@cspeach/cli 1.1.29 → 1.1.31

package/dist/register/records.js

@@ -13,6 +13,7 @@ import path from 'node:path';
 import { classificationFromCcaDetail, fromCcaDetailKey, normalizeKey, normalizeRuleId, objectKey, } from '@cspeach/register-core';
 import { defaultRand, readBaseline } from './store.js';
 import { safeDetailRel, resolveDetailFileSync } from '../projects/detail-path.js';
+import { writeWhole } from './write-whole.js';
 const FIX_STATUSES = new Set(['fixed', 'skipped', 'failed', 'pending']);
 export function writeRecord(joined, recordType, rows, by, opts = {}) {
     const known = new Set(readBaseline(joined.projectDir).map((o) => objectKey(o.type, o.name)));
@@ -63,6 +64,30 @@ export function writeRecord(joined, recordType, rows, by, opts = {}) {
     }
     return { file, written: kept.length, refused };
 }
+/** `20261007T080000Z`: the ISO time without dashes, colons or milliseconds, as every record file name carries it. */
+export const fileStamp = (now) => now.toISOString().replace(/[-:]/g, '').replace(/\.\d+Z$/, 'Z');
+/**
+ * A record the LEAD writes into one of the lead's own folders (`plan/`,
+ * `baseline/`), whose rows may be empty — a plan header says everything in
+ * its header fields. The caller has already decided which rows belong; this
+ * only writes, whole then renamed. Never under `writers/`.
+ */
+export function writeLeadRecord(dir, projectId, recordType, header, rows, by, opts = {}) {
+    const now = opts.now ?? new Date();
+    const recordId = (opts.rand ?? defaultRand)(6);
+    const name = opts.fileName ? path.basename(opts.fileName) : `${fileStamp(now)}-${recordType}-${recordId.slice(0, 4)}.json`;
+    const file = path.join(dir, name);
+    const own = {
+        kind: 'record', formatVersion: 1, recordId, projectId, recordType,
+        at: now.toISOString(), by: { name: by.name, writer: by.writer },
+    };
+    // A header field never stands in for one of the record's own fields.
+    const extra = Object.fromEntries(Object.entries(header).filter(([k]) => !(k in own) && k !== 'rows'));
+    const record = { ...own, ...extra, rows: [...rows] };
+    writeWhole(file, `${JSON.stringify(record, null, 2)}
+`);
+    return { file, recordId };
+}
 /**
  * Decisions from a saved CCA assessment. The full list lives in the detail
  * file's `objects.json` (the envelope table stops at 50 rows), so that is read
@@ -137,6 +162,34 @@ export function fixRowsFromUpgradeProgress(content, baseline) {
     }
     return { rows, ambiguous };
 }
+/**
+ * Decision rows from a saved clean-core triage — CONFIRMED rows only (one Yes
+ * per row, clean-core-confirm.ts). The five words map onto the four
+ * classifications (spec §4.2); a fix or a rebuild with no target reaches A.
+ */
+export function decisionRowsFromCleanCore(content) {
+    const rows = [];
+    for (const r of content.adjudications ?? []) {
+        if (r?.confirmed !== true)
+            continue;
+        const moves = r.disposition === 'fix' || r.disposition === 'rebuild';
+        const base = r.disposition === 'keep' ? { classification: 'keep' }
+            : r.disposition === 'exception' ? { classification: 'keep', exception: true }
+                : r.disposition === 'fix' ? { classification: 'fix' }
+                    : r.disposition === 'rebuild' ? { classification: 'redesign' }
+                        : r.disposition === 'retire' ? { classification: 'retire' } : null;
+        if (!base)
+            continue;
+        const reason = typeof r.reason === 'string' ? r.reason.trim().slice(0, 300) : '';
+        rows.push({
+            key: objectKey(r.objectType, r.objectName), ...base,
+            ...(r.level ? { level: r.level } : {}),
+            ...(moves ? { targetLevel: r.targetLevel ?? 'A' } : {}),
+            ...(reason ? { reason } : {}),
+        });
+    }
+    return rows;
+}
 /**
  * Called after every successful envelope save. Does nothing unless this laptop
  * has joined a project; never throws (a record is a by-product, a save is not).
@@ -160,5 +213,9 @@ opts = {}) {
         const res = writeRecord(joined, 'fix', rows, by, { source, ...opts });
         return { ...res, refused: [...res.refused, ...ambiguous.map((n) => `${n} (name matches more than one object type)`)] };
     }
+    if (env.artefactType === 'clean-core-decision') {
+        const rows = decisionRowsFromCleanCore(env.content);
+        return writeRecord(joined, 'decision', rows, by, { source, ...opts });
+    }
     return null;
 }

package/dist/register/status-file/estate-parts.js

@@ -0,0 +1,168 @@
+// @ts-nocheck
+// GENERATED COPY — do not edit here. Edit viewer/src/lib/estate-parts.js,
+// then run `npx tsx scripts/sync-status-file.ts` (prebuild runs it too).
+// src/register/__tests__/status-file-pin.test.ts fails when this copy drifts.
+/**
+ * The estate: what custom code the system holds, before anyone splits it up.
+ *
+ * Drawn from register-core's `EstateSummary` (the newest discovery file, read
+ * the strict way) and nothing else, so the page, the status file and the
+ * workbook count the same packages. Two places wear it: the Estate section of
+ * a team project page, and the whole page of a folder the lead has run
+ * discovery into but not yet made a team project from.
+ *
+ * The same rules as every other part of this page: every value out of the
+ * folder goes through `cell()` (or `esc()` for our own words), colour is a
+ * class and never a style attribute, and a count is a count — "last change" is
+ * when the code was changed and is never called use.
+ */
+import { esc } from './register-map.js';
+import { cell, n } from './register-parts.js';
+import { formatWhen } from './register-model.js';
+import { findingsByPackage, plainDate, shortUsageWindow, usageWindowOf } from '@cspeach/register-core';
+export const NO_ESTATE = 'No estate inventory yet. The lead runs cspeach team discover.';
+/** A discovery file is there but is not one this build can read (another kind or version). */
+export const ESTATE_UNREADABLE = 'The estate inventory in this folder could not be read.';
+/** As many package rows as a reader scans before the table stops helping. */
+const PACKAGE_ROWS = 100;
+const numberTile = (label, value, note) => `<li class="tile"><span class="tile-n">${n(value)}</span> <span class="tile-label">${esc(label)}</span> <span class="tile-note">${esc(note)}</span></li>`;
+/**
+ * Whether runtime usage is recorded, in the tile's own short words. The source
+ * is not named on screen; the workbook's Usage sources sheet says which one.
+ * Only an ACTIVE source can say usage is recorded — empty, off and not read
+ * all mean nothing on this system records which programs run.
+ *
+ * A window under 90 days, or one that ended more than 90 days before the
+ * report, says so: it is too short (or too old) to say what is unused, and the
+ * tile must not read as if it could (rehearsal fix 2).
+ *
+ * @param {string} [reportAt] when the report was made; the inventory's own time when not given
+ */
+function usageWords(estate, reportAt) {
+    const active = (estate.usageSources ?? []).find((s) => s.state === 'active');
+    if (!active)
+        return 'none recorded on this system';
+    if (!active.period)
+        return 'recorded, period not stated';
+    const window = usageWindowOf(estate.usageSources);
+    const weak = window ? shortUsageWindow(window, reportAt || estate.takenAt || '') : null;
+    if (weak) {
+        const span = `${plainDate(window.from)} – ${plainDate(window.to)}`;
+        return weak.short
+            ? `only ${weak.days} days (${span}) — too short to say what is unused`
+            : `${weak.days} days (${span}), ended over 90 days ago — too old to say what is unused`;
+    }
+    return `recorded from ${active.period.from} to ${active.period.to}`;
+}
+function tilesHtml(estate, reportAt) {
+    const t = estate.totals ?? {};
+    return '<ul class="tiles estate-tiles" data-role="estate-tiles">'
+        + numberTile('Packages', t.packages ?? 0, 'with custom code')
+        + numberTile('Code objects', t.codeObjects ?? 0, 'programs, classes, function groups')
+        + numberTile('Non-code objects', t.nonCodeObjects ?? 0, 'tables, data elements and the rest')
+        + numberTile('Outside packages', t.local ?? 0, 'local objects, never transported')
+        + numberTile('Modifications of SAP objects', t.modifications ?? 0, t.noteCorrections ? `not counting ${n(t.noteCorrections)} note corrections` : 'changes to SAP\x27s own code')
+        + `<li class="tile tile-words"><span class="tile-text">${esc(usageWords(estate, reportAt))}</span> <span class="tile-label">Usage data</span> <span class="tile-note">which programs run</span></li>`
+        + '</ul>';
+}
+function unknownsHtml(estate) {
+    const list = estate.unknowns ?? [];
+    if (!list.length)
+        return '<div class="estate-unknowns" data-role="estate-unknowns"><h3>Unknowns</h3><p class="quiet-note">Nothing is unknown: every step of the inventory read.</p></div>';
+    return '<div class="estate-unknowns" data-role="estate-unknowns"><h3>Unknowns</h3><ul>'
+        + list.map((u) => `<li><b>${cell(u.what)}</b> — ${u.why ? cell(u.why) : '<span class="quiet-note">no reason recorded</span>'}</li>`).join('')
+        + '</ul></div>';
+}
+/**
+ * @param {Record<string, number>} [findings] open findings per package, over
+ *   the objects a check has measured (register-core `findingsByPackage`); a
+ *   package with none measured has no key and says so.
+ */
+function packagesHtml(estate, { inScope, findings }) {
+    const all = estate.packages ?? [];
+    const shown = all.slice(0, PACKAGE_ROWS);
+    const heads = ['Package', 'Area', 'Objects', ...(findings ? ['Open findings'] : []), 'Last change', ...(inScope ? ['In scope'] : [])]
+        .map((h) => `<th scope="col">${h}</th>`).join('');
+    const row = (p) => `<tr><td><span class="ident">${cell(p.name)}</span>${p.text ? ` <span class="quiet-note">${cell(p.text)}</span>` : ''}</td>`
+        + `<td>${cell(p.area)}</td><td>${n(p.objects)}</td>`
+        + (findings ? `<td>${Object.hasOwn(findings, p.name) ? n(findings[p.name]) : '<span class="quiet-note">not measured</span>'}</td>` : '')
+        + `<td>${p.lastChanged ? cell(p.lastChanged.at) : '<span class="quiet-note">not recorded</span>'}</td>`
+        + (inScope ? `<td>${p.inScope ? 'in scope' : '<span class="quiet-note">not in scope</span>'}</td>` : '')
+        + '</tr>';
+    const more = all.length - shown.length;
+    return `<div class="scroller"><table data-role="estate-packages" aria-label="Packages with custom code"><thead><tr>${heads}</tr></thead>`
+        + `<tbody>${shown.map(row).join('')}</tbody></table></div>`
+        + (more > 0 ? `<p class="quiet-note" data-role="estate-more">and ${n(more)} more</p>` : '');
+}
+/**
+ * Inside a team project the whole system is one line, not a table of every
+ * package on it (rehearsal fix 3): the project is what the page is about, and
+ * the inventory workbook holds the rest.
+ */
+function wholeSystemHtml(estate) {
+    const t = estate.totals ?? {};
+    return `<p class="estate-whole" data-role="estate-whole">Whole system: ${n(t.packages ?? 0)} package${t.packages === 1 ? '' : 's'}, `
+        + `${n(t.codeObjects ?? 0)} code object${t.codeObjects === 1 ? '' : 's'} — see the inventory (estate.xlsx in the discovery folder).</p>`;
+}
+/**
+ * The estate section's body.
+ *
+ * @param {object|null|undefined} estate register-core `EstateSummary`
+ * @param {{ inScope?: boolean, findings?: Record<string, number>, unreadable?: boolean, now?: string }} [opts]
+ *   `inScope` — drawn inside a team project: the whole system is one line and
+ *   the In scope line follows; the package table is the estate-only view's.
+ *   `unreadable` — a discovery file was found but could not be read, so the
+ *   empty sentence must not say there is none.
+ *   `now` — when the report was made, for the usage tile.
+ */
+export function estateHtml(estate, { inScope = false, findings, unreadable = false, now } = {}) {
+    if (!estate) {
+        return unreadable
+            ? `<p class="empty-note" data-role="no-estate">${ESTATE_UNREADABLE}</p>`
+            : `<p class="empty-note" data-role="no-estate">${NO_ESTATE}</p>`;
+    }
+    const scope = inScope && estate.inScope
+        ? `<p class="estate-scope" data-role="estate-in-scope">In scope: ${n(estate.inScope.packages)} package${estate.inScope.packages === 1 ? '' : 's'}, ${n(estate.inScope.objects)} object${estate.inScope.objects === 1 ? '' : 's'}</p>`
+        : '';
+    if (inScope)
+        return `${tilesHtml(estate, now)}${wholeSystemHtml(estate)}${scope}${unknownsHtml(estate)}`;
+    return `${tilesHtml(estate, now)}${scope}${unknownsHtml(estate)}${packagesHtml(estate, { inScope: false, findings })}`;
+}
+/**
+ * The Estate section's body inside a team project, as the page and the status
+ * file both draw it: open findings per package come from register-core, so the
+ * two surfaces never count them two ways.
+ * @param {object} register
+ * @param {{ fileGiven?: boolean, now?: string }} [opts] a discovery file was in the folder; when the report was made
+ */
+export function estateSectionHtml(register, { fileGiven = false, now } = {}) {
+    return estateHtml(register.estate, {
+        inScope: true, findings: findingsByPackage(register), unreadable: fileGiven && !register.estate, now,
+    });
+}
+/**
+ * The whole page for a folder that holds a discovery and no team project yet.
+ * It says what it is, who took it and when, and the one step that comes next.
+ */
+export function estateOnlyPageHtml(estate, folderName, now) {
+    const taken = estate?.takenAt ? `Taken ${esc(formatWhen(estate.takenAt))}${estate.by ? ` by ${cell(estate.by)}` : ''}.` : '';
+    return `
+    <header class="masthead">
+      <p class="provenance">Estate inventory, read from the folder ${cell(folderName)}.</p>
+      <h1>The custom code on this system</h1>
+      <p class="summary">${taken} No team project yet. The lead makes one from this inventory with cspeach team init --from-discovery.</p>
+      <p class="notice" data-role="reload-note" hidden></p>
+      <div class="actions">
+        <button type="button" data-action="reload" class="primary">Read the folder again</button>
+        <button type="button" data-action="print" class="quiet">Print or save as PDF</button>
+        <button type="button" data-action="change-folder" class="quiet">Open another folder</button>
+      </div>
+    </header>
+    <section data-role="estate" class="estate" aria-labelledby="team-estate-heading">
+      <h2 id="team-estate-heading">Estate</h2>
+      ${estateHtml(estate, { unreadable: !estate, now })}
+    </section>
+    <footer>
+      <p data-role="trust">This page reads the files in your folder and draws them here, in your browser. Your browser blocks it from sending anything to any other site. The inventory holds package names, object counts, SAP user ids and dates. No source code. No passwords.</p>
+    </footer>`;
+}

package/dist/register/status-file/plan-parts.js

@@ -0,0 +1,68 @@
+// @ts-nocheck
+// GENERATED COPY — do not edit here. Edit viewer/src/lib/plan-parts.js,
+// then run `npx tsx scripts/sync-status-file.ts` (prebuild runs it too).
+// src/register/__tests__/status-file-pin.test.ts fails when this copy drifts.
+/**
+ * Plan and changes (spec 2026-10-06 §9 item 8): how the working lists are
+ * ordered, and who changed that, when and why.
+ *
+ * Three things, read top to bottom: the priority weights in one line with where
+ * they came from; the focus stack in order, each with how much of it is done;
+ * and the change history, newest first, as register-core hands it. Shared by
+ * the page and the status file, so a manager reading either sees one plan.
+ *
+ * Every value out of the folder goes through `cell()`; our own words through
+ * `esc()`. No style attribute anywhere.
+ */
+import { esc } from './register-map.js';
+import { formatWhen } from './register-model.js';
+import { cell, dayWords, n, NO_FOCUS } from './register-parts.js';
+import { DEFAULT_WEIGHTS } from '@cspeach/register-core';
+export const NOTHING_REPLANNED = 'Nothing has been re-planned. Lists follow the suggested order.';
+/** How many changes are listed before the rest is counted. */
+export const HISTORY_ROWS = 50;
+const PARTS = ['effort', 'risk', 'shared', 'usage', 'disposition'];
+const whole = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : 0);
+function weightsHtml(plan) {
+    const w = plan?.weights ?? DEFAULT_WEIGHTS;
+    const source = plan?.weightsFrom === 'set'
+        ? (() => {
+            const day = dayWords(plan.weightsAt);
+            return `Set${plan.weightsBy ? ` by ${cell(plan.weightsBy)}` : ''}${day ? ` on ${esc(day)}` : ''}.`;
+        })()
+        : 'The default weights.';
+    return `<p class="plan-weights" data-role="weights">Priority weights: ${PARTS.map((p) => `${p} ${n(whole(w[p]))}`).join(', ')}. ${source}</p>`;
+}
+function focusStackHtml(focuses) {
+    if (!focuses.length)
+        return `<p class="quiet-note" data-role="no-focus">${esc(NO_FOCUS)}</p>`;
+    const item = (f) => {
+        const day = dayWords(f.at);
+        return `<li>${cell(f.label)} — ${n(whole(f.donePct))}% done, ${n(whole(f.proven))} of ${n(whole(f.active))} proven. `
+            + `Set by ${cell(f.by)}${day ? ` on ${esc(day)}` : ''}${f.reason ? ` because ${cell(f.reason)}` : ''}.</li>`;
+    };
+    return `<h3>The focus, in order</h3><ol class="focus-stack" data-role="focus-stack">${focuses.map(item).join('')}</ol>`;
+}
+function historyHtml(history) {
+    const shown = history.slice(0, HISTORY_ROWS);
+    const row = (c) => `<tr><td>${esc(formatWhen(c.at))}</td><td>${cell(c.by)}</td><td class="what">${cell(c.what)}</td>`
+        + `<td class="what">${c.why ? cell(c.why) : '<span class="quiet-note">no reason recorded</span>'}</td></tr>`;
+    const more = history.length - shown.length;
+    return '<h3>Changes, newest first</h3>'
+        + '<div class="scroller"><table data-role="plan-history" aria-label="Plan changes, newest first"><thead><tr>'
+        + '<th scope="col">When</th><th scope="col">Who</th><th scope="col">What</th><th scope="col">Why</th></tr></thead>'
+        + `<tbody>${shown.map(row).join('')}</tbody></table></div>`
+        + (more > 0 ? `<p class="quiet-note" data-role="plan-more">and ${n(more)} more</p>` : '');
+}
+/**
+ * The Plan and changes section's body.
+ * @param {object} register register-core `Register` (an older one with no `plan` reads as not re-planned)
+ * @returns {string} escaped markup
+ */
+export function planSectionHtml(register) {
+    const plan = register?.plan;
+    const history = Array.isArray(plan?.history) ? plan.history : [];
+    if (!history.length)
+        return `${weightsHtml(plan)}<p class="empty-note" data-role="plan-empty">${NOTHING_REPLANNED}</p>`;
+    return weightsHtml(plan) + focusStackHtml(Array.isArray(plan.focuses) ? plan.focuses : []) + historyHtml(history);
+}

package/dist/register/status-file/progress-chart.js

@@ -0,0 +1,110 @@
+// @ts-nocheck
+// GENERATED COPY — do not edit here. Edit viewer/src/lib/progress-chart.js,
+// then run `npx tsx scripts/sync-status-file.ts` (prebuild runs it too).
+// src/register/__tests__/status-file-pin.test.ts fails when this copy drifts.
+/**
+ * Progress over time (spec 2026-10-06 §9 item 5).
+ *
+ * One small line chart a manager reads in one look: how many objects are
+ * decided, claimed, proven, and at level A, one point per check run. Drawn from
+ * register-core's `progress` series and nothing else, so the page, the status
+ * file and the workbook's Progress sheet all show the same counts.
+ *
+ * It lives under the page's strict policy and inside a mailed document, so it
+ * is plain inline SVG: no reference to anything outside itself, no style
+ * attribute (every colour and dash is a class in team.css), and every string
+ * escaped. Colour never stands alone: each line has its own dash, and the
+ * legend says the numbers in words.
+ *
+ * Under the chart, the done-% bars per lane and per focus — the same numbers
+ * the lane table and the focus line print. Bar widths are classes in 5 % steps
+ * (`w-0` … `w-100`), because a width written into the markup would be a style.
+ */
+import { esc } from './register-map.js';
+import { cell, dayWords, n, ownerLabel } from './register-parts.js';
+export const NO_RUN_YET = 'No check run yet, so there is no line to draw.';
+/** Back to front, so the line that matters most — proven — is drawn over the others. */
+const SERIES = [
+    { id: 'decided', label: 'Decided', of: (p) => p.decided },
+    { id: 'claimed', label: 'Claimed', of: (p) => p.claimed },
+    { id: 'proven', label: 'Proven', of: (p) => p.proven },
+    { id: 'a', label: 'At level A', of: (p) => p.aNow },
+];
+const num = (v) => (typeof v === 'number' && Number.isFinite(v) && v >= 0 ? v : 0);
+const fix = (v) => Number(v.toFixed(1));
+/** The width class for a percentage: nearest 5 % step, kept within 0 and 100. */
+export function pctClass(pct) {
+    const v = Number(pct);
+    if (!Number.isFinite(v) || v <= 0)
+        return 'w-0';
+    return `w-${Math.min(100, Math.round(v / 5) * 5)}`;
+}
+function legendHtml(points) {
+    const first = points[0];
+    const last = points[points.length - 1];
+    const was = (s) => (points.length > 1 ? ` (${n(num(s.of(first)))} at the first run shown)` : '');
+    const item = (s) => {
+        const value = s.id === 'a' ? `${n(num(last.aNow))}, ${n(num(last.aShare))}% of active` : n(num(s.of(last)));
+        return `<li><span class="key key-${s.id}"></span>${esc(s.label)}: ${value}${was(s)}</li>`;
+    };
+    return `<ul class="chart-legend" data-role="progress-legend">${SERIES.map(item).join('')}</ul>`;
+}
+/**
+ * The chart as one figure: the SVG, the legend in words, what a point is, and —
+ * when register-core cut the series — how many runs are not shown.
+ *
+ * @param {object[]} points register-core `ProgressPoint[]`, oldest first
+ * @param {{ width?: number, height?: number, capped?: { shown: number, total: number } }} [opts]
+ * @returns {string} escaped markup
+ */
+export function progressChartSvg(points, { width = 640, height = 220, capped } = {}) {
+    if (!Array.isArray(points) || !points.length)
+        return `<p class="empty-note" data-role="no-progress">${NO_RUN_YET}</p>`;
+    const left = 44;
+    const right = 12;
+    const top = 12;
+    const bottom = 28;
+    const plotW = width - left - right;
+    const plotH = height - top - bottom;
+    const max = Math.max(1, ...points.map((p) => Math.max(num(p.active), ...SERIES.map((s) => num(s.of(p))))));
+    const x = (i) => fix(points.length === 1 ? left + plotW / 2 : left + (plotW * i) / (points.length - 1));
+    const y = (v) => fix(top + plotH - (plotH * num(v)) / max);
+    const ticks = [...new Set([0, max >= 4 ? Math.round(max / 2) : null, max].filter((t) => t !== null))];
+    const grid = ticks.map((t) => `<line class="grid" x1="${left}" x2="${width - right}" y1="${y(t)}" y2="${y(t)}"></line>`
+        + `<text class="axis" x="${left - 6}" y="${fix(y(t) + 4)}" text-anchor="end">${esc(n(t))}</text>`).join('');
+    const firstDay = dayWords(points[0].at);
+    const lastDay = dayWords(points[points.length - 1].at);
+    const base = height - 8;
+    const xLabels = points.length === 1
+        ? `<text class="axis" x="${x(0)}" y="${base}" text-anchor="middle">${esc(firstDay)}</text>`
+        : `<text class="axis" x="${left}" y="${base}" text-anchor="start">${esc(firstDay)}</text>`
+            + (lastDay && lastDay !== firstDay ? `<text class="axis" x="${width - right}" y="${base}" text-anchor="end">${esc(lastDay)}</text>` : '');
+    const lines = SERIES.map((s) => `<polyline class="pl pl-${s.id}" points="${points.map((p, i) => `${x(i)},${y(s.of(p))}`).join(' ')}"></polyline>`).join('');
+    // One run is a point, not a line: a polyline with one vertex draws nothing.
+    const dots = points.length === 1 ? SERIES.map((s) => `<circle class="pd pd-${s.id}" cx="${x(0)}" cy="${y(s.of(points[0]))}" r="3.5"></circle>`).join('') : '';
+    const last = points[points.length - 1];
+    const label = `Progress over time, ${points.length} point${points.length === 1 ? '' : 's'}: `
+        + SERIES.map((s) => `${s.label} ${num(s.of(last))}`).join(', ');
+    return '<figure class="progress-chart" data-role="progress-chart">'
+        + `<svg viewBox="0 0 ${width} ${height}" role="img" aria-label="${esc(label)}">${grid}${lines}${dots}${xLabels}</svg>`
+        + `<figcaption>${legendHtml(points)}`
+        + '<p class="legend-line">Each point is a check run, oldest on the left. The A line counts the objects at level A. Lanes, scope and the focus are counted as they are now.</p>'
+        + (capped ? `<p class="legend-line" data-role="progress-capped">Showing the last ${n(num(capped.shown))} of ${n(num(capped.total))} check runs.</p>` : '')
+        + '</figcaption></figure>';
+}
+const barRow = (label, pct, proven, active, extra = '') => `<li><span class="pct-label">${label}</span> `
+    + `<span class="pct-bar"><span class="pct-fill${extra} ${pctClass(pct)}"></span></span>`
+    + `<span class="pct-n">${n(num(pct))}% · ${n(num(proven))} of ${n(num(active))} proven</span></li>`;
+/** How far each lane and each focus is now, as bars with the numbers beside them. */
+function doneBarsHtml(register) {
+    const lanes = (register.lanes ?? []).map((l) => barRow(cell(ownerLabel(l)), l.donePct, l.proven, l.active));
+    const focuses = (register.plan?.focuses ?? []).map((f) => barRow(`Focus: ${cell(f.label)}`, f.donePct, f.proven, f.active, ' f-focus'));
+    if (!lanes.length && !focuses.length)
+        return '';
+    return '<h3>Done now, per developer and focus</h3>'
+        + `<ul class="pct-bars" data-role="done-bars">${[...lanes, ...focuses].join('')}</ul>`;
+}
+/** The Progress over time section's body, as the page and the status file both draw it. */
+export function progressSectionHtml(register) {
+    return progressChartSvg(register.progress, { capped: register.progressCapped }) + doneBarsHtml(register);
+}

package/dist/register/status-file/register-map.js

@@ -0,0 +1,221 @@
+// @ts-nocheck
+// GENERATED COPY — do not edit here. Edit viewer/src/lib/register-map.js,
+// then run `npx tsx scripts/sync-status-file.ts` (prebuild runs it too).
+// src/register/__tests__/status-file-pin.test.ts fails when this copy drifts.
+/**
+ * The map: one block per package, one cell per object, colour = state.
+ *
+ * Strings, not DOM, for two reasons: the status file is a document with no
+ * script in it and needs the same picture as text; and 20,000 cells arrive in
+ * one innerHTML assignment rather than 20,000 createElement calls.
+ *
+ * Colour is a CSS class (`s-verified`), never a style attribute: the page's
+ * Content-Security-Policy forbids inline styles, and the status file and the
+ * page then share one stylesheet.
+ */
+import { STATE_ORDER, STATE_LABEL, FROM_FILE, NOT_MENTIONED, NOT_REPORTED } from './register-model.js';
+const ENTITIES = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' };
+/**
+ * The one escaping function for the whole page. Object, package, lane and
+ * person names all come from a shared folder and are untrusted text.
+ * The two quote characters are written as `\x22` and `\x27`. They are the same
+ * characters, and a quote inside a regex literal blinds the word scanner that
+ * reads these files (`team-words.test.js`): it knows strings and comments but
+ * not regexes, so one `"` here flips text and code around for the rest of the
+ * file and the guard goes quiet. Leave them escaped.
+ *
+ * @param {unknown} value
+ * @returns {string}
+ */
+export function esc(value) {
+    return value == null ? '' : String(value).replace(/[&<>\x22\x27]/g, (c) => ENTITIES[c]);
+}
+/**
+ * The class for a state. The states are a closed set: an unknown or hostile
+ * state becomes `s-unknown`, never a raw value, because `class` is
+ * space-separated and escaping does not neutralise a space — a state of
+ * "clean hidden" would otherwise add the class `hidden` and hide the cell.
+ * @param {unknown} state
+ * @returns {string}
+ */
+export function stateClass(state) {
+    return `s-${Object.hasOwn(STATE_LABEL, state) ? state : 'unknown'}`;
+}
+/**
+ * The words for a state, from the same closed set: an unknown state — or an
+ * inherited property name like "constructor" — reads "Unknown".
+ * @param {unknown} state
+ * @returns {string}
+ */
+export function stateLabel(state) {
+    return Object.hasOwn(STATE_LABEL, state) ? STATE_LABEL[state] : 'Unknown';
+}
+/**
+ * The newest measurement this object's colour was actually read from.
+ *
+ * `counted` is register-core's own answer to "did this run move the state", so
+ * the view never works that rule out a second time. Walking backwards stops at
+ * the first counted one, which on a real object is the last entry.
+ */
+function drivingNewest(o) {
+    const all = o?.measurements;
+    if (!Array.isArray(all))
+        return null;
+    for (let i = all.length - 1; i >= 0; i -= 1)
+        if (all[i]?.counted)
+            return all[i];
+    return null;
+}
+/**
+ * The words for an object's colour, with what that colour rests on.
+ *
+ * Three strengths, and only the two PROVEN states can carry the weaker two —
+ * "Did not hold, measured from a file" would be labelling a problem with how it
+ * was found. A colour read from a system run says nothing extra; one read from
+ * a file says so; and one that rests on SILENCE — nothing mentioned the object
+ * and it was counted clean anyway — says that instead, because nothing measured
+ * it at all.
+ *
+ * Whose silence it was follows the BASIS the state was read from: a file that
+ * did not mention it, or a check run that did not report it. Saying "in a file"
+ * of a live run would send a manager looking for an export that does not exist.
+ *
+ * It lives here, beside `stateLabel`, because the map's cells need it too: the
+ * `<title>` is the only thing a hover, a screen reader on the roving cell, and
+ * the status file's picture ever say about an object, and a file-backed "Clean"
+ * there would be the one place the label went missing.
+ *
+ * @param {{ state: string, measuredBasis?: string|null, measurements?: object[] }} o
+ * @returns {string}
+ */
+export function stateWord(o) {
+    const label = stateLabel(o?.state);
+    if (o?.state !== 'verified' && o?.state !== 'clean')
+        return label;
+    const fromFile = o.measuredBasis === 'file';
+    if (drivingNewest(o)?.evidence === 'absent')
+        return `${label} — ${fromFile ? NOT_MENTIONED : NOT_REPORTED}`;
+    return fromFile ? `${label} — ${FROM_FILE}` : label;
+}
+/**
+ * Wider than tall (reads like a block of text), and bounded so one huge
+ * package cannot run off the page. Nonsense in (NaN, negative) gives the
+ * smallest map rather than a NaN-sized picture.
+ * @param {number} count
+ * @returns {number}
+ */
+export function mapColumns(count) {
+    return Math.max(8, Math.min(60, Math.ceil(Math.sqrt(Math.max(0, count || 0)) * 1.6)));
+}
+/** The four clean-core levels. Anything else (absent, or a word this build does not know) is "not decided". */
+const LEVEL_SET = new Set(['A', 'B', 'C', 'D']);
+/** The five level buckets, in order, and their words: one table for the map, the legend and the bars. */
+export const LEVEL_BUCKETS = ['A', 'B', 'C', 'D', 'none'];
+export const LEVEL_WORD = { A: 'A', B: 'B', C: 'C', D: 'D', none: 'not decided' };
+/**
+ * The class for a level, from a closed set like the states: a hostile
+ * `levelNow` can never write a second class into the cell.
+ * @param {unknown} l
+ * @returns {string}
+ */
+export const levelClass = (l) => `l-${LEVEL_SET.has(l) ? l : 'none'}`;
+/** The only two roles a block may carry, so `role` can never be written into. */
+const BLOCK_ROLES = new Set(['group', 'img']);
+/**
+ * One package block as a single `<svg>` string.
+ * @param {{ package: string, objects: Array<{ key: string, type: string, name: string, state: string }> }} block
+ * `colourBy: 'level'` colours each cell by the level it stands at now
+ * (`levelNow`) instead of its state, and the title names that level. The state
+ * stays in the title either way.
+ * @param {{ cell?: number, gap?: number, role?: 'group'|'img', colourBy?: 'state'|'level' }} [opts]
+ * @returns {string}
+ */
+export function blockSvg(block, { cell = 10, gap = 2, role = 'group', colourBy = 'state' } = {}) {
+    // `group` by default: an image's children are presentational, and the page
+    // makes each cell something a reader can land on and open. `img` would hide
+    // every one of them from a screen reader.
+    //
+    // The status file asks for `img`, and is right to: it carries no script, so
+    // nothing there can open a cell, and a screen reader would otherwise be
+    // handed tens of thousands of shapes that do nothing. The set is closed, like
+    // the states — `role` is an attribute, and a caller must not be able to write
+    // a second one after it.
+    const safeRole = BLOCK_ROLES.has(role) ? role : 'group';
+    const n = block.objects.length;
+    const cols = mapColumns(n);
+    const rows = Math.max(1, Math.ceil(n / cols));
+    const step = cell + gap;
+    const width = cols * step - gap;
+    const height = rows * step - gap;
+    // `data-key` is how the page finds the object behind a cell that was clicked.
+    // A picture has no clicks, so in `img` mode it is 30 dead bytes per cell — on
+    // a 20,000-object project, most of a megabyte in a file somebody has to mail.
+    // The per-cell `<title>` stays either way: hovering a cell to read the name is
+    // worth its bytes in a document nobody can search any other way.
+    const keyed = safeRole !== 'img';
+    const byLevel = colourBy === 'level';
+    const rects = block.objects.map((o, i) => {
+        const x = (i % cols) * step;
+        const y = Math.floor(i / cols) * step;
+        // A retired object keeps its state colour in level mode: the level counts
+        // leave retired objects out, and a cell painted C that no count includes
+        // would show a manager two numbers for one folder.
+        //
+        // A clean (or verified) object nobody decided has no level and nothing to
+        // decide: it keeps its state colour too, and its title says so — never
+        // "level not decided" (register-core leaves it out of the level counts).
+        const nothing = byLevel && o.inScope !== false && !o.decision && !LEVEL_SET.has(o.levelNow) && (o.state === 'clean' || o.state === 'verified');
+        const asLevel = byLevel && o.state !== 'retired' && !nothing;
+        return `<rect class="cell ${asLevel ? levelClass(o.levelNow) : stateClass(o.state)}"${keyed ? ` data-key="${esc(o.key)}"` : ''} x="${x}" y="${y}" width="${cell}" height="${cell}" rx="2">`
+            + `<title>${esc(o.name)} · ${esc(o.type)}${asLevel ? ` · level ${esc(LEVEL_WORD[LEVEL_SET.has(o.levelNow) ? o.levelNow : 'none'])}` : nothing ? ' · clean, nothing to decide' : ''} · ${esc(stateWord(o))}</title></rect>`;
+    }).join('');
+    const label = `${block.package}: ${n.toLocaleString('en-US')} ${n === 1 ? 'object' : 'objects'}`;
+    return `<svg class="block-map" role="${safeRole}" aria-label="${esc(label)}" width="${width}" height="${height}" viewBox="0 0 ${width} ${height}">${rects}</svg>`;
+}
+/**
+ * The key to the colours: only the states that occur, worst first, with counts.
+ *
+ * `unknown` is the tenth colour, and it is not a state. A cell drawn in it
+ * holds something this build has no word for, and it is meant to look wrong —
+ * so the legend names it and counts it rather than leaving a mark on the map
+ * that nothing in the key accounts for.
+ *
+ * @param {Record<string, number>} byState
+ * @param {{ unknown?: number }} [opts]
+ * @returns {string}
+ */
+export function legendHtml(byState, { unknown = 0 } = {}) {
+    const entry = (cls, label, count) => `<li><span class="swatch ${cls}"></span>${esc(label)} <b>${esc(count.toLocaleString('en-US'))}</b></li>`;
+    const items = STATE_ORDER.filter((s) => (byState[s] ?? 0) > 0)
+        .map((s) => entry(stateClass(s), stateLabel(s), byState[s]));
+    if (unknown > 0)
+        items.push(entry(stateClass('unknown'), stateLabel('unknown'), unknown));
+    return `<ul class="legend">${items.join('')}</ul>`;
+}
+/**
+ * The key to the level colours: always all five, D included, with counts —
+ * or, for a folder from an older build with no level counts, one line saying so.
+ *
+ * The counts are register-core's own (`totals.byLevel.now`), never recounted
+ * here, so the legend and the "Levels now" bar are one number. Retired objects
+ * are outside those counts and drawn in their state colour, so they get their
+ * own entry when there are any.
+ *
+ * @param {Record<string, number>} counts  `totals.byLevel.now`
+ * @param {{ retired?: number }} [opts]
+ * @returns {string}
+ */
+export function levelLegendHtml(counts, { retired = 0, nothingToDecide = 0 } = {}) {
+    const entry = (cls, label, count) => `<li><span class="swatch ${cls}"></span>${esc(label)} <b>${esc((count ?? 0).toLocaleString('en-US'))}</b></li>`;
+    // A folder from an older build has no level counts: say so, as the level bars
+    // do, rather than print five zeros that read as "measured, nothing there".
+    const items = counts
+        ? LEVEL_BUCKETS.map((l) => entry(`l-${l}`, LEVEL_WORD[l], counts[l]))
+        : ['<li>No levels recorded yet.</li>'];
+    // Drawn in the clean colour, the colour their cells keep (blockSvg).
+    if (counts && nothingToDecide > 0)
+        items.push(entry(stateClass('clean'), 'clean, nothing to decide', nothingToDecide));
+    if (retired > 0)
+        items.push(entry(stateClass('retired'), 'retired', retired));
+    return `<ul class="legend">${items.join('')}</ul>`;
+}