@arjunkhera/atlas 0.4.23 → 0.4.25

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "atlas",
-  "version": "0.4.23",
+  "version": "0.4.25",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, for any repository.",
   "author": {
     "name": "Arjun Khera"

package/door/jobs/npm-release.yaml

@@ -0,0 +1,24 @@
+# An Atlas job (the routines design, records part). A job does nothing until a
+# repo names it in its atlas.yaml, with the npm packages it publishes:
+#
+#   jobs:
+#     atlas: [npm-release]
+#     npm: ['@scope/name']
+#
+# It fits a repo that publishes to npm through a release.yml on master that
+# keeps the Atlas release record, as Atlas does. A service, a schema repo or a
+# repo that publishes nothing does not name it.
+#
+# The check is Atlas code (door/lib/jobs.mjs). Each version that npm got in the
+# last 2 days must have the proof that `atlas upgrade` asks for: a successful
+# push run of release.yml on a master commit that recorded that version with
+# the sha256 of its tarball. A branch can publish before any merge (the gate
+# probes, P7), so a version with no such run is a finding. `problem` is a
+# code: no-tag, not-on-master, never-tip or no-record. Only a person can act
+# on it (deprecate the version on npm), so the job may only report.
+title: Each new npm version was published by a release run on master
+when: daily
+needs: []
+act: atlas:npm-release
+may: report
+fields: [package, version, problem, commit]

package/door/lib/install.mjs

@@ -218,12 +218,13 @@ export const recordName = (version, sha256) => `atlas-release-${version}-${sha25
 // commit must once have been the tip of master. A tag that a person made or
 // moved finds no record, so the upgrade refuses. With no sha256 (a loaded
 // copy has no tarball), any record of this version counts, and the byte
-// compare of every file does the rest.
+// compare of every file does the rest. A refusal carries a `code` too, for
+// the npm-release job of the watcher (jobs.mjs).
 export function findRelease({ gh, repo, version, sha256 }) {
   const commit = tagCommit(gh, repo, version);
-  if (!commit) return { problem: `no tag v${version} names a commit` };
-  if (!onMaster(gh, repo, commit)) return { problem: `the tag v${version} names commit ${commit.slice(0, 12)}, which is not on master` };
-  if (!wasTip(gh, repo, commit)) return { problem: `the tag v${version} names commit ${commit.slice(0, 12)}, which was never the tip of master through a merge or a push` };
+  if (!commit) return { code: 'no-tag', problem: `no tag v${version} names a commit` };
+  if (!onMaster(gh, repo, commit)) return { code: 'not-on-master', commit, problem: `the tag v${version} names commit ${commit.slice(0, 12)}, which is not on master` };
+  if (!wasTip(gh, repo, commit)) return { code: 'never-tip', commit, problem: `the tag v${version} names commit ${commit.slice(0, 12)}, which was never the tip of master through a merge or a push` };
   const runs = gh(['api', '--method', 'GET', `repos/${repo}/actions/workflows/release.yml/runs?event=push&status=success&head_sha=${commit}&per_page=100`]).workflow_runs ?? [];
   const prefix = recordName(version, '');
   const named = (name) => (sha256 ? name === recordName(version, sha256) : name.startsWith(prefix) && /^[0-9a-f]{64}$/.test(name.slice(prefix.length)));
@@ -234,7 +235,7 @@ export function findRelease({ gh, repo, version, sha256 }) {
     const artifacts = gh(['api', '--method', 'GET', `repos/${repo}/actions/runs/${run.id}/artifacts?per_page=100`]).artifacts ?? [];
     if (artifacts.some((artifact) => named(artifact.name ?? ''))) return { run, commit };
   }
-  return { problem: `no successful release run on master commit ${commit.slice(0, 12)} recorded ${version}${sha256 ? ' with this tarball' : ''}` };
+  return { code: 'no-record', commit, problem: `no successful release run on master commit ${commit.slice(0, 12)} recorded ${version}${sha256 ? ' with this tarball' : ''}` };
 }
 
 // The blob ids that the version files of the tarball must have: the files of

package/door/lib/jobs.mjs

@@ -24,7 +24,9 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parseYaml } from '../../shape/check.mjs';
+import { createHash } from 'node:crypto';
 import { api, apiBase, repoOk, openIssues, TOKEN_SHAPE, DEFAULT_BOT, DEFAULT_MAX } from './issues.mjs';
+import { findRelease, sha512Integrity } from './install.mjs';
 import { checkGateFiles, checkGateAudit, checkGateErrors } from './gate-audit.mjs';
 import { commitAudit, ghApi } from './gate.mjs';
 
@@ -107,7 +109,100 @@ export async function checkRedMain({ repo, branch, env }) {
   return findings;
 }
 
-// The check of each Atlas job, by its `when`. A job whose check is not built yet reads `none` and
+// ---------------------------------------------------------------- the check of npm-release
+
+// A branch of the repo can run its own release.yml and publish to npm before any merge (the gate
+// probes, P7). So each version that npm got in the last NPM_DAYS days must have the proof that
+// `atlas upgrade` asks for: a successful push run of release.yml on a master commit that recorded
+// this version with the sha256 of this exact tarball (findRelease, install.mjs). The watcher runs
+// once a day, so two days cover one missed run. A longer window reaches versions from before the
+// release record existed (Atlas 0.4.0), and the tip proof reads only the newest 100 changes of master.
+export const NPM_DAYS = 2;
+export const NPM_MAX = 50;
+const PACKAGE = /^(@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
+
+// The npm packages that atlas.yaml names under `jobs: { npm: [...] }`.
+export function npmPackages(root) {
+  const facts = parseYaml(readFileSync(join(root, 'atlas.yaml'), 'utf8')) ?? {};
+  const named = facts.jobs?.npm;
+  if (!Array.isArray(named) || !named.length) throw new Error('atlas.yaml names no package under jobs.npm');
+  const bad = named.map(String).find((name) => !PACKAGE.test(name));
+  if (bad !== undefined) throw new Error('jobs.npm in atlas.yaml holds a name that is not an npm package name');
+  return named.map(String);
+}
+
+// https, or http for this machine only (a test uses a fake registry on 127.0.0.1).
+function registryBase(env) {
+  const text = String(env.NPM_REGISTRY_URL || 'https://registry.npmjs.org');
+  let url;
+  try { url = new URL(text); } catch { throw usage('NPM_REGISTRY_URL is not a URL'); }
+  const local = url.hostname === '127.0.0.1' || url.hostname === 'localhost';
+  if (!(url.protocol === 'https:' || (url.protocol === 'http:' && local))) throw usage('NPM_REGISTRY_URL must be https (http is allowed only for 127.0.0.1 or localhost)');
+  return url;
+}
+
+// findRelease reads GitHub through a sync `gh`. Here each read is a fetch, so the proof runs again
+// after each read it asked for, until it needs none. Every read is a GET, and the same path gives the
+// same answer, so a replay changes nothing.
+export async function replayRelease({ base, key, repo, version, sha256 }) {
+  const answers = new Map();
+  for (let round = 0; round < 50; round += 1) {
+    try {
+      return findRelease({
+        repo, version, sha256,
+        gh: (args) => {
+          const path = `/${args.at(-1)}`;
+          if (!answers.has(path)) throw Object.assign(new Error('a read is still to come'), { need: path });
+          const answer = answers.get(path);
+          if (answer instanceof Error) throw answer;
+          return answer;
+        },
+      });
+    } catch (error) {
+      if (!error.need) throw error;
+      const r = await api(base, key, 'GET', error.need);
+      if (r.status === 404) answers.set(error.need, Object.assign(new Error('Not Found'), { stderr: 'HTTP 404' }));
+      else if (!r.ok) throw new Error(`GitHub answered ${r.status} when the release of ${version} was read`);
+      else answers.set(error.need, r.data);
+    }
+  }
+  throw new Error(`the release of ${version} needed more than 50 reads`);
+}
+
+export async function checkNpmRelease({ repo, env, root, now = Date.now(), fetchImpl = fetch }) {
+  const base = apiBase(env);
+  const key = env.GITHUB_TOKEN || '';
+  if (!key) throw usage('there is no token: set GITHUB_TOKEN in the environment');
+  const registry = registryBase(env);
+  const findings = [];
+  for (const name of npmPackages(root)) {
+    const response = await fetchImpl(new URL(name.replace('/', '%2F'), `${registry.href.replace(/\/?$/, '/')}`));
+    if (!response.ok) throw new Error(`npm answered ${response.status} when ${name} was read`);
+    const doc = await response.json();
+    // A broken answer must read broken, never none: each version needs a publish time.
+    const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+    if (!object(doc?.versions) || !object(doc?.time)) throw new Error(`npm sent no versions and times for ${name}`);
+    if (Object.keys(doc.versions).some((version) => !Number.isFinite(Date.parse(doc.time[version])))) throw new Error(`npm sent a version of ${name} with no publish time`);
+    const recent = Object.keys(doc.versions).filter((version) => now - Date.parse(doc.time[version]) <= NPM_DAYS * DAY);
+    if (recent.length > NPM_MAX) throw new Error(`npm holds ${recent.length} versions of ${name} from the last ${NPM_DAYS} days, more than ${NPM_MAX}`);
+    for (const version of recent.sort()) {
+      if (!VALUE.test(version)) throw new Error(`npm holds a version of ${name} that is not a plain version`);
+      const dist = doc.versions[version].dist ?? {};
+      const tarball = new URL(String(dist.tarball ?? ''), registry);
+      if (tarball.origin !== registry.origin) throw new Error(`the tarball of ${name}@${version} is not on the registry`);
+      const got = await fetchImpl(tarball);
+      if (!got.ok) throw new Error(`npm answered ${got.status} when the tarball of ${name}@${version} was read`);
+      const bytes = Buffer.from(await got.arrayBuffer());
+      if (sha512Integrity(bytes) !== dist.integrity) throw new Error(`the tarball of ${name}@${version} does not match the integrity npm records`);
+      const release = await replayRelease({ base, key, repo, version, sha256: createHash('sha256').update(bytes).digest('hex') });
+      if (!release.problem) continue;
+      findings.push({ job: 'npm-release', key: `${name}@${version}`, package: name, version, problem: release.code, ...(release.commit ? { commit: release.commit } : {}) });
+    }
+  }
+  return findings;
+}
+
+// The check of each Atlas job, by its id, else by its `when`. A job whose check is not built yet reads `none` and
 // says so in the notes; it never reads `found` from nothing.
 // The gate jobs (roadmap R14) read GitHub through `gh`, which the Actions
 // runner holds; their token is the run's own GITHUB_TOKEN.
@@ -116,6 +211,7 @@ const CHECKS = {
   'gate-files': ({ root, env, fetchImpl }) => checkGateFiles({ root, env, fetchImpl }),
   'gate-audit': ({ repo, branch, gh }) => checkGateAudit({ repo, branch, gh, audit: commitAudit }),
   'gate-errors': ({ repo, gh }) => checkGateErrors({ repo, gh }),
+  'npm-release': checkNpmRelease,
 };
 
 export async function jobsCheck({ root, repo, branch = null, env = process.env, jobs = atlasJobs(), gh = ghApi, fetchImpl = fetch }) {
@@ -128,7 +224,7 @@ export async function jobsCheck({ root, repo, branch = null, env = process.env,
   for (const id of named) {
     const job = jobs.get(id);
     if (!job) { notes.push(`${JOB_ID.test(id) ? id : '(a bad id)'}: no Atlas job has this id`); continue; }
-    const check = CHECKS[job.when];
+    const check = CHECKS[job.id] ?? CHECKS[job.when];
     if (!check) { notes.push(`${id}: its check is not built yet`); ran.push({ job: id, state: 'none' }); continue; }
     try {
       if (!mainBranch) mainBranch = await defaultBranch({ repo, env });

package/hooks/step-in.mjs

@@ -5,7 +5,8 @@
 // every test that reads the count.
 //
 // Its limits are the reason the package may ship it:
-// 1. A row holds the time, the session and the repos. It never holds the
+// 1. A row holds the time, the session and the repos, and `from: platform`
+//    when a platform sent the message (item f7391622). It never holds the
 //    text of the message.
 // 2. It makes no network call, reads no key and starts no program. It reads
 //    the hook input, atlas.yaml in the session folder or one level down, and
@@ -24,6 +25,11 @@ import { fileURLToPath } from 'node:url';
 const MAX_REPOS = 16;
 const REPO = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}\/[A-Za-z0-9_.-]{1,100}$/;
 const SESSION = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,199}$/;
+// Item f7391622: in a cloud project the platform also sends messages to the
+// session, such as a reminder, a relay or a pull request event. A message
+// that starts with one of these tags is the platform's.
+const PLATFORM_TAGS = ['wake', 'session-context', 'relay', 'coordinator-relay', 'system-reminder', 'task-notification'];
+const READ_BYTES = 65536;
 
 // The folder that the hook writes and the Atlas tools read. The tools keep
 // their own copy of the path, because these bytes are pinned.
@@ -52,13 +58,32 @@ export function reposOf(cwd) {
   return [...new Set(found.map((name) => repoOf(join(cwd, name, 'atlas.yaml'))).filter(Boolean))].slice(0, MAX_REPOS);
 }
 
+// Who sent one message, from its first bytes: 'owner' or 'platform'. The
+// text is read here and never kept.
+// 1. A <message> tag with trigger="true" and from="human" is the owner's. A
+//    cloud project wraps an owner message this way.
+// 2. A message that starts with a platform tag is the platform's.
+// 3. Any other message is the owner's, so an unknown shape counts high.
+export function senderOf(prompt) {
+  if (typeof prompt !== 'string') return 'owner';
+  const head = prompt.slice(0, READ_BYTES);
+  for (const match of head.matchAll(/<message\b([^>]*)>/g)) {
+    const attrs = match[1];
+    if (/\btrigger="true"/.test(attrs) && /\bfrom="human"/.test(attrs)) return 'owner';
+  }
+  const tag = /^\s*<([a-z][a-z-]*)[\s>]/.exec(head);
+  return tag && PLATFORM_TAGS.includes(tag[1]) ? 'platform' : 'owner';
+}
+
 // One message in, one row out, or null when no row is due.
 export function rowOf(input, { now = new Date(), id = randomUUID() } = {}) {
   const session = typeof input?.session_id === 'string' && SESSION.test(input.session_id) ? input.session_id : null;
   if (!session) return null;
   const repos = reposOf(input?.cwd);
   if (repos === null) return null;
-  return { v: 1, id, at: now.toISOString(), session, repos };
+  // A row with no sender is the owner's, as in the hook of 0.4.8, so only a
+  // platform message carries the key.
+  return { v: 1, id, at: now.toISOString(), session, repos, ...(senderOf(input?.prompt) === 'platform' ? { from: 'platform' } : {}) };
 }
 
 // The row goes to a file of its own, written under a temporary name and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arjunkhera/atlas",
-  "version": "0.4.23",
+  "version": "0.4.25",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, as a Claude Code plugin for any repository.",
   "type": "module",
   "license": "UNLICENSED",

package/work/lib/numbers.mjs

@@ -0,0 +1,317 @@
+// Roadmap R16 (item 76d8c717): the numbers. Part 6 of the roundup counts,
+// per repo, per week and per month, how changes reach the main branch and
+// how often the owner steps in. Design: docs/design-docs/the-numbers/.
+//
+// Three rules hold it together:
+//   1. Code counts. Every number is read from GitHub or from the tracker's
+//      marks at read time; the lead never types one, and none is stored.
+//   2. A count that cannot be read is refused, never shown as zero. A repo
+//      whose GitHub read fails names the reason, and its GitHub counts are
+//      null (line 4).
+//   3. A merge is not on green when a required check on its head failed,
+//      or finished after the merge (line 5).
+import { refuse } from './verb-fields.mjs';
+import { oneLine } from './questions.mjs';
+import { deliveryFacts, FATAL_CONCLUSIONS } from './delivery.mjs';
+import { standingOf, isOwnerMessage, isStepIn, senderOfMark } from './step-ins.mjs';
+import { ACTIONS_APP_ID } from '../../door/lib/gate.mjs';
+import { groupOf } from '../../door/lib/changed-tests.mjs';
+
+export const NUMBERS_MAX_DAYS = 92;
+export const NUMBERS_DEFAULT_DAYS = 28;
+export const PAGE = 100;
+// At most this many pull requests are read for one repo. More is refused,
+// never cut.
+export const MAX_PULL_PAGES = 10;
+const MAX_FILE_PAGES = 30;
+const CONCURRENCY = 8;
+const DAY = 86_400_000;
+// The second check of a changed test (roadmap R73). A signed act (R72) is
+// the other one; it is not built yet.
+export const SECOND_CHECK = 'passes-after';
+// A changed or removed file of these groups is an old test that changed. A
+// package.json or a runner config changes for many reasons, so it is not.
+const TEST_GROUPS = Object.freeze(['unit-test', 'check-block', 'scenario-words', 'test-helper', 'kit-manifest']);
+// The GitHub counts and the tracker counts of one row.
+export const GITHUB_COUNTS = Object.freeze(['merges', 'not_on_green', 'reverts', 'unchecked_test_changes']);
+export const GRAPH_COUNTS = Object.freeze(['reopens', 'step_ins', 'owner_messages', 'platform_messages']);
+// Line 2: the counts that wait on items not built yet. They are named, never
+// shown as zero.
+export const WAITING = Object.freeze({ signed_acts: 'waits on R72, the signed act', audit_unsigned_merges: 'waits on R14, the audit job' });
+
+const DATE = /^\d{4}-\d{2}-\d{2}$/;
+const dayOf = (value) => String(value ?? '').slice(0, 10);
+const time = (value) => Date.parse(value ?? '');
+
+// The period of the numbers. from and to are UTC days, both counted. With
+// neither, the period is the last NUMBERS_DEFAULT_DAYS days to the read.
+export function periodOf({ from, to } = {}, readAt) {
+  const check = (value, name) => {
+    if (value === undefined) return null;
+    // A day that does not exist, such as 2026-02-30, is refused, not rolled over.
+    if (typeof value !== 'string' || !DATE.test(value) || Number.isNaN(time(`${value}T00:00:00Z`)) || new Date(`${value}T00:00:00Z`).toISOString().slice(0, 10) !== value) refuse(`${name} must be a date, for example 2026-10-01`);
+    return value;
+  };
+  const fromDay = check(from, 'from'), toDay = check(to, 'to');
+  const end = toDay ? time(`${toDay}T00:00:00Z`) + DAY : time(readAt);
+  const start = fromDay ? time(`${fromDay}T00:00:00Z`) : end - NUMBERS_DEFAULT_DAYS * DAY;
+  if (start >= end) refuse('from must be on or before to');
+  if (end - start > NUMBERS_MAX_DAYS * DAY) refuse(`the numbers read at most ${NUMBERS_MAX_DAYS} days`);
+  return { start, end, from: new Date(start).toISOString(), to: new Date(end).toISOString() };
+}
+
+// The weeks of a period, counted back from its end: week 1 is the last seven
+// days. The first week may be short. And the calendar months it touches.
+export function bucketsOf(period) {
+  const weeks = [];
+  for (let k = 1, hi = period.end; hi > period.start; k += 1, hi -= 7 * DAY) {
+    const lo = Math.max(period.start, hi - 7 * DAY);
+    weeks.push({ week: k, start: lo, end: hi, from: dayOf(new Date(lo).toISOString()), to: dayOf(new Date(hi - 1).toISOString()) });
+  }
+  const months = [];
+  const first = new Date(period.start);
+  for (let y = first.getUTCFullYear(), m = first.getUTCMonth(); ; m += 1) {
+    const lo = Date.UTC(y, m, 1), hi = Date.UTC(y, m + 1, 1);
+    if (lo >= period.end) break;
+    const start = Math.max(lo, period.start), end = Math.min(hi, period.end);
+    months.push({ month: new Date(lo).toISOString().slice(0, 7), start, end, from: dayOf(new Date(start).toISOString()), to: dayOf(new Date(end - 1).toISOString()), whole: start === lo && end === hi });
+  }
+  return { weeks, months };
+}
+
+// Every pull request of a repo that changed in the period, newest change
+// first. The list pages past 100 and stops at the first page that ends
+// before the period (line 4). A merge is always older than the last change
+// of its pull request, so no merge of the period is missed.
+export async function readAllPulls(repo, readGitHub, sinceAt, maxPages = MAX_PULL_PAGES) {
+  const rows = [];
+  for (let page = 1; ; page += 1) {
+    if (page > maxPages) throw new Error(`more than ${maxPages * PAGE} pull requests changed in the period`);
+    const list = await readGitHub(`repos/${repo}/pulls?state=all&sort=updated&direction=desc&per_page=${PAGE}&page=${page}`);
+    if (!Array.isArray(list)) throw new Error(`page ${page} of the pull requests is not a list`);
+    rows.push(...list);
+    const last = list.at(-1);
+    if (list.length < PAGE || !last || time(last.updated_at ?? last.created_at) < sinceAt) return rows;
+  }
+}
+
+async function readAllFiles(repo, number, readGitHub) {
+  const rows = [];
+  for (let page = 1; page <= MAX_FILE_PAGES; page += 1) {
+    const list = await readGitHub(`repos/${repo}/pulls/${number}/files?per_page=${PAGE}&page=${page}`);
+    if (!Array.isArray(list)) throw new Error(`the files of pull request ${number} are not a list`);
+    rows.push(...list);
+    if (list.length < PAGE) return rows;
+  }
+  throw new Error(`pull request ${number} changed more than ${MAX_FILE_PAGES * PAGE} files`);
+}
+
+// Run each job, at most `limit` at a time. The first failure stops the rest
+// and is thrown, so a count is whole or refused.
+async function pool(jobs, limit = CONCURRENCY) {
+  const out = new Array(jobs.length);
+  let next = 0, failed = null;
+  const worker = async () => {
+    while (next < jobs.length && !failed) {
+      const at = next++;
+      try { out[at] = await jobs[at](); } catch (error) { failed = failed ?? error; }
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, jobs.length) }, worker));
+  if (failed) throw failed;
+  return out;
+}
+
+// Line 5: why one merge was not on green, or [] when it was. The required
+// checks are those of atlas.yaml at the first parent of the merge commit, as
+// item_done reads them: the gate as it stood when the merge came. A repo that names none counts
+// every GitHub Actions check run on the head. For each check, the newest run
+// that started before the merge decides.
+export function notOnGreenReasons({ required = [], runs = [], mergedAt }) {
+  const merged = time(mergedAt);
+  const actions = runs.filter((run) => run?.app?.id === ACTIONS_APP_ID && typeof run.name === 'string');
+  const named = required.length > 0;
+  const names = named ? required : [...new Set(actions.map((run) => run.name))].sort();
+  // With no required list and no run, nothing proved the head green.
+  if (!names.length) return ['no check ran on the head'];
+  const reasons = [];
+  for (const name of names) {
+    const all = actions.filter((run) => run.name === name);
+    const before = all.filter((run) => time(run.started_at ?? run.created_at) <= merged)
+      .sort((a, b) => `${b.started_at ?? ''}#${String(b.id ?? 0).padStart(24, '0')}`.localeCompare(`${a.started_at ?? ''}#${String(a.id ?? 0).padStart(24, '0')}`));
+    const run = before[0];
+    if (!run) { reasons.push(all.length ? `${name} started after the merge` : `${name} never ran on the head`); continue; }
+    const done = time(run.completed_at);
+    if (run.status !== 'completed' || Number.isNaN(done)) { reasons.push(`${name} had not finished at the merge`); continue; }
+    if (FATAL_CONCLUSIONS.includes(run.conclusion ?? '')) { reasons.push(`${name} ended ${run.conclusion}`); continue; }
+    if (named && run.conclusion === 'skipped') { reasons.push(`${name} was skipped`); continue; }
+    if (done > merged) reasons.push(`${name} finished ${Math.round((done - merged) / 1000)} s after the merge`);
+  }
+  return reasons;
+}
+
+// A merged pull request that undoes another: GitHub's revert button writes
+// both of these.
+export const isRevert = (pull) => /^revert\b/i.test(String(pull.title ?? '').trim()) || /^Reverts [A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+#\d+/m.test(String(pull.body ?? ''));
+
+// The old tests that one merge changed or removed. An added test is new, so
+// it is not here.
+export function changedOldTests(files = []) {
+  const out = [];
+  for (const file of files) {
+    if (!['modified', 'changed', 'removed', 'renamed'].includes(file?.status)) continue;
+    const path = file.status === 'renamed' ? (file.previous_filename ?? file.filename) : file.filename;
+    if (typeof path === 'string' && TEST_GROUPS.includes(groupOf(path))) out.push(path);
+  }
+  return [...new Set(out)].sort();
+}
+
+// The second check of one merge: the newest passes-after run that started
+// before the merge ended in success.
+export function secondCheckPassed(runs = [], mergedAt) {
+  const merged = time(mergedAt);
+  const run = runs.filter((one) => one?.app?.id === ACTIONS_APP_ID && one.name === SECOND_CHECK && time(one.started_at ?? one.created_at) <= merged)
+    .sort((a, b) => String(b.started_at ?? '').localeCompare(String(a.started_at ?? '')))[0];
+  return Boolean(run && run.status === 'completed' && run.conclusion === 'success' && time(run.completed_at) <= merged);
+}
+
+// Each merge of one repo in the period, with what the numbers count of it.
+export async function readMerges({ repo, defaultBranch, period, readGitHub }) {
+  const pulls = await readAllPulls(repo, readGitHub, period.start);
+  const merges = pulls.filter((pull) => pull.merged_at && time(pull.merged_at) >= period.start && time(pull.merged_at) < period.end && (!defaultBranch || pull.base?.ref === defaultBranch));
+  const facts = new Map();
+  const requiredAt = (sha) => {
+    if (!facts.has(sha)) facts.set(sha, (async () => {
+      let file;
+      try { file = await readGitHub(`repos/${repo}/contents/atlas.yaml?ref=${sha}`); }
+      catch (error) { if (error?.status === 404 || /HTTP 404|Not Found/i.test(String(error?.message ?? ''))) return []; throw error; }
+      if (!file || typeof file.content !== 'string') return [];
+      return deliveryFacts(Buffer.from(file.content, 'base64').toString('utf8')).required;
+    })());
+    return facts.get(sha);
+  };
+  return pool(merges.map((pull) => async () => {
+    const head = pull.head?.sha, merge = pull.merge_commit_sha;
+    if (!/^[0-9a-f]{40}$/i.test(String(head)) || !/^[0-9a-f]{40}$/i.test(String(merge))) throw new Error(`GitHub names no head or merge commit for pull request ${pull.number}`);
+    const requiredBefore = async () => {
+      const parent = (await readGitHub(`repos/${repo}/commits/${merge}`))?.parents?.[0]?.sha;
+      if (!/^[0-9a-f]{40}$/i.test(String(parent))) throw new Error(`GitHub names no parent of the merge commit of pull request ${pull.number}`);
+      return requiredAt(parent);
+    };
+    const [checks, files, required] = await Promise.all([
+      readGitHub(`repos/${repo}/commits/${head}/check-runs?per_page=${PAGE}`),
+      readAllFiles(repo, pull.number, readGitHub),
+      requiredBefore(),
+    ]);
+    if (!Array.isArray(checks?.check_runs)) throw new Error(`the check runs of pull request ${pull.number} are not a list`);
+    const runs = checks.check_runs;
+    if (Number(checks?.total_count ?? runs.length) > runs.length) throw new Error(`the head of pull request ${pull.number} has more than ${PAGE} check runs`);
+    const tests = changedOldTests(files);
+    return {
+      repo, number: pull.number, url: pull.html_url ?? `https://github.com/${repo}/pull/${pull.number}`, title: oneLine(pull.title ?? '', 200), merged_at: pull.merged_at,
+      not_on_green: notOnGreenReasons({ required, runs, mergedAt: pull.merged_at }), revert: isRevert(pull),
+      changed_tests: tests, unchecked: tests.length > 0 && !secondCheckPassed(runs, pull.merged_at),
+    };
+  }));
+}
+
+// The time an item went live: the release that holds it, the deploy check,
+// or the last merge. A legacy mark has none of them.
+export function liveAt(mark) {
+  const fields = mark.fields ?? {};
+  const releases = (Array.isArray(fields.releases) ? fields.releases : []).map((row) => row?.published_at).filter((at) => !Number.isNaN(time(at)));
+  if (releases.length) return releases.sort().at(-1);
+  if (!Number.isNaN(time(fields.deployed?.checked_at))) return fields.deployed.checked_at;
+  const merged = (Array.isArray(fields.prs) ? fields.prs : []).map((row) => row?.merged_at).filter((at) => !Number.isNaN(time(at)));
+  if (merged.length) return merged.sort().at(-1);
+  return fields.marked_at ?? null;
+}
+
+export function median(values) {
+  const sorted = values.filter((value) => Number.isFinite(value)).sort((a, b) => a - b);
+  if (!sorted.length) return null;
+  const mid = Math.floor(sorted.length / 2);
+  return sorted.length % 2 ? sorted[mid] : (sorted[mid - 1] + sorted[mid]) / 2;
+}
+const days = (ms) => Math.round((ms / DAY) * 10) / 10;
+
+// Line 3: one row for each item that went live in the period, from input to
+// live. Input is the time the item was recorded.
+export function deliveredRows({ marks, items, period }) {
+  const byId = new Map(items.map((item) => [item.id, item]));
+  const rows = [];
+  for (const mark of marks) {
+    if (mark.fields?.kind !== 'delivery' || mark.fields?.verdict !== 'delivered') continue;
+    const item = byId.get(mark.fields.item);
+    if (!item) continue;
+    const live = liveAt(mark);
+    if (Number.isNaN(time(live)) || time(live) < period.start || time(live) >= period.end) continue;
+    const input = item.created_at;
+    const span = Number.isNaN(time(input)) ? null : days(time(live) - time(input));
+    rows.push({ item: item.id, title: oneLine(item.title ?? '', 120), mark: mark.id, input_at: input ?? null, live_at: live, days: span });
+  }
+  // One row for each item: an item delivered, reopened and delivered again
+  // keeps its last delivery in the period.
+  const last = new Map();
+  for (const row of rows) if (!last.has(row.item) || String(row.live_at) > String(last.get(row.item).live_at)) last.set(row.item, row);
+  const kept = [...last.values()].sort((a, b) => String(a.live_at).localeCompare(String(b.live_at)));
+  return { rows: kept, median_days_to_live: median(kept.map((row) => row.days)) };
+}
+
+const zero = (keys) => Object.fromEntries(keys.map((key) => [key, 0]));
+const nulls = (keys) => Object.fromEntries(keys.map((key) => [key, null]));
+
+// The numbers of one product: per repo, the totals, the weeks and the months;
+// and the delivered items with their time to live.
+export async function readNumbers({ product, repos, items, marks, period, readGitHub }) {
+  const { weeks, months } = bucketsOf(period);
+  const inPeriod = (at) => !Number.isNaN(time(at)) && time(at) >= period.start && time(at) < period.end;
+  const productRepos = new Set(repos.map((repo) => repo.id));
+  const itemRepos = new Map(items.map((item) => [item.id, Array.isArray(item.fields?.repos) ? item.fields.repos : []]));
+  const pairs = standingOf(marks).filter(({ mark }) => mark.fields?.verdict === 'counted' && inPeriod(mark.fields.marked_at));
+  const reopens = marks.filter((mark) => mark.fields?.kind === 'reopen' && itemRepos.has(mark.fields.item) && inPeriod(mark.fields.marked_at));
+
+  const out = [];
+  for (const repo of repos) {
+    // Each counted thing, with the moment it counts at.
+    const events = [];
+    let refused = null, merges = [];
+    try { merges = await readMerges({ repo: repo.id, defaultBranch: repo.default_branch, period, readGitHub }); }
+    catch (error) { refused = `GitHub did not answer: ${oneLine(error?.message ?? String(error), 300)}`; }
+    if (!refused) for (const merge of merges) {
+      events.push(['merges', merge.merged_at]);
+      if (merge.not_on_green.length) events.push(['not_on_green', merge.merged_at]);
+      if (merge.revert) events.push(['reverts', merge.merged_at]);
+      if (merge.unchecked) events.push(['unchecked_test_changes', merge.merged_at]);
+    }
+    for (const mark of reopens) if (itemRepos.get(mark.fields.item).includes(repo.id)) events.push(['reopens', mark.fields.marked_at]);
+    for (const pair of pairs) {
+      if (!(pair.mark.fields.repos ?? []).includes(repo.id)) continue;
+      if (isOwnerMessage(pair)) events.push(['owner_messages', pair.mark.fields.marked_at]);
+      if (isStepIn(pair)) events.push(['step_ins', pair.mark.fields.marked_at]);
+      if (senderOfMark(pair.mark) === 'platform') events.push(['platform_messages', pair.mark.fields.marked_at]);
+    }
+    const counts = (lo, hi) => {
+      const row = { ...(refused ? nulls(GITHUB_COUNTS) : zero(GITHUB_COUNTS)), ...zero(GRAPH_COUNTS) };
+      for (const [key, at] of events) if (time(at) >= lo && time(at) < hi) row[key] += 1;
+      return row;
+    };
+    out.push({
+      repo: repo.id, refused,
+      total: counts(period.start, period.end),
+      weeks: weeks.map((week) => ({ week: week.week, from: week.from, to: week.to, ...counts(week.start, week.end) })),
+      months: months.map((month) => ({ month: month.month, from: month.from, to: month.to, whole: month.whole, ...counts(month.start, month.end) })),
+      not_on_green: refused ? null : merges.filter((merge) => merge.not_on_green.length).map((merge) => ({ pr: merge.url, merged_at: merge.merged_at, reasons: merge.not_on_green })),
+      reverts: refused ? null : merges.filter((merge) => merge.revert).map((merge) => ({ pr: merge.url, title: merge.title })),
+      unchecked_test_changes: refused ? null : merges.filter((merge) => merge.unchecked).map((merge) => ({ pr: merge.url, tests: merge.changed_tests })),
+    });
+  }
+  const delivered = deliveredRows({ marks: marks.filter((mark) => mark.fields?.product === product), items, period });
+  const notCounted = marks.filter((mark) => mark.fields?.kind === 'step-in' && mark.fields?.verdict === 'not counted' && inPeriod(mark.fields.marked_at)).length;
+  return {
+    from: dayOf(period.from), to: dayOf(new Date(period.end - 1).toISOString()), repos: out,
+    delivered: delivered.rows, median_days_to_live: delivered.median_days_to_live,
+    not_counted_sessions: notCounted, owner_acts: { ...WAITING }, second_check: SECOND_CHECK,
+    repos_known: [...productRepos].sort(),
+  };
+}

package/work/lib/roundup.mjs

@@ -13,11 +13,17 @@
 //                       and questions that wait longer than STUCK_DAYS
 //   5. Trend            per week, for TREND_WEEKS weeks: merges, deliveries,
 //                       new items; and the open questions with the oldest age
+//   6. The numbers      per repo, per week and per month: merges, merges not
+//                       on green, reverts, reopens, unchecked test changes,
+//                       step-ins and owner messages; and the time from input
+//                       to live of each delivered item (roadmap R16,
+//                       numbers.mjs). A count GitHub did not give is refused.
 // Every row carries a citation: an item id, a question id or a pull request
 // URL. It is computed at read time and never stored.
 import { refuse, isoDate, LIVE_LIFECYCLES } from './verb-fields.mjs';
 import { oneLine, ROW_LINE_MAX } from './questions.mjs';
 import { readPullsByRepo, pullsOfItem, daysBetween, listLine } from './delivery.mjs';
+import { readNumbers, periodOf } from './numbers.mjs';
 
 export const ROUNDUP_READ_VERBS = Object.freeze(['roundup']);
 
@@ -116,6 +122,7 @@ export function createRoundupVerbs(core) {
       const windowDays = args.days === undefined ? DEFAULT_WINDOW : args.days;
       if (!Number.isInteger(windowDays) || windowDays < 1 || windowDays > MAX_WINDOW) refuse(`days must be a whole number from 1 to ${MAX_WINDOW}`);
       const readAt = now();
+      const period = periodOf({ from: args.from, to: args.to }, readAt);
       const since = minus(readAt, windowDays);
       const trendFrom = minus(readAt, Math.max(windowDays, TREND_WEEKS * 7));
 
@@ -174,7 +181,16 @@ export function createRoundupVerbs(core) {
       for (const row of items) bump(row.created_at, 'new_items');
       const oldest = needRows.reduce((max, row) => Math.max(max, row.days_waiting ?? 0), 0);
 
-      const text = render({ product, readAt, windowDays, needRows, ladder, lifecycles, active, merged, deliveries, created, stale, notMarked, openNoItem, longWaits, audits, weeks, oldest, repoErrors });
+      // 6. The numbers. They read every pull request of the period, not only
+      // the newest 100, and the marks of the tracker.
+      const markType = await typeNamed('mark');
+      const marks = await client.listAllEntities({ type: markType.name, state: 'active' });
+      const numbers = await readNumbers({
+        product, items, marks, period, readGitHub,
+        repos: repoIds.map((id) => ({ id, default_branch: reg.repos.get(id)?.fields?.default_branch ?? null })),
+      });
+
+      const text = render({ product, readAt, windowDays, needRows, ladder, lifecycles, active, merged, deliveries, created, stale, notMarked, openNoItem, longWaits, audits, weeks, oldest, repoErrors, numbers });
       return {
         verb: 'roundup', read_at: readAt, product, window_days: windowDays, since,
         needs_you: needRows,
@@ -182,6 +198,7 @@ export function createRoundupVerbs(core) {
         what_moved: { merged, delivered: deliveries, new_items: created },
         stuck_or_drifting: { stale, merged_not_marked: notMarked, open_prs_with_no_item: openNoItem, long_waits: longWaits, stuck_days: STUCK_DAYS, audits_not_run: audits.stale, audits_unread: audits.unread, audit_stale_hours: AUDIT_STALE_HOURS },
         trend: { weeks, open_questions: needRows.length, oldest_question_days: oldest },
+        numbers,
         repos_read: repoIds, repo_errors: repoErrors,
         citation: { product, read_at: readAt, items: items.length, repos: repoIds },
         text,
@@ -191,7 +208,7 @@ export function createRoundupVerbs(core) {
 }
 
 function render(view) {
-  const { product, readAt, windowDays, needRows, ladder, lifecycles, active, merged, deliveries, created, stale, notMarked, openNoItem, longWaits, audits = { stale: [], unread: [] }, weeks, oldest, repoErrors } = view;
+  const { product, readAt, windowDays, needRows, ladder, lifecycles, active, merged, deliveries, created, stale, notMarked, openNoItem, longWaits, audits = { stale: [], unread: [] }, weeks, oldest, repoErrors, numbers } = view;
   const more = (list) => (list.length > SHOWN ? [`   and ${list.length - SHOWN} more`] : []);
   const out = [`${product} — roundup, ${dayOf(readAt)}`];
 
@@ -227,6 +244,33 @@ function render(view) {
     ...weeks.map((week) => `   week ${week.week} (${week.from} to ${week.to}): ${plural(week.merged, 'merge')} · ${plural(week.delivered, 'delivery')} · ${plural(week.new_items, 'new item')}`),
     `   waiting on you: ${plural(needRows.length, 'question')}${needRows.length ? `, oldest ${plural(oldest, 'day')}` : ''}`].join('\n'));
 
+  out.push(renderNumbers(numbers, more));
+
   if (repoErrors.length) out.push([`GitHub did not answer for ${plural(repoErrors.length, 'repo')}; parts 3 to 5 count from the graph only`, ...repoErrors.map((row) => oneLine(`   ${row.repo} — ${row.reason}`, ROW_LINE_MAX))].join('\n'));
   return out.join('\n\n');
 }
+
+// Part 6. A refused count reads "refused", never 0.
+const COLUMNS = [['merges', 'merges'], ['not_on_green', 'not on green'], ['reverts', 'reverts'], ['unchecked_test_changes', 'unchecked test changes'], ['reopens', 'reopens'], ['step_ins', 'step-ins'], ['owner_messages', 'owner messages'], ['platform_messages', 'platform messages']];
+const countsLine = (row) => COLUMNS.map(([key, word]) => `${row[key] === null ? 'refused' : row[key]} ${word}`).join(' · ');
+function renderNumbers(numbers, more) {
+  const out = [`6. The numbers, ${numbers.from} to ${numbers.to} (UTC)`];
+  if (!numbers.repos.length) out.push('   no repo is registered for this product');
+  for (const repo of numbers.repos) {
+    out.push(`   ${repo.repo}${repo.refused ? ` · GitHub counts refused: ${oneLine(repo.refused, 160)}` : ''}`);
+    out.push(`     total: ${countsLine(repo.total)}`);
+    for (const month of repo.months) out.push(`     ${month.month}${month.whole ? '' : ` (${month.from} to ${month.to})`}: ${countsLine(month)}`);
+    for (const week of repo.weeks) out.push(`     week ${week.week} (${week.from} to ${week.to}): ${countsLine(week)}`);
+    for (const row of (repo.not_on_green ?? []).slice(0, SHOWN)) out.push(listLine(`not on green: ${row.reasons.join('; ')}`, row.pr, '     '));
+    out.push(...more(repo.not_on_green ?? []));
+    for (const row of (repo.reverts ?? []).slice(0, SHOWN)) out.push(listLine(`revert: ${row.title}`, row.pr, '     '));
+  }
+  const median = numbers.median_days_to_live;
+  out.push(`   input to live: ${numbers.delivered.length} delivered ${numbers.delivered.length === 1 ? 'item' : 'items'}${median === null ? '' : `, median ${median} days`}`);
+  for (const row of numbers.delivered.slice(0, SHOWN)) out.push(listLine(row.title, `${row.item.slice(0, 8)} · ${row.days ?? '?'} days · live ${dayOf(row.live_at)}`, '     '));
+  out.push(...more(numbers.delivered));
+  out.push(`   owner acts: signed acts ${numbers.owner_acts.signed_acts}; unsigned merges ${numbers.owner_acts.audit_unsigned_merges}`);
+  if (numbers.not_counted_sessions) out.push(`   ${numbers.not_counted_sessions} sessions ran with the hooks off, so their messages were not counted`);
+  return out.join('\n');
+}
+

package/work/lib/step-ins.mjs

@@ -25,6 +25,9 @@ export const STEP_IN_READ_VERBS = Object.freeze(['step_ins']);
 // an answer replies to an open question.
 export const STEP_IN_CLASSES = Object.freeze([...OWNER_ONLY_CLASSES, 'brake', 'signed-act', 'answer']);
 export const STEP_IN_KIND = 'step-in';
+// Who sent a message, as the hook reads it (item f7391622). Only an owner
+// message can be a step-in.
+export const SENDERS = Object.freeze(['owner', 'platform']);
 export const NAME_KIND = 'step-in-name';
 const ROW_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const SESSION = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,199}$/;
@@ -48,7 +51,10 @@ export function parseRow(raw) {
   if (!ROW_ID.test(String(row.id ?? '')) || !SESSION.test(String(row.session ?? ''))) return null;
   if (typeof row.at !== 'string' || Number.isNaN(Date.parse(row.at))) return null;
   if (!Array.isArray(row.repos) || row.repos.length > 16 || !row.repos.every((repo) => typeof repo === 'string' && REPO.test(repo))) return null;
-  return { id: row.id, at: new Date(row.at).toISOString(), session: row.session, repos: [...row.repos] };
+  if (row.from !== undefined && !SENDERS.includes(row.from)) return null;
+  // A row from the hook of 0.4.8 has no sender. It reads as the owner's, as
+  // it did then.
+  return { id: row.id, at: new Date(row.at).toISOString(), session: row.session, repos: [...row.repos], from: row.from ?? 'owner' };
 }
 
 // Turn each row in the folder into a mark. Each row is claimed by a rename
@@ -101,9 +107,11 @@ export function createStepInVerbs(core) {
     if (prior) return prior;
     const product = await productOf(row.repos);
     return create(type, requestId, 'step_in_record', {
-      title: oneLine(`Step-in · ${row.repos.join(', ') || 'no repo'} · ${row.at}`, 200),
-      body: 'One message from the person. The hook keeps the time, the session and the repos; it never keeps the text.',
-      fields: { kind: STEP_IN_KIND, verdict: 'counted', item: '', product, marked_at: row.at, session: row.session, repos: row.repos, row: row.id, source: 'hook' },
+      title: oneLine(`Step-in · ${row.repos.join(', ') || 'no repo'} · ${row.at}${row.from === 'platform' ? ' · platform' : ''}`, 200),
+      body: row.from === 'platform'
+        ? 'One message that a platform sent to the session, such as a reminder or a relay. The hook keeps the time, the session and the repos; it never keeps the text. It is not a step-in.'
+        : 'One message from the person. The hook keeps the time, the session and the repos; it never keeps the text.',
+      fields: { kind: STEP_IN_KIND, verdict: 'counted', item: '', product, marked_at: row.at, session: row.session, repos: row.repos, row: row.id, source: 'hook', ...(row.from === 'platform' ? { from: 'platform' } : {}) },
       tags: ['atlas-mark', 'step-in', ...(product ? [`product:${product}`] : [])],
       readBack: false,
     });
@@ -128,14 +136,7 @@ export function createStepInVerbs(core) {
   // Every step-in mark with the newest name that corrects it.
   async function standing() {
     const type = await typeNamed('mark');
-    const rows = await client.listAllEntities({ type: type.name, state: 'active' });
-    const names = new Map();
-    for (const row of rows.filter((one) => one.fields?.kind === NAME_KIND)) {
-      const of = row.fields.corrects;
-      const held = names.get(of);
-      if (!held || String(row.fields.marked_at ?? '') > String(held.fields.marked_at ?? '')) names.set(of, row);
-    }
-    return rows.filter((one) => one.fields?.kind === STEP_IN_KIND).map((mark) => ({ mark, name: names.get(mark.id) ?? null }));
+    return standingOf(await client.listAllEntities({ type: type.name, state: 'active' }));
   }
 
   const verbs = {
@@ -189,11 +190,12 @@ export function createStepInVerbs(core) {
         .filter(({ mark }) => (!session || mark.fields.session === session) && (!since || String(mark.fields.marked_at) >= new Date(since).toISOString()))
         .sort((a, b) => String(b.mark.fields.marked_at).localeCompare(String(a.mark.fields.marked_at)));
       const shown = rows.slice(0, limit).map(({ mark, name }) => ({
-        step_in: mark.id, at: mark.fields.marked_at, session: mark.fields.session, repos: mark.fields.repos ?? [], verdict: mark.fields.verdict,
+        step_in: mark.id, at: mark.fields.marked_at, session: mark.fields.session, repos: mark.fields.repos ?? [], verdict: mark.fields.verdict, from: senderOfMark(mark),
         class: name?.fields?.class ?? null, lesson: name?.fields?.lesson ?? null, item: name?.fields?.item || null, named_by: name?.id ?? null,
       }));
-      const counted = rows.filter(({ mark, name }) => mark.fields.verdict === 'counted' && !name?.fields?.class).length;
-      return { verb: 'step_ins', total: rows.length, step_ins: counted, not_counted_sessions: rows.filter(({ mark }) => mark.fields.verdict === 'not counted').length, rows: shown };
+      const counted = rows.filter(isStepIn).length;
+      const platform = rows.filter(({ mark }) => mark.fields.verdict === 'counted' && senderOfMark(mark) === 'platform').length;
+      return { verb: 'step_ins', total: rows.length, step_ins: counted, platform_messages: platform, not_counted_sessions: rows.filter(({ mark }) => mark.fields.verdict === 'not counted').length, rows: shown };
     },
   };
 
@@ -208,6 +210,24 @@ export function createStepInVerbs(core) {
   return { verbs, record, notCounted };
 }
 
+// Each step-in mark of a list of marks, with the newest name that corrects
+// it. The numbers part of the roundup reads the same pairs.
+export function standingOf(rows) {
+  const names = new Map();
+  for (const row of rows.filter((one) => one.fields?.kind === NAME_KIND)) {
+    const of = row.fields.corrects;
+    const held = names.get(of);
+    if (!held || String(row.fields.marked_at ?? '') > String(held.fields.marked_at ?? '')) names.set(of, row);
+  }
+  return rows.filter((one) => one.fields?.kind === STEP_IN_KIND).map((mark) => ({ mark, name: names.get(mark.id) ?? null }));
+}
+
+// A mark from before item f7391622 has no sender: it reads as the owner's.
+export const senderOfMark = (mark) => (mark.fields?.from === 'platform' ? 'platform' : 'owner');
+// An owner message counts; a step-in is an owner message with no class.
+export const isOwnerMessage = ({ mark }) => mark.fields?.verdict === 'counted' && senderOfMark(mark) === 'owner';
+export const isStepIn = (pair) => isOwnerMessage(pair) && !pair.name?.fields?.class;
+
 // A lesson is a link: a pull request, a learnings entry, a page. Or the id
 // of a tracker record, such as the item the lesson became.
 function lessonOf(value) {

package/work/mcp.mjs

@@ -13,7 +13,7 @@
 // never reaches the server. In a Claude cloud session only, the server reads
 // the cloud environment's own ATLAS_ENGRAM variable first, which .mcp.json
 // passes on as ATLAS_ENGRAM_CLOUD. It reads them from nowhere else.
-import { execFileSync } from 'node:child_process';
+import { execFile, execFileSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { resolve, isAbsolute, dirname, join, delimiter } from 'node:path';
 import { existsSync, realpathSync, readFileSync, writeFileSync, mkdirSync, statSync, openSync, fstatSync, closeSync, constants as fsConstants } from 'node:fs';
@@ -69,7 +69,7 @@ export const TOOLS = [
   { name: 'item_reopen', description: `Reopen a delivered item: the lifecycle goes back to active and a reopen mark is appended, citing the failed check by URL. The delivery mark is never erased; the reopen points at it with the corrects relation. The owner, or the lead in this session, calls it. ${RULES}`, inputSchema: { type: 'object', required: ['request_id', 'item_id', 'reason', 'failed_check'], properties: { request_id: REQUEST_ID, item_id: S('Item id carrying at least one delivery mark.'), reason: S('Why it is reopened, in plain words.'), failed_check: S('Absolute URL of the check that failed: a CI run, a monitor, an issue.'), corrects: S('Mark id of the delivery this reopen corrects. Default: the item\'s latest delivery mark.') }, additionalProperties: false } },
   { name: 'in_flight', description: 'Answer "what are we working on, and what changed since a date?". Active items per product, ordered by the owner\'s current priority decision first, when it carries an order, then by days since the last change with the latest on top, and the days shown on each row. Each row says what the item waits on. Movement is read from the marks and from each registered repo\'s recent pull requests: the item\'s own pr links, plus any pull request whose title, body or branch names the item id. Merged pull requests with no delivery mark are listed as "merged, not marked". A legacy seal reads as a delivery mark with verdict "legacy". Computed at read time and never stored. Scope: read, no owner flag needed.', inputSchema: { type: 'object', properties: { product: S('Limit the view to one product id.'), since: S('ISO date. Adds what was delivered since then.') }, additionalProperties: false } },
   { name: 'needs_me', description: 'Answer "what needs me?": every open question on a proposed, active or paused item, per product, ordered by what waiting costs. A row on an item that is not active names its lifecycle. Each row is three lines, the question, the item and the cost, with the context folded under it. Computed at read time and never stored. Scope: read, no owner flag needed. Pass the row text back as rendered when the owner answers.', inputSchema: { type: 'object', properties: { product: S('Limit the view to one product id.') }, additionalProperties: false } },
-  { name: 'roundup', description: 'Answer "where does this product stand, and where is it going?" in five parts: 1 needs you (the needs_me read); 2 where we stand (items tagged stage-<n> in ladder order, a count of every item by lifecycle, and the active items); 3 what moved in the window (delivery marks, merged pull requests, new items); 4 stuck or drifting (active items with no change for 14 days, merged but not marked, open pull requests that name no item, questions waiting 14 days); 5 the trend per week for four weeks. Every row cites an item, a question or a pull request. Computed at read time and never stored. Scope: read, no owner flag needed.', inputSchema: { type: 'object', required: ['product'], properties: { product: S('Product id.'), days: { type: 'integer', minimum: 1, maximum: 90, description: 'The window for part 3, in days. Default 7.' } }, additionalProperties: false } },
+  { name: 'roundup', description: 'Answer "where does this product stand, and where is it going?" in five parts: 1 needs you (the needs_me read); 2 where we stand (items tagged stage-<n> in ladder order, a count of every item by lifecycle, and the active items); 3 what moved in the window (delivery marks, merged pull requests, new items); 4 stuck or drifting (active items with no change for 14 days, merged but not marked, open pull requests that name no item, questions waiting 14 days); 5 the trend per week for four weeks; 6 the numbers per repo, per week and per month (merges, merges not on green, reverts, reopens, unchecked test changes, step-ins, owner and platform messages) and the time from input to live of each delivered item, with the median. Part 6 reads every pull request of its period from GitHub; a count GitHub did not give reads refused, never 0. Every row cites an item, a question or a pull request. Computed at read time and never stored. Scope: read, no owner flag needed.', inputSchema: { type: 'object', required: ['product'], properties: { product: S('Product id.'), days: { type: 'integer', minimum: 1, maximum: 90, description: 'The window for part 3, in days. Default 7.' }, from: S('Part 6: the first UTC day, YYYY-MM-DD. Default: 28 days before the read.'), to: S('Part 6: the last UTC day, YYYY-MM-DD, counted. Default: the read. At most 92 days in all.') }, additionalProperties: false } },
   { name: 'code_read_brief', description: 'The brief for the sub-agents that read the code for "where are we with X", one per registered repo of the product. It carries the never-read and never-quote rules, the citation contract and the JSON shape of the digest. Give one brief to one sub-agent; sub-agents never receive this server or the Engram MCP. Pass each digest back in where_are_we.code. When: before answering "where are we with X". Scope: read, no owner flag needed; it opens no repo and writes nothing.', inputSchema: { type: 'object', required: ['product', 'capability'], properties: { product: S('Product registry id.'), capability: S('The capability to read for, the X of the question.'), repos: { type: 'array', description: 'Limit the briefs to these registered repo ids. Default: every repo of the product.', items: { type: 'string' } }, roots: { type: 'object', description: 'Repo id to the local checkout path the sub-agent reads.', additionalProperties: { type: 'string' } }, commits: { type: 'object', description: 'Repo id to the commit the read runs against.', additionalProperties: { type: 'string' } }, focus: { type: 'array', description: 'Extra things the read should look for.', items: { type: 'string' } } }, additionalProperties: false } },
   { name: 'where_are_we', description: 'Answer "where are we with X" in six parts: live support and known limits from the code read at question time, then in progress, delivered and proposed from the items, then the current priority decision. Every row carries a citation: a path and a line, an entity id, a pull request, or a decision date. The code half comes from the sub-agent digests, which are refused when they cite a never-read path or quote a never-quote path, and every string is scrubbed by pattern. Computed at read time and never stored. Scope: read, no owner flag needed.', inputSchema: { type: 'object', required: ['product', 'capability', 'code'], properties: { product: S('Product registry id.'), capability: S('The capability the question is about, the X.'), code: { type: 'array', description: 'One digest per repo, from the sub-agents briefed by code_read_brief. At least one is required: an answer with no code read says nothing about what the code does today.', items: CODE_DIGEST }, items: { type: 'array', description: 'Item ids the lead judges to answer this question.', items: { type: 'string' } }, match: { type: 'array', description: 'Terms to match against item titles, summaries and tags. Give items, match, or both.', items: { type: 'string' } }, movement_repos: { type: 'array', description: "Narrow the movement read to these registered repo ids. Default: every repo of the product. The digests' own repos are always read.", items: { type: 'string' } }, since: S('ISO date. Adds what changed since then.') }, additionalProperties: false } },
   { name: 'built_pending_possible', description: 'Answer "what are we building, what is built, what is pending and what can be done": delivered items by date, active items, paused items with their reason, proposed items with their age, and the decisions that set the order. Item records, delivery marks and decisions only; no code read and no GitHub read. Computed at read time and never stored. Scope: read, no owner flag needed.', inputSchema: { type: 'object', properties: { product: S('Limit the view to one product id.'), since: S('ISO date. Limits built and the decisions to what came after it.') }, additionalProperties: false } },
@@ -183,8 +183,12 @@ export function journalDirectory(env) {
   return directory;
 }
 
-function gh(args) {
-  return execFileSync('gh', args, { encoding: 'utf8', maxBuffer: 8 * 1024 * 1024, timeout: 30_000, stdio: ['pipe', 'pipe', 'pipe'], env: childEnvironment() });
+function ghAsync(args) {
+  return new Promise((done, fail) => {
+    execFile('gh', args, { encoding: 'utf8', maxBuffer: 8 * 1024 * 1024, timeout: 30_000, env: childEnvironment() }, (error, stdout, stderr) => {
+      if (error) { error.message = `${error.message}${stderr ? `: ${String(stderr).trim().split('\n')[0]}` : ''}`; fail(error); } else done(stdout);
+    });
+  });
 }
 
 // Every GitHub read the verbs may make, GET only and one shape per line. The
@@ -206,14 +210,19 @@ export const GITHUB_READS = Object.freeze([
   new RegExp(`^repos/${REPO}/contents/atlas\\.yaml\\?ref=(?:${SHA}|${BRANCH})$`),
   new RegExp(`^repos/${REPO}/releases\\?per_page=\\d{1,3}$`),
   new RegExp(`^repos/${REPO}/compare/${SHA}\\.\\.\\.${TAG}$`),
+  // Roadmap R16: the numbers page past 100 pull requests, and read the
+  // files of each merge to find a changed test.
+  new RegExp(`^repos/${REPO}/pulls\\?state=all&sort=updated&direction=desc&per_page=\\d{1,3}&page=\\d{1,3}$`),
+  new RegExp(`^repos/${REPO}/pulls/\\d{1,9}/files\\?per_page=\\d{1,3}&page=\\d{1,3}$`),
   // Roadmap R14 line 6: the newest run of the daily audit, for the roundup.
   new RegExp(`^repos/${REPO}/actions/workflows/atlas-jobs\\.yml/runs\\?per_page=\\d{1,3}$`),
 ]);
 export function githubReader() {
   return async (path) => {
     if (!GITHUB_READS.some((shape) => shape.test(path))) throw new Error(`this read is not on the allowlist: ${path}`);
-    // --method GET is explicit: the reader can never turn into a write.
-    return JSON.parse(gh(['api', '--method', 'GET', path]));
+    // --method GET is explicit: the reader can never turn into a write. It
+    // does not block, so the numbers (R16) can read several at a time.
+    return JSON.parse(await ghAsync(['api', '--method', 'GET', path]));
   };
 }