@oneie/claude 0.8.0 → 0.10.0

package/scripts/tsc-cached.sh

@@ -1,5 +1,15 @@
 #!/usr/bin/env bash
 # tsc-cached.sh <folder> — run `tsc --noEmit` for <folder>, or reuse the answer
+# tsc-cached.sh --probe <folder> — answer from the memo ONLY: prints `green` (exit 0)
+#   when this exact tree already passed, `unknown` (exit 1) otherwise. Never
+#   computes, never locks, never takes a slot. This is how land.sh learns what a
+#   branch knew about itself BEFORE the trunk was merged in, and whether dev's own
+#   tree is on record as green — the two facts that turn "fast gate RED" into an
+#   attribution (root CLAUDE.md § The dev → prod loop › three owners).
+# TSC_CACHE_ROOT=<dir> fingerprints THAT checkout instead of the one this script
+#   lives in. Every door script runs MAIN's copy (a worktree's copy resolves ROOT
+#   to the worktree and lands nothing), so main's copy needs a way to ask about a
+#   worktree. The key is content, so the memo is shared across checkouts anyway.
 # someone else already computed for this exact tree. Prints the error COUNT.
 #
 # manifest: needs-env
@@ -20,6 +30,30 @@
 # tree, which is the one thing this harness exists to prevent.
 #
 # TSC_CACHE_DISABLE=1 forces a real run (and still records the result).
+#
+# ── SLOT BEFORE LOCK — the 2026-09-13 deadlock ──────────────────────────────
+# This script used to take the per-folder dedupe LOCK and then, still holding
+# it, queue for a governor SLOT. Any caller already inside a gate arrives in the
+# opposite order: `bun run verify:fast` IS `gate-run.sh verify-fast -- …`, so it
+# holds a SLOT and its child here waits for the LOCK. Two orders, one cycle:
+#
+#   A: gate-run(verify-fast) holds slot-1   ->  its tsc-cached waits for lock-tsc-one.ie_web
+#   B: tsc-cached holds lock-tsc-one.ie_web ->  its inner gate-run waits for a slot
+#
+# Measured three times in ~35 minutes on 2026-09-13, each stalling EVERY session
+# on the box for 8-28 minutes at 0% CPU — one of them a production release gate.
+# Owner pairs: 22173/68920, 15762/97557, 87579. Nothing reaps it: both owners are
+# alive, and `reapLock`/gate-reaper only reap a DEAD owner.
+#
+# KILLING THE LOCK HOLDER DOES NOT FIX IT (observed twice): the lock passes
+# straight to the next waiter, which is itself inside a gate holding a slot, and
+# the cycle re-forms within seconds. Killing the SLOT holder is what breaks it.
+#
+# So the order is now global: SLOT, then LOCK, never the reverse. A cache HIT
+# and `--probe` still take NEITHER — a memo lookup must never join a queue.
+# Proof, both halves: `bash .claude/scripts/govern-order-check.sh`.
+# do-reconcile.sh takes the SAME lock name and carries the same fix; one
+# inverted participant is enough to re-form the cycle.
 set -uo pipefail
 
 # --self-test — the RED half. A cache that has never been seen to refuse is not
@@ -69,29 +103,82 @@ EOF
   out6=$(bash "$0" .tsc-cache-probe 2>&1 >/dev/null)
   case "$out6" in *"cache HIT"*) echo "FAIL: a content change replayed as a HIT — the key does not read the bytes"; fails=$((fails+1));;
     *) echo "ok: a content change MISSes (key covers the bytes)";; esac
+  # --probe answers from the memo and NEVER computes. The tree is green and
+  # memoised here (out6 computed it); a probe must say so. Then break it: a
+  # never-checked tree must read `unknown`, exit 1, and leave no stamp behind —
+  # a probe that computed would stamp the green half and hide the cost it exists
+  # to avoid; a probe that said `green` for an unchecked tree would let land.sh
+  # call a branch "green alone" on no evidence.
+  if pr=$(bash "$0" --probe .tsc-cache-probe 2>/dev/null) && [ "$pr" = "green" ]; then echo "ok: --probe reads the memoised PASS as green"
+  else echo "FAIL: --probe missed a memoised PASS (got '${pr:-}')"; fails=$((fails+1)); fi
+  echo 'export const y: string = 1;' > "$_P/src/b.ts"     # red, and never checked
+  _stamps_before=$(ls "$GOVERN_DIR" | wc -l | tr -d ' ')
+  if pr=$(bash "$0" --probe .tsc-cache-probe 2>/dev/null); then echo "FAIL: --probe reported '$pr' for a tree never checked"; fails=$((fails+1))
+  elif [ "$pr" != "unknown" ]; then echo "FAIL: --probe exit 1 but said '$pr', not 'unknown'"; fails=$((fails+1))
+  else echo "ok: --probe says unknown for an unchecked tree"; fi
+  _stamps_after=$(ls "$GOVERN_DIR" | wc -l | tr -d ' ')
+  [ "$_stamps_before" = "$_stamps_after" ] && echo "ok: --probe wrote nothing" \
+    || { echo "FAIL: --probe left a stamp ($_stamps_before -> $_stamps_after) — it computed"; fails=$((fails+1)); }
+  rm -f "$_P/src/b.ts"
+  # TSC_CACHE_ROOT: the same bytes in ANOTHER checkout share the memo. This is
+  # the property land.sh leans on — main's copy asking about a worktree's tree.
+  _C="$(mktemp -d)"; cp -R "$_P" "$_C/.tsc-cache-probe"
+  if pr=$(TSC_CACHE_ROOT="$_C" bash "$0" --probe .tsc-cache-probe 2>/dev/null) && [ "$pr" = "green" ]; then
+    echo "ok: TSC_CACHE_ROOT reads the same memo for identical bytes in another checkout"
+  else echo "FAIL: TSC_CACHE_ROOT did not share the memo (got '${pr:-}')"; fails=$((fails+1)); fi
+  rm -rf "$_C"
   # RED PROOF — an unrun tsc must NOT read as 0 errors. A child that cannot
   # finish inside the bound is killed by run_bounded, leaving the count file
   # EMPTY -- exactly the shape a real 600s timeout produces. The old
   # `n=${n:-0}` turned that empty file into "0 errors" AND cached it, so a
   # typecheck that never ran was replayed forever as a PASS.
   rm -rf "$GOVERN_DIR"; export GOVERN_DIR="$(mktemp -d)"
-  if TSC_CACHE_TIMEOUT=1 TSC_CACHE_CMD='sleep 30' bash "$0" .tsc-cache-probe >/dev/null 2>&1; then
+  if out7=$(TSC_CACHE_TIMEOUT=1 TSC_CACHE_CMD='sleep 30' bash "$0" .tsc-cache-probe 2>&1 >/dev/null); then
     echo "FAIL: a timed-out tsc exited 0 — an unrun gate read as a pass"; fails=$((fails+1))
   else echo "ok: a tsc that could not finish exits non-zero"; fi
+  # AND it must be the EMPTY-COUNT branch that refused, not merely some non-zero
+  # exit. Since 2026-09-13 the compute runs inside a slot this script bought
+  # itself, so there are now TWO bounds — the inner run_bounded and gate-run's
+  # outer one — and if the outer ever fires first, the count file is never even
+  # read and this red proof silently degrades into "the outer bound works".
+  # Pinned by the message the inner branch prints.
+  case "$out7" in *"no error count"*) echo "ok: the refusal came from the empty-count branch" ;;
+    *) echo "FAIL: a timed-out tsc did not reach the empty-count branch — got: ${out7:-<nothing>}"; fails=$((fails+1)) ;; esac
   rm -rf "$_P" "$GOVERN_DIR"
   [ "$fails" -eq 0 ] && { echo "tsc-cached: self-test PASS"; exit 0; }
   echo "tsc-cached: self-test FAILED ($fails)"; exit 1
 fi
 
-folder="${1:-}"
-[ -n "$folder" ] || { echo "usage: tsc-cached.sh <folder>" >&2; exit 2; }
+PROBE=0 LOCKED=0 folder=""
+for _a in "$@"; do
+  case "$_a" in
+    --probe) PROBE=1 ;;
+    # INTERNAL. Set only by this script's own re-invocation through gate-run.sh
+    # (see § SLOT BEFORE LOCK): "a slot is held — take the lock and compute".
+    # It is also what stops the re-invocation recursing: under CI=1 or
+    # GOVERN_DISABLE=1, gate-run.sh execs straight through BEFORE it exports
+    # GOVERN_IN_GATE, so the child would otherwise see no gate and re-invoke
+    # itself forever. The mode flag is checked first, and never GOVERN_IN_GATE
+    # alone.
+    --locked-compute) LOCKED=1 ;;
+    -*) echo "tsc-cached: unknown flag '$_a'" >&2; exit 2 ;;
+    *) folder="$_a" ;;
+  esac
+done
+[ -n "$folder" ] || { echo "usage: tsc-cached.sh [--probe] <folder>" >&2; exit 2; }
 
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# _HERE is where the SCRIPTS live (main's copy); ROOT is the tree being checked.
+# They differ exactly when TSC_CACHE_ROOT names a worktree.
+_HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# Resolved BEFORE the cd below, and by basename rather than a literal name, so
+# the re-invocation survives both a relative $0 and a rename of this file.
+_SELF="$_HERE/$(basename "${BASH_SOURCE[0]}")"
+ROOT="${TSC_CACHE_ROOT:-$(cd "$_HERE/../.." && pwd)}"
 cd "$ROOT" || exit 2
 [ -d "$folder" ] || { echo "tsc-cached: no such folder: $folder" >&2; exit 2; }
 
 # shellcheck source=lib/govern.sh
-. "$(dirname "${BASH_SOURCE[0]}")/lib/govern.sh"
+. "$_HERE/lib/govern.sh"
 
 # The key is tsc_tree_fingerprint (lib/govern.sh) — CONTENT, never mtime, over
 # everything tsc reads. It used to live here as an mtime stat over src/tests +
@@ -118,13 +205,57 @@ _cache_ok() { # <file> — 0 when it holds a reusable PASS
   [ -s "$1" ] || return 1
   [ "$(tr -d '[:space:]' < "$1")" = "0" ]
 }
+if [ "$PROBE" = "1" ]; then
+  # A memo lookup and nothing else. `unknown` is not `red`: it means this exact
+  # tree has no recorded PASS — never checked, or checked and found red (a red
+  # is never written). The caller decides what an unknown is worth.
+  if _cache_ok "$_cache"; then echo green; exit 0; fi
+  echo unknown; exit 1
+fi
 if [ "${TSC_CACHE_DISABLE:-0}" != "1" ] && _cache_ok "$_cache"; then
   echo "[tsc-cached] $folder — cache HIT (tree unchanged since it was checked)" >&2
   echo 0
   exit 0
 fi
 
-if gate_lock "$_key" "${TSC_CACHE_WAIT:-900}"; then
+# The two bounds, read once and validated: a non-numeric override would make the
+# arithmetic below a hard error rather than a slow gate.
+_num() { case "${1:-}" in ''|*[!0-9]*) printf '%s' "$2" ;; *) printf '%s' "$1" ;; esac; }
+_timeout=$(_num "${TSC_CACHE_TIMEOUT:-}" 600)
+_lockwait=$(_num "${TSC_CACHE_WAIT:-}" 900)
+# ZERO IS NOT A BOUND, it is a kill: run_bounded's timer is `setTimeout(secs *
+# 1000)` (govern.ts:256), so 0 fires on the next tick and SIGTERMs the compute
+# before tsc can start — every run would read RED through the empty-count
+# branch. Treat it the way `${x:-600}` treats an empty string.
+[ "$_timeout" -lt 1 ] && _timeout=600
+
+# ── SLOT BEFORE LOCK ────────────────────────────────────────────────────────
+# A miss from here on. Buy the SLOT first, by re-entering this same script
+# through gate-run.sh; the child then takes the lock and computes. Everything
+# above this line — the memo lookup and --probe — still costs neither.
+#
+# WHY THE SELF-INVOCATION rather than a bare gate_slot: gate-run.sh is the one
+# definition of what a slot is (the queue announcement, min(config, headroom),
+# the pressure warning, and the re-entrancy rule that makes a nested gate
+# INHERIT the outer slot instead of taking a second one). A second copy of that
+# contract here is a second thing to drift. It also keeps the hard wall-clock
+# BOUND on the compute: `run_bounded` is what turns a wedged tsc into an empty
+# count, and an empty count is RED (see the case below).
+#
+# GOVERN_IN_GATE=1 means the CALLER already holds a slot — `bun run verify:fast`
+# is exactly that. Then the order is already SLOT -> LOCK, so take the lock right
+# here and compute inline. Re-invoking would only add a process; gate-run.sh
+# would exec straight through anyway.
+if [ "$LOCKED" != "1" ] && [ "${GOVERN_IN_GATE:-0}" != "1" ]; then
+  # The outer bound must be LARGER than the inner one, or it fires first and the
+  # empty-count RED below stops being reachable: lock wait + compute + slack.
+  TSC_CACHE_ROOT="$ROOT" TSC_CACHE_TIMEOUT="$_timeout" TSC_CACHE_WAIT="$_lockwait" \
+  GOVERN_GATE_TIMEOUT=$(( _timeout + _lockwait + 60 )) \
+  exec bash "$_HERE/gate-run.sh" "tsc-cache:$folder" -- \
+    bash "$_SELF" --locked-compute "$folder"
+fi
+
+if gate_lock "$_key" "$_lockwait"; then
   trap 'gate_release_all' EXIT INT TERM
   # Someone may have computed it while we queued for the lock.
   if [ "${TSC_CACHE_DISABLE:-0}" != "1" ] && _cache_ok "$_cache"; then
@@ -137,9 +268,25 @@ if gate_lock "$_key" "${TSC_CACHE_WAIT:-900}"; then
   # TSC_CACHE_CMD exists for --self-test only (the `__probe__` idiom from
   # test-cached.sh): it substitutes a child that cannot finish inside the bound,
   # so the timeout branch below can be driven deterministically instead of raced.
-  run_bounded "${TSC_CACHE_TIMEOUT:-600}" \
+  #
+  # THE SLOT IS ALREADY HELD when we get here — either the caller's (they were
+  # inside a gate) or the one this script's own re-invocation bought above. The
+  # gate_lock we hold dedupes by FOLDER: it stops two sessions computing the SAME
+  # answer twice. It does not cap concurrency across DIFFERENT folders, and N
+  # worktrees are N folders. Measured 2026-09-07: three worktrees each ran a
+  # 2.5GB tsc at once, every lock uncontended and doing its job, load hit 171 and
+  # localhost served a page in 8.4s. A lock DEDUPES; only a SLOT BOUNDS THE
+  # MACHINE — which is why both exist and why the order between them is fixed.
+  #
+  # run_bounded, not a nested gate-run.sh: gate-run under GOVERN_IN_GATE=1 execs
+  # straight through, which correctly declines a SECOND slot but also drops the
+  # wall-clock BOUND. So every call from inside a gate — i.e. every
+  # `bun run verify:fast` — ran an unbounded tsc until 2026-09-13. Calling
+  # run_bounded directly keeps the slot contract (we hold one) and restores the
+  # bound on the path that had none. It kills the whole process group.
+  run_bounded "$_timeout" \
     bash -c "cd '$folder' && ${TSC_CACHE_CMD:-bunx tsc --noEmit} 2>&1 | grep -c 'error TS' > '$_tmp'" \
-    2>/dev/null || true
+    || true
   n=$(cat "$_tmp" 2>/dev/null | tr -d '[:space:]'); rm -f "$_tmp"
   gate_release_all; trap - EXIT INT TERM
   # AN EMPTY COUNT IS NOT ZERO. run_bounded kills tsc at the bound and its `|| true`

package/scripts/typedb-flake-check.sh

@@ -60,7 +60,9 @@ classify() {
     return 1
   fi
   # How many tests vitest itself says failed. No line ⇒ we cannot classify ⇒ RED.
-  fails=$(grep -Eo 'Tests +[0-9]+ failed' "$log" | tail -1 | grep -Eo '[0-9]+' || true)
+  # Strip ANSI escape codes first — vitest 4.x wraps its summary in colour codes
+  # that break the regex ("Tests  \x1b[1m\x1b[31m12 failed\x1b[39m" → no match).
+  fails=$(sed 's/\x1b\[[0-9;]*m//g' "$log" | grep -Eo 'Tests +[0-9]+ failed' | tail -1 | grep -Eo '[0-9]+' || true)
   if [ -z "$fails" ]; then
     # A green log has "Tests N passed" and no "failed" — that is not our business.
     if grep -qE 'Tests +[0-9]+ passed' "$log" && ! grep -qE '[0-9]+ failed' "$log"; then

package/scripts/urls-lint.sh

@@ -29,6 +29,14 @@ FROZEN_ROOT_PAGES=(
   # declared in RESERVED_PREFIXES (src/lib/urls/law.ts) and added to
   # RESERVED_SLUGS so no future workspace can claim them.
   tasks w
+  # platform — AMENDMENT 2026-09-05 (ad front door). `ad` is a paid-traffic
+  # landing page, not a door: it renders one `auraHeroes` split-test variant
+  # full-bleed and resolves nothing about the viewer. It is listed in
+  # ASTRO_PORTABLE (src/lib/urls/law.ts) so one host's brand is the only thing
+  # that changes between one.ie/ad, app.one.ie/ad and a tenant domain — which
+  # is a routing BYPASS, and takes the bare word away from workspace `one`'s
+  # published page of the same slug (still served at /p/ad and /u/one/p/ad).
+  ad
   # identity
   signin signup recover "recovery-codes" "auth-security" unsubscribe
   # system

package/scripts/verify-board-doors.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# verify-board-doors.sh — did the tasks:board / tasks:bulk ship actually land in prod?
+#
+# Run BEFORE the ship to capture RED, and AFTER to confirm GREEN. A checker never shown
+# to fail proves nothing — running it twice IS the instrument proof.
+#
+#   bash .claude/scripts/verify-board-doors.sh
+#
+# Gate row: task:01a09b3e3c8564b1eabb984a (p0.97, blocker)
+# Honest sibling: task:01a09b7497bdd80ac761b825 — tasks:board has NEVER been called
+# against a real substrate. These probes are the first time it ever will be.
+set -uo pipefail
+BASE="${ONE_API_URL:-https://one.ie}"
+ENVF="${ONE_ENV_FILE:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/one.ie/web/.dev.vars}"
+KEY="${GATEWAY_API_KEY:-$(grep -m1 '^GATEWAY_API_KEY' "$ENVF" 2>/dev/null | cut -d= -f2- | tr -d '"')}"
+red=0; green=0
+
+# WITHOUT a key every door answers 403 "direct substrate access not permitted" and every
+# line below reads RED for the wrong reason. The first version of this script did exactly
+# that; the CONTROL is what caught it.
+[ -n "$KEY" ] || { echo "NO KEY — set GATEWAY_API_KEY or ONE_ENV_FILE. Refusing to report."; exit 2; }
+
+probe() { # name · expect-regex · receiver · payload
+  local name="$1" expect="$2" rcv="$3" payload="$4" body
+  body=$(curl -s -m 25 -X POST "$BASE/api/ask/$rcv" -H "Authorization: Bearer $KEY" \
+    -H 'content-type: application/json' -d "$payload" 2>&1 | head -c 400)
+  if printf '%s' "$body" | grep -qE "$expect"; then
+    printf '  GREEN  %-36s\n' "$name"; green=$((green+1))
+  else
+    printf '  RED    %-36s %s\n' "$name" "$(printf '%s' "$body" | tr -d '\n' | head -c 130)"; red=$((red+1))
+  fi
+}
+
+echo "== board doors, against $BASE =="
+
+# CONTROL FIRST. If this is RED the key or the host is wrong and every other line is
+# meaningless rather than informative. Never read the results above a red control.
+probe "CONTROL tasks:everywhere" '"ok":true' 'tasks:everywhere' '{"data":{"workspace":"one","limit":1}}'
+
+# 1. tasks:board — answers `unknown_receiver` until this ships.
+probe "tasks:board summary" '"total"' 'tasks:board' '{"data":{"workspace":"one","view":"summary"}}'
+
+# 2. tasks:bulk where+set — prod takes `edits` only until this ships.
+probe "tasks:bulk where+set dryRun" '"ok":true|matched|dryRun' 'tasks:bulk' \
+  '{"data":{"workspace":"one","where":{"status":"open"},"set":{"addTags":["_probe"]},"dryRun":true}}'
+
+# 3. tasks:bulk `creates` with a priority — the ONLY door that can file a row the
+#    priority-sorted board can see. tasks:create still has no priority parameter, which
+#    is why 407 of 730 open rows carry none and the count grows with every filing.
+#    IT CLEANS UP AFTER ITSELF. The first version of this script left a _probe row on
+#    every run — which made the checker a source of exactly the orphan exhaust it was
+#    written to measure. A probe that litters the thing it measures is not a probe.
+body=$(curl -s -m 25 -X POST "$BASE/api/ask/tasks:bulk" -H "Authorization: Bearer $KEY" \
+  -H 'content-type: application/json' \
+  -d '{"data":{"workspace":"one","creates":[{"ref":"p","title":"_probe verify-board-doors — auto-dissolved","priority":0.01}]}}' 2>&1 | head -c 400)
+ptid=$(printf '%s' "$body" | grep -oE 'task:[0-9a-f]{24}' | head -1)
+if printf '%s' "$body" | grep -q '"ok":true'; then
+  printf '  GREEN  %-36s\n' "tasks:bulk creates takes priority"; green=$((green+1))
+else
+  printf '  RED    %-36s %s\n' "tasks:bulk creates takes priority" "$(printf '%s' "$body" | tr -d '\n' | head -c 130)"; red=$((red+1))
+fi
+if [ -n "$ptid" ]; then
+  swept=$(curl -s -m 20 -X POST "$BASE/api/ask/tasks:bulk" -H "Authorization: Bearer $KEY" \
+    -H 'content-type: application/json' \
+    -d "{\"data\":{\"workspace\":\"one\",\"edits\":[{\"tid\":\"$ptid\",\"status\":\"dissolved\"}]}}" | grep -c '"ok":true')
+  [ "$swept" -ge 1 ] && printf '         swept %s\n' "$ptid" || printf '         WARN could not sweep %s — dissolve it by hand\n' "$ptid"
+fi
+
+# 4. Single-row read door. Expected RED even AFTER this ship — "tasks:get" is 0 hits in
+#    dev's receivers.ts. Listed so its absence stays visible instead of being forgotten.
+code=$(curl -s -o /dev/null -m 15 -w '%{http_code}' "$BASE/api/things/task:01a09b3e3c8564b1eabb984a")
+if [ "$code" = "200" ]; then printf '  GREEN  %-36s\n' "GET /api/things/<tid>"; green=$((green+1))
+else printf '  RED    %-36s HTTP %s — no single-row read door (EXPECTED, not a ship failure)\n' "GET /api/things/<tid>" "$code"; red=$((red+1)); fi
+
+echo
+echo "  green=$green red=$red"
+echo "  BEFORE the ship: CONTROL green · doors 1-3 RED · door 4 RED"
+echo "  AFTER  the ship: CONTROL green · doors 1-3 GREEN · door 4 still RED"
+echo "  CONTROL red => the probe is broken, not the ship. Ignore every other line."
+[ "$red" -gt 0 ] && exit 1 || exit 0

package/scripts/verify-fast.sh

@@ -15,6 +15,9 @@
 #      Those are always run — ~seconds, and they are the class of gate that
 #      historically went dark.
 #   3. Everything heavy goes through gate-run.sh (machine governor + load-guard).
+#      This was ASSERTED here and false until 2026-09-07: tsc-cached.sh was called
+#      outside the governor on purpose (see below), so a typecheck escaped the
+#      slot cap entirely. It now takes its own slot internally.
 #
 # FULL_VERIFY=1 makes this an alias for `bun run verify`.
 set -euo pipefail
@@ -33,6 +36,63 @@ BASE_REF="${DO_BASE_REF:-main}"
 # and the test memo, so every worktree and session reads ONE ledger.
 DEBT_FILE="${VERIFY_FAST_DEBT_FILE:-${TMPDIR:-/tmp}/one-verify-fast-debt}"
 
+# --- 0. generated-artifact drift ---------------------------------------------
+# `blocks-manifest.mjs` builds THREE COMMITTED artifacts from one registry:
+#   one.ie/web/src/lib/puck/block-manifest.json        what tooling reads
+#   channels/src/generated/block-enum.ts               what the model is told
+#   one.ie/web/src/lib/puck/block-schema.generated.ts  what the browser
+#                                                      normalises against
+# Until 2026-09-09 NOTHING ran it: `grep -c blocks-manifest verify-fast.sh
+# deploy.sh` was 0 and 0, and no test shells out to it. Three committed files
+# behind an ungated generator are three files that rot silently -- the registry
+# moves, the artifacts do not, and the first symptom is a model being told about
+# a block the browser cannot render.
+#
+# IT IS A STEP, NOT A PIN, and that distinction is the entire gate. `PINS` below
+# are vitest POSITIONAL SUBSTRING filters. Adding `blocks-manifest` there would
+# select zero test files, the other pins would still match, the pinned gate would
+# exit 0 -- and `grep -q blocks-manifest .claude/scripts/verify-fast.sh` would be
+# TRUE. A green grep over a check that never ran is worse than no gate at all.
+#
+# It runs BEFORE the FULL_VERIFY branch on purpose: every lane below has an exit
+# of its own (FULL_VERIFY exits at the top; an empty selection `exec`s the full
+# suite; a do/* branch exits 0 after deferring the pins), so anywhere lower is a
+# lane that can skip it. Repo-scoped, not folder-scoped -- one of the three
+# artifacts lives in channels/ and one in one.ie/web/, so both folders check both.
+#
+# NOT wrapped in gate-run.sh: one node process, ~2.5s of CPU. Most of its ~16s
+# wall is `bunx tsx` resolving a dependency this repo does not vendor
+# (`one.ie/web/node_modules/.bin/tsx` does not exist -- measured 2026-09-09), and
+# holding a machine-wide slot through a network round-trip is the anti-pattern
+# the tsc-cached note further down records.
+#
+# Capture-then-branch, per rule 3 at the top of this file: `set -e` would kill the
+# script with no message, and `node ... | grep` is the PIPESTATUS scar recorded at
+# the vitest call below. `--check` writes `ok (no drift)` to stdout and `drift
+# detected` to stderr; both are shown. A rc it cannot explain is still RED --
+# an unrun check is not a passing check.
+# MEMOISED since 2026-09-09. The raw --check is ~7s WARM (measured 8.19s then
+# 6.98s back-to-back on this box), and this lane runs on every edit, so a
+# doc-only or test-only cycle was paying 7s for a registry nobody touched.
+# blocks-manifest-cached.sh keys on the whole of one.ie/web/src -- a superset
+# of the check's declared inputs AND of the three artifacts it compares --
+# so any src edit still runs it. Only a PASS is stamped; drift is never
+# memoised. deploy.sh Step 0.5 deliberately keeps calling the RAW check: the
+# ship gate runs once and should not depend on a stamp. BLOCKS_MANIFEST_FORCE=1
+# bypasses the memo; --self-test proves the miss.
+_bm_out="$(mktemp)"
+set +e
+bash "$ROOT/.claude/scripts/blocks-manifest-cached.sh" > "$_bm_out" 2>&1
+_bm_rc=$?
+set -e
+cat "$_bm_out"; rm -f "$_bm_out"
+if [ "$_bm_rc" -ne 0 ]; then
+  echo "[verify-fast] block manifest DRIFT (or --check could not run) - rc=$_bm_rc" >&2
+  echo "[verify-fast] regenerate and commit all three artifacts:" >&2
+  echo "[verify-fast]   node .claude/scripts/blocks-manifest.mjs" >&2
+  exit 1
+fi
+
 if [ "${FULL_VERIFY:-0}" = "1" ]; then
   echo "[verify-fast] FULL_VERIFY=1 — running the full gate"
   # The close gate is where deferred pins come due. The full suite is a superset
@@ -68,7 +128,55 @@ if [ "${FULL_VERIFY:-0}" = "1" ]; then
 fi
 
 # Pinned suites: run on every fast pass regardless of the diff.
-PINS_DEFAULT='parity|wrangler|boundary|authority|roles|signals-parity|receivers'
+#
+# `portable` and `design-dock` were added 2026-09-05, after both went red at the
+# ship gate on a change whose fast pass was green. They belong here for the
+# reason the whole list exists — they import NOTHING from what they guard:
+#
+#   astro-portable  reads the pages DIRECTORY. Adding a root `*.astro` puts it in
+#                   neither ASTRO_PORTABLE nor ASTRO_NON_PORTABLE, and the new
+#                   page then 404s on every tenant host. No import graph reaches
+#                   a file that was just created, so `vitest related` cannot ever
+#                   select this — the one edit that trips it is invisible to it.
+#   design-dock     reads `Layout.astro` and every page as STRINGS, to hold "one
+#                   BrandingSection per document". An edit to Layout.astro selects
+#                   nothing that imports Layout.astro.
+#   render-sites    reads MessageList/ShowcaseMessageList as STRINGS to hold that
+#                   both approval states route to the approval card. Added
+#                   2026-09-06, after both sites gated on `approval-requested`
+#                   alone: the answered card — the whole celebration — was
+#                   unreachable through the wire, and the component suite covering
+#                   that state was green the entire time, because it handed the
+#                   card a state no render site ever passes it.
+#   panel-tabs      reads `PanelPanes.tsx` as a STRING to hold that every tab a
+#   person-panel    strip can emit resolves to a rendered pane. Both import only
+#                   `panels/tabs`, so editing ONLY PanelPanes -- which is where a
+#                   pane is DELETED -- selects neither. Measured 2026-09-09:
+#                   with `pane('task', …)` removed, all 79 tests passed.
+#   ad-flow-panel   reads `pages/ad/index.astro` and `AdFunnel.tsx` as STRINGS.
+#                   Same class as design-dock: nothing imports an .astro page.
+#
+# Deliberately NOT pinned: `page-chat-meta`, which imports everything it guards,
+# so `vitest related` already reaches it. A pin for a suite the import graph
+# covers is cost with no coverage.
+#
+# These three cost SECONDS, not the milliseconds the two above cost: measured
+# 2026-09-09, 2.34s for 49 tests, most of it `ad-flow-panel.test.tsx` building a
+# jsdom to render AdFlowPanel. That is the price of the only check that can see
+# a deleted pane, and it is paid on every fast lane.
+#
+# Cost measured on the run that motivated this: 7ms and 46ms. The failure they
+# catch costs an 18-minute deploy gate and a red ship.
+#
+#   sweep-self-test  shells out to `sweep.sh --self-test`. A .sh file is in no
+#                    import graph at all, so `vitest related` can never select
+#                    it — not "usually misses", CANNOT. It is the most expensive
+#                    pin here (2.4s, minting throwaway git estates) and it buys
+#                    the only check on a script that runs `git reset --hard` on
+#                    `dev`: a red gate and a conflict must each put the trunk
+#                    back where they found it. Deleting the reset line takes it
+#                    RED on exactly that assertion — verified, not asserted.
+PINS_DEFAULT='parity|wrangler|boundary|authority|roles|signals-parity|receivers|portable|design-dock|render-sites|panel-tabs|person-panel|ad-flow-panel|ehc-tone|vantage-a-first|sweep-self-test|incident-ledger'
 PINS="${VERIFY_FAST_PINS:-$PINS_DEFAULT}"
 
 # --- changed files: committed-since-base UNION uncommitted -------------------
@@ -157,8 +265,30 @@ bash "$ROOT/.claude/scripts/sdk-build-cached.sh" || { echo "[verify-fast] sdk bu
 # since the last cycle typechecked it. Proving an artifact is not the same as
 # proving it in place.
 #
-# It takes its own gate lock, so it must NOT be nested inside another gate-run
-# slot -- that is a second lock on the same logical gate. It prints the error
+# It is NOT wrapped in gate-run here, and that is now safe rather than a hole:
+# tsc-cached.sh takes its own SLOT internally on a MISS, and takes the folder
+# lock only once that slot is held, so a HIT costs nothing and a MISS queues like
+# every other gate.
+#
+# THE ORDER IS THE POINT, and this comment used to argue the other way: it said
+# wrapping the call out here "would hold a slot through the up-to-900s lock
+# wait". That reasoning is what left tsc-cached taking the LOCK first and the
+# SLOT second -- while THIS script always runs inside `gate-run.sh verify-fast`,
+# i.e. holding a slot already. Two orders, one cycle, and on 2026-09-13 it
+# deadlocked every session on the box three times in ~35 minutes, one of them a
+# production release gate (tsc-cached.sh § SLOT BEFORE LOCK).
+#
+# The trade is real and it is the right way round: a waiter can now burn a slot
+# while the lock holder computes. But the holder is ALWAYS computing and ALWAYS
+# holds a slot itself, so that wait is bounded by one tsc and ends in a cache HIT
+# for the waiter. The old order was bounded by nothing -- it stalled the machine
+# until a human found the right process to kill, and killing the LOCK holder did
+# not even work.
+#
+# The comment this replaces said it "must NOT be nested inside another gate-run
+# slot -- that is a second lock on the same logical gate". That conflated the
+# per-folder dedupe LOCK with the machine-wide SLOT, and it is the instruction
+# that kept the typecheck outside the governor. It prints the error
 # COUNT on stdout and exits non-zero only when the check could not RUN; an unrun
 # check is not a passing check, so both a non-zero exit and a non-zero count fail.
 if [ -x "$ROOT/.claude/scripts/tsc-cached.sh" ] && [ "${VERIFY_FAST_TSC_CACHE:-1}" = "1" ]; then
@@ -214,10 +344,31 @@ fi
 # then vanishes silently, which is strictly worse than the false RED being fixed.
 # Measured: the run stopped after "typecheck: 0 errors" and printed no test line
 # at all. Suspend it around the call, exactly as the FULL_VERIFY branch does.
+
+# --- memo probe: never queue for a slot you do not need ----------------------
+# Both test legs below go through test-cached.sh, which reuses a recorded PASS.
+# But the SLOT was taken first and the memo consulted second, so a hit still
+# waited in the governor queue. Measured 2026-09-09 on a saturated box: a single
+# acquisition queued 855s and 1324s -- for work that, on a hit, is a stat() of a
+# stamp file. A hit needs no memory, no forks and no slot.
+#
+# _memo_hit asks test-cached.sh itself (TEST_CACHE_PROBE=1, runs nothing, exits 0
+# on a hit) so there is exactly ONE definition of what a hit is. On a MISS we
+# fall through and take the slot exactly as before -- the gate is never skipped,
+# only the WAIT for a gate that had nothing to do.
+_memo_hit() {
+  TEST_CACHE_PROBE=1 bash "$ROOT/.claude/scripts/test-cached.sh" "$@" >/dev/null 2>&1
+}
+
 _rel_out="$(mktemp)"
 set +e
-bash "$GATE" test -- bash "$ROOT/.claude/scripts/test-cached.sh" "$rel" -- related --run $(printf '%s ' $scoped) > "$_rel_out" 2>&1
-_rel_rc=$?
+if _memo_hit "$rel" -- related --run $(printf '%s ' $scoped); then
+  echo "[verify-fast] related: cache HIT — no slot taken"
+  _rel_rc=0
+else
+  bash "$GATE" test -- bash "$ROOT/.claude/scripts/test-cached.sh" "$rel" -- related --run $(printf '%s ' $scoped) > "$_rel_out" 2>&1
+  _rel_rc=$?
+fi
 set -e
 cat "$_rel_out"
 if [ "$_rel_rc" -eq 0 ]; then
@@ -306,7 +457,9 @@ if [ "${VERIFY_FAST_PINS_ALL:-0}" != "1" ] && [ "$_tier" = "PATCH" ]; then
 else
   echo "[verify-fast] tier=$_tier — running the full pin set"
 fi
-if ! bash "$GATE" test -- bash "$ROOT/.claude/scripts/test-cached.sh" "$rel" -- run "${_pins[@]}"; then
+if _memo_hit "$rel" -- run "${_pins[@]}"; then
+  echo "[verify-fast] pins: cache HIT — no slot taken"
+elif ! bash "$GATE" test -- bash "$ROOT/.claude/scripts/test-cached.sh" "$rel" -- run "${_pins[@]}"; then
   echo "[verify-fast] pinned gate FAILED (pins: ${_pins[*]})" >&2
   exit 1
 fi

package/scripts/worktree-up.sh

@@ -57,12 +57,15 @@
 set -uo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-NAME=""; PORT=""; BASE="main"; MODE="up"
+# Branches are cut from `dev`, not main: dev is the integration branch every
+# branch lands into, so a branch cut from main starts life missing whatever
+# dev has already integrated. `--base main` still does the old thing.
+NAME=""; PORT=""; BASE="dev"; MODE="up"
 
 while [ $# -gt 0 ]; do
   case "$1" in
     --port) PORT="${2:-}"; shift 2 ;;
-    --base) BASE="${2:-main}"; shift 2 ;;
+    --base) BASE="${2:-dev}"; shift 2 ;;
     --no-dev) MODE="setup"; shift ;;
     --check) MODE="check"; shift ;;
     --down) MODE="down"; shift ;;
@@ -81,8 +84,21 @@ _port_file() { echo "$WT/.worktree-port"; }
 # one.ie/web/node_modules is deliberately ABSENT here — it is built below as a
 # farm of per-package links so that .vite can be worktree-local. A wholesale
 # symlink would drag main's .vite in with it, which is the corruption above.
+# api/.dev.vars was MISSING from this list until 2026-09-15, and its absence does
+# not read as an absence: the gateway starts, answers 401, and the seven
+# real-TypeDB suites die in mustWrite at fixture setup — so the typedb lane reads
+# as a broken key or a flaky substrate rather than as an unlinked file. It holds
+# GATEWAY_API_KEY and the four TYPEDB_* vars; without it that lane cannot run at all.
+# api/ and sync/ were MISSING until 2026-09-17, and their absence does not read as
+# an absence either: `deploy.sh` typechecks all five services (:181-182), so both
+# died on `TS2688: Cannot find type definition file for '@cloudflare/workers-types'`
+# — a TypeScript error naming TypeScript, caused by an unlinked directory. Measured
+# that day at the ship gate: two of five typechecks red at t≈290s, in a tree whose
+# code was fine, in all four existing worktrees at once.
 LINKS="node_modules
 packages/node_modules
+api/node_modules
+sync/node_modules
 packages/sdk/dist
 packages/sdk/node_modules
 pay/backend/node_modules
@@ -91,8 +107,10 @@ one.ie/web/.env
 one.ie/web/.dev.vars
 one.ie/web/.wrangler
 one.ie/web/.astro
+one.ie/web/src/data/fleets.json
 pay/backend/.env
-channels/.env"
+channels/.env
+api/.dev.vars"
 
 # Ports are ALLOCATED, never assumed: several worktrees run at once, and a
 # hardcoded port is how two of them come to think they serve each other's code.

package/skills/astro/SKILL.md

@@ -71,7 +71,7 @@ export default defineConfig({
 ```
 
 **Don't copy a `vite.ssr` list out of this skill.** `astro.config.mjs` §
-`vite.ssr.external` is the authority (`.claude/commands/deploy.md` Rule 2 says so
+`vite.ssr.external` is the authority (`.claude/skills/deploy/REFERENCE.md` Rule 2 says so
 explicitly: *never reconcile that file to a doc*). Note the direction — `recharts`,
 Stripe, `@xyflow/react`, `motion`, `media-chrome` and the 100ms packages are
 **external**; `react`, `react-dom`, `@astrojs/react`, `better-auth` and `kysely` are
@@ -224,7 +224,7 @@ The documented ceiling is **3 MiB gzipped** free tier / 10 MiB paid, but this
 account's real ceiling is **unconfirmed**: deploys at 3.22 MiB (2026-07-08) and
 4.43 MiB (2026-07-19) both succeeded. Treat the current number as a floor to watch,
 not a hard gate, and re-run the diagnosis if it keeps climbing.
-`.claude/commands/deploy.md § Bundle Size Rules` + § Verified Bundle Numbers is the
+`.claude/skills/deploy/REFERENCE.md § Bundle Size Rules` + § Verified Bundle Numbers is the
 authority — reconcile to it, not to this table.
 
 | Rule | Where | Saves |
@@ -350,6 +350,12 @@ Five sub-workflows live beside this file: `create-page.md`, `create-component.md
 - **`output: "hybrid"`** throws in Astro 6. Replace with `"server"` + per-page `prerender = true`.
 - **Never delete a `vite.ssr.external` entry to match a doc snippet** — the config file is
   the authority and the list is longer than any snippet.
+- **A `{/* … */}` comment in ATTRIBUTE position inside an opening tag is parsed as
+  an expression.** Any backtick in the prose opens a template literal, and
+  `astro check` then reports `Unterminated string literal` **at EOF**, blaming the
+  closing tag while the source looks fine. `tsc` ignores `.astro`, so
+  `check:ratchet` is the only gate that catches this class (measured 2026-09-14).
+  Put such prose in the frontmatter as `//` comments.
 - **`platformProxy: { enabled: true }`** is wrong here. This tree uses
   `{ environment: undefined }` so `astro build` doesn't make Miniflare evaluate the
   Durable Object before `durableObjectExportsPlugin` has run.
@@ -358,7 +364,7 @@ Five sub-workflows live beside this file: `create-page.md`, `create-component.md
 
 - [Astro Cloudflare adapter](https://docs.astro.build/en/guides/integrations-guide/cloudflare/) — authoritative for v13
 - [CF Workers framework guide — Astro](https://developers.cloudflare.com/workers/frameworks/framework-guides/astro/)
-- `.claude/commands/deploy.md` — 8-step pipeline, 5 LOCKED bundle rules, verified bundle numbers, rollback
+- `.claude/commands/deploy.md` — the pipeline, the gates, rollback · `.claude/skills/deploy/REFERENCE.md` — the 5 LOCKED bundle rules + verified numbers (split out 2026-09-17)
 - `.claude/rules/astro.md` — auto-loaded on `*.astro` edits
 - `one.ie/web/astro.config.mjs` — the authority for adapter options and every `vite.ssr` list