@erclx/aitk 3.52.0 → 3.52.1

package/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "aitk",
   "description": "Automated governance, versioning, and discovery tools for Claude Code.",
-  "version": "3.52.0",
+  "version": "3.52.1",
   "author": {
     "name": "Eric Le",
     "url": "https://github.com/erclx"

package/docs/agents/audits.md

@@ -34,7 +34,7 @@ Each is invoked as the CLI the caller is running rather than as a global `aitk`.
 
 Four findings fail the run: an unresolved context citation, a banned character, word, or spelling, a skill folder carrying no `REQUIREMENT.md`, and a credential-shaped value in the tree the package ships. Each is a fact with no false-positive class behind it.
 
-Three of the four are the ones `scripts/core/verify.sh` already fails a push on. The secret scan is the one entry gating without a stage behind it, added on that same fact-or-judgment test rather than as a side effect of registering a measure, and the architecture record already ranks content leaving the repository above content that stays.
+Three of the four are the ones `aitk gate run` already fails a push on. The secret scan is the one entry gating without a stage behind it, added on that same fact-or-judgment test rather than as a side effect of registering a measure, and the architecture record already ranks content leaving the repository above content that stays.
 
 Everything else reports. A heavy bullet, a long entry, a board row nothing resolves, a degradation term in a comment, and an implementation reaching history ahead of its test are judgments a reader settles. A push failing on one of those teaches contributors to route around the stage, which is the split recorded across every audit here and the one this command inherits rather than moves.
 

package/docs/agents/commands.md

@@ -64,6 +64,7 @@ Full help: `aitk <command> --help`. Behavior notes for the install and sync verb
 | `aitk census [path]`       | Report tracked file count, a breakdown by extension, and a line total that skips whatever reads as binary (`--json`)                                                  |
 | `aitk audits run`          | Run every audit as one set, report per check under one verdict, and compare each count to the recorded baseline (`--json`, `--record`)                                |
 | `aitk audits list`         | List every audit the set runs, with the corpus each reads and whether it gates (`--json`)                                                                             |
+| `aitk gate run`            | Run every stage that guards a branch here, scoping shell, types, and tests to the changed set (`--all`, `--no-write`, `--nested`, `--json`)                           |
 | `aitk inventory [subject]` | Walk every route a project declares and group its elements by the property each computes, as a listing rather than a gate (`--json`)                                  |
 | `aitk capture [source]`    | Render HTML capture sources to PNG, toolkit-only and absent from an installed package                                                                                 |
 | `aitk serve [dir]`         | Serve a directory on the loopback interface and print the link that opens it, running until interrupted (`--port`, `--entry`, `--json`)                               |
@@ -116,6 +117,7 @@ Each domain exposes a consistent shape where applicable: `list`, `install`, `syn
 | `labels`    | `audit`                                                                                                                               |
 | `autoship`  | `classify`                                                                                                                            |
 | `audits`    | `run`, `list`                                                                                                                         |
+| `gate`      | `run`                                                                                                                                 |
 
 Common patterns:
 

package/docs/agents/gate.md

@@ -0,0 +1,84 @@
+---
+title: Merge gate
+description: Running the gate this repository verifies a branch with, what the stage table holds and what stays a script, how the changed set scopes three stages, and why a stage that cannot read its input reports rather than passing
+---
+
+# Merge gate
+
+`aitk gate run` runs every stage that guards a branch here, in order, stopping at the first stage that finds a fact. `bun run check` and `bun run check:ci` resolve to it, and `scripts/core/update.sh` calls it with `--nested` after a dependency update.
+
+```bash
+aitk gate run
+aitk gate run --all --no-write
+aitk gate run --json
+```
+
+| Option       | Behavior                                                                      |
+| ------------ | ----------------------------------------------------------------------------- |
+| `--all`      | Run every stage instead of scoping shell, types, and tests to the changed set |
+| `--no-write` | Check formatting instead of applying it, which is what a merge gate wants     |
+| `--nested`   | Suppress the outer frame when a calling script has already opened one         |
+| `--json`     | Add a machine-readable record on stdout                                       |
+
+## What the command owns and what it runs
+
+Three things sit in the command: the stage table in `src/gate/stages.ts`, the changed-file scoping and the run loop in `src/gate/sequencer.ts`, and every threshold comparison in `src/gate/measures.ts`. Each individual check is the script or the verb it already was, under `scripts/core/` or behind another `aitk` command, and the move changed none of them. Sequencing, scoping, and comparison are where the recurring defects were, and a check whose behavior changed while its sequencing moved would make any regression impossible to attribute.
+
+A stage is a list of checks and a check is one of four kinds:
+
+| Kind      | What it is                                                                      |
+| --------- | ------------------------------------------------------------------------------- |
+| `command` | Any binary, run from the project root                                           |
+| `cli`     | This checkout's own `src/cli.ts`, never a globally installed `aitk`             |
+| `drift`   | A regenerated pathspec asserted against the index and against the untracked set |
+| `measure` | A reading whose verdict is a comparison rather than an exit code                |
+
+A `cli` check runs the source rather than the binary because a globally installed `aitk` resolves to the main checkout no matter which worktree is running, so a gate reading through it would measure the wrong tree and pass a branch it never opened.
+
+Every check is an argument vector rather than a shell line, so no stage carries a quoting hazard and a `drift` pathspec reaches git exactly as the table spells it.
+
+## Scoping
+
+Shell, types, and tests read the changed set. Everything else always runs, because its input is diffuse enough that no path predicts it.
+
+The changed set unions the branch diff against the merge base with `origin/main`, the working tree, and untracked files, which is what a pull request will contain. The baseline is the remote ref and not local `main`, since on `main` itself the local ref is HEAD and every unpushed commit would drop out. Every fallback widens rather than narrows: no merge base at all runs every stage, and a local baseline equal to HEAD does the same. `--all` turns scoping off outright, which is what `bun run check:ci` passes so CI stays the backstop for a wrong local scoping decision.
+
+## A stage that cannot read its input
+
+A stage reports one of four states. It passed, it was scoped out, it found a fact, or it could not measure its input at all.
+
+The fourth is the one worth naming. An absent tool, a catalog that did not report, a corpus with nothing under it: each used to print a line that read like a pass. Now the run records it as unmeasured, the closing line says how many stages measured nothing, and the reader is not told a verdict nobody took.
+
+What happens next depends on where the run is. On a contributor's machine it warns and the run still exits 0, because an absent tool there is somebody mid-setup. Under CI, read off `CI=true`, it refuses, because the same absence on a runner is a broken workflow step.
+
+## Exit codes
+
+| Code | Meaning                                                       |
+| ---- | ------------------------------------------------------------- |
+| `0`  | every stage that ran reported, and none found a fact          |
+| `1`  | a stage found a fact, or could not measure its input under CI |
+
+One code for a failure, which is what a `bun run` caller and a git hook both read. An unmeasured stage takes no code of its own, since it has already refused under CI and reports on a contributor's machine, so a second code would name a state no caller branches on.
+
+## The record
+
+`--json` puts one record on stdout and keeps every diagnostic on stderr:
+
+```json
+{
+  "ok": true,
+  "root": "/path/to/checkout",
+  "scoped": true,
+  "changed": 12,
+  "summary": {
+    "ran": 23,
+    "passed": 22,
+    "skipped": 1,
+    "unmeasured": 0,
+    "failed": 0
+  },
+  "stages": [{ "id": "indexes", "label": "Indexes", "status": "passed" }]
+}
+```
+
+A failing stage carries its remedy in `failure`, and the same line goes to stderr so a caller reading neither the record nor the frame is still told what to fix.

package/docs/agents/index.md

@@ -18,6 +18,7 @@ CLI catalog and invocation rules for agents, split by command domain. Start with
 - [Self-stated counts](counts.md): Reading a sentence that asserts a closed catalog's size, how a match is decided, the plausibility filter that keeps a generic word from matching a subset, and why the sweep reports rather than gates
 - [Demo](demo.md): Compiling a screencast draft into a runnable plan, driving a served application to a recording and a still, the pointer the recording paints, and what each refusal reports
 - [Docs](docs.md): How aitk docs resolves the toolkit's own reference surface from an install root, and how a split domain is named
+- [Merge gate](gate.md): Running the gate this repository verifies a branch with, what the stage table holds and what stays a script, how the changed set scopes three stages, and why a stage that cannot read its input reports rather than passing
 - [Indexes](indexes.md): Flags, exit codes, and JSON shape for aitk indexes regen, plus when it auto-stages what it rewrote
 - [Install and sync](install-and-sync.md): What each install and sync verb writes, refuses, or leaves alone, and how drift is attributed in a target project
 - [Intake](intake.md): Reading intake folder counts and items, the three read states an item can be in, landing a batch of selections in one cluster, the refusal reasons, and why a call is scoped to one file

package/docs/agents/markdown-audit.md

@@ -126,9 +126,9 @@ The condition on that was something identifying a finite verb rather than guessi
 
 Exit codes are `0` for a completed run with no gating finding, `1` for a refusal, `2` for a ban hit, and `3` for a shipped ban set that arrived empty. A banned character, word, or spelling fails the run. Bullet, paragraph, and depth weight are judgments a reader settles, and cadence is a distribution whose healthy range moves with the surface, so all four report under every code.
 
-`3` is separate from `1` because the two want different responses from a caller. A refusal means no corpus was built, and the `Markdown bans` stage in `scripts/core/verify.sh` is right to warn and skip. An empty set means the corpus was walked and nothing was looked for, so that stage fails the push on `3` rather than skipping.
+`3` is separate from `1` because the two want different responses from a caller. A refusal means no corpus was built, and the `Markdown bans` stage in `aitk gate run` is right to report it as unmeasured rather than as a pass. An empty set means the corpus was walked and nothing was looked for, so that stage fails the push on `3` rather than skipping.
 
-`2` rather than `1` for the gate keeps a measurement that succeeded and found something distinct from the audit declining to measure at all. A caller reading one as the other sends a reader hunting a defect that does not exist, which is the distinction `aitk context audit` and the `verify.sh` seed stage already draw between the same two codes.
+`2` rather than `1` for the gate keeps a measurement that succeeded and found something distinct from the audit declining to measure at all. A caller reading one as the other sends a reader hunting a defect that does not exist, which is the distinction `aitk context audit` and the gate's own seed stage already draw between the same two codes.
 
 A banned character is a fact rather than a judgment, which is the test that admits it to a gate. What held it back was that gating on day one against a corpus never checked mechanically fails loudly on work nobody has had a chance to fix. The order was to land the verb reporting, measure the corpus once, fix what it finds, and turn the gate on as its own change, and the gate is the last of the four.
 
@@ -148,7 +148,7 @@ A hit the closed set cannot separate from correct prose is the case with no thir
 
 ### Where the rules are enforced
 
-Four surfaces apply the ban sets and three of them go through this verb. `.claude/hooks/standards-audit.sh` runs it against a single file after each markdown edit, the seed copy a project installs does the same, and the `Markdown bans` stage in `scripts/core/verify.sh` runs it across the whole corpus before a push. Each hook parsed its own copy of the word bans in awk before that, which left a British spelling passing at edit time and failing the push with nothing in between explaining the difference.
+Four surfaces apply the ban sets and three of them go through this verb. `.claude/hooks/standards-audit.sh` runs it against a single file after each markdown edit, the seed copy a project installs does the same, and the `Markdown bans` stage in `aitk gate run` runs it across the whole corpus before a push. Each hook parsed its own copy of the word bans in awk before that, which left a British spelling passing at edit time and failing the push with nothing in between explaining the difference.
 
 The seed copy moved onto the verb when the sets became data, since its awk had nothing left to parse. It resolves one runner where the toolkit copy resolves two, looking for no checkout source, and a machine carrying no `aitk` gets a report naming the binary to install rather than a silent pass. `scripts/core/check-seed-independence.sh` scopes its walk to markdown and leaves the seed hooks outside it, which its own comment records as deliberate.
 

package/docs/agents/state-scoped-risk.md

@@ -59,7 +59,7 @@ The exemption travels with the line rather than sitting in a path list away from
 
 Exit codes are `0` when the shipped tree carries no credential-shaped value, `1` for a refusal, and `2` for at least one value found.
 
-This is the one entry in `aitk audits run` that gates without a `verify.sh` stage behind it. A credential in the published tree is a fact rather than a judgment, which is the test the catalog asks any gating addition to pass, and the architecture record already ranks content leaving the repository above content that stays.
+This is the one entry in `aitk audits run` that gates without an `aitk gate run` stage behind it. A credential in the published tree is a fact rather than a judgment, which is the test the catalog asks any gating addition to pass, and the architecture record already ranks content leaving the repository above content that stays.
 
 A refusal is never a clean tree. Five reasons produce one, and each exits `1`, because zero findings over zero files reads in the report exactly like zero findings over the whole shipped tree.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/aitk",
   "type": "module",
-  "version": "3.52.0",
+  "version": "3.52.1",
   "description": "Infrastructure and quality tooling for developer workflows",
   "license": "MIT",
   "bin": {
@@ -34,8 +34,8 @@
     "check:install": "./scripts/core/install-check.sh",
     "test": "bun --bun vitest run",
     "prepare": "husky",
-    "check": "./scripts/core/verify.sh",
-    "check:ci": "VERIFY_WRITE=false ./scripts/core/verify.sh --all",
+    "check": "bun src/cli.ts gate run",
+    "check:ci": "bun src/cli.ts gate run --all --no-write",
     "update": "./scripts/core/update.sh",
     "clean": "./scripts/core/clean.sh",
     "snapshot": "./scripts/core/snapshot.sh",

package/scripts/core/list-seed-roots.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Prints every seed root carrying a `.claude/`, one per line and relative to
+# the project root.
+#
+# The discovery rule has one definition, `collect_seed_roots` in
+# `scripts/lib/tooling.sh`, which `check-seed-independence.sh` already reads.
+# This file is the route a caller outside bash takes to that same answer, so a
+# stack seeding `.claude/` later reaches both readers and the two stages
+# measuring seed content cannot disagree about which roots exist.
+set -e
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+
+source "$PROJECT_ROOT/scripts/lib/tooling.sh"
+
+collect_seed_roots

package/scripts/core/repair-bare-flag.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Repairs `core.bare`, which Claude Code's worktree entry leaves set in the
+# shared config with nothing restoring it. The flag strands the main worktree
+# and breaks the git reads that scope a verification run, so this runs ahead of
+# every stage rather than as one of them.
+#
+# The rule itself lives in `scripts/lib/worktree.sh`, the one bash function in
+# this repository under test, so this file is the invocation and never a second
+# copy of the guard that spares a genuinely bare repository.
+set -e
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+
+source "$PROJECT_ROOT/scripts/lib/ui.sh"
+source "$PROJECT_ROOT/scripts/lib/worktree.sh"
+
+repair_bare_flag "$PROJECT_ROOT"

package/scripts/core/update.sh

@@ -21,11 +21,11 @@ main() {
   bun update --interactive
 
   log_step "Verifying project health"
-  if [ -f "$SCRIPT_DIR/verify.sh" ]; then
-    VERIFY_NESTED=true "$SCRIPT_DIR/verify.sh"
+  if [ -f "$PROJECT_ROOT/src/cli.ts" ]; then
+    bun "$PROJECT_ROOT/src/cli.ts" gate run --nested
     log_info "All checks passed"
   else
-    log_warn "Verification script not found, skipping."
+    log_warn "Verification entry point not found, skipping."
   fi
 
   echo -e "${GREY}└${NC}\n"

package/src/audits/catalog.ts

@@ -469,8 +469,8 @@ const RECORD_KINDS: readonly (readonly [string, Corpus])[] = [
 /**
  * Every audit the aggregate runs.
  *
- * `context`, `markdown`, and `skills` gate because `scripts/core/verify.sh`
- * already fails a push on each. `secrets` is the one entry that gates without
+ * `context`, `markdown`, and `skills` gate because the merge gate in
+ * `src/gate/stages.ts` already fails a push on each. `secrets` is the one entry that gates without
  * a stage behind it, added deliberately rather than as a side effect, since a
  * credential in the published tree is a fact and the split this repository
  * records gates a fact and reports a judgment. Weigh any further addition

package/src/audits/run.ts

@@ -32,7 +32,8 @@ export type Spawn = (spec: AuditSpec) => Promise<SpawnResult>
  * Runs each verb out of the checkout this CLI is executing from.
  *
  * `process.execPath` and the resolved `cli.ts` rather than a bare `aitk`, for
- * the reason `verify.sh` already names: a globally installed binary resolves to
+ * the reason `cliRunner` in `src/gate/sequencer.ts` already names: a globally
+ * installed binary resolves to
  * the main checkout no matter which worktree is running, so the aggregate would
  * measure the wrong tree and report a pass over a branch it never read.
  *

package/src/cli.ts

@@ -30,6 +30,7 @@ import { register as records } from '@/commands/records'
 import { register as sessions } from '@/commands/sessions'
 import { register as worktrees } from '@/commands/worktrees'
 import { register as audits } from '@/commands/audits'
+import { register as gate } from '@/commands/gate'
 import { register as secrets } from '@/commands/secrets'
 import { register as deps } from '@/commands/deps'
 import { register as labels } from '@/commands/labels'
@@ -84,6 +85,7 @@ function showHelp(): void {
     `${GREY}│${NC}    autoship [cmd]     ${GREY}# Decide whether a changed set needs the review pass (classify)${NC}`,
     `${GREY}│${NC}    census [path]      ${GREY}# Report tracked file count, extension breakdown, and line totals${NC}`,
     `${GREY}│${NC}    audits [cmd]       ${GREY}# Run every health check as one set (run, list)${NC}`,
+    `${GREY}│${NC}    gate [cmd]         ${GREY}# Run the merge gate stage by stage (run)${NC}`,
     `${GREY}│${NC}    upgrade            ${GREY}# Reinstall the CLI globally with the manager that installed it${NC}`,
     `${GREY}│${NC}`,
     `${GREY}│${NC}  ${WHITE}Sandbox:${NC}`,
@@ -132,6 +134,7 @@ function showHelp(): void {
     `${GREY}│${NC}    aitk labels audit --json`,
     `${GREY}│${NC}    aitk census --json`,
     `${GREY}│${NC}    aitk audits run --json`,
+    `${GREY}│${NC}    aitk gate run --all --no-write`,
     `${GREY}│${NC}    aitk upgrade --json`,
     `${GREY}└${NC}`,
   ]
@@ -186,6 +189,7 @@ labels(program)
 autoship(program)
 census(program)
 audits(program)
+gate(program)
 upgrade(program)
 
 program.parse()

package/src/commands/claude.ts

@@ -1136,8 +1136,8 @@ function refuseAudit(
 /**
  * Prints nothing when every skill carries a requirement.
  *
- * `--requirements-only` is what `verify.sh` runs on every push, and that script
- * pipes a stage's whole output into its own frame. A passing gate that printed
+ * `--requirements-only` is what the merge gate runs on every push, and it pipes
+ * a stage's whole output into its own frame. A passing gate that printed
  * its frame would nest one inside the other on every contributor's push.
  */
 function reportRequirementGate(report: SkillsAudit): void {

package/src/commands/context.ts

@@ -349,8 +349,8 @@ function refuse(
 /**
  * Prints nothing when every path resolves.
  *
- * `--citations-only` is what `verify.sh` runs on every push, and that script
- * pipes a stage's whole output into its own frame. A passing gate that printed
+ * `--citations-only` is what the merge gate runs on every push, and it pipes
+ * a stage's whole output into its own frame. A passing gate that printed
  * its frame would nest one inside the other on every contributor's push.
  */
 function reportGate(report: ScannedCitations): void {

package/src/commands/gate.ts

@@ -0,0 +1,189 @@
+import type { Command } from 'commander'
+import {
+  cliRunner,
+  collectChangedFiles,
+  commandRunner,
+  exitCodeFor,
+  type GateContext,
+  repairBareFlag,
+  type StageResult,
+  type Summary,
+  runStages,
+  summarize,
+} from '@/gate/sequencer'
+import { STAGES } from '@/gate/stages'
+import { PROJECT_ROOT } from '@/project-root'
+import {
+  intro,
+  logError,
+  logInfo,
+  logStep,
+  logWarn,
+  outro,
+  palette,
+  pipeOutput,
+  plural,
+} from '@/ui'
+
+interface RunCommandOptions {
+  readonly all?: boolean
+  readonly write?: boolean
+  readonly nested?: boolean
+  readonly json?: boolean
+}
+
+export function register(program: Command): void {
+  const gate = program
+    .command('gate')
+    .description('Run the merge gate this repository verifies a branch with')
+    .helpOption('-h, --help', 'Show this help message')
+
+  gate
+    .command('run')
+    .description(
+      'Run every gating stage in order, scoping shell, types, and tests to the changed set',
+    )
+    .helpOption('-h, --help', 'Show this help message')
+    .option(
+      '--all',
+      'Run every stage instead of scoping shell, types, and tests to changed files',
+    )
+    .option(
+      '--no-write',
+      'Check formatting instead of applying it, which is what a merge gate wants',
+    )
+    .option(
+      '--nested',
+      'Suppress the outer frame when another script opened one',
+    )
+    .option('--json', 'Add a machine-readable record on stdout')
+    .addHelpText(
+      'after',
+      [
+        '',
+        'Exit codes:',
+        '  0  every stage that ran reported, and none found a fact',
+        '  1  a stage found a fact, or could not measure its input under CI',
+        '',
+        'A stage halts the run, so clearing a regenerate-then-assert stage',
+        'reveals the next one behind it rather than the whole set at once.',
+        '',
+        'A stage that cannot read its input reports rather than passing. On a',
+        "contributor's machine that is a warning and the run still exits 0,",
+        'because an absent tool there is somebody mid-setup. Under CI it',
+        'refuses, because the same absence is a broken workflow step and a',
+        'green run over a stage that measured nothing is the pass the gate',
+        'exists to withhold.',
+        '',
+        'Examples:',
+        '  aitk gate run',
+        '  aitk gate run --all --no-write',
+        '  aitk gate run --json',
+        '',
+      ].join('\n'),
+    )
+    .action(async (opts: RunCommandOptions) => {
+      process.exitCode = await runGate(opts)
+    })
+}
+
+async function runGate(opts: RunCommandOptions): Promise<number> {
+  const root = PROJECT_ROOT
+  const emitJson = opts.json ?? false
+  const nested = opts.nested ?? false
+  const write = opts.write ?? true
+  const run = commandRunner(root)
+
+  if (!emitJson && !nested) intro('aitk gate run')
+
+  await repairBareFlag(root)
+
+  const changed = opts.all
+    ? { scoped: false, files: [] }
+    : await collectChangedFiles(run)
+  if (!emitJson && changed.notice !== undefined) logWarn(changed.notice)
+
+  const ctx: GateContext = {
+    root,
+    ci: process.env.CI === 'true',
+    run,
+    cli: cliRunner(root),
+    write,
+    changed: changed.scoped ? changed.files : undefined,
+  }
+
+  const results = await runStages(
+    STAGES,
+    ctx,
+    emitJson ? undefined : (result) => report(result),
+  )
+  const summary = summarize(results)
+  const code = exitCodeFor(results)
+
+  if (emitJson) {
+    const failed = results.find((result) => result.status === 'failed')
+    // Diagnostics reach stderr in every mode, so a caller reading the record
+    // alone is not the only one told what went wrong.
+    if (failed?.failure !== undefined) {
+      process.stderr.write(`${failed.label}: ${failed.failure}\n`)
+    }
+    process.stdout.write(
+      `${JSON.stringify({
+        ok: code === 0,
+        root,
+        scoped: changed.scoped,
+        changed: changed.files.length,
+        summary,
+        stages: results.map(({ id, label, status, failure }) => ({
+          id,
+          label,
+          status,
+          failure,
+        })),
+      })}\n`,
+    )
+    return code
+  }
+
+  if (!nested) close(summary, code)
+  return code
+}
+
+function report(result: StageResult): void {
+  logStep(result.label)
+  for (const emission of result.emissions) {
+    if (emission.kind === 'info') logInfo(emission.text)
+    else if (emission.kind === 'warn') logWarn(emission.text)
+    else pipeOutput(emission.text)
+  }
+  if (result.failure !== undefined) logError(result.failure)
+}
+
+/**
+ * The closing verdict, which names what the run did not measure rather than
+ * reporting a bare pass over it.
+ *
+ * A run where every stage read its input still closes on the line the script
+ * this replaces closed on, so nothing about the ordinary case moved. A run
+ * carrying an unmeasured stage says so, because a green line over a stage that
+ * looked at nothing is exactly the silence the reporting outcome exists
+ * against.
+ */
+function close(summary: Summary, code: number): void {
+  const { GREEN, NC, RED, YELLOW } = palette(process.stderr)
+  outro()
+
+  if (code !== 0) {
+    process.stderr.write(`${RED}✗ Verification failed${NC}\n\n`)
+    return
+  }
+
+  if (summary.unmeasured > 0) {
+    process.stderr.write(
+      `${YELLOW}! Verification passed, ${plural(summary.unmeasured, 'stage')} measured nothing${NC}\n\n`,
+    )
+    return
+  }
+
+  process.stderr.write(`${GREEN}✓ Verification passed${NC}\n\n`)
+}