Merge PR #500 head into all-gates recovery

# Conflicts:
#	package.json
#	scripts/run-gates.ts

scripts/run-gates.ts

@@ -10,7 +10,6 @@ import { resolve } from 'node:path'
 import { performance } from 'node:perf_hooks'
 
 type Mode =
-  | 'all'
   | 'ci-primary'
   | 'ci-static'
   | 'ci-lint'
@@ -18,6 +17,7 @@ type Mode =
   | 'ci-snapshot'
   | 'ci-artifacts'
   | 'node-compat'
+  | 'manual-push'
   | 'doc-sync'
 type GateStatus = 'pending' | 'running' | 'passed' | 'failed' | 'skipped'
 
@@ -80,7 +80,6 @@ if (results.some(result => result.status === 'failed' || result.status === 'skip
 
 function parseMode(raw: string | undefined): Mode {
   switch (raw) {
-    case 'all':
     case 'ci-primary':
     case 'ci-static':
     case 'ci-lint':
@@ -88,20 +87,21 @@ function parseMode(raw: string | undefined): Mode {
     case 'ci-snapshot':
     case 'ci-artifacts':
     case 'node-compat':
+    case 'manual-push':
     case 'doc-sync':
       return raw
     default:
       throw new Error(
-        `run-gates: expected mode all | ci-primary | ci-static | ci-lint | ci-coverage | ci-snapshot | ci-artifacts | node-compat | doc-sync, got ${JSON.stringify(raw)}.`,
+        `run-gates: expected mode ci-primary | ci-static | ci-lint | ci-coverage | ci-snapshot | ci-artifacts | node-compat | manual-push | doc-sync, got ${JSON.stringify(raw)}.`,
       )
   }
 }
 
 function defaultConcurrency(selectedMode: Mode, total: number): ConcurrencyDefault {
   const available = availableParallelism()
-  // Local modes cap workers: several gates each build a full ts.Program,
+  // Local modes cap workers: several doc gates each build a full ts.Program,
   // so an uncapped default on a large host trades wall clock for memory blowups.
-  const localCap = selectedMode === 'all' || selectedMode === 'doc-sync'
+  const localCap = selectedMode === 'manual-push' || selectedMode === 'doc-sync'
   const modeLimit = localCap ? Math.min(4, available) : available
   return {
     workers: Math.min(total, modeLimit),
@@ -156,7 +156,6 @@ function nodeOptions(...options: string[]): string {
 
 function gatesForMode(selected: Mode): Gate[] {
   switch (selected) {
-    case 'all':
     case 'ci-primary':
       return ciPrimaryGates()
     case 'ci-static':
@@ -192,6 +191,23 @@ function gatesForMode(selected: Mode): Gate[] {
           'packages/session-persistence/session-persistence-jsonl/tests/zstd.compat.spec.ts',
         ], { label: 'JSONL Zstandard smoke' }),
       ]
+    case 'manual-push':
+      return [
+        pnpmScript('runtime-closure', 'verify-runtime-closure', { label: 'runtime closure' }),
+        pnpmScript('cordis-config', 'verify-cordis-config', { label: 'Cordis config' }),
+        pnpmScript('client-domain-graph', 'verify-client-domain-graph', { label: 'client domain graph' }),
+        pnpmScript('test', 'test'),
+        pnpmScript('duplication', 'duplication'),
+        snapshotGate(),
+        pnpmScript('build', 'build'),
+        pnpmScript('build:web', 'build:web'),
+        ...hygieneLeafGates({ artifactNeeds: ['build'] }),
+        ...docSyncLeafGates({
+          docTypecheckNeeds: ['build'],
+          docTypecheckEnv: { DSH_DOC_TYPECHECK_USE_BUILD_OUTPUT: '1' },
+        }),
+        pnpmScript('module-graph', 'verify-module-graph', { label: 'module graph' }),
+      ]
     case 'doc-sync':
       return docSyncLeafGates()
   }
@@ -281,8 +297,8 @@ function coverageGate(): Gate {
 }
 
 // The snapshot suite boots the example bins in `lib` mode (built artifact under plain Node,
-// plugins via real exports). CI pairs it with `build`, so it exercises what ships rather than
-// the tsx/source path dev uses and therefore waits on `build`.
+// plugins via real exports) — CI and manual-push already build, so they exercise what ships rather
+// than the tsx/source path dev uses. It therefore waits on `build`.
 function snapshotGate(): Gate {
   return pnpmScript('snapshot', 'test:snapshot', {
     env: { DSH_EXAMPLE_MODE: 'lib' },
@@ -307,9 +323,30 @@ function positiveIntArg(envName: string, flag: string): string[] {
   return [`${flag}=${raw}`]
 }
 
-function docSyncLeafGates(): Gate[] {
+function hygieneLeafGates(options: { artifactNeeds?: string[] } = {}): Gate[] {
+  const artifactOptions = options.artifactNeeds === undefined ? {} : { needs: options.artifactNeeds }
   return [
-    pnpmScript('doc-typecheck', 'doc-typecheck'),
+    pnpmScript('knip', 'knip'),
+    pnpmScript('publint', 'publint', artifactOptions),
+    pnpmScript('constraints', 'constraints'),
+    pnpmScript('package-invariants', 'verify-package-invariants', { label: 'package invariants' }),
+    builtPackageInvariantsGate(options.artifactNeeds),
+    pnpmScript('node-next-types', 'verify-node-next-types', {
+      label: 'node-next types',
+      ...artifactOptions,
+    }),
+  ]
+}
+
+function docSyncLeafGates(options: {
+  docTypecheckNeeds?: string[]
+  docTypecheckEnv?: Record<string, string | undefined>
+} = {}): Gate[] {
+  const docTypecheckOptions: Partial<Gate> = {}
+  if (options.docTypecheckNeeds !== undefined) docTypecheckOptions.needs = options.docTypecheckNeeds
+  if (options.docTypecheckEnv !== undefined) docTypecheckOptions.env = options.docTypecheckEnv
+  return [
+    pnpmScript('doc-typecheck', 'doc-typecheck', docTypecheckOptions),
     pnpmScript('cordis-catalog', 'verify-cordis-catalog', { label: 'cordis catalog' }),
     pnpmScript('cordis-api', 'verify-cordis-api', { label: 'cordis api' }),
     pnpmScript('export-jsdoc', 'verify-export-jsdoc', { label: 'export jsdoc' }),