@oneie/claude 0.6.0 → 0.8.0

package/scripts/do-auto.sh

@@ -20,23 +20,36 @@ MAX_CYCLES=30
 DRY_RUN=false
 GC_ONLY=false
 SETUP_ONLY=false
+SELF_TEST_LIFECYCLE=false
+SELF_TEST_KANBAN=false
+SELF_TEST_DAEMON=false
+STATUS_ONLY=false
+DAEMON=false
 
 while [ "$#" -gt 0 ]; do
   case "$1" in
-    --setup-only) SETUP_ONLY=true; shift ;;
-    --max-cycles) MAX_CYCLES="$2"; shift 2 ;;
-    --dry-run)    DRY_RUN=true; shift ;;
-    --gc)         GC_ONLY=true; shift ;;
-    -*)           echo "unknown flag: $1" >&2; exit 1 ;;
-    *)            SLUG="$1"; shift ;;
+    --setup-only)          SETUP_ONLY=true; shift ;;
+    --status)              STATUS_ONLY=true; shift ;;
+    --daemon)              DAEMON=true; shift ;;
+    --max-cycles)          MAX_CYCLES="$2"; shift 2 ;;
+    --dry-run)             DRY_RUN=true; shift ;;
+    --gc)                  GC_ONLY=true; shift ;;
+    --self-test-lifecycle) SELF_TEST_LIFECYCLE=true; shift ;;
+    --self-test-kanban)    SELF_TEST_KANBAN=true; shift ;;
+    --self-test-daemon)    SELF_TEST_DAEMON=true; shift ;;
+    -*)                    echo "unknown flag: $1" >&2; exit 1 ;;
+    *)                     SLUG="$1"; shift ;;
   esac
 done
 
 # Standalone GC: sweep all worktrees whose do/<slug> branch is fully merged into
-# the current branch. Safe-only: `worktree remove` refuses dirty, `branch -d`
-# refuses unmerged. Unmerged/dirty worktrees are listed, never touched.
+# trunk (main; DO_BASE_REF overrides). Safe-only: `worktree remove` refuses
+# dirty, `branch -d` refuses unmerged. Unmerged/dirty worktrees are listed,
+# never touched.
 if $GC_ONLY; then
-  BASE="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"
+  BASE="${DO_BASE_REF:-main}"
+  git show-ref --verify --quiet "refs/heads/$BASE" \
+    || BASE="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"
   removed=0; kept=0
   for wt in .do-worktrees/*/; do
     [ -d "$wt" ] || continue
@@ -56,6 +69,353 @@ if $GC_ONLY; then
   exit 0
 fi
 
+# _remaining/_reap_check/_reap_watcher are defined here (ahead of the SLUG
+# requirement) so --self-test-lifecycle can exercise them without a plan.
+_remaining() {
+  # Count cycles in the Status section that are open ([ ]) or in-flight ([~]) — i.e. not [x].
+  # Pattern starts with '\[' (not '-') so grep never mistakes it for an option flag.
+  # grep -c already prints a count (0 on no match) but exits 1 then — capture it so
+  # the `|| true` swallows the exit without appending a second "0" to the output.
+  # IC3 hardened: requires the em-dash after `C<n> ` so a prose bullet like
+  # "C2's collapsed into C1" is never mistaken for a real Status-block line.
+  # `^[[:space:]]*` (zero-or-more, not one-or-more) so the --self-test-lifecycle
+  # fixture (no leading indentation) still matches.
+  local n; n=$(grep -cE '^[[:space:]]*- \[[ ~]\] \*{0,2}C[0-9]+\*{0,2} —' "$TODO" 2>/dev/null) || true
+  echo "${n:-0}"
+}
+
+# The PLAN cycle this iteration is about to build — the first open C<n> in the Status
+# block, same lines _remaining counts. Every emission keys on this, never on the loop
+# ordinal `$i`: `i` restarts at 0 on a resume, so a resumed run building C3 would emit
+# cycle:1, and the projection's run key `do:<slug>:c1` would silently append C3's trace
+# to C1's closed run (text/do-as-workflow.md). Falls back to the caller's ordinal when
+# the todo carries no Status block.
+_plan_cycle() {
+  local n; n=$(grep -oE '^[[:space:]]*- \[[ ~]\] \*{0,2}C[0-9]+\*{0,2} —' "$TODO" 2>/dev/null | grep -oE 'C[0-9]+' | head -1 | tr -d 'C') || true
+  echo "${n:-${1:-0}}"
+}
+
+# IC3: keep the Status-block checkbox in sync with each cycle's own wave checkboxes —
+# a cycle is done iff its `## C<n>` section has zero remaining `- [ ] W` lines.
+# POSIX-portable (no gawk-only 3-arg match()) — works with BSD awk/sed (macOS) and GNU.
+_sync_status() {
+  local todo="$1"
+  [ -f "$todo" ] || return 0
+  local total_lines
+  total_lines=$(wc -l < "$todo" 2>/dev/null | tr -d ' ') || return 0
+  # Line numbers of every `## C<n>` header (cycle-section starts) and every
+  # `## ` header (section starts in general, used to find where a cycle ends).
+  local cid_lines
+  cid_lines=$(grep -nE '^## C[0-9]+' "$todo" 2>/dev/null) || true
+  [ -z "$cid_lines" ] && return 0
+  local all_hdr_lines
+  all_hdr_lines=$(grep -nE '^## ' "$todo" 2>/dev/null) || true
+  local entry cid start_line end_line section
+  while IFS= read -r entry; do
+    [ -z "$entry" ] && continue
+    start_line="${entry%%:*}"
+    cid=$(sed -E 's/^[0-9]+:## (C[0-9]+).*/\1/' <<<"$entry")
+    # End line = line number of the next header strictly after start_line, minus 1;
+    # if none, end of file.
+    end_line=$(awk -F: -v s="$start_line" '$1 > s {print $1; exit}' <<<"$all_hdr_lines")
+    if [ -z "$end_line" ]; then
+      end_line="$total_lines"
+    else
+      end_line=$((end_line - 1))
+    fi
+    section=$(sed -n "$((start_line + 1)),${end_line}p" "$todo" 2>/dev/null)
+    if ! printf '%s\n' "$section" | grep -qE '^[[:space:]]*- \[ \] W'; then
+      # No open wave line left in this cycle's section — flip the Status-block
+      # line for this cid from [ ]/[~] to [x] if not already ticked.
+      sed -i.bak -E "s/^([[:space:]]*- \\[)[ ~](\\] \\*{0,2}${cid}\\*{0,2} —)/\\1x\\2/" "$todo" 2>/dev/null || true
+      rm -f "${todo}.bak"
+    fi
+  done <<<"$cid_lines"
+}
+
+# IC2: reap a lingering conductor whose close-commit already landed. Split into
+# a pure decision (_reap_check, unit-testable) and the polling loop (_reap_watcher).
+_reap_check() {
+  local cur_sha="$1" iter_sha="$2" cur_remaining="$3" iter_remaining="$4"
+  [ -n "$cur_sha" ] && [ "$cur_sha" != "$iter_sha" ] && [ "$cur_remaining" -lt "$iter_remaining" ]
+}
+
+# interval/grace default to 60s/120s in production; --self-test-lifecycle passes
+# 1s/1s so the fixture doesn't block on real wall-clock time.
+_reap_watcher() {
+  local wt="$1" cond_pid="$2" iter_sha="$3" iter_remaining="$4"
+  local interval="${5:-60}" grace="${6:-120}"
+  # Iteration cap (backstop): the CONDUCTOR_TIMEOUT watchdog is what actually
+  # bounds this loop in production (it kills cond_pid, so `kill -0` fails and
+  # the while exits) — this cap only guards against a logic regression turning
+  # the loop infinite, at production defaults that's ~24h, harmless.
+  local max_iters=1440 n=0
+  while kill -0 "$cond_pid" 2>/dev/null; do
+    n=$((n + 1)); [ "$n" -gt "$max_iters" ] && return 1
+    sleep "$interval"
+    kill -0 "$cond_pid" 2>/dev/null || break
+    local cur_sha cur_remaining
+    cur_sha=$(git -C "$wt" rev-parse HEAD 2>/dev/null || echo "")
+    cur_remaining=$(_remaining)
+    if _reap_check "$cur_sha" "$iter_sha" "$cur_remaining" "$iter_remaining"; then
+      echo "[do-auto] reap watcher: close-commit detected (HEAD moved, remaining ${iter_remaining}→${cur_remaining}) — grace ${grace}s" >&2
+      sleep "$grace"
+      if kill -0 "$cond_pid" 2>/dev/null; then
+        kill -TERM "$cond_pid" 2>/dev/null || true
+        echo "[do-auto] reaped conductor — close-commit detected" >&2
+      fi
+      return 0
+    fi
+  done
+}
+
+# IC1: JSON sentinel — {"pid":N,"port":N,"iteration":N,"started_at":"<iso>"}.
+# Port is derived deterministically from the slug so a self-started dev server
+# (do-ui-gate.sh, C5) and the sentinel agree without a coordination file.
+_sentinel_port() {
+  echo $(( 4400 + $(cksum <<<"$1" | cut -d' ' -f1) % 100 ))
+}
+_write_sentinel() {
+  local path="$1" pid="$2" iteration="$3" slug="$4"
+  printf '{"pid":%d,"port":%d,"iteration":%d,"started_at":"%s"}\n' \
+    "$pid" "$(_sentinel_port "$slug")" "$iteration" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$path"
+}
+
+# --self-test-daemon: prove the liveness guard can go RED. A guard that only ever
+# reports success is the bug it is meant to prevent (this one shipped as
+# `ps aux | grep -c do-auto.sh`, which reported a loop that had already died).
+# True when this conductor run looks like "the API was unreachable": it died fast
+# AND its output carries a transport error. Pure so --self-test-daemon can prove
+# both verdicts — the guard that burned 30 iterations shipped untested.
+_netfail_run() {
+  local cond_secs="$1" logfile="$2"
+  [ "${cond_secs:-999}" -lt 90 ] || return 1
+  [ -f "$logfile" ] || return 1
+  tail -c 2000 "$logfile" 2>/dev/null \
+    | grep -qE 'Unable to connect to API|ENOTFOUND|ECONNREFUSED|getaddrinfo' || return 1
+  return 0
+}
+
+# The HEAD of the last commit that touched something OTHER than loop bookkeeping.
+# Plain HEAD is not a progress signal: a conductor that dies instantly still gets a
+# commit, because .do-conductor.out (the heartbeat log) and todo.md's timestamp are
+# inside the worktree. On 2026-08-07 that turned a 2-iteration stall halt into a
+# 30-iteration burn — 28 subprocesses, each dying on ENOTFOUND, each committing one
+# line of error text that the stall guard scored as work.
+_substantive_head() {
+  local wt="$1" sha
+  for sha in $(git -C "$wt" log --format=%H -200 2>/dev/null); do
+    if git -C "$wt" show --name-only --format= "$sha" 2>/dev/null \
+       | grep -qvE '^(\.do-|\.w[0-9]|todo\.md$|$)'; then
+      echo "$sha"; return 0
+    fi
+  done
+  echo ""
+}
+
+# Stalled ONLY if nothing moved on ANY axis we can observe. Cycle checkboxes are
+# too coarse to be the sole signal: a wide cycle (blocks C4) commits real work for
+# an hour — 97 registrations archived, three commits — while its cycle box stays
+# open until W4 closes it, so a box-only guard halts a run that is plainly working.
+# Returns 0 (true, stalled) only when the box count AND the branch head are both
+# unchanged from the previous iteration.
+_stall_check() {
+  local remaining="$1" prev_remaining="$2" head="$3" prev_head="$4"
+  [ "$remaining" -eq "$prev_remaining" ] || return 1
+  [ -n "$prev_head" ] && [ "$head" != "$prev_head" ] && return 1
+  return 0
+}
+
+if ${SELF_TEST_DAEMON:-false}; then
+  rc=0
+  _t=$(mktemp -d); _self="$(cd "$(dirname "$0")" && pwd)/$(basename "$0")"
+  cd "$_t" || exit 1
+  mkdir -p text .do-worktrees
+
+  # 1. --status on a slug with no loop and open cycles must say NOT RUNNING (exit 3).
+  printf -- '- [ ] C1 — nothing\n' > text/ghost-todo.md
+  st=0; out=$(bash "$_self" ghost --status 2>&1) || st=$?
+  if [ "$st" -eq 3 ] && grep -q "NOT RUNNING" <<<"$out"; then
+    echo "[self-test-daemon] PASS: absent loop reports NOT RUNNING (exit 3)"
+  else
+    echo "[self-test-daemon] FAIL: absent loop reported '$out' (exit $st, wanted 3)" >&2; rc=1
+  fi
+
+  # 2. A loop that dies on startup must make --daemon exit NON-ZERO. This is the
+  #    regression: `nohup setsid ...` died instantly and the launch read as success.
+  #    No text/<slug>-todo.md → the child exits 1 → the owner file never appears.
+  st=0; out=$(DO_DAEMON_LOG="$_t/d.log" bash "$_self" nosuchplan --daemon 2>&1) || st=$?
+  if [ "$st" -ne 0 ] && grep -q "is NOT running" <<<"$out"; then
+    echo "[self-test-daemon] PASS: a dead launch fails loud (exit $st)"
+  else
+    echo "[self-test-daemon] FAIL: dead launch reported '$out' (exit $st, wanted non-zero)" >&2; rc=1
+  fi
+
+  # 3. A live owner file must read RUNNING — the guard is not merely always-red.
+  mkdir -p .do-worktrees/alive
+  printf '{"pid":%d,"slug":"alive","started_at":"now"}\n' $$ > .do-worktrees/alive/.do-loop-owner
+  printf -- '- [ ] C1 — nothing\n' > text/alive-todo.md
+  st=0; out=$(bash "$_self" alive --status 2>&1) || st=$?
+  if [ "$st" -eq 0 ] && grep -q "RUNNING" <<<"$out"; then
+    echo "[self-test-daemon] PASS: a live loop reports RUNNING (exit 0)"
+  else
+    echo "[self-test-daemon] FAIL: live loop reported '$out' (exit $st, wanted 0)" >&2; rc=1
+  fi
+
+  # 4. the stall decision itself: a committing cycle is NOT stalled.
+  if _stall_check 6 6 "sha1" "sha1"; then
+    echo "[self-test-daemon] PASS: no boxes + no commits = stalled"
+  else
+    echo "[self-test-daemon] FAIL: flat state should count as stalled" >&2; rc=1
+  fi
+  if _stall_check 6 6 "sha2" "sha1"; then
+    echo "[self-test-daemon] FAIL: a new commit must clear the stall" >&2; rc=1
+  else
+    echo "[self-test-daemon] PASS: same boxes but a new commit = progress"
+  fi
+  if _stall_check 5 6 "sha1" "sha1"; then
+    echo "[self-test-daemon] FAIL: a ticked cycle must clear the stall" >&2; rc=1
+  else
+    echo "[self-test-daemon] PASS: a closed cycle = progress"
+  fi
+
+  # 5. the connectivity verdict: fast death + transport error = unreachable API.
+  printf 'API Error: Unable to connect to API (ENOTFOUND)\n' > "$_t/net.log"
+  if _netfail_run 3 "$_t/net.log"; then
+    echo "[self-test-daemon] PASS: fast death + ENOTFOUND = unreachable"
+  else
+    echo "[self-test-daemon] FAIL: should have flagged an unreachable API" >&2; rc=1
+  fi
+  if _netfail_run 4000 "$_t/net.log"; then
+    echo "[self-test-daemon] FAIL: a long run is not a connectivity failure" >&2; rc=1
+  else
+    echo "[self-test-daemon] PASS: a long run is never scored unreachable"
+  fi
+  printf 'W4 verify failed: 3 tests red\n' > "$_t/work.log"
+  if _netfail_run 3 "$_t/work.log"; then
+    echo "[self-test-daemon] FAIL: a real build failure must not read as network" >&2; rc=1
+  else
+    echo "[self-test-daemon] PASS: a fast REAL failure is not a network failure"
+  fi
+
+  cd /; rm -rf "$_t"
+  [ "$rc" -eq 0 ] && echo "[self-test-daemon] all checks passed"
+  exit "$rc"
+fi
+
+if $SELF_TEST_LIFECYCLE; then
+  rc=0
+  tmp=$(mktemp -d)
+  echo "[self-test-lifecycle] stale sentinel sweep..."
+  mkdir -p "$tmp/.do-worktrees/fake-slug"
+  sfile="$tmp/.do-worktrees/fake-slug/.do-loop-running"
+  _write_sentinel "$sfile" 99999999 1 "fake-slug"
+  spid=$(jq -r '.pid // empty' "$sfile" 2>/dev/null || true)
+  if [ -n "$spid" ] && kill -0 "$spid" 2>/dev/null; then
+    echo "[self-test-lifecycle] FAIL: expected dead pid $spid to fail kill -0" >&2; rc=1
+  else
+    rm -f "$sfile"
+    if [ -f "$sfile" ]; then echo "[self-test-lifecycle] FAIL: sentinel not swept" >&2; rc=1
+    else echo "[self-test-lifecycle] PASS: stale sentinel swept"; fi
+  fi
+
+  echo "[self-test-lifecycle] reap watcher..."
+  grepo=$(mktemp -d)
+  ( cd "$grepo" && git init -q && git commit --allow-empty -q -m init )
+  iter_sha=$(git -C "$grepo" rev-parse HEAD)
+  TODO="$tmp/fake-todo.md"
+  printf -- '- [x] C1 — reap + sentinel\n- [ ] C2 — kanban sync\n' > "$TODO"
+  iter_remaining=$(_remaining)
+  sleep 300 & fake_cond=$!
+  ( cd "$grepo" && git commit --allow-empty -q -m close )
+  printf -- '- [x] C1 — reap + sentinel\n- [x] C2 — kanban sync\n' > "$TODO"
+  cur_sha=$(git -C "$grepo" rev-parse HEAD); cur_remaining=$(_remaining)
+  if _reap_check "$cur_sha" "$iter_sha" "$cur_remaining" "$iter_remaining"; then
+    echo "[self-test-lifecycle] PASS: reap check fires on close-commit"
+  else
+    echo "[self-test-lifecycle] FAIL: reap check should fire" >&2; rc=1
+  fi
+  _reap_watcher "$grepo" "$fake_cond" "$iter_sha" "$iter_remaining" 1 1
+  sleep 1
+  if kill -0 "$fake_cond" 2>/dev/null; then
+    echo "[self-test-lifecycle] FAIL: fake conductor not reaped" >&2; rc=1; kill -KILL "$fake_cond" 2>/dev/null || true
+  else
+    echo "[self-test-lifecycle] PASS: fake conductor reaped"
+  fi
+
+  rm -rf "$tmp" "$grepo"
+  [ "$rc" -eq 0 ] && echo "[self-test-lifecycle] all checks passed"
+  exit "$rc"
+fi
+
+if $SELF_TEST_KANBAN; then
+  rc=0
+  tmp=$(mktemp -d)
+  TODO="$tmp/fake-todo.md"
+  cat > "$TODO" <<'EOF'
+## Status
+
+Batch 1
+  - [x] C1 — reap + sentinel (do-auto lifecycle)     state: done
+    - [x] W1 · W2 · W3 · W4
+
+Batch 2
+  - [ ] C2 — kanban sync + do-engine pick            state: blocked-on-C1
+    - [ ] W1 · W2 · W3 · W4
+
+Prose note: C2's collapsed into C1 because both touch the same file — not a real Status line.
+
+## C1 — reap + sentinel
+some text, no open wave boxes here
+
+## C2 — kanban sync + do-engine pick
+- [ ] W1 · W2 · W3 · W4
+EOF
+  before=$(_remaining)
+  # Now tick C2's wave line to simulate it finishing, then sync should flip Status too
+  sed -i.bak 's/^- \[ \] W1/- [x] W1/' "$TODO" && rm -f "$TODO.bak"
+  _sync_status "$TODO"
+  after=$(_remaining)
+  if grep -qE '^\s*- \[x\] C2 —' "$TODO"; then
+    echo "[self-test-kanban] PASS: Status line auto-ticked for C2"
+  else
+    echo "[self-test-kanban] FAIL: C2 Status line not ticked" >&2; rc=1
+  fi
+  if [ "$before" -eq 1 ] && [ "$after" -eq 0 ]; then
+    echo "[self-test-kanban] PASS: count correct before=$before after=$after"
+  else
+    echo "[self-test-kanban] FAIL: count wrong before=$before after=$after (expected 1,0)" >&2; rc=1
+  fi
+  # _plan_cycle: the run key must name the PLAN cycle, not the loop ordinal. C1 is
+  # already ticked here, so a resumed run (loop ordinal 1) building C2 must emit 2 —
+  # emitting 1 would append C2's trace to C1's closed run (text/do-as-workflow.md).
+  cat > "$TODO" <<'EOF'
+## Status
+
+Batch 1
+  - [x] C1 — done                                    state: done
+    - [x] W1 · W2 · W3 · W4
+  - [ ] C2 — next                                    state: ready
+    - [ ] W1 · W2 · W3 · W4
+EOF
+  pc=$(_plan_cycle 1)
+  if [ "$pc" = "2" ]; then
+    echo "[self-test-kanban] PASS: _plan_cycle resolves the open cycle (2), not the loop ordinal (1)"
+  else
+    echo "[self-test-kanban] FAIL: _plan_cycle=$pc (expected 2)" >&2; rc=1
+  fi
+  : > "$TODO"   # no Status block at all → fall back to the caller's ordinal
+  pc=$(_plan_cycle 7)
+  if [ "$pc" = "7" ]; then
+    echo "[self-test-kanban] PASS: _plan_cycle falls back to the ordinal with no Status block"
+  else
+    echo "[self-test-kanban] FAIL: _plan_cycle fallback=$pc (expected 7)" >&2; rc=1
+  fi
+  rm -rf "$tmp"
+  [ "$rc" -eq 0 ] && echo "[self-test-kanban] all checks passed"
+  exit "$rc"
+fi
+
 [ -z "$SLUG" ] && { echo "usage: do-auto.sh <slug> [--max-cycles N] [--dry-run] | do-auto.sh --gc" >&2; exit 1; }
 
 # Validate slug is safe (kebab-case only) before it touches any shell string.
@@ -64,13 +424,92 @@ if ! printf '%s' "$SLUG" | grep -qE '^[a-zA-Z0-9][a-zA-Z0-9_-]*$'; then
   echo "[do-auto] unsafe slug (must be alphanumeric + hyphens/underscores): $SLUG" >&2; exit 1
 fi
 
+# ── Liveness is READ, never inferred ──────────────────────────────────────────
+# The loop owns `.do-loop-owner` for its whole life (pid = this script's own $$,
+# removed by an EXIT trap). The older `.do-loop-running` sentinel tracks the
+# CONDUCTOR of the current iteration, so it is legitimately absent between
+# iterations — reading it to answer "is the loop up?" reports a false DEAD.
+#
+# WHY THIS EXISTS: a launch was reported as running when it had died instantly
+# (`nohup setsid ...` — setsid does not exist on macOS). The check used was
+# `ps aux | grep -c do-auto.sh`, which cannot go red: it counts its own shell,
+# a stale match, or nothing, and every outcome reads as plausible. A check that
+# cannot fail is not a check. Liveness now has exactly one answer, and the only
+# supported way to start a detached loop (--daemon) refuses to return success
+# until it has SEEN that answer say RUNNING.
+_owner_file() { echo ".do-worktrees/${1}/.do-loop-owner"; }
+
+_loop_pid() {
+  local f; f=$(_owner_file "$1")
+  [ -f "$f" ] || return 1
+  local pid; pid=$(jq -r '.pid // empty' "$f" 2>/dev/null || true)
+  [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null || return 1
+  echo "$pid"
+}
+
+if $STATUS_ONLY; then
+  [ -n "$SLUG" ] || { echo "usage: do-auto.sh <slug> --status" >&2; exit 1; }
+  TODO="text/${SLUG}-todo.md"
+  wt=".do-worktrees/${SLUG}"
+  [ -f "$wt/text/${SLUG}-todo.md" ] && TODO="$wt/text/${SLUG}-todo.md"
+  rem=$(_remaining)
+  if pid=$(_loop_pid "$SLUG"); then
+    f=$(_owner_file "$SLUG")
+    echo "[do-auto] RUNNING — slug=$SLUG pid=$pid started=$(jq -r '.started_at // "?"' "$f" 2>/dev/null) cycles-remaining=$rem"
+    exit 0
+  fi
+  if [ "$rem" -eq 0 ] && [ -f "$TODO" ]; then
+    echo "[do-auto] COMPLETE — slug=$SLUG no open cycles"
+    exit 4
+  fi
+  echo "[do-auto] NOT RUNNING — slug=$SLUG cycles-remaining=$rem"
+  exit 3
+fi
+
+if $DAEMON; then
+  [ -n "$SLUG" ] || { echo "usage: do-auto.sh <slug> --daemon" >&2; exit 1; }
+  if pid=$(_loop_pid "$SLUG"); then
+    echo "[do-auto] already running for $SLUG (pid $pid) — not starting a second loop" >&2
+    exit 0
+  fi
+  log="${DO_DAEMON_LOG:-.do-worktrees/${SLUG}.loop.log}"
+  mkdir -p "$(dirname "$log")" 2>/dev/null || true
+  # Portable detach: nohup + background + disown. NO setsid — it is Linux-only and
+  # its absence is precisely the silent death this guard exists to catch.
+  nohup "$0" "$SLUG" ${MAX_CYCLES:+--max-cycles "$MAX_CYCLES"} > "$log" 2>&1 < /dev/null &
+  child=$!
+  disown "$child" 2>/dev/null || true
+  # Do not trust the fork. Wait until the loop PUBLISHES liveness, or fail loud.
+  for _ in $(seq 1 60); do
+    if _loop_pid "$SLUG" >/dev/null; then
+      echo "[do-auto] daemon up — slug=$SLUG pid=$(_loop_pid "$SLUG") log=$log"
+      echo "[do-auto]   check: bash .claude/scripts/do-auto.sh $SLUG --status"
+      exit 0
+    fi
+    kill -0 "$child" 2>/dev/null || break
+    sleep 1
+  done
+  echo "[do-auto] FATAL: daemon did not come up for $SLUG — the loop is NOT running." >&2
+  echo "[do-auto]   log tail: $(tail -c 600 "$log" 2>/dev/null | tr '\n' ' ')" >&2
+  exit 1
+fi
+
 # Recursion guard: the conductor subprocess runs `/do <slug> --next-cycle` inside
 # the worktree. A buggy conductor may call do-auto.sh again despite the --next-cycle
-# flag. If our sentinel file exists, we're already inside a parent loop — exit cleanly.
+# flag. If our JSON sentinel exists AND its pid is alive, we're already inside a
+# parent loop — exit cleanly. A dead pid means a prior run crashed without
+# cleanup (kill -9, machine sleep) — self-heal by sweeping it instead of wedging
+# every future invocation forever.
 _sentinel=".do-worktrees/${SLUG}/.do-loop-running"
 if [ -f "$_sentinel" ]; then
-  echo "[do-auto] recursion guard: parent loop already running for $SLUG — exiting" >&2
-  exit 0
+  _sentinel_pid=$(jq -r '.pid // empty' "$_sentinel" 2>/dev/null || true)
+  if [ -n "$_sentinel_pid" ] && kill -0 "$_sentinel_pid" 2>/dev/null; then
+    echo "[do-auto] recursion guard: parent loop already running for $SLUG (pid $_sentinel_pid) — exiting" >&2
+    exit 0
+  else
+    echo "[do-auto] swept stale sentinel (pid ${_sentinel_pid:-unknown} dead)" >&2
+    rm -f "$_sentinel"
+  fi
 fi
 
 # Trust boundary: this script runs in the developer's own workspace, invoked by /do
@@ -99,13 +538,35 @@ CONDUCTOR_EFFORT="${DO_CONDUCTOR_EFFORT:-medium}"
 
 # Per-iteration hang guard: `claude -p` has no built-in wall-clock limit, and the
 # stall guard only fires BETWEEN iterations — a conductor that truly hangs would
-# block the loop forever. Cap each iteration; on overrun, terminate the conductor
-# so the iteration ends, ticks no box, and the stall guard takes over. Generous by
-# default (a healthy batch of 3 cycles runs ~20-25 min); override via env.
+# block the loop forever.
+#
+# F11 (2026-07-23): the guard is PROGRESS-BASED, not wall-clock. The old fixed
+# `sleep CONDUCTOR_TIMEOUT` killed live-but-slow COMPLEX/UI cycles mid-edit (done-ui:
+# a healthy cycle was murdered at 900s while actively editing). Now the watchdog
+# polls the worktree for SILENCE — it resets whenever the conductor writes anything
+# (new/edited files, growing diffs, a commit) and kills only after DO_IDLE_SECS of
+# NO change, with an absolute DO_HARD_CAP backstop against a pathological write-loop.
+# DO_CONDUCTOR_TIMEOUT is retained as the default hard-cap for back-compat.
 CONDUCTOR_TIMEOUT="${DO_CONDUCTOR_TIMEOUT:-2400}"
+# 60 min of TOTAL silence = hung. Not 10, and not 30 — both were measured too
+# tight on blocks C4 (killed at 603s, then at 1922s, both times mid-real-work): an apex W2 (Opus/Fable deciding a wide
+# cut — blocks C4 reasons over 376 registrations) legitimately spends 10-25 min
+# inside a single Agent spawn, writing nothing and printing nothing. At 600s the
+# guard killed a working conductor every iteration and the run could never finish
+# that cycle. HARD_CAP (3x CONDUCTOR_TIMEOUT, default 7200s) remains the backstop
+# against a genuinely wedged conductor, so raising this loses no real protection.
+IDLE_SECS="${DO_IDLE_SECS:-3600}"
+HARD_CAP="${DO_HARD_CAP:-$(( CONDUCTOR_TIMEOUT > 0 ? CONDUCTOR_TIMEOUT * 3 : 7200 ))}"  # absolute backstop
+POLL_SECS="${DO_POLL_SECS:-30}"
 
-# W1/W4 scripts (w1-recon.ts, w4-rubric.ts) always exit 2 and defer to agent
-# spawns through the Claude Code session (Claude Max subscription path).
+# W1/W4 scripts (w1-recon.ts, w4-rubric.ts) exit 2 and defer to agent spawns
+# through the Claude Code session (Claude Max subscription path) ONLY when no
+# OPENROUTER_API_KEY resolves. With a key present — and one is present in
+# one.ie/web/.env, which both scripts fall back to — they call OpenRouter and
+# exit 0/1 with a REAL verdict. "Always defers" was wrong and hid that
+# w4-rubric.ts gates for real: its exit 1 fails a wave without any agent
+# adjudicating. Note its number is the TASK rubric (no goal-fit); the cycle gate
+# is W4's own, per .claude/scripts/rubric-weights.json.
 
 # ── Worktree isolation (one per plan) ────────────────────────────────────────
 # The loop's existence IS the trigger: do-auto only runs for multi-cycle plans
@@ -121,10 +582,36 @@ CONDUCTOR_TIMEOUT="${DO_CONDUCTOR_TIMEOUT:-2400}"
 #        └─ do/<slug>  (worktree .do-worktrees/<slug>) ── every cycle commits here
 #   plan complete → report `git merge do/<slug>`  (human lands it — never auto)
 #   halt          → worktree persists → re-run /do <slug> resumes in place
-BASE="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"
+#
+# BASE is pinned to main, not HEAD: a shared tree parked on someone's feature
+# branch would otherwise seed every new do/<slug> with that branch's commits
+# (plans cross-contaminating across concurrent sessions, 2026-07-21).
+# DO_BASE_REF overrides for a deliberate stack on another branch.
+BASE="${DO_BASE_REF:-main}"
+git show-ref --verify --quiet "refs/heads/$BASE" \
+  || BASE="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"
 BR="do/${SLUG}"
 WT=".do-worktrees/${SLUG}"
 
+# Publish liveness the moment the worktree path is known, and retract it on ANY
+# exit (clean, halt, kill, crash). This file — not `ps | grep` — is the single
+# answer to "is the loop running?", and --daemon blocks until it appears.
+_OWNER="$WT/.do-loop-owner"
+_publish_owner() {
+  mkdir -p "$WT" 2>/dev/null || true
+  printf '{"pid":%d,"slug":"%s","started_at":"%s"}\n' \
+    "$$" "$SLUG" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$_OWNER" 2>/dev/null || true
+}
+_retract_owner() {
+  [ -f "$_OWNER" ] || return 0
+  local own; own=$(jq -r '.pid // empty' "$_OWNER" 2>/dev/null || true)
+  [ "$own" = "$$" ] && rm -f "$_OWNER"
+}
+if ! $SETUP_ONLY && ! $DRY_RUN; then
+  _publish_owner
+  trap _retract_owner EXIT INT TERM
+fi
+
 # Symlink node_modules + built SDK dist into the worktree. A git worktree omits
 # gitignored dirs (node_modules), so without this a worktree can't typecheck, run
 # vitest, or build — the kill-switch would fail for lack of deps, not lack of code.
@@ -133,8 +620,33 @@ WT=".do-worktrees/${SLUG}"
 _link_deps() {
   local wt="$1" root nm
   root="$(git rev-parse --show-toplevel 2>/dev/null)" || return 0
+  # pay/backend + channels are here because one.ie/web's OWN vitest suite reaches
+  # across into them (tests/e2e/wallets-refined.test.ts imports
+  # pay/backend/src/protocol, tests/unit/chat-block-tool-filter.test.ts imports
+  # channels/src/agents/builder). Without their node_modules those two suites fail
+  # to COLLECT — zero tests run, vitest exits 1 — so `bun run verify` in a worktree
+  # went red for a missing dep rather than a real fault (measured 2026-08-04).
+  # .env belongs in this list for exactly the reason node_modules does: it is
+  # gitignored, so a worktree never gets one, and the suites that need credentials
+  # then fail for lack of a KEY rather than lack of correct code. Measured
+  # 2026-08-31: two independent W4 verifiers both reported
+  # `fixture write failed (status=0 error=no_gateway_key)` across 4-7 real-TypeDB
+  # test files and had to hand-classify them as environmental — noise that makes a
+  # verifier argue with its own gate. Symlinked, never copied: one file of truth,
+  # and a rotated key is picked up by every live worktree at once.
+  #
+  # The credential file honours ONE_ENV_FILE (DO_ENV_FILE is the accepted
+  # alias), like every other credential-reading script in the harness —
+  # factory-repo.sh --check-env-indirection is the gate. A RELATIVE
+  # ONE_ENV_FILE is linked at the same relative path inside the worktree; an
+  # ABSOLUTE one is reachable from anywhere already and needs no link.
+  local env_file="${ONE_ENV_FILE:-${DO_ENV_FILE:-one.ie/web/.env}}"
+  local env_links="pay/backend/.env channels/.env"
+  case "$env_file" in /*) ;; *) env_links="$env_file $env_links" ;; esac
   for nm in node_modules one.ie/web/node_modules packages/node_modules \
-            packages/sdk/dist packages/sdk/node_modules; do
+            packages/sdk/dist packages/sdk/node_modules \
+            pay/backend/node_modules channels/node_modules \
+            $env_links; do
     if [ -e "$root/$nm" ] && [ ! -e "$wt/$nm" ]; then
       mkdir -p "$wt/$(dirname "$nm")"
       ln -s "$root/$nm" "$wt/$nm" 2>/dev/null && echo "[do-auto] linked $nm" || true
@@ -142,18 +654,80 @@ _link_deps() {
   done
 }
 
+# Is $WT a REAL linked worktree, or just a directory that happens to sit inside
+# the repo? `rev-parse --git-dir` cannot tell you: run from any plain directory
+# under the repo root it walks UP, finds the main tree's .git, and exits 0 —
+# verified 2026-08-02, `mkdir .do-worktrees/x && git -C .do-worktrees/x
+# rev-parse --git-dir` prints the MAIN /Users/toc/Server/one-ie/.git.
+#
+# That is not academic. do-orchestrate.sh used to `mkdir -p` the worktree path so
+# it could redirect a log into it BEFORE calling do-auto; this probe then said
+# "resuming worktree", `git worktree add` never ran, and every later
+# `git -C "$WT" commit` targeted the MAIN TREE'S HEAD — where _safe_stage
+# correctly refuses to stage. Orchestrated cycles committed nothing, silently.
+#
+# --show-toplevel is the discriminator: from a real worktree it returns that
+# worktree's own root; from a plain subdirectory it returns the main tree's root.
+# Compare it against the resolved path and the two cases separate cleanly.
+_is_worktree() {
+  local wt="$1" abs top
+  abs="$(cd "$wt" 2>/dev/null && pwd -P)" || return 1
+  [ -n "$abs" ] || return 1
+  top="$(git -C "$wt" rev-parse --show-toplevel 2>/dev/null)" || return 1
+  [ "$top" = "$abs" ]
+}
+
 _setup_worktree() {
   # Idempotent: reuse an existing worktree (resume), else attach one to an
   # existing branch (prior halt), else create branch+worktree fresh from HEAD.
-  if git -C "$WT" rev-parse --git-dir >/dev/null 2>&1; then
+  #
+  # A pre-existing PLAIN directory at $WT is fatal, not recoverable: `git
+  # worktree add` refuses a non-empty path, and silently proceeding is the bug
+  # documented above. Empty is fine — git accepts an existing empty dir — so
+  # clear that case and fail loudly on anything else.
+  if [ -d "$WT" ] && ! _is_worktree "$WT"; then
+    # OUR OWN liveness file is not foreign content. _publish_owner() runs long
+    # before this (it fires the moment $WT is known, so --daemon can block on
+    # it) and it `mkdir -p "$WT"` + writes .do-loop-owner. On a slug whose
+    # worktree does not exist yet, that left a plain directory holding exactly
+    # one file — ours — so the rmdir below failed and every NEW slug FATALed
+    # here. The file is deleted again on exit, so the directory read as empty
+    # to anyone who looked afterwards, which is what made this hard to see.
+    # Drop it, then re-publish after `git worktree add` succeeds.
+    rm -f "$WT/.do-loop-owner"
+    rmdir "$WT" 2>/dev/null || {
+      echo "[do-auto] FATAL: $WT exists but is not a git worktree, and is not empty." >&2
+      echo "[do-auto]   Commits there would land on the MAIN tree's HEAD. Refusing." >&2
+      echo "[do-auto]   Inspect it, then: rm -rf '$WT' && git worktree prune" >&2
+      return 1
+    }
+    echo "[do-auto] cleared empty non-worktree dir at $WT"
+  fi
+
+  if _is_worktree "$WT"; then
     echo "[do-auto] resuming worktree $WT on $BR"
-  elif git show-ref --verify --quiet "refs/heads/$BR"; then
-    echo "[do-auto] re-attaching worktree $WT to existing branch $BR"
-    git worktree add "$WT" "$BR" >/dev/null
   else
-    echo "[do-auto] creating worktree $WT on new branch $BR (from $BASE)"
-    git worktree add -b "$BR" "$WT" HEAD >/dev/null
+    # Both add-paths below fail with "already registered" if a previous run left
+    # a stale entry in .git/worktrees/<slug> — the directory deleted by hand but
+    # never deregistered. prune drops ONLY registrations whose working dir is
+    # gone, so it can never touch a live worktree; do-orchestrate.sh:178 already
+    # relies on that. Needed here because the clear-empty-dir branch above now
+    # routes more cases into `git worktree add` than the old probe ever did.
+    git worktree prune 2>/dev/null || true
+
+    if git show-ref --verify --quiet "refs/heads/$BR"; then
+      echo "[do-auto] re-attaching worktree $WT to existing branch $BR"
+      git worktree add "$WT" "$BR" >/dev/null
+    else
+      echo "[do-auto] creating worktree $WT on new branch $BR (from $BASE)"
+      git worktree add -b "$BR" "$WT" "$BASE" >/dev/null
+    fi
   fi
+
+  # Re-publish liveness: the clear-empty-dir branch above deletes our owner file
+  # so `git worktree add` sees an empty path. Without this, a fresh slug runs
+  # with no liveness file and `--status` reports it dead while it is building.
+  _publish_owner
   _link_deps "$WT"
 
   # Carry the plan's own artifacts into the worktree. The spine walk may have
@@ -263,19 +837,26 @@ if ! $DRY_RUN; then
   # All loop state now lives in the worktree — read the boxes the subprocess ticks.
   TODO="$WT/text/${SLUG}-todo.md"
   TRUST="$WT/.do-trust.json"
+  # Plan arm (tasks-do C1): file the origin substrate task once per plan — a
+  # worktree-local sentinel (persists across a resumed loop on the same branch)
+  # keeps a re-run from re-creating it.
+  if [ ! -f "$WT/.task-created" ]; then
+    _title=$(grep -m1 '^title:' "$TODO" 2>/dev/null | sed 's/^title:[[:space:]]*//' | tr -d '"' || true)
+    bash "$(dirname "$0")/do-signal.sh" --task-create "$SLUG" "${_title:-$SLUG}" "tags=do:cycle" >/dev/null 2>&1 || true
+    # ...and one task PER CYCLE, so the substrate holds the whole plan rather than
+    # a single row standing in for it. Measured 2026-09-01: lifecycle carries 10
+    # cycles and 13 deliverables; exactly ONE task reached the substrate, which is
+    # why `signal_tasks_cycle` had zero callers (the tasks it sets status on did
+    # not exist) and why do-next.sh re-derives readiness from markdown checkboxes.
+    bash "$(dirname "$0")/do-signal.sh" --task-plan "$SLUG" >/dev/null 2>&1 || true
+    touch "$WT/.task-created"
+  fi
 else
   TODO="text/${SLUG}-todo.md"
   TRUST=".do-trust.json"
 fi
 
-_remaining() {
-  # Count cycles in the Status section that are open ([ ]) or in-flight ([~]) — i.e. not [x].
-  # Pattern starts with '\[' (not '-') so grep never mistakes it for an option flag.
-  # grep -c already prints a count (0 on no match) but exits 1 then — capture it so
-  # the `|| true` swallows the exit without appending a second "0" to the output.
-  local n; n=$(grep -cE '\[[ ~]\] C[0-9]+' "$TODO" 2>/dev/null) || true
-  echo "${n:-0}"
-}
+# _remaining() is defined earlier (ahead of the SLUG check, for --self-test-lifecycle).
 
 _trust() {
   jq -r '.level // "standard"' "$TRUST" 2>/dev/null || echo "standard"
@@ -286,8 +867,16 @@ _tier() {
 }
 
 # Emit a world:do-event signal at a cycle boundary. Fire-and-forget — never blocks the loop.
+# stderr is NOT swallowed: do-signal's dark-cycle guard writes there, and a worktree
+# that emits nothing must say so rather than looking like a cycle that never ran.
 _signal() {
-  bash "$(dirname "$0")/do-signal.sh" "$@" 2>/dev/null || true
+  bash "$(dirname "$0")/do-signal.sh" "$@" || true
+}
+
+# Which wave checkboxes are ticked right now — the same `- [x] W` lines _sync_status
+# reads. Used as the wave-trace fallback when the conductor appended no census lines.
+_waves_ticked() {
+  grep -oE '^[[:space:]]*- \[x\] W[0-9]' "$1" 2>/dev/null | grep -oE 'W[0-9]' | sort -u | tr '\n' ' ' || true
 }
 
 _plan_done() {
@@ -355,8 +944,8 @@ _merge_digest() {
   # we threw away). Pure git + jq: cycles closed, diffstat, gate verdict, open items,
   # cycle commits. Written to trunk's root (.do-digest.md) where the human stands.
   local digest=".do-digest.md"
-  local cycles shortstat trust composite open mb behind
-  cycles=$(grep -cE '\[[xX]\] C[0-9]+' "$TODO" 2>/dev/null || true); cycles=${cycles:-0}
+  local cycles shortstat trust composite open mb behind agents
+  cycles=$(grep -cE '\[[xX]\] \*{0,2}C[0-9]+' "$TODO" 2>/dev/null || true); cycles=${cycles:-0}
   # Diff from the MERGE-BASE, not BASE..BR. A two-dot BASE..BR diff conflates
   # "what this branch added" with "what trunk advanced while we built" (the
   # latter shows as spurious reversions), inflating the digest. merge-base..BR
@@ -368,6 +957,11 @@ _merge_digest() {
   composite=$(jq -r '.composite // "?"' "$TRUST" 2>/dev/null || echo "?")
   open=0
   [ -f "$WT/.w4-improvements.json" ] && open=$(jq -r 'if type=="array" then length elif type=="object" then ([.[]?]|length) else 0 end' "$WT/.w4-improvements.json" 2>/dev/null || echo 0)
+  # IC7: exact agent count, not a guess — every wave agent appends a census
+  # line to $WT/.do-census.jsonl as it settles (do.md wave instructions,
+  # do-engine.js agent() wrapper); the digest just counts lines.
+  agents=0
+  [ -f "$WT/.do-census.jsonl" ] && agents=$(wc -l < "$WT/.do-census.jsonl" 2>/dev/null | tr -d ' ')
   {
     echo "# Merge digest — ${SLUG}"
     echo
@@ -378,6 +972,7 @@ _merge_digest() {
     [ "${behind:-0}" -gt 0 ] && echo "- **Trunk advanced during build:** ${behind} commit(s) — run \`git merge-tree ${BASE} ${BR}\` to confirm a clean merge before landing"
     echo "- **Gate verdict:** trust=${trust} · composite=${composite}"
     echo "- **Open improvements carried:** ${open}"
+    echo "- **Agents:** ${agents:-0}"
     echo
     echo "## Files changed (this branch only)"
     git -C "$WT" diff --stat "$mb..$BR" 2>/dev/null | sed 's/^/    /' || true
@@ -387,6 +982,34 @@ _merge_digest() {
   } > "$digest" 2>/dev/null || true
 }
 
+# --- Nested-CLI probe (fail-fast) --------------------------------------------
+# do-auto drives every cycle by spawning `claude -p` in a fresh session (line ~729).
+# In environments without a headless claude CLI / auth, those spawns die instantly
+# ("Execution error") and the loop grinds out ZERO work while LOOKING like a stall
+# (verified done-ui 2026-07-23: 3 launches, 0 cycles built, ~45min wasted). Probe
+# once, up front, and fail LOUDLY with the real cause + the Path-2 fallback instead
+# of two silent no-progress iterations. Override with DO_SKIP_CLI_PROBE=1.
+if [ "${DO_SKIP_CLI_PROBE:-0}" != "1" ] && ! $DRY_RUN; then
+  ( cd "$WT" && unset CLAUDECODE CLAUDE_CODE_CHILD_SESSION CLAUDE_CODE_SESSION_ID AI_AGENT && \
+    claude --model "$CONDUCTOR_MODEL" --dangerously-skip-permissions -p "Reply with exactly: PROBE_OK" ) >"$WT/.do-probe.out" 2>&1 &
+  _probe_pid=$!
+  ( sleep 45; kill -0 "$_probe_pid" 2>/dev/null && { pkill -f "PROBE_OK" 2>/dev/null || true; kill -TERM "$_probe_pid" 2>/dev/null || true; } ) &
+  _probe_wd=$!
+  wait "$_probe_pid" 2>/dev/null || true
+  kill "$_probe_wd" 2>/dev/null || true
+  if ! grep -q "PROBE_OK" "$WT/.do-probe.out" 2>/dev/null; then
+    echo "[do-auto] FATAL: nested \`claude -p\` cannot run in this environment — the conductor would build zero work." >&2
+    echo "[do-auto]   probe said: $(head -c 200 "$WT/.do-probe.out" 2>/dev/null | tr '\n' ' ')" >&2
+    echo "[do-auto]   Run Path 2 instead (in-process agents, no nested CLI):" >&2
+    echo "[do-auto]     Workflow({scriptPath: \".claude/workflows/do-engine.js\", args:{slug:\"$SLUG\"}})" >&2
+    rm -f "$WT/.do-probe.out"
+    _signal halt "$SLUG" "$(_tier)" 0 "reason=nested-cli-unavailable" 2>/dev/null || true
+    exit 3
+  fi
+  rm -f "$WT/.do-probe.out"
+  echo "[do-auto] nested-CLI probe: ok"
+fi
+
 i=0
 prev_remaining=-1
 stall=0
@@ -396,6 +1019,7 @@ while [ "$i" -lt "$MAX_CYCLES" ]; do
     break
   fi
 
+  _sync_status "$TODO"
   remaining=$(_remaining)
   if [ "$remaining" -eq 0 ]; then
     echo "[do-auto] no open cycles — plan complete"
@@ -404,25 +1028,45 @@ while [ "$i" -lt "$MAX_CYCLES" ]; do
 
   # Stall guard: a cycle that ticks no box means the subprocess halted/errored.
   # Retrying the identical state forever just burns subprocesses — halt after 2 stalls.
-  if [ "$remaining" -eq "$prev_remaining" ]; then
+  # Connectivity abort: a conductor that dies in seconds with a transport error
+  # built nothing and will keep building nothing until the network returns. Burning
+  # the whole --max-cycles budget on it (30 dead subprocesses, measured 2026-08-07)
+  # teaches nothing and buries the real state. Three in a row = stop and say why.
+  if _netfail_run "${_cond_secs:-999}" "$WT/.do-conductor.out"; then
+    netfail=$((${netfail:-0} + 1))
+    if [ "$netfail" -ge 3 ]; then
+      echo "[do-auto] FATAL: the conductor failed to reach the API 3 times in a row (last run ${_cond_secs}s)." >&2
+      echo "[do-auto]   This is a connectivity problem, not a plan problem — nothing was built." >&2
+      echo "[do-auto]   Check the network, then re-run: bash .claude/scripts/do-auto.sh $SLUG --daemon" >&2
+      echo "[do-auto]   WIP preserved on branch $BR (worktree $WT)." >&2
+      _signal halt "$SLUG" "$(_tier)" "$(_plan_cycle "$i")" "reason=api-unreachable" 2>/dev/null || true
+      exit 1
+    fi
+  else
+    netfail=0
+  fi
+
+  _cur_head=$(_substantive_head "$WT")
+  if _stall_check "$remaining" "$prev_remaining" "$_cur_head" "${prev_head:-}"; then
     stall=$((stall + 1))
     if [ "$stall" -ge 2 ]; then
       echo "[do-auto] no progress for 2 iterations (${remaining} cycle(s) stuck) — halting." >&2
-      echo "[do-auto] The last cycle ticked no checkbox. Inspect $TODO, fix the blocker, then re-run /do $SLUG." >&2
+      echo "[do-auto] The last cycle ticked no checkbox AND committed nothing. Inspect $TODO, fix the blocker, then re-run /do $SLUG." >&2
       echo "[do-auto] WIP preserved on branch $BR (worktree $WT)." >&2
-      _signal halt "$SLUG" "$(_tier)" "$i" "reason=stall"
+      _signal halt "$SLUG" "$(_tier)" "$(_plan_cycle "$i")" "reason=stall"
       exit 1
     fi
   else
     stall=0
   fi
+  prev_head="$_cur_head"
   prev_remaining=$remaining
 
   trust=$(_trust)
   if [ "$trust" = "cautious" ]; then
     echo "[do-auto] trust=cautious — halting. Fix the issue, then re-run /do $SLUG."
     echo "[do-auto] WIP preserved on branch $BR (worktree $WT)."
-    _signal halt "$SLUG" "$(_tier)" "$i" "reason=trust-cautious"
+    _signal halt "$SLUG" "$(_tier)" "$(_plan_cycle "$i")" "reason=trust-cautious"
     exit 1
   fi
 
@@ -457,7 +1101,19 @@ while [ "$i" -lt "$MAX_CYCLES" ]; do
   fi
 
   # Emit cycle-open signal (world:do-event type:aim) before the conductor starts.
-  _signal aim "$SLUG" "$(_tier)" "$i"
+  # One plan-cycle number for EVERY emission this iteration — resolved BEFORE the
+  # conductor runs, since the conductor ticks the cycle closed and the post-wait
+  # emissions would otherwise resolve to the NEXT cycle.
+  _cyc=$(_plan_cycle "$i")
+  _signal aim "$SLUG" "$(_tier)" "$_cyc"
+  # Lease the plan's substrate task (tasks-do C1/C5 — claim = lease, same verb
+  # do-fleet.sh checks before spawning a worktree). Asserted: a TypeDB-down or
+  # gateway miss is logged (never disguised as ok) and never aborts the cycle.
+  _claim_rc=0
+  bash "$(dirname "$0")/do-signal.sh" --task-claim "$SLUG" >/dev/null || _claim_rc=$?
+  if [ "$_claim_rc" -ne 0 ]; then
+    echo "board-write: claim FAILED (exit ${_claim_rc})" >&2
+  fi
 
   # C6: Trail confidence hint — query KV trail before spawning the conductor.
   # If confidence ≥ 0.8, write .do-trail-hint.json in the worktree so W1 can skip W2.
@@ -488,32 +1144,132 @@ while [ "$i" -lt "$MAX_CYCLES" ]; do
   # Fresh context, isolated tree: the subprocess runs INSIDE the worktree, so
   # every edit/box-tick/state-write lands on branch $BR — trunk is never touched.
   # Sentinel prevents the conductor from spawning a recursive do-auto.sh loop.
-  touch "$WT/.do-loop-running"
   # Pick the conductor model — fallback to sonnet (world:pick-model not yet wired).
   _shape_pick="do:$(_tier)"
   if [ -n "${_axis:-}" ]; then _shape_pick="${_shape_pick}·${_axis}"; fi
 
-  # Run the conductor in the background with a bash-native watchdog (macOS has no
-  # `timeout`). If it overruns CONDUCTOR_TIMEOUT, the watchdog terminates both the
-  # subshell and the claude process (matched by its --next-cycle command line).
+  # HEAD baseline + open-cycle baseline captured BEFORE the conductor runs — the
+  # reap watcher (IC2) compares against these to detect a close-commit.
+  _iter_sha=$(git -C "$WT" rev-parse HEAD 2>/dev/null || echo "")
+  _iter_remaining="$remaining"
+
+  # Wave-trace baselines, captured BEFORE the conductor runs (text/do-as-workflow.md).
+  _census_base=0
+  [ -f "$WT/.do-census.jsonl" ] && _census_base=$(wc -l < "$WT/.do-census.jsonl" 2>/dev/null | tr -d ' ')
+  _waves_base=$(_waves_ticked "$TODO")
+
+  # Run the conductor in the background with a bash-native, PROGRESS-BASED watchdog
+  # (macOS has no `timeout`). It kills the conductor only after IDLE_SECS of worktree
+  # SILENCE (or the HARD_CAP absolute backstop) — never mid-edit on a slow-but-live
+  # cycle. Matches the claude process by its --next-cycle command line.
   # Unset Claude Code session vars so the subprocess starts a fresh session instead
   # of being blocked by the anti-nesting guard (CLAUDECODE/CLAUDE_CODE_CHILD_SESSION).
-  ( cd "$WT" && unset CLAUDECODE CLAUDE_CODE_CHILD_SESSION CLAUDE_CODE_SESSION_ID AI_AGENT && claude --model "$CONDUCTOR_MODEL" --effort "$CONDUCTOR_EFFORT" --dangerously-skip-permissions -p "/do $SLUG --next-cycle${AUTO_FLAG}" ) &
+  # CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS=0 — wait indefinitely for the conductor's
+  # background tasks. The CLI default terminates a -p run whose background work is
+  # still going after 600s, which kills a LIVE conductor mid-decision: a wide W2
+  # (blocks C4 reasons over 376 registrations) always exceeds it, so that cycle can
+  # never close and every iteration burns identically until the stall guard halts.
+  # Bounding the conductor is already do-auto's own job, and its guards are the ones
+  # that can tell alive-but-slow from hung: IDLE_SECS (no worktree write) and
+  # HARD_CAP. Deferring to a print-wait ceiling that cannot see the worktree trades a
+  # real halt for a fake one.
+  # The conductor's own output is a heartbeat: tee it into the worktree so the
+  # find -newer probe below counts "the conductor is still talking" as progress.
+  # Without this, the only progress signal is a file write — and a wide W2 spends
+  # its whole life inside one Agent spawn, writing nothing.
+  ( cd "$WT" && unset CLAUDECODE CLAUDE_CODE_CHILD_SESSION CLAUDE_CODE_SESSION_ID AI_AGENT && CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS="${DO_BG_WAIT_CEILING_MS:-0}" claude --model "$CONDUCTOR_MODEL" --effort "$CONDUCTOR_EFFORT" --dangerously-skip-permissions -p "/do $SLUG --next-cycle${AUTO_FLAG}" ) > >(tee -a "$WT/.do-conductor.out") 2>&1 &
   cond_pid=$!
-  ( sleep "$CONDUCTOR_TIMEOUT"
-    if kill -0 "$cond_pid" 2>/dev/null; then
-      echo "[do-auto] conductor exceeded ${CONDUCTOR_TIMEOUT}s — terminating (hang guard); stall guard will halt if no progress" >&2
-      pkill -f "do ${SLUG} --next-cycle" 2>/dev/null || true
-      kill -TERM "$cond_pid" 2>/dev/null || true
-      sleep 5; kill -KILL "$cond_pid" 2>/dev/null || true
-    fi ) &
+  _cond_t0=$(date +%s)
+  _write_sentinel "$WT/.do-loop-running" "$cond_pid" "$i" "$SLUG"
+  # Progress signal (F11): ANY file written under the worktree since the last poll —
+  # code edits, new files, commits, AND gitignored state (.w2-spec.json, .w1-cache/,
+  # .do-census.jsonl) that a git-only signal would miss during a long W1/W2 phase that
+  # writes no tracked code. `find -newer <marker> | head -1` is POSIX-portable (BSD +
+  # GNU). Marker lives OUTSIDE the worktree so it never lands in a commit; excludes
+  # .git + node_modules (the linked heavy tree).
+  _wd_marker="${TMPDIR:-/tmp}/.do-wd-${SLUG}-$$"; : > "$_wd_marker"
+  ( _t0=$(date +%s); _last_change=$_t0
+    while kill -0 "$cond_pid" 2>/dev/null; do
+      sleep "$POLL_SECS"
+      _now=$(date +%s)
+      if [ -n "$(find "$WT" -type f -not -path '*/.git/*' -not -path '*/node_modules/*' -newer "$_wd_marker" 2>/dev/null | head -1)" ]; then
+        : > "$_wd_marker"; _last_change=$_now
+      fi
+      _idle=$(( _now - _last_change )); _elapsed=$(( _now - _t0 ))
+      if [ "$_idle" -ge "$IDLE_SECS" ]; then
+        echo "[do-auto] conductor idle ${_idle}s (no worktree write ≥ ${IDLE_SECS}s) — terminating (progress guard); stall guard halts if no box ticked." >&2
+        pkill -f "do ${SLUG} --next-cycle" 2>/dev/null || true
+        kill -TERM "$cond_pid" 2>/dev/null || true; sleep 5; kill -KILL "$cond_pid" 2>/dev/null || true; break
+      fi
+      if [ "$_elapsed" -ge "$HARD_CAP" ]; then
+        echo "[do-auto] conductor exceeded hard cap ${HARD_CAP}s (writing but never closing) — terminating (backstop)." >&2
+        pkill -f "do ${SLUG} --next-cycle" 2>/dev/null || true
+        kill -TERM "$cond_pid" 2>/dev/null || true; sleep 5; kill -KILL "$cond_pid" 2>/dev/null || true; break
+      fi
+    done
+    rm -f "$_wd_marker" ) &
   wd_pid=$!
+  # IC2: reap a conductor that's already committed its close but is still idling
+  # (e.g. waiting on a tool call that never returns) — the 3600s+ hang guard above
+  # stays as the backstop for a truly stuck conductor; this catches the faster,
+  # more common case of "done but not exiting."
+  TODO="$WT/text/${SLUG}-todo.md" _reap_watcher "$WT" "$cond_pid" "$_iter_sha" "$_iter_remaining" &
+  reap_pid=$!
+  # Board heartbeat (IC: the lease must outlive the cycle). `tasks:claim` stamps
+  # `updated-at-ms`; a `picked` row older than CLAIM_LEASE_TTL_MS (45 min,
+  # one.ie/web/src/lib/resolvers/tasks.ts:92) is STALE, and both `tasks:reap` (which
+  # tasks-loop.sh runs FIRST on every pass) and `tasks:claim`'s own stale branch will
+  # reopen it and hand the row to another worker. do-auto wrote exactly three board
+  # events per plan — create/claim/link — with nothing between claim and link, while
+  # p100 fleet duration is 79 min. So a live cycle crossed the TTL and its work could
+  # be double-claimed, discovered only at merge. This ticker is what makes the lease
+  # honest; the per-wave heartbeat below is the progress trace, not the keep-alive.
+  # Default 900s = 3x margin inside the TTL. Fire-and-forget like every other signal.
+  ( while kill -0 "$cond_pid" 2>/dev/null; do
+      sleep "${DO_HEARTBEAT_SECS:-900}"
+      kill -0 "$cond_pid" 2>/dev/null || break
+      _hb_waves=$(_waves_ticked "$TODO" 2>/dev/null | tr '\n' ' ' | sed 's/ *$//')
+      bash "$(dirname "$0")/do-signal.sh" --task-heartbeat "$SLUG" \
+        "cycle ${_cyc} in flight — waves: ${_hb_waves:-none yet}" >/dev/null 2>&1 || true
+    done ) &
+  hb_pid=$!
   wait "$cond_pid" 2>/dev/null || true
+  _cond_secs=$(( $(date +%s) - ${_cond_t0:-$(date +%s)} ))
   kill "$wd_pid" 2>/dev/null || true   # conductor finished first — cancel the watchdog
+  kill "$reap_pid" 2>/dev/null || true # conductor finished first — cancel the reap watcher
+  kill "$hb_pid" 2>/dev/null || true   # conductor finished first — cancel the board heartbeat
   # Kill any child do-auto.sh the conductor may have spawned despite --next-cycle.
   pkill -f "do-auto.sh ${SLUG}" 2>/dev/null || true
   sleep 1
-  rm -f "$WT/.do-loop-running"
+  rm -f "$WT/.do-loop-running" "${_wd_marker:-}"   # marker cleanup (subshell's rm is skipped when the conductor finishes first)
+
+  # Wave trace (text/do-as-workflow.md deliverable 1) — one `wave` event per wave this
+  # iteration ticked, in order, so the run record carries the wave-by-wave trace and a
+  # W3.5 reloop shows as repeated w3/w4 entries. Drained in the FOREGROUND after the
+  # wait: the watchdog subshell is killed the instant the conductor exits, which would
+  # systematically drop the closing W4. The census is the primary source (it records
+  # every agent settle, reloops included); it is an instruction to the conductor, not a
+  # mechanical guarantee, so a cycle that appended none falls back to the wave
+  # checkboxes it DID tick. Fire-and-forget, like every other _signal.
+  _census_now=0
+  [ -f "$WT/.do-census.jsonl" ] && _census_now=$(wc -l < "$WT/.do-census.jsonl" 2>/dev/null | tr -d ' ')
+  _new_waves=""
+  if [ "${_census_now:-0}" -gt "${_census_base:-0}" ]; then
+    _new_waves=$(tail -n "+$((_census_base + 1))" "$WT/.do-census.jsonl" 2>/dev/null \
+      | sed -n 's/.*"wave"[[:space:]]*:[[:space:]]*"\(W[0-9]\)".*/\1/p' || true)
+  else
+    for _w in $(_waves_ticked "$TODO"); do
+      case " ${_waves_base} " in *" ${_w} "*) ;; *) _new_waves="${_new_waves} ${_w}" ;; esac
+    done
+  fi
+  for _w in $_new_waves; do
+    _signal wave "$SLUG" "$(_tier)" "$_cyc" "wave=${_w}"
+    # Same wave close, second surface: a tasks:comment bumps `updated-at-ms`, so the
+    # task sheet's timeline becomes the wave-by-wave trace a human watches at
+    # /tasks/board — and each one re-arms the lease. Mirrors do-engine.js:427.
+    bash "$(dirname "$0")/do-signal.sh" --task-heartbeat "$SLUG" \
+      "cycle ${_cyc} · ${_w} close" >/dev/null 2>&1 || true
+  done
 
   # Objective security gate (W4 bash-first, zero-LLM): before the cycle lands on
   # the branch, secret-scan the worktree + audit deps. A scored security score can
@@ -523,7 +1279,7 @@ while [ "$i" -lt "$MAX_CYCLES" ]; do
   if ! _secret_gate "$WT"; then
     echo "[do-auto] secret-scan / bun audit found an issue — NOT committing cycle ${i}." >&2
     echo "[do-auto] Inspect $WT, remove the secret/vuln, then re-run /do $SLUG. WIP preserved on $BR." >&2
-    _signal halt "$SLUG" "$(_tier)" "$i" "reason=secret-gate"
+    _signal halt "$SLUG" "$(_tier)" "$_cyc" "reason=secret-gate"
     exit 1
   fi
 
@@ -553,10 +1309,13 @@ while [ "$i" -lt "$MAX_CYCLES" ]; do
   _shape=""
   [ -n "$_axis" ] && _shape="shape=do:$(_tier)·${_axis}"
   _model="model=${CONDUCTOR_MODEL}"
+  # worktags = the plan's dept+topic tags (the vocabulary real tasks carry) — the reputation
+  # harvest credits these tag-nodes so tasks:mine ranks by proven work (text/reputation.md § A).
+  _worktags=$(python3 "$(dirname "$0")/do-rank.py" --worktags "$SLUG" 2>/dev/null || true)
   if [ -n "$_composite" ]; then
-    _signal learn "$SLUG" "$(_tier)" "$i" "composite=${_composite}" ${_shape:+"$_shape"} "$_model"
+    _signal learn "$SLUG" "$(_tier)" "$_cyc" "composite=${_composite}" ${_shape:+"$_shape"} "$_model" ${_worktags:+"worktags=$_worktags"}
   else
-    _signal learn "$SLUG" "$(_tier)" "$i" ${_shape:+"$_shape"} "$_model"
+    _signal learn "$SLUG" "$(_tier)" "$_cyc" ${_shape:+"$_shape"} "$_model" ${_worktags:+"worktags=$_worktags"}
   fi
 done
 
@@ -565,7 +1324,7 @@ if $DRY_RUN; then exit 0; fi
 if [ "$i" -ge "$MAX_CYCLES" ]; then
   echo "[do-auto] hit --max-cycles $MAX_CYCLES — halting"
   echo "[do-auto] WIP preserved on branch $BR (worktree $WT)."
-  _signal halt "$SLUG" "$(_tier)" "$i" "reason=max-cycles"
+  _signal halt "$SLUG" "$(_tier)" "$(_plan_cycle "$i")" "reason=max-cycles"
   exit 1
 fi
 
@@ -576,6 +1335,16 @@ fi
 # away the reasoning to stay cheap, so the digest is the only thing left to read
 # before an irreversible merge.
 _merge_digest
+# Close the loop on the origin task (tasks-do C1): the handoff-completion
+# record — provenance line + task-status:done — lands once, at PLAN close,
+# not per cycle (a plan's cycles all serve the same origin task). Asserted:
+# a failed link is logged with its exit, never disguised as ok; the plan
+# still completed its code.
+_link_rc=0
+bash "$(dirname "$0")/do-signal.sh" --task-link "$SLUG" "docs=${SLUG}" >/dev/null || _link_rc=$?
+if [ "$_link_rc" -ne 0 ]; then
+  echo "board-write: link FAILED (exit ${_link_rc})" >&2
+fi
 echo ""
 echo "[do-auto] ✓ plan complete on branch $BR — trunk ($BASE) untouched."
 echo "[do-auto]   read:    .do-digest.md                 # what landed + gate verdict (reasoning was discarded)"