@oneie/claude 0.7.0 → 0.9.0

package/scripts/tasks-loop.sh

@@ -0,0 +1,185 @@
+#!/usr/bin/env bash
+# tasks-loop.sh — the task board as a continuously-running loop.
+#
+# Each pass does three things, in this order:
+#   0. REAP     sweep stranded `picked` leases back to `open`. This is the half
+#               atomicity does NOT fix: a lease whose owner died is invisible to
+#               the claimable view and blocks every dependent via ready-tasks.
+#               It runs FIRST so this pass can claim what it just freed.
+#   1. ACCEPTS  re-run every seed row's `accept:` check. Green ⇒ the task is
+#               done in the tree; it is not filed (and is reported as settled).
+#   2. SEED     file every still-RED seed row that is not on the board yet,
+#               tagged with its BARE-WORD stake.
+#   3. CLAIM    lease up to --claims tasks this pass.
+#
+# SAFE-BY-DEFAULT: it prints what it would do and writes NOTHING unless --live.
+# The board lives in PRODUCTION TypeDB (there is no separate task store — dev
+# and prod share it), so a dry run is the honest default.
+#
+#   bash .claude/scripts/tasks-loop.sh --accepts   # just score the checks
+#   bash .claude/scripts/tasks-loop.sh --once      # one pass, DRY
+#   bash .claude/scripts/tasks-loop.sh --once --live
+#   bash .claude/scripts/tasks-loop.sh --live      # continuous
+#   bash .claude/scripts/tasks-loop.sh --status    # read liveness, don't guess
+#   bash .claude/scripts/tasks-loop.sh --stop
+#
+# Liveness is a PUBLISHED FILE, never `ps | grep`. --status reads it.
+#
+# ── why this loop is safe to run beside other fleets ────────────────────────
+# `tasks:claim` is ATOMIC as of 2026-08-26: one guarded TypeDB pipeline, one
+# commit, and the loser of a race is refused at commit time with
+#   "[STC2] Commit ... failed with isolation conflict: Transaction uses a lock
+#    held by a concurrent commit."
+# Proven both ways by `node .claude/scripts/tasks-claim-race.mjs` (which also
+# demonstrates its own red half). So a second claimer here cannot double-lease.
+# This loop is therefore NOT single-claimer-by-construction; it is safe because
+# the seam underneath it was fixed. If that harness ever stops passing, drop
+# CLAIMS_PER_PASS to 0 until it does again.
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SEED="${TASKS_SEED:-$ROOT/.claude/tasks/seed.tsv}"
+STATE_DIR="${TMPDIR:-/tmp}/one-tasks-loop"
+LIVE="$STATE_DIR/live.json"
+LOG="$STATE_DIR/loop.log"
+LOCK="$STATE_DIR/lock"
+STOP="$STATE_DIR/stop"
+FILED="$STATE_DIR/filed"        # slugs already filed by this loop
+INTERVAL="${TASKS_LOOP_INTERVAL:-300}"
+CLAIMS_PER_PASS="${TASKS_LOOP_CLAIMS:-1}"
+WS="${CC_TASKS_WORKSPACE:-one}"
+DRY=true
+mkdir -p "$STATE_DIR"; touch "$FILED"
+
+now() { date -u +%Y-%m-%dT%H:%M:%SZ; }
+log() { printf '[%s] %s\n' "$(now)" "$*" | tee -a "$LOG"; }
+
+publish() {  # publish(state, detail, red, green, filed, claimed)
+  cat > "$LIVE" <<JSON
+{"state":"$1","pid":$$,"detail":"$2","red":$3,"green":$4,"filed":$5,"claimed":$6,"dry":$DRY,"workspace":"$WS","at":"$(now)","interval":$INTERVAL,"log":"$LOG"}
+JSON
+}
+
+# rows() — the seed, comments and blanks stripped.
+rows() { grep -v '^#' "$SEED" | grep -v '^[[:space:]]*$'; }
+
+# score_accepts — run every accept check. Prints "RED <slug>" / "GREEN <slug>".
+# An accept that exits 0 means the work is already in the tree.
+score_accepts() {
+  local red=0 green=0
+  while IFS=$'\t' read -r slug title tags accept; do
+    [ -z "${slug:-}" ] && continue
+    if ( cd "$ROOT" && eval "$accept" ) >/dev/null 2>&1; then
+      echo "GREEN $slug"; green=$((green+1))
+    else
+      echo "RED   $slug"; red=$((red+1))
+    fi
+  done < <(rows)
+  echo "# red=$red green=$green"
+}
+
+case "${1:-}" in
+  --status)
+    if [ ! -f "$LIVE" ]; then echo "no loop has ever published liveness here ($LIVE)"; exit 1; fi
+    cat "$LIVE"
+    pid=$(sed -n 's/.*"pid":\([0-9]*\).*/\1/p' "$LIVE")
+    if kill -0 "$pid" 2>/dev/null; then echo "owner pid $pid is ALIVE"
+    else echo "owner pid $pid is GONE — this file is a record, not a running loop"; fi
+    exit 0 ;;
+  --stop) touch "$STOP"; echo "stop requested — the loop exits after its current pass"; exit 0 ;;
+  --accepts) score_accepts; exit 0 ;;
+esac
+
+ONCE=false
+for a in "$@"; do
+  case "$a" in
+    --live) DRY=false ;;
+    --once) ONCE=true ;;
+    --claims=*) CLAIMS_PER_PASS="${a#*=}" ;;
+    *) echo "unknown flag: $a" >&2; exit 2 ;;
+  esac
+done
+
+# single instance — mkdir(2) is atomic; macOS ships no flock(1)
+if ! mkdir "$LOCK" 2>/dev/null; then
+  owner=$(cat "$LOCK/pid" 2>/dev/null || echo "?")
+  if [ "$owner" != "?" ] && kill -0 "$owner" 2>/dev/null; then
+    echo "[tasks-loop] already running as pid $owner — refusing to double-file"; exit 1
+  fi
+  echo "[tasks-loop] reaping dead lock (pid $owner)"; rm -rf "$LOCK"; mkdir "$LOCK" || exit 1
+fi
+echo $$ > "$LOCK/pid"
+rm -f "$STOP"
+cleanup() { rm -rf "$LOCK"; publish stopped "loop exited" 0 0 0 0; }
+trap cleanup EXIT INT TERM
+
+log "start — seed=$SEED ws=$WS interval=${INTERVAL}s claims/pass=$CLAIMS_PER_PASS dry=$DRY"
+
+one_pass() {
+  local red=0 green=0 filed=0 claimed=0 reaped=0
+  # 0. REAP — before anything else, so a freed lease is claimable this pass.
+  if $DRY; then
+    log "DRY would reap stranded leases in workspace $WS"
+  else
+    rout=$(CC_TASKS_WORKSPACE="$WS" bash "$ROOT/.claude/scripts/do-signal.sh" --task-reap 2>&1)
+    case "$rout" in
+      *'"reaped":[]'*) log "reap: nothing stranded" ;;
+      *'"ok":true'*)   log "reap: ${rout:0:220}"; reaped=1 ;;
+      *)               log "reap inconclusive: ${rout:0:220}" ;;
+    esac
+  fi
+  publish scoring "running accept checks" 0 0 0 0
+  while IFS=$'\t' read -r slug title tags accept; do
+    [ -z "${slug:-}" ] && continue
+    if ( cd "$ROOT" && eval "$accept" ) >/dev/null 2>&1; then
+      green=$((green+1))
+      log "SETTLED $slug — accept is green, not filing"
+      continue
+    fi
+    red=$((red+1))
+    grep -qx "$slug" "$FILED" && continue
+    if $DRY; then
+      log "DRY would file: $slug [$tags] — $title"
+    else
+      if CC_TASKS_WORKSPACE="$WS" bash "$ROOT/.claude/scripts/do-signal.sh" \
+           --task-create "$slug" "$title" "tags=$tags" "notes=accept: $accept" >>"$LOG" 2>&1; then
+        echo "$slug" >> "$FILED"; log "FILED $slug [$tags]"
+      else
+        log "file FAILED $slug — see $LOG"
+      fi
+    fi
+    filed=$((filed+1))
+  done < <(rows)
+
+  # CLAIM — bounded per pass. Atomic at the seam (see header), so a concurrent
+  # fleet claiming the same slug is refused, not silently co-granted.
+  local n=0
+  while IFS=$'\t' read -r slug title tags accept; do
+    [ -z "${slug:-}" ] && continue
+    [ "$n" -ge "$CLAIMS_PER_PASS" ] && break
+    grep -qx "$slug" "$FILED" || $DRY || continue
+    if $DRY; then
+      log "DRY would claim: $slug"
+    else
+      out=$(CC_TASKS_WORKSPACE="$WS" bash "$ROOT/.claude/scripts/do-signal.sh" --task-claim "$slug" 2>&1)
+      case "$out" in
+        *already-claimed*) log "SKIP $slug — already leased (that is the atomic guard working)" ;;
+        *'"ok":true'*)     log "CLAIMED $slug"; claimed=$((claimed+1)) ;;
+        *)                 log "claim inconclusive $slug: ${out:0:160}" ;;
+      esac
+    fi
+    n=$((n+1))
+  done < <(rows)
+
+  publish idle "pass complete" "$red" "$green" "$filed" "$claimed"
+  log "pass: red=$red green=$green filed=$filed claimed=$claimed reaped=$reaped"
+}
+
+if $ONCE; then one_pass; exit $?; fi
+while true; do
+  one_pass || true
+  for _ in $(seq 1 "$INTERVAL"); do
+    [ -f "$STOP" ] && { log "stop file seen — exiting"; exit 0; }
+    sleep 1
+  done
+done

package/scripts/test-cached.sh

@@ -0,0 +1,255 @@
+#!/usr/bin/env bash
+# test-cached.sh <folder> -- <vitest args...> — run a vitest selection, or reuse
+# the PASS someone already computed for this exact input. Exits 0 on pass/hit,
+# non-zero on fail or on could-not-run.
+#
+# manifest: needs-env
+#
+# WHY. The dev lane re-ran identical work on every cycle. The pinned block alone
+# is 44 files / 420 tests / ~20s, and it runs on EVERY cycle regardless of the
+# diff -- so a plan of six cycles paid it six times for a tree whose pinned
+# surface never moved. Same for `vitest related` when two cycles touch the same
+# file. Measured 2026-09-01: fast lane ~30s/cycle, two thirds of it the pins.
+#
+# The key is the exact INPUT to the run, so a hit is sound by construction:
+#   sha( vitest args + content of every selected test file
+#      + content of every tracked source file that differs from the base )
+# Nothing else can change the answer. Change a test, change a source file it
+# reads, or change the selection, and the key moves. This is the tsc-cached.sh
+# idiom (one compute per tree-fingerprint, everyone else reuses) narrowed from
+# the whole tree to the actual inputs of one selection.
+#
+# ONLY PASSES ARE CACHED. A red result is never memoised: a failing gate must be
+# re-run every single time until it is green, because the value of a gate is that
+# it keeps saying no. This is the `unrun-gate-is-not-a-pass` rule applied to its
+# mirror image -- a *remembered* pass is only a pass while its inputs are identical.
+#
+# TEST_CACHE_DISABLE=1 forces a real run (and still records the result).
+# --self-test runs the fixtures.
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+CACHE_DIR="${TEST_CACHE_DIR:-${TMPDIR:-/tmp}/one-test-cache}"
+MAX_AGE_DAYS="${TEST_CACHE_MAX_AGE_DAYS:-7}"
+
+_self_test() {
+  local t fails=0
+  t="$(mktemp -d)"; export TEST_CACHE_DIR="$t"
+  # 1. a PASS is remembered
+  bash "$ROOT/.claude/scripts/test-cached.sh" __probe__ -- --probe-pass >/dev/null 2>&1
+  local r1=$?
+  local out2; out2=$(bash "$ROOT/.claude/scripts/test-cached.sh" __probe__ -- --probe-pass 2>&1)
+  if printf '%s' "$out2" | grep -q 'cache HIT'; then echo "ok: pass is remembered"
+  else echo "FAIL: identical pass did not hit (r1=$r1): $out2"; fails=$((fails+1)); fi
+  # 2. RED PROOF — a FAIL must never be remembered
+  bash "$ROOT/.claude/scripts/test-cached.sh" __probe__ -- --probe-fail >/dev/null 2>&1
+  local out3; out3=$(bash "$ROOT/.claude/scripts/test-cached.sh" __probe__ -- --probe-fail 2>&1)
+  if printf '%s' "$out3" | grep -q 'cache HIT'; then
+    echo "FAIL: a RED result was cached — the gate would stop biting"; fails=$((fails+1))
+  else echo "ok: a fail is never cached (re-runs every time)"; fi
+  # 3. a different selection must not collide with a remembered pass
+  local out4; out4=$(bash "$ROOT/.claude/scripts/test-cached.sh" __probe__ -- --probe-pass --extra 2>&1)
+  if printf '%s' "$out4" | grep -q 'cache HIT'; then
+    echo "FAIL: different args collided with a cached key"; fails=$((fails+1))
+  else echo "ok: key discriminates on args"; fi
+  # 4. RED PROOF against a REAL vitest -- a genuinely failing run must exit
+  # non-zero AND leave no stamp. Checks 1-3 use the __probe__ folder, which never
+  # touches the runner; this one drives the actual code path the gate uses.
+  local pt; pt="$(mktemp -d)"
+  cat > "$pt/red.test.ts" <<'REDEOF'
+import { it, expect } from "vitest";
+it("is deliberately red", () => { expect(1).toBe(2); });
+REDEOF
+  local before after
+  before=$(ls "$t" 2>/dev/null | wc -l | tr -d ' ')
+  if TEST_CACHE_DIR="$t" bash "$ROOT/.claude/scripts/test-cached.sh" \
+       one.ie/web -- --reporter=dot --root "$pt" >/dev/null 2>&1; then
+    echo "FAIL: a red vitest exited 0"; fails=$((fails+1))
+  else echo "ok: a real failing vitest exits non-zero"; fi
+  after=$(ls "$t" 2>/dev/null | wc -l | tr -d ' ')
+  if [ "$before" = "$after" ]; then echo "ok: a red run recorded no stamp"
+  else echo "FAIL: a red run wrote a cache stamp"; fails=$((fails+1)); fi
+
+  # 5. the pty path, only where it can actually be exercised. `script -qeF` needs
+  # a controlling tty on stdin; without one it dies with
+  # "tcgetattr/ioctl: Operation not supported on socket" -- which is a NON-ZERO
+  # exit, so a naive red proof here passes for the wrong reason and proves
+  # nothing about status propagation. Measured 2026-09-01. An unrunnable check
+  # reports n/a; it is never reported as ok.
+  if [ -t 0 ]; then
+    before=$(ls "$t" 2>/dev/null | wc -l | tr -d ' ')
+    if TEST_CACHE_PTY=1 TEST_CACHE_DIR="$t" bash "$ROOT/.claude/scripts/test-cached.sh" \
+         one.ie/web -- --reporter=dot --root "$pt" >/dev/null 2>&1; then
+      echo "FAIL: a red vitest under the pty wrapper exited 0"; fails=$((fails+1))
+    else echo "ok: pty wrapper propagates a red exit status"; fi
+    after=$(ls "$t" 2>/dev/null | wc -l | tr -d ' ')
+    if [ "$before" = "$after" ]; then echo "ok: a red pty run recorded no stamp"
+    else echo "FAIL: a red pty run wrote a cache stamp"; fails=$((fails+1)); fi
+  else
+    echo "n/a: no controlling tty — the pty wrapper cannot be exercised here (NOT a pass)"
+  fi
+  rm -rf "$pt"
+  rm -rf "$t"
+  [ "$fails" -eq 0 ] && { echo "test-cached: self-test PASS"; return 0; }
+  echo "test-cached: self-test FAILED ($fails)"; return 1
+}
+[ "${1:-}" = "--self-test" ] && { _self_test; exit $?; }
+
+folder="${1:-}"; shift || true
+[ "${1:-}" = "--" ] && shift
+[ -n "$folder" ] || { echo "usage: test-cached.sh <folder> -- <vitest args>" >&2; exit 2; }
+ARGS=("$@")
+
+# --- key -------------------------------------------------------------------
+# Selected test files: whichever of the args name a real file, plus (for a
+# substring selection like the pins) the files those substrings resolve to.
+_sel=""
+for a in "${ARGS[@]}"; do
+  case "$a" in
+    --*) continue ;;
+    *) _sel="$_sel$a"$'\n' ;;
+  esac
+done
+
+# <hash>  <repo-relative path> — the shape `shasum <file>` prints, minus $ROOT.
+#
+# This is the SECOND memo key of the two the governor owns, and it is now
+# computed by lib/govern.ts (cycle 16) — the same program that computes
+# tsc_tree_fingerprint, so both keys have one implementation and one place to be
+# wrong. The BYTES ARE IDENTICAL to the `shasum -a 256 < file | cut -d' ' -f1`
+# form it replaces, including the empty hash a missing file produced, so every
+# stamp already on disk still hits: verified 2026-09-04 by comparing
+# TEST_CACHE_KEY_ONLY=1 across three selections before and after.
+# GOVERN_BUN unresolvable -> the hash comes back empty for every file, which
+# moves the key rather than freezing it, so a broken toolchain can only cost a
+# re-run and can never replay a stale pass.
+_GOV_LIB="$(dirname "${BASH_SOURCE[0]}")/lib/govern.sh"
+# shellcheck source=lib/govern.sh
+[ -r "$_GOV_LIB" ] && . "$_GOV_LIB"
+if command -v _gov >/dev/null 2>&1 && [ -n "${GOVERN_BUN:-}" ]; then
+  _hash_rel() { _gov hash-rel "$ROOT" "$@"; }
+else
+  # No governor lib and no bun (a fresh clone, CI). Same bytes, one file per call.
+  _hash_rel() {
+    local f
+    for f in "$@"; do
+      printf '%s  %s\n' "$(shasum -a 256 < "$ROOT/$f" 2>/dev/null | cut -d' ' -f1)" "$f"
+    done
+  }
+fi
+
+_key_src=$(
+  printf '%s\0' "${ARGS[@]}"
+  # content of every file the selection names, when it exists
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    # REPO-RELATIVE names, never "$ROOT/...": `shasum <path>` prints the path
+    # beside the hash, and an absolute path puts the WORKTREE into the key. The
+    # same bytes hashed from two checkouts then produced two keys, so the memo
+    # was private per worktree for every selection that named a file — `related`
+    # and BOTH full-suite lanes — and a plan that closed in a worktree and shipped
+    # from main paid ~122s twice. Measured 2026-09-03 (three-cell probe: the
+    # path-free pins shared, anything naming a file did not). Same bytes, same
+    # key, any checkout. This is NOT a narrowing: nothing leaves the key.
+    [ -f "$ROOT/$folder/$f" ] && _hash_rel "$folder/$f"
+    [ -f "$ROOT/$f" ] && _hash_rel "$f"
+  done <<< "$_sel"
+  # The working delta, BY CONTENT. `git status --porcelain` was the first attempt
+  # and it is a trap: it names files, so " M src/lib/authority.ts" is the same
+  # string whether that file gained one comment or was rewritten. Caught in the
+  # act 2026-09-01 -- appending a line to an already-modified file did not move
+  # the key, and the run returned a cached PASS for a tree that had changed. A
+  # green gate over a changed tree is the exact failure this cache must not have.
+  # `git diff HEAD` hashes the CONTENT of every tracked change; untracked files
+  # are hashed directly since no diff covers them.
+  git -C "$ROOT" diff HEAD 2>/dev/null
+  git -C "$ROOT" ls-files --others --exclude-standard 2>/dev/null \
+    | while IFS= read -r u; do _hash_rel "$u"; done
+  git -C "$ROOT" rev-parse HEAD 2>/dev/null
+  # Inputs git CANNOT see. `.env`/`.env.local` are gitignored, so neither
+  # `git diff HEAD` nor `ls-files --others` (which honours .gitignore) covers
+  # them -- yet the suite reads them. Without these lines a pass could be
+  # replayed across an environment change. Absent hashes as "ABSENT" so that
+  # DELETING one still moves the key.
+  for _e in "$folder/.env" "$folder/.env.local" "$folder/.env.test"; do
+    if [ -f "$ROOT/$_e" ]; then _hash_rel "$_e"
+    else echo "ABSENT $_e"; fi
+  done
+  # for a substring selection the matched SET can change without any arg changing
+  ( cd "$ROOT/$folder" 2>/dev/null && git ls-files '*.test.*' 2>/dev/null | shasum -a 256 )
+)
+KEY=$(printf '%s' "$_key_src" | shasum -a 256 | cut -d' ' -f1)
+# TEST_CACHE_KEY_ONLY=1 prints the key and runs nothing — how a caller (or a
+# sharing proof) asks "would this selection hit?" without paying for the run.
+if [ "${TEST_CACHE_KEY_ONLY:-0}" = "1" ]; then echo "$KEY"; exit 0; fi
+STAMP="$CACHE_DIR/$folder-${KEY}.pass"
+STAMP="${STAMP//\//_}"; STAMP="$CACHE_DIR/$(basename "$STAMP")"
+
+# TEST_CACHE_PROBE=1 answers "would this HIT?" and runs nothing: exit 0 on a
+# hit, 1 on a miss. It sits AFTER the STAMP lines above on purpose -- the
+# probe and the real check must resolve the same path or the probe is a
+# second, drifting definition of a hit. KEY_ONLY prints the key; PROBE
+# answers the question the caller actually has.
+#
+# WHY IT EXISTS. verify-fast.sh took a GOVERNOR SLOT and then asked whether
+# there was anything to run. Measured 2026-09-09 on a saturated box: 855s
+# and 1324s queued for slots whose work was a memo hit costing ~0. A cache
+# hit must never wait behind a real gate -- it needs no memory, no forks and
+# no slot. Probe first, take the slot only on a MISS.
+if [ "${TEST_CACHE_PROBE:-0}" = "1" ]; then
+  if [ "${TEST_CACHE_DISABLE:-0}" != "1" ] && [ -f "$STAMP" ]; then
+    echo "[test-cached] probe: HIT ${KEY:0:12}"; exit 0
+  fi
+  echo "[test-cached] probe: MISS ${KEY:0:12}"; exit 1
+fi
+
+mkdir -p "$CACHE_DIR" 2>/dev/null
+find "$CACHE_DIR" -name '*.pass' -mtime "+${MAX_AGE_DAYS}" -delete 2>/dev/null
+
+if [ "${TEST_CACHE_DISABLE:-0}" != "1" ] && [ -f "$STAMP" ]; then
+  echo "[test-cached] cache HIT ${KEY:0:12} — identical inputs already PASSED $(cat "$STAMP" 2>/dev/null)"
+  exit 0
+fi
+
+# --- run -------------------------------------------------------------------
+# __probe__ is the self-test's fake folder: no vitest, deterministic outcome.
+if [ "$folder" = "__probe__" ]; then
+  case " ${ARGS[*]} " in *--probe-fail*) st=1 ;; *) st=0 ;; esac
+else
+  # THE SLOT. This script takes no lock, so unlike tsc-cached.sh there is no
+  # ordering hazard -- adding a slot here is purely additive.
+  #
+  # verify-fast.sh already wraps ITS calls to this script in gate-run, and
+  # gate-run exports GOVERN_IN_GATE=1, so _gate below collapses to a plain `env`
+  # on that path: the outer slot is INHERITED, never doubled (a second slot held
+  # by one logical gate is what deadlocks the queue at cap 2).
+  #
+  # What this closes is the other caller: `bun run test` -> test-lanes.sh -> here
+  # reached vitest with no slot at all. Measured 2026-09-07 in one worktree at
+  # 256% CPU and ~800MB, with the governor reporting "1 of 2 slots held".
+  _gate=( env )
+  if [ "${TEST_CACHE_GATE:-1}" = "1" ] && [ "${GOVERN_IN_GATE:-0}" != "1" ] \
+     && [ -f "$ROOT/.claude/scripts/gate-run.sh" ]; then
+    _gate=( env "GOVERN_GATE_TIMEOUT=${TEST_CACHE_TIMEOUT:-1800}"
+            bash "$ROOT/.claude/scripts/gate-run.sh" "test-cache:$folder" -- )
+  fi
+  if [ "${TEST_CACHE_PTY:-0}" = "1" ]; then
+    # The deploy gate's vitest HANGS when stdout is not a TTY -- a fork is spawned
+    # and never given work (see .claude/commands/deploy.md "The vitest gate hangs").
+    # `script -qeF /dev/null` allocates a pty and flushes. The -e is load-bearing:
+    # it propagates the CHILD's exit status. Without it `script` exits 0 over a red
+    # suite and this cache would record a PASS for a failing run.
+    ( cd "$ROOT/$folder" && "${_gate[@]}" script -qeF /dev/null bunx vitest run "${ARGS[@]}" )
+    st=$?
+  else
+    ( cd "$ROOT/$folder" && "${_gate[@]}" bunx vitest run "${ARGS[@]}" )
+    st=$?
+  fi
+fi
+
+# ONLY a pass is recorded. A red gate must re-run until it is green.
+if [ "$st" -eq 0 ]; then
+  date -u +%Y-%m-%dT%H:%M:%SZ > "$STAMP" 2>/dev/null
+  echo "[test-cached] PASS recorded ${KEY:0:12}"
+fi
+exit "$st"

package/scripts/test-full.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# test-full.sh — THE full vitest suite. One definition, every caller.
+#
+# manifest: needs-env
+#
+# WHY THIS FILE EXISTS. The full suite had two callers that ran it with
+# DIFFERENT arguments:
+#
+#   ./deploy   → test-cached.sh one.ie/web -- --testTimeout=15000 … --reporter=dot
+#   /close     → bun run test → gate-run test -- vitest run   (no memo at all)
+#
+# test-cached.sh keys a PASS on the exact input, and the argv is part of that
+# key. So the two callers could not share a stamp even on a byte-identical
+# tree — and the /close path was not memoised in the first place. A warm tree
+# therefore paid the full suite TWICE: once to close the plan, once to ship it,
+# for inputs that had not moved between them.
+#
+# The fix is not a smarter cache. It is removing the second definition: both
+# callers now run THIS script, so the argv they present to test-cached.sh is
+# identical by construction and the second run is a hit.
+#
+# WHAT THIS IS NOT. It is not the fast lane's stamps being reused to shrink the
+# full run. That was the first idea and it is unsound, recorded here so nobody
+# rebuilds it:
+#   · `vitest related --run <files>` and `vitest run` are different runs — fork
+#     assignment and module-graph order differ. A file that passes in a 2-file
+#     selection is NOT thereby proven in the 875-file pool, and this repo has
+#     order-dependent shared-TypeDB suites.
+#   · On a do/* branch the fast lane DEFERS the pins (.verify-fast-debt), so its
+#     stamps systematically exclude the gates the full run exists to pay.
+#   · The window is empty anyway: a fast stamp is valid only at tree-state T, and
+#     the full gate is only slow when the tree is not T.
+# The inputs to a full-pool run include the pool. Only a whole-suite pass may
+# stand in for a whole-suite run.
+#
+# TEST_CACHE_PTY=1 for a non-TTY stdout (the deploy gate logs to a file, and the
+# runner hangs there — see deploy.md "The vitest gate hangs").
+# --check asserts no caller has grown a second definition.
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+FOLDER="${TEST_FULL_FOLDER:-one.ie/web}"
+
+# The one definition. Changing a flag here changes it for every caller at once,
+# which is the whole point — a flag added on one side only would split the key
+# again and silently cost a second full suite.
+ARGS=(--testTimeout=15000 --hookTimeout=15000 --teardownTimeout=15000 --reporter=dot)
+
+# --- --check: the second definition must not come back ----------------------
+# A caller that runs the full suite by hand gets a different argv, so its PASS
+# cannot be reused by the other caller. That is invisible — everything is green,
+# it just costs an extra ~3 minutes — so it needs a checker, not a comment.
+if [ "${1:-}" = "--check" ]; then
+  fails=0
+  # deploy.sh must reach the suite through this script
+  if grep -qE 'test-cached\.sh[^|]*one\.ie/web[^|]*--[^|]*--reporter' "$ROOT/.claude/scripts/deploy.sh"; then
+    echo "FAIL: deploy.sh still spells out its own vitest args — it must call test-full.sh"; fails=$((fails+1))
+  else echo "ok: deploy.sh has no second definition"; fi
+  # package.json's `test` must not be a bare vitest run (test:raw is the escape)
+  _t=$(python3 -c "import json;print(json.load(open('$ROOT/$FOLDER/package.json'))['scripts'].get('test',''))" 2>/dev/null)
+  case "$_t" in
+    *test-full.sh*) echo "ok: package.json test routes through test-full.sh" ;;
+    *) echo "FAIL: package.json test is '$_t' — not routed through test-full.sh"; fails=$((fails+1)) ;;
+  esac
+  # and the two must present the SAME argv, which is only true if neither adds any
+  # A caller may prefix env (TEST_CACHE_PTY=1) but must pass NO vitest args --
+  # an arg on one side only splits the key and quietly costs a second full suite.
+  _extra=$(grep -n 'test-full\.sh' "$ROOT/.claude/scripts/deploy.sh" | grep -- '--' | grep -v -- '--check' || true)
+  if [ -n "$_extra" ]; then
+    echo "FAIL: deploy.sh passes args to test-full.sh -- that splits the key:"; echo "$_extra"; fails=$((fails+1))
+  else echo "ok: no caller adds arguments"; fi
+  [ "$fails" -eq 0 ] && { echo "test-full: check PASS"; exit 0; }
+  echo "test-full: check FAILED ($fails)"; exit 1
+fi
+
+# TWO LANES, not one run. The suite has two binding constraints — CPU for ~1126
+# files, and one shared external TypeDB gateway for 19 — and a single 8-fork pool
+# serves the second one so badly the gate became a coin flip (four runs on an
+# unchanged tree: 8, 12, 13, 8 different failures). test-lanes.sh splits them and
+# runs them concurrently. Measured 2026-09-03, same tree:
+#   before  238-282s, RED, rotating victims
+#   after   121.9s wall, GREEN — pool 1125 passed / typedb 19 passed
+# It still reaches test-cached.sh (once per lane), so passes are still memoised
+# and a RED is still never cached. ARGS above stays the one definition of the
+# vitest flags; test-lanes.sh consumes it via TEST_FULL_ARGS.
+export TEST_FULL_ARGS="${ARGS[*]}"
+exec bash "$ROOT/.claude/scripts/test-lanes.sh"

package/scripts/test-honesty.mjs

@@ -0,0 +1,137 @@
+#!/usr/bin/env node
+// test-honesty — find tests that CANNOT FAIL.
+//
+// Written 2026-08-18 after an audit found 8 security tests whose bodies were
+// comment-only. They backed a SETTLED contract: text/SECURITY-plan.md names the
+// UC9 and UC26 canaries as its proof observable, and the kill-switch grepped
+// `[1-9][0-9]+ passed` over the same file — satisfied by ~130 unrelated tests in
+// it. An empty body cannot fail, so the contract rested on nothing.
+//
+// It reports two classes, and only ever counts what it can prove from the source:
+//
+//   EMPTY   a test body containing no assertion at all. Always a defect: the
+//           test is scored as a pass and can never go red.
+//   SKIP    a conditional skip (skipIf / it.skip / runIf / ternary-gated it).
+//           Not a defect by itself — but a suite that skips is INDISTINGUISHABLE
+//           from one that passes, so the count must be visible. 31 tests in this
+//           repo sat behind an env var vitest could not see and had never once
+//           executed on any machine.
+//
+// Deliberately NOT a linter. It makes no style judgements and flags nothing it
+// cannot demonstrate from the text of the file.
+//
+// Usage:  node .claude/scripts/test-honesty.mjs [--json] [dir ...]
+// Exit:   1 if any EMPTY body is found, else 0.
+
+import { readdirSync, statSync, readFileSync } from 'node:fs'
+import path from 'node:path'
+
+const ROOT = path.resolve(path.dirname(new URL(import.meta.url).pathname), '..', '..')
+const args = process.argv.slice(2)
+const JSON_OUT = args.includes('--json')
+const dirs = args.filter((a) => !a.startsWith('--'))
+const TARGETS = dirs.length ? dirs : ['one.ie/web/tests', 'channels/test', 'channels/tests']
+
+function walk(dir, out = []) {
+  let entries
+  try { entries = readdirSync(dir) } catch { return out }
+  for (const e of entries) {
+    const full = path.join(dir, e)
+    let st
+    try { st = statSync(full) } catch { continue }
+    if (st.isDirectory()) walk(full, out)
+    else if (/\.(test|spec)\.[tj]sx?$/.test(e)) out.push(full)
+  }
+  return out
+}
+
+// Walk from the opening brace, tracking strings/comments, and return the body.
+function bodyFrom(src, openIdx) {
+  let depth = 0, i = openIdx
+  let inS = null, inLine = false, inBlock = false
+  for (; i < src.length; i++) {
+    const c = src[i], n = src[i + 1]
+    if (inLine) { if (c === '\n') inLine = false; continue }
+    if (inBlock) { if (c === '*' && n === '/') { inBlock = false; i++ } continue }
+    if (inS) { if (c === '\\') { i++; continue } if (c === inS) inS = null; continue }
+    if (c === '/' && n === '/') { inLine = true; i++; continue }
+    if (c === '/' && n === '*') { inBlock = true; i++; continue }
+    if (c === '"' || c === "'" || c === '`') { inS = c; continue }
+    if (c === '{') depth++
+    else if (c === '}') { depth--; if (depth === 0) return src.slice(openIdx + 1, i) }
+  }
+  return null
+}
+
+function stripInert(s) {
+  return s
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/(^|[^:])\/\/[^\n]*/g, '$1')
+}
+
+// An assertion, or a call that defers to one. `expect.assertions`, a bare
+// `await somethingThatThrows()`, and custom helpers all count — the point is to
+// catch bodies with NOTHING, not to police assertion style.
+const ASSERTS = /\b(expect|assert|should|chai|\.rejects|\.resolves|toMatchSnapshot|toThrow|fail\()/
+
+const findings = { empty: [], declared: [], indirect: [], skips: [] }
+
+for (const target of TARGETS) {
+  for (const file of walk(path.join(ROOT, target))) {
+    const src = readFileSync(file, 'utf8')
+    const rel = path.relative(ROOT, file)
+
+    // conditional skips
+    for (const m of src.matchAll(/\b(?:it|test|describe)\.(skipIf|runIf|skip)\b|\b(?:skipWithout\w*|maybeIt|maybeDescribe)\s*\(/g)) {
+      const line = src.slice(0, m.index).split('\n').length
+      findings.skips.push({ file: rel, line, form: m[0].trim() })
+    }
+
+    // assertion-free bodies
+    const re = /\b(?:it|test)(\.\w+)?\s*\(\s*(['"`])([\s\S]*?)\2\s*,\s*(?:async\s*)?\(\s*\)\s*=>\s*\{/g
+    for (const m of re.exec_all ? [] : [...src.matchAll(re)]) {
+      const open = src.indexOf('{', m.index + m[0].length - 1)
+      const body = bodyFrom(src, open)
+      if (body === null) continue
+      const code = stripInert(body).trim()
+      // Two classes, deliberately unequal. A body with NO CODE is provably
+      // unable to fail — a hard error. A body with code but no visible assertion
+      // token is only a SUSPICION: it may delegate to a helper that asserts
+      // internally (engine-golden.test.ts does exactly that via goldenCheck()).
+      // Reporting the second as a failure would make this checker the very thing
+      // it exists to catch — confident, and wrong.
+      const rec = {
+        file: rel,
+        line: src.slice(0, m.index).split('\n').length,
+        name: m[3].slice(0, 100),
+      }
+      // An empty body under .skip/.todo is HONEST — vitest reports it as
+      // skipped/todo, never as passed, and it documents intent. The defect is an
+      // empty body that WILL BE SCORED: it reports a pass and can never go red.
+      // That is exactly the shape of the 8 security tests that backed a settled
+      // contract while asserting nothing.
+      const declared = /^\.(skip|todo|fails)$/.test(m[1] ?? '')
+      if (code.length === 0 && !declared) findings.empty.push({ ...rec, reason: 'empty body that will be SCORED AS A PASS' })
+      else if (code.length === 0) findings.declared.push({ ...rec, reason: `honest placeholder (${m[1]})` })
+      else if (!ASSERTS.test(code)) findings.indirect.push({ ...rec, reason: 'no assertion token — verify it delegates to one' })
+    }
+  }
+}
+
+if (JSON_OUT) {
+  console.log(JSON.stringify(findings, null, 2))
+} else {
+  const bySkipFile = new Map()
+  for (const s of findings.skips) bySkipFile.set(s.file, (bySkipFile.get(s.file) ?? 0) + 1)
+  console.log(`test-honesty: scanned ${TARGETS.join(', ')}`)
+  console.log(`\nSKIP — conditional skips (visible, not failures): ${findings.skips.length} across ${bySkipFile.size} file(s)`)
+  for (const [f, n] of [...bySkipFile].sort((a, b) => b[1] - a[1]).slice(0, 15)) console.log(`  ${String(n).padStart(3)}  ${f}`)
+  console.log(`\nDECLARED — empty but honestly marked .skip/.todo: ${findings.declared.length}`)
+  console.log(`\nINDIRECT — no assertion token; verify each delegates to one: ${findings.indirect.length}`)
+    for (const e of findings.indirect.slice(0, 8)) console.log(`  ${e.file}:${e.line}  ${e.name}`)
+    if (findings.indirect.length > 8) console.log(`  … ${findings.indirect.length - 8} more (--json for all)`)
+    console.log(`\nEMPTY — tests that CANNOT FAIL: ${findings.empty.length}`)
+  for (const e of findings.empty) console.log(`  ${e.file}:${e.line}  ${e.reason}\n      ${e.name}`)
+}
+
+process.exit(findings.empty.length > 0 ? 1 : 0)