@oneie/claude 0.9.0 → 0.10.0

package/scripts/thread-name-backfill.ts

@@ -0,0 +1,215 @@
+#!/usr/bin/env bun
+// thread-name-backfill.ts — name the threads that were written before there was a
+// name to write.
+//
+// manifest: monorepo-only  (binds the `one-owners` D1 by name through wrangler and
+//                           imports the namer out of one.ie/web/src)
+//
+// MEASURED 2026-09-13, production D1 `one-owners`: 1042 of 1053 threads in workspace
+// `one` and 125 of 132 in `ehc` carry an empty `name`, so the inbox renders their KEY
+// (`space:ehc`, `ehc-chairman`) or a hex id. The write door now names every thread it
+// mints (lib/threads.ts) — this is the other half, for the rows already written.
+//
+// IT APPLIES EXACTLY THE SAME FUNCTION THE LIVE PATH DOES — `deriveThreadName` from
+// one.ie/web/src/lib/in/thread-name.ts. A backfill with its own naming rules is a
+// second vocabulary for the same keys, and the day they disagree nobody can tell
+// which row was named by which.
+//
+// FOUR SAFETIES, and each is a thing that can go wrong once and not be undone:
+//   1. DRY RUN IS THE DEFAULT. `--apply` is required to write, and it is not a flag
+//      any read-only session should pass.
+//   2. It only ever writes `name`. A thread KEY is identity — `listThreads` filters
+//      `agent_id = ?` exactly, and rewriting one orphans the conversation.
+//   3. `WHERE name IS NULL OR name = ''` appears in the SELECT **and again in the
+//      UPDATE**, so a name a human typed between the two is never overwritten, and
+//      running it twice changes nothing the second time.
+//   4. Batched by `--limit`, one workspace at a time — and the APPLY is a generated
+//      SQL FILE (`--out`, chunked by `--chunk`), run with `wrangler … --file`, not
+//      one `--command` spawn per row. 411 sequential remote calls is ~15-30 minutes
+//      during which a concurrent writer can change a row read in the SELECT above;
+//      a handful of file round trips is not. The SQL is generated on a DRY RUN too,
+//      so the operator reads statements rather than a description of them, and the
+//      ids are written beside it because a rollback cannot be re-derived: run the
+//      namer again later and it names rows this pass never touched.
+//
+// A task thread's name is its TITLE, which no key can supply. Titles come from the
+// D1 `entity_meta` overlay (written by tasks:create/subtask/rename) and, for tasks
+// created before that landed, from an offline `--titles <file.json>` map of
+// `{ "<tid>": "<title>" }`. Rows with neither are COUNTED AND LEFT, never guessed at.
+//
+// USAGE
+//   bun .claude/scripts/thread-name-backfill.ts --slug one                 # dry run
+//   bun .claude/scripts/thread-name-backfill.ts --slug one --limit 500
+//   bun .claude/scripts/thread-name-backfill.ts --slug one --titles t.json
+//   bun .claude/scripts/thread-name-backfill.ts --slug one --out .backfill --chunk 400
+//   bun .claude/scripts/thread-name-backfill.ts --slug one --apply         # runs the SQL
+//   …add --local to work against the miniflare copy instead of production.
+
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { deriveThreadName, taskIdOf } from '../../one.ie/web/src/lib/in/thread-name.ts'
+
+const DB = 'one-owners'
+const WEB = new URL('../../one.ie/web', import.meta.url).pathname
+
+const argv = process.argv.slice(2)
+const flag = (name: string, fallback = ''): string => {
+  const i = argv.indexOf(`--${name}`)
+  return i >= 0 && argv[i + 1] && !argv[i + 1]!.startsWith('--') ? argv[i + 1]! : fallback
+}
+const has = (name: string) => argv.includes(`--${name}`)
+
+const slug = flag('slug')
+const limit = Number(flag('limit', '200'))
+const chunk = Number(flag('chunk', '400'))
+const outDir = resolve(new URL('../..', import.meta.url).pathname, flag('out', '.backfill'))
+const apply = has('apply')
+const remote = !has('local')
+const titlesFile = flag('titles')
+
+if (!slug || !Number.isFinite(limit) || limit <= 0 || !Number.isFinite(chunk) || chunk <= 0) {
+  console.error('usage: bun .claude/scripts/thread-name-backfill.ts --slug <workspace> [--limit N] [--chunk N] [--out DIR] [--titles f.json] [--local] [--apply]')
+  process.exit(2)
+}
+
+const sq = (s: string) => `'${s.replace(/'/g, "''")}'`
+
+function wrangler(mode: '--command' | '--file', value: string): Array<Record<string, unknown>> {
+  const args = ['wrangler', 'd1', 'execute', DB, remote ? '--remote' : '--local', '--json', mode, value]
+  const r = spawnSync('bunx', args, { cwd: WEB, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 })
+  if (r.status !== 0) {
+    // A failed READ must never read as "no rows to name" — that is the shape that
+    // turns an outage into a clean-looking pass. Stop instead.
+    console.error(r.stderr || r.stdout)
+    throw new Error(`d1 command failed (exit ${r.status})`)
+  }
+  const start = r.stdout.indexOf('[')
+  if (start < 0) return []
+  const parsed = JSON.parse(r.stdout.slice(start)) as Array<{ results?: Array<Record<string, unknown>> }>
+  return parsed[0]?.results ?? []
+}
+
+// ── titles ──────────────────────────────────────────────────────────────────
+const titles = new Map<string, string>()
+if (titlesFile) {
+  const raw = JSON.parse(readFileSync(titlesFile, 'utf8')) as Record<string, string>
+  for (const [tid, t] of Object.entries(raw)) if (typeof t === 'string' && t.trim()) titles.set(tid, t.trim())
+}
+// The overlay the live writers mirror to — the same source `tasks:comment` reads.
+for (const row of wrangler('--command', `SELECT entity_id, meta FROM entity_meta WHERE workspace_slug = ${sq(slug)}`)) {
+  const id = String(row['entity_id'] ?? '')
+  if (!id || titles.has(id)) continue
+  try {
+    const m = JSON.parse(String(row['meta'] ?? '{}')) as Record<string, unknown>
+    if (typeof m['title'] === 'string' && m['title'].trim()) titles.set(id, m['title'].trim())
+  } catch { /* a malformed overlay row names nothing */ }
+}
+
+// ── the nameless ────────────────────────────────────────────────────────────
+const rows = wrangler('--command',
+  `SELECT id, slug, agent_id, name FROM threads WHERE slug = ${sq(slug)} AND (name IS NULL OR name = '') ORDER BY last_msg_at DESC LIMIT ${limit}`,
+)
+
+type Plan = { id: string; key: string | null; name: string; via: string }
+const planned: Plan[] = []
+const unnamed: Array<{ id: string; key: string | null; why: string }> = []
+
+for (const r of rows) {
+  const id = String(r['id'] ?? '')
+  const key = r['agent_id'] === null || r['agent_id'] === undefined ? null : String(r['agent_id'])
+  if (!id) continue
+  if (key && key.startsWith('task:')) {
+    // Both stored shapes resolve to one tid, so a `task:task:` row and a `task:` row
+    // find the same title.
+    const tid = taskIdOf(key)
+    const title = titles.get(tid) ?? titles.get(`task:${tid}`) ?? ''
+    if (title) planned.push({ id, key, name: title.slice(0, 200), via: 'task title' })
+    else unnamed.push({ id, key, why: 'no title for this tid in the overlay or --titles' })
+    continue
+  }
+  const derived = deriveThreadName(key, slug)
+  if (derived) planned.push({ id, key, name: derived, via: 'key' })
+  else unnamed.push({ id, key, why: key ? 'key shape carries no name' : 'null key — the client derives from the body' })
+}
+
+// ── report ──────────────────────────────────────────────────────────────────
+console.log(`${apply ? 'APPLY' : 'DRY RUN'} · workspace ${slug} · ${remote ? 'remote' : 'local'} · limit ${limit}`)
+console.log(`nameless rows read: ${rows.length}   nameable: ${planned.length}   left unnamed: ${unnamed.length}`)
+console.log(`titles available: ${titles.size}`)
+console.log('\n── would name (sample) ──')
+for (const p of planned.slice(0, 15)) console.log(`  ${p.id}  ${String(p.key ?? '<null>').padEnd(34)} ''  →  '${p.name}'   [${p.via}]`)
+if (planned.length > 15) console.log(`  … ${planned.length - 15} more`)
+if (unnamed.length) {
+  console.log('\n── left unnamed (sample) ──')
+  for (const u of unnamed.slice(0, 10)) console.log(`  ${u.id}  ${String(u.key ?? '<null>').padEnd(34)} ${u.why}`)
+  if (unnamed.length > 10) console.log(`  … ${unnamed.length - 10} more`)
+}
+
+// ── generate the SQL ────────────────────────────────────────────────────────
+// ALWAYS, dry run included — the apply runs a FILE, not 411 `--command` spawns,
+// and the operator reads the statements before any of them run. The blank
+// predicate is repeated in every statement, not only in the SELECT above:
+// between the read and the write a human may have named the row, and a backfill
+// that clobbers a human is worse than one that leaves an id on screen.
+const now = Math.floor(Date.now() / 1000)
+const statementFor = (p: Plan) =>
+  `UPDATE threads SET name = ${sq(p.name)}, updated_at = ${now}\n` +
+  `  WHERE id = ${sq(p.id)} AND (name IS NULL OR name = '');`
+
+mkdirSync(outDir, { recursive: true })
+const files: string[] = []
+for (let i = 0; i < planned.length; i += chunk) {
+  const slice = planned.slice(i, i + chunk)
+  const path = `${outDir}/thread-name-${slug}-${String(i / chunk + 1).padStart(3, '0')}.sql`
+  writeFileSync(
+    path,
+    `-- thread-name-backfill · ${slug} · rows ${i + 1}-${i + slice.length} of ${planned.length}\n` +
+      `-- Re-runnable: every statement keeps the blank predicate, so a name typed since is never clobbered.\n` +
+      `-- Rollback: the ids this pass would write are listed beside this file.\n\n` +
+      slice.map(statementFor).join('\n'),
+    'utf8',
+  )
+  files.push(path)
+}
+// THE ROLLBACK CANNOT BE DERIVED, so it is written down. Re-running the namer
+// later would name rows this pass never touched, and could not tell a name this
+// wrote from one a human typed afterwards. The id list is the only honest undo.
+//
+// AND A RUN THAT PLANS NOTHING WRITES NOTHING HERE. Measured 2026-09-13, minutes
+// after the real apply: re-running the same command to PROVE idempotence read 8
+// nameless rows, planned 0, and truncated the list of the 107 rows the first run had
+// just named — the no-op proof destroyed the undo for the work it was proving.
+// Recovering it meant parsing the ids back out of the generated `.sql`. An empty
+// plan now leaves the file exactly as it is.
+const idsPath = `${outDir}/thread-name-${slug}.ids.txt`
+if (planned.length) writeFileSync(idsPath, `${planned.map((p) => `${p.id}\t${p.via}\t${p.name}`).join('\n')}\n`, 'utf8')
+
+console.log(`\n── generated SQL (${planned.length} statements, ${files.length} file(s) of ≤${chunk}) ──`)
+for (const f of files) console.log(`  ${f}`)
+console.log(
+  planned.length
+    ? `  ${idsPath}   (id, via, name — the rollback's row list)`
+    : `  nothing to do — ${idsPath} and any SQL already in ${outDir} were LEFT AS THEY WERE (an earlier pass's rollback list is not this run's to overwrite)`,
+)
+if (planned.length) {
+  console.log('\n  first statement:')
+  for (const line of statementFor(planned[0]).split('\n')) console.log(`    ${line.slice(0, 200)}`)
+}
+
+if (!apply) {
+  console.log('\nDRY RUN — nothing was written to the database. Read the SQL above, then re-run with --apply.')
+  console.log(`Rollback after an apply: UPDATE threads SET name = '' WHERE id IN (<the ids in ${idsPath}>);`)
+  process.exit(0)
+}
+
+// ── write ───────────────────────────────────────────────────────────────────
+for (const f of files) {
+  wrangler('--file', f)
+  console.log(`  ran ${f}`)
+}
+const after = wrangler('--command',
+  `SELECT COUNT(*) AS n FROM threads WHERE slug = ${sq(slug)} AND (name IS NULL OR name = '')`,
+)
+console.log(`\nran ${files.length} file(s), ${planned.length} guarded statement(s). still nameless in ${slug}: ${after[0]?.['n'] ?? '?'}`)
+console.log(`Rollback list: ${idsPath}`)

package/scripts/tsc-cached.sh

@@ -1,5 +1,15 @@
 #!/usr/bin/env bash
 # tsc-cached.sh <folder> — run `tsc --noEmit` for <folder>, or reuse the answer
+# tsc-cached.sh --probe <folder> — answer from the memo ONLY: prints `green` (exit 0)
+#   when this exact tree already passed, `unknown` (exit 1) otherwise. Never
+#   computes, never locks, never takes a slot. This is how land.sh learns what a
+#   branch knew about itself BEFORE the trunk was merged in, and whether dev's own
+#   tree is on record as green — the two facts that turn "fast gate RED" into an
+#   attribution (root CLAUDE.md § The dev → prod loop › three owners).
+# TSC_CACHE_ROOT=<dir> fingerprints THAT checkout instead of the one this script
+#   lives in. Every door script runs MAIN's copy (a worktree's copy resolves ROOT
+#   to the worktree and lands nothing), so main's copy needs a way to ask about a
+#   worktree. The key is content, so the memo is shared across checkouts anyway.
 # someone else already computed for this exact tree. Prints the error COUNT.
 #
 # manifest: needs-env
@@ -20,6 +30,30 @@
 # tree, which is the one thing this harness exists to prevent.
 #
 # TSC_CACHE_DISABLE=1 forces a real run (and still records the result).
+#
+# ── SLOT BEFORE LOCK — the 2026-09-13 deadlock ──────────────────────────────
+# This script used to take the per-folder dedupe LOCK and then, still holding
+# it, queue for a governor SLOT. Any caller already inside a gate arrives in the
+# opposite order: `bun run verify:fast` IS `gate-run.sh verify-fast -- …`, so it
+# holds a SLOT and its child here waits for the LOCK. Two orders, one cycle:
+#
+#   A: gate-run(verify-fast) holds slot-1   ->  its tsc-cached waits for lock-tsc-one.ie_web
+#   B: tsc-cached holds lock-tsc-one.ie_web ->  its inner gate-run waits for a slot
+#
+# Measured three times in ~35 minutes on 2026-09-13, each stalling EVERY session
+# on the box for 8-28 minutes at 0% CPU — one of them a production release gate.
+# Owner pairs: 22173/68920, 15762/97557, 87579. Nothing reaps it: both owners are
+# alive, and `reapLock`/gate-reaper only reap a DEAD owner.
+#
+# KILLING THE LOCK HOLDER DOES NOT FIX IT (observed twice): the lock passes
+# straight to the next waiter, which is itself inside a gate holding a slot, and
+# the cycle re-forms within seconds. Killing the SLOT holder is what breaks it.
+#
+# So the order is now global: SLOT, then LOCK, never the reverse. A cache HIT
+# and `--probe` still take NEITHER — a memo lookup must never join a queue.
+# Proof, both halves: `bash .claude/scripts/govern-order-check.sh`.
+# do-reconcile.sh takes the SAME lock name and carries the same fix; one
+# inverted participant is enough to re-form the cycle.
 set -uo pipefail
 
 # --self-test — the RED half. A cache that has never been seen to refuse is not
@@ -69,29 +103,82 @@ EOF
   out6=$(bash "$0" .tsc-cache-probe 2>&1 >/dev/null)
   case "$out6" in *"cache HIT"*) echo "FAIL: a content change replayed as a HIT — the key does not read the bytes"; fails=$((fails+1));;
     *) echo "ok: a content change MISSes (key covers the bytes)";; esac
+  # --probe answers from the memo and NEVER computes. The tree is green and
+  # memoised here (out6 computed it); a probe must say so. Then break it: a
+  # never-checked tree must read `unknown`, exit 1, and leave no stamp behind —
+  # a probe that computed would stamp the green half and hide the cost it exists
+  # to avoid; a probe that said `green` for an unchecked tree would let land.sh
+  # call a branch "green alone" on no evidence.
+  if pr=$(bash "$0" --probe .tsc-cache-probe 2>/dev/null) && [ "$pr" = "green" ]; then echo "ok: --probe reads the memoised PASS as green"
+  else echo "FAIL: --probe missed a memoised PASS (got '${pr:-}')"; fails=$((fails+1)); fi
+  echo 'export const y: string = 1;' > "$_P/src/b.ts"     # red, and never checked
+  _stamps_before=$(ls "$GOVERN_DIR" | wc -l | tr -d ' ')
+  if pr=$(bash "$0" --probe .tsc-cache-probe 2>/dev/null); then echo "FAIL: --probe reported '$pr' for a tree never checked"; fails=$((fails+1))
+  elif [ "$pr" != "unknown" ]; then echo "FAIL: --probe exit 1 but said '$pr', not 'unknown'"; fails=$((fails+1))
+  else echo "ok: --probe says unknown for an unchecked tree"; fi
+  _stamps_after=$(ls "$GOVERN_DIR" | wc -l | tr -d ' ')
+  [ "$_stamps_before" = "$_stamps_after" ] && echo "ok: --probe wrote nothing" \
+    || { echo "FAIL: --probe left a stamp ($_stamps_before -> $_stamps_after) — it computed"; fails=$((fails+1)); }
+  rm -f "$_P/src/b.ts"
+  # TSC_CACHE_ROOT: the same bytes in ANOTHER checkout share the memo. This is
+  # the property land.sh leans on — main's copy asking about a worktree's tree.
+  _C="$(mktemp -d)"; cp -R "$_P" "$_C/.tsc-cache-probe"
+  if pr=$(TSC_CACHE_ROOT="$_C" bash "$0" --probe .tsc-cache-probe 2>/dev/null) && [ "$pr" = "green" ]; then
+    echo "ok: TSC_CACHE_ROOT reads the same memo for identical bytes in another checkout"
+  else echo "FAIL: TSC_CACHE_ROOT did not share the memo (got '${pr:-}')"; fails=$((fails+1)); fi
+  rm -rf "$_C"
   # RED PROOF — an unrun tsc must NOT read as 0 errors. A child that cannot
   # finish inside the bound is killed by run_bounded, leaving the count file
   # EMPTY -- exactly the shape a real 600s timeout produces. The old
   # `n=${n:-0}` turned that empty file into "0 errors" AND cached it, so a
   # typecheck that never ran was replayed forever as a PASS.
   rm -rf "$GOVERN_DIR"; export GOVERN_DIR="$(mktemp -d)"
-  if TSC_CACHE_TIMEOUT=1 TSC_CACHE_CMD='sleep 30' bash "$0" .tsc-cache-probe >/dev/null 2>&1; then
+  if out7=$(TSC_CACHE_TIMEOUT=1 TSC_CACHE_CMD='sleep 30' bash "$0" .tsc-cache-probe 2>&1 >/dev/null); then
     echo "FAIL: a timed-out tsc exited 0 — an unrun gate read as a pass"; fails=$((fails+1))
   else echo "ok: a tsc that could not finish exits non-zero"; fi
+  # AND it must be the EMPTY-COUNT branch that refused, not merely some non-zero
+  # exit. Since 2026-09-13 the compute runs inside a slot this script bought
+  # itself, so there are now TWO bounds — the inner run_bounded and gate-run's
+  # outer one — and if the outer ever fires first, the count file is never even
+  # read and this red proof silently degrades into "the outer bound works".
+  # Pinned by the message the inner branch prints.
+  case "$out7" in *"no error count"*) echo "ok: the refusal came from the empty-count branch" ;;
+    *) echo "FAIL: a timed-out tsc did not reach the empty-count branch — got: ${out7:-<nothing>}"; fails=$((fails+1)) ;; esac
   rm -rf "$_P" "$GOVERN_DIR"
   [ "$fails" -eq 0 ] && { echo "tsc-cached: self-test PASS"; exit 0; }
   echo "tsc-cached: self-test FAILED ($fails)"; exit 1
 fi
 
-folder="${1:-}"
-[ -n "$folder" ] || { echo "usage: tsc-cached.sh <folder>" >&2; exit 2; }
+PROBE=0 LOCKED=0 folder=""
+for _a in "$@"; do
+  case "$_a" in
+    --probe) PROBE=1 ;;
+    # INTERNAL. Set only by this script's own re-invocation through gate-run.sh
+    # (see § SLOT BEFORE LOCK): "a slot is held — take the lock and compute".
+    # It is also what stops the re-invocation recursing: under CI=1 or
+    # GOVERN_DISABLE=1, gate-run.sh execs straight through BEFORE it exports
+    # GOVERN_IN_GATE, so the child would otherwise see no gate and re-invoke
+    # itself forever. The mode flag is checked first, and never GOVERN_IN_GATE
+    # alone.
+    --locked-compute) LOCKED=1 ;;
+    -*) echo "tsc-cached: unknown flag '$_a'" >&2; exit 2 ;;
+    *) folder="$_a" ;;
+  esac
+done
+[ -n "$folder" ] || { echo "usage: tsc-cached.sh [--probe] <folder>" >&2; exit 2; }
 
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# _HERE is where the SCRIPTS live (main's copy); ROOT is the tree being checked.
+# They differ exactly when TSC_CACHE_ROOT names a worktree.
+_HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# Resolved BEFORE the cd below, and by basename rather than a literal name, so
+# the re-invocation survives both a relative $0 and a rename of this file.
+_SELF="$_HERE/$(basename "${BASH_SOURCE[0]}")"
+ROOT="${TSC_CACHE_ROOT:-$(cd "$_HERE/../.." && pwd)}"
 cd "$ROOT" || exit 2
 [ -d "$folder" ] || { echo "tsc-cached: no such folder: $folder" >&2; exit 2; }
 
 # shellcheck source=lib/govern.sh
-. "$(dirname "${BASH_SOURCE[0]}")/lib/govern.sh"
+. "$_HERE/lib/govern.sh"
 
 # The key is tsc_tree_fingerprint (lib/govern.sh) — CONTENT, never mtime, over
 # everything tsc reads. It used to live here as an mtime stat over src/tests +
@@ -118,13 +205,57 @@ _cache_ok() { # <file> — 0 when it holds a reusable PASS
   [ -s "$1" ] || return 1
   [ "$(tr -d '[:space:]' < "$1")" = "0" ]
 }
+if [ "$PROBE" = "1" ]; then
+  # A memo lookup and nothing else. `unknown` is not `red`: it means this exact
+  # tree has no recorded PASS — never checked, or checked and found red (a red
+  # is never written). The caller decides what an unknown is worth.
+  if _cache_ok "$_cache"; then echo green; exit 0; fi
+  echo unknown; exit 1
+fi
 if [ "${TSC_CACHE_DISABLE:-0}" != "1" ] && _cache_ok "$_cache"; then
   echo "[tsc-cached] $folder — cache HIT (tree unchanged since it was checked)" >&2
   echo 0
   exit 0
 fi
 
-if gate_lock "$_key" "${TSC_CACHE_WAIT:-900}"; then
+# The two bounds, read once and validated: a non-numeric override would make the
+# arithmetic below a hard error rather than a slow gate.
+_num() { case "${1:-}" in ''|*[!0-9]*) printf '%s' "$2" ;; *) printf '%s' "$1" ;; esac; }
+_timeout=$(_num "${TSC_CACHE_TIMEOUT:-}" 600)
+_lockwait=$(_num "${TSC_CACHE_WAIT:-}" 900)
+# ZERO IS NOT A BOUND, it is a kill: run_bounded's timer is `setTimeout(secs *
+# 1000)` (govern.ts:256), so 0 fires on the next tick and SIGTERMs the compute
+# before tsc can start — every run would read RED through the empty-count
+# branch. Treat it the way `${x:-600}` treats an empty string.
+[ "$_timeout" -lt 1 ] && _timeout=600
+
+# ── SLOT BEFORE LOCK ────────────────────────────────────────────────────────
+# A miss from here on. Buy the SLOT first, by re-entering this same script
+# through gate-run.sh; the child then takes the lock and computes. Everything
+# above this line — the memo lookup and --probe — still costs neither.
+#
+# WHY THE SELF-INVOCATION rather than a bare gate_slot: gate-run.sh is the one
+# definition of what a slot is (the queue announcement, min(config, headroom),
+# the pressure warning, and the re-entrancy rule that makes a nested gate
+# INHERIT the outer slot instead of taking a second one). A second copy of that
+# contract here is a second thing to drift. It also keeps the hard wall-clock
+# BOUND on the compute: `run_bounded` is what turns a wedged tsc into an empty
+# count, and an empty count is RED (see the case below).
+#
+# GOVERN_IN_GATE=1 means the CALLER already holds a slot — `bun run verify:fast`
+# is exactly that. Then the order is already SLOT -> LOCK, so take the lock right
+# here and compute inline. Re-invoking would only add a process; gate-run.sh
+# would exec straight through anyway.
+if [ "$LOCKED" != "1" ] && [ "${GOVERN_IN_GATE:-0}" != "1" ]; then
+  # The outer bound must be LARGER than the inner one, or it fires first and the
+  # empty-count RED below stops being reachable: lock wait + compute + slack.
+  TSC_CACHE_ROOT="$ROOT" TSC_CACHE_TIMEOUT="$_timeout" TSC_CACHE_WAIT="$_lockwait" \
+  GOVERN_GATE_TIMEOUT=$(( _timeout + _lockwait + 60 )) \
+  exec bash "$_HERE/gate-run.sh" "tsc-cache:$folder" -- \
+    bash "$_SELF" --locked-compute "$folder"
+fi
+
+if gate_lock "$_key" "$_lockwait"; then
   trap 'gate_release_all' EXIT INT TERM
   # Someone may have computed it while we queued for the lock.
   if [ "${TSC_CACHE_DISABLE:-0}" != "1" ] && _cache_ok "$_cache"; then
@@ -137,22 +268,23 @@ if gate_lock "$_key" "${TSC_CACHE_WAIT:-900}"; then
   # TSC_CACHE_CMD exists for --self-test only (the `__probe__` idiom from
   # test-cached.sh): it substitutes a child that cannot finish inside the bound,
   # so the timeout branch below can be driven deterministically instead of raced.
-  # THE SLOT, not just the lock. gate_lock above dedupes by FOLDER: it stops two
-  # sessions computing the SAME answer twice. It does not cap concurrency across
-  # DIFFERENT folders, and N worktrees are N folders. Measured 2026-09-07: three
-  # worktrees each ran a 2.5GB tsc at once, every lock uncontended and doing its
-  # job, load hit 171 and localhost served a page in 8.4s. A lock DEDUPES; only a
-  # SLOT BOUNDS THE MACHINE. Route the compute through gate-run.sh so it queues
-  # behind GOVERN_MAX_GATES like every other heavy gate.
   #
-  # gate-run.sh, never a bare gate_slot: its GOVERN_IN_GATE guard makes a nested
-  # gate INHERIT the outer slot rather than take a second one, and a second slot
-  # held by one logical gate is what deadlocks the queue at cap 2.
+  # THE SLOT IS ALREADY HELD when we get here — either the caller's (they were
+  # inside a gate) or the one this script's own re-invocation bought above. The
+  # gate_lock we hold dedupes by FOLDER: it stops two sessions computing the SAME
+  # answer twice. It does not cap concurrency across DIFFERENT folders, and N
+  # worktrees are N folders. Measured 2026-09-07: three worktrees each ran a
+  # 2.5GB tsc at once, every lock uncontended and doing its job, load hit 171 and
+  # localhost served a page in 8.4s. A lock DEDUPES; only a SLOT BOUNDS THE
+  # MACHINE — which is why both exist and why the order between them is fixed.
   #
-  # stderr is deliberately NOT sent to /dev/null: gate-run announces "QUEUEING",
-  # and a wait that is silent gets read as a hang and then as a failure.
-  GOVERN_GATE_TIMEOUT="${TSC_CACHE_TIMEOUT:-600}" \
-  bash "$ROOT/.claude/scripts/gate-run.sh" "tsc-cache:$folder" -- \
+  # run_bounded, not a nested gate-run.sh: gate-run under GOVERN_IN_GATE=1 execs
+  # straight through, which correctly declines a SECOND slot but also drops the
+  # wall-clock BOUND. So every call from inside a gate — i.e. every
+  # `bun run verify:fast` — ran an unbounded tsc until 2026-09-13. Calling
+  # run_bounded directly keeps the slot contract (we hold one) and restores the
+  # bound on the path that had none. It kills the whole process group.
+  run_bounded "$_timeout" \
     bash -c "cd '$folder' && ${TSC_CACHE_CMD:-bunx tsc --noEmit} 2>&1 | grep -c 'error TS' > '$_tmp'" \
     || true
   n=$(cat "$_tmp" 2>/dev/null | tr -d '[:space:]'); rm -f "$_tmp"

package/scripts/urls-lint.sh

@@ -29,6 +29,14 @@ FROZEN_ROOT_PAGES=(
   # declared in RESERVED_PREFIXES (src/lib/urls/law.ts) and added to
   # RESERVED_SLUGS so no future workspace can claim them.
   tasks w
+  # platform — AMENDMENT 2026-09-05 (ad front door). `ad` is a paid-traffic
+  # landing page, not a door: it renders one `auraHeroes` split-test variant
+  # full-bleed and resolves nothing about the viewer. It is listed in
+  # ASTRO_PORTABLE (src/lib/urls/law.ts) so one host's brand is the only thing
+  # that changes between one.ie/ad, app.one.ie/ad and a tenant domain — which
+  # is a routing BYPASS, and takes the bare word away from workspace `one`'s
+  # published page of the same slug (still served at /p/ad and /u/one/p/ad).
+  ad
   # identity
   signin signup recover "recovery-codes" "auth-security" unsubscribe
   # system

package/scripts/verify-board-doors.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# verify-board-doors.sh — did the tasks:board / tasks:bulk ship actually land in prod?
+#
+# Run BEFORE the ship to capture RED, and AFTER to confirm GREEN. A checker never shown
+# to fail proves nothing — running it twice IS the instrument proof.
+#
+#   bash .claude/scripts/verify-board-doors.sh
+#
+# Gate row: task:01a09b3e3c8564b1eabb984a (p0.97, blocker)
+# Honest sibling: task:01a09b7497bdd80ac761b825 — tasks:board has NEVER been called
+# against a real substrate. These probes are the first time it ever will be.
+set -uo pipefail
+BASE="${ONE_API_URL:-https://one.ie}"
+ENVF="${ONE_ENV_FILE:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/one.ie/web/.dev.vars}"
+KEY="${GATEWAY_API_KEY:-$(grep -m1 '^GATEWAY_API_KEY' "$ENVF" 2>/dev/null | cut -d= -f2- | tr -d '"')}"
+red=0; green=0
+
+# WITHOUT a key every door answers 403 "direct substrate access not permitted" and every
+# line below reads RED for the wrong reason. The first version of this script did exactly
+# that; the CONTROL is what caught it.
+[ -n "$KEY" ] || { echo "NO KEY — set GATEWAY_API_KEY or ONE_ENV_FILE. Refusing to report."; exit 2; }
+
+probe() { # name · expect-regex · receiver · payload
+  local name="$1" expect="$2" rcv="$3" payload="$4" body
+  body=$(curl -s -m 25 -X POST "$BASE/api/ask/$rcv" -H "Authorization: Bearer $KEY" \
+    -H 'content-type: application/json' -d "$payload" 2>&1 | head -c 400)
+  if printf '%s' "$body" | grep -qE "$expect"; then
+    printf '  GREEN  %-36s\n' "$name"; green=$((green+1))
+  else
+    printf '  RED    %-36s %s\n' "$name" "$(printf '%s' "$body" | tr -d '\n' | head -c 130)"; red=$((red+1))
+  fi
+}
+
+echo "== board doors, against $BASE =="
+
+# CONTROL FIRST. If this is RED the key or the host is wrong and every other line is
+# meaningless rather than informative. Never read the results above a red control.
+probe "CONTROL tasks:everywhere" '"ok":true' 'tasks:everywhere' '{"data":{"workspace":"one","limit":1}}'
+
+# 1. tasks:board — answers `unknown_receiver` until this ships.
+probe "tasks:board summary" '"total"' 'tasks:board' '{"data":{"workspace":"one","view":"summary"}}'
+
+# 2. tasks:bulk where+set — prod takes `edits` only until this ships.
+probe "tasks:bulk where+set dryRun" '"ok":true|matched|dryRun' 'tasks:bulk' \
+  '{"data":{"workspace":"one","where":{"status":"open"},"set":{"addTags":["_probe"]},"dryRun":true}}'
+
+# 3. tasks:bulk `creates` with a priority — the ONLY door that can file a row the
+#    priority-sorted board can see. tasks:create still has no priority parameter, which
+#    is why 407 of 730 open rows carry none and the count grows with every filing.
+#    IT CLEANS UP AFTER ITSELF. The first version of this script left a _probe row on
+#    every run — which made the checker a source of exactly the orphan exhaust it was
+#    written to measure. A probe that litters the thing it measures is not a probe.
+body=$(curl -s -m 25 -X POST "$BASE/api/ask/tasks:bulk" -H "Authorization: Bearer $KEY" \
+  -H 'content-type: application/json' \
+  -d '{"data":{"workspace":"one","creates":[{"ref":"p","title":"_probe verify-board-doors — auto-dissolved","priority":0.01}]}}' 2>&1 | head -c 400)
+ptid=$(printf '%s' "$body" | grep -oE 'task:[0-9a-f]{24}' | head -1)
+if printf '%s' "$body" | grep -q '"ok":true'; then
+  printf '  GREEN  %-36s\n' "tasks:bulk creates takes priority"; green=$((green+1))
+else
+  printf '  RED    %-36s %s\n' "tasks:bulk creates takes priority" "$(printf '%s' "$body" | tr -d '\n' | head -c 130)"; red=$((red+1))
+fi
+if [ -n "$ptid" ]; then
+  swept=$(curl -s -m 20 -X POST "$BASE/api/ask/tasks:bulk" -H "Authorization: Bearer $KEY" \
+    -H 'content-type: application/json' \
+    -d "{\"data\":{\"workspace\":\"one\",\"edits\":[{\"tid\":\"$ptid\",\"status\":\"dissolved\"}]}}" | grep -c '"ok":true')
+  [ "$swept" -ge 1 ] && printf '         swept %s\n' "$ptid" || printf '         WARN could not sweep %s — dissolve it by hand\n' "$ptid"
+fi
+
+# 4. Single-row read door. Expected RED even AFTER this ship — "tasks:get" is 0 hits in
+#    dev's receivers.ts. Listed so its absence stays visible instead of being forgotten.
+code=$(curl -s -o /dev/null -m 15 -w '%{http_code}' "$BASE/api/things/task:01a09b3e3c8564b1eabb984a")
+if [ "$code" = "200" ]; then printf '  GREEN  %-36s\n' "GET /api/things/<tid>"; green=$((green+1))
+else printf '  RED    %-36s HTTP %s — no single-row read door (EXPECTED, not a ship failure)\n' "GET /api/things/<tid>" "$code"; red=$((red+1)); fi
+
+echo
+echo "  green=$green red=$red"
+echo "  BEFORE the ship: CONTROL green · doors 1-3 RED · door 4 RED"
+echo "  AFTER  the ship: CONTROL green · doors 1-3 GREEN · door 4 still RED"
+echo "  CONTROL red => the probe is broken, not the ship. Ignore every other line."
+[ "$red" -gt 0 ] && exit 1 || exit 0

package/scripts/verify-fast.sh

@@ -167,7 +167,16 @@ fi
 #
 # Cost measured on the run that motivated this: 7ms and 46ms. The failure they
 # catch costs an 18-minute deploy gate and a red ship.
-PINS_DEFAULT='parity|wrangler|boundary|authority|roles|signals-parity|receivers|portable|design-dock|render-sites|panel-tabs|person-panel|ad-flow-panel'
+#
+#   sweep-self-test  shells out to `sweep.sh --self-test`. A .sh file is in no
+#                    import graph at all, so `vitest related` can never select
+#                    it — not "usually misses", CANNOT. It is the most expensive
+#                    pin here (2.4s, minting throwaway git estates) and it buys
+#                    the only check on a script that runs `git reset --hard` on
+#                    `dev`: a red gate and a conflict must each put the trunk
+#                    back where they found it. Deleting the reset line takes it
+#                    RED on exactly that assertion — verified, not asserted.
+PINS_DEFAULT='parity|wrangler|boundary|authority|roles|signals-parity|receivers|portable|design-dock|render-sites|panel-tabs|person-panel|ad-flow-panel|ehc-tone|vantage-a-first|sweep-self-test|incident-ledger'
 PINS="${VERIFY_FAST_PINS:-$PINS_DEFAULT}"
 
 # --- changed files: committed-since-base UNION uncommitted -------------------
@@ -257,11 +266,24 @@ bash "$ROOT/.claude/scripts/sdk-build-cached.sh" || { echo "[verify-fast] sdk bu
 # proving it in place.
 #
 # It is NOT wrapped in gate-run here, and that is now safe rather than a hole:
-# tsc-cached.sh takes its own SLOT internally, around the compute and after the
-# cache double-check, so a HIT costs nothing and a MISS queues like every other
-# gate. Wrapping it out here instead would hold a slot through the up-to-900s
-# lock wait -- two sessions on one folder would occupy both slots while one only
-# waits for the other's answer.
+# tsc-cached.sh takes its own SLOT internally on a MISS, and takes the folder
+# lock only once that slot is held, so a HIT costs nothing and a MISS queues like
+# every other gate.
+#
+# THE ORDER IS THE POINT, and this comment used to argue the other way: it said
+# wrapping the call out here "would hold a slot through the up-to-900s lock
+# wait". That reasoning is what left tsc-cached taking the LOCK first and the
+# SLOT second -- while THIS script always runs inside `gate-run.sh verify-fast`,
+# i.e. holding a slot already. Two orders, one cycle, and on 2026-09-13 it
+# deadlocked every session on the box three times in ~35 minutes, one of them a
+# production release gate (tsc-cached.sh § SLOT BEFORE LOCK).
+#
+# The trade is real and it is the right way round: a waiter can now burn a slot
+# while the lock holder computes. But the holder is ALWAYS computing and ALWAYS
+# holds a slot itself, so that wait is bounded by one tsc and ends in a cache HIT
+# for the waiter. The old order was bounded by nothing -- it stalled the machine
+# until a human found the right process to kill, and killing the LOCK holder did
+# not even work.
 #
 # The comment this replaces said it "must NOT be nested inside another gate-run
 # slot -- that is a second lock on the same logical gate". That conflated the

package/scripts/worktree-up.sh

@@ -84,8 +84,21 @@ _port_file() { echo "$WT/.worktree-port"; }
 # one.ie/web/node_modules is deliberately ABSENT here — it is built below as a
 # farm of per-package links so that .vite can be worktree-local. A wholesale
 # symlink would drag main's .vite in with it, which is the corruption above.
+# api/.dev.vars was MISSING from this list until 2026-09-15, and its absence does
+# not read as an absence: the gateway starts, answers 401, and the seven
+# real-TypeDB suites die in mustWrite at fixture setup — so the typedb lane reads
+# as a broken key or a flaky substrate rather than as an unlinked file. It holds
+# GATEWAY_API_KEY and the four TYPEDB_* vars; without it that lane cannot run at all.
+# api/ and sync/ were MISSING until 2026-09-17, and their absence does not read as
+# an absence either: `deploy.sh` typechecks all five services (:181-182), so both
+# died on `TS2688: Cannot find type definition file for '@cloudflare/workers-types'`
+# — a TypeScript error naming TypeScript, caused by an unlinked directory. Measured
+# that day at the ship gate: two of five typechecks red at t≈290s, in a tree whose
+# code was fine, in all four existing worktrees at once.
 LINKS="node_modules
 packages/node_modules
+api/node_modules
+sync/node_modules
 packages/sdk/dist
 packages/sdk/node_modules
 pay/backend/node_modules
@@ -96,7 +109,8 @@ one.ie/web/.wrangler
 one.ie/web/.astro
 one.ie/web/src/data/fleets.json
 pay/backend/.env
-channels/.env"
+channels/.env
+api/.dev.vars"
 
 # Ports are ALLOCATED, never assumed: several worktrees run at once, and a
 # hardcoded port is how two of them come to think they serve each other's code.