@ok-ggwp/git-gloss 0.4.0 → 0.6.0

package/dist/config.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { GlossError, gitTry } from './git.js';
+import { git, GitError, GlossError, gitTry } from './git.js';
 import { globToRegExp } from './glob.js';
 // Settings for the computed signals, in three layers (later wins for scalars,
 // repo config extends the lists of the one before):
@@ -135,6 +135,31 @@ function gitInt(key) {
         throw new ConfigError(`git config gloss.attention.${key} must be a positive integer, got "${v}"`);
     return Number(v);
 }
+// Git failing (a broken repo, an unreadable object, no permission) is not the
+// same as "no base" or "no file": the repo's own, perhaps stricter, config
+// would silently not apply. It is not fatal either (the built-in defaults
+// still give a floor, and refusing to rate anything would make every command
+// fail in a damaged repo), so it is warned about on stderr, once per message,
+// and the defaults are used.
+const warned = new Set();
+function warnOnce(msg) {
+    if (warned.has(msg))
+        return;
+    warned.add(msg);
+    console.error(`warning: ${msg}`);
+}
+// git's output, or null when it exits 1 with nothing to say (its way of
+// answering "no"); any other failure is thrown.
+function gitAnswer(args) {
+    try {
+        return git(args);
+    }
+    catch (err) {
+        if (err instanceof GitError && err.status === 1 && /failed$/.test(err.message))
+            return null;
+        throw err;
+    }
+}
 // The config is read from the base branch, not the working tree: a change under
 // review must not be able to reclassify its own paths or add patterns that
 // lower its own floor. The base is the merge base of the checked-out HEAD (not
@@ -145,18 +170,49 @@ function gitInt(key) {
 // the change's own config. Editing the file in a change is itself flagged: it
 // is always a `sensitive` path.
 function trustedRef() {
+    // No commits yet: no base, and nothing failed.
+    if (gitAnswer(['rev-parse', '--verify', '-q', 'HEAD']) === null)
+        return noBase();
+    let failed = false;
     // Full ref names, so a tag called "main" cannot stand in for the branch.
     for (const b of ['refs/remotes/origin/main', 'refs/heads/main', 'refs/remotes/origin/master', 'refs/heads/master']) {
-        const mb = gitTry(['merge-base', 'HEAD', b])?.trim();
-        if (mb)
-            return mb;
+        try {
+            if (gitAnswer(['rev-parse', '--verify', '-q', b]) === null)
+                continue;
+            const mb = gitAnswer(['merge-base', 'HEAD', b])?.trim();
+            if (mb)
+                return mb;
+        }
+        catch (err) {
+            // A broken candidate does not hide the ones after it.
+            failed = true;
+            warnOnce(`git failed finding the base branch with ${b} (${err.message}); trying the next candidate`);
+        }
     }
+    // Some candidate failed: git's warning above is the reason, not an absent branch.
+    return failed ? (console.error(`warning: no working base branch, so ${CONFIG_FILE} is not read; using the built-in defaults`), null) : noBase();
+}
+function noBase() {
     console.error('warning: no base branch (origin/main, main, origin/master, master) found, so .gloss/config.json is not read; using the built-in defaults');
     return null;
 }
+// The config file at `ref`: null when the file is not there (the usual case),
+// a warning and null when git could not tell or could not read it. Presence
+// is asked of ls-tree (empty output: absent), not read off an error message.
+function configAt(ref) {
+    try {
+        if (!git(['ls-tree', '--full-tree', '--name-only', ref, '--', CONFIG_FILE]).trim())
+            return null;
+        return git(['show', `${ref}:${CONFIG_FILE}`]);
+    }
+    catch (err) {
+        warnOnce(`${CONFIG_FILE} could not be read from the base branch (${err.message}); using the built-in defaults, so the repo's own patterns do not apply`);
+        return null;
+    }
+}
 function readRepoConfig() {
     const ref = trustedRef();
-    const text = ref ? gitTry(['show', `${ref}:${CONFIG_FILE}`]) : null;
+    const text = ref ? configAt(ref) : null;
     if (text === null)
         return undefined;
     let json;

package/dist/findings.js

@@ -0,0 +1,254 @@
+// Stable references for the findings of a review report. Reports are free
+// markdown and every reviewer formats them differently, so for DISPLAY each
+// top-level list item is rewritten as `- **[S.N]** text`, S the section number
+// and N the item's position in that section. Nothing stored is changed: the
+// report stays raw in the notes, and verdicts and review keys use the raw text.
+//
+// The input is untrusted and up to 256 KiB, so this is one pass over the lines
+// with no backtracking patterns: every line is looked at a bounded number of
+// characters from its start (a 200 KB line costs no more than a short one,
+// apart from the copy into the output).
+//
+// Section numbers:
+//  - a heading (# to ######) that starts with a number (`1.`, `1)` or `1`) sets
+//    the section to that number;
+//  - any other heading is the previous section plus one;
+//  - EXCEPT titles: unnumbered headings before the first list item or numbered
+//    heading take no number (the first item then falls in section 1). So the
+//    headings `honesty`, `Review of X`, `1. Mismatches`, `Misgraded necessity`,
+//    `3. Removal` give sections 1, 2, 3, and `## A`, `## B` with items under
+//    both give 1 and 2.
+//  - a heading is a `#` line, or a line that is ONLY bold text (`**1. Title**`,
+//    `__Title__`, optional trailing colon), or, conservatively, a plain
+//    `1. Title` / `1) Title` line that is short, has no sentence punctuation
+//    at its end, follows a blank line (or the start), and whose next non-empty
+//    line (within two blank lines) is a bullet or another heading: an ordinary
+//    numbered sentence, or a numbered list, is an item, not a heading.
+//  - list items before any heading are labelled `[N]` (no section).
+// Items are indent-0 `-`, `*`, `+`, `1.` or `1)` lines; indented sub-items and
+// wrapped lines are left alone, as are fenced code blocks, rules and empty
+// items. A numbered heading with no list under it keeps its own number as its
+// ref (`1`) and gets no label. Running it on its own output changes nothing.
+const isDigit = (c) => c >= '0' && c <= '9';
+const MAXDIG = 6;
+// The section number at the start of a heading's text: up to 3 digits, then `.` or
+// `)`, then a space or the end. `2024 results` and `10 files changed` are text.
+function leadingNumber(s) {
+    let i = 0;
+    while (i < s.length && i < 4 && isDigit(s[i]))
+        i++;
+    if (i === 0 || i > 3)
+        return null;
+    if (s[i] !== '.' && s[i] !== ')')
+        return null;
+    i++;
+    if (i < s.length && s[i] !== ' ' && s[i] !== '\t')
+        return null;
+    return Number(s.slice(0, i - 1));
+}
+function headingText(line) {
+    let i = 0;
+    while (i < 3 && line[i] === ' ')
+        i++;
+    let h = 0;
+    while (line[i + h] === '#' && h < 7)
+        h++;
+    if (h < 1 || h > 6)
+        return null;
+    const c = line[i + h];
+    if (c !== undefined && c !== ' ' && c !== '\t')
+        return null;
+    let j = i + h;
+    while (line[j] === ' ' || line[j] === '\t')
+        j++;
+    return line.slice(j, j + 16);
+}
+// The text of a line made only of bold (`**x**`, `__x__`, optional colon), else null.
+function boldOnly(line) {
+    const mark = line.startsWith('**') ? '**' : line.startsWith('__') ? '__' : null;
+    if (mark === null)
+        return null;
+    let end = line.length;
+    while (end > 0 && (line[end - 1] === ' ' || line[end - 1] === '\t' || line[end - 1] === '\r'))
+        end--;
+    if (line[end - 1] === ':')
+        end--;
+    if (end < 2 * mark.length + 1 || !line.startsWith(mark, end - mark.length))
+        return null;
+    const inner = line.slice(mark.length, end - mark.length);
+    if (inner.indexOf(mark) !== -1 || inner.trim() === '')
+        return null;
+    return inner.trimStart().slice(0, 16);
+}
+const isBullet = (l) => (l[0] === '-' || l[0] === '*' || l[0] === '+') && (l[1] === ' ' || l[1] === '\t');
+// A plain `1. Title` line that is a section title rather than a numbered finding.
+function plainTitle(lines, n) {
+    const line = lines[n];
+    if (leadingNumber(line.slice(0, 12)) === null || itemText(line) === null)
+        return false;
+    if (line.length > 70 || (n > 0 && lines[n - 1].trim() !== ''))
+        return false;
+    const last = line.trimEnd().slice(-1);
+    if ('.!?,;:'.includes(last) && last !== ':')
+        return false;
+    // A real title has a blank line after it too: `1. Race` straight above bullets is an item with sub-items.
+    if (n + 1 >= lines.length || lines[n + 1].trim() !== '')
+        return false;
+    let k = n + 1;
+    while (k < lines.length && k <= n + 3 && lines[k].trim() === '')
+        k++;
+    if (k >= lines.length || k > n + 3)
+        return false;
+    const next = lines[k];
+    return isBullet(next) || headingText(next) !== null || boldOnly(next) !== null;
+}
+// The text after a top-level list marker, or null when the line is not an item.
+function itemText(line) {
+    const c = line[0];
+    let i = 0;
+    if (c === '-' || c === '*' || c === '+')
+        i = 1;
+    else if (c !== undefined && isDigit(c)) {
+        while (i < MAXDIG + 1 && isDigit(line[i] ?? ''))
+            i++;
+        if (i > MAXDIG || (line[i] !== '.' && line[i] !== ')'))
+            return null;
+        i++;
+    }
+    else
+        return null;
+    if (line[i] !== ' ' && line[i] !== '\t')
+        return null;
+    // A rule (`* * *`, `- - -`, `___`): at most 64 characters, so the pattern is bounded.
+    if (line.length <= 64 && /^([-*_])( *\1){2,} *$/.test(line))
+        return null;
+    let j = i;
+    while (line[j] === ' ' || line[j] === '\t')
+        j++;
+    if (j >= line.length)
+        return null;
+    return line.slice(j);
+}
+// Drop a label this function wrote before: `**[1.2]** `.
+function stripLabel(t) {
+    if (!t.startsWith('**['))
+        return t;
+    let i = 3;
+    while (i < 20 && (isDigit(t[i] ?? '') || t[i] === '.'))
+        i++;
+    if (i > 3 && t.startsWith(']**', i)) {
+        let j = i + 3;
+        while (t[j] === ' ')
+            j++;
+        return t.slice(j);
+    }
+    return t;
+}
+function scan(text) {
+    const lines = text.split('\n');
+    // Each ref with its text (an item's, or a numbered heading's line); the first wins.
+    const found = new Map();
+    const add = (ref, t) => { if (!found.has(ref))
+        found.set(ref, t); };
+    let section = 0, count = 0;
+    let sawHeading = false, sawNumbered = false, sawItem = false;
+    let fence = null;
+    for (let n = 0; n < lines.length; n++) {
+        const line = lines[n];
+        const t = line.trimStart();
+        if (t.startsWith('```') || t.startsWith('~~~')) {
+            if (fence === null)
+                fence = t.slice(0, 3);
+            else if (t.startsWith(fence))
+                fence = null;
+            continue;
+        }
+        if (fence !== null)
+            continue;
+        const h = headingText(line) ?? boldOnly(line) ?? (plainTitle(lines, n) ? line : null);
+        if (h !== null) {
+            const num = leadingNumber(h);
+            if (num !== null) {
+                section = num;
+                sawNumbered = true;
+                add(String(num), line.replace(/^[\s#*_]+/, '').replace(/^\d{1,3}[.)]?\s*/, '').replace(/[\s*_:]+$/, ''));
+            }
+            else if (!sawItem && !sawNumbered)
+                section = 0;
+            else
+                section += 1;
+            sawHeading = true;
+            count = 0;
+            continue;
+        }
+        const item = itemText(line);
+        if (item === null)
+            continue;
+        if (section === 0 && sawHeading)
+            section = 1;
+        sawItem = true;
+        count++;
+        const ref = sawHeading ? `${section}.${count}` : String(count);
+        add(ref, stripLabel(item));
+        lines[n] = `- **[${ref}]** ${stripLabel(item)}`;
+    }
+    return { out: lines.join('\n'), found };
+}
+export function labelFindings(text) {
+    return scan(text).out;
+}
+// The refs a report's findings carry (and its numbered headings'), as a set.
+export function findingRefs(text) {
+    return new Set(scan(text).found.keys());
+}
+// Each ref a report carries, once, with the text of its finding (raw, for the caller to clean).
+export function findingTexts(text) {
+    return [...scan(text).found];
+}
+// A decision's finding names a finding by starting with its ref: `1.2 wording nit`,
+// `1.2: ...`, or a bare section number only with a delimiter (`3: ...`, `3) ...`,
+// `3. ...`). Numbers are up to 3 digits, so `2024 migration` and `3 files` are text.
+export function refOf(finding) {
+    let i = 0;
+    while (i < 4 && isDigit(finding[i] ?? ''))
+        i++;
+    if (i === 0 || i > 3)
+        return null;
+    if (finding[i] === '.') {
+        let j = i + 1;
+        while (j < i + 5 && isDigit(finding[j] ?? ''))
+            j++;
+        if (j > i + 1 && j <= i + 4) {
+            const c = finding[j];
+            if (c === undefined || c === ' ' || c === '\t' || c === ':')
+                return finding.slice(0, j);
+        }
+    }
+    const c = finding[i];
+    if (c === ':' || c === ')')
+        return finding.slice(0, i);
+    if (c === '.' && (finding[i + 1] === undefined || finding[i + 1] === ' '))
+        return finding.slice(0, i);
+    return null;
+}
+function compareRefs(a, b) {
+    const [a1, a2 = '-1'] = a.split('.');
+    const [b1, b2 = '-1'] = b.split('.');
+    return Number(a1) - Number(b1) || Number(a2) - Number(b2);
+}
+// Finding order: decisions whose finding starts with a ref, by ref (1.2 before
+// 1.10, ties by time); the rest after them in time order.
+export function orderDecisions(input) {
+    const ds = [...input].sort((a, b) => a.at.localeCompare(b.at));
+    const withRef = [];
+    const rest = [];
+    for (const d of ds) {
+        const r = refOf(d.finding ?? '');
+        if (r === null)
+            rest.push(d);
+        else
+            withRef.push([r, d]);
+    }
+    withRef.sort((a, b) => compareRefs(a[0], b[0]));
+    return [...withRef.map((x) => x[1]), ...rest];
+}

package/dist/floor.js

@@ -1,7 +1,7 @@
 import { ConfigError, loadConfig } from './config.js';
 import { attentionForImpact, attentionRank, impactRank, maxAttention, maxImpact, raise } from './attention.js';
 import { servesOf } from './schema.js';
-import { analyze, CONFIG_EDIT_NOTE, partFloor } from './signals.js';
+import { analyze, CONFIG_EDIT_NOTE, partFloor, timedOutNotes } from './signals.js';
 import { changedCount, selections } from './selection.js';
 // The groups of a loaded gloss with their current hunks (a hunk that is gone is skipped).
 export function groupInputs(gloss) {
@@ -101,27 +101,54 @@ export function analyzeGroups(hunks, groups, cfg) {
         level = maxAttention(level, signals.floor.attention);
         reasons.push(`floor ${signals.floor.attention}: ${signals.floor.reasons[0] ?? signals.floor.impact}`);
     }
-    return { signals, groups: floors, floor: signals.floor.attention, derived: { level, reasons } };
+    return { signals, groups: floors, floor: signals.floor.attention, derived: { level, reasons }, timedOut: timedOutNotes(signals.hunks) };
 }
 export const analyzeGloss = (gloss, cfg) => analyzeGroups(gloss.hunks, groupInputs(gloss), cfg);
-export function ratingProblems(a, an) {
-    const warnings = [];
-    if (an.signals.floor.reasons.includes(CONFIG_EDIT_NOTE))
-        warnings.push(CONFIG_EDIT_NOTE);
+// Where a floor comes from, for messages.
+export const whyText = (why) => why.join('; ') || 'computed from the diff';
+export function ratingIssues(a, an) {
+    const belowFloor = [];
+    const unrated = [];
     for (const g of a.groups) {
         const f = an.groups.get(g.id);
-        // A floor of plain "module" is the baseline for source files, not a signal
-        // to warn about: a private helper may honestly be `local`.
-        if (!g.impact || !f || impactRank(f.floor) <= impactRank('module') || impactRank(g.impact) >= impactRank(f.floor))
+        if (g.impact) {
+            // A floor of plain "module" is the baseline for source files, not a signal
+            // to warn about: a private helper may honestly be `local`.
+            if (f && impactRank(f.floor) > impactRank('module') && impactRank(g.impact) < impactRank(f.floor))
+                belowFloor.push({ id: g.id, impact: g.impact, floor: f.floor, why: f.why });
             continue;
-        warnings.push(`group "${g.id}" is rated impact "${g.impact}" but its floor is "${f.floor}" (${f.why.join('; ') || 'computed from the diff'}); raise it, or say why in impact_reason`);
+        }
+        // A mechanical group on a floor signal (lockfile, config, CI, sensitive path)
+        // is not pure; plain module is the baseline for source files.
+        const signal = !!f && impactRank(f.floor) > impactRank('module');
+        if (g.necessity === 'mechanical' && !signal)
+            continue;
+        unrated.push({ id: g.id, floor: f?.floor ?? 'local', why: f?.why ?? [], signal });
     }
-    let underrated = null;
+    let attention = null;
     const att = a.attention;
     if (att && attentionRank(att.level) < attentionRank(an.floor) && !att.override_reason) {
         const why = an.signals.floor.reasons.length ? an.signals.floor.reasons.join('; ') : `${an.signals.floor.impact}: ordinary source changes`;
-        underrated = `attention.level "${att.level}" is below the computed floor "${an.floor}" (${why}); raise it, or explain with attention.override_reason`;
+        attention = { level: att.level, floor: an.floor, why };
+    }
+    return { configEdit: an.signals.floor.reasons.includes(CONFIG_EDIT_NOTE), belowFloor, unrated, attention };
+}
+export function ratingProblems(a, an) {
+    const issues = ratingIssues(a, an);
+    const warnings = [];
+    if (issues.configEdit)
+        warnings.push(CONFIG_EDIT_NOTE);
+    for (const b of issues.belowFloor) {
+        warnings.push(`group "${b.id}" is rated impact "${b.impact}" but its floor is "${b.floor}" (${whyText(b.why)}); raise it, or say why in impact_reason`);
+    }
+    const unrated = issues.unrated.map((u) => `"${u.id}"`);
+    const floored = issues.unrated.filter((u) => u.signal).map((u) => `${u.id}: floor ${u.floor}: ${whyText(u.why)}`);
+    if (unrated.length) {
+        const names = unrated.slice(0, 10).join(', ') + (unrated.length > 10 ? ` and ${unrated.length - 10} more` : '');
+        warnings.push(`no impact rated on group ${names}${floored.length ? ` (${floored.join('; ')})` : ''}; rate impact on every group except a mechanical one on plain source (floor module or below), see the gloss skill`);
     }
+    const att = issues.attention;
+    const underrated = att && `attention.level "${att.level}" is below the computed floor "${att.floor}" (${att.why}); raise it, or explain with attention.override_reason`;
     return { warnings, underrated };
 }
 let warned = false;

package/dist/git.js

@@ -4,6 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { Annotation, NOTE_FORMAT } from './schema.js';
 import { parsePath, unquote } from './diff.js';
+import { plain } from './plain.js';
 export const NOTES_REF = 'refs/notes/gloss';
 // Glosses of uncommitted work (wip snapshots) live in their own notes ref,
 // which sync never pushes, and the latest snapshot in a private ref that
@@ -18,6 +19,8 @@ export const EMPTY_TREE = '4b825dc642cb6eb9a060e54bf8d69288fbee4904';
 export class GlossError extends Error {
 }
 export class GitError extends GlossError {
+    // git's exit code, when it ran and failed (1 is often "no", 128 a real failure).
+    status;
 }
 export function git(args, input, env = {}) {
     try {
@@ -32,7 +35,9 @@ export function git(args, input, env = {}) {
     }
     catch (err) {
         const stderr = err.stderr?.trim();
-        throw new GitError(stderr || `git ${args.join(' ')} failed`);
+        const e = new GitError(stderr || `git ${args.join(' ')} failed`);
+        e.status = typeof err.status === 'number' ? err.status : undefined;
+        throw e;
     }
 }
 export function gitTry(args, input) {
@@ -224,6 +229,15 @@ function rawNote(ref, sha) {
         throw err;
     }
 }
+function cleanStrings(v) {
+    if (typeof v === 'string')
+        return plain(v, true);
+    if (Array.isArray(v))
+        return v.map(cleanStrings);
+    if (v && typeof v === 'object')
+        return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, cleanStrings(x)]));
+    return v;
+}
 export function readNote(sha) {
     // A commit's gloss, or a wip snapshot's (they are never the same object).
     const raw = rawNote(NOTES_REF, sha) ?? rawNote(WIP_NOTES_REF, sha);
@@ -249,7 +263,9 @@ export function readNote(sha) {
     if (![1, 2, 3, 4].includes(data?.gloss) || !Array.isArray(data.hunks) || !annotation.success) {
         throw new GlossError(`${at} is malformed; replace it with \`git gloss add --force\``);
     }
-    return { ...data, annotation: annotation.data };
+    // The gloss's text is shown in a terminal, and a note can come from anyone
+    // who can push to the remote: no escape sequences or control characters get through.
+    return { ...data, annotation: cleanStrings(annotation.data) };
 }
 export function writeNote(sha, note, ref = NOTES_REF) {
     git(['notes', '--ref', ref, 'add', '-f', '-F', '-', sha], JSON.stringify(note, null, 2) + '\n');

package/dist/html/client.js

@@ -62,7 +62,7 @@
     return { level: null, source: 'unrated' }
   }
   function fileCount(c) {
-    var seen = {}
+    var seen = Object.create(null)
     c.groups.forEach(function (g) { g.hunks.forEach(function (h) { seen[h.file] = true }) })
     c.unannotated.forEach(function (h) { seen[h.file] = true })
     return Object.keys(seen).length
@@ -72,7 +72,7 @@
   var readCache = {}
   function readSet(c) {
     if (!readCache[c.sha]) {
-      var s = {}
+      var s = Object.create(null) // no prototype: a group id like "constructor" must not read as already read
       try {
         var raw = window.sessionStorage.getItem('git-gloss:read:' + c.sha)
         if (raw) JSON.parse(raw).forEach(function (id) { s[id] = true })
@@ -240,6 +240,11 @@
       reasons.forEach(function (r) { ul.appendChild(el('li', null, r)) })
       add(box, ul)
     }
+    if (k && k.timedOut && k.timedOut.length) {
+      var tl = el('ul', 'timedout')
+      k.timedOut.forEach(function (r) { tl.appendChild(el('li', null, r)) })
+      add(box, tl)
+    }
     if (c.risks.length) {
       var rb = button('linkbtn', plural(c.risks.length, 'risk') + ' flagged', function () { selectRisks(commits.indexOf(c)) })
       add(box, add(el('p', 'look'), rb))
@@ -259,6 +264,13 @@
     var f = r.state === 'seen' ? 'current' : r.state === 'code-changed' ? 'code changed since review' : 'gloss changed since review'
     return v + ' · ' + f
   }
+  // How far the arbiter got with a stage's latest review, for a rail row: nothing unless it found issues.
+  function decidedShort(r) {
+    // reviewStatus() in src/reviews.ts sorts each stage newest-first, and the page data keeps that order.
+    var latest = r.entries[0]
+    if (!latest || !latest.decisions || latest.verdict === 'clean') return ''
+    return latest.complete ? ' \u00b7 complete' : latest.decisionCount ? ' \u00b7 ' + latest.decisionCount + ' decided' : ' \u00b7 undecided'
+  }
   // One compact row per stage; each opens the Reviews view in the main pane.
   function reviewStatus(c) {
     var ci = commits.indexOf(c)
@@ -269,7 +281,7 @@
       var b = button('rvrow', null, function () { selectReviews(ci, r.stage) })
       b.setAttribute('data-fid', 'rv:' + ci + ':' + r.stage)
       b.title = r.phrase
-      add(b, el('span', 'rvdot ' + (cls === 'review-ok' ? 'ok' : cls === 'stale' ? 'warn' : 'none')), el('span', 'rvstage', r.stage), el('span', 'rvtxt', reviewShort(r)),
+      add(b, el('span', 'rvdot ' + (cls === 'review-ok' ? 'ok' : cls === 'stale' ? 'warn' : 'none')), el('span', 'rvstage', r.stage), el('span', 'rvtxt', reviewShort(r) + decidedShort(r)),
         el('span', 'rvn', r.entries.length))
       box.appendChild(b)
     })
@@ -278,6 +290,8 @@
 
   // ---- markdown: a small subset, built as DOM nodes (never parsed as HTML) ----
   var ALNUM = /[A-Za-z0-9]/
+  // Review text is untrusted and unbounded: no emphasis or link may reach further than this.
+  var MAX_SPAN = 500
   function inline(parent, s) {
     var i = 0, buf = ''
     function flush() { if (buf) { parent.appendChild(text(buf)); buf = '' } }
@@ -290,12 +304,13 @@
         j = s.indexOf('**', i + 2)
         if (j > i + 2) { flush(); parent.appendChild(inline(el('strong'), s.slice(i + 2, j))); i = j + 2; continue }
       } else if (ch === '*' && s.charAt(i + 1) && !/[\s*]/.test(s.charAt(i + 1)) && (i === 0 || !ALNUM.test(s.charAt(i - 1)))) {
-        for (j = i + 2; j < s.length; j++) {
+        // Looks no further than MAX_SPAN: an unclosed marker would otherwise re-read the rest of the text each time (quadratic).
+        for (j = i + 2; j < s.length && j < i + MAX_SPAN; j++) {
           if (s.charAt(j) === '*' && !/\s/.test(s.charAt(j - 1)) && !ALNUM.test(s.charAt(j + 1)) && s.charAt(j + 1) !== '*') break
         }
-        if (j < s.length) { flush(); parent.appendChild(inline(el('em'), s.slice(i + 1, j))); i = j + 1; continue }
+        if (j < s.length && j < i + MAX_SPAN) { flush(); parent.appendChild(inline(el('em'), s.slice(i + 1, j))); i = j + 1; continue }
       } else if (ch === '[') {
-        m = /^\[([^\]]+)\]\(([^)\s]+)\)/.exec(s.slice(i))
+        m = /^\[([^\]]{1,200})\]\(([^)\s]{1,400})\)/.exec(s.slice(i, i + MAX_SPAN))
         if (m) { flush(); inline(parent, m[1]); parent.appendChild(el('span', 'muted', ' (' + m[2] + ')')); i += m[0].length; continue }
       }
       buf += ch
@@ -334,6 +349,9 @@
         if (!top || top.indent < indent || top.list.tagName.toLowerCase() !== tag) {
           if (top && top.indent === indent) stack.pop()
           var list = el(tag)
+          // A numbered list starts at its first item's number, so "5. 6." is not shown as "1. 2.".
+          var first = tag === 'ol' ? parseInt(m[2], 10) : 0
+          if (first > 0 && first < 100000 && first !== 1) list.start = first
           if (stack.length && stack[stack.length - 1].li) stack[stack.length - 1].li.appendChild(list); else root.appendChild(list)
           top = { indent: indent, list: list, li: null }
           stack.push(top)
@@ -368,6 +386,25 @@
     if (v) add(head, el('span', 'chip ' + (v === 'ISSUES' ? 'bad' : 'good'), v === 'ISSUES' ? 'issues found' : 'no issues'))
     return head
   }
+  // What was decided about one review: the summary, then a row per decision. Text only, never markup.
+  function decisionsBlock(e) {
+    if (!e.decisions) return null
+    var box = el('div', 'decisions')
+    add(box, el('h3', 'dhead', 'Decisions'), el('p', 'dsum', e.summary))
+    if (e.decisionCount > e.decisions.length) add(box, el('p', 'muted dhidden', 'showing the latest ' + e.decisions.length + ' of ' + e.decisionCount))
+    if (e.decisions.length) {
+      var ul = el('ul', 'dlist')
+      e.decisions.forEach(function (d) {
+        var row = el('li', 'drow')
+        add(row, el('span', 'chip dchip ' + d.outcome, d.outcome), text(' '), el('span', 'dfinding', d.finding))
+        if (d.note) add(row, text(' \u2014 '), el('span', 'dnote', d.note))
+        add(row, text(' '), el('span', 'muted dby', d.by + ', ' + d.at.slice(0, 10)))
+        ul.appendChild(row)
+      })
+      add(box, ul)
+    }
+    return box
+  }
   function reviewsPane(c, stage) {
     var pane = el('div')
     add(pane, button('btn small back', '‹ Back', goBack))
@@ -379,10 +416,10 @@
       add(sec, el('h2', null, r.stage), add(el('p', 'rvsum'), el('span', reviewClass(r), r.phrase)))
       var entries = r.entries.slice().sort(function (a, b) { return a.at < b.at ? 1 : a.at > b.at ? -1 : 0 })
       entries.forEach(function (e, i) {
-        if (i === 0) add(sec, add(el('div', 'entry'), entryHead(e), markdown(e.findings)))
+        if (i === 0) add(sec, add(el('div', 'entry'), entryHead(e), decisionsBlock(e), markdown(e.findings)))
         else {
           var d = el('details', 'entry old')
-          add(d, add(el('summary'), entryHead(e)), markdown(e.findings))
+          add(d, add(el('summary'), entryHead(e)), decisionsBlock(e), markdown(e.findings))
           add(sec, d)
         }
       })
@@ -466,6 +503,10 @@
 
   // ---- the detail pane ----
   var topEl = el('header', 'top')
+  // Served by `git gloss ary`: the branch pickers (src/ary/picker.js, included
+  // ahead of this script only then) live in the top bar. Built once, since
+  // the bar is rebuilt on every change of filter.
+  var aryEl = data.ary ? aryBar(data.ary, el, add) : null
   var railEl = el('aside', 'rail')
   railEl.setAttribute('aria-label', multi ? 'Commits in the range' : 'Groups in review order')
   var mainEl = el('main', 'main')
@@ -562,7 +603,7 @@
     var order = c.order
     var hunkN = g.hunks.length
     var files = []
-    var perFile = {}
+    var perFile = Object.create(null)
     g.hunks.forEach(function (h) {
       if (!perFile[h.file]) { perFile[h.file] = 0; files.push(h.file) }
       perFile[h.file]++
@@ -681,9 +722,9 @@
       return pane
     }
     warnings(c, pane)
-    add(pane, attentionCard(c))
     statement(pane, 'Task', c.task)
     statement(pane, 'Summary', c.summary)
+    add(pane, attentionCard(c))
     focusSection(c, ci, pane)
     if (c.groups.length) {
       var nb = necessityBar(c)
@@ -753,7 +794,7 @@
   function renderTop() {
     var c = commits[state.ci]
     topEl.textContent = ''
-    add(topEl, el('span', 'brand', 'git gloss'))
+    add(topEl, el('span', 'brand', 'git gloss'), aryEl)
     if (multi) {
       var glossed = commits.filter(function (x) { return x.glossed }).length
       var vetted = commits.filter(function (x) {
@@ -1091,8 +1132,12 @@
 
   // ---- start ----
   var desk = add(el('div', 'desk'), topEl, body)
+  // The rail sticks below the top bar, whose height varies (the pickers wrap).
+  function measureTop() { desk.style.setProperty('--top-h', topEl.offsetHeight + 'px') }
   app.textContent = ''
   app.appendChild(desk)
+  measureTop()
+  if (typeof ResizeObserver !== 'undefined') new ResizeObserver(measureTop).observe(topEl)
   if (multi) {
     var first = commitOrder()[0]
     state.ci = first