uniweb 0.64.1 → 0.66.0

package/src/commands/push.js

@@ -5,7 +5,7 @@
  *   - folder lane → one `@uniweb/folder` + the collection-record entities it
  *     references (the dynamic half; the `$ref` closure rides together).
  *
- * Each entity is an entity-content document (`$id` + `$model` + sections). The site's
+ * Each entity is an entity-content document (`$id` + `$schema` + sections). The site's
  * identity on a backend is its site-content uuid, in that backend's section of
  * `sync.json`. A first push to a backend has none — it CREATEs the site (uuid-less),
  * the backend mints + adopts it and returns the new uuid, which `push` records in
@@ -27,15 +27,11 @@
  *
  * Usage:
  *   uniweb push                          Build, push both lanes, back-fill $uuid
- *   uniweb push --org @org               Own the new site under @org. On the FIRST
- *                                        push it decides which org owns the site, and
- *                                        whose storage its assets are charged to;
- *                                        recorded in `sync.json`, and every request
- *                                        after names it. Without it, you are asked
- *                                        once. Later, it must match the workspace the
- *                                        backend works on the site from, or push stops.
- *   uniweb push --personal               Own the new site personally, deliberately:
- *                                        its requests name no workspace.
+ *   uniweb push --org @org               Work in @org for this push, instead of the
+ *   uniweb push --personal               workspace chosen at `uniweb login` (or your
+ *                                        personal workspace). A site this push creates
+ *                                        is created — owned — there; a site the backend
+ *                                        keeps in another workspace stops the push.
  *   uniweb push --dry-run                Report what would be pushed; submit nothing
  *   uniweb push -o out.uwx               Write the .uwx file(s) per lane; submit nothing
  *   uniweb push --foundation <dir>       Use this local foundation for the Model schema
@@ -62,15 +58,14 @@
 import { readFileSync, writeFileSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import yaml from 'js-yaml'
-import { emitSyncPackages } from '@uniweb/build/uwx'
+import { emitSyncPackages, readBackendState } from '@uniweb/build/uwx'
 import { findSiteCopies, describeSiteCopies } from '../utils/site-copies.js'
 import { uploadSiteMedia, describeAssetRefusal } from '../backend/site-media.js'
 import { updateBackendMap, carryServed, SYNC_STORE_FILE } from '@uniweb/build/uwx'
 import { BackendClient } from '../backend/client.js'
 import { resolveSiteDir } from './deploy.js'
-import { warnIfContentDoesNotConform } from '../utils/conformance.js'
+import { refuseIfContentDoesNotConform } from '../utils/conformance.js'
 import { reportSchemalessQueries } from '../utils/schemaless-report.js'
-import { readOrgFlag } from '../utils/args.js'
 import { checkFlags } from '../utils/flag-guard.js'
 import {
   syncedElsewhere,
@@ -88,14 +83,13 @@ import {
   readFolderItemUuids,
   readQueryUuids,
   ensureItemUuids,
+  refuseUnsendableRecords,
   ensureSiteExists,
   clearRemoteSyncStateIfUnbound,
   dropSiteBoundValues,
-  pushSyncPackages,
-  resolveSiteOrgForCreate,
-  nameSiteWorkspace,
-  EXPLICIT_OWNER
+  pushSyncPackages
 } from '../backend/site-sync.js'
+import { resolveWorkspace, describeWorkspace, SOURCE_LABEL } from '../backend/workspace.js'
 
 // Re-exported for downstream importers (pull.js, push.test.js) that read these
 // helpers from this module — their canonical home is now ../backend/site-sync.js.
@@ -155,9 +149,10 @@ export async function push(args = [], deps = {}) {
 
   const siteDir = await resolveSiteDir(args, 'push')
 
-  // Advisory only — warns and pushes. A malformed data block otherwise rides
-  // the sync wire unchecked; see utils/conformance.js.
-  await warnIfContentDoesNotConform(siteDir, { args })
+  // ⭐ A GATE, before anything is sent: the backend checks these records against the
+  // schemas this push registers, so one that does not conform would be refused on
+  // arrival or lose a value on the way. See utils/conformance.js.
+  if (await refuseIfContentDoesNotConform(siteDir, { args })) return { exitCode: 1 }
   // ⭐ THE BACKEND YOU ARE LOGGED IN TO is where this goes *[Diego, 2026-09-21]*, for every
   // backend verb (resolveBackendOrigin). Only UNIWEB_REGISTER_URL — the automation
   // override — outranks it, and nothing talks to a backend the user is not logged in to:
@@ -216,21 +211,13 @@ export async function push(args = [], deps = {}) {
     }
   }
 
-  // WHO will own this site, if this push is the one that creates it. Resolved
-  // before any lane runs, because both create paths below consume it and neither
-  // should be reached with the question still open. A site that already exists
-  // resolves to null without asking — ownership was settled at its create.
-  const org = await resolveSiteOrgForCreate({
-    client,
-    siteDir,
-    args,
-    flag: readOrgFlag(args),
-    personal: args.includes('--personal'),
-    offline: !!output || dryRun
-  })
-  if (org.refused) {
-    error('Refusing to create this site without naming an owner.')
-    note(org.reason)
+  // ⭐ THE WORKSPACE THIS PUSH WORKS IN — the one chosen with the login, unless this
+  // command names another (`workspace.js`). Resolved before any lane runs: a site this
+  // push creates is created in it, and a site the backend keeps elsewhere is refused.
+  const ws = await resolveWorkspace({ client, args, offline: !!output || dryRun })
+  if (ws.refused) {
+    error('This push works in one workspace, and none is chosen.')
+    note(ws.reason)
     return { exitCode: 2 }
   }
 
@@ -289,16 +276,12 @@ export async function push(args = [], deps = {}) {
   }
   if (!fnd.proceed) return { exitCode: 1 }
 
-  // ⭐ Name the workspace every site request works in. The user's own choice (`--org`,
-  // `--personal`, the picker) is explicit, so a `409 wrong_workspace` stops the push; a
-  // recorded one is adopted afresh from the backend's answer when stale
-  // (`nameSiteWorkspace`).
-  nameSiteWorkspace(client, {
-    siteDir,
-    workspace: org.workspace,
-    explicit: EXPLICIT_OWNER.has(org.source),
-    note
-  })
+  // ⭐ Every site request names the workspace; a site outside it stops the push
+  // (`WorkspaceMismatchError`). A site this push creates is created in it — said first.
+  client.setWorkspace(ws.workspace, { source: ws.source })
+  if (ws.source !== 'offline' && !readBackendState(siteDir, client.origin).site?.uuid) {
+    note(`This push creates the site in ${describeWorkspace(ws.workspace)} (${SOURCE_LABEL[ws.source]}).`)
+  }
 
   // Build BOTH directional packages (the producer side). Each carries its own
   // `index` — the per-entity source-file map for back-fill, correlated by submission
@@ -413,6 +396,7 @@ export async function push(args = [], deps = {}) {
   let assetIds = null
   if (!output && !dryRun) {
     let mediaRefs = []
+    let refusals = []
     try {
       const probe = await emitSyncPackages(siteDir, {
       backend: client.origin,
@@ -422,10 +406,14 @@ export async function push(args = [], deps = {}) {
         resolveModel: makeModelResolver({ client, offline: false })
       })
       mediaRefs = probe.localAssets || []
+      refusals = probe.refusals || []
     } catch (err) {
       error(`Could not scan the site for local media: ${err.message}`)
       return { exitCode: 2 }
     }
+    // A record the backend would refuse stops the push HERE — before the site is
+    // created or a byte uploaded, not merely before the send (`refuseUnsendableRecords`).
+    if (refuseUnsendableRecords(refusals, { error, note })) return { exitCode: 1 }
     if (mediaRefs.length) {
       // The site has to exist before its bytes do — an upload with no owning
       // entity is charged and cannot be freed, because freeing means deleting the
@@ -549,6 +537,9 @@ export async function push(args = [], deps = {}) {
   const { siteContent, records, siteContentUuid, warnings, skipped } = pkg
   log('')
   for (const w of warnings) note(`! ${w}`)
+  // The same stop for the paths the probe above does not run on — `-o` and
+  // `--dry-run` say what a push would do, and a push would stop here.
+  if (refuseUnsendableRecords(pkg.refusals, { error, note })) return { exitCode: 1 }
   // Warn level, not dim: this is the author choosing entities vs static files.
   reportSchemalessQueries(pkg.schemaless, { warn, dim: note })
 

package/src/commands/status.js

@@ -25,12 +25,11 @@ import { join } from 'node:path'
 import yaml from 'js-yaml'
 
 import { resolveSiteDir } from './deploy.js'
-import { probeUnpushed, nameSiteWorkspace, readSiteWorkspace } from '../backend/site-sync.js'
-import { readOrgFlag } from '../utils/args.js'
+import { probeUnpushed } from '../backend/site-sync.js'
+import { resolveWorkspace } from '../backend/workspace.js'
 import {
   BackendClient,
   resolveBackendOrigin,
-  workspaceHandle,
   WorkspaceMismatchError
 } from '../backend/client.js'
 import { readBackendState } from '@uniweb/build/uwx'
@@ -39,6 +38,7 @@ import {
   foundationScopedName
 } from '../backend/foundation-bring-along.js'
 import { computeFoundationDigest } from '../utils/code-upload.js'
+import { compareSemverPrecedence } from '../utils/semver-precedence.js'
 import { checkFlags } from '../utils/flag-guard.js'
 
 const c = {
@@ -121,6 +121,7 @@ export async function status(args = []) {
   let site = null
   let fdnLatest = null
   let foundationFresh = null // true/false when both digests are known; else null
+  let localFoundationVersion = null
   let remoteError = null // a refusal about the workspace — the one remote failure worth saying
   if (remote) {
     try {
@@ -128,21 +129,18 @@ export async function status(args = []) {
         args,
         command: 'Status'
       })
-      // The workspace the site's requests name — as pull names it. A stale record is
-      // re-adopted from the backend's answer; `--json` keeps stdout to the document.
-      const orgFlag = readOrgFlag(args)
-      nameSiteWorkspace(client, {
-        siteDir,
-        workspace: orgFlag ? workspaceHandle(orgFlag) : readSiteWorkspace(siteDir, client.origin),
-        explicit: Boolean(orgFlag),
-        note: jsonMode ? undefined : say.dim
-      })
+      // The workspace this status works in — the login's, unless this command names
+      // another (`workspace.js`). None chosen is reported, like a site outside it.
+      const ws = await resolveWorkspace({ client, args })
+      if (ws.refused) throw Object.assign(new Error(ws.reason), { status: 409 })
+      client.setWorkspace(ws.workspace, { source: ws.source })
       if (uuid) site = await client.siteStatus(uuid)
       // Foundation freshness: prefer the LOCAL foundation's scoped name (so a
       // local-foundation site can be checked too); fall back to a scoped
       // site.yml ref. The digest compare is read-only — it never builds, so it
       // only fires when the local foundation is already built (dist present).
       const local = resolveLocalFoundation(siteDir, siteYml)
+      localFoundationVersion = local?.version ?? null
       const lookupName =
         (local && (await foundationScopedName(local.dir))) || fndScope
       if (lookupName) fdnLatest = await client.readFoundationLatest(lookupName)
@@ -245,10 +243,21 @@ export async function status(args = []) {
         `A newer foundation version (${fdnLatest.latest_version}) is registered than the site pins (${fndVersion}).`
       )
     }
+    // What the next push or publish does with it (`backend/foundation-bring-along.js`):
+    // release changed code — under the next version when its own is taken — unless the
+    // registry holds a NEWER version, which stops them. ⛔ This pointed at `uniweb
+    // register` until 2026-09-24 — which cannot release a change under a version
+    // already registered, since a registered version is immutable.
     if (foundationFresh === false) {
-      say.info(
-        'Local foundation differs from the registered version — `uniweb register` (or `uniweb publish`) to release the change.'
-      )
+      if (compareSemverPrecedence(localFoundationVersion, fdnLatest.latest_version) === -1) {
+        say.info(
+          `The registry holds foundation ${fdnLatest.latest_version}, newer than your ${localFoundationVersion} — a push or publish stops until you pull that change, or pass \`--bump\` to release yours above it.`
+        )
+      } else {
+        say.info(
+          'Local foundation differs from the registered version — the next `uniweb push` or `uniweb publish` releases it.'
+        )
+      }
     } else if (foundationFresh === true) {
       say.ok('Local foundation matches the registered version.')
     }

package/src/commands/validate.js

@@ -4,14 +4,17 @@
  *
  * For each section that consumes file-based data, this resolves the schema the
  * foundation bound to that input (via `meta.js` `data:`) and checks the data
- * items against it. It answers "does my data match what I promised?" — distinct
- * from `doctor`, which checks your project against framework conventions.
+ * items against it — and every record file in the records directory against the
+ * schema its folder names, whether or not a section reads it. It answers "does my
+ * data match what I promised?" — distinct from `doctor`, which checks your project
+ * against framework conventions.
  *
- * It warns by default; `--strict` turns findings into a non-zero exit for CI.
- * The live render path stays tolerant — this gate runs before a site is live,
- * by choice. Dynamic (remote) inputs and entity references can't be resolved
- * without a running backend, so they're reported as deferred, never silently
- * skipped.
+ * ⭐ A violation fails it (exit 1); `--lax` reports without failing. It warned by
+ * default until 2026-09-24, with `--strict` to fail — a gate that passes is one
+ * nobody reads, and `push` / `publish` now refuse the same findings. The live render
+ * path stays tolerant. Dynamic (remote) inputs and entity references can't be
+ * resolved without a running backend, so they're reported as deferred, never
+ * silently skipped.
  */
 
 import { existsSync, readFileSync } from 'node:fs'
@@ -201,7 +204,9 @@ function dedupeUsers(users) {
 
 export async function validate(args = []) {
   const asJson = args.includes('--json')
-  const strict = args.includes('--strict')
+  // A violation fails the run unless `--lax` says to only report it. (`--strict`, the
+  // flag that turned failing on until 2026-09-24, is simply the default now.)
+  const strict = !args.includes('--lax')
   const siteFilter = flagValue(args, '--site')
   const positional = args.find(
     (a, i) => !a.startsWith('--') && args[i - 1] !== '--site'
@@ -353,7 +358,7 @@ export async function validate(args = []) {
           ? `${colors.red}error${colors.reset}`
           : `${colors.yellow}warning${colors.reset}`
         log(
-          `${totalViolations} violation(s) — reported as ${mode}${strict ? '' : ` ${colors.dim}(pass --strict to fail CI)${colors.reset}`}`
+          `${totalViolations} violation(s) — reported as ${mode}${strict ? '' : ` ${colors.dim}(--lax: without it, this fails)${colors.reset}`}`
         )
       }
       if (hadError)
@@ -362,9 +367,8 @@ export async function validate(args = []) {
     }
   }
 
-  // Exit semantics: 2 = couldn't run; 1 = violations under --strict; 0 = clean
-  // or warn-only (the live path stays tolerant, so findings don't fail by
-  // default). Setup/read failures are surfaced but don't fail the build.
+  // Exit semantics: 2 = couldn't run; 1 = violations (unless --lax); 0 = clean, or
+  // violations reported under --lax. Setup/read failures are surfaced but don't fail.
   if (hadError) return { exitCode: 2 }
   if (totalViolations > 0 && strict) return { exitCode: 1 }
   return { exitCode: 0 }

package/src/framework-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-09-23T16:44:03.282Z",
+  "generatedAt": "2026-09-24T15:29:04.711Z",
   "packages": {
     "@uniweb/api": {
       "version": "0.6.1",
@@ -10,7 +10,7 @@
       ]
     },
     "@uniweb/build": {
-      "version": "0.59.1",
+      "version": "0.60.0",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -96,7 +96,7 @@
       "deps": []
     },
     "@uniweb/schemas": {
-      "version": "0.4.0",
+      "version": "0.5.0",
       "path": "framework/schemas",
       "deps": []
     },
@@ -126,7 +126,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.10.2",
+      "version": "0.10.3",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",

package/src/index.js

@@ -1418,7 +1418,8 @@ ${colors.bright}Options:${colors.reset}
   --target <name>     Pick a target from deploy.yml (default: deploy.yml's \`default:\`)
   --dry-run           Resolve the target + adapter; print summary; upload nothing
   --no-save           Do not record this deploy in deploy.yml
-  --no-validate       Skip the content-conformance check (it only warns)
+  --no-validate       Skip the content-conformance check (a static host warns;
+                      Uniweb Cloud stops on content that does not conform)
   --non-interactive   Fail with usage info instead of prompting
 
 ${colors.bright}Examples:${colors.reset}
@@ -1439,9 +1440,10 @@ ${colors.bright}Usage:${colors.reset}
 The most ergonomic command in the tool: \`uniweb login && uniweb publish\` reads
 your project and makes the site live on Uniweb hosting. It resolves which site,
 BRINGS THE FOUNDATION ALONG (releases the local foundation when its code
-changed), syncs content, settles payment when go-live needs it (a browser
-handoff), and goes live. A published-registry foundation needs no release; an
-already-paid site opens no browser.
+changed — under the next version when its own is registered; commit the
+package.json it writes), syncs content, settles payment when go-live needs it
+(a browser handoff), and goes live. A published-registry foundation needs no
+release; an already-paid site opens no browser.
 
 For a third-party host use \`uniweb deploy --host=<name>\`; to register a
 FOUNDATION on its own use \`uniweb register\` (alias \`uniweb release\`).
@@ -1454,17 +1456,15 @@ ${colors.bright}Options:${colors.reset}
                      when only the content should go live. Refused if the
                      foundation has never been released — there is nothing to
                      bind to, and the app cannot open such a site.
+  --bump             When the registry holds a newer version of the foundation
+                     than yours, release yours above it instead of stopping
   --no-save          Do not record this deploy in deploy.yml
-  --no-validate      Skip the content-conformance check (it only warns)
-  --org @org         Publish under @org (membership-gated). On a site's FIRST
-                     publish it decides which org owns the site, and whose storage
-                     its assets are charged to. Recorded in sync.json and named on
-                     every request after, so it is never re-typed. Without it, you
-                     are asked once. Later, it must match the workspace the backend
-                     works on the site from, or publish stops.
-  --personal         Create the site under your personal account, deliberately.
-                     Only needed on a first publish, and only to answer the owner
-                     question without a prompt (CI, agents, scripts).
+  --no-validate      Skip the content-conformance check, which stops a publish
+                     whose content does not conform to its data schemas
+  --org @org         Work in @org for this publish, instead of the workspace
+  --personal         chosen at \`uniweb login\` (or your personal workspace). A
+                     site this publish creates is created — owned — there, and a
+                     site the backend keeps in another workspace stops it.
 `,
     create: `
 ${colors.cyan}${colors.bright}uniweb create${colors.reset} ${colors.dim}— Create a new project${colors.reset}
@@ -1695,17 +1695,18 @@ foundation declared for that input (meta.js \`data:\`). Answers "does my
 data match what I promised?" — distinct from \`doctor\`, which checks your
 project against framework conventions.
 
-Warns by default; the live render path stays tolerant, so this is a
-pre-live / CI gate. Dynamic (\`url:\`) inputs and entity references can't be
-resolved without a running backend, so they're reported as deferred,
-never silently skipped.
+Every record file is checked against the schema its folder names, whether or
+not a section reads it. A violation fails the run; \`push\` and \`publish\` refuse
+the same findings. The live render path stays tolerant. Dynamic (\`url:\`)
+inputs and entity references can't be resolved without a running backend, so
+they're reported as deferred, never silently skipped.
 
 ${colors.bright}Options:${colors.reset}
-  --strict           Treat findings as errors (non-zero exit for CI)
+  --lax              Report violations without failing (exit 0)
   --json             Machine-readable output (for CI annotations)
   --site <name>      Check one site in a multi-site workspace
 
-Exit codes: 0 clean (or warn-only), 1 violations under --strict, 2 setup error.
+Exit codes: 0 clean (or --lax), 1 violations, 2 setup error.
 `,
     register: `
 ${colors.cyan}${colors.bright}uniweb register${colors.reset} ${colors.dim}— Register (release) a foundation + its data schemas with the backend registry${colors.reset}
@@ -1793,16 +1794,26 @@ does nothing; add --password, --browser, --token-paste or --token to log in agai
 Without --backend: https://uniweb.app (or \$UNIWEB_REGISTER_URL). No command talks
 to a backend you are not logged in to — run one before logging in and it asks first.
 
+${colors.bright}The workspace you work in.${colors.reset} A login works in ONE workspace — your
+personal one, or an organization's — and every push, pull and publish works in it:
+a site it creates is created there, and a site kept in another workspace is refused.
+With no organization it is your personal workspace; with organizations you are asked,
+or name it. Already logged in, \`uniweb login --org @other\` switches without logging
+in again.
+
 ${colors.bright}Options:${colors.reset}
   --backend <url>    The backend to log in to
+  --org @org         Work in @org (an organization you belong to)
+  --personal         Work in your personal workspace
   --token <bearer>   Seed + verify a session from a bearer token (non-interactive)
   --browser          Force the browser method
   --password         Force the username/password method
   --token-paste      Force the paste-a-token prompt
 
-In non-interactive mode (CI / no TTY), pass \`--token <bearer>\`, or set
-\`UNIWEB_USERNAME\` + \`UNIWEB_PASSWORD\`, or set \`UNIWEB_TOKEN\` (used per-command,
-not stored). \`uniweb logout\` logs you out.
+In non-interactive mode (no TTY — an agent, a script), pass \`--token <bearer>\` with
+\`--org @org\` or \`--personal\`, or set \`UNIWEB_USERNAME\` + \`UNIWEB_PASSWORD\`, or set
+\`UNIWEB_TOKEN\` (per process, not stored) with \`UNIWEB_WORKSPACE=@org\` or \`personal\`.
+\`uniweb logout\` logs you out.
 `,
     refresh: `
 ${colors.cyan}${colors.bright}uniweb refresh${colors.reset} ${colors.dim}— Catch up with teammates AND app authors${colors.reset}
@@ -2082,10 +2093,11 @@ ${colors.bright}Publish Options:${colors.reset}
   --dry-run          Resolve everything; release/sync/POST nothing
   --yes              Skip confirmations (CI); never block on a prompt
   --no-release       Ship content against the already-released code; release nothing
-  --org @org         Publish under @org (first publish only; then remembered)
-  --personal         Own the new site personally, deliberately (first publish only)
+  --bump             Release above a newer registered foundation version
+  --org @org         Work in @org for this publish, not your login's workspace
+  --personal         Work in your personal workspace for this publish
   --no-save          Do not record this deploy in deploy.yml
-  --no-validate      Skip the content-conformance check (it only warns)
+  --no-validate      Skip the content-conformance check (it stops a publish)
 
   uniweb publish is the smart Uniweb-hosting path: it brings the site's
   foundation along, syncs, and goes live. To register a foundation on its own
@@ -2099,7 +2111,7 @@ ${colors.bright}Deploy Options:${colors.reset}
   --target <name>    Pick a target from deploy.yml (default: deploy.yml's \`default:\`)
   --dry-run          Resolve the target + adapter; print summary; upload nothing
   --no-save          Do not record this deploy in deploy.yml
-  --no-validate      Skip the content-conformance check (it only warns)
+  --no-validate      Skip the content-conformance check (a static host warns)
   To deploy on every push instead, see \`uniweb add ci --help\`.
 
 ${colors.bright}Dev Options:${colors.reset}

package/src/utils/conformance.js

@@ -8,17 +8,26 @@
  * it. The first symptom was a section rendering nothing on a live site, with no
  * error anywhere in the chain.
  *
- * ## It WARNS. It never blocks, and that is a decision, not a TODO.
+ * ## On a STATIC host it warns and never blocks — and on a backend it is a gate.
+ *
+ * ⭐ Two answers, one per destination [Diego, 2026-09-24: "The old rationale was in
+ * the context of static sites. It was never meant for pushed sites since that didn't
+ * even exist at the time."]. `push` and `publish` register the foundation first, so
+ * the backend checks the records against the very schemas checked here: a finding
+ * there is a refusal on arrival, or a value lost on the way — never a disagreement to
+ * ship through. `refuseIfContentDoesNotConform` is that gate; `deploy` to a static
+ * host keeps the warning below, whose reasoning is unchanged for it:
  *
  * A schema can be newer than the content that was valid when it was authored —
  * a foundation upgrade, a `@std/*` revision — so a finding does not mean the
  * content is wrong, it means the two disagree. A framework that refused to
  * publish over that would make an author's site hostage to a schema release,
- * for a defect whose real-world cost is one section rendering wrong. `--strict`
- * on `uniweb validate` is where the gate lives, and CI is where it belongs.
+ * for a defect whose real-world cost is one section rendering wrong. `uniweb
+ * validate` is where the gate lives for a static site, and CI is where it belongs.
  *
- * So: silent when everything conforms, silent when it cannot check, one compact
- * block when it finds something, and **the ship proceeds either way**.
+ * So, on a static host: silent when everything conforms, silent when it cannot
+ * check, one compact block when it finds something, and **the ship proceeds
+ * either way**.
  *
  * ## Why it is quiet about being unable to check
  *
@@ -41,7 +50,8 @@ const c = {
   reset: '\x1b[0m',
   bold: '\x1b[1m',
   dim: '\x1b[2m',
-  yellow: '\x1b[33m'
+  yellow: '\x1b[33m',
+  red: '\x1b[31m'
 }
 
 /** How many findings to print before summarizing the rest. */
@@ -144,6 +154,47 @@ export async function warnIfContentDoesNotConform(siteDir, options = {}) {
   return formatted.total
 }
 
+/**
+ * The same check as a GATE, for `push` and `publish` — see the header for why a
+ * backend gets a gate where a static host gets a warning.
+ *
+ * Only VIOLATIONS stop it: a record the backend would refuse, or whose value it would
+ * lose. A setup error is about how data reaches a section — a rendering question, not
+ * a record — so it is still printed as a warning and the ship goes on. A checker that
+ * cannot run says nothing and stops nothing, as above. `--no-validate` skips the check
+ * and leaves the records to the backend.
+ *
+ * @param {string} siteDir
+ * @param {object} [options] - `args`, and the caller's `error` / `warn` / `dim` printers
+ * @returns {Promise<number>} the violations that stop the ship (0 to go on)
+ */
+export async function refuseIfContentDoesNotConform(siteDir, options = {}) {
+  const {
+    args = [],
+    error = (m) => console.log(`${c.red}✗${c.reset} ${m}`),
+    warn = (m) => console.log(`${c.yellow}⚠${c.reset} ${m}`),
+    dim = (m) => console.log(`  ${c.dim}${m}${c.reset}`)
+  } = options
+
+  if (args.includes('--no-validate')) return 0
+
+  let result
+  try {
+    result = await checkSiteConformance(siteDir)
+  } catch {
+    return 0
+  }
+  if (result.status !== 'checked') return 0
+
+  const violations = result.report?.violations?.length || 0
+  const formatted = formatConformanceWarning(result, siteDir, { stops: violations > 0 })
+  if (!formatted) return 0
+
+  ;(violations > 0 ? error : warn)(formatted.headline)
+  for (const line of formatted.details) dim(line)
+  return violations
+}
+
 /**
  * Turn a report into the lines to print, or `null` when there is nothing to say.
  *
@@ -154,9 +205,11 @@ export async function warnIfContentDoesNotConform(siteDir, options = {}) {
  *
  * @param {{report?: object, foundation?: string}} result
  * @param {string} siteDir
+ * @param {{ stops?: boolean }} [options] - `stops`: the ship stops on this report
+ *   (`refuseIfContentDoesNotConform`), so the last line says nothing was sent
  * @returns {{headline: string, details: string[], total: number}|null}
  */
-export function formatConformanceWarning(result, siteDir = '') {
+export function formatConformanceWarning(result, siteDir = '', { stops = false } = {}) {
   const violations = result?.report?.violations || []
   const setupErrors = result?.report?.setupErrors || []
   const total = violations.length + setupErrors.length
@@ -201,9 +254,14 @@ export function formatConformanceWarning(result, siteDir = '') {
   const details = lines.slice(0, MAX_SHOWN).map((l) => `• ${l}`)
   if (lines.length > MAX_SHOWN) details.push(`…and ${lines.length - MAX_SHOWN} more`)
 
-  // Name the command that explains it, and say plainly that this is not a
-  // refusal — a warning during a ship reads as a failure unless it says so.
-  details.push('Shipping anyway. Run `uniweb validate` for the full report.')
+  // Name the command that explains it, and say plainly which this is — a warning
+  // during a ship reads as a failure unless it says so, and a refusal must say what
+  // did not happen.
+  details.push(
+    stops
+      ? 'Nothing was sent. Run `uniweb validate` for the full report, or pass `--no-validate` to send it anyway and let the backend decide.'
+      : 'Shipping anyway. Run `uniweb validate` for the full report.'
+  )
 
   return { headline, details, total }
 }