@oneie/claude 0.8.0 → 0.10.0

package/scripts/do-rank.py

@@ -23,6 +23,8 @@ Usage:
   do-rank.py                 human table
   do-rank.py --json          machine queue for the fleet
   do-rank.py --top N         the N highest READY slugs, one per line
+  do-rank.py --board-check   perform the live board read (floors print as `>=N`)
+  do-rank.py --untriaged [ws]  the triage queue as JSON — tasks:board, every page
 """
 import json
 import os
@@ -392,6 +394,60 @@ def _gateway_key():
     return found["one-"] or found["osk_"] or found["gw"]
 
 
+# ── the cap, and whether it bit ───────────────────────────────────────────────
+# Both board doors can hand back a PAGE and let it read as the board, and until
+# 2026-09-13 neither caller here looked. The two doors do not mean the same thing
+# by `total`, so they are not read the same way:
+#   tasks:everywhere — `total` is "visible rows BEFORE the limit was applied"
+#     (receivers.ts) and `truncated` is true when more exist. Both usable.
+#   /api/things      — `total` is `tasks.length` of the slice it JUST CUT
+#     (api/things/index.ts:396: "We do NOT claim a grand total we never
+#     measured"). Only its `truncated` object is usable; printing its `total`
+#     as a board total would be a NEW dishonesty, so it is deliberately dropped.
+# What this records is what the last read can honestly say. A number that is a
+# floor prints as a floor — `>=N` — because the rows past the cap were never seen.
+LAST_BOARD_READ = {"door": "", "returned": 0, "total": None, "truncated": False, "why": ""}
+
+
+def _note_board_read(door, returned, total=None, truncated=False, asked=None):
+    """Record what the last board read can honestly say about its own cap. Called by
+    EVERY board read, including the failing ones, so a stale note can never be read
+    as this read's answer.
+
+    `asked` is the limit WE SENT, and it is the load-bearing argument. Measured
+    2026-09-13 against prod: `tasks:everywhere` returned exactly 200 rows — our own
+    limit — with NO `total` and NO `truncated`, because those two fields are
+    declared in receivers.ts and the deployed worker does not yet send them. So a
+    cap that reports itself is a contract, not a fact, and trusting it would have
+    printed a silent floor as a clean count: exactly the defect this exists to fix.
+    A full page is structural evidence of a cap — it is derived from what we asked
+    for, so it holds whether or not the door is honest yet."""
+    truncated = bool(truncated)
+    why = "the door reported a cap" if truncated else ""
+    if not truncated and isinstance(asked, int) and asked > 0 and returned >= asked:
+        truncated, why = True, f"the page came back FULL at our own limit of {asked}, and the door reported no cap"
+    LAST_BOARD_READ.update(
+        door=door, returned=returned,
+        total=total if isinstance(total, int) else None,
+        truncated=truncated, why=why,
+    )
+    return LAST_BOARD_READ
+
+
+def board_count_phrase(n=None):
+    """How many rows the last board read actually PROVES, as words.
+
+    Uncapped → the count. Capped with a usable pre-limit total → `N of T (capped)`.
+    Capped with no honest total → `>=N (capped)`. Never a bare count over a cap."""
+    r = LAST_BOARD_READ
+    n = r["returned"] if n is None else n
+    if not r["truncated"]:
+        return str(n)
+    if isinstance(r["total"], int) and r["total"] > n:
+        return f"{n} of {r['total']} (CAPPED — {r['total'] - n} row(s) never read)"
+    return f">={n} (CAPPED — {r['why'] or 'the door returned a page, not the board'})"
+
+
 def fetch_tasks_everywhere(timeout=None):
     """Board-origin open tasks — the substrate half of the ranked queue (tasks-do C2).
 
@@ -470,7 +526,11 @@ def fetch_tasks_everywhere(timeout=None):
         return [], f"receiver refused: {err}{hint}"
     rows = inner.get("tasks", [])
     if not isinstance(rows, list):
+        _note_board_read("tasks:everywhere", 0)
         return [], "malformed response (tasks is not a list)"
+    # The receiver declares both (receivers.ts § tasks:everywhere) and this dropped
+    # them: a 595-row queue answered as 200 and read as the whole board.
+    _note_board_read("tasks:everywhere", len(rows), inner.get("total"), inner.get("truncated"), asked=200)
     # tasks:everywhere answers "workspaces I BELONG TO" — assignment/follow/ownership. A key
     # whose actor belongs to nothing (the MCP bootstrap agent is one) gets ok:true and an
     # empty list while the operator's own board is full. That green-empty read is worse than
@@ -518,10 +578,125 @@ def fetch_workspace_board(timeout=None, workspace=None):
         return [], f"unreachable ({type(e).__name__})"
     rows = payload.get("things") if isinstance(payload, dict) else None
     if not isinstance(rows, list):
+        _note_board_read("/api/things", 0)
         return [], "malformed response (things is not a list)"
+    # `limit=200` above is a HARD cap and this read is the ranker's last word on
+    # what is on the board. /api/things reports its own cap as a `truncated`
+    # OBJECT (absent = nothing was cut) — truthy is the whole test. Its `total` is
+    # the length of the slice, so it is NOT passed on as a board total.
+    _note_board_read("/api/things", len(rows), None, bool(payload.get("truncated")), asked=200)
     return rows, ""
 
 
+def board_ask(receiver, data, timeout=None):
+    """POST one receiver through the same door fetch_tasks_everywhere uses, with the
+    /api/ask envelope unwrapped. Returns (inner, reason) — never a silent empty."""
+    if timeout is None:
+        timeout = float(os.environ.get("DO_RANK_BOARD_TIMEOUT", "25"))
+    secret = _gateway_key()
+    if not secret:
+        return None, "no GATEWAY_API_KEY in one.ie/web/.env"
+    url = os.environ.get("DO_SIGNAL_URL", "https://one.ie") + "/api/ask/" + receiver
+    req = urllib.request.Request(
+        url, data=json.dumps({"data": data}).encode(), method="POST",
+        headers={
+            "Content-Type": "application/json",
+            "Authorization": f"Bearer {secret}",
+            # Cloudflare 403s the default urllib UA before the Worker runs.
+            "User-Agent": "one-do-rank/1.0 (+https://one.ie)",
+        },
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as r:
+            payload = json.loads(r.read().decode())
+    except urllib.error.HTTPError as e:
+        detail = "CF bot block (UA rejected)" if e.code == 403 else ""
+        return None, f"HTTP {e.code}{' — ' + detail if detail else ''}"
+    except Exception as e:
+        return None, f"unreachable ({type(e).__name__})"
+    if not isinstance(payload, dict):
+        return None, "malformed response (not an object)"
+    inner = payload.get("result")
+    inner = inner if isinstance(inner, dict) else payload
+    if not inner.get("ok"):
+        return None, str(inner.get("error") or payload.get("outcome") or "unknown")
+    return inner, ""
+
+
+# What triage treats as already-shaped. A row whose prose goal opens with this has
+# a one-line check that proves it done, which is the whole output of a triage pass.
+TRIAGED_PREFIX = "accept:"
+
+
+def fetch_untriaged(workspace=None, pages=None, timeout=None):
+    """Every OPEN row whose notes do NOT begin `accept:` — the triage queue, read
+    deterministically.
+
+    Why this is a script and not a prompt: triage.js used to hand a model the ONE
+    LINE `--board-check` prints and ask it for `{id,title,notes}[]`. That line
+    carries no rows, so the only possible answers were an invented list or an empty
+    one, and the only guard was the words "Do not invent rows." A fact the harness
+    needs gets a script (.claude/CLAUDE.md).
+
+    ONE door — tasks:board — followed to the LAST page. `nextCursor` is present iff
+    more rows match, so stopping at page one reports a page as the board; that is
+    the exact failure this mode exists to refuse. `include:["notes"]` is required:
+    a compact row carries no notes and the accept: test IS the filter. There is no
+    server-side notes filter, so the test runs here, over every page.
+
+    `truncated` is a DIFFERENT cut from paging — it means the snapshot itself hit a
+    budget, so `total` is only a floor. It is carried through verbatim."""
+    ws = workspace or os.environ.get("CC_TASKS_WORKSPACE", "one")
+    # A ceiling on the cursor walk so a runaway board cannot loop forever. 20 pages
+    # x 500 rows is 10,000 — far past any real board, and reported when it bites.
+    pages = int(pages or os.environ.get("DO_RANK_UNTRIAGED_PAGES", "20"))
+    out, cursor, total, truncated, seen, page = [], None, None, None, 0, 0
+    while page < pages:
+        req = {"workspace": ws, "status": "open", "view": "rows",
+               "include": ["notes"], "limit": 500, "sort": "priority"}
+        if cursor:
+            req["cursor"] = cursor
+        inner, reason = board_ask("tasks:board", req, timeout=timeout)
+        if reason:
+            # A failure mid-walk leaves a PARTIAL answer, and it must never read as
+            # the whole board: truncated=True is the honest state, always a 3-tuple.
+            _note_board_read("tasks:board", seen, total, True)
+            return out, f"page {page + 1}: {reason}", {
+                "workspace": ws, "scanned": seen, "total": total,
+                "truncated": truncated or None, "pagesExhausted": True, "pages": page,
+            }
+        rows = inner.get("tasks")
+        rows = rows if isinstance(rows, list) else []
+        if total is None and isinstance(inner.get("total"), int):
+            total = inner["total"]
+        if inner.get("truncated") and truncated is None:
+            truncated = inner["truncated"]
+        seen += len(rows)
+        for r in rows:
+            notes = str(r.get("notes") or "")
+            if notes.lstrip().lower().startswith(TRIAGED_PREFIX):
+                continue
+            out.append({"id": r.get("tid", ""), "title": r.get("name", ""),
+                        "notes": notes, "priority": r.get("priority", 0),
+                        "assignee": r.get("assignee", ""), "tags": r.get("tags") or []})
+        page += 1
+        cursor = inner.get("nextCursor")
+        if not cursor:
+            break
+    # Two independent cuts, reported separately: `truncated` = the snapshot was
+    # capped (total is a floor); `pagesExhausted` = WE stopped following cursors.
+    # `asked` is the third and it needs no cooperation from the door: a LAST page
+    # that came back full with no nextCursor is a cap that did not announce itself
+    # (measured on tasks:everywhere the day this was written — it returned exactly
+    # our limit and declared neither field).
+    pages_exhausted = bool(cursor)
+    _note_board_read("tasks:board", seen, total, bool(truncated) or pages_exhausted,
+                     asked=None if cursor else 500 * page or None)
+    return out, "", {"workspace": ws, "scanned": seen, "total": total,
+                     "truncated": truncated or None, "pagesExhausted": pages_exhausted,
+                     "pages": page, "capNote": LAST_BOARD_READ["why"] or None}
+
+
 def board_task_entry(row):
     """Shape one tasks:everywhere row as a plan-like dict — the same keys tasks_view()/
     tasks_seed() already read off a local todo's `plans[slug]` entry, so a board-created
@@ -549,13 +724,17 @@ def merge_board_tasks(active, plans):
     local match is a pure board-created task and is simply added. Empty/failed fetch is a
     no-op — file-only ranking, unchanged."""
     rows, reason = fetch_tasks_everywhere()
+    door = LAST_BOARD_READ["door"] or "tasks:everywhere"
     if not rows:
         why = reason or "board is empty (0 open tasks)"
-        print(f"[do-rank] tasks:everywhere: 0 rows — {why} — file-only fallback", file=sys.stderr)
+        print(f"[do-rank] {door}: 0 rows — {why} — file-only fallback", file=sys.stderr)
         return active
     board_entries = [board_task_entry(r) for r in rows]
     matched_slugs = {e["slug"] for e in board_entries if e["slug"] in plans}
-    print(f"[do-rank] tasks:everywhere: merged {len(board_entries)} row(s), "
+    # The door is named because the fallback inside fetch_tasks_everywhere can
+    # answer from /api/things, and this line said "tasks:everywhere" either way.
+    # The count is a FLOOR whenever that door capped — say so, don't round it off.
+    print(f"[do-rank] {door}: merged {board_count_phrase(len(board_entries))} row(s), "
           f"{len(matched_slugs)} superseding a local todo", file=sys.stderr)
     return [p for p in active if p["slug"] not in matched_slugs] + board_entries
 
@@ -1324,9 +1503,27 @@ def main():
         if reason:
             print(f"[board-check] RED — {target}: {reason}", file=sys.stderr)
             return 1
-        print(f"[board-check] OK — {target}: {len(rows)} open task(s) readable")
+        door = LAST_BOARD_READ["door"] or "tasks:everywhere"
+        print(f"[board-check] OK — {target}: {board_count_phrase(len(rows))} "
+              f"open task(s) readable (door: {door})")
         return 0
 
+    # `--untriaged [workspace]` — the triage queue as JSON on stdout, read through
+    # tasks:board and followed to the last page. This is what .claude/workflows/
+    # triage.js consumes: it used to ask a model to enumerate rows out of
+    # --board-check's single summary line, which carries none. Deterministic fact,
+    # deterministic script. Always prints an object; `ok:false` carries the reason.
+    if "--untriaged" in args:
+        i = args.index("--untriaged")
+        ws = args[i + 1] if len(args) > i + 1 and not args[i + 1].startswith("-") else None
+        rows, reason, meta = fetch_untriaged(workspace=ws)
+        out = {"ok": not reason, "tasks": rows, "returned": len(rows)}
+        out.update(meta)
+        if reason:
+            out["error"] = reason
+        print(json.dumps(out))
+        return 0 if not reason else 1
+
     # `--lint` — mechanical deliverables hygiene across all OPEN plans. Flags phantom
     # paths (under-qualified/wrong-rooted) that make a plan a fleet false-parallel, and
     # plans with NO parseable deliverables (a fleet hazard). Exit 1 if any plan is dirty.

package/scripts/do-reconcile.sh

@@ -324,23 +324,84 @@ case "$CANON" in
       _fp=$(tsc_tree_fingerprint "$folder" $_fp_extra)
       _cache="$GOVERN_DIR/tsc-$(printf '%s' "$folder" | tr '/' '_').$_fp"
 
+      # Set HERE, outside the branches, so the rc=3 handler below can never read
+      # a value left by an earlier folder or an unset variable.
+      _tsc_rc=0
       if [ -s "$_cache" ]; then
         current=$(cat "$_cache" | tr -d '[:space:]')          # someone already computed it
-      elif gate_lock "tsc-$(printf '%s' "$folder" | tr '/' '_')" "${RECONCILE_TSC_WAIT:-900}"; then
-        trap 'gate_release_all' EXIT INT TERM
-        if [ -s "$_cache" ]; then
+      else
+        # ── SLOT BEFORE LOCK ─────────────────────────────────────────────────
+        # This block used to take the gate_lock HERE and then queue for a slot
+        # while holding it. tsc-cached.sh had the same inversion, on the SAME
+        # lock name (`tsc-<folder>` — the shared memo namespace is deliberate),
+        # and between them they deadlocked the whole box three times in ~35
+        # minutes on 2026-09-13: one side held a slot and waited for this lock,
+        # the other held this lock and waited for a slot. Neither owner was
+        # dead, so nothing reaped it, and killing the LOCK holder only handed
+        # the lock to the next waiter and re-formed the cycle within seconds.
+        # tsc-cached.sh § SLOT BEFORE LOCK has the full account; the proof is
+        # `bash .claude/scripts/govern-order-check.sh`.
+        #
+        # So the lock is taken INSIDE the gate-run command, never around it: a
+        # slot is held before anyone waits on this lock. The inner shell's exit
+        # code carries which of the three things happened — 3 = could not lock,
+        # 4 = someone else's answer appeared while we queued, 0 = we computed.
+        #
+        # Resolve gate-run from THIS script's own directory. An earlier version
+        # used "$ROOT/..." -- ROOT is never set in this file, and under `set -u`
+        # that is a hard "unbound variable" that killed the whole `types` canon.
+        # Caught by tests/integration/reconcile.test.ts, which is the reason
+        # that test exists.
+        _tsc_tmp=$(mktemp)
+        _tsc_rc=0
+        _gr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/gate-run.sh"
+        _gv="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/govern.sh"
+        # The compute is passed as DATA, not as nested quoting: three levels of
+        # `bash -c "... \"...\" ..."` is how a pipeline silently loses its
+        # redirect. Everything the inner shells read arrives through the
+        # environment instead.
+        _RC_SCRIPT='cd "$_RC_FOLDER" && bunx tsc --noEmit 2>&1 | grep -c "error TS" > "$_RC_TMP"'
+        _RC_FOLDER="$folder" _RC_TMP="$_tsc_tmp" _RC_CACHE="$_cache" _RC_SCRIPT="$_RC_SCRIPT" \
+        _RC_LOCK="tsc-$(printf '%s' "$folder" | tr '/' '_')" _RC_GV="$_gv" \
+        _RC_WAIT="${RECONCILE_TSC_WAIT:-900}" _RC_TIMEOUT="${RECONCILE_TSC_TIMEOUT:-600}" \
+        GOVERN_GATE_TIMEOUT=$(( ${RECONCILE_TSC_TIMEOUT:-600} + ${RECONCILE_TSC_WAIT:-900} + 60 )) \
+        bash "$_gr" "tsc-reconcile:$folder" -- bash -c '
+          . "$_RC_GV"
+          gate_lock "$_RC_LOCK" "$_RC_WAIT" || exit 3
+          trap "gate_release_all" EXIT INT TERM
+          [ -s "$_RC_CACHE" ] && exit 4
+          run_bounded "$_RC_TIMEOUT" bash -c "$_RC_SCRIPT" || true
+          exit 0' || _tsc_rc=$?
+        # `|| _tsc_rc=$?`, never a bare `$?` on the next line: this file runs
+        # under `set -e`, so an exit 3 or 4 from the inner shell would kill the
+        # canon before the code could be read. The `|| true` this replaces hid
+        # every one of those codes.
+        if [ "$_tsc_rc" = "4" ] && [ -s "$_cache" ]; then
           current=$(cat "$_cache" | tr -d '[:space:]')        # computed while we queued
-        else
-          _tsc_tmp=$(mktemp)
-          run_bounded "${RECONCILE_TSC_TIMEOUT:-600}" \
-            bash -c "cd '$folder' && bunx tsc --noEmit 2>&1 | grep -c 'error TS' > '$_tsc_tmp'" \
-            2>/dev/null || true
+          rm -f "$_tsc_tmp"
+        elif [ "$_tsc_rc" != "3" ]; then
           current=$(cat "$_tsc_tmp" 2>/dev/null | tr -d '[:space:]'); rm -f "$_tsc_tmp"
-          current=${current:-0}
-          printf '%s' "$current" > "$_cache"
+          # AN UNRUN CHECK IS NEVER MEMOISED. This canon reports a DELTA and has
+          # always fallen open to 0 when it could not measure — that is its own
+          # call and is unchanged. What must not happen is that 0 being SHARED:
+          # this file is `$GOVERN_DIR/tsc-<folder>.<fp>`, the exact object
+          # tsc-cached.sh's `_cache_ok` accepts as a reusable PASS, so an unrun
+          # typecheck would become a green gate for every later reader on that
+          # tree, in every session and worktree.
+          #
+          # Reachable, and this is the line that made it likely: the slot queue
+          # is now the FIRST thing a miss does, so `gate-run … no slot after
+          # 1800s` on a saturated box lands here with an empty count file.
+          # Measured 2026-09-13 in a sandbox: GOVERN_QUEUE_WAIT=8 with the one
+          # slot held printed `OK — tsc delta=0` and wrote a `0` stamp.
+          case "$current" in
+            ''|*[!0-9]*) current=0 ;;                       # could not measure: no stamp
+            *) printf '%s' "$current" > "$_cache" ;;         # a real count is shareable
+          esac
         fi
-        gate_release_all; trap - EXIT INT TERM
-      else
+      fi
+      if [ "${_tsc_rc:-0}" = "3" ]; then
+        rm -f "${_tsc_tmp:-}"
         # Lock held for the full wait. Re-check the cache once — the holder may
         # have finished and released between our last poll and now.
         if [ -s "$_cache" ]; then

package/scripts/do-signal.sh

@@ -13,6 +13,7 @@
 #   do-signal.sh [--print] --task-reap
 #   do-signal.sh [--print] --task-link   <slug> [docs=a,b,c]
 #   do-signal.sh [--print] --task-heartbeat <slug> <body>
+#   do-signal.sh [--print] --outcome <slug> tags=a,b actor=<aid> success=<bool> [weight=<n>]
 #
 # --print: write JSON to stdout without POSTing (tests + dry runs).
 # Extra key=value pairs are merged into the world:do-event payload.
@@ -117,6 +118,23 @@ _jsonesc() { printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\t/\\t
 # session happened to be attested.
 CC_TASKS_WORKSPACE="${CC_TASKS_WORKSPACE:-one}"
 
+# CC_TASKS_AUTHOR — WHO the comment is from, when it is not simply "the
+# workspace". tasks:comment records an author on the message and the inbox draws
+# it (three directors on one task read as three speakers, not one anonymous
+# run), but a field no caller supplies is a field production never sets: this
+# script and the MCP door are the two writers, and both built their payload with
+# tid/workspace/body only, so every /do close and every wave heartbeat landed
+# `authorKind:"staff"`. The receiver honours the field only for an ATTESTED
+# staff caller — which is exactly what GATEWAY_API_KEY auth above makes this
+# script — and validates the slug shape; a caller that cannot be attested names
+# nobody. UNSET is the default and emits the byte-identical payload this script
+# has always sent, so nothing changes for a harness that does not set it.
+CC_TASKS_AUTHOR="${CC_TASKS_AUTHOR:-}"
+_author_json() {  # emits `,"author":"<slug>"` or nothing
+  [ -n "$CC_TASKS_AUTHOR" ] || return 0
+  printf ',"author":"%s"' "$CC_TASKS_AUTHOR"
+}
+
 # signal_tasks_create — plan arm: files an open task tagged slug:<slug>, so the
 # plan appears in tasks:everywhere the moment it's armed (C1/C2 interface contract).
 signal_tasks_create() {  # signal_tasks_create <slug> <title> [tags=a,b,c] [notes=...]
@@ -152,25 +170,16 @@ signal_tasks_create() {  # signal_tasks_create <slug> <title> [tags=a,b,c] [note
 # The cycle list is read from do-plan-json.sh, which is a parser, not a model.
 # tasks:create dedupes on the slug tag, so re-running a plan is idempotent.
 signal_tasks_plan() {  # signal_tasks_plan <slug>
-  local slug="$1" plan cid title n=0
-  plan="$(bash "$(dirname "${BASH_SOURCE[0]}")/do-plan-json.sh" "$slug" 2>/dev/null)" || {
-    printf 'do-signal: cannot parse plan %s — no cycle tasks filed\n' "$slug" >&2; return 1; }
-  # one task per cycle, tagged so the router can fan on any of them
-  while IFS=$'\t' read -r cid title; do
-    [ -n "$cid" ] && [ "$cid" != "null" ] || continue
-    if $PRINT; then
-      signal_tasks_create "${slug}-${cid}" "${title:-$slug $cid}" "tags=do:cycle,cycle:${cid#C},slug:${slug}"
-    else
-      signal_tasks_create "${slug}-${cid}" "${title:-$slug $cid}" "tags=do:cycle,cycle:${cid#C},slug:${slug}" >/dev/null || true
-    fi
-    n=$((n+1))
-    # `.cycles` is an OBJECT KEYED BY CYCLE ID, not an array. The first draft
-    # used `.cycles[]? | .id` and got null for every id -- it still reported
-    # "filed 2 cycle task(s)", so the count looked right while every task was
-    # named `<slug>-` and tagged `cycle:`. A count is not a check.
-  done < <(printf '%s' "$plan" | jq -r '.cycles | to_entries[] | "\(.key)\t\(.value.title // .key)"' 2>/dev/null)
-  [ "$n" -gt 0 ] || { printf 'do-signal: %s parsed but yielded ZERO cycles — refusing to report success\n' "$slug" >&2; return 1; }
-  printf 'do-signal: filed %d cycle task(s) for %s\n' "$n" "$slug"
+  # ONE MINTER (2026-09-12). This used to file the cycles itself — flat, unchained,
+  # tagged `slug:<slug>-C1` in UPPER case. SLUG_RE is lowercase-only, so those rows
+  # never deduped on re-arm and `--task-cycle` (which lowercases) closed a DIFFERENT
+  # row: the armed rows sat open forever. do-board.sh mints the same rows chained
+  # (`tasks:subtask` + blockedBy from the batch DAG), tagged `slug:<slug>-c<n>` —
+  # the exact tag _tid_for_slug resolves — so the existing --task-cycle close moves
+  # THESE rows and the gate unblocks the next batch by itself.
+  local slug="$1"
+  if $PRINT; then bash "$_ROOT/.claude/scripts/do-board.sh" "$slug" --dry-run; return $?; fi
+  bash "$_ROOT/.claude/scripts/do-board.sh" "$slug"
 }
 
 # signal_tasks_claim — cycle open: leases the plan's substrate task so a fleet
@@ -224,7 +233,15 @@ signal_tasks_claim() {  # signal_tasks_claim <slug>
   # task:<traceId>, so "task:<slug>" never matched — claim silently 404'd for every /do
   # run until this. The server resolves slug → tid (resolvers/tasks.ts resolveTaskBySlug).
   local slug="$1" tid
-  tid=$(_tid_for_slug "$slug") || true
+  # THE LEASE MOVES TO THE CYCLE. Once do-board.sh hangs cycle rows off the plan
+  # row (`containment`), blockersResolved refuses `picked` on the parent while any
+  # child is open — so a claim on the plan row reads `blocked` for the whole run.
+  # Claim the FIRST OPEN CYCLE's row instead: the thing actually in flight, gated by
+  # its own batch predecessors, which is the DAG doing its job. Falls back to the
+  # plan row for an unmirrored plan.
+  tid=$(DO_PLAN_TODO="${DO_PLAN_TODO:-}" bash "$_ROOT/.claude/scripts/do-plan-json.sh" "$slug" 2>/dev/null \
+        | jq -r '.cycleRows[.openCycles[0]] // empty' 2>/dev/null) || true
+  [ -n "$tid" ] || tid=$(_tid_for_slug "$slug") || true
   local payload
   if [ -n "$tid" ]; then
     payload="{\"data\":{\"tid\":\"${tid}\",\"workspace\":\"${CC_TASKS_WORKSPACE}\"}}"
@@ -248,6 +265,65 @@ signal_tasks_reap() {  # signal_tasks_reap
 # signal_tasks_link — cycle close: records the handoff-completion back on the
 # origin task (provenance line + task-status:done), same shape lifecycle.ts's
 # tasks_link MCP tool posts.
+# signal_outcome — /close's loop-closer, and the reason it is world:outcome.
+#
+# THE NAMING GAP, measured. `/api/receivers/signals` ranks every emitted signal
+# name as declared | candidate | unhomed against packages/sdk/src/receivers.ts,
+# because 35 distinct event names were emitted in 90 days and exactly ONE
+# (`world:in`) was a declared receiver. /close was a top contributor: measured
+# 2026-09-09, `do:close` 0, `loop:feedback` 0, `world:do-event` 0 declarations —
+# three of the four names it emitted could not be answered by anything, and it
+# reported success anyway.
+#
+# `world:outcome` is not a new contract written for this. It already says exactly
+# what /close does: "whoever consumed a route reports success/failure, moving the
+# same tag->receiver paths the router reads - success marks, failure warns."
+# So the fix converges four names to one and designs nothing.
+#
+# THE VERB IS READ BACK, NEVER ASSUMED. The receiver answers
+# {ok, outcome:"marked"|"warned", ...}; a caller that prints "marked" because it
+# sent success:true is reporting its own intent, which is the class of defect the
+# whole four-outcome grammar exists to stop.
+#
+# TAGS ARE BARE WORDS. `marketing`, never `lifecycle:marketing` - a namespaced
+# tag matches zero subscribers. `slug:`/`cycle:` are provenance, not stakes, and
+# are appended separately so they can never be mistaken for a routable tag.
+signal_outcome() {  # signal_outcome <slug> tags=a,b actor=<aid> success=<bool> weight=<n> [workspace=<ws>]
+  local slug="$1"; shift
+  local tags="" actor="" success="true" weight="" ws="${CC_TASKS_WORKSPACE}"
+  local kv
+  for kv in "$@"; do
+    case "$kv" in
+      tags=*)      tags="${kv#*=}" ;;
+      actor=*)     actor="${kv#*=}" ;;
+      success=*)   success="${kv#*=}" ;;
+      weight=*)    weight="${kv#*=}" ;;
+      workspace=*) ws="${kv#*=}" ;;
+    esac
+  done
+  [ -n "$slug" ]  || { echo "signal_outcome: slug required" >&2; return 2; }
+  [ -n "$actor" ] || { echo "signal_outcome: actor= required (world:outcome moves that actor's paths)" >&2; return 2; }
+  case "$success" in true|false) ;; *) echo "signal_outcome: success must be true|false" >&2; return 2 ;; esac
+
+  # A namespaced word here would route to nobody. Refuse it loudly rather than
+  # emit a signal that matches zero subscribers and still exits 0.
+  local t
+  for t in ${tags//,/ }; do
+    case "$t" in
+      slug:*|cycle:*) ;;
+      *:*) echo "signal_outcome: '$t' is namespaced - stake tags are BARE words (see subscribe-tags-parity.test.ts)" >&2; return 2 ;;
+    esac
+  done
+
+  tags="${tags:+${tags},}slug:${slug}"
+  local tags_json
+  tags_json=$(printf '%s' "$tags" | awk -F',' '{for(i=1;i<=NF;i++){if($i!=""){printf "%s\"%s\"", (n++?",":""), $i}}}')
+
+  local payload="{\"data\":{\"tags\":[${tags_json}],\"actor\":\"$(_jsonesc "$actor")\",\"success\":${success}${weight:+,\"weight\":${weight}},\"slug\":\"$(_jsonesc "$slug")\",\"workspace\":\"$(_jsonesc "$ws")\"}}"
+  if $PRINT; then printf '%s\n' "$payload"; return 0; fi
+  _post_ask "world:outcome" "$payload"
+}
+
 signal_tasks_link() {  # signal_tasks_link <slug> [docs=a,b,c]
   # Slug-addressed like claim — the server resolves slug → the origin tid create wrote.
   local slug="$1" docs=""
@@ -269,7 +345,7 @@ signal_tasks_link() {  # signal_tasks_link <slug> [docs=a,b,c]
   if _post_ask "tasks:link" "$payload"; then return 0; fi
   [ -n "$tid" ] || return 1
   _post_ask "tasks:status" "{\"data\":{\"tid\":\"${tid}\",\"workspace\":\"${CC_TASKS_WORKSPACE}\",\"status\":\"done\"}}" >/dev/null || return 1
-  _post_ask "tasks:comment" "{\"data\":{\"tid\":\"${tid}\",\"workspace\":\"${CC_TASKS_WORKSPACE}\",\"body\":\"/do close — ${slug}${docs:+ (docs: ${docs})}\"}}"
+  _post_ask "tasks:comment" "{\"data\":{\"tid\":\"${tid}\",\"workspace\":\"${CC_TASKS_WORKSPACE}\",\"body\":\"/do close — ${slug}${docs:+ (docs: ${docs})}\"$(_author_json)}}"
 }
 
 # signal_tasks_heartbeat — batch/wave close: posts tasks:comment so the lease
@@ -285,9 +361,9 @@ signal_tasks_heartbeat() {  # signal_tasks_heartbeat <slug> <body>
   # accompanied, when the tid is known — otherwise the broken resolver runs anyway.
   local payload
   if [ -n "$tid" ]; then
-    payload="{\"data\":{\"tid\":\"${tid}\",\"workspace\":\"${CC_TASKS_WORKSPACE}\",\"body\":\"${body_esc}\"}}"
+    payload="{\"data\":{\"tid\":\"${tid}\",\"workspace\":\"${CC_TASKS_WORKSPACE}\",\"body\":\"${body_esc}\"$(_author_json)}}"
   else
-    payload="{\"data\":{\"slug\":\"${slug}\",\"workspace\":\"${CC_TASKS_WORKSPACE}\",\"body\":\"${body_esc}\"}}"
+    payload="{\"data\":{\"slug\":\"${slug}\",\"workspace\":\"${CC_TASKS_WORKSPACE}\",\"body\":\"${body_esc}\"$(_author_json)}}"
   fi
   if $PRINT; then printf '%s\n' "$payload"; return 0; fi
   _post_ask "tasks:comment" "$payload"
@@ -315,6 +391,7 @@ while [ "$#" -gt 0 ]; do
     --task-reap)       shift; signal_tasks_reap "$@"; exit $? ;;
     --task-link)       shift; signal_tasks_link "$@"; exit $? ;;
     --task-heartbeat)  shift; signal_tasks_heartbeat "$@"; exit $? ;;
+    --outcome)         shift; signal_outcome "$@"; exit $? ;;
     *) break ;;
   esac
 done
@@ -322,6 +399,7 @@ done
 if [ "$#" -lt 4 ]; then
   echo "usage: do-signal.sh [--print] <type> <slug> <tier> <cycle> [key=value ...]" >&2
   echo "       do-signal.sh [--print] --task-create|--task-claim|--task-link|--task-heartbeat <slug> ..." >&2
+  echo "       do-signal.sh [--print] --outcome <slug> tags=a,b actor=<aid> success=<bool> [weight=<n>]" >&2
   exit 1
 fi
 

package/scripts/do-smoke.sh

@@ -4,6 +4,23 @@
 # the seven-canon predicate (do-reconcile.sh) + navigation reachable/orphan fixtures.
 # Exits 0 only if ALL pass.
 set -uo pipefail
+
+# _GATE — route a heavy compute through the machine governor. A gate_lock only
+# dedupes IDENTICAL work; a SLOT is what bounds N worktrees each running one of
+# these at once (measured 2026-09-07: three concurrent 2.5GB typecheckers, every
+# lock uncontended, load 171). Empty when already inside a gate, so a nested call
+# inherits the outer slot rather than taking a second one.
+#
+# Resolves gate-run.sh from its OWN directory, deliberately: an earlier version
+# keyed off $ROOT and got inserted above the line that sets it, so _GATE was
+# silently empty and every call ran ungoverned -- a fail-OPEN, which is the exact
+# defect this preamble exists to close.
+_GATE=()
+if [ "${GOVERN_IN_GATE:-0}" != "1" ]; then
+  _GR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/gate-run.sh"
+  [ -f "$_GR" ] && _GATE=( bash "$_GR" "compute:$(basename "${BASH_SOURCE[0]}")" -- )
+fi
+
 cd "$(dirname "${BASH_SOURCE[0]}")/../.." || exit 2
 S=.claude/scripts
 fail=0
@@ -61,7 +78,7 @@ echo "== C2 do-reconcile — types canon =="
 # Use a temp file to capture grep output — avoids pipefail swallowing the value when tsc
 # exits non-zero (which it does whenever there are any type errors).
 _tsc_tmp=$(mktemp)
-( cd one.ie/web 2>/dev/null && bunx tsc --noEmit 2>&1 | grep -c 'error TS' > "$_tsc_tmp" ) 2>/dev/null || true
+( cd one.ie/web 2>/dev/null && "${_GATE[@]}" bunx tsc --noEmit 2>&1 | grep -c 'error TS' > "$_tsc_tmp" ) 2>/dev/null || true
 _tsc_now=$(cat "$_tsc_tmp" 2>/dev/null | tr -d '[:space:]'); rm -f "$_tsc_tmp"
 echo "{\"tscErrors\": ${_tsc_now:-0}}" > .w0-baseline.json
 "$S/do-reconcile.sh" types >/dev/null 2>&1 && ok "types delta=0 → exit 0" || no "types should pass when no delta"

package/scripts/do-w4-gates.sh

@@ -49,6 +49,16 @@
 #                        because a skip is unrun, not pass; never set it for real.
 set -euo pipefail
 
+# _GATE — see governor-doors-check.sh "compute sites". A gate_lock dedupes
+# identical work; only a SLOT bounds N worktrees running N computes at once.
+# Empty inside an existing gate so the outer slot is inherited, never doubled.
+_GATE=()
+if [ "${GOVERN_IN_GATE:-0}" != "1" ]; then
+  _GR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/gate-run.sh"
+  [ -f "$_GR" ] && _GATE=( bash "$_GR" "compute:$(basename "${BASH_SOURCE[0]}")" -- )
+fi
+
+
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 S="$ROOT/.claude/scripts"
 RESULTS_FILE=""
@@ -265,7 +275,7 @@ _gates() {
     if [ -z "$base" ]; then
       _add tsc-delta unrun ".w0-baseline.json has no tscErrors"
     else
-      set +e; now="$(cd "$ROOT" && bunx tsc --noEmit 2>&1 | grep -c 'error TS')"; set -e
+      set +e; now="$(cd "$ROOT" && "${_GATE[@]}" bunx tsc --noEmit 2>&1 | grep -c 'error TS')"; set -e
       if [ "$now" -le "$base" ]; then _add tsc-delta pass "baseline=$base now=$now"
       else _add tsc-delta fail "baseline=$base now=$now — new type errors"; fi
     fi