cursedbelt 4.3.0 → 4.4.0

package/src/typecheckCachesAreSeparate.spec.ts

@@ -1,5 +1,5 @@
 /**
- * 🔴 Four `tsc` projects run AT ONCE in `scripts/verify.ts`. Two of them writing one
+ * 🔴 Four `tsc` projects run AT ONCE under `$FORGE/tools/gate.ts`. Two of them writing one
  * `.tsbuildinfo` is a corrupt cache, and a corrupt cache is a typecheck that skips files.
  *
  * ## Why this file exists
@@ -83,7 +83,7 @@ describe('the typecheck caches', () => {
     const shared = [...byFile.entries()].filter(([, names]) => names.length > 1);
     expect(
       shared.map(([file, names]) => `${relative(ROOT, file)} ← ${names.join(', ')}`),
-      'these projects share one incremental cache. `scripts/verify.ts` runs them ' +
+      'these projects share one incremental cache. `$FORGE/tools/gate.ts` runs them ' +
         'concurrently, so both processes write the same file and whatever survives is what ' +
         'the NEXT run trusts. Give each project its own `tsBuildInfoFile` — an `extends` ' +
         'inherits the parent\'s.',

package/src/verifyGraph.spec.ts

@@ -1,49 +1,70 @@
 /**
  * 🔴 The gate got faster on 2026-09-15. This is the file that stops it getting smaller.
  *
- * `bun run verify` was `paths && typecheck && demo:check && build && test && e2e` — six
- * serial links, 142.0s measured end to end on an idle machine, five of them single-threaded
- * work queued behind each other on a fourteen-core Mac. It is now a dependency graph
- * (`scripts/verify.ts`) that runs the same stages concurrently.
+ * `bun run verify` was `paths && typecheck && demo:check && build && test && e2e` — six serial
+ * links, 142.0s measured end to end on an idle machine, five of them single-threaded work queued
+ * behind each other on a fourteen-core Mac. It became a dependency graph, and on 2026-09-20 the
+ * SCHEDULER for that graph moved to `$FORGE/tools/gate.ts` so the other twenty repos could have
+ * it too. The stages are now the `gate` block in this repo's `package.json`.
  *
- * Every speed-up of a gate is one edit away from being a deletion of a gate, and the two
- * look identical in a diff: dropping `e2e` from the graph makes `verify` four times faster
- * and every test still passes. This generation's third rule is that a repo's gate proves
- * that repo, so the SET of stages is pinned here, by name, against the chain that existed
- * before the change. Adding a stage is free; removing one has to argue with this file.
+ * Every speed-up of a gate is one edit away from being a deletion of a gate, and the two look
+ * identical in a diff: dropping `e2e` from the graph makes `verify` four times faster and every
+ * test still passes. This generation's third rule is that a repo's gate proves that repo, so the
+ * SET of stages is pinned here, by name, against the chain that existed before the change.
+ * Adding a stage is free; removing one has to argue with this file.
  *
- * The literal list below is deliberate duplication. A test that derived the expectation from
- * `STAGES` would assert that the graph equals itself.
+ * The literal list below is deliberate duplication. A test that derived the expectation from the
+ * declaration would assert that the graph equals itself.
+ *
+ * ## 🔴 What moved out of this file, and where it is checked now
+ *
+ * `graphFault`, `jobLimit` and `timingTable` were this repo's; they are the shared runner's now,
+ * and `autopilot/test/gate.test.ts` drives every case this file used to — the dangling `needs`,
+ * the cycle, the duplicate script, the job cap and its overrides, the table's overlap and its
+ * skipped stage. `$FORGE/tools/check-gate-graph.ts` additionally asserts the graph is acyclic and
+ * fully reachable on EVERY gate of every repo, out of `bun run paths`, which is strictly more
+ * often than a spec in one repo could. What stays here is what is about THIS repo: the stage set,
+ * the two edges, and why `build` is a leaf.
  */
 import { describe, expect, it } from 'bun:test';
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import pkg from '../package.json';
-import { graphFault, jobLimit, ROOT, STAGES, timingTable } from '../scripts/verify';
+
+/** The repo root — this file is `src/`, one level down. Never a literal. */
+const ROOT = resolve(import.meta.dir, '..');
+
+interface Stage {
+	script: string;
+	needs?: readonly string[];
+	why?: string;
+}
+
+/** The declared graph, read as data. There is no import of the scheduler to drift from. */
+const STAGES: readonly Stage[] = (pkg as { gate?: { stages?: Stage[] } }).gate?.stages ?? [];
 
 /**
  * What `verify` ran before it became a graph, expanded to the leaf scripts.
  *
- * `typecheck` was one script running three `tsc` projects serially; it is now three scripts
- * so they can run at once, and `typecheck` still runs all three for anybody typing it by
- * hand. `styles` is new — it is the first two steps of `build`, hoisted so that the things
- * which READ the generated stylesheets can wait on the thing that writes them.
+ * `typecheck` was one script running three `tsc` projects serially; it is now three scripts so
+ * they can run at once, and `typecheck` still runs all three for anybody typing it by hand.
+ * `styles` is new — it is the first two steps of `build`, hoisted so that the things which READ
+ * the generated stylesheets can wait on the thing that writes them.
  */
 const MUST_RUN = [
 	'paths',
 	'typecheck:root',
-	// 🔴 `typecheck:server` is deliberately absent since 2026-09-15 (task 148), and this is
-	// the one removal this list is allowed to have: `src/server` is not in this repo any
-	// more. It moved to `cursedbelt-server`, whose own `verify` typechecks it — this
-	// generation's third rule is that a repo's gate proves THAT repo, so a stage here
-	// checking code that lives elsewhere would be the violation, not the fix. Removed in the
-	// same commit as the stage in scripts/verify.ts, which is what this comment is for.
+	// 🔴 `typecheck:server` is deliberately absent since 2026-09-15 (task 148), and this is the
+	// one removal this list is allowed to have: `src/server` is not in this repo any more. It
+	// moved to `cursedbelt-server`, whose own `verify` typechecks it — this generation's third
+	// rule is that a repo's gate proves THAT repo, so a stage here checking code that lives
+	// elsewhere would be the violation, not the fix.
 	'typecheck:specs',
-	// 🔴 Not part of the original chain — added 2026-09-16 (task 172), and pinned here the
-	// same way, because it is the only thing that compiles `scripts/`. `cursedbelt/guardrails`
-	// is an EXPORT resolving into that tree, so dropping this stage puts four apps back to
-	// inheriting type errors from a file nothing here checks. "Adding a stage is free" cuts
-	// both ways: once added, removing it argues with this list.
+	// 🔴 Not part of the original chain — added 2026-09-16 (task 172), and pinned here the same
+	// way, because it is the only thing that compiles `scripts/`. `cursedbelt/guardrails` is an
+	// EXPORT resolving into that tree, so dropping this stage puts four apps back to inheriting
+	// type errors from a file nothing here checks. "Adding a stage is free" cuts both ways: once
+	// added, removing it argues with this list.
 	'typecheck:scripts',
 	'demo:check',
 	'styles',
@@ -59,8 +80,9 @@ describe('the verify graph', () => {
 		expect(
 			missing,
 			`\`bun run verify\` no longer runs:\n  ${missing.join('\n  ')}\n` +
-				'A gate that got faster by proving less is not faster. Add the stage back, or — if it ' +
-				'genuinely belongs somewhere else now — say so here and in scripts/verify.ts together.',
+				'A gate that got faster by proving less is not faster. Add the stage back to the `gate` ' +
+				'block in package.json, or — if it genuinely belongs somewhere else now — say so here ' +
+				'and there together.',
 		).toEqual([]);
 	});
 
@@ -71,49 +93,42 @@ describe('the verify graph', () => {
 	});
 
 	it('is the thing `bun run verify` actually runs', () => {
-		// Without this the graph can be perfect and unreachable: `verify` could quietly go
-		// back to a chain, and every assertion above would still pass.
-		expect(pkg.scripts.verify).toInclude('scripts/verify.ts');
-	});
-
-	it('has no dangling `needs` and no cycle', () => {
-		expect(graphFault(STAGES)).toBeNull();
+		// Without this the graph can be perfect and unreachable: `verify` could quietly go back to
+		// a chain, or the `gate` block could become data nothing reads, and every assertion above
+		// would still pass. `check-gate-graph.ts` makes the same assertion from outside, on every
+		// gate — this is the one that fails in THIS repo's own suite.
+		expect(pkg.scripts.verify).toInclude('gate');
+		expect(pkg.scripts.gate).toInclude('scripts/gate.ts');
 	});
 
-	it('catches a dangling `needs` rather than idling with work left', () => {
-		// The negative control. A typo in `needs` makes a stage that can never become ready,
-		// and a scheduler that simply runs out of ready work would exit 0 having skipped it —
-		// "nothing failed" reported as "everything passed", which is the false green in its
-		// purest form.
-		expect(graphFault([{ script: 'a' }, { script: 'b', needs: ['typo'] }])).toInclude('typo');
-	});
-
-	it('catches a cycle', () => {
-		expect(graphFault([{ script: 'a', needs: ['b'] }, { script: 'b', needs: ['a'] }])).toInclude('cycle');
-	});
-
-	it('catches two stages claiming the same script', () => {
-		expect(graphFault([{ script: 'a' }, { script: 'a' }])).toInclude('same script');
+	it('🔴 a publish re-proves every stage, because a publish cannot be taken back', () => {
+		// The stamp store means a stage whose bytes are already proved is not re-run, which is
+		// right for a gate and wrong for the one run that ships bytes to a registry that will
+		// never let them be replaced. `--force` is the re-roll.
+		expect(pkg.scripts.prepublishOnly).toInclude('--force');
 	});
 });
 
 describe('the two edges the graph rests on', () => {
 	it('keeps everything that reads the generated stylesheets behind `styles`', () => {
 		// `build` regenerates src/styles-static.css and src/styles-utilities.css;
-		// stylesStaticMatches.spec.ts and stylesUtilitiesMatches.spec.ts assert those exact
-		// files are current, and the demo bundle e2e drives is compiled from them. Any of
-		// those three running beside the generators is a writer racing a reader.
+		// stylesStaticMatches.spec.ts and stylesUtilitiesMatches.spec.ts assert those exact files
+		// are current, and the demo bundle e2e drives is compiled from them. Any of those three
+		// running beside the generators is a writer racing a reader.
 		for (const script of ['build', 'test', 'e2e']) {
 			const stage = STAGES.find((s) => s.script === script);
 			expect(stage?.needs, `\`${script}\` must wait for \`styles\``).toContain('styles');
+			// 🔴 And it must say WHY. An edge nobody can explain is an edge nobody can safely
+			// remove, and the shared runner carries a `why` field for exactly this reason.
+			expect(stage?.why, `\`${script}\`'s edge must explain itself`).toBeTruthy();
 		}
 	});
 
 	it('🔴 no spec reads dist/, which is why `build` is a leaf', () => {
-		// The graph runs `build` BESIDE `test` and `e2e` rather than in front of them, and
-		// that is only sound while nothing under test can observe the compiled output. The
-		// build stages into dist.next and swaps, so a reader of `dist/` during a build sees
-		// the previous bytes or — for one `mv` — no directory at all.
+		// The graph runs `build` BESIDE `test` and `e2e` rather than in front of them, and that is
+		// only sound while nothing under test can observe the compiled output. The build stages
+		// into dist.next and swaps, so a reader of `dist/` during a build sees the previous bytes
+		// or — for one `mv` — no directory at all.
 		const offenders: string[] = [];
 		const walk = (dir: string): void => {
 			for (const entry of readdirSync(dir)) {
@@ -127,8 +142,8 @@ describe('the two edges the graph rests on', () => {
 				// `namedSubpathsResolve.spec.ts` needs for the same reason.
 				if (entry === 'verifyGraph.spec.ts') continue;
 				const text = readFileSync(full, 'utf8');
-				// A filesystem read whose path argument mentions dist — not the word in prose,
-				// and not `dist.next` inside buildIsStaged's assertions about the SCRIPT TEXT.
+				// A filesystem read whose path argument mentions dist — not the word in prose, and
+				// not `dist.next` inside buildIsStaged's assertions about the SCRIPT TEXT.
 				if (/(?:readFileSync|readdirSync|existsSync|statSync|Bun\.file|new Glob)\([^)]*['"`][^'"`]*\bdist\b/.test(text)) {
 					offenders.push(full.slice(ROOT.length + 1));
 				}
@@ -138,55 +153,7 @@ describe('the two edges the graph rests on', () => {
 		expect(
 			offenders,
 			`these specs read dist/, so \`build\` is no longer a leaf and the graph is wrong:\n  ${offenders.join('\n  ')}\n` +
-				'Either give them `needs: ["build"]` in scripts/verify.ts, or stop reading dist.',
+				'Either give them `needs: ["build"]` in the `gate` block, or stop reading dist.',
 		).toEqual([]);
 	});
 });
-
-describe('the job limit', () => {
-	it('defaults to a third of the cores, because a stage is not a process', () => {
-		// e2e alone spawns seven Playwright workers; build spawns two tsc processes. Six
-		// stages is already twenty-odd processes on a machine with fourteen cores.
-		expect(jobLimit({}, 14)).toBe(4);
-		expect(jobLimit({}, 4)).toBe(2);
-		expect(jobLimit({}, 64)).toBe(6);
-	});
-
-	it('honours an explicit override, including 1', () => {
-		// 🔴 `1` is the old serial behaviour, and it must stay reachable without a second
-		// gate script existing for somebody to run instead of this one.
-		expect(jobLimit({ CURSEDBELT_VERIFY_JOBS: '1' }, 14)).toBe(1);
-		expect(jobLimit({ CURSEDBELT_VERIFY_JOBS: '9' }, 14)).toBe(9);
-	});
-
-	it('ignores nonsense rather than running zero stages at a time', () => {
-		expect(jobLimit({ CURSEDBELT_VERIFY_JOBS: 'lots' }, 14)).toBe(4);
-		expect(jobLimit({ CURSEDBELT_VERIFY_JOBS: '0' }, 14)).toBe(4);
-		expect(jobLimit({ CURSEDBELT_VERIFY_JOBS: '-3' }, 14)).toBe(4);
-	});
-});
-
-describe('the timing table', () => {
-	it('reports the overlap, which is the whole point of the change', () => {
-		const table = timingTable(
-			[
-				{ script: 'test', ok: true, ms: 60_000, output: '' },
-				{ script: 'e2e', ok: true, ms: 30_000, output: '' },
-			],
-			60_000,
-		);
-		expect(table).toInclude('1.5× overlap');
-		expect(table).toInclude('test');
-	});
-
-	it('says so plainly when nothing overlapped', () => {
-		const table = timingTable([{ script: 'paths', ok: true, ms: 1_000, output: '' }], 1_000);
-		expect(table).toInclude('No overlap');
-	});
-
-	it('shows a skipped stage as skipped, never as passing', () => {
-		const table = timingTable([{ script: 'e2e', ok: false, ms: 0, output: '', skipped: true }], 1_000);
-		expect(table).toInclude('skipped');
-		expect(table).not.toInclude(' ok');
-	});
-});

package/scripts/verify.ts

@@ -1,296 +0,0 @@
-#!/usr/bin/env bun
-/**
- * `bun run verify` — every check this repo has, run as a dependency GRAPH instead of a
- * six-link `&&` chain.
- *
- * ## Why this stopped being a chain
- *
- * Measured 2026-09-15 on an idle machine, stage by stage, with the chain in place:
- *
- *     paths 0.4s · typecheck 22.6s (three tsc projects) · demo:check 7.2s
- *     · build 13.2s · test 67.6s · e2e 32.2s        →  142.0s end to end
- *
- * Five of those are single-threaded `tsc`/scan work that share nothing but the source tree,
- * and they were queued behind one another on a fourteen-core machine. As a graph the same
- * stages finish in roughly half the wall clock, and the saving grows with load: this repo's
- * gate is two thirds of every gate second the generation has ever spent.
- *
- * 🔴 NOTHING HERE IS A SMALLER GATE. Every script the chain ran is still run, and
- * `src/verifyGraph.spec.ts` fails if one is dropped or orphaned. This generation's third
- * rule is that a repo's gate proves that repo — a gate that got faster by proving less is
- * not faster, it is gone. There is deliberately no `verify:fast`: one gate, or the fast one
- * becomes the one everybody runs and the slow one becomes the one nobody does.
- *
- * ## The edges, and why these are the only ones
- *
- * `build` regenerates `src/styles-static.css` and `src/styles-utilities.css` (its first two
- * steps), and `stylesStaticMatches.spec.ts` and `stylesUtilitiesMatches.spec.ts` read those
- * exact files and assert they are current. Run concurrently against a STALE stylesheet, one
- * process writes the bytes the other is asserting on — a flake that appears only on the
- * commit that changed a component, which is the worst possible day for it.
- *
- * So the generators are their own stage and everything that touches those bytes waits for
- * it. Once `styles` has run, the same generators inside `build` find their output current
- * and write nothing (they compare before writing) — which is what makes `build` safe to run
- * beside `test` and `e2e` rather than in front of them.
- *
- * 🔴 `build` is a LEAF, not a prerequisite. No spec under `src` opens `dist/` — checked by
- * `verifyGraph.spec.ts` rather than asserted here — and the demo resolves every
- * `cursedbelt/…` specifier to SOURCE through the export map, so nothing in `test` or `e2e`
- * can see the compiled output at all.
- *
- * ## What it prints
- *
- * Buffered per stage, never interleaved: six concurrent stages writing to one transcript is
- * output nobody can read. The cost of buffering is silence, and silence is exactly what
- * `autopilot/src/proc.ts` exists to prevent — so a heartbeat names what is still running and
- * for how long. A reader can tell "thinking" from "dead" without knowing anything about the
- * suite.
- *
- * 🔴 A failing stage's output is printed LAST, after the timing table. The runner keeps the
- * final 4 KB of a gate as the evidence it files against the task (`worker.ts`), so whatever
- * is at the tail is what a human reads first. The chain got this for free by stopping at the
- * failure; a graph has to put it there on purpose.
- */
-import { cpus } from "node:os";
-import { resolve } from "node:path";
-
-export interface Stage {
-	/**
-	 * The `package.json` script this stage runs. 🔴 A script name, never a command line —
-	 * `package.json` stays the one place every command is spelled, so this file cannot drift
-	 * from what `bun run <thing>` does.
-	 */
-	script: string;
-	/** Stages that must be GREEN before this one may start. */
-	needs?: readonly string[];
-	/** Why the edge exists. An edge nobody can explain is an edge nobody can safely remove. */
-	why?: string;
-}
-
-/**
- * The gate. 🔴 Order in this list means nothing — `needs` is the only thing that sequences
- * anything, and the scheduler starts whatever is ready.
- */
-export const STAGES: readonly Stage[] = [
-	{ script: "paths" },
-	{ script: "typecheck:root" },
-	{ script: "typecheck:specs" },
-	// 🔴 Added 2026-09-16 (task 172). `tsconfig.json` includes `src` only, so the eleven
-	// files under `scripts/` were compiled by nothing — including `guardrailsEnforce.ts`,
-	// which package.json EXPORTS as `cursedbelt/guardrails`. Four apps were typechecking a
-	// file this repo's own gate had never looked at, and inheriting its errors.
-	{ script: "typecheck:scripts" },
-	{ script: "demo:check" },
-	{ script: "styles" },
-	{
-		script: "build",
-		needs: ["styles"],
-		why: "its first two steps are the same generators; two writers on one stylesheet is a race",
-	},
-	{
-		script: "test",
-		needs: ["styles"],
-		why: "stylesStaticMatches / stylesUtilitiesMatches read those two files and assert they are current",
-	},
-	{
-		script: "e2e",
-		needs: ["styles"],
-		why: "the demo bundle it drives is compiled from the same stylesheets",
-	},
-];
-
-/** The repo root — this file's own directory, one level up. Never a literal. */
-export const ROOT = resolve(import.meta.dir, "..");
-
-/**
- * How many stages may run at once.
- *
- * 🔴 A THIRD of the cores, not all of them, and the reason is that a stage is not a process.
- * `e2e` alone spawns seven Playwright workers and `build` spawns two `tsc` processes, so a
- * cap of six stages is already twenty-odd processes. This Mac reached twenty-one concurrent
- * `bun test` processes once and the machine-wide PreToolUse warning exists because of it.
- * Parallelism never reduces the total CPU work; over-subscribing only converts it into
- * thrash, and browser specs degrade worse than anything else under contention.
- *
- * An explicit `CURSEDBELT_VERIFY_JOBS` wins, including `1`, which is how a bisect gets the
- * old serial behaviour back without a second gate script existing.
- */
-export function jobLimit(env: NodeJS.ProcessEnv = process.env, cpuCount: number = cpus().length): number {
-	const asked = Number(env.CURSEDBELT_VERIFY_JOBS);
-	if (Number.isFinite(asked) && asked >= 1) return Math.floor(asked);
-	return Math.max(2, Math.min(6, Math.floor(cpuCount / 3)));
-}
-
-/**
- * 🔴 Every stage reachable, and every `needs` naming a stage that exists.
- *
- * Both halves matter and they fail in opposite directions: a typo in `needs` would otherwise
- * make a stage that can NEVER run (the scheduler would idle with work left, and "nothing
- * failed" is not the same as "everything passed"), while a cycle would deadlock the same way.
- * Checked before anything is spawned, so a broken graph costs a second rather than a gate.
- */
-export function graphFault(stages: readonly Stage[] = STAGES): string | null {
-	const names = new Set(stages.map((s) => s.script));
-	if (names.size !== stages.length) return "two stages name the same script";
-	for (const stage of stages) {
-		for (const need of stage.needs ?? []) {
-			if (!names.has(need)) return `\`${stage.script}\` needs \`${need}\`, which is not a stage`;
-		}
-	}
-	// Kahn's algorithm: anything still unresolved when nothing more can be resolved is a cycle.
-	const done = new Set<string>();
-	for (;;) {
-		const ready = stages.filter((s) => !done.has(s.script) && (s.needs ?? []).every((n) => done.has(n)));
-		if (ready.length === 0) break;
-		for (const s of ready) done.add(s.script);
-	}
-	const stuck = stages.filter((s) => !done.has(s.script)).map((s) => s.script);
-	return stuck.length > 0 ? `these stages can never run (a cycle in \`needs\`): ${stuck.join(", ")}` : null;
-}
-
-export interface StageResult {
-	script: string;
-	ok: boolean;
-	ms: number;
-	output: string;
-	/** Not started, because something it needed failed or the run had already gone red. */
-	skipped?: boolean;
-}
-
-function secs(ms: number): string {
-	return `${(ms / 1000).toFixed(1)}s`;
-}
-
-/** The table every run ends with, green or red. Pure, so the shape of it is testable. */
-export function timingTable(results: readonly StageResult[], wallMs: number): string {
-	const width = Math.max(10, ...results.map((r) => r.script.length));
-	const cpu = results.reduce((a, r) => a + r.ms, 0);
-	const lines = [`  ${"stage".padEnd(width)}   elapsed  result`];
-	for (const r of [...results].sort((a, b) => b.ms - a.ms)) {
-		const verdict = r.skipped ? "skipped" : r.ok ? "ok" : "FAILED";
-		lines.push(`  ${r.script.padEnd(width)} ${secs(r.ms).padStart(9)}  ${verdict}`);
-	}
-	lines.push(
-		"",
-		`  ${secs(wallMs)} of wall clock; ${secs(cpu)} of stage time. ` +
-			`${cpu > wallMs ? `${(cpu / wallMs).toFixed(1)}× overlap.` : "No overlap — one stage at a time."}`,
-	);
-	return lines.join("\n");
-}
-
-async function runStage(stage: Stage): Promise<StageResult> {
-	const started = Date.now();
-	const child = Bun.spawn([process.execPath, "run", stage.script], {
-		cwd: ROOT,
-		stdout: "pipe",
-		// Merged rather than kept apart: a compiler writes diagnostics to one and progress to
-		// the other, and a reader needs them interleaved the way the stage wrote them.
-		stderr: "pipe",
-	});
-	const [out, err, code] = await Promise.all([
-		new Response(child.stdout).text(),
-		new Response(child.stderr).text(),
-		child.exited,
-	]);
-	return { script: stage.script, ok: code === 0, ms: Date.now() - started, output: `${out}${err}` };
-}
-
-/** Bytes of a failing stage's output that reach the tail. Enough for a stack, not a build log. */
-const FAILURE_TAIL = 12_000;
-
-export async function verify(stages: readonly Stage[] = STAGES): Promise<number> {
-	const fault = graphFault(stages);
-	if (fault) {
-		process.stdout.write(`\n🔴 the verify graph is broken: ${fault}\n`);
-		return 2;
-	}
-	const jobs = jobLimit();
-	const startedAt = Date.now();
-	process.stdout.write(`\n▸ verify — ${stages.length} stages, up to ${jobs} at once.\n\n`);
-
-	const results = new Map<string, StageResult>();
-	const running = new Map<string, number>();
-	let red = false;
-
-	// 🔴 Names what is STILL running, never a spinner. The question a reader has at minute
-	// four of a Playwright suite is "which stage, and how long has it been there" — a
-	// progress animation answers neither, and the transcript this lands in is a file.
-	const heartbeat = setInterval(() => {
-		if (running.size === 0) return;
-		const live = [...running.entries()]
-			.map(([script, at]) => `${script} ${secs(Date.now() - at)}`)
-			.sort()
-			.join(" · ");
-		process.stdout.write(`  ⧗ still running: ${live}\n`);
-	}, 30_000);
-	// Never hold the process open on the timer alone.
-	heartbeat.unref?.();
-
-	const inFlight = new Set<Promise<void>>();
-	const start = (stage: Stage): void => {
-		running.set(stage.script, Date.now());
-		process.stdout.write(`  ▶ ${stage.script}\n`);
-		const task = runStage(stage).then((result) => {
-			running.delete(stage.script);
-			results.set(result.script, result);
-			if (!result.ok) red = true;
-			process.stdout.write(`  ${result.ok ? "✔" : "✘"} ${result.script} ${secs(result.ms)}\n`);
-		});
-		inFlight.add(task);
-		void task.finally(() => inFlight.delete(task));
-	};
-
-	for (;;) {
-		// 🔴 Once anything is red, nothing NEW starts — the chain would never have reached it —
-		// but whatever is already running is left to finish. Killing an in-flight stage buys
-		// back seconds that are already spent and throws away a second, independent failure
-		// that would otherwise be in the same report.
-		const ready = red
-			? []
-			: stages.filter(
-					(s) =>
-						!results.has(s.script) &&
-						!running.has(s.script) &&
-						(s.needs ?? []).every((n) => results.get(n)?.ok === true),
-				);
-		while (ready.length > 0 && running.size < jobs) {
-			const next = ready.shift();
-			if (next) start(next);
-		}
-		if (inFlight.size === 0) break;
-		await Promise.race(inFlight);
-	}
-	clearInterval(heartbeat);
-
-	for (const stage of stages) {
-		if (!results.has(stage.script)) {
-			results.set(stage.script, { script: stage.script, ok: false, ms: 0, output: "", skipped: true });
-		}
-	}
-
-	const all = stages.map((s) => results.get(s.script) as StageResult);
-	const failed = all.filter((r) => !r.ok && !r.skipped);
-	const skipped = all.filter((r) => r.skipped);
-	const wall = Date.now() - startedAt;
-
-	process.stdout.write(`\n${timingTable(all, wall)}\n`);
-	if (skipped.length > 0) {
-		process.stdout.write(
-			`\n  ⏭ not run, because the gate was already red: ${skipped.map((r) => r.script).join(", ")}\n`,
-		);
-	}
-	if (failed.length === 0) {
-		process.stdout.write(`\n✅ verify green in ${secs(wall)}.\n`);
-		return 0;
-	}
-	// 🔴 LAST. `worker.ts` files the final 4 KB of this as the evidence against the task.
-	for (const r of failed) {
-		process.stdout.write(`\n\n${"═".repeat(72)}\n🔴 FAILED: bun run ${r.script}  (${secs(r.ms)})\n${"═".repeat(72)}\n`);
-		process.stdout.write(r.output.length > FAILURE_TAIL ? `…\n${r.output.slice(-FAILURE_TAIL)}` : r.output);
-	}
-	process.stdout.write(`\n\n🔴 verify FAILED in ${secs(wall)}: ${failed.map((r) => r.script).join(", ")}\n`);
-	return 1;
-}
-
-if (import.meta.main) process.exit(await verify());