@oneie/claude 0.9.0 → 0.10.0

package/scripts/land.sh

@@ -23,6 +23,37 @@
 # What it will NOT do: touch production. Promotion to one.ie is `./deploy`, a
 # full gate and a human decision. A fast pass is never reported as a full pass.
 #
+# --- A RED ON THE INTEGRATED TREE HAS THREE OWNERS ---------------------------
+# Step 2 gates the branch WITH dev merged in, so a red there can belong to:
+#
+#   the branch     — red on its own, dev innocent
+#   dev            — dev was already red; every branch landing now inherits it
+#   the seam       — green alone, green on dev, red TOGETHER (a signature dev
+#                    changed, a call the branch added; each side typechecks)
+#   (and a fourth that is nobody's: the ENVIRONMENT — the substrate door the
+#    real-TypeDB suites need was down at gate time, and eight of those suites
+#    refuse to skip by design)
+#
+# Until 2026-09-12 every one of these printed the same line — "fast gate RED on
+# <branch> — not landing it" — which is the wrong owner three ways out of four,
+# and a wrong diagnosis is worse than none because it sends the executor to fix
+# the wrong tree. Measured that day on feat/agent-page: the first red WAS the
+# seam (TS2559 — dev changed authorizeWorkspace's env shape, the branch's
+# overview.ts passed the old one; both green alone), the executor fixed it, and
+# the NEXT red — same line, same blame — was `fixture write failed (transport:
+# fetch failed)` against a local gateway that was not answering; the same suite
+# passed 4/4 five minutes later. Two reds, two owners, one message.
+#
+# So a red is DIAGNOSED, deterministically, from three cheap facts:
+#   1. the branch's own typecheck BEFORE the merge — a memo lookup
+#      (`tsc-cached.sh --probe`; verify:fast stamps it on every edit), never a
+#      compute: `green` or `unknown`
+#   2. dev's own typecheck at the sha merged in — the same lookup on dev's tree
+#   3. the gate's own output: `error TS` lines, transport failures, assertion
+#      failures, and WHICH SIDE of the merge touched each failing file
+# and the record (`deploy-runs.json`) carries the verdict as its note, so the
+# /deploy page shows why, not just that.
+#
 # --- THE OTHER DOOR: --pr ----------------------------------------------------
 #   bash .claude/scripts/land.sh feat/x --pr        # open/update a PR, do not touch main
 #
@@ -84,10 +115,14 @@ cd "$ROOT" || exit 1
 # so nothing ever advanced dev and it fell behind by construction — 5 commits one
 # way, 8 the other, undetected until someone asked.
 TRUNK="${LAND_TRUNK:-dev}"
-DEPLOY=0 DRY=0 QUICK=0 PR=0 PR_BASE="main" BRANCHES=() PROBES=()
+DEPLOY=0 DRY=0 QUICK=0 PR=0 SELF_TEST=0 PR_BASE="main" BRANCHES=() PROBES=()
+INTEGRATE=0 INTEGRATE_FULL=0
 for a in "$@"; do
   case "$a" in
+    --self-test) SELF_TEST=1 ;;
     --deploy) DEPLOY=1 ;;
+    --integrate) INTEGRATE=1 ;;
+    --full) INTEGRATE_FULL=1 ;;
     --quick) QUICK=1 ;;
     --pr) PR=1 ;;
     --to) LAND_TRUNK_ARG=1 ;;
@@ -101,7 +136,17 @@ for a in "$@"; do
   esac
 done
 [[ "${WANT_PROBE:-0}" == 1 ]] && { echo "land.sh: --probe needs a route" >&2; exit 2; }
-(( ${#BRANCHES[@]} )) || { echo "land.sh: name at least one branch" >&2; exit 2; }
+(( ${#BRANCHES[@]} || SELF_TEST )) || { echo "land.sh: name at least one branch" >&2; exit 2; }
+# --integrate advances $TRUNK; --pr deliberately advances nothing. Asking for
+# both is asking for two different answers to "where does this work go".
+if (( INTEGRATE && PR )); then
+  echo "land.sh: --integrate and --pr are opposite doors — --integrate advances $TRUNK, --pr advances nothing" >&2
+  exit 2
+fi
+if (( INTEGRATE && QUICK )); then
+  echo "land.sh: --quick is a per-branch concession; --integrate already costs ONE gate — run it properly" >&2
+  exit 2
+fi
 # --pr --deploy is the full workflow (gate -> dev -> probe -> PR) and it ships
 # the BRANCH's worktree, not main. dev.one.ie is one slot, so it takes one branch:
 # with two, the second overwrites the first while the first is being probed.
@@ -134,12 +179,98 @@ worktree_of() {
 
 LANDED=() FAILED=() LANDED_QUICK=0 PRS=() DEV_NOTE="" DEV_URL="https://dev.one.ie"
 BR_T0=0 GATE_T=0 DEV_T=0 PROBE_T=0 PR_T=0; PH=()
+# Where $TRUNK is checked out, if anywhere (dev IS, on this box — see step 3).
+TRUNK_WT="$(worktree_of "$TRUNK")"
+
+# Per-branch facts the diagnosis reads. Reset at the top of every branch.
+pre_sha="" dev_sha="" PRE_TSC="unknown" DEV_TSC="unknown" GW_URL="" GW_HTTP=""
+DEV_FILES="" BR_FILES="" DIAG_NOTE=""
+
+# The memo lookup — `green` when this exact tree has a recorded typecheck PASS,
+# `unknown` otherwise (never checked, or checked and red: a red is never
+# stamped). Never computes: TSC_CACHE_ROOT points MAIN's tsc-cached at another
+# checkout, and the key is content, so a stamp made in the branch's worktree by
+# its own verify:fast is found here.
+_tsc_memo() { # <tree>
+  TSC_CACHE_ROOT="$1" bash "$ROOT/.claude/scripts/tsc-cached.sh" --probe one.ie/web 2>/dev/null || echo unknown
+}
+
+# Which side of the merge touched a repo-relative path. DEV_FILES is what the
+# merge brought in (pre-merge sha..HEAD); BR_FILES is what the branch added
+# (dev sha..HEAD). Both computed by git after step 1, so this cannot drift.
+_side() { # <repo-relative path>
+  local d=0 b=0
+  [[ -n "$DEV_FILES" ]] && grep -qxF "$1" <<<"$DEV_FILES" && d=1
+  [[ -n "$BR_FILES" ]] && grep -qxF "$1" <<<"$BR_FILES" && b=1
+  case "$d$b" in
+    11) echo "both sides touched it" ;;
+    10) echo "$TRUNK's change" ;;
+    01) echo "the branch's file" ;;
+    *)  echo "touched by neither side" ;;
+  esac
+}
+
+# The diagnosis. Reads the gate's own output plus the two memo facts; prints the
+# block and sets DIAG_NOTE (one line, for the record). It never changes the
+# verdict — the gate is red and the branch is not landing; this says WHOSE red.
+_land_diagnose() { # <branch> <gate-log>
+  local br="$1" log="$2" ts_n env_n assert_n fails f
+  ts_n=$(grep -c 'error TS' "$log" 2>/dev/null || true); ts_n=${ts_n:-0}
+  env_n=$(grep -cE 'transport: fetch failed|fixture write failed|ECONNREFUSED|unreachable \(' "$log" 2>/dev/null || true); env_n=${env_n:-0}
+  assert_n=$(grep -cE 'AssertionError|expected .* to (be|equal|have|contain|match|throw|deep)' "$log" 2>/dev/null || true); assert_n=${assert_n:-0}
+  fails="$(grep -oE 'FAIL +[^ ]+\.test\.[a-z]+' "$log" 2>/dev/null | awk '{print $2}' | sort -u || true)"
+  say ""
+  say "  ── why the gate is red ──"
+  if (( ts_n > 0 )); then
+    say "  typecheck: $ts_n error(s) on the INTEGRATED tree"
+    say "    branch alone @${pre_sha:-?}  : $PRE_TSC"
+    say "    $TRUNK alone    @${dev_sha:-?}  : $DEV_TSC"
+    say "    integrated            : $ts_n error(s)"
+    grep 'error TS' "$log" | head -3 | sed 's/^/      /'
+    for f in $(sed -nE 's/^([^(]+)\([0-9]+,[0-9]+\): error TS.*/\1/p' "$log" | sort -u | head -5); do
+      say "      $f — $(_side "one.ie/web/$f")"
+    done
+    if [[ "$DEV_TSC" == unknown* ]]; then
+      warn "$TRUNK's own typecheck is NOT on record at ${dev_sha:-?} — check $TRUNK before blaming $br:"
+      say "      TSC_CACHE_ROOT=${TRUNK_WT:-<$TRUNK worktree>} bash .claude/scripts/tsc-cached.sh one.ie/web"
+      DIAG_NOTE="typecheck red on the integrated tree; $TRUNK unverified at ${dev_sha:-?}"
+    elif [[ "$PRE_TSC" == green ]]; then
+      warn "INTEGRATION defect — green alone, green on $TRUNK, red together."
+      warn "  $TRUNK brought $(git -C "$wt" rev-list --count "${pre_sha:-HEAD}..HEAD" 2>/dev/null || echo '?') commit(s) touching $(grep -c . <<<"$DEV_FILES" || true) file(s); the error lives in the seam."
+      warn "  Fix on $br (in $wt), then re-run: bash .claude/scripts/land.sh $br"
+      DIAG_NOTE="integration defect: $ts_n tsc error(s) only when $br and $TRUNK meet"
+    else
+      warn "$br was NOT typechecked as committed before this land — its own share is unknown."
+      warn "  Run verify:fast in $wt first; a memo of that pass is what lets the next land attribute a red."
+      DIAG_NOTE="typecheck red; $br unverified alone"
+    fi
+    return 0
+  fi
+  if (( env_n > 0 && assert_n == 0 )); then
+    say "  ENVIRONMENT: $env_n transport failure(s), 0 assertion failures"
+    [[ -n "$fails" ]] && printf '%s\n' "$fails" | sed 's/^/      /'
+    if [[ "$GW_HTTP" == "000" ]]; then
+      warn "the substrate door $GW_URL was DOWN at pre-flight and the gate could not reach it."
+    else
+      warn "the substrate door $GW_URL answered at pre-flight (HTTP $GW_HTTP) and dropped during the run — a wrangler reload, or a flip of .env under a running gate."
+    fi
+    warn "  These suites refuse to skip by design (real TypeDB or red). This is NOT evidence against $br."
+    warn "  Bring the gateway back (or point GATEWAY_URL at a live one; \`typedb-env.sh\` flips .env) and re-run: bash .claude/scripts/land.sh $br"
+    DIAG_NOTE="environment: substrate $GW_URL unreachable ($env_n transport failure(s), 0 assertions)"
+    return 0
+  fi
+  say "  tests: $assert_n assertion failure(s)"
+  for f in $fails; do say "      $f — $(_side "one.ie/web/$f")"; done
+  [[ -z "$fails" ]] && say "      (no FAIL line found — read the gate output above)"
+  DIAG_NOTE="test red: $(printf '%s' "$fails" | tr '\n' ' ')"
+  return 0
+}
 
 # The record the /deploy page renders. A RED run is the one most worth a timing —
 # a record holding only successes cannot be read for a trend, and the phase that
 # refused is exactly what a reader wants to see. It can never change an exit
 # status: the whole call is `|| true`.
-_land_record() { # <branch> <verdict>
+_land_record() { # <branch> <verdict> [note]
   [[ -x "$ROOT/.claude/scripts/deploy-record.sh" ]] || return 0
   (( DRY )) && return 0
   local door="land"
@@ -150,6 +281,7 @@ _land_record() { # <branch> <verdict>
   local -a args=(--door "$door" --branch "$1" --verdict "$2" --target "$target"
                  --sha "$(git -C "$ROOT" rev-parse --short "$1" 2>/dev/null || echo '')"
                  --wall "$(( SECONDS - BR_T0 ))")
+  [[ -n "${3:-}" ]] && args+=(--note "$3")
   local p; for p in ${PH[@]+"${PH[@]}"}; do args+=(--phase "$p"); done
   bash "$ROOT/.claude/scripts/deploy-record.sh" "${args[@]}" >/dev/null 2>&1 || true
   # The same nudge deploy.sh prints. This door is where it is cheapest to act
@@ -163,6 +295,166 @@ _land_record() { # <branch> <verdict>
   return 0
 }
 
+# --self-test — the diagnosis driven with synthetic gate output, including the
+# RED half: a log that carries BOTH a transport failure and an assertion must
+# not be excused as environment. No gate runs, no branch is touched.
+if (( SELF_TEST )); then
+  fails=0; _log="$(mktemp)"; wt="$ROOT"
+  _case() { # <name> <expected DIAG_NOTE prefix> <expected substring in output>
+    # Not `out="$(…)"`: a command substitution is a subshell, and DIAG_NOTE set
+    # inside it never reaches this shell — the first cut of this checker failed
+    # all seven cases with an empty note for exactly that reason.
+    local out; _land_diagnose feat/probe "$_log" > "$_log.out" 2>&1; out="$(cat "$_log.out")"; rm -f "$_log.out"
+    if [[ "$DIAG_NOTE" == "$2"* ]] && [[ "$out" == *"$3"* ]]; then echo "ok: $1 → ${DIAG_NOTE%%:*}"
+    else echo "FAIL: $1 — note '$DIAG_NOTE', wanted '$2*' and output containing '$3'"; fails=$((fails+1)); fi
+  }
+  pre_sha=aaaaaaa dev_sha=bbbbbbb
+  DEV_FILES="one.ie/web/src/lib/authorize.ts"; BR_FILES="one.ie/web/src/pages/api/agents/[id]/overview.ts"
+  printf '%s\n' 'src/pages/api/agents/[id]/overview.ts(59,44): error TS2559: Type X has no properties in common with type Y.' \
+    '[verify-fast] typecheck FAILED — 1 error(s) in one.ie/web' > "$_log"
+  PRE_TSC=green DEV_TSC=green;   _case "tsc red, both green alone" "integration defect" "the branch's file"
+  PRE_TSC=green DEV_TSC=unknown; _case "tsc red, dev not on record" "typecheck red on the integrated tree; dev unverified" "check dev before blaming"
+  PRE_TSC=unknown DEV_TSC=green; _case "tsc red, branch never checked" "typecheck red; feat/probe unverified" "NOT typechecked as committed"
+  printf '%s\n' 'typedbQuery transport failure: fetch failed' \
+    ' FAIL  tests/tasks-bulk.test.ts > tasks:bulk — N rows (real TypeDB)' \
+    'Error: fixture write failed (status=0 error=transport: fetch failed) — nothing below proves anything.' > "$_log"
+  GW_URL=http://127.0.0.1:8790 GW_HTTP=000; _case "transport red, door down" "environment:" "was DOWN at pre-flight"
+  GW_HTTP=404;                              _case "transport red, door dropped" "environment:" "dropped during the run"
+  printf '%s\n' ' FAIL  tests/unit/foo.test.ts > foo' 'AssertionError: expected 1 to be 2' > "$_log"
+  _case "assertion red" "test red: tests/unit/foo.test.ts" "1 assertion failure"
+  # RED PROOF: a transport line next to a real assertion is a test red, not an excuse.
+  printf '%s\n' 'typedbQuery transport failure: fetch failed' ' FAIL  tests/unit/foo.test.ts > foo' 'AssertionError: expected 1 to be 2' > "$_log"
+  _case "transport + assertion" "test red:" "assertion failure"
+  rm -f "$_log"
+  [[ "$fails" -eq 0 ]] && { echo "land.sh: self-test PASS"; exit 0; }
+  echo "land.sh: self-test FAILED ($fails)"; exit 1
+fi
+
+# ── THE TRUNK LOCK ───────────────────────────────────────────────────────────
+# Three land.sh runs raced on `dev` on 2026-09-13 and NOTHING landed: 0 of 14
+# branches in 32 minutes with every gate GREEN. The shape is a livelock, not a
+# slow path — each ~20-minute gate outlived the next session's fast-forward, so
+# the ff was refused as "$TRUNK genuinely moved", and the retry inherits exactly
+# the same race. More sessions made it strictly worse.
+#
+# The fix is not to forbid concurrency, it is to SERIALISE the trunk: one lander
+# owns $TRUNK at a time and the others queue behind it, so a second session
+# lands AFTER the first instead of invalidating it. The primitive already
+# existed (gate_lock, lib/govern.sh) — land.sh simply never took it.
+#
+# Not held under --pr (a PR never advances $TRUNK, so there is nothing to race)
+# and not under --dry-run. LAND_LOCK_WAIT bounds the queue; the default is
+# generous because waiting is the CHEAP outcome here — the expensive one is a
+# gate that runs for 20 minutes and then cannot land.
+if (( ! PR && ! DRY )); then
+  # shellcheck source=lib/govern.sh
+  . "$ROOT/.claude/scripts/lib/govern.sh"
+  if ! gate_lock "land-$TRUNK" "${LAND_LOCK_WAIT:-3600}"; then
+    echo "land.sh: another land into $TRUNK still holds the lock after ${LAND_LOCK_WAIT:-3600}s." >&2
+    echo "land.sh: NOT racing it — a concurrent land is how 0 of 14 branches landed on 2026-09-13." >&2
+    exit 1
+  fi
+  trap 'gate_unlock "land-'"$TRUNK"'"' EXIT
+fi
+
+# ── --integrate: N branches, ONE gate ────────────────────────────────────────
+# The default path gates each branch in its own worktree: N branches cost N
+# gates. On a box whose governor funds ONE slot (the effective cap is
+# min(GOVERN_MAX_GATES, what memory funds at ~2300MB each) — measured cap 1 on
+# 2026-09-13 with 2GB free), those gates are strictly serial, so 14 branches is
+# ~14 × 20min ≈ 5 hours of wall clock to prove a tree nobody will ever ship.
+#
+# What actually ships is the INTEGRATED tree, and root CLAUDE.md already says
+# so: "one gate on the integrated tree also costs one gate, not N." This door
+# implements that sentence — merge every named branch into $TRUNK's worktree,
+# then gate ONCE. 14× less gate, and it is a STRICTLY STRONGER proof than the
+# per-branch lane, which is green on each branch and blind to the defect that
+# only exists once they are combined (measured twice on 2026-09-13: five inbox
+# suites, then two stale stubs that reached main and blocked the release).
+#
+# The trade, stated plainly: a red here does not name its branch. That is what
+# --no-ff buys back — every branch is one identifiable merge commit, so
+# `git revert -m 1 <sha>` backs out a single suspect without disturbing the
+# rest. A conflicting branch is SET ASIDE and named, never aborted wholesale:
+# one conflict must not cost the other thirteen merges.
+if (( INTEGRATE )); then
+  step "integrate ${#BRANCHES[@]} branch(es) into $TRUNK — one gate, not ${#BRANCHES[@]}"
+
+  TRUNK_WT="$(git worktree list --porcelain \
+    | awk -v b="refs/heads/$TRUNK" '/^worktree /{w=$2} $0=="branch "b{print w; exit}')"
+  [[ -n "$TRUNK_WT" ]] || { bad "$TRUNK is not checked out in any worktree — cannot integrate"; exit 2; }
+  say "  worktree: $TRUNK_WT"
+
+  # A dirty trunk is the same refusal the ff path makes, and for the same
+  # reason: a gate on a tree carrying someone's half-typed file measures that
+  # file, not these branches.
+  if [[ -n "$(git -C "$TRUNK_WT" status --porcelain --untracked-files=no)" ]]; then
+    bad "$TRUNK's worktree has uncommitted TRACKED changes — refusing to integrate onto it"
+    git -C "$TRUNK_WT" status --short --untracked-files=no | sed 's/^/    /'
+    exit 2
+  fi
+
+  MERGED=() CONFLICTED=() ALREADY=()
+  for br in "${BRANCHES[@]}"; do
+    git show-ref --verify --quiet "refs/heads/$br" || { warn "no such branch: $br"; FAILED+=("$br: missing"); continue; }
+    if [[ -z "$(git -C "$TRUNK_WT" rev-list "$TRUNK..$br")" ]]; then
+      ok "$br — already in $TRUNK, nothing to merge"; ALREADY+=("$br"); continue
+    fi
+    if (( DRY )); then say "  [dry] (cd $TRUNK_WT && git merge --no-ff $br)"; MERGED+=("$br"); continue; fi
+    if git -C "$TRUNK_WT" merge --no-ff --no-edit "$br" >/dev/null 2>&1; then
+      ok "merged $br"; MERGED+=("$br")
+    else
+      git -C "$TRUNK_WT" merge --abort 2>/dev/null || true
+      warn "CONFLICT: $br — set aside, $TRUNK untouched by it"
+      CONFLICTED+=("$br"); FAILED+=("$br: conflict")
+    fi
+  done
+
+  say ""
+  say "  merged=${#MERGED[@]}  already-in=${#ALREADY[@]}  conflicted=${#CONFLICTED[@]}"
+  (( ${#CONFLICTED[@]} )) && { say "  resolve by hand, then land individually:"; printf '    %s\n' "${CONFLICTED[@]}"; }
+
+  if (( ! ${#MERGED[@]} )); then
+    say "  nothing new merged — no gate to run"
+    exit $(( ${#CONFLICTED[@]} ? 1 : 0 ))
+  fi
+
+  # THE one gate. Run from the PACKAGE dir, never the worktree root: pointed at
+  # the root, verify-fast resolves folder=<worktree>, finds 0 changed files,
+  # falls back to the full suite, and that fallback dies on a missing "test"
+  # script — measured 2026-09-13, and it exited 0 while running no tests at all.
+  # And NEVER pipe it: `bun run verify | tail` reports tail's status, which
+  # turned a RED lane (`test-lanes: FAILED`) into a reported pass twice in one
+  # night. The subshell form below keeps $? honest.
+  #
+  # A BRANCH CAN MOVE UNDER YOU between the merge and the gate — measured the
+  # same night: the fix that unblocked the release was pushed to a branch after
+  # this door had already merged it, so $TRUNK carried the merge commit but not
+  # the fix. `git merge-base --is-ancestor <br> $TRUNK` is the check; a merge
+  # commit's presence proves nothing about a branch's current contents.
+  if (( DRY )); then
+    (( INTEGRATE_FULL )) && say "  [dry] (cd $TRUNK_WT/one.ie/web && FULL_VERIFY=1 bun run verify)" \
+                         || say "  [dry] (cd $TRUNK_WT/one.ie/web && bun run verify:fast)"
+  else
+    if (( INTEGRATE_FULL )); then
+      say "  gate: FULL lane on the integrated tree"
+      _gate() ( cd "$TRUNK_WT/one.ie/web" && FULL_VERIFY=1 bash "$ROOT/.claude/scripts/gate-run.sh" verify -- bun run verify )
+    else
+      say "  gate: FAST lane on the integrated tree (not a full pass)"
+      _gate() ( cd "$TRUNK_WT/one.ie/web" && bash "$ROOT/.claude/scripts/gate-run.sh" verify-fast -- bun run verify:fast )
+    fi
+    if _gate; then
+      ok "$TRUNK is GREEN with ${#MERGED[@]} branch(es) integrated"
+    else
+      bad "$TRUNK is RED with ${#MERGED[@]} branch(es) integrated — the merges are LOCAL, nothing was pushed"
+      say "  back one branch out with:  git -C $TRUNK_WT log --merges --oneline -${#MERGED[@]}"
+      say "                             git -C $TRUNK_WT revert -m 1 <merge-sha>"
+      exit 1
+    fi
+  fi
+  exit $(( ${#CONFLICTED[@]} ? 1 : 0 ))
+fi
+
 for br in "${BRANCHES[@]}"; do
   step "land $br"
   BR_T0=$SECONDS; PH=(); GATE_T=0; DEV_T=0; PROBE_T=0; PR_T=0
@@ -178,6 +470,27 @@ for br in "${BRANCHES[@]}"; do
     fi
   fi
   say "  worktree: $wt"
+  pre_sha="" dev_sha="" PRE_TSC="unknown" DEV_TSC="unknown" GW_URL="" GW_HTTP=""
+  DEV_FILES="" BR_FILES="" DIAG_NOTE=""
+
+  # 0.9 — what the branch knows about ITSELF before the trunk touches it. A
+  # memo lookup, never a compute: every verify:fast in this worktree stamped
+  # its typecheck, so a branch gated the way the canon says is `green` here for
+  # free. Read again by _land_diagnose if step 2 goes red.
+  pre_sha="$(git -C "$wt" rev-parse --short HEAD 2>/dev/null || echo '')"
+  dev_sha="$(git rev-parse --short "$TRUNK" 2>/dev/null || echo '')"
+  if ! (( DRY )); then
+    PRE_TSC="$(_tsc_memo "$wt")"
+    if [[ -n "$TRUNK_WT" ]]; then
+      DEV_TSC="$(_tsc_memo "$TRUNK_WT")"
+      # The memo reflects the worktree's BYTES; uncommitted edits there are in
+      # the key. Say so rather than let a neighbour's half-typed file read as dev.
+      if [[ -n "$(git -C "$TRUNK_WT" status --porcelain --untracked-files=no 2>/dev/null)" ]]; then
+        DEV_TSC="$DEV_TSC (worktree has uncommitted edits)"
+      fi
+    fi
+    say "  memo: branch alone @$pre_sha typecheck $PRE_TSC · $TRUNK @$dev_sha typecheck $DEV_TSC"
+  fi
 
   # 1 — main INTO the branch. A conflict surfaces here, not on main.
   # Skipped under --pr: a reviewer must see what this branch added, not what
@@ -193,6 +506,12 @@ for br in "${BRANCHES[@]}"; do
       _land_record "$br" red; continue
     fi
     ok "merged $TRUNK into $br"
+    # What each side contributed, by git — read by _side in the diagnosis.
+    DEV_FILES="$(git -C "$wt" diff --name-only "$pre_sha" HEAD 2>/dev/null || true)"
+    BR_FILES="$(git -C "$wt" diff --name-only "$dev_sha" HEAD 2>/dev/null || true)"
+  fi
+  if (( PR )) && ! (( DRY )); then
+    BR_FILES="$(git -C "$wt" diff --name-only "$(git merge-base "$TRUNK" "$br" 2>/dev/null || echo "$TRUNK")" HEAD 2>/dev/null || true)"
   fi
 
   # 1.5 — the worktree node_modules trap. A fresh worktree has none, so every
@@ -284,7 +603,29 @@ for br in "${BRANCHES[@]}"; do
     fi
   done
 
-  # 2 — the fast gate, in the branch's worktree, through the governor.
+  # 1.7 — the substrate door the real-TypeDB suites will use, resolved the way
+  # tests/_env-file.ts resolves it: the shell wins, then one.ie/web/.env, then
+  # api.one.ie. Eight suites (tasks-bulk, tasks-depend-cycle, …) refuse to skip
+  # by design — real TypeDB or red — so a gateway that is down at gate time
+  # reads as a red gate on an innocent branch. One curl, 4s cap; any HTTP
+  # answer (401/404 included) proves the door is there — only a transport
+  # failure means unreachable, the exact line substrate.ts draws at status 0.
+  if ! (( DRY )); then
+    GW_URL="${GATEWAY_URL:-$(sed -n 's/^GATEWAY_URL=//p' "$wt/one.ie/web/.env" 2>/dev/null | tail -1 | tr -d "\"'" | tr -d ' ')}"
+    GW_URL="${GW_URL:-https://api.one.ie}"
+    GW_HTTP="$(curl -s -m 4 -o /dev/null -w '%{http_code}' -X POST "$GW_URL/typedb/query" \
+      -H 'content-type: application/json' -d '{}' 2>/dev/null || echo 000)"
+    [[ -n "$GW_HTTP" ]] || GW_HTTP=000
+    if [[ "$GW_HTTP" == "000" ]]; then
+      warn "substrate door $GW_URL is UNREACHABLE — real-TypeDB suites will skip or go red; a red of that shape is named as ENVIRONMENT below, never as $br's"
+    else
+      ok "substrate door $GW_URL answers (HTTP $GW_HTTP)"
+    fi
+  fi
+
+  # 2 — the fast gate, in the branch's worktree, through the governor. Output is
+  # captured (tee) so a red can be diagnosed from what the gate actually said;
+  # the exit code is read from PIPESTATUS, never from tee's.
   if (( DRY )); then
     (( QUICK )) && say "  [dry] (cd $wt/one.ie/web && npx tsc --noEmit)   # --quick" \
                 || say "  [dry] (cd $wt/one.ie/web && bun run verify:fast)"
@@ -297,20 +638,32 @@ for br in "${BRANCHES[@]}"; do
       # that import nothing from what they guard. Use it to move a queue when the
       # box is saturated; never as the last gate before production.
       warn "gate: TYPECHECK ONLY (--quick) — weaker than the fast lane, never a full pass"
-      if ! ( cd "$wt/one.ie/web" && bash "$ROOT/.claude/scripts/gate-run.sh" quicktsc -- npx tsc --noEmit ); then
-        bad "typecheck RED on $br — not landing it"
+      gate_log="$(mktemp)"
+      ( cd "$wt/one.ie/web" && bash "$ROOT/.claude/scripts/gate-run.sh" quicktsc -- npx tsc --noEmit ) 2>&1 | tee "$gate_log"
+      gate_rc=${PIPESTATUS[0]}
+      if [[ "$gate_rc" -ne 0 ]]; then
+        bad "typecheck RED on the integrated tree ($br + $TRUNK) — not landing it"
+        _land_diagnose "$br" "$gate_log"; rm -f "$gate_log"
         FAILED+=("$br: tsc red")
-        _land_record "$br" red; continue
+        PH+=("tsc only:0:$(( SECONDS - BR_T0 )):gate:fail")
+        _land_record "$br" red "$DIAG_NOTE"; continue
       fi
+      rm -f "$gate_log"
       ok "typecheck green (tests NOT run)"
       LANDED_QUICK=1
     else
     say "  gate: FAST LANE (not a full pass)"
-    if ! ( cd "$wt/one.ie/web" && bun run verify:fast ); then
-      bad "fast gate RED on $br — not landing it"
+    gate_log="$(mktemp)"
+    ( cd "$wt/one.ie/web" && bun run verify:fast ) 2>&1 | tee "$gate_log"
+    gate_rc=${PIPESTATUS[0]}
+    if [[ "$gate_rc" -ne 0 ]]; then
+      bad "fast gate RED on the integrated tree ($br + $TRUNK) — not landing it"
+      _land_diagnose "$br" "$gate_log"; rm -f "$gate_log"
       FAILED+=("$br: gate red")
-      _land_record "$br" red; continue
+      PH+=("fast gate:0:$(( SECONDS - BR_T0 )):gate:fail")
+      _land_record "$br" red "$DIAG_NOTE"; continue
     fi
+    rm -f "$gate_log"
     ok "fast gate green"
     fi
     GATE_T=$(( SECONDS - BR_T0 ))
@@ -451,8 +804,7 @@ for br in "${BRANCHES[@]}"; do
     #     as `merge --ff-only` does.
     # Measured 2026-09-06: dev IS checked out at .claude/worktrees/dev on this
     # box, so the fetch-only version of this failed on its first real use.
-    TRUNK_WT="$(git worktree list --porcelain \
-      | awk -v b="refs/heads/$TRUNK" '/^worktree /{w=$2} $0=="branch "b{print w; exit}')"
+    # TRUNK_WT was resolved once, before the loop (worktree_of "$TRUNK").
     # CAPTURE the error, never swallow it. Until 2026-09-09 both forms ended in
     # `>/dev/null 2>&1` and EVERY failure printed "$TRUNK moved", which is the
     # wrong diagnosis most of the time on this box: $TRUNK is checked out in a

package/scripts/memory-index-budget.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# memory-index-budget.sh — is the auto-memory index still inside the loader's budget?
+#
+# WHY THIS EXISTS. Measured 2026-09-12: MEMORY.md was 89,954 bytes / 479 lines,
+# and a session loaded 128 lines = 25,162 bytes. The cut is a ~25KB BYTE budget.
+# 73% of the index never reached context, and the only warning was a line at the
+# BOTTOM of the file — inside the 73% nobody reads. The corpus passed the budget
+# around June and nothing noticed for three months.
+#
+# The loader's own advice ("one line under ~200 chars") does not fix it: 245 of
+# 479 lines violated it, and trimming every one yields 77,943 bytes — still 3.1x
+# over. The constraint is total bytes, so that is what this measures.
+#
+# Growth is 7.3 files/day (Sep 2026), so an index cut by hand re-grows within
+# weeks. This is the thing that says so.
+#
+#   bash memory-index-budget.sh              # check, exit 3 if over
+#   bash memory-index-budget.sh --self-test  # prove it can go RED
+set -uo pipefail
+
+BUDGET_BYTES="${MEMORY_INDEX_BUDGET:-25162}"   # measured cut, not a guess
+WARN_AT_PCT="${MEMORY_INDEX_WARN_PCT:-80}"
+
+_check() {
+  local idx="$1"
+  [ -f "$idx" ] || { echo "[memory-budget] no index at $idx"; return 2; }
+
+  local bytes lines pct
+  bytes=$(wc -c < "$idx" | tr -d ' ')
+  lines=$(wc -l < "$idx" | tr -d ' ')
+  pct=$(( bytes * 100 / BUDGET_BYTES ))
+
+  # How much actually loads: bytes are the cap, so count lines until the budget.
+  local fit
+  fit=$(awk -v b="$BUDGET_BYTES" '{s+=length($0)+1; if(s<=b) n++} END{print n+0}' "$idx")
+  local dark=$(( lines - fit ))
+  local darkpct=0
+  [ "$lines" -gt 0 ] && darkpct=$(( dark * 100 / lines ))
+
+  echo "[memory-budget] $idx"
+  echo "  bytes   $bytes / $BUDGET_BYTES budget  (${pct}%)"
+  echo "  lines   $lines total, ~$fit reach context, $dark dark (${darkpct}%)"
+
+  if [ "$bytes" -gt "$BUDGET_BYTES" ]; then
+    echo "  RED — over budget. ~${darkpct}% of the index never reaches context."
+    echo "        Trimming long lines does not fix this; the cap is total bytes."
+    echo "        Shrink to a hot set and move the tail to its files — they stay"
+    echo "        reachable by their description:, which is the real recall key."
+    return 3
+  fi
+  if [ "$pct" -ge "$WARN_AT_PCT" ]; then
+    echo "  WARN — ${pct}% of budget. At ~7 new memories/day this goes red soon."
+    return 0
+  fi
+  echo "  ok — inside budget, whole index reaches context."
+  return 0
+}
+
+_self_test() {
+  local t; t=$(mktemp -d); local rc=0
+  # GREEN: a small index must pass.
+  printf 'a%.0s' $(seq 1 100) > "$t/small.md"
+  if _check "$t/small.md" >/dev/null 2>&1; then echo "  ok   green half: small index passes"
+  else echo "  FAIL green half: small index did not pass"; rc=1; fi
+  # RED: an oversized index must fail, or this checker is theatre.
+  awk -v n=$((BUDGET_BYTES * 2)) 'BEGIN{for(i=0;i<n/50;i++) print "x-------------------------------------------------"}' > "$t/big.md"
+  if _check "$t/big.md" >/dev/null 2>&1; then echo "  FAIL red half: oversized index PASSED — checker is broken"; rc=1
+  else echo "  ok   red half: oversized index correctly goes red"; fi
+  rm -rf "$t"
+  [ $rc -eq 0 ] && echo "[memory-budget] self-test PASS" || echo "[memory-budget] self-test FAIL"
+  return $rc
+}
+
+INDEX="${MEMORY_INDEX:-$HOME/.claude/projects/-Users-toc-Server-one-ie/memory/MEMORY.md}"
+case "${1:-}" in
+  --self-test) _self_test ;;
+  --index)     _check "${2:?--index needs a path}" ;;
+  *)           _check "$INDEX" ;;
+esac

package/scripts/npm-downloads.sh

@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# npm-downloads.sh — all-time download counts for every @oneie package.
+#
+#   bash .claude/scripts/npm-downloads.sh            # table, all time
+#   bash .claude/scripts/npm-downloads.sh --json     # machine-readable
+#   bash .claude/scripts/npm-downloads.sh --since 2026-01-01
+#   bash .claude/scripts/npm-downloads.sh --scope @other
+#
+# portability: needs-env (network + jq; no repo state, no credentials)
+#
+# WHY THIS IS NOT ONE CURL: npm's downloads API answers `last-day`, `last-week`
+# and `last-month`, and for anything else a date range — but it REFUSES a range
+# longer than 18 months (`{"error":"...exceeds maximum of 18 months"}`), and it
+# answers that with HTTP 200. So "all time" is a WALK: start at the package's
+# first publish (registry `time.created`), step in 17-month windows, and sum.
+# A single wide range does not error loudly, it just returns nothing useful.
+#
+# THE SCOPED-NAME TRAP: `@oneie/sdk` must be percent-encoded as `@oneie%2Fsdk`
+# in the downloads API path. Unencoded, the `/` reads as a path separator and
+# the API returns a 404 that looks exactly like "this package has no downloads"
+# — a zero you would believe. Encoded here, once.
+#
+# A package published days ago legitimately reads 0. That is not a failure, and
+# it is reported as 0 with its first-publish date beside it so the number can be
+# read in context rather than mistaken for a broken query.
+set -uo pipefail
+
+SCOPE="@oneie"; JSON=0; SINCE=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --json)  JSON=1 ;;
+    --scope) SCOPE="$2"; shift ;;
+    --since) SINCE="$2"; shift ;;
+    -h|--help) sed -n '2,12p' "${BASH_SOURCE[0]}"; exit 0 ;;
+    *) echo "npm-downloads.sh: unknown flag '$1'" >&2; exit 2 ;;
+  esac
+  shift
+done
+
+command -v jq >/dev/null || { echo "npm-downloads.sh: needs jq" >&2; exit 2; }
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+# The package list comes from the workspace, not from `npm access list packages`
+# — that command returns nothing for a granular token whose scope is per-package
+# (measured 2026-09-14: "packages in scope: 0" while all nine were readable).
+# The manifests on disk are the honest list.
+pkgs=()
+while IFS= read -r pj; do
+  n="$(jq -r '.name // empty' "$pj" 2>/dev/null)"
+  [[ "$n" == "$SCOPE/"* ]] || continue
+  [[ "$(jq -r '.private // false' "$pj")" == "true" ]] && continue
+  pkgs+=("$n")
+done < <(find "$ROOT/packages" -maxdepth 2 -name package.json -not -path '*/node_modules/*' 2>/dev/null | sort)
+
+(( ${#pkgs[@]} )) || { echo "npm-downloads.sh: no public $SCOPE packages found under packages/" >&2; exit 1; }
+
+# add_months <YYYY-MM-DD> <n> — date(1) differs between BSD and GNU; try both.
+add_months() {
+  date -j -v+"$2"m -f '%Y-%m-%d' "$1" '+%Y-%m-%d' 2>/dev/null \
+    || date -d "$1 + $2 months" '+%Y-%m-%d' 2>/dev/null
+}
+today() { date -u '+%Y-%m-%d'; }
+
+rows="[]"
+for p in "${pkgs[@]}"; do
+  enc="${p/\//%2F}"                                   # @oneie/sdk -> @oneie%2Fsdk
+  created="$(npm view "$p" time.created 2>/dev/null | head -1 | cut -c1-10)"
+  [[ -n "$created" ]] || { created="2024-01-01"; }
+  start="${SINCE:-$created}"
+  end="$(today)"
+
+  total=0; cursor="$start"
+  while [[ "$cursor" < "$end" ]]; do
+    stop="$(add_months "$cursor" 17)"
+    [[ -z "$stop" || "$stop" > "$end" ]] && stop="$end"
+    body="$(curl -sS --max-time 25 "https://api.npmjs.org/downloads/point/${cursor}:${stop}/${enc}" 2>/dev/null)"
+    # the API reports its refusals in a 200 body — read the field, not the status
+    err="$(printf '%s' "$body" | jq -r '.error // empty' 2>/dev/null)"
+    if [[ -n "$err" ]]; then
+      printf '  ! %s: %s\n' "$p" "$err" >&2
+    else
+      n="$(printf '%s' "$body" | jq -r '.downloads // 0' 2>/dev/null)"
+      [[ "$n" =~ ^[0-9]+$ ]] && total=$(( total + n ))
+    fi
+    [[ "$stop" == "$end" ]] && break
+    cursor="$(add_months "$stop" 0)"
+  done
+
+  wk="$(curl -sS --max-time 15 "https://api.npmjs.org/downloads/point/last-week/${enc}" 2>/dev/null | jq -r '.downloads // 0')"
+  ver="$(npm view "$p" version 2>/dev/null | tail -1)"
+  rows="$(printf '%s' "$rows" | jq --arg p "$p" --arg v "$ver" --arg c "$created" \
+            --argjson t "${total:-0}" --argjson w "${wk:-0}" \
+            '. + [{package:$p, version:$v, since:$c, all_time:$t, last_week:$w}]')"
+done
+
+if (( JSON )); then
+  printf '%s\n' "$rows" | jq .
+  exit 0
+fi
+
+printf '\n  %-24s %-9s %12s %10s   %s\n' "PACKAGE" "VERSION" "ALL TIME" "LAST WK" "SINCE"
+printf '  %s\n' "$(printf '─%.0s' {1..74})"
+printf '%s' "$rows" | jq -r '.[] | [.package,.version,(.all_time|tostring),(.last_week|tostring),.since] | @tsv' \
+  | while IFS=$'\t' read -r p v a w s; do printf '  %-24s %-9s %12s %10s   %s\n' "$p" "$v" "$a" "$w" "$s"; done
+printf '  %s\n' "$(printf '─%.0s' {1..74})"
+printf '  %-24s %-9s %12s %10s\n\n' "TOTAL" "" \
+  "$(printf '%s' "$rows" | jq '[.[].all_time]|add')" \
+  "$(printf '%s' "$rows" | jq '[.[].last_week]|add')"