@intentic/sandbox-contract 1.176.3 → 1.209.0

package/src/chores/verdict.test.ts

@@ -1,4 +1,4 @@
-import type { ChoreLedgerEntry, ChorePackage, ChoresReport, ChoreShape, ChoreSignals, ProbeResult } from "../schemas.js";
+import type { Bundle, ChoreLedgerEntry, ChorePackage, ChoresReport, ChoreShape, ChoreSignals, Duplication, ProbeResult, UiScan } from "../schemas.js";
 import { describe, expect, test } from "vitest";
 import { choreById, CHORES } from "./chores.js";
 import { assessReport, ledgerKey, unseenVerdicts } from "./verdict.js";
@@ -20,14 +20,15 @@ const pkg = (over: Partial<ChorePackage> = {}): ChorePackage => ({
     ...over,
 });
 
-// A repository that is a Node workspace with documents, a pipeline and an image — so every chore APPLIES by
-// default and each applicability test can turn off exactly the one fact it is about.
+// A repository that is a Node workspace with documents, a pipeline, an image and a Tailwind front-end — so every
+// chore APPLIES by default and each applicability test can turn off exactly the one fact it is about.
 const shape = (over: Partial<ChoreShape> = {}): ChoreShape => ({
     docs: [`docs/architecture/repo.md`],
     dockerfiles: [`Dockerfile`],
     ci: [`.github/workflows/ci.yml`],
     lockfile: true,
     packageManifest: true,
+    deps: [`tailwindcss`, `vue`],
     ...over,
 });
 
@@ -46,10 +47,21 @@ const probe = (over: Partial<ProbeResult> & Pick<ProbeResult, "id">): ProbeResul
 const auditProbe = (names: readonly string[]): ProbeResult =>
     probe({
         id: `audit`,
-        facts: { id: `audit`, advisories: names.map((name) => ({ name, severity: `high` as const, title: `${name} is bad`, patched: `>=2`, dev: false })) },
-    });
-
-const report = (over: Partial<ChoresReport> = {}): ChoresReport => ({ repos: [{ repo: `app`, probes: [], signals: signals() }], ledger: [], node: `v24.18.0`, ...over });
+        facts: {
+            id: `audit`,
+            advisories: names.map((name) => ({ name, severity: `high` as const, title: `${name} is bad`, patched: `>=2`, dev: false })),
+        },
+    });
+
+const report = (over: Partial<ChoresReport> = {}): ChoresReport => ({
+    repos: [{ repo: `app`, probes: [], signals: signals() }],
+    ledger: [],
+    // Verdicts are about EVIDENCE, never about work in flight — a probe running does not make a chore more or
+    // less due, it only makes the panel say so. Empty here because no assertion in this file should depend on it.
+    running: [],
+    node: `v24.18.0`,
+    ...over,
+});
 
 const verdictFor = (input: ChoresReport, chore: string, repo = `app`) => {
     const found = assessReport(input, NOW).find((verdict) => verdict.chore.id === chore && verdict.repo === repo);
@@ -70,7 +82,9 @@ describe(`what "we have not measured this" means`, () => {
     // does not have is not evidence of anything, and it carries the tool's own reason rather than an invented one.
     test(`a probe the repository cannot run says so, and never badges`, () => {
         const input = report({
-            repos: [{ repo: `app`, probes: [probe({ id: `knip`, state: `unavailable`, reason: `knip is not a devDependency` })], signals: signals() }],
+            repos: [
+                { repo: `app`, probes: [probe({ id: `knip`, state: `unavailable`, reason: `knip is not a devDependency` })], signals: signals() },
+            ],
         });
         const verdict = verdictFor(input, `dead-code`);
         expect(verdict.state).toBe(`unavailable`);
@@ -107,7 +121,10 @@ describe(`the ledger debounces; it cannot hide`, () => {
     // The point of digesting evidence rather than stamping a time: a fix landing, or a NEW advisory arriving,
     // both move the evidence and both deserve to be heard again.
     test(`evidence that has moved since the run is unsettled again`, () => {
-        const moved = report({ repos: [{ repo: `app`, probes: [auditProbe([`left-pad`, `minimist`])], signals: signals() }], ledger: [ledgerEntry()] });
+        const moved = report({
+            repos: [{ repo: `app`, probes: [auditProbe([`left-pad`, `minimist`])], signals: signals() }],
+            ledger: [ledgerEntry()],
+        });
         const verdict = verdictFor(moved, `security-advisories`);
         expect(verdict.state).toBe(`due`);
         expect(verdict.settled).toBe(false);
@@ -143,6 +160,76 @@ describe(`the ledger debounces; it cannot hide`, () => {
     });
 });
 
+/* The distinction the digest alone cannot draw, and the one whose absence had the panel quoting a six-day-old
+ * dead-code count an hour after the turn that deleted it. An unchanged digest is what a probe that never re-ran
+ * produces, so "the fix did not move the numbers" and "we have not looked since the fix" reached the same branch
+ * and both came out as a confident `due`. */
+describe(`a measurement older than the work is not evidence about the work`, () => {
+    const withAdvisories = report({ repos: [{ repo: `app`, probes: [auditProbe([`left-pad`])], signals: signals() }] });
+    const ledgerEntry = (over: Partial<ChoreLedgerEntry> = {}): ChoreLedgerEntry => ({
+        repo: `app`,
+        chore: `security-advisories`,
+        ranAt: NOW - DAY,
+        runId: `r1`,
+        outcome: `acted`,
+        digest: verdictFor(withAdvisories, `security-advisories`).digest,
+        ...over,
+    });
+
+    // The probe ran a day ago; the turn started an hour ago. Whatever it did, nothing has looked since.
+    test(`a turn that landed after the measurement steps the chore down from due`, () => {
+        const verdict = verdictFor({ ...withAdvisories, ledger: [ledgerEntry({ ranAt: NOW - 3_600_000 })] }, `security-advisories`);
+        expect(verdict.state).toBe(`stale`);
+        // The evidence stays on the row — it is what the reader checks the claim against — and the claim comes off.
+        expect(verdict.detail).not.toEqual([]);
+        expect(verdict.settled).toBe(false);
+    });
+
+    // No prompt, so the row cannot offer to spend a second turn on a finding nobody has re-checked; and no badge,
+    // which is what stops the tile lighting for work that is already done.
+    test(`a stale chore offers no turn and never badges`, () => {
+        const verdict = verdictFor({ ...withAdvisories, ledger: [ledgerEntry({ ranAt: NOW - 3_600_000 })] }, `security-advisories`);
+        expect(verdict.prompt).toBeUndefined();
+        expect(unseenVerdicts([verdict], {})).toEqual([]);
+    });
+
+    // Re-measuring is the whole cure: the same run, against evidence taken after it, is settled rather than stale.
+    test(`re-measuring after the turn restores the verdict — due, and now genuinely settled`, () => {
+        const remeasured = report({
+            repos: [{ repo: `app`, probes: [{ ...auditProbe([`left-pad`]), ranAt: NOW - 60_000 }], signals: signals() }],
+            ledger: [ledgerEntry({ ranAt: NOW - 3_600_000 })],
+        });
+        const verdict = verdictFor(remeasured, `security-advisories`);
+        expect(verdict.state).toBe(`due`);
+        expect(verdict.settled).toBe(true);
+    });
+
+    // The agent's own "these were false positives" is a judgement about the live tree, made after the measurement.
+    // It outranks staleness, or every clean run would be re-opened by the very probe age it was reported against.
+    test(`an agent reporting the findings did not hold up still clears the chore`, () => {
+        const verdict = verdictFor({ ...withAdvisories, ledger: [ledgerEntry({ ranAt: NOW - 3_600_000, outcome: `clean` })] }, `security-advisories`);
+        expect(verdict.state).toBe(`clear`);
+    });
+
+    // A snooze is the owner speaking, and it outranks both.
+    test(`a snooze still wins`, () => {
+        const verdict = verdictFor(
+            { ...withAdvisories, ledger: [ledgerEntry({ ranAt: NOW - 3_600_000, snoozedUntil: NOW + DAY })] },
+            `security-advisories`,
+        );
+        expect(verdict.state).toBe(`snoozed`);
+    });
+
+    // Every measured row carries when it was taken, so no row can pass off a week-old count as this morning's.
+    test(`every measured verdict says when it was measured, and the unmeasurable ones say nothing`, () => {
+        expect(verdictFor(withAdvisories, `security-advisories`).measuredAt).toBe(NOW - DAY);
+        // A survey rests on no measurement — it is decided by the calendar, and has nothing to be out of date.
+        expect(verdictFor(report(), `standardize-patterns`).measuredAt).toBeUndefined();
+        // Nor does a probe that never ran.
+        expect(verdictFor(report(), `security-advisories`).measuredAt).toBeUndefined();
+    });
+});
+
 describe(`surveys are due because time passed, and say so`, () => {
     const surveyLedger = (ranAt: number): ChoreLedgerEntry => ({
         repo: `app`,
@@ -178,7 +265,10 @@ describe(`the badge speaks about transitions, not about statistics`, () => {
         const seen = { [ledgerKey(`app`, `security-advisories`)]: first.digest };
         expect(unseenVerdicts([first], seen)).toEqual([]);
 
-        const next = verdictFor(report({ repos: [{ repo: `app`, probes: [auditProbe([`left-pad`, `tar`])], signals: signals() }] }), `security-advisories`);
+        const next = verdictFor(
+            report({ repos: [{ repo: `app`, probes: [auditProbe([`left-pad`, `tar`])], signals: signals() }] }),
+            `security-advisories`,
+        );
         expect(unseenVerdicts([next], seen)).toHaveLength(1);
     });
 
@@ -202,7 +292,15 @@ describe(`the badge speaks about transitions, not about statistics`, () => {
 
 describe(`the findings themselves`, () => {
     test(`complexity reports only files that are load-bearing or out of proportion, never just the ranking's top`, () => {
-        const hotspot = (path: string, complexity: number) => ({ path, commits: 20, adds: 100, dels: 50, complexity, score: complexity * 20, latestMs: NOW });
+        const hotspot = (path: string, complexity: number) => ({
+            path,
+            commits: 20,
+            adds: 100,
+            dels: 50,
+            complexity,
+            score: complexity * 20,
+            latestMs: NOW,
+        });
         // An even ranking has no outlier and no key module in it: a healthy repository, and an empty finding.
         const even = report({
             repos: [{ repo: `app`, probes: [], signals: signals({ hotspots: [hotspot(`a.ts`, 30), hotspot(`b.ts`, 28), hotspot(`c.ts`, 26)] }) }],
@@ -224,7 +322,10 @@ describe(`the findings themselves`, () => {
                 {
                     repo: `app`,
                     probes: [],
-                    signals: signals({ indexed: false, hotspots: [{ path: `a.ts`, commits: 9, adds: 1, dels: 1, complexity: 900, score: 8100, latestMs: NOW }] }),
+                    signals: signals({
+                        indexed: false,
+                        hotspots: [{ path: `a.ts`, commits: 9, adds: 1, dels: 1, complexity: 900, score: 8100, latestMs: NOW }],
+                    }),
                 },
             ],
         });
@@ -259,7 +360,8 @@ describe(`the findings themselves`, () => {
 });
 
 describe(`the prompts`, () => {
-    const dueVerdict = () => verdictFor(report({ repos: [{ repo: `app`, probes: [auditProbe([`left-pad`])], signals: signals() }] }), `security-advisories`);
+    const dueVerdict = () =>
+        verdictFor(report({ repos: [{ repo: `app`, probes: [auditProbe([`left-pad`])], signals: signals() }] }), `security-advisories`);
 
     /* A prompt that counts without NAMING sends the agent off to re-derive a list we are already holding — slowly,
      * and against a tree that has moved since. Every measured chore names its artefacts. */
@@ -283,9 +385,27 @@ describe(`the prompts`, () => {
                         repo: `app`,
                         probes: [
                             auditProbe([`left-pad`]),
-                            probe({ id: `outdated`, facts: { id: `outdated`, packages: [{ name: `vue`, current: `1.0.0`, latest: `2.0.0`, kind: `major`, section: `dependencies` }] } }),
-                            probe({ id: `knip`, facts: { id: `knip`, deadCode: { files: 3, exports: 2, types: 0, dependencies: 1, devDependencies: 0, sample: [`a.ts`] } } }),
-                            probe({ id: `jscpd`, facts: { id: `jscpd`, duplication: { percentage: 9, clones: 4, top: [{ lines: 20, first: `a.ts`, second: `b.ts` }] } } }),
+                            probe({
+                                id: `outdated`,
+                                facts: {
+                                    id: `outdated`,
+                                    packages: [{ name: `vue`, current: `1.0.0`, latest: `2.0.0`, kind: `major`, section: `dependencies` }],
+                                },
+                            }),
+                            probe({
+                                id: `knip`,
+                                facts: {
+                                    id: `knip`,
+                                    deadCode: { files: 3, exports: 2, types: 0, dependencies: 1, devDependencies: 0, sample: [`a.ts`] },
+                                },
+                            }),
+                            probe({
+                                id: `jscpd`,
+                                facts: {
+                                    id: `jscpd`,
+                                    duplication: { percentage: 9, clones: 4, top: [{ lines: 20, first: `a.ts`, second: `b.ts` }] },
+                                },
+                            }),
                         ],
                         signals: signals({ packages: [pkg({ documented: false, dependencies: [`zod`, `joi`] })] }),
                     },
@@ -323,7 +443,7 @@ describe(`what does not apply here`, () => {
     test(`a repository with no documents is not asked to re-read its documentation`, () => {
         const verdict = verdictFor(withShape({ docs: [] }), `documentation-drift`);
         expect(verdict.state).toBe(`not-applicable`);
-        expect(verdict.headline).toBe(`this repository has no architecture documents to re-read`);
+        expect(verdict.headline).toBe(`no architecture documents`);
         expect(verdict.prompt).toBeUndefined();
     });
 
@@ -352,10 +472,12 @@ describe(`what does not apply here`, () => {
     // fires forever in repositories where its subject does not exist. This is the regression that motivated
     // making `applies` a required field on SurveySpec rather than an optional one.
     test(`a tiny repository is not surveyed for cross-cutting patterns it cannot have`, () => {
-        const tiny = report({ repos: [{ repo: `app`, probes: [], signals: signals({ totals: { files: 4, symbols: 10, complexity: 5, hotspots: 0 } }) }] });
+        const tiny = report({
+            repos: [{ repo: `app`, probes: [], signals: signals({ totals: { files: 4, symbols: 10, complexity: 5, hotspots: 0 } }) }],
+        });
         const verdict = verdictFor(tiny, `standardize-patterns`);
         expect(verdict.state).toBe(`not-applicable`);
-        expect(verdict.headline).toContain(`4 indexed files`);
+        expect(verdict.headline).toBe(`only 4 indexed files`);
     });
 
     test(`applicability is decided before measurement, so a missing probe never masks it`, () => {
@@ -373,6 +495,222 @@ describe(`what does not apply here`, () => {
     test(`a fully-equipped repository rules nothing out`, () => {
         expect(assessReport(withShape({}), NOW).filter((verdict) => verdict.state === `not-applicable`)).toEqual([]);
     });
+
+    /* THE CAUSES HAVE TO GROUP, and that is a fact about the STRINGS rather than about the gates. The scope strip
+     * prints one line per distinct cause with the chores it costs listed beside it, so two gates that both mean
+     * "there is no package.json here" and say it in different words print two lines — and a workspace root, where
+     * a dozen chores are ruled out by three facts, is back to the paragraph-per-chore wall this phrasing replaced.
+     * Bounded rather than enumerated: a new gate may invent a new cause, it may not invent a new sentence. */
+    test(`applicability reasons are bare causes, so the ones that mean the same thing group`, () => {
+        const bare = withShape({ packageManifest: false, lockfile: false, docs: [], ci: [], dockerfiles: [], deps: [] });
+        const causes = assessReport(bare, NOW)
+            .filter((verdict) => verdict.state === `not-applicable`)
+            .map((verdict) => verdict.headline);
+        for (const cause of causes) {
+            expect(cause, cause).toMatch(/^[a-z]/);
+            expect(cause.split(` `).length, cause).toBeLessThanOrEqual(4);
+        }
+        // Four chores are ruled out by ONE absent file, and the strip says so once rather than four times.
+        expect(causes.filter((cause) => cause === `no package.json`)).toHaveLength(4);
+    });
+});
+
+/* THE FRONT-END CHORES. Four chores over two probes, tested where they decide something — the share that makes a
+ * bundle a finding, the names that make two components one component, and above all the digests, because three of
+ * these four measure things that move every time anyone writes a line of markup. */
+const uiProbe = (scan: Partial<UiScan> = {}): ProbeResult =>
+    probe({ id: `ui`, facts: { id: `ui`, scan: { components: [], bypasses: [], idioms: [], ...scan } } });
+
+const bundleProbe = (assets: Bundle["assets"]): ProbeResult =>
+    probe({
+        id: `bundle`,
+        facts: {
+            id: `bundle`,
+            bundle: {
+                dir: `dist`,
+                assets,
+                totalBytes: assets.reduce((sum, asset) => sum + asset.bytes, 0),
+                totalGzip: assets.reduce((sum, asset) => sum + asset.gzip, 0),
+            },
+        },
+    });
+
+const jscpdProbe = (top: Duplication["top"]): ProbeResult =>
+    probe({ id: `jscpd`, facts: { id: `jscpd`, duplication: { percentage: 1, clones: top.length, top } } });
+
+const withProbes = (probes: readonly ProbeResult[], over: Partial<ChoreShape> = {}): ChoresReport =>
+    report({ repos: [{ repo: `app`, probes: [...probes], signals: signals({ shape: shape(over) }) }] });
+
+const chunk = (path: string, gzip: number): Bundle["assets"][number] => ({ path, bytes: gzip * 3, gzip });
+
+describe(`what the browser downloads`, () => {
+    test(`one chunk over half the transfer is the finding, and the headline names it`, () => {
+        const verdict = verdictFor(
+            withProbes([bundleProbe([chunk(`dist/vendor-DlAUqK2U.js`, 800), chunk(`dist/index-a1.js`, 100), chunk(`dist/s-b2.css`, 50)])]),
+            `bundle-weight`,
+        );
+        expect(verdict.state).toBe(`due`);
+        expect(verdict.headline).toContain(`dist/vendor-DlAUqK2U.js`);
+        expect(verdict.headline).toContain(`84%`);
+    });
+
+    test(`a build that is actually split says nothing`, () => {
+        const even = [chunk(`dist/a-1.js`, 100), chunk(`dist/b-2.js`, 100), chunk(`dist/c-3.js`, 100), chunk(`dist/d-4.js`, 100)];
+        expect(verdictFor(withProbes([bundleProbe(even)]), `bundle-weight`).state).toBe(`clear`);
+    });
+
+    // Two files cannot tell you how a build is divided, and the larger of them is over half by arithmetic.
+    test(`too few assets to have a shape is clear, not due`, () => {
+        expect(verdictFor(withProbes([bundleProbe([chunk(`dist/a-1.js`, 900), chunk(`dist/b-2.js`, 10)])]), `bundle-weight`).state).toBe(`clear`);
+    });
+
+    /* THE CASE THIS CHORE WOULD OTHERWISE FAIL EVERY DAY. A content hash changing is what a content hash is for,
+     * so rebuilding identical code renames every asset. Digesting the raw paths would mint new evidence on every
+     * `pnpm build` and badge forever while reporting nothing new. */
+    test(`rebuilding the same code does not read as new evidence`, () => {
+        const before = verdictFor(
+            withProbes([bundleProbe([chunk(`dist/vendor-DlAUqK2U.js`, 800), chunk(`dist/index-a1b2c3d4.js`, 100), chunk(`dist/s.css`, 50)])]),
+            `bundle-weight`,
+        );
+        const after = verdictFor(
+            withProbes([bundleProbe([chunk(`dist/vendor-Zq99XxYw.js`, 802), chunk(`dist/index-9z8y7x6w.js`, 101), chunk(`dist/s.css`, 50)])]),
+            `bundle-weight`,
+        );
+        expect(after.digest).toBe(before.digest);
+    });
+
+    test(`a genuinely different chunk appearing does`, () => {
+        const before = verdictFor(
+            withProbes([bundleProbe([chunk(`dist/vendor-DlAUqK2U.js`, 800), chunk(`dist/index-a1b2c3d4.js`, 100), chunk(`dist/s.css`, 50)])]),
+            `bundle-weight`,
+        );
+        const after = verdictFor(
+            withProbes([bundleProbe([chunk(`dist/vendor-DlAUqK2U.js`, 800), chunk(`dist/charting-a1b2c3d4.js`, 100), chunk(`dist/s.css`, 50)])]),
+            `bundle-weight`,
+        );
+        expect(after.digest).not.toBe(before.digest);
+    });
+});
+
+describe(`idioms the framework has replaced`, () => {
+    const idioms = (id: string, count: number) => ({ id, files: Array.from({ length: count }, (_, index) => `src/C${index}.vue`) });
+
+    test(`names what is still in use and what replaced it`, () => {
+        const verdict = verdictFor(withProbes([uiProbe({ idioms: [idioms(`vue-options-api`, 3)] })]), `framework-idiom`);
+        expect(verdict.state).toBe(`due`);
+        expect(verdict.detail).toEqual([`3 files · the Options API → <script setup> with the Composition API`]);
+    });
+
+    /* A migration in progress is a set that changes on every commit, so digesting the file identities — which is
+     * right for the documentation chore, whose set is packages — would badge continuously through exactly the
+     * period someone is doing the work. The bucketed count moves on real progress and not on daily churn. */
+    test(`one more file in a large migration is not news`, () => {
+        const before = verdictFor(withProbes([uiProbe({ idioms: [idioms(`vue-options-api`, 40)] })]), `framework-idiom`);
+        const after = verdictFor(withProbes([uiProbe({ idioms: [idioms(`vue-options-api`, 41)] })]), `framework-idiom`);
+        expect(after.digest).toBe(before.digest);
+    });
+
+    test(`a kind of legacy code the repository did not have before is`, () => {
+        const before = verdictFor(withProbes([uiProbe({ idioms: [idioms(`vue-options-api`, 40)] })]), `framework-idiom`);
+        const after = verdictFor(withProbes([uiProbe({ idioms: [idioms(`vue-options-api`, 40), idioms(`vue-global-api`, 1)] })]), `framework-idiom`);
+        expect(after.digest).not.toBe(before.digest);
+    });
+
+    // The daemon composes the sweep from its own copy of the table, so an image ahead of the browser can report a
+    // rule this build has no label or replacement for. A row about it could say nothing useful.
+    test(`an idiom this build of the book does not know is dropped, not shown unnamed`, () => {
+        expect(verdictFor(withProbes([uiProbe({ idioms: [idioms(`react-from-2029`, 5)] })]), `framework-idiom`).state).toBe(`clear`);
+    });
+
+    /* A probe's command is a fixed string, so every rule sweeps every repository and the Angular patterns get
+     * their chance in a Vue codebase. Run against this workspace it found one file: the rule table itself, which
+     * quotes `RouterModule.forRoot` as a pattern. What the repository declares is what settles it. */
+    test(`an idiom from a framework the repository does not declare is not its problem`, () => {
+        const vue = withProbes([uiProbe({ idioms: [idioms(`angular-ngmodule`, 4)] })], { deps: [`vue`] });
+        const angular = withProbes([uiProbe({ idioms: [idioms(`angular-ngmodule`, 4)] })], { deps: [`@angular/core`] });
+        expect(verdictFor(vue, `framework-idiom`).state).toBe(`clear`);
+        expect(verdictFor(angular, `framework-idiom`).state).toBe(`due`);
+    });
+});
+
+describe(`components built twice`, () => {
+    const components = (...paths: readonly string[]) => uiProbe({ components: [...paths] });
+
+    test(`a shared name across two directories is a family, whatever each file is called`, () => {
+        const verdict = verdictFor(
+            withProbes([components(`src/ui/BaseButton.vue`, `src/checkout/ButtonV2.tsx`), jscpdProbe([])]),
+            `component-overlap`,
+        );
+        expect(verdict.state).toBe(`due`);
+        expect(verdict.headline).toBe(`1 name used by more than one component`);
+        expect(verdict.detail).toEqual([`button · src/checkout/ButtonV2.tsx, src/ui/BaseButton.vue`]);
+    });
+
+    test(`components that merely coexist are not a finding`, () => {
+        expect(verdictFor(withProbes([components(`src/Button.vue`, `src/Card.vue`), jscpdProbe([])]), `component-overlap`).state).toBe(`clear`);
+    });
+
+    // The other half of the evidence: two components with unrelated names doing the same work, which no name
+    // comparison can reach and jscpd already measured.
+    test(`a clone counts only when a component sits on both sides of it`, () => {
+        const ui = components(`src/Chart.vue`, `src/Graph.vue`);
+        const shared = verdictFor(
+            withProbes([ui, jscpdProbe([{ lines: 40, first: `./src/Chart.vue`, second: `./src/Graph.vue` }])]),
+            `component-overlap`,
+        );
+        const oneSided = verdictFor(
+            withProbes([ui, jscpdProbe([{ lines: 40, first: `./src/Chart.vue`, second: `./src/utils/format.ts` }])]),
+            `component-overlap`,
+        );
+        expect(shared.state).toBe(`due`);
+        expect(shared.headline).toBe(`1 clone spanning two of them`);
+        expect(oneSided.state).toBe(`clear`);
+    });
+
+    /* Half a measurement would let the row claim it looked for shared logic in a repository where jscpd has never
+     * run — the "measured and found nothing" lie the unavailable state exists to prevent. */
+    test(`without the clone sweep the chore is unavailable, not clear`, () => {
+        expect(verdictFor(withProbes([components(`src/Button.vue`, `src/ui/Button.vue`)]), `component-overlap`).state).toBe(`unavailable`);
+    });
+});
+
+describe(`hard-coded styles`, () => {
+    test(`counts the values and leads with the heaviest files`, () => {
+        const verdict = verdictFor(
+            withProbes([
+                uiProbe({
+                    bypasses: [
+                        { path: `src/Checkout.vue`, count: 11 },
+                        { path: `src/Nav.vue`, count: 2 },
+                    ],
+                }),
+            ]),
+            `tailwind-arbitrary-values`,
+        );
+        expect(verdict.state).toBe(`due`);
+        expect(verdict.headline).toBe(`13 hard-coded values across 2 files`);
+        expect(verdict.detail[0]).toBe(`src/Checkout.vue · 11 values`);
+    });
+
+    // Tailwind gates this one alone — a Vue repository with no Tailwind has no theme scale to have bypassed, and
+    // a row saying so would be the surface inventing a subject.
+    test(`a repository without Tailwind is not asked the question at all`, () => {
+        const verdict = verdictFor(
+            withProbes([uiProbe({ bypasses: [{ path: `src/Nav.vue`, count: 2 }] })], { deps: [`vue`] }),
+            `tailwind-arbitrary-values`,
+        );
+        expect(verdict.state).toBe(`not-applicable`);
+        expect(verdict.headline).toBe(`no Tailwind`);
+    });
+
+    // And the framework gate the other four share, from the other side: deps come from shape, not from packages,
+    // because a single-package Vite app has no workspace packages at all.
+    test(`a repository with no framework rules the front-end chores out entirely`, () => {
+        const states = [`bundle-weight`, `framework-idiom`, `component-overlap`, `tailwind-arbitrary-values`].map(
+            (id) => verdictFor(withProbes([], { deps: [`pino`] }), id).state,
+        );
+        expect(states).toEqual([`not-applicable`, `not-applicable`, `not-applicable`, `not-applicable`]);
+    });
 });
 
 /* THE CRITERION — the rule in words, next to the evidence that met it. A row that reports a number without the