@andresmassello/uscha 1.89.0 → 1.90.0

package/README.md

@@ -40,7 +40,7 @@ Requires **Python 3.8+** on the machine (the engine is Python stdlib — no pip
 runtime dependencies). The npm package is a thin router; the canonical installer is
 `uscha-kit/install-uscha.py`.
 
-**Kit v1.89.0** <!-- uscha:version --> · [uscha.dev](https://uscha.dev) ·
+**Kit v1.90.0** <!-- uscha:version --> · [uscha.dev](https://uscha.dev) ·
 [changelog](https://github.com/andresmassello/uscha/blob/main/uscha-kit/CHANGELOG.md)
 (the per-release changelogs live in the repo, not in the npm tarball)
 
@@ -82,10 +82,10 @@ automatic tool can perform: a human verdict.
                                               system (= 100% drift)
 
    round trip · bench-roundtrip — how much of the asset the reverse organs re-anchor
-   from the compiled code: 0.062 measured (12 archetypes) — names, not yet semantics
+   from the compiled code: 0.828 measured (12 archetypes) — names AND behaviour
 ```
 
-**What each arrow is, in the engine (kit 1.89.0, 52 subcommands, all measured):**
+**What each arrow is, in the engine (kit 1.90.0, 52 subcommands, all measured):**
 
 | Leg | Subcommands | What it establishes |
 |---|---|---|
@@ -94,13 +94,17 @@ automatic tool can perform: a human verdict.
 | Forward, is it the *same* system? | `bootstrap-oracle`, `bootstrap-variance`, `bench` | a withheld oracle judges blind compilations — **12 archetypes, 9 PASS · 3 PARTIAL**, three models, JS included (M4/M5, ADR-017/018/028/029) |
 | Reverse, facts | `discover`, `golden-diff` (+ the `/uscha-characterize` skill) | system map + mechanically captured golden; typed candidate observations with evidence class (M1, ADR-013) |
 | Reverse, the human gate | `curate`, `promote`, `curation-check`, `bench-curate` | one verdict per candidate, append-only ledger verified against git; unjudged → `pr-ready` blocked naming it (ADR-009/010, INV-CURATION-01) |
-| Fidelity, honestly | `fidelity`, `roundtrip`, `bench-roundtrip`, `bench-r2` | per-compiler fidelity vector, id-level round trip, recoverability **0.062**, and the **noise floor** under every variance claim (ADR-014/022/027/030) |
+| Fidelity, honestly | `fidelity`, `roundtrip`, `bench-roundtrip`, `bench-r2` | per-compiler fidelity vector, id-level round trip, recoverability **0.828**, and the **noise floor** under every variance claim (ADR-014/022/027/030) |
 
 **Read the numbers the way the repo does.** 9 of 12 archetypes regenerate to the same system
-under an oracle the compilers never saw — that is the closed loop working. 0.062 is the mean
+under an oracle the compilers never saw — that is the closed loop working. 0.828 is the mean
 *recoverability* of the asset from compiled code counting only static and behavioural
-footing, with the behaviour dimension still `UNMEASURED` — it says the reverse organs anchor
-**names, not yet semantics**, and it is published rather than smoothed. And `bench-r2` measured
+footing. It read **0.062** until 1.90.0, with the behaviour dimension `UNMEASURED`, because no
+oracle case carried an AC tag — a named absence, not a zero. The 12 bench oracles are now
+curated per case (`ORACLE-TAGS-CURATED.json`, human-authored; payloads and expectations
+untouched), so the dimension is measured and the number says the reverse organs anchor **names
+and behaviour**. Both numbers are published rather than smoothed, and what moved between them
+was the tagging, not the code under test. And `bench-r2` measured
 that same-model reruns differ structurally about as much as different models do (aggregate
 `NOISY`) — so one earlier variance narrative was **retracted**. Every claim above is a subcommand
 you can run; every unmeasured part is labeled. That honesty is the method applied to itself.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andresmassello/uscha",
-  "version": "1.89.0",
+  "version": "1.90.0",
   "description": "Spec-driven development for LLM coding agents: 9 skills + a stdlib evidence engine. Facts block, guesses advise; the human approves.",
   "author": {
     "name": "Andres Massello",

package/uscha-kit/.claude/skills/uscha-devloop/qa_ledger.py

@@ -3423,6 +3423,15 @@ def cmd_golden_coverage(args):
 
         env = dict(os.environ)
         env["COVERAGE_PROCESS_START"] = rc
+        # COVERAGE_FILE is set EXPLICITLY, not merely inherited. coverage.py resolves its
+        # data_file with the environment variable AFTER the rc file, so an inherited
+        # COVERAGE_FILE (the shape the kit's own suite has under USCHA_COVERAGE=1) silently
+        # overrode the isolated data_file above and the capture landed in the caller's shared
+        # file -- the map then read as "covers nothing" and AC-GM-08 went red under coverage
+        # while passing plain. Writing it here pins the child to OUR file whether or not the
+        # caller has one; the parent's own Coverage(data_file=...) already wins over the
+        # environment because constructor arguments are applied last.
+        env["COVERAGE_FILE"] = data_file
         env["PYTHONPATH"] = tmp + os.pathsep + env.get("PYTHONPATH", "")
         env["PYTHONIOENCODING"] = "utf-8"
         r = subprocess.run([sys.executable, harness], cwd=root, env=env,
@@ -5468,6 +5477,47 @@ def _static_surface_for(cd, unit):
     return so, []
 
 
+def _judged_env():
+    """The environment a JUDGED program gets: this process's, minus the hooks that would make
+    a third party instrument it, plus the one setting that keeps it from leaving anything
+    behind in the tree it is judged from.
+
+    The withheld oracle measures a compiled implementation by its exit code and its stdout. A
+    measurement that changes what it measures is a broken measurement, and coverage.py's
+    documented subprocess hook does exactly that: with `COVERAGE_PROCESS_START` in the
+    environment, coverage.py's own `.pth` (`a1_coverage.pth`, shipped in site-packages) starts
+    a full Coverage in EVERY python process, at interpreter start-up, before any of that
+    process's own code runs. The oracle's children are fixture programs that sit outside every
+    `--source` root, so what they record is empty by construction -- pure cost, no measurement.
+
+    That cost is not theoretical (1.90.0). Running this repo's own smoke suite under
+    `USCHA_COVERAGE=1` spawned ~14,000 such children; `coverage combine` reported
+    "Combined 600 files, skipped 13702" -- 96% of them recorded nothing -- and late in the run
+    Windows began refusing to create processes: seven bench archetypes flipped to FAIL because
+    an oracle child could not start, and a py3.8 interpreter came back 3221225794
+    (0xC0000142, STATUS_DLL_INIT_FAILED) with an empty stderr. Nothing was wrong with the
+    engine or the fixtures; the instrument was crushing the machine it measured on.
+
+    Only the two variables that START coverage in a child are dropped. `COVERAGE_FILE` is
+    left alone: it names a data file, it does not turn anything on, and a caller that set it
+    means it.
+
+    `PYTHONDONTWRITEBYTECODE` is SET, and that one is not about coverage (1.90.0, ADR-030
+    amended). A multi-unit compilation imports its sibling module, so running it writes
+    `__pycache__/*.pyc` INTO the fixture directory -- and the round trip's own criterion is
+    that the instrument regenerates nothing under the bench tree (AC-RT-01 snapshots the file
+    list before and after). It only became reachable when the behaviour dimension started
+    running cases: measured on a clean tree, `bench-roundtrip` left three `.pyc` files behind.
+    In the suite the earlier `bench` block had already warmed the cache, so the red would have
+    waited for a fresh CI clone to appear -- an ordering dependency, which is the kind of
+    green worth nothing. Judging a program must not modify what is being judged."""
+    env = dict(os.environ)
+    for key in ("COVERAGE_PROCESS_START", "COVERAGE_PROCESS_CONFIG"):
+        env.pop(key, None)
+    env["PYTHONDONTWRITEBYTECODE"] = "1"
+    return env
+
+
 def _impl_interpreter(impl_path):
     """Resolve the interpreter argv prefix for one implementation file by extension (ADR-028):
     `.py` runs under this same Python (unchanged); `.js` runs under `node`, resolved from PATH.
@@ -5508,7 +5558,7 @@ def _run_oracle_case(impl_path, case):
         # sibling modules by bare name; single-unit impls are unaffected by their cwd
         r = subprocess.run(interp + [os.path.abspath(impl_path)], input=stdin,
                            capture_output=True, text=True, encoding="utf-8", errors="replace",
-                           timeout=_BOOTSTRAP_CASE_TIMEOUT,
+                           timeout=_BOOTSTRAP_CASE_TIMEOUT, env=_judged_env(),
                            cwd=os.path.dirname(os.path.abspath(impl_path)) or None)
         got, out, err = r.returncode, r.stdout, None
     except subprocess.TimeoutExpired:
@@ -6307,6 +6357,41 @@ def _rt_ids_in(text):
     return out
 
 
+def _rt_ac_key(cid):
+    """ONE spelling for comparing an AC id, so the round-trip's footings cannot disagree over
+    punctuation (ADR-030, amended 1.90.0).
+
+    The three footings read ids from three places that spell them differently: an IR node id is
+    written the way a human wrote the acceptance line and keeps its padding (`AC-DD-07`), a
+    source comment or a curated oracle tag may write `AC-DD-7` or `AC_DD_07`, and `_rt_ids_in`
+    only upper-cases what it finds. Comparing those raw was a match that depended on a zero.
+    The normal form is ADR-036's OWN grammar (`_ac_tag_ids`, family + integer, padding and
+    separator dropped) -- reused rather than reimplemented, because a second grammar for the
+    same id is the drift this function exists to prevent. It is applied to BOTH sides of the
+    behaviour comparison and nowhere else: `per_node["id"]`, the static footing and the
+    manifest footing keep the IR's own spelling, so no report changes shape. A non-AC id
+    (INV-*, ADR-*) has no behaviour footing at all and falls through upper-cased."""
+    ids = _ac_tag_ids(str(cid or ""))
+    return ids[0] if ids else str(cid or "").upper().replace("_", "-")
+
+
+def _rt_case_tags(case):
+    """Every AC id ONE withheld-oracle case is tagged with, normalised (ADR-030, amended
+    1.90.0): the ids literally referenced in its `name`, plus the ids in its curated `ac` list.
+
+    `ac` is a human-curated field on the case (provenance:
+    `tests/fixtures/diamond-bench/ORACLE-TAGS-CURATED.json`) -- the payload and the expectations
+    are untouched by it, so tagging cannot change what a case MEASURES, only what the id map
+    says it measures. Absence stays absence: a missing key, a null, a non-list, or a list with
+    nothing usable in it yields no tags, and an entry whose cases carry none is still
+    behaviour-UNMEASURED rather than behaviour-zero."""
+    out = set(_rt_ids_in(case.get("name", "")))
+    raw = case.get("ac")
+    if isinstance(raw, (list, tuple)):
+        out |= {t for t in (str(x).strip() for x in raw if isinstance(x, str)) if t}
+    return {_rt_ac_key(t) for t in out}
+
+
 def _rt_read_source(cd, unit):
     try:
         with open(os.path.join(cd, unit.replace("/", os.sep)), encoding="utf-8",
@@ -6321,8 +6406,9 @@ def _rt_compilation(entry_dir, cd, ir_graph, cases):
     IR node, whether the mechanical reverse organs find footing for it in the artifact --
     (a) static: a source unit's text or a static observation literally references the id;
     (b) manifest: the compiler's validated trace manifest maps the node to a unit that exists;
-    (c) behaviour: for AC nodes, at least one withheld-oracle case tagged with the id passes
-    (UNMEASURED when no case carries any AC tag). It regenerates NOTHING: no IR', no spec --
+    (c) behaviour: for AC nodes, at least one withheld-oracle case tagged with the id passes --
+    tagged in the case NAME or in its curated `ac` list (ADR-030 amended 1.90.0), and
+    UNMEASURED when no case carries any tag at all. It regenerates NOTHING: no IR', no spec --
     a coverage over the human-authored IR, plus the list of nodes nothing anchors."""
     cj = os.path.join(cd, "COMPILATION.json")
     try:
@@ -6347,26 +6433,40 @@ def _rt_compilation(entry_dir, cd, ir_graph, cases):
         if e.get("unit") in units:
             for nid in e.get("implements") or []:
                 manifest_ids.add(str(nid).upper())
-    # (c) behaviour footing: oracle cases whose NAME carries an AC id (payload tags are not a
-    # convention the bench oracles use today -- absence named, not faked)
+    # (c) behaviour footing: the oracle cases an id is tagged with -- in the case NAME, and
+    # since 1.90.0 in the case's curated `ac` list as well (ADR-030 amended). Before the
+    # curation there was no tag anywhere in this fixture and the whole dimension read
+    # UNMEASURED: a named absence, which is what it was, and it is now measured instead.
     tagged = {}
-    for case in cases:
-        for cid in _rt_ids_in(case.get("name", "")):
-            tagged.setdefault(cid, []).append(case)
-    behaviour_measured = bool(tagged)
+    for i, case in enumerate(cases):
+        for cid in _rt_case_tags(case):
+            tagged.setdefault(cid, []).append(i)
+    # MEASURED only when at least one tag names an AC node of THIS entry's IR (1.90.0 review):
+    # a typo, a stray ADR/INV id or a tag from another archetype anchors nothing, and a tag
+    # that anchors nothing must leave the dimension a named absence, never a measured zero.
+    ir_ac_keys = {_rt_ac_key(n) for n in node_ids if str(n).upper().startswith("AC")}
+    behaviour_measured = any(_rt_ac_key(k) in ir_ac_keys for k in tagged)
     behaviour_ids = set()
     entry_unit = _entry_unit(c.get("source") or [])
     impl = os.path.join(cd, entry_unit.replace("/", os.sep)) if entry_unit else None
     if behaviour_measured and impl and os.path.isfile(impl):
-        for cid, cs in tagged.items():
-            if any(_run_oracle_case(impl, case).get("ok") for case in cs):
+        # one RUN per case, not one per tag: a case tagged with three ids used to be executed
+        # three times, and running a judged program more often than the oracle asked is both
+        # slower and a different experiment
+        verdicts = {}
+        for cid, idxs in tagged.items():
+            for i in idxs:
+                if i not in verdicts:
+                    verdicts[i] = bool(_run_oracle_case(impl, cases[i]).get("ok"))
+            if any(verdicts[i] for i in idxs):
                 behaviour_ids.add(cid)
     per_node = []
     anchored = 0
     for nid in node_ids:
         a_s = nid in static_ids
         a_m = nid in manifest_ids
-        a_b = (nid in behaviour_ids) if (behaviour_measured and nid.startswith("AC-")) else None
+        a_b = ((_rt_ac_key(nid) in behaviour_ids)
+               if (behaviour_measured and nid.startswith("AC-")) else None)
         anchored_any = a_s or a_m or bool(a_b)
         # the MEASURED footing excludes the manifest: the manifest is what the compiler
         # CLAIMED (and the prompt handed it the ids), so counting it as recovered would be
@@ -6423,6 +6523,26 @@ def _rt_entry(entry_dir, name):
     return rec
 
 
+def _rt_behaviour_note(agg):
+    """The report's closing sentence about the behaviour dimension, DERIVED from the aggregate
+    instead of asserted (1.90.0).
+
+    It used to end 'which today is every entry' -- true when written, false the moment the
+    diamond-bench oracles were curated with per-case `ac` tags, and nothing would have caught
+    it: a generated document is exactly where a hardcoded claim rots unseen. Three honest
+    states, one of them chosen by the number beside it."""
+    measured, total = agg.get("behaviour_measured") or 0, agg.get("measured") or 0
+    if not total or not measured:
+        return ("which today is every entry: the honest state of reverse discovery is that it "
+                "anchors names, not semantics, until oracles carry per-AC tags")
+    if measured == total:
+        return ("which today is no entry: every oracle here carries per-AC tags, so this "
+                "dimension is measured rather than named absent, and what it attributes is "
+                "behaviour and not merely a name")
+    return ("which today is %d of the %d measured entries -- the rest carry per-AC tags and "
+            "are attributed by behaviour" % (total - measured, total))
+
+
 def _render_rt_md(recs, agg):
     lines = ["<!-- GENERATED by qa_ledger.py bench-roundtrip (ADR-030) -- measured run; do not hand-edit. -->",
              "", "# DIAMOND-ROUNDTRIP -- how much of the pinned IR the reverse organs can anchor in each compiled artifact", "",
@@ -6460,10 +6580,8 @@ def _render_rt_md(recs, agg):
               "", "*The manifest dimension is what the compiler CLAIMED (validated for shape, "
               "not truth) and is excluded from recoverability; the static dimension is what the "
               "artifact literally names; the behaviour dimension is what the withheld oracle can "
-              "attribute per AC -- and it is UNMEASURED wherever oracle cases are not tagged with "
-              "AC ids, which today is every entry: the honest state of reverse discovery is that "
-              "it anchors names, not semantics, until oracles carry per-AC tags. None of the three "
-              "is a spec.*", ""]
+              "attribute per AC -- UNMEASURED wherever the entry's oracle cases carry no AC tag, "
+              "%s. None of the three is a spec.*" % _rt_behaviour_note(agg), ""]
     return "\n".join(lines)
 
 
@@ -8288,9 +8406,17 @@ def _top_clean(text):
     observation statement, a tool name) -- human and CLI input -- so an ESC or a C0 byte
     inside one would be a control sequence the board obeys instead of prints. It dies HERE,
     in the engine, and the renderer drops it again on the way out: two cheap guards over one
-    attack surface. What is filtered is exactly C0 and DEL (ADR-032)."""
+    attack surface.
+
+    Filtered (1.90.0): C0 and DEL, the C1 range U+0080-U+009F (a terminal decoding the text
+    as latin-1 reads those as CSI/OSC introducers, so they are the same attack in one byte
+    less), and every Unicode format character (category `Cf`) -- U+200B and friends occupy no
+    column but do occupy a codepoint, and U+202E reverses the rest of the line. A character
+    that cannot be seen must not be able to move what is."""
     txt = "".join(" " if c in ("\t", "\n", "\r") else c for c in str(text))
-    txt = "".join(c for c in txt if ord(c) >= 32 and ord(c) != 127)
+    txt = "".join(c for c in txt
+                  if ord(c) >= 32 and ord(c) != 127 and not 0x80 <= ord(c) <= 0x9F
+                  and unicodedata.category(c) != "Cf")
     return " ".join(txt.split())
 
 

package/uscha-kit/.claude/skills/uscha-devloop/uscha_top.py

@@ -30,6 +30,7 @@ import shutil
 import subprocess
 import sys
 import time
+import unicodedata
 
 DEFAULT_LEDGER = "QA-LEDGER.json"
 FALLBACK_SIZE = (100, 32)
@@ -105,21 +106,71 @@ ACTIONS = {
 # --------------------------------------------------------------------------- #
 # pure rendering                                                              #
 # --------------------------------------------------------------------------- #
+def _dw(text):
+    """Display width in TERMINAL COLUMNS, not codepoints.
+
+    `len()` counts codepoints, and the frame's whole contract is columns: a CJK project name
+    or a full-width event text takes two columns per codepoint, so a line `len()` called
+    exactly `cols` wide draws twice that and the frame every golden pins stops being a frame
+    (1.86.1 fresh review, LOW, deferred until a fixture existed -- `state-wide.json` is it).
+
+    Three classes, and no font metric anywhere: East Asian Wide and Fullwidth cost 2, a
+    combining mark costs 0 (it draws on the previous cell), everything else costs 1. East
+    Asian *Ambiguous* deliberately counts 1 -- that is the class the renderer's own glyphs
+    fall into (`…`, `·`, `─`, `│`, `▁`, `—`), so on an ASCII state `_dw` is `len` and every
+    frame captured before this function existed stays byte-identical."""
+    width = 0
+    for ch in str(text):
+        if unicodedata.combining(ch):
+            continue
+        width += 2 if unicodedata.east_asian_width(ch) in ("W", "F") else 1
+    return width
+
+
+def _cut(text, width):
+    """The longest PREFIX of `text` that fits in `width` columns, whole characters only.
+
+    A wide character is never split: half a glyph is not half a column, it is a cell the
+    terminal fills however it likes and a frame nobody can snapshot."""
+    if width <= 0:
+        return ""
+    out, used = [], 0
+    for ch in str(text):
+        w = 0 if unicodedata.combining(ch) else (
+            2 if unicodedata.east_asian_width(ch) in ("W", "F") else 1)
+        if used + w > width:
+            break
+        out.append(ch)
+        used += w
+    return "".join(out)
+
+
+def _pad(text, width):
+    """`str.ljust` measured in columns. Padding by codepoints puts a wide cell's second
+    column inside the next field and every column after it walks."""
+    return str(text) + " " * max(0, width - _dw(text))
+
+
 def _fit(text, cols):
     """One line, never wider than the terminal. Wrapping would break the frame's row
-    accounting, so an over-long line is cut and marked."""
+    accounting, so an over-long line is cut and marked.
+
+    Measured and cut in COLUMNS (`_dw`/`_cut`): cutting by codepoints was the bug. Note the
+    cut may leave one column short rather than land exactly on `cols - 1` -- when the
+    character at the boundary is wide it is dropped whole, and a frame one column narrow is
+    correct where a frame one column wide is not."""
     if cols <= 0:
         return ""
-    if len(text) <= cols:
+    if _dw(text) <= cols:
         return text
-    return text[:cols - 1] + "…" if cols > 1 else text[:cols]
+    return _cut(text, cols - 1) + "…" if cols > 1 else _cut(text, cols)
 
 
 def _spread(left, right, cols):
     """left ... right on one line, right-aligned, degrading to just `left` when tight."""
-    if len(left) + len(right) + 1 > cols:
+    if _dw(left) + _dw(right) + 1 > cols:
         return _fit(left, cols)
-    return left + " " * (cols - len(left) - len(right)) + right
+    return left + " " * (cols - _dw(left) - _dw(right)) + right
 
 
 def _num(value):
@@ -151,7 +202,7 @@ def _burnup_line(burnup, cols):
     note = "  (readiness score, not closed obligations)"
     if not points:
         return label + DASH + "  (no `readiness --record` history yet)"
-    room = max(4, min(BURNUP_MAX, cols - len(label) - len(note)))
+    room = max(4, min(BURNUP_MAX, cols - _dw(label) - _dw(note)))
     bars = "".join(BLOCKS[min(len(BLOCKS) - 1, max(0, int(p) * len(BLOCKS) // 101))]
                    for p in points[-room:])
     return label + bars + note
@@ -180,10 +231,13 @@ def _cases_text(ob):
 
 
 def _row(ob, selected):
+    # the three left columns are cut and padded in COLUMNS: an id or state carrying wide
+    # characters used to eat its neighbour's field and walk every column after it.
     gutter = "> " if selected else "  "
-    return "%s%-8s%-9s%-15s%7s%5s  %s" % (
-        gutter, _safe(ob.get("id") or "?")[:8], _safe(ob.get("gate") or DASH)[:8],
-        _safe(ob.get("state") or "?")[:14], _cases_text(ob),
+    return "%s%s%s%s%7s%5s  %s" % (
+        gutter, _pad(_cut(_safe(ob.get("id") or "?"), 8), 8),
+        _pad(_cut(_safe(ob.get("gate") or DASH), 8), 9),
+        _pad(_cut(_safe(ob.get("state") or "?"), 14), 15), _cases_text(ob),
         _num(ob.get("age_hours")), ACTIONS.get(ob.get("state"), DASH))
 
 
@@ -191,8 +245,22 @@ def _safe(text):
     """No control character reaches the terminal through the feed. The engine already
     strips them where the text is derived (`_top_event_text`); this is the second guard on
     the same surface, because the renderer also accepts a frozen state file a human wrote,
-    and one ESC in it would be a control sequence the board obeys instead of prints."""
-    return "".join(c for c in str(text or "") if ord(c) >= 32 and ord(c) != 127)
+    and one ESC in it would be a control sequence the board obeys instead of prints.
+
+    Dropped (1.90.0), matching the engine's `_top_clean` exactly: C0 and DEL, the C1 range
+    U+0080-U+009F (a terminal reading the stream as latin-1 takes those for CSI/OSC), and
+    every Unicode format character (category `Cf`) -- U+200B costs a codepoint and no column,
+    U+202E reverses everything after it. A character that cannot be seen must not be able to
+    move what is."""
+    out = []
+    for ch in str(text or ""):
+        code = ord(ch)
+        if code < 32 or code == 127 or 0x80 <= code <= 0x9F:
+            continue
+        if unicodedata.category(ch) == "Cf":
+            continue
+        out.append(ch)
+    return "".join(out)
 
 
 def _feed_line(ev, cols, plain):
@@ -355,14 +423,17 @@ def _wrap(text, width):
     for word in _safe(text).split():
         if not line:
             line = word
-        elif len(line) + 1 + len(word) <= width:
+        elif _dw(line) + 1 + _dw(word) <= width:
             line += " " + word
         else:
             out.append(line)
             line = word
-        while len(line) > width:
-            out.append(line[:width])
-            line = line[width:]
+        # the hard split is measured in columns too, and `_cut` never breaks a wide
+        # character in half -- so a wide token continues on the next line, whole.
+        while _dw(line) > width:
+            head = _cut(line, width)
+            out.append(head)
+            line = line[len(head):]
     if line:
         out.append(line)
     return out or [""]
@@ -374,10 +445,10 @@ def _obs_row(i, ob, selected, cols):
     gutter = "> " if selected else "  "
     idx = "[%d]" % (i + 1) if i < VERDICT_LIST_MAX else "   "
     tail = " %s %s %s pending" % (MID, _safe(ob.get("ac")) or ("AC " + DASH), MID)
-    head = "%s%-4s%-18s" % (gutter, idx, _safe(ob.get("id"))[:18])
-    room = max(4, cols - len(head) - len(tail))
+    head = "%s%-4s%s" % (gutter, idx, _pad(_cut(_safe(ob.get("id")), 18), 18))
+    room = max(4, cols - _dw(head) - _dw(tail))
     title = _fit(_safe(ob.get("title")) or DASH, room)
-    return head + title.ljust(room) + tail
+    return head + _pad(title, room) + tail
 
 
 def _column_widths(cols):
@@ -412,7 +483,7 @@ def _pane(ob, cols, height):
             pad = max(len(left), len(right))
             left += [""] * (pad - len(left))
             right += [""] * (pad - len(right))
-            body = head + [("  %s │ %s" % (l.ljust(lw), r)).rstrip()
+            body = head + [("  %s │ %s" % (_pad(l, lw), r)).rstrip()
                            for l, r in zip(left, right)]
         else:
             body = (head + ["  CANDIDATE"] + ["  " + ln for ln in block("candidate", cols - 2)]

package/uscha-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "uscha",
-  "version": "1.89.0",
+  "version": "1.90.0",
   "displayName": "Uscha",
   "description": "Spec-driven development for LLM coding agents: 9 skills (discovery, adr-refine, reverse-discovery, characterize, devloop, sysdoc, rubric, mirador, status) + a stdlib measurement engine (qa_ledger.py, 52 subcommands + universal installer + npm/npx router). Facts block, guesses advise; the human approves.",
   "author": {

package/uscha-kit/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "uscha",
-  "version": "1.89.0",
+  "version": "1.90.0",
   "description": "Uscha spec-driven development methodology for coding agents. Includes npm/npx router.",
   "author": {
     "name": "Andres Massello",

package/uscha-kit/README.md

@@ -1,6 +1,6 @@
 # uscha-kit
 
-**Kit version:** v1.89.0 <!-- uscha:version --> · **[uscha.dev](https://uscha.dev)**
+**Kit version:** v1.90.0 <!-- uscha:version --> · **[uscha.dev](https://uscha.dev)**
 
 Spec-driven orchestrator + multi-repo QA for Claude Code, with a deterministic ledger.
 **Nine skills** (`uscha-discovery`, `uscha-adr-refine`, `uscha-devloop`, `uscha-sysdoc`, `uscha-reverse-discovery`,

package/uscha-kit/VERSION

@@ -1 +1 @@
-uscha-kit 1.89.0
+uscha-kit 1.90.0

package/uscha-kit/skills/uscha-devloop/qa_ledger.py

@@ -3423,6 +3423,15 @@ def cmd_golden_coverage(args):
 
         env = dict(os.environ)
         env["COVERAGE_PROCESS_START"] = rc
+        # COVERAGE_FILE is set EXPLICITLY, not merely inherited. coverage.py resolves its
+        # data_file with the environment variable AFTER the rc file, so an inherited
+        # COVERAGE_FILE (the shape the kit's own suite has under USCHA_COVERAGE=1) silently
+        # overrode the isolated data_file above and the capture landed in the caller's shared
+        # file -- the map then read as "covers nothing" and AC-GM-08 went red under coverage
+        # while passing plain. Writing it here pins the child to OUR file whether or not the
+        # caller has one; the parent's own Coverage(data_file=...) already wins over the
+        # environment because constructor arguments are applied last.
+        env["COVERAGE_FILE"] = data_file
         env["PYTHONPATH"] = tmp + os.pathsep + env.get("PYTHONPATH", "")
         env["PYTHONIOENCODING"] = "utf-8"
         r = subprocess.run([sys.executable, harness], cwd=root, env=env,
@@ -5468,6 +5477,47 @@ def _static_surface_for(cd, unit):
     return so, []
 
 
+def _judged_env():
+    """The environment a JUDGED program gets: this process's, minus the hooks that would make
+    a third party instrument it, plus the one setting that keeps it from leaving anything
+    behind in the tree it is judged from.
+
+    The withheld oracle measures a compiled implementation by its exit code and its stdout. A
+    measurement that changes what it measures is a broken measurement, and coverage.py's
+    documented subprocess hook does exactly that: with `COVERAGE_PROCESS_START` in the
+    environment, coverage.py's own `.pth` (`a1_coverage.pth`, shipped in site-packages) starts
+    a full Coverage in EVERY python process, at interpreter start-up, before any of that
+    process's own code runs. The oracle's children are fixture programs that sit outside every
+    `--source` root, so what they record is empty by construction -- pure cost, no measurement.
+
+    That cost is not theoretical (1.90.0). Running this repo's own smoke suite under
+    `USCHA_COVERAGE=1` spawned ~14,000 such children; `coverage combine` reported
+    "Combined 600 files, skipped 13702" -- 96% of them recorded nothing -- and late in the run
+    Windows began refusing to create processes: seven bench archetypes flipped to FAIL because
+    an oracle child could not start, and a py3.8 interpreter came back 3221225794
+    (0xC0000142, STATUS_DLL_INIT_FAILED) with an empty stderr. Nothing was wrong with the
+    engine or the fixtures; the instrument was crushing the machine it measured on.
+
+    Only the two variables that START coverage in a child are dropped. `COVERAGE_FILE` is
+    left alone: it names a data file, it does not turn anything on, and a caller that set it
+    means it.
+
+    `PYTHONDONTWRITEBYTECODE` is SET, and that one is not about coverage (1.90.0, ADR-030
+    amended). A multi-unit compilation imports its sibling module, so running it writes
+    `__pycache__/*.pyc` INTO the fixture directory -- and the round trip's own criterion is
+    that the instrument regenerates nothing under the bench tree (AC-RT-01 snapshots the file
+    list before and after). It only became reachable when the behaviour dimension started
+    running cases: measured on a clean tree, `bench-roundtrip` left three `.pyc` files behind.
+    In the suite the earlier `bench` block had already warmed the cache, so the red would have
+    waited for a fresh CI clone to appear -- an ordering dependency, which is the kind of
+    green worth nothing. Judging a program must not modify what is being judged."""
+    env = dict(os.environ)
+    for key in ("COVERAGE_PROCESS_START", "COVERAGE_PROCESS_CONFIG"):
+        env.pop(key, None)
+    env["PYTHONDONTWRITEBYTECODE"] = "1"
+    return env
+
+
 def _impl_interpreter(impl_path):
     """Resolve the interpreter argv prefix for one implementation file by extension (ADR-028):
     `.py` runs under this same Python (unchanged); `.js` runs under `node`, resolved from PATH.
@@ -5508,7 +5558,7 @@ def _run_oracle_case(impl_path, case):
         # sibling modules by bare name; single-unit impls are unaffected by their cwd
         r = subprocess.run(interp + [os.path.abspath(impl_path)], input=stdin,
                            capture_output=True, text=True, encoding="utf-8", errors="replace",
-                           timeout=_BOOTSTRAP_CASE_TIMEOUT,
+                           timeout=_BOOTSTRAP_CASE_TIMEOUT, env=_judged_env(),
                            cwd=os.path.dirname(os.path.abspath(impl_path)) or None)
         got, out, err = r.returncode, r.stdout, None
     except subprocess.TimeoutExpired:
@@ -6307,6 +6357,41 @@ def _rt_ids_in(text):
     return out
 
 
+def _rt_ac_key(cid):
+    """ONE spelling for comparing an AC id, so the round-trip's footings cannot disagree over
+    punctuation (ADR-030, amended 1.90.0).
+
+    The three footings read ids from three places that spell them differently: an IR node id is
+    written the way a human wrote the acceptance line and keeps its padding (`AC-DD-07`), a
+    source comment or a curated oracle tag may write `AC-DD-7` or `AC_DD_07`, and `_rt_ids_in`
+    only upper-cases what it finds. Comparing those raw was a match that depended on a zero.
+    The normal form is ADR-036's OWN grammar (`_ac_tag_ids`, family + integer, padding and
+    separator dropped) -- reused rather than reimplemented, because a second grammar for the
+    same id is the drift this function exists to prevent. It is applied to BOTH sides of the
+    behaviour comparison and nowhere else: `per_node["id"]`, the static footing and the
+    manifest footing keep the IR's own spelling, so no report changes shape. A non-AC id
+    (INV-*, ADR-*) has no behaviour footing at all and falls through upper-cased."""
+    ids = _ac_tag_ids(str(cid or ""))
+    return ids[0] if ids else str(cid or "").upper().replace("_", "-")
+
+
+def _rt_case_tags(case):
+    """Every AC id ONE withheld-oracle case is tagged with, normalised (ADR-030, amended
+    1.90.0): the ids literally referenced in its `name`, plus the ids in its curated `ac` list.
+
+    `ac` is a human-curated field on the case (provenance:
+    `tests/fixtures/diamond-bench/ORACLE-TAGS-CURATED.json`) -- the payload and the expectations
+    are untouched by it, so tagging cannot change what a case MEASURES, only what the id map
+    says it measures. Absence stays absence: a missing key, a null, a non-list, or a list with
+    nothing usable in it yields no tags, and an entry whose cases carry none is still
+    behaviour-UNMEASURED rather than behaviour-zero."""
+    out = set(_rt_ids_in(case.get("name", "")))
+    raw = case.get("ac")
+    if isinstance(raw, (list, tuple)):
+        out |= {t for t in (str(x).strip() for x in raw if isinstance(x, str)) if t}
+    return {_rt_ac_key(t) for t in out}
+
+
 def _rt_read_source(cd, unit):
     try:
         with open(os.path.join(cd, unit.replace("/", os.sep)), encoding="utf-8",
@@ -6321,8 +6406,9 @@ def _rt_compilation(entry_dir, cd, ir_graph, cases):
     IR node, whether the mechanical reverse organs find footing for it in the artifact --
     (a) static: a source unit's text or a static observation literally references the id;
     (b) manifest: the compiler's validated trace manifest maps the node to a unit that exists;
-    (c) behaviour: for AC nodes, at least one withheld-oracle case tagged with the id passes
-    (UNMEASURED when no case carries any AC tag). It regenerates NOTHING: no IR', no spec --
+    (c) behaviour: for AC nodes, at least one withheld-oracle case tagged with the id passes --
+    tagged in the case NAME or in its curated `ac` list (ADR-030 amended 1.90.0), and
+    UNMEASURED when no case carries any tag at all. It regenerates NOTHING: no IR', no spec --
     a coverage over the human-authored IR, plus the list of nodes nothing anchors."""
     cj = os.path.join(cd, "COMPILATION.json")
     try:
@@ -6347,26 +6433,40 @@ def _rt_compilation(entry_dir, cd, ir_graph, cases):
         if e.get("unit") in units:
             for nid in e.get("implements") or []:
                 manifest_ids.add(str(nid).upper())
-    # (c) behaviour footing: oracle cases whose NAME carries an AC id (payload tags are not a
-    # convention the bench oracles use today -- absence named, not faked)
+    # (c) behaviour footing: the oracle cases an id is tagged with -- in the case NAME, and
+    # since 1.90.0 in the case's curated `ac` list as well (ADR-030 amended). Before the
+    # curation there was no tag anywhere in this fixture and the whole dimension read
+    # UNMEASURED: a named absence, which is what it was, and it is now measured instead.
     tagged = {}
-    for case in cases:
-        for cid in _rt_ids_in(case.get("name", "")):
-            tagged.setdefault(cid, []).append(case)
-    behaviour_measured = bool(tagged)
+    for i, case in enumerate(cases):
+        for cid in _rt_case_tags(case):
+            tagged.setdefault(cid, []).append(i)
+    # MEASURED only when at least one tag names an AC node of THIS entry's IR (1.90.0 review):
+    # a typo, a stray ADR/INV id or a tag from another archetype anchors nothing, and a tag
+    # that anchors nothing must leave the dimension a named absence, never a measured zero.
+    ir_ac_keys = {_rt_ac_key(n) for n in node_ids if str(n).upper().startswith("AC")}
+    behaviour_measured = any(_rt_ac_key(k) in ir_ac_keys for k in tagged)
     behaviour_ids = set()
     entry_unit = _entry_unit(c.get("source") or [])
     impl = os.path.join(cd, entry_unit.replace("/", os.sep)) if entry_unit else None
     if behaviour_measured and impl and os.path.isfile(impl):
-        for cid, cs in tagged.items():
-            if any(_run_oracle_case(impl, case).get("ok") for case in cs):
+        # one RUN per case, not one per tag: a case tagged with three ids used to be executed
+        # three times, and running a judged program more often than the oracle asked is both
+        # slower and a different experiment
+        verdicts = {}
+        for cid, idxs in tagged.items():
+            for i in idxs:
+                if i not in verdicts:
+                    verdicts[i] = bool(_run_oracle_case(impl, cases[i]).get("ok"))
+            if any(verdicts[i] for i in idxs):
                 behaviour_ids.add(cid)
     per_node = []
     anchored = 0
     for nid in node_ids:
         a_s = nid in static_ids
         a_m = nid in manifest_ids
-        a_b = (nid in behaviour_ids) if (behaviour_measured and nid.startswith("AC-")) else None
+        a_b = ((_rt_ac_key(nid) in behaviour_ids)
+               if (behaviour_measured and nid.startswith("AC-")) else None)
         anchored_any = a_s or a_m or bool(a_b)
         # the MEASURED footing excludes the manifest: the manifest is what the compiler
         # CLAIMED (and the prompt handed it the ids), so counting it as recovered would be
@@ -6423,6 +6523,26 @@ def _rt_entry(entry_dir, name):
     return rec
 
 
+def _rt_behaviour_note(agg):
+    """The report's closing sentence about the behaviour dimension, DERIVED from the aggregate
+    instead of asserted (1.90.0).
+
+    It used to end 'which today is every entry' -- true when written, false the moment the
+    diamond-bench oracles were curated with per-case `ac` tags, and nothing would have caught
+    it: a generated document is exactly where a hardcoded claim rots unseen. Three honest
+    states, one of them chosen by the number beside it."""
+    measured, total = agg.get("behaviour_measured") or 0, agg.get("measured") or 0
+    if not total or not measured:
+        return ("which today is every entry: the honest state of reverse discovery is that it "
+                "anchors names, not semantics, until oracles carry per-AC tags")
+    if measured == total:
+        return ("which today is no entry: every oracle here carries per-AC tags, so this "
+                "dimension is measured rather than named absent, and what it attributes is "
+                "behaviour and not merely a name")
+    return ("which today is %d of the %d measured entries -- the rest carry per-AC tags and "
+            "are attributed by behaviour" % (total - measured, total))
+
+
 def _render_rt_md(recs, agg):
     lines = ["<!-- GENERATED by qa_ledger.py bench-roundtrip (ADR-030) -- measured run; do not hand-edit. -->",
              "", "# DIAMOND-ROUNDTRIP -- how much of the pinned IR the reverse organs can anchor in each compiled artifact", "",
@@ -6460,10 +6580,8 @@ def _render_rt_md(recs, agg):
               "", "*The manifest dimension is what the compiler CLAIMED (validated for shape, "
               "not truth) and is excluded from recoverability; the static dimension is what the "
               "artifact literally names; the behaviour dimension is what the withheld oracle can "
-              "attribute per AC -- and it is UNMEASURED wherever oracle cases are not tagged with "
-              "AC ids, which today is every entry: the honest state of reverse discovery is that "
-              "it anchors names, not semantics, until oracles carry per-AC tags. None of the three "
-              "is a spec.*", ""]
+              "attribute per AC -- UNMEASURED wherever the entry's oracle cases carry no AC tag, "
+              "%s. None of the three is a spec.*" % _rt_behaviour_note(agg), ""]
     return "\n".join(lines)
 
 
@@ -8288,9 +8406,17 @@ def _top_clean(text):
     observation statement, a tool name) -- human and CLI input -- so an ESC or a C0 byte
     inside one would be a control sequence the board obeys instead of prints. It dies HERE,
     in the engine, and the renderer drops it again on the way out: two cheap guards over one
-    attack surface. What is filtered is exactly C0 and DEL (ADR-032)."""
+    attack surface.
+
+    Filtered (1.90.0): C0 and DEL, the C1 range U+0080-U+009F (a terminal decoding the text
+    as latin-1 reads those as CSI/OSC introducers, so they are the same attack in one byte
+    less), and every Unicode format character (category `Cf`) -- U+200B and friends occupy no
+    column but do occupy a codepoint, and U+202E reverses the rest of the line. A character
+    that cannot be seen must not be able to move what is."""
     txt = "".join(" " if c in ("\t", "\n", "\r") else c for c in str(text))
-    txt = "".join(c for c in txt if ord(c) >= 32 and ord(c) != 127)
+    txt = "".join(c for c in txt
+                  if ord(c) >= 32 and ord(c) != 127 and not 0x80 <= ord(c) <= 0x9F
+                  and unicodedata.category(c) != "Cf")
     return " ".join(txt.split())
 
 

package/uscha-kit/skills/uscha-devloop/uscha_top.py

@@ -30,6 +30,7 @@ import shutil
 import subprocess
 import sys
 import time
+import unicodedata
 
 DEFAULT_LEDGER = "QA-LEDGER.json"
 FALLBACK_SIZE = (100, 32)
@@ -105,21 +106,71 @@ ACTIONS = {
 # --------------------------------------------------------------------------- #
 # pure rendering                                                              #
 # --------------------------------------------------------------------------- #
+def _dw(text):
+    """Display width in TERMINAL COLUMNS, not codepoints.
+
+    `len()` counts codepoints, and the frame's whole contract is columns: a CJK project name
+    or a full-width event text takes two columns per codepoint, so a line `len()` called
+    exactly `cols` wide draws twice that and the frame every golden pins stops being a frame
+    (1.86.1 fresh review, LOW, deferred until a fixture existed -- `state-wide.json` is it).
+
+    Three classes, and no font metric anywhere: East Asian Wide and Fullwidth cost 2, a
+    combining mark costs 0 (it draws on the previous cell), everything else costs 1. East
+    Asian *Ambiguous* deliberately counts 1 -- that is the class the renderer's own glyphs
+    fall into (`…`, `·`, `─`, `│`, `▁`, `—`), so on an ASCII state `_dw` is `len` and every
+    frame captured before this function existed stays byte-identical."""
+    width = 0
+    for ch in str(text):
+        if unicodedata.combining(ch):
+            continue
+        width += 2 if unicodedata.east_asian_width(ch) in ("W", "F") else 1
+    return width
+
+
+def _cut(text, width):
+    """The longest PREFIX of `text` that fits in `width` columns, whole characters only.
+
+    A wide character is never split: half a glyph is not half a column, it is a cell the
+    terminal fills however it likes and a frame nobody can snapshot."""
+    if width <= 0:
+        return ""
+    out, used = [], 0
+    for ch in str(text):
+        w = 0 if unicodedata.combining(ch) else (
+            2 if unicodedata.east_asian_width(ch) in ("W", "F") else 1)
+        if used + w > width:
+            break
+        out.append(ch)
+        used += w
+    return "".join(out)
+
+
+def _pad(text, width):
+    """`str.ljust` measured in columns. Padding by codepoints puts a wide cell's second
+    column inside the next field and every column after it walks."""
+    return str(text) + " " * max(0, width - _dw(text))
+
+
 def _fit(text, cols):
     """One line, never wider than the terminal. Wrapping would break the frame's row
-    accounting, so an over-long line is cut and marked."""
+    accounting, so an over-long line is cut and marked.
+
+    Measured and cut in COLUMNS (`_dw`/`_cut`): cutting by codepoints was the bug. Note the
+    cut may leave one column short rather than land exactly on `cols - 1` -- when the
+    character at the boundary is wide it is dropped whole, and a frame one column narrow is
+    correct where a frame one column wide is not."""
     if cols <= 0:
         return ""
-    if len(text) <= cols:
+    if _dw(text) <= cols:
         return text
-    return text[:cols - 1] + "…" if cols > 1 else text[:cols]
+    return _cut(text, cols - 1) + "…" if cols > 1 else _cut(text, cols)
 
 
 def _spread(left, right, cols):
     """left ... right on one line, right-aligned, degrading to just `left` when tight."""
-    if len(left) + len(right) + 1 > cols:
+    if _dw(left) + _dw(right) + 1 > cols:
         return _fit(left, cols)
-    return left + " " * (cols - len(left) - len(right)) + right
+    return left + " " * (cols - _dw(left) - _dw(right)) + right
 
 
 def _num(value):
@@ -151,7 +202,7 @@ def _burnup_line(burnup, cols):
     note = "  (readiness score, not closed obligations)"
     if not points:
         return label + DASH + "  (no `readiness --record` history yet)"
-    room = max(4, min(BURNUP_MAX, cols - len(label) - len(note)))
+    room = max(4, min(BURNUP_MAX, cols - _dw(label) - _dw(note)))
     bars = "".join(BLOCKS[min(len(BLOCKS) - 1, max(0, int(p) * len(BLOCKS) // 101))]
                    for p in points[-room:])
     return label + bars + note
@@ -180,10 +231,13 @@ def _cases_text(ob):
 
 
 def _row(ob, selected):
+    # the three left columns are cut and padded in COLUMNS: an id or state carrying wide
+    # characters used to eat its neighbour's field and walk every column after it.
     gutter = "> " if selected else "  "
-    return "%s%-8s%-9s%-15s%7s%5s  %s" % (
-        gutter, _safe(ob.get("id") or "?")[:8], _safe(ob.get("gate") or DASH)[:8],
-        _safe(ob.get("state") or "?")[:14], _cases_text(ob),
+    return "%s%s%s%s%7s%5s  %s" % (
+        gutter, _pad(_cut(_safe(ob.get("id") or "?"), 8), 8),
+        _pad(_cut(_safe(ob.get("gate") or DASH), 8), 9),
+        _pad(_cut(_safe(ob.get("state") or "?"), 14), 15), _cases_text(ob),
         _num(ob.get("age_hours")), ACTIONS.get(ob.get("state"), DASH))
 
 
@@ -191,8 +245,22 @@ def _safe(text):
     """No control character reaches the terminal through the feed. The engine already
     strips them where the text is derived (`_top_event_text`); this is the second guard on
     the same surface, because the renderer also accepts a frozen state file a human wrote,
-    and one ESC in it would be a control sequence the board obeys instead of prints."""
-    return "".join(c for c in str(text or "") if ord(c) >= 32 and ord(c) != 127)
+    and one ESC in it would be a control sequence the board obeys instead of prints.
+
+    Dropped (1.90.0), matching the engine's `_top_clean` exactly: C0 and DEL, the C1 range
+    U+0080-U+009F (a terminal reading the stream as latin-1 takes those for CSI/OSC), and
+    every Unicode format character (category `Cf`) -- U+200B costs a codepoint and no column,
+    U+202E reverses everything after it. A character that cannot be seen must not be able to
+    move what is."""
+    out = []
+    for ch in str(text or ""):
+        code = ord(ch)
+        if code < 32 or code == 127 or 0x80 <= code <= 0x9F:
+            continue
+        if unicodedata.category(ch) == "Cf":
+            continue
+        out.append(ch)
+    return "".join(out)
 
 
 def _feed_line(ev, cols, plain):
@@ -355,14 +423,17 @@ def _wrap(text, width):
     for word in _safe(text).split():
         if not line:
             line = word
-        elif len(line) + 1 + len(word) <= width:
+        elif _dw(line) + 1 + _dw(word) <= width:
             line += " " + word
         else:
             out.append(line)
             line = word
-        while len(line) > width:
-            out.append(line[:width])
-            line = line[width:]
+        # the hard split is measured in columns too, and `_cut` never breaks a wide
+        # character in half -- so a wide token continues on the next line, whole.
+        while _dw(line) > width:
+            head = _cut(line, width)
+            out.append(head)
+            line = line[len(head):]
     if line:
         out.append(line)
     return out or [""]
@@ -374,10 +445,10 @@ def _obs_row(i, ob, selected, cols):
     gutter = "> " if selected else "  "
     idx = "[%d]" % (i + 1) if i < VERDICT_LIST_MAX else "   "
     tail = " %s %s %s pending" % (MID, _safe(ob.get("ac")) or ("AC " + DASH), MID)
-    head = "%s%-4s%-18s" % (gutter, idx, _safe(ob.get("id"))[:18])
-    room = max(4, cols - len(head) - len(tail))
+    head = "%s%-4s%s" % (gutter, idx, _pad(_cut(_safe(ob.get("id")), 18), 18))
+    room = max(4, cols - _dw(head) - _dw(tail))
     title = _fit(_safe(ob.get("title")) or DASH, room)
-    return head + title.ljust(room) + tail
+    return head + _pad(title, room) + tail
 
 
 def _column_widths(cols):
@@ -412,7 +483,7 @@ def _pane(ob, cols, height):
             pad = max(len(left), len(right))
             left += [""] * (pad - len(left))
             right += [""] * (pad - len(right))
-            body = head + [("  %s │ %s" % (l.ljust(lw), r)).rstrip()
+            body = head + [("  %s │ %s" % (_pad(l, lw), r)).rstrip()
                            for l, r in zip(left, right)]
         else:
             body = (head + ["  CANDIDATE"] + ["  " + ln for ln in block("candidate", cols - 2)]

package/uscha-kit/uscha.config.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.89.0",
+  "version": "1.90.0",
   "project": null,
   "defaults": {
     "coverage_threshold": 60,

package/uscha-kit/reports/junit/.bench-cases.json

@@ -1 +0,0 @@
-{"AC-DB-01": true, "AC-DB-02": true, "AC-DB-03": true, "AC-DB-05": true, "AC-DB-04": true, "AC-DB-06": true, "AC-BG-01": true, "AC-BG-02": true, "AC-BG-03": true, "AC-BG-04": true, "AC-BG-05": true, "AC-FC-01": true, "AC-FC-02": true, "AC-FC-03": true}

package/uscha-kit/reports/junit/.bench-curate-cases.json

@@ -1 +0,0 @@
-{"AC-BC-04": true, "AC-BC-01": true, "AC-BC-02": true, "AC-BC-03": true}

package/uscha-kit/reports/junit/.bootstrap-cases.json

@@ -1 +0,0 @@
-{"AC-BS-01": true, "AC-BS-02": true, "AC-BS-03": true, "AC-BS-04": true, "AC-BS-05": true, "AC-BS-06": true}

package/uscha-kit/reports/junit/.cleanroom-cases.json

@@ -1 +0,0 @@
-{"AC-CR-06": true, "AC-CR-02": true, "AC-CR-04": true, "AC-CR-05": true, "AC-CR-03": true, "AC-CR-01": true, "AC-CR-07": true, "AC-CR-08": true}

package/uscha-kit/reports/junit/.compile-cases.json

@@ -1 +0,0 @@
-{"AC-CC-01": true, "AC-CC-02": true, "AC-CC-03": true, "AC-CC-04": true, "AC-CC-05": true, "AC-CC-06": true, "AC-CC-07": true}

package/uscha-kit/reports/junit/.curation-cases.json

@@ -1 +0,0 @@
-{"AC-RD-07": true, "AC-RD-01": true, "AC-RD-02": true, "AC-RD-03": true, "AC-RD-06": true, "AC-RD-04": true, "AC-RD-05": true, "AC-RD-13": true}

package/uscha-kit/reports/junit/.delta-cases.json

@@ -1 +0,0 @@
-{"AC-DD-01": true, "AC-DD-02": true, "AC-DD-03": true, "AC-DD-04": true, "AC-DD-05": true, "AC-DD-06": true, "AC-CU-06": true, "AC-CU-01": true, "AC-CU-02": true, "AC-CU-03": true, "AC-CU-04": true, "AC-CU-05": true, "AC-DD-07": true, "review-m1": true, "review-m3": true, "review-h1": true}

package/uscha-kit/reports/junit/.fa-cases.json

@@ -1 +0,0 @@
-{"AC-FA-01": true, "AC-FA-02": true, "AC-FA-03": null, "AC-FA-04": true, "AC-FA-05": true, "AC-FA-06": true}

package/uscha-kit/reports/junit/.facts-cases.json

@@ -1 +0,0 @@
-{"AC-SF-01": true, "AC-SF-02": true, "AC-SF-03": true, "AC-SF-04": true, "AC-SF-05": true}

package/uscha-kit/reports/junit/.fastpath-cases.json

@@ -1 +0,0 @@
-{"AC-FP-01": true, "AC-FP-11": true, "AC-FP-07": true, "AC-FP-06": true, "AC-FP-05": true, "AC-FP-02": true, "AC-FP-03": true, "AC-FP-09": true, "AC-FP-10": true, "AC-FP-08": true}

package/uscha-kit/reports/junit/.fidelity-cases.json

@@ -1 +0,0 @@
-{"AC-FV-01": true, "AC-FV-02": true, "AC-FV-04": true, "AC-FV-05": true, "AC-FV-03": true, "review-h2": true, "AC-FV-06": true, "review-m4": true}

package/uscha-kit/reports/junit/.goldencov-cases.json

@@ -1 +0,0 @@
-{"AC-GM-01": true, "AC-GM-03": true, "AC-GM-05": true, "AC-GM-04": true, "AC-GM-02": true, "AC-GM-06": true, "AC-GM-07": true, "AC-GM-08": null}

package/uscha-kit/reports/junit/.ir-cases.json

@@ -1 +0,0 @@
-{"AC-IR-01": true, "AC-IR-02": true, "AC-IR-03": true, "AC-IR-04": true, "AC-IR-05": true, "AC-IR-06": true}

package/uscha-kit/reports/junit/.js-cases.json

@@ -1 +0,0 @@
-{"AC-JS-01": true, "AC-JS-02": true, "AC-JS-03": true}

package/uscha-kit/reports/junit/.lang-cases.json

@@ -1 +0,0 @@
-{"AC-CL-01": true, "AC-CL-02": true, "AC-CL-03": true, "AC-CL-04": true, "AC-CL-05": true, "AC-CL-06": true, "AC-CL2-01": true, "AC-CL2-02": true, "AC-CL2-03": true, "AC-CL2-04": true}

package/uscha-kit/reports/junit/.lang3-cases.json

@@ -1 +0,0 @@
-{"AC-CL3-01": true, "AC-CL3-02": true, "AC-CL3-03": true}

package/uscha-kit/reports/junit/.multi-cases.json

@@ -1 +0,0 @@
-{"AC-MU-01": true, "AC-MU-02": true, "AC-MU-03": true}

package/uscha-kit/reports/junit/.oracle-cases.json

@@ -1 +0,0 @@
-{"AC-RD-08": true, "AC-RD-09": true, "AC-RD-10": true, "AC-RD-11": true, "AC-RD-12": true}

package/uscha-kit/reports/junit/.origin-cases.json

@@ -1 +0,0 @@
-{"AC-EP-01": true, "AC-EP-02": true, "AC-EP-03": true, "AC-EP-05": true, "AC-EP-04": true}

package/uscha-kit/reports/junit/.r2-cases.json

@@ -1 +0,0 @@
-{"AC-R2-01": true, "AC-R2-02": true, "AC-R2-03": true}

package/uscha-kit/reports/junit/.rt-cases.json

@@ -1 +0,0 @@
-{"AC-RT-01": true, "AC-RT-02": true, "AC-RT-03": true}

package/uscha-kit/reports/junit/.sched-cases.json

@@ -1 +0,0 @@
-{"AC-SH-01": true, "AC-SH-02": true, "AC-SH-03": true, "AC-LI-01": true, "AC-LI-02": true, "AC-LI-03": true}

package/uscha-kit/reports/junit/.specdrift-cases.json

@@ -1 +0,0 @@
-{"AC-SD-01": true, "AC-SD-03": true, "AC-SD-05": true, "AC-SD-02": true, "AC-SD-04": true}

package/uscha-kit/reports/junit/.top-cases.json

@@ -1 +0,0 @@
-{"AC-T-01": true, "AC-T-02": true, "AC-T-03": true, "AC-T-10": true, "AC-T-04": true, "AC-T-05": true, "AC-T-06": true, "AC-T-09": true, "AC-T-24": true, "reg-quarantine-obs-null-on-measured": true, "reg-spec-pin-null-outside-worktree": true, "reg-unreachable-repo-named-not-silent": true, "reg-top-events-malformed-fields-degrade": true, "AC-T-11": true, "AC-T-19": true, "reg-empty-project-honest": true, "AC-T-23": true, "AC-T-21": true, "AC-T-08": true, "AC-T-07": true, "AC-T-18": true, "AC-T-20": true, "AC-T-22": true, "reg-ledger-not-found": true, "AC-T-12": true, "reg-top-render-state-text-cannot-widen-or-escape": true, "AC-T-13": true, "AC-T-14": true, "AC-T-15": true, "AC-T-16": true, "AC-T-17": true}