omakit 0.4.3 → 0.5.0

package/README.md

@@ -39,7 +39,7 @@ Compares your installed plugin commits with the marketplace's validated commits.
 
 ![inspect showing a size score and the two review classes one fixture shows](https://raw.githubusercontent.com/mtolhuys/omakit/main/docs/media/inspect.gif)
 
-Reads a plugin's tree and prints what needs attention, biggest first: a size score (10 minus the mean rank of its functions among functions in listed plugins, [M12](docs/MEASUREMENTS.md#m12-how-long-a-plugins-functions-are-in-listed-trees)), the functions over what 90 of 100 listed functions stay under, then each review class the tree shows with the class's measured share of review findings ([M11](docs/MEASUREMENTS.md#m11-what-the-human-review-raises-by-class)) and up to five sites. No verdict, nothing run from the tree; `--full` is every site, `--json` the document. Over 18 listed plugins read at their validated commits, the extraction counted 515 process sites (57 QML `Process` blocks, 458 shell lines), 17 hosts, 63 writes and 40 timers, left 15 rows it could not resolve, and printed 73 pattern rows across 17 of the 18 ([record](docs/evidence/inspect/2026-09-15-listed-sample.json)).
+Reads a plugin's tree and prints what needs attention, biggest first: a size score (the share of its function lines that sit in functions over the measured size, placed among the 50 listed trees' shares, so a tree with no long function scores 10.00, [M12](docs/MEASUREMENTS.md#m12-how-long-a-plugins-functions-are-in-listed-trees)), the functions over what 90 of 100 listed functions stay under, then each review class the tree shows with the class's measured share of review findings ([M11](docs/MEASUREMENTS.md#m11-what-the-human-review-raises-by-class)) and up to five sites. No verdict, nothing run from the tree; `--full` is every site, `--json` the document. Over 18 listed plugins read at their validated commits, the extraction counted 515 process sites (57 QML `Process` blocks, 458 shell lines), 17 hosts, 63 writes and 40 timers, left 15 rows it could not resolve, and printed 73 pattern rows across 17 of the 18 ([record](docs/evidence/inspect/2026-09-15-listed-sample.json)).
 
 ## `omakit weigh <plugin>`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omakit",
-  "version": "0.4.3",
+  "version": "0.5.0",
   "description": "The safe place to find out: everything knowable about an Omarchy Quattro plugin submission before you post it, on your own machine. Agent-first, read-only against the marketplace, posts nothing, zero dependencies.",
   "license": "MIT",
   "author": "Maarten Tolhuijs",

package/skills/omarchy-plugin-check/SKILL.md

@@ -53,11 +53,17 @@ share of review findings (`share`, from M11 of `docs/MEASUREMENTS.md`).
 `size.over` lists the functions longer, more branched or deeper than 90 of
 100 functions in listed trees (the thresholds are in `size.thresholds`,
 from M12), longest first, each with its `percentile` among them, and
-`size.score` is 10 minus the mean percentile of every function in the
-tree. When the owner asks for simpler code, start with the top of
-`size.over`, and read the score before and after as the measure of the
-change; it is a position among listed plugins, not a grade, so never tell
-the owner a score is good or bad, only that it moved. Read
+`size.heavyShare` is the share of the tree's function lines that sit in
+those functions, and `size.score` is 10 minus the share of listed trees
+with a strictly smaller `heavyShare`, divided by 10: 10.00 when no
+function is over a threshold, 0.00 when the tree is heavier than every
+listed one (`size.sample.heavyShares` holds the listed trees' shares). It
+is line-weighted, so splitting a long function into short ones raises it
+and adding small functions beside a long one barely moves it. When the
+owner asks for simpler code, start with the top of `size.over`, and read
+the score before and after as the measure of the change; it is a position
+among listed plugins, not a grade, so never tell the owner a score is good
+or bad, only that it moved. Read
 the document, not the report: the report a person sees lists at most five
 sites per class and drops classes under five percent, `--full` prints every
 site, and `--json` carries all of it either way.

package/tools/inspect/contract.mjs

@@ -125,6 +125,7 @@ export function validateInspectDocument(document, known = {}) {
   const filesRead = subject.filesRead || {}
   for (const kind of FILE_KINDS) if (!isInt(filesRead[kind]) || filesRead[kind] < 0) problems.push(`subject.filesRead.${kind} is not a count`)
   for (const key of Object.keys(filesRead)) if (!FILE_KINDS.includes(key)) problems.push(`subject.filesRead.${key} is not a kind inspect reads`)
+  if (!isInt(subject.uncommittedFiles) || subject.uncommittedFiles < 0) problems.push("subject.uncommittedFiles is not a count")
 
   const observed = document.observed || {}
   for (const [key, check] of [["processes", processRow], ["hosts", host], ["writes", write], ["timers", timer], ["functions", fn]]) {
@@ -166,15 +167,25 @@ export function validateInspectDocument(document, known = {}) {
   else {
     if (!isString(size.measurement) || !/^M\d+$/.test(size.measurement)) problems.push("size.measurement is not a measurement id")
     for (const key of ["lines", "branches", "depth"]) if (!isInt(size.thresholds?.[key]) || size.thresholds[key] < 1) problems.push(`size.thresholds.${key} is not a count`)
-    if (!size.sample || !isInt(size.sample.trees) || !isInt(size.sample.functions)) problems.push("size.sample is not { trees, functions }")
+    const shares = size.sample?.heavyShares
+    if (!size.sample || !isInt(size.sample.trees) || !isInt(size.sample.functions)) problems.push("size.sample is not { trees, functions, heavyShares }")
+    else if (!Array.isArray(shares) || shares.length !== size.sample.trees || !shares.every((share) => typeof share === "number" && share >= 0 && share <= 1)) problems.push("size.sample.heavyShares is not one share from 0 to 1 per listed tree")
     const scorable = Array.isArray(observed.functions) && observed.functions.length > 0
+    if (typeof size.heavyShare !== "number" || size.heavyShare < 0 || size.heavyShare > 1) problems.push("size.heavyShare is not a share from 0 to 1")
+    else if (Array.isArray(observed.functions) && size.thresholds) {
+      const total = observed.functions.reduce((sum, row) => sum + row.lines, 0)
+      const heavy = observed.functions.filter((row) => row.lines > size.thresholds.lines || row.branches > size.thresholds.branches || row.depth > size.thresholds.depth).reduce((sum, row) => sum + row.lines, 0)
+      const expected = total ? heavy / total : 0
+      if (Math.abs(expected - size.heavyShare) > 0.00011) problems.push(`size.heavyShare is ${size.heavyShare}; the function lines over the thresholds say ${expected}`)
+    }
     if (size.score === null) {
       if (scorable) problems.push("size.score is null for a tree with functions")
     } else if (typeof size.score !== "number" || size.score < 0 || size.score > 10 || Math.abs(Math.round(size.score * 100) - size.score * 100) > 1e-6) problems.push("size.score is not a number from 0 to 10 with two decimals")
     else if (!scorable) problems.push("size.score is set for a tree with no function")
-    else {
-      const expected = Math.round((10 - observed.functions.reduce((sum, row) => sum + row.percentile, 0) / observed.functions.length / 10) * 100) / 100
-      if (Math.abs(expected - size.score) > 0.011) problems.push(`size.score is ${size.score}; the mean rank of the functions says ${expected}`)
+    else if (Array.isArray(shares) && shares.length && typeof size.heavyShare === "number") {
+      const rank = (shares.filter((share) => share < size.heavyShare).length / shares.length) * 100
+      const expected = Math.round((10 - rank / 10) * 100) / 100
+      if (Math.abs(expected - size.score) > 0.011) problems.push(`size.score is ${size.score}; the tree's rank among the listed shares says ${expected}`)
     }
     if (!Array.isArray(size.over)) problems.push("size.over is not a list")
     else {

package/tools/inspect/functions.mjs

@@ -1,7 +1,8 @@
-// Function sites: every named function, QML handler, shell function and
-// Python def, with its length in lines, its deepest nesting and its branch
-// count. Size is the one thing a person asks about a tree that regular
-// expressions can answer without a parser: where does the logic pile up.
+// Function sites: every named function (declared, assigned as an arrow, or
+// a method), QML handler, shell function and Python def, with its length
+// in lines, its deepest nesting and its branch count. Size is the one
+// thing a person asks about a tree that regular expressions can answer
+// without a parser: where does the logic pile up.
 // The numbers are counts over the text; the threshold they are compared
 // with is measured over listed trees (M12), never chosen.
 
@@ -13,11 +14,22 @@ const SHELL_CLOSE = /^\s*(?:fi|done|esac)\b/
 const SHELL_BRANCH = /\b(?:if|elif|for|while|until|case)\b|\|\||&&|^\s*[^)]*\)\s*(?!\s*$)/
 const PY_BRANCH = /^\s*(?:if|elif|for|while|except|with)\b|\band\b|\bor\b/
 
-/** Deepest brace nesting inside a body, relative to the body itself. */
+/**
+ * Deepest brace nesting inside a body, relative to the body itself. A `{`
+ * that opens a literal is not a level: an object or array literal spread
+ * over lines (`return {`, `foo({`, `x = {`, `[{`, `? {`, `a || {`) and an
+ * inline arrow body (`=> {`) are values, not control flow. The test is the
+ * last non-space text before the brace, so this is a regular-expression
+ * heuristic, not a parser: it aims at an object literal not counting as
+ * nesting, and a `{` after `)` or `else` or on a line of its own counts.
+ */
+const LITERAL_BEFORE = /(?:[(,:=[?]|\breturn|=>|\|\||&&)\s*$/
+
 function braceDepth(body) {
   let depth = 0
   let deepest = 0
   let quote = null
+  const literal = []
   for (let i = 0; i < body.length; i += 1) {
     const ch = body[i]
     if (quote) {
@@ -27,30 +39,50 @@ function braceDepth(body) {
     }
     if (ch === '"' || ch === "'" || ch === "`") quote = ch
     else if (ch === "{") {
+      const isLiteral = LITERAL_BEFORE.test(body.slice(Math.max(0, i - 12), i))
+      literal.push(isLiteral)
+      if (isLiteral) continue
       depth += 1
       if (depth > deepest) deepest = depth
-    } else if (ch === "}") depth -= 1
+    } else if (ch === "}") {
+      if (!literal.pop()) depth -= 1
+    }
   }
   return deepest
 }
 
+/** Words that stand before `(...) {` without naming a method. */
+const NOT_A_METHOD = new Set(["if", "for", "while", "switch", "catch", "with", "function", "return", "else", "do", "try"])
+
 function jsFunctions(file) {
   const text = blankComments(file.text)
   const rows = []
-  // `function name(` and, in QML, `onSomething: {` handlers with a body block.
-  const pattern = /(?<![\w.])function\s+([A-Za-z_$][\w$]*)\s*\(|(?<![\w.])(on[A-Z]\w*)\s*:\s*(?=\{)/g
+  // Four shapes, each followed by a body block: `function name(`; in QML,
+  // `onSomething: {` handlers; a named arrow function, `const load = (rows)
+  // => {` or `this.load = rows => {` on a property; and method shorthand,
+  // `load(rows) {` at the start of a line inside an object literal or a
+  // class. An anonymous callback (`(x) => {`, `function (x) {`) has no name
+  // and is not counted; the method shape excludes the keywords that stand
+  // before `(...) {` (`if`, `for`, `while`, `switch`, `catch`).
+  const pattern = new RegExp([
+    /(?<![\w.])function\s+([A-Za-z_$][\w$]*)\s*\(/.source,
+    /(?<![\w.])(on[A-Z]\w*)\s*:\s*(?=\{)/.source,
+    /(?<![\w$])([A-Za-z_$][\w$]*)\s*=\s*(?:async\s*)?(?:\([^()\n]*\)|[A-Za-z_$][\w$]*)\s*=>[ \t]*(?=\{)/.source,
+    /^[ \t]*(?:(?:async|static)\s+)*([A-Za-z_$][\w$]*)[ \t]*\([^()\n]*\)[ \t]*(?=\{)/.source,
+  ].join("|"), "gm")
   for (const match of text.matchAll(pattern)) {
-    const open = text.indexOf("{", match.index + match[0].length - (match[2] ? 0 : 0))
+    if (match[4] && NOT_A_METHOD.has(match[4])) continue
+    const open = text.indexOf("{", match.index + match[0].length)
     if (open < 0) continue
     const end = closingBracket(text, open)
     if (end < 0) continue
     const body = text.slice(open + 1, end)
-    const start = lineOf(text, match.index)
+    const start = lineOf(text, match.index + match[0].length - match[0].trimStart().length)
     rows.push({
       file: file.path,
       line: start,
-      name: match[1] || match[2],
-      kind: match[1] ? "function" : "handler",
+      name: match[1] || match[2] || match[3] || match[4],
+      kind: match[2] ? "handler" : "function",
       lines: lineOf(text, end) - start + 1,
       depth: braceDepth(body),
       branches: (body.match(JS_BRANCH) || []).length,
@@ -102,12 +134,22 @@ function pythonFunctions(file) {
     let end = index
     let deepest = 0
     let branches = 0
+    // Depth is relative to the body, the way it is for a brace block: the
+    // body's own indent is depth 0 and one `if` is depth 1. The unit is
+    // one indentation step, read from the first body line (4 spaces by
+    // PEP 8, 2 in some trees); 4 is assumed when there is no body line.
+    let unit = 4
+    let first = true
     for (let at = index + 1; at < lines.length; at += 1) {
       const line = lines[at]
       if (!line.trim()) continue
       const indent = line.match(/^\s*/)[0].length
       if (indent <= base) break
-      const level = Math.floor((indent - base) / 4)
+      if (first) {
+        unit = indent - base
+        first = false
+      }
+      const level = Math.max(0, Math.floor((indent - base) / unit) - 1)
       if (level > deepest) deepest = level
       if (PY_BRANCH.test(line)) branches += 1
       end = at

package/tools/inspect/inspect.mjs

@@ -3,7 +3,8 @@
 // the commit, run the four extractors over every file inspect reads, run
 // the marketplace's own baseline through `verify` for the capabilities,
 // and build the document of docs/INSPECT.md. No verdict, and the one score
-// a position among listed plugins, never a grade: every
+// a position among listed trees by how much of its function text is in
+// long functions, never a grade: every
 // row is a fact the text shows, labelled observed, and the document ends
 // with what the method cannot see.
 //
@@ -23,7 +24,7 @@ import { extractHosts } from "./hosts.mjs"
 import { extractWrites } from "./writes.mjs"
 import { extractTimers } from "./timers.mjs"
 import { extractFunctions } from "./functions.mjs"
-import { evaluatePatterns, overSize, PATTERNS, rankOf, SIZE, sizeScore } from "./patterns.mjs"
+import { evaluatePatterns, heavyShare, overSize, PATTERNS, rankOf, SIZE, sizeScore } from "./patterns.mjs"
 
 export const METHOD = "static extraction, regular expressions over qml and shell; observed, not executed"
 
@@ -62,6 +63,9 @@ export async function inspectPlugin({ repoRoot, target, offline = false, allowDi
   try {
     subject = resolveSubject(target, { cacheRoot, allowDirty })
   } catch (error) {
+    if (error instanceof SubjectError && error.code === "dirty-worktree") {
+      throw new InspectError(error.code, error.message.replace("read HEAD as committed", "inspect HEAD as committed"), "Commit them, or pass --allow-dirty to inspect HEAD as committed; uncommitted edits are not read.")
+    }
     if (error instanceof SubjectError) throw new InspectError(error.code, error.message)
     throw error
   }
@@ -128,6 +132,10 @@ export async function inspectPlugin({ repoRoot, target, offline = false, allowDi
       mode: subject.mode,
       pluginId,
       filesRead: tree.filesRead,
+      // Paths `git status` lists at the checkout, under --allow-dirty: the
+      // tree was read at the commit, so these were not inspected. 0 for a
+      // clean checkout and for a fetched commit.
+      uncommittedFiles: subject.uncommittedFiles,
     },
     observed: { processes, hosts, writes, timers, functions },
     // Size: the functions over the M12 thresholds, longest first. A count of
@@ -135,11 +143,15 @@ export async function inspectPlugin({ repoRoot, target, offline = false, allowDi
     // 100 functions in listed trees stay under; never a judgement.
     size: {
       measurement: SIZE.measurement,
-      sample: { trees: SIZE.trees, functions: SIZE.functions },
+      // The listed trees' own heavy shares, so the score can be read from
+      // the document alone: `heavyShares[i]` is the i-th listed tree's.
+      sample: { trees: SIZE.trees, functions: SIZE.functions, heavyShares: [...SIZE.distribution.heavyShare] },
       thresholds: { lines: SIZE.lines, branches: SIZE.branches, depth: SIZE.depth },
-      // 10 minus the mean rank of this tree's functions among the listed
-      // ones: where the tree sits, never whether it is good; null with no
+      // The share of this tree's function lines inside functions over the
+      // thresholds, and 10 minus its rank among the listed trees' shares:
+      // where the tree sits, never whether it is good; null with no
       // function to rank.
+      heavyShare: Math.round(heavyShare(functions) * 10000) / 10000,
       score: sizeScore(functions),
       over: overSize(functions),
     },

package/tools/inspect/measure-functions.mjs

@@ -0,0 +1,150 @@
+// M12 reproduction: how long a plugin's functions are, in listed trees.
+// The selection rule is the record's: the first 50 distinct community
+// repositories in the pinned catalog's order, laid out as a root plugin and
+// carrying a validated commit, each fetched read-only at that commit in
+// reviewer mode through tools/subject/resolve.mjs and read from the Git
+// object database through walk.mjs. `extractFunctions` runs over every
+// file inspect reads; nothing from a tree is executed. The record carries
+// no repository or commit: the rule reproduces the set.
+//
+// Writes docs/evidence/inspect/<date>-function-lengths.json (or --out FILE)
+// and prints the quantiles to stderr. The three p90 quantiles and the three
+// histograms replace the constants in patterns.mjs SIZE, and the per-tree
+// heavyShare list its SIZE.distribution.heavyShare; tests/unit/submit.test.mjs
+// holds them equal to the record.
+
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs"
+import { dirname, join, resolve } from "node:path"
+import { pathToFileURL } from "node:url"
+import { requirePin } from "../marketplace/pin.mjs"
+import { CATALOG_PATH } from "../marketplace/registry.mjs"
+import { omakitCacheDir } from "../marketplace/paths.mjs"
+import { resolveSubject } from "../subject/resolve.mjs"
+import { walkSubject } from "./walk.mjs"
+import { extractFunctions } from "./functions.mjs"
+
+export const TREES = 50
+const KINDS = ["qml", "js", "shell", "python"]
+
+/** The nearest-rank quantile of a sorted list: the value at position ceil(p * n). */
+export function quantile(sorted, p) {
+  if (!sorted.length) return null
+  return sorted[Math.max(0, Math.ceil(p * sorted.length) - 1)]
+}
+
+/** Value to count, keys in ascending numeric order. */
+export function histogram(values) {
+  const counts = new Map()
+  for (const value of values) counts.set(value, (counts.get(value) || 0) + 1)
+  return Object.fromEntries([...counts.entries()].sort((a, b) => a[0] - b[0]).map(([value, count]) => [String(value), count]))
+}
+
+/**
+ * The record's selection: catalog order, community listings laid out as a
+ * root plugin with a validated commit, one entry per repository, the first
+ * `count`.
+ */
+export function selectTrees(catalog, count = TREES) {
+  const seen = new Set()
+  const picked = []
+  for (const plugin of Array.isArray(catalog.plugins) ? catalog.plugins : []) {
+    if (plugin.sourceType !== "community" || plugin.repositoryLayout !== "root-plugin") continue
+    if (typeof plugin.repo !== "string" || !/^[0-9a-f]{40}$/i.test(String(plugin.listingValidatedCommit || ""))) continue
+    if (seen.has(plugin.repo)) continue
+    seen.add(plugin.repo)
+    picked.push({ repo: plugin.repo, commit: plugin.listingValidatedCommit.toLowerCase() })
+    if (picked.length === count) break
+  }
+  return picked
+}
+
+/** Lines inside functions over any threshold, over lines inside every function; 0 with no function. */
+export function heavyLinesOf(functions, thresholds) {
+  return functions.filter((row) => row.lines > thresholds.lines || row.branches > thresholds.branches || row.depth > thresholds.depth).reduce((sum, row) => sum + row.lines, 0)
+}
+
+const median = (values) => {
+  if (!values.length) return null
+  const sorted = [...values].sort((a, b) => a - b)
+  const mid = Math.floor(sorted.length / 2)
+  return sorted.length % 2 ? sorted[mid] : (sorted[mid - 1] + sorted[mid]) / 2
+}
+
+/**
+ * @param {Array<{ functions: Array, byKind?: object }>} trees the functions of each tree, in selection order
+ * @param {{ fetchFailed?: string[], date?: string, previous?: string }} [meta]
+ * @returns {object} the record
+ */
+export function buildRecord(trees, { fetchFailed = [], date = new Date().toISOString().slice(0, 10), previous = null } = {}) {
+  const pooled = trees.flatMap((tree) => tree.functions)
+  const sorted = (measure) => pooled.map((row) => row[measure]).sort((a, b) => a - b)
+  const lines = sorted("lines")
+  const depth = sorted("depth")
+  const branches = sorted("branches")
+  const quantiles = {
+    lines: { p50: quantile(lines, 0.5), p75: quantile(lines, 0.75), p90: quantile(lines, 0.9), p95: quantile(lines, 0.95), max: lines.at(-1) ?? null },
+    depth: { p50: quantile(depth, 0.5), p90: quantile(depth, 0.9), max: depth.at(-1) ?? null },
+    branches: { p50: quantile(branches, 0.5), p90: quantile(branches, 0.9), max: branches.at(-1) ?? null },
+  }
+  const thresholds = { lines: quantiles.lines.p90, branches: quantiles.branches.p90, depth: quantiles.depth.p90 }
+  const rows = trees.map((tree, index) => {
+    const functionLines = tree.functions.reduce((sum, row) => sum + row.lines, 0)
+    const heavyLines = heavyLinesOf(tree.functions, thresholds)
+    return {
+      row: index + 1,
+      functions: tree.functions.length,
+      byKind: Object.fromEntries(KINDS.map((kind) => [kind, tree.byKind?.[kind] ?? 0])),
+      longest: tree.functions.length ? Math.max(...tree.functions.map((row) => row.lines)) : 0,
+      medianLines: median(tree.functions.map((row) => row.lines)),
+      functionLines,
+      heavyLines,
+      heavyShare: functionLines ? Math.round((heavyLines / functionLines) * 10000) / 10000 : 0,
+    }
+  })
+  return {
+    measurement: "M12",
+    date,
+    command: "node tools/inspect/measure-functions.mjs",
+    method: `extractFunctions from tools/inspect/functions.mjs over the first ${trees.length} distinct repositories in the pinned catalog's order whose listing is community, laid out as a root plugin and carrying a validated commit (the 2026-09-15 inspect record's rule), each fetched read-only at that commit in reviewer mode. A function is a \`function name(\`, a named arrow function (\`const load = (rows) => {\`, \`this.load = rows => {\`), a method shorthand \`load(rows) {\` inside an object literal or a class, or a multi-line \`onSomething: {\` handler in QML and JavaScript; a \`name() {\` or \`function name\` block in shell; a \`def\` in Python. Anonymous callbacks are not counted. Lines are first to last line inclusive; depth is the deepest nesting below the body, the body itself at 0 in every language, a brace that opens an object or array literal or an inline arrow body not a level; branches count if, else if, for, while, switch, case, catch, &&, || and ?: (their shell and Python equivalents). Quantiles are nearest-rank over every function in the sample pooled, not per tree. \`distribution\` is the histogram of each measure over the same functions, value to count, from which a function's percentile rank is read. Per tree, functionLines is the lines inside every function, heavyLines the lines inside functions over any p90 threshold of this record, and heavyShare their ratio, 0 with no function; the size score of omakit inspect is a tree's position among these 50 heavyShares.`,
+    sample: { trees: trees.length, functions: pooled.length, fetchFailed },
+    quantiles,
+    distribution: { lines: histogram(lines), branches: histogram(branches), depth: histogram(depth) },
+    rows,
+    notes: `Rows carry no repository or commit; the selection rule reproduces the set. A function count and a longest length per tree are counts of what the extraction saw, not a judgement of any plugin.${previous ? ` ${previous}` : ""}`,
+  }
+}
+
+const PREVIOUS = "Re-measured on 2026-09-16 after three extraction fixes, so the quantiles are not comparable with the 0.4.3 record (this file at commit 6619c26: 50 trees, 6040 functions, p90 22 lines, 6 branches, nesting 3; and before it 18 trees, 715 functions, p90 18 lines, 7 branches, nesting 2): a Python body now starts at depth 0 the way a brace body does, where it started at 1; a brace that opens an object or array literal is no longer a nesting level; and a named arrow function or a method shorthand is a function, where only `function name(` and `onSomething: {` were."
+
+export async function measureFunctions(repoRoot, { count = TREES, cacheRoot = omakitCacheDir(), log = () => {} } = {}) {
+  const pin = requirePin(repoRoot)
+  const catalog = JSON.parse(readFileSync(join(pin.dir, CATALOG_PATH), "utf8"))
+  const selected = selectTrees(catalog, count)
+  const trees = []
+  const fetchFailed = []
+  for (const [index, entry] of selected.entries()) {
+    log(`${index + 1}/${selected.length} ${entry.repo}@${entry.commit.slice(0, 8)}`)
+    let subject
+    try {
+      subject = resolveSubject(`${entry.repo}@${entry.commit}`, { cacheRoot })
+    } catch (error) {
+      fetchFailed.push(`row ${index + 1}: ${error.code || "error"}`)
+      continue
+    }
+    const tree = walkSubject(subject)
+    const functions = tree.files.flatMap((file) => extractFunctions(file).map((row) => ({ ...row, fileKind: file.kind })))
+    const byKind = Object.fromEntries(KINDS.map((kind) => [kind, functions.filter((row) => row.fileKind === kind).length]))
+    trees.push({ functions, byKind })
+  }
+  return buildRecord(trees, { fetchFailed, previous: PREVIOUS })
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  const repoRoot = resolve(process.cwd())
+  const record = await measureFunctions(repoRoot, { log: (text) => process.stderr.write(`${text}\n`) })
+  const at = process.argv.indexOf("--out")
+  const evidencePath = resolve(at > 0 && process.argv[at + 1] ? process.argv[at + 1] : join(repoRoot, "docs/evidence/inspect", `${record.date}-function-lengths.json`))
+  mkdirSync(dirname(evidencePath), { recursive: true })
+  writeFileSync(evidencePath, `${JSON.stringify(record, null, 2)}\n`)
+  process.stderr.write(`${record.sample.trees} trees, ${record.sample.functions} functions; p90 ${record.quantiles.lines.p90} lines, ${record.quantiles.branches.p90} branches, nesting ${record.quantiles.depth.p90}; ${record.sample.fetchFailed.length} fetch failures\n${evidencePath}\n`)
+}

package/tools/inspect/patterns.mjs

@@ -89,18 +89,22 @@ function secretLogs(files) {
  */
 export const SIZE = Object.freeze({
   measurement: "M12",
-  sample: "50 listed trees, 6040 functions",
+  sample: "50 listed trees, 6041 functions",
   trees: 50,
-  functions: 6040,
+  functions: 6041,
   lines: 22,
   branches: 6,
-  depth: 3,
-  // The histogram of each measure over the 6040 functions, value to count,
-  // from which a function's percentile rank among listed functions is read.
+  depth: 2,
+  // The histogram of each measure over the 6041 functions, value to count,
+  // from which a function's percentile rank among listed functions is read;
+  // and each listed tree's heavyShare, the share of its function lines in
+  // functions over the thresholds, in the record's row order, from which
+  // a tree's position among listed trees is read.
   distribution: Object.freeze({
-    lines: Object.freeze({ 1: 330, 2: 185, 3: 682, 4: 659, 5: 629, 6: 514, 7: 420, 8: 339, 9: 301, 10: 235, 11: 192, 12: 138, 13: 150, 14: 129, 15: 104, 16: 75, 17: 84, 18: 64, 19: 70, 20: 48, 21: 51, 22: 46, 23: 45, 24: 42, 25: 27, 26: 25, 27: 16, 28: 24, 29: 24, 30: 17, 31: 18, 32: 23, 33: 18, 34: 19, 35: 10, 36: 5, 37: 11, 38: 12, 39: 12, 40: 9, 41: 10, 42: 12, 43: 9, 44: 8, 45: 7, 46: 14, 47: 8, 48: 11, 49: 8, 50: 6, 51: 2, 52: 2, 53: 6, 54: 2, 55: 7, 56: 4, 57: 3, 58: 5, 60: 6, 61: 2, 62: 3, 63: 6, 64: 1, 65: 3, 66: 1, 67: 3, 68: 4, 69: 8, 70: 5, 71: 6, 72: 2, 73: 2, 74: 1, 75: 1, 76: 1, 77: 1, 78: 1, 79: 3, 80: 1, 81: 3, 82: 1, 83: 1, 85: 1, 87: 1, 89: 1, 90: 2, 91: 2, 92: 1, 94: 1, 96: 2, 97: 2, 98: 1, 99: 1, 100: 1, 101: 1, 102: 2, 104: 1, 108: 1, 110: 2, 111: 1, 112: 1, 113: 1, 115: 2, 116: 1, 117: 1, 119: 1, 120: 1, 121: 1, 128: 2, 129: 1, 133: 1, 134: 1, 144: 1, 145: 1, 154: 1, 161: 1, 173: 1, 253: 1, 277: 1, 292: 1, 365: 1, 495: 1 }),
-    branches: Object.freeze({ 0: 2336, 1: 1096, 2: 807, 3: 454, 4: 339, 5: 233, 6: 171, 7: 125, 8: 90, 9: 68, 10: 47, 11: 53, 12: 24, 13: 26, 14: 18, 15: 11, 16: 17, 17: 18, 18: 12, 19: 12, 20: 11, 21: 3, 22: 5, 23: 7, 24: 8, 25: 4, 26: 1, 27: 6, 28: 4, 29: 5, 31: 1, 32: 3, 33: 3, 34: 1, 35: 1, 36: 4, 37: 1, 38: 1, 40: 1, 41: 1, 43: 2, 44: 1, 45: 2, 46: 1, 64: 1, 75: 1, 78: 1, 85: 1, 87: 2 }),
-    depth: Object.freeze({ 0: 2606, 1: 1938, 2: 859, 3: 327, 4: 133, 5: 71, 6: 60, 7: 26, 8: 8, 9: 6, 10: 2, 13: 2, 15: 1, 18: 1 }),
+    lines: Object.freeze({ 1: 330, 2: 185, 3: 682, 4: 659, 5: 629, 6: 515, 7: 420, 8: 339, 9: 301, 10: 235, 11: 192, 12: 138, 13: 150, 14: 129, 15: 104, 16: 75, 17: 84, 18: 64, 19: 70, 20: 48, 21: 51, 22: 46, 23: 45, 24: 42, 25: 27, 26: 25, 27: 16, 28: 24, 29: 24, 30: 17, 31: 18, 32: 23, 33: 18, 34: 19, 35: 10, 36: 5, 37: 11, 38: 12, 39: 12, 40: 9, 41: 10, 42: 12, 43: 9, 44: 8, 45: 7, 46: 14, 47: 8, 48: 11, 49: 8, 50: 6, 51: 2, 52: 2, 53: 6, 54: 2, 55: 7, 56: 4, 57: 3, 58: 5, 60: 6, 61: 2, 62: 3, 63: 6, 64: 1, 65: 3, 66: 1, 67: 3, 68: 4, 69: 8, 70: 5, 71: 6, 72: 2, 73: 2, 74: 1, 75: 1, 76: 1, 77: 1, 78: 1, 79: 3, 80: 1, 81: 3, 82: 1, 83: 1, 85: 1, 87: 1, 89: 1, 90: 2, 91: 2, 92: 1, 94: 1, 96: 2, 97: 2, 98: 1, 99: 1, 100: 1, 101: 1, 102: 2, 104: 1, 108: 1, 110: 2, 111: 1, 112: 1, 113: 1, 115: 2, 116: 1, 117: 1, 119: 1, 120: 1, 121: 1, 128: 2, 129: 1, 133: 1, 134: 1, 144: 1, 145: 1, 154: 1, 161: 1, 173: 1, 253: 1, 277: 1, 292: 1, 365: 1, 495: 1 }),
+    branches: Object.freeze({ 0: 2336, 1: 1096, 2: 807, 3: 455, 4: 339, 5: 233, 6: 171, 7: 125, 8: 90, 9: 68, 10: 47, 11: 53, 12: 24, 13: 26, 14: 18, 15: 11, 16: 17, 17: 18, 18: 12, 19: 12, 20: 11, 21: 3, 22: 5, 23: 7, 24: 8, 25: 4, 26: 1, 27: 6, 28: 4, 29: 5, 31: 1, 32: 3, 33: 3, 34: 1, 35: 1, 36: 4, 37: 1, 38: 1, 40: 1, 41: 1, 43: 2, 44: 1, 45: 2, 46: 1, 64: 1, 75: 1, 78: 1, 85: 1, 87: 2 }),
+    depth: Object.freeze({ 0: 3794, 1: 1421, 2: 481, 3: 155, 4: 80, 5: 62, 6: 27, 7: 10, 8: 5, 9: 2, 12: 1, 13: 1, 15: 1, 18: 1 }),
+    heavyShare: Object.freeze([0.421, 0.3361, 0.4049, 0, 0.3687, 0.4469, 0.4107, 0.6167, 0.2635, 0.8434, 0, 0, 0.193, 0.7036, 0.4506, 0.4846, 0.5047, 0.5337, 0.3628, 0.682, 0.0554, 0.7775, 0.3548, 0.3552, 0, 0.7172, 0.2542, 0.3747, 0.4275, 0.6607, 0.4322, 0.6941, 0.3247, 0.5225, 0.2545, 0.1462, 0, 0.5817, 0.5891, 0.4353, 0, 0.3479, 0.6109, 0.296, 0.3882, 0.5624, 0.6783, 0.4385, 0.6078, 0.5826]),
   }),
 })
 
@@ -123,16 +127,41 @@ export function rankOf(entry) {
 }
 
 /**
- * The size score of a tree: 10 minus the mean rank of its functions among
- * the 6040 listed ones, on 0 to 10 with two decimals. A tree of median
- * functions scores 5.00; every function made shorter, flatter or less
- * branched raises it. It says where the tree sits among listed plugins,
- * never whether it is good, and a tree with no function has no score.
+ * The share of a tree's function lines that sit in functions over any of
+ * the M12 thresholds: lines inside `overSize` functions over lines inside
+ * every function, 0 with no function. Line-weighted on purpose: splitting
+ * one long function into short ones moves its lines out of the heavy set,
+ * and padding a tree with small functions barely moves the ratio.
+ */
+export function heavyShare(functions) {
+  const total = functions.reduce((sum, entry) => sum + entry.lines, 0)
+  if (!total) return 0
+  const heavy = overSize(functions).reduce((sum, entry) => sum + entry.lines, 0)
+  return heavy / total
+}
+
+/**
+ * The share of listed trees whose heavyShare is strictly smaller than this
+ * one, as a percentage over the trees of the M12 record: 0 for a tree with
+ * no function over the thresholds, 100 for one heavier than every listed
+ * tree.
+ */
+export function treeRank(share) {
+  const below = SIZE.distribution.heavyShare.filter((listed) => listed < share).length
+  return Math.round((below / SIZE.trees) * 1000) / 10
+}
+
+/**
+ * The size score of a tree: 10 minus its rank among the listed trees
+ * divided by 10, on 0 to 10 with two decimals. A tree with no function
+ * over the thresholds scores 10.00, a tree heavier than every listed tree
+ * 0.00. It says where the tree sits among listed plugins by how much of
+ * its function text is in long functions, never whether it is good, and a
+ * tree with no function has no score.
  */
 export function sizeScore(functions) {
   if (!functions.length) return null
-  const mean = functions.reduce((sum, entry) => sum + rankOf(entry), 0) / functions.length
-  return Math.round((10 - mean / 10) * 100) / 100
+  return Math.round((10 - treeRank(heavyShare(functions)) / 10) * 100) / 100
 }
 
 /** The functions over any of the thresholds, longest first, then most branched. */

package/tools/inspect/report.mjs

@@ -27,6 +27,28 @@ const NOTHING = "observed nothing of this kind"
 const plural = (count, word, words = `${word}s`) => `${count} ${count === 1 ? word : words}`
 const site = (row) => `${row.file}:${row.line}`
 
+/** A share as a whole percentage; one that would round to 0 or 100 says so instead of rounding past the truth. */
+function percent(share) {
+  const rounded = Math.round(share * 100)
+  if (share > 0 && rounded === 0) return "under 1%"
+  if (share < 1 && rounded === 100) return "over 99%"
+  return `${rounded}%`
+}
+
+/** The score sentence after the number: the share, then the position among the listed trees the document itself carries. */
+function scoreText(size) {
+  const shares = size.sample.heavyShares
+  const rank = (shares.filter((share) => share < size.heavyShare).length / shares.length) * 100
+  return `${percent(size.heavyShare)} of its function lines sit in functions over the measured size, less than ${100 - Math.round(rank)} of 100 listed trees (${size.measurement})`
+}
+
+/** Under --allow-dirty: what the checkout holds that the tree at the commit does not. */
+function uncommittedLine(document, c) {
+  const count = document.subject.uncommittedFiles
+  if (!count) return []
+  return field("uncommitted", `${plural(count, "file")} differ${count === 1 ? "s" : ""} from HEAD and ${count === 1 ? "was" : "were"} not inspected; the tree at ${document.subject.commit ? document.subject.commit.slice(0, 8) : "the commit"} is what was read`, c)
+}
+
 /** A row: a mark, the site in bold, then the text, wrapped under the gutter. */
 function row(state, head, text, c, extra = []) {
   const lines = wrap(text || "(nothing)", { indent: GUTTER, first: GUTTER + head.length + 2 }, c)
@@ -233,11 +255,12 @@ export function renderInspect(document, { colour = colourEnabled(), full = false
   const out = []
   const counts = document.counts
   out.push(...field("subject", `${withHomeAbbreviated(document.subject.dir)} at ${document.subject.commit ? document.subject.commit.slice(0, 8) : "no commit"}`, c))
+  out.push(...uncommittedLine(document, c))
   out.push(...field("baseline", baselineText(document.marketplaceBaseline), c))
   const score = document.size.score
   out.push(...field("size score", score === null
     ? `none: no function to rank`
-    : `${score.toFixed(2)} of 10; 10 minus the mean rank of its ${plural(counts.functions, "function")} among ${SIZE.functions} in ${document.size.sample.trees} listed trees (${SIZE.measurement}), so a tree of median functions scores 5.00`, c))
+    : `${score.toFixed(2)} of 10; ${scoreText(document.size)}`, c))
   out.push("")
 
   const ranked = [...document.patterns].sort((a, b) => b.share - a.share)
@@ -300,6 +323,7 @@ function renderFull(document, { colour }) {
   const kinds = Object.entries(read).filter(([, count]) => count > 0).map(([kind, count]) => `${count} ${kind}`)
   const total = Object.values(read).reduce((sum, count) => sum + count, 0)
   out.push(...field("subject", `${withHomeAbbreviated(document.subject.dir)} at ${document.subject.commit ? document.subject.commit.slice(0, 8) : "no commit"}, ${plural(total, "file")} read${kinds.length ? ` (${kinds.join(", ")})` : ""}`, c))
+  out.push(...uncommittedLine(document, c))
   out.push(...field("method", document.method, c))
   out.push("")
 
@@ -320,7 +344,7 @@ function renderFull(document, { colour }) {
     ? `observed ${functions.length}, ${over.length} over what 90 of 100 functions in ${SIZE.sample} stay under (${SIZE.lines} lines, ${SIZE.branches} branches or nesting ${SIZE.depth}; ${SIZE.measurement}), longest first`
     : NOTHING, c))
   for (const entry of over) out.push(...row("info", `${entry.file}:${entry.line}`, `${entry.name}, ${plural(entry.lines, "line")}, ${plural(entry.branches, "branch", "branches")}, nesting ${entry.depth}, over ${entry.percentile} of 100 listed`, c))
-  if (functions.length) out.push(...wrap(`size score ${document.size.score.toFixed(2)} of 10: 10 minus the mean rank of the ${functions.length} among ${SIZE.functions} listed functions (${SIZE.measurement})`, { indent: GUTTER }, c))
+  if (functions.length) out.push(...wrap(`size score ${document.size.score.toFixed(2)} of 10: ${scoreText(document.size)}`, { indent: GUTTER }, c))
   out.push("")
   out.push(...baselineLines(document.marketplaceBaseline, c))
   out.push("")

package/tools/marketplace/README.md

@@ -68,7 +68,8 @@ the tree, no verdict:
 | `inspect/hosts.mjs` | Every `http` or `https` literal with its host, the tool it reaches, and the timeout and size-cap flags in the same argv; a host behind an expression is not resolvable, never guessed. |
 | `inspect/writes.mjs` | Write sites in QML (`FileView` with a write), shell (redirects, `tee`, `cp`, `mv`, `mkdir`, `mktemp`, `install`, `touch`), JavaScript and Python, with the controlled-directory test over the canonical path prefix and the mode the file shows. |
 | `inspect/timers.mjs` | `Timer {` blocks: interval, repeat, running, triggeredOnStart, and the handler outside the block that starts it. |
-| `inspect/functions.mjs` | Function sites: `function name(` and multi-line handlers in QML and JavaScript, shell functions, Python defs, each with its length in lines, deepest nesting and branch count. |
+| `inspect/functions.mjs` | Function sites: `function name(`, named arrow functions and method shorthand in JavaScript and QML, multi-line `onSomething: {` handlers, shell functions and Python `def`s, each with its lines, deepest nesting (a literal is not a level; a Python body starts at 0) and branch count. |
+| `inspect/measure-functions.mjs` | Reproduces M12: the first 50 listed community root-plugin trees at their validated commits, fetched read-only, `extractFunctions` over each, the quantiles, the histograms and each tree's heavy share, written to `docs/evidence/inspect/<date>-function-lengths.json`. |
 | `inspect/patterns.mjs` | The ten review classes of M11 as data: id, label, precondition over the facts, measurement, share, and the phrase for the `not observed` line. `supply-chain` cites the baseline's own findings and detects nothing. Also the M12 size thresholds as data, and the longest-first order over them. |
 | `inspect/contract.mjs` | The JSON contract of docs/INSPECT.md as a validator, run by the unit tests over every fixture document. |
 | `inspect/report.mjs` | The report for a person, drawn with `style.mjs` only: `░ info` for a fact, `▒ ?` for one that could not be read, `▓ note` for a pattern row, `▔ skip` under `--offline`, and the closing word `INSPECTED`. |

package/tools/marketplace/cli.mjs

@@ -58,7 +58,7 @@ const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..")
 const REMEDY = Object.freeze({
   "usage": "omakit help",
   "marketplace-unavailable": "omakit pin",
-  "dirty-worktree": "Commit the changes, or pass --allow-dirty to check the tree as it is.",
+  "dirty-worktree": "Commit the changes, or pass --allow-dirty to read HEAD as committed; uncommitted edits are not read.",
   "subject-not-found": "Pass a local Git repository path, or <https url>@<40-char sha>.",
   "not-a-git-repository": "Pass a local Git repository path, or <https url>@<40-char sha>.",
   "commit-not-found": "Commit first; the checks read the tree at an exact commit, never the working copy.",

package/tools/marketplace/usage.mjs

@@ -105,8 +105,9 @@ export const COMMANDS = Object.freeze([
       "each with its measured share, only where the tree shows the class.",
       "Regular expressions over QML and shell, labelled observed; runs nothing",
       "from the tree, decides nothing, exits 0 with a report and 2 when the",
-      "target cannot be read. The report opens with a size score, 10 minus",
-      "the mean rank of the tree's functions among those in listed trees,",
+      "target cannot be read. The report opens with a size score, the share",
+      "of the tree's function lines in functions over the measured size,",
+      "placed among the listed trees' shares, 10.00 with no long function;",
       "then what needs attention: functions over the measured size, longest",
       "first, then the review classes by measured share, five sites each;",
       "--full is every site with every qualifier; --json prints the document.",

package/tools/subject/resolve.mjs

@@ -55,7 +55,8 @@ function expandHome(text) {
 /**
  * @param {string} target
  * @param {{ cacheRoot: string, allowDirty?: boolean }} options
- * @returns {{ mode, dir, commit, clean, repository: { kind: "git", url: string|null, declared: boolean } }}
+ * @returns {{ mode, dir, subdir, commit, clean, uncommittedFiles: number, repository: { kind: "git", url: string|null, declared: boolean } }}
+ *   `uncommittedFiles` is the number of paths `git status --porcelain` lists, 0 for a clean or a fetched tree
  */
 export function resolveSubject(target, options) {
   const parsed = parseTarget(target)
@@ -73,8 +74,12 @@ export function resolveSubject(target, options) {
     } catch {
       throw new SubjectError("commit-not-found", `${top} has no commit yet`)
     }
-    const clean = git(top, ["status", "--porcelain"]).trim().length === 0
-    if (!clean && !options.allowDirty) throw new SubjectError("dirty-worktree", `${top} has uncommitted changes; commit them or pass --allow-dirty`)
+    // Every check reads the tree at HEAD from the object database, so an
+    // uncommitted edit is never read; the count says how many files it
+    // leaves out, and the message says so instead of promising the tree as it is.
+    const status = git(top, ["status", "--porcelain"]).split("\n").filter((line) => line.trim().length)
+    const clean = status.length === 0
+    if (!clean && !options.allowDirty) throw new SubjectError("dirty-worktree", `${top} has uncommitted changes (${status.length} ${status.length === 1 ? "file" : "files"}); commit them, or pass --allow-dirty to read HEAD as committed; uncommitted edits are not read`)
     let originUrl = null
     try {
       originUrl = git(top, ["remote", "get-url", "origin"]).trim()
@@ -88,6 +93,7 @@ export function resolveSubject(target, options) {
       subdir: resolve(parsed.path) === top ? "" : resolve(parsed.path).slice(top.length + 1),
       commit,
       clean,
+      uncommittedFiles: status.length,
       repository: { kind: "git", url: gh ? gh.url : null, declared: Boolean(gh) },
     }
   }
@@ -119,6 +125,7 @@ export function resolveSubject(target, options) {
     subdir: "",
     commit: parsed.commit,
     clean: true,
+    uncommittedFiles: 0,
     repository: { kind: "git", url: gh.url, declared: true },
   }
 }