@oneie/claude 0.8.0 → 0.9.0

package/scripts/preview-fd-check.sh

@@ -0,0 +1,289 @@
+#!/usr/bin/env bash
+# preview-fd-check.sh — is the preview tax a PIPE that outlives the script?
+#
+# manifest: needs-env
+#   Mode A (default) is self-contained: a scratch sandbox, one node mimic, no
+#   ports, no worktree, no astro, no credential. Mode B (--real) drives
+#   worktree-preview.sh against one.ie/web and costs a worktree and a port.
+#
+# NOT A FIX. A MEASUREMENT THAT IS ALLOWED TO COME BACK NEGATIVE.
+#
+# THE OBSERVATION. The chairman measured ~7 min of Opus per UI task blocked in
+#   worktree-preview.sh up <slug> --route / | tail -30
+# with the server green in under a minute and the shell parked in __wait4 at
+# 8m42s. Two mechanisms fit that sample and only one of them is fixable at the
+# launch line:
+#
+#   H1  THE PIPE OUTLIVES THE SCRIPT. cmd_up prints GREEN and returns, but the
+#       reader never sees EOF because a descendant of the launch still holds the
+#       script's stdout. The tool call is waiting on `tail`, not on the server.
+#   H2  THE SCRIPT REALLY IS STILL RUNNING. BOOT_LOCK_WAIT 240 + BOOT_TIMEOUT 60
+#       + WARM_TIMEOUT 180 = 480s against an observed 522s. A `sleep 1` poll loop
+#       samples as __wait4 exactly like waiting on a pipe.
+#
+# Mode A can only support or refute H1. It CANNOT exclude H2 — only --real can,
+# by asking whether the driver process is already gone at the moment the server
+# answers 200. So a green Mode A is not licence to touch worktree-preview.sh.
+#
+# THE LAUNCH THIS REPRODUCES, quoted from worktree-preview.sh (the perl branch;
+# the nohup branch is its twin):
+#   ( cd "$app" && perl -e 'setsid; exec @ARGV' -- sh -c "exec $astro dev ..." >>"$log" 2>&1 & echo $! > "$state/pid" )
+#
+# VARIANTS, each timed from the DRIVER'S OWN EXIT to the reader's EOF:
+#   V1 driver | cat                      the shape the operator runs
+#   V2 driver > file                     no pipe at all
+#   V3 driver | cat, launch gets </dev/null    is stdin the holder?
+#   V4 driver | cat, subshell does `exec >>log 2>&1 </dev/null` BEFORE the fork
+#
+# VERDICT DISCIPLINE. REPRODUCED requires ALL THREE:
+#   V1 hold >= 60% of the mimic's lifetime  AND  V2 hold <= 2s  AND  a NAMED
+#   process holding the same pipe as the reader's fd 0.
+# A timing alone is a correlation. Anything short of all three prints
+# NOT REPRODUCED with every number and exits 3, and no line of
+# worktree-preview.sh is touched.
+#
+# WHAT MODE A FOUND, 2026-09-06 (hold 12s):
+#   V1(pipe)=12.2s  V2(file)=0.0s  V3(stdin</dev/null)=12.2s  V4(exec-before-fork)=0.0s
+#   holder = <pid> bash / fd 1 / the exact peer of the reader's fd 0.
+# The holder is a BASH SUBSHELL, not node. `cmd >>log 2>&1 &` backgrounds the
+# whole `cd "$app" && perl …` AND-LIST: bash forks a subshell to run it, and the
+# `>>"$log" 2>&1` binds to the `perl` simple command INSIDE it. So the subshell
+# keeps the caller's stdout on its own fd 1 for as long as the server lives, and
+# `$!` — the pid worktree-preview.sh stores and polls — IS that subshell.
+# V3 shows stdin is not the holder; V4 shows giving the subshell its own stdio
+# before the fork closes it. That is H1, named.
+#
+# H2 IS STILL LIVE for the 522s the chairman observed (BOOT_LOCK_WAIT 240 +
+# BOOT_TIMEOUT 60 + WARM_TIMEOUT 180 = 480s), and Mode A cannot separate them.
+# NOTHING IN worktree-preview.sh HAS BEEN CHANGED on the strength of this run.
+#
+# USAGE  preview-fd-check.sh [--sandbox] [--hold N]     Mode A, default
+#        preview-fd-check.sh --real <slug>              Mode B, opt-in
+#        preview-fd-check.sh --self-test                the harness's own guards
+# EXITS  0 REPRODUCED · 3 NOT REPRODUCED · 4 bad arguments / missing tool /
+#        UNMEASURED (a variant produced no timing — never reported as a verdict)
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+HOLD="${PREVIEW_FD_HOLD:-12}"
+MODE=sandbox
+SLUG=""
+
+now() { perl -MTime::HiRes=time -e 'printf "%.3f\n", time'; }
+el()  { perl -e 'printf "%.1f\n", $ARGV[1] - $ARGV[0]' "$1" "$2"; }
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --sandbox) MODE=sandbox; shift ;;
+    --real)    MODE=real; SLUG="${2:-}"; shift 2 ;;
+    --hold)    HOLD="${2:-12}"; shift 2 ;;
+    --self-test) MODE=selftest; shift ;;
+    -h|--help) sed -n '2,50p' "${BASH_SOURCE[0]}"; exit 0 ;;
+    *) echo "preview-fd-check: unknown argument: $1" >&2; exit 4 ;;
+  esac
+done
+
+command -v perl >/dev/null 2>&1 || { echo "preview-fd-check: perl not found — it is both the timer and the launch shape" >&2; exit 4; }
+command -v node >/dev/null 2>&1 || { echo "preview-fd-check: node not found — the mimic is a node process on purpose" >&2; exit 4; }
+
+SB="${TMPDIR:-/tmp}/preview-fd-$$"
+mkdir -p "$SB"
+cleanup() {
+  local p
+  for p in "$SB"/*/pid; do [ -f "$p" ] || continue; kill -- -"$(cat "$p")" 2>/dev/null || kill "$(cat "$p")" 2>/dev/null; done
+  rm -rf "$SB"
+}
+trap cleanup EXIT INT TERM
+
+# The astro-mimic: a node process that (a) runs a worker thread, (b) spawns a
+# grandchild with inherited stdio, (c) holds the event loop. Those are the three
+# things astro dev's process tree does that a bare `sleep` child does not — and
+# a bare `sleep` child is exactly the harness that already failed to reproduce.
+cat > "$SB/mimic.js" <<'MIMIC'
+const { Worker } = require('worker_threads')
+const { spawn } = require('child_process')
+const secs = Number(process.argv[2] || 12)
+const ms = secs * 1000
+new Worker(`setTimeout(() => {}, ${ms})`, { eval: true })
+spawn('sh', ['-c', `sleep ${secs}`], { stdio: 'inherit' })
+console.log('mimic up')
+setTimeout(() => process.exit(0), ms)
+MIMIC
+
+# The driver: worktree-preview.sh's cmd_up, reduced to its launch and its GREEN
+# line. $1 = variant, $2 = state dir, $3 = hold seconds.
+cat > "$SB/driver.sh" <<'DRIVER'
+#!/usr/bin/env bash
+set -uo pipefail
+variant="$1"; state="$2"; hold="$3"
+log="$state/mimic.log"; : > "$log"
+mimic="$state/../mimic.js"
+case "$variant" in
+  plain)
+    ( cd "$state" && perl -e 'setsid; exec @ARGV' -- sh -c "exec node $mimic $hold" >>"$log" 2>&1 & echo $! > "$state/pid" ) ;;
+  stdin)
+    ( cd "$state" && perl -e 'setsid; exec @ARGV' -- sh -c "exec node $mimic $hold" >>"$log" 2>&1 </dev/null & echo $! > "$state/pid" ) ;;
+  execfd)
+    ( cd "$state" && exec >>"$log" 2>&1 </dev/null; perl -e 'setsid; exec @ARGV' -- sh -c "exec node $mimic $hold" & echo $! > "$state/pid" ) ;;
+  *) echo "driver: unknown variant $variant" >&2; exit 4 ;;
+esac
+perl -MTime::HiRes=time -e 'printf "%.3f\n", time' > "$state/driver_exit"
+echo "GREEN mimic up (driver returning, exactly as cmd_up does)"
+DRIVER
+chmod +x "$SB/driver.sh"
+
+# One variant, measured. $1 = name, $2 = driver variant, $3 = pipe|file
+run_variant() {
+  # NOT one `local` line: bash expands every word of the builtin BEFORE any of
+  # the assignments take effect, so `st="$SB/$name"` reads an unset `name` and
+  # dies under `set -u`. Measured here 2026-09-06 — it produced four empty
+  # timings that the verdict then reported as a confident NOT REPRODUCED.
+  local name="$1" variant="$2" sink="$3" t0 t_eof t_drv
+  local st="$SB/$name"
+  mkdir -p "$st"
+  t0="$(now)"
+  if [ "$sink" = pipe ]; then
+    ( bash "$SB/driver.sh" "$variant" "$st" "$HOLD" | cat > "$st/out.txt"
+      perl -MTime::HiRes=time -e 'printf "%.3f\n", time' > "$st/eof" ) &
+  else
+    ( bash "$SB/driver.sh" "$variant" "$st" "$HOLD" > "$st/out.txt"
+      perl -MTime::HiRes=time -e 'printf "%.3f\n", time' > "$st/eof" ) &
+  fi
+  local job=$!
+  # While the reader may still be blocked, name the holder. A timing without a
+  # named process is a correlation, and the verdict refuses it.
+  if [ "$sink" = pipe ] && [ "$name" = V1 ]; then sleep 3; name_holder "$st"; fi
+  wait "$job" 2>/dev/null
+  t_eof="$(cat "$st/eof" 2>/dev/null)"; t_drv="$(cat "$st/driver_exit" 2>/dev/null)"
+  if [ -z "$t_eof" ] || [ -z "$t_drv" ]; then echo "unmeasured"; return; fi
+  el "$t_drv" "$t_eof"
+}
+
+# Does any process in the launched tree hold the SAME pipe the reader is blocked
+# on? macOS lsof prints a pipe as `PIPE 0x<dev> ... ->0x<peer>`; the reader's fd
+# 0 and a writer's fd share those addresses.
+HOLDER="none"
+name_holder() {
+  local st="$1" mpid rp toks t
+  mpid="$(cat "$st/pid" 2>/dev/null)"
+  command -v lsof >/dev/null 2>&1 || { HOLDER="lsof-missing"; return; }
+  # The reader is the `cat` whose fd 1 is out.txt; find its pipe tokens on fd 0.
+  rp="$(lsof -n -t -- "$st/out.txt" 2>/dev/null | head -1)"
+  [ -n "$rp" ] || { HOLDER="reader-not-found"; return; }
+  toks="$(lsof -n -p "$rp" 2>/dev/null | awk '$5 == "PIPE" {print $6; if ($NF ~ /^->0x/) print substr($NF,3)}' | sort -u)"
+  [ -n "$toks" ] || { HOLDER="reader-holds-no-pipe"; return; }
+  local cand="" line
+  # Every descendant of the launched pid, plus the pid itself.
+  local pids; pids="$(ps -A -o pid=,ppid=,comm= 2>/dev/null)"
+  local tree; tree="$(printf '%s\n' "$mpid"; printf '%s\n' "$pids" | awk -v m="$mpid" '$2 == m {print $1}')"
+  for t in $tree; do
+    [ -n "$t" ] || continue
+    line="$(lsof -n -p "$t" 2>/dev/null | awk '$5 == "PIPE" {print $6; if ($NF ~ /^->0x/) print substr($NF,3)}' | sort -u)"
+    [ -n "$line" ] || continue
+    local shared; shared="$(comm -12 <(printf '%s\n' "$toks") <(printf '%s\n' "$line") 2>/dev/null | head -1)"
+    if [ -n "$shared" ]; then
+      # Name the process AND the pipe, with the fd it holds it on. A pid alone
+      # is a coincidence; a pid whose fd 1 is the peer of the reader's fd 0 is
+      # the mechanism.
+      local fd; fd="$(lsof -n -p "$t" 2>/dev/null | awk -v s="$shared" '$5 == "PIPE" && ($6 == s || substr($NF,3) == s) {print $4; exit}')"
+      cand="$(ps -o pid=,comm= -p "$t" 2>/dev/null | tr -s ' ' | sed 's/^ *//;s/ *$//')/fd${fd:-?}/pipe${shared}"
+      break
+    fi
+  done
+  HOLDER="${cand:-no-shared-pipe-in-launch-tree}"
+  # run_variant is called in a command substitution, so this assignment lives in
+  # a subshell and would evaporate. The answer travels by file, or the verdict
+  # would silently read `none` and refuse a real reproduction.
+  printf '%s' "$HOLDER" > "$SB/holder"
+}
+
+self_test() {
+  local fails=0 rc
+  printf '== preview-fd-check --self-test\n'
+  # The harness must refuse to call a hang a reproduction without a named holder.
+  if ( HOLDER="no-shared-pipe-in-launch-tree"; verdict 30 0 30 0 >/dev/null 2>&1 ); then
+    printf '  FAIL %-52s\n' 'a hang with NO named holder read as REPRODUCED' >&2; fails=$((fails+1))
+  else
+    printf '  ok   %-52s\n' 'no named holder => NOT REPRODUCED, whatever the timings'
+  fi
+  if ( HOLDER="1234 node"; verdict 0 0 0 0 >/dev/null 2>&1 ); then
+    printf '  FAIL %-52s\n' 'zero hold everywhere read as REPRODUCED' >&2; fails=$((fails+1))
+  else
+    printf '  ok   %-52s\n' 'no hold => NOT REPRODUCED even with a holder'
+  fi
+  if ( HOLDER="1234 node"; verdict "$HOLD" 0 "$HOLD" 0 >/dev/null 2>&1 ); then
+    printf '  ok   %-52s\n' 'all three conditions => REPRODUCED'
+  else
+    printf '  FAIL %-52s\n' 'the green half is unreachable' >&2; fails=$((fails+1))
+  fi
+  if ( HOLDER="1234 node"; verdict "$HOLD" "$HOLD" "$HOLD" "$HOLD" >/dev/null 2>&1 ); then
+    printf '  FAIL %-52s\n' 'V2 hanging too (so: not the pipe) read as REPRODUCED' >&2; fails=$((fails+1))
+  else
+    printf '  ok   %-52s\n' 'V2 hanging too => NOT REPRODUCED (not a pipe effect)'
+  fi
+  # THE HOUSE BUG, in this harness's own shape: an empty timing must not read as
+  # a benign "not reproduced". Driven for real — this exact defect shipped in the
+  # first draft and was caught by running it.
+  ( HOLDER="1234 node"; verdict "" 0 0 0 >/dev/null 2>&1 ); rc=$?
+  if [ "$rc" = 4 ]; then printf '  ok   %-52s exit 4\n' 'an unmeasured variant is UNMEASURED, not a verdict'
+  else printf '  FAIL %-52s exit %s\n' 'an empty timing produced a verdict' "$rc" >&2; fails=$((fails+1)); fi
+  ( HOLDER="1234 node"; verdict "$HOLD" unmeasured 0 0 >/dev/null 2>&1 ); rc=$?
+  if [ "$rc" = 4 ]; then printf '  ok   %-52s exit 4\n' 'a word where a number belongs is UNMEASURED'
+  else printf '  FAIL %-52s exit %s\n' 'a non-numeric timing produced a verdict' "$rc" >&2; fails=$((fails+1)); fi
+
+  [ "$fails" -eq 0 ] && { printf 'preview-fd-check --self-test: PASS (6 checks)\n'; return 0; }
+  printf 'preview-fd-check --self-test: RED — %s failed\n' "$fails" >&2; return 1
+}
+
+# verdict <v1> <v2> <v3> <v4> — the three conditions, judged together.
+verdict() {
+  local v1="$1" v2="$2" v3="$3" v4="$4" floor
+  floor="$(perl -e 'printf "%.1f", $ARGV[0] * 0.6' "$HOLD")"
+  printf 'PREVIEW-FD hold=%ss floor=%ss  V1(pipe)=%ss  V2(file)=%ss  V3(stdin</dev/null)=%ss  V4(exec-before-fork)=%ss  holder=%s\n' \
+    "$HOLD" "$floor" "$v1" "$v2" "$v3" "$v4" "$HOLDER"
+  local n
+  for n in "$v1" "$v2" "$v3" "$v4"; do
+    case "$n" in
+      ''|*[!0-9.]*)
+        printf 'PREVIEW-FD: UNMEASURED — a variant produced no timing (%s). This is NOT "not reproduced";\n' "$n"
+        printf '  the harness failed to measure and says so. worktree-preview.sh unchanged.\n'
+        return 4 ;;
+    esac
+  done
+  local ok1 ok2 ok3
+  ok1="$(perl -e 'print(($ARGV[0] =~ /^[0-9.]+$/ && $ARGV[0] >= $ARGV[1]) ? 1 : 0)' "$v1" "$floor")"
+  ok2="$(perl -e 'print(($ARGV[0] =~ /^[0-9.]+$/ && $ARGV[0] <= 2.0) ? 1 : 0)' "$v2")"
+  case "$HOLDER" in none|lsof-missing|reader-not-found|reader-holds-no-pipe|no-shared-pipe-in-launch-tree|'') ok3=0 ;; *) ok3=1 ;; esac
+  if [ "$ok1" = 1 ] && [ "$ok2" = 1 ] && [ "$ok3" = 1 ]; then
+    printf 'PREVIEW-FD: REPRODUCED (H1 candidate) — a named process in the launch tree holds the reader'"'"'s pipe.\n'
+    printf 'PREVIEW-FD: H2 IS NOT EXCLUDED — Mode A cannot separate them. --real is unrun.\n'
+    return 0
+  fi
+  printf 'PREVIEW-FD: NOT REPRODUCED — '
+  [ "$ok1" = 1 ] || printf 'V1 did not hold past the floor. '
+  [ "$ok2" = 1 ] || printf 'V2 held too (so the pipe is not the discriminator). '
+  [ "$ok3" = 1 ] || printf 'no named fd holder (%s). ' "$HOLDER"
+  printf 'worktree-preview.sh unchanged.\n'
+  return 3
+}
+
+case "$MODE" in
+  selftest) self_test; exit $? ;;
+  real)
+    [ -n "$SLUG" ] || { echo "preview-fd-check: --real needs a slug" >&2; exit 4; }
+    echo "preview-fd-check: --real is opt-in and UNRUN here — it costs a worktree, a port and ~2.3GB," >&2
+    echo "  it takes no boot lock, and this box is memory-bound. Run it alone, never in a fleet:" >&2
+    echo "  PREVIEW_FD_REAL_YES=1 bash .claude/scripts/preview-fd-check.sh --real $SLUG" >&2
+    [ "${PREVIEW_FD_REAL_YES:-0}" = 1 ] || exit 4
+    echo "preview-fd-check: --real not implemented in this cycle; Mode A is the deliverable." >&2
+    exit 4 ;;
+esac
+
+printf '== preview-fd-check --sandbox (mimic lifetime %ss)\n' "$HOLD"
+V1="$(run_variant V1 plain  pipe)"
+HOLDER="$(cat "$SB/holder" 2>/dev/null)"; HOLDER="${HOLDER:-none}"
+V2="$(run_variant V2 plain  file)"
+V3="$(run_variant V3 stdin  pipe)"
+V4="$(run_variant V4 execfd pipe)"
+verdict "$V1" "$V2" "$V3" "$V4"
+exit $?

package/scripts/signal-watch.sh

@@ -17,8 +17,31 @@
 # hooks and do-signal.sh post to, plus the stream the listeners sit on:
 #
 #   health            GET  /api/health                       the worker answers
-#   world:announce    POST a canary tagged [cc,factory,canary] — intake's door.
-#                     Matches nobody by design; what is measured is the wire.
+#   world:announce    POST a canary tagged [signal-watch-wire] on the
+#                     MARKETPLACE board — intake's door.
+#                     The wire, and only the wire: zero subscribers matched, so
+#                     the number is the door's own cost with no fan-out in it.
+#                     It used to be sent on the caller's own board and the header
+#                     claimed it "matches nobody by design" — it matched `ceo`,
+#                     which subscribes to EVERY tag by canon (root CLAUDE.md: the
+#                     CEO is the default receiver, always listening). Measured
+#                     2026-09-08 on prod server-timing, same door, one variable:
+#                     matched=0 -> data 259/332/401 ms; matched=1 -> data
+#                     1535..2066 ms. So ~1.3s per matched subscriber was being
+#                     read as "the wire". The probe now ASSERTS matched=0 and
+#                     goes UNRUN if it ever matches — a wire probe that fanned
+#                     out did not measure the wire, and an unrun door is not a
+#                     pass. The fan-out's own cost is a separate finding
+#                     (text/announce-fanout-plan.md), not a budget to widen.
+#                     BOTH halves are load-bearing and both were measured
+#                     wrong before: the BOARD (own board -> `ceo`, who
+#                     follows every tag) and the TAG (`cc` on the marketplace
+#                     board -> the live `cc-proof-listener`, found 2026-09-08
+#                     by this very assertion on its first run). Hence a
+#                     RESERVED tag nobody stakes, on the shared board. If
+#                     someone ever stakes `signal-watch-wire`, the row goes
+#                     unrun and says so, rather than quietly reporting a
+#                     fan-out as the wire.
 #   tasks:everywhere  POST {workspace:factory-do}             the board read
 #   factory:size      POST {paths:[this file]}                the size hop
 #   stream            GET  channels.one.ie/stream/space:vespio  time to first byte
@@ -80,9 +103,14 @@ _row() { # lane door verdict wall budget placement phases note
   case "$3" in pass) PASS=$((PASS+1));; fail) FAIL=$((FAIL+1));; n/a) NA=$((NA+1));; unrun) UNRUN=$((UNRUN+1));; esac
 }
 
-# door <lane> <name> <method> <url> <payload|-> <budget_ms> <key|->
+# door <lane> <name> <method> <url> <payload|-> <budget_ms> <key|-> [expect|-]
+# `expect` is a fixed string the RESPONSE BODY must contain for the number to
+# mean what the door claims to measure. Absent it, a door can keep answering 200
+# fast while measuring something else entirely — which is exactly how the
+# announce canary reported "the wire" while paying a full fan-out. A miss is
+# UNRUN, never fail and never pass: the door ran, but not the door we named.
 door() {
-  local lane="$1" name="$2" method="$3" url="$4" payload="$5" budget key="$7" hdr body out code wall placement phases verdict note=""
+  local lane="$1" name="$2" method="$3" url="$4" payload="$5" budget key="$7" expect="${8:--}" hdr body out code wall placement phases verdict note=""
   budget=$(_budget "$6")
   hdr=$(mktemp); body=$(mktemp)
   if [ "$method" = POST ] && [ "$key" = "-" ]; then
@@ -104,6 +132,7 @@ door() {
   elif [ "$code" != "200" ]; then verdict=fail; note="http $code $(head -c 80 "$body" | tr -d '\n')"
   elif [ "$method" = POST ] && ! grep -q '"outcome":"result"' "$body"; then verdict=fail; note="refused: $(head -c 100 "$body" | tr -d '\n')"
   elif [ "$method" = POST ] && grep -q '"ok":false' "$body"; then verdict=unrun; note="refused before the work: $(grep -oE '"error":"[^"]{0,80}' "$body" | head -1 | cut -d'"' -f4)"
+  elif [ "$expect" != "-" ] && ! grep -qF "$expect" "$body"; then verdict=unrun; note="not the door we named: body lacks $expect — $(head -c 60 "$body" | tr -d '\n')"
   elif [ "$wall" -gt "$budget" ]; then verdict=fail; note="over budget by $((wall-budget)) ms"
   else verdict=pass; fi
   _row "$lane" "$name" "$verdict" "$wall" "$budget" "${placement:-}" "${phases:-}" "$note"
@@ -131,7 +160,12 @@ listeners() {
 
 lane() { # prod|local
   local l="$1" base key
-  if [ "$l" = prod ]; then base="$PROD_URL"; key=$(_key "$ROOT/one.ie/web/.env")
+  # The prod credential file honours ONE_ENV_FILE / DO_ENV_FILE, like every other
+  # credential read in the harness (factory-repo.sh --check-env-indirection).
+  # A relative path is taken from $ROOT; the shell's GATEWAY_API_KEY still wins.
+  local env_file="${ONE_ENV_FILE:-${DO_ENV_FILE:-one.ie/web/.env}}"
+  case "$env_file" in /*) ;; *) env_file="$ROOT/$env_file" ;; esac
+  if [ "$l" = prod ]; then base="$PROD_URL"; key=$(_key "$env_file")
   else
     base="$LOCAL_URL"; key=$(_key "$ROOT/one.ie/web/.dev.vars")
     if ! curl -s -o /dev/null --max-time 3 "$base/api/health"; then
@@ -143,10 +177,27 @@ lane() { # prod|local
   # watched (2026-09-05 — announce 1.3-1.8s, board/size 0.8-1.5s), lowered only
   # after a measured improvement ships. Never raised to make a red row green.
   # announce: 2000 → 800 after the parallel-read ship (2026-09-05, measured 149-379 ms).
+  # UNCHANGED 2026-09-08 on purpose. The door it describes is now the WIRE door
+  # (board=marketplace, matched=0), whose data phase measures 259-401 ms — the
+  # same range 800 was set against. The wall it is compared to also carries the
+  # CLIENT's egress, which is not the worker's: `health` does det=0 ms of server
+  # work and has walked 134 → 72 → 437 → 463 ms across the ledger purely on where
+  # the laptop was sitting. So a marginal announce/health miss can be this box's
+  # network, not the door. Whether these budgets should be worker-phase budgets
+  # rather than wall budgets is a RECALIBRATION — a human decision, deliberately
+  # not taken here. A budget moved to fit an observation stops meaning anything.
   local b1 b2 b3; if [ "$l" = prod ]; then b1=400; b2=1500; b3=800; else b1=150; b2=300; b3=300; fi
   door "$l" health GET "$base/api/health" - "$b1" -
+  # SIGNAL_WATCH_WIRE_OWN_BOARD=1 exists for --self-test case 4 ONLY: DROPPING
+  # the board key sends the canary to the caller's own board, where `ceo` matches
+  # every tag by canon — the durable red half of the assertion below. (Setting
+  # `board` to an arbitrary slug does NOT work: the receiver's Zod schema rejects
+  # it with a 400, which is a different failure and proves nothing.) Never set
+  # this in a real run.
+  local wire_board='"board":"marketplace",'
+  if [ "${SIGNAL_WATCH_WIRE_OWN_BOARD:-0}" = 1 ]; then wire_board=''; fi
   door "$l" world:announce POST "$base/api/ask/world:announce" \
-    "{\"data\":{\"tags\":[\"cc\",\"factory\",\"canary\"],\"type\":\"signal:canary\",\"text\":\"signal-watch $(date -u +%H:%M:%SZ)\",\"priority\":\"fyi\",\"slug\":\"one\"}}" "$b3" "$key"
+    "{\"data\":{\"tags\":[\"signal-watch-wire\"],${wire_board}\"type\":\"signal:canary\",\"text\":\"signal-watch $(date -u +%H:%M:%SZ)\",\"priority\":\"fyi\",\"slug\":\"one\"}}" "$b3" "$key" '"matched":0'
   door "$l" tasks:everywhere POST "$base/api/ask/tasks:everywhere" '{"data":{"workspace":"factory-do","limit":200}}' "$b2" "$key"
   door "$l" factory:size POST "$base/api/ask/factory:size" '{"data":{"paths":[".claude/scripts/signal-watch.sh"]}}' "$b2" "$key"
 }
@@ -174,6 +225,12 @@ if [ "${SELF_TEST:-0}" = 1 ]; then
   out=$(GATEWAY_API_KEY= SIGNAL_WATCH_BUDGET_SCALE=100 bash "$tmp/.claude/scripts/signal-watch.sh" --prod --no-ledger 2>&1); rc=$?
   [ "$rc" -eq 3 ] && grep -q "unrun" <<<"$out" && echo "  ok   exit 3, unrun rows" || { echo "  FAIL rc=$rc"; echo "$out" | tail -4; fails=$((fails+1)); }
   rm -rf "$tmp"
+  echo "== 4. a wire probe that MATCHED somebody is unrun (exit 3), not a fast pass"
+  # Red half: point the canary back at the caller's own board, where `ceo`
+  # subscribes to every tag. The door still answers 200 with outcome=result —
+  # only the assertion catches it.
+  out=$(SIGNAL_WATCH_WIRE_OWN_BOARD=1 SIGNAL_WATCH_BUDGET_SCALE=100 bash "$0" --prod --no-ledger 2>&1); rc=$?
+  [ "$rc" -eq 3 ] && grep -q 'not the door we named' <<<"$out" && echo "  ok   exit 3, fan-out named as not-the-wire" || { echo "  FAIL rc=$rc"; echo "$out" | tail -4; fails=$((fails+1)); }
   echo "signal-watch --self-test: $fails failed"
   exit "$fails"
 fi

package/scripts/speed-cache-check.sh

@@ -28,6 +28,16 @@
 
 set -euo pipefail
 
+# _GATE — see governor-doors-check.sh "compute sites". A gate_lock dedupes
+# identical work; only a SLOT bounds N worktrees running N computes at once.
+# Empty inside an existing gate so the outer slot is inherited, never doubled.
+_GATE=()
+if [ "${GOVERN_IN_GATE:-0}" != "1" ]; then
+  _GR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/gate-run.sh"
+  [ -f "$_GR" ] && _GATE=( bash "$_GR" "compute:$(basename "${BASH_SOURCE[0]}")" -- )
+fi
+
+
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 WEB="$ROOT/one.ie/web"
 REL_MEMO="one.ie/web/src/lib/domain-memo.ts"
@@ -120,7 +130,7 @@ fi
 echo "[speed-cache-check] RED run — $RED_SOURCE_DESC"
 cd "$WEB"
 set +e
-RED_OUT="$(bunx vitest run "$TEST_FILE" -t "$COLD_TEST_NAME" 2>&1)"
+RED_OUT="$("${_GATE[@]}" bunx vitest run "$TEST_FILE" -t "$COLD_TEST_NAME" 2>&1)"
 RED_STATUS=$?
 set -e
 cd "$ROOT"
@@ -147,7 +157,7 @@ TMP_BROKEN=""
 echo "[speed-cache-check] GREEN run — working tree $REL_MEMO"
 cd "$WEB"
 set +e
-GREEN_OUT="$(bunx vitest run "$TEST_FILE" 2>&1)"
+GREEN_OUT="$("${_GATE[@]}" bunx vitest run "$TEST_FILE" 2>&1)"
 GREEN_STATUS=$?
 set -e
 cd "$ROOT"

package/scripts/test-cached.sh

@@ -185,6 +185,24 @@ if [ "${TEST_CACHE_KEY_ONLY:-0}" = "1" ]; then echo "$KEY"; exit 0; fi
 STAMP="$CACHE_DIR/$folder-${KEY}.pass"
 STAMP="${STAMP//\//_}"; STAMP="$CACHE_DIR/$(basename "$STAMP")"
 
+# TEST_CACHE_PROBE=1 answers "would this HIT?" and runs nothing: exit 0 on a
+# hit, 1 on a miss. It sits AFTER the STAMP lines above on purpose -- the
+# probe and the real check must resolve the same path or the probe is a
+# second, drifting definition of a hit. KEY_ONLY prints the key; PROBE
+# answers the question the caller actually has.
+#
+# WHY IT EXISTS. verify-fast.sh took a GOVERNOR SLOT and then asked whether
+# there was anything to run. Measured 2026-09-09 on a saturated box: 855s
+# and 1324s queued for slots whose work was a memo hit costing ~0. A cache
+# hit must never wait behind a real gate -- it needs no memory, no forks and
+# no slot. Probe first, take the slot only on a MISS.
+if [ "${TEST_CACHE_PROBE:-0}" = "1" ]; then
+  if [ "${TEST_CACHE_DISABLE:-0}" != "1" ] && [ -f "$STAMP" ]; then
+    echo "[test-cached] probe: HIT ${KEY:0:12}"; exit 0
+  fi
+  echo "[test-cached] probe: MISS ${KEY:0:12}"; exit 1
+fi
+
 mkdir -p "$CACHE_DIR" 2>/dev/null
 find "$CACHE_DIR" -name '*.pass' -mtime "+${MAX_AGE_DAYS}" -delete 2>/dev/null
 
@@ -197,17 +215,36 @@ fi
 # __probe__ is the self-test's fake folder: no vitest, deterministic outcome.
 if [ "$folder" = "__probe__" ]; then
   case " ${ARGS[*]} " in *--probe-fail*) st=1 ;; *) st=0 ;; esac
-elif [ "${TEST_CACHE_PTY:-0}" = "1" ]; then
-  # The deploy gate's vitest HANGS when stdout is not a TTY -- a fork is spawned
-  # and never given work (see .claude/commands/deploy.md "The vitest gate hangs").
-  # `script -qeF /dev/null` allocates a pty and flushes. The -e is load-bearing:
-  # it propagates the CHILD's exit status. Without it `script` exits 0 over a red
-  # suite and this cache would record a PASS for a failing run.
-  ( cd "$ROOT/$folder" && script -qeF /dev/null bunx vitest run "${ARGS[@]}" )
-  st=$?
 else
-  ( cd "$ROOT/$folder" && bunx vitest run "${ARGS[@]}" )
-  st=$?
+  # THE SLOT. This script takes no lock, so unlike tsc-cached.sh there is no
+  # ordering hazard -- adding a slot here is purely additive.
+  #
+  # verify-fast.sh already wraps ITS calls to this script in gate-run, and
+  # gate-run exports GOVERN_IN_GATE=1, so _gate below collapses to a plain `env`
+  # on that path: the outer slot is INHERITED, never doubled (a second slot held
+  # by one logical gate is what deadlocks the queue at cap 2).
+  #
+  # What this closes is the other caller: `bun run test` -> test-lanes.sh -> here
+  # reached vitest with no slot at all. Measured 2026-09-07 in one worktree at
+  # 256% CPU and ~800MB, with the governor reporting "1 of 2 slots held".
+  _gate=( env )
+  if [ "${TEST_CACHE_GATE:-1}" = "1" ] && [ "${GOVERN_IN_GATE:-0}" != "1" ] \
+     && [ -f "$ROOT/.claude/scripts/gate-run.sh" ]; then
+    _gate=( env "GOVERN_GATE_TIMEOUT=${TEST_CACHE_TIMEOUT:-1800}"
+            bash "$ROOT/.claude/scripts/gate-run.sh" "test-cache:$folder" -- )
+  fi
+  if [ "${TEST_CACHE_PTY:-0}" = "1" ]; then
+    # The deploy gate's vitest HANGS when stdout is not a TTY -- a fork is spawned
+    # and never given work (see .claude/commands/deploy.md "The vitest gate hangs").
+    # `script -qeF /dev/null` allocates a pty and flushes. The -e is load-bearing:
+    # it propagates the CHILD's exit status. Without it `script` exits 0 over a red
+    # suite and this cache would record a PASS for a failing run.
+    ( cd "$ROOT/$folder" && "${_gate[@]}" script -qeF /dev/null bunx vitest run "${ARGS[@]}" )
+    st=$?
+  else
+    ( cd "$ROOT/$folder" && "${_gate[@]}" bunx vitest run "${ARGS[@]}" )
+    st=$?
+  fi
 fi
 
 # ONLY a pass is recorded. A red gate must re-run until it is green.

package/scripts/test-lanes.sh

@@ -145,6 +145,20 @@ echo "───── pool lane (rc=$RC_A) ─────";   cat "$LOG_A"
 echo "───── typedb lane (rc=$RC_B) ─────"; cat "$LOG_B"
 rm -f "$LOG_A" "$LOG_B"
 
+# TYPEDB_LANE_NONBLOCKING: the typedb lane still runs (signal is preserved) but
+# its exit code is never a gate. Set in deploy.sh because the deploy must not
+# block on the shared TypeDB Cloud cluster — the request path goes through
+# Cloudflare (BrainDO / KV), TypeDB is writes + sync only (§ The brain and the edge).
+if [[ "${TYPEDB_LANE_NONBLOCKING:-0}" == "1" ]]; then
+  if [ "$RC_B" -ne 0 ]; then
+    echo "test-lanes: typedb lane FAILED (rc=$RC_B) — non-blocking, gate is pool lane only"
+  fi
+  if [ "$RC_A" -eq 0 ]; then
+    echo "test-lanes: pool lane green — PASS (typedb lane non-blocking)"; exit 0
+  fi
+  echo "test-lanes: FAILED (pool=$RC_A typedb=$RC_B, typedb non-blocking)"; exit 1
+fi
+
 # Both must pass. A lane that could not run is a failure, never a pass.
 if [ "$RC_A" -eq 0 ] && [ "$RC_B" -eq 0 ]; then
   echo "test-lanes: BOTH lanes green"; exit 0