cursedops 0.10.26 → 0.11.2

package/README.md

@@ -14,17 +14,18 @@ bun add cursedops
 | `cursedops/smoke` | the scaffolding of a deployed smoke — the ledger, the fetch, the DNS hint, the exit code — the one check no app owns (every address of a deployment serving the same built client), and since 0.5.0 its VERDICTS: the origin asked on loopback, the smoke's own environment, a network that lies about DNS, and a version that has settled |
 | `cursedops/worker-deploy` | the sequence that ships a Cloudflare Worker — clean tree, stage first, schema, `--var` stamp, secrets, smoke — and the readers it needs (0.5.0); `readWranglerFile(root)` since 0.9.0, lifted from four apps' `readWrangler` (task 2153); since 0.10.25 every run, red or green, appends a `kind: "deploy"` line with each leg's wall clock (`install`, `stage`, `walk`, `build`, `schema`, `upload`, `secrets`, `smoke`) to the generation's ledger (task 2246) |
 | `cursedops/worker-deploy` (CPU) | a `wrangler tail` around the traffic a deploy already sends, each request's BILLED CPU charged to its declared route, red on an undeclared, over-budget or uncapped route — and `runWorkerDeploy`'s `stageWalk` + `cpuTail` that wrap the walk and the smoke in it (0.7.0, task 2134, lifted from collections) |
-| `cursedops/worker-secrets` | a Worker holding EXACTLY its deployment's secrets, uploaded over a pipe, read back (0.5.0) |
+| `cursedops/worker-secrets` | a Worker holding EXACTLY its deployment's secrets, uploaded over a pipe, read back (0.5.0) — and read again, up to five times, before a set that is not exact is believed: the list lags the puts (0.11.1) |
 | `cursedops/worker-rollback` | a hostname back on its Mac origin: origin first, route second, the route found rather than typed (0.5.0) |
-| `cursedops/edge-fetch` | a request to a deployed Worker as a script must make it — curl pinned past the Mac's negative DNS cache (0.5.0) |
+| `cursedops/edge-fetch` | a request to a deployed Worker as a script must make it — curl pinned past the Mac's negative DNS cache (0.5.0); a request's own `maxTimeSec` over the instance's (0.11.1) |
 | `cursedops/d1-import` | a cutover's data proof — SQL literals and the row-for-row comparison, never a count (0.5.0); and `d1SchemaText`, the generated `db/schema.sql` that refuses a statement spanning lines, because D1's exec splits on newlines (0.9.0, lifted from five apps, task 2153) — and its `forge-d1-schema` bin (0.9.1), so no app carries its own schema script at all |
-| `cursedops/backups` | `BACKUP_KEEP`, the fleet's one retention for dated snapshots — six apps each exported `KEEP = 14` (0.9.0, task 2153) |
+| `cursedops/backups` | `BACKUP_KEEP`, the fleet's one retention for dated snapshots — six apps each exported `KEEP = 14` (0.9.0, task 2153); `BACKUP_STAMP_PATTERN`, `backupStamp` and its inverse `stampTime` — the local-time run name every backup script writes and station's audit reads (0.11.2) |
 | `cursedops/serve` | the static tier's four helpers — the path-traversal guard, the MIME table, the hashed-asset test, the crash handlers |
 | `cursedops/api-floor` | the rule that an unmatched `/api/...` is a phrase and never the app shell — the namespace predicates, the trailing-slash normaliser and the default 404 body. No `node:` import, so it mounts inside a Worker |
 | `cursedops/build-info` | which commit a checkout-served process is running and whether its tree was dirty — read once at load, and a `null` retried in the background rather than cached for the life of the process. `node:child_process`, so never in a Worker |
 | `cursedops/bound-lists` | the static check that no SQL builds an `IN (…)` list one `?` per value — the shape D1 500s on past 100 ids. Test-time only; the recorded third exception, see below |
 | `cursedops/staged-client` | the IMMUTABLE client a checkout-served app serves — a build staged into `<APP_DATA_DIR>/client/<commit>/` behind `CURRENT`, so another agent's `vite build` in the checkout never changes live bytes — and its `forge-client stamp` / `forge-client stage` bin (0.6.0, lifted from family, flix, roms, station) |
 | `cursedops/deploy-tree` | the two refusals a checkout-served deploy needs — never deploy a dirty tree, never `git revert` in one (`readTreeStatus`, `refuseToDeploy`, `refuseToRevert`; 0.6.0, lifted from nine apps) |
+| `cursedops/ship` | the owner's FAST SHIPPING switch as every deploy reads it — `readShipSetting` (`$FORGE_STATE/state/autopilot/ship.json`; absent or unreadable is `fast`, no generation is `each`), `deferral`/`shipDeferral` (the sentence a production deploy prints instead of deploying, or `null`), `FORGE_SHIP_NOW=1` to ship now whatever it says. `runWorkerDeploy` asks it before installing anything; a Mac-side `bun run deploy` calls `shipDeferral` first (0.11.0) |
 | `cursedops/relay` | the WORKER half of a relay — a Worker in front of a Mac-bound app over ONE outbound WebSocket: the frames (station's wire, byte for byte), the key-digest door (`acceptLink`), and `RelayLink`, the Durable Object an app subclasses with its name, body ceiling, timeout and (optionally) station's per-cookie offline cache. No `node:` import (0.10.0, lifted from station for roms, task 065) |
 | `cursedops/relay-link` | the MAC half — `dialLink` (answer each frame with the app's own `fetch`, redial 1 s → 60 s on close, no timer otherwise), `readLinkSettings` for `<APP>_LINK_URL`/`<APP>_LINK_KEY`, and `rotateLinkKey` (digest to the Worker FIRST, the key to the 0600 file only if it took) (0.10.0) |
 | `cursedops/relay-stage` | the signed-in STAGE WALK's skeleton both relay apps shared — `stageByteCheck` (SHA-256 of every built file, a stale byte re-asked 4 × 10 s), `putStageLinkDigest` (`--env stage` only), `grantStageOwner` (auth-stage's 2FA grant, never production's), `oldKeyRefused` (the rotation leg: 20 s refused window, 3 min ceiling), `awaitSystemResolver`, `servedPath`, `STAGE_AUTH_URL`. With `relayWorkerDeployCli` in `cursedops/worker-deploy`, a relay app's whole `worker:deploy` as data (0.10.6) |
@@ -95,6 +96,13 @@ Workers — so the choice was two more copies of the scanner or one here. Copies
 It is mechanism only: each app passes its own root and directories and keeps its own
 "not vacuous" assertion about which files the scan must reach.
 
+🔴 **`ship` is the fourth recorded exception: no app wrote it, because it is the switch the
+deploys themselves obey.** The owner's ruling (2026-09-28) was that agents run the same commands
+whatever the switch says and the commands deal with it — so it has to live in the one seam every
+production deploy passes through, which is `runWorkerDeploy` here and `deploy-tree`'s callers.
+It reads a file the runner owns and knows no app: rule 2 holds, and the header of `src/ship.ts`
+says why every failure reads as `fast`.
+
 ### What was deliberately left in the apps
 
 The comparison that produced this library found three areas that are genuinely
@@ -296,6 +304,12 @@ pins an address** — the deliverable is the distinction, not a way around the n
 `steadyHealth(ask, ready)` is the Worker smoke's wait: `ready` must hold for THREE reads in a
 row, because on `music`'s first deploy (2026-09-23, `a54ef71`) one good `/healthz` was followed
 by thirteen routes answering the pre-secrets version. It returns what answered and never judges.
+A read that THROWS (0.11.1) is a bad read asked again, bounded by `deadlineMs` (240 s), and only
+a LAST read that threw is thrown to the caller: the 2026-09-29 ship reported family and music red
+on a first `/healthz` that timed out twice while the edge was between versions (task 2291).
+`runWorkerSmoke` asks each of those reads with a 10 s curl `--max-time`
+(`HEALTH_READ_MAX_TIME_SEC`, passed as `EdgeRequestInit.maxTimeSec`), so the window costs 20 s a
+read instead of 120.
 
 `awaitConverged(probes)` (0.10.19) is the same wait over SEVERAL paths: every probe must agree
 three rounds in a row, bounded (120 s), before any leg is judged — a Worker's code and its static

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.10.26",
+	"version": "0.11.2",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {
@@ -122,6 +122,12 @@
 			"source": "./src/deployTree.ts",
 			"import": "./src/deployTree.ts"
 		},
+		"./ship": {
+			"types": "./src/ship.ts",
+			"bun": "./src/ship.ts",
+			"source": "./src/ship.ts",
+			"import": "./src/ship.ts"
+		},
 		"./relay": {
 			"types": "./src/relay.ts",
 			"bun": "./src/relay.ts",

package/src/backups.ts

@@ -7,3 +7,28 @@
  * whatever was decided. So it is one number here, and each app's prune takes it.
  */
 export const BACKUP_KEEP = 14;
+
+/**
+ * The name of one dated run: `YYYYMMDD-HHMMSS`, in the Mac's LOCAL time.
+ *
+ * 🔴 A contract with two sides, so it is spelled once. Every app's own backup script WRITES
+ * these directory names and prunes only what matches the pattern; station's backup audit READS
+ * them back into a time. Until cursedops 0.11.2 the writers held nine copies of the pattern and
+ * two of the stamp, and the reader held its own pair that wrote and read the stamp as UTC — so a
+ * run the apps named `20260929-100000` at 10:00 CDT was read as 10:00Z, five hours off.
+ */
+export const BACKUP_STAMP_PATTERN = /^\d{8}-\d{6}$/;
+
+const pad = (n: number): string => String(n).padStart(2, "0");
+
+/** A `Date` → its run name, in local time. {@link stampTime} is its inverse. */
+export const backupStamp = (d: Date): string =>
+	`${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
+
+/** A run name → epoch ms, read as local time — or `null` for anything that is not one. */
+export function stampTime(stamp: string): number | null {
+	if (!BACKUP_STAMP_PATTERN.test(stamp)) return null;
+	const n = (from: number, to: number): number => Number(stamp.slice(from, to));
+	const at = new Date(n(0, 4), n(4, 6) - 1, n(6, 8), n(9, 11), n(11, 13), n(13, 15));
+	return Number.isNaN(at.getTime()) ? null : at.getTime();
+}

package/src/edgeFetch.ts

@@ -58,6 +58,12 @@ export interface EdgeFetchOptions {
 	retryDelayMs?: (retry: number) => number;
 }
 
+/**
+ * A `RequestInit` this fetch reads one more field from: `maxTimeSec`, curl's `--max-time` for
+ * THIS request, over the instance's {@link EdgeFetchOptions.maxTimeSec}. A plain `fetch` ignores it.
+ */
+export type EdgeRequestInit = RequestInit & { maxTimeSec?: number };
+
 /**
  * 🔴 How many MORE times a request is sent after a connection-level curl failure that carried
  * no answer. Measured 2026-09-24: vault's prod deploy of `953e19a` reported "smoke FAILED" on one
@@ -125,7 +131,7 @@ export function parseCurlResponse(raw: Buffer, origin = "the edge", exit: number
 }
 
 /** A `fetch`-shaped function over curl — see the header. Each host is resolved once per instance — once it has an answer. */
-export function createEdgeFetch(options: EdgeFetchOptions = {}): (url: string, init?: RequestInit) => Promise<Response> {
+export function createEdgeFetch(options: EdgeFetchOptions = {}): (url: string, init?: EdgeRequestInit) => Promise<Response> {
 	const pinned = new Map<string, string>();
 	const resolve = options.resolve === undefined ? digCloudflare : options.resolve;
 	const curl =
@@ -155,7 +161,7 @@ export function createEdgeFetch(options: EdgeFetchOptions = {}): (url: string, i
 		const port = target.port || (target.protocol === "http:" ? "80" : "443");
 		const head = () => {
 			const ip = pinFor(target.hostname);
-			return ["-s", "-i", "--max-time", String(options.maxTimeSec ?? 60), ...(ip ? ["--resolve", `${target.hostname}:${port}:${ip}`] : [])];
+			return ["-s", "-i", "--max-time", String(init.maxTimeSec ?? options.maxTimeSec ?? 60), ...(ip ? ["--resolve", `${target.hostname}:${port}:${ip}`] : [])];
 		};
 		const args: string[] = [];
 		for (const [k, v] of Object.entries(options.headersFor?.(target.hostname) ?? {})) args.push("-H", `${k}: ${v}`);

package/src/ship.ts

@@ -0,0 +1,149 @@
+/**
+ * 🚢 FAST SHIPPING — the owner's switch for when a production deploy happens: after each task
+ * (`each`), or once, at the end of a run of tasks (`fast`, the default).
+ *
+ * The owner's ruling, 2026-09-28:
+ *
+ * > *"While on, agents do not publish or do long running things at all if they block task
+ * > completions. Instead they keep doing tasks until the end and do a final test run and if
+ * > everything is perfect then they publish … While the toggle is off, things work like today …
+ * > I will generally want it on because a few hours of a broken deploy is generally not a deal
+ * > breaker if we can get a big increase in tasks completed."*
+ *
+ * and, on how agents should meet it: *"the same commands no matter what the toggle is set to and
+ * the automation commands deal with the changes automatically."* So this module is read by the
+ * COMMANDS — `runWorkerDeploy` and every Mac-side `bun run deploy` — not by an agent deciding
+ * whether to call them. Measured 2026-09-28 (`autopilot phases`): deploys ~110 min/day, publishes
+ * 45–120 min/day and the waits on them ~115 min/day had become the slowest things a task does,
+ * and a batch that touches one app three times deployed it three times.
+ *
+ * ## The contract — one small file the runner owns
+ *
+ * `$FORGE_STATE/state/autopilot/ship.json`, written only by `autopilot ship-mode` (the station
+ * console's switch runs it). This module only READS it, the same way `recordDeployEvent` writes the
+ * runner's `events.jsonl` without importing the runner: the file shape is the interface.
+ *
+ *     { "mode": "fast" | "each", "setBy": "owner", "at": "<ISO>", "reason"?: "…" }
+ *
+ * - **Absent → `fast`.** The owner asked for it on by default.
+ * - **Unreadable or a mode it does not know → `fast`**, the same answer as absent. Fast never puts
+ *   anything unproven on a production URL — it only makes the deploy LATER — so there is no
+ *   direction of a bad read that ships something it should not.
+ * - **No generation at all → `each`.** A checkout outside any `forge.env` has no runner to ship
+ *   for it later, so deferring there would defer for ever.
+ *
+ * ## The overrides, both directions
+ *
+ * `FORGE_SHIP_NOW=1` in the environment ships now whatever the switch says: the ship task's own
+ * deploys, an outage fix, and a deploy the owner asked for in words (his sentence beats a switch he
+ * flipped yesterday — the precedence the retired `fastMode.ts` settled on 2026-08-13). A stage
+ * deploy is never deferred: it IS the fast way to see a change on a real edge.
+ */
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { forgeState } from "cursedops/roots";
+
+export const SHIP_MODES = ["fast", "each"] as const;
+export type ShipMode = (typeof SHIP_MODES)[number];
+
+/** The mode when the file is absent or unreadable — the owner's ruling, see the header. */
+export const DEFAULT_SHIP_MODE: ShipMode = "fast";
+
+/** `$FORGE_STATE/<this>` is the switch. The runner's `paths.ts` names the same file. */
+export const SHIP_FILE = join("state", "autopilot", "ship.json");
+
+/** The variable that ships now regardless of the switch. */
+export const SHIP_NOW_VAR = "FORGE_SHIP_NOW";
+
+export interface ShipSetting {
+	mode: ShipMode;
+	/** Who set it — `default` when no file says. */
+	setBy: string;
+	/** ISO, or `null` when nothing was ever written. */
+	at: string | null;
+	/** Why it reads as it does when the file could not be believed — shown, never thrown. */
+	unreadable?: string;
+}
+
+/** The switch as the file says it, with every failure read as {@link DEFAULT_SHIP_MODE}. */
+export function readShipSetting(state: string | null): ShipSetting {
+	if (state === null) return { mode: "each", setBy: "no generation", at: null };
+	const file = join(state, SHIP_FILE);
+	if (!existsSync(file)) return { mode: DEFAULT_SHIP_MODE, setBy: "default", at: null };
+	try {
+		const raw = JSON.parse(readFileSync(file, "utf8")) as { mode?: unknown; setBy?: unknown; at?: unknown };
+		if (!SHIP_MODES.includes(raw.mode as ShipMode)) {
+			return { mode: DEFAULT_SHIP_MODE, setBy: "default", at: null, unreadable: `mode ${JSON.stringify(raw.mode)} is not one of ${SHIP_MODES.join(", ")}` };
+		}
+		return {
+			mode: raw.mode as ShipMode,
+			setBy: typeof raw.setBy === "string" && raw.setBy ? raw.setBy : "unknown",
+			at: typeof raw.at === "string" ? raw.at : null,
+		};
+	} catch (cause) {
+		return { mode: DEFAULT_SHIP_MODE, setBy: "default", at: null, unreadable: (cause as Error).message };
+	}
+}
+
+/** Is `FORGE_SHIP_NOW` set to something that means yes? */
+export function shipNowAsked(env: NodeJS.ProcessEnv = process.env): boolean {
+	const v = env[SHIP_NOW_VAR]?.trim().toLowerCase();
+	return v === "1" || v === "true" || v === "yes";
+}
+
+/**
+ * The sentence a production deploy prints INSTEAD of deploying, or `null` to deploy now.
+ *
+ * The deploy then exits 0: it did what the mode asks of it. The app stays behind prod on purpose,
+ * and the runner's ship task — filed when the queue empties or the oldest owed commit is too old —
+ * deploys every app that is behind, once. `autopilot ship` lists what is owed.
+ */
+export function deferral(what: string, setting: ShipSetting, env: NodeJS.ProcessEnv = process.env): string | null {
+	if (setting.mode !== "fast" || shipNowAsked(env)) return null;
+	const by = setting.setBy === "default" ? "the default" : `set by ${setting.setBy}${setting.at ? ` at ${setting.at}` : ""}`;
+	return [
+		`🚢 ${what}: DEFERRED — fast shipping is on (${by}${setting.unreadable ? `; ship.json unreadable: ${setting.unreadable}` : ""}).`,
+		"   Nothing was deployed, and that is the intended result, not a failure: this app is now owed to",
+		"   the ship, which deploys every app behind its HEAD once, when the queue empties. Carry on with",
+		"   the next task — file this one as done once it is landed and gated, saying the deploy is owed.",
+		`   \`autopilot ship\` lists what is owed. To deploy now anyway (an outage fix, the ship itself, or`,
+		`   the owner asked for it): ${SHIP_NOW_VAR}=1 <the same command>.`,
+	].join("\n");
+}
+
+/**
+ * {@link deferral} for the checkout at `cwd` — what a Mac-side `bun run deploy` asks first:
+ *
+ *     const deferred = shipDeferral(appRoot(), "roms production deploy");
+ *     if (deferred) { console.log(deferred); process.exit(0); }
+ */
+export function shipDeferral(cwd: string, what: string, env: NodeJS.ProcessEnv = process.env): string | null {
+	return deferral(what, readShipSetting(forgeState(cwd, env)), env);
+}
+
+/** The ledger line a deferred production deploy leaves — what `autopilot ship` counts. */
+export interface ShipEventLine {
+	at: string;
+	kind: "ship";
+	what: "deferred";
+	repo: string;
+	env: string;
+	commit: string;
+	dirty: boolean;
+}
+
+/**
+ * Append one JSON line to the generation's ledger (`$FORGE_STATE/state/autopilot/events.jsonl`).
+ * Never throws; `false` when it did not write — a ledger that can fail a deploy is worse than none.
+ */
+export function appendLedger(state: string | null, line: object): boolean {
+	if (!state) return false;
+	try {
+		const file = join(state, "state", "autopilot", "events.jsonl");
+		mkdirSync(dirname(file), { recursive: true });
+		appendFileSync(file, `${JSON.stringify(line)}\n`);
+		return true;
+	} catch {
+		return false;
+	}
+}

package/src/smoke.ts

@@ -83,6 +83,8 @@
 import { spawnSync } from "node:child_process";
 import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
+// The package's own subpath, never `./edgeFetch.ts` — see `publishShape.test.ts`.
+import type { EdgeRequestInit } from "cursedops/edge-fetch";
 
 export interface Failure {
 	check: string;
@@ -840,12 +842,18 @@ export interface SteadyOptions {
 	reads?: number;
 	/** Reads before giving up and judging whatever answered. Default 40. */
 	tries?: number;
+	/**
+	 * Stop asking after this long, whatever `tries` says. Default 240 s — a read that THROWS can
+	 * cost a whole curl `--max-time`, so a count alone does not bound the wait.
+	 */
+	deadlineMs?: number;
 	/** Pause after a GOOD read, before the next. Default 2 s. */
 	pauseMs?: number;
 	/** Pause after a BAD read. Default 5 s. */
 	retryMs?: number;
 	/** Injected for tests. */
 	sleep?: (ms: number) => Promise<void>;
+	now?: () => number;
 }
 
 export interface SteadyRead<T> {
@@ -868,6 +876,14 @@ export interface SteadyRead<T> {
  * answering `503` (the pre-secrets version) and `404`, because one isolate had the new version
  * and the next did not. The copies in `vault` and `collections` still judged after one read.
  *
+ * 🔴 **A read that THROWS is a bad read, not the end of the wait.** Measured 2026-09-29 (task
+ * 2291): family's and music's production smokes each went red on their FIRST `/healthz`, straight
+ * after the secrets were put — `no answer … (curl exit 28)`, twice 60 s — and both hosts answered
+ * in 0.2 s moments later. The edge was between versions; rethrowing that first silence charged a
+ * green deploy with a red smoke. A throw now resets the count and is asked again until `tries`
+ * or `deadlineMs`; only when the LAST read threw is that error thrown to the caller, so a Worker
+ * that never answers is still a red that names why.
+ *
  * It never decides pass or fail: it returns what answered, and the caller judges that — a wait
  * that swallowed its own timeout would be a check that cannot go red.
  */
@@ -878,22 +894,44 @@ export async function steadyHealth<T = Record<string, unknown>>(
 ): Promise<SteadyRead<T>> {
 	const reads = options.reads ?? 3;
 	const tries = options.tries ?? 40;
+	const deadlineMs = options.deadlineMs ?? 240_000;
 	const sleep = options.sleep ?? ((ms: number) => new Promise<void>((done) => setTimeout(done, ms)));
+	const now = options.now ?? Date.now;
+	const started = now();
 	let steady = 0;
 	let asked = 0;
 	for (;;) {
-		const response = await ask();
+		let read: { response: Response; body: T } | null = null;
+		let thrown: unknown = null;
+		try {
+			const response = await ask();
+			const body = (await response
+				.clone()
+				.json()
+				.catch(() => ({}))) as T;
+			read = { response, body };
+		} catch (error) {
+			thrown = error;
+		}
 		asked++;
-		const body = (await response
-			.clone()
-			.json()
-			.catch(() => ({}))) as T;
-		steady = ready(body, response) ? steady + 1 : 0;
-		if (steady >= reads || asked >= tries) return { response, body, steady, asked };
+		steady = read && ready(read.body, read.response) ? steady + 1 : 0;
+		const out = asked >= tries || now() - started >= deadlineMs;
+		if (read && (steady >= reads || out)) return { ...read, steady, asked };
+		if (!read && out) throw thrown;
 		await sleep(steady > 0 ? (options.pauseMs ?? 2_000) : (options.retryMs ?? 5_000));
 	}
 }
 
+/**
+ * curl's `--max-time` for ONE `/healthz` read of a settling Worker, in seconds. Short on purpose:
+ * {@link steadyHealth} asks again after a silence, so a long timeout only makes the edge's
+ * between-versions window cost more — the 2026-09-29 reds spent 120 s on two reads of it.
+ */
+export const HEALTH_READ_MAX_TIME_SEC = 10;
+
+/** The init a smoke's `/healthz` read carries — `cursedops/edge-fetch` honours it; a plain `fetch` ignores it. */
+const healthRead: EdgeRequestInit = { maxTimeSec: HEALTH_READ_MAX_TIME_SEC };
+
 /** One question a deploy must answer the NEW way — `null` when it does, else why not. */
 export interface ConvergenceProbe {
 	name: string;
@@ -1065,7 +1103,7 @@ export async function runWorkerSmoke(spec: WorkerSmokeSpec): Promise<number> {
 		let status: number;
 		try {
 			const read = await steadyHealth<Record<string, unknown>>(
-				() => ask("/healthz"),
+				() => ask("/healthz", healthRead),
 				(body) => body.commit === spec.head && body.apiServed === true,
 				spec.steady,
 			);
@@ -1155,7 +1193,7 @@ async function accessDoorSmoke(
 		let health: Record<string, unknown>;
 		let status: number;
 		try {
-			const read = await steadyHealth<Record<string, unknown>>(() => ask("/healthz"), (body) => body.commit === spec.head, spec.steady);
+			const read = await steadyHealth<Record<string, unknown>>(() => ask("/healthz", healthRead), (body) => body.commit === spec.head, spec.steady);
 			health = read.body;
 			status = read.response.status;
 		} catch (error) {

package/src/workerDeploy.ts

@@ -53,9 +53,10 @@
  * refusal without wrangler, git or a network.
  */
 import { spawn, spawnSync } from "node:child_process";
-import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 import { forgeState } from "cursedops/roots";
+import { appendLedger, deferral, readShipSetting, type ShipEventLine, type ShipSetting } from "cursedops/ship";
 
 /** The two deployments every Worker app here has. */
 export type WorkerEnv = "production" | "stage";
@@ -318,6 +319,16 @@ export interface DeployDeps {
 	 * A throw here is swallowed: a ledger that can fail a deploy is worse than none.
 	 */
 	record?: (line: DeployEventLine) => void;
+	/**
+	 * The owner's fast-shipping switch ({@link readShipSetting}). {@link workerDeployDeps} reads the
+	 * generation's `ship.json`; absent here, the deploy behaves as it always did — so a suite that
+	 * builds its own deps never reads this Mac's switch.
+	 */
+	ship?: () => ShipSetting;
+	/** Where `FORGE_SHIP_NOW` is read from. Default `process.env`. */
+	env?: NodeJS.ProcessEnv;
+	/** Where a deferred production deploy's `ship` line goes. {@link workerDeployDeps} appends it to the ledger. */
+	recordShip?: (line: ShipEventLine) => void;
 }
 
 /**
@@ -353,15 +364,7 @@ export interface DeployEventLine {
 
 /** Append one line to the ledger under a state root. Never throws; `false` when it did not write. */
 export function recordDeployEvent(state: string | null, line: DeployEventLine): boolean {
-	if (!state) return false;
-	try {
-		const file = join(state, "state", "autopilot", "events.jsonl");
-		mkdirSync(dirname(file), { recursive: true });
-		appendFileSync(file, `${JSON.stringify(line)}\n`);
-		return true;
-	} catch {
-		return false;
-	}
+	return appendLedger(state, line);
 }
 
 export interface DeployResult {
@@ -404,6 +407,10 @@ export function workerDeployDeps(cwd: string): DeployDeps {
 		record: (line) => {
 			recordDeployEvent(forgeState(cwd), line);
 		},
+		ship: () => readShipSetting(forgeState(cwd)),
+		recordShip: (line) => {
+			appendLedger(forgeState(cwd), line);
+		},
 	};
 }
 
@@ -688,6 +695,21 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 	const unmeasured: string[] = [];
 
 	if (!commit) return stop("head", "this checkout has no readable HEAD — there is no commit to stamp, so nothing could prove the deploy.");
+	// 🚢 Fast shipping (`./ship.ts`): a production deploy made while the switch is on is owed to the
+	// runner's ship instead — asked before anything installs or builds, so deferring costs nothing.
+	// Its `ship` line, not a `deploy` one: a deferral is not a deploy, and would drag every median.
+	if (spec.env === "production" && deps.ship) {
+		const deferred = deferral(`${spec.app} production deploy`, deps.ship(), deps.env ?? process.env);
+		if (deferred) {
+			log(`\n${deferred}`);
+			try {
+				deps.recordShip?.({ at: new Date(started).toISOString(), kind: "ship", what: "deferred", repo: spec.app, env: spec.env, commit: commit.slice(0, 8), dirty });
+			} catch {
+				// never the deploy's verdict — see DeployDeps.record
+			}
+			return { code: 0, step: "deferred", detail: deferred, commit, dirty };
+		}
+	}
 	if (spec.env === "production" && dirty) {
 		return stop("clean-tree", `the tree is dirty — production would report ${commit.slice(0, 8)} and run something else:\n${porcelain}`);
 	}

package/src/workerSecrets.ts

@@ -92,6 +92,12 @@ export interface SecretSync {
 /** Tries per put. A put is idempotent, so a retry can only turn a network blip into a success. */
 export const SECRET_PUT_ATTEMPTS = 3;
 
+/**
+ * Reads of the account after the puts before a set that is not exact is believed. A read changes
+ * nothing, so asking again can only replace a stale answer with a current one — see {@link syncSecrets}.
+ */
+export const SECRET_READBACK_ATTEMPTS = 5;
+
 /**
  * Apply `plan`: put every value, delete every extra, then READ THE ACCOUNT BACK and fail unless it
  * holds exactly the set. Refuses without touching anything when the plan has `absent` keys.
@@ -100,11 +106,17 @@ export const SECRET_PUT_ATTEMPTS = 3;
  * `wrangler secret put` of three hit `fetch failed` and the whole deploy stopped with
  * collections-stage holding a Worker and no secrets — serving nothing — for a blip the next
  * attempt would have cleared. The read-back is still the verdict.
+ *
+ * 🔴 **The read-back is asked again, up to {@link SECRET_READBACK_ATTEMPTS} times, before a set
+ * that is not exact is believed.** Measured 2026-09-29 on family-stage (task 2291): the account
+ * listed both secrets, both puts said ok, and the list read straight after answered NOTHING — a
+ * green deploy stopped as "secrets NOT attached". The same script run again a minute later read
+ * both. The LAST read is the verdict, so a set that is really wrong is still a red.
  */
 export async function syncSecrets(
 	plan: SecretPlan,
 	ops: SecretOps,
-	options: { attempts?: number; pause?: (ms: number) => Promise<void> } = {},
+	options: { attempts?: number; readbacks?: number; pause?: (ms: number) => Promise<void> } = {},
 ): Promise<SecretSync> {
 	const attempts = Math.max(1, options.attempts ?? SECRET_PUT_ATTEMPTS);
 	const pause = options.pause ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
@@ -130,9 +142,20 @@ export async function syncSecrets(
 		lines.push(`DELETE ${name} — not in the set — ${ok ? "gone" : "FAILED"}`);
 		if (!ok) bad++;
 	}
-	const after = await ops.held();
-	const exact = after.length === plan.wanted.length && plan.wanted.every((name) => after.includes(name));
-	lines.push(exact ? `holds exactly: ${after.join(", ")}` : `🔴 holds ${after.join(", ") || "(nothing)"} — not exactly ${plan.wanted.join(", ")}`);
+	const readbacks = Math.max(1, options.readbacks ?? SECRET_READBACK_ATTEMPTS);
+	const isExact = (held: readonly string[]) => held.length === plan.wanted.length && plan.wanted.every((name) => held.includes(name));
+	let after = await ops.held();
+	let reads = 1;
+	while (!isExact(after) && reads < readbacks) {
+		await pause(2_000 * reads);
+		after = await ops.held();
+		reads++;
+	}
+	const exact = isExact(after);
+	const reread = reads > 1 ? ` (read ${reads} times)` : "";
+	lines.push(
+		exact ? `holds exactly: ${after.join(", ")}${reread}` : `🔴 holds ${after.join(", ") || "(nothing)"} — not exactly ${plan.wanted.join(", ")}${reread}`,
+	);
 	return { ok: exact && bad === 0, lines, after };
 }