@oneie/claude 0.8.0 → 0.9.0

package/scripts/factory-peak.sh

@@ -0,0 +1,301 @@
+#!/usr/bin/env bash
+# factory-peak.sh — the resident price of a running tree, measured.
+#
+# manifest: portable
+#
+# WHAT IT IS. Width is an assumption until something reads the bill.
+# factory-width.sh DIVIDES the free memory by an assumed price per cycle; this
+# script MEASURES that price. Point it at the root pid of anything that forks —
+# a parked preview server, a gate, a fleet worktree — and it samples the
+# resident set of the whole process TREE until the job ends or the clock runs
+# out, then prints the peak.
+#
+#   bash .claude/scripts/factory-peak.sh --pid 12163 --seconds 30
+#   bash .claude/scripts/factory-peak.sh --pid "$!" --until /tmp/run.done --interval 5
+#   bash .claude/scripts/factory-peak.sh --self-test
+#
+# Output — one line per sample, then the verdict:
+#
+#   t=0 procs=4 rss_mb=91
+#   t=2 procs=4 rss_mb=104
+#   PEAK rss_mb=104 at t=2 procs=4
+#
+# WHAT THE NUMBER IS. The SUM of every process's RSS in the tree. RSS
+# double-counts pages that processes share — a node parent and its workerd child
+# share libraries and mapped files — so the figure is an UPPER BOUND on what the
+# tree costs the box. That is the conservative direction for a budget, and it is
+# the same rough arithmetic gate_headroom already prices a cycle with.
+#
+# RSS IS A LIVE QUANTITY, NOT A CONSTANT. The OS reclaims and compresses idle
+# anonymous pages, so an idle tree's resident set DECAYS while you watch it: the
+# same parked preview server, untouched, read PEAK 138 MB in one 30s window and
+# 87 MB in another. Neither is wrong — a peak is what the tree held while it was
+# watched. Price a cycle from a window in which the tree is DOING the work being
+# priced, and read an idle tree's number as its floor, not its cost under load.
+#
+# THE TREE. Descendants via `pgrep -P`, walked breadth-first with a seen-set and
+# a depth cap (a live tree reshapes between levels; a pid must be counted once).
+# If the root pid is its own process-group leader, the group's other members are
+# added too (mode=children+pgid). When it is NOT — a server forked by a wrapper
+# shell inherits the WRAPPER's group — that group belongs to somebody else and is
+# left alone (mode=children). The mode is printed, so the number is interpretable.
+#
+# FAILS CLOSED. A tree that is not there is never a cheap tree:
+#
+#   exit 2   the root pid is not alive at start      nothing was measured
+#   exit 3   the root exited mid-run                 TRUNCATED, peak still printed
+#   exit 4   every sample read 0 MB                  the sampler is broken, not the tree free
+#   exit 5   --self-test failed
+#
+# `PEAK rss_mb=0` is never printed as a pass — that is the benign default this
+# instrument exists to refuse.
+set -uo pipefail
+
+PID=""
+INTERVAL=2
+UNTIL_FILE=""
+SECONDS_CAP=""
+DO_SELFTEST=0
+MAX_DEPTH=6
+HARD_CAP="${FACTORY_PEAK_HARD_CAP:-3600}"
+
+die() { printf '%s\n' "$*" >&2; }
+
+usage() {
+  die "usage: factory-peak.sh --pid <root pid> [--interval 2] [--until <file>|--seconds N]"
+  die "       factory-peak.sh --self-test"
+}
+
+# RED-PROOF SEAM — --self-test's red half neuters exactly this line and asserts
+# the green half then fails. Keep it a one-liner.
+_children() { pgrep -P "$1" 2>/dev/null; }
+
+_alive() { kill -0 "$1" 2>/dev/null; }
+
+# Every descendant of $1, breadth-first, each pid once, depth-capped.
+_tree_pids() {
+  local root="$1" seen=" $1 " d=0 p c
+  local -a frontier=("$root") next=()
+  printf '%s\n' "$root"
+  while [ "${#frontier[@]}" -gt 0 ] && [ "$d" -lt "$MAX_DEPTH" ]; do
+    next=()
+    for p in "${frontier[@]}"; do
+      while read -r c; do
+        [ -n "$c" ] || continue
+        case "$seen" in *" $c "*) continue ;; esac
+        seen="$seen$c "
+        printf '%s\n' "$c"
+        next+=("$c")
+      done < <(_children "$p")
+    done
+    frontier=(${next[@]+"${next[@]}"})
+    d=$((d + 1))
+  done
+}
+
+# echoes "<rss_mb> <procs>"; 0 0 when nothing in the tree answered.
+_sample() {
+  local pids list
+  pids="$(_tree_pids "$PID" | sort -un)"
+  if [ "$MODE" = "children+pgid" ]; then
+    pids="$(printf '%s\n%s\n' "$pids" \
+      "$(ps -axo pid=,pgid= | awk -v g="$PID" '$2 == g { print $1 }')" | sort -un)"
+  fi
+  list="$(printf '%s' "$pids" | tr '\n' ',' | sed 's/,$//')"
+  [ -n "$list" ] && [ "$list" != "," ] || { printf '0 0\n'; return; }
+  ps -o rss= -p "$list" 2>/dev/null \
+    | awk '{ s += $1; n++ } END { printf "%d %d\n", s / 1024, n }'
+}
+
+measure() {
+  local start now t mb n samples=0 truncated=0
+  local peak=0 peak_t=0 peak_n=0
+
+  _alive "$PID" || { die "root pid $PID is not alive — nothing to measure"; return 2; }
+
+  MODE=children
+  local rpgid
+  rpgid="$(ps -o pgid= -p "$PID" 2>/dev/null | tr -d ' ')"
+  [ -n "$rpgid" ] && [ "$rpgid" = "$PID" ] && MODE="children+pgid"
+  printf '# pid=%s mode=%s interval=%s%s%s\n' "$PID" "$MODE" "$INTERVAL" \
+    "${SECONDS_CAP:+ seconds=$SECONDS_CAP}" "${UNTIL_FILE:+ until=$UNTIL_FILE}"
+
+  start="$(date +%s)"
+  while :; do
+    now="$(date +%s)"; t=$((now - start))
+    if ! _alive "$PID"; then
+      truncated=1
+      die "# root pid $PID exited at t=${t}s — the tree is gone"
+      break
+    fi
+    read -r mb n <<EOS
+$(_sample)
+EOS
+    printf 't=%s procs=%s rss_mb=%s\n' "$t" "$n" "$mb"
+    samples=$((samples + 1))
+    if [ "$mb" -gt "$peak" ]; then peak="$mb"; peak_t="$t"; peak_n="$n"; fi
+
+    if [ -n "$UNTIL_FILE" ] && [ -e "$UNTIL_FILE" ]; then break; fi
+    if [ -n "$SECONDS_CAP" ] && [ "$t" -ge "$SECONDS_CAP" ]; then break; fi
+    if [ "$t" -ge "$HARD_CAP" ]; then break; fi
+    sleep "$INTERVAL"
+  done
+
+  if [ "$samples" -eq 0 ]; then
+    die "no sample was taken — root pid $PID died before the first read"
+    return 3
+  fi
+  if [ "$peak" -le 0 ]; then
+    die "every one of $samples sample(s) read 0 MB — the sampler could not see the tree,"
+    die "which is not the same as the tree being free. Refusing to print a peak."
+    return 4
+  fi
+  printf 'PEAK rss_mb=%s at t=%s procs=%s\n' "$peak" "$peak_t" "$peak_n"
+  if [ "$truncated" -eq 1 ]; then
+    printf 'TRUNCATED — the root exited before the window closed; the peak is a lower bound\n'
+    return 3
+  fi
+  return 0
+}
+
+# ---------------------------------------------------------------------------
+# --self-test: a tree whose allocation is KNOWN, then the red half.
+# ---------------------------------------------------------------------------
+self_test() {
+  local rt alloc_mb=50 base_mb expected measured delta rc
+  local tmpdir child root out
+
+  command -v python3 >/dev/null 2>&1 || {
+    die "SELF-TEST unrun — no python3 on this box to build a known tree"
+    return 5
+  }
+  rt=python3
+
+  tmpdir="$(mktemp -d -t factory-peak)" || { die "SELF-TEST unrun — mktemp failed"; return 5; }
+  child="$tmpdir/hold.py"
+  # The child must KEEP its pages hot, not merely allocate them. macOS compresses
+  # idle anonymous pages: a bytearray touched once and then slept on falls out of
+  # the resident set within seconds (measured — a 133MB tree read 20MB at t=3s),
+  # so a self-test that allocates and sleeps asserts against a number the OS has
+  # already taken back. Re-touching every page is what makes the allocation a
+  # thing the sampler can be held to.
+  cat > "$child" <<PY
+import time
+b = bytearray(${alloc_mb} * 1024 * 1024)
+end = time.time() + 25
+while time.time() < end:
+    for i in range(0, len(b), 4096):
+        b[i] = 1                  # keep every page RESIDENT, not just allocated
+    time.sleep(0.05)
+PY
+
+  # Baseline: what one interpreter costs holding nothing. Measured, never guessed —
+  # it is what makes the 30% tolerance mean something.
+  "$rt" -c 'import time; time.sleep(6)' &
+  local bpid=$!
+  sleep 2
+  base_mb="$(ps -o rss= -p "$bpid" 2>/dev/null | awk '{ printf "%d", $1 / 1024 }')"
+  kill "$bpid" 2>/dev/null; wait "$bpid" 2>/dev/null
+  case "${base_mb:-}" in ''|*[!0-9]*) base_mb=0 ;; esac
+  if [ "$base_mb" -le 0 ]; then
+    die "SELF-TEST unrun — could not read the baseline interpreter's RSS"
+    rm -rf "$tmpdir"; return 5
+  fi
+
+  # The known tree: one sh, two children each holding alloc_mb resident.
+  sh -c "\"$rt\" \"$child\" & \"$rt\" \"$child\" & wait" &
+  root=$!
+  sleep 2   # let both children reach the plateau
+
+  out="$(PID="$root" INTERVAL=1 SECONDS_CAP=8 UNTIL_FILE="" measure 2>&1)"
+  rc=$?
+  kill -- -"$root" 2>/dev/null
+  pkill -P "$root" 2>/dev/null
+  kill "$root" 2>/dev/null
+  wait "$root" 2>/dev/null
+  rm -rf "$tmpdir"
+
+  if [ "$rc" -ne 0 ]; then
+    printf '%s\n' "$out"
+    die "SELF-TEST FAIL — the sampler exited $rc against a known-live tree"
+    return 5
+  fi
+  measured="$(printf '%s\n' "$out" | awk -F'rss_mb=' '/^PEAK /{ split($2, a, " "); print a[1] }')"
+  case "${measured:-}" in ''|*[!0-9]*)
+    printf '%s\n' "$out"
+    die "SELF-TEST FAIL — no PEAK line to read"
+    return 5 ;;
+  esac
+
+  # The KNOWN quantity is the allocation: 2 x alloc_mb, page-touched, resident.
+  # The interpreter baseline is measured, but it is the unstable term (it swings
+  # with how far the interpreter has loaded when it is sampled), so it is never
+  # allowed into the FLOOR — only into the ceiling, as headroom. Asserting the
+  # symmetric "expected = 2*alloc + 2*baseline" would put a term that moves 36%
+  # between runs inside a 30% budget.
+  local known floor ceiling
+  known=$(( 2 * alloc_mb ))
+  floor=$(( known * 70 / 100 ))
+  ceiling=$(( known * 130 / 100 + 2 * base_mb ))
+  delta="$(awk -v m="$measured" -v k="$known" 'BEGIN { printf "%+.1f", (m - k) * 100 / k }')"
+  printf 'SELF-TEST known=%sMB (2x%s alloc) measured=%sMB delta=%s%% window=[%s,%s] (ceiling carries 2x%s baseline)\n' \
+    "$known" "$alloc_mb" "$measured" "$delta" "$floor" "$ceiling" "$base_mb"
+  if [ "$measured" -lt "$floor" ] || [ "$measured" -gt "$ceiling" ]; then
+    die "SELF-TEST FAIL — measured peak ${measured}MB is outside [${floor},${ceiling}] for a known ${known}MB allocation"
+    return 5
+  fi
+  printf 'SELF-TEST green half ok — tree measured within 30%% of a known allocation\n'
+
+  # --- red half: gut the recursion, assert the green half then goes RED --------
+  if [ "${FACTORY_PEAK_NO_RED:-0}" = "1" ]; then return 0; fi
+  local gutted
+  gutted="$(mktemp -t factory-peak-red)" || { die "SELF-TEST unrun — mktemp failed"; return 5; }
+  sed 's/^_children() { pgrep -P "\$1" 2>\/dev\/null; }$/_children() { :; }/' "$0" > "$gutted"
+  if ! grep -q '^_children() { :; }$' "$gutted"; then
+    rm -f "$gutted"
+    die "SELF-TEST unrun — could not neuter the recursion seam; the red proof did not run"
+    return 5
+  fi
+  FACTORY_PEAK_NO_RED=1 bash "$gutted" --self-test >/dev/null 2>&1
+  rc=$?
+  rm -f "$gutted"
+  if [ "$rc" -eq 0 ]; then
+    die "SELF-TEST FAIL — a copy with the child recursion REMOVED still passed."
+    die "The green half proves nothing; it is not reading the tree."
+    return 5
+  fi
+  printf 'SELF-TEST red-proof ok — recursion removed => exit %s (root only, tree unseen)\n' "$rc"
+  printf 'SELF-TEST PASS\n'
+  return 0
+}
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --pid)       PID="${2:-}"; shift 2 ;;
+    --interval)  INTERVAL="${2:-}"; shift 2 ;;
+    --until)     UNTIL_FILE="${2:-}"; shift 2 ;;
+    --seconds)   SECONDS_CAP="${2:-}"; shift 2 ;;
+    --self-test) DO_SELFTEST=1; shift ;;
+    -h|--help)   usage; exit 0 ;;
+    *)           die "unknown argument: $1"; usage; exit 64 ;;
+  esac
+done
+
+if [ "$DO_SELFTEST" -eq 1 ]; then
+  self_test
+  exit $?
+fi
+
+case "${PID:-}" in
+  ''|*[!0-9]*) usage; exit 64 ;;
+esac
+case "$INTERVAL" in ''|*[!0-9]*) die "--interval must be whole seconds"; exit 64 ;; esac
+[ "$INTERVAL" -lt 1 ] && INTERVAL=1
+if [ -n "$SECONDS_CAP" ]; then
+  case "$SECONDS_CAP" in *[!0-9]*) die "--seconds must be a whole number"; exit 64 ;; esac
+fi
+# Neither stop condition given: bound the run rather than sample forever.
+[ -z "$SECONDS_CAP" ] && [ -z "$UNTIL_FILE" ] && SECONDS_CAP=30
+
+measure
+exit $?

package/scripts/factory-repo.sh

@@ -64,8 +64,11 @@ portable       browser-check.mjs
 portable       chrome.mjs
 portable       do-analyze.sh
 portable       gate-reaper.sh
+portable       health.sh
 portable       govern-bound-check.sh
 portable       factory-width.sh
+portable       factory-executor-check.mjs
+portable       factory-peak.sh
 portable       do-learn-loop.sh
 portable       do-promise-lint.sh
 portable       do-recon-cache.sh
@@ -74,11 +77,16 @@ portable       do-next.sh
 portable       do-plan-json.sh
 portable       do-test-gate.sh
 portable       do-tick.sh
+portable       do-prove-selftest.sh
 portable       do-validate-armed.py
+portable       factory-brief-check.sh
 portable       fixtures/triage-dupe.md
 portable       gate-run.sh
+portable       gate-reaper-check.sh
+portable       gc-content-check.sh
 portable       govern-mem-check.sh
 portable       governor-escape-check.sh
+portable       lib/gc-finished.sh
 portable       lib/govern.sh
 portable       lib/govern.ts
 portable       package.json
@@ -137,14 +145,24 @@ monorepo-only  orphan-modules.mjs
 needs-env      worktree-preview.sh
 needs-env      factory-walk.sh
 needs-env      factory-turn.sh
+needs-env      factory-emit.sh
+needs-env      factory-close-check.sh
+needs-env      preview-fd-check.sh
+portable       factory-review-check.mjs
+portable       pr-body.sh
+monorepo-only  deploy-record.sh
+monorepo-only  deploy-emit.sh
+needs-env      fixtures/factory-brief-real.md
 monorepo-only  agentverse-audit.sh
 monorepo-only  asi-walk.sh
 monorepo-only  cc-events-proof.sh
+monorepo-only  db-sync-lock-check.sh
 monorepo-only  skills-publish.sh
 monorepo-only  deploy.sh
 monorepo-only  factory-ship.sh
 monorepo-only  blocks-ratchet.sh
 monorepo-only  blocks-manifest.mjs
+monorepo-only  id-inventory.mjs
 monorepo-only  fleet-manifest.mjs
 monorepo-only  one-agents.mjs
 monorepo-only  blocks-render-probe.mjs
@@ -171,7 +189,9 @@ monorepo-only  livekit-ratchet.sh
 monorepo-only  outcome-pull.ts
 monorepo-only  promise-manifest.mjs
 monorepo-only  roles-check.sh
+monorepo-only  ad-copy-lint.sh
 monorepo-only  spine-canary.sh
+monorepo-only  worktree-up.sh
 monorepo-only  subdomains-proof.sh
 monorepo-only  sync-claude-mirror.sh
 monorepo-only  tg-listen.sh

package/scripts/factory-review-check.mjs

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+// classification: portable
+// Red proof for factory-executor.js's Review predicate — and it READS THE FILE.
+//
+// The first version of this checker defined OLD and NEW as two inline lambdas
+// and never opened the executor. It stayed green through two merges on
+// 2026-09-06 while the executor's own line was fail-open (`0*2 > 1` = false
+// for zero survivors). A checker that cannot see its subject proves nothing;
+// this one lifts the predicate out of the source with new Function, drives it
+// over the jury table beside the OLD shape, and fails closed if the lines it
+// expects are not in the file.
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, join } from 'node:path'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const file = process.argv[2] || join(here, '..', 'workflows', 'factory-executor.js')
+const src = readFileSync(file, 'utf8')
+
+// Lift the two lines that ARE the predicate. Anchored on the const names, not
+// on the arithmetic, so a wrong formula is caught by the table, not by the regex.
+const mAgainst = src.match(/^\s*const against = (.+)$/m)
+const mRefuted = src.match(/^\s*const refuted = (.+)$/m)
+if (!mRefuted) {
+  console.log(`RED  could not lift the Review predicate from ${file} — expected a \`const refuted = …\` line`)
+  process.exit(1)
+}
+// A pre-fix file has no `against` line; derive it so the OLD shape is DRIVEN and
+// fails on the table (a wrong verdict), rather than tripping the regex (a miss).
+const againstExpr = mAgainst ? mAgainst[1] : 'votes.filter((v) => v.refuted).length'
+let LIFTED
+try {
+  LIFTED = new Function('votes', `const against = ${againstExpr}; return ${mRefuted[1]};`)
+} catch (e) {
+  console.log(`RED  lifted predicate does not parse: ${e.message}`); process.exit(1)
+}
+const OLD = (v) => v.filter(x => x.refuted).length * 2 > Math.max(1, v.length)
+
+const R = { refuted: true }, A = { refuted: false }
+const cases = [
+  ['zero survivors (every lens threw)', [],            true,  'THE BUG: nobody voted, so nobody objected'],
+  ['1 lens, refutes',                   [R],           true,  'lone lens must bite'],
+  ['1 lens, approves',                  [A],           false, 'lone lens approves'],
+  ['2 lenses split 1-1',                [R, A],        true,  'a split jury is not an acquittal'],
+  ['2 lenses both refute',              [R, R],        true,  'unanimous against'],
+  ['2 lenses both approve',             [A, A],        false, 'unanimous for'],
+  ['3 lenses, 1 refutes',               [R, A, A],     false, 'a lone dissenter is not a majority'],
+  ['3 lenses, 2 refute',                [R, R, A],     true,  'majority against'],
+]
+let oldFails = 0, fileFails = 0
+console.log(`predicate lifted from ${file}\n  against = ${againstExpr}${mAgainst ? '' : '  (derived — file has no against line)'}\n  refuted = ${mRefuted[1]}\n`)
+console.log('case                                  want   OLD    FILE')
+for (const [name, votes, want, why] of cases) {
+  const o = OLD(votes), f = LIFTED(votes)
+  if (o !== want) oldFails++
+  if (f !== want) fileFails++
+  console.log(`${name.padEnd(36)} ${String(want).padEnd(6)} ${o === want ? ' ok  ' : 'RED  '} ${f === want ? ' ok' : 'RED'}   ${f !== want ? '<- FILE WRONG: ' + why : ''}`)
+}
+console.log(`\nOLD shape: ${oldFails} failure(s)  <- must be > 0 or this proof is worthless`)
+console.log(`FILE:      ${fileFails} failure(s)  <- must be 0`)
+process.exit(oldFails > 0 && fileFails === 0 ? 0 : 1)

package/scripts/factory-tasks-check.sh

@@ -22,6 +22,23 @@
 # pointed at production writes fabricated rungs into the graph the board reads.
 set -uo pipefail
 
+# _GATE — route a heavy compute through the machine governor. A gate_lock only
+# dedupes IDENTICAL work; a SLOT is what bounds N worktrees each running one of
+# these at once (measured 2026-09-07: three concurrent 2.5GB typecheckers, every
+# lock uncontended, load 171). Empty when already inside a gate, so a nested call
+# inherits the outer slot rather than taking a second one.
+#
+# Resolves gate-run.sh from its OWN directory, deliberately: an earlier version
+# keyed off $ROOT and got inserted above the line that sets it, so _GATE was
+# silently empty and every call ran ungoverned -- a fail-OPEN, which is the exact
+# defect this preamble exists to close.
+_GATE=()
+if [ "${GOVERN_IN_GATE:-0}" != "1" ]; then
+  _GR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/gate-run.sh"
+  [ -f "$_GR" ] && _GATE=( bash "$_GR" "compute:$(basename "${BASH_SOURCE[0]}")" -- )
+fi
+
+
 ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
 MODE="${1:-ladder-live}"
 
@@ -59,7 +76,7 @@ check_ladder_live() {
         TYPEDB_USERNAME="$TYPEDB_USERNAME" \
         TYPEDB_PASSWORD="$TYPEDB_PASSWORD" \
         TYPEDB_TEST_DB="$TYPEDB_TEST_DB" \
-        bunx vitest run src/lib/resolvers/factory-ladder-live.test.ts 2>&1)
+        "${_GATE[@]}" bunx vitest run src/lib/resolvers/factory-ladder-live.test.ts 2>&1)
 
   # An empty scratch db answers "Type label 'thing' not found" — the schema was never
   # loaded there. That is an environment gap, not a broken ladder.

package/scripts/fixtures/factory-brief-real.md

@@ -0,0 +1,44 @@
+You are the hand. Build task task:01a07591e5c350a306c93933: "In pages/components add a button > add this component to a page — it shows a list of pages in the workspace, you select the page to add the component, then edit the page or continue adding components".
+Notes from the board:
+SPEC (the title is the whole spec; the row's notes were empty — this brief was assembled by the launching session from a real read of the tree on 2026-09-06, every file:line verified).
+
+WHAT TO BUILD
+On /components (the Component Library gallery, ComponentBrowser.tsx), give every block an 'Add to page' affordance. Clicking it opens a picker listing the workspace's pages; choosing one appends that block to that page; after the write, offer two exits — 'Edit page' (link to the page editor) and 'Continue adding components' (dismiss the picker, stay in the gallery).
+
+BOTH RECEIVERS ALREADY EXIST — DO NOT WRITE A NEW ONE, DO NOT ADD AN API ROUTE.
+- pages:list — one.ie/web/src/lib/resolvers/pages.ts:670. Request { slug }. Returns { pages: [{ slug, title, status, updated_at }] } ordered by updated_at DESC. This is the picker's list. Returns { pages: [] } on any auth denial.
+- pages:add-block — one.ie/web/src/lib/resolvers/pages.ts:630. Request { slug, page, section: { component, props }, atIndex? }. atIndex omitted = append to end, which is what this feature wants. It already runs normalizeBlockProps(BLOCK_SCHEMA, ...) server-side, so send the block's defaultProps verbatim — do NOT normalize on the client.
+
+EXACT CALL-SITE PRECEDENT — copy this shape:
+one.ie/web/src/components/chat/BlockFrame.tsx:112-125. It is the same feature one surface over ('Add to page' from chat). Note its gate: `const canAddToPage = addToPage && !!slug && !!page`, its pending/added state machine, and `emitClick('ui:chat:add-to-page', { component })` before the call. Use `ask` from '@/lib/in/ask'. Emit a sibling signal name, e.g. 'ui:component-browser:add-to-page'.
+
+THE ONE DESIGN DECISION, ALREADY SETTLED — DO NOT RE-OPEN IT.
+/components is a genuinely PUBLIC route. pages/components.astro mounts <ComponentBrowser client:only="react" /> with a plain Layout and passes NO props, and ComponentBrowser takes none. It is NOT one of the slugless console pages: those (see pages/tasks.astro) call resolveRoom() and rewrite to /u/[slug]/..., and components.astro does neither. There is also no workspace-scoped mount — ComponentBrowser appears only in pages/components.astro and is referenced by components/puck/BlockFinder.tsx.
+
+So: derive the workspace slug SERVER-SIDE in pages/components.astro (from Astro.locals.workspaceContext?.workspace ?? Astro.locals.slug — verify which is right against how another workspace-aware page reads it) and pass it down as an optional `slug` prop to ComponentBrowser. When there is no session there is no slug, and the 'Add to page' button MUST NOT RENDER — same gate shape as BlockFrame's canAddToPage. An anonymous visitor keeps exactly today's public gallery, unchanged. Do NOT invent a client-side workspace read, do NOT add a new route, do NOT make /components members-only.
+
+WHERE THE BUTTON GOES
+ComponentBrowser.tsx has two surfaces for a block: the grid card (article, ~line 250) and PreviewModal (~line 143). Put the affordance in the PreviewModal footer at minimum — the modal is the block's detail view and already has a footer row. A card-level quick-add is welcome but must not swallow the card's existing onClick (which opens the preview).
+
+DONE LOOKS LIKE
+1. Signed in, /components → open any block → 'Add to page' → picker lists this workspace's real pages → pick one → success state → 'Edit page' and 'Continue adding components' both present and both work.
+2. The block actually lands: re-open that page in the editor and the block is there, rendered, at the end.
+3. Signed out, /components renders exactly as before with no 'Add to page' button anywhere.
+4. `cd one.ie/web && bun run verify:fast` green. Add a unit test for the picker gate (no slug ⇒ no button).
+
+CONSTRAINTS
+- 6-token palette only (hook:design-check blocks otherwise) — follow the existing var(--color-border) / text-font / bg-foreground idiom in this very file.
+- Do not regress the IntersectionObserver lazy-mount or the PreviewErrorBoundary; the gallery renders ~376 blocks.
+- Edit in a worktree, never on shared main.
+
+RULES, each one a recorded outage (text/factory-do.md § Concurrency):
+1. Work in YOUR OWN worktree, never the shared main tree. Slug: task-task:01a07591e5c350a306c93933.
+   UI task — run:  bash .claude/scripts/worktree-preview.sh up task-task:01a07591e5c350a306c93933 --route /components
+   It cuts the worktree from main, links node_modules CONTENTS (never the dir), copies .env, allocates a port (never sweeps), and hands you a URL only after 3 consecutive 200s. Use the path and URL it prints.
+2. NEVER `bun install` inside the worktree. NEVER symlink node_modules itself.
+3. Make the change the task describes — minimal, in the worktree. Write or extend the test that names the concrete failure this change prevents (input → wrong result). No test that guards a shape.
+4. Run only YOUR test file(s) in the worktree:  cd <wt>/one.ie/web && bunx vitest related --run <files>  — through bash ../../.claude/scripts/gate-run.sh doer -- … . Do NOT run the suite; factory-walk.sh runs the tier's lane after you.
+5. Commit in the worktree by EXPLICIT PATH (git add <file>...), message: "task(task:01a07591e5c350a306c93933): <what was measured>". Never git add -A.
+6. Report files from `git status --porcelain` / `git show --stat` in the worktree, never from memory.
+7. THE BRAIN AND THE EDGE (root CLAUDE.md, LOCKED): if the change adds or touches a receiver, it reads KV / BrainDO JSON — never typedbQuery — and writes to the brain fire-and-forget or via sync/. resolvers/factory.ts is the one exception. Prove the door: bash .claude/scripts/signal-watch.sh --local (with your preview as SIGNAL_WATCH_LOCAL) — a door over budget or reaching for the brain is red, and red closes nothing.
+If the task cannot be done as written, do the part that can, say exactly what you left out and why, and return committed:false rather than inventing scope.

package/scripts/gate-reaper-check.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# gate-reaper-check.sh — what gate-reaper.sh reaps, and what it must never touch.
+#
+# manifest: portable
+#
+# WHY THIS EXISTS (measured 2026-09-05). Five `workerd` processes left behind by
+# dead `astro dev` sessions sat at ppid=1 for 33-63 minutes holding ~196MB, while
+# BOTH gate-reaper and machine-check printed "orphans: none". The reaper keys on
+# a gate SHAPE, and `workerd serve` was not one of the shapes, so nothing in the
+# harness could see them. They had to be found and killed by hand.
+#
+# The reaper's danger is symmetric, and this checker holds both ends:
+#   C1  an abandoned workerd under node_modules IS reaped
+#   C2  a LIVE workerd (parent alive) is NEVER reaped
+#   C3  a freshly reparented workerd is spared — the age floor still applies
+#   C4  a long-lived ppid=1 daemon that merely NAMES a gate word is spared
+#   C5  the pre-existing gate shapes still reap — no regression
+#   C6  a workerd outside node_modules is spared — not ours to kill
+#   R1  RED-PROOF: drop the workerd arm and C1 must FAIL
+#
+# Drives the REAL script with --once --dry-run against a STUBBED `ps`, so it
+# never reads the live process table and never signals anything.
+#
+#   bash .claude/scripts/gate-reaper-check.sh
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+REAPER="$ROOT/.claude/scripts/gate-reaper.sh"
+SANDBOX="$(mktemp -d "${TMPDIR:-/tmp}/gate-reaper-check.XXXXXX")"
+trap 'rm -rf "$SANDBOX"' EXIT
+
+fails=0
+ok()  { printf '  \033[32mPASS\033[0m  %s\n' "$1"; }
+bad() { printf '  \033[31mFAIL\033[0m  %s\n' "$1"; fails=$((fails + 1)); }
+
+WD='node_modules/@cloudflare/workerd-darwin-arm64/bin/workerd serve --binary --experimental'
+
+# The fixture process table. Columns match `ps -Ao pid=,ppid=,etime=,command=`.
+cat > "$SANDBOX/table" <<EOF
+1001 1 45:00 /repo/someapp/web/$WD
+1002 29457 45:00 /repo/someapp/web/$WD
+1003 1 01:00 /repo/someapp/web/$WD
+1004 1 45:00 /Users/toc/bin/cc-connect.sh daemon run verify
+1005 1 45:00 /usr/local/bin/workerd serve --binary --experimental
+1006 1 45:00 bash /repo/.claude/scripts/gate-run.sh verify -- bun run verify
+EOF
+
+# Stub `ps`: serve the fixture for the sweep's -Ao read, and a pgid for lookups.
+mkdir -p "$SANDBOX/bin"
+cat > "$SANDBOX/bin/ps" <<EOF
+#!/usr/bin/env bash
+for a in "\$@"; do case "\$a" in pgid=) echo "  9999"; exit 0 ;; esac; done
+cat "$SANDBOX/table"
+EOF
+chmod +x "$SANDBOX/bin/ps"
+
+run_reaper() { PATH="$SANDBOX/bin:$PATH" bash "$1" --once --dry-run 2>&1; }
+
+echo "── gate-reaper: reaps the abandoned, spares the live ──"
+out="$(run_reaper "$REAPER")"
+
+reaped() { grep -q "WOULD reap pid=$1 " <<<"$out"; }
+
+if reaped 1001; then ok "C1 abandoned workerd under node_modules is reaped"
+else bad "C1 abandoned workerd NOT reaped — the orphan shape is still invisible: $out"; fi
+
+if ! reaped 1002; then ok "C2 live workerd (parent alive) spared"
+else bad "C2 LIVE workerd would be reaped — this kills a running dev server"; fi
+
+if ! reaped 1003; then ok "C3 freshly reparented workerd spared by the age floor"
+else bad "C3 age floor not applied to workerd"; fi
+
+if ! reaped 1004; then ok "C4 ppid=1 daemon naming a gate word is spared"
+else bad "C4 cc-connect daemon would be reaped — exclusions broken"; fi
+
+if reaped 1006; then ok "C5 pre-existing gate-run.sh shape still reaps"
+else bad "C5 REGRESSION — gate-run.sh shape no longer reaped: $out"; fi
+
+if ! reaped 1005; then ok "C6 workerd outside node_modules spared"
+else bad "C6 would reap a workerd this tree did not spawn"; fi
+
+# ── R1  RED-PROOF: without the workerd arm, C1 must fail ─────────────────────
+GUTTED="$SANDBOX/gutted.sh"
+grep -v 'node_modules\*workerd" serve"\*) ;;' "$REAPER" > "$GUTTED"
+if [ "$(wc -l < "$GUTTED")" -eq "$(wc -l < "$REAPER")" ]; then
+  bad "R1 could not remove the workerd arm — anchor moved, this checker is blind"
+else
+  gout="$(run_reaper "$GUTTED")"
+  if grep -q "WOULD reap pid=1001 " <<<"$gout"; then
+    bad "R1 gutted reaper STILL reaped 1001 — C1 is not testing the new arm"
+  else
+    ok "R1 red-proof: without the arm 1001 is missed, so C1 has teeth"
+  fi
+fi
+
+echo
+if [ $fails -eq 0 ]; then echo "ALL GREEN — the reaper sees orphaned workerd and still spares live work"; exit 0; fi
+echo "RED — $fails check(s) failed"; exit 1

package/scripts/gate-reaper.sh

@@ -82,6 +82,15 @@ sweep() {
       *"tsc --noEmit"*) ;;
       *"astro check"*) ;;
       *"run verify"*|*"run test"*|*"run typecheck"*) ;;
+      # An `astro dev` / `wrangler dev` that dies leaves its workerd child behind,
+      # reparented and holding ~40MB for as long as the box is up. FIVE of them
+      # accumulated in one hour on 2026-09-05 (ages 33-63min, ~196MB) while both
+      # this reaper and machine-check reported "orphans: none" -- neither knew the
+      # shape, so nothing in the harness could see them. A LIVE workerd always has
+      # a live parent (astro dev, or wrangler), so the ppid==1 test above already
+      # spares it; the node_modules anchor keeps this to runtimes THIS tree spawned
+      # and away from any workerd a user runs by hand.
+      *node_modules*workerd" serve"*) ;;
       *) continue ;;
     esac
     # Belt and braces: never a daemon, an editor, or anything system-owned, even