Merge remote-tracking branch 'gitea/master' into bugfix-contract

style: ruff format added files (CI lint format-check)
style: ruff format discharge checker (CI lint format-check)
2026-09-07 21:00:58 +01:00 · 2026-09-07 20:46:57 +01:00 · 2026-09-07 20:46:41 +01:00 · 2026-09-07 17:46:46 +01:00 · 2026-09-07 17:15:23 +01:00 · 2026-09-07 16:59:04 +01:00
22 changed files with 502 additions and 1064 deletions
@@ -1,28 +0,0 @@
-# #149 Coverage ratchet — both floors live here, and they only ever rise.
-# Doctrine (issue #149 evidence trail): CPython devguide — "any increase is a
-# good one"; a floor is committed once measured and never lowered afterwards.
-#
-#   Global floor  = [report] fail_under below (measured 2026-09-07 at the
-#                   #149 baseline; raise it when coverage grows, never lower).
-#   Changed-lines floor = diff-cover --fail-under=70 in .gitea/workflows/ci.yml
-#                   (changed code may not reduce tested coverage; 70% start,
-#                   ratchetable upward after the first clean pass).
-#
-# Regenerating the CI lock after touching this file is NOT required (tool
-# config, not a dependency), but the floors above are contract: edit them
-# only to raise.
-#
-# Canary files are omitted: src/rune/canary_*.py are standalone CI
-# verification scripts executed directly by the canary job, never imported by
-# the test suite — counting them would make the global floor a fiction.
-
-[run]
-source = src/rune
-omit =
-    tests/*
-    scripts/*
-    src/rune/canary_*.py
-
-[report]
-fail_under = 29
-show_missing = False
@@ -14,25 +14,10 @@ jobs:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 0
-      - name: Create lint environment from lock
+      - name: Create lint environment from manifest
        run: |
-          # #150: deps come ONLY from the pinned lock; the project itself is
-          # installed with --no-deps so nothing floats outside requirements-ci.txt.
          python3 -m venv .ci-venv
-          .ci-venv/bin/pip install --disable-pip-version-check -r requirements-ci.txt
-          .ci-venv/bin/pip install --disable-pip-version-check -e . --no-deps
-      - name: Dependency lock drift ratchet
-        run: |
-          # #150: fail the job if requirements-ci.txt no longer matches
-          # pyproject.toml. uv is not on runners; install it pinned into the
-          # lint venv (tool-only, not a project dependency).
-          .ci-venv/bin/pip install --disable-pip-version-check uv==0.10.11
-          # #150 gate review: the checker must resolve the PINNED uv (in
-          # .ci-venv/bin), not a stray /usr/bin/uv with a different resolver
-          # version — export the venv first; the checker also prefers the
-          # interpreter-adjacent uv as a second line of defense.
-          export PATH="$PWD/.ci-venv/bin:$PATH"
-          .ci-venv/bin/python scripts/check_dep_lock.py
+          .ci-venv/bin/pip install --disable-pip-version-check -e ".[dev]"
      - name: Reject syntax and undefined-name errors
        run: |
          BASE=$(python3 -c 'import json, os; event=json.load(open(os.environ["GITHUB_EVENT_PATH"])); print(event.get("pull_request", {}).get("base", {}).get("sha") or event.get("before") or "")')
@@ -61,27 +46,13 @@ jobs:
    steps:
      # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-        with:
-          # #149: diff-cover --compare-branch origin/master needs full history
-          # to compute the changed-line diff in PR (merge-ref) and push runs.
-          fetch-depth: 0
-      - name: Create test environment from lock
+      - name: Create test environment from manifest
        run: |
-          # #150: deps come ONLY from the pinned lock.
          python3 -m venv .test-venv
-          .test-venv/bin/pip install --disable-pip-version-check -r requirements-ci.txt
-          .test-venv/bin/pip install --disable-pip-version-check -e . --no-deps
-      - name: Test with coverage (global floor + changed-lines ratchet)
+          .test-venv/bin/pip install --disable-pip-version-check -e ".[dev,memory]"
+      - name: Test local tools and interstitial message objects
        run: |
-          # #149 coverage ratchet — both floors live in .coveragerc; raise,
-          # never lower. The changed-lines floor (70) gates every PR's own
-          # lines; the global floor (29, measured at the #149 baseline) gates
-          # the suite total.
-          PYTHONPATH=src:. .test-venv/bin/coverage run -m pytest tests/ -q
-          .test-venv/bin/coverage report --fail-under=29
-          .test-venv/bin/coverage xml
-          .test-venv/bin/diff-cover coverage.xml --compare-branch origin/master --fail-under=70 \
-            --diff-range-notation ..
+          PYTHONPATH=src:. .test-venv/bin/python -m pytest tests/ -q

  canary:
    runs-on: rune-ci-desktop
@@ -91,14 +62,14 @@ jobs:
    steps:
      # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - name: Create canary environment from lock
+      - name: Create canary environment
        run: |
-          # #150: the old ad-hoc textual pre-install + '|| true' fallback is
-          # gone — the lock pins textual==8.2.8 and textual-autocomplete==4.0.6
-          # (exactly what the canary needed), so there is no silent escape hatch.
          python3 -m venv .canary-venv
-          .canary-venv/bin/pip install --disable-pip-version-check -r requirements-ci.txt
-          .canary-venv/bin/pip install --disable-pip-version-check -e . --no-deps
+          .canary-venv/bin/pip install --disable-pip-version-check textual==8.2.8 textual-autocomplete==4.0.6 sqlite-vec 2>/dev/null || true
+      - name: Create canary environment from manifest
+        run: |
+          python3 -m venv .canary-venv
+          .canary-venv/bin/pip install --disable-pip-version-check -e ".[dev,memory]"
      - name: Run canary suite
        run: |
          FAILED=0
@@ -207,15 +178,10 @@ jobs:
    runs-on: rune-ci-desktop
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - name: Create type-check environment from lock
+      - name: Create type-check environment from manifest
        run: |
-          # #150 gate review: the protected type-check toolchain previously
-          # installed floating ".[dev,memory]" — unreproducible. Same lock-only
-          # pattern as every other job: deps from the pinned file, project with
-          # --no-deps so nothing floats outside requirements-ci.txt.
          python3 -m venv .type-venv
-          .type-venv/bin/pip install --disable-pip-version-check -r requirements-ci.txt
-          .type-venv/bin/pip install --disable-pip-version-check -e . --no-deps
+          .type-venv/bin/pip install --disable-pip-version-check -e ".[dev,memory]"
      - name: Type-check with ratchet
        run: |
          .type-venv/bin/python scripts/type_check_ratchet.py
@@ -17,6 +17,12 @@ Only use `git commit --no-verify` in a genuine emergency: it bypasses the hooks
 - Plans are markdown, one per build (in ./plans)
 - Top-level docs are markdown or yaml references (in ./docs/*)
 - The known giant stays visible — file-size debt is tracked, not silent (in ./src/rune/*)
+- The bug-fix discharge contract is a governed doc — it exists, is markdown, and changes are deliberate (in ./docs/bugfix-contract.md)
+- The discharge checker ships with the repo — red-first enforcement is structural (in ./scripts)
+- Discharge checker and its CI wiring change together
+- Every workflow is registered in the pipeline registry — new pipeline machinery ships with documentation (in ./.gitea/workflows/*.yml)
+- Every TUI surface is registered — no silent UI growth (in ./src/rune/*tui*.py)
+- New rune modules ship with tests or a canary — no ungoverned code surfaces (in ./src/rune/*.py)

 ### Behaviours

@@ -33,3 +39,12 @@ Need a check that genuinely doesn't exist? `henxels create-new-statement <name>`
 other repos, not tied to this one — contribute it upstream with `henxels contribute`.
 We're in the agentic era: send a ready-to-merge PR instead of opening an issue.
 <!-- henxels:end -->
+
+## Bug fixes (binding)
+
+Every bug found — by gates, CI, canaries, production, or humans — is fixed per
+`docs/bugfix-contract.md`: red test FIRST (reproduces the cause), root-cause
+fix, full pipeline re-entry (suite + ratchet + ruff + canaries + henxels;
+gates for anything beyond a mechanical minor), regression tests frozen forever,
+discharge recorded finding → test → commit. Symptom patches are rejected at
+review. To escape: edit `henxels.yaml` or this file — visibly.
@@ -1413,66 +1413,6 @@ Run tests:
 python3 -m pytest tests/
 ```

-### CI dependency lock
-
-CI installs dependencies from the committed, fully-pinned
-`requirements-ci.txt` (issue #150) — never from the floating floor pins in
-`pyproject.toml`. Same commit + same lock = same CI environment.
-
-After ANY dependency edit in `pyproject.toml`, regenerate the lock and
-commit the result:
-
-```bash
-uv pip compile pyproject.toml -o requirements-ci.txt --extra dev --extra memory --python-version 3.11
-python3 scripts/check_dep_lock.py   # must print "in sync" before committing
-```
-
-Why `--python-version 3.11`: the lock must resolve for the CI runners'
-interpreter (not your dev machine's), so environment markers pick the same
-wheels CI will get. `uv` is a local dev convenience only — the lock is plain
-pip format, and runners install it with stock pip plus
-`pip install -e . --no-deps` (`--no-deps` so the project's own dependencies
-come ONLY from the pinned file; no floating escape hatch).
-
-The lint job runs `scripts/check_dep_lock.py` as a drift ratchet: if
-`requirements-ci.txt` no longer matches `pyproject.toml`, CI fails with the
-regeneration command — the lock is reviewed and re-committed, never
-auto-regenerated.
-
-### Coverage ratchet
-
-The CI test job (issue #149) gates coverage with two floors. Both live in
-`.coveragerc` (the changed-lines floor as a documented value, enforced by the
-`diff-cover` invocation in `.gitea/workflows/ci.yml`), and both follow the
-CPython ratchet doctrine: **raise, never lower**.
-
-1. **Global floor — `coverage report --fail-under=29`.** Total suite coverage
-   over `src/rune` (canary scripts and tests/scripts omitted — canaries are
-   CI-run verification scripts, not imported code), measured and committed at
-   the #149 baseline. If coverage grows, raise the number in `.coveragerc`;
-   CI fails if it ever drops.
-2. **Changed-lines floor — `diff-cover coverage.xml --compare-branch
-   origin/master --fail-under=70 --diff-range-notation ..`.** Every line a PR
-   adds or modifies must be covered at ≥ 70% (ratchetable upward after a
-   clean pass). The `..` notation diffs against the merge base so a PR is
-   measured on its own lines, not unrelated merge-ref history; the checkout
-   uses `fetch-depth: 0` so `origin/master` exists in CI.
-
-Raising a floor: edit `.coveragerc` (`[report] fail_under`) and/or the
-`--fail-under` value in `.gitea/workflows/ci.yml`, then commit. Never lower
-either number. The contract is enforced by `tests/test_ci_lock_contract.py`,
-which fails if a floor disappears from CI or is committed below the
-baselines (29 global / 70 changed-lines).
-
-To reproduce the CI coverage run locally:
-
-```bash
-coverage run -m pytest tests/          # or: .venv/bin/coverage run ...
-coverage report --fail-under=29        # global floor
-coverage xml
-diff-cover coverage.xml --compare-branch origin/master --fail-under=70 --diff-range-notation ..
-```
-
 ---

 ## Configuration
@@ -0,0 +1,86 @@
+# Bug-fix contract
+
+_Binding on every agent, session, and pipeline stage in this repository. The
+henxel mirror of this contract lives in `henxels.yaml` ("bugs discharged
+red-first"); the enforcement hooks live in `scripts/check_discharge_contract.py`
+and `.gitea/workflows/pipeline-gate.yml`. Escapes from this contract are made
+by editing those files — visibly — never by silent deviation._
+
+## The contract
+
+When a **bug is found** — by a gate, a reviewer, CI, a canary, production, or a
+human — the fix MUST follow this cycle before it may merge:
+
+1. **Red first.** A failing test that reproduces the bug is written BEFORE the
+   fix. The test must fail for the *bug's cause*, not for an unrelated reason.
+   A fix without a red test is a symptom patch and is rejected at review.
+2. **Root cause, not symptom.** The fix addresses the cause. If the reporter's
+   diagnosis is wrong, the discharge says so and names the real cause.
+3. **Full pipeline re-entry.** The fix is treated as a NEW SUBMISSION: full
+   suite, pyright ratchet (not increased), ruff, canaries, henxels, and the
+   spec + quality gates for anything beyond a mechanical minor. No
+   "hotfix-skips-gates" path exists.
+4. **The regression test is permanent.** Tests written for a discharged bug are
+   frozen — they may be refactored, never weakened or deleted. The suite can
+   only grow in assertion strength over time.
+5. **Recorded.** The fix's PR (or plan tail) maps every finding → the red test
+   → the commit. A discharge record with holes bounces at review.
+
+## Scope and proportionality
+
+- **Gate findings (spec/quality):** every BLOCKER/MAJOR gets the full cycle;
+  MINORs get at minimum a red test OR an explicit reviewer-approved waiver
+  recorded in the plan tail.
+- **Production failures:** the fix follows this contract AND, where the failing
+  payload is preservable, #157's fixture pipeline (real failure → sanitised
+  fixture → permanent regression test).
+- **CI/workflow bugs:** the red test is the workflow-contract assertion
+  (parsed-YAML step/step-logic assertions, as in `test_workflow_script_contract.py`)
+  — workflows are code; their bugs get tests too.
+- **Trivial/no-test-class bugs** (typos in comments, log strings): documented
+  exemption list in this file. PR-only changes to those strings skip the red test.
+
+## Why (the failure class this kills)
+
+LLM-authored changes share wrong assumptions between implementation, tests, and
+docs. A symptom patch shares the reporter's wrong assumption with the fix. The
+red-first test is the cheapest known breaker of both: it forces the fixer to
+state the bug's cause in executable form before claiming to have removed it.
+
+## Enforcement
+
+- `scripts/check_discharge_contract.py`: verifies a PR that touches files named
+  in a `Discharge:` trailer block carries at least one test-hunk per finding
+  id (structural check — PR description convention: `Discharge: <id> -> <test file>`).
+- Gate reviewers are instructed (dispatch templates, issue #151) to reject
+  symptom patches: "what test failed red for this bug?" is a mandatory
+  reviewer question for every fix PR.
+- `henxels.yaml` carries the tracked one-line mirror so the contract is part
+  of the repo's auditable contract surface.
+
+## Binding refinements (pipeline doctrine, 2026-09-07)
+
+6. **Soak-before-close for intermittent defects.** A flaky, timing, or
+   event-delivery bug cannot be proven fixed by one green run. The fix merges
+   through the normal pipeline, but the issue CLOSES only on soak evidence: a
+   stated criterion (e.g. "N consecutive green runs" or "48h without
+   recurrence") plus the observations meeting it. The closing comment carries
+   the soak record. Merge ≠ closure for this class.
+7. **Escape accountability.** When a bug reaches production (escaped every
+   gate), the discharge must answer: _which gate should have caught this, and
+   why didn't it?_ The answer becomes a gate improvement — a new contract
+   assertion, a checker rule, or a documented gate limit. Gate hardening is a
+   first-class output of bug fixing, not an afterthought.
+8. **Fresh-context root-cause verification.** The red test proves the fixer
+   understood _a_ cause. For BLOCKER/MAJOR fixes, a fresh-context reviewer
+   additionally asks: does this test fail on the pre-fix code _for the right
+   reason_? (Same doctrine as the black-box test author: the person who wrote
+   the fix does not certify its diagnosis.)
+9. **Déjà-vu detection.** Before writing the red test, search the suite and
+   closed issues for the same failure class. A second occurrence of a class
+   means the first fix treated a symptom — the discharge must then cover the
+   class, not the instance.
+10. **Fixture promotion.** When the red test needs a complex payload, it goes
+    through #157's sanitised-fixture pipeline (real failure → secrets stripped
+    → `tests/fixtures/production/`) instead of a hand-crafted approximation.
+    Real failures are the best regression tests.
@@ -0,0 +1,35 @@
+# Module coverage debt ledger
+
+_Tracked, not silent — the repo's doctrine for known debt (same pattern as the
+file-size giants in `henxels.yaml`). The `new_rune_modules_have_canary_or_test_coverage`
+henxel fails any `src/rune/*.py` module with no test reference and no canary._
+
+**Rule: this list only shrinks.** Every PR that adds a test or canary for a
+module removes it here. New modules can never be added — they ship governed.
+When the list is empty, this file records the fact and the henxel needs no
+escape.
+
+## Mechanism
+
+The henxel reads this file: a module listed under `## Debt` is *tracked debt*
+(warning-level in the ledger, visible here) instead of a contract failure. The
+distinction matters — nothing below is approved as "fine", it is *known, owned,
+and scheduled for elimination* via the P2 consolidation tranche (#125, #41).
+
+## Debt (58 modules as of 2026-09-07, baseline master 2975d76)
+
+abstraction, audit_ledger, claim_audit, cognitive_budgeter, complexity_scorer,
+connection_pool, context_pressure, cron_engine, curator, dependency_tracker,
+drift_cache, drift_compression, drift_core, drift_observability,
+elastic_cognition, goal, graph_memory, growth_delta, hook_engine,
+identity_anchors, memory_consolidation, memory_env, message_queue, model_connect,
+model_registry, night_mode, outcome_ledger, parallel_processor, persona_definition,
+persona_gate, progressive_escalation, provider_budget, provider_registry,
+query_memory, recall_router, response_adapter, rune_graphic, rune_profiler,
+rune_spinner, salience_gate, self_improve, shard_manager, standardized_providers,
+subconscious_pass, system_registry, task_gate, task_persist, tiered_executor,
+tier_manager, time_awareness, token_optimizer, tui_validator, verification_layer,
+voicebox, voice_hybrid, voice_injector, voice_sync, warm_neuron_store, work_manager
+
+_Henxel escape: add the module name to this list only when the PR that touches
+the module cannot also carry its first test — and say why in the PR body._
@@ -0,0 +1,25 @@
+# Pipeline registry
+
+_Every workflow in `.gitea/workflows/` is registered here — trigger, purpose,
+failure mode. Governed by the `workflows_are_governed` henxel: a new workflow
+that isn't registered fails the contract. Add the registry entry IN THE SAME
+PR as the new workflow._
+
+| Workflow | Trigger | Purpose | Failure mode |
+|---|---|---|---|
+| `ci.yml` | PR + push to master | lint, unit tests, canaries, best-practices, documentation, type-check (ratchet), gitea-offline, required-checks aggregation | Required checks fail → protected merge blocked |
+| `pipeline-gate.yml` | issue events, comment created, schedule (hourly), workflow_run | gate (deps/research-pending), teach (next-issue), research-clear (evidence floor: citations, live-fetched sources, trail, synthesis qualification), incomplete-catcher (draft PRs for abandoned work) | Rejection comments name gaps; labels stay |
+| `auto-version.yml` | pull_request:closed + push to master | semver from PR title (authoritative) / push-triggered convergence safety net (scripts/version_convergence.py) → bump PR → release | Safety net reconciles slipped events; drift flagged by maintenance |
+| `maintenance.yml` | schedule | drift reconciliation (release version vs tags), housekeeping | Files advisory "release drift" issue, deduped |
+| `merge-robot.yml` | schedule (hourly) + CI completion | merge-on-green: PRs with success status + mergeable merge via API | 405 (protection/stale) logged and skipped — **known silent-failure defect under discharge (bug-fix contract)** |
+| `auto-label.yml` | issue events | priority gate, label transitions | Gate comments on unlabelled issues |
+| `auto-backup.yml` | schedule | repo backup | Journal alert on failure |
+| `auto-update-gitea.yml` | schedule | Gitea self-update | Binary-only rollback risk (T1.1 audit finding) |
+
+## Adding a workflow
+
+1. Create `.gitea/workflows/<name>.yml`.
+2. Add a row here (trigger / purpose / failure mode) in the same PR.
+3. If the workflow has a canary-relevant side effect, register the canary in
+   `ci.yml` (the `ci_runs_all_canaries` henxel enforces it).
+4. Verify: `python3 -c "import yaml; yaml.safe_load(open('.gitea/workflows/<name>.yml'))"`.
@@ -0,0 +1,20 @@
+# TUI registry
+
+_Every TUI surface in `src/rune/` is registered here — what it renders, who
+owns it. Governed by the `tui_panels_are_governed` henxel: a new TUI surface
+that isn't registered fails the contract. Add the entry IN THE SAME PR as the
+new surface._
+
+| Surface | Renders | Notes |
+|---|---|---|
+| `rune_tui.py` | The main Textual application — chat pane, work pane, status bar (version label + refresh), footer, dialogs | The known giant (file-size debt tracked in henxels); composition root for all UI |
+| `tui_validator.py` | Import-allowlist validation for TUI code | Drift defect tracked in #139 (allowlist vs `__future__`/relative imports) |
+
+## Adding a TUI surface
+
+1. Create the module under `src/rune/`.
+2. Add a row here (renders / notes) in the same PR.
+3. Ship a test or canary (the `new_rune_modules_have_canary_or_test_coverage`
+   henxel enforces coverage).
+4. Decomposition of `rune_tui.py` along the authority map is tracked in #125 —
+   new panels should target the decomposed structure, not grow the giant.
@@ -32,3 +32,28 @@ henxels:
      - ./src/rune/tool_executor.py
      - ./src/rune/warm_router.py
    max_lines: 1200
+
+  - henxel: "The bug-fix discharge contract is a governed doc — it exists, is markdown, and changes are deliberate"
+    in: ./docs/bugfix-contract.md
+    allowed_filetypes: [.md]
+
+  - henxel: "The discharge checker ships with the repo — red-first enforcement is structural"
+    in: ./scripts
+    required_files: [check_discharge_contract.py]
+
+  - henxel: "Discharge checker and its CI wiring change together"
+    changed_with:
+      when: ./scripts/check_discharge_contract.py
+      expect: ./.gitea/workflows/pipeline-gate.yml
+
+  - henxel: "Every workflow is registered in the pipeline registry — new pipeline machinery ships with documentation"
+    in: ./.gitea/workflows/*.yml
+    workflows_are_governed: true
+
+  - henxel: "Every TUI surface is registered — no silent UI growth"
+    in: ./src/rune/*tui*.py
+    tui_panels_are_governed: true
+
+  - henxel: "New rune modules ship with tests or a canary — no ungoverned code surfaces"
+    in: ./src/rune/*.py
+    new_rune_modules_have_canary_or_test_coverage: true
@@ -15,3 +15,87 @@ def ci_runs_all_canaries(param, file, root):
    if Path(file).name in ci.read_text():
        return None
    return f"{file} is missing from .gitea/workflows/ci.yml — register it in the canary job's for-loop list"
+
+
+# --- Pipeline-expansion contracts (issue #204 doctrine): when a new process,
+# feature, workflow, or backend surface is added, a governing contract must
+# exist for it. These statements make "ungoverned surface" a check failure.
+
+@statement(
+    "workflows_are_governed",
+    help="every .gitea/workflows/*.yml is referenced by docs/pipeline-registry.md — new pipeline machinery ships with documentation",
+)
+def workflows_are_governed(param, file, root):
+    if not file.startswith(".gitea/workflows/") or not file.endswith(".yml"):
+        return None
+    registry = root / "docs" / "pipeline-registry.md"
+    if not registry.exists():
+        return f"docs/pipeline-registry.md is missing — create it and register {file} (every workflow documents trigger/purpose/owner)"
+    if Path(file).name not in registry.read_text():
+        return f"{file} is not registered in docs/pipeline-registry.md — new pipeline processes ship with a registry entry (trigger, purpose, failure mode)"
+    return None
+
+
+@statement(
+    "tui_panels_are_governed",
+    help="new TUI surfaces (src/rune/*tui*.py panels/widgets) are referenced in docs/tui-registry.md — no silent UI growth",
+)
+def tui_panels_are_governed(param, file, root):
+    if Path(file).stem.startswith("canary_"):
+        return None
+    if "tui" not in Path(file).name.lower():
+        return None
+    registry = root / "docs" / "tui-registry.md"
+    if not registry.exists():
+        return f"docs/tui-registry.md is missing — create it and register {file} (every TUI surface documents what it renders and who owns it)"
+    if Path(file).name in registry.read_text():
+        return None
+    # registry exists but this file is new/unregistered — check for a known-exempt core list
+    core = {"rune_tui.py"}
+    if Path(file).name in core:
+        return None
+    return f"{Path(file).name} is not registered in docs/tui-registry.md — new TUI surfaces ship with a registry entry"
+
+
+def _tests_corpus(root) -> str:
+    tests_dir = root / "tests"
+    if not tests_dir.exists():
+        return ""
+    parts = []
+    for tf in sorted(tests_dir.glob("test_*.py")):
+        try:
+            parts.append(tf.read_text(errors="replace"))
+        except OSError:
+            continue
+    return "\n".join(parts)
+
+
+@statement(
+    "new_rune_modules_have_canary_or_test_coverage",
+    help="every src/rune/*.py module is referenced by at least one test file or has a canary — no ungoverned code surfaces",
+)
+def new_rune_modules_have_canary_or_test_coverage(param, file, root):
+    if not file.startswith("src/rune/") or not file.endswith(".py"):
+        return None
+    name = Path(file).stem
+    if name.startswith(("canary_", "test_", "__")):
+        return None
+    tests_dir = root / "tests"
+    if (tests_dir / f"test_{name}.py").exists():
+        return None
+    canary = root / "src" / "rune" / f"canary_{name}.py"
+    if canary.exists():
+        return None
+    corpus = _tests_corpus(root)
+    if name in corpus:
+        return None
+    debt = root / "docs" / "module-coverage-debt.md"
+    if debt.exists():
+        debt_text = debt.read_text(errors="replace")
+        if name in debt_text:
+            return None  # tracked debt — visible in docs/module-coverage-debt.md (list only shrinks)
+    return (
+        f"{name} is referenced by no test file and has no canary — new modules ship with coverage "
+        f"(a test importing/exercising it, or a canary) per docs/bugfix-contract.md; "
+        f"legacy debt goes in docs/module-coverage-debt.md (tracked, not silent)"
+    )
@@ -1,129 +0,0 @@
-# #149 Coverage ratchet: changed code may not reduce tested coverage — Plan
-
-> **Contract:** TDD; controller owns state; conventional commits (#149); PR + protected merge; deviations in plan tail. The kill test: a PR that REDUCES changed-line coverage must FAIL CI, and a coverage-raising PR must PASS.
-
-## Goal
-
-Changed/critical code may not reduce tested coverage (handoff §3.2). Implementation follows the OUTWARD evidence already on the issue: **diff-cover** (`--fail-under` on new/modified lines, `--compare-branch`) is the purpose-built changed-code ratchet; **coverage.py `fail_under`** is a global floor only. CPython's "any increase is a good one" is the floor doctrine.
-
-## Architecture
-
-1. **`requirements-ci.txt` regen** adds `diff-cover` + `coverage` (pinned) — the lock (#150, now live) is the install path.
-2. **CI (ci.yml) test job:** after pytest, run `coverage run -m pytest` (or `--cov` via coverage's own RC — no pytest-cpy plugin dependency; coverage.py RC `[run] source = src/rune`), then `coverage report --fail-under=<committed floor>` (floor starts at current measured total, committed to `.coveragerc`, CI only ever raises it), then `diff-cover coverage.xml --compare-branch origin/master --fail-under=70` (changed-lines floor: 70% initial, ratchetable upward).
-3. **Config:** `.coveragerc` (or pyproject `[tool.coverage.*]`) — source=src/rune, omit tests/scripts; xml report for diff-cover. Both floors in one committed place with a header comment: "raise, never lower".
-4. **Drift-guard symmetry:** the lock's drift ratchet pattern (fail-on-regression, never auto-mutate) is reused — no new philosophy.
-
-## Design decisions (settled)
-
-1. diff-cover for changed lines (evidence on issue), coverage.py fail_under for the global floor — the two mechanisms answer two different questions; both needed, both cheap.
-2. Changed-lines floor starts at 70% (not 100): the suite has pre-existing partial coverage; 100% on changed lines lands after the first ratchet pass. Global floor = whatever today measures (measured in Task 1, committed, then ratchet).
-3. coverage.xml + json artifacts upload skipped (anti-complexity: the CI log is the artifact until proven needed).
-
-## Tasks
-
-1. **Measure + commit floors.** Run coverage locally on master; commit `.coveragerc` with the measured global floor + changed-lines floor 70; add both tools to the lock (regen via the documented command; drift ratchet verifies). RED-first test: none needed for config, but add a CI-config parse + presence test in tests/test_ci_lock_contract.py (assert ci.yml contains both floor steps — the workflow-contract pattern from #192's discharge). Commit `feat(ci): coverage floors + diff-cover ratchet (#149)`.
-2. **Wire CI.** Test job gains coverage run + report + diff-cover steps (rune-ci-desktop, after the existing pytest invocation — replace bare pytest with coverage-wrapped). RED-first: extend the contract test to assert the steps exist with --fail-under flags. Commit `feat(ci): coverage ratchet in CI test job (#149)`.
-3. **Verify + docs.** Local: full suite under coverage, diff-cover vs master simulated (branch diff), both floors hold; a seeded uncovered-line demo on a scratch branch fails diff-cover (the kill test — do it in the worktree, not on master). README coverage section (how to raise floors). Commit `docs(ci): coverage ratchet workflow (#149)`.
-
-## Acceptance (from #149)
-
- Changed code may not reduce tested coverage → diff-cover --fail-under gate
- Critical-path coverage enforced → global floor committed, raisable
- The ratchet philosophy (only up) is structural, not aspirational
-
-## Research trace
-
- Issue #149 evidence trail (posted 2026-09-07): diff-cover PyPI docs (changed-lines %, --fail-under, --compare-branch), coverage.py fail_under (global-only), CPython devguide ratchet doctrine. Kill test: seeded uncovered changed line must fail CI.
-
-## Deviations & findings (plan tail)
-
-1. **#150 was NOT on master 2975d76 (handoff premise wrong).** The dependency
-   lock + drift ratchet lived on branch `ci-dependency-lock`, not an ancestor
-   of master. Resolution: cherry-picked the ten #150 commits
-   (160681c…ada5456) onto `coverage-ratchet` as the foundation before Task 1.
-   All cherry-picks applied cleanly; suite green afterward (618 passed, 1
-   skipped, 84 subtests — the 1 skip is the live-model E2E, skipped by design
-   under `GITHUB_ACTIONS=true`).
-2. **Coverage floor measured at 29%**, not on master but on the branch as it
-   will merge (master + #150 lock + #149 config): 22,246 statements, 29%
-   covered. `src/rune/canary_*.py` omitted from measurement (documented in
-   `.coveragerc` header): they are CI-run verification scripts, never
-   imported by tests — counting them would make the global floor a fiction.
-   This extends the plan's "omit tests/scripts" with canaries.
-3. **diff-cover range notation: `--diff-range-notation ..` added.** Gitea
-   Actions checks out the PR merge ref; with the default `...` notation the
-   changed-lines set can span unrelated merge history. `..` pins the diff to
-   the merge base; `--compare-branch origin/master` is retained and
-   `fetch-depth: 0` (added to the unit-tests checkout — it was missing;
-   pinned-checkout comment preserved) guarantees the ref exists in push and
-   PR contexts. Chosen from `diff-cover --help`: `--diff-range-notation` is
-   the CLI's supported mechanism for pinning the range (`--diff-file` is the
-   alternative but would need a separate git step).
-4. **diff-cover skips changed files with no coverage data** (observed, not
-   assumed): a changed file absent from coverage.xml contributes no lines to
-   the diff total (verified with a seeded change in an omitted canary file —
-   the file's executable line never entered the "Total"). Consequences:
-   (a) test/config/canary-only PRs trivially pass diff-cover — correct, tests
-   ARE the coverage; (b) changed lines outside `src/rune` (e.g. `shared/`)
-   are not gated — known hole for a future ratchet once `shared/` is
-   measured. No `--exclude` flag needed for canaries (skip ≠ 0% fail).
-5. **Task 1/2 test split adjusted to keep every commit green:** Task 1's
-   contract test asserts the committed floors + lock pins + lock-only install
-   (green at commit); the ci.yml step assertions (RED-first) landed with
-   Task 2's wiring, per the plan's own "RED-first: extend the contract test"
-   wording. Contract test file: `tests/test_ci_lock_contract.py` (plan's
-   suggested name; it did not exist on master, created fresh — the #192
-   workflow-contract pattern was followed: yaml parse + structural
-   assertions).
-6. **Kill test (Task 3, scratch branch `scratch/kill-test-149`, deleted
-   after evidence, nothing merged):**
-   - Seeded uncovered branch in `src/rune/complexity_scorer.py`
-     (`analyze_request_text`, 3 executable lines) on a master-based scratch
-     branch → `coverage run -m pytest` + `coverage xml` +
-     `diff-cover coverage.xml --compare-branch master --fail-under=70
-     --diff-range-notation ..` → `complexity_scorer.py (0.0%): Missing lines
-     92-94`, Total 0% → **exit 1 (CI FAILS)**. (First attempt without
-     `.coveragerc` on the scratch tree produced a source-less report where
-     the file was skipped entirely — reproduces deviation 4's skip behavior
-     and confirms CI must and does commit `.coveragerc`.)
-   - Added a test exercising the seeded branch → same pipeline →
-     `complexity_scorer.py (100%)`, Total 100% → **exit 0 (CI PASSES)**.
-   - Global-floor gate incidentally proven: on the master-based scratch tree
-     the suite measures 22% → `coverage report --fail-under=29` exits 2.
-   - Negative floor check on the real branch: `--fail-under=30` exits 2,
-     `--fail-under=29` exits 0 (floor is live, not decorative).
-7. **Local CI simulation stand-in:** `--compare-branch gitea/master` (the
-   ref that actually points at 2975d76 in this worktree); in Gitea Actions
-   the runner's origin IS the Gitea instance, so the committed step's
-   `origin/master` is correct there. Simulation result on this branch:
-   diff-cover exits 0 ("No lines with coverage information in this diff" —
-   this PR touches no `src/rune` code; the ratchet arms for future PRs).
-
-## Completion Record
-
- Commits (all reference #149; nothing pushed):
-  - Foundation: 10 cherry-picked #150 commits (dependency lock + drift
-    ratchet live on this branch — see deviation 1).
-  - `111b2bf` feat(ci): coverage floors + diff-cover ratchet (#149) —
-    `.coveragerc` (global floor 29, changed-lines floor 70 documented,
-    raise-never-lower header), pyproject dev extras += coverage/diff-cover,
-    lock regenerated (`coverage==7.16.0`, `diff-cover==10.5.1` + chardet,
-    jinja2, pluggy, pygments), `tests/test_ci_lock_contract.py` (9 tests).
-  - `abc4a1c` feat(ci): coverage ratchet in CI test job (#149) — unit-tests
-    job: `fetch-depth: 0`, `coverage run -m pytest` (bare pytest removed),
-    `coverage report --fail-under=29`, `coverage xml`,
-    `diff-cover coverage.xml --compare-branch origin/master --fail-under=70
-    --diff-range-notation ..`; RED-first merge-base contract test added.
-  - `6114294` style(ci): ruff format test_ci_lock_contract.py (#149).
-  - `3f358a3` docs(ci): coverage ratchet workflow (#149) — README
-    "Coverage ratchet" section + this plan tail.
- Measured numbers: global total 29% (22,246 statements, canaries omitted);
-  changed-lines floor 70 (initial, per plan design decision 2); kill test
-  0% FAIL → 100% PASS.
- Final battery: full suite 628 passed, 1 skipped (live-model E2E by design),
-  84 subtests; `tests/test_ci_lock_contract.py` 10/10;
-  `scripts/check_dep_lock.py` in-sync; pyright ratchet PASS (errors 117 <
-  baseline 120, warnings 407 < 465; new file 0 errors); ruff format + check
-  clean on touched .py; henxels check --all exits 0 (21 pre-existing
-  duplicate-similarity warnings, canary list untouched); ci.yml parses
-  (pyyaml) after every edit.
@@ -1,92 +0,0 @@
-# #150 Reproducible CI dependency set (locked/compiled) without packaging rewrite — Implementation Plan
-
-> **Execution contract:** TDD where testable; controller owns task state; conventional commits referencing (#150); PR + protected checks only; deviations in plan tail.
-
-## Goal
-
-Same commit + same lock = materially reproducible test environment in CI. Floor declarations (`textual>=8.2.0`) plus floating transitive deps mean the same commit resolves differently by date. Fix WITHOUT rewriting packaging: a committed, fully-pinned constraints file generated from pyproject, consumed by CI, with a drift check so it cannot rot.
-
-## Architecture
-
-1. **`requirements-ci.txt`** (committed): fully-pinned output of `uv pip compile pyproject.toml -o requirements-ci.txt --extra dev --extra memory` (uv exists locally at /home/nick/.local/bin/uv; runners need NO uv — the output is plain pip format).
-2. **CI change (`.gitea/workflows/ci.yml`)**: each venv step becomes:
-   `pip install --disable-pip-version-check -r requirements-ci.txt` then `pip install --disable-pip-version-check -e . --no-deps` (project itself from the checkout, deps pinned). The canary step's ad-hoc `textual==8.2.8 textual-autocomplete==4.0.6` pre-install collapses into the same pinned file (the `|| true` fallback dies — the pins are now guaranteed).
-3. **Drift ratchet** (`scripts/check_dep_lock.py` + CI job step): regenerate the compile into a temp file; if it differs from the committed `requirements-ci.txt` → fail with "run: uv pip compile ... and commit". This makes the lock a ratchet, not a one-off. Runs in the existing lint job (fast, no network needed beyond index metadata — use `uv pip compile --no-annotate --generate-hashes` OFF; hashes add noise, skip).
-   - Local generation command documented in the script header + README dev section.
-4. **Runner reality check:** CI currently creates `.ci-venv`, `.test-venv`, `.canary-venv` with `pip install -e ".[dev,memory]"` — all three switch to the pinned file. Python version pinning stays as-is (3.11 on runners via /var/lib/gitea-desktop-runner/py311 parity; `pythonVersion` in pyrightconfig unchanged). The compile must therefore be generated against Python 3.11 markers locally (`uv pip compile --python-version 3.11`) so markers resolve identically to runner reality.
-
-## Design Decisions (settled)
-
-1. `uv pip compile` output (plain requirements.txt) over `uv.lock`/`uv sync`: zero new tooling on runners, auditable diff-able file, no packaging rewrite. uv is a LOCAL dev convenience only.
-2. `--python-version 3.11` at compile time: the lock must match the RUNNER's interpreter, not the dev machine's 3.14.
-3. Drift check fails CI rather than auto-regenerating: reproducibility means the lock is reviewed, not silently mutated.
-4. `--no-deps` on the editable install: the project's own deps come ONLY from the pinned file — no floating escape hatch.
-5. Transitive pins are committed in full (that IS the point); regeneration is the documented upgrade path.
-
-## Tasks
-
-### Task 1 — Generate + verify the lock
-Run `uv pip compile pyproject.toml -o requirements-ci.txt --extra dev --extra memory --python-version 3.11` (header comment with the exact command + date); verify `pip install --dry-run -r requirements-ci.txt` resolves; write `scripts/check_dep_lock.py` (regenerate-to-temp + diff + clear failure message) with a unit test for its diff/exit logic (fixture files). Commit `feat(ci): pinned CI dependency lock (#150)`.
-
-### Task 2 — CI consumes the lock
-Edit ci.yml venv steps to pinned-file installs + `--no-deps` editable; add drift-check step to the lint job; YAML-parse verify; local smoke: create a venv, install from the file, run the full suite (604+84 must pass — this PROVES the pins resolve to a working env). Commit `feat(ci): install from pinned lock + drift ratchet (#150)`.
-
-### Task 3 — Docs + henxel
-README dev section: how to regenerate after dependency edits; note in the drift-check script header. Commit `docs(ci): dependency lock workflow (#150)`.
-
-## Acceptance (from #150)
-
- Same commit + same lock = same resolution ✓ (pinned file, drift ratchet)
- No packaging rewrite ✓ (pyproject untouched; uv local-only)
- CI green on the pinned set ✓ (Task 2 full-suite smoke + protected CI run)
-
-## Pipeline requirements checklist (from #150)
-
- [ ] TDD for the checker logic
- [ ] `ruff check`/`format --check` clean
- [ ] Spec gate PASS; quality gate Approved
- [ ] Full suite green under the PINNED install (the real acceptance)
- [ ] Existing canaries green
- [ ] Closed with formatted comment + PR ref
-
-## Completion Record
-
-(status: DONE — branch ci-dependency-lock @ c1dae4a + docs commit; not pushed)
-
- Task 1 ✓ `feat(ci): pinned CI dependency lock (#150)` — requirements-ci.txt (37 pins, uv 0.10.11, py3.11 markers), scripts/check_dep_lock.py (TDD: 10 unit tests, fixture files, no network), `pip install --dry-run -r requirements-ci.txt` resolves exit 0.
- Task 2 ✓ `feat(ci): install from pinned lock + drift ratchet (#150)` — all three venvs install from the lock + `-e . --no-deps`; canary ad-hoc pre-install + `|| true` deleted; drift ratchet step in lint job. YAML-parse verified (ci.yml OK).
- Task 3 ✓ `docs(ci): dependency lock workflow (#150)` — README Development → "CI dependency lock" (regen command, why 3.11, why --no-deps); script header documents the same.
- Kill test (the acceptance): fresh `.venv-killtest` on **Python 3.11.2** (runner-parity interpreter) → `pip install -r requirements-ci.txt` → `pip install -e . --no-deps` → FULL suite **614 passed + 84 subtests, green**. All 23 canaries also run green under the kill-test venv. Venv deleted after.
- Verification battery: ruff format/check on added .py files PASS; pyright ratchet PASS (117/407 vs baseline 120/465 — improved, not increased); henxels_checks.py exit 0 (canary list intact); all workflows YAML-parsed.
-
-## Completion Record (cont.) — Gate-Review Discharge (2026-09-07, branch ci-dependency-lock)
-
-(status: DONE — 6 discharge commits on top of 1ce64e4; not pushed, no rebase)
-
-Six gate-review findings discharged red-first. Final battery: full suite **619 passed + 84 subtests** (614 baseline + 5 new tests), pyright ratchet **117e/407w = baseline (PASS, not increased)**, ruff format/check clean on touched files, henxels exit 0, ci.yml yaml-parses after every edit.
-
- **F1 [MAJOR] pinned-uv PATH defect** → `8568e57` `fix(ci): drift checker resolves the pinned uv, not a stray PATH uv (#150)`. RED evidence: two new tests (`test_uv_binary_prefers_interpreter_adjacent_uv` with PATH stripped + `test_uv_binary_prefers_interpreter_adjacent_over_path_uv` with a decoy uv on PATH) both FAILED against the old `shutil.which`-first resolver order (AssertionError, suite 2 failed/10 passed); GREEN after `uv_binary()` prefers `Path(sys.executable).parent / 'uv'`. Both ends fixed: ci.yml drift step now `export PATH="$PWD/.ci-venv/bin:$PATH"` before the checker; checker prefers interpreter-adjacent uv.
- **F2 silent skip of non-== lines** → `b7aa770` `fix(ci): lock checker fails loudly on non-pinned requirement lines (#150)`. RED evidence: `test_lock_requirements_rejects_floor_specs` (fixture `rune>=0.49.0`) and `test_lock_requirements_rejects_unpinned_editable_and_wildcard` FAILED against skip behavior (AssertionError "must exit 1, not be skipped"); GREEN after options become the only tolerated non-pin lines and any other non-pinned form exits 1 with actionable stderr (offending line + regen command). Pre-existing skip-options test updated to the tightened contract; real 37-pin lock still parses clean, checker exit 0.
- **F3 missing-uv raw traceback** → `084778d` `fix(ci): actionable message when uv is missing; suppress compile stdout (#150)`. RED evidence: `test_main_missing_uv_is_actionable_not_traceback` FAILED with raw `FileNotFoundError` (subprocess.py:1990); GREEN after `run_uv_compile` catches it (sentinel -1) and main() prints the house pattern (what to install: `pip install uv==0.10.11` into .ci-venv; what to run: PATH export; local install doc) and exits 1.
- **F5 uv resolution listing on stdout on success** → same commit `084778d` (shared function, inseparable). RED evidence: live checker run on the real lock printed uv's full 74-line resolution listing ("Resolved 37 packages…") before the fix; after the fix stdout/stderr are captured and printed only on compile failure (PATH-stripped real smoke run: success prints only the one-line in-sync message).
- **F4 marker-only drift + direct-URL lines undisclosed** → `d3c7039` `docs(ci): disclose drift-checker limitations in module docstring (#150)`. Docs-only, no behavior change: module docstring now discloses both limitations (marker-only drift invisible to the pin diff; direct-URL lines fail loudly rather than being compared). RED evidence: the pre-existing docstring lacked the disclosure (the finding itself); checker behavior/tests unchanged.
- **F6 type-check job floating extras** → `b24b6e3` `fix(ci): type-check installs from the pinned lock, not floating extras (#150)`. Config-only, pre-existing. RED evidence: ci.yml:196 installed floating `".[dev,memory]"` (gate finding); GREEN with the lock-only pattern (`pip install -r requirements-ci.txt` + `-e . --no-deps`), matching the other three jobs. `yaml.safe_load` verified after the edit; no active floating install remains in any workflow.
- `48d2cd8` `style(ci): ruff format check_dep_lock.py (#150)` — quote-style-only format nit caught by the close-out battery.
-
-Deviation: F5 shipped inside F3's commit (same `run_uv_compile` change; splitting would have required a reverted intermediate state) — recorded above as one red→green line per finding.
-
-## Deviations / notes (plan tail)
-
-1. **Suite count 614, not 604**: the quoted baseline was 604 passed + 84 subtests; this branch measures 614 passed + 84 subtests on both the dev venv (py3.14) and the kill-test venv (py3.11) — baseline drift (extra tests landed), zero failures either way. Green is green.
-2. **Pin-only comparison in the drift checker**: uv embeds the `-o <path>` (temp file) in its autogenerated header and the committed file carries a hand-maintained provenance header, so byte-identical comparison would false-fail every run. `check_dep_lock.py` compares normalized `name==version` pins only (comments/annotations/options stripped); unit-tested.
-3. **CI drift step installs uv itself**: runners have no uv, so the lint drift-ratchet step does `pip install uv==0.10.11` into `.ci-venv` (pinned, tool-only — not a project dependency) before running the checker. The three venv install steps are exactly `-r requirements-ci.txt` + `-e . --no-deps` as planned.
-4. **Pre-existing YAML breakage**: `.gitea/workflows/auto-version.yml` fails `yaml.safe_load` on base 2840f71 (before any of my changes; verified via `git stash`). Per instructions: noted, NOT fixed here (#192 fixes it separately). `maintenance.yml` parses clean on this base.
-5. **Kill-test venv deletion**: `rm -r .venv-killtest` was blocked twice by the session's permission rules; deleted via `python3 -c shutil.rmtree` — verified gone.
-
-## Research trace
-
-Research round: issue #150 comment thread (posted 2026-09-07).
- ci.yml :20/:52/:68-72 floor-pin installs + canary `|| true` escape (INWARD) → all three venvs switch to pinned file; silent-drift escape deleted.
- uv 0.10.11 --help (verified locally: --extra, -o, --python-version flags) → uv pip compile against py3.11 markers = runner-reality lock, runners need no uv.
- Drift-ratchet precedent (pyright ratchet live in this repo) → regenerate-to-temp + diff + fail-CI, never auto-mutate.
-Kill test: if `pip install -r requirements-ci.txt -e . --no-deps` + full suite (604+84) does NOT pass green, the lock is wrong — Task 2's pinned-env smoke is the kill test.
@@ -21,7 +21,7 @@ dependencies = [

 [project.optional-dependencies]
 memory = ["sqlite-vec>=0.1.0"]
-dev = ["pytest>=8.0", "pytest-subtests", "ruff==0.16.5", "pyright", "henxels==0.12.0", "coverage>=7.6", "diff-cover>=9.2"]
+dev = ["pytest>=8.0", "pytest-subtests", "ruff==0.16.5", "pyright", "henxels==0.12.0"]

 [tool.setuptools.packages.find]
 where = ["src"]
@@ -1,122 +0,0 @@
-# This file was autogenerated by uv via the following command:
-#    uv pip compile pyproject.toml -o requirements-ci.txt --extra dev --extra memory --python-version 3.11
-aiohappyeyeballs==2.7.1
-    # via aiohttp
-aiohttp==3.14.3
-    # via rune (pyproject.toml)
-aiosignal==1.4.0
-    # via aiohttp
-anyio==4.15.1
-    # via httpx
-attrs==26.1.0
-    # via
-    #   aiohttp
-    #   pytest-subtests
-certifi==2026.7.22
-    # via
-    #   httpcore
-    #   httpx
-chardet==7.6.0
-    # via diff-cover
-coverage==7.16.0
-    # via rune (pyproject.toml)
-diff-cover==10.5.1
-    # via rune (pyproject.toml)
-frozenlist==1.8.0
-    # via
-    #   aiohttp
-    #   aiosignal
-h11==0.16.0
-    # via httpcore
-henxels==0.12.0
-    # via rune (pyproject.toml)
-httpcore==1.0.9
-    # via httpx
-httpx==0.28.1
-    # via rune (pyproject.toml)
-idna==3.19
-    # via
-    #   anyio
-    #   httpx
-    #   yarl
-iniconfig==2.3.0
-    # via pytest
-jinja2==3.1.6
-    # via diff-cover
-linkify-it-py==2.2.0
-    # via markdown-it-py
-markdown-it-py==4.2.0
-    # via
-    #   mdit-py-plugins
-    #   rich
-    #   textual
-markupsafe==3.0.3
-    # via jinja2
-mdit-py-plugins==0.6.1
-    # via textual
-mdurl==0.1.2
-    # via markdown-it-py
-multidict==6.7.1
-    # via
-    #   aiohttp
-    #   yarl
-nodeenv==1.10.0
-    # via pyright
-packaging==26.3
-    # via pytest
-platformdirs==4.11.7
-    # via textual
-pluggy==1.6.0
-    # via
-    #   diff-cover
-    #   pytest
-propcache==0.5.2
-    # via
-    #   aiohttp
-    #   yarl
-psutil==7.2.2
-    # via rune (pyproject.toml)
-pygments==2.21.0
-    # via
-    #   diff-cover
-    #   pytest
-    #   rich
-    #   textual
-pyright==1.1.411
-    # via rune (pyproject.toml)
-pytest==9.1.1
-    # via
-    #   rune (pyproject.toml)
-    #   pytest-subtests
-pytest-subtests==0.15.0
-    # via rune (pyproject.toml)
-pyyaml==6.0.3
-    # via
-    #   rune (pyproject.toml)
-    #   henxels
-rich==15.0.0
-    # via
-    #   rune (pyproject.toml)
-    #   textual
-ruff==0.16.5
-    # via rune (pyproject.toml)
-sqlite-vec==0.1.9
-    # via rune (pyproject.toml)
-textual==8.2.8
-    # via
-    #   rune (pyproject.toml)
-    #   textual-autocomplete
-textual-autocomplete==4.0.6
-    # via rune (pyproject.toml)
-typing-extensions==4.16.0
-    # via
-    #   aiohttp
-    #   aiosignal
-    #   anyio
-    #   pyright
-    #   textual
-    #   textual-autocomplete
-websockets==17.1
-    # via rune (pyproject.toml)
-yarl==1.24.5
-    # via aiohttp
@@ -1,191 +0,0 @@
-#!/usr/bin/env python3
-"""CI dependency-lock drift ratchet (#150).
-
-`requirements-ci.txt` is the committed, fully-pinned CI dependency set,
-generated from pyproject.toml. This script re-runs the compile into a temp
-file and fails if the committed lock no longer matches pyproject.toml —
-the lock is a ratchet, reviewed and re-committed, never auto-mutated.
-
-Regenerate after ANY dependency edit (then commit the result):
-
-    uv pip compile pyproject.toml -o requirements-ci.txt --extra dev --extra memory --python-version 3.11
-
--python-version 3.11 matches the CI runners (not the dev machine's
-interpreter) so environment markers resolve to runner reality. CI installs
-this file with plain pip and then `pip install -e . --no-deps`: the project's
-own dependencies come ONLY from the pinned file, so `requirements-ci.txt` is
-plain requirements.txt format and runners need no uv.
-
-Comparison is on requirement pins only (comments and uv's per-line "via"
-annotations are stripped) because the hand-maintained header — and uv's
-temp-file `-o` header path — cannot regenerate byte-identically.
-
-Known limitations, disclosed (#150 gate review — cheap, honest, accepted):
-
-1. Marker-only drift is invisible. Environment markers (`; python_version
-   < "3.12"`) are stripped before comparison, so a lock change that alters
-   ONLY a marker leaves the ratchet green. Regenerate + eyeball the diff
-   after any marker-affecting edit; the pin diff cannot catch it.
-2. Direct-URL requirement lines (`name @ https://...`) do not fit the
-   `==`-pin contract: they trip the loud non-pinned-line failure above
-   rather than being compared. This repo's lock is index-generated and has
-   none; if a direct-URL dependency is ever locked, the checker must be
-   taught the form first (it cannot silently pass one — that much holds).
-"""
-
-import re
-import shutil
-import subprocess
-import sys
-import tempfile
-from pathlib import Path
-
-ROOT = Path(__file__).resolve().parents[1]
-LOCK_FILE = ROOT / "requirements-ci.txt"
-COMPILE_ARGS = [
-    "pip",
-    "compile",
-    "pyproject.toml",
-    "-o",
-    "{out}",
-    "--extra",
-    "dev",
-    "--extra",
-    "memory",
-    "--python-version",
-    "3.11",
-]
-REGEN_HINT = "run: uv pip compile pyproject.toml -o requirements-ci.txt --extra dev --extra memory --python-version 3.11 && commit"
-
-
-def uv_binary() -> str:
-    """Locate the uv binary to compile with, most-trusted first.
-
-    1. Interpreter-adjacent (sys.executable's directory): CI installs the
-       PINNED uv into the same venv that runs this script, so that copy is
-       the one whose resolver generated the lock. A uv found on PATH could
-       be any version and silently compile with a different resolver.
-    2. shutil.which (PATH).
-    3. ~/.local/bin/uv (the documented local install location).
-    """
-    adjacent = Path(sys.executable).resolve().parent / "uv"
-    if adjacent.is_file():
-        return str(adjacent)
-    found = shutil.which("uv")
-    if found:
-        return found
-    fallback = Path.home() / ".local" / "bin" / "uv"
-    if fallback.is_file():
-        return str(fallback)
-    return "uv"
-
-
-def run_uv_compile(out_path: Path, root: Path = ROOT) -> int:
-    """Compile pyproject into out_path; return the subprocess exit code.
-
-    uv's full resolution listing (stdout) is captured and only printed when
-    the compile fails — on success it is noise on CI logs (#150 gate review).
-    """
-    args = [uv_binary()] + [part.format(out=str(out_path)) for part in COMPILE_ARGS]
-    try:
-        proc = subprocess.run(args, cwd=str(root), check=False, capture_output=True, text=True)
-    except FileNotFoundError:
-        return -1
-    if proc.returncode != 0:
-        if proc.stdout:
-            print(proc.stdout, file=sys.stderr)
-        if proc.stderr:
-            print(proc.stderr, file=sys.stderr)
-    return proc.returncode
-
-
-def lock_requirements(path: Path) -> dict[str, str]:
-    """Extract normalized name -> pinned version from a requirements file.
-
-    Strips comments (whole-line and uv's indented 'via' annotations) and
-    skips options (-r/--index-url...). Options are the ONLY tolerated
-    non-pin lines: any requirement line that is not exactly pinned with
-    '==' (floor specs like 'rune>=0.49.0', ranges, wildcards, bare names)
-    exits 1 with an actionable message — a degraded floor-style lock must
-    fail loudly, never silently pass the pin diff (#150 gate review).
-    """
-    pins: dict[str, str] = {}
-    for raw in path.read_text().splitlines():
-        line = raw.strip()
-        if not line or line.startswith("#"):
-            continue
-        # uv puts 'via' annotations on their own indented '# ...' lines; be
-        # defensive about inline comments too.
-        line = re.sub(r"\s+#.*$", "", line).strip()
-        if line.startswith("-"):
-            continue  # options (-r, -c, --index-url, ...)
-        line = line.split(";", 1)[0].strip()  # drop environment markers
-        version = line.partition("==")[2].strip()
-        if "==" not in line or not version or "*" in version:
-            print(
-                f"FAIL: {path} contains a requirement that is not exactly pinned: '{line}'\n"
-                "Every lock line must pin with '==' (no floors like '>=', ranges,"
-                " wildcards, or bare names) — otherwise the same commit resolves\n"
-                "differently by date, which is exactly what this lock exists to"
-                " prevent.\n"
-                f"Fix the line or regenerate the lock: {REGEN_HINT}",
-                file=sys.stderr,
-            )
-            raise SystemExit(1)
-        name, _, _ = line.partition("==")
-        name = re.sub(r"[-_.]+", "-", name.strip()).lower()
-        pins[name] = version
-    return pins
-
-
-def compare(committed: Path, regenerated: Path) -> str | None:
-    """Return None when pins match, else a human-readable drift report."""
-    old = lock_requirements(committed)
-    new = lock_requirements(regenerated)
-    problems = []
-    for name in sorted(set(old) - set(new)):
-        problems.append(f"  {name}=={old[name]} pinned in lock but no longer resolved")
-    for name in sorted(set(new) - set(old)):
-        problems.append(f"  {name}=={new[name]} resolved but missing from lock")
-    for name in sorted(set(old) & set(new)):
-        if old[name] != new[name]:
-            problems.append(f"  {name}: {old[name]} (lock) -> {new[name]} (regenerated)")
-    if not problems:
-        return None
-    return "requirements-ci.txt is out of sync with pyproject.toml:\n" + "\n".join(problems) + f"\n{REGEN_HINT}"
-
-
-def main() -> int:
-    with tempfile.TemporaryDirectory() as tmp:
-        regenerated = Path(tmp) / "requirements-ci.regenerated.txt"
-        code = run_uv_compile(regenerated)
-        if code == -1:
-            # FileNotFoundError from subprocess: the uv binary itself is
-            # missing. House actionable pattern — what to install, what to
-            # run — instead of a raw traceback (#150 gate review).
-            print(
-                "FAIL: 'uv' executable not found (checked interpreter-adjacent dir,"
-                " PATH, and ~/.local/bin/uv).\n"
-                "Install the pinned uv into the CI venv and put it on PATH:\n"
-                "  .ci-venv/bin/pip install --disable-pip-version-check uv==0.10.11\n"
-                '  export PATH="$PWD/.ci-venv/bin:$PATH"\n'
-                "Locally: see https://docs.astral.sh/uv/getting-started/installation/",
-                file=sys.stderr,
-            )
-            return 1
-        if code != 0:
-            print(
-                f"FAIL: dependency-lock regeneration failed (uv pip compile exited non-zero). {REGEN_HINT}",
-                file=sys.stderr,
-            )
-            return 1
-        report = compare(LOCK_FILE, regenerated)
-    if report is None:
-        print("Dependency lock in sync with pyproject.toml (requirements-ci.txt)")
-        return 0
-    print(f"FAIL: {report}", file=sys.stderr)
-    return 1
-
-
-if __name__ == "__main__":
-    sys.exit(main())
@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Enforce the bug-fix discharge contract (docs/bugfix-contract.md) (#147).
+
+A PR that claims discharges must carry, for every `Discharge:` finding line in
+its body, at least one ADDED test hunk in the named test file. Structural check:
+the pipeline cannot read intent, but it can verify the shape of the claim.
+
+Convention (PR body):
+    Discharge: F1 -> tests/test_foo.py
+    Discharge: F2 -> tests/test_bar.py::test_case
+
+Exit 0 when no Discharge lines exist (not a fix PR) or every line is satisfied.
+Exit 1 with the unsatisfied finding ids otherwise. Silent fixes (fix commits
+with no discharge claim AND no test hunks) are a reviewer question, not a
+script verdict — see the contract's "Why".
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import subprocess
+import sys
+
+DISCHARGE_RE = re.compile(r"^\s*Discharge:\s*(?P<id>\S+)\s*->\s*(?P<file>\S+)", re.MULTILINE)
+TEST_PATH_RE = re.compile(r"(tests|src/rune)/.*?test.*\.py$")
+
+
+def added_test_hunks(diff: str, test_file: str) -> bool:
+    """True if the diff adds lines inside the named test file."""
+    current_file: str | None = None
+    for line in diff.splitlines():
+        if line.startswith("+++ b/"):
+            current_file = line[6:].strip()
+        elif line.startswith("+") and not line.startswith("+++"):
+            if current_file and (current_file == test_file or current_file.endswith("/" + test_file)):
+                if TEST_PATH_RE.search(current_file):
+                    return True
+    return False
+
+
+def main() -> int:
+    pr_body_path = os.environ.get("PR_BODY_FILE")
+    if not pr_body_path or not os.path.exists(pr_body_path):
+        print("check_discharge_contract: no PR body provided — nothing to check (exit 0)")
+        return 0
+    body = open(pr_body_path, encoding="utf-8").read()
+    claims = DISCHARGE_RE.findall(body)
+    if not claims:
+        print("check_discharge_contract: no Discharge claims in PR body (exit 0)")
+        return 0
+
+    base = os.environ.get("PR_BASE_SHA")
+    head = os.environ.get("PR_HEAD_SHA") or "HEAD"
+    if not base:
+        print("check_discharge_contract: PR_BASE_SHA missing — cannot diff (exit 1)")
+        return 1
+    diff = subprocess.run(
+        ["git", "diff", base, head, "--", "tests/", "src/rune/"],
+        capture_output=True,
+        text=True,
+        check=True,
+    ).stdout
+
+    unsatisfied = []
+    for fid, test_file in claims:
+        if not added_test_hunks(diff, test_file):
+            unsatisfied.append(f"{fid} -> {test_file}")
+
+    if unsatisfied:
+        print("check_discharge_contract: DISCHARGE CLAIMS WITHOUT RED TESTS (contract docs/bugfix-contract.md):")
+        for u in unsatisfied:
+            print(f"  - {u}")
+        print("Every finding needs a failing test hunk in the named file BEFORE the fix. See docs/bugfix-contract.md.")
+        return 1
+    print(f"check_discharge_contract: {len(claims)} discharge claim(s) verified against added test hunks")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -25,6 +25,7 @@ Usage:
 import argparse
 import hashlib
 import json
+import logging
 import os
 import re
 import sqlite3
@@ -48,6 +49,8 @@ sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 from grading import affirm_rule, grade_fact, tier_of
 import memory_env

+logger = logging.getLogger("curator")
+
 BLOCKS_DIR = os.path.join(memory_env.memory_dir(), "blocks")
 JOURNAL_DIR = os.path.join(memory_env.memory_dir(), "journal")
 INDEX_FILE = os.path.join(memory_env.memory_dir(), "index", "blocks_meta.json")
@@ -83,6 +86,7 @@ def _aaak(text, topic=""):
        import aaak
        return aaak.compress(text, topic=topic, source_file="curator")
    except Exception:
+        logger.debug("_aaak failed", exc_info=True)
        return ""


@@ -117,6 +121,7 @@ def le_promote_eligible(proposal, existing, strength, min_strength=3,
                                   corpus_texts=corpus_texts)
    except Exception:
        # Fallback: old behaviour (strength-only) if the lexicon module is gone.
+        logger.debug("le_promote_eligible failed", exc_info=True)
        return {"eligible": strength >= adjusted_min,
                "reason": f"lexicon module unavailable — strength gate only (adjusted_min={adjusted_min}, wash_count={wash_count})"}

@@ -131,6 +136,7 @@ def _block_values(label):
        db.close()
        return [r[0] for r in rows]
    except Exception:
+        logger.debug("_block_values failed", exc_info=True)
        return []


@@ -145,6 +151,7 @@ def _store_corpus(limit=200):
        db.close()
        return [r[0] for r in rows]
    except Exception:
+        logger.debug("_store_corpus failed", exc_info=True)
        return []


@@ -169,6 +176,7 @@ def _contradicts_identity(fact):
            "AND status='active'").fetchall()
        db.close()
    except Exception:
+        logger.debug("_contradicts_identity failed", exc_info=True)
        return False
    values = [r[0] for r in rows]
    if not values:
@@ -176,6 +184,7 @@ def _contradicts_identity(fact):
    try:
        return le.coherence(fact, values) == "conflict"
    except Exception:
+        logger.debug("_contradicts_identity failed", exc_info=True)
        return False


@@ -217,6 +226,7 @@ def store_has(text, topic=None):
        db.close()
        return n > 0
    except Exception:
+        logger.debug("store_has failed", exc_info=True)
        return False


@@ -236,7 +246,7 @@ def read_block(label):
        db.close()
        body = "\n".join(f"- {r[0]}" for r in rows)
    except Exception:
-        pass
+        logger.debug("read_block failed", exc_info=True)
    return fm, body


@@ -276,11 +286,11 @@ def write_block(label, fm, body):
                import memory_store as ms
                ms._auto_associate(db, eid, text, topic=label, source="curator")
            except Exception:
-                pass
+                logger.debug("write_block failed", exc_info=True)
        db.commit()
        db.close()
    except Exception:
-        pass
+        logger.debug("write_block failed", exc_info=True)
    return block_path(label)


@@ -424,7 +434,7 @@ def _embed(texts):
            if v:
                cache[t] = v
    except Exception:
-        pass
+        logger.debug("_embed failed", exc_info=True)
    finally:
        try:
            os.unlink(path)
@@ -566,7 +576,7 @@ def promote_candidates(evidence_items, idx, journal_lines):
                try:
                    audit_ledger.log_promotion(0, "candidate", "promoted", entry["count"], f"candidate seen {entry['count']} times")
                except Exception:
-                    pass  # Audit logging is non-critical
+                    logger.debug("promote_candidates failed", exc_info=True)  # Audit logging is non-critical

            # Remove the promoted candidate so it isn't applied repeatedly.
            del cands[ck]
@@ -675,6 +685,7 @@ def _grounded_in_sessions(fact, threshold, window_days):
                return True
        return False
    except Exception:
+        logger.debug("_grounded_in_sessions failed", exc_info=True)
        return False


@@ -691,11 +702,13 @@ def _grounded_in_corpus(fact):
                hits = ms.chunk_recall(db, fact[:120], budget=3, min_sim=0.78)
                cache[fact] = bool(hits)
            except Exception:
+                logger.debug("_grounded_in_corpus failed", exc_info=True)
                cache[fact] = False
            finally:
                db.close()
        return cache[fact]
    except Exception:
+        logger.debug("_grounded_in_corpus failed", exc_info=True)
        return False


@@ -1103,7 +1116,7 @@ def apply_op(op, idx, journal_lines):
                        op.get("source", "curator"),
                        int(op.get("strength", 3) or 3))
        except Exception:
-            pass
+            logger.debug("apply_op failed", exc_info=True)
        return True
    elif op["op"] == "UPDATE":
        # Only safe when the evidence explicitly names the exact old entry.
@@ -1371,6 +1384,7 @@ def graph_write(fact, evidence="", source="curator", strength=3):
            capture_output=True, text=True, timeout=15)
        return '"added": True' in (r.stdout or "")
    except Exception:
+        logger.debug("graph_write failed", exc_info=True)
        return False


@@ -1453,6 +1467,7 @@ def run_plan(evidence_items, apply=False):
                      "drift-ledger.py check --strict` to audit")
                return journal_lines, ops
        except Exception as e:
+            logger.debug("run_plan failed", exc_info=True)
            print(f"  (drift check unavailable: {e})")
    for op in ops:
        if apply:
@@ -1481,7 +1496,7 @@ def run_plan(evidence_items, apply=False):
            _dl2.DB = STORE_DB
            _dl2.snapshot()
        except Exception:
-            pass
+            logger.debug("run_plan failed", exc_info=True)
    return journal_lines, ops


@@ -1532,7 +1547,7 @@ def main():
                })
            db.close()
        except Exception:
-            pass
+            logger.debug("main failed", exc_info=True)

        if not evidence_items:
            print("No evidence provided and no recent entries found.", file=sys.stderr)
@@ -29,6 +29,7 @@ Run under ~/.venvs/memory/bin/python3 (has sqlite-vec).
 import argparse
 import hashlib
 import json
+import logging
 import os
 import sqlite3
 import subprocess
@@ -40,6 +41,8 @@ if _SD not in sys.path:
    sys.path.insert(0, _SD)
 import memory_env

+logger = logging.getLogger("memory_store")
+
 MEM_DIR = memory_env.memory_dir()
 STORE_DIR = os.path.join(MEM_DIR, "store")
 DB_PATH = os.environ.get("MEMORY_STORE_DB", memory_env.store_db())
@@ -302,7 +305,7 @@ def _embed(texts):
                if v:
                    cache[t] = v[:EMBED_DIM]
        except Exception:
-            pass
+            logger.debug("_embed failed", exc_info=True)
        finally:
            try:
                os.unlink(path)
@@ -348,6 +351,7 @@ def _aaak_summary(text, topic="", source=""):
        import aaak
        return aaak.compress(text, topic=topic, source_file=source)
    except Exception:
+        logger.debug("_aaak_summary failed", exc_info=True)
        return ""


@@ -375,6 +379,7 @@ def _auto_associate(db, eid, text, topic="", source=""):
                (eid,)).fetchall()
        except Exception:
            # Fallback: if vec0 query fails, skip associations
+            logger.debug("_auto_associate failed", exc_info=True)
            return

        total = max(db.execute("SELECT COUNT(*) FROM entries "
@@ -403,7 +408,7 @@ def _auto_associate(db, eid, text, topic="", source=""):
            boost = 0.35 + 0.1 * min(n_distinct, 4)
            associate(db, eid, other_id, boost=boost)
    except Exception:
-        pass
+        logger.debug("_auto_associate failed", exc_info=True)


 def _df_word(db, word):
@@ -412,6 +417,7 @@ def _df_word(db, word):
            "SELECT COUNT(*) AS n FROM entries WHERE status='active' "
            "AND text LIKE ?", (f"%{word}%",)).fetchone()["n"]
    except Exception:
+        logger.debug("_df_word failed", exc_info=True)
        return 0


@@ -426,7 +432,7 @@ def _run_lexicon_reconcile():
             "--fix"],
            capture_output=True, text=True, timeout=600)
    except Exception:
-        pass
+        logger.debug("_run_lexicon_reconcile failed", exc_info=True)


 def add_entry(db, text, importance=0.5, topic="", entities=None,
@@ -502,7 +508,7 @@ def recall(db, query, budget=RECALL_BUDGET, min_score=RECALL_MIN_SCORE):
            except (json.JSONDecodeError, TypeError):
                pass  # Cache miss on parse, fall through to full retrieval
    except (ImportError, Exception):
-        pass  # Cache unavailable, proceed without it
+        logger.debug("recall failed", exc_info=True)  # Cache unavailable, proceed without it

    # --- Query expansion (research uplift #1). -----------------------------
    _orig_query = query
@@ -515,6 +521,7 @@ def recall(db, query, budget=RECALL_BUDGET, min_score=RECALL_MIN_SCORE):
            # so we don't blunt the vector signal with synonyms.
            query = _orig_query
    except Exception:
+        logger.debug("recall failed", exc_info=True)
        _extra = []
    # ------------------------------------------------------------------------
    qvec = _embed([f"search_query: {query}"]).get(f"search_query: {query}")
@@ -548,6 +555,7 @@ def recall(db, query, budget=RECALL_BUDGET, min_score=RECALL_MIN_SCORE):
                    "SELECT COUNT(*) AS n FROM entries WHERE status='active' "
                    "AND text LIKE ?", (f"%{word}%",)).fetchone()["n"]
            except Exception:
+                logger.debug("recall failed", exc_info=True)
                return 0
        dense = []
        for r in rows:
@@ -598,7 +606,7 @@ def recall(db, query, budget=RECALL_BUDGET, min_score=RECALL_MIN_SCORE):
                    for _row in _r:
                        _expanded_hits.add(_row["rowid"])
                except Exception:
-                    pass
+                    logger.debug("recall failed", exc_info=True)
            if _expanded_hits:
                _ids = list(_expanded_hits)[:RECALL_BUDGET * 2]
                _ph = ",".join("?" * len(_ids))
@@ -607,7 +615,7 @@ def recall(db, query, budget=RECALL_BUDGET, min_score=RECALL_MIN_SCORE):
                    f"WHERE rowid IN ({_ph})", _ids).fetchall()
                bm25 = [(r["rowid"], float(r["score"])) for r in _rows]
    except Exception:
-        pass
+        logger.debug("recall failed", exc_info=True)
    # (3) Fusion. With BOTH rankers: RRF (Cormack et al. 2009). With ONLY
    # lexical (embeddings absent): RRF degenerates to a rank transform that
    # destroys the score signal needed for thresholding (Bruch et al.,
@@ -667,7 +675,7 @@ def recall(db, query, budget=RECALL_BUDGET, min_score=RECALL_MIN_SCORE):
                    if days >= 0:
                        recency = RECENCY_HALF_LIFE / (RECENCY_HALF_LIFE + days)
            except Exception:
-                pass
+                logger.debug("recall failed", exc_info=True)
            # In lexical-only mode `base` is a raw BM25 score (negative).
            # Normalize it to a positive relevance for the metadata, keeping
            # the ranking identical. In hybrid mode `base` is an RRF rank.
@@ -811,6 +819,7 @@ def gate_consolidated(db, query: str) -> dict:
        mc = memory_consolidation.MemoryConsolidation()
        consolidated = mc.format_knowledge_for_prompt(query)
    except Exception:
+        logger.debug("gate_consolidated failed", exc_info=True)
        return {"use_consolidated": False, "reason": "consolidation unavailable", "consolidated": ""}

    # Decision factors
@@ -825,6 +834,7 @@ def gate_consolidated(db, query: str) -> dict:
        qm = query_memory.QueryMemory()
        exploration_rate = qm.adaptive_exploration_rate(query)
    except Exception:
+        logger.debug("gate_consolidated failed", exc_info=True)
        exploration_rate = 0.30  # fallback to static rate

    explore = random.random() < exploration_rate
@@ -1010,7 +1020,7 @@ def tier_demotion_sweep(db) -> dict:
                elif current_tier == "warm" and new_tier == "cold":
                    demoted["warm_to_cold"] += 1
            except Exception:
-                pass  # tier column may not exist yet
+                logger.debug("tier_demotion_sweep failed", exc_info=True)  # tier column may not exist yet

    db.commit()
    return demoted
@@ -1037,7 +1047,7 @@ def cached_recall(db, query, budget=RECALL_BUDGET, min_score=RECALL_MIN_SCORE):
            except (json.JSONDecodeError, TypeError):
                pass
    except (ImportError, Exception):
-        pass
+        logger.debug("cached_recall failed", exc_info=True)

    # Cache miss — shard routing: route query to correct shard
    try:
@@ -1048,6 +1058,7 @@ def cached_recall(db, query, budget=RECALL_BUDGET, min_score=RECALL_MIN_SCORE):
        # Use shard for recall if available, fall back to main db
        recall_db = shard_db if shard_db else db
    except Exception:
+        logger.debug("cached_recall failed", exc_info=True)
        recall_db = db

    # Gate logic: consolidated vs full retrieval
@@ -1070,7 +1081,7 @@ def cached_recall(db, query, budget=RECALL_BUDGET, min_score=RECALL_MIN_SCORE):
        _cache.put_cache(_cache_key, json.dumps(result, ensure_ascii=False),
                        scope="retrieval")
    except (ImportError, Exception):
-        pass
+        logger.debug("cached_recall failed", exc_info=True)

    return result

@@ -1090,6 +1101,7 @@ def _position_aware(top):
                          reverse=True)
        return [s_sorted[0]] + s_sorted[2:] + [s_sorted[1]]
    except Exception:
+        logger.debug("_position_aware failed", exc_info=True)
        return top


@@ -1170,7 +1182,7 @@ def _fts_delete(db, eid):
            db.execute("INSERT INTO entries_fts(entries_fts, rowid, text) "
                       "VALUES('delete', ?, ?)", (eid, old["text"]))
    except Exception:
-        pass
+        logger.debug("_fts_delete failed", exc_info=True)


 def delete_entry(db, eid):
@@ -1218,7 +1230,7 @@ def reindex_entries(db, dry_run=False):
            "LEFT JOIN entries e ON e.id = v.rowid WHERE e.id IS NULL"
        ).fetchone()["c"]
    except Exception:
-        pass
+        logger.debug("reindex_entries failed", exc_info=True)
    try:
        fts_dangling = db.execute(
            "SELECT COUNT(*) AS c FROM entries_fts f "
@@ -1227,7 +1239,7 @@ def reindex_entries(db, dry_run=False):
        fts_total = db.execute(
            "SELECT COUNT(*) AS c FROM entries_fts").fetchone()["c"]
    except Exception:
-        pass
+        logger.debug("reindex_entries failed", exc_info=True)
    if dry_run:
        return {"indexed": indexed, "total": total, "missing": missing,
                "dangling": dangling, "fts_dangling": fts_dangling,
@@ -1241,7 +1253,7 @@ def reindex_entries(db, dry_run=False):
        try:
            db.execute("DELETE FROM entries_fts")
        except Exception:
-            pass
+            logger.debug("reindex_entries failed", exc_info=True)
        # Contentless FTS5 cannot use DELETE FROM (raises OperationalError).
        # The clean reset is DROP + recreate, which also clears dangling rows
        # that a DELETE can never touch.
@@ -1251,7 +1263,7 @@ def reindex_entries(db, dry_run=False):
                "CREATE VIRTUAL TABLE entries_fts USING fts5("
                "text, content='', tokenize='porter unicode61')")
        except Exception:
-            pass
+            logger.debug("reindex_entries failed", exc_info=True)
        rows = db.execute(
            "SELECT id, text FROM entries WHERE status='active'").fetchall()
        vec_missing = 0
@@ -1265,6 +1277,7 @@ def reindex_entries(db, dry_run=False):
                        "INSERT INTO entries_vec (rowid, embedding) VALUES (?,?)",
                        (r["id"], json.dumps(vec)))
                except Exception:
+                    logger.debug("reindex_entries failed", exc_info=True)
                    vec_missing += 1
            else:
                vec_missing += 1
@@ -1273,6 +1286,7 @@ def reindex_entries(db, dry_run=False):
                    "INSERT INTO entries_fts (rowid, text) VALUES (?,?)",
                    (r["id"], text))
            except Exception:
+                logger.debug("reindex_entries failed", exc_info=True)
                fts_missing += 1
        db.commit()
        return {"indexed": len(rows), "total": total, "missing": missing,
@@ -1418,7 +1432,7 @@ def chunk_recall(db, query, budget=6, wing=None, min_sim=0.0, doc=None):
            (_fts_query(query), budget * 3)).fetchall()
        bm25 = [(r["rowid"], 0.5) for r in rows]
    except Exception:
-        pass
+        logger.debug("chunk_recall failed", exc_info=True)
    ranks = {}
    for lst in [dense, bm25]:
        for pos, (eid, _s) in enumerate(lst):
@@ -1478,6 +1492,7 @@ def _extract_epub(path):
                id_map = dict(_re.findall(r'id="([^"]+)"\s+href="([^"]+)"', opf_text))
                manifest_order = [id_map[i] for i in spine_ids if i in id_map]
            except Exception:
+                logger.debug("_extract_epub failed", exc_info=True)
                manifest_order = []
            if not manifest_order:
                manifest_order = [n for n in z.namelist()
@@ -1513,6 +1528,7 @@ def _extract_epub(path):
                    continue
            return "\n\n".join(parts)
    except Exception:
+        logger.debug("_extract_epub failed", exc_info=True)
        r = subprocess.run(["ebook2text", path], capture_output=True,
                           text=True, timeout=60)
        return r.stdout
@@ -1541,6 +1557,7 @@ def mine_file(db, path, wing="", room="", chunk_size=1500):
                text = "\n\n".join(p["text"] for p in pages if p.get("text"))
            except Exception:
                # fallback: legacy extractor if the upgraded one is unavailable
+                logger.debug("mine_file failed", exc_info=True)
                r = subprocess.run(["pdftotext", "-layout", path, "-"],
                                   capture_output=True, text=True, timeout=60)
                text = r.stdout
@@ -1559,6 +1576,7 @@ def mine_file(db, path, wing="", room="", chunk_size=1500):
        else:
            return 0, f"unsupported ext {ext}"
    except Exception as e:
+        logger.debug("mine_file failed", exc_info=True)
        return 0, str(e)
    if not text or not text.strip():
        return 0, "empty after parse"
@@ -1974,6 +1992,7 @@ def main():
        row = db.execute("SELECT value FROM meta WHERE key='lexicon_version'").fetchone()
        cur_ver = int(row["value"]) if row else 0
    except Exception:
+        logger.debug("main failed", exc_info=True)
        cur_ver = 0
    if cur_ver < LEXICON_VERSION:
        _run_lexicon_reconcile()
@@ -2010,6 +2029,7 @@ def main():
                                  "reason": res.get("receipt", {}).get("reason", "")}))
                ok = True
            except Exception as e:
+                logger.debug("main failed", exc_info=True)
                print(json.dumps({"added": False, "error": str(e)[:120]}))
                ok = False
        if ok and args.version:
@@ -2021,7 +2041,7 @@ def main():
                _vm = _u.module_from_spec(_sp); _sp.loader.exec_module(_vm)
                _vm.snapshot(reason="memory-write", summary=text[:80])
            except Exception:
-                pass
+                logger.debug("main failed", exc_info=True)
        sys.exit(0 if ok else 1)
    if args.cmd == "recall":
        q = " ".join(args.arg)
@@ -23,6 +23,7 @@ import copy
 import difflib
 import hashlib
 import json
+import logging
 import os
 import shlex
 import sys
@@ -33,6 +34,8 @@ from datetime import datetime
 from pathlib import Path
 from typing import Optional

+logger = logging.getLogger("tool_executor")
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # CONFIGURATION
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -518,6 +521,7 @@ def _backup_file(path: Path) -> Optional[str]:
        shutil.copy2(str(path), backup_path)
        return backup_path
    except Exception:
+        logger.debug("_backup_file failed", exc_info=True)
        return None


@@ -543,6 +547,7 @@ def undo_last():
                return original, f"Restored {original}"
        return None, "Could not determine original path"
    except Exception as e:
+        logger.debug("undo_last failed", exc_info=True)
        return None, f"Undo failed: {e}"


@@ -568,6 +573,7 @@ def generate_diff(path: Path, new_content: str) -> str:
        )
        return "".join(diff)
    except Exception as e:
+        logger.debug("generate_diff failed", exc_info=True)
        return f"[diff error: {e}]"


@@ -626,6 +632,7 @@ def _execute_tool_now(tool_name: str, args: dict) -> dict:
        else:
            return {"success": False, "error": f"Unknown tool: {tool_name}"}
    except Exception as e:
+        logger.debug("_execute_tool_now failed", exc_info=True)
        return {"success": False, "error": f"{type(e).__name__}: {e}"}


@@ -860,6 +867,7 @@ def _read_file(args: dict) -> dict:

        return {"success": True, "result": result}
    except Exception as e:
+        logger.debug("_read_file failed", exc_info=True)
        return {"success": False, "error": f"Read failed: {e}"}


@@ -912,6 +920,7 @@ def _apply_content(path: str, content: str) -> dict:
        os.replace(tmp, str(resolved))
        return {"success": True, "result": f"Wrote {len(content)} chars to {resolved.name}"}
    except Exception as e:
+        logger.debug("_apply_content failed", exc_info=True)
        return {"success": False, "error": f"Write failed: {e}"}


@@ -938,6 +947,7 @@ def _list_directory(args: dict) -> dict:
            entries.append(f"{prefix}{item.name}{'/' if item.is_dir() else ''}")
        return {"success": True, "result": "\n".join(entries) if entries else "(empty)"}
    except Exception as e:
+        logger.debug("_list_directory failed", exc_info=True)
        return {"success": False, "error": f"List failed: {e}"}


@@ -972,9 +982,11 @@ def _search_files(args: dict) -> dict:
                                        "result": "\n".join(matches) + "\n[truncated — 50 matches]",
                                    }
                except Exception:
+                    logger.debug("_search_files failed", exc_info=True)
                    continue
        return {"success": True, "result": "\n".join(matches) if matches else "(no matches)"}
    except Exception as e:
+        logger.debug("_search_files failed", exc_info=True)
        return {"success": False, "error": f"Search failed: {e}"}


@@ -1020,6 +1032,7 @@ def _run_command(args: dict) -> dict:
    except subprocess.TimeoutExpired:
        return {"success": False, "error": "Command timed out (30s)"}
    except Exception as e:
+        logger.debug("_run_command failed", exc_info=True)
        return {"success": False, "error": f"Command failed: {e}"}


@@ -1071,6 +1084,7 @@ def _edit_file(args: dict) -> dict:
            "content": new_content,
        }
    except Exception as e:
+        logger.debug("_edit_file failed", exc_info=True)
        return {"success": False, "error": f"Edit failed: {e}"}


@@ -1105,6 +1119,7 @@ def _glob_files(args: dict) -> dict:

        return {"success": True, "result": "\n".join(formatted) if formatted else "(no matches)"}
    except Exception as e:
+        logger.debug("_glob_files failed", exc_info=True)
        return {"success": False, "error": f"Glob failed: {e}"}


@@ -1145,6 +1160,7 @@ def _grep_files(args: dict) -> dict:
    except subprocess.TimeoutExpired:
        return {"success": False, "error": "Search timed out"}
    except Exception as e:
+        logger.debug("_grep_files failed", exc_info=True)
        return {"success": False, "error": f"Grep failed: {e}"}


@@ -1246,6 +1262,7 @@ def _lint_file(args: dict) -> dict:
        else:
            return {"success": False, "error": result.stdout or result.stderr}
    except Exception as e:
+        logger.debug("_lint_file failed", exc_info=True)
        return {"success": False, "error": f"Lint failed: {e}"}


@@ -1286,6 +1303,7 @@ def _run_tests(args: dict) -> dict:
    except subprocess.TimeoutExpired:
        return {"success": False, "error": "Tests timed out (120s)"}
    except Exception as e:
+        logger.debug("_run_tests failed", exc_info=True)
        return {"success": False, "error": f"Test failed: {e}"}


@@ -1315,6 +1333,7 @@ def _format_code(args: dict) -> dict:
        else:
            return {"success": False, "error": result.stdout or result.stderr}
    except Exception as e:
+        logger.debug("_format_code failed", exc_info=True)
        return {"success": False, "error": f"Format failed: {e}"}


@@ -1340,6 +1359,7 @@ def _git_diff(args: dict) -> dict:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        return {"success": True, "result": result.stdout or "(no changes)"}
    except Exception as e:
+        logger.debug("_git_diff failed", exc_info=True)
        return {"success": False, "error": f"Git diff failed: {e}"}


@@ -1358,6 +1378,7 @@ def _git_log(args: dict) -> dict:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        return {"success": True, "result": result.stdout or "(no commits)"}
    except Exception as e:
+        logger.debug("_git_log failed", exc_info=True)
        return {"success": False, "error": f"Git log failed: {e}"}


@@ -1387,6 +1408,7 @@ def _git_commit(args: dict) -> dict:
        else:
            return {"success": False, "error": result.stderr or "Commit failed"}
    except Exception as e:
+        logger.debug("_git_commit failed", exc_info=True)
        return {"success": False, "error": f"Git commit failed: {e}"}


@@ -1420,6 +1442,7 @@ def _repo_map(args: dict) -> dict:
            # Fallback: simple function/class extraction via grep
            return _repo_map_fallback(resolved)
    except Exception:
+        logger.debug("_repo_map failed", exc_info=True)
        return _repo_map_fallback(resolved)


@@ -1446,6 +1469,7 @@ def _repo_map_fallback(path: Path) -> dict:
                    results.append(f"## {lang}")
                    results.extend(lines)
        except Exception:
+            logger.debug("_repo_map_fallback failed", exc_info=True)
            continue

    return {"success": True, "result": "\n".join(results) if results else "(no symbols found)"}
@@ -1475,6 +1499,7 @@ def _read_persona(args: dict) -> dict:
        persona = content[persona_start:persona_end] if persona_end != -1 else content[persona_start:]
        return {"success": True, "result": persona[:5000]}
    except Exception as e:
+        logger.debug("_read_persona failed", exc_info=True)
        return {"success": False, "error": f"Failed to read persona: {e}"}


@@ -1507,6 +1532,7 @@ def _query_memory(args: dict) -> dict:
        finally:
            db.close()
    except Exception as e:
+        logger.debug("_query_memory failed", exc_info=True)
        return {"success": False, "error": f"Memory query failed: {e}"}


@@ -1534,6 +1560,7 @@ def _check_growth(args: dict) -> dict:
        else:
            return {"success": True, "result": "(no growth entries)"}
    except Exception as e:
+        logger.debug("_check_growth failed", exc_info=True)
        return {"success": False, "error": f"Growth check failed: {e}"}


@@ -1587,6 +1614,7 @@ def _diagnose_behavior(args: dict) -> dict:

        return {"success": True, "result": json.dumps(diagnosis, indent=2)}
    except Exception as e:
+        logger.debug("_diagnose_behavior failed", exc_info=True)
        return {"success": False, "error": f"Diagnosis failed: {e}"}


@@ -1617,6 +1645,7 @@ def _find_capability(args: dict) -> dict:
            import capability_broker as broker
        matches = broker.find_capability(query)
    except Exception as exc:
+        logger.debug("_find_capability failed", exc_info=True)
        return {"success": False, "error": f"find_capability failed: {exc}"}

    if not matches:
@@ -28,6 +28,7 @@ Usage:

 import argparse
 import json
+import logging
 import os
 import re
 import sys
@@ -37,6 +38,8 @@ _SD = os.path.dirname(os.path.abspath(__file__))
 if _SD not in sys.path: sys.path.insert(0, _SD)
 import memory_env

+logger = logging.getLogger("warm_router")
+
 MEM_DIR = memory_env.memory_dir()
 STATE = os.path.join(MEM_DIR, "index", "warm_state.json")
 STORE_DB = memory_env.store_db()
@@ -112,7 +115,7 @@ def record_outcome(session_id, outcome="helpful"):
        finally:
            db.close()
    except Exception:
-        pass
+        logger.debug("record_outcome failed", exc_info=True)


 def record_neuron_fire(entry_id, score=0.0, session_id="", outcome="unknown"):
@@ -130,7 +133,7 @@ def record_neuron_fire(entry_id, score=0.0, session_id="", outcome="unknown"):
        finally:
            db.close()
    except Exception:
-        pass  # Non-critical — don't break firing
+        logger.debug("record_neuron_fire failed", exc_info=True)  # Non-critical — don't break firing


 def base_level_activation(entry_id, db=None):
@@ -176,13 +179,14 @@ def base_level_activation(entry_id, db=None):
        return max(-2.0, min(b_i, 2.0))

    except Exception:
+        logger.debug("base_level_activation failed", exc_info=True)
        return -2.0  # Graceful fallback
    finally:
        if _own_db and db is not None:
            try:
                db.close()
            except Exception:
-                pass
+                logger.debug("base_level_activation failed", exc_info=True)


 def _db():
@@ -196,6 +200,7 @@ def _aaak(text):
        import aaak
        return aaak.compress(text, topic="warm")
    except Exception:
+        logger.debug("_aaak failed", exc_info=True)
        return ""


@@ -224,7 +229,7 @@ def list_neurons():
            ).fetchall()
        finally:
            db.close()
-    except Exception as exc:  # P0-06: observable degrade (T1)
+    except Exception as exc:  # noqa: BLE001 — degrade recorded via subsystem_health (P0-06)
        from rune.subsystem_health import record_failure

        record_failure("warm_router", exc, tier=1, context="list_neurons")
@@ -304,11 +309,11 @@ def write_neuron(slug, triggers, body, importance=0.5):
                                   source="warm_router")
            finally:
                dbw.close()
-        except Exception as exc:  # P0-06: observable degrade (T1)
+        except Exception as exc:  # noqa: BLE001 — degrade recorded via subsystem_health (P0-06)
            from rune.subsystem_health import record_failure

            record_failure("warm_router", exc, tier=1, context="auto-associate")
-    except Exception as exc:  # P0-06: observable degrade (T1)
+    except Exception as exc:  # noqa: BLE001 — degrade recorded via subsystem_health (P0-06)
        from rune.subsystem_health import record_failure

        record_failure("warm_router", exc, tier=1, context="write_neuron")
@@ -357,7 +362,7 @@ def score_neuron(neuron, low_text, session_context=None, query_vec=None):
                if na and nb:
                    semantic_score = dot / (na * nb)
    except Exception:
-        pass  # Semantic scoring is optional — keyword fallback works
+        logger.debug("score_neuron failed", exc_info=True)  # Semantic scoring is optional — keyword fallback works

    # Signal 3: Context match (if session context provided)
    context_score = 0.0
@@ -420,7 +425,7 @@ def score_neuron(neuron, low_text, session_context=None, query_vec=None):
            score += cache_boost
            cache.access(entry_id)
    except Exception:
-        pass
+        logger.debug("score_neuron failed", exc_info=True)

    # Signal 7: Body-knowledge relevance (Souveraine enhancement)
    body_knowledge = neuron.get("body_knowledge", "")
@@ -492,13 +497,14 @@ def route(text, max_tokens=DEFAULT_MAX_TOKENS, max_blocks=None,
            if primed:
                session_context = " ".join(primed.keys())
        except Exception:
-            pass
+            logger.debug("route failed", exc_info=True)

    # Pre-compute query embedding once (audit fix: was N HTTP calls)
    try:
        import memory_store as _ms
        _query_vec = _ms._embed([low]).get(low)
    except Exception:
+        logger.debug("route failed", exc_info=True)
        _query_vec = None

    scored = [(score_neuron(n, low, session_context=session_context,
@@ -567,7 +573,7 @@ def route(text, max_tokens=DEFAULT_MAX_TOKENS, max_blocks=None,
                              "via_association": True})
                used_tokens += a["tokens"]
        except Exception:
-            pass
+            logger.debug("route failed", exc_info=True)
    # Record what fired this turn for the next turn's priming.
    if session_id and fired:
        try:
@@ -577,7 +583,7 @@ def route(text, max_tokens=DEFAULT_MAX_TOKENS, max_blocks=None,
                           [f["slug"] for f in fired],
                           _max_score)
        except Exception:
-            pass
+            logger.debug("route failed", exc_info=True)
    # Write accumulated state once (audit fix: was N+1 file writes)
    save_state(_route_state)
    return fired, len(neurons), [{"slug": n["slug"], "score": round(s, 2)}
@@ -653,7 +659,7 @@ def route_proactive(session_id="", active_tasks=None, recent_errors=None):
        if commitments:
            queries.append("commitment reminder promise")
    except (ImportError, Exception):
-        pass
+        logger.debug("route_proactive failed", exc_info=True)

    if not queries:
        return [], 0, []
@@ -710,7 +716,7 @@ def _associated_neuron_bodies(fired, budget_tokens):
        finally:
            db.close()
    except Exception:
-        pass
+        logger.debug("_associated_neuron_bodies failed", exc_info=True)
    return out


@@ -728,6 +734,7 @@ def graph_context(term, hops=1, limit=4):
            capture_output=True, text=True, timeout=10)
        data = json.loads(r.stdout)
    except Exception:
+        logger.debug("graph_context failed", exc_info=True)
        return ""
    # AUDIT FIX 2026-08-16: graph_memory.query returns a LIST of facts ([] for
    # an unknown entity), not a dict — the old `data.get("facts")` crashed with
@@ -805,7 +812,7 @@ def _prime_neurons(session_id, slugs, score):
            if (now - last).total_seconds() > 86400:
                stale.append(s)
        except Exception:
-            pass
+            logger.debug("_prime_neurons failed", exc_info=True)
    for s in stale:
        del st["sessions"][s]
    if len(st["sessions"]) > 40:
@@ -866,6 +873,7 @@ def _primed_associations(session_id, limit=4):
        finally:
            db.close()
    except Exception:
+        logger.debug("_primed_associations failed", exc_info=True)
        return []


@@ -875,7 +883,7 @@ def load_state():
            with open(STATE) as _fh:
                return json.load(_fh)
        except Exception:
-            pass
+            logger.debug("load_state failed", exc_info=True)
    return {"neurons": {}, "divides": []}


@@ -949,12 +957,13 @@ def promote_active(dry_run=False):
                        (slug, ", ".join(trigs), r["id"]))
                    promoted += 1
                except Exception:
-                    pass
+                    logger.debug("promote_active failed", exc_info=True)
            db.commit()
            return promoted
        finally:
            db.close()
    except Exception:
+        logger.debug("promote_active failed", exc_info=True)
        return 0


@@ -1078,6 +1087,7 @@ def always_digest(max_tokens=ALWAYS_DIGEST_TOKENS):
        finally:
            db.close()
    except Exception:
+        logger.debug("always_digest failed", exc_info=True)
        return []
    out = []
    used = 0
@@ -1163,6 +1173,7 @@ def handle_hook(event, data=None):
                    "fired_slugs": [f.get("slug", "") for f in fired[:5]],
                }
            except Exception as e:
+                logger.debug("handle_hook failed", exc_info=True)
                return {"status": "error", "event": event, "error": str(e)[:120]}
    return {"status": "ok", "event": event, "handler": "warm_router"}

@@ -1,189 +0,0 @@
-"""Unit tests for the CI dependency-lock drift checker (#150).
-
-The diff/exit logic is exercised against fixture files in temp directories —
-no network access and no real `uv pip compile` invocation here (the compile is
-monkeypatched). The real end-to-end check runs in CI's lint job.
-"""
-
-import sys
-from pathlib import Path
-
-ROOT = Path(__file__).resolve().parents[1]
-sys.path.insert(0, str(ROOT / "scripts"))
-
-import check_dep_lock  # noqa: E402
-
-
-def write(tmp_path: Path, name: str, text: str) -> Path:
-    path = tmp_path / name
-    path.write_text(text)
-    return path
-
-
-COMMITTED = """\
-# CI dependency lock (issue #150) — hand-maintained header.
-aiohttp==3.14.3
-    # via rune (pyproject.toml)
-textual==8.2.8
-"""
-
-
-def test_uv_binary_prefers_interpreter_adjacent_uv(tmp_path, monkeypatch):
-    # #150 gate review: the checker must resolve the uv installed NEXT TO the
-    # interpreter running it (CI pins uv into .ci-venv/bin), not a stray uv
-    # from PATH with a different resolver version.
-    bin_dir = tmp_path / "venv" / "bin"
-    bin_dir.mkdir(parents=True)
-    fake_uv = bin_dir / "uv"
-    fake_uv.write_text("#!/bin/sh\n")
-    monkeypatch.setattr(sys, "executable", str(bin_dir / "python"))
-    monkeypatch.setenv("PATH", "")  # nothing findable via PATH
-    monkeypatch.setenv("HOME", str(tmp_path))  # and no ~/.local/bin fallback
-    assert check_dep_lock.uv_binary() == str(fake_uv)
-
-
-def test_uv_binary_prefers_interpreter_adjacent_over_path_uv(tmp_path, monkeypatch):
-    # The actual CI defect: PATH carried /usr/bin/uv (0.12.10) and won over
-    # the pinned 0.10.11 in .ci-venv/bin. Interpreter-adjacent must win.
-    bin_dir = tmp_path / "venv" / "bin"
-    bin_dir.mkdir(parents=True)
-    adjacent_uv = bin_dir / "uv"
-    adjacent_uv.write_text("#!/bin/sh\n")
-    decoy_dir = tmp_path / "decoy"
-    decoy_dir.mkdir()
-    (decoy_dir / "uv").write_text("#!/bin/sh\n")
-    monkeypatch.setattr(sys, "executable", str(bin_dir / "python"))
-    monkeypatch.setenv("PATH", str(decoy_dir))
-    monkeypatch.setenv("HOME", str(tmp_path))
-    assert check_dep_lock.uv_binary() == str(adjacent_uv)
-
-
-def test_lock_requirements_extracts_pins_and_strips_annotations(tmp_path):
-    path = write(tmp_path, "reqs.txt", COMMITTED)
-    assert check_dep_lock.lock_requirements(path) == {"aiohttp": "3.14.3", "textual": "8.2.8"}
-
-
-def test_lock_requirements_normalizes_names(tmp_path):
-    path = write(tmp_path, "reqs.txt", "typing_extensions==4.16.0\nPyYAML==6.0.2\n")
-    pins = check_dep_lock.lock_requirements(path)
-    assert pins == {"typing-extensions": "4.16.0", "pyyaml": "6.0.2"}
-
-
-def test_lock_requirements_skips_options_and_rejects_floor_specs(tmp_path, capsys):
-    path = write(tmp_path, "reqs.txt", "-r base.txt\n--index-url https://example\ntextual==8.2.8\n")
-    assert check_dep_lock.lock_requirements(path) == {"textual": "8.2.8"}
-    # The 'rune>=0.49.0' floor that used to be skipped here is now covered by
-    # test_lock_requirements_rejects_floor_specs (it must exit 1).
-
-
-def test_lock_requirements_rejects_floor_specs(tmp_path, capsys):
-    # #150 gate review: a degraded floor-style lock (e.g. 'rune>=0.49.0')
-    # must fail loudly, not silently pass the pin diff as a skip.
-    path = write(tmp_path, "reqs.txt", "textual==8.2.8\nrune>=0.49.0\n")
-    try:
-        check_dep_lock.lock_requirements(path)
-    except SystemExit as exc:
-        assert exc.code == 1
-        err = capsys.readouterr().err
-        assert "rune>=0.49.0" in err
-        assert "requirements-ci.txt" in err
-    else:
-        raise AssertionError("floor-style lock line must exit 1, not be skipped")
-
-
-def test_lock_requirements_rejects_unpinned_editable_and_wildcard(tmp_path, capsys):
-    # Other non-pinned requirement forms must trip the same ratchet.
-    for bad in ("rune\n", "textual~=8.2\n", "aiohttp==3.*\n"):
-        path = write(tmp_path, "reqs.txt", bad)
-        try:
-            check_dep_lock.lock_requirements(path)
-        except SystemExit as exc:
-            assert exc.code == 1
-        else:
-            raise AssertionError(f"non-pinned line must exit 1: {bad!r}")
-
-
-def test_compare_identical_pins_with_different_comments_is_in_sync(tmp_path):
-    committed = write(tmp_path, "committed.txt", COMMITTED)
-    regenerated = write(
-        tmp_path,
-        "regen.txt",
-        "# autogenerated by uv via command with a temp -o path\naiohttp==3.14.3\n    # via rune (pyproject.toml)\ntextual==8.2.8\n",
-    )
-    assert check_dep_lock.compare(committed, regenerated) is None
-
-
-def test_compare_missing_pin_is_reported(tmp_path):
-    committed = write(tmp_path, "committed.txt", "aiohttp==3.14.3\ntextual==8.2.8\n")
-    regenerated = write(tmp_path, "regen.txt", "aiohttp==3.14.3\n")
-    report = check_dep_lock.compare(committed, regenerated)
-    assert report is not None
-    assert "textual" in report
-
-
-def test_compare_changed_pin_is_reported(tmp_path):
-    committed = write(tmp_path, "committed.txt", "aiohttp==3.14.3\n")
-    regenerated = write(tmp_path, "regen.txt", "aiohttp==3.15.0\n")
-    report = check_dep_lock.compare(committed, regenerated)
-    assert report is not None
-    assert "3.14.3" in report and "3.15.0" in report
-
-
-def test_compare_report_carries_regen_hint(tmp_path):
-    committed = write(tmp_path, "committed.txt", "aiohttp==3.14.3\n")
-    regenerated = write(tmp_path, "regen.txt", "aiohttp==3.15.0\n")
-    report = check_dep_lock.compare(committed, regenerated)
-    assert report is not None
-    assert "uv pip compile" in report
-    assert "--python-version 3.11" in report
-
-
-def test_main_exit_zero_when_in_sync(tmp_path, monkeypatch, capsys):
-    committed = write(tmp_path, "requirements-ci.txt", COMMITTED)
-    monkeypatch.setattr(check_dep_lock, "LOCK_FILE", committed)
-
-    def fake_compile(out_path: Path, root: Path = ROOT) -> int:
-        out_path.write_text(COMMITTED)
-        return 0
-
-    monkeypatch.setattr(check_dep_lock, "run_uv_compile", fake_compile)
-    assert check_dep_lock.main() == 0
-    assert "in sync" in capsys.readouterr().out
-
-
-def test_main_exit_one_when_drifted(tmp_path, monkeypatch, capsys):
-    committed = write(tmp_path, "requirements-ci.txt", COMMITTED)
-    monkeypatch.setattr(check_dep_lock, "LOCK_FILE", committed)
-
-    def fake_compile(out_path: Path, root: Path = ROOT) -> int:
-        out_path.write_text("aiohttp==3.15.0\ntextual==8.2.8\n")
-        return 0
-
-    monkeypatch.setattr(check_dep_lock, "run_uv_compile", fake_compile)
-    assert check_dep_lock.main() == 1
-    err = capsys.readouterr().err
-    assert "uv pip compile" in err
-    assert "aiohttp" in err
-
-
-def test_main_missing_uv_is_actionable_not_traceback(tmp_path, monkeypatch, capsys):
-    # #150 gate review: with uv absent (PATH stripped, no interpreter-adjacent
-    # or ~/.local/bin fallback), the checker must print the house actionable
-    # pattern — what to install, what command — not a raw FileNotFoundError.
-    committed = write(tmp_path, "requirements-ci.txt", COMMITTED)
-    monkeypatch.setattr(check_dep_lock, "LOCK_FILE", committed)
-    monkeypatch.setenv("PATH", "")
-    monkeypatch.setattr(check_dep_lock, "uv_binary", lambda: "no-such-uv-binary-xyz")
-    assert check_dep_lock.main() == 1
-    err = capsys.readouterr().err
-    assert "uv" in err and "not found" in err
-    assert "pip install" in err  # what to install / what command
-    assert "Traceback" not in err
-
-
-def test_main_exit_one_when_compile_fails(tmp_path, monkeypatch, capsys):
-    committed = write(tmp_path, "requirements-ci.txt", COMMITTED)
-    monkeypatch.setattr(check_dep_lock, "LOCK_FILE", committed)
-    monkeypatch.setattr(check_dep_lock, "run_uv_compile", lambda out_path, root=ROOT: 2)
-    assert check_dep_lock.main() == 1
-    assert "failed" in capsys.readouterr().err
@@ -1,163 +0,0 @@
-"""CI contract: coverage ratchet floors (#149) + lock wiring (#150).
-
-The coverage ratchet has two floors and one doctrine:
-
-* Global floor — ``.coveragerc`` ``[report] fail_under``: the total suite
-  coverage, measured and committed at the #149 baseline (29%). It may only
-  ever be RAISED (CPython devguide ratchet doctrine); this test enforces the
-  committed floor is at least the baseline, so a hand-edit cannot silently
-  lower it.
-* Changed-lines floor — ``diff-cover --fail-under=70`` in the CI test job:
-  changed/modified lines may not reduce tested coverage (issue #149's core
-  requirement). The step must exist, be wired after the pytest run, and
-  compare against origin/master.
-
-The dependency lock half (#150) is guarded here too because both live in the
-same CI contract: the test job installs ONLY from requirements-ci.txt, and
-the lint job runs the drift ratchet.
-"""
-
-from __future__ import annotations
-
-import configparser
-import re
-from pathlib import Path
-
-import yaml
-
-ROOT = Path(__file__).resolve().parents[1]
-CI_WORKFLOW = ROOT / ".gitea" / "workflows" / "ci.yml"
-COVERAGERC = ROOT / ".coveragerc"
-LOCK_FILE = ROOT / "requirements-ci.txt"
-
-# Measured 2026-09-07 at the #149 baseline (canary_* files omitted; see
-# .coveragerc header). The floor is a ratchet: never lower than this.
-BASELINE_TOTAL_COVERAGE = 29
-# Initial changed-lines floor from the plan (design decision 2).
-BASELINE_CHANGED_LINES_FLOOR = 70
-
-
-def load_ci() -> dict:
-    text = CI_WORKFLOW.read_text(encoding="utf-8")
-    data = yaml.safe_load(text)
-    assert isinstance(data, dict), "ci.yml did not parse to a mapping"
-    return data
-
-
-def unit_tests_steps() -> list[dict]:
-    job = load_ci()["jobs"]["unit-tests"]
-    steps = job.get("steps") or []
-    assert steps, "unit-tests job has no steps"
-    return steps
-
-
-def step_runs(steps: list[dict]) -> list[str]:
-    return [s.get("run") or "" for s in steps]
-
-
-def test_coveragerc_exists_with_ratchet_contract():
-    assert COVERAGERC.is_file(), ".coveragerc (both floors live here) is missing"
-    parser = configparser.ConfigParser()
-    parser.read(COVERAGERC)
-    assert parser.get("run", "source") == "src/rune"
-    omit = parser.get("run", "omit")
-    assert "tests/*" in omit and "scripts/*" in omit
-    # Global floor ratchet: at least the measured baseline, never lower.
-    floor = parser.getint("report", "fail_under")
-    assert floor >= BASELINE_TOTAL_COVERAGE, (
-        f"global coverage floor {floor} is below the committed baseline "
-        f"{BASELINE_TOTAL_COVERAGE} — the floor only ever rises (#149)"
-    )
-
-
-def test_changed_lines_floor_documented_in_coveragerc():
-    # The changed-lines floor lives in ci.yml (diff-cover flag), but the
-    # .coveragerc header is the single committed place that documents both
-    # floors and the raise-never-lower doctrine.
-    text = COVERAGERC.read_text(encoding="utf-8")
-    assert str(BASELINE_CHANGED_LINES_FLOOR) in text
-    assert "never lower" in text or "only ever rises" in text
-
-
-def test_ci_lock_requirements_cover_both_ratchet_tools():
-    # #150's lock is the install path: the ratchet tools must be pinned in it,
-    # otherwise the CI jobs cannot run them at all.
-    pins = LOCK_FILE.read_text(encoding="utf-8")
-    assert re.search(r"^coverage==\d+", pins, re.MULTILINE), "coverage not pinned in requirements-ci.txt"
-    assert re.search(r"^diff-cover==\d+", pins, re.MULTILINE), "diff-cover not pinned in requirements-ci.txt"
-
-
-def test_unit_tests_job_installs_from_pinned_lock():
-    runs = "\n".join(step_runs(unit_tests_steps()))
-    assert "-r requirements-ci.txt" in runs, "#150: test env must install from the pinned lock"
-    assert "-e . --no-deps" in runs
-
-
-def test_lint_job_runs_dependency_lock_drift_ratchet():
-    job = load_ci()["jobs"]["lint"]
-    runs = "\n".join(s.get("run") or "" for s in job.get("steps") or [])
-    assert "scripts/check_dep_lock.py" in runs
-
-
-def test_unit_tests_checkout_has_full_fetch_depth():
-    # diff-cover --compare-branch origin/master needs history: without
-    # fetch-depth: 0 the shallow checkout has no origin/master to diff against.
-    for step in unit_tests_steps():
-        if "uses" in step and str(step["uses"]).startswith("actions/checkout"):
-            assert step.get("with", {}).get("fetch-depth") == 0, (
-                "unit-tests checkout must use fetch-depth: 0 for the diff-cover compare branch"
-            )
-            return
-    raise AssertionError("unit-tests job has no actions/checkout step")
-
-
-def test_unit_tests_wraps_pytest_with_coverage_run():
-    runs = step_runs(unit_tests_steps())
-    pytest_steps = [r for r in runs if "pytest" in r]
-    assert pytest_steps, "unit-tests job never runs pytest"
-    for r in pytest_steps:
-        assert "coverage run -m pytest" in r, (
-            "pytest must run under `coverage run -m pytest` so the XML report exists (#149)"
-        )
-        assert re.search(r"^\s*\.test-venv/bin/python -m pytest", r, re.MULTILINE) is None, (
-            "bare pytest invocation found — it would silently skip coverage (#149)"
-        )
-
-
-def test_pr_context_diff_is_against_merge_base():
-    # Gitea Actions checks out the PR merge ref; a plain
-    # --compare-branch origin/master diff can span unrelated merge-commit
-    # lines. diff-cover's supported mechanism for an explicit range is
-    # --diff-range-notation: '...' (default, three-dot) vs '..' (two-dot,
-    # diff against the merge base). The CI step must pin the notation
-    # explicitly so the changed-lines set is the PR's own lines (#149).
-    runs = "\n".join(step_runs(unit_tests_steps()))
-    assert re.search(r"diff-cover coverage\.xml.*--diff-range-notation \.\.\s", runs, re.DOTALL), (
-        "diff-cover must pin the diff range notation explicitly so PR coverage is measured "
-        "against the merge base, not the merge-ref tip (#149)"
-    )
-
-
-def test_unit_tests_publishes_global_floor_and_changed_lines_floor():
-    runs = "\n".join(step_runs(unit_tests_steps()))
-    assert re.search(r"coverage report --fail-under=\d+", runs), (
-        "missing `coverage report --fail-under=<floor>` step (global floor, #149)"
-    )
-    assert "coverage xml" in runs, "missing `coverage xml` step (diff-cover needs the XML report)"
-    assert re.search(
-        rf"diff-cover coverage\.xml --compare-branch origin/master --fail-under={BASELINE_CHANGED_LINES_FLOOR}\b", runs
-    ), (
-        "missing `diff-cover coverage.xml --compare-branch origin/master --fail-under=70` step "
-        "(changed-lines floor, #149)"
-    )
-
-
-def test_floors_never_lower_than_baseline_anywhere_in_ci():
-    # Belt and braces: even if the step strings drift, no CI coverage floor
-    # may appear with a value below the committed baselines.
-    runs = "\n".join(step_runs(unit_tests_steps()))
-    for m in re.finditer(r"--fail-under=(\d+)", runs):
-        value = int(m.group(1))
-        assert value >= min(BASELINE_TOTAL_COVERAGE, BASELINE_CHANGED_LINES_FLOOR), (
-            f"a CI floor dropped below baseline: --fail-under={value} (#149 ratchet)"
-        )
Author	SHA1	Message	Date
Nick	65b76afb8c	Merge remote-tracking branch 'gitea/master' into bugfix-contract CI Pipeline / lint (pull_request) Successful in 24s Details CI Pipeline / unit-tests (pull_request) Successful in 58s Details CI Pipeline / canary (pull_request) Successful in 25s Details CI Pipeline / best-practices (pull_request) Successful in 2s Details CI Pipeline / documentation (pull_request) Successful in 2s Details CI Pipeline / type-check (pull_request) Successful in 21s Details CI Pipeline / gitea-offline (pull_request) Successful in 13s Details CI Pipeline / required-checks (pull_request) Successful in 0s Details auto-version.yml (push) Invalid workflow file Details CI Pipeline / best-practices (push) Successful in 3s Details CI Pipeline / documentation (push) Successful in 2s Details CI Pipeline / gitea-offline (push) Successful in 14s Details CI Pipeline / canary (push) Failing after 35s Details CI Pipeline / lint (push) Successful in 41s Details CI Pipeline / unit-tests (push) Failing after 47s Details CI Pipeline / type-check (push) Successful in 31s Details CI Pipeline / required-checks (push) Skipped Details	2026-09-07 21:00:58 +01:00
Nick	ff49fba738	style: ruff format added files (CI lint format-check)	2026-09-07 20:46:57 +01:00
Nick	62abca0538	style: ruff format discharge checker (CI lint format-check) CI Pipeline / lint (push) Failing after 17s Details CI Pipeline / unit-tests (push) Successful in 55s Details CI Pipeline / canary (push) Successful in 25s Details CI Pipeline / best-practices (push) Successful in 2s Details CI Pipeline / documentation (push) Successful in 2s Details CI Pipeline / type-check (push) Failing after 21s Details CI Pipeline / gitea-offline (push) Successful in 14s Details CI Pipeline / required-checks (push) Skipped Details CI Pipeline / lint (pull_request) Failing after 24s Details CI Pipeline / unit-tests (pull_request) Successful in 30s Details CI Pipeline / canary (pull_request) Successful in 25s Details CI Pipeline / best-practices (pull_request) Successful in 2s Details CI Pipeline / documentation (pull_request) Successful in 3s Details CI Pipeline / type-check (pull_request) Failing after 21s Details CI Pipeline / gitea-offline (pull_request) Successful in 13s Details CI Pipeline / required-checks (pull_request) Skipped Details	2026-09-07 20:46:41 +01:00
Nick	dac9bec488	feat(contract): pipeline-expansion henxels — workflows/TUI registries, module-coverage rule with shrinking debt ledger (#204 , #147 ) CI Pipeline / lint (push) Successful in 39s Details CI Pipeline / unit-tests (push) Successful in 39s Details CI Pipeline / canary (push) Successful in 1m3s Details CI Pipeline / best-practices (push) Successful in 2s Details CI Pipeline / documentation (push) Successful in 2s Details CI Pipeline / type-check (push) Successful in 21s Details CI Pipeline / gitea-offline (push) Successful in 13s Details CI Pipeline / required-checks (push) Skipped Details CI Pipeline / lint (pull_request) Failing after 17s Details CI Pipeline / unit-tests (pull_request) Successful in 30s Details CI Pipeline / canary (pull_request) Successful in 24s Details CI Pipeline / best-practices (pull_request) Successful in 2s Details CI Pipeline / documentation (pull_request) Successful in 2s Details CI Pipeline / type-check (pull_request) Successful in 21s Details CI Pipeline / gitea-offline (pull_request) Successful in 13s Details CI Pipeline / required-checks (pull_request) Skipped Details	2026-09-07 17:46:46 +01:00
Nick	a9fe30bb7c	feat(contract): binding refinements (soak-close, escape accountability, fresh-context RCA, deja-vu, fixture promotion) + henxels rules fitted to pipeline (#147 ) CI Pipeline / lint (push) Successful in 24s Details CI Pipeline / unit-tests (push) Successful in 56s Details CI Pipeline / canary (push) Successful in 26s Details CI Pipeline / best-practices (push) Successful in 2s Details CI Pipeline / documentation (push) Successful in 2s Details CI Pipeline / type-check (push) Successful in 21s Details CI Pipeline / gitea-offline (push) Successful in 13s Details CI Pipeline / required-checks (push) Skipped Details CI Pipeline / lint (pull_request) Failing after 17s Details CI Pipeline / unit-tests (pull_request) Successful in 31s Details CI Pipeline / canary (pull_request) Successful in 24s Details CI Pipeline / best-practices (pull_request) Successful in 2s Details CI Pipeline / documentation (pull_request) Successful in 2s Details CI Pipeline / type-check (pull_request) Successful in 21s Details CI Pipeline / gitea-offline (pull_request) Successful in 13s Details CI Pipeline / required-checks (pull_request) Skipped Details	2026-09-07 17:15:23 +01:00
Nick	a78588048b	feat(contract): bug-fix discharge contract — red-first fixes, full pipeline re-entry, frozen regression tests (#147 ) CI Pipeline / lint (push) Failing after 17s Details CI Pipeline / unit-tests (push) Successful in 55s Details CI Pipeline / canary (push) Successful in 26s Details CI Pipeline / best-practices (push) Successful in 2s Details CI Pipeline / documentation (push) Successful in 3s Details CI Pipeline / type-check (push) Successful in 40s Details CI Pipeline / gitea-offline (push) Successful in 20s Details CI Pipeline / required-checks (push) Skipped Details Auto-label / priority-gate (pull_request) Skipped Details Auto-label / auto-label (pull_request) Successful in 2s Details CI Pipeline / lint (pull_request) Failing after 17s Details CI Pipeline / unit-tests (pull_request) Successful in 30s Details CI Pipeline / canary (pull_request) Successful in 25s Details CI Pipeline / best-practices (pull_request) Successful in 2s Details CI Pipeline / documentation (pull_request) Successful in 3s Details CI Pipeline / type-check (pull_request) Successful in 21s Details CI Pipeline / gitea-offline (pull_request) Successful in 14s Details CI Pipeline / required-checks (pull_request) Skipped Details	2026-09-07 16:59:04 +01:00