@oneie/claude 0.6.0 → 0.8.0

package/scripts/do-fleet.sh

@@ -31,6 +31,11 @@ RANK="$ROOT/.claude/scripts/do-rank.py"
 AUTO="$ROOT/.claude/scripts/do-auto.sh"
 WT_BASE="$ROOT/.do-worktrees"
 
+# Worktree branches cut from trunk, never HEAD — a shared tree parked on a
+# feature branch must not seed fleet plans with its commits. DO_BASE_REF overrides.
+BASE_REF="${DO_BASE_REF:-main}"
+git -C "$ROOT" show-ref --verify --quiet "refs/heads/$BASE_REF" || BASE_REF=HEAD
+
 GO=false
 SLOTS=3
 TOP=40
@@ -52,9 +57,33 @@ done
 # Cap slots by (cores - 2), never exceed --slots.
 CORES=$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 4)
 CORE_CAP=$(( CORES - 2 )); [ "$CORE_CAP" -lt 1 ] && CORE_CAP=1
-[ "$SLOTS" -gt "$CORE_CAP" ] && SLOTS="$CORE_CAP"
+BIND="--slots"
+[ "$SLOTS" -gt "$CORE_CAP" ] && { SLOTS="$CORE_CAP"; BIND="cores"; }
+
+# …and by MEMORY, which is the constraint that actually bites.
+#
+# Cores were never the limit. On a 10-core/24GB box `cores - 2` authorised 8
+# concurrent worktrees; 8 cycles is ~16GB of gates before the editors, the
+# sessions and the OS get a byte. The box reached load 57 and filled 16GB of
+# swap with fewer than that. gate_headroom prices a cycle in GB and divides
+# what is actually free, so the fleet shrinks on a loaded box and opens back
+# up on an idle one. It only ever LOWERS the count — --slots and the core cap
+# still hold.
+# shellcheck source=lib/govern.sh
+. "$ROOT/.claude/scripts/lib/govern.sh"
+MEM_CAP=$(gate_headroom)
+[ "$SLOTS" -gt "$MEM_CAP" ] && { SLOTS="$MEM_CAP"; BIND="memory"; }
 
-echo "[do-fleet] ranking… (top $TOP candidates, $SLOTS slots, $( $GO && echo LIVE || echo DRY-RUN ))"
+# A worktree cut before the governor landed runs the OLD unbounded gates, so
+# the cap above is the only thing protecting the box from it. Say so — a silent
+# stale worktree is how this problem returns.
+for _wt in "$WT_BASE"/*/; do
+  [ -f "$_wt/.claude/scripts/lib/govern.sh" ] && continue
+  [ -d "$_wt/.claude/scripts" ] || continue
+  echo "[do-fleet] ⚠ $(basename "$_wt") predates the governor — its gates are unbounded; rebase it onto $BASE_REF"
+done
+
+echo "[do-fleet] ranking… (top $TOP candidates, $SLOTS slots — bound by $BIND; cores≤$CORE_CAP mem≤$MEM_CAP, $( $GO && echo LIVE || echo DRY-RUN ))"
 
 # Load ranked queue into an array (bash 3.2 compatible — no mapfile).
 QUEUE=()
@@ -84,63 +113,143 @@ link_deps() {
   done
 }
 
-# Dynamic file-lock registry: "dir<TAB>slug" lines in a temp file.
-LOCK_FILE="$(mktemp)"
-trap 'rm -f "$LOCK_FILE"' EXIT
+# Region-claim registry — MACHINE-WIDE, in $GOVERN_DIR/claims (lib/govern.sh).
+#
+# This used to be `LOCK_FILE="$(mktemp)"`: a map private to one fleet process.
+# Nine concurrent fleet invocations held nine private maps, so two fleets could
+# each believe a region was free and both take it — the duplicate-selection
+# collision this registry exists to remove. mkdir(2) is the arbiter; a claim
+# evaporates on its own when the owner dies (kill -0) or its lease expires.
+trap 'claim_release_all' EXIT
 
-claim_dirs() {   # claim_dirs <slug>
-  local n=0
+claim_dirs() {   # claim_dirs <slug> → 0 = all regions claimed, 1 = lost a race
+  local slug="$1" n=0 d
+  CLAIM_TAKEN=()
   while IFS= read -r d; do
-    [ -n "$d" ] && { printf '%s\t%s\n' "$d" "$1" >> "$LOCK_FILE"; n=$(( n + 1 )); }
-  done < <(deliverable_dirs "$1")
+    [ -n "$d" ] || continue
+    n=$(( n + 1 ))
+    if claim_take "$d" "$slug"; then
+      CLAIM_TAKEN+=("$d")
+    else
+      # Another fleet won this region between has_conflict and here. Give back
+      # everything already taken for this slug — a half-claimed plan would hold
+      # ground it never builds, and only the TTL would ever free it.
+      if [ "${#CLAIM_TAKEN[@]}" -gt 0 ]; then
+        for d in "${CLAIM_TAKEN[@]}"; do claim_release "$d"; done
+      fi
+      echo "  ✗ $slug — lost the race for a region to another fleet, deferring" >&2
+      return 1
+    fi
+  done < <(deliverable_dirs "$slug")
   # An unscoped plan (no deliverables:) declares zero dirs — the conflict filter
   # would treat it as disjoint from EVERYTHING and parallelize it blindly, which
   # clobbers shared trees (one.ie/web). Claim the __ANY__ sentinel so it conflicts
   # with any other plan: it only ever runs as the sole slot. Declare deliverables
   # to make it fleet-safe (see do-rank.py UNSCOPED warning).
-  [ "$n" -eq 0 ] && printf '%s\t%s\n' "__ANY__" "$1" >> "$LOCK_FILE"
+  if [ "$n" -eq 0 ]; then
+    claim_take "__ANY__" "$slug" || { echo "  ✗ $slug — __ANY__ taken, deferring" >&2; return 1; }
+  fi
+  return 0
 }
 
 free_dirs() {    # free_dirs <slug>
-  local tmp; tmp="$(mktemp)"
-  grep -v "	$1$" "$LOCK_FILE" > "$tmp" 2>/dev/null || true
-  mv "$tmp" "$LOCK_FILE"
+  local d
+  while IFS= read -r d; do
+    [ -n "$d" ] && claim_release "$d"
+  done < <(deliverable_dirs "$1")
+  # Only the slug that took the sentinel may give it back. Every claim in this
+  # process shares one pid, so an unguarded release here would let a finishing
+  # SCOPED plan hand back a live UNSCOPED plan's sole-slot guarantee.
+  [ "$(claim_owner "__ANY__" | awk '{print $1}')" = "$1" ] && claim_release "__ANY__"
+  return 0
 }
 
 has_conflict() { # has_conflict <slug> → exit 0 if conflict
+  # Every read below goes through claim_owner/claim_list, which reap a dead or
+  # expired owner before answering — so a fleet that was killed mid-plan never
+  # keeps a region shut.
+  local live_owner
   # A live unscoped plan holds the __ANY__ sentinel → nothing may share with it.
-  any_owner=$(awk -F'\t' '$1=="__ANY__"{print $2; exit}' "$LOCK_FILE" 2>/dev/null || true)
+  any_owner=$(claim_owner "__ANY__" | awk '{print $1}')
   if [ -n "$any_owner" ] && [ "$any_owner" != "$1" ]; then
     echo "  ✗ $1 — unscoped plan $any_owner holds the fleet (sole slot), deferring"
     return 0
   fi
   # This plan is itself unscoped (no deliverable dirs) → only runs alone.
   ndirs=$(deliverable_dirs "$1" | grep -c . || true)
-  if [ "$ndirs" -eq 0 ] && [ -s "$LOCK_FILE" ]; then
-    echo "  ✗ $1 — unscoped (no deliverables:), defers while any plan is live"
-    return 0
+  if [ "$ndirs" -eq 0 ]; then
+    live_owner=$(claim_list | awk -F'\t' -v s="$1" '$2!=s{print $2; exit}')
+    if [ -n "$live_owner" ]; then
+      echo "  ✗ $1 — unscoped (no deliverables:), defers while $live_owner is live"
+      return 0
+    fi
   fi
   while IFS= read -r d; do
     [ -z "$d" ] && continue
-    owner=$(awk -F'\t' -v k="$d" '$1==k{print $2; exit}' "$LOCK_FILE" 2>/dev/null || true)
-    if [ -n "$owner" ]; then
-      echo "  ✗ $1 — dir $d locked by $owner, deferring"
+    owner=$(claim_owner "$d" | awk '{print $1}')
+    if [ -n "$owner" ] && [ "$owner" != "$1" ]; then
+      echo "  ✗ $1 — dir $d claimed by $owner, deferring"
       return 0
     fi
   done < <(deliverable_dirs "$1")
   return 1
 }
 
-launch_plan() {  # launch_plan <slug> → echoes PID
+# claim_task — fires tasks:claim before a worktree is cut (claim = lease, tasks-do C5).
+# Best-effort like do-signal.sh's world:do-event stance: no configured secret or an
+# unparseable response degrades to "ok to launch" rather than blocking the fleet. An
+# explicit already-claimed/blocked response returns 1 so fill_slots skips this slug —
+# two fleet runs (or a fleet run racing a human claim) never double-build the same task.
+claim_task() {  # claim_task <slug> → 0 ok to launch, 1 already claimed elsewhere
+  # GATEWAY_API_KEY, not SERVER_SECRET — /api/ask/<receiver>'s isServiceCaller checks
+  # env.GATEWAY_API_KEY (one.ie/web/src/pages/api/ask/[...receiver].ts). SERVER_SECRET
+  # is what /api/signal/ checks; the two routes don't share a secret. Also pin
+  # workspace so the claim's ctx.ownerSlug lands in /u/one/tasks like every other
+  # Claude Code task (do-signal.sh's CC_TASKS_WORKSPACE convention).
+  # Address the lease by the plan SLUG, never a guessed tid: real tids are minted
+  # task:<traceId> (resolvers/tasks.ts insertTaskRow), so "task:<slug>" resolved
+  # not_found for every plan and the lease could never gate. tasks:claim resolves
+  # data.slug via resolveTaskBySlug when present (resolvers/tasks.ts claim).
+  local slug="$1" secret="" f resp
+  # ONE_ENV_FILE first: the loop must be able to read credentials with no
+  # one.ie/web/ on disk. The monorepo paths stay as fallbacks and expand to
+  # nothing outside it.
+  for f in "${ONE_ENV_FILE:-${DO_ENV_FILE:-}}" "$ROOT/.env" "$ROOT/one.ie/web/.env" "$ROOT/one.ie/web/.secrets.generated.local"; do
+    [ -n "$f" ] || continue
+    [ -f "$f" ] || continue
+    secret=$(grep -E '^GATEWAY_API_KEY=' "$f" 2>/dev/null | head -1 | sed 's/^[^=]*=//;s/^"//;s/"$//' || true)
+    [ -n "$secret" ] && break
+  done
+  [ -z "$secret" ] && return 0
+  resp=$(curl -sf -X POST "${DO_SIGNAL_URL:-https://one.ie}/api/ask/tasks:claim" \
+    -H "Content-Type: application/json" -H "Authorization: Bearer $secret" \
+    -d "{\"data\":{\"slug\":\"$slug\",\"workspace\":\"${CC_TASKS_WORKSPACE:-one}\"}}" 2>/dev/null || true)
+  case "$resp" in
+    *'"ok":true'*)                 return 0 ;;   # lease held by us — launch
+    *'"error":"already-claimed"'*) echo "  ~ $slug — claimed by another actor, skipping" >&2; return 1 ;;
+    *'"error":"blocked"'*)         echo "  ~ $slug — blocked by an unresolved dependency, skipping" >&2; return 1 ;;
+    *'"error":"not_found"'*)       return 0 ;;   # no substrate task yet (claim-before-create) — launch
+    *'"error"'*)                   echo "  ! $slug — claim degraded: $resp" >&2; return 0 ;;
+    *)                             return 0 ;;   # unparseable/empty — best-effort, launch
+  esac
+}
+
+launch_plan() {  # launch_plan <slug> → echoes PID, or nothing if the claim was lost
   local slug="$1"
   local wt="$WT_BASE/$slug"
+  # Claim the ground FIRST. has_conflict only read the registry; between that
+  # read and now another fleet may have deposited. mkdir decides, and a loser
+  # reroutes to the next candidate rather than waiting.
+  claim_dirs "$slug" || return 1
   if [ ! -d "$wt" ]; then
-    git -C "$ROOT" worktree add -b "do/$slug" "$wt" HEAD >/dev/null 2>&1 \
+    git -C "$ROOT" worktree add -b "do/$slug" "$wt" "$BASE_REF" >/dev/null 2>&1 \
       || git -C "$ROOT" worktree add "$wt" "do/$slug" >/dev/null 2>&1 || true
   fi
-  link_deps "$wt"
-  claim_dirs "$slug"
-  echo "  ▶ launching $slug (log: $wt/.fleet.log)"
+  # stdout of this function IS the pid — fill_slots captures it. Chatter must go
+  # to stderr or the "pid" is a multi-line string and every kill -0 on it fails,
+  # which reads as "slot finished" the instant it launches.
+  link_deps "$wt" >&2
+  echo "  ▶ launching $slug (log: $wt/.fleet.log)" >&2
   # Direct exec (no subshell wrapper) so $! is the do-auto.sh bash process itself.
   # A ( cmd ) & subshell forks cmd and exits immediately — the fleet would track the
   # subshell PID, which dies before cmd finishes, misreporting the slot as done.
@@ -152,7 +261,15 @@ launch_plan() {  # launch_plan <slug> → echoes PID
 if ! $GO; then
   echo ""
   echo "  DRY-RUN — first $SLOTS disjoint plans from queue:"
-  CLAIMED_DRY=""
+  # Seed the preview from the LIVE machine-wide registry (read-only — a dry run
+  # never deposits). Otherwise the preview says "✓ foo" for a region another
+  # fleet is already inside, which is exactly the lie the registry removes.
+  # claim_list emits region<TAB>slug<TAB>pid and reaps dead owners as it walks,
+  # so the preview inherits evaporation for free.
+  CLAIMED_DRY="$(claim_list)"
+  # Keep "" meaning "nothing claimed" — the unscoped-plan check below tests -n.
+  if [ -n "$CLAIMED_DRY" ]; then CLAIMED_DRY="$CLAIMED_DRY
+"; fi
   COUNT=0
   for slug in "${QUEUE[@]}"; do
     [ "$COUNT" -ge "$SLOTS" ] && break
@@ -260,7 +377,17 @@ fill_slots() {
   while [ "${#SLOT_PIDS[@]}" -lt "$SLOTS" ]; do
     pop_next
     [ -z "$NEXT_SLUG" ] && break
-    local pid; pid=$(launch_plan "$NEXT_SLUG")
+    if ! claim_task "$NEXT_SLUG"; then
+      echo "  ~ $NEXT_SLUG — already claimed elsewhere, skipping"
+      DONE_SLUGS+=("$NEXT_SLUG")
+      continue
+    fi
+    local pid=""
+    # A lost region race is not an error — reroute to the next candidate.
+    if ! pid=$(launch_plan "$NEXT_SLUG") || [ -z "$pid" ]; then
+      DONE_SLUGS+=("$NEXT_SLUG")
+      continue
+    fi
     SLOT_PIDS+=("$pid")
     SLOT_SLUGS+=("$NEXT_SLUG")
     SLOT_START+=("$(date +%s)")

package/scripts/do-folder.sh

@@ -36,7 +36,11 @@ fi
 
 # 3. longest-prefix match against known buildable folders (one.ie/web BEFORE one.ie).
 #    bash 3.2-safe (macOS): no associative arrays — dedup a newline list with sort -u.
-folders="one.ie/web one.ie packages agents api schema sync backup"
+# channels/ and pay/ were ABSENT until 2026-09-03, and they are two of the five
+# deployed services. A changed set touching only them answered "unmapped", which
+# do-w4-gates then dropped on the floor -- no verify row at all, in either lane.
+# pay/backend before pay, one.ie/web before one.ie: longest prefix must win.
+folders="one.ie/web one.ie packages agents api schema sync backup channels pay/backend pay"
 matched=""
 for p in "${paths[@]}"; do
   for f in $folders; do
@@ -56,7 +60,12 @@ printf '%s\n' "$matched" | while IFS= read -r f; do
   pj="$ROOT/$f/package.json"
   verify="null"; build="null"
   if [ -f "$pj" ]; then
+    # Dev lane by default: verify:fast (tsc + related tests + pinned gates).
+    # FULL_VERIFY=1 (set by /close and ./deploy) asks for the whole suite.
     jq -e '.scripts.verify' "$pj" >/dev/null 2>&1 && verify='"bun run verify"'
+    if [ "${FULL_VERIFY:-0}" != "1" ] && jq -e '.scripts["verify:fast"]' "$pj" >/dev/null 2>&1; then
+      verify='"bun run verify:fast"'
+    fi
     jq -e '.scripts.build'  "$pj" >/dev/null 2>&1 && build='"bun run build"'
   fi
   printf '{"folder":"%s","verify":%s,"build":%s,"doc_only":false}\n' "$f" "$verify" "$build"

package/scripts/do-killswitch-audit.py

@@ -54,27 +54,46 @@ def parse_outcome(text):
         lines = [re.sub(r"\\$", "", l.strip()) for l in bm.group(1).splitlines() if l.strip()]
         return " ".join(lines).strip()
     # inline form: outcome: "..."  or  outcome: ...
-    im = re.search(r'^outcome:\s*"?(.+?)"?\s*$', body, re.MULTILINE)
+    # A double-quoted YAML scalar must be unescaped (\" → ", \\ → \) and may
+    # carry a trailing comment after the closing quote — match the quoted
+    # string properly first, else the escapes leak into the shell verbatim
+    # and grep hunts for quote characters that were never in the file.
+    qm = re.search(r'^outcome:\s*"((?:[^"\\]|\\.)*)"', body, re.MULTILINE)
+    if qm:
+        return re.sub(r'\\(.)', r'\1', qm.group(1)).strip()
+    # single-quoted YAML scalar: '' is the only escape (a literal ')
+    sm = re.search(r"^outcome:\s*'((?:[^']|'')*)'", body, re.MULTILINE)
+    if sm:
+        return sm.group(1).replace("''", "'").strip()
+    im = re.search(r'^outcome:\s*(.+?)\s*$', body, re.MULTILINE)
     return im.group(1).strip() if im else ""
 
 
 def stale_cd(cmd):
     """Walk the &&/; chain tracking cwd — `cd a && cd ../b` makes ../b relative
-    to a, not to root. Return the first cd target that doesn't exist, else None."""
+    to a, not to root. A `(cd x && …)` subshell inherits the outer cwd but its
+    cd does NOT leak past the closing paren (outcomes are commonly chains of
+    subshells: `(cd web && test) && (cd channels && test)`). Parens inside
+    quotes (grep patterns) can unbalance the stack; that degrades to the outer
+    cwd, never a crash. Return the first cd target that doesn't exist, else None."""
     cwd = ROOT
+    stack = []
     for seg in re.split(r"&&|;|\|", cmd):
-        m = re.search(r"\bcd\s+([^\s&|;]+)", seg)
-        if not m:
-            continue
-        t = m.group(1)
-        nxt = Path(t) if t.startswith("/") else (cwd / t)
-        try:
-            nxt = nxt.resolve()
-        except Exception:
-            return t
-        if not nxt.exists():
-            return t
-        cwd = nxt
+        for _ in range(seg.count("(")):
+            stack.append(cwd)
+        m = re.search(r"\bcd\s+([^\s&|;)]+)", seg)
+        if m:
+            t = m.group(1)
+            nxt = Path(t) if t.startswith("/") else (cwd / t)
+            try:
+                nxt = nxt.resolve()
+            except Exception:
+                return t
+            if not nxt.exists():
+                return t
+            cwd = nxt
+        for _ in range(seg.count(")")):
+            cwd = stack.pop() if stack else ROOT
     return None
 
 

package/scripts/do-next.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+# do-next.sh <slug> [--claim] [--all] — stream the next READY cycle(s) of a plan.
+#
+# manifest: portable
+#
+# WHY. do-engine runs a plan as BATCHES: every cycle in a batch must finish before
+# any cycle of the next one starts, so the batch costs its SLOWEST member and a
+# cycle whose own dependencies closed an hour ago still waits at the barrier. The
+# batch is not a real constraint — the DAG is. This emits the cycles whose
+# dependencies are ACTUALLY closed, right now, so a worker can take one, do it,
+# verify it, close it, and immediately ask for the next.
+#
+# Readiness is DERIVED, never read. The todo's `state: ready` / `state: blocked-on-C1,C2`
+# words are written once when the plan is authored and nothing updates them as
+# cycles close — the same second-source-of-truth seam that let a verified cycle
+# stay `- [ ]` forever. The `blocked-on-` list is the edge set (authored, static,
+# correct); whether those edges are SATISFIED is computed from the checkboxes,
+# which are the live record do-tick.sh writes.
+#
+# --claim makes the emission ATOMIC across every session and worktree on this box:
+# claim_take is mkdir(2)-arbitrated, so N workers racing the same plan each get a
+# DIFFERENT cycle and never the same one. A claim evaporates when its owner dies
+# or its lease expires, so a killed worker's cycle returns to the stream by itself
+# — no coordinator, no queue, nothing to deadlock.
+set -euo pipefail
+
+SLUG=""; DO_CLAIM=0; ALL=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --claim) DO_CLAIM=1 ;;
+    --all) ALL=1 ;;
+    -*) echo "do-next: unknown flag $1" >&2; exit 2 ;;
+    *) [ -n "$SLUG" ] && { echo "do-next: one slug only" >&2; exit 2; }; SLUG="$1" ;;
+  esac
+  shift
+done
+[ -n "$SLUG" ] || { echo "usage: do-next.sh <slug> [--claim] [--all]" >&2; exit 2; }
+
+ROOT="${DO_NEXT_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
+TODO="$ROOT/text/${SLUG}-todo.md"
+[ -f "$TODO" ] || { echo "do-next: no such plan: $TODO" >&2; exit 3; }
+
+# The cycle-line shape. Identical to do-tick.sh's reader and do-auto.sh's
+# _remaining(); parity across all four implementations is proven behaviourally by
+# do-cycle-shape-check.sh, which reads this file rather than a copy of it.
+OPEN_RE='^[[:space:]]*- \[[ ~]\] \*{0,2}C[0-9]+\*{0,2} —'
+CLOSED_RE='^[[:space:]]*- \[x\] \*{0,2}C[0-9]+\*{0,2} —'
+
+closed_raw=$(grep -oE "$CLOSED_RE" "$TODO" 2>/dev/null || true)
+closed=" $(printf '%s' "$closed_raw" | grep -oE 'C[0-9]+' 2>/dev/null | tr '\n' ' ' || true)"
+open_lines=$(grep -E "$OPEN_RE" "$TODO" 2>/dev/null || true)
+[ -n "$open_lines" ] || { echo "do-next: ${SLUG} — no open cycles; plan complete" >&2; exit 0; }
+
+ready=""
+while IFS= read -r line; do
+  [ -n "$line" ] || continue
+  cid=$(printf '%s' "$line" | grep -oE 'C[0-9]+' | head -1)
+  [ -n "$cid" ] || continue
+  # Edge set: `state: blocked-on-C1,C2`. No blocked-on clause ⇒ no edges ⇒ ready.
+  deps=$(printf '%s' "$line" | sed -nE 's/.*blocked-on-([C0-9,]+).*/\1/p' | tr ',' ' ')
+  blocked=0
+  for d in $deps; do
+    case "$closed" in *" $d "*) ;; *) blocked=1; break ;; esac
+  done
+  [ "$blocked" -eq 0 ] && ready="$ready $cid"
+done <<EOF
+$open_lines
+EOF
+
+ready=$(printf '%s' "$ready" | tr ' ' '\n' | grep -v '^$' || true)
+[ -n "$ready" ] || { echo "do-next: ${SLUG} — cycles remain OPEN but every one is blocked on an unclosed dependency. Nothing to stream." >&2; exit 1; }
+
+if [ "$DO_CLAIM" -eq 0 ]; then
+  [ "$ALL" -eq 1 ] && printf '%s\n' "$ready" || printf '%s\n' "$ready" | head -1
+  exit 0
+fi
+
+# shellcheck source=lib/govern.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib/govern.sh"
+# Claim on behalf of the WORKER, not of this script. do-next.sh exits in
+# milliseconds; if the claim tracked its lifetime it would evaporate immediately
+# and the next racer would be handed the very cycle we just emitted. Default to
+# the caller (PPID) — the shell, agent, or fleet loop that will actually do the
+# work and whose death SHOULD return the cycle to the stream.
+export GOVERN_CLAIM_PID="${DO_NEXT_OWNER_PID:-$PPID}"
+# PPID is only the real worker when do-next is called directly. Called the
+# natural way — `cid=$(do-next.sh <slug> --claim)` — the parent IS the command
+# substitution's subshell, which dies the instant the value is assigned, so the
+# claim would evaporate before the worker ever saw the cycle it was handed.
+# minhold keeps the ground held for a grace window regardless of owner liveness;
+# the worker adopts it by re-claiming under its own pid (claim_take is idempotent
+# for the same owner), and the lease TTL still bounds the whole thing.
+export GOVERN_CLAIM_MIN_HOLD_SECS="${DO_NEXT_MIN_HOLD_SECS:-300}"
+took=""
+for cid in $ready; do
+  if claim_take "do-${SLUG}-${cid}" "${SLUG}/${cid}" >/dev/null 2>&1; then
+    took="$took $cid"
+    [ "$ALL" -eq 1 ] || break
+  fi
+done
+took=$(printf '%s' "$took" | tr ' ' '\n' | grep -v '^$' || true)
+if [ -z "$took" ]; then
+  echo "do-next: ${SLUG} — every ready cycle is already claimed by a live worker. Nothing to take." >&2
+  exit 1
+fi
+printf '%s\n' "$took"

package/scripts/do-orchestrate.sh

@@ -278,11 +278,23 @@ while [ "$i" -lt "$ITERS" ]; do
   fi
 
   # LIVE: build the plan (do-auto worktrees + cycles + W4 + digest)
-  echo "  ▶ building (log: $WT_BASE/$pick/.orchestrate.log)" | tee -a "$RUNLOG"
-  mkdir -p "$WT_BASE/$pick"
-  _link_deps "$WT_BASE/$pick"   # worktree can verify before do-auto even runs
-  if "$AUTO" "$pick" >"$WT_BASE/$pick/.orchestrate.log" 2>&1; then
-    _link_deps "$WT_BASE/$pick"   # re-link in case do-auto recreated the worktree
+  #
+  # The log lives BESIDE the worktrees, never inside one. It used to be
+  # "$WT_BASE/$pick/.orchestrate.log", which forced a `mkdir -p` of the worktree
+  # path before do-auto ran — and that plain directory made do-auto's old
+  # `rev-parse --git-dir` probe report "resuming worktree". `git worktree add`
+  # then never ran, and every cycle commit targeted the MAIN tree's HEAD, where
+  # _safe_stage refuses to stage: orchestrated cycles committed NOTHING, with no
+  # error. do-auto now discriminates properly (see _is_worktree there); this side
+  # removes the trigger, so neither half depends on the other being correct.
+  #
+  # Keeping it outside also means the log survives `git worktree remove`, which
+  # is when you most want to read it.
+  log="$WT_BASE/.logs/$pick.log"   # not `local` — this loop is top-level, not a function
+  mkdir -p "$WT_BASE/.logs"
+  echo "  ▶ building (log: $log)" | tee -a "$RUNLOG"
+  if "$AUTO" "$pick" >"$log" 2>&1; then
+    _link_deps "$WT_BASE/$pick"   # do-auto cut the worktree; ensure deps are linked
     if _reflect "$pick" | tee -a "$RUNLOG"; then
       echo "  ✅ $pick — VERIFIED, merge-ready on branch do/$pick" | tee -a "$RUNLOG"
       BUILT+=("$pick")

package/scripts/do-plan-json.mjs

@@ -0,0 +1,162 @@
+// do-plan-json.mjs — parse a /do plan into JSON, deterministically. No LLM.
+//
+// WHY (2026-08-31): do-engine.js runs with no filesystem access, so it asked an
+// LLM agent for "the raw, verbatim content of text/<slug>-todo.md". An LLM will
+// not return a 30KB file verbatim — it returned 6.8KB ending "(Full todo text
+// continues...)". The guard reading open cycles out of that text saw NONE, and
+// four launches burned ~3M subagent tokens building nothing.
+//
+// The plan is a deterministic fact on disk. Reading it through a probabilistic
+// channel is the defect. This is the deterministic channel; the agent's only job
+// becomes "run this, paste stdout". Same discipline as do-auto.sh's _remaining(),
+// which is grep and has never had this failure.
+//
+// Exits non-zero and emits NOTHING when the plan is unreadable — a partial plan
+// must never read as a runnable one.
+import fs from 'node:fs'
+import path from 'node:path'
+import crypto from 'node:crypto'
+
+const slug = process.argv[2]
+if (!slug) { console.error('usage: do-plan-json.mjs <slug>'); process.exit(2) }
+
+const repo = path.resolve(new URL('../..', import.meta.url).pathname)
+
+// READ THE TODO THE ENGINE WRITES.
+//
+// do-tick.sh runs inside the plan WORKTREE, so a closed cycle is ticked in
+// .do-worktrees/<slug>/text/<slug>-todo.md. This parser read main's copy, where
+// those cycles are still `- [ ]` until the branch merges. So a relaunch computed
+// openCycles from main and rebuilt work the worktree had already proven --
+// measured 2026-09-01: a relaunch of `lifecycle` re-ran C0, C2 and C3 (all three
+// closed and committed on do/lifecycle) before it could reach the C1/C5 it was
+// launched for.
+//
+// Same read/write divergence that stalled the engine this morning, one level up:
+// the tick and the reader were looking at two different files. The worktree copy
+// is the live record while a plan is in flight; main's is the record after merge.
+// Prefer the worktree when it exists, and SAY which one was read so a surprising
+// openCycles is one line of output away from being explained.
+const wtTodo = path.join(repo, '.do-worktrees', slug, 'text', `${slug}-todo.md`)
+const mainTodo = path.join(repo, 'text', `${slug}-todo.md`)
+const todo = (process.env.DO_PLAN_TODO) || (fs.existsSync(wtTodo) ? wtTodo : mainTodo)
+if (!fs.existsSync(todo)) { console.error(`do-plan-json: no such plan: text/${slug}-todo.md`); process.exit(3) }
+
+const t = fs.readFileSync(todo, 'utf8')
+const fail = (m) => { console.error(`do-plan-json: ${m}`); process.exit(4) }
+
+const fm = t.match(/^---\n([\s\S]*?)\n---/)
+if (!fm) fail('no frontmatter')
+const F = fm[1]
+
+// batches: `- [C0, C2]` lines under `batches:`
+const bm = F.match(/^batches:\n((?:[ \t]+- \[.*\]\n?)+)/m)
+const batches = bm
+  ? bm[1].trim().split('\n').map((l) =>
+      l.replace(/^[\s-]*\[|\]\s*$/g, '').split(',').map((s) => s.trim()).filter(Boolean))
+  : []
+
+// outcome: the kill-switch. A YAML double-quoted scalar carries \" and \\ escapes;
+// stripping the outer quotes WITHOUT unescaping leaves a stray backslash that
+// JSON.stringify then doubles, emitting invalid JSON (measured: lifecycle-money,
+// lifecycle-human, both of whose outcomes contain a quoted grep pattern).
+function unquote(raw) {
+  if (raw.length > 1 && raw.startsWith('"') && raw.endsWith('"')) {
+    return raw.slice(1, -1).replace(/\\(["\\])/g, '$1')
+  }
+  if (raw.length > 1 && raw.startsWith("'") && raw.endsWith("'")) {
+    return raw.slice(1, -1).replace(/''/g, "'")
+  }
+  return raw
+}
+let outcome = ''
+const om = F.match(/^outcome:[ \t]*(?:\|[-+]?|>[-+]?)?[ \t]*(.*)$/m)
+if (om) {
+  if (om[1].trim()) outcome = unquote(om[1].trim())
+  else {
+    const rest = F.slice(F.indexOf(om[0]) + om[0].length)
+    const blk = rest.match(/^\n((?:[ \t]+.*\n?)+)/)
+    if (blk) outcome = blk[1].split('\n').map((l) => l.trim()).filter(Boolean).join(' ')
+  }
+}
+
+// The Status kanban — the same fact do-auto.sh's _remaining() greps.
+const openCycles = []
+for (const m of t.matchAll(/^[ \t]*- \[[ ~]\] \*{0,2}(C\d+)\*{0,2} —/gm)) {
+  if (!openCycles.includes(m[1])) openCycles.push(m[1])
+}
+
+// closed + deps — the REAL DAG, so a scheduler can stream instead of marching.
+// `batches:` is the author's flattening of this graph into rounds, and a round
+// costs its slowest member: a cycle whose own dependencies closed an hour ago
+// still waits at the barrier for an unrelated sibling. The edges themselves live
+// in the kanban's `state: blocked-on-C1,C2` clause. Emitting them lets the engine
+// start a cycle the moment ITS dependencies pass. Same source do-next.sh reads.
+const closedCycles = []
+for (const m of t.matchAll(/^[ \t]*- \[x\] \*{0,2}(C\d+)\*{0,2} —/gm)) {
+  if (!closedCycles.includes(m[1])) closedCycles.push(m[1])
+}
+const deps = {}
+for (const m of t.matchAll(/^[ \t]*- \[[x ~]\] \*{0,2}(C\d+)\*{0,2} —(.*)$/gm)) {
+  const d = m[2].match(/blocked-on-([C0-9,]+)/)
+  deps[m[1]] = d ? d[1].split(',').map((x) => x.trim()).filter(Boolean) : []
+}
+
+// Cycle headers: "## C3 — title  ⚡/★ marker"
+const cycles = {}
+const heads = [...t.matchAll(/^##[ \t]+(C\d+)[ \t]+—[ \t]+(.+)$/gm)]
+heads.forEach((m, i) => {
+  const body = t.slice(m.index, i + 1 < heads.length ? heads[i + 1].index : t.length)
+  // Repo-relative paths named anywhere in the cycle body — W1's recon list.
+  // ALWAYS repo-relative: an absolute path double-prefixes ${WT} downstream, and
+  // an LLM asked for "the file list" returns absolute paths about half the time.
+  const files = [...new Set(
+    [...body.matchAll(/(?<![\w/.-])((?:one\.ie|packages|channels|api|schema|pay|sync|backup|text|\.claude)\/[A-Za-z0-9._\/\[\]-]+\.[a-z]{2,5})/g)]
+      .map((f) => f[1].replace(/[.,)`]+$/, '')),
+  )]
+    // A path is only a recon hint if it EXISTS. Plan prose abbreviates
+    // ("api/events.ts" for one.ie/web/src/pages/api/events.ts), and a hint that
+    // resolves to nothing sends W1 hunting for a file that was never there.
+    // Existence-filtering makes the list self-validating instead of plausible.
+    .filter((f) => fs.existsSync(path.join(repo, f)))
+    .slice(0, 12)
+  cycles[m[1]] = {
+    title: m[2].replace(/\s*[⚡★].*$/, '').trim(),
+    // schema tier: touches persistent/irreversible shape (same patterns as do-tier.sh)
+    schema: /\.tql\b|migrations\/\d|\.sql\b|\.move\b|\.sol\b/.test(body),
+    fableMandatory: /\[Fable\s*—\s*mandatory\]/i.test(body),
+    files,
+  }
+})
+
+// Invariants — refuse to emit a plan that cannot be run.
+if (!batches.length) fail('frontmatter has no `batches:` — nothing to schedule')
+if (!openCycles.length) {
+  fail('no open cycles in the Status kanban. Lines must match /^[ \\t]*- \\[[ ~]\\] C<n> — /; ' +
+       'a "Batch N  - [ ] C0 — ..." prefix breaks the ^ anchor and hides the cycle')
+}
+const orphan = batches.flat().filter((c) => !cycles[c])
+if (orphan.length) fail(`batches name cycles with no "## Cn —" header: ${orphan.join(', ')}`)
+if (!outcome) fail('frontmatter has no `outcome:` kill-switch')
+
+// shared_recon: the author's own explicit file list, existence-checked the same way.
+const srm = F.match(/^shared_recon:\n((?:[ \t]+- .*\n?)+)/m)
+const sharedRecon = srm
+  ? srm[1].trim().split('\n').map((l) => l.replace(/^[\s-]+/, '').trim())
+      .filter((f) => f && fs.existsSync(path.join(repo, f)))
+  : []
+
+process.stdout.write(JSON.stringify({
+  slug,
+  sharedRecon,
+  todo: path.relative(repo, todo),
+  todoSource: todo === mainTodo ? 'main' : 'worktree',
+  worktree: path.join(repo, '.do-worktrees', slug),
+  outcome,
+  batches,
+  openCycles,
+  closedCycles,
+  deps,
+  cycles,
+  sha256: crypto.createHash('sha256').update(t).digest('hex').slice(0, 16),
+}, null, 2) + '\n')

package/scripts/do-plan-json.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# do-plan-json.sh <slug> — thin wrapper over do-plan-json.mjs (the parser).
+# manifest: portable
+# Kept as a .sh so callers match every other script in this dir; the parser is a
+# real .mjs file rather than a quoted heredoc, because embedding it inline is how
+# a stray backslash silently became invalid JSON.
+set -euo pipefail
+exec node "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/do-plan-json.mjs" "$@"