jobs: only settle may close; e2e proof harness

close_all no longer joins pump threads from the owner thread: job:close()
joins the pump, and a pump parked in an owner-posted tool batch needs the
owner back in the loop, so a synchronous close at turn_end could deadlock.
close_all now cancels everything, closes only already-settled jobs, and
defers the rest to their own settle; jobs.active() ignores closing children
so the next turn can resume the id.

e2e/ reconstructs the end-to-end proof against the real binary in print
mode: a scripted fixture protocol plays primary and children, and the suite
asserts the product surface from process output and JSONL bytes on disk —
parallel batch with unknown-agent error, lane identity, tool inheritance
minus subagents.*, resume with manifest re-identification, workflow diamond,
sandbox fan-out with an ephemeral structured worker, catalog round-trip,
child-store isolation from the session picker. mise run e2e; check stays
independent.

1 files changed, 21 insertions, 0 deletions

diff --git a/mise.toml b/mise.toml
index 429d8dd..97d78c5 100644
--- a/mise.toml
+++ b/mise.toml
@@ -25,6 +25,27 @@ luarocks --lua-version 5.4 --tree .rocks install luv
 luarocks --lua-version 5.4 --tree .rocks install dkjson
 """
 
+# `mise run e2e` drives the REAL panto binary against the REAL rock through a
+# scripted provider protocol (see e2e/run.lua). It is deliberately not a
+# dependency of `check`: it needs the sibling pantograph checkout built, which a
+# rock-only contributor has no reason to have. Point PANTO_REPO elsewhere, or
+# PANTO_BIN straight at a binary, to skip the build.
+[tasks.e2e]
+description = "End-to-end: the real panto binary, the real rock, a scripted provider"
+dir = "{{config_root}}"
+run = """
+set -e
+PANTO_REPO="${PANTO_REPO:-$(cd .. && pwd)/pantograph}"
+if [ -z "${PANTO_BIN:-}" ] && [ -d "$PANTO_REPO" ]; then
+    (cd "$PANTO_REPO" && mise exec -- zig build)
+    PANTO_BIN="$PANTO_REPO/zig-out/bin/panto"
+fi
+# The rock's lazily required dependencies (lyaml, toml2lua, dkjson) are handed
+# to the embedded interpreter from this tree; see e2e/fixture.lua.
+[ -d .rocks ] || mise run deps
+PANTO_BIN="$PANTO_BIN" lua e2e/run.lua
+"""
+
 [tasks.check]
 description = "Run the specs against ./.rocks"
 dir = "{{config_root}}"