# anatomy.md

> Auto-maintained by OpenWolf. Last scanned: 2026-08-25T04:01:04.056Z
> Files: 726 tracked | Anatomy hits: 0 | Misses: 0

## ../../../../../../tmp/

- `apiserver` (~27 tok)

## ../../../../../../tmp/claude-1000/-home-rshen-projects-xce-worktrees-scheduler-framework/01599b27-8a93-432e-a4a8-263066731f52/scratchpad/

- `add_bug1573.py` — Declares core_apply_worker_resvals (~901 tok)
- `check_leftover.sh` — Standalone leftover-process checker -- avoids the bug-1576 self-match (~180 tok)
- `crash_handler.c` — define _GNU_SOURCE (~485 tok)
- `exe-watch.sh` — Watches for a REAL worker daemon process by checking each PID's /proc/exe (~193 tok)
- `fake-apiserver.sh` — Deliberately-crashing fake apiserver binary for independent mid-abort (~96 tok)
- `fix_bug_1574.py` (~799 tok)
- `fix_bug1572.py` (~1026 tok)
- `gdbcmds.txt` (~63 tok)
- `proc_worker_scan.sh` — Scan /proc/<pid>/exe for any process whose REAL BINARY (not argv/cmdline (~300 tok)
- `procscan.sh` — Scan /proc for real processes whose cmdline references the given (~261 tok)
- `reviewer_synth_test.sh` — Independent reviewer synthetic test -- sources the REAL script (production (~1538 tok)
- `stress_driver.sh` — Independent stress-test driver for run-resource-verify.sh's trap-based (~758 tok)
- `synth_aggregate_test_round2.sh` — Round-2 synthetic regression suite for run-resource-verify.sh's task 7.1 (~2469 tok)
- `synth_aggregate_test.sh` — Synthetic sanity-check for run-resource-verify.sh's aggregate_verdict() (~1559 tok)
- `test_aggregate.sh` — Independent synthetic test of aggregate_verdict() / build_verdict_record() (~2105 tok)
- `test-sched-check.sh` — Synthetic (no live deployment) test of query_scheduler_resvals() / poll_scheduler_log() (~783 tok)
- `trap_repro.sh` (~301 tok)
- `xtest_script.txt` (~52 tok)

## ../../../../../../tmp/claude-1000/-home-rshen-projects-xce-worktrees-scheduler-framework/0334ebbe-8d9c-4931-871d-87c678f83a79/scratchpad/

- `dryrun_funcs.sh` — Dry-run harness: extracts and exercises the pure functions from the new (~1407 tok)
- `fix_bug1604.py` (~813 tok)
- `log_bug_1602.py` (~1054 tok)

## ../../../../../../tmp/claude-1000/-home-rshen-projects-xce-worktrees-scheduler-framework/0334ebbe-8d9c-4931-871d-87c678f83a79/scratchpad/dfp-4.3-remediation/fakebin/

- `git` — Wrapper: fail ONLY `git diff` (and any `git diff ...` invocation), pass (~55 tok)

## ../../../../../../tmp/claude-1000/-home-rshen-projects-xce-worktrees-scheduler-framework/0334ebbe-8d9c-4931-871d-87c678f83a79/scratchpad/dfp_test/

- `Makefile.after` (~441 tok)
- `Makefile.before` (~376 tok)

## ../../../../../../tmp/claude-1000/-home-rshen-projects-xce-worktrees-scheduler-framework/2455e81b-dd7c-4f96-b2cd-548167b22732/scratchpad/

- `close_out_bug1588.py` — Declares parameter (~1202 tok)
- `fix_buglog_1629.py` (~405 tok)
- `tasks-draft.md` — Implementation Plan (~2677 tok)
- `update_bug1613.py` (~859 tok)
- `update_buglog.py` (~1058 tok)

## ../../../../../../tmp/claude-1000/-home-rshen-projects-xce-worktrees-scheduler-framework/fe2ba1fe-c8fb-4d72-986e-1c8e2406aa3a/scratchpad/

- `strstr_probe.c` — define _GNU_SOURCE (~236 tok)

## ../../../../../claude/.claude/plugins/claude-hud/

- `config.json` (~310 tok)

## ../../../../../claude/.claude/projects/-home-rshen-projects-xce-xce/memory/

- `incident_subagent_scope_violation.md` (~1171 tok)
- `MEMORY.md` (~83 tok)
- `project_bug_tracker_buglog.md` (~369 tok)

## ../../xce/.claude/worktrees/fix-bug-1613/.kiro/steering/

- `scheduler-driver-equivalence.md` — Scheduler Driver Equivalence (~1520 tok)

## ../../xce/.claude/worktrees/fix-bug-1613/src/scheduler/

- `CLAUDE.md` — XCE Scheduler (~1264 tok)

## ./

- `.clang-format` (~226 tok)
- `.gitignore` — Git ignore rules (~402 tok)
- `.mcp.json` (~7 tok)
- `.opencode.json` (~7 tok)
- `CLAUDE.md` — OpenWolf (~1484 tok)
- `README.md` — Project documentation (~612 tok)

## .agent-shell/transcripts/

- `2026-08-11-11-39-59.md` — Agent Shell Transcript (~104 tok)
- `2026-08-11-14-49-05.md` — Agent Shell Transcript (~188 tok)
- `2026-08-11-22-00-54.md` — Agent Shell Transcript (~9623 tok)
- `2026-08-15-22-30-02.md` — Agent Shell Transcript (~438 tok)
- `2026-08-16-06-11-30.md` — Agent Shell Transcript (~60273 tok)

## .claude/

- `settings.json` (~718 tok)

## .claude/rules/

- `openwolf.md` (~313 tok)

## .claude/skills/gitea-sync/

- `SKILL.md` — Gitea Sync Skill (~1875 tok)

## .claude/skills/kiro-debug/

- `SKILL.md` — kiro-debug (~1322 tok)

## .claude/skills/kiro-discovery/

- `SKILL.md` — kiro-discovery Skill (~3387 tok)

## .claude/skills/kiro-impl/

- `SKILL.md` — kiro-impl Skill (~4048 tok)

## .claude/skills/kiro-impl/templates/

- `debugger-prompt.md` — Debug Investigator (~812 tok)
- `implementer-prompt.md` — TDD Task Implementer (~1659 tok)
- `reviewer-prompt.md` — Task Implementation Reviewer (~1352 tok)

## .claude/skills/kiro-review/

- `SKILL.md` — kiro-review (~1756 tok)

## .claude/skills/kiro-spec-batch/

- `SKILL.md` — kiro-spec-batch Skill (~2293 tok)

## .claude/skills/kiro-spec-design/

- `SKILL.md` — kiro-spec-design Skill (~2869 tok)

## .claude/skills/kiro-spec-design/rules/

- `design-discovery-full.md` — Full Discovery Process for Technical Design (~949 tok)
- `design-discovery-light.md` — Light Discovery Process for Extensions (~389 tok)
- `design-principles.md` — Technical Design Rules and Principles (~2982 tok)
- `design-review-gate.md` — Design Review Gate (~1016 tok)
- `design-synthesis.md` — Design Synthesis (~464 tok)

## .claude/skills/kiro-spec-design/templates/specs/

- `design.md` — Design Document Template (~3303 tok)
- `research.md` — Research & Design Decisions Template (~586 tok)

## .claude/skills/kiro-spec-init/

- `SKILL.md` — Spec Initialization (~783 tok)

## .claude/skills/kiro-spec-init/templates/specs/

- `init.json` (~125 tok)
- `requirements-init.md` — Requirements Document (~40 tok)

## .claude/skills/kiro-spec-quick/

- `SKILL.md` — Quick Spec Generator (~1993 tok)

## .claude/skills/kiro-spec-quick/templates/specs/

- `init.json` (~125 tok)
- `requirements-init.md` — Requirements Document (~40 tok)

## .claude/skills/kiro-spec-requirements/

- `SKILL.md` — kiro-spec-requirements Skill (~2122 tok)

## .claude/skills/kiro-spec-requirements/rules/

- `ears-format.md` — EARS Format Guidelines (~739 tok)
- `requirements-review-gate.md` — Requirements Review Gate (~924 tok)

## .claude/skills/kiro-spec-requirements/templates/specs/

- `requirements.md` — Requirements Document (~325 tok)

## .claude/skills/kiro-spec-status/

- `SKILL.md` — kiro-spec-status Skill (~746 tok)

## .claude/skills/kiro-spec-tasks/

- `SKILL.md` — kiro-spec-tasks Skill (~2460 tok)

## .claude/skills/kiro-spec-tasks/rules/

- `tasks-generation.md` — Task Generation Rules (~2773 tok)
- `tasks-parallel-analysis.md` — Parallel Task Analysis Rules (~633 tok)

## .claude/skills/kiro-spec-tasks/templates/specs/

- `tasks.md` — Implementation Plan (~318 tok)

## .claude/skills/kiro-steering-custom/

- `SKILL.md` — kiro-steering-custom Skill (~1222 tok)

## .claude/skills/kiro-steering-custom/rules/

- `steering-principles.md` — Steering Principles (~593 tok)

## .claude/skills/kiro-steering-custom/templates/steering-custom/

- `api-standards.md` — API Standards (~415 tok)
- `authentication.md` — Authentication & Authorization Standards (~523 tok)
- `database.md` — Database Standards (~377 tok)
- `deployment.md` — Deployment Standards (~441 tok)
- `error-handling.md` — Error Handling Standards (~549 tok)
- `security.md` — Security Standards (~523 tok)
- `testing.md` — Testing Standards (~325 tok)

## .claude/skills/kiro-steering/

- `SKILL.md` — kiro-steering Skill (~1185 tok)

## .claude/skills/kiro-steering/rules/

- `steering-principles.md` — Steering Principles (~593 tok)

## .claude/skills/kiro-steering/templates/steering/

- `product.md` — Product Overview (~89 tok)
- `structure.md` — Project Structure (~218 tok)
- `tech.md` — Technology Stack (~198 tok)

## .claude/skills/kiro-validate-design/

- `SKILL.md` — kiro-validate-design Skill (~1296 tok)

## .claude/skills/kiro-validate-design/rules/

- `design-review.md` — Design Review Process (~1090 tok)

## .claude/skills/kiro-validate-gap/

- `SKILL.md` — kiro-validate-gap Skill (~1385 tok)

## .claude/skills/kiro-validate-gap/rules/

- `gap-analysis.md` — Gap Analysis Process (~1266 tok)

## .claude/skills/kiro-validate-impl/

- `SKILL.md` — kiro-validate-impl Skill (~2826 tok)

## .claude/skills/kiro-verify-completion/

- `SKILL.md` — kiro-verify-completion (~972 tok)

## .claude/skills/weekly_report/

- `SKILL.md` — weekly_report Skill (~3367 tok)

## .claude/skills/xce-audit-invariants/

- `SKILL.md` — XCE Design-Invariant Audit & Fix — audit documented invariants, fix confirmed violations, prove with build+unit+live HA soak (~2311 tok)

## .claude/skills/xce-build/

- `SKILL.md` — build xce source code (~2597 tok)

## .claude/skills/xce-deploy-ha/

- `SKILL.md` — XCE HA Cluster Deployment; now auto-picks real `xcecd` (sudo, root) vs `xcecd_virtual` per host via `/run/systemd/system` (~8200 tok)

## .claude/skills/xce-test-ha/

- `run-ha-soak.sh` — run-ha-soak.sh — driver for /xce-test-ha: deploy a 3-node XCE HA cluster, then (~44744 tok)
- `SKILL.md` — XCE HA Failover Soak Test (~9766 tok)
- `soak-verdict-selftest.sh` — soak-verdict-selftest.sh — deterministic unit test for the verdict parser in (~2825 tok)
- `soak-verdict.sh` — soak-verdict.sh — pure (side-effect-free) verdict helpers for run-ha-soak.sh. (~2980 tok)

## .claude/skills/xce-test-resources/

- `run-resource-verify.sh` — run-resource-verify.sh -- driver for /xce-test-resources: end-to-end (~21445 tok)
- `SKILL.md` — XCE Resource-Value Verification skill contract, FULLY UPDATED for task 7.1 completion: "Status: complete and functional", real VERDICT line format (`resources=N layers_checked=3 mismatches=M unreachable=U rejected=R result=PASS|FAIL`), real flag names (`--keep-running`, `--dir DIR`, `$XCE_RESVERIFY_*` env vars, all cross-checked against the actual script), FAILURE-line format, self-contained/sourceable `aggregate_verdict()` note for task 8.2, known-bugs section (1572/1574 open, 1579 fixed). No longer says "not yet implemented" anywhere. (~3400 tok)
- `verdict-logic-selftest.sh` — verdict-logic-selftest.sh -- deterministic, no-deployment unit test for (~3135 tok)

## .codegraph/

- `.gitignore` — Git ignore rules (~61 tok)
- `daemon.log` (~6538 tok)

## .kiro/settings/rules/

- `design-discovery-full.md` — Full Discovery Process for Technical Design (~949 tok)
- `design-discovery-light.md` — Light Discovery Process for Extensions (~389 tok)
- `design-principles.md` — Technical Design Rules and Principles (~2982 tok)
- `design-review-gate.md` — Design Review Gate (~1016 tok)
- `design-review.md` — Design Review Process (~1090 tok)
- `design-synthesis.md` — Design Synthesis (~464 tok)
- `ears-format.md` — EARS Format Guidelines (~739 tok)
- `gap-analysis.md` — Gap Analysis Process (~1266 tok)
- `requirements-review-gate.md` — Requirements Review Gate (~924 tok)
- `steering-principles.md` — Steering Principles (~593 tok)
- `tasks-generation.md` — Task Generation Rules (~2773 tok)
- `tasks-parallel-analysis.md` — Parallel Task Analysis Rules (~633 tok)

## .kiro/settings/templates/specs/

- `design.md` — Design Document Template (~3303 tok)
- `init.json` (~125 tok)
- `requirements-init.md` — Requirements Document (~40 tok)
- `requirements.md` — Requirements Document (~325 tok)
- `research.md` — Research & Design Decisions Template (~586 tok)
- `tasks.md` — Implementation Plan (~318 tok)

## .kiro/settings/templates/steering-custom/

- `api-standards.md` — API Standards (~415 tok)
- `authentication.md` — Authentication & Authorization Standards (~523 tok)
- `database.md` — Database Standards (~377 tok)
- `deployment.md` — Deployment Standards (~441 tok)
- `error-handling.md` — Error Handling Standards (~549 tok)
- `security.md` — Security Standards (~523 tok)
- `testing.md` — Testing Standards (~325 tok)

## .kiro/settings/templates/steering/

- `product.md` — Product Overview (~89 tok)
- `structure.md` — Project Structure (~218 tok)
- `tech.md` — Technology Stack (~198 tok)

## .kiro/specs/

- `.gitignore` — Git ignore rules (~3 tok)

## .kiro/specs/admin-config-tool/

- `brief.md` — Brief: admin-config-tool (~10613 tok)
- `design.md` — Technical Design: admin-config-tool (~13515 tok)
- `requirements.md` — Requirements Document (~5992 tok)
- `research.md` — Research & Design Decisions: admin-config-tool (~8886 tok)
- `spec.json` (~1040 tok)
- `tasks.md` — Implementation Plan (~9416 tok)

## .kiro/specs/build-time-versioning/

- `design.md` — Design Document (~5779 tok)
- `requirements.md` — Requirements Document (~1680 tok)
- `research.md` — Research & Design Decisions (~2236 tok)
- `spec.json` (~132 tok)
- `tasks.md` — Implementation Plan (~4349 tok)

## .kiro/specs/clusterconfig-schema-split/

- `design.md` — Overview (~7542 tok)
- `requirements.md` — Requirements Document (~4621 tok)
- `research.md` — Research & Design Decisions (~7013 tok)
- `spec.json` (~133 tok)
- `tasks.md` — Implementation Plan (~2668 tok)

## .kiro/specs/component-failover-adoption/

- `design.md` — Design Document: component-failover-adoption (~17338 tok)
- `requirements.md` — Requirements Document (~4175 tok)
- `research.md` — Research & Design Decisions (~6985 tok)
- `spec.json` (~638 tok)
- `tasks.md` — Implementation Plan (~14898 tok)

## .kiro/specs/component-rejoin-resync/

- `brief.md` — Brief: component-rejoin-resync (~1187 tok)
- `spec.json` (~214 tok)

## .kiro/specs/config-upgrade-snapshot/

- `brief.md` — Brief: config-upgrade-snapshot (~1108 tok)
- `design.md` — Design Document: config-upgrade-snapshot (~13143 tok)
- `requirements.md` — Requirements Document (~7093 tok)
- `research.md` — Gap Analysis — config-upgrade-snapshot (2026-06-24) (~11380 tok)
- `spec.json` (~387 tok)
- `tasks.md` — Implementation Plan (~12616 tok)

## .kiro/specs/controller-status/

- `design.md` — Design Document — controller-status (`ctrlstatus`) (~8356 tok)
- `requirements.md` — Requirements Document (~3158 tok)
- `research.md` — Gap Analysis — controller-status (ctrlstatus) (~4457 tok)
- `spec.json` (~1011 tok)
- `tasks.md` — Implementation Plan (~5073 tok)

## .kiro/specs/dirty-content-fingerprint/

- `design.md` — Design Document (~6899 tok)
- `requirements.md` — Requirements Document (~2326 tok)
- `research.md` — Research & Design Decisions (~5146 tok)
- `spec.json` (~133 tok)
- `tasks.md` — Implementation Plan (~5390 tok)

## .kiro/specs/election-iomgr-refactor/

- `design.md` — Design Document: election-iomgr-refactor (~8505 tok)
- `requirements.md` — Requirements Document (~2695 tok)
- `research.md` — Research & Design Decisions (~11773 tok)
- `spec.json` (~129 tok)
- `tasks.md` — Implementation Plan (~3693 tok)

## .kiro/specs/ha-commit-barrier-rollout/

- `brief.md` — Brief: ha-commit-barrier-rollout (~626 tok)
- `design.md` — Design: ha-commit-barrier-rollout (~12605 tok)
- `requirements.md` — Requirements Document (~3181 tok)
- `research.md` — Research & Design Decisions: ha-commit-barrier-rollout (~6381 tok)
- `spec.json` (~341 tok)
- `tasks.md` — Implementation Plan: ha-commit-barrier-rollout (~5658 tok)

## .kiro/specs/ha-commit-durability/

- `brief.md` — Brief: ha-commit-durability (~2855 tok)
- `design.md` — Design Document — ha-commit-durability (~16535 tok)
- `INVESTIGATION-failover-job-loss.md` — Investigation: committed jobs lost across controller failover (bug-795 family) (~6171 tok)
- `requirements.md` — Requirements Document (~2587 tok)
- `research.md` — Gap Analysis — ha-commit-durability (~7773 tok)
- `spec.json` — phase implementation-complete, validate_impl GO (2026-07-18) (~2378 tok)
- `tasks.md` — Implementation Plan (~11353 tok)

## .kiro/specs/ha-commit-durability/repro-851/

- `ctrl-1.log` (~6116 tok)
- `ctrl-2.log` (~3742 tok)
- `ctrl-3.log` (~8148 tok)
- `waldump-ctrl-1.txt` (~1383 tok)
- `waldump-ctrl-2.txt` (~1383 tok)
- `waldump-ctrl-3.txt` (~1395 tok)

## .kiro/specs/ha-commit-engine/

- `brief.md` — Brief: ha-commit-engine (~588 tok)
- `design.md` — Design: ha-commit-engine (~8326 tok)
- `requirements.md` — Requirements Document (~2715 tok)
- `research.md` — Research Log: ha-commit-engine (~3398 tok)
- `spec.json` (~255 tok)
- `tasks.md` — Implementation Plan: ha-commit-engine (~4593 tok)

## .kiro/specs/ha-config-bootstrap/

- `brief.md` — Brief: ha-election-raft-config (~16310 tok)
- `design.md` — Design: HA Config Bootstrap & Raft-Style Quorum Election (~12557 tok)
- `election-trace.md` — Election Trace: 3-Node Cold Start (2026-06-04 00:15:58) (~2907 tok)
- `manual-tests.md` — Manual Integration Tests: ha-config-bootstrap (~3748 tok)
- `requirements.md` — Requirements: HA Config Bootstrap & Raft-Style Quorum Election (~3890 tok)
- `research.md` — Cross-Spec Gap Audit (2026-06-03) (~16849 tok)
- `spec.json` (~545 tok)
- `tasks.md` — Implementation Plan: HA Config Bootstrap & Raft-Style Quorum Election (~5780 tok)

## .kiro/specs/ha-consistency-invariants/

- `brief.md` — Brief: ha-consistency-invariants (~2916 tok)
- `design.md` — Design: ha-consistency-invariants (~9196 tok)
- `requirements.md` — Requirements Document (~3772 tok)
- `research.md` — Gap Analysis: ha-consistency-invariants (~10252 tok)
- `spec.json` (~560 tok)

## .kiro/specs/ha-convergence-recovery/

- `brief.md` — Brief: ha-convergence-recovery (~746 tok)
- `design.md` — Design: ha-convergence-recovery (~11283 tok)
- `requirements.md` — Requirements Document (~3867 tok)
- `research.md` — Research & Design Decisions: ha-convergence-recovery (~8994 tok)
- `spec.json` (~190 tok)
- `tasks.md` — Implementation Plan: ha-convergence-recovery (~5999 tok)

## .kiro/specs/ha-elect-ctx-lifecycle/

- `brief.md` — Discovery Brief: ha-elect-ctx-lifecycle (~774 tok)
- `design.md` — Design Document: ha-elect-ctx-lifecycle (~5237 tok)
- `requirements.md` — Requirements Document (~1634 tok)
- `research.md` — Research / Gap Analysis — ha-elect-ctx-lifecycle (~2095 tok)
- `spec.json` (~2554 tok)
- `tasks.md` — Implementation Plan: ha-elect-ctx-lifecycle (~1696 tok)

## .kiro/specs/ha-entity-snapshots/

- `design.md` — Design Document: ha-entity-snapshots (~8948 tok)
- `requirements.md` — Requirements Document (~2216 tok)
- `research.md` — Gap Analysis: ha-entity-snapshots (~4497 tok)
- `spec.json` (~1450 tok)
- `tasks.md` — Implementation Plan (~3997 tok)

## .kiro/specs/ha-heartbeat-committed-propagation/

- `brief.md` — Brief: ha-heartbeat-committed-propagation (~1403 tok)
- `design.md` — Design Document — ha-heartbeat-committed-propagation (~4865 tok)
- `requirements.md` — Requirements Document (~1763 tok)
- `research.md` — Research / Gap Analysis — ha-heartbeat-committed-propagation (~2474 tok)
- `spec.json` (~2799 tok)
- `tasks.md` — Implementation Plan (~2873 tok)

## .kiro/specs/ha-heartbeat-liveness/

- `design.md` — Design Document: ha-heartbeat-liveness (~5926 tok)
- `manual-tests.md` — Manual Integration Tests: ha-heartbeat-liveness — Task 4.5 (~1726 tok)
- `requirements.md` — Requirements Document (~2054 tok)
- `research.md` — Gap Analysis: ha-heartbeat-liveness (~7901 tok)
- `spec.json` (~171 tok)
- `tasks.md` — Implementation Plan (~2227 tok)

## .kiro/specs/ha-peer-connection-reuse/

- `design.md` — Design Document: ha-peer-connection-reuse (~6506 tok)
- `requirements.md` — Requirements Document (~1605 tok)
- `research.md` — Research & Design Decisions: ha-peer-connection-reuse (~8740 tok)
- `spec.json` (~169 tok)
- `tasks.md` — Implementation Plan: ha-peer-connection-reuse (~2022 tok)

## .kiro/specs/ha-prevote/

- `design.md` — Design Document (~7342 tok)
- `requirements.md` — Requirements Document (~3604 tok)
- `research.md` — Gap Analysis: ha-prevote (~8259 tok)
- `spec.json` (~3803 tok)
- `tasks.md` — Implementation Plan (~3197 tok)

## .kiro/specs/ha-repl-hardening/

- `design.md` — Design: HA Replication Hardening (~6606 tok)
- `raft-tla-audit.md` — Raft TLA+ Specification Audit (~1591 tok)
- `requirements.md` — Requirements Document (~2850 tok)
- `research.md` — Gap Analysis: HA Replication Hardening (~11568 tok)
- `spec.json` (~198 tok)
- `tasks.md` — Implementation Plan: HA Replication Hardening (~4501 tok)

## .kiro/specs/ha-single-leader-role/

- `brief.md` — Brief: ha-single-leader-role (~624 tok)
- `design.md` — Design: ha-single-leader-role (~8611 tok)
- `requirements.md` — Requirements Document (~2177 tok)
- `research.md` — Research & Discovery Log: ha-single-leader-role (~5686 tok)
- `spec.json` (~177 tok)
- `tasks.md` — Implementation Plan: ha-single-leader-role (~5040 tok)

## .kiro/specs/ha-term-safety/

- `design.md` — Design Document (~11209 tok)
- `requirements.md` — Requirements Document (~4240 tok)
- `research.md` — Research & Design Decisions (~5375 tok)
- `spec.json` (~785 tok)
- `tasks.md` — Implementation Plan (~14377 tok)
- `TLA-gap-analysis.md` — Gap Analysis: XCE HA implementation vs `raft/raft.tla` (~2070 tok)

## .kiro/specs/ha-wal-replication/

- `brief.md` — Brief: ha-wal-replication (~829 tok)
- `design.md` — Design: HA WAL Replication (~1456 tok)
- `requirements.md` — Requirements Document (~1087 tok)
- `research.md` — Research: HA WAL Replication (~2542 tok)
- `spec.json` (~2214 tok)
- `tasks.md` — Implementation Plan: HA WAL Replication (~1913 tok)

## .kiro/specs/job-array-single-wal-record/

- `brief.md` — Brief: job-array-single-wal-record (~1277 tok)
- `design.md` — Design Document: job-array-single-wal-record (~14117 tok)
- `requirements.md` — Requirements Document (~5216 tok)
- `research.md` — Research & Design Decisions: job-array-single-wal-record (~7857 tok)
- `spec.json` (~444 tok)
- `tasks.md` — Implementation Plan: job-array-single-wal-record (~15580 tok)

## .kiro/specs/libxce-failover/

- `brief.md` — Brief: libxce-failover (~2238 tok)
- `design.md` — Design Document — libxce-failover (~8279 tok)
- `requirements.md` — Requirements Document (~2933 tok)
- `research.md` — Research Log — libxce-failover (~4638 tok)
- `spec.json` (~787 tok)
- `tasks.md` — Implementation Plan (~4086 tok)

## .kiro/specs/raft-adapter-conformance/

- `design.md` — Design Document: raft-adapter-conformance (~9311 tok)
- `requirements.md` — Requirements Document (~4577 tok)
- `research.md` — Gap Analysis: raft-adapter-conformance (~8747 tok)
- `spec.json` (~578 tok)
- `tasks.md` — Implementation Plan (~4416 tok)

## .kiro/specs/raft-apply-decoupling/

- `brief.md` — Brief: raft-apply-decoupling (~2239 tok)
- `design.md` — Design Document: raft-apply-decoupling (~9566 tok)
- `facts-in-raft.md` — Design Note: Routing Facts Through Raft (apply-after-commit for RETAIN events) (~5569 tok)
- `requirements.md` — Requirements Document (~4752 tok)
- `research.md` — Research & Design Decisions (~4600 tok)
- `spec.json` (~128 tok)
- `tasks.md` — Implementation Plan (~23836 tok)

## .kiro/specs/raft-commit-safety/

- `brief.md` — Brief: raft-commit-safety (~967 tok)
- `design.md` — Design Document (~8677 tok)
- `requirements.md` — Requirements Document (~4523 tok)
- `research.md` — Gap Analysis — raft-commit-safety (2026-06-24) (~1679 tok)
- `spec.json` (~515 tok)
- `tasks.md` — Implementation Plan (~3186 tok)

## .kiro/specs/raft-drive-async/

- `brief.md` — Brief: raft-drive-async (~2465 tok)
- `design.md` — Design Document — raft-drive-async (~9226 tok)
- `requirements.md` — Requirements Document (~3369 tok)
- `research.md` — Gap Analysis — raft-drive-async (2026-06-25) (~3578 tok)
- `spec.json` (~1659 tok)
- `tasks.md` — Implementation Plan (~10270 tok)

## .kiro/specs/raft-ha-core-safety/

- `design.md` — Design Document — raft-ha-core-safety (~10893 tok)
- `requirements.md` — Requirements Document (~2601 tok)
- `research.md` — Gap Analysis — raft-ha-core-safety (~20590 tok)
- `spec.json` (~128 tok)
- `tasks.md` — Implementation Plan: raft-ha-core-safety (~11904 tok)

## .kiro/specs/raft-library/

- `design.md` — Design Document: raft-library (~7756 tok)
- `requirements.md` — Requirements Document (~2115 tok)
- `research.md` — Research & Design Decisions: raft-library (~6052 tok)
- `spec.json` (~215 tok)
- `tasks.md` — Implementation Plan (~4312 tok)

## .kiro/specs/raft-log-replication/

- `brief.md` — Brief: raft-log-replication (~1297 tok)
- `design.md` — Design Document (~7912 tok)
- `requirements.md` — Requirements Document (~4710 tok)
- `research.md` — Research Log: raft-log-replication (~1206 tok)
- `spec.json` (~368 tok)
- `tasks.md` — Implementation Plan (~3864 tok)

## .kiro/specs/raft-sim-conformance/

- `brief.md` — Brief: raft-sim-conformance (~697 tok)
- `design.md` — Design Document (~8280 tok)
- `requirements.md` — Requirements Document (~3776 tok)
- `research.md` — Gap Analysis — raft-sim-conformance (2026-06-24) (~3557 tok)
- `spec.json` — Declares divergence (~1650 tok)
- `tasks.md` — Implementation Plan (~4680 tok)

## .kiro/specs/resource-distribution-mapping/

- `requirements.md` — Requirements Document (~508 tok)
- `research.md` — Research: resourcemap / distributions / hostBased (~1548 tok)
- `spec.json` (~132 tok)

## .kiro/specs/resource-value-verification/

- `design.md` — Design Document (~11716 tok)
- `requirements.md` — Requirements Document (~2797 tok)
- `research.md` — Research & Design Decisions (~5967 tok)
- `spec.json` (~133 tok)
- `tasks.md` — Implementation Plan (~8164 tok)

## .kiro/specs/resval-id-decoupling/

- `design.md` — Design: resval-id-decoupling (~3914 tok)
- `requirements.md` — Requirements: resval-id-decoupling (~2360 tok)
- `research.md` — Gap Analysis: resval-id-decoupling (~7389 tok)
- `spec.json` (~471 tok)
- `tasks.md` — Implementation Tasks: resval-id-decoupling (~2424 tok)

## .kiro/specs/scheduler-allocation/

- `brief.md` — Brief: scheduler-allocation (~3375 tok)
- `requirements.md` — Requirements Document (~9034 tok)
- `spec.json` (~338 tok)

## .kiro/specs/scheduler-controller-msg-gap/

- `design.md` — Design: scheduler-controller-msg-gap (~5006 tok)
- `requirements.md` — Requirements: scheduler-controller-msg-gap (~2712 tok)
- `research.md` — Research Log: scheduler-controller-msg-gap (~8281 tok)
- `spec.json` (~388 tok)
- `tasks.md` — Tasks: scheduler-controller-msg-gap (~4650 tok)

## .kiro/specs/scheduler-core/

- `brief.md` — Brief: scheduler-core (~2035 tok)
- `design.md` — Technical Design: scheduler-core (~17232 tok)
- `requirements.md` — Requirements Document (~26526 tok)
- `research.md` — Research & Design Decisions: scheduler-core (~4653 tok)
- `spec.json` (~200 tok)
- `tasks.md` — Implementation Plan (~32966 tok)

## .kiro/specs/scheduler-core/.solomd/

- `session.94ffc737-bfba-49ef-8dcb-f6e6a1bf0915.json` (~327 tok)

## .kiro/specs/scheduler-dispatch-commit/

- `design.md` — Design Document (~11677 tok)
- `requirements.md` — Requirements Document (~3606 tok)
- `research.md` — Research & Design Decisions (~4541 tok)
- `spec.json` (~931 tok)
- `tasks.md` — Implementation Plan (~7090 tok)

## .kiro/specs/scheduler-framework/

- `brief.md` — Brief: scheduler-framework (~6115 tok)
- `requirements.md` — Requirements Document (~17160 tok)
- `spec.json` (~211 tok)

## .kiro/specs/scheduler-preemption/

- `brief.md` — Brief: scheduler-preemption (~2910 tok)
- `requirements.md` — Requirements Document (~2476 tok)
- `spec.json` (~213 tok)

## .kiro/specs/scheduler-sim-decision-parity/

- `brief.md` — Brief: scheduler-sim-decision-parity (~2025 tok)
- `design.md` — Design Document (~8189 tok)
- `requirements.md` — Requirements Document, 5 reqs (accounting parity, capacity awareness, decision visibility, graceful degradation, no regression) (~1400 tok)
- `research.md` — Research & Design Decisions (~2853 tok)
- `spec.json` (~134 tok)
- `tasks.md` — Implementation Plan (~4736 tok)

## .kiro/specs/scheduler-sim-diagnostics/

- `brief.md` — Brief: scheduler-sim-diagnostics (~1333 tok)

## .kiro/specs/scheduler-sim-eager-reconciliation/

- `requirements.md` — Requirements Document (~2312 tok)
- `spec.json` (~137 tok)

## .kiro/specs/scheduler-sim-repl-verbosity/

- `design.md` — Design Document: REPL continue-mode output (event echo gate, round rollup + collapse-range flush interface, jobid range compression, sim_print_decision gate) (~6900 tok)
- `requirements.md` — Requirements Document: 5 EARS requirement areas (mode-aware echo, per-round summary, collapsing, jobid ranges, no regression) (~1852 tok)
- `research.md` — Research & Design Decisions, incl. the flush-interface gap found/fixed during task-graph sanity review (~3600 tok)
- `spec.json` — phase: tasks-generated, ready_for_implementation: true (~220 tok)
- `spec.json` (~131 tok)
- `tasks.md` — Implementation Plan: 5 major tasks / 9 sub-tasks, TDD-paired, tasks 3-4 parallel-safe after task 2 (~1900 tok)
- `tasks.md` — Implementation Plan (~1962 tok)

## .kiro/specs/worker-join-refactor/

- `design.md` — Design Document: worker-join-refactor (~4709 tok)
- `requirements.md` — Requirements Document (~1401 tok)
- `research.md` — Research Log: worker-join-refactor (~7581 tok)
- `spec.json` (~128 tok)
- `tasks.md` — Implementation Plan (~1638 tok)

## .kiro/specs/worker-rejoin-resync/

- `brief.md` — Brief: worker-rejoin-resync (~1394 tok)
- `spec.json` (~200 tok)

## .kiro/specs/xce-test-e2e-primitives/

- `design.md` — Design Document — xce-test-e2e-primitives (~2913 tok)
- `requirements.md` — Requirements Document (~2163 tok)
- `research.md` — Research / Discovery — xce-test-e2e-primitives (~499 tok)
- `spec.json` (~271 tok)
- `tasks.md` — Implementation Plan (~4188 tok)

## .kiro/steering/

- `api-standards.md` — API Standards (~1447 tok)
- `build-deployment.md` — Build & Deployment (~2917 tok)
- `config-design.md` — Configuration Design: What Belongs in Shared Config (~2053 tok)
- `error-handling.md` — Error Handling Standards (~1367 tok)
- `ha-async-io.md` — HA Protocol & Async I/O (~4721 tok)
- `persistence.md` — WAL & Persistence Durability (~3007 tok)
- `product.md` — Product Overview (~1509 tok)
- `roadmap.md` — Roadmap (~15496 tok)
- `security.md` — Security Standards (~1636 tok)
- `structure.md` — Project Structure (~1348 tok)
- `tech.md` — Technology Stack (~1500 tok)
- `testing.md` — Testing Standards (~976 tok)

## docs/superpowers/plans/

- `2026-05-07-p0-single-controller-persistence.md` — P0: Single-Controller Persistence — Implementation Plan (~13549 tok)
- `2026-05-07-p1-ha-foundation.md` — P1: HA Foundation — Implementation Plan (~13680 tok)
- `2026-05-07-p2-replication.md` — P2: Replication (Fan-Out TCP) — TDD Implementation Plan (~12942 tok)
- `2026-05-07-p25-discovery.md` — P2.5: libxce Smart Discovery — TDD Implementation Plan (~10344 tok)
- `2026-05-07-p3-hardening.md` — P3: Integration & Hardening — TDD Implementation Plan (~9841 tok)
- `2026-05-07-persistence-ha-overview.md` — XCE Persistence & HA — Implementation Overview (~732 tok)
- `2026-05-13-config-replication.md` — Config Replication Implementation Plan (~21833 tok)
- `2026-05-20-config-repl-wire-protocol.md` — Config Replication — Wire Protocol Completion + Bug Fixes (~5322 tok)

## raft/

- `raft.tla` — ------------------------------- MODULE raft --------------------------------- (~5350 tok)

## reports/

- `aug03-aug09-2026.md` — XCE Project Status — Aug 03 – Aug 07, 2026 (~1626 tok)
- `aug08-aug15-2026.md` — XCE Project Status — Aug 08 – Aug 15, 2026 (~3603 tok)
- `aug16-aug22-2026.md` — XCE Project Status — Aug 16 – Aug 22, 2026 (~2706 tok)
- `jul06-jul11-2026.md` — Jul 6 → Jul 11 Progress Report (~2311 tok)
- `jul13-jul18-2026.md` — Jul 13 → Jul 18 Progress Report (~3919 tok)
- `jul19-jul26-2026.md` — Work Summary: Jul 19 – Jul 26, 2026 (~3482 tok)
- `jul27-aug02-2026.md` — XCE Project Status — Jul 27 – Aug 01, 2026 (~2003 tok)
- `jun29-jul04-2026.md` — Work Summary: June 30 – July 4, 2026 (~857 tok)

## scripts/

- `gitea-sync.py` — GiteaAPI: die, warn, api_url, request + 12 more (~8433 tok)

## src/

- `flake.nix` (~1301 tok)
- `meson.build` (~672 tok)
- `meson.options` — dirty-content-fingerprint task 1: sibling `dirty_fingerprint` string option (default '') added next to commit_id/build_time (~135 tok)

## src/.claude/

- `ucai-formatter-cache.local.json` (~17 tok)

## src/autoscaler/

- `meson.build` (~163 tok)

## src/autoscaler/providers/

- `meson.build` (~342 tok)

## src/autoscaler/providers/baidu/

- `BccTool.env` (~64 tok)

## src/autoscaler/providers/baidu/lsf/conf/

- `baiduprov_config.json` (~44 tok)
- `baiduprov_templates.json` (~431 tok)
- `logger.yaml` (~196 tok)

## src/autoscaler/providers/baidu/postprovision/lsf/

- `example_user_data.sh` (~486 tok)

## src/autoscaler/providers/baidu/scripts/

- `getAvailableMachines.sh` — This script: (~112 tok)
- `getAvailableTemplates.sh` — This script: (~110 tok)
- `getRequestStatus.sh` — This script: (~110 tok)
- `getReturnRequests.sh` — This script: (~110 tok)
- `requestMachines.sh` — This script: (~110 tok)
- `requestReturnMachines.sh` — This script: (~110 tok)

## src/autoscaler/providers/baidu/src/bcctool/

- `BccTool.env` (~64 tok)
- `go.mod` — Go module definition (~136 tok)
- `go.sum` — Go dependency checksums (~566 tok)
- `main.go` (~355 tok)

## src/autoscaler/providers/baidu/src/bcctool/client/

- `bccClient.go` — ProvCloudClient (63 fields); methods: CreateInstances, ReleaseInstances, ListInstancesByTag, ListAllInstances (~3781 tok)

## src/autoscaler/providers/baidu/src/bcctool/enums/

- `provCode.go` — All error codes used in the Baidu Cloud provider plugin (~1198 tok)

## src/autoscaler/providers/baidu/src/bcctool/model/

- `types.go` — ClientCredential (149 fields); methods: IsBidTemplate, GetNcpus, GetMemory, String (~4213 tok)

## src/autoscaler/providers/baidu/src/bcctool/provconst/

- `bdConst.go` — Declares var (~311 tok)

## src/autoscaler/providers/baidu/src/bcctool/provservices/

- `provService.go` — GetAvailableTemplates, CreateInstancesFromFile, DeleteInstancesFromFile, SyncInstancesStatusFromFile, GetRequestStatusFromFile (~3661 tok)

## src/autoscaler/providers/baidu/src/bcctool/utils/

- `envvars.go` — InitEnvVars (~696 tok)
- `jsonUtils.go` — LoadProvTemplates, LoadProvConfig, LoadNodeCreationInputFile, LoadGetReturnRequestInputFile + 6 more (~2660 tok)
- `logger.go` — Config (50 fields) (~1649 tok)
- `provUtils.go` — InitProv, ExitWithError, Result, CreationTimeout, TerminationTimeout (~718 tok)

## src/autoscaler/scaler/

- `obj_mgr.c` — include <errno.h> (~3260 tok)
- `plug_mgr.c` — Main functions: (~4412 tok)
- `prov_conf.c` — include "prov_conf.h" (~2721 tok)
- `scaler_ctx.c` — include <string.h> (~547 tok)
- `scaler_json.c` — include <stdio.h> (~3716 tok)
- `scaler_misc.c` — include <math.h> (~1482 tok)
- `scaler_obj.c` — include "scaler_obj.h" (~2462 tok)
- `scaler.c` — include <errno.h> (~5076 tok)

## src/autoscaler/scaler/conf/

- `hostProviders.json` (~60 tok)
- `hostProviders.yaml` (~35 tok)

## src/autoscaler/scaler/include/

- `obj_mgr.h` — ifndef _OBJ_MGR_H_ (~492 tok)
- `plug_mgr.h` — ifndef _PLUG_MGR_H_ (~119 tok)
- `prov_conf.h` — ifndef _SCALER_CONF_H_ (~132 tok)
- `scaler_ctx.h` — ifndef _SCALER_CTX_H_ (~73 tok)
- `scaler_json.h` — ifndef __JSON_UTILS_H__ (~267 tok)
- `scaler_misc.h` — ifndef _SCALER_MISC_H_ (~203 tok)
- `scaler_obj.h` — ifndef _SCALER_OBJ_H_ (~273 tok)
- `scaler.h` — ifndef _SCALER_H_ (~384 tok)

## src/autoscaler/scaler/include/scaler/

- `types.h` — ifndef _SCALER_TYPES_H_ (~1091 tok)

## src/autoscaler/scaler/testsuite/

- `test_plug_mgr.c` — include <stdlib.h> (~1794 tok)
- `test_scale_misc.c` — include <stdio.h> (~1258 tok)
- `test.c` — include <stdio.h> (~97 tok)

## src/autoscaler/scaler/testsuite/scripts/

- `getAvailableTemplates.sh` (~242 tok)
- `getRequestStatus.sh` — Parse command line arguments (~644 tok)
- `getReturnRequests.sh` (~44 tok)
- `requestMachines.sh` (~20 tok)
- `requestReturnMachines.sh` (~38 tok)

## src/configs/

- `.resources.yaml.~undo-tree~` (~2957 tok)
- `hosts.yaml` (~248 tok)
- `limits.yaml` (~475 tok)
- `queues.yaml` (~504 tok)
- `resources.yaml` — Declares type (~1687 tok)
- `scaler.yaml` (~102 tok)
- `users.yaml` — define usergroup share (~47 tok)
- `xce.yaml` (~33 tok)

## src/configs/schema/

- `hosts.schema.json` (~1016 tok)
- `limits.schema.json` (~454 tok)
- `queues.schema.json` (~1154 tok)
- `resources.schema.json` (~342 tok)
- `scaler.schema.json` (~232 tok)
- `users.schema.json` (~284 tok)
- `xce.schema.json` (~312 tok)

## src/controller/

- `apiserver.c` — include <errno.h> (~5966 tok)
- `CLAUDE.md` — XCE Controller (~4776 tok)
- `cluster.c` — include "config.h" (~24998 tok)
- `commit.c` — Declares is (~13741 tok)
- `config_repl.c` — define _GNU_SOURCE (~36913 tok)
- `config_repl.h` — pragma once (~6952 tok)
- `ctrl_metrics.c` — include "ctrl_metrics.h" (~767 tok)
- `ctrlstatus.c` — include "config.h" (~3234 tok)
- `dataex.c` — include <errno.h> (~2531 tok)
- `egress.c` (~1130 tok)
- `ha_convergence.c` — Declares char (~8389 tok)
- `ha.c` — define _GNU_SOURCE (~125491 tok)
- `ha.h` — ifndef HA_H (~36503 tok)
- `job.c` — include <assert.h> (~33580 tok)
- `join.c` — include "config.h" (~2994 tok)
- `main.c` — build-time-versioning task 3.2 (argp_program_version runtime-composed into static `version_buf[128]`, "My name is..." startup INFO reads that buffer) PLUS dirty-content-fingerprint task 3.2 (2026-08-21): new static `version_display_buf[128]` composed via `xce_compose_version_ex()` (adds `STR(VERSION_DIRTY_FINGERPRINT)`) feeds `argp_program_version` instead; `version_buf`'s composition + the startup INFO log are byte-identical/untouched (Req 3.2). Live-verified: `--version` -> `7ebcba6d-cdb7cc7d`, startup log -> `7ebcba6d-dirty` (~5346 tok)
- `meson.build` (~3466 tok)
- `misc.c` — include <errno.h> (~1359 tok)
- `myapp.c` — define _GNU_SOURCE (~6287 tok)
- `myconf.c` — define _GNU_SOURCE (~1180 tok)
- `opget.c` — include "config.h" (~1730 tok)
- `opupd.c` — include "config.h" (~714 tok)
- `persist.c` — define _GNU_SOURCE (~91271 tok)
- `queue.c` — include <errno.h> (~1554 tok)
- `repl.c` — include <assert.h> (~9240 tok)
- `reply.c` — include "config.h" (~590 tok)
- `resources.c` — include <errno.h> (~50 tok)
- `sched.c` — include <errno.h> (~6080 tok)
- `slowlane.c` — define _GNU_SOURCE (~2392 tok)
- `startup_validation.c` — define _GNU_SOURCE (~1524 tok)
- `task.c` — include <errno.h> (~1376 tok)
- `worker.c` — include <errno.h> (~8004 tok)

## src/controller/include/

- `cluster.h` — if !defined(_CLUSTER_H_) (~3474 tok)
- `commit.h` — pragma once (~3894 tok)
- `slowlane.h` — pragma once (~1149 tok)
- `worker.h` — if !defined(_WORKER_H_) (~213 tok)

## src/controller/testsuite/

- `clean_failover_preservation.sh` — clean_failover_preservation.sh — ha-term-safety task 5.2 live integration test. (~5327 tok)
- `configcompare.c` — define _GNU_SOURCE (~2273 tok)
- `configcompare.h` — pragma once (~1186 tok)
- `controller_test.c` — include <argp.h> (~2353 tok)
- `ctrlstatus_fmt.h` — ifndef _CTRLSTATUS_FMT_H_ (~631 tok)
- `resval_typeresolve.c` — resval_resolve_type(): resource-name -> Value_u_which table lookup (14 known names unchanged) + task 2.1's numeric-default fallback / `-t` type_override for unrecognized names (~499 tok)
- `resval_typeresolve.h` — declares resval_resolve_type()/RESVAL_TYPE_UNKNOWN; task 2.1 fallback now implemented (~676 tok)
- `snapdiff.c` — define _GNU_SOURCE (~893 tok)
- `snapdiff.h` — pragma once (~610 tok)
- `snapverify.c` — define _GNU_SOURCE (~4322 tok)
- `snapverify.h` — pragma once (~1339 tok)
- `test_apply_committed_entry.c` — Declares directly (~11605 tok)
- `test_apply_correctness_verification.c` — Declares driving (~19199 tok)
- `test_apply_pump_integration.c` — Declares hook (~18120 tok)
- `test_apply_pump.c` (~22429 tok)
- `test_apply_reapply_idempotency.c` — Declares xce_job_t (~4312 tok)
- `test_apply_seam.c` — raft-apply-decoupling task 2.1: calls apply_job_start/finish/fail/update_transition() directly on a bare jobmgr+job_t (no cluster_t), bypassing on_job_start/finish/fail, to prove the extracted guard cores work outside the receipt path (~3144 tok)
- `test_bug857_regression.c` — Declares void (~6525 tok)
- `test_cluster_persist.c` — define _GNU_SOURCE (~1755 tok)
- `test_coldstart_lsn0.c` — Declares char (~4729 tok)
- `test_commit_admission_pool.c` — Declares int (~2315 tok)
- `test_commit_barrier_reply.c` — Declares uint8_t (~45188 tok)
- `test_commit_barrier_rollout.c` — Declares explicitly (~29654 tok)
- `test_commit_durability.c` — define _GNU_SOURCE (~33748 tok)
- `test_commit_engine.c` (~19059 tok)
- `test_commit_resolve.c` (~15028 tok)
- `test_config_repl.c` — define _GNU_SOURCE (~93438 tok)
- `test_configcompare.c` — define _GNU_SOURCE (~2224 tok)
- `test_convergence_verification.c` — define _GNU_SOURCE (~20242 tok)
- `test_ctrl_metrics.c` — define _GNU_SOURCE (~949 tok)
- `test_ctrlstatus.c` — include <stdatomic.h> (~6287 tok)
- `test_dispatch_commit.c` — Declares table (~7800 tok)
- `test_dispatch_fail_retry.c` — task 5.2's fail->succeed->fail test (`test_rpc_failure_bound_resets_after_intervening_success`, toggles worker ep broken/working across `dispatch_a_job_test()` calls) proves Req 4.3 counter-reset end-to-end (GREEN). Its job.state==PEND/job.allocs==NULL assertions on the post-success retryable/terminal failures were REMOVED (task 5.2 remediation, 2026-08-23) after kiro-debug (HIGH confidence) found that sub-scenario unreachable via any real caller today -- see bug-1631 for the deferred analysis; the removed-assertion rationale is documented inline in the test (~13000 tok)
- `test_dispatch_fail_terminal.c` — Declares table (~3499 tok)
- `test_ha_rdhup_integration.c` — Declares char (~8362 tok)
- `test_job_dispatch_fail_count.c` (~1002 tok)
- `test_job_dispatch_fail_count.c` — scheduler-dispatch-commit task 1.3: proves job_t.dispatch_fail_count (xce/types.h wrapper struct, new uint32_t next to submit_lsn) is a plain, directly settable/incrementable/resettable in-memory-only field; bare stack-local job_t, no jobmgr/RTTI, mirrors test_persist_types.c's test_slot_key_t_fields precedent. Data-model only -- no dispatch_a_job_() wiring (~1600 tok)
- `test_job_dispatch.c` — Declares in (~1205 tok)
- `test_jobdispatch_no_double_notify.c` — Declares table (~5490 tok)
- `test_repl_apply.c` — include <dirent.h> (~5812 tok)
- `test_resval_typeresolve.c` — Declares override (~1118 tok)
- `test_sched_admin_dispatch.c` (~7510 tok)
- `test_sched_worker_change.c` — Declares bug (~3893 tok)
- `test_term_safety_adapter.c` — define _GNU_SOURCE (~29920 tok)
- `test_wal_job_dispatch_fact.c` — Declares in (~5222 tok)
- `test.c` — include <argp.h>. jobid-%lu-to-fmt_jobid task (2026-08-21): all 10 remaining raw `%lu` jobid printfs (cmd_jobkill, cmd_jobckpt, run_task_local, handle_notify x3, handle_runtasks x2, check_run_jobs, check_run_tasks) converted to `fmt_jobid(buf, sizeof(buf) - 1, ...)` + `%s`, matching this file's existing convention (buf/jobidStr/wantStr precedents at ~1559/1980/2405-2422); no new #include needed. Loop-scoped buffers repopulated fresh per iteration where the jobid varies (check_run_jobs, check_run_tasks, handle_notify's per-case union fields); reused a single populate when the jobid is loop-invariant (handle_runtasks: same runmsg->jobid across the task loop) (~40184 tok)

## src/frontend/

- `Makefile` — XCE project — test targets (~2823 tok)

## src/frontend/apiserver/

- `meson.build` — frontend/apiserver — Go REST API server with CGO backend integration. (~613 tok)

## src/frontend/apiserver/backend/

- `convert_pure.go` — Struct: rawStartInfo (~3599 tok)
- `convert_test.go` — TestRawJobToModel_BasicFields, TestRawJobToModel_FromHost_EmptySafe, TestRawJobToModel_NilSubmit, Te (~7115 tok)
- `convert.go` — go:build cgo (~3606 tok)
- `handler_test.go` — TestOnHostConfigUpdated_UnregisteredHostIgnored, TestOnHostConfigUpdated_DefaultPseudoHostIgnored, T (~5356 tok)
- `handler.go` — Struct: DefaultHandler (~2878 tok)
- `integration_test.go` — go:build !cgo (~4494 tok)

## src/frontend/apiserver/cmd/

- `main_test.go` — dirty-content-fingerprint task 4.4: `TestComposeVersionDisplay`, table-driven, 6 cases covering strip-and-append, clean/no-fingerprint passthrough, degraded-dirty passthrough (`unknown`), append-with-nothing-to-strip, and an anchored-suffix (non-blind-substring) regression case; mutation-tested live (swapping the `"-dirty"` literal for `"-clean"` correctly fails 2/6 subtests) (~550 tok)
- `main.go` (~1611 tok)

## src/frontend/apiserver/controllers/

- `jobs_test.go` — TestPreCheckJobRequest_LostAndFound, TestJobsListFieldValidation_UsesJobInfoNotSubmitRequest, TestPr (~1292 tok)
- `jobs.go` — Struct: JobController (~30746 tok)

## src/frontend/apiserver/models/

- `jobs.go` — Struct: JobArrayID (~6787 tok)

## src/frontend/apiserver/store/

- `query.go` — ExecuteQuery, MatchesCondition, MatchesBitmaskCondition, IsBitmaskField, FilterRows (~2564 tok)

## src/frontend/xcecli/

- `meson.build` — frontend/xcecli — Go CLI tool (~195 tok)

## src/frontend/xcecli/cmd/

- `main_test.go` — dirty-content-fingerprint task 4.5: table-driven `TestComposeVersionDisplay` (6 cases incl. anchored-suffix regression), mirrors apiserver's task-4.4 test (~594 tok)
- `main.go` (~1172 tok)

## src/frontend/xcecli/cmd/jobs/

- `submit.go` — Struct: JobSubmitter (~6572 tok)

## src/frontend/xcecli/common/request/

- `request_test.go` — TestExtractErrorMessage, TestAuthHeaderConsistency (~377 tok)
- `request.go` — Struct: APIResponse (~2824 tok)

## src/frontend/xcecli/models/

- `jobs.go` — Struct: JobsResponse (~5211 tok)

## src/frontend/xcecli/router/

- `router.go` — Execute(cm, version string); build-time-versioning task 4.5: signature extended with `version string` param, sets `rootCmd.Version = version` before `rootCmd.Execute()` so Cobra's native `--version` handling prints/exits (~900 tok)

## src/include/

- `persist.h` — pragma once (~24996 tok)
- `utils.h` — dirty-content-fingerprint task 3.1: new `xce_compose_version_ex()` extern decl (--version-only sibling of xce_compose_version(), adds optional `dirty_fingerprint` param); startup-log call sites keep calling the untouched xce_compose_version() (~2720 tok)
- `wal_types.h` — pragma once (~2250 tok)

## src/include/xce/

- `types.h` — < NULL. (~5439 tok)

## src/lib/

- `group.c` — include <errno.h> (~2635 tok)
- `jobj.c` — include <errno.h> (~6130 tok)
- `utils.c` — dirty-content-fingerprint task 3.1: `xce_compose_version_ex()` added after xce_compose_version() -- when dirty_fingerprint empty, delegates straight to xce_compose_version() (byte-identical); when non-empty, strips a literal trailing "-dirty" off the commit field (anchored suffix check, not blind substring) and appends "-<dirty_fingerprint>" before composing. commit_id/xce_compose_version() itself untouched (~7035 tok)

## src/lib/testsuite/

- `test_group.c` — include <stdio.h> (~1659 tok)
- `test_jobj.c` — include <stdio.h> (~3856 tok)
- `test_utils.c` — dirty-content-fingerprint task 3.1: 5 new tests for xce_compose_version_ex() (strip-and-append with fingerprint, empty+clean, empty+dirty unchanged, NULL fingerprint, and a direct byte-for-byte regression proof against xce_compose_version()); all 5 pre-existing compose/version_field tests untouched and still passing (~2708 tok)

## src/nixSupport/

- `default.nix` — threads myCommitId AND (dirty-content-fingerprint task 2.2) myDirtyFingerprint to xce.nix/xcecli.nix callPackage calls; myBuildTime removed, no longer eval-time (~286 tok)
- `xce.nix` — mesonFlags has `-Dcommit_id=` and (task 2.2) `-Ddirty_fingerprint=` (both eval-time, plain mesonFlags entries); a separate `preConfigure` hook computes `date -u +%Y-%m-%dT%H:%M:%SZ` at build time and appends `-Dbuild_time=` to `mesonFlagsArray` (fixes bug-1603: builtins.currentTime broke pure-eval) -- untouched by task 2.2 (~1190 tok)
- `xcecli.nix` — same `preConfigure` build-time pattern as xce.nix, plus (task 2.2) `-Ddirty_fingerprint=` in mesonFlags (~292 tok)

## src/scheduler/

- `CLAUDE.md` — XCE Scheduler (~1188 tok)
- `meson.build` (~1426 tok)

## src/scheduler/include/

- `core.h` — if !defined(_CORE_H_) (~8509 tok)
- `repl.h` — if !defined(_REPL_H_); task 12.5 added xce_repl_on_replay_complete()/xce_repl_check_replay_complete() (bug-1594) (~2258 tok)
- `scheduler.h` — if !defined(_SCHEDULER_H_) (~4072 tok)

## src/scheduler/src/

- `core_clock.c` — include <stdarg.h> (~3441 tok)
- `core_events.c` — include <errno.h> (~10963 tok)
- `core.c` — include <errno.h> (~4310 tok)
- `driver.c` — include <errno.h> (~9286 tok)
- `handler.c` — include <errno.h> (~6283 tok)
- `main.c` — build-time-versioning task 3.2 (argp_program_version runtime-composed into static `version_buf[128]`, both mutually-exclusive startup INFO lines read that buffer) PLUS dirty-content-fingerprint task 3.2 (2026-08-21): same split-buffer pattern as controller/main.c -- new static `version_display_buf[128]` via `xce_compose_version_ex()` feeds `argp_program_version`; `version_buf`/startup INFO lines untouched (Req 3.2). Live-verified: `--version` -> `7ebcba6d-cdb7cc7d`, startup log -> `7ebcba6d-dirty` (~5186 tok)
- `recording_session.c` — include <stdint.h> (~2706 tok)
- `repl_break.c` — include <stdio.h> (~7907 tok)
- `repl_info.c` — include <stdio.h> (~9489 tok)
- `repl_internal.h` — if !defined(_REPL_INTERNAL_H_); task 12.5 added replay_complete field + repl_job_state_name extern (~3602 tok)
- `repl_params.c` — include <errno.h> (~4299 tok)
- `repl.c` — include <ctype.h>; task 12.5 added xce_repl_on_replay_complete(), replay_complete guard on step/continue, quote-stripping in repl_split_tokens() (bug-1594/1596) (~6611 tok)
- `resource.c` — include <errno.h> (~4509 tok)
- `scheduler.c` — include <errno.h> (~15834 tok)
- `sim_loop.c` — include <errno.h> (~13725 tok)
- `sim_picker.c` — include <errno.h> (~1374 tok)
- `sim_verify.c` — include <stdio.h> (~4694 tok)
- `sim.c` — include <errno.h> (~6106 tok)
- `snapshot_load.c` — include <errno.h> (~4005 tok)
- `snapshot_wire.c` — include <errno.h> (~2611 tok)

## src/scheduler/src/plugins/

- `builtin_fcfs.c` — Declares signature (~10701 tok)

## src/scheduler/testsuite/

- `meson.build` — Declares vtask_entry (~18646 tok)
- `scratch_gen_resource_replay.c` (~2735 tok)
- `test_admin_request.c` — Declares level (~12706 tok)
- `test_clock.c` — Declares uint64_t (~5450 tok)
- `test_core_events.c` — Declares and; real dup_val() reimpl added for link (bug-1585) (~7880 tok)
- `test_core_isolation.c` — Declares char (~4069 tok)
- `test_driver_decision_cb.c` — Declares is (~3675 tok)
- `test_driver_session_ordering.c` — Declares started (~8520 tok)
- `test_driver_translate.c` — Declares field (~9507 tok)
- `test_handlers.c` — define UNIT_TEST 1 (~2728 tok)
- `test_no_bare_printf.c` — Declares char (~1702 tok)
- `test_record_lifecycle.c` — Declares char (~12710 tok)
- `test_repl_breakpoints_inspection.c` — Declares and (~19332 tok)
- `test_repl_equivalence.c` — Declares char (~7658 tok)
- `test_repl_execution_control.c` — Declares directly (~8901 tok)
- `test_repl_snapshot_params.c` — Declares char (~8179 tok)
- `test_resource_accounting.c` — Req 1.4 proof: sched_charge_account/sched_uncharge_account/sched_commit_job_alloc (resource.c) give identical resInUse/sharedInUse whether core comes from xce_scheduler_t or xce_sched_sim_driver_t; white-box core.c+resource.c (~3200 tok)
- `test_resource_accounting.c` — Declares char (~4292 tok)
- `test_resval_ownership.c` — Declares instead (~5471 tok)
- `test_scheduler_dispatch_commit.c` — scheduler-dispatch-commit task 2.1 (Req 1.1-1.3): sched_commit_decision()'s DISPATCH branch sets job->state=JOB_STAT_RUN alongside allocs/accounts; whole-scheduler_srcs link, no sched_init()/xcecli_* wrap needed. Extended task 5.1 (Req 1.1-1.3,2.1,2.3, bug-1624 e2e regression): added test_dispatch_commit_survives_several_rounds_before_confirmation (GAP_ROUNDS=5 round-boundary loop, asserts resInUse restored every round) and test_dispatch_commit_multi_round_gap_matches_same_round_confirmation (explicit value comparison via run_dispatch_then_n_rounds(1) vs (GAP_ROUNDS) helper, not just a hardcoded-constant check); RED-verified by temporarily reverting scheduler.c's job->state=JOB_STAT_RUN line (4/5 tests failed as expected), restored clean (~5000 tok)
- `test_sim_alt_events.c` — Declares char (~4966 tok)
- `test_sim_contention_parity.c` — Declares calls (~14346 tok)
- `test_sim_contention_parity.c` — scheduler-sim-decision-parity task 4.1 (Req 1.4, 2.1/2.2): record-then-replay-and-diff parity proof extending task 1.2's contention fixture (worker 10.0 capacity, jobs A/B/C wanting 8/5/2) to an ACTUAL round-by-round comparison -- Part A: real driven normal-mode recording (2 real rounds: A+C dispatch/B deny, then job D denied too, capacity fully saturated); Part B: hand-crafted `.replay` (JOB_STATE_CHANGE precedes matching DISPATCH for BOTH A and C, extending task 3's single-job technique) replayed via real unmodified sched_sim_driver_run(); real sched_account_jobs() reimpl augmented with a round-boundary resInUse snapshot spy (g_round_resinuse[]) giving per-round sim-side observability; asserts resInUse parity at EVERY round (not just final) plus decision-level (dispatch/pend) and sched_check_host_satisfy() capacity-check parity on both sides; white-box core.c+driver.c+resource.c+full sim/repl/recording stack; RED-phase discriminating power confirmed live (temporarily reverted sim_loop.c's reconciliation call site -- test failed "Expected 10 Was 0" -- restored, GREEN) (~9800 tok)
- `test_sim_e2e_original_motivation.c` — scheduler-sim-decision-parity task 4.3 (FINAL task, Req 1.1-1.3, 3.1-3.3): live-verify substitute for the missing original bug-1611/bug-1613 motivating recording (`scheduler-replay-20260820-070103.replay`, confirmed absent from this filesystem before writing). A real, driven 24-round, 12-job, resource-constrained recording (worker 20.0 capacity; ANCHOR_ID holds 12.0 permanently; J2-J12 arrive/deny/dispatch/finish across the remaining 8.0 headroom via a capacity-aware allocator thread, same technique as test_sim_resource_contention.c) is replayed through the real, unmodified interactive REPL (fork+freopen stdin/stdout, test_repl_execution_control.c's own technique). ANCHOR_ID's own arrival+RUN-confirmation are pushed via the real dataq/translate path; its OWN "originating decision" is the one deliberately-injected piece (built with real make_charge_account/sched_commit_job_alloc/make_dispatch_decision constructors, fed through the real core->decisions cbuf), because reconciliation's successful-match path is PROVABLY unreachable from any organically-live-driven round (dispatch-round and RUN-confirmation-round can never coincide for a job a real/simulated picker itself decided) -- confirmed both by source analysis and empirically (J2-J12's own real dispatches never surface via resInUse during replay, only ANCHOR_ID's does, since only its trigger was engineered same-round). Asserts "info worker" shows used=12.00 (nonzero, ANCHOR_ID's charge, constant since no churn job is ever reconciled) at 4 checkpoints across the whole replay, plus ANCHOR_ID's own "[sim] DISPATCH jobid=..." line now visible in step/continue output (bug-1611's exact symptom, fixed). RED-phase discriminating power confirmed live (reverted sim_loop.c's reconciliation call site -- DISPATCH-visibility assertion failed for the right reason -- restored, git diff clean, GREEN) (~13500 tok)
- `test_sim_e2e_original_motivation.c` (~12913 tok)
- `test_sim_equivalence.c` — Declares BOTH (~8365 tok)
- `test_sim_event_loop.c` — Declares char (~9352 tok)
- `test_sim_isolation.c` — Declares names (~8174 tok)
- `test_sim_reconcile_unaccounted.c` — Declares char (~9352 tok)
- `test_sim_record_output.c` — Declares char (~5888 tok)
- `test_sim_resource_contention.c` — scheduler-sim-decision-parity task 1.2 (Req 2.1/2.2): resource-contention replay fixture (worker w/ 10.0-unit capacity, 3 jobs wanting 8/5/2 -- job B genuinely denied by real sched_check_host_satisfy()/sched_charge_account()); proves fixture shape + dual-use (real normal-mode recording, also replayable via sim driver); white-box core.c+driver.c+resource.c+full sim/repl/recording stack (~9218 tok)
- `test_sim_round_boundary_reconciliation.c` — scheduler-sim-decision-parity task 3 (Req 1.3/1.4, 2.1/2.2): end-to-end proof that reconciliation is wired before sched_account_jobs()/xce_core_signal_go() -- job A already RUN with no live decision (JOB_STATE_CHANGE event + matching recorded DISPATCH, hand-crafted `.replay`) gets its resInUse charged (via REAL make_job_account()/sched_charge_account(), including lazy resname->residx resolution through a pre-registered makeResource()) before sched_check_host_satisfy() correctly denies/grants hypothetical capacity; real (non-stub) sched_account_jobs() reimpl, unlike every sibling sim_loop.c-including test file (~7700 tok)
- `test_sim_session_ordering.c` — scheduler-sim-decision-parity task 2.1 (Req 1.3/1.4, 5.1, 5.3): sim-mode counterpart to test_driver_session_ordering.c; spy sched_account_jobs() proves sched_sim_driver_run() now calls it once per replayed round with core->session_active==1 (0 calls pre-fix = bug-1613, RED; 2 calls GREEN); records 2 real normal-mode rounds then replays via real unmodified sim driver; white-box core.c+driver.c+full sim/repl/recording stack (~6004 tok)
- `test_sim_snapshot_reconcile_gap.c` — scheduler-sim-decision-parity task 4.2 (Req 4.1/4.2 regression, the genuinely-new check (c)): a replay starting from a SNAPSHOT that already has a job (901) in RUN state with no in-window recorded decision anywhere -- pushes a QUEUE_UPDATE+JOBS_PUSH(job.state=JOB_STAT_RUN, no allocs) directly onto a throwaway xce_scheduler_t's core via real xce_core_push_events() BEFORE sched_record_start() snapshots it, so the written `.replay`'s initial SnapshotEntry carries the RUN job with job->accounts==NULL from byte one; asserts rc==0 (no crash), job->accounts/allocs stay NULL after replay (unavailable, not fabricated), job->state stays RUN, and a second ordinary job (902) is still decided normally -- proves builtin_fcfs's JOB_IS_PEND(job->state) guard in on_job_push also keeps this job out of live-picker candidacy, so reconciliation's "not found" branch (task 2.2) is the only path that ever touches it; white-box core.c+full sim/repl/recording stack, same set as test_sim_verify.c (~6117 tok)
- `test_sim_startup.c` — Declares char (~5535 tok)
- `test_sim_verify.c` — Declares mismatch; task 3 (Req 5.2) adds append_job_state_change_event()/append_replay_session_with_dispatch_and_pend() + test_verify_with_already_resolved_job_reports_no_mismatch(): --sim-verify against a recording with an already-resolved job reports zero mismatches now that reconciliation compacts decoded_session before the verify drain loop; task 4.2 (Req 5.1/5.2, check (b) extension) adds append_replay_session_with_two_dispatches_and_pend()/append_replay_session_with_two_pends() + test_verify_with_multiple_already_resolved_jobs_across_rounds_reports_no_mismatch(): TWO already-resolved jobs (A/C) in one round with a still-genuinely-PEND job's (B) own recorded PEND sandwiched BETWEEN the two DISPATCH entries (exercises non-adjacent memmove compaction, unlike task 3's single-leading-entry case), followed by an ordinary round 2 -- caught a real test-authoring gap live: builtin_fcfs's pendJobs discipline re-offers a still-PEND job EVERY subsequent round (not just its arrival round), so round 2's recorded fixture had to include B's recurring PEND too, not just the fresh job D's (~13500 tok)

## src/schema/

- `controller.capnp` — Declares OPCode (~14664 tok)

## src/tools/

- `deploy-ha.sh` — auto-detects real `xcecd` vs `xcecd_virtual` (XCE_REAL_WORKER / /run/systemd/system), generates sudo-wrapped start-worker.sh for real (~8000 tok)
- `go_build` — dirty-content-fingerprint task 4.1: reads `XCE_DIRTY_FINGERPRINT` (empty-safe like GitCommit/BuildTime), but falls back to plain `""` (NOT `"unknown"`, unlike the other two) and appends `-X main.DirtyFingerprint=$_dirty_fingerprint` to the existing `-ldflags` alongside GitCommit/BuildTime, unaffected (~730 tok)
- `test-build-version-regression.sh` — build-time-versioning task 6.1: standalone regression script (follows `test-commit-durability.sh`/`test-heartbeat-tolerance.sh` precedent in this dir) running a REAL `nix develop $SRC_DIR --command bash xce-build.sh scheduler <asan|debug> <dedicated build dir>` for both profiles, then `xce_scheduler --version`, failing loudly if the parsed commit id is empty/`unknown`/mismatched vs `git rev-parse --short HEAD` (+`-dirty`). Also runs a detection-capability demonstration (deliberately-wrong hash / synthetic-empty / synthetic-`unknown` commit id must all be rejected; genuine match must pass). Tolerates xce-build.sh's own non-zero exit from its bundled scheduler-suite `meson test` (bug-1560, unrelated pre-existing flake) via `cmd || rc=$?` so that doesn't mask the version check. Dedicated build dirs cleaned up on exit unless `--keep-build-dirs` passed. Live-verified passing both profiles (~3373 tok)
- `test-dirty-fingerprint-distinguishability.sh` — dirty-content-fingerprint task 6.1 (2026-08-21): standalone regression script (follows test-build-version-regression.sh's convention) proving the 4 required --version states hold via a real `xce-build.sh scheduler debug` build cycle. ISOLATION TECHNIQUE (the key design decision): since this shared repo is under continuous concurrent editing, `git status` on the ambient tree can't reliably represent "clean" -- creates its own throwaway `git worktree add --detach <tmp> HEAD` first (genuinely clean by construction), then invokes THAT worktree's own copy of xce-build.sh -- which works because xce-build.sh resolves SRC_DIR from `$0`'s location and `cd`s there itself, so every git command inside it auto-scopes to the isolated worktree with zero extra `-C`/`cd` bookkeeping. Edits `README.md` inside the isolated worktree only (`git checkout --` between edits for byte-exact reverts); shared tree's own README.md never touched (asserted via `git status --porcelain` at the end). 4 states: clean (`meson setup` fresh) -> edit-A -> edit-B (`--incremental` reconfigure for speed, safe since same single component/dir reused throughout) -> revert-to-A. `check_capture()` is the single function both the real per-state checks AND `demonstrate_detection_capability()` exercise (mirrors check_result/check_consistency precedent). Found+fixed bug-1615 live (a same-statement `local a=... b="$a/..."` cross-reference silently unbound under `set -u` -- split into two `local` statements). Live-verified: 2 full passing runs reproduce IDENTICAL fingerprints across independent runs (determinism proof); a 3rd run with edit-B deliberately forced to reproduce edit-A's content correctly FAILs (exit 1, differs-check catches the unexpected match) (~5200 tok)
- `test-dirty-fingerprint-distinguishability.sh` — test-dirty-fingerprint-distinguishability.sh — dirty-content-fingerprint (~6112 tok)
- `test-dirty-fingerprint-nix-production-path.sh` — test-dirty-fingerprint-nix-production-path.sh — dirty-content-fingerprint (~7683 tok)
- `test-dirty-fingerprint-nix-production-path.sh` — dirty-content-fingerprint task 6.3 (2026-08-21, LAST task in spec): standalone regression script proving the NIX production path (`nix build ./src#xcecore_debug`, no `--impure`) carries task 2.2's `myDirtyFingerprint` into a real build attempt, not just `nix eval`. Reuses the family's isolated `git worktree add --detach` technique, but edits `flake.nix` itself (inside `src/`, the flake's own source) rather than README.md -- the exact edit target task 2.2's own research.md already validated for `self.narHash` sensitivity. SANDBOX FINDING (new, beyond task 2.2): `nix build` here dispatches to a REMOTE builder (`ssh://.../172.31.109.18`); `--keep-failed`'s leftover build dir (containing a real, linked `scheduler/xce_scheduler`) sits on that unreachable remote host (SSH connection times out), so unlike the dev-loop scripts this one can't extract-and-run a compiled binary -- mirrors task 2.2's own accepted technique instead: `nix eval --json <flake>#packages.x86_64-linux.xcecore_debug.mesonFlags` (fast, eval-time) cross-checked against the REAL build log's `mesonConfigurePhase flags:` line (via `-L --keep-going --keep-failed`, ~1-2 min per attempt thanks to ccache reuse across edits since only flake.nix's comment changes, not C/Go source). Treats the known bcctool/goproxy.cn failure as the expected PASSING outcome (`check_reached_known_limitation()` asserts every `FAILED: [code=` line -- nix's error epilogue reprints the same one 3x for xcecore_debug's 2 outputs -- references bcctool, not a new regression) and asserts `scheduler/xce_scheduler` was actually linked before that failure. States: clean (nix eval only, empty fingerprint) -> edit-A (eval+real build) -> edit-B different content (eval+real build, differs from A in BOTH eval and real build log) -> revert-to-A (eval only, matches A exactly). Found+fixed 3 live bugs: the same bug-1615 same-statement `local` cross-reference gotcha (in `extract_flag_from_json`), BusyBox `mktemp` rejecting a `.log` suffix after `XXXXXX` (GNU-only feature -- dropped the suffix), and a `git checkout -- flake.nix` pathspec bug (`-C "$ISO_DIR"` doesn't see `src/flake.nix` as `flake.nix` -- fixed to `-C "$ISO_SRC"`). Also caught and fixed a self-check false-positive: grepping the whole script for the literal string `--impure` matched its own header prose explaining the Observable -- narrowed to only lines beginning a real `nix eval/build/develop/log` invocation. Live-verified passing end-to-end (~1m54s total, well under the 10-min-per-build budget); zero leftover worktrees/tmp dirs/logs; shared repo's `src/flake.nix` confirmed untouched (~14000 tok)
- `test-dirty-fingerprint-startup-log-unchanged.sh` — dirty-content-fingerprint task 6.2 (2026-08-21): standalone regression script proving the fingerprint (task 3.1-4.4) never leaks into either xce_scheduler's or xce_apiserver's startup log, even on a dirty tree where `--version`/`-version` clearly does show one. Reuses task 6.1's isolated `git worktree add --detach` technique (one controlled dirty edit to README.md inside the isolated worktree only) to build scheduler for real via `xce-build.sh scheduler debug`; builds apiserver via a direct `go build -ldflags` invocation (mirrors test-version-startup-consistency.sh's bug-1597 workaround) injecting the REAL fingerprint extracted from the scheduler's own `--version` output (not a second independent hash computation -- simpler and more faithful to a real single-session `xce-build.sh` run). `assert_version_shows_fingerprint()` confirms `--version`/`-version` shows `<commit>-<fingerprint>` (never the old `-dirty` format); `assert_startup_log_unchanged()` confirms the startup log's commit field is byte-identical to the original build-time-versioning format (`<commit>-dirty`) AND that the fingerprint string is absent anywhere in the line (not just the commit field). `demonstrate_detection_capability()` proves both functions reject: fingerprint leaking straight into the commit field, fingerprint leaking via an unrelated field while the commit field looks fine, and a commit-field format drift with no fingerprint involved at all -- plus a sanity pass on genuinely unchanged lines. Cleanup kills daemons by PID first, then scans `/proc/*/exe` (not cmdline text, to avoid bug-1576's self-match hazard) for any leftover process pointing at the built binaries before removing the isolated worktree. Live-verified passing twice end-to-end (real scheduler + apiserver builds and daemon starts each run); zero leftover processes/worktrees; shared repo's README.md confirmed untouched both times (~9800 tok)
- `test-version-startup-consistency.sh` — test-version-startup-consistency.sh — build-time-versioning task 6.2 (~6131 tok)
- `test-xceadmin-build-install-version.sh` — build-time-versioning task 6.3 (LAST task in spec): real `nix develop $SRC_DIR --command bash xce-build.sh xceadmin release <dir>` (meson-driven: schema sync, pinned venv install, pytest, wheel build), then installs the wheel into one fresh scratch venv and does `pip install -e src/xceadmin` into a second fresh scratch venv (both venv creation/pip install/`xceadmin --version` runs happen inside `nix develop` -- confirmed live that pycapnp's prebuilt PyPI wheel needs the nix devshell's libstdc++.so.6 resolution, absent on the bare host). Extracts the `(<commit>, <build_time>)` suffix from `xceadmin --version`'s "xceadmin, version <pkgver> (...)" output (isolating that line first via `VERSION_LINE_ANCHOR` grep before parsing parens, since captures are `2>&1` and include `nix develop`'s own "Git tree is dirty" stderr noise) and asserts: wheel install = real (non-`unknown`) fields; editable install = `unknown`/`unknown` (task 5.2 stub); the two DIFFER. `demonstrate_detection_capability()` proves synthetic unknown-in-wheel / real-in-editable / identical-outputs are all rejected. Cleanup always sweeps `.egg-info`/`__pycache__`/`.pytest_cache` left in the real `src/xceadmin` tree by the editable install (even with `--keep-artifacts`), plus the scratch venvs and meson build dir. Live-verified passing twice, `git status --porcelain` on `src/xceadmin` clean after each run (~4900 tok)
- `test-xceadmin-build-install-version.sh` — test-xceadmin-build-install-version.sh — build-time-versioning task 6.3 (~5819 tok)
- `xce-build.sh` — build-time-versioning task 2.1 computes commit_id (git rev-parse --short HEAD [+ -dirty]) + build_time (date -u) once per invocation, appended to MESON_OPTS for every profile. dirty-content-fingerprint task 2.1 (2026-08-21) adds a NEW, independent `dirty_fingerprint` computation right after that block (commit_id/build_time untouched): empty on a clean tree; sha256 (8 hex chars) over `git diff HEAD` + sorted raw content of `git ls-files --others --exclude-standard` when dirty; empty (never fabricated) if the hash computation itself fails (e.g. sha256sum missing) -- every intermediate command is guarded via explicit `if`/`elif` so a failure degrades gracefully instead of tripping the script's own `set -euo pipefail`. Uses two `mktemp` scratch files (cleaned up unconditionally), zero working-tree/index mutation. Appended as `-Ddirty_fingerprint="$dirty_fingerprint"` on the same MESON_OPTS line as commit_id/build_time, so it reaches every profile (asan/debug/release) identically. Live-verified via real `nix develop ... xce-build.sh scheduler debug`+`lib asan`+`lib release` builds against `compile_commands.json`'s `-DVERSION_DIRTY_FINGERPRINT=`: edit-A -> hash X, edit-B -> different hash Y, revert-to-A -> hash X again exactly, `.bak`-gitignored file added -> hash unchanged; `commit_id`'s `-dirty` suffix confirmed unaffected throughout. `set -euo pipefail` means its bundled scheduler-suite `meson test` failing (bug-1560) makes the WHOLE invocation exit non-zero even when compile succeeded (~4400 tok)

## src/worker/src/

- `controller_connector.c` — include "client.h"; jobid-readability (2026-08-21): 21 job-id `%lu` log sites across 10 functions (`dump_startjob_request`, `job_start_remote_task`, `job_start_local_task`, `handle_startjob`, `handle_runtasks`, `handle_fetchfile`, `handle_jobcontrol`, `xcecd_job_remote_start`, `xcecd_jobrusage_update`) now render via `fmt_jobid()` into a local `jobidStr[64]` instead of raw uint64; `handle_fetchfile`'s `offset=%lu` byte-offset field is NOT a jobid and was left raw (~18100 tok)
- `main.c` — include "sqlite3.h"; jobid-readability (2026-08-21): 4 job-id `%lu` log sites (`master_disconnect_callback`, `master_job_status_callback`, `master_ckpt_result_callback`, `master_rusages_callback`) now render via `fmt_jobid()` into a local `jobidStr[64]` instead of raw uint64 (~6282 tok)
- `resource_sync.c` — include "resource_sync.h" (~3926 tok)
- `uv_ipc.c` — include "uv_ipc.h" (~12231 tok)
- `xcecd_cgroups.c` — include "xcecd_cgroups.h"; jobid-readability (2026-08-21): `collect_job_rusages()`'s rusage TRACE log job-id `%lu` -> `fmt_jobid()`/`jobidStr[64]`; the `xcecd-worker-%lu.service` unit-name snprintf (line ~1406) deliberately left untouched (behavioral, not log formatting) (~13889 tok)
- `xcecd_dbus_manager.c` — include "xcecd_dbus_manager.h"; jobid-readability (2026-08-21): `dbus_stop_all_workers()`'s "Job %lu killed" log -> `fmt_jobid()`/per-iteration `jobidStr[64]` (~3777 tok)
- `xcecd_worker_utils.c` — include "xcecd_worker_utils.h"; jobid-readability (2026-08-21): 9 job-id `%lu` log sites across `update_worker_status()` (6, shared one `jobidStr[64]` populated once after `job->job_id` is set), `find_worker_by_jobid()`, `resend_job_status()` (per-iteration buffer), `check_worker_sleep_time_elapsed()` -> all now `fmt_jobid()` (~4658 tok)
- `xcecd_worker.c` — include "inter_job_utils.h"; jobid-readability (2026-08-21): 30 job-id `%lu` log sites (31 conversions, `worker_signal_callback`'s "Signal for job X but current job is Y" line has two) across `on_rusage_timer`, `xjob_start_vnc`/`xjob_stop_vnc`, `worker_job_callback` (11, shared one `jobidStr[64]` populated once after `jobid = info->job_id`), `worker_signal_callback` (`jobidStr` for param `job_id` + separate `curJobidStr` for global `jobid`), `do_criu_ckpt`, `worker_ckpt_callback` -> all now `fmt_jobid()`; `snprintf(ckpt_dir, ..., "%s/%lu", CKPT_BASE, job_id)` (on-disk path, not a log) intentionally left raw (~12812 tok)
- `xcecd.c` — fake pids used in virtual cluster; jobid-readability (2026-08-21): `xcecd_process_command()`'s "No startinfo provided, job %lu" log -> `fmt_jobid()`/`jobidStr[64]` (~5154 tok)

## src/worker/testsuite/

- `meson.build` — Worker unit test suite (component-failover-adoption, task 2.1). White-box (~1147 tok)
- `test_dbus_workers_update.c` — Declares started (~3398 tok)
- `test_resource_sync.c` (~1374 tok)

## src/xceadmin/

- `meson-build.sh` — Meson-driven xceadmin build: install + test out-of-tree, in the meson; dirty-content-fingerprint task 5.1 (2026-08-21): reads new $8 positional `dirty_fingerprint` (independent empty-string fallback, NOT "unknown"), writes `DIRTY_FINGERPRINT` as a third field into generated `_build_info.py`. Live-verified: dirty tree -> real hash matching compile_commands.json's `-DVERSION_DIRTY_FINGERPRINT=`; `-Ddirty_fingerprint=` explicit empty -> `DIRTY_FINGERPRINT = ""` while GIT_COMMIT/BUILD_TIME still fall back to "unknown" independently; 261 tests pass in all scenarios (~2100 tok)
- `meson.build` — xceadmin (admin-config-tool): Python package, no C compilation; dirty-content-fingerprint task 5.1: custom_target gains a third positional arg `get_option('dirty_fingerprint')` after commit_id/build_time (~1140 tok)
- `pyproject.toml` — XCE cluster configuration admin CLI (config build / config push) (~662 tok)

## src/xceadmin/src/xceadmin/

- `_build_info.py` — Committed fallback build-info stub (build-time-versioning task 5.2; (~360 tok)
- `cli.py` — xceadmin command-line entry point (design.md, ``xceadmin.cli``; (~4225 tok)

## src/xceadmin/tests/

- `test_cli.py` — Tests for the xceadmin CLI (design.md, ``xceadmin.cli``; task 1.1's (~8975 tok)