@oneie/claude 0.7.0 → 0.8.0

package/scripts/fleet-status.sh

@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+# fleet-status.sh — what the board looks like right now.
+# Reads the machine, the worktrees and the fleet docs. No agents, no cost.
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT"
+
+C_DIM=$'\033[2m'; C_OK=$'\033[32m'; C_WARN=$'\033[33m'; C_BAD=$'\033[31m'; C_0=$'\033[0m'; C_B=$'\033[1m'
+
+printf '%s\n' "${C_B}   ██████╗ ███╗   ██╗███████╗${C_0}"
+printf '%s\n' "${C_B}  ██╔═══██╗████╗  ██║██╔════╝${C_0}"
+printf '%s\n' "${C_B}  ██║   ██║██╔██╗ ██║█████╗  ${C_0}  ${C_DIM}probe · fan out · join${C_0}"
+printf '%s\n' "${C_B}  ██║   ██║██║╚██╗██║██╔══╝  ${C_0}  ${C_DIM}no conductor · no collisions${C_0}"
+printf '%s\n' "${C_B}  ╚██████╔╝██║ ╚████║███████╗${C_0}"
+printf '%s\n' "${C_B}   ╚═════╝ ╚═╝  ╚═══╝╚══════╝${C_0}"
+echo
+
+# ── the box ────────────────────────────────────────────────────────────────
+cores=$(sysctl -n hw.ncpu 2>/dev/null || echo '?')
+memgb=$(( $(sysctl -n hw.memsize 2>/dev/null || echo 0) / 1073741824 ))
+load=$(uptime | sed 's/.*load averages*: *//' | awk '{print $1}')
+# This board had a THIRD memory arithmetic of its own: (free+inactive) over
+# (free+inactive+active+wired). It counted every inactive page as free, dirty
+# anonymous ones included, and ignored the compressor entirely — on 2026-09-03
+# it printed 41% while vm_stat said 1.3% free and 9.4 GB sat in swap. One honest
+# probe now answers for the whole harness.
+# shellcheck source=lib/govern.sh
+. "$ROOT/.claude/scripts/lib/govern.sh"
+availmb=$(gate_mem_avail_mb 2>/dev/null || echo "")
+freepct='?'; [ -n "$availmb" ] && [ "$memgb" -gt 0 ] && freepct=$(( availmb * 100 / (memgb * 1024) ))
+swapused=$(sysctl -n vm.swapusage 2>/dev/null | sed 's/.*used = \([0-9.]*\)M.*/\1/')
+
+lc=$(printf '%.0f' "${load:-0}" 2>/dev/null || echo 0)
+if   [ "$lc" -lt "$((cores))" ]; then lcol=$C_OK
+elif [ "$lc" -lt "$((cores*2))" ]; then lcol=$C_WARN
+else lcol=$C_BAD; fi
+
+printf '  %-14s %s cores · %s GB\n' 'box' "$cores" "$memgb"
+printf '  %-14s %b%s%b   %s free mem   swap %s M\n' 'load' "$lcol" "${load:-?}" "$C_0" "${freepct:-?}%" "${swapused:-?}"
+
+# how many cycles can this box actually afford? Ask the governor rather than
+# keeping a second copy of its arithmetic — that copy is how this line drifted.
+res=${GOVERN_RESERVE_GB:-2}
+permb=$(gate_price_mb)
+slots=$(gate_headroom)
+capc=$(( cores - 2 )); [ "$slots" -gt "$capc" ] && slots=$capc
+bind='memory'; [ "$slots" -eq "$capc" ] && bind='cores'
+printf '  %-14s %s  %b(bound by %s · %sMB/cycle · %sGB reserved)%b\n' 'affordable' "$slots" "$C_DIM" "$bind" "$permb" "$res" "$C_0"
+
+gates=$(ls -d "${TMPDIR:-/tmp}"/one-govern/lock-slot-* 2>/dev/null | wc -l | tr -d ' ')
+printf '  %-14s %s held / %s max\n' 'gate slots' "$gates" "${GOVERN_MAX_GATES:-2}"
+
+orph=$(pgrep -f 'esbuild|vite/node_modules' 2>/dev/null | wc -l | tr -d ' ')
+if [ "$orph" -gt 0 ]; then
+  printf '  %-14s %b%s%b  %bpkill -f "esbuild|vite/node_modules"%b\n' 'orphans' "$C_WARN" "$orph" "$C_0" "$C_DIM" "$C_0"
+fi
+echo
+
+# ── worktrees ──────────────────────────────────────────────────────────────
+wt=$(git worktree list 2>/dev/null | wc -l | tr -d ' ')
+wtsz=$(du -sh .claude/worktrees 2>/dev/null | cut -f1)
+printf '  %-14s %s  %s  %b(~120MB + one tsserver each)%b\n' 'worktrees' "$wt" "${wtsz:-0}" "$C_DIM" "$C_0"
+echo
+
+# ── the board ──────────────────────────────────────────────────────────────
+printf '  %bFLEET%b\n' "$C_B" "$C_0"
+while IFS='|' read -r name doc; do
+  [ -z "$name" ] && continue
+  if [ -f "$doc" ]; then
+    lines=$(wc -l < "$doc" | tr -d ' ')
+    open=$(grep -ci 'NOT WIRED\|NOT MEASURED\|DARK —' "$doc" 2>/dev/null | head -1 | tr -dc '0-9')
+    open=${open:-0}
+    if [ "$open" -gt 0 ]; then
+      printf '   %b●%b %-13s %-38s %4s lines  %b%s open%b\n' "$C_WARN" "$C_0" "$name" "$doc" "$lines" "$C_WARN" "$open" "$C_0"
+    else
+      printf '   %b●%b %-13s %-38s %4s lines\n' "$C_OK" "$C_0" "$name" "$doc" "$lines"
+    fi
+  else
+    printf '   %b○%b %-13s %-38s %bnot written%b\n' "$C_DIM" "$C_0" "$name" "$doc" "$C_DIM" "$C_0"
+  fi
+done < <(
+  # Single source of the fleet -> doc map: .claude/scripts/fleet-manifest.mjs,
+  # which also feeds /u/one/engineering/fleets. Regenerated here so the CLI and
+  # the page can never disagree about which fleets exist. Emits nothing if the
+  # manifest is missing — a visibly empty board beats a stale second copy.
+  node .claude/scripts/fleet-manifest.mjs >/dev/null 2>&1
+  node -e '
+    const fs=require("fs");
+    const p="one.ie/web/src/data/fleets.json";
+    if(!fs.existsSync(p)) process.exit(0);
+    for(const f of JSON.parse(fs.readFileSync(p,"utf8")).board)
+      console.log(f.name+"|"+(f.doc||"(no doc written)"));
+  ' 2>/dev/null
+)
+echo
+
+# ── the wall ───────────────────────────────────────────────────────────────
+DB=$(ls one.ie/web/.wrangler/state/v3/d1/miniflare-D1DatabaseObject/*.sqlite 2>/dev/null | head -1)
+if [ -n "$DB" ] && command -v sqlite3 >/dev/null 2>&1; then
+  owners=$(sqlite3 "$DB" "SELECT COUNT(*) FROM owners;" 2>/dev/null)
+  charge=$(sqlite3 "$DB" "SELECT COUNT(*) FROM owners WHERE charges_enabled=1;" 2>/dev/null)
+  addrs=$(sqlite3 "$DB" "SELECT COUNT(*) FROM wallets WHERE sui_address IS NOT NULL AND sui_address!='';" 2>/dev/null)
+  sales=$(sqlite3 "$DB" "SELECT COUNT(*) FROM credit_grants WHERE source='credits_product_sale';" 2>/dev/null)
+  printf '  %bTHE FUNNEL%b  %b(local mirror of prod)%b\n' "$C_B" "$C_0" "$C_DIM" "$C_0"
+  printf '   owners %-6s  can charge %b%-4s%b  wallets w/ address %b%-4s%b  sales %b%s%b\n' \
+    "${owners:-?}" "$C_BAD" "${charge:-?}" "$C_0" "$C_BAD" "${addrs:-?}" "$C_0" "$C_WARN" "${sales:-?}" "$C_0"
+  echo
+fi
+
+printf '  %bnext%b  re-measure (/one §1) · sweep worktrees · then fan out\n' "$C_DIM" "$C_0"

package/scripts/full-suite-paths-check.sh

@@ -0,0 +1,144 @@
+#!/bin/bash
+# full-suite-paths-check.sh — sweep for unaccounted paths to the full test suite
+#
+# The full suite is run in three places: package.json callers (via test-full.sh),
+# hooks, and outcome: strings in text/*-todo.md. This script sweeps all three
+# surfaces and compares against a reviewed allowlist.
+#
+# manifest: portable
+#
+# Exit 0: all paths accounted for.
+# Exit 1: a path found that is not in the allowlist (new caller, new hook, new outcome).
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+# --- The allowlist — paths we have reviewed and accept -----------------------
+# Format:
+#   caller:<file>:<pattern>  — a package.json script that runs the full suite
+#   hook:<file>              — a hook that runs the full suite
+#   outcome:<file>:<line>    — an outcome: string in a todo file
+#
+# This list is built by examining the sources and is NOT auto-generated.
+ALLOWLIST=(
+  # Package.json callers: test-full.sh --check verifies no duplicates here
+  # (gates route through test-full.sh, not duplicated across callers)
+
+  # Hooks: must not run the full suite (but may mention it in comments)
+  # task-complete-verify.sh had bun run verify removed (documented in comments)
+
+  # Outcome strings in text/*-todo.md (these are the 15 known paths that need
+  # to be routed through gate-run.sh or otherwise accounted for)
+  "outcome:text/best-practices-todo.md:12"
+  "outcome:text/blocks-todo.md:17"
+  "outcome:text/campaigns-reimagined-todo.md:12"
+  "outcome:text/composio-todo.md:13"
+  "outcome:text/dashboard-personas-todo.md:10"
+  "outcome:text/dashboard-todo.md:10"
+  "outcome:text/inbox-simplify-todo.md:10"
+  "outcome:text/inbox-ui-simple-todo.md:10"
+  "outcome:text/inbox-ui-todo.md:11"
+  "outcome:text/lifecycle-loop-todo.md:21"
+  "outcome:text/pack-starter-workflows-todo.md:12"
+  "outcome:text/payments-integrated-todo.md:29"
+  "outcome:text/roles-act-as-switcher-todo.md:11"
+  "outcome:text/roles-final-todo.md:10"
+  "outcome:text/voice-agents-todo.md:13"
+)
+
+# --- Check package.json callers -----------------------------------------------
+# test-full.sh --check ensures no caller duplicates the vitest argv
+if ! bash "$ROOT/.claude/scripts/test-full.sh" --check; then
+  echo "FAIL: test-full.sh --check found a duplicate caller" >&2
+  exit 1
+fi
+echo "✓ package.json callers: test-full.sh --check passed"
+
+# --- Sweep hooks for full suite invocations ----------------------------------
+# Read all hooks and look for patterns that EXECUTE the full suite.
+# We exclude: comments (#), error message output (echo/cat), code examples in help text.
+# We include: actual shell execution like $(bun run verify) or command substitution.
+found_hooks=()
+for hook in "$ROOT"/.claude/hooks/*.sh; do
+  [ -f "$hook" ] || continue
+  # Look for ACTUAL EXECUTION patterns:
+  #  - $(bun run verify) — command substitution (not in echo/cat/string)
+  # Ignore: comments (#), plain text mentions in error messages
+  if grep -E '^\s*\$\(.*bun run verify' "$hook" >/dev/null 2>&1; then
+    found_hooks+=("$(basename "$hook")")
+  fi
+done
+
+if [ ${#found_hooks[@]} -gt 0 ]; then
+  echo "FAIL: hooks running full suite (should be routed through gate-run.sh or removed):" >&2
+  for h in "${found_hooks[@]}"; do
+    echo "  hook:$h" >&2
+  done
+  exit 1
+fi
+echo "✓ hooks: none running full suite directly"
+
+# --- Sweep outcome: strings in todo files ------------------------------------
+# Count each `outcome:` field that contains `bun run verify` and check against allowlist
+found_outcomes=()
+for todofile in "$ROOT"/text/*-todo.md; do
+  [ -f "$todofile" ] || continue
+  # Use relative path from ROOT (e.g., text/best-practices-todo.md)
+  relpath="${todofile#$ROOT/}"
+
+  # Find all lines with outcome: (frontmatter field or inline)
+  while IFS=: read -r linenum line; do
+    # Check if this line contains bun run verify (unrouted)
+    if echo "$line" | grep -q "bun run verify"; then
+      found_outcomes+=("outcome:$relpath:$linenum")
+    fi
+  done < <(grep -n "^outcome:" "$todofile" 2>/dev/null || true)
+done
+
+# --- Compare against allowlist -----------------------------------------------
+failed=0
+
+# Check for new outcomes not in allowlist
+if [ ${#found_outcomes[@]:-0} -gt 0 ]; then
+  for found in "${found_outcomes[@]}"; do
+    in_allowlist=0
+    for allowed in "${ALLOWLIST[@]}"; do
+      if [ "$found" = "$allowed" ]; then
+        in_allowlist=1
+        break
+      fi
+    done
+    if [ $in_allowlist -eq 0 ]; then
+      echo "FAIL: unaccounted path to full suite: $found" >&2
+      failed=1
+    fi
+  done
+fi
+
+# Check for allowlist entries that no longer exist (removed paths)
+for allowed in "${ALLOWLIST[@]}"; do
+  found_match=0
+  if [ ${#found_outcomes[@]:-0} -gt 0 ]; then
+    for found in "${found_outcomes[@]}"; do
+      if [ "$found" = "$allowed" ]; then
+        found_match=1
+        break
+      fi
+    done
+  fi
+  if [ $found_match -eq 0 ]; then
+    # Extract the file:line from the allowlist entry
+    if [[ $allowed == outcome:* ]]; then
+      echo "INFO: allowlist entry no longer exists (may be fixed): $allowed" >&2
+    fi
+  fi
+done
+
+if [ $failed -eq 1 ]; then
+  exit 1
+fi
+
+echo "✓ outcome strings: all ${#found_outcomes[@]} accounted for"
+echo "✓ full-suite-paths-check.sh: all paths verified"
+exit 0

package/scripts/gate-reaper.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# gate-reaper.sh — reap ABANDONED gates, so a stalled fleet cannot poison the box.
+#
+# manifest: portable
+#
+# WHY (measured 2026-08-31). Two fleets were running and the box sat at load 138
+# on 10 cores with swap at 4.3G of 5.1G. The cause was not the live work: four
+# processes had been reparented to launchd (ppid=1) when their parent shell died
+# and were still burning CPU — a `bun run verify` abandoned for 21 minutes, and a
+# gate-run.sh abandoned for 9 minutes that was STILL HOLDING governor slot-3. A
+# dead process holding a slot shrinks the effective gate cap until someone
+# notices by hand; nothing in the harness noticed.
+#
+# gate_sweep_stale reclaims the LOCK a dead owner left behind. Nothing reclaimed
+# the PROCESS. This does.
+#
+# Deliberately narrow. It kills a process only when ALL of:
+#   1. ppid == 1            — genuinely reparented; its parent is gone
+#   2. the command names THIS repo, or is a gate-run.sh / bun-run-verify shape
+#   3. it has burned real CPU time — not merely idle and forgotten
+# so a system daemon (WindowServer and coreaudiod are both ppid=1 and busy) can
+# never match, and neither can a live fleet's gate, whose parent is alive.
+#
+# Usage:  gate-reaper.sh [--once] [--interval N] [--dry-run]
+# Prints one line per reap; silent when there is nothing to do, so it is safe to
+# run as a Monitor for the length of a session.
+set -uo pipefail
+
+INTERVAL=60
+ONCE=0
+DRY=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --once) ONCE=1 ;;
+    --dry-run) DRY=1 ;;
+    --interval) INTERVAL="${2:-60}"; shift ;;
+    *) echo "gate-reaper: unknown flag $1" >&2; exit 2 ;;
+  esac
+  shift
+done
+
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# Gate on ELAPSED age, not CPU. An abandoned `bun run verify` parent sits at 0s
+# CPU while the children it spawned burn the box -- gating on the parent's own
+# CPU skipped exactly the processes worth reaping (measured: pids 79192 and
+# 84649, both 0s CPU, both abandoned). ppid=1 plus a gate shape is already
+# conclusive: a live gate always has a live parent. The age floor only avoids
+# racing a process that was reparented moments ago.
+# 90s was too eager. A gate is reparented the moment its launching shell exits,
+# and that happens to LIVE work -- the harness killing a Bash call at its timeout,
+# or a backgrounded launch -- not only to abandoned work. Reaping a 96s-old gate
+# that a fleet is still waiting on slows the plan down, which is the opposite of
+# the point. Every genuinely dead gate found by hand was 7-22 MINUTES old, and
+# the harness Bash ceiling is 600s, so a gate still orphaned past that is one
+# nobody is coming back for.
+MIN_AGE_SECS="${GATE_REAPER_MIN_AGE:-900}"
+
+# Elapsed seconds, from `ps -o etime=` (MM:SS | HH:MM:SS | D-HH:MM:SS)
+_age_secs() {
+  printf '%s' "$1" | awk -F: '
+    { d=0; s=$0
+      if (s ~ /-/) { split(s, a, "-"); d=a[1]; s=a[2]; n=split(s, b, ":") }
+      else n=split(s, b, ":")
+      if (n==3) print int(d*86400 + b[1]*3600 + b[2]*60 + b[3])
+      else if (n==2) print int(d*86400 + b[1]*60 + b[2])
+      else print int(0+s) }'
+}
+
+sweep() {
+  local pid ppid age cmd secs pgid n=0
+  while read -r pid ppid age cmd; do
+    [ "$ppid" = "1" ] || continue
+    # Match the GATE SHAPE, never "mentions the repo". The first draft keyed on
+    # the repo path and its dry run would have killed cc-connect, the Telegram
+    # listener, a `claude daemon run` and Cursor's extension host -- all of them
+    # legitimate long-lived daemons that are ppid=1 by design, exactly like an
+    # abandoned gate. A reaper that cannot tell those apart is worse than no
+    # reaper. Only these shapes are gates, and a gate is always short-lived:
+    case "$cmd" in
+      *gate-run.sh*) ;;
+      *"vitest"*) ;;
+      *"tsc --noEmit"*) ;;
+      *"astro check"*) ;;
+      *"run verify"*|*"run test"*|*"run typecheck"*) ;;
+      *) continue ;;
+    esac
+    # Belt and braces: never a daemon, an editor, or anything system-owned, even
+    # if one of the words above appears somewhere in its argv.
+    case "$cmd" in
+      */System/*|/usr/sbin/*|/usr/libexec/*|*Applications*) continue ;;
+      *cc-connect*|*tg-listen*|*"daemon run"*|*Cursor*|*Code\ Helper*) continue ;;
+      *--watch*|*watchexec*|*nodemon*) continue ;;
+    esac
+    secs=$(_age_secs "$age")
+    [ "${secs:-0}" -ge "$MIN_AGE_SECS" ] || continue
+    pgid=$(ps -o pgid= -p "$pid" 2>/dev/null | tr -d ' ')
+    if [ "$DRY" = "1" ]; then
+      echo "[gate-reaper] WOULD reap pid=$pid pgid=${pgid:-?} age=${secs}s ${cmd:0:60}"
+    else
+      echo "[gate-reaper] reaped abandoned gate pid=$pid pgid=${pgid:-?} age=${secs}s ${cmd:0:60}"
+      kill -TERM -"${pgid:-$pid}" 2>/dev/null || kill -TERM "$pid" 2>/dev/null || true
+    fi
+    n=$((n + 1))
+  done < <(ps -Ao pid=,ppid=,etime=,command= 2>/dev/null)
+
+  # A dead owner's lock shrinks the gate cap until someone contends. Reclaim it.
+  if [ "$DRY" != "1" ] && [ -f "$REPO/.claude/scripts/lib/govern.sh" ]; then
+    local reclaimed
+    reclaimed=$(bash -c ". '$REPO/.claude/scripts/lib/govern.sh'; gate_sweep_stale; claim_sweep" 2>/dev/null | tr '\n' ' ')
+    case "$reclaimed" in *[1-9]*) echo "[gate-reaper] reclaimed stale governor locks/claims: $reclaimed" ;; esac
+  fi
+  return 0
+}
+
+if [ "$ONCE" = "1" ]; then sweep; exit 0; fi
+while :; do sweep; sleep "$INTERVAL"; done

package/scripts/gate-run.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# gate-run.sh — run a heavy build gate under the machine-wide governor.
+#
+#   gate-run.sh <label> -- <command...>
+#
+# Three things it guarantees that a bare `bun run verify` does not:
+#   1. SLOT   — at most GOVERN_MAX_GATES heavy gates run machine-wide, across
+#               every Claude Code session and every worktree. Session 3+ queues.
+#   2. BOUND  — a hard wall-clock cap; macOS ships no timeout(1), so an
+#               unbounded gate ran 18 min under load and outlived its session.
+#   3. REAP   — kills the whole PROCESS GROUP on timeout/exit. Killing only the
+#               shell reparents bun/node/vitest-forks to launchd, which is how
+#               orphaned verify trees leaked here.
+#
+# Degrades to a plain exec if the governor lib is missing (CI, fresh clone).
+set -uo pipefail
+
+LABEL="${1:-gate}"; shift || true
+[ "${1:-}" = "--" ] && shift
+
+LIB="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/govern.sh"
+if [ ! -f "$LIB" ]; then exec "$@"; fi
+. "$LIB"
+
+# CI and explicit opt-out run at full throughput.
+if [ -n "${CI:-}" ] || [ "${GOVERN_DISABLE:-0}" = "1" ]; then exec "$@"; fi
+
+# Re-entrancy: `verify` calls `test`, and both are wrapped. A nested gate must
+# INHERIT the outer slot, never take a second one — two slots held by one
+# logical gate would deadlock the queue at cap 2.
+if [ "${GOVERN_IN_GATE:-0}" = "1" ]; then exec "$@"; fi
+export GOVERN_IN_GATE=1
+
+trap 'gate_release_all' EXIT INT TERM
+
+# SAY THAT YOU ARE QUEUEING.
+#
+# gate_slot blocks for up to 1800s and this script printed nothing until it had a
+# slot, so a queued gate and a hung gate looked identical to whoever was waiting.
+# Measured 2026-09-01: lifecycle C8's demo gate was reported by its verifier as
+# "timed out (>120s) and did not complete", and the cycle failed. Run directly it
+# passes 6/6 in 1.19 SECONDS. Nothing was broken — the gate was waiting behind
+# other gates in silence, and the verifier gave up and called it a hang.
+#
+# A wait that is announced is a wait. A wait that is silent is read as a failure.
+_held=$(ls -d "$GOVERN_DIR"/lock-slot-* 2>/dev/null | wc -l | tr -d ' ')
+# The EFFECTIVE cap is min(config, what memory can fund) — gate_slot takes that
+# min every retry. Announcing the config alone misreported the wait on exactly
+# the boxes where the memory probe is doing its job.
+_head=$(gate_headroom 2>/dev/null || echo 99)
+_cap="${GOVERN_MAX_GATES:-2}"
+[ "$_head" -lt "$_cap" ] 2>/dev/null && _cap="$_head"
+[ "${_cap:-0}" -lt 1 ] 2>/dev/null && _cap=1
+if [ "${_held:-0}" -ge "$_cap" ]; then
+  echo "[gate-run] $LABEL: QUEUEING for a slot (${_held}/${_cap} held; config ${GOVERN_MAX_GATES:-2}, memory funds ${_head} at $(gate_price_mb)MB each). This is a WAIT, not a hang — do not report it as a timeout. Set GOVERN_QUEUE_WAIT to bound it, or GOVERN_DISABLE=1 to bypass." >&2
+fi
+_q0=$(date +%s)
+
+if ! gate_slot "${GOVERN_QUEUE_WAIT:-1800}"; then
+  echo "[gate-run] $LABEL: no slot after ${GOVERN_QUEUE_WAIT:-1800}s — machine saturated." >&2
+  exit 1
+fi
+
+if ! gate_pressure; then
+  echo "[gate-run] $LABEL: WARNING — low free memory; running anyway in slot $GOVERN_SLOT." >&2
+fi
+
+_qw=$(( $(date +%s) - _q0 ))
+echo "[gate-run] $LABEL: running in $GOVERN_SLOT (cap ${GOVERN_MAX_GATES} machine-wide$([ "$_qw" -gt 2 ] && echo ", queued ${_qw}s"))" >&2
+run_bounded "${GOVERN_GATE_TIMEOUT:-1800}" "$@"
+rc=$?
+gate_release_all; trap - EXIT INT TERM
+exit $rc

package/scripts/gen-dev-config.py

@@ -0,0 +1,20 @@
+import json, pathlib, sys
+# Patch the ASTRO-GENERATED config (which carries `main` + the assets binding)
+# rather than hand-rolling one: wrangler.toml omits `main` by design, so a
+# standalone copy deploys as an assets-only Worker and is rejected.
+p = pathlib.Path("dist/server/wrangler.json")
+if not p.exists():
+    print("[gen-dev-config] FATAL: dist/server/wrangler.json missing - build first"); sys.exit(1)
+c = json.loads(p.read_text())
+c["name"] = "one-dev"
+c["routes"] = [{"pattern": "dev.one.ie", "custom_domain": True}]
+# STRIP CRONS. The dev worker shares production's D1/KV bindings, so inheriting
+# prod's schedules means TWO workers running the same handlers against the same
+# rows - double sends, double syncs, races. Dev observes prod data; it must not
+# also drive prod's clock. (Measured 2026-08-25: the first dev deploy shipped
+# 6 schedules including */5 * * * *.)
+for k in ("triggers", "crons"):
+    c.pop(k, None)
+out = pathlib.Path("dist/server/wrangler.dev.json")
+out.write_text(json.dumps(c, indent=2))
+print(f"[gen-dev-config] {out} -> name={c['name']} routes={c['routes']} main={c.get('main')}")

package/scripts/govern-bound-check.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# govern-bound-check.sh — prove run_bounded neither hangs its caller nor leaks
+# its watchdog. Three checks, each one a measured outage.
+#
+# manifest: portable
+#
+#   1. A CAPTURED call returns when the command returns. `$(run_bounded 60 true
+#      2>&1)` must come back in ~0s, not 60s. The watchdog used to inherit the
+#      caller's stdout (fixed 2026-09-01, `>&2`) and then its stderr (measured
+#      2026-09-03 as 1800s of nothing inside `$(… 2>&1)`, and again inside
+#      `… 2>&1 | tail`). A wait that reads as a hang gets killed at 144 = UNRUN.
+#   2. NO ORPHAN SLEEP survives a bounded call. `kill "$watch_pid"` reaped the
+#      watchdog subshell but not the `sleep` it forked — 21 `sleep 1800` with
+#      ppid 1 were on the box on 2026-09-04, each holding a dead caller's pipe.
+#   3. The bound still BITES: a command that outlives its cap is killed, the
+#      whole process group with it, and the parent says so on stderr.
+#
+# Exit 0 = all three hold · 1 = one did not. Touches nothing machine-wide:
+# GOVERN_DIR is a sandbox.
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+export GOVERN_DIR="${TMPDIR:-/tmp}/one-govern-boundcheck.$$"
+mkdir -p "$GOVERN_DIR"; trap 'rm -rf "$GOVERN_DIR"' EXIT
+# shellcheck source=lib/govern.sh
+. "$ROOT/.claude/scripts/lib/govern.sh"
+fails=0
+ok()  { printf '  ok   %s\n' "$*"; }
+bad() { printf '  FAIL %s\n' "$*"; fails=$((fails+1)); }
+now() { date +%s; }
+tag="bound-check-$$"
+
+echo "== 1. a captured call returns with the command, not with the watchdog"
+t0=$(now)
+out="$(run_bounded 61 bash -c "echo answer-$tag" 2>&1)"; rc=$?
+dt=$(( $(now) - t0 ))
+if [ "$rc" -eq 0 ] && [ "$dt" -le 3 ] && [ "$out" = "answer-$tag" ]; then ok "\$(run_bounded 60 …) returned in ${dt}s with the output intact"
+else bad "captured call took ${dt}s rc=$rc out='$out' (a 60s wait here is the watchdog holding the pipe)"; fi
+t0=$(now)
+out="$(run_bounded 61 bash -c "echo answer2-$tag" 2>&1 | cat)"
+dt=$(( $(now) - t0 ))
+[ "$dt" -le 3 ] && ok "… and through a pipe (${dt}s)" || bad "piped call took ${dt}s"
+
+echo "== 2. no orphaned watchdog sleep survives"
+sleep 1
+n=$(ps -Ao command= | grep -c "^sleep 61$")
+[ "$n" -eq 0 ] && ok "no 'sleep 61' left behind" || bad "$n orphaned 'sleep 61' still running (the watchdog's child outlived it)"
+
+echo "== 3. the bound still bites, and the group goes with it"
+t0=$(now)
+err="$(run_bounded 1 bash -c "sleep 31 & sleep 31; echo lived-$tag" 2>&1 >/dev/null)"; rc=$?
+dt=$(( $(now) - t0 ))
+if [ "$rc" -ne 0 ] && [ "$dt" -le 12 ]; then ok "a 31s command under a 1s cap died in ${dt}s (rc=$rc)"
+else bad "cap did not bite: rc=$rc after ${dt}s"; fi
+case "$err" in *TIMEOUT*) ok "the parent printed the TIMEOUT line" ;; *) bad "no TIMEOUT line on stderr: '$err'" ;; esac
+sleep 1
+n=$(ps -Ao command= | grep -c "^sleep 31$")
+[ "$n" -eq 0 ] && ok "the process group was reaped (no 'sleep 31' survivors)" || bad "$n 'sleep 31' survived the group kill"
+
+[ "$fails" -eq 0 ] && { echo "govern-bound-check: PASS"; exit 0; }
+echo "govern-bound-check: FAILED ($fails)"; exit 1