clearotron 0.3.2-beta.6 → 0.3.2-beta.7

package/scripts/release-duplicate-notes.mjs

@@ -0,0 +1,246 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// release-duplicate-notes.mjs — refuse a release note that sits in `.changeset/` and `.changeset/pre/` at
+// once, because the next cut would publish its text a second time.
+//
+//   node scripts/release-duplicate-notes.mjs
+//
+// Exit 0 when no note is in both places · 1 when one is, each named with the cut that consumed it · 2 when
+// it could not look.
+//
+// ── WHAT GOES WRONG, MEASURED ──────────────────────────────────────────────────────────────────────
+//
+// A pre-release consumes a note by MOVING it from `.changeset/` into `.changeset/pre/`, where it waits so
+// the eventual stable can list every change since the last stable. A branch that carries its own copy of
+// work already on main can put that same filename back at the top level. The tree then holds both, and
+// nothing refuses it: the next cut consumes the top-level copy again and republishes its sentence on the
+// releases page — the surface a stranger reads to decide whether to upgrade.
+//
+// Seen on a report pack's head, 2026-09-16: ten notes consumed by a beta at 17:32Z were re-added three
+// minutes later by a branch commit. No run would have failed.
+//
+// ── WHY THE CONSUMING CUT COMES FROM GIT AND NOT FROM pre.json ─────────────────────────────────────
+//
+// It would be natural to read the consuming release out of `.changeset/pre.json`. It is not there. In
+// changesets 3.x that file carries `{ mode, tag }` and nothing else — no list of consumed notes and no
+// initial versions — so the only record of WHICH cut took a note is the commit that added it under
+// `pre/`. That commit is the version commit, and its subject names the release. A guard that read
+// `pre.json` for this would find an absent field and report nothing, which is the failure this comment
+// exists to stop somebody re-introducing.
+//
+// ── THE FLOOR ──────────────────────────────────────────────────────────────────────────────────────
+//
+// An empty `.changeset/` is the ordinary state straight after a cut, and an empty `pre/` is the ordinary
+// state on a tree that has never pre-released. Neither is a defect, but a run that enumerated nothing
+// because it was pointed at the wrong place must not read as a pass, so the count of what was compared is
+// printed on success and a missing `.changeset/` is a refusal rather than a clean answer.
+import { readdirSync, existsSync, readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { execFileSync } from "node:child_process";
+import { isEntrypoint } from "../shared/is-entrypoint.mjs";
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+
+const mdIn = (dir, { keepReadme = false } = {}) =>
+  readdirSync(dir, { withFileTypes: true })
+    .filter((e) => e.isFile() && e.name.endsWith(".md") && (keepReadme || e.name !== "README.md"))
+    .map((e) => e.name)
+    .sort();
+
+/** The notes present in BOTH `.changeset/` and `.changeset/pre/`, by file name. */
+export function duplicateNotes(root = ROOT) {
+  const dir = join(root, ".changeset");
+  if (!existsSync(dir)) return { error: `${dir} does not exist — this is not a tree that carries release notes` };
+  const preDir = join(dir, "pre");
+  const waiting = mdIn(dir);
+  const consumed = existsSync(preDir) ? mdIn(preDir, { keepReadme: true }) : [];
+  const inPre = new Set(consumed);
+  return { duplicates: waiting.filter((n) => inPre.has(n)), waiting: waiting.length, consumed: consumed.length };
+}
+
+/**
+ * For every note now under `pre/`, the commit that most recently PUT IT THERE.
+ *
+ * ONE WALK OF `.changeset/`, NOT ONE QUERY PER FILE, and that is a correctness fix rather than a saving.
+ * `git log --diff-filter=A -- .changeset/pre/<name>` looks right and lies in two ways. A cut consumes a
+ * note by MOVING it, which git records as a rename and not an add. And a path-limited log simplifies
+ * history: for a note that went into `pre/`, back out, and in again — which is exactly what the note that
+ * prompted this guard did — it reports the FIRST creation and never mentions the release that consumed it.
+ * Measured 2026-09-17: the query named `911b0b4 The report a client opens, redrawn` for a note the beta.6
+ * version commit had just consumed, so the guard refused a tree that was correct.
+ *
+ * `--full-history` stops the simplification, `-M` makes the rename legible, and `--name-status` says where
+ * each file LANDED. The first entry naming a destination under `pre/` is the most recent one, because the
+ * log is newest-first.
+ *
+ * THE TWO FLAGS ARE NOT EQUALLY GUARDED, and that is written down rather than left to be discovered.
+ * Removing `-M` reds the arm for this, because ignoring renames is the original defect and a linear
+ * fixture reproduces it. Removing `--full-history` reds NOTHING, because the simplification it defeats
+ * needs a MERGE in the history and the fixture repository has none — the real case was this repository
+ * with main merged into a branch. So that flag is carried on a measurement rather than on a passing
+ * test, and deleting it because nothing goes red would restore a defect no arm here can see.
+ */
+export function consumedProvenance(root = ROOT) {
+  let out;
+  try {
+    out = execFileSync("git",
+      ["log", "--full-history", "-M", "--name-status", "--format=@@%h%x00%an%x00%s", "--", ".changeset/"],
+      { cwd: root, encoding: "utf8", maxBuffer: 32 * 1024 * 1024, stdio: ["ignore", "pipe", "ignore"] });
+  } catch {
+    return new Map();   // no history to read — the caller reports that, it does not condemn anything
+  }
+  const seen = new Map();
+  let commit = null;
+  for (const line of out.split("\n")) {
+    if (line.startsWith("@@")) {
+      const [hash, author, subject] = line.slice(2).split("\0");
+      commit = { hash, author, subject };
+      continue;
+    }
+    if (!commit || !line.trim()) continue;
+    const parts = line.split("\t");
+    const dest = parts[parts.length - 1];           // A → the path; R → the destination
+    const m = /^\.changeset\/pre\/(.+)$/.exec(dest);
+    if (!m) continue;
+    if (!seen.has(m[1])) seen.set(m[1], commit);    // newest-first, so the first sighting is the latest
+  }
+  return seen;
+}
+
+/** The commit that most recently put this note under `pre/`, or null when history cannot answer. */
+export function addedBy(name, root = ROOT) {
+  return consumedProvenance(root).get(name) ?? null;
+}
+
+/** The commit that consumed this note, as a line for a reader. */
+export function consumedBy(name, root = ROOT) {
+  const a = addedBy(name, root);
+  return a ? `${a.hash} ${a.subject}` : null;
+}
+
+// A NOTE ARRIVES UNDER `pre/` ONE WAY ONLY: a cut moves it there after publishing it. The author and the
+// subject of that commit are how it is recognised, and both are the release pipeline's own doing rather
+// than a convention anybody types.
+const VERSION_AUTHOR = "github-actions[bot]";
+
+// THE VERSION COMMIT HAS TWO NAMES, AND THIS CHECK RUNS WHERE BOTH ARE LIVE.
+//
+// On `main` it reads "Release 0.3.2-beta.6", because the squash that merges the version pull request
+// takes the pull request's title. ON THE VERSION BRANCH ITSELF it reads whatever the cut named it, and
+// the cut runs this same check before the merge — so a discriminator built from main's history alone
+// refuses every version pull request, calling the notes it has just consumed misfiled by the very commit
+// that consumed them. Measured 2026-09-17: it blocked a beta cut on its first live run, naming both
+// waiting notes against `Cut a version (beta)`.
+//
+// So the branch-side subject is DERIVED from the workflow that writes it rather than restated here. A
+// restated copy is a second place to keep in step, and it is exactly the copy that was missing.
+const RELEASED_SUBJECT = /^Release\s/;
+
+/** The subject the cut gives its own commit, read from the workflow that sets it. */
+export function cutCommitSubject(root = ROOT) {
+  try {
+    const wf = readFileSync(join(root, ".github", "workflows", "release.yml"), "utf8");
+    return /^\s*commit-message:\s*['"]([^'"]+)['"]/m.exec(wf)?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+
+/** Did a release put this note here — under either of the two names that commit goes by? */
+export function isVersionCommit(commit, cutSubject) {
+  if (commit.author !== VERSION_AUTHOR) return false;
+  if (RELEASED_SUBJECT.test(commit.subject)) return true;
+  return Boolean(cutSubject) && commit.subject.startsWith(cutSubject);
+}
+
+/**
+ * Notes sitting in the consumed pile that no cut put there — written straight into `.changeset/pre/`.
+ *
+ * Such a note is born consumed: the versioning tool filters `pre/` ids out of its count while the tree is
+ * in pre-release mode, so the note is never eligible for a release and nothing refuses it. It then lands
+ * in the eventual stable's changelog as though a pre-release had already carried it. Measured
+ * 2026-09-17: one note in this state, holding the whole report redesign, published by no release at all.
+ *
+ * NEEDS HISTORY. A shallow clone cannot say which commit added a file, and answering "misfiled" from a
+ * missing answer would condemn every note on a depth-1 checkout. Those are returned as `unknown` and the
+ * caller decides; `main` refuses to give a verdict when it could not look at any of them.
+ */
+export function misfiledNotes(root = ROOT) {
+  const preDir = join(root, ".changeset", "pre");
+  if (!existsSync(preDir)) return { misfiled: [], checked: 0, unknown: [] };
+  const provenance = consumedProvenance(root);
+  const cutSubject = cutCommitSubject(root);
+  const misfiled = [], unknown = [];
+  for (const name of mdIn(preDir, { keepReadme: true })) {
+    const added = provenance.get(name);
+    if (!added) { unknown.push(name); continue; }
+    if (!isVersionCommit(added, cutSubject)) misfiled.push({ name, ...added });
+  }
+  return { misfiled, unknown, cutSubject,
+    checked: mdIn(preDir, { keepReadme: true }).length - unknown.length };
+}
+
+export function placementMain(root = ROOT) {
+  const preDir = join(root, ".changeset", "pre");
+  if (!existsSync(preDir)) {
+    console.log("release-duplicate-notes: no .changeset/pre/ in this tree — nothing has been consumed yet.");
+    return 0;
+  }
+  const { misfiled, unknown, cutSubject } = misfiledNotes(root);
+  const total = mdIn(preDir, { keepReadme: true }).length;
+  if (total && !cutSubject) {
+    console.error("release-duplicate-notes: could not look — the release workflow's `commit-message:` could "
+      + "not be read, and that is half of what tells a release's own commit from a hand-filed note. Judging "
+      + "on the other half alone is what refused a correct version pull request once already.");
+    return 2;
+  }
+  if (total && unknown.length === total) {
+    console.error("release-duplicate-notes: could not look — no commit could be found for any of the "
+      + `${total} note(s) under .changeset/pre/. This check reads history to tell a note a cut consumed `
+      + "from one written straight into the consumed pile, so it needs a full clone (fetch-depth: 0).");
+    return 2;
+  }
+  if (misfiled.length) {
+    for (const m of misfiled) {
+      console.error(`::error file=.changeset/pre/${m.name}::${m.name} sits in .changeset/pre/, the pile a cut `
+        + `moves a note into AFTER publishing it, but it was put there by \`${m.hash} ${m.subject}\` rather than `
+        + "by a release. A note written straight into pre/ is never counted, never published, and then appears "
+        + "in the next stable's changelog as though a pre-release had carried it. Move it to .changeset/.");
+    }
+    console.error(`\nrelease-duplicate-notes: ${misfiled.length} note(s) in the consumed pile that no cut consumed`
+      + `${unknown.length ? `, and ${unknown.length} whose history could not be read` : ""}.`);
+    return 1;
+  }
+  console.log(`release-duplicate-notes: every one of the ${total - unknown.length} consumed note(s) was put there `
+    + `by a release${unknown.length ? `; ${unknown.length} could not be read` : ""}.`);
+  return 0;
+}
+
+export function main(root = ROOT) {
+  const read = duplicateNotes(root);
+  if (read.error) {
+    console.error(`release-duplicate-notes: could not look — ${read.error}.`);
+    return 2;
+  }
+  if (read.duplicates.length) {
+    for (const name of read.duplicates) {
+      const by = consumedBy(name, root);
+      console.error(`::error file=.changeset/${name}::${name} is in .changeset/ and in .changeset/pre/ at once. `
+        + `It was already consumed by ${by ? `\`${by}\`` : "an earlier cut (no commit found that added it under pre/)"}, `
+        + "so the next cut would publish its text a second time. Delete the copy at the top level — the one "
+        + "under pre/ is the record the stable release reads.");
+    }
+    console.error(`\nrelease-duplicate-notes: ${read.duplicates.length} note(s) counted twice, `
+      + `of ${read.waiting} waiting and ${read.consumed} already consumed.`);
+    return 1;
+  }
+  console.log(`release-duplicate-notes: no note is counted twice — ${read.waiting} waiting, `
+    + `${read.consumed} already consumed by an earlier cut.`);
+  return 0;
+}
+
+if (isEntrypoint(import.meta.url)) {
+  process.exitCode = process.argv.includes("--placement") ? placementMain() : main();
+}

package/scripts/release-publish-guard.mjs

@@ -38,18 +38,42 @@ export const REPOSITORY = "CordilleraSarl/clearotron";
  *
  * A job is "publishing" if its own block runs `npm publish`. Comments are already stripped by the caller.
  */
-export function publishingJobs(live) {
-  const out = [];
+export function jobBlocks(live) {
+  const out = new Map();
   const starts = [...live.matchAll(/^ {2}([A-Za-z_][A-Za-z0-9_-]*):$/gm)];
   for (let i = 0; i < starts.length; i++) {
     const from = starts[i].index;
     const to = i + 1 < starts.length ? starts[i + 1].index : live.length;
-    const block = live.slice(from, to);
-    if (/\bnpm\s+publish\b/.test(block)) out.push([starts[i][1], block]);
+    out.set(starts[i][1], live.slice(from, to));
   }
   return out;
 }
 
+export function publishingJobs(live) {
+  return [...jobBlocks(live)].filter(([, block]) => /\bnpm\s+publish\b/.test(block));
+}
+
+/**
+ * The ONE job permitted to hold a registry credential, and the secret it must come from.
+ *
+ * Owner ruling 2026-09-17. Deprecating a published version is a write the OIDC exchange cannot make: the
+ * short-lived credential npm mints for a trusted publish is scoped to publishing, and eleven deprecations
+ * attempted with it came back 404 while reads succeeded. So this one job reads a granular token, created
+ * by hand and held as a repository secret, into NODE_AUTH_TOKEN for its own step.
+ *
+ * WHAT THE RULING DID NOT CHANGE, and what the checks below hold: publishing stays credential-less. A
+ * credential anywhere else in this file is the thing this guard was written for and is still refused. The
+ * exemption is one named job, it may not publish, its credential must come from the named secret, and it
+ * must be scoped to a step rather than to the job — a job-level `env:` would hand the token to every step
+ * in it, including this guard.
+ */
+export const CREDENTIALLED_JOB = "deprecate";
+export const DEPRECATE_SECRET = "NPM_DEPRECATE_TOKEN";
+
+/** The only two lines in this file permitted to name a credential or a registry, spelled exactly. */
+export const PERMITTED_CREDENTIAL_LINE = `NODE_AUTH_TOKEN: \${{ secrets.${DEPRECATE_SECRET} }}`;
+export const PERMITTED_REGISTRY_LINE = "registry-url: https://registry.npmjs.org";
+
 /** Credential spellings that would let this repository publish without the OIDC exchange. */
 export const CREDENTIAL_TOKENS = Object.freeze([
   "NPM_TOKEN",
@@ -68,12 +92,46 @@ export function refusals({ workflow, rootPkg }) {
   // scanner that reads its own prose as a finding refuses the thing it is describing.
   const live = workflow.split("\n").filter((l) => !/^\s*#/.test(l)).join("\n");
 
+  // THE EXEMPTION IS TWO EXACT LINES, NOT A REGION, and the difference is not pedantry — it was measured.
+  // Exempting the whole `deprecate` job looked equivalent and was not: that job is the LAST in the file,
+  // so its block runs to end-of-file, and every plant this guard's own arms append at the end landed
+  // inside the exemption. Four credential spellings went from refused to accepted in one edit, and the
+  // arm caught it. So one occurrence of each permitted line is removed and everything else is scanned:
+  // a second copy, a different spelling, or the same line in another job all stay in what is scanned.
+  const deprecateBlock = jobBlocks(live).get(CREDENTIALLED_JOB) ?? "";
+  let rest = live;
+  for (const line of [PERMITTED_CREDENTIAL_LINE, PERMITTED_REGISTRY_LINE]) {
+    if (!deprecateBlock.includes(line)) continue;   // permitted only where the ruling put it
+    const at = rest.indexOf(line);
+    if (at !== -1) rest = rest.slice(0, at) + rest.slice(at + line.length);
+  }
+
   for (const tok of CREDENTIAL_TOKENS) {
-    if (live.includes(tok)) add(`the release workflow carries a registry credential (${tok})`);
+    if (rest.includes(tok)) add(`the release workflow carries a registry credential (${tok})`);
   }
   // `registry-url:` on setup-node writes an .npmrc that authenticates with NODE_AUTH_TOKEN. Trusted
   // publishing needs no registry configured at all, so its presence means somebody is wiring a token.
-  if (/registry-url:/.test(live)) add("the release workflow configures a registry to authenticate against");
+  if (/registry-url:/.test(rest)) add("the release workflow configures a registry to authenticate against");
+
+  // ── AND THE PERMITTED JOB IS HELD TO THE TERMS OF ITS OWN EXEMPTION ─────────────────────────────
+  //
+  // An exemption nobody checks is a hole. These are the conditions the ruling was given under, and each
+  // one is a way the exemption could quietly become general.
+  if (deprecateBlock) {
+    if (/\bnpm\s+publish\b/.test(deprecateBlock)) {
+      add(`job \`${CREDENTIALLED_JOB}\` publishes, and it is the one job allowed to hold a credential — `
+        + "the two must never be the same job");
+    }
+    if (deprecateBlock.includes("NODE_AUTH_TOKEN") && !deprecateBlock.includes(`secrets.${DEPRECATE_SECRET}`)) {
+      add(`job \`${CREDENTIALLED_JOB}\` takes its credential from something other than \`secrets.${DEPRECATE_SECRET}\``);
+    }
+    // Job-level `env:` sits at four spaces; a step's sits at eight. The distinction is the whole point:
+    // a job-level block hands the token to every step, this guard included.
+    if (/^ {4}env:/m.test(deprecateBlock) && deprecateBlock.includes("NODE_AUTH_TOKEN")) {
+      add(`job \`${CREDENTIALLED_JOB}\` holds its credential at job level, so every step in it gets the token; `
+        + "it belongs on the one step that deprecates");
+    }
+  }
 
   // A publish without provenance is a publish nobody can trace back to a commit — which is the whole
   // reason the owner's ruling moved from a human publish to a CI one.

package/scripts/report-print-check.mjs

@@ -0,0 +1,194 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+// What does the EXPORTED PDF actually show? Ask a browser under print media, not a regex.
+//
+//   node scripts/report-print-check.mjs [--keep]
+//
+// ── WHY THIS EXISTS ─────────────────────────────────────────────────────────────────────────────────
+//
+// The exported PDF is the client-facing document, and it is the one rendering of a report that nothing
+// else in this repository can see. The frozen hash pins the renderer's bytes; the render tests read its
+// HTML. Neither can tell you that a control which exists to be CLICKED is being printed onto paper,
+// because on screen it is correct and only the print block decides otherwise.
+//
+// Two folds have shipped mis-ruled. A hero caption's fold printed an inert label and a right-pointing
+// COLLAPSED marker above text that was already fully expanded. A "What was searched" heading printed its
+// arrow the same way. In both cases the commit that added the fold checked the half it thought about —
+// the caption's text was carried correctly — and shipped the half it did not.
+//
+// ── THE INVARIANT, AND WHY IT IS NOT A LIST OF NAMES ────────────────────────────────────────────────
+//
+// `report.css`'s print block has two mechanisms for <details>, and its own comment states the rule. PURE
+// TOGGLES hide their summary line. Summaries that CARRY content — region rows, secondary groups, section
+// titles — print as static headers with the marker blanked. Every <details> the renderers emit must be
+// ruled by one or the other.
+//
+// A test naming a class in the hide list would be the tautology this repository keeps shipping: it would
+// go green the day somebody adds a sixth disclosure and forgets it, which is precisely the failure. So
+// this walks EVERY <details> a real rendered page contains and requires each one that reaches paper to be
+// ruled by a mechanism. A new disclosure fails this until somebody decides which it is.
+//
+// ── HOW IT ASKS ─────────────────────────────────────────────────────────────────────────────────────
+//
+// `@media print{` is rewritten to `@media all{`, so the print block applies to the live layout tree and
+// every computed style is the one the export would use. A probe script appended to the page walks the
+// disclosures and writes what it found into the DOM, which `--dump-dom` hands back. Two floors sit under
+// that: a page with no print block at all is a refusal rather than a clean sweep, and a probe that never
+// ran is a refusal rather than an empty list of problems.
+//
+// Needs `google-chrome`, and MUST NOT run under a virtual-memory ulimit — Chrome dies under one.
+import { execFileSync } from "node:child_process";
+import { readFileSync, writeFileSync, readdirSync, existsSync, rmSync, mkdtempSync, copyFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { isEntrypoint } from "../shared/is-entrypoint.mjs";
+import { browserRun } from "../shared/browser-temp-root.mjs";
+import { buildFixturePool } from "./render-check.mjs";
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+
+/** Appended to the page: it walks the disclosures and leaves its answer in the DOM for --dump-dom. */
+export const PROBE = `
+<script>
+(function () {
+  var out = [];
+  document.querySelectorAll('details').forEach(function (d) {
+    var sm = d.querySelector(':scope > summary');
+    if (!sm) { out.push({ cls: d.className || '(none)', noSummary: true }); return; }
+    // Does it reach paper at all? An ancestor with display:none means no, and a disclosure that never
+    // prints cannot print a control.
+    var hidden = false, n = d;
+    while (n && n !== document.body) { if (getComputedStyle(n).display === 'none') { hidden = true; break; } n = n.parentElement; }
+    var sc = getComputedStyle(sm);
+    out.push({
+      cls: d.className || '(none)',
+      renders: !hidden,
+      summaryDisplay: sc.display,
+      before: getComputedStyle(sm, '::before').content,
+      listStyle: sc.listStyleType,
+      text: sm.textContent.replace(/\\s+/g, ' ').trim().slice(0, 48),
+    });
+  });
+  var p = document.createElement('pre');
+  p.id = 'PRINT-PROBE';
+  p.textContent = JSON.stringify(out);
+  document.body.appendChild(p);
+})();
+</script>
+`;
+
+const unescapeDom = (s) => s
+  .replace(/&quot;/g, '"').replace(/&#39;/g, "'")
+  .replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+
+/** A disclosure is ruled when its summary is hidden, or when it prints with no marker of any kind. */
+export function ruledBy(row) {
+  if (row.summaryDisplay === "none") return "hidden";
+  const before = String(row.before ?? "");
+  const blanked = before === "" || before === "none" || before === '""' || before === "normal";
+  const noNativeMarker = row.listStyle === "none";
+  return blanked && noNativeMarker ? "static-header" : null;
+}
+
+/** Every <details> on one rendered page, as the export would draw it. */
+export function measure(name, html, work, env) {
+  const printed = html.replace(/@media print\{/g, "@media all{");
+  if (printed === html) return { error: `${name}: no @media print block — the instrument measured nothing` };
+  const file = join(work, `${name}.print.html`);
+  writeFileSync(file, printed + PROBE);
+  let dom;
+  try {
+    dom = execFileSync("google-chrome", [
+      "--headless=new", "--disable-gpu", "--no-sandbox", "--hide-scrollbars",
+      "--host-resolver-rules=MAP * ~NOTFOUND, EXCLUDE 127.0.0.1",
+      `--user-data-dir=${join(work, `chrome-${name}`)}`, "--virtual-time-budget=8000",
+      "--dump-dom", `file://${file}`,
+    ], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 64 * 1024 * 1024, env: env });
+  } catch (e) {
+    return { error: `${name}: the browser did not run (${String(e.message).split("\n")[0]})` };
+  }
+  const m = dom.match(/<pre id="PRINT-PROBE">([\s\S]*?)<\/pre>/);
+  if (!m) return { error: `${name}: the probe never ran — nothing was measured` };
+  return { rows: JSON.parse(unescapeDom(m[1])) };
+}
+
+/** Every published report in a pool, with the stylesheet each one needs beside it. */
+export function pagesIn(pool, work) {
+  const pages = [];
+  for (const run of readdirSync(pool)) {
+    const html = join(pool, run, "report.html");
+    if (!existsSync(html)) continue;
+    for (const f of readdirSync(join(pool, run))) {
+      if (f.endsWith(".css")) copyFileSync(join(pool, run, f), join(work, f));
+    }
+    pages.push([run, readFileSync(html, "utf8")]);
+  }
+  return pages;
+}
+
+export function main() {
+  const keep = process.argv.includes("--keep");
+  // `keep` is the handle that takes this run's root OUT of the exit sweep. Destructuring only the root
+  // and the environment is what defeats a --keep flag silently: the flag still parses, the sweep still
+  // runs, and nothing in the check's own output changes. The membership arm catches exactly that.
+  const { root: work, env: chromeEnv, keep: keepRoot } = browserRun("report-print-check-");
+  const pool = buildFixturePool(mkdtempSync(join(tmpdir(), "print-check-pool-")));
+  let failures = 0;
+  const fail = (m) => { failures += 1; console.error(`  ✕ ${m}`); };
+  try {
+    const pages = pagesIn(pool, work);
+    // THE FLOOR ON THE POPULATION. An empty pool reports nothing wrong, which is what a broken fixture
+    // looks like from here. A check that measured no page is a could-not-look, never a pass.
+    if (!pages.length) {
+      console.error("report-print-check: the fixture pool published no report — nothing was measured.");
+      return 2;
+    }
+    let ruled = 0;
+    const byMechanism = { hidden: 0, "static-header": 0 };
+    for (const [name, html] of pages) {
+      const got = measure(name, html, work, chromeEnv);
+      if (got.error) { fail(got.error); continue; }
+      const printed = got.rows.filter((r) => r.renders);
+      console.log(`${name}: ${got.rows.length} disclosure(s), ${printed.length} of them printed`);
+      for (const r of got.rows) {
+        if (r.noSummary) { fail(`${name}: a <details class="${r.cls}"> has no <summary> — nothing rules how it prints`); continue; }
+        if (!r.renders) continue;
+        const how = ruledBy(r);
+        if (how) { ruled += 1; byMechanism[how] = (byMechanism[how] ?? 0) + 1; continue; }
+        fail(`${name}: <details class="${r.cls}"> ("${r.text}") prints its control — summary display `
+          + `${r.summaryDisplay}, marker ${r.before}, list-style ${r.listStyle}. On paper that is a label and `
+          + "an arrow over content that is already fully expanded. Rule it in report.css's print block: hide "
+          + "the summary if it is a pure toggle, or blank its marker if the summary carries content.");
+      }
+    }
+    // AND THE SECOND FLOOR. Every page answering "no disclosures" is indistinguishable from a probe that
+    // walked an empty document, so the run must have ruled at least one.
+    if (!failures && !ruled) {
+      console.error("report-print-check: no printed disclosure was found on any page. Either the reports "
+        + "stopped carrying them or the probe read the wrong document; both are a could-not-look.");
+      return 2;
+    }
+    if (failures) {
+      console.error(`\nreport-print-check: ${failures} disclosure(s) reach paper ruled by neither mechanism.`);
+      return 1;
+    }
+    // THE BREAKDOWN IS THE POINT OF PRINTING IT. "How many still draw a marker" is a question a reader
+    // will ask of a rendered report, and the answer is none: the hidden ones draw nothing because their
+    // summary is not painted at all, and the static headers draw nothing because their marker is blanked.
+    // Recording which mechanism ruled how many turns that from an inference into a number.
+    console.log(`report-print-check: ${ruled} printed disclosure(s), every one ruled by the print block — `
+      + `${byMechanism.hidden} by hiding the summary (pure toggles), `
+      + `${byMechanism["static-header"]} as static headers with the marker blanked.`);
+    return 0;
+  } finally {
+    // Out of the exit sweep first, or --keep promises a directory that goes at exit anyway — the flag
+    // parses, the removal it guards still runs, and nothing in the output says so.
+    if (keep) keepRoot();
+    if (keep) console.log(`  kept: ${work} (and the fixture pool at ${pool})`);
+    else { rmSync(pool, { recursive: true, force: true }); rmSync(work, { recursive: true, force: true }); }
+  }
+}
+
+if (isEntrypoint(import.meta.url)) process.exitCode = main();

package/shared/driver-dir.mjs

@@ -35,7 +35,7 @@
 // its own population needs an exception list — which would rebuild this issue's defect inside its fix:
 //
 //   · `driver/stage-freshness.mjs` creates a CHILD, `join(runDir, "_driver", STAMP_DIR)`.
-//   · `driver/pipeline.mjs:15757 shadowDir` passes a shadow dispatch sandbox under `_experiments/`, not a run
+//   · `driver/pipeline.mjs:15945 shadowDir` passes a shadow dispatch sandbox under `_experiments/`, not a run
 //     directory. It is a run-dir-SHAPED base, which is why the parameter is `base` and not `runDir`.
 //
 // ── WHAT THIS DELIBERATELY DOES NOT DO ────────────────────────────────────────────────────────────