From 8d75ff7ffa1a101726c33196263fe25e45334fcf Mon Sep 17 00:00:00 2001
From: Dmitrii Vasilev <admin@t27.ai>
Date: Sun, 9 Aug 2026 20:06:10 +0700
Subject: [PATCH] queen(gHashTag/trios#1239): The watcher catches the moment
 correctly - it printed that QueenObserver.swift was 9263 bytes - but instead
 of naming a culprit it dumps the entire system process table, sixty-two
 kilobytes of noise in which every browser helper on the machine appears. That
 is not evidence, it is a haystack. Narrow it: report the processes that
 actually hold the file or the repository open, using lsof on the path and on
 the repository directory, and fall back to naming only processes whose
 working directory is inside the repository. Keep the timestamp, the path and
 the previous size as they are. Read only the watch-empties target. Do not add
 an assert. Make the edit with Edit, then verify once

---
 trios/Makefile | 34 +++++++++++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/trios/Makefile b/trios/Makefile
index a6a82be769..8ce604c95e 100644
--- a/trios/Makefile
+++ b/trios/Makefile
@@ -19,7 +19,7 @@ DEV_APP     := $(ROOT)/trios-dev.app
 RELEASE_APP := $(ROOT)/trios.app
 
 .DEFAULT_GOAL := dev
-.PHONY: help dev release build keychain-doors make-dollars empty-sources check test cassettes e2e run run-release stop clean promote doctor chat-probe verify restart xctest delegate-probe drift-guard
+.PHONY: help dev release build keychain-doors make-dollars empty-sources watch-empties check test cassettes e2e run run-release stop clean promote doctor chat-probe verify restart xctest delegate-probe drift-guard
 
 help:
 	@echo "TriOS targets:"
@@ -229,6 +229,38 @@ empty-sources:
 		echo "[OK] no empty Swift source files under rings or BR-OUTPUT"; \
 	fi
 
+# --- Watch for empty sources --------------------------------------------
+#
+# Samples the byte size of every tracked Swift file under rings/ and BR-OUTPUT/
+# once a second.  When a file drops to zero, prints the timestamp, the path,
+# the previous size, and processes holding the file or repository open (lsof).
+# Read-only: never writes to the tree, so Ctrl+C leaves nothing behind.
+.PHONY: watch-empties
+watch-empties:
+	@files=$$(git -C "$(ROOT)" ls-files -- 'rings/' 'BR-OUTPUT/' \
+		| grep '\.swift$$'); \
+	i=0; \
+	while IFS= read -r f; do \
+		names[$$i]=$$f; \
+		i=$$((i+1)); \
+	done <<< "$$files"; \
+	count=$$i; \
+	while true; do \
+		for ((i=0; i<$$count; i++)); do \
+			now=$$(stat -f%z "$(ROOT)/$${names[$$i]}" 2>/dev/null || echo 0); \
+			if [ -n "$${sizes[$$i]}" ] && [ "$$now" = "0" ] \
+			   && [ "$${sizes[$$i]}" != "0" ]; then \
+				procs=$$( lsof "$(ROOT)/$${names[$$i]}" "$(ROOT)" 2>/dev/null | awk 'NR>1{print $$1}' | sort -u | tr '\n' ' ' ); \
+				if [ -z "$$procs" ]; then \
+					procs=$$( lsof -a -d cwd 2>/dev/null | grep -F "$(ROOT)/" | awk '{print $$1}' | sort -u | tr '\n' ' ' ); \
+				fi; \
+				echo "$$(date '+%Y-%m-%d %H:%M:%S') $${names[$$i]} was $${sizes[$$i]} bytes; processes: $$procs"; \
+			fi; \
+			sizes[$$i]=$$now; \
+		done; \
+		sleep 1; \
+	done
+
 check: check-selftest keychain-doors make-dollars empty-sources dev test cassettes
 
 # Replay every cassette and assert the expected signal appears in the log.