omakit 0.4.1 → 0.4.2

package/README.md

@@ -1,126 +1,60 @@
 <p align="center">
-  <img src="docs/media/banner.gif" alt="omakit" width="440">
+  <img src="https://raw.githubusercontent.com/mtolhuys/omakit/main/docs/media/banner.gif" alt="omakit" width="440">
 </p>
 
-The safe place to find out: everything knowable about an Omarchy Quattro plugin submission before you post it, on your own machine. Agent-first, read-only against the marketplace, posts nothing, zero dependencies.
+The marketplace validates one exact commit of your plugin. Push a fix or comment "fixed", and nothing re-runs ([M6](docs/MEASUREMENTS.md#m6-the-validated-commit-falls-behind-silently-and-that-is-the-centre-of-this-tool)). omakit runs the marketplace's own checks locally, watches your submission and posts nothing.
 
 [![Built for Omarchy: App](https://raw.githubusercontent.com/tcballard/omarchy-badges/75975e5b5bf75e7ede3764bcd2950046f7abfe2c/badges/v1/omarchy-app.svg)](https://github.com/tcballard/omarchy-badges) [![npm version](https://img.shields.io/npm/v/omakit)](https://www.npmjs.com/package/omakit) [![CI status](https://img.shields.io/github/actions/workflow/status/mtolhuys/omakit/ci.yml?branch=main)](https://github.com/mtolhuys/omakit/actions/workflows/ci.yml) [![Socket](https://socket.dev/api/badge/npm/package/omakit)](https://socket.dev/npm/package/omakit)
 
-`omakit` is a zero-dependency Node CLI that checks an Omarchy Quattro plugin submission on your machine.
-It is for a coding agent or a person submitting a plugin.
-It never posts to the marketplace or writes into a plugin tree.
-
 ## Install
 
 ```bash
-npm install --global omakit
-omakit setup
-```
-
-See [docs/INSTALL.md](docs/INSTALL.md) for the clone route, PATH, requirements and upgrading.
-
-## Commands
-
-| Command | What it does |
-| --- | --- |
-| [`omakit setup`](docs/COMMANDS.md) | The environment, the pin, tab completion, and what to try first. |
-| [`omakit submit <plugin-repo>`](docs/SUBMIT.md) | Every check, the issue title and body; asks for a category and tags at a terminal. |
-| [`omakit watch [<issue-url>]`](docs/VALIDATION_WATCH.md) | Pick your marketplace issues, list them, or check all with `--all`. |
-| [`omakit verify <plugin-repo>`](docs/COMMANDS.md) | The official security baseline over the local transport; `--json` for the document. |
-| [`omakit parity`](docs/COMMANDS.md) | The baseline over GitHub versus the local transport, on real listings; writes the evidence. |
-| [`omakit audit [<plugin>]`](docs/AUDIT.md) | Installed third-party commits against the exact commits the marketplace validated. |
-| [`omakit weigh <plugin>`](docs/WEIGH.md) | What a plugin weighs on the shell, measured by restarting it without and with the plugin; asks first. |
-| [`omakit doctor`](docs/COMMANDS.md) | What is installed, what is pinned, and what has moved. |
-| [`omakit pin`](docs/COMMANDS.md) | What setup does for the pin, on its own. |
-| [`omakit upgrade`](docs/COMMANDS.md) | Updates omakit through its own installer: npm, or a fast-forward. |
-| [`omakit help --agent`](docs/COMMANDS.md) | The operating instructions, for the agent running this. |
-
-Normal terminal use also checks for a newer npm release at most once daily
-and shows the upgrade command. It installs nothing automatically; scripts
-and JSON stay quiet. `DISABLE_UPDATE_NOTIFIER=1` disables the notice, and
-`omakit doctor` checks explicitly. [Update behaviour](docs/INSTALL.md#updating).
-
-Terminal help and reports adapt to the available width, up to 120 columns
-for readability. Narrow windows wrap sooner; pipes and text files keep the
-stable eighty-column layout. JSON and exact issue bodies remain intact.
-
-### `submit`
-
-```bash
-omakit submit <plugin-repo> --category Widgets --tags bar,quickshell
+npm i -g omakit && omakit setup
+npx skills add mtolhuys/omakit
 ```
 
-It decides whether the plugin is ready, refused, or already listed; [103 issues mention agent-control files that no automated check reports](docs/MEASUREMENTS.md).
+Requirements: [Node >=22](package.json); Omarchy Quattro.
 
-![omakit submit refusing a plugin with no license, a README that never says how to uninstall, and a reserved plugin id](docs/media/submit.gif)
+Licence: [MIT](LICENSE).
 
-Read more: [docs/SUBMIT.md](docs/SUBMIT.md).
+## `omakit submit <plugin-repo>`
 
-### `watch`
+![submit refusing a fixture plugin before any issue is posted](https://raw.githubusercontent.com/mtolhuys/omakit/main/docs/media/submit.gif)
 
-```bash
-omakit watch <submission-issue-url>
-omakit watch --all
-omakit watch --list
-omakit watch                 # choose one or several issues at a terminal
-```
+Checks the exact commit with the marketplace's own baseline and, when ready, prints the exact issue title and body for you to paste. The GIF shows a refusal with three blocking checks and their fixes.
 
-It decides whether the marketplace validated the plugin's current commit; [73% of parked submissions have a HEAD the marketplace never saw](docs/MEASUREMENTS.md).
+## `omakit watch --all`
 
-Account-wide discovery uses your signed-in `gh` account and reads your open marketplace issues. `--user <login>` reads another public account. Batch output includes baseline results, labels and the latest human discussion; `current` compares commits and does not imply approval or publication. Each command takes one snapshot and posts nothing.
+![watch counts and two current issues, including human discussion](https://raw.githubusercontent.com/mtolhuys/omakit/main/docs/media/watch-all.gif)
 
-![omakit watch reporting that a validated commit has fallen behind](docs/media/watch.gif)
+Checks your submission commits and names the action that re-runs stale validation: edit the issue body. The GIF shows five CURRENT issues in the counts and the first two issues with a discussion; CURRENT means matching commits, not approval.
 
-Read more: [docs/VALIDATION_WATCH.md](docs/VALIDATION_WATCH.md).
+## `omakit audit`
 
-### `weigh`
-
-```bash
-omakit weigh <plugin-id-or-dir>
-```
+![audit keeping drift rows and the DRIFT summary visible together](https://raw.githubusercontent.com/mtolhuys/omakit/main/docs/media/audit.gif)
 
-It measures what a plugin weighs on the shell, CPU and child processes, against a baseline taken the same minute; [in the lab, a 180 ms timer fixture measured 2.73% CPU above a 0.13% floor](docs/MEASUREMENTS.md).
+Compares your installed plugin commits with the marketplace's validated commits. The GIF shows drift rows first: on the author's desktop, 9 of 18 audited plugins ran commits the marketplace never validated.
 
-```text
-Weighs no CPU above the floor (0.13%) and runs 2 child processes using 8.2 MB and 0.1% CPU, on Omarchy 4.0.0.alpha, measured with omakit weigh on 2026-09-14
-```
+## `omakit weigh <plugin>`
 
-It restarts your shell and asks first. Memory is a shell fact; CPU and child processes are the weight.
+![completed three-run desktop weighing with baseline samples and the noise floor](https://raw.githubusercontent.com/mtolhuys/omakit/main/docs/media/weigh.gif)
 
-Read more: [docs/WEIGH.md](docs/WEIGH.md).
+Measures the shell with and without your plugin, reading Pss and CPU. The GIF shows three completed runs on the author's desktop, with baseline and plugin samples and a 0.33% CPU floor ([method](docs/WEIGH.md)).
 
 ## Evidence, not claims
 
-| Claim | Proof |
+| Measurement | Evidence |
 | --- | --- |
-| The local transport produces the marketplace's own result | 30 of 30 identical, [docs/evidence/parity/](docs/evidence/parity/) |
-| A local run touches no network | run inside `unshare -rn`, [docs/evidence/offline/](docs/evidence/offline/) |
-| The generated body is well formed | the marketplace's own parser, `tests/unit/issue.test.mjs` |
-| Nothing writes to the marketplace | `tests/unit/read-only.test.mjs`, over every source file |
-| No agent-control file can reach a plugin | `tests/unit/self-containment.test.mjs` |
-| `weigh` restores `shell.json` on every exit path, and runs a frozen list of Omarchy commands | `tests/unit/weigh.test.mjs` against a fake `/proc` and stub commands, `tests/unit/read-only.test.mjs` |
-| The GIFs above are real output | captures and renderer in [docs/media/](docs/media/) |
-
-Committed evidence records a digest of each side rather than the results themselves, because findings about a specific third-party plugin are not this project's to publish.
+| Baseline parity | 30/30 identical results, [recorded corpus](docs/evidence/parity/2026-09-12-local-vs-github-2.json), 2026-09-12 |
+| Stale validated commit | 326/519 readable comparisons stale (62.8%); 64/583 unknown, [2026-09-15 data](docs/evidence/staleness/2026-09-15.json) |
+| Registry churn | 4,201/4,293 registry-only commits in 30 days, 2026-09-13, [M7](docs/MEASUREMENTS.md#m7-the-registry-moves-by-the-hour-the-code-and-the-rules-move-by-the-week) |
+| GIFs are recorded output | 5 GIFs with [captures and scenes](docs/media/README.md) |
+| Posts nothing | 0 marketplace writes, [M10](docs/MEASUREMENTS.md#m10-readme-evidence-and-command-captures) |
+| Zero dependencies | 0 runtime and 0 development dependencies, counted in [package.json](package.json) |
 
 ## Documentation
 
-| Document | For |
-| --- | --- |
-| [docs/INSTALL.md](docs/INSTALL.md) | install details, PATH, requirements, upgrading, and what Socket reports and why |
-| [docs/HOW.md](docs/HOW.md) | what omakit is doing, why it uses Node, the baseline and check labels |
-| [docs/COMMANDS.md](docs/COMMANDS.md) | command details, authentication and network behaviour |
-| [docs/AUDIT.md](docs/AUDIT.md) | installed plugin drift against marketplace-validated commits, with JSON origins |
-| [docs/SUBMIT.md](docs/SUBMIT.md) | every check and what it decides |
-| [docs/WEIGH.md](docs/WEIGH.md) | what `weigh` measures, the noise floor, the `shell.json` mutation and its restore, and the JSON contract |
-| [docs/VALIDATION_WATCH.md](docs/VALIDATION_WATCH.md) | the validation watch: what the marketplace validated, and what moves it |
-| [docs/MEASUREMENTS.md](docs/MEASUREMENTS.md) | every number, its method and its limits |
-| [docs/UPSTREAM_CONTRACT.md](docs/UPSTREAM_CONTRACT.md) | the seam, the pin, the boundaries |
-| [docs/MARKETPLACE.md](docs/MARKETPLACE.md) | who this actually helps |
-| [docs/PALETTE.md](docs/PALETTE.md) | every installed Omarchy theme measured, and which palette index each role gets |
-| [docs/TUI.md](docs/TUI.md) | what the terminal shows, and why it looks that way |
-| [AGENTS.md](AGENTS.md) | changing this repository |
-
-MIT. Derived work built on public data from
-`omacom/omarchy-plugin-marketplace`; not affiliated with or endorsed by that
-project.
+- Using: [install](docs/INSTALL.md), [commands](docs/COMMANDS.md), [audience](docs/MARKETPLACE.md).
+- Checks and measurements: [submit](docs/SUBMIT.md), [watch](docs/VALIDATION_WATCH.md), [audit](docs/AUDIT.md), [evidence](docs/MEASUREMENTS.md).
+- Method docs: [how](docs/HOW.md), [weigh](docs/WEIGH.md), [upstream contract](docs/UPSTREAM_CONTRACT.md), [palette](docs/PALETTE.md), [terminal](docs/TUI.md).
+- Contributing: [repository rules](AGENTS.md), [releasing](docs/RELEASING.md), [media](docs/media/README.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omakit",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "The safe place to find out: everything knowable about an Omarchy Quattro plugin submission before you post it, on your own machine. Agent-first, read-only against the marketplace, posts nothing, zero dependencies.",
   "license": "MIT",
   "author": "Maarten Tolhuijs",

package/skills/omarchy-plugin-check/SKILL.md

@@ -92,8 +92,8 @@ own words, and so should you.
 
 The marketplace validates the pushed default-branch HEAD, not whatever is
 checked out locally. Run the check on the commit that will be pushed, then
-commit and push before the real submission. Of the 464 submissions parked in
-their author's court, 73% have a HEAD the marketplace never saw; that is the
+commit and push before the real submission. On 2026-09-15, 326/519 readable author-fixes
+comparisons were stale, with 64 of 583 issues unknown; that is the
 round this loop is meant to prevent.
 
 ## When the plugin is ready

package/skills/omarchy-plugin-submit/SKILL.md

@@ -133,8 +133,8 @@ strip files from their tree on your own.
 
 **`submission.validation-commit`.** The marketplace validates the commit it
 resolves when the issue is opened or edited, which is the pushed default-branch
-HEAD, not whatever is checked out locally. Push first, then submit. 73% of submissions
-parked in their author's court have a HEAD the marketplace never saw.
+HEAD, not whatever is checked out locally. Push first, then submit. On 2026-09-15, 326/519 readable author-fixes comparisons were stale
+(62.8%), with 64 of 583 issues unknown.
 
 ## What the baseline result means
 

package/skills/omarchy-plugin-validation-watch/SKILL.md

@@ -18,10 +18,10 @@ the issue body**.
   submissions.
 
 So pushing a fix does nothing, and commenting "fixed in `abc123`" does nothing.
-Both feel like progress. Neither is. This is the single most common reason a
-submission sits still: of the 464 submissions parked in their author's court, 73%
-have a default-branch HEAD the marketplace never saw, and 82% of the authors whose
-push came after a review comment had also commented: engaged, and stuck.
+Both feel like progress. Neither is. The full author-fixes queue was measured on 2026-09-15: 326/519 readable
+comparisons were stale (62.8%), with 64 of 583 issues unknown. The older
+2026-09-12 sample found 68/93 readable issues stale (73.1%); that rate was
+not a measurement of all 464 issues in the queue.
 
 ## Check it
 

package/tools/marketplace/README.md

@@ -18,6 +18,8 @@ local commit through the transport seam the marketplace tests itself
 | `tree.mjs` | The installable tree of a subject at one exact commit, from the Git object database. |
 | `plugin.mjs` | The root files the submission contract needs, and the declared plugin identity. |
 | `agent-control.mjs` | The recursive agent-control warning, and its remedy. |
+| `review-cost.mjs` | The advisory review-cost verdict, shared account discovery, and path classification between dated validated snapshots. M4 and M9 carry its evidence. |
+| `measure-review-cost.mjs` | Reproduces M9 across the open update population at live marketplace HEAD, with compare sources and explicit skipped reasons in JSON. |
 | `issue.mjs` | Renders the issue the way the form would, then has the marketplace's own parser judge it. |
 | `submit.mjs` | Assembles every check with its measured reason, and withholds the body when a blocking check fails. Three outcomes: `ready` (the body), `refused` (a blocking check failed) and `listed` (the plugin is already listed by its own repository: `identity.available` passes with the listing's record, the five body checks are omitted rather than drawn as waiting, no body exists on purpose, and `listing` carries the listed commit against the local one and the form to use for a newer commit). Decides the category and tags after the registry: a listed plugin, own or taken, is asked for neither; an unlisted one without them is asked through `ask.mjs` at a terminal, and is a usage error otherwise. Ends with `reproduce`, the command line that repeats the run without asking. Under `--offline` the validation-commit check is `skipped`, not passed: verdict `skipped`, listed under `skipped` and not `unknown`, never blocking, and the READY line says "1 check skipped (--offline)". |
 | `ask.mjs` | The two questions `submit` asks a person at a terminal, and only there: category and tags, numbered from the pinned form, with the marketplace's own presentation for the manifest's kinds (read from the pinned catalog builder) as the default where it is on the list. Prompts on stderr, nothing persisted. |
@@ -98,7 +100,9 @@ sequences and nothing else.
 built-in `fetch`, which does not read proxy environment variables by default.
 Behind a proxy, run them with `NODE_USE_ENV_PROXY=1`. `submit` reads two things
 online, the subject's default-branch HEAD and the marketplace's current
-registry, and `--offline` turns both off; `verify` needs no network at all
+registry. A manual-review baseline also reads the account's open issue
+discovery and issue bodies for batching advice; `--offline` turns these
+reads off. `verify` needs no network at all
 beyond fetching a reviewer-mode subject, and `tests/parity/offline.mjs` proves
 it.
 

package/tools/marketplace/cli.mjs

@@ -68,6 +68,16 @@ const REMEDY = Object.freeze({
   "interrupted": "shell.json was restored; run it again when the desktop is yours to restart.",
 })
 
+/*
+ * A command that has written its result leaves through `process.exitCode`,
+ * never `process.exit()`: stdout is an API, and on a pipe whose reader has
+ * not started reading yet the exit cuts the output. Measured on 0.4.1:
+ * `omakit submit <listed plugin> --json | (sleep 2; cat)` delivered 8,192 of
+ * 14,033 bytes, and a parser downstream saw invalid JSON. The failure
+ * states below still exit at once: they write one short block to stderr,
+ * and their callers use them the way a throw is used.
+ */
+
 /**
  * Every failure, in one register, on stderr. `usage` errors carry the
  * signature that was expected, so the remedy is the reference and not a
@@ -90,9 +100,21 @@ function failFrom(error) {
   throw error
 }
 
+/**
+ * The value of a valued option, written either way the table accepts,
+ * `--name value` or `--name=value`, the last occurrence winning as it does
+ * in options.mjs. Measured on 0.4.1: the table accepted `--out=FILE` and the
+ * value was looked up as the token after `--out`, so `doctor --out=x` wrote
+ * nothing and exited 0, and `submit --category=Widgets` said the flag was
+ * missing.
+ */
 function option(args, name) {
-  const index = args.indexOf(name)
-  return index >= 0 ? args[index + 1] : undefined
+  let value
+  for (let index = 0; index < args.length; index += 1) {
+    if (args[index] === name) value = args[index + 1]
+    else if (args[index].startsWith(`${name}=`)) value = args[index].slice(name.length + 1)
+  }
+  return value
 }
 
 /** The bare arguments, with every valued option's value (options.mjs, one table) left out. */
@@ -169,7 +191,8 @@ async function cmdSubmit(args) {
       const usage = error.usage
       if (json) {
         process.stdout.write(`${JSON.stringify({ usage }, null, 2)}\n`)
-        process.exit(2)
+        process.exitCode = 2
+        return
       }
       const flags = usage.missing.join(" and ")
       fail("usage", `submit needs ${flags}: ${usage.missing.length === 1 ? "it is" : "they are"} an editorial choice nobody else can make, from the pinned form's own lists.`, 2,
@@ -185,7 +208,7 @@ async function cmdSubmit(args) {
   emit(args, args.includes("--json") ? `${JSON.stringify(result, null, 2)}\n` : reportText(args, renderSubmit, result))
   // Three outcomes, two exit codes: `ready` and `listed` are both healthy
   // states, and only a refusal is a 1.
-  process.exit(result.outcome === "refused" ? 1 : 0)
+  process.exitCode = result.outcome === "refused" ? 1 : 0
 }
 
 async function cmdWatch(args) {
@@ -224,7 +247,7 @@ async function cmdWatch(args) {
   spinner.done()
   const render = result.mode === "list" ? renderWatchList : result.mode === "all" ? renderWatchAll : renderWatch
   emit(args, args.includes("--json") ? `${JSON.stringify(result, null, 2)}\n` : reportText(args, render, result))
-  process.exit(result.verdict?.state === "unknown" || result.summary?.unknown > 0 ? 2 : 0)
+  process.exitCode = result.verdict?.state === "unknown" || result.summary?.unknown > 0 ? 2 : 0
 }
 
 async function cmdFrontDoor() {
@@ -243,15 +266,16 @@ async function cmdSetup(args) {
   if (args.includes("--completion")) {
     const identity = requirePin(ROOT).identity
     const result = await completionStep({ repoRoot: ROOT, pin: identity.commit, version: VERSION, askRc: false })
-    process.exit(result.state === "ok" ? 0 : 1)
+    process.exitCode = result.state === "ok" ? 0 : 1
+    return
   }
   const result = await setup({ repoRoot: ROOT, entryPoint: resolve(ROOT, "bin/omakit"), yes: args.includes("--yes") })
-  process.exit(result.ok ? 0 : 1)
+  process.exitCode = result.ok ? 0 : 1
 }
 
 async function cmdUpgrade(args) {
   const result = await upgrade({ repoRoot: ROOT, dryRun: args.includes("--dry-run") })
-  process.exit(result.ok ? 0 : 1)
+  process.exitCode = result.ok ? 0 : 1
 }
 
 async function cmdDoctor(args) {
@@ -259,7 +283,7 @@ async function cmdDoctor(args) {
   const result = await doctor({ repoRoot: ROOT, offline: args.includes("--offline"), onPhase: spinner.phase })
   spinner.done()
   emit(args, args.includes("--json") ? `${JSON.stringify(result, null, 2)}\n` : reportText(args, renderDoctor, result))
-  process.exit(result.problems ? 1 : 0)
+  process.exitCode = result.problems ? 1 : 0
 }
 
 async function cmdVerify(args) {
@@ -325,7 +349,7 @@ async function cmdParity(args) {
   } catch (error) {
     failFrom(error)
   }
-  process.exit(ok ? 0 : 1)
+  process.exitCode = ok ? 0 : 1
 }
 
 function notAudited(message, remedy = null, exit = 1) {
@@ -359,7 +383,7 @@ async function cmdAudit(args) {
   }
   if (parsed.options.has("--json")) process.stdout.write(json)
   else process.stdout.write(`${renderAudit(document)}\n`)
-  process.exit(document.ok ? 0 : 1)
+  process.exitCode = document.ok ? 0 : 1
 }
 
 /**
@@ -399,7 +423,7 @@ async function cmdWeigh(args) {
       throw error
     }
     process.stdout.write(json ? `${JSON.stringify(list.rows, null, 2)}\n` : `${renderList(list)}\n`)
-    process.exit(0)
+    return
   }
   if (!target && !all) notWeighed("usage", "weigh needs a plugin: `omakit weigh <plugin-id-or-dir>`, or `omakit weigh --all` for every enabled third-party plugin.", "omakit weigh <plugin-id-or-dir>", 2)
   if (target && all) notWeighed("usage", `--all weighs every enabled third-party plugin, so ${JSON.stringify(target)} is one argument more than it takes.`, "omakit weigh --all, or omakit weigh <plugin-id-or-dir>", 2)
@@ -466,7 +490,6 @@ async function cmdWeigh(args) {
   } else {
     process.stdout.write(`\n${renderWeigh(document)}\n`)
   }
-  process.exit(0)
 }
 
 const VERSION = JSON.parse(readFileSync(resolve(ROOT, "package.json"), "utf8")).version

package/tools/marketplace/github.mjs

@@ -180,10 +180,10 @@ export async function authenticatedUser() {
 }
 
 /** Repository issues by their creator. PRs are excluded; pagination never silently truncates. */
-export async function repositoryIssues(owner, repository, creator, { readJson = getJson, maxPages = 100 } = {}) {
+export async function repositoryIssues(owner, repository, creator, { readJson = getJson, maxPages = 100, labels } = {}) {
   const all = []
   for (let page = 1; page <= maxPages; page += 1) {
-    const query = new URLSearchParams({ creator, state: "open", sort: "updated", direction: "desc", per_page: "100", page: String(page) })
+    const query = new URLSearchParams({ ...(creator ? { creator } : {}), ...(labels ? { labels } : {}), state: "open", sort: "updated", direction: "desc", per_page: "100", page: String(page) })
     const batch = await readJson(`https://api.github.com/repos/${owner}/${repository}/issues?${query}`)
     if (!Array.isArray(batch)) throw new GitHubError("github-unavailable", "GitHub did not return an issue list")
     all.push(...batch.filter((item) => !item.pull_request))
@@ -205,6 +205,17 @@ export async function issueComments(owner, repository, number, maxPages = 10, re
   throw new GitHubError("comments-incomplete", `Issue #${number} exceeded ${maxPages} comment pages; its latest baseline cannot be determined`)
 }
 
+/** Compare exact validated snapshots. The API caps its file list at 300: never classify a truncated diff. */
+export async function compareCommits(repositoryUrl, previous, validated, { readJson = getJson } = {}) {
+  const match = String(repositoryUrl).match(/^https:\/\/github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?\/?$/)
+  if (!match || ![previous, validated].every((commit) => /^[a-f0-9]{40}$/i.test(commit))) throw new GitHubError("usage", "compare needs a repository and two full commit identifiers")
+  const url = `https://api.github.com/repos/${match[1]}/${match[2]}/compare/${previous}...${validated}?per_page=1`
+  const result = await readJson(url)
+  if (!["ahead", "identical"].includes(result?.status)) throw new GitHubError("compare-not-forward", "validated snapshots are not a forward comparison")
+  if (!Array.isArray(result.files) || result.files.length >= 300) throw new GitHubError("compare-incomplete", "compare file list unavailable or at the 300-file API limit")
+  return { url, files: result.files }
+}
+
 /**
  * The current default-branch HEAD of a repository.
  *

package/tools/marketplace/measure-review-cost.mjs

@@ -0,0 +1,39 @@
+// Reproduce M9 with GET-only issue discovery and compare reads. No sampling.
+import { resolve } from "node:path"
+import { pathToFileURL } from "node:url"
+import { MARKETPLACE_PIN } from "./pin.mjs"
+import { repositoryIssues } from "./github.mjs"
+import { liveRegistry } from "./registry.mjs"
+import { reviewPolicy } from "./review-cost.mjs"
+import { validationWatchAll } from "./watch.mjs"
+
+export async function measureReviewCost(repoRoot) {
+  const policy = await reviewPolicy(repoRoot)
+  const registry = await liveRegistry({ repoRoot })
+  if (registry.source !== "head") throw new Error(`cannot measure at HEAD: ${registry.reason}`)
+  const [owner, repository] = new URL(MARKETPLACE_PIN.repository).pathname.slice(1).split("/")
+  const openedAt = new Date().toISOString()
+  const subjects = await repositoryIssues(owner, repository, undefined, { labels: policy.updateLabel })
+  const issues = subjects.filter((subject) => subject.state === "open" && !subject.pull_request).map((subject) => ({
+    number: subject.number, url: `${MARKETPLACE_PIN.repository}/issues/${subject.number}`, title: subject.title,
+    state: subject.state, labels: subject.labels.map((label) => typeof label === "string" ? label : label.name),
+  }))
+  // Only the manual-review subset needs comment reads and comparisons. No plugin HEAD reads.
+  const manual = issues.filter((subject) => subject.labels.includes(policy.reviewLabel))
+  const batch = await validationWatchAll({ repoRoot, discovery: { account: null, marketplace: MARKETPLACE_PIN.repository, issues: manual },
+    readRegistry: async () => registry, github: { defaultBranchHead: async () => null } })
+  const counts = batch.reviewCostSummary
+  return {
+    measurement: "M9", openedAt, completedAt: new Date().toISOString(), marketplace: MARKETPLACE_PIN.repository,
+    marketplaceHead: registry.commit, command: "node tools/marketplace/measure-review-cost.mjs", sample: false,
+    pluginUpdates: issues.length, manualQueue: manual.length, manualQueueShare: issues.length ? manual.length / issues.length : null,
+    docsOnly: counts.docsOnly, compared: counts.compared, skipped: counts.skipped.length,
+    docsOnlyShareOfCompared: counts.compared ? counts.docsOnly / counts.compared : null,
+    docsOnlyShareOfManualQueue: counts.skipped.length || !manual.length ? null : counts.docsOnly / manual.length,
+    rows: batch.issues.map((row) => ({ issue: row.issue.number, ...row.documentationDiff })),
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  process.stdout.write(`${JSON.stringify(await measureReviewCost(resolve(process.cwd())), null, 2)}\n`)
+}

package/tools/marketplace/measure-staleness.mjs

@@ -0,0 +1,76 @@
+// M6 reproduction: open author-fixes issues, bot marker against commits.atom.
+// All remote reads use the existing GET-only client. Unknowns stay unknown.
+import { resolve } from "node:path"
+import { pathToFileURL } from "node:url"
+import { MARKETPLACE_PIN } from "./pin.mjs"
+import { repositoryIssues, getText } from "./github.mjs"
+import { validationWatch } from "./watch.mjs"
+
+export function atomHead(feed, source) {
+  const commit = feed.match(/<id>tag:github\.com,2008:Grit::Commit\/([0-9a-f]{40})<\/id>/i)?.[1]
+    || feed.match(/\/commit\/([0-9a-f]{40})/i)?.[1]
+  if (!commit) throw new Error("No full HEAD commit in commits.atom")
+  return { source, commit: commit.toLowerCase(), branch: null,
+    committedAt: feed.match(/<updated>([^<]+)<\/updated>/)?.[1] || null }
+}
+
+export function stalenessCounts(rows) {
+  const stale = rows.filter((row) => row.verdict === "stale").length
+  const current = rows.filter((row) => row.verdict === "current").length
+  const compared = stale + current
+  return { total: rows.length, compared, stale, current, unknown: rows.length - compared,
+    staleShareOfCompared: compared ? stale / compared : null,
+    staleShareOfPopulation: compared === rows.length && rows.length ? stale / rows.length : null }
+}
+
+export async function measureStaleness(repoRoot, { discover = repositoryIssues, watch = validationWatch, readText = getText } = {}) {
+  const openedAt = new Date().toISOString()
+  const [owner, repository] = new URL(MARKETPLACE_PIN.repository).pathname.slice(1).split("/")
+  const batches = await Promise.all(["needs-fixes", "security-needs-fixes"].map((labels) => discover(owner, repository, undefined, { labels })))
+  const subjects = [...new Map(batches.flat().map((subject) => [subject.number, subject])).values()]
+    .filter((subject) => subject.state === "open" && !subject.pull_request)
+    .sort((a, b) => a.number - b.number)
+  const heads = new Map()
+  function readHead(url) {
+    if (!heads.has(url)) {
+      const source = `${url.replace(/\/$/, "")}/commits.atom`
+      heads.set(url, Promise.resolve().then(async () => atomHead(await readText(source, "application/atom+xml"), source)))
+    }
+    return heads.get(url)
+  }
+  const rows = new Array(subjects.length)
+  let next = 0
+  async function worker() {
+    while (next < subjects.length) {
+      const index = next++
+      const subject = subjects[index]
+      const issueUrl = `${MARKETPLACE_PIN.repository}/issues/${subject.number}`
+      const observedAt = new Date().toISOString()
+      try {
+        const report = await watch({ repoRoot, issueUrl, github: { issue: async () => subject, defaultBranchHead: readHead } })
+        rows[index] = { issue: subject.number, issueUrl, observedAt, completedAt: new Date().toISOString(),
+          repository: report.plugin.repository, validatedCommit: report.validated?.commit || null,
+          validationSource: report.validated?.source || null, validatedAt: report.validated?.checkedAt || null,
+          validationCommentsSource: `https://api.github.com/repos/${owner}/${repository}/issues/${subject.number}/comments`,
+          defaultBranchHead: report.head?.commit || null, headSource: report.head?.source || null,
+          verdict: report.verdict.state,
+          reason: report.verdict.state === "unknown" ? report.verdict.summary : null }
+      } catch (error) {
+        rows[index] = { issue: subject.number, issueUrl, observedAt, completedAt: new Date().toISOString(),
+          repository: null, validatedCommit: null, defaultBranchHead: null, verdict: "unknown",
+          reason: `${error.code || "read-unavailable"}: ${error.message}` }
+      }
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(4, subjects.length) }, worker))
+  return { measurement: "M6", date: openedAt.slice(0, 10), openedAt, completedAt: new Date().toISOString(),
+    marketplace: MARKETPLACE_PIN.repository, marketplacePin: MARKETPLACE_PIN.commit,
+    command: "node tools/marketplace/measure-staleness.mjs", sample: false,
+    population: "All open non-PR marketplace issues labelled needs-fixes or security-needs-fixes at discovery",
+    method: "Latest bot security-baseline full commit against default-branch commits.atom HEAD; missing full markers or feeds are unknown; unequal commits are stale, without a claim about ancestry",
+    ...stalenessCounts(rows), rows }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  process.stdout.write(`${JSON.stringify(await measureStaleness(resolve(process.cwd())), null, 2)}\n`)
+}

package/tools/marketplace/report.mjs

@@ -266,12 +266,19 @@ export function renderWatchList(result, { colour = colourEnabled() } = {}) {
 /** Compact batch report; exact commits and full discussion remain in JSON. */
 export function renderWatchAll(result, { colour = colourEnabled() } = {}) {
   const c = styler(colour)
-  const out = [...field("account", result.account, c), ...field("issues", `${result.summary.total} checked; ${result.summary.current} current, ${result.summary.stale} stale, ${result.summary.unknown} unknown`, c), ""]
+  const out = [...field("account", result.account, c), ...field("issues", `${result.summary.total} checked; ${result.summary.current} current, ${result.summary.stale} stale, ${result.summary.unknown} unknown`, c)]
+  if (result.reviewCostSummary) {
+    const cost = result.reviewCostSummary
+    const skipped = cost.skipped.length ? `; ${cost.skipped.length} diff(s) skipped (reasons on issue rows)` : ""
+    out.push(...field("review cost", `${cost.manualQueue} of ${cost.pluginUpdates} plugin-update issue(s) on security-review-required; ${cost.docsOnly} docs-only validated diff(s) of ${cost.compared} compared${skipped}`, c))
+  }
+  out.push("")
   for (const row of result.issues) {
     const state = row.report?.verdict.state || "unknown"
     const style = { current: "pass", stale: "fail", unknown: "unknown" }[state]
     out.push(...verdict(style, state.toUpperCase(), `#${row.issue.number} ${watchIssueTitle(row.report?.read.title || row.issue.title)}`, c))
     out.push(...field("issue", row.issue.url, c, { wrapValue: false }))
+    if (row.documentationDiff?.docsOnly === null) out.push(...field("diff skipped", watchIssueTitle(row.documentationDiff.reason), c))
     if (row.error) {
       out.push(...field("read error", watchIssueTitle(`${row.error.code}: ${row.error.message}`), c))
     } else {

package/tools/marketplace/review-cost.mjs

@@ -0,0 +1,107 @@
+// Review cost is advice, never a marketplace rule. Evidence: MEASUREMENTS.md M4 and M9.
+import { readFileSync } from "node:fs"
+import { join } from "node:path"
+import { pathToFileURL } from "node:url"
+import { requirePin } from "./pin.mjs"
+import { token, issue, parseIssueUrl, compareCommits } from "./github.mjs"
+import { discoverWatchIssues, repositoryFor } from "./watch.mjs"
+import { repositorySlug } from "./registry.mjs"
+
+/** Outcome and update label names come from the pin, rather than a second policy. */
+export async function reviewPolicy(repoRoot) {
+  const { dir } = requirePin(repoRoot)
+  const policy = await import(pathToFileURL(join(dir, "scripts/security-baseline-policy.mjs")).href)
+  const approval = readFileSync(join(dir, "scripts/approve-plugin-update.mjs"), "utf8")
+  const updateLabel = approval.match(/for \(const required of \["([^"]+)"/)?.[1]
+  if (!updateLabel) throw new Error("cannot read the update issue label from the pin")
+  const manual = policy.currentSecurityBaselinePolicy.maintainerVerificationOutcome
+  return { automated: policy.securityBaselineOutcome([], []), manual, updateLabel, reviewLabel: `security-${manual}` }
+}
+
+/** The same discovery as watch --all; no credential or incomplete reads are not zero issues. */
+export async function openIssuesForRepository({ repoRoot, repository, offline = false, github = {} }) {
+  if (offline) return { count: null, reason: "not checked (--offline)" }
+  if (!(github.token || token)()) return { count: null, reason: "not checked: no GitHub credential" }
+  try {
+    const discovery = await discoverWatchIssues({ github })
+    const { dir } = requirePin(repoRoot)
+    let count = 0
+    let next = 0
+    async function worker() {
+      while (next < discovery.issues.length) {
+        const target = parseIssueUrl(discovery.issues[next++].url)
+        const subject = await (github.issue || issue)(target.owner, target.repository, target.number)
+        const parsed = await repositoryFor(dir, subject)
+        if (!parsed.url) throw new Error(`repository unknown on issue #${target.number}: ${parsed.error}`)
+        if (repositorySlug(parsed.url) === repositorySlug(repository)) count += 1
+      }
+    }
+    await Promise.all(Array.from({ length: Math.min(4, discovery.issues.length) }, worker))
+    return { count, reason: `watch --all discovery: ${count} open issue(s) for this repository` }
+  } catch (error) {
+    return { count: null, reason: `not checked (${error.code || "issue-discovery-unavailable"}): ${error.message}` }
+  }
+}
+
+export function reviewCostVerdict({ baseline, policy, openIssues = { count: null, reason: "not checked" }, why }) {
+  const capabilities = [...(baseline?.capabilities || [])]
+  const manual = baseline?.outcome === policy.manual
+  const automated = baseline?.outcome === policy.automated
+  const outcome = manual ? openIssues.count > 0 ? "manual queue, again" : "manual queue" : automated ? "automated" : null
+  const detail = manual
+    ? `${outcome}: capabilities ${capabilities.join(", ") || "none"}. Every update of this plugin, including a docs-only one, lands in the manual queue.${openIssues.count > 0 ? ` You already have ${openIssues.count} open issue(s) for this repository.` : ""}`
+    : automated ? "automated: this update will not need a human for the security baseline." : "not checked: baseline.preflight has no passed or review-required outcome"
+  return {
+    reviewCost: { outcome, capabilities, openIssuesForRepository: openIssues.count, reason: `${detail} ${openIssues.reason}` },
+    check: {
+      id: "review.cost", source: "omakit", severity: "advisory", verdict: manual ? "fail" : automated ? "pass" : "unknown",
+      why, detail, paths: [],
+      remedy: manual && openIssues.count > 0 ? "consider batching: close or fold the open one before opening another" : null,
+    },
+  }
+}
+
+/** A rename must be documentation at both ends; an empty diff is not a docs-only update. */
+export function documentationPath(path) {
+  return typeof path === "string" && !path.split("/").some((part) => part === "..") &&
+    (/^docs\//i.test(path) || /\.md$/i.test(path) || /(?:^|\/)LICENSE$/i.test(path) || /\.(?:png|jpe?g|gif|webp|svg|ico|avif|bmp|tiff?)$/i.test(path))
+}
+
+export function docsOnlyFiles(files) {
+  return Array.isArray(files) && files.length > 0 && files.every((file) =>
+    documentationPath(file.filename) && (!file.previous_filename || documentationPath(file.previous_filename)))
+}
+
+/** Select a dated validation record, never a parent guessed from Git history. */
+export function previousValidatedCommit(registry, report, catalog = null) {
+  if (!repositorySlug(report.plugin.repository)) return null
+  const sources = Array.isArray(registry?.sources) ? registry.sources : Object.values(registry?.sources || {})
+  const source = sources.find((entry) => repositorySlug(entry.repo) === repositorySlug(report.plugin.repository))
+  if (!report.validated?.commit) return null
+  const target = report.validated.commit
+  const checkedAt = Date.parse(report.validated.checkedAt)
+  const candidates = [...(Array.isArray(source?.listingValidationHistory) ? source.listingValidationHistory : []), {
+    commit: source?.listingValidatedCommit, validatedAt: source?.listingValidatedAt,
+  }, { commit: report.previousValidated?.commit, validatedAt: report.previousValidated?.checkedAt }]
+  // The catalog also records successful upstream validation before an update
+  // is promoted to the listing. This is validation evidence, not branch HEAD.
+  for (const plugin of Array.isArray(catalog?.plugins) ? catalog.plugins : []) {
+    if (repositorySlug(plugin.repo) === repositorySlug(report.plugin.repository)) {
+      candidates.push({ commit: plugin.upstreamValidatedCommit, validatedAt: plugin.upstreamValidatedAt })
+    }
+  }
+  return candidates.filter((entry) => /^[a-f0-9]{40}$/i.test(entry.commit || "") && entry.commit.toLowerCase() !== target.toLowerCase() &&
+    Number.isFinite(Date.parse(entry.validatedAt)) && Date.parse(entry.validatedAt) <= checkedAt)
+    .sort((a, b) => Date.parse(a.validatedAt) - Date.parse(b.validatedAt)).at(-1)?.commit.toLowerCase() || null
+}
+
+export async function validatedDocumentationDiff({ report, registry, catalog, registryReason = null, compare = compareCommits }) {
+  const previous = previousValidatedCommit(registry, report, catalog)
+  if (!previous) return { previousCommit: null, validatedCommit: report.validated?.commit || null, docsOnly: null, files: null, source: null, reason: registryReason || "previous validated commit unknown in the marketplace registry" }
+  try {
+    const diff = await compare(report.plugin.repository, previous, report.validated.commit)
+    return { previousCommit: previous, validatedCommit: report.validated.commit, docsOnly: docsOnlyFiles(diff.files), files: diff.files.length, source: diff.url, reason: null }
+  } catch (error) {
+    return { previousCommit: previous, validatedCommit: report.validated.commit, docsOnly: null, files: null, source: null, reason: `${error.code || "compare-unavailable"}: ${error.message}` }
+  }
+}

package/tools/marketplace/submit.mjs

@@ -23,6 +23,7 @@ import { renderIssue, verifyAgainstOfficialParser } from "./issue.mjs"
 import { defaultBranchHead } from "./github.mjs"
 import { REFRESH_ACTION } from "./watch.mjs"
 import { omakitCacheDir } from "./paths.mjs"
+import { openIssuesForRepository, reviewCostVerdict, reviewPolicy } from "./review-cost.mjs"
 
 /**
  * One arrow per cause, in this order, so a person fixes the thing that is
@@ -135,6 +136,7 @@ export function reproduceCommand({ target, category, tags, pluginName, notes, su
  * @param {{ repoRoot: string, target: string, category?: string, tags?: string|string[],
  *           notes?: string, suggestedTag?: string, pluginName?: string,
  *           allowDirty?: boolean, offline?: boolean,
+ *           github?: object,
  *           readRegistry?: typeof liveRegistry,
  *           chooser?: (question: { contract: object, defaults: object, missing: string[] }) => Promise<{ category?: string, tags?: string[] }> }} options
  *   `readRegistry` is injectable for tests; the default reads the marketplace's
@@ -404,7 +406,7 @@ export async function submitPreflight(options) {
   if (!options.offline && subject.repository.url) {
     phase("reading the repository's default-branch HEAD")
     try {
-      head = await defaultBranchHead(subject.repository.url)
+      head = await (options.github?.defaultBranchHead || defaultBranchHead)(subject.repository.url)
     } catch (error) {
       headError = { code: error.code || "head-unreadable", message: error.message }
     }
@@ -412,9 +414,14 @@ export async function submitPreflight(options) {
   const validationMatches = head ? head.commit === subject.commit.toLowerCase() : null
   checks.push(check("submission.validation-commit", {
     source: "omakit",
-    why: "The marketplace validates the default-branch HEAD it resolves when the issue is opened or edited, not the commit checked here. 73% of the 464 submissions parked in the author's court have a HEAD ahead of their validated commit, so a preflight against a commit that is not the pushed HEAD describes a tree nobody will review. Not a marketplace rule; an Omakit refusal to report on the wrong tree.",
+    why: "The marketplace validates the default-branch HEAD it resolves when the issue is opened or edited, not the commit checked here. M6 on 2026-09-15 found 326/519 readable author-fixes comparisons stale (62.8%), with 64 of 583 issues unknown, so a preflight against a commit that is not the pushed HEAD describes a tree nobody will review. Not a marketplace rule; an Omakit refusal to report on the wrong tree.",
     severity: options.offline ? "advisory" : "blocking",
     skipped: options.offline === true,
+    // No origin, no URL to read a HEAD from: the check waits on the one that
+    // says so. Measured on 0.4.1: it failed as a second root cause with
+    // "could not read the default-branch HEAD (unknown): " for a read that
+    // was never attempted.
+    waitedOn: [!options.offline && !subject.repository.url && "submission.repository-url"],
     verdict: validationMatches === true,
     detail: options.offline
       ? `not checked (--offline). Local commit ${subject.commit}.`
@@ -461,6 +468,14 @@ export async function submitPreflight(options) {
         : null,
   }))
 
+  const policy = await reviewPolicy(repoRoot)
+  const review = reviewCostVerdict({ baseline: consequence, policy,
+    openIssues: consequence?.outcome === policy.manual ? await openIssuesForRepository({ repoRoot, repository: subject.repository.url,
+      offline: options.offline === true, github: options.github }) : { count: null, reason: consequence?.outcome === policy.automated ? "open issue count not checked: automated baseline" : preflight.skipReason || preflight.refusal?.message || "baseline outcome needs findings resolved" },
+    why: `MEASUREMENTS.md M4: ${figure(figures.outcomes[policy.manual] || 0)} of ${figure(figures.withBaseline)} recorded listing baselines required review at the pin. M9: on 2026-09-15, 140 of 307 open update issues carried the manual-review label; 4 of 139 compared validated diffs were docs-only, with 1 unavailable. The baseline scans the whole snapshot, not the update diff, so unchanged capabilities also require another review. Sources and exact marketplace HEAD are recorded in MEASUREMENTS.md.`,
+  })
+  checks.push(review.check)
+
   const blocking = checks.filter((entry) => entry.severity === "blocking" && entry.verdict === "fail")
   const advisory = checks.filter((entry) => entry.severity === "advisory" && entry.verdict === "fail")
   const unknown = checks.filter((entry) => entry.verdict === "unknown")
@@ -511,6 +526,7 @@ export async function submitPreflight(options) {
       offline: options.offline === true,
     }),
     checks,
+    reviewCost: review.reviewCost,
     outcome,
     ready,
     listing,

package/tools/marketplace/watch.mjs

@@ -9,19 +9,11 @@
 // compares branch HEADs only for repositories that are already listed. So
 // pushing a fix does nothing, and commenting "fixed in abc123" does nothing.
 //
-// Measured reason (docs/MEASUREMENTS.md M6): of the 464 submissions parked in
-// the author's court, 73% have a default-branch HEAD ahead of the validated
-// commit. 47% pushed after the maintainer's review without the marketplace ever
-// seeing it, and 82% of those authors also commented, so they are engaged and
-// stuck rather than gone. Of 13 open submissions inspected with no labels left,
-// 9 had passed validation and passed the automated security baseline with zero
-// findings and were blocked solely because their validated commit had fallen
-// behind while they waited. 46% of the maintainer's own requests for a fresh validation never
-// produced one; in the parked group 77% never did. The instruction that would
-// fix this appears 22 times in the failure path of
-// `scripts/submission-feedback.mjs` and zero times in the success path of
-// `scripts/validate-submission.mjs`, which is the path 97 of 100 parked
-// submissions took.
+// Measured reason (docs/MEASUREMENTS.md M6), 2026-09-15: 326 of 519 readable
+// author-fixes comparisons were stale (62.8%), with 64 of 583 issues unknown.
+// The original 2026-09-12 research sampled 100 of a 464-issue queue: 68 of
+// 93 readable pairs were stale (73.1%). It did not measure every queue item.
+// Editing the issue body is the action the pinned workflow observes.
 //
 // This command reads. It never edits the issue, never comments, never labels.
 // The action it names is the author's to take.
@@ -30,6 +22,8 @@ import { join } from "node:path"
 import { pathToFileURL } from "node:url"
 import { MARKETPLACE_PIN, requirePin } from "./pin.mjs"
 import { authenticatedUser, repositoryIssues, defaultBranchHead, issue, issueComments, parseIssueUrl, token, GitHubError } from "./github.mjs"
+import { liveRegistry } from "./registry.mjs"
+import { reviewPolicy, validatedDocumentationDiff } from "./review-cost.mjs"
 
 export class WatchError extends Error {
   constructor(code, message) {
@@ -77,8 +71,11 @@ export async function discoverWatchIssues({ user, github = {}, onPhase = () => {
 }
 
 /** A batch keeps independent read failures visible and shares repository HEAD reads. */
-export async function validationWatchAll({ repoRoot, discovery, github = {}, onPhase = () => {} }) {
+export async function validationWatchAll({ repoRoot, discovery, github = {}, readRegistry = liveRegistry, onPhase = () => {} }) {
   if (discovery.issues.length) requirePin(repoRoot)
+  const policy = discovery.issues.length ? await reviewPolicy(repoRoot) : null
+  let registry = null
+  const reviewCostSummary = { pluginUpdates: 0, manualQueue: 0, docsOnly: 0, compared: 0, skipped: [] }
   const heads = new Map()
   const readHead = github.defaultBranchHead || defaultBranchHead
   const shared = { ...github, defaultBranchHead: (url) => {
@@ -102,7 +99,38 @@ export async function validationWatchAll({ repoRoot, discovery, github = {}, onP
   await Promise.all(Array.from({ length: Math.min(4, discovery.issues.length) }, worker))
   const summary = { total: results.length, current: 0, stale: 0, unknown: 0 }
   for (const result of results) summary[result.report?.verdict.state || "unknown"] += 1
-  return { mode: "all", account: discovery.account, marketplace: discovery.marketplace, summary, issues: results }
+  // M9: count labels on the listed issues, then compare only updates in the manual queue.
+  const manual = results.filter((row) => {
+    const labels = row.report?.read.labels || row.issue.labels
+    if (!labels.includes(policy?.updateLabel)) return false
+    reviewCostSummary.pluginUpdates += 1
+    return labels.includes(policy.reviewLabel)
+  })
+  reviewCostSummary.manualQueue = manual.length
+  if (manual.length) {
+    onPhase("reading the previous validated marketplace snapshots")
+    try { registry = await readRegistry({ repoRoot }) } catch (error) { registry = { reason: error.message } }
+  }
+  let compareNext = 0
+  async function compareWorker() {
+    while (compareNext < manual.length) {
+      const row = manual[compareNext++]
+      const diff = row.report
+        ? await validatedDocumentationDiff({ report: row.report, registry: registry?.source === "head" ? registry.registry : null,
+          catalog: registry?.source === "head" ? registry.catalog : null,
+          registryReason: registry?.source === "head" ? null : `previous validated commit unknown: live registry unavailable (${registry?.reason || "unknown"})`, compare: github.compareCommits })
+        : { docsOnly: null, reason: `issue unreadable: ${row.error?.message || "unknown"}` }
+      row.documentationDiff = diff
+      if (diff.docsOnly === null) reviewCostSummary.skipped.push({ issue: row.issue.number, reason: diff.reason })
+      else {
+        reviewCostSummary.compared += 1
+        if (diff.docsOnly) reviewCostSummary.docsOnly += 1
+      }
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(4, manual.length) }, compareWorker))
+  reviewCostSummary.skipped.sort((a, b) => a.issue - b.issue)
+  return { mode: "all", account: discovery.account, marketplace: discovery.marketplace, summary, reviewCostSummary, issues: results }
 }
 
 // The one action that re-runs validation, in the register the marketplace itself
@@ -133,7 +161,7 @@ async function loadVerification(pinDir) {
  * happens to recognise. So each form is read by the parser the marketplace
  * itself uses for it, and the issue says which one it is.
  */
-async function repositoryFor(pinDir, subject) {
+export async function repositoryFor(pinDir, subject) {
   const submission = await loadSubmission(pinDir)
   const verification = await loadVerification(pinDir)
   const title = String(subject.title || "")
@@ -221,11 +249,29 @@ export async function validationWatch({ repoRoot, issueUrl, onPhase, github = {}
     baselineError = { code: error.code || "baseline-unreadable", message: error.message }
   }
   const fallback = validated ? null : validationCommentCommit(comments)
+  let previousValidated = null
+  if (validated) {
+    // Revalidation on an existing issue may precede the latest marker. Ignore
+    // repeated attestations of the same commit, not a different validated tree.
+    for (const comment of [...comments].reverse()) {
+      try {
+        const marker = record.findLatestSecurityBaseline([comment])
+        if (marker && marker.commitSha !== validated.commit && Date.parse(marker.checkedAt) <= Date.parse(validated.checkedAt)) {
+          previousValidated = { commit: marker.commitSha, checkedAt: marker.checkedAt, source: "security-baseline-marker" }
+          break
+        }
+      } catch { /* An incomplete run is not a previously validated commit. */ }
+    }
+  }
 
   const labels = (subject.labels || []).map((label) => (typeof label === "string" ? label : label?.name)).filter(Boolean)
   const authorComments = comments.filter((comment) => comment?.user?.login === subject.user?.login)
+  // The discussion is a person's: the marketplace's own bot and any other
+  // automation (GitHub marks an app's account `type: "Bot"`, and names it
+  // `<app>[bot]`) is neither a reviewer nor the last human review.
+  const isBot = (user) => user?.type === "Bot" || /\[bot\]$/i.test(String(user?.login || ""))
   const maintainerComments = comments.filter(
-    (comment) => comment?.user?.login && comment.user.login !== subject.user?.login && comment.user.login !== "github-actions[bot]",
+    (comment) => comment?.user?.login && comment.user.login !== subject.user?.login && !isBot(comment.user),
   )
 
   let head = null
@@ -267,6 +313,7 @@ export async function validationWatch({ repoRoot, issueUrl, onPhase, github = {}
     },
     plugin: { repository: repositoryUrl, repositoryError, form: issueKind },
     validated,
+    previousValidated,
     validationCommentFallback: fallback,
     baselineError,
     head,

package/tools/weigh/audit.mjs

@@ -331,7 +331,12 @@ async function sampleConfig({ label, runIndex, config, plan, env, procRoot, sign
   onPhase(`run ${runIndex} of ${plan.runs}: ${label}, sampling for ${windowSeconds}s`)
   const started = utc()
   const t0 = Date.now()
-  const cpu0 = cpuTicks(procRoot, pid) ?? 0
+  // A pid with no stat is a process that is gone, and a gone shell has no
+  // sample: nothing is read as zero in its place. Measured on 0.4.1: a pid
+  // absent from /proc "completed" the window with 0 ticks and a Pss of
+  // null read as 0 MB, a delta of minus the whole baseline.
+  const cpu0 = cpuTicks(procRoot, pid)
+  if (cpu0 === null) return { label, run: runIndex, failed: `the shell (pid ${pid}) is not in ${procRoot}` }
   const child0 = childTicks(procRoot, pid) ?? 0
   const rows = []
   const trace = []
@@ -355,7 +360,8 @@ async function sampleConfig({ label, runIndex, config, plan, env, procRoot, sign
   } catch {
     configRewritten = null
   }
-  const cpu1 = cpuTicks(procRoot, pid) ?? cpu0
+  const cpu1 = cpuTicks(procRoot, pid)
+  if (cpu1 === null) return { label, run: runIndex, failed: `the shell (pid ${pid}) disappeared from ${procRoot} during the window` }
   const child1 = childTicks(procRoot, pid) ?? child0
   const memory = { pssKb: pssKb(procRoot, pid), rssKb: rssKb(procRoot, pid), memoryAt: "window-end", ...settled, trace }
   const seconds = (t1 - t0) / 1000
@@ -605,6 +611,13 @@ export async function measureWeigh(plan, { env = plan.env || process.env, procRo
   let restore = null
   let restoreProblem = null
   let comeBack = null
+  // What stopped the measurement early, an interrupt or a thrown error, is
+  // kept so the restore's outcome can be judged first: a restore that failed
+  // or did not verify is the fact the person is left with, and it is what
+  // is reported, with the stop as its context. Measured on 0.4.1: an
+  // interrupt propagated past a restore whose md5 differed, and the entry
+  // point closed with "shell.json was restored".
+  let stopped = null
   try {
     for (let runIndex = 1; runIndex <= plan.runs; runIndex += 1) {
       for (const { label, config } of configs) {
@@ -619,6 +632,8 @@ export async function measureWeigh(plan, { env = plan.env || process.env, procRo
         samples.push(sample)
       }
     }
+  } catch (error) {
+    stopped = error
   } finally {
     onPhase("restoring shell.json and restarting the shell")
     try {
@@ -642,7 +657,10 @@ export async function measureWeigh(plan, { env = plan.env || process.env, procRo
       onLine({ state: "fail", text: `the restore failed: ${error.message}; the backup is ${backup.backupFile}` })
     }
   }
-  if (restoreProblem) throw new WeighError("restore-failed", `shell.json could not be restored from ${backup.backupFile}: ${restoreProblem.message}`, `Copy ${backup.backupFile} over ${plan.configFile} yourself, then run omarchy-restart-shell.`)
+  const because = stopped ? `. The measurement had stopped first: ${stopped.message}` : ""
+  if (restoreProblem) throw new WeighError("restore-failed", `shell.json could not be restored from ${backup.backupFile}: ${restoreProblem.message}${because}`, `Copy ${backup.backupFile} over ${plan.configFile} yourself, then run omarchy-restart-shell.`)
+  if (stopped && !restore.restored) throw new WeighError("restore-unverified", `shell.json differs from the backup after the restore; the backup ${backup.backupFile} is kept${because}`, `Compare ${backup.backupFile} with ${plan.configFile} and copy it over if the difference is not yours.`)
+  if (stopped) throw stopped
   const ended = utc()
   const config = {
     path: plan.configFile,