@descryy/core 0.6.3 → 0.8.0

package/dist/tiers/certify.d.ts

@@ -28,6 +28,17 @@ export interface PrecisionDraw {
     /** The negative control over the same adjudicator. Must be ~0. */
     readonly controlDrawn: number;
     readonly controlCorrect: number;
+    /** Control rows drawn but never scored, because the swap could not be made WRONG — every
+     *  candidate the pool offered was itself a real edge, so the row tested nothing. Excluded from
+     *  `controlDrawn` (zero out of zero is undefined, and a swap nothing tested must not be scored
+     *  like one that was tested and rejected) and recorded here instead of vanishing.
+     *
+     *  `undefined` is not zero: a grader with no such bucket decided every swap it drew, and is
+     *  charged nothing — same reason an absent `decided` is not charged COVERAGE_FLOOR.
+     *
+     *  It IS a weakening of the control, and `CONTROL_CONSTRUCTION_FLOOR` is what stops it being an
+     *  unlimited one — a denominator the grader may shrink is one the grader can shrink to one row. */
+    readonly controlUncontrollable?: number;
     /** Did the adapter's author pick this repo? DEC-075 §6.2 requires two that didn't. Declared, not inferred. */
     readonly authorChose: boolean;
     /** Who recorded this, so an attested claim has a name against it. */
@@ -49,6 +60,105 @@ export interface ConformanceEvidence {
      *  corpus's fault) — conflating them failed every adapter at Tier C on a low-resolution sweep. */
     readonly manifestClean: boolean;
 }
+/**
+ * Which denominator a recall figure is over. **The headline is `wholeCodebase`,
+ * ruled and not inferred.**
+ *
+ * `inCodebase` divides by the references whose TARGET is declared inside the
+ * repository, so every call into a library is absent from its denominator — the
+ * axis excluded precisely the part of the codebase the graph could not
+ * represent, which made it the most flattering figure available and the least
+ * answerable one. External-symbol nodes made those references representable and
+ * measured what it was worth: go/gin 24.5% → 59.5%, python/dispatch 11.8% →
+ * 37.3%, both at zero false positives. Once a call into a library can be a
+ * node, the axis that counts it is the one that answers "how much of my code
+ * did you analyse".
+ *
+ * `narrow` is `found / (found + missing)` — what every `bench/<lang>-recall.mjs`
+ * prints and what every earlier recall number in this repository means. It is
+ * the narrowest of the three and is kept only for continuity.
+ *
+ * Both narrower axes are reportable. Neither is the headline, and a draw that
+ * offers one as its headline is refused with that reason — see
+ * {@link ruleRecallDraw}.
+ */
+export type RecallAxis = "wholeCodebase" | "inCodebase" | "narrow";
+/**
+ * A recall measurement, as `bench/recall-baseline.json` records one.
+ *
+ * Deliberately NOT shaped like {@link PrecisionDraw}: it carries no control and
+ * no `authorChose`, because it gates nothing and therefore needs neither. What
+ * it does carry is the pair that makes a recall figure readable at all — the
+ * denominator's axis, and the draw size that denominator came out of.
+ */
+export interface RecallDraw {
+    readonly repository: string;
+    /** Which denominator {@link denominator} is. Required: a rate with no stated
+     *  axis is three different claims wearing one number. */
+    readonly axis: RecallAxis;
+    /** Every site the instrument drew, before any exclusion. Coverage's denominator. */
+    readonly drawn: number;
+    /** The figure's own denominator: `drawn` minus whatever this axis excludes. */
+    readonly denominator: number;
+    /** How many of `denominator` reached the graph. */
+    readonly found: number;
+    /** The second axis, disclosed beside the headline so a reader has both.
+     *  Optional; its absence is printed as absence, never as agreement. */
+    readonly secondAxis?: {
+        readonly axis: RecallAxis;
+        readonly found: number;
+        readonly denominator: number;
+    };
+    /** What the generated-code exclusion removed from this draw, if it was applied.
+     *  `undefined` means no exclusion was recorded — printed as such, because an
+     *  undisclosed exclusion and no exclusion must not read the same. */
+    readonly generatedExcluded?: {
+        readonly files: number;
+        readonly sites: number;
+        readonly rules: readonly string[];
+    };
+    /** Who recorded it. Same rule as everywhere else here: unattributable is not admissible. */
+    readonly recordedBy: string;
+}
+/** One {@link RecallDraw}, ruled. `admissible` is about the FIGURE, never about the adapter. */
+export interface RecallRuling {
+    readonly repository: string;
+    readonly axis: RecallAxis;
+    readonly found: number;
+    readonly denominator: number;
+    readonly drawn: number;
+    /** `found / denominator`, or `null` where the denominator is zero — which is
+     *  undefined, not 0% and not 100%. */
+    readonly rate: number | null;
+    /** `denominator / drawn`: how much of its own draw the instrument was willing
+     *  to be graded on. `null` where there is no draw to divide by. */
+    readonly coverage: number | null;
+    /** Does this figure say anything at all? False does NOT mean the adapter fell
+     *  short — it means the figure is a claim about what the instrument judged, or
+     *  is over the wrong denominator. */
+    readonly admissible: boolean;
+    readonly detail: string;
+    readonly secondAxis?: RecallDraw["secondAxis"];
+    readonly generatedExcluded?: RecallDraw["generatedExcluded"];
+    readonly recordedBy: string;
+}
+/**
+ * What the certificate says about recall.
+ *
+ * `not-measured` is its own state and is printed. A certificate that simply
+ * omitted recall when none was recorded would let "we never measured how much
+ * of your codebase we reached" and "we reached it" render identically, which is
+ * the silent degradation rule 7 forbids.
+ */
+export type RecallDisclosure = {
+    readonly state: "not-measured";
+    readonly detail: string;
+    readonly rows: readonly [];
+} | {
+    readonly state: "disclosed";
+    readonly detail: string;
+    readonly rows: readonly RecallRuling[];
+};
 export interface GateEvidence {
     readonly adapter: string;
     readonly language: string;
@@ -65,9 +175,16 @@ export interface GateEvidence {
      *  that fails on absence; JS has none). Distinct from "not built yet" (§20.2) — doesn't block the
      *  tier and doesn't vanish, it's printed on the certificate. `declaredBy` required; unattributed = ignored. */
     readonly structuralLimits?: readonly StructuralLimit[];
+    /** Requirements the admitted reference corpus cannot supply evidence for (see `CorpusCeiling`).
+     *  Waives nothing and moves no tier — changes "not done yet" into "not reachable from this corpus". */
+    readonly corpusCeilings?: readonly CorpusCeiling[];
     /** Capabilities claimed below what evidence supports, pending an open policy (see `PolicyCap`).
      *  Doesn't waive a requirement or block a tier — stops a deliberate cap being published as an absence. */
     readonly policyCaps?: readonly PolicyCap[];
+    /** Recall measurements. **Disclosed on the certificate and gating nothing** —
+     *  see `RECALL_COVERAGE_FLOOR` for why, and for what would have to be true
+     *  before this could become a requirement. Absent is printed as absent. */
+    readonly recallDraws?: readonly RecallDraw[];
 }
 /** A capability this language cannot have. Declared, never inferred. */
 export interface StructuralLimit {
@@ -78,6 +195,40 @@ export interface StructuralLimit {
     /** Who declared it. An anonymous structural limit is not admissible. */
     readonly declaredBy: string;
 }
+/**
+ * A requirement the ADMITTED REFERENCE CORPUS cannot supply evidence for, published as a
+ * ceiling rather than left standing as unmet work.
+ *
+ * Three neighbouring things, and conflating any two of them publishes a falsehood:
+ *
+ *   `StructuralLimit`   the LANGUAGE cannot have this, ever. Waives the requirement.
+ *   `unreachableHere`   this repository's population is a measured zero. Derived, waives
+ *                       nothing, and says the remedy is other repositories.
+ *   `CorpusCeiling`     the admitted repositories contain almost none of the edge type the
+ *                       requirement is scored on, AND the rules forbid admitting a better
+ *                       one for that reason. Declared, waives nothing.
+ *
+ * The difference between the second and the third is who is allowed to fix it. A measured
+ * zero invites other repositories; a corpus ceiling is the case where reaching for one is
+ * the prohibited move — the outcome-blind admission rules exist precisely to stop a
+ * repository being admitted because it would move a tier. So the row is not pending work,
+ * and printing it as unmet tells a reader to go and do something the rules forbid.
+ *
+ * **It waives nothing, deliberately.** A ceiling that waived its own requirement would be
+ * the cheapest route to a tier available: declare the corpus inadequate, collect the badge.
+ * The tier stays exactly where the evidence puts it; only the sentence beside it changes.
+ *
+ * `declaredBy` is required for the same reason `StructuralLimit` requires it — an anonymous
+ * "the corpus is inadequate" is a sentence anyone can add to stop a row reading as work.
+ */
+export interface CorpusCeiling {
+    /** A requirement id, or the name of a check. */
+    readonly id: string;
+    /** Why the admitted reference set cannot supply this, in terms of the corpus. */
+    readonly reason: string;
+    /** Who declared it. An anonymous ceiling is not admissible. */
+    readonly declaredBy: string;
+}
 /** A capability claimable higher but deliberately claimed lower, pending an unwritten policy —
  *  distinct from absent (unmeasured) and StructuralLimit (impossible). E.g. an R4-introspected
  *  route table claimed at R3 pending R4's expiry policy (R4 is unconditionally class A, DEC-115). */
@@ -99,6 +250,17 @@ export interface EmptyPopulation {
     readonly repository: string;
     readonly edgeType: EdgeType | "mixed";
 }
+/** A draw whose negative control excluded rows it could not make wrong. Derived from the draw,
+ *  never declared — the grader counted them, nobody attests to them. Printed because a control
+ *  that excluded rows and a control that excluded none read identically otherwise. */
+export interface WeakenedControl {
+    readonly repository: string;
+    readonly edgeType: EdgeType | "mixed";
+    /** Swaps that were actually made wrong and scored — the control's real denominator. */
+    readonly constructed: number;
+    /** Swaps drawn where every candidate in the pool was itself a real edge. */
+    readonly uncontrollable: number;
+}
 export interface UnmetRequirement {
     readonly requirement: Requirement;
     /** Why it is unmet, in terms of what was found rather than what was wanted. */
@@ -130,8 +292,20 @@ export interface TierCertificate {
     /** Draws whose population was zero — nothing here to measure, not "the adapter fell short."
      *  Printed beside structural limitations; the remedy is other repositories. */
     readonly unreachableHere: readonly EmptyPopulation[];
+    /** Requirements published as unreachable from the admitted corpus. Declared, attributed, and
+     *  waiving nothing — never omit these when printing, or a ceiling reads as pending work. */
+    readonly corpusCeilings: readonly CorpusCeiling[];
+    /** Draws whose control excluded rows it could not make wrong. Empty for every draw that
+     *  records no such bucket. Never omit when printing — an undisclosed exclusion is the thing
+     *  the bucket exists to stop. */
+    readonly weakenedControls: readonly WeakenedControl[];
     /** DEC-075 §6.3: does `capabilities()` match what was emitted? */
     readonly capabilitiesHonest: boolean | "unknown";
+    /** How much of the codebase was reached, and on which denominator. Never omit
+     *  when printing: a tier says how RIGHT the edges are, and says nothing at all
+     *  about how MANY of them there are. Those are different questions and a
+     *  reader handed only the first will answer the second with it. */
+    readonly recall: RecallDisclosure;
 }
 export declare function certify(evidence: GateEvidence): TierCertificate;
 /** Tier first, then immediately why it isn't higher. Printing "B" alone teaches a reader B is

package/dist/tiers/certify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"certify.d.ts","sourceRoot":"","sources":["../../src/tiers/certify.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAU,KAAK,WAAW,EAAE,KAAK,IAAI,EAA0B,MAAM,aAAa,CAAC;AAE1F;yGACyG;AACzG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;mGAE+F;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;4GAEwG;IACxG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;iGAE6F;IAC7F,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,8GAA8G;IAC9G,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;2GAEuG;IACvG,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CACzG;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;sGAEkG;IAClG,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,2EAA2E;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;IAChD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACrD,QAAQ,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IAClD;qGACiG;IACjG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD;;mHAE+G;IAC/G,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACvD;8GAC0G;IAC1G,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;CAC5C;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;qGAEqG;AACrG,MAAM,WAAW,SAAS;IACxB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gCAAgC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;gGAC4F;IAC5F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACnD,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,gBAAgB,EAAE,CAAC,CAAC,CAAC;IACrE;mCAC+B;IAC/B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;2FAEuF;IACvF,QAAQ,CAAC,iBAAiB,EAAE,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC;IAC5D;qGACiG;IACjG,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAC;IACjD;+CAC2C;IAC3C,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C;mFAC+E;IAC/E,QAAQ,CAAC,eAAe,EAAE,SAAS,eAAe,EAAE,CAAC;IACrD,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,EAAE,OAAO,GAAG,SAAS,CAAC;CAClD;AAmOD,wBAAgB,OAAO,CAAC,QAAQ,EAAE,YAAY,GAAG,eAAe,CAsD/D;AAED;iFACiF;AACjF,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,eAAe,GAAG,MAAM,CA4CtE"}
+{"version":3,"file":"certify.d.ts","sourceRoot":"","sources":["../../src/tiers/certify.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAU,KAAK,WAAW,EAAE,KAAK,IAAI,EAA0B,MAAM,aAAa,CAAC;AAE1F;yGACyG;AACzG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;mGAE+F;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;4GAEwG;IACxG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;iGAE6F;IAC7F,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;;;;;uGASmG;IACnG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,8GAA8G;IAC9G,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;2GAEuG;IACvG,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CACzG;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;sGAEkG;IAClG,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEnE;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;6DACyD;IACzD,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;2EACuE;IACvE,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1G;;yEAEqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;KACnC,CAAC;IACF,4FAA4F;IAC5F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,gGAAgG;AAChG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;0CACsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;uEACmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;yCAEqC;IACrC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;IAC/C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAA;CAAE,GACvF;IAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,CAAC;AAErG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,2EAA2E;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;IAChD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACrD,QAAQ,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IAClD;qGACiG;IACjG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD;;mHAE+G;IAC/G,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACvD;2GACuG;IACvG,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACnD;8GAC0G;IAC1G,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAC3C;;+EAE2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;CAC9C;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;qGAEqG;AACrG,MAAM,WAAW,SAAS;IACxB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gCAAgC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;gGAC4F;IAC5F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC;CACvC;AAED;;sFAEsF;AACtF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC;IACtC,uFAAuF;IACvF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACnD,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,gBAAgB,EAAE,CAAC,CAAC,CAAC;IACrE;mCAC+B;IAC/B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;2FAEuF;IACvF,QAAQ,CAAC,iBAAiB,EAAE,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC;IAC5D;qGACiG;IACjG,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAC;IACjD;+CAC2C;IAC3C,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C;mFAC+E;IAC/E,QAAQ,CAAC,eAAe,EAAE,SAAS,eAAe,EAAE,CAAC;IACrD;gGAC4F;IAC5F,QAAQ,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IAClD;;qCAEiC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;IACtD,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,EAAE,OAAO,GAAG,SAAS,CAAC;IACjD;;;uEAGmE;IACnE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC;AAieD,wBAAgB,OAAO,CAAC,QAAQ,EAAE,YAAY,GAAG,eAAe,CAuE/D;AAED;iFACiF;AACjF,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,eAAe,GAAG,MAAM,CA+GtE"}

package/dist/tiers/certify.js

@@ -11,7 +11,59 @@ const MAX_CONTROL = 0.02;
  *  bench/ can't be imported from packages/core. User-ruled: a capability that moves a tier needs
  *  this many decided rows of its OWN edge type, not just an aggregate pass. */
 const TYPE_FLOOR = 20;
+/** The other half of the same floor, and it was missing. `bench/grader-outcome-adjudicate.mjs`'s
+ *  `scoreLines` has always marked a type `<- below floor` at `n >= TYPE_FLOOR && ok / n < 0.95`;
+ *  this file counted the rows and never looked at how many were right, so a draw that FAILED a
+ *  capability was the evidence that granted it — csharp/eShopOnWeb's USES_API at 19/25 = 76% moved
+ *  csharp from B to A. Same value as the bench layer's, for the same reason TYPE_FLOOR is. */
+const TYPE_RATE_FLOOR = 0.95;
 const REPOSITORIES_REQUIRED = 2;
+/** Mirrors `bench/kotlin-precision.mjs`'s `COVERAGE_FLOOR` — the other half of scoring over
+ *  `decided`. Precision says how well the grader did on what it judged; coverage says how much
+ *  it was willing to judge. Neither alone is a claim, and only one of the two was ever gated
+ *  here. Restated rather than imported for the same reason `TYPE_FLOOR` is: a bench instrument
+ *  is not a dependency of the shipped gate. If you change one, change both. */
+const COVERAGE_FLOOR = 0.6;
+/** The same floor again, one layer down: of the control swaps a grader ATTEMPTED, how many it
+ *  managed to make wrong at all. Mirrors `bench/grader-outcome-adjudicate.mjs`'s
+ *  `CONTROL_COVERAGE_FLOOR`, which guards the neighbouring shrink (rows the adjudicator refused
+ *  to judge) at the same 0.6 — restated rather than imported, on the same terms as TYPE_FLOOR and
+ *  COVERAGE_FLOOR. If you change one, change both. */
+const CONTROL_CONSTRUCTION_FLOOR = 0.6;
+/**
+ * The headline recall denominator. Mirrors `HEADLINE_AXIS` in
+ * `bench/lib/recall-baseline.mjs`, restated on the same terms as `TYPE_FLOOR`
+ * and `COVERAGE_FLOOR`: a bench instrument is not a dependency of the shipped
+ * gate. **If you change one, change both.** `packages/core/test/tiers.test.ts`
+ * and `bench/test/recall-verdict.test.mjs` both pin it.
+ */
+const HEADLINE_RECALL_AXIS = "wholeCodebase";
+/**
+ * `COVERAGE_FLOOR` again, for recall.
+ *
+ * Precision says how well the grader did on what it judged; coverage says how
+ * much it was willing to judge. Recall has the identical hole: an instrument
+ * that draws 2000 sites, decides 118 of them and reports 118/118 = 100% has
+ * measured its own willingness to be graded. That is `ruby/fluentd`, verbatim.
+ *
+ * **This floor DISQUALIFIES a figure and does not fail an adapter**, and unlike
+ * every other constant in this file it is attached to nothing that moves a
+ * tier. Two measured reasons, both of which would have to change first:
+ *
+ *  1. `bench/gate-evidence.json` carries no recall rows for any adapter. This
+ *     file's doctrine is that absent evidence fails, so a recall REQUIREMENT
+ *     today would drop every adapter at once — on the evidence's absence, not
+ *     on any adapter's performance.
+ *  2. Nothing in the corpus is close. On `bench/recall-baseline.json` the
+ *     headline axis reads 6.7%–45.3% across eighteen rows, best
+ *     `java/shopizer` at 45.3%. A requirement at any rate a reader would accept
+ *     is red for every row, and a gate red for every row is a gate people stop
+ *     reading.
+ *
+ * Mirrors `RECALL_COVERAGE_FLOOR` in `bench/recall-verdict.mjs`, which mirrors
+ * `COVERAGE_FLOOR` above. Three places, one value; change one, change all.
+ */
+const RECALL_COVERAGE_FLOOR = 0.6;
 function missing(wanted, have) {
     if (wanted === undefined)
         return [];
@@ -22,10 +74,16 @@ function missing(wanted, have) {
  *  Fixes a defect where a dedicated single-type draw read as silence — Python's SERVES_API drew
  *  200/200 and 48/48 (re-verified) but printed "0/20 decided". A dedicated zero-row draw counts as 0. */
 function decidedRowsOfType(draw, type) {
-    if (draw.perEdgeType !== undefined)
-        return draw.perEdgeType[type]?.decided ?? 0;
+    return rowsOfType(draw, type)?.decided;
+}
+/** Decided AND correct for one edge type. Both, because the floor is about both — see `TYPE_RATE_FLOOR`. */
+function rowsOfType(draw, type) {
+    if (draw.perEdgeType !== undefined) {
+        const bucket = draw.perEdgeType[type];
+        return bucket === undefined ? { decided: 0, correct: 0 } : { decided: bucket.decided, correct: bucket.correct };
+    }
     if (draw.edgeType === type)
-        return draw.decided ?? draw.drawn;
+        return { decided: draw.decided ?? draw.drawn, correct: draw.correct };
     return undefined;
 }
 function checkCapability(requirement, evidence) {
@@ -55,7 +113,23 @@ function checkCapability(requirement, evidence) {
             continue; // already named in edgeGap above
         if (!isPromotionRequirement)
             continue;
-        const contributions = evidence.precisionDraws
+        // **Only draws whose own negative control held.** The control is the sole
+        // detector for an adjudicator that says yes to everything, so a draw whose
+        // control exceeded the ceiling carries an UNGUARDED precision figure — and
+        // routing its per-type rows into a capability check would be the control
+        // gate in `checkPrecisionDraws` bypassed by a second code path. Measured:
+        // kotlin/ktor's USES_API draw reads 54/54 with a control of 4/54 = 7.4%, and
+        // its own artefact records `passed: false`; recording it moved kotlin from
+        // Tier B to Tier A until this line existed.
+        const guarded = evidence.precisionDraws.filter((d) => d.controlDrawn > 0 && d.controlCorrect / d.controlDrawn <= MAX_CONTROL);
+        const unguarded = evidence.precisionDraws.filter((d) => !guarded.includes(d) && (decidedRowsOfType(d, type) ?? 0) > 0);
+        for (const d of unguarded) {
+            gaps.push(`${type} evidence from ${d.repository} is not counted: its negative control is ` +
+                `${d.controlCorrect}/${d.controlDrawn}` +
+                (d.controlDrawn === 0 ? " — no control was run at all" : `, above ${MAX_CONTROL * 100}%`) +
+                `, so that draw's precision figure is unguarded and cannot earn a capability`);
+        }
+        const contributions = guarded
             .map((d) => decidedRowsOfType(d, type))
             .filter((n) => n !== undefined);
         if (contributions.length === 0) {
@@ -64,6 +138,21 @@ function checkCapability(requirement, evidence) {
             continue;
         }
         const decided = contributions.reduce((sum, n) => sum + n, 0);
+        // **The rate, checked at the floor and never above it.** Below TYPE_FLOOR the
+        // sample is too small to say anything, and the count check below is what
+        // rejects it; at or above the floor a type that is measurably wrong must not
+        // be the evidence that grants the requirement it fails.
+        const measured = guarded
+            .map((d) => rowsOfType(d, type))
+            .filter((r) => r !== undefined)
+            .reduce((sum, r) => ({ decided: sum.decided + r.decided, correct: sum.correct + r.correct }), { decided: 0, correct: 0 });
+        if (measured.decided >= TYPE_FLOOR && measured.correct / measured.decided < TYPE_RATE_FLOOR) {
+            gaps.push(`${type} ${measured.correct}/${measured.decided} = ` +
+                `${Math.round((100 * measured.correct) / measured.decided)}% across the recorded precision draws, ` +
+                `below the per-type floor of ${TYPE_RATE_FLOOR * 100}% — the draws that measure this capability ` +
+                `measure it FAILING, and a failing measurement is not evidence for the requirement it fails`);
+            continue;
+        }
         if (decided < TYPE_FLOOR) {
             gaps.push(`${type} ${decided}/${TYPE_FLOOR} decided rows across the recorded precision draws — declared, ` +
                 `but not validated by the draw at the floor every edge type is otherwise held to`);
@@ -98,6 +187,32 @@ function checkPrecisionDraws(requirement, evidence) {
     }
     const reasons = [];
     const qualifying = draws.filter((d) => {
+        // **Checked before anything else, because every check after it is a `<`.**
+        // `undefined / 32` is NaN, and every comparison with NaN is false — so a row
+        // carrying no usable counts does not fail these gates, it passes all of
+        // them in turn. That is not hypothetical: a recorder wrote four rows with
+        // `correct: undefined` and this function awarded Tier A on them, one of
+        // which had really measured 19/25 = 76%.
+        //
+        // A numeric guard rather than a `=== undefined` guard, because NaN and
+        // Infinity arrive the same way (a rate multiplied back into a count, a
+        // division by a zero denominator) and read the same way downstream.
+        const counts = [
+            ["drawn", d.drawn],
+            ["correct", d.correct],
+            ["controlDrawn", d.controlDrawn],
+            ["controlCorrect", d.controlCorrect],
+            ["decided", d.decided ?? 0],
+            ["population", d.population ?? 0],
+            ["controlUncontrollable", d.controlUncontrollable ?? 0],
+        ];
+        const unusable = counts.filter(([, value]) => typeof value !== "number" || !Number.isFinite(value));
+        if (unusable.length > 0) {
+            reasons.push(`${d.repository}: no usable counts — ${unusable.map(([name]) => name).join(", ")} ` +
+                `${unusable.length === 1 ? "is" : "are"} not a number. A draw that cannot be compared against a ` +
+                `threshold must not pass one: absent evidence is a failure, never a pass`);
+            return false;
+        }
         if (d.authorChose) {
             reasons.push(`${d.repository}: the author chose this repository, so it does not count toward the two`);
             return false;
@@ -129,8 +244,24 @@ function checkPrecisionDraws(requirement, evidence) {
             return false;
         }
         // Precision = correct/DECIDED, never /drawn — folding an honest refusal-to-judge into the
-        // denominator punishes it exactly like a wrong answer. Coverage is reported separately.
+        // denominator punishes it exactly like a wrong answer.
         const decided = d.decided ?? d.drawn;
+        // ...but a denominator the grader chooses is a denominator the grader can shrink. Gated
+        // together with precision, never apart: `bench/kotlin-precision.mjs` reasoned this out
+        // first ("refusal with no floor is a way to buy any precision you like by refusing
+        // whatever you would have got wrong") and enforced it inside itself, where it protected
+        // Kotlin's draws and no others. Moving it here is what makes the refusal design honest
+        // for every grader that records `decided`, not just the one that invented the field.
+        //
+        // A draw with no `decided` is NOT charged this. Its grader has no third outcome, so it
+        // decided every row it drew; there is no shrinking to guard against, and charging it
+        // would fail every row recorded before the distinction existed.
+        if (d.decided !== undefined && decided / d.drawn < COVERAGE_FLOOR) {
+            reasons.push(`${d.repository}: decided ${decided}/${d.drawn}, coverage ` +
+                `${Math.round((decided / d.drawn) * 100)}% below ${COVERAGE_FLOOR * 100}% — precision over a ` +
+                `denominator this small is a claim about what the grader chose to judge, not about the adapter`);
+            return false;
+        }
         if (d.correct / decided < MIN_PRECISION) {
             reasons.push(`${d.repository}: precision ${d.correct}/${decided}` +
                 (decided === d.drawn ? "" : ` (of ${d.drawn} drawn, ${decided} decided)`) +
@@ -145,6 +276,17 @@ function checkPrecisionDraws(requirement, evidence) {
             reasons.push(`${d.repository}: no negative control was run, so the precision figure is unguarded`);
             return false;
         }
+        // ...and the same shrink again, one layer down. A row whose swap could not be made wrong
+        // tested nothing and is rightly out of the denominator; a grader free to declare most of its
+        // rows that way can report 0/10 and print the same clean sentence as a control that rejected
+        // 200. Charged only where the grader records the bucket at all.
+        const attempted = d.controlDrawn + (d.controlUncontrollable ?? 0);
+        if (d.controlUncontrollable !== undefined && d.controlDrawn / attempted < CONTROL_CONSTRUCTION_FLOOR) {
+            reasons.push(`${d.repository}: ${d.controlDrawn} of ${attempted} control swaps could be made wrong at all, ` +
+                `below ${CONTROL_CONSTRUCTION_FLOOR * 100}% — a control this much of which tested nothing is not ` +
+                `a guard on the precision figure beside it`);
+            return false;
+        }
         return true;
     });
     const repositories = new Set(qualifying.map((d) => d.repository));
@@ -204,6 +346,95 @@ function capabilitiesHonest(evidence) {
     const overEdges = missing(evidence.capabilities.edgeTypes, evidence.emittedEdgeTypes);
     return overNodes.length === 0 && overEdges.length === 0;
 }
+/**
+ * Rule one recall draw. Pure, and it decides nothing about a tier.
+ *
+ * Three ways a figure says nothing, and they are different statements:
+ *   - it is over a NARROWER axis than the headline, so it answers a different
+ *     question from the one a reader will read it as answering;
+ *   - it has no draw size, so its coverage has no denominator;
+ *   - it was graded on too little of its own draw.
+ *
+ * None of them is "the adapter did badly", and the certificate says so.
+ */
+function ruleRecallDraw(draw) {
+    const rate = draw.denominator === 0 ? null : draw.found / draw.denominator;
+    const coverage = draw.drawn > 0 ? draw.denominator / draw.drawn : null;
+    const base = {
+        repository: draw.repository,
+        axis: draw.axis,
+        found: draw.found,
+        denominator: draw.denominator,
+        drawn: draw.drawn,
+        rate,
+        coverage,
+        ...(draw.secondAxis === undefined ? {} : { secondAxis: draw.secondAxis }),
+        ...(draw.generatedExcluded === undefined ? {} : { generatedExcluded: draw.generatedExcluded }),
+        recordedBy: draw.recordedBy,
+    };
+    if (draw.axis !== HEADLINE_RECALL_AXIS) {
+        return {
+            ...base,
+            admissible: false,
+            detail: `recorded on the '${draw.axis}' axis, not the headline '${HEADLINE_RECALL_AXIS}'. ` +
+                (draw.axis === "inCodebase"
+                    ? "`inCodebase` divides by the references whose target is declared inside the repository, so every " +
+                        "call into a library is absent from its denominator — it excludes precisely what the graph could " +
+                        "not represent. Reportable beside the headline; never as it"
+                    : "`narrow` divides by found + missing and drops everything the instrument declined to attempt — " +
+                        "on this corpus that is 78% of drawn sites. Reportable beside the headline; never as it"),
+        };
+    }
+    if (coverage === null) {
+        return { ...base, admissible: false, detail: "the draw records no draw size, so coverage has no denominator" };
+    }
+    if (draw.denominator === 0) {
+        return {
+            ...base,
+            admissible: false,
+            detail: `all ${draw.drawn} drawn sites were excluded; nothing was graded, which is undefined and not 0%`,
+        };
+    }
+    if (coverage < RECALL_COVERAGE_FLOOR) {
+        return {
+            ...base,
+            admissible: false,
+            detail: `${draw.found}/${draw.denominator} over ${draw.drawn} drawn — coverage ` +
+                `${Math.round(coverage * 100)}% is below ${RECALL_COVERAGE_FLOOR * 100}%, so this figure is a claim ` +
+                `about what the instrument was willing to grade, not about the adapter`,
+        };
+    }
+    return {
+        ...base,
+        admissible: true,
+        detail: `${draw.found}/${draw.denominator} on the ${HEADLINE_RECALL_AXIS} axis, over ${draw.drawn} drawn`,
+    };
+}
+/**
+ * The whole recall disclosure, including the case where there is none.
+ *
+ * **It never contributes to `awarded`.** `packages/core/test/tiers.test.ts`
+ * asserts that the worst possible recall draw leaves the tier where it was; if
+ * that assertion ever fails, recall has quietly become a gate and every tier on
+ * every certificate is now a claim about a measurement no adapter records.
+ */
+function discloseRecall(evidence) {
+    const draws = evidence.recallDraws ?? [];
+    if (draws.length === 0) {
+        return {
+            state: "not-measured",
+            detail: "no recall draw is recorded for this adapter, so this certificate says nothing about how much of a " +
+                "codebase reaches the graph. The tier above is about how RIGHT the edges are, not how many there are",
+            rows: [],
+        };
+    }
+    return {
+        state: "disclosed",
+        detail: `recall is disclosed and gates nothing: the headline axis is '${HEADLINE_RECALL_AXIS}', and a figure ` +
+            `below the ${RECALL_COVERAGE_FLOOR * 100}% coverage floor is disqualified rather than charged to the adapter`,
+        rows: draws.map(ruleRecallDraw),
+    };
+}
 export function certify(evidence) {
     const byTier = { S: [], A: [], B: [], C: [] };
     const limits = admissibleLimits(evidence);
@@ -245,9 +476,26 @@ export function certify(evidence) {
         unreachableHere: evidence.precisionDraws
             .filter((d) => drawableFrom(d) === 0)
             .map((d) => ({ repository: d.repository, edgeType: d.edgeType })),
+        // Not folded into `limitedIds` either, and for a sharper version of the same reason: a
+        // ceiling that waived would let any language buy a tier by declaring its own corpus poor.
+        corpusCeilings: (evidence.corpusCeilings ?? []).filter((c) => c.declaredBy.trim() !== ""),
+        // Derived like `unreachableHere`, and disclosed whether or not the draw qualified: a draw
+        // rejected by the construction floor still says something about its grader, and a draw that
+        // passed with rows excluded has a weaker control than its clean number suggests.
+        weakenedControls: evidence.precisionDraws
+            .filter((d) => (d.controlUncontrollable ?? 0) > 0)
+            .map((d) => ({
+            repository: d.repository,
+            edgeType: d.edgeType,
+            constructed: d.controlDrawn,
+            uncontrollable: d.controlUncontrollable ?? 0,
+        })),
         // Not folded into `limitedIds` — a cap waives nothing, and if it could skip a requirement that'd be the cheapest route to a tier.
         policyCaps: admissibleCaps(evidence),
         capabilitiesHonest: capabilitiesHonest(evidence),
+        // Disclosed, never gating. See `RECALL_COVERAGE_FLOOR` for the two measured
+        // reasons, and `discloseRecall` for the test that keeps it that way.
+        recall: discloseRecall(evidence),
     };
 }
 /** Tier first, then immediately why it isn't higher. Printing "B" alone teaches a reader B is
@@ -273,6 +521,26 @@ export function formatCertificate(certificate) {
         lines.push(`  NOT REACHABLE IN THIS REFERENCE SET — ${empty.edgeType} on ${empty.repository}: population 0`);
         lines.push("    Nothing here to sample. The remedy is other repositories, not more measurement");
     }
+    // "Not done yet" and "not reachable from the repositories we are allowed to use" are
+    // different sentences, and the second is the one eight languages are actually in. Printed
+    // beside the unmet rows it explains, never instead of them — the requirement is still unmet.
+    for (const ceiling of certificate.corpusCeilings) {
+        lines.push(`  CEILING ACCEPTED — ${ceiling.id}: ${ceiling.reason}`);
+        lines.push(`    declared by ${ceiling.declaredBy}; the admitted corpus cannot supply this, and admitting ` +
+            `another repository BECAUSE it would move a tier is the move the selection rules forbid. ` +
+            `Published as a ceiling, not as work outstanding. Waives nothing`);
+    }
+    // The control's own disclosure. A swap that could not be made wrong tested nothing, which is
+    // why it left the denominator; printing the count is what keeps "0 of 196, 4 untestable" from
+    // reading as "0 of 196".
+    for (const weak of certificate.weakenedControls) {
+        const attempted = weak.constructed + weak.uncontrollable;
+        lines.push(`  CONTROL WEAKENED — ${weak.repository} (${weak.edgeType}): ${weak.uncontrollable} of ${attempted} ` +
+            `control swaps could not be made wrong at all`);
+        lines.push(`    Every candidate the pool offered for those rows was itself a real edge, so the swap tested ` +
+            `nothing and left the denominator. Scored over ${weak.constructed}. A genuine over-acceptance on ` +
+            `one of those rows would not have been counted`);
+    }
     for (const cap of certificate.policyCaps) {
         lines.push(`  CAPPED BY POLICY — ${cap.id}: claims ${cap.claimed}, evidence supports ${cap.claimable}`);
         lines.push(`    pending ${cap.pendingOn}; declared by ${cap.declaredBy}. Not a limit — a deliberate under-claim`);
@@ -283,6 +551,42 @@ export function formatCertificate(certificate) {
     else if (certificate.capabilitiesHonest === "unknown") {
         lines.push("  capabilities() not compared against a run — DEC-075 §6.3 unverified here");
     }
+    // COVERAGE, NOT CORRECTNESS, and it is printed on every certificate including
+    // the ones that have nothing to say. A tier is a statement about how right the
+    // edges are; a reader handed only that will answer "how much of my codebase did
+    // you analyse" with it, and on this corpus the honest answer to that question is
+    // between 6.7% and 45.3%. Printed BEFORE the early return below, so a Tier S
+    // certificate does not skip it.
+    if (certificate.recall.state === "not-measured") {
+        lines.push("  RECALL — not measured");
+        lines.push(`    ${certificate.recall.detail}`);
+    }
+    else {
+        for (const row of certificate.recall.rows) {
+            const rate = row.rate === null ? "undefined (nothing graded)" : `${(100 * row.rate).toFixed(1)}%`;
+            const coverage = row.coverage === null ? "—" : `${(100 * row.coverage).toFixed(1)}%`;
+            lines.push(`  RECALL — ${row.repository}: ${rate} on the ${row.axis} axis ` +
+                `(${row.found}/${row.denominator}, ${row.drawn} drawn, coverage ${coverage})` +
+                (row.admissible ? "" : "   <- DISQUALIFIED AS A FIGURE, not charged to the adapter"));
+            lines.push(`    ${row.detail}; recorded by ${row.recordedBy}`);
+            if (row.secondAxis !== undefined) {
+                const second = row.secondAxis;
+                const secondRate = second.denominator === 0 ? "undefined" : `${((100 * second.found) / second.denominator).toFixed(1)}%`;
+                lines.push(`    second axis ${second.axis}: ${second.found}/${second.denominator} = ${secondRate} ` +
+                    `— reported beside the headline, never as it`);
+            }
+            if (row.generatedExcluded === undefined) {
+                // An undisclosed exclusion and no exclusion must not read the same.
+                lines.push("    no generated-code exclusion was recorded for this draw");
+            }
+            else {
+                const excluded = row.generatedExcluded;
+                lines.push(`    generated code excluded: ${excluded.files} file(s), ${excluded.sites} drawn site(s), by ` +
+                    `${excluded.rules.join(", ")} — the figure above is over a denominator that much smaller`);
+            }
+        }
+        lines.push(`    ${certificate.recall.detail}`);
+    }
     if (certificate.nextTier === null) {
         lines.push("  nothing above this tier");
         return lines.join("\n");