tumwater 0.3.0 → 0.4.0

package/dist/src/backlog/backlog-parts.js

@@ -4,32 +4,37 @@
 import { collapseWhitespace } from "../text/text.js";
 import { openParenthetical, trailingParenthetical } from "./backlog-md.js";
 import { stripEntryStamp } from "./backlog-structure.js";
-/** One prerequisite ref, resolved against the entry's own series when it names none. */
-function parseRef(chunk, ownSeries) {
+/** One prerequisite chunk: its refs resolved against `fallbackSeries` (the last series the clause
+ * named, or the entry's own when it named none), and the series this chunk names — null when it
+ * names none (a bare `parts a/n` inherits the surrounding clause's series). The series keyword
+ * `parts`/`part` belongs to neither a named series nor the bare ref, so a trailing one is dropped
+ * from a captured name. */
+function parseRef(chunk, fallbackSeries) {
     const text = chunk.trim().replace(/^parts?\s+/i, "");
     if (text === "")
-        return [];
+        return { refs: [], named: null };
     const m = /^(?:([\s\S]+?)\s+)?([0-9]+[a-z]?)\/(\d+)(?:\s*[–-]\s*(\d+)\/(\d+))?$/i.exec(text);
     if (m === null)
-        return [];
-    const series = (m[1]?.trim() ?? "") || ownSeries;
+        return { refs: [], named: null };
+    let named = (m[1]?.trim() ?? "").replace(/\s+parts?$/i, "");
+    const series = named || fallbackSeries;
     if (series === null || series === "")
-        return [];
+        return { refs: [], named: named || null };
     const of = Number(m[3]);
     const start = m[2].toLowerCase();
     if (!Number.isInteger(of) || of < 1)
-        return [];
+        return { refs: [], named: named || null };
     if (m[4] === undefined)
-        return [{ series, part: start, of }];
+        return { refs: [{ series, part: start, of }], named: named || null };
     // A range is numeric on both ends (the lettered parts never range); expand it inclusively.
     const from = Number(start);
     const to = Number(m[4]);
     if (!Number.isInteger(from) || !Number.isInteger(to) || to < from)
-        return [];
+        return { refs: [], named: named || null };
     const parts = [];
     for (let p = from; p <= to; p++)
         parts.push({ series, part: String(p), of });
-    return parts;
+    return { refs: parts, named: named || null };
 }
 /** The stable identity of an entry heading: its `(planned …)`/`(done …)` stamp suffix
  * removed through the shared stripEntryStamp, whitespace collapsed, lowercased. Adding a
@@ -140,8 +145,13 @@ export function requiredParts(title) {
         return [];
     const ownSeries = seriesPart(title)?.series ?? null;
     const refs = [];
-    for (const chunk of clause.split(/\s*,\s*|\s+and\s+/i))
-        refs.push(...parseRef(chunk, ownSeries));
+    let lastNamed = null;
+    for (const chunk of clause.split(/\s*,\s*|\s+and\s+/i)) {
+        const { refs: chunkRefs, named } = parseRef(chunk, lastNamed ?? ownSeries);
+        if (named !== null)
+            lastNamed = named;
+        refs.push(...chunkRefs);
+    }
     return refs;
 }
 /** The ref text a heading's `requires <refs> landed` clause captures — read from the trailing
@@ -198,7 +208,7 @@ export function planDependencyProblems(planned, doneTitles) {
             meta = openParenthetical(entry.title);
         const held = new Set(refs.map((ref) => partKey(ref.series, ref.part)));
         for (const m of meta.matchAll(MISWORDED_DEPENDENCY_RE)) {
-            for (const ref of parseRef(m[1], own.series)) {
+            for (const ref of parseRef(m[1], own.series).refs) {
                 const key = partKey(ref.series, ref.part);
                 if (!plannedKeys.has(key) || held.has(key))
                     continue;

package/dist/src/backlog/backlog-release.js

@@ -11,22 +11,37 @@ import { readTextIfExists, writeTextAtomic } from "../files/files.js";
 import { fail } from "../cli/cli-output.js";
 import { trimTrailingBlankLines } from "../text/text.js";
 import { withPrimaryWorktreeLock } from "../concurrency/lock.js";
-/** Drop the Refused note from `entry`'s slice of `lines`, in place; an entry with none loses its
- * Waiting-for-the-next-failure note instead, and one with neither loses its held-for-operator
- * Needs-review/Needs-replan note (the `(held N)` count at/above threshold, plus its
- * **Previously held N** line). False (and `lines` untouched) when the entry carries none of the
- * three, shared by releaseEntry and tryReleaseEntry so they cannot drift. */
+/** The prose naming the note `lifted` kind a release removed, shared by the CLI, TUI and the
+ * exit-announcers so their released lines cannot drift. */
+export function liftedNotePhrase(lifted) {
+    return lifted === "refused"
+        ? "the Refused note"
+        : lifted === "waiting-for-failure"
+            ? "the Waiting-for-the-next-failure note"
+            : "the held-for-operator note"; // vocabulary-ok: the held-for-operator note's release wording
+}
+/** Drop the Refused note from `entry`'s slice of `lines`, in place, and return its kind; an
+ * entry with none loses its Waiting-for-the-next-failure note instead, and one with neither
+ * loses its held-for-operator Needs-review/Needs-replan note (the `(held N)` count at/above
+ * threshold, plus its **Previously held N** line). Null (and `lines` untouched) when the entry
+ * carries none of the three, shared by releaseEntry and tryReleaseEntry so they cannot drift. */
 function liftRefusal(lines, entry) {
     const slice = lines.slice(entry.start - 1, entry.end);
     let kept = withoutRefusalNotes(slice);
-    if (kept.length === slice.length)
+    if (kept.length === slice.length) {
         kept = withoutWaitingNotes(slice);
-    if (kept.length === slice.length)
-        kept = withoutHeldForOperatorNotes(slice);
-    if (kept.length === slice.length)
-        return false;
+        if (kept.length === slice.length) {
+            kept = withoutHeldForOperatorNotes(slice);
+            if (kept.length === slice.length)
+                return null;
+            lines.splice(entry.start - 1, slice.length, ...kept);
+            return "held-for-operator"; // vocabulary-ok: the held-for-operator note's release wording
+        }
+        lines.splice(entry.start - 1, slice.length, ...kept);
+        return "waiting-for-failure";
+    }
     lines.splice(entry.start - 1, slice.length, ...kept);
-    return true;
+    return "refused";
 }
 /** The non-exiting release the dashboard calls: releaseEntry's splice with tryCancelEntry's
  * title check, all decided inside the lock. */
@@ -41,25 +56,27 @@ export function tryReleaseEntry(root, kind, n, expectedTitle) {
         if (entry.title !== expectedTitle)
             return { status: "moved", title: entry.title };
         const lines = md.split("\n");
-        if (!liftRefusal(lines, entry))
+        const lifted = liftRefusal(lines, entry);
+        if (lifted === null)
             return { status: "not_refused", title: entry.title };
         writeTextAtomic(file, lines.join("\n"));
-        return { status: "released", file: fileName, title: entry.title };
+        return { status: "released", file: fileName, title: entry.title, lifted };
     });
 }
 /** Lift the Refused, Waiting for the next failure, or held-for-operator note from the
  * `n`th entry (1-based, as `--list` numbers them) of the kind's open section and write the
- * file, under the same lock the cancel and edit writers hold.
+ * file, under the same lock the cancel and edit writers hold, returning which hold it lifted.
  * An out-of-range position fails with locateEntry's wording; an entry with neither note
  * fails too, writing nothing. */
 export function releaseEntry(root, kind, n) {
     const { fileName, sectionTitle } = backlogTarget(kind);
     return withPrimaryWorktreeLock(root, () => {
         const { file, lines, entry } = readEntryLines(root, fileName, sectionTitle, n);
-        if (!liftRefusal(lines, entry))
+        const lifted = liftRefusal(lines, entry);
+        if (lifted === null)
             fail(`${kind} #${n} "${entry.title}" carries no Refused, Waiting for the next failure, or held-for-operator note`); // vocabulary-ok: the held-for-operator note's release wording
         writeTextAtomic(file, lines.join("\n"));
-        return { file: fileName, title: entry.title };
+        return { file: fileName, title: entry.title, lifted };
     });
 }
 /** Move the `n`th entry (1-based, as `--list` numbers them) of the kind's open section to the

package/dist/src/baseline/main-guardrails.js

@@ -113,78 +113,6 @@ export function quarantineWarning(entries, now) {
     }
     return phrases.length > 0 ? phrases.join("; ") : null;
 }
-/** How many `main_revert` events in the trailing 24 h the doctor and digest warn once the
- * daily ceiling is passed (G2's rate test): a burst of reverts reads like a flaky-revert
- * habit, distinct from a single false revert. */
-export const REVERT_RATE_LIMIT = 5;
-/** One `main_revert` in the last 24 h looks false when either G2 test holds — its failure did
- * not reproduce (a test it names has been quarantined at or since the revert, or a later
- * `main_check`'s `quarantined` list names it), or its change came back unchanged and main
- * stayed green (a later `merged` event carries the culprit's patch-id, and the first
- * `main_check` after that merge which actually ran the check passed). */
-function revertLooksFalse(r, events, quarantine) {
-    const rts = typeof r.ts === "number" ? r.ts : 0;
-    const tests = Array.isArray(r.failingTests)
-        ? r.failingTests.filter((t) => typeof t === "string")
-        : [];
-    const firstTest = tests[0];
-    // Did not reproduce: the named test is quarantined at or since the revert, or a later
-    // main_check's `quarantined` list names it (src/baseline/main-watch.ts records a red naming
-    // only quarantined flaky tests as passed there).
-    if (firstTest !== undefined &&
-        (quarantine.some((q) => q.test === firstTest && q.lastSeen >= rts) ||
-            events.some((e) => e.type === "main_check" &&
-                typeof e.ts === "number" &&
-                e.ts >= rts &&
-                Array.isArray(e.quarantined) &&
-                e.quarantined.includes(firstTest))))
-        return "quarantined";
-    // Came back unchanged and main stayed green: a later `merged` carries this revert's
-    // patch-id, and the first `main_check` after that merge which ran the check passed.
-    const patch = typeof r.patchId === "string" ? r.patchId : undefined;
-    if (patch === undefined)
-        return null;
-    const remerged = events.find((e) => e.type === "merged" && e.patchId === patch && typeof e.ts === "number" && e.ts >= rts);
-    if (remerged === undefined)
-        return null;
-    const rmTs = typeof remerged.ts === "number" ? remerged.ts : 0;
-    const after = events
-        .filter((e) => e.type === "main_check" &&
-        typeof e.ts === "number" &&
-        e.ts >= rmTs &&
-        typeof e.durationMs === "number" &&
-        e.durationMs > 0)
-        .sort((a, b) => a.ts - b.ts)[0];
-    return after?.status === "passed" ? "remerged" : null;
-}
-/** G2 over `events` and the quarantine list: warns on a `main_revert` in the trailing 24 h that
- * looks false, and on more than REVERT_RATE_LIMIT reverts a day. The detail names each
- * false-looking revert (culprit sha and which test failed / that it landed again unchanged)
- * and the count when over the rate limit. Returns the phrases that fire (empty when none do). */
-export function revertWarnings(events, quarantine, now) {
-    const cutoff = now - DAY_MS;
-    const reverts = events.filter((e) => e.type === "main_revert" && typeof e.ts === "number" && e.ts >= cutoff);
-    if (reverts.length === 0)
-        return [];
-    const phrases = [];
-    if (reverts.length > REVERT_RATE_LIMIT) {
-        phrases.push(`${reverts.length} reverts in the last 24 h — over the ${REVERT_RATE_LIMIT}-revert ceiling`);
-    }
-    for (const r of reverts) {
-        const culprit = typeof r.commit === "string" ? r.commit : typeof r.sha === "string" ? r.sha : "";
-        const reason = revertLooksFalse(r, events, quarantine);
-        if (reason === "quarantined") {
-            const tests = Array.isArray(r.failingTests)
-                ? r.failingTests.filter((t) => typeof t === "string")
-                : [];
-            phrases.push(`revert ${shortSha(culprit)} blamed ${squash(tests[0] ?? "", 60)}, which has been quarantined since — the failure did not reproduce`);
-        }
-        else if (reason === "remerged") {
-            phrases.push(`revert ${shortSha(culprit)}'s change merged again unchanged and main stayed green — the revert looks false`);
-        }
-    }
-    return phrases;
-}
 /** Both guardrail phrases that fire for `root`, reading the trailing 24 h of the event log and
  * quarantine.json, oldest-test text bounded as the doctor rows are. */
 export function guardrailWarnings(root, now = Date.now()) {
@@ -197,7 +125,6 @@ export function guardrailWarnings(root, now = Date.now()) {
     const qw = quarantineWarning(q, now);
     if (qw !== null)
         warnings.push(qw);
-    warnings.push(...revertWarnings(events, q, now));
     return warnings;
 }
 /** "40 min", "3 h" — the duration a red main's warning names. */

package/dist/src/baseline/main-red.js

@@ -1,4 +1,4 @@
-import { baselineBlocked, BUGFIX_ROLE } from "../roles/roles.js";
+import { baselineBlocked } from "../roles/roles.js";
 import { baseRoleOf } from "../roles/runner-ids.js";
 import { enqueueRolePrompt } from "../inbox/inbox.js";
 import { isCustomRole, liveConfig } from "../config/config.js";
@@ -35,7 +35,7 @@ import { ensureDetachedWorktree } from "../git/worktree.js";
 let lastMainRedSha = null;
 /** The key of the last failing set the healer was sent a prompt for: the sorted failing test
  * names, or the red SHA when the red names none. Two red commits with the same failing set send
- * one heal prompt, not one per commit; a green main observed by the gate or the bugfix handoff
+ * one heal prompt, not one per commit; a green main observed by the gate or the ci handoff
  * clears it, so a set that returns after green is healed again. */
 let lastHealKey = null;
 /** The failing tests a red verdict names, when the list is complete — non-empty and short of
@@ -54,11 +54,11 @@ function redMainMessage(red, action) {
 }
 /** Log the team-wide `main_red_hold` event (the notify hook pages it) for `red`'s SHA at
  * most once per process, and hand the red suite to the healer. Module-level (with
- * lastMainRedSha) so the gate and the bugfix handoff share one guard: whichever observes the
+ * lastMainRedSha) so the gate and the ci handoff share one guard: whichever observes the
  * red first logs it, the other stays silent. `foundBy` is the role whose path verified the
- * red — when that role is not bugfix itself, one prompt is enqueued to bugfix's own inbox so
+ * red — when that role is not ci itself, one prompt is enqueued to ci's own inbox so
  * the healer runs on the orchestrator's next poll instead of waiting out its own interval or
- * deferral; bugfix finding its own red skips the enqueue because its running run already
+ * deferral; ci finding its own red skips the enqueue because its running run already
  * carries the note and IS the heal (and enqueuing from inside it would queue a second run). A
  * queued per-role prompt makes the role due by itself (`isEligible`, scheduling.ts, returns
  * `{ run: true, reason: "inbox" }` on a non-empty inbox before any interval, backoff, or
@@ -80,9 +80,9 @@ function warnMainRedOnce(root, red, foundBy) {
             ? `${mainRedPhrase(red.sha)} (${plural(named.length, "failing test")}: ${clipToWidth(named[0] ?? "", 80)}${named.length > 1 ? `, +${named.length - 1} more` : ""}); changes that add no new failures still merge`
             : redMainMessage(red, "code merges blocked until main is green"),
     });
-    // Bugfix is the only repairer, and it is exempt from mainRedGate — but it is a work role
-    // that with no open bugs defers like a maintenance role, so a red main discovered by any
-    // other path could sit unrepaired until bugfix's own interval or a coincidental wake.
+    // The ci role is the healer, and it is exempt from mainRedGate but schedules as an observer,
+    // so a red main discovered by any other path could sit unrepaired until ci's own interval or
+    // a coincidental wake.
     // Queue the heal: one prompt per newly-verified red SHA per process (a restart re-queues
     // once, desirable because the cache is cold then too). With named failures the key is the
     // failing set, so a second red commit with the same failures queues nothing.
@@ -90,24 +90,24 @@ function warnMainRedOnce(root, red, foundBy) {
     if (lastHealKey === healKey)
         return;
     lastHealKey = healKey;
-    if (baseRoleOf(foundBy) !== BUGFIX_ROLE) {
+    if (baseRoleOf(foundBy) !== "ci") {
         try {
-            enqueueRolePrompt(root, BUGFIX_ROLE, mainRedHealPrompt(red.sha));
+            enqueueRolePrompt(root, "ci", mainRedHealPrompt(red.sha));
         }
         catch (err) {
             // Clear the key so a later verification retries the heal. lastMainRedSha stays set, so a
             // second call for this same SHA still returns early: the retry comes with the next red
             // SHA or a fresh process.
             lastHealKey = null;
-            warnEventBestEffort(root, foundBy, `could not queue the heal prompt for bugfix: ${errorMessage(err)}`);
+            warnEventBestEffort(root, foundBy, `could not queue the heal prompt for ci: ${errorMessage(err)}`);
         }
     }
 }
-/** The one-line, self-limiting directive queued for the bugfix healer when a non-bugfix path
+/** The one-line, self-limiting directive queued for the ci healer when a non-ci path
  * newly verifies a red main. It names the short SHA the check was reported red at, tells the
  * healer to verify main is green now, and to reproduce and land the fix only if it is still
  * red. The self-limiting wording is the green race's whole handling: if main turned green
- * before the healer consumes the prompt, bugfixMainRedNote returns undefined (no `<main-red>`
+ * before the healer consumes the prompt, mainRedHealNote returns undefined (no `<main-red>`
  * note is appended) and the "verify green" clause makes the run a no-op. */
 export function mainRedHealPrompt(sha, detail) {
     const base = `Main was reported red at commit ${shortSha(sha)}. Verify main is green now; if it is still red, reproduce the failure and land the fix.`;
@@ -117,28 +117,38 @@ export function mainRedHealPrompt(sha, detail) {
     const tail = detail.outputTail && detail.outputTail.length > 0 ? ` Output tail: ${detail.outputTail.join(" | ")}` : "";
     return `${base} The watch named ${shortSha(detail.culprit)} as the commit that turned it red.${tests}${tail}`;
 }
-/** Queue the heal prompt for bugfix with the culprit's detail: the fallback when the automatic
- * revert (src/baseline/main-revert.ts) is skipped or fails. */
+/** Queue the heal prompt for ci with the culprit's detail: the one way a named red-main culprit
+ * is answered (Forward, never back, part 4/6): the watch's onCulprit hand-off routes through
+ * this, and nothing is ever reverted. (The ci gate's own red-main hand-off is the separate
+ * direct `enqueueRolePrompt` in warnMainRedOnce.) Never throws: a prompt that cannot be
+ * queued (an unwritable inbox) is warned, like that hand-off guard in warnMainRedOnce — so
+ * the watch's onCulprit (whose caller discards the result) cannot derail a watch run or end
+ * the orchestrator. */
 export function queueCulpritHeal(root, tip, detail) {
-    enqueueRolePrompt(root, BUGFIX_ROLE, mainRedHealPrompt(tip, detail));
+    try {
+        enqueueRolePrompt(root, "ci", mainRedHealPrompt(tip, detail));
+    }
+    catch (err) {
+        warnEventBestEffort(root, TUMWATER_SOURCE, `could not queue the heal prompt for ci: ${errorMessage(err)}`);
+    }
 }
 /** checkMainBaseline's per-run hook: log the one run per SHA (cache misses only) under the role
  * that paid for it, with its duration — the gate's build_check sibling, so both halves of the
  * team's deterministic verification are priced in the feed. The one logger for every baseline
- * check this module runs — the bugfix handoff, the authoring gate, and mainTipVerdict's tip
+ * check this module runs — the ci handoff, the authoring gate, and mainTipVerdict's tip
  * check (which review.ts's gate and merge-check-failures.ts's attributeRedCheck reach
  * through it) — so the event's shape cannot drift between them. */
 export function baselineCheckLogger(root, role) {
     return baselineCheckEventLogger(role, (event) => logEventBestEffort(root, event));
 }
-/** Red-main handoff for the `bugfix` healer: mainRedGate exempts
- * bugfix so the only role that can unblock the team may author, but its prompt then starts from
- * BUGS.md and knows nothing about the red suite. This runs the same per-SHA baseline check
+/** Red-main handoff for the `ci` healer: mainRedGate exempts
+ * ci so the only role that can unblock the team may author, but its prompt then starts from
+ * its own queue and knows nothing about the red suite. This runs the same per-SHA baseline check
  * (cache and provisional-red re-verification reused unchanged, so it costs at most the one run
  * the gate would have paid for) and, when main is red, returns the note that points the healer
  * at the failure. Returns undefined on green, no declared check, or an environmental skip — the
  * healer's run then proceeds exactly as it did before this existed. Never throws. */
-export async function bugfixMainRedNote(root, role, wt) {
+export async function mainRedHealNote(root, role, wt) {
     // The declared check is detected through the live config (plans/portability.md §6/7); a
     // broken file degrades to defaults, which declare none — the run then proceeds as before.
     const config = liveConfig(root);

package/dist/src/baseline/main-watch.js

@@ -1,15 +1,18 @@
 import { checkMainBaseline } from "./main-baseline.js";
-import { findRedCulprit } from "./main-culprit.js";
 import { baselineCheckLogger, withMainTipWorktree } from "./main-red.js";
 import { CHECK_TIER } from "../concurrency/check-permit.js";
 import { FAILING_TESTS_MAX } from "../build/build-check-report.js";
 import { detectBuildCheck } from "../build/build-check-detect.js";
-import { gitTry } from "../git/git-run.js";
+import { git, gitTry } from "../git/git-run.js";
 import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { errorMessage } from "../text/text.js";
 import { fileQuarantineBugsOnMain } from "../backlog/backlog-archive.js";
 import { loadQuarantine, markQuarantineFiled, onlyQuarantined, quarantinedTests, quarantineTests, releaseQuarantine, } from "../review/known-flakes.js";
 import { shortSha } from "../text/format.js";
+import { treeDiffFiles } from "../git/git-diff.js";
+import { mergingRoleOf } from "../events/event-read.js";
+import { isExemptDiff } from "../review/exemptions.js";
+import { diffRuleReasons } from "../review/diff-rules.js";
 /** The failing tests of each root's newest watch verdict, keyed by root. */
 const knownFailures = new Map();
 /** Main's known failures: the failing tests of the watch's newest verdict — main's tip, or the
@@ -73,8 +76,57 @@ export function createMainWatch(root, mainBranch, onCulprit) {
         }
     }
     async function watchOnce(mainHead, config) {
+        // The deterministic diff rules ("Every commit is verified on main, part 1/3"): run the same
+        // five checks the gate runs on a change, against main's new tip. A rule failure is a
+        // deterministic red — it takes no confirming re-run and never quarantines — reported as a
+        // warning naming the rule and the head (and each committing role, when a recent merged event
+        // names one). It runs on every tip the watch covers in a poll — a build green, a build
+        // red, and a head with no verdict (a skipped or sleep-spanned check) or no declared build
+        // check at all — because a tip counts as watched (lastWatched) either way, so this is the one
+        // chance to judge its diff before the next head moves.
+        const watchRules = async (wt, base, tip) => {
+            // Judge each first-parent commit in the range by its own diff and its own merged-event role,
+            // not the tip's: a multi-commit range's union diff attributed to whichever role merged the
+            // tip would report a legitimate director/steward PRINCIPLES.md edit in an intermediate commit
+            // as unauthorized by the role that merged later. base is undefined only before the first
+            // watched head, when the range is the tip's own commit.
+            //
+            // The diff rules read the change's "head" side from the worktree (conflict markers,
+            // brief/protected-file content, secrets, backlog structure) against a base revision, so the
+            // mirror checkout must sit ON the commit being judged — not on the tip — or an intermediate
+            // commit would be compared against the tip's content of its touched files rather than its
+            // own. The range is walked oldest-first and ends back on the tip.
+            const commits = base === undefined
+                ? [tip]
+                : ((await gitTry(wt, "rev-list", "--first-parent", "--reverse", `${base}..${tip}`)) ?? "")
+                    .trim()
+                    .split(/\s+/)
+                    .filter(Boolean);
+            for (const commit of commits) {
+                await git(wt, "checkout", "-q", "--detach", "--force", commit);
+                const parent = `${commit}^`;
+                const files = (await treeDiffFiles(wt, parent, commit)) ?? [];
+                const [ruleReason] = await diffRuleReasons(wt, parent, files, mergingRoleOf(root, commit) ?? "", isExemptDiff(files, config.review.exemptPaths));
+                if (ruleReason !== undefined) {
+                    logEventBestEffort(root, {
+                        source: TUMWATER_SOURCE,
+                        type: "warning",
+                        message: `main's tip ${shortSha(tip)} fails the diff rules: ${ruleReason}`,
+                    });
+                    // A finding stops the walk mid-range; put the mirror back on the tip. The first finding
+                    // across the range is reported once, like the gate's short-circuit.
+                    await git(wt, "checkout", "-q", "--detach", "--force", tip);
+                    return;
+                }
+            }
+        };
         if (!detectBuildCheck(root, config)) {
-            lastWatched = mainHead; // no declared check: nothing to watch until main moves
+            // No declared build check: nothing to watch for a build red, but the diff rules still run on
+            // the tip. The build-red path below is what never runs here.
+            await withMainTipWorktree(root, mainBranch, async (wt) => {
+                await watchRules(wt, lastWatched, await headOf(wt));
+            });
+            lastWatched = mainHead; // no declared check: nothing else to watch until main moves
             return;
         }
         await withMainTipWorktree(root, mainBranch, async (wt) => {
@@ -96,11 +148,14 @@ export function createMainWatch(root, mainBranch, onCulprit) {
             const baseline = check.baseline;
             const previous = lastWatched;
             // A skipped or sleep-spanned run made no verdict: the head still counts as watched, so the
-            // next poll does not start another run for it.
-            if (!baseline)
-                return void (lastWatched = await headOf(wt));
+            // next poll does not start another run for it — but the diff rules still run on this tip.
+            if (!baseline) {
+                const tip = await headOf(wt);
+                await watchRules(wt, previous, tip);
+                return void (lastWatched = tip);
+            }
             lastWatched = baseline.sha;
-            // A red naming only quarantined tests counts as green: no bisect, no redeploy hold.
+            // A red naming only quarantined tests counts as green: no redeploy hold.
             const quarantined = baseline.status === "red" ? onlyQuarantined(root, baseline.failingTests) : null;
             const red = baseline.status === "red" && !quarantined;
             knownFailures.set(root, red ? (baseline.failingTests ?? []) : []);
@@ -118,35 +173,28 @@ export function createMainWatch(root, mainBranch, onCulprit) {
                 ...(quarantined ? { quarantined } : {}),
                 ...(baseline.inheritedFrom !== undefined ? { inherited: true } : {}),
             });
+            // The diff rules judge the tip whether the build is green or red; the build-red path below
+            // names the whole tip as the culprit, so the two red kinds are judged independently.
+            await watchRules(wt, previous, baseline.sha);
             if (!red)
                 return;
-            // Once per red head: lastWatched already holds it, so a later poll does not search again.
-            const found = await findRedCulprit(root, wt, config, baseline);
-            if (found.kind === "culprit") {
-                logEventBestEffort(root, {
-                    source: TUMWATER_SOURCE,
-                    type: "main_culprit",
-                    commit: found.commit,
-                    ...(found.runner !== undefined ? { runner: found.runner } : {}),
-                    failingTests: found.failingTests,
-                    green: found.green,
-                });
-                onCulprit?.({
-                    commit: found.commit,
-                    ...(found.runner !== undefined ? { runner: found.runner } : {}),
-                    failingTests: found.failingTests,
-                    tip: baseline.sha,
-                });
-            }
-            else {
-                logEventBestEffort(root, {
-                    source: TUMWATER_SOURCE,
-                    type: "warning",
-                    message: found.kind === "environment"
-                        ? `main's last green commit ${shortSha(found.green)} is red now too — not attributing`
-                        : `main watch could not name the commit that turned main red: ${found.reason}`,
-                });
-            }
+            // The newest head is the culprit ("Every commit is verified on main, part 2/3"): the watch
+            // checks each new red tip, so whatever it found belongs to the head it checked. Once per red
+            // head — lastWatched already holds it, so a later poll does not attribute it again — name
+            // the tip with its own failing tests and, when the newest merged event names it, its runner.
+            const runner = mergingRoleOf(root, baseline.sha);
+            logEventBestEffort(root, {
+                source: TUMWATER_SOURCE,
+                type: "main_culprit",
+                commit: baseline.sha,
+                ...(runner !== undefined ? { runner } : {}),
+                failingTests: baseline.failingTests ?? [],
+            });
+            onCulprit?.({
+                commit: baseline.sha,
+                failingTests: baseline.failingTests ?? [],
+                tip: baseline.sha,
+            });
         });
     }
     return {

package/dist/src/brief/brief-edit.js

@@ -37,5 +37,7 @@ export async function editBriefText(root, text) {
     if (typeof changed === "string")
         return { ok: false, error: changed };
     const committed = changed && (await commitOperatorBacklogEdit(root, name, stampedSubject("operator", "Edit brief"))); // vocabulary-ok: commit prefix stays
-    return { ok: true, file: name, changed, committed };
+    // A commit that fails is rolled back by commitOperatorBacklogEdit, so on disk the brief is
+    // unchanged: report changed accordingly (nothing persisted) instead of claiming the edit landed.
+    return { ok: true, file: name, changed: changed && committed, committed };
 }