devrites 4.6.0 → 5.0.0

package/engine/internal/state/acceptance_test.go

@@ -0,0 +1,57 @@
+package state
+
+import (
+	"slices"
+	"testing"
+)
+
+func TestParseAcceptanceMapEmptySpecPasses(t *testing.T) {
+	got := ParseAcceptanceMap([]byte("# Spec\n\nReady.\n"), []byte("tasks"), []byte("plan"), true, true)
+	if len(got.SpecIDs) != 0 || len(got.Problems) != 0 {
+		t.Fatalf("ids=%v problems=%v", got.SpecIDs, got.Problems)
+	}
+}
+
+func TestParseAcceptanceMapRequiresTasksAndTestPlan(t *testing.T) {
+	spec := []byte("# Spec\n\n## Acceptance criteria\n- [ ] AC-001: export CSV\n- [ ] AC-002: reject cross-user\n")
+	tasks := []byte("# Tasks\nSatisfies: AC-001\n")
+	plan := []byte("# Test plan\nAC-001 → T1\n")
+	got := ParseAcceptanceMap(spec, tasks, plan, true, true)
+	if !slices.Equal(got.SpecIDs, []string{"AC-001", "AC-002"}) {
+		t.Fatalf("ids=%v", got.SpecIDs)
+	}
+	if !slices.Equal(got.Problems, []string{
+		"acceptance AC-002 is not referenced in tasks.md",
+		"acceptance AC-002 is not referenced in test-plan.md",
+	}) {
+		t.Fatalf("problems=%v", got.Problems)
+	}
+}
+
+func TestParseAcceptanceMapSkipsUnrequiredArtifacts(t *testing.T) {
+	spec := []byte("## Acceptance Criteria\n- AC-001: bind readiness inputs.\n")
+	got := ParseAcceptanceMap(spec, nil, nil, false, false)
+	if !slices.Equal(got.SpecIDs, []string{"AC-001"}) || len(got.Problems) != 0 {
+		t.Fatalf("ids=%v problems=%v", got.SpecIDs, got.Problems)
+	}
+}
+
+func TestParseAcceptanceMapIgnoresNoncanonicalAndDuplicates(t *testing.T) {
+	spec := []byte("## Acceptance criteria\n- AC-001: one\n- AC1: ignored\n- AC-001: again\n")
+	tasks := []byte("Satisfies: AC-001\n")
+	plan := []byte("AC-001\n")
+	got := ParseAcceptanceMap(spec, tasks, plan, true, true)
+	if !slices.Equal(got.SpecIDs, []string{"AC-001"}) || len(got.Problems) != 0 {
+		t.Fatalf("ids=%v problems=%v", got.SpecIDs, got.Problems)
+	}
+}
+
+func TestParseAcceptanceMapStopsAtNextH2(t *testing.T) {
+	spec := []byte("## Acceptance criteria\n- AC-001: in section\n\n## Non-goals\n- AC-999: outside\n")
+	tasks := []byte("AC-001\n")
+	plan := []byte("AC-001\n")
+	got := ParseAcceptanceMap(spec, tasks, plan, true, true)
+	if !slices.Equal(got.SpecIDs, []string{"AC-001"}) || len(got.Problems) != 0 {
+		t.Fatalf("ids=%v problems=%v", got.SpecIDs, got.Problems)
+	}
+}

package/engine/internal/state/cmd/workflowmanifest/main.go

@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"flag"
 	"fmt"
+	"io"
 	"os"
 
 	"github.com/devrites/devrites/internal/state"
@@ -42,9 +43,19 @@ func workflowPhases() []workflowPhase {
 }
 
 func main() {
-	outPath := flag.String("out", "workflow_manifest.json", "output path")
-	check := flag.Bool("check", false, "fail when the output is stale")
-	flag.Parse()
+	os.Exit(run(os.Args[1:], os.Stderr))
+}
+
+// run is the testable entry point. It returns the process exit code.
+func run(args []string, stderr io.Writer) int {
+	flags := flag.NewFlagSet("workflowmanifest", flag.ContinueOnError)
+	flags.SetOutput(io.Discard)
+	outPath := flags.String("out", "workflow_manifest.json", "output path")
+	check := flags.Bool("check", false, "fail when the output is stale")
+	if err := flags.Parse(args); err != nil {
+		fmt.Fprintln(stderr, err)
+		return 2
+	}
 
 	document := struct {
 		GeneratedBy      string                 `json:"generatedBy"`
@@ -61,25 +72,25 @@ func main() {
 	}
 	data, err := json.MarshalIndent(document, "", "  ")
 	if err != nil {
-		fatal(err)
+		fmt.Fprintln(stderr, err)
+		return 1
 	}
 	data = append(data, '\n')
 	if *check {
 		current, err := os.ReadFile(*outPath)
 		if err != nil {
-			fatal(err)
+			fmt.Fprintln(stderr, err)
+			return 1
 		}
 		if !bytes.Equal(current, data) {
-			fatal(fmt.Errorf("%s is stale; run go generate ./internal/state", *outPath))
+			fmt.Fprintf(stderr, "%s is stale; run go generate ./internal/state\n", *outPath)
+			return 1
 		}
-		return
+		return 0
 	}
 	if err := os.WriteFile(*outPath, data, 0o644); err != nil {
-		fatal(err)
+		fmt.Fprintln(stderr, err)
+		return 1
 	}
-}
-
-func fatal(err error) {
-	fmt.Fprintln(os.Stderr, err)
-	os.Exit(1)
+	return 0
 }

package/engine/internal/state/cmd/workflowmanifest/main_test.go

@@ -0,0 +1,96 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/devrites/devrites/internal/state"
+)
+
+func TestRunWritesDeterministicManifest(t *testing.T) {
+	dir := t.TempDir()
+	out := filepath.Join(dir, "workflow_manifest.json")
+
+	if code := run([]string{"--out", out}, os.Stderr); code != 0 {
+		t.Fatalf("run exit=%d", code)
+	}
+	first, err := os.ReadFile(out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var document struct {
+		GeneratedBy   string `json:"generatedBy"`
+		SchemaVersion int    `json:"schemaVersion"`
+		Phases        []struct {
+			ID              state.Phase `json:"id"`
+			TransitionRight string      `json:"transitionRight"`
+		} `json:"phases"`
+	}
+	if err := json.Unmarshal(first, &document); err != nil {
+		t.Fatalf("manifest is not valid JSON: %v", err)
+	}
+	if document.SchemaVersion != state.SchemaVersion {
+		t.Fatalf("schemaVersion=%d want %d", document.SchemaVersion, state.SchemaVersion)
+	}
+	if !strings.HasPrefix(document.GeneratedBy, "go generate ./internal/state") {
+		t.Fatalf("generatedBy %q", document.GeneratedBy)
+	}
+	if len(document.Phases) == 0 {
+		t.Fatal("manifest must list phases")
+	}
+
+	// Deterministic: a second run produces identical bytes.
+	if code := run([]string{"--out", out}, os.Stderr); code != 0 {
+		t.Fatalf("second run exit=%d", code)
+	}
+	second, err := os.ReadFile(out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(first, second) {
+		t.Fatal("manifest output is not deterministic")
+	}
+}
+
+func TestRunCheckPassesOnCurrentAndFailsOnStale(t *testing.T) {
+	dir := t.TempDir()
+	out := filepath.Join(dir, "workflow_manifest.json")
+
+	if code := run([]string{"--out", out}, os.Stderr); code != 0 {
+		t.Fatalf("generate exit=%d", code)
+	}
+	if code := run([]string{"--out", out, "--check"}, os.Stderr); code != 0 {
+		t.Fatalf("check on current manifest exit=%d", code)
+	}
+
+	if err := os.WriteFile(out, []byte("{\"stale\": true}\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	stderr := &strings.Builder{}
+	if code := run([]string{"--out", out, "--check"}, stderr); code != 1 {
+		t.Fatalf("check on stale manifest exit=%d want 1", code)
+	}
+	if !strings.Contains(stderr.String(), "is stale") {
+		t.Fatalf("stderr should name the stale manifest, got %q", stderr.String())
+	}
+}
+
+func TestRunCheckFailsOnMissingManifest(t *testing.T) {
+	dir := t.TempDir()
+	missing := filepath.Join(dir, "absent.json")
+	stderr := &strings.Builder{}
+	if code := run([]string{"--out", missing, "--check"}, stderr); code != 1 {
+		t.Fatalf("check on missing manifest exit=%d want 1", code)
+	}
+}
+
+func TestRunRejectsUnknownFlags(t *testing.T) {
+	stderr := &strings.Builder{}
+	if code := run([]string{"--bogus"}, stderr); code != 2 {
+		t.Fatalf("unknown flag exit=%d want 2", code)
+	}
+}

package/engine/internal/state/cursor.go

@@ -20,6 +20,7 @@ const (
 	CursorAFKSlicesRemaining = "afk_slices_remaining"
 	CursorReturnPhase        = "return_phase"
 	CursorReturnNextAction   = "return_next_action"
+	CursorSchema             = "schema"
 )
 
 var cursorKeyAliases = map[string]string{
@@ -73,13 +74,26 @@ func CursorField(lines []string, key string) (string, bool) {
 }
 
 // SetCursorField replaces an existing state.md field without changing whether
-// the file uses the canonical table or legacy bullet form.
+// the file uses the canonical table or legacy bullet form. A value carrying a
+// raw pipe is declined (false) for table rows, and a value carrying a line
+// break is declined everywhere: neither is representable in a cell. A write
+// the reader cannot read back is declined too.
 func SetCursorField(lines []string, key, value string) ([]string, bool) {
+	if strings.ContainsAny(value, "\r\n") {
+		return append([]string(nil), lines...), false
+	}
 	structural, ok := structuralCursorLines(lines)
 	if !ok {
 		return append([]string(nil), lines...), false
 	}
-	return setCursorField(lines, structural, key, value)
+	out, ok := setCursorField(lines, structural, key, value)
+	if !ok {
+		return out, false
+	}
+	if !cursorReadable(out, key, value) {
+		return append([]string(nil), lines...), false
+	}
+	return out, true
 }
 
 func setCursorField(lines, structural []string, key, value string) ([]string, bool) {
@@ -93,6 +107,9 @@ func setCursorField(lines, structural []string, key, value string) ([]string, bo
 		original := out[i]
 		switch kind {
 		case cursorLineTable:
+			if strings.Contains(value, "|") {
+				return out, false
+			}
 			indent := original[:len(original)-len(strings.TrimLeft(original, " \t"))]
 			out[i] = indent + "| " + strings.TrimSpace(gotKey) + " | " + value + " |"
 		case cursorLineLegacy:
@@ -105,16 +122,41 @@ func setCursorField(lines, structural []string, key, value string) ([]string, bo
 }
 
 // UpsertCursorField replaces key when present or inserts it into the canonical
-// cursor table (falling back to a legacy bullet when no table exists).
+// cursor table (falling back to a legacy bullet when no table exists). A value
+// carrying a raw pipe keeps the legacy bullet form — a cell cannot represent
+// it — and a value carrying a line break is declined with the input returned
+// unchanged. Every write is verified readable before it is returned; an
+// unreadable write (for example, appending after an unclosed fence) leaves the
+// document unchanged.
 func UpsertCursorField(lines []string, key, value string) []string {
+	if strings.ContainsAny(value, "\r\n") {
+		return append([]string(nil), lines...)
+	}
 	structural, ok := structuralCursorLines(lines)
 	if !ok {
 		return append([]string(nil), lines...)
 	}
-	if out, ok := setCursorField(lines, structural, key, value); ok {
-		return out
+	var candidate []string
+	if strings.Contains(value, "|") {
+		candidate = append(DeleteCursorField(lines, key), "- "+key+": "+value)
+	} else if out, ok := setCursorField(lines, structural, key, value); ok {
+		candidate = out
+	} else if lastTable := lastCursorTableRow(structural); lastTable >= 0 {
+		candidate = append(append([]string(nil), lines...), "")
+		copy(candidate[lastTable+2:], candidate[lastTable+1:])
+		candidate[lastTable+1] = "| " + key + " | " + value + " |"
+	} else {
+		candidate = append(append([]string(nil), lines...), "- "+key+": "+value)
 	}
-	out := append([]string(nil), lines...)
+	if cursorReadable(candidate, key, value) {
+		return candidate
+	}
+	return append([]string(nil), lines...)
+}
+
+// lastCursorTableRow returns the index of the final table row inside the
+// Cursor section, or -1 when no table exists.
+func lastCursorTableRow(structural []string) int {
 	lastTable := -1
 	inCursor := false
 	for i, line := range structural {
@@ -139,14 +181,14 @@ func UpsertCursorField(lines []string, key, value string) []string {
 			}
 		}
 	}
-	if lastTable >= 0 {
-		insert := "| " + key + " | " + value + " |"
-		out = append(out, "")
-		copy(out[lastTable+2:], out[lastTable+1:])
-		out[lastTable+1] = insert
-		return out
-	}
-	return append(out, "- "+key+": "+value)
+	return lastTable
+}
+
+// cursorReadable reports whether key reads back as value from a candidate
+// document — the write side of parseCursorLine's cell normalization.
+func cursorReadable(lines []string, key, value string) bool {
+	got, ok := CursorField(lines, key)
+	return ok && got == strings.TrimSpace(value)
 }
 
 // DeleteCursorField removes every presentation of key from canonical or legacy
@@ -168,6 +210,79 @@ func DeleteCursorField(lines []string, key string) []string {
 	return out
 }
 
+// CursorForm reports the presentation of the state.md cursor: "table" when a
+// canonical table row exists, "legacy" when only bullet fields exist, and
+// "none" when neither is present.
+func CursorForm(lines []string) string {
+	form := "none"
+	for _, line := range lines {
+		_, _, kind, ok := parseCursorLine(line)
+		if !ok {
+			continue
+		}
+		if kind == cursorLineTable {
+			return "table"
+		}
+		if form == "none" {
+			form = "legacy"
+		}
+	}
+	return form
+}
+
+// ConvertCursorToTable rewrites legacy bullet cursor fields into canonical
+// table rows in place. A bullet whose key resolves to a canonical cursor key
+// is a cursor field wherever it appears — the same rule CursorField uses to
+// read — so such a bullet is converted even inside prose sections. Prose
+// without a canonical cursor key is preserved, and a value carrying a raw pipe
+// keeps its bullet form because a table cell cannot represent it. It reports
+// whether any line changed.
+func ConvertCursorToTable(lines []string) ([]string, bool) {
+	changed := false
+	out := append([]string(nil), lines...)
+	for i, line := range out {
+		key, value, kind, ok := parseCursorLine(line)
+		if !ok || kind != cursorLineLegacy {
+			continue
+		}
+		if !isMigratableCursorKey(key) {
+			continue
+		}
+		if strings.Contains(value, "|") {
+			continue
+		}
+		spelling, ok := canonicalCursorSpelling(key)
+		if !ok {
+			continue
+		}
+		indent := line[:len(line)-len(strings.TrimLeft(line, " \t"))]
+		out[i] = indent + "| " + spelling + " | " + value + " |"
+		changed = true
+	}
+	return out, changed
+}
+
+func isMigratableCursorKey(key string) bool {
+	_, ok := canonicalCursorSpelling(key)
+	return ok
+}
+
+// canonicalCursorSpelling maps a cursor key (including aliases) to the
+// canonical table-row spelling. Matching is normalization-based, so
+// "Next step" resolves to the "next_action" spelling.
+func canonicalCursorSpelling(key string) (string, bool) {
+	normalized := normalizeCursorKey(key)
+	canonicals := []string{CursorPhase, CursorStatus, CursorNextAction, CursorQuestionID,
+		CursorActiveSlice, CursorAFKSlicesRemaining, CursorReturnPhase,
+		CursorReturnNextAction, CursorSchema}
+	for _, canonical := range canonicals {
+		if normalized == normalizeCursorKey(canonical) {
+			return canonical, true
+		}
+	}
+	return "", false
+}
+
 func structuralCursorLines(lines []string) ([]string, bool) {
 	if len(lines) == 0 {
 		return nil, true

package/engine/internal/state/cursor_fuzz_test.go

@@ -0,0 +1,80 @@
+package state
+
+import (
+	"bytes"
+	"slices"
+	"strings"
+	"testing"
+	"unicode/utf8"
+)
+
+var cursorFuzzKeys = []string{
+	CursorPhase, CursorStatus, CursorNextAction, CursorQuestionID,
+	CursorActiveSlice, CursorAFKSlicesRemaining, CursorReturnPhase,
+	CursorReturnNextAction, CursorSchema,
+}
+
+func FuzzCursorRoundTrip(f *testing.F) {
+	f.Add(uint8(0), "spec", []byte("# Feature\n\n## Cursor\n\n| phase | init |\n| --- | --- |\n| status | running |"))
+	f.Add(uint8(1), "", []byte("- phase: spec\n- status: running"))
+	f.Add(uint8(8), "5", []byte("## Cursor\n\n| phase | init |"))
+	f.Add(uint8(2), "a|b", []byte("| status | running |"))
+	f.Add(uint8(4), "two\nlines", []byte("| status | running |"))
+	f.Add(uint8(5), "value with spaces", []byte{})
+	f.Fuzz(func(t *testing.T, keyIndex uint8, value string, doc []byte) {
+		// Docs and values with NUL bytes or invalid UTF-8 are outside the
+		// format: the read and write paths refuse them, so round-trip says
+		// nothing there.
+		if !utf8.Valid(doc) || bytes.IndexByte(doc, 0) >= 0 ||
+			!utf8.ValidString(value) || strings.IndexByte(value, 0) >= 0 {
+			return
+		}
+		key := cursorFuzzKeys[int(keyIndex)%len(cursorFuzzKeys)]
+		lines := strings.Split(string(doc), "\n")
+		upserted := UpsertCursorField(lines, key, value)
+		if strings.ContainsAny(value, "\r\n") {
+			// Line breaks are representable in no form: the write must be
+			// declined with the document unchanged.
+			if !slices.Equal(upserted, lines) {
+				t.Fatal("newline value was not declined unchanged")
+			}
+			return
+		}
+		// The upsert contract: either the document is unchanged, or the value
+		// is readable from the result.
+		got, ok := CursorField(upserted, key)
+		if !slices.Equal(upserted, lines) && (!ok || got != strings.TrimSpace(value)) {
+			t.Fatalf("upsert changed the document but %q is not readable (got %q, ok %v)", value, got, ok)
+		}
+		deleted := DeleteCursorField(upserted, key)
+		if _, ok := CursorField(deleted, key); ok {
+			t.Fatalf("deleted key %q still readable", key)
+		}
+		replaced, ok := SetCursorField(upserted, key, value)
+		if ok {
+			got, ok := CursorField(replaced, key)
+			if !ok || got != strings.TrimSpace(value) {
+				t.Fatalf("set %q not readable (got %q, ok %v)", value, got, ok)
+			}
+		}
+	})
+}
+
+func FuzzCursorParsing(f *testing.F) {
+	f.Add([]byte("| phase | spec |"), "phase", "x")
+	f.Add([]byte("```\n| q | a |\n```"), "qid", "y")
+	f.Add([]byte("- nextstep: run"), "next_action", "z")
+	f.Add([]byte("## Cursor\n\n| a | b | extra |"), "", "")
+	f.Fuzz(func(t *testing.T, doc []byte, key, value string) {
+		if !utf8.Valid(doc) || bytes.IndexByte(doc, 0) >= 0 {
+			return
+		}
+		lines := strings.Split(string(doc), "\n")
+		_, _ = CursorField(lines, key)
+		_ = CursorForm(lines)
+		out, _ := SetCursorField(lines, key, value)
+		out = UpsertCursorField(out, key, value)
+		_ = DeleteCursorField(out, key)
+		_, _ = ConvertCursorToTable(lines)
+	})
+}

package/engine/internal/state/lock_unix.go

@@ -14,6 +14,7 @@ import (
 type fileLock struct{ f *os.File }
 
 func acquireLock(path string) (*fileLock, error) {
+	// #nosec G304 -- feature lock file inside the workspace .devrites tree
 	f, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o644)
 	if err != nil {
 		return nil, fmt.Errorf("acquire lock: %w", err)

package/engine/internal/state/observation.go

@@ -253,8 +253,8 @@ func observeWorkspace(root, slug string, callback observationCallback) (*Workspa
 	if err != nil {
 		return nil, ObservationWorkspaceInvalid
 	}
-	defer roots.devrites.Close()
-	defer roots.workspace.Close()
+	defer func() { _ = roots.devrites.Close() }()
+	defer func() { _ = roots.workspace.Close() }()
 
 	inventory := observationInventory()
 	facts := make([]ArtifactFact, 0, len(inventory))
@@ -456,7 +456,7 @@ func observeArtifact(location artifactLocation, callback observationCallback) (A
 	if err != nil {
 		return artifactFailureResult(location.path, snapshot, artifactUnchanged(location, snapshot), err)
 	}
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 
 	openedInfo, err := file.Stat()
 	if err != nil {

package/engine/internal/state/observation_test.go

@@ -336,7 +336,7 @@ func TestWorkspaceObservationSymlinkClassifiesParent(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer root.Close()
+	defer func() { _ = root.Close() }()
 
 	fact, _, err := observeArtifact(artifactLocation{
 		path: ArtifactPath("spec.md"),

package/engine/internal/state/schema.go

@@ -2,8 +2,9 @@ package state
 
 //go:generate go run ./cmd/workflowmanifest -out workflow_manifest.json
 
-// SchemaVersion versions the persisted workflow/state manifest.
-const SchemaVersion = 2
+// SchemaVersion versions the persisted workflow/state manifest and the
+// workspace contract the engine accepts.
+const SchemaVersion = 3
 
 const EvidenceFile = "evidence.md"
 

package/engine/internal/state/state_test.go

@@ -703,7 +703,7 @@ func TestStatusRejectsCorruptStateMarkdownWithoutContentDisclosure(t *testing.T)
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(dir, "state.md"), []byte("| phase | build |\x00\n"), 0o644); err != nil {
+	if err := os.WriteFile(filepath.Join(dir, "state.md"), []byte("| phase | build |\x00\n| schema | 3 |\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	want := `compute status: feature "corrupt": state.md is malformed (malformed_markdown); repair state.md and retry`
@@ -720,7 +720,7 @@ func TestOnlyCanonicalWorkLayoutIsDiscovered(t *testing.T) {
 	if err := os.MkdirAll(legacy, 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(legacy, "state.md"), []byte("- Phase: spec\n"), 0o644); err != nil {
+	if err := os.WriteFile(filepath.Join(legacy, "state.md"), []byte("- Phase: spec\n- Schema: 3\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := Status(root, "alias"); err == nil {

package/engine/internal/state/taskgraph_fuzz_test.go

@@ -0,0 +1,38 @@
+package state
+
+import "testing"
+
+func FuzzTaskGraphParsing(f *testing.F) {
+	f.Add([]byte("## SLICE-1\n\nDependencies: none\n"))
+	f.Add([]byte("## SLICE-1\nDependencies: [SLICE-2]\n\n## SLICE-2\nDependencies: [SLICE-1]\n"))
+	f.Add([]byte("## SLICE-1\nDependencies: none\ndepends_on: SLICE-9\n"))
+	f.Add([]byte("## SLICE-1\n## SLICE-1\nDependencies: none\n"))
+	f.Add([]byte("## SLICE-1\nDependencies: [oops, SLICE-2]\n\n## SLICE-2\ndepends_on: [SLICE-1]\n"))
+	f.Add([]byte("## SLICE-42\nDependencies:\n"))
+	f.Add([]byte(""))
+	f.Fuzz(func(t *testing.T, doc []byte) {
+		result := ParseTaskGraph(doc)
+
+		known := make(map[string]bool, len(result.Slices))
+		for _, slice := range result.Slices {
+			if !sliceIDValidRE.MatchString(slice.ID) {
+				t.Fatalf("slice id %q does not satisfy the id grammar", slice.ID)
+			}
+			if known[slice.ID] {
+				t.Fatalf("slice id %q emitted twice", slice.ID)
+			}
+			known[slice.ID] = true
+		}
+		unknown := make(map[string]bool, len(result.Unknown))
+		for _, dep := range result.Unknown {
+			unknown[dep] = true
+		}
+		for _, slice := range result.Slices {
+			for _, dep := range slice.Dependencies {
+				if !known[dep] && !unknown[dep] {
+					t.Fatalf("slice %s depends on %q which is neither defined nor reported unknown", slice.ID, dep)
+				}
+			}
+		}
+	})
+}

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/114b28f68c1fa4db

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\x00')
+string("0")
+[]byte("```")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/378a0f2218e812ea

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\x10')
+string("\r|")
+[]byte("0")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/39eaa26fcb481e3c

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\x05')
+string("\xe4")
+[]byte("")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/776ca1dc0143acf0

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\b')
+string(" ")
+[]byte("0")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/9295930c1ebb81df

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('ñ')
+string("|")
+[]byte("```")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/a60de309dc33be0d

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\b')
+string("\n")
+[]byte("0")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/f04dc7b06ef7c99f

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\x12')
+string("\x00")
+[]byte("0")

package/engine/internal/state/testdata/fuzz/FuzzCursorRoundTrip/f3000ac510878bd6

@@ -0,0 +1,4 @@
+go test fuzz v1
+byte('\x05')
+string("0")
+[]byte("\x8e")

package/engine/internal/state/testdata/fuzz/FuzzWorkspaceSchemaRow/a75aabb9f2a847d5

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("sChemA:1")

package/engine/internal/state/workflow_manifest.json

@@ -1,6 +1,6 @@
 {
   "generatedBy": "go generate ./internal/state; DO NOT EDIT",
-  "schemaVersion": 2,
+  "schemaVersion": 3,
   "authorityPolicy": {
     "principlesTrust": "Project principles may become project policy only after explicit provenance and validation; arbitrary project-local Markdown is never inherently trusted executable instruction.",
     "trackedState": [