cursedops 0.18.0 → 0.19.1

package/README.md

@@ -25,7 +25,7 @@ import shape, worked example, and the incident each one is pinned to.
 | `cursedops/backups` | `BACKUP_KEEP`, the fleet's one retention for dated snapshots; `BACKUP_STAMP_PATTERN`, `backupStamp` and `stampTime` |
 | `cursedops/serve` | the static tier's four helpers — the path-traversal guard, the MIME table, the hashed-asset test, the crash handlers |
 | `cursedops/worker-safety` | the two static checks every Worker app's suite runs over its own source — the import-graph walk an app's own test does from `worker/index.ts` (a value import of `bun:sqlite` or a Bun-only subpath is a deploy that goes green and a Worker that never starts), and the await port's silent shapes (`rows.filter(async …)` keeps every row) |
-| `cursedops/api-floor` | the rule that an unmatched `/api/...` is a phrase and never the app shell — the namespace predicates, the trailing-slash normaliser, the default 404 body |
+| `cursedops/api-floor` | the rule that an unmatched `/api/...` is a phrase and never the app shell — the namespace predicates, the trailing-slash normalizer, the default 404 body |
 | `cursedops/build-info` | which commit a checkout-served process is running and whether its tree was dirty, read once at load. `node:child_process`, so never in a Worker |
 | `cursedops/bound-lists` | the static check that no SQL builds an `IN (…)` list one `?` per value — the shape D1 500s on past 100 ids |
 | `cursedops/staged-client` | the IMMUTABLE client a checkout-served app serves — a build staged into `<APP_DATA_DIR>/client/<commit>/` behind `CURRENT` |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.18.0",
+	"version": "0.19.1",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/apiFloor.ts

@@ -19,7 +19,7 @@
  *   > this commit and reload"*, which sent the owner at a deploy that could not have
  *   > helped.
  *
- * Both halves of that are here, because a floor without the normaliser fixes the symptom
+ * Both halves of that are here, because a floor without the normalizer fixes the symptom
  * the owner did not have: {@link canonicalApiPath} makes the trailing slash a non-event,
  * and {@link isApiPath} + {@link apiNotFoundBody} make every remaining miss a JSON 404
  * that names the route, the app and the commit answering. A wrong path says "wrong path";
@@ -73,7 +73,7 @@ export const isApiPath = (urlPath: string): boolean =>
  * 🔴 One rule, and it is the one that broke the Openclaw page: a trailing slash on an API
  * path is never meaningful. Hono mounts a sub-app's `get("/")` at the mount point WITHOUT
  * a trailing slash and then matches strictly, so `/api/openclaw/` is a different path
- * from `/api/openclaw` and matched nothing at all. Normalising once, in front of the
+ * from `/api/openclaw` and matched nothing at all. Normalizing once, in front of the
  * router, means no caller anywhere can spell it the losing way again — which a fix in the
  * one client module that happened to do it would not have bought.
  *
@@ -86,8 +86,8 @@ export function canonicalApiPath(urlPath: string): string | null {
 }
 
 /**
- * The same normalisation, applied to a whole request. Returns the request unchanged when
- * there is nothing to normalise, so a caller that guards on {@link canonicalApiPath}
+ * The same normalization, applied to a whole request. Returns the request unchanged when
+ * there is nothing to normalize, so a caller that guards on {@link canonicalApiPath}
  * allocates nothing.
  *
  * 🔴 **Call it from INSIDE the floor handler and re-dispatch, not from the host's

package/src/d1Import.ts

@@ -14,17 +14,17 @@
  * ## 🔴 Row for row, never a count
  *
  * Two tables can hold the same NUMBER of different rows, and a count is exactly the check that
- * cannot tell — on `collections`' catalogue that would have been a caption, a rotation or a
+ * cannot tell — on `collections`' catalog that would have been a caption, a rotation or a
  * checksum silently replaced by another file's. `collections`, `vault`, `patterns` and `music`
  * each wrote this comparison (task 2097); the `rowDigest` bodies had drifted:
  *
- *   · `collections` normalised numbers — `bun:sqlite` hands back `0` where D1's JSON carries
+ *   · `collections` normalized numbers — `bun:sqlite` hands back `0` where D1's JSON carries
  *     `0.0`, and float noise past twelve significant digits — because `duration_seconds` is REAL
- *     on 39 of its rows and a comparison that called those different reported the catalogue
- *     corrupt on every run. `vault` and `music` did not normalise, and would have.
+ *     on 39 of its rows and a comparison that called those different reported the catalog
+ *     corrupt on every run. `vault` and `music` did not normalize, and would have.
  *   · `vault` and `music` spelled a BLOB as `X'…'` for the insert; `patterns` could not carry one.
  *
- * The body here is the union: numbers normalised, blobs compared as hex whichever side they came
+ * The body here is the union: numbers normalized, blobs compared as hex whichever side they came
  * from (a `Uint8Array` from `bun:sqlite`, an array of bytes from D1's JSON), booleans as 0/1.
  */
 
@@ -54,7 +54,7 @@ function cell(value: unknown): string | number | null {
 	return String(value);
 }
 
-/** One row flattened to a comparable string over `columns` — see the header for the normalisation. */
+/** One row flattened to a comparable string over `columns` — see the header for the normalization. */
 export function rowDigest(row: Readonly<Record<string, unknown>>, columns: readonly string[]): string {
 	return JSON.stringify(columns.map((column) => cell(row[column])));
 }

package/src/edgeFetch.ts

@@ -271,7 +271,7 @@ export const NO_ANSWER_STATUS = 599;
  * {@link NO_ANSWER_STATUS} `Response` whose body and `x-edge-error` header carry the reason, and
  * `onThrow` hears it first so the smoke's ledger can name it.
  *
- * 🔴 Why (2026-09-25): roms' `worker:smoke` asked a relayed path while the Mac's link redialled,
+ * 🔴 Why (2026-09-25): roms' `worker:smoke` asked a relayed path while the Mac's link redialed,
  * `edgeFetch` threw on curl exit 28, and the process died with a stack trace and no ledger — so a
  * healthy release exited 1. Every leg of a smoke is supposed to be RECORDED: a throw is a failed
  * leg naming its path, never the end of the run.

package/src/launchd.ts

@@ -66,7 +66,7 @@ export interface CommandResult {
 /**
  * How this module reaches launchd and the LaunchAgents directory.
  *
- * Injectable as one object because the interesting behaviour — clearing a label
+ * Injectable as one object because the interesting behavior — clearing a label
  * and *waiting* for it to go — cannot otherwise be reached from a test that does
  * not install a real login agent first, and a test nobody runs is not a test.
  */

package/src/relay.ts

@@ -38,7 +38,7 @@ export const DEFAULT_MAX_BODY_BYTES = 4 * 1024 * 1024;
 /** How long the Worker waits for the Mac to answer one request before it says so. */
 export const DEFAULT_RELAY_TIMEOUT_MS = 30_000;
 
-/** A request travelling DOWN the link. `path` includes the query string. */
+/** A request traveling DOWN the link. `path` includes the query string. */
 export interface RequestFrame {
 	t: "req";
 	id: string;
@@ -48,7 +48,7 @@ export interface RequestFrame {
 	body: string | null;
 }
 
-/** The Mac's answer, travelling UP. Multiple `set-cookie` lines stay separate pairs. */
+/** The Mac's answer, traveling UP. Multiple `set-cookie` lines stay separate pairs. */
 export interface ResponseFrame {
 	t: "res";
 	id: string;
@@ -459,7 +459,7 @@ export class RelayLink {
 			if (body.length <= (cache.maxKeptBody ?? 512 * 1024)) {
 				const at = this.now();
 				await this.state.storage.put(`c:${owner}:${keyed}`, { body, contentType: response.headers.get("content-type") ?? "application/json", at } satisfies Kept);
-				// The newest cookie the Mac honoured is the one a `warm` frame refreshes under.
+				// The newest cookie the Mac honored is the one a `warm` frame refreshes under.
 				await this.state.storage.put("warm", { cookie, at });
 			}
 		}
@@ -474,7 +474,7 @@ export class RelayLink {
 		if (keys.length > 0) await this.state.storage.delete(keys);
 	}
 
-	/** Refresh every read the Mac named, under the newest cookie it honoured — if that is still fresh. */
+	/** Refresh every read the Mac named, under the newest cookie it honored — if that is still fresh. */
 	private async warm(paths: readonly string[]): Promise<void> {
 		const cache = this.options.offline;
 		if (!cache) return;

package/src/relayStage.ts

@@ -163,7 +163,7 @@ export const realRun: Run = (argv, options) => {
 /**
  * 🔴 How many rounds in a row every `/healthz` must name a just-put link digest before a walk uses it.
  * A digest put is a new Worker version, and the edge takes it up instance by instance: the link
- * staying up for 15 s proves only that the instance the link dialled has it. The Worker signs the
+ * staying up for 15 s proves only that the instance the link dialed has it. The Worker signs the
  * Mac's identity with that digest, so a request answered by an instance still on the old one is the
  * Mac's own 401 (and station's kept read a 503). Measured 2026-10-15 (forge task 3235): station's
  * fast-lane walk at baf8495, the link steady for 15 s, then four writes 401 at the Mac; on the real

package/src/roots.ts

@@ -8,7 +8,7 @@
  * written independently against the same problem; measured 2026-09-16 the
  * `findForgeRoot` bodies were character-identical and the surrounding halves were
  * not, which is the definition of an extraction that is measurable rather than
- * speculative. Two implementations, one behaviour.
+ * speculative. Two implementations, one behavior.
  *
  * ## The rule this serves
  *
@@ -332,7 +332,7 @@ function shellDoubleQuoted(value: string): string {
  * {@link findForgeRoot}).
  *
  * 🔴 **Verified, never trusted.** A `$FORGE` pointing at a directory with no `forge.env` is a
- * stale export from a shell that outlived a move, and honouring it re-creates the exact defect
+ * stale export from a shell that outlived a move, and honoring it re-creates the exact defect
  * {@link repoCd} exists to end: a command naming a directory that is not there.
  * {@link forgeCodeRoot} deliberately keeps its older contract (the variable wins unchecked); this
  * is the one for text a person will paste.

package/src/serve.ts

@@ -9,7 +9,7 @@
  * `station` and `vault` each have a `src/server/serve.ts`. The FILES differ — 247
  * to 387 lines, eight distinct versions, which is why no `diff` ever flagged them —
  * but these four bodies are character-identical in **eight of eight**, with the
- * whitespace and comments normalised away.
+ * whitespace and comments normalized away.
  *
  * 🔴 **`fileWithin` is why this was urgent rather than tidy.** It is the check that
  * stops `%2e%2e%2f` reaching the filesystem. Eight copies of a security guarantee
@@ -28,7 +28,7 @@
  * `8  <symbol> src/server/serve.ts` and is the census that will notice if a copy
  * comes back.
  *
- * ## 🔴 The one behaviour that is NOT a byte-for-byte carry
+ * ## 🔴 The one behavior that is NOT a byte-for-byte carry
  *
  * The eight copies resolved containment LEXICALLY — `resolve(join(root, …))` and a
  * `startsWith` — which is correct for `..` and for `%2e%2e%2f`, and blind to a
@@ -42,7 +42,7 @@
  *     the same way — the failure mode a naive `realpath` on one side only would
  *     have introduced, and the reason this is not one line;
  *   - every caller today passes a Vite `dist/`, and all eight were checked for
- *     symlinks on 2026-09-17: there are none. So no app's behaviour moves, and the
+ *     symlinks on 2026-09-17: there are none. So no app's behavior moves, and the
  *     day one of them serves a directory it did not build, the guard already holds.
  *
  * `serve.test.ts` drives both halves, including the symlink escape, because a guard

package/src/ship.ts

@@ -39,12 +39,12 @@
  * flipped yesterday — the precedence the retired `fastMode.ts` settled on 2026-08-13). A stage
  * deploy is never deferred: it IS the fast way to see a change on a real edge.
  *
- * 🔴 **Under a batch (`$AUTOPILOT_BATCH` set) it is honoured only for the ship task or an incident**
+ * 🔴 **Under a batch (`$AUTOPILOT_BATCH` set) it is honored only for the ship task or an incident**
  * ({@link shipNowVerdict}), and only with a reason in `FORGE_SHIP_NOW_WHY`. Until task 2384 any agent
  * could prefix one variable and turn the owner's switch off for itself — the thing
  * `~/.claude/CLAUDE.md` §2 says an agent may never do — and no record said it had. Now every ask,
- * honoured or refused, is a `kind: "ship-now"` ledger row, and `autopilot doctor` lists the ones
- * with no reason. In the owner's own shell (no batch) it is honoured exactly as before, and recorded.
+ * honored or refused, is a `kind: "ship-now"` ledger row, and `autopilot doctor` lists the ones
+ * with no reason. In the owner's own shell (no batch) it is honored exactly as before, and recorded.
  */
 import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -92,7 +92,7 @@ export function readShipSetting(state: string | null): ShipSetting {
 	}
 }
 
-/** Is `FORGE_SHIP_NOW` set to something that means yes? Asked is not honoured — see {@link shipNowVerdict}. */
+/** Is `FORGE_SHIP_NOW` set to something that means yes? Asked is not honored — see {@link shipNowVerdict}. */
 export function shipNowAsked(env: NodeJS.ProcessEnv = process.env): boolean {
 	const v = env[SHIP_NOW_VAR]?.trim().toLowerCase();
 	return v === "1" || v === "true" || v === "yes";
@@ -116,7 +116,7 @@ export interface ShipNowVerdict {
 	asked: boolean;
 	/** Ship now: asked, and (outside a batch, or on a claim that earns it). */
 	honoured: boolean;
-	/** One sentence: what made it honoured or refused. */
+	/** One sentence: what made it honored or refused. */
 	why: string;
 	/** `FORGE_SHIP_NOW_WHY`, trimmed — `""` when not given. */
 	reason: string;
@@ -159,7 +159,7 @@ export interface ShipNowWhere {
 }
 
 /**
- * Is `FORGE_SHIP_NOW` honoured here? Outside a batch, whenever it is asked: that is the owner's own
+ * Is `FORGE_SHIP_NOW` honored here? Outside a batch, whenever it is asked: that is the owner's own
  * shell. Under `$AUTOPILOT_BATCH`, only when that batch holds a live `kind: "task"` board claim
  * (`$FORGE_STATE/state/board/*.json`, the pid alive and not expired) on a task in
  * `$FORGE/tasks/In_Progress/` whose `escalation-key:` is one of {@link SHIP_NOW_KEYS}, AND
@@ -206,11 +206,11 @@ export function shipNowVerdict(where: ShipNowWhere, env: NodeJS.ProcessEnv = pro
 		if (key && SHIP_NOW_KEYS.some((k) => k.test(key))) return { ...base, honoured: true, why: `batch ${batch} holds ${c.task} (escalation-key: ${key})`, task: c.task };
 	}
 	return refuse(
-		`batch ${batch} holds ${held.length ? held.join(", ") : "no live task claim"} — ${SHIP_NOW_VAR} is honoured under a batch only for the ship task or a prod incident (escalation-key: ship | prod-down:<host>)`,
+		`batch ${batch} holds ${held.length ? held.join(", ") : "no live task claim"} — ${SHIP_NOW_VAR} is honored under a batch only for the ship task or a prod incident (escalation-key: ship | prod-down:<host>)`,
 	);
 }
 
-/** The ledger line every ship-now ask leaves — honoured or refused. */
+/** The ledger line every ship-now ask leaves — honored or refused. */
 export interface ShipNowEventLine {
 	at: string;
 	kind: "ship-now";

package/src/smoke.ts

@@ -13,7 +13,7 @@
  *      its logs was wrong.
  *   3. A deploy *succeeded* while every byte of media was unreachable, because the
  *      failing layer answered before the thing being health-checked ran.
- *   4. An app was up, green, and serving a catalogue a MONTH out of date.
+ *   4. An app was up, green, and serving a catalog a MONTH out of date.
  *   5. Two apps went live answering `no built client at …/public` at `/` while the
  *      edge returned 200 out of its cache of the RETIRED deployment. Gate green,
  *      deploy green, smoke green, app down; the owner found it, not a check.
@@ -62,7 +62,7 @@
  * built, `patterns.cursedalchemy.com` served one built on 2026-09-12 out of a
  * Worker nobody knew about, and **every automated surface was green for six days.**
  * The app-local implementation that found it — `apps/patterns/scripts/worker-smoke.ts`,
- * `CROSS_CHECKS` — is what this generalises, because five more apps are moving
+ * `CROSS_CHECKS` — is what this generalizes, because five more apps are moving
  * behind an edge Worker and a check told ONE NAME is a check about that name.
  *
  * ## What this module will never grow
@@ -501,7 +501,7 @@ export async function compareDeployedShells(addresses: string[], options: ShellO
 		url.searchParams.set("cb", cacheBust());
 		// 🔴 Re-thrown WITH the address and with the original message intact: which
 		// of the addresses could not be reached is the whole diagnosis, and
-		// {@link Smoke.dnsHint} still has to recognise an ENOTFOUND inside it.
+		// {@link Smoke.dnsHint} still has to recognize an ENOTFOUND inside it.
 		const response = await send(url.toString(), {
 			redirect: "manual",
 			signal: AbortSignal.timeout(timeoutMs),
@@ -929,7 +929,7 @@ export async function steadyHealth<T = Record<string, unknown>>(
  */
 export const HEALTH_READ_MAX_TIME_SEC = 10;
 
-/** The init a smoke's `/healthz` read carries — `cursedops/edge-fetch` honours it; a plain `fetch` ignores it. */
+/** The init a smoke's `/healthz` read carries — `cursedops/edge-fetch` honors it; a plain `fetch` ignores it. */
 const healthRead: EdgeRequestInit = { maxTimeSec: HEALTH_READ_MAX_TIME_SEC };
 
 /** One question a deploy must answer the NEW way — `null` when it does, else why not. */
@@ -1030,8 +1030,13 @@ export interface WorkerSmokeSpec {
 	deployment: { env: string; workerName: string; publicUrl: string; previewUrl: string | null };
 	/** Addresses given on the command line. Empty: the preview (no cache in front) and the public URL. */
 	urls?: readonly string[];
-	/** The checkout's HEAD, as `/healthz` reports a commit (`git rev-parse --short=8 HEAD`). */
+	/**
+	 * The checkout's HEAD, as `/healthz` reports a commit (`git rev-parse --short=8 HEAD`). Under
+	 * `runWorkerDeploy` the commit it STAMPED wins — see {@link DEPLOYED_COMMIT_ENV}.
+	 */
 	head: string;
+	/** Where {@link DEPLOYED_COMMIT_ENV} is read. Default `process.env`. */
+	env?: Record<string, string | undefined>;
 	/**
 	 * Every private route; each must refuse an anonymous caller with 401 (`door: "access"`: 403 on
 	 * the preview, 200 through the token on the public host). Empty is a FAILURE.
@@ -1059,6 +1064,25 @@ export interface WorkerSmokeSpec {
 	log?: (line: string) => void;
 }
 
+/**
+ * 🔴 The commit `runWorkerDeploy` stamped into the Worker it just uploaded, handed to its smoke.
+ *
+ * Each app's smoke reads its checkout's HEAD when it starts, minutes after the deploy read it to
+ * stamp the build. On 2026-10-18 music's fast lane built and stamped `a0bca487`, a batch landed an
+ * e2e-only commit two minutes in, and the smoke — asking for the new HEAD `43c2bae8` — waited out
+ * its steady window and then failed a healthy production deploy on `commit`. The smoke proves
+ * what was DEPLOYED, so it asks for this commit when it is set, and for HEAD only when run alone.
+ */
+export const DEPLOYED_COMMIT_ENV = "CURSEDOPS_DEPLOYED_COMMIT";
+
+/** The commit `/healthz` must report, and the words the `commit` check says it in. */
+export function expectedCommit(spec: Pick<WorkerSmokeSpec, "head" | "env">): { commit: string; said: string } {
+	const stamped = (spec.env ?? process.env)[DEPLOYED_COMMIT_ENV]?.trim();
+	if (!stamped) return { commit: spec.head, said: `HEAD ${spec.head}` };
+	const commit = stamped.slice(0, spec.head.length || 8);
+	return { commit, said: commit === spec.head ? `HEAD ${commit}` : `deployed ${commit} (HEAD has moved on to ${spec.head} since)` };
+}
+
 /**
  * The whole anonymous `worker:smoke` of a deployed Worker, lifted out of `apps/family` and
  * `apps/music` (task 2145). Per address: `/healthz` settles on THIS commit with the door mounted
@@ -1078,6 +1102,7 @@ export async function runWorkerSmoke(spec: WorkerSmokeSpec): Promise<number> {
 			? [...spec.urls]
 			: [...new Set([deployment.previewUrl, deployment.publicUrl].filter((u): u is string => Boolean(u)))];
 	const smoke = createSmoke({ base: deployment.publicUrl || (urls[0] as string), ...spec.smokeOptions });
+	const want = expectedCommit(spec);
 
 	for (const base of urls) {
 		const host = new URL(base).hostname;
@@ -1104,7 +1129,7 @@ export async function runWorkerSmoke(spec: WorkerSmokeSpec): Promise<number> {
 		try {
 			const read = await steadyHealth<Record<string, unknown>>(
 				() => ask("/healthz", healthRead),
-				(body) => body.commit === spec.head && body.apiServed === true,
+				(body) => body.commit === want.commit && body.apiServed === true,
 				spec.steady,
 			);
 			health = read.body;
@@ -1120,7 +1145,7 @@ export async function runWorkerSmoke(spec: WorkerSmokeSpec): Promise<number> {
 			health.apiServed === true,
 			`apiServed ${JSON.stringify(health.apiServed)}${health.apiRefusal ? ` (${health.apiRefusal})` : ""}`,
 		);
-		smoke.record(`${tag} commit`, health.commit === spec.head, `serving ${JSON.stringify(health.commit)}, HEAD ${spec.head}`);
+		smoke.record(`${tag} commit`, health.commit === want.commit, `serving ${JSON.stringify(health.commit)}, ${want.said}`);
 		smoke.record(
 			`${tag} publicUrl`,
 			health.publicUrl === deployment.publicUrl,
@@ -1180,6 +1205,7 @@ async function accessDoorSmoke(
 	log: (line: string) => void,
 ): Promise<number> {
 	const { deployment } = spec;
+	const want = expectedCommit(spec);
 	const anonymous = spec.anonymousFetch;
 	if (!anonymous) {
 		smoke.refuseEnvironment("the anonymous fetch", 'door: "access" needs `anonymousFetch` — a fetch that carries NO Access token');
@@ -1199,7 +1225,7 @@ async function accessDoorSmoke(
 		let health: Record<string, unknown>;
 		let status: number;
 		try {
-			const read = await steadyHealth<Record<string, unknown>>(() => ask("/healthz", healthRead), (body) => body.commit === spec.head, spec.steady);
+			const read = await steadyHealth<Record<string, unknown>>(() => ask("/healthz", healthRead), (body) => body.commit === want.commit, spec.steady);
 			health = read.body;
 			status = read.response.status;
 		} catch (error) {
@@ -1208,7 +1234,7 @@ async function accessDoorSmoke(
 			continue;
 		}
 		smoke.record(`${tag} healthz`, status === 200 && health.runtime === "worker", `${status}, runtime ${JSON.stringify(health.runtime)}`);
-		smoke.record(`${tag} commit`, health.commit === spec.head, `serving ${JSON.stringify(health.commit)}, HEAD ${spec.head}`);
+		smoke.record(`${tag} commit`, health.commit === want.commit, `serving ${JSON.stringify(health.commit)}, ${want.said}`);
 		smoke.record(
 			`${tag} access`,
 			health.access === true,

package/src/workerDeploy.ts

@@ -60,6 +60,7 @@ import { join } from "node:path";
 import { liveColumns, liveColumnsQueries, missingColumnStatements, schemaTables } from "cursedops/d1-columns";
 import { wranglerRows } from "cursedops/d1-import";
 import { forgeCodeRoot, forgeState } from "cursedops/roots";
+import { DEPLOYED_COMMIT_ENV } from "cursedops/smoke";
 import { appendLedger, deferral, readShipSetting, type ShipEventLine, type ShipNowWhere, type ShipSetting } from "cursedops/ship";
 import { type StageLeaseResult, takeStageLease } from "cursedops/stage-lease";
 
@@ -81,7 +82,7 @@ export function parseWorkerEnv(argv: readonly string[]): WorkerEnv {
 	const value = (joined !== undefined ? joined.slice("--env=".length) : argv[index + 1])?.trim();
 	if (value === "production" || value === "stage") return value;
 	throw new Error(
-		`unrecognised --env ${JSON.stringify(value ?? "")} — production (no flag) or stage. ` +
+		`unrecognized --env ${JSON.stringify(value ?? "")} — production (no flag) or stage. ` +
 			"This refuses rather than defaulting: a typo that meant production would report success against the owner's data.",
 	);
 }
@@ -977,7 +978,8 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 		step(`smoke every address this deployment answers on${spec.cpuTail ? ", under a CPU tail" : ""}`);
 		enter("smoke");
 		const smoke = spec.cpuTail ? underCpuTail(spec.cpuTail, spec.env, spec.smoke) : spec.smoke;
-		const smoked = deps.run(smoke, {});
+		// The commit stamped above, not the HEAD the smoke would read minutes later (`DEPLOYED_COMMIT_ENV`).
+		const smoked = deps.run(smoke, { [DEPLOYED_COMMIT_ENV]: commit });
 		if (spec.cpuTail && smoked === TAIL_UNATTACHED_EXIT) unmeasured.push("the smoke");
 		else if (smoked !== 0) {
 			return stop(
@@ -1262,7 +1264,7 @@ export interface JudgeOpts {
 	scriptName: string;
 	/** Paths that are never the static tier. Default {@link DEFAULT_API_PREFIXES}. */
 	apiPrefixes?: readonly string[];
-	/** Replace the labeller entirely. Default {@link tierRoute}. */
+	/** Replace the labeler entirely. Default {@link tierRoute}. */
 	route?: (method: string, path: string) => string | null;
 }
 

package/src/workerRollback.ts

@@ -16,7 +16,7 @@
  * ## Why this order, and why it is a library entry
  *
  * `patterns` wrote it first (2026-09-19) because the owner required the rollback to be ONE
- * command — a launchd invocation nobody runs monthly and a route id nobody has memorised are not
+ * command — a launchd invocation nobody runs monthly and a route id nobody has memorized are not
  * cheap at the moment somebody needs them — and `collections`, `vault` and `music` copied it.
  * Deleting the route while nothing listens on the Mac points the household's hostname at a dead
  * box; so this starts the origin, WAITS for it to answer, and refuses to touch the route if it
@@ -184,7 +184,7 @@ export async function runWorkerRollback(spec: WorkerRollbackSpec, argv: readonly
 	const found = await findWorkerRoute(spec.api, host);
 	log(`route   ${found.pattern} → ${found.route ? `${found.script} (${found.route})` : "(none — the hostname already falls through to the Mac)"}`);
 
-	log("\n▸ what D1 holds against the Mac's frozen catalogue (the writes a rollback loses):");
+	log("\n▸ what D1 holds against the Mac's frozen catalog (the writes a rollback loses):");
 	bun(["run", "scripts/worker-import.ts", "--verify-only"], spec.root);
 
 	if (argv.includes("--check")) {

package/src/workerSecrets.ts

@@ -30,7 +30,7 @@
  * never noticed an extra — the drift this module ends.
  *
  * 🔴 **A value that is already single-quoted is written as is.** {@link envFileLines}:
- * `collections`' seed serialiser returns `'{"kdf":…}'`, quoting it again wrote an escaped pair
+ * `collections`' seed serializer returns `'{"kdf":…}'`, quoting it again wrote an escaped pair
  * around it, `readEnvFile` stripped one layer, and the stage's master lock came up asking to
  * ENROLL a new password (found 2026-09-22 by the stage walk, one step past sign-in).
  */