@erclx/canon 5.60.0 → 5.62.0

package/governance/rules/ui/ux-controls.md

@@ -0,0 +1,25 @@
+---
+description: Destructive actions, edit cancel, and element states for interactive controls
+paths:
+  - '**/*.tsx'
+  - '**/*.jsx'
+  - '**/*.astro'
+  - '**/*.html'
+  - '**/*.css'
+---
+
+# UX controls standards
+
+## Destructive actions
+
+- Confirm a destructive action, such as a delete, disconnect, or discard, before it runs, unless it can be undone afterward.
+- Restore the value from before an edit when the edit is cancelled. Never discard typed work on Escape or an outside click unasked, but confirm first when the person has typed something.
+
+## Element states
+
+- Give every interactive element distinct hover, active, focus, and disabled styles.
+- Never flash an intermediate state, such as a light frame before a dark theme or a layout jump before data arrives. Reserve the space or settle it first.
+- Say why a control is disabled, in text beside it or a tooltip, and keep it focusable through `aria-disabled` when the reason matters.
+- Declare `color-scheme` on `:root` to match each theme, so scrollbars and form controls follow the theme instead of staying light.
+- Keep content shown on hover or focus dismissible without moving the pointer, hoverable, and visible until the trigger leaves or the person dismisses it (WCAG 1.4.13).
+- Change no context, such as navigating, submitting, or moving focus, when a control gains focus or changes value, unless the person was told first (WCAG 3.2.1, 3.2.2).

package/governance/splits.toml

@@ -0,0 +1,15 @@
+# Rule splits a sync tells a target about. Each key under [split] is the
+# basename of a rule that shed bullets into others, and its value lists the
+# basenames those bullets moved to. `canon gov sync` adds no rule, so a target
+# holding the key and not a partner reads a notice naming the partner and the
+# `canon gov install --add` command that installs it.
+#
+# This ledger is not the rename ledger. A rename entry resolves to a successor
+# the sync installs, and a split key is a live rule the target keeps. Add the
+# entry in the same change as the split. The notice is stateless, so a target
+# installed after the split reads it too until it adds the partner. Prune an
+# entry only once its key or partner is retired, which the live-rule check in
+# `src/gov/splits.test.ts` forces.
+[split]
+keyboard = ["pointer"]
+ux-completeness = ["ux-controls"]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "5.60.0",
+  "version": "5.62.0",
   "description": "Runs your agent's work and keeps its code good, on one setup for every repo.",
   "license": "MIT",
   "bin": {
@@ -51,6 +51,7 @@
     "web:e2e": "cd web && playwright test"
   },
   "dependencies": {
+    "axe-core": "4.14.0",
     "commander": "^13.1.0",
     "execa": "^9.5.2",
     "playwright-core": "1.64.1"

package/src/commands/driver.ts

@@ -3,6 +3,7 @@ import { resolve } from 'node:path'
 import type { Command } from 'commander'
 import { INSTALL_BROWSER, isEngineMissing } from '@/browser/engine'
 import type { DriverRefusal } from '@/driver/drive'
+import { AXE_GATE_RULES } from '@/driver/probes/axe'
 import { describeViewport } from '@/driver/probes/viewport'
 import { PROBE_NAMES, readDriverPlan, type ProbeName } from '@/driver/steps'
 import type { PlanRefusal } from '@/driver/steps'
@@ -51,6 +52,8 @@ const PLAN_REFUSALS: Record<PlanRefusal, string> = {
 
 const DRIVE_REFUSALS: Record<DriverRefusal, string> = {
   'browser-missing': 'The browser binary is not installed in this project.',
+  'axe-missing':
+    'The axe engine did not resolve from canon, so no page was read with it.',
   'server-unreachable': 'Nothing answered at the URL, so no state was reached.',
   'drive-failed': 'The drive failed against a reachable page.',
 }
@@ -62,6 +65,7 @@ const PROBE_NOTES: Record<ProbeName, string> = {
   'diagram-geometry':
     'an SVG label outside its frame, covered by a fill, or on another label',
   'diagram-strokes': 'an SVG label a stroke crosses, in either paint order',
+  axe: 'axe-core on WCAG 2.2 A and AA, frames excluded, run only when named',
 }
 
 export function register(program: Command): void {
@@ -89,9 +93,10 @@ export function register(program: Command): void {
         'run, since nothing else there measures the page as it first painted.',
         '',
         'The run file carries the viewport, the default probe list, and the',
-        'steps. A step names its own probes to override the default. Viewport',
-        'heights are never defaulted: the heights a defect hides at are a',
-        'property of the layout rather than of this command.',
+        'steps. A step names its own probes to override the default, and a run',
+        'naming no list gets every probe but axe. Viewport heights are never',
+        'defaulted: the heights a defect hides at are a property of the layout',
+        'rather than of this command.',
         '',
         '  {',
         '    "viewport": { "width": 1440, "heights": [900, 1200, 1500] },',
@@ -116,6 +121,11 @@ export function register(program: Command): void {
           (name) => `  ${name.padEnd(18)}${PROBE_NOTES[name]}`,
         ),
         '',
+        'An axe finding carries rule, outcome, and gate. outcome is violation or',
+        'incomplete, the second being axe declining to decide. gate is true for',
+        'a violation of one of these rules, which a UI review holds open on:',
+        ...wrapRules(AXE_GATE_RULES),
+        '',
         'Reasons:',
         '  no-run-file         nothing readable at the run path',
         '  unreadable-plan     the run file is not valid JSON',
@@ -128,6 +138,7 @@ export function register(program: Command): void {
         '  no-heights          the viewport names no height, which is never defaulted',
         '  engine-missing      the browser engine is not installed in this project',
         '  browser-missing     the engine is installed and its browser binary is not',
+        '  axe-missing         the run names axe and its engine did not resolve',
         '  server-unreachable  nothing answered at the URL, so no state was reached',
         '  drive-failed        the drive failed against a reachable page',
         '',
@@ -153,6 +164,21 @@ export function register(program: Command): void {
     })
 }
 
+/** Lays the gate list out at the help text's width. */
+function wrapRules(rules: readonly string[]): string[] {
+  const lines: string[] = []
+  let line = ' '
+  for (const rule of rules) {
+    if (line.length + rule.length + 1 > 74) {
+      lines.push(line)
+      line = ' '
+    }
+    line += ` ${rule}`
+  }
+  lines.push(line)
+  return lines
+}
+
 async function runDriver(
   url: string,
   runPath: string,

package/src/commands/migrate.ts

@@ -326,6 +326,11 @@ function reportRecords(plan: RecordsPlan, records: number): void {
   logInfo(
     `${plural(plan.entries.length, 'file')} to change, ${plural(plan.rewritten, 'citation')} to rewrite.`,
   )
+  if (plan.dropped > 0) {
+    logInfo(
+      `${plural(plan.dropped, 'ignore line')} dropped, already covered by .canon/.`,
+    )
+  }
   logInfo(`${plural(plan.kept, 'citation')} marked to keep the old root.`)
 
   // A count rather than a list, and its own line rather than a place in
@@ -401,6 +406,7 @@ function toRecordsRecord(
     collisions: plan.collisions,
     files: plan.entries.length,
     rewritten: plan.rewritten,
+    dropped: plan.dropped,
     kept: plan.kept,
     excluded: plan.excluded.length,
     coupled: plan.coupled,
@@ -414,6 +420,7 @@ function toRecordsRecord(
     paths: plan.entries.map((entry) => ({
       path: entry.path,
       rewritten: entry.rewritten,
+      dropped: entry.dropped,
     })),
   }
 }

package/src/commands/records.ts

@@ -223,7 +223,7 @@ export function register(program: Command): void {
   records
     .command('stale')
     .description(
-      'Report when the requirements record was last reviewed and how many releases have shipped since',
+      'Report when the requirements and design records were last reviewed and how many releases have shipped since',
     )
     .argument('<kind>', `Record folder: ${STALE_KINDS.join(', ')}`)
     .helpOption('-h, --help', 'Show this help message')
@@ -233,7 +233,8 @@ export function register(program: Command): void {
       'after',
       [
         '',
-        'canonical: reads REQUIREMENTS.md at whichever surface root carries it,',
+        'canonical: reads REQUIREMENTS.md and DESIGN.md at whichever surface root',
+        'carries each, skipping one the project lacks,',
         'in the current worktree since it is tracked. It reports its reviewed date',
         'and the release tags merged into HEAD after that day, or never when it',
         'carries no date.',

package/src/commands/sync.ts

@@ -285,7 +285,9 @@ function renderTooling(report: CheckReport): void {
     if (count > 0) logWarn(`${count} ${category}`)
   }
   logInfo(
-    'Run `canon tooling sync --check` to see which files, `--write` to apply.',
+    tooling.changes === tooling.counts.customized
+      ? 'A customized config moved upstream, and no write touches it. Run `canon tooling diff` to see which, and `canon tooling lift <path>` to take it.'
+      : 'Run `canon tooling sync --check` to see which files, `--write` to apply.',
   )
 }
 

package/src/commands/tooling.ts

@@ -11,6 +11,7 @@ import {
 } from '@/tooling/inject'
 import { buildStackSummaries, describeStack } from '@/tooling/list'
 import {
+  configFiles,
   isStackExcluded,
   listStacks,
   loadManifest,
@@ -23,6 +24,16 @@ import {
   renderStackSections,
   resolveReference,
 } from '@/tooling/read'
+import { resolveRecorded } from '@/sync/check'
+import { readStamp, stampedChain, writeDispositions } from '@/sync/stamp'
+import {
+  customize,
+  decline,
+  lift,
+  normalizeGoldenPath,
+  readDispositions,
+  resolveGolden,
+} from '@/tooling/disposition'
 import { scan, type ScanResult } from '@/tooling/scan'
 import { recordToolingChain } from '@/tooling/stamp'
 import { subfolderPath } from '@/tooling/subfolder'
@@ -44,14 +55,26 @@ interface SyncOptions {
   readonly skip?: string
   readonly check?: boolean
   readonly write?: boolean
+  readonly replace?: readonly string[]
   readonly diff?: { readonly json: boolean }
 }
 
+function collect(value: string, previous: readonly string[]): string[] {
+  return [...previous, value]
+}
+
 interface DiffOptions {
   readonly skip?: string
   readonly json?: boolean
 }
 
+interface DispositionOptions {
+  readonly reason?: string
+  readonly json?: boolean
+}
+
+type DispositionAction = 'decline' | 'customize' | 'lift'
+
 interface InjectOptions {
   readonly configs?: boolean
   readonly seeds?: boolean
@@ -94,6 +117,12 @@ export function register(program: Command): void {
       'Report what would change and write nothing, always exiting 0. Prefer `canon tooling diff`',
     )
     .option('--write', 'Apply every change without prompting')
+    .option(
+      '--replace <path>',
+      'Replace a held config with the golden copy (repeatable)',
+      collect,
+      [],
+    )
     .addHelpText(
       'after',
       [
@@ -102,6 +131,7 @@ export function register(program: Command): void {
         '  canon tooling sync base',
         '  canon tooling sync base --check',
         '  canon tooling sync base --write',
+        '  canon tooling sync base --write --replace .oxfmtrc.json',
         '  canon tooling sync vite-react web --skip base',
         '',
         'A target below its git root syncs as a subfolder. It withholds',
@@ -115,8 +145,15 @@ export function register(program: Command): void {
         'what `canon sync --check --exit-code` spells with a flag. Pass --check',
         'to report the same list and always exit 0.',
         '',
-        '--write replaces every golden config that differs from the stack.',
+        '--write replaces a golden config only when canon changed it and the',
+        'project did not, which the hash the last write recorded tells apart.',
+        'A config the project edited, or one written before hashes were',
+        'recorded, is held and listed. Name it with --replace to take the',
+        'golden copy, or run `canon tooling customize <path>` to keep yours.',
+        'A config no recorded stack ships is a first install and never held,',
+        'so a fresh scaffold takes every golden config of a stack new to it.',
         'Seeds are copy-once, so a seed the target already holds is left alone.',
+        'A declined or customized path is never written.',
         '',
         'Exit codes:',
         '  0  synced, up to date, cancelled, or run with --check',
@@ -167,6 +204,88 @@ export function register(program: Command): void {
       },
     )
 
+  const dispositionHelp = [
+    '',
+    '<path> is relative to the target, as `canon tooling diff` lists it, and',
+    'resolves against the chain the last sync recorded. These verbs are the',
+    'only writers of the record, kept under domains.tooling.dispositions in',
+    'canon/config/config.json. Nothing here deletes or edits the file itself.',
+    '',
+    'Exit codes:',
+    '  0  recorded',
+    '  1  refused: no-chain, bad-path, not-golden, already-held,',
+    '     seed-not-customizable, missing-file, not-held, or toolkit-root',
+    '',
+  ]
+
+  tooling
+    .command('decline')
+    .description('Keep sync and inject from ever writing one golden file')
+    .argument('<path>', 'Golden file path, relative to the target')
+    .argument('[target]', 'Target directory', '.')
+    .helpOption('-h, --help', 'Show this help message')
+    .option('--reason <text>', 'Record why the project declined it')
+    .option('--json', 'Add a machine-readable record on stdout')
+    .addHelpText(
+      'after',
+      [
+        ...dispositionHelp,
+        'Examples:',
+        '  canon tooling decline .github/workflows/readme-screenshot.yml',
+        '  canon tooling decline .oxlintrc.json web --reason "lint runs in CI only"',
+        '',
+      ].join('\n'),
+    )
+    .action(async (path: string, target: string, opts: DispositionOptions) => {
+      process.exitCode = await runDisposition('decline', path, target, opts)
+    })
+
+  tooling
+    .command('customize')
+    .description(
+      'Keep the project copy of one golden config through every write',
+    )
+    .argument('<path>', 'Golden config path, relative to the target')
+    .argument('[target]', 'Target directory', '.')
+    .helpOption('-h, --help', 'Show this help message')
+    .option('--json', 'Add a machine-readable record on stdout')
+    .addHelpText(
+      'after',
+      [
+        ...dispositionHelp,
+        'The golden hash is recorded, so `canon tooling diff` exits 1 once the',
+        'stack ships a different copy. A seed cannot be customized, since sync',
+        'never overwrites one.',
+        '',
+        'Examples:',
+        '  canon tooling customize e2e/home.spec.ts',
+        '',
+      ].join('\n'),
+    )
+    .action(async (path: string, target: string, opts: DispositionOptions) => {
+      process.exitCode = await runDisposition('customize', path, target, opts)
+    })
+
+  tooling
+    .command('lift')
+    .description('Hand a declined or customized file back to sync')
+    .argument('<path>', 'Golden file path, relative to the target')
+    .argument('[target]', 'Target directory', '.')
+    .helpOption('-h, --help', 'Show this help message')
+    .option('--json', 'Add a machine-readable record on stdout')
+    .addHelpText(
+      'after',
+      [
+        ...dispositionHelp,
+        'Examples:',
+        '  canon tooling lift .github/workflows/readme-screenshot.yml',
+        '',
+      ].join('\n'),
+    )
+    .action(async (path: string, target: string, opts: DispositionOptions) => {
+      process.exitCode = await runDisposition('lift', path, target, opts)
+    })
+
   tooling
     .command('inject')
     .description('Apply one stack to a target without scanning or prompting')
@@ -380,7 +499,7 @@ async function runSync(
 
   if (opts.check === true && opts.write === true) {
     return refuse(
-      opts,
+      opts.diff?.json,
       'conflicting-flags',
       'Pass --check or --write, not both.',
     )
@@ -388,22 +507,37 @@ async function runSync(
 
   const selected = stack ?? (await promptForStack())
   if (selected === undefined) {
-    return refuse(opts, 'no-stacks', 'No tooling stacks found')
+    return refuse(opts.diff?.json, 'no-stacks', 'No tooling stacks found')
   }
 
   if (isStackExcluded(selected)) {
     return refuse(
-      opts,
+      opts.diff?.json,
       'excluded-stack',
       'Claude is managed by `canon claude`, not `canon tooling`. Run `canon claude sync` instead.',
     )
   }
 
   const prepared = prepare(selected, target, opts.skip)
-  if (!prepared.ok) return refuse(opts, prepared.reason, prepared.error)
+  if (!prepared.ok)
+    return refuse(opts.diff?.json, prepared.reason, prepared.error)
 
   const result = scan(prepared.chain, prepared.target)
 
+  const replace = (opts.replace ?? []).map(
+    (input) => normalizeGoldenPath(input) ?? input,
+  )
+  const unknown = replace.filter(
+    (rel) => !result.configs.some((entry) => entry.rel === rel),
+  )
+  if (unknown.length > 0) {
+    return refuse(
+      opts.diff?.json,
+      'unknown-replace',
+      `--replace names no config this chain writes: ${unknown.join(', ')}`,
+    )
+  }
+
   report(result, prepared.target)
 
   if (opts.diff !== undefined) {
@@ -442,15 +576,16 @@ async function runSync(
     return decision === 'unauthorized' ? 1 : 0
   }
 
+  const held = heldConfigs(result, replace, prepared.chain, prepared.target)
   if (result.configs.some((entry) => entry.state !== 'matching')) {
-    await injectConfigs(prepared.chain, prepared.target)
+    await injectConfigs(prepared.chain, prepared.target, new Set(held))
   }
 
   await injectSeeds(prepared.chain, prepared.target)
   const manifest = await injectManifest(prepared.chain, prepared.target)
   if (!manifest.ok) {
     return refuse(
-      opts,
+      false,
       manifest.reason,
       `${manifest.message}\nConfigs and seeds above were written. Scripts, gitignore entries, and the stamp were not, so the next sync retries.`,
     )
@@ -458,24 +593,170 @@ async function runSync(
 
   await stampChain(prepared.chain, prepared.target)
 
+  if (held.length > 0) {
+    reportHeld(held, selected, target, opts.skip)
+  }
+
   outroSuccess('Tooling sync complete')
   return 0
 }
 
+/**
+ * A drifted config the project edited, or one no write recorded, is held
+ * rather than replaced, since a write naming a stack is not consent to lose an
+ * edit inside it. Only a path `--replace` names is taken over.
+ *
+ * A path no recorded stack ships is a first install of that stack, so it is
+ * never held. `canon init` records `base` before a framework stack syncs over
+ * a fresh scaffold, whose own copies of that stack's configs came from the
+ * scaffold rather than from a project edit.
+ */
+function heldConfigs(
+  result: ScanResult,
+  replace: readonly string[],
+  chain: readonly Manifest[],
+  target: string,
+): string[] {
+  const recorded = new Set(stampedChain(readStamp(target), 'tooling'))
+  const installed = new Set(
+    chain
+      .filter((manifest) => recorded.has(manifest.name))
+      .flatMap(configFiles),
+  )
+
+  return result.configs
+    .filter(
+      (entry) =>
+        entry.state === 'drifted' &&
+        entry.cause !== 'stale' &&
+        installed.has(entry.rel) &&
+        !replace.includes(entry.rel),
+    )
+    .map((entry) => entry.rel)
+}
+
+/**
+ * Names every held path in one copyable command, so taking the first run's
+ * unattributed holds costs one paste rather than one flag per path typed.
+ */
+function reportHeld(
+  held: readonly string[],
+  stack: string,
+  target: string,
+  skip: string | undefined,
+): void {
+  logStep('Held')
+  for (const rel of held) logWarn(rel)
+  logInfo(
+    'The project changed these, or no earlier write recorded them, so --write left them as they are. Keep one with `canon tooling customize <path>`, or take the golden copies with:',
+  )
+  const command = [
+    'canon tooling sync',
+    stack,
+    target,
+    ...(skip === undefined ? [] : ['--skip', skip]),
+    '--write',
+    ...held.flatMap((rel) => ['--replace', rel]),
+  ]
+  logInfo(command.join(' '))
+}
+
 /**
  * A diff caller branches on the record rather than the exit, since a shell
  * wrapper can flatten the status. Every refusal therefore answers with a reason
  * on stdout under `--json`, beside the exit 1 that keeps a gate failing.
  */
-function refuse(opts: SyncOptions, reason: string, message: string): number {
+function refuse(
+  json: boolean | undefined,
+  reason: string,
+  message: string,
+): number {
   logWarn(message)
-  if (opts.diff?.json) {
+  if (json === true) {
     process.stdout.write(`${JSON.stringify({ ok: false, reason, message })}\n`)
   }
   outro()
   return 1
 }
 
+/**
+ * Resolves the path against the chain the last sync recorded rather than a
+ * stack argument, since a disposition belongs to the path whichever stack
+ * ships it. An unstamped target has no chain to resolve against and refuses.
+ */
+async function runDisposition(
+  action: DispositionAction,
+  input: string,
+  target: string,
+  opts: DispositionOptions,
+): Promise<number> {
+  intro(`canon tooling ${action}`)
+
+  const resolved = resolve(target)
+  if (resolved === PROJECT_ROOT) {
+    return refuse(
+      opts.json,
+      'toolkit-root',
+      'Cannot run against toolkit root. Files here are the source of truth.',
+    )
+  }
+
+  const rel = normalizeGoldenPath(input)
+  if (rel === undefined) {
+    return refuse(
+      opts.json,
+      'bad-path',
+      `${input} is not a path inside the target. Pass it relative to the target.`,
+    )
+  }
+
+  const chain = resolveRecorded(
+    PROJECT_ROOT,
+    stampedChain(readStamp(resolved), 'tooling'),
+  )
+  if (chain.length === 0) {
+    return refuse(
+      opts.json,
+      'no-chain',
+      `No tooling chain is recorded in ${resolved}. Run \`canon tooling sync <stack>\` there first.`,
+    )
+  }
+
+  const current = readDispositions(resolved)
+  const golden = resolveGolden(chain, rel)
+  const transition =
+    action === 'decline'
+      ? decline(current, golden, opts.reason)
+      : action === 'customize'
+        ? customize(current, golden, existsSync(join(resolved, rel)))
+        : lift(current, rel)
+
+  if (!transition.ok) {
+    return refuse(opts.json, transition.reason, transition.message)
+  }
+
+  await writeDispositions(
+    resolved,
+    { domain: 'tooling', toolkitRoot: PROJECT_ROOT },
+    transition.dispositions,
+    new Date(),
+  )
+
+  const entry = transition.dispositions[rel]
+  if (opts.json === true) {
+    process.stdout.write(
+      `${JSON.stringify({ ok: true, action, path: rel, ...(entry === undefined ? {} : { entry }) })}\n`,
+    )
+  }
+
+  outroSuccess(
+    entry === undefined
+      ? `Lifted ${rel}. The next sync writes it again.`
+      : `Recorded ${rel} as ${entry.disposition}. Sync and inject skip it.`,
+  )
+  return 0
+}
+
 type WriteMode = 'apply' | 'prompt' | 'report' | 'unauthorized'
 
 type ApplyDecision = 'apply' | 'cancelled' | 'reported' | 'unauthorized'
@@ -629,13 +910,18 @@ function report(result: ScanResult, target: string): void {
     if (entry.state === 'matching') logInfo(entry.rel)
   }
   for (const entry of result.configs) {
-    if (entry.state === 'drifted') logWarn(entry.rel)
+    if (entry.state === 'drifted') {
+      logWarn(
+        entry.cause === 'stale' ? entry.rel : `${entry.rel} (${entry.cause})`,
+      )
+    }
   }
   for (const entry of result.configs) {
     if (entry.state === 'new') logAdd(entry.rel)
   }
 
   if (result.withheld.length > 0) reportWithheld(result, target)
+  reportDispositions(result)
 
   logStep('Scanning seeds')
   for (const entry of result.seeds) {
@@ -681,6 +967,35 @@ function reportWithheld(result: ScanResult, target: string): void {
   logInfo(`working-directory: ${subfolderPath(target) ?? '.'}`)
 }
 
+function reportDispositions(result: ScanResult): void {
+  const declined = result.dispositions.filter(
+    (entry) => entry.disposition === 'declined',
+  )
+  const customized = result.dispositions.filter(
+    (entry) => entry.disposition === 'customized',
+  )
+
+  if (declined.length > 0) {
+    logStep('Declined')
+    for (const entry of declined) {
+      logInfo(entry.present ? `${entry.rel} (still here)` : entry.rel)
+    }
+  }
+
+  if (customized.length > 0) {
+    logStep('Customized')
+    for (const entry of customized) {
+      if (entry.moved === true) {
+        logWarn(
+          `${entry.rel}: the ${entry.stack} golden changed since it was customized. Run \`canon tooling lift ${entry.rel}\` to take the new copy on the next write, or lift and customize again to keep this one.`,
+        )
+      } else {
+        logInfo(entry.rel)
+      }
+    }
+  }
+}
+
 function reportPackage(result: ScanResult): void {
   if (result.scripts.length > 0) {
     logStep('Scanning scripts')
@@ -717,6 +1032,10 @@ function summarize(result: ScanResult): string {
     result.configs.filter((entry) => entry.state !== 'matching').length,
     'configs',
   )
+  add(
+    result.dispositions.filter((entry) => entry.moved === true).length,
+    'moved customized',
+  )
   add(result.seeds.filter((entry) => entry.state === 'missing').length, 'seeds')
   add(
     result.scripts.filter((entry) => entry.state !== 'matching').length,