rvlib-shipkit 1.4.0 → 1.6.0

package/src/collections/providers.ts

@@ -321,6 +321,8 @@ export function mediaKitCollection(root: string, kit: ResolvedKit | null, heal:
                 const base: Instance = {
                     id: `media:${f.asset.id}`,
                     text: f.asset.id,
+                    label: f.asset.label ?? f.asset.id,
+                    group: f.kind.category,
                     // the roll count is the one fact a row of assets is read for
                     slot: rolls.length > 0 ? `${rolls.length} roll${rolls.length === 1 ? '' : 's'}` : manual ? 'manual' : undefined,
                     type: 'asset',
@@ -343,11 +345,11 @@ export function mediaKitCollection(root: string, kit: ResolvedKit | null, heal:
                 const said: Partial<Instance> = manual && rolls.length === 0
                     // the brief IS the paste-ready artifact ("I don't even
                     // know what to paste" — the tile hands him the prompt)
-                    ? { text: `${f.asset.id} — manual, nothing uploaded`, label: f.asset.id, verbs: ['provide'], artifact: f.asset.prompt != null ? { copy: f.asset.prompt } : undefined }
+                    ? { text: `${f.asset.id} — manual, nothing uploaded`, verbs: ['provide'], artifact: f.asset.prompt != null ? { copy: f.asset.prompt } : undefined }
                     : rolls.length > 0 && !picked
-                        ? { text: `${f.asset.id} — ${rolls.length} roll(s), default in use, none picked`, label: f.asset.id, verbs: ['pick'] }
+                        ? { text: `${f.asset.id} — ${rolls.length} roll(s), default in use, none picked`, verbs: ['pick'] }
                         : stale
-                            ? { text: `${f.asset.id} — stale (a parent was re-picked)`, label: f.asset.id, verbs: ['pick'] }
+                            ? { text: `${f.asset.id} — stale (a parent was re-picked)`, verbs: ['pick'] }
                             : {}
                 out.push({ ...base, ...said, ...colour })
             }

package/src/core/app-icon.ts

@@ -0,0 +1,154 @@
+// a repo's app icon, drawn from its mark: the mark's transparent margin is
+// cut away, and what is left sits on a rounded plate in the repo's identity
+// colour, on the macOS icon grid (an 824 plate on a 1024 canvas). A mark that
+// already fills its box (a photo, a square tile) becomes the plate itself.
+// The app build and the page's preview both draw through appIconPngs.
+import { createCanvas, Image, type Canvas } from '@napi-rs/canvas'
+import { existsSync, readFileSync } from 'fs'
+import { join } from 'path'
+import { identityOfName, identityOfText, type Identity } from './identity-color.ts'
+import { configName, CONFIG_FILE } from './identity.ts'
+import { LAYOUT } from './layout.ts'
+
+/** the mark an app wears: the repo's own, largest first. Rasters only */
+export const APP_ICON_FILES = [`${LAYOUT.identity}/icon.png`, 'public/logo.png', 'public/favicon.png']
+
+export function appIconOf(root: string): string | null {
+    for (const f of APP_ICON_FILES) if (existsSync(join(root, f))) return join(root, f)
+    return null
+}
+
+export const ICON_PX = 1024
+const PLATE = 824
+const RADIUS = 185
+/** the mark's longest side, as a share of the plate */
+const MARK = 0.7
+/** an alpha at or under this is margin, and is dropped: a generated image
+ *  often carries faint noise over its whole canvas, which would widen the box
+ *  to the full image and haze the plate */
+const NOISE = 48
+/** a mark whose box is this full is a tile already: it fills the plate */
+const TILE = 0.85
+
+export type Box = { x: number; y: number; w: number; h: number; fill: number }
+
+/** the box of the pixels that are not margin, and how full it is; null for a
+ *  mark with no such pixel */
+export function markBox(rgba: Uint8Array | Uint8ClampedArray, w: number, h: number): Box | null {
+    let x0 = w, y0 = h, x1 = -1, y1 = -1
+    for (let y = 0; y < h; y++)
+        for (let x = 0; x < w; x++)
+            if (rgba[(y * w + x) * 4 + 3]! > NOISE) {
+                if (x < x0) x0 = x
+                if (x > x1) x1 = x
+                if (y < y0) y0 = y
+                if (y > y1) y1 = y
+            }
+    if (x1 < 0) return null
+    let solid = 0
+    for (let y = y0; y <= y1; y++) for (let x = x0; x <= x1; x++) if (rgba[(y * w + x) * 4 + 3]! > 250) solid++
+    const bw = x1 - x0 + 1
+    const bh = y1 - y0 + 1
+    return { x: x0, y: y0, w: bw, h: bh, fill: solid / (bw * bh) }
+}
+
+const lum = (r: number, g: number, b: number): number => (0.2126 * r + 0.7152 * g + 0.0722 * b) / 255
+
+/** the mean lightness of the mark's own pixels, alpha weighted */
+function markLum(rgba: Uint8Array | Uint8ClampedArray): number {
+    let sum = 0, weight = 0
+    for (let i = 0; i < rgba.length; i += 4) {
+        const a = rgba[i + 3]! / 255
+        sum += a * lum(rgba[i]!, rgba[i + 1]!, rgba[i + 2]!)
+        weight += a
+    }
+    return weight === 0 ? 0.5 : sum / weight
+}
+
+const hexLum = (hex: string): number => {
+    const n = Number.parseInt(hex.slice(1), 16)
+    return lum((n >> 16) & 255, (n >> 8) & 255, n & 255)
+}
+
+/** of the two identity colours, the one the mark stands out on most */
+export function plateOf(id: Identity, markLightness: number): string {
+    return Math.abs(hexLum(id.colorLight) - markLightness) >= Math.abs(hexLum(id.colorDark) - markLightness) ? id.colorLight : id.colorDark
+}
+
+const towardWhite = (hex: string, t: number): string => {
+    const n = Number.parseInt(hex.slice(1), 16)
+    const c = [(n >> 16) & 255, (n >> 8) & 255, n & 255].map((v) => Math.round(v + (255 - v) * t))
+    return `#${c.map((v) => v.toString(16).padStart(2, '0')).join('')}`
+}
+
+async function decode(bytes: Uint8Array): Promise<Image> {
+    const img = new Image()
+    img.src = Buffer.from(bytes)
+    // the pixels land on decode: drawn before it, the image is empty
+    await img.decode().catch(() => {})
+    if (img.width === 0) throw new Error('not an image the icon renderer reads')
+    return img
+}
+
+function plate(ctx: ReturnType<Canvas['getContext']>, o: number): void {
+    ctx.beginPath()
+    ctx.roundRect(o, o, PLATE, PLATE, RADIUS)
+}
+
+/** the icon at 1024px, and the plate colour it used (null: the mark is the plate) */
+export async function drawAppIcon(bytes: Uint8Array, id: Identity): Promise<{ canvas: Canvas; plate: string | null }> {
+    const img = await decode(bytes)
+    const src = createCanvas(img.width, img.height)
+    const sctx = src.getContext('2d')
+    sctx.drawImage(img, 0, 0)
+    const data = sctx.getImageData(0, 0, img.width, img.height)
+    const px = data.data
+    for (let i = 3; i < px.length; i += 4) if (px[i]! <= NOISE) px[i] = 0
+    sctx.putImageData(data, 0, 0)
+    const box = markBox(px, img.width, img.height) ?? { x: 0, y: 0, w: img.width, h: img.height, fill: 0 }
+    const out = createCanvas(ICON_PX, ICON_PX)
+    const ctx = out.getContext('2d')
+    ctx.imageSmoothingQuality = 'high'
+    const o = (ICON_PX - PLATE) / 2
+    if (box.fill >= TILE) {
+        // a tile: cover the plate with it, clipped to the plate's corners
+        const s = Math.max(PLATE / box.w, PLATE / box.h)
+        ctx.save()
+        plate(ctx, o)
+        ctx.clip()
+        ctx.drawImage(src, box.x, box.y, box.w, box.h, ICON_PX / 2 - (box.w * s) / 2, ICON_PX / 2 - (box.h * s) / 2, box.w * s, box.h * s)
+        ctx.restore()
+        return { canvas: out, plate: null }
+    }
+    const colour = plateOf(id, markLum(px))
+    const g = ctx.createLinearGradient(0, o, 0, o + PLATE)
+    // a lighter top edge, the way a native icon catches light
+    g.addColorStop(0, towardWhite(colour, 0.14))
+    g.addColorStop(1, colour)
+    ctx.fillStyle = g
+    plate(ctx, o)
+    ctx.fill()
+    const s = (PLATE * MARK) / Math.max(box.w, box.h)
+    ctx.drawImage(src, box.x, box.y, box.w, box.h, ICON_PX / 2 - (box.w * s) / 2, ICON_PX / 2 - (box.h * s) / 2, box.w * s, box.h * s)
+    return { canvas: out, plate: colour }
+}
+
+/** the icon as pngs, one per size asked, drawn once */
+export async function appIconPngs(bytes: Uint8Array, id: Identity, sizes: number[] = [ICON_PX]): Promise<Buffer[]> {
+    const { canvas } = await drawAppIcon(bytes, id)
+    return sizes.map((px) => {
+        if (px === ICON_PX) return canvas.toBuffer('image/png')
+        const small = createCanvas(px, px)
+        const ctx = small.getContext('2d')
+        ctx.imageSmoothingQuality = 'high'
+        ctx.drawImage(canvas, 0, 0, px, px)
+        return small.toBuffer('image/png')
+    })
+}
+
+/** the identity a repo's config declares, else the one its name hashes to */
+export function identityOfRoot(root: string): Identity {
+    const path = join(root, CONFIG_FILE)
+    const text = existsSync(path) ? readFileSync(path, 'utf8') : ''
+    return identityOfText(text) ?? identityOfName(configName(text, root))
+}

package/src/core/audit-report.ts

@@ -0,0 +1,21 @@
+// THE KEPT AUDIT: what the last traced audit (core/trace-audit.ts) found, per
+// task. It lives under the git common dir, beside the ledger, so every
+// worktree of the repo on this machine reads the same one. The keys read it
+// (ledger/gate-checks.ts): a finding covers the task that read it before any
+// config write lands. The shape and the pure helpers: core/ignored-inputs.ts.
+import { readFileSync } from 'fs'
+import { join } from 'path'
+import { shipkitRoot } from './git-root.ts'
+import type { AuditReport } from './ignored-inputs.ts'
+
+export type { AuditReport, AuditTask, IgnoredInputs } from './ignored-inputs.ts'
+export { auditedExtras, describeByTask, ignoredFor, pendingByTask } from './ignored-inputs.ts'
+
+/** its name under the repo's shipkit state dir (CheckCtx.state reads it) */
+export const AUDIT_FILE = 'trace-audit.json'
+
+export const auditReportPath = (root: string): string => join(shipkitRoot(root), AUDIT_FILE)
+
+export function readAuditReport(root: string): AuditReport | null {
+    try { return JSON.parse(readFileSync(auditReportPath(root), 'utf8')) as AuditReport } catch { return null }
+}

package/src/core/cache-audit.ts

@@ -0,0 +1,72 @@
+// THE CACHE AUDIT: is a cached green still what a fresh run says? A check
+// keyed on files is only as honest as the paths it declares: a path it reads
+// and never declared cannot move its key, so an edit there serves the old
+// green. Nothing sees that while it happens. This re-runs a small sample of
+// the checks the cache would answer right now, fresh, and compares.
+//
+// the one constraint a reader breaks first: only a green is ever stored, so
+// a fresh FAIL under a key that replays a green is the whole finding. A
+// fresh green where the stored one warned, or the reverse, is reported too.
+import { composeChecks } from '../ledger/gate-checks.ts'
+import { Ledger } from '../ledger/ledger.ts'
+import { gateBinary } from '../ledger/toolchain-identity.ts'
+import { populationOf } from '../problems/problem-line.ts'
+import { runCheckPass } from './run-check.ts'
+import type { RepoConfig } from '../repo-config.ts'
+
+export type AuditRow = {
+    id: string
+    /** what the cache holds for the current key */
+    cached: 'pass' | 'warn'
+    /** what a fresh run said */
+    fresh: 'pass' | 'warn' | 'fail' | 'skip'
+    /** how the check is keyed: files (declared paths) or reads (recorded) */
+    keyedOn: 'files' | 'reads'
+    ms: number
+}
+
+export type AuditResult = {
+    /** checks the cache would answer now, the pool the sample came from */
+    pool: number
+    rows: AuditRow[]
+    /** the rows whose fresh verdict is not the cached one */
+    stale: AuditRow[]
+}
+
+/** the sample: `n` checks of the pool, a different stable set each day, so
+ *  every check is audited over time and two runs on one day agree */
+export function sampleOf(ids: string[], n: number, day: number): string[] {
+    const rank = (id: string): bigint => BigInt(Bun.hash(`${day}:${id}`))
+    return [...ids].sort((a, b) => (rank(a) < rank(b) ? -1 : rank(a) > rank(b) ? 1 : 0)).slice(0, n)
+}
+
+export async function auditCache(root: string, config: RepoConfig, o: { sample: number; only?: string[]; now?: number }): Promise<AuditResult> {
+    const composed = await composeChecks(root, config, { tier: 'quick' })
+    const ledger = Ledger.open(root, composed.map((g) => g.row.decl), { cliEntry: gateBinary(), read: true })
+    // what the cache would answer right now, keyed on the repo's own files
+    const pool: { id: string; cached: 'pass' | 'warn'; keyedOn: 'files' | 'reads' }[] = []
+    for (const g of composed) {
+        if (g.row.runs.off != null) continue
+        const pop = populationOf(g.row.decl)
+        if (pop !== 'content' && pop !== 'reads') continue
+        if (o.only != null && !o.only.includes(g.row.decl.id)) continue
+        const hit = ledger.replay(g.row.decl.id)
+        if (hit != null) pool.push({ id: g.row.decl.id, cached: hit.status, keyedOn: pop === 'content' ? 'files' : 'reads' })
+    }
+    const day = Math.floor((o.now ?? Date.now()) / 86_400_000)
+    const picked = new Set(o.only != null ? pool.map((p) => p.id) : sampleOf(pool.map((p) => p.id), o.sample, day))
+    const rows: AuditRow[] = []
+    for (const p of pool.filter((x) => picked.has(x.id))) {
+        const t = performance.now()
+        // fresh: nothing comes from the cache. A green it finds is stored, a
+        // failure is not, which is why a stale entry is forgotten below
+        const run = await runCheckPass(root, { config, composed, audience: 'health', only: [p.id], fresh: true, frozen: true, status: false, print: () => {}, detail: () => {} })
+        const r = run.results.find((x) => x.id === p.id)
+        rows.push({ id: p.id, cached: p.cached, fresh: r?.status ?? 'skip', keyedOn: p.keyedOn, ms: Math.round(performance.now() - t) })
+    }
+    const stale = rows.filter((r) => r.fresh !== 'skip' && r.fresh !== r.cached)
+    // a fresh failure is never stored, so without this the stale green would
+    // keep being served under the same key
+    for (const r of stale) ledger.forget(r.id)
+    return { pool: pool.length, rows, stale }
+}

package/src/core/canonical-scripts.ts

@@ -22,7 +22,7 @@ export function canonicalBodies(opts: ScriptStyle = {}): Record<string, string>
 }
 
 // conditional canon (bodies stated by the vocabulary page) — keyed by the
-// SK001 requirement name; a requirement with no canonical body (comfy:up) is
+// SK001 requirement name; a requirement with no canonical body is
 // deliberately absent: a fixer must not invent one
 export function conditionalBodies(_opts: ScriptStyle = {}): Record<string, string> {
     return {
@@ -30,7 +30,7 @@ export function conditionalBodies(_opts: ScriptStyle = {}): Record<string, strin
     }
 }
 
-// ONE WAY IN (build/shipkit.md): the verification verbs an agent types from
+// ONE WAY IN (build/shipkit/one-way-in.md): the verification verbs an agent types from
 // muscle memory ROUTE to shipkit, so `bun run test` gets the cache and the
 // job attachment without anyone having to remember a rule. The tool body they
 // used to hold moves to `<name>:raw`, which is what shipkit itself runs and

package/src/core/check-ctx.ts

@@ -18,12 +18,13 @@
 // A context with no pass reports and reaches the world, and a repo read there
 // throws rather than guess a root.
 import { existsSync, mkdirSync, readFileSync, rmSync } from 'fs'
-import { dirname, join } from 'path'
+import { basename, dirname, isAbsolute, join } from 'path'
 import { atomicWrite } from './locked-write.ts'
 import { spawnWithTimeout } from './spawn-timeout.ts'
 import { blobOid, dirEntries, entriesHash, isLinkAt, kindOf, listingHash, Reads, type DirEntry } from './read-set.ts'
 import { CheckPass } from './check-pass.ts'
 import { normalizeInput, WHOLE_TREE } from '../ledger/git-scan.ts'
+import { shipkitRoot } from './git-root.ts'
 import type { RepoConfig } from '../repo-config.ts'
 import type { Scan } from '../scan.ts'
 import type { Line } from './wire.ts'
@@ -123,17 +124,25 @@ export class CheckCtx {
         if (p === WHOLE_TREE) throw new Error(`'${path}' is the repo root, not a file`)
         return p
     }
-    /** the text of a repo-relative file, null when there is none */
+    /** the text of a repo-relative file, null when there is none. An
+     *  absolute path reads a file outside the work tree (the kept audit under
+     *  the git common dir), recorded by that path */
     read(path: string): string | null {
         return this.bytes(path)?.toString('utf8') ?? null
     }
+    /** the text of a file under the repo's shipkit state dir (the git common
+     *  dir, shared by every worktree), null when there is none. Recorded by
+     *  its absolute path, like any read */
+    state(name: string): string | null {
+        return this.read(join(shipkitRoot(this.root), name))
+    }
     /** the raw bytes of a repo-relative file (an image, a binary), null when
      *  there is none. Recorded exactly like `read` */
     bytes(path: string): Buffer | null {
-        const p = this.rel(path)
+        const p = isAbsolute(path) ? path : this.rel(path)
         let bytes: Buffer
         try {
-            bytes = readFileSync(join(this.repo('read').root, p))
+            bytes = readFileSync(isAbsolute(p) ? p : join(this.repo('read').root, p))
         } catch (e) {
             const code = (e as { code?: string }).code
             if (code !== 'ENOENT' && code !== 'ENOTDIR' && code !== 'EISDIR') throw e
@@ -245,7 +254,7 @@ export class CheckCtx {
     // spawn without the Bun.spawn throw-on-missing-binary gotcha; SIGTERM at
     // timeoutMs, SIGKILL 2s later (one code path: core/spawn-timeout.ts)
     async exec(cmd: string[], opts?: { env?: Record<string, string | undefined>; cwd?: string; timeoutMs?: number }): Promise<{ code: number; out: string; timedOut: boolean }> {
-        this.world('exec')
+        this.world(`\`${cmd.slice(0, 3).map((a) => basename(a)).join(' ')}\``)
         // the environment as it stands NOW: left out, Bun hands the child the
         // one it started with, and a variable set since (a test seam, a flag
         // the gate set) never reaches it

package/src/core/check-runner.ts

@@ -40,15 +40,19 @@ import { machinePool, SLOT_HELD_ENV, takeSlot, type SlotPool } from './slots.ts'
 import { budgetLine, machineLoad } from './budget.ts'
 import { killTree, spawnWithTimeout } from './spawn-timeout.ts'
 import { FOREVER_MS, formatLine, parseWireOutput, type Line } from './wire.ts'
-import { offLine, type WhenDecl } from './when.ts'
+import { offLine, runsIn, type ResolvedRuns, type RunContext } from './runs.ts'
 import { runCheckBody, type CheckDef, type CheckEnv } from '../check.ts'
 import { Ledger, stampCached } from '../ledger/ledger.ts'
-import { attachedStamp } from './outcome-words.ts'
+import { attachedStamp, ranStamp } from './outcome-words.ts'
 import type { RunLog, RunStatus } from '../ledger/run-log.ts'
 import { liveStateOf } from '../ledger/live-runs.ts'
 import { CHECK_ID_ENV } from '../ledger/suite-log.ts'
 import { rememberWorld, replayWorld, worldKeyOf, type WorldCache } from '../ledger/world-cache.ts'
 import { extractProblems } from '../problems/extract.ts'
+
+/** the first line of a check that ran in this run, stamped with its cost. A
+ *  world answer carries its keep in a stamp already, so the cost joins it */
+const ranHere = (l: Line, ms: number): Line => (l.stamp != null && l.stamp.cached !== true ? { ...l, stamp: { ...l.stamp, ranMs: ms } } : { ...l, text: `${l.text} ${ranStamp(ms)}` })
 import { feedsProblemsPane, type Population, type Problem } from '../problems/problem-line.ts'
 
 /** the ceiling a check takes when it names none. A build step's floor
@@ -82,7 +86,8 @@ export type RunnableCheck = {
     blocking: boolean | null
     /** a build step: the gate runs it, the health pass does not */
     build: boolean
-    when: WhenDecl
+    /** every context it runs in, resolved (core/runs.ts) */
+    runs: ResolvedRuns
     deps: string[]
     group: string | null
     timeoutMs: number
@@ -159,8 +164,10 @@ export type RunChecksOpts = {
     root: string
     config: CheckEnv['config']
     audience: Audience
-    /** `release` checks are in at the full tier and out at the quick one */
+    /** the full tests tier: `onFull` decides instead of `onCi` */
     fullTier: boolean
+    /** the release preflight: `onRelease` decides, whatever the tier */
+    release?: boolean
     /** where a `cmd` check's whole output is streamed */
     logDir: string
     /** the world answers' store, null = nothing is remembered by TTL */
@@ -256,10 +263,13 @@ export type Selection = {
     errors: string[]
 }
 
+/** the axis each context reads, as a parked line names it */
+const CTX_AXIS: Record<RunContext, string> = { preCommit: 'onPreCommit', ci: 'onCi', full: 'onFull', release: 'onRelease', health: 'onHealth' }
+
 /** what this run asks about. The audience decides the shape of the question,
  *  `--only` and `--with` name checks past any filter, and OFF is the one word
  *  no flag lifts. */
-export function selectChecks(o: Pick<RunChecksOpts, 'checks' | 'audience' | 'fullTier' | 'skipGroups' | 'onlyIds' | 'withIds' | 'onlyBlocking' | 'buildOnly' | 'exclude' | 'includeProactive'>): Selection {
+export function selectChecks(o: Pick<RunChecksOpts, 'checks' | 'audience' | 'fullTier' | 'release' | 'skipGroups' | 'onlyIds' | 'withIds' | 'onlyBlocking' | 'buildOnly' | 'exclude' | 'includeProactive'>): Selection {
     const errors: string[] = []
     const ids = new Set(o.checks.map((u) => u.id))
     if (ids.size !== o.checks.length) errors.push('duplicate check ids')
@@ -318,26 +328,28 @@ export function selectChecks(o: Pick<RunChecksOpts, 'checks' | 'audience' | 'ful
         if (u.blocking == null) undeclared.push(u.id)
         selected.push(u)
     }
+    // the one context this run asks about: every row declares whether it
+    // runs there (core/runs.ts), and nothing is guessed from its kind
+    const ctx: RunContext = o.audience === 'health' ? 'health' : o.release === true ? 'release' : o.fullTier ? 'full' : 'ci'
     for (const u of o.checks) {
-        // IS IT THIS RUN'S BUSINESS AT ALL? The health pass never builds (a
-        // repo's test suite and its type checker answer "is my change good",
-        // which is the gate's question), the TUI's build panel asks for
-        // nothing else, and a sub-unit release skips what its own gate ran.
-        // A check out of scope here is not even reported as off: it is not part
-        // of this question.
+        // IS IT THIS RUN'S BUSINESS AT ALL? The TUI's build panel asks for
+        // nothing but build steps, and a sub-unit release skips what its own
+        // gate ran. A check out of scope here is not even reported as off: it
+        // is not part of this question.
         if (!named.has(u.id)) {
-            if (o.audience === 'health' && u.build) continue
             if (o.buildOnly === true && !u.build) continue
             if (excluded.has(u.id)) { parked.push({ id: u.id, text: `${u.id} (not part of this release, its own gate covers it)` }); continue }
         }
         // OFF is the one word that means never, past every other flag: a
         // switch a filter can lift is a suggestion
-        if (u.when.at === 'off') { off.push(u); continue }
+        if (u.runs.off != null) { off.push(u); continue }
         if (named.has(u.id)) { take(u); continue }
         if (u.group != null && skipGroups.has(u.group)) { parked.push({ id: u.id, text: `${u.id} (--skip ${u.group})` }); continue }
-        if (o.audience === 'gate') {
-            if (u.when.at === 'health' && o.includeProactive !== true) { parked.push({ id: u.id, text: `${u.id} (health)` }); continue }
-            if (u.when.at === 'release' && !o.fullTier) { parked.push({ id: u.id, text: `${u.id} (release)` }); continue }
+        if (!runsIn(u.runs, ctx)) {
+            // the health pass answers its own question and lists nothing else
+            if (ctx === 'health') continue
+            // release.requireHealthy asks the gate for the health probes too
+            if (!(o.includeProactive === true && u.runs.onHealth && !u.build)) { parked.push({ id: u.id, text: `${u.id} (not ${CTX_AXIS[ctx]})` }); continue }
         }
         if (o.onlyBlocking === true && u.blocking !== true) { if (u.blocking == null) undeclared.push(u.id); nonBlocking.set(u.id, u); continue }
         take(u)
@@ -430,6 +442,8 @@ type Live = RunnableCheck & CheckResult & {
     /** what an in process body read, null when it reached the world or ran
      *  as a subprocess */
     reads: ReadSet | null
+    /** why its answer cannot be stored on its reads, in its own words */
+    untracked: string | null
     /** it printed nothing of its own, so its one line is the headline below */
     synthetic: boolean
     /** what the headline carries after the id: a failure's last line, or the
@@ -471,7 +485,7 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
     // OFF, in ONE place: skipped by name, never run, never stored, and the
     // reason printed where the verdict would have been
     for (const u of [...sel.off, ...(sel.offElsewhere ?? [])]) {
-        const line: Line = { kind: 'skip', text: offLine(u.id, u.when) }
+        const line: Line = { kind: 'skip', text: offLine(u.id, u.runs) }
         if (sel.off.includes(u)) emit(line); else (o.detail ?? print)(formatLine(line, color))
         report(u, { id: u.id, status: 'skip', advisory: false, replayed: false, ms: 0, exitCode: null, lines: [line], problems: [], lastLine: line.text, note: 'off', logPath: null })
     }
@@ -486,7 +500,7 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
     const runDir = openRunDir(o.logDir)
     const checks: Live[] = sel.selected.map((u) => ({
         ...u,
-        status: 'skip', advisory: false, replayed: false, ms: 0, exitCode: null, lines: [], problems: [], lastLine: '', note: '', startedAt: 0, endedAt: 0, unmeasured: false, attached: false, reads: null, synthetic: false, tail: '', extra: [],
+        status: 'skip', advisory: false, replayed: false, ms: 0, exitCode: null, lines: [], problems: [], lastLine: '', note: '', startedAt: 0, endedAt: 0, unmeasured: false, attached: false, reads: null, untracked: null, synthetic: false, tail: '', extra: [],
         logPath: u.body.cmd != null ? join(runDir, `${u.id.replace(/[^a-zA-Z0-9-]/g, '_')}.log`) : null,
     }))
     const selectedIds = new Set(checks.map((u) => u.id))
@@ -566,9 +580,14 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
         const ran = u.status === 'pass' || u.status === 'warn' ? testsRan(u.lastLine) : null
         const counted = ran != null && head != null && head.kind === 'ok' && (head.text === u.id || head.text.startsWith(`${u.id} (`))
         const id = counted ? `${u.id} ${ran} test${ran === 1 ? '' : 's'}` : u.id
-        const shown = u.synthetic && !u.replayed && head != null
-            ? [{ ...head, text: `${id} (${(u.ms / 1000).toFixed(1)}s)${u.tail}` }, ...u.lines.slice(1)]
+        const composed = u.synthetic && !u.replayed && head != null
+            ? [{ ...head, text: `${id} ${ranStamp(u.ms)}${u.tail}` }, ...u.lines.slice(1)]
             : counted ? [{ ...head, text: `${id}${head.text.slice(u.id.length)}` }, ...u.lines.slice(1)] : u.lines
+        // every line says where its answer came from: a replay carries its
+        // cached stamp already, so one that ran here says so and what it cost
+        const shown = u.synthetic || u.replayed || u.attached || u.startedAt === 0 || composed[0] == null
+            ? composed
+            : [ranHere(composed[0], u.ms), ...composed.slice(1)]
         // a caller printing its own verdict wants one line per green check and
         // only the warnings of a warned one; a failure prints whole
         const quiet = (l: Line, i: number): boolean =>
@@ -585,7 +604,7 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
         const hit = o.ledger?.replay(u.id)
         if (hit != null) {
             u.replayed = true
-            u.lines = stampCached(hit.lines, hit.measuredMs)
+            u.lines = stampCached(hit.lines, hit.measuredMs, hit.at, clock())
             u.lastLine = hit.lastLine ?? ''
             u.status = hit.status
             // a replay stands for the verdict it replays, findings included:
@@ -612,6 +631,7 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
             // id, every line is tagged, and a failure carries a fix pointer
             await runCheckBody({ id: u.id, title: u.title, owner: u.owner, run: u.body.run, fix: u.fix }, t)
             u.reads = t.untracked == null ? t.reads.snapshot() : null
+            u.untracked = t.untracked
             u.lines = t.lines
             u.problems = findings(u, t.lines)
             u.unmeasured = t.unmeasured
@@ -768,7 +788,7 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
             await measureAndKeep(u)
             return { value: answerOf(u), share: !killed.has(u.id) && !u.unmeasured }
         })
-        if (r.kind === 'attached') { o.ledger?.noteAttached(); adopt(u, r.value, r.pid) }
+        if (r.kind === 'attached') { o.ledger?.noteAttached(u.id); adopt(u, r.value, r.pid) }
         else if (r.kind === 'aborted') { u.status = 'skip'; u.note = bailed ? 'bailed' : 'interrupted'; u.lines = [] }
         else if (r.kind === 'overlapped') emit({ kind: 'warn', text: `${u.id} ran again beside another run: ${r.warn}` })
     }
@@ -811,7 +831,7 @@ export async function runChecks(o: RunChecksOpts): Promise<RunChecksSummary> {
             })
         }
         if (o.ledger != null && keep)
-            o.ledger.record(u.id, { status: u.status as 'pass' | 'warn', lines: u.lines, lastLine: u.lastLine, problems: u.problems, measuredMs: clock() - u.startedAt }, u.reads)
+            o.ledger.record(u.id, { status: u.status as 'pass' | 'warn', lines: u.lines, lastLine: u.lastLine, problems: u.problems, measuredMs: clock() - u.startedAt }, u.reads, u.untracked)
     }
 
     const start = (u: Live): void => {

package/src/core/config-rewrite.ts

@@ -1,14 +1,15 @@
-// THE CONFIG HALF of the SK016 migration, in its own process. Writing the
+// THE CONFIG HALF of the SK016 and SK029 migrations, in its own process. Writing the
 // managed block and reading the result back both LOAD repo.config.ts as a
 // module, which no check context read can stand for, so the fixer reaches it
 // through `c.exec` and the check file itself never imports the loader.
 //
 //   bun config-rewrite.ts <root> '<plan json>'   → one json line on stdout
 //
-// The order is the migration's: the `when` entries first, then each key is
-// dropped only once what leaned on it has a home, then the result is read
-// back through the loader and the previous bytes go back when it does not
-// survive.
+// The order is the migration's: a key the managed block holds (the retired
+// `when`) is dropped first, so the block describes the config again, then the
+// `off` entries are written into the block, then each other key is dropped
+// only once what leaned on it has a home. The result is read back through the
+// loader and the previous bytes go back when it does not survive.
 import { readFileSync } from 'fs'
 import { join } from 'path'
 import { atomicWrite } from './locked-write.ts'
@@ -17,10 +18,11 @@ import { writeGateBlock } from './when-block.ts'
 import { loadRepoConfig } from '../repo-config.ts'
 
 export type ConfigPlan = {
-    /** check id → `when` value, written into the managed block */
-    when: Record<string, string>
-    /** keys to drop, in order. `afterWhen` drops only once the block took the entries */
-    drop: { key: string; why: string; afterWhen?: boolean }[]
+    /** check id → why it is off, written into the managed block */
+    off: Record<string, string>
+    /** keys to drop, in order. `first` drops before the block is written (a
+     *  key inside it), `afterOff` only once the block took the entries */
+    drop: { key: string; why: string; phase?: 'first' | 'afterOff' }[]
     /** the config's `name` before the rewrite: what the read back must still say */
     name: string
 }
@@ -35,27 +37,38 @@ export type ConfigRewrite = {
 export async function rewriteConfig(root: string, plan: ConfigPlan): Promise<ConfigRewrite> {
     const did: string[] = []
     const hand: string[] = []
-    let whenWritten = false
-    if (Object.keys(plan.when).length > 0) {
+    const path = join(root, 'repo.config.ts')
+    const before = readFileSync(path, 'utf8')
+    const drop = (text: string, d: ConfigPlan['drop'][number]): string => {
+        const next = dropConfigKey(text, d.key)
+        if (next == null) { hand.push(`repo.config.ts \`${d.key}\`: ${d.why}, and the key could not be read mechanically — delete it by hand`); return text }
+        did.push(`repo.config.ts drops \`${d.key}\``)
+        return next
+    }
+    let first = before
+    for (const d of plan.drop.filter((x) => x.phase === 'first')) first = drop(first, d)
+    if (first !== before) atomicWrite(path, first)
+    let offWritten = false
+    if (Object.keys(plan.off).length > 0) {
         try {
-            await writeGateBlock(root, { when: plan.when })
-            whenWritten = true
-            did.push(`${Object.keys(plan.when).length} when entr(ies) written into the managed block`)
+            await writeGateBlock(root, { off: plan.off })
+            offWritten = true
+            did.push(`${Object.keys(plan.off).length} off entr(ies) written into the managed block`)
         } catch (e) {
-            hand.push(`the \`when\` block refused the rewrite (${String(e).slice(0, 160)}) — write ${JSON.stringify(plan.when)} into it by hand`)
+            // a key dropped first held these entries: without the block they
+            // would be gone, so the file goes back as it was
+            if (first !== before) { atomicWrite(path, before); return { did: [], hand, restored: `the managed block refused off ${JSON.stringify(plan.off)}: ${String(e).slice(0, 160)}` } }
+            hand.push(`the managed block refused the rewrite (${String(e).slice(0, 160)}) — write off: ${JSON.stringify(plan.off)} into it by hand`)
         }
     }
-    const path = join(root, 'repo.config.ts')
-    const before = readFileSync(path, 'utf8')
-    let text = before
-    for (const d of plan.drop) {
-        if (d.afterWhen === true && !whenWritten) continue
-        const next = dropConfigKey(text, d.key)
-        if (next == null) hand.push(`repo.config.ts \`${d.key}\`: ${d.why}, and the key could not be read mechanically — delete it by hand`)
-        else { text = next; did.push(`repo.config.ts drops \`${d.key}\``) }
+    const mid = readFileSync(path, 'utf8')
+    let text = mid
+    for (const d of plan.drop.filter((x) => x.phase !== 'first')) {
+        if (d.phase === 'afterOff' && !offWritten) continue
+        text = drop(text, d)
     }
+    if (text !== mid) atomicWrite(path, text)
     if (text !== before) {
-        atomicWrite(path, text)
         try {
             const after = await loadRepoConfig(root, { fresh: true })
             if (after.name !== plan.name) throw new Error(`the config reads as '${String(after.name)}'`)