@sylad/cadence 1.34.1 → 1.36.0

package/dist/release.js

@@ -200,20 +200,22 @@ function whatsNewIssues(text, version) {
  * types que Claude Code génère dans plugins/cadence-hud et que seul un clone ne porte pas). `git clone` du dépôt courant ne prend que ce qui est commité,
  * `--no-hardlinks` pour ne rien partager avec lui ; le clone est retiré, vert ou rouge.
  */
-function cloneStep(scripts) {
+function cloneStep(scripts, untag) {
     const run = scripts.map((n) => (n === 'test' ? 'npm test' : `npm run ${n}`)).join(' && ');
-    return `d=$(mktemp -d) && git clone -q --no-hardlinks . "$d/c" && (cd "$d/c" && npm ci && ${run}); r=$?; rm -rf "$d"; test $r -eq 0    (la suite dans un git clone neuf, comme publish.yml ; rouge = pas de tag)`;
+    return `d=$(mktemp -d) && git clone -q --no-hardlinks . "$d/c" && (cd "$d/c" && npm ci && ${run}); r=$?; rm -rf "$d"; test $r -eq 0 || ${untag}    (la suite dans un git clone neuf, qui reçoit le tag provisoire, comme publish.yml ; rouge = tag retiré)`;
 }
 /** Les étapes que le lead joue, dans l'ordre : la commande n'en fait aucune. */
 function steps(p, files, branch) {
     const tag = `v${p.version}`;
+    // Rouge à la porte, au clone ou à l'éval : le tag provisoire est retiré, la release n'a pas eu lieu.
+    const untag = `{ git tag -d ${tag}; false; }`;
     const out = [
         `git add ${files.join(' ')} && git commit -m "release: ${p.version}"`,
-        'cadence verify --gate --sha HEAD    (la suite et le build rejoués sur le commit de version, où le CHANGELOG n\'a plus de [Unreleased] plein ; rouge = pas d\'éval ni de tag)',
-        ...(p.cloneScripts.length ? [cloneStep(p.cloneScripts)] : []),
-        ...(p.hasEvalScript ? ['npm run eval:plugin -- --trust-plugin    (facturé ; un cas sous le seuil arrête la release)'] : []),
-        `git tag ${tag}`,
-        `git push origin ${branch} ${tag}    (le tag lance le workflow de publication)`,
+        `git tag ${tag}    (tag local provisoire sur le commit de version : les tests qui lisent le dernier tag, comme test/changelog.test.ts, voient la version publiée ; retiré si une des trois étapes suivantes est rouge, jamais poussé avant)`,
+        `cadence verify --gate --sha HEAD || ${untag}    (la suite et le build rejoués sur le commit de version, où le CHANGELOG n'a plus de [Unreleased] plein ; rouge = tag retiré, pas d'éval)`,
+        ...(p.cloneScripts.length ? [cloneStep(p.cloneScripts, untag)] : []),
+        ...(p.hasEvalScript ? [`npm run eval:plugin -- --trust-plugin || ${untag}    (facturé ; un cas sous le seuil arrête la release et retire le tag ; si la lecture du rapport le juge faux, reposer le tag de l’étape 2 avant le push)`] : []),
+        `git push origin ${branch} ${tag}    (le tag provisoire devient le tag de la release ; il lance le workflow de publication)`,
         'gh run watch    (jusqu\'à la fin du run de publication)',
         ...(p.isPrivate || p.packageName === '' ? [] : [`npm view ${p.packageName} version    (doit répondre ${p.version})`]),
         ...(p.pluginName ? [

package/dist/remote-gate.js

@@ -0,0 +1,278 @@
+// Porte déportée (L403) : build et tests joués par ssh sur l'hôte `orchestrate.gate.host`, au sha poussé dans un dépôt nu, avec un cache de dépendances par empreinte des lockfiles.
+// Ce module ne connaît ni nom de machine ni nom de dépôt : l'hôte vient de la config, le dossier de travail distant est dérivé du dossier du projet (`.cadence-gate/<projet>`).
+import { spawn, spawnSync } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { basename, join, resolve } from 'node:path';
+import { onTermination } from './proc.js';
+import { git, gitFailure, ignoredDeps, isCopiedDep } from './orchestrate/worktree.js';
+/** Les lockfiles que l'empreinte couvre, à tout niveau du dépôt (R18). */
+const LOCKFILES = ['package-lock.json', 'npm-shrinkwrap.json', 'pnpm-lock.yaml', 'yarn.lock', 'poetry.lock', 'uv.lock', 'Pipfile.lock', 'Cargo.lock', 'go.sum'];
+/** Au-delà de cet âge, un worktree ou un cache temporaire laissé sur l'hôte est un orphelin (aucune commande de la porte ne dure autant) : le prochain appel le retire (R17, R19). */
+const ORPHAN_MIN = 360;
+/** Délai de chaque commande de la porte : celui du rejeu de la ligne de base de la vague. */
+export const GATE_TIMEOUT_MS = 30 * 60_000;
+/** Délai de connexion de la sonde (R4) puis des autres appels ssh. */
+const PROBE_CONNECT_S = 5;
+const CONNECT_S = 10;
+/** Un nom de commit sûr à insérer dans une commande : hexadécimal de 4 à 64 caractères (R18). */
+export const isSha = (s) => /^[0-9a-f]{4,64}$/i.test(s);
+/** Une valeur entre apostrophes pour `sh`, apostrophes internes échappées (R18) : le sha, l'hôte et les chemins insérés dans une commande ssh passent par là. */
+export const shq = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+/** Empreinte des lockfiles du sha (R3, R18) ; null quand le sha n'en porte aucun (pas de cache). `files` : leurs chemins dans le dépôt, triés. */
+export function lockfileFingerprint(repo, sha) {
+    const files = git(repo, 'ls-tree', '-r', '--name-only', '-z', sha)
+        .split('\0')
+        .filter((f) => f && LOCKFILES.includes(basename(f)) && !f.split('/').includes('node_modules'))
+        .sort();
+    if (!files.length)
+        return null;
+    const h = createHash('sha256');
+    for (const f of files) {
+        h.update(`${f}\0`);
+        h.update(spawnSync('git', ['show', `${sha}:${f}`], { cwd: repo, maxBuffer: 1 << 28 }).stdout);
+        h.update('\0');
+    }
+    return { fp: h.digest('hex'), files };
+}
+/** Empreinte des mêmes lockfiles dans le dossier `dir` du disque (R16) ; null si l'un manque. */
+function diskFingerprint(dir, files) {
+    const h = createHash('sha256');
+    for (const f of files) {
+        if (!existsSync(join(dir, f)))
+            return null;
+        h.update(`${f}\0`);
+        h.update(readFileSync(join(dir, f)));
+        h.update('\0');
+    }
+    return h.digest('hex');
+}
+const archOf = (m) => ({ x86_64: 'x64', amd64: 'x64', aarch64: 'arm64', arm64: 'arm64' })[m] ?? m;
+/** Système et architecture de cette machine, écrits comme ceux de l'hôte (relevés par la sonde) : `linux-x64`, `darwin-arm64` (R16). */
+const localPlatform = () => `${process.platform}-${process.arch}`;
+/** ssh a perdu la connexion pendant une commande de la porte déportée (code 255, R6) : la porte est rejouée en local. */
+export class ConnectionLost extends Error {
+}
+const sshArgs = (c) => ['-o', 'BatchMode=yes', '-o', `ConnectTimeout=${c.connectS ?? CONNECT_S}`, ...(c.tty ? ['-tt'] : []), '--', c.host, c.script];
+function killGroup(pgid) {
+    try {
+        process.kill(-pgid, 'SIGKILL');
+    }
+    catch {
+        // groupe déjà vide
+    }
+}
+/** Un appel ssh non interactif (jamais de mot de passe : BatchMode). Le délai tue le ssh local et son groupe ; 255 est une connexion perdue (`lost`), 124 un délai. */
+function ssh(c) {
+    return new Promise((resolveRan) => {
+        const child = spawn('ssh', sshArgs(c), { env: c.env, stdio: [c.stdin ? 'pipe' : 'ignore', 'pipe', 'pipe'], detached: true });
+        child.once('error', (e) => resolveRan({ code: 127, output: e.message }));
+        const pgid = child.pid;
+        if (pgid === undefined)
+            return;
+        c.stdin?.pipe(child.stdin).on('error', () => { });
+        let output = '';
+        for (const s of [child.stdout, child.stderr])
+            s.on('data', (d) => (output += d.toString()));
+        // Un terminal écrit « \r\n » : la sortie de la porte est celle d'une commande locale.
+        const text = () => output.replace(/\r\n/g, '\n');
+        // Au délai le ssh local est tué et la porte n'attend pas la fermeture de ses tubes : ce qui tourne encore sur l'hôte est arrêté par le nettoyage (R19).
+        const timer = c.timeoutMs
+            ? setTimeout(() => {
+                killGroup(pgid);
+                resolveRan({ code: 124, output: `${text()}\ndélai dépassé (${Math.round((c.timeoutMs ?? 0) / 60_000)} min)` });
+            }, c.timeoutMs)
+            : undefined;
+        child.once('close', (code) => {
+            clearTimeout(timer);
+            killGroup(pgid);
+            resolveRan({ code: code ?? 1, output: text(), lost: code === 255 });
+        });
+    });
+}
+/** La dernière ligne utile d'une sortie d'échec : la cause dite à l'humain. */
+const causeOf = (r) => r.output.trim().split('\n').filter(Boolean).slice(-1)[0] ?? `code ${r.code}`;
+/**
+ * Sonde l'hôte, y pousse le sha, prépare le cache de dépendances et le worktree (R3-R5, R15-R18). Un échec avant la première commande de la porte rend `ok: false`
+ * avec son étape : l'appelant se replie sur la porte locale, jamais un rouge (R4, R5). Le sha doit être hexadécimal (R18) : refusé avant toute commande ssh.
+ */
+export async function openRemoteGate(o) {
+    if (!isSha(o.sha))
+        throw new Error(`sha invalide pour la porte déportée : ${o.sha}`);
+    // Dès la préparation (gate.install dure jusqu'à 30 min) et jusqu'à `close`, Ctrl-C ou un signal arrête ce qui tourne sur l'hôte et en retire le worktree (R10, R19).
+    let forget = () => { };
+    try {
+        const opened = await prepare(o, (w) => {
+            forget = onTermination(() => {
+                cleanupHost(o, w);
+            });
+        });
+        if (!opened.ok)
+            forget();
+        else {
+            const close = opened.gate.close;
+            opened.gate.close = () => {
+                forget();
+                return close();
+            };
+        }
+        return opened;
+    }
+    catch (e) {
+        forget();
+        // Une erreur locale (sha absent du dépôt, git illisible) n'est pas un rouge : la porte se replie en local, avec la cause (R5).
+        return { ok: false, stage: 'host', cause: e instanceof Error ? e.message.split('\n')[0] : String(e) };
+    }
+}
+/** Sonde l'hôte (R4) : sa plateforme et ses cœurs, ou la cause de son silence. */
+async function probeHost(o) {
+    const probe = await ssh({ host: o.host, env: o.env, connectS: PROBE_CONNECT_S, timeoutMs: 30_000, script: 'uname -s; uname -m; nproc 2>/dev/null || getconf _NPROCESSORS_ONLN' });
+    if (probe.code !== 0)
+        return causeOf(probe);
+    // Une bannière de connexion (motd, .bashrc bavard) précède la sortie : les trois dernières lignes sont celles de la sonde.
+    const [os = '', arch = '', cores = ''] = probe.output.trim().split('\n').map((l) => l.trim()).slice(-3);
+    const nproc = Number.parseInt(cores, 10);
+    return { platform: `${os.toLowerCase()}-${archOf(arch)}`, cores: Number.isFinite(nproc) && nproc >= 1 ? nproc : 1 };
+}
+/** Crée le dossier de travail de l'hôte (dépôt nu créé à part puis renommé : deux portes simultanées ne s'y disputent pas, orphelins retirés même si le renommage échoue, R17, R19) et y pousse le sha (R5) ; rend la cause d'un échec. */
+async function pushSha(o, w) {
+    const { host, env } = o;
+    const { head, bare, root } = w;
+    const init = await ssh({
+        host,
+        env,
+        script: `${head}set -e; mkdir -p "$R/deps" "$R/wt"; [ -d ${bare} ] || { git init --bare -q ${bare}.init-$$ && mv ${bare}.init-$$ ${bare} 2>/dev/null || true; }; rm -rf ${bare}.init-$$ ${bare}/repo.git.init-$$; [ -d ${bare} ]; ` +
+            `find "$R/wt" -mindepth 1 -maxdepth 1 -mmin +${ORPHAN_MIN} -exec rm -rf {} + 2>/dev/null || true; ` +
+            `find "$R/deps" -mindepth 1 -maxdepth 1 -name '.tmp-*' -mmin +${ORPHAN_MIN} -exec rm -rf {} + 2>/dev/null || true; git -C ${bare} worktree prune 2>/dev/null || true`,
+    });
+    if (init.code !== 0)
+        return `dépôt de travail impossible : ${causeOf(init)}`;
+    const push = await new Promise((res) => {
+        const child = spawn('git', ['push', '-q', '--no-verify', `${host}:${root}/repo.git`, `${o.sha}:refs/cadence-gate/${o.sha}`], { cwd: o.repo, env: { ...env, GIT_SSH_COMMAND: `ssh -o BatchMode=yes -o ConnectTimeout=${CONNECT_S}`, GIT_TERMINAL_PROMPT: '0' }, stdio: ['ignore', 'pipe', 'pipe'] });
+        let output = '';
+        for (const s of [child.stdout, child.stderr])
+            s.on('data', (d) => (output += d.toString()));
+        child.once('error', (e) => res({ code: 127, output: e.message }));
+        child.once('close', (code) => res({ code: code ?? 1, output }));
+    });
+    if (push.code === 0)
+        return null;
+    // Deux pushes simultanés du même sha (vague en parallèle, verify --gate) se disputent la même référence : le perdant échoue alors que le sha est arrivé.
+    const there = await ssh({ host, env, script: `${head}git -C ${bare} cat-file -e ${shq(`${o.sha}^{commit}`)}` });
+    return there.code === 0 ? null : `push du sha impossible : ${causeOf(push)}`;
+}
+/** Arrête ce qui tourne encore de cette porte sur l'hôte et en retire les worktrees et le cache temporaire (R10, R19) ; rend la cause si l'hôte n'a pas pu être nettoyé. */
+function cleanupHost(o, w) {
+    const { head, bare, id } = w;
+    const script = `${head}for i in ${id} ${id}-i; do if [ -f "$R/wt/$i.pid" ]; then p=$(cat "$R/wt/$i.pid"); kill -s KILL -- "-$p" 2>/dev/null || true; fi; ` +
+        `git -C ${bare} worktree remove --force "$R/wt/$i" 2>/dev/null || rm -rf "$R/wt/$i"; rm -f "$R/wt/$i.pid"; done; rm -rf "$R/deps/.tmp-${id}"; git -C ${bare} worktree prune 2>/dev/null || true`;
+    const r = spawnSync('ssh', sshArgs({ host: o.host, env: o.env, script }), { env: o.env, encoding: 'utf8', timeout: 30_000 });
+    return r.status === 0 ? null : `${(r.stderr || r.stdout || `code ${r.status}`).trim().split('\n').slice(-1)[0]}`;
+}
+/**
+ * Le cache de dépendances du sha dans le worktree de l'hôte (R3) : copié s'il existe, sinon rempli (R15, R16) puis copié ; rend la ligne qui dit son état, ou `{ cause }`.
+ * Sans lockfile au sha, il n'y a pas de cache.
+ */
+async function prepareCache(o, w, hostPlatform) {
+    const prints = lockfileFingerprint(o.repo, o.sha);
+    if (!prints)
+        return 'sans cache (aucun lockfile au sha)';
+    const { head, wt } = w;
+    const short = prints.fp.slice(0, 8);
+    const keyInstall = `${prints.fp}-${hostPlatform}`;
+    const copyDeps = () => ssh({
+        host: o.host,
+        env: o.env,
+        script: `${head}set -e; for k in ${shq(keyInstall)} ${shq(prints.fp)}; do if [ -d "$R/deps/$k" ]; then ` +
+            `while IFS= read -r p; do mkdir -p ${wt}/"$(dirname "$p")"; cp -R "$R/deps/$k/$p" ${wt}/"$p"; done < "$R/deps/$k/.paths"; echo "HIT $k"; exit 0; fi; done; echo MISS`,
+    });
+    let r = await copyDeps();
+    if (r.code !== 0)
+        return { cause: `lecture du cache impossible : ${causeOf(r)}` };
+    if (!r.output.includes('MISS'))
+        return `cache utilisé (empreinte ${short})`;
+    const filled = o.install ? await fillByInstall(o, keyInstall, w.id, head, w.bare) : await fillByCopy(o, prints, hostPlatform, w.id, head);
+    if (typeof filled === 'string')
+        return { cause: filled };
+    r = await copyDeps();
+    if (r.code !== 0 || !r.output.includes('HIT'))
+        return { cause: `cache introuvable après remplissage : ${causeOf(r)}` };
+    return `cache rempli ${o.install ? 'par gate.install' : 'par copie des dépendances locales'} (empreinte ${short})`;
+}
+async function prepare(o, onWork) {
+    const { host, env } = o;
+    const probe = await probeHost(o);
+    if (typeof probe === 'string')
+        return { ok: false, stage: 'host', cause: probe };
+    const id = `${Date.now().toString(36)}-${randomBytes(4).toString('hex')}`;
+    const root = `.cadence-gate/${basename(resolve(o.repo))}`;
+    const w = { id, root, head: `R="$PWD"/${shq(root)}; `, bare: '"$R/repo.git"', wt: `"$R/wt/${id}"` };
+    onWork(w);
+    const pushed = await pushSha(o, w);
+    if (pushed)
+        return { ok: false, stage: 'host', cause: pushed };
+    const fail = (cause, stage) => {
+        cleanupHost(o, w);
+        return { ok: false, stage, cause };
+    };
+    const add = await ssh({ host, env, script: `${w.head}set -e; git -C ${w.bare} worktree add -q --detach ${w.wt} ${shq(o.sha)}` });
+    if (add.code !== 0)
+        return fail(`worktree impossible : ${causeOf(add)}`, 'host');
+    const cache = await prepareCache(o, w, probe.platform);
+    if (typeof cache !== 'string')
+        return fail(cache.cause, 'cache');
+    const workers = o.workers(probe.cores);
+    const gate = {
+        host,
+        cache,
+        run: (command, timeoutMs) => ssh({ host, env, tty: true, timeoutMs, script: `${w.head}echo $$ > "$R/wt/${id}.pid"; cd ${w.wt} && export CADENCE_TEST_WORKERS=${workers} && exec sh -c ${shq(command)}` }),
+        close: () => cleanupHost(o, w),
+    };
+    return { ok: true, gate };
+}
+/** Remplit le cache `key` en jouant `gate.install` sur l'hôte, dans un worktree au sha (R15) ; rend la cause d'un échec. */
+async function fillByInstall(o, key, id, head, bare) {
+    const iw = `"$R/wt/${id}-i"`;
+    const tmp = `"$R/deps/.tmp-${id}"`;
+    const dirs = o.worktreeDeps
+        ? `for p in ${o.worktreeDeps.map(shq).join(' ')}; do [ -e "$p" ] && echo "$p"; done`
+        : `find . -name .git -prune -o \\( -name node_modules -o -name .venv \\) -type d -print -prune`;
+    const script = `${head}echo $$ > "$R/wt/${id}-i.pid"; set -e; git -C ${bare} worktree add -q --detach ${iw} ${shq(o.sha)}; cd ${iw}; sh -c ${shq(o.install)}; ` +
+        `mkdir -p ${tmp}; : > ${tmp}/.paths; (${dirs}) | while IFS= read -r p; do p="\${p#./}"; mkdir -p ${tmp}/"$(dirname "$p")"; cp -R "$p" ${tmp}/"$p"; echo "$p" >> ${tmp}/.paths; done; ` +
+        `cd "$R"; git -C ${bare} worktree remove --force ${iw} || true; mv ${tmp} "$R/deps/${key}" 2>/dev/null || true; rm -rf "$R/deps/${key}/.tmp-${id}" ${tmp}; [ -d "$R/deps/${key}" ]`;
+    const r = await ssh({ host: o.host, env: o.env, tty: true, timeoutMs: o.timeoutMs, script });
+    return r.code === 0 ? null : `gate.install en échec sur ${o.host} (code ${r.code}) : ${causeOf(r)}`;
+}
+/** Remplit le cache par copie des dépendances locales, seulement si elles méritent l'empreinte du sha et viennent de la même plateforme que l'hôte (R16) ; rend la cause d'un refus ou d'un échec. */
+async function fillByCopy(o, prints, hostPlatform, id, head) {
+    if (localPlatform() !== hostPlatform)
+        return `gate.install absent et plateforme locale ${localPlatform()} différente de celle de l'hôte ${hostPlatform} : dépendances locales non copiées`;
+    if (diskFingerprint(o.depsFrom, prints.files) !== prints.fp)
+        return 'gate.install absent et lockfile local différent de celui du sha : dépendances locales non copiées';
+    let paths;
+    try {
+        paths = o.worktreeDeps ? o.worktreeDeps.filter((n) => existsSync(join(o.depsFrom, n))) : ignoredDeps(o.depsFrom).filter(isCopiedDep);
+    }
+    catch (e) {
+        return `dépendances locales illisibles (${gitFailure(e)})`;
+    }
+    if (!paths.length)
+        return 'gate.install absent et aucune dépendance locale à copier';
+    const tmp = `"$R/deps/.tmp-${id}"`;
+    const tar = spawn('tar', ['-cf', '-', '-C', o.depsFrom, ...paths], { stdio: ['ignore', 'pipe', 'pipe'] });
+    const tarDone = new Promise((res) => {
+        tar.once('error', () => res(127));
+        tar.once('close', (c) => res(c ?? 1));
+    });
+    const up = await ssh({ host: o.host, env: o.env, timeoutMs: o.timeoutMs, stdin: tar.stdout, script: `${head}set -e; mkdir -p ${tmp}; tar -xf - -C ${tmp}` });
+    const tarCode = await tarDone;
+    if (up.code !== 0 || tarCode !== 0)
+        return `copie des dépendances locales impossible : ${tarCode !== 0 ? `tar code ${tarCode}` : causeOf(up)}`;
+    const key = prints.fp;
+    const publish = await ssh({
+        host: o.host,
+        env: o.env,
+        script: `${head}set -e; printf '%s\\n' ${paths.map(shq).join(' ')} > ${tmp}/.paths; mv ${tmp} "$R/deps/${key}" 2>/dev/null || true; rm -rf "$R/deps/${key}/.tmp-${id}" ${tmp}; [ -d "$R/deps/${key}" ]`,
+    });
+    return publish.code === 0 ? null : `publication du cache impossible : ${causeOf(publish)}`;
+}

package/dist/state.js

@@ -156,6 +156,10 @@ export function pidAlive(pid) {
 export function appendDelivery(dir, day, sha) {
     appendFileSync(join(dir, 'deliveries.log'), `${day} ${sha}\n`);
 }
+/** Ajoute une étape à `deliveries-steps.log` (ajout seul, une ligne JSON par étape) ; `deliveries.log` n'est pas touché. */
+export function appendStep(dir, step) {
+    appendFileSync(join(dir, 'deliveries-steps.log'), `${JSON.stringify(step)}\n`);
+}
 /** Classe d'une livraison rouge : où elle a cassé. `refus` : le script a refusé avant d'agir (code 2). */
 export const FAIL_CLASSES = ['refus', 'ci', 'deploiement', 'verification'];
 const TAIL_SEP = ' ⏎ ';

package/dist/verify-gate-remote.js

@@ -0,0 +1,55 @@
+import { configuredCap } from './orchestrate/command.js';
+import { testWorkersFrom } from './orchestrate/workers.js';
+import { ConnectionLost, GATE_TIMEOUT_MS, isSha, openRemoteGate } from './remote-gate.js';
+/**
+ * La porte de `cadence verify --gate` sur l'hôte `orchestrate.gate.host` (L403) : sha poussé, cache de dépendances, worktree jetable distant ; les mêmes étapes que la porte locale (`play` est son `runSteps`), le même verdict.
+ * Rend le code de la porte, ou null quand elle doit être jouée en local : pas d'hôte, `verify.inPlace: true` qui impose l'arbre principal (R9), hôte injoignable, push ou cache impossible (R4, R5, jamais un rouge),
+ * ou connexion perdue pendant une commande (R6, la porte entière est rejouée en local). Un autre code non nul d'une commande reste son verdict (R8). Le worktree distant est retiré dans tous les cas, au signal compris (R10, R19).
+ */
+export async function tryRemote(ctx, short, replayReason, play) {
+    const { repo, sha, config, out } = ctx;
+    const host = config.gate?.host;
+    if (!host)
+        return null;
+    if (ctx.verify?.inPlace === true) {
+        out(`verify --gate : verify.inPlace demande l'arbre principal, l'hôte ${host} est ignoré`);
+        return null;
+    }
+    if (!isSha(sha)) {
+        out('verify --gate : sha invalide pour la porte déportée (hexadécimal attendu)');
+        return 2;
+    }
+    const base = ctx.env ?? process.env;
+    const timeout = ctx.timeoutMs ?? GATE_TIMEOUT_MS;
+    const opened = await openRemoteGate({ host, install: config.gate?.install, repo, sha, depsFrom: repo, worktreeDeps: config.worktreeDeps, env: base, timeoutMs: timeout, workers: (cores) => testWorkersFrom(base, cores, configuredCap(base)) });
+    if (!opened.ok) {
+        out(opened.stage === 'host' ? `verify --gate : porte déportée indisponible sur ${host} (${opened.cause}) — repli sur la porte locale` : `verify --gate : cache de dépendances impossible sur ${host} (${opened.cause}) — repli sur la porte locale`);
+        return null;
+    }
+    const gate = opened.gate;
+    out(`verify --gate ${short} : porte jouée sur l'hôte ${host} (sha ${short}, ${gate.cache})`);
+    // Les lignes des étapes sont tenues jusqu'au bout : une connexion perdue en cours de porte la fait rejouer en local, les ✓ de l'hôte ne seraient pas ceux du verdict.
+    const lines = [replayReason];
+    try {
+        const { code, summary } = await play(async (cmd) => {
+            const r = await gate.run(cmd, timeout);
+            if (r.lost)
+                throw new ConnectionLost();
+            return r;
+        }, (l) => lines.push(l));
+        for (const l of [...lines, summary])
+            out(l);
+        return code;
+    }
+    catch (e) {
+        if (!(e instanceof ConnectionLost))
+            throw e;
+        out(`verify --gate : connexion perdue avec ${host} pendant la porte — rejouée en local`);
+        return null;
+    }
+    finally {
+        const orphan = gate.close();
+        if (orphan)
+            out(`verify --gate : nettoyage de l'hôte ${host} en échec (${orphan}) — le worktree orphelin y sera retiré au prochain appel`);
+    }
+}

package/dist/verify-gate.js

@@ -9,10 +9,11 @@ import { sharedStateDir } from './state.js';
 import { activeLock, REPO_LOCK } from './orchestrate/lock.js';
 import { failedTests, hasUnnamedFailure, unloadedSuites } from './orchestrate/baseline.js';
 import { configuredCap } from './orchestrate/command.js';
-import { replayRed, TEST_WORKERS_ENV, testWorkersFrom } from './orchestrate/workers.js';
+import { TEST_WORKERS_ENV, testWorkersFrom } from './orchestrate/workers.js';
+import { gateLabel, gateReplayable, gateUnnamed, replayGate, runGate } from './orchestrate/gate-parts.js';
 import { copyDeps, git, gitFailure, ignoredDeps, isCopiedDep } from './orchestrate/worktree.js';
-/** Délai de chaque commande de la porte : celui du rejeu de la ligne de base de la vague. */
-const GATE_TIMEOUT_MS = 30 * 60_000;
+import { tryRemote } from './verify-gate-remote.js';
+import { GATE_TIMEOUT_MS } from './remote-gate.js';
 /** Lignes de la fin de la sortie montrées quand aucun test n'est identifiable dans une sortie rouge. */
 const TAIL_LINES = 10;
 function killGroup(pgid) {
@@ -112,11 +113,24 @@ export async function verifyGate(ctx) {
     }
     return code;
 }
+/** La porte déjà jouée par une vague au même arbre (L397) : son verdict est repris, rien n'est rejoué. */
+function reuseRecorded(f, steps, sha, out) {
+    const short = sha.slice(0, 7);
+    const where = f.checked === sha ? 'au même sha' : `au sha ${f.checked.slice(0, 7)}, sous les seuls commits de plan de ${short}`;
+    out(`verify --gate ${short} : verdict repris de la porte de la vague ${f.wave} (lot ${f.lot} : contrôles du programme ${where}, arbre ${f.tree.slice(0, 7)} identique) — rien rejoué`);
+    for (const step of steps) {
+        const run = f.runs.find((r) => r.label === (step.name === 'build' ? 'build' : 'tests') && r.command === step.cmd);
+        out(`✓ ${step.name} (${step.cmd}) — enregistré par la vague${run.instables?.length ? `, ${run.instables.length} test(s) instable(s) sous charge, verts rejoués seuls` : ''}`);
+    }
+    out(`verify --gate ${short} : vert`);
+    return 0;
+}
 async function playGate(ctx) {
     const { repo, sha, config, out } = ctx;
+    // `cmd` est le libellé (celui du CheckRun d'une vague, pour reprendre son verdict) ; `gate` ce qui est joué : pour des parties (L512), chacune dans son dossier.
     const steps = [
-        ...(config.build ? [{ name: 'build', cmd: config.build }] : []),
-        ...(config.test ? [{ name: 'tests', cmd: config.test }] : []),
+        ...(config.build ? [{ name: 'build', cmd: config.build, gate: config.build }] : []),
+        ...(config.test ? [{ name: 'tests', cmd: gateLabel(config.test), gate: config.test }] : []),
     ];
     const short = sha.slice(0, 7);
     const base = ctx.env ?? process.env;
@@ -128,25 +142,19 @@ async function playGate(ctx) {
     let recorded = { reason: 'aucune porte de vague enregistrée pour ce sha' };
     try {
         // Un test qui lit le plan (orchestrate.gate.readsPlan, L450) voit un autre contenu après un `raf done` : les commits de plan seuls ne sont pas traversés.
-        recorded = recordedGate(ctx.launchDirs ?? [], repo, sha, steps, config.gate ? undefined : ctx.planFile);
+        recorded = recordedGate(ctx.launchDirs ?? [], repo, sha, steps, config.gate?.readsPlan ? undefined : ctx.planFile);
     }
     catch (e) {
         recorded = { reason: `état des vagues illisible (${gitFailure(e)})` };
     }
-    if ('found' in recorded) {
-        const f = recorded.found;
-        const where = f.checked === sha ? 'au même sha' : `au sha ${f.checked.slice(0, 7)}, sous les seuls commits de plan de ${short}`;
-        out(`verify --gate ${short} : verdict repris de la porte de la vague ${f.wave} (lot ${f.lot} : contrôles du programme ${where}, arbre ${f.tree.slice(0, 7)} identique) — rien rejoué`);
-        for (const step of steps) {
-            const run = f.runs.find((r) => r.label === (step.name === 'build' ? 'build' : 'tests') && r.command === step.cmd);
-            out(`✓ ${step.name} (${step.cmd}) — enregistré par la vague${run.instables?.length ? `, ${run.instables.length} test(s) instable(s) sous charge, verts rejoués seuls` : ''}`);
-        }
-        out(`verify --gate ${short} : vert`);
-        return 0;
-    }
-    const replayReason = `verdict rejoué : ${recorded.reason}${config.gate && ctx.planFile ? ' (orchestrate.gate.readsPlan : un test lit le plan, les commits de plan seuls ne reprennent pas le verdict d\'un sha dessous)' : ''}`;
+    if ('found' in recorded)
+        return reuseRecorded(recorded.found, steps, sha, out);
+    const replayReason = `verdict rejoué : ${recorded.reason}${config.gate?.readsPlan && ctx.planFile ? ' (orchestrate.gate.readsPlan : un test lit le plan, les commits de plan seuls ne reprennent pas le verdict d\'un sha dessous)' : ''}`;
     const obstacle = mainTreeObstacle(repo, sha);
     const mode = ctx.verify?.inPlace;
+    const remote = await tryRemote(ctx, short, replayReason, (exec, emit) => runSteps(steps, exec, emit, config, short));
+    if (remote !== null)
+        return remote;
     if (mode === true && obstacle) {
         out(`verify --gate : verify.inPlace demande l'arbre principal, mais ${obstacle} — rien n'est joué`);
         return 2;
@@ -169,7 +177,7 @@ async function playGate(ctx) {
                 killGroup(group.pgid);
         });
         try {
-            const { code, summary } = await runSteps(steps, repo, ctx, group, env, short);
+            const { code, summary } = await runSteps(steps, (cmd) => sh(cmd, repo, ctx.timeoutMs ?? GATE_TIMEOUT_MS, group, env), ctx.out, config, short);
             // Une vague intègre ses lots par fast-forward dans cet arbre et y commite son plan : s'il a bougé pendant la porte, les commandes ont lu un mélange de commits.
             const moved = mainTreeMoved(repo, sha);
             if (moved === null) {
@@ -227,7 +235,7 @@ async function playGate(ctx) {
         out(replayReason);
         if (missing.length)
             out(`dépendances déclarées absentes de l'arbre principal, non copiées : ${missing.join(', ')}`);
-        const done = await runSteps(steps, dir, ctx, group, env, short);
+        const done = await runSteps(steps, (cmd) => sh(cmd, dir, ctx.timeoutMs ?? GATE_TIMEOUT_MS, group, env), out, config, short);
         out(done.summary);
         return done.code;
     }
@@ -236,12 +244,10 @@ async function playGate(ctx) {
         cleanup();
     }
 }
-/** Les étapes de la porte jouées dans `cwd` ; le code de sortie (0 vert, 1 rouge) et la ligne de verdict, écrite par l'appelant une fois sûr qu'elle vaut pour le sha. */
-async function runSteps(steps, cwd, ctx, group, env, short) {
-    const { config, out } = ctx;
+async function runSteps(steps, exec, out, config, short) {
     let red = 0;
     for (const step of steps) {
-        const r = await sh(step.cmd, cwd, ctx.timeoutMs ?? GATE_TIMEOUT_MS, group, env);
+        const r = await runGate(exec, step.gate);
         if (r.code === 0) {
             out(`✓ ${step.name} (${step.cmd})`);
             continue;
@@ -251,14 +257,15 @@ async function runSteps(steps, cwd, ctx, group, env, short) {
         const unloaded = tests ? unloadedSuites(r.output) : [];
         // `orchestrate.testReplay` comme la porte d'une vague (L354, L387) : un rouge nommé est rejoué seul avant d'être compté ; vert au rejeu, il est instable sous charge.
         // Un échec que la sortie ne rattache à aucun test, ou un fichier qui ne se charge pas, n'est jamais rejoué.
-        const replayable = tests && config.testReplay && names.length > 0 && unloaded.length === 0 && !hasUnnamedFailure(r.output);
+        // Porte en parties (L512) : une partie rouge sans test nommé, ou à échec sans nom, bloque tout rejeu (`gateUnnamed`) : l'instable d'une autre partie n'excuse jamais la porte.
+        const replayable = tests && gateReplayable(step.gate, config.testReplay) && names.length > 0 && unloaded.length === 0 && !gateUnnamed(r);
         const replays = [];
         const { red: still, unstable } = replayable
-            ? await replayRed(async (c) => {
-                const p = await sh(c, cwd, ctx.timeoutMs ?? GATE_TIMEOUT_MS, group, env);
+            ? await replayGate(async (c) => {
+                const p = await exec(c);
                 replays.push(p.code);
                 return p;
-            }, config.testReplay, names, r.output)
+            }, config.testReplay, names, r)
             : { red: names, unstable: [] };
         if (replayable && still.length === 0) {
             out(`✓ ${step.name} (${step.cmd}) — ${unstable.length} test(s) rouge(s) sous charge, verts rejoués seuls (instables sous charge) :`);
@@ -268,6 +275,8 @@ async function runSteps(steps, cwd, ctx, group, env, short) {
         }
         red++;
         out(`✗ ${step.name} (${step.cmd}) — code ${r.code}`);
+        if (r.parts)
+            out(`  parties rouges : ${r.parts.filter((p) => p.code !== 0).map((p) => `${p.part.dir} (code ${p.code})`).join(', ')}`);
         for (const n of still)
             out(`  - ${n}`);
         for (const n of unloaded)

package/docs/corrections.md

@@ -33,3 +33,7 @@ The cause `bug-code` alone is 69 % of the classified passes (74 of 107, 24→30-
 - The report gains the section « Bug de code par sous-cause » (sub-cause, passes, share of the sub-classified passes, link) and a line « Maillon dominant ». `--json` gains the key `bugCode` — `{ classees, sansSousCause, parSousCause, maillon: { nom, raison } }`. With no `bug-code` pass in the window nothing is added: the text report and the JSON keys are those of before.
 
 **The link.** Each sub-cause belongs to one link of the chain: `cas-limite` and `test-vide` to the `implement` brief, `affirmation-fausse` and `appelant-oublie` to the self-check before handing back, `test-casse` to the local gate, `contrat-mal-lu` to the sheet, `autre` to none. The **dominant link** is the one whose sub-causes weigh the most passes; it is named only when at least 10 passes are sub-classified and its passes are at least 40 % of them. With fewer, with a link under 40 %, or with two links tied at the top, the line says « aucun » and why. The two thresholds and the table are constants of `src/corrections.ts` (hypotheses: the link is recomputed at each read, nothing stores it). `cadence perf` prints the same count under « causes dominantes » for the current 7-day window — `bug de code (N passes sous-classées sur M) : 1. cas limite … · maillon dominant : …` — reading the cache without writing it: an absent file gives `sous-causes n/d · à classer : cadence corrections --classify`, an unreadable one a warning on stderr (`perf : <file> illisible, sous-causes n/d`) and no line, exit code 0 in both cases (`corrections.causes.current.bugCode` in `--json`). Over 7 days the 10-pass threshold is often not reached: « aucun » is then the usual answer, not an error.
+
+## Passes launched on tests that ended without a code change (L510)
+
+A pass with no review finding to read is a pass the gate launched on **red tests** right after a write session (`sans revue (tests rouges)` above). When such a pass ends with **no commit**, the session found nothing to change: the red was a false red (a timeout under load, a test that was already red) or the test needed no fix. `cadence corrections` prints, after the report, `N passes lancées sur des tests, M terminées sans changement de code (P %)` (nothing when there is no pass on tests) and adds `testsSansCode: { passes, sansCode }` to `--json`. The line is outside the report of the 10-10 baseline, which `test/corrections-mesure.test.ts` replays word for word. Two windows are measured with `--since` and `--until` (a window of creation dates of the waves, see above): the figures of the last two 7-day windows are in [mesures/tests-sans-code-2026-11-01.md](mesures/tests-sans-code-2026-11-01.md).

package/docs/deliver.md

@@ -133,6 +133,24 @@ cadence deliver              # 0 delivered and verified · 1 a step failed · 2
   5 minutes is a failure (you probably pushed another commit than the one you
   deliver); every run must end `success`, `skipped` or `neutral`. `gh` errors
   are retried, and reported with their cause after 5 minutes.
+- **CI not waited for on a plan-only sha** (L516): with `ci: github` or a CI command (no `deliver.script`, which
+  carries its own CI), when the previous delivery (`deliveries.log`) is an ancestor of the sha and **every** commit of
+  `previous..sha` only touches the plan (the same test as `raf check`, `isPlanOnly`), nothing is waited for: no
+  `gh run list`, no CI command. The output says `→ CI : non attendue (aucun fichier hors plan depuis <previous sha>)`
+  and the deploy and the checks run as usual. One commit that touches anything else (source, tests, docs,
+  `cadence.yaml` outside its `plan` key) is enough to wait for the CI as before; so is any case where this cannot be
+  proved: no previous delivery, a previous delivery outside the history of the sha or equal to it, no plan loaded, an
+  unreadable or empty range. `--dry-run` announces it with the same words on its CI line (`CI : non attendue (…)`).
+- **Timestamps and step journal** (L516): every step line of the output (`→ script`, `→ CI`, `→ déploiement i/n`,
+  `→ vérification i/n`, `✓ livré`) starts with the UTC time `HH:MM:SS`, and `✓ livré` ends with `en N s`, the time
+  since the lock was taken. The failure messages, the exit codes, `deliveries.log` (`day sha`) and
+  `deliveries-failed.log` are unchanged. Each step played (the CI wait, each deploy command, each check) also appends
+  one JSON line to `<git common dir>/cadence/deliveries-steps.log`, append-only, with the keys `lots` (lots cited since
+  the previous delivery, `[]` if none), `sha`, `projet`, `etape` (`ci`, `deploiement i/n`, `verification i/n`), `debut`
+  and `fin` (ISO 8601 UTC), `duree_s` (seconds, rounded) and `resultat` (`ok` or `echec`). A failing step writes its
+  `echec` line before `deliver` exits 1; steps not played write nothing (no `ci` line when the CI is not waited for or
+  `ci: none`). The project script (`deliver.script`) is not a step of this journal. `--dry-run` writes nothing. A write
+  error only prints a warning (`deliver : journal des étapes non écrit : <cause>`): the delivery and its code stand.
 - Commands get `CADENCE_SHA`, `CADENCE_SHORT` (7 characters) and `CADENCE_BRANCH` (a `deliver.script` also gets `CADENCE_DEPLOYED_FILE`, see below);
   `${SHA}` and `${SHORT}` are replaced in `url` and `contains`.
 - On success the lots cited by the commits since the previous delivery are
@@ -143,7 +161,7 @@ cadence deliver              # 0 delivered and verified · 1 a step failed · 2
   commits (see "Plan upkeep needs no lot") are skipped in that list: they cite
   lots without delivering anything.
 - With [`docs.articles`](news.md#an-article-elsewhere-that-follows-the-delivery), a green delivery of lots with a
-  public title also opens the lot `Article <project> à rafraîchir` in the plan (committed, with the files `plan.onWrite` produces, when a wave holds the repository, L388).
+  public title also opens the lot `Article <project> à rafraîchir` in the plan (committed, with the files `plan.onWrite` produces, during a wave as well as outside one, L388, L420).
 
 ## A project with its own delivery script
 
@@ -317,6 +335,8 @@ verify --gate 6b0d9aa : vert
 
 Nothing runs: no worktree, no copy of the dependencies, exit 0. Otherwise the gate is **replayed** exactly as described above, and the line right after the one telling where it ran gives the reason: `verdict rejoué : aucune porte de vague enregistrée pour ce sha` (no wave state, another sha such as the head after an integration that rebased, a commit that also touches another file (a plan-only commit is crossed, L444), another repository), `arbre différent de celui contrôlé`, `arbre non enregistré` (state written before L397), or `l'enregistrement (vague …, lot …) ne couvre pas en vert test (…)` (a red, missing or changed step). A recorded red is never repeated as a verdict: it is replayed. The verdict read is the one of the wave's gate (with `orchestrate.testReplay` applied), not a new run: to force a replay, ask for a sha the wave did not check.
 
+**On another machine (L403).** With `orchestrate.gate.host` in `cadence.yaml` the gate is played by ssh on that host, at the sha pushed there, with a dependency cache; it falls back to the local gate when the host does not answer, and replays locally a command whose connection was lost: [docs/remote-gate.md](remote-gate.md).
+
 **A test that reads the plan (L450).** Crossing the plan-only commits assumes that no test reads the plan. On 30-10 avatar-pandora's `plan-page.e2e`, which reads `.cadence/raf.yaml`, went red after the `raf done` of L8 while the head gate, taking over the wave's verdict under that commit, saw nothing. A project whose gate has such a test declares it: `orchestrate.gate: { readsPlan: true }` (or `readsPlan: [e2e/plan-page.e2e.ts]`, the paths of the tests that read it; a non-empty list of relative paths without `..`, anything else is refused when `cadence.yaml` is read). The verdict of a sha *below* plan-only commits is then never taken over: the gate is replayed at the sha asked, and the reason line ends with `(orchestrate.gate.readsPlan : un test lit le plan, …)`. A verdict recorded at the very sha asked is still taken over. Absent or `false`: unchanged. The pre-push hook keeps crossing plan-only commits (its rule, L432, is not changed here).
 
 ```yaml
@@ -342,7 +362,7 @@ verify --gate 6b0d9aa : rouge (1 étape sur 2)
 
 Both commands always run, even when the first is red, so the report is whole. A red step lists the failing
 tests the output names (the same reading as the wave's baseline) and the test files that do not load (`- test/a.test.ts (ne se charge pas)`, the typical sign of a missing dependency); with none identifiable (or when an unnamed failure is mixed with them), the last 10 lines of the output, each prefixed `  | `: a red that names no test, seen three times under load on 27-10 (L380, B28.17), is no longer a bare exit code.
-With `orchestrate.testReplay` declared (`docs/orchestrate.md`, « A red test is replayed alone »), the gate does what a wave does: a red test the output names is **replayed alone, twice at most**, in the same throwaway worktree. Green at a replay it is *unstable under load*: the step prints `✓ tests (…) — N test(s) rouge(s) sous charge, verts rejoués seuls (instables sous charge) :` with the names and does not make the gate red; the tests still red stay listed and the unstable ones follow, under a line of their own. A failure the output ties to no test, or a file that does not load, is never replayed and stays red. When a replay took place and the step stays red, one line says so (`rejeu seul (orchestrate.testReplay) : N rejeu(x), dernier code C — k test(s) confirmé(s) vert(s) sur n`): a replay that fails or runs no test confirms nothing, and the line tells a real red from a replay that could not run. Without `testReplay` nothing is replayed.
+With `orchestrate.testReplay` declared (`docs/orchestrate.md`, « A red test is replayed alone »), the gate does what a wave does: a red test the output names is **replayed alone, twice at most**, in the same throwaway worktree. Green at a replay it is *unstable under load*: the step prints `✓ tests (…) — N test(s) rouge(s) sous charge, verts rejoués seuls (instables sous charge) :` with the names and does not make the gate red; the tests still red stay listed and the unstable ones follow, under a line of their own. A failure the output ties to no test, or a file that does not load, is never replayed and stays red. With `orchestrate.test` declared as a list of parts (L512, `docs/orchestrate.md`, « A gate declared in parts »), the `tests` step is labelled `dir : run ; dir : run`, every part is played in its folder, a red step also prints `parties rouges : <dir> (code N), …`, and each red test is replayed alone by the `replay` of the part that printed it, in that folder (a name printed by several parts must be green in each of them). When a replay took place and the step stays red, one line says so (`rejeu seul (orchestrate.testReplay) : N rejeu(x), dernier code C — k test(s) confirmé(s) vert(s) sur n`): a replay that fails or runs no test confirms nothing, and the line tells a real red from a replay that could not run. Without `testReplay` nothing is replayed.
 Each command has 30 minutes (then its whole process group is killed, code 124). Ctrl-C, SIGTERM or a hangup received by cadence kills the running command and removes the worktree before cadence dies.
 `--sha` is required (the moving head of a wave is not a sha to re-verify) and `--retry` does not apply. Exit code:
 **0** green · **1** red · **2** nothing to replay (neither `orchestrate.build` nor `orchestrate.test`), unknown sha, a worktree that cannot be made, or `verify.inPlace: true` with a main tree not clean at the sha.

package/docs/lead.md

@@ -58,7 +58,9 @@ picture, not its source.
    soon as the folder keeps several unfinished waves). While the wave is still running the same command (or
    `cadence orchestrate --answer <project>:<lot> "…"`) queues the answer and the live wave replays the lot at
    once, whatever the other lots do (L407). The lead never answers in the
-   human's place. `--drop` and `--stop-after-current` steer a wave that is running.
+   human's place. `--drop` and `--stop-after-current` steer a wave that is running, and
+   `cadence orchestrate --add <project>:<lot> [--wave <wave>]` adds a lot to it instead of launching a second
+   wave, which is refused in a repository the first one holds; the refusal names this command (L421).
 4. **Review.** The final table of the wave lists the lots ready, handed back, and the line
    « livrable jusqu'à <sha> » for a ready lot stacked under a handed-back one. Minor findings come back in
    the table: one becomes a lot of its own only if it describes an observable bug.

package/docs/news.md

@@ -201,10 +201,8 @@ else all the `##` headings. The lot is then played like any other, in an ordinar
 implementer rewrites the article in the neighbouring repository, the review checks it against the note). If a lot
 of that title is still open, it receives a note instead of a duplicate. Two entries with the same name (the same
 project told in two neighbouring repositories) share one lot, which declares both repositories in `repos:`. Internal lots (no public title) open nothing;
-a red delivery opens nothing; `cadence deliver --dry-run` announces the articles. Outside a wave the plan is written but **not
-committed**: the line `article à rafraîchir : L9 …` says so. During a wave (`cadence deliver --sha`), the plan is committed with the files that `plan.onWrite` produces from it,
-using the `plan.commit` template (`plan: L9 article à rafraîchir ouvert (orchestrate <wave>)` by default), so no plan change is left in the tree a session
-of the wave works in; if the plan or one of those files already had uncommitted changes (the commit would carry them away), or the commit is refused (a `commit-msg` hook), nothing is committed, it stays written and the line says so. With a plan kept by another
+a red delivery opens nothing; `cadence deliver --dry-run` announces the articles. The plan is committed with the files that `plan.onWrite` produces from it,
+using the `plan.commit` template (`plan: L9 article à rafraîchir ouvert (orchestrate <wave>)` by default, `plan: L9 article à rafraîchir ouvert` outside a wave), so no plan change is left in the tree, during a wave (L388) or when the deliverer is run by hand (L420); if the plan or one of those files already had uncommitted changes (the commit would carry them away), or the commit is refused (a `commit-msg` hook), nothing is committed, it stays written and the line says so. With a plan kept by another
 tool (read-only), the same line carries the instruction to open the lot with that tool. This replaces the manual
 `sync-site-docs` skill.