@oneie/claude 0.8.0 → 0.9.0

package/scripts/land.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# land.sh — a finished fleet branch to dev.one.ie in one command.
+# land.sh — a finished branch into `dev` in one command. `--to main` overrides.
 #
 #   bash .claude/scripts/land.sh feat/campaign-one
 #   bash .claude/scripts/land.sh feat/campaign-one --deploy   # also ship dev
@@ -12,9 +12,9 @@
 # was being done by hand, once per fleet, and it is the slow part.
 #
 # THE ORDER IS THE POINT:
-#   1  merge main INTO the branch, in the branch's own worktree     (cheap, isolated)
+#   1  merge $TRUNK (dev) INTO the branch, in its own worktree     (cheap, isolated)
 #   2  run the FAST gate there                                      (the dev-tier gate)
-#   3  only then fast-forward main                                  (main never breaks)
+#   3  only then fast-forward $TRUNK                                (dev never breaks)
 #   4  optionally ./deploy dev                                      (fast lane again)
 # Merging main into the branch first means a conflict or a red gate is discovered
 # on the BRANCH, where it costs nothing, instead of on main, where every other
@@ -22,22 +22,99 @@
 #
 # What it will NOT do: touch production. Promotion to one.ie is `./deploy`, a
 # full gate and a human decision. A fast pass is never reported as a full pass.
+#
+# --- THE OTHER DOOR: --pr ----------------------------------------------------
+#   bash .claude/scripts/land.sh feat/x --pr        # open/update a PR, do not touch main
+#
+# `--pr` swaps step 3 for a pull request, and it also SKIPS STEP 1 — deliberately,
+# because the two orders answer different questions. Landing merges main into the
+# branch first so a conflict is discovered where it costs nothing; a PR wants the
+# branch as the author wrote it, so GitHub computes the merge and the diff a
+# reviewer reads is what this branch added and nothing else. Merging main in
+# first would put trunk's own commits in the PR and make the branch
+# non-fast-forwardable at the same time.
+#
+# So the gate under `--pr` proves LESS than the gate under a land: it says the
+# branch is green on its own, not that it survives the trunk. The body says so,
+# and reports how far trunk has moved plus whether the merge is clean
+# (`git merge-tree`, which computes without mutating anything).
+#
+# --- --pr --deploy: run it before you propose it ------------------------------
+#   bash .claude/scripts/land.sh feat/x --pr --deploy --probe /pricing
+#
+# The full workflow, in one command and in this order:
+#
+#   gate (fast lane, in the branch's worktree)
+#     → ship THAT WORKTREE to dev.one.ie
+#     → prove the routes against dev, with the landing rule
+#     → open/update the PR, carrying the dev URL and the probe verdict
+#
+# The pair used to be refused, and the refusal was right while `--deploy` meant
+# "ship main after the fast-forward" — a PR lands nothing, so there was nothing
+# to ship. What makes it work now is a property of `deploy-dev.sh`, not a flag:
+# it derives its own ROOT from `${BASH_SOURCE[0]}/../..`, so invoking THE
+# WORKTREE'S COPY ships the worktree's tree. `$wt/.claude/scripts/deploy-dev.sh`
+# puts the BRANCH on dev.one.ie; `$ROOT`'s copy would have put main there and
+# called it the branch.
+#
+# The probe is `do-prove.sh` with both its bases pinned to dev, never curl.
+# do-prove carries the LANDING RULE — a route counts only if the run ENDED on
+# the path asked for — and deploy-dev.sh's own check is `curl / -> 200`, which
+# a redirect to /signin satisfies. Both bases are pinned because do-prove falls
+# back to PROVE_PROD_URL (https://one.ie by default) when its dev base does not
+# answer: an unreachable dev would otherwise quietly prove PRODUCTION and report
+# it as the branch passing. And `PROVE: skipped` exits 0, so the route COUNT is
+# read, not the exit code — an unrun probe is not a pass.
+#
+# dev.one.ie IS ONE SLOT, and it reads and writes production's rows. So this door
+# takes exactly one branch: two branches would mean the second overwrites the
+# first while the first is still being "tested". It is also why nothing here
+# touches production — promotion to one.ie is `./deploy`, a full gate, a human.
+#
+# The body is `pr-body.sh` — every number derived from git at PR time. Re-running
+# is the normal case, not the edge case: an existing open PR is UPDATED, never
+# duplicated.
 set -uo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 cd "$ROOT" || exit 1
 
-DEPLOY=0 DRY=0 QUICK=0 BRANCHES=()
+# TRUNK is what a branch LANDS INTO; PR_BASE is what `dev` is RELEASED into.
+# They are deliberately different: branches integrate on dev and main receives a
+# pull request (root CLAUDE.md § the loop). Before 2026-09-06 both were `main`,
+# so nothing ever advanced dev and it fell behind by construction — 5 commits one
+# way, 8 the other, undetected until someone asked.
+TRUNK="${LAND_TRUNK:-dev}"
+DEPLOY=0 DRY=0 QUICK=0 PR=0 PR_BASE="main" BRANCHES=() PROBES=()
 for a in "$@"; do
   case "$a" in
     --deploy) DEPLOY=1 ;;
     --quick) QUICK=1 ;;
+    --pr) PR=1 ;;
+    --to) LAND_TRUNK_ARG=1 ;;
+    --probe) WANT_PROBE=1 ;;
     -n|--dry-run) DRY=1 ;;
-    -h|--help) sed -n '2,30p' "${BASH_SOURCE[0]}"; exit 0 ;;
+    -h|--help) sed -n '2,80p' "${BASH_SOURCE[0]}"; exit 0 ;;
     -*) echo "land.sh: unknown flag '$a'" >&2; exit 2 ;;
-    *) BRANCHES+=("$a") ;;
+    *) if [[ "${WANT_PROBE:-0}" == 1 ]]; then PROBES+=("$a"); WANT_PROBE=0;
+       elif [[ "${LAND_TRUNK_ARG:-0}" == 1 ]]; then TRUNK="$a"; LAND_TRUNK_ARG=0;
+       else BRANCHES+=("$a"); fi ;;
   esac
 done
+[[ "${WANT_PROBE:-0}" == 1 ]] && { echo "land.sh: --probe needs a route" >&2; exit 2; }
 (( ${#BRANCHES[@]} )) || { echo "land.sh: name at least one branch" >&2; exit 2; }
+# --pr --deploy is the full workflow (gate -> dev -> probe -> PR) and it ships
+# the BRANCH's worktree, not main. dev.one.ie is one slot, so it takes one branch:
+# with two, the second overwrites the first while the first is being probed.
+if (( PR && DEPLOY )) && (( ${#BRANCHES[@]} > 1 )); then
+  echo "land.sh: --pr --deploy ships one branch to dev.one.ie — name one, not ${#BRANCHES[@]}" >&2
+  exit 2
+fi
+# --probe only means anything when something was shipped to probe.
+if (( ${#PROBES[@]} )) && ! (( PR && DEPLOY )); then
+  echo "land.sh: --probe needs --pr --deploy (there is nothing on dev to probe otherwise)" >&2
+  exit 2
+fi
+(( PR )) && ! command -v gh >/dev/null 2>&1 && { echo "land.sh: --pr needs the gh CLI" >&2; exit 2; }
 
 GRN=$'\033[32m'; RED=$'\033[31m'; YEL=$'\033[33m'; DIM=$'\033[2m'; OFF=$'\033[0m'
 [[ -t 1 ]] || { GRN=""; RED=""; YEL=""; DIM=""; OFF=""; }
@@ -55,10 +132,40 @@ worktree_of() {
     | head -1
 }
 
-LANDED=() FAILED=() LANDED_QUICK=0
+LANDED=() FAILED=() LANDED_QUICK=0 PRS=() DEV_NOTE="" DEV_URL="https://dev.one.ie"
+BR_T0=0 GATE_T=0 DEV_T=0 PROBE_T=0 PR_T=0; PH=()
+
+# The record the /deploy page renders. A RED run is the one most worth a timing —
+# a record holding only successes cannot be read for a trend, and the phase that
+# refused is exactly what a reader wants to see. It can never change an exit
+# status: the whole call is `|| true`.
+_land_record() { # <branch> <verdict>
+  [[ -x "$ROOT/.claude/scripts/deploy-record.sh" ]] || return 0
+  (( DRY )) && return 0
+  local door="land"
+  (( PR )) && door="$door --pr"
+  (( DEPLOY )) && door="$door --deploy"
+  local target="$TRUNK"
+  (( PR && DEPLOY )) && target="$DEV_URL"
+  local -a args=(--door "$door" --branch "$1" --verdict "$2" --target "$target"
+                 --sha "$(git -C "$ROOT" rev-parse --short "$1" 2>/dev/null || echo '')"
+                 --wall "$(( SECONDS - BR_T0 ))")
+  local p; for p in ${PH[@]+"${PH[@]}"}; do args+=(--phase "$p"); done
+  bash "$ROOT/.claude/scripts/deploy-record.sh" "${args[@]}" >/dev/null 2>&1 || true
+  # The same nudge deploy.sh prints. This door is where it is cheapest to act
+  # on: land runs many times a day, the operator already has the worktrees open,
+  # and once the rows are committed on one the message degrades to the very
+  # command being typed here — `land.sh <branch>`. Note ROOT is MAIN's tree (run
+  # MAIN's copy), so --land itself is refused here; the message says where to go.
+  # Never fatal — `|| true`, like the record call above it.
+  local pend; pend="$(bash "$ROOT/.claude/scripts/deploy-record.sh" --pending 2>/dev/null)" || true
+  [[ -n "$pend" ]] && say "$pend"
+  return 0
+}
 
 for br in "${BRANCHES[@]}"; do
   step "land $br"
+  BR_T0=$SECONDS; PH=(); GATE_T=0; DEV_T=0; PROBE_T=0; PR_T=0
 
   git show-ref --verify --quiet "refs/heads/$br" || { bad "no such branch"; FAILED+=("$br: missing"); continue; }
 
@@ -73,37 +180,54 @@ for br in "${BRANCHES[@]}"; do
   say "  worktree: $wt"
 
   # 1 — main INTO the branch. A conflict surfaces here, not on main.
-  if (( DRY )); then say "  [dry] (cd $wt && git merge main)"
+  # Skipped under --pr: a reviewer must see what this branch added, not what
+  # trunk did while it built, and a branch with main merged in is no longer
+  # fast-forwardable. `pr-body.sh` reports mergeability without mutating.
+  if (( PR )); then say "  ${DIM}step 1 skipped — a PR shows the branch as written${OFF}"
+  elif (( DRY )); then say "  [dry] (cd $wt && git merge $TRUNK)"
   else
-    if ! ( cd "$wt" && git merge --no-edit main >/dev/null 2>&1 ); then
-      bad "merge conflict with main — resolve in $wt"
+    if ! ( cd "$wt" && git merge --no-edit "$TRUNK" >/dev/null 2>&1 ); then
+      bad "merge conflict with $TRUNK — resolve in $wt"
       ( cd "$wt" && git merge --abort >/dev/null 2>&1 )
-      FAILED+=("$br: conflict"); continue
+      FAILED+=("$br: conflict")
+      _land_record "$br" red; continue
     fi
-    ok "merged main into $br"
+    ok "merged $TRUNK into $br"
   fi
 
-  # 1.5 — the worktree SDK trap. A fleet worktree has no packages/sdk/node_modules,
-  # so `verify:fast`'s first step (sdk build) dies on missing @noble/@scure types —
-  # reported as a RED gate when nothing is wrong with the code. `bun install` here
-  # is NOT the fix: it re-points main's one.ie/web/node_modules/@oneie/sdk at this
+  # 1.5 — the worktree node_modules trap. A fresh worktree has none, so every
+  # gate that resolves through a service package dies on an import and reports a
+  # RED gate when nothing is wrong with the code. `bun install` here is NOT the
+  # fix: it re-points main's one.ie/web/node_modules/@oneie/sdk at this
   # worktree's dist-less SDK and breaks the shared tree. A symlink to main's
   # already-installed deps is read-only reuse and costs nothing.
-  if [[ -d "$wt/packages/sdk" && ! -e "$wt/packages/sdk/node_modules" && -d "$ROOT/packages/sdk/node_modules" ]]; then
-    if (( DRY )); then say "  [dry] ln -s $ROOT/packages/sdk/node_modules $wt/packages/sdk/node_modules"
-    else ln -s "$ROOT/packages/sdk/node_modules" "$wt/packages/sdk/node_modules" && ok "linked sdk node_modules (no bun install — that clobbers main)"
+  #
+  # ENUMERATED FROM THE TREE, not from a list. This started as two hardcoded
+  # directories — packages/sdk, then one.ie/web — each added after somebody's
+  # branch went falsely red, and on 2026-09-05 it went red a third time for
+  # `channels/` and `pay/backend/`: four suites under one.ie/web import
+  # `channels/src/tools/pages.ts`, which imports `zod`, which a worktree without
+  # channels/node_modules cannot resolve. The gate said `fast gate RED` and the
+  # branch it was blaming contained nothing but shell scripts. Asking git for
+  # every tracked package.json learns the next service without being told.
+  while IFS= read -r pj; do
+    d="$(dirname "$pj")"
+    [[ "$d" == "." ]] && continue
+    [[ -d "$ROOT/$d/node_modules" ]] || continue
+    [[ -e "$wt/$d/node_modules" ]] && continue
+    if (( DRY )); then say "  [dry] ln -s $ROOT/$d/node_modules $wt/$d/node_modules"
+    else
+      mkdir -p "$wt/$d"
+      ln -s "$ROOT/$d/node_modules" "$wt/$d/node_modules" && ok "linked $d/node_modules (no bun install — that clobbers main)"
     fi
-  fi
+  done < <(git -C "$ROOT" ls-files -- '*package.json' ':!:**/node_modules/**' 2>/dev/null || true)
 
-  # 1.55 — web node_modules. A fresh land worktree has none; tsc then fails
-  # `File 'astro/tsconfigs/strict' not found`. Same rule as sdk: symlink main.
+  # 1.55 — one.ie/web is the one that can be present but INCOMPLETE (a partial
+  # install leaves the directory there, so the `-e` test above passes and tsc
+  # still fails `File 'astro/tsconfigs/strict' not found`). Repair it by hand.
   if [[ -d "$ROOT/one.ie/web/node_modules/astro/tsconfigs" ]]; then
     webnm="$wt/one.ie/web/node_modules"
-    if [[ ! -e "$webnm" ]]; then
-      if (( DRY )); then say "  [dry] ln -s $ROOT/one.ie/web/node_modules $webnm"
-      else ln -s "$ROOT/one.ie/web/node_modules" "$webnm" && ok "linked web node_modules"
-      fi
-    elif [[ ! -e "$webnm/astro/tsconfigs/strict.json" ]]; then
+    if [[ -e "$webnm" && ! -e "$webnm/astro/tsconfigs/strict.json" ]]; then
       if (( DRY )); then say "  [dry] replace incomplete $webnm with main's"
       else
         rm -rf "$webnm"
@@ -120,6 +244,34 @@ for br in "${BRANCHES[@]}"; do
     fi
   fi
 
+  # 1.57 — src/lib/generated/ is the same trap one directory over, and it bit a
+  # fresh land worktree on 2026-09-05: `page-modified.json` is written by
+  # `gen:page-modified` (a step of `verify`, never of a bare checkout), so tsc
+  # stopped at TS2307 and the branch read RED with nothing wrong in it.
+  #
+  # Linking the DIRECTORY does not work and the first attempt at this proved it:
+  # `src/lib/generated/` is tracked (it holds `substrate-client.ts`), so the
+  # worktree already has the directory and only the gitignored files inside it
+  # are missing. `! -e` on the directory is therefore always false, the link
+  # never fires, and the gate stays red for a reason nothing in the output names.
+  #
+  # So ask git which files it IGNORES under that path and link those. That still
+  # learns a new generator without this script being told about it — the failure
+  # mode of the enumerated approach (1.55, 1.56, each added one file at a time
+  # after somebody's branch went falsely red) is what this avoids.
+  gendir="one.ie/web/src/lib/generated"
+  if [[ -d "$ROOT/$gendir" ]]; then
+    while IFS= read -r rel; do
+      [[ -n "$rel" ]] || continue
+      [[ -e "$wt/$rel" ]] && continue
+      if (( DRY )); then say "  [dry] ln -s $rel"
+      else
+        mkdir -p "$(dirname "$wt/$rel")"
+        ln -s "$ROOT/$rel" "$wt/$rel" && ok "linked ${rel#one.ie/web/src/lib/} (gen:* output a checkout never has)"
+      fi
+    done < <(git -C "$ROOT" ls-files --others --ignored --exclude-standard -- "$gendir" 2>/dev/null || true)
+  fi
+
   # 1.6 — the same gap, one layer up: a worktree has no one.ie/web/.env, so
   # GATEWAY_API_KEY is unset and every real-substrate suite SKIPS. A skipped suite
   # is NOT a passing suite — the gate would go green having never run the substrate
@@ -147,7 +299,8 @@ for br in "${BRANCHES[@]}"; do
       warn "gate: TYPECHECK ONLY (--quick) — weaker than the fast lane, never a full pass"
       if ! ( cd "$wt/one.ie/web" && bash "$ROOT/.claude/scripts/gate-run.sh" quicktsc -- npx tsc --noEmit ); then
         bad "typecheck RED on $br — not landing it"
-        FAILED+=("$br: tsc red"); continue
+        FAILED+=("$br: tsc red")
+        _land_record "$br" red; continue
       fi
       ok "typecheck green (tests NOT run)"
       LANDED_QUICK=1
@@ -155,27 +308,214 @@ for br in "${BRANCHES[@]}"; do
     say "  gate: FAST LANE (not a full pass)"
     if ! ( cd "$wt/one.ie/web" && bun run verify:fast ); then
       bad "fast gate RED on $br — not landing it"
-      FAILED+=("$br: gate red"); continue
+      FAILED+=("$br: gate red")
+      _land_record "$br" red; continue
     fi
     ok "fast gate green"
     fi
+    GATE_T=$(( SECONDS - BR_T0 ))
+    PH+=("$( (( QUICK )) && printf 'tsc only' || printf 'fast gate' ):0:$GATE_T:gate:pass")
   fi
 
-  # 3 — fast-forward main only. A non-ff means main moved under us: re-run.
-  if (( DRY )); then say "  [dry] git merge --ff-only $br"
+  # 2.5 — run it before proposing it. Only under `--pr --deploy`: ship THIS
+  # WORKTREE to dev.one.ie, then prove the routes there. A PR whose branch has
+  # never been executed is a diff, not a proposal.
+  if (( PR && DEPLOY )); then
+    step "dev.one.ie ← $br"
+    if (( DRY )); then
+      say "  [dry] (cd $wt && DEV_SKIP_GATE=$(( QUICK ? 0 : 1 )) bash $wt/.claude/scripts/deploy-dev.sh)"
+      dry_probe=""
+      for r in ${PROBES[@]+"${PROBES[@]}"}; do dry_probe="$dry_probe --route $r"; done
+      [[ -n "$dry_probe" ]] || dry_probe=" --route /"
+      say "  [dry] PROVE_BASE_URL=$DEV_URL PROVE_PROD_URL=$DEV_URL do-prove.sh$dry_probe"
+      DEV_NOTE="$DEV_URL — not run (dry run)"
+    else
+      # The worktree's OWN copy. $ROOT's would ship main and call it the branch.
+      # The gate is skipped here because step 2 just ran it in this same tree —
+      # except under --quick, where step 2 ran tsc only and is NOT the fast lane,
+      # so deploy-dev.sh must run its own before anything reaches dev.
+      if ! ( cd "$wt" && DEV_SKIP_GATE=$(( QUICK ? 0 : 1 )) bash "$wt/.claude/scripts/deploy-dev.sh" ); then
+        bad "dev deploy failed for $br — not opening a PR for code that will not ship"
+        FAILED+=("$br: dev deploy")
+        _land_record "$br" red; continue
+      fi
+      ok "shipped $br to $DEV_URL"
+      DEV_T=$(( SECONDS - BR_T0 - GATE_T ))
+      PH+=("ship dev:$GATE_T:$DEV_T:ship:pass")
+
+      # The probe. Both bases pinned to dev: do-prove falls back to
+      # PROVE_PROD_URL when its dev base is silent, and an unreachable dev would
+      # otherwise prove https://one.ie and report it as this branch passing.
+      probe_args=()
+      for r in ${PROBES[@]+"${PROBES[@]}"}; do probe_args+=(--route "$r"); done
+      (( ${#probe_args[@]} )) || probe_args=(--route /)
+      say "  probe: ${probe_args[*]} (landing rule, signed-out)"
+      probe_out="$( cd "$wt" && PROVE_BASE_URL="$DEV_URL" PROVE_PROD_URL="$DEV_URL" \
+        bash "$wt/.claude/scripts/do-prove.sh" "${probe_args[@]}" 2>&1 )"
+      printf '%s\n' "$probe_out" | sed 's/^/    /'
+      # Read the ROUTE COUNT, not the exit code: `PROVE: skipped (no reachable
+      # environment)` exits 0, and an unrun probe is not a pass.
+      proven="$(printf '%s' "$probe_out" | sed -n 's/^PROVE: pass (\([0-9][0-9]*\) route.*/\1/p' | tail -1)"
+      if [[ -z "$proven" || "$proven" -lt 1 ]]; then
+        bad "probe did not prove a single route on dev — not opening a PR"
+        FAILED+=("$br: probe")
+        _land_record "$br" red; continue
+      fi
+      ok "proved $proven route(s) on $DEV_URL"
+      PROBE_T=$(( SECONDS - BR_T0 - GATE_T - DEV_T ))
+      PH+=("probe dev:$(( GATE_T + DEV_T )):$PROBE_T:probe:pass")
+      DEV_NOTE="$DEV_URL — $proven route(s) proven signed-out (landing rule); dev shares production's data"
+    fi
+  fi
+
+  # 3 — the door. Either main fast-forwards to the branch, or the branch becomes
+  # a pull request. Never both: a PR that has already been merged into main is a
+  # PR with nothing to review.
+  if (( PR )); then
+    # The gate label is PASSED to pr-body.sh rather than inferred by it. That
+    # script runs no gate and must never imply one; what actually ran is known
+    # only here, and --quick has to say out loud that it is weaker.
+    gate_label="fast lane (green) — branch only, trunk not merged in"
+    (( QUICK )) && gate_label="typecheck only (--quick) — NOT the fast lane, never a full pass"
+    (( DRY )) && gate_label="not run (dry run)"
+
+    if (( DRY )); then
+      say "  [dry] git push -u origin $br"
+      say "  [dry] gh pr create --base $PR_BASE --head $br --title \"$(bash "$ROOT/.claude/scripts/pr-body.sh" "$br" --base "$PR_BASE" --title 2>/dev/null)\""
+      say "  [dry] (body from pr-body.sh — $(bash "$ROOT/.claude/scripts/pr-body.sh" "$br" --base "$PR_BASE" 2>/dev/null | wc -l | tr -d ' ') lines${DEV_NOTE:+, + dev line})"
+      PRS+=("$br: [dry]")
+    else
+      if ! git push -u origin "$br" >/dev/null 2>&1; then
+        bad "could not push $br to origin"
+        FAILED+=("$br: push"); continue
+      fi
+      ok "pushed $br"
+
+      body_file="$(mktemp)"
+      # --dev is passed only when something was actually shipped and probed.
+      # pr-body.sh renders no line without it, which is the honest default: a PR
+      # silent about dev is a PR whose branch was never run.
+      dev_args=()
+      [[ -n "$DEV_NOTE" ]] && dev_args=(--dev "$DEV_NOTE")
+      bash "$ROOT/.claude/scripts/pr-body.sh" "$br" --base "$PR_BASE" --gate "$gate_label" \
+        ${dev_args[@]+"${dev_args[@]}"} > "$body_file" 2>/dev/null
+      title="$(bash "$ROOT/.claude/scripts/pr-body.sh" "$br" --base "$PR_BASE" --title 2>/dev/null)"
+      [ -s "$body_file" ] || { bad "pr-body.sh produced nothing for $br"; rm -f "$body_file"; FAILED+=("$br: body"); continue; }
+
+      # Idempotent by design. A re-run after "main moved", a second cycle on the
+      # same branch, or simply landing twice must UPDATE the open PR — creating
+      # is what fails when one already exists, so ask first.
+      existing="$(gh pr list --head "$br" --base "$PR_BASE" --state open --json number \
+        --jq '.[0].number' 2>/dev/null || true)"
+      if [ -n "$existing" ]; then
+        if gh pr edit "$existing" --title "$title" --body-file "$body_file" >/dev/null 2>&1; then
+          url="$(gh pr view "$existing" --json url --jq .url 2>/dev/null || echo "#$existing")"
+          ok "updated PR $url"
+          PRS+=("$br: $url (updated)")
+        else
+          bad "could not update PR #$existing for $br"
+          FAILED+=("$br: pr edit")
+        fi
+      else
+        if url="$(gh pr create --base "$PR_BASE" --head "$br" --title "$title" --body-file "$body_file" 2>&1 | tail -1)"; then
+          ok "opened PR $url"
+          PRS+=("$br: $url")
+        else
+          bad "could not open a PR for $br: $url"
+          FAILED+=("$br: pr create")
+        fi
+      fi
+      rm -f "$body_file"
+    fi
+    # The PR path returns here, BEFORE the `LANDED+=` record below — so without
+    # this line a green `--pr` run recorded nothing and the page showed only the
+    # runs that failed. Measured on the first green run of this door: PR #35
+    # opened, 768s of real work, and the record stayed empty.
+    PR_T=$(( SECONDS - BR_T0 - GATE_T - DEV_T - PROBE_T ))
+    PH+=("open PR:$(( GATE_T + DEV_T + PROBE_T )):$PR_T:pr:pass")
+    _land_record "$br" green
+    continue
+  fi
+
+  if (( DRY )); then say "  [dry] advance $TRUNK to $br (in its worktree if it has one, else git fetch .)"
   else
-    if ! git merge --ff-only "$br" >/dev/null 2>&1; then
-      warn "main moved — re-run land.sh for $br"
-      FAILED+=("$br: main moved"); continue
+    # Advance $TRUNK WITHOUT MOVING HEAD in the shared tree. Switching HEAD here
+    # is what `hook:branch-pin` refuses and the canon forbids: concurrent
+    # sessions get pulled onto each other's branches. Two ways to avoid it, and
+    # which applies is decided by git, not by taste:
+    #   * $TRUNK is checked out in a worktree -> `fetch .` REFUSES it outright
+    #     ("refusing to fetch into branch ... checked out at ..."), so
+    #     fast-forward inside that worktree instead.
+    #   * $TRUNK is checked out nowhere -> there is no worktree to run in, so
+    #     move the ref with `fetch .`, which refuses a non-fast-forward exactly
+    #     as `merge --ff-only` does.
+    # Measured 2026-09-06: dev IS checked out at .claude/worktrees/dev on this
+    # box, so the fetch-only version of this failed on its first real use.
+    TRUNK_WT="$(git worktree list --porcelain \
+      | awk -v b="refs/heads/$TRUNK" '/^worktree /{w=$2} $0=="branch "b{print w; exit}')"
+    # CAPTURE the error, never swallow it. Until 2026-09-09 both forms ended in
+    # `>/dev/null 2>&1` and EVERY failure printed "$TRUNK moved", which is the
+    # wrong diagnosis most of the time on this box: $TRUNK is checked out in a
+    # worktree OTHER SESSIONS EDIT, so a fast-forward is refused whenever one of
+    # them holds an uncommitted file this branch also touches. Measured that day
+    # — three consecutive lands reported "dev moved" while `dev` was 0 commits
+    # behind the branch; the real error was only visible by running the merge by
+    # hand:
+    #     error: Your local changes to the following files would be overwritten
+    #     by merge:  one.ie/web/src/data/deploy-runs.json
+    # "moved" sends you to re-run (which fails identically, forever); the truth
+    # sends you to one named file. A wrong diagnosis costs more than no
+    # diagnosis, because it is actionable in the wrong direction.
+    if [[ -n "$TRUNK_WT" ]]; then
+      _adv() { git -C "$TRUNK_WT" merge --ff-only "$br" 2>&1; }
+    else
+      _adv() { git fetch . "$br:$TRUNK" 2>&1; }
     fi
-    ok "main fast-forwarded to $br"
+    if ! adv_err="$(_adv)"; then
+      # Three causes, and they need three different next moves.
+      if [[ "$adv_err" == *"would be overwritten by merge"* || "$adv_err" == *"local changes"* ]]; then
+        # Name the files. `git` already listed them; pass them straight through
+        # rather than re-deriving, so this cannot drift from what git checked.
+        dirty="$(printf '%s\n' "$adv_err" | sed -n 's/^\t//p' | tr '\n' ' ')"
+        warn "$TRUNK's worktree ($TRUNK_WT) has UNCOMMITTED changes to: ${dirty:-<see below>}"
+        warn "  $TRUNK did NOT move — the fast-forward was refused by a dirty tree."
+        warn "  Another session is likely mid-edit there. Do not blanket-restore:"
+        warn "  check whether those files' contents are already in $br, and clear"
+        warn "  only the paths that are (git checkout -- <path>), never -A."
+        FAILED+=("$br: $TRUNK worktree dirty"); continue
+      fi
+      if [[ "$adv_err" == *"non-fast-forward"* || "$adv_err" == *"Not possible to fast-forward"* || "$adv_err" == *"diverge"* ]]; then
+        warn "$TRUNK genuinely moved — merge it in and re-run land.sh for $br"
+        FAILED+=("$br: $TRUNK moved"); continue
+      fi
+      warn "could not advance $TRUNK — git said:"
+      printf '%s\n' "$adv_err" | sed 's/^/    /' >&2
+      FAILED+=("$br: advance failed"); continue
+    fi
+    # READ THE REF BACK. A successful --ff-only is not proof the branch is IN
+    # main a moment later: several sessions land into one shared tree, and on
+    # 2026-09-05 two of these printed "main fast-forwarded to feat/deploy-page"
+    # while main's reflog recorded a NEIGHBOUR's branch name at the very sha
+    # this script had just reported. Twelve commits sat outside main for an hour
+    # and were reported as landed, twice, because the script trusted its own
+    # exit code over the ref. `git merge` succeeding is a claim; the branch
+    # being an ancestor of main is the fact.
+    if ! git merge-base --is-ancestor "$br" "$TRUNK"; then
+      bad "$TRUNK does NOT contain $br after a clean fast-forward — a concurrent land overwrote it"
+      say "  $TRUNK is now $(git rev-parse --short "$TRUNK"); $br is $(git rev-parse --short "$br")"
+      FAILED+=("$br: ff did not hold"); _land_record "$br" red; continue
+    fi
+    ok "$TRUNK fast-forwarded to $br (verified: $TRUNK contains $(git rev-parse --short "$br"))"
   fi
 
   LANDED+=("$br")
+  _land_record "$br" green
 done
 
-# 4 — one dev deploy for the whole batch, not one per branch.
-if (( DEPLOY )) && (( ${#LANDED[@]} )); then
+# 4 — one dev deploy for the whole batch, not one per branch. Not under --pr:
+# that path already shipped the branch's own worktree in step 2.5, and this would
+# overwrite it with main — the tree the PR is NOT proposing.
+if (( DEPLOY )) && ! (( PR )) && (( ${#LANDED[@]} )); then
   step "deploy dev"
   if (( DRY )); then say "  [dry] bash .claude/scripts/deploy.sh dev"
   else
@@ -185,9 +525,27 @@ fi
 
 step "report"
 (( ${#LANDED[@]} )) && ok "landed: ${LANDED[*]}"
+if (( ${#PRS[@]} )); then
+  for p in "${PRS[@]}"; do ok "pr: $p"; done
+fi
 (( LANDED_QUICK )) && warn "typecheck-only gate was used — run the full suite before ./deploy to production"
 (( ${#FAILED[@]} )) && bad "failed: ${FAILED[*]}"
-(( ${#FAILED[@]} )) && exit 1
+# --only dims,feedback is deliberate. A BRANCH NAME is not a plan slug: without
+# --tid the task leg resolves by the `slug:` tag and would close whatever plan
+# happens to share the name. And land runs the FAST lane, so the receipt gate is
+# unrun on every land — filing that would fire a row on every land forever, with
+# nothing anyone can do, which is the EXPIRED class deploy-record.sh names. The
+# pheromone is the part that is true here.
+# Close the loop on BOTH exits — a red land is an outcome, not an absence of one.
+# `|| true` on purpose: a logging debt must never change what the merge door did.
+(( ${#FAILED[@]} )) && { bash "$(dirname "${BASH_SOURCE[0]}")/do-close.sh" "${BRANCHES[0]##*/}" --status failed --only dims,feedback || true; exit 1; }
 say ""
-say "  dev only. Promote to production with: ./deploy   (full gate, human decision)"
+if (( PR )); then
+  say "  Nothing landed — these are pull requests. main is untouched."
+  say "  The gate that ran proves the branch is green ON ITS OWN, not that it survives the trunk."
+  [[ -n "$DEV_NOTE" ]] && say "  Running on dev: $DEV_URL — dev shares production's DATA. Merge the PR, then ./deploy."
+else
+  say "  dev only. Promote to production with: ./deploy   (full gate, human decision)"
+fi
+bash "$(dirname "${BASH_SOURCE[0]}")/do-close.sh" "${BRANCHES[0]##*/}" --only dims,feedback || true
 exit 0

package/scripts/lib/gc-finished.sh

@@ -0,0 +1,77 @@
+#!/bin/bash
+# gc-finished.sh — "is this branch's work already on the platform?"
+#
+# ONE definition, sourced by both the sweep (do-auto.sh --gc) and its red proof
+# (gc-content-check.sh). The matcher for hook:governor-escape lives in a shared
+# lib for the same reason: a checker that re-implements what it checks proves
+# only that two copies agree.
+#
+# NOT `rev-list --count BASE..branch`. That counts COMMITS, and a branch whose
+# patch reached BASE under a different sha — cherry-picked, rebased, landed by a
+# squash — keeps commits of its own for ever. Measured 2026-09-07 on this repo:
+# fix/webhook-500's single patch was already in dev under another sha, so the
+# count read "1 unmerged" and the sweep had been keeping a ~120MB checkout of
+# work the platform already had. A sweep that cannot recognise its own work is
+# not a sweep, it is a hoard.
+#
+# `git cherry` is the obvious fix and is NOT sufficient alone. A MERGE commit
+# carries no patch of its own, so cherry reports 0-new for a branch that holds
+# content nothing else has — merge/trunk-reconcile, the same day, 24 files and
+# 3416 lines dev had never seen. Sweeping on cherry would have deleted the only
+# checkout of a hand-made merge resolution.
+#
+# The predicate true in BOTH cases is content identity: every path the branch
+# touched since the merge base is now byte-identical in BASE. A rebased duplicate
+# passes; a merge carrying unique files fails; an ordinary unlanded branch fails.
+
+# gc_finished <base> <branch> -> 0 = finished (its content is in base), 1 = not
+gc_finished() {
+  local base="$1" b="$2"
+  local -a paths=()
+  # Paths the branch changed since the merge base. `...` (three dots) is the
+  # load-bearing part: `..` would also list what BASE changed underneath it, and
+  # a busy trunk would then make every branch look like it carries everything.
+  while IFS= read -r f; do [ -n "$f" ] && paths+=("$f"); done < <(git diff --name-only "${base}...${b}" 2>/dev/null)
+  # A branch that changed nothing since the merge base is finished by definition.
+  [ ${#paths[@]} -eq 0 ] && return 0
+  # Compare those paths as they stand NOW in each tip. --quiet exits 1 on any
+  # difference, which is the answer, not an error — never let `set -e` see it.
+  git diff --quiet "$base" "$b" -- "${paths[@]}" 2>/dev/null
+}
+
+# gc_carries <base> <branch> — how many paths the BRANCH still carries that base
+# does not have. This is the number the sweep prints, so it has to mean what it
+# says: `git diff --name-only base branch | wc -l` (two dots) counts everything
+# that differs in EITHER direction, so a branch adding one file to a trunk that
+# has moved on by 500 commits reports "carries 508 paths". Measured on this repo
+# 2026-09-07: fix/webhook-500-again touches ONE file and read 508. The paths that
+# belong to the branch are the ones it changed since the merge base AND that
+# still differ from base now — the same set gc_finished tests.
+gc_carries() {
+  local base="$1" b="$2" n=0 f
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    git diff --quiet "$base" "$b" -- "$f" 2>/dev/null || n=$((n+1))
+  done < <(git diff --name-only "${base}...${b}" 2>/dev/null)
+  echo "$n"
+}
+
+# Dirt that is not work: build output, worktree bookkeeping, a regenerated data
+# file. None of it is recoverable from a checkout and all of it regenerates, so
+# it must not stand between a finished branch and its removal.
+GC_EPHEMERAL="${GC_EPHEMERAL:-one\.ie/web/\.astro|one\.ie/web/\.wrangler|one\.ie/web/\.preview|\.dev\.pid|\.worktree-port|deploy-runs\.json|node_modules}"
+
+# gc_real_dirt <worktree> — the uncommitted lines that are actually WORK, empty
+# when the tree is clean or carries only ephemera.
+#
+# The `|| true` is load-bearing and is why this is a function rather than an
+# inline pipeline. `grep -v` exits 1 when it filters EVERYTHING out — which is
+# exactly the clean-worktree case — and the caller runs under `set -euo
+# pipefail`, so `real="$(... | grep -v ...)"` killed the sweep the first time it
+# met a worktree it was supposed to remove. Measured 2026-09-07: the sweep
+# printed four keep lines, exited 1, and never reached its own summary; piped
+# through `cat` or `tail` the failure was invisible, which is how it nearly got
+# reported as a clean run.
+gc_real_dirt() {
+  git -C "$1" status --porcelain 2>/dev/null | grep -vE "$GC_EPHEMERAL" || true
+}

package/scripts/livekit-ratchet.sh

@@ -10,6 +10,23 @@
 
 set -uo pipefail
 
+# _GATE — route a heavy compute through the machine governor. A gate_lock only
+# dedupes IDENTICAL work; a SLOT is what bounds N worktrees each running one of
+# these at once (measured 2026-09-07: three concurrent 2.5GB typecheckers, every
+# lock uncontended, load 171). Empty when already inside a gate, so a nested call
+# inherits the outer slot rather than taking a second one.
+#
+# Resolves gate-run.sh from its OWN directory, deliberately: an earlier version
+# keyed off $ROOT and got inserted above the line that sets it, so _GATE was
+# silently empty and every call ran ungoverned -- a fail-OPEN, which is the exact
+# defect this preamble exists to close.
+_GATE=()
+if [ "${GOVERN_IN_GATE:-0}" != "1" ]; then
+  _GR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/gate-run.sh"
+  [ -f "$_GR" ] && _GATE=( bash "$_GR" "compute:$(basename "${BASH_SOURCE[0]}")" -- )
+fi
+
+
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 cd "$ROOT" || exit 1
 
@@ -21,7 +38,7 @@ if [ ! -f "one.ie/web/$TEST_REL" ]; then
   exit 1
 fi
 
-(cd one.ie/web && bunx vitest run "$TEST_REL") || {
+(cd one.ie/web && "${_GATE[@]}" bunx vitest run "$TEST_REL") || {
   echo "livekit-ratchet FAIL — more than one LiveKit block is registered" >&2
   exit 1
 }