tumwater 0.4.0 → 0.4.2

package/dist/src/backlog/question-answer.js

@@ -14,13 +14,14 @@
  * CLI command package for domain logic.
  */
 import path from "node:path";
-import { fencedHeadingTitle, fenceTracker, nextSectionHeading } from "./backlog-md.js";
+import { fencedHeadingTitle, fenceTracker, firstDate, nextSectionHeading } from "./backlog-md.js";
 import { answeredQuestionEntries, entryMatches, openQuestionEntries, ageInDays, ageSuffix } from "./backlog.js";
 import { normalizeEntryBody } from "./backlog-write.js";
 import { collapseWhitespace, firstTrimmedLineStartingWith, trimLeadingBlankLines, trimTrailingBlankLines, truncate } from "../text/text.js";
 import { readTextOrNull, writeTextAtomic } from "../files/files.js";
 import { formatDate } from "../text/datetime.js";
 import { numberedList } from "../text/markdown.js";
+import { topAndHidden } from "../collections.js";
 import { withPrimaryWorktreeLock } from "../concurrency/lock.js";
 /** Cap on a question's one-line body preview, so one very long first line cannot dominate
  * the `questions` list. */
@@ -42,10 +43,11 @@ function firstBodySuffix(body) {
 /** The open question's filing stamp, `YYYY-MM-DD`, read from the heading's `(asked by <who>
  * YYYY-MM-DD)` clause — the first `YYYY-MM-DD` after an `asked by` word in the title text — or
  * null when the heading carries no such clause. Taken from the title text only, not the body:
- * the stamp is the entry's own, and the body may name other dates. */
+ * the stamp is the entry's own, and the body may name other dates. Routed through
+ * backlog-md.ts's firstDate - the one first-match mechanism filingDate (backlog.ts) uses too -
+ * with the `asked by` verb in place of the plans/bugs stamp verbs. */
 export function questionFilingDate(title) {
-    const m = /(?:asked by)\b[^)]*?\b(\d{4}-\d{2}-\d{2})/.exec(title);
-    return m === null ? null : m[1];
+    return firstDate(title, /(?:asked by)\b[^)]*?\b(\d{4}-\d{2}-\d{2})/);
 }
 /** The role id named in the heading's `(asked by <role> …)` clause — the first word after
  * `asked by` — or null when the heading has no such clause. Taken from the title only, like
@@ -133,7 +135,8 @@ function answerPreview(body) {
 function answeredQuestionsNewestFirst(root, count, pattern) {
     const numbered = answeredQuestionEntries(root).reverse().map((e, i) => ({ ...e, position: i + 1 }));
     const all = pattern === undefined ? numbered : numbered.filter((e) => entryMatches(e, pattern));
-    return { entries: all.slice(0, count), older: Math.max(0, all.length - count) };
+    const { visible: entries, hidden: older } = topAndHidden(all, count);
+    return { entries, older };
 }
 /** `tumwater questions --answered`: lines numbered by `--show <n> --answered` position, newest
  * first — a numbering separate from the `## Open` positions `questions answer <n>` takes. */
@@ -271,40 +274,56 @@ function answerQuestionLocked(root, n, rawDecision, expectedTitle, keepLines) {
     if (expectedTitle !== undefined && block.title !== expectedTitle)
         return { status: "moved", title: block.title };
     const moved = lines.slice(block.start, block.end);
-    trimTrailingBlankLines(moved);
+    const rebuilt = cutOpenBlock(lines, scanned, block);
+    const text = appendAnsweredEntry(rebuilt, moved, decision, scanned.answeredIdx !== -1);
+    writeTextAtomic(file, text);
+    return { status: "answered", title: block.title, decision };
+}
+/** Cut `block` out of `## Open`, returning the rebuilt file text (as lines). When the section
+ * is left with no content at all, restores the `_None yet._` placeholder the skeleton carries,
+ * so an empty outbox still reads as an intentionally empty section. */
+function cutOpenBlock(lines, scan, block) {
     // Cut the block out of ## Open: everything before it, everything from its end on. When the
     // section is left with no content at all, restore the `_None yet._` placeholder the skeleton
     // carries, so an empty outbox still reads as an intentionally empty section.
     // Emptiness is judged against the Open section only (openIdx+1 .. openEnd): with an
     // intermediate section between Open and Answered, judging against answeredIdx would keep
     // the placeholder from returning and, worse, the empty rebuild would drop that section.
-    const openContent = lines.slice(scanned.openIdx + 1, scanned.openEnd);
-    const remaining = openContent.filter((_, i) => i < block.start - scanned.openIdx - 1 || i >= block.end - scanned.openIdx - 1);
+    const openContent = lines.slice(scan.openIdx + 1, scan.openEnd);
+    const remaining = openContent.filter((_, i) => i < block.start - scan.openIdx - 1 || i >= block.end - scan.openIdx - 1);
     const openEmpty = remaining.every((l) => l.trim() === "");
     const rebuilt = [];
     if (openEmpty) {
-        rebuilt.push(...lines.slice(0, scanned.openIdx + 1), "", "_None yet._", 
+        rebuilt.push(...lines.slice(0, scan.openIdx + 1), "", "_None yet._", 
         // Resume at the section that followed Open (openEnd, not answeredIdx — an intermediate
         // section between the two must survive) with the blank separator line the dropped Open
         // content used to carry, so `_None yet._` never reads as a paragraph glued to a heading.
-        "", ...lines.slice(scanned.openEnd));
+        "", ...lines.slice(scan.openEnd));
     }
     else {
         rebuilt.push(...lines.slice(0, block.start), ...lines.slice(block.end));
     }
+    return rebuilt;
+}
+/** Append the moved block at the end of `## Answered` (growing the section when the file has
+ * none, stripping a real `_None yet._` placeholder from it), returning the full text to write.
+ * `hasAnswered` is whether the file already held a `## Answered` section. */
+function appendAnsweredEntry(rebuilt, moved, decision, hasAnswered) {
+    // The moved block's trailing blank lines are dropped, so the appended entry never reads
+    // as a spill of blank lines before the dated answer stamp.
+    trimTrailingBlankLines(moved);
     // Append the block at the end of ## Answered: before the next `## ` heading when one
     // follows, at the file's end otherwise — the section is last in the documented skeleton.
     const stamp = `**Answered ${formatDate(new Date())} by the user:**`;
     const stamped = decision.includes("\n") ? [stamp, "", ...decision.split("\n")] : [`${stamp} ${decision}`];
     const answerLines = moved.concat("", ...stamped, "");
-    if (scanned.answeredIdx === -1) {
+    if (!hasAnswered) {
         // No ## Answered section: grow the file's end with the skeleton section plus the block.
         let out = rebuilt.join("\n");
         if (out !== "" && !out.endsWith("\n"))
             out += "\n";
         out += `\n## Answered\n\n${answerLines.join("\n")}`;
-        writeTextAtomic(file, out);
-        return { status: "answered", title: block.title, decision };
+        return out;
     }
     const fenced2 = fenceTracker();
     let answeredAt = -1;
@@ -340,6 +359,5 @@ function answerQuestionLocked(root, n, rawDecision, expectedTitle, keepLines) {
     trimTrailingBlankLines(head);
     trimLeadingBlankLines(tail);
     const result = head.concat("", answerLines, tail);
-    writeTextAtomic(file, result.join("\n"));
-    return { status: "answered", title: block.title, decision };
+    return result.join("\n");
 }

package/dist/src/baseline/main-baseline.js

@@ -2,7 +2,7 @@ import { runBuildCheck, } from "../build/build-check.js";
 import { SLEEP_SPAN_TOLERANCE_MS, runWithCleanRetry } from "../build/build-check-events.js";
 import { sampleSleepClock } from "../build/host-sleep.js";
 import { CHECK_TIER, withCheckPermit } from "../concurrency/check-permit.js";
-import { detectBuildCheck } from "../build/build-check-detect.js";
+import { detectBuildCheck, mergeCommandOf } from "../build/build-check-detect.js";
 import { gitLines, refSha } from "../git/git.js";
 import { gitTry } from "../git/git-run.js";
 import { treeDiffFiles } from "../git/git-diff.js";
@@ -110,7 +110,7 @@ export function persistBaselineVerdicts(root) {
     greensFile = file;
 }
 /** In-flight dedup: concurrent runs on the same not-yet-cached SHA (a fresh main move wakes
- * every blocked role at once) share one check run instead of racing N npm invocations. Keyed by
+ * every role's verifier at once) share one check run instead of racing N npm invocations. Keyed by
  * SHA for ordinary checks; a re-verification adds its worktree, because joining another
  * worktree's run would observe the wrong environment — the one thing it exists to re-test. */
 const baselineInFlight = new Map();
@@ -174,6 +174,15 @@ export function noteInheritedGreen(sha, from) {
  * verdict anyway (every code merge seeds one), so this bound only caps the rev-list on a cold
  * cache. */
 const INHERIT_WALK_MAX = 64;
+/** The body of a `git rev-list --first-parent --max-count=<max> <ref>` read — the walk the three
+ * first-parent scans in this module share, spelled the same on purpose so a change to the walk
+ * shape (the bound, the `--first-parent` flag) lands once. `inheritedGreen` and `watchedBaseline`
+ * walk a commit's ancestors (`${sha}^` / `${tip}^`, the commit itself excluded);
+ * `newestGreenAboveBuild` walks `tip` itself and down. Never throws: a git failure is an empty
+ * list, and every caller already treats that as a no-inheritance / no-verdict answer. */
+async function firstParentWalk(wt, ref, max) {
+    return gitLines(await gitTry(wt, "rev-list", "--first-parent", `--max-count=${max}`, ref));
+}
 /** A green for `sha` carried over from its nearest verdict-bearing first-parent ancestor, or null
  * when there is none to carry. The nearest ancestor with a cached verdict must be GREEN, and the
  * tree diff from it to `sha` must touch only `exemptPaths` (config.review.exemptPaths, the same
@@ -185,7 +194,7 @@ const INHERIT_WALK_MAX = 64;
  * past. An uncached ancestor is walked through, since the single diff from the green covers it.
  * Never throws: any git failure means no inheritance, and the caller runs the suite as before. */
 async function inheritedGreen(wt, sha, exemptPaths) {
-    const ancestors = gitLines(await gitTry(wt, "rev-list", "--first-parent", `--max-count=${INHERIT_WALK_MAX}`, `${sha}^`));
+    const ancestors = await firstParentWalk(wt, `${sha}^`, INHERIT_WALK_MAX);
     for (const ancestor of ancestors) {
         const verdict = baselineCache.get(ancestor);
         if (verdict === undefined)
@@ -229,7 +238,7 @@ export async function watchedBaseline(wt, sha) {
     const own = baselineCache.get(tip);
     if (own)
         return own;
-    const ancestors = gitLines(await gitTry(wt, "rev-list", "--first-parent", `--max-count=${INHERIT_WALK_MAX}`, `${tip}^`));
+    const ancestors = await firstParentWalk(wt, `${tip}^`, INHERIT_WALK_MAX);
     for (const ancestor of ancestors) {
         const verdict = baselineCache.get(ancestor);
         if (verdict)
@@ -239,49 +248,85 @@ export async function watchedBaseline(wt, sha) {
 }
 /** How many first-parent commits below main's tip redeployTarget looks at. */
 const REDEPLOY_WALK_MAX = 64;
-/** The commit self-redeploy should run: main's newest first-parent commit with a green full-check
- * verdict in the cache (observed or inherited) that is newer than the running build `buildSha`,
- * looking at most REDEPLOY_WALK_MAX commits down from `tip`. A tip the cache has no verdict for
- * is the target as is — the redeployer checks it. A tip whose cached red was observed in the
- * redeployer's mirror worktree (mirrorWorktreePath of `wt`) falls back to the newest older green
- * above the build. Any other red may be another worktree's environmental one, which the redeployer
- * re-verifies; a build that is not a first-parent ancestor of `tip`, or no green, also leaves the
- * tip the target, and the redeployer blocks that commit alone. The cache holds only full-check
- * verdicts, so a cheaper command's green never makes a commit deployable.
- * Never throws: a git failure leaves the tip as the target. */
-export async function redeployTarget(wt, tip, buildSha) {
-    const red = baselineCache.get(tip);
-    if (tip === "" || red?.status !== "red" || !(red.redFrom ?? []).includes(mirrorWorktreePath(wt)))
-        return tip;
-    const walk = gitLines(await gitTry(wt, "rev-list", "--first-parent", `--max-count=${REDEPLOY_WALK_MAX}`, tip));
+/** True when the main watch (src/baseline/main-watch.ts) verifies main — the configs where no
+ * merge seeds a green verdict (`watchedBaseline`'s doc) and the watch has a check to run: a
+ * declared check and a `check.mergeCommand` (or its gate-command fallback) in effect. In this
+ * mode the redeployer reads the watch's verdicts and starts no full check of its own
+ * (redeployTarget's `watched`). False when the project declares no check, or when a blank
+ * `check.mergeCommand` keeps the full check in the merge lock. Never throws: detection resolves
+ * to null, which is also false. */
+export function watchVerifiesMain(root, config) {
+    return detectBuildCheck(root, config) !== null && mergeCommandOf(config) !== undefined;
+}
+/** The newest first-parent commit below `tip`, down to and through `buildSha`, with a green
+ * cached verdict — the walk+scan redeployTarget's watched and un-watched branches share. Only
+ * their fallback differs: `notOnHistory` when `buildSha` is not on the first-parent walk at all
+ * (the caller keeps today's answer, `tip`), `onHistoryNone` when it is but nothing above it is
+ * green (watched keeps the build; un-watched keeps `tip`). Never throws: a git failure leaves
+ * the walk empty, so the fallback answers. */
+async function newestGreenAboveBuild(wt, tip, buildSha, notOnHistory, onHistoryNone) {
+    const walk = await firstParentWalk(wt, tip, REDEPLOY_WALK_MAX);
     const buildAt = walk.indexOf(buildSha);
     if (buildAt === -1)
-        return tip;
+        return notOnHistory;
     for (const sha of walk.slice(0, buildAt)) {
         if (baselineCache.get(sha)?.status === "green")
             return sha;
     }
-    return tip;
+    return onHistoryNone;
+}
+/** The commit self-redeploy should run: main's newest first-parent commit with a green full-check
+ * verdict in the cache (observed or inherited) that is newer than the running build `buildSha`,
+ * looking at most REDEPLOY_WALK_MAX commits down from `tip`.
+ *
+ * With `watched` false (the default, a project whose main the watch does not verify), a tip the
+ * cache has no verdict for is the target as is — the redeployer checks it. A tip whose cached red
+ * was observed in the redeployer's mirror worktree (mirrorWorktreePath of `wt`) falls back to the
+ * newest older green above the build. Any other red may be another worktree's environmental one,
+ * which the redeployer re-verifies; a build that is not a first-parent ancestor of `tip`, or no
+ * green, also leaves the tip the target, and the redeployer blocks that commit alone.
+ *
+ * With `watched` true (watchVerifiesMain), the watch supplies the verdicts and the redeployer only
+ * reads them: walk `tip`'s first-parent history down to `buildSha` and return the first commit
+ * whose cached verdict is green — a cached red is walked past, never targeted. With no green
+ * above the build, target `buildSha` itself, so buildStaleness reads it as not stale and no
+ * episode, hold or pre-warm starts until the watch calls a newer commit green. A build that is
+ * not a first-parent ancestor of `tip` keeps today's answer (`tip`, which the redeployer
+ * checks), as does `watched` false. Every target `watched` picks has a cached green, so
+ * mainIsGreen on it is a cache hit and the redeployer starts no suite.
+ * The cache holds only full-check verdicts, so a cheaper command's green never makes a commit
+ * deployable.
+ * Never throws: a git failure leaves the tip as the target. */
+export async function redeployTarget(wt, tip, buildSha, watched = false) {
+    if (watched) {
+        if (tip === "")
+            return tip;
+        return newestGreenAboveBuild(wt, tip, buildSha, tip, buildSha);
+    }
+    const red = baselineCache.get(tip);
+    if (tip === "" || red?.status !== "red" || !(red.redFrom ?? []).includes(mirrorWorktreePath(wt)))
+        return tip;
+    return newestGreenAboveBuild(wt, tip, buildSha, tip, tip);
 }
 /** Verify main's own build/test suite at `wt`'s HEAD — which must be pristine main (the caller
  * is the fresh-run path right after resetWorktreeToMain; a dirty or ahead worktree would
  * measure the wrong thing). Cache hit returns immediately; on miss runs detectBuildCheck +
  * runBuildCheck once per SHA (in-flight deduped) and caches green/red. Never throws: git,
- * detection, and execution failures all resolve to "nothing blocks authoring". */
+ * detection, and execution failures all resolve to no verdict (nothing to verify). */
 export async function checkMainBaseline(wt, 
 /** The live config — the declared check is detected through it (plans/portability.md
  * §6/7), so a configured command verifies main on a non-npm repo too. Required in this
  * position: detection needs it, and an optional trailing parameter would let future
- * callers skip the baseline gate entirely. */
+ * callers skip the baseline check entirely. */
 config, 
 /** Called once per actual script run (never for cache hits or deduped waiters) with what ran
  * and how long it took — the caller's hook for a build_check event. */
 onRun, 
 /** Ignore a cached RED verdict and run the suite here instead (a cached green still short-
  * circuits — see baselineCache). For the caller whose false block is expensive enough to pay
- * one extra run: the redeploy gate, where trusting another worktree's environmental red
- * strands the whole team on a stale build until main moves. A green from the re-run promotes
- * the SHA team-wide, which unblocks the role runners too. */
+ * one extra run: the redeploy path, where trusting another worktree's environmental red
+ * strands the team on a stale build until main moves. A green from the re-run promotes
+ * the SHA team-wide, so every consumer reads main green. */
 reverifyRed = false, 
 /** Ignore the cache entirely and run the suite here, even over a GREEN verdict. For the one
  * caller that cannot trust a green (BUGS.md 2026-10-06: the review gate re-attributing a

package/dist/src/baseline/main-guardrails.js

@@ -4,7 +4,9 @@
  * selfcheck digest) words them the same. Read-only: it never writes an event, state or file.
  *
  * G1 lives on the `main_check` / `main_red_hold` event trail (src/baseline/main-watch.ts,
- * src/baseline/main-red.ts): only `main_check` events that actually ran the check
+ * src/baseline/main-red.ts), and names the merge the watch blamed (`main_culprit`, logged by
+ * src/baseline/main-watch.ts) in the same clause the dashboard alert uses. Only `main_check`
+ * events that actually ran the check
  * (`durationMs` > 0; a cached or inherited verdict is ignored) and `main_red_hold` events
  * count, and a `main_check` that passed (a red naming only quarantined tests is recorded
  * passed) ends a red. G3 reads the quarantine list (src/review/known-flakes.ts) directly.
@@ -13,6 +15,8 @@ import { readEventsSince } from "../events/event-window.js";
 import { loadQuarantine } from "../review/known-flakes.js";
 import { DAY_MS, clockHm, humanAgo } from "../text/datetime.js";
 import { shortSha } from "../text/format.js";
+import { roleLabel } from "../roles/role-labels.js";
+import { plural } from "../text/phrases.js";
 import { squash } from "../text/text.js";
 /** How long a red main must last before the doctor and the selfcheck digest warn (G1). */
 export const RED_MAIN_WARN_MS = 30 * 60_000;
@@ -45,22 +49,36 @@ export const QUARANTINE_WARN_COUNT = 10;
 /** How many of the oldest quarantined tests a warning names before folding the rest into a
  * remainder count. */
 const QUARANTINE_DETAIL_MAX = 3;
-/** G1 over `events`: warns when main has been red for more than RED_MAIN_WARN_MS, over the
- * trailing 24 h of `events` from `now`. Only `main_check` events with `durationMs` > 0 and
- * `main_red_hold` events count; a `main_check` with `durationMs` 0 (cached or inherited) is
- * ignored; a pass (including one naming only quarantined tests, recorded passed) ends the red.
- * The phrase names how long main has had no passing full check, the sha it has been red since,
- * its clock time, and the newest red's first failing test when one is named. Returns null when
- * main is green, or red for RED_MAIN_WARN_MS or less. */
-export function redMainWarning(events, now) {
-    const cutoff = now - DAY_MS;
+/** True when `e` is the newest `main_culprit` seen so far: no contender yet, or a later `ts`.
+ * The newest-in-window pick that `scanRedWindow` folds into its loop. */
+function isNewerCulprit(c, e) {
+    return c === undefined || e.ts > c.ts;
+}
+/** Scans the trailing 24 h of `events` (cutoff `now - DAY_MS`), collecting the events that open,
+ * extend or end a red and picking the newest in-window `main_culprit` with a non-empty string
+ * `commit`. Owns the window scan and the newest-culprit pick. */
+function scanRedWindow(events, cutoff) {
     const relevant = [];
+    let culprit;
     for (const e of events) {
         if (typeof e.ts !== "number" || e.ts < cutoff)
             continue;
+        if (e.type === "main_culprit") {
+            if (typeof e.commit === "string" && e.commit.length > 0 && isNewerCulprit(culprit, e)) {
+                culprit = e;
+            }
+            continue;
+        }
         if (isRedMain(e) || isPassingMainCheck(e))
             relevant.push(e);
     }
+    return { relevant, culprit };
+}
+/** Derives the red spell over `window`'s `relevant` events: the start event and duration from
+ * `now`, whether the spell is unbroken, and the 30-minute threshold (null when main is green,
+ * or red for RED_MAIN_WARN_MS or less). Owns the red-spell derivation and the 30-minute bail. */
+function redSpell(window, now) {
+    const relevant = window.relevant;
     if (relevant.length === 0)
         return null;
     let newest = relevant[0];
@@ -85,10 +103,53 @@ export function redMainWarning(events, now) {
     if (durationMs <= RED_MAIN_WARN_MS)
         return null;
     const unbroken = lastPass === undefined && reds.length > 1;
-    const duration = unbroken || durationMs >= DAY_MS ? "more than 24 h" : redDurationPhrase(durationMs);
-    const failing = Array.isArray(newest.failingTests) && typeof newest.failingTests[0] === "string" ? newest.failingTests[0] : undefined;
-    const head = `main has had no passing full check for ${duration}: red since ${shortSha(startEv.sha)} at ${clockHm(startEv.ts)}`;
-    return failing ? `${head} — ${squash(failing, 120)}` : head;
+    return { startEv, newest, durationMs, unbroken };
+}
+/** "more than 24 h" for an unbroken or full-window red, else the short duration phrase. Owns
+ * the duration wording. */
+function redSpellDuration(spell) {
+    return spell.unbroken || spell.durationMs >= DAY_MS ? "more than 24 h" : redDurationPhrase(spell.durationMs);
+}
+/** The newest red's first failing test, when one is named. Owns the first-failing-test read. */
+function redFailingTest(newest) {
+    return Array.isArray(newest.failingTests) && typeof newest.failingTests[0] === "string" ? newest.failingTests[0] : undefined;
+}
+/** The blame clause naming the merge the main watch blamed, when the newest `culprit` in the
+ * window blames the same sha the phrase names. Owns the blame clause. */
+function redBlameClause(culprit, newest) {
+    // The blame names the merge the main watch blamed for the red — the same `main_culprit`
+    // commit-equals-tip rule the dashboard alert uses (status-polls only publishes a blame whose
+    // commit is the derived tip sha), so a red the watch did not blame never borrows another
+    // head's culprit. A culprit naming another commit, or none, leaves the phrase as today.
+    const shouldBlame = culprit !== undefined && culprit.commit === newest.sha;
+    return shouldBlame
+        ? typeof culprit.runner === "string" && culprit.runner.length > 0
+            ? `; the main watch blames ${roleLabel(culprit.runner)}'s merge ${shortSha(culprit.commit)}`
+            : `; the main watch blames merge ${shortSha(culprit.commit)}`
+        : "";
+}
+/** G1 over `events`: warns when main has been red for more than RED_MAIN_WARN_MS, over the
+ * trailing 24 h of `events` from `now`. Only `main_check` events with `durationMs` > 0 and
+ * `main_red_hold` events count; a `main_check` with `durationMs` 0 (cached or inherited) is
+ * ignored; a pass (including one naming only quarantined tests, recorded passed) ends the red.
+ * The phrase names how long main has had no passing full check, the sha it has been red since,
+ * its clock time, the newest red's first failing test when one is named, and — when the newest
+ * `main_culprit` in the window blames the same sha the phrase names — the merge the main watch
+ * blamed (`; the main watch blames <role>'s merge <sha>`, or `; the main watch blames merge
+ * <sha>` when no runner is named), the one rule the dashboard alert and this phrase share.
+ * Returns null when main is green, or red for RED_MAIN_WARN_MS or less. The per-job work is
+ * split into the module-private helpers `scanRedWindow`, `redSpell`, `redSpellDuration`,
+ * `redFailingTest` and `redBlameClause`, one per job, so each is found by name. */
+export function redMainWarning(events, now) {
+    const window = scanRedWindow(events, now - DAY_MS);
+    const spell = redSpell(window, now);
+    if (spell === null)
+        return null;
+    const duration = redSpellDuration(spell);
+    const head = `main has had no passing full check for ${duration}: red since ${shortSha(spell.startEv.sha)} at ${clockHm(spell.startEv.ts)}`;
+    const failing = redFailingTest(spell.newest);
+    const blame = redBlameClause(window.culprit, spell.newest);
+    return failing ? `${head} — ${squash(failing, 120)}${blame}` : `${head}${blame}`;
 }
 /** G3 over `entries` (the loadQuarantine list): warns when the list holds more than
  * QUARANTINE_WARN_COUNT tests, or when any test's `firstSeen` is more than QUARANTINE_AGE_MS
@@ -109,7 +170,7 @@ export function quarantineWarning(entries, now) {
             return `"${squash(e.test, 40)}" (${filed}, ${humanAgo(e.firstSeen, now)})`;
         });
         const more = old.length > QUARANTINE_DETAIL_MAX ? ` (and ${old.length - QUARANTINE_DETAIL_MAX} more)` : "";
-        phrases.push(`quarantine holds ${old.length} test${old.length === 1 ? "" : "s"} over 3 days: ${named.join(", ")}${more}`);
+        phrases.push(`quarantine holds ${plural(old.length, "test")} over 3 days: ${named.join(", ")}${more}`);
     }
     return phrases.length > 0 ? phrases.join("; ") : null;
 }