omakit 0.6.10 → 0.6.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omakit",
-  "version": "0.6.10",
+  "version": "0.6.11",
   "description": "Tested plumbing, the marketplace's own checks, and a disposable Omarchy to test in.",
   "license": "MIT",
   "author": "Maarten Tolhuijs",

package/tools/blocks/commit.json

@@ -1,5 +1,5 @@
 {
-  "commit": "517b87d52ba42465a12ab5722e979ed6f8d27805",
-  "recordedAt": "2026-10-01T02:52:49.108Z",
+  "commit": "134073bfe9da1073721c0a7e9905c15dea0c7176",
+  "recordedAt": "2026-10-01T04:06:29.378Z",
   "how": "Written by `node tools/blocks/record-commit.mjs` in the release workflow before `npm pack`, so a packaged omakit, which has no Git checkout, still names the commit its block files come from. In a checkout this file is null and `git rev-parse HEAD` is the source; a package with null here was packed without the release step, and `omakit add` refuses to stamp a header it cannot name."
 }

package/tools/marketplace/README.md

@@ -19,6 +19,8 @@ local commit through the transport seam the marketplace tests itself
 | `plugin.mjs` | The root files the submission contract needs, and the declared plugin identity. |
 | `agent-control.mjs` | The recursive agent-control warning, and its remedy. |
 | `review-cost.mjs` | The advisory review-cost verdict, shared account discovery, and path classification between dated validated snapshots. M4 and M9 carry its evidence. |
+| `measure-registry-figures.mjs` | Reproduces the registry figures of M4 and M6 at the pin: `baselineFigures()` recorded per pin in `docs/evidence/registry-figures.json`, newest first, and rendered from that record into the literal block of `tests/unit/registry-figures.test.mjs`, the M4 block and M6 row of `docs/MEASUREMENTS.md` and the Registry facts row of `docs/UPSTREAM_CONTRACT.md`. Without `--write` it names the files not yet rendered from the record (exit 1 when one is stale); with it, it writes them. Every outcome, capability and rule name it prints is a key of the registry's data. |
+| `measure-pin-grades.mjs` | Reproduces M7's grades: each marketplace commit in a range that touched `scripts/` or the form, graded against its parent by the shipped `comparePin()` and `pinFreshness()` three ways (tree, 0.6.6's rule; blob, 0.6.7's; value, the shipped one), every request answered from a local clone of the marketplace history, so it fetches and runs nothing. |
 | `measure-review-cost.mjs` | Reproduces M9 across the open update population at live marketplace HEAD, with compare sources and explicit skipped reasons in JSON. |
 | `issue.mjs` | Renders the issue the way the form would, then has the marketplace's own parser judge it. |
 | `submit.mjs` | Assembles every check with its measured reason, and withholds the body when a blocking check fails. Three outcomes: `ready` (the body), `refused` (a blocking check failed) and `listed` (the plugin is already listed by its own repository: `identity.available` passes with the listing's record, the five body checks are omitted rather than drawn as waiting, no body exists on purpose, and `listing` carries the listed commit against the local one and the form to use for a newer commit). Decides the category and tags after the registry: a listed plugin, own or taken, is asked for neither; an unlisted one without them is asked through `ask.mjs` at a terminal, and is a usage error otherwise. Ends with `reproduce`, the command line that repeats the run without asking. Under `--offline` the validation-commit check is `skipped`, not passed: verdict `skipped`, listed under `skipped` and not `unknown`, never blocking, and the READY line says "1 check skipped (--offline)". |

package/tools/marketplace/measure-pin-grades.mjs

@@ -0,0 +1,119 @@
+// M7 reproduction: every marketplace commit in a range that touched a pinned
+// path other than the two data files (scripts/ and the form), graded as a
+// change from its parent, the parent as the pin and the commit as HEAD,
+// under the three comparisons doctor has shipped: tree, 0.6.6's (any such
+// path's tree or blob id moved); blob, 0.6.7's (pinFreshness without the
+// text-read values); value, the one since 0.6.10 (pinFreshness as it
+// ships). It runs the shipped comparePin() and pinFreshness() against a
+// local clone of the marketplace's history (a blob-filtered clone is
+// enough) and answers each request the comparison would make from that
+// clone, counting it: nothing is fetched by this script and nothing from
+// the clone is run. Measured on 2026-10-01: over the seven such commits
+// since 38060f89, the three grades it gives equal those of the v0.6.6 and
+// v0.6.7 tags' own code (docs/evidence/pin-freshness/2026-10-01-grades.json).
+import { execFileSync } from "node:child_process"
+import { resolve } from "node:path"
+import { pathToFileURL } from "node:url"
+import { PIN_PATHS, POLICY_MODULE, pinnedReadSet, policyConstants } from "./pin.mjs"
+import { LIVE_PATHS } from "./registry.mjs"
+import { comparePin, pinFreshness } from "./doctor.mjs"
+
+/** The pinned paths a grade can turn on: PIN_PATHS less the two data files read live. */
+export const GRADED_PATHS = Object.freeze(PIN_PATHS.map((pattern) => pattern.replace(/^\/|\/$/g, "")).filter((path) => !LIVE_PATHS.includes(path)))
+
+/**
+ * The two kinds of request comparePin() makes, answered from the clone: a
+ * tree read by `git ls-tree`, a file's text at a commit by `git show`.
+ * `requests` lists each, in order.
+ */
+export function cloneTransport(clone) {
+  const git = (...args) => execFileSync("git", ["-C", clone, ...args], { timeout: 60_000, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 })
+  const requests = []
+  const fetchJson = async (url) => {
+    requests.push(url)
+    const sha = String(url).match(/\/git\/trees\/([0-9a-f]{40})$/)?.[1]
+    if (!sha) throw new Error(`not a tree read at an object id: ${url}`)
+    const tree = git("ls-tree", sha).split("\n").filter(Boolean).map((line) => {
+      const [meta, path] = line.split("\t")
+      const [, type, id] = meta.split(" ")
+      return { path, type, sha: id }
+    })
+    return { sha, tree, truncated: false }
+  }
+  const fetchText = async (url) => {
+    requests.push(url)
+    const [, commit, path] = String(url).match(/\/([0-9a-f]{40})\/(.+)$/) || []
+    if (!commit) throw new Error(`not a file read at a commit: ${url}`)
+    return git("show", `${commit}:${path}`)
+  }
+  return { git, requests, fetchJson, fetchText }
+}
+
+/** One change graded three ways, with the read set resolved at `pin` and what the value comparison says of it. */
+export async function gradeChange(clone, pin, head) {
+  const transport = cloneTransport(clone)
+  const reads = pinnedReadSet(clone, undefined, (path) => transport.git("show", `${pin}:${path}`))
+  const identity = { commit: pin, ...policyConstants(transport.git("show", `${pin}:${POLICY_MODULE}`)) }
+  const comparison = await comparePin({ pinDir: clone, headCommit: head, pinCommit: pin, fetchJson: transport.fetchJson, fetchText: transport.fetchText, reads })
+  const at = { commit: head, branch: null }
+  const value = pinFreshness(identity, at, comparison)
+  const blob = pinFreshness(identity, at, { ...comparison, textReads: {} })
+  return {
+    readSet: reads.map((read) => read.path),
+    requests: transport.requests.length,
+    tree: value.evidence.pinned.length ? "advice" : "ok",
+    blob: blob.state,
+    value: value.state,
+    detail: value.detail,
+    effective: value.evidence.effective,
+    textReads: value.evidence.textReads,
+  }
+}
+
+/**
+ * Every commit in `since..until` that touched GRADED_PATHS, oldest first,
+ * each graded by gradeChange() against its first parent, and how many of
+ * those that touched a file in the read set each comparison grades advice.
+ */
+export async function measurePinGrades({ clone, since, until }) {
+  const git = (...args) => execFileSync("git", ["-C", clone, ...args], { timeout: 60_000, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 })
+  const range = `${git("rev-parse", since).trim()}..${git("rev-parse", until).trim()}`
+  const listed = git("log", "--reverse", "--format=%H%x09%cI%x09%s", range, "--", ...GRADED_PATHS).split("\n").filter(Boolean)
+  const commits = []
+  for (const line of listed) {
+    const [commit, committedAt, subject] = line.split("\t")
+    const parent = git("rev-parse", `${commit}^`).trim()
+    const touched = git("log", "-1", "--format=", "--name-only", commit, "--", ...GRADED_PATHS).split("\n").filter(Boolean)
+    const { readSet, ...graded } = await gradeChange(clone, parent, commit)
+    commits.push({ commit, committedAt, subject, parent, touched, inReadSet: touched.filter((path) => readSet.includes(path)), ...graded })
+  }
+  const touching = commits.filter((row) => row.inReadSet.length)
+  const advice = (rows, rule) => rows.filter((row) => row[rule] === "advice").length
+  return {
+    measurement: "M7",
+    measuredAt: new Date().toISOString(),
+    range,
+    gradedPaths: GRADED_PATHS,
+    method: "Each commit in the range that touched a graded path, graded against its first parent by the shipped comparePin() and pinFreshness(), every request answered from the local clone: tree is 0.6.6's rule (a graded path's object id moved), blob 0.6.7's (pinFreshness without text-read values), value the shipped grade.",
+    commits,
+    touchingReadSet: touching.length,
+    advice: { tree: advice(touching, "tree"), blob: advice(touching, "blob"), value: advice(touching, "value") },
+    adviceOverAll: { commits: commits.length, tree: advice(commits, "tree"), blob: advice(commits, "blob"), value: advice(commits, "value") },
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  const args = process.argv.slice(2)
+  const option = (name) => {
+    const index = args.indexOf(name)
+    return index >= 0 ? args[index + 1] : undefined
+  }
+  const clone = option("--clone")
+  const since = option("--since")
+  const until = option("--until") || "HEAD"
+  if (!clone || !since || args.length !== (option("--until") ? 6 : 4)) {
+    process.stderr.write("usage: node tools/marketplace/measure-pin-grades.mjs --clone <marketplace clone> --since <commit> [--until <commit>]\n")
+    process.exit(2)
+  }
+  process.stdout.write(`${JSON.stringify(await measurePinGrades({ clone: resolve(clone), since, until }), null, 2)}\n`)
+}

package/tools/marketplace/measure-registry-figures.mjs

@@ -0,0 +1,160 @@
+// M4 and M6 reproduction: the registry figures at the pin, recorded per pin
+// in docs/evidence/registry-figures.json and rendered from that one record
+// into the three places that cite them: the literal block in
+// tests/unit/registry-figures.test.mjs, the M4 block and the M6 row of
+// docs/MEASUREMENTS.md, and the Registry facts row of
+// docs/UPSTREAM_CONTRACT.md. Measured on the 0.6.10 bump: the same
+// figures were retyped by hand in nine files, and four of them
+// (preflight.mjs, MARKETPLACE.md, HOW.md, INSPECT_DESIGN.md) no test reads.
+// Without --write it prints the record entry for the pin and names each
+// file that is not yet rendered from it; with --write it records the entry
+// and rewrites those files.
+//
+// Every name in the output (outcomes, capabilities, finding rules) is a key
+// of the registry's own data, never typed here.
+import { execFileSync } from "node:child_process"
+import { readFileSync, writeFileSync } from "node:fs"
+import { join, resolve } from "node:path"
+import { fileURLToPath, pathToFileURL } from "node:url"
+import { MARKETPLACE_PIN, requirePin } from "./pin.mjs"
+import { baselineFigures, figure } from "./registry.mjs"
+
+const ROOT = resolve(fileURLToPath(new URL("../..", import.meta.url)))
+
+export const RECORD_PATH = "docs/evidence/registry-figures.json"
+export const TEST_PATH = "tests/unit/registry-figures.test.mjs"
+export const MEASUREMENTS_PATH = "docs/MEASUREMENTS.md"
+export const CONTRACT_PATH = "docs/UPSTREAM_CONTRACT.md"
+
+const TEST_BLOCK = /\/\/ registry-figures:begin[^\n]*\n[\s\S]*?\/\/ registry-figures:end\n/
+const M4_BLOCK = /<!-- registry-figures:m4 -->\n[\s\S]*?<!-- \/registry-figures:m4 -->\n/
+const M6_ROW = /^\| Listed sources whose validated commit was superseded at least once \|.*\|$/m
+const CONTRACT_ROW = /^\| Registry facts \|.*\|$/m
+
+/** The record entry for the pinned checkout: its commit, when it was committed, and baselineFigures() over it. */
+export function entryAtPin(pinDir) {
+  const commit = execFileSync("git", ["-C", pinDir, "rev-parse", "HEAD"], { timeout: 60_000, encoding: "utf8" }).trim()
+  const committedAt = execFileSync("git", ["-C", pinDir, "log", "-1", "--format=%cI", "HEAD"], { timeout: 60_000, encoding: "utf8" }).trim()
+  return { commit, committedAt: new Date(committedAt).toISOString().replace(/\.000Z$/, "Z"), figures: baselineFigures({ pinDir }) }
+}
+
+/** The record with `entry` first, replacing an entry for the same commit; the others keep their order, newest first. */
+export function upsert(record, entry) {
+  return { ...record, pins: [entry, ...record.pins.filter((pin) => pin.commit !== entry.commit)] }
+}
+
+/** A table of counts, largest first and by name on a tie: the order every list here is printed in. */
+const ranked = (table) => Object.entries(table).sort(([a, x], [b, y]) => y - x || a.localeCompare(b))
+const short = (commit) => commit.slice(0, 8)
+const when = (iso) => `${iso.slice(0, 10)} ${iso.slice(11, 16)} UTC`
+const percent = (part, whole) => ((part / whole) * 100).toFixed(1)
+
+/** Prose wrapped at 76 columns, the way the documents are written. */
+function wrap(text, width = 76) {
+  const lines = []
+  let line = ""
+  for (const word of text.split(" ")) {
+    if (line && line.length + 1 + word.length > width) {
+      lines.push(line)
+      line = word
+    } else {
+      line = line ? `${line} ${word}` : word
+    }
+  }
+  if (line) lines.push(line)
+  return lines.join("\n")
+}
+
+/** The literal block the figures test holds the pin to. */
+export function renderTest(text, record) {
+  const [current] = record.pins
+  const block = [
+    `// registry-figures:begin rendered from ${RECORD_PATH} by \`node tools/marketplace/measure-registry-figures.mjs --write\`; change the record, not this block`,
+    `const AT_PIN = Object.freeze(${JSON.stringify({ commit: current.commit, figures: current.figures }, null, 2)})`,
+    "// registry-figures:end",
+    "",
+  ].join("\n")
+  if (!TEST_BLOCK.test(text)) throw new Error(`${TEST_PATH} has no registry-figures block to render into`)
+  return text.replace(TEST_BLOCK, () => block)
+}
+
+/** M4's figures and the earlier pins' table, and M6's superseded row. */
+export function renderMeasurements(text, record) {
+  const [current, ...earlier] = record.pins
+  const f = current.figures
+  const outcomes = ranked(f.outcomes)
+  const lines = [
+    "<!-- registry-figures:m4 -->",
+    wrap(`From \`registry.json\` at the pin (\`${short(current.commit)}\`, ${when(current.committedAt)}): ${figure(f.sources)} listed sources, of which ${figure(f.withBaseline)} carry a recorded baseline (the rest were listed before the baseline existed or have no record):`),
+    "",
+    "| Outcome | Count |",
+    "| --- | --- |",
+    ...outcomes.map(([name, n]) => `| \`${name}\` | ${figure(n)} |`),
+    `| Findings ever recorded, total | ${figure(f.findingsTotal)} (${ranked(f.findings).map(([name, n]) => `\`${name}\` ${figure(n)}`).join(", ")}) |`,
+    "",
+    wrap(`Capabilities recorded: ${ranked(f.capabilities).map(([name, n]) => `${name} ${figure(n)}`).join(", ")}.`),
+  ]
+  if (earlier.length) {
+    lines.push(
+      "",
+      "At the earlier pins, counted the same way from the same two files:",
+      "",
+      `| Pin | Sources | With a baseline | ${outcomes.map(([name]) => `\`${name}\``).join(" | ")} |`,
+      `| --- | --- | --- | ${outcomes.map(() => "---").join(" | ")} |`,
+      ...earlier.map((pin) => `| \`${short(pin.commit)}\` (${when(pin.committedAt)}) | ${figure(pin.figures.sources)} | ${figure(pin.figures.withBaseline)} | ${outcomes.map(([name]) => figure(pin.figures.outcomes[name] || 0)).join(" | ")} |`),
+    )
+  }
+  lines.push("<!-- /registry-figures:m4 -->", "")
+  const superseded = (pin) => `${figure(pin.figures.superseded.sources)} of ${figure(pin.figures.sources)}, ${percent(pin.figures.superseded.sources, pin.figures.sources)}%, ${figure(pin.figures.superseded.commits)} commits`
+  const row = `| Listed sources whose validated commit was superseded at least once | ${figure(f.superseded.sources)} of ${figure(f.sources)} (${percent(f.superseded.sources, f.sources)}%) at pin \`${short(current.commit)}\`, ${figure(f.superseded.commits)} superseded commits, one source revalidated ${f.superseded.most} times${earlier.length ? ` (${earlier.map((pin) => `at pin \`${short(pin.commit)}\`: ${superseded(pin)}`).join("; ")})` : ""} |`
+  if (!M4_BLOCK.test(text)) throw new Error(`${MEASUREMENTS_PATH} has no registry-figures:m4 block to render into`)
+  if (!M6_ROW.test(text)) throw new Error(`${MEASUREMENTS_PATH} has no superseded row in M6 to render into`)
+  return text.replace(M4_BLOCK, () => lines.join("\n")).replace(M6_ROW, () => row)
+}
+
+/** The Registry facts row of the pinned-checkout table. */
+export function renderContract(text, record) {
+  const f = record.pins[0].figures
+  const row = `| Registry facts | ${figure(f.listingValidated)} sources with \`listingValidatedCommit\`; ${figure(f.withBaseline)} with an \`automatedSecurityBaseline\` record (${ranked(f.outcomes).map(([name, n]) => `${figure(n)} ${name}`).join(", ")}); ${figure(f.catalogPlugins)} catalog plugin ids; ${figure(f.retiredIds)} retired ids; ${figure(f.superseded.sources)} sources (${percent(f.superseded.sources, f.sources)}%) with at least one superseded validated commit, ${figure(f.superseded.commits)} superseded commits in all |`
+  if (!CONTRACT_ROW.test(text)) throw new Error(`${CONTRACT_PATH} has no Registry facts row to render into`)
+  return text.replace(CONTRACT_ROW, () => row)
+}
+
+/** Each file the record renders into, as it is and as the record would have it. */
+export function renderAll(record, read = (path) => readFileSync(join(ROOT, path), "utf8")) {
+  return [
+    { path: RECORD_PATH, now: read(RECORD_PATH), next: `${JSON.stringify(record, null, 2)}\n` },
+    { path: TEST_PATH, now: read(TEST_PATH), next: renderTest(read(TEST_PATH), record) },
+    { path: MEASUREMENTS_PATH, now: read(MEASUREMENTS_PATH), next: renderMeasurements(read(MEASUREMENTS_PATH), record) },
+    { path: CONTRACT_PATH, now: read(CONTRACT_PATH), next: renderContract(read(CONTRACT_PATH), record) },
+  ]
+}
+
+/**
+ * The pin's entry recorded and every file rendered from the record. With
+ * `write`, the files that differ are written; without, nothing is. Returns
+ * the entry and, per file, whether it was (or would be) rewritten.
+ */
+export function measureRegistryFigures({ repoRoot = ROOT, pinDir = requirePin(repoRoot).dir, write = false } = {}) {
+  const entry = entryAtPin(pinDir)
+  if (entry.commit !== MARKETPLACE_PIN.commit) throw new Error(`the checkout at ${pinDir} is at ${entry.commit}, not the pin ${MARKETPLACE_PIN.commit}`)
+  const read = (path) => readFileSync(join(repoRoot, path), "utf8")
+  const record = upsert(JSON.parse(read(RECORD_PATH)), entry)
+  const files = renderAll(record, read)
+  if (write) {
+    for (const file of files.filter((candidate) => candidate.next !== candidate.now)) writeFileSync(join(repoRoot, file.path), file.next)
+  }
+  return { entry, files: Object.fromEntries(files.map((file) => [file.path, file.next === file.now ? "current" : write ? "written" : "stale"])) }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  const args = process.argv.slice(2)
+  const unknown = args.filter((arg) => arg !== "--write")
+  if (unknown.length) {
+    process.stderr.write(`usage: node tools/marketplace/measure-registry-figures.mjs [--write]; not ${unknown.join(" ")}\n`)
+    process.exit(2)
+  }
+  const result = measureRegistryFigures({ write: args.includes("--write") })
+  process.stdout.write(`${JSON.stringify(result, null, 2)}\n`)
+  if (!args.includes("--write") && Object.values(result.files).includes("stale")) process.exitCode = 1
+}

package/tools/marketplace/pin.mjs

@@ -5,7 +5,7 @@
 // It fetches only what omakit reads. The marketplace at this commit is 325 MB,
 // of which 168 MB is preview imagery and 151 MB is history, and omakit reads
 // twenty files out of it, sixteen of them under scripts/ (PIN_READS). A
-// blob-filtered, sparsely checked out fetch of just those paths is 15 MB and
+// blob-filtered, sparsely checked out fetch of just those paths was 15 MB and
 // takes 2 seconds instead of 17; at pin b441b4f0 (2026-10-01) the same fetch
 // was 23 MB on disk in 3.1 seconds. PIN_PATHS below is the whole list, and
 // tests/unit/pin.test.mjs fails if any module starts reading a path outside
@@ -32,6 +32,9 @@ export const MARKETPLACE_PIN = Object.freeze({
   commitSubject: "Add LINE for Omarchy plugin (#9470)",
   baselineVersion: "3",
   enforcementMode: "selective",
+  // What a fresh sparse fetch of this commit measured on disk, for the one
+  // line `omakit pin` prints before it fetches. A pin bump re-measures it.
+  fetchedMb: 23,
 })
 
 /**
@@ -179,10 +182,12 @@ export function unfollowedImports(pinDir, reads = pinnedReadSet(pinDir)) {
  * a package (`sharp`) is not followed: PIN_PATHS does not fetch it, so
  * omakit could not read it. Measured at pins b7b29654 and b441b4f0: 16 of
  * the 34 files under scripts/, 10 opened by omakit and 6 imported by those.
+ * `text` reads one file's text by its path; it defaults to the checkout in
+ * `pinDir`, and measure-pin-grades.mjs hands in a commit's blobs instead.
  *
  * @returns {{ path: string, imported: boolean, via: string|null }[]}
  */
-export function pinnedReadSet(pinDir, reads = PIN_READS) {
+export function pinnedReadSet(pinDir, reads = PIN_READS, text = (path) => readFileSync(join(pinDir, path), "utf8")) {
   const set = new Map()
   const queue = []
   for (const read of reads) {
@@ -191,13 +196,13 @@ export function pinnedReadSet(pinDir, reads = PIN_READS) {
   }
   while (queue.length) {
     const from = queue.shift()
-    let text
+    let source
     try {
-      text = readFileSync(join(pinDir, from), "utf8")
+      source = text(from)
     } catch (error) {
       throw new PinError(`cannot read ${from} from the pinned checkout at ${pinDir}: ${error.message}`)
     }
-    for (const match of text.matchAll(RELATIVE_IMPORT)) {
+    for (const match of source.matchAll(RELATIVE_IMPORT)) {
       const path = posix.normalize(posix.join(posix.dirname(from), match[1]))
       if (!path.startsWith("scripts/") || set.has(path)) continue
       set.set(path, { path, imported: true, via: from })
@@ -232,7 +237,7 @@ function pinMigration(repoRoot, env = process.env) {
   if (!existsSync(join(oldDir, ".git")) || existsSync(newDir)) return null
   const remedy = `mkdir -p -- ${shellQuote(dirname(newDir))} && mv -- ${shellQuote(oldDir)} ${shellQuote(newDir)}`
   return new PinError(
-    `the marketplace pin is still at the old in-repository location ${oldDir}; the user-writable location ${newDir} does not exist. Omakit will not move the measured 15 MB checkout without you.`,
+    `the marketplace pin is still at the old in-repository location ${oldDir}; the user-writable location ${newDir} does not exist. Omakit will not move the checkout (${pinDiskUsage(oldDir, env)}) without you.`,
     { code: "marketplace-pin-migration-required", remedy },
   )
 }
@@ -409,7 +414,7 @@ function populatePin(dir, log) {
   mkdirSync(dir, { recursive: true })
   execFileSync("git", ["init", "-q", dir], { timeout: 60_000, encoding: "utf8" })
   git(dir, ["remote", "add", "origin", MARKETPLACE_PIN.repository])
-  log({ state: "fetching", text: `fetching the pinned marketplace checkout, ${MARKETPLACE_PIN.commit.slice(0, 7)}, about 15 MB` })
+  log({ state: "fetching", text: `fetching the pinned marketplace checkout, ${MARKETPLACE_PIN.commit.slice(0, 7)}, about ${MARKETPLACE_PIN.fetchedMb} MB` })
   git(dir, ["config", "core.sparseCheckout", "true"])
   mkdirSync(join(dir, ".git/info"), { recursive: true })
   writeFileSync(join(dir, ".git/info/sparse-checkout"), `${PIN_PATHS.join("\n")}\n`)
@@ -524,7 +529,7 @@ export function ensurePin(repoRoot, log = () => {}, env = process.env, { populat
 export function pinDiskUsage(dir, env = process.env) {
   // -H follows a symlink given on the command line (POSIX; GNU's -D). Measured
   // without it: a checkout reached through a symlink reported 0.0 MB, the size
-  // of the link, while the directory behind it was 15 MB.
+  // of the link, while the directory behind it was 15 MB (at pin 38060f89).
   //
   // The total is read whether or not du exited 0. du exits 1 when a file it
   // listed is gone by the time it reaches it, and still prints the total.

package/tools/marketplace/registry.mjs

@@ -373,12 +373,13 @@ export function idUniverse(options = {}) {
 /**
  * The recorded baseline over every listed source, counted from registry.json at
  * the pin. This is the one place the figures cited by `baseline.preflight` and
- * docs/MEASUREMENTS.md M4 come from; tests/unit/registry-figures.test.mjs pins
- * the values, so a pin bump changes the printed number rather than leaving a
- * stale literal behind.
+ * docs/MEASUREMENTS.md M4 come from; measure-registry-figures.mjs records
+ * them per pin and renders the test and the two documents that cite them, so
+ * a pin bump changes the printed number rather than leaving a stale literal
+ * behind.
  *
  * @param {{ repoRoot?: string, pinDir?: string }} [options]
- * @returns {{ sources: number, withBaseline: number, outcomes: Record<string, number>,
+ * @returns {{ sources: number, listingValidated: number, withBaseline: number, outcomes: Record<string, number>,
  *             capabilities: Record<string, number>, findings: Record<string, number>,
  *             findingsTotal: number, superseded: { sources: number, commits: number, most: number },
  *             retiredIds: number, catalogPlugins: number }}
@@ -393,11 +394,13 @@ export function baselineFigures(options = {}) {
   const capabilities = {}
   const findings = {}
   let withBaseline = 0
+  let listingValidated = 0
   let findingsTotal = 0
   let supersededSources = 0
   let supersededCommits = 0
   let most = 0
   for (const source of sources) {
+    if (typeof source?.listingValidatedCommit === "string" && source.listingValidatedCommit) listingValidated += 1
     const baseline = source?.automatedSecurityBaseline
     if (baseline && typeof baseline.outcome === "string") {
       withBaseline += 1
@@ -415,6 +418,7 @@ export function baselineFigures(options = {}) {
   }
   return {
     sources: sources.length,
+    listingValidated,
     withBaseline,
     outcomes,
     capabilities,