@oneie/claude 0.7.0 → 0.8.0

package/scripts/govern-claims-check.sh

@@ -0,0 +1,233 @@
+#!/usr/bin/env bash
+# govern-claims-check.sh — the two properties the claim registry exists for.
+#
+#   C1  MUTUAL EXCLUSION   two workers cannot hold the same claim
+#   C2  EVAPORATION        a dead owner's claim expires with no human in the loop
+#
+# Plus the checks that stop C1/C2 from passing against a gutted implementation:
+#   C3  the TTL branch also evaporates (the pid branch is not the only one)
+#   C4  a partial claim rolls back (a loser holds no ground)
+#   C5  do-fleet's has_conflict seam inherits the reap — the caller, not just
+#       the primitive
+#   R1/R2  RED-PROOF: with the reaper disabled, C2 and C5 must FAIL. A checker
+#       that stays green against a broken implementation is not a check.
+#
+# No coordinator anywhere in here — every worker is an independent process and
+# mkdir(2) is the only arbiter.
+#
+#   bash .claude/scripts/govern-claims-check.sh
+set -uo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SANDBOX="$(mktemp -d)"
+trap 'rm -rf "$SANDBOX"' EXIT
+
+# Point the whole library at a throwaway dir — this test must never touch the
+# real machine registry other sessions are coordinating through.
+export GOVERN_DIR="$SANDBOX/govern"
+export GOVERN_CLAIMS_DIR="$GOVERN_DIR/claims"
+# shellcheck source=lib/govern.sh
+. "$HERE/lib/govern.sh"
+
+PASS=0; FAIL=0
+ok()   { echo "  ok   $*"; PASS=$(( PASS + 1 )); }
+bad()  { echo "  FAIL $*"; FAIL=$(( FAIL + 1 )); }
+head_() { echo ""; echo "$*"; }
+
+reset_registry() { rm -rf "$GOVERN_CLAIMS_DIR"; mkdir -p "$GOVERN_CLAIMS_DIR"; }
+
+# A worker is a separate bash process that sources the library and tries to
+# claim. It records WON or LOST and then HOLDS — a worker that exits the instant
+# it wins is a DEAD owner, and the next contender would rightly reap it, so the
+# exclusion test would end up measuring evaporation instead of exclusion (it did,
+# first run: 12 winners). Nothing coordinates these processes; mkdir(2) is the
+# only arbiter between them.
+worker() { # worker <region> <slug> <outfile>
+  bash -c '
+    . "$1/lib/govern.sh"
+    if claim_take "$2" "$3"; then echo WON > "$4"; else echo LOST > "$4"; fi
+    sleep 20
+  ' _ "$HERE" "$1" "$2" "$3" >/dev/null 2>&1
+}
+
+# ─── C1 · two workers cannot hold the same claim ──────────────────────────────
+head_ "C1  mutual exclusion — N concurrent workers, one region"
+reset_registry
+N=12
+WPIDS=""
+for i in $(seq 1 $N); do
+  worker "one.ie/web/src/lib/resolvers" "fleet-$i" "$SANDBOX/w$i" &
+  WPIDS="$WPIDS $!"
+  disown %% 2>/dev/null || true   # keep the reap quiet; we kill by pid below
+done
+# Wait until every worker has decided — all of them are still holding.
+for _ in $(seq 1 100); do
+  [ "$(cat "$SANDBOX"/w* 2>/dev/null | grep -c . || true)" = "$N" ] && break
+  sleep 0.1
+done
+WON=$(cat "$SANDBOX"/w* 2>/dev/null | grep -c WON || true)
+LOST=$(cat "$SANDBOX"/w* 2>/dev/null | grep -c LOST || true)
+HOLDERS=$(claim_list | grep -c . || true)
+[ "$WON" = "1" ] && ok "exactly 1 of $N concurrent workers won the region (won=$WON lost=$LOST)" \
+                 || bad "expected exactly 1 winner, got $WON (lost=$LOST)"
+[ "$HOLDERS" = "1" ] && ok "registry holds exactly 1 claim on the region" \
+                     || bad "registry holds $HOLDERS claims on one region"
+# shellcheck disable=SC2086
+kill -9 $WPIDS 2>/dev/null || true
+rm -f "$SANDBOX"/w*
+
+# Two DIFFERENT regions must never collide into one claim. Sanitising a path
+# into a filename is lossy (a/b and a_b sanitise alike); the key must not be.
+reset_registry
+claim_take "a/b" "p1" >/dev/null 2>&1
+claim_take "a_b" "p2" >/dev/null 2>&1
+KEYS=$(claim_list | grep -c . || true)
+[ "$KEYS" = "2" ] && ok "distinct regions a/b and a_b get distinct claims (key is injective)" \
+                  || bad "a/b and a_b produced $KEYS claim(s) — the claim key collides"
+
+# ─── C2 · a dead owner's claim evaporates ─────────────────────────────────────
+head_ "C2  evaporation — kill the owner, prove the claim clears"
+reset_registry
+REGION="auth-seam"
+# Spawn a real process, let IT take the claim, then kill it. The claim outlives
+# the process on disk — that is the whole hazard.
+bash -c '. "$1/lib/govern.sh"; claim_take "$2" "dead-fleet" >/dev/null; sleep 300' \
+  _ "$HERE" "$REGION" &
+DEAD_PID=$!
+for _ in 1 2 3 4 5 6 7 8 9 10; do
+  [ -n "$(claim_owner "$REGION")" ] && break
+  sleep 0.2
+done
+OWNER_BEFORE="$(claim_owner "$REGION")"
+[ -n "$OWNER_BEFORE" ] && ok "claim is held while the owner lives ($OWNER_BEFORE)" \
+                       || bad "owner never took the claim — test is not exercising anything"
+
+kill -9 "$DEAD_PID" 2>/dev/null || true
+wait "$DEAD_PID" 2>/dev/null || true
+
+# No sweeper ran. No human intervened. The next contender's own read reaps it.
+OWNER_AFTER="$(claim_owner "$REGION")"
+[ -z "$OWNER_AFTER" ] && ok "after the owner dies, claim_owner reports nobody" \
+                      || bad "dead owner still reads as holding the claim ($OWNER_AFTER)"
+
+if claim_take "$REGION" "next-fleet"; then
+  NEW_OWNER="$(claim_owner "$REGION" | awk '{print $1}')"
+  [ "$NEW_OWNER" = "next-fleet" ] \
+    && ok "the ground is reclaimable — new owner is next-fleet" \
+    || bad "claim taken but metadata still names '$NEW_OWNER'"
+else
+  bad "a dead owner's region could not be reclaimed — evaporation failed"
+fi
+claim_release "$REGION"
+
+# ─── C3 · the TTL branch evaporates too ───────────────────────────────────────
+head_ "C3  evaporation — an expired lease clears even while the owner lives"
+reset_registry
+GOVERN_CLAIM_TTL_SECS=5400 claim_take "stale-region" "silent-fleet" >/dev/null
+KEY="$GOVERN_CLAIMS_DIR/$(_gv_claim_key "stale-region")"
+# Backdate the deposit past its lease. Owner (this shell) is very much alive,
+# so ONLY the timestamp branch can clear this.
+sed -i.bak "s/^started=.*/started=$(( $(date +%s) - 6000 ))/" "$KEY/meta" && rm -f "$KEY/meta.bak"
+[ -z "$(claim_owner "stale-region")" ] \
+  && ok "a lease older than ttl reads as free although the owner is alive" \
+  || bad "expired lease still reads as held — the TTL branch never fires"
+
+# …and an in-lease claim from a live owner is NOT reaped (the check can say no).
+reset_registry
+claim_take "fresh-region" "live-fleet" >/dev/null
+[ -n "$(claim_owner "fresh-region")" ] \
+  && ok "a fresh claim from a live owner is still held (reaper is not indiscriminate)" \
+  || bad "reaper cleared a live, in-lease claim"
+claim_release "fresh-region"
+
+# ─── C4 · partial claim rolls back ────────────────────────────────────────────
+head_ "C4  rollback — a worker that loses one region holds none"
+reset_registry
+# Another live worker owns region B.
+bash -c '. "$1/lib/govern.sh"; claim_take "regionB" "other" >/dev/null; sleep 60' _ "$HERE" &
+OTHER=$!
+for _ in 1 2 3 4 5 6 7 8 9 10; do [ -n "$(claim_owner regionB)" ] && break; sleep 0.2; done
+# Our worker wants A and B; it must end up holding neither.
+bash -c '
+  . "$1/lib/govern.sh"
+  taken=()
+  for r in regionA regionB; do
+    if claim_take "$r" "mine"; then taken+=("$r"); else
+      for t in "${taken[@]}"; do claim_release "$t"; done
+      exit 1
+    fi
+  done
+  exit 0' _ "$HERE" 2>/dev/null
+[ $? -ne 0 ] && ok "the multi-region worker correctly failed" || bad "worker claimed a region another holds"
+[ -z "$(claim_owner regionA)" ] \
+  && ok "regionA was released on rollback — no orphan ground" \
+  || bad "regionA left claimed by a worker that never launched"
+kill -9 "$OTHER" 2>/dev/null || true; wait "$OTHER" 2>/dev/null || true
+
+# ─── C5 · the do-fleet seam inherits the reap ─────────────────────────────────
+head_ "C5  seam — do-fleet's REAL has_conflict/free_dirs read through the reaper"
+reset_registry
+# Lift the ACTUAL function bodies out of do-fleet.sh — not a hand-written copy.
+# A copy passes while the shipped function dies on an unquoted var or a stray
+# awk field, which is precisely the drift this check exists to catch.
+FLEET="$HERE/do-fleet.sh"
+eval "$(awk '/^has_conflict\(\) \{/,/^\}/' "$FLEET")"
+eval "$(awk '/^free_dirs\(\) \{/,/^\}/'   "$FLEET")"
+# do-fleet gets its dir list from do-rank.py; stub that one seam so the test
+# needs no plan files. Everything below is do-fleet's own code.
+deliverable_dirs() { case "$1" in newplan|ghostplan) echo "one.ie/web/src/pages";; *) : ;; esac; }
+declare -f has_conflict >/dev/null && ok "lifted the real has_conflict() out of do-fleet.sh" \
+                                  || bad "could not lift has_conflict() — check the awk range"
+
+bash -c '. "$1/lib/govern.sh"; claim_take "one.ie/web/src/pages" "ghostplan" >/dev/null; sleep 300' \
+  _ "$HERE" &
+GHOST=$!
+for _ in 1 2 3 4 5 6 7 8 9 10; do [ -n "$(claim_owner "one.ie/web/src/pages")" ] && break; sleep 0.2; done
+if has_conflict "newplan" >/dev/null 2>&1; then
+  ok "a live ghost blocks the region (real has_conflict says conflict)"
+else
+  bad "real has_conflict failed to see another fleet's live claim"
+fi
+kill -9 "$GHOST" 2>/dev/null || true; wait "$GHOST" 2>/dev/null || true
+if has_conflict "newplan" >/dev/null 2>&1; then
+  bad "real has_conflict still blocks on a DEAD owner — the fleet would stay wedged"
+else
+  ok "after the owner dies the real has_conflict clears — the fleet reroutes in"
+fi
+
+# free_dirs must not hand back a sentinel this slug never took.
+reset_registry
+claim_take "__ANY__" "unscoped-plan" >/dev/null
+free_dirs "newplan"          # a DIFFERENT, scoped plan finishing
+[ "$(claim_owner "__ANY__" | awk '{print $1}')" = "unscoped-plan" ] \
+  && ok "free_dirs leaves another slug's __ANY__ sentinel alone" \
+  || bad "a scoped plan's free_dirs released the unscoped plan's sole-slot claim"
+free_dirs "unscoped-plan"
+[ -z "$(claim_owner "__ANY__")" ] \
+  && ok "the sentinel's own slug can still release it" \
+  || bad "__ANY__ could not be released by its owner"
+
+# ─── R1/R2 · prove the checker can go RED ─────────────────────────────────────
+head_ "R1/R2  red-proof — with the reaper gutted, C2 and C5 must FAIL"
+reset_registry
+(
+  # A gutted implementation: the owner is always "alive", so nothing evaporates.
+  _gv_alive() { return 0; }
+  bash -c '. "$1/lib/govern.sh"; claim_take "red-region" "zombie" >/dev/null; sleep 300' \
+    _ "$HERE" &
+  Z=$!
+  for _ in 1 2 3 4 5 6 7 8 9 10; do [ -d "$GOVERN_CLAIMS_DIR/$(_gv_claim_key red-region)" ] && break; sleep 0.2; done
+  kill -9 "$Z" 2>/dev/null || true; wait "$Z" 2>/dev/null || true
+  if [ -n "$(claim_owner "red-region")" ]; then
+    echo "  ok   with _gv_alive stubbed true, the dead owner's claim does NOT clear"
+    echo "       -> C2/C5 are testing the reaper, not an empty directory"
+    exit 0
+  fi
+  echo "  FAIL C2/C5 pass even with the reaper disabled — they prove nothing"
+  exit 1
+)
+if [ $? -eq 0 ]; then PASS=$(( PASS + 1 )); else FAIL=$(( FAIL + 1 )); fi
+
+echo ""
+echo "govern-claims-check: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ] || exit 1

package/scripts/govern-mem-check.sh

@@ -0,0 +1,290 @@
+#!/usr/bin/env bash
+# govern-mem-check.sh — prove the machine governor's memory probe can say NO.
+#
+#   bash .claude/scripts/govern-mem-check.sh            # all checks
+#   bash .claude/scripts/govern-mem-check.sh --self-test # same, explicit
+#   bash .claude/scripts/govern-mem-check.sh --live      # just read this box
+#
+# WHY THIS EXISTS
+# gate_headroom used to compute availability as
+#     hw.memsize * (memory_pressure "free percentage") / 100
+# and that percentage counts reclaimable memory — file cache, purgeable, and
+# already-compressed pages — as free. It is a PRESSURE signal, not a quantity.
+# Measured three times on one 24GB box, all while ~1% of RAM was actually free
+# and 9-12 GB sat in swap, the old probe answered "room for 2 / 7 / 7 more
+# 2GB cycles". A governor that cannot say no is not a governor.
+#
+# Every check below drives a SYNTHETIC machine state — a fake vm_stat, a fake
+# memory_pressure block and a fake vm.swapusage line, together, so the old
+# formula and the new one see the SAME input and the comparison is honest.
+# Stubbing is done by overriding _gv_vm_stat / _gv_swapusage / _gv_memsize,
+# the same idiom govern-claims-check.sh uses to stub _gv_alive.
+#
+# Nothing here touches the real machine, the real $GOVERN_DIR, or any gate.
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT" || exit 1
+
+# Sandbox: never touch the machine-wide governor dir.
+export GOVERN_DIR="${TMPDIR:-/tmp}/one-govern-memcheck.$$"
+mkdir -p "$GOVERN_DIR"
+trap 'rm -rf "$GOVERN_DIR"' EXIT
+
+# shellcheck source=lib/govern.sh
+. "$ROOT/.claude/scripts/lib/govern.sh"
+
+PASS=0; FAIL=0
+ok()   { PASS=$((PASS+1)); printf '  \033[32mPASS\033[0m  %s\n' "$*"; }
+bad()  { FAIL=$((FAIL+1)); printf '  \033[31mFAIL\033[0m  %s\n' "$*"; }
+hdr()  { printf '\n\033[1m%s\033[0m\n' "$*"; }
+
+# ── the pre-fix arithmetic, VERBATIM ────────────────────────────────────────
+# Copied unchanged from lib/govern.sh before 2026-09-03 (the `deploy-gate-check.sh`
+# idiom: carry the old code so the red proof is a real comparison, not a story).
+_old_gate_headroom() {
+  local total_gb free_pct avail_gb usable_gb per_cycle reserve slots
+  total_gb=$(( $(_gv_memsize 2>/dev/null || echo 0) / 1073741824 ))
+  [ "$total_gb" -lt 1 ] && { echo 99; return 0; }
+  free_pct=$(_gv_memory_pressure 2>/dev/null | awk -F': ' '/free percentage/{gsub(/%/,"",$2); print int($2)}')
+  [ -z "$free_pct" ] && { echo 99; return 0; }
+  per_cycle="${GOVERN_GB_PER_CYCLE:-2}"
+  reserve="${GOVERN_RESERVE_GB:-2}"
+  avail_gb=$(( total_gb * free_pct / 100 ))
+  usable_gb=$(( avail_gb - reserve ))
+  [ "$usable_gb" -lt 0 ] && usable_gb=0
+  slots=$(( usable_gb / per_cycle ))
+  [ "$slots" -lt 1 ] && slots=1
+  echo "$slots"
+}
+_old_gate_pressure() {
+  local free_pct
+  free_pct=$(_gv_memory_pressure 2>/dev/null | awk -F': ' '/free percentage/{gsub(/%/,"",$2); print $2}')
+  [ -z "$free_pct" ] && return 0
+  [ "$free_pct" -lt "${GOVERN_MIN_FREE_PCT:-12}" ] && return 1
+  return 0
+}
+
+# ── synthetic machine states ────────────────────────────────────────────────
+# All on a 24 GB / 16384-byte-page box, so hw.memsize is constant and only the
+# page counts move. FIX_* are set by fixture(); the stubs read them.
+FIX_FREE=0; FIX_PURGE=0; FIX_INACT=0; FIX_FILEBK=0; FIX_ACTIVE=0; FIX_WIRED=0
+FIX_COMPRESSOR=0; FIX_PCT=0; FIX_SWAP_USED="0.00"; FIX_SWAP_TOTAL="0.00"
+FIX_MODE=normal   # normal | empty | garbage | nopagesize
+
+_gv_memsize()   { [ "$FIX_MODE" = "nomemsize" ] && return 1; echo 25769803776; }
+_gv_swapusage() { echo "total = ${FIX_SWAP_TOTAL}M  used = ${FIX_SWAP_USED}M  free = 0.00M  (encrypted)"; }
+_gv_memory_pressure() {
+  cat <<PRESSURE
+Swapins: 1614739
+Swapouts: 2928367
+
+Page Q counts:
+Pages active: $FIX_ACTIVE
+Pages inactive: $FIX_INACT
+Pages speculative: 6772
+Pages throttled: 0
+Pages wired down: $FIX_WIRED
+
+Compressor Stats:
+Pages used by compressor: $FIX_COMPRESSOR
+
+System-wide memory free percentage: ${FIX_PCT}%
+PRESSURE
+}
+_gv_vm_stat() {
+  case "$FIX_MODE" in
+    empty)      return 0 ;;
+    garbage)    echo "vm_stat: command not found"; return 0 ;;
+    nopagesize) echo "Mach Virtual Memory Statistics:" ;;
+    *)          echo "Mach Virtual Memory Statistics: (page size of 16384 bytes)" ;;
+  esac
+  cat <<VMSTAT
+Pages free:                                   $FIX_FREE.
+Pages active:                                 $FIX_ACTIVE.
+Pages inactive:                               $FIX_INACT.
+Pages speculative:                              6772.
+Pages throttled:                                   0.
+Pages wired down:                             $FIX_WIRED.
+Pages purgeable:                              $FIX_PURGE.
+File-backed pages:                            $FIX_FILEBK.
+Anonymous pages:                              893951.
+Pages occupied by compressor:                 $FIX_COMPRESSOR.
+Swapins:                                     1614739.
+Swapouts:                                    2928367.
+VMSTAT
+}
+
+fixture() {
+  FIX_MODE=normal
+  case "$1" in
+    # ── The live reading taken 2026-09-03 at load 8, verbatim from vm_stat and
+    #    memory_pressure on the box the operator was complaining about. It
+    #    reproduces Receipt B: 1.3% of RAM free, 9.4 GB in swap, probe says 7.
+    thrash-now)
+      FIX_FREE=21032; FIX_PURGE=646; FIX_INACT=547837; FIX_FILEBK=216477
+      FIX_ACTIVE=555819; FIX_WIRED=250202; FIX_COMPRESSOR=135982
+      FIX_PCT=74; FIX_SWAP_USED="9400.56"; FIX_SWAP_TOTAL="10240.00" ;;
+    # ── Receipt A: the verifier's sample at load 27, with hook:load-guard itself
+    #    reporting the machine saturated. free 15798 pages, compressor 8.7 GB,
+    #    swap 11997/13312 M, memory_pressure 32%. Old probe answered 2.
+    thrash-A)
+      FIX_FREE=15798; FIX_PURGE=500; FIX_INACT=137812; FIX_FILEBK=100000
+      FIX_ACTIVE=600000; FIX_WIRED=250000; FIX_COMPRESSOR=569254
+      FIX_PCT=32; FIX_SWAP_USED="11997.44"; FIX_SWAP_TOTAL="13312.00" ;;
+    # ── The row that kills a swap-subtraction design: genuinely idle NOW
+    #    (8 GB free, 6 GB cache) but macOS has not released the 9.4 GB swapfile
+    #    it grew an hour ago. A probe that charges for history serialises this.
+    recovered-idle)
+      FIX_FREE=524288; FIX_PURGE=1000; FIX_INACT=655360; FIX_FILEBK=393216
+      FIX_ACTIVE=200000; FIX_WIRED=200000; FIX_COMPRESSOR=50000
+      FIX_PCT=85; FIX_SWAP_USED="9400.56"; FIX_SWAP_TOTAL="10240.00" ;;
+    # ── Fresh idle: 12 GB free, swap never grown.
+    fresh-idle)
+      FIX_FREE=786432; FIX_PURGE=500; FIX_INACT=65536; FIX_FILEBK=131072
+      FIX_ACTIVE=100000; FIX_WIRED=150000; FIX_COMPRESSOR=20000
+      FIX_PCT=90; FIX_SWAP_USED="0.00"; FIX_SWAP_TOTAL="0.00" ;;
+    # ── Absurd: nothing available at all. Must floor to 1, never 0 —
+    #    do-fleet.sh clamps its slot count to this with no floor of its own.
+    starved)
+      FIX_FREE=0; FIX_PURGE=0; FIX_INACT=0; FIX_FILEBK=0
+      FIX_ACTIVE=1000000; FIX_WIRED=500000; FIX_COMPRESSOR=72864
+      FIX_PCT=1; FIX_SWAP_USED="16000.00"; FIX_SWAP_TOTAL="16384.00" ;;
+    *) echo "unknown fixture $1" >&2; exit 2 ;;
+  esac
+}
+
+# The environment the checks are scored in: the box's real settings.json values
+# minus the stale GOVERN_GB_PER_CYCLE pin, so the derived price is live.
+unset GOVERN_GB_PER_CYCLE
+export GOVERN_RESERVE_GB=3
+export VITEST_MAX_FORKS=4          # what a Claude Code session actually sets
+
+[ "${1:-}" = "--live" ] && { echo "live: $(gate_mem_report)"; exit 0; }
+
+# ═══════════════════════════════════════════════════════════════════════════
+hdr "1. THRASH — the new probe says no, and the OLD one says yes (red proof)"
+for st in thrash-now thrash-A; do
+  fixture "$st"
+  new=$(gate_headroom); old=$(_old_gate_headroom)
+  avail=$(gate_mem_avail_mb)
+  oldpct=$FIX_PCT
+  if _old_gate_pressure; then oldp="0 (has headroom)"; else oldp="1 (thrashing)"; fi
+  if gate_pressure;      then newp="0 (has headroom)"; else newp="1 (thrashing)"; fi
+  echo "  [$st] memory_pressure says ${oldpct}% free · vm_stat says $((FIX_FREE*16384/1048576))MB free · swap ${FIX_SWAP_USED}M used"
+  echo "        OLD: headroom=$old  pressure=$oldp        NEW: avail=${avail}MB headroom=$new  pressure=$newp"
+  [ "$new" -eq 1 ] && ok "$st: new cap FELL to 1" || bad "$st: new cap is $new, expected 1"
+  [ "$old" -gt 1 ] && ok "$st: OLD arithmetic authorised $old cycles on this same state (red proof)" \
+                   || bad "$st: OLD arithmetic did not over-authorise — red proof is inert"
+  _old_gate_pressure && ok "$st: OLD gate_pressure called it healthy (red proof)" \
+                     || bad "$st: OLD gate_pressure already fired — red proof is inert"
+  gate_pressure && bad "$st: NEW gate_pressure still calls it healthy" \
+                || ok "$st: NEW gate_pressure fires"
+done
+
+hdr "2. HEALTHY — not replaced by a serialising bug"
+for st in recovered-idle fresh-idle; do
+  fixture "$st"
+  new=$(gate_headroom); avail=$(gate_mem_avail_mb)
+  echo "  [$st] avail=${avail}MB  swap ${FIX_SWAP_USED}M used  ->  headroom=$new"
+  [ "$new" -ge 2 ] && ok "$st: healthy box still funds $new cycles (>=2)" \
+                   || bad "$st: healthy box collapsed to $new — this is the serialising bug"
+  gate_pressure && ok "$st: gate_pressure stays quiet" || bad "$st: gate_pressure fired on a healthy box"
+done
+echo "  (recovered-idle is the row that refutes any design subtracting vm.swapusage:"
+echo "   9.4GB of stale swap would drive it to 1 while 8GB of RAM sits free.)"
+
+hdr "3. BROKEN SENSOR — 99, never 0, never 1"
+for mode in empty garbage nopagesize; do
+  fixture thrash-now; FIX_MODE="$mode"
+  h=$(gate_headroom)
+  [ "$h" = "99" ] && ok "vm_stat '$mode' -> headroom=99 (do not constrain)" \
+                  || bad "vm_stat '$mode' -> headroom=$h, expected 99"
+  gate_pressure && ok "vm_stat '$mode' -> gate_pressure does not block" \
+                || bad "vm_stat '$mode' -> gate_pressure blocked on a broken probe"
+done
+
+hdr "4. FLOOR — a starved box slows down, it never stops"
+fixture starved
+h=$(gate_headroom); a=$(gate_mem_avail_mb)
+echo "  avail=${a}MB, reserve=$((GOVERN_RESERVE_GB*1024))MB, price=$(gate_price_mb)MB -> headroom=$h"
+[ "$h" = "1" ] && ok "starved box -> 1 (do-fleet.sh clamps to this with no floor of its own; 0 would launch nothing)" \
+               || bad "starved box -> $h, expected 1"
+
+hdr "5. PRICE — derived from the live fork count, not a stale constant"
+p4=$(VITEST_MAX_FORKS=4 gate_price_mb)
+p8=$(VITEST_MAX_FORKS=8 gate_price_mb)
+pdef=$(unset VITEST_MAX_FORKS; gate_price_mb)
+povr=$(GOVERN_GB_PER_CYCLE=2 gate_price_mb)
+echo "  forks=4 -> ${p4}MB · forks=8 -> ${p8}MB · unset -> ${pdef}MB · GOVERN_GB_PER_CYCLE=2 -> ${povr}MB"
+[ "$p8" -gt "$p4" ]  && ok "price tracks fork count (8 forks cost more than 4)" || bad "price ignores fork count"
+[ "$p4" -gt 2048 ]   && ok "a 4-fork slot is priced above the old flat 2048MB" || bad "4-fork slot still priced at or below the stale constant ($p4)"
+[ "$pdef" = "$p8" ]  && ok "unset VITEST_MAX_FORKS prices the config default of 8" || bad "unset != 8-fork price"
+[ "$povr" = "2048" ] && ok "explicit GOVERN_GB_PER_CYCLE still wins (operator override)" || bad "override ignored"
+if grep -q '"GOVERN_GB_PER_CYCLE"' "$ROOT/.claude/settings.json" 2>/dev/null; then
+  bad "settings.json still pins GOVERN_GB_PER_CYCLE — the derivation is dead code in every Claude Code session"
+else
+  ok "settings.json no longer pins GOVERN_GB_PER_CYCLE"
+fi
+
+hdr "6. SELF-RED — gut the probe and the checks above MUST go red"
+# A checker that stays green against a gutted probe proves nothing
+# (govern-claims-check.sh stubs _gv_alive for exactly this reason). Here we
+# put the OLD arithmetic back behind the new name and re-run section 1's
+# assertions: they have to fail.
+_saved_headroom=$(declare -f gate_headroom)
+_saved_pressure=$(declare -f gate_pressure)
+gate_headroom() { _old_gate_headroom; }
+gate_pressure() { _old_gate_pressure; }
+red=0
+for st in thrash-now thrash-A; do
+  fixture "$st"
+  h=$(gate_headroom)
+  [ "$h" -eq 1 ] || red=$((red+1))
+  gate_pressure && red=$((red+1))
+done
+if [ "$red" -ge 4 ]; then
+  ok "with the old arithmetic restored, all 4 thrash assertions fail ($red/4) — the checks have power"
+else
+  bad "gutted probe still satisfied $(( 4 - red ))/4 thrash assertions — this checker proves nothing"
+fi
+eval "$_saved_headroom"; eval "$_saved_pressure"
+
+hdr "7. LOAD-GUARD's MEMORY ARM — the one site that actually BLOCKS"
+# load-guard-check.sh exercises the regex classifier (which commands count as
+# heavy), never the memory state. This drives the real hook against the REAL
+# box with only the memory threshold moving, so the arm is seen firing AND
+# staying silent — a guard only ever seen to fire is an unproven guard. The load
+# and running-gate arms are pinned out of the way so nothing else can explain
+# the verdict.
+_lg_run() {  # _lg_run <GUARD_MIN_FREE_PCT> -> prints "deny" or "allow"
+  local out
+  out=$(CLAUDE_PROJECT_DIR="$ROOT" GUARD_MIN_FREE_PCT="$1" \
+        GUARD_LOAD_FACTOR=100000 GUARD_MAX_RUNNING=100000 \
+        bash "$ROOT/.claude/hooks/load-guard.sh" \
+        '{"tool_name":"Bash","tool_input":{"command":"bunx vitest run"}}' 2>/dev/null)
+  case "$out" in *'"deny"'*) echo deny ;; *) echo allow ;; esac
+}
+_lg_hi=$(_lg_run 101)   # threshold above any possible reading -> must deny
+_lg_lo=$(_lg_run 0)     # threshold below any possible reading -> must allow
+echo "  GUARD_MIN_FREE_PCT=101 -> $_lg_hi   ·   GUARD_MIN_FREE_PCT=0 -> $_lg_lo"
+[ "$_lg_hi" = "deny" ]  && ok "memory arm FIRES (hook emits a deny decision, does not crash open)" \
+                        || bad "memory arm did not fire — the blocking hook failed OPEN"
+[ "$_lg_lo" = "allow" ] && ok "memory arm stays silent on a satisfied threshold" \
+                        || bad "memory arm fires unconditionally — it is not reading memory"
+# And it must survive a probe that cannot be read at all: point the hook at a
+# project dir with no govern.sh. FREE falls back to 100, so the arm goes quiet
+# rather than taking the hook down with it.
+_lg_nolib=$(CLAUDE_PROJECT_DIR="$GOVERN_DIR" GUARD_MIN_FREE_PCT=101 \
+            GUARD_LOAD_FACTOR=100000 GUARD_MAX_RUNNING=100000 \
+            bash "$ROOT/.claude/hooks/load-guard.sh" \
+            '{"tool_name":"Bash","tool_input":{"command":"bunx vitest run"}}' 2>/dev/null; echo "rc=$?")
+case "$_lg_nolib" in
+  *rc=0*) ok "missing govern.sh -> hook still exits 0 (FREE=100, arm silent, nothing crashes)" ;;
+  *)      bad "missing govern.sh -> hook exited non-zero: $_lg_nolib" ;;
+esac
+
+hdr "RESULT"
+echo "  $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ] || { echo "  GOVERN-MEM-CHECK: RED"; exit 1; }
+echo "  GOVERN-MEM-CHECK: GREEN"