@oneie/claude 0.9.0 → 0.10.0

package/commands/do.md

@@ -171,12 +171,16 @@ The pruned spine by tier:
 ```
 PATCH     AIM → BUILD → VERIFY                                                                          (edit + W4 verify gate; 0 spawns)
 FIX       AIM → SURVEY → [INVESTIGATE] → DOCS → BUILD → TEST → PROVE → LEARN
-FEATURE   AIM → PROMISE → SURVEY → DESIGN ▸clarify → DOCS → PLAN ▸analyze → TEST → BUILD → VERIFY → PROVE → TEACH → SHIP → LEARN
+FEATURE   AIM → PROMISE → SURVEY → DESIGN ▸clarify → DOCS → PLAN ▸analyze ▸board ▸meet → TEST → BUILD → VERIFY → PROVE → TEACH → SHIP → LEARN
 SCHEMA    = FEATURE + Substrate reconcile at max
 
   ▸ Docs-first order: DOCS (the full doc set = the spec) is written right after DESIGN; TEST (from those docs)
     is written before BUILD; BUILD makes docs+tests true; PROVE validates the shipped thing against the docs;
     TEACH is now reconcile-not-author (correct any doc↔reality drift so every doc ends true).
+
+  ▸ Board-then-meet: ▸board mirrors the plan's batch DAG onto the board as chained rows; ▸meet convenes
+    the heads who will claim them. BOTH run before BUILD, and in that order — a meeting called before the
+    rows are chained hands every head every cycle at once, and the fan-out is a race.
 ```
 
 `INVESTIGATE` rides any tier when the work touches code we didn't just write — it's the "understand before you change" step, not a separate tier.
@@ -199,6 +203,8 @@ For each **enabled** stop (per the pruned spine), in order: check if its artifac
 | **DOCS** | doc set exists ∧ reconciles | the **full** doc set, written as the spec — `docs` skill picks the types, `writer` drafts: always `-docs.md`; + `-tutorial`/`-how-to`/`-reference`/`-agents-docs` per condition. Written in the reader's language *before* code — this is the acceptance spec PROVE validates against. Not a draft: the real thing | sonnet · medium |
 | **PLAN** | `test -f text/<slug>-todo.md` | `/create todo` + `text/template-todo.md` — cycles + deliverables derived from the docs (each cycle ships a documented observable) | sonnet · medium |
 | ↳ *ANALYZE* | — | `do-analyze.sh text/<slug>-todo.md [--strict-promise]` — CRITICAL exit 1 blocks BUILD. Also reads `text/<slug>.md` and HIGH-warns any promise `accept:` no `C<n>` cycle carries (the todo's `outcome:` and `Correct-course` blocks are not corpus — that's where the gap hides); `--strict-promise` makes an uncovered deliverable CRITICAL | bash · none |
+| ↳ *BOARD* | `bash .claude/scripts/do-board.sh <slug> --status` shows a tid and a live status on every cycle (drift 0) | **`bash .claude/scripts/do-board.sh <slug>`** — the ONE minter of cycle rows (`do-signal.sh --task-plan` delegates to it). Reuses the plan row do-auto already filed as `anchor:`, walks the batches **in order**, one `tasks:subtask` per cycle (`parent` = anchor, `blockedBy` = the previous batch's tids, tags `slug:<slug>-c<n>` + `plan:<slug>`, notes = the cycle's goal delta + the close command), and writes `anchor:` + `cycle_rows:` back after **every batch**. Idempotent (an existing row only gets its edges re-asserted with `tasks:depend`) and resumable. `--dry-run` walks the same loop against a fake door. **The return leg already exists:** the engine's `--task-cycle <slug> C<n> done` resolves the same `slug:` tag, so closing a cycle unblocks the next batch on the board with no new wire | bash · none |
+| ↳ *MEET* *(fan-out plans only — any batch with ≥2 cycles)* | a thread id in `/u/<slug>/in` and every claimable cycle row carries a **named** assignee (`do-board.sh <slug> --status`) | the `meeting` skill — chairman convenes, heads **claim · delegate · chat · chain**, ledger read back from D1. Under the shared gateway key every head claims as the workspace (`@one`), so a head **names itself with `tasks:reassign` after `tasks:claim`** — the two calls are one act. Skipped when the plan is one head wide | opus · high |
 | **TEST** | test file in the repo folder | test-first **from the docs** — one assertion per documented observable; the docs' claims become the executable acceptance tests *before* code exists | sonnet · low |
 | **BUILD** | survey verdict = `build` (≥70% match → `expose`/`extend` instead) | the BUILD engine (Step 3) — make the docs + tests true | sonnet · low–medium |
 | **VERIFY** | rubric + ratchet pass | `do-reconcile.sh <canon>` per category + rubric composite ≥ 0.65 | haiku · medium |
@@ -207,6 +213,56 @@ For each **enabled** stop (per the pruned spine), in order: check if its artifac
 | **SHIP** | changelog / README row | `/release` + adoption signal | sonnet · low |
 | **LEARN** | learnings entry written | close: learnings + cost signal + trust write | — |
 
+### The board is the plan's other rendering — and the gate that enforces it
+
+A plan's cycles and the board's rows are **the same work, twice**. Until ▸board existed they were
+two graphs that drifted: `batches:` held the ordering in markdown, D1 held it in `blocks` edges,
+and nothing joined them.
+
+**The join is not bookkeeping. `tasks:claim` is BLOCKER-GATED and reads the very `blocks` edge
+`tasks:depend` writes.** So a plan mirrored onto the board **cannot be claimed out of order** —
+the substrate enforces the batch DAG that used to be a comment. A plan that is *not* mirrored
+hands every agent every cycle at once.
+
+```
+batches: [[C1],[C2,C3],[C4]]   ≡   C2.blockedBy=[C1] · C3.blockedBy=[C1] · C4.blockedBy=[C2,C3]
+```
+
+**If the two disagree, the BOARD is truth** — it is what the gate reads. `do-plan-json.sh` emits
+both so the drift is visible rather than silent.
+
+**Mint with `tasks:subtask`, never `tasks:create`.** Subtask writes the row, its notes, its tags,
+its `containment` edge to the anchor **and** every `blockedBy` in ONE pipeline — precisely so a
+child never appears claimable with an empty body or missing ordering. A cycle row made with
+`tasks:create` is an orphan that some head claims before it is ready.
+
+**A cycle with no row is invisible to every agent but the one running `/do`.** Measured
+2026-09-12: fifteen filed rungs returned in **zero** of `tasks:everywhere`'s reads at any limit
+(hard cap 200, weight DESC, `tag` ignored) — which, not neglect, was why every one had sat open.
+Read rungs with `tasks:list` by tag, and treat a count from a capped door as not a count.
+
+### ▸meet — the four verbs, and when the chairman convenes
+
+A meeting is **not** where heads report. It is where they take a row, hand a row, argue on the
+row, and put the rows in order:
+
+| verb | door |
+|---|---|
+| **claim** | `tasks:claim` — blocker-gated; the claimant is the **attested caller**, never a body field. Under the gateway key that caller is the *workspace* (`@one`) for every head, so a spawned head follows the claim with `tasks:reassign {assignee: <its own slug>}` or the ledger cannot say who took what |
+| **delegate** | `tasks:reassign` (moves the row in place) · `tasks:announce` (to the world by tags — returns `matched`, and **matched is not delivered**) |
+| **chat** | `tasks:comment` (same D1 store as the inbox thread) · `thread:append` for the room |
+| **chain** | `tasks:subtask` (split) · `tasks:depend` (order) |
+
+Protocol: the **`meeting` skill** (`.claude/skills/meeting/SKILL.md`); form:
+`text/template-meeting.md`. Two rules the skill enforces that `/do` depends on — **no head leaves
+without a tid**, and **size the spawn to the budget** (five heads spawned into a budget that
+carried two report nothing at all).
+
+**The lease moves to the cycle.** `blockersResolved` reads `containment` too, so once cycle rows hang off the anchor a `tasks:claim` on the plan row is refused as `blocked` for the whole run. `do-signal.sh --task-claim` and `do-fleet.sh` therefore lease the **first open cycle's row** when `cycle_rows:` is filled — the row actually in flight, gated by its own batch.
+
+**▸meet is skipped when the plan is one head wide.** A meeting with one attendee is a status
+update, and the checklist refuses it.
+
 **Docs are written first, validated last.** `text/<slug>-docs.md` (and the conditional doc set) is the **spec** — authored at DOCS, *before* BUILD, in the reader's language, so the plan and tests are drawn from a sharp description of intended behavior. It is not a draft: it is what the build must make true. At TEACH / plan close the same doc is **validated, not re-authored** — PROVE checks the shipped thing against it, and any drift is reconciled (fix the doc where reality justifiably diverged, or loop BUILD where the code fell short). Every doc ends true. *(This supersedes the old seed-at-PLAN / refine-at-TEACH pattern: the first write is the real spec, the last touch is validation.)*
 
 **Doc artifacts — all ten templates, each gated.** Every doc type in `text/docs.md` has a template (`text/templates.md` is the map). The **promise's `derives:` manifest** (`text/<slug>.md` frontmatter) declares which of these the feature spawns; the `docs` skill (`.claude/skills/docs/SKILL.md`) confirms the choice at DESIGN/DOCS — neither forces all ten. **Three are spine (automatic); seven are conditional (write only if the promise's `derives:` set them true, else skip).** All are written *before* BUILD. Copy the template, never write from scratch.
@@ -232,7 +288,7 @@ The two `↳` rows are **gates, not artifacts**: CLARIFY edits the plan in place
 - **`deliverables:`** — the **schedule of work**, enumerated and exhaustive: every item the client receives, each with its own `accept:` check. Not on the schedule = not promised (it goes in the promise's "Out of scope" section, in writing); on the schedule = ships or the whole promise settles broken. Acceptance is indivisible — no partial credit. `assumes:` alongside it lists client-side dependencies, each green at the making (a failing assumption means the contract can't be signed yet).
 - **`proof:`** — the acceptance test that settles the contract: **derived, not authored** — the `&&`-join of every deliverable's `accept:`, verbatim, so the one observable is exhaustive *by construction*. It *becomes* the todo's `outcome:`, the TEST assertion, and the PROVE oracle — named once here, never restated loosely. The schedule ⇄ proof law is enforced by `.claude/scripts/do-promise-lint.sh <slug>` (zero LLM — the PROMISE gate): every `accept:` must appear inside `proof:`, every item must carry an `accept:`, every assumption must hold; `--red` additionally requires the proof RED at PROMISE. Promises predating the schedule (no `deliverables:` block) pass grandfathered.
 - **`derives:`** — the manifest of which artifacts this promise spawns. `/do` reads it to know which conditional stops to backfill (instead of re-deciding at DESIGN); the tier prune still applies on top.
-- **`world:`** — the manifest of runtime the kept promise puts into the substrate: lifecycle moves (+ the signal that records each), workflow steps (the locked kinds), agents (+ their `subscribes:` tags), skills, task tags, tracking marks/warns, routing paths. At DESIGN/PLAN, `/do` presence-checks every entry the same way it checks an artifact — **missing agent → a `template-agent.md` cycle (+ `subscriptions:register` for its tags) · missing skill → `/skill-creator` · missing workflow/lifecycle stage → a cycle in the todo · present → skip**. PROVE reads `tracking.marks` as production observables alongside the docs; the `routing:` paths are where cycle composites and run-time outcomes land, so the ranker routes the next wave toward what worked. The fan-out builds exactly what the promise names — nothing more.
+- **`world:`** — the manifest of runtime the kept promise puts into the substrate: lifecycle moves (+ the signal that records each), workflow steps (the locked kinds), agents (+ their `subscribes:` tags), skills, the tag's own **code** surfaces, task tags, tracking marks/warns, routing paths. At DESIGN/PLAN, `/do` presence-checks every entry the same way it checks an artifact — **missing agent → a `template-agent.md` cycle (+ `subscriptions:register` for its tags) · missing skill → `/skill-creator` · missing workflow/lifecycle stage → a cycle in the todo · present → skip**. The `code:` sub-block is the one kind checked MECHANICALLY rather than by reading — it names `ts`/`astro`/`tql`/`panel`/`command` paths relative to the repo root, and `bash .claude/scripts/do-world-check.sh <slug>` answers missing/present for each under the same rule (exit 1 on a declared path that does not exist). PROVE reads `tracking.marks` as production observables alongside the docs; the `routing:` paths are where cycle composites and run-time outcomes land, so the ranker routes the next wave toward what worked. The fan-out builds exactly what the promise names — nothing more.
 
 **Contract-backed promises mint on-chain.** When the promise carries an uncommented `contract:` block (`text/template-feature.md`'s optional on-chain block), PROMISE also runs `bun pay/tools/promise-chain.ts mint <slug>` — it submits the generated `create_promise` with `terms_hash = sha256(text/<slug>.md)` and writes `object_id` + `maker` back into the frontmatter. Unarmed (no signer) → clean exit 2, the promise stays off-chain-only until minted. At close, `do-promise-settle.sh` settles **both halves** from the one proof exit code.
 

package/commands/sweep.md

@@ -0,0 +1,159 @@
+# /sweep
+
+> **Every finished branch into `dev`, one gate, one sha to promote.**
+> `/sweep` is the door before `/deploy`. It runs `bash .claude/scripts/sweep.sh`
+> — the script is the authority for the procedure; this page never carries a
+> second copy of the steps.
+>
+> ```bash
+> bash .claude/scripts/sweep.sh --dry-run    # the whole plan, nothing moved
+> bash .claude/scripts/sweep.sh              # doctor · fetch · classify · land · ONE gate · gc · close
+> bash .claude/scripts/sweep.sh --pr         # …and open/refresh the dev → main PR
+> ```
+>
+> **Run it from the MAIN tree's copy**, like every other door script — `land.sh`,
+> `release.sh` and `deploy.sh` all derive `ROOT` from `${BASH_SOURCE[0]}/../..`,
+> so a worktree's copy sweeps that worktree (`../CLAUDE.md § The dev → prod loop`).
+
+**It does not ship.** It ends by naming the sha and handing the last two doors to
+`release-manager` — see `/deploy`.
+
+---
+
+## What it costs: one gate, not N
+
+`land.sh` gates each branch **with dev merged in**. That is a different tree per
+branch, so six branches is six full computes plus the release gate. The memo does
+not help: `test-cached.sh` is content-addressed, so the same suite on the same
+tree is already free — the cost was never double-calling, it was N different trees.
+
+`/sweep` inverts the order:
+
+1. merge every **ready** branch into `dev` first,
+2. read each branch's own typecheck as a **memo lookup** (`tsc-cached.sh --probe`
+   — a read, never a compute),
+3. run **one** gate on the integrated tree.
+
+N+1 computes becomes 1. The lane is chosen deterministically from what was swept:
+`fast` by default, **`full`** whenever the merge touched `schema/`,
+`packages/sdk/` or auth — the canon's own escalation rule, applied by the script
+rather than remembered by a human.
+
+**What that trade costs, said out loud.** A batched gate cannot name which of N
+branches owns a red. So a red **resets `dev` to the pre-sweep sha** and prints the
+`land.sh` line for each branch — where the four-owner diagnosis (branch · dev ·
+seam · environment, measured 2026-09-12) still lives. You pay the N gates only in
+the case that needs them. **`land.sh`'s own default is unchanged**; use it
+directly for a single branch.
+
+---
+
+## The four classes
+
+Classification is `lib/gc-finished.sh` — the same predicate the sweep that removes
+worktrees uses, sourced, not re-implemented. It is **content identity**, never
+`rev-list --count`: a branch whose patch landed under another sha (rebase,
+squash, cherry-pick) is finished, and a merge commit carrying unique files is not.
+
+| Class | Test | What happens |
+|---|---|---|
+| `infra` | `main` · `dev` · `release` | never touched |
+| `landed` | its content is already in `dev` | left for the gc, which measures against **`origin/main`** |
+| `busy` | ahead, but its worktree has uncommitted **work** or something is running in it | skipped, and the reason is named |
+| `ready` | ahead, clean, idle | merged |
+
+Build output is not work: `one.ie/web/.astro`, `.wrangler`, `.preview`,
+`node_modules` and friends never make a branch busy.
+
+**gc measures against `origin/main`, after a fetch, and that is deliberate.** A
+branch is finished when it is *released*, not when it is integrated — a reviewer
+asking for changes must not find the branch already deleted. A stale local ref
+makes landed work look unmerged (measured 2026-09-07: local main 131 behind, 1.0 GB
+hoarded), which is why the fetch is the first git command.
+
+---
+
+## The doctor holds the box
+
+Phase 0 is `health.sh --box --json`. A sweep **starts gates**, and on a paging box
+a gate runs long — a slow gate is indistinguishable from a red one at the wall
+clock, which is how a good tree gets diagnosed as broken code.
+
+| Verdict | What sweep does |
+|---|---|
+| `HEALTHY` | go |
+| `DEGRADED` | go — it funds one concurrent gate, and a sweep needs exactly one |
+| `UNHEALTHY` | reap **only if `orphans > 0`**, re-read, then refuse (exit 3) and name the agent |
+
+On a refusal, spawn the doctor and re-run:
+
+```
+Agent({ subagent_type: "doctor", model: "opus",
+        prompt: "health.sh says: <why>. Reclaim what nothing is coming back for, then report the verdict." })
+```
+
+`--dry-run` is **never** refused for the box — a plan starts no gates, and a tool
+that refuses a plan teaches you to pass `--no-doctor` by reflex. The flag you
+reach for out of habit is the flag that stops protecting you.
+
+---
+
+## The numeric close
+
+```
+ready=2 merged=2 landed=4 busy=1 infra=3 gates=1 lane=fast box=DEGRADED dev=85250c0b6 ahead_of_main=8
+```
+
+Every number is counted, not narrated. `gates` is the one that matters: it is the
+count of real computes the sweep cost, and it is 1.
+
+Exit codes are distinct and named, because "it refused" is not a finding:
+`0` ok · `2` usage · `3` box refused · `4` integrated gate RED (dev reset) ·
+`5` a merge conflicted (dev reset) · `6` nothing to sweep and nothing to promote.
+
+---
+
+## Prove it can go red
+
+```bash
+bash .claude/scripts/sweep.sh --self-test     # 22 assertions, ~3s
+```
+
+The live estate is usually three worktrees and no feature branches, so a green
+`/sweep` proves only that a no-op is a no-op. The self-test mints throwaway
+estates instead, and covers **both halves** — the read-only classifier and the
+half that moves refs:
+
+| What it proves | How |
+|---|---|
+| every class | one branch each: landed **under a different sha**, ready, dirty, ephemeral-dirt-only, infra |
+| liveness, both ways | it must see a process under the tree (`exec -a`, because `pgrep -f` matches argv, not cwd) and must **not** match a prefix neighbour |
+| the merge | ready branches land, the dirty one does not, `gates=1` |
+| the lane | a `schema/` touch selects `full` without being asked |
+| **a red gate** | exit 4, `dev` **back at the pre-sweep sha**, and the `land.sh` line named per branch |
+| **a conflict** | exit 5, `dev` back at the pre-sweep sha — a conflict is not a red suite and does not share its code |
+| the seam itself | `SWEEP_GATE_CMD` is read **only** under `SWEEP_ROOT`, so there is no way to spell "skip the gate" in a real run |
+
+The two reset paths are the reason the merge half is tested at all: a reset
+nobody ever runs is a reset nobody knows is broken, and the ref it fails to
+restore is someone's branch. Deleting the reset line makes the suite go **RED**
+on exactly that assertion — verified, not asserted.
+
+It has already bitten its own author twice: an untracked `one.ie/` collapsing in
+`git status --porcelain` read a build-output-only branch as busy, and a `sleep`
+with no path in its argv proved nothing about `pgrep -f`.
+
+**The box refusal is proved the same way** — stub `health.sh` to `UNHEALTHY` and
+a real run exits **3** while `--dry-run` reports and proceeds.
+
+---
+
+## Then deploy
+
+```
+/sweep --pr      # dev carries everything, one gate green, PR open
+/deploy          # spawns release-manager, which promotes the named sha and ships
+```
+
+See also: `/deploy` · `.claude/skills/deploy/SKILL.md` (the run as tracked work) ·
+`../CLAUDE.md § The dev → prod loop`.

package/hooks/scripts/dev-only.sh

@@ -0,0 +1,135 @@
+#!/usr/bin/env bash
+# DEV-ONLY — PreToolUse(Edit|Write|MultiEdit, Bash): development happens on
+# `dev`, or in a worktree cut from `dev`. Never on the shared main tree.
+#
+# THE RULE, in one line: main RECEIVES, it does not get EDITED.
+#
+# WHY THIS EXISTS — three measured failures, none of them theoretical:
+#
+#   1. WORK VANISHES. 2026-09-16: a session deleted eight root .astro pages in
+#      the shared main tree and never committed. The 12:14 reboot killed it,
+#      `git pull --ff-only` fast-forwarded main, and every deleted file came
+#      back. `git status` was CLEAN afterwards, so nothing recorded that the
+#      work had existed at all. The operator reported it as "I deleted them but
+#      they don't seem to be deleted" — which is exactly what it looks like.
+#
+#   2. THE RECEIPT CAN NEVER BIND. `test-cached.sh` keys on tree CONTENT
+#      (`git diff HEAD` + untracked + .env). A gate run on a main tree that any
+#      neighbour is editing measures a MOVING tree, so it mints a receipt for a
+#      state that never ships. 2026-09-05: four full suites, ~25 minutes, zero
+#      receipts. `./deploy` from main was simply never runnable that day.
+#
+#   3. A DEV SERVER ON MAIN SERVES THE STALE TRUNK. Every page it renders is a
+#      false reading — the same false-RED class as running a gate there.
+#      2026-09-16: localhost:4321 answered /media with 200 for hours after the
+#      page was deleted on dev, because it was booted from the main tree.
+#
+# WHAT IS ALLOWED. Any linked worktree — its git-dir sits under
+# `.git/worktrees/…`, which is the test this hook uses. That covers
+# `.claude/worktrees/dev` (the workbench), every `feat/*` tree cut from dev,
+# and `.release` (which must stay writable: it is how prod ships). Anything
+# outside the repo entirely is none of this hook's business.
+#
+# WHERE TO GO INSTEAD:
+#   small, hours   ->  .claude/worktrees/dev          (already minted and warm)
+#   large or long  ->  bash .claude/scripts/worktree-up.sh <name> --no-dev
+#                      (cuts from dev by default — worktree-up.sh:63 BASE="dev")
+#
+# Disable: ECC_DISABLED_HOOKS=hook:dev-only
+
+# shellcheck source=lib/hook.sh
+source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/hook.sh"
+is_hook_disabled "hook:dev-only" && exit 0
+
+PAYLOAD="${1:-}"
+# Claude Code delivers the payload on STDIN; argv stays first so a positional
+# caller still works. Bounded read — a bare $(cat) hangs forever on a tty and
+# would freeze every Edit and every Bash call in the session.
+if [[ -z "$PAYLOAD" && ! -t 0 ]]; then
+  IFS= read -r -d '' -t 2 PAYLOAD <&0 || true
+fi
+[[ -z "$PAYLOAD" ]] && exit 0
+
+TOOL=$(printf '%s' "$PAYLOAD" | jq -r '.tool_name // empty' 2>/dev/null)
+
+# ── is this path inside the SHARED MAIN tree? ────────────────────────────────
+# A linked worktree's absolute git-dir contains /worktrees/. The primary tree's
+# does not. That single fact is the whole test, and it needs no path list that
+# could drift as worktrees come and go.
+_is_shared_main() {
+  local p="$1" d gitdir
+  [[ -z "$p" ]] && return 1
+  # A Write to a file that does not exist yet still has an existing parent.
+  d="$p"; while [[ -n "$d" && "$d" != "/" && ! -d "$d" ]]; do d=$(dirname "$d"); done
+  [[ -d "$d" ]] || return 1
+  gitdir=$(git -C "$d" rev-parse --absolute-git-dir 2>/dev/null) || return 1
+  [[ -z "$gitdir" ]] && return 1
+  case "$gitdir" in */worktrees/*) return 1 ;; esac   # linked worktree — fine
+  return 0
+}
+
+_deny() {
+  jq -nc --arg r "$1" \
+    '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":$r}}'
+  exit 0
+}
+
+WHERE="Work in the dev worktree, or a worktree cut from it:
+
+  small, hours   cd .claude/worktrees/dev
+  large or long  bash .claude/scripts/worktree-up.sh <name> --no-dev
+
+Both are cut from \`dev\`, which is the branch every feature integrates into.
+main receives \`--ff-only\` merges and a release PR; it is not an edit surface.
+
+Override, for a deliberate one-off:  ECC_DISABLED_HOOKS=hook:dev-only"
+
+case "$TOOL" in
+  Edit|Write|MultiEdit|NotebookEdit)
+    FP=$(printf '%s' "$PAYLOAD" | jq -r '.tool_input.file_path // .tool_input.notebook_path // empty' 2>/dev/null)
+    [[ -z "$FP" ]] && exit 0
+    _is_shared_main "$FP" || exit 0
+    _deny "[dev-only] This file is in the SHARED MAIN tree. Development happens on dev.
+
+  $FP
+
+An edit here is not saved work. Main gets fast-forwarded by whichever session
+pulls next, and an uncommitted change is silently reverted — on 2026-09-16 that
+resurrected eight deleted pages and left \`git status\` clean, so nothing
+recorded that the work had ever existed.
+
+$WHERE"
+    ;;
+
+  Bash)
+    CMD=$(printf '%s' "$PAYLOAD" | jq -r '.tool_input.command // empty' 2>/dev/null)
+    [[ -z "$CMD" ]] && exit 0
+    # Strip heredoc bodies so a command that merely NAMES a dev server in a
+    # commit message or a doc is never refused — same discipline as
+    # hook:governor-escape.
+    STRIPPED=$(printf '%s' "$CMD" | sed -E '/<<-?[A-Za-z_'"'"'"]/,/^[[:space:]]*[A-Za-z_]+[[:space:]]*$/d')
+    printf '%s' "$STRIPPED" | grep -qE '(^|[|&;[:space:]])(astro[[:space:]]+dev|(bun|npm|pnpm|yarn)[[:space:]]+run[[:space:]]+dev)([[:space:]]|$)' || exit 0
+
+    # Where would it run? An explicit `cd` wins, else the tool's cwd.
+    TARGET=$(printf '%s' "$CMD" | grep -oE "(^|&&|;|\|)[[:space:]]*cd[[:space:]]+(\"[^\"]+\"|'[^']+'|[^[:space:]]+)" | head -1 \
+             | sed -E "s/.*cd[[:space:]]+//; s/^[\"']//; s/[\"']\$//")
+    [[ -z "$TARGET" ]] && TARGET=$(printf '%s' "$PAYLOAD" | jq -r '.cwd // empty' 2>/dev/null)
+    case "$TARGET" in *'$'*) TARGET=$(printf '%s' "$PAYLOAD" | jq -r '.cwd // "."' 2>/dev/null) ;; esac
+    [[ -z "$TARGET" ]] && TARGET="."
+    _is_shared_main "$TARGET" || exit 0
+    _deny "[dev-only] A dev server started here serves the STALE TRUNK.
+
+  $TARGET
+
+Every page it renders is a false reading: main does not carry what dev has
+integrated. Measured 2026-09-16 — localhost:4321 answered /media with 200 for
+hours after that page was deleted on dev, because the server was booted from
+the main tree. One dev server, and it runs on dev.
+
+  cd .claude/worktrees/dev/one.ie/web && bun run dev
+
+$WHERE"
+    ;;
+esac
+
+exit 0

package/hooks/scripts/session-start.sh

@@ -1,6 +1,7 @@
 #!/bin/bash
-# SESSION-START — one job: reclaim what a dead session left behind, then tell
-# the world a session began.
+# SESSION-START — one job: reclaim what a dead session left behind — and, since
+# 2026-09-13, break the one jam whose owners are both ALIVE — then tell the world
+# a session began.
 #
 # `_gv_reap` only fires when someone CONTENDS for a lock, so a session that died
 # holding a governor slot would shrink GOVERN_MAX_GATES until the next contender
@@ -37,12 +38,26 @@ if [ -x "$CLAUDE_PROJECT_DIR/.claude/scripts/gate-reaper.sh" ]; then
   REAPED=$(bash "$CLAUDE_PROJECT_DIR/.claude/scripts/gate-reaper.sh" --once 2>/dev/null | grep -c '^\[gate-reaper\] reaped' || true)
 fi
 
+# The reaper reaps a DEAD owner. The 2026-09-13 deadlock has two LIVE owners —
+# a lock holder with no slot, and a slot holder waiting on that lock — so no
+# reaper could ever see it, and it stalled every session on the box for 8-28
+# minutes at 0% CPU, three times in 35 minutes. gate-watchdog is the one thing
+# that cuts it. A healthy box costs 0.12s and prints nothing; it only spends the
+# confirm delay when it has already found a jam. Its predicate is positive
+# evidence of a closed cycle (--self-test drives all 14 checks, both halves), so
+# a slow-but-working gate is never the victim and a slot owner never is either.
+JAMMED=0
+if [ -x "$CLAUDE_PROJECT_DIR/.claude/scripts/gate-watchdog.sh" ]; then
+  JAMMED=$(bash "$CLAUDE_PROJECT_DIR/.claude/scripts/gate-watchdog.sh" --once 2>/dev/null | grep -c '^\[gate-watchdog\] BREAK' || true)
+fi
+
 OUT=""
+[ "${JAMMED:-0}" -gt 0 ] 2>/dev/null && OUT+="🧹 broke ${JAMMED} governor deadlock(s) — a lock was held with no slot while every slot sat idle\n"
 [ "${REAPED:-0}" -gt 0 ] 2>/dev/null && OUT+="🧹 reaped ${REAPED} abandoned gate(s)/workerd orphan(s) burning the box\n"
 [ "${SWEPT:-0}" -gt 0 ] 2>/dev/null && OUT+="🧹 reclaimed ${SWEPT} stale build slot(s) from a dead session\n"
 [ "${CLAIMS_SWEPT:-0}" -gt 0 ] 2>/dev/null && OUT+="🧹 reclaimed ${CLAIMS_SWEPT} region claim(s) from a dead worker\n"
 [ -n "$OUT" ] && { echo ""; printf "%b" "$OUT"; echo ""; }
 
-emit_signal "hook:session-start:ok" 1 "swept=${SWEPT:-0} claims=${CLAIMS_SWEPT:-0} reaped=${REAPED:-0}"
-emit_world "session:start" "fyi" "session,start" "session started" "swept=${SWEPT:-0}" "claims=${CLAIMS_SWEPT:-0}" "reaped=${REAPED:-0}"
+emit_signal "hook:session-start:ok" 1 "swept=${SWEPT:-0} claims=${CLAIMS_SWEPT:-0} reaped=${REAPED:-0} jams=${JAMMED:-0}"
+emit_world "session:start" "fyi" "session,start" "session started" "swept=${SWEPT:-0}" "claims=${CLAIMS_SWEPT:-0}" "reaped=${REAPED:-0}" "jams=${JAMMED:-0}"
 exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneie/claude",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "ONE Claude Code plugin — /do lifecycle, W0-W4 BUILD engine, 7-canon reconcile, ONE substrate via MCP, signals, and rules",
   "files": [
     ".claude-plugin",

package/rules/scripts.md

@@ -0,0 +1,85 @@
+---
+paths:
+  - ".claude/scripts/**"
+  - "packages/claude/scripts/**"
+---
+
+# Harness script rules
+
+Short on purpose. Every rule here is imperative and true at the line it guards;
+the story that earned it is one command away and is never summarised:
+
+```bash
+bash .claude/scripts/incident.sh --for <script>   # the accounts for this file
+bash .claude/scripts/incident.sh                  # every family
+```
+
+Two neighbours, so nothing here restates them: `.claude/scripts/CLAUDE.md` is
+the per-script INVENTORY (what each door does, and the SIGPIPE/`grep -q` and
+governor sections), loaded when you work in that directory;
+`.claude/incidents/` is the ACCOUNTS. This file is only the imperatives.
+
+`incident.sh` and `.claude/incidents/` are **monorepo-only** — they hold this
+repo's measured history and do not ship to the factory clone. In a generated
+clone the rules below still apply; the accounts behind them do not travel.
+
+## Writing one
+
+- **Declare the manifest — in the TABLE.** The authority is the heredoc in
+  `factory-repo.sh` (`portable | needs-env | monorepo-only  <script>`); the
+  `# manifest:` line in the script itself is a convenience copy the check does
+  **not** read. `factory-repo.sh` **refuses to build** with an unclassified
+  script, and `--check-portability` only sees TRACKED files — so a new script
+  passes the check right up until you commit it.
+- **Split the comment.** A block is two things: the RULE (imperative, 1-2 lines,
+  stays inline) and the ACCOUNT (dates, shas, counts, the wrong diagnosis that
+  came first — moves to `.claude/incidents/<family>.md` under a `## <id>`, and
+  the script keeps a bare `incident:<id>` token). **Carry every measurement,
+  date, sha, count and error string over unchanged** — a trap loses its authority
+  the moment its numbers are summarised away; rewrapping the prose around them is
+  fine. `incident.sh --check` proves every pointer resolves and every account is
+  reachable, both directions, both copies — but it scans DIRECTORIES, so it
+  cannot see a broken `--for`, which is how deploy.sh's pointers resolved for the
+  checker and not for the reader for an hour.
+- **Both copies.** `packages/claude/scripts/` is a hand-maintained verbatim
+  mirror with no build step, so it rots silently. `sync-claude-mirror.sh` after
+  every edit; a proof that covers canon and not the copy that ships is worse than
+  no proof.
+- **`set -uo pipefail`, never `-e`.** These scripts read exit codes as answers
+  (`git diff --quiet` exits 1 to mean "differs"); `-e` turns an answer into a
+  crash.
+
+## Gates and exit codes
+
+- **Never pipe a gate.** `bun run verify | tail` reports tail's status — measured
+  reporting **0** for an exit-1 verify. Redirect to a file, or read
+  `PIPESTATUS[0]`. In the Claude Code Bash tool (zsh) `PIPESTATUS` is **empty**:
+  use `${pipestatus[1]}` or a file.
+- **An unrun gate is never a pass.** `gate-run.sh` exits **127** when its target
+  is not on `PATH`. Invoke by absolute path, and distinguish `pass|fail|unrun|n/a`.
+- **Everything heavy goes through `gate-run.sh`** — a raw `vitest` bypasses the
+  governor and `hook:load-guard` blocks it.
+- **Exit codes are distinct and named.** "It refused" is not a finding: give each
+  refusal its own code and say which one bit.
+
+## Proofs
+
+- **A checker must be able to go RED.** Ship a `--self-test` that drives the
+  failure, not only the success, and prove it by breaking the code on a copy.
+- **A `.sh` is in no import graph**, so `vitest related` can never select it. A
+  shell proof the suite must keep running needs a vitest wrapper **and** a name
+  in `VERIFY_FAST_PINS` (`verify-fast.sh`) — otherwise it stops being run the
+  moment its author's session ends.
+- **A fixture looser than production certifies the bug.** Build the sandbox to
+  match the real tree's shape, then assert.
+
+## Doors
+
+- **Run door scripts from the MAIN tree's copy.** `land.sh`, `release.sh`,
+  `deploy.sh` and `sweep.sh` all derive `ROOT` from `${BASH_SOURCE[0]}/../..`; a
+  worktree's copy operates on that worktree.
+- **And check the main tree is CURRENT** — `git rev-list --count HEAD..origin/main`
+  is exactly how many commits old the script you are about to run is. `git status`
+  clean says nothing about it.
+- **Deploy and ship are `release-manager`'s**, spawned as a subagent; the box is
+  `doctor`'s. See `.claude/commands/deploy.md` and `/sweep`.