opts.label || "";
+  if (label === "profile") return over.profile || PROFILE;
+  if (label === "preconditions") return facts;
+  if (label.startsWith("state:") || label === "close") return "done 1000001";
+  if (label.startsWith("ingest:")) return "ingest" in over ? over.ingest
+    : { items: [{ line: "- [ ] CRITICAL · apps/api/a.ts:3 · quality · f", file: "apps/api/a.ts" }] };
+  if (label.startsWith("tick:")) return "done";
+  if (label.startsWith("build") || label.startsWith("fix")) {
+    return "impl" in over ? over.impl : "handoff\n## Remediation addressed\n- apps/api/a.ts:3 — fixed";
+  }
+  return "ok";
+};
+const reviewOf = over => ({
+  verdict: "REVISE", blocking: 1, blockingItems: ["backend|apps/api/a.ts|p"],
+  unreviewedSurfaces: [], deferred: 0, ...over,
+});
+const SHIP_CLEAN = { verdict: "SHIP", blocking: 0, blockingItems: [], unreviewedSurfaces: [], deferred: 0, next: "/cohorte-ship feat-x (DoD ticked + freshness stamped)" };
+
+{
+  // THE ordering regression: a dead reviewer's zero findings must not read as ship.
+  // unreviewed is checked BEFORE blocking — the other way round ships unread code.
+  const wf = async () => reviewOf({ blocking: 0, unreviewedSurfaces: ["backend"] });
+  const { result } = await run("loop.js", loopReply(loopFacts({ build: FRESH_BUILD })), { feature: "feat-x" }, wf);
+  check("unreviewed + blocking 0 ⇒ abort/unreviewed, NOT ship",
+    result.outcome === "abort" && result.reason === "unreviewed", JSON.stringify([result.outcome, result.reason]));
+}
+{
+  // Same blocking identity two consecutive rounds ⇒ treading water at round 2,
+  // not burned down to maxRounds.
+  const wf = async () => reviewOf();
+  const { result, calls } = await run("loop.js", loopReply(loopFacts({ build: FRESH_BUILD })), { feature: "feat-x" }, wf);
+  check("identical fingerprint twice ⇒ abort/treading-water", result.reason === "treading-water", result.reason);
+  check("…at round 2, not maxRounds", result.rounds === 2, `rounds ${result.rounds}`);
+  check("…after exactly one fix round", calls.filter(c => c.startsWith("fix:")).length === 1,
+    calls.filter(c => c.startsWith("fix")).join(","));
+}
+{
+  // NOT-READY is the one outcome more passes cannot fix — and a precondition that
+  // aborts AFTER spawning has not aborted: only profile + preconditions may run.
+  const facts = loopFacts({ readiness: { exists: true, mtimeEpoch: 600, verdict: "NOT-READY", gaps: ["contract|POST /x|no shape"], surfaces: ["backend"] } });
+  const { result, calls } = await run("loop.js", loopReply(facts), { feature: "feat-x" }, async () => SHIP_CLEAN);
+  check("NOT-READY ⇒ abort/precondition with the gaps verbatim",
+    result.reason === "precondition" && (result.gaps || []).length === 1, JSON.stringify(result));
+  check("NOT-READY ⇒ zero dispatches (profile + facts only)",
+    calls.join(",") === "profile,preconditions", calls.join(","));
+}
+{
+  // readiness older than the spec describes a spec that no longer exists ⇒ absent.
+  const facts = loopFacts({ readiness: { exists: true, mtimeEpoch: 400, verdict: "READY", gaps: [], surfaces: ["backend"] } });
+  const { result, calls } = await run("loop.js", loopReply(facts), { feature: "feat-x" }, async () => SHIP_CLEAN);
+  check("stale readiness.json ⇒ treated as absent ⇒ abort/precondition",
+    result.reason === "precondition" && /older than the spec/.test(result.detail), JSON.stringify(result.detail));
+  check("stale readiness ⇒ zero dispatches", calls.join(",") === "profile,preconditions", calls.join(","));
+}
+{
+  // A blocking finding on the contract file is /cohorte-fix §1's lead-only step.
+  const CPROFILE = { ...PROFILE, contract: { enabled: true, path: "packages/shared/src", ext: "ts", mechanism: "shared-types-zod" } };
+  const wf = async () => reviewOf({ blockingItems: ["backend|packages/shared/src/feat-x.ts|response shape wrong"] });
+  const { result, calls } = await run("loop.js",
+    loopReply(loopFacts({ build: FRESH_BUILD }), { profile: CPROFILE }), { feature: "feat-x" }, wf);
+  check("blocking finding on the contract file ⇒ abort/contract-change",
+    result.reason === "contract-change", result.reason);
+  check("contract-change ⇒ no fix round dispatched", !calls.some(c => c.startsWith("fix")), calls.join(","));
+}
+{
+  // Dead build implementers: retried ONCE, byte-identical, then abort — never "ok".
+  const { result, calls, prompts } = await run("loop.js",
+    loopReply(loopFacts(), { impl: null }), { feature: "feat-x" }, async () => SHIP_CLEAN);
+  check("dead implementers ⇒ abort/dead-implementers", result.reason === "dead-implementers", result.reason);
+  check("each dead surface retried exactly once",
+    calls.filter(c => c === "build:backend").length === 1 && calls.filter(c => c === "build-retry:backend").length === 1,
+    calls.join(","));
+  check("the retry is byte-identical to the dispatch",
+    prompts["build:backend"] === prompts["build-retry:backend"]);
+}
+{
+  // Deferred findings never cost a round: 9 deferred + 0 blocking ships in one.
+  const wf = async () => ({ ...SHIP_CLEAN, deferred: 9 });
+  const { result } = await run("loop.js", loopReply(loopFacts({ build: FRESH_BUILD })), { feature: "feat-x" }, wf);
+  check("deferred 9 + blocking 0 ⇒ ship in one round",
+    result.outcome === "ship" && result.rounds === 1 && result.deferred === 9, JSON.stringify(result));
+}
+{
+  // The degraded preflight verdict has no unreviewed/blocking keys — the reducer
+  // must branch on `aborted`, not crash on a missing field.
+  const wf = async () => ({ verdict: "ABORTED", aborted: "preflight", reason: "preflight red" });
+  const { result } = await run("loop.js", loopReply(loopFacts({ build: FRESH_BUILD })), { feature: "feat-x" }, wf);
+  check("child preflight abort ⇒ abort/preflight (no crash on the degraded shape)",
+    result.outcome === "abort" && result.reason === "preflight", JSON.stringify([result.outcome, result.reason]));
+}
+{
+  // A fresh build.json with no dead surfaces means the work is on disk — entering
+  // after a conversational /cohorte-build must not rebuild it.
+  const { result, calls } = await run("loop.js",
+    loopReply(loopFacts({ build: FRESH_BUILD })), { feature: "feat-x" }, async () => SHIP_CLEAN);
+  check("fresh build.json ⇒ build phase skipped", !calls.some(c => c.startsWith("build")), calls.join(","));
+  check("…and the run still ships", result.outcome === "ship", result.outcome);
+  // …and a STALE build.json builds: the work on disk predates the spec.
+  const stale = await run("loop.js",
+    loopReply(loopFacts({ build: { exists: true, mtimeEpoch: 400, dead: [] } })), { feature: "feat-x" }, async () => SHIP_CLEAN);
+  check("stale build.json ⇒ build phase runs", stale.calls.some(c => c.startsWith("build:")), stale.calls.join(","));
+}
+{
+  // Resume: an unfinished, fresh loop.json restores round + the treading-water key,
+  // so a run killed mid-round costs a re-review, not a restart.
+  const prev = JSON.stringify({ id: "feat-x", round: 3, lastItems: ["backend|apps/api/a.ts|p"], history: [{ round: 1, blocking: 3 }, { round: 2, blocking: 1 }] });
+  const facts = loopFacts({ build: FRESH_BUILD, loop: { exists: true, mtimeEpoch: 700, raw: prev } });
+  const wf = async () => reviewOf();
+  const { result, calls } = await run("loop.js", loopReply(facts), { feature: "feat-x" }, wf);
+  check("resume: same items as the resumed round ⇒ treading-water immediately",
+    result.reason === "treading-water" && !calls.some(c => c.startsWith("fix")), JSON.stringify([result.reason, result.rounds]));
+  check("resume: history carries the prior rounds", result.rounds === 3, `rounds ${result.rounds}`);
+  // A FINISHED loop.json (outcome set) must not resume — fresh run from round 1.
+  const done = JSON.stringify({ id: "feat-x", round: 4, outcome: "abort", lastItems: ["backend|apps/api/a.ts|p"], history: [] });
+  const r2 = await run("loop.js",
+    loopReply(loopFacts({ build: FRESH_BUILD, loop: { exists: true, mtimeEpoch: 700, raw: done } })),
+    { feature: "feat-x" }, wf);
+  check("a finished loop.json does not resume (round 1, fix dispatched)",
+    r2.calls.some(c => c.startsWith("fix:")), r2.calls.join(","));
+}
+{
+  // The loop EDITS the spec as it runs (status stamps, Remediation appends), so on
+  // resume the spec's mtime is NEWER than readiness.json — freshness must be measured
+  // against the baseline stored in loop.json, or the loop's own footprint aborts its
+  // own resume with "readiness is older than the spec".
+  const prev = JSON.stringify({ id: "feat-x", round: 2, specMtime: 500, lastItems: ["backend|apps/api/old.ts|p"], history: [{ round: 1, blocking: 3 }] });
+  const facts = loopFacts({
+    spec: { exists: true, status: "in-progress", kind: "", mtimeEpoch: 900, designFiles: [] },
+    build: FRESH_BUILD,
+    loop: { exists: true, mtimeEpoch: 700, raw: prev },
+  });
+  const { result } = await run("loop.js", loopReply(facts), { feature: "feat-x" }, async () => SHIP_CLEAN);
+  check("resume survives the loop's own spec writes (baseline mtime, not current)",
+    result.outcome === "ship", JSON.stringify([result.outcome, result.reason, result.detail]));
+  check("resume keeps only rounds before the resumed one (no double count)",
+    result.rounds === 2, `rounds ${result.rounds}`);
+}
+{
+  // A real verdict whose report never landed on disk: the fix round would ingest the
+  // PREVIOUS round's report. Resumable give-up, never a fix round on stale findings.
+  const wf = async () => reviewOf({ reportStaged: false });
+  const { result, calls } = await run("loop.js", loopReply(loopFacts({ build: FRESH_BUILD })), { feature: "feat-x" }, wf);
+  check("blocking verdict + unstaged report ⇒ abort/report-not-staged, no fix round",
+    result.reason === "report-not-staged" && !calls.some(c => c.startsWith("fix")),
+    JSON.stringify([result.reason, calls.filter(c => c.startsWith("fix"))]));
+}
+{
+  // Ordinary surface code can live UNDER contract.path (a `shared` surface at the
+  // contract package) — only the feature's contract FILE is the lead-only abort.
+  const CPROFILE = { ...PROFILE, contract: { enabled: true, path: "packages/shared/src", ext: "ts", mechanism: "shared-types-zod" } };
+  const wf = async () => reviewOf({ blockingItems: ["backend|packages/shared/src/utils.ts|helper broken"] });
+  const { result, calls } = await run("loop.js",
+    loopReply(loopFacts({ build: FRESH_BUILD }), { profile: CPROFILE }), { feature: "feat-x" }, wf);
+  check("a finding elsewhere under contract.path is NOT contract-change",
+    result.reason !== "contract-change" && calls.some(c => c.startsWith("fix:")),
+    JSON.stringify([result.reason, calls.filter(c => c.startsWith("fix"))]));
+}
+{
+  // A dead fix implementer still gets its metrics line — an incomplete batch is the
+  // batch worth recording — written BEFORE the abort.
+  const wf = async () => reviewOf();
+  const { result, prompts } = await run("loop.js",
+    loopReply(loopFacts({ build: FRESH_BUILD }), { impl: null }), { feature: "feat-x" }, wf);
+  check("dead fix implementer ⇒ abort, with the fix metrics written first (\"dead\")",
+    result.reason === "dead-implementers" && /"backend":"dead"/.test(prompts["state:fixed-1"] || ""),
+    JSON.stringify([result.reason, (prompts["state:fixed-1"] || "").slice(-120)]));
+}
+{
+  // maxRounds is the last net: distinct findings each round burn down to it.
+  let n = 0;
+  const wf = async () => reviewOf({ blockingItems: [`backend|apps/api/f${++n}.ts|p`] });
+  const { result } = await run("loop.js", loopReply(loopFacts({ build: FRESH_BUILD })),
+    { feature: "feat-x", maxRounds: 2 }, wf);
+  check("maxRounds reached with distinct findings ⇒ abort/max-rounds at that round",
+    result.reason === "max-rounds" && result.rounds === 2, JSON.stringify([result.reason, result.rounds]));
+}
+{
+  // A ship with surviving HIGH/MEDIUM has NO freshness stamp — the loop must relay
+  // review's routing (which says /cohorte-fix), not print "/cohorte-ship".
+  const wf = async () => ({ ...SHIP_CLEAN, next: "/cohorte-fix feat-x — SHIP verdict, but 2 finding(s) above LOW survived; park them in specs/refactor-backlog.md instead if you deliberately defer them" });
+  const { result } = await run("loop.js", loopReply(loopFacts({ build: FRESH_BUILD })), { feature: "feat-x" }, wf);
+  check("ship with HIGH leftovers ⇒ next relays review's /cohorte-fix routing",
+    String(result.next).startsWith("/cohorte-fix"), result.next);
+}
+{
+  // Dead ingest = no Remediation items were appended; dispatching blind would
+  // re-build surfaces with no instructions. Abort, resumable at this round.
+  const wf = async () => reviewOf();
+  const { result } = await run("loop.js",
+    loopReply(loopFacts({ build: FRESH_BUILD }), { ingest: null }), { feature: "feat-x" }, wf);
+  check("dead ingest agent ⇒ abort/ingest-died, items never invented",
+    result.reason === "ingest-died", result.reason);
+}
+{
+  // Token accounting: the run's history and metrics lines carry approximate output
+  // tokens from budget.spent() — the figure the conversational path cannot record.
+  const wf = async () => reviewOf();
+  const { result, prompts } = await run("loop.js", loopReply(loopFacts()),
+    { feature: "feat-x" }, wf, tickingBudget());
+  check("loop: history rounds carry a tokens figure",
+    result.history.length > 0 && result.history.every(h => typeof h.tokens === "number" && h.tokens > 0),
+    JSON.stringify(result.history));
+  check("loop: build metrics line carries tokens",
+    /"phase":"build".*"tokens":[1-9]/.test(prompts["state:built"] || ""),
+    (prompts["state:built"] || "").slice(-200));
+  check("loop: the run total is returned", typeof result.tokens === "number" && result.tokens > 0,
+    String(result.tokens));
+  let stagePrompt = "";
+  await run("review.js", (prompt, opts) => {
+    if (opts.label === "stage-report") { stagePrompt = prompt; return "done"; }
+    return replier([["review:", { verdict: "SHIP", findings: [] }], ...BASE_REVIEW])(prompt, opts);
+  }, { feature: "feat-x" }, undefined, tickingBudget());
+  check("review: metrics line carries tokens",
+    /"phase":"review".*"tokens":[1-9]/.test(stagePrompt), stagePrompt.slice(-200));
+}
+{
+  // workflow() unavailable (no runtime / review.js not installed) ⇒ explicit refusal,
+  // never a conversational fallback.
+  const wf = async () => { throw new Error("unknown workflow: cohorte-review"); };
+  const { result } = await run("loop.js", loopReply(loopFacts({ build: FRESH_BUILD })), { feature: "feat-x" }, wf);
+  check("review workflow unavailable ⇒ abort/review-workflow-unavailable",
+    result.reason === "review-workflow-unavailable", result.reason);
+}
+
 console.log("");
 if (failures) { console.error(`test-workflows: ${failures} failure(s)`); process.exit(1); }
 console.log("test-workflows: OK");