`--quiet` and `--verbose` are advertised on every subcommand and are byte-for-byte no-ops

[noahgift]

Found by dogfooding cargo install aprender 0.63.0 from crates.io (2026-08-09). Part of the audit epic — see #2373.

3 finding(s) in this cluster. Every one was reproduced against the installed 0.63.0 binary with verbatim output and at least two input variations before being recorded.

Findings

#	Sev	Target	Defect	Status
1	P1	all 16 lint commands (-q / --quiet)	-q, --quiet Quiet mode (errors only) is advertised in every lint's --help but has no effect — the full report is still printed to stdout	open
2	P1	--quiet (global)	--quiet is advertised in every subcommand's help but is a byte-for-byte no-op on 14 of 16 runnable commands	open
3	P1	inspect,debug,validate,tensors,tree,hex	-q/--quiet and -v/--verbose are advertised on every command in the family and produce byte-identical output on all of them	open

Evidence

1. [P1] `-q, --quiet Quiet mode (errors only)` is advertised in every lint's --help but has no effect — the full report is stil

Target: all 16 lint commands (-q / --quiet)

Repro

APR=/tmp/claude-1000/-home-noah-src-aprender/3e7b3507-59c1-4c5a-873b-c4003bfeca64/scratchpad/dogfood/cratesio/bin/apr
cd $(mktemp -d)
echo '{"output":"{\"a\":1}","finish_reason":"stop"}' > gbnf_ok.json
"$APR" gbnf-lint --help | grep -- '--quiet'
"$APR" gbnf-lint --observation-file gbnf_ok.json      # baseline
"$APR" gbnf-lint --observation-file gbnf_ok.json -q   # identical output
"$APR" gbnf-lint --observation-file gbnf_ok.json --quiet
diff <("$APR" gbnf-lint --observation-file gbnf_ok.json 2>/dev/null) \
     <("$APR" gbnf-lint --observation-file gbnf_ok.json -q 2>/dev/null) && echo "IDENTICAL"

Observed

-q, --quiet                    Quiet mode (errors only)

(baseline)
gbnf-lint report for gbnf_ok.json
  json:        Ok
  diagnostic:  (missing fields — classifier skipped)
  masking:     (missing fields — classifier skipped)

(with -q — byte-identical)
gbnf-lint report for gbnf_ok.json
  json:        Ok
  diagnostic:  (missing fields — classifier skipped)
  masking:     (missing fields — classifier skipped)
IDENTICAL

Expected / root cause

--quiet should suppress the PASS report and print only failures, as its own help text states. Note this is not slice-local: -q/--verbose are global clap flags and are equally inert on apr inspect (verified: apr inspect <model>.safetensors and apr inspect <model>.safetensors -q produce identical Rosetta Stone tables). No quiet handling exists in the CLI dispatch. Either wire it up or drop it from --help.

Variations tried: Tested -q and --quiet on gbnf-lint, awq-lint, attn-parity-lint, embed-viz-lint and ddp-metrics-lint — output identical in every case. Also tried -v/--verbose (equally inert), the contradictory combination -q -v (accepted, no error, full output), and a non-lint control command (apr inspect ... -q) to establish the scope is global rather than a lint-family regression.

Exit code: 0 (exit code is fine; the flag is the defect)

2. [P1] `--quiet` is advertised in every subcommand's help but is a byte-for-byte no-op on 14 of 16 runnable commands

Target: --quiet (global)

Repro

APR=/tmp/claude-1000/-home-noah-src-aprender/3e7b3507-59c1-4c5a-873b-c4003bfeca64/scratchpad/dogfood/cratesio/bin/apr
M=/home/noah/models/qwen2.5-coder-0.5b-instruct.apr
for c in inspect tensors validate tree check oracle explain debug flow hex trace; do
  timeout 180 "$APR" $c "$M" > /tmp/base.out 2>/tmp/base.err
  timeout 180 "$APR" $c "$M" --quiet > /tmp/q.out 2>/tmp/q.err
  printf '%-9s stdout %s  stderr %s\n' "$c" "$(cmp -s /tmp/base.out /tmp/q.out && echo IDENTICAL || echo differs)" "$(cmp -s /tmp/base.err /tmp/q.err && echo IDENTICAL || echo differs)"
done

Observed

inspect   stdout IDENTICAL  stderr IDENTICAL
tensors   stdout IDENTICAL  stderr IDENTICAL
validate  stdout IDENTICAL  stderr IDENTICAL
tree      stdout IDENTICAL  stderr IDENTICAL
check     stdout IDENTICAL  stderr IDENTICAL
oracle    stdout IDENTICAL  stderr IDENTICAL
explain   stdout IDENTICAL  stderr IDENTICAL
debug     stdout IDENTICAL  stderr IDENTICAL
flow      stdout IDENTICAL  stderr IDENTICAL
hex       stdout IDENTICAL  stderr IDENTICAL
trace     stdout IDENTICAL  stderr IDENTICAL

Byte counts from the full sweep (base / --quiet / --verbose stdout):
inspect  1529 / 1529 / 1529    tensors 29878 / 29878 / 29878
validate 2855 / 2855 / 2855    tree    25794 / 25794 / 25794
check    3854 / 3854 / 3907    oracle   1007 / 1007 / 1041
hex    303972 / 303972 / 303972  trace   1940 / 1940 / 2157
diff     1198 / 1198 / 1198    gpu       262 / 262 / 262
showcase 1127 / 1127 / 1127
Only honoured by:  lint 1930 -> 507,  list 4535 -> 541

Expected / root cause

-q, --quiet Quiet mode (errors only) appears in the Options block of all 104 subcommands' --help. It must actually suppress non-error output, or it must not be advertised on commands that ignore it. hex --quiet still emits 303 KB of hex dump; tensors --quiet still emits the full 29 KB table. A documented flag with no effect is unusable in scripts and misleads anyone piping output.

Variations tried: Swept 18 commands x {base, --quiet, --verbose} comparing exact byte counts on both streams; also verified flag position doesn't matter (apr --quiet list and apr list --quiet both produce 575 bytes). Confirmed the two commands that DO honour it (lint, list) shrink substantially, proving the sweep can detect a working --quiet. --verbose is likewise a no-op on 13 of 16 — honoured only by check (+53 B), oracle (+34 B) and trace (+217 B).

3. [P1] -q/--quiet and -v/--verbose are advertised on every command in the family and produce byte-identical output on all of th

Target: inspect,debug,validate,tensors,tree,hex

Repro

APR=/tmp/claude-1000/-home-noah-src-aprender/3e7b3507-59c1-4c5a-873b-c4003bfeca64/scratchpad/dogfood/cratesio/bin/apr
for f in /home/noah/models/qwen2.5-coder-0.5b-instruct.apr /home/noah/models/Qwen3.5-0.8B-Q4_K_M.gguf; do
 for c in inspect debug validate tensors tree hex; do
  "$APR" $c "$f" > a.out 2>/dev/null
  "$APR" $c "$f" --quiet   > b.out 2>/dev/null
  "$APR" $c "$f" --verbose > c.out 2>/dev/null
  echo "  $c $(basename $f|cut -c1-12): quiet=$(cmp -s a.out b.out && echo IDENTICAL || echo differs) verbose=$(cmp -s a.out c.out && echo IDENTICAL || echo differs)"
 done
done

Observed

11 command x format combinations, every one byte-identical for both flags:
  inspect  qwen2.5-code: quiet=IDENTICAL verbose=IDENTICAL
  debug    qwen2.5-code: quiet=IDENTICAL verbose=IDENTICAL
  validate qwen2.5-code: quiet=IDENTICAL verbose=IDENTICAL
  tensors  qwen2.5-code: quiet=IDENTICAL verbose=IDENTICAL
  tree     qwen2.5-code: quiet=IDENTICAL verbose=IDENTICAL
  hex      qwen2.5-code: quiet=IDENTICAL verbose=IDENTICAL
  inspect  Qwen3.5-0.8B: quiet=IDENTICAL verbose=IDENTICAL
  debug    Qwen3.5-0.8B: quiet=IDENTICAL verbose=IDENTICAL
  validate Qwen3.5-0.8B: quiet=IDENTICAL verbose=IDENTICAL
  tensors  Qwen3.5-0.8B: quiet=IDENTICAL verbose=IDENTICAL
  tree     Qwen3.5-0.8B: quiet=IDENTICAL verbose=IDENTICAL

Concretely, `apr inspect <gguf> --quiet` still writes all 6282 bytes of the full report to stdout, byte for byte identical to the unflagged run. Help text on every one of the eight commands promises:
  -v, --verbose        Verbose output
  -q, --quiet          Quiet mode (errors only)

--skip-contract likewise produced zero output difference on inspect, validate and tensors.

Expected / root cause

"Quiet mode (errors only)" must suppress the report body and leave only diagnostics; --verbose must add something. As shipped both are accepted-and-discarded on the whole inspect family, so a user scripting apr validate model.apr --quiet to get just a pass/fail gets 22 KB of tables instead.

Variations tried: Six commands x two formats (APR and GGUF) = 11 completed combinations (the 12th, hex on GGUF, exceeded the harness window; hex on APR is included and IDENTICAL). Compared with cmp -s on captured stdout rather than eyeballing, so this is byte equality, not "looks the same". Also verified the flags are genuinely accepted (exit 0, no clap error) rather than being silently swallowed as positional args. Separately checked --skip-contract on three commands -- also zero effect.

[noahgift]

Fixed on main by #2449 (batch 1), which merged fix/quiet-verbose-global-latch verbatim.

The 24 audit branches were batched into a single PR because the binding constraint was one ~50-minute workspace-test per PR on one shared box — nine concurrent PRs starved each other into 75-minute step timeouts and produced zero merges in 4.5 hours.

Merge commit: e759af2.