@erclx/canon 5.46.0 → 5.48.0

package/src/commands/pr.ts

@@ -63,6 +63,7 @@ import {
 } from '@/pr/frames'
 import { type HeadRefusal, resolveHead, resolveTip } from '@/pr/head'
 import {
+  type ChecksGate,
   DEFAULT_WAIT_SECONDS,
   type EvidenceGate,
   type GitRunner,
@@ -73,6 +74,13 @@ import {
   readBaseStanding,
   readChangedPaths,
 } from '@/pr/lift'
+import {
+  merge,
+  type MergeApi,
+  type MergeOutcome,
+  type MergeRefusal,
+  type MergeRequest,
+} from '@/pr/merge'
 import { machineListenerReader } from '@/listeners/machine'
 import { loadPaintedPatterns } from '@/pr/painted'
 import {
@@ -93,7 +101,15 @@ import {
   servesChange,
   type WorkflowFile,
 } from '@/pr/preview'
-import { type TickRefusal, tickBoxes } from '@/pr/tick'
+import { coversHead, resolveUiScope } from '@/pr/review-scope'
+import {
+  countTicksAtHead,
+  readUiPassHead,
+  type TickRefusal,
+  tickBoxes,
+  type UiPassSummary,
+  writeUiPassLine,
+} from '@/pr/tick'
 import {
   commentRowOf,
   identityOf,
@@ -144,6 +160,10 @@ interface LiftCommandOptions extends ReadOptions {
   readonly wait?: string
 }
 
+interface MergeCommandOptions extends ReadOptions {
+  readonly dryRun?: boolean
+}
+
 interface ReviewStateOptions extends ReadOptions {
   readonly wait?: string
 }
@@ -157,13 +177,23 @@ interface TickOptions extends ReadOptions {
   readonly head?: string
 }
 
-type TickReason = TickRefusal | 'stale-head' | 'bad-boxes' | 'no-comment'
+type TickReason =
+  | TickRefusal
+  | 'count-mismatch'
+  | 'stale-head'
+  | 'bad-boxes'
+  | 'no-comment'
+  | 'body-refused'
 
 const TICK_REFUSALS: Record<TickReason | 'gh-failed', string> = {
+  'body-refused':
+    'The boxes are ticked on the evidence comment, but gh could not edit the pull request body, so its UI pass line still shows the earlier result. Re-run the tick to retry the body.',
   'stale-head':
     'The head named is not the branch tip on the remote, so a tick would claim a pass on a commit that is no longer the pull request. Re-drive the checklist at the tip.',
   'bad-boxes':
     '--boxes takes box numbers as a comma-separated list of positive whole numbers, such as 1,3, and --head takes the commit that was driven.',
+  'count-mismatch':
+    'The newest UI verdict at this head passed a different number of boxes than the ticks this call would leave at the head. Nothing was written. With fewer ticks than passed, re-run once with every box that passed. With more, a box ticked earlier at this head has since failed, which only the operator can untick.',
   'no-comment': 'No comment on this pull request carries the evidence marker.',
   'no-checklist': 'The evidence comment carries no checklist to tick.',
   'no-box':
@@ -736,6 +766,11 @@ export function register(program: Command): void {
         'comment. Together with --checklist the link and the checklist land in',
         'one comment.',
         '',
+        "A render at a new head also resets the pull request body's UI pass",
+        'line, the one `canon pr tick` writes under ## Testing, to unchecked',
+        'naming that head. It touches no other body text, leaves a line already',
+        'naming this head alone, and reports `uiPass` as reset or reset-refused.',
+        '',
         'Both reasons carry what the marked comment already posted, each field',
         'present only when that comment holds it:',
         '  preview    the hosted **Preview:** address the comment carries',
@@ -816,7 +851,9 @@ export function register(program: Command): void {
         '            on an earlier commit still holds when it is an ancestor of the',
         '            head and no painted path changed since, and the record names',
         '            it as `carriedFrom`. A painted change refuses `ui-behind` and',
-        '            lists the paths as `paintedPaths`',
+        '            lists the paths as `paintedPaths`. A close whose count line',
+        '            shows boxes not driven and none passed, failed, or needing',
+        '            eyes refuses `ui-undriven`, carried or not',
         '  evidence  the evidence check reads settled',
         '  standing  the head is fresh against the base, not stale or conflicted',
         '  ci        every check run on the tip passed, waited on up to --wait',
@@ -842,7 +879,7 @@ export function register(program: Command): void {
         '  lifted, already-ready, redrafted, clear (--check)',
         '  pull-closed, review-missing, review-open, review-unmarked,',
         '  review-behind, ui-missing, ui-open, ui-unmarked, ui-behind,',
-        '  evidence-owed, standing-stale, standing-conflict, standing-unknown,',
+        '  ui-undriven, evidence-owed, standing-stale, standing-conflict, standing-unknown,',
         '  ci-pending (--check), ci-failing, ci-conflicted, ci-timeout,',
         '  head-moved, gh-failed',
         '',
@@ -863,6 +900,57 @@ export function register(program: Command): void {
       process.exitCode = await runLift(number, opts)
     })
 
+  pr.command('merge')
+    .description(
+      'Squash-merge a ready pull request with a message carrying only its Summary, Key changes, and Technical context',
+    )
+    .argument('[number]', 'Pull request to merge, defaulting to this branch')
+    .helpOption('-h, --help', 'Show this help message')
+    .option('--root <path>', 'Repository to read, defaulting to the cwd')
+    .option('--json', 'Add a machine-readable record on stdout')
+    .option('--dry-run', 'Print the title and description and merge nothing')
+    .addHelpText(
+      'after',
+      [
+        '',
+        'The operator runs this verb, and no skill calls it. A permissions deny',
+        'rule on `canon pr merge` and `gh pr merge` keeps an agent off it.',
+        '',
+        'The title is the pull request title plus ` (#<number>)`. The',
+        "description is the body's `## Summary`, `## Key changes`, and",
+        '`## Technical context`, in that order under their headings, with the',
+        'UI pass line dropped. Technical context is optional. Testing, the',
+        'reviewer requests, and every other section stay out of the trunk.',
+        '',
+        'Refusals are read before the one write, which sends the head it read',
+        'as `sha`, so a push after the read refuses rather than merging. The',
+        'verb reads the draft flag and not the reviews, since a ready pull',
+        'request already passed `canon pr lift`. It does not wait on checks or',
+        'delete the branch.',
+        '',
+        'Reasons:',
+        '  merged, dry-run (--dry-run)',
+        '  pull-closed, pull-draft, missing-summary, missing-key-changes,',
+        '  ci-failing, ci-conflicted, ci-pending, head-moved, not-mergeable,',
+        '  gh-failed',
+        '',
+        'The merge is the REST `PUT pulls/<number>/merge` with',
+        '`merge_method=squash`, never `gh pr merge`, which runs on GraphQL.',
+        '',
+        'Exit codes:',
+        '  0  merged, or every refusal clear under --dry-run',
+        '  1  refused, with the reason in the JSON record',
+        '',
+        'Examples:',
+        '  canon pr merge 1341 --dry-run',
+        '  canon pr merge 1341 --json',
+        '',
+      ].join('\n'),
+    )
+    .action(async (number: string | undefined, opts: MergeCommandOptions) => {
+      process.exitCode = await runMerge(number, opts)
+    })
+
   pr.command('preview')
     .description(
       "Deploy the pull request's branch to a Cloudflare Pages preview and report its address",
@@ -1024,8 +1112,27 @@ export function register(program: Command): void {
         'it. A later render at another head clears a tick whose stamp names',
         'a different commit.',
         '',
+        "It also keeps one marked line in the pull request body's ## Testing,",
+        'such as `- [x] UI pass, 17 of 17 boxes passed at <short sha>, 1 taste',
+        'box left to the operator`. The line is ticked only when every box a',
+        'driver can run is ticked, counts taste boxes apart, and is the only',
+        'body text this verb writes, so hand edits elsewhere survive.',
+        '',
+        'Before writing it reads the newest UI verdict. One that covers the tip',
+        'and carries a count line must match the ticks this call leaves at the',
+        'tip, so a re-drive passes every box that passed, since a new head',
+        'clears the older ticks. Any other verdict leaves the check unrun.',
+        '',
         'Read `reason` on the JSON record:',
-        '  ticked       the boxes were ticked, with the tip in `head`',
+        '  ticked       the boxes were ticked and the body line written, with the',
+        '               tip in `head` and `countCheck` as matched or unchecked',
+        '  count-mismatch the verdict passed a different number of boxes than',
+        '               this call leaves ticked at the tip, nothing written,',
+        '               `passed` and `ticked` carry the two counts. Fewer ticks',
+        '               owe a re-run with every passed box, more ticks owe the',
+        '               operator an untick of a box that has since failed',
+        '  body-refused the comment is ticked but gh could not edit the body,',
+        '               exit 1 with `commentTicked`. Re-run to retry the body.',
         '  stale-head   --head is not the remote branch tip, nothing written',
         '  taste-box    a named box ends in (taste), nothing written',
         '  no-box       a named number is past the checklist, nothing written',
@@ -2437,10 +2544,30 @@ async function runEvidence(
     return 1
   }
 
+  // A UI pass line stamped at an earlier head describes a tree that is gone,
+  // so a render at a new head puts it back to unchecked. A line already
+  // naming this head is left alone, since each body edit reruns the label gate.
+  const priorBody = identity.body ?? ''
+  const stampedHead = readUiPassHead(priorBody)
+  let uiPass: 'reset' | 'reset-refused' | undefined
+  if (stampedHead !== undefined && !identity.head.startsWith(stampedHead)) {
+    const reset = writeUiPassLine(priorBody, {
+      kind: 'reset',
+      head: identity.head,
+    })
+    uiPass = (await patchPullBody(root, identity.number, reset))
+      ? 'reset'
+      : 'reset-refused'
+  }
+
   logStep('Scope')
   logInfo(
     `${plural(caseCount, 'case')} across ${plural(states.length, 'state')}`,
   )
+  if (uiPass === 'reset') logInfo('UI pass line reset to the new head')
+  if (uiPass === 'reset-refused') {
+    logWarn('gh could not edit the body, so its UI pass line names an old head')
+  }
   if (sized.unread.length > 0) {
     logWarn(
       `width unread for ${plural(sized.unread.length, 'image')}, rendered at 1000: ${sized.unread.join(', ')}`,
@@ -2469,6 +2596,7 @@ async function runEvidence(
         body,
         states,
         ...(sized.unread.length > 0 && { widthUnread: sized.unread }),
+        ...(uiPass !== undefined && { uiPass }),
         ...(commentId !== undefined && { commentId }),
         ...carried,
       })}\n`,
@@ -2929,6 +3057,32 @@ async function runTick(
   const result = tickBoxes(marked.body, numbers.map(Number), reading.tip)
   if (result.kind === 'refused') return refuseTick(result.reason)
 
+  // Read ahead of the write so a short list refuses before it leaves the
+  // comment half ticked. A verdict that does not cover the tip, carries no
+  // count line, or cannot be read leaves the check unrun and says so.
+  const ticked = countTicksAtHead(
+    readChecklistBoxes(findEvidenceChecklist([{ body: result.body }]) ?? ''),
+    reading.tip,
+  )
+  const reviews = await listReviews(root, String(identity.number))
+  const verdict = resolveUiScope({
+    reviews: reviews.kind === 'read' ? reviews.rows.map(reviewRowOf) : [],
+  })
+  const isCounted =
+    verdict.counts !== undefined &&
+    verdict.commit !== undefined &&
+    coversHead(verdict.commit, reading.tip)
+  if (isCounted && verdict.counts.passed !== ticked) {
+    return refuseWith(
+      'count-mismatch',
+      TICK_REFUSALS['count-mismatch'],
+      emitJson,
+      root,
+      { passed: verdict.counts.passed, ticked },
+    )
+  }
+  const countCheck = isCounted ? 'matched' : 'unchecked'
+
   if (result.body !== marked.body) {
     const patched = await gh(root, [
       'api',
@@ -2941,9 +3095,47 @@ async function runTick(
     if (patched === null) return refuseTick('gh-failed')
   }
 
+  const boxes = readChecklistBoxes(
+    findEvidenceChecklist([{ body: result.body }]) ?? '',
+  )
+  const driven = boxes.filter((box) => !box.isTaste)
+  const summary: UiPassSummary = {
+    kind: 'passed',
+    passed: countTicksAtHead(boxes, reading.tip),
+    total: driven.length,
+    taste: boxes.length - driven.length,
+    head: reading.tip,
+  }
+  const priorBody = identity.body ?? ''
+  const nextBody = writeUiPassLine(priorBody, summary)
+  if (
+    nextBody !== priorBody &&
+    !(await patchPullBody(root, identity.number, nextBody))
+  ) {
+    logStep('Partly ticked')
+    logWarn(TICK_REFUSALS['body-refused'])
+    outro()
+    if (emitJson) {
+      process.stdout.write(
+        `${JSON.stringify({
+          root,
+          number: identity.number,
+          reason: 'body-refused',
+          message: TICK_REFUSALS['body-refused'],
+          commentTicked: true,
+          countCheck,
+          head: reading.tip,
+          boxes: numbers.map(Number),
+          commentId,
+        })}\n`,
+      )
+    }
+    return 1
+  }
+
   logStep('Ticked')
   logInfo(
-    `${plural(numbers.length, 'box')} at ${reading.tip.slice(0, 7)} on comment ${commentId}`,
+    `${plural(numbers.length, 'box')} at ${reading.tip.slice(0, 7)} on comment ${commentId}, UI pass line on the body`,
   )
   outro()
   if (emitJson) {
@@ -2952,6 +3144,7 @@ async function runTick(
         root,
         number: identity.number,
         reason: 'ticked',
+        countCheck,
         head: reading.tip,
         boxes: numbers.map(Number),
         commentId,
@@ -2961,6 +3154,23 @@ async function runTick(
   return 0
 }
 
+/** Replaces a pull request's body, which `gh` takes through the REST pulls endpoint a cloud proxy serves. */
+async function patchPullBody(
+  root: string,
+  number: number,
+  body: string,
+): Promise<boolean> {
+  const patched = await gh(root, [
+    'api',
+    '-X',
+    'PATCH',
+    `repos/{owner}/{repo}/pulls/${number}`,
+    '-f',
+    `body=${body}`,
+  ])
+  return patched !== null
+}
+
 /** One `gh api` call, keeping the HTTP status of a failure so a refused write can be told from a missing ref. */
 type ApiCall =
   | { readonly ok: true; readonly data: unknown }
@@ -3334,6 +3544,8 @@ const LIFT_REFUSALS: Record<LiftRefusal | 'bad-wait' | 'gh-missing', string> = {
     'The newest UI review carries no head marker, so the commit it covers is a GitHub stamp this gate does not trust.',
   'ui-behind':
     'The newest UI review closed on an earlier commit than the head.',
+  'ui-undriven':
+    'The newest UI review closed having driven no box, so it looked at nothing. Re-drive the checklist on an address that answers.',
   'evidence-owed':
     'The evidence check reads owed, so the ship chain left a step undone.',
   'standing-stale':
@@ -3455,6 +3667,34 @@ async function readEvidenceGate(
   }
 }
 
+async function readChecksGate(
+  root: string,
+  number: string,
+  tip: string,
+): Promise<ChecksGate | undefined> {
+  const [listed, pulled] = await Promise.all([
+    gh(root, [
+      'api',
+      `repos/{owner}/{repo}/commits/${tip}/check-runs?per_page=100`,
+    ]),
+    gh(root, ['api', `repos/{owner}/{repo}/pulls/${number}`]),
+  ])
+  if (listed === null) return undefined
+  try {
+    const mergeState =
+      pulled === null
+        ? undefined
+        : mergeStateOf((JSON.parse(pulled) as RestPull).mergeable_state)
+    const reading = withMergeState(
+      mergeState,
+      collapseChecks(tip, JSON.parse(listed) as CheckRunListing),
+    )
+    return { state: reading.state, isConflicted: reading.conflicted }
+  } catch {
+    return undefined
+  }
+}
+
 function liftApi(root: string, number: string, baseRef: string): LiftApi {
   const git = gitRunner(root)
 
@@ -3492,29 +3732,7 @@ function liftApi(root: string, number: string, baseRef: string): LiftApi {
     readEvidence: () => readEvidenceGate(root, number),
     readStanding: (head) =>
       readBaseStanding(git, Number(number), head, baseRef),
-    readChecks: async (tip) => {
-      const [listed, pulled] = await Promise.all([
-        gh(root, [
-          'api',
-          `repos/{owner}/{repo}/commits/${tip}/check-runs?per_page=100`,
-        ]),
-        gh(root, ['api', `repos/{owner}/{repo}/pulls/${number}`]),
-      ])
-      if (listed === null) return undefined
-      try {
-        const mergeState =
-          pulled === null
-            ? undefined
-            : mergeStateOf((JSON.parse(pulled) as RestPull).mergeable_state)
-        const reading = withMergeState(
-          mergeState,
-          collapseChecks(tip, JSON.parse(listed) as CheckRunListing),
-        )
-        return { state: reading.state, isConflicted: reading.conflicted }
-      } catch {
-        return undefined
-      }
-    },
+    readChecks: (tip) => readChecksGate(root, number, tip),
     markReady: (nodeId) =>
       flipDraft(
         root,
@@ -3616,6 +3834,160 @@ async function runLift(
   return record.isOk ? 0 : 1
 }
 
+const MERGE_REFUSALS: Record<MergeRefusal | 'gh-missing', string> = {
+  'gh-missing': PULL_REFUSALS['gh-missing'],
+  'pull-closed': 'The pull request is closed, so there is nothing to merge.',
+  'pull-draft':
+    'The pull request is a draft, so its reviews have not lifted the mark.',
+  'missing-summary':
+    'The body carries no `## Summary` with text under it, so the description has no change to state.',
+  'missing-key-changes':
+    'The body carries no `## Key changes` with text under it, so the description has no change to state.',
+  'ci-failing': 'A check run on the head failed.',
+  'ci-conflicted': 'The branch conflicts with its base.',
+  'ci-pending':
+    'A check run on the head has yet to conclude. Run the verb again once it does.',
+  'head-moved':
+    'The head moved after the read, so GitHub refused rather than merging unread commits.',
+  'not-mergeable': 'GitHub answered that the pull request is not mergeable.',
+  'gh-failed':
+    'A read or the merge was refused, so nothing is reported as merged.',
+}
+
+/**
+ * The REST merge, never `gh pr merge`, which runs on the GraphQL a cloud
+ * session's proxy refuses. gh reports the status only as the `(HTTP <code>)`
+ * tail of its stderr, so 409 and 405 are read off it.
+ */
+async function putSquashMerge(
+  root: string,
+  number: string,
+  request: MergeRequest,
+): Promise<MergeOutcome> {
+  const result = await execa(
+    'gh',
+    [
+      'api',
+      '-X',
+      'PUT',
+      `repos/{owner}/{repo}/pulls/${number}/merge`,
+      '-f',
+      `commit_title=${request.title}`,
+      '-f',
+      `commit_message=${request.description}`,
+      '-f',
+      `sha=${request.sha}`,
+      '-f',
+      'merge_method=squash',
+    ],
+    {
+      cwd: root,
+      reject: false,
+      timeout: GH_TIMEOUT_MS,
+      env: gitEnv(),
+      extendEnv: false,
+    },
+  )
+  if (result.exitCode !== 0) {
+    const status = /\(HTTP (\d{3})\)/.exec(String(result.stderr))?.[1]
+    if (status === '409') return { kind: 'head-moved' }
+    if (status === '405') return { kind: 'not-mergeable' }
+    return { kind: 'failed' }
+  }
+  try {
+    const body = JSON.parse(String(result.stdout)) as {
+      merged?: unknown
+      sha?: unknown
+    }
+    return body.merged === true && typeof body.sha === 'string'
+      ? { kind: 'merged', sha: body.sha }
+      : { kind: 'failed' }
+  } catch {
+    return { kind: 'failed' }
+  }
+}
+
+function mergeApi(root: string, number: string): MergeApi {
+  return {
+    readPull: async () => {
+      const stdout = await gh(root, [
+        'api',
+        `repos/{owner}/{repo}/pulls/${number}`,
+      ])
+      if (stdout === null) return undefined
+      try {
+        const row = JSON.parse(stdout) as RestPull
+        if (row.head?.sha === undefined || typeof row.title !== 'string') {
+          return undefined
+        }
+        return {
+          isOpen: row.state === 'open',
+          isDraft: row.draft === true,
+          title: row.title,
+          body: row.body ?? '',
+          head: row.head.sha,
+        }
+      } catch {
+        return undefined
+      }
+    },
+    readChecks: (head) => readChecksGate(root, number, head),
+    putMerge: (request) => putSquashMerge(root, number, request),
+  }
+}
+
+async function runMerge(
+  number: string | undefined,
+  opts: MergeCommandOptions,
+): Promise<number> {
+  const root = resolve(opts.root ?? process.cwd())
+  const emitJson = opts.json ?? false
+
+  intro('canon pr merge')
+
+  if (Bun.which('gh') === null) {
+    return refuseWith(
+      'gh-missing',
+      MERGE_REFUSALS['gh-missing'],
+      emitJson,
+      root,
+    )
+  }
+
+  const resolved = await resolvePullNumber(root, number)
+  if (resolved.kind === 'refused') {
+    return refuseWith(
+      resolved.reason,
+      PULL_REFUSALS[resolved.reason],
+      emitJson,
+      root,
+    )
+  }
+
+  const record = await merge(mergeApi(root, resolved.number), {
+    number: Number(resolved.number),
+    isDryRun: opts.dryRun ?? false,
+  })
+
+  logStep(record.reason)
+  logInfo(
+    record.reason === 'merged'
+      ? `#${record.number} squash-merged as ${record.sha?.slice(0, 8)}`
+      : record.reason === 'dry-run'
+        ? `#${record.number} would merge with the message below`
+        : MERGE_REFUSALS[record.reason],
+  )
+  outro()
+
+  if (emitJson) {
+    process.stdout.write(`${JSON.stringify({ root, ...record })}\n`)
+  } else if (record.reason === 'dry-run') {
+    process.stdout.write(`${record.title}\n\n${record.description}\n`)
+  }
+
+  return record.isOk ? 0 : 1
+}
+
 /**
  * Frames a refusal on stderr in both modes and puts the record on stdout alone,
  * so an operator reading the terminal sees the reason rather than a command
@@ -3630,13 +4002,16 @@ function refuseWith(
   message: string,
   emitJson: boolean,
   root: string,
+  extra: Record<string, unknown> = {},
 ): number {
   logStep('Refused')
   logWarn(message)
   outro()
 
   if (emitJson) {
-    process.stdout.write(`${JSON.stringify({ root, reason, message })}\n`)
+    process.stdout.write(
+      `${JSON.stringify({ root, reason, message, ...extra })}\n`,
+    )
   }
   return 1
 }

package/src/commands/sessions.ts

@@ -3,6 +3,7 @@ import type { Command } from 'commander'
 import { checkClaim, type ClaimReport } from '@/sessions/claim'
 import {
   callerIdentity,
+  confidenceOf,
   repositoryOf,
   type ResolvedSession,
   resolveSessions,
@@ -134,15 +135,21 @@ export function register(program: Command): void {
         '',
         'The confidence field says how the liveness of a row was decided.',
         '"confirmed" matched the running process against the start time the',
-        'record stamped. "unverified" means only that the pid answers, which',
-        'cannot rule out a pid handed to an unrelated process, so a roster',
-        'reported that way is a candidate list rather than an identity.',
+        'record stamped, and reads "via": "pid". "unverified" means only that the',
+        'pid answers, which cannot rule out a pid handed to an unrelated',
+        'process, so a roster reported that way is a candidate list rather than',
+        'an identity. Where the start time cannot be read, a row whose messaging',
+        'socket accepts a connection is confirmed instead and reads "via":',
+        '"listener". The probe connects and closes without writing. Each row',
+        'carries its own "confidence", and the top-level field is the weakest of',
+        'the rows listed, so --branch is not weakened by a row it dropped.',
         '',
         'A reader in another pid namespace, such as a sandboxed shell, cannot',
         'see the pid of a record stamped elsewhere. That row is judged on its',
         'messaging socket instead: it stays on the roster as "unverified" with',
         '"via": "socket", since a crashed session leaves its socket behind. A',
-        'foreign record whose socket is gone is left off the roster and',
+        'foreign record whose socket accepts a connection is confirmed as',
+        '"listener". One whose socket is gone is left off the roster and',
         'counted in "foreignDead", so an empty roster beside a count above zero',
         'is one this reader could not check, not one whose sessions ended.',
         '',
@@ -471,7 +478,7 @@ async function runList(opts: ListCommandOptions): Promise<number> {
     : null
 
   intro('canon sessions list')
-  reportConfidence(report)
+  reportConfidence(shown, report)
   reportSessions(
     shown,
     opts.branch,
@@ -486,7 +493,8 @@ async function runList(opts: ListCommandOptions): Promise<number> {
     process.stdout.write(
       `${JSON.stringify({
         dir: report.dir,
-        confidence: report.confidence,
+        // Over the rows shown, so an unrelated row --branch dropped cannot weaken it.
+        confidence: confidenceOf(shown),
         foreignDead: report.foreignDead,
         branch: opts.branch ?? null,
         repository,
@@ -528,6 +536,7 @@ function selfRefusal(own: Extract<SelfReport, { kind: 'unresolved' }>): string {
  * addresses a session directly and the second opens by asking to be corrected.
  */
 function reportConfidence(
+  shown: readonly ResolvedSession[],
   report: Extract<SessionReport, { kind: 'resolved' }>,
 ): void {
   logStep('Liveness')
@@ -535,23 +544,28 @@ function reportConfidence(
   // A roster of none decided nothing, so the confirmed line would claim a check
   // over rows that do not exist. The registry is never pruned and holds a record
   // per session ever run, which is what makes the empty result worth stating.
-  if (report.sessions.length === 0) {
+  if (shown.length === 0) {
     logInfo(
-      report.foreignDead > 0
+      report.foreignDead > 0 || report.sessions.length > 0
         ? 'No row to decide.'
         : 'No row to decide. Every record belongs to a session that has ended.',
     )
     return
   }
 
-  if (report.confidence === 'confirmed') {
+  if (confidenceOf(shown) === 'confirmed') {
+    const listened = shown.filter(
+      (session) => session.via === 'listener',
+    ).length
     logInfo(
-      'Every row matched a running process against the start time its record stamped.',
+      listened === 0
+        ? 'Every row matched a running process against the start time its record stamped.'
+        : `Every row is confirmed, ${listened} of them because their messaging socket accepted a connection and the rest by start time.`,
     )
     return
   }
 
-  if (report.sessions.some((session) => session.via === 'socket')) {
+  if (shown.some((session) => session.via === 'socket')) {
     logWarn(
       'This reader sits in another pid namespace than some records, so those rows rest on a messaging socket existing alone. A crashed session leaves its socket behind, so treat the mapping as inferred and open by asking to be corrected.',
     )