@ultimat3/cli 23.0.0 → 24.0.0

package/src/test-shards.ts

@@ -39,12 +39,12 @@
 // `@ultimat3/testing`'s preload clears the plugins after each file (`isolated-plugins.ts`). And the
 // per-WORKER database survives untouched: `@ultimat3/testing`'s `workerId` already read
 // `BUN_TEST_WORKER_ID` as its second key, which is exactly what Bun sets, 1..N, one per real
-// process (probed on 1.4.0). `ULTIMATE_TEST_WORKER` stays the first key and is what `--worker`
-// still sets, so a single-shard rerun keeps naming its own database.
+// process (probed on 1.4.0).
 
 // why: Bun ships no path-join primitive; the timings cache lives under the run's root.
 import { join } from 'node:path';
 import { ERROR_DOCS_URL } from '@ultimat3/core';
+import { ISOLATED_ENV } from '@ultimat3/testing';
 import type { AffectedSelection } from './affected';
 import type { Runner } from './exec';
 import { msg } from './messages';
@@ -52,8 +52,8 @@ import type { CommandResult, Finding, JsonValue, StepResult } from './output';
 import { quoteArg } from './shell-quote';
 import { testEnvOverrides } from './test-dotenv';
 
-/** `@ultimat3/testing`'s `ISOLATED_ENV`, restated: `cli → testing` is a runtime edge, kept to fixtures. */
-export const ISOLATED_TEST_ENV = 'ULTIMATE_TEST_ISOLATED';
+/** `@ultimat3/testing`'s `ISOLATED_ENV` — the one spelling, which that package's preload reads. */
+export const ISOLATED_TEST_ENV = ISOLATED_ENV;
 
 /** Bun's per-file durations, cached under the run's root and refreshed by every parallel run. */
 export const TEST_TIMINGS_FILE = '.x/test-timings.json';
@@ -68,24 +68,13 @@ import type { TestType } from './verify-tests';
  * The argv for one run. An explicit file list, never a re-glob: discovery already decided which
  * files belong to this type, and a child that globs again can pick up a file the selection removed.
  *
- * `--parallel=N` for the whole selection, `--shard=i+1/N` for one slice of it. The shard form is
- * `--worker`'s, and it carries `--isolate` in its own right — only `--parallel` implies it, and a
- * partition without a fresh module registry per file is the failure mode this whole design exists
- * to remove: measured on this repo, an 8-way split turned 0 failures into 36, every one
- * `X_PERMISSION_UNKNOWN` in `@ultimat3/query` because the `packages/cli` file that had been
- * declaring `feed:read` for it landed elsewhere. Half a dozen registries here are process-global by
- * design — the permission set, the roles, the entity/action/query tables, the error-code titles,
- * the fixture bag — and a serial `bun test` only passes because glob order happens to put every
- * declaring file before every file that reads what it left behind.
- *
- * Bun's shard partition is round-robin over the list it is given, so the sorted list this hands it
- * makes `--shard=2/8` the same 1/8 on CI and on a laptop (probed on 1.4.0).
+ * `--parallel=N` over the selection, sorted, so two runs over one corpus hand Bun the same list.
+ * One CI job's share of the corpus is `x verify --only unit --shard i/n` (`verify-shard.ts`), never
+ * a flag here: `x test --worker I` was a second, 0-based, unhashed split of the same suite.
  */
 export function testArgs(input: {
   readonly files: readonly string[];
   readonly workers: number;
-  /** 0-based, matching `--worker`. Absent runs the whole selection across `workers` processes. */
-  readonly shard?: number;
   /**
    * Everything after a bare `--`, handed to `bun test` verbatim and BEFORE the file list, which is
    * where bun reads its flags. `ParsedArgs.passthrough` had no reader anywhere until 2026-09, so
@@ -114,32 +103,23 @@ export function testArgs(input: {
   const isolate =
     extra.includes('--isolate') || (input.isolate === true && !extra.includes('--no-isolate'));
   const bare = extra.filter((arg) => arg !== '--isolate' && arg !== '--no-isolate');
-  return input.shard === undefined
-    ? [
-        'bun',
-        'test',
-        `--parallel=${String(input.workers)}`,
-        ...(isolate ? [] : ['--no-isolate']),
-        ...(input.timings === undefined || bare.some((arg) => arg.startsWith('--timings'))
-          ? []
-          : [`--timings=${input.timings}`, '--update-timings']),
-        ...bare,
-        ...files,
-      ]
-    : [
-        'bun',
-        'test',
-        ...(isolate ? ['--isolate'] : []),
-        `--shard=${String(input.shard + 1)}/${String(input.workers)}`,
-        ...bare,
-        ...files,
-      ];
+  return [
+    'bun',
+    'test',
+    `--parallel=${String(input.workers)}`,
+    ...(isolate ? [] : ['--no-isolate']),
+    ...(input.timings === undefined || bare.some((arg) => arg.startsWith('--timings'))
+      ? []
+      : [`--timings=${input.timings}`, '--update-timings']),
+    ...bare,
+    ...files,
+  ];
 }
 
 /**
  * The files an argv selects, flags stripped. `bun test` takes its file list positionally, so this
  * is the inverse of `testArgs` and the one thing a test asserting "what did the child get?" needs
- * — the flag COUNT is not fixed (`--parallel=N` is one token, a shard run carries two more), and a
+ * — the flag COUNT is not fixed (`--no-isolate` and the timings pair come and go), and a
  * test slicing a hardcoded prefix length reads a flag as a filename the day that changes.
  */
 export const filesIn = (command: readonly string[]): readonly string[] =>
@@ -154,12 +134,9 @@ export interface ReproduceOptions {
   readonly sample?: number;
   /**
    * The `--affected` narrowing, when there was one. The input most easily forgotten: `--affected`
-   * decides which files exist to run at all, so a rerun without it selects the WHOLE corpus and
-   * its shard 2 is a different shard 2.
+   * decides which files exist to run at all, so a rerun without it selects the WHOLE corpus.
    */
   readonly affected?: AffectedSelection;
-  /** 0-based, when reproducing ONE shard. Absent reproduces the whole selection. */
-  readonly shard?: number;
   /** What the caller put after `--`. It reaches `bun test`, so a rerun without it runs differently. */
   readonly passthrough?: readonly string[];
   /** The run was isolated per file; the rerun must be too. */
@@ -185,7 +162,6 @@ export function reproduceFor(options: ReproduceOptions): string {
     ...(options.affected?.dirty === true ? ['--dirty'] : []),
     '--workers',
     String(options.workers),
-    ...(options.shard === undefined ? [] : ['--worker', String(options.shard)]),
     ...(options.isolate === true ? ['--isolate'] : []),
     // Last, and after a `--` of its own, because that is where the caller typed it and where the
     // parser will find it again. Quoted for `shell-quote.ts`'s reason: a reproduce line is pasted.
@@ -200,14 +176,11 @@ export interface RunShardsOptions {
   readonly runner: Runner;
   readonly files: readonly TestFile[];
   readonly workers: number;
-  /** Run exactly one shard of the same N-way split, not a one-worker run of everything. */
-  readonly only?: number;
   readonly filter?: string;
   readonly type?: TestType;
   /**
    * Set when `--sample` narrowed `files`: `kept` is what survived, `total` what discovery found.
-   * `kept` is carried rather than counted from what ran, because `--worker N` runs one shard of the
-   * sample and would otherwise report that shard's size as the corpus.
+   * Carried rather than counted from what ran: a pass runs part of the sample, never the corpus.
    */
   readonly sample?: { readonly kept: number; readonly total: number };
   /** Passed straight to `reproduceFor`: see `ReproduceOptions.affected`. */
@@ -248,7 +221,6 @@ const planOf = (
   ...(pass.type === undefined ? {} : { type: pass.type }),
   ...(options.sample === undefined ? {} : { sample: options.sample.kept }),
   ...(options.affected === undefined ? {} : { affected: options.affected }),
-  ...(options.only === undefined ? {} : { shard: options.only }),
   ...(options.isolate === true ? { isolate: true } : {}),
   ...(options.passthrough === undefined || options.passthrough.length === 0
     ? {}
@@ -256,17 +228,12 @@ const planOf = (
 });
 
 /**
- * `X_TEST_SHARD_FAILED` for a `--worker` run and `X_TEST_FAILED` for a whole one, because the two
- * name different reruns: a shard is reproduced by naming it, and a full run by rerunning it. Both
- * codes already exist and both are already documented — a third would be a new name for a failed
- * `bun test`.
+ * `X_TEST_FAILED`, whose `fix:` reruns exactly what failed. `X_TEST_SHARD_FAILED` was the
+ * `--worker` rerun's and went with it: the code stays registered (codes are forever) and unthrown.
  */
 export const failureOf = (code: number, files: number, plan: ReproduceOptions): Finding => ({
-  code: plan.shard === undefined ? 'X_TEST_FAILED' : 'X_TEST_SHARD_FAILED',
-  cause:
-    plan.shard === undefined
-      ? `${plan.type ?? 'test'} run exited ${code} across ${plan.workers} worker(s) (${files} file(s))`
-      : `shard ${plan.shard} of ${plan.workers} exited ${code} (${files} file(s))`,
+  code: 'X_TEST_FAILED',
+  cause: `${plan.type ?? 'test'} run exited ${code} across ${plan.workers} worker(s) (${files} file(s))`,
   fix: reproduceFor(plan),
   docs: ERROR_DOCS_URL,
 });
@@ -281,12 +248,10 @@ export const failureOf = (code: number, files: number, plan: ReproduceOptions):
  * it. And every pass runs even after one fails — the caller asked for a suite, and a report that
  * stops at the first red step hides the rest of the answer.
  *
- * `ULTIMATE_TEST_WORKER` is still set for a `--worker` rerun and only then: that run is one
- * process, so naming its database is this file's to do. A `--parallel` run has N of them and Bun
- * numbers each with `BUN_TEST_WORKER_ID`, which `@ultimat3/testing`'s `workerId` already reads.
+ * No `ULTIMATE_TEST_WORKER` here: a `--parallel` run has N processes and Bun numbers each with
+ * `BUN_TEST_WORKER_ID`, which `@ultimat3/testing`'s `workerId` already reads.
  */
 export async function runShards(options: RunShardsOptions): Promise<CommandResult> {
-  const only = options.only;
   // Computed ONCE per invocation, never per pass: every pass spawns from the same `root` and the
   // same parent env, so the leaked-key set cannot differ pass to pass.
   const envOverrides: Record<string, string | undefined> = {
@@ -302,7 +267,6 @@ export async function runShards(options: RunShardsOptions): Promise<CommandResul
     files: options.files,
     workers: options.workers,
     ...(options.type === undefined ? {} : { type: options.type }),
-    ...(only === undefined ? {} : { shard: only }),
   });
   const started = performance.now();
   const steps: StepResult[] = [];
@@ -312,53 +276,38 @@ export async function runShards(options: RunShardsOptions): Promise<CommandResul
   let exitCode = 0;
   for (const pass of passes) {
     const files = pass.files.map((file) => file.path);
-    // A `--worker` rerun is one process over one shard and is never split: shard i of the rerun
-    // must be the same files as shard i of the run it reproduces. Nor is `-- --watch`, which never
-    // exits, so a second batch would never start. Every other pass is spent in `test-batches.ts`'
-    // batches, one `bun test` after another.
-    const batches =
-      only === undefined && !watching
-        ? testBatches(
-            files,
-            pass.workers,
-            isolatedRun(options) ? BATCH_FILES_PER_WORKER : SHARED_BATCH_FILES_PER_WORKER,
-          )
-        : [files];
+    // `-- --watch` is never split: it never exits, so a second batch would never start. Every
+    // other pass is spent in `test-batches.ts`' batches, one `bun test` after another.
+    const batches = !watching
+      ? testBatches(
+          files,
+          pass.workers,
+          isolatedRun(options) ? BATCH_FILES_PER_WORKER : SHARED_BATCH_FILES_PER_WORKER,
+        )
+      : [files];
     const result = await runBatches({
       runner: options.runner,
       batches,
       stopOnFailure: bailing,
       workers: pass.workers,
-      // A `--worker` rerun is one process whatever its N says, and a serial pass is one worker:
-      // only a default-width parallel pass leases from the machine pool.
-      ...(only === undefined && pass.workers > 1 && options.lease !== undefined
-        ? { lease: options.lease }
-        : {}),
+      // A serial pass is one worker: only a default-width parallel pass leases from the pool.
+      ...(pass.workers > 1 && options.lease !== undefined ? { lease: options.lease } : {}),
       argsFor: (batch, width) =>
         testArgs({
           files: batch,
-          workers: only === undefined ? width : pass.workers,
-          ...(only === undefined ? {} : { shard: only }),
+          workers: width,
           ...(options.passthrough === undefined ? {} : { passthrough: options.passthrough }),
           ...(options.isolate === undefined ? {} : { isolate: options.isolate }),
           timings: join(options.root, TEST_TIMINGS_FILE),
         }),
       options: {
         cwd: options.root,
-        ...(Object.keys(envOverrides).length === 0 && only === undefined
-          ? {}
-          : {
-              env: {
-                ...envOverrides,
-                ...(only === undefined ? {} : { ULTIMATE_TEST_WORKER: String(only) }),
-              },
-            }),
+        ...(Object.keys(envOverrides).length === 0 ? {} : { env: envOverrides }),
       },
     });
     batchCount += batches.length;
     const plan = planOf(options, pass);
-    const label =
-      only === undefined ? `${pass.workers} worker(s)` : `shard ${only} of ${pass.workers}`;
+    const label = `${pass.workers} worker(s)`;
     steps.push({
       name: `${pass.type === undefined ? label : `${pass.type} · ${label}`} · ${files.length} files${
         batches.length > 1 ? msg('cli.test.batches', { batches: batches.length }) : ''
@@ -403,7 +352,6 @@ export async function runShards(options: RunShardsOptions): Promise<CommandResul
     durationMs,
     ...(options.filter === undefined ? {} : { filter: options.filter }),
     ...(sample === undefined ? {} : { sample: { kept: sample.kept, total: sample.total } }),
-    ...(only === undefined ? {} : { shard: only }),
     // Only when the split made more than one, so a single-pass run's JSON is byte-identical to
     // what it has always been — and a mixed one can never be read as if it were a single run.
     ...(spent.length > 1 ? { passes: spent } : {}),

package/src/test-workers.ts

@@ -1,14 +1,36 @@
 // How wide a parallel test run goes, decided in one place. `x test --workers`, `x verify
 // --workers` and every parallel step of the gate read this — a second default would split the same
-// suite two different ways, and the `--worker N` reproduction a shard failure prints would then
-// name a shard the gate never ran.
+// suite two different ways, and the `--workers N` a failure's reproduction prints would then name
+// a width the gate never ran.
 
 // Bun ships no CPU-count or memory primitive: `cpus()` is the fallback when navigator cannot
 // answer, and `totalmem()` is the only reader of the machine's RAM.
 // why: Bun ships no CPU-count or total-memory primitive.
 import { cpus, totalmem } from 'node:os';
+import { UltimateError } from '@ultimat3/core';
 import type { TestType } from '@ultimat3/testing';
-import { TestBudgetInvalidError } from './verify-errors';
+
+/**
+ * `ULTIMATE_TEST_MEMORY_BUDGET` or `ULTIMATE_TEST_MAX_WORKERS` set to something that does not
+ * parse. Refused rather than ignored: a typo read as "the default" is a run sized for a machine
+ * the caller said this is not.
+ */
+export class TestBudgetInvalidError extends UltimateError {
+  constructor(name: string, value: string) {
+    super({
+      code: 'X_TEST_BUDGET_INVALID',
+      cause: `${name}=${JSON.stringify(value)} does not parse — ${
+        name === 'ULTIMATE_TEST_MAX_WORKERS'
+          ? 'expected a positive integer'
+          : 'expected a size such as 3g, 512m or 4GiB'
+      }`,
+      fix:
+        name === 'ULTIMATE_TEST_MAX_WORKERS'
+          ? 'ULTIMATE_TEST_MAX_WORKERS=4 x verify'
+          : 'ULTIMATE_TEST_MEMORY_BUDGET=3g x verify',
+    });
+  }
+}
 
 /** navigator first: it is the runtime's own answer, and it respects a container's CPU limit. */
 export function availableCpus(): number {
@@ -219,7 +241,7 @@ export const sharedWorkers = (
  * Which types run across worker processes, and why the other two cannot.
  *
  * Parallel is safe when the only thing a test file shares with another file is the database, and
- * the database is per worker by construction (`ULTIMATE_TEST_WORKER` → one clone of the migrated
+ * the database is per worker by construction (`BUN_TEST_WORKER_ID` → one clone of the migrated
  * template, `@ultimat3/testing`'s `acquireWorkerDatabase`). Every other process-global in this
  * framework — the permission set, the roles, the entity/action/query registries, the error-code
  * titles, the fixture bag — is handled by `--isolate` giving each FILE its own module registry.

package/src/theme-boot.ts

@@ -1,40 +1,15 @@
-// The no-flash theme script, inlined into every document a served or exported process writes,
-// with `theme.defaultMode` from `app.config.ts` as its fallback. Before this the key had no reader
-// at all (pinned as a dead key in `scripts/lib/config-reader-pins.ts`) and neither of the two
-// scripts the framework exported was wired into a document: an app that wanted to open dark had to
-// write its own boot script AND admit it to the CSP by hand — which every app forgot in one of the
-// two places. Sibling of `app-auth.ts`'s `loadSignInPath` and imports the config for the same
-// reason: a regex over the app's source is the pattern `app-load.ts` refuses.
+// The no-flash theme script, inlined into every document a served or exported process writes, with
+// `theme.defaultMode` (off the one loader, `app-config-load.ts`) as its fallback — and the CSP source
+// that admits it, so no app writes its own boot script and forgets to admit it.
 
-// why: Bun exposes no path-join primitive, and the config path is app-root-relative — the same
-// necessity `app-auth.ts` records.
-import { join } from 'node:path';
 import type { ThemeMode } from '@ultimat3/core';
 import { cspHashSource } from '@ultimat3/http';
 import { renderHead, themeScript, themeScriptBody } from '@ultimat3/render';
-import { APP_CONFIG_EXPORT } from './app-auth';
-import { APP_CONFIG_FILE } from './app-root';
+import { loadAppConfig } from './app-config-load';
 
-const isRecord = (value: unknown): value is Record<string, unknown> =>
-  typeof value === 'object' && value !== null;
-
-const isThemeMode = (value: unknown): value is ThemeMode =>
-  value === 'light' || value === 'dark' || value === 'system';
-
-/**
- * `theme.defaultMode`, or `'system'` — the value `defineConfig` fills in — when the app declares
- * none or the file is absent. Structural, never `instanceof`, for `loadSignInPath`'s reason.
- */
+/** `theme.defaultMode`, or `'system'` — core's own default — for a root with no config file. */
 export async function loadThemeMode(root: string): Promise<ThemeMode> {
-  const configPath = join(root, APP_CONFIG_FILE);
-  if (!(await Bun.file(configPath).exists())) return 'system';
-  const module = (await import(configPath)) as Record<string, unknown>;
-  const config = module[APP_CONFIG_EXPORT];
-  if (!isRecord(config)) return 'system';
-  const theme = config['theme'];
-  if (!isRecord(theme)) return 'system';
-  const mode = theme['defaultMode'];
-  return isThemeMode(mode) ? mode : 'system';
+  return (await loadAppConfig(root))?.theme.defaultMode ?? 'system';
 }
 
 export interface ThemeBoot {

package/src/trusted-hops-error.ts

@@ -0,0 +1,17 @@
+// The refusal of a malformed `TRUSTED_PROXY_HOPS` — its own code, never `X_PORT_INVALID`: a proxy
+// count is not a port, and an operator told "is not a TCP port number" looked for the wrong setting.
+
+import { UltimateError } from '@ultimat3/core';
+import { MAX_PROXY_HOPS } from '@ultimat3/http';
+import { quoteArg } from './shell-quote';
+
+export class TrustedProxyHopsInvalidError extends UltimateError {
+  constructor(input: { readonly value: string }) {
+    super({
+      code: 'X_TRUSTED_PROXY_HOPS_INVALID',
+      cause: `TRUSTED_PROXY_HOPS=${quoteArg(input.value)} is not a whole number of proxies from 1 to ${MAX_PROXY_HOPS} — the count that append to x-forwarded-for in front of this process; unset means none`,
+      fix: 'TRUSTED_PROXY_HOPS=1 ROLE=web bun apps/web/server.ts',
+      meta: { value: input.value, max: MAX_PROXY_HOPS },
+    });
+  }
+}

package/src/unthrown-codes.ts

@@ -0,0 +1,26 @@
+// The registered codes this repo no longer throws, as a list `error-unthrown.ts` reads — its own
+// file, so the literals naming the waived codes are not mistaken for a throw site.
+
+/** Where the list lives, so a finding can name the file to edit. */
+export const UNTHROWN_CODES_FILE = 'packages/cli/src/unthrown-codes.ts';
+
+/**
+ * The codes this repo registers and no longer throws — each a decision, and each row on the
+ * reference page says so in words. A LIST, never a prose match: the waiver was any row containing
+ * "not thrown" or "thrown by nothing", so a sentence that happened to use either phrase silenced the
+ * rule for its code. A listing whose code is thrown again, or is not registered, is
+ * `X_ERROR_CODE_UNTHROWN_STALE`.
+ */
+export const UNTHROWN_CODES: ReadonlySet<string> = new Set([
+  // `x db studio` is planned and unreleased; it exits X_NOT_IMPLEMENTED.
+  'X_DB_STUDIO_FAILED',
+  // 21.0.0: there is no LiveClient to register (X_REALTIME_UNINSTALLED replaced it).
+  'X_LIVE_CLIENT_MISSING',
+  // 21.0.0: liveHookFor was deleted; useQuery reads any query.
+  'X_QUERY_NOT_SUBSCRIBABLE',
+  // 21.0.0: the worker no longer POSTs a flush endpoint nothing mounted.
+  'X_PWA_SYNC_FLUSH_FAILED',
+  'X_PWA_SYNC_INCOMPLETE',
+  // 24.0.0: `x test --worker` was deleted; `x verify --only unit --shard i/n` is the one split.
+  'X_TEST_SHARD_FAILED',
+]);

package/src/verify-checks.ts

@@ -6,19 +6,13 @@ import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { ERROR_DOCS_URL } from '@ultimat3/core';
 import type { Manifest } from '@ultimat3/manifest';
-import {
-  AGENTS_MD_FILENAME,
-  assertNoDrift,
-  MANIFEST_FILENAME,
-  verifyContract,
-} from '@ultimat3/manifest';
+import { AGENTS_MD_FILENAME, MANIFEST_FILENAME, verifyContract } from '@ultimat3/manifest';
 import type { MetaIssue } from '@ultimat3/seo';
 import { validateMeta } from '@ultimat3/seo';
 import { checkAgentsMd } from './app-agents-md';
 import { readAppSources } from './app-boundaries';
 import { envExampleFindings } from './app-env';
 import { appManifest, readAppManifest } from './app-manifest';
-import { OPENAPI_FILE, openApiStaleness } from './app-openapi';
 import { policyFindings } from './app-permissions';
 import { APP_CONFIG_FILE } from './app-root';
 import { asyncPageFindings } from './async-pages';
@@ -33,6 +27,11 @@ import { catalogFindings } from './i18n-registration';
 import { unregisteredJobFindings } from './job-registration';
 import { liveRouteFindings } from './live-routes';
 import { withLoadFindings, withoutLoadFindings } from './load-findings';
+import {
+  hasCommittedContract,
+  manifestMissingFindings,
+  manifestStaleness,
+} from './manifest-staleness';
 import { msg } from './messages';
 import type { Finding } from './output';
 import { findingFrom } from './output';
@@ -198,10 +197,11 @@ export const VERIFY_STEPS: readonly VerifyStep[] = [
   {
     name: 'contract-diff',
     summary: 'the published contract vs the committed manifest',
-    // Either file is a published contract on its own: `openapi.json` generates the typed client,
-    // so gating on the manifest alone let a stale spec ship a wrong client unchecked.
-    applies: async (ctx) =>
-      existsSync(join(ctx.root, MANIFEST_FILENAME)) || existsSync(join(ctx.root, OPENAPI_FILE)),
+    // A BREAKING change against the committed manifest, and nothing else. Whether the committed
+    // files are stale — `openapi.json` included — is the `manifest` step's, through the one check
+    // `x manifest --check` runs (`manifest-staleness.ts`): reported here as well it was two
+    // steps and one command answering one question, and the step named `manifest` saying green.
+    applies: async (ctx) => existsSync(join(ctx.root, MANIFEST_FILENAME)),
     async run(ctx) {
       const committed = await readAppManifest(ctx.root);
       const { manifest, findings } = await appManifest(ctx.root);
@@ -209,14 +209,13 @@ export const VERIFY_STEPS: readonly VerifyStep[] = [
       return withoutLoadFindings(ctx.root, [
         ...findings,
         ...(committed === undefined ? [] : contractFindings(committed, manifest)),
-        ...(await openApiStaleness(ctx.root, manifest)),
       ]);
     },
   },
   {
     name: 'budgets',
     summary:
-      'per-route JS bytes and LCP, the global style layer every document carries, and the routes that boot nothing to receive their live rows',
+      'per-route JS bytes, the global style layer every document carries, and the routes that boot nothing to receive their live rows',
     // The global-style assertion rides here rather than becoming a step of its own, because this
     // step already asks the one question it asks: what does the document this build emits actually
     // contain? It is also the same app load — `appManifest` fills render's stylesheet registry on
@@ -346,7 +345,6 @@ export const VERIFY_STEPS: readonly VerifyStep[] = [
       const roleLoad = app ? roleLoadFindings(ctx.root, ctx.runner) : Promise.resolve([]);
       const drift = await driftFindings(ctx.root);
       const findings = [
-        ...manifestMissingFindings(ctx.root),
         ...(app ? await withLoadFindings(ctx.root, drift) : drift),
         // An app only: the framework monorepo declares no `defineApi`, so it has no list to be in.
         ...(existsSync(join(ctx.root, APP_CONFIG_FILE))
@@ -384,41 +382,14 @@ export const VERIFY_STEPS: readonly VerifyStep[] = [
 ];
 
 /**
- * The half that had never been asked: is the file there at all? `driftFindings` returns nothing
- * when it is absent — correctly, it has nothing to compare — and `AGENTS.md` line 3 tells an agent
- * that facts live in `x.manifest.json`, `x dev` prints its path, and `x manifest` is the only
- * thing that writes it. Nothing ran it: after `x new`, `bin/setup` and all thirteen generators,
- * `find . -name '*.manifest.json'` returned nothing while this step reported green (#F7).
- *
- * An app root, never this repo: the framework monorepo emits `framework.manifest.json` and has no
- * `x.manifest.json` to be missing, so the `app.config.ts` is what decides — the same discriminator
- * `drift`, `budgets`, `seo`, `i18n` and `policy` each use.
+ * The committed generated files against the code — `x manifest --check`'s check, through its
+ * function. With no committed contract there is nothing to load an app for: an app root is told
+ * its manifest is missing, and the framework monorepo (which has neither file) is told nothing.
  */
-function manifestMissingFindings(root: string): readonly Finding[] {
-  if (!existsSync(join(root, APP_CONFIG_FILE))) return [];
-  if (existsSync(join(root, MANIFEST_FILENAME))) return [];
-  return [
-    {
-      code: 'X_MANIFEST_MISSING',
-      cause: `${MANIFEST_FILENAME} does not exist, so every fact an agent reads about this app — route table, action schemas, policies, error codes — is unavailable`,
-      fix: 'x manifest',
-      docs: ERROR_DOCS_URL,
-      at: MANIFEST_FILENAME,
-    },
-  ];
-}
-
-/** `assertNoDrift` throws `X_MANIFEST_DRIFT`; a step reports, so the error becomes a finding. */
 async function driftFindings(root: string): Promise<readonly Finding[]> {
-  const path = join(root, MANIFEST_FILENAME);
-  if (!existsSync(path)) return [];
+  if (!hasCommittedContract(root)) return manifestMissingFindings(root);
   const { manifest, findings } = await appManifest(root);
-  try {
-    await assertNoDrift({ manifest, path });
-    return findings;
-  } catch (error) {
-    return [...findings, { ...findingFrom(error), at: MANIFEST_FILENAME }];
-  }
+  return [...findings, ...(await manifestStaleness(root, manifest))];
 }
 
 /** A breaking change is allowed — with a major bump. `verifyContract` is the one that decides. */