rvlib-shipkit 1.2.0 → 1.4.0

package/src/contracts/web-surface.ts

@@ -0,0 +1,59 @@
+// What a repo serves on the web, read from how it deploys: a GitHub Pages
+// workflow, a wrangler config, or deploy.sh. The web root is where the
+// identity outputs (favicon, logo, OG image) must land to be served, so it
+// comes from the deploy, never a hardcoded `public/`.
+// pure over the disk it is handed: SK002 is cached on what it reads through it
+import type { ScanCtx } from '../core/check-ctx.ts'
+
+export type WebDisk = Pick<ScanCtx, 'read' | 'exists' | 'entries'>
+/** `source`: the file that says the repo deploys; `root`: the served dir, null when that file does not name one */
+export type WebDeploy = { source: string; root: string | null }
+
+const WORKFLOWS = '.github/workflows'
+const PAGES = /actions\/(?:deploy-pages|upload-pages-artifact)|peaceiris\/actions-gh-pages|cloudflare\/(?:pages|wrangler)-action|wrangler\s+pages\s+deploy/
+const WRANGLER = ['wrangler.toml', 'wrangler.json', 'wrangler.jsonc']
+export const DEFAULT_WEB_ROOT = 'public'
+
+const clean = (dir: string): string => dir.replace(/^["']|["']$/g, '').replace(/^\.\//, '').replace(/\/+$/, '') || '.'
+
+/** the served dir a deploy file names, null when it names none */
+function rootIn(text: string): string | null {
+    const pick = (re: RegExp): string | null => {
+        const m = text.match(re)
+        return m?.[1] != null ? clean(m[1]) : null
+    }
+    return (
+        pick(/upload-pages-artifact@[^\n]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+path:\s*(\S+)/) ??
+        pick(/publish_dir:\s*(\S+)/) ??
+        pick(/wrangler\s+pages\s+deploy\s+([^\s-]\S*)/) ??
+        pick(/pages_build_output_dir["']?\s*[:=]\s*["']([^"']+)["']/) ??
+        pick(/\[assets\][^[]*?directory\s*=\s*["']([^"']+)["']/) ??
+        pick(/"assets"\s*:\s*\{[^}]*"directory"\s*:\s*"([^"]+)"/) ??
+        pick(/\[site\][^[]*?bucket\s*=\s*["']([^"']+)["']/)
+    )
+}
+
+/** every deploy this repo declares, in the order a web root is read from */
+export function webDeploys(d: WebDisk): WebDeploy[] {
+    const out: WebDeploy[] = []
+    for (const e of d.entries(WORKFLOWS)) {
+        if (e.kind !== 'file' || !/\.ya?ml$/.test(e.name)) continue
+        const text = d.read(`${WORKFLOWS}/${e.name}`) ?? ''
+        if (PAGES.test(text)) out.push({ source: `${WORKFLOWS}/${e.name}`, root: rootIn(text) })
+    }
+    for (const f of WRANGLER) {
+        const text = d.exists(f, 'file') ? d.read(f) : null
+        if (text != null) out.push({ source: f, root: rootIn(text) })
+    }
+    const sh = d.exists('deploy.sh', 'file') ? d.read('deploy.sh') : null
+    if (sh != null) out.push({ source: 'deploy.sh', root: rootIn(sh) })
+    return out
+}
+
+/** where the identity outputs go: the config's `contracts.webRoot`, else the
+ *  first dir a deploy names, else `public` */
+export function webRootOf(configured: string | undefined, deploys: WebDeploy[]): string {
+    if (configured != null) return clean(configured)
+    return deploys.find((x) => x.root != null)?.root ?? DEFAULT_WEB_ROOT
+}
+

package/src/core/agent-spawn.ts

@@ -0,0 +1,46 @@
+// AGENT SPAWN, found statically: code that starts a Claude or agent process on
+// its own (a spawn or exec of `claude`, `claude -p`, the agent sdk). No tool
+// here starts an agent unless its owner asks in person, so the sweep tests
+// (tests/no-agent-spawn.test.ts, and the house repo's own) fail on any hit.
+//
+// a string that only MENTIONS claude (a url, `~/.claude/projects`, a help
+// line naming the product) is no spawn, and comments are skipped.
+
+export type AgentSpawn = { line: number; what: string }
+
+const SHAPES: { re: RegExp; what: string }[] = [
+    // the sdks that run an agent loop in process or spawn the cli
+    { re: /(['"`])@anthropic-ai\/(?:claude-agent-sdk|claude-code)(?:\/[^'"`]*)?\1/, what: 'imports the agent sdk' },
+    // an argv whose command is claude: spawn(['claude', …]), c.exec(['claude'])
+    { re: /\[\s*(['"`])(?:[^'"`\s]*\/)?claude\1/, what: 'an argv that runs claude' },
+    // spawn('claude', …), execSync('claude -p …'), execFile('claude')
+    { re: /\b(?:spawn|spawnSync|exec|execSync|execFile|execFileSync|execa|execaSync|fork)\s*\(\s*(['"`])(?:[^'"`\s]*\/)?claude(?:\s[^'"`]*)?\1/, what: 'a process call that runs claude' },
+    // the bun shell: $`claude -p …`
+    { re: /\$\s*`\s*(?:[^`\s]*\/)?claude(?:\s|`)/, what: 'a bun shell line that runs claude' },
+    // the headless form, wherever the string goes
+    { re: /(['"`])(?:[^'"`\s]*\/)?claude\s+(?:-p|--print)\b/, what: 'a claude -p command line' },
+]
+
+/** the first agent spawn in one source text, 1-based line, comments skipped */
+export function agentSpawnIn(src: string): AgentSpawn | null {
+    const lines = src.split('\n')
+    let inBlock = false
+    for (let i = 0; i < lines.length; i++) {
+        let l = lines[i]!
+        if (inBlock) {
+            const end = l.indexOf('*/')
+            if (end < 0) continue
+            l = l.slice(end + 2)
+            inBlock = false
+        }
+        l = l.replace(/\/\*.*?\*\//g, '')
+        const open = l.indexOf('/*')
+        if (open >= 0) {
+            inBlock = true
+            l = l.slice(0, open)
+        }
+        l = l.replace(/(^|\s)\/\/.*$/, '$1')
+        for (const s of SHAPES) if (s.re.test(l)) return { line: i + 1, what: s.what }
+    }
+    return null
+}

package/src/core/archived.ts

@@ -0,0 +1,82 @@
+// `archived: true` in repo.config.ts: the repo stays known and listed, and
+// nothing runs there (no hub load, so no watch, no plan rows, no gates, no
+// processes, no widgets, no identity fill). Read and written as TEXT, never by
+// loading the config: the daemon and the page rows read many configs per poll,
+// and the toggle moves that one key and no other byte.
+import { readFileSync } from 'fs'
+import { join } from 'path'
+import { atomicWrite } from './locked-write.ts'
+import { configDepths } from './identity-color.ts'
+
+const KEY_RE = /(?:^|[{,])\s*(['"]?)archived\1\s*:\s*(true|false)\b/gm
+
+/** every top level `archived` key of `defineRepo({…})` with its value and the
+ *  offsets of the whole `archived: <value>` token */
+function archivedKeys(text: string): { on: boolean; start: number; end: number }[] {
+    const depth = configDepths(text)
+    const out: { on: boolean; start: number; end: number }[] = []
+    for (const m of text.matchAll(KEY_RE)) {
+        const lead = /^[{,]/.test(m[0]) ? 1 : 0
+        const sep = lead === 1 ? m.index : m.index - 1
+        if (sep < 0 || depth[sep] !== 1) continue
+        const start = m.index + lead + /^[{,]?(\s*)/.exec(m[0])![1]!.length
+        out.push({ on: m[2] === 'true', start, end: m.index + m[0].length })
+    }
+    return out
+}
+
+/** does the config text archive the repo */
+export const archivedOfText = (text: string): boolean => archivedKeys(text).some((k) => k.on)
+
+/** the config text with the repo archived or not. On: the key reads true, a
+ *  missing one lands as the first key of `defineRepo({`. Off: the key goes,
+ *  so a round trip gives the text back byte for byte */
+export function setArchivedText(text: string, on: boolean): string {
+    const keys = archivedKeys(text)
+    if (keys.length > 1) throw new Error('repo.config.ts declares `archived` more than once, set it by hand')
+    const k = keys[0]
+    if (on) {
+        if (k != null) return k.on ? text : `${text.slice(0, k.start)}archived: true${text.slice(k.end)}`
+        const lines = text.split('\n')
+        const open = lines.findIndex((l) => /defineRepo\(\s*\{/.test(l))
+        if (open === -1) throw new Error('repo.config.ts has no `defineRepo({` to write `archived` into, set it by hand')
+        const line = lines[open]!
+        if (/defineRepo\(\s*\{\s*$/.test(line)) {
+            const next = lines.slice(open + 1).find((l) => l.trim() !== '' && !/^\s*}/.test(l))
+            const pad = next != null ? /^(\s*)/.exec(next)![1]! : `${/^(\s*)/.exec(line)![1]!}    `
+            return [...lines.slice(0, open + 1), `${pad}archived: true,`, ...lines.slice(open + 1)].join('\n')
+        }
+        lines[open] = line.replace(/defineRepo\(\s*\{\s*/, (m) => `${m}archived: true, `)
+        return lines.join('\n')
+    }
+    if (k == null) return text
+    // a line of its own goes whole, an inline key goes with its comma
+    const lineStart = text.lastIndexOf('\n', k.start - 1) + 1
+    const lineEnd = text.indexOf('\n', k.end)
+    const rest = text.slice(k.end, lineEnd === -1 ? text.length : lineEnd)
+    if (text.slice(lineStart, k.start).trim() === '' && /^\s*,?\s*$/.test(rest)) return text.slice(0, lineStart) + text.slice(lineEnd === -1 ? text.length : lineEnd + 1)
+    const after = /^\s*,\s*/.exec(text.slice(k.end))
+    if (after != null) return text.slice(0, k.start) + text.slice(k.end + after[0].length)
+    const before = /,\s*$/.exec(text.slice(0, k.start))
+    return before != null ? text.slice(0, k.start - before[0].length) + text.slice(k.end) : text.slice(0, k.start) + text.slice(k.end)
+}
+
+const CONFIG_FILE = 'repo.config.ts'
+
+/** is this repo archived; false when it has no readable config */
+export function isArchived(root: string): boolean {
+    try {
+        return archivedOfText(readFileSync(join(root, CONFIG_FILE), 'utf8'))
+    } catch {
+        return false
+    }
+}
+
+/** archive the repo or bring it back: only that key of its config moves */
+export function writeArchived(root: string, on: boolean): boolean {
+    const path = join(root, CONFIG_FILE)
+    const text = readFileSync(path, 'utf8')
+    const out = setArchivedText(text, on)
+    if (out !== text) atomicWrite(path, out)
+    return on
+}

package/src/core/budget.ts

@@ -11,12 +11,14 @@ import type { MachineLoad } from '../suite/judge-suites.ts'
  *  2s at their 90th percentile, and the few past it shell out to a tool */
 export const IN_PROCESS_BUDGET_MS = 2_000
 
-/** a subprocess (a build step, a test suite, a `cmd` check) or a world probe.
+/** a subprocess (a build step, a test suite, a `cmd` check) or a world probe
+ *  (a `ttl` check, or a `never:` one, whose answer lives outside the repo).
  *  Read off the same record: every typecheck stays under 6s at its 90th
  *  percentile, and the quick test suites under 6s but one */
 export const SUBPROCESS_BUDGET_MS = 10_000
 
-/** what a check declares about itself that picks its default */
+/** what a check declares about itself that picks its default. `world`: it
+ *  declares `ttl` or `never`, so it reads the world rather than the repo */
 export type BudgetKind = { build: boolean; cmd: boolean; world: boolean }
 
 export const defaultBudget = (k: BudgetKind): number => (k.build || k.cmd || k.world ? SUBPROCESS_BUDGET_MS : IN_PROCESS_BUDGET_MS)
@@ -36,7 +38,15 @@ export const unknownBudgetIds = (ids: readonly string[], budgets: Record<string,
 export const budgetValueProblem = (v: unknown): string | null =>
     typeof v === 'number' && Number.isInteger(v) && v > 0 ? null : `must be a whole number of milliseconds above 0, got ${JSON.stringify(v)}`
 
-export const machineLoad = (): MachineLoad => ({ load1: loadavg()[0] ?? 0, cores: availableParallelism() })
+/** `<load1>/<cores>` in this variable pins the reading: a test of a budget
+ *  verdict must not depend on what else the machine runs */
+export const MACHINE_LOAD_ENV = 'SHIPKIT_MACHINE_LOAD'
+
+export const machineLoad = (): MachineLoad => {
+    const pinned = process.env[MACHINE_LOAD_ENV]?.match(/^(\d+(?:\.\d+)?)\/(\d+)$/)
+    if (pinned != null) return { load1: Number(pinned[1]), cores: Number(pinned[2]) }
+    return { load1: loadavg()[0] ?? 0, cores: availableParallelism() }
+}
 
 /** `10s` for a whole second count, `150ms` otherwise */
 export const fmtBudget = (ms: number): string => (ms % 1000 === 0 ? `${ms / 1000}s` : `${ms}ms`)
@@ -49,12 +59,12 @@ export const isBudgetLine = (text: string): boolean => /^\S+ (passed|warned) in
 /** a test check sends the reader to the page that breaks its time down */
 const isTestCheck = (id: string): boolean => id === 'test' || id.startsWith('test:')
 
-/** the WARN a pass over its budget prints, or null inside it. A loaded
- *  machine is named, because wall time is what the reader waits on and load
- *  is the first thing to rule out */
+/** the WARN a pass over its budget prints, or null inside it. Null too with
+ *  the load at or past the core count: the budget judges wall time, and on a
+ *  saturated machine the wall is the machine's, not the check's (a suite's
+ *  own verdict judges CPU instead, suite/judge-suites.ts) */
 export function budgetLine(id: string, ms: number, budgetMs: number, load: MachineLoad, verb: 'passed' | 'warned' = 'passed'): string | null {
-    if (ms <= budgetMs) return null
-    const loaded = load.load1 >= load.cores ? ` under load ${load.load1.toFixed(1)} on ${load.cores} cores,` : ''
+    if (ms <= budgetMs || load.load1 >= load.cores) return null
     const where = isTestCheck(id) ? 'see the tests page for where the time goes' : 'its page in the hub shows every run'
-    return `${id} ${verb} in ${(ms / 1000).toFixed(1)}s,${loaded} over its ${fmtBudget(budgetMs)} budget: ${where}`
+    return `${id} ${verb} in ${(ms / 1000).toFixed(1)}s, over its ${fmtBudget(budgetMs)} budget: ${where}`
 }

package/src/core/canonical-scripts.ts

@@ -65,12 +65,21 @@ export function routesToShipkit(body: string): boolean {
     return /\bshipkit\b\S*(?:\s+\S+)*?\s+ci(?:\s|$)/.test(body.split(/&&|\|\||;/)[0] ?? body)
 }
 
-// recover the consumption style from existing scripts: any shipkit command
-// already running `bun <path>/cli.ts <cmd>` fixes the style for new bodies
+/** is this path shipkit's own cli: a file named exactly `cli.ts` under a
+ *  directory whose name says shipkit. A repo's own cli (`src/cli.ts`,
+ *  `src/cli/comfy-ts-cli.ts`) is not, and taking it for shipkit writes
+ *  scripts that call a command that cli does not have */
+export function isShipkitCli(path: string): boolean {
+    const parts = path.split('/')
+    return parts.at(-1) === 'cli.ts' && parts.slice(0, -1).some((d) => /shipkit/.test(d))
+}
+
+// recover the consumption style from existing scripts: any script already
+// running shipkit's cli by path fixes the style for new bodies
 export function inferBin(scripts: Record<string, string>): string | undefined {
     for (const body of Object.values(scripts)) {
         const m = body.match(/^bun (?:--watch )?(\S+cli\.ts) /)
-        if (m != null && m[1] !== 'node_modules/rvlib-shipkit/src/cli.ts') return m[1]
+        if (m != null && isShipkitCli(m[1]!) && m[1] !== 'node_modules/rvlib-shipkit/src/cli.ts') return m[1]
     }
     return undefined
 }

package/src/core/check-runner.ts

@@ -39,7 +39,7 @@ import { parallelCap } from './parallel.ts'
 import { machinePool, SLOT_HELD_ENV, takeSlot, type SlotPool } from './slots.ts'
 import { budgetLine, machineLoad } from './budget.ts'
 import { killTree, spawnWithTimeout } from './spawn-timeout.ts'
-import { formatLine, parseWireOutput, type Line } from './wire.ts'
+import { FOREVER_MS, formatLine, parseWireOutput, type Line } from './wire.ts'
 import { offLine, type WhenDecl } from './when.ts'
 import { runCheckBody, type CheckDef, type CheckEnv } from '../check.ts'
 import { Ledger, stampCached } from '../ledger/ledger.ts'
@@ -47,7 +47,7 @@ import { attachedStamp } from './outcome-words.ts'
 import type { RunLog, RunStatus } from '../ledger/run-log.ts'
 import { liveStateOf } from '../ledger/live-runs.ts'
 import { CHECK_ID_ENV } from '../ledger/suite-log.ts'
-import { rememberWorld, replayWorld, type WorldCache } from '../ledger/world-cache.ts'
+import { rememberWorld, replayWorld, worldKeyOf, type WorldCache } from '../ledger/world-cache.ts'
 import { extractProblems } from '../problems/extract.ts'
 import { feedsProblemsPane, type Population, type Problem } from '../problems/problem-line.ts'
 
@@ -56,6 +56,10 @@ import { feedsProblemsPane, type Population, type Problem } from '../problems/pr
  *  about the world. */
 export const CHECK_TIMEOUT_MS = 120_000
 
+/** the most findings a failed build step keeps beside its headline: a tool
+ *  that prints a wall of them is read in its log */
+const MAX_EXTRA = 20
+
 /** epoch ms that never goes backwards inside one process, whole numbers so a
  *  row's `at - ms` is its start exactly: the wall clock can step back (an NTP
  *  correction), and a check stamped before an earlier one ended makes the
@@ -191,6 +195,9 @@ export type RunChecksOpts = {
      *  gate the whole repo, since the check's own gate already ran. */
     exclude?: string[]
     print?: (line: string) => void
+    /** where the green summary goes when the caller prints its own verdict
+     *  (`shipkit ci` does). Default: print */
+    detail?: (line: string) => void
     color?: boolean
     onCheck?: (e: CheckEvent) => void
 }
@@ -227,11 +234,21 @@ function closure(checks: RunnableCheck[], ids: string[]): Set<string> {
     return keep
 }
 
+/** how many tests a suite ran, read from the headline it prints last
+ *  (`Ran 920 tests across 12 files.`), null when it printed none */
+export function testsRan(lastLine: string): number | null {
+    const m = /Ran (\d+) tests?/.exec(lastLine)
+    return m == null ? null : Number(m[1])
+}
+
 export type Selection = {
     /** what this run measures */
     selected: RunnableCheck[]
     /** turned off by name, with the reason: never run, always reported */
     off: RunnableCheck[]
+    /** off, and outside what `--only` asked about: reported where the caller
+     *  keeps what nobody acts on */
+    offElsewhere?: RunnableCheck[]
     /** not asked about by this run, and why */
     parked: { id: string; text: string }[]
     /** asked for, and it never said whether it blocks */
@@ -337,6 +354,8 @@ export function selectChecks(o: Pick<RunChecksOpts, 'checks' | 'audience' | 'ful
     if (o.onlyIds != null && o.onlyIds.length > 0) {
         const keep = closure(o.checks, onlyIds)
         selected = selected.filter((u) => keep.has(u.id))
+        // a narrowed run says nothing about the checks it never asked about
+        return { selected, off: off.filter((u) => keep.has(u.id)), offElsewhere: off.filter((u) => !keep.has(u.id)), parked, undeclared, errors }
     }
     return { selected, off, parked, undeclared, errors }
 }
@@ -416,6 +435,9 @@ type Live = RunnableCheck & CheckResult & {
     /** what the headline carries after the id: a failure's last line, or the
      *  reason it never ran */
     tail: string
+    /** a failed build step's other findings, the wire lines its tool printed
+     *  beside the one the headline carries */
+    extra: Line[]
 }
 
 export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
@@ -439,15 +461,18 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
             blocking: u.blocking, advisory: r.advisory, lines: r.lines, problems: r.problems, logPath: r.logPath, lastLine: r.lastLine, note: r.note, attached,
         })
         // an attached check is filed as a replay: it measured nothing, and a
-        // row carrying its wait would read as a check running in this process
-        o.log?.add({ id: u.id, status: r.status, ms: r.ms, replayed: r.replayed || attached, lines: r.lines, at })
+        // row carrying its wait would read as a check running in this process.
+        // A non-blocking failure is filed as the warning the gate printed, so
+        // no surface reading the record paints red what the gate called orange
+        const filed = r.status === 'fail' && r.advisory ? 'warn' : r.status
+        o.log?.add({ id: u.id, status: filed, ms: r.ms, replayed: r.replayed || attached, lines: r.lines, at })
     }
 
     // OFF, in ONE place: skipped by name, never run, never stored, and the
     // reason printed where the verdict would have been
-    for (const u of sel.off) {
+    for (const u of [...sel.off, ...(sel.offElsewhere ?? [])]) {
         const line: Line = { kind: 'skip', text: offLine(u.id, u.when) }
-        emit(line)
+        if (sel.off.includes(u)) emit(line); else (o.detail ?? print)(formatLine(line, color))
         report(u, { id: u.id, status: 'skip', advisory: false, replayed: false, ms: 0, exitCode: null, lines: [line], problems: [], lastLine: line.text, note: 'off', logPath: null })
     }
     // `--only` that leaves nothing to run asked a question nobody answers, and
@@ -461,7 +486,7 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
     const runDir = openRunDir(o.logDir)
     const checks: Live[] = sel.selected.map((u) => ({
         ...u,
-        status: 'skip', advisory: false, replayed: false, ms: 0, exitCode: null, lines: [], problems: [], lastLine: '', note: '', startedAt: 0, endedAt: 0, unmeasured: false, attached: false, reads: null, synthetic: false, tail: '',
+        status: 'skip', advisory: false, replayed: false, ms: 0, exitCode: null, lines: [], problems: [], lastLine: '', note: '', startedAt: 0, endedAt: 0, unmeasured: false, attached: false, reads: null, synthetic: false, tail: '', extra: [],
         logPath: u.body.cmd != null ? join(runDir, `${u.id.replace(/[^a-zA-Z0-9-]/g, '_')}.log`) : null,
     }))
     const selectedIds = new Set(checks.map((u) => u.id))
@@ -499,10 +524,15 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
      *  or that a different shipkit measured it. */
     const worldKey = (u: RunnableCheck): string => {
         let code = ''
-        try { code = o.ledger?.layer.keyFor(u.id).codeKey ?? '' } catch { code = '' }
-        // a check that writes answers a different question when frozen
-        const frozen = u.writes === true ? `\0frozen=${process.env['SHIPKIT_FROZEN'] === '1'}` : ''
-        return `tc=${o.ledger?.layer.toolchainId ?? ''}\0code=${code}\0${u.rotation ?? ''}${frozen}`
+        if (u.ttlMs < FOREVER_MS) try { code = o.ledger?.layer.keyFor(u.id).codeKey ?? '' } catch { code = '' }
+        return worldKeyOf({
+            ttlMs: u.ttlMs,
+            toolchain: u.ttlMs < FOREVER_MS ? o.ledger?.layer.toolchainId ?? '' : '',
+            code,
+            rotation: u.rotation ?? '',
+            // a check that writes answers a different question when frozen
+            frozen: u.writes === true ? process.env['SHIPKIT_FROZEN'] === '1' : null,
+        })
     }
 
     // a non-blocking failure becomes a WARNING here, at the source: printing
@@ -532,10 +562,18 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
         // baked into a remembered line comes back on a replay as if this run
         // had measured it (ledger/ledger.ts rule 5)
         const head = u.lines[0]
+        // a suite's count rides on its own line: `test 920 tests (1.4s)`
+        const ran = u.status === 'pass' || u.status === 'warn' ? testsRan(u.lastLine) : null
+        const counted = ran != null && head != null && head.kind === 'ok' && (head.text === u.id || head.text.startsWith(`${u.id} (`))
+        const id = counted ? `${u.id} ${ran} test${ran === 1 ? '' : 's'}` : u.id
         const shown = u.synthetic && !u.replayed && head != null
-            ? [{ ...head, text: `${u.id} (${(u.ms / 1000).toFixed(1)}s)${u.tail}` }, ...u.lines.slice(1)]
-            : u.lines
-        for (const l of shown) emit(l)
+            ? [{ ...head, text: `${id} (${(u.ms / 1000).toFixed(1)}s)${u.tail}` }, ...u.lines.slice(1)]
+            : counted ? [{ ...head, text: `${id}${head.text.slice(u.id.length)}` }, ...u.lines.slice(1)] : u.lines
+        // a caller printing its own verdict wants one line per green check and
+        // only the warnings of a warned one; a failure prints whole
+        const quiet = (l: Line, i: number): boolean =>
+            o.detail != null && (u.status === 'pass' ? i > 0 : u.status === 'warn' || u.advisory ? l.kind === 'ok' || l.kind === 'note' || l.kind === 'skip' : false)
+        for (const [i, l] of shown.entries()) if (quiet(l, i)) o.detail!(formatLine(l, color)); else emit(l)
         if (u.status === 'fail' && !u.advisory && u.logPath != null)
             emit({ kind: 'fix-fail', text: `full log: ${u.logPath}` })
         report(u, { id: u.id, status: u.status, advisory: u.advisory, replayed: u.replayed, ms: u.ms, exitCode: u.exitCode, lines: u.lines, problems: u.problems, lastLine: u.lastLine, note: u.note, logPath: u.logPath }, finishedAt, u.attached)
@@ -642,14 +680,25 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
         u.problems = findings(u, u.lines, r.out)
         const lastFail = u.lines.filter((l) => l.kind === 'fail').at(-1)
         if (lastFail != null) u.lastLine = lastFail.text.slice(0, 200)
+        // a tool that speaks the wire (the suite runner) ends on its FAIL
+        // lines, and the headline carries only the last one. Only that closing
+        // block is its report: a wire line earlier in the log is some test's
+        // own output
+        if (u.build && u.status === 'fail') {
+            const parsed = parseWireOutput(r.out)
+            let i = parsed.length
+            while (i > 0 && (parsed[i - 1]!.kind === 'fail' || parsed[i - 1]!.kind === 'fix-fail')) i--
+            u.extra = parsed.slice(i).filter((l) => !(l.kind === 'fail' && `FAIL: ${l.text}` === u.lastLine)).slice(-MAX_EXTRA)
+        }
     }
 
     /** a check that printed nothing of its own still has to report that it
      *  ran: the verdict, its name, and (at print time) what it cost */
     const headlineOf = (u: Live): void => {
         u.synthetic = true
-        u.tail = u.status === 'fail' ? (u.lastLine === '' ? '' : ` — ${u.lastLine}`) : u.status === 'skip' ? (u.note === '' ? '' : ` (${u.note})`) : ''
-        u.lines = [{ kind: u.status === 'fail' ? 'fail' : u.status === 'skip' ? 'skip' : 'ok', text: `${u.id}${u.tail}` }]
+        const more = u.extra.filter((l) => l.kind === 'fail').length
+        u.tail = u.status === 'fail' ? (u.lastLine === '' ? '' : ` — ${u.lastLine}${more > 0 ? ` (+${more} more below)` : ''}`) : u.status === 'skip' ? (u.note === '' ? '' : ` (${u.note})`) : ''
+        u.lines = [{ kind: u.status === 'fail' ? 'fail' : u.status === 'skip' ? 'skip' : 'ok', text: `${u.id}${u.tail}` }, ...u.extra]
     }
 
     /** what an attached asker adopts: the verdict and the lines BEFORE this
@@ -842,7 +891,7 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
     const warned = results.filter((r) => r.status === 'warn' || (r.status === 'fail' && r.advisory))
     const ran = results.filter((r) => r.status !== 'skip').length
     if (blocked.length === 0 && !interrupted && results.length > 0)
-        emit({ kind: 'ok', text: warned.length === 0 ? `all ${ran} check(s) green` : `all ${ran} check(s) passed, ${warned.length} with a warning: ${warned.map((r) => r.id).join(', ')}` })
+        (o.detail ?? print)(formatLine({ kind: 'ok', text: warned.length === 0 ? `all ${ran} check(s) green` : `all ${ran} check(s) passed, ${warned.length} with a warning: ${warned.map((r) => r.id).join(', ')}` }, color))
     return {
         ok: blocked.length === 0 && !interrupted,
         interrupted,

package/src/core/discover-checks.ts

@@ -17,6 +17,7 @@
 //
 // Skipped dirs: node_modules, dist, tmp, references (templates for other
 // repos), and every dot-dir.
+import { RETIRED_CHECK_IDS } from './retired-checks.ts'
 import { readdirSync, readFileSync, realpathSync, statSync } from 'fs'
 import { basename, join, relative } from 'path'
 import { check, type CheckDef, type CheckFrom } from '../check.ts'
@@ -55,20 +56,23 @@ export type DiscoveredCheck = {
     from: CheckFrom
 }
 
-function walk(dir: string, out: string[], suffix = SUFFIX): void {
+function walk(dir: string, out: string[], suffix = SUFFIX, dirs?: string[]): void {
+    dirs?.push(dir)
     let entries
     try { entries = readdirSync(dir, { withFileTypes: true }) } catch { return }
     for (const e of entries) {
         if (e.isDirectory()) {
-            if (!IGNORED_DIRS.has(e.name) && !e.name.startsWith('.')) walk(join(dir, e.name), out, suffix)
+            if (!IGNORED_DIRS.has(e.name) && !e.name.startsWith('.')) walk(join(dir, e.name), out, suffix, dirs)
         } else if (e.name.endsWith(suffix)) out.push(join(dir, e.name))
     }
 }
 
-/** every `*.shipkit.ts` file under a repo root, by the same walk. Sorted */
-export function repoUnitFiles(root: string): string[] {
+/** every `*.shipkit.ts` file under a repo root, by the same walk. Sorted.
+ *  `dirs` collects every dir the walk read: a file added to one moves its
+ *  mtime, which is how a reader tells the list moved without walking again */
+export function repoUnitFiles(root: string, dirs?: string[]): string[] {
     const out: string[] = []
-    walk(root, out, UNIT_SUFFIX)
+    walk(root, out, UNIT_SUFFIX, dirs)
     return out.sort()
 }
 
@@ -176,6 +180,7 @@ export async function discoverChecks(root: string): Promise<DiscoveredCheck[]> {
         if (isBuiltin) {
             if (id !== fallback) throw new Error(`${f}: declares id '${id}' but its file name says '${fallback}' — a built-in id is its file name`)
             if ((def.owner ?? '') === '') throw new Error(`${f}: a built-in check names the page that OWNS the invariant`)
+            if (RETIRED_CHECK_IDS[id] != null) throw new Error(`${f}: id '${id}' is retired (${RETIRED_CHECK_IDS[id]}), and an id is never reused`)
         } else if (id.startsWith('SK')) {
             throw new Error(`${rel}: id '${id}' uses the reserved SK prefix — a repo check picks its own (e.g. RV${id.slice(-3)}) or plain words`)
         }

package/src/core/file-stamp.ts

@@ -0,0 +1,20 @@
+// the content of a file no tree id reaches (outside the repo, gitignored, an
+// install), as one short hash for a check's `cacheKey`. `absent` when nothing
+// stands there, so a file appearing or vanishing moves the key too.
+import { createHash } from 'crypto'
+import { readFileSync } from 'fs'
+import { homedir } from 'os'
+import { isAbsolute, join } from 'path'
+
+export function fileStamp(abs: string): string {
+    try {
+        return createHash('sha256').update(readFileSync(abs)).digest('hex').slice(0, 16)
+    } catch {
+        return 'absent'
+    }
+}
+
+/** a path as a config declares it (`~/...`, absolute, or repo relative), absolute */
+export function configPath(root: string, p: string): string {
+    return p.startsWith('~/') ? join(homedir(), p.slice(2)) : isAbsolute(p) ? p : join(root, p)
+}