@oneie/claude 0.7.0 → 0.9.0

package/scripts/gc-content-check.sh

@@ -0,0 +1,140 @@
+#!/bin/bash
+# gc-content-check.sh — the red proof for lib/gc-finished.sh.
+#
+# manifest: portable
+#
+# Builds a sandbox repo carrying the branch shapes the sweep meets, drives the
+# REAL predicate (sourced, never re-implemented), and then proves the OLD
+# commit-count predicate gets the important one wrong. A checker that only shows
+# the new code passing would not tell you the change was worth making.
+#
+# NOT reproduced here: `git cherry`'s blind spot on a merge commit. That was
+# measured on this repo (merge/trunk-reconcile, 2026-09-07: cherry reported
+# 0-new for a branch holding 24 files and 3416 lines dev had never seen) and the
+# reasoning lives in lib/gc-finished.sh. Faking a multi-merge-base history to
+# re-stage it would be asserting a claim this sandbox does not actually show —
+# the fourth case below covers the same risk directly: a merge carrying unique
+# content must read NOT finished.
+#
+#   bash .claude/scripts/gc-content-check.sh    # exits non-zero on failure
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+. "$HERE/lib/gc-finished.sh"
+
+SANDBOX="$(mktemp -d)"; trap 'rm -rf "$SANDBOX"' EXIT
+fails=0
+EXPECT_RED=0   # set while driving the neutered predicate, so an INTENDED failure
+               # does not print the word FAIL and read as a broken checker.
+ok()  { printf '  ok    %s\n' "$1"; }
+bad() {
+  if [ "$EXPECT_RED" = 1 ]; then printf '  red   %s — as intended\n' "$1"
+  else printf '  FAIL  %s\n' "$1"; fi
+  fails=$((fails+1))
+}
+want() { # <expected 0|1> <branch> <what>
+  gc_finished trunk "$2"; local got=$?
+  [ "$got" -eq "$1" ] && ok "$3" || bad "$3 (wanted finished=$1, got $got)"
+}
+
+cd "$SANDBOX"
+git init -q -b trunk .
+git config user.email t@e.st; git config user.name t
+git config commit.gpgsign false
+echo base > a.txt; git add a.txt; git commit -qm base
+echo one  > c.txt; git add c.txt; git commit -qm second
+B1="$(git rev-parse HEAD)"
+
+# 1 — REBASED DUPLICATE: the branch's patch reaches trunk under a DIFFERENT sha.
+#     This is the case the commit count gets wrong, and the reason for this file.
+git checkout -q -b dup "$B1"
+echo fixed > a.txt; git commit -qam "fix a"
+git checkout -q trunk
+git cherry-pick dup >/dev/null 2>&1 || { bad "sandbox: cherry-pick failed"; exit 1; }
+# Re-message it. A cherry-pick onto the same parent, in the same second, with the
+# same author and message, produces a byte-identical commit OBJECT — trunk then
+# fast-forwards onto the branch and there is no divergence left to detect. That
+# is a sandbox artifact, not the real world, where a re-landed patch always
+# arrives with a different sha. The amend forces the sha apart while leaving the
+# patch identical, which is precisely the case under test.
+git commit -q --amend -m "fix a (relanded under a different sha)"
+
+# 2 — ORDINARY UNLANDED BRANCH.
+git checkout -q -b ahead trunk
+echo new > b.txt; git add b.txt; git commit -qm "adds b"
+
+# 3 — FULLY CONTAINED: tip is an ancestor of trunk.
+git checkout -q -b behind "$B1"
+
+# 4 — MERGE COMMIT CARRYING UNIQUE CONTENT. The shape that makes a
+#     patch-counting test (git cherry) unsafe on its own.
+git checkout -q -b side "$B1"
+echo unique > only-here.txt; git add only-here.txt; git commit -qm "unique file"
+git checkout -q -b mergey trunk
+git merge --no-edit side >/dev/null 2>&1 || { bad "sandbox: merge failed"; exit 1; }
+
+echo "== the predicate the sweep runs"
+want 0 dup    "a rebased duplicate reads FINISHED — its content is already on the platform"
+want 1 ahead  "an ordinary unlanded branch reads NOT finished"
+want 0 behind "a branch fully contained in the base reads FINISHED"
+want 1 mergey "a merge carrying a file the base lacks reads NOT finished"
+
+echo "== what the OLD commit-count predicate would have said"
+old_finished() { [ "$(git rev-list --count "trunk..$1" 2>/dev/null || echo 1)" -eq 0 ]; }
+if old_finished dup
+then bad "the count predicate should MISS the duplicate — this proof is broken"
+else ok  "the count predicate hoards the duplicate for ever — the ~120MB this fixes"; fi
+if old_finished ahead
+then bad "the count predicate wrongly sweeps an unlanded branch"
+else ok  "the count predicate keeps an unlanded branch (both agree here)"; fi
+
+echo "== the clean-worktree path survives set -e"
+# The sweep runs under `set -euo pipefail`, and `grep -v` exits 1 when it filters
+# EVERYTHING out — the clean-worktree case. Inline, that killed the sweep at the
+# first worktree it was meant to remove: four keep lines, exit 1, no summary, and
+# invisible behind a `| cat`. Drive the real function in a real subshell under
+# the real flags, because that is the only way this comes back red.
+git checkout -q trunk
+if out="$(bash -c '
+      set -euo pipefail
+      . "'"$HERE"'/lib/gc-finished.sh"
+      d="$(gc_real_dirt "'"$SANDBOX"'")"
+      [ -z "$d" ] && echo CLEAN-AND-ALIVE
+    ' 2>&1)" && [ "$out" = "CLEAN-AND-ALIVE" ]; then
+  ok "a clean worktree reports no dirt AND the shell survives it"
+else
+  bad "the clean-tree path died under set -e (got: ${out:-<nothing>})"
+fi
+# And it still SEES real work, or the fix would be a mute button.
+echo scratch > "$SANDBOX/uncommitted.txt"
+if [ -n "$(gc_real_dirt "$SANDBOX")" ]
+then ok "uncommitted work is still reported — the guard did not silence it"
+else bad "gc_real_dirt missed an uncommitted file"; fi
+rm -f "$SANDBOX/uncommitted.txt"
+# Ephemera alone must NOT read as work, or nothing is ever swept.
+# The tracked file is required, not decoration: git COLLAPSES a wholly-untracked
+# directory to its top level, so an unrepresentative sandbox reports `?? one.ie/`
+# and no path pattern can match. A real worktree has one.ie/web/ tracked, so git
+# descends and reports `?? one.ie/web/.astro` — which is what the filter is
+# written against. Committing one file reproduces that.
+mkdir -p "$SANDBOX/one.ie/web"; echo keep > "$SANDBOX/one.ie/web/keep.txt"
+git add one.ie/web/keep.txt; git commit -qm "tracked file under one.ie/web"
+mkdir -p "$SANDBOX/one.ie/web/.astro"; echo x > "$SANDBOX/one.ie/web/.astro/gen.d.ts"
+if [ -z "$(gc_real_dirt "$SANDBOX")" ]
+then ok "build output alone does not count as work"
+else bad "ephemeral dirt was reported as work — nothing would ever be swept"; fi
+rm -rf "$SANDBOX/one.ie/web/.astro"
+
+echo "== red proof: neuter the predicate and the checks must fail"
+gc_finished() { return 0; }   # claim every branch is finished
+before=$fails; EXPECT_RED=1
+want 1 ahead  "(neutered) an unlanded branch must NOT read finished"
+want 1 mergey "(neutered) a unique-content merge must NOT read finished"
+if [ "$fails" -eq $((before+2)) ]; then
+  fails=$before; EXPECT_RED=0; ok "both checks bite when the predicate is gutted"
+else
+  fails=$((before+1)); EXPECT_RED=0; printf '  FAIL  a gutted predicate still passed — this checker proves nothing\n'
+fi
+
+echo
+[ "$fails" -eq 0 ] && { echo "gc-content-check: PASS"; exit 0; }
+echo "gc-content-check: FAIL ($fails)"; exit 1

package/scripts/gen-dev-config.py

@@ -0,0 +1,20 @@
+import json, pathlib, sys
+# Patch the ASTRO-GENERATED config (which carries `main` + the assets binding)
+# rather than hand-rolling one: wrangler.toml omits `main` by design, so a
+# standalone copy deploys as an assets-only Worker and is rejected.
+p = pathlib.Path("dist/server/wrangler.json")
+if not p.exists():
+    print("[gen-dev-config] FATAL: dist/server/wrangler.json missing - build first"); sys.exit(1)
+c = json.loads(p.read_text())
+c["name"] = "one-dev"
+c["routes"] = [{"pattern": "dev.one.ie", "custom_domain": True}]
+# STRIP CRONS. The dev worker shares production's D1/KV bindings, so inheriting
+# prod's schedules means TWO workers running the same handlers against the same
+# rows - double sends, double syncs, races. Dev observes prod data; it must not
+# also drive prod's clock. (Measured 2026-08-25: the first dev deploy shipped
+# 6 schedules including */5 * * * *.)
+for k in ("triggers", "crons"):
+    c.pop(k, None)
+out = pathlib.Path("dist/server/wrangler.dev.json")
+out.write_text(json.dumps(c, indent=2))
+print(f"[gen-dev-config] {out} -> name={c['name']} routes={c['routes']} main={c.get('main')}")

package/scripts/govern-bound-check.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# govern-bound-check.sh — prove run_bounded neither hangs its caller nor leaks
+# its watchdog. Three checks, each one a measured outage.
+#
+# manifest: portable
+#
+#   1. A CAPTURED call returns when the command returns. `$(run_bounded 60 true
+#      2>&1)` must come back in ~0s, not 60s. The watchdog used to inherit the
+#      caller's stdout (fixed 2026-09-01, `>&2`) and then its stderr (measured
+#      2026-09-03 as 1800s of nothing inside `$(… 2>&1)`, and again inside
+#      `… 2>&1 | tail`). A wait that reads as a hang gets killed at 144 = UNRUN.
+#   2. NO ORPHAN SLEEP survives a bounded call. `kill "$watch_pid"` reaped the
+#      watchdog subshell but not the `sleep` it forked — 21 `sleep 1800` with
+#      ppid 1 were on the box on 2026-09-04, each holding a dead caller's pipe.
+#   3. The bound still BITES: a command that outlives its cap is killed, the
+#      whole process group with it, and the parent says so on stderr.
+#
+# Exit 0 = all three hold · 1 = one did not. Touches nothing machine-wide:
+# GOVERN_DIR is a sandbox.
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+export GOVERN_DIR="${TMPDIR:-/tmp}/one-govern-boundcheck.$$"
+mkdir -p "$GOVERN_DIR"; trap 'rm -rf "$GOVERN_DIR"' EXIT
+# shellcheck source=lib/govern.sh
+. "$ROOT/.claude/scripts/lib/govern.sh"
+fails=0
+ok()  { printf '  ok   %s\n' "$*"; }
+bad() { printf '  FAIL %s\n' "$*"; fails=$((fails+1)); }
+now() { date +%s; }
+tag="bound-check-$$"
+
+echo "== 1. a captured call returns with the command, not with the watchdog"
+t0=$(now)
+out="$(run_bounded 61 bash -c "echo answer-$tag" 2>&1)"; rc=$?
+dt=$(( $(now) - t0 ))
+if [ "$rc" -eq 0 ] && [ "$dt" -le 3 ] && [ "$out" = "answer-$tag" ]; then ok "\$(run_bounded 60 …) returned in ${dt}s with the output intact"
+else bad "captured call took ${dt}s rc=$rc out='$out' (a 60s wait here is the watchdog holding the pipe)"; fi
+t0=$(now)
+out="$(run_bounded 61 bash -c "echo answer2-$tag" 2>&1 | cat)"
+dt=$(( $(now) - t0 ))
+[ "$dt" -le 3 ] && ok "… and through a pipe (${dt}s)" || bad "piped call took ${dt}s"
+
+echo "== 2. no orphaned watchdog sleep survives"
+sleep 1
+n=$(ps -Ao command= | grep -c "^sleep 61$")
+[ "$n" -eq 0 ] && ok "no 'sleep 61' left behind" || bad "$n orphaned 'sleep 61' still running (the watchdog's child outlived it)"
+
+echo "== 3. the bound still bites, and the group goes with it"
+t0=$(now)
+err="$(run_bounded 1 bash -c "sleep 31 & sleep 31; echo lived-$tag" 2>&1 >/dev/null)"; rc=$?
+dt=$(( $(now) - t0 ))
+if [ "$rc" -ne 0 ] && [ "$dt" -le 12 ]; then ok "a 31s command under a 1s cap died in ${dt}s (rc=$rc)"
+else bad "cap did not bite: rc=$rc after ${dt}s"; fi
+case "$err" in *TIMEOUT*) ok "the parent printed the TIMEOUT line" ;; *) bad "no TIMEOUT line on stderr: '$err'" ;; esac
+sleep 1
+n=$(ps -Ao command= | grep -c "^sleep 31$")
+[ "$n" -eq 0 ] && ok "the process group was reaped (no 'sleep 31' survivors)" || bad "$n 'sleep 31' survived the group kill"
+
+[ "$fails" -eq 0 ] && { echo "govern-bound-check: PASS"; exit 0; }
+echo "govern-bound-check: FAILED ($fails)"; exit 1

package/scripts/govern-claims-check.sh

@@ -0,0 +1,233 @@
+#!/usr/bin/env bash
+# govern-claims-check.sh — the two properties the claim registry exists for.
+#
+#   C1  MUTUAL EXCLUSION   two workers cannot hold the same claim
+#   C2  EVAPORATION        a dead owner's claim expires with no human in the loop
+#
+# Plus the checks that stop C1/C2 from passing against a gutted implementation:
+#   C3  the TTL branch also evaporates (the pid branch is not the only one)
+#   C4  a partial claim rolls back (a loser holds no ground)
+#   C5  do-fleet's has_conflict seam inherits the reap — the caller, not just
+#       the primitive
+#   R1/R2  RED-PROOF: with the reaper disabled, C2 and C5 must FAIL. A checker
+#       that stays green against a broken implementation is not a check.
+#
+# No coordinator anywhere in here — every worker is an independent process and
+# mkdir(2) is the only arbiter.
+#
+#   bash .claude/scripts/govern-claims-check.sh
+set -uo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SANDBOX="$(mktemp -d)"
+trap 'rm -rf "$SANDBOX"' EXIT
+
+# Point the whole library at a throwaway dir — this test must never touch the
+# real machine registry other sessions are coordinating through.
+export GOVERN_DIR="$SANDBOX/govern"
+export GOVERN_CLAIMS_DIR="$GOVERN_DIR/claims"
+# shellcheck source=lib/govern.sh
+. "$HERE/lib/govern.sh"
+
+PASS=0; FAIL=0
+ok()   { echo "  ok   $*"; PASS=$(( PASS + 1 )); }
+bad()  { echo "  FAIL $*"; FAIL=$(( FAIL + 1 )); }
+head_() { echo ""; echo "$*"; }
+
+reset_registry() { rm -rf "$GOVERN_CLAIMS_DIR"; mkdir -p "$GOVERN_CLAIMS_DIR"; }
+
+# A worker is a separate bash process that sources the library and tries to
+# claim. It records WON or LOST and then HOLDS — a worker that exits the instant
+# it wins is a DEAD owner, and the next contender would rightly reap it, so the
+# exclusion test would end up measuring evaporation instead of exclusion (it did,
+# first run: 12 winners). Nothing coordinates these processes; mkdir(2) is the
+# only arbiter between them.
+worker() { # worker <region> <slug> <outfile>
+  bash -c '
+    . "$1/lib/govern.sh"
+    if claim_take "$2" "$3"; then echo WON > "$4"; else echo LOST > "$4"; fi
+    sleep 20
+  ' _ "$HERE" "$1" "$2" "$3" >/dev/null 2>&1
+}
+
+# ─── C1 · two workers cannot hold the same claim ──────────────────────────────
+head_ "C1  mutual exclusion — N concurrent workers, one region"
+reset_registry
+N=12
+WPIDS=""
+for i in $(seq 1 $N); do
+  worker "one.ie/web/src/lib/resolvers" "fleet-$i" "$SANDBOX/w$i" &
+  WPIDS="$WPIDS $!"
+  disown %% 2>/dev/null || true   # keep the reap quiet; we kill by pid below
+done
+# Wait until every worker has decided — all of them are still holding.
+for _ in $(seq 1 100); do
+  [ "$(cat "$SANDBOX"/w* 2>/dev/null | grep -c . || true)" = "$N" ] && break
+  sleep 0.1
+done
+WON=$(cat "$SANDBOX"/w* 2>/dev/null | grep -c WON || true)
+LOST=$(cat "$SANDBOX"/w* 2>/dev/null | grep -c LOST || true)
+HOLDERS=$(claim_list | grep -c . || true)
+[ "$WON" = "1" ] && ok "exactly 1 of $N concurrent workers won the region (won=$WON lost=$LOST)" \
+                 || bad "expected exactly 1 winner, got $WON (lost=$LOST)"
+[ "$HOLDERS" = "1" ] && ok "registry holds exactly 1 claim on the region" \
+                     || bad "registry holds $HOLDERS claims on one region"
+# shellcheck disable=SC2086
+kill -9 $WPIDS 2>/dev/null || true
+rm -f "$SANDBOX"/w*
+
+# Two DIFFERENT regions must never collide into one claim. Sanitising a path
+# into a filename is lossy (a/b and a_b sanitise alike); the key must not be.
+reset_registry
+claim_take "a/b" "p1" >/dev/null 2>&1
+claim_take "a_b" "p2" >/dev/null 2>&1
+KEYS=$(claim_list | grep -c . || true)
+[ "$KEYS" = "2" ] && ok "distinct regions a/b and a_b get distinct claims (key is injective)" \
+                  || bad "a/b and a_b produced $KEYS claim(s) — the claim key collides"
+
+# ─── C2 · a dead owner's claim evaporates ─────────────────────────────────────
+head_ "C2  evaporation — kill the owner, prove the claim clears"
+reset_registry
+REGION="auth-seam"
+# Spawn a real process, let IT take the claim, then kill it. The claim outlives
+# the process on disk — that is the whole hazard.
+bash -c '. "$1/lib/govern.sh"; claim_take "$2" "dead-fleet" >/dev/null; sleep 300' \
+  _ "$HERE" "$REGION" &
+DEAD_PID=$!
+for _ in 1 2 3 4 5 6 7 8 9 10; do
+  [ -n "$(claim_owner "$REGION")" ] && break
+  sleep 0.2
+done
+OWNER_BEFORE="$(claim_owner "$REGION")"
+[ -n "$OWNER_BEFORE" ] && ok "claim is held while the owner lives ($OWNER_BEFORE)" \
+                       || bad "owner never took the claim — test is not exercising anything"
+
+kill -9 "$DEAD_PID" 2>/dev/null || true
+wait "$DEAD_PID" 2>/dev/null || true
+
+# No sweeper ran. No human intervened. The next contender's own read reaps it.
+OWNER_AFTER="$(claim_owner "$REGION")"
+[ -z "$OWNER_AFTER" ] && ok "after the owner dies, claim_owner reports nobody" \
+                      || bad "dead owner still reads as holding the claim ($OWNER_AFTER)"
+
+if claim_take "$REGION" "next-fleet"; then
+  NEW_OWNER="$(claim_owner "$REGION" | awk '{print $1}')"
+  [ "$NEW_OWNER" = "next-fleet" ] \
+    && ok "the ground is reclaimable — new owner is next-fleet" \
+    || bad "claim taken but metadata still names '$NEW_OWNER'"
+else
+  bad "a dead owner's region could not be reclaimed — evaporation failed"
+fi
+claim_release "$REGION"
+
+# ─── C3 · the TTL branch evaporates too ───────────────────────────────────────
+head_ "C3  evaporation — an expired lease clears even while the owner lives"
+reset_registry
+GOVERN_CLAIM_TTL_SECS=5400 claim_take "stale-region" "silent-fleet" >/dev/null
+KEY="$GOVERN_CLAIMS_DIR/$(_gv_claim_key "stale-region")"
+# Backdate the deposit past its lease. Owner (this shell) is very much alive,
+# so ONLY the timestamp branch can clear this.
+sed -i.bak "s/^started=.*/started=$(( $(date +%s) - 6000 ))/" "$KEY/meta" && rm -f "$KEY/meta.bak"
+[ -z "$(claim_owner "stale-region")" ] \
+  && ok "a lease older than ttl reads as free although the owner is alive" \
+  || bad "expired lease still reads as held — the TTL branch never fires"
+
+# …and an in-lease claim from a live owner is NOT reaped (the check can say no).
+reset_registry
+claim_take "fresh-region" "live-fleet" >/dev/null
+[ -n "$(claim_owner "fresh-region")" ] \
+  && ok "a fresh claim from a live owner is still held (reaper is not indiscriminate)" \
+  || bad "reaper cleared a live, in-lease claim"
+claim_release "fresh-region"
+
+# ─── C4 · partial claim rolls back ────────────────────────────────────────────
+head_ "C4  rollback — a worker that loses one region holds none"
+reset_registry
+# Another live worker owns region B.
+bash -c '. "$1/lib/govern.sh"; claim_take "regionB" "other" >/dev/null; sleep 60' _ "$HERE" &
+OTHER=$!
+for _ in 1 2 3 4 5 6 7 8 9 10; do [ -n "$(claim_owner regionB)" ] && break; sleep 0.2; done
+# Our worker wants A and B; it must end up holding neither.
+bash -c '
+  . "$1/lib/govern.sh"
+  taken=()
+  for r in regionA regionB; do
+    if claim_take "$r" "mine"; then taken+=("$r"); else
+      for t in "${taken[@]}"; do claim_release "$t"; done
+      exit 1
+    fi
+  done
+  exit 0' _ "$HERE" 2>/dev/null
+[ $? -ne 0 ] && ok "the multi-region worker correctly failed" || bad "worker claimed a region another holds"
+[ -z "$(claim_owner regionA)" ] \
+  && ok "regionA was released on rollback — no orphan ground" \
+  || bad "regionA left claimed by a worker that never launched"
+kill -9 "$OTHER" 2>/dev/null || true; wait "$OTHER" 2>/dev/null || true
+
+# ─── C5 · the do-fleet seam inherits the reap ─────────────────────────────────
+head_ "C5  seam — do-fleet's REAL has_conflict/free_dirs read through the reaper"
+reset_registry
+# Lift the ACTUAL function bodies out of do-fleet.sh — not a hand-written copy.
+# A copy passes while the shipped function dies on an unquoted var or a stray
+# awk field, which is precisely the drift this check exists to catch.
+FLEET="$HERE/do-fleet.sh"
+eval "$(awk '/^has_conflict\(\) \{/,/^\}/' "$FLEET")"
+eval "$(awk '/^free_dirs\(\) \{/,/^\}/'   "$FLEET")"
+# do-fleet gets its dir list from do-rank.py; stub that one seam so the test
+# needs no plan files. Everything below is do-fleet's own code.
+deliverable_dirs() { case "$1" in newplan|ghostplan) echo "one.ie/web/src/pages";; *) : ;; esac; }
+declare -f has_conflict >/dev/null && ok "lifted the real has_conflict() out of do-fleet.sh" \
+                                  || bad "could not lift has_conflict() — check the awk range"
+
+bash -c '. "$1/lib/govern.sh"; claim_take "one.ie/web/src/pages" "ghostplan" >/dev/null; sleep 300' \
+  _ "$HERE" &
+GHOST=$!
+for _ in 1 2 3 4 5 6 7 8 9 10; do [ -n "$(claim_owner "one.ie/web/src/pages")" ] && break; sleep 0.2; done
+if has_conflict "newplan" >/dev/null 2>&1; then
+  ok "a live ghost blocks the region (real has_conflict says conflict)"
+else
+  bad "real has_conflict failed to see another fleet's live claim"
+fi
+kill -9 "$GHOST" 2>/dev/null || true; wait "$GHOST" 2>/dev/null || true
+if has_conflict "newplan" >/dev/null 2>&1; then
+  bad "real has_conflict still blocks on a DEAD owner — the fleet would stay wedged"
+else
+  ok "after the owner dies the real has_conflict clears — the fleet reroutes in"
+fi
+
+# free_dirs must not hand back a sentinel this slug never took.
+reset_registry
+claim_take "__ANY__" "unscoped-plan" >/dev/null
+free_dirs "newplan"          # a DIFFERENT, scoped plan finishing
+[ "$(claim_owner "__ANY__" | awk '{print $1}')" = "unscoped-plan" ] \
+  && ok "free_dirs leaves another slug's __ANY__ sentinel alone" \
+  || bad "a scoped plan's free_dirs released the unscoped plan's sole-slot claim"
+free_dirs "unscoped-plan"
+[ -z "$(claim_owner "__ANY__")" ] \
+  && ok "the sentinel's own slug can still release it" \
+  || bad "__ANY__ could not be released by its owner"
+
+# ─── R1/R2 · prove the checker can go RED ─────────────────────────────────────
+head_ "R1/R2  red-proof — with the reaper gutted, C2 and C5 must FAIL"
+reset_registry
+(
+  # A gutted implementation: the owner is always "alive", so nothing evaporates.
+  _gv_alive() { return 0; }
+  bash -c '. "$1/lib/govern.sh"; claim_take "red-region" "zombie" >/dev/null; sleep 300' \
+    _ "$HERE" &
+  Z=$!
+  for _ in 1 2 3 4 5 6 7 8 9 10; do [ -d "$GOVERN_CLAIMS_DIR/$(_gv_claim_key red-region)" ] && break; sleep 0.2; done
+  kill -9 "$Z" 2>/dev/null || true; wait "$Z" 2>/dev/null || true
+  if [ -n "$(claim_owner "red-region")" ]; then
+    echo "  ok   with _gv_alive stubbed true, the dead owner's claim does NOT clear"
+    echo "       -> C2/C5 are testing the reaper, not an empty directory"
+    exit 0
+  fi
+  echo "  FAIL C2/C5 pass even with the reaper disabled — they prove nothing"
+  exit 1
+)
+if [ $? -eq 0 ]; then PASS=$(( PASS + 1 )); else FAIL=$(( FAIL + 1 )); fi
+
+echo ""
+echo "govern-claims-check: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ] || exit 1