tumwater 0.1.2 → 0.2.0

package/dist/src/budget/budget.js

@@ -1,4 +1,4 @@
-/** The daily-cost budget: a loop's and the fleet's local-day spend and the gate those figures
+/** The daily-cost budget: a loop's and the team's local-day spend and the gate those figures
  * drive (plans/daily-cost-budget.md, plans/fallback-model.md). The circuit breaker that judges
  * whether the gate's fallback can actually serve lives beside it in fallback-breaker.ts. Split
  * out of loop-state.ts, which owns
@@ -17,7 +17,7 @@ export function todayStamp(now = Date.now()) {
 }
 /** A spend figure is finite and non-negative (json-object.ts's nonNegativeNumber); a string,
  * NaN, ±Infinity, or a negative hand-edited value reads as $0. Negative spend is as poisonous
- * to the cap as NaN: it makes every `>= cap` comparison false — and drags the fleet sum down —
+ * to the cap as NaN: it makes every `>= cap` comparison false — and drags the team sum down —
  * silently defeating the budget's safety valve. */
 function spendNumber(value) {
     return nonNegativeNumber(value, 0);
@@ -28,7 +28,7 @@ function spendNumber(value) {
  * non-finite, or negative value reads as $0 too: `loadLoopState` heals the field on read, but
  * this is the budget gate's own guard, and a hand-edited or torn `dayCostUsd` (or an in-memory
  * state) would otherwise concatenate into
- * fleetDailyCost's sum (or make every `>= cap` comparison false) and silently defeat the cap,
+ * teamDailyCost's sum (or make every `>= cap` comparison false) and silently defeat the cap,
  * the budget's safety valve. Reads never mutate. See plans/daily-cost-budget.md. */
 export function dailyCost(s, now = Date.now()) {
     return s.dayStamp === todayStamp(now) ? spendNumber(s.dayCostUsd) : 0;
@@ -40,16 +40,33 @@ export function dailyCost(s, now = Date.now()) {
  * authoritative across an in-flight tick; the value persists at tick end with the rest of the
  * state. Both operands are guarded through spendNumber so a corrupt stored value or a
  * non-finite/negative run cost cannot poison the window with a string/NaN/negative sum. */
-export function recordDailyCost(s, usd, now = Date.now()) {
+export function recordDailyCost(s, usd, now = Date.now(), pair) {
     const stamp = todayStamp(now);
     if (s.dayStamp !== stamp) {
         s.dayStamp = stamp;
         s.dayCostUsd = 0;
+        s.dayCostByPair = {};
     }
     s.dayCostUsd = spendNumber(s.dayCostUsd) + spendNumber(usd);
+    // The per-step split (a priced fallback step's own cap): folded under the run's pair name,
+    // an own property so a `__proto__` pair cannot reach the prototype.
+    if (pair !== undefined) {
+        const by = (s.dayCostByPair ??= {});
+        const sum = spendNumber(Object.hasOwn(by, pair) ? by[pair] : 0) + spendNumber(usd);
+        Object.defineProperty(by, pair, { value: sum, enumerable: true, writable: true, configurable: true });
+    }
+}
+/** One model pair's spend for the local day, summed over every loop's per-pair window
+ * (`dayCostByPair`): $0 for a stale day stamp or a pair no run has charged. */
+export function pairDailyCost(states, pair, now = Date.now()) {
+    const today = todayStamp(now);
+    return states.reduce((sum, s) => {
+        const by = s.dayStamp === today ? s.dayCostByPair : undefined;
+        return sum + (by !== undefined && Object.hasOwn(by, pair) ? spendNumber(by[pair]) : 0);
+    }, 0);
 }
-/** The fleet's spend for the local day: every loop's daily window summed. */
-export function fleetDailyCost(states, now = Date.now()) {
+/** The team's spend for the local day: every loop's daily window summed. */
+export function teamDailyCost(states, now = Date.now()) {
     return states.reduce((sum, s) => sum + dailyCost(s, now), 0);
 }
 /** True when today's spend has reached the daily cost budget — the view is non-null, its cap is
@@ -57,23 +74,23 @@ export function fleetDailyCost(states, now = Date.now()) {
  * above it. The single definition of "the budget gate is on": the orchestrator evaluates it from
  * live loop states via budgetPaused, and both dashboards evaluate it from the snapshot's
  * materialized budget field (status/status-data.ts) — which carries the object even while
- * disabled, so the capUsd > 0 term is what keeps a disabled fleet out of "budget paused". The
+ * disabled, so the capUsd > 0 term is what keeps a disabled team out of "budget paused". The
  * comparison cannot drift between what the scheduler enforces and what users see. */
 export function budgetReached(budget) {
     return budget !== null && budget.capUsd > 0 && budget.spentUsd >= budget.capUsd;
 }
-/** The fixed fraction of the daily cap at which the fleet pages the operator that spend is
+/** The fixed fraction of the daily cap at which the team pages the operator that spend is
  * closing in on it (PLANS.md 2026-09-30): opinionated default, no config knob. */
 export const BUDGET_WARNING_FRACTION = 0.8;
 /** True when today's spend has crossed `BUDGET_WARNING_FRACTION` of the daily cap while the
  * budget gate is still open — the early heads-up beside budgetReached, which fires only once
- * the cap itself is reached and the fleet has already stopped (or demoted) its ticks. Same
+ * the cap itself is reached and the team has already stopped (or demoted) its ticks. Same
  * guard terms as budgetReached (non-null view, a cap of 0 disables the budget), scaled by the
  * warning fraction, so the two views can never disagree about whether the budget is on. */
 export function budgetWarning(budget) {
     return (budget !== null && budget.capUsd > 0 && budget.spentUsd >= budget.capUsd * BUDGET_WARNING_FRACTION);
 }
-/** True while the fleet's spend for the local day has reached `maxDailyCostUsd` (a cap of 0
+/** True while the team's spend for the local day has reached `maxDailyCostUsd` (a cap of 0
  * disables the budget). The orchestrator re-evaluates this every poll from its runners' live
  * states and the freshly reloaded config — resume is stateless, so raising/disabling the cap
  * or crossing midnight flips it on the next cycle and nothing can get stuck. Lives here (not
@@ -81,13 +98,13 @@ export function budgetWarning(budget) {
 export function budgetPaused(states, config, now = Date.now()) {
     return budgetReached(budgetSpend(states, config, now));
 }
-/** The fleet's daily-budget figures from live loop states — the exact pair the gate evaluates:
+/** The team's daily-budget figures from live loop states — the exact pair the gate evaluates:
  * today's summed spend and the configured cap (0 when disabled). budgetReached's own capUsd > 0
  * term makes a disabled cap read unreached, so the pair needs no null ceremony. Returning the
  * figures (not just the verdict) lets the scheduler publish WHAT it tripped on, not only THAT it
  * tripped — the one number every observer must show. */
 export function budgetSpend(states, config, now = Date.now()) {
-    return { spentUsd: fleetDailyCost(states, now), capUsd: config.maxDailyCostUsd };
+    return { spentUsd: teamDailyCost(states, now), capUsd: config.maxDailyCostUsd };
 }
 /** When today's burn will reach the cap, as a local-day epoch-ms instant — the budget badge's
  * `~cap at HH:MM` forecast — or null when no forecast may be stated: no cap (`capUsd <= 0`, the
@@ -123,8 +140,8 @@ export function modelPairName(p) {
  * (budgetReached for observers, budgetPaused for the scheduler), and whether the `default` and
  * `strong` tiers resolved to a usable free pair (resolveTierFallbacks over the full usable
  * predicate — price AND breaker serving) — plus whether the review gate is on. The gate is
- * `paused` when `default` resolves to pause (nothing for the fleet's bulk to run on), or when
- * review is on and `strong` does (nothing could land, so every authoring tick is wasted work);
+ * `paused` when `default` resolves to pause (nothing for the team's bulk to run on), or when
+ * review is on and `strong` does (nothing could merge, so every authoring tick is wasted work);
  * `fallback` otherwise, with the tiers that did resolve running their pairs and the rest held
  * per role. The single definition of the gate: the orchestrator enforces it and both dashboards
  * display it, so what an operator sees is what the scheduler is doing. */
@@ -140,7 +157,7 @@ export function budgetGate(reached, tiers, reviewOn) {
 /** The configured fallback tier map as display entries: one `tier: pair` per set tier, in
  * MODEL_TIERS order (small, default, strong). The single home of the tier-list rendering
  * shared by the budget badge (src/ui/badges.ts), the fallback alert's detail
- * (src/ui/fleet-alerts.ts), and the budget_fallback event line
+ * (src/ui/team-alerts.ts), and the budget_fallback event line
  * (src/events/event-format.ts), so the pair shape and the tier order cannot drift between
  * the three surfaces; each caller joins or length-tests the entries itself. A non-string
  * value is not a pair (the event reads a loosely typed field) and is left out; absent or

package/dist/src/budget/fallback-breaker.js

@@ -1,3 +1,4 @@
+// vocabulary: plain
 /** The fallback's circuit breaker (BUGS.md 2026-09-20): whether the engaged free fallback can
  * actually SERVE. Split out of budget.ts, which keeps the daily-cost figures and the gate they
  * drive; the breaker is a self-contained pure state machine — no scheduler, no pi model
@@ -5,13 +6,13 @@
  * orchestrator can hold it in memory and fold tick outcomes into it without importing the
  * budget. The gate reads its verdict through fallbackServing (budget.ts's budgetGate). */
 /** failureLimit 3 is a single loop's failing-streak threshold (tick-apply.ts ERROR_STREAK_WARN)
- * applied fleet-wide: consecutive across every role, so any tick that served in between resets
+ * applied team-wide: consecutive across every role, so any tick that served in between resets
  * it — a healthy backend with one flaky tick never trips it, while a dead one trips on its
  * first three ticks (on 2026-09-19 the third failure landed 24 minutes into the hour; the 30
  * ticks after it were the waste). A 5-minute first cool-down because a failed probe costs one
  * tick — about half of that hour's failures came back in under 10 s, the rest ran minutes
  * before the 400 — which is cheap next to idling until midnight; doubling to at most 30 minutes
- * bounds how long an operator who fixed the backend waits for the fleet to notice (editing the
+ * bounds how long an operator who fixed the backend waits for the team to notice (editing the
  * cap or the pair re-trusts it at once — see rekeyFallbackBreaker). */
 export const FALLBACK_BREAKER_POLICY = {
     failureLimit: 3,
@@ -64,14 +65,14 @@ export function abandonFallbackProbe(b) {
  * alone: every way a backend cannot serve — an HTTP 4xx/5xx like oMLX's prefill guard, a
  * refused connection, a request that never returns (the tick timeout) — ends a tick as `error`,
  * and 33 of 33 did on 2026-09-19. (An `error` can also be local, e.g. a worktree that will not
- * reset; failureLimit of those in a row fleet-wide is still a fleet that cannot work, and the
+ * reset; failureLimit of those in a row team-wide is still a team that cannot work, and the
  * probe wins the pause back.) `served` is a result only a model reply produces: a change bound
- * for landing (`queued`, `changed`), an explicit decision (`no_change`, `refused`), or a
+ * for merge (`queued`, `changed`), an explicit decision (`no_change`, `refused`), or a
  * reviewer's rejection. Everything else is no evidence: harness and operator kills (`aborted`,
  * `user_aborted`), ticks that never reached the model (`skipped`, `main_red`), a quiet kill
  * (the model had answered before the stall — a tool call or the stream stopped), and the
- * landing results (`merge_conflict`, `merge_blocked`, `review_error`) — a tick no longer
- * returns them since leftover recovery queues its pin instead of landing it, and they would
+ * merge results (`merge_conflict`, `merge_blocked`, `review_error`) — a tick no longer
+ * returns them since leftover recovery queues its pin instead of merging it, and they would
  * not say whether the backend was involved. */
 export function fallbackEvidence(result) {
     switch (result) {
@@ -114,7 +115,7 @@ export function recordFallbackTick(b, ranOn, result, probe, now, policy = FALLBA
     return { ...b, failures, probeAt: now + policy.cooldownMs, cooldownMs: policy.cooldownMs, probing: false };
 }
 /** What orchestrator.json publishes while the breaker holds the fallback demoted
- * (fleet/orchestrator-info.ts's OrchestratorInfo.fallbackDemoted). Observers need it because the
+ * (team/orchestrator-info.ts's OrchestratorInfo.fallbackDemoted). Observers need it because the
  * price check alone would advertise the demoted pair as a working fallback —
  * status/status-data.ts nulls the snapshot's `fallback` from it and `tumwater doctor` names it.
  * Undefined while the fallback is trusted or not engaged. */

package/dist/src/build/build-check-detect.js

@@ -1,3 +1,4 @@
+// vocabulary: plain
 import fs from "node:fs";
 import path from "node:path";
 import { isJsonObject } from "../files/json-object.js";
@@ -79,7 +80,7 @@ function isCheckScript(s, key) {
 export function detectBuildCheck(startDir, config, maxLevels = WALK_UP_LEVELS) {
     const c = config?.check;
     // check.timeoutSeconds bounds the npm walk-up's check too: it is how a repo whose suite
-    // outgrows 300 s under load says so (the fleet's own gate runs were timing out there).
+    // outgrows 300 s under load says so (the team's own gate runs were timing out there).
     const configuredMs = typeof c?.timeoutSeconds === "number" && c.timeoutSeconds > 0 ? c.timeoutSeconds * 1000 : undefined;
     if (c && isNonBlankString(c.command)) {
         return {
@@ -95,10 +96,10 @@ export function detectBuildCheck(startDir, config, maxLevels = WALK_UP_LEVELS) {
 }
 /** The configured per-change gate command (`check.gateCommand`, PLANS.md Land-queue speed 3e) when
  * it is a non-blank string, else undefined — off. Opt-in: a repo that sets it trades a cheaper
- * review-gate pre-check for a full check.command run that happens once per stack at the
- * batch/landing scope instead. One reading shared by runScopedBuildCheck (which runs it at scope
- * "gate") and landing-merge.ts's verifyLanding (which must then never treat the gate's green as the
- * full check's), so the two cannot disagree about whether it is on. */
+ * review-gate pre-check for a full check.command run that happens once per stack at the batch/merge
+ * scope instead. One reading shared by runScopedBuildCheck (which runs it at scope "gate") and
+ * merge-to-main.ts's verifyMerge (which must then never treat the gate's green as the full
+ * check's), so the two cannot disagree about whether it is on. */
 export function gateCommandOf(config) {
     const g = config?.check?.gateCommand;
     return isNonBlankString(g) ? g : undefined;
@@ -108,9 +109,9 @@ export function gateCommandOf(config) {
  * of its own (node_modules is gitignored, so it exists only where someone ran npm install), and
  * neither does a project nested under an installed root. Returns the first existing path, or
  * null when no ancestor within `maxLevels` has it. Assuming a local install instead is what
- * broke the fleet's own redeploy on 2026-09-08: compileStaged looked only at
+ * broke the team's own redeploy on 2026-09-08: compileStaged looked only at
  * `<root>/node_modules/typescript`, so its test could not pass in a bare worktree, the failing
- * suite made main read red, and the blocked restart stranded the fleet on a stale build
+ * suite made main read red, and the blocked restart stranded the team on a stale build
  * (BUGS.md). Never throws. */
 export function resolveFromNodeModules(startDir, rel, maxLevels = WALK_UP_LEVELS) {
     return walkUp(startDir, maxLevels, (dir) => {

package/dist/src/build/build-check-events.js

@@ -1,3 +1,4 @@
+// vocabulary: plain
 /** The presentation half of the build check: the scope vocabulary, the environmental-skip
  * warning's wording, and the build_check event's shape. Split out of build-check.ts — which
  * keeps the deterministic execution and classification (detect → spawn → classify) — because
@@ -7,6 +8,30 @@
  * running a check. This module imports only types from build-check.js, so no runtime cycle.
  * runScopedBuildCheck (build-check-scoped.ts) is the only caller that both runs a check and
  * uses this wording; the baseline surfaces use the event/warning helpers alone. */
+/** Does this build_check scope stand for a full-suite verdict — merge, batch, or the red-main
+ * baseline? A gate check can run a subset of the tree, so a scope outside this set is never a
+ * full-suite check. The one vocabulary the three predicates that recognize a full-suite check
+ * select on — isPassingFullCheck, isRedFullCheck, and the status polls' newest-merge-check
+ * scan (status-polls.ts) — so they cannot drift on which scopes count. The deadline-killed
+ * failure costing in time-spend.ts is a narrower pair (merge/batch only, with a status and a
+ * timeout required), so it keeps its own check. */
+export function isFullCheckScope(scope) {
+    return scope === "merge" || scope === "batch" || scope === "baseline";
+}
+/** Is this a passing build_check over the full suite? The scopes doctor's check row counts —
+ * merge, batch and the red-main baseline — are isFullCheckScope's set; a gate check can run a
+ * subset, so it is left out. */
+export function isPassingFullCheck(ev) {
+    return ev.type === "build_check" && ev.status === "passed" && isFullCheckScope(ev.scope);
+}
+/** The red sibling of isPassingFullCheck: a failed build_check over the same three scopes
+ * (isFullCheckScope's set). A `skipped` check made no verdict about the tree, and a merge-scope
+ * timeout is already remapped to `failed` by runScopedBuildCheck (`MERGE_SCOPES`), so `failed`
+ * alone is the rule. The two predicates are mutually exclusive on `status`, so a fold branch on
+ * them never sees the other's events. */
+export function isRedFullCheck(ev) {
+    return ev.type === "build_check" && ev.status === "failed" && isFullCheckScope(ev.scope);
+}
 /** How late a check's deadline timer may fire before the timeout's wording stops naming the
  * configured bound alone. Normal timer lag is milliseconds; past this the warning and the
  * merge-scope reason name the wall-clock time the deadline actually fired and how late (see
@@ -25,7 +50,7 @@ export const SLEEP_SPAN_TOLERANCE_MS = 5_000;
  * says nothing about the tree: a skip from a signal the harness did not send, a timeout whose
  * deadline demonstrably fired late, and a failure the host slept through. The one rule for every
  * scope — runScopedBuildCheck and the red-main baseline (checkMainBaseline) both ask it. */
-export function owesCleanRetry(first) {
+function owesCleanRetry(first) {
     if (first.status === "failed")
         return (first.run?.sleptMs ?? 0) > SLEEP_SPAN_TOLERANCE_MS;
     if (first.status !== "skipped")
@@ -33,22 +58,43 @@ export function owesCleanRetry(first) {
     return (first.skipReason === "killed" ||
         (first.skipReason === "timeout" && (first.run?.deadlineLateMs ?? 0) > DEADLINE_LATE_TOLERANCE_MS));
 }
+/** Run one build-check attempt, priced, and give a verdict-less first attempt one clean retry
+ * — the timing-and-counting discipline shared by runScopedBuildCheck (build-check-scoped.ts)
+ * and the red-main baseline (checkMainBaseline, main-baseline.ts), so the two surfaces cannot
+ * drift on how long one check "took" or on how many attempts a weather-killed run owes
+ * (BUGS.md 2026-09-30). `run` starts one attempt; the returned `durationMs` prices the attempt
+ * whose verdict stands — the first, unless owesCleanRetry, in which case the retry's. `onFirst`
+ * prices the verdict-less first attempt the way the caller's surface reports runs
+ * (runScopedBuildCheck logs a build_check event; checkMainBaseline feeds its onRun hook), so a
+ * retried attempt's cost is still recorded even though its verdict is discarded.` */
+export async function runWithCleanRetry(run, onFirst) {
+    const startedAt = Date.now();
+    const first = await run();
+    let durationMs = Date.now() - startedAt;
+    if (!owesCleanRetry(first))
+        return { outcome: first, durationMs };
+    onFirst?.(first, durationMs);
+    const retryStart = Date.now();
+    const retry = await run();
+    durationMs = Date.now() - retryStart;
+    return { outcome: retry, durationMs };
+}
 /** Per-scope wording for the environmental-skip warning. The call sites' current messages
  * are identical apart from these words, so keying them on the scope keeps each surface's feed
  * line byte-for-byte what it is today. */
 export const SCOPE_WORDS = {
-    gate: { label: "build check", proceeding: "proceeding to model review" },
-    landing: { label: "landing build check", proceeding: "proceeding to merge" },
-    // The batch's next step after the check is the fast-forward — the same phrase the landing
-    // scope uses (gate says "proceeding to model review" because its next step is the reviewer).
-    batch: { label: "batch build check", proceeding: "proceeding to merge" },
+    gate: { label: "check", proceeding: "proceeding to model review" },
+    merge: { label: "merge check", proceeding: "proceeding to merge" },
+    // The batch's next step after the check is the fast-forward — the same phrase the merge scope
+    // uses (gate says "proceeding to model review" because its next step is the reviewer).
+    batch: { label: "batch check", proceeding: "proceeding to merge" },
 };
-/** Scopes whose outcome gates a merge to main: runScopedBuildCheck remaps a timeout or an
- * external signal kill at these scopes to a deterministic "failed" — the tree is unverified,
- * and these are the last checks before main. The gate scope's pre-check stays fail-open
- * because the model reviewer and the landing path's own check still stand behind it
- * (BUGS.md: a landing build check that times out must not merge unverified). */
-export const MERGE_SCOPES = new Set(["landing", "batch"]);
+/** Scopes whose outcome gates a merge to main: runScopedBuildCheck remaps a timeout or an external
+ * signal kill at these scopes to a deterministic "failed" — the tree is unverified, and these are
+ * the last checks before main. The gate scope's pre-check stays fail-open because the model
+ * reviewer and the merge path's own check still stand behind it (BUGS.md: a merge build check that
+ * times out must not merge unverified). */
+export const MERGE_SCOPES = new Set(["merge", "batch"]);
 /** The proceeding reason a merge-scope check that made no verdict about the tree carries: the
  * run was killed, timed out, or spanned a host sleep, so nothing it saw is the change's
  * failure. The single home of that wording, shared by runScopedBuildCheck's four merge-scope
@@ -79,7 +125,7 @@ export function timedOutPhrase(timeoutMs, run) {
     // swap-thrashing host, a harness stall), so it is reported as such rather than as a sleep.
     const cause = (run?.sleptMs ?? 0) > SLEEP_SPAN_TOLERANCE_MS
         ? "the host was asleep"
-        : "no host sleep measured: the host was starved or the harness stalled";
+        : "no host sleep measured: the host was starved or tumwater stalled";
     return (`timed out after ${oneDecimalSeconds(bound + late)}s (its ${bound / 1000}s deadline fired ` +
         `${oneDecimalSeconds(late)}s late: ${cause})`);
 }
@@ -89,7 +135,7 @@ const STARVED_DEADLINE_MAX_FACTOR = 2;
 /** The deadline a merge-scope check runs under: `baseMs` stretched by the host's load-to-cores
  * ratio (at most STARVED_DEADLINE_MAX_FACTOR) when the load average exceeds the core count,
  * else `baseMs` itself. 46 of 50 merge-scope rejections in one window were the 300 s deadline
- * firing on time under the fleet's own load, with a passing tail at 299.97 s — the check was
+ * firing on time under the team's own load, with a passing tail at 299.97 s — the check was
  * measuring the load, not the tree (BUGS.md 2026-10-12). */
 export function starvedDeadlineMs(baseMs, load) {
     if (!(load.cpus > 0) || !(load.load1 > load.cpus))
@@ -97,7 +143,7 @@ export function starvedDeadlineMs(baseMs, load) {
     return Math.round(baseMs * Math.min(load.load1 / load.cpus, STARVED_DEADLINE_MAX_FACTOR));
 }
 /** The note an on-time deadline kill carries when the host was starved: the load average
- * beyond the core count means the check shared the machine with the rest of the fleet, so the
+ * beyond the core count means the check shared the machine with the rest of the team, so the
  * 300 s kill is a statement about the deadline under load, not a measured verdict on the
  * change (BUGS.md 2026-10-12). Empty when the host had a core to spare. */
 export function loadedHostPhrase(load) {
@@ -136,7 +182,7 @@ export function installFailedPhrase(label, install, proceeding) {
 /** Did this outcome make no verdict about the tree? runScopedBuildCheck records that verdict-
  * less shape explicitly (`unverified: true`) at the merge scopes; a gate-scope failure carries
  * only the run's own sleep evidence (BuildCheckRun.sleptMs), so both spellings count. The
- * consumers that attribute a red — review.ts's gate, landing-check-failures.ts's attribution, the
+ * consumers that attribute a red — review.ts's gate, merge-check-failures.ts's attribution, the
  * red-main baseline — ask this instead of re-deriving the evidence, so the attribution policy
  * cannot drift between them (BUGS.md 2026-09-30). */
 export function unverifiedTreeOutcome(outcome) {
@@ -184,15 +230,15 @@ function buildCheckRunFields(outcome) {
         ...(run.sleptMs === undefined ? {} : { sleptMs: run.sleptMs }),
     };
 }
-/** The one home of the build_check event's shape — `{ loop, type: "build_check", scope,
+/** The one home of the build_check event's shape — `{ source, type: "build_check", scope,
  * status, script, durationMs }` plus the run-timing fields (buildCheckRunFields above) —
  * so the feed's most expensive event type cannot drift a field between its four surfaces:
  * runScopedBuildCheck's two priced events in build-check-scoped.ts (the killed retry and the
  * final verdict) and the red-main baseline loggers (main-red.ts's baselineCheckLogger,
  * redeploy.ts's redeploy mirror), which all paid the run whose timings the event carries. */
-export function buildCheckEvent(loop, scope, outcome, durationMs) {
+export function buildCheckEvent(source, scope, outcome, durationMs) {
     return {
-        loop,
+        source,
         type: "build_check",
         scope,
         status: outcome.status,
@@ -213,11 +259,11 @@ export function buildCheckEvent(loop, scope, outcome, durationMs) {
             : {}),
     };
 }
-/** The onRun hook that logs one baseline check's build_check event through `log` under `loop`:
+/** The onRun hook that logs one baseline check's build_check event through `log` under `source`:
  * main-red.ts's gate logger (logEventBestEffort) and redeploy.ts's green-check and witness hooks
  * all turn the same run shape into the same baseline event, so that mapping lives here once
  * instead of as three hand-rolled closures. `log` receives the event alone; a caller binds its
  * root (logEventBestEffort) or its RedeployEvent sink. */
-export function baselineCheckEventLogger(loop, log) {
-    return ({ outcome, durationMs }) => log(buildCheckEvent(loop, "baseline", outcome, durationMs));
+export function baselineCheckEventLogger(source, log) {
+    return ({ outcome, durationMs }) => log(buildCheckEvent(source, "baseline", outcome, durationMs));
 }

package/dist/src/build/build-check-report.js

@@ -1,15 +1,15 @@
-/** Pure formatting and description of a build check's failure output — split out of
- * build-check.ts, which keeps the execution side (detect → run → classify, the toolchain
- * probe, the process-group runner). This module turns a check's raw combined output and a
- * BuildCheckOutcome into the machine text that is persisted and shown: the per-line clip cap
- * (clipReason/MAX_REASON_CHARS, shared with review-verdict.ts's parseVerdict), the clipped
- * output tail (clipBuildTail), the one-line headline a warning names the failure by
- * (failureHeadline), the check's human-facing command name (describeCheck), and the reasons a
- * red check hands its author (checkFailureReasons). Every consumer of a check's tail — the
- * review gate, the landing path, the red-main gate, the tick prompt — imports from here, so
- * "which line is the headline" and "how much output survives" have one answer each. Type-only
- * back-reference to build-check.ts for BuildCheckOutcome (no runtime cycle); BuildCheck comes
- * from build-check-detect.ts. */
+// vocabulary: plain
+/** Pure formatting and description of a build check's failure output — split out of build-check.ts,
+ * which keeps the execution side (detect → run → classify, the toolchain probe, the process-group
+ * runner). This module turns a check's raw combined output and a BuildCheckOutcome into the machine
+ * text that is persisted and shown: the per-line clip cap (clipReason/MAX_REASON_CHARS, shared with
+ * review-verdict.ts's parseVerdict), the clipped output tail (clipBuildTail), the one-line headline
+ * a warning names the failure by (failureHeadline), the check's human-facing command name
+ * (describeCheck), and the reasons a red check hands its author (checkFailureReasons). Every
+ * consumer of a check's tail — the review gate, the merge path, the red-main gate, the tick prompt
+ * — imports from here, so "which line is the headline" and "how much output survives" have one
+ * answer each. Type-only back-reference to build-check.ts for BuildCheckOutcome (no runtime cycle);
+ * BuildCheck comes from build-check-detect.ts. */
 import { truncate } from "../text/text.js";
 /** Per-reason length cap with ellipsis — bounds one line of machine-generated or reviewer
  * text so it cannot bloat persisted state (shared by clipBuildTail here and parseVerdict in
@@ -52,7 +52,7 @@ export function clipBuildTail(output) {
  * window when it would otherwise be cut), so a check that died on an unhandled rejection ends
  * mid-stack and the tail's FIRST line is a frame: every red-main warning logged before
  * 2026-09-18 read "main <sha> is red (test: at process.processTicksAndRejections
- * (node:internal/...))" — where, never what, which is why a false red that blocked the fleet
+ * (node:internal/...))" — where, never what, which is why a false red that blocked the team
  * for hours could not be diagnosed from the event feed at all (BUGS.md). Prefer the first line
  * that is not framing — a stack frame, or node:test's summary/framing lines (below) — and fall
  * back to the tail's first line when every line is framing, so a caller always has something
@@ -95,13 +95,12 @@ export function failureHeadline(tail) {
 export function describeCheck(check) {
     return check.kind === "npm" ? `\`npm run ${check.script}\`` : `\`${check.command}\``;
 }
-/** The machine-generated reasons a red check hands its author: the headline joined to the rest
- * of the clipped tail, so the compiler error sits right after it in the injected next-tick note.
- * The headline is failureHeadline's — the first line that is not a stack frame — not
- * outputTail[0]: a suite that dies on an unhandled rejection opens mid-stack, and naming the
- * frame tells the author where it broke, never what (BUGS.md 2026-09-19). One definition for
- * every red that rejects a change: the gate's pre-check, a batch's single-change red, and a
- * single landing's in-lock check. */
+/** The machine-generated reasons a red check hands its author: the headline joined to the rest of
+ * the clipped tail, so the compiler error sits right after it in the injected next-tick note. The
+ * headline is failureHeadline's — the first line that is not a stack frame — not outputTail[0]: a
+ * suite that dies on an unhandled rejection opens mid-stack, and naming the frame tells the author
+ * where it broke, never what (BUGS.md 2026-09-19). One definition for every red that rejects a
+ * change: the gate's pre-check, a batch's single-change red, and a single merge's in-lock check. */
 export function checkFailureReasons(check, outcome) {
     const tail = outcome.outputTail ?? [];
     // An unverified rejection already says what happened — the check never finished, the tree is
@@ -110,11 +109,11 @@ export function checkFailureReasons(check, outcome) {
     // failure that never happened (BUGS.md 2026-09-28). The empty-tail fallback keeps the safe
     // default should a remap ever lose its reason line.
     if (outcome.unverified) {
-        return tail.length > 0 ? tail : [`build check failed (${describeCheck(check)})`];
+        return tail.length > 0 ? tail : [`check failed (${describeCheck(check)})`];
     }
     const headline = failureHeadline(tail);
     const what = describeCheck(check);
     return headline !== undefined
-        ? [`build check failed (${what}): ${headline}`, ...tail.filter((l) => l !== headline)]
-        : [`build check failed (${what})`];
+        ? [`check failed (${what}): ${headline}`, ...tail.filter((l) => l !== headline)]
+        : [`check failed (${what})`];
 }