in2-agent-server 0.20260821.185429

package/dist/direct/metadataSchema.js

@@ -0,0 +1,179 @@
+import { createRequire } from "node:module";
+// SCHEMA TIER — the official Metadata API definitions, as runtime data.
+//
+// Built by scripts/build-metadata-schema.mjs from @salesforce/types. See that file for why the
+// extraction exists at all (TypeScript types are erased, so they cannot be queried at runtime).
+//
+// WHAT THIS TIER IS FOR: killing the guess -> 45s checkOnly -> rejected -> guess again loop. A
+// deploy is all-or-nothing and checkOnly reports only the FIRST failure, so one bad element rolls
+// back an entire wave and a wave with three bad elements costs three serial round-trips. This
+// answers the same questions locally, all at once, in microseconds.
+//
+// WHAT IT DELIBERATELY DOES NOT DO: it checks SHAPE, never truth-in-this-org. `emailTemplate`
+// naming a template that does not exist, or `componentName` being `forceSearch:recentItems`
+// (a free xsd:string), are both schema-VALID. Those belong to the referential tier and to
+// observing the org. Claiming otherwise would mean inventing constraints Salesforce does not have.
+const require = createRequire(import.meta.url);
+let cached = null;
+function schema() {
+    if (!cached)
+        cached = require("./metadataSchema.generated.json");
+    return cached;
+}
+export function schemaVersion() {
+    return `${schema().sourcePackage}@${schema().sourceVersion}`;
+}
+/** True when the artifact describes this metadata type at all. */
+export function schemaKnowsType(typeName) {
+    return Boolean(schema().types[typeName]);
+}
+/**
+ * Element name -> the types that legitimately declare it.
+ *
+ * This is what makes a placement check safe. An element name that is simply UNKNOWN stays silent —
+ * the artifact is one API version and "I have not heard of this" is not evidence of wrong. But an
+ * element the schema knows perfectly well, appearing somewhere it is not declared, is a different
+ * claim entirely: it is in the wrong place, and we can say where it belongs.
+ *
+ * Live origin: both flows put <triggerOrder> inside <start>. It is a member of Flow, not FlowStart.
+ * Schema-shaped, locally knowable, and it still cost a 45s checkOnly that rolled back the wave.
+ */
+let ownersCache = null;
+function declaringTypes() {
+    if (ownersCache)
+        return ownersCache;
+    const owners = new Map();
+    for (const [typeName, members] of Object.entries(schema().types)) {
+        for (const member of Object.keys(members)) {
+            const list = owners.get(member) ?? [];
+            list.push(typeName);
+            owners.set(member, list);
+        }
+    }
+    ownersCache = owners;
+    return owners;
+}
+const MAX_FINDINGS = 25;
+/**
+ * Walk an authored XML body against its type definition.
+ *
+ * Only two checks, and both are chosen for a near-zero false-positive rate:
+ *
+ *  - ENUM: an enum's value set is genuinely exhaustive at a given API version, which is the only
+ *    reason a wrong value is knowable locally. This is the NextOwnerType/'group' case.
+ *  - REQUIRED: a member the definitions mark non-optional that the author omitted. Salesforce
+ *    would reject the deploy for it.
+ *
+ * Element NAMES are deliberately NOT checked. That check can only ever warn (a newer org may have
+ * elements this artifact version does not know), and it is the largest false-positive surface —
+ * exactly the noise that trains a reader to ignore findings.
+ *
+ * Unknown types and unknown member types are skipped silently rather than warned about: the
+ * artifact is a snapshot of one API version, and "I have not heard of this" is not evidence of
+ * "this is wrong".
+ */
+export function checkAgainstSchema(typeName, body) {
+    const s = schema();
+    if (!s.types[typeName])
+        return [];
+    const findings = [];
+    const walk = (members, node, prefix) => {
+        if (findings.length >= MAX_FINDINGS)
+            return;
+        // REQUIRED: present in the definitions as non-optional, absent from the authored XML.
+        for (const [name, def] of Object.entries(members)) {
+            if (!def.required)
+                continue;
+            // NEVER required-check a COLLECTION. In TypeScript `fields: CustomField[]` is non-optional
+            // because an empty array is representable; in XML an empty collection is simply ABSENT. So
+            // every unstated collection reads as "required and missing". Measured on 160 components the
+            // org actually accepted, this single confusion produced 819 false findings (5 per component)
+            // — noise that would have trained every reader to ignore the tier. Only scalars and single
+            // objects can be meaningfully "missing".
+            if (def.array)
+                continue;
+            // NEVER required-check a BOOLEAN either. Salesforce defaults an omitted boolean to false, so
+            // absence is a legal way to say false — `<default>` on a picklist value, `<sorted>` on a
+            // value set, `<includeRecordsOwnedByAll>` on a sharing rule. Measured: these were the ONLY
+            // findings left on org-accepted components after collections were excluded, all 13 of them.
+            if (def.type === "boolean")
+                continue;
+            // `fullName` rides the file path in source format, so its absence from the body is normal.
+            //
+            // A NESTED member does need its own — but this tier cannot say so: @salesforce/types declares
+            // `Metadata = { fullName?: string }`, optional, and the same optional flows to every child. The
+            // types have no way to express "optional at the root, required on a child". Attempting it here
+            // would be inventing a constraint the artifact does not carry. It lives in the LEMMA tier
+            // instead, where live-caught facts belong (LEMMA_CHILD_MISSING_FULLNAME).
+            if (name === "fullName")
+                continue;
+            const value = node[name];
+            if (value === undefined || value === null || value === "") {
+                findings.push({
+                    path: prefix ? `${prefix}.${name}` : name,
+                    kind: "required",
+                    message: `<${name}> is required on ${typeName}${prefix ? ` (at ${prefix})` : ""} but is missing.`
+                });
+            }
+        }
+        // ENUM + recursion into nested object types.
+        for (const [name, raw] of Object.entries(node)) {
+            const def = members[name];
+            if (!def) {
+                // Unknown HERE. Silent unless the schema declares it somewhere else, in which case this is
+                // a misplacement rather than an unrecognised name — see declaringTypes().
+                // `fullName` USED to be excluded outright. The reason was real but is now obsolete: the
+                // artifact modelled it inconsistently (CompactLayout declared it, ValidationRule did not),
+                // so a placement check reported <fullName> inside <validationRules> as misplaced and
+                // suggested DeployMessage — a confident, wrong answer on a shape the org accepts daily.
+                // The extractor now follows TypeReferences through intersections, so fullName resolves on
+                // 750 types instead of 14 and the inconsistency is gone.
+                //
+                // That makes a NARROW claim safe, and it is one the org enforces: a child type that
+                // declares `name` and NOT `fullName` is name-keyed, so <fullName> there is simply the wrong
+                // key. 221 types are in that class; the 34 that declare BOTH stay silent, because there the
+                // schema genuinely cannot tell us which one is meant. Live cost of not having this: an
+                // <fullName> inside <approvalStep> failed CF77's wave 4 at checkOnly and — a deploy being
+                // all-or-nothing — rolled back six correct components with it.
+                const elsewhere = name === "fullName" ? (members.name && !members.fullName ? ["<name>"] : undefined) : declaringTypes().get(name);
+                if (elsewhere && elsewhere.length > 0 && findings.length < MAX_FINDINGS) {
+                    findings.push({
+                        path: prefix ? `${prefix}.${name}` : name,
+                        kind: "placement",
+                        message: name === "fullName"
+                            ? `<fullName> is not valid ${prefix ? `inside <${prefix.split(".").pop()}>` : `on ${typeName}`} — this child is keyed by <name>, not <fullName>. Rename the element, and make its value a developer name (letters, digits and underscores only; no spaces).`
+                            : `<${name}> is not valid ${prefix ? `inside <${prefix.split(".").pop()}>` : `on ${typeName}`}. The schema declares it on: ${elsewhere.slice(0, 4).join(", ")}${elsewhere.length > 4 ? ", …" : ""}. Move it there.`
+                    });
+                }
+                continue;
+            }
+            const path = prefix ? `${prefix}.${name}` : name;
+            const values = Array.isArray(raw) ? raw : [raw];
+            const allowed = s.enums[def.type];
+            if (allowed) {
+                for (const v of values) {
+                    if (v === undefined || v === null || typeof v === "object")
+                        continue;
+                    if (!allowed.includes(String(v))) {
+                        findings.push({
+                            path,
+                            kind: "enum",
+                            message: `<${name}> = "${String(v)}" is not a valid ${def.type}. Allowed: ${allowed.join(" | ")}.`
+                        });
+                    }
+                }
+                continue;
+            }
+            const nested = s.types[def.type];
+            if (nested) {
+                for (const v of values) {
+                    if (v && typeof v === "object" && !Array.isArray(v)) {
+                        walk(nested, v, path);
+                    }
+                }
+            }
+        }
+    };
+    walk(s.types[typeName], body, "");
+    return findings;
+}

package/dist/direct/operatorPage.js

@@ -0,0 +1,349 @@
+// THE OPERATOR'S RESULTS PAGE, RENDERED.
+//
+// Before this module, the page was composed freehand by the supervisor from a prose skeleton on
+// every run — which is why it never displayed the same way twice, and why 7 outstanding items
+// could outweigh 45 delivered ones on the reader's screen. The counts were already computed once
+// and carried to close (`plannedScope.ts`); what was missing was a renderer that spends the
+// PAGE'S SPACE in proportion to what actually happened.
+//
+// Pure by construction: no I/O, no clock, no org call. Every input arrives as an argument so the
+// whole page is a golden test.
+import { CI_RULES } from "../campfire/configItem.js";
+import { plannedKey } from "./plannedScope.js";
+/**
+ * The nouns de-camel-casing gets WRONG. Everything else falls through to the split below, which
+ * turns "ValidationRule" into "validation rule" perfectly well — so this map stays short rather
+ * than becoming a second registry to maintain.
+ */
+const TYPE_NOUN = {
+    CustomObject: "object",
+    CustomField: "field",
+    StandardField: "field",
+    // A WebLink IS a custom button in Setup. "web link" would send someone hunting for the wrong page.
+    WebLink: "button",
+    FlexiPage: "page",
+    Layout: "page layout",
+    CustomApplication: "app",
+    CustomTab: "tab",
+    ApexClass: "Apex class",
+    ApexTrigger: "Apex trigger"
+};
+function noun(typeName) {
+    const exact = TYPE_NOUN[typeName];
+    if (exact !== undefined)
+        return exact;
+    return typeName.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase();
+}
+/**
+ * A component as a consultant would say it out loud.
+ *
+ * Api names STAY. `operator-voice.md`'s test is "the line is the audience, not the topic", and
+ * `Agreement.Form__c` is a Salesforce fact a consultant reads fluently — unlike `DIFF_VERIFIED`,
+ * which is a harness fact and never appears on this page.
+ */
+export function componentLabel(typeName, fullName) {
+    const word = noun(typeName);
+    const rule = CI_RULES[typeName];
+    if (rule?.shape === "layout") {
+        // "Agreement-Agreement Layout" — the object, then the label, separated by the FIRST hyphen.
+        const cut = fullName.indexOf("-");
+        if (cut > 0) {
+            return `**${fullName.slice(cut + 1)}** ${word} on ${fullName.slice(0, cut)}`;
+        }
+    }
+    if (rule?.shape === "objectChild" || rule?.shape === "objectChildOptional") {
+        // A GLOBAL quick action has no dot and genuinely has no object — say so by omission rather
+        // than by inventing one.
+        const cut = fullName.indexOf(".");
+        if (cut > 0) {
+            return `**${fullName.slice(cut + 1)}** ${word} on ${fullName.slice(0, cut)}`;
+        }
+    }
+    return `**${fullName}** ${word}`;
+}
+/** Fixed width, so two runs sit side by side in a transcript and compare honestly. */
+const BAR_CELLS = 22;
+/**
+ * The rate as a bar.
+ *
+ * Two guards, both about what the EYE reads before the number: a non-zero rate always shows at
+ * least one filled cell, and anything short of 100% always shows at least one empty one.
+ */
+export function rateBar(rate) {
+    const clamped = Math.max(0, Math.min(100, rate));
+    let filled = Math.round((clamped / 100) * BAR_CELLS);
+    if (clamped > 0 && filled === 0)
+        filled = 1;
+    if (clamped < 100 && filled === BAR_CELLS)
+        filled = BAR_CELLS - 1;
+    return `${"█".repeat(filled)}${"░".repeat(BAR_CELLS - filled)}`;
+}
+/**
+ * The planned scope, grouped by the requirement that owns each configuration.
+ *
+ * THE INVARIANT THIS EXISTS TO HOLD: summed across groups, `denominator` equals `scope.planned`
+ * and `deliveredCount` equals `scope.automated`. That is only true if this walks the three lists
+ * in the SAME precedence `computeScope` does — components, then manual, then unautomatable, each
+ * key taken once, first owner winning. A page whose green lines do not total its own headline
+ * teaches the reader to distrust both numbers.
+ */
+export function groupByRequirement(plannedScope, deliveredKeys, requirements) {
+    const delivered = new Set(deliveredKeys);
+    const titles = new Map(requirements.map((r) => [r.extId, r.title]));
+    const seen = new Set();
+    const groups = new Map();
+    const take = (component, kind) => {
+        const key = plannedKey(component);
+        // FIRST OWNER WINS, across all three lists — the same collapse `computeScope` applies, and the
+        // reason a component named by two requirements cannot double the denominator.
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        let group = groups.get(component.extId);
+        if (!group) {
+            group = {
+                extId: component.extId,
+                // An ext id with no index entry still gets a group. Dropping it would lose a real
+                // configuration from the page while leaving it in the panel's count.
+                //
+                // WHITESPACE COLLAPSED, and not cosmetically: this string is rendered inside a bold span
+                // in a block the supervisor pastes VERBATIM. Campfire titles reach the index through
+                // `stripRichText`, which turns `</p>` into a newline, so a two-paragraph requirement name
+                // would break the bold across lines and inject a stray line into the pasted block.
+                title: (titles.get(component.extId) ?? component.extId).replace(/\s+/g, " ").trim(),
+                components: [],
+                deliveredCount: 0,
+                denominator: 0,
+                fullyDelivered: false
+            };
+            groups.set(component.extId, group);
+        }
+        // A DELIVERY OUTRANKS A PLAN-TIME ROUTE — the same promotion `computeScope` applies before its
+        // own dedup. A configuration the plan routed to a person, that a wave then delivered, is
+        // deployed work: the panel counts it in both halves and removes it from the manual count.
+        // Grouping it any other way is precisely how the page's lines stop totalling the headline
+        // above them, which is the one thing this function exists to prevent.
+        const effective = kind !== "deployable" && delivered.has(key) ? "deployable" : kind;
+        const isDelivered = effective === "deployable" && delivered.has(key);
+        group.components.push({
+            key,
+            label: componentLabel(component.typeName, component.fullName),
+            delivered: isDelivered,
+            route: effective
+        });
+        if (effective !== "unautomatable")
+            group.denominator += 1;
+        if (isDelivered)
+            group.deliveredCount += 1;
+    };
+    for (const c of plannedScope.components)
+        take(c, "deployable");
+    for (const c of plannedScope.manual)
+        take(c, "manual");
+    for (const c of plannedScope.unautomatable ?? [])
+        take(c, "unautomatable");
+    for (const group of groups.values()) {
+        group.fullyDelivered = group.denominator > 0 && group.deliveredCount === group.denominator;
+    }
+    // Requirement-index order, so the page lists them the way the operator approved them. A group
+    // whose requirement is not in the index keeps insertion order at the end.
+    const rank = new Map(requirements.map((r, i) => [r.extId, i]));
+    return [...groups.values()].sort((a, b) => (rank.get(a.extId) ?? Number.MAX_SAFE_INTEGER) - (rank.get(b.extId) ?? Number.MAX_SAFE_INTEGER));
+}
+/**
+ * The page, as the operator reads it.
+ *
+ * The block this returns is pasted VERBATIM. Everything below its final heading — the manual
+ * steps, rollback, notes, the technical section — remains the supervisor's to write, because
+ * those are the parts that genuinely differ run to run.
+ */
+export function renderOperatorPage(report, requirements) {
+    const { scope } = report;
+    const lines = [];
+    // NO DENOMINATOR IS A REAL ANSWER. Rendering a zero rate here would state a measurement this
+    // batch never took, in the flattering-to-nobody direction.
+    if (!scope) {
+        lines.push(`## Delivery finished`, ``, `**automation rate unavailable — this run recorded no planned scope.**`, ``);
+        return lines.join("\n");
+    }
+    const failed = report.result === "FAILED";
+    const needsAttention = report.result === "NEEDS_ATTENTION";
+    const alreadySatisfied = report.result === "ALREADY_SATISFIED";
+    const nothingDeployed = report.result === "NO_WAVES";
+    // THE ONLY RUN THE READ-ONLY SENTENCE IS TRUE OF: one that asked for nothing.
+    //
+    // It used to cover every NO_WAVES batch, and that re-introduced the QA-round-2 defect at one
+    // remove: a batch of 12 planned configurations whose approval card the operator declined got a
+    // three-line page that mentioned none of them. "The remainder is never softened or omitted" is
+    // the invariant, and omitting the whole page is the strongest form of omitting it.
+    if (nothingDeployed && scope.planned === 0) {
+        lines.push(`## No changes were made`, ``, `No step changed this org — this run only read.`, ``);
+        return lines.join("\n");
+    }
+    const plural = (n, one, many) => (n === 1 ? one : many);
+    if (alreadySatisfied) {
+        // A RESULT, not an absence of one: the consultant asked a question about their org and got a
+        // definitive answer. The rate is honestly 0% and saying so would read as failure.
+        lines.push(`## ✅ Already configured — all ${scope.planned} requested ${plural(scope.planned, "configuration was", "configurations were")} already in place`);
+    }
+    else if (nothingDeployed) {
+        // TRUE OF BOTH CAUSES, and it must not choose between them: this renderer cannot tell an
+        // operator who declined the approval card from a batch nothing ever reached a wave for, and
+        // guessing would put a reason on the page that no evidence on disk supports.
+        lines.push(`## Nothing was deployed — ${scope.automated} of ${scope.planned} ${plural(scope.planned, "configuration", "configurations")} automated`);
+    }
+    else if (failed) {
+        lines.push(`## ❌ Delivery failed`);
+    }
+    else if (needsAttention) {
+        lines.push(`## ⚠️ Delivery finished — ${report.problemWaves} ${plural(report.problemWaves, "step needs", "steps need")} review`);
+    }
+    else if (scope.automated === scope.planned) {
+        // "ALL" IS A CLAIM ABOUT WHAT LANDED, not about what is left over. Branching on `manual === 0`
+        // printed "all 4 configurations automated" directly above a 75% bar and a ⬜ "not deployed"
+        // line, on a batch of 4 planned / 3 automated / 0 manual — flattering, and forbidden.
+        lines.push(`## ✅ Delivery complete — all ${scope.planned} ${plural(scope.planned, "configuration", "configurations")} automated`);
+    }
+    else {
+        lines.push(`## ✅ Delivery complete — ${scope.automated} of ${scope.planned} ${plural(scope.planned, "configuration", "configurations")} automated`);
+    }
+    lines.push(``);
+    // The bar is celebratory framing and belongs only on a run that earned it. The RATE itself is
+    // stated either way — a bad batch still gets an honest measurement, just not a trophy.
+    if (alreadySatisfied) {
+        lines.push(`**Already in place — nothing needed to be deployed.** Each configuration below was found present when this batch was planned.`);
+    }
+    else if (nothingDeployed) {
+        lines.push(`No deployment step ran in this batch, so nothing below has been applied to your org.`);
+    }
+    else if (failed || needsAttention) {
+        lines.push(`${scope.automated} of ${scope.planned} configurations automated — ${scope.automationRate}%.`);
+    }
+    else {
+        lines.push(`**${scope.automationRate}% automated** — \`${rateBar(scope.automationRate)}\`` +
+            (scope.manual > 0
+                ? ` — ${scope.manual} configuration${scope.manual === 1 ? " still needs" : "s still need"} you`
+                : ""));
+    }
+    lines.push(``);
+    const groups = report.plannedScope
+        ? groupByRequirement(report.plannedScope, report.deliveredKeys, requirements)
+        : [];
+    // A requirement whose planned work is ENTIRELY data setup has no fraction to be right or wrong
+    // about, so it is out of this denominator for the same reason a requirement owning no planned
+    // component is: counting it would state a rollup the batch never attempted, and drag a perfect
+    // run below 100% on the strength of work that was never in the rate either.
+    const rollup = groups.filter((g) => g.denominator > 0);
+    const fullyDelivered = rollup.filter((g) => g.fullyDelivered).length;
+    // A checkmark is a claim of success — this panel earns it only on the same runs the headline
+    // and bar do. Every other result still states every count below, just without the mark.
+    const panel = [];
+    if (!failed && !needsAttention && !nothingDeployed && !alreadySatisfied) {
+        panel.push(`> ✅ **${scope.automated}** completed and verified in Salesforce`);
+        if (rollup.length > 0) {
+            panel.push(`> ✅ **${fullyDelivered} of ${rollup.length}** ${plural(rollup.length, "requirement", "requirements")} fully delivered`);
+        }
+    }
+    if (scope.manual > 0) {
+        panel.push(`> ⬜ **${scope.manual}** manual ${plural(scope.manual, "configuration remains", "configurations remain")}`);
+    }
+    // Beside the rate, in NEITHER half of it — with the reason, because a bare exclusion reads as
+    // a number being hidden. And with WHO IT IS WAITING ON: these are permission-set assignments,
+    // group memberships and custom-setting rows, so "not counted against the rate" alone let a
+    // consultant read "Still to do — 2" while three things needed a human. They stay out of
+    // `scope.manual` — that number is computed once, at close, and is never re-derived here — so
+    // they are stated as their own count instead.
+    if (scope.unautomatable > 0) {
+        const one = scope.unautomatable === 1;
+        panel.push(`> ⚙️ **${scope.unautomatable}** item${one ? " is" : "s are"} data setup, not deployable configuration — ${one ? "it still needs" : "they still need"} a person, and ${one ? "it is" : "they are"} not counted against the rate`);
+    }
+    if (scope.outsideScope > 0) {
+        const one = scope.outsideScope === 1;
+        panel.push(`> ➕ **${scope.outsideScope}** configuration${one ? "" : "s"} delivered that no approved plan asked for — counted in neither half of the rate`);
+    }
+    // Only when there IS a panel: an unconditional blank after an empty one is how a FAILED batch
+    // with no remainder emitted two blank lines before its first heading.
+    if (panel.length > 0)
+        lines.push(...panel, ``);
+    const mode = alreadySatisfied ? "alreadySatisfied" : nothingDeployed ? "nothingDeployed" : "delivered";
+    return `${lines.join("\n")}\n${renderGroups(report, requirements, mode)}`;
+}
+/**
+ * Above this many component lines, requirements with nothing outstanding collapse to their header.
+ *
+ * The pile IS the message — a reader should see the volume of what landed — but a 140-line scroll
+ * to reach the outstanding work trades one bad proportion for another. Requirements with anything
+ * left stay enumerated at any size, because those are the ones a reader must act on.
+ */
+const ENUMERATION_LIMIT = 60;
+function renderGroups(report, requirements, mode) {
+    if (!report.plannedScope)
+        return "";
+    // ALREADY_SATISFIED confirms presence at PLANNING time, not through a wave — no wave ran, so
+    // `report.deliveredKeys` is always empty here (see batchReport.ts: it is narrowed from NO_WAVES).
+    // Grouping against it as-is would mark every configuration "⬜ needs a person" below, which is
+    // backwards for a batch whose entire premise is that nothing was missing. The confirmed set here
+    // is everything the plan named as deployable or manual — unautomatable items are handled by their
+    // own branch below and deliberately excluded.
+    const deliveredKeys = mode === "alreadySatisfied"
+        ? [...report.plannedScope.components, ...report.plannedScope.manual].map(plannedKey)
+        : report.deliveredKeys;
+    const groups = groupByRequirement(report.plannedScope, deliveredKeys, requirements);
+    if (groups.length === 0)
+        return "";
+    const totalLines = groups.reduce((n, g) => n + g.components.length, 0);
+    const collapseClean = totalLines >= ENUMERATION_LIMIT;
+    const landed = report.scope?.automated ?? 0;
+    const planned = report.scope?.planned ?? 0;
+    const lines = [
+        mode === "alreadySatisfied"
+            ? `### What was already in place`
+            : mode === "nothingDeployed"
+                ? // "What landed — 0 configurations" would be true and would read as an epitaph. The pile
+                    // on this page is the plan, and saying so is what makes the ⬜ lines below legible.
+                    `### What this batch planned — ${planned} configuration${planned === 1 ? "" : "s"}`
+                : `### What landed in Salesforce — ${landed} configuration${landed === 1 ? "" : "s"}`,
+        ``
+    ];
+    for (const group of groups) {
+        // A ZERO DENOMINATOR IS NOT A SCORE. A requirement whose planned work is entirely data setup
+        // rendered "⬜ 0 of 0", which reads as a requirement that failed. It has no fraction, so it
+        // gets none — the ⚙️ lines beneath it say what it is waiting on.
+        if (group.denominator === 0) {
+            lines.push(`**${group.extId} — ${group.title}**`);
+        }
+        else {
+            const mark = group.fullyDelivered ? "✅" : "⬜";
+            lines.push(`**${group.extId} — ${group.title}** — ${mark} ${group.deliveredCount} of ${group.denominator}`);
+        }
+        if (collapseClean && group.fullyDelivered) {
+            lines.push(``);
+            continue;
+        }
+        for (const c of group.components) {
+            if (c.route === "unautomatable") {
+                // BOTH HALVES OF THE TRUTH. Out of the rate, and still on somebody's desk — a
+                // permission-set assignment or a custom-setting row is work a person does by hand.
+                lines.push(`- ⚙️ ${c.label} — data setup, not a deployable configuration; needs a person`);
+            }
+            else if (c.delivered) {
+                lines.push(mode === "alreadySatisfied" ? `- ✅ ${c.label} — already present` : `- ✅ ${c.label}`);
+            }
+            else if (c.route === "manual") {
+                lines.push(`- ⬜ ${c.label} — needs a person`);
+            }
+            else {
+                lines.push(`- ⬜ ${c.label} — not deployed`);
+            }
+        }
+        lines.push(``);
+    }
+    // THE HEADING ONLY. Its items, their Setup paths and their time estimates stay the supervisor's
+    // to write — Campfire writeback is being reworked, and this page must not depend on it. What
+    // the code owns is the COUNT, so the proportion of the page cannot be reframed.
+    const manual = report.scope?.manual ?? 0;
+    if (manual > 0) {
+        lines.push(`### Still to do — ${manual} configuration${manual === 1 ? "" : "s"}`);
+    }
+    return lines.join("\n");
+}