@ultimat3/cli 29.3.2 → 30.0.0

package/src/verify-checks.ts

@@ -8,7 +8,7 @@ import { APP_CONFIG_FILE, ERROR_DOCS_URL } from '@ultimat3/core';
 import type { Manifest } from '@ultimat3/manifest';
 import { AGENTS_MD_FILENAME, MANIFEST_FILENAME, verifyContract } from '@ultimat3/manifest';
 import type { MetaIssue } from '@ultimat3/seo';
-import { validateMeta } from '@ultimat3/seo';
+import { llmsDescriptionIssues, validateMeta } from '@ultimat3/seo';
 import { checkAgentsMd } from './app-agents-md';
 import { readAppSources } from './app-boundaries';
 import { envExampleFindings } from './app-env';
@@ -17,14 +17,18 @@ import { policyFindings } from './app-permissions';
 import { asyncPageFindings } from './async-pages';
 import { appBoundaryFindings } from './boundary-findings';
 import { checkBudgets, readBuildStats } from './budgets';
+import { checkClientDrift } from './client-emit-drift';
 import { checkDestructiveMigrations } from './db-destructive';
+import { checkRollingMigrations } from './db-rolling';
 import { checkUngeneratableMigrations } from './db-ungeneratable';
 import { checkDocumentStyles, documentSurfaces } from './document-styles';
 import { checkErrorCodeResolution, checkErrorFixReport } from './error-contract';
 import { guardFindings } from './guards';
 import { catalogFindings } from './i18n-registration';
 import { isrQueryAdvice } from './isr-query-advice';
+import { readJobBudgetFindings } from './job-budget';
 import { unregisteredJobFindings } from './job-registration';
+import { LINT_ARGV, lintOutcome } from './lint-findings';
 import { liveRouteFindings } from './live-routes';
 import { withLoadFindings, withoutLoadFindings } from './load-findings';
 import {
@@ -32,14 +36,21 @@ import {
   manifestMissingFindings,
   manifestStaleness,
 } from './manifest-staleness';
+import { mcpLockFindings } from './mcp-lock-findings';
 import { msg } from './messages';
 import type { Finding } from './output';
 import { findingFrom } from './output';
+import { retainUnsweptFindings } from './retain-sweep';
 import { checkMigrationDrift } from './schema-drift';
 import { checkSchemaDump } from './schema-dump-drift';
+import { cardRouteFindings } from './seo-cards';
 import { scanSiteMeta } from './seo-meta';
 import { quoteArg } from './shell-quote';
+import { loadSiteSettings } from './site-config';
 import { readStaticReport } from './static-report';
+import { unknownToolGateFindings } from './tool-gate-names';
+import { measureIfStale } from './verify-budgets-build';
+import { exerciseStep } from './verify-exercise';
 import { floorProblemFindings, readVerifyFloor } from './verify-floor';
 import { roleLoadFindings } from './verify-role-load';
 import type { VerifyStep } from './verify-step';
@@ -52,6 +63,9 @@ import { checkWorkspaceDependencies } from './workspace-graph';
 /** The one file that makes the `roadmap` step answerable, and therefore what `applies` reads. */
 const ROADMAP_FILE = join('docs', 'idea', '14-roadmap.md');
 
+/** Where `exercise` joins the suites: directly after `job`, as `VERIFY_STEP_NAMES` holds it. */
+const AFTER_JOB = TEST_STEPS.findIndex((step) => step.name === 'job') + 1;
+
 /** The whole contract, in cost order. Every check the framework knows how to make lives here. */
 export const VERIFY_STEPS: readonly VerifyStep[] = [
   {
@@ -82,12 +96,7 @@ export const VERIFY_STEPS: readonly VerifyStep[] = [
     // the colour rule is `packages/ui/src/tokens/tokens.test.ts`, and rides on the `unit` step.
     summary: 'biome: format, no any, no default exports, no unused imports',
     async run(ctx) {
-      const result = await ctx.runner(['bunx', 'biome', 'check', '.'], { cwd: ctx.root });
-      return fromExec(result, {
-        code: 'X_LINT_FAILED',
-        cause: 'biome reported problems',
-        fix: 'bunx biome check --write .',
-      });
+      return lintOutcome(await ctx.runner(LINT_ARGV, { cwd: ctx.root }));
     },
   },
   {
@@ -176,7 +185,9 @@ export const VERIFY_STEPS: readonly VerifyStep[] = [
       };
     },
   },
-  ...TEST_STEPS,
+  ...TEST_STEPS.slice(0, AFTER_JOB),
+  exerciseStep,
+  ...TEST_STEPS.slice(AFTER_JOB),
   {
     name: 'drift',
     summary:
@@ -202,6 +213,12 @@ export const VERIFY_STEPS: readonly VerifyStep[] = [
         // itself, so CI still needs nothing listening: the committed `packages/db/schema/` against
         // what replaying the migrations produces, and that dump loaded back (`X_SCHEMA_DUMP_DRIFT`).
         ...(await checkSchemaDump(ctx.root, ctx.env ?? Bun.env)),
+        // The fifth: what the previous release would trip over during a roll. Off until the app
+        // sets `rollingSince` in `x.verify.json`, since an applied migration cannot gain a marker.
+        ...(await checkRollingMigrations(ctx.root)),
+        // The sixth: a generated client (`x client`) against its own stamp — a source document that
+        // moved (`X_CLIENT_STALE`) or a body edited by hand (`X_CLIENT_EDITED`). No database.
+        ...(await checkClientDrift(ctx.root)),
       ]),
   },
   {
@@ -235,17 +252,21 @@ export const VERIFY_STEPS: readonly VerifyStep[] = [
     // no stylesheet registry to read; there is nothing for either half to weigh.
     applies: async (ctx) => existsSync(join(ctx.root, APP_CONFIG_FILE)),
     async run(ctx) {
-      // No stats file is NOT "nothing to weigh" — it is every declared budget unmeasured, which is
-      // the case `checkBudgets` already names per route (`X_BUDGET_UNMEASURED`). Skipping the half
-      // entirely is how a step that has never run once reported green: `.x/` is gitignored, so no
-      // CI run and neither gated app has ever had a `build-stats.json` for it to read.
+      // No stats file is NOT "nothing to weigh" — it is every declared budget unmeasured. So the
+      // step MEASURES first, whenever the stats are missing, of an earlier rule, or older than the
+      // newest app source (`verify-budgets-build.ts`): `x verify` alone is the gate, on a fresh
+      // tree too, and a heavier island is never weighed at the bytes of a build before it.
       //
-      // Handed over as `undefined` and never as `?? { routes: [] }`: "no build has run here" and
-      // "a build ran and could not weigh this route" are two different instructions, and only the
-      // caller knows which of them is true. The step still does not BUILD — measuring here would
-      // make `x verify` a static build on every run (8.2s on `dummy/social-media-clone`, and 5.9s
-      // to a hard `X_PRERENDER_FAILED` on `examples/dummy`), and it would be a second builder
-      // beside `apps/web/prerender.ts`, which is where an app reads `SITE_ORIGIN`.
+      // Only then, never on every run: an unedited tree pays nothing, and a rebuild after an edit costs
+      // one static build (8.2 s on `dummy/social-media-clone`, As of 2026-11). The builder is
+      // `x build`, spawned through `ctx.runner` so it is a tagged child under this step's deadline
+      // (`stepTimeoutMs.budgets` overrides). A failing build — `examples/dummy`'s old 5.9 s was a
+      // hard `X_PRERENDER_FAILED` — is red under the build's own findings, unchanged. `SITE_ORIGIN`
+      // shapes canonical and og:url, never script bytes, and the build writes `.x/verify-static`,
+      // so a deployable `.x/static` built with the real origin is never replaced.
+      // A failed build's findings stand in for the per-route weighing below, which would only
+      // repeat them as `X_BUDGET_UNMEASURED` per route; the other riders still answer.
+      const measured = await measureIfStale(ctx);
       const stats = await readBuildStats(ctx.root);
       // The report beside the stats, for the one thing `checkBudgets` reads off it: a route the
       // build rendered and could not weigh because its island was handed props over the cap is
@@ -265,13 +286,17 @@ export const VERIFY_STEPS: readonly VerifyStep[] = [
         ...(await liveRouteFindings(ctx.root)),
         // The fourth: a data read in an async Page rather than in `load` (`async-pages.ts`).
         ...asyncPageFindings(),
-        ...checkBudgets(manifest, stats, report?.unmeasured),
+        ...(measured.findings.length > 0
+          ? measured.findings
+          : checkBudgets(manifest, stats, report?.unmeasured)),
       ]);
       // What no build can weigh, said out loud rather than dropped (`measure-paths.ts`).
       const notes = (report?.unmeasured ?? [])
         .filter((one) => one.weighable === false)
         .map((one) => `not weighed: ${one.reason}`);
-      const output = [outcome.output, ...notes].filter((line) => line !== undefined).join('\n');
+      const output = [measured.output, outcome.output, ...notes]
+        .filter((line) => line !== undefined)
+        .join('\n');
       return output === '' ? outcome : { ...outcome, output };
     },
   },
@@ -293,12 +318,19 @@ export const VERIFY_STEPS: readonly VerifyStep[] = [
       // such key), so canonical checks are skipped rather than run against an origin this file
       // invented. `seo-meta.ts` spells out why that is the honest half.
       const report = validateMeta(scan.records);
+      // `/llms.txt` lists these pages by description: while it is on, a page without one is red.
+      const llms =
+        (await loadSiteSettings(ctx.root)).llms === false
+          ? []
+          : llmsDescriptionIssues(scan.records);
       // The scan filled the route table, so the advice costs no second load. Rides here because
       // this is the step about public, shared-cache pages; it never fails it.
       const warnings = await isrQueryAdvice(ctx.root);
+      // A declared `og.capture` that names no site/ route: the card convention's build error.
+      const cards = cardRouteFindings(scan.records);
       return {
-        ok: scan.findings.length === 0 && report.ok,
-        findings: [...scan.findings, ...report.issues.map(seoFinding)],
+        ok: scan.findings.length === 0 && report.ok && llms.length === 0 && cards.length === 0,
+        findings: [...scan.findings, ...[...report.issues, ...llms].map(seoFinding), ...cards],
         ...(warnings.length === 0 ? {} : { warnings }),
       };
     },
@@ -358,11 +390,19 @@ export const VERIFY_STEPS: readonly VerifyStep[] = [
       // Started first and awaited last: it is a child process, and it runs beside the rest.
       const roleLoad = app ? roleLoadFindings(ctx.root, ctx.runner) : Promise.resolve([]);
       const drift = await driftFindings(ctx.root);
+      // Every `mcpTools()` against `tools.lock.json`: the `x mcp lock --check` of each, at once.
+      const remote = app ? await mcpLockFindings(ctx.root) : { findings: [], warnings: [] };
       const findings = [
         ...(app ? await withLoadFindings(ctx.root, drift) : drift),
         // An app only: the framework monorepo declares no `defineApi`, so it has no list to be in.
         ...(existsSync(join(ctx.root, APP_CONFIG_FILE))
-          ? await unregisteredJobFindings(ctx.root)
+          ? [
+              ...(await unregisteredJobFindings(ctx.root)),
+              ...(await retainUnsweptFindings(ctx.root)),
+              ...(await readJobBudgetFindings(ctx.root)),
+              ...(await unknownToolGateFindings(ctx.root)),
+              ...remote.findings,
+            ]
           : []),
         // What a worker never registers: a declaration beside a component the API index does not
         // import (`verify-role-load.ts`). The boot checks jobs and tasks only, and only at boot.
@@ -374,7 +414,10 @@ export const VERIFY_STEPS: readonly VerifyStep[] = [
       ];
       // Warnings are not findings: `AGENTS.md` tabulating a route table is a smell a human
       // judges, not a build error. They ride in `output`, which `--json` carries verbatim.
-      const output = agents.warnings.map((warning) => `${AGENTS_MD_FILENAME}: ${warning}`);
+      const output = [
+        ...agents.warnings.map((warning) => `${AGENTS_MD_FILENAME}: ${warning}`),
+        ...remote.warnings,
+      ];
       return {
         ok: findings.length === 0,
         findings,

package/src/verify-coverage-run.ts

@@ -13,7 +13,7 @@
 // ORDER, NOT MEMBERSHIP, FOLLOWS THE CLOCK. Each slice also writes a junit report; its per-file
 // durations go into the run's timings cache (`TEST_TIMINGS_FILE`, `test-timings.ts`) and the NEXT
 // run starts the slices longest-first from it. The slices themselves stay a pure function of the
-// file list — the coverage a slice measures never depends on a cache. Measured on bank-integrations
+// file list — the coverage a slice measures never depends on a cache. Measured on one adopter's app
 // (1 192 files, 102 slices, 8 processes): sorted order 64.1 s, longest-first 56.3 s, the floor
 // 56.1 s — the pool used to start its 50 s slice last.
 

package/src/verify-e2e-lane.ts

@@ -0,0 +1,41 @@
+// The gate's second serial lane: `e2e` beside `live` in a package monorepo, isolated from it by
+// construction. Split from `verify-run.ts`, which owns the order; this file owns the one condition
+// under which two serial suites may share the machine, and the environment that makes it safe.
+
+// why: Bun ships no synchronous existence check or path join.
+import { existsSync } from 'node:fs';
+// why: Bun ships no path-join primitive.
+import { join } from 'node:path';
+import { APP_CONFIG_FILE } from '@ultimat3/core';
+import type { Runner } from './exec';
+import type { VerifyContext } from './verify-step';
+
+/**
+ * What a service URL is called: every `TEST_*_URL` the suites read (`docker/test-services.env`) and
+ * `DATABASE_URL`, which `@ultimat3/testing`'s template database falls back to. A child of the lane
+ * sees none of them, so whatever it runs, it cannot reach the server `live` is using.
+ */
+export const isServiceUrlKey = (key: string): boolean =>
+  key === 'DATABASE_URL' || /^TEST_[A-Z0-9_]*_URL$/.test(key);
+
+/**
+ * Whether `e2e` may run beside `live`. Both serial, and serial for reasons that do not meet: `live`
+ * holds a cluster-wide replication slot, `e2e` one browser profile and the built output. In a
+ * package monorepo the e2e suite boots throwaway apps on free ports and strips every service URL
+ * itself (`packages/cli/e2e/*`), and `besideLive` below makes that true of every file. An APP's
+ * e2e boots the app against the services its own live suite uses, so an app keeps them in order.
+ */
+export const e2eBesideLive = (ctx: Pick<VerifyContext, 'root'>): boolean =>
+  !existsSync(join(ctx.root, APP_CONFIG_FILE));
+
+/** `ctx` with every child its runner starts stripped of each service URL in `env`. */
+export function besideLive(ctx: VerifyContext): VerifyContext {
+  // Both: a child inherits the process environment, so a URL only `Bun.env` holds reaches it even
+  // when the caller handed `ctx.env`.
+  const keys = new Set([...Object.keys(Bun.env), ...Object.keys(ctx.env ?? {})]);
+  const strip: Record<string, undefined> = {};
+  for (const key of keys) if (isServiceUrlKey(key)) strip[key] = undefined;
+  const runner: Runner = (command, options) =>
+    ctx.runner(command, { ...options, env: { ...options.env, ...strip } });
+  return { ...ctx, runner };
+}

package/src/verify-exercise.ts

@@ -0,0 +1,64 @@
+// The `exercise` gate step: `x exercise --json` as a child under the step's deadline, its findings
+// the step's. A child, never in process: the pass freezes the clock, seals the network and installs
+// its own database, and the steps beside it in this process must see none of that.
+
+// why: Bun has no directory probe for the app config, and no path joiner.
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { APP_CONFIG_FILE, ERROR_DOCS_URL, isCompiledBundle } from '@ultimat3/core';
+import { t } from '@ultimat3/schema';
+import { execOutput } from './exec';
+import type { Finding } from './output';
+import { documentIn } from './upgrade-gate';
+import type { VerifyStep } from './verify-step';
+
+/** `x exercise`'s argv, spawned as this process's own CLI: the source entry, or a compiled binary. */
+export function verifyExerciseCommand(): readonly string[] {
+  const self = isCompiledBundle(import.meta.dir) ? [] : [join(import.meta.dir, 'bin.ts')];
+  return [process.execPath, ...self, 'exercise', '--json'];
+}
+
+const FINDING = t.object({
+  code: t.string,
+  cause: t.string,
+  fix: t.string,
+  docs: t.optional(t.string),
+  at: t.optional(t.string),
+});
+const DOCUMENT = t.object({ ok: t.boolean, findings: t.optional(t.array(FINDING)) });
+
+interface ExerciseDocument {
+  readonly ok: boolean;
+  readonly findings?: readonly Finding[];
+}
+
+export const exerciseStep: VerifyStep = {
+  name: 'exercise',
+  summary: 'every action, query and job runs once against seeded rows, with no test written',
+  // A repo with no `app.config.ts` registers no primitive: SKIPPED, for the reason `policy` gives.
+  applies: async (ctx) => existsSync(join(ctx.root, APP_CONFIG_FILE)),
+  async run(ctx) {
+    const result = await ctx.runner(verifyExerciseCommand(), { cwd: ctx.root });
+    const parsed = DOCUMENT.safeParse(documentIn(result.stdout));
+    const document = parsed.issues === undefined ? (parsed.value as ExerciseDocument) : undefined;
+    const reported = document?.findings ?? [];
+    // The exit code is the verdict, as `fromExec` reads every child's; the document adds the
+    // findings, and a document that says red is red whatever the exit. A red with nothing to say
+    // is still red, under the code for a CLI that failed without saying why.
+    if (result.ok && document?.ok !== false && reported.length === 0) {
+      return { ok: true, findings: [], output: execOutput(result) };
+    }
+    const findings: readonly Finding[] =
+      reported.length > 0
+        ? reported
+        : [
+            {
+              code: 'X_CLI_UNEXPECTED',
+              cause: `x exercise --json exited ${String(result.code)} with no finding, so x verify could not say which primitive failed`,
+              fix: 'x exercise --json',
+              docs: ERROR_DOCS_URL,
+            },
+          ];
+    return { ok: false, findings, output: execOutput(result) };
+  },
+};

package/src/verify-floor.ts

@@ -14,6 +14,8 @@ import { COVERAGE_FIELD, readCoverageFloor } from './coverage-floor';
 import type { Finding } from './output';
 import type { StepTimeouts } from './verify-deadline';
 import { readStepTimeouts, STEP_TIMEOUT_FIELD } from './verify-deadline';
+import type { SkipCeiling } from './verify-skip-ceiling';
+import { readSkipCeiling, SKIP_CEILING_FIELD } from './verify-skip-ceiling';
 import { GATE_COMMAND, VERIFY_STEP_NAMES } from './verify-step';
 
 /** Hand-written and committed, beside the generated `x.manifest.json` the same gate reads. */
@@ -62,6 +64,17 @@ export interface VerifyFloor {
    * Absent in an app is `X_COVERAGE_FLOOR_UNSTATED`: no app is held to a number it did not write.
    */
   readonly coverage?: CoverageFloor;
+  /**
+   * The migration id the rolling-deploy rail judges after (`db-rolling.ts`), exclusive: an applied
+   * migration cannot gain a marker, so what it already holds is not judged. `"0"` judges everything.
+   * Absent is off, and `x doctor` says which id turns it on.
+   */
+  readonly rollingSince?: string;
+  /**
+   * The most tests a step may skip (`verify-skip-ceiling.ts`), judged by `x verify merge` and by a
+   * whole `x verify` under `CI`. Absent is no ceiling, and a CI run names the number to write.
+   */
+  readonly skipCeiling?: SkipCeiling;
   /** Why part of the file is not a floor. The `manifest` step reports these; nothing swallows them. */
   readonly problems: readonly string[];
 }
@@ -72,6 +85,9 @@ export const BUDGET_FIELD = 'agentsMdMaxBytes';
 /** The floor's typecheck-binary key. Named once: the problem quotes it and the fix repairs it. */
 export const TYPECHECK_BIN_FIELD = 'typecheckBin';
 
+/** The floor's rolling-rail bound. Named once: the problem quotes it and the fix repairs it. */
+export const ROLLING_SINCE_FIELD = 'rollingSince';
+
 /** The floor's isolation key. */
 export const ISOLATE_FIELD = 'isolate';
 
@@ -130,6 +146,19 @@ function readTypecheckBin(payload: Record<string, unknown> | undefined): {
   return { bin: raw, problems: [] };
 }
 
+function readRollingSince(payload: Record<string, unknown> | undefined): {
+  since?: string;
+  problems: readonly string[];
+} {
+  const raw = payload?.[ROLLING_SINCE_FIELD];
+  if (raw === undefined) return { problems: [] };
+  if (typeof raw !== 'string' || raw.trim().length === 0)
+    return {
+      problems: [`"${ROLLING_SINCE_FIELD}" is ${JSON.stringify(raw)}, which is not a migration id`],
+    };
+  return { since: raw, problems: [] };
+}
+
 const asRecord = (value: unknown): Record<string, unknown> | undefined =>
   typeof value === 'object' && value !== null && !Array.isArray(value)
     ? (value as Record<string, unknown>)
@@ -163,12 +192,16 @@ export function parseVerifyFloor(
   const isolate = readIsolate(record);
   const timeouts = readStepTimeouts(record, declared);
   const coverage = readCoverageFloor(record);
+  const rolling = readRollingSince(record);
+  const skips = readSkipCeiling(record, declared);
   const rest = {
     ...(budget.budget === undefined ? {} : { agentsMdMaxBytes: budget.budget }),
     ...(typecheckBin.bin === undefined ? {} : { typecheckBin: typecheckBin.bin }),
     ...(isolate.isolate === undefined ? {} : { isolate: isolate.isolate }),
     ...(timeouts.timeouts === undefined ? {} : { stepTimeoutMs: timeouts.timeouts }),
     ...(coverage.coverage === undefined ? {} : { coverage: coverage.coverage }),
+    ...(rolling.since === undefined ? {} : { rollingSince: rolling.since }),
+    ...(skips.ceiling === undefined ? {} : { skipCeiling: skips.ceiling }),
   };
   const steps = record?.['steps'];
   if (!Array.isArray(steps)) {
@@ -182,6 +215,8 @@ export function parseVerifyFloor(
         ...isolate.problems,
         ...timeouts.problems,
         ...coverage.problems,
+        ...rolling.problems,
+        ...skips.problems,
       ],
     };
   }
@@ -200,6 +235,8 @@ export function parseVerifyFloor(
       ...budget.problems,
       ...timeouts.problems,
       ...coverage.problems,
+      ...rolling.problems,
+      ...skips.problems,
     ],
   };
 }
@@ -289,5 +326,9 @@ const fixFor = (problem: string): string => {
     return `x verify --json   # then write "${STEP_TIMEOUT_FIELD}" in ${VERIFY_FLOOR_FILE} as { "unit": 900000 } — a step it runs, a whole number of milliseconds`;
   if (problem.includes(`"${COVERAGE_FIELD}`))
     return `x verify --only unit --json   # then write "${COVERAGE_FIELD}" in ${VERIFY_FLOOR_FILE} as { "lines": 95, "funcs": 95 }, every "exclude" entry as { "glob": "…", "why": "…" }`;
+  if (problem.includes(`"${ROLLING_SINCE_FIELD}"`))
+    return `x doctor --json   # it names your newest migration id: set "${ROLLING_SINCE_FIELD}" in ${VERIFY_FLOOR_FILE} to that, "0" to judge them all, or drop the key`;
+  if (problem.includes(`"${SKIP_CEILING_FIELD}"`))
+    return `x verify --json   # then write "${SKIP_CEILING_FIELD}" in ${VERIFY_FLOOR_FILE} as { "contract": 9 } — a step it runs, a whole number of tests`;
   return `x verify --json   # then write ${VERIFY_FLOOR_FILE} as {"steps":["unit","contract"]}, naming only steps it ran`;
 };

package/src/verify-merge.ts

@@ -29,6 +29,7 @@ import type { PartStep } from './verify-part-step';
 import { readPartStep } from './verify-part-step';
 import { verifySummary } from './verify-run';
 import { corpusHash } from './verify-shard';
+import { judgeSkips } from './verify-skip-ceiling';
 import { GATE_COMMAND, VERIFY_STEP_NAMES } from './verify-step';
 
 /**
@@ -71,8 +72,8 @@ const isRecord = (value: unknown): value is Record<string, unknown> =>
   typeof value === 'object' && value !== null && !Array.isArray(value);
 
 /**
- * The LAST non-empty line, and only it: `bin/check --json` prints the build's document and then
- * the gate's. Never "the last line that parses" — a part whose tail is not the gate's document is
+ * The LAST non-empty line, and only it: an app's own wrapper script (an older scaffold's
+ * `bin/check --json`) prints the build's document and then the gate's. Never "the last line that parses" — a part whose tail is not the gate's document is
  * a truncated or appended upload, and falling back to an earlier line would believe it.
  */
 export function parsePart(file: string, text: string, command: string = GATE_COMMAND): VerifyPart {
@@ -322,8 +323,19 @@ function mergeStep(
   const nothingRan = sharded.length > 0 && tests !== undefined && tests.ran === 0;
   const required = floorRequires(floor, name);
   const floorGap = nothingRan && required ? [skippedSuiteFinding(name, tests.skipped)] : [];
+  // The ceiling on the SUM, always: a merge is the CI verdict, and one shard's skips say nothing.
+  const skips =
+    sharded.length > 0
+      ? judgeSkips(name, tests, floor?.skipCeiling)
+      : { findings: [], warnings: [] };
   const riding = rider?.findings ?? [];
-  const findings = [...steps.flatMap((step) => step.findings), ...gaps, ...floorGap, ...riding];
+  const findings = [
+    ...steps.flatMap((step) => step.findings),
+    ...gaps,
+    ...floorGap,
+    ...skips.findings,
+    ...riding,
+  ];
   const output = [
     ...steps
       .filter((step) => !step.ok && step.output !== undefined && step.output.length > 0)
@@ -331,7 +343,9 @@ function mergeStep(
     ...(rider?.output === undefined ? [] : [rider.output]),
   ].join('\n');
   // Every part's advice, once each and in the order the parts reported it.
-  const warnings = [...new Set(steps.flatMap((step) => step.warnings ?? []))];
+  const warnings = [
+    ...new Set([...steps.flatMap((step) => step.warnings ?? []), ...skips.warnings]),
+  ];
   const skipped =
     sharded.length > 0 ? nothingRan && !required : steps.every((step) => step.skipped);
   return {
@@ -340,6 +354,7 @@ function mergeStep(
       steps.every((step) => step.ok) &&
       gaps.length === 0 &&
       floorGap.length === 0 &&
+      skips.findings.length === 0 &&
       riding.length === 0,
     // The slowest job: the parts ran side by side, and wall time is what a CI run waits on.
     durationMs: Math.max(...steps.map((step) => step.durationMs)),

package/src/verify-role-load.ts

@@ -6,6 +6,7 @@
 
 // why: Bun ships no path API; the fix names the import relative to the API index.
 import { dirname, join } from 'node:path';
+import { gatedToolNames } from '@ultimat3/action';
 import { ERROR_DOCS_URL, registeredServiceNames, singleLine } from '@ultimat3/core';
 import { entityNames } from '@ultimat3/entity';
 import { catalogDeclarationCount } from '@ultimat3/i18n';
@@ -67,6 +68,7 @@ export function registrations(): readonly Registration[] {
       'channel',
       registeredChannels().map((channel) => channel.name),
     ),
+    ...of('tool gate', gatedToolNames()),
   ];
 }
 

package/src/verify-run.ts

@@ -9,12 +9,14 @@ import { msg } from './messages';
 import type { CommandResult, Finding, JsonValue, StepResult } from './output';
 import type { StepDeadline, StepGuard } from './verify-deadline';
 import { guardStep, raceDeadline, stepDeadline } from './verify-deadline';
+import { besideLive, e2eBesideLive } from './verify-e2e-lane';
 import {
   floorRequires,
   readVerifyFloor,
   skippedSuiteFinding,
   vanishedSuiteFinding,
 } from './verify-floor';
+import { inCi, judgeSkips } from './verify-skip-ceiling';
 import { stalledOutput, stepTimeoutFinding } from './verify-stalled';
 import type {
   CoverageNumbers,
@@ -24,6 +26,7 @@ import type {
   VerifyStepName,
 } from './verify-step';
 import { GATE_COMMAND } from './verify-step';
+import { resetTestDiscovery } from './verify-tests';
 
 /**
  * Run every step, never bailing early: an agent fixing three things at once needs all
@@ -38,6 +41,9 @@ export async function runVerify(
   steps: readonly VerifyStep[],
   ctx: VerifyContext,
 ): Promise<CommandResult> {
+  // The file list is one run's: the dev MCP host calls this again in one process, and a suite
+  // written or deleted since the last call must be what this one judges.
+  resetTestDiscovery();
   const floor = await readVerifyFloor(ctx.root);
   const only = onlyList(ctx.only);
   const selected = only === undefined ? steps : steps.filter((step) => only.includes(step.name));
@@ -76,7 +82,14 @@ export async function runVerify(
   // The static steps wait for the serial suites and then run BESIDE them — only when `live` is in
   // the list, so a one-step run (`--only`) and a list with no serial suite keep today's order.
   const overlapping = selected.some((step) => step.name === SERIAL_SUITES[0]);
-  const beside = overlapping ? selected.filter((step) => BESIDE_SERIAL_SUITES.has(step.name)) : [];
+  // The second serial lane (`verify-e2e-lane.ts`): `e2e` beside `live`, its children stripped of
+  // every service URL, in a package monorepo only.
+  const e2eLane = overlapping && e2eBesideLive(ctx);
+  const beside = overlapping
+    ? selected.filter(
+        (step) => BESIDE_SERIAL_SUITES.has(step.name) || (e2eLane && step.name === 'e2e'),
+      )
+    : [];
   let pending: Promise<void> | undefined;
   const join = async (): Promise<void> => {
     await pending;
@@ -93,7 +106,9 @@ export async function runVerify(
   for (const step of selected) {
     if (beside.includes(step)) continue;
     if (step.name === SERIAL_SUITES[0]) {
-      pending = Promise.all(beside.map((other) => run(other, base))).then(() => undefined);
+      pending = Promise.all(
+        beside.map((other) => run(other, other.name === 'e2e' ? besideLive(base) : base)),
+      ).then(() => undefined);
     } else if (!SERIAL_SUITES.includes(step.name)) {
       await join();
     }
@@ -199,7 +214,7 @@ export const BESIDE_SERIAL_SUITES: ReadonlySet<VerifyStepName> = new Set<VerifyS
 ]);
 
 /** The consecutive run of steps the static group overlaps, in the order `VERIFY_STEP_NAMES` holds. */
-export const SERIAL_SUITES: readonly VerifyStepName[] = ['live', 'job', 'e2e', 'eval'];
+export const SERIAL_SUITES: readonly VerifyStepName[] = ['live', 'job', 'exercise', 'e2e', 'eval'];
 
 async function runStep(
   step: VerifyStep,
@@ -279,20 +294,25 @@ async function runStep(
   // with no files at all — the run just had to finish before it could be seen. Appended to the
   // step's own findings so `data.failed`, the counts and every gate reading this table carry it.
   const vanished = nothingRan && required ? [skippedSuiteFinding(step.name, tests.skipped)] : [];
+  // A mostly skipped suite, judged where the verdict is: CI, and only a whole run (a shard's
+  // share is judged by `x verify merge`, on the sum). A laptop without services stays a dev loop.
+  const skips =
+    outcome.shard === undefined && inCi(ctx.env ?? Bun.env)
+      ? judgeSkips(step.name, tests, floor?.skipCeiling)
+      : { findings: [], warnings: [] };
+  const warnings = [...(outcome.warnings ?? []), ...skips.warnings];
   return {
     result: {
       name: step.name,
-      ok: outcome.ok && vanished.length === 0,
+      ok: outcome.ok && vanished.length === 0 && skips.findings.length === 0,
       durationMs: Math.round(performance.now() - started),
       // Without a floor to require it, a suite that ran nothing is a SKIP and not a pass (#434):
       // the `e2e` step printed `✓ e2e 46ms` over its one skipped test, which is the one thing a
       // step table may never do — a reader cannot tell a lane that ran from a lane that did not.
       skipped: nothingRan && !required,
-      findings: [...outcome.findings, ...vanished],
+      findings: [...outcome.findings, ...vanished, ...skips.findings],
       ...(outcome.output === undefined ? {} : { output: outcome.output }),
-      ...(outcome.warnings === undefined || outcome.warnings.length === 0
-        ? {}
-        : { warnings: outcome.warnings }),
+      ...(warnings.length === 0 ? {} : { warnings }),
       ...(outcome.workers === undefined ? {} : { workers: outcome.workers }),
       ...(outcome.widthReason === undefined ? {} : { widthReason: outcome.widthReason }),
       ...(outcome.slowest === undefined || outcome.slowest.length === 0

package/src/verify-shard.ts

@@ -23,8 +23,18 @@ export class VerifyShardInvalidError extends UltimateError {
   }
 }
 
-/** The steps a shard may split: the parallel suites. `live` and `e2e` are serial by design. */
-export const SHARDABLE_STEPS: readonly VerifyStepName[] = ['unit', 'contract', 'job'];
+/**
+ * The steps a shard may split: every suite that runs test files. `live` and `e2e` stay ONE process
+ * inside a shard — serial is about one machine's replication slot and browser, and each CI runner
+ * starts its own — so their slices split across runners, never across workers.
+ */
+export const SHARDABLE_STEPS: readonly VerifyStepName[] = [
+  'unit',
+  'contract',
+  'live',
+  'job',
+  'e2e',
+];
 
 export interface ShardSpec {
   /** 1-based, as a CI matrix counts. */