omakit 0.4.3 → 0.5.1

package/README.md

@@ -6,6 +6,20 @@ The marketplace validates one exact commit of your plugin. Push a fix or comment
 
 [![Built for Omarchy: App](https://raw.githubusercontent.com/tcballard/omarchy-badges/75975e5b5bf75e7ede3764bcd2950046f7abfe2c/badges/v1/omarchy-app.svg)](https://github.com/tcballard/omarchy-badges) [![npm version](https://img.shields.io/npm/v/omakit)](https://www.npmjs.com/package/omakit) [![CI status](https://img.shields.io/github/actions/workflow/status/mtolhuys/omakit/ci.yml?branch=main)](https://github.com/mtolhuys/omakit/actions/workflows/ci.yml) [![Socket](https://socket.dev/api/badge/npm/package/omakit)](https://socket.dev/npm/package/omakit)
 
+## What it delivers
+
+| Command | What you get | Read more |
+| --- | --- | --- |
+| `omakit submit <plugin-repo>` | Run the marketplace's own checks before you open the issue, and get the issue text ready to paste. Nothing is posted for you. | [submit](docs/SUBMIT.md) |
+| `omakit inspect <plugin-dir>` | See what needs attention in your plugin before a reviewer does: the longest functions, and the things reviewers flag most often, each with the file and line. | [inspect](docs/INSPECT.md) |
+| `omakit watch <issue-url>` | Know whether the commit the marketplace checked is still the one you are shipping, and what to do when it is not. | [watch](docs/VALIDATION_WATCH.md) |
+| `omakit audit` | Find installed plugins that are running code the marketplace never checked. | [audit](docs/AUDIT.md) |
+| `omakit weigh <plugin>` | Find out what a plugin costs the shell in memory and CPU. | [weigh](docs/WEIGH.md) |
+| `omakit verify <plugin-repo>` | Get the marketplace's security result for your commit, exactly as it would see it. | [commands](docs/COMMANDS.md) |
+| `omakit doctor`, `omakit setup` | Check what is installed and pinned, or set everything up once, with tab completion. | [install](docs/INSTALL.md) |
+
+Every number a command prints has a measured origin in [MEASUREMENTS.md](docs/MEASUREMENTS.md); nothing is a guess and nothing is a grade.
+
 ## Install
 
 ```bash
@@ -37,9 +51,9 @@ Compares your installed plugin commits with the marketplace's validated commits.
 
 ## `omakit inspect <plugin-dir>`
 
-![inspect showing a size score and the two review classes one fixture shows](https://raw.githubusercontent.com/mtolhuys/omakit/main/docs/media/inspect.gif)
+![inspect showing a fixture's size score, its two long functions with their ranks, and the one review class it shows](https://raw.githubusercontent.com/mtolhuys/omakit/main/docs/media/inspect.gif)
 
-Reads a plugin's tree and prints what needs attention, biggest first: a size score (10 minus the mean rank of its functions among functions in listed plugins, [M12](docs/MEASUREMENTS.md#m12-how-long-a-plugins-functions-are-in-listed-trees)), the functions over what 90 of 100 listed functions stay under, then each review class the tree shows with the class's measured share of review findings ([M11](docs/MEASUREMENTS.md#m11-what-the-human-review-raises-by-class)) and up to five sites. No verdict, nothing run from the tree; `--full` is every site, `--json` the document. Over 18 listed plugins read at their validated commits, the extraction counted 515 process sites (57 QML `Process` blocks, 458 shell lines), 17 hosts, 63 writes and 40 timers, left 15 rows it could not resolve, and printed 73 pattern rows across 17 of the 18 ([record](docs/evidence/inspect/2026-09-15-listed-sample.json)).
+Reads a plugin's tree and prints what needs attention, biggest first: a size score (the share of its function lines that sit in functions over the measured size, placed among the listed trees' shares, so a tree with no long function scores 10.00, [M12](docs/MEASUREMENTS.md#m12-how-long-a-plugins-functions-are-in-listed-trees)), the functions over what 90 of 100 listed functions stay under, then each review class the tree shows with the class's measured share of review findings ([M11](docs/MEASUREMENTS.md#m11-what-the-human-review-raises-by-class)) and up to five sites. No verdict, nothing run from the tree; `--full` is every site, `--json` the document. Over 18 listed plugins read at their validated commits, the extraction counted 515 process sites (57 QML `Process` blocks, 458 shell lines), 17 hosts, 63 writes and 40 timers, left 15 rows it could not resolve, and printed 73 pattern rows across 17 of the 18 ([record](docs/evidence/inspect/2026-09-15-listed-sample.json)).
 
 ## `omakit weigh <plugin>`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omakit",
-  "version": "0.4.3",
+  "version": "0.5.1",
   "description": "The safe place to find out: everything knowable about an Omarchy Quattro plugin submission before you post it, on your own machine. Agent-first, read-only against the marketplace, posts nothing, zero dependencies.",
   "license": "MIT",
   "author": "Maarten Tolhuijs",

package/skills/omarchy-plugin-check/SKILL.md

@@ -53,11 +53,17 @@ share of review findings (`share`, from M11 of `docs/MEASUREMENTS.md`).
 `size.over` lists the functions longer, more branched or deeper than 90 of
 100 functions in listed trees (the thresholds are in `size.thresholds`,
 from M12), longest first, each with its `percentile` among them, and
-`size.score` is 10 minus the mean percentile of every function in the
-tree. When the owner asks for simpler code, start with the top of
-`size.over`, and read the score before and after as the measure of the
-change; it is a position among listed plugins, not a grade, so never tell
-the owner a score is good or bad, only that it moved. Read
+`size.heavyShare` is the share of the tree's function lines that sit in
+those functions, and `size.score` is 10 minus the share of listed trees
+with a strictly smaller `heavyShare`, divided by 10: 10.00 when no
+function is over a threshold, 0.00 when the tree is heavier than every
+listed one (`size.sample.heavyShares` holds the shares of the listed trees that have a function, 49 of 50). It
+is line-weighted, so splitting a long function into short ones raises it
+and adding small functions beside a long one barely moves it. When the
+owner asks for simpler code, start with the top of `size.over`, and read
+the score before and after as the measure of the change; it is a position
+among listed plugins, not a grade, so never tell the owner a score is good
+or bad, only that it moved. Read
 the document, not the report: the report a person sees lists at most five
 sites per class and drops classes under five percent, `--full` prints every
 site, and `--json` carries all of it either way.

package/tools/inspect/contract.mjs

@@ -125,6 +125,7 @@ export function validateInspectDocument(document, known = {}) {
   const filesRead = subject.filesRead || {}
   for (const kind of FILE_KINDS) if (!isInt(filesRead[kind]) || filesRead[kind] < 0) problems.push(`subject.filesRead.${kind} is not a count`)
   for (const key of Object.keys(filesRead)) if (!FILE_KINDS.includes(key)) problems.push(`subject.filesRead.${key} is not a kind inspect reads`)
+  if (!isInt(subject.uncommittedFiles) || subject.uncommittedFiles < 0) problems.push("subject.uncommittedFiles is not a count")
 
   const observed = document.observed || {}
   for (const [key, check] of [["processes", processRow], ["hosts", host], ["writes", write], ["timers", timer], ["functions", fn]]) {
@@ -166,15 +167,25 @@ export function validateInspectDocument(document, known = {}) {
   else {
     if (!isString(size.measurement) || !/^M\d+$/.test(size.measurement)) problems.push("size.measurement is not a measurement id")
     for (const key of ["lines", "branches", "depth"]) if (!isInt(size.thresholds?.[key]) || size.thresholds[key] < 1) problems.push(`size.thresholds.${key} is not a count`)
-    if (!size.sample || !isInt(size.sample.trees) || !isInt(size.sample.functions)) problems.push("size.sample is not { trees, functions }")
+    const shares = size.sample?.heavyShares
+    if (!size.sample || !isInt(size.sample.trees) || !isInt(size.sample.functions)) problems.push("size.sample is not { trees, functions, heavyShares }")
+    else if (!Array.isArray(shares) || !shares.length || shares.length > size.sample.trees || !shares.every((share) => typeof share === "number" && share >= 0 && share <= 1)) problems.push("size.sample.heavyShares is not one share from 0 to 1 per listed tree with a function")
     const scorable = Array.isArray(observed.functions) && observed.functions.length > 0
+    if (typeof size.heavyShare !== "number" || size.heavyShare < 0 || size.heavyShare > 1) problems.push("size.heavyShare is not a share from 0 to 1")
+    else if (Array.isArray(observed.functions) && size.thresholds) {
+      const total = observed.functions.reduce((sum, row) => sum + row.lines, 0)
+      const heavy = observed.functions.filter((row) => row.lines > size.thresholds.lines || row.branches > size.thresholds.branches || row.depth > size.thresholds.depth).reduce((sum, row) => sum + row.lines, 0)
+      const expected = total ? heavy / total : 0
+      if (Math.abs(expected - size.heavyShare) > 0.00011) problems.push(`size.heavyShare is ${size.heavyShare}; the function lines over the thresholds say ${expected}`)
+    }
     if (size.score === null) {
       if (scorable) problems.push("size.score is null for a tree with functions")
     } else if (typeof size.score !== "number" || size.score < 0 || size.score > 10 || Math.abs(Math.round(size.score * 100) - size.score * 100) > 1e-6) problems.push("size.score is not a number from 0 to 10 with two decimals")
     else if (!scorable) problems.push("size.score is set for a tree with no function")
-    else {
-      const expected = Math.round((10 - observed.functions.reduce((sum, row) => sum + row.percentile, 0) / observed.functions.length / 10) * 100) / 100
-      if (Math.abs(expected - size.score) > 0.011) problems.push(`size.score is ${size.score}; the mean rank of the functions says ${expected}`)
+    else if (Array.isArray(shares) && shares.length && typeof size.heavyShare === "number") {
+      const rank = (shares.filter((share) => share < size.heavyShare).length / shares.length) * 100
+      const expected = Math.round((10 - rank / 10) * 100) / 100
+      if (Math.abs(expected - size.score) > 0.011) problems.push(`size.score is ${size.score}; the tree's rank among the listed shares says ${expected}`)
     }
     if (!Array.isArray(size.over)) problems.push("size.over is not a list")
     else {

package/tools/inspect/functions.mjs

@@ -1,23 +1,58 @@
-// Function sites: every named function, QML handler, shell function and
-// Python def, with its length in lines, its deepest nesting and its branch
-// count. Size is the one thing a person asks about a tree that regular
-// expressions can answer without a parser: where does the logic pile up.
+// Function sites: every named function (declared, assigned as an arrow, or
+// a method), QML handler, shell function and Python def, with its length
+// in lines, its deepest nesting and its branch count. Size is the one
+// thing a person asks about a tree that regular expressions can answer
+// without a parser: where does the logic pile up.
 // The numbers are counts over the text; the threshold they are compared
 // with is measured over listed trees (M12), never chosen.
 
 import { blankComments, closingBracket, lineOf } from "./text.mjs"
 
 const JS_BRANCH = /\b(?:if|else if|for|while|do|switch|case|catch)\b|&&|\|\||\?[^.:]/g
-const SHELL_OPEN = /^\s*(?:if|for|while|until|case|select)\b/
-const SHELL_CLOSE = /^\s*(?:fi|done|esac)\b/
-const SHELL_BRANCH = /\b(?:if|elif|for|while|until|case)\b|\|\||&&|^\s*[^)]*\)\s*(?!\s*$)/
+// A block opens with `if`, `for`, `while`, `until`, `case` or `select` and
+// closes with `fi`, `done` or `esac`, each counted only where a statement
+// can start (the line's start, after `;`, `&`, `|`, `(`, `then`, `do` or
+// `else`), over the line with its quoted text removed, so `if x; then y;
+// fi` on one line nets zero and is not a level, `x && if y; then z; fi`
+// nets zero too, and neither `echo "done"` nor `echo done` closes anything.
+const SHELL_OPEN = /(?:^|[;&|(]|\b(?:then|do|else))\s*(?:if|for|while|until|case|select)\b/g
+const SHELL_CLOSE = /(?:^|[;&|(]|\b(?:then|do|else))\s*(?:fi|done|esac)\b/g
+// A case arm, `pattern) command` or `(pattern) command`, is a branch: a `)`
+// with text after it on a line with no `(` before it but an opening one,
+// so a `$(...)` or `(( ))` in a test is not one.
+const SHELL_BRANCH = /\b(?:if|elif|for|while|until|case)\b|\|\||&&|^\s*\(?[^()]*\)\s*(?!\s*$)/
+// A guard, not a branch: `||` or `&&` followed by one flow word (`return`,
+// `exit`, `continue`, `break`, `true`, `false`, `:`) with an optional
+// status (a number, `$?` or a variable), then nothing but a `;` or the `;;`
+// that ends a case arm, as in `[[ -f $x ]] || return 1`. One guard per
+// line, the one at its end: `x && return 0 || return 1` is a choice, and
+// its `&&` counts. JavaScript has no such idiom, so shell alone is
+// exempted.
+// Matched against the trimmed end of the code, and anchored there, so a long run of spaces costs nothing.
+const SHELL_GUARD = /(?:\|\||&&)\s*(?:return|exit|continue|break|true|false|:)(?:\s+(?:\$\?|\$\{?\w+\}?|\d+))?\s*;{0,2}$/
+// `<<WORD`, `<<-WORD`, `<<'WORD'`, `<<"WORD"` or `<<\WORD` outside quotes and
+// outside `(( ))`; `<<<` is a here-string and `<<` in arithmetic a shift.
+const HEREDOC = /^<<(-?)\s*(?:(['"])([A-Za-z_][\w.-]*)\2|\\?([A-Za-z_][\w.-]*))/
+// The line that closes a shell function: `}` alone, or `}` with a comment or a redirection after it.
+const SHELL_END = /^\}\s*(?:#.*|[<>&|].*)?$/
 const PY_BRANCH = /^\s*(?:if|elif|for|while|except|with)\b|\band\b|\bor\b/
 
-/** Deepest brace nesting inside a body, relative to the body itself. */
+/**
+ * Deepest brace nesting inside a body, relative to the body itself. A `{`
+ * that opens a literal is not a level: an object or array literal spread
+ * over lines (`return {`, `foo({`, `x = {`, `[{`, `? {`, `a || {`) and an
+ * inline arrow body (`=> {`) are values, not control flow. The test is the
+ * last non-space text before the brace, so this is a regular-expression
+ * heuristic, not a parser: it aims at an object literal not counting as
+ * nesting, and a `{` after `)` or `else` or on a line of its own counts.
+ */
+const LITERAL_BEFORE = /(?:[(,:=[?]|\breturn|=>|\|\||&&)\s*$/
+
 function braceDepth(body) {
   let depth = 0
   let deepest = 0
   let quote = null
+  const literal = []
   for (let i = 0; i < body.length; i += 1) {
     const ch = body[i]
     if (quote) {
@@ -27,30 +62,50 @@ function braceDepth(body) {
     }
     if (ch === '"' || ch === "'" || ch === "`") quote = ch
     else if (ch === "{") {
+      const isLiteral = LITERAL_BEFORE.test(body.slice(Math.max(0, i - 12), i))
+      literal.push(isLiteral)
+      if (isLiteral) continue
       depth += 1
       if (depth > deepest) deepest = depth
-    } else if (ch === "}") depth -= 1
+    } else if (ch === "}") {
+      if (!literal.pop()) depth -= 1
+    }
   }
   return deepest
 }
 
+/** Words that stand before `(...) {` without naming a method. */
+const NOT_A_METHOD = new Set(["if", "for", "while", "switch", "catch", "with", "function", "return", "else", "do", "try"])
+
 function jsFunctions(file) {
   const text = blankComments(file.text)
   const rows = []
-  // `function name(` and, in QML, `onSomething: {` handlers with a body block.
-  const pattern = /(?<![\w.])function\s+([A-Za-z_$][\w$]*)\s*\(|(?<![\w.])(on[A-Z]\w*)\s*:\s*(?=\{)/g
+  // Four shapes, each followed by a body block: `function name(`; in QML,
+  // `onSomething: {` handlers; a named arrow function, `const load = (rows)
+  // => {` or `this.load = rows => {` on a property; and method shorthand,
+  // `load(rows) {` at the start of a line inside an object literal or a
+  // class. An anonymous callback (`(x) => {`, `function (x) {`) has no name
+  // and is not counted; the method shape excludes the keywords that stand
+  // before `(...) {` (`if`, `for`, `while`, `switch`, `catch`).
+  const pattern = new RegExp([
+    /(?<![\w.])function\s+([A-Za-z_$][\w$]*)\s*\(/.source,
+    /(?<![\w.])(on[A-Z]\w*)\s*:\s*(?=\{)/.source,
+    /(?<![\w$])([A-Za-z_$][\w$]*)\s*=\s*(?:async\s*)?(?:\([^()\n]*\)|[A-Za-z_$][\w$]*)\s*=>[ \t]*(?=\{)/.source,
+    /^[ \t]*(?:(?:async|static)\s+)*([A-Za-z_$][\w$]*)[ \t]*\([^()\n]*\)[ \t]*(?=\{)/.source,
+  ].join("|"), "gm")
   for (const match of text.matchAll(pattern)) {
-    const open = text.indexOf("{", match.index + match[0].length - (match[2] ? 0 : 0))
+    if (match[4] && NOT_A_METHOD.has(match[4])) continue
+    const open = text.indexOf("{", match.index + match[0].length)
     if (open < 0) continue
     const end = closingBracket(text, open)
     if (end < 0) continue
     const body = text.slice(open + 1, end)
-    const start = lineOf(text, match.index)
+    const start = lineOf(text, match.index + match[0].length - match[0].trimStart().length)
     rows.push({
       file: file.path,
       line: start,
-      name: match[1] || match[2],
-      kind: match[1] ? "function" : "handler",
+      name: match[1] || match[2] || match[3] || match[4],
+      kind: match[2] ? "handler" : "function",
       lines: lineOf(text, end) - start + 1,
       depth: braceDepth(body),
       branches: (body.match(JS_BRANCH) || []).length,
@@ -59,6 +114,105 @@ function jsFunctions(file) {
   return rows
 }
 
+/**
+ * One shell line read left to right with a stack of contexts: a
+ * single-quoted string, a double-quoted string, an ANSI-C `$'...'` string,
+ * and, nested in a double-quoted string, `$(...)`, `${...}` and a
+ * backtick substitution, which is what lets `"$(printf "it's")"` and
+ * `"${x:-"it's"}"` read their inner quotes as their own. It returns the
+ * code before a `#` that starts a comment, the heredoc the line opens, and
+ * the contexts left open at its end. Quoted text is data and left out of
+ * the code, whether the quote closes on the line or spans lines (the
+ * heredoc delimiter is read here, before the quotes go, so `<<'PY'` and
+ * `<<PY` read alike), while what a substitution holds is shell and kept. A `'` inside double quotes
+ * ("Okomart's") and a `#` inside quotes (`*'#'*`) are text; a backslash
+ * escapes in code, inside double quotes and inside `$'...'`, and inside
+ * plain single quotes nothing does. `<<` in shell, at the top or inside a
+ * substitution, and outside `(( ))`, is a heredoc.
+ * @param {string} line
+ * @param {Array<{ kind: string, depth: number }>} open the contexts open from the line above, innermost last
+ * @returns {{ code: string, open: Array<{ kind: string, depth: number }>, heredoc: { word: string, strip: boolean } | null }}
+ */
+function scanShellLine(line, open) {
+  const stack = open.map((entry) => ({ ...entry }))
+  let code = ""
+  let heredoc = null
+  // Depth of `((` arithmetic on this line, inside which `<<` is a shift.
+  let arith = 0
+  const top = () => stack[stack.length - 1] || null
+  const isCode = (kind) => kind === "code" || kind === "$(" || kind === "${" || kind === "`"
+  // Text inside a string is data; text in shell, nested or not, is kept.
+  const keep = () => {
+    const inner = top()
+    return !inner || isCode(inner.kind)
+  }
+  for (let i = 0; i < line.length; i += 1) {
+    const ch = line[i]
+    const context = top()
+    const kind = context ? context.kind : "code"
+    if (kind === "'") {
+      if (ch === "'") stack.pop()
+      else if (keep()) code += ch
+      continue
+    }
+    if (ch === "\\") {
+      i += 1
+      if (keep()) code += ch + (line[i] ?? "")
+      continue
+    }
+    if (kind === '"' || kind === "$'") {
+      if (ch === kind[kind.length - 1]) stack.pop()
+      else if (kind === '"' && ch === "$" && (line[i + 1] === "(" || line[i + 1] === "{")) {
+        stack.push({ kind: `$${line[i + 1]}`, depth: 0 })
+        code += `$${line[i + 1]}`
+        i += 1
+        // `$((` under a quote is arithmetic: its `<<` is a shift.
+        if (line[i] === "(" && line[i + 1] === "(") arith += 1
+      } else if (kind === '"' && ch === "`") {
+        stack.push({ kind: "`", depth: 0 })
+        code += ch
+      } else if (keep()) code += ch
+      continue
+    }
+    // Shell code: at the top, or inside a substitution under a double quote.
+    if (kind === "$(" || kind === "${") {
+      const [opener, closer] = kind === "$(" ? ["(", ")"] : ["{", "}"]
+      if (ch === opener) context.depth += 1
+      else if (ch === closer) {
+        if (context.depth === 0) {
+          stack.pop()
+          code += ch
+          continue
+        }
+        context.depth -= 1
+      }
+    } else if (kind === "`" && ch === "`") {
+      stack.pop()
+      code += ch
+      continue
+    }
+    if (ch === "#" && (i === 0 || /[\s;()&|]/.test(line[i - 1]))) break
+    if (ch === "'" || ch === '"') {
+      stack.push({ kind: ch === "'" && line[i - 1] === "$" ? "$'" : ch, depth: 0 })
+      continue
+    }
+    if (ch === "(" && line[i + 1] === "(") arith += 1
+    else if (ch === ")" && line[i + 1] === ")" && arith) arith -= 1
+    if (ch === "<" && line[i + 1] === "<" && line[i - 1] !== "<" && line[i + 2] !== "<" && !heredoc && !arith) {
+      const found = line.slice(i).match(HEREDOC)
+      if (found) heredoc = { word: found[3] || found[4], strip: found[1] === "-" }
+    }
+    code += ch
+  }
+  return { code, open: stack.map(({ kind, depth }) => ({ kind, depth })), heredoc }
+}
+
+/** The code with any guard tail removed, so what is left is what SHELL_BRANCH reads. */
+function withoutGuards(code) {
+  // The one guard at the end: `a || b && return` is one guard over a real `||`.
+  return code.trimEnd().replace(SHELL_GUARD, "").trimEnd()
+}
+
 function shellFunctions(file) {
   const lines = file.text.split("\n")
   const rows = []
@@ -72,18 +226,37 @@ function shellFunctions(file) {
     let depth = 0
     let deepest = 0
     let branches = 0
+    // Data inside the function is not shell: the body of a heredoc up to its
+    // delimiter alone on a line (leading tabs allowed after `<<-`), and
+    // quoted text, on one line or spanning lines (an awk or python program
+    // in single quotes, a remote command in double quotes). Those count
+    // toward the length and toward nothing else; the shell around them,
+    // and inside a substitution nested in them, is read. Two heredocs on
+    // one line: the first is tracked, the second's body is read as shell.
+    let heredoc = null
+    let open = []
     for (let at = index + 1; at < lines.length; at += 1) {
       const line = lines[at]
-      if (line.trim() === "}" && line.startsWith(indent) && line.match(/^\s*/)[0].length === indent.length) {
+      if (heredoc) {
+        if ((heredoc.strip ? line.replace(/^\t+/, "") : line) === heredoc.word) heredoc = null
         end = at
-        break
+        continue
       }
-      if (SHELL_OPEN.test(line)) {
-        depth += 1
-        if (depth > deepest) deepest = depth
+      if (!open.length && SHELL_END.test(line.trim()) && line.startsWith(indent) && line.match(/^\s*/)[0].length === indent.length) {
+        end = at
+        break
       }
-      if (SHELL_CLOSE.test(line)) depth -= 1
-      if (SHELL_BRANCH.test(line.split("#")[0])) branches += 1
+      const scanned = scanShellLine(line, open)
+      const code = withoutGuards(scanned.code)
+      open = scanned.open
+      heredoc = scanned.heredoc
+      // A line that opens inside a string is read only after the string closes: no `if` at its start, only what the code holds.
+      // The line's net over its code: `if x; then y; fi` on one line is no level.
+      const net = (code.match(SHELL_OPEN) || []).length - (code.match(SHELL_CLOSE) || []).length
+      // Never below the body: a close the scanner misread cannot hide every later level.
+      depth = Math.max(0, depth + net)
+      if (depth > deepest) deepest = depth
+      if (SHELL_BRANCH.test(code)) branches += 1
       end = at
     }
     rows.push({ file: file.path, line: index + 1, name, kind: "function", lines: end - index + 1, depth: deepest, branches })
@@ -92,24 +265,117 @@ function shellFunctions(file) {
   return rows
 }
 
+/**
+ * Opening brackets minus closing ones on a line, outside string literals
+ * and comments, carrying the state of a triple-quoted string across lines
+ * so a bracket inside a docstring or an SQL text counts nothing; and the
+ * code of the line with its strings and comment removed, so `and`, `or`
+ * and `if` in prose are not branches.
+ * @param {string} line
+ * @param {string|null} triple the triple quote open from the line above, or null
+ * @returns {{ balance: number, triple: string|null, continued: boolean, code: string }} `continued` when the line ends in a backslash outside a string
+ */
+function bracketBalance(line, triple) {
+  let balance = 0
+  let quote = triple
+  let code = ""
+  let i = 0
+  for (; i < line.length; i += 1) {
+    const ch = line[i]
+    if (quote) {
+      if (ch === "\\") i += 1
+      else if (quote.length === 3 ? line.startsWith(quote, i) : ch === quote) {
+        i += quote.length - 1
+        quote = null
+      }
+      continue
+    }
+    if (ch === "#") break
+    if (ch === '"' || ch === "'") {
+      quote = line.startsWith(ch.repeat(3), i) ? ch.repeat(3) : ch
+      i += quote.length - 1
+      continue
+    }
+    if (ch === "(" || ch === "[" || ch === "{") balance += 1
+    else if (ch === ")" || ch === "]" || ch === "}") balance -= 1
+    code += ch
+  }
+  // A single quote never spans a line; a triple one does.
+  const open = quote && quote.length === 3 ? quote : null
+  return { balance, triple: open, continued: !open && /\\$/.test(code.trimEnd()), code }
+}
+
+const PY_DEF = /^(\s*)(?:async\s+)?def\s+([A-Za-z_]\w*)\s*\(/
+const PY_CLOSER = /^\s*[)\]}]/
+
 function pythonFunctions(file) {
   const lines = file.text.split("\n")
   const rows = []
+  // Whether each line starts inside a triple-quoted string, over the whole
+  // file, so a `def` quoted in a docstring's example is not a function.
+  const quoted = new Array(lines.length)
+  let moduleTriple = null
+  for (let at = 0; at < lines.length; at += 1) {
+    quoted[at] = moduleTriple !== null
+    moduleTriple = bracketBalance(lines[at], moduleTriple).triple
+  }
   for (let index = 0; index < lines.length; index += 1) {
-    const head = lines[index].match(/^(\s*)(?:async\s+)?def\s+([A-Za-z_]\w*)\s*\(/)
+    if (quoted[index]) continue
+    const head = lines[index].match(PY_DEF)
     if (!head) continue
     const base = head[1].length
     let end = index
     let deepest = 0
     let branches = 0
+    // Depth is relative to the body, the way it is for a brace block: the
+    // body's own indent is depth 0 and one `if` is depth 1. The unit is
+    // one indentation step, read from the first body line (4 spaces by
+    // PEP 8, 2 in some trees); 4 is assumed when there is no body line.
+    let unit = 4
+    let first = true
+    // A line that starts while a bracket is open, inside a triple-quoted
+    // string, or after a line ending in a backslash is a continuation of
+    // the statement above it (the arguments of a multi-line call, a
+    // docstring, a split condition): it counts toward the length and the
+    // branches, never toward depth, and never sets the unit. The def's own
+    // parameter list, when it spans lines, is a continuation of the def.
+    // The balance is over `(`, `[` and `{` minus their closers, outside
+    // string literals, the way braceDepth skips quotes. A miscount cannot
+    // run past the function: a bracket or backslash continuation ends at
+    // the first line at the def's indent or shallower that is not a
+    // closing bracket, whatever the balance says; a triple-quoted string
+    // runs to its close, since an SQL or help text inside it may sit at
+    // column 0.
+    let state = bracketBalance(lines[index], null)
+    let balance = Math.max(0, state.balance)
+    let triple = state.triple
+    let continued = state.continued
     for (let at = index + 1; at < lines.length; at += 1) {
       const line = lines[at]
       if (!line.trim()) continue
       const indent = line.match(/^\s*/)[0].length
+      const continuation = balance > 0 || triple !== null || continued
+      if (continuation && triple === null && indent <= base && !PY_CLOSER.test(line)) break
+      state = bracketBalance(line, triple)
+      if (continuation) {
+        balance = Math.max(0, balance + state.balance)
+        triple = state.triple
+        continued = state.continued
+        if (PY_BRANCH.test(state.code)) branches += 1
+        end = at
+        continue
+      }
       if (indent <= base) break
-      const level = Math.floor((indent - base) / 4)
+      balance = Math.max(0, state.balance)
+      triple = state.triple
+      continued = state.continued
+      if (first) {
+        unit = indent - base
+        first = false
+      }
+      const level = Math.max(0, Math.floor((indent - base) / unit) - 1)
       if (level > deepest) deepest = level
-      if (PY_BRANCH.test(line)) branches += 1
+      if (PY_BRANCH.test(state.code)) branches += 1
       end = at
     }
     rows.push({ file: file.path, line: index + 1, name: head[2], kind: "function", lines: end - index + 1, depth: deepest, branches })

package/tools/inspect/inspect.mjs

@@ -3,7 +3,8 @@
 // the commit, run the four extractors over every file inspect reads, run
 // the marketplace's own baseline through `verify` for the capabilities,
 // and build the document of docs/INSPECT.md. No verdict, and the one score
-// a position among listed plugins, never a grade: every
+// a position among listed trees by how much of its function text is in
+// long functions, never a grade: every
 // row is a fact the text shows, labelled observed, and the document ends
 // with what the method cannot see.
 //
@@ -23,7 +24,7 @@ import { extractHosts } from "./hosts.mjs"
 import { extractWrites } from "./writes.mjs"
 import { extractTimers } from "./timers.mjs"
 import { extractFunctions } from "./functions.mjs"
-import { evaluatePatterns, overSize, PATTERNS, rankOf, SIZE, sizeScore } from "./patterns.mjs"
+import { evaluatePatterns, heavyShare, overSize, PATTERNS, rankOf, SIZE, sizeScore } from "./patterns.mjs"
 
 export const METHOD = "static extraction, regular expressions over qml and shell; observed, not executed"
 
@@ -62,6 +63,9 @@ export async function inspectPlugin({ repoRoot, target, offline = false, allowDi
   try {
     subject = resolveSubject(target, { cacheRoot, allowDirty })
   } catch (error) {
+    if (error instanceof SubjectError && error.code === "dirty-worktree") {
+      throw new InspectError(error.code, error.message.replace("read HEAD as committed", "inspect HEAD as committed"), "Commit them, or pass --allow-dirty to inspect HEAD as committed; uncommitted edits are not read.")
+    }
     if (error instanceof SubjectError) throw new InspectError(error.code, error.message)
     throw error
   }
@@ -128,6 +132,10 @@ export async function inspectPlugin({ repoRoot, target, offline = false, allowDi
       mode: subject.mode,
       pluginId,
       filesRead: tree.filesRead,
+      // Paths `git status` lists at the checkout, under --allow-dirty: the
+      // tree was read at the commit, so these were not inspected. 0 for a
+      // clean checkout and for a fetched commit.
+      uncommittedFiles: subject.uncommittedFiles,
     },
     observed: { processes, hosts, writes, timers, functions },
     // Size: the functions over the M12 thresholds, longest first. A count of
@@ -135,11 +143,16 @@ export async function inspectPlugin({ repoRoot, target, offline = false, allowDi
     // 100 functions in listed trees stay under; never a judgement.
     size: {
       measurement: SIZE.measurement,
-      sample: { trees: SIZE.trees, functions: SIZE.functions },
+      // The listed trees' own heavy shares, in the record's row order and
+      // only for the trees with a function, so the score can be read from
+      // the document alone.
+      sample: { trees: SIZE.trees, functions: SIZE.functions, heavyShares: [...SIZE.distribution.heavyShare] },
       thresholds: { lines: SIZE.lines, branches: SIZE.branches, depth: SIZE.depth },
-      // 10 minus the mean rank of this tree's functions among the listed
-      // ones: where the tree sits, never whether it is good; null with no
+      // The share of this tree's function lines inside functions over the
+      // thresholds, and 10 minus its rank among the listed trees' shares:
+      // where the tree sits, never whether it is good; null with no
       // function to rank.
+      heavyShare: Math.round(heavyShare(functions) * 10000) / 10000,
       score: sizeScore(functions),
       over: overSize(functions),
     },

package/tools/inspect/measure-functions.mjs

@@ -0,0 +1,159 @@
+// M12 reproduction: how long a plugin's functions are, in listed trees.
+// The selection rule is the record's: the first 50 distinct community
+// repositories in the pinned catalog's order, laid out as a root plugin and
+// carrying a validated commit, each fetched read-only at that commit in
+// reviewer mode through tools/subject/resolve.mjs and read from the Git
+// object database through walk.mjs. `extractFunctions` runs over every
+// file inspect reads; nothing from a tree is executed. The record carries
+// no repository or commit: the rule reproduces the set.
+//
+// Writes docs/evidence/inspect/<date>-function-lengths.json (or --out FILE)
+// and prints the quantiles to stderr. The three p90 quantiles and the three
+// histograms replace the constants in patterns.mjs SIZE, and the per-tree
+// heavyShare list its SIZE.distribution.heavyShare; tests/unit/submit.test.mjs
+// holds them equal to the record.
+
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs"
+import { dirname, join, resolve } from "node:path"
+import { pathToFileURL } from "node:url"
+import { requirePin } from "../marketplace/pin.mjs"
+import { CATALOG_PATH } from "../marketplace/registry.mjs"
+import { omakitCacheDir } from "../marketplace/paths.mjs"
+import { resolveSubject } from "../subject/resolve.mjs"
+import { walkSubject } from "./walk.mjs"
+import { extractFunctions } from "./functions.mjs"
+
+export const TREES = 50
+const KINDS = ["qml", "js", "shell", "python"]
+
+/** The nearest-rank quantile of a sorted list: the value at position ceil(p * n). */
+export function quantile(sorted, p) {
+  if (!sorted.length) return null
+  return sorted[Math.max(0, Math.ceil(p * sorted.length) - 1)]
+}
+
+/** Value to count, keys in ascending numeric order. */
+export function histogram(values) {
+  const counts = new Map()
+  for (const value of values) counts.set(value, (counts.get(value) || 0) + 1)
+  return Object.fromEntries([...counts.entries()].sort((a, b) => a[0] - b[0]).map(([value, count]) => [String(value), count]))
+}
+
+/**
+ * The record's selection: catalog order, community listings laid out as a
+ * root plugin with a validated commit, one entry per repository, the first
+ * `count`.
+ */
+export function selectTrees(catalog, count = TREES) {
+  const seen = new Set()
+  const picked = []
+  for (const plugin of Array.isArray(catalog.plugins) ? catalog.plugins : []) {
+    if (plugin.sourceType !== "community" || plugin.repositoryLayout !== "root-plugin") continue
+    if (typeof plugin.repo !== "string" || !/^[0-9a-f]{40}$/i.test(String(plugin.listingValidatedCommit || ""))) continue
+    if (seen.has(plugin.repo)) continue
+    seen.add(plugin.repo)
+    picked.push({ repo: plugin.repo, commit: plugin.listingValidatedCommit.toLowerCase() })
+    if (picked.length === count) break
+  }
+  return picked
+}
+
+/** Lines inside functions over any threshold, over lines inside every function; 0 with no function. */
+export function heavyLinesOf(functions, thresholds) {
+  return functions.filter((row) => row.lines > thresholds.lines || row.branches > thresholds.branches || row.depth > thresholds.depth).reduce((sum, row) => sum + row.lines, 0)
+}
+
+const median = (values) => {
+  if (!values.length) return null
+  const sorted = [...values].sort((a, b) => a - b)
+  const mid = Math.floor(sorted.length / 2)
+  return sorted.length % 2 ? sorted[mid] : (sorted[mid - 1] + sorted[mid]) / 2
+}
+
+/**
+ * @param {Array<{ functions: Array, byKind?: object }>} trees the functions of each tree, in selection order
+ * @param {{ fetchFailed?: string[], date?: string, previous?: string }} [meta]
+ * @returns {object} the record
+ */
+export function buildRecord(trees, { fetchFailed = [], date = new Date().toISOString().slice(0, 10), previous = null } = {}) {
+  const pooled = trees.flatMap((tree) => tree.functions)
+  const sorted = (measure) => pooled.map((row) => row[measure]).sort((a, b) => a - b)
+  const lines = sorted("lines")
+  const depth = sorted("depth")
+  const branches = sorted("branches")
+  const quantiles = {
+    lines: { p50: quantile(lines, 0.5), p75: quantile(lines, 0.75), p90: quantile(lines, 0.9), p95: quantile(lines, 0.95), max: lines.at(-1) ?? null },
+    depth: { p50: quantile(depth, 0.5), p90: quantile(depth, 0.9), max: depth.at(-1) ?? null },
+    branches: { p50: quantile(branches, 0.5), p90: quantile(branches, 0.9), max: branches.at(-1) ?? null },
+  }
+  const thresholds = { lines: quantiles.lines.p90, branches: quantiles.branches.p90, depth: quantiles.depth.p90 }
+  const rows = trees.map((tree, index) => {
+    const functionLines = tree.functions.reduce((sum, row) => sum + row.lines, 0)
+    const heavyLines = heavyLinesOf(tree.functions, thresholds)
+    return {
+      row: index + 1,
+      functions: tree.functions.length,
+      byKind: Object.fromEntries(KINDS.map((kind) => [kind, tree.byKind?.[kind] ?? 0])),
+      longest: tree.functions.length ? Math.max(...tree.functions.map((row) => row.lines)) : 0,
+      medianLines: median(tree.functions.map((row) => row.lines)),
+      functionLines,
+      heavyLines,
+      // null, not 0, with no function: a tree with nothing to measure did not measure light.
+      heavyShare: functionLines ? Math.round((heavyLines / functionLines) * 10000) / 10000 : null,
+    }
+  })
+  return {
+    measurement: "M12",
+    date,
+    command: "node tools/inspect/measure-functions.mjs",
+    method: [
+      `extractFunctions from tools/inspect/functions.mjs over the first ${trees.length} distinct repositories in the pinned catalog's order whose listing is community, laid out as a root plugin and carrying a validated commit (the 2026-09-15 inspect record's rule), each fetched read-only at that commit in reviewer mode.`,
+      "A function is a `function name(`, a named arrow function (`const load = (rows) => {`, `this.load = rows => {`), a method shorthand `load(rows) {` inside an object literal or a class, or a multi-line `onSomething: {` handler in QML and JavaScript; a `name() {` or `function name` block in shell; a `def` in Python. Anonymous callbacks are not counted.",
+      "Lines are first to last line inclusive; depth is the deepest nesting below the body, the body itself at 0 in every language, a brace that opens an object or array literal or an inline arrow body not a level; branches count if, else if, for, while, switch, case, catch, &&, || and ?: (their shell and Python equivalents).",
+      "In shell, a `||` or `&&` followed by one flow word (return, exit, continue, break, true, false, :) with an optional status (a number, `$?` or a variable) and nothing else on the line but a `;` or `;;` is a guard and not a branch, one per line at its end, so `x && return 0 || return 1` keeps its `&&`; the body of a heredoc (`<<WORD`, `<<-WORD`, quoted or backslashed, outside quotes and outside arithmetic) up to its delimiter alone on a line, and a quoted string that spans lines from its opening quote to the line that closes it, count toward the length and toward nothing else, while a `$(...)`, `${...}` or backtick substitution nested in a string reads its own quotes and, spanning lines, is shell and read as shell; a case arm is a `)` with text after it on a line with no `(` before it but its own opening one; a block opens with `if`, `for`, `while`, `until`, `case` or `select` and closes with `fi`, `done` or `esac`, each counted only where a statement can start over the line with its quoted text removed, so a block that opens and closes on one line is no level and a keyword inside a string or as an argument is nothing.",
+      "In Python, a line that starts while a bracket is open, inside a triple-quoted string, or after a line ending in a backslash is a continuation of the statement above it, and a def's own parameter list spanning lines is a continuation of the def: it counts toward the length and the branches and never toward nesting; a bracket or backslash continuation ends at the first line at the def's indent that is not a closing bracket, a triple-quoted string at its close. Branch words inside strings, docstrings and comments are prose, not branches, and a def quoted in a docstring is not a function.",
+      "Quantiles are nearest-rank over every function in the sample pooled, not per tree. `distribution` is the histogram of each measure over the same functions, value to count, from which a function's percentile rank is read.",
+      "Per tree, functionLines is the lines inside every function, heavyLines the lines inside functions over any p90 threshold of this record, and heavyShare their ratio, null with no function; the size score of omakit inspect is a tree's position among the non-null heavyShares.",
+    ].join(" "),
+    sample: { trees: trees.length, functions: pooled.length, fetchFailed },
+    quantiles,
+    distribution: { lines: histogram(lines), branches: histogram(branches), depth: histogram(depth) },
+    rows,
+    notes: `Rows carry no repository or commit; the selection rule reproduces the set. A function count and a longest length per tree are counts of what the extraction saw, not a judgement of any plugin.${previous ? ` ${previous}` : ""}`,
+  }
+}
+
+const PREVIOUS = "Re-measured on 2026-09-16 after three extraction fixes, so the quantiles are not comparable with the 0.4.3 record (this file at commit 6619c26: 50 trees, 6040 functions, p90 22 lines, 6 branches, nesting 3; and before it 18 trees, 715 functions, p90 18 lines, 7 branches, nesting 2): a Python body now starts at depth 0 the way a brace body does, where it started at 1; a brace that opens an object or array literal is no longer a nesting level; and a named arrow function or a method shorthand is a function, where only `function name(` and `onSomething: {` were. Re-measured again for 0.5.1 after more (the 0.5.0 record is this file at commit 7df451a: 6041 functions, p90 22 lines, 6 branches, nesting 2, six heavyShares of 0 among 50): a Python continuation line inside an open bracket, a triple-quoted string or after a backslash no longer counts as nesting, and a def whose parameter list spans lines is read through to its body where before only the signature was, which is what moved the line p90 from 22 to 25; branch words in Python strings and docstrings are prose; a shell heredoc body and a quoted program spanning lines are no longer read as shell; a shell guard (`|| return 1`) is no longer a branch; and a tree with no function carries heavyShare null instead of 0, so it no longer lifts every other tree's rank. The earlier 0.5.1 cuts, never released, are in this file's history, each corrected by the next: one read a `\"` inside a string and a `\"\"\"` inside a bracket wrongly and stretched two listed Python functions (101 to 133 and 128 to 162 lines); one still read `<<` in arithmetic and a quote inside `$(...)` inside a string wrongly, and counted docstring prose as branches; one counted `if x; then y; fi` on one line as a nesting level; and one closed a block on `done` as a plain argument and peeled two guards from one line."
+
+export async function measureFunctions(repoRoot, { count = TREES, cacheRoot = omakitCacheDir(), log = () => {} } = {}) {
+  const pin = requirePin(repoRoot)
+  const catalog = JSON.parse(readFileSync(join(pin.dir, CATALOG_PATH), "utf8"))
+  const selected = selectTrees(catalog, count)
+  const trees = []
+  const fetchFailed = []
+  for (const [index, entry] of selected.entries()) {
+    log(`${index + 1}/${selected.length} ${entry.repo}@${entry.commit.slice(0, 8)}`)
+    let subject
+    try {
+      subject = resolveSubject(`${entry.repo}@${entry.commit}`, { cacheRoot })
+    } catch (error) {
+      fetchFailed.push(`row ${index + 1}: ${error.code || "error"}`)
+      continue
+    }
+    const tree = walkSubject(subject)
+    const functions = tree.files.flatMap((file) => extractFunctions(file).map((row) => ({ ...row, fileKind: file.kind })))
+    const byKind = Object.fromEntries(KINDS.map((kind) => [kind, functions.filter((row) => row.fileKind === kind).length]))
+    trees.push({ functions, byKind })
+  }
+  return buildRecord(trees, { fetchFailed, previous: PREVIOUS })
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  const repoRoot = resolve(process.cwd())
+  const record = await measureFunctions(repoRoot, { log: (text) => process.stderr.write(`${text}\n`) })
+  const at = process.argv.indexOf("--out")
+  const evidencePath = resolve(at > 0 && process.argv[at + 1] ? process.argv[at + 1] : join(repoRoot, "docs/evidence/inspect", `${record.date}-function-lengths.json`))
+  mkdirSync(dirname(evidencePath), { recursive: true })
+  writeFileSync(evidencePath, `${JSON.stringify(record, null, 2)}\n`)
+  process.stderr.write(`${record.sample.trees} trees, ${record.sample.functions} functions; p90 ${record.quantiles.lines.p90} lines, ${record.quantiles.branches.p90} branches, nesting ${record.quantiles.depth.p90}; ${record.sample.fetchFailed.length} fetch failures\n${evidencePath}\n`)
+}

package/tools/inspect/patterns.mjs

@@ -89,18 +89,23 @@ function secretLogs(files) {
  */
 export const SIZE = Object.freeze({
   measurement: "M12",
-  sample: "50 listed trees, 6040 functions",
+  sample: "50 listed trees, 6034 functions",
   trees: 50,
-  functions: 6040,
-  lines: 22,
+  functions: 6034,
+  lines: 25,
   branches: 6,
-  depth: 3,
-  // The histogram of each measure over the 6040 functions, value to count,
-  // from which a function's percentile rank among listed functions is read.
+  depth: 2,
+  // The histogram of each measure over the 6034 functions, value to count,
+  // from which a function's percentile rank among listed functions is read;
+  // and each listed tree's heavyShare, the share of its function lines in
+  // functions over the thresholds, in the record's row order and only for
+  // the trees with a function (a tree with nothing to measure has no
+  // share), from which a tree's position among listed trees is read.
   distribution: Object.freeze({
-    lines: Object.freeze({ 1: 330, 2: 185, 3: 682, 4: 659, 5: 629, 6: 514, 7: 420, 8: 339, 9: 301, 10: 235, 11: 192, 12: 138, 13: 150, 14: 129, 15: 104, 16: 75, 17: 84, 18: 64, 19: 70, 20: 48, 21: 51, 22: 46, 23: 45, 24: 42, 25: 27, 26: 25, 27: 16, 28: 24, 29: 24, 30: 17, 31: 18, 32: 23, 33: 18, 34: 19, 35: 10, 36: 5, 37: 11, 38: 12, 39: 12, 40: 9, 41: 10, 42: 12, 43: 9, 44: 8, 45: 7, 46: 14, 47: 8, 48: 11, 49: 8, 50: 6, 51: 2, 52: 2, 53: 6, 54: 2, 55: 7, 56: 4, 57: 3, 58: 5, 60: 6, 61: 2, 62: 3, 63: 6, 64: 1, 65: 3, 66: 1, 67: 3, 68: 4, 69: 8, 70: 5, 71: 6, 72: 2, 73: 2, 74: 1, 75: 1, 76: 1, 77: 1, 78: 1, 79: 3, 80: 1, 81: 3, 82: 1, 83: 1, 85: 1, 87: 1, 89: 1, 90: 2, 91: 2, 92: 1, 94: 1, 96: 2, 97: 2, 98: 1, 99: 1, 100: 1, 101: 1, 102: 2, 104: 1, 108: 1, 110: 2, 111: 1, 112: 1, 113: 1, 115: 2, 116: 1, 117: 1, 119: 1, 120: 1, 121: 1, 128: 2, 129: 1, 133: 1, 134: 1, 144: 1, 145: 1, 154: 1, 161: 1, 173: 1, 253: 1, 277: 1, 292: 1, 365: 1, 495: 1 }),
-    branches: Object.freeze({ 0: 2336, 1: 1096, 2: 807, 3: 454, 4: 339, 5: 233, 6: 171, 7: 125, 8: 90, 9: 68, 10: 47, 11: 53, 12: 24, 13: 26, 14: 18, 15: 11, 16: 17, 17: 18, 18: 12, 19: 12, 20: 11, 21: 3, 22: 5, 23: 7, 24: 8, 25: 4, 26: 1, 27: 6, 28: 4, 29: 5, 31: 1, 32: 3, 33: 3, 34: 1, 35: 1, 36: 4, 37: 1, 38: 1, 40: 1, 41: 1, 43: 2, 44: 1, 45: 2, 46: 1, 64: 1, 75: 1, 78: 1, 85: 1, 87: 2 }),
-    depth: Object.freeze({ 0: 2606, 1: 1938, 2: 859, 3: 327, 4: 133, 5: 71, 6: 60, 7: 26, 8: 8, 9: 6, 10: 2, 13: 2, 15: 1, 18: 1 }),
+    lines: Object.freeze({ 1: 330, 2: 157, 3: 667, 4: 620, 5: 584, 6: 508, 7: 413, 8: 337, 9: 301, 10: 238, 11: 195, 12: 138, 13: 152, 14: 131, 15: 106, 16: 75, 17: 86, 18: 62, 19: 71, 20: 57, 21: 51, 22: 56, 23: 47, 24: 44, 25: 33, 26: 28, 27: 24, 28: 26, 29: 27, 30: 17, 31: 21, 32: 22, 33: 18, 34: 23, 35: 11, 36: 5, 37: 16, 38: 13, 39: 13, 40: 9, 41: 13, 42: 12, 43: 11, 44: 9, 45: 8, 46: 14, 47: 8, 48: 11, 49: 7, 50: 6, 51: 1, 52: 2, 53: 6, 54: 3, 55: 7, 56: 4, 57: 3, 58: 5, 59: 3, 60: 8, 61: 5, 62: 3, 63: 6, 64: 2, 65: 3, 66: 1, 67: 3, 68: 4, 69: 9, 70: 7, 71: 7, 72: 3, 73: 3, 74: 3, 75: 1, 76: 1, 77: 2, 78: 2, 79: 3, 80: 3, 81: 4, 82: 3, 83: 1, 85: 1, 86: 3, 87: 3, 88: 1, 89: 1, 90: 3, 91: 2, 92: 2, 93: 2, 94: 1, 96: 3, 97: 2, 98: 1, 99: 1, 100: 1, 101: 3, 102: 2, 104: 2, 107: 2, 108: 1, 109: 2, 110: 2, 111: 2, 112: 2, 113: 2, 115: 3, 116: 1, 117: 2, 119: 1, 120: 1, 121: 1, 125: 1, 126: 1, 128: 2, 129: 1, 133: 1, 134: 1, 142: 1, 144: 1, 145: 1, 154: 1, 155: 1, 161: 2, 173: 1, 217: 2, 253: 1, 272: 1, 277: 1, 290: 1, 292: 1, 298: 1, 325: 1, 365: 1, 495: 1 }),
+    branches: Object.freeze({ 0: 2302, 1: 1130, 2: 828, 3: 457, 4: 344, 5: 221, 6: 180, 7: 127, 8: 83, 9: 70, 10: 48, 11: 48, 12: 24, 13: 30, 14: 20, 15: 10, 16: 14, 17: 10, 18: 12, 19: 8, 20: 6, 21: 4, 22: 5, 23: 5, 24: 7, 25: 4, 26: 2, 27: 7, 28: 5, 29: 2, 31: 1, 32: 2, 33: 2, 35: 1, 36: 3, 38: 1, 39: 1, 40: 1, 41: 1, 43: 1, 45: 2, 55: 1, 64: 1, 75: 1, 78: 1, 85: 1 }),
+    depth: Object.freeze({ 0: 3854, 1: 1478, 2: 482, 3: 140, 4: 47, 5: 27, 6: 5, 7: 1 }),
+    heavyShare: Object.freeze([0.421, 0.3361, 0.4049, 0, 0.2979, 0.3647, 0.4107, 0.6167, 0.2635, 0.8434, 0, 0, 0.193, 0.6399, 0.4063, 0.4769, 0.4322, 0.5337, 0.3628, 0.6626, 0.0554, 0.7775, 0.3548, 0.3285, 0, 0.6801, 0.2222, 0.3084, 0.3705, 0.6468, 0.3928, 0.6786, 0.3247, 0.5225, 0, 0.1462, 0, 0.5817, 0.5891, 0.3835, 0.2491, 0.5627, 0.2439, 0.3643, 0.6719, 0.6525, 0.4385, 0.565, 0.5672]),
   }),
 })
 
@@ -123,16 +128,42 @@ export function rankOf(entry) {
 }
 
 /**
- * The size score of a tree: 10 minus the mean rank of its functions among
- * the 6040 listed ones, on 0 to 10 with two decimals. A tree of median
- * functions scores 5.00; every function made shorter, flatter or less
- * branched raises it. It says where the tree sits among listed plugins,
- * never whether it is good, and a tree with no function has no score.
+ * The share of a tree's function lines that sit in functions over any of
+ * the M12 thresholds: lines inside `overSize` functions over lines inside
+ * every function, 0 with no function. Line-weighted on purpose: splitting
+ * one long function into short ones moves its lines out of the heavy set,
+ * and padding a tree with small functions barely moves the ratio.
+ */
+export function heavyShare(functions) {
+  const total = functions.reduce((sum, entry) => sum + entry.lines, 0)
+  if (!total) return 0
+  const heavy = overSize(functions).reduce((sum, entry) => sum + entry.lines, 0)
+  return heavy / total
+}
+
+/**
+ * The share of listed trees whose heavyShare is strictly smaller than this
+ * one, as a percentage over the listed trees that have a share: 0 for a
+ * tree with no function over the thresholds, 100 for one heavier than
+ * every listed tree.
+ */
+export function treeRank(share) {
+  const shares = SIZE.distribution.heavyShare
+  const below = shares.filter((listed) => listed < share).length
+  return Math.round((below / shares.length) * 1000) / 10
+}
+
+/**
+ * The size score of a tree: 10 minus its rank among the listed trees
+ * divided by 10, on 0 to 10 with two decimals. A tree with no function
+ * over the thresholds scores 10.00, a tree heavier than every listed tree
+ * 0.00. It says where the tree sits among listed plugins by how much of
+ * its function text is in long functions, never whether it is good, and a
+ * tree with no function has no score.
  */
 export function sizeScore(functions) {
   if (!functions.length) return null
-  const mean = functions.reduce((sum, entry) => sum + rankOf(entry), 0) / functions.length
-  return Math.round((10 - mean / 10) * 100) / 100
+  return Math.round((10 - treeRank(heavyShare(functions)) / 10) * 100) / 100
 }
 
 /** The functions over any of the thresholds, longest first, then most branched. */

package/tools/inspect/report.mjs

@@ -27,6 +27,34 @@ const NOTHING = "observed nothing of this kind"
 const plural = (count, word, words = `${word}s`) => `${count} ${count === 1 ? word : words}`
 const site = (row) => `${row.file}:${row.line}`
 
+/** A share as a whole percentage; one that would round to 0 or 100 says so instead of rounding past the truth. */
+function percent(share) {
+  const rounded = Math.round(share * 100)
+  if (share > 0 && rounded === 0) return "under 1%"
+  if (share < 1 && rounded === 100) return "over 99%"
+  return `${rounded}%`
+}
+
+/**
+ * The score sentence after the number: the share, then the position among
+ * the listed trees the document itself carries. The rank counts the listed
+ * trees with a strictly smaller share, so the tree is "no heavier than"
+ * the rest: a tie is level, not lighter.
+ */
+function scoreText(size) {
+  const shares = size.sample.heavyShares
+  if (!shares.length) return `${percent(size.heavyShare)} of its function lines sit in functions over the measured size; no listed tree to place it among (${size.measurement})`
+  const lighter = shares.filter((share) => share < size.heavyShare).length
+  return `${percent(size.heavyShare)} of its function lines sit in functions over the measured size, no heavier than ${shares.length - lighter} of ${shares.length} listed trees (${size.measurement})`
+}
+
+/** Under --allow-dirty: what the checkout holds that the tree at the commit does not. */
+function uncommittedLine(document, c) {
+  const count = document.subject.uncommittedFiles
+  if (!count) return []
+  return field("uncommitted", `${plural(count, "file")} differ${count === 1 ? "s" : ""} from HEAD and ${count === 1 ? "was" : "were"} not inspected; the tree at ${document.subject.commit ? document.subject.commit.slice(0, 8) : "the commit"} is what was read`, c)
+}
+
 /** A row: a mark, the site in bold, then the text, wrapped under the gutter. */
 function row(state, head, text, c, extra = []) {
   const lines = wrap(text || "(nothing)", { indent: GUTTER, first: GUTTER + head.length + 2 }, c)
@@ -233,11 +261,12 @@ export function renderInspect(document, { colour = colourEnabled(), full = false
   const out = []
   const counts = document.counts
   out.push(...field("subject", `${withHomeAbbreviated(document.subject.dir)} at ${document.subject.commit ? document.subject.commit.slice(0, 8) : "no commit"}`, c))
+  out.push(...uncommittedLine(document, c))
   out.push(...field("baseline", baselineText(document.marketplaceBaseline), c))
   const score = document.size.score
   out.push(...field("size score", score === null
     ? `none: no function to rank`
-    : `${score.toFixed(2)} of 10; 10 minus the mean rank of its ${plural(counts.functions, "function")} among ${SIZE.functions} in ${document.size.sample.trees} listed trees (${SIZE.measurement}), so a tree of median functions scores 5.00`, c))
+    : `${score.toFixed(2)} of 10; ${scoreText(document.size)}`, c))
   out.push("")
 
   const ranked = [...document.patterns].sort((a, b) => b.share - a.share)
@@ -248,7 +277,12 @@ export function renderInspect(document, { colour = colourEnabled(), full = false
   if (!ranked.length && !over.length) {
     out.push(...field("attention", `nothing: no function over the size of ${SIZE.sample} (${SIZE.measurement}), and none of the ${PATTERNS.length} classes reviewers raise shows in this tree (${PATTERNS[0]?.measurement || "M11"})`, c))
   } else {
-    out.push(...field("attention", `${over.length ? `long functions first, by length, then ` : ""}${plural(shown.length, "class", "classes")} reviewers raise, biggest first by share of review findings (${PATTERNS[0].measurement}); up to ${SHOWN_SITES} sites each`, c))
+    const classes = shown.length
+      ? `${plural(shown.length, "class", "classes")} reviewers raise, biggest first by share of review findings (${PATTERNS[0].measurement}); up to ${SHOWN_SITES} sites each`
+      : below.length
+        ? `only classes under ${Math.round(MIN_SHARE * 100)}% of review findings show (${PATTERNS[0].measurement}), counted below`
+        : `none of the classes reviewers raise shows in this tree (${PATTERNS[0].measurement})`
+    out.push(...field("attention", `${over.length ? `long functions first, by length${shown.length ? ", then " : "; "}` : ""}${classes}`, c))
   }
   // Long functions first: what the person asked about, so the order is a
   // preference and the heading says whose thresholds it uses.
@@ -300,6 +334,7 @@ function renderFull(document, { colour }) {
   const kinds = Object.entries(read).filter(([, count]) => count > 0).map(([kind, count]) => `${count} ${kind}`)
   const total = Object.values(read).reduce((sum, count) => sum + count, 0)
   out.push(...field("subject", `${withHomeAbbreviated(document.subject.dir)} at ${document.subject.commit ? document.subject.commit.slice(0, 8) : "no commit"}, ${plural(total, "file")} read${kinds.length ? ` (${kinds.join(", ")})` : ""}`, c))
+  out.push(...uncommittedLine(document, c))
   out.push(...field("method", document.method, c))
   out.push("")
 
@@ -320,7 +355,7 @@ function renderFull(document, { colour }) {
     ? `observed ${functions.length}, ${over.length} over what 90 of 100 functions in ${SIZE.sample} stay under (${SIZE.lines} lines, ${SIZE.branches} branches or nesting ${SIZE.depth}; ${SIZE.measurement}), longest first`
     : NOTHING, c))
   for (const entry of over) out.push(...row("info", `${entry.file}:${entry.line}`, `${entry.name}, ${plural(entry.lines, "line")}, ${plural(entry.branches, "branch", "branches")}, nesting ${entry.depth}, over ${entry.percentile} of 100 listed`, c))
-  if (functions.length) out.push(...wrap(`size score ${document.size.score.toFixed(2)} of 10: 10 minus the mean rank of the ${functions.length} among ${SIZE.functions} listed functions (${SIZE.measurement})`, { indent: GUTTER }, c))
+  if (functions.length) out.push(...wrap(`size score ${document.size.score.toFixed(2)} of 10: ${scoreText(document.size)}`, { indent: GUTTER }, c))
   out.push("")
   out.push(...baselineLines(document.marketplaceBaseline, c))
   out.push("")

package/tools/marketplace/README.md

@@ -68,7 +68,8 @@ the tree, no verdict:
 | `inspect/hosts.mjs` | Every `http` or `https` literal with its host, the tool it reaches, and the timeout and size-cap flags in the same argv; a host behind an expression is not resolvable, never guessed. |
 | `inspect/writes.mjs` | Write sites in QML (`FileView` with a write), shell (redirects, `tee`, `cp`, `mv`, `mkdir`, `mktemp`, `install`, `touch`), JavaScript and Python, with the controlled-directory test over the canonical path prefix and the mode the file shows. |
 | `inspect/timers.mjs` | `Timer {` blocks: interval, repeat, running, triggeredOnStart, and the handler outside the block that starts it. |
-| `inspect/functions.mjs` | Function sites: `function name(` and multi-line handlers in QML and JavaScript, shell functions, Python defs, each with its length in lines, deepest nesting and branch count. |
+| `inspect/functions.mjs` | Function sites: `function name(`, named arrow functions and method shorthand in JavaScript and QML, multi-line `onSomething: {` handlers, shell functions and Python `def`s, each with its lines, deepest nesting (a literal is not a level; a Python body starts at 0) and branch count. |
+| `inspect/measure-functions.mjs` | Reproduces M12: the first 50 listed community root-plugin trees at their validated commits, fetched read-only, `extractFunctions` over each, the quantiles, the histograms and each tree's heavy share, written to `docs/evidence/inspect/<date>-function-lengths.json`. |
 | `inspect/patterns.mjs` | The ten review classes of M11 as data: id, label, precondition over the facts, measurement, share, and the phrase for the `not observed` line. `supply-chain` cites the baseline's own findings and detects nothing. Also the M12 size thresholds as data, and the longest-first order over them. |
 | `inspect/contract.mjs` | The JSON contract of docs/INSPECT.md as a validator, run by the unit tests over every fixture document. |
 | `inspect/report.mjs` | The report for a person, drawn with `style.mjs` only: `░ info` for a fact, `▒ ?` for one that could not be read, `▓ note` for a pattern row, `▔ skip` under `--offline`, and the closing word `INSPECTED`. |

package/tools/marketplace/cli.mjs

@@ -58,7 +58,7 @@ const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..")
 const REMEDY = Object.freeze({
   "usage": "omakit help",
   "marketplace-unavailable": "omakit pin",
-  "dirty-worktree": "Commit the changes, or pass --allow-dirty to check the tree as it is.",
+  "dirty-worktree": "Commit the changes, or pass --allow-dirty to read HEAD as committed; uncommitted edits are not read.",
   "subject-not-found": "Pass a local Git repository path, or <https url>@<40-char sha>.",
   "not-a-git-repository": "Pass a local Git repository path, or <https url>@<40-char sha>.",
   "commit-not-found": "Commit first; the checks read the tree at an exact commit, never the working copy.",

package/tools/marketplace/usage.mjs

@@ -105,8 +105,9 @@ export const COMMANDS = Object.freeze([
       "each with its measured share, only where the tree shows the class.",
       "Regular expressions over QML and shell, labelled observed; runs nothing",
       "from the tree, decides nothing, exits 0 with a report and 2 when the",
-      "target cannot be read. The report opens with a size score, 10 minus",
-      "the mean rank of the tree's functions among those in listed trees,",
+      "target cannot be read. The report opens with a size score, the share",
+      "of the tree's function lines in functions over the measured size,",
+      "placed among the listed trees' shares, 10.00 with no long function;",
       "then what needs attention: functions over the measured size, longest",
       "first, then the review classes by measured share, five sites each;",
       "--full is every site with every qualifier; --json prints the document.",

package/tools/subject/resolve.mjs

@@ -55,7 +55,8 @@ function expandHome(text) {
 /**
  * @param {string} target
  * @param {{ cacheRoot: string, allowDirty?: boolean }} options
- * @returns {{ mode, dir, commit, clean, repository: { kind: "git", url: string|null, declared: boolean } }}
+ * @returns {{ mode, dir, subdir, commit, clean, uncommittedFiles: number, repository: { kind: "git", url: string|null, declared: boolean } }}
+ *   `uncommittedFiles` is the number of paths `git status --porcelain` lists, 0 for a clean or a fetched tree
  */
 export function resolveSubject(target, options) {
   const parsed = parseTarget(target)
@@ -73,8 +74,12 @@ export function resolveSubject(target, options) {
     } catch {
       throw new SubjectError("commit-not-found", `${top} has no commit yet`)
     }
-    const clean = git(top, ["status", "--porcelain"]).trim().length === 0
-    if (!clean && !options.allowDirty) throw new SubjectError("dirty-worktree", `${top} has uncommitted changes; commit them or pass --allow-dirty`)
+    // Every check reads the tree at HEAD from the object database, so an
+    // uncommitted edit is never read; the count says how many files it
+    // leaves out, and the message says so instead of promising the tree as it is.
+    const status = git(top, ["status", "--porcelain"]).split("\n").filter((line) => line.trim().length)
+    const clean = status.length === 0
+    if (!clean && !options.allowDirty) throw new SubjectError("dirty-worktree", `${top} has uncommitted changes (${status.length} ${status.length === 1 ? "file" : "files"}); commit them, or pass --allow-dirty to read HEAD as committed; uncommitted edits are not read`)
     let originUrl = null
     try {
       originUrl = git(top, ["remote", "get-url", "origin"]).trim()
@@ -88,6 +93,7 @@ export function resolveSubject(target, options) {
       subdir: resolve(parsed.path) === top ? "" : resolve(parsed.path).slice(top.length + 1),
       commit,
       clean,
+      uncommittedFiles: status.length,
       repository: { kind: "git", url: gh ? gh.url : null, declared: Boolean(gh) },
     }
   }
@@ -119,6 +125,7 @@ export function resolveSubject(target, options) {
     subdir: "",
     commit: parsed.commit,
     clean: true,
+    uncommittedFiles: 0,
     repository: { kind: "git", url: gh.url, declared: true },
   }
 }