@oneie/claude 0.8.0 → 0.9.0

package/scripts/triage-shape-check.sh

@@ -0,0 +1,149 @@
+#!/usr/bin/env bash
+# triage-shape-check.sh — prove the `shape` half of .claude/workflows/triage.js
+# writes a sane, non-destructive plan. Same idiom as do-tier.sh --self-test and
+# do-triage.sh --self-test: one command, exits non-zero on failure, and carries
+# a RED PROOF so a checker that stays green against gutted code is caught.
+#
+# manifest: monorepo-only
+#
+# WHY THIS EXISTS. The shape phase emits a LIST of board writes, and the list is
+# where the damage lives, not the words. Two of these invariants were broken in
+# the first version and neither would have failed a syntax check:
+#   · TWO tasks:notes writes. tasks:notes SETS the body, it does not append, so
+#     the second silently destroyed the first — and the survivor said
+#     "accept: see above" pointing at the line it had just deleted. Exactly the
+#     defect the board already carries one layer down (an absent notes key is a
+#     silent DELETE returning ok:true).
+#   · tasks:assign, which is not in the receiver registry and would dissolve as
+#     unknown_receiver.
+# Both are invisible to the eye and obvious to this file.
+#
+# Usage:  bash .claude/scripts/triage-shape-check.sh [--red]
+#         --red   gut the guard and assert this checker goes RED
+
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+WF="$ROOT/.claude/workflows/triage.js"
+SDK="$ROOT/packages/sdk/src/receivers.ts"
+RED=0
+[ "${1:-}" = "--red" ] && RED=1
+
+[ -f "$WF" ] || { echo "FAIL: no $WF"; exit 2; }
+
+run_cases() { # <workflow file>
+  node - "$1" "$SDK" <<'NODE'
+// eval() IS DELIBERATE AND BOUNDED HERE, and JSON.parse cannot replace it: the
+// tables it lifts contain REGEX LITERALS (ROUTES) and unquoted keys (SPLIT),
+// neither of which is JSON. The input is not untrusted — it is a tracked file
+// in this repo, read by path, and the whole point of the checker is to test the
+// SHIPPING definitions rather than a copy that can drift. A copy is the failure
+// mode this file exists to prevent: two definitions of one rule is how the
+// routing table and its fixtures disagree silently. Never point this at a path
+// a caller supplies.
+const fs = require('fs')
+const src = fs.readFileSync(process.argv[2], 'utf8')
+const sdk = fs.existsSync(process.argv[3]) ? fs.readFileSync(process.argv[3], 'utf8') : ''
+const grab = (re) => { const m = src.match(re); if (!m) { console.log('FAIL: could not find ' + re); process.exit(3) } return m[0] }
+const ROUTES = eval('(' + grab(/const ROUTES = \[[\s\S]*?\n\]/).replace('const ROUTES = ', '') + ')')
+const SPLIT  = eval('(' + grab(/const SPLIT = \{[\s\S]*?\n\}/).replace('const SPLIT = ', '') + ')')
+eval(grab(/function routeFor[\s\S]*?\n\}/))
+eval(grab(/function plannedWrites[\s\S]*?\n  return writes\n\}/))
+
+let bad = 0
+const fail = (m) => { console.log('  FAIL  ' + m); bad++ }
+const ok   = (m) => console.log('  ok    ' + m)
+
+// ── 1. routing: what a file IS beats what it is ABOUT ───────────────────────
+// The first draft put the money nouns first and sent a wallet COMPONENT and a
+// wallet TEST to security-auditor. These fixtures are that bug, frozen.
+for (const [p, want] of [
+  ['one.ie/web/src/components/wallet/AllWallets.tsx', 'implementer'],
+  ['one.ie/web/tests/unit/wallet/x.test.ts', 'test-engineer'],
+  ['one.ie/web/src/lib/auth/passkey-webauthn.ts', 'security-auditor'],
+  ['pay/backend/src/signing-key.ts', 'security-auditor'],
+  ['schema/one.tql', 'architect'],
+  ['one.ie/web/src/lib/resolvers/tasks.ts', 'architect'],
+  ['text/story.md', 'tech-writer'],
+  ['one.ie/web/wrangler.toml', 'release-manager'],
+  ['one.ie/web/src/pages/about.astro', 'implementer'],
+  ['somewhere/random.go', 'cto'],
+]) {
+  const got = routeFor([p])
+  got === want ? ok(`route ${want.padEnd(17)}${p}`) : fail(`route ${p} → ${got}, want ${want}`)
+}
+
+// ── 2. the write plan ───────────────────────────────────────────────────────
+const C = {
+  FIX: { title: 'send button does nothing', triage: { verdict: 'sizeable', paths: ['one.ie/web/src/components/wallet/AllWallets.tsx'] }, size: { tier: 'FIX' },
+    shape: { want: 'Stop the Send button pretending it moved money', why: 'It emits telemetry and signs nothing.', subtasks: ['a', 'b', 'c'], chain: true, assignee: 'implementer' } },
+  UNSIZED: { title: 'make chat nicer', triage: { verdict: 'idea', paths: [] }, size: { tier: 'UNSIZED' }, shape: null },
+  PATCH: { title: 'typo', triage: { verdict: 'sizeable', paths: ['text/readme.md'] }, size: { tier: 'PATCH' },
+    shape: { want: 'Fix the misspelled word', why: '', subtasks: [], chain: false, assignee: 'tech-writer' } },
+}
+const plans = Object.fromEntries(Object.entries(C).map(([k, t]) => [k, plannedWrites(t)]))
+
+for (const [k, w] of Object.entries(plans)) {
+  const ops = w.map((x) => x.op)
+  // EXACTLY ONE notes write. Two means the second clobbers the first.
+  const notes = w.filter((x) => x.op === 'tasks:notes')
+  notes.length <= 1 ? ok(`${k}: one notes write`) : fail(`${k}: ${notes.length} notes writes — the later SETS over the earlier`)
+  if (notes[0] && /accept:\s*see above/i.test(notes[0].text)) fail(`${k}: notes back-reference a line this plan deletes`)
+  // The capture lands FIRST, before anything can overwrite the title.
+  ops[0] === 'tasks:comment' ? ok(`${k}: capture first`) : fail(`${k}: first write is ${ops[0]}, not tasks:comment`)
+  // Every emitted receiver must exist.
+  if (sdk) for (const op of new Set(ops)) {
+    if (!sdk.includes('"' + op + '"')) fail(`${k}: ${op} is not in the receiver registry — would dissolve as unknown_receiver`)
+  }
+}
+// UNSIZED is shaped by nobody.
+{
+  const ops = plans.UNSIZED.map((x) => x.op)
+  ops.some((o) => ['tasks:rename', 'tasks:reassign', 'tasks:subtask'].includes(o))
+    ? fail('UNSIZED row was renamed/assigned/split — absence of recon must not read as simplicity')
+    : ok('UNSIZED: no title, no owner, no children')
+}
+// PATCH is one piece.
+plans.PATCH.some((x) => x.op === 'tasks:subtask') ? fail('PATCH got children') : ok('PATCH: no children')
+// The chain leaves exactly one sibling ready.
+{
+  const subs = plans.FIX.filter((x) => x.op === 'tasks:subtask')
+  subs.length === 3 ? ok('FIX: 3 children') : fail(`FIX: ${subs.length} children, want 3`)
+  subs[0] && subs[0].blockedBy ? fail('first sibling is blocked — nothing would be ready') : ok('FIX: first sibling ready')
+  subs.slice(1).every((s) => s.blockedBy) ? ok('FIX: later siblings chained') : fail('FIX: a later sibling is unchained — siblings race')
+}
+process.exit(bad ? 1 : 0)
+NODE
+}
+
+if [ "$RED" -eq 0 ]; then
+  echo "triage-shape-check — invariants"
+  run_cases "$WF"; rc=$?
+  [ $rc -eq 0 ] && echo "triage-shape: self-test green" || echo "triage-shape: self-test FAILED"
+  exit $rc
+fi
+
+# ── RED PROOF ────────────────────────────────────────────────────────────────
+# A checker that stays green against gutted code proves nothing. Re-introduce
+# the two defects that were actually shipped and assert this file catches both.
+tmp="$(mktemp -d)"; trap 'rm -rf "$tmp"' EXIT
+gut="$tmp/triage.js"
+
+echo "RED PROOF 1 — second notes write restored (the clobber)"
+sed 's|if (body) writes.splice(1, 0, { op: .tasks:notes., text: body })|if (body) writes.splice(1, 0, { op: "tasks:notes", text: body }); if (task.shape \&\& task.shape.why) writes.push({ op: "tasks:notes", text: task.shape.why + "\\n\\naccept: see above" })|' "$WF" > "$gut"
+if run_cases "$gut" >/dev/null 2>&1; then echo "  FAIL: checker stayed GREEN against a double notes write"; exit 1
+else echo "  ok   checker went RED"; fi
+
+echo "RED PROOF 2 — tasks:assign restored (the absent receiver)"
+sed "s|op: 'tasks:reassign'|op: 'tasks:assign'|" "$WF" > "$gut"
+if run_cases "$gut" >/dev/null 2>&1; then echo "  FAIL: checker stayed GREEN against an unwired receiver"; exit 1
+else echo "  ok   checker went RED"; fi
+
+echo "RED PROOF 3 — money rule moved back to the front (the mis-route)"
+node -e '
+const fs=require("fs");let s=fs.readFileSync(process.argv[1],"utf8");
+s=s.replace(/const ROUTES = \[[\s\S]*?\n\]/,`const ROUTES = [\n  [/(^|\\\\/)(auth|passkey|vault|signer|wallet|escrow|payment|credits)/i, "security-auditor"],\n  [/\\\\.(astro|tsx|jsx|css)$|components?\\\\/|pages?\\\\//i, "implementer"],\n]`);
+fs.writeFileSync(process.argv[2],s)' "$WF" "$gut"
+if run_cases "$gut" >/dev/null 2>&1; then echo "  FAIL: checker stayed GREEN against a greedy money rule"; exit 1
+else echo "  ok   checker went RED"; fi
+
+echo "triage-shape: red proofs green (all three defects caught)"

package/scripts/tsc-cached.sh

@@ -137,9 +137,24 @@ if gate_lock "$_key" "${TSC_CACHE_WAIT:-900}"; then
   # TSC_CACHE_CMD exists for --self-test only (the `__probe__` idiom from
   # test-cached.sh): it substitutes a child that cannot finish inside the bound,
   # so the timeout branch below can be driven deterministically instead of raced.
-  run_bounded "${TSC_CACHE_TIMEOUT:-600}" \
+  # THE SLOT, not just the lock. gate_lock above dedupes by FOLDER: it stops two
+  # sessions computing the SAME answer twice. It does not cap concurrency across
+  # DIFFERENT folders, and N worktrees are N folders. Measured 2026-09-07: three
+  # worktrees each ran a 2.5GB tsc at once, every lock uncontended and doing its
+  # job, load hit 171 and localhost served a page in 8.4s. A lock DEDUPES; only a
+  # SLOT BOUNDS THE MACHINE. Route the compute through gate-run.sh so it queues
+  # behind GOVERN_MAX_GATES like every other heavy gate.
+  #
+  # gate-run.sh, never a bare gate_slot: its GOVERN_IN_GATE guard makes a nested
+  # gate INHERIT the outer slot rather than take a second one, and a second slot
+  # held by one logical gate is what deadlocks the queue at cap 2.
+  #
+  # stderr is deliberately NOT sent to /dev/null: gate-run announces "QUEUEING",
+  # and a wait that is silent gets read as a hang and then as a failure.
+  GOVERN_GATE_TIMEOUT="${TSC_CACHE_TIMEOUT:-600}" \
+  bash "$ROOT/.claude/scripts/gate-run.sh" "tsc-cache:$folder" -- \
     bash -c "cd '$folder' && ${TSC_CACHE_CMD:-bunx tsc --noEmit} 2>&1 | grep -c 'error TS' > '$_tmp'" \
-    2>/dev/null || true
+    || true
   n=$(cat "$_tmp" 2>/dev/null | tr -d '[:space:]'); rm -f "$_tmp"
   gate_release_all; trap - EXIT INT TERM
   # AN EMPTY COUNT IS NOT ZERO. run_bounded kills tsc at the bound and its `|| true`

package/scripts/typedb-flake-check.sh

@@ -60,7 +60,9 @@ classify() {
     return 1
   fi
   # How many tests vitest itself says failed. No line ⇒ we cannot classify ⇒ RED.
-  fails=$(grep -Eo 'Tests +[0-9]+ failed' "$log" | tail -1 | grep -Eo '[0-9]+' || true)
+  # Strip ANSI escape codes first — vitest 4.x wraps its summary in colour codes
+  # that break the regex ("Tests  \x1b[1m\x1b[31m12 failed\x1b[39m" → no match).
+  fails=$(sed 's/\x1b\[[0-9;]*m//g' "$log" | grep -Eo 'Tests +[0-9]+ failed' | tail -1 | grep -Eo '[0-9]+' || true)
   if [ -z "$fails" ]; then
     # A green log has "Tests N passed" and no "failed" — that is not our business.
     if grep -qE 'Tests +[0-9]+ passed' "$log" && ! grep -qE '[0-9]+ failed' "$log"; then

package/scripts/verify-fast.sh

@@ -15,6 +15,9 @@
 #      Those are always run — ~seconds, and they are the class of gate that
 #      historically went dark.
 #   3. Everything heavy goes through gate-run.sh (machine governor + load-guard).
+#      This was ASSERTED here and false until 2026-09-07: tsc-cached.sh was called
+#      outside the governor on purpose (see below), so a typecheck escaped the
+#      slot cap entirely. It now takes its own slot internally.
 #
 # FULL_VERIFY=1 makes this an alias for `bun run verify`.
 set -euo pipefail
@@ -33,6 +36,63 @@ BASE_REF="${DO_BASE_REF:-main}"
 # and the test memo, so every worktree and session reads ONE ledger.
 DEBT_FILE="${VERIFY_FAST_DEBT_FILE:-${TMPDIR:-/tmp}/one-verify-fast-debt}"
 
+# --- 0. generated-artifact drift ---------------------------------------------
+# `blocks-manifest.mjs` builds THREE COMMITTED artifacts from one registry:
+#   one.ie/web/src/lib/puck/block-manifest.json        what tooling reads
+#   channels/src/generated/block-enum.ts               what the model is told
+#   one.ie/web/src/lib/puck/block-schema.generated.ts  what the browser
+#                                                      normalises against
+# Until 2026-09-09 NOTHING ran it: `grep -c blocks-manifest verify-fast.sh
+# deploy.sh` was 0 and 0, and no test shells out to it. Three committed files
+# behind an ungated generator are three files that rot silently -- the registry
+# moves, the artifacts do not, and the first symptom is a model being told about
+# a block the browser cannot render.
+#
+# IT IS A STEP, NOT A PIN, and that distinction is the entire gate. `PINS` below
+# are vitest POSITIONAL SUBSTRING filters. Adding `blocks-manifest` there would
+# select zero test files, the other pins would still match, the pinned gate would
+# exit 0 -- and `grep -q blocks-manifest .claude/scripts/verify-fast.sh` would be
+# TRUE. A green grep over a check that never ran is worse than no gate at all.
+#
+# It runs BEFORE the FULL_VERIFY branch on purpose: every lane below has an exit
+# of its own (FULL_VERIFY exits at the top; an empty selection `exec`s the full
+# suite; a do/* branch exits 0 after deferring the pins), so anywhere lower is a
+# lane that can skip it. Repo-scoped, not folder-scoped -- one of the three
+# artifacts lives in channels/ and one in one.ie/web/, so both folders check both.
+#
+# NOT wrapped in gate-run.sh: one node process, ~2.5s of CPU. Most of its ~16s
+# wall is `bunx tsx` resolving a dependency this repo does not vendor
+# (`one.ie/web/node_modules/.bin/tsx` does not exist -- measured 2026-09-09), and
+# holding a machine-wide slot through a network round-trip is the anti-pattern
+# the tsc-cached note further down records.
+#
+# Capture-then-branch, per rule 3 at the top of this file: `set -e` would kill the
+# script with no message, and `node ... | grep` is the PIPESTATUS scar recorded at
+# the vitest call below. `--check` writes `ok (no drift)` to stdout and `drift
+# detected` to stderr; both are shown. A rc it cannot explain is still RED --
+# an unrun check is not a passing check.
+# MEMOISED since 2026-09-09. The raw --check is ~7s WARM (measured 8.19s then
+# 6.98s back-to-back on this box), and this lane runs on every edit, so a
+# doc-only or test-only cycle was paying 7s for a registry nobody touched.
+# blocks-manifest-cached.sh keys on the whole of one.ie/web/src -- a superset
+# of the check's declared inputs AND of the three artifacts it compares --
+# so any src edit still runs it. Only a PASS is stamped; drift is never
+# memoised. deploy.sh Step 0.5 deliberately keeps calling the RAW check: the
+# ship gate runs once and should not depend on a stamp. BLOCKS_MANIFEST_FORCE=1
+# bypasses the memo; --self-test proves the miss.
+_bm_out="$(mktemp)"
+set +e
+bash "$ROOT/.claude/scripts/blocks-manifest-cached.sh" > "$_bm_out" 2>&1
+_bm_rc=$?
+set -e
+cat "$_bm_out"; rm -f "$_bm_out"
+if [ "$_bm_rc" -ne 0 ]; then
+  echo "[verify-fast] block manifest DRIFT (or --check could not run) - rc=$_bm_rc" >&2
+  echo "[verify-fast] regenerate and commit all three artifacts:" >&2
+  echo "[verify-fast]   node .claude/scripts/blocks-manifest.mjs" >&2
+  exit 1
+fi
+
 if [ "${FULL_VERIFY:-0}" = "1" ]; then
   echo "[verify-fast] FULL_VERIFY=1 — running the full gate"
   # The close gate is where deferred pins come due. The full suite is a superset
@@ -68,7 +128,46 @@ if [ "${FULL_VERIFY:-0}" = "1" ]; then
 fi
 
 # Pinned suites: run on every fast pass regardless of the diff.
-PINS_DEFAULT='parity|wrangler|boundary|authority|roles|signals-parity|receivers'
+#
+# `portable` and `design-dock` were added 2026-09-05, after both went red at the
+# ship gate on a change whose fast pass was green. They belong here for the
+# reason the whole list exists — they import NOTHING from what they guard:
+#
+#   astro-portable  reads the pages DIRECTORY. Adding a root `*.astro` puts it in
+#                   neither ASTRO_PORTABLE nor ASTRO_NON_PORTABLE, and the new
+#                   page then 404s on every tenant host. No import graph reaches
+#                   a file that was just created, so `vitest related` cannot ever
+#                   select this — the one edit that trips it is invisible to it.
+#   design-dock     reads `Layout.astro` and every page as STRINGS, to hold "one
+#                   BrandingSection per document". An edit to Layout.astro selects
+#                   nothing that imports Layout.astro.
+#   render-sites    reads MessageList/ShowcaseMessageList as STRINGS to hold that
+#                   both approval states route to the approval card. Added
+#                   2026-09-06, after both sites gated on `approval-requested`
+#                   alone: the answered card — the whole celebration — was
+#                   unreachable through the wire, and the component suite covering
+#                   that state was green the entire time, because it handed the
+#                   card a state no render site ever passes it.
+#   panel-tabs      reads `PanelPanes.tsx` as a STRING to hold that every tab a
+#   person-panel    strip can emit resolves to a rendered pane. Both import only
+#                   `panels/tabs`, so editing ONLY PanelPanes -- which is where a
+#                   pane is DELETED -- selects neither. Measured 2026-09-09:
+#                   with `pane('task', …)` removed, all 79 tests passed.
+#   ad-flow-panel   reads `pages/ad/index.astro` and `AdFunnel.tsx` as STRINGS.
+#                   Same class as design-dock: nothing imports an .astro page.
+#
+# Deliberately NOT pinned: `page-chat-meta`, which imports everything it guards,
+# so `vitest related` already reaches it. A pin for a suite the import graph
+# covers is cost with no coverage.
+#
+# These three cost SECONDS, not the milliseconds the two above cost: measured
+# 2026-09-09, 2.34s for 49 tests, most of it `ad-flow-panel.test.tsx` building a
+# jsdom to render AdFlowPanel. That is the price of the only check that can see
+# a deleted pane, and it is paid on every fast lane.
+#
+# Cost measured on the run that motivated this: 7ms and 46ms. The failure they
+# catch costs an 18-minute deploy gate and a red ship.
+PINS_DEFAULT='parity|wrangler|boundary|authority|roles|signals-parity|receivers|portable|design-dock|render-sites|panel-tabs|person-panel|ad-flow-panel'
 PINS="${VERIFY_FAST_PINS:-$PINS_DEFAULT}"
 
 # --- changed files: committed-since-base UNION uncommitted -------------------
@@ -157,8 +256,17 @@ bash "$ROOT/.claude/scripts/sdk-build-cached.sh" || { echo "[verify-fast] sdk bu
 # since the last cycle typechecked it. Proving an artifact is not the same as
 # proving it in place.
 #
-# It takes its own gate lock, so it must NOT be nested inside another gate-run
-# slot -- that is a second lock on the same logical gate. It prints the error
+# It is NOT wrapped in gate-run here, and that is now safe rather than a hole:
+# tsc-cached.sh takes its own SLOT internally, around the compute and after the
+# cache double-check, so a HIT costs nothing and a MISS queues like every other
+# gate. Wrapping it out here instead would hold a slot through the up-to-900s
+# lock wait -- two sessions on one folder would occupy both slots while one only
+# waits for the other's answer.
+#
+# The comment this replaces said it "must NOT be nested inside another gate-run
+# slot -- that is a second lock on the same logical gate". That conflated the
+# per-folder dedupe LOCK with the machine-wide SLOT, and it is the instruction
+# that kept the typecheck outside the governor. It prints the error
 # COUNT on stdout and exits non-zero only when the check could not RUN; an unrun
 # check is not a passing check, so both a non-zero exit and a non-zero count fail.
 if [ -x "$ROOT/.claude/scripts/tsc-cached.sh" ] && [ "${VERIFY_FAST_TSC_CACHE:-1}" = "1" ]; then
@@ -214,10 +322,31 @@ fi
 # then vanishes silently, which is strictly worse than the false RED being fixed.
 # Measured: the run stopped after "typecheck: 0 errors" and printed no test line
 # at all. Suspend it around the call, exactly as the FULL_VERIFY branch does.
+
+# --- memo probe: never queue for a slot you do not need ----------------------
+# Both test legs below go through test-cached.sh, which reuses a recorded PASS.
+# But the SLOT was taken first and the memo consulted second, so a hit still
+# waited in the governor queue. Measured 2026-09-09 on a saturated box: a single
+# acquisition queued 855s and 1324s -- for work that, on a hit, is a stat() of a
+# stamp file. A hit needs no memory, no forks and no slot.
+#
+# _memo_hit asks test-cached.sh itself (TEST_CACHE_PROBE=1, runs nothing, exits 0
+# on a hit) so there is exactly ONE definition of what a hit is. On a MISS we
+# fall through and take the slot exactly as before -- the gate is never skipped,
+# only the WAIT for a gate that had nothing to do.
+_memo_hit() {
+  TEST_CACHE_PROBE=1 bash "$ROOT/.claude/scripts/test-cached.sh" "$@" >/dev/null 2>&1
+}
+
 _rel_out="$(mktemp)"
 set +e
-bash "$GATE" test -- bash "$ROOT/.claude/scripts/test-cached.sh" "$rel" -- related --run $(printf '%s ' $scoped) > "$_rel_out" 2>&1
-_rel_rc=$?
+if _memo_hit "$rel" -- related --run $(printf '%s ' $scoped); then
+  echo "[verify-fast] related: cache HIT — no slot taken"
+  _rel_rc=0
+else
+  bash "$GATE" test -- bash "$ROOT/.claude/scripts/test-cached.sh" "$rel" -- related --run $(printf '%s ' $scoped) > "$_rel_out" 2>&1
+  _rel_rc=$?
+fi
 set -e
 cat "$_rel_out"
 if [ "$_rel_rc" -eq 0 ]; then
@@ -306,7 +435,9 @@ if [ "${VERIFY_FAST_PINS_ALL:-0}" != "1" ] && [ "$_tier" = "PATCH" ]; then
 else
   echo "[verify-fast] tier=$_tier — running the full pin set"
 fi
-if ! bash "$GATE" test -- bash "$ROOT/.claude/scripts/test-cached.sh" "$rel" -- run "${_pins[@]}"; then
+if _memo_hit "$rel" -- run "${_pins[@]}"; then
+  echo "[verify-fast] pins: cache HIT — no slot taken"
+elif ! bash "$GATE" test -- bash "$ROOT/.claude/scripts/test-cached.sh" "$rel" -- run "${_pins[@]}"; then
   echo "[verify-fast] pinned gate FAILED (pins: ${_pins[*]})" >&2
   exit 1
 fi

package/scripts/worktree-up.sh

@@ -57,12 +57,15 @@
 set -uo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-NAME=""; PORT=""; BASE="main"; MODE="up"
+# Branches are cut from `dev`, not main: dev is the integration branch every
+# branch lands into, so a branch cut from main starts life missing whatever
+# dev has already integrated. `--base main` still does the old thing.
+NAME=""; PORT=""; BASE="dev"; MODE="up"
 
 while [ $# -gt 0 ]; do
   case "$1" in
     --port) PORT="${2:-}"; shift 2 ;;
-    --base) BASE="${2:-main}"; shift 2 ;;
+    --base) BASE="${2:-dev}"; shift 2 ;;
     --no-dev) MODE="setup"; shift ;;
     --check) MODE="check"; shift ;;
     --down) MODE="down"; shift ;;
@@ -91,6 +94,7 @@ one.ie/web/.env
 one.ie/web/.dev.vars
 one.ie/web/.wrangler
 one.ie/web/.astro
+one.ie/web/src/data/fleets.json
 pay/backend/.env
 channels/.env"
 

package/skills/shadcn/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: shadcn
-description: shadcn/ui primitives in `one.ie/web` under the ONE 6-token design system. Covers the `src/components/ui/` inventory, why shadcn's own `-foreground` names survive the `--color-*: initial` palette wipe via the Layout.astro aliases, adding a primitive with the CLI, and Button/Badge/Card/Dialog variants. Use when adding or editing a `src/components/ui/` primitive, when a shadcn component renders transparent or invisible after the wipe, or when picking between a token utility and an alias.
+description: "shadcn/ui primitives in `one.ie/web` under the ONE 6-token design system. Covers the `src/components/ui/` inventory, why shadcn's own `-foreground` names survive the `--color-*: initial` palette wipe via the Layout.astro aliases, adding a primitive with the CLI, and Button/Badge/Card/Dialog variants. Use when adding or editing a `src/components/ui/` primitive, when a shadcn component renders transparent or invisible after the wipe, or when picking between a token utility and an alias."
 user-invocable: true
 allowed-tools: Read, Write, Edit, Glob, Grep, Bash
 ---

package/skills/voice/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: voice
-description: Write in Anthony O'Connell's voice. Use whenever prose will go out under Anthony's or ONE's name and must sound like him, not like a generic assistant — books, essays, whitepapers, manifestos, blog posts, landing-page and marketing copy, founder updates, social posts, newsletters, client emails, playbook chapters, README and doc prose, or any rewrite where the note is "this doesn't sound like me". Its first job is picking the register: book/essay (patient, observational, no visible author, never sells) or commercial (first person, receipts, product names, sells). Invoke AFTER `writer` (craft) and alongside `product-marketing.md` (product context). Triggers — "write this in my voice", "in Anthony's voice/tone", "make it sound like me", "this reads like AI", "too corporate", "sounds generic", "write the book/chapter/essay/whitepaper", "write the blog post/landing page", "rewrite this properly".
+description: "Write in Anthony O'Connell's voice. Use whenever prose will go out under Anthony's or ONE's name and must sound like him, not like a generic assistant — books, essays, whitepapers, manifestos, blog posts, landing-page and marketing copy, founder updates, social posts, newsletters, client emails, playbook chapters, README and doc prose, or any rewrite where the note is \"this doesn't sound like me\". Its first job is picking the register: book/essay (patient, observational, no visible author, never sells) or commercial (first person, receipts, product names, sells). Invoke AFTER `writer` (craft) and alongside `product-marketing.md` (product context). Triggers — \"write this in my voice\", \"in Anthony's voice/tone\", \"make it sound like me\", \"this reads like AI\", \"too corporate\", \"sounds generic\", \"write the book/chapter/essay/whitepaper\", \"write the blog post/landing page\", \"rewrite this properly\"."
 ---
 
 # voice — Anthony O'Connell's register
@@ -33,7 +33,7 @@ Everything else — observe don't assert, specific numbers or none, short senten
 
 ## Step 2 — the sources, in order of authority
 
-1. **`text/voice-and-tone.md`** — the specification. **Authored by Anthony.** Vendored from `apps/ants/docs/book/files/01-voice-and-tone.md`; edit the original, re-vendor here. Demonstrated across 96,540 words in `apps/ants/docs/book/manuscript/`. **Senior to everything else. Where anything disagrees with it, it wins.**
+1. **`text/voice-and-tone.md`** — the specification. **Authored by Anthony.** Vendored from `apps/ants/docs/book/files/01-voice-and-tone.md`; edit the original, re-vendor here. Demonstrated across `apps/ants/docs/book/manuscript/` — 96,540 words of directory, 93,032 of them the 25 chapters the section below measures. **Senior to everything else. Where anything disagrees with it, it wins.**
 2. **`text/writing-style-guide.md`** — derived. Splits universal from book-only, and documents the commercial register the spec doesn't cover.
 3. **`.claude/product-marketing.md`** — product context: offer, audience, thesis, the measured-numbers table. Commercial only.
 
@@ -51,22 +51,110 @@ If it performs urgency, expertise, contrarianism, or aspiration — rewrite it.
 
 ---
 
+## What the corpus actually does — measured
+
+`text/voice-and-tone.md` says what the voice must never do. The 25 chapters of
+*100 Million Years Ahead* show what it does. Measured 2026-09-09 over
+`apps/ants/docs/book/manuscript/*.md` — 93,032 words, 6,163 sentences, 1,441
+paragraphs. Re-measure any time with `bash .claude/skills/voice/corpus-check.sh --corpus`.
+
+| Signature | Measured | What it means for a draft |
+|---|---|---|
+| **"I"** | **0** in 93,032 words | Absolute, not a preference. One occurrence is a defect. |
+| **Contractions** (`n't`) | **5** in the whole book | Effectively never. Write *does not*, *is not*, *will not*. The spec never states this; the corpus is unanimous. |
+| **`###` headings inside a chapter** | **0**, across all 25 | Confirmed absolute. |
+| **Horizontal rules** (`---`) | **median 5 per chapter**, up to 10 | The derived guide's "once or twice" is **wrong**. The scene break is a primary structural tool, not a rarity. |
+| **One-sentence paragraphs** | **371 of 1,441 — 25.7%** | One paragraph in four is a single sentence. That is the rhythm, not an occasional flourish. |
+| **Sentence length** | median **12** words · mean 15.1 · p10 **4** · p90 30 · max 82 | Wide range on purpose; 22.2% of sentences are 6 words or fewer. A draft of uniform 20-word sentences is not this voice. |
+| **Final sentence of a chapter** | median **10** words; three chapters end in 3 | Land short. *"The soil will."* · *"In the substrate."* · *"The architecture, running."* |
+| **"the reader"** vs **"you"** | 134 vs 113 — and **50 of the 113 sit in the epilogue alone** | The standing device is third-person *"the reader."* Direct *you* is held back and spent at the end, where the book turns to face the reader. |
+| **Digits** | 5.8 per 10k words | Numbers are rare and therefore load-bearing. A number earns its place or is cut. |
+| **Hedges** | *on the order of* ×12 · *roughly* ×23 · *approximately* ×3 | Precise when the evidence is sharp, *on the order of* when it is not. Never a fake decimal. |
+| **Em dashes** | 89.6 per 10k | Book register uses them freely. The "3 or fewer" rule is **commercial only** — do not carry it across. |
+| **Question marks** | 5.3 per 10k — 49 in the whole book | A rhetorical question is a rationed move. Two chapters end on one. |
+
+---
+
+## The three sentence shapes
+
+These are the shapes the corpus reaches for. They are not decoration. They are how an
+observation gets made without being asserted.
+
+**1. The negative-definition fragment.** A statement, then a fragment that names the
+obvious alternative and refuses it. The most characteristic sentence in the book.
+
+> *"This is the thing to look at. Not the ant."*
+> *"This is where the colony's memory lives. Not in any ant."*
+> *"The colony regulates the queen. Not the other way around."*
+> *"That eighth one ran in fifteen years what the desert ran in a hundred million. Not because it was better designed."*
+
+The fragment is deliberate. It does the work an em dash and a subordinate clause would
+do, and it lands harder because it stops.
+
+**2. "It is not X. It is Y."** Two flat copulas. The first clears the ground, the second
+puts the thing down. No connective, no *rather*, no *instead*.
+
+> *"It is not chemistry. It is not soil."*
+> *"It is not a stored recipe retrieved on cue. It is constructed for the case in front of it."*
+> *"It was not built as a substrate for collective intelligence. It was built to record grain shipments and tax debts."*
+
+**3. The copula-forward declarative.** *It is* appears 683 times — 73.5 per 10k. The
+voice states what a thing is and then stops, rather than explaining that it is about to
+state it. This is what "confidence without assertion" looks like structurally.
+
+**And one shape to avoid:** the interpretive paragraph after a clear observation. The
+corpus makes the observation and leaves a blank line. The reader is given room to feel
+the implication before the next paragraph arrives.
+
+---
+
+## Openings and closings
+
+**Every one of the 25 chapters opens on a concrete particular.** Never on an argument,
+never on a thesis, never on a summary of what the chapter will do.
+
+They open on: a temperature on dirt · a nine-month-old on a kitchen floor · dawn in the
+Chihuahuan Desert · a corridor a centimetre wide · a freshly emerged ant · a stretch of
+high desert near Rodeo · *"She is the largest animal in the nest, and she is doing the
+least."* · a man opening a coffee shop · a person selling four hundred shares · Vienna,
+1847 · a scrape on a knee · one and a half kilograms of tissue · the year 1300 · 2008 ·
+*"The desert is still there."*
+
+Three reliable opening moves: **a place and a temperature**; **a date, a person, an
+action**; **a flat short sentence holding a contradiction** ("largest… doing the least").
+Pick one and begin. Do not announce.
+
+**The closings are short, and they return.** Median 10 words. The dominant move is a
+recontextualised return to the chapter's own opening image — chapter 22 opens *"The
+desert is still there"* and closes *"The architecture, running."* Two chapters close on a
+question. Several close on a fragment that lands on one noun and nothing else.
+
+Never close on a summary. Never close on an implication the reader can draw alone.
+
+---
 ## Book-register checklist
 
 - [ ] **Opens on a scene** — a place, a person, a moment, a number. Never on an argument.
 - [ ] **No "I", no editorial "we", no visible author.** The camera is there; the camera is not the subject.
 - [ ] **Observes; does not assert.** "The intelligence was not in any of the ants," not "intelligence is a property of substrates."
 - [ ] **Sells nothing.** Names no company, product, or technology. Quotes no code.
-- [ ] **No subheadings.** A horizontal rule may mark a shift in scene or scale, once or twice.
-- [ ] **Specific numbers, or honest hedging** (*on the order of*, *approximately*). Never false specificity.
+- [ ] **No contractions.** *does not*, not *doesn't*. Five in 92,894 words of corpus.
+- [ ] **No `###` subheadings** — zero across 25 chapters. But **use the horizontal rule**: median 5 scene breaks per chapter, up to 10.
+- [ ] **"The reader", not "you"** — 134 to 116, and 50 of the *you*s are in the epilogue. Direct address is saved for the end.
+- [ ] **One paragraph in four is a single sentence** (25.7% measured). Vary sentence length hard: median 12 words, but 22.2% are ≤6.
+- [ ] **Specific numbers, or honest hedging** (*on the order of*, *roughly*). Never false specificity. Digits appear only 5.8 times per 10k words — each one is load-bearing.
 - [ ] **Never defines a technical term** — makes its meaning land through use.
-- [ ] **Closes on a short concrete sentence** the reader carries, often a recontextualised return to the opening.
+- [ ] **Opens on a concrete particular** — a place and a temperature, a date and a person and an action, or a short flat sentence holding a contradiction. Never on the thesis.
+- [ ] **Closes short** — median 10 words — often a recontextualised return to the opening image. Never a summary.
+- [ ] **Reaches for the three shapes** — the negative-definition fragment, "It is not X. It is Y.", the copula-forward declarative.
+- [ ] **Leaves the observation alone.** No interpretive paragraph after a clear one.
 - [ ] **Passes both the "your mum" and the "Demis Hassabis" test.**
 - [ ] **The emotion is recognition, not awe.** No "this changes everything."
+- [ ] **Run `bash .claude/skills/voice/corpus-check.sh <draft.md>`** — it counts the mechanical half against the corpus and cannot judge the rest.
 
 ## Commercial-register checklist
 
-- [ ] **Em dashes: 3 or fewer.** Count them.
+- [ ] **Em dashes: 3 or fewer.** Count them. (Book register is the opposite — 89.6 per 10k. Do not carry this rule across.)
 - [ ] **Every quality adjective replaced by a number** — or the claim cut, or the gap stated.
 - [ ] **No fabricated proof.** Every metric, quote, logo, benchmark, file path real or marked unproven.
 - [ ] **Speed claims carry a measured number** from `product-marketing.md`'s table.

package/skills/voice/corpus-check.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# corpus-check.sh — measure book-register prose against the corpus that defines it.
+#
+#   bash .claude/skills/voice/corpus-check.sh --corpus        re-derive the SKILL.md table
+#   bash .claude/skills/voice/corpus-check.sh <draft.md> ...  check a draft
+#   bash .claude/skills/voice/corpus-check.sh --self-test     prove the checker goes RED
+#
+# It counts the MECHANICAL half of the voice only: the things a machine can see.
+# It cannot tell whether a sentence observes or asserts, and it never claims to.
+# A green run is a draft that has not broken a countable rule. It is not a good draft.
+#
+# manifest: monorepo-only   (the corpus lives in the sibling repo apps/ants)
+set -o pipefail
+
+CORPUS="${VOICE_CORPUS:-/Users/toc/Server/apps/ants/docs/book/manuscript}"
+
+measure() {  # measure <label> <file...>
+  python3 - "$@" <<'PY'
+import re,sys,statistics
+label=sys.argv[1]; files=sys.argv[2:]
+txt=[]
+for f in files:
+    try: t=open(f, encoding="utf-8").read()
+    except OSError as e: print(f"  cannot read {f}: {e}"); continue
+    txt.append(t)
+raw="\n".join(txt)
+raw=re.sub(r'\A---\n.*?\n---\n','',raw,flags=re.S)      # YAML frontmatter is metadata, not prose
+body="\n".join(l for l in raw.split("\n") if not l.startswith("#"))
+words=len(body.split())
+if not words: print("  EMPTY — nothing to measure"); sys.exit(2)
+sents=[s.strip() for s in re.split(r'(?<=[.!?])\s+',body) if len(s.strip())>1]
+wl=[len(s.split()) for s in sents]
+paras=[p.strip() for p in body.split("\n\n") if p.strip() and p.strip()!="---"]
+psent=[len(re.split(r'(?<=[.!?])\s+',p)) for p in paras]
+per10k=lambda n: 10000*n/words
+CONTRACTION=r"n[\u2019']t\b"
+c=lambda pat: len(re.findall(pat,body))
+craw=lambda pat: len(re.findall(pat,raw))   # headings live only in raw
+one=sum(1 for x in psent if x==1)
+short=sum(1 for x in wl if x<=6)
+last=re.split(r'(?<=[.!?])\s+',paras[-1].replace("\n"," "))[-1] if paras else ""
+print(f"  {label}: {words} words · {len(sents)} sentences · {len(paras)} paragraphs")
+print(f"    I                    {c(r'(?<![A-Za-z])I[ ,.]'):6d}        target 0")
+print(f"    contractions n\'t     {c(CONTRACTION):6d}        target ~0 (corpus 0.5/10k)")
+print(f"    ### headings         {craw(r'(?m)^#{3,}'):6d}        target 0")
+sb=[len(re.findall(r'(?m)^---\s*$',t)) for t in txt]
+print(f"    --- scene breaks     {sum(sb):6d}  median {statistics.median(sb) if sb else 0:.0f}/file   corpus median 5")
+print(f"    1-sentence paras     {one:6d}  {100*one/len(paras):5.1f}%   corpus 25.7%")
+print(f"    sentences <=6 words  {short:6d}  {100*short/len(sents):5.1f}%   corpus 22.4%")
+print(f"    sentence median      {statistics.median(wl):6.0f} words    corpus 12 (mean {statistics.mean(wl):.1f}, corpus 15.1)")
+print(f"    'the reader'         {c(r'(?i)\bthe reader\b'):6d}")
+print(f"    'you'                {c(r'(?i)\byou\b'):6d}        corpus favours 'the reader'")
+print(f"    digits    per10k     {per10k(c(r'\b\d')):6.1f}        corpus 5.8")
+print(f"    em dash   per10k     {per10k(c(chr(8212))):6.1f}        corpus 89.8")
+print(f"    final sentence       {len(last.split()):6d} words    corpus median 10")
+if last: print(f"      > {last[:100]}")
+PY
+}
+
+case "${1:-}" in
+  --corpus)
+    if [ ! -d "$CORPUS" ]; then
+      echo "corpus not found: $CORPUS"
+      echo "It lives in the sibling repo apps/ants and does not ship. Set VOICE_CORPUS to point at it."
+      exit 4          # unavailable — NOT a pass
+    fi
+    measure "corpus" "$CORPUS"/[0-9][0-9]-*.md ;;
+
+  --self-test)
+    d=$(mktemp -d); trap 'rm -rf "$d"' EXIT
+    printf '### A heading\n\nI think this is fine. It doesn'"'"'t matter.\n\nYou will see that you agree, you really will.\n' > "$d/bad.md"
+    out=$(measure "red-proof" "$d/bad.md")
+    echo "$out"
+    fail=0
+    echo "$out" | grep -qE '^ +I +[1-9]'            || { echo "RED PROOF FAILED: 'I' not counted"; fail=1; }
+    echo "$out" | grep -qE "contractions n't +[1-9]" || { echo "RED PROOF FAILED: contraction not counted"; fail=1; }
+    echo "$out" | grep -qE '### headings +[1-9]'     || { echo "RED PROOF FAILED: heading not counted"; fail=1; }
+    [ $fail -eq 0 ] && echo "SELF-TEST ok — the checker sees all three violations" || exit 1 ;;
+
+  ""|-h|--help)
+    sed -n '2,14p' "$0" | sed 's/^# \{0,1\}//' ;;
+
+  *)
+    measure "draft" "$@"
+    echo
+    echo "  Counted, not judged. The uncountable half is the checklist in SKILL.md." ;;
+esac