unitbob 0.7.4 → 0.7.7

package/dist/cli.js

@@ -57,8 +57,11 @@ Verbs:
                        every slice it names, before fan-out.
   validate-worker-checkpoints
                        Internal: validate every worker checkpoint before assembly or repair.
-  put-suite-build      Internal: upload the host-built guardrail suite (whole spec file + test_metadata),
-                       then run every branch it published and report the server's results.
+  put-suite-build [branch]
+                       Internal: upload the host-built guardrail suite (whole spec file + test_metadata),
+                       then run every branch it published and report the server's results. Name a branch
+                       to publish that one alone, as soon as it is finished; with no argument both are
+                       expected, and one the answer never mentions is reported.
   run-local [branch]   Internal: run the suite you just wrote, before publishing it, with the same runner
                        that will run it afterwards. No argument runs every branch the build asked for.
   fix-prepare <id>     Internal: fetch the per-capability repair packet for one red guard (by interface_id).

package/dist/files/behavioral.js

@@ -331,19 +331,33 @@ export function filesLostOnMaterialize(projectRoot, artifact, runner) {
     const behavioralRoot = join(projectRoot, BEHAVIORAL_DIR);
     if (!existsSync(behavioralRoot))
         return [];
-    const connectorWorld = behavioralWorldFor(runner);
-    const listed = new Set([
-        artifact.path,
-        ...(artifact.support_files ?? []).map((file) => file.path),
-        ...(connectorWorld ? [connectorWorld.path] : []),
-    ]);
-    const runnerEntries = RUNNER_ENVIRONMENT_ENTRIES[runner] ?? EMPTY_ENTRIES;
+    const listed = new Set([artifact.path, ...(artifact.support_files ?? []).map((file) => file.path)]);
+    const kept = behavioralKeptByConnector(runner);
     return readdirSync(behavioralRoot)
-        .filter((entry) => !runnerEntries.has(entry) && !CONNECTOR_RUN_ARTIFACTS.has(entry))
+        .filter((entry) => !kept.has(entry))
         .flatMap((entry) => filesUnder(projectRoot, `${BEHAVIORAL_DIR}/${entry}`))
-        .filter((path) => !listed.has(path))
+        .filter((path) => !listed.has(path) && !kept.has(path.slice(BEHAVIORAL_DIR.length + 1)) && !isRuntimeByProduct(path))
         .sort();
 }
+// What under the behavioral root is the connector's or the runner's rather than
+// the build's, as paths relative to that root: the installed environment, the
+// connector-owned World, and the report files the run itself writes. One set,
+// read by two callers that must agree — the review warning above, which stays
+// quiet about these, and `movePreviousRunAside` (spec 49), which leaves them in
+// place while everything else the last build wrote goes to `previous/`. A
+// second hand-kept list would let the warning and the move disagree about
+// whose file something is.
+//
+// A runner this connector has no table for keeps nothing but the run's own
+// artifacts, which is the same answer `materializeBehavioral` gives it.
+export function behavioralKeptByConnector(runner) {
+    const world = runner ? behavioralWorldFor(runner) : undefined;
+    return new Set([
+        ...(runner ? RUNNER_ENVIRONMENT_ENTRIES[runner] ?? EMPTY_ENTRIES : EMPTY_ENTRIES),
+        ...(world ? [world.path.slice(BEHAVIORAL_DIR.length + 1)] : []),
+        ...CONNECTOR_RUN_ARTIFACTS,
+    ]);
+}
 // The real files under `relative`. Symlinks are not followed: materialization
 // removes the link, not what it points at, and naming the target here would read
 // as a warning about a file that was never in danger.
@@ -355,6 +369,27 @@ function filesUnder(projectRoot, relative) {
         return [];
     return readdirSync(join(projectRoot, relative)).flatMap((entry) => filesUnder(projectRoot, `${relative}/${entry}`));
 }
+// What the branch's own run leaves behind while it runs: Python's byte-code
+// cache beside every step file, the SQLite database the World opens at start
+// and its journal. Nobody wrote them, the next run makes them again, and the
+// answer could not list them if it tried. On the bench, 2026-09-11, the review
+// warning named fourteen `.pyc` files on microblog and the World's own database
+// on soul as things "running it will delete" — the same way the connector's
+// report files used to be named, and for the same cost: a warning that fires on
+// every review is a warning nobody reads when a step file really is forgotten.
+//
+// Matched anywhere in the path, not only at the top: `__pycache__` sits inside
+// `step_definitions/`, where the top-level filter above never looks.
+//
+// Exported for `movePreviousRunAside` (spec 49), which deletes exactly these
+// rather than carrying them to `previous/` — the same list, so what the warning
+// does not name is what the move does not keep.
+const RUNTIME_BY_PRODUCT_DIRS = new Set(['__pycache__', '.pytest_cache']);
+const RUNTIME_BY_PRODUCT_FILE = /\.(pyc|sqlite|sqlite3|db|db-shm|db-wal|db-journal)$/;
+export function isRuntimeByProduct(relativePath) {
+    const parts = relativePath.split('/');
+    return parts.some((part) => RUNTIME_BY_PRODUCT_DIRS.has(part)) || RUNTIME_BY_PRODUCT_FILE.test(parts[parts.length - 1]);
+}
 export function copyBehavioralRunnerEnvironment(sourceRoot, targetRoot, runner) {
     const entries = RUNNER_ENVIRONMENT_ENTRIES[runner] ?? EMPTY_ENTRIES;
     for (const entry of entries) {

package/dist/files/guardrails.js

@@ -13,6 +13,27 @@ export const HELPER_FILE = 'unitbob_helper.rb';
 // the project's own .rspec (stray --require lines, extra stdout formatters)
 // out of guardrail runs, whose JSON output must stay parseable.
 export const OPTIONS_FILE = 'rspec.opts';
+// The report each structural runner writes beside the suite. Named here rather
+// than in `runner/{rspec,vitest,pytest}.ts`, which build their full paths from
+// these: those modules import this one, and the names are needed below — the
+// same reason `BDD_RUN_ARTIFACTS` is listed where it is written.
+export const RSPEC_RESULT_NAME = 'rspec_result.json';
+export const VITEST_RESULT_NAME = 'vitest_result.json';
+export const PYTEST_RESULT_NAME = 'pytest_result.xml';
+// What under the structural root is the connector's rather than the build's,
+// as paths relative to that root (spec 49): the Ruby boot kit and the runners'
+// reports. `movePreviousRunAside` leaves these in place and moves everything
+// else — including `_setup.ts` and a `conftest.py`, which are the *last*
+// build's preparation, written against its files. The same set whatever the
+// runner: a Ruby helper in a Python project is litter `suite-prepare` no longer
+// writes, and moving it to `previous/` would only move the litter.
+export const STRUCTURAL_KEPT_BY_CONNECTOR = new Set([
+    HELPER_FILE,
+    OPTIONS_FILE,
+    RSPEC_RESULT_NAME,
+    VITEST_RESULT_NAME,
+    PYTEST_RESULT_NAME,
+]);
 // The one place that decides whether a host-provided suite path is safe to
 // write: relative, anchored under .unitbob/guardrails/, no traversal. Anything
 // else throws and nothing is written.

package/dist/files/suiteBuild.js

@@ -1,7 +1,9 @@
-import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { dirname, join, sep } from 'node:path';
 import { assertUnitbobPath } from "./artifactPath.js";
+import { BEHAVIORAL_DIR, behavioralKeptByConnector, isRuntimeByProduct } from "./behavioral.js";
+import { GUARDRAILS_DIR, STRUCTURAL_KEPT_BY_CONNECTOR } from "./guardrails.js";
 import { readWorkerPlan, validateWorkerPlanFiles, workerPlanDigest, workerPlanPath } from "./workerPlan.js";
 export function requestPath(projectRoot) {
     return join(projectRoot, '.unitbob', 'suite-build', 'request.json');
@@ -18,14 +20,29 @@ export function reviewRequestPath(projectRoot) {
 export function candidateRunPath(projectRoot) {
     return join(projectRoot, '.unitbob', 'suite-build', 'candidate-run.json');
 }
-// Spec 37-2, criterion 3. What a new build leaves behind, in the order a reader
+// Spec 37-2, criterion 3. What a build leaves behind, in the order a reader
 // meets it: the plan, the checkpoints written against that plan, and the answer
 // assembled from them. All three are bound to the `request.json` this run is
 // about to overwrite, so from the next line on they are a previous run's papers
 // wearing this run's filenames — which is exactly the confusion the coordinator
 // used to spend a turn untangling before fan-out.
-const PREVIOUS_RUN_ARTIFACTS = ['worker-plan.json', 'checkpoints', 'suite_output.json'];
+const BUILD_PAPERS = ['worker-plan.json', 'checkpoints', 'suite_output.json'];
+// Spec 49. And the three the review writes, bound to the candidate that build
+// ran: left behind, a stale `behavioral_review.json` fails `validate-build` with
+// a sentence about the reviewer.
+const PREVIOUS_RUN_ARTIFACTS = [...BUILD_PAPERS, 'behavioral_review.json', 'candidate-run.json', 'review-request.json'];
 const PREVIOUS_DIR = 'previous';
+// Is the `suite-prepare` about to run the first step of a new build, or a
+// repeat inside one? Spec 49, criterion 3. A new build is one with a plan, a
+// checkpoint set or an answer on disk from the build before — or no
+// `request.json` at all, which is a machine that has never built here (and may
+// hold a suite that `check` materialized from the published one). A request
+// with no plan yet is the coordinator's second question of the probe (spec 39):
+// nothing moves then, so the `_setup.ts` written between the two runs survives.
+export function isNewBuild(projectRoot) {
+    const buildDir = join(projectRoot, '.unitbob', 'suite-build');
+    return !existsSync(requestPath(projectRoot)) || BUILD_PAPERS.some((name) => existsSync(join(buildDir, name)));
+}
 // Moved, never removed. A run costs hours and real money, and one interrupt plus
 // one restart must not be able to spend that twice — `previous/` is one line
 // more than `rmSync` and it is the line that makes a restart survivable.
@@ -37,18 +54,98 @@ const PREVIOUS_DIR = 'previous';
 // finished checkpoints and answer of the run before it with no way back. A
 // `previous/` holding pieces of two runs is worth strictly more than an empty
 // one, and every piece in it is named by the file it kept.
-export function movePreviousRunAside(projectRoot) {
+//
+// Since spec 49 the same rule covers the branches' own directories. The
+// behavioral runner loads its directory whole, so a `.feature` the last build
+// wrote runs under this build's markers and a dead step file argues with a live
+// one over the same step text; on the bench (2026-09-11) two workers reworded
+// their steps to dodge files nobody had written this build. Every file the last
+// build wrote under `.unitbob/structural/` and `.unitbob/behavioral/` goes to
+// `previous/<branch>/` under the same relative path — `_setup.ts` and a
+// `conftest.py` included, since they are the last build's preparation, written
+// against its files. What stays is what the connector and the runner own
+// (`STRUCTURAL_KEPT_BY_CONNECTOR`, `behavioralKeptByConnector`); what the run
+// itself dropped — byte-code caches, the World's database — is deleted, because
+// nobody wrote it and the next run makes it again.
+//
+// `behavioralRunner` is the runner that branch is under, so the move knows
+// which installed environment and which World are that runner's; null when
+// none is known, and then only what every runner shares is kept. The structural
+// side needs no runner: its kept set is the same for all three.
+export function movePreviousRunAside(projectRoot, behavioralRunner) {
     const buildDir = join(projectRoot, '.unitbob', 'suite-build');
-    const found = PREVIOUS_RUN_ARTIFACTS.filter((name) => existsSync(join(buildDir, name)));
-    if (found.length === 0)
-        return [];
     const previous = join(buildDir, PREVIOUS_DIR);
-    mkdirSync(previous, { recursive: true });
+    const found = PREVIOUS_RUN_ARTIFACTS.filter((name) => existsSync(join(buildDir, name)));
+    if (found.length > 0)
+        mkdirSync(previous, { recursive: true });
     for (const name of found) {
         rmSync(join(previous, name), { recursive: true, force: true });
         renameSync(join(buildDir, name), join(previous, name));
     }
-    return found;
+    return {
+        artifacts: found,
+        branches: {
+            structural: moveBranchAside(join(projectRoot, GUARDRAILS_DIR), join(previous, 'structural'), STRUCTURAL_KEPT_BY_CONNECTOR),
+            behavioral: moveBranchAside(join(projectRoot, BEHAVIORAL_DIR), join(previous, 'behavioral'), behavioralKeptByConnector(behavioralRunner)),
+        },
+    };
+}
+// One branch directory: the build's files to `target` under the same relative
+// paths, `kept` left where it is, by-products deleted. Returns how many files
+// moved.
+//
+// Collected first, moved second, so that a branch with nothing of the build's
+// in it leaves the `previous/<branch>/` of the build before alone — the
+// per-artifact rule above, applied to a directory. When there is something to
+// move, the target is replaced whole: `previous/` holds one previous build, not
+// an archive. The clearing happens before the first rename, so a rename that
+// fails halfway (a full disk, a permission) leaves `previous/<branch>/` holding
+// only what moved so far; the files that did not move are still where they
+// were, and nothing is lost, which is the promise this function makes.
+//
+// The directories the files leave behind are removed too, so the branch root
+// reads as what it is — empty of the last build — rather than as its skeleton.
+// Deepest first, and only when empty: a directory holding a kept file (the
+// World inside `step_definitions/`) keeps its file and stays.
+function moveBranchAside(root, target, kept) {
+    if (!existsSync(root))
+        return 0;
+    const moving = [];
+    collectBuildFiles(root, '', kept, moving);
+    if (moving.length === 0)
+        return 0;
+    rmSync(target, { recursive: true, force: true });
+    for (const relative of moving) {
+        const destination = join(target, relative);
+        mkdirSync(dirname(destination), { recursive: true });
+        renameSync(join(root, relative), destination);
+    }
+    const emptied = new Set(moving.map((relative) => dirname(relative)).filter((dir) => dir !== '.'));
+    for (const dir of [...emptied].sort((a, b) => b.length - a.length)) {
+        for (let ancestor = dir; ancestor !== '.'; ancestor = dirname(ancestor)) {
+            if (readdirSync(join(root, ancestor)).length > 0)
+                break;
+            rmSync(join(root, ancestor), { recursive: true });
+        }
+    }
+    return moving.length;
+}
+// A symlink is a file here: it moves as a link, and what it points at is never
+// touched — the same reading `filesUnder` gives the review warning.
+function collectBuildFiles(root, relative, kept, into) {
+    for (const entry of readdirSync(join(root, relative))) {
+        const path = relative ? `${relative}/${entry}` : entry;
+        if (kept.has(path))
+            continue;
+        if (isRuntimeByProduct(path)) {
+            rmSync(join(root, path), { recursive: true, force: true });
+            continue;
+        }
+        if (lstatSync(join(root, path)).isDirectory())
+            collectBuildFiles(root, path, kept, into);
+        else
+            into.push(path);
+    }
 }
 export function writeBehavioralReviewRequest(projectRoot, output, candidateRun, knownDefectContext = { status: 'not_supplied' }, fixedCandidateRun) {
     const metadata = output.test_metadata;
@@ -284,6 +381,27 @@ export function writeSuiteBuildRequest(projectRoot, branches, knownDefectContext
     writeFileSync(path, `${JSON.stringify(request, null, 2)}\n`);
     return request;
 }
+// Which branches a command was told to work on. No name means all of them — the
+// "one suite, one run" shape both recipes insist on, so the default never teaches
+// the habit the recipes forbid. A name narrows: `run-local` uses it for the
+// repair loop, where re-running the finished peer is pure cost, and
+// `put-suite-build` for publishing a branch the moment it is done (spec 41,
+// criterion 3).
+//
+// One parse and one sentence for both, because it is one rule. They had a copy
+// each and worded the same user error two different ways, which makes a person
+// who has met one of them read the other as a different problem.
+export function namedBranches(request, args) {
+    const all = request.branches.map((branch) => branch.suite_kind);
+    const named = args.filter((arg) => !arg.startsWith('-'));
+    if (named.length === 0)
+        return [];
+    const unknown = named.filter((name) => !all.includes(name));
+    if (unknown.length > 0) {
+        throw new Error(`This suite build has no branch called ${unknown.join(', ')}. It asked for: ${all.join(', ')}.`);
+    }
+    return named;
+}
 export function readSuiteBuildRequest(projectRoot) {
     const path = requestPath(projectRoot);
     if (!existsSync(path)) {

package/dist/files/workerPlan.js

@@ -21,6 +21,48 @@ export function requestDigest(projectRoot) {
 export function workerPlanDigest(projectRoot) {
     return exactFileDigest(workerPlanPath(projectRoot));
 }
+// The addresses the request handed to each capability, indexed by id. The
+// checkpoint gate needs them for one question only: was this address given to
+// this slice at all (spec 41, criterion 1). What a slice *left* is not worked out
+// anywhere in this repo — answering that means reading how much of a capability
+// is guarded, which is Rails' to say and, as the architecture guard notes, not a
+// sentence `src/` is even allowed to write.
+//
+// A capability whose assignment lists no surfaces is absent from the map rather
+// than present with an empty list: "this assignment does not say" and "this
+// capability has no addresses" are different, and only the first must leave
+// membership unchecked.
+export function assignedSurfaces(projectRoot) {
+    const request = readRequest(projectRoot);
+    const byId = new Map();
+    for (const branch of Array.isArray(request.branches) ? request.branches : []) {
+        const assignment = branch.assignment;
+        for (const entry of Array.isArray(assignment?.capabilities) ? assignment.capabilities : []) {
+            const capability = entry;
+            const id = capability?.capability_id;
+            const surfaces = capability?.surfaces;
+            if (!isNonEmptyString(id) || !Array.isArray(surfaces) || surfaces.length === 0)
+                continue;
+            byId.set(id, surfaces.filter(isNonEmptyString));
+        }
+    }
+    return byId;
+}
+// The task, read as loosely typed JSON.
+//
+// `readSuiteBuildRequest` in `suiteBuild.ts` returns the same file typed, and is
+// the obvious thing to call — but that module imports this one, so calling it
+// back would close an import cycle. This is the price, written down so the next
+// reader does not spend the same minutes finding out why.
+function readRequest(projectRoot) {
+    const path = requestPath(projectRoot);
+    try {
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (error) {
+        throw new Error(`${path} is not valid JSON: ${error.message}`);
+    }
+}
 export function readWorkerPlan(projectRoot) {
     const path = workerPlanPath(projectRoot);
     if (!existsSync(path))
@@ -97,9 +139,15 @@ function seedFor(item, request_digest, plan_digest) {
         written_paths: [],
         decisions: [],
         known_problems: [],
-        // Behavioral only, and absent rather than empty elsewhere — it joins Gherkin
-        // Scenarios to addresses, and the structural branch has no Scenarios.
-        ...(item.branch === 'behavioral' ? { surface_coverage: [] } : {}),
+        // Behavioral only, and absent rather than empty elsewhere — they are about
+        // addresses, and the structural branch has none.
+        //
+        // `unreachable_surfaces` is seeded empty because empty is the honest common
+        // answer and the gate wants the key present either way. Its peer bucket,
+        // `deferred_surfaces`, is deliberately not here: what a slice did not take is
+        // the remainder of what it did, and it is worked out where the upload is
+        // assembled. Two places to answer one question is how the two drift.
+        ...(item.branch === 'behavioral' ? { surface_coverage: [], unreachable_surfaces: [] } : {}),
         facts: [],
     };
 }
@@ -111,13 +159,7 @@ export function validateWorkerPlanFiles(projectRoot) {
     const errors = [];
     const rubyProject = detectStructuralRunner(projectRoot) === 'rspec';
     const plan = readWorkerPlan(projectRoot);
-    let request;
-    try {
-        request = JSON.parse(readFileSync(requestPath(projectRoot), 'utf8'));
-    }
-    catch (error) {
-        throw new Error(`${requestPath(projectRoot)} is not valid JSON: ${error.message}`);
-    }
+    const request = readRequest(projectRoot);
     if (!plan || typeof plan !== 'object')
         return ['worker plan must be an object'];
     if (plan.request_digest !== requestDigest(projectRoot))

package/dist/proc.js

@@ -66,18 +66,47 @@ export function runProcess(command, args = [], options = {}) {
         child.on('close', (code) => finish({ stdout, stderr, code: timedOut ? null : code }));
     });
 }
-export async function requireGraphify() {
+// The oldest graphify the map may be built with. Below it, `detect.py` drops
+// any file whose name ends in `token`, `secret`, `password` or `credential` as
+// a probable secret store — by the name alone, before the file is parsed, and
+// without a word on stdout: `graphify update` never prints the list it keeps.
+// On the bench, 2026-09-11, that took `app/api/tokens.py` out of microblog and
+// `src/controllers/auth/token.js` out of soul, so both maps were built without
+// the sign-in code and nothing said so. `.graphifyignore` cannot re-include a
+// file graphify has decided is sensitive, so the only cure is the release that
+// exempts real source files (`.py`, `.js`, `.ts`, `.rb`) from that rule, and
+// 0.9.18 is the first one that does — checked release by release.
+export const GRAPHIFY_MIN_VERSION = '0.9.18';
+const GRAPHIFY_INSTALL = '`pip install graphifyy && graphify install` (PyPI package "graphifyy", command "graphify", needs Python 3.10+)';
+export async function requireGraphify(run = runProcess) {
+    let result;
     try {
-        const result = await runProcess('graphify', ['--help']);
-        if (result.code === 0)
-            return;
-        throw new Error(result.stderr.trim() || result.stdout.trim() || `graphify --help exited ${result.code}`);
+        result = await run('graphify', ['--version']);
     }
     catch (err) {
-        throw new Error(`graphify is required but was not found or did not run. Install it with ` +
-            `\`pip install graphifyy && graphify install\` (PyPI package "graphifyy", command ` +
-            `"graphify", needs Python 3.10+), then retry (${err.message}).`);
+        throw new Error(`graphify is required but was not found or did not run. Install it with ${GRAPHIFY_INSTALL}, ` +
+            `then retry (${err.message}).`);
     }
+    // `graphify 0.9.58` on stdout. A release too old to answer `--version` at all
+    // (0.7.x says "unknown command") is older than the floor by definition, so it
+    // is refused with the same sentence rather than a different one.
+    const version = /\bgraphify\s+(\d+\.\d+\.\d+)/.exec(result.stdout)?.[1];
+    if (version && !olderThan(version, GRAPHIFY_MIN_VERSION))
+        return;
+    const found = version ?? (result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`);
+    throw new Error(`graphify ${found} is installed, and Unitbob needs ${GRAPHIFY_MIN_VERSION} or newer. Older releases ` +
+        `silently leave out any source file whose name ends in "token", "secret" or "password" — ` +
+        `the sign-in code, typically — so the map would be built without it and nobody would be told. ` +
+        `Upgrade with \`pip install --upgrade graphifyy\`, then retry.`);
+}
+function olderThan(version, floor) {
+    const a = version.split('.').map(Number);
+    const b = floor.split('.').map(Number);
+    for (let i = 0; i < 3; i += 1) {
+        if (a[i] !== b[i])
+            return a[i] < b[i];
+    }
+    return false;
 }
 // Paths that hold no business logic in the stacks unitbob supports — Rails,
 // JS/TS, Python — and that graphify does not already skip (it drops

package/dist/runner/bootcheck.js

@@ -286,16 +286,27 @@ ${imports}
 test('the modules our guardrails import all load', () => {});
 `;
 }
-// Python imports modules, not files, so the probe does the translation itself.
-// The module is registered in `sys.modules` before it is executed, because a
-// module that is not there yet cannot be the target of its own relative
-// imports.
-//
-// This is the one part of spec 38 that no live project has exercised: there was
-// no Python project on the bench. Worth watching on the first Python run.
+// Python imports modules, not files, so the probe does the translation itself —
+// and then imports by name, exactly as a guardrail's `from app.models import
+// User` will (spec 50). Not `spec_from_file_location` + `exec_module`, which is
+// what stood here until 2026-09-11: that executes the file whether or not it is
+// already loaded. On microblog the first target, `app/__init__.py`, does `from
+// app import models`, so by the time the loop reached `app/models.py` the module
+// was in `sys.modules` and got run a second time — SQLAlchemy answered "Table
+// 'followers' is already defined for this MetaData instance", and a healthy
+// Flask application lost its structural branch. `import_module` reads
+// `sys.modules` first, names `app/__init__.py` `app` rather than `app.__init__`,
+// and goes through the finders, so the probe asks the run's question and no
+// stricter one (`docs/adr/0001`). Where it still differs: `sys.path.insert(0,
+// ROOT)` puts the project root first, which `-m pytest` run from that root does
+// on its own — every interpreter `locateRunner` returns is invoked that way — so
+// the line is the run's assumption made visible, not an addition to it. A
+// src-layout project, whose guardrails import `pkg.mod` with `src/` on the
+// path, is named `src.pkg.mod` here and would be refused; no such project has
+// reached the bench, and the spec records it as work not done.
 function pytestProbeSource(sourceFiles) {
     return `# Written by the unitbob connector before the boot check — do not edit.
-import importlib.util
+import importlib
 import pathlib
 import sys
 
@@ -313,12 +324,9 @@ def test_the_modules_our_guardrails_import_all_load():
         if not rel.endswith(".py"):
             continue
         name = rel[:-3].replace("/", ".")
-        spec = importlib.util.spec_from_file_location(name, ROOT / rel)
-        if spec is None or spec.loader is None:
-            continue
-        module = importlib.util.module_from_spec(spec)
-        sys.modules[name] = module
-        spec.loader.exec_module(module)
+        if name.endswith(".__init__"):
+            name = name[: -len(".__init__")]
+        importlib.import_module(name)
 `;
 }
 // Runs one command, turning "this binary is not on the machine" into null (the

package/dist/runner/provision.js

@@ -523,7 +523,23 @@ async function provisionRuby(projectRoot, behavioralDir, deps) {
         // the exact shape of failure 35-1 closes. A project that does carry it keeps
         // its own version, and now actually gets to: see the comment on the helper
         // for what asking twice cost A2.Time.
-        gemLineUnlessTheProjectHasIt('webmock');
+        gemLineUnlessTheProjectHasIt('webmock') +
+        // The connector-owned World does not merely mention rspec — it requires
+        // `rspec/expectations` and `rspec/mocks` at load and runs a full mock
+        // lifecycle per scenario (`src/files/behavioral.ts`). Until spec 40 the
+        // sidecar never asked for either, so a Rails project on minitest got a World
+        // that could not load: noahsat-web died on `cannot load such file --
+        // rspec/expectations` and lost its behavioral branch entirely.
+        //
+        // Unpinned, and that is a safety condition rather than a taste. A project
+        // carrying `rspec-rails` does not declare `rspec-expectations` explicitly —
+        // it arrives transitively — so the guard above does not fire and our line is
+        // added. It resolves without conflict because the sidecar starts from a copy
+        // of the project's own lock (below) and `>= 0` constrains nothing, leaving
+        // the version rspec-rails already chose. A pin that missed that line would be
+        // a `Bundler::VersionConflict` at install instead.
+        gemLineUnlessTheProjectHasIt('rspec-expectations') +
+        gemLineUnlessTheProjectHasIt('rspec-mocks');
     if (!existsSync(sidecarGemfile) || readFileSync(sidecarGemfile, 'utf8') !== sidecarContent) {
         writeFileSync(sidecarGemfile, sidecarContent);
     }

package/dist/runner/pytest.js

@@ -1,11 +1,11 @@
 import { writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { GUARDRAILS_DIR } from "../files/guardrails.js";
+import { GUARDRAILS_DIR, PYTEST_RESULT_NAME } from "../files/guardrails.js";
 import { projectRootAsSeenByThePlace, runInProject } from "./place.js";
 import { locateRunner } from "./toolchain.js";
 import { clearReport, readFreshReport } from "./types.js";
 export const PYTEST_TIMEOUT_MS = 10 * 60 * 1000;
-export const PYTEST_RESULT_FILE = join(GUARDRAILS_DIR, 'pytest_result.xml');
+export const PYTEST_RESULT_FILE = join(GUARDRAILS_DIR, PYTEST_RESULT_NAME);
 // A minimal runtime config, created or overwritten before each run and passed
 // via `-c` so the project's own addopts (e.g. --cov, -n auto) cannot break the
 // guardrail run or its JUnit output. Connector-owned: never stored in Rails,

package/dist/runner/rspec.js

@@ -1,5 +1,5 @@
 import { join } from 'node:path';
-import { GUARDRAILS_DIR, OPTIONS_FILE } from "../files/guardrails.js";
+import { GUARDRAILS_DIR, OPTIONS_FILE, RSPEC_RESULT_NAME } from "../files/guardrails.js";
 import { projectRootAsSeenByThePlace, runInProject } from "./place.js";
 import { locateRunner } from "./toolchain.js";
 import { clearReport, readFreshReport } from "./types.js";
@@ -8,7 +8,7 @@ export const RSPEC_TIMEOUT_MS = 10 * 60 * 1000;
 // green→red flip can never come from run-order nondeterminism. It does not inherit
 // the project's random ordering.
 export const RSPEC_SEED = '1';
-export const RSPEC_RESULT_FILE = join(GUARDRAILS_DIR, 'rspec_result.json');
+export const RSPEC_RESULT_FILE = join(GUARDRAILS_DIR, RSPEC_RESULT_NAME);
 // Run the materialised Unitbob guardrail suite (spec 26). Only these files run —
 // never the project's full suite — under RAILS_ENV=test with a fixed order/seed.
 // --options points at the materialized empty file so the project's own .rspec

package/dist/runner/vitest.js

@@ -1,11 +1,11 @@
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { GUARDRAILS_DIR } from "../files/guardrails.js";
+import { GUARDRAILS_DIR, VITEST_RESULT_NAME } from "../files/guardrails.js";
 import { projectRootAsSeenByThePlace, runInProject } from "./place.js";
 import { locateRunner } from "./toolchain.js";
 import { clearReport, readFreshReport } from "./types.js";
 export const VITEST_TIMEOUT_MS = 10 * 60 * 1000;
-export const VITEST_RESULT_FILE = join(GUARDRAILS_DIR, 'vitest_result.json');
+export const VITEST_RESULT_FILE = join(GUARDRAILS_DIR, VITEST_RESULT_NAME);
 // A connector-owned Vitest config, written next to .unitbob/ before a run when
 // the project has its own config. Connector-owned: never stored in Rails, never
 // part of the suite digest.

package/dist/verbs/putSuiteBuild.js

@@ -1,4 +1,4 @@
-import { readHostSuiteOutputsPerBranch, readSuiteBuildRequest, } from "../files/suiteBuild.js";
+import { namedBranches, readHostSuiteOutputsPerBranch, readSuiteBuildRequest, } from "../files/suiteBuild.js";
 import { placeProblem } from "../runner/place.js";
 import { collectBuildProblems } from "./validateBuild.js";
 import { PUBLISHED, uploadItem, withReview } from "../files/suiteBuildUpload.js";
@@ -20,17 +20,40 @@ import { Wire } from "../wire.js";
 //
 // Returns the server's per-branch results so the caller can compose the first run
 // on top of them (spec 32-4) without parsing the lines printed here.
-export async function putSuiteBuild(config, _args = [], deps) {
+export async function putSuiteBuild(config, args = [], deps) {
     // Spec 36, criterion 7. Publishing is followed immediately by a first run, so
     // a place that cannot be used is not something to discover after the suite is
     // stored on the server.
     const unusable = placeProblem(config.projectRoot);
     if (unusable)
         throw new Error(`${unusable}\nNothing was uploaded.`);
-    const request = readSuiteBuildRequest(config.projectRoot);
+    // Spec 41, criterion 3. The one thing a caller may say about scope: publish
+    // these branches, and only these.
+    //
+    // a2time, 2026-09-05. A two-hour run was interrupted mid-repair and left
+    // nothing on the server, though a complete answer for both branches had been
+    // sitting on disk since before the first run. Uploading one branch was never
+    // the problem — a missing branch has always been named against itself and never
+    // sunk the batch. What was missing is a way to say the peer's absence is the
+    // plan: `collectBuildProblems` exists to catch a branch abandoned in silence,
+    // and on a branch-at-a-time publish it would cry wolf every run.
+    //
+    // The request is cut down once, here, so every later step answers the same
+    // question about the same list instead of each remembering to skip the peer.
+    const whole = readSuiteBuildRequest(config.projectRoot);
+    const only = namedBranches(whole, args);
+    const request = only.length > 0
+        ? { ...whole, branches: whole.branches.filter((branch) => only.includes(branch.suite_kind)) }
+        : whole;
     // Spec 32-6: read branch by branch, so one unreadable entry neither hides the
     // next branch's problems nor sinks a peer that is finished and correct.
-    const { outputs, unreadable } = readHostSuiteOutputsPerBranch(request.output_path, request);
+    const answer = readHostSuiteOutputsPerBranch(request.output_path, request);
+    // The answer file is the whole run's, not this call's: when a branch is named,
+    // its peer's entry is somebody else's business — already published by an
+    // earlier call, or still being repaired — and reading it here would report the
+    // peer as unpublishable for the sole reason that this call was not about it.
+    const outputs = answer.outputs.filter((output) => only.length === 0 || only.includes(output.suite_kind));
+    const unreadable = answer.unreadable.filter((entry) => only.length === 0 || only.includes(entry.suite_kind));
     const d = {
         putSuiteBuilds: (items) => new Wire(config).putSuiteBuilds(items),
         stdout: process.stdout,

package/dist/verbs/runLocal.js

@@ -1,4 +1,4 @@
-import { branchRunner, readHostSuiteOutputsPerBranch, readSuiteBuildRequest, } from "../files/suiteBuild.js";
+import { branchRunner, namedBranches, readHostSuiteOutputsPerBranch, readSuiteBuildRequest, } from "../files/suiteBuild.js";
 import { digestOf, failureSet, readRunState, rememberFailures, reportedFailures, } from "../runner/failureDigest.js";
 import { placeProblem } from "../runner/place.js";
 import { placeAdvice } from "../runner/placeAdvice.js";
@@ -76,26 +76,23 @@ function compareFailures(config, d, suiteKind, ran, before) {
     rememberFailures(config.projectRoot, suiteKind, digest);
     if (digest !== before)
         return false;
-    d.stdout.write(`\nStopping ${suiteKind}: it just failed the same ${failures.length} case(s) as the previous run, ` +
+    // The number is the one the reader has just counted in the list above — every
+    // failed case — not the size of the compared set. That set is keyed on marker,
+    // file and first line, so seven Scenarios under one marker failing the same
+    // way are one entry in it; on soul, 2026-09-11, this line said "the same
+    // 1 case(s)" under a list of seven, and read as a counting error.
+    const reported = reportedFailures(ran.runner, ran.result.report)?.length ?? failures.length;
+    d.stdout.write(`\nStopping ${suiteKind}: it just failed the same ${reported} case(s) as the previous run, ` +
         'down to the first line of every message. The edits since then changed nothing this run can see.\n' +
         'Look at the failures yourself, replan the slice, or record the branch as a build_error. ' +
         'Running it again unchanged prints this same line.\n');
     return true;
 }
-// Which branches to run. No argument runs every branch the request asked for —
-// the same "one suite, one run" shape both recipes insist on, so the default
-// never teaches the habit the recipes forbid. A named branch is for the repair
-// loop, where re-running the finished peer is pure cost.
+// Which branches to run: the ones named, or every branch the request asked for.
+// The parse and the error live in `namedBranches`, shared with the publish side.
 function selectBranches(request, args) {
-    const all = request.branches.map((branch) => branch.suite_kind);
-    const named = args.filter((arg) => !arg.startsWith('-'));
-    if (named.length === 0)
-        return all;
-    const unknown = named.filter((name) => !all.includes(name));
-    if (unknown.length > 0) {
-        throw new Error(`This suite build has no branch called ${unknown.join(', ')}. It asked for: ${all.join(', ')}.`);
-    }
-    return named;
+    const named = namedBranches(request, args);
+    return named.length > 0 ? named : request.branches.map((branch) => branch.suite_kind);
 }
 // Non-null when the runner actually executed the branch. Everything else — no
 // entry, a declared `build_error`, a stack that cannot run it — is a branch that

package/dist/verbs/suitePrepare.js

@@ -2,7 +2,7 @@ import { clearRunState } from "../runner/failureDigest.js";
 import { materializeHelper } from "../files/guardrails.js";
 import { materializeBehavioralWorld } from "../files/behavioral.js";
 import { PACKETS_DIR, structuralSourceFiles, writeSuitePackets, } from "../files/packets.js";
-import { movePreviousRunAside, recipeNameFor, writeSuiteBuildRequest, } from "../files/suiteBuild.js";
+import { isNewBuild, movePreviousRunAside, recipeNameFor, writeSuiteBuildRequest, } from "../files/suiteBuild.js";
 import { bddStepLoading } from "../runner/bdd.js";
 import { bootCheck, SIGNAL_STRENGTH } from "../runner/bootcheck.js";
 import { anyStackPrecheck, behavioralHarnessNotice, detectBddRunner, detectStructuralRunner, runnerReadyPrecheck, } from "../runner/precheck.js";
@@ -100,6 +100,35 @@ export async function suitePrepare(config, args = [], deps) {
     const replaced = alignRunnerEnvironmentWithPlace(config.projectRoot);
     if (replaced)
         actual.stdout.write(`${replaced}\n`);
+    // Spec 37-2, criterion 3, widened by spec 49. The papers a build leaves
+    // behind — plan, checkpoints, answer, review — outlive the `request.json`
+    // they were digested against, and every one of them is refused by its own
+    // gate from here on. The suite files of both branches outlive it too, and
+    // nothing refuses those: the behavioral runner loads its directory whole, so
+    // a dead `.feature` runs and a dead step file argues with a live one. Moved
+    // rather than removed — see `movePreviousRunAside`.
+    //
+    // Here, before the helper and the World are written and before the probe asks
+    // its question (criterion 4): a `conftest.py` from the last build would be
+    // loaded by pytest beside our probe, and a leftover `_setup.ts` would turn the
+    // probe's scouting into a sentence. Only on a new build (criterion 3): a
+    // repeat inside one is the coordinator's second question of the probe (spec
+    // 39), and the setup file written between the two runs has to survive it.
+    //
+    // Wrapped, because a read-only checkout or a permission the move does not
+    // have is a note, not a build that dies before it has asked the server
+    // anything. And nothing is lost if a later step refuses: `request.json` of
+    // the last build is still there, so the next run does not move again.
+    let displaced = { artifacts: [], branches: { structural: 0, behavioral: 0 } };
+    let displaceProblem = '';
+    if (isNewBuild(config.projectRoot)) {
+        try {
+            displaced = movePreviousRunAside(config.projectRoot, detectBddRunner(config.projectRoot));
+        }
+        catch (err) {
+            displaceProblem = err.message;
+        }
+    }
     // Ruby only. This wrote `unitbob_helper.rb` and `rspec.opts` into every
     // project it touched, so a Flask app and a NestJS app each came away with a
     // Ruby file they never asked for and cannot run — the product leaving another
@@ -300,38 +329,22 @@ export async function suitePrepare(config, args = [], deps) {
     // step of the loop, so a failure set remembered from the build before it would
     // stop a branch that has not run once yet.
     clearRunState(config.projectRoot);
-    // Spec 37-2, criterion 3. Same reasoning, applied to the papers that were left
-    // behind rather than cleared: a plan and its checkpoints outlive the
-    // `request.json` they were digested against, and every one of them is refused
-    // by its own gate from here on. Moved rather than removed — see
-    // `movePreviousRunAside`.
-    //
-    // Wrapped for the same reason `buildPackets` is: by this line the request is
-    // written and the build is real. A read-only checkout or a permission the move
-    // does not have is a note, not a build that dies after its own work landed
-    // and before it could say so.
-    let displaced = [];
-    let displaceProblem = '';
-    try {
-        displaced = movePreviousRunAside(config.projectRoot);
-    }
-    catch (err) {
-        displaceProblem = err.message;
-    }
     const kinds = branches.map((branch) => branch.suite_kind).join(' and ');
     const nextCommand = branches.some((branch) => branch.suite_kind === 'behavioral')
         ? '`unitbob suite-review-prepare` before upload'
         : '`unitbob put-suite-build`';
     actual.stdout.write(`Suite build request written to ${request.project_root}/.unitbob/suite-build/request.json\n`);
-    if (displaced.length > 0) {
-        actual.stdout.write(`The previous run's ${displaced.join(', ')} moved to ` +
+    const moved = displacedList(displaced);
+    if (moved.length > 0) {
+        actual.stdout.write(`The previous run's ${moved.join(', ')} moved to ` +
             `${request.project_root}/.unitbob/suite-build/previous/ — none of it is left where this build will ` +
             'look, and none of it was deleted.\n');
     }
     if (displaceProblem) {
         actual.stdout.write(`\nThe previous run's files could not be moved out of the way (${displaceProblem}). This build is fine, ` +
             'but a plan or checkpoint left over from it will be refused by its own gate — the digests belong to ' +
-            'the request that was just replaced.\n');
+            'the request that was just replaced — and running a branch will include files from the previous build ' +
+            'still under .unitbob/structural/ and .unitbob/behavioral/.\n');
     }
     actual.stdout.write(packetNotice(request.project_root, sourcePackets));
     actual.stdout.write(`Next: build ${branches.length === 1 ? 'the' : 'both'} peer ${branches.length === 1 ? 'suite' : 'suites'} (${kinds}) following each branch's \`recipe\` and \`assignment\`, ` +
@@ -403,6 +416,16 @@ export async function suitePrepare(config, args = [], deps) {
             '\n');
     }
 }
+// Everything that moved, in the words the line has always used: the artifacts
+// by name, then each branch as a count (spec 49, criterion 5). By-products that
+// were deleted are not listed — nobody lost them.
+function displacedList(moved) {
+    const branchFiles = (branch) => {
+        const count = moved.branches[branch];
+        return count > 0 ? [`${count} ${branch} ${count === 1 ? 'file' : 'files'}`] : [];
+    };
+    return [...moved.artifacts, ...branchFiles('structural'), ...branchFiles('behavioral')];
+}
 // A checkout we cannot write packets into is a run without packets, not a
 // failed build: the workers search the source themselves, exactly as they did
 // before this spec. The same rule the route inventory follows for the same

package/dist/verbs/validateBuild.js

@@ -93,6 +93,7 @@ function dryRunBatch(config, request, outputs) {
     const items = [];
     const unchecked = [];
     const problems = [];
+    const withoutReview = new Set();
     for (const output of outputs) {
         if (output.build_error) {
             items.push(uploadItem(request, output, undefined));
@@ -108,15 +109,33 @@ function dryRunBatch(config, request, outputs) {
                     problems.push({ branch: output.suite_kind, message: error.message });
                     continue;
                 }
-                unchecked.push(`${output.suite_kind}: the independent review has not been written yet, so the server judged ` +
-                    'this branch without it. Anything it says about bdd_quality_review, known_defect_probe or ' +
-                    'candidate_run is answered later, by `suite-review-prepare` and the reviewer — run this ' +
-                    'command again afterwards for a verdict on the whole branch.');
+                withoutReview.add(output.suite_kind);
+                unchecked.push(`${output.suite_kind}: the independent review has not been written yet, so the server judges ` +
+                    'this branch up to the point where it would read the review. Everything before that — the ' +
+                    'manifest, the markers, the addresses — is checked now; the review itself is answered later, ' +
+                    'by `suite-review-prepare` and the reviewer. Run this command again afterwards for a verdict ' +
+                    'on the whole branch.');
             }
         }
         items.push(uploadItem(request, output, testMetadata));
     }
-    return { items, unchecked, problems };
+    return { items, unchecked, problems, withoutReview };
+}
+// The one refusal a branch sent without its review is expected to get. The
+// server checks the manifest, the markers and the surface arithmetic first and
+// stops at the first rule broken, so reaching *this* rule means everything
+// before it passed — which is the whole answer the pre-review run was after.
+//
+// Printed as a refusal, it was read as one: "must include a bdd_quality_review
+// artifact", right under "Fix them, then run validate-build again", sent a
+// reader looking for a defect in an answer that step 9 forbids from carrying
+// that key in the first place. The text is matched, not reworded — the words on
+// the line below are the server's, and if the server ever says it differently
+// the line stops matching and the refusal is shown as before, which is the safe
+// way for this to go stale.
+const REVIEW_MISSING = /must include a bdd_quality_review artifact/;
+function reachedTheReview(result, withoutReview) {
+    return withoutReview.has(result.suite_kind) && REVIEW_MISSING.test(result.error ?? '');
 }
 function describe(result) {
     const tallies = result.counts
@@ -140,7 +159,7 @@ export async function validateBuild(config, _args = [], deps) {
     };
     const request = readSuiteBuildRequest(config.projectRoot);
     const { outputs, unreadable } = readHostSuiteOutputsPerBranch(request.output_path, request);
-    const { items, unchecked, problems } = dryRunBatch(config, request, outputs);
+    const { items, unchecked, problems, withoutReview } = dryRunBatch(config, request, outputs);
     const local = [
         ...unreadable.map((entry) => ({ branch: entry.suite_kind, message: entry.message })),
         ...collectBuildProblems(request, outputs, unreadable),
@@ -178,7 +197,7 @@ export async function validateBuild(config, _args = [], deps) {
             'instead of checking. Upgrade the server before running validate-build again — and note that this ' +
             'branch is now live.\n');
     }
-    const refused = results.filter((result) => result.status !== WOULD_PUBLISH && result.status !== 'build_error');
+    const refused = results.filter((result) => result.status !== WOULD_PUBLISH && result.status !== 'build_error' && !reachedTheReview(result, withoutReview));
     if (refused.length > 0) {
         throw new Error(`The Unitbob server would refuse this answer:\n${refused.map(rejection).join('\n')}\n` +
             'Those are the server\'s own words. Fix them, then run `unitbob validate-build` again — this round ' +
@@ -188,9 +207,20 @@ export async function validateBuild(config, _args = [], deps) {
     // answer whose every branch is a declared `build_error` is accepted and stores
     // nothing, and reporting that as a suite about to go up would be the one
     // sentence in this output that is not true of what happened.
+    //
+    // A branch that reached the review rule without a review is neither: the
+    // server checked everything before it and stopped where the review would be.
+    // It gets its own line, and the headline does not promise a publish for it.
     const accepted = results.filter((result) => result.status === WOULD_PUBLISH);
+    const pending = results.filter((result) => reachedTheReview(result, withoutReview));
     const headline = accepted.length === 0
-        ? 'The Unitbob server accepted this answer, and it publishes no suite:'
+        ? pending.length === 0
+            ? 'The Unitbob server accepted this answer, and it publishes no suite:'
+            : 'The Unitbob server checked this answer as far as it can before the review:'
         : 'The Unitbob server checked this answer and would publish it:';
-    d.stdout.write(`${headline}\n${results.map(describe).join('\n')}\n${DRY_RUN_DOES_NOT}\n`);
+    const lines = results.map((result) => reachedTheReview(result, withoutReview)
+        ? `  ${result.suite_kind}: checked up to the review — the manifest, the markers and the addresses passed; ` +
+            'the review is what is left'
+        : describe(result));
+    d.stdout.write(`${headline}\n${lines.join('\n')}\n${DRY_RUN_DOES_NOT}\n`);
 }

package/dist/verbs/validateWorkerCheckpoints.js

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync } from 'node:fs';
-import { checkpointPath, readWorkerPlan, requestDigest, validateWorkerPlanFiles, workerPlanDigest, } from "../files/workerPlan.js";
+import { assignedSurfaces, checkpointPath, readWorkerPlan, requestDigest, validateWorkerPlanFiles, workerPlanDigest, } from "../files/workerPlan.js";
 export async function validateWorkerCheckpoints(config, _args = [], deps = { stdout: process.stdout }) {
     const planErrors = validateWorkerPlanFiles(config.projectRoot);
     if (planErrors.length > 0)
@@ -7,6 +7,7 @@ export async function validateWorkerCheckpoints(config, _args = [], deps = { std
     const plan = readWorkerPlan(config.projectRoot);
     const expectedRequestDigest = requestDigest(config.projectRoot);
     const expectedPlanDigest = workerPlanDigest(config.projectRoot);
+    const assigned = assignedSurfaces(config.projectRoot);
     const errors = [];
     for (const item of plan.workers) {
         const label = `${item.branch}:${item.worker_id}`;
@@ -53,6 +54,7 @@ export async function validateWorkerCheckpoints(config, _args = [], deps = { std
         }
         validateCompactFacts(checkpoint.facts, label, errors);
         validateSurfaceCoverage(checkpoint.surface_coverage, item, label, errors);
+        validateUnreachableSurfaces(checkpoint.unreachable_surfaces, item, checkpoint.surface_coverage, assigned, label, errors);
         stringArray(checkpoint.decisions, `${label}: decisions`, errors);
         stringArray(checkpoint.known_problems, `${label}: known_problems`, errors);
     }
@@ -139,6 +141,75 @@ function validateSurfaceCoverage(value, item, label, errors) {
         }
     }
 }
+// Spec 41, criterion 1. Every assigned address ends in one of three places:
+// driven by a Scenario, unreachable, or deferred. Only the first two are answers
+// a worker can give — deferred is whatever is left, worked out where the upload
+// is assembled, so a slice never has to enumerate what it did not do.
+//
+// a2time, 2026-09-05. Eight capabilities left 81 addresses in none of the three,
+// and the server refused the publication after two hours. The workers were not
+// careless: `deferred_surfaces` was only legal past the ceiling of twenty, six of
+// those eight never came near it, and silence was the only move left. Widening
+// the deferred bucket gave them a legal answer; computing it gave them a free
+// one. What stays here is the pair the machine cannot work out on its own.
+//
+// Behavioral only, for the same reason as its neighbour: the structural branch
+// has no addresses to account for.
+function validateUnreachableSurfaces(value, item, coverage, assigned, label, errors) {
+    if (value === undefined && item.branch !== 'behavioral')
+        return;
+    if (!Array.isArray(value)) {
+        errors.push(`${label}: unreachable_surfaces must be an array of {surface, reason} entries, empty when the slice can drive everything it was given`);
+        return;
+    }
+    const driven = new Set(drivenSurfaces(coverage));
+    // Membership is measured against the addresses this slice's own capabilities
+    // were given, never the whole assignment: a neighbour's address is as foreign
+    // as an invented one.
+    const mine = item.capability_ids.flatMap((id) => assigned.get(id) ?? []);
+    const known = new Set(mine);
+    const seen = new Set();
+    for (const [index, entry] of value.entries()) {
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+            errors.push(`${label}: unreachable_surfaces[${index}] must be an object with surface and reason; got ${jsonType(entry)}`);
+            continue;
+        }
+        const record = entry;
+        const surface = record.surface;
+        if (typeof surface !== 'string' || !surface.trim()) {
+            errors.push(`${label}: unreachable_surfaces[${index}].surface must name one address`);
+            continue;
+        }
+        // A reason per address, never one reason for a list. A sentence you cannot
+        // write about *this* address is the signal it is not really unreachable —
+        // which is the whole guard, and the reason this bucket stays narrow while
+        // its neighbour widened.
+        if (typeof record.reason !== 'string' || !record.reason.trim()) {
+            errors.push(`${label}: unreachable_surfaces[${index}].reason must say what has to happen elsewhere for ${surface} to be called`);
+        }
+        if (driven.has(surface)) {
+            errors.push(`${label}: ${surface} is driven by a Scenario and declared unreachable — it is one or the other`);
+        }
+        // Only when the assignment actually listed addresses for this capability.
+        // An assignment that says nothing cannot say a surface is foreign, and
+        // refusing there would refuse honest slices over an absence.
+        if (known.size > 0 && !known.has(surface)) {
+            errors.push(`${label}: ${surface} was not assigned to this slice`);
+        }
+        if (seen.has(surface))
+            errors.push(`${label}: unreachable_surfaces names ${surface} more than once`);
+        else
+            seen.add(surface);
+    }
+}
+function drivenSurfaces(coverage) {
+    if (!Array.isArray(coverage))
+        return [];
+    return coverage.flatMap((entry) => {
+        const surfaces = entry?.surfaces;
+        return Array.isArray(surfaces) ? surfaces.filter((surface) => typeof surface === 'string') : [];
+    });
+}
 function jsonType(value) {
     if (value === null)
         return 'null';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unitbob",
-  "version": "0.7.4",
+  "version": "0.7.7",
   "description": "Unitbob connector — thin local hands for the Unitbob Rails brain. Owns no domain logic: it runs tools, relays bytes over the wire, and prints what the server returns.",
   "type": "module",
   "bin": {

package/plugin/codex/agents/suite-repair-worker.toml

@@ -21,7 +21,7 @@ markers, or paths. Do not edit production code, host-owned shared files, the
 connector-owned harness, or another slice.
 
 After every owned edit, run
-`npx -y --loglevel=error unitbob@0.7.4 run-local <branch>` and inspect the machine
+`npx -y --loglevel=error unitbob@0.7.7 run-local <branch>` and inspect the machine
 report. Look only at examples or scenarios matching your owned paths or case
 markers. Do not require a green exit code from the whole branch: foreign failures
 and an already-confirmed product red do not widen your scope. Repeat the bounded

package/plugin/codex/agents/suite-reviewer.toml

@@ -105,7 +105,15 @@ actually drives, and must equal that Scenario's `surface_coverage` in the
 candidate's metadata. If the two disagree, that is a finding — say it in a
 reservation or an objection rather than adjusting your list to match.
 
-A Scenario that also happens to drive an address belonging to another capability
+The `When`, and only the `When` — the same rule the worker wrote its list by.
+What a `Given` does to arrive (sign in, create the table the Scenario needs) and
+what an `After` does to leave are not the behaviour under test, so an address
+they touch is not missing from `surface_coverage` and not a finding. On soul,
+2026-09-11, every one of seven Scenarios got a reservation for its setup hitting
+`POST /api/tables`, and seven reservations for one worker following its
+instruction to the letter looked like a broken suite.
+
+A Scenario whose `When` also drives an address belonging to another capability
 goes in `reservation`, naming the address. There is no separate field for it and
 none is coming; the text is free-form. One run had that observation, was right
 about it, and withdrew it believing the format had nowhere to put it.
@@ -117,7 +125,7 @@ repair round opens — by the time you are reading, the repair rotation and the
 final run are spent.
 
 What it does do: a capability whose Scenarios were **all** objected to is stored
-`unguarded` at publish — the amber "not yet testable" lamp, never green — and
+`unguarded` at publish — the amber "not guarded yet" lamp, never green — and
 your objection becomes the sentence its owner reads in place of the headline.
 Write it so it reads well there. One objection among sound siblings changes
 nothing: the siblings guard the capability and its green lamp is earned. A

package/plugin/codex/agents/suite-worker.toml

@@ -46,6 +46,22 @@ said about their work; the independent reviewer read the steps instead, six
 Scenarios claimed addresses their steps never drove, and the server refused the
 publication.
 
+Your checkpoint also carries `unreachable_surfaces`, and it is usually empty. An
+address goes there only when *nothing you can do* makes that request happen — a
+third party's callback, a vendor's webhook, a redirect a real account has to
+send. Each one needs its own sentence saying what has to happen elsewhere:
+```json
+{"surface":"GET /oauth2callback","reason":"The provider sends the user back here after they approve access, and no test can cause that."}
+```
+Hard is not unreachable. Authentication, a fixture that takes work, a background
+job, a paid API with a sandbox — all drivable, so drive them.
+
+You do **not** list the addresses you simply did not take. Whatever you neither
+drove nor declared unreachable is the remainder, and the map shows it beside the
+capability as *not taken this time* — "6 of 21 addresses guarded". So take the
+ones that matter first: money, then authorization, then the addresses the rest of
+the code points at most.
+
 Write first, then find out. Start with the planned cases your seeded facts
 already support and get them onto disk; go reading only for what you still lack
 after that. The opposite order — survey the sources, then write — is what spent