unitbob 0.4.3 → 0.4.5

package/README.md

@@ -30,7 +30,7 @@ claude plugin install unitbob@unitbob
 ```
 codex plugin marketplace add sergeygershun/unitbob-connector
 codex plugin add unitbob@unitbob
-npx -y unitbob@0.4.3 codex-install
+npx -y unitbob@0.4.4 codex-install
 ```
 
 Start a new Claude Code or Codex thread so the installed skill and named agents

package/dist/cli.js

@@ -133,8 +133,10 @@ export async function main(argv, deps = { ensureLinked }) {
                 await contractPrompt(await linked(), args);
                 return 0;
             case 'run-local':
-                await runLocal(await linked(), args);
-                return 0;
+                // The one verb whose non-zero exit is not an error: a branch that failed
+                // the same set of cases twice in a row (spec 34-6, criterion 3). Red
+                // tests still exit zero — a live defect is the suite working.
+                return await runLocal(await linked(), args);
             case 'run':
             case 'check':
                 await run(await linked(), args);

package/dist/files/suiteBuild.js

@@ -2,7 +2,6 @@ import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from
 import { createHash } from 'node:crypto';
 import { dirname, join, sep } from 'node:path';
 import { assertUnitbobPath } from "./artifactPath.js";
-import { readBudget, RUN_BUDGET } from "./budget.js";
 import { readWorkerPlan, validateWorkerPlanFiles, workerPlanDigest, workerPlanPath } from "./workerPlan.js";
 export function requestPath(projectRoot) {
     return join(projectRoot, '.unitbob', 'suite-build', 'request.json');
@@ -232,7 +231,6 @@ export function writeSuiteBuildRequest(projectRoot, branches, knownDefectContext
         output_path: outputPath(projectRoot),
         branches,
         known_defect_context: knownDefectContext,
-        budget: RUN_BUDGET,
     };
     const path = requestPath(projectRoot);
     mkdirSync(dirname(path), { recursive: true });
@@ -251,10 +249,13 @@ export function readSuiteBuildRequest(projectRoot) {
         !Array.isArray(request.branches)) {
         throw new Error(`${path} is malformed: expected project_root, output_path, and a branches array.`);
     }
+    // Spec 34-6, criterion 2.3. A request written by an older connector still
+    // carries a `budget` block; it is spread through untouched and read by nobody,
+    // which is the whole of the compatibility story — there is no ceiling left for
+    // it to name.
     return {
         ...request,
         known_defect_context: readKnownDefectContext(request.known_defect_context, path),
-        budget: readBudget(request.budget),
     };
 }
 function readKnownDefectContext(value, path) {

package/dist/files/workerPlan.js

@@ -54,8 +54,6 @@ export function validateWorkerPlanFiles(projectRoot) {
         branch.suite_kind,
         assignmentIds(branch.assignment),
     ]));
-    const budget = request.budget;
-    const workerCeiling = typeof budget?.workers === 'number' ? budget.workers : Number.POSITIVE_INFINITY;
     const seenWorkers = new Set();
     const seenPaths = new Map();
     for (const [index, item] of plan.workers.entries()) {
@@ -97,9 +95,6 @@ export function validateWorkerPlanFiles(projectRoot) {
         if (!item?.limits || item.limits.planned_cases !== item.planned_cases?.length) {
             errors.push(`${label}: limits.planned_cases must equal planned_cases.length`);
         }
-        if (!Number.isInteger(item?.limits?.fact_finder_lookups) || item.limits.fact_finder_lookups < 0 || item.limits.fact_finder_lookups > 8) {
-            errors.push(`${label}: limits.fact_finder_lookups must be an integer from 0 to 8`);
-        }
         for (const ownedPath of Array.isArray(item?.owned_paths) ? item.owned_paths : []) {
             if (!isNonEmptyString(ownedPath)) {
                 errors.push(`${label}: owned path must be a non-empty string`);
@@ -118,27 +113,29 @@ export function validateWorkerPlanFiles(projectRoot) {
                 seenPaths.set(ownedPath, label);
         }
     }
+    // Spec 34-6, criterion 1.6. What is left here catches a corrupted plan, never
+    // a small one. The gate used to also demand that every assigned capability
+    // appear — which made the plan's size a copy of the assignment's size, and the
+    // assignment is the whole product map. That is the load one worker could not
+    // finish on a2time, 2026-08-10. Scope is chosen by the coordinator with the
+    // user (workflow step 3), and the plan is the only record of it, so a plan
+    // that covers part of the assignment is now an ordinary plan.
+    //
+    // The neighbours stay for the opposite reason: naming a capability the request
+    // never assigned, or naming one twice, are ways a plan is wrong rather than
+    // ways it is narrow. So is an empty plan for a branch that was given work.
     for (const [branch, expected] of expectedByBranch) {
         const items = plan.workers.filter((item) => item && typeof item === 'object' && !Array.isArray(item) && item.branch === branch);
         if (expected.length > 0 && items.length === 0)
             errors.push(`${branch}: no worker slice was planned`);
-        if (items.length > Math.min(workerCeiling, expected.length)) {
-            errors.push(`${branch}: worker count ${items.length} exceeds min(budget.workers, capability count)`);
-        }
         const assigned = items.flatMap((item) => Array.isArray(item.capability_ids) ? item.capability_ids : []);
         for (const id of expected) {
-            const count = assigned.filter((candidate) => candidate === id).length;
-            if (count === 0)
-                errors.push(`${branch}: assigned capability ${id} is missing from the plan`);
-            if (count > 1)
+            if (assigned.filter((candidate) => candidate === id).length > 1) {
                 errors.push(`${branch}: assigned capability ${id} appears more than once`);
+            }
         }
         for (const id of assigned.filter((id) => !expected.includes(id)))
             errors.push(`${branch}: capability ${id} was not assigned by the request`);
-        const sizes = items.map((item) => Array.isArray(item.planned_cases) ? item.planned_cases.length : 0).filter((size) => size > 0);
-        if (sizes.length > 1 && Math.max(...sizes) / Math.min(...sizes) > 1.5) {
-            errors.push(`${branch}: planned case slice ratio exceeds 1.5`);
-        }
     }
     return errors;
 }

package/dist/proc.js

@@ -115,6 +115,21 @@ export const GRAPH_NOISE_PATTERNS = [
     // Type declarations — a contract for a compiler, with no runtime behaviour.
     '*.d.ts',
     '*.pyi',
+    // Spec 34-6, criterion 6. Unitbob's own session reports, left in the repo root
+    // by the operator, are read as source: on a2time, 2026-08-10, two of them
+    // contributed 44 and 25 nodes and pushed their community to third-largest in
+    // the whole project. The more often you run unitbob, the dirtier its map gets —
+    // a feedback loop with no floor.
+    '/unitbob*.md',
+    // Test scaffolding and boot wiring. Factories and model specs describe the
+    // fixtures a suite builds, not a business promise a guardrail could protect;
+    // `config/initializers/` and `config/deploy/` run once at boot and at deploy.
+    // The project's own request and feature specs stay — they are evidence of what
+    // the app promises.
+    'spec/factories/',
+    'spec/models/',
+    'config/deploy/',
+    'config/initializers/',
 ];
 export function ensureUnitbobIgnored(projectRoot) {
     // `.graphifyignore` is unitbob's own bookkeeping, like the other two entries —

package/dist/runner/failureDigest.js

@@ -0,0 +1,238 @@
+import { createHash } from 'node:crypto';
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+export const RUN_STATE_FILE = 'run-state.json';
+// A marker embedded in a reported test name or Gherkin tag. Same shape the
+// server joins on (`CaseMarker::EMBEDDED`): a full 12-hex marker, never a prefix
+// of a longer hex run. A case with no marker still counts as a failure — it is
+// identified by its file and message alone.
+const MARKER = /ubc_[0-9a-f]{12}(?![0-9a-f])/;
+// The failures a report describes, canonically ordered, or `null` when the
+// report cannot be read as one. `null` is not "green": a runner that died before
+// the first test produces no set at all, and comparing against nothing would
+// stop a branch over a harness problem the loop never even reached.
+export function failureSet(runner, report) {
+    if (!report.trim())
+        return null;
+    const found = extract(runner, report);
+    return found && canonical(found);
+}
+// One hash for one set. Same set, same hash, on any machine and in any order.
+export function digestOf(failures) {
+    return createHash('sha256').update(JSON.stringify(failures)).digest('hex');
+}
+export function runStatePath(projectRoot) {
+    return join(projectRoot, '.unitbob', 'suite-build', RUN_STATE_FILE);
+}
+// A damaged, hand-edited or absent file reads as "no previous run". Refusing to
+// run over a bookkeeping file would turn the one soft stop in the loop into the
+// hardest thing in it — and this file is written by a process that repair
+// deliberately kills and restarts.
+export function readRunState(projectRoot) {
+    try {
+        const parsed = JSON.parse(readFileSync(runStatePath(projectRoot), 'utf8'));
+        const branches = parsed?.branches;
+        if (!branches || typeof branches !== 'object' || Array.isArray(branches))
+            return {};
+        return Object.fromEntries(Object.entries(branches).filter(([, value]) => typeof value === 'string'));
+    }
+    catch {
+        return {};
+    }
+}
+// `undefined` forgets this branch: a run that produced no comparable set leaves
+// the next one to be a first run again.
+export function rememberFailures(projectRoot, branch, digest) {
+    const branches = readRunState(projectRoot);
+    if (digest === undefined)
+        delete branches[branch];
+    else
+        branches[branch] = digest;
+    const path = runStatePath(projectRoot);
+    mkdirSync(dirname(path), { recursive: true });
+    // Written whole and moved into place. A plain write that is interrupted leaves
+    // truncated JSON, which reads back as "no previous run" — exactly at the
+    // moment a run is being killed and restarted, which is the loop this bounds.
+    const staging = `${path}.tmp`;
+    writeFileSync(staging, `${JSON.stringify({ branches }, null, 2)}\n`);
+    renameSync(staging, path);
+}
+export function clearRunState(projectRoot) {
+    rmSync(runStatePath(projectRoot), { force: true });
+}
+function canonical(failures) {
+    const byKey = new Map(failures.map((failure) => [keyOf(failure), failure]));
+    return [...byKey.keys()].sort().map((key) => byKey.get(key));
+}
+function keyOf(failure) {
+    return `${failure.marker}\u0000${failure.file}\u0000${failure.message}`;
+}
+// The connector interprets a report in exactly one other place — `boundReport`,
+// which bounds it for transport — and this switch deliberately mirrors that
+// one's shape rather than inventing a second dispatch. Neither of them judges a
+// run — the server owns every verdict a report leads to. This one only asks "is
+// this the same wall we hit last time", and its answer reaches nothing but an
+// exit code.
+function extract(runner, report) {
+    switch (runner) {
+        case 'rspec':
+            return fromRspec(report);
+        case 'vitest':
+            return fromVitest(report);
+        case 'pytest':
+            return fromJunitXml(report);
+        case 'cucumber':
+        case 'cucumber-js':
+            return fromCucumberMessages(report);
+        case 'pytest-bdd':
+            return fromPytestBdd(report);
+        default:
+            return null;
+    }
+}
+function fromRspec(report) {
+    const data = parseObject(report);
+    if (!Array.isArray(data?.examples))
+        return null;
+    return rows(data.examples).flatMap((example) => {
+        if (example.status === 'passed')
+            return [];
+        const name = `${text(example.description)} ${text(example.full_description)}`;
+        const exception = example.exception;
+        return [failure(name, text(example.file_path), text(exception?.message))];
+    });
+}
+function fromVitest(report) {
+    const data = parseObject(report);
+    if (!Array.isArray(data?.testResults))
+        return null;
+    return rows(data.testResults).flatMap((file) => {
+        const assertions = Array.isArray(file.assertionResults) ? rows(file.assertionResults) : [];
+        return assertions.flatMap((assertion) => {
+            if (assertion.status === 'passed')
+                return [];
+            const messages = Array.isArray(assertion.failureMessages) ? assertion.failureMessages : [];
+            const name = `${text(assertion.title)} ${text(assertion.fullName)}`;
+            return [failure(name, text(file.name), messages.map((m) => text(m)).join('\n'))];
+        });
+    });
+}
+// pytest's JUnit XML, read the way `boundReport` already reads it: by pattern,
+// because a whole XML parser to answer one yes/no question is a dependency this
+// package does not need.
+//
+// `failure` and `error`, but not `skipped` — and this is the one place the set
+// deliberately does not match the server's "did not pass". A skip never moves:
+// it reports the same thing on every run forever, so counting it here would stop
+// a branch whose only permanent case is a skip, and it would do it while the
+// repair was still fixing everything else. A skip that should not be there is
+// caught at upload, where it costs a message rather than a branch.
+function fromJunitXml(report) {
+    if (!/<testsuites?\b/.test(report))
+        return null;
+    const cases = report.match(/<testcase\b[^>]*(?:\/>|>[\s\S]*?<\/testcase>)/g) ?? [];
+    return cases.flatMap((testcase) => {
+        const problem = testcase.match(/<(?:failure|error)\b[^>]*(?:\/>|>[\s\S]*?<\/(?:failure|error)>)/);
+        if (!problem)
+            return [];
+        const name = attribute(testcase, 'name');
+        const file = attribute(testcase, 'file') || attribute(testcase, 'classname');
+        return [failure(name, file, attribute(problem[0], 'message'))];
+    });
+}
+// Cucumber Messages (NDJSON), both the Ruby and the JS emitter. One scenario is
+// spread over several envelopes: the pickle holds its name, tags and file, the
+// testCase maps its steps, and testStepFinished carries each step's result.
+function fromCucumberMessages(report) {
+    const envelopes = [];
+    for (const line of report.split('\n')) {
+        if (!line.trim())
+            continue;
+        const parsed = parseObject(line);
+        if (!parsed)
+            return null;
+        envelopes.push(parsed);
+    }
+    if (envelopes.length === 0)
+        return null;
+    const pickles = indexBy(envelopes, 'pickle');
+    const testCases = indexBy(envelopes, 'testCase');
+    const results = new Map();
+    for (const envelope of envelopes) {
+        const finished = envelope.testStepFinished;
+        if (!finished)
+            continue;
+        const startedId = text(finished.testCaseStartedId);
+        const list = results.get(startedId) ?? [];
+        list.push(finished.testStepResult ?? {});
+        results.set(startedId, list);
+    }
+    return envelopes.flatMap((envelope) => {
+        const started = envelope.testCaseStarted;
+        if (!started)
+            return [];
+        const testCase = testCases.get(text(started.testCaseId)) ?? {};
+        const pickle = pickles.get(text(testCase.pickleId)) ?? {};
+        const steps = results.get(text(started.id)) ?? [];
+        const failed = steps.filter((step) => text(step.status) !== 'PASSED' && text(step.status) !== 'SKIPPED');
+        if (failed.length === 0)
+            return [];
+        const tags = Array.isArray(pickle.tags) ? pickle.tags : [];
+        const tagText = rows(tags).map((tag) => text(tag.name)).join(' ');
+        const message = failed.map((step) => text(step.message)).find((line) => line.trim()) ?? '';
+        return [failure(`${tagText} ${text(pickle.name)}`, text(pickle.uri), message)];
+    });
+}
+// The connector's own pytest-bdd report (`runner/pytestBddPlugin.ts`). It names
+// no file — the whole behavioral bundle is one run — so the scenario's marker
+// and message carry the identity alone.
+function fromPytestBdd(report) {
+    const data = parseObject(report);
+    if (!Array.isArray(data?.scenarios))
+        return null;
+    return rows(data.scenarios).flatMap((scenario) => {
+        if (text(scenario.status) === 'passed')
+            return [];
+        const tags = Array.isArray(scenario.tags) ? scenario.tags.map((tag) => text(tag)).join(' ') : '';
+        return [failure(`${tags} ${text(scenario.name)}`, '', text(scenario.failure))];
+    });
+}
+// Only the first line of a message. Later lines are backtraces and diffs, which
+// carry object ids and absolute paths that differ between two runs of the same
+// unchanged failure — the very drift that would make this comparison useless.
+function failure(name, file, message) {
+    return {
+        marker: name.match(MARKER)?.[0] ?? '',
+        file,
+        message: message.split('\n')[0]?.trim() ?? '',
+    };
+}
+function indexBy(envelopes, key) {
+    const found = new Map();
+    for (const envelope of envelopes) {
+        const item = envelope[key];
+        if (item)
+            found.set(text(item.id), item);
+    }
+    return found;
+}
+function attribute(tag, name) {
+    return tag.match(new RegExp(`\\b${name}="([^"]*)"`))?.[1] ?? '';
+}
+function rows(values) {
+    return values.filter((value) => value !== null && typeof value === 'object' && !Array.isArray(value));
+}
+function text(value) {
+    return typeof value === 'string' ? value : '';
+}
+function parseObject(source) {
+    try {
+        const parsed = JSON.parse(source);
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/runner/worldProbe.js

@@ -28,13 +28,14 @@ export async function probeBehavioralWorld(projectRoot, deps = {
             env: {
                 ...process.env,
                 RAILS_ENV: 'test',
+                CUCUMBER_PUBLISH_QUIET: 'true',
                 UNITBOB_REPO_ROOT: projectRoot,
                 BUNDLE_GEMFILE: join(projectRoot, '.unitbob', 'behavioral', 'Gemfile'),
             },
         });
         if (result.code === 0)
             return { status: 'ok' };
-        const detail = [result.stderr, result.stdout].find((text) => text.trim())?.trim() ?? `exit ${result.code}`;
+        const detail = [result.stdout, result.stderr].map((text) => text.trim()).filter(Boolean).join('\n') || `exit ${result.code}`;
         return { status: 'fixable', message: `The connector-owned Ruby/Cucumber World probe failed: ${detail}` };
     }
     catch (error) {
@@ -58,6 +59,14 @@ PROBE_OTHER_TIME_ZONE = PROBE_TIME_ZONE&.name == 'UTC' ? 'Hawaii' : 'UTC'
 PROBE_LOCALE = I18n.locale
 PROBE_RECEIVER = Object.new
 
+# The probe runs in a dedicated process, so replacing its in-memory route set
+# cannot affect the host application after the process exits. Keeping these
+# endpoints here makes the profile check independent of routes the host owns.
+Rails.application.routes.draw do
+  match '/__unitbob_world_probe__', to: proc { [200, { 'Content-Type' => 'text/plain' }, ['ok']] }, via: :all
+  match '/__unitbob_world_probe_redirect__', to: redirect('/__unitbob_world_probe_target__'), via: :all
+end
+
 Given('the first World probe scenario mutates supported state') do
   @unitbob_connection.execute("INSERT INTO schema_migrations (version) VALUES ('#{PROBE_VERSION}')")
   Time.zone = PROBE_OTHER_TIME_ZONE

package/dist/verbs/runLocal.js

@@ -1,5 +1,5 @@
 import { branchRunner, readHostSuiteOutputsPerBranch, readSuiteBuildRequest, } from "../files/suiteBuild.js";
-import { spend } from "../files/budget.js";
+import { digestOf, failureSet, readRunState, rememberFailures } from "../runner/failureDigest.js";
 import { validateStack } from "../runner/precheck.js";
 import { runBddSuite } from "../runner/bdd.js";
 import { runStructuralByRunner } from "./run.js";
@@ -15,6 +15,8 @@ export async function runLocal(config, args = [], deps) {
     const request = readSuiteBuildRequest(config.projectRoot);
     const { outputs, unreadable } = readHostSuiteOutputsPerBranch(request.output_path, request);
     const wanted = selectBranches(request, args);
+    const previous = readRunState(config.projectRoot);
+    let stuck = false;
     for (const suiteKind of wanted) {
         d.stdout.write(`\n── ${suiteKind} ──\n`);
         // An entry that exists but will not parse is a different problem from an
@@ -27,16 +29,47 @@ export async function runLocal(config, args = [], deps) {
             continue;
         }
         const ran = await runOneBranch(config, d, suiteKind, outputs.find((entry) => entry.suite_kind === suiteKind));
-        // Only a run that happened spends a repair round. A branch with no entry
-        // written yet, or one the stack cannot execute, produced nothing to repair
-        // against — charging it would exhaust the budget on rounds that never
-        // examined the suite.
+        // A branch with no entry written yet, or one the stack cannot execute,
+        // produced nothing to compare: it is the ordinary state halfway through a
+        // build, not a repair loop going nowhere.
         if (!ran)
             continue;
-        // Kept as compatibility diagnostics only. The bounded repair role owns the
-        // mechanical ceiling; this counter never stops execution or classifies reds.
-        spend(config.projectRoot, `run-local:${suiteKind}`);
+        if (compareFailures(config, d, suiteKind, ran, previous[suiteKind]))
+            stuck = true;
     }
+    return stuck ? 1 : 0;
+}
+// Spec 34-6, criterion 3. The whole stop condition, and it stops the branch
+// rather than the worker: the set of failures belongs to the branch, and a
+// repair worker looking only at its own slice cannot see that the branch as a
+// whole has stopped moving.
+//
+// Returns true when this branch is the one that has stopped moving.
+function compareFailures(config, d, suiteKind, ran, before) {
+    const failures = failureSet(ran.runner, ran.result.report);
+    // No comparable set: the run produced no readable report, which is a harness
+    // problem the loop never reached. Forget the branch so the next run that does
+    // produce one is a first run again, rather than a match against a set from
+    // before the harness broke.
+    if (!failures) {
+        rememberFailures(config.projectRoot, suiteKind, undefined);
+        return false;
+    }
+    // Green. Nothing to be stuck on, and remembering an empty set would stop a
+    // branch that passes twice in a row.
+    if (failures.length === 0) {
+        rememberFailures(config.projectRoot, suiteKind, undefined);
+        return false;
+    }
+    const digest = digestOf(failures);
+    rememberFailures(config.projectRoot, suiteKind, digest);
+    if (digest !== before)
+        return false;
+    d.stdout.write(`\nStopping ${suiteKind}: it just failed the same ${failures.length} case(s) as the previous run, ` +
+        'down to the first line of every message. The edits since then changed nothing this run can see.\n' +
+        'Look at the failures yourself, replan the slice, or record the branch as a build_error. ' +
+        'Running it again unchanged prints this same line.\n');
+    return true;
 }
 // Which branches to run. No argument runs every branch the request asked for —
 // the same "one suite, one run" shape both recipes insist on, so the default
@@ -53,19 +86,20 @@ function selectBranches(request, args) {
     }
     return named;
 }
-// True when the runner actually executed the branch — which is what a repair
-// round is, and the only thing the caller charges the budget for.
+// Non-null when the runner actually executed the branch. Everything else — no
+// entry, a declared `build_error`, a stack that cannot run it — is a branch that
+// produced no result to compare against.
 async function runOneBranch(config, d, suiteKind, output) {
     // Nothing written for this branch yet. That is the ordinary state halfway
     // through a build, not an error — say what is missing and move to the peer.
     if (!output) {
         d.stdout.write(`Nothing to run: your answer has no entry for this branch yet. Write its suite under ` +
             `${branchRoot(config, suiteKind)} and add its entry to the answer, then run this again.\n`);
-        return false;
+        return null;
     }
     if (output.build_error) {
         d.stdout.write(`Not built, by your own answer: ${output.build_error.message}\n`);
-        return false;
+        return null;
     }
     let runner;
     let suitePath;
@@ -75,12 +109,12 @@ async function runOneBranch(config, d, suiteKind, output) {
     }
     catch (err) {
         d.stdout.write(`Cannot run this branch: ${err.message}\n`);
-        return false;
+        return null;
     }
     const check = d.validateStack(config.projectRoot, runner);
     if (!check.ok) {
         d.stdout.write(`Cannot run this branch: ${check.message ?? `this project does not match "${runner}".`}\n`);
-        return false;
+        return null;
     }
     let result;
     try {
@@ -91,10 +125,10 @@ async function runOneBranch(config, d, suiteKind, output) {
     }
     catch (err) {
         d.stdout.write(`The runner could not start: ${err.message}\n`);
-        return false;
+        return null;
     }
     d.stdout.write(report(result));
-    return true;
+    return { runner, result };
 }
 // The command first, and always — including on a green run. It is the answer to
 // "how do I run just this one file again", which is the question the whole

package/dist/verbs/suitePrepare.js

@@ -1,4 +1,4 @@
-import { clearSpending } from "../files/budget.js";
+import { clearRunState } from "../runner/failureDigest.js";
 import { materializeHelper } from "../files/guardrails.js";
 import { materializeBehavioralWorld } from "../files/behavioral.js";
 import { recipeNameFor, writeSuiteBuildRequest, } from "../files/suiteBuild.js";
@@ -153,13 +153,11 @@ export async function suitePrepare(config, args = [], deps) {
         throw new Error(`No suite branch can be built this run:\n${blockedNotices.join('\n')}\nNothing was written and nothing was uploaded.`);
     }
     const request = writeSuiteBuildRequest(config.projectRoot, branches, defectContext);
-    // A new request is a new build, and a new build starts on the whole budget
-    // (spec 34-2). Said out loud, because re-running this verb is a documented
-    // step of the loop — the fixable-runner path below ends by asking for it — so
-    // a reset that happened silently would be a ceiling that quietly is not one.
-    if (clearSpending(config.projectRoot)) {
-        actual.stdout.write('Starting a fresh build: the review and run counts from the previous one are cleared.\n');
-    }
+    // A new request is a new build, and a new build has no previous run to be
+    // stuck against (spec 34-6, criterion 3). Re-running this verb is a documented
+    // step of the loop, so a failure set remembered from the build before it would
+    // stop a branch that has not run once yet.
+    clearRunState(config.projectRoot);
     const kinds = branches.map((branch) => branch.suite_kind).join(' and ');
     const nextCommand = branches.some((branch) => branch.suite_kind === 'behavioral')
         ? '`unitbob suite-review-prepare` before upload'
@@ -173,7 +171,7 @@ export async function suitePrepare(config, args = [], deps) {
     // A fixable runner blocker is not a failure: the structural suite still builds this run. Tell the
     // vibecoder the one command that unblocks the behavioral peer, then re-run suite-prepare.
     if (fixableNotices.length > 0) {
-        actual.stdout.write('\nBehavioral suite skipped this run — its BDD runner is not installed yet. ' +
+        actual.stdout.write('\nBehavioral suite skipped this run — its runner or connector-owned World profile is not ready. ' +
             'This is a fixable setup step, not a build failure, and it does not affect the structural suite:\n' +
             fixableNotices.join('\n') +
             '\nFix the above, then re-run `unitbob suite-prepare` to build the behavioral peer.\n');

package/dist/verbs/suiteReviewPrepare.js

@@ -6,7 +6,6 @@ import { copyBehavioralRunnerEnvironment, filesLostOnMaterialize, materializeBeh
 import { runBddSuite } from "../runner/bdd.js";
 import { boundReport } from "../runner/boundReport.js";
 import { branchRunner, readHostSuiteOutputs, readSuiteBuildRequest, reviewRequestPath, writeBehavioralReviewRequest, } from "../files/suiteBuild.js";
-import { spend } from "../files/budget.js";
 export async function suiteReviewPrepare(config, _args = [], deps) {
     const actual = {
         runCandidate: runCandidate,
@@ -38,27 +37,6 @@ export async function suiteReviewPrepare(config, _args = [], deps) {
     const request = writeBehavioralReviewRequest(config.projectRoot, behavioral, candidateRun, buildRequest.known_defect_context, fixedCandidateRun);
     actual.stdout.write(`Behavioral review request written to ${reviewRequestPath(config.projectRoot)}\n`);
     actual.stdout.write(`Next: have an independent reviewer inspect this exact candidate and write bdd_quality_review and known_defect_probe to ${request.output_path}, then run \`unitbob put-suite-build\`.\n`);
-    // Counted after the request is written, never before it. Refusing the round
-    // would rebuild the autobrella deadlock on a different number: the branch
-    // could not publish, so the work would be lost again for the sake of the
-    // ceiling meant to protect it. What the ceiling buys is a sentence.
-    const round = spend(config.projectRoot, 'review_rounds');
-    const budget = buildRequest.budget;
-    if (budget && round > budget.review_rounds) {
-        actual.stdout.write(lastRoundNotice(round, budget.review_rounds));
-    }
-}
-// Says what to do, not that something is forbidden. This is only sayable because
-// spec 34-2 already made an imperfect suite publishable: before it, "publish what
-// you have" was not available to the reviewer at all, and the only way to record
-// a bad Scenario was to take the branch down.
-function lastRoundNotice(round, allowed) {
-    return (`\nThis is review round ${round}; the budget for this build was ${allowed}. Treat it as the last round ` +
-        'and publish what you have.\n' +
-        'A Scenario the reviewer still objects to does not hold the branch back: it is recorded with ' +
-        '`verdict: "does_not_pass"` and a `reviewer_objection_text` saying what is wrong, the branch publishes, ' +
-        'and the objection is read afterwards by the operator. Another round of rewriting buys less than ' +
-        'publishing the objection does.\n');
 }
 async function runCandidate(projectRoot, output, revision) {
     if (revision)

package/dist/verbs/validateBuild.js

@@ -227,10 +227,16 @@ function checkSurfaceCoverage(row, id, expected, suiteText, add) {
     // Spec 34-3, criterion 6. Cheap here and expensive later: over the ceiling is
     // one of the answers the server rejects, and finding it after the suite has
     // been written, run and reviewed costs the whole cycle.
+    //
+    // Spec 34-6, criterion 5: it names how many surfaces have to move, because
+    // that number is the edit, and it lands in the same batch as every other
+    // capability over the ceiling. On a2time, 2026-08-09 the server's version of
+    // this complaint arrived one capability at a time and cost five
+    // `validate-build` rounds for one kind of mistake.
     const budget = expected.surfaceBudget;
     if (budget !== undefined && reached.size > budget) {
         add(`${id} guards ${reached.size} surfaces, over the surface_budget of ${budget}` +
-            ' — guard the most important ones up to that number and list the rest in deferred_surfaces.');
+            ` — move ${reached.size - budget} of them into deferred_surfaces and keep the most important ones guarded.`);
     }
     const missed = expected.surfaces.filter((surface) => !reached.has(surface) && !declaredUnreachable.has(surface) && !deferred.has(surface));
     if (missed.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unitbob",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "Unitbob connector — thin local hands for the Unitbob Rails brain. Owns no domain logic: it runs tools, relays bytes over the wire, and prints what the server returns.",
   "type": "module",
   "bin": {

package/plugin/codex/agents/suite-repair-worker.toml

@@ -7,6 +7,11 @@ You receive one failure packet: one validated plan item, its checkpoint, branch,
 owned paths and case markers, and only related failures or stack traces. This is
 your complete write scope.
 
+The checkpoint's `facts` come to you established, by the coordinator and by the
+worker before you. Inherit them; do not go and find them out again. A fact
+carries source references, so you can check one on the spot when a failure makes
+you doubt it — that is a targeted re-check, not a fresh survey.
+
 Complete `unresolved_promises` first while preserving every completed file and
 decision. You may read the plan item's source paths and, only as needed for the
 owned diagnosis, stack-referenced project source, the runner setup and harness
@@ -16,7 +21,7 @@ markers, or paths. Do not edit production code, host-owned shared files, the
 connector-owned harness, or another slice.
 
 After every owned edit, run
-`npx -y --loglevel=error unitbob@0.4.3 run-local <branch>` and inspect the machine
+`npx -y --loglevel=error unitbob@0.4.5 run-local <branch>` and inspect the machine
 report. Look only at examples or scenarios matching your owned paths or case
 markers. Do not require a green exit code from the whole branch: foreign failures
 and an already-confirmed product red do not widen your scope. Repeat the bounded
@@ -24,14 +29,21 @@ and an already-confirmed product red do not widen your scope. Repeat the bounded
 as a product defect. Do not run the project's suite directly, boot a dev server,
 or invoke an arbitrary runner command.
 
+`run-local` exits non-zero when the branch comes back with exactly the failures
+it came back with last time. That is not your slice being red — it is the branch
+as a whole having stopped moving. Stop the loop, hand the packet back with what
+you have, and say so; do not run it again unchanged.
+
 A product-defect diagnosis must briefly name the violated business contract, the
 reason, and production source references. Never delete a planned case, marker,
 capability binding, or assertion; never add `skip`, `pending`, `todo`, or weaken a
 business promise for green. You may correct a generated expectation only when
 the business promise remains intact and source confirms the correction. If the
 harness is still wrong, continue the loop. If the outcome is ambiguous, the
-runner is unusable, or the turn ceiling stops unfinished work, leave an honest
-branch `build_error`, never a product red. No strict JSON handoff is required.
+runner is unusable, or the emergency fuse stops unfinished work, leave an honest
+branch `build_error`, never a product red. That fuse sits far above the work one
+packet takes: reaching it means the run is broken, not that the packet was big.
+No strict JSON handoff is required.
 
 Update the same checkpoint as promises complete. Keep facts compact and
 source-referenced. The normative JSON shape of one facts entry is:
@@ -41,11 +53,11 @@ source-referenced. The normative JSON shape of one facts entry is:
 Every facts entry is an object in that shape, never a string. Before handoff,
 make one final read of the checkpoint and confirm every `facts` entry is an
 object in the normative shape above. Do not delegate repair or auto-resume after
-the ceiling. Preserve files and checkpoint for the coordinator's existing
+the fuse. Preserve files and checkpoint for the coordinator's existing
 `Continue once / Stop` choice; record unfinished work in `unresolved_promises`.
 '''
 
 [features.rollout_budget]
 enabled = true
-limit_tokens = 40000
-reminder_at_remaining_tokens = [3000]
+limit_tokens = 100000
+reminder_at_remaining_tokens = [8000]

package/plugin/codex/agents/suite-worker.toml

@@ -7,27 +7,34 @@ You receive exactly one worker-plan item and the request paths it references.
 That item is your complete scope. Do not add capabilities, promises, examples,
 or scenarios after fan-out.
 
-On the initial incarnation, create the checkpoint before reading application
-source, at the path prescribed by the workflow. Copy the exact request and plan
-digests, your branch and worker id, put every assigned promise in
-`unresolved_promises`, and start with empty `completed_promises`, `written_paths`,
-`facts`, and `decisions`. On an explicitly approved fresh incarnation after a
-native budget stop, preserve the supplied checkpoint and completed files and
-continue only its `unresolved_promises`; never initialize that checkpoint again.
-Update the checkpoint after every completed promise. Also keep `known_problems` as a compact
-array of precise unresolved harness problems (empty when none are known). Facts are short statements with
-source references. The normative JSON shape of one facts entry is:
+Your checkpoint already exists: the coordinator wrote it before fan-out, at the
+path the workflow prescribes, with the exact request and plan digests, your
+branch and worker id, your promises in `unresolved_promises`, and the facts it
+had already verified. Never initialize it again — not on the first incarnation,
+and not on an explicitly approved fresh incarnation after a native budget stop,
+where you preserve the supplied checkpoint and completed files and continue only
+its `unresolved_promises`. Update it after every completed promise. Also keep
+`known_problems` as a compact array of precise unresolved harness problems
+(empty when none are known). Facts are short statements with source references.
+The normative JSON shape of one facts entry is:
 ```json
 {"fact":"The route creates an order.","source_refs":["app/orders.rb:12"]}
 ```
 Every facts entry is an object in that shape, never a string. Never embed source
 files, suite copies, or transcript.
 
-Read only the initial `source_paths` and dependencies needed for the finite
-planned cases. Ask closed questions with the files to look in. For a closed
-missing fact, use the named `fact-finder`
-agent and respect the plan's lookup limit. A lookup may confirm implementation
-facts but may not expand the plan.
+Write first, then find out. Start with the planned cases your seeded facts
+already support and get them onto disk; go reading only for what you still lack
+after that. The opposite order — survey the sources, then write — is what spent
+seven of eight workers' entire ceilings on a2time, 2026-08-10, and produced no
+file at all. A fact already in your checkpoint is settled: do not establish it a
+second time. Nothing mechanical enforces that rule; it holds because you keep
+it.
+
+Read only the `source_paths` and dependencies your finite planned cases need.
+Ask closed questions with the files to look in. For a closed missing fact, use
+the named `fact-finder` agent, as often as the work genuinely needs. A lookup
+may confirm implementation facts but may not expand the plan.
 
 Write only the plan item's `owned_paths` and its checkpoint. Never edit the
 connector-owned harness, another worker's file, the user's own tests, manifests,
@@ -39,12 +46,16 @@ marker, metadata, or surface validation. You may make one final read of your
 owned files before handoff. During that final read, confirm every `facts` entry
 is an object in the normative shape above and correct the checkpoint if it is
 not. Do not create temporary self-validation scripts or
-loop over repeated rereads. If the turn ceiling arrives, leave partial files and
-an accurate checkpoint; the coordinator will rotate unresolved work into one
-fresh repair task.
+loop over repeated rereads.
+
+Your ceiling is an emergency fuse, not a budget to spend. It sits far above the
+work one plan item takes, so reaching it means this run is broken rather than
+large. If it arrives, leave partial files and an accurate checkpoint; the
+coordinator rotates unresolved work into one fresh repair task and reports the
+fuse as a fault of the run, never as an outcome.
 '''
 
 [features.rollout_budget]
 enabled = true
-limit_tokens = 40000
-reminder_at_remaining_tokens = [8000, 4000]
+limit_tokens = 100000
+reminder_at_remaining_tokens = [20000, 10000]

package/dist/files/budget.js

@@ -1,74 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-export const RUN_BUDGET = { workers: 4, review_rounds: 2, repair_rounds: 8 };
-// Only two of the three have a counter behind them. The connector cannot see
-// the host launch a subagent, so `workers` is a number it states and cannot
-// check. It travels in the same block anyway, and the recipe is told not to sort
-// the fields into checked and unchecked: an agent that knows which half is
-// watched has been handed a reason to treat the other half as advice.
-const SPENT_FILE = 'budget-spent.json';
-function spentPath(projectRoot) {
-    return join(projectRoot, '.unitbob', 'suite-build', SPENT_FILE);
-}
-// On disk, not in memory, because the loop these bound spans separate processes:
-// every `run-local` and every `suite-review-prepare` is a fresh `npx`. A count
-// held in a running command would reset on each one and bound nothing.
-export function spend(projectRoot, key) {
-    const path = spentPath(projectRoot);
-    const spent = readSpent(path);
-    const count = (spent[key] ?? 0) + 1;
-    spent[key] = count;
-    mkdirSync(dirname(path), { recursive: true });
-    // Written whole and moved into place, never written in place. A plain write
-    // that is interrupted leaves truncated JSON, which `readSpent` then reads as
-    // nothing spent — so the count would reset exactly when a run is being killed
-    // and restarted, which is the loop this exists to bound.
-    const staging = `${path}.tmp`;
-    writeFileSync(staging, `${JSON.stringify(spent, null, 2)}\n`);
-    renameSync(staging, path);
-    return count;
-}
-// A new build request starts on a fresh budget. Without this a project Unitbob
-// ran a month ago opens today already over its ceiling, and every command
-// announces the last round — noise, and advice that is wrong besides.
-//
-// True when there was something to clear, so the caller can say so out loud.
-// Re-running `suite-prepare` is a documented step of the loop, and it resets
-// both counters; a reset nobody is told about is a ceiling that quietly is not
-// one.
-export function clearSpending(projectRoot) {
-    const path = spentPath(projectRoot);
-    const had = existsSync(path);
-    rmSync(path, { force: true });
-    return had;
-}
-// A damaged or hand-edited file counts as nothing spent. The alternative is
-// refusing to run over a bookkeeping file, which would make a counter that
-// deliberately never blocks into the one thing that does.
-function readSpent(path) {
-    if (!existsSync(path))
-        return {};
-    try {
-        const parsed = JSON.parse(readFileSync(path, 'utf8'));
-        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
-            return {};
-        return Object.fromEntries(Object.entries(parsed)
-            .filter(([, value]) => typeof value === 'number' && Number.isFinite(value)));
-    }
-    catch {
-        return {};
-    }
-}
-// A request written by an older connector carries no budget, and that is not an
-// error: there is no ceiling to enforce, so every counter goes quiet and the run
-// works as it did before (spec 34-2, edge cases).
-export function readBudget(value) {
-    if (!value || typeof value !== 'object')
-        return undefined;
-    const block = value;
-    const fields = ['workers', 'review_rounds', 'repair_rounds']
-        .map((field) => [field, block[field]]);
-    if (fields.some(([, number]) => typeof number !== 'number' || !Number.isFinite(number)))
-        return undefined;
-    return Object.fromEntries(fields);
-}