@oneie/claude 0.8.0 → 0.10.0

package/scripts/task-titles-dump.ts

@@ -0,0 +1,101 @@
+#!/usr/bin/env bun
+// task-titles-dump.ts — the offline `{ tid: title }` map the thread-name backfill reads.
+//
+// manifest: monorepo-only  (reads this repo's one.ie/web/.dev.vars and calls one.ie's
+//                           own receivers by name)
+//
+// WHY IT EXISTS. A task thread's name is the task's TITLE, and the D1 `entity_meta`
+// overlay that will carry it is written by `tasks:create`/`subtask`/`rename` FROM NOW
+// ON — measured 2026-09-13, production's overlay held 2 rows and 0 titles. So for
+// every task that already exists the title lives only in the brain, and
+// `thread-name-backfill.ts --titles` is the door. Without a map it names 15 of 1055
+// rows in `one`; with one it names 411.
+//
+// READ-ONLY, AND IT NEVER TOUCHES THE BRAIN DIRECTLY. Two shipped receivers over
+// HTTP: `tasks:everywhere` once, only to learn which BARE tags this workspace
+// actually uses, then `tasks:list` per tag — the one door that returns every row for
+// a tag with no cap. `tasks:board` would answer in a single call and is the right
+// door the day it reaches production; it dissolves as `unknown_receiver` there today
+// (measured 2026-09-13), which is the whole reason this unions tag pages instead.
+//
+// THE COUNT IS A FLOOR, NOT A TOTAL, and the file says so. `tasks:everywhere` on
+// production still clamps at 200 rows with no `total`/`truncated` beside it, so the
+// TAG SET it yields is whatever those 200 rows carry — a tag used only by older rows
+// is invisible, and its tasks are simply absent from the map. A thread whose title is
+// missing is COUNTED AND LEFT by the backfill, never guessed at, so an incomplete map
+// under-names and never mis-names. Add `--tag <t>` to force one in.
+//
+// USAGE
+//   bun .claude/scripts/task-titles-dump.ts --slug ehc --out .backfill/titles-ehc.json
+//   bun .claude/scripts/task-titles-dump.ts --slug one --tag legacy --tag archived
+
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, resolve } from 'node:path'
+
+const ROOT = new URL('../..', import.meta.url).pathname
+const API = process.env['ONE_API_URL'] || 'https://one.ie'
+
+const argv = process.argv.slice(2)
+const flag = (name: string, fallback = ''): string => {
+  const i = argv.indexOf(`--${name}`)
+  return i >= 0 && argv[i + 1] && !argv[i + 1]!.startsWith('--') ? argv[i + 1]! : fallback
+}
+const flags = (name: string): string[] =>
+  argv.reduce<string[]>((acc, a, i) => (a === `--${name}` && argv[i + 1] && !argv[i + 1]!.startsWith('--') ? [...acc, argv[i + 1]!] : acc), [])
+
+const slug = flag('slug')
+const out = resolve(ROOT, flag('out', `.backfill/titles-${slug}.json`))
+const extraTags = flags('tag')
+
+if (!slug) {
+  console.error('usage: bun .claude/scripts/task-titles-dump.ts --slug <workspace> [--out FILE] [--tag <bare-word>]…')
+  process.exit(2)
+}
+
+// The service key prod accepts is the one in `.dev.vars`; the copy in `.env` is
+// REFUSED by production (measured 2026-09-06). Never printed.
+const devVars = readFileSync(`${ROOT}/one.ie/web/.dev.vars`, 'utf8')
+const KEY = (devVars.match(/^GATEWAY_API_KEY=(.*)$/m)?.[1] ?? '').trim().replace(/^"|"$/g, '')
+if (!KEY) {
+  console.error('no GATEWAY_API_KEY in one.ie/web/.dev.vars — stopping rather than calling the door unauthenticated')
+  process.exit(3)
+}
+
+async function ask<T>(receiver: string, data: unknown): Promise<T | null> {
+  const res = await fetch(`${API}/api/ask/${receiver}`, {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${KEY}`, 'content-type': 'application/json' },
+    body: JSON.stringify({ data }),
+  })
+  // BOTH refusals answer HTTP 200 — success is `outcome=='result'` AND `result.ok`.
+  const body = (await res.json()) as { outcome?: string; result?: { ok?: boolean } & T; reason?: string }
+  if (body.outcome !== 'result' || !body.result?.ok) {
+    console.error(`  ${receiver} refused: ${body.outcome ?? res.status}${body.reason ? ` (${body.reason})` : ''}`)
+    return null
+  }
+  return body.result as T
+}
+
+// ── which tags this workspace uses ──────────────────────────────────────────
+const seed = await ask<{ tasks?: Array<{ tags?: string[] }> }>('tasks:everywhere', { workspace: slug, limit: 5000 })
+const tags = new Set(extraTags)
+for (const t of seed?.tasks ?? []) {
+  // BARE words only. A namespaced tag is a routing lane, not a tag, and `tasks:list`
+  // filters on the bare word.
+  for (const g of t.tags ?? []) if (!g.includes(':') && !g.startsWith('@')) tags.add(g)
+}
+console.log(`${slug}: ${seed?.tasks?.length ?? 0} seed row(s) → ${tags.size} bare tag(s)`)
+
+// ── one page per tag, unioned ───────────────────────────────────────────────
+const titles: Record<string, string> = {}
+let refused = 0
+for (const tag of [...tags].sort()) {
+  const page = await ask<{ tasks?: Array<{ tid?: string; name?: string }> }>('tasks:list', { workspace: slug, tag })
+  if (!page) { refused++; continue }
+  for (const t of page.tasks ?? []) if (t.tid && t.name) titles[t.tid] = t.name
+}
+
+mkdirSync(dirname(out), { recursive: true })
+writeFileSync(out, `${JSON.stringify(titles, null, 1)}\n`, 'utf8')
+console.log(`${Object.keys(titles).length} title(s) → ${out}${refused ? `   (${refused} tag page(s) refused — the map is short by however many rows they held)` : ''}`)
+console.log('This is a FLOOR: a tag absent from the seed page contributes nothing, and a missing title is left unnamed by the backfill rather than guessed.')

package/scripts/test-cached.sh

@@ -185,6 +185,24 @@ if [ "${TEST_CACHE_KEY_ONLY:-0}" = "1" ]; then echo "$KEY"; exit 0; fi
 STAMP="$CACHE_DIR/$folder-${KEY}.pass"
 STAMP="${STAMP//\//_}"; STAMP="$CACHE_DIR/$(basename "$STAMP")"
 
+# TEST_CACHE_PROBE=1 answers "would this HIT?" and runs nothing: exit 0 on a
+# hit, 1 on a miss. It sits AFTER the STAMP lines above on purpose -- the
+# probe and the real check must resolve the same path or the probe is a
+# second, drifting definition of a hit. KEY_ONLY prints the key; PROBE
+# answers the question the caller actually has.
+#
+# WHY IT EXISTS. verify-fast.sh took a GOVERNOR SLOT and then asked whether
+# there was anything to run. Measured 2026-09-09 on a saturated box: 855s
+# and 1324s queued for slots whose work was a memo hit costing ~0. A cache
+# hit must never wait behind a real gate -- it needs no memory, no forks and
+# no slot. Probe first, take the slot only on a MISS.
+if [ "${TEST_CACHE_PROBE:-0}" = "1" ]; then
+  if [ "${TEST_CACHE_DISABLE:-0}" != "1" ] && [ -f "$STAMP" ]; then
+    echo "[test-cached] probe: HIT ${KEY:0:12}"; exit 0
+  fi
+  echo "[test-cached] probe: MISS ${KEY:0:12}"; exit 1
+fi
+
 mkdir -p "$CACHE_DIR" 2>/dev/null
 find "$CACHE_DIR" -name '*.pass' -mtime "+${MAX_AGE_DAYS}" -delete 2>/dev/null
 
@@ -197,17 +215,36 @@ fi
 # __probe__ is the self-test's fake folder: no vitest, deterministic outcome.
 if [ "$folder" = "__probe__" ]; then
   case " ${ARGS[*]} " in *--probe-fail*) st=1 ;; *) st=0 ;; esac
-elif [ "${TEST_CACHE_PTY:-0}" = "1" ]; then
-  # The deploy gate's vitest HANGS when stdout is not a TTY -- a fork is spawned
-  # and never given work (see .claude/commands/deploy.md "The vitest gate hangs").
-  # `script -qeF /dev/null` allocates a pty and flushes. The -e is load-bearing:
-  # it propagates the CHILD's exit status. Without it `script` exits 0 over a red
-  # suite and this cache would record a PASS for a failing run.
-  ( cd "$ROOT/$folder" && script -qeF /dev/null bunx vitest run "${ARGS[@]}" )
-  st=$?
 else
-  ( cd "$ROOT/$folder" && bunx vitest run "${ARGS[@]}" )
-  st=$?
+  # THE SLOT. This script takes no lock, so unlike tsc-cached.sh there is no
+  # ordering hazard -- adding a slot here is purely additive.
+  #
+  # verify-fast.sh already wraps ITS calls to this script in gate-run, and
+  # gate-run exports GOVERN_IN_GATE=1, so _gate below collapses to a plain `env`
+  # on that path: the outer slot is INHERITED, never doubled (a second slot held
+  # by one logical gate is what deadlocks the queue at cap 2).
+  #
+  # What this closes is the other caller: `bun run test` -> test-lanes.sh -> here
+  # reached vitest with no slot at all. Measured 2026-09-07 in one worktree at
+  # 256% CPU and ~800MB, with the governor reporting "1 of 2 slots held".
+  _gate=( env )
+  if [ "${TEST_CACHE_GATE:-1}" = "1" ] && [ "${GOVERN_IN_GATE:-0}" != "1" ] \
+     && [ -f "$ROOT/.claude/scripts/gate-run.sh" ]; then
+    _gate=( env "GOVERN_GATE_TIMEOUT=${TEST_CACHE_TIMEOUT:-1800}"
+            bash "$ROOT/.claude/scripts/gate-run.sh" "test-cache:$folder" -- )
+  fi
+  if [ "${TEST_CACHE_PTY:-0}" = "1" ]; then
+    # The deploy gate's vitest HANGS when stdout is not a TTY -- a fork is spawned
+    # and never given work (see .claude/commands/deploy.md "The vitest gate hangs").
+    # `script -qeF /dev/null` allocates a pty and flushes. The -e is load-bearing:
+    # it propagates the CHILD's exit status. Without it `script` exits 0 over a red
+    # suite and this cache would record a PASS for a failing run.
+    ( cd "$ROOT/$folder" && "${_gate[@]}" script -qeF /dev/null bunx vitest run "${ARGS[@]}" )
+    st=$?
+  else
+    ( cd "$ROOT/$folder" && "${_gate[@]}" bunx vitest run "${ARGS[@]}" )
+    st=$?
+  fi
 fi
 
 # ONLY a pass is recorded. A red gate must re-run until it is green.

package/scripts/test-lanes.sh

@@ -145,6 +145,20 @@ echo "───── pool lane (rc=$RC_A) ─────";   cat "$LOG_A"
 echo "───── typedb lane (rc=$RC_B) ─────"; cat "$LOG_B"
 rm -f "$LOG_A" "$LOG_B"
 
+# TYPEDB_LANE_NONBLOCKING: the typedb lane still runs (signal is preserved) but
+# its exit code is never a gate. Set in deploy.sh because the deploy must not
+# block on the shared TypeDB Cloud cluster — the request path goes through
+# Cloudflare (BrainDO / KV), TypeDB is writes + sync only (§ The brain and the edge).
+if [[ "${TYPEDB_LANE_NONBLOCKING:-0}" == "1" ]]; then
+  if [ "$RC_B" -ne 0 ]; then
+    echo "test-lanes: typedb lane FAILED (rc=$RC_B) — non-blocking, gate is pool lane only"
+  fi
+  if [ "$RC_A" -eq 0 ]; then
+    echo "test-lanes: pool lane green — PASS (typedb lane non-blocking)"; exit 0
+  fi
+  echo "test-lanes: FAILED (pool=$RC_A typedb=$RC_B, typedb non-blocking)"; exit 1
+fi
+
 # Both must pass. A lane that could not run is a failure, never a pass.
 if [ "$RC_A" -eq 0 ] && [ "$RC_B" -eq 0 ]; then
   echo "test-lanes: BOTH lanes green"; exit 0

package/scripts/thread-name-backfill.ts

@@ -0,0 +1,215 @@
+#!/usr/bin/env bun
+// thread-name-backfill.ts — name the threads that were written before there was a
+// name to write.
+//
+// manifest: monorepo-only  (binds the `one-owners` D1 by name through wrangler and
+//                           imports the namer out of one.ie/web/src)
+//
+// MEASURED 2026-09-13, production D1 `one-owners`: 1042 of 1053 threads in workspace
+// `one` and 125 of 132 in `ehc` carry an empty `name`, so the inbox renders their KEY
+// (`space:ehc`, `ehc-chairman`) or a hex id. The write door now names every thread it
+// mints (lib/threads.ts) — this is the other half, for the rows already written.
+//
+// IT APPLIES EXACTLY THE SAME FUNCTION THE LIVE PATH DOES — `deriveThreadName` from
+// one.ie/web/src/lib/in/thread-name.ts. A backfill with its own naming rules is a
+// second vocabulary for the same keys, and the day they disagree nobody can tell
+// which row was named by which.
+//
+// FOUR SAFETIES, and each is a thing that can go wrong once and not be undone:
+//   1. DRY RUN IS THE DEFAULT. `--apply` is required to write, and it is not a flag
+//      any read-only session should pass.
+//   2. It only ever writes `name`. A thread KEY is identity — `listThreads` filters
+//      `agent_id = ?` exactly, and rewriting one orphans the conversation.
+//   3. `WHERE name IS NULL OR name = ''` appears in the SELECT **and again in the
+//      UPDATE**, so a name a human typed between the two is never overwritten, and
+//      running it twice changes nothing the second time.
+//   4. Batched by `--limit`, one workspace at a time — and the APPLY is a generated
+//      SQL FILE (`--out`, chunked by `--chunk`), run with `wrangler … --file`, not
+//      one `--command` spawn per row. 411 sequential remote calls is ~15-30 minutes
+//      during which a concurrent writer can change a row read in the SELECT above;
+//      a handful of file round trips is not. The SQL is generated on a DRY RUN too,
+//      so the operator reads statements rather than a description of them, and the
+//      ids are written beside it because a rollback cannot be re-derived: run the
+//      namer again later and it names rows this pass never touched.
+//
+// A task thread's name is its TITLE, which no key can supply. Titles come from the
+// D1 `entity_meta` overlay (written by tasks:create/subtask/rename) and, for tasks
+// created before that landed, from an offline `--titles <file.json>` map of
+// `{ "<tid>": "<title>" }`. Rows with neither are COUNTED AND LEFT, never guessed at.
+//
+// USAGE
+//   bun .claude/scripts/thread-name-backfill.ts --slug one                 # dry run
+//   bun .claude/scripts/thread-name-backfill.ts --slug one --limit 500
+//   bun .claude/scripts/thread-name-backfill.ts --slug one --titles t.json
+//   bun .claude/scripts/thread-name-backfill.ts --slug one --out .backfill --chunk 400
+//   bun .claude/scripts/thread-name-backfill.ts --slug one --apply         # runs the SQL
+//   …add --local to work against the miniflare copy instead of production.
+
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { deriveThreadName, taskIdOf } from '../../one.ie/web/src/lib/in/thread-name.ts'
+
+const DB = 'one-owners'
+const WEB = new URL('../../one.ie/web', import.meta.url).pathname
+
+const argv = process.argv.slice(2)
+const flag = (name: string, fallback = ''): string => {
+  const i = argv.indexOf(`--${name}`)
+  return i >= 0 && argv[i + 1] && !argv[i + 1]!.startsWith('--') ? argv[i + 1]! : fallback
+}
+const has = (name: string) => argv.includes(`--${name}`)
+
+const slug = flag('slug')
+const limit = Number(flag('limit', '200'))
+const chunk = Number(flag('chunk', '400'))
+const outDir = resolve(new URL('../..', import.meta.url).pathname, flag('out', '.backfill'))
+const apply = has('apply')
+const remote = !has('local')
+const titlesFile = flag('titles')
+
+if (!slug || !Number.isFinite(limit) || limit <= 0 || !Number.isFinite(chunk) || chunk <= 0) {
+  console.error('usage: bun .claude/scripts/thread-name-backfill.ts --slug <workspace> [--limit N] [--chunk N] [--out DIR] [--titles f.json] [--local] [--apply]')
+  process.exit(2)
+}
+
+const sq = (s: string) => `'${s.replace(/'/g, "''")}'`
+
+function wrangler(mode: '--command' | '--file', value: string): Array<Record<string, unknown>> {
+  const args = ['wrangler', 'd1', 'execute', DB, remote ? '--remote' : '--local', '--json', mode, value]
+  const r = spawnSync('bunx', args, { cwd: WEB, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 })
+  if (r.status !== 0) {
+    // A failed READ must never read as "no rows to name" — that is the shape that
+    // turns an outage into a clean-looking pass. Stop instead.
+    console.error(r.stderr || r.stdout)
+    throw new Error(`d1 command failed (exit ${r.status})`)
+  }
+  const start = r.stdout.indexOf('[')
+  if (start < 0) return []
+  const parsed = JSON.parse(r.stdout.slice(start)) as Array<{ results?: Array<Record<string, unknown>> }>
+  return parsed[0]?.results ?? []
+}
+
+// ── titles ──────────────────────────────────────────────────────────────────
+const titles = new Map<string, string>()
+if (titlesFile) {
+  const raw = JSON.parse(readFileSync(titlesFile, 'utf8')) as Record<string, string>
+  for (const [tid, t] of Object.entries(raw)) if (typeof t === 'string' && t.trim()) titles.set(tid, t.trim())
+}
+// The overlay the live writers mirror to — the same source `tasks:comment` reads.
+for (const row of wrangler('--command', `SELECT entity_id, meta FROM entity_meta WHERE workspace_slug = ${sq(slug)}`)) {
+  const id = String(row['entity_id'] ?? '')
+  if (!id || titles.has(id)) continue
+  try {
+    const m = JSON.parse(String(row['meta'] ?? '{}')) as Record<string, unknown>
+    if (typeof m['title'] === 'string' && m['title'].trim()) titles.set(id, m['title'].trim())
+  } catch { /* a malformed overlay row names nothing */ }
+}
+
+// ── the nameless ────────────────────────────────────────────────────────────
+const rows = wrangler('--command',
+  `SELECT id, slug, agent_id, name FROM threads WHERE slug = ${sq(slug)} AND (name IS NULL OR name = '') ORDER BY last_msg_at DESC LIMIT ${limit}`,
+)
+
+type Plan = { id: string; key: string | null; name: string; via: string }
+const planned: Plan[] = []
+const unnamed: Array<{ id: string; key: string | null; why: string }> = []
+
+for (const r of rows) {
+  const id = String(r['id'] ?? '')
+  const key = r['agent_id'] === null || r['agent_id'] === undefined ? null : String(r['agent_id'])
+  if (!id) continue
+  if (key && key.startsWith('task:')) {
+    // Both stored shapes resolve to one tid, so a `task:task:` row and a `task:` row
+    // find the same title.
+    const tid = taskIdOf(key)
+    const title = titles.get(tid) ?? titles.get(`task:${tid}`) ?? ''
+    if (title) planned.push({ id, key, name: title.slice(0, 200), via: 'task title' })
+    else unnamed.push({ id, key, why: 'no title for this tid in the overlay or --titles' })
+    continue
+  }
+  const derived = deriveThreadName(key, slug)
+  if (derived) planned.push({ id, key, name: derived, via: 'key' })
+  else unnamed.push({ id, key, why: key ? 'key shape carries no name' : 'null key — the client derives from the body' })
+}
+
+// ── report ──────────────────────────────────────────────────────────────────
+console.log(`${apply ? 'APPLY' : 'DRY RUN'} · workspace ${slug} · ${remote ? 'remote' : 'local'} · limit ${limit}`)
+console.log(`nameless rows read: ${rows.length}   nameable: ${planned.length}   left unnamed: ${unnamed.length}`)
+console.log(`titles available: ${titles.size}`)
+console.log('\n── would name (sample) ──')
+for (const p of planned.slice(0, 15)) console.log(`  ${p.id}  ${String(p.key ?? '<null>').padEnd(34)} ''  →  '${p.name}'   [${p.via}]`)
+if (planned.length > 15) console.log(`  … ${planned.length - 15} more`)
+if (unnamed.length) {
+  console.log('\n── left unnamed (sample) ──')
+  for (const u of unnamed.slice(0, 10)) console.log(`  ${u.id}  ${String(u.key ?? '<null>').padEnd(34)} ${u.why}`)
+  if (unnamed.length > 10) console.log(`  … ${unnamed.length - 10} more`)
+}
+
+// ── generate the SQL ────────────────────────────────────────────────────────
+// ALWAYS, dry run included — the apply runs a FILE, not 411 `--command` spawns,
+// and the operator reads the statements before any of them run. The blank
+// predicate is repeated in every statement, not only in the SELECT above:
+// between the read and the write a human may have named the row, and a backfill
+// that clobbers a human is worse than one that leaves an id on screen.
+const now = Math.floor(Date.now() / 1000)
+const statementFor = (p: Plan) =>
+  `UPDATE threads SET name = ${sq(p.name)}, updated_at = ${now}\n` +
+  `  WHERE id = ${sq(p.id)} AND (name IS NULL OR name = '');`
+
+mkdirSync(outDir, { recursive: true })
+const files: string[] = []
+for (let i = 0; i < planned.length; i += chunk) {
+  const slice = planned.slice(i, i + chunk)
+  const path = `${outDir}/thread-name-${slug}-${String(i / chunk + 1).padStart(3, '0')}.sql`
+  writeFileSync(
+    path,
+    `-- thread-name-backfill · ${slug} · rows ${i + 1}-${i + slice.length} of ${planned.length}\n` +
+      `-- Re-runnable: every statement keeps the blank predicate, so a name typed since is never clobbered.\n` +
+      `-- Rollback: the ids this pass would write are listed beside this file.\n\n` +
+      slice.map(statementFor).join('\n'),
+    'utf8',
+  )
+  files.push(path)
+}
+// THE ROLLBACK CANNOT BE DERIVED, so it is written down. Re-running the namer
+// later would name rows this pass never touched, and could not tell a name this
+// wrote from one a human typed afterwards. The id list is the only honest undo.
+//
+// AND A RUN THAT PLANS NOTHING WRITES NOTHING HERE. Measured 2026-09-13, minutes
+// after the real apply: re-running the same command to PROVE idempotence read 8
+// nameless rows, planned 0, and truncated the list of the 107 rows the first run had
+// just named — the no-op proof destroyed the undo for the work it was proving.
+// Recovering it meant parsing the ids back out of the generated `.sql`. An empty
+// plan now leaves the file exactly as it is.
+const idsPath = `${outDir}/thread-name-${slug}.ids.txt`
+if (planned.length) writeFileSync(idsPath, `${planned.map((p) => `${p.id}\t${p.via}\t${p.name}`).join('\n')}\n`, 'utf8')
+
+console.log(`\n── generated SQL (${planned.length} statements, ${files.length} file(s) of ≤${chunk}) ──`)
+for (const f of files) console.log(`  ${f}`)
+console.log(
+  planned.length
+    ? `  ${idsPath}   (id, via, name — the rollback's row list)`
+    : `  nothing to do — ${idsPath} and any SQL already in ${outDir} were LEFT AS THEY WERE (an earlier pass's rollback list is not this run's to overwrite)`,
+)
+if (planned.length) {
+  console.log('\n  first statement:')
+  for (const line of statementFor(planned[0]).split('\n')) console.log(`    ${line.slice(0, 200)}`)
+}
+
+if (!apply) {
+  console.log('\nDRY RUN — nothing was written to the database. Read the SQL above, then re-run with --apply.')
+  console.log(`Rollback after an apply: UPDATE threads SET name = '' WHERE id IN (<the ids in ${idsPath}>);`)
+  process.exit(0)
+}
+
+// ── write ───────────────────────────────────────────────────────────────────
+for (const f of files) {
+  wrangler('--file', f)
+  console.log(`  ran ${f}`)
+}
+const after = wrangler('--command',
+  `SELECT COUNT(*) AS n FROM threads WHERE slug = ${sq(slug)} AND (name IS NULL OR name = '')`,
+)
+console.log(`\nran ${files.length} file(s), ${planned.length} guarded statement(s). still nameless in ${slug}: ${after[0]?.['n'] ?? '?'}`)
+console.log(`Rollback list: ${idsPath}`)

package/scripts/triage-shape-check.sh

@@ -0,0 +1,149 @@
+#!/usr/bin/env bash
+# triage-shape-check.sh — prove the `shape` half of .claude/workflows/triage.js
+# writes a sane, non-destructive plan. Same idiom as do-tier.sh --self-test and
+# do-triage.sh --self-test: one command, exits non-zero on failure, and carries
+# a RED PROOF so a checker that stays green against gutted code is caught.
+#
+# manifest: monorepo-only
+#
+# WHY THIS EXISTS. The shape phase emits a LIST of board writes, and the list is
+# where the damage lives, not the words. Two of these invariants were broken in
+# the first version and neither would have failed a syntax check:
+#   · TWO tasks:notes writes. tasks:notes SETS the body, it does not append, so
+#     the second silently destroyed the first — and the survivor said
+#     "accept: see above" pointing at the line it had just deleted. Exactly the
+#     defect the board already carries one layer down (an absent notes key is a
+#     silent DELETE returning ok:true).
+#   · tasks:assign, which is not in the receiver registry and would dissolve as
+#     unknown_receiver.
+# Both are invisible to the eye and obvious to this file.
+#
+# Usage:  bash .claude/scripts/triage-shape-check.sh [--red]
+#         --red   gut the guard and assert this checker goes RED
+
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+WF="$ROOT/.claude/workflows/triage.js"
+SDK="$ROOT/packages/sdk/src/receivers.ts"
+RED=0
+[ "${1:-}" = "--red" ] && RED=1
+
+[ -f "$WF" ] || { echo "FAIL: no $WF"; exit 2; }
+
+run_cases() { # <workflow file>
+  node - "$1" "$SDK" <<'NODE'
+// eval() IS DELIBERATE AND BOUNDED HERE, and JSON.parse cannot replace it: the
+// tables it lifts contain REGEX LITERALS (ROUTES) and unquoted keys (SPLIT),
+// neither of which is JSON. The input is not untrusted — it is a tracked file
+// in this repo, read by path, and the whole point of the checker is to test the
+// SHIPPING definitions rather than a copy that can drift. A copy is the failure
+// mode this file exists to prevent: two definitions of one rule is how the
+// routing table and its fixtures disagree silently. Never point this at a path
+// a caller supplies.
+const fs = require('fs')
+const src = fs.readFileSync(process.argv[2], 'utf8')
+const sdk = fs.existsSync(process.argv[3]) ? fs.readFileSync(process.argv[3], 'utf8') : ''
+const grab = (re) => { const m = src.match(re); if (!m) { console.log('FAIL: could not find ' + re); process.exit(3) } return m[0] }
+const ROUTES = eval('(' + grab(/const ROUTES = \[[\s\S]*?\n\]/).replace('const ROUTES = ', '') + ')')
+const SPLIT  = eval('(' + grab(/const SPLIT = \{[\s\S]*?\n\}/).replace('const SPLIT = ', '') + ')')
+eval(grab(/function routeFor[\s\S]*?\n\}/))
+eval(grab(/function plannedWrites[\s\S]*?\n  return writes\n\}/))
+
+let bad = 0
+const fail = (m) => { console.log('  FAIL  ' + m); bad++ }
+const ok   = (m) => console.log('  ok    ' + m)
+
+// ── 1. routing: what a file IS beats what it is ABOUT ───────────────────────
+// The first draft put the money nouns first and sent a wallet COMPONENT and a
+// wallet TEST to security-auditor. These fixtures are that bug, frozen.
+for (const [p, want] of [
+  ['one.ie/web/src/components/wallet/AllWallets.tsx', 'implementer'],
+  ['one.ie/web/tests/unit/wallet/x.test.ts', 'test-engineer'],
+  ['one.ie/web/src/lib/auth/passkey-webauthn.ts', 'security-auditor'],
+  ['pay/backend/src/signing-key.ts', 'security-auditor'],
+  ['schema/one.tql', 'architect'],
+  ['one.ie/web/src/lib/resolvers/tasks.ts', 'architect'],
+  ['text/story.md', 'tech-writer'],
+  ['one.ie/web/wrangler.toml', 'release-manager'],
+  ['one.ie/web/src/pages/about.astro', 'implementer'],
+  ['somewhere/random.go', 'cto'],
+]) {
+  const got = routeFor([p])
+  got === want ? ok(`route ${want.padEnd(17)}${p}`) : fail(`route ${p} → ${got}, want ${want}`)
+}
+
+// ── 2. the write plan ───────────────────────────────────────────────────────
+const C = {
+  FIX: { title: 'send button does nothing', triage: { verdict: 'sizeable', paths: ['one.ie/web/src/components/wallet/AllWallets.tsx'] }, size: { tier: 'FIX' },
+    shape: { want: 'Stop the Send button pretending it moved money', why: 'It emits telemetry and signs nothing.', subtasks: ['a', 'b', 'c'], chain: true, assignee: 'implementer' } },
+  UNSIZED: { title: 'make chat nicer', triage: { verdict: 'idea', paths: [] }, size: { tier: 'UNSIZED' }, shape: null },
+  PATCH: { title: 'typo', triage: { verdict: 'sizeable', paths: ['text/readme.md'] }, size: { tier: 'PATCH' },
+    shape: { want: 'Fix the misspelled word', why: '', subtasks: [], chain: false, assignee: 'tech-writer' } },
+}
+const plans = Object.fromEntries(Object.entries(C).map(([k, t]) => [k, plannedWrites(t)]))
+
+for (const [k, w] of Object.entries(plans)) {
+  const ops = w.map((x) => x.op)
+  // EXACTLY ONE notes write. Two means the second clobbers the first.
+  const notes = w.filter((x) => x.op === 'tasks:notes')
+  notes.length <= 1 ? ok(`${k}: one notes write`) : fail(`${k}: ${notes.length} notes writes — the later SETS over the earlier`)
+  if (notes[0] && /accept:\s*see above/i.test(notes[0].text)) fail(`${k}: notes back-reference a line this plan deletes`)
+  // The capture lands FIRST, before anything can overwrite the title.
+  ops[0] === 'tasks:comment' ? ok(`${k}: capture first`) : fail(`${k}: first write is ${ops[0]}, not tasks:comment`)
+  // Every emitted receiver must exist.
+  if (sdk) for (const op of new Set(ops)) {
+    if (!sdk.includes('"' + op + '"')) fail(`${k}: ${op} is not in the receiver registry — would dissolve as unknown_receiver`)
+  }
+}
+// UNSIZED is shaped by nobody.
+{
+  const ops = plans.UNSIZED.map((x) => x.op)
+  ops.some((o) => ['tasks:rename', 'tasks:reassign', 'tasks:subtask'].includes(o))
+    ? fail('UNSIZED row was renamed/assigned/split — absence of recon must not read as simplicity')
+    : ok('UNSIZED: no title, no owner, no children')
+}
+// PATCH is one piece.
+plans.PATCH.some((x) => x.op === 'tasks:subtask') ? fail('PATCH got children') : ok('PATCH: no children')
+// The chain leaves exactly one sibling ready.
+{
+  const subs = plans.FIX.filter((x) => x.op === 'tasks:subtask')
+  subs.length === 3 ? ok('FIX: 3 children') : fail(`FIX: ${subs.length} children, want 3`)
+  subs[0] && subs[0].blockedBy ? fail('first sibling is blocked — nothing would be ready') : ok('FIX: first sibling ready')
+  subs.slice(1).every((s) => s.blockedBy) ? ok('FIX: later siblings chained') : fail('FIX: a later sibling is unchained — siblings race')
+}
+process.exit(bad ? 1 : 0)
+NODE
+}
+
+if [ "$RED" -eq 0 ]; then
+  echo "triage-shape-check — invariants"
+  run_cases "$WF"; rc=$?
+  [ $rc -eq 0 ] && echo "triage-shape: self-test green" || echo "triage-shape: self-test FAILED"
+  exit $rc
+fi
+
+# ── RED PROOF ────────────────────────────────────────────────────────────────
+# A checker that stays green against gutted code proves nothing. Re-introduce
+# the two defects that were actually shipped and assert this file catches both.
+tmp="$(mktemp -d)"; trap 'rm -rf "$tmp"' EXIT
+gut="$tmp/triage.js"
+
+echo "RED PROOF 1 — second notes write restored (the clobber)"
+sed 's|if (body) writes.splice(1, 0, { op: .tasks:notes., text: body })|if (body) writes.splice(1, 0, { op: "tasks:notes", text: body }); if (task.shape \&\& task.shape.why) writes.push({ op: "tasks:notes", text: task.shape.why + "\\n\\naccept: see above" })|' "$WF" > "$gut"
+if run_cases "$gut" >/dev/null 2>&1; then echo "  FAIL: checker stayed GREEN against a double notes write"; exit 1
+else echo "  ok   checker went RED"; fi
+
+echo "RED PROOF 2 — tasks:assign restored (the absent receiver)"
+sed "s|op: 'tasks:reassign'|op: 'tasks:assign'|" "$WF" > "$gut"
+if run_cases "$gut" >/dev/null 2>&1; then echo "  FAIL: checker stayed GREEN against an unwired receiver"; exit 1
+else echo "  ok   checker went RED"; fi
+
+echo "RED PROOF 3 — money rule moved back to the front (the mis-route)"
+node -e '
+const fs=require("fs");let s=fs.readFileSync(process.argv[1],"utf8");
+s=s.replace(/const ROUTES = \[[\s\S]*?\n\]/,`const ROUTES = [\n  [/(^|\\\\/)(auth|passkey|vault|signer|wallet|escrow|payment|credits)/i, "security-auditor"],\n  [/\\\\.(astro|tsx|jsx|css)$|components?\\\\/|pages?\\\\//i, "implementer"],\n]`);
+fs.writeFileSync(process.argv[2],s)' "$WF" "$gut"
+if run_cases "$gut" >/dev/null 2>&1; then echo "  FAIL: checker stayed GREEN against a greedy money rule"; exit 1
+else echo "  ok   checker went RED"; fi
+
+echo "triage-shape: red proofs green (all three defects caught)"