hecks 6.0.0 → 7.0.0

data/lib/hecks/quality_control/cli/qa_generated_domains/promotion.rb

@@ -49,7 +49,7 @@ module Hecks
           puts "promoted: qa/stress_domains/#{name}"
           puts "next:"
           puts "  hecks quality_control judge_novelty qa/stress_domains/#{name}"
-          puts "  hecks project_rust qa/stress_domains/#{name}  # when the finding needs the Rust comparison"
+          puts "  hecks build.project_rust! qa/stress_domains/#{name}  # when the finding needs the Rust comparison"
           # `hecks quality_control target.seed` derives targets from
           # `Hecks::Corpus.rotation_targets`, so a hand-typed `target.identify` line is not printed:
           # nobody ran it and the domain never
@@ -67,7 +67,7 @@ module Hecks
           <<~NOTES
             # #{name}
 
-            Promoted from a `hecks quality_control check_generated_domains` finding — #{origin_phrase(recorded)}, not
+            Promoted from a `hecks quality_control query target.check_generated_domains` finding — #{origin_phrase(recorded)}, not
             hand-written. The bluebook is the minimal form of the domain that
             surprised; `QaGenerated` was renamed to `#{camelize(name)}` and nothing
             else changed.
@@ -102,7 +102,7 @@ module Hecks
         end
 
         def origin_phrase(recorded)
-          recorded&.key?("source") ? "written by `hecks quality_control mine_combinations`' agent" : "generated"
+          recorded&.key?("source") ? "written by `hecks quality_control query target.mine_combinations`' agent" : "generated"
         end
       end
     end

data/lib/hecks/quality_control/cli/qa_main_gate/gate_run.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require "hecks/tools/gate"
+
+module Hecks
+  module QualityControlCli
+    class QaMainGate
+      # Runs the quick gate's checks in a directory, all at once, and says which passed. The checks are
+      # the `GateStage` rows of the Vocabulary bluebook, so a red check is reported with the output it
+      # printed, the same way `hecks gate_run.gate! stage=quick` reports one.
+      module GateRun
+        # One check of the quick gate after it ran.
+        #
+        # @!attribute [r] id
+        #   @return [String] the check's name in the Vocabulary bluebook, such as `rubocop`
+        # @!attribute [r] title
+        #   @return [String] what the check is
+        # @!attribute [r] output
+        #   @return [String] everything the check printed
+        # @!attribute [r] passed
+        #   @return [Boolean] whether it exited 0
+        Result = Struct.new(:id, :title, :output, :passed)
+
+        # Stands in for the gate's progress lines, which go to standard error of a person's terminal.
+        class Quiet
+          # @return [nil]
+          def start(_id) = nil
+
+          # @return [nil]
+          def finish(*) = nil
+        end
+
+        module_function
+
+        # @param dir [String] the checkout the checks run in
+        # @return [Array<Result>] every quick-gate check, in the stage's order
+        def run(dir)
+          stage = Hecks::Tools::Gate.stages.fetch("quick")
+          checks = stage.fetch("checks")
+          answers = Hecks::Tools::Gate.run_all(stage, checks, dir, Quiet.new)
+          checks.map { |check| result(check, answers.fetch(check.fetch("id"))) }
+        end
+
+        # @return [Result]
+        def result(check, answer)
+          output, passed = answer
+          Result.new(check.fetch("id"), check.fetch("title"), output, passed)
+        end
+      end
+    end
+  end
+end

data/lib/hecks/quality_control/cli/qa_main_gate/logging.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module Hecks
+  module QualityControlCli
+    class QaMainGate
+      # Turns one red check into one QA bug, proven by the check's own output, and triages it. A check the
+      # command can fix mechanically is `self_contained`; every other is `bigger`, for the owner.
+      module Logging
+        # Checks with a mechanical fixer. `rubocop -a` fixes style offenses it can fix; metrics and the
+        # rest need a person.
+        SELF_CONTAINED = %w[rubocop].freeze
+        SUBMITTER = "qa_main_gate"
+        NAME_PREFIX = "main-red-"
+
+        # A bug already open for the same check is not logged again: the commit moved, the red did not.
+        # @return [Array(String, String, Boolean)] the reference, its disposition, and whether it was new
+        def log_red(sweep, result, sha)
+          open = open_bug_named(bug_name(result.id))
+          return [open, disposition(result.id), false] if open
+
+          bug = log(sweep, result, sha)
+          bug.triage!(disposition: { value: disposition(result.id) })
+          [bug.reference.value, disposition(result.id), true]
+        end
+
+        # @return [String] `main-red-<check>`, the name `QaFixMainBug` reads the check back from
+        def bug_name(check_id)
+          "#{NAME_PREFIX}#{check_id.tr("_", "-")}"
+        end
+
+        # @return [String] the bug's disposition as its triage writes it
+        def disposition(check_id)
+          SELF_CONTAINED.include?(check_id) ? "self_contained" : "bigger"
+        end
+
+        private
+
+        def log(sweep, result, sha)
+          sequence, reference = next_bug_reference
+          ::QualityControl::Bug.log!(
+            sweep: sweep.id, reference: { value: reference }, sequence: { value: sequence },
+            title: { value: "main is red: #{result.title}" }, name: { value: bug_name(result.id) },
+            demonstration: { value: demonstration_text(result) },
+            symptom: { value: "the quick gate's #{result.title} exits non-zero on main at #{sha[0, 7]}" },
+            expectation: { value: "the quick gate's #{result.title} exits 0 on main" },
+            submitter: { value: SUBMITTER }, tags: [{ value: "main-gate" }]
+          )
+        end
+
+        # @return [String] what the check printed, or a stand-in when it printed nothing
+        def demonstration_text(result)
+          text = result.output.to_s.strip
+          text.empty? ? "(no output)" : text
+        end
+
+        def open_bug_named(name)
+          row = @runtime.query("QualityControl::Bug.Open").find { |bug| bug[:name]&.[](:value) == name }
+          row && row[:reference][:value]
+        end
+
+        # @return [Array(Integer, String)] the next sequence and reference, after every logged bug
+        def next_bug_reference
+          rows = @runtime.query("QualityControl::Bug.All")
+          sequence = rows.map { |row| row[:sequence][:value] }.max.to_i + 1
+          [sequence, "BUG##{sequence}"]
+        end
+      end
+    end
+  end
+end

data/lib/hecks/quality_control/cli/qa_main_gate/shell.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "open3"
+
+module Hecks
+  module QualityControlCli
+    class QaMainGate
+      # The commands outside the ledger that a red-main fix runs: the mechanical fixer, the landing, and the
+      # push through the push train. Each answers its output and whether it exited 0.
+      module Shell
+        # The push train's own launcher, in its detached checkout.
+        TRAIN_LAUNCHER = File.expand_path("~/.claude/hecks-train/exe/hecks")
+
+        module_function
+
+        # Applies `rubocop -a` to the files, which fixes what it can; whether the rest is fixed is the gate's
+        # to say.
+        #
+        # @return [Array(String, Boolean)]
+        def rubocop(dir, files)
+          run("bundle", "exec", "rubocop", "-a", *files, chdir: dir)
+        end
+
+        # Lands a branch on local main, through the launcher of the checkout.
+        #
+        # @return [Array(String, Boolean)]
+        def land(root, branch)
+          run(File.join(root, "exe/hecks"), "landing.land!", "checkout.value=#{root}", "branch.value=#{branch}",
+              "--confirm", "--wait", chdir: root)
+        end
+
+        # Pushes main through the push train.
+        #
+        # @return [Array(String, Boolean)]
+        def push(root)
+          run(TRAIN_LAUNCHER, "SendTrain.board!", "checkout=#{root}", "remote=origin", "branch=main",
+              "--confirm", "--wait", chdir: root)
+        end
+
+        def run(*argv, chdir:)
+          output, status = Open3.capture2e(*argv, chdir: chdir)
+          [output, status.success?]
+        end
+      end
+    end
+  end
+end

data/lib/hecks/quality_control/cli/qa_main_gate/sweeping.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Hecks
+  module QualityControlCli
+    class QaMainGate
+      # The sweep a red run of the gate on main is written as. Main is not a bluebook, so the sweep runs
+      # against one standing target, `main-gate`, that is shelved: the rotation never claims it. Each gate
+      # check is one `Check`, its expectation written before the answer is read.
+      module Sweeping
+        TARGET = "main-gate"
+        ENGINEER = "qa_main_gate"
+
+        private
+
+        # @return [void] opens the target if no run has yet
+        def standing_target
+          return if ::QualityControl::Target.find(TARGET)
+
+          target = ::QualityControl::Target.identify!(reference: { value: TARGET }, path: { value: @root })
+          target.shelve!(reason: { value: "the quick gate on main is not a bluebook; this target only holds its sweeps" })
+        end
+
+        # @return [Object] the sweep of this commit's red run, concluded once every check is written
+        def record_sweep(sha, results)
+          standing_target
+          sweep = ::QualityControl::Sweep.open!(target: TARGET, reference: { value: "MAIN-#{sha[0, 12]}" },
+                                                engineer: { value: ENGINEER })
+          results.each { |result| record_check(sweep, result, sha) }
+          sweep.conclude!(notes: { value: "the quick gate on main at #{sha[0, 7]}: #{results.count { |r| !r.passed }} red" })
+          sweep
+        end
+
+        def record_check(sweep, result, sha)
+          sweep.check!(subject:     { value: "gate:#{result.id}" },
+                       expectation: { value: "#{result.title} exits 0 on main at #{sha[0, 7]}" })
+          sequence = ::QualityControl::Sweep.find(sweep.id).made.value
+          settle(sweep, sequence, result)
+        end
+
+        def settle(sweep, sequence, result)
+          if result.passed
+            dispatch("QualityControl::Sweep.Check.Held", id: sweep.id, sequence: { value: sequence },
+                                                          observation: { value: "exit 0" })
+          else
+            # Not `Check.Surprised`: its `SuspendOnSurprise` policy can only suspend a held target, and this
+            # one is shelved, so the policy would be refused on every red run. The red is carried by the
+            # `MainCheck` record and the bugs logged from the output.
+            dispatch("QualityControl::Sweep.Check.Unsettled", id: sweep.id, sequence: { value: sequence },
+                                                               observation: { value: result.output })
+          end
+        end
+
+        def dispatch(name, **args)
+          @runtime.dispatch_flat(name, args)
+        end
+      end
+    end
+  end
+end

data/lib/hecks/quality_control/cli/qa_main_gate/worktree.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "open3"
+require "tmpdir"
+
+module Hecks
+  module QualityControlCli
+    class QaMainGate
+      # A temporary git worktree, made for one block and removed when it returns, so a gate or a fix never
+      # runs in the owner's checkout.
+      module Worktree
+        # Raised when a git command the worktree needs fails.
+        class Failed < StandardError; end
+
+        module_function
+
+        # @param root [String] the repository the worktree belongs to
+        # @param ref [String] the commit the worktree starts at
+        # @param branch [String, nil] a new branch checked out in it; nil leaves HEAD detached
+        # @yieldparam dir [String] the worktree's directory
+        # @return [Object] whatever the block returns
+        def with(root:, ref:, branch: nil)
+          dir = Dir.mktmpdir("hecks-qa-worktree-")
+          git!(root, "worktree", "add", *(branch ? ["-b", branch] : ["--detach"]), dir, ref)
+          yield dir
+        ensure
+          remove(root, dir) if dir
+        end
+
+        # @return [String] the output of one git command, stripped
+        # @raise [Failed] when git exits non-zero
+        def git!(root, *argv)
+          output, status = Open3.capture2e("git", "-C", root, *argv)
+          raise Failed, "git #{argv.join(" ")} failed: #{output.strip}" unless status.success?
+
+          output.strip
+        end
+
+        # @return [Boolean] whether git exited 0
+        def git?(root, *argv)
+          _, status = Open3.capture2e("git", "-C", root, *argv)
+          status.success?
+        end
+
+        # Removes a worktree and its directory. Nothing is answered: a removal that fails leaves the
+        # directory for `git worktree prune` to report.
+        def remove(root, dir)
+          try(root, "worktree", "remove", "--force", dir)
+          try(root, "worktree", "prune")
+          FileUtils.rm_rf(dir)
+        end
+
+        # Runs one git command and answers nothing, for the commands whose failure is not a refusal.
+        def try(root, *argv)
+          Open3.capture2e("git", "-C", root, *argv)
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/hecks/quality_control/cli/qa_main_gate.rb

@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+require "open3"
+require_relative "../../../hecks"
+# The era subsystem does not load with core (ADR 0033); the QualityControl ledger binds it.
+require_relative "../../ports/persistence/plugins/era"
+require_relative "qa_main_gate/gate_run"
+require_relative "qa_main_gate/worktree"
+require_relative "qa_main_gate/shell"
+require_relative "qa_main_gate/sweeping"
+require_relative "qa_main_gate/logging"
+require_relative "qa_fix_main_bug"
+
+module Hecks
+  module QualityControlCli
+    # The command behind `hecks quality_control main_check.check_main`, the tick's main step. It runs
+    # the quick gate on local main in a temporary worktree, records the verdict against the commit, and
+    # for each red check logs one bug proven by its output. A self-contained bug is handed to
+    # `QaFixMainBug`. A commit already on record is answered from the record, so a tick that finds it again
+    # logs nothing twice.
+    #
+    # Exit 0 when main is green, 2 when a check is red (the bugs are on the ledger), 1 on an operational
+    # error. `QA_SWEEP_DOMAIN_DIR` picks the ledger, as for the other QA commands.
+    class QaMainGate
+      include Sweeping
+      include Logging
+
+      EXIT_OK = 0
+      EXIT_ERROR = 1
+      EXIT_FOUND_SOMETHING = 2
+
+      USAGE = "usage: hecks quality_control main_check.check_main"
+
+      # Runs the step.
+      #
+      # @param argv [Array<String>] no arguments
+      # @param root [String] the repository root, whose local `main` is checked
+      # @param env [Hash{String => String}] `QA_SWEEP_DOMAIN_DIR` picks another ledger
+      # @param gate [#run] runs the quick gate in a directory and answers its results; a spec injects one
+      # @param shell [Module] the fixer, landing and push commands; a spec injects one
+      # @return [Integer] the exit status
+      def self.call(argv, root:, env: ENV, gate: GateRun, shell: Shell)
+        new(root: root, env: env, gate: gate, shell: shell).call(argv)
+      end
+
+      # @param root [String] the repository root
+      # @param env [Hash{String => String}] `QA_SWEEP_DOMAIN_DIR` picks another ledger
+      # @param gate [#run] the quick gate's runner
+      # @param shell [Module] the fixer, landing and push commands
+      def initialize(root:, env: ENV, gate: GateRun, shell: Shell)
+        @root = root
+        @domain_dir = env.fetch("QA_SWEEP_DOMAIN_DIR", File.join(root, "qa/bluebook"))
+        @gate = gate
+        @shell = shell
+      end
+
+      # @param argv [Array<String>] no arguments
+      # @return [Integer] the exit status
+      def call(argv)
+        return reject(argv) unless argv.empty?
+
+        @runtime = boot_ledger
+        sha = Worktree.git!(@root, "rev-parse", "--verify", "main")
+        recorded = recorded_verdict(sha)
+        return answer_recorded(sha, recorded) if recorded
+
+        results = Worktree.with(root: @root, ref: sha) { |dir| @gate.run(dir) }
+        judge(sha, results)
+      end
+
+      private
+
+      def reject(argv)
+        return puts(USAGE) && EXIT_OK if %w[-h --help].include?(argv.first)
+
+        warn "#{USAGE}\nthis command takes no arguments"
+        EXIT_ERROR
+      end
+
+      def boot_ledger
+        Hecks.boot(@domain_dir)
+      rescue StandardError => e
+        abort "the QualityControl ledger did not boot (#{e.class}: #{e.message})"
+      end
+
+      # @return [String, nil] `red` or `green` when the commit is on record
+      def recorded_verdict(sha)
+        row = @runtime.query("QualityControl::MainCheck.All").find { |check| check[:reference][:value] == sha }
+        row&.[](:verdict)&.[](:value)
+      end
+
+      def answer_recorded(sha, verdict)
+        puts "main at #{sha[0, 7]} was already checked: #{verdict}"
+        verdict == "red" ? EXIT_FOUND_SOMETHING : EXIT_OK
+      end
+
+      def judge(sha, results)
+        reds = results.reject(&:passed)
+        record!(sha, reds.size)
+        return green(sha, results) if reds.empty?
+
+        sweep = record_sweep(sha, results)
+        logged = reds.map { |result| log_red(sweep, result, sha) }
+        fixes = fix_self_contained(logged)
+        red(sha, logged, fixes)
+      end
+
+      def record!(sha, count)
+        ::QualityControl::MainCheck.record!(reference: { value: sha }, verdict: { value: count.zero? ? "green" : "red" },
+                                            red_checks: { value: count })
+      end
+
+      def fix_self_contained(logged)
+        logged.filter_map do |reference, disposition, fresh|
+          next unless fresh && disposition == "self_contained"
+
+          QaFixMainBug.new(runtime: @runtime, root: @root, gate: @gate, shell: @shell).fix(reference).message
+        end
+      end
+
+      def green(sha, results)
+        puts "main at #{sha[0, 7]} is green: #{results.map(&:id).join(", ")}"
+        EXIT_OK
+      end
+
+      def red(sha, logged, fixes)
+        logged.each do |reference, _, fresh|
+          puts "#{fresh ? "logged" : "already open"} #{reference} for main at #{sha[0, 7]}"
+        end
+        fixes.each { |line| puts line }
+        EXIT_FOUND_SOMETHING
+      end
+    end
+  end
+end

data/lib/hecks/quality_control/cli/qa_postgres_role.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "pg"
 require_relative "qa_postgres_role/ownership"
 
 module Hecks
@@ -77,6 +76,7 @@ module Hecks
       def provision(database, role)
         done = []
         skipped = []
+        require "pg"
         admin = PG.connect(dbname: "postgres")
         create_role(admin, role, done, skipped)
         take_database(admin, database, role, done, skipped)

data/lib/hecks/quality_control/cli/qa_pr_check/checking.rb

@@ -99,12 +99,11 @@ module Hecks
           "checks still running" if checks.any? { |c| c[:bucket] == "pending" }
         end
 
-        # Starts a Clearance and asks the CI port for a verdict. ClearOnPass/RefuseOnFail settle
+        # Checks a commit: the CI port gives a verdict. ClearOnPass/RefuseOnFail settle
         # the record synchronously, so `find` sees it straight away; a red one is appended to
         # `@newly_red`.
         def ask_the_ledger(pull)
-          ::QualityControl::Clearance.start!(commit: { value: pull.sha })
-          @runtime.dispatch_flat("QualityControl::Clearance.CI.Run", { commit: pull.sha })
+          ::QualityControl::Clearance.check!(commit: { value: pull.sha })
           cleared = ::QualityControl::Clearance.find(pull.sha)
           summary = cleared.summary.to_h[:value]
           return puts("#{pull.tag}: CLEARED — #{summary}") if cleared.status == "green"

data/lib/hecks/quality_control/cli/qa_push_nudge.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require_relative "../../../hecks"
+
+module Hecks
+  module QualityControlCli
+    # The tick's push check: dispatches `PushNudge.Check` once in the Hecks domain, where Tickets
+    # keeps the Work rows, and prints that it ran. It reads refs git already holds and fetches,
+    # pushes and merges nothing. It never fails a tick: a check that could not run prints why and
+    # exits 0, since a missing nudge must not stop the sweep.
+    class QaPushNudge
+      EXIT_OK = 0
+
+      # Everything up to the first line break.
+      FIRST_LINE = /[^\n]*/
+
+      # Runs the check.
+      #
+      # @param _argv [Array<String>] unused
+      # @param root [String] the repository root, whose `lib/hecks/hecks` domain is booted
+      # @return [Integer] 0, always
+      def self.call(_argv, root:)
+        new(root: root).call
+      end
+
+      # @param root [String] the repository root
+      def initialize(root:)
+        @root = root
+      end
+
+      # @return [Integer] 0, always
+      def call
+        runtime = Hecks.boot(File.join(@root, "lib/hecks/hecks"))
+        key = "check-#{Time.now.utc.strftime("%Y%m%dT%H%M%S")}-#{Process.pid}"
+        runtime.dispatch_flat("QualityControl::PushNudge.Check", nudge: { value: key })
+        puts "push nudge: checked (#{key}); the push-due Work row is filed, revised or finished"
+        EXIT_OK
+      rescue StandardError => e
+        puts "push nudge: skipped (#{e.class}: #{first_line(e.message)})"
+        EXIT_OK
+      end
+
+      private
+
+      def first_line(text) = text[FIRST_LINE].strip
+    end
+  end
+end

data/lib/hecks/quality_control/cli/qa_seed_angles/seed.rb

@@ -48,7 +48,7 @@ module Hecks
                      "banking for CI-gated differential fuzzing. rust/Cargo.toml already declares " \
                      "compiled-binary features for compliance and roster (plus meta) that " \
                      "sit unused for this purpose; examples/chess and examples/directory have no Cargo " \
-                     "feature at all — `hecks project_rust` has never regenerated a binary for either. " \
+                     "feature at all — `hecks build.project_rust!` has never regenerated a binary for either. " \
                      "Widening either list would let differential fuzzing catch a whole bug class " \
                      "Ruby-only fuzzing cannot, on domains the practice already owns.",
           citation:  "BUG#1/#3/#4 (engine-divergence bugs); spec/rust_conformance_fuzz_spec.rb DOMAINS " \

data/lib/hecks/quality_control/cli/qa_sweep/seat.rb

@@ -60,7 +60,7 @@ module Hecks
           # `build_rust_for` answers nil only for an undeclared feature; a declared one that fails
           # raises, so its cargo stderr is printed here.
           reason = @rust_build_failure ? @rust_build_failure.message : "rust/Cargo.toml declares no #{@feature} feature"
-          puts "note: no #{@feature} Rust binary — degrading this sweep to ruby_only. Run `hecks project_rust` for it " \
+          puts "note: no #{@feature} Rust binary — degrading this sweep to ruby_only. Run `hecks build.project_rust!` for it " \
                "and re-sweep.\n#{reason}"
           @active_modes = (@active_modes - %i[differential properties_in_differential structural_skip_report]) |
                           [:ruby_only]

data/lib/hecks/quality_control/cli/qa_tick/event_pump_step.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require_relative "../qa_event_pump"
+require_relative "push_nudge_step"
+
+module Hecks
+  module QualityControlCli
+    class QaTick
+      # The tick's last finding step: the event pump, which runs each attached domain's policies
+      # on the events its cursors have not yet read.
+      module EventPumpStep
+        include PushNudgeStep
+
+        private
+
+        # @return [Array<Step>] the steps after the finding steps: the push check and the pump
+        def watch_steps = push_nudge_steps + pump_steps
+
+        # @return [Array<Step>] the pump's step when the `event_pump` dial is on, else none
+        def pump_steps
+          dial(:EVENT_PUMP, false) ? [guarded("event_pump") { run_event_pump }] : []
+        end
+
+        # @return [Array(String, Integer)] the pump's output and its exit status
+        def run_event_pump
+          banner "hecks quality_control event_pump.pump!"
+          output, exit_code = run_step(->(argv) { QaEventPump.call(argv, root: @root) })
+          puts output
+          [output, exit_code]
+        end
+      end
+    end
+  end
+end

data/lib/hecks/quality_control/cli/qa_tick/output.rb

@@ -79,7 +79,10 @@ module Hecks
 
         def report(steps, reclaimed, log_path)
           banner "tick report"
-          steps.each { |step| puts step_verdict(step) }
+          steps.each do |step|
+            puts step_verdict(step)
+            puts errored_line(step) if step.exit_code != EXIT_OK && step.exit_code != EXIT_FOUND_SOMETHING
+          end
           puts stale_holds_line(reclaimed)
           tick_exit = tick_exit_for(steps.map(&:exit_code))
           puts "tick: #{verdict(tick_exit)} (exit #{tick_exit})"
@@ -93,6 +96,18 @@ module Hecks
           "hecks quality_control #{verb}: #{verdict(step.exit_code)} (exit #{step.exit_code.inspect})"
         end
 
+        # What an errored step last said, under its verdict: an abort's refusal (a ledger with no
+        # era held names `hold_first`) ends the output, so the closing report carries it too.
+        def errored_line(step)
+          last = last_said(step.output)
+          last ? "    #{last}" : "    (no output)"
+        end
+
+        def last_said(output)
+          stripped = output.to_s.lines.map(&:strip)
+          stripped.reject(&:empty?).last
+        end
+
         def stale_holds_line(reclaimed)
           named = reclaimed.empty? ? "" : " (#{reclaimed.join(", ")})"
           "stale holds reclaimed: #{reclaimed.size}#{named}"

data/lib/hecks/quality_control/cli/qa_tick/push_nudge_step.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require_relative "../qa_push_nudge"
+
+module Hecks
+  module QualityControlCli
+    class QaTick
+      # The tick's push check, once per tick: `PushNudge.Check` files, revises or finishes the one
+      # `push-due` Work row from refs git already holds. It fetches, pushes and merges nothing.
+      module PushNudgeStep
+        private
+
+        # @return [Array<Step>] the check's step when the `push_nudge` dial is on, else none
+        def push_nudge_steps
+          dial(:PUSH_NUDGE, false) ? [guarded("push_nudge") { run_push_nudge }] : []
+        end
+
+        # @return [Array(String, Integer)] the check's output and its exit status
+        def run_push_nudge
+          banner "hecks quality_control push_nudge.check!"
+          output, exit_code = run_step(->(argv) { QaPushNudge.call(argv, root: @root) })
+          puts output
+          [output, exit_code]
+        end
+      end
+    end
+  end
+end