filipeforattini · Sep 30, 2026 · Sep 30, 2026
diff --git a/.red/code/plans/2026-09-26-backend-libcall-parity.md b/.red/code/plans/2026-09-26-backend-libcall-parity.md
@@ -82,7 +82,7 @@ Concluído quando parent e child distinguirem ausência de IPC de canal desconec
 2. Rodar `pnpm manifest` quando as tabelas de decisão do compiler mudarem e então `pnpm node-compat`; inspecionar o ledger interno, o artefato público e o backlog por mudanças não relacionadas.
 3. Adicionar ou completar corpus diferencial por família. Cobrir sucesso, shapes importantes de erro, callback único, ordem/lifecycle, stdout, stderr e exit code. IPC precisa de fixtures parent/worker e crypto aleatório precisa testar invariantes, não bytes específicos.
 4. Rodar testes focados por família sob `pnpm limit`, depois `cargo test` e `cargo clippy -- -D warnings` no runtime Rust, `pnpm node-compat:check`, build do workspace e gate de docs se artefatos públicos mudarem.
-5. Rodar `pnpm test:sandbox`. Se credenciais Sandbox não existirem, rodar as lanes locais plain e sanitizada prescritas em `AGENTS.md`. Registrar separadamente qualquer limitação real do host para LLVM 22; não classificar ausência de toolchain como regressão de código.
+5. Rodar as lanes locais plain e sanitizada prescritas em `AGENTS.md`, que são o gate completo deste fork. Registrar separadamente qualquer limitação real do host para LLVM 22; não classificar ausência de toolchain como regressão de código.
 
 Concluído quando o gerador não tiver órfãs, as 52 chamadas tiverem lowering Rust, o diff da implementação permanecer fora das lanes C/LLVM, os artefatos gerados estiverem limpos, o runtime Rust continuar sem `unsafe`, todos os gates disponíveis estiverem verdes e `git status` estiver limpo.
 

diff --git a/.red/code/plans/2026-09-30-estado-e-proximos-passos.md b/.red/code/plans/2026-09-30-estado-e-proximos-passos.md
@@ -35,7 +35,7 @@ Aberto: a Onda 6 do plano de libcall parity nunca rodou. Os critérios de regene
 
 1. Zerar os 23 erros de clippy. Enquanto o gate declarado do runtime está vermelho, nenhum outro sinal é confiável.
 2. Executar a Onda 6: corpus diferencial das 52 libcalls, uma família por commit. IPC precisa de fixtures parent e worker; aleatoriedade de crypto testa invariantes e não bytes específicos; toda callback precisa de prova de disparo único. O objetivo declarado é encontrar bugs nas implementações, não apenas produzir verde.
-3. Rodar `pnpm test:sandbox`, que agora existe e conclui em cerca de quatro minutos. Ele substitui as lanes locais de várias horas que sofriam com OOM e contenção nesta máquina.
+3. Rodar o gate completo, que são as duas lanes locais plain e sanitizada. O harness de Vercel Sandbox foi removido do fork em 30/09 por não haver credenciais nem intenção de usá-lo; as lanes locais são o único gate completo. Elas são longas nesta máquina, então isole `TMPDIR` e `SCRIPTC_CACHE_DIR` e não as rode sob `pnpm limit`.
 4. Retomar o dogfooding nos alvos restantes, `red-dev` e `red-skills`, agora que redcode compila.
 
 ## Pegadinhas operacionais desta máquina

diff --git a/AGENTS.md b/AGENTS.md
@@ -9,36 +9,14 @@ Write prose paragraphs and list items as single source lines and let editors and
 ## Build and test
 
 ```bash
-pnpm install && pnpm -r build   # build the workspace
-pnpm test:sandbox              # full gate: ~4m custom image, ~9m cold managed fallback
+pnpm install && pnpm -r build                    # build the workspace
+SCRIPTC_TEST_WORKERS=4 pnpm test                 # full gate: plain lane
+SCRIPTC_TEST_WORKERS=4 SCRIPTC_SAN=1 pnpm test   # full gate: sanitized lane
 ```
 
 The ordinary workspace build does not rebuild packaged native artifacts. When changing native assembly/object emission or runtime-pack selection, install CMake, Ninja, the pinned LLVM 22 development package, and Zig 0.16.0, then run the matching `@scriptc/llvm-<platform>` and `@scriptc/runtime-<platform>` `build:native` scripts explicitly. The macOS full test suite also needs its generated artifacts.
 
-Use focused local tests while iterating, then use `pnpm test:sandbox` whenever a
-full validation gate is required. It loads Sandbox configuration from the
-shell and `.env.local`, runs portable coverage across disposable Linux
-Sandboxes, and retains the Darwin-native contracts on macOS. Linux hosts run
-their supported native-clang contracts locally; other hosts retain those
-checks in the Sandboxes. Both lanes green is the bar before shipping any
-change.
-
-`VERCEL_OIDC_TOKEN` is the preferred credential. `VERCEL_TOKEN` remains
-supported with explicit `VERCEL_TEAM_ID` and `VERCEL_PROJECT_ID`. The custom
-`SCRIPTC_SANDBOX_IMAGE` is optional: without it, the gate starts from
-`vercel/sandbox/universal` and installs the repository-pinned Node, pnpm, and
-LLVM toolchain plus workspace dependencies before building. Team/project
-selection never comes from the image reference. The legacy VCR image command
-uses `VERCEL_TOKEN` or the existing Vercel CLI login for authentication; OIDC
-claims can still provide its team/project scope.
-
-Only when Vercel Sandbox credentials are unavailable, run the slower local
-fallback:
-
-```bash
-SCRIPTC_TEST_WORKERS=4 pnpm test                 # plain lane
-SCRIPTC_TEST_WORKERS=4 SCRIPTC_SAN=1 pnpm test  # sanitized lane
-```
+Use focused local tests while iterating, then run both full lanes locally before shipping. Both lanes green is the bar before shipping any change. Linux hosts run their supported native-clang contracts locally, and macOS retains the Darwin-native contracts.
 
 `SCRIPTC_TEST_WORKERS` caps the vitest worker pool so concurrent agents don't
 contend for cores. Direct local runs default to two workers, two nested native

diff --git a/Dockerfile.sandbox b/Dockerfile.sandbox
diff --git a/README.md b/README.md
@@ -202,8 +202,7 @@ not a claim established by the default selection.
 
 ```console
 $ pnpm install && pnpm -r build
-$ vercel link && vercel env pull  # writes a project-scoped VERCEL_OIDC_TOKEN
-$ pnpm test:sandbox
+$ SCRIPTC_TEST_WORKERS=4 pnpm test
 ```
 
 The normal workspace build needs no local LLVM installation. To rebuild a
@@ -212,22 +211,9 @@ development package on that target host, then run the matching
 `@scriptc/llvm-<platform>` and `@scriptc/runtime-<platform>` `build:native`
 scripts. The macOS full test suite also uses those generated artifacts.
 
-`pnpm test:sandbox` loads `.env.local`, preflights Vercel authentication and
-project access, and uses the managed `vercel/sandbox/universal` image by
-default. It installs the repository-pinned Node, pnpm, and LLVM toolchain plus
-ScriptC dependencies in each disposable Sandbox before building the uploaded
-worktree. Set
-`SCRIPTC_SANDBOX_IMAGE` to a fully qualified VCR reference only to use the
-optional prebuilt image from `pnpm test:sandbox:image`.
-The prebuilt image keeps the roughly four-minute fast path; cold managed-image
-runs take longer because they install the pinned toolchain in each Sandbox.
-
-`VERCEL_OIDC_TOKEN` is preferred. For access-token authentication, set
-`VERCEL_TOKEN`, `VERCEL_TEAM_ID`, and `VERCEL_PROJECT_ID`; team and project are
-never inferred from `SCRIPTC_SANDBOX_IMAGE`. The legacy VCR command used by
-`pnpm test:sandbox:image` cannot authenticate with an OIDC JWT, so image builds
-use `VERCEL_TOKEN` when available or the existing Vercel CLI login; OIDC claims
-still select the VCR team and project. The test corpus runs each program
-under Node and as a compiled native binary, then compares stdout, stderr, and
-exit codes byte for byte. The full gate also runs the corpus with
-AddressSanitizer and the runtime reference-count audit.
+The full gate is the two local lanes. `SCRIPTC_TEST_WORKERS` caps the vitest
+worker pool so concurrent runs do not contend for cores. The test corpus runs
+each program under Node and as a compiled native binary, then compares stdout,
+stderr, and exit codes byte for byte. The sanitized lane
+(`SCRIPTC_SAN=1 pnpm test`) runs the same corpus with AddressSanitizer and the
+runtime reference-count audit.
diff --git a/package.json b/package.json
@@ -21,8 +21,6 @@
     "inventory:node": "node scripts/node-surface-inventory.mjs",
     "inventory:node:check": "node scripts/node-surface-inventory.mjs --check --offline",
     "test:cache-identity": "node tests/harness/cache-identity.mjs",
-    "test:sandbox": "node scripts/sandbox-test.mjs",
-    "test:sandbox:image": "node scripts/sandbox-image.mjs",
     "test:watch": "vitest",
     "limit": "node scripts/run-resource-limited.mjs",
     "lint": "node scripts/check-rust-file-lines.mjs && node scripts/gen-island-bootstrap.mjs --check && tsx scripts/gen-backend-libcalls.mjs --check && eslint packages/compiler/src packages/cli/src",

diff --git a/scripts/sandbox-bootstrap.sh b/scripts/sandbox-bootstrap.sh
diff --git a/scripts/sandbox-command.mjs b/scripts/sandbox-command.mjs