@decohere/ci-tools 0.0.1-dev.19 → 0.0.1-dev.20261105.103

package/src/pages/restore-bench-history.mjs

@@ -1,37 +1,24 @@
 #!/usr/bin/env node
 
-// Restore benchmark history from Pages, or initialize empty if not found
+// Restore benchmark history from Pages. Only a 404 (never published, or cleared) starts an
+// empty history: any other failure stops the job, so a network blip can't wipe the trend on
+// the next save.
 
-import { execSync } from "node:child_process";
-import { writeFileSync } from "node:fs";
-import { mkdir } from "node:fs/promises";
+import { mkdir, writeFile } from "node:fs/promises";
 
 const HISTORY_DIR = "projects/ci-tools/dist/ci/bench";
 const HISTORY_FILE = `${HISTORY_DIR}/bench-history.json`;
-const PAGES_URL = "https://typesmiths.github.io/decohere/data/bench-history.json";
+const PAGES_URL = process.env.PAGES_URL ?? "https://typesmiths.github.io/decohere";
 
-try {
-	await mkdir(HISTORY_DIR, { recursive: true });
-
-	try {
-		execSync(`curl -fsSL "${PAGES_URL}" -o "${HISTORY_FILE}"`, {
-			stdio: "pipe",
-		});
-		console.log("✓ Restored benchmark history from Pages");
-	} catch {
-		console.log("No benchmark history on Pages; starting from empty history");
-		writeFileSync(
-			HISTORY_FILE,
-			JSON.stringify(
-				{
-					runs: {},
-				},
-				null,
-				2,
-			),
-		);
-	}
-} catch (error) {
-	console.error("Error restoring benchmark history:", error.message);
+await mkdir(HISTORY_DIR, { recursive: true });
+const response = await fetch(`${PAGES_URL}/data/bench-history.json`);
+if (response.status === 404) {
+	console.log("No benchmark history on Pages; starting from empty history");
+	await writeFile(HISTORY_FILE, `${JSON.stringify({ version: 2, contexts: {} }, null, 2)}\n`);
+} else if (!response.ok) {
+	console.error(`Failed to restore benchmark history: HTTP ${response.status}`);
 	process.exit(1);
+} else {
+	await writeFile(HISTORY_FILE, await response.text());
+	console.log("✓ Restored benchmark history from Pages");
 }

package/src/release/npm-links.mjs

@@ -4,8 +4,9 @@
  * Outputs markdown formatted links for GitHub release notes
  */
 
-import { readdirSync, readFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { listProjectDirs } from "../lib/workspace-packages.mjs";
 
 const VERSION = process.argv[2] || process.env.VERSION;
 
@@ -15,20 +16,12 @@ if (!VERSION) {
 }
 
 let links = "## Published Packages\n\n";
-const projectsDir = join(process.cwd(), "projects");
 
 try {
-	const projects = readdirSync(projectsDir);
-
-	for (const project of projects) {
-		const pkgPath = join(projectsDir, project, "package.json");
-		try {
-			const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
-			if (pkg.name?.startsWith("@decohere/")) {
-				links += `- [\`${pkg.name}@${VERSION}\`](https://www.npmjs.com/package/${pkg.name}/v/${VERSION})\n`;
-			}
-		} catch {
-			// Skip projects without package.json
+	for (const projectDir of listProjectDirs(process.cwd())) {
+		const pkg = JSON.parse(readFileSync(join(projectDir, "package.json"), "utf8"));
+		if (pkg.name?.startsWith("@decohere/")) {
+			links += `- [\`${pkg.name}@${VERSION}\`](https://www.npmjs.com/package/${pkg.name}/v/${VERSION})\n`;
 		}
 	}
 

package/src/release/promote-latest.mjs

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+/**
+ * Points npm's `latest` tag at a version on every public @decohere package. Run by
+ * `promote-latest.yml`, which authenticates over OIDC.
+ *
+ * Refuses a version that isn't on every package, has no `v*` tag (a version only gets one once it
+ * passed CI and fully shipped), or is under a day old, unless `allowYoung` is set: current pnpm
+ * skips versions that new and would install an older one. Safe to re-run: packages already there
+ * are skipped.
+ */
+import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { listPublishablePackages } from "../github/publish-verify.mjs";
+
+const ONE_DAY_MS = 24 * 60 * 60 * 1000;
+const LAUNCH_PACKAGE = "@decohere/cli";
+
+/** @typedef {{ status: number | null, stdout: string }} RunResult */
+
+/**
+ * @param {{
+ *   version?: string,
+ *   allowYoung?: boolean,
+ *   packages: string[],
+ *   run: (command: string, args: string[]) => RunResult,
+ *   now?: () => number,
+ *   log?: (message: string) => void,
+ * }} options
+ * @returns {number} exit code
+ */
+export function promoteLatest(options) {
+	const { packages, run, allowYoung = false } = options;
+	const now = options.now ?? Date.now;
+	const log = options.log ?? console.log;
+	const npm = (...args) => run("npm", args);
+
+	const version =
+		options.version?.trim() || npm("view", LAUNCH_PACKAGE, "dist-tags.dev").stdout.trim();
+	if (!version) {
+		log(`Could not read the dev tag of ${LAUNCH_PACKAGE}. Nothing moved.`);
+		return 1;
+	}
+	log(`Promoting ${version} to latest on ${packages.length} packages`);
+
+	const tag = run("git", ["tag", "--list", `v${version}`]).stdout.trim();
+	if (tag !== `v${version}`) {
+		log(`${version} has no v${version} tag, so it didn't fully ship. Nothing moved.`);
+		return 1;
+	}
+
+	const missing = packages.filter(
+		(name) => npm("view", `${name}@${version}`, "version").stdout.trim() !== version,
+	);
+	if (missing.length > 0) {
+		log(`Not on npm at ${version}: ${missing.join(", ")}. Nothing moved.`);
+		return 1;
+	}
+
+	if (!allowYoung) {
+		const published = Date.parse(
+			npm("view", `${LAUNCH_PACKAGE}@${version}`, "time", "--json").stdout.match(
+				new RegExp(`"${version.replaceAll(".", "\\.")}":\\s*"([^"]+)"`),
+			)?.[1] ?? "",
+		);
+		if (Number.isNaN(published)) {
+			log(`Could not read when ${version} was published. Nothing moved.`);
+			return 1;
+		}
+		const hours = (now() - published) / (60 * 60 * 1000);
+		if (now() - published < ONE_DAY_MS) {
+			log(
+				`${version} is ${hours.toFixed(1)} hours old. Current pnpm skips versions under a day old ` +
+					"and would install an older one. Wait, or run with allow_young. Nothing moved.",
+			);
+			return 1;
+		}
+	}
+
+	/** `npm dist-tag ls` reads fresh; `npm view` can lag for a minute or so after a move. */
+	const onLatest = (name) => {
+		const line = npm("dist-tag", "ls", name)
+			.stdout.split("\n")
+			.find((entry) => entry.startsWith("latest:"));
+		return line?.slice("latest:".length).trim() === version;
+	};
+
+	const failed = [];
+	for (const name of packages) {
+		if (onLatest(name)) {
+			log(`already there: ${name}`);
+			continue;
+		}
+		if (npm("dist-tag", "add", `${name}@${version}`, "latest").status !== 0) failed.push(name);
+	}
+
+	const wrong = packages.filter((name) => !failed.includes(name) && !onLatest(name));
+	if (failed.length > 0 || wrong.length > 0) {
+		log(`Failed to move: ${[...failed, ...wrong].join(", ")}. Run it again to finish.`);
+		return 1;
+	}
+	log(`latest is now ${version} on all ${packages.length} packages`);
+	return 0;
+}
+
+if (process.argv[1] != null && import.meta.url === pathToFileURL(process.argv[1]).href) {
+	const packages = listPublishablePackages(resolve(".")).map((pkg) => pkg.name);
+	process.exit(
+		promoteLatest({
+			version: process.env.PROMOTE_VERSION,
+			allowYoung: process.env.PROMOTE_ALLOW_YOUNG === "true",
+			packages,
+			run: (command, args) => {
+				const result = spawnSync(command, args, {
+					encoding: "utf8",
+					stdio: ["ignore", "pipe", "inherit"],
+				});
+				return { status: result.status, stdout: result.stdout ?? "" };
+			},
+		}),
+	);
+}

package/src/release/publish-to-temporary-registry.mjs

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+/**
+ * Publishes every public @decohere package in a build folder to CI's temporary registry, named by
+ * DECOHERE_E2E_REGISTRY. Plain `npm publish`: `forge publish` ignores the user's npm config on
+ * purpose, so that a real publish can't pick up stray credentials. npm refuses to publish without
+ * a login, so this gives it a made-up one; the registry takes anything.
+ *
+ * Usage: publish-to-temporary-registry.mjs <build folder>
+ */
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+/**
+ * @param {string} dir
+ * @returns {string[]} folders of public @decohere packages
+ */
+export function findPublicPackages(dir) {
+	const found = [];
+	for (const entry of readdirSync(dir, { withFileTypes: true })) {
+		if (entry.name === "node_modules") continue;
+		const path = join(dir, entry.name);
+		if (entry.isDirectory()) {
+			found.push(...findPublicPackages(path));
+		} else if (entry.name === "package.json") {
+			const pkg = JSON.parse(readFileSync(path, "utf8"));
+			if (pkg.name?.startsWith("@decohere/") && pkg.private !== true) found.push(dir);
+		}
+	}
+	return found;
+}
+
+if (process.argv[1] != null && import.meta.url === pathToFileURL(process.argv[1]).href) {
+	const registry = process.env.DECOHERE_E2E_REGISTRY;
+	if (!registry) {
+		console.error("DECOHERE_E2E_REGISTRY is required");
+		process.exit(1);
+	}
+	const { host } = new URL(registry);
+	const userConfig = join(mkdtempSync(join(tmpdir(), "temporary-registry-")), ".npmrc");
+	writeFileSync(userConfig, `registry=${registry}\n//${host}/:_authToken=made-up\n`);
+
+	const packages = findPublicPackages(resolve(process.argv[2] ?? "dist/release"));
+	if (packages.length === 0) {
+		console.error("No public @decohere packages found");
+		process.exit(1);
+	}
+	for (const dir of packages) {
+		const result = spawnSync("npm", ["publish", dir, "--tag", "dev"], {
+			stdio: ["ignore", "inherit", "inherit"],
+			env: {
+				...process.env,
+				NPM_CONFIG_REGISTRY: registry,
+				NPM_CONFIG_USERCONFIG: userConfig,
+			},
+		});
+		if (result.status !== 0) {
+			console.error(`Publishing ${dir} failed`);
+			process.exit(result.status ?? 1);
+		}
+	}
+	console.log(`Published ${packages.length} packages`);
+}

package/src/release/sync-dependencies.mjs

@@ -7,10 +7,9 @@
 import { execSync } from "node:child_process";
 
 const DRY_RUN = process.env.DRY_RUN === "true";
-const TERMINAL_CLI = process.env.TERMINAL_CLI || "dist/debug/projects/terminal/src/cli.js";
 const DECOHERE_CONFIG = process.env.DECOHERE_CONFIG || ".decohere.js";
 
-const baseCmd = `node "${TERMINAL_CLI}" --log-level trace --config-file "${DECOHERE_CONFIG}" forge dependencies --configuration release sync`;
+const baseCmd = `pnpm forge --log-level info --config-file "${DECOHERE_CONFIG}" dependencies --configuration release sync`;
 
 try {
 	if (DRY_RUN) {

package/tests/audit/format.test.mjs

@@ -0,0 +1,115 @@
+import { describe, expect, it } from "vitest";
+import {
+	formatLog,
+	formatMarkdown,
+	highCritical,
+	parseAudit,
+} from "../../src/audit/format.mjs";
+
+const fixture = {
+	metadata: {
+		vulnerabilities: { info: 0, low: 1, moderate: 0, high: 1, critical: 0, total: 2 },
+	},
+	advisories: {
+		1: {
+			id: 1,
+			module_name: "nanoid",
+			severity: "high",
+			title: "nanoid: custom generators can loop indefinitely when size is zero",
+			url: "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
+			vulnerable_versions: "<3.3.18",
+			patched_versions: ">=3.3.18",
+			cves: [],
+			findings: [{ version: "3.3.17", paths: [". > vite > postcss > nanoid@3.3.17"] }],
+		},
+		2: {
+			id: 2,
+			module_name: "esbuild",
+			severity: "low",
+			title: "esbuild Windows file read",
+			url: "https://github.com/advisories/GHSA-g7r4-m6w7-qqqr",
+			vulnerable_versions: "<0.28.1",
+			patched_versions: ">=0.28.1",
+			cves: [],
+			findings: [{ version: "0.27.3", paths: [". > vite > esbuild"] }],
+		},
+	},
+};
+
+describe("parseAudit", () => {
+	it("reads severity counts and sorts advisories critical/high first", () => {
+		const parsed = parseAudit(fixture);
+		expect(parsed.total).toBe(2);
+		expect(parsed.high).toBe(1);
+		expect(parsed.low).toBe(1);
+		expect(parsed.advisories.map((a) => a.module)).toEqual(["nanoid", "esbuild"]);
+		expect(parsed.advisories[0]?.severity).toBe("high");
+		expect(parsed.advisories[0]?.ghsa).toBe("GHSA-2v37-7h3g-55p8");
+	});
+});
+
+describe("formatLog", () => {
+	it("prints severity counts and advisory lines including GHSA", () => {
+		const log = formatLog(parseAudit(fixture));
+		expect(log).toContain("high=1");
+		expect(log).toContain("[high] nanoid GHSA-2v37-7h3g-55p8");
+		expect(log).toContain("[low] esbuild");
+	});
+});
+
+describe("formatMarkdown", () => {
+	it("includes a severity table and linked advisories", () => {
+		const md = formatMarkdown(parseAudit(fixture));
+		expect(md).toContain("| High | 1 |");
+		expect(md).toContain("**high** `nanoid`");
+		expect(md).toContain("GHSA-2v37-7h3g-55p8");
+	});
+});
+
+describe("highCritical", () => {
+	it("filters to high and critical only", () => {
+		expect(highCritical(parseAudit(fixture)).map((a) => a.module)).toEqual(["nanoid"]);
+	});
+});
+
+describe("parseAudit npm v2", () => {
+	it("dedupes GHSA rows from package via objects", () => {
+		const v2 = {
+			auditReportVersion: 2,
+			metadata: {
+				vulnerabilities: { info: 0, low: 0, moderate: 0, high: 1, critical: 0, total: 1 },
+			},
+			vulnerabilities: {
+				nanoid: {
+					name: "nanoid",
+					severity: "high",
+					via: [
+						{
+							source: 1103848,
+							name: "nanoid",
+							title: "nanoid infinite loop",
+							url: "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
+							severity: "high",
+							range: "<3.3.18",
+						},
+					],
+					range: "<3.3.18",
+					nodes: ["node_modules/.pnpm/nanoid@3.3.17/node_modules/nanoid"],
+				},
+				postcss: {
+					name: "postcss",
+					severity: "high",
+					via: ["nanoid"],
+					effects: [],
+					range: "*",
+					nodes: ["node_modules/.pnpm/postcss@8.5.26/node_modules/postcss"],
+				},
+			},
+		};
+		const parsed = parseAudit(v2);
+		expect(parsed.advisories).toHaveLength(1);
+		expect(parsed.advisories[0]?.module).toBe("nanoid");
+		expect(parsed.advisories[0]?.ghsa).toBe("GHSA-2v37-7h3g-55p8");
+		expect(parsed.advisories[0]?.vulnerable).toBe("<3.3.18");
+	});
+});

package/tests/bench/history.test.mjs

@@ -0,0 +1,279 @@
+import { describe, expect, it } from "vitest";
+import {
+	appendRun,
+	assertValid,
+	compare,
+	contextId,
+	compareRounds,
+	latestRun,
+	pruneStale,
+	formatComparison,
+	fromVitest,
+	getContext,
+	normalize,
+	parseResults,
+	previousRun,
+	RESULT_PREFIX,
+} from "../../src/bench/history.mjs";
+
+const fakeOs = {
+	cpus: () => [{ model: " Test CPU " }, { model: "Test CPU" }],
+	platform: () => "linux",
+	arch: () => "x64",
+	totalmem: () => 16 * 1024 ** 3,
+};
+const ctx = getContext(
+	fakeOs,
+	{ BENCH_ENV: "gh-actions" },
+	"v24.1.0",
+	new Date("2026-10-20T03:17:00Z"),
+);
+
+const result = (id, median, extra = {}) => ({
+	id,
+	label: id,
+	unit: "ms",
+	median,
+	p90: median * 1.2,
+	min: median * 0.9,
+	max: median * 1.3,
+	samples: 5,
+	...extra,
+});
+
+const vitestOutput = {
+	files: [
+		{
+			groups: [
+				{
+					benchmarks: [
+						{
+							name: "forge build es6 + types (18 files)",
+							mean: 70,
+							median: 64,
+							min: 60,
+							max: 80,
+							sampleCount: 5,
+						},
+						{
+							name: "forge build es6 only (18 files)",
+							mean: 10,
+							min: 8,
+							max: 12,
+							sampleCount: 5,
+						},
+					],
+				},
+			],
+		},
+	],
+};
+
+describe("getContext / contextId", () => {
+	it("describes the machine and names the CI environment with the Node major", () => {
+		expect(ctx).toEqual({
+			benchEnv: "gh-actions-node24",
+			date: "2026-10-20T03:17:00.000Z",
+			os: { platform: "linux", arch: "x64" },
+			cpu: { model: "Test CPU", count: 2 },
+			memoryGb: 16,
+			node: "v24.1.0",
+		});
+		expect(getContext(fakeOs, {}, "v24.1.0").benchEnv).toBe("(local)");
+	});
+
+	it("gives the same id to the same machine regardless of date or env label", () => {
+		const later = getContext(fakeOs, {}, "v24.1.0", new Date("2027-01-01"));
+		expect(contextId(later)).toBe(contextId(ctx));
+		expect(contextId({ ...ctx, cpu: { ...ctx.cpu, count: 4 } })).not.toBe(contextId(ctx));
+	});
+});
+
+describe("parseResults", () => {
+	it("reads the last result line among other output", () => {
+		const results = [result("flux.load.cold", 250)];
+		const output = `flux load: median 250 ms\n${RESULT_PREFIX}[]\n${RESULT_PREFIX}${JSON.stringify(results)}\n`;
+		expect(parseResults(output, "flux-load")).toEqual(results);
+	});
+
+	it("fails, naming the suite, when there is no result line", () => {
+		expect(() => parseResults("crashed\n", "flux-serve")).toThrow(/flux-serve/);
+	});
+});
+
+describe("fromVitest", () => {
+	it("maps forge benchmarks to stable ids, keeping the file count out of the label", () => {
+		expect(fromVitest(vitestOutput)).toEqual([
+			{
+				id: "forge.build.local",
+				label: "forge build es6 + types",
+				unit: "ms",
+				median: 64,
+				min: 60,
+				max: 80,
+				samples: 5,
+				files: 18,
+			},
+			// No median from vitest: the mean stands in.
+			expect.objectContaining({ id: "forge.build.debug", median: 10, files: 18 }),
+		]);
+	});
+
+	it("fails on a benchmark it has no id for, instead of charting it under a moving name", () => {
+		const output = {
+			files: [{ groups: [{ benchmarks: [{ name: "something new", mean: 1 }] }] }],
+		};
+		expect(() => fromVitest(output)).toThrow(/something new/);
+	});
+});
+
+describe("assertValid", () => {
+	it("passes real results and rejects NaN or empty ones, naming them", () => {
+		expect(() => assertValid([result("a", 1)])).not.toThrow();
+		expect(() =>
+			assertValid([result("a", 1), result("b", Number.NaN), result("c", 2, { samples: 0 })]),
+		).toThrow(/b, c/);
+	});
+});
+
+describe("normalize", () => {
+	it("keeps a version 2 history as it is", () => {
+		const history = { version: 2, contexts: { x: { context: ctx, runs: [] } } };
+		expect(normalize(history)).toBe(history);
+	});
+
+	it("converts version 1 forge runs so their trend carries on", () => {
+		const v1 = {
+			runs: {
+				abc: {
+					context: ctx,
+					runs: [{ date: "2026-08-12T14:18:10Z", context: ctx, vitestOutput }],
+				},
+				empty: { context: ctx, runs: [] },
+			},
+		};
+		const history = normalize(v1);
+		expect(Object.keys(history.contexts)).toEqual(["abc"]);
+		expect(history.contexts.abc.runs[0]).toMatchObject({
+			date: "2026-08-12T14:18:10Z",
+			sha: null,
+			results: [{ id: "forge.build.local" }, { id: "forge.build.debug" }],
+		});
+	});
+
+	it("starts empty when there is no history", () => {
+		expect(normalize(null)).toEqual({ version: 2, contexts: {} });
+	});
+});
+
+describe("appendRun / previousRun", () => {
+	const run = (day) => ({
+		date: `2026-10-${day}T03:17:00Z`,
+		sha: `sha${day}`,
+		results: [result("a", Number(day))],
+	});
+
+	it("puts the new run first, trims to the limit, and leaves the input untouched", () => {
+		const empty = normalize(null);
+		const one = appendRun(empty, ctx, run("18"), 2);
+		const two = appendRun(one, ctx, run("19"), 2);
+		const three = appendRun(two, ctx, run("20"), 2);
+
+		expect(empty.contexts).toEqual({});
+		expect(one.contexts[contextId(ctx)].runs).toHaveLength(1);
+		expect(three.contexts[contextId(ctx)].runs.map((r) => r.sha)).toEqual(["sha20", "sha19"]);
+		expect(previousRun(three, contextId(ctx))?.sha).toBe("sha20");
+		expect(previousRun(three, "other-machine")).toBeUndefined();
+	});
+});
+
+describe("compare / formatComparison", () => {
+	it("reports the change in median against the previous run, and n/a for new benchmarks", () => {
+		const rows = compare([result("a", 120), result("new", 5)], {
+			results: [result("a", 100)],
+		});
+		expect(rows).toEqual([
+			{ id: "a", current: 120, previous: 100, delta: 20, percent: 20 },
+			{ id: "new", current: 5 },
+		]);
+
+		const table = formatComparison(rows).split("\n");
+		expect(table[0]).toMatch(/^Benchmark \| +Median \| Previous \| +Delta \| +%$/);
+		expect(table[2]).toMatch(/^a +\| +120\.0 ms \| +100\.0 ms \| +\+20\.0 ms \| \+20\.0%$/);
+		expect(table[3]).toMatch(/^new +\| +5\.0 ms \| +n\/a \| +n\/a \| +n\/a$/);
+	});
+
+	it("compares against nothing on a machine's first run", () => {
+		expect(compare([result("a", 1)], undefined)).toEqual([{ id: "a", current: 1 }]);
+	});
+});
+
+describe("compareRounds", () => {
+	const round = (...medians) => medians.map((median, index) => result(`b${index}`, median));
+
+	it("flags a benchmark slower on head than base in every round, with both rounds' numbers", () => {
+		const [regression] = compareRounds([round(130, 50)], [round(100, 50)], {
+			threshold: 0.2,
+			rounds: 1,
+		});
+		expect(regression).toMatchObject({
+			id: "b0",
+			base: 100,
+			head: 130,
+			rounds: [{ base: 100, head: 130 }],
+		});
+		expect(regression.percent).toBeCloseTo(30);
+	});
+
+	it("needs every round slower: one slow round is as likely the runner as the code", () => {
+		expect(compareRounds([round(130), round(105)], [round(100), round(100)])).toEqual([]);
+		expect(compareRounds([round(130), round(126)], [round(100), round(100)])).toHaveLength(1);
+	});
+
+	it("ignores slowdowns within the threshold", () => {
+		expect(compareRounds([round(115), round(118)], [round(100), round(100)])).toEqual([]);
+	});
+
+	it("skips benchmarks only one side has, and compares nothing without enough rounds", () => {
+		const head = [
+			[result("new", 500), result("old", 100)],
+			[result("new", 500), result("old", 100)],
+		];
+		const base = [[result("old", 100)], [result("old", 100)]];
+		expect(compareRounds(head, base)).toEqual([]);
+		expect(compareRounds([round(200)], [round(100)])).toEqual([]);
+	});
+});
+
+describe("pruneStale / latestRun", () => {
+	const at = (date, sha) => ({ date, sha, results: [] });
+	const history = {
+		version: 2,
+		contexts: {
+			old: { context: ctx, runs: [at("2026-08-12T03:17:00Z", "aaa")] },
+			recent: {
+				context: ctx,
+				runs: [at("2026-10-20T03:17:00Z", "ccc"), at("2026-10-19T03:17:00Z", "bbb")],
+			},
+		},
+	};
+
+	it("drops machine types with no run in the last 30 days", () => {
+		expect(
+			Object.keys(pruneStale(history, new Date("2026-10-21T00:00:00Z")).contexts),
+		).toEqual(["recent"]);
+		expect(
+			Object.keys(pruneStale(history, new Date("2026-09-01T00:00:00Z")).contexts),
+		).toEqual(["old", "recent"]);
+	});
+
+	it("prunes when a run is appended", () => {
+		const next = appendRun(history, ctx, at("2026-10-21T03:17:00Z", "ddd"));
+		expect(Object.keys(next.contexts)).not.toContain("old");
+	});
+
+	it("finds the newest run on any machine: the commit the previous nightly measured", () => {
+		expect(latestRun(history)?.sha).toBe("ccc");
+		expect(latestRun({ version: 2, contexts: {} })).toBeUndefined();
+	});
+});