omakit 0.6.9 → 0.6.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omakit",
-  "version": "0.6.9",
+  "version": "0.6.11",
   "description": "Tested plumbing, the marketplace's own checks, and a disposable Omarchy to test in.",
   "license": "MIT",
   "author": "Maarten Tolhuijs",

package/tools/blocks/commit.json

@@ -1,5 +1,5 @@
 {
-  "commit": "275ab1557edc5c8d152068e323659a5cc831ebbe",
-  "recordedAt": "2026-09-23T09:18:44.425Z",
+  "commit": "134073bfe9da1073721c0a7e9905c15dea0c7176",
+  "recordedAt": "2026-10-01T04:06:29.378Z",
   "how": "Written by `node tools/blocks/record-commit.mjs` in the release workflow before `npm pack`, so a packaged omakit, which has no Git checkout, still names the commit its block files come from. In a checkout this file is null and `git rev-parse HEAD` is the source; a package with null here was packed without the release step, and `omakit add` refuses to stamp a header it cannot name."
 }

package/tools/lab/guest.mjs

@@ -134,7 +134,7 @@ export async function clearStartupNotifications(guest, { onPhase = () => {} } =
  * the package or from a linked checkout (`OMARCHY_PATH` in
  * /etc/omarchy.conf; a dev-linked guest names `.local/share/omarchy`).
  * This is the line the old gates never wrote (docs/history/2026-09-18-lab-
- * inventory.md P8), and packaging/LAB_PLAN.md's run identity requires.
+ * inventory.md P8), and docs/LAB.md's run identity requires.
  */
 export function guestIdentity(guest) {
   const read = (command) => sshGuest(guest, command).stdout.trim()

package/tools/lab/host.mjs

@@ -1,7 +1,7 @@
 // What the host has and what it lacks, each with its measured reason.
 //
 // Read-only: every probe is a stat, a read of /proc, or a `--version`.
-// Nothing here installs anything (packaging/LAB_PLAN.md: lab-only host
+// Nothing here installs anything (docs/LAB.md: lab-only host
 // capabilities are preflighted and reported, never installed). Measured
 // before this (docs/history/2026-09-18-lab-inventory.md P10, P20): the
 // upstream harness ran `omarchy-pkg-add` for six packages at the top of
@@ -168,7 +168,7 @@ export function probeRunHost({ pin = labPin(), run, env = process.env } = {}) {
 
 /**
  * The vCPU count a run gives the guest: every logical CPU, which is what
- * the toolchain's `-smp $(nproc)` gave the reference build (32, packaging/LAB_PLAN.md M4, M14). A
+ * the toolchain's `-smp $(nproc)` gave the reference build (32, M14). A
  * smaller number would be a guess about what a suite needs, and no run
  * has measured one.
  */

package/tools/lab/paths.mjs

@@ -29,7 +29,7 @@ export function labStateDir(env = process.env) {
 
 /**
  * The layout under the cache root. One base, not one per release
- * (packaging/LAB_PLAN.md, the one-base rule): a pin update replaces it.
+ * (docs/LAB.md): setup replaces it when a newer release is built.
  */
 export function labLayout(env = process.env) {
   const cache = labCacheDir(env)

package/tools/lab/pin.json

@@ -33,6 +33,6 @@
     "preparedLabBytes": 12442931200,
     "overlayAfterRunBytes": 610734080,
     "pluginsBytes": 6836224,
-    "source": "docs/MEASUREMENTS.md M14, measured by omakit lab on the reference host with Omarchy 4.0.3; packaging/LAB_PLAN.md M4 to M7 are the 2026-09-10 to 2026-09-13 observations it re-measured"
+    "source": "docs/MEASUREMENTS.md M14, measured by omakit lab on the reference host with Omarchy 4.0.3, re-measuring the lab plan's observations of 2026-09-10 to 2026-09-13 (M4 to M7, in git history at 9c667f9)"
   }
 }

package/tools/lab/verify.mjs

@@ -5,8 +5,8 @@
 // The signature is the trust: a substituted ISO with a substituted
 // checksum beside it fails here, because only Omarchy's key signs. The
 // digest names the file and catches a download that went wrong. Both,
-// every time, and a mismatch in either fails closed (packaging/LAB_PLAN.md,
-// the acquisition boundary).
+// every time, and a mismatch in either fails closed (docs/LAB.md, the
+// trust anchor).
 // The key is imported into a throwaway GNUPGHOME under the lab, never into
 // the user's keyring: a lab that added keys to ~/.gnupg would be changing
 // the host, and the only host change the lab makes is the lab.

package/tools/marketplace/README.md

@@ -7,23 +7,25 @@ local commit through the transport seam the marketplace tests itself
 
 | File | Purpose |
 | --- | --- |
-| `pin.mjs` | The pin identity (one home) and the reproducible setup: `omakit pin` fetches exactly that commit into `$XDG_CACHE_HOME/omakit/marketplace` and refuses a modified checkout. `PIN_PATHS` is what is fetched; `PIN_READS` is what omakit opens under `scripts/` and how (imported or read as text), and `pinnedReadSet(pinDir)` adds what the imported files import, by regex over the pinned text and never by loading a module: 16 of 34 files at `b7b29654`, pinned by `tests/unit/pin.test.mjs`. `policyConstants(text)` reads the two policy constants out of the module's text, for the pin's identity and for doctor's comparison at HEAD. |
+| `pin.mjs` | The pin identity (one home) and the reproducible setup: `omakit pin` fetches exactly that commit into `$XDG_CACHE_HOME/omakit/marketplace` and refuses a modified checkout. `PIN_PATHS` is what is fetched; `PIN_READS` is what omakit opens under `scripts/` and how (imported or read as text), and `pinnedReadSet(pinDir)` adds what the imported files import, by regex over the pinned text and never by loading a module: 16 of 34 files at `b441b4f0`, pinned by `tests/unit/pin.test.mjs`. `policyConstants(text)` reads the two policy constants out of the module's text, for the pin's identity and for doctor's comparison at HEAD; each file read as text carries its `readers` in `PIN_READS`, the values taken out of it as functions from text to value (`reservedNamespace`, `catalogPresentation`, `validatedLabel`, `updateLabel`), which the checks call on the pin's text and doctor on the pin's and HEAD's. |
 | `local-transport.mjs` | Answers the four request shapes the official resolver makes, from a local clone at the exact commit. No network, no credentials, no writes. With `subdir`, serves a directory below the root as the whole tree, which is how `inspect` keeps the baseline to the plugin's own tree. |
 | `run-baseline.mjs` | Runs the pinned official baseline over either transport and reports the pin identity beside the result. |
 | `verify.mjs` | Builds the `marketplaceBaseline` section: pin, transport, assumptions, the official result verbatim, the statement. `omakit verify` renders it for a person (`renderVerify` in `report.mjs`) and prints the document itself behind `--json` and `--out`. |
 | `preflight.mjs` | Translates that result into what it will cause on submission, using the pinned policy, and renders the marketplace's own report text with its attestation marker stripped and asserted absent. |
 | `yaml.mjs` | A deliberately small YAML reader for the pinned issue form. Accepts that subset and throws on anything else. |
 | `form.mjs` | The submission contract, read from the form and cross-checked against the marketplace's own constants. Also the route for a plugin that is already listed: the marketplace's verification form and its "newer commit" choice, read from `verify-plugin.yml` at the pin and cross-checked against `plugin-verification-request.mjs`. |
-| `registry.mjs` | The plugin-id and repository universe: the reserved namespace from the pinned catalog builder, the listed and retired ids and listed repositories from `registry.json` and `site/catalog.json` at the marketplace's current HEAD when the network is there (cached under `$XDG_CACHE_HOME/omakit/registry/<commit>/`, never in the pin) and at the pin with `--offline`; `liveFileUrl()` is the way to the raw file host for those two files, and `headTextUrl()` for the one text `doctor` compares and drops (the policy module at HEAD, `HEAD_TEXT_PATHS`), both at a 40-character commit. `sameRepository()` is the one rule for "the subject's own repository" (owner and name, case-insensitively, a trailing `.git` ignored), and `listingOf()` is what the catalog records about a listing: since when, which commit, verified or not, checked when. |
+| `registry.mjs` | The plugin-id and repository universe: the reserved namespace from the pinned catalog builder, the listed and retired ids and listed repositories from `registry.json` and `site/catalog.json` at the marketplace's current HEAD when the network is there (cached under `$XDG_CACHE_HOME/omakit/registry/<commit>/`, never in the pin) and at the pin with `--offline`; `liveFileUrl()` is the way to the raw file host for those two files, and `headTextUrl()` for the text `doctor` compares and drops (the policy module and the three files read as text at HEAD, `HEAD_TEXT_PATHS`), both at a 40-character commit; `catalogBuilderText()` is the pin's catalog builder, and `reservedNamespace` and `catalogPresentation` are re-exported from `pin.mjs`. `sameRepository()` is the one rule for "the subject's own repository" (owner and name, case-insensitively, a trailing `.git` ignored), and `listingOf()` is what the catalog records about a listing: since when, which commit, verified or not, checked when. |
 | `tree.mjs` | The installable tree of a subject at one exact commit, from the Git object database. |
 | `plugin.mjs` | The root files the submission contract needs, and the declared plugin identity. |
 | `agent-control.mjs` | The recursive agent-control warning, and its remedy. |
 | `review-cost.mjs` | The advisory review-cost verdict, shared account discovery, and path classification between dated validated snapshots. M4 and M9 carry its evidence. |
+| `measure-registry-figures.mjs` | Reproduces the registry figures of M4 and M6 at the pin: `baselineFigures()` recorded per pin in `docs/evidence/registry-figures.json`, newest first, and rendered from that record into the literal block of `tests/unit/registry-figures.test.mjs`, the M4 block and M6 row of `docs/MEASUREMENTS.md` and the Registry facts row of `docs/UPSTREAM_CONTRACT.md`. Without `--write` it names the files not yet rendered from the record (exit 1 when one is stale); with it, it writes them. Every outcome, capability and rule name it prints is a key of the registry's data. |
+| `measure-pin-grades.mjs` | Reproduces M7's grades: each marketplace commit in a range that touched `scripts/` or the form, graded against its parent by the shipped `comparePin()` and `pinFreshness()` three ways (tree, 0.6.6's rule; blob, 0.6.7's; value, the shipped one), every request answered from a local clone of the marketplace history, so it fetches and runs nothing. |
 | `measure-review-cost.mjs` | Reproduces M9 across the open update population at live marketplace HEAD, with compare sources and explicit skipped reasons in JSON. |
 | `issue.mjs` | Renders the issue the way the form would, then has the marketplace's own parser judge it. |
 | `submit.mjs` | Assembles every check with its measured reason, and withholds the body when a blocking check fails. Three outcomes: `ready` (the body), `refused` (a blocking check failed) and `listed` (the plugin is already listed by its own repository: `identity.available` passes with the listing's record, the five body checks are omitted rather than drawn as waiting, no body exists on purpose, and `listing` carries the listed commit against the local one and the form to use for a newer commit). Decides the category and tags after the registry: a listed plugin, own or taken, is asked for neither; an unlisted one without them is asked through `ask.mjs` at a terminal, and is a usage error otherwise. Ends with `reproduce`, the command line that repeats the run without asking. Under `--offline` the validation-commit check is `skipped`, not passed: verdict `skipped`, listed under `skipped` and not `unknown`, never blocking, and the READY line says "1 check skipped (--offline)". |
 | `ask.mjs` | The two questions `submit` asks a person at a terminal, and only there: category and tags, numbered from the pinned form, with the marketplace's own presentation for the manifest's kinds (read from the pinned catalog builder) as the default where it is on the list. Prompts on stderr, nothing persisted. |
-| `doctor.mjs` | What is installed, what is pinned, and what has moved. `omakit.version` is one check for one question, is this the current omakit: `ok` with "0.1.8, the newest published version", a `note` with "0.1.8; 0.1.9 is published" and the upgrade command, `unknown` with the registry's failure code, `info` offline; its evidence carries `{ installed, latest, source }`. `pin.freshness` compares what omakit reads between the pin and the marketplace's HEAD (`comparePin`): the 16 files in `pinnedReadSet()` by blob id, the two data files by blob id, the form directory by tree id, and the two policy constants by the module's text at HEAD when its blob moved; three tree reads, a fourth for `scripts/` only when its id moved, a fifth GET for the policy text only when that blob moved. Graded: `ok` when nothing in the read set moved (the data files are read live; `scripts/` moving elsewhere is said as "in none of the 16 files omakit reads"), `info` when a read file moved and both constants read the same (the files named, verdicts unchanged, nothing to do), `advice` when a constant differs, a read file is gone, or the form moved, with `omakit upgrade` as the action when a newer omakit is published and otherwise that the maintainer is notified; it never asks for an issue, the weekly workflow opens the one there is. Measured (M7): 5e401552, which changed only `repository-identity.mjs`, graded `advice` by tree id and grades `ok` here. The maintainer's pin procedure stays in `docs/UPSTREAM_CONTRACT.md` and is never printed. HEAD unreadable is `unknown`. `--json` carries `changedPaths`, `readLive` and `pinned` under the check's evidence as before, plus `reads`, `moved`, `missing` and `policy.{pin,head}`. |
+| `doctor.mjs` | What is installed, what is pinned, and what has moved. `omakit.version` is one check for one question, is this the current omakit: `ok` with "0.1.8, the newest published version", a `note` with "0.1.8; 0.1.9 is published" and the upgrade command, `unknown` with the registry's failure code, `info` offline; its evidence carries `{ installed, latest, source }`. `pin.freshness` compares what omakit reads between the pin and the marketplace's HEAD (`comparePin`): the 16 files in `pinnedReadSet()` by blob id, the two data files by blob id, the form directory by tree id, the two policy constants by the module's text at HEAD when its blob moved, and each file read as text, when its blob moved, by the values its `readers` take out of it at both ends (`textReadsBetween`, `textReads`); three tree reads, a fourth for `scripts/` only when its id moved, one more GET per moved text. Graded on `effective`, the moved files less the text-read ones whose every value is unchanged: `ok` when it is empty (the data files are read live; `scripts/` moving elsewhere is said as "in none of the 16 files omakit reads"; an unchanged text-read file is named with how many values), `info` when it holds only `WORDING_READS`, `advice` when a verdict-bearing file moved, a text-read value differs (both printed), a read file is gone, or the form moved, with `omakit upgrade` as the action when a newer omakit is published and otherwise that the maintainer is notified; it never asks for an issue, the weekly workflow opens the one there is. Measured (M7): of the five commits since `38060f89` that touched the read set, tree and blob comparison grade five advice, this two. The maintainer's pin procedure stays in `docs/UPSTREAM_CONTRACT.md` and is never printed. HEAD unreadable is `unknown`. `--json` carries `changedPaths`, `readLive` and `pinned` under the check's evidence as before, plus `reads`, `moved`, `missing` and `policy.{pin,head}`. |
 | `watch.mjs` | The validation watch: validated commit versus current default-branch HEAD, and the one action that refreshes it. |
 | `github.mjs` | Read-only GitHub access. GET only. The credential is your `gh` login, read through one frozen `gh auth token` call, and is never written anywhere. |
 | `style.mjs` | The visual system, defined once: the palette, the status vocabulary, the block ramp, the columns, the motion budgets, and the composition helpers every command draws with. Six states: `▁ ok`, `█ FAIL`, `▓ note`, `░ info`, `▒ ?` for a check that could not be made, and `▔ skip` for a check a flag said not to make, the floor's ink at the ceiling so it is never read as a pass. `docs/TUI.md` explains it. |

package/tools/marketplace/cli.mjs

@@ -747,7 +747,7 @@ async function cmdLab(args) {
         onLine: (line) => {
           spinner.done()
           // The identity block, once the guest has been read: the line
-          // packaging/LAB_PLAN.md says every run prints before its suite.
+          // docs/LAB.md says every run prints before its suite.
           if (line.record) {
             narrate.write(`${withOutputStream(narrate, () => renderRunIdentity(line.record, { colour: colourEnabled(narrate) }))}\n\n`)
             return

package/tools/marketplace/doctor.mjs

@@ -54,11 +54,26 @@
 // a rule can change without its version. The other two commits (7dd6e56,
 // 40315f2) touched submission.mjs and the policy module, both executed,
 // and the forms, so they grade advice either way.
+//
+// Nor is "a file omakit reads moved" the same as "what omakit reads out of
+// it moved", for the three files it reads as text and never runs. Measured
+// on 2026-10-01 (M7, docs/evidence/pin-freshness/2026-10-01-grades.json):
+// build-catalog.mjs, the most edited file under scripts/, moved three times
+// after b7b29654 (a166e3ac, b612419c, cb7947ec), the reserved namespace and
+// the category mapping read out of it the same each time, and the blob
+// comparison graded each advice, a release for nothing. So a text-read file
+// whose blob moved is read once at HEAD and each value its `readers`
+// (PIN_READS) take out of it is compared with the pin's, by the same
+// function; one whose every value is unchanged does not count as moved for
+// the grade (`effective`), and one whose value differs is advice with both
+// values printed. Of the five commits since 38060f89 that touched a file in
+// the read set, the tree comparison and the blob comparison grade five
+// advice and this grades two: 7dd6e56 and 40315f2, as above.
 
 import { execFileSync } from "node:child_process"
 import { existsSync, readFileSync } from "node:fs"
 import { join } from "node:path"
-import { MARKETPLACE_PIN, PIN_PATHS, POLICY_MODULE, WORDING_READS, marketplacePinDir, pinDiskUsage, pinShape, pinnedReadSet, policyConstants, requirePin } from "./pin.mjs"
+import { MARKETPLACE_PIN, PIN_PATHS, PIN_READS, POLICY_MODULE, WORDING_READS, marketplacePinDir, pinDiskUsage, pinShape, pinnedReadSet, policyConstants, requirePin } from "./pin.mjs"
 import { LIVE_PATHS, headTextUrl } from "./registry.mjs"
 import { credential, defaultBranchHead, getJson, getText, GitHubError } from "./github.mjs"
 import { compareVersions, NPM_REGISTRY, registryLatest, upgradeCommand } from "./upgrade.mjs"
@@ -93,6 +108,45 @@ function pinObjectId(pinDir, commit, path) {
   return execFileSync("git", ["-C", pinDir, "rev-parse", `${commit}:${path}`], { timeout: 60_000, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim()
 }
 
+/** A file's text at a commit in the pinned checkout. Local: the read set's blobs are in the checkout. */
+function pinFileText(pinDir, commit, path) {
+  return execFileSync("git", ["-C", pinDir, "show", `${commit}:${path}`], { timeout: 60_000, encoding: "utf8", maxBuffer: 16 * 1024 * 1024, stdio: ["ignore", "pipe", "pipe"] })
+}
+
+/**
+ * Each value `readers` takes out of a file, read out of the pin's text and
+ * HEAD's by the same function, and whether the two are the same: equal
+ * when their JSON is, since every reader returns a string, null or plain
+ * data.
+ *
+ * @returns {Record<string, { pin: unknown, head: unknown, same: boolean }>}
+ */
+export function textReadValues(readers, pinText, headText) {
+  return Object.fromEntries(Object.entries(readers).map(([name, read]) => {
+    const pin = read(pinText)
+    const head = read(headText)
+    return [name, { pin, head, same: JSON.stringify(pin) === JSON.stringify(head) }]
+  }))
+}
+
+/**
+ * The text-read files of `reads` (those PIN_READS gives `readers`), each
+ * with whether its blob moved and the values read out of it at both ends.
+ * The pin's text comes from the checkout; HEAD's is fetched once, and only
+ * for a file in `moved`: an identical blob has identical values, so an
+ * unmoved file's values are the pin's at both ends and cost no request.
+ * With nothing moved (a current pin) it reads locally only.
+ */
+export async function textReadsBetween({ pinDir, pinCommit = MARKETPLACE_PIN.commit, headCommit = pinCommit, reads = pinnedReadSet(pinDir), moved = [], fetchText = getText }) {
+  const textReads = {}
+  for (const { path, readers } of PIN_READS.filter((read) => read.readers && reads.some((entry) => entry.path === read.path))) {
+    const atPin = pinFileText(pinDir, pinCommit, path)
+    const blobMoved = moved.includes(path)
+    textReads[path] = { moved: blobMoved, values: textReadValues(readers, atPin, blobMoved ? await fetchText(headTextUrl(headCommit, path)) : atPin) }
+  }
+  return textReads
+}
+
 /** A PIN_PATHS pattern as a path: "/site/catalog.json" -> "site/catalog.json". */
 const asPath = (pattern) => pattern.replace(/^\/|\/$/g, "")
 
@@ -117,10 +171,20 @@ const FORMS = "/.github/ISSUE_TEMPLATE/"
  * `policyAtHead`; otherwise `policyAtHead` is null, because an identical
  * blob has identical constants. The text is never imported.
  *
+ * Each file PIN_READS reads as text is compared by what omakit reads out
+ * of it, under `textReads`: its `readers` run on the pin's text (from the
+ * checkout) and on HEAD's, and each value is returned with both sides and
+ * whether they are the same. HEAD's text is read once through `fetchText`
+ * only when the file's blob moved, one more GET per such file; an
+ * unmoved file's values are the pin's at both ends, and a file gone at
+ * HEAD is in `missing` and not here. The text is compared and dropped,
+ * never imported.
+ *
  * `fetchJson` and `fetchText` are injectable for tests.
  *
  * @returns {Promise<{ changedPaths: string[], reads: number, moved: string[], missing: string[],
- *                     policyAtHead: { baselineVersion: string, enforcementMode: string }|null }>}
+ *                     policyAtHead: { baselineVersion: string, enforcementMode: string }|null,
+ *                     textReads: Record<string, { moved: boolean, values: Record<string, { pin: unknown, head: unknown, same: boolean }> }> }>}
  */
 export async function comparePin({ pinDir, headCommit, pinCommit = MARKETPLACE_PIN.commit, fetchJson = getJson, fetchText = getText, reads = pinnedReadSet(pinDir) }) {
   const match = MARKETPLACE_PIN.repository.match(/^https:\/\/github\.com\/([^/]+)\/([^/]+)$/)
@@ -164,7 +228,8 @@ export async function comparePin({ pinDir, headCommit, pinCommit = MARKETPLACE_P
     }
   }
   const policyAtHead = moved.includes(POLICY_MODULE) ? policyConstants(await fetchText(headTextUrl(headCommit, POLICY_MODULE))) : null
-  return { changedPaths, reads: reads.length, moved, missing, policyAtHead }
+  const textReads = await textReadsBetween({ pinDir, pinCommit, headCommit, reads: reads.filter((read) => !missing.includes(read.path)), moved, fetchText })
+  return { changedPaths, reads: reads.length, moved, missing, policyAtHead, textReads }
 }
 
 /** "a", "a and b", "a, b and c". */
@@ -186,24 +251,36 @@ const verdictBearing = (paths) => paths.filter((path) => !WORDING_READS.includes
  * from HEAD, and `pinned`, everything only a new pin can carry; its `moved`
  * and `missing` name the files omakit reads under scripts/ whose blob
  * differs at HEAD; its `policyAtHead` carries the two policy constants
- * there when the policy module moved.
+ * there when the policy module moved; its `textReads` carries, for each
+ * file read as text, the values omakit reads out of it at both ends.
+ *
+ * A file read as text whose blob moved and whose every value reads the
+ * same at HEAD does not count as moved for the grade: omakit takes those
+ * values out of it and nothing else, so the move cannot reach a verdict or
+ * a line. `effective` is `moved` without such files, and the grade is
+ * taken from it; `moved` keeps meaning the blob. Measured on 2026-10-01
+ * (M7): build-catalog.mjs moved three times after b7b29654, the reserved
+ * namespace and the category mapping read the same each time, and the
+ * blob comparison graded the pin advice for it.
  *
  *   ok      nothing omakit reads moved: HEAD moved elsewhere, or only in
  *           the live-read data files, or scripts/ moved in none of the
- *           files omakit reads.
- *   info    the only read files that moved are ones omakit takes wording
+ *           files omakit reads, or only in files read as text whose values
+ *           are unchanged (named, with how many values).
+ *   info    the only read files that count are ones omakit takes wording
  *           or a label out of (WORDING_READS): what it prints may differ
  *           at HEAD, what it passes or refuses cannot. A newer omakit will
  *           carry the pin. Nothing for a user to do.
  *   advice  a file omakit executes or reads a rule from moved (a verdict
  *           may differ at HEAD, whether or not the two policy constants
  *           still read the same, since a rule can change without its
- *           version), a read file is gone at HEAD, or the form directory
- *           moved (the contract itself). The action is `upgrade` (the
- *           command, when the caller found a newer omakit published), else
- *           that the maintainer is notified; never an issue to open, since
- *           the weekly pin-freshness workflow opens the one there is. The
- *           two constants are printed beside the grade in both cases.
+ *           version), a value read out of a text-read file differs (both
+ *           values printed), a read file is gone at HEAD, or the form
+ *           directory moved (the contract itself). The action is `upgrade`
+ *           (the command, when the caller found a newer omakit published),
+ *           else that the maintainer is notified; never an issue to open,
+ *           since the weekly pin-freshness workflow opens the one there is.
+ *           The two constants are printed beside the grade in both cases.
  *
  * Null for `comparison` means the comparison was not made, which stays
  * advice: HEAD moved and nothing here can say the pin is fine. Full commits
@@ -218,15 +295,22 @@ export function pinFreshness(identity, head, comparison = null, { upgrade = null
   const pinned = changed.filter((pattern) => !LIVE_PATHS.includes(asPath(pattern)))
   const moved = compared ? comparison.moved : []
   const missing = compared ? comparison.missing : []
+  const textReads = comparison?.textReads || {}
   const pinPolicy = { baselineVersion: identity.baselineVersion, enforcementMode: identity.enforcementMode }
   const headPolicy = (compared && comparison.policyAtHead) || pinPolicy
   const policyDiffers = headPolicy.baselineVersion !== pinPolicy.baselineVersion || headPolicy.enforcementMode !== pinPolicy.enforcementMode
   const formMoved = pinned.includes(FORMS)
+  // The text-read files that moved, by whether every value read out of them is the same at HEAD.
+  const valuesOf = (path) => Object.entries(textReads[path]?.moved ? textReads[path].values : {})
+  const unchanged = moved.filter((path) => valuesOf(path).length && valuesOf(path).every(([, value]) => value.same))
+  const differing = moved.filter((path) => valuesOf(path).some(([, value]) => !value.same))
+  const effective = moved.filter((path) => !unchanged.includes(path))
   const verdictMoved = verdictBearing(moved)
+  const verdictEffective = verdictBearing(effective)
   const graded = moved.length > 0 || missing.length > 0 || formMoved
   const state = current ? "ok"
-    : comparison === null || policyDiffers || formMoved || missing.length || verdictMoved.length ? "advice"
-      : moved.length ? "info"
+    : comparison === null || policyDiffers || formMoved || missing.length || differing.length || verdictEffective.length ? "advice"
+      : effective.length ? "info"
         : "ok"
 
   const where = `pin ${identity.commit.slice(0, 7)}; marketplace ${branch} at ${head.commit.slice(0, 7)}`
@@ -234,7 +318,14 @@ export function pinFreshness(identity, head, comparison = null, { upgrade = null
   if (comparison === null) clauses.push("the paths omakit reads were not compared")
   else if (!changed.length) clauses.push("nothing omakit reads moved")
   else {
-    if (moved.length) clauses.push(`moved since the pin: ${list(moved)}${verdictMoved.length ? "" : " (wording and labels only)"}`)
+    if (effective.length) clauses.push(`moved since the pin: ${list(effective)}${verdictEffective.length || differing.length ? "" : " (wording and labels only)"}`)
+    for (const path of differing) {
+      for (const [name, value] of valuesOf(path).filter(([, entry]) => !entry.same)) clauses.push(`${name} ${JSON.stringify(value.pin)} at the pin, ${JSON.stringify(value.head)} at HEAD`)
+    }
+    if (unchanged.length) {
+      const count = unchanged.reduce((sum, path) => sum + valuesOf(path).length, 0)
+      clauses.push(`${list(unchanged)} moved, and ${count === 1 ? "the one value" : `the ${count} values`} omakit reads from ${unchanged.length === 1 ? "it" : "them"} ${count === 1 ? "is" : "are"} unchanged`)
+    }
     if (missing.length) clauses.push(`gone at HEAD: ${list(missing)}`)
     if (formMoved) clauses.push(`the form moved (${asPath(FORMS)}/)`)
     if (pinned.includes("/scripts/") && !moved.length && !missing.length) clauses.push(`scripts/ moved in none of the ${comparison.reads} files omakit reads`)
@@ -245,7 +336,7 @@ export function pinFreshness(identity, head, comparison = null, { upgrade = null
   const detail = current ? `the pin is the marketplace's current ${branch}-branch HEAD` : `${where}; ${clauses.join("; ")}${tail}`
 
   const action = state === "info"
-    ? `${moved.length === 1 ? "That file is" : "Those files are"} read for wording and labels, not for a pass or a refusal; what omakit prints may differ at HEAD, what it decides cannot. A newer omakit will carry the pin; nothing to do.`
+    ? `${effective.length === 1 ? "That file is" : "Those files are"} read for wording and labels, not for a pass or a refusal; what omakit prints may differ at HEAD, what it decides cannot. A newer omakit will carry the pin; nothing to do.`
     : state === "advice"
       ? upgrade
         ? `A newer omakit is published and may carry the pin: run \`${upgrade}\`. Until then every verdict here is the pin's, and the marketplace's own run on your issue is the one that counts.`
@@ -268,7 +359,9 @@ export function pinFreshness(identity, head, comparison = null, { upgrade = null
         reads: comparison.reads,
         moved,
         verdictMoved,
+        effective,
         missing,
+        textReads,
         policy: { pin: pinPolicy, head: headPolicy },
       }),
     },
@@ -396,10 +489,14 @@ export async function doctor({ repoRoot, offline = false, onPhase, env = process
     phase("reading the marketplace's current default-branch HEAD")
     try {
       const head = await resolveHead(MARKETPLACE_PIN.repository)
-      let comparison = { changedPaths: [], reads: pinnedReadSet(dir).length, moved: [], missing: [], policyAtHead: null }
+      let comparison
       if (head.commit !== identity.commit) {
         phase("comparing each file omakit reads between the pin and HEAD")
         comparison = await compare({ pinDir: dir, headCommit: head.commit, pinCommit: identity.commit })
+      } else {
+        // The pin is HEAD: nothing moved, and the values read as text are the pin's, read locally.
+        const reads = pinnedReadSet(dir)
+        comparison = { changedPaths: [], reads: reads.length, moved: [], missing: [], policyAtHead: null, textReads: await textReadsBetween({ pinDir: dir, pinCommit: identity.commit, reads }) }
       }
       checks.push(pinFreshness(identity, head, comparison, { upgrade }))
     } catch (error) {

package/tools/marketplace/measure-pin-grades.mjs

@@ -0,0 +1,119 @@
+// M7 reproduction: every marketplace commit in a range that touched a pinned
+// path other than the two data files (scripts/ and the form), graded as a
+// change from its parent, the parent as the pin and the commit as HEAD,
+// under the three comparisons doctor has shipped: tree, 0.6.6's (any such
+// path's tree or blob id moved); blob, 0.6.7's (pinFreshness without the
+// text-read values); value, the one since 0.6.10 (pinFreshness as it
+// ships). It runs the shipped comparePin() and pinFreshness() against a
+// local clone of the marketplace's history (a blob-filtered clone is
+// enough) and answers each request the comparison would make from that
+// clone, counting it: nothing is fetched by this script and nothing from
+// the clone is run. Measured on 2026-10-01: over the seven such commits
+// since 38060f89, the three grades it gives equal those of the v0.6.6 and
+// v0.6.7 tags' own code (docs/evidence/pin-freshness/2026-10-01-grades.json).
+import { execFileSync } from "node:child_process"
+import { resolve } from "node:path"
+import { pathToFileURL } from "node:url"
+import { PIN_PATHS, POLICY_MODULE, pinnedReadSet, policyConstants } from "./pin.mjs"
+import { LIVE_PATHS } from "./registry.mjs"
+import { comparePin, pinFreshness } from "./doctor.mjs"
+
+/** The pinned paths a grade can turn on: PIN_PATHS less the two data files read live. */
+export const GRADED_PATHS = Object.freeze(PIN_PATHS.map((pattern) => pattern.replace(/^\/|\/$/g, "")).filter((path) => !LIVE_PATHS.includes(path)))
+
+/**
+ * The two kinds of request comparePin() makes, answered from the clone: a
+ * tree read by `git ls-tree`, a file's text at a commit by `git show`.
+ * `requests` lists each, in order.
+ */
+export function cloneTransport(clone) {
+  const git = (...args) => execFileSync("git", ["-C", clone, ...args], { timeout: 60_000, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 })
+  const requests = []
+  const fetchJson = async (url) => {
+    requests.push(url)
+    const sha = String(url).match(/\/git\/trees\/([0-9a-f]{40})$/)?.[1]
+    if (!sha) throw new Error(`not a tree read at an object id: ${url}`)
+    const tree = git("ls-tree", sha).split("\n").filter(Boolean).map((line) => {
+      const [meta, path] = line.split("\t")
+      const [, type, id] = meta.split(" ")
+      return { path, type, sha: id }
+    })
+    return { sha, tree, truncated: false }
+  }
+  const fetchText = async (url) => {
+    requests.push(url)
+    const [, commit, path] = String(url).match(/\/([0-9a-f]{40})\/(.+)$/) || []
+    if (!commit) throw new Error(`not a file read at a commit: ${url}`)
+    return git("show", `${commit}:${path}`)
+  }
+  return { git, requests, fetchJson, fetchText }
+}
+
+/** One change graded three ways, with the read set resolved at `pin` and what the value comparison says of it. */
+export async function gradeChange(clone, pin, head) {
+  const transport = cloneTransport(clone)
+  const reads = pinnedReadSet(clone, undefined, (path) => transport.git("show", `${pin}:${path}`))
+  const identity = { commit: pin, ...policyConstants(transport.git("show", `${pin}:${POLICY_MODULE}`)) }
+  const comparison = await comparePin({ pinDir: clone, headCommit: head, pinCommit: pin, fetchJson: transport.fetchJson, fetchText: transport.fetchText, reads })
+  const at = { commit: head, branch: null }
+  const value = pinFreshness(identity, at, comparison)
+  const blob = pinFreshness(identity, at, { ...comparison, textReads: {} })
+  return {
+    readSet: reads.map((read) => read.path),
+    requests: transport.requests.length,
+    tree: value.evidence.pinned.length ? "advice" : "ok",
+    blob: blob.state,
+    value: value.state,
+    detail: value.detail,
+    effective: value.evidence.effective,
+    textReads: value.evidence.textReads,
+  }
+}
+
+/**
+ * Every commit in `since..until` that touched GRADED_PATHS, oldest first,
+ * each graded by gradeChange() against its first parent, and how many of
+ * those that touched a file in the read set each comparison grades advice.
+ */
+export async function measurePinGrades({ clone, since, until }) {
+  const git = (...args) => execFileSync("git", ["-C", clone, ...args], { timeout: 60_000, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 })
+  const range = `${git("rev-parse", since).trim()}..${git("rev-parse", until).trim()}`
+  const listed = git("log", "--reverse", "--format=%H%x09%cI%x09%s", range, "--", ...GRADED_PATHS).split("\n").filter(Boolean)
+  const commits = []
+  for (const line of listed) {
+    const [commit, committedAt, subject] = line.split("\t")
+    const parent = git("rev-parse", `${commit}^`).trim()
+    const touched = git("log", "-1", "--format=", "--name-only", commit, "--", ...GRADED_PATHS).split("\n").filter(Boolean)
+    const { readSet, ...graded } = await gradeChange(clone, parent, commit)
+    commits.push({ commit, committedAt, subject, parent, touched, inReadSet: touched.filter((path) => readSet.includes(path)), ...graded })
+  }
+  const touching = commits.filter((row) => row.inReadSet.length)
+  const advice = (rows, rule) => rows.filter((row) => row[rule] === "advice").length
+  return {
+    measurement: "M7",
+    measuredAt: new Date().toISOString(),
+    range,
+    gradedPaths: GRADED_PATHS,
+    method: "Each commit in the range that touched a graded path, graded against its first parent by the shipped comparePin() and pinFreshness(), every request answered from the local clone: tree is 0.6.6's rule (a graded path's object id moved), blob 0.6.7's (pinFreshness without text-read values), value the shipped grade.",
+    commits,
+    touchingReadSet: touching.length,
+    advice: { tree: advice(touching, "tree"), blob: advice(touching, "blob"), value: advice(touching, "value") },
+    adviceOverAll: { commits: commits.length, tree: advice(commits, "tree"), blob: advice(commits, "blob"), value: advice(commits, "value") },
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  const args = process.argv.slice(2)
+  const option = (name) => {
+    const index = args.indexOf(name)
+    return index >= 0 ? args[index + 1] : undefined
+  }
+  const clone = option("--clone")
+  const since = option("--since")
+  const until = option("--until") || "HEAD"
+  if (!clone || !since || args.length !== (option("--until") ? 6 : 4)) {
+    process.stderr.write("usage: node tools/marketplace/measure-pin-grades.mjs --clone <marketplace clone> --since <commit> [--until <commit>]\n")
+    process.exit(2)
+  }
+  process.stdout.write(`${JSON.stringify(await measurePinGrades({ clone: resolve(clone), since, until }), null, 2)}\n`)
+}

package/tools/marketplace/measure-registry-figures.mjs

@@ -0,0 +1,160 @@
+// M4 and M6 reproduction: the registry figures at the pin, recorded per pin
+// in docs/evidence/registry-figures.json and rendered from that one record
+// into the three places that cite them: the literal block in
+// tests/unit/registry-figures.test.mjs, the M4 block and the M6 row of
+// docs/MEASUREMENTS.md, and the Registry facts row of
+// docs/UPSTREAM_CONTRACT.md. Measured on the 0.6.10 bump: the same
+// figures were retyped by hand in nine files, and four of them
+// (preflight.mjs, MARKETPLACE.md, HOW.md, INSPECT_DESIGN.md) no test reads.
+// Without --write it prints the record entry for the pin and names each
+// file that is not yet rendered from it; with --write it records the entry
+// and rewrites those files.
+//
+// Every name in the output (outcomes, capabilities, finding rules) is a key
+// of the registry's own data, never typed here.
+import { execFileSync } from "node:child_process"
+import { readFileSync, writeFileSync } from "node:fs"
+import { join, resolve } from "node:path"
+import { fileURLToPath, pathToFileURL } from "node:url"
+import { MARKETPLACE_PIN, requirePin } from "./pin.mjs"
+import { baselineFigures, figure } from "./registry.mjs"
+
+const ROOT = resolve(fileURLToPath(new URL("../..", import.meta.url)))
+
+export const RECORD_PATH = "docs/evidence/registry-figures.json"
+export const TEST_PATH = "tests/unit/registry-figures.test.mjs"
+export const MEASUREMENTS_PATH = "docs/MEASUREMENTS.md"
+export const CONTRACT_PATH = "docs/UPSTREAM_CONTRACT.md"
+
+const TEST_BLOCK = /\/\/ registry-figures:begin[^\n]*\n[\s\S]*?\/\/ registry-figures:end\n/
+const M4_BLOCK = /<!-- registry-figures:m4 -->\n[\s\S]*?<!-- \/registry-figures:m4 -->\n/
+const M6_ROW = /^\| Listed sources whose validated commit was superseded at least once \|.*\|$/m
+const CONTRACT_ROW = /^\| Registry facts \|.*\|$/m
+
+/** The record entry for the pinned checkout: its commit, when it was committed, and baselineFigures() over it. */
+export function entryAtPin(pinDir) {
+  const commit = execFileSync("git", ["-C", pinDir, "rev-parse", "HEAD"], { timeout: 60_000, encoding: "utf8" }).trim()
+  const committedAt = execFileSync("git", ["-C", pinDir, "log", "-1", "--format=%cI", "HEAD"], { timeout: 60_000, encoding: "utf8" }).trim()
+  return { commit, committedAt: new Date(committedAt).toISOString().replace(/\.000Z$/, "Z"), figures: baselineFigures({ pinDir }) }
+}
+
+/** The record with `entry` first, replacing an entry for the same commit; the others keep their order, newest first. */
+export function upsert(record, entry) {
+  return { ...record, pins: [entry, ...record.pins.filter((pin) => pin.commit !== entry.commit)] }
+}
+
+/** A table of counts, largest first and by name on a tie: the order every list here is printed in. */
+const ranked = (table) => Object.entries(table).sort(([a, x], [b, y]) => y - x || a.localeCompare(b))
+const short = (commit) => commit.slice(0, 8)
+const when = (iso) => `${iso.slice(0, 10)} ${iso.slice(11, 16)} UTC`
+const percent = (part, whole) => ((part / whole) * 100).toFixed(1)
+
+/** Prose wrapped at 76 columns, the way the documents are written. */
+function wrap(text, width = 76) {
+  const lines = []
+  let line = ""
+  for (const word of text.split(" ")) {
+    if (line && line.length + 1 + word.length > width) {
+      lines.push(line)
+      line = word
+    } else {
+      line = line ? `${line} ${word}` : word
+    }
+  }
+  if (line) lines.push(line)
+  return lines.join("\n")
+}
+
+/** The literal block the figures test holds the pin to. */
+export function renderTest(text, record) {
+  const [current] = record.pins
+  const block = [
+    `// registry-figures:begin rendered from ${RECORD_PATH} by \`node tools/marketplace/measure-registry-figures.mjs --write\`; change the record, not this block`,
+    `const AT_PIN = Object.freeze(${JSON.stringify({ commit: current.commit, figures: current.figures }, null, 2)})`,
+    "// registry-figures:end",
+    "",
+  ].join("\n")
+  if (!TEST_BLOCK.test(text)) throw new Error(`${TEST_PATH} has no registry-figures block to render into`)
+  return text.replace(TEST_BLOCK, () => block)
+}
+
+/** M4's figures and the earlier pins' table, and M6's superseded row. */
+export function renderMeasurements(text, record) {
+  const [current, ...earlier] = record.pins
+  const f = current.figures
+  const outcomes = ranked(f.outcomes)
+  const lines = [
+    "<!-- registry-figures:m4 -->",
+    wrap(`From \`registry.json\` at the pin (\`${short(current.commit)}\`, ${when(current.committedAt)}): ${figure(f.sources)} listed sources, of which ${figure(f.withBaseline)} carry a recorded baseline (the rest were listed before the baseline existed or have no record):`),
+    "",
+    "| Outcome | Count |",
+    "| --- | --- |",
+    ...outcomes.map(([name, n]) => `| \`${name}\` | ${figure(n)} |`),
+    `| Findings ever recorded, total | ${figure(f.findingsTotal)} (${ranked(f.findings).map(([name, n]) => `\`${name}\` ${figure(n)}`).join(", ")}) |`,
+    "",
+    wrap(`Capabilities recorded: ${ranked(f.capabilities).map(([name, n]) => `${name} ${figure(n)}`).join(", ")}.`),
+  ]
+  if (earlier.length) {
+    lines.push(
+      "",
+      "At the earlier pins, counted the same way from the same two files:",
+      "",
+      `| Pin | Sources | With a baseline | ${outcomes.map(([name]) => `\`${name}\``).join(" | ")} |`,
+      `| --- | --- | --- | ${outcomes.map(() => "---").join(" | ")} |`,
+      ...earlier.map((pin) => `| \`${short(pin.commit)}\` (${when(pin.committedAt)}) | ${figure(pin.figures.sources)} | ${figure(pin.figures.withBaseline)} | ${outcomes.map(([name]) => figure(pin.figures.outcomes[name] || 0)).join(" | ")} |`),
+    )
+  }
+  lines.push("<!-- /registry-figures:m4 -->", "")
+  const superseded = (pin) => `${figure(pin.figures.superseded.sources)} of ${figure(pin.figures.sources)}, ${percent(pin.figures.superseded.sources, pin.figures.sources)}%, ${figure(pin.figures.superseded.commits)} commits`
+  const row = `| Listed sources whose validated commit was superseded at least once | ${figure(f.superseded.sources)} of ${figure(f.sources)} (${percent(f.superseded.sources, f.sources)}%) at pin \`${short(current.commit)}\`, ${figure(f.superseded.commits)} superseded commits, one source revalidated ${f.superseded.most} times${earlier.length ? ` (${earlier.map((pin) => `at pin \`${short(pin.commit)}\`: ${superseded(pin)}`).join("; ")})` : ""} |`
+  if (!M4_BLOCK.test(text)) throw new Error(`${MEASUREMENTS_PATH} has no registry-figures:m4 block to render into`)
+  if (!M6_ROW.test(text)) throw new Error(`${MEASUREMENTS_PATH} has no superseded row in M6 to render into`)
+  return text.replace(M4_BLOCK, () => lines.join("\n")).replace(M6_ROW, () => row)
+}
+
+/** The Registry facts row of the pinned-checkout table. */
+export function renderContract(text, record) {
+  const f = record.pins[0].figures
+  const row = `| Registry facts | ${figure(f.listingValidated)} sources with \`listingValidatedCommit\`; ${figure(f.withBaseline)} with an \`automatedSecurityBaseline\` record (${ranked(f.outcomes).map(([name, n]) => `${figure(n)} ${name}`).join(", ")}); ${figure(f.catalogPlugins)} catalog plugin ids; ${figure(f.retiredIds)} retired ids; ${figure(f.superseded.sources)} sources (${percent(f.superseded.sources, f.sources)}%) with at least one superseded validated commit, ${figure(f.superseded.commits)} superseded commits in all |`
+  if (!CONTRACT_ROW.test(text)) throw new Error(`${CONTRACT_PATH} has no Registry facts row to render into`)
+  return text.replace(CONTRACT_ROW, () => row)
+}
+
+/** Each file the record renders into, as it is and as the record would have it. */
+export function renderAll(record, read = (path) => readFileSync(join(ROOT, path), "utf8")) {
+  return [
+    { path: RECORD_PATH, now: read(RECORD_PATH), next: `${JSON.stringify(record, null, 2)}\n` },
+    { path: TEST_PATH, now: read(TEST_PATH), next: renderTest(read(TEST_PATH), record) },
+    { path: MEASUREMENTS_PATH, now: read(MEASUREMENTS_PATH), next: renderMeasurements(read(MEASUREMENTS_PATH), record) },
+    { path: CONTRACT_PATH, now: read(CONTRACT_PATH), next: renderContract(read(CONTRACT_PATH), record) },
+  ]
+}
+
+/**
+ * The pin's entry recorded and every file rendered from the record. With
+ * `write`, the files that differ are written; without, nothing is. Returns
+ * the entry and, per file, whether it was (or would be) rewritten.
+ */
+export function measureRegistryFigures({ repoRoot = ROOT, pinDir = requirePin(repoRoot).dir, write = false } = {}) {
+  const entry = entryAtPin(pinDir)
+  if (entry.commit !== MARKETPLACE_PIN.commit) throw new Error(`the checkout at ${pinDir} is at ${entry.commit}, not the pin ${MARKETPLACE_PIN.commit}`)
+  const read = (path) => readFileSync(join(repoRoot, path), "utf8")
+  const record = upsert(JSON.parse(read(RECORD_PATH)), entry)
+  const files = renderAll(record, read)
+  if (write) {
+    for (const file of files.filter((candidate) => candidate.next !== candidate.now)) writeFileSync(join(repoRoot, file.path), file.next)
+  }
+  return { entry, files: Object.fromEntries(files.map((file) => [file.path, file.next === file.now ? "current" : write ? "written" : "stale"])) }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  const args = process.argv.slice(2)
+  const unknown = args.filter((arg) => arg !== "--write")
+  if (unknown.length) {
+    process.stderr.write(`usage: node tools/marketplace/measure-registry-figures.mjs [--write]; not ${unknown.join(" ")}\n`)
+    process.exit(2)
+  }
+  const result = measureRegistryFigures({ write: args.includes("--write") })
+  process.stdout.write(`${JSON.stringify(result, null, 2)}\n`)
+  if (!args.includes("--write") && Object.values(result.files).includes("stale")) process.exitCode = 1
+}

package/tools/marketplace/pin.mjs

@@ -5,8 +5,9 @@
 // It fetches only what omakit reads. The marketplace at this commit is 325 MB,
 // of which 168 MB is preview imagery and 151 MB is history, and omakit reads
 // twenty files out of it, sixteen of them under scripts/ (PIN_READS). A
-// blob-filtered, sparsely checked out fetch of just those paths is 15 MB and
-// takes 2 seconds instead of 17. PIN_PATHS below is the whole list, and
+// blob-filtered, sparsely checked out fetch of just those paths was 15 MB and
+// takes 2 seconds instead of 17; at pin b441b4f0 (2026-10-01) the same fetch
+// was 23 MB on disk in 3.1 seconds. PIN_PATHS below is the whole list, and
 // tests/unit/pin.test.mjs fails if any module starts reading a path outside
 // it, because on a partial clone such a read would quietly reach for the
 // network instead of failing.
@@ -27,10 +28,13 @@ export class PinError extends Error {
 
 export const MARKETPLACE_PIN = Object.freeze({
   repository: "https://github.com/omacom/omarchy-plugin-marketplace",
-  commit: "b7b2965431c52fc6311fdb389bd9f0d6275235c4",
-  commitSubject: "Add OmaStudio plugin (#6843)",
+  commit: "b441b4f059132b5b7203a7563027f2b3a9adaa1d",
+  commitSubject: "Add LINE for Omarchy plugin (#9470)",
   baselineVersion: "3",
   enforcementMode: "selective",
+  // What a fresh sparse fetch of this commit measured on disk, for the one
+  // line `omakit pin` prints before it fetches. A pin bump re-measures it.
+  fetchedMb: 23,
 })
 
 /**
@@ -40,8 +44,9 @@ export const MARKETPLACE_PIN = Object.freeze({
  *   /scripts/                     the official submission parser, baseline
  *                                 scanner, policy, report and record modules,
  *                                 and build-catalog.mjs read as text for the
- *                                 reserved plugin-id namespace. Taken whole
- *                                 because those modules import each other.
+ *                                 reserved plugin-id namespace and the
+ *                                 category mapping. Taken whole because
+ *                                 those modules import each other.
  *   /registry.json                retired plugin ids, listed repositories
  *   /site/catalog.json            listed plugin ids
  *   /.github/ISSUE_TEMPLATE/      the submission form: the whole contract
@@ -83,8 +88,19 @@ export const POLICY_MODULE = "scripts/security-baseline-policy.mjs"
  *   approve-submission.mjs           watch.mjs, text: one label
  *   approve-plugin-update.mjs        review-cost.mjs, text: one label
  *
+ * A file read as text carries `readers`: each value omakit takes out of
+ * it, by name, as a function from the file's text to the value. This is
+ * the one list of what is read out of such a file, and the functions are
+ * the ones the modules above call on the pin's text and the ones `omakit
+ * doctor` calls on the pin's text and on HEAD's, so the two sides of the
+ * comparison cannot read differently. Measured on 2026-10-01 (M7): the
+ * three commits that moved build-catalog.mjs since b7b29654 changed
+ * neither of the two values read out of it, and the blob comparison
+ * graded each of them advice.
+ *
  * tests/unit/pin.test.mjs derives this list from the sources and fails on
- * a read that is not here, or one listed the wrong way round.
+ * a read that is not here, or one listed the wrong way round, and holds
+ * `readers` to exactly the files read as text.
  */
 export const PIN_READS = Object.freeze([
   Object.freeze({ path: "scripts/submission.mjs", imported: true }),
@@ -94,9 +110,9 @@ export const PIN_READS = Object.freeze([
   Object.freeze({ path: "scripts/security-baseline-report.mjs", imported: true }),
   Object.freeze({ path: "scripts/security-baseline-record.mjs", imported: true }),
   Object.freeze({ path: "scripts/submission-feedback.mjs", imported: true }),
-  Object.freeze({ path: "scripts/build-catalog.mjs", imported: false }),
-  Object.freeze({ path: "scripts/approve-submission.mjs", imported: false }),
-  Object.freeze({ path: "scripts/approve-plugin-update.mjs", imported: false }),
+  Object.freeze({ path: "scripts/build-catalog.mjs", imported: false, readers: Object.freeze({ reservedNamespace, catalogPresentation }) }),
+  Object.freeze({ path: "scripts/approve-submission.mjs", imported: false, readers: Object.freeze({ validatedLabel }) }),
+  Object.freeze({ path: "scripts/approve-plugin-update.mjs", imported: false, readers: Object.freeze({ updateLabel }) }),
 ])
 
 /**
@@ -126,9 +142,9 @@ export const RELATIVE_IMPORT = /\bfrom\s+["'](\.\.?\/[^"']+)["']/g
  * no guard; Node's ESM loader requires an extension.) If one of these ever
  * appears in an executed file of the pinned read set, pinnedReadSet() could
  * miss a file, and tests/unit/pin.test.mjs fails on the file and line
- * instead of doctor staying quiet. Measured at pin b7b29654: none of
- * the 13 executed files uses any of them (the three read as text are not
- * scanned, since nothing they import is loaded).
+ * instead of doctor staying quiet. Measured at pins b7b29654 and
+ * b441b4f0: none of the 13 executed files uses any of them (the three read
+ * as text are not scanned, since nothing they import is loaded).
  */
 export const UNFOLLOWED_IMPORTS = Object.freeze([
   Object.freeze({ form: "dynamic import()", pattern: /\bimport\s*\(/ }),
@@ -164,12 +180,14 @@ export function unfollowedImports(pinDir, reads = pinnedReadSet(pinDir)) {
  * the file that imports it or null for one omakit opens itself. A
  * specifier that leaves scripts/ (the marketplace's site/ assets) or names
  * a package (`sharp`) is not followed: PIN_PATHS does not fetch it, so
- * omakit could not read it. Measured at pin b7b29654: 16 of the 34 files
- * under scripts/, 10 opened by omakit and 6 imported by those.
+ * omakit could not read it. Measured at pins b7b29654 and b441b4f0: 16 of
+ * the 34 files under scripts/, 10 opened by omakit and 6 imported by those.
+ * `text` reads one file's text by its path; it defaults to the checkout in
+ * `pinDir`, and measure-pin-grades.mjs hands in a commit's blobs instead.
  *
  * @returns {{ path: string, imported: boolean, via: string|null }[]}
  */
-export function pinnedReadSet(pinDir, reads = PIN_READS) {
+export function pinnedReadSet(pinDir, reads = PIN_READS, text = (path) => readFileSync(join(pinDir, path), "utf8")) {
   const set = new Map()
   const queue = []
   for (const read of reads) {
@@ -178,13 +196,13 @@ export function pinnedReadSet(pinDir, reads = PIN_READS) {
   }
   while (queue.length) {
     const from = queue.shift()
-    let text
+    let source
     try {
-      text = readFileSync(join(pinDir, from), "utf8")
+      source = text(from)
     } catch (error) {
       throw new PinError(`cannot read ${from} from the pinned checkout at ${pinDir}: ${error.message}`)
     }
-    for (const match of text.matchAll(RELATIVE_IMPORT)) {
+    for (const match of source.matchAll(RELATIVE_IMPORT)) {
       const path = posix.normalize(posix.join(posix.dirname(from), match[1]))
       if (!path.startsWith("scripts/") || set.has(path)) continue
       set.set(path, { path, imported: true, via: from })
@@ -219,7 +237,7 @@ function pinMigration(repoRoot, env = process.env) {
   if (!existsSync(join(oldDir, ".git")) || existsSync(newDir)) return null
   const remedy = `mkdir -p -- ${shellQuote(dirname(newDir))} && mv -- ${shellQuote(oldDir)} ${shellQuote(newDir)}`
   return new PinError(
-    `the marketplace pin is still at the old in-repository location ${oldDir}; the user-writable location ${newDir} does not exist. Omakit will not move the measured 15 MB checkout without you.`,
+    `the marketplace pin is still at the old in-repository location ${oldDir}; the user-writable location ${newDir} does not exist. Omakit will not move the checkout (${pinDiskUsage(oldDir, env)}) without you.`,
     { code: "marketplace-pin-migration-required", remedy },
   )
 }
@@ -243,6 +261,58 @@ export function policyConstants(text) {
   }
 }
 
+// The readers PIN_READS registers for the files read as text. Each takes
+// the file's text and returns the value, or null where the text does not
+// carry it, the way policyConstants() does for the policy module: no file
+// is opened here and no module is loaded, so the same function reads the
+// pin's copy for a check and HEAD's copy for doctor's comparison.
+
+/**
+ * The reserved plugin-id namespace as the marketplace states it in
+ * `build-catalog.mjs`, next to its own `reserved-plugin-id` check, with
+ * its trailing dot. Read, not copied, so a pin update moves it.
+ */
+export function reservedNamespace(text) {
+  const source = String(text || "")
+  const match = source.match(/startsWith\("([A-Za-z0-9.\-_]+\.)"\)\s*\)\s*\{\s*\n\s*checkError\("reserved-plugin-id"/)
+    || source.match(/checkError\("reserved-plugin-id",\s*`[^`]*\$\{[^}]*\}:\s*the ([A-Za-z0-9.\-_]+)\.\*\s+namespace is reserved`/)
+  if (!match) return null
+  return match[1].endsWith(".") ? match[1] : `${match[1]}.`
+}
+
+/**
+ * How the marketplace itself presents a plugin it lists, read out of
+ * `build-catalog.mjs` rather than copied: `categoryFor(kinds)` maps the
+ * manifest's kinds to a category in order of its `if` lines, with a
+ * fallback, and the tags are the first three kinds lowercased. `omakit
+ * submit` offers these as the default answer when it has to ask for a
+ * category and tags, so the default is the marketplace's own choice; a
+ * mapping that cannot be read offers no default. tests/unit/registry-
+ * figures.test.mjs pins what the mapping is at this commit, so a
+ * marketplace that changes it fails the suite until the docs follow.
+ *
+ * @returns {{ rules: Array<{ kinds: string[], category: string }>, fallback: string|null, tagsFromKinds: boolean }}
+ */
+export function catalogPresentation(text) {
+  const source = String(text || "")
+  const body = source.match(/function categoryFor\([^)]*\)\s*\{([\s\S]*?)\n\}/)?.[1] || ""
+  const rules = [...body.matchAll(/if \(((?:kinds\.includes\("[^"]+"\)(?:\s*\|\|\s*)?)+)\) return "([^"]+)";/g)]
+    .map((match) => ({ kinds: [...match[1].matchAll(/"([^"]+)"/g)].map((kind) => kind[1]), category: match[2] }))
+  const fallback = body.match(/\n\s*return "([^"]+)";\s*$/)?.[1] || null
+  const tagsFromKinds = /tags:\s*kinds\.slice\(0,\s*3\)\.map\(\(kind\) => kind\.toLowerCase\(\)\)/.test(source)
+  return { rules, fallback, tagsFromKinds }
+}
+
+/** The label `approve-submission.mjs` requires beside `submission` before it approves: the one `omakit watch` reads as validated. */
+export function validatedLabel(text) {
+  return String(text || "").match(/for \(const required of \["submission", "([^"]+)"/)?.[1] || null
+}
+
+/** The first label `approve-plugin-update.mjs` requires: the one an update issue carries, for review cost. */
+export function updateLabel(text) {
+  return String(text || "").match(/for \(const required of \["([^"]+)"/)?.[1] || null
+}
+
 /** Identity of the checkout at `dir`: commit plus the policy constants read from the pinned source. */
 function readPinIdentity(dir) {
   const commit = git(dir, ["rev-parse", "HEAD"]).trim()
@@ -344,7 +414,7 @@ function populatePin(dir, log) {
   mkdirSync(dir, { recursive: true })
   execFileSync("git", ["init", "-q", dir], { timeout: 60_000, encoding: "utf8" })
   git(dir, ["remote", "add", "origin", MARKETPLACE_PIN.repository])
-  log({ state: "fetching", text: `fetching the pinned marketplace checkout, ${MARKETPLACE_PIN.commit.slice(0, 7)}, about 15 MB` })
+  log({ state: "fetching", text: `fetching the pinned marketplace checkout, ${MARKETPLACE_PIN.commit.slice(0, 7)}, about ${MARKETPLACE_PIN.fetchedMb} MB` })
   git(dir, ["config", "core.sparseCheckout", "true"])
   mkdirSync(join(dir, ".git/info"), { recursive: true })
   writeFileSync(join(dir, ".git/info/sparse-checkout"), `${PIN_PATHS.join("\n")}\n`)
@@ -459,7 +529,7 @@ export function ensurePin(repoRoot, log = () => {}, env = process.env, { populat
 export function pinDiskUsage(dir, env = process.env) {
   // -H follows a symlink given on the command line (POSIX; GNU's -D). Measured
   // without it: a checkout reached through a symlink reported 0.0 MB, the size
-  // of the link, while the directory behind it was 15 MB.
+  // of the link, while the directory behind it was 15 MB (at pin 38060f89).
   //
   // The total is read whether or not du exited 0. du exits 1 when a file it
   // listed is gone by the time it reaches it, and still prints the total.

package/tools/marketplace/preflight.mjs

@@ -3,8 +3,8 @@
 // its outcome will cause on submission.
 //
 // Measured reason this runs before submitting (docs/MEASUREMENTS.md M4): of the
-// 3,619 listed sources with a recorded baseline at the pin, it produced 2,031
-// `passed`, 1,562 `review-required` and 26 `needs-fixes` (counted by
+// 4,449 listed sources with a recorded baseline at the pin, it produced 2,451
+// `passed`, 1,962 `review-required` and 36 `needs-fixes` (counted by
 // registry.mjs baselineFigures, pinned by tests/unit/registry-figures.test.mjs). `review-required` is not a defect and
 // needs no source change, but it does mean a human must look, and it is the
 // single largest determinant of whether a submission waits on a person. An

package/tools/marketplace/registry.mjs

@@ -26,7 +26,7 @@
 
 import { mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"
 import { dirname, join } from "node:path"
-import { MARKETPLACE_PIN, POLICY_MODULE, requirePin } from "./pin.mjs"
+import { MARKETPLACE_PIN, PIN_READS, POLICY_MODULE, catalogPresentation, requirePin, reservedNamespace } from "./pin.mjs"
 import { defaultBranchHead, getJson } from "./github.mjs"
 import { omakitCacheDir } from "./paths.mjs"
 
@@ -38,12 +38,14 @@ export const CATALOG_BUILDER_PATH = "scripts/build-catalog.mjs"
 export const LIVE_PATHS = Object.freeze([REGISTRY_PATH, CATALOG_PATH])
 
 /**
- * The one file read from HEAD as text and used for nothing: `omakit doctor`
- * reads the policy module at HEAD to compare its two constants with the
- * pin's (pin.mjs policyConstants) and drops the text. It is never imported,
- * never cached and never a source of a rule; the rules stay the pin's.
+ * The files read from HEAD as text and used for nothing but a comparison:
+ * `omakit doctor` reads the policy module at HEAD to compare its two
+ * constants with the pin's (pin.mjs policyConstants), and each file
+ * PIN_READS reads as text to compare the values its `readers` take out of
+ * it, and drops the text. None is ever imported, cached or a source of a
+ * rule; the rules stay the pin's.
  */
-export const HEAD_TEXT_PATHS = Object.freeze([POLICY_MODULE])
+export const HEAD_TEXT_PATHS = Object.freeze([POLICY_MODULE, ...PIN_READS.filter((read) => read.readers).map((read) => read.path)])
 
 export class RegistryError extends Error {
   constructor(code, message) {
@@ -62,45 +64,17 @@ function readJson(pinDir, relative) {
 }
 
 /**
- * The reserved namespace as the marketplace states it, read from the pinned
- * `build-catalog.mjs` next to its own `reserved-plugin-id` check. Read, not
- * copied, so a pin update moves it.
+ * The text of the pinned catalog builder, the one file under scripts/ this
+ * module reads: never imported (it imports `sharp`), read for the two
+ * values PIN_READS registers for it, `reservedNamespace` and
+ * `catalogPresentation` (pin.mjs). Those two are re-exported here, where
+ * the checks that use them have always found them.
  */
-export function reservedNamespace(pinDir) {
-  const source = readFileSync(join(pinDir, CATALOG_BUILDER_PATH), "utf8")
-  const match = source.match(/startsWith\("([A-Za-z0-9.\-_]+\.)"\)\s*\)\s*\{\s*\n\s*checkError\("reserved-plugin-id"/)
-    || source.match(/checkError\("reserved-plugin-id",\s*`[^`]*\$\{[^}]*\}:\s*the ([A-Za-z0-9.\-_]+)\.\*\s+namespace is reserved`/)
-  if (!match) {
-    throw new RegistryError(
-      "pin-unreadable",
-      `cannot read the reserved plugin-id namespace from ${CATALOG_BUILDER_PATH} at the pin; refusing to guess it`,
-    )
-  }
-  return match[1].endsWith(".") ? match[1] : `${match[1]}.`
+export function catalogBuilderText(pinDir) {
+  return readFileSync(join(pinDir, CATALOG_BUILDER_PATH), "utf8")
 }
 
-/**
- * How the marketplace itself presents a plugin it lists, read out of the
- * pinned `build-catalog.mjs` rather than copied: `categoryFor(kinds)` maps the
- * manifest's kinds to a category in order of its `if` lines, with a fallback,
- * and the tags are the first three kinds lowercased. `omakit submit` offers
- * these as the default answer when it has to ask for a category and tags, so
- * the default is the marketplace's own choice; a mapping that cannot be read
- * offers no default. tests/unit/registry-figures.test.mjs pins what the
- * mapping is at this commit, so a marketplace that changes it fails the suite
- * until the docs follow.
- *
- * @returns {{ rules: Array<{ kinds: string[], category: string }>, fallback: string|null, tagsFromKinds: boolean }}
- */
-export function catalogPresentation(pinDir) {
-  const source = readFileSync(join(pinDir, CATALOG_BUILDER_PATH), "utf8")
-  const body = source.match(/function categoryFor\([^)]*\)\s*\{([\s\S]*?)\n\}/)?.[1] || ""
-  const rules = [...body.matchAll(/if \(((?:kinds\.includes\("[^"]+"\)(?:\s*\|\|\s*)?)+)\) return "([^"]+)";/g)]
-    .map((match) => ({ kinds: [...match[1].matchAll(/"([^"]+)"/g)].map((kind) => kind[1]), category: match[2] }))
-  const fallback = body.match(/\n\s*return "([^"]+)";\s*$/)?.[1] || null
-  const tagsFromKinds = /tags:\s*kinds\.slice\(0,\s*3\)\.map\(\(kind\) => kind\.toLowerCase\(\)\)/.test(source)
-  return { rules, fallback, tagsFromKinds }
-}
+export { catalogPresentation, reservedNamespace }
 
 /**
  * The marketplace's own presentation for a manifest's kinds: the category its
@@ -149,8 +123,8 @@ export function sameRepository(a, b) {
  * a branch name, so the two files always come from the same commit and the
  * commit named in the output is the one they came from; never a path outside
  * LIVE_PATHS, so nothing executable can arrive this way. (headTextUrl below
- * reaches the same host for one module's text, which is compared and never
- * run.)
+ * reaches the same host for the text of the files doctor compares, which is
+ * compared and never run.)
  */
 export function liveFileUrl(commit, path) {
   if (!/^[0-9a-f]{40}$/.test(String(commit))) {
@@ -163,17 +137,17 @@ export function liveFileUrl(commit, path) {
 }
 
 /**
- * The same URL shape for the one file doctor reads from HEAD as text:
+ * The same URL shape for the files doctor reads from HEAD as text:
  * HEAD_TEXT_PATHS, at a 40-character commit, through the same host and the
- * same GET call site. Its text is compared and dropped; `liveFileUrl` still
- * refuses it, so nothing reads it as data.
+ * same GET call site. Their text is compared and dropped; `liveFileUrl`
+ * still refuses them, so nothing reads them as data.
  */
 export function headTextUrl(commit, path) {
   if (!/^[0-9a-f]{40}$/.test(String(commit))) {
     throw new RegistryError("usage", `a marketplace file is read at a 40-character commit, not "${commit}"`)
   }
   if (!HEAD_TEXT_PATHS.includes(path)) {
-    throw new RegistryError("usage", `${path} is never read from HEAD as text; only ${HEAD_TEXT_PATHS.join(" and ")} ${HEAD_TEXT_PATHS.length === 1 ? "is" : "are"}`)
+    throw new RegistryError("usage", `${path} is never read from HEAD as text; only ${HEAD_TEXT_PATHS.join(", ")} are`)
   }
   return rawFileUrl(commit, path)
 }
@@ -371,9 +345,17 @@ export function idUniverse(options = {}) {
     throw new RegistryError("pin-unreadable", "the pinned catalog and registry produced no listed ids or repositories")
   }
 
+  const reservedPrefix = reservedNamespace(catalogBuilderText(pinDir))
+  if (!reservedPrefix) {
+    throw new RegistryError(
+      "pin-unreadable",
+      `cannot read the reserved plugin-id namespace from ${CATALOG_BUILDER_PATH} at the pin; refusing to guess it`,
+    )
+  }
+
   return {
     pinDir,
-    reservedPrefix: reservedNamespace(pinDir),
+    reservedPrefix,
     listedIds,
     retiredIds,
     listedRepositories,
@@ -391,12 +373,13 @@ export function idUniverse(options = {}) {
 /**
  * The recorded baseline over every listed source, counted from registry.json at
  * the pin. This is the one place the figures cited by `baseline.preflight` and
- * docs/MEASUREMENTS.md M4 come from; tests/unit/registry-figures.test.mjs pins
- * the values, so a pin bump changes the printed number rather than leaving a
- * stale literal behind.
+ * docs/MEASUREMENTS.md M4 come from; measure-registry-figures.mjs records
+ * them per pin and renders the test and the two documents that cite them, so
+ * a pin bump changes the printed number rather than leaving a stale literal
+ * behind.
  *
  * @param {{ repoRoot?: string, pinDir?: string }} [options]
- * @returns {{ sources: number, withBaseline: number, outcomes: Record<string, number>,
+ * @returns {{ sources: number, listingValidated: number, withBaseline: number, outcomes: Record<string, number>,
  *             capabilities: Record<string, number>, findings: Record<string, number>,
  *             findingsTotal: number, superseded: { sources: number, commits: number, most: number },
  *             retiredIds: number, catalogPlugins: number }}
@@ -411,11 +394,13 @@ export function baselineFigures(options = {}) {
   const capabilities = {}
   const findings = {}
   let withBaseline = 0
+  let listingValidated = 0
   let findingsTotal = 0
   let supersededSources = 0
   let supersededCommits = 0
   let most = 0
   for (const source of sources) {
+    if (typeof source?.listingValidatedCommit === "string" && source.listingValidatedCommit) listingValidated += 1
     const baseline = source?.automatedSecurityBaseline
     if (baseline && typeof baseline.outcome === "string") {
       withBaseline += 1
@@ -433,6 +418,7 @@ export function baselineFigures(options = {}) {
   }
   return {
     sources: sources.length,
+    listingValidated,
     withBaseline,
     outcomes,
     capabilities,

package/tools/marketplace/review-cost.mjs

@@ -2,7 +2,7 @@
 import { readFileSync } from "node:fs"
 import { join } from "node:path"
 import { pathToFileURL } from "node:url"
-import { requirePin } from "./pin.mjs"
+import { requirePin, updateLabel as updateLabelOf } from "./pin.mjs"
 import { token, issue, parseIssueUrl, compareCommits } from "./github.mjs"
 import { discoverWatchIssues, repositoryFor } from "./watch.mjs"
 import { repositorySlug } from "./registry.mjs"
@@ -12,8 +12,7 @@ import { submissionContract } from "./form.mjs"
 export async function reviewPolicy(repoRoot) {
   const { dir } = requirePin(repoRoot)
   const policy = await import(pathToFileURL(join(dir, "scripts/security-baseline-policy.mjs")).href)
-  const approval = readFileSync(join(dir, "scripts/approve-plugin-update.mjs"), "utf8")
-  const updateLabel = approval.match(/for \(const required of \["([^"]+)"/)?.[1]
+  const updateLabel = updateLabelOf(readFileSync(join(dir, "scripts/approve-plugin-update.mjs"), "utf8"))
   if (!updateLabel) throw new Error("cannot read the update issue label from the pin")
   const manual = policy.currentSecurityBaselinePolicy.maintainerVerificationOutcome
   return { automated: policy.securityBaselineOutcome([], []), manual, updateLabel, reviewLabel: `security-${manual}` }

package/tools/marketplace/submit.mjs

@@ -14,7 +14,7 @@
 import { resolveSubject, SubjectError } from "../subject/resolve.mjs"
 import { requirePin } from "./pin.mjs"
 import { submissionContract, newerCommitChoice, resolveCategory, resolveTags, tagSlug } from "./form.mjs"
-import { idUniverse, checkIdentity, listingOf, baselineFigures, figure, liveRegistry, registrySourceDetail, catalogPresentation, defaultPresentation } from "./registry.mjs"
+import { idUniverse, checkIdentity, listingOf, baselineFigures, figure, liveRegistry, registrySourceDetail, catalogBuilderText, catalogPresentation, defaultPresentation } from "./registry.mjs"
 import { readTree } from "./tree.mjs"
 import { inspectTree } from "./plugin.mjs"
 import { findAgentControl, REMEDY as AGENT_CONTROL_REMEDY } from "./agent-control.mjs"
@@ -283,7 +283,7 @@ export async function submitPreflight(options) {
       error.usage = missing
       throw error
     }
-    const defaults = defaultPresentation(catalogPresentation(pinDir), tree.manifest?.kinds)
+    const defaults = defaultPresentation(catalogPresentation(catalogBuilderText(pinDir)), tree.manifest?.kinds)
     const answers = await options.chooser({ contract, defaults, missing: missing.missing })
     if (answers?.category) chosenCategory = answers.category
     if (answers?.tags) chosenTags = answers.tags

package/tools/marketplace/watch.mjs

@@ -21,7 +21,7 @@
 import { join } from "node:path"
 import { pathToFileURL } from "node:url"
 import { readFileSync } from "node:fs"
-import { MARKETPLACE_PIN, requirePin } from "./pin.mjs"
+import { MARKETPLACE_PIN, requirePin, validatedLabel } from "./pin.mjs"
 import { authenticatedUser, repositoryIssues, defaultBranchHead, issue, issueComments, parseIssueUrl, token, GitHubError } from "./github.mjs"
 import { liveRegistry } from "./registry.mjs"
 import { reviewPolicy, validatedDocumentationDiff } from "./review-cost.mjs"
@@ -266,8 +266,7 @@ export function validationComment(comments, feedback = []) {
  */
 export async function marketplaceLabels(pinDir) {
   const policy = await import(pathToFileURL(join(pinDir, "scripts/security-baseline-policy.mjs")).href)
-  const approval = readFileSync(join(pinDir, "scripts/approve-submission.mjs"), "utf8")
-  const validated = approval.match(/for \(const required of \["submission", "([^"]+)"/)?.[1]
+  const validated = validatedLabel(readFileSync(join(pinDir, "scripts/approve-submission.mjs"), "utf8"))
   if (!validated) throw new Error("cannot read the validated label from the pin")
   const manual = policy.currentSecurityBaselinePolicy.maintainerVerificationOutcome
   return { blocking: [...policy.securityBaselineBlockingLabels], validated, reviewRequired: `security-${manual}` }