feat(ten-lane-highway): ship lane_teardown.sh, the recovery path the skill only named (giwq)

amplifier_app_cli/data/skills/ten-lane-highway/SKILL.md

@@ -90,6 +90,7 @@ repo** (a real run left `.amplifier/bin/` behind as untracked pollution).
 | `verify_lane.sh BATCH_DIR LANE` | Git-facts probe for one landed lane (DONE.json, ahead-count, three-dot diffstat, uncommitted work) | "Ground truth from git and the filesystem, not from what any session said about itself" |
 | `highway_watchdog.sh BATCH_DIR WIDTH SESSION_ID [INTERVAL] [MAX_HOURS]` | Detached tmux loop that re-wakes THIS session (`amplifier run --resume`) on lane-end / under-width / stale heartbeat | The highway once froze overnight because the manager stopped monitoring the moment it reported status |
 | `infra_ledger.sh BATCH_DIR add TYPE ID DESTROY_CMD...` / `infra_ledger.sh BATCH_DIR sweep --all-owners` | Records any infrastructure a lane OR the manager stands up (DTU, gitea instance, container, service, background process) into `infra.tsv` at creation, each with its teardown command; `sweep` runs those commands and exits non-zero until nothing is left standing | A run closed with a DTU and a gitea container still live — nothing the highway stands up should outlive it (Rule 14) |
+| `lane_teardown.sh BATCH_DIR LANE claim ID...` / `lane_teardown.sh BATCH_DIR LANE teardown\|reconcile\|list\|audit` | **A LANE's** teardown: destroys only the rows that lane claimed, verifies each container is actually gone before flipping its row, and never runs another lane's destroy command. Dry-run by default; `--yes` to act | The emergency recovery path used to live in another repo, untracked — the skill named a tool it did not ship, and an operator mid-incident followed that path to nothing |
 
 **`sweep` is the MANAGER's batch-close verb, never a lane's.** It runs EVERY
 open row's destroy command, so one lane calling it destroys every other lane's
@@ -98,10 +99,16 @@ live infrastructure — that is not hypothetical: on 2026-09-02 a single foreign
 measurements. The script now **refuses with exit 3, having run nothing**, when
 the open rows span more than one owner or any row is unattributable, so:
 
-- **A lane tearing down its OWN rows uses the batch's lane-scoped teardown
-  tool** (`lane_teardown.sh BATCH_DIR <lane> teardown --yes`; omit `--yes` for a
-  dry run), which touches only the rows that lane claimed. A lane never calls
-  `sweep`.
+- **A lane tearing down its OWN rows uses the lane-scoped teardown tool that
+  ships with this skill** —
+  `<skill_directory>/scripts/lane_teardown.sh BATCH_DIR <lane> teardown --yes`;
+  omit `--yes` for a dry run — which touches only the rows that lane claimed. A
+  lane never calls `sweep`. A lane name that ALMOST matches the claimed owner
+  **exits 4 naming the candidate owners and their open-row counts**, rather than
+  reporting success for a teardown that would do nothing: on 2026-09-05
+  `lane_teardown.sh <batch> drbf teardown --yes` printed *"lane 'drbf' owns no
+  open rows — nothing to do"* and exited 0 while six rows were open under
+  `drbf-compaction-notice-ab`.
 - **The manager closing the batch passes `--all-owners`** — the deliberate
   batch-close override. Every close instruction below says
   `sweep --all-owners` for exactly this reason: a guard that deadlocks the
@@ -120,7 +127,8 @@ open rows; the ledger recorded all six correctly and the status report showed
 the lanes ENDED, but **nothing joined the two**, so the manager found the
 containers only by running `incus list` by hand. A non-zero `orphan_rows` means
 infrastructure with nothing driving it (Rule 14) — reclaim each named lane with
-`lane_teardown.sh BATCH_DIR <lane> teardown --yes`. The report **destroys
+`<skill_directory>/scripts/lane_teardown.sh BATCH_DIR <lane> teardown --yes`
+(the report prints that path resolved, ready to paste). The report **destroys
 nothing**: a false positive that prints is a nuisance, a false positive that
 destroys is another 0rg. A **live** lane's rows are never counted. Owners are
 matched by exact lane name, else by a unique lane-name prefix (so a row claimed

amplifier_app_cli/data/skills/ten-lane-highway/scripts/highway_status.sh

@@ -204,5 +204,8 @@ if [ "$orphan_rows" -gt 0 ]; then
   echo "WARNING: orphan_rows=$orphan_rows owned by: $orphan_owners"
   echo "  Open infra-ledger rows whose owning lane is NOT live - infrastructure"
   echo "  with nothing driving it (Rule 14). Nothing was destroyed; reclaim each"
-  echo "  with: lane_teardown.sh $BATCH_DIR <lane> teardown --yes"
+  # Resolved from THIS file so the printed command is copy-pasteable. It used
+  # to be a bare name that is on no PATH, and before item model_performance-giwq
+  # the tool was not even shipped with this skill (item kez's sibling defect).
+  echo "  with: $(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lane_teardown.sh $BATCH_DIR <lane> teardown --yes"
 fi

amplifier_app_cli/data/skills/ten-lane-highway/scripts/infra_ledger.sh

@@ -23,7 +23,8 @@
 #   sweep  THE MANAGER'S BATCH-CLOSE VERB, NEVER A LANE'S. It runs EVERY open
 #          row's destroy_cmd, so a lane calling it destroys other lanes' live
 #          infrastructure. A lane tearing down its OWN rows uses the batch's
-#          lane-scoped teardown tool (lane_teardown.sh) instead.
+#          lane-scoped teardown tool instead: `lane_teardown.sh`, the SIBLING
+#          of this script in <skill_directory>/scripts/.
 #          Refuses with exit 3, having run NOTHING, when the open rows span
 #          more than one owner or any row is unattributable; the manager
 #          closing the batch passes --all-owners to proceed anyway.
@@ -43,6 +44,14 @@ BATCH_DIR=${1:?BATCH_DIR required}
 CMD=${2:?command required (add|list|sweep)}
 LEDGER="$BATCH_DIR/infra.tsv"
 
+# The lane-scoped teardown tool this script's refusal sends operators to. It is
+# a SIBLING in this same scripts/ directory, resolved from this file rather than
+# spelled as a literal (item model_performance-giwq): the refusal used to name
+# `.amplifier/evaluation/tools/lane_teardown.sh` — a path in a DIFFERENT repo,
+# where the file was untracked. An operator hitting the refusal mid-incident
+# followed that path to nothing.
+LANE_TEARDOWN="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lane_teardown.sh"
+
 # Signatures meaning "the thing you asked me to destroy does not exist".
 # Deliberately NARROW: a blanket exit-code amnesty would destroy the signal
 # that a REAL teardown failed, which is the whole reason sweep checks rc
@@ -80,7 +89,7 @@ case "$CMD" in
     # infrastructure. Observed 2026-09-02: one foreign sweep took lane l1's
     # three DTUs and lane 161's three, 35 minutes into their measurements.
     # A lane tearing down its OWN rows uses the lane-scoped tool:
-    #   .amplifier/evaluation/tools/lane_teardown.sh BATCH_DIR LANE teardown
+    #   <skill_directory>/scripts/lane_teardown.sh BATCH_DIR LANE teardown
     ALL_OWNERS=0
     for a in "$@"; do [ "$a" = "--all-owners" ] && ALL_OWNERS=1; done
     if [ "$ALL_OWNERS" != 1 ]; then
@@ -96,7 +105,7 @@ case "$CMD" in
         echo "" >&2
         echo "sweep is the MANAGER's batch-close verb and destroys EVERY open row." >&2
         echo "A lane tearing down its OWN rows must use the lane-scoped tool:" >&2
-        echo "  .amplifier/evaluation/tools/lane_teardown.sh $BATCH_DIR <lane> teardown --yes" >&2
+        echo "  $LANE_TEARDOWN $BATCH_DIR <lane> teardown --yes" >&2
         echo "The manager closing the batch passes --all-owners." >&2
         exit 3
       fi