Module downgrade 

The ledger of problems that did NOT block — the shadow-mode signal, kept instead of discarded.

crate::dispatch already detects the interesting event. Report.downgraded is every check that FAILED while the severity that applies said warn, and until this module existed the detection was followed by one line of output and nothing else:

! 1 check(s) reported a problem but are set to warn: pre-commit-ban-terms

That line is the whole evidence base for the question a team lead actually asks before adopting anything that can block a commit — will this annoy my team into switching it off? Turning every blocking check down to warn for a fortnight answers it exactly, and answered it into a scrollback buffer that nobody kept.

This module only counts. Nothing here participates in any verdict, and nothing ever may — the same rule crate::bypass states about itself, for the same reason: a wrong read in a gate weakens a gate, and a wrong read here miscounts a report.

The ledger is a local file, never a ref, never pushed, never sent anywhere — the project’s no-telemetry promise applies in full. It lives in the COMMON git dir because “what has this repository been warning about” is a question about the repository, not about one worktree. amont uninstall deletes it; so does amont.recordDowngrades false, prospectively.

A consequence worth stating rather than leaving to be discovered: this cannot aggregate across a team. Every developer’s ledger is their own machine’s. A lead runs the trial on their own checkout, or asks people to paste. That is a deliberate limit of the no-telemetry promise, not a gap.

Format, versioned like its siblings (amont-bypass-v1, amont-gate-v1):

amont-downgrade-v1
<unix-epoch> <head-oid> <check-id> <origin>

No paths ever appear in the file, which is why space delimiting is safe here where staged_only needed NUL.

Structs

CheckCount

One check’s slice of the ledger.

Ledger

What the ledger says, aggregated. Everything a reader displays comes through here; nobody re-parses the file.

Enums

Origin

Why the check did not block.

Constants

FORMAT

First line of the ledger. A future amont that changes the shape bumps this, and an old ledger reads as empty rather than being misread.

Functions

forget

uninstall: the ledger is OUR bookkeeping, gone with the hooks.

forget_in

The same, for a repository this process is not standing in — what the fleet needs, and it must resolve the path the way git would THERE.

parse

Aggregate a ledger’s text. Pure; a malformed line is skipped, never guessed at, and a missing or foreign header reads as an empty ledger.

read

The in-repo door: resolves the common dir itself (process cwd). Empty on any failure — amont list in a broken repo still prints.

read_at

The fleet’s door: read the ledger under an already-resolved common dir. Absent file, unreadable file, foreign format — all read as empty.