--converge is the CLI big red button: bring the rig to ready, then let the existing
checks prove it. Scope is SERVICES, not apps — it starts systemd units it owns and
REPORTS Pulsar/Ardour with the command instead of launching them, because a script
that opens windows under someone is a script they stop trusting (and Ardour has a
session + crash-recovery dialog, #20). Launching apps belongs to the Bridge (#116).

Safe at any moment: every action is conditional on the thing being broken, so a
healthy rig converges to a no-op — verified, scsynth PID unchanged. It handles the
exact 2026-08-01 failure explicitly: unit ACTIVE but audio server DEAD needs a
RESTART, since `start` is a no-op on an active unit. Distinguishing those two is the
whole lesson. Preload is fixed BEFORE SuperDirt boots, or the warm would not happen
until the next restart. And it waits for scsynth to appear rather than guessing —
guessing is what made the first watchdog flap.

=== THE THIRD TIME, AND THIS TIME IT WAS US ===

gig-up's first run (1219c704) found check-boot.sh and check-tracks.sh at mode 644 —
never runnable as `tools/check-tracks.sh`. That fix turned out to be FAKE: the chmod
only ever touched the working tree. Git has recorded 100644 for both from that day to
this, so every fresh clone still got a broken pre-gig gate.

And gig-up.sh had the same bug, from birth. Committed 100644 by 1219c704 and again by
6ab09eaa. It ran only because the local working tree happened to carry the bit; a
`git checkout master` materialised it at 644 and it died with "permission denied".

That failure was nearly invisible, which is the real story: the caller filtered its
output through sed, so a run that never executed LOOKED like a clean no-op, and I
reported "no-op confirmed" about a script that had not run. A false green produced by
the absence of a program.

So the gate now checks its own hands — "tools executable", HARD, verifying BOTH the
on-disk bit and what git records. It found four real problems on its first run:
    disk=x  git=100644  check-boot.sh          <- day-one "fix" never committed
    disk=x  git=100644  check-tracks.sh        <- same
    disk=-  git=100644  sc-watchdog.sh         <- not executable AT ALL
    disk=-  git=100644  tests/test-sc-watchdog.sh
The third is the one that matters: parvagues-sc-watchdog.service had been ENABLED AT
BOOT with an ExecStart it could not execute. It was stuck `activating`, restart-
looping silently. The supervisor I added to catch silent failure was itself failing
silently, and nothing would have said so until an audio server died at a venue and
did not come back. All six now 100755 on disk and in the index; watchdog restarted
and confirmed logging.

Same family as the day-one finding: a thing verified once, in a context that no
longer holds. The new twist is that "chmod +x" is not a fix — recording it in git is.

Also honest-ing the recovery toast (#122). PLN reported needing a ctrl+enter in
Pulsar to resume after a recovery. Likely ICMP port-unreachable poisoning Tidal's
connected UDP socket (ECONNREFUSED on next send, stream stops until re-evaluated).
Until #122 tests it, the toast says "if the music does not resume on its own,
ctrl+enter in Pulsar" rather than claiming a full recovery — a rig that is alive and
silent is indistinguishable on stage from the original fault.

Validation: 16/16 green on the live rig (9 cold + 7 live). Converge no-op verified on
a healthy rig; converge ACTION verified by stopping the watchdog and watching it come
back, with scsynth untouched throughout.