@humanbased/crosscheck 1.6.0-beta.5 → 1.6.0

package/dist/github/review-status.d.ts

@@ -1,6 +1,39 @@
 import type { Octokit } from 'octokit';
+/** Parse the instance id out of a claim description. Null for a foreign or legacy status. */
+export declare function parseClaimOwner(description: string | null | undefined): string | null;
+/**
+ * Is another instance actively reviewing this commit?
+ *
+ * Our own claim does not count: a retry inside the same process must not be
+ * blocked by the pending status that process itself just wrote.
+ */
 export declare function checkRemoteLock(octokit: Octokit, owner: string, repo: string, sha: string): Promise<boolean>;
 export declare function acquireRemoteLock(octokit: Octokit, owner: string, repo: string, sha: string): Promise<void>;
+/**
+ * Claim the commit and confirm the claim held. Returns false when another instance
+ * won, in which case this caller must not review.
+ *
+ * `checkRemoteLock` then `acquireRemoteLock` is a check-then-act race: two instances
+ * that receive the same webhook within a round-trip of each other both see no pending
+ * status, both write one, and both review the same commit — the duplicate same-SHA
+ * reviews this arbitration exists to stop. GitHub has no conditional status write, so
+ * instead of pretending the write was exclusive, both writers read back after a settle
+ * window and only the instance whose id survived as the newest status proceeds. Last
+ * write wins, deterministically, rather than nobody losing.
+ *
+ * This is arbitration, not a mutex: a peer writing after the read-back still gets in.
+ * The window is milliseconds against a review measured in minutes, and the local lock
+ * covers same-machine collisions outright.
+ */
+export declare function claimRemoteLock(octokit: Octokit, owner: string, repo: string, sha: string, settleMs?: number): Promise<boolean>;
 export declare function startRemoteLockHeartbeat(octokit: Octokit, owner: string, repo: string, sha: string): () => void;
+/**
+ * Publish the review outcome and drop the claim — but only if the claim is still ours.
+ *
+ * Writing unconditionally let any instance clear any other instance's lock. Worse than
+ * the lost mutual exclusion, `crosscheck/review` is a status a repo can require for
+ * merge: a late `success` from an instance that reviewed an older commit, or one whose
+ * claim was superseded, marks a commit green that nothing has actually reviewed.
+ */
 export declare function releaseRemoteLock(octokit: Octokit, owner: string, repo: string, sha: string, outcome: 'success' | 'failure'): Promise<void>;
 //# sourceMappingURL=review-status.d.ts.map

package/dist/github/review-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review-status.d.ts","sourceRoot":"","sources":["../../src/github/review-status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAWtC,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAOf;AAKD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,MAAM,IAAI,CAUZ;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,SAAS,GAAG,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC,CAMf"}
+{"version":3,"file":"review-status.d.ts","sourceRoot":"","sources":["../../src/github/review-status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAyBtC,6FAA6F;AAC7F,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIrF;AA0BD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAwB,GACjC,OAAO,CAAC,OAAO,CAAC,CAelB;AAKD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,MAAM,IAAI,CAUZ;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,SAAS,GAAG,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC,CAYf"}

package/dist/github/review-status.js

@@ -1,3 +1,4 @@
+import { INSTANCE_ID } from '../lib/pr-lock.js';
 const CONTEXT = 'crosscheck/review';
 // Lock is stale when the process hasn't heartbeated within this window.
 // Shorter = faster self-heal after a crash; must exceed HEARTBEAT_INTERVAL_MS
@@ -6,16 +7,51 @@ const STALE_MS = 5 * 60 * 1000;
 // Heartbeat keeps the pending status fresh so long-running reviews don't look
 // abandoned. Must be well under STALE_MS so a live review never goes stale.
 const HEARTBEAT_INTERVAL_MS = 2 * 60 * 1000;
+// How long to let concurrent claims settle before reading back who won.
+// createCommitStatus is an upsert, not a compare-and-swap — GitHub offers no
+// conditional create for a commit status — so two instances can both write. The
+// settle-then-read-back below is what turns that into a decision instead of two
+// instances both proceeding. It must comfortably exceed a write round-trip.
+const CLAIM_SETTLE_MS = 2_500;
+// The claim marker. Kept short: GitHub truncates a status description at 140 chars,
+// and the instance id has to survive that intact to be readable on the way back.
+function claimDescription(id) {
+    return `crosscheck ${id}`;
+}
+/** Parse the instance id out of a claim description. Null for a foreign or legacy status. */
+export function parseClaimOwner(description) {
+    if (!description)
+        return null;
+    const m = description.match(/^crosscheck ([^\s]+)/);
+    return m ? (m[1] ?? null) : null;
+}
+async function readClaim(octokit, owner, repo, sha) {
+    const { data } = await octokit.rest.repos.getCombinedStatusForRef({ owner, repo, ref: sha });
+    const status = data.statuses
+        .filter(s => s.context === CONTEXT)
+        .sort((a, b) => new Date(b.updated_at).getTime() - new Date(a.updated_at).getTime())[0];
+    if (!status)
+        return null;
+    return {
+        state: status.state,
+        owner: parseClaimOwner(status.description),
+        updatedAt: new Date(status.updated_at).getTime(),
+    };
+}
+/**
+ * Is another instance actively reviewing this commit?
+ *
+ * Our own claim does not count: a retry inside the same process must not be
+ * blocked by the pending status that process itself just wrote.
+ */
 export async function checkRemoteLock(octokit, owner, repo, sha) {
     try {
-        const { data } = await octokit.rest.repos.getCombinedStatusForRef({ owner, repo, ref: sha });
-        const status = data.statuses
-            .filter(s => s.context === CONTEXT)
-            .sort((a, b) => new Date(b.updated_at).getTime() - new Date(a.updated_at).getTime())[0];
-        if (!status || status.state !== 'pending')
+        const claim = await readClaim(octokit, owner, repo, sha);
+        if (!claim || claim.state !== 'pending')
             return false;
-        const age = Date.now() - new Date(status.updated_at).getTime();
-        return age < STALE_MS;
+        if (claim.owner === INSTANCE_ID)
+            return false;
+        return Date.now() - claim.updatedAt < STALE_MS;
     }
     catch {
         return false;
@@ -26,9 +62,43 @@ export async function acquireRemoteLock(octokit, owner, repo, sha) {
         owner, repo, sha,
         state: 'pending',
         context: CONTEXT,
-        description: `Review started at ${new Date().toISOString()}`,
+        description: `${claimDescription(INSTANCE_ID)} started ${new Date().toISOString()}`,
     });
 }
+/**
+ * Claim the commit and confirm the claim held. Returns false when another instance
+ * won, in which case this caller must not review.
+ *
+ * `checkRemoteLock` then `acquireRemoteLock` is a check-then-act race: two instances
+ * that receive the same webhook within a round-trip of each other both see no pending
+ * status, both write one, and both review the same commit — the duplicate same-SHA
+ * reviews this arbitration exists to stop. GitHub has no conditional status write, so
+ * instead of pretending the write was exclusive, both writers read back after a settle
+ * window and only the instance whose id survived as the newest status proceeds. Last
+ * write wins, deterministically, rather than nobody losing.
+ *
+ * This is arbitration, not a mutex: a peer writing after the read-back still gets in.
+ * The window is milliseconds against a review measured in minutes, and the local lock
+ * covers same-machine collisions outright.
+ */
+export async function claimRemoteLock(octokit, owner, repo, sha, settleMs = CLAIM_SETTLE_MS) {
+    await acquireRemoteLock(octokit, owner, repo, sha);
+    await new Promise(resolve => setTimeout(resolve, settleMs));
+    try {
+        const claim = await readClaim(octokit, owner, repo, sha);
+        // No claim readable, or one with no owner (a legacy status, or a description
+        // GitHub truncated): nothing proves we lost, and refusing to review on an
+        // unreadable status would strand the PR. Proceed — the local lock still holds.
+        if (!claim || claim.owner === null)
+            return true;
+        return claim.owner === INSTANCE_ID;
+    }
+    catch {
+        // The read-back is the optional half. Failing it leaves us exactly where the
+        // old unconditional acquire always was, which is still safe enough to review.
+        return true;
+    }
+}
 // Starts a repeating interval that refreshes the pending status timestamp so
 // checkRemoteLock never treats an active review as stale. Returns a stop
 // function that must be called in the finally block after the review completes.
@@ -38,15 +108,30 @@ export function startRemoteLockHeartbeat(octokit, owner, repo, sha) {
             owner, repo, sha,
             state: 'pending',
             context: CONTEXT,
-            description: `Review active at ${new Date().toISOString()}`,
+            description: `${claimDescription(INSTANCE_ID)} active ${new Date().toISOString()}`,
         }).catch(() => { });
     }, HEARTBEAT_INTERVAL_MS);
     return () => clearInterval(id);
 }
+/**
+ * Publish the review outcome and drop the claim — but only if the claim is still ours.
+ *
+ * Writing unconditionally let any instance clear any other instance's lock. Worse than
+ * the lost mutual exclusion, `crosscheck/review` is a status a repo can require for
+ * merge: a late `success` from an instance that reviewed an older commit, or one whose
+ * claim was superseded, marks a commit green that nothing has actually reviewed.
+ */
 export async function releaseRemoteLock(octokit, owner, repo, sha, outcome) {
     try {
+        const claim = await readClaim(octokit, owner, repo, sha);
+        // A claim owned by someone else is theirs to resolve. An unowned claim (legacy
+        // or truncated) is indistinguishable from our own predecessor's, so resolve it
+        // rather than leaving a pending status behind forever.
+        if (claim && claim.owner !== null && claim.owner !== INSTANCE_ID)
+            return;
         await octokit.rest.repos.createCommitStatus({
             owner, repo, sha, state: outcome, context: CONTEXT,
+            description: `${claimDescription(INSTANCE_ID)} ${outcome}`,
         });
     }
     catch { /* best-effort */ }

package/dist/github/review-status.js.map

@@ -1 +1 @@
-{"version":3,"file":"review-status.js","sourceRoot":"","sources":["../../src/github/review-status.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,GAAG,mBAAmB,CAAA;AACnC,wEAAwE;AACxE,8EAA8E;AAC9E,4DAA4D;AAC5D,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAC9B,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAE3C,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;QAC5F,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ;aACzB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC;aAClC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACzF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAA;QAC9D,OAAO,GAAG,GAAG,QAAQ,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,GAAW;IAEX,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAC1C,KAAK,EAAE,IAAI,EAAE,GAAG;QAChB,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,qBAAqB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;KAC7D,CAAC,CAAA;AACJ,CAAC;AAED,6EAA6E;AAC7E,yEAAyE;AACzE,gFAAgF;AAChF,MAAM,UAAU,wBAAwB,CACtC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,GAAW;IAEX,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE;QAC1B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YACpC,KAAK,EAAE,IAAI,EAAE,GAAG;YAChB,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,oBAAoB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;SAC5D,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAqB,CAAC,CAAC,CAAA;IACvC,CAAC,EAAE,qBAAqB,CAAC,CAAA;IACzB,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,GAAW,EACX,OAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC1C,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO;SACnD,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"review-status.js","sourceRoot":"","sources":["../../src/github/review-status.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C,MAAM,OAAO,GAAG,mBAAmB,CAAA;AACnC,wEAAwE;AACxE,8EAA8E;AAC9E,4DAA4D;AAC5D,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAC9B,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAE3C,wEAAwE;AACxE,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,4EAA4E;AAC5E,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B,oFAAoF;AACpF,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,EAAU;IAClC,OAAO,cAAc,EAAE,EAAE,CAAA;AAC3B,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,eAAe,CAAC,WAAsC;IACpE,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IAC7B,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACnD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAClC,CAAC;AAQD,KAAK,UAAU,SAAS,CACtB,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,GAAW;IAEX,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5F,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ;SACzB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC;SAClC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACzF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC;QAC1C,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;KACjD,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QACxD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACrD,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW;YAAE,OAAO,KAAK,CAAA;QAC7C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,GAAW;IAEX,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAC1C,KAAK,EAAE,IAAI,EAAE,GAAG;QAChB,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,GAAG,gBAAgB,CAAC,WAAW,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;KACpF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,GAAW,EACX,WAAmB,eAAe;IAElC,MAAM,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;IAClD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC3D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QACxD,6EAA6E;QAC7E,0EAA0E;QAC1E,+EAA+E;QAC/E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC/C,OAAO,KAAK,CAAC,KAAK,KAAK,WAAW,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,8EAA8E;QAC9E,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,yEAAyE;AACzE,gFAAgF;AAChF,MAAM,UAAU,wBAAwB,CACtC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,GAAW;IAEX,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE;QAC1B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YACpC,KAAK,EAAE,IAAI,EAAE,GAAG;YAChB,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,GAAG,gBAAgB,CAAC,WAAW,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;SACnF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAqB,CAAC,CAAC,CAAA;IACvC,CAAC,EAAE,qBAAqB,CAAC,CAAA;IACzB,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAgB,EAChB,KAAa,EACb,IAAY,EACZ,GAAW,EACX,OAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QACxD,+EAA+E;QAC/E,+EAA+E;QAC/E,uDAAuD;QACvD,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW;YAAE,OAAM;QACxE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC1C,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO;YAClD,WAAW,EAAE,GAAG,gBAAgB,CAAC,WAAW,CAAC,IAAI,OAAO,EAAE;SAC3D,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC"}

package/dist/lib/board.d.ts

@@ -24,8 +24,26 @@ export interface PRCompletionData {
      *  run, such as one the review strategy short-circuited. */
     label?: string;
 }
+/**
+ * The terminal state of one settled slot, for the session outcome distribution.
+ * `skipped` is a PR that settled without any verdict at all — the review
+ * strategy short-circuited it (lockfile-only, doc-only) — as distinct from
+ * `no verdict`, where a reviewer ran and returned nothing parseable.
+ */
+export type Outcome = 'APPROVE' | 'NEEDS WORK' | 'BLOCK' | 'no verdict' | 'skipped' | 'error';
 export declare function fmtTime(d?: Date): string;
 export declare const FMT_TIME_WIDTH = 11;
+export declare function fmtEnteredAt(epochMs: number): string;
+export declare function fmtUptime(ms: number): string;
+/**
+ * Whole percentages summing to exactly 100, by the largest-remainder method.
+ * Plain rounding drifts — three equal shares render as 33/33/33 — and a
+ * distribution that visibly fails to add up reads as a bug in the numbers.
+ *
+ * A non-zero count too small to earn a point comes back as 0; the caller
+ * renders those as "<1%" rather than claiming the outcome never happened.
+ */
+export declare function distribute(counts: readonly number[]): number[];
 export declare function fmtTokens(n?: number): string;
 export declare function fmtTokensRaw(n?: number): string;
 export declare function isNoticeLine(msg: string): boolean;
@@ -60,6 +78,13 @@ export declare class PRBoard {
     addPR(key: string, prNumber: number, repo: string, branch: string, round?: number): void;
     updatePR(key: string, updates: PRUpdate): void;
     completePR(key: string, data: PRCompletionData): void;
+    /**
+     * Settle a slot that ended in an error. The slot stays in the workspace as a
+     * settled row, the same as a completed one: a failed run is a session record,
+     * and deleting it here was what pushed reviewer timeouts out of the table and
+     * into raw scrollback, where a long watch session showed 43 errors above an
+     * empty workspace reading "no PRs yet".
+     */
     failPR(key: string, error: string): void;
     /** Print 1–2 static lines to scrollback (above the live block). */
     log(line1: string, line2?: string): void;
@@ -72,7 +97,13 @@ export declare class PRBoard {
     private verdictBadge;
     private crFillFn;
     private crLabelFn;
-    private uptime;
+    /** "since 08:25 PM · up 3h32m" — when watch started, and how long it has run. */
+    private sessionRow;
+    /**
+     * Outcome shares across every PR that settled this session, e.g.
+     * "APPROVE 45% · BLOCK 30% · error 25%". Empty when nothing has settled yet.
+     */
+    private outcomeRow;
     private statsRow;
     private renderPRSlot;
     private phaseLine1Label;

package/dist/lib/board.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"board.d.ts","sourceRoot":"","sources":["../../src/lib/board.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAgB,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAKjD,MAAM,MAAM,OAAO,GACf,QAAQ,GACR,WAAW,GACX,UAAU,GACV,QAAQ,GACR,OAAO,GACP,YAAY,GACZ,WAAW,CAAA;AA+Cf,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX;gEAC4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAoBD,wBAAgB,OAAO,CAAC,CAAC,OAAa,GAAG,MAAM,CAE9C;AAGD,eAAO,MAAM,cAAc,KAAK,CAAA;AAmBhC,wBAAgB,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK5C;AAGD,wBAAgB,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK/C;AA8CD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEjD;AAID,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,IAAI,CAAA;AAc9C,2FAA2F;AAC3F,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAgBlD;AAsGD,qBAAa,OAAO;IAClB,OAAO,CAAC,KAAK,CAA4B;IACzC,OAAO,CAAC,QAAQ,CAAI;IACpB,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,SAAS,CAAI;IACrB,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAC/D,OAAO,CAAC,OAAO,CAAe;IAC9B,OAAO,CAAC,IAAI,CAAI;IAChB,OAAO,CAAC,SAAS,CAAI;IACrB,OAAO,CAAC,UAAU,CAAwC;IAC1D,OAAO,CAAC,WAAW,CAAQ;IAE3B,OAAO,CAAC,KAAK,CAOZ;IAED,OAAO,CAAC,MAAM,CAEb;IAED,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,KAAK,CAAqB;IAClC,OAAO,CAAC,KAAK,CAIX;IAIF,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI;IAMtD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAIjE,KAAK,IAAI,IAAI;IASb,IAAI,IAAI,IAAI;IAMZ,iFAAiF;IACjF,SAAS,IAAI,IAAI;IAOjB,oEAAoE;IACpE,SAAS,IAAI,IAAI;IAMjB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAiBxF,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,GAAG,IAAI;IAmB9C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI;IAwBrD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAUxC,mEAAmE;IACnE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAKxC,+EAA+E;IAC/E,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAQnC,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,SAAS;IASjB,OAAO,CAAC,MAAM;IASd,OAAO,CAAC,QAAQ;IAWhB,OAAO,CAAC,YAAY;IA0DpB,OAAO,CAAC,eAAe;IAevB,OAAO,CAAC,eAAe;IA0BvB,OAAO,CAAC,gBAAgB;IAexB,OAAO,CAAC,oBAAoB;IA4C5B,OAAO,CAAC,MAAM;IAiCd;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAkBnB,wEAAwE;IACxE,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,WAAW;IAMnB,OAAO,CAAC,YAAY;IAkBpB,+EAA+E;IAC/E,OAAO,CAAC,WAAW;IAWnB,yFAAyF;IACzF,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,iBAAiB;IAkBzB,OAAO,CAAC,gBAAgB;IAwBxB,OAAO,CAAC,aAAa;IAiBrB,OAAO,CAAC,iBAAiB;IA6CzB,6EAA6E;IAC7E,OAAO,CAAC,YAAY;IAmBpB,OAAO,CAAC,kBAAkB;IAmC1B,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,UAAU;IAsBlB,OAAO,CAAC,UAAU;CASnB"}
+{"version":3,"file":"board.d.ts","sourceRoot":"","sources":["../../src/lib/board.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAgB,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAMjD,MAAM,MAAM,OAAO,GACf,QAAQ,GACR,WAAW,GACX,UAAU,GACV,QAAQ,GACR,OAAO,GACP,YAAY,GACZ,WAAW,CAAA;AAiDf,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX;gEAC4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,GAAG,YAAY,GAAG,SAAS,GAAG,OAAO,CAAA;AAwB7F,wBAAgB,OAAO,CAAC,CAAC,OAAa,GAAG,MAAM,CAE9C;AAGD,eAAO,MAAM,cAAc,KAAK,CAAA;AAehC,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIpD;AAUD,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAK5C;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAsB9D;AAGD,wBAAgB,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK5C;AAGD,wBAAgB,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK/C;AA8CD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEjD;AAID,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,IAAI,CAAA;AAW9C,2FAA2F;AAC3F,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAIlD;AAuHD,qBAAa,OAAO;IAClB,OAAO,CAAC,KAAK,CAA4B;IACzC,OAAO,CAAC,QAAQ,CAAI;IACpB,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,SAAS,CAAI;IACrB,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAC/D,OAAO,CAAC,OAAO,CAAe;IAC9B,OAAO,CAAC,IAAI,CAAI;IAChB,OAAO,CAAC,SAAS,CAAI;IACrB,OAAO,CAAC,UAAU,CAAwC;IAC1D,OAAO,CAAC,WAAW,CAAQ;IAE3B,OAAO,CAAC,KAAK,CAQZ;IAED,OAAO,CAAC,MAAM,CAEb;IAED,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,KAAK,CAAqB;IAClC,OAAO,CAAC,KAAK,CAIX;IAIF,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI;IAMtD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAIjE,KAAK,IAAI,IAAI;IASb,IAAI,IAAI,IAAI;IAMZ,iFAAiF;IACjF,SAAS,IAAI,IAAI;IAOjB,oEAAoE;IACpE,SAAS,IAAI,IAAI;IAMjB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAiBxF,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,GAAG,IAAI;IAmB9C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI;IAyBrD;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAqBxC,mEAAmE;IACnE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAKxC,+EAA+E;IAC/E,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAQnC,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,SAAS;IASjB,iFAAiF;IACjF,OAAO,CAAC,UAAU;IAOlB;;;OAGG;IACH,OAAO,CAAC,UAAU;IA4BlB,OAAO,CAAC,QAAQ;IAWhB,OAAO,CAAC,YAAY;IA0DpB,OAAO,CAAC,eAAe;IAevB,OAAO,CAAC,eAAe;IA0BvB,OAAO,CAAC,gBAAgB;IAexB,OAAO,CAAC,oBAAoB;IA4C5B,OAAO,CAAC,MAAM;IAiCd;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAkBnB,wEAAwE;IACxE,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,WAAW;IAMnB,OAAO,CAAC,YAAY;IAkBpB,+EAA+E;IAC/E,OAAO,CAAC,WAAW;IAWnB,yFAAyF;IACzF,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,iBAAiB;IAkBzB,OAAO,CAAC,gBAAgB;IA6BxB,OAAO,CAAC,aAAa;IAiBrB,OAAO,CAAC,iBAAiB;IAmDzB,6EAA6E;IAC7E,OAAO,CAAC,YAAY;IAuBpB,OAAO,CAAC,kBAAkB;IA4C1B,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,UAAU;IAsBlB,OAAO,CAAC,UAAU;CASnB"}

package/dist/lib/board.js

@@ -1,5 +1,7 @@
 import chalk from 'chalk';
 import { selectTip } from './tips.js';
+import { oneLine } from './vendor-error-summary.js';
+const OUTCOME_ORDER = ['APPROVE', 'NEEDS WORK', 'BLOCK', 'no verdict', 'skipped', 'error'];
 // ── Constants ─────────────────────────────────────────────────────────────────
 const FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
 const BAR_FILLED = '█';
@@ -23,10 +25,55 @@ function fmtDuration(ms) {
         return `${m}m${String(s).padStart(2, '0')}s`;
     return `${s}s`;
 }
+// When a PR entered the board, in the operator's locale: "09/22, 03:50 PM" in
+// en-US. Every part is 2-digit so the column keeps one width within a session.
+export function fmtEnteredAt(epochMs) {
+    return new Date(epochMs).toLocaleString(undefined, {
+        month: '2-digit', day: '2-digit', hour: '2-digit', minute: '2-digit',
+    });
+}
 // Short HH:MM timestamp (no seconds) for the "started" label
 function fmtStartTime(epochMs) {
     return new Date(epochMs).toLocaleTimeString('en-US', { hour: '2-digit', minute: '2-digit', hour12: true });
 }
+// Session age in hours and minutes: "3h32m", or "12m" under the hour. Deliberately
+// not fmtDuration: that renders MM:SS shaped output under an hour, which reads as
+// hours:minutes on a long-running watch and understates the session by 60x.
+export function fmtUptime(ms) {
+    const totalMin = Math.max(0, Math.floor(ms / 60_000));
+    const h = Math.floor(totalMin / 60);
+    const m = totalMin % 60;
+    return h > 0 ? `${h}h${String(m).padStart(2, '0')}m` : `${m}m`;
+}
+/**
+ * Whole percentages summing to exactly 100, by the largest-remainder method.
+ * Plain rounding drifts — three equal shares render as 33/33/33 — and a
+ * distribution that visibly fails to add up reads as a bug in the numbers.
+ *
+ * A non-zero count too small to earn a point comes back as 0; the caller
+ * renders those as "<1%" rather than claiming the outcome never happened.
+ */
+export function distribute(counts) {
+    const total = counts.reduce((a, b) => a + b, 0);
+    if (total === 0)
+        return counts.map(() => 0);
+    const exact = counts.map(c => (c * 100) / total);
+    const out = exact.map(Math.floor);
+    // Exact shares sum to 100, so the floors leave fewer whole points than there
+    // are entries: one pass in remainder order always places every last one.
+    let remaining = 100 - out.reduce((a, b) => a + b, 0);
+    const byRemainder = exact
+        .map((e, i) => ({ i, rem: e - Math.floor(e) }))
+        .filter(({ i }) => counts[i] > 0)
+        .sort((a, b) => b.rem - a.rem);
+    for (const { i } of byRemainder) {
+        if (remaining <= 0)
+            break;
+        out[i]++;
+        remaining--;
+    }
+    return out;
+}
 // Format token count as a compact suffix: "(900)", "(1.2K)", "(1.5M)". Returns '' when undefined.
 export function fmtTokens(n) {
     if (n == null)
@@ -94,35 +141,20 @@ const NOTICE_PREFIX = /^(?:\x1B\[[0-9;]*m)*\s*[⚠✗]/;
 export function isNoticeLine(msg) {
     return NOTICE_PREFIX.test(msg) || msg.includes('\n');
 }
-// Bare `<`/`>` (and their unshifted `,`/`.`) always work. Terminals cannot agree
-// on how to report ctrl/cmd with a punctuation key, so every encoding they do
-// emit is accepted: meta-prefixed, CSI-u (kitty / xterm modifyOtherKeys) and
-// modified arrows. macOS Terminal swallows cmd entirely — there the bare keys,
-// or ctrl+arrow, are the way through.
-const PAGE_OLDER_KEYS = new Set(['<', ',', '\u001b<', '\u001b,', '\u001b[D', '\u001b[5~']);
-const PAGE_NEWER_KEYS = new Set(['>', '.', '\u001b>', '\u001b.', '\u001b[C', '\u001b[6~']);
-// eslint-disable-next-line no-control-regex -- the ESC byte is the sequence
-const CSI_U = /^\u001b\[(\d+);\d+u$/; // ESC [ <codepoint> ; <modifiers> u
-// eslint-disable-next-line no-control-regex -- the ESC byte is the sequence
-const CSI_ARROW = /^\u001b\[1;\d+([DC])$/; // ESC [ 1 ; <modifiers> D|C
+// ← / → are the only page keys, on Windows, Linux and macOS alike: every
+// terminal forwards a bare arrow, where modifier and punctuation combinations
+// arrive inconsistently or not at all (macOS never forwards cmd). Each arrow has
+// two encodings: normal cursor mode (`ESC [ D`) and application cursor mode
+// (`ESC O D`), which Terminal.app emits while an alternate-screen app owns the tty.
+// ← moves toward newer PRs (the live page), → toward older history.
+const PAGE_NEWER_KEYS = new Set(['\u001b[D', '\u001bOD']);
+const PAGE_OLDER_KEYS = new Set(['\u001b[C', '\u001bOC']);
 /** Map a raw stdin key sequence to a page direction, or null when it is not a page key. */
 export function pageKeyAction(seq) {
     if (PAGE_OLDER_KEYS.has(seq))
         return 'older';
     if (PAGE_NEWER_KEYS.has(seq))
         return 'newer';
-    const csiU = CSI_U.exec(seq);
-    if (csiU) {
-        const codepoint = Number(csiU[1]);
-        if (codepoint === 44 || codepoint === 60)
-            return 'older'; // , <
-        if (codepoint === 46 || codepoint === 62)
-            return 'newer'; // . >
-        return null;
-    }
-    const arrow = CSI_ARROW.exec(seq);
-    if (arrow)
-        return arrow[1] === 'D' ? 'older' : 'newer';
     return null;
 }
 // Keep every active slot plus the newest `budget` settled ones. Anything older
@@ -135,6 +167,24 @@ function trimToBudget(pool, budget) {
     const keep = new Set(settled.slice(settled.length - budget));
     return pool.filter(s => s.completedAt === undefined || keep.has(s));
 }
+/**
+ * The one outcome a settled slot counts toward. A recheck verdict supersedes
+ * the review verdict — it is the later word on the same PR — and `null` from
+ * either step means a reviewer ran but returned nothing parseable, which is a
+ * different event from never having run at all.
+ */
+function outcomeOf(slot) {
+    if (slot.error !== undefined)
+        return 'error';
+    const final = typeof slot.recheckVerdict === 'string'
+        ? slot.recheckVerdict
+        : typeof slot.verdict === 'string' ? slot.verdict : null;
+    if (final === 'APPROVE' || final === 'NEEDS WORK' || final === 'BLOCK')
+        return final;
+    if (slot.recheckVerdict === null || slot.verdict === null)
+        return 'no verdict';
+    return 'skipped';
+}
 function makeBar(filled, total, fillFn, emptyFn) {
     const f = Math.max(0, Math.min(total, Math.round(filled)));
     return fillFn(BAR_FILLED.repeat(f)) + emptyFn(BAR_EMPTY.repeat(total - f));
@@ -220,6 +270,7 @@ function buildTheme(cfg) {
         warning: chalk.yellow,
         error: chalk.red,
         dim: chalk.dim,
+        muted: chalk.gray.dim,
         accent: chalk.cyan,
         barPRFill: resolveColor(cfg.bar_fill),
         barEmpty: empty,
@@ -256,6 +307,7 @@ export class PRBoard {
         errorsOccurred: 0,
         crTotalMs: 0,
         sessionStart: Date.now(),
+        outcomes: { 'APPROVE': 0, 'NEEDS WORK': 0, 'BLOCK': 0, 'no verdict': 0, 'skipped': 0, 'error': 0 },
     };
     tunnel = {
         type: 'none', url: null, alive: false,
@@ -372,19 +424,37 @@ export class PRBoard {
         }
         if (fixCount !== undefined && fixCount > 0)
             this.stats.fixesApplied++;
+        this.stats.outcomes[outcomeOf(slot)]++;
         // Non-TTY has no live block to re-render — emit the folded line to scrollback and drop the slot.
         if (!this.isTTY) {
             process.stdout.write(this.renderPRSlotFolded(slot) + '\n');
             this.slots.delete(key);
         }
     }
+    /**
+     * Settle a slot that ended in an error. The slot stays in the workspace as a
+     * settled row, the same as a completed one: a failed run is a session record,
+     * and deleting it here was what pushed reviewer timeouts out of the table and
+     * into raw scrollback, where a long watch session showed 43 errors above an
+     * empty workspace reading "no PRs yet".
+     */
     failPR(key, error) {
         const slot = this.slots.get(key);
-        this.slots.delete(key);
         this.stats.errorsOccurred++;
-        if (slot) {
-            const ts = fmtTime();
-            this.printStatic(`${chalk.dim(ts)}  PR #${slot.prNumber}  ${chalk.red('✗')} ${error}`);
+        if (!slot || slot.completedAt !== undefined)
+            return;
+        slot.completedAt = Date.now();
+        // A failure message is whatever the thrower had — a subprocess dump can
+        // arrive with embedded newlines and hundreds of columns. The folded row is
+        // clamped to one terminal row and history pagination counts on that, so the
+        // text is flattened here rather than at render time. The untouched error is
+        // in the file log.
+        slot.error = oneLine(error, 160);
+        slot.label = 'failed';
+        this.stats.outcomes.error++;
+        if (!this.isTTY) {
+            process.stdout.write(this.renderPRSlotFolded(slot) + '\n');
+            this.slots.delete(key);
         }
     }
     /** Print 1–2 static lines to scrollback (above the live block). */
@@ -454,14 +524,43 @@ export class PRBoard {
         return t.barCRNeedsWork;
     }
     // ── Private: render ────────────────────────────────────────────────────────
-    uptime() {
-        const totalSec = Math.floor((Date.now() - this.stats.sessionStart) / 1000);
-        const h = Math.floor(totalSec / 3600);
-        const m = Math.floor((totalSec % 3600) / 60);
-        const s = totalSec % 60;
-        if (h > 0)
-            return `${String(h).padStart(2, '0')}:${String(m).padStart(2, '0')}`;
-        return `${String(m).padStart(2, '0')}:${String(s).padStart(2, '0')}`;
+    /** "since 08:25 PM · up 3h32m" — when watch started, and how long it has run. */
+    sessionRow() {
+        const t = this.theme;
+        const started = fmtStartTime(this.stats.sessionStart);
+        const age = fmtUptime(Date.now() - this.stats.sessionStart);
+        return `${t.dim('since')} ${started}  ${t.dim('·')}  ${t.dim('up')} ${age}`;
+    }
+    /**
+     * Outcome shares across every PR that settled this session, e.g.
+     * "APPROVE 45% · BLOCK 30% · error 25%". Empty when nothing has settled yet.
+     */
+    outcomeRow() {
+        const t = this.theme;
+        const counts = OUTCOME_ORDER.map(o => this.stats.outcomes[o]);
+        const total = counts.reduce((a, b) => a + b, 0);
+        if (total === 0)
+            return '';
+        const pcts = distribute(counts);
+        const mixed = counts.filter(c => c > 0).length > 1;
+        const parts = OUTCOME_ORDER.map((outcome, i) => {
+            if (counts[i] === 0)
+                return null;
+            // A share too small to earn a whole point still happened; "<1%" says so
+            // where "0%" would read as never. Its complement is then not a whole 100
+            // either — "error 100%" beside "APPROVE <1%" contradicts itself — so the
+            // rounded-up bucket reads ">99%" whenever some other outcome is non-zero.
+            const pct = pcts[i] === 0 ? '<1%'
+                : pcts[i] === 100 && mixed ? '>99%'
+                    : `${pcts[i]}%`;
+            const paint = outcome === 'APPROVE' ? t.barCRApprove
+                : outcome === 'BLOCK' ? t.barCRBlock
+                    : outcome === 'NEEDS WORK' ? t.barCRNeedsWork
+                        : outcome === 'error' ? t.error
+                            : t.dim;
+            return `${paint(outcome)} ${t.dim(pct)}`;
+        }).filter((p) => p !== null);
+        return parts.join(t.dim(' · '));
     }
     statsRow() {
         const { prsReceived, crsCompleted, fixesApplied, errorsOccurred, crTotalMs } = this.stats;
@@ -473,7 +572,7 @@ export class PRBoard {
             : '';
         return `PRs: ${prsReceived} · CRs: ${crsCompleted}${errorPart} · fixes: ${fixesApplied}${avgCr}`;
     }
-    renderPRSlot(slot, frame) {
+    renderPRSlot(slot, frame, numWidth = 0) {
         const t = this.theme;
         const w = process.stdout.columns || 80;
         const isCompleted = slot.completedAt !== undefined;
@@ -485,15 +584,15 @@ export class PRBoard {
         const branch = truncate(slot.branch, 22);
         const icon = isCompleted ? t.success('✓') : t.spinner(frame);
         const phaseLabel = this.phaseLine1Label(slot, frame);
-        const timePart = isCompleted
-            ? t.dim(eSuffix)
-            : `${t.dim('started ' + fmtStartTime(slot.startedAt))}  ${t.dim(eSuffix)}`;
-        const rightPart = `${timePart}  ${phaseLabel}`;
-        const identityPlain = `   #${slot.prNumber}  ${slot.repo}  ${branch}`;
+        // The entered-at column after the PR number already says when it started.
+        const rightPart = `${t.dim(eSuffix)}  ${phaseLabel}`;
+        const numText = `#${slot.prNumber}`.padEnd(numWidth);
+        const entered = fmtEnteredAt(slot.startedAt);
+        const identityPlain = `   ${numText}  ${entered}  ${slot.repo}  ${branch}`;
         const l1Pad = Math.max(2, w - stripAnsi(identityPlain).length - stripAnsi(rightPart).length - 2);
-        const prNum = isCompleted ? t.dim(`#${slot.prNumber}`) : chalk.bold(`#${slot.prNumber}`);
+        const prNum = isCompleted ? t.dim(numText) : chalk.bold(numText);
         const repoStr = isCompleted ? t.dim(slot.repo) : chalk.white(slot.repo);
-        const l1 = `  ${icon} ${prNum}  ${repoStr}  ${t.dim(branch)}` +
+        const l1 = `  ${icon} ${prNum}  ${t.dim(entered)}  ${repoStr}  ${t.dim(branch)}` +
             ' '.repeat(l1Pad) + rightPart;
         // ── Line 2: PR | CR | Fix | Recheck pipeline ────────────────────────────────
         const pipe = t.dim(' | ');
@@ -740,7 +839,11 @@ export class PRBoard {
     renderStatsPanel(connLogLines, showTip) {
         const t = this.theme;
         const lines = [];
-        lines.push(`  ${this.statsRow()}  ${t.dim('│')}  ${t.dim('↑')} ${this.uptime()}`);
+        lines.push(`  ${this.statsRow()}`);
+        // Session line: start time + age, and the outcome split when anything has
+        // settled. One row, because every row here costs a PR row on the live page.
+        const outcomes = this.outcomeRow();
+        lines.push(`  ${this.sessionRow()}${outcomes ? `  ${t.dim('│')}  ${outcomes}` : ''}`);
         const { type: tunnelType, url, alive } = this.tunnel;
         if (tunnelType !== 'none') {
             const tunnelLabel = tunnelType === 'serve' ? 'endpoint:' : 'tunnel:  ';
@@ -781,6 +884,8 @@ export class PRBoard {
                 completedCount++;
         }
         const foldByCount = completedCount > FOLD_THRESHOLD;
+        // Pad the PR number to the page's widest so the entered-at column lines up.
+        const numWidth = Math.max(...visible.map(s => `#${s.prNumber}`.length));
         const lines = [];
         let prevWasExpanded = false;
         let first = true;
@@ -794,17 +899,20 @@ export class PRBoard {
             // should re-expand.
             if (isCompleted && foldByCount)
                 slot.stickyFolded = true;
-            const useFolded = isCompleted && (foldAll || slot.stickyFolded === true);
+            // A failed slot is always folded: its pipeline bars are frozen wherever the
+            // run died ("CR queued", "Fix queued"), which describes work that will
+            // never happen. The folded row carries the error instead.
+            const useFolded = isCompleted && (foldAll || slot.stickyFolded === true || slot.error !== undefined);
             if (useFolded) {
                 // Clamped so the row never wraps: history pagination sizes a page by
                 // counting one terminal row per folded slot.
-                lines.push(truncateVisible(this.renderPRSlotFolded(slot), w - 1));
+                lines.push(truncateVisible(this.renderPRSlotFolded(slot, numWidth), w - 1));
                 prevWasExpanded = false;
             }
             else {
                 if (!first && prevWasExpanded)
                     lines.push('');
-                lines.push(this.renderPRSlot(slot, frame));
+                lines.push(this.renderPRSlot(slot, frame, numWidth));
                 prevWasExpanded = true;
             }
             first = false;
@@ -822,13 +930,16 @@ export class PRBoard {
         // "shown of retained", not of stats.prsReceived: rounds add rows, and the
         // history cap eventually drops the oldest, so the two counts diverge.
         const counts = t.dim(`showing ${shown} of ${total}`);
+        // A key with nowhere to go fades to the muted colour: ← on the live page,
+        // → on the oldest history page.
+        const key = (arrow, label, live) => live ? `${t.accent(arrow)} ${t.dim(label)}` : t.muted(`${arrow} ${label}`);
         const keys = this.pageCount > 1
-            ? `  ${t.dim('│')}  ${t.accent('ctrl+<')} ${t.dim('older')}  ${t.accent('ctrl+>')} ${t.dim('newer')}`
+            ? `  ${t.dim('│')}  ${key('←', 'newer', this.page > 0)}  ${key('→', 'older', this.page < this.pageCount - 1)}`
             : '';
         return `  ${position}  ${t.dim('│')}  ${counts}${keys}`;
     }
     // ── Folded PR slot ─────────────────────────────────────────────────────────
-    renderPRSlotFolded(slot) {
+    renderPRSlotFolded(slot, numWidth = 0) {
         const t = this.theme;
         const elapsedMs = (slot.completedAt ?? Date.now()) - slot.startedAt;
         const elapsed = fmtDuration(elapsedMs);
@@ -854,9 +965,17 @@ export class PRBoard {
             const rFn = this.crLabelFn(slot.recheckVerdict);
             parts.push(`recheck ${rFn(slot.recheckVerdict)}`);
         }
+        // A failed run reports the error in place of the verdict trail: whatever the
+        // pipeline had reached is what it never got to finish, and the reason it
+        // stopped is the only thing worth the row.
+        if (slot.error !== undefined) {
+            parts.push(t.error(slot.error));
+        }
         const urlPart = slot.url ? `  ${t.dim('→')} ${t.accent(slot.url)}` : '';
         const partsStr = parts.length > 0 ? parts.join(t.dim(' · ')) : t.dim('—');
-        return `  ${t.success('✓')} ${t.dim(`#${slot.prNumber}`)}  ${t.dim(slot.repo)}  ${t.dim(branch)}  ${partsStr}  ${t.dim(`(${elapsed})`)}${urlPart}`;
+        const icon = slot.error !== undefined ? t.error('✗') : t.success('✓');
+        const numText = `#${slot.prNumber}`.padEnd(numWidth);
+        return `  ${icon} ${t.dim(numText)}  ${t.dim(fmtEnteredAt(slot.startedAt))}  ${t.dim(slot.repo)}  ${t.dim(branch)}  ${partsStr}  ${t.dim(`(${elapsed})`)}${urlPart}`;
     }
     redraw() {
         const content = this.render();