arkgate 4.8.24 → 4.8.26

package/bin/lib/html-report.mjs

@@ -11,7 +11,7 @@ import {
   resolveOperatingMode,
 } from '../ark-shared.mjs';
 import { collectAdoptionGaps, arkCheckCommand } from './agent-gates.mjs';
-import { LEFTOVER_DESIGN_BADGE } from './product-copy.mjs';
+import { LEFTOVER_DESIGN_LABEL } from './product-copy.mjs';
 import { CORE_LAYER_NAMES } from './core-layers.mjs';
 import {
   renderBaselineSignalLegend,
@@ -572,7 +572,7 @@ export function renderHtmlReport({
   const designSmells = Array.isArray(depth.designSmells) ? depth.designSmells : [];
   const designWeakBadge =
     designFitness?.designWeak === true
-      ? ` <span class="badge design" title="Import rules can be green while leftover design work remains. Not a FAIL.">${LEFTOVER_DESIGN_BADGE}</span>`
+      ? ` <span class="badge design" title="Import rules can be green while leftover design work remains. Not a FAIL.">${LEFTOVER_DESIGN_LABEL}</span>`
       : '';
   const designStripHtml =
     renderDesignDepthStrip({

package/bin/lib/import-graph-projection.mjs

@@ -0,0 +1,112 @@
+/**
+ * Compact importer index for doctor and report (ADR 0037 D1).
+ *
+ * The scan releases the resolved facts right after the verdict (memory). This
+ * keeps only what the files-nothing-imports advisory and the flat-parent
+ * suggestion read: governed paths, incoming edge counts, the edge list as
+ * typed-array pairs, and which export names each target is imported by. It is
+ * a projection of facts that already exist — never an input to the verdict.
+ */
+
+/** Unresolved project-looking specifiers kept for `maybe-unresolved` matching. */
+const MAX_UNRESOLVED_SPECIFIERS = 200;
+/** A bare specifier that looks like a project alias rather than a package. */
+const ALIAS_LIKE = /^(?:[@~#$]\/|[~#$])/;
+
+function looksLikeProjectSpecifier(specifier) {
+  return typeof specifier === 'string' && (specifier.startsWith('.') || ALIAS_LIKE.test(specifier));
+}
+
+/**
+ * @param {{ files?: Array<{ path: string, parseStatus?: string }>, dependencies?: Array<object>, completeness?: string }} facts
+ * @returns {{
+ *   files: string[],
+ *   importerCount: Uint32Array,
+ *   edges: Int32Array,
+ *   namedUse: Map<number, Set<string> | '*'>,
+ *   unresolved: Array<{ from: string, specifier: string }>,
+ *   unresolvedTotal: number,
+ *   dynamicSites: number,
+ *   invalidFiles: number,
+ *   completeness: string,
+ * }}
+ */
+export function projectImporterIndex(facts) {
+  const files = [];
+  const indexOf = new Map();
+  let invalidFiles = 0;
+  for (const file of Array.isArray(facts?.files) ? facts.files : []) {
+    if (typeof file?.path !== 'string' || indexOf.has(file.path)) continue;
+    indexOf.set(file.path, files.length);
+    files.push(file.path);
+    if (file.parseStatus === 'invalid') invalidFiles += 1;
+  }
+  const importerCount = new Uint32Array(files.length);
+  const pairs = [];
+  const namedUse = new Map();
+  const unresolved = [];
+  let unresolvedTotal = 0;
+  let dynamicSites = 0;
+  for (const dep of Array.isArray(facts?.dependencies) ? facts.dependencies : []) {
+    if (dep?.resolution === 'dynamic') {
+      dynamicSites += 1;
+      continue;
+    }
+    if (dep?.resolution === 'unresolved') {
+      if (!looksLikeProjectSpecifier(dep.specifier)) continue;
+      unresolvedTotal += 1;
+      if (unresolved.length < MAX_UNRESOLVED_SPECIFIERS) {
+        unresolved.push({ from: dep.from, specifier: dep.specifier });
+      }
+      continue;
+    }
+    if (dep?.resolution !== 'resolved-project') continue;
+    const from = indexOf.get(dep.from);
+    const to = indexOf.get(dep.target);
+    if (from === undefined || to === undefined || from === to) continue;
+    pairs.push(from, to);
+    importerCount[to] += 1;
+    const previous = namedUse.get(to);
+    if (previous === '*') continue;
+    // Default, namespace, side-effect, dynamic, require and `export *` carry no
+    // names: any export may be used through them.
+    const named = Array.isArray(dep.namedBindings) && dep.namedBindings.length > 0 ? dep.namedBindings : null;
+    if (!named) {
+      namedUse.set(to, '*');
+      continue;
+    }
+    const set = previous ?? new Set();
+    for (const name of named) set.add(name);
+    namedUse.set(to, set);
+  }
+  return {
+    files,
+    importerCount,
+    edges: Int32Array.from(pairs),
+    namedUse,
+    unresolved,
+    unresolvedTotal,
+    dynamicSites,
+    invalidFiles,
+    completeness: typeof facts?.completeness === 'string' ? facts.completeness : 'unavailable',
+  };
+}
+
+/**
+ * target path → every governed file that imports it (the flat-parent graph).
+ * @param {ReturnType<typeof projectImporterIndex>} index
+ */
+export function importerGraphFromIndex(index) {
+  const graph = new Map();
+  const { files, edges } = index;
+  for (let i = 0; i + 1 < edges.length; i += 2) {
+    const target = files[edges[i + 1]];
+    let set = graph.get(target);
+    if (!set) {
+      set = new Set();
+      graph.set(target, set);
+    }
+    set.add(files[edges[i]]);
+  }
+  return graph;
+}

package/bin/lib/improvement-compass-doctor.mjs

@@ -2,11 +2,7 @@
  * Doctor adapter for the Domain improvement compass (notAScore projection).
  * Keeps doctor-plan.mjs inside its module budget; pure assembly only.
  */
-import {
-  buildImprovementCompass,
-  formatImprovementCompassDoctorLines,
-  primaryImprovementCompassNextAction,
-} from './improvement-compass.mjs';
+import { buildImprovementCompass } from './improvement-compass.mjs';
 
 /**
  * @param {{
@@ -92,22 +88,3 @@ export function buildDoctorImprovementCompass(input = {}) {
   });
 }
 
-export {
-  formatImprovementCompassDoctorLines,
-  primaryImprovementCompassNextAction,
-};
-
-/**
- * Human doctor section (never a score bar).
- * @param {import('./improvement-compass.mjs').ImprovementCompass} compass
- * @param {{ line: Function, warn: string, ok: string, color: { bold: Function } }} io
- */
-export function printImprovementCompassSection(compass, io) {
-  const { line, warn, ok, color } = io;
-  console.log('');
-  console.log(color.bold('Improvement compass (not a score)'));
-  const mark = compass.topResidual.length > 0 ? warn : ok;
-  for (const text of formatImprovementCompassDoctorLines(compass)) {
-    line(mark, text);
-  }
-}

package/bin/lib/invariant-coverage-io.mjs

@@ -10,7 +10,7 @@ const DEFAULT_TEST_NAME_RE =
   /\.(test|spec)\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$|\/__tests__\/|\/tests?\//i;
 
 /** Default max files to load for coverage evidence (budget). Config: `coverage.maxFiles`. */
-export const DEFAULT_MAX_COVERAGE_FILES = 400;
+const DEFAULT_MAX_COVERAGE_FILES = 400;
 /**
  * Hard ceiling on `coverage.maxFiles`. The config validator implements no
  * `maximum` keyword for integers, so a schema bound would be accepted and then
@@ -38,11 +38,12 @@ function isPathInsideRoot(root, absolute) {
 }
 
 /**
- * Minimal glob match for testGlobs (double-star slash = zero path segments).
+ * Minimal glob match for testGlobs and ArkRules `appliesTo` fileHints
+ * (double-star slash = zero path segments).
  * @param {string} glob
  * @param {string} file
  */
-function matchSimpleGlob(glob, file) {
+export function matchSimpleGlob(glob, file) {
   const pattern = String(glob || '').replace(/\\/g, '/');
   const target = String(file || '').replace(/\\/g, '/');
   if (!pattern) return false;

package/bin/lib/invariant-coverage.mjs

@@ -9,6 +9,7 @@
  */
 
 import { findClassDeclarations, findMemberContainers, objectLiteralMemberNames, scanClassMembers, } from './class-source-scan.mjs';
+import { probeRefusalReason, verdictRefusesPromotion } from './invariant-probe.mjs';
 /** Adopted + catalogued invariants, but no declared tests path (P2 §10). */
 export const INVARIANT_TESTS_PATH_RULE_ID = 'INVARIANT_TESTS_PATH_MISSING';
 export const INVARIANT_TESTS_PATH_MESSAGE = 'This project is adopted and has domain invariants, but ark.config.json does not name a real tests path. Add coverage.testGlobs or coverage.coverageRoots pointing at the folder where those tests live, then re-run. Without that path, coverage is an empty checkbox.';
@@ -672,6 +673,15 @@ export function canPromoteInvariant(coverage) {
             reason: `Declare coverage.coverageRoots in ark.config.json before promoting ${coverage.invariantId} to enforced. Without that, ArkGate cannot tell whether a covering test is one the runner executes.`,
         };
     }
+    // ADR 0039 D2: probe evidence can only subtract. A fresh survived or
+    // not-reached row refuses; stale, killed, inconclusive or absent changes nothing.
+    if (coverage.probe?.fresh === true && verdictRefusesPromotion(coverage.probe.verdict)) {
+        return {
+            ok: false,
+            reason: probeRefusalReason(coverage.invariantId, coverage.probe),
+            blocker: 'probe-survived',
+        };
+    }
     return { ok: true, reason: `Invariant ${coverage.invariantId} has coverage evidence.` };
 }
 function nonEmptyPathStrings(value) {
@@ -780,3 +790,19 @@ export function collectMissingCoverageRootsFindings(input) {
         },
     ];
 }
+/**
+ * Test files whose describe/it/test/context title names `invariant.id` — the
+ * same title matcher coverage uses. Sorted, deduplicated. The probe (ADR 0039)
+ * runs these as covering tests; coverage itself never runs anything.
+ */
+export function testFilesNamingInvariant(invariant, files) {
+    const out = new Set();
+    for (const file of files.testFiles ?? []) {
+        const content = files.fileContents[file];
+        if (!content)
+            continue;
+        if (matchTestTitle(content, invariant.id) !== undefined)
+            out.add(normalizePath(file));
+    }
+    return [...out].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+}

package/bin/lib/invariant-probe-cli.mjs

@@ -0,0 +1,347 @@
+/**
+ * `arkgate-check --probe-invariants[=<id>] [--write] [--json] [--runner <id>]`
+ * — orchestration and output (ADR 0039).
+ *
+ * Owner-invoked only. Loaded through a dynamic import from the CLI entry when
+ * the flag is set; the write hook, MCP, ESLint, the action and --strict-merge
+ * never import this module (a static test pins it).
+ *
+ * Per target: baseline green → load canary caught → reach canary caught → at
+ * most three mutants. Everything runs in a temporary copy; the user's tree is
+ * only read, except `.ark/invariant-probe.json` under --write.
+ *
+ * Exit codes: 0 no survivor and nothing unreached · 1 at least one survived or
+ * not-reached · 2 could not run.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { arkCommand } from '../ark-shared.mjs';
+import { loadEffectiveArkRulesFromDisk } from './effective-contract-load.mjs';
+import { testFilesNamingInvariant } from './invariant-coverage.mjs';
+import {
+  INVARIANT_PROBE_ARTIFACT_PATH,
+  INVARIANT_PROBE_MAX_TARGETS,
+  INVARIANT_PROBE_MAX_TESTS,
+  applyEdit,
+  buildInvariantProbeArtifact,
+  canaryEdits,
+  foldVerdict,
+  planMutants,
+  probeExitCode,
+  probeRowLine,
+  readInvariantProbeArtifact,
+} from './invariant-probe.mjs';
+import { hashProjectFile, invariantIdentityHash, sha256Text } from './invariant-probe-io.mjs';
+import {
+  PROBE_TIMEOUT_CEILING_MS,
+  buildProbeEnv,
+  detectRunner,
+  probeTimeoutMs,
+  runCoveringTests,
+} from './invariant-probe-runner.mjs';
+import { findProbeSites, parsesCleanly } from './invariant-probe-sites.mjs';
+import { createProbeWorkspace, sweepStaleProbeWorkspaces } from './invariant-probe-workspace.mjs';
+import { testImportersOf } from './outside-importers.mjs';
+import { collectGovernedFiles, normalize } from './scan-files.mjs';
+import { evaluateCatalogCoverage } from './sensor-promote-io.mjs';
+import { arkPackageVersion } from './skill-install.mjs';
+import { loadTypeScript } from './typescript-host.mjs';
+import { color } from './violations.mjs';
+
+const DECLARATION_ONLY_SHAPES = new Set(['type', 'interface', 'enum', 'class']);
+
+function unprobeable(root, inv, reason, symbolFile = null) {
+  return {
+    invariantId: inv.id,
+    invariantHash: invariantIdentityHash(inv),
+    layer: inv.provenance?.layer ?? null,
+    sourceFile: inv.provenance?.sourceFile ?? null,
+    mode: inv.mode ?? 'advisory',
+    symbol: inv.coverage?.symbol ?? null,
+    symbolFile,
+    // Bound like any row: when the file changes, the reason may no longer hold.
+    symbolFileHash: symbolFile ? hashProjectFile(root, symbolFile) : null,
+    tests: [],
+    baseline: null,
+    wiring: null,
+    mutants: [],
+    verdict: 'unprobeable',
+    reason,
+  };
+}
+
+/** Resolve what to probe for one invariant, or the unprobeable row that says why not. */
+function planTarget({ root, ts, inv, coverageRow, inputs, importers }) {
+  const symbol = inv.coverage?.symbol;
+  if (!symbol) return { row: unprobeable(root, inv, 'no-symbol') };
+  const symbolFile = coverageRow?.symbolEvidenceFile ?? null;
+  if (coverageRow?.shape && DECLARATION_ONLY_SHAPES.has(coverageRow.shape)) {
+    return { row: unprobeable(root, inv, 'declaration-only', symbolFile) };
+  }
+  if (!symbolFile) return { row: unprobeable(root, inv, 'symbol-not-found') };
+  let text;
+  try {
+    text = fs.readFileSync(path.join(root, symbolFile), 'utf8');
+  } catch {
+    return { row: unprobeable(root, inv, 'symbol-not-found', symbolFile) };
+  }
+  const found = findProbeSites(ts, symbolFile, text, symbol);
+  if (!found.ok) return { row: unprobeable(root, inv, found.reason, symbolFile) };
+  const named = inputs ? testFilesNamingInvariant(inv, inputs) : [];
+  const tests = [...new Set([...named, ...(importers.get(symbolFile) ?? [])])].slice(0, INVARIANT_PROBE_MAX_TESTS);
+  if (tests.length === 0) return { row: unprobeable(root, inv, 'no-covering-test', symbolFile) };
+  return { target: { inv, symbol, symbolFile, text, found, tests } };
+}
+
+function outcomeToRun(outcome) {
+  if (outcome === 'failed') return 'killed';
+  if (outcome === 'passed') return 'survived';
+  return outcome;
+}
+
+function outcomeToBaseline(outcome) {
+  if (outcome === 'passed') return 'green';
+  if (outcome === 'failed') return 'red';
+  return outcome;
+}
+
+/** Run one target in the workspace. The copy's symbol file is restored after every edit. */
+async function probeTarget(root, workspace, runner, target) {
+  const cwd = path.join(workspace.project, path.relative(root, runner.pkgRoot));
+  const files = target.tests.map((test) => normalize(path.relative(runner.pkgRoot, path.join(root, test))));
+  const copyFile = path.join(workspace.project, target.symbolFile);
+  const env = buildProbeEnv({ home: workspace.home, tmp: workspace.tmp });
+  const run = (timeoutMs) => runCoveringTests({ runner, cwd, files, timeoutMs, env, scratch: workspace.tmp });
+  const withText = async (text, timeoutMs) => {
+    fs.writeFileSync(copyFile, text);
+    try {
+      return await run(timeoutMs);
+    } finally {
+      fs.writeFileSync(copyFile, target.text);
+    }
+  };
+  const baseline = await run(PROBE_TIMEOUT_CEILING_MS);
+  const wiring = { baseline: outcomeToBaseline(baseline.outcome) };
+  const mutants = [];
+  if (wiring.baseline === 'green') {
+    const timeout = probeTimeoutMs(baseline.durationMs);
+    const canary = canaryEdits(target.text, target.found.body);
+    wiring.load = outcomeToRun((await withText(applyEdit(target.text, canary.load), timeout)).outcome);
+    if (wiring.load === 'killed' || wiring.load === 'timeout') {
+      wiring.reach = outcomeToRun((await withText(applyEdit(target.text, canary.reach), timeout)).outcome);
+    }
+    if (wiring.reach === 'killed' || wiring.reach === 'timeout') {
+      for (const mutant of planMutants(target.found.sites)) {
+        const mutated = applyEdit(target.text, mutant);
+        const record = {
+          id: mutant.id,
+          operator: mutant.operator,
+          line: mutant.line,
+          column: mutant.column,
+          original: mutant.original,
+          replacement: mutant.replacement,
+        };
+        if (!parsesCleanly(workspace.ts, target.symbolFile, mutated)) {
+          mutants.push({ ...record, status: 'invalid', durationMs: 0 });
+          continue;
+        }
+        const result = await withText(mutated, timeout);
+        mutants.push({ ...record, status: outcomeToRun(result.outcome), durationMs: result.durationMs });
+      }
+    }
+  }
+  const { verdict, reason } = foldVerdict(wiring, mutants);
+  return {
+    invariantId: target.inv.id,
+    invariantHash: invariantIdentityHash(target.inv),
+    layer: target.inv.provenance?.layer ?? null,
+    sourceFile: target.inv.provenance?.sourceFile ?? null,
+    mode: target.inv.mode ?? 'advisory',
+    symbol: target.symbol,
+    symbolFile: target.symbolFile,
+    symbolFileHash: sha256Text(target.text),
+    tests: target.tests.map((test) => ({ path: test, contentHash: hashProjectFile(root, test) ?? 'sha256:missing' })),
+    baseline: { status: wiring.baseline, durationMs: baseline.durationMs },
+    wiring: { load: wiring.load ?? null, reach: wiring.reach ?? null },
+    mutants,
+    verdict,
+    reason,
+  };
+}
+
+/** Persist under `.ark/`, merging rows for invariants this run did not touch. */
+function writeArtifact(root, artifact, focus) {
+  const absolute = path.join(root, INVARIANT_PROBE_ARTIFACT_PATH);
+  const dir = path.dirname(absolute);
+  fs.mkdirSync(dir, { recursive: true });
+  const rootReal = fs.realpathSync(root);
+  const dirReal = fs.realpathSync(dir);
+  if (dirReal !== rootReal && !dirReal.startsWith(`${rootReal}${path.sep}`)) {
+    throw new Error(`${path.dirname(INVARIANT_PROBE_ARTIFACT_PATH)} resolves outside the project; refusing to write.`);
+  }
+  let rows = artifact.invariants;
+  if (focus) {
+    try {
+      const previous = readInvariantProbeArtifact(JSON.parse(fs.readFileSync(absolute, 'utf8')));
+      if (previous.ok) {
+        const ids = new Set(rows.map((row) => row.invariantId));
+        rows = [...previous.artifact.invariants.filter((row) => !ids.has(row.invariantId)), ...rows];
+      }
+    } catch {
+      /* no previous artifact, or unreadable: this run's rows only */
+    }
+  }
+  const merged = buildInvariantProbeArtifact({
+    arkgateVersion: artifact.arkgateVersion,
+    runner: artifact.runner,
+    probedOn: artifact.probedOn,
+    rows,
+  });
+  const temp = path.join(dir, `.invariant-probe.${process.pid}.tmp`);
+  fs.writeFileSync(temp, `${JSON.stringify(merged, null, 2)}\n`);
+  fs.renameSync(temp, absolute);
+  return INVARIANT_PROBE_ARTIFACT_PATH;
+}
+
+function refuse(args, reasonCode, reason) {
+  if (args.json) {
+    console.log(JSON.stringify({ probeInvariants: { notAScore: true, status: 'refused', reasonCode, reason } }, null, 2));
+  } else {
+    console.error(`${reason}`);
+  }
+  process.exitCode = 2;
+}
+
+function printReport(root, payload) {
+  console.log(color.bold('Invariant probe (not a score)'));
+  console.log(color.dim('  Ran the covering tests in a temporary copy. Your files were not changed.'));
+  for (const row of payload.rows) {
+    const mark =
+      row.verdict === 'killed'
+        ? color.green('caught')
+        : row.verdict === 'survived' || row.verdict === 'not-reached'
+          ? color.red(row.verdict)
+          : color.dim(row.verdict);
+    console.log(`  ${mark}  ${row.line}`);
+  }
+  if (payload.truncated > 0) {
+    console.log(color.dim(`  ${payload.truncated} more invariant(s) past the ${INVARIANT_PROBE_MAX_TARGETS}-target cap were not probed. Probe them one at a time with --probe-invariants=<id>.`));
+  }
+  if (payload.written) {
+    console.log(color.green(`  wrote ${payload.written}. Commit it so CI sees the same evidence.`));
+  } else {
+    console.log(color.dim(`  Report only. ${arkCommand(root, 'ark-check', '--probe-invariants --write')} saves ${INVARIANT_PROBE_ARTIFACT_PATH}; a fresh survived or not-reached row refuses promotion.`));
+  }
+}
+
+export async function runProbeInvariants(args, readConfig) {
+  const root = args.root;
+  let config;
+  try {
+    config = readConfig(root, args.config);
+  } catch (error) {
+    refuse(args, 'PROBE_CONFIG_INVALID', error instanceof Error ? error.message : String(error));
+    return;
+  }
+  const loaded = loadEffectiveArkRulesFromDisk(root, config);
+  if (loaded.errors?.length) {
+    refuse(args, 'PROBE_CONFIG_INVALID', 'ArkRules references failed to load, so no invariant can be probed.');
+    return;
+  }
+  const focus = typeof args.probeInvariants === 'string' ? args.probeInvariants : null;
+  const catalog = (loaded.arkRules.invariants ?? []).filter((inv) => !focus || inv.id === focus);
+  if (catalog.length === 0) {
+    refuse(
+      args,
+      'PROBE_NO_TARGETS',
+      focus
+        ? `No declared invariant with id ${JSON.stringify(focus)}.`
+        : 'No ArkRules invariants are declared, so there is nothing to probe.'
+    );
+    return;
+  }
+  const loadedTs = await loadTypeScript(root);
+  const ts = loadedTs?.ts;
+  if (!ts || typeof ts.createSourceFile !== 'function') {
+    refuse(args, 'PROBE_RUNNER_UNSUPPORTED', 'TypeScript could not be loaded, so the symbol cannot be located.');
+    return;
+  }
+  const governedRel = collectGovernedFiles(root, config).map((file) => normalize(path.relative(root, file)));
+  const evaluated = evaluateCatalogCoverage(root, config, { files: governedRel.map((p) => ({ path: p })) }, {
+    ...loaded.arkRules,
+    invariants: catalog,
+  });
+  const coverageById = new Map(evaluated.rows.map((row) => [row.invariantId, row]));
+  const selected = catalog.slice(0, INVARIANT_PROBE_MAX_TARGETS);
+  const truncated = catalog.length - selected.length;
+  const symbolFiles = [...new Set(selected.map((inv) => coverageById.get(inv.id)?.symbolEvidenceFile).filter(Boolean))];
+  const importers = testImportersOf({ root, ts, config, governed: new Set(governedRel), targets: symbolFiles }).byTarget;
+
+  const rows = [];
+  const targets = [];
+  for (const inv of selected) {
+    const planned = planTarget({ root, ts, inv, coverageRow: coverageById.get(inv.id), inputs: evaluated.inputs, importers });
+    if (planned.row) rows.push(planned.row);
+    else targets.push(planned.target);
+  }
+
+  let runnerInfo = null;
+  if (targets.length > 0) {
+    const runners = [];
+    for (const target of targets) {
+      const runner = detectRunner({ root, tests: target.tests, override: args.runner });
+      if (!runner.ok) {
+        refuse(args, runner.reasonCode, `${target.inv.id}: ${runner.reason}`);
+        return;
+      }
+      runners.push(runner);
+    }
+    sweepStaleProbeWorkspaces();
+    const workspace = createProbeWorkspace(root);
+    if (!workspace.ok) {
+      refuse(
+        args,
+        workspace.reasonCode,
+        `The project is too large to copy for the probe (${workspace.files} files, ${Math.round(workspace.bytes / 1048576)} MiB; the limits are 20000 files and 256 MiB).`
+      );
+      return;
+    }
+    workspace.ts = ts;
+    try {
+      for (let index = 0; index < targets.length; index += 1) {
+        rows.push(await probeTarget(root, workspace, runners[index], targets[index]));
+      }
+    } finally {
+      workspace.cleanup();
+    }
+    runnerInfo = { id: runners[0].id, version: runners[0].version ?? null };
+  }
+
+  const artifact = buildInvariantProbeArtifact({
+    arkgateVersion: arkPackageVersion() ?? 'unknown',
+    runner: runnerInfo,
+    probedOn: new Date().toISOString().slice(0, 10),
+    rows,
+  });
+  let written = null;
+  if (args.write) {
+    try {
+      written = writeArtifact(root, artifact, focus);
+    } catch (error) {
+      refuse(args, 'PROBE_WRITE_FAILED', error instanceof Error ? error.message : String(error));
+      return;
+    }
+  }
+  const payload = {
+    notAScore: true,
+    status: 'complete',
+    runner: artifact.runner,
+    rows: artifact.invariants.map((row) => ({ ...row, line: probeRowLine(row) })),
+    totals: artifact.totals,
+    truncated,
+    ...(written ? { written } : {}),
+  };
+  if (args.json) console.log(JSON.stringify({ probeInvariants: payload }, null, 2));
+  else printReport(root, payload);
+  process.exitCode = probeExitCode(artifact.invariants);
+}