@mikitasazan/notify 1.11.1 → 1.12.1

package/README.md

@@ -158,6 +158,23 @@ notify report --project playhub --json < payload.json   # весь объект
 никогда, только новый тип события**. Тогда старый вызывающий код и новый
 пакет всегда совместимы.
 
+## Тег сменился 18.08.2026 у шести отправителей
+
+Коммит `85564fc` в mac-config дал явный `--key` шести местам вызова, которые
+раньше отправляли карточку БЕЗ ключа — тег брался из `--job`/`--title`
+автоматически (`slug()`, см. `src/render.ts`). Без этой таблицы старую
+красную карточку в Telegram не найти поиском по новому тегу — она там под
+старым.
+
+| Отправитель | Старый тег (авто из русского названия) | Новый тег (из `--key`) |
+|---|---|---|
+| `arvent-eval-report.sh`, отчёт по эвалу | `#eval_качество_ответов_бота` | `#arvent_eval` |
+| `arvent-eval-report.sh`, файл диалогов | нет — шёл мимо пакета, сырым `sendDocument` Bot API | `#arvent_eval_dialogues` |
+| `daily-digest.sh`, дайджест задач (`job`) | `#дайджест_задач` | `#daily_digest` |
+| `daily-digest.sh`, дайджест задач (`report`) | `#дайджест_задач` (то же слово, другой тип-тег: `#report` вместо `#job`) | `#daily_digest` |
+| `daily-digest.sh`, отключённые Actions | `#github_actions_выключены` | `#actions_off` |
+| `daily-digest.sh`, Config doctor | `#config_doctor` | `#config_doctor` — не изменился: `slug()` приводит и старое, и новое к одной строке |
+
 ## Чего в пакете нет и почему
 
 - Очереди, брокера, демона — десятки сообщений в день, ретрай в памяти

package/dist/cli-flags.js

@@ -11,7 +11,8 @@
 export const KNOWN_FLAGS = new Set([
     'action', 'actor', 'assignee', 'author', 'body', 'branch', 'commit',
     'id', 'opened', 'reason', 'workdir',
-    'command', 'command-note', 'commit-author', 'commit-body', 'commit-title', 'commit-url', 'detail',
+    'check', 'command', 'command-note', 'commit-author', 'commit-body', 'commit-title', 'commit-url',
+    'detail', 'detail-label',
     'expected', 'filename', 'item',
     'item-group', 'job', 'key', 'last-seen', 'line', 'logs', 'note',
     'aside', 'number', 'path', 'period', 'project', 'reviewer', 'stat', 'status',

package/dist/cli.js

@@ -24,7 +24,9 @@
 import { readFileSync } from 'node:fs';
 import { KNOWN_FLAGS } from "./cli-flags.js";
 import { render } from "./render.js";
+import { lintCard } from "./lint.js";
 import { notify } from "./send.js";
+import { ROUTES } from "./routes.js";
 import { setupTopic } from "./setup.js";
 const log = (msg) => console.error(`[notify] ${msg}`);
 /**
@@ -41,6 +43,23 @@ const log = (msg) => console.error(`[notify] ${msg}`);
 const safe = (v) => String(v ?? '').replace(/\b(sent|failed|skipped)\b/gi, (w) => `${w[0]}·${w.slice(1)}`);
 const args = process.argv.slice(2);
 const command = args[0];
+// `lint-text` and `routes` exist so the nightly audit asks the PACKAGE
+// instead of keeping its own copy of the rules and the routing table — the
+// copies had already drifted twice.
+if (command === 'lint-text') {
+    // The finished card HTML on stdin; every fault on stdout, one per line.
+    // Empty output means the card obeys the standard. Exit code stays 0 —
+    // the CLI-wide contract.
+    const text = readFileSync(0, 'utf-8').replace(/\n$/, '');
+    for (const fault of lintCard(text)) {
+        process.stdout.write(`${fault}\n`);
+    }
+    process.exit(0);
+}
+if (command === 'routes') {
+    process.stdout.write(`${JSON.stringify(ROUTES, null, 2)}\n`);
+    process.exit(0);
+}
 if (command === 'setup') {
     const [, chatId, projectKey] = args;
     if (!chatId || !projectKey) {
@@ -261,6 +280,8 @@ else {
                 command: one('command'),
                 commandNote: one('command-note'),
                 logs: one('logs'),
+                detail: one('detail'),
+                detailLabel: one('detail-label'),
                 workflowUrl: one('workflow-url'),
                 workflowName: one('workflow-name'),
                 url: one('url')
@@ -390,6 +411,9 @@ if (event) {
     // --path is applicable to any type too, for the same reason --key is.
     event.path = one('path') ?? event.path;
     event.filename = one('filename') ?? event.filename;
+    // --check applies to any type (rule S): the verification command for a
+    // card whose event has no canonical URL.
+    event.check = one('check') ?? event.check;
 }
 if (event?.filename && !event.path) {
     parseErrors.push('--filename: given without --path, so there is no file to name');

package/dist/events.d.ts

@@ -37,6 +37,18 @@ type Keyed = {
     path?: string;
     /** The file's name in the chat; defaults to the name from `path`. */
     filename?: string;
+    /**
+     * The verification command — `Check:` in the card's last block, monospaced
+     * and tap-to-copy. The standard (v2.1, rule S) wants every card to say
+     * where to verify it: a `Source:` link when the event has a canonical URL,
+     * this command when the event is local. Usually `config jobs --log <key>`.
+     */
+    check?: string;
+    /**
+     * Set by the send-side suppression, never by a caller: which day of the
+     * same unresolved failure this is. Renders as `Still red: day N`.
+     */
+    stillRed?: number;
 };
 /**
  * A list item inside a message: a task from a digest, a failed check, a
@@ -172,8 +184,20 @@ export type NotifyEvent = Keyed & (
      * A local log path — monospaced, not a link, same as on an incident.
      * It used to be glued onto the end of the reason sentence behind a
      * colon, which is what made a red card read as one long run-on line.
+     * Under rule S it is an ADDITION to `check`/a link, never the card's
+     * only pointer — a path cannot be tapped, only copied.
      */
     logs?: string;
+    /**
+     * A multi-line quoted block with its own caption (`detailLabel`) — the
+     * shape the watchdog uses to show the offending card's first lines
+     * under `Offender:`. Generic on purpose: any job with a verbatim
+     * excerpt to show (someone else's text, not the sender's own words)
+     * uses this instead of stuffing it into `note`.
+     */
+    detail?: string;
+    /** The caption over `detail`; defaults to `Detail`. */
+    detailLabel?: string;
     workflowUrl?: string;
     /** The run's name, for the link's visible text. Without it, the type line itself becomes the link. */
     workflowName?: string;

package/dist/lint.js

@@ -32,8 +32,12 @@ const NOT_A_NAME = new Set([
 ]);
 /** The five words the third tag is allowed to be, and there is no sixth. */
 const OUTCOMES = new Set(['ok', 'fail', 'off', 'unknown', 'info']);
-/** Labels the template retired. Each one used to say what a neighbour said. */
-const RETIRED = ['Title', 'Number', 'State', 'Via', 'Check', 'Logs', 'Task', 'Id', 'Period'];
+/**
+ * Labels the template retired. Each one used to say what a neighbour said.
+ * `Check` LEFT this list in v2.1: rule S brought it back as the standard
+ * verification-command row. `Logs` stays retired — the new spelling is `Log`.
+ */
+const RETIRED = ['Title', 'Number', 'State', 'Via', 'Logs', 'Task', 'Id', 'Period'];
 /**
  * Reads a finished card and returns what is wrong with it, in the owner's
  * terms. An empty array means the card obeys the standard.
@@ -45,8 +49,23 @@ export const lintCard = (html) => {
     if (tags.length !== 3 || !tags.every((t) => t.startsWith('#'))) {
         found.push(`line 1 is "${rows[0] ?? ''}" — it must be exactly three tags`);
     }
-    else if (!OUTCOMES.has(tags[2].slice(1))) {
-        found.push(`the outcome tag is "${tags[2]}" — the vocabulary is ok, fail, off, unknown, info`);
+    else {
+        if (!OUTCOMES.has(tags[2].slice(1))) {
+            found.push(`the outcome tag is "${tags[2]}" — the vocabulary is ok, fail, off, unknown, info`);
+        }
+        // The charset is checked HERE, not trusted to slug(): slug keeps any
+        // Unicode letter, so a Russian-named job produces a Cyrillic tag with no
+        // complaint anywhere — confirmed against render.ts on 31.08.2026.
+        for (const t of tags) {
+            if (!/^#[a-z0-9_]+$/.test(t)) {
+                found.push(`the tag "${t}" carries characters outside [a-z0-9_] — tags are English, lowercase`);
+            }
+        }
+        // A dated tag groups nothing: every day mints a new one and the filter
+        // the tags exist for never collects two cards.
+        if (/(_|^#)20\d{2}_\d{2}_\d{2}$/.test(tags[1]) || /_20\d{6}$/.test(tags[1])) {
+            found.push(`the instance tag "${tags[1]}" ends in a date — a dated tag groups nothing`);
+        }
     }
     if (tags[1] === '#' || tags[1] === '#_') {
         found.push('the instance tag is empty — it groups nothing and pairs with nothing');
@@ -98,17 +117,39 @@ export const lintCard = (html) => {
             break;
         }
     }
-    // A red card must say where to look. Here — and only here — that can be
-    // judged completely: a log row, a command to run, or any address at all,
-    // including the one riding on line 2 where the standard puts it. Read back
-    // from Telegram the addresses are gone, so the same rule there accused a
-    // deploy card whose own second line was the link to the failed run.
-    // `#fail` only. A task that has gone silent is `#unknown`, and it has no log
-    // by definition — it never ran. Demanding one there would be demanding a
-    // thing that cannot exist.
-    const broke = (rows[0] ?? '').includes('#fail');
-    if (broke && !html.includes('<b>Log:</b>') && !html.includes('<b>To do:</b>') && !html.includes('<a href=')) {
-        found.push('a red card with no log, no command and no link — nowhere to look');
+    // Rule L (v2.1): everything the SYSTEM says is English. Cyrillic is
+    // allowed only as QUOTED CONTENT — text that exists in Russian outside the
+    // card: a blockquote (commit bodies, issue bodies, an offender's lines),
+    // the text of a link (issue titles in digests), and the title slot on
+    // line 2. Everywhere else — a label, a bare field value, a tag, a command —
+    // it is system text and a fault.
+    const quotedStripped = html
+        .replace(/<blockquote[^>]*>[\s\S]*?<\/blockquote>/g, '')
+        .replace(/<a href="[^"]*">[^<]*<\/a>/g, '')
+        // A commit's title rides the `Commit:` row after the hash — it is a
+        // commit message, the canonical quoted content.
+        .replace(/^<b>Commit:<\/b>.*$/gm, '')
+        // List items carry content (issue titles in a digest, findings) — the
+        // row's own text is the subject's, not the system's.
+        .replace(/^(?:•|\d+\.) .*$/gm, '');
+    const strippedRows = quotedStripped.split('\n');
+    // Line 2's value after the label is the one non-quoted slot allowed to
+    // carry a title written in Russian (issue/PR/report/incident titles).
+    if (strippedRows[1]) {
+        strippedRows[1] = strippedRows[1].replace(/(<b>[^<]+:<\/b>|<b>[^<]+<\/b>).*/, '$1');
+    }
+    if (/[а-яё]/i.test(strippedRows.join('\n'))) {
+        found.push('Cyrillic outside quoted content — system text is English (rule L)');
+    }
+    // Rule S (v2.1): a card that reports trouble must say where to verify it —
+    // a `Check:` command, a `Source:` link, a `To do:` command, or any link at
+    // all. A `Log:` path alone is not enough: a path cannot be tapped, and a
+    // card whose only pointer needs a file manager is a card with no pointer.
+    // `#fail` and `#unknown` both: a silent task has no log, but `config jobs
+    // --log <key>` answers it too.
+    const broke = (rows[0] ?? '').includes('#fail') || (rows[0] ?? '').includes('#unknown');
+    if (broke && !html.includes('<b>Check:</b>') && !html.includes('<b>To do:</b>') && !html.includes('<a href=')) {
+        found.push('a trouble card with no check command and no link — nowhere to look (rule S)');
     }
     return found;
 };

package/dist/render.d.ts

@@ -36,7 +36,7 @@ export declare const esc: (v: unknown) => string;
  *    Telegram replies `400 can't parse entities`, and we treat a 4xx as a
  *    permanent error and do not retry — the message disappeared for good.
  */
-export declare const clampMessage: (text: string, limit?: number) => string;
+export declare const clampMessage: (text: string, limit?: number, marker?: string) => string;
 export declare const slug: (raw: string) => string;
 /**
  * The instance tag: exactly which concrete event this is (branch,
@@ -81,10 +81,13 @@ export declare const OUTCOME_TAG: Readonly<Record<Icon, OutcomeTag>>;
 export declare const outcomeTag: (e: NotifyEvent) => OutcomeTag;
 /**
  * Renders an event into finished HTML text, cut to Telegram's limit.
- * Tags are the FIRST line, added before the cut (not after, as before):
- * they carry both the human filter and the parser's machine key — a card
- * cut without them would be not only unclickable but invisible to the
- * parser on exactly the longest, meaning the most important, messages.
+ *
+ * Assembly is TAIL-FIRST (v2.1): the parts that must survive any cut — the
+ * tag line (the human filter and the parser's machine key), the pointer
+ * block (`Log`/`Check`/`Source`) and the cut marker — are measured before
+ * the body is clamped, and the body gets what is left. Under the old order
+ * the pointer was part of the body, so the longest cards lost exactly the
+ * line saying where to look.
  */
 export declare const render: (e: NotifyEvent) => string;
 export {};

package/dist/render.js

@@ -51,7 +51,7 @@ export const esc = (v) => String(v ?? '')
  *    Telegram replies `400 can't parse entities`, and we treat a 4xx as a
  *    permanent error and do not retry — the message disappeared for good.
  */
-export const clampMessage = (text, limit = 4000) => {
+export const clampMessage = (text, limit = 4000, marker = '…') => {
     if (text.length <= limit) {
         return text;
     }
@@ -108,7 +108,12 @@ export const clampMessage = (text, limit = 4000) => {
         .reverse()
         .map((t) => `</${t}>`)
         .join('');
-    return `${body}${tail}\n…`;
+    // The marker ANNOUNCES the cut instead of hiding it (v2.1): the caller
+    // reserves the marker's length out of `limit` before calling, so the
+    // marker itself can never be the thing that pushes the message over
+    // Telegram's hard cap — a free addition on top of 4000/4096 plus a long
+    // path was measured to earn a 400, and a 4xx is never retried.
+    return `${body}${tail}\n${marker}`;
 };
 // Only the first line: a field is single-line by contract (commit, branch,
 // author, a stat), not a place for a paragraph. A live case (18.08): a CI card
@@ -129,6 +134,21 @@ const firstLine = (value) => {
  * value serializes as `null`, not as a missing key.
  */
 const field = (label, value) => value === undefined || value === null || value === '' ? null : `<b>${esc(cap(label))}:</b> ${esc(firstLine(value))}`;
+/**
+ * A Reason-shaped field: one line stays an ordinary field, several lines
+ * become a captioned quote — NOTHING is cut to the first line any more.
+ * `field`'s silent `firstLine` on a multi-line reason was the v1 contract,
+ * and it gutted every card whose failure did not fit one line (scp retries,
+ * a three-line diagnosis): the owner saw `Connection timed…` and nothing
+ * else. Confirmed live on four cards in the 14-day sweep, fixed in v2.1.
+ */
+const reason = (label, value) => {
+    if (value === undefined || value === null || value === '') {
+        return null;
+    }
+    const text = String(value);
+    return text.includes('\n') ? quoted(label, text) : field(label, text);
+};
 /**
  * An identifier field (`commit:`/`pr:`/`issue:`): the value is a link if
  * one exists, otherwise the plain text of the same field — an identifier
@@ -483,15 +503,15 @@ const mechanism = (workflowName, via) => workflowName ?? via;
 // unlinked, because a hand deploy has no run to open.
 const renderDeploy = (e) => {
     const icon = iconFor(e);
-    const runUrl = e.workflowUrl ?? e.url;
     return join([
         // The name of what shipped the deploy sits on the type line, the outcome
         // in parens beside it — icon and tag alone were judged, live, not to be
         // enough: a plain 🔴 next to a workflow name still read as "something
         // happened," not "it failed," on a screen small enough to lose the color.
         // The `Via` row is gone: it used to carry this same name one floor below.
-        typeLine(icon, 'Deploy', mechanism(e.workflowName, e.via), runUrl, e.status === 'fail' ? 'Fail' : 'OK'),
-        ...twoBlocks([field('Target', e.target), field('Reason', e.note)], [
+        // The run URL is gone from this line too — it is the `Source:` row now.
+        typeLine(icon, 'Deploy', mechanism(e.workflowName, e.via), undefined, e.status === 'fail' ? 'Fail' : 'OK'),
+        ...twoBlocks([field('Target', e.target), reason('Reason', e.note), field('Still red', e.stillRed ? `day ${e.stillRed}` : null)], [
             commitRow(e.commit, e.commitUrl, e.commitTitle),
             fieldPerson('Author', e.commitAuthor),
             bodyQuote(e.commitBody)
@@ -517,27 +537,30 @@ const renderJob = (e) => {
     // icon says and what the third tag now says too. The icon table on the
     // catalogue page defines both marks.
     return join([
-        typeLine(icon, 'Job', e.job, e.workflowUrl ?? e.url, e.aside),
-        field('Reason', e.note),
+        // The URL moved off the type line into the `Source:` row of the pointer
+        // block (v2.1, rule S): the owner asked for a pointer he can SEE, and a
+        // link riding invisibly on the name is not one.
+        typeLine(icon, 'Job', e.job, undefined, e.aside),
+        reason('Reason', e.note),
+        field('Still red', e.stillRed ? `day ${e.stillRed}` : null),
         // The timetable is a different subject from this event: how often the task
         // owes a sign of life and when it last gave one. It stood in a bare run
         // under `Reason:` and read as more of the same. `Last run` when the task
         // is alive, `Last seen` when it is not — one timestamp, two questions.
         ...schedule(e.expected, e.lastSeen, e.status === 'silent' ? 'Last seen' : 'Last run'),
         ...labelled(e.stats),
+        e.detail ? '' : null,
+        quoted(e.detailLabel ?? 'Detail', e.detail),
         hasItems ? '' : null,
         // Heading ONLY for `disabled`. It used to print for any job carrying a
         // list, so playhub's daily card of newly published games was headed
         // "Disabled workflows".
         disabledList ? group('Disabled workflows') : null,
         ...(hasItems ? bullets(e.items, disabledList) : []),
-        e.command || e.logs ? '' : null,
-        fieldCode('Log', e.logs),
+        e.command ? '' : null,
         ...fieldRun(e.command, e.commandNote)
-        // No trailing `Workflow:` row. It pointed at `workflowUrl ?? url` — the
-        // exact address line 2 already carries — so it was one destination
-        // written twice, and it stood BELOW the `To do:` command, which is the
-        // last thing the card is supposed to say.
+        // `Log:` left this body for the pointer block that `render` appends to
+        // every card — the block a cut can never take.
     ]);
 };
 const renderReport = (e) => {
@@ -548,7 +571,7 @@ const renderReport = (e) => {
         // without a word.
         const numbers = labelled(e.lines);
         return join([
-            typeLine(iconFor(e), 'Report', e.title, e.url, e.aside),
+            typeLine(iconFor(e), 'Report', e.title, undefined, e.aside),
             // Rows with no group of their own sit flush against the header instead of
             // forming a separate slab under a blank line. `labelled` puts the blank
             // line before the first group itself, so there is none here.
@@ -559,9 +582,8 @@ const renderReport = (e) => {
     }
     const items = bullets(e.items, false);
     return join([
-        // Both analytics jobs send a link to the day's snapshot in docs/. It used to
-        // hang off a trailing `Details: open` row; now it is the report's own name.
-        typeLine(iconFor(e), 'Report', e.title, e.url, e.aside),
+        // The day's snapshot link is the `Source:` row now, same as every URL.
+        typeLine(iconFor(e), 'Report', e.title, undefined, e.aside),
         // Flush against the header — see the branch above.
         ...labelled(e.lines),
         items.length > 0 ? '' : null,
@@ -575,9 +597,9 @@ const renderReport = (e) => {
 // spoke (`nightly`, `Quality`) — but both are the name on the type line.
 const renderCi = (e) => {
     const icon = iconFor(e);
-    const runUrl = e.workflowUrl ?? e.url;
     return join([
-        typeLine(icon, 'CI', mechanism(e.workflowName, undefined), runUrl, e.status === 'fail' ? 'Fail' : 'OK'),
+        // The run URL is the `Source:` row now, not an invisible link on the name.
+        typeLine(icon, 'CI', mechanism(e.workflowName, undefined), undefined, e.status === 'fail' ? 'Fail' : 'OK'),
         // `Actor` used to be read as "who wrote the commit," and on most runs it
         // is — `github.actor` for a push IS the person who pushed. It stops being
         // that on a scheduled run: arvent's nightly rewrites it to whoever is on
@@ -585,7 +607,7 @@ const renderCi = (e) => {
         // author. So Actor answers "who is responsible for this run," `Author`
         // below the commit answers "who wrote this code" — two different people
         // on a nightly card, the same person everywhere else.
-        ...twoBlocks([field('Reason', e.note)], [
+        ...twoBlocks([reason('Reason', e.note), field('Still red', e.stillRed ? `day ${e.stillRed}` : null)], [
             fieldTelegram('Actor', e.actor),
             commitRow(e.commit, e.commitUrl, e.commitTitle),
             fieldPerson('Author', e.commitAuthor),
@@ -622,21 +644,24 @@ const opening = (action, body) => action === 'opened' || VERDICT.has(action) ? b
 // old order, title then Author then Assignee then finally the body — "why
 // does the assignee cut apart what should be inseparable?"
 const renderPr = (e) => join([
-    typeLine(iconFor(e), 'PR', named(e.number, e.title), e.url),
+    typeLine(iconFor(e), 'PR', named(e.number, e.title)),
     opening(e.action, e.body),
     (e.action === 'opened' || VERDICT.has(e.action)) && e.body ? '' : null,
     fieldPerson('Author', e.author),
     fieldPerson('Reviewer', e.reviewer)
 ]);
-// Unlike a PR, an issue's `body` means one thing on every action — its own
-// description, never someone else's verdict — so it prints whenever it is
-// there, not only on `opened`. The owner: hiding it on `assigned` read as
-// inconsistent with the same card type showing it moments earlier — his call
-// to keep, 26.08.2026, over the earlier "he already saw it" reasoning.
+// The issue's body prints ONLY on `opened` — the same law the PR card
+// follows. History of this line: hidden → shown everywhere (the owner's call
+// of 26.08.2026, "inconsistent with the same card showing it moments
+// earlier") → hidden again on 31.08.2026, when the owner, shown the live
+// duplicate ("the full body arrives a second time in one day"), delegated
+// the call ("сделай как лучше по оптимизации и простоте") and approved the
+// short assigned card in the v2.1 mockups. On assigned/closed the card is
+// the one new fact plus the `Source:` link to the full text.
 const renderIssue = (e) => join([
-    typeLine(iconFor(e), 'Issue', named(e.number, e.title), e.url),
-    bodyQuote(e.body),
-    e.body ? '' : null,
+    typeLine(iconFor(e), 'Issue', named(e.number, e.title)),
+    e.action === 'opened' ? bodyQuote(e.body) : null,
+    e.action === 'opened' && e.body ? '' : null,
     fieldPerson('Author', e.author),
     fieldPerson('Assignee', e.assignee)
 ]);
@@ -651,12 +676,12 @@ const renderIssue = (e) => join([
 const renderIncident = (e) => {
     const findings = bullets(e.items, false);
     return join([
-        typeLine(iconFor(e), 'Incident', e.title, e.url),
+        typeLine(iconFor(e), 'Incident', e.title),
         e.detail && e.detail !== e.title ? note(e.detail) : null,
+        field('Still red', e.stillRed ? `day ${e.stillRed}` : null),
         findings.length > 0 ? '' : null,
-        ...findings,
-        e.logs ? '' : null,
-        fieldCode('Log', e.logs)
+        ...findings
+        // `Log:` moved to the pointer block `render` appends — see renderJob.
     ]);
 };
 // A session in trouble. Same law as every other card: identifier first, then
@@ -673,7 +698,8 @@ const renderSession = (e) => join([
     // opened a block that had no heading. Facts about the session touch the
     // line that names it, the way they do on every job card.
     field('Project', e.workdir),
-    field('Reason', e.reason),
+    reason('Reason', e.reason),
+    field('Still red', e.stillRed ? `day ${e.stillRed}` : null),
     e.opened ? '' : null,
     quoted('Opened with', e.opened),
     e.command ? '' : null,
@@ -798,12 +824,62 @@ export const OUTCOME_TAG = {
 };
 export const outcomeTag = (e) => OUTCOME_TAG[iconFor(e)];
 const tagsLine = (e) => `#${TYPE_TAG[e.type]} #${esc(eventKey(e))} #${outcomeTag(e)}`;
+/**
+ * Rule S (v2.1): the card's last block says where to verify it. `Source:` is
+ * a hyperlink when the event has a canonical URL; `Check:` is a local
+ * command; `Log:` is a path and only ever an ADDITION — a path cannot be
+ * tapped, only copied. The link text is a short English noun naming what
+ * opens, never the click.
+ */
+const SOURCE_NAME = {
+    deploy: 'workflow run',
+    ci: 'workflow run',
+    job: 'workflow run',
+    report: 'report',
+    pr: 'pull request',
+    issue: 'issue',
+    incident: 'details',
+    session: 'details',
+    heartbeat_miss: 'details'
+};
+const sourceUrl = (e) => {
+    const wf = 'workflowUrl' in e ? e.workflowUrl : undefined;
+    const url = 'url' in e ? e.url : undefined;
+    return wf ?? url;
+};
+const pointerBlock = (e) => {
+    const url = sourceUrl(e);
+    const logs = 'logs' in e ? e.logs : undefined;
+    const rows = [
+        fieldCode('Log', logs),
+        fieldCode('Check', e.check),
+        url ? `<b>Source:</b> <a href="${esc(url)}">${esc(SOURCE_NAME[e.type] ?? 'source')}</a>` : null
+    ].filter((r) => r !== null);
+    return rows.length > 0 ? `\n\n${rows.join('\n')}` : '';
+};
+/**
+ * The line that stands in for what the cut removed. It rides INSIDE the
+ * budget (the caller subtracts its length before clamping), so announcing
+ * the cut can never itself overflow the limit — with an attachment the
+ * limit is 1024, and the old flat 40-character margin did not fit a marker
+ * plus a path.
+ */
+const cutMarker = (e) => {
+    if (e.path) {
+        return '⋯ cut, full text attached';
+    }
+    const logs = 'logs' in e ? e.logs : undefined;
+    return logs ? `⋯ cut, full: <code>${esc(logs)}</code>` : '⋯ cut';
+};
 /**
  * Renders an event into finished HTML text, cut to Telegram's limit.
- * Tags are the FIRST line, added before the cut (not after, as before):
- * they carry both the human filter and the parser's machine key — a card
- * cut without them would be not only unclickable but invisible to the
- * parser on exactly the longest, meaning the most important, messages.
+ *
+ * Assembly is TAIL-FIRST (v2.1): the parts that must survive any cut — the
+ * tag line (the human filter and the parser's machine key), the pointer
+ * block (`Log`/`Check`/`Source`) and the cut marker — are measured before
+ * the body is clamped, and the body gets what is left. Under the old order
+ * the pointer was part of the body, so the longest cards lost exactly the
+ * line saying where to look.
  */
 export const render = (e) => {
     const renderer = RENDERERS[e.type];
@@ -814,11 +890,14 @@ export const render = (e) => {
         throw new Error(`unknown event type: ${String(e.type)}`);
     }
     const tags = tagsLine(e);
-    // clampMessage can go past the passed limit for the tail of closing tags
-    // and the ellipsis — minus 40 leaves it that margin. Messages already have
-    // their own margin (4000 against Telegram's 4096); for a caption the 1024
-    // limit is the real one. A card with an attachment is a caption, so the
-    // budget is chosen by `path`.
-    const budget = Math.max(64, e.path ? 1024 - tags.length - 40 : 4000 - tags.length - 1);
-    return `${tags}\n${clampMessage(renderer(e), budget)}`;
+    const pointer = pointerBlock(e);
+    const marker = cutMarker(e);
+    // clampMessage can go past the passed limit for the tail of closing tags —
+    // minus 40 leaves it that margin. Messages already have their own margin
+    // (4000 against Telegram's 4096); for a caption the 1024 limit is the real
+    // one. A card with an attachment is a caption, so the budget is chosen by
+    // `path`.
+    const limit = e.path ? 1024 : 4000;
+    const budget = Math.max(64, limit - tags.length - pointer.length - marker.length - 42);
+    return `${tags}\n${clampMessage(renderer(e), budget, marker)}${pointer}`;
 };

package/dist/send.d.ts

@@ -1,3 +1,10 @@
 import type { NotifyEvent } from './events.ts';
 export type SendResult = 'sent' | 'skipped' | 'failed';
+/** Exported for tests only — the time is injectable so day counting is provable. */
+export declare const dedupe: (e: NotifyEvent, now?: number) => {
+    action: "send" | "suppress";
+    stillRed?: number;
+};
+/** Exported for tests: the watchdog's own card must provably pass the lint. */
+export declare const brokenCardEvent: (e: NotifyEvent, faults: string[], offenderHtml: string) => NotifyEvent;
 export declare const notify: (e: NotifyEvent) => Promise<SendResult>;

package/dist/send.js

@@ -15,9 +15,10 @@
  * allowed to bring down the deploy or the scheduled task that called it.
  */
 import { execFileSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
-import { basename } from 'node:path';
-import { render } from "./render.js";
+import { appendFileSync, mkdirSync, readFileSync, renameSync, rmdirSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, dirname, join } from 'node:path';
+import { eventKey, outcomeTag, render } from "./render.js";
 import { lintCard } from "./lint.js";
 import { ROUTES, targets } from "./routes.js";
 const log = (msg) => {
@@ -257,6 +258,99 @@ const sendFile = async (e) => {
     }
     return results.includes('sent') ? 'sent' : 'failed';
 };
+/**
+ * Repeat suppression (v2.1). A failure that is still the same failure does
+ * not resend every run: the first card goes out, repeats inside the window
+ * are swallowed, and past the window ONE card a day goes out carrying
+ * `Still red: day N`. A green outcome clears the record — without that, a
+ * new failure would inherit the old one's day counter and the recovery
+ * itself would never be told.
+ *
+ * The key is project + type + instance — DELIBERATELY no free text: both
+ * external reviews independently showed that normalizing prose (stripping
+ * digits, hexes, paths) merges different failures — "connect to host A" and
+ * "connect to host B" become one key and the second failure goes silent. A
+ * job that covers several targets owes each target its own `--key`.
+ *
+ * Every failure of the mechanism itself fails OPEN: a broken state file, a
+ * held lock, an unwritable directory all mean "send". A duplicate card is a
+ * small cost; a swallowed alarm is not.
+ */
+const WINDOW_MS = 20 * 3600_000;
+const DAY_MS = 24 * 3600_000;
+const statePath = () => process.env.NOTIFY_STATE?.trim() || join(homedir(), '.claude', '.runs', 'notify-sent.json');
+/** Exported for tests only — the time is injectable so day counting is provable. */
+export const dedupe = (e, now = Date.now()) => {
+    const file = statePath();
+    const lock = `${file}.lock`;
+    try {
+        mkdirSync(dirname(file), { recursive: true });
+        // The lock is a directory: mkdir is atomic on every filesystem this runs
+        // on. A held lock means another sender is mid-write — fail open.
+        mkdirSync(lock);
+    }
+    catch {
+        return { action: 'send' };
+    }
+    try {
+        let state = {};
+        try {
+            state = JSON.parse(readFileSync(file, 'utf-8'));
+        }
+        catch {
+            state = {}; // missing or broken JSON — start clean, never swallow
+        }
+        const key = `${String(e.project)}:${String(e.type)}:${eventKey(e)}`;
+        const rec = state[key];
+        const write = () => {
+            const tmp = `${file}.tmp`;
+            writeFileSync(tmp, JSON.stringify(state));
+            renameSync(tmp, file);
+        };
+        if (outcomeTag(e) !== 'fail') {
+            if (rec) {
+                delete state[key];
+                write();
+            }
+            return { action: 'send' };
+        }
+        if (!rec) {
+            state[key] = { first: new Date(now).toISOString(), last: new Date(now).toISOString(), count: 0 };
+            write();
+            return { action: 'send' };
+        }
+        const last = Date.parse(rec.last);
+        const first = Date.parse(rec.first);
+        if (Number.isNaN(last) || Number.isNaN(first)) {
+            delete state[key];
+            write();
+            return { action: 'send' };
+        }
+        if (now - last < WINDOW_MS) {
+            rec.count += 1;
+            write();
+            log(`suppressed: same failure "${key}" already reported ${rec.count} time(s) in the window`);
+            return { action: 'suppress' };
+        }
+        rec.last = new Date(now).toISOString();
+        write();
+        // Day 1 is the day the first card went out; the counter only appears
+        // from day 2 on — "Still red: day 1" would restate the card itself.
+        const day = Math.floor((now - first) / DAY_MS) + 1;
+        return { action: 'send', ...(day >= 2 ? { stillRed: day } : {}) };
+    }
+    catch {
+        return { action: 'send' };
+    }
+    finally {
+        try {
+            rmdirSync(lock);
+        }
+        catch {
+            // the lock directory is gone or never ours — nothing to release
+        }
+    }
+};
 /**
  * Sends the event to all of its targets (the project topic, plus
  * `incidents` if needed, plus the team chat). Targets are handled one after
@@ -281,6 +375,7 @@ const reportLostProject = async (project, kind) => {
         job: 'notify: an event was lost',
         status: 'fail',
         note: `project "${String(project)}" is not in ROUTES — event "${kind}" went nowhere`,
+        check: 'npx --yes @mikitasazan/notify routes --json',
         key: 'notify-unknown-project'
     };
     await deliver(targets(lost), render(lost)).catch(() => undefined);
@@ -290,21 +385,76 @@ const reportLostProject = async (project, kind) => {
  * worth losing over its own formatting — and the breach is raised as its own
  * red card, the way a lost project is.
  *
+ * The watchdog card names the offender: the first two content lines of the
+ * card it complains about, quoted verbatim under `Offender:` so the owner
+ * can find it in the feed. Its `Check:` is a real command (the mockups'
+ * `lint-text < card.txt` pointed at a file the owner does not have — a fake
+ * pointer is worse than none), and the offender's full text goes to the
+ * failure log the session start already reads.
+ *
  * `key` carries the type, so a renderer that starts producing broken deploy
- * cards raises one running complaint rather than a new one every hour.
- * Recursion is not possible: this card is not linted.
+ * cards raises one running complaint rather than a new one every hour — and
+ * the card passes through the same `dedupe` as any failure, so it cannot
+ * loop daily on one unfixed offender.
+ *
+ * The watchdog lints ITSELF (v2.1 — the v1 card failed its own lint and
+ * nothing noticed). If its own card is at fault it still goes out, and the
+ * breach lands in the failure log: silence is the one thing it may not do.
  */
-const reportBrokenCard = async (e, faults) => {
-    log(`card does not match the standard: ${faults.join('; ')}`);
-    const broken = {
+const failuresLog = () => process.env.NOTIFY_FAILLOG?.trim() || join(homedir(), '.claude', '.runs', 'notify-fail.failures.log');
+const journal = (line) => {
+    try {
+        const file = failuresLog();
+        mkdirSync(dirname(file), { recursive: true });
+        appendFileSync(file, `${new Date().toISOString()} ${line}\n`);
+    }
+    catch {
+        // the journal is best-effort: a card must never be lost to bookkeeping
+    }
+};
+/** Exported for tests: the watchdog's own card must provably pass the lint. */
+export const brokenCardEvent = (e, faults, offenderHtml) => {
+    const offender = offenderHtml
+        .split('\n')
+        .slice(1) // the tag line names nothing a human reads
+        .map((r) => r.replace(/<[^>]+>/g, '').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&').trim())
+        .filter((r) => r !== '')
+        .slice(0, 2)
+        .join('\n');
+    return {
         type: 'job',
         project: 'mac-config',
         job: 'notify: a card broke the standard',
         status: 'fail',
-        note: `${String(e.type)} card for ${String(e.project)}: ${faults.join('; ')}`,
+        // The faults go in the LIST, not in Reason: a fault message quotes the
+        // offending text verbatim ("the tag #аналитика carries…"), and quoted
+        // text inside a system field is exactly what rule L forbids — the
+        // watchdog was failing its own lint on any Russian-speaking offender
+        // (caught live by its own journal, 31.08.2026).
+        note: `a ${String(e.type)} card for ${String(e.project)} broke ${faults.length} rule(s)`,
+        items: faults.map((f) => ({ text: f, group: 'Faults' })),
+        detail: offender || undefined,
+        detailLabel: 'Offender',
+        check: 'config jobs --log notify-broken',
         key: `notify-broken-${String(e.type)}`
     };
-    await deliver(targets(broken), render(broken)).catch(() => undefined);
+};
+const reportBrokenCard = async (e, faults, offenderHtml) => {
+    log(`card does not match the standard: ${faults.join('; ')}`);
+    const broken = brokenCardEvent(e, faults, offenderHtml);
+    const dup = dedupe(broken);
+    if (dup.action === 'suppress') {
+        return;
+    }
+    if (dup.stillRed) {
+        broken.stillRed = dup.stillRed;
+    }
+    const html = render(broken);
+    const ownFaults = lintCard(html);
+    if (ownFaults.length > 0) {
+        journal(`notify-watchdog: own card failed lint: ${ownFaults.join('; ')}`);
+    }
+    await deliver(targets(broken), html).catch(() => undefined);
 };
 export const notify = async (e) => {
     // Object.hasOwn, not `in`: `in` walks the prototype chain, and
@@ -313,6 +463,17 @@ export const notify = async (e) => {
         await reportLostProject(e.project, String(e.type));
         return 'skipped';
     }
+    // The same unresolved failure does not resend: the window swallows it, one
+    // card a day carries `Still red: day N`. Suppression reports 'sent' to the
+    // caller — the words sent/failed/skipped are a watchdog contract about the
+    // delivery PIPELINE, and a deliberate swallow is the pipeline working.
+    const dup = dedupe(e);
+    if (dup.action === 'suppress') {
+        return 'sent';
+    }
+    if (dup.stillRed) {
+        e.stillRed = dup.stillRed;
+    }
     // A card with a file becomes the caption of that file — one card, not two.
     if (e.path) {
         return sendFile(e);
@@ -323,7 +484,7 @@ export const notify = async (e) => {
     const result = await deliver(targets(e), html);
     const faults = lintCard(html);
     if (faults.length > 0) {
-        await reportBrokenCard(e, faults);
+        await reportBrokenCard(e, faults, html);
     }
     return result;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikitasazan/notify",
-  "version": "1.11.1",
+  "version": "1.12.1",
   "description": "Единая типизированная отправка Telegram-уведомлений (форум-темы, маршрутизация, ретраи) для всех проектов",
   "type": "module",
   "license": "MIT",