@oneie/claude 0.8.0 → 0.9.0

package/scripts/deploy.sh

@@ -404,6 +404,39 @@ else
   ok "clean tree"
 fi
 
+# ── Step 0.5 — generated artifacts (cheap, before the slow gates) ─────────
+# Same reasoning as Step 0.4: one cheap deterministic check, run where failing is
+# free, rather than after five typechecks, the whole suite and an astro build.
+#
+# blocks-manifest.mjs builds THREE COMMITTED artifacts from one block registry --
+# one.ie/web/src/lib/puck/block-manifest.json (what tooling reads),
+# channels/src/generated/block-enum.ts (what the model is told) and
+# one.ie/web/src/lib/puck/block-schema.generated.ts (what the browser normalises
+# against) -- and until 2026-09-09 nothing ran it: not this script, not
+# verify-fast.sh, not a test. `grep -c blocks-manifest` on both was 0 and 0.
+# A drifted enum ships a vocabulary the model is told about and the browser
+# cannot render, so the generator belongs on the SHIP gate and not only the
+# dev lane.
+#
+# Step 0 has already refused a dirty tree, so what --check diffs is exactly what
+# would ship. It exits non-zero on drift AND on failing to run, and both stop the
+# deploy: an unrun gate is not a pass.
+#
+# THE DRY BRANCH IS EXPLICIT, and it has to be: `run` returns 0 under --dry-run
+# (see its definition above), so `if run ...; then ok "no drift"` would print a
+# GREEN verdict for a check that never executed -- an unrun gate reported as a
+# pass, in the one script where that is the cardinal sin. `gate_start` below
+# already handles DRY the same way: say what would run, record no verdict.
+step "Step 0.5 — generated artifacts"
+if (( DRY )); then
+  say "  [dry] node .claude/scripts/blocks-manifest.mjs --check"
+elif run "blocks-manifest --check" . node "$ROOT/.claude/scripts/blocks-manifest.mjs" --check; then
+  ok "block manifest: no drift"
+else
+  tail -5 "$LOG" | sed 's/^/    /'
+  die "block manifest DRIFT (or --check could not run) — regenerate with 'node .claude/scripts/blocks-manifest.mjs' and commit all three artifacts"
+fi
+
 # ── Steps 1+3 — the slow gates, all at once ─────────────────────────────────
 # typecheck ×5, vitest and the astro build share no STATE — the only thing they
 # share is the SDK's dist/, built first if missing. Running them concurrently
@@ -477,6 +510,82 @@ else
   say "          (overlapping them pages; measured 1145s vs 176s — see deploy.sh)"
 fi
 
+# ── the run, streamed into the world ────────────────────────────────────────
+# Until 2026-09-07 this script emitted NOTHING — no signal, no row — and a
+# committed JSON file was a deploy's only trace. `deploy-emit.sh` puts each gate
+# on the same run/event stream /do and the factory already write to, LIVE, so a
+# reader can see a deploy that is happening rather than only one that happened.
+#
+# THREE RULES, and all three are about not making the telemetry load-bearing:
+#
+#  1. IT CAN NEVER FAIL THE DEPLOY. Backgrounded and `|| true`, exactly as
+#     _record_run is guarded. A gate that passed while the network was down is
+#     still a gate that passed, and a deploy going red because it could not
+#     phone home is a worse failure than the one it was reporting.
+#  2. IT CAN NEVER SLOW THE DEPLOY. `&` — the emitter's own --max-time is 8s and
+#     that must not land on the critical path of a gate somebody is waiting on.
+#  3. --dry-run EMITS NOTHING. A run row for a deploy that did not happen is the
+#     theater /deploy already refuses to render. Checked here, because the
+#     emitter cannot know its caller's flags.
+#
+# A dropped emit degrades to a GAP in the trace, never to a lie: the mapper
+# treats an absent stage as absent and has no default frame.
+# bash 3.2 (what macOS ships) closes `$(` at the FIRST `)` it meets — and a
+# case pattern ends in one. So the old form,
+#   EMIT_TARGET="$( case "$MODE" in dev) echo dev.one.ie ;; *) echo one.ie ;; esac )"
+# raised `syntax error near unexpected token` at run time and left EMIT_TARGET
+# holding the literal tail ` echo dev.one.ie ;; *) echo one.ie ;; esac )`, which
+# was then passed as --target and written into deploy-runs.json. Measured on the
+# 2026-09-08 production ship, in the log, twice.
+#
+# That is the one outcome the comment above forbids: an emit that degrades to a
+# LIE rather than a gap. deploy-runs.json is the artifact the release path reads
+# to learn what production runs, so a false target there misinforms the next
+# person to ask "what is live". An `if` has no pattern and no closing paren.
+if [ "$MODE" = dev ]; then EMIT_TARGET="dev.one.ie"; else EMIT_TARGET="one.ie"; fi
+EMIT_ENV="$( [[ "$MODE" == dev ]] && echo dev || echo prod )"
+
+# deploy.sh's gate names are implementation names (`tsc-one.ie-web`, `vitest`);
+# DEPLOY_SPINE_STEPS are the pipeline's. Anything unmapped emits NOTHING rather
+# than inventing a stage — an unknown stage is refused at the receiver anyway,
+# and a gate the spine has no name for is better absent than mislabelled.
+_spine_stage() {
+  case "$1" in
+    tsc-*)   echo typecheck ;;
+    vitest)  echo tests ;;
+    build)   echo build ;;
+    *)       echo "" ;;
+  esac
+}
+
+# The verdict CLOSES the run, and it is a field of its own rather than something
+# inferred from the last stage to arrive. `--gates-only` is a complete,
+# successful run that never reaches ship or health; closing on a stage would
+# leave every one of those runs `open` forever in every run list.
+_emit_verdict() {
+  local v="$1"
+  _emit --verdict "$v" \
+    --detail "shipped=${TARGETS[*]:-none}" \
+    --detail "wallSec=$(( SECONDS ))" \
+    --detail "mode=${MODE}" \
+    --detail "heavyParallel=$( (( ${HEAVY_PARALLEL:-0} )) && echo true || echo false )" \
+    --detail "memFreeGb=${HEAVY_FREE_GB:-0}"
+  # Give the backgrounded emits a moment to land. Bounded and ignored: the run
+  # is closing either way, and a deploy must not wait on its own telemetry.
+  wait -n 2>/dev/null || true
+}
+
+_emit() {  # ...deploy-emit.sh args
+  [[ -x "$ROOT/.claude/scripts/deploy-emit.sh" ]] || return 0
+  (( DRY )) && return 0
+  ( bash "$ROOT/.claude/scripts/deploy-emit.sh" \
+      --run "$STAMP" --target "$EMIT_TARGET" --env "$EMIT_ENV" \
+      --door "deploy${MODE:+ $MODE}" \
+      --sha "$(git -C "$ROOT" rev-parse --short HEAD 2>/dev/null || echo '')" \
+      "$@" >/dev/null 2>&1 || true ) &
+  return 0
+}
+
 GATE_NAMES=() GATE_PIDS=() GATE_LOGS=() GATE_RC=() GATE_T=() GATE_DUR=()
 GATE_BOUND="${DEPLOY_GATE_TIMEOUT:-900}"   # healthy vitest 176s, build 174s
 # Typechecks were run bare on the claim that they are "cached ~1s each". They
@@ -502,6 +611,10 @@ gate_start() { # <name> <dir> <cmd...>
   ( cd "$ROOT/$dir" && unset CLOUDFLARE_API_TOKEN && "$@" ) >"$out" 2>&1 &
   GATE_NAMES+=("$name"); GATE_PIDS+=("$!"); GATE_LOGS+=("$out"); GATE_RC+=(-1)
   GATE_T+=("$SECONDS"); GATE_DUR+=(-1)
+  # The `start` frame is what makes a run render as IN PROGRESS rather than
+  # appearing whole at the end. Emitted per LAUNCH, so a serialised gate's
+  # start is the moment it really started, not the moment the batch did.
+  { st="$(_spine_stage "$name")"; [[ -n "$st" ]] && _emit --stage "$st" --status start; } || true
   say "  → $name (pid $!)"
 }
 # Heavy gates run under gate-run.sh for its BOUND and its process-group REAP:
@@ -516,6 +629,10 @@ gate_start_governed() { # <name> <dir> <cmd...>
          exec "$ROOT/.claude/scripts/gate-run.sh" "deploy-$name" -- "$@" ) >"$out" 2>&1 &
   GATE_NAMES+=("$name"); GATE_PIDS+=("$!"); GATE_LOGS+=("$out"); GATE_RC+=(-1)
   GATE_T+=("$SECONDS"); GATE_DUR+=(-1)
+  # The `start` frame is what makes a run render as IN PROGRESS rather than
+  # appearing whole at the end. Emitted per LAUNCH, so a serialised gate's
+  # start is the moment it really started, not the moment the batch did.
+  { st="$(_spine_stage "$name")"; [[ -n "$st" ]] && _emit --stage "$st" --status start; } || true
   say "  → $name (pid $!, bound ${GATE_BOUND}s)"
 }
 # gate_start_heavy — same, but when memory says the two heavy gates cannot
@@ -550,6 +667,30 @@ if ! (( SKIP_TYPECHECK )); then
   # typechecking one.ie/web would make this gate queue up to TSC_CACHE_WAIT (900s)
   # and then exit 1 -- a red ship gate caused by lock contention rather than by
   # code. Four seconds is not worth that trade.
+  # CONTENT TYPES FIRST, and this line is worth its four seconds.
+  #
+  # `astro check` and `astro build` sync implicitly; raw `tsc --noEmit` does NOT,
+  # and `DataEntryMap` is GENERATED into the gitignored one.ie/web/.astro/. So a
+  # freshly-materialised tree carries whatever that directory happened to hold —
+  # for .release/, types from before the newest collection existed; for a new
+  # worktree, no file at all. Either way tsc rejects the collection key and the
+  # gate goes red on code that is fine.
+  #
+  # Measured three times on 2026-09-06/07, each costing a full gate: twice on
+  # .release/ during a promote, once on a fresh worktree. The error names
+  # TypeScript and the cause is Astro, which is why it kept being re-diagnosed:
+  #   src/lib/docs/sections.ts(23,40): error TS2344:
+  #     Type '"docs"' does not satisfy the constraint 'keyof DataEntryMap'.
+  #
+  # It must run BEFORE the fan-out rather than inside the one.ie/web gate: the
+  # five typechecks start concurrently, and a sync racing them writes the types
+  # out from under a tsc that is already reading them.
+  if (( want_astro )) && [[ -d one.ie/web ]]; then
+    ( cd one.ie/web && NODE_OPTIONS=--max-old-space-size=4096 \
+        ./node_modules/.bin/astro sync >/dev/null 2>&1 ) \
+      && ok "content types synced" \
+      || warn "astro sync failed — a new content collection will read as a tsc error"
+  fi
   for svc in "${SERVICES_TYPECHECK[@]}"; do
     if (( TSC_GOVERNED )); then
       gate_start_governed "tsc-$(echo "$svc" | tr / -)" "$svc" bunx tsc --noEmit
@@ -577,7 +718,7 @@ fi
 # which /close reaches too -- test-cached keys on argv, so two spellings of the
 # same suite could never share a stamp and a warm tree paid it twice.
 (( SKIP_TESTS || ! want_astro )) || gate_start_heavy vitest one.ie/web \
-  env TEST_CACHE_PTY=1 bash "$ROOT/.claude/scripts/test-full.sh"
+  env TYPEDB_LANE_NONBLOCKING=1 TEST_CACHE_PTY=1 bash "$ROOT/.claude/scripts/test-full.sh"
 if (( want_astro )); then
   if (( SKIP_BUILD )); then
     [[ -d one.ie/web/dist/server ]] || die "--skip-build but one.ie/web/dist/server/ does not exist"
@@ -595,6 +736,12 @@ for i in $(seq 0 $(( ${#GATE_NAMES[@]} - 1 )) ); do
   elif wait "${GATE_PIDS[$i]}"; then rc=0; else rc=1; fi
   GATE_RC[$i]=$rc   # record it: the deploy receipt below reads results, not just timings
   (( ${GATE_DUR[$i]} < 0 )) && GATE_DUR[$i]=$(( SECONDS - GATE_T[$i] ))
+  # …and onto the stream. ONE hook for typecheck/tests/build — the three gates
+  # that are ~95% of the wall clock and carry the metrics deploy-runs.json has
+  # no shape for. Deferred to after the `case` below for `tests`, which is the
+  # only gate whose reused/waived facts are not known yet at this line.
+  _emit_stage="$(_spine_stage "$name")"
+  _emit_dur=$(( GATE_DUR[i] < 0 ? 0 : GATE_DUR[i] ))
   cat "$glog" >>"$LOG"
   case "$name" in
     tsc-*)
@@ -663,6 +810,32 @@ for i in $(seq 0 $(( ${#GATE_NAMES[@]} - 1 )) ); do
       if (( rc )); then bad "astro build FAILED"; gate_fail+=(build)
       else BUILD_REPORT="ok"; ok "astro build clean"; fi ;;
   esac
+  # AFTER the case, deliberately: `tests` only learns whether it was a memo hit
+  # or a waived failure inside it, and those two booleans are the whole reason
+  # this stream exists. Emitting before the case would carry the timing and lose
+  # the meaning.
+  #
+  # `waived` is the one that matters most. On 2026-09-06 a flake waiver let this
+  # gate exit 0 on a genuinely red suite, and deploy-runs.json recorded `green`
+  # with nothing to distinguish it. A waived pass is now a fact on the run.
+  if [[ -n "$_emit_stage" ]]; then
+    _emit_args=(--stage "$_emit_stage" --wall-ms "$(( _emit_dur * 1000 ))")
+    if (( rc )) && ! { [[ "$_emit_stage" == tests ]] && (( TESTS_WAIVED )); }; then
+      _emit_args+=(--status fail --reason "${name}")
+    else
+      _emit_args+=(--status ok)
+    fi
+    case "$_emit_stage" in
+      tests)
+        _emit_args+=(--detail "reused=$( [[ "$TESTS_REPORT" == *REUSED* ]] && echo true || echo false )")
+        _emit_args+=(--detail "waived=$( (( TESTS_WAIVED )) && echo true || echo false )") ;;
+      typecheck)
+        # Which of the five, not just how many — a reader chasing a red gate
+        # should not have to open the log to learn the service.
+        _emit_args+=(--detail "service=${name#tsc-}") ;;
+    esac
+    _emit "${_emit_args[@]}"
+  fi
 done
 (( tc_total )) && {
   TYPECHECK_REPORT="$tc_pass/$tc_total services clean"
@@ -679,6 +852,13 @@ if (( ${#GATE_NAMES[@]} )); then
     say "    ${GATE_NAMES[$i]}: ${GATE_DUR[$i]}s"
   done
   say "  gates wall-clock: $GATE_WALL"
+  # Repeat the branch HERE, next to the durations it explains. Without it a
+  # reader comparing two runs cannot tell a slow gate from a serialised one.
+  if (( HEAVY_PARALLEL )); then
+    say "  heavy gates: OVERLAPPED (${HEAVY_FREE_GB}GB free >= ${HEAVY_NEED_GB}GB)"
+  else
+    say "  heavy gates: SERIALISED (${HEAVY_FREE_GB}GB free < ${HEAVY_NEED_GB}GB) — the 6.5x branch"
+  fi
   [[ "$BUILD_REPORT" == ok ]] && BUILD_REPORT="$GATE_WALL (overlapped)"
 fi
 (( ${#gate_fail[@]} )) && die "gates red: ${gate_fail[*]} — nothing deployed"
@@ -718,6 +898,12 @@ fi
 if (( GATES_ONLY )); then
   say ""; ok "gates green in ${GATE_WALL:-0s} — nothing shipped (--gates-only)"
   say "  Typecheck:  $TYPECHECK_REPORT"; say "  Tests:      $TESTS_REPORT"; say "  Log: $LOG"
+  # CLOSE THE RUN. This exit is the one --gates-only always takes, and it is the
+  # path this feature is exercised by most (every release.sh promote mints its
+  # receipt through it). Without this the run would carry its gate frames and
+  # sit `open` forever — the precise failure the verdict field was added to
+  # prevent, and it is only not a bug because of this line.
+  _emit_verdict green
   exit 0
 fi
 
@@ -1027,11 +1213,61 @@ say "  Health:     $HEALTH_REPORT"
 [[ -n "${GZIP_HINT:-}" ]] && say "  Bundle:     $GZIP_HINT"
 say "  Log:        $LOG"
 
+# The record the /deploy page renders. It runs on BOTH exits — a degraded deploy
+# is the run most worth having a timing for, and a record that only ever holds
+# green runs is a record that cannot be read for a trend. Guarded so a recorder
+# fault can never turn a good deploy into a bad exit: `|| true`, and the phases
+# come from arrays the gates already filled.
+_record_run() {
+  local verdict="$1"
+  [[ -x "$ROOT/.claude/scripts/deploy-record.sh" ]] || return 0
+  (( DRY )) && return 0
+  local -a args=(--door "deploy${MODE:+ $MODE}" --target "${TARGETS[*]:-—}"
+                 --branch "$(git -C "$ROOT" rev-parse --abbrev-ref HEAD 2>/dev/null || echo '')"
+                 --sha "$(git -C "$ROOT" rev-parse --short HEAD 2>/dev/null || echo '')"
+                 --verdict "$verdict" --wall "$(( SECONDS ))"
+                 --note "heavy=$( (( ${HEAVY_PARALLEL:-0} )) && echo parallel || echo serial ) memFreeGb=${HEAVY_FREE_GB:-?} needGb=${HEAVY_NEED_GB:-?}")
+  local i st
+  for i in "${!GATE_NAMES[@]}"; do
+    # -1 means the gate never reported. It is recorded as `unrun`, never as a
+    # pass and never as a zero — the page draws it as an outline for that reason.
+    if   [[ "${GATE_RC[$i]}" == 0 ]];  then st=pass
+    elif [[ "${GATE_RC[$i]}" == -1 ]]; then st=unrun
+    else st=fail; fi
+    args+=(--phase "${GATE_NAMES[$i]}:$(( GATE_T[i] - GATE_T0 )):$(( GATE_DUR[i] < 0 ? 0 : GATE_DUR[i] )):gate:$st")
+  done
+  bash "$ROOT/.claude/scripts/deploy-record.sh" "${args[@]}" >/dev/null 2>&1 || true
+  # THE TRUNK LEG. The row lands in the PRIMARY worktree, where a commit can
+  # pick it up — and nothing commits it, so /deploy (which renders that file at
+  # BUILD time) never sees it. Two production ships were lost that way in two
+  # days. It is not automated: main receives merges, never edits, and a
+  # recorder that pushed its own row would invent a door past that loop and
+  # need credentials at ship time. So it is made impossible to miss instead —
+  # printed here, at the moment it becomes true. Never fatal: a LOGGING debt
+  # must not fail a ship.
+  local pend; pend="$(bash "$ROOT/.claude/scripts/deploy-record.sh" --pending 2>/dev/null)" || true
+  [[ -n "$pend" ]] && say "$pend"
+  return 0
+}
+
 if (( ${#hfail[@]} )); then
+  _emit --stage health --status fail --reason "unhealthy: ${hfail[*]}"
+  _emit_verdict red
+  _record_run degraded
+  # A degraded ship is an outcome. Close it as one.
+  # --only dims,feedback: `deploy` is a label, not a plan slug — without --tid the
+  # task leg resolves it through the `slug:` tag door and would close a plan named
+  # deploy if one ever existed. The deploy record is deploy-record.sh's job; what
+  # is true to write here is the pheromone.
+  bash "$(dirname "${BASH_SOURCE[0]}")/do-close.sh" deploy --status failed --only dims,feedback || true
   say ""
   bad "degraded — unhealthy: ${hfail[*]}"
   say "  rollback: cd one.ie/web && bunx wrangler rollback --name one-prod"
   exit 1
 fi
+_emit --stage health --status ok --detail "probes=${#TARGETS[@]}"
+_emit_verdict green
+_record_run green
+bash "$(dirname "${BASH_SOURCE[0]}")/do-close.sh" deploy --only dims,feedback || true
 say ""
 ok "deploy:success"

package/scripts/do-auto.sh

@@ -42,30 +42,110 @@ while [ "$#" -gt 0 ]; do
   esac
 done
 
-# Standalone GC: sweep all worktrees whose do/<slug> branch is fully merged into
-# trunk (main; DO_BASE_REF overrides). Safe-only: `worktree remove` refuses
-# dirty, `branch -d` refuses unmerged. Unmerged/dirty worktrees are listed,
-# never touched.
+# Standalone GC: sweep every worktree whose branch is fully merged into the
+# RELEASE trunk. Safe-only: `worktree remove` refuses a dirty tree and
+# `branch -d` refuses an unmerged branch, so live work is listed, never touched.
+#
+# TWO DIRECTORIES, not one. `.do-worktrees/<slug>` carries branch `do/<slug>`;
+# `.claude/worktrees/<name>` carries whatever branch is checked out there, which
+# is the door root CLAUDE.md sends every session through. Only the first was ever
+# swept, and the canon said so out loud — "swept by nothing" — for as long as the
+# second existed. Measured 2026-09-06: 36 worktrees, 24 of them fully landed,
+# 6.4G, and the box at load 16 funding ONE concurrent gate because each one costs
+# a tsserver. Sweeping 17 took load to 3.5.
+#
+# THE BASE IS `main`, DELIBERATELY, AND NOT `dev`. Branches are cut from dev and
+# land into dev (§ the loop), so measuring against dev would delete a worktree
+# the moment its work integrated — which is BEFORE the dev→main PR is reviewed.
+# A reviewer asking for changes would find the branch already gone. A branch is
+# finished when it is released, not when it is integrated. DO_BASE_REF overrides.
 if $GC_ONLY; then
-  BASE="${DO_BASE_REF:-main}"
-  git show-ref --verify --quiet "refs/heads/$BASE" \
-    || BASE="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"
+  BASE="${DO_GC_BASE:-${DO_BASE_REF_GC:-main}}"
+  # RESOLVE ANY COMMIT-ISH, AND NEVER SUBSTITUTE ONE SILENTLY. This used to be
+  # `show-ref --verify refs/heads/$BASE`, which accepts only a LOCAL branch — so
+  # `DO_GC_BASE=origin/main`, the obvious way to sweep against the real trunk,
+  # failed the check and fell back to the invoking branch. That is the branch the
+  # override exists to escape, and the run reported `base=main` as if it had
+  # worked. Measured 2026-09-07: local main sat 131 commits behind origin/main,
+  # so every landed branch read as "142 unmerged commit(s)" and the sweep hoarded
+  # 1.0 GB of finished worktrees. A base that cannot be resolved is now a REFUSAL,
+  # not a fallback — the whole point of --gc is that it never deletes live work,
+  # and measuring against the wrong ref is how it would.
+  if ! git rev-parse --verify --quiet "${BASE}^{commit}" >/dev/null 2>&1; then
+    echo "[do-auto] gc: base '$BASE' does not resolve to a commit — refusing to sweep" >&2
+    echo "[do-auto]     (a wrong base makes landed work look unmerged, and unlanded work look landed)" >&2
+    exit 2
+  fi
+  # Say what was measured against, so a STALE base is visible in the output
+  # rather than inferred from a surprising verdict. `main` 131 commits behind its
+  # upstream is not a wrong ref — it is a right ref pointing at the wrong commit,
+  # and nothing in the old output could tell those apart.
+  BASE_SHA="$(git rev-parse --short "${BASE}^{commit}")"
+  BASE_NOTE=""
+  if _gc_up="$(git rev-parse --abbrev-ref --symbolic-full-name "${BASE}@{upstream}" 2>/dev/null)"; then
+    _gc_behind="$(git rev-list --count "${BASE}..${_gc_up}" 2>/dev/null || echo 0)"
+    [ "${_gc_behind:-0}" -gt 0 ] && BASE_NOTE=" — STALE: ${_gc_behind} commit(s) behind ${_gc_up}"
+  fi
+  echo "[do-auto] gc: measuring against ${BASE} (${BASE_SHA})${BASE_NOTE}"
+  # Never sweep the branches the loop itself stands on, whatever their state.
+  GC_KEEP="${GC_KEEP:-main dev release}"
   removed=0; kept=0
-  for wt in .do-worktrees/*/; do
-    [ -d "$wt" ] || continue
-    s=$(basename "$wt"); b="do/${s}"
-    git show-ref --verify --quiet "refs/heads/$b" || { echo "[do-auto] gc: $wt has no branch $b — inspect manually"; kept=$((kept+1)); continue; }
-    if [ "$(git rev-list --count "${BASE}..${b}" 2>/dev/null || echo 1)" -eq 0 ]; then
-      if git worktree remove "$wt" 2>/dev/null && git branch -d "$b" 2>/dev/null; then
-        echo "[do-auto] gc: removed merged worktree $wt + branch $b"; removed=$((removed+1))
-      else
-        echo "[do-auto] gc: $wt merged but dirty — inspect manually"; kept=$((kept+1))
-      fi
+
+  # The predicate lives in lib/gc-finished.sh — shared, so its red proof
+  # (gc-content-check.sh) drives the same code the sweep runs.
+  . "$(dirname "${BASH_SOURCE[0]}")/lib/gc-finished.sh"
+
+  _gc_one() { # <worktree-dir> <branch>
+    local wt="$1" b="$2"
+    case " $GC_KEEP " in *" $b "*) echo "[do-auto] gc: $wt is $b — infrastructure, kept"; kept=$((kept+1)); return ;; esac
+
+    if ! gc_finished "$BASE" "$b"; then
+      echo "[do-auto] gc: $b carries $(gc_carries "$BASE" "$b") path(s) $BASE does not have — kept"; kept=$((kept+1)); return
+    fi
+
+    # Finished. The only thing that still earns a keep is UNCOMMITTED work — that
+    # is content no merge has seen and no ref points at, so losing it loses it.
+    local real; real="$(gc_real_dirt "$wt")"
+    if [ -n "$real" ]; then
+      echo "[do-auto] gc: $b is in $BASE but its worktree has uncommitted work — kept:"
+      echo "$real" | sed "s/^/[do-auto] gc:     /"
+      kept=$((kept+1)); return
+    fi
+
+    # --force gets past ephemeral dirt only: the check above already refused
+    # anything that was work. `branch -d` asks "is it merged into HEAD", which is
+    # the wrong question here (HEAD is usually main and $BASE is usually dev), so
+    # -D is correct once content identity is proven — and it is proven, above.
+    if git worktree remove --force "$wt" 2>/dev/null; then
+      git branch -D "$b" >/dev/null 2>&1 \
+        && echo "[do-auto] gc: removed $wt + branch $b (content already in $BASE)" \
+        || echo "[do-auto] gc: removed $wt (branch $b kept — could not delete ref)"
+      removed=$((removed+1))
     else
-      echo "[do-auto] gc: $b has $(git rev-list --count "${BASE}..${b}") unmerged commit(s) — kept"; kept=$((kept+1))
+      echo "[do-auto] gc: $b is in $BASE but its worktree would not remove — inspect $wt"; kept=$((kept+1))
     fi
-  done
-  echo "[do-auto] gc done: removed=$removed kept=$kept"
+  }
+
+  # ENUMERATE FROM GIT, NOT FROM A GLOB. `for wt in .claude/worktrees/*/` is
+  # relative to the INVOKING tree, and a worktree contains no worktrees — so run
+  # from anywhere but main and the sweep matches nothing and reports success.
+  # Measured 2026-09-06 on the first run of this code: `removed=0 kept=0` with 19
+  # worktrees live. It is the same trap the canon already records for land.sh and
+  # release.sh ("Run MAIN's copy"), and a glob cannot be told apart from a clean
+  # sweep by its output. `git worktree list` answers with absolute paths from any
+  # tree, so there is no copy to run.
+  SELF="$(git rev-parse --show-toplevel 2>/dev/null)"
+  while IFS= read -r wt; do
+    [ -d "$wt" ] || continue
+    case "$wt" in *"/.do-worktrees/"*|*"/.claude/worktrees/"*) ;; *) continue ;; esac
+    # Never saw off the branch you are sitting on.
+    [ "$wt" = "$SELF" ] && { echo "[do-auto] gc: $wt is the invoking tree — kept"; kept=$((kept+1)); continue; }
+    b="$(git -C "$wt" branch --show-current 2>/dev/null)"
+    [ -n "$b" ] || { echo "[do-auto] gc: $wt is detached — kept"; kept=$((kept+1)); continue; }
+    _gc_one "$wt" "$b"
+  done < <(git worktree list --porcelain | sed -n 's/^worktree //p')
+
+  echo "[do-auto] gc done: removed=$removed kept=$kept (base=$BASE ${BASE_SHA}${BASE_NOTE})"
   exit 0
 fi
 
@@ -587,7 +667,9 @@ POLL_SECS="${DO_POLL_SECS:-30}"
 # branch would otherwise seed every new do/<slug> with that branch's commits
 # (plans cross-contaminating across concurrent sessions, 2026-07-21).
 # DO_BASE_REF overrides for a deliberate stack on another branch.
-BASE="${DO_BASE_REF:-main}"
+# `dev` since 2026-09-06: it is the integration branch branches land into, so
+# cutting from main would start every cycle missing what dev already holds.
+BASE="${DO_BASE_REF:-dev}"
 git show-ref --verify --quiet "refs/heads/$BASE" \
   || BASE="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"
 BR="do/${SLUG}"
@@ -1325,6 +1407,10 @@ if [ "$i" -ge "$MAX_CYCLES" ]; then
   echo "[do-auto] hit --max-cycles $MAX_CYCLES — halting"
   echo "[do-auto] WIP preserved on branch $BR (worktree $WT)."
   _signal halt "$SLUG" "$(_tier)" "$(_plan_cycle "$i")" "reason=max-cycles"
+  # A halt still closes. --status timeout is the honest word: the lease stays
+  # held and the task is NOT marked done, so the next run resumes rather than
+  # re-opening finished work. Rule 1 has no exception for halts.
+  bash "$(dirname "$0")/do-close.sh" "$SLUG" --status timeout || true
   exit 1
 fi
 
@@ -1340,11 +1426,13 @@ _merge_digest
 # not per cycle (a plan's cycles all serve the same origin task). Asserted:
 # a failed link is logged with its exit, never disguised as ok; the plan
 # still completed its code.
-_link_rc=0
-bash "$(dirname "$0")/do-signal.sh" --task-link "$SLUG" "docs=${SLUG}" >/dev/null || _link_rc=$?
-if [ "$_link_rc" -ne 0 ]; then
-  echo "board-write: link FAILED (exit ${_link_rc})" >&2
-fi
+#
+# do-close.sh is the whole close, not just the link: the board write (through
+# this same slug door), the receipt check that gates it, the rubric dims, the
+# feedback pheromone and the promise settle — bounded, in ~5s, and whatever it
+# cannot close it FILES with the command that finishes it. It exits 0 by design
+# even with open legs; a close that can fail a plan is a close plans skip.
+bash "$(dirname "$0")/do-close.sh" "$SLUG" --composite "${_composite:-}" || true
 echo ""
 echo "[do-auto] ✓ plan complete on branch $BR — trunk ($BASE) untouched."
 echo "[do-auto]   read:    .do-digest.md                 # what landed + gate verdict (reasoning was discarded)"