@oneie/claude 0.6.0 → 0.7.0

package/commands/do.md

@@ -73,7 +73,7 @@ Comprehensive and fast are not in tension: the **tier decides which gates run**,
 
 | Lever | Fires at | Saves by |
 |---|---|---|
-| Tier prune | Step 1 | PATCH walks `code` only; a gate never runs above the phases it guards |
+| Tier prune | Step 1 | PATCH walks `BUILD → VERIFY` only; a gate never runs above the phases it guards |
 | Tool ladder | every decision | bash → Haiku → Sonnet → Opus → Fable; stop at the first that decides |
 | **Context reset** | cycle boundary | multi-cycle plans run each cycle in a fresh subprocess (`do-auto.sh`) — prior-cycle chatter (~15–25k/cycle) never accumulates; ~90–150k saved on a 6-cycle plan |
 | **TRIVIAL fast-path** | BUILD | **0 agent spawns** — read ≤3 files inline, edit, bash verify, inline rubric, 1 learnings line |
@@ -174,6 +174,9 @@ If the **first word** after `/do` is one of these reserved verbs, it routes to t
 | `/do reject <slug>` | record a branch you abandoned | `.claude/scripts/do-accept.sh <slug> reject` |
 | `/do prove` | prove the anti-fabrication gate (4/4) | `.claude/scripts/do-orchestrate.sh --prove-gate` |
 | `/do rubric [pkg]` | score security · stability · simplicity · integration · speed; writes W0 baseline the loop reads | `python3 .claude/scripts/do-rubric.py ${pkg:-"--all"}` |
+| `/do turn` | **one wavefront turn of ONE LOOP** — 4 haiku senses ∥ → opus pick (fable on anomaly) → 1–4 disjoint moves ∥ (worktree-isolated, model per move) → haiku skeptics re-run every receipt → one sonnet close (marks, log, state, rotation) | `Workflow({scriptPath: ".claude/workflows/one-loop.js"})` — contract: `text/one-loop.md` |
+
+`/do turn` is the company loop, not a plan loop: it picks across ALL lanes (SETTLE·BUILD·SHIP·DISTRIBUTE·SELL·MINE·LEARN), and its **verify-before-mark law** is absolute — an executor's claimed success is worthless until an independent skeptic reproduces the receipt; unverified success closes as `warn`. Self-grading corrupts weights at scale. Code moves land on `loop/<slug>` branches; merge stays human.
 
 `/do auto` builds **nothing** when no plan is hermetic ∧ genuine-armed ∧ no-open-judgment — that's correct (it refuses unsafe work with a receipt). Give it fuel: a `tier: fix` plan with a LOCAL `outcome:` (see `text/orchestrator-how-to.md` §8). Full runbook: `text/orchestrator-how-to.md`.
 
@@ -200,6 +203,16 @@ Headless, the four asking-gates **must not call `AskUserQuestion`** — there is
    .claude/scripts/do-tier.sh --intent "<idea>" $(git diff --name-only 2>/dev/null)
    ```
    Emits **tier** (PATCH | FIX | FEATURE | SCHEMA), the **pruned spine** (which stops run), the **inner classifier** (TRIVIAL | SIMPLE | COMPLEX for BUILD), and a **token ceiling**. Default down when unsure — an under-built FIX reopens cheaply at PROVE; an over-built PATCH is tokens you can't refund.
+
+   **`UNSIZED` (exit 3) is the expected answer at AIM on a clean tree.** `git diff` is
+   empty before any edit exists, and `do-tier` sizes a *diff*, never a sentence — so it
+   refuses rather than guessing. It used to fall through to PATCH/TRIVIAL/5k here, which
+   silently mis-sized real work twice on record (`text/learnings.md:485`,
+   `text/remote-suspend-todo.md:5`). On `UNSIZED`: name the files the idea would touch
+   (a grep or a `w1-recon` spawn — this is what SURVEY does anyway), then re-run
+   `do-tier` with those paths. Never treat `UNSIZED` as PATCH. Note it exits non-zero,
+   so under `pipefail` a `do-tier … | grep` returns 3 even when the grep matches —
+   capture the output first.
 3. **Confirm once** — goal sentence + tier, in a single `AskUserQuestion`. Never interrogate. A pre-agreed backlog item auto-skips this gate.
 
 The pruned spine by tier:
@@ -234,7 +247,7 @@ For each **enabled** stop (per the pruned spine), in order: check if its artifac
 | ↳ *SPEC docs* | `-features.md` if scope is multi-capability; `-ui.md` if the feature ships a user-visible surface | `docs` skill picks the types → `text/template-features.md` / `text/template-ui.md` (conditional — see Doc artifacts below) | sonnet · medium |
 | **DOCS** | doc set exists ∧ reconciles | the **full** doc set, written as the spec — `docs` skill picks the types, `writer` drafts: always `-docs.md`; + `-tutorial`/`-how-to`/`-reference`/`-agents-docs` per condition. Written in the reader's language *before* code — this is the acceptance spec PROVE validates against. Not a draft: the real thing | sonnet · medium |
 | **PLAN** | `test -f text/<slug>-todo.md` | `/create todo` + `text/template-todo.md` — cycles + deliverables derived from the docs (each cycle ships a documented observable) | sonnet · medium |
-| ↳ *ANALYZE* | — | `do-analyze.sh text/<slug>-todo.md` — CRITICAL exit 1 blocks BUILD | bash · none |
+| ↳ *ANALYZE* | — | `do-analyze.sh text/<slug>-todo.md [--strict-promise]` — CRITICAL exit 1 blocks BUILD. Also reads `text/<slug>.md` and HIGH-warns any promise `accept:` no `C<n>` cycle carries (the todo's `outcome:` and `Correct-course` blocks are not corpus — that's where the gap hides); `--strict-promise` makes an uncovered deliverable CRITICAL | bash · none |
 | **TEST** | test file in the repo folder | test-first **from the docs** — one assertion per documented observable; the docs' claims become the executable acceptance tests *before* code exists | sonnet · low |
 | **BUILD** | survey verdict = `build` (≥70% match → `expose`/`extend` instead) | the BUILD engine (Step 3) — make the docs + tests true | sonnet · low–medium |
 | **VERIFY** | rubric + ratchet pass | `do-reconcile.sh <canon>` per category + rubric composite ≥ 0.65 | haiku · medium |
@@ -292,7 +305,14 @@ Forward-only — a `[x]` is never un-ticked except by `/do --wave N --redo`. If
 
 After the spine: **LEARN / close** — validate `text/<slug>-docs.md` against the shipped behavior (the doc was authored at DOCS as the spec; close is where every documented observable is confirmed true and any drift reconciled — no plan closes with a doc that lies about what shipped); write one `learnings.md` entry (slug, tier, composite, deliverable, proof line), emit `signal("cost:cycle", {tokens, model, composite})` and `signal("world:do-event", { type:"learn", slug, tier, cycle, composite, deliverable, tags:["do:learn","do:cycle","tier:"+tier,"slug:"+slug] })`, delete `.w3-receipts.json`, write `.do-trust.json {level, consecutive, composite}` (in a worktree loop, `do-auto.sh` syncs trust + improvements back to the main tree every iteration — state never strands), and append `.w4-improvements.json` (an open item recurring in 3+ consecutive cycles = systemic gap → emit `substrate:systemic-gap`; next W1 reads it as a mandatory recon target).
 
-**Plan-outcome kill-switch (zero LLM).** The switch must be **armed before it can fire**: at PLAN close (before the first BUILD cycle), run the `outcome:` command once and require a **non-zero exit**. Exit 0 at plan start means either the goal is already met (close the plan, build nothing) or the outcome is too weak to gate anything (rewrite it before any cycle runs) — red before green, at plan level. Then re-run the command every cycle close. Exit 0 → the goal is met: remaining cycles enter justify-or-drop (default drop), `--auto` halts. Over the tier ceiling → `warn` + justify. Weak rubric 3× → halt, the *plan* is wrong, not the code. Goal-drift (outcome fails 3× with green rubrics) → force a re-plan.
+**Plan-outcome kill-switch (zero LLM).** The switch must be **armed before it can fire**: at PLAN close (before the first BUILD cycle), run the `outcome:` command once and require a **non-zero exit**. Exit 0 at plan start means either the goal is already met (close the plan, build nothing) or the outcome is too weak to gate anything (rewrite it before any cycle runs) — red before green, at plan level. Then re-run the command every cycle close. Exit 0 → the goal is met: remaining cycles enter justify-or-drop (default drop), `--auto` halts. Over the tier ceiling → `warn` + justify. Weak rubric 3× → halt, the *plan* is wrong, not the code.
+
+**Correct-course — mid-plan triage, tier-sized.** When reality diverges from the plan mid-loop — goal-drift (outcome fails 3× with green rubrics), a W3 anchor-miss that survives the autonomous re-plan-once, or INVESTIGATE surfacing a wider blast radius than the plan assumed — size the *correction*, not the feature, with the same tier lens Step 1 already uses:
+- **PATCH-sized** (a wrong assumption in one cycle, no scope change) → fix inline in the current cycle; append one line to the todo's `## Correct-course` log; continue the loop.
+- **FIX-sized** (a cycle's tasks/deliverables need adding, splitting, or dropping, but the promise still holds) → reopen PLAN: edit `text/<slug>-todo.md` cycles in place, append a `## Correct-course: <date>` block (old → new, one-line rationale, which cycle triggered it), re-run `do-analyze.sh` (the ANALYZE gate), resume the loop.
+- **FEATURE-sized** (a `deliverables:`/`assumes:` entry in the promise no longer holds, or the goal itself must change) → reopen DESIGN (and PROMISE, if the schedule of work changed): append the same `## Correct-course` block, re-derive PLAN from it, `do-promise-lint.sh` re-checks the schedule⇄proof law before the loop resumes.
+
+The block is the only new artifact — appended to the todo/plan already on disk, never a separate document. `--autonomous` treats a FEATURE-sized correction the same as CLARIFY: park, don't guess.
 
 **One command, complexity-sized.** `/do <anything>` is the only thing a human types — an idea, a slug, or a `text/<slug>-todo.md` path. The tier sizes the work and the spine prunes itself: a typo is edited and verified inline (one cycle, no loop); a feature writes its promise, plan, todo, tests, and docs and then runs every cycle. The human never picks the mode, never types a flag, never runs a second command.
 
@@ -358,7 +378,7 @@ echo "$RESOLVED" | jq -se 'all(.doc_only)' >/dev/null \
 TSC=$(bunx tsc --noEmit 2>&1 | grep -c "error TS" || echo 0)   # write .w0-baseline.json {tscErrors, loc, tests}
 ```
 
-**W1 — Recon.** Read `.w4-improvements.json` open items first — they're mandatory recon targets. Then consume the improvements queue: `grep -i "<slug-or-touched-paths>" .claude/improvements.queue.md | head -5` — matching proposals become recon targets too, and W4 deletes any line this cycle resolves (the queue shrinks or the loop is hoarding).
+**W1 — Recon.** If the task was picked up from the substrate queue (`tasks:mine`/`tasks:everywhere`, MCP `tasks_mine`/`tasks_everywhere`, or a board claim), read its `contextDocs` and `notes` FIRST — mandatory recon targets, same tier as `.w4-improvements.json` below. `contextDocs` names the doc-family stems that already exist for this slug (`do-rank.py`'s `task_context_for()` builds this list: `""`, `-plan`, `-features`, `-ui`, `-todo`, `-docs`, filtered to what's actually on disk); `notes` is the prose goal a human or a prior cycle attached. A picked task never starts bare. Read `.w4-improvements.json` open items next — they're mandatory recon targets. Then consume the improvements queue: `grep -i "<slug-or-touched-paths>" .claude/improvements.queue.md | head -5` — matching proposals become recon targets too, and W4 deletes any line this cycle resolves (the queue shrinks or the loop is hoarding). After the W1 agent (or cache hit) settles, append `{"cycle":"C<n>","wave":"W1","model":"haiku","ts":"<iso>"}` to `$WT/.do-census.jsonl`.
 
 **Cache check (zero tokens):**
 ```bash
@@ -372,9 +392,9 @@ bun .claude/scripts/w1-recon.ts --targets "$FILES" --mode RECON
 ```
 Script exits 2 if `ANTHROPIC_API_KEY` is absent → fall back to spawning `w1-recon` agent (Haiku · low) for ALL files in ONE message. Either path: skip `relevance_score < 0.4`; all-filtered → halt and broaden (zero-findings guard). Receipt capped at 400 words; persist high-signal slices into `.w2-spec.json`. *(The `w1-recon` agent carries the two-track existing-code + primitive-inventory contract.)*
 
-**W2 — Decide (spawned single `w2-decide` agent — Opus · high; Fable · high when the cycle is Fable-pinned).** W2 is NOT run inline; the conductor spawns one `w2-decide` agent at Opus·high (model-override `fable` if the plan marks this cycle Fable-mandatory) and waits for its result. Understanding is not delegable; it stays single, never fanned — but pinning it to the conductor process is not required. The conductor/session model runs Sonnet; W2 stays Opus. W2 writes the goal/deliverable/UX gate (3 sentences) first. Then: reconcile names against `dictionary.md`; run the **compress check** before any new primitive (name 3 existing primitives that compose it → `compose` removes it from the diff, `new` needs a one-line justification + same-diff doc edit). The pre-mortem + trade-offs were already captured at the DESIGN stop (`template-plan.md`) — carry the failure modes forward as test cases, don't redo them. Classify each W1 finding Act / Keep / Defer. Output diff specs + write `.w2-spec.json` (+ `.w2-doc-plan.json` if a doc trigger fires). **Output surface checklist:** for each route/page/component being added, fill `.w2-surface-checklist.json` with: which nav parent it links under, what inbound links to add + from which pages, which SDK/MCP/CLI exports are needed, all UI states. If a surface is being added but nav_entry/inbound_links are null, W4 will fail — they are not optional. Pin the **Interface Contract** (shared names, CLI signatures, decisions that multiple downstream tasks reference — pins let them run parallel, not serial). Emit the maximal-width batch DAG (arrow test applied: arrows exist only where one cycle reads a file another writes). *(The `w2-decide` agent carries the compose-target table — which canonical doc to check per primitive type — plus context-triggers for surgical doc injection.)*
+**W2 — Decide (spawned single `w2-decide` agent — Opus · high; Fable · high when the cycle is Fable-pinned).** W2 is NOT run inline; the conductor spawns one `w2-decide` agent at Opus·high (model-override `fable` if the plan marks this cycle Fable-mandatory) and waits for its result. Understanding is not delegable; it stays single, never fanned — but pinning it to the conductor process is not required. The conductor/session model runs Sonnet; W2 stays Opus. W2 writes the goal/deliverable/UX gate (3 sentences) first. Then: reconcile names against `dictionary.md`; run the **compress check** before any new primitive (name 3 existing primitives that compose it → `compose` removes it from the diff, `new` needs a one-line justification + same-diff doc edit). The pre-mortem + trade-offs were already captured at the DESIGN stop (`template-plan.md`) — carry the failure modes forward as test cases, don't redo them. Classify each W1 finding Act / Keep / Defer. Output diff specs + write `.w2-spec.json` (+ `.w2-doc-plan.json` if a doc trigger fires). **Output surface checklist (mandatory, every cycle):** W2 always writes `.w2-surface-checklist.json` — either the surface layers or `{"surface":"none","reason":"<why no user-visible surface>"}`. For each route/page/component being added, fill it with: which nav parent it links under, what inbound links to add + from which pages, which SDK/MCP/CLI exports are needed, all UI states. A cycle with no user-visible surface must say so explicitly — `surface: "none"` plus a `reason` string — so the escape hatch is auditable, never implicit. W4 fails the cycle if the file is absent. If a surface is being added but nav_entry/inbound_links are null, W4 will fail — they are not optional. Pin the **Interface Contract** (shared names, CLI signatures, decisions that multiple downstream tasks reference — pins let them run parallel, not serial). Emit the maximal-width batch DAG (arrow test applied: arrows exist only where one cycle reads a file another writes). *(The `w2-decide` agent carries the compose-target table — which canonical doc to check per primitive type — plus context-triggers for surgical doc injection.)* After the spawned `w2-decide` agent settles, append `{"cycle":"C<n>","wave":"W2","model":"opus|fable","ts":"<iso>"}` to `$WT/.do-census.jsonl`.
 
-**W3 — Edit (Sonnet × N parallel).** Soft-resume first: if `.w3-receipts.json` has fewer receipts than `.w2-spec.json` diff specs, a prior W3 was interrupted — skip W0–W2 and resume from the first unapplied spec. Pre-validate every anchor with `grep -qF` in parallel. No file overlap → spawn all `w3-edit` agents in ONE message (W3a). Overlap → W3a (independent) then W3b (same-file, sequential). Append a receipt per edit; anchor miss twice → halt, ask user. **Surface build order (mandatory, every cycle):** `schema → types → receiver/SDK → API route → MCP tool → CLI verb → component → page → route registration → navigation → inbound links → doc updates → UI states` (full-stack composition example: `text/sdk-mcp-cli-schema-design-integration.md`). MCP/CLI layers run only when `.w2-surface-checklist.json` declares `mcp_tool`/`cli_verb` — agent-facing or operator-facing capabilities, not every UI tweak. **Docs are parallel to code** — do not wait for W3a to complete; doc edits spawn in the same W3a message as code edits. **Navigation is mandatory** — if `.w2-surface-checklist.json` declares `nav_entry`, W3 must wire it (add route to nav system + create link from specified parent page); if omitted from checklist, W4 will fail. Same for inbound links. UI states (empty / loading / error / edge) rendered inline with page/component; not separate edits.
+**W3 — Edit (Sonnet × N parallel).** Soft-resume first: if `.w3-receipts.json` has fewer receipts than `.w2-spec.json` diff specs, a prior W3 was interrupted — skip W0–W2 and resume from the first unapplied spec. Pre-validate every anchor with `grep -qF` in parallel. No file overlap → spawn all `w3-edit` agents in ONE message (W3a). Overlap → W3a (independent) then W3b (same-file, sequential). Append a receipt per edit; anchor miss twice → halt, ask user. **Surface build order (mandatory, every cycle):** `schema → types → receiver/SDK → API route → MCP tool → CLI verb → component → page → route registration → navigation → inbound links → doc updates → UI states` (full-stack composition example: `text/sdk-mcp-cli-schema-design-integration.md`). MCP/CLI layers run only when `.w2-surface-checklist.json` declares `mcp_tool`/`cli_verb` — agent-facing or operator-facing capabilities, not every UI tweak. **Docs are parallel to code** — do not wait for W3a to complete; doc edits spawn in the same W3a message as code edits. **Navigation is mandatory** — if `.w2-surface-checklist.json` declares `nav_entry`, W3 must wire it (add route to nav system + create link from specified parent page); if omitted from checklist, W4 will fail. Same for inbound links. UI states (empty / loading / error / edge) rendered inline with page/component; not separate edits. After each `w3-edit` agent settles, append `{"cycle":"C<n>","wave":"W3","model":"sonnet","ts":"<iso>"}` to `$WT/.do-census.jsonl`.
 
 **W4 — Verify (bash first, zero tokens).**
 ```bash
@@ -387,8 +407,17 @@ if command -v gitleaks >/dev/null; then gitleaks detect --no-git --source . --re
 if git diff HEAD --name-only | grep -qE '(bun\.lock|package\.json)$'; then bun audit --audit-level moderate || exit 1; fi  # dep audit (only when deps moved)
 # do-auto.sh runs the same _secret_gate before every per-cycle commit — the secret never lands on the branch.
 
-# SURFACE LAYER VERIFICATION (the missing piece)
-if [ -f .w2-surface-checklist.json ]; then
+# SURFACE LAYER VERIFICATION — checklist is mandatory. W2 always writes
+# .w2-surface-checklist.json: either the surface layers, or {"surface":"none","reason":"..."}
+# (an explicit, auditable "no user-visible surface, because X"). Missing file = W4 FAIL —
+# a forgotten checklist is exactly the cycle where W2 forgot the UI, so the gate must not vanish.
+if [ ! -f .w2-surface-checklist.json ]; then
+  echo "W4 FAIL: .w2-surface-checklist.json missing — W2 must declare surfaces or surface:none+reason" >&2
+  exit 1
+fi
+if [ "$(jq -r '.surface // empty' .w2-surface-checklist.json)" = "none" ]; then
+  [ -n "$(jq -r '.reason // empty' .w2-surface-checklist.json)" ] || { echo "W4 FAIL: surface:none without a reason" >&2; exit 1; }
+else
   jq -r '.surfaces[] | select(.nav_entry) | .nav_entry' .w2-surface-checklist.json | while read -r route; do
     grep -q "path:.*$route" src/lib/navigation.ts || exit 1  # route registered
   done
@@ -402,10 +431,10 @@ if [ -f .w2-surface-checklist.json ]; then
     grep -q "export.*from.*$export" packages/sdk/src/index.ts || exit 1
   done
   jq -r '.surfaces[] | select(.mcp_tool) | .mcp_tool' .w2-surface-checklist.json | while read -r tool; do
-    grep -rq "$tool" packages/mcp/src/tools/index.ts || exit 1    # tool registered
+    grep -rq "$tool" packages/mcp/src/index.ts || exit 1          # tool registered
   done
   jq -r '.surfaces[] | select(.cli_verb) | .cli_verb' .w2-surface-checklist.json | while read -r verb; do
-    grep -rq "$verb" packages/cli/src/commands/index.ts || exit 1 # verb registered
+    grep -rq "$verb" packages/cli/src/index.ts || exit 1          # verb registered
   done
 fi
 # RECONCILES gate: per-category reconcile calls
@@ -416,6 +445,7 @@ do-reconcile.sh sdk         <file>          # GATEWAY tasks — joins a receiver
 do-reconcile.sh navigation  <surface>       # SURFACE tasks — registered + ≥1 inbound link
 do-reconcile.sh design      <file>          # SURFACE tasks — composes shadcn/tokens
 do-reconcile.sh authority   <file>          # GATEWAY tasks — walk-up resolves, no ad-hoc role bypass, no slug/workspace-from-request without authorizeWorkspace() (IDOR)
+bash .claude/scripts/do-consumer-sweep.sh --exec $(git diff HEAD --name-only)  # sweep every changed public surface's consumers (SDK/schema/receivers)
 # PROMISE CHECK (verify shipped feature matches text/<slug>.md promise)
 if [ -f "text/$(cycle.slug).md" ]; then
   # Cycle demo must prove the observable from text/<slug>.md exists
@@ -429,16 +459,23 @@ Rubric (inline for TRIVIAL/SIMPLE; for COMPLEX — run the SDK script first (6 H
 ```bash
 bun .claude/scripts/w4-rubric.ts --files "$(git diff HEAD --name-only | tr '\n' ',')"
 ```
-Script exits 2 if key absent → fall back to spawning 6 Haiku agents · medium. Either path runs alongside `pr-review-toolkit` (code-reviewer, silent-failure-hunter, type-design-analyzer) + `find-bugs` + `accessibility` on UI):
+Script exits 2 if key absent → fall back to spawning 6 Haiku agents · medium (after each settles, append `{"cycle":"C<n>","wave":"W4","model":"haiku","ts":"<iso>"}` to `$WT/.do-census.jsonl`). Either path runs alongside `pr-review-toolkit` (code-reviewer, silent-failure-hunter, type-design-analyzer) + `find-bugs` + `accessibility` on UI):
 ```
 composite = 0.30·goal-fit + 0.18·security + 0.18·stability + 0.12·simplicity + 0.12·integration + 0.10·speed
 gate: composite ≥ 0.65  AND  goal-fit ≥ 0.50 (hard)  AND  no adversarial > 0.5  AND  delta_tsc ≤ 0
 ```
-**Integration is scored deterministically** — from `.w2-surface-checklist.json` (nav entry registered · inbound links present · SDK/MCP/CLI exports wired) + the `do-reconcile.sh sdk|navigation|docs` results: fraction of declared surfaces verified. Pass it to the rubric as `w4-rubric.ts --integration=0.NN`; only when no checklist exists does the LLM score it from the diff. The surface hard gates above still block independently — the score makes the axis *compound* (mark amount, `s:integration` signal), the gates make it *mandatory*.
+Weights and axis definitions are data, not prose — `.claude/scripts/rubric-weights.json` (`cycle` block) is the single source; the line above is a readable copy of it.
+
+> **`w4-rubric.ts` supplies the five code axes, not this verdict.** It computes the `task` rubric and prints `task-composite=` — five axes, no goal-fit, because a bare diff has no plan context. **W4 scores goal-fit itself** (against the todo's `outcome:` line) and applies the `≥ 0.50` hard gate; the script cannot. Take its axis scores, add goal-fit, recompute with the `cycle` weights. Its exit code is a task-rubric verdict — never the cycle's.
+**Integration is scored deterministically** — from `.w2-surface-checklist.json` (nav entry registered · inbound links present · SDK/MCP/CLI exports wired) + the `do-reconcile.sh sdk|navigation` results: fraction of declared surfaces verified. Pass it to the rubric as `w4-rubric.ts --integration=0.NN`; only when the checklist declares `surface:"none"` (with its reason) is integration scored from the diff — an *absent* checklist is a W4 fail, never a fallback. The surface hard gates above still block independently — the score makes the axis *compound* (mark amount, `s:integration` signal), the gates make it *mandatory*.
 **Taste gate (UI-heavy cycles only).** When a cycle's deliverable is primarily a component/page, the design canon checks composition (shadcn/tokens) but not whether the result is *good*. Spawn one Fable verdict — fed the screenshot/render + the surface checklist, returning keep / refine / reject with one sentence why. Counts toward the simplicity score; reject → W3.5. Skipped for internal-only or non-UI cycles.
 
 Verify scope is the **dependency cone** of `git diff` (full verify only at cycle close — speed). Then compress sweep (ts-prune + noUnusedLocals → delete orphans/dead code), write `.w4-improvements.json`, and fire one pre-warm Haiku at the next cycle's W1 targets. Verify or demo failure on touched files → W3.5 (one Sonnet per dirty file), max 3 W4 loops then halt.
 
+**in-wave-race.** Parallel W3a agents editing disjoint files can still race the type checker: agent A creates `foo.ts` while agent B, in the same wave, writes an import of it — if B's `tsc` snapshot runs before A's file lands on disk, B sees a false `TS2307: Cannot find module`. A TS2307 whose missing specifier resolves to a file listed in another SAME-WAVE diff spec is classified `in-wave-race`: re-run `tsc` once after all wave agents settle; only a persisting error fails the cycle. This is a same-wave-only allowance — a TS2307 pointing at a file no diff spec in this wave creates is a real missing-file error, not a race.
+
+Consumer sweep runs alongside RECONCILES: `do-consumer-sweep.sh` maps a changed public surface (SDK export, schema, receiver) to the commands that prove its consumers still build — `packages/sdk/src/` → cli test + mcp typecheck, `schema/one.tql` → SDK codegen diff-clean, `packages/sdk/src/receivers.ts` → the surfaces vitest suite. A sibling consumer broken by this cycle's surface change fails here, not three cycles later when someone else's build goes red for no visible reason.
+
 **Testing policy** (full detail in `text/templates-plan.md` § Todo doctrine): Vitest-first; Playwright only when the cycle declares `requires_playwright: true`; one goal-based `expect()` per deliverable (assert the destination, not the path); ≤1 test file per cycle; a cycle needing >5 tasks splits unless `mode: lean`; N-variant split-test → winner `mark()`, losers `warn(0.5)`.
 
 ---
@@ -478,6 +515,7 @@ PATCH clears {1, 3, 11, 12}. FIX clears {1, 2, 3, 4, 11, 12}. FEATURE clears all
 - **Closed loop** — every cycle ends in `mark`/`warn`, never a silent return.
 - **Cheapest tool that decides wins** — a phase that needs no LLM call is the best kind.
 - **Arm the kill-switch.** The plan `outcome:` command must exit non-zero at PLAN close, before the first cycle. An outcome that passes before the work starts gates nothing.
+- **Correct-course, don't silently absorb.** A discovery that widens blast radius, breaks a promise assumption, or drifts the goal gets sized (PATCH/FIX/FEATURE) and logged in a `## Correct-course` block on the todo/plan — never quietly folded into the current cycle's diff unremarked.
 - **W4 max 3 loops**, then halt and report.
 - **One command.** A human types `/do <anything>` and nothing else. Complexity sizing, spine pruning, and (for multi-cycle plans) the context-isolated loop are all automatic — never a flag, never a second command.
 - **Every cycle gets a fresh context.** A multi-cycle `/do` runs each cycle in a clean subprocess via the internal loop. Prior-cycle conversation is noise; the todo checkboxes are the only state that carries forward.
@@ -489,11 +527,13 @@ PATCH clears {1, 3, 11, 12}. FIX clears {1, 2, 3, 4, 11, 12}. FEATURE clears all
 
 **Scripts** (`.claude/scripts/`): `do-auto.sh` (*internal* — the context-isolated, worktree-isolated loop `/do` drives for multi-cycle plans; builds on branch `do/<slug>`, merges to trunk only on a human's say-so; writes a zero-LLM merge digest (`.do-digest.md`) at plan-complete so the human merges informed, not blind; conductor pinned `--model sonnet`; syncs trust/improvements back to main tree every iteration; `--gc` sweeps merged worktrees; **`--setup-only` cuts+links the worktree and prints its path then exits — the seam the inline single-cycle/PATCH/FIX path uses to build in a worktree without the subprocess loop**) · `do-tier.sh` (tier + pruned spine + classifier + ceiling) · `do-folder.sh` (folder-aware verify/build) · `do-survey.sh` (reuse verdict) · `do-reconcile.sh <canon>` (**one predicate over 7 canons** — `substrate|dictionary|authority|sdk|design|navigation|types` — subsumes the old RECONCILE, COMPRESS, PROMISE-CHECK, DOC-SYNC gates; `navigation` branch enforces surface reachability; `--self-test` drives fixtures) · `do-analyze.sh` (deliverable↔cycle coverage gate) · `do-prove.sh` (surface-detect proof — pure PROVE, promise-check moved into `do-reconcile.sh design`) · `do-promise-settle.sh <slug> [--composite 0.NN]` (zero-LLM promise settle at close — re-runs the promise's `proof:`; kept → `mark` on `promise:<slug>→proof` + `world:announce`, broken → `warn`, no observable → dissolved; `--self-test` drives kept/broken/dissolved fixtures; thesis `text/marketplace.md`) · `do-smoke.sh` (deterministic outcome — drives ≥1 fixture per canon branch + orphan/reachable nav fixtures) · `w1-recon.ts` (prompt-cached recon) · `w4-rubric.ts` (cached parallel rubric).
 
+**Workflows** (`.claude/workflows/`): `one-loop.js` (`/do turn` — one wavefront company turn; phase-pinned model ladder Sense=haiku · Pick=opus/fable-on-anomaly · Execute=pick-assigned per move · Verify=haiku skeptics · Close=sonnet; contract `text/one-loop.md`, log `text/loop-log.md`, state `text/loop-state.json`) · `do-engine` (per-wave model+effort plan runner, `text/do-engine-plan.md`).
+
 **Templates**: `text/template-feature.md` (promise/PROMISE — uncomment its `contract:` block for a contract-backed promise that mints on-chain, worked example `text/playbook.md`) · `text/template-plan.md` (design + pre-mortem + decisions/DESIGN) · `text/template-todo.md` (plan + parallel budget + testing policy/PLAN) · `text/template-agent.md` (agent definition/BUILD).
 
 **Agents**: `w1-recon` · `w2-decide` (spawned single Opus; carries the full W2 contract — compress check, Interface Contract pin, maximal batch DAG) · `w3-edit` · `w4-verify` · `Explore` · `Plan` · `pr-review-toolkit:*` (code-reviewer, silent-failure-hunter, type-design-analyzer, pr-test-analyzer, code-simplifier) · `find-bugs`.
 
-**Skills** (per-stage routing in `text/templates-plan.md`): PROMISE → `docs`, `writer`, `copywriting` · DESIGN → `docs`, `typedb`, `signal`, `frontend-design` (if UI) · BUILD → `astro`, `react19`, `shadcn`, `ai-ui`, `ai-sdk`, `sdk`, `mcp`, `cli`, `reactflow`, `hono`, `cloudflare`, `wrangler`, `durable-objects` · TEST → `vitest`, `playwright-best-practices`, `webapp-testing` · VERIFY → `accessibility`, `find-bugs`, `perf`, `typecheck` · TEACH → `docs`, `writer`.
+**Skills** (per-stage routing in `text/templates-plan.md`): PROMISE → `docs`, `writer`, `copywriting` · DESIGN → `docs`, `typedb`, `signal`, `frontend-design` (if UI) · BUILD → `astro`, `react19`, `shadcn`, `ai-ui`, `reactflow`, `puck` (page-shaped deliverables route through the Puck page editor / views registry — `one.ie/web/src/lib/views/registry.ts` — not hand-rolled pages), `ai-sdk`, `sdk`, `mcp`, `cli`, `hono`, `cloudflare`, `wrangler`, `durable-objects` · TEST → `vitest`, `playwright-best-practices`, `webapp-testing` · VERIFY → `accessibility`, `find-bugs`, `perf`, `typecheck` · TEACH → `docs`, `writer`.
 
 **Skill-per-layer routing (W3 surface build order):** schema → `typedb` · types → `sdk` · API route → `ai-sdk` · receiver/SDK → `sdk` · MCP tool → `mcp` · CLI verb → `cli` · component/page → `react19` + `shadcn` · docs → `writer`. W3 loads the layer's skill before editing; missing/stale (>30d) → `/skill-creator` first (contract: `text/skill-invocation.md`).
 

package/commands/go.md

@@ -0,0 +1,75 @@
+# /go — the standing "yes"
+
+One word for everything the operator types over and over: **fill the gaps · do it · yessssss · continue · merge and deploy · fan out.**
+
+`/go` means: you already have consent. Stop narrating options, stop asking, move.
+
+---
+
+## Modes
+
+| Invocation | Meaning |
+|---|---|
+| `/go` | Resolve state and advance NOW (one push, this turn) |
+| `/go on [max] [mission…]` | Arm auto-continue — the Stop hook re-prompts you until done |
+| `/go off` | Disarm auto-continue |
+| `/go status` | Report flag state + continuation count |
+| `/go <slug>` | `/go` scoped to one todo slug (= consent for its whole arc) |
+
+---
+
+## `/go` (no args) — the advance algorithm
+
+Work the first matching rung, then close with numbers:
+
+1. **In-flight work exists** (uncommitted changes, failing test you just saw, half-done todo cycle) → finish it. A failed command is a step, not a stop: diagnose, fix, retry.
+2. **Work is done and green** (tsc + tests + kill-switch pass) → close the loop without being asked:
+   - `git branch --show-current` FIRST (shared-tree law), commit by explicit path
+   - merge to main, `/deploy`, verify live (real request, not "file exists")
+3. **Idle** → read `todo.md`, take the top unblocked slug, run `/do <slug>`.
+4. **Multiple independent, file-disjoint items** → fan out: spawn parallel agents in ONE message (or `do-fleet.sh --slots N --go` for whole waves).
+
+"Fill the gaps" = before building, presence-check the promise's `deliverables:`/`world:` manifests and the plan's artifacts — missing → write, stale → rewrite, true → skip. That is the /do lifecycle; `/go` just skips the part where you wait for permission.
+
+### What /go does NOT consent to
+
+Still ask, even under /go:
+
+- destructive/irreversible actions (data deletion, prod schema drops, force-push)
+- spending money beyond already-established rails
+- genuine scope changes (new promise, killing a feature)
+- publishing to external surfaces not already in the task's arc
+
+Everything else — edits, tests, commits on the right branch, merge, deploy, fan-out — is pre-approved.
+
+## `/go on [max] [mission…]`
+
+Write the flag file the Stop hook (`hooks/auto-continue.sh`) reads:
+
+```bash
+printf 'max=%s\n%s' "${max:-12}" "${mission:+mission=$mission}" > .claude/auto-continue.local
+```
+
+Then behave as `/go` (advance now — the hook keeps you advancing on every stop until done or budget spent). Budget is per-session; counter lives in `/tmp/oneie-auto-continue-<session>.count`.
+
+## `/go off`
+
+```bash
+rm -f .claude/auto-continue.local
+```
+
+## `/go status`
+
+Report: flag present? max? mission? current count from the /tmp counter. One line.
+
+---
+
+## Numeric close
+
+Every `/go` invocation ends with a countable line:
+
+```
+/go closed: rung=<1|2|3|4> actions=<n> merged=<0|1> deployed=<0|1> next=<slug|none>
+```
+
+`/go on|off|status` close with: `auto-continue=<on|off> max=<n> count=<n>`.

package/commands/improve.md

@@ -29,7 +29,7 @@ Proposals come in three kinds (set by `stop-reflect.sh`):
 | Proposal kind | Detection | Target |
 |---|---|---|
 | `**convention**` | `\.claude/(rules\|skills\|agents)/...` or `CLAUDE\.md` in path | the named file — promote the rule into its body |
-| `**new primitive**` | `\.claude/(skills\|rules\|agents\|hooks)/[^/]+\.(md\|sh)` | the index in `one-ie/.claude/CLAUDE.md` — add a one-line entry |
+| `**new primitive**` | `\.claude/(skills\|rules\|agents\|hooks)/[^/]+\.(md\|sh)` | `.claude/CLAUDE.md` § Structure, or the root `README.md` skills table — add a one-line entry (the two targets `stop-reflect.sh` names) |
 | `**doc-drift**` | `<subdir>/CLAUDE.md` named | that CLAUDE.md — surface a 3-line summary of the most impactful code changes and ask the user which (if any) belong in the contract |
 
 If detection fails, the user is asked: "which file should this update?" Free-text answer accepted.
@@ -48,7 +48,9 @@ If detection fails, the user is asked: "which file should this update?" Free-tex
 ```
 - **new primitive** `.claude/skills/perf.md` — add a one-line entry to the index.
 ```
-→ `apply` opens `one-ie/.claude/CLAUDE.md`, finds the skills index, appends `| /perf | ...` row.
+→ `apply` opens `.claude/CLAUDE.md`, finds the `skills/` line in the § Structure block, and
+adds the name to it (that block is a tree listing, not a table — the `| /perf | … |` row form
+belongs in the root `README.md` skills table).
 
 **Doc-drift proposal:**
 ```

package/commands/kill.md

@@ -27,22 +27,20 @@ Deleting `.wrangler/` wipes all local data. There is no undo. Do not include it
 3. **Reinstall** via `bun install`
 4. **Start all three servers** in background:
    - `bun run dev` — Astro on 4321
-   - `bun run dev:gateway:bg` — local gateway
+   - `bun run dev:gateway` — local gateway on 8788 (use the plain script, not `dev:gateway:bg`: the `:bg` variant self-forks and returns immediately, so a `run_in_background: true` Bash call would report "done" while the gateway is still booting)
    - `bun run dev:wrangler` — CF Worker on 8787 (requires build; slow ~30s)
 
 ## One-shot command
 
 Run the kill + reinstall first, then start all three servers. Each server starts in background (`run_in_background: true`).
 
+⚠️ The port sweep below also hits other projects' dev servers parked in 4321–4329 (e.g. `apps/one/site` on 4322). If a neighbour project is running, drop its port from the list — and never re-add blanket `pkill -f "astro dev"`-style patterns; they kill every Astro/vite on the machine across all sessions.
+
 **Step 1 — kill + reinstall:**
 ```bash
 cd /Users/toc/Server/one-ie/one.ie/web && \
   (lsof -ti:4321,4322,4323,4324,4325,4326,4327,4328,4329,8787,8788,8789,8790,8791,8792,8793,8794,8795,8796,8797,8798,8799 2>/dev/null | xargs kill -9 2>/dev/null; \
-   pkill -f "astro dev" 2>/dev/null; \
-   pkill -f "wrangler dev" 2>/dev/null; \
-   pkill -f "vite" 2>/dev/null; \
-   pkill -f "workerd" 2>/dev/null; \
-   pkill -f "miniflare" 2>/dev/null; true) && \
+   pkill -f "one\.ie/web.*(astro|vite|workerd|miniflare|wrangler)" 2>/dev/null; true) && \
   rm -rf .astro node_modules/.vite node_modules/.astro dist && \
   bun install
 ```
@@ -64,8 +62,8 @@ Confirm Astro is up on 4321, gateway is up, and wrangler is up on 8787 by checki
 ## When NOT to use
 
 - Cache-only fix would do → `rm -rf node_modules/.vite .astro && bun run dev` (~3s); this is ~30s
-- Production / deploy issues → use `/deploy` or `/build`
-- TypeScript errors only → use `/typecheck`; cache reset won't fix code
+- Production / deploy issues → use `/deploy` (there is no `/build` command — the build step lives inside `/deploy`, or run `cd one.ie/web && bun run build`)
+- TypeScript errors only → `cd one.ie/web && bun run typecheck` (there is no `/typecheck` command); cache reset won't fix code
 - Dependency version drift suspected → manually `rm -rf node_modules bun.lock && bun install` (this command preserves both)
 
 ## Diagnostic order (cheapest first)

package/commands/notify.md

@@ -2,6 +2,11 @@
 
 Send a message to your personal Telegram from Claude Code.
 
+**Prefer `/chat` or `cc-connect send` for peer messaging** — those route through
+`space:post` and mirror into the workspace inbox. `notify.sh` marks itself
+DEPRECATED for plain text; keep it for **file sends** and for direct Telegram
+delivery when `space:post` is unavailable.
+
 ## Usage
 
 ```
@@ -12,13 +17,21 @@ Send a message to your personal Telegram from Claude Code.
 
 ```bash
 .claude/scripts/notify.sh "<message>"
+.claude/scripts/notify.sh --to <me|tony|donal|chat_id> "<message>"
+.claude/scripts/notify.sh --file <path> ["caption"]
 ```
 
 ## Examples
 
 ```bash
 .claude/scripts/notify.sh "deploy done — channels worker is live"
-.claude/scripts/notify.sh "tests passing, ready to review"
+.claude/scripts/notify.sh --to donal "tests passing, ready to review"
+.claude/scripts/notify.sh --file /tmp/report.pdf "this cycle's numbers"
 ```
 
-Sends to your Telegram (tg-631201930) via the channels worker. Uses `CHANNELS_URL` env var or the deployed worker at `channels.oneie.workers.dev`.
+Posts **directly to `api.telegram.org`** (`sendMessage` / `sendDocument`) — it does
+**not** go through the channels worker and reads no `CHANNELS_URL`. The bot token
+comes from `TELEGRAM_TOKEN` in the environment, falling back to the
+`TELEGRAM_TOKEN=` line in `channels/.dev.vars`; the script exits 1 if neither
+resolves. Default recipient is chat_id `631201930` (me/tony); `donal` is
+`714125982`. Prints `sent ✓` on success.

package/commands/oo-push.md

@@ -1,13 +1,24 @@
 # /oo-push
 
-Push changes in `apps/oo/` to `github.com/one-ie/oo`.
+Push changes in the standalone `oo` clone to `github.com/one-ie/oo`.
 
-`apps/oo/` is the canonical repo — it has its own git history and remote. The monorepo subtree was removed 2026-06-20.
+**Path (verified 2026-08-02): `/Users/toc/Server/one-ie.pre-mono/oo`.**
+`apps/oo/` does **not** exist — that path was wrong and any command using it
+fails with "no such file or directory". The clone is the canonical repo: its own
+git history, `origin` = `https://github.com/one-ie/oo.git`. The monorepo subtree
+was removed 2026-06-20.
+
+Resolve the path before pushing rather than trusting this line — the clone has
+moved once already:
+
+```bash
+git -C /Users/toc/Server/one-ie.pre-mono/oo remote -v   # must show one-ie/oo.git
+```
 
 ## Usage
 
 ```
-/oo-push              # push apps/oo to github.com/one-ie/oo main
+/oo-push              # push the oo clone to github.com/one-ie/oo main
 /oo-push <branch>     # push to a specific branch
 ```
 
@@ -17,21 +28,25 @@ Push changes in `apps/oo/` to `github.com/one-ie/oo`.
 
 2. **Check for uncommitted changes**
    ```bash
-   git -C /Users/toc/Server/apps/oo status --short
+   git -C /Users/toc/Server/one-ie.pre-mono/oo status --short
    ```
-   If anything is uncommitted, surface a warning and ask whether to stage + commit first.
+   If anything is uncommitted, surface a warning and ask whether to stage + commit
+   first. As of 2026-08-02 this tree has uncommitted edits (`README.md`,
+   `TUTORIAL.md`, `features.md`) and untracked files under `docs/` — a bare push
+   ships none of them, so expect this warning and do not treat it as noise.
 
 3. **Push**
    ```bash
-   git -C /Users/toc/Server/apps/oo push origin <branch>
+   git -C /Users/toc/Server/one-ie.pre-mono/oo push origin <branch>
    ```
 
 4. **Report**
    ```
-   Pushed apps/oo → github.com/one-ie/oo (<branch>)
+   Pushed one-ie.pre-mono/oo → github.com/one-ie/oo (<branch>)
    ```
 
 ## Notes
 
-- `apps/oo` remote `origin` points at `https://github.com/one-ie/oo.git`
-- The monorepo `oo` remote (`one-ie/` → `github.com/one-ie/oo.git`) is stale — do not use `git subtree push --prefix=oo oo main` (the prefix was deleted)
+- The monorepo `one-ie/` still carries a stale `oo` remote pointing at the same
+  URL — do **not** use `git subtree push --prefix=oo oo main`; the `oo/` prefix
+  was deleted from this repo and the subtree rotted.

package/commands/rag.md

@@ -41,6 +41,12 @@ Search, synthesize, verify, and ingest notes from the OO-Brain corpus (Obsidian
 
 ## Steps per mode
 
+**"Delegate to `<name>` skill" below means: Read `.claude/skills/<name>.md` and
+follow it.** Those six files are flat `.md`, not `<name>/SKILL.md` directories,
+so the runtime does not register them — the Skill tool cannot invoke them by
+name even though each carries valid `name`/`description` frontmatter. Read the
+file directly; it is the live contract either way.
+
 ### `/rag <query>` — Quick Search
 
 1. Auto-route vault from query topic.

package/commands/release.md

@@ -2,8 +2,15 @@
 
 Release the ONE OSS template and/or npm packages.
 
-**Template source:** `one-ie/template/` → `apps/one/` (github.com/one-ie/one)
-**npm packages:** `packages/{sdk,react,mcp,cli}` → npm registry
+**Template direction flipped 2026-07-23 — `apps/one/` is now the SINGLE SOURCE OF TRUTH.**
+Real development happens directly in the public clone; `one-ie/template/` is a read-only-by-
+convention **mirror** kept inside the monorepo so `packages/` and `/do` cycles can reference it
+without a second clone. Edit `apps/one` directly, then pull it back:
+**`apps/one/` → `one-ie/template/` (+ `apps/oo/site/`)**. There is deliberately **no**
+template → apps/one push path; the old direction would have destroyed apps/one-only work.
+
+**npm packages:** `packages/{sdk,react,mcp,cli}` → npm registry (a separate job — the release
+script does not publish; see Step 4)
 
 ---
 
@@ -11,8 +18,8 @@ Release the ONE OSS template and/or npm packages.
 
 | Command | What |
 |---|---|
-| `/release` | Full pipeline: template + npm packages |
-| `/release template` | Sync template to apps/one and push (no npm publish) |
+| `/release` | Full pipeline: template pull + npm packages |
+| `/release template` | Pull apps/one into the template mirror and commit in one-ie (no npm publish) |
 | `/release npm` | Bump + build + publish npm packages only |
 | `/release --dry-run` | Print what would happen, no writes |
 
@@ -30,31 +37,36 @@ test -d /Users/toc/Server/apps/one/.git || {
   exit 1
 }
 
-# Run strip guard — zero moat source in template
-cd one-ie/template && bash scripts/strip-guard.sh
+# Run strip guard — zero moat/do-engine source in the template's site/src/
+# (maintainer-only tooling lives in template-release/, a SIBLING of template/,
+#  and never ships in the published repo)
+cd one-ie/template-release && bash scripts/strip-guard.sh
 
 # Run test suite
-cd one-ie/template && bun vitest run
+cd one-ie/template-release && bun vitest run
 ```
 
 ---
 
-## Step 2 — Sync template to apps/one
+## Step 2 — Pull apps/one into the template mirror
 
 ```bash
-cd one-ie/template
+cd one-ie/template-release
 bash scripts/release.sh --message "release: $(date +%Y-%m-%d)"
+# flags: --dry-run | --no-push | --message "<note>"
 ```
 
-The script (`template/scripts/release.sh`):
-1. `rsync` template/ → apps/one/ (excludes node_modules, dist, .do-* state)
-2. Stubs paid plugins — replaces `src/` with a single `index.ts` pointing to `pay.one.ie/x/<plugin>.js`
-3. `git add -A && git commit && git push origin main`
-
-**Paid plugins** (stubbed at release — source stays private):
-- `plugin-admin` → `pay.one.ie/x/admin.js`
+The script (`template-release/scripts/release.sh`):
+1. `rsync` apps/one/ → one-ie/template/ (excludes local-only / secret files)
+2. Sync per-package LICENSE files (`sync-licenses.sh`)
+3. `git commit` (+ push unless `--no-push`) **inside the one-ie monorepo — NOT apps/one.**
+   Nothing here writes to apps/one or to github.com/one-ie/one; that clone owns its own history.
+4. `rsync` apps/one/site/ → apps/oo/site/ (keeps the agency node current, if apps/oo exists)
 
-Add more to the `PAID_PLUGINS` array in `template/scripts/release.sh` as you build them.
+**Paid plugins are not stubbed by this script.** The 5 paid plugins backing `PAID_FEATURES`
+(`one.ie/web/src/lib/billing/gate.ts`) — `plugin-{admin,course,dashboard,premium,shop}` — live in
+`apps/one/packages/` and are mirrored into `template/packages/` unpublished. Their delivery
+mechanism is still undecided: `text/plugin-delivery-plan.md` § Scope correction.
 
 ---
 
@@ -101,6 +113,13 @@ cd packages/cli   && npm publish --access public && cd ../..
 
 **Gotcha:** `workspace:*` deps must be temporarily pinned to `^x.y.z` before publishing, then restored. See memory entry `reference_oneie_npm_publish_workspace`.
 
+**The other npm packages have their own door.** `@oneie/design`, `@oneie/frontend`, and the 9
+free plugins (auth/backend/blog/booking/chat/docs/mail/media/track) publish per-package via
+`bash packages/publish-plugin.sh <plugin-dir-name> [--dry-run]` — it rewrites `workspace:*`
+peers to a loose optional `*` and restores `package.json` on exit. It **hard-refuses** the 5
+paid plugins unconditionally, even with `--dry-run`: public npm has no purchase gate. Do not
+remove that block to work around it.
+
 ---
 
 ## Step 5 — Tag + report
@@ -113,7 +132,7 @@ git tag "v$VERSION" && git push origin "v$VERSION"
 
 Report format:
 ```
-Template:  strip-guard ✓  34/34 tests ✓  synced → apps/one  pushed → github.com/one-ie/one
+Template:  strip-guard ✓  N/N tests ✓  pulled apps/one → template/  committed in one-ie
 npm:       @oneie/sdk@0.14.0 ✓  @oneie/react@0.14.0 ✓  @oneie/mcp@0.14.0 ✓  @oneie/cli@0.14.0 ✓
 Tag:       v0.14.0 → main
 ```
@@ -122,12 +141,14 @@ Tag:       v0.14.0 → main
 
 ## x402-gated plugins
 
-Paid plugins are served from `pay.one.ie/x/<name>.js`. The `release.sh` script stubs them in the OSS repo. To add a new paid plugin:
+**Design, not shipped.** `release.sh` does not stub paid plugins and there is no `PAID_PLUGINS`
+array in it — the x402 delivery path (`pay.one.ie/x/<name>.js`) is the undecided half of
+`text/plugin-delivery-plan.md`. What IS enforced today is the refusal: `packages/publish-plugin.sh`
+blocks the 5 paid plugins from npm, and they ship to nobody until that plan lands.
 
-1. Build the full plugin in `template/packages/plugin-<name>/`
-2. Add `plugin-<name>` to `PAID_PLUGINS` in `template/scripts/release.sh`
-3. Set `serves: "pay.one.ie/x/<name>.js"` in the plugin's `index.ts`
-4. Wire the x402 endpoint in `pay/backend/` to serve the compiled JS after payment
+The paid set is defined in one place — `PAID_FEATURES` in `one.ie/web/src/lib/billing/gate.ts`,
+mirrored by the `PAID_PLUGINS` string in `packages/publish-plugin.sh`. Adding a paid plugin means
+editing both, not a release-script array.
 
 ---
 
@@ -137,8 +158,8 @@ Paid plugins are served from `pay.one.ie/x/<name>.js`. The `release.sh` script s
 - **npm token** — automation token stored in memory as `reference_npm_token` (expires 2026-08-26)
 - **SDK publishes first** — registry must have it before react/mcp/cli resolve it
 - **Paid plugin source never ships** — `strip-guard.sh` verifies this; if it fails, fix before publish
-- **`apps/one` keeps its git history** — `release.sh` commits on top of existing history, preserving stars/forks
+- **`apps/one` is never written by `release.sh`** — it is the SSOT and owns its own history; the commit lands in the one-ie monorepo. Anything the mirror has that apps/one lacks must be moved by hand, deliberately.
 
 ---
 
-*Template syncs via rsync. Paid plugins stub to x402. npm packages publish in dependency order.*
+*apps/one is the source; the template mirrors it via rsync. Paid plugins ship to nobody yet. npm packages publish in dependency order.*

package/commands/restart.md

@@ -18,9 +18,7 @@ Use when: you want a clean restart without the full `/kill` overhead. Takes ~15s
 ```bash
 cd /Users/toc/Server/one-ie/one.ie/web && \
   (lsof -ti:4321,4322,4323,4324,4325,4326,4327,4328,4329,8787,8788,8789,8790,8791,8792,8793,8794,8795,8796,8797,8798,8799 2>/dev/null | xargs kill -9 2>/dev/null; \
-   pkill -f "astro dev" 2>/dev/null; \
-   pkill -f "wrangler dev" 2>/dev/null; \
-   pkill -f "local-gateway" 2>/dev/null; true)
+   pkill -f "one\.ie/web.*(astro|wrangler|local-gateway)" 2>/dev/null; true)
 ```
 
 **Step 2 — db-sync (blocking, must finish before servers start):**
@@ -36,10 +34,13 @@ cd /Users/toc/Server/one-ie/one.ie/web && bun run dev
 # Gateway — TypeDB-backed local gateway on 8788
 cd /Users/toc/Server/one-ie/one.ie/web && bun run dev:gateway
 
-# Channels worker — wrangler on 8787
+# Channels worker — wrangler on 8787 (`bun run dev` = bare `wrangler dev`)
 cd /Users/toc/Server/one-ie/channels && bun run dev
 ```
 
+`/kill` puts `one.ie/web`'s `dev:wrangler` on 8787 instead. Only one of the two
+can hold that port — don't run both; the second bind fails.
+
 Poll `http://localhost:4321/` until 200, then confirm all three up:
 - Astro: http://localhost:4321 → 200
 - Gateway: http://localhost:8788 → 404 (expected)