@oneie/claude 0.7.0 → 0.9.0

package/scripts/lighthouse-run.sh

@@ -0,0 +1,187 @@
+#!/usr/bin/env bash
+# lighthouse-run.sh — capture-and-print ONE Lighthouse run. No thresholds.
+#
+# WHY IT EXISTS: the two pre-existing runners (one.ie/web/scripts/
+# lighthouse-{dashboard,in}.sh) each hardcode their own pass/fail numbers.
+# That made the thresholds live in two places and neither could be ratcheted.
+# This script does capture only; `speed-check.mjs` owns every comparison.
+# One source of truth for "what is the number", one for "is it good enough".
+#
+# USAGE
+#   lighthouse-run.sh <url> [desktop|mobile]
+#
+# PRINTS (one line, stdout, parseable):
+#   perf=<0-100> a11y=<0-100> bp=<0-100> seo=<0-100>
+#   fcp=<ms> lcp=<ms> tbt=<ms> cls=<0.000> si=<ms> tti=<ms> bytes=<n>
+#
+# EXIT  0 captured · 2 INCONCLUSIVE (no lighthouse, no chrome, url dead,
+#       unparseable report). NEVER 1 — this script has no opinion on the
+#       numbers, so it can never "fail". An unrun check is not a green check.
+set -uo pipefail
+
+URL="${1:?usage: lighthouse-run.sh <url> [desktop|mobile]}"
+MODE="${2:-desktop}"
+OUT="${LIGHTHOUSE_OUT:-$(mktemp -t lhrun)}"
+LH_ERR="$(mktemp -t lherr)"
+# Clean up BOTH temp files on every exit path. ~40 runs a session otherwise
+# leaves ~80 stray files in $TMPDIR.
+trap 'rm -f "$OUT" "$LH_ERR"' EXIT
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+inconclusive() { echo "INCONCLUSIVE: $*" >&2; exit 2; }
+
+# --- locate lighthouse ------------------------------------------------------
+LH=""
+for cand in \
+  "$REPO/one.ie/web/node_modules/.bin/lighthouse" \
+  "$REPO/node_modules/.bin/lighthouse" \
+  "$(command -v lighthouse 2>/dev/null || true)"; do
+  [ -n "$cand" ] && [ -x "$cand" ] && { LH="$cand"; break; }
+done
+[ -n "$LH" ] || inconclusive "lighthouse not installed (bun add -D lighthouse in one.ie/web)"
+
+# --- locate chrome ----------------------------------------------------------
+# Lighthouse needs full Chrome, not chrome-headless-shell: several audits
+# (and the whole a11y category) depend on APIs the shell build omits.
+if [ -z "${CHROME_PATH:-}" ]; then
+  for cand in \
+    "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \
+    "/Applications/Chromium.app/Contents/MacOS/Chromium" \
+    "$(command -v google-chrome 2>/dev/null || true)" \
+    "$(command -v chromium 2>/dev/null || true)"; do
+    [ -n "$cand" ] && [ -x "$cand" ] && { export CHROME_PATH="$cand"; break; }
+  done
+fi
+[ -n "${CHROME_PATH:-}" ] || inconclusive "no Chrome found (set CHROME_PATH)"
+
+# --- url must actually answer before we spend 30s on Chrome -----------------
+# NOTE: curl's -w prints "000" on connection failure AND exits non-zero, so a
+# `|| echo 000` fallback concatenates to "000000" and silently misses the
+# guard. Test curl's exit status separately instead.
+# Fetch the body ONCE here and reuse it for the asset guard below — a second
+# full download per sample would add latency to every measurement.
+BODY_FILE="$(mktemp -t lhbody)"; trap 'rm -f "$OUT" "$LH_ERR" "$BODY_FILE"' EXIT
+if code="$(curl -s -o "$BODY_FILE" -w '%{http_code}' --max-time 10 -L "$URL" 2>/dev/null)"; then
+  case "$code" in
+    000|"") inconclusive "$URL unreachable (no server listening?)" ;;
+    5*)     inconclusive "$URL returned $code — measuring an error page is not a measurement" ;;
+  esac
+else
+  inconclusive "$URL unreachable (curl failed; no server listening?)"
+fi
+
+# --- assets must resolve, or we measure a blank page ----------------------
+# A served-200 document whose stylesheets 404 paints NOTHING: Lighthouse
+# returns runtimeError NO_FCP, or (worse) a partial load that scores 100.
+# Measured 2026-08-18: a concurrent `bun run build` replaced dist/ under a
+# running `wrangler dev`, so the HTML referenced new content hashes the
+# server could no longer serve — every /_astro/*.css returned 404 while `/`
+# still returned 200 in 19ms. Checking the document alone cannot see this.
+if [ "${SPEED_SKIP_ASSET_CHECK:-0}" != "1" ]; then
+  first_asset="$(grep -oE '/_astro/[^"]+\.(css|js)' "$BODY_FILE" 2>/dev/null | head -1 || true)"
+  if [ -n "$first_asset" ]; then
+    base="$(printf '%s' "$URL" | sed -E 's#^(https?://[^/]+).*#\1#')"
+    acode="$(curl -s -o /dev/null -w '%{http_code}' --max-time 10 "${base}${first_asset}" 2>/dev/null || echo 000)"
+    case "$acode" in
+      2*) : ;;
+      *)  inconclusive "assets 404 (${first_asset} -> ${acode}) — the page cannot paint. Stale build? Rebuild and restart the server." ;;
+    esac
+  fi
+fi
+
+# --- run --------------------------------------------------------------------
+# THROTTLING: default is `simulate` (Lighthouse's own default), NOT `provided`.
+# This matters more than anything else in this file. `provided` scores whatever
+# the real network happened to do, so the same unchanged page measured minutes
+# apart scored perf 95 then 63, LCP 1486ms then 4340ms (measured 2026-08-18) —
+# noise that large makes a ratchet worthless and is why nobody trusted the old
+# numbers. `simulate` loads once then applies a fixed synthetic connection, so
+# scores are stable and comparable across machines and runs.
+# Override with SPEED_THROTTLING=provided for a raw real-network reading.
+# FORM FACTOR: use --preset=desktop, NOT --form-factor=desktop. Lighthouse's
+# default screen emulation is mobile, and setting form-factor alone leaves the
+# two inconsistent -> hard runtime error ("Screen emulation mobile setting
+# (true) does not match formFactor setting (desktop)"). The preset sets
+# form-factor, screen emulation and throttling together. Mobile needs no
+# preset; it is already the default config.
+# NOTE: macOS ships bash 3.2, where expanding an EMPTY array under `set -u`
+# ("${PRESET[@]}") is an "unbound variable" error. Use a plain string + word
+# splitting instead of an array — the value is a single fixed flag, so there is
+# nothing to quote-protect.
+PRESET=""
+[ "$MODE" = "desktop" ] && PRESET="--preset=desktop"
+
+"$LH" "$URL" \
+  --output=json \
+  --output-path="$OUT" \
+  --chrome-flags="--headless=new --no-sandbox --disable-gpu --disable-dev-shm-usage" \
+  --quiet \
+  --only-categories=performance,accessibility,best-practices,seo \
+  ${PRESET} \
+  --throttling-method="${SPEED_THROTTLING:-simulate}" >/dev/null 2>"$LH_ERR" || true
+
+# Surface the real reason. Swallowing stderr here turned a config error into a
+# bare "produced no report", which cost a debugging cycle.
+if [ ! -s "$OUT" ]; then
+  inconclusive "lighthouse produced no report for $URL: $(head -2 "$LH_ERR" | tr '\n' ' ')"
+fi
+
+node -e '
+const fs = require("fs");
+let j;
+try { j = JSON.parse(fs.readFileSync(process.argv[1], "utf8")); }
+catch { process.exit(3); }
+if (j.runtimeError) { console.error("runtimeError: " + j.runtimeError.code); process.exit(3); }
+const cat = (k) => {
+  const c = j.categories && j.categories[k];
+  return c && typeof c.score === "number" ? Math.round(c.score * 100) : -1;
+};
+const num = (k) => {
+  const a = j.audits && j.audits[k];
+  return a && typeof a.numericValue === "number" ? Math.round(a.numericValue) : -1;
+};
+const cls = (() => {
+  const a = j.audits && j.audits["cumulative-layout-shift"];
+  return a && typeof a.numericValue === "number" ? a.numericValue.toFixed(3) : "-1";
+})();
+const bytes = num("total-byte-weight");
+const perf = cat("performance");
+if (perf < 0) { console.error("no performance score in report"); process.exit(3); }
+
+// PARTIAL-LOAD GUARD. A page that only half-loaded scores BRILLIANTLY: fewer
+// bytes, earlier LCP, no long tasks. Measured 2026-08-18 under box contention:
+// /chat reported perf=100 lcp=275ms bytes=13043 while the server was serving a
+// healthy 49KB document with ~400KB of subresources. That reading would have
+// been written into the baseline as a record to defend forever.
+// Any real route here is >= 100KB, so a tiny total is a failed load, not a fast
+// page. Tune with SPEED_MIN_BYTES for a genuinely minimal route.
+const MIN_BYTES = Number(process.env.SPEED_MIN_BYTES || 100000);
+if (bytes >= 0 && bytes < MIN_BYTES) {
+  console.error(`partial load: total-byte-weight ${bytes} < ${MIN_BYTES} — not a measurement`);
+  process.exit(3);
+}
+// Failed requests: judge the MAIN DOCUMENT strictly and the rest by
+// proportion. Real pages routinely 404 a favicon or lose an analytics beacon;
+// that is not a failed measurement. A dead document, or most of the page
+// missing, is.
+const reqs = (j.audits && j.audits["network-requests"] && j.audits["network-requests"].details
+  && j.audits["network-requests"].details.items) || [];
+if (reqs.length) {
+  const doc = reqs.find((r) => r.resourceType === "Document");
+  if (doc && doc.statusCode >= 400) {
+    console.error(`main document returned ${doc.statusCode} — not a measurement`);
+    process.exit(3);
+  }
+  const failed = reqs.filter((r) => r.statusCode >= 400).length;
+  if (failed / reqs.length > 0.5) {
+    console.error(`partial load: ${failed}/${reqs.length} requests failed`);
+    process.exit(3);
+  }
+}
+console.log(
+  `perf=${perf} a11y=${cat("accessibility")} bp=${cat("best-practices")} seo=${cat("seo")} ` +
+  `fcp=${num("first-contentful-paint")} lcp=${num("largest-contentful-paint")} ` +
+  `tbt=${num("total-blocking-time")} cls=${cls} si=${num("speed-index")} ` +
+  `tti=${num("interactive")} bytes=${bytes}`
+);
+' "$OUT" 2>"$LH_ERR" || inconclusive "$(head -2 "$LH_ERR" | tr '\n' ' ')" 

package/scripts/livekit-live-check.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# livekit-live-check.sh — does the LIVE LiveKit server accept a token this repo signs?
+#
+# The offline suites prove the token is well FORMED (claims decode correctly).
+# They cannot prove LiveKit ACCEPTS it — that needs a real project. This does.
+#
+# THREE EXIT CODES, because red and cannot-run send a human to opposite places:
+#   0  the live server verified our HMAC signature
+#   1  RED — it rejected us (wrong key/secret, or the signer regressed)
+#   3  CANNOT RUN — no credentials configured. NOT a failure; the promise's
+#      offline proof still stands and this check simply has no evidence to read.
+#
+# Credentials are read from one.ie/web/.dev.vars (gitignored) or the environment.
+# Never prints a secret — only the host, the HTTP status, and the verdict.
+set -uo pipefail
+cd "$(dirname "$0")/../.." || exit 3
+
+ENV_FILE="${ONE_ENV_FILE:-${DO_ENV_FILE:-one.ie/web/.dev.vars}}"
+
+_read() { # _read VARNAME — env wins, then the env file
+  local v="${!1:-}"
+  [ -n "$v" ] && { printf '%s' "$v"; return; }
+  [ -f "$ENV_FILE" ] || return
+  sed -n "s/^${1}=//p" "$ENV_FILE" | tail -1 | tr -d '\r'
+}
+
+URL=$(_read LIVEKIT_URL); KEY=$(_read LIVEKIT_API_KEY); SECRET=$(_read LIVEKIT_API_SECRET)
+
+if [ -z "$URL" ] || [ -z "$KEY" ] || [ -z "$SECRET" ]; then
+  echo "livekit-live-check: CANNOT RUN — LIVEKIT_URL/API_KEY/API_SECRET unset (checked ${ENV_FILE})"
+  echo "  this is not a failure: local mode needs no credentials. See text/livekit-docs.md."
+  exit 3
+fi
+
+OUT=$(LK_URL="$URL" LK_KEY="$KEY" LK_SECRET="$SECRET" node -e '
+const { createHmac } = require("crypto");
+const b = (o) => Buffer.from(JSON.stringify(o)).toString("base64")
+  .replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"");
+const now = Math.floor(Date.now()/1000);
+// Same claim shape as one.ie/web/src/lib/livekit.ts, with roomList so the
+// REST API is reachable without joining anything.
+const h = b({ typ:"JWT", alg:"HS256" });
+const p = b({ iss: process.env.LK_KEY, sub:"live-check", jti:"live-check",
+  nbf: now, iat: now, exp: now+120, video:{ roomList:true } });
+const s = createHmac("sha256", process.env.LK_SECRET).update(h+"."+p).digest("base64")
+  .replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"");
+const base = process.env.LK_URL.replace(/^wss:/,"https:").replace(/^ws:/,"http:");
+fetch(base + "/twirp/livekit.RoomService/ListRooms", { method:"POST",
+  headers:{ Authorization:"Bearer " + h+"."+p+"."+s, "Content-Type":"application/json" },
+  body:"{}" })
+  .then(r => console.log(new URL(base).host + " " + r.status))
+  .catch(e => { console.log("unreachable " + String(e.message).slice(0,60)); });
+' 2>&1)
+
+HOST=${OUT%% *}; STATUS=${OUT##* }
+
+case "$STATUS" in
+  200) echo "livekit-live-check OK — $HOST verified our signature (http 200)"; exit 0 ;;
+  401|403) echo "livekit-live-check RED — $HOST rejected our token (http $STATUS): key/secret wrong, or the signer regressed" >&2; exit 1 ;;
+  *) echo "livekit-live-check CANNOT RUN — $OUT (server unreachable, not a signing failure)"; exit 3 ;;
+esac

package/scripts/livekit-ratchet.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# livekit-ratchet.sh — monorepo-only (hard-asserts against one.ie/web).
+#
+# Proves the LiveKit block family stayed collapsed: exactly ONE registration
+# (`LiveRoom`), no second prefab smuggled either into livekit-blocks.tsx or
+# straight into config.tsx's withChrome({...}) merge.
+#
+# Exit 0 = still one block. Exit 1 = the family re-split (or the test vanished).
+# No pipes on purpose: `producer | grep -q` returns 141 on a match here.
+
+set -uo pipefail
+
+# _GATE — route a heavy compute through the machine governor. A gate_lock only
+# dedupes IDENTICAL work; a SLOT is what bounds N worktrees each running one of
+# these at once (measured 2026-09-07: three concurrent 2.5GB typecheckers, every
+# lock uncontended, load 171). Empty when already inside a gate, so a nested call
+# inherits the outer slot rather than taking a second one.
+#
+# Resolves gate-run.sh from its OWN directory, deliberately: an earlier version
+# keyed off $ROOT and got inserted above the line that sets it, so _GATE was
+# silently empty and every call ran ungoverned -- a fail-OPEN, which is the exact
+# defect this preamble exists to close.
+_GATE=()
+if [ "${GOVERN_IN_GATE:-0}" != "1" ]; then
+  _GR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/gate-run.sh"
+  [ -f "$_GR" ] && _GATE=( bash "$_GR" "compute:$(basename "${BASH_SOURCE[0]}")" -- )
+fi
+
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT" || exit 1
+
+TEST_REL="tests/unit/puck/livekit-ratchet.test.ts"
+
+# A vitest run whose path filter matches nothing exits 0. Assert the file first.
+if [ ! -f "one.ie/web/$TEST_REL" ]; then
+  echo "livekit-ratchet FAIL — missing one.ie/web/$TEST_REL" >&2
+  exit 1
+fi
+
+(cd one.ie/web && "${_GATE[@]}" bunx vitest run "$TEST_REL") || {
+  echo "livekit-ratchet FAIL — more than one LiveKit block is registered" >&2
+  exit 1
+}
+
+echo "livekit-ratchet OK — exactly one LiveKit block (LiveRoom)"

package/scripts/load-guard-check.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Test the load-guard's heavy-command matcher. Lives in a file because the cases
+# manifest: portable
+# ARE command strings -- putting them in the command would make the hook match on
+# the test itself, which is what happened twice while writing this.
+POS='(^|[;&|(]|&&|\|\|)[[:space:]]*([A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*[[:space:]]+)*'
+A="${POS}((bunx|npx|bun|npm)[[:space:]]+)?(tsc[[:space:]]+--noEmit|vitest([[:space:]]+run)?|astro[[:space:]]+check|playwright[[:space:]]+test)"
+B="${POS}(bun|npm)[[:space:]]+run[[:space:]]+(verify|test|typecheck|check)(:[a-z]+)?([[:space:]]|\$)"
+
+heavy() {
+  local c="$1" h=0 out
+  out=$(printf '%s' "$c" | grep -cE "$A" || true); [ "${out:-0}" -gt 0 ] && h=1
+  out=$(printf '%s' "$c" | grep -cE "$B" || true); [ "${out:-0}" -gt 0 ] && h=1
+  echo "$h"
+}
+
+bad=0
+check() { # check <expected 1|0> <command>
+  local want="$1" cmd="$2" got
+  got=$(heavy "$cmd")
+  if [ "$got" = "$want" ]; then
+    printf '  ok    %-6s %s\n' "$([ "$want" = 1 ] && echo BLOCK || echo allow)" "$cmd"
+  else
+    printf '  FAIL  %-6s %s\n' "$([ "$want" = 1 ] && echo BLOCK || echo allow)" "$cmd"
+    bad=$((bad + 1))
+  fi
+}
+
+echo "--- must be treated as a heavy gate ---"
+V=verify; T=test
+check 1 "bun run $V"
+check 1 "cd one.ie/web && bun run $T"
+check 1 "bunx vitest run"
+check 1 "bunx tsc --noEmit"
+check 1 "VITEST_MAX_FORKS=2 bunx vitest run"
+check 1 "cd x; npx playwright test"
+check 1 "bun run $V:fast"
+check 1 "bun run check:ratchet"
+
+echo "--- must NOT be (merely names a gate) ---"
+check 0 "sed -n '1,60p' vitest.config.ts"
+check 0 "git commit -m 'perf: bun run $V is the review gate'"
+check 0 "cat one.ie/web/vitest.config.ts"
+check 0 "grep -rn 'bun run $V' .claude/"
+check 0 "echo the astro check ratchet is a doc phrase"
+check 0 "ps -Ao pcpu=,command= | sort -rn"
+
+echo
+[ "$bad" -eq 0 ] && echo "RESULT: all correct" || { echo "RESULT: $bad wrong"; exit 1; }

package/scripts/machine-check.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# machine-check.sh — is this box healthy, and if not, what is holding it?
+# Answers the question "why is my Mac slow" with numbers, not vibes.
+#   bash .claude/scripts/machine-check.sh          # snapshot
+#   bash .claude/scripts/machine-check.sh --watch  # live swap-rate probe
+set -uo pipefail
+
+cores=$(sysctl -n hw.ncpu); ram=$(( $(sysctl -n hw.memsize) / 1073741824 ))
+load=$(uptime | sed -E 's/.*load averages?: //')
+l1=$(echo "$load" | awk '{print $1}')
+echo "host      : ${cores} cores · ${ram} GB RAM"
+echo "load      : $load   (healthy < ${cores})"
+sysctl -n vm.swapusage | sed 's/^/swap      : /'
+# Both numbers, deliberately. memory_pressure's "free percentage" is what every
+# probe in this harness used to believe; it counts file cache, purgeable and
+# already-compressed pages as free, and read 74% on 2026-09-03 while 1.3% of RAM
+# was actually free and 9.4 GB sat in swap. Printing them side by side is how
+# the next person sees the gap instead of rediscovering it.
+# shellcheck source=lib/govern.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib/govern.sh"
+free_pct=$(memory_pressure 2>/dev/null | awk -F': ' '/free percentage/{print $2}')
+avail_mb=$(gate_mem_avail_mb 2>/dev/null || echo "")
+tot_mb=$(( ram * 1024 ))
+if [ -n "$avail_mb" ] && [ "$tot_mb" -gt 0 ]; then
+  echo "free mem  : $(( avail_mb / 1024 )) GB available ($(( avail_mb * 100 / tot_mb ))% — free + purgeable + cold cache)"
+  echo "            memory_pressure claims ${free_pct:-?} free; that figure counts reclaimable memory — never price gates with it"
+else
+  echo "free mem  : ? (vm_stat unreadable) · memory_pressure claims ${free_pct:-?}"
+fi
+echo "gates     : memory funds $(gate_headroom) concurrent cycle(s) at $(gate_price_mb) MB each"
+
+if [ "${1:-}" = "--watch" ]; then
+  echo -n "swap rate : sampling 10s ... "
+  _sw() { vm_stat | awk '/Swapins/{gsub(/\./,"",$2); i=$2} /Swapouts/{gsub(/\./,"",$2); o=$2} END{print i, o}'; }
+  _used() { sysctl -n vm.swapusage | sed -E 's/.*used = ([0-9.]+)M.*/\1/' | cut -d. -f1; }
+  a=$(_sw); ua=$(_used); sleep 10; b=$(_sw); ub=$(_used)
+  din=$(( $(echo "$b"|awk '{print $1}') - $(echo "$a"|awk '{print $1}') ))
+  dout=$(( $(echo "$b"|awk '{print $2}') - $(echo "$a"|awk '{print $2}') ))
+  echo "in ${din} / out ${dout} pages per 10s · swap used ${ua}M -> ${ub}M"
+  # Swapins alone are ambiguous: they spike during RECOVERY too, as freed
+  # memory lets pages fault back in. The thrash signal is pages going OUT
+  # while swap usage GROWS and free memory is scarce — that is the box
+  # evicting live working sets to make room, which is what makes it crawl.
+  fp=$(memory_pressure 2>/dev/null | awk -F': ' '/free percentage/{gsub(/%/,"",$2); print int($2)}')
+  if [ "$dout" -gt 2000 ] && [ "$ub" -ge "$ua" ] && [ "${fp:-100}" -lt 20 ]; then
+    echo "            ^^ THRASHING — evicting live memory; reduce concurrent gates"
+  elif [ "$din" -gt 1000 ] && [ "$ub" -lt "$ua" ]; then
+    echo "            (recovering — swap draining, pages faulting back in; this is fine)"
+  else
+    echo "            (paging normal)"
+  fi
+fi
+
+echo
+echo "── heavy gates running now ──"
+ps -Ao pid=,etime=,rss=,command= \
+  | grep -E '[t]sc --noEmit|[v]itest run|[a]stro check|[e]sbuild --service' \
+  | awk '{printf "  %-7s %-9s %6.0fMB  %s\n",$1,$2,$3/1024,substr($0,index($0,$4),60)}' \
+  || echo "  none"
+
+echo
+echo "── language servers (OUTSIDE the governor) ──"
+# Every Claude Code session spawns typescript-language-server, and its tsserver
+# child grows with the project it indexes. Measured 2026-09-04: one tsserver at
+# 1.99 GB after 1h39m, 2.46 GB across the fleet — the single largest ungoverned
+# consumer on the box, and it never shows up in a "heavy gates" grep because it
+# is not a gate. It is priced only indirectly, through what gate_mem_avail_mb
+# sees left over. Listed so the number is legible, not to be killed here.
+ps -Ao pid=,etime=,rss=,command= \
+  | grep -E '[t]sserver\.js|[t]ypescript-language-server' \
+  | awk '{n++; s+=$3; if ($3/1024 >= 100) printf "  %-7s %-9s %6.0fMB  tsserver\n",$1,$2,$3/1024}
+         END {printf "  %d process(es), %.0f MB total\n", n, s/1024}'
+
+echo
+echo "── governor ──"
+GOVERN_DIR="${GOVERN_DIR:-${TMPDIR:-/tmp}/one-govern}"
+if [ -d "$GOVERN_DIR" ]; then
+  held=0
+  for d in "$GOVERN_DIR"/lock-*; do
+    [ -d "$d" ] || continue
+    pid=$(cat "$d/pid" 2>/dev/null)
+    if kill -0 "$pid" 2>/dev/null; then
+      echo "  HELD  $(basename "$d")  by pid $pid"; held=$((held+1))
+    else
+      echo "  stale $(basename "$d")  (dead pid $pid — will be reaped)"
+    fi
+  done
+  [ "$held" = 0 ] && echo "  no slots held (idle)"
+else
+  echo "  never used yet"
+fi
+
+echo
+echo "── orphans (parent died, work still burning CPU) ──"
+ps -Ao pid=,ppid=,etime=,rss=,command= | awk '$2==1' \
+  | grep -E 'tsc --noEmit|vitest|bun run (verify|test)|node .*(one-ie|\.do-worktrees)|node_modules.*workerd serve|sleep [0-9]+$' \
+  | awk '{printf "  %-7s %-9s %6.0fMB  %s\n",$1,$3,$4/1024,substr($0,index($0,$5),55)}' \
+  || echo "  none"
+
+echo
+echo "── claude sessions ──"
+echo "  $(pgrep -f '^claude' 2>/dev/null | wc -l | tr -d ' ') running · each /do cycle can launch a gate"

package/scripts/machine-watch.sh

@@ -0,0 +1,177 @@
+#!/bin/bash
+# machine-watch.sh — periodic memory check + conservative reclaim.
+#
+# Reports the same picture as machine-check.sh, then reclaims ONLY what is
+# provably safe: leaked children whose parent is gone, and stale governor locks.
+# It never touches a gate owned by a live session and never touches a deploy —
+# those are a human's call. Appends one line per run to the log so trend is
+# readable without watching.
+#
+# Usage: machine-watch.sh [--reclaim] [--quiet]
+#   --reclaim  actually kill orphans (default: report only)
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+LOG="${MACHINE_WATCH_LOG:-$ROOT/.machine-watch.log}"
+RECLAIM=0; QUIET=0
+for a in "$@"; do
+  [ "$a" = "--reclaim" ] && RECLAIM=1
+  [ "$a" = "--quiet" ]   && QUIET=1
+done
+
+CORES=$(sysctl -n hw.ncpu 2>/dev/null || echo 8)
+LOAD=$(uptime | sed -E 's/.*load averages?: //' | awk '{print $1}')
+LOADI=${LOAD%%.*}
+FREE=$(memory_pressure 2>/dev/null | awk -F': ' '/free percentage/{gsub(/%/,"",$2); print int($2)}')
+FREE=${FREE:-100}
+SWAP_USED=$(sysctl -n vm.swapusage | sed -E 's/.*used = ([0-9.]+)M.*/\1/')
+SWAP_FREE=$(sysctl -n vm.swapusage | sed -E 's/.*free = ([0-9.]+)M.*/\1/')
+GATE_PAT='(\.bin/tsc --noEmit|\.bin/vitest run|astro check)'
+
+# Snapshot ps ONCE, then count from the frozen text. Critical: a `ps | grep PAT`
+# pipeline matches grep's OWN command line (the pattern is an argv element), and
+# the awk variant self-matches the same way — both silently inflate every count
+# by one. Freezing the snapshot before any matcher process exists removes the
+# whole class. (Found 2026-08-21: a phantom ungoverned=2 with nothing running.)
+PS_SNAP=$(ps -Ao pid=,ppid=,command= 2>/dev/null)
+
+# Real gate drivers: matches the pattern, and is not a shell wrapper / gate-run
+# whose command TEXT merely mentions it.
+GATES=$(printf '%s\n' "$PS_SNAP" \
+  | grep -E "$GATE_PAT" \
+  | grep -vE '^ *[0-9]+ +[0-9]+ +([^ ]*/)?(zsh|bash|sh|grep|awk|ps)( |$)|gate-run\.sh' \
+  | grep -c . || true)
+
+# Of those, how many have no gate-run.sh ancestor — the actionable number.
+UNGOV=$(printf '%s\n' "$PS_SNAP" | awk '
+  { cmd=""; for(i=3;i<=NF;i++) cmd=cmd" "$i; parent[$1]=$2; command[$1]=cmd }
+  END {
+    for (p in command) {
+      if (command[p] !~ GP) continue
+      if (command[p] ~ /^ *([^ ]*\/)?(zsh|bash|sh|grep|awk|ps) /) continue
+      if (command[p] ~ /gate-run\.sh/) continue
+      q=parent[p]; gov=0
+      for (i=0; i<9 && q!="" && q!="1"; i++) {
+        if (command[q] ~ /gate-run\.sh/) { gov=1; break }
+        q=parent[q]
+      }
+      if (!gov) n++
+    }
+    print n+0
+  }' GP="$GATE_PAT" || true)
+UNGOV=${UNGOV:-0}
+
+# macOS sizes the swap FILE to demand, so small swap_free is NOT thrash. Thrash
+# is pages going OUT while free memory is scarce. Measure the pageout RATE across
+# runs via a state file.
+STATE="${MACHINE_WATCH_STATE:-$ROOT/.machine-watch.state}"
+NOW=$(date +%s)
+PGOUT=$(vm_stat | awk '/Pageouts/{gsub(/\./,"",$NF); print $NF}')
+PGOUT=${PGOUT:-0}
+PO_RATE=0
+if [ -r "$STATE" ]; then
+  read -r LAST_T LAST_PO < "$STATE" 2>/dev/null || true
+  if [ -n "${LAST_T:-}" ] && [ -n "${LAST_PO:-}" ] && [ "$NOW" -gt "$LAST_T" ]; then
+    PO_RATE=$(( (PGOUT - LAST_PO) / (NOW - LAST_T) ))
+    [ "$PO_RATE" -lt 0 ] && PO_RATE=0
+  fi
+fi
+echo "$NOW $PGOUT" > "$STATE"
+
+# Claude sessions are the other half of the bill and they only ever grow: each
+# session's cost is its whole descendant tree (gates, node, language servers),
+# not the one `claude` process. Track count + rolled-up RSS + oldest age so the
+# trend is visible before the box is in trouble.
+SESSIONS=$(printf '%s\n' "$PS_SNAP" | grep -cE '(^| )[0-9]+ +[0-9]+ +([^ ]*/)?claude( |$)|claude --' || true)
+SESS_MB=$(printf '%s\n' "$PS_SNAP" | awk '
+  { cmd=""; for(i=3;i<=NF;i++) cmd=cmd" "$i; parent[$1]=$2; command[$1]=cmd }
+  END { print 0 }')
+SESS_MB=$(ps -Ao rss=,command= 2>/dev/null | awk '/[c]laude/{s+=$1} END{printf "%d", s/1024}')
+SESSIONS=${SESSIONS:-0}; SESS_MB=${SESS_MB:-0}
+
+# Thresholds are env-tunable so the alarm can be exercised in BOTH directions.
+# An alarm only ever seen green is an unproven alarm.
+W_LOAD_FACTOR="${WATCH_LOAD_FACTOR:-2}"
+W_FREE_WARN="${WATCH_FREE_WARN:-20}"
+W_FREE_CRIT="${WATCH_FREE_CRIT:-10}"
+W_GATES="${WATCH_GATES_WARN:-4}"
+W_PO="${WATCH_PAGEOUT_CRIT:-100}"
+W_PO_FREE="${WATCH_PAGEOUT_FREE:-25}"
+
+SEV=ok
+[ "$LOADI" -gt $((CORES * W_LOAD_FACTOR)) ] && SEV=warn
+[ "$FREE" -lt "$W_FREE_WARN" ]              && SEV=warn
+[ "$GATES" -ge "$W_GATES" ]                 && SEV=warn
+[ "$UNGOV" -ge "${WATCH_UNGOV_WARN:-2}" ]     && SEV=warn
+# Sustained pageouts with little free memory = the box is actually paging.
+[ "$PO_RATE" -gt "$W_PO" ] && [ "$FREE" -lt "$W_PO_FREE" ] && SEV=CRITICAL
+[ "$FREE" -lt "$W_FREE_CRIT" ]                              && SEV=CRITICAL
+
+# ── reclaim: leaked children of a dead parent, inside this repo, > 5 min old ──
+# Shape filter is load-bearing: a backgrounded `astro dev` / `wrangler dev`
+# reparents to launchd the moment its launching shell exits, and is then
+# indistinguishable BY PATH from a leaked esbuild child. Reaping it is what made
+# the dev server "keep stopping" every 10 minutes. Only leaked HELPERS qualify,
+# and only past the 5-minute age the comment above always claimed (etime is $3).
+ORPHANS=$(ps -Ao pid=,ppid=,etime=,command= 2>/dev/null \
+  | awk -v root="$ROOT" '
+      $2!=1 { next }
+      index($0, root"/one.ie/web/node_modules")==0 { next }
+      # long-lived servers a human deliberately started — never reap
+      /astro dev|vite|wrangler|workerd serve|miniflare|tsserver/ { next }
+      {
+        # etime: [[dd-]hh:]mm:ss — require > 5 minutes
+        e=$3; sub(/^.*-/,"",e); n=split(e,t,":")
+        secs = (n==3 ? t[1]*3600+t[2]*60+t[3] : t[1]*60+t[2])
+        if (secs > 300) print $1
+      }')
+KILLED=0
+for p in $ORPHANS; do
+  [ -z "$p" ] && continue
+  if [ "$RECLAIM" = "1" ]; then
+    kill -TERM "$p" 2>/dev/null; sleep 1; kill -KILL "$p" 2>/dev/null
+    KILLED=$((KILLED+1))
+  else
+    KILLED=$((KILLED+1))
+  fi
+done
+
+# stale governor locks (owner pid gone) — shrinks the slot cap silently otherwise
+STALE=0
+GDIR="${TMPDIR:-/tmp}one-govern"
+for l in "$GDIR"/lock-slot-* "$GDIR"/lock-tsc-*; do
+  [ -d "$l" ] || continue
+  own=$(cat "$l/pid" 2>/dev/null)
+  [ -z "$own" ] && continue
+  if ! kill -0 "$own" 2>/dev/null; then
+    [ "$RECLAIM" = "1" ] && rm -rf "$l"
+    STALE=$((STALE+1))
+  fi
+done
+
+# An ungoverned gate is usually short-lived — by the time a human investigates it
+# has exited. Record WHICH command it was at detection time, or the warning is
+# unactionable (observed 2026-08-21 15:21: ungoverned=2, both gone seconds later).
+if [ "${UNGOV:-0}" -gt 0 ]; then
+  ps -Ao pid=,etime=,command= 2>/dev/null \
+    | grep -E "$GATE_PAT" \
+    | grep -vE '^ *[0-9]+ *[0-9:-]+ *[^ ]*/(zsh|bash|sh) |gate-run\.sh' \
+    | sed "s|^|$(date '+%Y-%m-%d %H:%M:%S') UNGOVERNED |" >> "${LOG%.log}.ungoverned.log"
+fi
+
+STAMP=$(date '+%Y-%m-%d %H:%M:%S')
+VERB=$([ "$RECLAIM" = "1" ] && echo reaped || echo "would-reap")
+LINE="$STAMP sev=$SEV load=$LOAD free=${FREE}% swap_used=${SWAP_USED}M swap_free=${SWAP_FREE}M pageout_rate=${PO_RATE}/s gates=$GATES ungoverned=$UNGOV sessions=$SESSIONS sess_mb=${SESS_MB}M ${VERB}_orphans=$KILLED stale_locks=$STALE"
+echo "$LINE" >> "$LOG"
+
+if [ "$QUIET" = "0" ] || [ "$SEV" != "ok" ]; then
+  echo "$LINE"
+  if [ "$SEV" != "ok" ]; then
+    echo
+    echo "  top consumers:"
+    ps -Ao rss=,comm= | awk '{n=$2;for(i=3;i<=NF;i++)n=n" "$i;split(n,a,"/");k=a[length(a)];s[k]+=$1}END{for(i in s)printf "    %8.0f MB  %s\n",s[i]/1024,i}' | sort -rn | head -5
+  fi
+fi
+
+[ "$SEV" = "CRITICAL" ] && exit 2
+[ "$SEV" = "warn" ] && exit 1
+exit 0