Commits

26 TUI file headers named files the prefix sweep had renamed, and diff/model.go had a 20-line package doc and no header. Six infrastructure files take a table prefix, the tuicore nav target registry named after what it holds once tuinav's registry took the basename. Ten

ARCHITECTURE.md said one place lists every extension's Processors, recorded the extension-table asymmetry for core/search alone, named 14 of 21 package-level seams, and left the fork refs and the TUI prefix table's scope unstated; each sentence now says what the tree does, the

go test -count=5 failed from run 2 in core/fetch, social and tui/test, each through state a package shares across runs: fixed repository URLs and hashes in a cache opened once, a follower's read marker keyed on the follower alone, and a pull request written into the shared TUI

Model.Update was 365 lines over a 36-case switch, changed in 22 of the last 90 days' commits, and sat at the funlen statement ceiling, so the next message type failed the push. Seven groups (navigation, workspace sync, fetch, push, import, badges, artifact export) are methods in

serve.js was spawned with stdin ignored and killed only on the runner's success path, so a runner that died mid-run left the server listening. Two of them outlived their runs by a day. The failure modes: a suite throwing lands in main().catch, which exits without the kill, and a

scripts/release.sh read $root without assigning it since ac83792, so every run aborted in preflight under set -u; the Chrome probe called node outside its guard, and a trailing && made a real release exit 1 on its last line. All three fixed, and TestReleaseScript_dryRunCompletes

Every app card heads through cardHead now, so the card skeleton has one shape to pin: a fixture names the parts and the head's slot order per type, asserted over the page's entries template and the app's activity row. The test found both renderers heading body-only rows the

The item page's raw toggle and copy-link sat on two rows; they share one .page-actions row in the top bar. The trailer list stays as a Trailers component, app only, carrying only the header fields no other component shows, eight rows to five on a pull request. The sidebar's file

STYLE.md bans eleven intensifiers (exactly, deliberately, silently, loudly, forever, by construction, honest, genuinely, precisely, the whole) and 273 lines carried one. The confidence rule lists every such line in any tracked file but STYLE.md; the sweep rewrote 270 of them

The blob view labels a binary, an LFS pointer, a submodule and a symlink with one sentence and renders nothing else, deciding from the tree entry's mode before any fetch. The app renders .mdx as prose the way the page already ships it, so the boot swap never turns a read

The detail route paints only when findItemDeep resolves, a ~200-object loose walk over HTTP, and the suite gave it a fixed 20x50 ms poll budget before asserting. On a loaded machine the walk outran that budget and the paint assertions read the router's own "Loading..."

Three survey findings, each with a different cause than read. The front page's activity row built its head by hand in both renderers, so a prerelease release carried no chip; siteRowChips and rowChips are now the one row rule, an issue leaving its state to the tinted glyph. The

gs-render.js was the largest browser gap at 75% of functions. Four DOM-shim unit suites seed objects and commits straight into the reader's context and cover the markdown renderer, the card vocabulary, the code, blob and diff views and the detail routes, 222 assertions, no

The rule counted added comment lines and never removed ones, so a comment rewritten line for line read as pure comment addition and the confidence sweep, net zero on every commit, failed the hook on seven of eight. Comment lines removed now offset the ones added, so a rewrite

Chrome clamps a headless window to the platform floor, 500px on macOS, so --window-size=390 laid the page out at 500 and --screenshot cropped it to 390: every 390px golden was a crop of a 500px layout, not a phone layout. cdp.js sets the viewport over the DevTools pipe instead,

The memo personal, session and inherited tiers live in repositories outside the workspace, so their five routes rendered only through the smoke matrix. The fixture seeds a personal repo under the isolated HOME, a session pinned by MEMO_SESSION_ID and an inherited source under

The CLI tests run the binary and the s3 remote helper as children, so helper_push.go and thin.go earned no statement credit. The harness builds the binary with -cover when GITSOCIAL_COVERDIR is set, the children write GOCOVERDIR data, and coverage.sh --merge folds it into the

The design doc's change rules say a new route, chip variant or page version gets its row first, and nothing checked it. One conformance test reads every chip class the renderers emit, every route parseRoute dispatches, the page kinds the page layer writes and the current

Building a command tree wrote --json, --workdir and --cache-dir into package-level variables, which raced under -race the moment two in-process tests overlapped. One Config per tree now carries them through the command's context. The eleven body-from-stdin readers read

The HTML pages and Testing sections described the markup, the chips, the meta row and the fixed wording of every state, which STATIC-SITE-DESIGN.md now owns. What is left is how a page is generated, what it holds and what it costs. Each file links the other from its opening

The site design spec lived in the plan file, outside the tree, so a visual change had no in-repo rule to meet. It lands as STATIC-SITE-DESIGN.md with the components, states and repo shapes it now describes, in the style guide's register: the plan's dated notes and measured

An error value has no exported fields, so encoding/json wrote data.details as {} whenever a Result carried its cause as an error. Clients saw an empty object where the CLI printed the cause. The conversion at the RPC boundary now renders an error as its Error() text and passes

Every fixture bucket was synthetic and shaped like this repository, so the C.6 repo-shape rules had no test. shapes.sh generates six buckets on a fixture-lib.sh shared with fixture.sh: a source tree on a trunk branch with a hero README, an .mdx docs site, one commit with no

Commands printed with fmt.Print to the process streams, so the in-process test harness had to swap os.Stdout and os.Stderr for pipes and no CLI test could run in parallel. 400 print sites in 31 files now write through cmd.OutOrStdout() and cmd.ErrOrStderr(), printers take an

The branch flow, the design note, the tiers and the definition of done each hold one part of how work runs, and nothing collected them. The new section links to each rule instead of restating it. The read-in-full line moves there from Code Rules, its only other home.

The rule against comment-heavy diffs was prose with no mechanism. The prose check already reads the pushed range, so it counts each commit's added comment lines against its added code lines there and fails at 0 in the baseline. Commits touching only documentation, testdata or

Nineteen tests spawned the binary only to exercise command logic. They now run through buildRootCmd() on the exit seam, the --json tree walk among them; the push verbs, the thin-bucket set and the s3 helper battery stay child processes. The credentials tests get a config home

The CLI printed result.Error.Message and nothing read Details, so the cause behind every ErrWithDetails never reached the user. Error.Text() renders "message: details"; 97 CLI and 92 TUI relay sites use it, and RPC keeps Message and Details as separate fields. Social's eighteen

The fixture dated every commit at now, so a slow run crossed from "just now" to "1m ago". The golden mask pads its placeholder to the matched length, so that label shifted the row two columns and TestGolden failed on releases, pr_list and timeline under machine load.

The full tier gained the coverage check and the site fixture build, and "Test and lint" names both. Its wall-time table goes: the numbers were measured on one machine and went stale within days, the full tier read 4 min while it ran in 2, and the rule is the same at any

Every command exited through os.Exit inside its Run closure, 343 sites, so no command could run in the test process and the CLI's coverage could only move through child processes, which earn no credit. Commands now return exit(code) through RunE and main exits once; PrintError

The browser battery runs at release only, so a fixture.sh failure sat on main for six commits unnoticed. The build now runs in the full tier behind fullTierOnly, with no node and no Chrome.

Every error literal in cli/ and library/ follows STYLE.md's Errors section: the thing that failed, then the next action when the reader has one. About 1,100 literals read across fmt.Errorf, errors.New, result.Err and PrintError, about 230 reworded; codes, sentinels, %w chains

STYLE.md had the rule as one table row and nothing said what a wrap, a sentinel or a next action looks like, so a sweep would settle it three ways. The Errors section names the shape with five examples. The prose check gains error-shape over fmt.Errorf, errors.New, result.Err

The full tier runs the tests under -coverpkg=./... and checks the profile against scripts/coverage-baseline.txt. A package that loses its tests now fails the gate instead of drifting down unnoticed. The baseline holds 45 packages, from a full-tier run on this branch. Two runs

The provider ran the push precondition check per gitmsg branch, five git processes each, at TUI startup and after every fetch. One for-each-ref now reads every local and remote-tracking gitmsg tip, and a converged repository costs that one process. Only a branch whose

Neither adapter filled ImportMilestone.UpdatedAt, so the mapping stored no time for a milestone and skipByUpdatedAt never fired. Every --update re-import read each mapped milestone back and compared its fields, and one the comparison could not match was rewritten on every run.

A URL with no repository path, such as https://host:8080, produced https://host:8080.git/info/lfs/objects/batch. The port then parsed as "8080.git" and http.NewRequest rejected the address, so an LFS fetch against such a remote failed before it was sent. The URL is now parsed,

A reader of SOCIAL.md or REVIEW.md had no way to tell whether the URL they type is the one git is handed. ARCHITECTURE.md names the two roles the rest of the guide relies on.

A fork pull request naming the upstream as <origin>.git/ was invisible: its base did not match the workspace URL by string equality, so it was neither listed nor notified. The canonicalizer now folds the spelling; the test holds it.

A followed repository or registered fork was fetched from its canonical form, so an ssh-only repository could not be fetched at all and a bare repository whose path ends in .git was fetched from a path without it. RepoInfo carries the address from the list member ref,

A repository followed as git@host:o/r.git was stored canonicalized, so git was handed an https URL the user never gave and an ssh-only repository could not be followed at all. A list member ref and a fork ref now carry the spelling the user gave; the fork ref path, the cache

ParseS3URL split the raw URL while NormalizeURL folded it, so the two disagreed on a trailing space, a percent escape and an empty first label. The parser now canonicalizes first and splits only that, refuses a percent escape, and leaves the endpoint-host check to the

A repository reached as repo.git.git, repo.git/ or repo// read as a different repository on every pass, so refs to it never matched and the ref round trip had no fixed point. The strip loop now runs to a fixed point, and NormalizeRefWithContext uses the canonicalizer instead of

The meta row, the empty sentence and the truncation notices all changed the markup of item pages and sealed list pages, which a rebuild rewrites only on a version change. pages-core.css changed too, and every page's head carries a copy of it.

The .err notice was the one C.4 component no computed-style assertion covered, so a token change could recolour every error page unnoticed. It joins probe.js's selector list, the styles suite gains a missing-branch route that renders one, and its check reads --danger,

The page layer's thread, file and README markers read "… truncated — …" in a .meta line, an em-dash STYLE.md forbids in a UI string, and the feed's read "… truncated". All four now carry the spec's sentence in .notice: "N more replies not shown." on a thread and "Truncated. The

The page layer showed "nothing here yet" on every list, whatever the list held. Each list now renders "No <items> in this repository." in .empty, with "No activity in this repository yet." on the timeline, the sentence the app already shows. The app reads the same strings from

The page layer wrote the author, date and short ref as plain text and dropped the hash on list rows, while the app built spans and two chips. Both now render span.author, span.reltime and a.hash in that order, with the email and the precise time in title attributes, and the

No item carried a platform UpdatedAt, so skipByUpdatedAt never matched and a re-import with --update rewrote every item it had already imported. The REST release payload omits updated_at, so a release takes its time from a GraphQL query batched over the planned tags.

The cache design is justified by a 1M-commit case and the largest seeded row count in the suite was 5, so no query plan was ever checked against real statistics. The benchmark seeds 100,000 core_commits and 100,000 social_items through InsertCommits and insertSocialItems in

getThread built its SQL inside its QueryLocked closure, so no test could reach the string and the plan the comment in the function describes was never checked. The query moves to threadQuery, the shape commentsQuery already has, with the text unchanged.

The import section still said comments came from GitHub alone and that --api-url was the only way to reach a self-hosted instance.

A plain re-import skipped an imported discussion whole, comments included, so a new comment on it arrived only with --update. The post is still not re-created; its comments now take the comment path, which skips each mapped comment on its own.

The TUI built the adapter with empty options, so an import of a self-hosted project talked to gitlab.com, and the CLI reached the instance only when the user passed --api-url. Both now derive the base URL from the repository URL through OptionsForRepo, with an explicit --api-url

No item carried a platform UpdatedAt, so skipByUpdatedAt never matched and a re-import with --update rewrote every item it had already imported.

Neither fetch read the notes endpoints, so a GitLab import dropped every conversation comment. Notes now map to the comment shape the GitHub adapter produces, keyed by note id so the #note_ anchor round trips, with system notes left out as GitLab's own activity log.

Keyset pagination carries the next page in the Link header alone, with no X-Next-Page, so the walk stopped after page one and an import saw the first 100 items of a project. apiGetPage now returns the next page's path, taken from X-Next-Page or from the rel="next" link.

A failed page after the first left the walk with a partial plan and a nil error, so an import silently dropped every item the walk had not reached. The caller decides what a partial fetch is worth.

pm.RetractIssue, RetractMilestone, RetractSprint, release.RetractRelease, review.RetractPR and RetractFeedback wrote the commit and stopped, so a session that does not sync on start, RPC, kept serving the item until the next fetch. Each now caches its commit through the

GetPostsOptions.SortBy was written by social.getPosts from its `sort` param and read by nothing, so a client could order posts and see no change. The field, the param and the RPC.md bullet go; posts still come back newest first and an undocumented param is still ignored.

RemoveFork returned nil when no fork ref existed, so `gitsocial fork remove` printed success and review.removeFork answered true for a URL nobody had registered. It now returns ErrForkNotRegistered naming the URL; the CLI exits non-zero, RPC answers NOT_FOUND, and the TUI shows

A sibling edge inside core was reported and never failed, so a package importing one listed above it could return unnoticed. --check now reads the tier list from the stack sentence in documentation/ARCHITECTURE.md, so the doc stays the one source, and fails on an edge at or

The fourteen branches that landed on 2026-09-13 cut fifty-six Go comment blocks and seventy em-dashes without touching the baseline, so every count sat below its ceiling and the ratchet had nothing to bite on. Recorded here so the next rise fails the push again.

review.createPR validates subject alone: sent only a subject it returns a pull request with an empty base and head, so the "required" marking on both params was false. The doc now says what happens instead, that such a pull request cannot be merged, and a round-trip test holds

Nine destructive verbs run in one workspace: social retract, pm issue close, release retract, memo retract, review pr merge, review pr close, social list remove, social list delete and fork remove. Each is sent a wrong target first, which must be refused, and the real target

Every namespace beyond core now has a test that drives a real workspace and a temp cache through processRequest: a create, a read back, an error code the handler maps, and the JSON shape RPC.md documents. Coverage of library/rpc goes 25.2% to 37.1%.

Every route fits the narrow frame now, so LayoutProperties asserts width and height at all three sizes with no exception list. assertLineCount goes with it; assertFrameFits carries the line check.

A column was never narrower than 15 cells, so four columns plus their separators needed 69 of the 41 the content area has at 80 columns. The columns now share the width they are given, down to a floor of 4, and a cell and a header are cut by printable cells with TruncateToWidth

The wrapper padded the content to the frame height and then appended the footer, so a view whose content already filled the frame got the first footer line glued onto its last content row. At 80 columns the footer wraps to three or four lines, which made the row 149 cells wide

A detail view builds its title from a subject, an author, a time and a ref, each shortened on its own but never against the terminal. The top border then ran past the edge on every detail route.

renderFrame passed a content line through whenever it reached the inner width, a rule meant for the full-width footer bar, and padded shorter lines without checking that the padding still fit. A view that drew a row from a fixed column layout pushed the right border off the

LayoutProperties bounded the line count at each size and left the width to the golden routes, which render at 120x40, so nothing measured a narrow terminal. It now runs the escape-aware width and exact line-count check at every size.

The Long listed six inline prefixes where the parser reads nine, so repository, commit and list reached CLI.md but not the terminal. The help now carries all nine in the parser's order, and says that any other prefix searches as text.

The filter regexp took a run of non-space characters, and Go's \s class leaves out the vertical tab, so "repo:\v" carried a space into a filter value that strings.Fields later split again. Tokenizing with unicode.IsSpace gives the parser and the text search one idea of a space.

CLI.md listed six inline prefixes and the parser reads nine: repository, commit and list went undocumented. The table now carries all nine in the parser's order, and a test reads it back against filterPrefixes, the way the CLI and RPC conformance tests read their docs, so a

A token the parser did not recognise was dropped from the query and filled no field, so "state:open" narrowed nothing and said nothing. A colon is ordinary in prose, so a known prefix is the only thing that makes a token a filter.

Every padding, margin and gap that moved to its nearest step moved the computed value with it: 200 properties across the twenty baselines. The largest single move is 2.4px, a card's vertical padding at --pad-panel, under one step of the scale.

A scale nothing checks drifts back to literals one rule at a time. The token test now reads every padding, margin, gap and offset in both sheets and fails on a value that is not a step, zero, or a mark under 4px, the way it already holds url() and the shared breakpoint.

The two sheets carried 342 literal paddings, margins, gaps and offsets in 35 distinct values, clustered close enough that no two neighbours read apart. Six tokens replace them by nearest step, and the padding pairs are now built from those steps, so one edit moves a whole rhythm.

The external id was the discussion number and the comment's second, so two comments posted in one second collided on one mapping key and the second one was dropped on every re-import. The id is now the comment's databaseId, the number GitHub's own #discussioncomment- anchor

The discussions query already asked for author.name and the plan builder threw it away, so every distinct login cost one users/<login> call. The query now selects name and email together, and an author carrying both seeds the profile cache instead of a call.

The discussions query asked for no replies and ImportComment had no reply shape, so every threaded reply on a GitHub discussion was dropped. The query now selects each comment's replies and pages them, ImportComment carries the parent comment's external ID, and the social write

The CardList table omitted esc and the SectionList table omitted esc and the search keys, because they were handled inside Update where the generator could not see them. The generator keeps its own tables, so the two tables are edited there and TUI-KEYS.md is regenerated from

SectionList and CardList mapped the same keys and mouse events twice, so a new key had to be added in two places. One action set and one resolver now name the action, and each list applies it to its own scroll model. Link cycling, the focused link lookup and the click target

CardList and SectionList carry the same key and mouse map twice, and the shared map is about to replace it. These tests drive each key and mouse action through the real Update and assert the cursor, the offset and the focused link, so the refactor has something to hold it to.

The package sat at 5.0% coverage, so a change to a request path, a filter or a decode shape failed only at import time against a live GitLab. A fake API over httptest now drives every exported fetch through the BaseURL the CLI already passes. Coverage goes to 95.2%.

A bucket switched from etag mode to generation mode carries both keys for one ref, and nothing pinned which of the two the ref read resolves to.

Both local buckets reported every listing complete, so the loop that follows a continuation token ran against no fixture. A listing of more keys than one page now runs it.

locals3 and membucket are the fixtures the bucket tests run against, so a divergence from S3 hides a transport bug instead of catching it. The five audited ones are gone: a range past the object answers 416 with a Content-Range, suffix ranges serve the last bytes, listings

The exception line listed every package holding mutable package state except core/git, which keeps the executor seam SetExecutor swaps, the timeout SetTimeout sets and the memo of the s3 helper alias. The gap predates the push surfaces work; the two warn-once flags that branch

The three clients now resolve one remote list, so the docs that said "the remote" or described the CLI rule alone were behind. RPC.md carries the three new params and the result shape, TUI-KEYS.md a line on what p reaches, and the package table gains the client row PublishAll

The sequence has implemented these three since the site step landed, but core.push decoded neither them nor the fan-out, so an RPC client could not refresh a site, detach a thin bucket or preview a push, and it reached one remote where the CLI reached every configured one. The

The TUI pushed to the first remote and copied the resolver's ambiguity rule to decide whether to ask. It now resolves through client.ResolveRemotes, shows the picker only when the resolution is ambiguous, names every target in the confirm, and publishes through PublishAll. The

The fan-out loop lived in the CLI, so the TUI and RPC pushed to the first remote while the CLI pushed to every configured one. PublishAll runs Publish per remote in order, continues past a failure and returns the results beside one error naming the remotes that failed.

The resolver reported ambiguity and a stale configured name on stderr through two sync.Once flags, which the TUI and RPC never see and which the TUI worked around by copying the ambiguity rule. ResolvePushRemotes now returns the reason, PushRemote and PushRemotes read it, and

Of the 130 exports the package declared, 43 are now lowercase, so the package boundary names what the CLI, TUI, RPC, import, client and the four extensions call. A type stays exported when it appears in an exported signature or an exported struct field, even with no reference by

The same read-convert-sort tail stood in pm, review, release and memo, each filtering original_repo_url and original_hash through social_items_resolved. One social.GetComments joins social_items directly, and the four wrappers keep their names and their NOT_FOUND and

An item page's head changed markup: the subject moved into a card head as an h1.subject, the head chips moved out of the meta line into the head's own slot, and the meta line became a detail-meta row. Published pages carry the old shape, so every one has to regenerate.

The style suite saw the detail head only through .subject and .meta, so a head chip moving between them read as a baseline diff with no rule behind it.