@oneie/claude 0.9.0 → 0.10.0

package/scripts/CLAUDE.md

@@ -0,0 +1,315 @@
+# CLAUDE.md — `.claude/scripts/`
+
+Moved from `.claude/CLAUDE.md` so it loads only when working here.
+
+## Script notes
+
+```
+├── scripts/       # 65 entries — `ls .claude/scripts/` is the map, not this comment.
+│                 # deploy.sh — the whole /deploy pipeline, deterministic:
+│                 # gates (tree, tsc ×5, vitest, build, creds, smoke, approval,
+│                 # D1) then parallel deploy + health probes. `./deploy` at the
+│                 # repo root execs it. It is the AUTHORITY for the deploy
+│                 # steps — .claude/commands/deploy.md carries no second copy.
+│                 # Its vitest gate PROBES THE MEMO BEFORE TAKING A SLOT (the
+│                 # `>>> vitest-memo-probe` block): measured 2026-09-13, the gate
+│                 # queued 300s under gate-run.sh and then reported both lanes as
+│                 # cache HITs. The probe asks PER LANE the way release.sh's
+│                 # receipt does (TEST_CACHE_KEY_ONLY=1 + a stamp per key) and
+│                 # skips only when EVERY lane is already green — never by reading
+│                 # test-lanes.sh's exit code, which under TYPEDB_LANE_NONBLOCKING=1
+│                 # is the pool lane's alone and would skip 19 typedb suites that
+│                 # had never run. A miss or an unanswerable probe takes the slot.
+│                 # A skipped gate counts as PASSED, stays OUT of HEAVY_IDX (a
+│                 # process-less gate there makes the next heavy gate `wait 0` —
+│                 # exit 127 — and overwrite its rc), and reports REUSED with the
+│                 # stamp's timestamp, never "all pass". --skip-tests is distinct.
+│                 # release.sh — the PROD door since 2026-09-05: `promote <sha>`
+│                 # fast-forwards branch `release`, materialises .release/ (deps
+│                 # by symlink, never bun install) and refuses unless that exact
+│                 # tree carries deploy's own full-suite receipt (test-cached
+│                 # stamp) + 5 clean tsc; `ship` runs deploy.sh --changed FROM
+│                 # .release/ so the suite gate is a memo HIT reported REUSED —
+│                 # no --skip-tests, ever. Nine named exit codes; --self-test is
+│                 # the red proof. Run MAIN's copy (from inside .release/ it
+│                 # resolves ROOT to .release and tries to add .release/.release).
+│                 # Step 9 (Lighthouse) is detached by default — SPEED_SYNC=1
+│                 # holds it inline, SPEED_TIMEOUT bounds it, 124 reads as unrun.
+│                 # Two of its gates are MEMOISED on a byte-identical tree: the
+│                 # full vitest suite via test-cached.sh (only passes; a reused
+│                 # pass is reported as reused, never as "all pass") and the
+│                 # astro build via astro-build-cached.sh (stamp inside dist/,
+│                 # key covers one.ie/web + packages/ + the gitignored .env and
+│                 # lockfiles). The typechecks are deliberately NOT cached —
+│                 # measured 8s serial, inside vitest's shadow, and tsc-cached
+│                 # shares a gate_lock with do-reconcile — both take a SLOT
+│                 # BEFORE that lock since 2026-09-13, never while holding it
+│                 # (govern-order-check.sh). An unpaid deferred-pin
+│                 # debt (verify-fast's ledger) now REFUSES a deploy that did not
+│                 # run the suite. Red proofs: deploy-gate-check.sh (extracts the
+│                 # debt block verbatim and drives it), plus --self-test on
+│                 # tsc-cached / test-cached / astro-build-cached.
+│                 # roles-check.sh — the nine authority checks (IC row 1 of
+│                 # roles-vantage-collapse); --check-gate plants a vantage-vs-rung
+│                 # comparison and proves one.ie/web's astro-check ratchet goes red.
+│                 # --check-floors runs the page-floor matrix (five callers per
+│                 # private page through the real guardPage) and proves an
+│                 # ANONYMOUS private page cannot land — it forces anonymity with
+│                 # a `signed_out=1` cookie, because DEV_SLUG otherwise makes a
+│                 # session-less localhost request the owner of the `one` subtree.
+│                 # --check-decide / --check-503 run the authority matrix
+│                 # (one.ie/web/tests/authority/) through the real decide(), then
+│                 # mutate the FIXTURE to prove the deny cells bite and that a
+│                 # swallowed lookup error cannot pass as a 403. --check-worldkey
+│                 # (C6) replays the same suite with a world-key Principal — the
+│                 # original bug report — and asserts a denial NAMES the node
+│                 # instead of comparing a vantage word to a rung word.
+│                 # land.sh — the BRANCH door. Bare: merge main in, fast gate in the
+│                 # branch's worktree, then --ff-only main. `--pr`: gate then open/
+│                 # update a PR, skipping the trunk merge so a reviewer sees what the
+│                 # branch added. `--pr --deploy`: the whole workflow in order —
+│                 # gate → ship THAT WORKTREE to dev.one.ie → prove the routes with
+│                 # do-prove (both bases pinned to dev; it falls back to PROVE_PROD_URL
+│                 # and would otherwise prove PRODUCTION) → open the PR carrying the
+│                 # dev URL. Reads the probe's ROUTE COUNT, never its exit code —
+│                 # `PROVE: skipped` exits 0. RUN MAIN'S COPY: from a worktree, ROOT is
+│                 # that worktree and the ff merges the branch into itself (always
+│                 # "already up to date", main untouched, three false "landed" reports
+│                 # on 2026-09-05). It now verifies with `merge-base --is-ancestor`.
+│                 # A red gate is DIAGNOSED, not blamed (2026-09-12): branch-alone and
+│                 # dev-alone typecheck read from the memo (`tsc-cached.sh --probe`,
+│                 # `TSC_CACHE_ROOT=<tree>`), a gateway pre-flight, and which side of
+│                 # the merge touched each failing file — branch / dev / seam /
+│                 # environment. The verdict is the run's --note. `--self-test` drives
+│                 # all seven shapes, including transport+assertion ⇒ NOT environment.
+│                 # It links node_modules for every tracked package.json rather than a
+│                 # list — the list missed channels/, pay/backend/ and one.ie/web/ in
+│                 # turn, each time reading as a RED gate on a branch of shell scripts.
+│                 # deploy-record.sh — appends a run to one.ie/web/src/data/deploy-runs.json,
+│                 # which /deploy renders (the factory.astro shape: data, not a live
+│                 # query — a deploy runs on a laptop and one-prod cannot read that disk).
+│                 # Called by deploy.sh and land.sh on BOTH exits, `|| true`. --self-test.
+│                 # Load-bearing few: do-reconcile.sh (7 canons) · do-auto.sh + do-fleet.sh
+│                 # (worktree cycles) · do-tier.sh (spine prune) · do-promise-lint/settle.sh
+│                 # · signal-watch.sh — every door the factory's signals cross (prod + local),
+│                 #   with server-timing phases, cf-placement, ratchet budgets, a JSONL
+│                 #   ledger and --self-test; the instrument for root CLAUDE.md § The brain
+│                 #   and the edge (a receiver that queries TypeDB inline reads RED here)
+│                 # · chrome.mjs (the browser — chrome-headless-shell, backs /browser and
+│                 # every do-prove.sh --route check; browser-check.mjs is a shim over it)
+│                 #   do-prove enforces a LANDING RULE: a route only counts as proven if
+│                 #   the run ENDED on the path asked for. A signed-out /u/<slug>/* 302s
+│                 #   to /signin, which renders 200 with no console errors — that scored
+│                 #   "ok" until 2026-08-04, so authed promise clauses were green on the
+│                 #   sign-in page. Every route runs SIGNED-OUT first; only a bounce to
+│                 #   the login wall retries with a dev session (dev-sign-in.ts, or
+│                 #   OWNER_EMAIL+DEV_PASSWORD over HTTP, localhost base only) so those
+│                 #   clauses still run in a bare shell. Lazy on purpose: DEV_SLUG makes
+│                 #   a signed-out request render /u/one/* as workspace `one`, while the
+│                 #   dev session is tony — signing in up front turned a genuine pass on
+│                 #   /u/one/workflows into "landed on /u/tony/workflows".
+│                 #   PROVE_SESSION_COOKIE overrides; PROVE_NO_SESSION=1 drives the red
+│                 #   half on demand. A worktree without .wrangler/state cannot seed the
+│                 #   credential — export the two vars or the cookie there.
+│                 # · typedb-env.sh (flip one.ie/web/.env local↔cloud) · factory-repo.sh
+│                 # (emits one-ie/factory, see below) · sync-claude-mirror.sh (packages/claude)
+│                 # None are on PATH — always invoke as `bash .claude/scripts/<name>`.
+│                 # TRAP, measured 2026-08-04: in a `set -o pipefail` script,
+│                 # `<producer> | grep -q PAT` returns 141 when it MATCHES if the
+│                 # producer is still writing — grep -q exits first and the
+│                 # producer takes SIGPIPE. Sharp threshold: curl of 87 bytes is
+│                 # fine, curl of a 378 KB page is not; shell builtins never
+│                 # misfire. It bit do-walk's expect_text (false RED) and
+│                 # factory-repo's cycle gate (false GREEN — the pipe sat under a
+│                 # `!`, so failures read as green). Capture the output, then
+│                 # match it with a here-string. `printf "$out" | grep -q` puts
+│                 # the same race one process to the left.
+```
+
+## A non-run must never read as a pass
+
+The SIGPIPE trap above has a sibling class: a gate that never ran, reported green.
+Two shapes, both measured 2026-09-14.
+
+- **`gate-run.sh <label> -- <cmd>` exits 127 when `<cmd>` is a bare name not on
+  PATH** — `vitest` lives in `node_modules/.bin`, not on PATH. It ran **zero
+  tests twice** and the harness reported the wrapper as "completed exit 0". The
+  mechanism is unconfirmed in source (`govern.ts` spawns with no `env:`
+  override, so PATH *should* inherit); the behaviour is what is measured.
+  **Invoke the target by ABSOLUTE path** — `gate-run.sh test --
+  /abs/path/node_modules/.bin/vitest run …` — and treat a 127 as RED, never as a
+  clean suite.
+- **Piping a gate through `tail` masks its exit code.**
+  `FULL_VERIFY=1 bun run verify … | tail -60` printed `[exited with code 0]`
+  while `verify` itself exited **1**. Same lesson as the pipefail trap one
+  process to the right: read **`${PIPESTATUS[0]}`**, or capture the output first
+  and match it with a here-string.
+
+## Machine governor — why N sessions no longer melt the box
+
+**Measured 2026-08-18:** several sessions each ran `bun run verify`
+(tsc --noEmit + vitest over 875 test files) concurrently on a 10-core/24GB Mac.
+Six `tsc` and three vitest pools ran at once — load **57**, swap **15.7/16 GB**,
+~26 MB/s of swapins. Starved by paging, each gate took **18 min instead of ~2**,
+so sessions hit their Bash timeout and launched *more*. The box got slower the
+harder it was pushed. Claude Code was the trigger; the amplifier was that
+nothing in this harness bounded a gate's concurrency or its children's lifetime.
+
+macOS ships **neither `flock(1)` nor `timeout(1)`** — both are GNU coreutils.
+That absence is the root reason gates were unbounded here. The governor
+rebuilds both from `mkdir(2)` atomicity and a real process group.
+
+**Since 2026-09-04 the mechanics are `scripts/lib/govern.ts` (Bun) and
+`scripts/lib/govern.sh` is a shim.** The design did not change; the runtime
+did — bash 3.2 on macOS has no flock, no timeout and no BASHPID, `set -m`
+needs job control, and a watchdog subshell cannot own the `sleep` it forks.
+Every function NAME, ARGUMENT and EXIT CODE is unchanged, so no caller
+changed. Four functions deliberately stay in bash: `_gv_alive` and the three
+`_gv_vm_stat` / `_gv_swapusage` / `_gv_memsize` wrappers are the seams three
+of the six proofs **stub as bash functions**, and `_gv_claim_key` is BSD
+`cksum` (the POSIX CRC, not zlib's) which the claims checker reads off disk.
+A new `_gv_*` seam a checker stubs belongs in the shim, not in the port.
+
+| Piece | Does |
+|---|---|
+| `scripts/lib/govern.ts` | the mechanics — lock/slot loops, `run_bounded`, the claim reaper + TTL, the memory arithmetic, and BOTH memo keys (`tsc_tree_fingerprint`; test-cached's per-file `_hash_rel`). Reached through the shim, never called directly |
+| `scripts/lib/govern.sh` | the shim every caller sources. `gate_lock` (mkdir-atomic named lock, reaps dead owners) · `gate_slot` (machine-wide semaphore, `GOVERN_MAX_GATES`, default 2) · `run_bounded` (wall-clock cap that kills the **process group**) · `gate_pressure` · **claims** — see below. The lock/claim owner is the CALLING SHELL's `$$`, never the short-lived bun process |
+| `scripts/gate-run.sh` | `gate-run.sh <label> -- <cmd>` — slot + bound + group-reap. Re-entrant (`verify` calling `test` inherits the slot, never deadlocks). Execs straight through under `CI=1` or `GOVERN_DISABLE=1` |
+| `hooks/load-guard.sh` | PreToolUse(Bash) backstop for heavy commands typed directly, bypassing package.json |
+| `hooks/governor-escape.sh` | PreToolUse(Bash) — the *escape hatches* themselves are refused unconditionally: `verify:raw`, `test:raw`, a bare `vitest`, an inline `GOVERN_DISABLE=1`/`CI=1`. Matcher shared with the checker at `hooks/lib/governor-escape-match.sh` — one definition, no drift |
+| `scripts/governor-doors-check.sh` | the other half — what the TREE OFFERS. `hook:governor-escape` guards what an executor TYPES, but `cd channels && bun run test` was an ungoverned 135-file two-runner suite and nothing about that string looks like an escape: the hole was the package script. Enumerates every tracked `package.json` at run time (never a hardcoded list), follows one hop through `bash <x>.sh`, and fails on any heavy script that is neither governed nor on the reasoned skip list. Also proves the wrapped relative paths resolve and that a nested gate does not deadlock |
+| `scripts/governor-escape-check.sh` | its proof, three parts: the matcher's case table (bites / does not false-positive), the real hook driven with a payload, and a RED PROOF that guts the matcher and neuters the hook and asserts both halves go red |
+| `scripts/machine-check.sh` | `--watch` for the live read: load, swap **direction**, running gates, held slots, orphans |
+| `scripts/gate-watchdog.sh` | the reaper's OPPOSITE — it breaks the jam whose owners are both **alive**, which by definition no reaper can see (2026-09-13: three deadlocks in 35 minutes, 8-28 min each at 0% CPU). Cuts exactly one shape: a lock holder with **no slot** that has a `gate-run.sh` descendant queueing for one — the single process on the wrong side of the ordering. **Never a slot owner.** The clock is the SLOT's directory mtime, not the lock's: during the live jam the lock changed hands every ~9 minutes (each holder killed by its session's 600s Bash ceiling) while the jam ran >20, so a lock-clocked watchdog never fires. `--once` from `hooks/session-start.sh` (0.12s, silent), `--dry-run` to name a victim without cutting, `--self-test` for 14 checks including a real planted deadlock and three red proofs. The code fix that removes the cause is `govern-order-check.sh`'s SLOT-before-LOCK; this stays useful until every worktree has rebased onto it |
+| `scripts/govern-claims-check.sh` | the claim registry's two properties — exclusion and evaporation — plus a red-proof. `bash .claude/scripts/govern-claims-check.sh`, exits non-zero on failure, touches only a sandbox `GOVERN_DIR` |
+| `scripts/govern-order-check.sh` | **the LOCK ORDER**, proved by deadlocking it. Runs the two roles in the two orders — a gate holding a slot whose child wants the lock, vs a bare caller — and asserts they finish. Its red half plants the pre-2026-09-13 `LOCK -> SLOT` holder and asserts the same harness STALLS, so a green run is never green for lack of power; a third section proves a cache HIT and `--probe` still take neither. ~20s, own sandbox `GOVERN_DIR`, kills only its own children |
+
+Wired: `one.ie/web` `verify`/`test`/`check`/`demo:*` plus `api`, `channels`,
+`schema`, `pay/backend`, `packages/sdk` and `packages/cli` `test` all route
+through `gate-run.sh` (`verify:raw`/`test:raw` are the ungoverned escapes,
+and `governor-doors-check.sh` is what keeps that list honest); `do-reconcile.sh types`
+takes a per-folder lock and **caches by tree fingerprint** — git HEAD +
+porcelain + source mtimes — so six identical `tsc` runs collapse to one compute
+and five cache hits; `vitest.config.ts` caps the fork pool (`maxWorkers` **8**,
+`VITEST_MAX_FORKS` to override) with a 1GB per-fork heap.
+
+That cap was **4** until 2026-09-01, and the reason it could double is the reason
+it existed: each fork used to hold a ~120MB jsdom. `vitest.config.ts` now defaults
+`environment` to `node` (only ~230 of ~1135 files touch a DOM; the rest opt in
+with a `// @vitest-environment jsdom` docblock), so **jsdom is no longer the memory
+driver** and the same box carries twice the fan-out. Full suite, same tree, all
+green: **518s → 324s → 87.3s**. Memory is still the binding constraint the fleet
+prices in — `gate_headroom` is unchanged, so N sessions cannot each take 8.
+
+**The fleet prices its own concurrency in memory, not cores.** `do-fleet.sh`
+capped slots at `cores - 2` — on a 10-core/24GB box that authorised **8
+concurrent worktrees**, and 8 cycles is ~16GB of gates before the editors,
+sessions and OS get a byte. Cores were never the binding constraint.
+`gate_headroom` prices a cycle (~2GB: vitest driver + 4 forks + tsc + node
+overhead), subtracts a reserve, and divides what is actually free. It only ever
+*lowers* the count — `--slots` and the core cap still hold — and the fleet now
+names the binding constraint on its ranking line:
+
+```
+[do-fleet] ranking… (top 5 candidates, 2 slots — bound by memory;
+                     cores<=8 mem<=2, DRY-RUN)
+```
+
+Tune with `GOVERN_GB_PER_CYCLE` (default 2) and `GOVERN_RESERVE_GB` (default 2).
+A probe that cannot read memory returns 99 — a broken sensor must never
+silently serialise the fleet.
+
+`hooks/session-start.sh` calls `gate_sweep_stale`: `_gv_reap` only fires when
+someone *contends* for a lock, so a session that died holding a slot would
+shrink `GOVERN_MAX_GATES` until the next contender happened along. Silent
+unless it actually reclaims something. It also calls `claim_sweep` (below) for
+the same reason.
+
+### SLOT before LOCK — the one ordering rule, and the day it was broken
+
+The governor hands out two different things and **the order between them is
+fixed: take the SLOT first, then the LOCK.** A slot bounds the machine; a lock
+dedupes identical work. Take them the other way round anywhere and that site can
+deadlock against every site that takes them correctly.
+
+Measured 2026-09-13 — **three occurrences in ~35 minutes**, each stalling every
+session on the box for 8-28 minutes at 0% CPU, one of them a production release
+gate. `tsc-cached.sh` took the per-folder lock and then queued for a slot while
+holding it; `bun run verify:fast` IS `gate-run.sh verify-fast -- …`, so it
+arrives already holding a slot and its child then waits for that lock:
+
+```
+A: gate-run(verify-fast) holds slot-1   ->  its tsc-cached waits for lock-tsc-one.ie_web
+B: tsc-cached holds lock-tsc-one.ie_web ->  its inner gate-run waits for a slot
+```
+
+Owner pairs measured: 22173/68920, 15762/97557, 87579. **Nothing reaps this** —
+`reapLock` and `gate-reaper.sh` only reap an owner whose pid is GONE, and both
+owners are alive and idle. And **killing the lock holder does not fix it**
+(observed twice): the lock passes straight to the next waiter, which is itself
+inside a gate holding a slot, and the cycle re-forms within seconds. Kill the
+**slot** holder — that is the resource nobody else can produce.
+
+Both inverted sites are fixed (`tsc-cached.sh` re-enters itself through
+`gate-run.sh` in an internal `--locked-compute` mode; `do-reconcile.sh` takes the
+lock INSIDE its `gate-run.sh` command). A cache HIT and `tsc-cached.sh --probe`
+still take neither — a memo lookup must never join a queue. Proof, both halves:
+`bash .claude/scripts/govern-order-check.sh`.
+
+### Region claims — one pheromone map, not nine
+
+`do-fleet.sh` kept its conflict registry in `LOCK_FILE="$(mktemp)"` — **private
+to one fleet process**. Nine concurrent fleet invocations therefore held nine
+private maps and could not see each other, so two fleets each read their region
+as free and both took it. That is how two fleets came to audit the same auth
+seam on one box: not a lock that failed, a map nobody else could read.
+
+The registry now lives at `$GOVERN_DIR/claims/<region>.<cksum>` — the same
+machine-wide directory the gate locks use, so every session and worktree reads
+one map. `ls` it; it is meant to be legible.
+
+| Function | Does |
+|---|---|
+| `claim_take <region> [slug]` | deposit. `mkdir(2)` is the arbiter — N racers, exactly one wins. 0 = yours (re-claiming your own is idempotent), 1 = a live worker holds it |
+| `claim_owner <region>` | `<slug> <pid>` of the LIVE owner, empty if free — **reaps before it answers** |
+| `claim_release` / `claim_release_all` | give ground back; the latter is wired to do-fleet's EXIT trap |
+| `claim_list` / `claim_sweep` | the live map / reap everything dead, echo the count |
+
+**It is not a lock and there is no coordinator.** A worker that finds its region
+claimed takes the next candidate — contention costs a re-rank, never a wait, so
+there is no queue and nothing to deadlock.
+
+**Evaporation is the whole contract.** A claim expires with no human in the
+loop, two ways: the owner pid is dead (`kill -0`, instant) or the lease expired
+(`GOVERN_CLAIM_TTL_SECS`, default 5400s = 90 min — p100 observed fleet duration
+is 79 min). Both fire on the **read** path, so the next contender reclaims dead
+ground by itself; `claim_sweep` at session start only stops uncontended dirs
+accumulating. Note `gate_sweep_stale` matches `lock-*` at depth 1 and will never
+see a claim — that is what `claim_sweep` is for.
+
+Proof, not assertion: `bash .claude/scripts/govern-claims-check.sh` runs 12
+concurrent independent processes at one region (exactly one wins), kills a live
+owner and proves the region becomes claimable again, backdates a lease to fire
+the TTL branch, proves a losing multi-region worker holds **no** ground
+(rollback), and proves do-fleet's own `has_conflict` shape clears on a dead
+owner. It also **stubs `_gv_alive` true and asserts the evaporation checks then
+fail** — a checker that stays green against a gutted reaper proves nothing.
+
+The lock dir is `$TMPDIR/one-govern` — **machine-wide**, so sessions coordinate
+across worktrees automatically. A worktree only participates once it has this
+code: `do-fleet.sh` now **warns per stale worktree** at launch, because until it
+rebases onto `main` its gates are the old unbounded ones and the slot cap is the
+only thing protecting the box from it.
+
+**Editors are the other half of the bill.** Each `/do` cycle drops a ~115MB
+checkout in `.do-worktrees/`; it is gitignored, but editors index gitignored
+paths (Zed only with `search.include_ignored`, which is on here) and every
+indexed worktree costs its own tsserver — measured 16 language-server processes
+holding 2.3-3.0GB from 3 worktrees, entirely outside the gate governor.
+`.vscode/settings.json` + `.cursorignore` exclude it; Zed's equivalent
+(`file_scan_exclusions`) is user-level config, not in this repo.
+
+**Reading swap correctly:** swapins spike during *recovery* too, as freed memory
+lets pages fault back in. Thrash is pages going **out** while swap usage grows
+and free memory is scarce. `machine-check.sh --watch` distinguishes the two;
+don't diagnose from the swapin counter alone.

package/scripts/agent-actor-parity.sh

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+# agent-actor-parity.sh — the Proof line for text/agent-actor-plan.md.
+#
+# THREE GUARDS over the three stores that claim to know which agents are live.
+# All reads are read-only (D1 SELECT, R2 ListObjectsV2, one HTTP GET). Nothing
+# is written, nothing is published.
+#
+#   G1 IDENTITY   every distinct follows.actor_id is a mintable actor id
+#                 ^[a-z0-9][a-z0-9-]{0,62}$ — no trailing dot, no domain
+#   G2 GROUNDING  every distinct follows.actor_id has a live persona in R2
+#                 at <ws>/agents/<id>.md
+#   G3 SUBSTRATE  count(R2 live personas) == count(actor with actor-status "live")
+#
+# EXIT CODES ARE THE VERDICT
+#   0  all three pass
+#   1  a guard FAILED (real mismatch)
+#   3  no guard failed but one is UNRUN — an unrun gate is not a pass
+#   4  could not read a store (credentials / network) — UNRUN, never green
+#
+# Usage:  bash .claude/scripts/agent-actor-parity.sh [workspace]      (default: one)
+#         bash .claude/scripts/agent-actor-parity.sh --self-test      (red + green proof)
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+WS="${1:-one}"
+
+# ── the guard logic, isolated so --self-test can drive it with fixtures ──────
+guards() { # $1=actor_ids file  $2=r2 live names file  $3=substrate live count ("" = unrun)
+  python3 - "$1" "$2" "${3:-}" <<'PY'
+import re,sys
+ids=[l.strip() for l in open(sys.argv[1]) if l.strip()]
+r2=set(l.strip() for l in open(sys.argv[2]) if l.strip())
+sub=sys.argv[3]
+ID=re.compile(r'^[a-z0-9][a-z0-9-]{0,62}$')
+bad=[i for i in ids if not ID.match(i)]
+ung=[i for i in ids if i not in r2]
+rc=0
+print(f"G1 IDENTITY   {'pass' if not bad else 'FAIL'}  {len(ids)-len(bad)}/{len(ids)} mintable" + (f"  -> {' '.join(sorted(bad))}" if bad else ""))
+print(f"G2 GROUNDING  {'pass' if not ung else 'FAIL'}  {len(ids)-len(ung)}/{len(ids)} have an R2 persona" + (f"  -> {len(ung)} ungrounded" if ung else ""))
+if bad or ung: rc=1
+if sub=="":
+    print(f"G3 SUBSTRATE  unrun  R2 live={len(r2)}  actor-status live=UNREADABLE (no door)")
+    rc = rc if rc else 3
+else:
+    ok = int(sub)==len(r2) and len(r2)>0
+    print(f"G3 SUBSTRATE  {'pass' if ok else 'FAIL'}  R2 live={len(r2)}  actor-status live={sub}")
+    if not ok: rc=1
+sys.exit(rc)
+PY
+}
+
+# ── --self-test: prove the checker can go BOTH ways ─────────────────────────
+if [ "${1:-}" = "--self-test" ]; then
+  T="$(mktemp -d)"; trap 'rm -rf "$T"' EXIT
+  printf 'ceo\ncmo.\n'      > "$T/red_ids";   printf 'ceo\n'        > "$T/red_r2"
+  printf 'ceo\ncto\n'       > "$T/green_ids"; printf 'ceo\ncto\n'   > "$T/green_r2"
+  guards "$T/red_ids" "$T/red_r2" 0 >/dev/null 2>&1; r=$?
+  guards "$T/green_ids" "$T/green_r2" 2 >/dev/null 2>&1; g=$?
+  guards "$T/green_ids" "$T/green_r2" "" >/dev/null 2>&1; u=$?
+  echo "self-test: red=$r (want 1)  green=$g (want 0)  unrun=$u (want 3)"
+  [ "$r" = 1 ] && [ "$g" = 0 ] && [ "$u" = 3 ] && { echo "SELF-TEST PASS"; exit 0; }
+  echo "SELF-TEST FAIL"; exit 1
+fi
+
+WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
+
+# ── store 1: D1 follows ─────────────────────────────────────────────────────
+( cd "$ROOT/one.ie/web" && npx wrangler d1 execute one-owners --remote --json \
+    --command "SELECT DISTINCT actor_id FROM follows WHERE workspace='$WS' ORDER BY actor_id" 2>/dev/null ) \
+  | python3 -c "import json,sys;d=json.load(sys.stdin);print('\n'.join(r['actor_id'] for r in d[0]['results']))" \
+  > "$WORK/ids" || { echo "UNRUN: D1 follows unreadable"; exit 4; }
+[ -s "$WORK/ids" ] || { echo "UNRUN: D1 follows returned no rows for workspace=$WS"; exit 4; }
+
+# ── store 2: R2 one-content, ListObjectsV2 (SigV4, stdlib only) ─────────────
+python3 - "$ROOT/one.ie/web/.dev.vars" "one-content" "$WS/agents/" > "$WORK/r2" <<'PY' || { echo "UNRUN: R2 unreadable"; exit 4; }
+import sys,hmac,hashlib,datetime,urllib.request,urllib.parse
+import xml.etree.ElementTree as ET
+env={}
+for line in open(sys.argv[1],encoding='utf-8',errors='ignore'):
+    line=line.strip()
+    if line and not line.startswith('#') and '=' in line:
+        k,v=line.split('=',1); env[k.strip()]=v.strip().strip('"').strip("'")
+AK=env['CLOUDFLARE_R2_S3_ACCESS_KEY_ID']; SK=env['CLOUDFLARE_R2_S3_SECRET_KEY']
+host=f"{env['CLOUDFLARE_ACCOUNT_ID']}.r2.cloudflarestorage.com"
+bucket,prefix=sys.argv[2],sys.argv[3]
+sign=lambda k,m: hmac.new(k,m.encode(),hashlib.sha256).digest()
+def page(tok):
+    q={'list-type':'2','prefix':prefix,'max-keys':'1000'}
+    if tok: q['continuation-token']=tok
+    qs='&'.join(f"{urllib.parse.quote(k,safe='')}={urllib.parse.quote(v,safe='')}" for k,v in sorted(q.items()))
+    t=datetime.datetime.now(datetime.timezone.utc)
+    ad,ds=t.strftime('%Y%m%dT%H%M%SZ'),t.strftime('%Y%m%d')
+    ph=hashlib.sha256(b'').hexdigest()
+    cr=f"GET\n/{bucket}\n{qs}\nhost:{host}\nx-amz-content-sha256:{ph}\nx-amz-date:{ad}\n\nhost;x-amz-content-sha256;x-amz-date\n{ph}"
+    sc=f"{ds}/auto/s3/aws4_request"
+    sts=f"AWS4-HMAC-SHA256\n{ad}\n{sc}\n{hashlib.sha256(cr.encode()).hexdigest()}"
+    k=sign(('AWS4'+SK).encode(),ds);k=sign(k,'auto');k=sign(k,'s3');k=sign(k,'aws4_request')
+    sig=hmac.new(k,sts.encode(),hashlib.sha256).hexdigest()
+    r=urllib.request.Request(f"https://{host}/{bucket}?{qs}",headers={'Host':host,'x-amz-date':ad,
+        'x-amz-content-sha256':ph,'Authorization':f"AWS4-HMAC-SHA256 Credential={AK}/{sc}, "
+        f"SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature={sig}"})
+    return urllib.request.urlopen(r,timeout=60).read()
+ns='{http://s3.amazonaws.com/doc/2006-03-01/}';keys=[];tok=None
+while True:
+    root=ET.fromstring(page(tok))
+    keys += [c.find(ns+'Key').text for c in root.findall(ns+'Contents')]
+    tr=root.find(ns+'IsTruncated')
+    if tr is not None and tr.text=='true': tok=root.find(ns+'NextContinuationToken').text
+    else: break
+for k in sorted(keys):
+    rel=k[len(prefix):]
+    if rel.endswith('.md') and '/' not in rel: print(rel[:-3])
+PY
+
+# ── store 3: the substrate. actor-status "live" has no read door today. ─────
+SUB=""
+CODE=$(curl -s -o "$WORK/sub" -w '%{http_code}' --max-time 25 \
+        "https://one.ie/api/export/actors?workspace=$WS&status=live" 2>/dev/null || echo 000)
+if [ "$CODE" = "200" ]; then
+  SUB=$(python3 -c "
+import json,sys
+try:
+  d=json.load(open('$WORK/sub'))
+  rows=d if isinstance(d,list) else d.get('actors',d.get('results',[]))
+  print(sum(1 for r in rows if str(r.get('actorStatus',r.get('actor-status',''))) == 'live'))
+except Exception: print('')" 2>/dev/null)
+fi
+
+echo "workspace=$WS  follows_actors=$(wc -l < "$WORK/ids" | tr -d ' ')  r2_live_personas=$(wc -l < "$WORK/r2" | tr -d ' ')  export_actors_http=$CODE"
+guards "$WORK/ids" "$WORK/r2" "$SUB"

package/scripts/chrome.mjs

@@ -30,6 +30,9 @@
  *   --header <k: v>        extra HTTP header (repeatable)
  *   --ua <string>          user agent
  *   --viewport <WxH>       viewport (default 1280x800)
+ *   --reduced-motion       emulate `prefers-reduced-motion: reduce` for the run, so a
+ *                          reduced-motion rule can be CHECKED instead of believed:
+ *                          drive the same route twice and diff the computed styles
  *   --headed               use full Chromium with a visible window instead of the shell
  *   --max <n>              truncation ceiling for text/html/eval (default 4000)
  *
@@ -184,8 +187,23 @@ const statePath = typeof val('state') === 'string' ? val('state') : null
 const stateLoaded = Boolean(statePath && existsSync(statePath))
 
 const [vw, vh] = String(val('viewport', '1280x800')).split('x').map(Number)
+// THE FLAG text/ehc-motion.md ASKED FOR, and what it buys.
+//
+// That page could not write an `accept:` for its own central rule — "reduced
+// motion must reach the same final frame" — because this harness had no way to
+// ask for the flag, so every reduced-motion block in the repo was believed
+// rather than checked, and one of them (`Layout.astro:599`) had already been
+// correct, reviewed, and DEAD because its sheet was not on the page. An
+// animation is the one kind of code whose failure looks exactly like success.
+//
+// Playwright emulates it per context (CDP `Emulation.setEmulatedMedia`), so the
+// same route can be driven twice and the two `getComputedStyle` readings
+// compared. `--reduced-motion` asks for `reduce`; the default stays `no-preference`
+// so every existing caller reads exactly what it read before.
+const reducedMotion = flag('reduced-motion') ? 'reduce' : 'no-preference'
 const context = await browser.newContext({
   viewport: { width: vw || 1280, height: vh || 800 },
+  reducedMotion,
   ...(stateLoaded ? { storageState: statePath } : {}),
   ...(typeof val('ua') === 'string' ? { userAgent: val('ua') } : {}),
   ...(all('header').length

package/scripts/close-metrics.sh

@@ -246,7 +246,19 @@ if _want gates; then
   # as yours. A memo HIT is free and it counts.
   if [ -f "$S/test-full.sh" ]; then
     keys="$(cd "$ROOT" && TEST_CACHE_KEY_ONLY=1 _try 12 bash .claude/scripts/test-full.sh | grep -Eo '^[0-9a-f]{64}$')"
-    cache="${TEST_CACHE_DIR:-$ROOT/.claude/.test-cache}"
+    # ${TMPDIR:-/tmp}/one-test-cache — the SAME default test-cached.sh:32 mints into
+    # and do-close.sh:110 reads. It used to be "$ROOT/.claude/.test-cache", a path no
+    # minter has ever written to, so `ls` found nothing and this row could only ever
+    # answer MISS. Measured 2026-09-15 on a tree whose two lanes were both stamped:
+    # the gate LEG read "pass — 2/2 lane(s), minted 09:16:44Z" and this row read
+    # "MISS 0/2", same tree, same second. A permanent false RED on the one row that
+    # gates the board write.
+    #
+    # This is the file's own Rule 1 broken — "it composes, it never re-derives". The
+    # row re-derived the cache PATH instead of taking the owner's, which is the same
+    # drift-with-a-delay that made it call test-cached.sh without a <folder>. Both
+    # halves of that lesson are now spent; the path is not to be re-derived either.
+    cache="${TEST_CACHE_DIR:-${TMPDIR:-/tmp}/one-test-cache}"
     if [ -z "$keys" ]; then
       _row gates full_suite_receipt "" unrun "test-full.sh printed no receipt key inside its budget"
     else
@@ -484,6 +496,23 @@ if [ "$SELFTEST" -eq 1 ]; then
   printf '%s' "$out" | grep -E 'full_suite_receipt .*(MISS|unrun)' >/dev/null
   ck $? "RED PROOF — an absent receipt cache is MISS or unrun, never a green receipt"
 
+  # GREEN PROOF — and it is the half that was missing, which is how the row stayed
+  # broken. The red proof above passes just as happily when the row can ONLY answer
+  # red: for months `cache` defaulted to "$ROOT/.claude/.test-cache", a path no
+  # minter has ever written to, so MISS was the only reachable verdict and the one
+  # check guarding it was satisfied by the defect. Measured 2026-09-15: the gate LEG
+  # read "pass — 2/2 lane(s)" on a tree this row called "MISS 0/2", same second.
+  #
+  # A check that cannot go both ways is not a check. But note WHERE the fault was:
+  # in the DEFAULT. A proof that exports TEST_CACHE_DIR overrides that default and
+  # passes against the broken version too — verified, and it is why the first attempt
+  # at this check was worthless. So the proof reads the default EXPRESSION and
+  # requires it to be the same one the minter uses.
+  minter="$(grep -m1 '^CACHE_DIR=' "$ROOT/.claude/scripts/test-cached.sh" | sed 's/^CACHE_DIR=//')"
+  mine="$(grep -m1 '^[[:space:]]*cache=' "${BASH_SOURCE[0]}" | sed 's/^[[:space:]]*cache=//')"
+  [ -n "$minter" ] && [ "$minter" = "$mine" ]
+  ck $? "PARITY — the receipt cache default matches test-cached.sh's (minter: ${minter:-?} / reader: ${mine:-?})"
+
   out="$(bash "${BASH_SOURCE[0]}" --section rubric 2>&1)"
   printf '%s' "$out" | grep -q 'no --composite passed'
   ck $? "RED PROOF — no --composite is UNRUN, never a zero score"

package/scripts/close-owner.sh

@@ -1,7 +1,9 @@
 #!/usr/bin/env bash
 # close-owner.sh — resolve WHO owns a close and WHO they report to.
 #
-# manifest: portable
+# manifest: needs-env
+#   (reads $ROOT/one.ie/ai/agents — degrades to `owner=ceo via=fallback hits=0`
+#    off-monorepo, which is a no-op, not a lie. Not `portable`: it names the path.)
 #
 # /close needs two deterministic facts before any model speaks: which agent owns
 # the work, and which agent it reports to. Both are declared in the roster
@@ -36,11 +38,36 @@ _tier_rank() {
 _field() { grep -m1 "^$2:" "$1" 2>/dev/null | cut -d' ' -f2- | tr -d '\r' | xargs 2>/dev/null; }
 
 # The bare stake words only — skip every `- signal:` line.
+#
+# TWO YAML SHAPES, and missing the second one made 24 agents invisible.
+# Block:  subscribes:\n  - ship\n  - deploy
+# Inline: subscribes: [engineering, do-event, ship, deploy, contracts]
+# The old parser matched `/^subscribes:/` and immediately `next`ed — which for the
+# inline shape SKIPS THE ONLY LINE THE TAGS ARE ON, so the agent parsed as having
+# no stake and was silently unreachable by tag. Measured 2026-09-15: 24 of ~108
+# agent files use the inline shape, and `close-owner.sh --tags ship` answered
+# `hits=0 confidence=none` while release-manager/agent.md:18 stakes both `ship`
+# and `deploy`. Every close on those tags fell through to the CEO fallback and
+# read as "nobody owns this area" — the routing was wrong, not the roster.
 _stakes() {
-  awk '/^subscribes:/{f=1;next} f&&/^[a-zA-Z_]+:/{f=0} f&&/^[[:space:]]*-[[:space:]]/{
-    line=$0; sub(/^[[:space:]]*-[[:space:]]*/,"",line)
-    if (line !~ /^signal:/ && line !~ /:/ && line != "") print line
-  }' "$1" 2>/dev/null | tr -d '\r' | xargs -n1 2>/dev/null
+  awk '
+    /^subscribes:/ {
+      if ($0 ~ /\[/) {                      # inline flow list — tags are on THIS line
+        l=$0; sub(/^[^[]*\[/,"",l); sub(/\].*$/,"",l)
+        n=split(l,a,",")
+        for (i=1;i<=n;i++) {
+          t=a[i]; gsub(/^[ \t"]+|[ \t"]+$/,"",t)
+          if (t !~ /^signal:/ && t !~ /:/ && t != "") print t
+        }
+        f=0; next
+      }
+      f=1; next                             # block list — tags are on following lines
+    }
+    f&&/^[a-zA-Z_]+:/{f=0}
+    f&&/^[[:space:]]*-[[:space:]]/{
+      line=$0; sub(/^[[:space:]]*-[[:space:]]*/,"",line)
+      if (line !~ /^signal:/ && line !~ /:/ && line != "") print line
+    }' "$1" 2>/dev/null | tr -d '\r' | xargs -n1 2>/dev/null
 }
 
 _superior() {           # walk the declared chain, then the tier ladder
@@ -101,7 +128,21 @@ _index() {
     /^name:/        { sub(/^name:[[:space:]]*/,"");        name=$0 }
     /^tier:/        { sub(/^tier:[[:space:]]*/,"");        tier=$0 }
     /^reports_to:/  { sub(/^reports_to:[[:space:]]*/,"");  rt=$0 }
-    /^subscribes:/  { insub=1; next }
+    # Both YAML shapes — see _stakes() above for why the inline one is not optional.
+    # `name:` precedes `subscribes:` in every agent.md, so name is already bound here.
+    /^subscribes:/  {
+      if ($0 ~ /\[/) {
+        il=$0; sub(/^[^[]*\[/,"",il); sub(/\].*$/,"",il)
+        ic=split(il,ia,",")
+        for (ii=1;ii<=ic;ii++) {
+          it=ia[ii]; gsub(/^[ \t"]+|[ \t"]+$/,"",it)
+          if (it !~ /^signal:/ && it !~ /:/ && it != "")
+            print (name==""?dir:name) "\t" tier "\t" rt "\t" it
+        }
+        insub=0; next
+      }
+      insub=1; next
+    }
     insub && /^[a-zA-Z_]+:/ { insub=0 }
     insub && /^[[:space:]]*-[[:space:]]/ {
       l=$0; sub(/^[[:space:]]*-[[:space:]]*/,"",l); gsub(/[[:space:]]+$/,"",l)
@@ -240,6 +281,23 @@ cmd_self_test() {
   local ns; ns="$(cmd_resolve 'campaign:brief')"
   _expect "a namespaced trigger word matches NOBODY (falls back)" "$ns" "owner=ceo"
 
+  # THE INLINE-YAML SHAPE. `subscribes:` is written two ways across the roster and
+  # for a long time only one was parsed: `/^subscribes:/ … next` skipped the very
+  # line an inline `[a, b, c]` keeps its tags on, so those agents had NO stake as
+  # far as this resolver was concerned. Measured 2026-09-15 — 24 of ~108 agent
+  # files use the inline shape, and `--tags deploy,release,ship` answered
+  # `hits=0 confidence=none` while release-manager/agent.md:18 reads
+  # `subscribes: [engineering, do-event, ship, deploy, contracts]`. It did not look
+  # like a bug: "no agent staked this" is a legitimate answer this script gives on
+  # purpose, so every close on those tags fell through to the CEO and read as an
+  # unowned area of the company rather than a parser that could not see the roster.
+  # These two assert the inline shape resolves; the file they depend on is a real
+  # one, so a rewrite of that frontmatter to the block shape keeps them green.
+  _expect "an INLINE subscribes: [a, b] list is parsed (not skipped)" \
+    "$(cmd_resolve 'deploy,ship')" "owner=release-manager"
+  _expect "an inline stake carries full confidence, like a block one" \
+    "$(cmd_resolve 'deploy,ship')" "confidence=high"
+
   # RED PROOF: gut the mechanism the resolver ACTUALLY reads and assert the
   # matches stop working. A checker that stays green against a gutted mechanism
   # proves nothing — and this one caught exactly that on itself: it used to gut