wowbagger 0.1.0-alpha.9 → 0.5.0

package/src/mutation.js

@@ -26,6 +26,13 @@ import { MAX_ITEM_SOURCE_BYTES } from './limits.js';
 import { JsonNumber, parseJsonRequest, pointer, sortIssues } from './request.js';
 import { isCalendarDate, isRfc3339Utc, validateLedger } from './validate.js';
 
+const LOCK_OWNER_OPERATIONS = new Set([
+  'create',
+  'transition',
+  'parent-migrate',
+  'snooze',
+  'patch',
+]);
 const REQUIRED_CORE_FIELDS = [
   'schema_version',
   'id',
@@ -57,6 +64,7 @@ const CONTROLLED_ITEM_FIELDS = new Set([
   'related',
   'decisions',
   'body',
+  'extensions',
 ]);
 // Everything the core view owns. Extension-node identity preserves only
 // fields outside this set; core-owned values are compared through coreView.
@@ -167,7 +175,7 @@ export function validateCreateRequest(request, parseIssues = []) {
   }
   const controlled = new Set([
     'schema_version', 'id', 'status', 'created', 'updated', 'completed',
-    'killed', 'archived', 'deferred', 'decisions', 'body', 'number',
+    'killed', 'archived', 'deferred', 'decisions', 'body', 'number', 'extensions',
   ]);
   for (const field of Object.keys(item)) {
     if (controlled.has(field)) {
@@ -229,11 +237,15 @@ export async function createItem(ledgerDirectory, request, scenario) {
     ledgerDirectory,
     request.id,
     'create-v1',
-    (authorize, ledgerSnapshot) => createItemUnfenced(ledgerDirectory, request, scenario, ledgerSnapshot),
+    (authorize, ledgerSnapshot) => createItemUnfenced(
+      ledgerDirectory, request, scenario, authorize, ledgerSnapshot,
+    ),
   );
 }
 
-async function createItemUnfenced(ledgerDirectory, request, scenario, ledgerSnapshot) {
+async function createItemUnfenced(
+  ledgerDirectory, request, scenario, authorize, ledgerSnapshot,
+) {
   const root = path.resolve(ledgerDirectory);
   const id = request.id;
   const readPreLockLedger = snapshotReader(root, ledgerSnapshot);
@@ -361,6 +373,15 @@ async function createItemUnfenced(ledgerDirectory, request, scenario, ledgerSnap
         }));
       }
 
+      // The allocation this create proposes becomes journal-visible before any
+      // byte reaches the ledger, so a sibling worktree that cannot see this
+      // item's publication cannot hand the same number out again. The intent is
+      // appended only once the candidate is known publishable, so a refusal
+      // this command would have returned anyway records no attempt.
+      if (authorize) {
+        await authorize(null, revisionFor(bytes), relativeFinalPath);
+      }
+
       temporaryPath = path.join(finalDirectory, `.wowbagger-tmp-${id}-${randomSuffix()}`);
       const temporaryFailure = await prepareTemporary(temporaryPath, bytes, null, scenario);
       if (temporaryFailure) {
@@ -518,7 +539,7 @@ export async function migrateParentItem(ledgerDirectory, request, scenario) {
       build: buildParentMigration,
       authorize,
     }, ledgerSnapshot)
-  ));
+  ), { responseCommand: 'parent-migrate-v1' });
 }
 
 export async function snoozeItem(ledgerDirectory, request, scenario) {
@@ -529,7 +550,7 @@ export async function snoozeItem(ledgerDirectory, request, scenario) {
       build: buildSnooze,
       authorize,
     }, ledgerSnapshot)
-  ));
+  ), { responseCommand: 'snooze-v1' });
 }
 
 // The namespace-lock-held mutation strategy. A claimed publication runs inside
@@ -936,18 +957,23 @@ export function validateParentMigrationRequest(request, parseIssues = []) {
   for (const member of ['id', 'expected_revision', 'expected_parent', 'parent', 'date']) {
     if (!hasOwn(request, member)) issues.push(issue(`/${member}`, 'missing-member', `Required member ${member} is missing.`));
   }
-  if (typeof request.id !== 'string' || !ULID_PATTERN.test(request.id)) {
+  if (hasOwn(request, 'id')
+    && (typeof request.id !== 'string' || !ULID_PATTERN.test(request.id))) {
     issues.push(issue('/id', 'invalid-value', 'Member id must be a canonical Wowbagger item ID.'));
   }
-  if (typeof request.expected_revision !== 'string' || !/^sha256:[0-9a-f]{64}$/.test(request.expected_revision)) {
+  if (hasOwn(request, 'expected_revision')
+    && (typeof request.expected_revision !== 'string' || !/^sha256:[0-9a-f]{64}$/.test(request.expected_revision))) {
     issues.push(issue('/expected_revision', 'invalid-value', 'Member expected_revision must be a SHA-256 revision.'));
   }
   for (const member of ['expected_parent', 'parent']) {
-    if (request[member] !== null && (typeof request[member] !== 'string' || !ULID_PATTERN.test(request[member]))) {
+    if (hasOwn(request, member)
+      && request[member] !== null
+      && (typeof request[member] !== 'string' || !ULID_PATTERN.test(request[member]))) {
       issues.push(issue(`/${member}`, 'invalid-value', `Member ${member} must be null or a canonical Wowbagger item ID.`));
     }
   }
-  if (typeof request.date !== 'string' || !isCalendarDate(request.date)) {
+  if (hasOwn(request, 'date')
+    && (typeof request.date !== 'string' || !isCalendarDate(request.date))) {
     issues.push(issue('/date', 'invalid-value', 'Member date must be an ISO calendar date.'));
   }
   return sortIssues(issues);
@@ -961,9 +987,24 @@ async function buildParentMigration(lockedTarget, ledger, request, scenario, roo
   if (request.date < lockedTarget.data.updated) {
     issues.push(dateIssue('date-before-updated', 'Migration date must not be earlier than updated.', lockedTarget.data));
   }
+  if (issues.length > 0) {
+    return { outcome: parentMigrationRefusal(2, { id: lockedTarget.data.id, issues }) };
+  }
   const currentParent = lockedTarget.data.parent ?? null;
   if (request.expected_parent !== currentParent) {
-    issues.push({ code: 'parent-revision-conflict', field: 'expected_parent', message: 'The current parent does not match expected_parent.', related_ids: [] });
+    return {
+      outcome: parentMigrationRefusal(4, {
+        id: lockedTarget.data.id,
+        expected_parent: request.expected_parent,
+        actual_parent: currentParent,
+        issues: [{
+          code: 'parent-revision-conflict',
+          field: 'expected_parent',
+          message: 'The current parent does not match expected_parent.',
+          related_ids: [],
+        }],
+      }),
+    };
   }
   if (request.parent === lockedTarget.data.id) {
     issues.push({ code: 'invalid-parent', field: 'parent', message: 'An item cannot parent itself.', related_ids: [] });
@@ -975,7 +1016,7 @@ async function buildParentMigration(lockedTarget, ledger, request, scenario, roo
     }
   }
   if (issues.length > 0) {
-    return { outcome: mutationError('parent-migration-precondition-failed', 'The parent migration failed its preconditions.', 'unchanged', 2, { id: lockedTarget.data.id, issues }) };
+    return { outcome: parentMigrationRefusal(2, { id: lockedTarget.data.id, issues }) };
   }
   const successor = { ...lockedTarget.data, updated: request.date };
   if (request.parent === null) delete successor.parent;
@@ -993,6 +1034,19 @@ async function buildParentMigration(lockedTarget, ledger, request, scenario, roo
     return { outcome: operationFailed(request.id, 'serialize-candidate', 'serialization-failed') };
   }
 }
+
+// One refusal answers every parent-migration precondition. The exit separates a
+// stated conflict with the observed parent from the other precondition failures.
+function parentMigrationRefusal(exit, details) {
+  return mutationError(
+    'parent-migration-precondition-failed',
+    'The parent migration failed its preconditions.',
+    'unchanged',
+    exit,
+    details,
+  );
+}
+
 export function validateSnoozeRequest(request, parseIssues = []) {
   const issues = [...parseIssues];
   if (request === null || typeof request !== 'object' || Array.isArray(request)) {
@@ -1001,14 +1055,18 @@ export function validateSnoozeRequest(request, parseIssues = []) {
   for (const member of ['id', 'expected_revision', 'snoozed_until', 'date']) {
     if (!hasOwn(request, member)) issues.push(issue(`/${member}`, 'missing-member', `Required member ${member} is missing.`));
   }
-  if (typeof request.id !== 'string' || !ULID_PATTERN.test(request.id)) {
+  if (hasOwn(request, 'id')
+    && (typeof request.id !== 'string' || !ULID_PATTERN.test(request.id))) {
     issues.push(issue('/id', 'invalid-value', 'Member id must be a canonical Wowbagger item ID.'));
   }
-  if (typeof request.expected_revision !== 'string' || !/^sha256:[0-9a-f]{64}$/.test(request.expected_revision)) {
+  if (hasOwn(request, 'expected_revision')
+    && (typeof request.expected_revision !== 'string' || !/^sha256:[0-9a-f]{64}$/.test(request.expected_revision))) {
     issues.push(issue('/expected_revision', 'invalid-value', 'Member expected_revision must be a SHA-256 revision.'));
   }
   for (const member of ['snoozed_until', 'date']) {
-    if (request[member] !== null && (typeof request[member] !== 'string' || !isCalendarDate(request[member]))) {
+    if (hasOwn(request, member)
+      && request[member] !== null
+      && (typeof request[member] !== 'string' || !isCalendarDate(request[member]))) {
       issues.push(issue(`/${member}`, 'invalid-value', `Member ${member} must be null or an ISO calendar date.`));
     }
   }
@@ -2015,7 +2073,7 @@ function validLockOwner(owner, file) {
   }
   return isJsonInteger(owner.lock_version, 1)
     && owner.item_id === expectedId
-    && (owner.operation === 'create' || owner.operation === 'transition' || owner.operation === 'patch')
+    && LOCK_OWNER_OPERATIONS.has(owner.operation)
     && typeof owner.writer_id === 'string'
     && /^[\x21-\x7e]{1,128}$/.test(owner.writer_id)
     && isRfc3339Utc(owner.started_at);

package/src/reconciliation-classifier.js

@@ -0,0 +1,117 @@
+// The reconciliation topology, decided once, from evidence alone.
+//
+// Every command that reconciles a claim journal has to answer the same
+// question about a drifted item: which of the recognized topologies is this,
+// and does it block the write in front of us? Answering it inside each command
+// is how the answers drifted apart, so the decision lives here, pure: no Git,
+// no filesystem, no prose. Callers gather the evidence, render the sentences,
+// and keep the scope to themselves.
+//
+// The vocabulary:
+//
+//   revision state  where a surface's bytes stand against the journal —
+//                   `expected` the authorized revision itself, `authorized`
+//                   some other revision the journal once ruled legitimate,
+//                   `unknown` bytes no ruling covers, `absent` no bytes at all.
+//   owner evidence  `{ kind, ref?, commit? }` from `findRevisionOwner`: which
+//                   live worktree, if any, carries the expected revision.
+//   expected writer `current` when the journal names this worktree as the
+//                   writer of the expected revision, `other` when it names
+//                   another, `unknown` when nothing can be attributed.
+//   scope           who a finding blocks: `global` every write, `target` only
+//                   a write against the item it names, `none` nobody.
+//   remediation     which remedy the topology prescribes; the caller renders
+//                   the sentence, so the kinds carry no wording.
+
+// Where one surface's bytes stand against the journal. `expected` is a
+// refinement of `authorized`, so it is tested first.
+export function normalizeRevision(revision, expectedRevision, authorizedRevisions) {
+  if (revision === null) return 'absent';
+  if (revision === expectedRevision) return 'expected';
+  return authorizedRevisions.has(revision) ? 'authorized' : 'unknown';
+}
+
+// Owner evidence costs a walk of every live worktree's history, so the two
+// topologies that never consult it must not pay for it. The predicate answers
+// from the same states the classifier judges, through the same helper, so
+// neither can drift from the other.
+export function requiresOwnerEvidence({ workingTree, head }) {
+  return !isUnattributed(workingTree, head) && workingTree !== 'expected';
+}
+
+// Bytes no ruling covers, on either surface, and a working tree that is gone
+// while another surface still holds bytes. Nothing here is attributable to a
+// writer or an owner: the local state is simply out of protocol.
+function isUnattributed(workingTree, head) {
+  return workingTree === 'unknown'
+    || head === 'unknown'
+    || (workingTree === 'absent' && head !== 'absent');
+}
+
+// One topology, one member. `expectedOwner` is required exactly when
+// `requiresOwnerEvidence` says so, and is never read otherwise.
+export function classifyReconciliation({ workingTree, head, expectedOwner, expectedWriter }) {
+  if (isUnattributed(workingTree, head)) return UNAUTHORIZED_REVISION;
+  // The authorized bytes are here and Git has yet to record them. Nothing is
+  // in doubt but the commit.
+  if (workingTree === 'expected') {
+    return { scope: 'global', reason: 'git-finalization-required', remediation: 'commit-in-git' };
+  }
+  // An item absent from both local surfaces has never existed in this
+  // checkout. A sibling may carry the expected revision, but that does not
+  // establish ownership for a checkout with no local history or item path.
+  if (workingTree === 'absent') {
+    return {
+      scope: 'target',
+      reason: 'worktree-synchronization-required',
+      remediation: 'establish-ownership',
+    };
+  }
+  // A live named worktree carries the expected revision, so there is a ref to
+  // wait on and a commit to name. This outranks the remaining synchronization
+  // answers, because it is the only one that names an owner.
+  if (expectedOwner.kind === 'named-sibling') {
+    return {
+      scope: 'target',
+      reason: 'worktree-synchronization-required',
+      owner: expectedOwner,
+      remediation: 'wait-for-named-owner',
+    };
+  }
+  // Advice to wait for an owning worktree needs an owner that could still
+  // appear. When the journal names this worktree as the writer of the expected
+  // revision, or this worktree's own history reaches it, the successor exists
+  // nowhere but in the journal: there is nothing to synchronize from, and the
+  // authorized bytes on disk are simply the wrong ones.
+  if (expectedWriter !== 'current' && expectedOwner.kind !== 'current') {
+    return {
+      scope: 'target',
+      reason: 'worktree-synchronization-required',
+      // Waiting is only truthful while the commit is still missing. Git already
+      // reaches a `reachable-unowned` revision through a tag, a remote-tracking
+      // ref, an unchecked branch, or a detached HEAD, so telling a reader to
+      // wait for a commit names a wait that can never end: the bytes are there
+      // to inspect, and no named worktree will publish them.
+      remediation: expectedOwner.kind === 'reachable-unowned'
+        ? 'inspect-reachable-history'
+        : 'await-owner-commit',
+    };
+  }
+  return UNAUTHORIZED_REVISION;
+}
+
+const UNAUTHORIZED_REVISION = Object.freeze({
+  scope: 'global',
+  reason: 'unauthorized-revision',
+  remediation: 'restore-or-adopt',
+});
+
+// Scope, never reason text, decides what a finding refuses. A mutation names
+// the item it targets, and a synchronization another item waits on is a wait
+// this mutation does not touch. A caller that names no target, such as the
+// `claim-verify` command, keeps every finding blocking.
+export function blocksTarget(scope, itemId, targetItemId) {
+  if (scope === 'none') return false;
+  if (scope === 'global') return true;
+  return targetItemId === null || itemId === targetItemId;
+}

package/src/report-evidence.js

@@ -71,59 +71,120 @@ function shiftDays(date, days) {
     .slice(0, 10);
 }
 
-// Arrivals against completions, week by week. An arrival is `created`; a
-// completion is the item reaching any terminal status, because every one of the
-// four terminal statuses removes work from the backlog.
-export function buildWeeklyFlow(allItems, asOf) {
-  const lastWeek = weekStart(asOf);
-  const counts = new Map();
+// Arrivals against closures, week by week. An arrival is `created`; a closure
+// is the item reaching any terminal status, because every one of the four
+// terminal statuses removes work from the backlog. `done` counts the closures
+// that delivered: only a `done` departure is finished work, so only `done`
+// may be read as completed work.
+function isValidDateString(value) {
+  if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(value)) {
+    return false;
+  }
+  const parsed = Date.parse(`${value}T00:00:00Z`);
+  return !Number.isNaN(parsed)
+    && new Date(parsed).toISOString().slice(0, 10) === value;
+}
+
+// The weeks an evidence window covers. The default is the trailing twelve
+// calendar weeks ending in the week of `asOf`. An explicit range uses the
+// inclusive UTC calendar dates `from` through `to` (`to <= asOf`); a week
+// bucket the range cuts short is marked partial, and the rolling mean only
+// covers complete weeks. A range never filters items out: anything created
+// before `from` still contributes to cumulative inventory.
+function resolveWindow(asOf, range) {
+  if (range === null || range === undefined) {
+    const lastWeek = weekStart(asOf);
+    const weekStarts = [];
+    for (let index = WINDOW_WEEKS - 1; index >= 0; index -= 1) {
+      weekStarts.push(shiftDays(lastWeek, -index * 7));
+    }
+    return {
+      weekStarts,
+      start: weekStarts[0],
+      end: asOf,
+      partial: new Set(),
+      windowWeeks: WINDOW_WEEKS,
+      range: null,
+    };
+  }
+  const from = range?.from ?? null;
+  const to = range?.to ?? null;
+  if (!isValidDateString(from) || !isValidDateString(to) || from > to || to > asOf) {
+    throw new Error(`invalid report range ${JSON.stringify(range)}`);
+  }
   const weekStarts = [];
-  for (let index = WINDOW_WEEKS - 1; index >= 0; index -= 1) {
-    const start = shiftDays(lastWeek, -index * 7);
+  for (let start = weekStart(from); start <= weekStart(to); start = shiftDays(start, 7)) {
     weekStarts.push(start);
-    counts.set(start, { weekStart: start, arrivals: 0, completions: 0 });
+  }
+  const partial = new Set(
+    weekStarts.filter((start) => start < from || shiftDays(start, 6) > to),
+  );
+  const windowDays = (daysBetween(from, to) ?? 0) + 1;
+  const windowWeeks = windowDays / 7;
+  return {
+    weekStarts, start: from, end: to, partial, windowWeeks, range: { from, to },
+  };
+}
+
+export function buildWeeklyFlow(allItems, asOf, range = null) {
+  const window = resolveWindow(asOf, range);
+  const counts = new Map();
+  for (const start of window.weekStarts) {
+    counts.set(start, {
+      weekStart: start, arrivals: 0, closures: 0, done: 0, partial: window.partial.has(start),
+    });
   }
 
   for (const item of allItems) {
     const arrivalWeek = counts.get(weekStart(item.created));
-    if (arrivalWeek !== undefined) {
+    if (arrivalWeek !== undefined && item.created >= window.start && item.created <= window.end) {
       arrivalWeek.arrivals += 1;
     }
-    const departureWeek = item.terminalDate === null
-      ? undefined
-      : counts.get(weekStart(item.terminalDate));
-    if (departureWeek !== undefined) {
-      departureWeek.completions += 1;
+    if (item.terminalDate === null) {
+      continue;
+    }
+    const departureWeek = counts.get(weekStart(item.terminalDate));
+    if (departureWeek !== undefined
+      && item.terminalDate >= window.start && item.terminalDate <= window.end) {
+      departureWeek.closures += 1;
+      if (item.status === 'done') {
+        departureWeek.done += 1;
+      }
     }
   }
-  const series = weekStarts.map((start) => counts.get(start));
-  return attachRollingMean(series);
+  return attachRollingMean(counts, window);
 }
 
-// A four-week trailing mean over completions. Weekly throughput is noisy
+// A four-week trailing mean over closures. Weekly throughput is noisy
 // enough that the bar heights alone mislead; the mean is the trend line.
-// The first three weeks stay null because a four-week mean needs four weeks,
-// and averaging over fewer would flatter the start of the window.
+// A trailing window shorter than four complete weeks stays null: averaging
+// over fewer weeks, or over a week the selected range cut short, would
+// flatter or understate the start of the window.
 const ROLLING_WEEKS = 4;
 
-function attachRollingMean(series) {
-  return series.map((week, index) => {
-    if (index < ROLLING_WEEKS - 1) {
+function attachRollingMean(counts, window) {
+  return window.weekStarts.map((start, index) => {
+    const week = counts.get(start);
+    const trailing = window.weekStarts.slice(Math.max(0, index - ROLLING_WEEKS + 1), index + 1);
+    if (trailing.length < ROLLING_WEEKS || trailing.some((member) => window.partial.has(member))) {
       return { ...week, rolling: null };
     }
-    const window = series.slice(index - ROLLING_WEEKS + 1, index + 1);
-    const total = window.reduce((sum, member) => sum + member.completions, 0);
+    const total = trailing.reduce((sum, member) => sum + counts.get(member).closures, 0);
     return { ...week, rolling: Math.round((total / ROLLING_WEEKS) * 100) / 100 };
   });
 }
-
 // Cumulative flow over the same window the weekly series covers. Each item
 // carries three timestamps - `created`, the accept decision, and its terminal
 // date - so every day in the window can be replayed from the current bytes.
 // Only three bands are honest here: `backlog -> in-progress` records no
-// decision, so the ledger cannot say when work actually started.
-export function buildCumulativeFlow(allItems, asOf) {
-  const start = shiftDays(weekStart(asOf), -(WINDOW_WEEKS - 1) * 7);
+// decision, so the ledger cannot say when work actually started. An explicit
+// range moves the window edges but never drops early items: anything created
+// before the range still stands in inventory on every day it spans.
+// A band named Untriaged holds items with no recorded accept decision, which
+// is reconstruction uncertainty - not proof the item sat untriaged. Deleted
+// items and unrecorded transitions cannot be recovered from the snapshot.
+export function buildCumulativeFlow(allItems, asOf, range = null) {
+  const window = resolveWindow(asOf, range);
   const states = allItems.map((item) => ({
     created: item.created,
     accepted: item.decisions.find((decision) => decision.action === 'accept')?.date ?? null,
@@ -131,7 +192,7 @@ export function buildCumulativeFlow(allItems, asOf) {
   }));
 
   const points = [];
-  for (let date = start; date <= asOf; date = shiftDays(date, 1)) {
+  for (let date = window.start; date <= window.end; date = shiftDays(date, 1)) {
     const point = {
       date, triage: 0, accepted: 0, terminal: 0,
     };
@@ -205,11 +266,13 @@ const FORECAST_WEEK_CEILING = 520;
 // the same --as-of, so the sampler may not read the clock or Math.random.
 const FORECAST_SEED = 0x9e3779b9;
 
-// Monte Carlo over observed weekly throughput, per Vacanti: resample the weeks
-// the ledger actually recorded rather than extrapolating an average, and report
-// a band instead of one false-precision date.
+// Monte Carlo over the observed weekly closure rate, per Vacanti: resample the
+// weeks the ledger actually recorded rather than extrapolating an average,
+// and report a band instead of one false-precision date. This is a
+// closure-based estimate of when open work clears, not a feature-delivery
+// commitment: closures include kills, deferrals, and archives alongside done.
 export function buildForecast(weeks, remaining, asOf) {
-  const samples = weeks.map((week) => week.completions);
+  const samples = weeks.map((week) => week.closures);
   if (samples.reduce((total, value) => total + value, 0) === 0) {
     return null;
   }
@@ -283,21 +346,75 @@ function seededRandom(seed) {
   };
 }
 
-export function buildEvidence(openItems, terminalItems, asOf) {
-  const weeks = buildWeeklyFlow([...openItems, ...terminalItems], asOf);
-  const completionTotal = weeks.reduce((total, week) => total + week.completions, 0);
+export function buildEvidence(openItems, terminalItems, asOf, range = null) {
+  const window = resolveWindow(asOf, range);
+  const retained = [...openItems, ...terminalItems];
+  const weeks = buildWeeklyFlow(retained, asOf, range);
+  const closureTotal = weeks.reduce((total, week) => total + week.closures, 0);
+  const doneTotal = weeks.reduce((total, week) => total + week.done, 0);
 
   return {
+    range: window.range,
     agingBuckets: buildAgingBuckets(openItems, asOf),
     agingMatrix: buildAgingMatrix(openItems, asOf),
     weeks,
     throughput: {
-      total: completionTotal,
-      windowWeeks: WINDOW_WEEKS,
-      perWeek: Math.round((completionTotal / WINDOW_WEEKS) * 100) / 100,
+      total: closureTotal,
+      done: doneTotal,
+      windowWeeks: window.windowWeeks,
+      perWeek: window.windowWeeks === 0
+        ? 0
+        : Math.round((closureTotal / window.windowWeeks) * 100) / 100,
+    },
+    cumulativeFlow: buildCumulativeFlow(retained, asOf, range),
+    coverageGaps: {
+      // Retained items past triage with no recorded accept decision. Their
+      // band history reads as untriaged until departure, which is
+      // reconstruction uncertainty, not proof they sat untriaged. An item
+      // killed straight from triage records a kill instead of an accept;
+      // its history is complete, so it is not a gap.
+      missingAcceptance: retained.filter((item) => item.status !== 'triage'
+        && !item.decisions.some((decision) => decision.action === 'accept')
+        && !(item.status === 'killed'
+          && item.decisions.some((decision) => decision.action === 'kill'))).length,
     },
-    cumulativeFlow: buildCumulativeFlow([...openItems, ...terminalItems], asOf),
     cycleTime: buildCycleTime(terminalItems),
     forecast: buildForecast(weeks, openItems.length, asOf),
   };
 }
+
+// The calculators the browser re-runs, serialized from the same functions
+// Node executes above. Tested for runtime parity against the direct functions
+// in a VM: the browser never carries a second formula.
+function browserFunctionSource(fn) {
+  return fn.toString().replace(/^export\s+/, '');
+}
+
+export function reportEvidenceBrowserSource() {
+  return [
+    `const AGE_BUCKETS = ${JSON.stringify(AGE_BUCKETS)};`,
+    `const OPEN_STATUSES = ${JSON.stringify(OPEN_STATUSES)};`,
+    `const WINDOW_WEEKS = ${WINDOW_WEEKS};`,
+    `const MILLISECONDS_PER_DAY = ${MILLISECONDS_PER_DAY};`,
+    `const ROLLING_WEEKS = ${ROLLING_WEEKS};`,
+    `const FORECAST_TRIALS = ${FORECAST_TRIALS};`,
+    `const FORECAST_WEEK_CEILING = ${FORECAST_WEEK_CEILING};`,
+    `const FORECAST_SEED = ${FORECAST_SEED};`,
+    browserFunctionSource(daysBetween),
+    browserFunctionSource(buildAgingBuckets),
+    browserFunctionSource(buildAgingMatrix),
+    browserFunctionSource(weekStart),
+    browserFunctionSource(shiftDays),
+    browserFunctionSource(isValidDateString),
+    browserFunctionSource(resolveWindow),
+    browserFunctionSource(buildWeeklyFlow),
+    browserFunctionSource(attachRollingMean),
+    browserFunctionSource(buildCumulativeFlow),
+    browserFunctionSource(buildCycleTime),
+    browserFunctionSource(percentile),
+    browserFunctionSource(buildForecast),
+    browserFunctionSource(cumulativeShare),
+    browserFunctionSource(seededRandom),
+    browserFunctionSource(buildEvidence),
+  ].join('\n');
+}