@oneie/claude 0.9.0 → 0.10.0

package/scripts/one-agents.mjs

@@ -26,6 +26,8 @@
 //   node .claude/scripts/one-agents.mjs            # write .claude/agents/one/
 //   node .claude/scripts/one-agents.mjs --check    # exit 1 if regeneration would change anything
 //   node .claude/scripts/one-agents.mjs --chart    # print the routing table, emit nothing
+//   node .claude/scripts/one-agents.mjs --models   # which model each agent gets and WHY, emit nothing
+//   node .claude/scripts/one-agents.mjs --models --json   # the same as JSON on stdout (nothing written)
 //   node .claude/scripts/one-agents.mjs --self-test
 
 import { readFileSync, writeFileSync, readdirSync, mkdirSync, rmSync, existsSync } from 'node:fs'
@@ -48,15 +50,66 @@ const RESERVED = new Set([
   'claude-code-guide', 'w1-recon', 'w2-decide', 'w3-edit', 'w4-verify', 'w4-tools',
 ])
 
-// The Agent tool accepts ONLY these. Platform agents declare `model:
-// x-ai/grok-4.5` — an OpenRouter id that means nothing here, so it is mapped
-// by tier and never copied through.
+// The Agent tool accepts ONLY these. MODEL_BY_TIER is the FALLBACK — the answer
+// when the declared model is not expressible here, or when nothing is declared.
 const MODEL_BY_TIER = {
   chairman: 'opus', ceo: 'opus', director: 'opus',
   specialist: 'sonnet', tool: 'haiku',
   1: 'sonnet', 2: 'sonnet', '1': 'sonnet', '2': 'sonnet',
 }
 
+// The closed set. NOTHING outside it may ever reach the Agent tool — which is
+// why resolveClaudeModel returns a member of this set and NEVER the declared
+// string. `fable` is legal and has no tier that produces it: it can only ever
+// arrive by being declared.
+const CLAUDE_MODELS = new Set(['opus', 'sonnet', 'haiku', 'fable'])
+
+/** The Anthropic family named by an OpenRouter-shaped id, or null.
+ *  Deliberately FAMILY-shaped, not an id list: `anthropic/claude-opus-5`,
+ *  `claude-sonnet-4-5`, `claude-sonnet-4-6` and whatever version ships next all
+ *  answer the same way, so a normalisation pass over the corpus cannot silently
+ *  change which Claude Code model an agent gets. */
+function claudeFamily(id) {
+  const base = id.toLowerCase().split('/').pop()
+  if (!base.startsWith('claude')) return null
+  return base.split(/[^a-z]+/).find(w => w === 'opus' || w === 'sonnet' || w === 'haiku') ?? null
+}
+
+/**
+ * Which Claude Code model this agent runs on, and WHICH RUNG SAID SO.
+ *
+ * Three outcomes, and the generated file names the one that happened — an agent
+ * running on sonnet because its grok declaration cannot be expressed here is a
+ * different fact from one running on sonnet because a human chose sonnet, and a
+ * reader who cannot tell them apart will "fix" the wrong one.
+ *
+ *   declared  — the declared model is expressible; it travels.
+ *   fallback  — declared, but an OpenRouter id Claude Code cannot run (grok,
+ *               kimi). A real limit of this bridge, not a bug in the agent.
+ *   tier      — nothing declared. Since C14 an absent `model:` means the
+ *               PLATFORM default at runtime (`DEFAULT_MODEL = 'x-ai/grok-4.5'`,
+ *               packages/sdk/src/billing.ts) — also not expressible here, so
+ *               absent lands on tier for the same honest reason grok does.
+ *
+ * @returns {{model: string, source: 'declared'|'fallback'|'tier', note: string}}
+ */
+function resolveClaudeModel(declared, tier) {
+  const fallback = MODEL_BY_TIER[tier] ?? 'sonnet'
+  const d = typeof declared === 'string' ? declared.trim() : ''
+  if (!d) return { model: fallback, source: 'tier', note: `${fallback} (tier — no model declared)` }
+  if (CLAUDE_MODELS.has(d.toLowerCase())) {
+    const m = d.toLowerCase()
+    return { model: m, source: 'declared', note: `${m} (declared ${d})` }
+  }
+  const fam = claudeFamily(d)
+  if (fam) return { model: fam, source: 'declared', note: `${fam} (declared ${d})` }
+  return {
+    model: fallback,
+    source: 'fallback',
+    note: `${fallback} (tier fallback — declared ${d} is not expressible in Claude Code)`,
+  }
+}
+
 // Engineering agents touch the repo; everyone else touches the world.
 const TOOLS_ENGINEERING = 'Read, Grep, Glob, Bash, Edit, Write, WebFetch'
 const TOOLS_WORLD = 'Read, Grep, Glob, Bash, Write, WebFetch, WebSearch'
@@ -151,6 +204,11 @@ function collect() {
       name,
       src: rel,
       tier: String(meta.tier ?? 'specialist'),
+      // The RAW declared value, or undefined. Nothing fills a default here: this
+      // script parses the file itself (`frontmatter(readFileSync(...))` above),
+      // never the web loader — which since C14 fills the platform default in and
+      // would make every single agent read as `declared`.
+      model: meta.model ? String(meta.model) : undefined,
       reports_to: meta.reports_to ? String(meta.reports_to) : null,
       domain: String(meta.domain ?? 'governance'),
       title: meta.title ? String(meta.title) : name,
@@ -209,6 +267,56 @@ Space and tags the task.
 
 **Proof discipline:** a presence grep is not proof. Probe the running thing. Report numbers you
 actually measured, and say plainly when a check did not run — an unrun gate is not a pass.
+
+## The four verbs of working together — claim · delegate · chat · chain
+
+A meeting is not where you report. It is where you **take a row, hand a row, argue on the row,
+and put the rows in order.** All four are receivers; none is a convention you can improvise.
+
+    claim     tasks:claim    {"data":{"tid":"task:<24hex>","workspace":"<slug>"}}
+    delegate  tasks:reassign {"data":{"tid":"...","assignee":"<slug>","workspace":"..."}}
+              tasks:announce {"data":{"taskId":"...","tags":["bare","words"],"workspace":"..."}}
+    chat      tasks:comment  {"data":{"tid":"...","workspace":"...","body":"..."}}
+              thread:append  {"data":{"slug":"one","group":"space:one","sender":"<you>","role":"assistant","content":"..."}}
+    chain     tasks:subtask  {"data":{"parent":"task:...","title":"...","blockedBy":["task:..."],"workspace":"..."}}
+              tasks:depend   {"data":{"tid":"task:<blocked>","blockedBy":"task:<blocker>","workspace":"..."}}
+
+**CHAINING IS NOT BOOKKEEPING — it is what makes the board sequence itself.** \`tasks:claim\`
+is **blocker-gated**, and \`tasks:depend\` writes the very \`blocks\` edge that gate reads. So an
+unchained board hands every agent every row at once and nothing knows what comes first; a chained
+one refuses a claim whose prerequisites are still open. **Chain before you fan out, or the fan-out
+is a race.** \`tasks:depend\` refuses a self-edge and a reverse edge, so a cycle cannot be filed.
+
+**\`tasks:subtask\` is the verb for splitting work, not \`tasks:create\`.** It writes the row, its
+notes, its tags, its \`containment\` edge to the parent AND every \`blockedBy\` prerequisite in ONE
+pipeline — precisely so a child never appears claimable with an empty body or missing ordering.
+A child made with \`tasks:create\` is an orphan that somebody will claim before it is ready.
+
+**Delegation moves a row; it does not copy one.** \`tasks:reassign\` swaps the \`@<slug>\` tag in
+place and announces on the new tag set. An empty assignee unassigns and moves a \`picked\` row back
+to \`open\` — claimable means **open AND unassigned**. Never "delegate" by filing a second task:
+that is how a board grows a duplicate \`Handle: <title>\` row for work that already had one.
+
+**\`tasks:announce\` returns \`matched\`, and matched is not delivered.** It reports how many staked
+actors the tags reached, not how many acted. Quote it as reach; never as done.
+
+**The claimant is the attested caller, never a body field.** You cannot claim on someone else's
+behalf — hand them the row with \`tasks:reassign\` and let them claim it. **Under the shared
+gateway key the attested caller is the workspace, so every head's claim lands as \`@one\`** — follow
+\`tasks:claim\` with \`tasks:reassign {assignee: "<your slug>"}\` in the same breath, or the ledger
+cannot say who took the row.
+
+**Two rules that keep a chain honest**, and they are the same rule twice:
+- **A child's cast is a subset of its parent's.** Inherit by default, declare to narrow, **never
+  declare to widen.** A leaf must not quietly attach a stakeholder the parent never had.
+- **Depth needs a floor.** A parent that spawns children without any settling is a leak, not a
+  big plan. Freeze the parent's outcome before its children mint, and let \`fade\`/\`warn\` decay
+  what goes quiet.
+
+**No agent leaves a meeting without a tid.** Claimed, delegated (name who to), chained (name the
+parent), or **declined with an argument** — a refusal on principle is sometimes the best act
+available. "Blocked" with no named blocker is not a status, it is a shrug. A meeting whose output
+is a document and no moved row has failed, however good the document.
 `.trim()
 
 /** How many agents stake each tag — used to drop the non-discriminating ones
@@ -221,7 +329,8 @@ function indexStakes(roster) {
 
 function render(a, roster) {
   if (STAKE_FREQ.size === 0) indexStakes(roster)
-  const model = MODEL_BY_TIER[a.tier] ?? 'sonnet'
+  const resolved = resolveClaudeModel(a.model, a.tier)
+  const model = resolved.model
   const isDirector = a.tier === 'director' || a.tier === 'ceo' || a.tier === 'chairman'
   const tools = isDirector ? TOOLS_DIRECTOR
     : a.domain === 'engineering' ? TOOLS_ENGINEERING
@@ -261,6 +370,13 @@ function render(a, roster) {
     ? `\n## Your reports\n\nThese agents report to you and are spawnable by name: ${reports.join(' · ')}.\n${delegation}\n`
     : ''
 
+  // The provenance line goes in the MARKER block, NOT as a YAML comment inside
+  // the frontmatter. Measured: not one agent file Claude Code loads on this box
+  // carries a `#` line inside its frontmatter (0 of the 96 generated + 5
+  // hand-written), so a YAML comment there is unproven ground — and the failure
+  // would land on all 96 files at once, at a regeneration nobody is watching.
+  // The HTML comment below is proven to survive: it is the first line of every
+  // spawned agent's own system prompt.
   return `---
 name: ${a.name}
 description: "${desc}"
@@ -269,6 +385,7 @@ model: ${model}
 color: ${color}
 ---
 ${MARKER} from ${a.src} — do not hand-edit.
+     model: ${resolved.note}
      Edit the platform agent, then re-run the generator. -->
 
 ${SUBSTRATE}
@@ -309,10 +426,53 @@ if (args.includes('--self-test')) {
   // RED PROOF: an OpenRouter model id must never reach the Agent tool.
   ok('grok id never mapped through', !Object.values(MODEL_BY_TIER).some(m => m.includes('/')))
 
+  // RED PROOFS for C16 — a declared Claude model must TRAVEL, and the generated
+  // file must SAY which of the three things happened. Literal fixtures, never
+  // corpus rows: exactly one agent declares opus today, so a corpus-keyed test
+  // would go red the moment that file is renamed.
+  const fx = (tier, model) => ({
+    name: 'fx', src: 'fx.md', tier, reports_to: null, domain: 'engineering',
+    title: 'Fixture', tagline: 'A fixture.', skills: [], subscribes: [], body: 'fixture body', model,
+  })
+  const declaredOpus = render(fx('specialist', 'anthropic/claude-opus-5'), [])
+  ok('declared opus travels', /^model: opus$/m.test(declaredOpus))
+  ok('declared opus says declared', declaredOpus.includes('model: opus (declared anthropic/claude-opus-5)'))
+  const declaredGrok = render(fx('specialist', 'x-ai/grok-4.5'), [])
+  ok('grok falls back to tier', /^model: sonnet$/m.test(declaredGrok))
+  ok('grok never travels verbatim', !declaredGrok.includes('x-ai/grok-4.5\n') && !/^model: .*\//m.test(declaredGrok))
+  ok('grok says tier fallback', declaredGrok.includes('model: sonnet (tier fallback — declared x-ai/grok-4.5 is not expressible in Claude Code)'))
+  const noModel = render(fx('specialist', undefined), [])
+  ok('no model declared falls back to tier', /^model: sonnet$/m.test(noModel))
+  ok('no model declared says so', noModel.includes('model: sonnet (tier — no model declared)'))
+  // The family map must be version-agnostic — C15 is normalising these ids right now.
+  ok('bare claude-sonnet-4-5 is expressible', /^model: sonnet$/m.test(render(fx('director', 'claude-sonnet-4-5'), [])))
+  ok('bare `sonnet` is expressible', /^model: sonnet$/m.test(render(fx('director', 'sonnet'), [])))
+  ok('fable stays a legal declared value', /^model: fable$/m.test(render(fx('specialist', 'fable'), [])))
+  ok('a director declaring haiku is honoured over its tier', /^model: haiku$/m.test(render(fx('director', 'anthropic/claude-haiku-4-5'), [])))
+  // C15 measured that OpenRouter's real ids use DOTS, not hyphens, for the
+  // version (`grok-4.5`), and 78 of 105 declared ids are not served at all — so
+  // the normalisation landing beside this one will rewrite the version
+  // separator. The family map must not care, and here is the proof that it does
+  // not: hyphen, dot, prefixed, unprefixed, all four answer the same.
+  ok('a dotted version resolves (anthropic/claude-sonnet-4.5)', /^model: sonnet$/m.test(render(fx('director', 'anthropic/claude-sonnet-4.5'), [])))
+  ok('a dotted unprefixed version resolves (claude-opus-4.6)', /^model: opus$/m.test(render(fx('specialist', 'claude-opus-4.6'), [])))
+  ok('a dotted haiku resolves (anthropic/claude-haiku-4.5)', /^model: haiku$/m.test(render(fx('ceo', 'anthropic/claude-haiku-4.5'), [])))
+  ok('a non-claude vendor id never resolves to a family', claudeFamily('x-ai/grok-4.5') === null && claudeFamily('moonshotai/kimi-k3') === null)
+
   const roster = collect()
   ok(`roster non-empty (${roster.length})`, roster.length > 20)
   ok('no placeholder in roster', !roster.some(r => r.name.includes('<')))
-  ok('every roster model is legal', roster.every(r => ['opus', 'sonnet', 'haiku', 'fable'].includes(MODEL_BY_TIER[r.tier] ?? 'sonnet')))
+  // RED PROOF, STRENGTHENED for C16. Until a declared model could travel, this
+  // assertion read MODEL_BY_TIER[r.tier] — the table, not the emitted value —
+  // and so did `grok id never mapped through` above. Both were true and both
+  // were BLIND to the declared path, which is now the only way an OpenRouter id
+  // could reach the Agent tool. Assert on what render() actually writes, for
+  // every real roster row.
+  ok('every RESOLVED roster model is legal', roster.every(r => CLAUDE_MODELS.has(resolveClaudeModel(r.model, r.tier).model)))
+  const emitted = roster.map(r => (render(r, roster).match(/^model: (.*)$/m) ?? [])[1])
+  ok('no OpenRouter id reaches the Agent tool', emitted.every(m => CLAUDE_MODELS.has(m)))
+  ok('no emitted model carries a vendor slash', emitted.every(m => m && !m.includes('/')))
+  ok('every agent says which rung chose its model', roster.every(r => /\n     model: .+ \((declared |tier)/.test(render(r, roster))))
   const ceo = roster.find(r => r.name === 'ceo')
   ok('ceo present', !!ceo)
   ok('ceo drops the "*" wildcard subscribe', ceo && !ceo.subscribes.includes('*'))
@@ -345,6 +505,21 @@ if (args.includes('--self-test')) {
 
 const roster = collect()
 
+if (args.includes('--models')) {
+  const rows = roster.map(a => ({ name: a.name, tier: a.tier, declared: a.model ?? null, ...resolveClaudeModel(a.model, a.tier) }))
+  const tally = { declared: 0, fallback: 0, tier: 0 }
+  for (const r of rows) tally[r.source]++
+  if (args.includes('--json')) {
+    console.log(JSON.stringify({ total: rows.length, tally, agents: rows }, null, 2))
+    process.exit(0)
+  }
+  for (const r of rows.sort((x, y) => x.source.localeCompare(y.source) || x.name.localeCompare(y.name))) {
+    console.log(`  ${r.name.padEnd(28)} ${r.model.padEnd(7)} ${r.source.padEnd(9)} ${r.declared ?? '(none declared)'}`)
+  }
+  console.log(`\n${rows.length} agents — declared ${tally.declared} · tier fallback ${tally.fallback} · no model declared ${tally.tier}`)
+  process.exit(0)
+}
+
 if (args.includes('--chart')) {
   const byDomain = {}
   for (const a of roster) (byDomain[a.domain] ??= []).push(a)

package/scripts/one-resume.sh

@@ -51,22 +51,50 @@ done < <(find "$PROJ" -path '*/subagents/workflows/wf_*/journal.jsonl' -mtime -3
 
 echo
 echo "${DIM}══ branches ══${OFF}"
+# WHY the yardstick is `dev` and not `main`:
+#   land.sh merges a branch into TRUNK, and TRUNK is `dev` (land.sh:117 —
+#   "TRUNK is what a branch LANDS INTO; PR_BASE is what dev is RELEASED into").
+#   Measuring "ready to land" against main therefore counts every commit that
+#   is ALREADY INTEGRATED on dev and merely waiting on the dev->main PR, and
+#   reports it as unlanded work. Measured 2026-09-15: feat/dashboard,
+#   feat/fix-og-screenshot-fullpage and feat/tasks-bulk each read
+#   "38 / 20 / 11 commit(s) ready to land" while all three were 0 ahead of
+#   origin/dev and already merged — and `--deploy` would have re-run land.sh
+#   on all three. This is the same stale-yardstick class as do-auto.sh --gc,
+#   but the opposite direction: --gc measures against main and KEEPS too much
+#   (safe); this INVENTED work (unsafe), and re-launching landed work is the
+#   most expensive mistake the board offers.
+# Remote refs first: a local `main`/`dev` can sit hundreds of commits behind
+#   origin while `git status` reports the tree clean.
+_ref() { git rev-parse --verify -q "origin/$1" >/dev/null 2>&1 && echo "origin/$1" || echo "$1"; }
+TRUNK_REF="$(_ref "${LAND_TRUNK:-dev}")"   # what a branch lands INTO
+BASE_REF="$(_ref main)"                    # what dev is RELEASED into
 READY=()
 while IFS= read -r br; do
   [[ -z "$br" ]] && continue
-  ahead="$(git rev-list --count "main..$br" 2>/dev/null || echo 0)"
+  ahead="$(git rev-list --count "$TRUNK_REF..$br" 2>/dev/null || echo 0)"
   if [[ "$ahead" == "0" ]]; then
-    printf '  %-34s %sno commits beyond main%s\n' "$br" "$DIM" "$OFF"
+    printf '  %-34s %sno commits beyond %s%s\n' "$br" "$DIM" "$TRUNK_REF" "$OFF"
   else
-    printf '  %-34s %s%s commit(s) ready to land%s\n' "$br" "$GRN" "$ahead" "$OFF"
+    printf '  %-34s %s%s commit(s) ready to land%s %s(-> %s)%s\n' \
+      "$br" "$GRN" "$ahead" "$OFF" "$DIM" "$TRUNK_REF" "$OFF"
     READY+=("$br")
   fi
 done < <(git for-each-ref --format='%(refname:short)' --sort=-committerdate refs/heads/feat 2>/dev/null | head -20)
 
+# The other half of the loop: what is integrated but not yet released.
+rel="$(git rev-list --count "$BASE_REF..$TRUNK_REF" 2>/dev/null || echo 0)"
+if [[ "$rel" != "0" ]]; then
+  printf '\n  %-34s %s%s commit(s) ready to release%s %s(%s -> %s, by PR)%s\n' \
+    "${LAND_TRUNK:-dev}" "$YEL" "$rel" "$OFF" "$DIM" "$TRUNK_REF" "$BASE_REF" "$OFF"
+fi
+
 echo
 echo "${DIM}══ next ══${OFF}"
 if (( ${#READY[@]} )); then
   echo "  bash .claude/scripts/land.sh ${READY[*]} --deploy"
+elif [[ "$rel" != "0" ]]; then
+  echo "  gh pr create --base main --head ${LAND_TRUNK:-dev}   # $rel commit(s) integrated, not released"
 else
   echo "  nothing to land yet — resume a fleet above, or ./deploy dev"
 fi

package/scripts/redirect-lint.sh

@@ -0,0 +1,169 @@
+#!/usr/bin/env bash
+# redirect-lint.sh — `Response.redirect()` is banned under one.ie/web/src/pages/api/.
+#
+# WHY. `Response.redirect()` returns a Response whose headers are IMMUTABLE.
+# The Astro Cloudflare adapter / middleware then writes `Server-Timing` (or the
+# queued `vid` cookie) onto it and the worker throws "Can't modify immutable
+# headers" — a 500 with Cloudflare error code 1101, on the success path only.
+# Measured on production 2026-09-11: /api/composio/redirect and
+# /api/composio/callback both 500.
+#
+# This repo has diagnosed and fixed the same mechanism three separate times
+# before this lint existed:
+#   one.ie/web/src/pages/api/og/screenshot.png.ts:33  (the comment + the fix)
+#   one.ie/web/src/middleware.ts:746                  (the comment + the fix)
+#   one.ie/web/src/lib/page-cache-middleware.ts:45    (swallows the throw)
+# The lint is what stops a fourth time.
+#
+# THE FIX, every time:
+#   return new Response(null, { status: 302, headers: { Location: <absolute url> } })
+#
+# SCOPE. API routes only — those are the handlers whose response the adapter
+# decorates. Comment lines are exempt: the three files above NAME the pattern in
+# prose, and a lint that is red on a clean tree gets deleted within a week.
+#
+# USAGE
+#   bash .claude/scripts/redirect-lint.sh              # lint the repo, exit 1 on any hit
+#   bash .claude/scripts/redirect-lint.sh --self-test  # drive it RED, then GREEN, then
+#                                                      # prove a comment stays GREEN
+# EXITS
+#   0  clean          1  violations found          2  usage / self-test failed
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+API_DIR="one.ie/web/src/pages/api"
+PATTERN='Response\.redirect('
+
+# scan <dir> — every CODE occurrence as `file:line:content`, comments dropped.
+# Empty output means clean. The grep output is CAPTURED first and matched from a
+# here-string: under `set -o pipefail`, `<producer> | grep -q` returns 141 when
+# it matches while the producer is still writing.
+scan() {
+  local dir="$1" raw line content trimmed
+  raw="$(grep -rn "$PATTERN" "$dir" 2>/dev/null || true)"
+  [ -z "$raw" ] && return 0
+  while IFS= read -r line; do
+    [ -z "$line" ] && continue
+    content="${line#*:}"          # strip `file:`
+    content="${content#*:}"       # strip `line:`
+    trimmed="$(printf '%s' "$content" | sed 's/^[[:space:]]*//')"
+    case "$trimmed" in
+      '//'*|'*'*|'/*'*) continue ;;   # a comment naming the pattern is not a call
+    esac
+    printf '%s\n' "$line"
+  done <<< "$raw"
+}
+
+# lint <dir> [label] — report and set the exit code. The whole main path, so the
+# self-test drives the real thing rather than a re-implementation of it.
+lint() {
+  local dir="$1" label="${2:-$dir}" hits count
+  if [ ! -d "$dir" ]; then
+    echo "[redirect-lint] RED — directory not found: $dir" >&2
+    return 2
+  fi
+  hits="$(scan "$dir")"
+  if [ -z "$hits" ]; then
+    echo "[redirect-lint] ok — no Response.redirect() under $label"
+    return 0
+  fi
+  count="$(printf '%s\n' "$hits" | wc -l | tr -d ' ')"
+  echo "[redirect-lint] RED — $count call site(s) of Response.redirect() under $label:" >&2
+  printf '%s\n' "$hits" | sed "s#^$ROOT/##" >&2
+  cat >&2 <<'HINT'
+
+  Response.redirect() headers are immutable; the adapter's Server-Timing write
+  then throws "Can't modify immutable headers" (500, cf error 1101). Use:
+
+    return new Response(null, { status: 302, headers: { Location: <absolute url> } })
+HINT
+  return 1
+}
+
+# Global on purpose: the EXIT trap body is evaluated after self_test has
+# returned, so a `local` sandbox is already out of scope by then — under
+# `set -u` that made a fully passing self-test exit 1 on its own cleanup.
+sandbox=""
+
+self_test() {
+  local rc out fails=0
+  sandbox="$(mktemp -d "${TMPDIR:-/tmp}/redirect-lint-selftest.XXXXXX")"
+  trap 'rm -rf "${sandbox:-}"' EXIT
+  mkdir -p "$sandbox/api"
+
+  # A file that is already correct — present in all three phases, so a green
+  # phase proves the scan ran over real content rather than over nothing.
+  cat > "$sandbox/api/ok.ts" <<'TS'
+export const GET = ({ url }) =>
+  new Response(null, { status: 302, headers: { Location: `${url.origin}/next` } })
+TS
+
+  # 1 — a real call site must go RED.
+  cat > "$sandbox/api/bad.ts" <<'TS'
+export const GET = ({ url }) => Response.redirect(`${url.origin}/next`, 302)
+TS
+  set +e
+  out="$(lint "$sandbox" "sandbox" 2>&1)"; rc=$?
+  set -e
+  if [ "$rc" -eq 1 ]; then
+    echo "  [1/3] planted call site → RED (exit 1) ✓"
+  else
+    echo "  [1/3] planted call site → expected exit 1, got $rc" >&2
+    printf '%s\n' "$out" >&2
+    fails=$((fails + 1))
+  fi
+
+  # 2 — removing it must go GREEN.
+  rm -f "$sandbox/api/bad.ts"
+  set +e
+  out="$(lint "$sandbox" "sandbox" 2>&1)"; rc=$?
+  set -e
+  if [ "$rc" -eq 0 ]; then
+    echo "  [2/3] violation removed → GREEN (exit 0) ✓"
+  else
+    echo "  [2/3] violation removed → expected exit 0, got $rc" >&2
+    printf '%s\n' "$out" >&2
+    fails=$((fails + 1))
+  fi
+
+  # 3 — a COMMENT naming the pattern must stay GREEN. This is the exclusion the
+  # three prior fixes depend on; untested, someone "simplifies" it back into a
+  # false positive and the lint starts firing on its own documentation.
+  cat > "$sandbox/api/documented.ts" <<'TS'
+export const GET = ({ url }) => {
+  // Response.redirect() returns an immutable Response — the adapter's
+  // Server-Timing header write then throws "Can't modify immutable headers".
+  /* Response.redirect( in a block comment too */
+  return new Response(null, { status: 302, headers: { Location: `${url.origin}/next` } })
+}
+TS
+  set +e
+  out="$(lint "$sandbox" "sandbox" 2>&1)"; rc=$?
+  set -e
+  if [ "$rc" -eq 0 ]; then
+    echo "  [3/3] comment naming the pattern → GREEN (exit 0) ✓"
+  else
+    echo "  [3/3] comment naming the pattern → expected exit 0, got $rc" >&2
+    printf '%s\n' "$out" >&2
+    fails=$((fails + 1))
+  fi
+
+  if [ "$fails" -ne 0 ]; then
+    echo "[redirect-lint] --self-test FAILED ($fails/3)" >&2
+    return 2
+  fi
+  echo "[redirect-lint] --self-test ok (3/3)"
+  return 0
+}
+
+case "${1:-}" in
+  --self-test) self_test ;;
+  --scan-dir)  lint "${2:?--scan-dir needs a directory}" ;;
+  -h|--help)
+    sed -n '1,32p' "${BASH_SOURCE[0]}"
+    exit 2 ;;
+  '')          lint "$ROOT/$API_DIR" "$API_DIR" ;;
+  *)
+    echo "usage: redirect-lint.sh [--self-test|--scan-dir <dir>]" >&2
+    exit 2 ;;
+esac

package/scripts/release.sh

@@ -92,9 +92,14 @@ _link_deps() {
 # The receipt keys for the tree standing in $1. Prints one 64-hex key per lane.
 # TEST_CACHE_KEY_ONLY=1 makes every test-cached.sh in the fan-out print its key
 # and exit 0 without running vitest, so this costs ~1s and cannot start a suite.
+#
+# Each line is "<lane> <key>". The lane is read off test-lanes.sh's own
+# `───── <lane> lane (rc=N) ─────` header that precedes the key, so a new lane
+# names itself; a key with no header (the single-run fallback) is lane `suite`.
 _receipt_keys() {
   ( cd "$1" && TEST_CACHE_KEY_ONLY=1 bash .claude/scripts/test-full.sh 2>/dev/null ) \
-    | grep -Eo '^[0-9a-f]{64}$'
+    | awk '/ lane \(rc=/ { for (i = 1; i <= NF; i++) if ($i == "lane") lane = $(i-1); next }
+           /^[0-9a-f]{64}$/ { print (lane == "" ? "suite" : lane), $0 }'
 }
 
 # The stamp for a key, if one exists. test-cached.sh mangles the whole stamp path
@@ -165,16 +170,27 @@ cmd_promote() {
     bad "no receipt key could be computed — test-full.sh printed no lane key"
     return 9
   fi
-  local n_keys=0 missing=0 stamps=()
-  while IFS= read -r k; do
+  # THE TYPEDB LANE DOES NOT GATE PRODUCTION (operator ruling 2026-09-13). The
+  # request path reads the edge snapshot, never TypeDB (CLAUDE.md § The brain and
+  # the edge), and the lane's reds were the shared cluster timing out, not code:
+  # three promotes in a row held a green pool lane behind `upstream 500: aborted
+  # due to timeout`. deploy.sh already runs it non-blocking
+  # (TYPEDB_LANE_NONBLOCKING=1); promote now weighs it the same way, so the two
+  # doors can no longer disagree. The lane is still READ and printed — a missing
+  # stamp is a named warning, never silence. RELEASE_TYPEDB_BLOCKING=1 restores
+  # the hard gate.
+  local n_keys=0 missing=0 stamps=() lane k
+  while read -r lane k; do
     [ -n "$k" ] || continue
     n_keys=$((n_keys+1))
     local s
     if s="$(_stamp_for "$k")"; then
       stamps+=("$s")
-      ok "receipt ${k:0:12} — full suite PASSED $(cat "$s" 2>/dev/null)"
+      ok "receipt ${k:0:12} ($lane lane) — full suite PASSED $(cat "$s" 2>/dev/null)"
+    elif [ "$lane" = "typedb" ] && [ "${RELEASE_TYPEDB_BLOCKING:-0}" != "1" ]; then
+      say "  warn receipt ${k:0:12} (typedb lane) — no green stamp; non-blocking for production"
     else
-      bad "receipt ${k:0:12} — NO green full-suite stamp for this tree"
+      bad "receipt ${k:0:12} ($lane lane) — NO green full-suite stamp for this tree"
       missing=$((missing+1))
     fi
   done <<< "$keys"
@@ -276,8 +292,26 @@ _self_test() {
   # 1. a tree with no receipt is REFUSED (3)
   _run "$base"; _assert 3 $? "no receipt refuses"
 
+  # 2a. the typedb lane does not gate production: stamp every OTHER lane and the
+  #     promote succeeds; RELEASE_TYPEDB_BLOCKING=1 restores the refusal. Red half
+  #     first — a non-typedb lane left unstamped must still refuse.
+  local lane k
+  while read -r lane k; do
+    [ -n "$k" ] && [ "$lane" = "typedb" ] && date -u +%Y-%m-%dT%H:%M:%SZ > "$sbcache/selftest-$k.pass"
+  done < <(_receipt_keys "$sbwt")
+  _run "$base"; _assert 3 $? "a green typedb lane cannot carry an unstamped pool lane"
+  rm -f "$sbcache"/selftest-*.pass
+  while read -r lane k; do
+    [ -n "$k" ] && [ "$lane" != "typedb" ] && date -u +%Y-%m-%dT%H:%M:%SZ > "$sbcache/selftest-$k.pass"
+  done < <(_receipt_keys "$sbwt")
+  if _receipt_keys "$sbwt" | grep -q '^typedb '; then
+    RELEASE_TYPEDB_BLOCKING=1 _run "$base"; _assert 3 $? "RELEASE_TYPEDB_BLOCKING=1 refuses an unstamped typedb lane"
+    _run "$base"; _assert 0 $? "an unstamped typedb lane does not gate production"
+  else
+    echo "  FAIL no typedb lane key found — the non-blocking branch went unproven"; fails=$((fails+1))
+  fi
+
   # 2. plant a PASS stamp for every lane key of that tree — promotion succeeds
-  local k
   while IFS= read -r k; do
     [ -n "$k" ] && date -u +%Y-%m-%dT%H:%M:%SZ > "$sbcache/selftest-$k.pass"
   done < <(TEST_CACHE_KEY_ONLY=1 bash -c "cd '$sbwt' && bash .claude/scripts/test-full.sh" 2>/dev/null \

package/scripts/resume-lost-sessions.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# resume-lost-sessions.sh — reopen the Claude Code sessions killed by the
+# 2026-09-16 12:14 reboot, one Ghostty tab each.
+#
+# manifest: monorepo-only
+#
+# WHY THIS EXISTS. The box rebooted at 12:14 and took 8 live sessions with it.
+# Every session's COMMITTED work survived — all of it is in production at
+# c716295ac (verified by probe: /buttons 200, /ambient 404). What died was the
+# conversation: the half-finished next step each one was holding in context.
+# `--resume <id>` restores that context; the transcripts are on disk under
+# ~/.claude/projects/-Users-toc-Server-one-ie/.
+#
+# Usage:
+#   bash .claude/scripts/resume-lost-sessions.sh --list     # names + status, no side effects
+#   bash .claude/scripts/resume-lost-sessions.sh <key>...   # open those tabs
+#   bash .claude/scripts/resume-lost-sessions.sh --unfinished
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+# key|session-id|status|what it was doing
+ROWS=(
+"media|baa8d065-7e0a-44a5-be4a-0b65ea39252f|MID-CYCLE|@chairman team: pages/media — view, upload, generate media and insert into pages. Was at /close when it died."
+"blocks|3aa1bc43-0029-4ddd-bd4e-bc76695dd74c|LANDED|One block-insert component shared by page editor and documents. Shipped ca89b9c58 + 5b74e7f4d. Was at /close."
+"components|a82ef0c3-3863-40ed-84b8-49502e42a42e|MID-CYCLE|Parallel agents enhancing the hundreds of page-editor components. 9 turns in, feat/components merged — more was planned."
+"pages-links|bd004874-cd1e-4298-bd8d-a733721c8af0|OPEN Q|Feature pages (pages/analytics etc.) — wanted links to them, 'on prod'. A question, no commit."
+"models|95bead26-d470-4c4a-84d7-41dabbf54144|LANDED|Rank models by intelligence and speed in the + picker. Shipped: src/lib/chat/model-rank.ts."
+"ticker|d8b1424b-3bfe-4fa5-92bc-fa4fc197ed4e|LANDED|Real streamed 'thinking' text instead of pretend. Shipped a99651b48. Last words: 'ship it all'."
+"chat-url|79bc3b97-dab2-4f3d-a4c1-81b163917e4f|LANDED|Can chat change the page URL the user is on. Shipped d6a41f2f5 + text/chat-navigation-docs.md."
+"health|4c2ff180-a2d9-4b37-9cef-9ce9740c5fc9|ONE-SHOT|'health' — the doctor pass. Nothing to resume unless you want another."
+)
+
+_row() { local k=$1; for r in "${ROWS[@]}"; do [ "${r%%|*}" = "$k" ] && { echo "$r"; return 0; }; done; return 1; }
+
+if [ $# -eq 0 ] || [ "${1:-}" = "--list" ]; then
+  printf '\n  %-13s %-10s %s\n' KEY STATUS "WHAT IT WAS DOING"
+  for r in "${ROWS[@]}"; do
+    IFS='|' read -r k id st what <<<"$r"
+    printf '  %-13s %-10s %s\n' "$k" "$st" "${what:0:88}"
+  done
+  printf '\n  open one:  bash %s <key>\n' "${BASH_SOURCE[0]#"$ROOT/"}"
+  printf '  unfinished only:  bash %s --unfinished\n\n' "${BASH_SOURCE[0]#"$ROOT/"}"
+  exit 0
+fi
+
+KEYS=("$@")
+if [ "${1:-}" = "--unfinished" ]; then
+  KEYS=()
+  for r in "${ROWS[@]}"; do
+    IFS='|' read -r k id st what <<<"$r"
+    case "$st" in MID-CYCLE|"OPEN Q") KEYS+=("$k");; esac
+  done
+  echo "  unfinished: ${KEYS[*]}"
+fi
+
+for k in "${KEYS[@]}"; do
+  r="$(_row "$k")" || { echo "  ✗ unknown key: $k (try --list)" >&2; continue; }
+  IFS='|' read -r _ id st what <<<"$r"
+  echo "  → $k  ($st)  $id"
+  osascript <<OSA >/dev/null 2>&1 || echo "     (could not open a tab — run by hand: cd $ROOT && claude --resume $id)"
+tell application "Ghostty" to activate
+tell application "System Events" to keystroke "t" using command down
+delay 0.7
+tell application "System Events" to keystroke "cd $ROOT && claude --resume $id"
+tell application "System Events" to key code 36
+OSA
+  sleep 1
+done