agent-dealer 1.2.3 → 1.2.5

package/bundle/server/dist/adapters/agent-health.js

@@ -4,6 +4,7 @@ import { CODEX_AUTH_REMEDIATION, MUSE_AUTH_REMEDIATION, cursorAuthIssueFromOutpu
 import { claudeBinExists, cursorBinExists, resolveClaudeBin, cursorInvokeArgs, resolveCursorBin, resolveCodexBin, codexBinExists, resolveMuseBin, museBinExists, resolveMuseAuthFile, MUSE_CLI_ENV, } from "../cli-env.js";
 import { checkAgentDeckHealth, checkAgentDeckMcpRegistration, fetchDecks, } from "./agent-deck.js";
 import { runtimeAvailability } from "../repository/runtime-availability.js";
+import { museCapabilityCheckInFlight, museCapabilityIssues, museCapabilitySettleCount, parseMuseVersion, resetMuseCapabilityStateForTests, } from "./muse-capability.js";
 const RUNTIME_LABEL = {
     claude_code: "Claude",
     cursor_local: "Cursor",
@@ -112,6 +113,7 @@ export function clearAgentHealthCaches() {
     githubIssueCache = null;
     cursorSoftFailStreak = 0;
     cursorLastHealthyAt = null;
+    resetMuseCapabilityStateForTests();
 }
 function isSoftCursorProbeIssue(issue) {
     return (issue.code === "runtime_auth" &&
@@ -195,6 +197,11 @@ async function cursorRuntimeIssues() {
  * billed `muse exec`, so a *present* but expired login is not detectable here — it surfaces at
  * the first run, which the same classifier reads from stderr. `auth.json` is tested for
  * existence only, never read.
+ *
+ * NOT-277: with CLI and credentials present, the reported version is handed to the capability
+ * check — a version not yet checked runs one real developer-shell probe (muse-capability.ts);
+ * `runtime_capability` blocks while it runs, when it finds shell/write missing, or when it could
+ * not complete.
  */
 async function museRuntimeIssues() {
     const bin = resolveMuseBin();
@@ -224,7 +231,17 @@ async function museRuntimeIssues() {
     if (!process.env.META_API_KEY && !fs.existsSync(resolveMuseAuthFile())) {
         return [{ code: "runtime_auth", message: MUSE_AUTH_REMEDIATION }];
     }
-    return [];
+    const version = parseMuseVersion(ver.output);
+    if (!version) {
+        return [
+            {
+                code: "runtime_unknown",
+                message: "Could not determine Muse Code health — `muse --version` printed no version",
+            },
+        ];
+    }
+    // A settled check drops the cached result so admission sees it on its next health read.
+    return museCapabilityIssues(version, () => runtimeIssueCache.delete("muse_code"));
 }
 /** Exported for direct testing — bypasses the 60s cache in runtimeIssues(). */
 export async function runtimeIssuesUncached(runtime) {
@@ -427,12 +444,18 @@ async function runtimeIssues(runtime) {
     if (cached && Date.now() - cached.at < ttl) {
         return [...capIssues, ...cached.issues];
     }
+    const museSettles = museCapabilitySettleCount();
     const issues = await runtimeIssuesUncached(runtime);
     const nonCap = issues.filter((i) => i.code !== "usage_capped");
+    // NOT-277: a capability check that settled during this read already superseded what it returned.
+    if (runtime === "muse_code" && museCapabilitySettleCount() !== museSettles) {
+        return runtimeIssues(runtime);
+    }
     // Soft fail (published or grace-held) uses a short TTL so a wake retry can clear quickly;
     // a sticky 60s cache of "Could not confirm" is what parked the queue after sleep (NOT-157).
     const softProbeFailure = nonCap.some(isSoftCursorProbeIssue) ||
-        (runtime === "cursor_local" && cursorSoftFailStreak > 0);
+        (runtime === "cursor_local" && cursorSoftFailStreak > 0) ||
+        (runtime === "muse_code" && museCapabilityCheckInFlight());
     runtimeIssueCache.set(runtime, { at: Date.now(), issues: nonCap, softProbeFailure });
     return [...capIssues, ...nonCap];
 }

package/bundle/server/dist/adapters/agent-health.test.js

@@ -16,7 +16,10 @@ process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-ag
 const { migrate, getDb } = await import("../db/index.js");
 const { createAgent, getAgent } = await import("../repository/agents.js");
 const { healthForAgent, runtimeIssuesUncached, githubIssuesUncached, githubIssuesSync, classifyGithubAuthStatus, clearAgentHealthCaches, setCursorProbeTimingForTests, setRunCommandForTests, } = await import("./agent-health.js");
+const { setMuseCapabilityProbeForTests, settleMuseCapabilityCheckForTests } = await import("./muse-capability.js");
 migrate();
+// NOT-277: health never runs the real (billed) Muse capability probe in tests.
+setMuseCapabilityProbeForTests(async () => ({ status: "capable" }));
 const FAILURE = { ok: false, code: "DECK_UNAVAILABLE", message: "Agent Deck API error: 502" };
 /** Tests inject an empty github list so host `gh auth` does not pollute assertions. */
 const NO_GITHUB = [];
@@ -414,8 +417,14 @@ The keychain item is stuck. Delete it and sign in again:
         const withLogin = emptyConfigHome();
         fs.mkdirSync(path.join(withLogin, "muse"));
         fs.writeFileSync(path.join(withLogin, "muse", "auth.json"), "{}");
-        assert.deepEqual(await withMuseEnv({ MUSE_CLI: stub.bin, configHome: withLogin }, () => runtimeIssuesUncached("muse_code")), []);
-        assert.deepEqual(await withMuseEnv({ MUSE_CLI: stub.bin, META_API_KEY: "k", configHome: emptyConfigHome() }, () => runtimeIssuesUncached("muse_code")), []);
+        // NOT-277: the first read of a version starts its one-time capability check; healthy once settled.
+        const settledIssues = async () => {
+            await runtimeIssuesUncached("muse_code");
+            await settleMuseCapabilityCheckForTests();
+            return runtimeIssuesUncached("muse_code");
+        };
+        assert.deepEqual(await withMuseEnv({ MUSE_CLI: stub.bin, configHome: withLogin }, settledIssues), []);
+        assert.deepEqual(await withMuseEnv({ MUSE_CLI: stub.bin, META_API_KEY: "k", configHome: emptyConfigHome() }, settledIssues), []);
     });
     test("muse probes run with MUSE_NO_AUTO_UPDATE=1 so the launcher cannot swap the pinned version", async () => {
         const stub = stubMuse("echo 'Muse Code 1.3.0 (1.3.0-R3401.1)'");
@@ -442,6 +451,50 @@ The keychain item is stuck. Delete it and sign in again:
             setCursorProbeTimingForTests(null);
         }
     });
+    // NOT-277: through the cached health path the agent list / admission read — a Muse auto-update
+    // fires the capability check exactly once for the new version, and the result (not a generic
+    // symptom) is what the unhealthy agent shows.
+    test("a Muse version change is capability-checked once and its named result surfaces on the agent", async () => {
+        const OLD = "1.3.0-R3401.1";
+        const NEW = "1.4.0-R4161.1";
+        const versionFile = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "dealer-muse-ver-")), "v");
+        fs.writeFileSync(versionFile, `Muse Code 1.3.0 (${OLD})\n`);
+        const stub = stubMuse(`cat ${JSON.stringify(versionFile)}`);
+        const calls = [];
+        setMuseCapabilityProbeForTests(async (version) => {
+            calls.push(version);
+            return version === OLD
+                ? { status: "capable" }
+                : { status: "missing", detail: "probe session completed without running its shell command" };
+        });
+        const agent = createAgent({ name: "muse-updated", runtime: "muse_code", deckId: randomUUID() });
+        const health = () => healthForAgent(agent, true, undefined, true, null, NO_GITHUB);
+        try {
+            await withMuseEnv({ MUSE_CLI: stub.bin, META_API_KEY: "k", configHome: emptyConfigHome() }, async () => {
+                // The stub probe settles within this read; the health read must not cache its stale
+                // "verifying" block (the in-flight block itself is covered in muse-capability.test.ts).
+                await health();
+                await settleMuseCapabilityCheckForTests();
+                for (let i = 0; i < 3; i++)
+                    assert.deepEqual((await health()).issues, []);
+                assert.deepEqual(calls, [OLD]);
+                // Muse auto-updates. The 60s runtime cache notices on its next miss.
+                fs.writeFileSync(versionFile, `Muse Code 1.4.0 (${NEW})\n`);
+                await runtimeIssuesUncached("muse_code");
+                await settleMuseCapabilityCheckForTests();
+                for (let i = 0; i < 3; i++) {
+                    const after = await health();
+                    assert.equal(after.healthy, false);
+                    assert.deepEqual(after.issues.map((x) => x.code), ["runtime_capability"]);
+                    assert.match(after.issues[0].message, new RegExp(`Muse Code updated ${OLD} → ${NEW}: developer sessions no longer get shell/write access`));
+                }
+                assert.deepEqual(calls, [OLD, NEW]);
+            });
+        }
+        finally {
+            setMuseCapabilityProbeForTests(async () => ({ status: "capable" }));
+        }
+    });
     test("claude MCP endpoint mismatch surfaces a distinct message, not the generic setup hint", async () => {
         const agent = createAgent({
             name: "claude-mcp-mismatch",

package/bundle/server/dist/adapters/github.js

@@ -70,8 +70,23 @@ export const CHECKS_FAILURE_GENERIC_REASON = "Developer's PR checks failed.";
 export const CHECKS_EVIDENCE_MAX_FAILED_CHECKS = 10;
 /** Max distinct Actions runs whose logs are fetched (one `gh run view` per run). */
 export const CHECKS_EVIDENCE_MAX_RUNS = 5;
-/** Per-run cap on fetched log text before excerpt focusing (tail kept — failures surface last). */
-export const CHECKS_EVIDENCE_MAX_LOG_CHARS_PER_RUN = 20_000;
+/**
+ * NOT-276: raw per-run ceiling (2MB) on fetched log text actually held in
+ * memory — purely a guard against pathologically huge logs, NOT a "search only
+ * the tail" window. `fetchChecksFailureEvidence` passes everything under this
+ * ceiling untruncated into `buildFailureExcerpt`, whose failure-pattern search
+ * plus the per-excerpt line/char caps already bound the output.
+ */
+export const CHECKS_EVIDENCE_MAX_RAW_LOG_CHARS_PER_RUN = 2_000_000;
+/**
+ * NOT-276 round 3: explicit `maxBuffer` (bytes) for the `gh run view --log-failed`
+ * fetch. Node's `execFile` defaults to ~1 MiB, which would reject any log over
+ * that size with ERR_CHILD_PROCESS_STDIO_MAXBUFFER before the 2MB raw-log
+ * ceiling above ever applies. This buffer sits above the ceiling (plus headroom
+ * for stderr bytes and multi-byte chars) so the ceiling — not the process
+ * buffer — is what bounds memory.
+ */
+export const CHECKS_EVIDENCE_GH_LOG_MAX_BUFFER = 4_000_000;
 /** Single global cap on the focused excerpt threaded into the retry prompt. */
 export const CHECKS_EVIDENCE_MAX_EXCERPT_CHARS = 4_000;
 /** Max lines in the focused excerpt; context lines kept around each failure line. */
@@ -148,11 +163,35 @@ export function sanitizeCiText(text) {
     return out;
 }
 const FAILURE_LINE_PATTERN = /error|err!|e404|fail|fatal|exception|traceback|assert|not found|cannot |can't |unable |conflict|reject|denied|panic|timed?\s*out|npm ERR!/i;
+/**
+ * Explicit failure markers, not just failure-adjacent vocabulary: TAP's own `not ok`
+ * result line (the TAP spec's standard fail marker, used by many test harnesses beyond
+ * `node:test` — not a runner-specific parser) and GitHub Actions' own `##[error]`
+ * workflow-command annotation (emitted by the platform itself for a genuinely failed
+ * step, regardless of what tool ran in it). A coordinator/CI-tooling repo's own test
+ * suite is full of passing tests *about* failure handling — "conflict", "timeout",
+ * "denied", "escalates" — so `FAILURE_LINE_PATTERN` density alone is not reliable
+ * (NOT-276 round 3: verified against the real run-36330128633 log, a cluster of
+ * passing tests named around escalation/conflict/timeout out-ranked the actual
+ * `not ok 355`/`356` failure under pure density ranking). These two markers get a
+ * large ranking bonus below so a window that contains one always wins.
+ */
+// Not anchored to line start: `gh run view --log-failed` prefixes every line with
+// `<job>\t<step>\t<timestamp> ` before the actual tool output, so the TAP/annotation
+// text never starts at column 0.
+const STRONG_FAILURE_LINE_PATTERN = /\bnot ok\b|##\[error\]/i;
+const STRONG_HIT_WEIGHT = 1000;
 /**
  * Focus a (sanitized) log around its useful failure/error lines: keep a small context
- * window around each matching line, merge overlapping windows, collapse long runs of
- * identical lines (CI setup spam), then enforce the global line/char caps. With no
- * matching line, the tail is the most likely failure site. Never returns unsanitized text.
+ * window around each matching line, merge overlapping windows, rank merged regions by
+ * weighted hit density (explicit failure markers far outweigh failure-adjacent
+ * vocabulary; ties break on density, then log order) so an early real failure cluster
+ * is not crowded out of the line budget by sparse isolated mentions in passing-test
+ * names, or by a *dense* but merely topical cluster of passing tests about failure
+ * handling itself (NOT-276 round 2 found the former, round 3 the latter — see
+ * `STRONG_FAILURE_LINE_PATTERN`'s comment), then collapse long runs of identical lines
+ * (CI setup spam) and enforce the global line/char caps. With no matching line, the
+ * tail is the most likely failure site. Never returns unsanitized text.
  */
 export function buildFailureExcerpt(combinedLog) {
     const sanitized = sanitizeCiText(combinedLog);
@@ -160,9 +199,14 @@ export function buildFailureExcerpt(combinedLog) {
     if (lines.every((l) => !l.trim()))
         return { excerpt: "", truncated: false };
     const hits = [];
+    const strongHits = new Set();
     lines.forEach((line, i) => {
-        if (FAILURE_LINE_PATTERN.test(line))
+        const strong = STRONG_FAILURE_LINE_PATTERN.test(line);
+        if (strong || FAILURE_LINE_PATTERN.test(line)) {
             hits.push(i);
+            if (strong)
+                strongHits.add(i);
+        }
     });
     let selected;
     let truncated = false;
@@ -180,8 +224,54 @@ export function buildFailureExcerpt(combinedLog) {
             else
                 merged.push([w[0], w[1]]);
         }
+        // Rank merged regions by weighted hit density so the excerpt budget goes to the
+        // most failure-indicative clusters first: an explicit failure marker (`not ok`,
+        // `##[error]`) counts for STRONG_HIT_WEIGHT, everything else for 1 — a window
+        // with one real marker always outranks a window with many topical-only hits.
+        // Ties keep log order, and output is re-sorted to log order for readability.
+        // `hits` is ascending (built in line order) and `merged` is ascending by `from`,
+        // so a single linear pass sums weight per region.
+        let hi = 0;
+        const ranked = merged.map(([from, to]) => {
+            while (hi < hits.length && hits[hi] < from)
+                hi++;
+            let weight = 0;
+            let k = hi;
+            while (k < hits.length && hits[k] <= to) {
+                weight += strongHits.has(hits[k]) ? STRONG_HIT_WEIGHT : 1;
+                k++;
+            }
+            return { from, to, weight };
+        });
+        ranked.sort((a, b) => b.weight - a.weight || a.from - b.from);
+        const taken = [];
+        let used = 0;
+        let usedChars = 0;
+        for (const w of ranked) {
+            const size = w.to - w.from + 1 + (taken.length > 0 ? 1 : 0);
+            let chars = taken.length > 0 ? 3 : 0; // "...\n" separator
+            for (let i = w.from; i <= w.to; i++)
+                chars += lines[i].length + 1;
+            // Skip regions that no longer fit — by line count or by character count, since
+            // the final excerpt is char-capped too (NOT-276 round 3: a lower-ranked but
+            // verbose region taken first would otherwise still crowd a higher-ranked
+            // region's content out of the *character* budget after chronological
+            // reassembly below, even though ranking correctly gave the real failure
+            // priority for line-budget inclusion). A smaller later region can still fill
+            // whatever budget remains — but always take the top-ranked region even if it
+            // alone exceeds either budget (the caps below truncate it, as before).
+            if (taken.length > 0 &&
+                (used + size > CHECKS_EVIDENCE_MAX_EXCERPT_LINES || usedChars + chars > CHECKS_EVIDENCE_MAX_EXCERPT_CHARS)) {
+                truncated = true;
+                continue;
+            }
+            taken.push([w.from, w.to]);
+            used += size;
+            usedChars += chars;
+        }
+        taken.sort((a, b) => a[0] - b[0]);
         const picked = [];
-        merged.forEach(([from, to], idx) => {
+        taken.forEach(([from, to], idx) => {
             if (idx > 0)
                 picked.push("...");
             for (let i = from; i <= to; i++)
@@ -241,7 +331,7 @@ export function formatChecksFailureDetails(opts) {
     return parts.join("\n");
 }
 const NO_COMMITS_PATTERN = /no commits between/i;
-const defaultExec = (args, opts) => run("gh", args, opts);
+const defaultExec = (args, opts) => run("gh", args, { cwd: opts.cwd, maxBuffer: opts.maxBuffer });
 async function ghPrView(exec, cwd, fields, selector) {
     const args = ["pr", "view", ...(selector != null ? [selector] : []), "--json", fields];
     try {
@@ -354,11 +444,19 @@ export async function fetchChecksFailureEvidence(exec, opts) {
     let logsUnavailable = false;
     for (const runId of runIds) {
         try {
-            const { stdout } = await exec(["run", "view", runId, "--log-failed"], { cwd: opts.cwd });
-            const tail = stdout.length > CHECKS_EVIDENCE_MAX_LOG_CHARS_PER_RUN
-                ? stdout.slice(-CHECKS_EVIDENCE_MAX_LOG_CHARS_PER_RUN)
+            const { stdout } = await exec(["run", "view", runId, "--log-failed"], {
+                cwd: opts.cwd,
+                maxBuffer: CHECKS_EVIDENCE_GH_LOG_MAX_BUFFER,
+            });
+            // NOT-276: search before truncating — the full fetched log feeds
+            // `buildFailureExcerpt`'s failure-pattern search, so an early failure is
+            // never discarded by a small tail window. Only logs beyond the raw memory
+            // ceiling are cut at all (tail kept), and the excerpt caps still bound
+            // the final output.
+            const full = stdout.length > CHECKS_EVIDENCE_MAX_RAW_LOG_CHARS_PER_RUN
+                ? stdout.slice(-CHECKS_EVIDENCE_MAX_RAW_LOG_CHARS_PER_RUN)
                 : stdout;
-            logsByRun.set(runId, tail);
+            logsByRun.set(runId, full);
         }
         catch {
             logsUnavailable = true;

package/bundle/server/dist/adapters/github.test.js

@@ -1,7 +1,7 @@
 // packages/server/src/adapters/github.test.ts
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { parsePrView, summarizeChecks, pollPrChecks, createGithubAdapter, fetchChecksFailureEvidence, sanitizeCiText, sanitizeUrl, extractActionsRunId, buildFailureExcerpt, formatChecksFailureDetails, CHECKS_EVIDENCE_MAX_EXCERPT_CHARS, CHECKS_FAILURE_GENERIC_REASON, PR_VIEW_FIELDS, } from "./github.js";
+import { parsePrView, summarizeChecks, pollPrChecks, createGithubAdapter, fetchChecksFailureEvidence, sanitizeCiText, sanitizeUrl, extractActionsRunId, buildFailureExcerpt, formatChecksFailureDetails, CHECKS_EVIDENCE_MAX_EXCERPT_CHARS, CHECKS_EVIDENCE_MAX_EXCERPT_LINES, CHECKS_EVIDENCE_MAX_RAW_LOG_CHARS_PER_RUN, CHECKS_EVIDENCE_GH_LOG_MAX_BUFFER, CHECKS_FAILURE_GENERIC_REASON, PR_VIEW_FIELDS, } from "./github.js";
 test("parsePrView extracts the ground-truth handoff fields, including draft status", () => {
     const view = parsePrView(JSON.stringify({
         number: 7,
@@ -34,15 +34,17 @@ test("summarizeChecks accepts neutral/skipped as success but fails closed on an
 /** Records every `gh` invocation and returns responses off a queue — never calls real `gh`. */
 function queuedExec(responses) {
     const calls = [];
+    const execOpts = [];
     const queue = [...responses];
-    const exec = async (args) => {
+    const exec = async (args, opts) => {
         calls.push(args);
+        execOpts.push(opts);
         const next = queue.shift() ?? { stdout: "" };
         if (next.error != null)
             throw Object.assign(new Error(next.error), { stderr: next.error });
         return { stdout: next.stdout ?? "" };
     };
-    return { exec, calls };
+    return { exec, calls, execOpts };
 }
 test("viewPr looks up the PR explicitly by branch, never a bare `gh pr view`", async () => {
     const { exec, calls } = queuedExec([
@@ -426,6 +428,275 @@ test("NOT-252: extractActionsRunId and sanitizeUrl helpers", async () => {
     assert.equal(sanitizeUrl("https://example.com/a?b=1#c"), "https://example.com/a");
     assert.equal(sanitizeUrl("https://example.com/a"), "https://example.com/a");
 });
+// --- NOT-276: search-before-truncate — an early failure must survive excerpt building ---
+// Replays the NOT-273 incident shape (Actions run 36330128633 "Unit tests" step):
+// 1667 TAP lines, `not ok 355/356` + `cancelledByParent` at ~21% through the log,
+// followed by ~1300 passing-test lines. Under the old last-20K-chars pre-truncation
+// the failure sat outside the kept tail and the excerpt showed only passing
+// tail noise; with search-before-truncate it must surface the failure instead.
+// Faithful-scale substitute for the real `gh run view 36330128633 --log-failed`
+// replay (no network/gh in this sandbox — the PR description must still record a
+// replay against the saved real "Unit tests" log showing `not ok 355`/`356`).
+// Crucially, ~21 passing lines BEFORE the failure carry realistic
+// failure-pattern words in their test names (real TAP `ok` lines do this — e.g.
+// "handles error ..."), spaced >13 lines apart so each is an isolated hit region:
+// without hit-density ranking, those early weak hits fill the 80-line budget
+// ahead of the real failure cluster (round-2 blocking finding). The dense
+// failure block (failureType x2 + error: x1 within 9 lines) must outrank them.
+test("NOT-276: failure line before the last 20K chars still reaches the excerpt", async () => {
+    const early = [];
+    for (let n = 1; n <= 354; n++) {
+        // Isolated pattern hits every 16 lines (> 2x the 6-line context radius, so
+        // windows never merge): ~22 weak hits precede the real failure.
+        if (n % 16 === 0)
+            early.push(`ok ${n} - handles error output for test ${n}`);
+        else if (n === 353)
+            early.push("ok 353 - reports error when child fails to spawn");
+        else if (n === 354)
+            early.push("ok 354 - cleans up after failure");
+        else
+            early.push(`ok ${n} - passing test number ${n}`);
+    }
+    const failureBlock = [
+        "not ok 355 - coordinator spawns child with explicit cwd",
+        "  ---",
+        "  failureType: 'cancelledByParent'",
+        "  error: test cancelled by parent",
+        "  ---",
+        "not ok 356 - coordinator spawns child with explicit cwd (2)",
+        "  ---",
+        "  failureType: 'cancelledByParent'",
+        "  ---",
+    ].join("\n");
+    const filler = Array.from({ length: 1667 - 356 }, (_, i) => {
+        const n = 357 + i;
+        if (i % 200 === 0)
+            return `ok ${n} - handles error output for test ${n}`;
+        if (i % 150 === 0)
+            return `ok ${n} - cleans up after failure ${n}`;
+        return `ok ${n} - passing test number ${n}`;
+    }).join("\n");
+    const log = `${early.join("\n")}\n${failureBlock}\n${filler}`;
+    // Guard the test's premise: the failure really does sit outside the old 20K tail window.
+    assert.ok(log.indexOf("not ok 355") < log.length - 20_000);
+    const { exec } = queuedExec([
+        { stdout: prViewWithRollup([actionsCheck("verify", "FAILURE", "36330128633")]) },
+        { stdout: log },
+    ]);
+    const evidence = await fetchChecksFailureEvidence(exec, { cwd: "/repo", number: 160, expectedHeadSha: HEAD_SHA });
+    assert.ok(evidence);
+    assert.match(evidence.excerpt, /not ok 355/);
+    assert.match(evidence.excerpt, /not ok 356/);
+    assert.match(evidence.excerpt, /cancelledByParent/);
+    assert.doesNotMatch(evidence.excerpt, /passing test number 1667/);
+    assert.ok(evidence.excerpt.length <= CHECKS_EVIDENCE_MAX_EXCERPT_CHARS);
+    assert.ok(evidence.excerpt.split("\n").length <= CHECKS_EVIDENCE_MAX_EXCERPT_LINES);
+});
+// NOT-276 round-2 replay stand-in (blocking finding: the real `gh run view
+// 36330128633 --log-failed` replay needs network/gh, unavailable in CI/sandbox,
+// so this mirrors its exact byte shape at faithful scale instead): every line
+// carries the real `<job>\t<step>\t<timestamp> ` prefix, 1667 TAP results with
+// `not ok 355`/`356` + `cancelledByParent` at ~21% through, ~24 passing lines
+// before the failure carrying failure-pattern words in their names, >20K
+// chars of passing-test tail after it, and the node:test TAP summary block at
+// the true end of the log (the root-cause mechanism: node:test runs to
+// completion, so `# fail 2` — a weak tail hit — sits after thousands of passing
+// lines). The excerpt must surface the early strong failure, not the tail.
+test("NOT-276 round-2 replay: full-scale Actions-prefixed log with an early `not ok` failure", async () => {
+    const bodies = [];
+    for (let n = 1; n <= 354; n++) {
+        if (n % 16 === 0)
+            bodies.push(`ok ${n} - handles error output for test ${n}`);
+        else if (n === 353)
+            bodies.push("ok 353 - reports error when child fails to spawn");
+        else if (n === 354)
+            bodies.push("ok 354 - cleans up after failure");
+        else
+            bodies.push(`ok ${n} - passing test number ${n}`);
+    }
+    bodies.push("not ok 355 - coordinator spawns child with explicit cwd", "  ---", "  failureType: 'cancelledByParent'", "  error: test cancelled by parent", "  ---", "not ok 356 - coordinator spawns child with explicit cwd (2)", "  ---", "  failureType: 'cancelledByParent'", "  ---");
+    for (let n = 357; n <= 1667; n++) {
+        const i = n - 357;
+        if (i % 200 === 0)
+            bodies.push(`ok ${n} - handles error output for test ${n}`);
+        else if (i % 150 === 0)
+            bodies.push(`ok ${n} - cleans up after failure ${n}`);
+        else
+            bodies.push(`ok ${n} - passing test number ${n}`);
+    }
+    // node:test's own end-of-run TAP summary, as in the real incident log — its
+    // `# fail 2` line is a weak failure-pattern hit in the tail that must not
+    // outrank the early strong `not ok` failure (round-2 blocking finding).
+    bodies.push("# tests 1667", "# suites 4", "# pass 1663", "# fail 2", "# cancelled 2", "# skipped 0", "# todo 0", "# duration_ms 184213.015");
+    const log = bodies
+        .map((b, i) => `verify\tUnit tests\t2026-09-27T16:${String(Math.floor(i / 60)).padStart(2, "0")}:${String(i % 60).padStart(2, "0")}Z ${b}`)
+        .join("\n");
+    // Guard the test's premise: the failure really does sit outside the old 20K tail window.
+    assert.ok(log.indexOf("not ok 355") < log.length - 20_000);
+    const { exec } = queuedExec([
+        { stdout: prViewWithRollup([actionsCheck("verify", "FAILURE", "36330128633")]) },
+        { stdout: log },
+    ]);
+    const evidence = await fetchChecksFailureEvidence(exec, { cwd: "/repo", number: 160, expectedHeadSha: HEAD_SHA });
+    assert.ok(evidence);
+    assert.match(evidence.excerpt, /not ok 355/);
+    assert.match(evidence.excerpt, /not ok 356/);
+    assert.match(evidence.excerpt, /cancelledByParent/);
+    assert.doesNotMatch(evidence.excerpt, /passing test number 1667/);
+    assert.ok(evidence.excerpt.length <= CHECKS_EVIDENCE_MAX_EXCERPT_CHARS);
+    assert.ok(evidence.excerpt.split("\n").length <= CHECKS_EVIDENCE_MAX_EXCERPT_LINES);
+});
+test("NOT-276: dense failure cluster outranks sparse earlier weak hits (unit level)", async () => {
+    // Minimal direct proof of the round-2 ranking: 30 isolated weak hits precede one
+    // dense 3-hit failure cluster; the excerpt must contain the cluster.
+    const lines = [];
+    for (let g = 0; g < 30; g++) {
+        for (let k = 0; k < 15; k++)
+            lines.push(`ok ${g * 16 + k + 1} - passing test number ${g * 16 + k + 1}`);
+        lines.push(`ok ${g * 16 + 16} - handles error output for test ${g * 16 + 16}`);
+    }
+    lines.push("not ok 999 - real failure here", "  failureType: 'cancelledByParent'", "  error: test cancelled by parent");
+    for (let n = 1000; n < 1100; n++)
+        lines.push(`ok ${n} - passing test number ${n}`);
+    const { excerpt } = buildFailureExcerpt(lines.join("\n"));
+    assert.match(excerpt, /not ok 999/);
+    assert.match(excerpt, /cancelledByParent/);
+});
+// NOT-276 round 3 (real PR #163 review, verified against the actual saved
+// `gh run view 36330128633 --log-failed` output): plain hit-density ranking still
+// missed the real failure two different ways. (1) `gh run view --log-failed`
+// prefixes every line with `<job>\t<step>\t<timestamp> ` before the tool's own
+// output, so an anchored `^\s*not ok\b` pattern never matches the real thing — only
+// an unanchored one does. (2) This repo's own coordinator tests are *about*
+// escalation/conflict/timeout handling, so a cluster of unrelated passing tests can
+// out-rank the real (sparse) failure under density alone; an explicit marker
+// (`not ok`, `##[error]`) must dominate ranking regardless of density.
+test("NOT-276 round 3: a GitHub Actions log-line prefix must not hide the `not ok` marker", async () => {
+    const prefix = (ts) => `verify\tUnit tests\t${ts}Z `;
+    const early = Array.from({ length: 60 }, (_, i) => `${prefix(`2026-09-27T16:07:${String(i).padStart(2, "0")}.0000000`)}ok ${i + 1} - passing test number ${i + 1}`).join("\n");
+    const failureBlock = [
+        `${prefix("2026-09-27T16:07:31.3990644")}not ok 355 - NOT-273: the serve child spawns with an explicit cwd`,
+        `${prefix("2026-09-27T16:07:31.3991406")}  failureType: 'cancelledByParent'`,
+        `${prefix("2026-09-27T16:07:31.3992743")}not ok 356 - no credential short-circuits to missing without spawning`,
+        `${prefix("2026-09-27T16:07:31.3993384")}  failureType: 'cancelledByParent'`,
+    ].join("\n");
+    const late = Array.from({ length: 60 }, (_, i) => `${prefix(`2026-09-27T16:08:${String(i).padStart(2, "0")}.0000000`)}ok ${357 + i} - passing test number ${357 + i}`).join("\n");
+    const log = `${early}\n${failureBlock}\n${late}\n${prefix("2026-09-27T16:09:02.6611414")}##[error]Process completed with exit code 1.`;
+    const { excerpt } = buildFailureExcerpt(log);
+    assert.match(excerpt, /not ok 355/);
+    assert.match(excerpt, /not ok 356/);
+    assert.match(excerpt, /cancelledByParent/);
+});
+// NOT-276 round 3: a lower-ranked region taken first can still be chronologically
+// *earlier* than a higher-ranked one; if the excerpt were char-capped by slicing
+// the reassembled string's tail (ignoring rank), the earlier low-priority region
+// could crowd the later high-priority region's content out of the character
+// budget even though line-budget ranking correctly preferred the real failure.
+test("NOT-276 round 3: an earlier low-priority region must not crowd the real failure out of the character budget", async () => {
+    // ~12 weak hits (one per line, "failed"/"error"), long lines: ~12 * 460 ≈ 5500 chars.
+    const earlyWeakCluster = Array.from({ length: 12 }, (_, i) => `ok ${i + 1} - reports a handled failure/error path for scenario ${i + 1} ` + "x".repeat(400)).join("\n");
+    // The real failure: 2 strong `not ok` hits, short lines (~450 chars total).
+    const realFailure = [
+        "not ok 999 - the real failure",
+        "  failureType: 'cancelledByParent'",
+        "not ok 1000 - a second real failure",
+        "  failureType: 'cancelledByParent'",
+    ].join("\n");
+    // A gap of ordinary passing lines keeps the two clusters as separate merged
+    // windows (matching the real incident: the weak cluster and the real failure
+    // sat ~2300 lines apart) rather than merging into one oversized window, which
+    // would exercise a different, narrower edge case than the one under test here.
+    const gap = Array.from({ length: 20 }, (_, i) => `ok ${900 + i} - passing test number ${900 + i}`).join("\n");
+    const log = `${earlyWeakCluster}\n${gap}\n${realFailure}`;
+    assert.ok(earlyWeakCluster.length + realFailure.length > CHECKS_EVIDENCE_MAX_EXCERPT_CHARS, "test premise: both regions together exceed the char budget");
+    const { excerpt, truncated } = buildFailureExcerpt(log);
+    assert.match(excerpt, /not ok 999/);
+    assert.match(excerpt, /not ok 1000/);
+    assert.match(excerpt, /cancelledByParent/);
+    assert.ok(excerpt.length <= CHECKS_EVIDENCE_MAX_EXCERPT_CHARS);
+    assert.equal(truncated, true, "dropping the lower-ranked region must be reported as truncation");
+});
+test("NOT-276: an exact line-budget fill still reports a later failure region as truncated", async () => {
+    // The A and B windows contain 39 and 40 lines respectively. With the separator
+    // between them, taking both fills the 80-line budget exactly. Region C is a real
+    // failure that must be omitted, and that omission must set truncated=true.
+    const ordinary = (label, count) => Array.from({ length: count }, (_, i) => `ok ${label}-${i + 1} - passing test`);
+    const regionA = Array.from({ length: 27 }, (_, i) => `not ok A-${i + 1} - strong failure A`);
+    const regionB = Array.from({ length: 28 }, (_, i) => `not ok B-${i + 1} - strong failure B`);
+    const lines = [
+        ...ordinary("prefix", 6),
+        ...regionA,
+        ...ordinary("gap-a-b", 13),
+        ...regionB,
+        ...ordinary("gap-b-c", 13),
+        "not ok C-1 - later real failure",
+        ...ordinary("suffix", 6),
+    ];
+    const { excerpt, truncated } = buildFailureExcerpt(lines.join("\n"));
+    assert.equal(excerpt.split("\n").length, CHECKS_EVIDENCE_MAX_EXCERPT_LINES);
+    assert.match(excerpt, /not ok A-1/);
+    assert.match(excerpt, /not ok B-1/);
+    assert.doesNotMatch(excerpt, /not ok C-1/);
+    assert.equal(truncated, true, "the omitted third failure region must be reported as truncation");
+});
+test("NOT-276: log with no failure-pattern hits still falls back to the tail, unchanged", async () => {
+    // NB: this filler must stay free of FAILURE_LINE_PATTERN words — that absence is the no-hit premise.
+    const log = Array.from({ length: 200 }, (_, i) => `ok ${i + 1} - passing test number ${i + 1}`).join("\n");
+    const { exec } = queuedExec([
+        { stdout: prViewWithRollup([actionsCheck("verify", "FAILURE", "111")]) },
+        { stdout: log },
+    ]);
+    const evidence = await fetchChecksFailureEvidence(exec, { cwd: "/repo", number: 42, expectedHeadSha: HEAD_SHA });
+    assert.ok(evidence);
+    // The fetch path must feed the full log through exactly as buildFailureExcerpt sees it.
+    assert.equal(evidence.excerpt, buildFailureExcerpt(log).excerpt);
+    const excerptLines = evidence.excerpt.split("\n");
+    assert.equal(excerptLines.length, CHECKS_EVIDENCE_MAX_EXCERPT_LINES);
+    assert.match(excerptLines[0] ?? "", /passing test number 121/);
+    assert.match(excerptLines[excerptLines.length - 1] ?? "", /passing test number 200/);
+    assert.equal(evidence.excerptTruncated, true);
+    assert.ok(evidence.excerpt.length <= CHECKS_EVIDENCE_MAX_EXCERPT_CHARS);
+});
+test("NOT-276: log larger than the raw memory ceiling stays bounded without crashing", async () => {
+    // Short lines on purpose: the 80-line tail must fit under the 4,000-char
+    // excerpt cap, otherwise the char cap (not the memory ceiling) would cut the
+    // asserted last line and the test would prove nothing about the tail.
+    const line = (i) => `ok ${i} - pad pad ${i}`;
+    const targetLen = CHECKS_EVIDENCE_MAX_RAW_LOG_CHARS_PER_RUN + 500_000;
+    const count = Math.ceil(targetLen / 20);
+    const parts = new Array(count);
+    for (let i = 0; i < count; i++)
+        parts[i] = line(i);
+    const log = parts.join("\n");
+    assert.ok(log.length > CHECKS_EVIDENCE_MAX_RAW_LOG_CHARS_PER_RUN);
+    const { exec } = queuedExec([
+        { stdout: prViewWithRollup([actionsCheck("verify", "FAILURE", "111")]) },
+        { stdout: log },
+    ]);
+    const evidence = await fetchChecksFailureEvidence(exec, { cwd: "/repo", number: 42, expectedHeadSha: HEAD_SHA });
+    assert.ok(evidence);
+    assert.ok(evidence.excerpt.length <= CHECKS_EVIDENCE_MAX_EXCERPT_CHARS);
+    // The excerpt is built from the kept tail portion, never the discarded head.
+    assert.equal(evidence.excerpt, buildFailureExcerpt(log.slice(-CHECKS_EVIDENCE_MAX_RAW_LOG_CHARS_PER_RUN)).excerpt);
+    assert.match(evidence.excerpt, new RegExp(`pad pad ${count - 1}`));
+});
+test("NOT-276 round 3: run-log fetch carries an explicit maxBuffer above the raw ceiling", async () => {
+    // Node's execFile defaults to ~1 MiB maxBuffer, which would reject any larger
+    // --log-failed output with ERR_CHILD_PROCESS_STDIO_MAXBUFFER before the 2MB
+    // raw-log ceiling applies. The fetch must pass an explicit buffer above the
+    // ceiling so the ceiling — not the process buffer — bounds memory.
+    assert.ok(CHECKS_EVIDENCE_GH_LOG_MAX_BUFFER > CHECKS_EVIDENCE_MAX_RAW_LOG_CHARS_PER_RUN, "maxBuffer must sit above the raw-log ceiling");
+    const { exec, calls, execOpts } = queuedExec([
+        { stdout: prViewWithRollup([actionsCheck("verify", "FAILURE", "111")]) },
+        { stdout: "verify log\nError: boom\n" },
+    ]);
+    const evidence = await fetchChecksFailureEvidence(exec, { cwd: "/repo", number: 42, expectedHeadSha: HEAD_SHA });
+    assert.ok(evidence);
+    assert.deepEqual(calls[1], ["run", "view", "111", "--log-failed"]);
+    assert.equal(execOpts[1]?.maxBuffer, CHECKS_EVIDENCE_GH_LOG_MAX_BUFFER);
+    // The small pr-view lookup needs no oversized buffer.
+    assert.ok(execOpts[0]?.maxBuffer == null, "pr view must not carry the log buffer");
+});
 test("NOT-252: formatChecksFailureDetails labels the excerpt as untrusted, not instructions", async () => {
     const details = formatChecksFailureDetails({
         headSha: HEAD_SHA,