rvlib-shipkit 0.38.0 → 1.0.0

package/src/core/run-check.ts

@@ -1,35 +1,31 @@
-// periodic health — contracts + every *.check.ts in the repo. Discovery IS
-// the registration (core/discover-checks.ts); each check runs as a
-// subprocess: wire lines parsed back, exit code is truth.
+// THE HEALTH PASS — `shipkit check`: every check this repo has except the
+// build steps, through the one runner (core/check-runner.ts). `shipkit ci` asks
+// the same runner for the gate's set instead (core/run-ci.ts), so the two
+// commands differ by the QUESTION and never by the engine.
 //
-// NOTHING here decides what may be remembered any more. A rule or a check is
-// replayed when it DECLARED how ("inputs" makes it content-keyed and the
-// ledger owns it, "ttl" makes it a world probe and CheckSuite owns it), and
-// otherwise it is measured every run. The blanket 30-minute orchestrator TTL
-// that used to cover every plain check died with that: it cached by default,
-// on top of whatever the check cached for itself, so one question had two
-// staleness windows and neither was declared by anyone. `--fresh`
-// (SHIPKIT_FRESH=1, which travels to children) busts the one that is left.
-import { join, relative } from 'path'
-import { CheckSuite, type CheckOutcome } from './check-suite.ts'
-import { gateUnits } from '../ledger/gate-units.ts'
-import { Ledger, stampReplayed } from '../ledger/ledger.ts'
+// NOTHING here decides what may be remembered. A check is replayed when it
+// DECLARED how ("inputs" makes it content-keyed and the ledger owns it, "ttl"
+// makes it a world probe and the world cache owns it), and otherwise it is
+// measured every run. `--fresh` (SHIPKIT_FRESH=1, which travels to children)
+// busts both.
+import { join } from 'path'
+import { composeChecks, envTier, gateInventory, type GateCheck, type TestTier } from '../ledger/gate-checks.ts'
+import { Ledger } from '../ledger/ledger.ts'
+import { RunLog, type InvokedBy } from '../ledger/run-log.ts'
 import { storeRoot } from '../ledger/store.ts'
-import { CheckCtx } from './check-ctx.ts'
-import { discoverChecks } from './discover-checks.ts'
-import { spawnWithTimeout } from './spawn-timeout.ts'
+import { gateBinary } from '../ledger/toolchain-identity.ts'
+import { runChecks, type Audience, type CheckEvent, type CheckResult } from './check-runner.ts'
 import { loadRepoConfig, type RepoConfig } from '../repo-config.ts'
 import { reportToMotherhome } from './motherhome.ts'
-import { RULES } from '../rules/rule-registry.ts'
-import { ruleCacheExtra, runRuleLint } from '../rules/rule.ts'
-import { formatLine, parseWireOutput, type Line } from './wire.ts'
+import { unknownWhenIds } from './when.ts'
+import { formatLine, type Line } from './wire.ts'
 import { writeStatus } from './write-status.ts'
-import { gateInventory } from '../ledger/gate-units.ts'
-import { UNIT_TABLE_FILE, writeUnitTable } from '../ledger/unit-table.ts'
+import { CHECK_TABLE_FILE, writeCheckTable } from '../ledger/check-table.ts'
 import { SHARE_ENV } from '../release/releases-share.ts'
 import { rmSync } from 'fs'
+import { CI_LOG_DIR } from './layout.ts'
 
-const CHECK_TIMEOUT_MS = 120_000
+export type { CheckEvent } from './check-runner.ts'
 
 export type CheckOpts = {
     json?: boolean
@@ -40,65 +36,64 @@ export type CheckOpts = {
     status?: boolean
     /** line sink — commands pass their context stream; defaults to console */
     print?: (line: string) => void
-    /** per-check completion tap — the TUI checks panel streams results in */
-    onResult?: (name: string, r: CheckOutcome) => void
-    /** the already-resolved config, same contract as runCi: the caller that
-     *  decides severity and the engine that runs the rules must read the same
-     *  object, or a blocking rule failure silently reclassifies as a probe */
+    /** per-CHECK completion tap: the real status, whether it replayed, what it
+     *  cost. The demotion of a non-blocking failure happens in the LINES (a
+     *  FAIL is rewritten to a warn before anything sees it), so `status` here
+     *  is the check's REAL outcome and `advisory` says it cannot block. */
+    onCheck?: (e: CheckEvent) => void
+    /** the run's timings log, when the caller already opened one (runCi does),
+     *  and the caller then owns the flush. null = record nothing. */
+    runLog?: RunLog | null
+    /** who started this run, as the run record files it: a terminal, the
+     *  hub's buttons, or the hub's daily timer */
+    invokedBy?: InvokedBy
+    /** the already-resolved config: the caller that decides severity and the
+     *  engine that runs the checks must read the same object */
     config?: RepoConfig
-    /** run only the checks that can BLOCK. A check declaring blocking:false
-     *  cannot change the outcome, so running it is pure cost: a release does
-     *  not need to know whether a DNS provider is reachable, and probing one
-     *  spends a third-party API call per publish. Undeclared checks are still
-     *  collected, because an unclassified check stays fatal. */
+    /** run only the checks that can BLOCK (the release path) */
     onlyBlocking?: boolean
-    /** the caller is the GATE (`shipkit ci`), so checks that declared
-     *  `export const gate = false` are skipped. `shipkit check` leaves it unset
-     *  and runs everything: the health surface is where a human todo list
-     *  belongs, and the gate is not. */
-    gateOnly?: boolean
-    /** the caller narrowed the run to these ids (`ci --only`). Empty or absent
-     *  means everything. A `--only` that narrowed TASKS while every check still
-     *  ran made the flag actively harmful: `ci --only cycles`, a 0.03s task,
-     *  probed every third-party service the repo knows about. One flag, one
-     *  meaning, across all three surfaces. */
+    /** which test tier the caller is asking for */
+    tier?: TestTier
+    /** which question: the gate's set (`shipkit ci`) or the health pass's */
+    audience?: Audience
+    /** the caller narrowed the run to these ids (`--only`) */
     only?: string[]
+    /** ids ADDED to a default run (`--with`) */
+    withIds?: string[]
+    /** a label several checks share, parked at once */
+    skipGroups?: string[]
+    /** stop at the first blocking failure */
+    bail?: boolean
+    /** the BUILD steps alone (the TUI's tasks panel) */
+    buildOnly?: boolean
+    /** the gate asks the proactive checks too (`release.requireHealthy`) */
+    includeProactive?: boolean
+    /** ids this caller does not need (a sub-unit release) */
+    exclude?: string[]
+    /** the already-composed check list, when the caller built one (runCi does,
+     *  to open the ledger on it). One walk per run, the same contract the
+     *  ledger and the run record follow. */
+    composed?: GateCheck[]
     /** the run's ledger, when the caller already opened one (runCi does). A
      *  standalone `shipkit check` opens its own. */
     ledger?: Ledger | null
+    /** the gate binary that own ledger is keyed on (default: the one running
+     *  it). Ignored when `ledger` is passed, which carries its own. */
+    cliEntry?: string
     /** refresh the motherhome registry row. runCi passes false and does it
      *  ITSELF, after the ledger has committed: that row is a TRACKED file under
      *  `wiki/`, so writing it before the post-run re-hash makes the gate look
      *  like an agent editing the tree and throws away every result the run just
-     *  measured. Two reports per gate run was duplication anyway. */
+     *  measured. */
     reportHome?: boolean
 }
 
-/** does this rule or check answer to one of the `--only` ids? Matched against
- *  every name the surface is known by (a rule's id AND its title, a discovered
- *  check's name AND its path), because the id an operator types is whichever
- *  one they last saw on the wire. */
-export function matchesOnly(only: string[] | undefined, ...names: string[]): boolean {
-    if (!isNarrowed(only)) return true
-    return only.some((want) => names.some((n) => n.toLowerCase() === want.toLowerCase()))
-}
-
 /** did the operator narrow this run? The ONE reading of `--only` everywhere: an
  *  empty list is not a selection, it is the absence of one. */
 export function isNarrowed(only: string[] | undefined): only is string[] {
     return only != null && only.length > 0
 }
 
-/** every id `--only` can name that is NOT a task: rule ids, rule titles,
- *  discovered check names and their repo-relative paths. `--only` addresses all
- *  three surfaces, so the task runner has to be told which ids belong to the
- *  other two, or it answers `unknown task id` for a check that does run. */
-export function checkSideIds(root: string, c: RepoConfig): string[] {
-    const ids = [...RULES, ...(c.rules ?? [])].flatMap((r) => [r.id, r.title])
-    for (const d of discoverChecks(root)) ids.push(d.name, relative(root, d.path))
-    return ids
-}
-
 export type CheckRun = {
     /** wire lines, with non-blocking failures already downgraded to warnings */
     lines: Line[]
@@ -108,201 +103,148 @@ export type CheckRun = {
     advisoryFailures: string[]
     /** checks that never declared `blocking` — always fatal */
     undeclared: string[]
+    /** `when` entries naming no check of this repo — a toggle that does
+     *  nothing is worse than none, so it is fatal too */
+    unknownWhen: string[]
+    /** what every asked-for check did, in declaration order */
+    results: CheckResult[]
+    /** the run was interrupted or bailed out */
+    interrupted: boolean
 }
 
-/** run every check and classify by what it declared. This is the whole engine;
- *  runCi wraps it with the task DAG, and nothing else decides severity. */
-export async function collectChecks(root: string, o: CheckOpts = {}): Promise<CheckRun> {
+/** THE run body: compose this repo's checks, run the set the audience asks
+ *  for, and classify the outcome by what each check declared. `shipkit check`
+ *  and `shipkit ci` both come through here, and nothing else decides
+ *  severity. */
+export async function runCheckPass(root: string, o: CheckOpts = {}): Promise<CheckRun> {
     const c = o.config ?? (await loadRepoConfig(root))
+    const print = o.print ?? ((l: string) => console.log(l))
     // env carries the flags to child checks — restored after the run so a
-    // long-lived caller (doctor, TUI, hub) is never poisoned by one
+    // long-lived caller (the TUI, the hub) is never poisoned by one
     // fresh/frozen invocation
     const prevFresh = process.env.SHIPKIT_FRESH
     const prevFrozen = process.env.SHIPKIT_FROZEN
     if (o.fresh === true) process.env.SHIPKIT_FRESH = '1'
     if (o.frozen === true) process.env.SHIPKIT_FROZEN = '1'
-    // the caller's ledger, or this run's own. `shipkit check` is a full run
-    // of every rule and check, so it deserves the same replay the gate gets.
+    const tier: TestTier = o.tier ?? envTier()
+    const audience: Audience = o.audience ?? 'health'
+    const composed = o.composed ?? (await composeChecks(root, c, { tier }))
+    const checks = composed.map((g) => g.runnable)
+    // the caller's ledger, or this run's own. `shipkit check` is a full run of
+    // every check it owns, so it deserves the same replay the gate gets.
     let ledger: Ledger | null = o.ledger ?? null
     if (ledger === null && o.ledger === undefined) {
         try {
-            ledger = Ledger.open(root, gateUnits(root, c), { cliEntry: new URL('../cli.ts', import.meta.url).pathname, fresh: o.fresh })
+            ledger = Ledger.open(root, composed.map((g) => g.row.decl), { cliEntry: o.cliEntry ?? gateBinary(), fresh: o.fresh })
         } catch { ledger = null }
     }
-    const replayed = new Set<string>()
-    const unitIdByName = new Map<string, string>()
-    /** what a TTL'd answer is remembered under, beside its rotation key. A TTL
-     *  says how long the WORLD keeps; it cannot say that the probe was
-     *  rewritten, or that a different shipkit measured it. Without these two a
-     *  fixed check replayed its old verdict for the rest of its TTL. */
-    const worldKey = (unitId: string, rotation?: string): string => {
-        let code = ''
-        try { code = ledger?.layer.keyFor(unitId).codeKey ?? '' } catch { code = '' }
-        return `tc=${ledger?.layer.toolchainId ?? ''}\0code=${code}\0${rotation ?? ''}`
-    }
-    const suite = new CheckSuite({
-        name: c.name,
-        storeDir: storeRoot(root),
-        onResult: (name, r) => {
-            o.onResult?.(name, r)
-            // a replay measured nothing, and a red is never stored. A check
-            // that cannot block had its FAIL rewritten to a warn before this
-            // fires, so the demotion list is what says it failed: a content
-            // key has no TTL, so storing that red would pin it until an
-            // unrelated edit moved the tree, and "the box is off" is fixed by
-            // turning the box on, which changes no file.
-            if (ledger == null || r.cached || replayed.has(name) || r.status === 'skip' || r.status === 'fail') return
-            if (advisoryFailures.includes(name)) return
-            const id = unitIdByName.get(name)
-            if (id == null) return
-            ledger.record(id, { status: r.status, lines: r.lines, measuredMs: r.ms })
+    // the caller's log, or this run's own: `shipkit check` measures checks too,
+    // and its timings are as honest as the gate's
+    const log: RunLog | null = o.runLog !== undefined ? o.runLog : RunLog.open(root, {
+        invocation: {
+            kind: audience === 'gate' ? 'ci' : 'check',
+            label: isNarrowed(o.only) ? `shipkit check --only ${o.only.join(',')}` : 'shipkit check',
+            by: o.invokedBy ?? 'cli',
+            narrowed: isNarrowed(o.only),
         },
     })
-    /** a stored answer, re-emitted as a runner that does no work. Keeping it in
-     *  the suite rather than splicing lines afterwards is what preserves
-     *  declaration order, which the wire contract is frozen on. */
-    const addReplay = (unitId: string, name: string, blocking: boolean): boolean => {
-        const hit = ledger?.replay(unitId)
-        if (hit == null) return false
-        replayed.add(name)
-        unitIdByName.set(name, unitId)
-        suite.addCheck({
-            blocking,
-            name,
-            logic: (t) => {
-                for (const l of stampReplayed(hit.lines, hit.measuredMs)) t.lines.push(l)
-                if (t.lines.some((l) => l.kind === 'warn' || l.kind === 'fix-warn')) t.warned = true
-            },
-        })
-        return true
-    }
-    // built-in SK rules (rules/rule-registry.ts) THEN the repo's own
-    // (repo.config rules: []), id-tagged, crash-safe, fix-pointer floor
-    // (rules/rule.ts runRuleLint owns the semantics). `shipkit ci` runs this
-    // same engine, so a blocking rule blocks a commit as well as a doctor run
-    const undeclared: string[] = []
-    const advisoryFailures: string[] = []
-    // a non-blocking failure becomes a WARNING here, at the source. printing
-    // FAIL and exiting 0 would be the tool lying about its own severity, and
-    // demoting in the check means the suite's exit code already means exactly
-    // "something that blocks you failed".
-    const demote = (t: CheckCtx, blocking: boolean, name: string): void => {
-        if (blocking || !t.failed) return
-        if (!advisoryFailures.includes(name)) advisoryFailures.push(name)
-        t.lines = t.lines.map((l) => (l.kind === 'fail' ? { ...l, kind: 'warn' as const } : l.kind === 'fix-fail' ? { ...l, kind: 'fix-warn' as const } : l))
-        t.failed = false
-        t.warned = true
-    }
-    for (const rule of [...RULES, ...(c.rules ?? [])]) {
-        if (!matchesOnly(o.only, rule.id, rule.title)) continue
-        if (o.onlyBlocking === true && !rule.blocking) continue
-        unitIdByName.set(rule.title, rule.id)
-        if (addReplay(rule.id, rule.title, rule.blocking)) continue
-        suite.addCheck({
-            blocking: rule.blocking,
-            name: rule.title,
-            remainValidFor: rule.ttl,
-            cacheExtra: () => worldKey(rule.id, ruleCacheExtra(rule, { root, config: c })),
-            logic: async (t) => { await runRuleLint(rule, t, { root, config: c }); demote(t, rule.blocking, rule.title) },
-        })
-    }
-    // ONE release survey for the whole run: several discovered checks call
+    // ONE release survey for the whole run: several probes call
     // collectReports, each in its own subprocess, and the survey is ~3s of
     // network. The path is per RUN and never reused across runs, so nothing
     // here can serve a stale answer to a later gate (releases-share.ts).
-    // This is the ONLY owner: nothing else in shipkit sets the variable, and an
-    // inherited one can only come from a caller outside the binary, which then
-    // owns its own cleanup.
     const inherited = process.env[SHARE_ENV]
-    const sharePath = inherited != null && inherited !== '' ? inherited : join(root, 'tmp/shipkit-ci', `releases-${process.pid}-${Date.now()}.json`)
-    const childEnv: Record<string, string | undefined> = {
-        ...process.env,
-        [SHARE_ENV]: sharePath,
-        ...(o.fresh === true ? { SHIPKIT_FRESH: '1' } : {}),
-    }
-    for (const d of discoverChecks(root)) {
-        const rel = relative(root, d.path)
-        // file wins, then the repo default, then nothing: an unclassified
-        // check is an error, never a guess
-        if (!matchesOnly(o.only, d.name, rel)) continue
-        // `ci` answers "is my change good". A check that answers something else,
-        // and that can sit red for months with nothing wrong, is not part of
-        // that answer at any interval. `shipkit check` still runs it, and
-        // naming it in `--only` still runs it, so opting out is never a way to
-        // make a check unreachable. "not narrowed" is an EMPTY list as much as
-        // an absent one: the CLI's --only is an Option.Array defaulting to [],
-        // so a `== null` test here reads every plain gate run as narrowed and
-        // opts nothing out (matchesOnly above uses the same predicate).
-        if (o.gateOnly === true && !d.gate && !isNarrowed(o.only)) continue
-        const blocking = d.blocking ?? c.checkDefaults?.blocking
-        if (blocking == null) undeclared.push(rel)
-        if (o.onlyBlocking === true && blocking !== true) continue
-        unitIdByName.set(d.name, d.name)
-        if (addReplay(d.name, d.name, blocking ?? true)) continue
-        suite.addCheck({
-            // a check about the WORLD may remember a measured negative; one
-            // about this repo never does (check-suite.ts, the rule)
-            blocking: blocking ?? true,
-            name: d.name,
-            // a WORLD check says how long its answer keeps; everything else is
-            // measured every run rather than blanket-cached by this layer
-            remainValidFor: d.ttl ?? undefined,
-            cacheExtra: () => worldKey(d.name),
-            logic: async (t) => {
-                const r = await spawnWithTimeout(['bun', d.path], { cwd: root, timeoutMs: CHECK_TIMEOUT_MS, env: childEnv })
-                for (const l of parseWireOutput(r.out)) t.lines.push(l)
-                if (t.lines.some((l) => l.kind === 'warn')) t.warned = true
-                if (t.lines.some((l) => l.kind === 'fail')) t.failed = true
-                // exit code is truth — a non-zero exit with no FAIL line
-                // (crash, non-wire output, timeout) must still fail loud
-                if (r.code !== 0 && !t.failed)
-                    t.fail(`${d.name} exited ${r.code}${r.timedOut ? ` (timeout after ${CHECK_TIMEOUT_MS}ms)` : ''} — ${r.out.trim().split('\n').at(-1)?.slice(0, 160) ?? ''}`, `bun ${rel}`)
-                demote(t, blocking ?? true, d.name)
-            },
-        })
+    const sharePath = inherited != null && inherited !== '' ? inherited : join(root, CI_LOG_DIR, `releases-${process.pid}-${Date.now()}.json`)
+    const collected: Line[] = []
+    const sink = (l: string): void => print(l)
+    const summary = await runChecks({
+        checks,
+        root,
+        config: c,
+        audience,
+        fullTier: tier === 'full',
+        logDir: c.logDir ?? join(root, CI_LOG_DIR),
+        cache: { storeDir: storeRoot(root), ns: c.name, now: Date.now },
+        ledger,
+        log,
+        childEnv: { [SHARE_ENV]: sharePath, ...(o.fresh === true ? { SHIPKIT_FRESH: '1' } : {}) },
+        bail: o.bail,
+        skipGroups: o.skipGroups,
+        onlyIds: o.only,
+        withIds: o.withIds,
+        onlyBlocking: o.onlyBlocking,
+        buildOnly: o.buildOnly,
+        includeProactive: o.includeProactive,
+        exclude: o.exclude,
+        print: sink,
+        onCheck: (e) => { collected.push(...e.lines); o.onCheck?.(e) },
+    })
+    const lines: Line[] = []
+    const say = (l: Line): void => { lines.push(l); print(formatLine(l, false)) }
+    // a declaration in a shape the check file replaced is reported by check
+    // SK016, which also carries the fixer that rewrites it: one owner, one
+    // line, one command, rather than a warning per surface.
+    //
+    // checks this run did not ask about: named here rather than printed one
+    // line each, because twenty four `skip:` lines is the wall of text the
+    // page just replaced
+    if (summary.parked.length > 0) {
+        const head = summary.parked.slice(0, 8).join(', ')
+        say({ kind: 'skip', text: `${summary.parked.length} check(s) not in this run (health only, release only at the quick tier, or a skipped group): ${head}${summary.parked.length > 8 ? `, and ${summary.parked.length - 8} more` : ''}` })
     }
-    const r = await suite.execute()
     // the survey dies with the run that made it, and only the run that made it
     if (inherited == null || inherited === '') for (const f of [sharePath, `${sharePath}.lock`]) { try { rmSync(f, { force: true }) } catch {} }
     if (prevFresh == null) delete process.env.SHIPKIT_FRESH; else process.env.SHIPKIT_FRESH = prevFresh
     if (prevFrozen == null) delete process.env.SHIPKIT_FROZEN; else process.env.SHIPKIT_FROZEN = prevFrozen
     // frozen = a release-shaped run: reporting would re-dirty the tree the
-    // caller is about to demand clean (field wart 2026-08-05, second head)
+    // caller is about to demand clean
     if (o.frozen !== true && o.reportHome !== false) reportToMotherhome(root, c)
     // the caller that OPENED the ledger owns committing it: runCi commits once
-    // after its tasks and its checks, so a task and a check in one run share
-    // one post-run re-hash
-    if (o.ledger === undefined && ledger != null) r.lines.push(...ledger.header(ledger.commit()))
-    return { lines: r.lines, blocked: r.exitCode !== 0, advisoryFailures, undeclared }
+    // after everything, so one post-run re-hash covers the whole gate
+    if (o.ledger === undefined && ledger != null) for (const l of ledger.header(ledger.commit())) say(l)
+    // the caller that OPENED the record owns writing it, the same rule
+    if (o.runLog === undefined && log != null) for (const l of log.flush()) say(l)
+    // a `when` id naming nothing is a switch wired to no check: the id is read
+    // against the WHOLE inventory this run composed, never its narrowed list
+    const unknownWhen = unknownWhenIds(composed.map((g) => g.row), c)
+    return {
+        lines: [...collected, ...lines],
+        blocked: !summary.ok,
+        advisoryFailures: summary.advisoryFailures,
+        undeclared: summary.undeclared,
+        unknownWhen,
+        results: summary.results,
+        interrupted: summary.interrupted,
+    }
 }
 
-/** `shipkit check` as a standalone command: the same engine, printed. */
+/** `shipkit check` as a standalone command: the same runner, printed. */
 export async function runCheck(root: string, o: CheckOpts = {}): Promise<number> {
     const print = o.print ?? ((l: string) => console.log(l))
     const c = o.config ?? (await loadRepoConfig(root))
-    const run = await collectChecks(root, { ...o, config: c })
-    const code = run.blocked || run.undeclared.length > 0 ? 1 : 0
+    const run = await runCheckPass(root, { ...o, config: c })
+    const code = run.blocked || run.undeclared.length > 0 || run.unknownWhen.length > 0 ? 1 : 0
     if (o.json === true) { print(JSON.stringify(run)); return code }
-    const color = process.stdout.isTTY && process.env.NO_COLOR == null
-    for (const l of run.lines) print(formatLine(l, color))
     for (const u of run.undeclared) {
         print(`FAIL: ${u} does not declare whether it blocks`)
-        print(`      fix: add \`export const blocking = true\` (about this repo) or \`false\` (about the world) to that file`)
+        print(`      fix: add \`blocking: true\` (about this repo) or \`false\` (about the world) to that check`)
+    }
+    for (const id of run.unknownWhen) {
+        print(`FAIL: when.${id} names no check of this repo`)
+        print(`      fix: \`shipkit checks\` lists every id; drop the entry or correct it`)
     }
     if (o.status !== false) {
-        // the producing command is named honestly: a checks-only run must not
+        // the producing command is named honestly: a health run must not
         // overwrite the gate verdict with a green nobody gated
         const st = writeStatus(root, {
             name: c.name,
             command: 'shipkit check',
             lines: run.lines.map((l) => formatLine(l, false)),
             exitCode: code,
-            sidecar: { file: UNIT_TABLE_FILE, says: 'Every unit this repo can run, and whether it blocks you' },
+            sidecar: { file: CHECK_TABLE_FILE, says: 'Every check this repo can run, and whether it blocks you' },
         })
         if (!st.written) print(`WARN ${st.warn}`)
-        const units = writeUnitTable(root, { name: c.name, rows: gateInventory(root, c) })
-        if (!units.written) print(`WARN ${units.warn}`)
-
+        const checks = writeCheckTable(root, { name: c.name, rows: await gateInventory(root, c) })
+        if (!checks.written) print(`WARN ${checks.warn}`)
     }
     return code
 }