@@ -275,6 +275,7 @@ jobs:
               - 'scripts/check-dual-build-cjs-loads.mjs'
               - 'scripts/check-lean-entry-closure.mjs'
               - 'scripts/check-sourcemap-no-sources-content.mjs'
+              - 'scripts/ci/assert-turbo-remote-cache.mjs'
               - 'scripts/population-floor.mjs'
             # Build inputs of the vendored Console SPA — see the Console Pin Gate
             # job at the bottom of this file. `.objectui-sha` is a ROOT DOTFILE, so
@@ -736,9 +737,11 @@ jobs:
       # builds it there.
       #
       # Its own guarded step, for the reason the slice step below gives: a
-      # guarded SITE is (file, job, step). No `--summarize`: `.turbo/runs/`
-      # stays the test step's alone, and that is what the drift check and the
-      # timings capture read. The four TURBO_* lines are Build Core's,
+      # guarded SITE is (file, job, step). `.turbo/runs/` stays the test step's
+      # alone, because that is what the drift check and the timings capture
+      # read: the `--summarize` here is for the remote-cache assertion after
+      # this step (#25374), which moves the summary it read out to
+      # $RUNNER_TEMP before the tests run. The four TURBO_* lines are Build Core's,
       # verbatim; its "Turbo remote cache (#21186)" comment holds the write
       # rule, the signing and the PINS. ⛔ An empty FILTERS must exit here:
       # `turbo run build` with no filter builds the whole workspace.
@@ -764,7 +767,16 @@ jobs:
           mkdir -p "$RUNNER_TEMP/stall-reports"
           node scripts/run-with-stall-guard.mjs --log "$RUNNER_TEMP/test-core-closure-build.log" --stall-minutes 10 \
             --report-dir "$RUNNER_TEMP/stall-reports" -- \
-            pnpm turbo run build $FILTERS --concurrency=4 --log-order=stream
+            pnpm turbo run build $FILTERS --concurrency=4 --log-order=stream \
+              --summarize --log-file=.turbo/remote-cache/test-core-closure.json
+
+      # Build Core's "Turbo remote cache (#21186)" comment, ASSERTED paragraph.
+      # `--if-ran`: an empty shard exits the step above before turbo runs.
+      - name: The Turbo remote cache was on for this shard's closure build
+        run: |
+          node scripts/ci/assert-turbo-remote-cache.mjs --site 'Test Core (${{ matrix.shard }}/6) closure' \
+            --log .turbo/remote-cache/test-core-closure.json --if-ran \
+            --move-summary-to "$RUNNER_TEMP/turbo-remote-cache"
 
       # ⛔ A FILE-LEVEL SLICE BUILDS ITS DEPENDENCY CLOSURE HERE, IN ITS OWN
       # GUARDED STEP, so the slice leg in the next step REPLAYS it. Since #19278
@@ -2544,6 +2556,12 @@ jobs:
       - name: check-dts-emitted self-test
         run: node scripts/check-dts-emitted.mjs --self-test
 
+      # The remote-cache assertion after the build below, and after every
+      # carrier that runs it (Test Core's closure, lint.yml's three Type Check
+      # lanes), is one script; its self-test runs here, once.
+      - name: assert-turbo-remote-cache self-test
+        run: node scripts/ci/assert-turbo-remote-cache.mjs --self-test
+
       # ── Turbo remote cache (#21186) ─────────────────────────────────────
       # Vercel's managed Turborepo remote cache. objectstack-ai/cloud's
       # test.yml builds this repo at its pinned SHA with the same command and
@@ -2579,6 +2597,16 @@ jobs:
       # unset: remote caching is off and the build is unchanged; the summary
       # then reads `Remote caching disabled (remote cache requested — …)`.
       #
+      # ASSERTED (#25374). The step after this one reads that prelude line
+      # from turbo's structured log (`--log-file`, repo-relative or turbo
+      # ignores it) and the hit counts from `--summarize`, prints both into the
+      # job's step summary, and reds a run that WRITES the remote (the
+      # `remote:rw` branch above) when the cache is off; a read-only run only
+      # warns. Neither flag enters a task hash (83 of 83 identical with and
+      # without, `--dry=json`, turbo 2.11.5). The carriers that assert are this
+      # step, Test Core's closure and lint.yml's three Type Check lanes; the
+      # verdict table is the script header's.
+      #
       # PINS, for every step that carries these four lines (#22077). Each
       # carrier points back here.
       #   - BUILD TASKS ONLY. #19086's lesson: a step that writes artifacts from
@@ -2608,7 +2636,10 @@ jobs:
           TURBO_TOKEN: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY != '' && secrets.TURBO_TOKEN || '' }}
           TURBO_TEAM: ${{ vars.TURBO_TEAM }}
           TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
-        run: pnpm build
+        run: pnpm build --summarize --log-file=.turbo/remote-cache/build-core.json
+
+      - name: The Turbo remote cache was on for the build
+        run: node scripts/ci/assert-turbo-remote-cache.mjs --site 'Build Core' --log .turbo/remote-cache/build-core.json
 
       # [#15042] The closure-wide declaration re-check. `check-dts-emitted` runs
       # per package, immediately after that package's `tsup`, and is the LAST
 
@@ -5785,7 +5785,14 @@ jobs:
           TURBO_TOKEN: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY != '' && secrets.TURBO_TOKEN || '' }}
           TURBO_TEAM: ${{ vars.TURBO_TEAM }}
           TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
-        run: pnpm exec turbo run build --filter='./packages/*' --filter='./examples/*^...'
+        run: pnpm exec turbo run build --filter='./packages/*' --filter='./examples/*^...' --summarize --log-file=.turbo/remote-cache/typecheck-workspace.json
+
+      # ci.yml Build Core's "Turbo remote cache (#21186)" comment, ASSERTED
+      # paragraph (#25374). A gate of this lane, so the lane verdict carries its red.
+      - name: The Turbo remote cache was on for the workspace build
+        id: turbo-remote-cache-was-on
+        continue-on-error: true
+        run: node scripts/ci/assert-turbo-remote-cache.mjs --site 'Type Check · workspace' --log .turbo/remote-cache/typecheck-workspace.json
 
       # CLI transcripts in content/docs are bound to the registries they quote
       # (#15373). `content/docs` teaches with pasted CLI output, and some of those
@@ -6041,7 +6048,14 @@ jobs:
           TURBO_TOKEN: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY != '' && secrets.TURBO_TOKEN || '' }}
           TURBO_TEAM: ${{ vars.TURBO_TEAM }}
           TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
-        run: pnpm exec turbo run build --filter='./packages/*' --filter='./examples/*^...'
+        run: pnpm exec turbo run build --filter='./packages/*' --filter='./examples/*^...' --summarize --log-file=.turbo/remote-cache/typecheck-debt.json
+
+      # ci.yml Build Core's "Turbo remote cache (#21186)" comment, ASSERTED
+      # paragraph (#25374). A gate of this lane, so the lane verdict carries its red.
+      - name: The Turbo remote cache was on for the workspace build
+        id: turbo-remote-cache-was-on
+        continue-on-error: true
+        run: node scripts/ci/assert-turbo-remote-cache.mjs --site 'Type Check · debt ledger' --log .turbo/remote-cache/typecheck-debt.json
 
       # The MEASURED half of the coverage gate (#5278). The cheap structural
       # check near the top of this job asserts that a package without a
@@ -6242,7 +6256,14 @@ jobs:
           TURBO_TOKEN: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY != '' && secrets.TURBO_TOKEN || '' }}
           TURBO_TEAM: ${{ vars.TURBO_TEAM }}
           TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
-        run: pnpm exec turbo run build --filter='./packages/*' --filter='./examples/*^...'
+        run: pnpm exec turbo run build --filter='./packages/*' --filter='./examples/*^...' --summarize --log-file=.turbo/remote-cache/typecheck-consumers.json
+
+      # ci.yml Build Core's "Turbo remote cache (#21186)" comment, ASSERTED
+      # paragraph (#25374). A gate of this lane, so the lane verdict carries its red.
+      - name: The Turbo remote cache was on for the workspace build
+        id: turbo-remote-cache-was-on
+        continue-on-error: true
+        run: node scripts/ci/assert-turbo-remote-cache.mjs --site 'Type Check · consumer gates' --log .turbo/remote-cache/typecheck-consumers.json
 
       # The nested-package build. ⚠️ NOT redundant with "Build workspace
       # packages" above, and the reason is the glob: the bare `./packages/*`
 
@@ -161,7 +161,8 @@
  * build-task inputs and `globalDependencies` come out of turbo.json, and the
  * builds Build Core does not run come out of the root manifest's `build`
  * script (`--filter=!<package>`), which is what the job's `run: pnpm build`
- * expands to. Every misreading of that script can only drop an exclusion,
+ * expands to (followed, at most, by the closed BUILD_COMMAND_FLAGS list:
+ * reporting flags that change no task, #25374). Every misreading of that script can only drop an exclusion,
  * which REQUIRES more of `core` -- a loud red, never a silent gap. The only
  * constant is turbo.json itself, which is the config being read.
  *
@@ -276,7 +277,7 @@ const SELF_TEST_BATTERIES = Object.freeze({
   '(6) the real tree': 10,
   '(7) WIRING: the gate and its self-test really run in CI': 2,
   '(8) the `console` selection and the dist key it must move': 20,
-  '(9) Build Core and the build inputs turbo.json declares': 33,
+  '(9) Build Core and the build inputs turbo.json declares': 42,
   '(10) Build Core and the scripts its own steps run': 30,
 });
 
@@ -644,6 +645,23 @@ export const TURBO_CONFIG = 'turbo.json';
 export const ROOT_MANIFEST = 'package.json';
 /** The step Build Core runs, verbatim; the manifest's `build` script is what it expands to. */
 const BUILD_COMMAND = 'pnpm build';
+/**
+ * The CLOSED list of words that may follow BUILD_COMMAND in that step. Each
+ * changes what turbo REPORTS, never which tasks it runs or how they hash
+ * (measured: 83 of 83 hashes identical with and without, `--dry=json`, turbo
+ * 2.11.5), and the remote-cache assertion after the step reads both
+ * (#25374). ⛔ No pattern over "any flag": a `--filter` or `--affected` here
+ * changes the task set the manifest's script says, and must refuse.
+ */
+const BUILD_COMMAND_FLAGS = Object.freeze([/^--summarize$/, /^--log-file=\S+$/]);
+
+/** Whether a `run:` is BUILD_COMMAND followed only by BUILD_COMMAND_FLAGS. */
+export function isBuildCommand(run) {
+  if (typeof run !== 'string') return false;
+  const words = run.trim().split(/\s+/);
+  if (words.slice(0, 2).join(' ') !== BUILD_COMMAND) return false;
+  return words.slice(2).every((w) => BUILD_COMMAND_FLAGS.some((re) => re.test(w)));
+}
 /** The prefix turbo.json spells a repo-root-relative input with. */
 const TURBO_ROOT = '$TURBO_ROOT$/';
 
@@ -794,7 +812,7 @@ export function judgeBuildInputs(source, turboSource, manifestSource, closureOf
     };
   }
   const steps = Array.isArray(job.steps) ? job.steps : [];
-  if (!steps.some((s) => typeof s?.run === 'string' && s.run.trim() === BUILD_COMMAND)) {
+  if (!steps.some((s) => isBuildCommand(s?.run))) {
     return {
       refusal:
         `${CI_WORKFLOW}'s \`${BUILD_JOB}\` job has no \`run: ${BUILD_COMMAND}\` step, so ${ROOT_MANIFEST}'s \`build\` ` +
@@ -1574,7 +1592,8 @@ export async function selfTest() {
       '  build-core:',
       `    if: ${JSON.stringify(condition)}`,
       '    steps:',
-      `      - run: ${run}`,
+      // Quoted, so a multi-line `run` stays one YAML scalar.
+      `      - run: ${JSON.stringify(run)}`,
     ].join('\n');
   };
   const turboFixture = ({ globalDependencies = ['tsconfig.json', 'tsup.config.ts'], tasks } = {}) =>
@@ -1653,6 +1672,21 @@ export async function selfTest() {
   assert(/no \`build-core\` job/.test(judgeBuildInputs(fixtureWorkflow(), turboFixture(), manifestFixture()).refusal ?? ''), 'no Build Core job => REFUSAL');
   assert(/no longer names \`core\`/.test(buildRefusal({ workflow: buildWorkflow({ condition: '${{ !cancelled() }}' }) })), 'Build Core dropping `core` from its `if:` => REFUSAL');
   assert(/no \`run: pnpm build\` step/.test(buildRefusal({ workflow: buildWorkflow({ run: 'pnpm turbo run build' }) })), 'Build Core no longer running `pnpm build` => REFUSAL');
+  // The closed flag list (#25374): reporting flags pass, anything that could
+  // change the task set refuses, and so do the same flags on another command.
+  assert(!buildRefusal({ workflow: buildWorkflow({ run: 'pnpm build --summarize --log-file=.turbo/remote-cache/build-core.json' }) }), '`pnpm build --summarize --log-file=PATH` is still Build Core running `pnpm build`');
+  assert(!buildRefusal({ workflow: buildWorkflow({ run: 'pnpm build --summarize' }) }), '-- and so is `pnpm build --summarize` alone');
+  for (const [run, why] of [
+    ['pnpm build --summarize --filter=@objectstack/spec', 'a `--filter` beside the allowed flags'],
+    ['pnpm build --affected', '`--affected`'],
+    ['pnpm build --summarize --force', 'an unknown flag'],
+    ['pnpm build --log-file=', 'a `--log-file=` with no path'],
+    ['pnpm build -- --summarize', 'a `--` passthrough'],
+    ['pnpm test --summarize --log-file=x.json', 'the allowed flags on a different command'],
+    ['pnpm build --summarize\nnode scripts/x.mjs', 'a second command after the build'],
+  ]) {
+    assert(/no \`run: pnpm build\` step/.test(buildRefusal({ workflow: buildWorkflow({ run }) })), `${why} => REFUSAL`);
+  }
   assert(/turbo.json could not be read\./.test(buildRefusal({ turbo: null })), 'an unreadable turbo.json => REFUSAL');
   assert(/could not be read as JSON/.test(buildRefusal({ turbo: '{ tasks: ' })), 'a turbo.json that is not JSON => REFUSAL');
   assert(/no \`tasks\` map/.test(buildRefusal({ turbo: '{}' })), 'a turbo.json with no tasks map => REFUSAL');