@event4u/agent-config 14.14.0 → 14.15.0

package/src/scripts/check_web_launch_readiness.ts

@@ -21,14 +21,16 @@
  * (`claim:web-launch-readiness-finds-more`, status `unbacked`). Absent the
  * opt-in, this exits 0 and says why rather than auditing.
  *
- * Exit codes: 0 = no critical/high finding (or not enabled) · 1 = a blocking
- * finding · 2 = usage or a dead scan scope.
+ * Exit codes: 0 = no critical/high finding and nothing left undecided (or not
+ * enabled) · 1 = a blocking finding, OR an applicable check the instrument could
+ * not decide · 2 = usage or a dead scan scope.
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath } from 'node:url';
 
+import { asOf } from './_lib/as_of.js';
 import { DeadScopeError, reportScanned } from './_lib/scan_scope.js';
 
 const HERE = fileURLToPath(import.meta.url);
@@ -42,7 +44,12 @@ export type Tier = 'critical' | 'high' | 'medium' | 'situational';
  *
  * `applies_to` decides WHETHER a check applies; a region decides HOW SEVERELY.
  * A legal page is not more or less *applicable* in Germany — it is more or less
- * *optional*, because TMG 5 and DSGVO Art. 13 make it owed rather than advisable.
+ * *optional*, because German and EU law make it owed rather than advisable. The
+ * two citations behind that sentence are NOT restated here: they live in the
+ * escalation row's `authority` field in `web-launch-readiness.json`, where a
+ * `review_by` date can lapse them. That is the whole point of the
+ * `ddg-citation-authority` decision — a statute in prose cited law already dead
+ * for twenty-seven months and nothing could see it.
  * Modelling it as a tier escalation keeps one check with one implementation and
  * puts the jurisdiction where it belongs: on the consequence.
  */
@@ -56,6 +63,10 @@ export interface CheckDef {
     why: string;
     remediation: string;
     verification: string;
+    /** Statute + where it can be read. Required once the row asserts a legal basis. */
+    authority?: string;
+    /** ISO date the citation must be re-read by. A lapsed date FAILS the loader. */
+    review_by?: string;
 }
 
 export interface Finding {
@@ -75,6 +86,22 @@ export interface Skipped {
     reason: string;
 }
 
+/**
+ * An applicable check the instrument could not decide.
+ *
+ * NOT a finding (nothing was established) and NOT a pass (nothing was cleared).
+ * The third state exists because a detector that guesses on an undecidable input
+ * is worse than one that abstains — and because a pass this checker did not earn
+ * is exactly the silent-green defect its own header names.
+ */
+export interface Undecided {
+    check: string;
+    tier: Tier;
+    /** `file:line` the instrument stopped at, so the reader can look at it. */
+    location: string;
+    reason: string;
+}
+
 /** A tier the region axis moved, and why. Reported so the axis is visible. */
 export interface Escalated {
     check: string;
@@ -93,6 +120,8 @@ export interface Report {
     passed: string[];
     /** Applicable checks with no implementation yet — never counted as passed. */
     unimplemented: string[];
+    /** Applicable, implemented, and undecidable on THIS input. Never a pass. */
+    unknown: Undecided[];
     /** Tiers the region axis raised. Empty on `unspecified`, by construction. */
     escalated: Escalated[];
     scanned_files: number;
@@ -103,6 +132,141 @@ export interface Escalation {
     region: Region;
     to: Tier;
     why: string;
+    /** Same contract as `CheckDef` — an escalation row is a legal claim too. */
+    authority?: string;
+    review_by?: string;
+}
+
+/* -- 2.1/2.2: a legal claim carries its own authority and expiry ------------ */
+
+/**
+ * A statute reference: a named instrument, or a numbered article/section.
+ *
+ * The list is deliberately short and abbreviation-shaped. A broader "any legal
+ * word" match would fire on `regulatory exposure` and turn every jurisdictional
+ * sentence into a citation the gate then demands a source for — which is how a
+ * scoped gate becomes a blanket one nobody can satisfy. The numbered-provision
+ * arm (`Art. 13`, `§ 5`) catches an instrument the list does not name yet.
+ *
+ * `TMG` is retained as a token on purpose, and this is a HISTORICAL NOTE rather
+ * than a citation: the statute was superseded by the DDG in May 2024, so a row
+ * that names it again is exactly what this detector must still catch.
+ */
+export const STATUTE_RE =
+    /\b(TMG|DDG|TTDSG|TDDDG|DSGVO|GDPR|BDSG|RDG|UWG|BGB|HGB|StGB|CCPA|CPRA|HIPAA|ePrivacy|DSA|DMA|BFSG|EAA)\b|(?:\bArt\.|\bArticle\b|§)\s*\d/;
+
+/** A config row that may assert a legal basis: a check, or a region escalation. */
+export interface LegalRow {
+    kind: 'check' | 'escalation';
+    id: string;
+    why: string;
+    authority?: string;
+    review_by?: string;
+}
+
+const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+
+/**
+ * Today, as an ISO date, through the repository's one sanctioned clock seam.
+ *
+ * NOT `new Date()`: a lapsed-date verdict read off the wall clock is a verdict
+ * that greens on Monday and reds on Friday from the same tree, which is the
+ * defect `lint_deterministic_time` exists to keep out of a gate. `asOf()`
+ * resolves `--as-of`, `AC_AS_OF`, the commit date under CI, and only then the
+ * wall clock — with its own non-reproducibility warning attached.
+ */
+export function asOfToday(): string {
+    return asOf().toISOString().slice(0, 10);
+}
+
+/** Every row of the config that could carry a legal claim, in report order. */
+export function legalRowsOf(doc: {
+    checks?: CheckDef[];
+    regions?: { escalations?: Escalation[] };
+}): LegalRow[] {
+    const rows: LegalRow[] = [];
+    for (const c of doc.checks ?? []) {
+        rows.push({
+            kind: 'check',
+            id: c.id,
+            why: c.why ?? '',
+            ...(c.authority === undefined ? {} : { authority: c.authority }),
+            ...(c.review_by === undefined ? {} : { review_by: c.review_by }),
+        });
+    }
+    for (const e of doc.regions?.escalations ?? []) {
+        rows.push({
+            kind: 'escalation',
+            id: `${e.check}@${e.region}`,
+            why: e.why ?? '',
+            ...(e.authority === undefined ? {} : { authority: e.authority }),
+            ...(e.review_by === undefined ? {} : { review_by: e.review_by }),
+        });
+    }
+    return rows;
+}
+
+/**
+ * The legal-row contract, as a list of violations (empty = clean).
+ *
+ * Three obligations, and the third is the one that makes the other two more
+ * than decoration:
+ *
+ *   1. a row whose `why` NAMES a statute must carry `authority` and `review_by`;
+ *   2. `authority` and `review_by` travel together — a citation with no expiry
+ *      is the comment this contract exists to replace, and an expiry with no
+ *      citation dates nothing. This half is what keeps the contract intact when
+ *      the statute moves OUT of the prose and INTO `authority`;
+ *   3. a `review_by` on or after `asOf` is live; anything earlier is LAPSED and
+ *      is a violation rather than a warning. A date nothing reads is a comment,
+ *      and this repository already documents a warning ignored eighteen times.
+ *
+ * A row that asserts no legal basis is not policed. The gate is scoped, not
+ * blanket: demanding a citation from `A framework default error page loses the
+ * visitor` would make the contract unsatisfiable and therefore ignorable.
+ */
+export function legalRowViolations(rows: readonly LegalRow[], asOf: string): string[] {
+    const out: string[] = [];
+    for (const r of rows) {
+        const namesStatute = STATUTE_RE.test(r.why);
+        const hasAuthority = (r.authority ?? '').trim().length > 0;
+        const hasDate = (r.review_by ?? '').trim().length > 0;
+        const where = `${r.kind} "${r.id}"`;
+        // One violation per MISSING FIELD, never one per rule that noticed it.
+        // Dropping `authority` from a statute row trips both obligation 1 and
+        // obligation 2, and reporting it twice would make the count a property
+        // of the rule set rather than of the config.
+        const isLegal = namesStatute || hasAuthority || hasDate;
+        if (isLegal && !hasAuthority) {
+            out.push(
+                `${where}: carries no \`authority\` — ` +
+                    (namesStatute
+                        ? 'its `why` names a statute, and a citation with no source is a comment rather than a claim anyone can re-check.'
+                        : 'a `review_by` with no citation dates nothing.'),
+            );
+        }
+        if (isLegal && !hasDate) {
+            out.push(
+                `${where}: carries no \`review_by\` — ` +
+                    (namesStatute
+                        ? 'its `why` names a statute, and the citation has no date by which it must be re-read.'
+                        : 'an undated citation cannot go stale visibly.'),
+            );
+        }
+        if (!hasDate) continue;
+        const date = (r.review_by ?? '').trim();
+        if (!ISO_DATE_RE.test(date) || Number.isNaN(Date.parse(date))) {
+            out.push(`${where}: \`review_by\` is "${date}", which is not an ISO YYYY-MM-DD date.`);
+            continue;
+        }
+        if (date < asOf) {
+            out.push(
+                `${where}: \`review_by\` lapsed on ${date} (as of ${asOf}) — re-read the citation, ` +
+                    'then move the date. Overdue is a finding, not a silent pass.',
+            );
+        }
+    }
+    return out;
 }
 
 export function loadConfig(root = REPO_ROOT): {
@@ -144,6 +308,15 @@ export function loadConfig(root = REPO_ROOT): {
                 'situational tier for a legally owed page.',
         );
     }
+    const legal = legalRowViolations(legalRowsOf(doc), asOfToday());
+    if (legal.length > 0) {
+        // A gate that audited a site while shipping an unbacked legal claim of
+        // its own would be auditing from a position it has not earned.
+        throw new DeadScopeError(
+            'check_web_launch_readiness',
+            `${CONFIG_REL} ships a legal claim the row cannot back:\n  - ${legal.join('\n  - ')}`,
+        );
+    }
     return { checks, siteTypes, regions, escalations };
 }
 
@@ -479,17 +652,44 @@ const requiredLegalPages: Impl = (files) => {
 };
 
 /**
- * Analytics loads only behind consent.
+ * Analytics loads only behind consent — INCLUDING the load order (3.1).
+ *
+ * The row's own `verification` field asks for the runtime assertion: *"Load the
+ * page with consent declined and assert no request to the analytics origin."*
+ * A static reader cannot load a page. The strongest assertion it CAN make is
+ * source order within one document, so that is what it makes — and where even
+ * that is undecidable it returns `unknown` (3.2) rather than a pass.
  *
- * The finding is analytics present with NO consent mechanism anywhere in the
- * build — never "analytics present", which would flag every site that does
- * consent correctly. The gate cannot see the wiring order, and says so in the
- * evidence rather than implying it checked.
+ * What the ordering pass covers, stated so the message can say it: the position
+ * of the measurement tag relative to the gate script INSIDE one file. What it
+ * does not cover: runtime order, deferred or dynamic imports, order established
+ * by a bundler across files, and anything a minifier put on one line — each of
+ * which produces an `unknown`, never a silent pass.
  */
 const ANALYTICS_RE = /(googletagmanager\.com|google-analytics\.com|gtag\(|plausible\.io|matomo|segment\.com|hotjar)/i;
 const CONSENT_RE = /(consent|cookiebanner|cookie-banner|cookieconsent|klaro|usercentrics|borlabs|osano)/i;
-const analyticsAndConsent: Impl = (files) => {
+
+/**
+ * A line that can actually LOAD something, as opposed to prose about loading.
+ *
+ * `consent-order-bad` says the word *consent* in its `<meta description>` and
+ * still fires: a sentence describing a gate is not a gate, and a positional
+ * detector that counted it would report a correctly ordered page while the tag
+ * fires first. Applied to markup only — every line of a `.js` file is code.
+ */
+const EXECUTABLE_LINE_RE = /<script\b|\bsrc\s*=|\bimport\b|\brequire\s*\(|\.js\b/i;
+
+/** Past this, a line is a bundler artefact and its internal order is not source order. */
+const MINIFIED_LINE_CHARS = 400;
+
+interface ConsentOrder {
+    hits: Located[];
+    undecided: Located[];
+}
+
+function analyseConsentOrder(files: readonly SourceFile[]): ConsentOrder {
     const hits: Located[] = [];
+    const undecided: Located[] = [];
     // Prose is excluded from BOTH sides, and the fixture is why: a `.md` file
     // in the build tree describing the consent banner matched CONSENT_RE, so
     // the check reported a pass on a fixture seeded to fire it. Documentation
@@ -497,21 +697,92 @@ const analyticsAndConsent: Impl = (files) => {
     // runs the other way, so an analytics name mentioned in a README must not
     // count as analytics either.
     const code = files.filter((f) => !/\.md$/i.test(f.base));
-    const anyConsent = code.some((f) => CONSENT_RE.test(f.text));
-    if (anyConsent) return hits;
+    const loadable = (f: SourceFile, line: string): boolean => !isPage(f) || EXECUTABLE_LINE_RE.test(line);
+    const firstLoad = (f: SourceFile, re: RegExp): number =>
+        f.lines.findIndex((l) => re.test(l) && loadable(f, l));
+    const anyConsent = code.some((f) => firstLoad(f, CONSENT_RE) >= 0);
+
     for (const f of code) {
-        f.lines.forEach((line, i) => {
-            if (!ANALYTICS_RE.test(line)) return;
+        const a = firstLoad(f, ANALYTICS_RE);
+        if (a < 0) continue;
+        if (!anyConsent) {
+            // Unchanged from the pre-3.1 behaviour, and still the sharpest
+            // finding available: nothing in the build can gate the tag.
+            f.lines.forEach((line, i) => {
+                if (!ANALYTICS_RE.test(line) || !loadable(f, line)) return;
+                hits.push({
+                    file: f.rel,
+                    line: i + 1,
+                    text:
+                        `${line.trim().slice(0, 120)} — analytics is loaded here and no consent mechanism ` +
+                        'was found anywhere in the build, so nothing can gate it. Source order was not the ' +
+                        'question: there is no gate to be ordered against.',
+                });
+            });
+            continue;
+        }
+        const c = firstLoad(f, CONSENT_RE);
+        const aLine = f.lines[a] ?? '';
+        if (c < 0) {
+            undecided.push({
+                file: f.rel,
+                line: a + 1,
+                text:
+                    'analytics is loaded here and the consent mechanism lives in another file. Which of ' +
+                    'the two the browser runs first is decided by the bundler and the page, not by source ' +
+                    'order across files, and a static read cannot establish it.',
+            });
+            continue;
+        }
+        if (c === a) {
+            undecided.push({
+                file: f.rel,
+                line: a + 1,
+                text:
+                    'the analytics tag and the consent gate are on the SAME line, so line order cannot ' +
+                    'separate them. Ordering is undecidable on this input.',
+            });
+            continue;
+        }
+        if (aLine.length > MINIFIED_LINE_CHARS) {
+            undecided.push({
+                file: f.rel,
+                line: a + 1,
+                text:
+                    `this line is ${String(aLine.length)} characters, i.e. minified — the order inside a ` +
+                    'bundler artefact is not the source order this pass reads.',
+            });
+            continue;
+        }
+        if (a < c) {
             hits.push({
                 file: f.rel,
-                line: i + 1,
+                line: a + 1,
                 text:
-                    `${line.trim().slice(0, 120)} — analytics present and no consent mechanism ` +
-                    'found anywhere in the build. Load order is NOT checked here.',
+                    `${aLine.trim().slice(0, 120)} — the analytics tag is at line ${String(a + 1)}, ` +
+                    `ABOVE the consent gate at line ${String(c + 1)} of the same file, so it is reached ` +
+                    'before consent can be recorded. Source order inside this file is what was checked; ' +
+                    'runtime order, dynamic imports and cross-file bundler order were not.',
             });
-        });
+        }
     }
-    return hits;
+    return { hits, undecided };
+}
+
+const analyticsAndConsent: Impl = (files) => analyseConsentOrder(files).hits;
+
+/**
+ * Checks that can report `unknown`, and the probe that decides when they do.
+ *
+ * A separate table rather than a widened `Impl` signature: the invariant that an
+ * EMPTY `Located[]` means "applied and found nothing" is what keeps the
+ * silent-green defect out of `IMPLS`, and folding a third state into that return
+ * type would put the invariant back in play for all eight implementations.
+ */
+type Undecide = (files: readonly SourceFile[]) => Located[];
+
+export const UNDECIDABLE: Readonly<Record<string, Undecide>> = {
+    'analytics-and-consent-wiring': (files) => analyseConsentOrder(files).undecided,
 };
 
 /** First line containing `needle`, 1-indexed; 1 when absent (an absence has no line). */
@@ -560,6 +831,7 @@ export function audit(
     const skipped: Skipped[] = [];
     const passed: string[] = [];
     const unimplemented: string[] = [];
+    const unknown: Undecided[] = [];
     const escalated: Escalated[] = [];
     // ONE walk for every check. Eight walkers over the same bytes is eight
     // times the IO and eight chances to disagree about what counts as a file.
@@ -586,7 +858,11 @@ export function audit(
             impl === undefined
                 ? scanIndexability(buildDir).hits
                 : impl(files);
-        if (hits.length === 0) {
+        const undecided = UNDECIDABLE[c.id]?.(files) ?? [];
+        for (const u of undecided) {
+            unknown.push({ check: c.id, tier, location: `${u.file}:${String(u.line)}`, reason: u.text });
+        }
+        if (hits.length === 0 && undecided.length === 0) {
             passed.push(c.id);
             continue;
         }
@@ -609,6 +885,7 @@ export function audit(
         skipped,
         passed,
         unimplemented,
+        unknown,
         escalated,
         scanned_files: files.length,
     };
@@ -637,6 +914,15 @@ export function render(r: Report): string {
             out.push(`    verification: ${x.verification}`);
         }
     }
+    if (r.unknown.length > 0) {
+        // Printed with the findings rather than with the passes, because an
+        // undecided check is an open question about the site — not a clearance.
+        out.push('', `UNDECIDED — applicable, audited, and not decidable from this build (${String(r.unknown.length)})`);
+        for (const u of r.unknown) {
+            out.push(`  ${u.location}  ${u.check}`);
+            out.push(`    unknown: ${u.reason}`);
+        }
+    }
     if (r.passed.length > 0) out.push('', `PASSED: ${r.passed.join(', ')}`);
     if (r.unimplemented.length > 0) {
         out.push('', `NOT YET IMPLEMENTED (applicable, not audited): ${r.unimplemented.join(', ')}`);
@@ -697,7 +983,11 @@ export function main(argv: string[] = process.argv.slice(2), root = REPO_ROOT):
         process.stdout.write(`${render(r)}\n`);
     }
     const blocking = r.findings.filter((f) => f.tier === 'critical' || f.tier === 'high');
-    return blocking.length > 0 ? 1 : 0;
+    // An UNDECIDED applicable check exits non-zero whatever its tier. Exiting 0
+    // would report the run as clean on a question the instrument never answered,
+    // which is the same silent-green failure as counting an unimplemented check
+    // as passed — the tier axis grades findings, and this is not one.
+    return blocking.length > 0 || r.unknown.length > 0 ? 1 : 0;
 }
 
 if (path.resolve(process.argv[1] ?? '') === path.resolve(HERE)) {

package/src/scripts/evolution_lab.ts

@@ -89,6 +89,8 @@ import {
 } from './_lib/promotion_evidence.js';
 import { MERGE_AUTHORITY_ROADMAP, readMergeAuthorityStatus } from './_lib/promotion_capability.js';
 import { assertNotSemanticNoOp, isSemanticNoOp, SemanticNoOpError } from './_lib/semantic_noop.js';
+import { buildRunSpec } from './_lib/experiment_binding.js';
+import { ExperimentDriftError, assertUnchanged, freeze } from './_lib/experiment_freeze.js';
 import {
     RECIPES,
     byteCompare,
@@ -635,6 +637,15 @@ function guardAbort(e: unknown): number | undefined {
         );
         return EXIT_GUARD_ABORT;
     }
+    if (e instanceof ExperimentDriftError) {
+        process.stderr.write(
+            `evolution_lab: ABORTED on experiment drift (moved: ${e.changed.join(', ')})\n` +
+                `  ${e.message}\n` +
+                '  The run cloned one record set and would have scored another. Nothing is\n' +
+                '  reported: an ROI figure over a set that moved mid-run is not a comparison.\n',
+        );
+        return EXIT_GUARD_ABORT;
+    }
     if (e instanceof BudgetConfigError) {
         process.stderr.write(`evolution_lab: ABORTED — ${(e as Error).message}\n`);
         return EXIT_GUARD_ABORT;
@@ -767,10 +778,38 @@ function verbRun(argv: readonly string[]): number {
             return fail(`vector ${vf} rejected — ${(e as Error).message}`);
         }
     }
+    // The experiment binding. Frozen HERE, before the first clone, and asserted
+    // again after the loop. The window it closes is real and specific: the loop
+    // below clones from `record`, then RE-READS the same file from disk to
+    // evaluate it, so a record rewritten in between produces a run that cloned
+    // one thing and scored another. Every guard already in this verb fires
+    // before the run starts and never looks again.
+    const ordered = [...files].sort(byteCompare);
+    const readRecord = (f: string): string => {
+        try {
+            return fs.readFileSync(f, 'utf-8');
+        } catch {
+            // Unreadable is a STATE of the record set here, not a reason to
+            // fail: the loop below already reports the specific file with its
+            // own message, and a freeze that pre-empted it would replace a
+            // precise diagnostic with a vaguer one. The marker still moves the
+            // digest, so a record that appears or vanishes mid-run is drift.
+            return '\u0000<unreadable>';
+        }
+    };
+    let frozenSpec;
+    let frozenDigest: string;
+    try {
+        frozenSpec = buildRunSpec(ordered, readRecord);
+        frozenDigest = freeze(frozenSpec);
+    } catch (e) {
+        return fail(`experiment spec could not be built — ${(e as Error).message}`);
+    }
+
     const seen = new Set<string>();
     const ids: string[] = [];
     const results: CascadeResult[] = [];
-    for (const f of files.sort(byteCompare)) {
+    for (const f of ordered) {
         let record: CandidateRecord;
         try {
             record = loadRecord(f);
@@ -821,6 +860,19 @@ function verbRun(argv: readonly string[]): number {
         results.push(result);
     }
 
+    // Assert BEFORE the verdicts are rendered, and before the cascade-abort
+    // return below: a drifted run has no verdict worth printing, whichever way
+    // the cascade came out.
+    try {
+        assertUnchanged(frozenDigest, frozenSpec, buildRunSpec(ordered, readRecord));
+    } catch (e) {
+        const aborted = guardAbort(e);
+        if (aborted !== undefined) {
+            return aborted;
+        }
+        throw e;
+    }
+
     for (const r of results) {
         if (r.outcome === 'abort') {
             process.stdout.write(

package/src/scripts/generate_capability_matrix.ts

@@ -72,7 +72,7 @@ interface FnSpec {
     cells: Record<string, string>;
 }
 
-// Each condense.py dispatcher generator → what it emits, for which host(s),
+// Each condense.ts dispatcher generator → what it emits, for which host(s),
 // via which mechanism. Universal generators (symlink fan-out to every host
 // that consumes the artifact) list all consuming hosts explicitly. This is the
 // one place the host×artifact mechanism is asserted; the coverage guard below
@@ -222,10 +222,17 @@ export function render_md(matrix: Record<string, Record<string, string>>): strin
     const lines: string[] = [
         '# Capability matrix — what works on which host',
         '',
-        '> **Generated** by `generate_capability_matrix` — do NOT',
-        '> hand-edit. Derived from the `generate_tools()` projection logic in',
-        '> `condense.py` (each cell traces to a `generate_*` dispatcher call).',
-        '> Drift-checked in CI (`--check`).',
+        '> **Generated — still generated, not hand-maintained prose wearing a',
+        '> generated header.** Emitted by `src/scripts/generate_capability_matrix.ts`;',
+        '> do NOT hand-edit. Derived from the `generate_tools()` projection logic in',
+        '> `src/scripts/condense.ts` (each cell traces to a `generate_*` dispatcher',
+        '> call). Drift-checked in CI (`--check`).',
+        '>',
+        '> Until 2026-09-03 this header named two Python-era generator paths that',
+        '> have not existed since ADR-200 ended that era, so a reader checking the',
+        '> provenance of this table found dead paths and no way to tell whether',
+        '> anything still produced it. They are described rather than reproduced',
+        '> here, so every path this header names resolves.',
         '',
         'Cells: **✅ native** (host consumes the artifact directly — symlink /',
         'native dir) · **🔁 adapter** (projected through a host-specific',
@@ -337,8 +344,8 @@ interface ParsedArgs {
 class _ArgExit extends Error {}
 
 function _argError(msg: string): never {
-    process.stderr.write('usage: generate_capability_matrix.py [-h] [--check] [--quiet]\n');
-    process.stderr.write(`generate_capability_matrix.py: error: ${msg}\n`);
+    process.stderr.write('usage: generate_capability_matrix [-h] [--check] [--quiet]\n');
+    process.stderr.write(`generate_capability_matrix: error: ${msg}\n`);
     process.exitCode = 2;
     throw new _ArgExit();
 }
@@ -347,7 +354,7 @@ function parse_args(argv: string[]): ParsedArgs {
     const out: ParsedArgs = { check: false, quiet: false };
     for (const a of argv) {
         if (a === '-h' || a === '--help') {
-            process.stdout.write('usage: generate_capability_matrix.py [-h] [--check] [--quiet]\n');
+            process.stdout.write('usage: generate_capability_matrix [-h] [--check] [--quiet]\n');
             process.exitCode = 0;
             throw new _ArgExit();
         } else if (a === '--check') {
@@ -383,7 +390,7 @@ export function main(argv: string[] | null = null): number {
     const missing = coverage_guard();
     if (missing.length > 0) {
         process.stderr.write(
-            '❌  generate_capability_matrix: condense.py dispatcher has ' +
+            '❌  generate_capability_matrix: condense.ts dispatcher has ' +
                 `generator(s) not mapped in _FN_SPEC: ${_pyListRepr(missing)}. Add an _FN_SPEC ` +
                 'entry so the matrix stays derived (never silently drift).\n',
         );