@oneie/claude 0.8.0 → 0.10.0

package/scripts/preview-fd-check.sh

@@ -0,0 +1,289 @@
+#!/usr/bin/env bash
+# preview-fd-check.sh — is the preview tax a PIPE that outlives the script?
+#
+# manifest: needs-env
+#   Mode A (default) is self-contained: a scratch sandbox, one node mimic, no
+#   ports, no worktree, no astro, no credential. Mode B (--real) drives
+#   worktree-preview.sh against one.ie/web and costs a worktree and a port.
+#
+# NOT A FIX. A MEASUREMENT THAT IS ALLOWED TO COME BACK NEGATIVE.
+#
+# THE OBSERVATION. The chairman measured ~7 min of Opus per UI task blocked in
+#   worktree-preview.sh up <slug> --route / | tail -30
+# with the server green in under a minute and the shell parked in __wait4 at
+# 8m42s. Two mechanisms fit that sample and only one of them is fixable at the
+# launch line:
+#
+#   H1  THE PIPE OUTLIVES THE SCRIPT. cmd_up prints GREEN and returns, but the
+#       reader never sees EOF because a descendant of the launch still holds the
+#       script's stdout. The tool call is waiting on `tail`, not on the server.
+#   H2  THE SCRIPT REALLY IS STILL RUNNING. BOOT_LOCK_WAIT 240 + BOOT_TIMEOUT 60
+#       + WARM_TIMEOUT 180 = 480s against an observed 522s. A `sleep 1` poll loop
+#       samples as __wait4 exactly like waiting on a pipe.
+#
+# Mode A can only support or refute H1. It CANNOT exclude H2 — only --real can,
+# by asking whether the driver process is already gone at the moment the server
+# answers 200. So a green Mode A is not licence to touch worktree-preview.sh.
+#
+# THE LAUNCH THIS REPRODUCES, quoted from worktree-preview.sh (the perl branch;
+# the nohup branch is its twin):
+#   ( cd "$app" && perl -e 'setsid; exec @ARGV' -- sh -c "exec $astro dev ..." >>"$log" 2>&1 & echo $! > "$state/pid" )
+#
+# VARIANTS, each timed from the DRIVER'S OWN EXIT to the reader's EOF:
+#   V1 driver | cat                      the shape the operator runs
+#   V2 driver > file                     no pipe at all
+#   V3 driver | cat, launch gets </dev/null    is stdin the holder?
+#   V4 driver | cat, subshell does `exec >>log 2>&1 </dev/null` BEFORE the fork
+#
+# VERDICT DISCIPLINE. REPRODUCED requires ALL THREE:
+#   V1 hold >= 60% of the mimic's lifetime  AND  V2 hold <= 2s  AND  a NAMED
+#   process holding the same pipe as the reader's fd 0.
+# A timing alone is a correlation. Anything short of all three prints
+# NOT REPRODUCED with every number and exits 3, and no line of
+# worktree-preview.sh is touched.
+#
+# WHAT MODE A FOUND, 2026-09-06 (hold 12s):
+#   V1(pipe)=12.2s  V2(file)=0.0s  V3(stdin</dev/null)=12.2s  V4(exec-before-fork)=0.0s
+#   holder = <pid> bash / fd 1 / the exact peer of the reader's fd 0.
+# The holder is a BASH SUBSHELL, not node. `cmd >>log 2>&1 &` backgrounds the
+# whole `cd "$app" && perl …` AND-LIST: bash forks a subshell to run it, and the
+# `>>"$log" 2>&1` binds to the `perl` simple command INSIDE it. So the subshell
+# keeps the caller's stdout on its own fd 1 for as long as the server lives, and
+# `$!` — the pid worktree-preview.sh stores and polls — IS that subshell.
+# V3 shows stdin is not the holder; V4 shows giving the subshell its own stdio
+# before the fork closes it. That is H1, named.
+#
+# H2 IS STILL LIVE for the 522s the chairman observed (BOOT_LOCK_WAIT 240 +
+# BOOT_TIMEOUT 60 + WARM_TIMEOUT 180 = 480s), and Mode A cannot separate them.
+# NOTHING IN worktree-preview.sh HAS BEEN CHANGED on the strength of this run.
+#
+# USAGE  preview-fd-check.sh [--sandbox] [--hold N]     Mode A, default
+#        preview-fd-check.sh --real <slug>              Mode B, opt-in
+#        preview-fd-check.sh --self-test                the harness's own guards
+# EXITS  0 REPRODUCED · 3 NOT REPRODUCED · 4 bad arguments / missing tool /
+#        UNMEASURED (a variant produced no timing — never reported as a verdict)
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+HOLD="${PREVIEW_FD_HOLD:-12}"
+MODE=sandbox
+SLUG=""
+
+now() { perl -MTime::HiRes=time -e 'printf "%.3f\n", time'; }
+el()  { perl -e 'printf "%.1f\n", $ARGV[1] - $ARGV[0]' "$1" "$2"; }
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --sandbox) MODE=sandbox; shift ;;
+    --real)    MODE=real; SLUG="${2:-}"; shift 2 ;;
+    --hold)    HOLD="${2:-12}"; shift 2 ;;
+    --self-test) MODE=selftest; shift ;;
+    -h|--help) sed -n '2,50p' "${BASH_SOURCE[0]}"; exit 0 ;;
+    *) echo "preview-fd-check: unknown argument: $1" >&2; exit 4 ;;
+  esac
+done
+
+command -v perl >/dev/null 2>&1 || { echo "preview-fd-check: perl not found — it is both the timer and the launch shape" >&2; exit 4; }
+command -v node >/dev/null 2>&1 || { echo "preview-fd-check: node not found — the mimic is a node process on purpose" >&2; exit 4; }
+
+SB="${TMPDIR:-/tmp}/preview-fd-$$"
+mkdir -p "$SB"
+cleanup() {
+  local p
+  for p in "$SB"/*/pid; do [ -f "$p" ] || continue; kill -- -"$(cat "$p")" 2>/dev/null || kill "$(cat "$p")" 2>/dev/null; done
+  rm -rf "$SB"
+}
+trap cleanup EXIT INT TERM
+
+# The astro-mimic: a node process that (a) runs a worker thread, (b) spawns a
+# grandchild with inherited stdio, (c) holds the event loop. Those are the three
+# things astro dev's process tree does that a bare `sleep` child does not — and
+# a bare `sleep` child is exactly the harness that already failed to reproduce.
+cat > "$SB/mimic.js" <<'MIMIC'
+const { Worker } = require('worker_threads')
+const { spawn } = require('child_process')
+const secs = Number(process.argv[2] || 12)
+const ms = secs * 1000
+new Worker(`setTimeout(() => {}, ${ms})`, { eval: true })
+spawn('sh', ['-c', `sleep ${secs}`], { stdio: 'inherit' })
+console.log('mimic up')
+setTimeout(() => process.exit(0), ms)
+MIMIC
+
+# The driver: worktree-preview.sh's cmd_up, reduced to its launch and its GREEN
+# line. $1 = variant, $2 = state dir, $3 = hold seconds.
+cat > "$SB/driver.sh" <<'DRIVER'
+#!/usr/bin/env bash
+set -uo pipefail
+variant="$1"; state="$2"; hold="$3"
+log="$state/mimic.log"; : > "$log"
+mimic="$state/../mimic.js"
+case "$variant" in
+  plain)
+    ( cd "$state" && perl -e 'setsid; exec @ARGV' -- sh -c "exec node $mimic $hold" >>"$log" 2>&1 & echo $! > "$state/pid" ) ;;
+  stdin)
+    ( cd "$state" && perl -e 'setsid; exec @ARGV' -- sh -c "exec node $mimic $hold" >>"$log" 2>&1 </dev/null & echo $! > "$state/pid" ) ;;
+  execfd)
+    ( cd "$state" && exec >>"$log" 2>&1 </dev/null; perl -e 'setsid; exec @ARGV' -- sh -c "exec node $mimic $hold" & echo $! > "$state/pid" ) ;;
+  *) echo "driver: unknown variant $variant" >&2; exit 4 ;;
+esac
+perl -MTime::HiRes=time -e 'printf "%.3f\n", time' > "$state/driver_exit"
+echo "GREEN mimic up (driver returning, exactly as cmd_up does)"
+DRIVER
+chmod +x "$SB/driver.sh"
+
+# One variant, measured. $1 = name, $2 = driver variant, $3 = pipe|file
+run_variant() {
+  # NOT one `local` line: bash expands every word of the builtin BEFORE any of
+  # the assignments take effect, so `st="$SB/$name"` reads an unset `name` and
+  # dies under `set -u`. Measured here 2026-09-06 — it produced four empty
+  # timings that the verdict then reported as a confident NOT REPRODUCED.
+  local name="$1" variant="$2" sink="$3" t0 t_eof t_drv
+  local st="$SB/$name"
+  mkdir -p "$st"
+  t0="$(now)"
+  if [ "$sink" = pipe ]; then
+    ( bash "$SB/driver.sh" "$variant" "$st" "$HOLD" | cat > "$st/out.txt"
+      perl -MTime::HiRes=time -e 'printf "%.3f\n", time' > "$st/eof" ) &
+  else
+    ( bash "$SB/driver.sh" "$variant" "$st" "$HOLD" > "$st/out.txt"
+      perl -MTime::HiRes=time -e 'printf "%.3f\n", time' > "$st/eof" ) &
+  fi
+  local job=$!
+  # While the reader may still be blocked, name the holder. A timing without a
+  # named process is a correlation, and the verdict refuses it.
+  if [ "$sink" = pipe ] && [ "$name" = V1 ]; then sleep 3; name_holder "$st"; fi
+  wait "$job" 2>/dev/null
+  t_eof="$(cat "$st/eof" 2>/dev/null)"; t_drv="$(cat "$st/driver_exit" 2>/dev/null)"
+  if [ -z "$t_eof" ] || [ -z "$t_drv" ]; then echo "unmeasured"; return; fi
+  el "$t_drv" "$t_eof"
+}
+
+# Does any process in the launched tree hold the SAME pipe the reader is blocked
+# on? macOS lsof prints a pipe as `PIPE 0x<dev> ... ->0x<peer>`; the reader's fd
+# 0 and a writer's fd share those addresses.
+HOLDER="none"
+name_holder() {
+  local st="$1" mpid rp toks t
+  mpid="$(cat "$st/pid" 2>/dev/null)"
+  command -v lsof >/dev/null 2>&1 || { HOLDER="lsof-missing"; return; }
+  # The reader is the `cat` whose fd 1 is out.txt; find its pipe tokens on fd 0.
+  rp="$(lsof -n -t -- "$st/out.txt" 2>/dev/null | head -1)"
+  [ -n "$rp" ] || { HOLDER="reader-not-found"; return; }
+  toks="$(lsof -n -p "$rp" 2>/dev/null | awk '$5 == "PIPE" {print $6; if ($NF ~ /^->0x/) print substr($NF,3)}' | sort -u)"
+  [ -n "$toks" ] || { HOLDER="reader-holds-no-pipe"; return; }
+  local cand="" line
+  # Every descendant of the launched pid, plus the pid itself.
+  local pids; pids="$(ps -A -o pid=,ppid=,comm= 2>/dev/null)"
+  local tree; tree="$(printf '%s\n' "$mpid"; printf '%s\n' "$pids" | awk -v m="$mpid" '$2 == m {print $1}')"
+  for t in $tree; do
+    [ -n "$t" ] || continue
+    line="$(lsof -n -p "$t" 2>/dev/null | awk '$5 == "PIPE" {print $6; if ($NF ~ /^->0x/) print substr($NF,3)}' | sort -u)"
+    [ -n "$line" ] || continue
+    local shared; shared="$(comm -12 <(printf '%s\n' "$toks") <(printf '%s\n' "$line") 2>/dev/null | head -1)"
+    if [ -n "$shared" ]; then
+      # Name the process AND the pipe, with the fd it holds it on. A pid alone
+      # is a coincidence; a pid whose fd 1 is the peer of the reader's fd 0 is
+      # the mechanism.
+      local fd; fd="$(lsof -n -p "$t" 2>/dev/null | awk -v s="$shared" '$5 == "PIPE" && ($6 == s || substr($NF,3) == s) {print $4; exit}')"
+      cand="$(ps -o pid=,comm= -p "$t" 2>/dev/null | tr -s ' ' | sed 's/^ *//;s/ *$//')/fd${fd:-?}/pipe${shared}"
+      break
+    fi
+  done
+  HOLDER="${cand:-no-shared-pipe-in-launch-tree}"
+  # run_variant is called in a command substitution, so this assignment lives in
+  # a subshell and would evaporate. The answer travels by file, or the verdict
+  # would silently read `none` and refuse a real reproduction.
+  printf '%s' "$HOLDER" > "$SB/holder"
+}
+
+self_test() {
+  local fails=0 rc
+  printf '== preview-fd-check --self-test\n'
+  # The harness must refuse to call a hang a reproduction without a named holder.
+  if ( HOLDER="no-shared-pipe-in-launch-tree"; verdict 30 0 30 0 >/dev/null 2>&1 ); then
+    printf '  FAIL %-52s\n' 'a hang with NO named holder read as REPRODUCED' >&2; fails=$((fails+1))
+  else
+    printf '  ok   %-52s\n' 'no named holder => NOT REPRODUCED, whatever the timings'
+  fi
+  if ( HOLDER="1234 node"; verdict 0 0 0 0 >/dev/null 2>&1 ); then
+    printf '  FAIL %-52s\n' 'zero hold everywhere read as REPRODUCED' >&2; fails=$((fails+1))
+  else
+    printf '  ok   %-52s\n' 'no hold => NOT REPRODUCED even with a holder'
+  fi
+  if ( HOLDER="1234 node"; verdict "$HOLD" 0 "$HOLD" 0 >/dev/null 2>&1 ); then
+    printf '  ok   %-52s\n' 'all three conditions => REPRODUCED'
+  else
+    printf '  FAIL %-52s\n' 'the green half is unreachable' >&2; fails=$((fails+1))
+  fi
+  if ( HOLDER="1234 node"; verdict "$HOLD" "$HOLD" "$HOLD" "$HOLD" >/dev/null 2>&1 ); then
+    printf '  FAIL %-52s\n' 'V2 hanging too (so: not the pipe) read as REPRODUCED' >&2; fails=$((fails+1))
+  else
+    printf '  ok   %-52s\n' 'V2 hanging too => NOT REPRODUCED (not a pipe effect)'
+  fi
+  # THE HOUSE BUG, in this harness's own shape: an empty timing must not read as
+  # a benign "not reproduced". Driven for real — this exact defect shipped in the
+  # first draft and was caught by running it.
+  ( HOLDER="1234 node"; verdict "" 0 0 0 >/dev/null 2>&1 ); rc=$?
+  if [ "$rc" = 4 ]; then printf '  ok   %-52s exit 4\n' 'an unmeasured variant is UNMEASURED, not a verdict'
+  else printf '  FAIL %-52s exit %s\n' 'an empty timing produced a verdict' "$rc" >&2; fails=$((fails+1)); fi
+  ( HOLDER="1234 node"; verdict "$HOLD" unmeasured 0 0 >/dev/null 2>&1 ); rc=$?
+  if [ "$rc" = 4 ]; then printf '  ok   %-52s exit 4\n' 'a word where a number belongs is UNMEASURED'
+  else printf '  FAIL %-52s exit %s\n' 'a non-numeric timing produced a verdict' "$rc" >&2; fails=$((fails+1)); fi
+
+  [ "$fails" -eq 0 ] && { printf 'preview-fd-check --self-test: PASS (6 checks)\n'; return 0; }
+  printf 'preview-fd-check --self-test: RED — %s failed\n' "$fails" >&2; return 1
+}
+
+# verdict <v1> <v2> <v3> <v4> — the three conditions, judged together.
+verdict() {
+  local v1="$1" v2="$2" v3="$3" v4="$4" floor
+  floor="$(perl -e 'printf "%.1f", $ARGV[0] * 0.6' "$HOLD")"
+  printf 'PREVIEW-FD hold=%ss floor=%ss  V1(pipe)=%ss  V2(file)=%ss  V3(stdin</dev/null)=%ss  V4(exec-before-fork)=%ss  holder=%s\n' \
+    "$HOLD" "$floor" "$v1" "$v2" "$v3" "$v4" "$HOLDER"
+  local n
+  for n in "$v1" "$v2" "$v3" "$v4"; do
+    case "$n" in
+      ''|*[!0-9.]*)
+        printf 'PREVIEW-FD: UNMEASURED — a variant produced no timing (%s). This is NOT "not reproduced";\n' "$n"
+        printf '  the harness failed to measure and says so. worktree-preview.sh unchanged.\n'
+        return 4 ;;
+    esac
+  done
+  local ok1 ok2 ok3
+  ok1="$(perl -e 'print(($ARGV[0] =~ /^[0-9.]+$/ && $ARGV[0] >= $ARGV[1]) ? 1 : 0)' "$v1" "$floor")"
+  ok2="$(perl -e 'print(($ARGV[0] =~ /^[0-9.]+$/ && $ARGV[0] <= 2.0) ? 1 : 0)' "$v2")"
+  case "$HOLDER" in none|lsof-missing|reader-not-found|reader-holds-no-pipe|no-shared-pipe-in-launch-tree|'') ok3=0 ;; *) ok3=1 ;; esac
+  if [ "$ok1" = 1 ] && [ "$ok2" = 1 ] && [ "$ok3" = 1 ]; then
+    printf 'PREVIEW-FD: REPRODUCED (H1 candidate) — a named process in the launch tree holds the reader'"'"'s pipe.\n'
+    printf 'PREVIEW-FD: H2 IS NOT EXCLUDED — Mode A cannot separate them. --real is unrun.\n'
+    return 0
+  fi
+  printf 'PREVIEW-FD: NOT REPRODUCED — '
+  [ "$ok1" = 1 ] || printf 'V1 did not hold past the floor. '
+  [ "$ok2" = 1 ] || printf 'V2 held too (so the pipe is not the discriminator). '
+  [ "$ok3" = 1 ] || printf 'no named fd holder (%s). ' "$HOLDER"
+  printf 'worktree-preview.sh unchanged.\n'
+  return 3
+}
+
+case "$MODE" in
+  selftest) self_test; exit $? ;;
+  real)
+    [ -n "$SLUG" ] || { echo "preview-fd-check: --real needs a slug" >&2; exit 4; }
+    echo "preview-fd-check: --real is opt-in and UNRUN here — it costs a worktree, a port and ~2.3GB," >&2
+    echo "  it takes no boot lock, and this box is memory-bound. Run it alone, never in a fleet:" >&2
+    echo "  PREVIEW_FD_REAL_YES=1 bash .claude/scripts/preview-fd-check.sh --real $SLUG" >&2
+    [ "${PREVIEW_FD_REAL_YES:-0}" = 1 ] || exit 4
+    echo "preview-fd-check: --real not implemented in this cycle; Mode A is the deliverable." >&2
+    exit 4 ;;
+esac
+
+printf '== preview-fd-check --sandbox (mimic lifetime %ss)\n' "$HOLD"
+V1="$(run_variant V1 plain  pipe)"
+HOLDER="$(cat "$SB/holder" 2>/dev/null)"; HOLDER="${HOLDER:-none}"
+V2="$(run_variant V2 plain  file)"
+V3="$(run_variant V3 stdin  pipe)"
+V4="$(run_variant V4 execfd pipe)"
+verdict "$V1" "$V2" "$V3" "$V4"
+exit $?

package/scripts/redirect-lint.sh

@@ -0,0 +1,169 @@
+#!/usr/bin/env bash
+# redirect-lint.sh — `Response.redirect()` is banned under one.ie/web/src/pages/api/.
+#
+# WHY. `Response.redirect()` returns a Response whose headers are IMMUTABLE.
+# The Astro Cloudflare adapter / middleware then writes `Server-Timing` (or the
+# queued `vid` cookie) onto it and the worker throws "Can't modify immutable
+# headers" — a 500 with Cloudflare error code 1101, on the success path only.
+# Measured on production 2026-09-11: /api/composio/redirect and
+# /api/composio/callback both 500.
+#
+# This repo has diagnosed and fixed the same mechanism three separate times
+# before this lint existed:
+#   one.ie/web/src/pages/api/og/screenshot.png.ts:33  (the comment + the fix)
+#   one.ie/web/src/middleware.ts:746                  (the comment + the fix)
+#   one.ie/web/src/lib/page-cache-middleware.ts:45    (swallows the throw)
+# The lint is what stops a fourth time.
+#
+# THE FIX, every time:
+#   return new Response(null, { status: 302, headers: { Location: <absolute url> } })
+#
+# SCOPE. API routes only — those are the handlers whose response the adapter
+# decorates. Comment lines are exempt: the three files above NAME the pattern in
+# prose, and a lint that is red on a clean tree gets deleted within a week.
+#
+# USAGE
+#   bash .claude/scripts/redirect-lint.sh              # lint the repo, exit 1 on any hit
+#   bash .claude/scripts/redirect-lint.sh --self-test  # drive it RED, then GREEN, then
+#                                                      # prove a comment stays GREEN
+# EXITS
+#   0  clean          1  violations found          2  usage / self-test failed
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+API_DIR="one.ie/web/src/pages/api"
+PATTERN='Response\.redirect('
+
+# scan <dir> — every CODE occurrence as `file:line:content`, comments dropped.
+# Empty output means clean. The grep output is CAPTURED first and matched from a
+# here-string: under `set -o pipefail`, `<producer> | grep -q` returns 141 when
+# it matches while the producer is still writing.
+scan() {
+  local dir="$1" raw line content trimmed
+  raw="$(grep -rn "$PATTERN" "$dir" 2>/dev/null || true)"
+  [ -z "$raw" ] && return 0
+  while IFS= read -r line; do
+    [ -z "$line" ] && continue
+    content="${line#*:}"          # strip `file:`
+    content="${content#*:}"       # strip `line:`
+    trimmed="$(printf '%s' "$content" | sed 's/^[[:space:]]*//')"
+    case "$trimmed" in
+      '//'*|'*'*|'/*'*) continue ;;   # a comment naming the pattern is not a call
+    esac
+    printf '%s\n' "$line"
+  done <<< "$raw"
+}
+
+# lint <dir> [label] — report and set the exit code. The whole main path, so the
+# self-test drives the real thing rather than a re-implementation of it.
+lint() {
+  local dir="$1" label="${2:-$dir}" hits count
+  if [ ! -d "$dir" ]; then
+    echo "[redirect-lint] RED — directory not found: $dir" >&2
+    return 2
+  fi
+  hits="$(scan "$dir")"
+  if [ -z "$hits" ]; then
+    echo "[redirect-lint] ok — no Response.redirect() under $label"
+    return 0
+  fi
+  count="$(printf '%s\n' "$hits" | wc -l | tr -d ' ')"
+  echo "[redirect-lint] RED — $count call site(s) of Response.redirect() under $label:" >&2
+  printf '%s\n' "$hits" | sed "s#^$ROOT/##" >&2
+  cat >&2 <<'HINT'
+
+  Response.redirect() headers are immutable; the adapter's Server-Timing write
+  then throws "Can't modify immutable headers" (500, cf error 1101). Use:
+
+    return new Response(null, { status: 302, headers: { Location: <absolute url> } })
+HINT
+  return 1
+}
+
+# Global on purpose: the EXIT trap body is evaluated after self_test has
+# returned, so a `local` sandbox is already out of scope by then — under
+# `set -u` that made a fully passing self-test exit 1 on its own cleanup.
+sandbox=""
+
+self_test() {
+  local rc out fails=0
+  sandbox="$(mktemp -d "${TMPDIR:-/tmp}/redirect-lint-selftest.XXXXXX")"
+  trap 'rm -rf "${sandbox:-}"' EXIT
+  mkdir -p "$sandbox/api"
+
+  # A file that is already correct — present in all three phases, so a green
+  # phase proves the scan ran over real content rather than over nothing.
+  cat > "$sandbox/api/ok.ts" <<'TS'
+export const GET = ({ url }) =>
+  new Response(null, { status: 302, headers: { Location: `${url.origin}/next` } })
+TS
+
+  # 1 — a real call site must go RED.
+  cat > "$sandbox/api/bad.ts" <<'TS'
+export const GET = ({ url }) => Response.redirect(`${url.origin}/next`, 302)
+TS
+  set +e
+  out="$(lint "$sandbox" "sandbox" 2>&1)"; rc=$?
+  set -e
+  if [ "$rc" -eq 1 ]; then
+    echo "  [1/3] planted call site → RED (exit 1) ✓"
+  else
+    echo "  [1/3] planted call site → expected exit 1, got $rc" >&2
+    printf '%s\n' "$out" >&2
+    fails=$((fails + 1))
+  fi
+
+  # 2 — removing it must go GREEN.
+  rm -f "$sandbox/api/bad.ts"
+  set +e
+  out="$(lint "$sandbox" "sandbox" 2>&1)"; rc=$?
+  set -e
+  if [ "$rc" -eq 0 ]; then
+    echo "  [2/3] violation removed → GREEN (exit 0) ✓"
+  else
+    echo "  [2/3] violation removed → expected exit 0, got $rc" >&2
+    printf '%s\n' "$out" >&2
+    fails=$((fails + 1))
+  fi
+
+  # 3 — a COMMENT naming the pattern must stay GREEN. This is the exclusion the
+  # three prior fixes depend on; untested, someone "simplifies" it back into a
+  # false positive and the lint starts firing on its own documentation.
+  cat > "$sandbox/api/documented.ts" <<'TS'
+export const GET = ({ url }) => {
+  // Response.redirect() returns an immutable Response — the adapter's
+  // Server-Timing header write then throws "Can't modify immutable headers".
+  /* Response.redirect( in a block comment too */
+  return new Response(null, { status: 302, headers: { Location: `${url.origin}/next` } })
+}
+TS
+  set +e
+  out="$(lint "$sandbox" "sandbox" 2>&1)"; rc=$?
+  set -e
+  if [ "$rc" -eq 0 ]; then
+    echo "  [3/3] comment naming the pattern → GREEN (exit 0) ✓"
+  else
+    echo "  [3/3] comment naming the pattern → expected exit 0, got $rc" >&2
+    printf '%s\n' "$out" >&2
+    fails=$((fails + 1))
+  fi
+
+  if [ "$fails" -ne 0 ]; then
+    echo "[redirect-lint] --self-test FAILED ($fails/3)" >&2
+    return 2
+  fi
+  echo "[redirect-lint] --self-test ok (3/3)"
+  return 0
+}
+
+case "${1:-}" in
+  --self-test) self_test ;;
+  --scan-dir)  lint "${2:?--scan-dir needs a directory}" ;;
+  -h|--help)
+    sed -n '1,32p' "${BASH_SOURCE[0]}"
+    exit 2 ;;
+  '')          lint "$ROOT/$API_DIR" "$API_DIR" ;;
+  *)
+    echo "usage: redirect-lint.sh [--self-test|--scan-dir <dir>]" >&2
+    exit 2 ;;
+esac

package/scripts/release.sh

@@ -92,9 +92,14 @@ _link_deps() {
 # The receipt keys for the tree standing in $1. Prints one 64-hex key per lane.
 # TEST_CACHE_KEY_ONLY=1 makes every test-cached.sh in the fan-out print its key
 # and exit 0 without running vitest, so this costs ~1s and cannot start a suite.
+#
+# Each line is "<lane> <key>". The lane is read off test-lanes.sh's own
+# `───── <lane> lane (rc=N) ─────` header that precedes the key, so a new lane
+# names itself; a key with no header (the single-run fallback) is lane `suite`.
 _receipt_keys() {
   ( cd "$1" && TEST_CACHE_KEY_ONLY=1 bash .claude/scripts/test-full.sh 2>/dev/null ) \
-    | grep -Eo '^[0-9a-f]{64}$'
+    | awk '/ lane \(rc=/ { for (i = 1; i <= NF; i++) if ($i == "lane") lane = $(i-1); next }
+           /^[0-9a-f]{64}$/ { print (lane == "" ? "suite" : lane), $0 }'
 }
 
 # The stamp for a key, if one exists. test-cached.sh mangles the whole stamp path
@@ -165,16 +170,27 @@ cmd_promote() {
     bad "no receipt key could be computed — test-full.sh printed no lane key"
     return 9
   fi
-  local n_keys=0 missing=0 stamps=()
-  while IFS= read -r k; do
+  # THE TYPEDB LANE DOES NOT GATE PRODUCTION (operator ruling 2026-09-13). The
+  # request path reads the edge snapshot, never TypeDB (CLAUDE.md § The brain and
+  # the edge), and the lane's reds were the shared cluster timing out, not code:
+  # three promotes in a row held a green pool lane behind `upstream 500: aborted
+  # due to timeout`. deploy.sh already runs it non-blocking
+  # (TYPEDB_LANE_NONBLOCKING=1); promote now weighs it the same way, so the two
+  # doors can no longer disagree. The lane is still READ and printed — a missing
+  # stamp is a named warning, never silence. RELEASE_TYPEDB_BLOCKING=1 restores
+  # the hard gate.
+  local n_keys=0 missing=0 stamps=() lane k
+  while read -r lane k; do
     [ -n "$k" ] || continue
     n_keys=$((n_keys+1))
     local s
     if s="$(_stamp_for "$k")"; then
       stamps+=("$s")
-      ok "receipt ${k:0:12} — full suite PASSED $(cat "$s" 2>/dev/null)"
+      ok "receipt ${k:0:12} ($lane lane) — full suite PASSED $(cat "$s" 2>/dev/null)"
+    elif [ "$lane" = "typedb" ] && [ "${RELEASE_TYPEDB_BLOCKING:-0}" != "1" ]; then
+      say "  warn receipt ${k:0:12} (typedb lane) — no green stamp; non-blocking for production"
     else
-      bad "receipt ${k:0:12} — NO green full-suite stamp for this tree"
+      bad "receipt ${k:0:12} ($lane lane) — NO green full-suite stamp for this tree"
       missing=$((missing+1))
     fi
   done <<< "$keys"
@@ -276,8 +292,26 @@ _self_test() {
   # 1. a tree with no receipt is REFUSED (3)
   _run "$base"; _assert 3 $? "no receipt refuses"
 
+  # 2a. the typedb lane does not gate production: stamp every OTHER lane and the
+  #     promote succeeds; RELEASE_TYPEDB_BLOCKING=1 restores the refusal. Red half
+  #     first — a non-typedb lane left unstamped must still refuse.
+  local lane k
+  while read -r lane k; do
+    [ -n "$k" ] && [ "$lane" = "typedb" ] && date -u +%Y-%m-%dT%H:%M:%SZ > "$sbcache/selftest-$k.pass"
+  done < <(_receipt_keys "$sbwt")
+  _run "$base"; _assert 3 $? "a green typedb lane cannot carry an unstamped pool lane"
+  rm -f "$sbcache"/selftest-*.pass
+  while read -r lane k; do
+    [ -n "$k" ] && [ "$lane" != "typedb" ] && date -u +%Y-%m-%dT%H:%M:%SZ > "$sbcache/selftest-$k.pass"
+  done < <(_receipt_keys "$sbwt")
+  if _receipt_keys "$sbwt" | grep -q '^typedb '; then
+    RELEASE_TYPEDB_BLOCKING=1 _run "$base"; _assert 3 $? "RELEASE_TYPEDB_BLOCKING=1 refuses an unstamped typedb lane"
+    _run "$base"; _assert 0 $? "an unstamped typedb lane does not gate production"
+  else
+    echo "  FAIL no typedb lane key found — the non-blocking branch went unproven"; fails=$((fails+1))
+  fi
+
   # 2. plant a PASS stamp for every lane key of that tree — promotion succeeds
-  local k
   while IFS= read -r k; do
     [ -n "$k" ] && date -u +%Y-%m-%dT%H:%M:%SZ > "$sbcache/selftest-$k.pass"
   done < <(TEST_CACHE_KEY_ONLY=1 bash -c "cd '$sbwt' && bash .claude/scripts/test-full.sh" 2>/dev/null \

package/scripts/resume-lost-sessions.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# resume-lost-sessions.sh — reopen the Claude Code sessions killed by the
+# 2026-09-16 12:14 reboot, one Ghostty tab each.
+#
+# manifest: monorepo-only
+#
+# WHY THIS EXISTS. The box rebooted at 12:14 and took 8 live sessions with it.
+# Every session's COMMITTED work survived — all of it is in production at
+# c716295ac (verified by probe: /buttons 200, /ambient 404). What died was the
+# conversation: the half-finished next step each one was holding in context.
+# `--resume <id>` restores that context; the transcripts are on disk under
+# ~/.claude/projects/-Users-toc-Server-one-ie/.
+#
+# Usage:
+#   bash .claude/scripts/resume-lost-sessions.sh --list     # names + status, no side effects
+#   bash .claude/scripts/resume-lost-sessions.sh <key>...   # open those tabs
+#   bash .claude/scripts/resume-lost-sessions.sh --unfinished
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+# key|session-id|status|what it was doing
+ROWS=(
+"media|baa8d065-7e0a-44a5-be4a-0b65ea39252f|MID-CYCLE|@chairman team: pages/media — view, upload, generate media and insert into pages. Was at /close when it died."
+"blocks|3aa1bc43-0029-4ddd-bd4e-bc76695dd74c|LANDED|One block-insert component shared by page editor and documents. Shipped ca89b9c58 + 5b74e7f4d. Was at /close."
+"components|a82ef0c3-3863-40ed-84b8-49502e42a42e|MID-CYCLE|Parallel agents enhancing the hundreds of page-editor components. 9 turns in, feat/components merged — more was planned."
+"pages-links|bd004874-cd1e-4298-bd8d-a733721c8af0|OPEN Q|Feature pages (pages/analytics etc.) — wanted links to them, 'on prod'. A question, no commit."
+"models|95bead26-d470-4c4a-84d7-41dabbf54144|LANDED|Rank models by intelligence and speed in the + picker. Shipped: src/lib/chat/model-rank.ts."
+"ticker|d8b1424b-3bfe-4fa5-92bc-fa4fc197ed4e|LANDED|Real streamed 'thinking' text instead of pretend. Shipped a99651b48. Last words: 'ship it all'."
+"chat-url|79bc3b97-dab2-4f3d-a4c1-81b163917e4f|LANDED|Can chat change the page URL the user is on. Shipped d6a41f2f5 + text/chat-navigation-docs.md."
+"health|4c2ff180-a2d9-4b37-9cef-9ce9740c5fc9|ONE-SHOT|'health' — the doctor pass. Nothing to resume unless you want another."
+)
+
+_row() { local k=$1; for r in "${ROWS[@]}"; do [ "${r%%|*}" = "$k" ] && { echo "$r"; return 0; }; done; return 1; }
+
+if [ $# -eq 0 ] || [ "${1:-}" = "--list" ]; then
+  printf '\n  %-13s %-10s %s\n' KEY STATUS "WHAT IT WAS DOING"
+  for r in "${ROWS[@]}"; do
+    IFS='|' read -r k id st what <<<"$r"
+    printf '  %-13s %-10s %s\n' "$k" "$st" "${what:0:88}"
+  done
+  printf '\n  open one:  bash %s <key>\n' "${BASH_SOURCE[0]#"$ROOT/"}"
+  printf '  unfinished only:  bash %s --unfinished\n\n' "${BASH_SOURCE[0]#"$ROOT/"}"
+  exit 0
+fi
+
+KEYS=("$@")
+if [ "${1:-}" = "--unfinished" ]; then
+  KEYS=()
+  for r in "${ROWS[@]}"; do
+    IFS='|' read -r k id st what <<<"$r"
+    case "$st" in MID-CYCLE|"OPEN Q") KEYS+=("$k");; esac
+  done
+  echo "  unfinished: ${KEYS[*]}"
+fi
+
+for k in "${KEYS[@]}"; do
+  r="$(_row "$k")" || { echo "  ✗ unknown key: $k (try --list)" >&2; continue; }
+  IFS='|' read -r _ id st what <<<"$r"
+  echo "  → $k  ($st)  $id"
+  osascript <<OSA >/dev/null 2>&1 || echo "     (could not open a tab — run by hand: cd $ROOT && claude --resume $id)"
+tell application "Ghostty" to activate
+tell application "System Events" to keystroke "t" using command down
+delay 0.7
+tell application "System Events" to keystroke "cd $ROOT && claude --resume $id"
+tell application "System Events" to key code 36
+OSA
+  sleep 1
+done