omakit 0.4.1 → 0.4.3

package/tools/marketplace/pin.mjs

@@ -9,7 +9,7 @@
 // whole list, and tests/unit/pin.test.mjs fails if any module starts reading a
 // path outside it, because on a partial clone such a read would quietly reach
 // for the network instead of failing.
-import { execFileSync } from "node:child_process"
+import { execFileSync, spawnSync } from "node:child_process"
 import { existsSync, mkdirSync, writeFileSync } from "node:fs"
 import { dirname, join, resolve } from "node:path"
 import { omakitCacheDir } from "./paths.mjs"
@@ -178,18 +178,26 @@ export function ensurePin(repoRoot, log = () => {}, env = process.env) {
   return { dir, identity, fetched: true }
 }
 
-/** Human-readable size of the pinned checkout, for `omakit pin` and `omakit doctor`. */
-export function pinDiskUsage(dir) {
+/**
+ * Human-readable size of the pinned checkout, for `omakit pin` and `omakit
+ * doctor`. `env` is the environment `du` is found in; injectable for tests.
+ */
+export function pinDiskUsage(dir, env = process.env) {
   // -H follows a symlink given on the command line (POSIX; GNU's -D). Measured
   // without it: a checkout reached through a symlink reported 0.0 MB, the size
   // of the link, while the directory behind it was 15 MB.
-  try {
-    const output = execFileSync("du", ["-skH", dir], { encoding: "utf8" }).split(/\s+/)[0]
-    const mib = Number(output) / 1024
-    return `${mib < 10 ? mib.toFixed(1) : Math.round(mib)} MB on disk`
-  } catch {
-    return "size unknown"
-  }
+  //
+  // The total is read whether or not du exited 0. du exits 1 when a file it
+  // listed is gone by the time it reaches it, and still prints the total.
+  // Measured: with `git status` running on the pin in parallel, 1 of 40 runs
+  // warned "cannot access '.git/index.lock'" over its momentary lock file
+  // and exited 1, so doctor said "size unknown" for a checkout it had the
+  // size of. Only a run that printed no total is unknown.
+  const result = spawnSync("du", ["-skH", dir], { encoding: "utf8", env, stdio: ["ignore", "pipe", "ignore"] })
+  const output = String(result.stdout || "").trim().split(/\s+/)[0]
+  if (result.error || !/^\d+$/.test(output)) return "size unknown"
+  const mib = Number(output) / 1024
+  return `${mib < 10 ? mib.toFixed(1) : Math.round(mib)} MB on disk`
 }
 
 /** True when the checkout was fetched with only PIN_PATHS, as a fresh one is. */

package/tools/marketplace/report.mjs

@@ -266,12 +266,19 @@ export function renderWatchList(result, { colour = colourEnabled() } = {}) {
 /** Compact batch report; exact commits and full discussion remain in JSON. */
 export function renderWatchAll(result, { colour = colourEnabled() } = {}) {
   const c = styler(colour)
-  const out = [...field("account", result.account, c), ...field("issues", `${result.summary.total} checked; ${result.summary.current} current, ${result.summary.stale} stale, ${result.summary.unknown} unknown`, c), ""]
+  const out = [...field("account", result.account, c), ...field("issues", `${result.summary.total} checked; ${result.summary.current} current, ${result.summary.stale} stale, ${result.summary.unknown} unknown`, c)]
+  if (result.reviewCostSummary) {
+    const cost = result.reviewCostSummary
+    const skipped = cost.skipped.length ? `; ${cost.skipped.length} diff(s) skipped (reasons on issue rows)` : ""
+    out.push(...field("review cost", `${cost.manualQueue} of ${cost.pluginUpdates} plugin-update issue(s) on security-review-required; ${cost.docsOnly} docs-only validated diff(s) of ${cost.compared} compared${skipped}`, c))
+  }
+  out.push("")
   for (const row of result.issues) {
     const state = row.report?.verdict.state || "unknown"
     const style = { current: "pass", stale: "fail", unknown: "unknown" }[state]
     out.push(...verdict(style, state.toUpperCase(), `#${row.issue.number} ${watchIssueTitle(row.report?.read.title || row.issue.title)}`, c))
     out.push(...field("issue", row.issue.url, c, { wrapValue: false }))
+    if (row.documentationDiff?.docsOnly === null) out.push(...field("diff skipped", watchIssueTitle(row.documentationDiff.reason), c))
     if (row.error) {
       out.push(...field("read error", watchIssueTitle(`${row.error.code}: ${row.error.message}`), c))
     } else {

package/tools/marketplace/review-cost.mjs

@@ -0,0 +1,107 @@
+// Review cost is advice, never a marketplace rule. Evidence: MEASUREMENTS.md M4 and M9.
+import { readFileSync } from "node:fs"
+import { join } from "node:path"
+import { pathToFileURL } from "node:url"
+import { requirePin } from "./pin.mjs"
+import { token, issue, parseIssueUrl, compareCommits } from "./github.mjs"
+import { discoverWatchIssues, repositoryFor } from "./watch.mjs"
+import { repositorySlug } from "./registry.mjs"
+
+/** Outcome and update label names come from the pin, rather than a second policy. */
+export async function reviewPolicy(repoRoot) {
+  const { dir } = requirePin(repoRoot)
+  const policy = await import(pathToFileURL(join(dir, "scripts/security-baseline-policy.mjs")).href)
+  const approval = readFileSync(join(dir, "scripts/approve-plugin-update.mjs"), "utf8")
+  const updateLabel = approval.match(/for \(const required of \["([^"]+)"/)?.[1]
+  if (!updateLabel) throw new Error("cannot read the update issue label from the pin")
+  const manual = policy.currentSecurityBaselinePolicy.maintainerVerificationOutcome
+  return { automated: policy.securityBaselineOutcome([], []), manual, updateLabel, reviewLabel: `security-${manual}` }
+}
+
+/** The same discovery as watch --all; no credential or incomplete reads are not zero issues. */
+export async function openIssuesForRepository({ repoRoot, repository, offline = false, github = {} }) {
+  if (offline) return { count: null, reason: "not checked (--offline)" }
+  if (!(github.token || token)()) return { count: null, reason: "not checked: no GitHub credential" }
+  try {
+    const discovery = await discoverWatchIssues({ github })
+    const { dir } = requirePin(repoRoot)
+    let count = 0
+    let next = 0
+    async function worker() {
+      while (next < discovery.issues.length) {
+        const target = parseIssueUrl(discovery.issues[next++].url)
+        const subject = await (github.issue || issue)(target.owner, target.repository, target.number)
+        const parsed = await repositoryFor(dir, subject)
+        if (!parsed.url) throw new Error(`repository unknown on issue #${target.number}: ${parsed.error}`)
+        if (repositorySlug(parsed.url) === repositorySlug(repository)) count += 1
+      }
+    }
+    await Promise.all(Array.from({ length: Math.min(4, discovery.issues.length) }, worker))
+    return { count, reason: `watch --all discovery: ${count} open issue(s) for this repository` }
+  } catch (error) {
+    return { count: null, reason: `not checked (${error.code || "issue-discovery-unavailable"}): ${error.message}` }
+  }
+}
+
+export function reviewCostVerdict({ baseline, policy, openIssues = { count: null, reason: "not checked" }, why }) {
+  const capabilities = [...(baseline?.capabilities || [])]
+  const manual = baseline?.outcome === policy.manual
+  const automated = baseline?.outcome === policy.automated
+  const outcome = manual ? openIssues.count > 0 ? "manual queue, again" : "manual queue" : automated ? "automated" : null
+  const detail = manual
+    ? `${outcome}: capabilities ${capabilities.join(", ") || "none"}. Every update of this plugin, including a docs-only one, lands in the manual queue.${openIssues.count > 0 ? ` You already have ${openIssues.count} open issue(s) for this repository.` : ""}`
+    : automated ? "automated: this update will not need a human for the security baseline." : "not checked: baseline.preflight has no passed or review-required outcome"
+  return {
+    reviewCost: { outcome, capabilities, openIssuesForRepository: openIssues.count, reason: `${detail} ${openIssues.reason}` },
+    check: {
+      id: "review.cost", source: "omakit", severity: "advisory", verdict: manual ? "fail" : automated ? "pass" : "unknown",
+      why, detail, paths: [],
+      remedy: manual && openIssues.count > 0 ? "consider batching: close or fold the open one before opening another" : null,
+    },
+  }
+}
+
+/** A rename must be documentation at both ends; an empty diff is not a docs-only update. */
+export function documentationPath(path) {
+  return typeof path === "string" && !path.split("/").some((part) => part === "..") &&
+    (/^docs\//i.test(path) || /\.md$/i.test(path) || /(?:^|\/)LICENSE$/i.test(path) || /\.(?:png|jpe?g|gif|webp|svg|ico|avif|bmp|tiff?)$/i.test(path))
+}
+
+export function docsOnlyFiles(files) {
+  return Array.isArray(files) && files.length > 0 && files.every((file) =>
+    documentationPath(file.filename) && (!file.previous_filename || documentationPath(file.previous_filename)))
+}
+
+/** Select a dated validation record, never a parent guessed from Git history. */
+export function previousValidatedCommit(registry, report, catalog = null) {
+  if (!repositorySlug(report.plugin.repository)) return null
+  const sources = Array.isArray(registry?.sources) ? registry.sources : Object.values(registry?.sources || {})
+  const source = sources.find((entry) => repositorySlug(entry.repo) === repositorySlug(report.plugin.repository))
+  if (!report.validated?.commit) return null
+  const target = report.validated.commit
+  const checkedAt = Date.parse(report.validated.checkedAt)
+  const candidates = [...(Array.isArray(source?.listingValidationHistory) ? source.listingValidationHistory : []), {
+    commit: source?.listingValidatedCommit, validatedAt: source?.listingValidatedAt,
+  }, { commit: report.previousValidated?.commit, validatedAt: report.previousValidated?.checkedAt }]
+  // The catalog also records successful upstream validation before an update
+  // is promoted to the listing. This is validation evidence, not branch HEAD.
+  for (const plugin of Array.isArray(catalog?.plugins) ? catalog.plugins : []) {
+    if (repositorySlug(plugin.repo) === repositorySlug(report.plugin.repository)) {
+      candidates.push({ commit: plugin.upstreamValidatedCommit, validatedAt: plugin.upstreamValidatedAt })
+    }
+  }
+  return candidates.filter((entry) => /^[a-f0-9]{40}$/i.test(entry.commit || "") && entry.commit.toLowerCase() !== target.toLowerCase() &&
+    Number.isFinite(Date.parse(entry.validatedAt)) && Date.parse(entry.validatedAt) <= checkedAt)
+    .sort((a, b) => Date.parse(a.validatedAt) - Date.parse(b.validatedAt)).at(-1)?.commit.toLowerCase() || null
+}
+
+export async function validatedDocumentationDiff({ report, registry, catalog, registryReason = null, compare = compareCommits }) {
+  const previous = previousValidatedCommit(registry, report, catalog)
+  if (!previous) return { previousCommit: null, validatedCommit: report.validated?.commit || null, docsOnly: null, files: null, source: null, reason: registryReason || "previous validated commit unknown in the marketplace registry" }
+  try {
+    const diff = await compare(report.plugin.repository, previous, report.validated.commit)
+    return { previousCommit: previous, validatedCommit: report.validated.commit, docsOnly: docsOnlyFiles(diff.files), files: diff.files.length, source: diff.url, reason: null }
+  } catch (error) {
+    return { previousCommit: previous, validatedCommit: report.validated.commit, docsOnly: null, files: null, source: null, reason: `${error.code || "compare-unavailable"}: ${error.message}` }
+  }
+}

package/tools/marketplace/run-baseline.mjs

@@ -18,7 +18,7 @@ async function loadScanner(pinDir) {
 
 /**
  * @param {{ repoRoot: string, repoUrl: string, commitSha: string, transport: "local"|"github",
- *           repoDir?: string, listedPlugins?: Array, token?: string }} options
+ *           repoDir?: string, repoSubdir?: string, listedPlugins?: Array, token?: string }} options
  */
 export async function runBaseline(options) {
   const { dir: pinDir, identity } = requirePin(options.repoRoot)
@@ -34,6 +34,7 @@ export async function runBaseline(options) {
       repoDir: options.repoDir,
       repoUrl: options.repoUrl,
       commitSha: options.commitSha,
+      subdir: options.repoSubdir || "",
     })
     scanOptions.fetchImpl = transport.fetchImpl
     adapter = {

package/tools/marketplace/style.mjs

@@ -220,6 +220,9 @@ export const AUDIT_VERDICTS = Object.freeze({
   unavailable: "NOT AUDITED",
 })
 
+/** The closing word of `omakit inspect`: a report was produced, and it decided nothing. */
+export const INSPECT_VERDICT = "INSPECTED"
+
 /** The width of the widest mark, "█ FAIL"; every mark is padded to it so the names beside them align. */
 export const MARK_WIDTH = Math.max(...Object.values(STATUS).map((s) => `${s.glyph} ${s.word}`.length))
 

package/tools/marketplace/submit.mjs

@@ -23,6 +23,7 @@ import { renderIssue, verifyAgainstOfficialParser } from "./issue.mjs"
 import { defaultBranchHead } from "./github.mjs"
 import { REFRESH_ACTION } from "./watch.mjs"
 import { omakitCacheDir } from "./paths.mjs"
+import { openIssuesForRepository, reviewCostVerdict, reviewPolicy } from "./review-cost.mjs"
 
 /**
  * One arrow per cause, in this order, so a person fixes the thing that is
@@ -135,6 +136,7 @@ export function reproduceCommand({ target, category, tags, pluginName, notes, su
  * @param {{ repoRoot: string, target: string, category?: string, tags?: string|string[],
  *           notes?: string, suggestedTag?: string, pluginName?: string,
  *           allowDirty?: boolean, offline?: boolean,
+ *           github?: object,
  *           readRegistry?: typeof liveRegistry,
  *           chooser?: (question: { contract: object, defaults: object, missing: string[] }) => Promise<{ category?: string, tags?: string[] }> }} options
  *   `readRegistry` is injectable for tests; the default reads the marketplace's
@@ -404,7 +406,7 @@ export async function submitPreflight(options) {
   if (!options.offline && subject.repository.url) {
     phase("reading the repository's default-branch HEAD")
     try {
-      head = await defaultBranchHead(subject.repository.url)
+      head = await (options.github?.defaultBranchHead || defaultBranchHead)(subject.repository.url)
     } catch (error) {
       headError = { code: error.code || "head-unreadable", message: error.message }
     }
@@ -412,9 +414,14 @@ export async function submitPreflight(options) {
   const validationMatches = head ? head.commit === subject.commit.toLowerCase() : null
   checks.push(check("submission.validation-commit", {
     source: "omakit",
-    why: "The marketplace validates the default-branch HEAD it resolves when the issue is opened or edited, not the commit checked here. 73% of the 464 submissions parked in the author's court have a HEAD ahead of their validated commit, so a preflight against a commit that is not the pushed HEAD describes a tree nobody will review. Not a marketplace rule; an Omakit refusal to report on the wrong tree.",
+    why: "The marketplace validates the default-branch HEAD it resolves when the issue is opened or edited, not the commit checked here. M6 on 2026-09-15 found 326/519 readable author-fixes comparisons stale (62.8%), with 64 of 583 issues unknown, so a preflight against a commit that is not the pushed HEAD describes a tree nobody will review. Not a marketplace rule; an Omakit refusal to report on the wrong tree.",
     severity: options.offline ? "advisory" : "blocking",
     skipped: options.offline === true,
+    // No origin, no URL to read a HEAD from: the check waits on the one that
+    // says so. Measured on 0.4.1: it failed as a second root cause with
+    // "could not read the default-branch HEAD (unknown): " for a read that
+    // was never attempted.
+    waitedOn: [!options.offline && !subject.repository.url && "submission.repository-url"],
     verdict: validationMatches === true,
     detail: options.offline
       ? `not checked (--offline). Local commit ${subject.commit}.`
@@ -461,6 +468,14 @@ export async function submitPreflight(options) {
         : null,
   }))
 
+  const policy = await reviewPolicy(repoRoot)
+  const review = reviewCostVerdict({ baseline: consequence, policy,
+    openIssues: consequence?.outcome === policy.manual ? await openIssuesForRepository({ repoRoot, repository: subject.repository.url,
+      offline: options.offline === true, github: options.github }) : { count: null, reason: consequence?.outcome === policy.automated ? "open issue count not checked: automated baseline" : preflight.skipReason || preflight.refusal?.message || "baseline outcome needs findings resolved" },
+    why: `MEASUREMENTS.md M4: ${figure(figures.outcomes[policy.manual] || 0)} of ${figure(figures.withBaseline)} recorded listing baselines required review at the pin. M9: on 2026-09-15, 140 of 307 open update issues carried the manual-review label; 4 of 139 compared validated diffs were docs-only, with 1 unavailable. The baseline scans the whole snapshot, not the update diff, so unchanged capabilities also require another review. Sources and exact marketplace HEAD are recorded in MEASUREMENTS.md.`,
+  })
+  checks.push(review.check)
+
   const blocking = checks.filter((entry) => entry.severity === "blocking" && entry.verdict === "fail")
   const advisory = checks.filter((entry) => entry.severity === "advisory" && entry.verdict === "fail")
   const unknown = checks.filter((entry) => entry.verdict === "unknown")
@@ -511,6 +526,7 @@ export async function submitPreflight(options) {
       offline: options.offline === true,
     }),
     checks,
+    reviewCost: review.reviewCost,
     outcome,
     ready,
     listing,

package/tools/marketplace/usage.mjs

@@ -91,6 +91,27 @@ export const COMMANDS = Object.freeze([
       "prints the document itself, and --out writes it to a file.",
     ],
   },
+  {
+    signature: [
+      "omakit inspect <target> [--full] [--json] [--out <file>] [--offline]",
+      "                        [--allow-dirty]",
+    ],
+    lines: [
+      "What a plugin tree does, as observations: every process with its argv,",
+      "every host with its timeout and size-cap flags, every write with whether",
+      "it falls under a directory the plugin controls, every timer with its",
+      "interval, and the capabilities the marketplace baseline records. Below",
+      "the facts, the review classes the marketplace's human review raised,",
+      "each with its measured share, only where the tree shows the class.",
+      "Regular expressions over QML and shell, labelled observed; runs nothing",
+      "from the tree, decides nothing, exits 0 with a report and 2 when the",
+      "target cannot be read. The report opens with a size score, 10 minus",
+      "the mean rank of the tree's functions among those in listed trees,",
+      "then what needs attention: functions over the measured size, longest",
+      "first, then the review classes by measured share, five sites each;",
+      "--full is every site with every qualifier; --json prints the document.",
+    ],
+  },
   {
     signature: "omakit help --agent",
     lines: [

package/tools/marketplace/verify.mjs

@@ -6,15 +6,25 @@ import { runBaseline } from "./run-baseline.mjs"
 import { MARKETPLACE_PIN } from "./pin.mjs"
 import { ASSUMED_BY_ADAPTER } from "./local-transport.mjs"
 
+/** The one assumption a subtree scan adds: the tree the official code saw is the plugin directory, not the repository root. */
+function subtreeAssumption(subdir) {
+  return subdir ? [`tree.root=${subdir.replace(/\/+$/, "")}/ (the plugin directory below the repository root, not the root)`] : []
+}
+
 const MARKETPLACE_STATEMENT =
   "Official baseline preview over a local snapshot. The marketplace rescans the public commit itself. This is not approval, listing, verification or a security audit."
 
 /**
- * @param {{ repoRoot: string, subject: { dir: string, commit: string, repository: { url: string|null } }, listedPlugins?: Array }} options
+ * @param {{ repoRoot: string, subject: { dir: string, commit: string, repository: { url: string|null } }, listedPlugins?: Array, subdir?: string }} options
+ *   `subdir`, when given, is a directory below the repository root that the
+ *   local transport serves as the whole tree, so the official code scans the
+ *   plugin's directory and not the repository around it; the section records
+ *   it under `assumedByAdapter`. `verify` and `submit` pass none and scan the
+ *   root, which for them is the repository the marketplace would fetch.
  * @returns the `marketplaceBaseline` section: pin, transport, adapter
  *   assumptions, the official result verbatim, and the statement.
  */
-export async function marketplaceBaselineSection({ repoRoot, subject, listedPlugins }) {
+export async function marketplaceBaselineSection({ repoRoot, subject, listedPlugins, subdir = "" }) {
   const pin = {
     repository: MARKETPLACE_PIN.repository,
     commit: MARKETPLACE_PIN.commit,
@@ -40,6 +50,7 @@ export async function marketplaceBaselineSection({ repoRoot, subject, listedPlug
       commitSha: subject.commit,
       transport: "local",
       repoDir: subject.dir,
+      repoSubdir: subdir,
       listedPlugins,
     })
   } catch (error) {
@@ -49,7 +60,7 @@ export async function marketplaceBaselineSection({ repoRoot, subject, listedPlug
       return {
         pin,
         transport: "local-git",
-        assumedByAdapter: [...ASSUMED_BY_ADAPTER],
+        assumedByAdapter: [...ASSUMED_BY_ADAPTER, ...subtreeAssumption(subdir)],
         invoked: true,
         skipReason: null,
         official: { error: { code: error.code, message: error.message, ...(error.details || {}) } },
@@ -61,7 +72,7 @@ export async function marketplaceBaselineSection({ repoRoot, subject, listedPlug
   return {
     pin: { ...pin, commit: run.pin.commit, baselineVersion: run.pin.baselineVersion, enforcementMode: run.pin.enforcementMode },
     transport: "local-git",
-    assumedByAdapter: [...run.adapter.assumedByAdapter],
+    assumedByAdapter: [...run.adapter.assumedByAdapter, ...subtreeAssumption(subdir)],
     invoked: true,
     skipReason: null,
     official: run.result,

package/tools/marketplace/watch.mjs

@@ -9,19 +9,11 @@
 // compares branch HEADs only for repositories that are already listed. So
 // pushing a fix does nothing, and commenting "fixed in abc123" does nothing.
 //
-// Measured reason (docs/MEASUREMENTS.md M6): of the 464 submissions parked in
-// the author's court, 73% have a default-branch HEAD ahead of the validated
-// commit. 47% pushed after the maintainer's review without the marketplace ever
-// seeing it, and 82% of those authors also commented, so they are engaged and
-// stuck rather than gone. Of 13 open submissions inspected with no labels left,
-// 9 had passed validation and passed the automated security baseline with zero
-// findings and were blocked solely because their validated commit had fallen
-// behind while they waited. 46% of the maintainer's own requests for a fresh validation never
-// produced one; in the parked group 77% never did. The instruction that would
-// fix this appears 22 times in the failure path of
-// `scripts/submission-feedback.mjs` and zero times in the success path of
-// `scripts/validate-submission.mjs`, which is the path 97 of 100 parked
-// submissions took.
+// Measured reason (docs/MEASUREMENTS.md M6), 2026-09-15: 326 of 519 readable
+// author-fixes comparisons were stale (62.8%), with 64 of 583 issues unknown.
+// The original 2026-09-12 research sampled 100 of a 464-issue queue: 68 of
+// 93 readable pairs were stale (73.1%). It did not measure every queue item.
+// Editing the issue body is the action the pinned workflow observes.
 //
 // This command reads. It never edits the issue, never comments, never labels.
 // The action it names is the author's to take.
@@ -30,6 +22,8 @@ import { join } from "node:path"
 import { pathToFileURL } from "node:url"
 import { MARKETPLACE_PIN, requirePin } from "./pin.mjs"
 import { authenticatedUser, repositoryIssues, defaultBranchHead, issue, issueComments, parseIssueUrl, token, GitHubError } from "./github.mjs"
+import { liveRegistry } from "./registry.mjs"
+import { reviewPolicy, validatedDocumentationDiff } from "./review-cost.mjs"
 
 export class WatchError extends Error {
   constructor(code, message) {
@@ -77,8 +71,11 @@ export async function discoverWatchIssues({ user, github = {}, onPhase = () => {
 }
 
 /** A batch keeps independent read failures visible and shares repository HEAD reads. */
-export async function validationWatchAll({ repoRoot, discovery, github = {}, onPhase = () => {} }) {
+export async function validationWatchAll({ repoRoot, discovery, github = {}, readRegistry = liveRegistry, onPhase = () => {} }) {
   if (discovery.issues.length) requirePin(repoRoot)
+  const policy = discovery.issues.length ? await reviewPolicy(repoRoot) : null
+  let registry = null
+  const reviewCostSummary = { pluginUpdates: 0, manualQueue: 0, docsOnly: 0, compared: 0, skipped: [] }
   const heads = new Map()
   const readHead = github.defaultBranchHead || defaultBranchHead
   const shared = { ...github, defaultBranchHead: (url) => {
@@ -102,7 +99,38 @@ export async function validationWatchAll({ repoRoot, discovery, github = {}, onP
   await Promise.all(Array.from({ length: Math.min(4, discovery.issues.length) }, worker))
   const summary = { total: results.length, current: 0, stale: 0, unknown: 0 }
   for (const result of results) summary[result.report?.verdict.state || "unknown"] += 1
-  return { mode: "all", account: discovery.account, marketplace: discovery.marketplace, summary, issues: results }
+  // M9: count labels on the listed issues, then compare only updates in the manual queue.
+  const manual = results.filter((row) => {
+    const labels = row.report?.read.labels || row.issue.labels
+    if (!labels.includes(policy?.updateLabel)) return false
+    reviewCostSummary.pluginUpdates += 1
+    return labels.includes(policy.reviewLabel)
+  })
+  reviewCostSummary.manualQueue = manual.length
+  if (manual.length) {
+    onPhase("reading the previous validated marketplace snapshots")
+    try { registry = await readRegistry({ repoRoot }) } catch (error) { registry = { reason: error.message } }
+  }
+  let compareNext = 0
+  async function compareWorker() {
+    while (compareNext < manual.length) {
+      const row = manual[compareNext++]
+      const diff = row.report
+        ? await validatedDocumentationDiff({ report: row.report, registry: registry?.source === "head" ? registry.registry : null,
+          catalog: registry?.source === "head" ? registry.catalog : null,
+          registryReason: registry?.source === "head" ? null : `previous validated commit unknown: live registry unavailable (${registry?.reason || "unknown"})`, compare: github.compareCommits })
+        : { docsOnly: null, reason: `issue unreadable: ${row.error?.message || "unknown"}` }
+      row.documentationDiff = diff
+      if (diff.docsOnly === null) reviewCostSummary.skipped.push({ issue: row.issue.number, reason: diff.reason })
+      else {
+        reviewCostSummary.compared += 1
+        if (diff.docsOnly) reviewCostSummary.docsOnly += 1
+      }
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(4, manual.length) }, compareWorker))
+  reviewCostSummary.skipped.sort((a, b) => a.issue - b.issue)
+  return { mode: "all", account: discovery.account, marketplace: discovery.marketplace, summary, reviewCostSummary, issues: results }
 }
 
 // The one action that re-runs validation, in the register the marketplace itself
@@ -133,7 +161,7 @@ async function loadVerification(pinDir) {
  * happens to recognise. So each form is read by the parser the marketplace
  * itself uses for it, and the issue says which one it is.
  */
-async function repositoryFor(pinDir, subject) {
+export async function repositoryFor(pinDir, subject) {
   const submission = await loadSubmission(pinDir)
   const verification = await loadVerification(pinDir)
   const title = String(subject.title || "")
@@ -221,11 +249,29 @@ export async function validationWatch({ repoRoot, issueUrl, onPhase, github = {}
     baselineError = { code: error.code || "baseline-unreadable", message: error.message }
   }
   const fallback = validated ? null : validationCommentCommit(comments)
+  let previousValidated = null
+  if (validated) {
+    // Revalidation on an existing issue may precede the latest marker. Ignore
+    // repeated attestations of the same commit, not a different validated tree.
+    for (const comment of [...comments].reverse()) {
+      try {
+        const marker = record.findLatestSecurityBaseline([comment])
+        if (marker && marker.commitSha !== validated.commit && Date.parse(marker.checkedAt) <= Date.parse(validated.checkedAt)) {
+          previousValidated = { commit: marker.commitSha, checkedAt: marker.checkedAt, source: "security-baseline-marker" }
+          break
+        }
+      } catch { /* An incomplete run is not a previously validated commit. */ }
+    }
+  }
 
   const labels = (subject.labels || []).map((label) => (typeof label === "string" ? label : label?.name)).filter(Boolean)
   const authorComments = comments.filter((comment) => comment?.user?.login === subject.user?.login)
+  // The discussion is a person's: the marketplace's own bot and any other
+  // automation (GitHub marks an app's account `type: "Bot"`, and names it
+  // `<app>[bot]`) is neither a reviewer nor the last human review.
+  const isBot = (user) => user?.type === "Bot" || /\[bot\]$/i.test(String(user?.login || ""))
   const maintainerComments = comments.filter(
-    (comment) => comment?.user?.login && comment.user.login !== subject.user?.login && comment.user.login !== "github-actions[bot]",
+    (comment) => comment?.user?.login && comment.user.login !== subject.user?.login && !isBot(comment.user),
   )
 
   let head = null
@@ -267,6 +313,7 @@ export async function validationWatch({ repoRoot, issueUrl, onPhase, github = {}
     },
     plugin: { repository: repositoryUrl, repositoryError, form: issueKind },
     validated,
+    previousValidated,
     validationCommentFallback: fallback,
     baselineError,
     head,

package/tools/weigh/audit.mjs

@@ -331,7 +331,12 @@ async function sampleConfig({ label, runIndex, config, plan, env, procRoot, sign
   onPhase(`run ${runIndex} of ${plan.runs}: ${label}, sampling for ${windowSeconds}s`)
   const started = utc()
   const t0 = Date.now()
-  const cpu0 = cpuTicks(procRoot, pid) ?? 0
+  // A pid with no stat is a process that is gone, and a gone shell has no
+  // sample: nothing is read as zero in its place. Measured on 0.4.1: a pid
+  // absent from /proc "completed" the window with 0 ticks and a Pss of
+  // null read as 0 MB, a delta of minus the whole baseline.
+  const cpu0 = cpuTicks(procRoot, pid)
+  if (cpu0 === null) return { label, run: runIndex, failed: `the shell (pid ${pid}) is not in ${procRoot}` }
   const child0 = childTicks(procRoot, pid) ?? 0
   const rows = []
   const trace = []
@@ -355,7 +360,8 @@ async function sampleConfig({ label, runIndex, config, plan, env, procRoot, sign
   } catch {
     configRewritten = null
   }
-  const cpu1 = cpuTicks(procRoot, pid) ?? cpu0
+  const cpu1 = cpuTicks(procRoot, pid)
+  if (cpu1 === null) return { label, run: runIndex, failed: `the shell (pid ${pid}) disappeared from ${procRoot} during the window` }
   const child1 = childTicks(procRoot, pid) ?? child0
   const memory = { pssKb: pssKb(procRoot, pid), rssKb: rssKb(procRoot, pid), memoryAt: "window-end", ...settled, trace }
   const seconds = (t1 - t0) / 1000
@@ -605,6 +611,13 @@ export async function measureWeigh(plan, { env = plan.env || process.env, procRo
   let restore = null
   let restoreProblem = null
   let comeBack = null
+  // What stopped the measurement early, an interrupt or a thrown error, is
+  // kept so the restore's outcome can be judged first: a restore that failed
+  // or did not verify is the fact the person is left with, and it is what
+  // is reported, with the stop as its context. Measured on 0.4.1: an
+  // interrupt propagated past a restore whose md5 differed, and the entry
+  // point closed with "shell.json was restored".
+  let stopped = null
   try {
     for (let runIndex = 1; runIndex <= plan.runs; runIndex += 1) {
       for (const { label, config } of configs) {
@@ -619,6 +632,8 @@ export async function measureWeigh(plan, { env = plan.env || process.env, procRo
         samples.push(sample)
       }
     }
+  } catch (error) {
+    stopped = error
   } finally {
     onPhase("restoring shell.json and restarting the shell")
     try {
@@ -642,7 +657,10 @@ export async function measureWeigh(plan, { env = plan.env || process.env, procRo
       onLine({ state: "fail", text: `the restore failed: ${error.message}; the backup is ${backup.backupFile}` })
     }
   }
-  if (restoreProblem) throw new WeighError("restore-failed", `shell.json could not be restored from ${backup.backupFile}: ${restoreProblem.message}`, `Copy ${backup.backupFile} over ${plan.configFile} yourself, then run omarchy-restart-shell.`)
+  const because = stopped ? `. The measurement had stopped first: ${stopped.message}` : ""
+  if (restoreProblem) throw new WeighError("restore-failed", `shell.json could not be restored from ${backup.backupFile}: ${restoreProblem.message}${because}`, `Copy ${backup.backupFile} over ${plan.configFile} yourself, then run omarchy-restart-shell.`)
+  if (stopped && !restore.restored) throw new WeighError("restore-unverified", `shell.json differs from the backup after the restore; the backup ${backup.backupFile} is kept${because}`, `Compare ${backup.backupFile} with ${plan.configFile} and copy it over if the difference is not yours.`)
+  if (stopped) throw stopped
   const ended = utc()
   const config = {
     path: plan.configFile,