unitbob 0.7.6 → 0.7.7

package/dist/files/behavioral.js

@@ -331,19 +331,33 @@ export function filesLostOnMaterialize(projectRoot, artifact, runner) {
     const behavioralRoot = join(projectRoot, BEHAVIORAL_DIR);
     if (!existsSync(behavioralRoot))
         return [];
-    const connectorWorld = behavioralWorldFor(runner);
-    const listed = new Set([
-        artifact.path,
-        ...(artifact.support_files ?? []).map((file) => file.path),
-        ...(connectorWorld ? [connectorWorld.path] : []),
-    ]);
-    const runnerEntries = RUNNER_ENVIRONMENT_ENTRIES[runner] ?? EMPTY_ENTRIES;
+    const listed = new Set([artifact.path, ...(artifact.support_files ?? []).map((file) => file.path)]);
+    const kept = behavioralKeptByConnector(runner);
     return readdirSync(behavioralRoot)
-        .filter((entry) => !runnerEntries.has(entry) && !CONNECTOR_RUN_ARTIFACTS.has(entry))
+        .filter((entry) => !kept.has(entry))
         .flatMap((entry) => filesUnder(projectRoot, `${BEHAVIORAL_DIR}/${entry}`))
-        .filter((path) => !listed.has(path))
+        .filter((path) => !listed.has(path) && !kept.has(path.slice(BEHAVIORAL_DIR.length + 1)) && !isRuntimeByProduct(path))
         .sort();
 }
+// What under the behavioral root is the connector's or the runner's rather than
+// the build's, as paths relative to that root: the installed environment, the
+// connector-owned World, and the report files the run itself writes. One set,
+// read by two callers that must agree — the review warning above, which stays
+// quiet about these, and `movePreviousRunAside` (spec 49), which leaves them in
+// place while everything else the last build wrote goes to `previous/`. A
+// second hand-kept list would let the warning and the move disagree about
+// whose file something is.
+//
+// A runner this connector has no table for keeps nothing but the run's own
+// artifacts, which is the same answer `materializeBehavioral` gives it.
+export function behavioralKeptByConnector(runner) {
+    const world = runner ? behavioralWorldFor(runner) : undefined;
+    return new Set([
+        ...(runner ? RUNNER_ENVIRONMENT_ENTRIES[runner] ?? EMPTY_ENTRIES : EMPTY_ENTRIES),
+        ...(world ? [world.path.slice(BEHAVIORAL_DIR.length + 1)] : []),
+        ...CONNECTOR_RUN_ARTIFACTS,
+    ]);
+}
 // The real files under `relative`. Symlinks are not followed: materialization
 // removes the link, not what it points at, and naming the target here would read
 // as a warning about a file that was never in danger.
@@ -355,6 +369,27 @@ function filesUnder(projectRoot, relative) {
         return [];
     return readdirSync(join(projectRoot, relative)).flatMap((entry) => filesUnder(projectRoot, `${relative}/${entry}`));
 }
+// What the branch's own run leaves behind while it runs: Python's byte-code
+// cache beside every step file, the SQLite database the World opens at start
+// and its journal. Nobody wrote them, the next run makes them again, and the
+// answer could not list them if it tried. On the bench, 2026-09-11, the review
+// warning named fourteen `.pyc` files on microblog and the World's own database
+// on soul as things "running it will delete" — the same way the connector's
+// report files used to be named, and for the same cost: a warning that fires on
+// every review is a warning nobody reads when a step file really is forgotten.
+//
+// Matched anywhere in the path, not only at the top: `__pycache__` sits inside
+// `step_definitions/`, where the top-level filter above never looks.
+//
+// Exported for `movePreviousRunAside` (spec 49), which deletes exactly these
+// rather than carrying them to `previous/` — the same list, so what the warning
+// does not name is what the move does not keep.
+const RUNTIME_BY_PRODUCT_DIRS = new Set(['__pycache__', '.pytest_cache']);
+const RUNTIME_BY_PRODUCT_FILE = /\.(pyc|sqlite|sqlite3|db|db-shm|db-wal|db-journal)$/;
+export function isRuntimeByProduct(relativePath) {
+    const parts = relativePath.split('/');
+    return parts.some((part) => RUNTIME_BY_PRODUCT_DIRS.has(part)) || RUNTIME_BY_PRODUCT_FILE.test(parts[parts.length - 1]);
+}
 export function copyBehavioralRunnerEnvironment(sourceRoot, targetRoot, runner) {
     const entries = RUNNER_ENVIRONMENT_ENTRIES[runner] ?? EMPTY_ENTRIES;
     for (const entry of entries) {

package/dist/files/guardrails.js

@@ -13,6 +13,27 @@ export const HELPER_FILE = 'unitbob_helper.rb';
 // the project's own .rspec (stray --require lines, extra stdout formatters)
 // out of guardrail runs, whose JSON output must stay parseable.
 export const OPTIONS_FILE = 'rspec.opts';
+// The report each structural runner writes beside the suite. Named here rather
+// than in `runner/{rspec,vitest,pytest}.ts`, which build their full paths from
+// these: those modules import this one, and the names are needed below — the
+// same reason `BDD_RUN_ARTIFACTS` is listed where it is written.
+export const RSPEC_RESULT_NAME = 'rspec_result.json';
+export const VITEST_RESULT_NAME = 'vitest_result.json';
+export const PYTEST_RESULT_NAME = 'pytest_result.xml';
+// What under the structural root is the connector's rather than the build's,
+// as paths relative to that root (spec 49): the Ruby boot kit and the runners'
+// reports. `movePreviousRunAside` leaves these in place and moves everything
+// else — including `_setup.ts` and a `conftest.py`, which are the *last*
+// build's preparation, written against its files. The same set whatever the
+// runner: a Ruby helper in a Python project is litter `suite-prepare` no longer
+// writes, and moving it to `previous/` would only move the litter.
+export const STRUCTURAL_KEPT_BY_CONNECTOR = new Set([
+    HELPER_FILE,
+    OPTIONS_FILE,
+    RSPEC_RESULT_NAME,
+    VITEST_RESULT_NAME,
+    PYTEST_RESULT_NAME,
+]);
 // The one place that decides whether a host-provided suite path is safe to
 // write: relative, anchored under .unitbob/guardrails/, no traversal. Anything
 // else throws and nothing is written.

package/dist/files/suiteBuild.js

@@ -1,7 +1,9 @@
-import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { dirname, join, sep } from 'node:path';
 import { assertUnitbobPath } from "./artifactPath.js";
+import { BEHAVIORAL_DIR, behavioralKeptByConnector, isRuntimeByProduct } from "./behavioral.js";
+import { GUARDRAILS_DIR, STRUCTURAL_KEPT_BY_CONNECTOR } from "./guardrails.js";
 import { readWorkerPlan, validateWorkerPlanFiles, workerPlanDigest, workerPlanPath } from "./workerPlan.js";
 export function requestPath(projectRoot) {
     return join(projectRoot, '.unitbob', 'suite-build', 'request.json');
@@ -18,14 +20,29 @@ export function reviewRequestPath(projectRoot) {
 export function candidateRunPath(projectRoot) {
     return join(projectRoot, '.unitbob', 'suite-build', 'candidate-run.json');
 }
-// Spec 37-2, criterion 3. What a new build leaves behind, in the order a reader
+// Spec 37-2, criterion 3. What a build leaves behind, in the order a reader
 // meets it: the plan, the checkpoints written against that plan, and the answer
 // assembled from them. All three are bound to the `request.json` this run is
 // about to overwrite, so from the next line on they are a previous run's papers
 // wearing this run's filenames — which is exactly the confusion the coordinator
 // used to spend a turn untangling before fan-out.
-const PREVIOUS_RUN_ARTIFACTS = ['worker-plan.json', 'checkpoints', 'suite_output.json'];
+const BUILD_PAPERS = ['worker-plan.json', 'checkpoints', 'suite_output.json'];
+// Spec 49. And the three the review writes, bound to the candidate that build
+// ran: left behind, a stale `behavioral_review.json` fails `validate-build` with
+// a sentence about the reviewer.
+const PREVIOUS_RUN_ARTIFACTS = [...BUILD_PAPERS, 'behavioral_review.json', 'candidate-run.json', 'review-request.json'];
 const PREVIOUS_DIR = 'previous';
+// Is the `suite-prepare` about to run the first step of a new build, or a
+// repeat inside one? Spec 49, criterion 3. A new build is one with a plan, a
+// checkpoint set or an answer on disk from the build before — or no
+// `request.json` at all, which is a machine that has never built here (and may
+// hold a suite that `check` materialized from the published one). A request
+// with no plan yet is the coordinator's second question of the probe (spec 39):
+// nothing moves then, so the `_setup.ts` written between the two runs survives.
+export function isNewBuild(projectRoot) {
+    const buildDir = join(projectRoot, '.unitbob', 'suite-build');
+    return !existsSync(requestPath(projectRoot)) || BUILD_PAPERS.some((name) => existsSync(join(buildDir, name)));
+}
 // Moved, never removed. A run costs hours and real money, and one interrupt plus
 // one restart must not be able to spend that twice — `previous/` is one line
 // more than `rmSync` and it is the line that makes a restart survivable.
@@ -37,18 +54,98 @@ const PREVIOUS_DIR = 'previous';
 // finished checkpoints and answer of the run before it with no way back. A
 // `previous/` holding pieces of two runs is worth strictly more than an empty
 // one, and every piece in it is named by the file it kept.
-export function movePreviousRunAside(projectRoot) {
+//
+// Since spec 49 the same rule covers the branches' own directories. The
+// behavioral runner loads its directory whole, so a `.feature` the last build
+// wrote runs under this build's markers and a dead step file argues with a live
+// one over the same step text; on the bench (2026-09-11) two workers reworded
+// their steps to dodge files nobody had written this build. Every file the last
+// build wrote under `.unitbob/structural/` and `.unitbob/behavioral/` goes to
+// `previous/<branch>/` under the same relative path — `_setup.ts` and a
+// `conftest.py` included, since they are the last build's preparation, written
+// against its files. What stays is what the connector and the runner own
+// (`STRUCTURAL_KEPT_BY_CONNECTOR`, `behavioralKeptByConnector`); what the run
+// itself dropped — byte-code caches, the World's database — is deleted, because
+// nobody wrote it and the next run makes it again.
+//
+// `behavioralRunner` is the runner that branch is under, so the move knows
+// which installed environment and which World are that runner's; null when
+// none is known, and then only what every runner shares is kept. The structural
+// side needs no runner: its kept set is the same for all three.
+export function movePreviousRunAside(projectRoot, behavioralRunner) {
     const buildDir = join(projectRoot, '.unitbob', 'suite-build');
-    const found = PREVIOUS_RUN_ARTIFACTS.filter((name) => existsSync(join(buildDir, name)));
-    if (found.length === 0)
-        return [];
     const previous = join(buildDir, PREVIOUS_DIR);
-    mkdirSync(previous, { recursive: true });
+    const found = PREVIOUS_RUN_ARTIFACTS.filter((name) => existsSync(join(buildDir, name)));
+    if (found.length > 0)
+        mkdirSync(previous, { recursive: true });
     for (const name of found) {
         rmSync(join(previous, name), { recursive: true, force: true });
         renameSync(join(buildDir, name), join(previous, name));
     }
-    return found;
+    return {
+        artifacts: found,
+        branches: {
+            structural: moveBranchAside(join(projectRoot, GUARDRAILS_DIR), join(previous, 'structural'), STRUCTURAL_KEPT_BY_CONNECTOR),
+            behavioral: moveBranchAside(join(projectRoot, BEHAVIORAL_DIR), join(previous, 'behavioral'), behavioralKeptByConnector(behavioralRunner)),
+        },
+    };
+}
+// One branch directory: the build's files to `target` under the same relative
+// paths, `kept` left where it is, by-products deleted. Returns how many files
+// moved.
+//
+// Collected first, moved second, so that a branch with nothing of the build's
+// in it leaves the `previous/<branch>/` of the build before alone — the
+// per-artifact rule above, applied to a directory. When there is something to
+// move, the target is replaced whole: `previous/` holds one previous build, not
+// an archive. The clearing happens before the first rename, so a rename that
+// fails halfway (a full disk, a permission) leaves `previous/<branch>/` holding
+// only what moved so far; the files that did not move are still where they
+// were, and nothing is lost, which is the promise this function makes.
+//
+// The directories the files leave behind are removed too, so the branch root
+// reads as what it is — empty of the last build — rather than as its skeleton.
+// Deepest first, and only when empty: a directory holding a kept file (the
+// World inside `step_definitions/`) keeps its file and stays.
+function moveBranchAside(root, target, kept) {
+    if (!existsSync(root))
+        return 0;
+    const moving = [];
+    collectBuildFiles(root, '', kept, moving);
+    if (moving.length === 0)
+        return 0;
+    rmSync(target, { recursive: true, force: true });
+    for (const relative of moving) {
+        const destination = join(target, relative);
+        mkdirSync(dirname(destination), { recursive: true });
+        renameSync(join(root, relative), destination);
+    }
+    const emptied = new Set(moving.map((relative) => dirname(relative)).filter((dir) => dir !== '.'));
+    for (const dir of [...emptied].sort((a, b) => b.length - a.length)) {
+        for (let ancestor = dir; ancestor !== '.'; ancestor = dirname(ancestor)) {
+            if (readdirSync(join(root, ancestor)).length > 0)
+                break;
+            rmSync(join(root, ancestor), { recursive: true });
+        }
+    }
+    return moving.length;
+}
+// A symlink is a file here: it moves as a link, and what it points at is never
+// touched — the same reading `filesUnder` gives the review warning.
+function collectBuildFiles(root, relative, kept, into) {
+    for (const entry of readdirSync(join(root, relative))) {
+        const path = relative ? `${relative}/${entry}` : entry;
+        if (kept.has(path))
+            continue;
+        if (isRuntimeByProduct(path)) {
+            rmSync(join(root, path), { recursive: true, force: true });
+            continue;
+        }
+        if (lstatSync(join(root, path)).isDirectory())
+            collectBuildFiles(root, path, kept, into);
+        else
+            into.push(path);
+    }
 }
 export function writeBehavioralReviewRequest(projectRoot, output, candidateRun, knownDefectContext = { status: 'not_supplied' }, fixedCandidateRun) {
     const metadata = output.test_metadata;

package/dist/proc.js

@@ -66,18 +66,47 @@ export function runProcess(command, args = [], options = {}) {
         child.on('close', (code) => finish({ stdout, stderr, code: timedOut ? null : code }));
     });
 }
-export async function requireGraphify() {
+// The oldest graphify the map may be built with. Below it, `detect.py` drops
+// any file whose name ends in `token`, `secret`, `password` or `credential` as
+// a probable secret store — by the name alone, before the file is parsed, and
+// without a word on stdout: `graphify update` never prints the list it keeps.
+// On the bench, 2026-09-11, that took `app/api/tokens.py` out of microblog and
+// `src/controllers/auth/token.js` out of soul, so both maps were built without
+// the sign-in code and nothing said so. `.graphifyignore` cannot re-include a
+// file graphify has decided is sensitive, so the only cure is the release that
+// exempts real source files (`.py`, `.js`, `.ts`, `.rb`) from that rule, and
+// 0.9.18 is the first one that does — checked release by release.
+export const GRAPHIFY_MIN_VERSION = '0.9.18';
+const GRAPHIFY_INSTALL = '`pip install graphifyy && graphify install` (PyPI package "graphifyy", command "graphify", needs Python 3.10+)';
+export async function requireGraphify(run = runProcess) {
+    let result;
     try {
-        const result = await runProcess('graphify', ['--help']);
-        if (result.code === 0)
-            return;
-        throw new Error(result.stderr.trim() || result.stdout.trim() || `graphify --help exited ${result.code}`);
+        result = await run('graphify', ['--version']);
     }
     catch (err) {
-        throw new Error(`graphify is required but was not found or did not run. Install it with ` +
-            `\`pip install graphifyy && graphify install\` (PyPI package "graphifyy", command ` +
-            `"graphify", needs Python 3.10+), then retry (${err.message}).`);
+        throw new Error(`graphify is required but was not found or did not run. Install it with ${GRAPHIFY_INSTALL}, ` +
+            `then retry (${err.message}).`);
     }
+    // `graphify 0.9.58` on stdout. A release too old to answer `--version` at all
+    // (0.7.x says "unknown command") is older than the floor by definition, so it
+    // is refused with the same sentence rather than a different one.
+    const version = /\bgraphify\s+(\d+\.\d+\.\d+)/.exec(result.stdout)?.[1];
+    if (version && !olderThan(version, GRAPHIFY_MIN_VERSION))
+        return;
+    const found = version ?? (result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`);
+    throw new Error(`graphify ${found} is installed, and Unitbob needs ${GRAPHIFY_MIN_VERSION} or newer. Older releases ` +
+        `silently leave out any source file whose name ends in "token", "secret" or "password" — ` +
+        `the sign-in code, typically — so the map would be built without it and nobody would be told. ` +
+        `Upgrade with \`pip install --upgrade graphifyy\`, then retry.`);
+}
+function olderThan(version, floor) {
+    const a = version.split('.').map(Number);
+    const b = floor.split('.').map(Number);
+    for (let i = 0; i < 3; i += 1) {
+        if (a[i] !== b[i])
+            return a[i] < b[i];
+    }
+    return false;
 }
 // Paths that hold no business logic in the stacks unitbob supports — Rails,
 // JS/TS, Python — and that graphify does not already skip (it drops

package/dist/runner/bootcheck.js

@@ -286,16 +286,27 @@ ${imports}
 test('the modules our guardrails import all load', () => {});
 `;
 }
-// Python imports modules, not files, so the probe does the translation itself.
-// The module is registered in `sys.modules` before it is executed, because a
-// module that is not there yet cannot be the target of its own relative
-// imports.
-//
-// This is the one part of spec 38 that no live project has exercised: there was
-// no Python project on the bench. Worth watching on the first Python run.
+// Python imports modules, not files, so the probe does the translation itself —
+// and then imports by name, exactly as a guardrail's `from app.models import
+// User` will (spec 50). Not `spec_from_file_location` + `exec_module`, which is
+// what stood here until 2026-09-11: that executes the file whether or not it is
+// already loaded. On microblog the first target, `app/__init__.py`, does `from
+// app import models`, so by the time the loop reached `app/models.py` the module
+// was in `sys.modules` and got run a second time — SQLAlchemy answered "Table
+// 'followers' is already defined for this MetaData instance", and a healthy
+// Flask application lost its structural branch. `import_module` reads
+// `sys.modules` first, names `app/__init__.py` `app` rather than `app.__init__`,
+// and goes through the finders, so the probe asks the run's question and no
+// stricter one (`docs/adr/0001`). Where it still differs: `sys.path.insert(0,
+// ROOT)` puts the project root first, which `-m pytest` run from that root does
+// on its own — every interpreter `locateRunner` returns is invoked that way — so
+// the line is the run's assumption made visible, not an addition to it. A
+// src-layout project, whose guardrails import `pkg.mod` with `src/` on the
+// path, is named `src.pkg.mod` here and would be refused; no such project has
+// reached the bench, and the spec records it as work not done.
 function pytestProbeSource(sourceFiles) {
     return `# Written by the unitbob connector before the boot check — do not edit.
-import importlib.util
+import importlib
 import pathlib
 import sys
 
@@ -313,12 +324,9 @@ def test_the_modules_our_guardrails_import_all_load():
         if not rel.endswith(".py"):
             continue
         name = rel[:-3].replace("/", ".")
-        spec = importlib.util.spec_from_file_location(name, ROOT / rel)
-        if spec is None or spec.loader is None:
-            continue
-        module = importlib.util.module_from_spec(spec)
-        sys.modules[name] = module
-        spec.loader.exec_module(module)
+        if name.endswith(".__init__"):
+            name = name[: -len(".__init__")]
+        importlib.import_module(name)
 `;
 }
 // Runs one command, turning "this binary is not on the machine" into null (the

package/dist/runner/pytest.js

@@ -1,11 +1,11 @@
 import { writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { GUARDRAILS_DIR } from "../files/guardrails.js";
+import { GUARDRAILS_DIR, PYTEST_RESULT_NAME } from "../files/guardrails.js";
 import { projectRootAsSeenByThePlace, runInProject } from "./place.js";
 import { locateRunner } from "./toolchain.js";
 import { clearReport, readFreshReport } from "./types.js";
 export const PYTEST_TIMEOUT_MS = 10 * 60 * 1000;
-export const PYTEST_RESULT_FILE = join(GUARDRAILS_DIR, 'pytest_result.xml');
+export const PYTEST_RESULT_FILE = join(GUARDRAILS_DIR, PYTEST_RESULT_NAME);
 // A minimal runtime config, created or overwritten before each run and passed
 // via `-c` so the project's own addopts (e.g. --cov, -n auto) cannot break the
 // guardrail run or its JUnit output. Connector-owned: never stored in Rails,

package/dist/runner/rspec.js

@@ -1,5 +1,5 @@
 import { join } from 'node:path';
-import { GUARDRAILS_DIR, OPTIONS_FILE } from "../files/guardrails.js";
+import { GUARDRAILS_DIR, OPTIONS_FILE, RSPEC_RESULT_NAME } from "../files/guardrails.js";
 import { projectRootAsSeenByThePlace, runInProject } from "./place.js";
 import { locateRunner } from "./toolchain.js";
 import { clearReport, readFreshReport } from "./types.js";
@@ -8,7 +8,7 @@ export const RSPEC_TIMEOUT_MS = 10 * 60 * 1000;
 // green→red flip can never come from run-order nondeterminism. It does not inherit
 // the project's random ordering.
 export const RSPEC_SEED = '1';
-export const RSPEC_RESULT_FILE = join(GUARDRAILS_DIR, 'rspec_result.json');
+export const RSPEC_RESULT_FILE = join(GUARDRAILS_DIR, RSPEC_RESULT_NAME);
 // Run the materialised Unitbob guardrail suite (spec 26). Only these files run —
 // never the project's full suite — under RAILS_ENV=test with a fixed order/seed.
 // --options points at the materialized empty file so the project's own .rspec

package/dist/runner/vitest.js

@@ -1,11 +1,11 @@
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { GUARDRAILS_DIR } from "../files/guardrails.js";
+import { GUARDRAILS_DIR, VITEST_RESULT_NAME } from "../files/guardrails.js";
 import { projectRootAsSeenByThePlace, runInProject } from "./place.js";
 import { locateRunner } from "./toolchain.js";
 import { clearReport, readFreshReport } from "./types.js";
 export const VITEST_TIMEOUT_MS = 10 * 60 * 1000;
-export const VITEST_RESULT_FILE = join(GUARDRAILS_DIR, 'vitest_result.json');
+export const VITEST_RESULT_FILE = join(GUARDRAILS_DIR, VITEST_RESULT_NAME);
 // A connector-owned Vitest config, written next to .unitbob/ before a run when
 // the project has its own config. Connector-owned: never stored in Rails, never
 // part of the suite digest.

package/dist/verbs/runLocal.js

@@ -76,7 +76,13 @@ function compareFailures(config, d, suiteKind, ran, before) {
     rememberFailures(config.projectRoot, suiteKind, digest);
     if (digest !== before)
         return false;
-    d.stdout.write(`\nStopping ${suiteKind}: it just failed the same ${failures.length} case(s) as the previous run, ` +
+    // The number is the one the reader has just counted in the list above — every
+    // failed case — not the size of the compared set. That set is keyed on marker,
+    // file and first line, so seven Scenarios under one marker failing the same
+    // way are one entry in it; on soul, 2026-09-11, this line said "the same
+    // 1 case(s)" under a list of seven, and read as a counting error.
+    const reported = reportedFailures(ran.runner, ran.result.report)?.length ?? failures.length;
+    d.stdout.write(`\nStopping ${suiteKind}: it just failed the same ${reported} case(s) as the previous run, ` +
         'down to the first line of every message. The edits since then changed nothing this run can see.\n' +
         'Look at the failures yourself, replan the slice, or record the branch as a build_error. ' +
         'Running it again unchanged prints this same line.\n');

package/dist/verbs/suitePrepare.js

@@ -2,7 +2,7 @@ import { clearRunState } from "../runner/failureDigest.js";
 import { materializeHelper } from "../files/guardrails.js";
 import { materializeBehavioralWorld } from "../files/behavioral.js";
 import { PACKETS_DIR, structuralSourceFiles, writeSuitePackets, } from "../files/packets.js";
-import { movePreviousRunAside, recipeNameFor, writeSuiteBuildRequest, } from "../files/suiteBuild.js";
+import { isNewBuild, movePreviousRunAside, recipeNameFor, writeSuiteBuildRequest, } from "../files/suiteBuild.js";
 import { bddStepLoading } from "../runner/bdd.js";
 import { bootCheck, SIGNAL_STRENGTH } from "../runner/bootcheck.js";
 import { anyStackPrecheck, behavioralHarnessNotice, detectBddRunner, detectStructuralRunner, runnerReadyPrecheck, } from "../runner/precheck.js";
@@ -100,6 +100,35 @@ export async function suitePrepare(config, args = [], deps) {
     const replaced = alignRunnerEnvironmentWithPlace(config.projectRoot);
     if (replaced)
         actual.stdout.write(`${replaced}\n`);
+    // Spec 37-2, criterion 3, widened by spec 49. The papers a build leaves
+    // behind — plan, checkpoints, answer, review — outlive the `request.json`
+    // they were digested against, and every one of them is refused by its own
+    // gate from here on. The suite files of both branches outlive it too, and
+    // nothing refuses those: the behavioral runner loads its directory whole, so
+    // a dead `.feature` runs and a dead step file argues with a live one. Moved
+    // rather than removed — see `movePreviousRunAside`.
+    //
+    // Here, before the helper and the World are written and before the probe asks
+    // its question (criterion 4): a `conftest.py` from the last build would be
+    // loaded by pytest beside our probe, and a leftover `_setup.ts` would turn the
+    // probe's scouting into a sentence. Only on a new build (criterion 3): a
+    // repeat inside one is the coordinator's second question of the probe (spec
+    // 39), and the setup file written between the two runs has to survive it.
+    //
+    // Wrapped, because a read-only checkout or a permission the move does not
+    // have is a note, not a build that dies before it has asked the server
+    // anything. And nothing is lost if a later step refuses: `request.json` of
+    // the last build is still there, so the next run does not move again.
+    let displaced = { artifacts: [], branches: { structural: 0, behavioral: 0 } };
+    let displaceProblem = '';
+    if (isNewBuild(config.projectRoot)) {
+        try {
+            displaced = movePreviousRunAside(config.projectRoot, detectBddRunner(config.projectRoot));
+        }
+        catch (err) {
+            displaceProblem = err.message;
+        }
+    }
     // Ruby only. This wrote `unitbob_helper.rb` and `rspec.opts` into every
     // project it touched, so a Flask app and a NestJS app each came away with a
     // Ruby file they never asked for and cannot run — the product leaving another
@@ -300,38 +329,22 @@ export async function suitePrepare(config, args = [], deps) {
     // step of the loop, so a failure set remembered from the build before it would
     // stop a branch that has not run once yet.
     clearRunState(config.projectRoot);
-    // Spec 37-2, criterion 3. Same reasoning, applied to the papers that were left
-    // behind rather than cleared: a plan and its checkpoints outlive the
-    // `request.json` they were digested against, and every one of them is refused
-    // by its own gate from here on. Moved rather than removed — see
-    // `movePreviousRunAside`.
-    //
-    // Wrapped for the same reason `buildPackets` is: by this line the request is
-    // written and the build is real. A read-only checkout or a permission the move
-    // does not have is a note, not a build that dies after its own work landed
-    // and before it could say so.
-    let displaced = [];
-    let displaceProblem = '';
-    try {
-        displaced = movePreviousRunAside(config.projectRoot);
-    }
-    catch (err) {
-        displaceProblem = err.message;
-    }
     const kinds = branches.map((branch) => branch.suite_kind).join(' and ');
     const nextCommand = branches.some((branch) => branch.suite_kind === 'behavioral')
         ? '`unitbob suite-review-prepare` before upload'
         : '`unitbob put-suite-build`';
     actual.stdout.write(`Suite build request written to ${request.project_root}/.unitbob/suite-build/request.json\n`);
-    if (displaced.length > 0) {
-        actual.stdout.write(`The previous run's ${displaced.join(', ')} moved to ` +
+    const moved = displacedList(displaced);
+    if (moved.length > 0) {
+        actual.stdout.write(`The previous run's ${moved.join(', ')} moved to ` +
             `${request.project_root}/.unitbob/suite-build/previous/ — none of it is left where this build will ` +
             'look, and none of it was deleted.\n');
     }
     if (displaceProblem) {
         actual.stdout.write(`\nThe previous run's files could not be moved out of the way (${displaceProblem}). This build is fine, ` +
             'but a plan or checkpoint left over from it will be refused by its own gate — the digests belong to ' +
-            'the request that was just replaced.\n');
+            'the request that was just replaced — and running a branch will include files from the previous build ' +
+            'still under .unitbob/structural/ and .unitbob/behavioral/.\n');
     }
     actual.stdout.write(packetNotice(request.project_root, sourcePackets));
     actual.stdout.write(`Next: build ${branches.length === 1 ? 'the' : 'both'} peer ${branches.length === 1 ? 'suite' : 'suites'} (${kinds}) following each branch's \`recipe\` and \`assignment\`, ` +
@@ -403,6 +416,16 @@ export async function suitePrepare(config, args = [], deps) {
             '\n');
     }
 }
+// Everything that moved, in the words the line has always used: the artifacts
+// by name, then each branch as a count (spec 49, criterion 5). By-products that
+// were deleted are not listed — nobody lost them.
+function displacedList(moved) {
+    const branchFiles = (branch) => {
+        const count = moved.branches[branch];
+        return count > 0 ? [`${count} ${branch} ${count === 1 ? 'file' : 'files'}`] : [];
+    };
+    return [...moved.artifacts, ...branchFiles('structural'), ...branchFiles('behavioral')];
+}
 // A checkout we cannot write packets into is a run without packets, not a
 // failed build: the workers search the source themselves, exactly as they did
 // before this spec. The same rule the route inventory follows for the same

package/dist/verbs/validateBuild.js

@@ -93,6 +93,7 @@ function dryRunBatch(config, request, outputs) {
     const items = [];
     const unchecked = [];
     const problems = [];
+    const withoutReview = new Set();
     for (const output of outputs) {
         if (output.build_error) {
             items.push(uploadItem(request, output, undefined));
@@ -108,15 +109,33 @@ function dryRunBatch(config, request, outputs) {
                     problems.push({ branch: output.suite_kind, message: error.message });
                     continue;
                 }
-                unchecked.push(`${output.suite_kind}: the independent review has not been written yet, so the server judged ` +
-                    'this branch without it. Anything it says about bdd_quality_review, known_defect_probe or ' +
-                    'candidate_run is answered later, by `suite-review-prepare` and the reviewer — run this ' +
-                    'command again afterwards for a verdict on the whole branch.');
+                withoutReview.add(output.suite_kind);
+                unchecked.push(`${output.suite_kind}: the independent review has not been written yet, so the server judges ` +
+                    'this branch up to the point where it would read the review. Everything before that — the ' +
+                    'manifest, the markers, the addresses — is checked now; the review itself is answered later, ' +
+                    'by `suite-review-prepare` and the reviewer. Run this command again afterwards for a verdict ' +
+                    'on the whole branch.');
             }
         }
         items.push(uploadItem(request, output, testMetadata));
     }
-    return { items, unchecked, problems };
+    return { items, unchecked, problems, withoutReview };
+}
+// The one refusal a branch sent without its review is expected to get. The
+// server checks the manifest, the markers and the surface arithmetic first and
+// stops at the first rule broken, so reaching *this* rule means everything
+// before it passed — which is the whole answer the pre-review run was after.
+//
+// Printed as a refusal, it was read as one: "must include a bdd_quality_review
+// artifact", right under "Fix them, then run validate-build again", sent a
+// reader looking for a defect in an answer that step 9 forbids from carrying
+// that key in the first place. The text is matched, not reworded — the words on
+// the line below are the server's, and if the server ever says it differently
+// the line stops matching and the refusal is shown as before, which is the safe
+// way for this to go stale.
+const REVIEW_MISSING = /must include a bdd_quality_review artifact/;
+function reachedTheReview(result, withoutReview) {
+    return withoutReview.has(result.suite_kind) && REVIEW_MISSING.test(result.error ?? '');
 }
 function describe(result) {
     const tallies = result.counts
@@ -140,7 +159,7 @@ export async function validateBuild(config, _args = [], deps) {
     };
     const request = readSuiteBuildRequest(config.projectRoot);
     const { outputs, unreadable } = readHostSuiteOutputsPerBranch(request.output_path, request);
-    const { items, unchecked, problems } = dryRunBatch(config, request, outputs);
+    const { items, unchecked, problems, withoutReview } = dryRunBatch(config, request, outputs);
     const local = [
         ...unreadable.map((entry) => ({ branch: entry.suite_kind, message: entry.message })),
         ...collectBuildProblems(request, outputs, unreadable),
@@ -178,7 +197,7 @@ export async function validateBuild(config, _args = [], deps) {
             'instead of checking. Upgrade the server before running validate-build again — and note that this ' +
             'branch is now live.\n');
     }
-    const refused = results.filter((result) => result.status !== WOULD_PUBLISH && result.status !== 'build_error');
+    const refused = results.filter((result) => result.status !== WOULD_PUBLISH && result.status !== 'build_error' && !reachedTheReview(result, withoutReview));
     if (refused.length > 0) {
         throw new Error(`The Unitbob server would refuse this answer:\n${refused.map(rejection).join('\n')}\n` +
             'Those are the server\'s own words. Fix them, then run `unitbob validate-build` again — this round ' +
@@ -188,9 +207,20 @@ export async function validateBuild(config, _args = [], deps) {
     // answer whose every branch is a declared `build_error` is accepted and stores
     // nothing, and reporting that as a suite about to go up would be the one
     // sentence in this output that is not true of what happened.
+    //
+    // A branch that reached the review rule without a review is neither: the
+    // server checked everything before it and stopped where the review would be.
+    // It gets its own line, and the headline does not promise a publish for it.
     const accepted = results.filter((result) => result.status === WOULD_PUBLISH);
+    const pending = results.filter((result) => reachedTheReview(result, withoutReview));
     const headline = accepted.length === 0
-        ? 'The Unitbob server accepted this answer, and it publishes no suite:'
+        ? pending.length === 0
+            ? 'The Unitbob server accepted this answer, and it publishes no suite:'
+            : 'The Unitbob server checked this answer as far as it can before the review:'
         : 'The Unitbob server checked this answer and would publish it:';
-    d.stdout.write(`${headline}\n${results.map(describe).join('\n')}\n${DRY_RUN_DOES_NOT}\n`);
+    const lines = results.map((result) => reachedTheReview(result, withoutReview)
+        ? `  ${result.suite_kind}: checked up to the review — the manifest, the markers and the addresses passed; ` +
+            'the review is what is left'
+        : describe(result));
+    d.stdout.write(`${headline}\n${lines.join('\n')}\n${DRY_RUN_DOES_NOT}\n`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unitbob",
-  "version": "0.7.6",
+  "version": "0.7.7",
   "description": "Unitbob connector — thin local hands for the Unitbob Rails brain. Owns no domain logic: it runs tools, relays bytes over the wire, and prints what the server returns.",
   "type": "module",
   "bin": {

package/plugin/codex/agents/suite-repair-worker.toml

@@ -21,7 +21,7 @@ markers, or paths. Do not edit production code, host-owned shared files, the
 connector-owned harness, or another slice.
 
 After every owned edit, run
-`npx -y --loglevel=error unitbob@0.7.6 run-local <branch>` and inspect the machine
+`npx -y --loglevel=error unitbob@0.7.7 run-local <branch>` and inspect the machine
 report. Look only at examples or scenarios matching your owned paths or case
 markers. Do not require a green exit code from the whole branch: foreign failures
 and an already-confirmed product red do not widen your scope. Repeat the bounded

package/plugin/codex/agents/suite-reviewer.toml

@@ -105,7 +105,15 @@ actually drives, and must equal that Scenario's `surface_coverage` in the
 candidate's metadata. If the two disagree, that is a finding — say it in a
 reservation or an objection rather than adjusting your list to match.
 
-A Scenario that also happens to drive an address belonging to another capability
+The `When`, and only the `When` — the same rule the worker wrote its list by.
+What a `Given` does to arrive (sign in, create the table the Scenario needs) and
+what an `After` does to leave are not the behaviour under test, so an address
+they touch is not missing from `surface_coverage` and not a finding. On soul,
+2026-09-11, every one of seven Scenarios got a reservation for its setup hitting
+`POST /api/tables`, and seven reservations for one worker following its
+instruction to the letter looked like a broken suite.
+
+A Scenario whose `When` also drives an address belonging to another capability
 goes in `reservation`, naming the address. There is no separate field for it and
 none is coming; the text is free-form. One run had that observation, was right
 about it, and withdrew it believing the format had nowhere to put it.
@@ -117,7 +125,7 @@ repair round opens — by the time you are reading, the repair rotation and the
 final run are spent.
 
 What it does do: a capability whose Scenarios were **all** objected to is stored
-`unguarded` at publish — the amber "not yet testable" lamp, never green — and
+`unguarded` at publish — the amber "not guarded yet" lamp, never green — and
 your objection becomes the sentence its owner reads in place of the headline.
 Write it so it reads well there. One objection among sound siblings changes
 nothing: the siblings guard the capability and its green lamp is earned. A