feat(prd-intake): the PRD becomes an input, and devagent up brings the factory up

[linhdmn]

Why

The driver had no route from what the operator writes into what it builds. docs/PRD.md is a state document by policy — and a dirty one blocks every iteration ([prd-fresh] … operator mid-edit), while an empty deterministic lane left the LLM free to select the loop itself (issue #355: weeks of loop plumbing, not product). Starting the driver on top of that meant SELFBUILD_* exports, a devagent on PATH that a Go-only checkout never installed, and make loop-start by hand.

Three changes, one outcome: write what you want built, type one word, get tested PRs.

What

PRD intake — the PRD becomes an input (#370)

• internal/prdintake: an OPEN checkbox is an instruction. Each - [ ] item becomes a queue row carrying its heading as context, its indented sub-bullets as acceptance criteria, and its section body as the task-PRD sidecar (PrdMarkdown), so the worker reads the spec instead of one bullet. Row id = PRD-<8hex> of the normalized text: re-running over an unchanged PRD queues nothing, and the row's own criterion makes the shipped PR tick the box it built.
• Not work, ever: - [x] (shipped state), blockquotes (state notes), struck lines, plain prose bullets, fenced examples. Policy stays intact — the PRD is still a state doc, with one documented exception.
• internal/loopdriver/intake.go runs it at iteration head, after the PRD-currency gate (a draft is never read as intent) and before pickIssue/claimQueueTask, so the iteration that reads your edit builds it. SELFBUILD_PRD_INTAKE=0 / SELFBUILD_PRD_INTAKE_MAX control it; failures are logged and never fail an iteration.
• Phase 2a already outranked the tracker, so operator intent now outranks LLM self-selection. devagent prd-intake --dry-run|--json|--max N runs the same step by hand.
• selfbuild queue is empty: every pick falls back to LLM self-selection, so the loop ships loop plumbing #355's other half: the empty-lane fallback now logs its remedy and breadcrumbs queue-empty into events, instead of reading as LLM-driven progress.

devagent up / devagent down — one command (#371)

Gate → state dirs → PRD intake → lane census → daemon → detached driver → report. up launches the driver from its own executable with SELFBUILD_DEVAGENT_BIN pinned to match (the PATH trap), refuses to start behind a dirty docs/PRD.md (the driver would skip every iteration silently), prints pending rows / open PRD items / open selfbuild issues (the number that predicts whether the next ten hours ship product or plumbing), and is idempotent against a live loop lock. down signals recorded pids only — never pkill -f (#354). make up|down are now thin wrappers over both; --scout adds the researcher as a second recorded child.

Green up means a running factory. The first smoke caught up printing a healthy pid for 15 s after the driver printed max iterations reached: up is the driver's parent, so a child that halts at its own gate exits 0 and stays a zombie whose pid answers any liveness probe. up now reaps its own child and withholds the verdict until the loop lock and a phase-naming heartbeat exist — driver running (pid 31815) — holds the loop lock, iteration 2, phase queue-empty — or fails the run with the halt line read from .selfbuild/logs/. --wait 0 skips the proof for scripted starts.

The scout writer is alive again (#372)

runScoutOnce/runScoutLoop ported: lock → config → queue-depth check before the paid dispatch → prompt → workers.GetWorker().Spawn → extract → parse → queue.EnqueueTask (+ task-PRD sidecar) → heartbeat. devagent scout --once/--interval no longer exits 3 while the com.devagent.scout LaunchAgent ticks every 30 min against a dead queue writer; an empty ResultText with a nonzero exit is an error, never a silent fallback. Also: devagent create --scout/--tracker stopped baking the deleted dist/src/cli.js into plist argv, where cobra would choke on it.

Verification

• gofmt -l, go vet ./..., golangci-lint run (0 issues), full go test ./... green — 24 new tests: parser contract (fences, blockquotes, struck, nesting, re-wrap stability), the 120-word dispatch cap, ingest idempotency/reword/per-pass cap/missing-PRD, same-iteration claim + per-iteration idempotency + off-switch + dry-run writes nothing, and both up health-receipt directions plus down's recorded-pid stop.
• Live, with the built binary: scratch docs/PRD.md item → prd-intake (once, then idempotent) → queue list → loop --dry-run claimed it and published .selfbuild/goals/loop-1.md + an ok ledger row; up proved a live driver and refused a dead one with its cause; down stopped a real session-leader pid and left nothing; scout --once --dry-run previewed a cycle with no AI call and no writes.

Docs

FR-SIMPLE-07/08 + §12 command rows + §21 status note + footer, docs/SELF-BUILD-LOOP.md (one-command section, up step table, the intake policy exception, SELFBUILD_PRD_INTAKE* knobs), README "Run the automated driver", docs/PRD.html regenerated with pandoc, and the 2026-09-14 cold-start research pass committed so its citations resolve.