tumwater 0.1.2 → 0.2.0

package/dist/src/events/notify.js

@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
-import { subscribeEvents, warnEventBestEffort } from "./events.js";
+import { loadConfigSafe } from "../config/config.js";
+import { subscribeEvents, TUMWATER_SOURCE, warnEventBestEffort } from "./events.js";
 import { formatEvent } from "./event-format.js";
 import { errorMessage, stripTerminalControls } from "../text/text.js";
 import { childEnv } from "../process/process.js";
@@ -8,53 +9,150 @@ import { childEnv } from "../process/process.js";
  * push channel beside the pull-based dashboards and `tumwater logs`.
  *
  * Scope, stated plainly: the notifier subscribes via subscribeEvents (src/events/events.ts), which
- * only sees events THIS process logs. All nine allowlisted types are logged by the
- * orchestrator's own process (budget-gates.ts, gate-polls.ts → streak-gate.ts,
- * role-cap-gates.ts and disk-gate.ts, landing-slot.ts, landing-questions.ts,
- * src/redeploy/redeployer.ts), so nothing
- * notable is missed; events appended by
+ * only sees events THIS process logs. Every allowlisted type but `supervisor_exit` is logged by
+ * the orchestrator's own process (budget-gates.ts, gate-polls.ts → streak-gate.ts,
+ * role-cap-gates.ts and disk-gate.ts, src/baseline/main-red.ts, src/team/team-polls.ts,
+ * merge-slot.ts, merge-questions.ts,
+ * src/redeploy/redeployer.ts). `supervisor_exit` is logged by the supervisor after the
+ * orchestrator is gone, so src/cli/cli-run.ts pages it directly with notifyTeamDown; events
+ * appended by
  * operator CLI commands go straight to the file and are out of scope by design.
  *
  * One knob, an opinionated fixed allowlist, no per-event selection — a command that can post
  * anywhere (a desktop notification, a webhook, a phone push) composes it with the environment
- * the harness hands it: TUMWATER_EVENT_TYPE, TUMWATER_EVENT_LOOP, and TUMWATER_EVENT_MESSAGE
+ * the harness hands it: TUMWATER_EVENT_TYPE, TUMWATER_EVENT_SOURCE, and TUMWATER_EVENT_MESSAGE
  * (the exact line `tumwater logs` renders, via formatEvent). */
 export const NOTIFY_EVENT_TYPES = [
     "budget_warning", // daily spend crossed 80% of the cap, gate still open — time to raise it or fix the fallback before the page below
     "role_cap_warning", // one role's own daily spend crossed 80% of its cap, still ticking — time to raise it before the page below
     "budget_paused", // spend cap hit with no usable free fallback — role loops are stopped
+    "claude_window_warning", // the claude.ai subscription window first reported allowed_warning — subscription claude seams still tick; the heads-up before the hold below
+    "claude_window_limited", // a rejected subscription window holds every subscription claude seam until it resets — the subscription team's binding stop
     "role_streak_paused", // the error-streak circuit breaker auto-paused a role
     "role_cap_paused", // the role's own daily cost cap is reached — it stops starting ticks
     "disk_low", // free space on the worktrees volume dropped below diskHoldGB — new work is held
-    "land_failed", // the landing slot finished without landing a change
-    "restart_blocked", // the self-redeploy for main is blocked and latched — the fleet is stuck behind it
-    "question_posted", // a landing posted a new QUESTIONS.md ## Open entry — only a human can answer it
+    "main_red_hold", // main's own check is red — every code loop is held until a fix lands
+    "merge_failed", // the merge slot finished without merging a change
+    "restart_blocked", // the self-redeploy for main is blocked and latched — the team is stuck behind it
+    "question_posted", // a merge posted a new QUESTIONS.md ## Open entry — only a human can answer it
+    "entry_refused", // a refusal note merged — the entry is held until a human or the director releases it
+    "supervisor_exit", // the supervisor gave up — the team is down; paged from the supervisor process by notifyTeamDown, since no orchestrator is left to hear it
 ];
-/** Same-type events within this gap spawn the command once, not once per event: a burst of
- * `land_failed` events pages once. Keyed per type, so one type's page never suppresses
+/** Same-type events within this gap spawn the command at most once per gap: a burst of
+ * `merge_failed` events pages once at once and once more when the gap ends, carrying the newest
+ * held event and how many were held. Keyed per type, so one type's page never suppresses
  * another's. */
 export const NOTIFY_MIN_GAP_MS = 60_000;
 /** The child environment the notify hook runs with: the three TUMWATER_EVENT_* variables over
  * the harness's own environment. One home for the variable names, shared by the notifier's
  * spawn and the `tumwater notify --test` diagnostic (src/cli/notify-command.ts), so the two
  * cannot drift on what a hook sees. */
-export function notifyCommandEnv(type, loop, message) {
+export function notifyCommandEnv(type, source, message) {
     return childEnv({
         TUMWATER_EVENT_TYPE: type,
-        TUMWATER_EVENT_LOOP: loop,
+        TUMWATER_EVENT_SOURCE: source,
         TUMWATER_EVENT_MESSAGE: message,
     });
 }
+/** What every notify-hook failure warning starts with. The writers below build their messages
+ * from it and `isNotifyFailure` recognizes them by it, so the doctor reader and the writer
+ * share one definition. */
+const NOTIFY_FAILURE_PREFIX = "notify command ";
+/** True for a warning that spawnNotifyCommand logged for a failed page. */
+export function isNotifyFailure(ev) {
+    return ev.type === "warning" && ev.source === TUMWATER_SOURCE && typeof ev.message === "string" && ev.message.startsWith(NOTIFY_FAILURE_PREFIX);
+}
+/** The warning for a notify hook that did not exit cleanly, or undefined for exit code 0.
+ * Pure, so the wording is testable without a spawn. */
+export function notifyExitWarning(type, code, signal) {
+    if (code === 0)
+        return undefined;
+    const hint = "check it with `tumwater notify --test`";
+    if (code === null)
+        return `${NOTIFY_FAILURE_PREFIX}was killed by ${signal} paging ${type} — ${hint}`;
+    return `${NOTIFY_FAILURE_PREFIX}exited with code ${code}${notifyExitGloss(code)} paging ${type} — ${hint}`;
+}
+/** The sh launch-failure gloss for a notify hook that could not start: 127 is sh's "command
+ * not found", 126 its "found but not executable" — most often the configured `notify` command
+ * is a typo or an uninstalled/non-executable binary, so a bare "code 127" hides the fix the
+ * gloss names. Shared by the notifier's warning (notifyExitWarning above) and `tumwater
+ * notify --test`'s diagnostic (src/cli/notify-command.ts) so both surfaces name the same fix
+ * for a hook that cannot launch. Any other code gets no gloss. */
+export function notifyExitGloss(code) {
+    return code === 127 ? " (command not found)" : code === 126 ? " (found but not executable)" : "";
+}
+/** Spawn the notify command for one event: detached with stdio ignored, so it outlives the
+ * caller, and never awaited. A failed spawn or a nonzero exit is one warning, never a throw. */
+function spawnNotifyCommand(root, command, event, suffix = "") {
+    try {
+        const child = spawn(command, [], {
+            shell: true,
+            env: notifyCommandEnv(event.type, event.source, stripTerminalControls(formatEvent(event)) + suffix),
+            stdio: "ignore",
+            detached: true,
+        });
+        child.unref();
+        // The shell itself could not start (spawn failed asynchronously — e.g. the command line
+        // exceeds the OS arg limit): one warning names it and the listener keeps working. A
+        // command that starts but exits nonzero is reported by the exit listener below.
+        child.on("error", (err) => {
+            warnEventBestEffort(root, TUMWATER_SOURCE, `${NOTIFY_FAILURE_PREFIX}could not start: ${err.message}`);
+        });
+        // After unref() this listener does not keep the process alive: a hook that outlives the
+        // caller logs nothing.
+        child.on("exit", (code, signal) => {
+            const message = notifyExitWarning(event.type, code, signal);
+            if (message)
+                warnEventBestEffort(root, TUMWATER_SOURCE, message);
+        });
+    }
+    catch (err) {
+        warnEventBestEffort(root, TUMWATER_SOURCE, `${NOTIFY_FAILURE_PREFIX}could not start: ${errorMessage(err)}`);
+    }
+}
+/** Page the configured notify command for the team going down. The supervisor process calls
+ * this directly, because the orchestrator generation that runs newNotifier is already gone.
+ * Reads the command fresh from tumwater.json; a missing or invalid file or an absent `notify`
+ * returns silently (the team-down cause may be that very file), and there is no throttle —
+ * the supervisor exits right after this one event. */
+export function notifyTeamDown(root, event) {
+    const { config } = loadConfigSafe(root);
+    const command = config?.notify;
+    if (typeof command !== "string" || command === "")
+        return;
+    spawnNotifyCommand(root, command, event);
+}
 /** Subscribe to this process's event feed and spawn the configured command for allowlisted
  * events. Fire-and-forget: the spawn is never awaited from the poll loop — the command runs
- * detached with stdio ignored, so it outlives whatever the orchestrator does next, and a
- * nonzero exit is the command's problem, not the fleet's. `"warning"` is deliberately not on
- * the allowlist, so a failed spawn's warning can never recurse into another spawn. */
+ * detached with stdio ignored, so it outlives whatever the orchestrator does next. A nonzero
+ * exit or kill is logged as one warning and the page is not retried. `"warning"` is
+ * deliberately not on the allowlist, so a failure warning can never recurse into another
+ * spawn. A same-type event inside the gap is held, not dropped: the newest one is paged when
+ * the gap ends (or at `dispose`), with a count of the others held with it. */
 export function newNotifier(root, minGapMs = NOTIFY_MIN_GAP_MS, 
 /** The throttle's clock — a test seam; production reads the wall clock. */
-now = Date.now) {
+now = Date.now, 
+/** Runs `fn` after `delayMs` and returns a cancel function — a test seam; production uses an
+ * unref'd timer so a held page never keeps the process alive. */
+schedule = (fn, delayMs) => {
+    const timer = setTimeout(fn, delayMs);
+    timer.unref();
+    return () => clearTimeout(timer);
+}) {
     let command;
     const lastSpawnAt = new Map();
+    const pending = new Map();
+    const flush = (type) => {
+        const entry = pending.get(type);
+        if (!entry)
+            return;
+        pending.delete(type);
+        if (typeof command !== "string" || command === "")
+            return;
+        lastSpawnAt.set(type, now());
+        const suffix = entry.held > 1 ? ` (and ${entry.held - 1} more ${type} event(s) in the same minute; \`tumwater logs\` lists them)` : "";
+        spawnNotifyCommand(root, command, entry.event, suffix);
+    };
     const unsubscribe = subscribeEvents((event) => {
         if (typeof command !== "string" || command === "")
             return;
@@ -63,32 +161,33 @@ now = Date.now) {
         const type = event.type;
         const at = now();
         const last = lastSpawnAt.get(type);
-        if (last !== undefined && at - last < minGapMs)
+        if (last !== undefined && at - last < minGapMs) {
+            const held = pending.get(type);
+            if (held) {
+                held.event = event;
+                held.held += 1;
+            }
+            else {
+                pending.set(type, { event, held: 1, cancel: schedule(() => flush(type), last + minGapMs - at) });
+            }
             return;
-        lastSpawnAt.set(type, at);
-        try {
-            const child = spawn(command, [], {
-                shell: true,
-                env: notifyCommandEnv(event.type, event.loop, stripTerminalControls(formatEvent(event))),
-                stdio: "ignore",
-                detached: true,
-            });
-            child.unref();
-            // The shell itself could not start (spawn failed asynchronously — e.g. the command line
-            // exceeds the OS arg limit): one warning names it and the listener keeps working. A
-            // command that starts but exits nonzero is not a harness concern and is ignored.
-            child.on("error", (err) => {
-                warnEventBestEffort(root, "harness", `notify command could not start: ${err.message}`);
-            });
-        }
-        catch (err) {
-            warnEventBestEffort(root, "harness", `notify command could not start: ${errorMessage(err)}`);
         }
+        // Past the gap: this event pages now and supersedes anything still held for the type.
+        pending.get(type)?.cancel();
+        pending.delete(type);
+        lastSpawnAt.set(type, at);
+        spawnNotifyCommand(root, command, event);
     });
     return {
         update(config) {
             command = config.notify;
         },
-        dispose: unsubscribe,
+        dispose() {
+            unsubscribe();
+            for (const [type, entry] of [...pending]) {
+                entry.cancel();
+                flush(type);
+            }
+        },
     };
 }

package/dist/src/failure/failure-cluster.js

@@ -1,6 +1,6 @@
 /** The cluster-key rules shared by everything that groups failure messages into causes: the
  * failure digest's collection (failure-data.ts) and the error-storm reducer
- * (src/fleet/error-storm.ts) both count by these keys, so the normalization, the two
+ * (src/team/error-storm.ts) both count by these keys, so the normalization, the two
  * tick-timeout shapes and their pooling, and the grouping engine live here rather than
  * inside either consumer. Pure string
  * and grouping logic — no event reads, no clock. */
@@ -12,7 +12,7 @@ import { cutSplitsSurrogatePair } from "../text/text.js";
 export const EXAMPLE_MAX = 120;
 /** The example and cluster key every message-less failure takes: errorTextOrPlaceholder
  * returns it for the digest's error clusters (failure-data.ts) and its loss ranking
- * (time-spend.ts), so a broken `tick_end` that skipped its error text reads the same on both
+ * (time-spend.ts), so a broken `run_end` that skipped its error text reads the same on both
  * surfaces. */
 const NO_ERROR_TEXT = "(no error text recorded)";
 /** The error text a failure event carries, or NO_ERROR_TEXT when it carries none — the field
@@ -49,7 +49,7 @@ export function truncateExample(message, max = EXAMPLE_MAX) {
  * array in ascending localeCompare order, so equal inputs always render identically no matter
  * the Set's insertion order. One home for the rule the failure digest's clusters
  * (clusterMessages) and loss causes (failure-data.ts) and the error-storm warning
- * (src/fleet/error-storm.ts) all share — an inline `.sort()` without the comparator would
+ * (src/team/error-storm.ts) all share — an inline `.sort()` without the comparator would
  * silently pick code-unit order instead and let the two rules drift. */
 export function sortedRoles(roles) {
     return [...roles].sort((a, b) => a.localeCompare(b));
@@ -78,7 +78,7 @@ export function normalizeClusterKey(message) {
 }
 /** normalizeClusterKey's rendering of the two tick-timeout errors src/agent/run-agent.ts emits —
  * the plain kill and the still-making-progress variant (session and worktree edits preserved
- * for resume, BUGS.md 2026-09-29). Both are one cause pointing at one knob (tickTimeoutSeconds),
+ * for resume, BUGS.md 2026-09-29). Both are one cause pointing at one knob (runTimeoutSeconds),
  * so every consumer that counts by cluster key pools them under the plain one. */
 export const TICK_TIMEOUT_KEY = "timed out after <dur>";
 const TICK_TIMEOUT_PROGRESSING_KEY = "timed out after <dur> while still making progress — session and worktree edits preserved for resume";
@@ -94,9 +94,9 @@ const TICK_TIMEOUT_PROGRESSING_REVIEW_KEY = "timed out after <dur> while still m
 export const TICK_TIMEOUT_PROGRESSING_REVIEW_RESUME_KEY = "timed out after <dur> while still making progress — the commit is kept; the next attempt continues this review";
 /** The known progressing-timeout wordings and the key each pools under. The two review
  * wordings name one cause on one knob (review.timeoutSeconds): a still-making-progress kill
- * pools into the plain tick-timeout row (a mixed fleet of plain and progressing kills is one
+ * pools into the plain tick-timeout row (a mixed team of plain and progressing kills is one
  * cause's agent-hours, not two half-size rows the top-N cut can drop — the same pooling the
- * error-storm reducer applies, src/fleet/error-storm.ts), and a resumed review's wording maps
+ * error-storm reducer applies, src/team/error-storm.ts), and a resumed review's wording maps
  * to itself, because continuing the timed-out session is a different cause from a from-scratch
  * re-review. Enumerated so a future wording edit lands in
  * this table rather than silently changing which row its timeouts count under. */
@@ -114,9 +114,10 @@ export function poolTimeoutKey(key) {
  * rides lastSeen: a cluster that outlived a config change labels itself with the message as
  * it happens now, not the retired value it first emitted (BUGS.md 2026-09-30). `keyPrefix`
  * scopes a cluster to something the message itself omits (rejections key on role too) without
- * polluting the verbatim example. Returns the top-N clusters plus how many fell past the cut,
+ * polluting the verbatim example. `urgent` marks messages that outrank the count.
+ * Returns the top-N clusters plus how many fell past the cut,
  * so the render can mark the truncation instead of presenting the survivors as the whole. */
-export function clusterMessages(messages, top) {
+export function clusterMessages(messages, top, urgent) {
     const drafts = new Map();
     for (const { message, role, ts, keyPrefix } of messages) {
         const key = `${keyPrefix ?? ""}${poolTimeoutKey(normalizeClusterKey(message))}`;
@@ -142,7 +143,9 @@ export function clusterMessages(messages, top) {
             });
         }
     }
-    const sorted = rankByCount(drafts.values(), (d) => d.count, (d) => d.key);
+    // Clusters whose example is `urgent` rank ahead of every other, whatever their count, so a
+    // once-per-window singleton survives the cut past recurring noise.
+    const sorted = rankByCount(drafts.values(), (d) => d.count + (urgent?.(d.example) ? Number.MAX_SAFE_INTEGER / 2 : 0), (d) => d.key);
     return {
         clusters: sorted.slice(0, top).map((d) => ({
             key: d.key,

package/dist/src/failure/failure-data.js

@@ -5,19 +5,34 @@ import { timeAndSpend } from "./time-spend.js";
 import { dayAt, dayKey, dayWindow, formatDate } from "../text/datetime.js";
 import { describeStateChange, STATE_CHANGE_TOP, STATE_CHANGE_TYPES } from "./failure-state-change.js";
 import { clusterMessages, errorTextOrPlaceholder, truncateExample } from "./failure-cluster.js";
-import { addTo, getOrCreate, rankByCount } from "../collections.js";
+import { addTo, getOrCreate, memoSetLru, rankByCount } from "../collections.js";
 import { firstReason } from "../text/phrases.js";
 import { sameStatIdentity, statOrNull } from "../files/files.js";
 import { nonNegativeNumber } from "../files/json-object.js";
 import { eventsLogPath } from "../paths.js";
 /** Caps that keep the digest bounded regardless of how bad the window was — the top-N
- * clusters, one trimmed example each, and the newest N landed commits. See the render-doc
+ * clusters, one trimmed example each, and the newest N merged commits. See the render-doc
  * byte bound below for what these buy. */
 const ERROR_TOP = 7;
 const WARNING_TOP = 7;
+/** Warnings that name a failing check or a stalled tool call. Each is a once-per-window
+ * singleton, so ranking by count alone lets recurring housekeeping lines push it out of the
+ * digest; these rank first. */
+const URGENT_WARNING = /^(?:landing check red|merge check failed|tool call stalled)/;
+/** The pre-07b2664a wording of the merge-check warning, pooled under the current one so a
+ * window spanning the reword counts one cause, not two. */
+const OLD_MERGE_CHECK_WORDING = /^landing check red \(kept for one re-land\)/;
 const REVIEW_FAILURE_TOP = 5;
 const REJECTION_TOP = 5;
-const LANDED_TOP = 10;
+/** Blocked merges are rare and each one is a signal, so the section gets its own cut, roomier
+ * than the other cluster sections'; the digest stays bounded and the render marks any clusters
+ * the cut hides. */
+const MERGE_FAILURE_TOP = 10;
+/** The cause text for a blocked or conflicted merge whose role logged no warning since its
+ * previous merge outcome — a block with no stated reason is a signal in itself, so it clusters
+ * on its own instead of hiding. */
+const NO_MERGE_REASON = "no reason recorded";
+const MERGED_TOP = 10;
 const SUMMARY_MAX = 100;
 /** Keep only events that belong to one base role, so a scoped digest aggregates instances
  * (`feature-2`) into their group exactly as `report --role` and the per-role cap do. Loop
@@ -44,21 +59,56 @@ function section(clustered, total) {
  * section does not render through it — its text lives on `error`, not `message`, with a
  * fallback phrase — and rejections key on reasons[0] and prefix their cluster keys, so both
  * keep their own blocks. */
-function messageSection(events, type, top) {
+function messageSection(events, type, top, urgent) {
     const selected = events.filter((ev) => ev.type === type && typeof ev.message === "string" && ev.message !== "");
-    return section(clusterMessages(selected.map((ev) => ({ message: ev.message, role: eventRole(ev), ts: ev.ts })), top), selected.length);
+    return section(clusterMessages(selected.map((ev) => ({ message: ev.message, role: eventRole(ev), ts: ev.ts })), top, urgent), selected.length);
+}
+/** The merge-failure section: each blocked or conflicted `merge_failed` clusters on
+ * (role, result, reason).
+ * `merge_failed` carries no message, so the reason is the same role's nearest preceding
+ * `warning` (a red merge check, a structure or fix-claim block) logged after that role's
+ * previous merge outcome; with none, the placeholder. The total counts every blocked or
+ * conflicted `merge_failed` in the window. */
+function mergeFailureSection(events) {
+    const ordered = [...events].sort((a, b) => a.ts - b.ts);
+    const lastWarning = new Map();
+    const messages = [];
+    let total = 0;
+    for (const ev of ordered) {
+        const role = eventRole(ev);
+        if (ev.type === "warning" && typeof ev.message === "string" && ev.message !== "") {
+            lastWarning.set(role, ev.message.replace(OLD_MERGE_CHECK_WORDING, "merge check failed (kept for one retry)"));
+        }
+        else if (ev.type === "merge_done") {
+            lastWarning.delete(role);
+        }
+        else if (ev.type === "merge_failed") {
+            const result = typeof ev.result === "string" ? ev.result : "";
+            // Rejected and review_error merges have their own sections; only a block or a conflict
+            // is unaccounted for here.
+            if (result !== "merge_blocked" && result !== "merge_conflict") {
+                lastWarning.delete(role);
+                continue;
+            }
+            total++;
+            const reason = lastWarning.get(role) ?? NO_MERGE_REASON;
+            lastWarning.delete(role);
+            messages.push({ message: `${result} — ${reason}`, role, ts: ev.ts, keyPrefix: `${role}\u0000` });
+        }
+    }
+    return section(clusterMessages(messages, MERGE_FAILURE_TOP), total);
 }
 function roleStats(events) {
     const byRole = new Map();
-    const statsFor = (role) => getOrCreate(byRole, role, () => ({ ticks: 0, errors: 0, quietKills: 0, rejections: 0 }));
+    const statsFor = (role) => getOrCreate(byRole, role, () => ({ runs: 0, errors: 0, quietKills: 0, rejections: 0 }));
     for (const ev of events) {
-        // Ticks are tick_end events; a rejection is now recorded by the landing slot, AFTER the
+        // Ticks are run_end events; a rejection is now recorded by the merge slot, AFTER the
         // authoring tick has already ended `queued` (plans/merge-queue.md 3/5). review_rejected is
         // the one event every reject path logs exactly once (src/review/review.ts), so it — not a
-        // tick_end result no production path emits — is the rejection source.
-        if (ev.type === "tick_end") {
+        // run_end result no production path emits — is the rejection source.
+        if (ev.type === "run_end") {
             const stats = statsFor(eventRole(ev));
-            stats.ticks++;
+            stats.runs++;
             if (ev.result === "error")
                 stats.errors++;
             else if (ev.result === "quiet_killed")
@@ -75,7 +125,7 @@ function roleStats(events) {
  * collector re-reads and re-parses up to 2× the window's log bytes each time (~4 MB on this
  * repo's own log, growing toward the rotation cap). An unchanged log and window cost one stat
  * and return the prior result; any change — an append, a rotation, or a new local day —
- * re-derives exactly as uncached. Mirrors report-data.ts's foldWindowEvents, which already
+ * re-derives exactly as uncached. Mirrors report-fold.ts's foldWindowEvents, which already
  * spares the usage report the same re-read. */
 const failureDigestCache = new Map();
 const FAILURE_DIGEST_CACHE_MAX = 8;
@@ -95,7 +145,7 @@ export function collectFailureReport(root, days, role) {
     const { from, to } = dayWindow(days, now);
     const priorFrom = formatDate(dayAt(days * 2 - 1, now));
     const base = role === undefined ? undefined : baseRoleOf(role);
-    // The base role rides the key, so a scoped and a fleet digest of the same log cannot
+    // The base role rides the key, so a scoped and a team digest of the same log cannot
     // collide in the memo.
     const key = `${root}\u0000${days}\u0000${base ?? ""}`;
     const stat = digestStat(root);
@@ -104,8 +154,7 @@ export function collectFailureReport(root, days, role) {
         cached.to === to &&
         cached.priorFrom === priorFrom &&
         sameStatIdentity(cached.stat, stat)) {
-        failureDigestCache.delete(key); // Refresh LRU position.
-        failureDigestCache.set(key, cached);
+        memoSetLru(failureDigestCache, key, cached, FAILURE_DIGEST_CACHE_MAX);
         return cached.data;
     }
     const { events, coversFullWindow, logState } = readWindowEvents(root, priorFrom);
@@ -121,12 +170,7 @@ export function collectFailureReport(root, days, role) {
             prior.push(ev);
     }
     const data = assembleFailureReport(current, prior, events, coversFullWindow, logState, { days, from, to }, role);
-    failureDigestCache.set(key, { from, to, priorFrom, stat, data });
-    if (failureDigestCache.size > FAILURE_DIGEST_CACHE_MAX) {
-        const oldest = failureDigestCache.keys().next().value;
-        if (oldest !== undefined)
-            failureDigestCache.delete(oldest);
-    }
+    memoSetLru(failureDigestCache, key, { from, to, priorFrom, stat, data }, FAILURE_DIGEST_CACHE_MAX);
     return data;
 }
 /** Collect the digest over the trailing `sinceMs` window ending now, partitioning the read into
@@ -164,7 +208,7 @@ export function collectFailureReportSince(root, sinceMs, role) {
  * exist twice. `window` carries the labels the render branches on. */
 function assembleFailureReport(currentRaw, priorRaw, allEventsRaw, coversFullWindow, logState, window, role) {
     // Scope first when a role was named: every section below derives from these partitions, so
-    // narrowing them at the source scopes outcomes, deltas, clusters, landings, and time/spend at
+    // narrowing them at the source scopes outcomes, deltas, clusters, merges, and time/spend at
     // once. The unfiltered read's first event is kept for the retention line, so a scoped partial
     // window still names when the log starts, not when the scoped role's own first tick does.
     const base = role === undefined ? undefined : baseRoleOf(role);
@@ -172,7 +216,7 @@ function assembleFailureReport(currentRaw, priorRaw, allEventsRaw, coversFullWin
     const prior = base === undefined ? priorRaw : scopeToRole(priorRaw, base);
     const allEvents = base === undefined ? allEventsRaw : scopeToRole(allEventsRaw, base);
     const oldestRetained = allEventsRaw.length > 0 ? eventDayKey(allEventsRaw[0]) : null;
-    const tickEvents = current.filter((ev) => ev.type === "tick_end");
+    const tickEvents = current.filter((ev) => ev.type === "run_end");
     // Outcome table: one row per role, counts per result that occurred.
     const outcomeMap = new Map();
     for (const ev of tickEvents) {
@@ -186,11 +230,11 @@ function assembleFailureReport(currentRaw, priorRaw, allEventsRaw, coversFullWin
     // reverse-alphabetical order; equal-total roles now follow the stated deterministic rule
     // (pinned by the tie test in test/failure-render.test.ts).
     const outcomes = rankByCount([...outcomeMap.entries()].map(([role, counts]) => ({ role, counts })), (row) => total(row.counts), (row) => row.role);
-    // Time and spend: the same ticks priced by wall-clock span and cost, per role × outcome
+    // Time and spend: the same runs priced by wall-clock span and cost, per role × outcome
     // class, plus the loss ranking that weighs causes by agent-hours rather than tick counts.
     const { timeSpend, lossCauses, lossCausesHidden } = timeAndSpend(tickEvents, allEvents);
     // Prompt-token telemetry: per role, the median prompt tokens a tick sent and how much of
-    // the prompt budget went out before the first edit. Only ticks carrying the field count, so
+    // the prompt budget went out before the first edit. Only runs carrying the field count, so
     // a pre-feature log leaves the section off entirely.
     const promptStats = promptStatsFor(tickEvents);
     // Deltas: current vs preceding window, per role.
@@ -199,12 +243,12 @@ function assembleFailureReport(currentRaw, priorRaw, allEventsRaw, coversFullWin
     const roles = [...new Set([...curStats.keys(), ...prevStats.keys()])];
     const deltas = roles
         .map((role) => {
-        const c = curStats.get(role) ?? { ticks: 0, errors: 0, quietKills: 0, rejections: 0 };
-        const p = prevStats.get(role) ?? { ticks: 0, errors: 0, quietKills: 0, rejections: 0 };
+        const c = curStats.get(role) ?? { runs: 0, errors: 0, quietKills: 0, rejections: 0 };
+        const p = prevStats.get(role) ?? { runs: 0, errors: 0, quietKills: 0, rejections: 0 };
         return {
             role,
-            prevTicks: p.ticks,
-            ticks: c.ticks,
+            prevRuns: p.runs,
+            runs: c.runs,
             prevErrors: p.errors,
             errors: c.errors,
             prevQuietKills: p.quietKills,
@@ -213,18 +257,18 @@ function assembleFailureReport(currentRaw, priorRaw, allEventsRaw, coversFullWin
             rejections: c.rejections,
         };
     })
-        .sort((a, b) => b.ticks - a.ticks ||
-        b.prevTicks - a.prevTicks ||
+        .sort((a, b) => b.runs - a.runs ||
+        b.prevRuns - a.prevRuns ||
         a.role.localeCompare(b.role));
-    // Only ticks that ENDED as errors carry a tick error: `state.lastError` is shared state the
-    // lander also writes, so a successful tick's `tick_end` can carry a leftover landing failure's
+    // Only runs that ENDED as errors carry a tick error: `state.lastError` is shared state the
+    // merge slot also writes, so a successful tick's `run_end` can carry a leftover merge failure's
     // text (BUGS.md 2026-09-21). `main_red` joins them because its cause is written for that result
     // — the baseline gate's own text (src/baseline/main-red.ts), never a leftover — so the
     // section itemizes the outcome that blocks every merge instead of leaving it a bare count
     // (BUGS.md 2026-09-28). The total therefore equals the Outcome table's error column PLUS its
-    // main_red cells; the render's section title says so, and landing failures still surface below.
+    // main_red cells; the render's section title says so, and merge failures still surface below.
     // The selection predicate is the Outcome table's own — raw `error`/`main_red` results, no
-    // error-text test — so a malformed tick_end that skipped the text can never be counted above
+    // error-text test — so a malformed run_end that skipped the text can never be counted above
     // but itemized nowhere: those events cluster under a placeholder cause, keeping the section's
     // total equal to the tables it cross-checks against (BUGS.md 2026-09-30).
     const errorEvents = tickEvents.filter((ev) => ev.result === "error" || ev.result === "main_red");
@@ -233,7 +277,9 @@ function assembleFailureReport(currentRaw, priorRaw, allEventsRaw, coversFullWin
         role: eventRole(ev),
         ts: ev.ts,
     })), ERROR_TOP), errorEvents.length);
-    const warnings = messageSection(current, "warning", WARNING_TOP);
+    const warnings = messageSection(current.map((ev) => ev.type === "warning" && typeof ev.message === "string"
+        ? { ...ev, message: ev.message.replace(OLD_MERGE_CHECK_WORDING, "merge check failed (kept for one retry)") }
+        : ev), "warning", WARNING_TOP, (m) => URGENT_WARNING.test(m));
     // Rejections cluster on (role, reasons[0]) — the field the event feed renders — so two
     // different rejection reasons from the same role stay separate rows. The section's total
     // counts every `review_rejected` in the window, reasons or not, so it equals the Deltas
@@ -245,16 +291,17 @@ function assembleFailureReport(currentRaw, priorRaw, allEventsRaw, coversFullWin
         const reasons = ev.reasons;
         return { message: firstReason(reasons), role: eventRole(ev), ts: ev.ts, keyPrefix: `${eventRole(ev)}\u0000` };
     }), REJECTION_TOP), rejectedEvents.length);
-    // Landing review failures: a reviewer that could not return a parseable verdict (a dead
+    const mergeFailures = mergeFailureSection(current);
+    // Merge review failures: a reviewer that could not return a parseable verdict (a dead
     // backend, a transport error) fails closed and keeps the commit, but its authoring tick ends
     // `queued`/`no_change` — so the failure lives on the `review_failed` event, never on
-    // `tick_end.error`. Clustered on their own so the telemetry role can see a gate that keeps
+    // `run_end.error`. Clustered on their own so the telemetry role can see a gate that keeps
     // failing without misreading it as a tick error (BUGS.md 2026-09-21).
     const reviewFailures = messageSection(current, "review_failed", REVIEW_FAILURE_TOP);
-    // The newest LANDED_TOP merges, newest first. The pre-slice count rides along, as it does for
+    // The newest MERGED_TOP merges, newest first. The pre-slice count rides along, as it does for
     // the state changes below, so the render can name what the cut left out — a busy window must
-    // not read as a LANDED_TOP-merge day (BUGS.md 2026-09-23).
-    const allLanded = current
+    // not read as a MERGED_TOP-merge day (BUGS.md 2026-09-23).
+    const allMerged = current
         .filter((ev) => ev.type === "merged")
         .map((ev) => ({
         ts: ev.ts,
@@ -262,7 +309,7 @@ function assembleFailureReport(currentRaw, priorRaw, allEventsRaw, coversFullWin
         summary: typeof ev.summary === "string" ? truncateExample(ev.summary, SUMMARY_MAX) : "",
     }))
         .sort((a, b) => b.ts - a.ts);
-    const landed = allLanded.slice(0, LANDED_TOP);
+    const merged = allMerged.slice(0, MERGED_TOP);
     // The harness's own decisions, newest STATE_CHANGE_TOP kept in chronological order. The
     // description is bounded at collection so render stays a pure function of this data. The
     // pre-slice count rides along so the render can say when it is showing a cut, not all of them.
@@ -289,7 +336,7 @@ function assembleFailureReport(currentRaw, priorRaw, allEventsRaw, coversFullWin
     return {
         ...window,
         ...(base === undefined ? {} : { role: base }),
-        ticks: tickEvents.length,
+        runs: tickEvents.length,
         hasEvents,
         emptyLog: !hasEvents && !coversFullWindow,
         logState,
@@ -305,8 +352,9 @@ function assembleFailureReport(currentRaw, priorRaw, allEventsRaw, coversFullWin
         warnings,
         reviewFailures,
         rejections,
-        landed,
-        landedTotal: allLanded.length,
+        mergeFailures,
+        merged,
+        mergedTotal: allMerged.length,
         stateChanges,
         stateChangesTotal: allStateChanges.length,
     };
@@ -317,15 +365,15 @@ function median(values) {
     const mid = Math.floor(sorted.length / 2);
     return sorted.length % 2 === 0 ? (sorted[mid - 1] + sorted[mid]) / 2 : sorted[mid];
 }
-/** Per-role prompt-token stats from the window's tick_end events. Ticks without a
+/** Per-role prompt-token stats from the window's run_end events. Ticks without a
  * `promptTokens` reading contribute nothing (and skip a role entirely), so the section only
  * appears once some tick ran on a build that records the field. Both reads go through
  * nonNegativeNumber like every other event-log number: a torn or hand-edited line whose
  * `promptTokens` is `1e999` (JSON parses to Infinity) would otherwise land in the median and
  * the `preEditSum / promptSum` ratio as a non-finite value no report can render. */
-function promptStatsFor(ticks) {
+function promptStatsFor(runs) {
     const byRole = new Map();
-    for (const ev of ticks) {
+    for (const ev of runs) {
         const prompt = nonNegativeNumber(ev.promptTokens, 0);
         const preEdit = nonNegativeNumber(ev.preEditPromptTokens, 0);
         if (prompt === 0 && preEdit === 0)
@@ -342,7 +390,7 @@ function promptStatsFor(ticks) {
         .filter(([, acc]) => acc.promptSum > 0)
         .map(([role, acc]) => ({
         role,
-        ticks: acc.prompts.length,
+        runs: acc.prompts.length,
         medianPromptTokens: median(acc.prompts),
         preEditShare: acc.preEditSum / acc.promptSum,
     }))