tumwater 0.4.0 → 0.4.2

package/dist/src/doctor/doctor-opencode-checks.js

@@ -3,7 +3,8 @@ import path from "node:path";
 import { childEnv } from "../process/process.js";
 import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./probe.js";
 import { opencodeBackend, opencodeSpillDir } from "../agent/opencode/opencode-backend.js";
-import { opencodeModelKey, readOpencodeCache } from "../agent/opencode/opencode-catalog.js";
+import { opencodeModelFree, opencodeModelKey, readOpencodeCache } from "../agent/opencode/opencode-catalog.js";
+import { formatDate } from "../text/datetime.js";
 import { opencodeDbPath } from "../paths.js";
 import { envPath, isDirectory, readTextOrNull, statOrNull, treeBytes } from "../files/files.js";
 import { formatBytes, tokenWindowLabel } from "../text/format.js";
@@ -11,7 +12,7 @@ import { escapeRegExp } from "../text/text.js";
 import { failOutcome, okOutcome, warnOutcome } from "./outcome.js";
 import { loadConfigForCheck, opencodeSeamsInUse, seamedModels, } from "./doctor-model-checks.js";
 /** The doctor's opencode credential and leak readiness check, split out of doctor-model-checks.ts
- * (whose shared seam/model framework and the pi, tier-models and image-input checks stay there):
+ * (whose shared seam/model framework and the pi and tier-models checks stay there):
  * checkOpencode and its helpers (opencodeProviderOf, opencodeAuthLists, jsonKeyPresent,
  * opencodeConfigLeaks). This is the doctor's only check that spawns the `opencode` CLI and reads
  * its catalog and the operator's global opencode config — a distinct concern from the
@@ -107,6 +108,80 @@ function opencodeConfigLeaks(configHome) {
         warns.push(`${agentsMd} still loads into team runs`);
     return warns;
 }
+/** A catalog model's price text — "free" when free, the billed-demotion phrase when `billedAt`
+ * is set, else the per-M prices — so opencodeModelRow can name the price without the nested
+ * ternary and its two `?? 0` fallbacks. */
+function opencodePriceText(free, billedAt, inputPerM, outputPerM) {
+    if (free)
+        return "free";
+    if (billedAt !== undefined)
+        return `no longer free (billed ${formatDate(new Date(billedAt))})`;
+    return `$${inputPerM ?? 0}/$${outputPerM ?? 0} per M`;
+}
+/** One opencode catalog model's row: today's per-model body from the cache key through the
+ * dropped-effort warning, returning the catalog note and any warnings, or undefined when the
+ * model is missing from the cache (the caller owns that failure message). `warnings` holds the
+ * billed-at demotion line and the dropped-effort line in today's order. */
+function opencodeModelRow(cache, model, thinking) {
+    const key = opencodeModelKey(model);
+    const entry = cache.models[key];
+    if (entry === undefined)
+        return undefined;
+    const warnings = [];
+    const free = opencodeModelFree(cache, key);
+    if (entry.billedAt !== undefined) {
+        warnings.push(`${model} was free in the catalog but billed once on ${formatDate(new Date(entry.billedAt))} — the budget gate now prices it`);
+    }
+    const window = entry.context !== undefined ? `, ${tokenWindowLabel(entry.context)}` : "";
+    const note = `${model} — ${opencodePriceText(free, entry.billedAt, entry.inputPerM, entry.outputPerM)}${window}`;
+    // A model with no effort list at all supports no thinking level, so a requested level is
+    // dropped just the same as one the list omits.
+    if (thinking !== undefined && thinking !== "" && !entry.efforts?.includes(thinking)) {
+        warnings.push(`${model} has no ${thinking} effort — that thinking level is dropped`);
+    }
+    return { note, warnings };
+}
+/** The team's opencode database and spill directory sizes as one information line (`db …,
+ * spill …`), reading the db, the spill dir and their byte formatting — today's storage tail. */
+function opencodeStorageNote(root) {
+    const db = statOrNull(opencodeDbPath(root));
+    const spillDir = opencodeSpillDir(root);
+    const spill = spillDir !== "" && isDirectory(spillDir) ? treeBytes(spillDir) : null;
+    return `db ${formatBytes(db?.size ?? 0)}${spill !== null ? `, spill ${formatBytes(spill)}` : ", no spill dir"}`;
+}
+/** Walk the opencode-routed model pairs into today's per-model fails, warns and notes: the
+ * catalog-miss failure, the catalog note and its warnings from opencodeModelRow, and the
+ * non-gateway credential probe each provider. Returns the three arrays checkOpencode assembles. */
+async function collectOpencodeModelRows(cache, models, config, pathEnv, timeoutMs) {
+    const fails = [];
+    const warns = [];
+    const notes = [];
+    for (const pair of models) {
+        const model = pair.model;
+        const row = opencodeModelRow(cache, model, pair.thinking);
+        if (row === undefined) {
+            fails.push(`${model} is not in the opencode catalog cache`);
+            continue;
+        }
+        notes.push(row.note);
+        warns.push(...row.warnings);
+        const provider = opencodeProviderOf(model);
+        if (provider !== undefined && !(await opencodeAuthLists(config, provider, pathEnv, timeoutMs))) {
+            warns.push(`${model} is a non-gateway provider opencode does not list a credential for`);
+        }
+    }
+    return { fails, warns, notes };
+}
+/** The check's outcome from the accumulated fails/warns/notes and the storage tail: the joined
+ * base line ("opencode ready — …" when nothing is wrong, else the found lines) and the
+ * fail/warn/ok verdict by severity. */
+function opencodeOutcome(fails, warns, notes, sizeNotes) {
+    const found = [...fails, ...warns];
+    const base = found.length === 0 ? `opencode ready — ${notes.join("; ")}; ${sizeNotes}` : found.join("; ");
+    if (fails.length > 0)
+        return failOutcome(base);
+    return (warns.length > 0 ? warnOutcome : okOutcome)(base);
+}
 /** OpenCode model, credential and leak readiness (plans/opencode-backend.md §7, part 7/7):
  * every model routed to opencode must be in the catalog cache — an unknown model fails, a
  * cached one reads "free" or its per-M prices and context window, and a thinking level with no
@@ -116,49 +191,23 @@ function opencodeConfigLeaks(configHome) {
  * team runs, else warns naming the file and key. Reports the team's opencode database and spill
  * sizes as information. Stands down (ok) when no seam routes to opencode, so a pi-only team
  * spawns nothing and reads nothing. `pathEnv` and `home` are injectable so tests need no real
- * PATH or HOME. The version half of the opencode pre-flight is the sibling checkOpencodeVersion
- * in doctor-checks.ts. */
+ * PATH or HOME. A model's freeness is read from opencodeModelFree — the same call the budget
+ * gate and status use — so a catalog-free model that an observed bill demoted to billed reads
+ * as billed here, not free, keeping the row from drifting from what the team is billed. The
+ * per-model catalog row lives in opencodeModelRow, the database-and-spill size line in
+ * opencodeStorageNote; both are the two extracted jobs the reader names by. The version half of
+ * the opencode pre-flight is the sibling checkOpencodeVersion in doctor-checks.ts. */
 export async function checkOpencode(root, pathEnv = envPath(), home = os.homedir(), xdgConfigHome = process.env.XDG_CONFIG_HOME ?? "", timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
     const config = loadConfigForCheck(root);
     if ("level" in config)
         return config;
     if (!opencodeSeamsInUse(config))
         return okOutcome("no model jobs run on opencode");
-    const models = seamedModels(config, "opencode");
-    const cache = readOpencodeCache(root);
-    const fails = [];
-    const warns = [];
-    const notes = [];
-    for (const pair of models) {
-        const key = opencodeModelKey(pair.model);
-        const entry = cache.models[key];
-        if (entry === undefined) {
-            fails.push(`${pair.model} is not in the opencode catalog cache`);
-            continue;
-        }
-        const price = entry.free ? "free" : `$${entry.inputPerM ?? 0}/$${entry.outputPerM ?? 0} per M`;
-        const window = entry.context !== undefined ? `, ${tokenWindowLabel(entry.context)}` : "";
-        notes.push(`${pair.model} — ${price}${window}`);
-        // A model with no effort list at all supports no thinking level, so a requested level is
-        // dropped just the same as one the list omits.
-        if (pair.thinking !== undefined &&
-            pair.thinking !== "" &&
-            !entry.efforts?.includes(pair.thinking)) {
-            warns.push(`${pair.model} has no ${pair.thinking} effort — that thinking level is dropped`);
-        }
-        const provider = opencodeProviderOf(pair.model);
-        if (provider !== undefined && !(await opencodeAuthLists(config, provider, pathEnv, timeoutMs))) {
-            warns.push(`${pair.model} is a non-gateway provider opencode does not list a credential for`);
-        }
-    }
-    warns.push(...opencodeConfigLeaks(xdgConfigHome !== "" ? xdgConfigHome : path.join(home, ".config")));
-    const db = statOrNull(opencodeDbPath(root));
-    const spillDir = opencodeSpillDir(root);
-    const spill = spillDir !== "" && isDirectory(spillDir) ? treeBytes(spillDir) : null;
-    const sizeNotes = `db ${formatBytes(db?.size ?? 0)}${spill !== null ? `, spill ${formatBytes(spill)}` : ", no spill dir"}`;
-    const found = [...fails, ...warns];
-    const base = found.length === 0 ? `opencode ready — ${notes.join("; ")}; ${sizeNotes}` : found.join("; ");
-    if (fails.length > 0)
-        return failOutcome(base);
-    return (warns.length > 0 ? warnOutcome : okOutcome)(base);
+    const rows = await collectOpencodeModelRows(readOpencodeCache(root), seamedModels(config, "opencode"), config, pathEnv, timeoutMs);
+    const warns = [
+        ...rows.warns,
+        ...opencodeConfigLeaks(xdgConfigHome !== "" ? xdgConfigHome : path.join(home, ".config")),
+    ];
+    const sizeNotes = opencodeStorageNote(root);
+    return opencodeOutcome(rows.fails, warns, rows.notes, sizeNotes);
 }

package/dist/src/doctor/doctor-principles.js

@@ -0,0 +1,26 @@
+import path from "node:path";
+import { readTextOrNull } from "../files/files.js";
+import { PRINCIPLES_MAX_CHARS } from "../prompt/principles.js";
+import { okOutcome, warnOutcome } from "./outcome.js";
+/** Doctor check for PRINCIPLES.md's injection cap. readPrinciples caps the trimmed text at
+ * PRINCIPLES_MAX_CHARS for every prompt's <principles> block, and principleBullets keeps only
+ * its leading bullets; a file over the cap loses its tail (and a long header eats bullet
+ * budget) with nothing telling the operator who edits it. This check warns when the file would
+ * truncate, naming the trimmed count, the cap, the marker, and the fix. Read-only, like every
+ * doctor check — it never edits PRINCIPLES.md. */
+export function checkPrinciples(root) {
+    const raw = readTextOrNull(path.join(root, "PRINCIPLES.md"));
+    if (raw === null)
+        return okOutcome("no PRINCIPLES.md");
+    const length = raw.trim().length;
+    if (length <= PRINCIPLES_MAX_CHARS) {
+        return okOutcome(`PRINCIPLES.md is within the ${PRINCIPLES_MAX_CHARS}-character prompt cap`);
+    }
+    return warnOutcome("PRINCIPLES.md has " +
+        `${length} trimmed characters, over the ${PRINCIPLES_MAX_CHARS}-character ` +
+        "prompt cap; every run's <principles> block carries only the head plus " +
+        "`…[PRINCIPLES.md truncated at " +
+        `${PRINCIPLES_MAX_CHARS} chars]` +
+        " and only the leading bullets survive — keep it to its list bullets and " +
+        "move long-form rationale into docs/ (not injected)");
+}

package/dist/src/doctor/doctor-project-checks.js

@@ -26,6 +26,7 @@ import { eventLogState, readEventsSince } from "../events/event-window.js";
 import { EVENTS_KEEP } from "../events/events.js";
 import { finiteNumber } from "../files/json-object.js";
 import { agree, plural, shortSpanPhrase } from "../text/phrases.js";
+import { andMore } from "./doctor-backlog.js";
 import { KNOWN_FLAKE_WINDOW_MS, loadQuarantine, repeatedFlakeCounts } from "../review/known-flakes.js";
 import { POST_MERGE_REJECT_WINDOW_MS, postMergeChurn } from "../review/post-merge-review.js";
 import { roleLabel } from "../roles/role-labels.js";
@@ -216,7 +217,7 @@ export function checkDurationPhrase(events) {
 export function checkBuildCheck(root, config) {
     const check = detectBuildCheck(root, config ?? undefined);
     if (!check)
-        return warnOutcome("none declared — the review gate's build pre-check, the red-main baseline, and redeploy's green check are all off (set `check.command` in tumwater.json for a non-npm repo)");
+        return warnOutcome("none declared — the review gate's build pre-check, the red-main baseline, and redeploy's green check are all off (set `check.command` in tumwater.json for a non-npm repo); the plan role will plan this project's check and the feature role declare it, a test/typecheck/build npm script or check.command");
     // The in-lock command from mergeCommandOf (absent mergeCommand falls back to the gate
     // command): the row names which command the merge lock runs and where the full check lands,
     // facts a reader cannot get from detectBuildCheck alone. The after-merge roles are not named
@@ -266,13 +267,10 @@ export function checkFlakyChecks(root, now = Date.now()) {
     return warnOutcome(phrases.join("; "));
 }
 /** A trailing day of at least `POST_MERGE_REJECT_WARN` post-merge `review_rejected` events — the
- * audit twin of the always-on `post-merge-churn` amber alert (src/ui/status-payload.ts
- * `postMergeChurnAlert`). Each rejection is an already-landed commit the reviewer turned back, so
- * it stays on main with the reviewer's reasons, so a churn day must not read as a clean
- * main. Shares the alert's
- * window, threshold and
- * event selection through `postMergeChurn`, so the doctor row and the alert cannot disagree on
- * when churn fires. ok/warn only — a churn burst does not stop the team. */
+ * audit of a day that must not read as a clean main: each rejection is an already-landed commit
+ * the reviewer turned back, so it stays on main with the reviewer's reasons. Reads the
+ * `POST_MERGE_REJECT_WINDOW_MS` window and
+ * threshold through `postMergeChurn`. ok/warn only — a churn burst does not stop the team. */
 export function checkPostMergeChurn(root) {
     const { events } = readEventsSince(root, POST_MERGE_REJECT_WINDOW_MS);
     const churn = postMergeChurn(events);
@@ -283,15 +281,15 @@ export function checkPostMergeChurn(root) {
         .join(", ")}) — each commit had already reached main and stays there with the reviewer's reasons; narrow \`review.afterMerge\` for the noisy role or raise the authoring bar`);
 }
 /** The one home of the doctor's `flaky checks` sentence: names each check that flapped more than
- * once, most frequent first, with how many times it flapped — the same wording the always-on
- * flapped-checks alert carries, so the doctor row and the alert cannot drift. null when `flapped`
+ * once, most frequent first, with how many times it flapped — the one sentence the doctor's
+ * `flaky checks` row shows. null when `flapped`
  * is empty (nothing crossed the bar). */
-export function flappedChecksPhrase(flapped) {
+function flappedChecksPhrase(flapped) {
     if (flapped.length === 0)
         return null;
     const render = ([k, n]) => `"${k}" ×${n}`;
     const [first, ...rest] = flapped;
-    const more = rest.length > 0 ? ` (and ${rest.length} more: ${rest.map(render).join(", ")})` : "";
+    const more = andMore(rest, render);
     return `${agree(flapped.length, "check", "checks")} flapped more than once in the last 24h: ${render(first)}${more}`;
 }
 /** Build provenance — is the harness about to run (this process's dist/) the code main
@@ -324,7 +322,7 @@ running = null) {
             : running?.restartPending
                 ? "; auto-restart is under way"
                 : "; run `npm run build` and restart `tumwater start` (auto-restart does this for a running team)";
-        return warnOutcome(`dist/ from ${sha} is stale — main has ${stale.aheadCommits} later commit(s) touching ${STALE_INPUTS_LABEL}${next}`);
+        return warnOutcome(`dist/ from ${sha} is stale — main has ${plural(stale.aheadCommits, "later commit")} touching ${STALE_INPUTS_LABEL}${next}`);
     }
     return okOutcome(`dist/ from ${sha}, matches main`);
 }
@@ -343,7 +341,7 @@ function currentHead(root) {
  * on every merge and the ci role runs on its own clock, so a post-merge gap is normal and must
  * not turn the Health card or the exit code red. A stale verdict that stays stale past
  * `CI_PARITY_STALE_MS` (ciParityStalled) is a stall — the full suite has silently stopped
- * covering new tips — and warns, alongside the standing `ci-stale` alert. Read-only against
+ * covering new tips — and warns. Read-only against
  * .tumwater/. */
 export function checkCiParity(root, config, now = Date.now()) {
     const entry = readCiParity(root);
@@ -359,9 +357,9 @@ export function checkCiParity(root, config, now = Date.now()) {
     }
     // A stale verdict is normal right after a merge (main moves and the ci role runs on its own
     // clock), but one that stays stale past CI_PARITY_STALE_MS is a stall: the full suite has
-    // silently stopped covering new tips. The doctor warn and the standing `ci-stale` alert share
-    // this one predicate (ciParityStalled), so the row and the alert cannot disagree on when a
-    // gap is a problem. Inside the window the existing friendly stale wording stands.
+    // silently stopped covering new tips. This warn is the one place ciParityStalled is applied —
+    // the row is the standing signal. Inside the window the existing friendly stale wording
+    // stands.
     if (ciParityStalled({ state: "stale", lastRunAt: entry.lastRunAt }, now)) {
         return warnOutcome(`stale and stalled — the last run covered ${shortSha(entry.tip)} @ lock ${shortSha(entry.lockHash)} ${age} ago (${entry.result}); main is now ${shortSha(tip)} @ lock ${shortSha(lockHash)} — no full-suite run has covered a tip in over ${CI_PARITY_STALE_MS / DAY_MS} days, so the ci role is disabled, paused, or unable to record`);
     }
@@ -374,8 +372,8 @@ export function checkCiParity(root, config, now = Date.now()) {
  * is not a stall); a fresh ledger reads ok naming the newest exercised flow and its age. A
  * ledger whose newest exercise is older than `QA_COVERAGE_STALE_MS` (qaCoverageStalled) is a
  * `warn` naming that flow and its age — the role is disabled, paused, or unable to record —
- * alongside the standing `qa-stale` alert, both through the one `qaCoverageStalled` predicate
- * so the row and the alert cannot disagree. Read-only against .tumwater/. */
+ * via the one `qaCoverageStalled` predicate, this row the standing signal. Read-only against
+ * .tumwater/. */
 export function checkQaCoverage(root, now = Date.now()) {
     const coverage = readQaCoverage(root);
     const entries = Object.entries(coverage);
@@ -395,3 +393,55 @@ export function checkQaCoverage(root, now = Date.now()) {
     }
     return okOutcome(`newest flow coverage: ${newestFlow} exercised ${age} ago`);
 }
+/** How far back the `main diff rules` row looks — one day, the same 24 h trailing-day convention
+ * every event-reading doctor row uses, so a diff-rule failure the main watch logged stays a
+ * standing warn until a day passes. Owned here (the check that reads it). */
+const MAIN_RULE_FAILURE_WINDOW_MS = 24 * 60 * 60_000;
+/** The exact substring src/baseline/main-watch.ts's `watchRules` logs in its warning, so this
+ * check matches a real rule failure and cannot drift from the wording the watch writes. */
+const MAIN_RULE_FAILURE_MARKER = "fails the diff rules";
+/** The doctor's `main diff rules` row: a `warning` the main watch logged when the review gate's
+ * diff rules rejected main's tip in the trailing day. The gate judges one change; the watch
+ * judges each first-parent commit's own diff, so a conflict marker, a protected edit, a leaked
+ * secret, a phantom fix claim or a broken backlog structure that reached main through a gate
+ * blind spot sits on main with only this event log to say so. Reads only the `warning` event
+ * the watch already writes, so the row cannot drift from the watch's wording; the most recent
+ * hit names the tip and the rule. ok/warn only — it never fails a scripted pre-flight. */
+export function checkMainDiffRules(root) {
+    const { events } = readEventsSince(root, MAIN_RULE_FAILURE_WINDOW_MS);
+    const hits = events.filter((e) => e.type === "warning" && typeof e.message === "string" && e.message.includes(MAIN_RULE_FAILURE_MARKER));
+    if (hits.length === 0)
+        return okOutcome("no diff-rule failure on main in the last day");
+    const latest = hits[hits.length - 1];
+    return warnOutcome(`${plural(hits.length, "diff-rule failure on main", "diff-rule failures on main")} in the last day — most recently ${String(latest.message)} — the gate approved a diff the watch's rules reject; repair the tip or revert it with \`tumwater revert <sha>\``);
+}
+/** The exact prefix src/merge/merge-post-review-drain.ts logs when it drops a post-merge
+ * review at POST_REVIEW_FAILURE_LIMIT. The drain drops in two ways and logs each with its own
+ * tail — "it stays on main unreviewed" after failed runs (the commit never got a review) and
+ * "the fix stays unreviewed" after failed fix merges (the fix ref is deleted, main unmoved) —
+ * so this check matches the shared "dropping the post-merge review of" prefix both share, not
+ * either tail. The drain also files the drop in BUGS.md as best-effort ordinary backlog work
+ * (fileDroppedReview), but a skipped filing (off-base checkout or a dirty BUGS.md) leaves only
+ * this event log standing, so this check matches the drain's own wording. */
+const DROPPED_REVIEW_MARKER = "dropping the post-merge review of";
+/** How far back the `dropped post-merge reviews` row looks — one day, the same 24 h trailing-day
+ * convention every event-reading doctor row uses. Owned here (the check that reads it). */
+const DROPPED_REVIEW_WINDOW_MS = 24 * 60 * 60_000;
+/** The doctor's `dropped post-merge reviews` row: a `warning` the post-merge-review drain
+ * (src/merge/merge-post-review-drain.ts) wrote when it dropped a review at
+ * POST_REVIEW_FAILURE_LIMIT — after failed runs its commit stays on main unreviewed, and
+ * after failed fix merges the fix ref is deleted (main unmoved) so the commit stays
+ * unreviewed; either way the review is gone and no longer in the queue the `post-merge
+ * reviews` row reads. The drain files the dropped review in BUGS.md as best-effort ordinary
+ * backlog work, so when that filing is skipped this row is the standing signal naming the
+ * dropped review. Reads only the `warning` event the drain already writes, so it cannot drift
+ * from the drain's wording; the most recent hit names the commit. ok/warn only — an
+ * unreviewed commit is operator signal, not a broken environment. */
+export function checkDroppedPostMergeReviews(root) {
+    const { events } = readEventsSince(root, DROPPED_REVIEW_WINDOW_MS);
+    const hits = events.filter((e) => e.type === "warning" && typeof e.message === "string" && e.message.includes(DROPPED_REVIEW_MARKER));
+    if (hits.length === 0)
+        return okOutcome("no post-merge review was dropped in the last day");
+    const latest = hits[hits.length - 1];
+    return warnOutcome(`${plural(hits.length, "post-merge review was dropped", "post-merge reviews were dropped")} in the last day — the dropped review is gone and its commit stays unreviewed; most recently ${String(latest.message)}`);
+}

package/dist/src/doctor/doctor-role-notes.js

@@ -0,0 +1,33 @@
+import { readRoleNotesOverCap } from "../status/status-role-notes.js";
+import { ROLE_NOTES_MAX_BYTES } from "../agent/role-notes-write.js";
+import { agree, plural } from "../text/phrases.js";
+import { okOutcome, warnOutcome } from "./outcome.js";
+/** How many oversized notes the `role notes` row names before appending "and N more", the
+ * cap the other multi-role observer rows (e.g. workspaces) use so a long tail does not drown
+ * the report. */
+const ROLE_NOTES_NAMED_CAP = 3;
+/** The `role notes` check: whether any role's notes file would be truncated when read into
+ * that role's run prompt. `readRoleNote` (src/run/run-prompt.ts) cuts every notes file at
+ * ROLE_NOTES_MAX_BYTES *characters* on read (truncateWithNote's text.length bound), but every
+ * operator surface reads the file whole — so a hand edit or old build can leave a note the
+ * operator sees and the role never does. This row warns on that gap without touching the file.
+ * The over-cap walk is shared with the status snapshot's collectRoleNotesOverCap
+ * (src/status/status-role-notes.ts), so the row and the status alert cannot disagree about
+ * which notes are over the bound; null means the notes dir is missing or unreadable.
+ * Read-only against .tumwater/, like every check. Never throws. */
+export function checkRoleNotes(root) {
+    const over = readRoleNotesOverCap(root);
+    if (over === null) {
+        // Missing or unreadable notes dir: nothing recorded yet (the write path creates it).
+        return okOutcome("no role notes recorded yet");
+    }
+    if (over.length === 0) {
+        return okOutcome(`every role note is within the ${ROLE_NOTES_MAX_BYTES}-character read bound`);
+    }
+    const first = over
+        .slice(0, ROLE_NOTES_NAMED_CAP)
+        .map((o) => `${o.role} (${o.chars})`)
+        .join(", ");
+    const more = over.length > ROLE_NOTES_NAMED_CAP ? ` and ${over.length - ROLE_NOTES_NAMED_CAP} more` : "";
+    return warnOutcome(`${plural(over.length, "note", "notes")} across ${plural(over.length, "role", "roles")} ${agree(over.length, "exceeds", "exceed")} the ${ROLE_NOTES_MAX_BYTES}-character read bound: ${first}${more} — each role's prompt shows only the truncated head, so rewrite the note under the cap (tumwater role <id> --notes-file <path> or the tumwater-notes shim)`);
+}

package/dist/src/doctor/doctor.js

@@ -6,16 +6,18 @@ import { checkOrphans } from "./doctor-orphans.js";
 import { checkBudget, checkErrorStreaks, checkMainRed, checkMaintenanceQuota, checkPause, checkProviderHolds, checkQuietHours, checkSubscriptionWindow } from "./doctor-holds.js";
 import { checkRootInstall } from "./doctor-install.js";
 import { checkNotify } from "./doctor-notify.js";
+import { checkRoleNotes } from "./doctor-role-notes.js";
 import { checkLaunchServicesPorts } from "./doctor-launch-services.js";
 import { plural } from "../text/phrases.js";
 import { shortSha } from "../text/format.js";
 import { failOutcome } from "./outcome.js";
 import { errorMessage } from "../text/text.js";
 import { checkBackendBinary, checkBrief, checkBootstrap, checkClaudeTranscripts, checkExecPath, checkFunes, checkGitBinary, checkConfigKeyNames, checkInit, checkOpencodeVersion, checkNodeVersion, checkPiExtensions, checkRepo, } from "./doctor-checks.js";
-import { checkBuild, checkBuildCheck, checkCiParity, checkDiskSpace, checkEventLog, checkFlakyChecks, checkPostMergeChurn, checkQaCoverage, checkStateDir, } from "./doctor-project-checks.js";
+import { checkPrinciples } from "./doctor-principles.js";
+import { checkBuild, checkBuildCheck, checkCiParity, checkDiskSpace, checkDroppedPostMergeReviews, checkEventLog, checkFlakyChecks, checkMainDiffRules, checkPostMergeChurn, checkQaCoverage, checkStateDir, } from "./doctor-project-checks.js";
 import { sampleFreeBytes } from "../gates/disk-gate.js";
 import { checkCheckContention, checkLeftoverRoleBranches, checkMergeLock, checkProviderConcurrency, checkProviderContention, checkTumwaterPins, checkWorkInstances, checkWorktreePool, } from "./doctor-contention-checks.js";
-import { checkFeedbackFiling, checkImageInput, checkTierModels } from "./doctor-model-checks.js";
+import { checkFeedbackFiling, checkTierModels } from "./doctor-model-checks.js";
 import { checkFallbackChain, checkFallbackModel } from "./doctor-fallback-checks.js";
 import { checkAnthroApiKey, checkClaudeAuth, checkClaudeVersion } from "./doctor-claude-checks.js";
 import { checkOpencode } from "./doctor-opencode-checks.js";
@@ -23,7 +25,7 @@ import { checkCodexAccount, checkCodexAuth, checkCodexHome, checkCodexLeaks, che
 import { backendQualifiedSelector } from "../config/config-views.js";
 import { seamsInUse } from "../config/config-fallbacks.js";
 import { checkBacklogHeadings, checkFixClaims, checkLiveFinished, checkPlanDependencies, checkStalledEntries, checkStrandedPlans, checkValidationGaps } from "./doctor-backlog-plans.js";
-import { checkRefusedEntries, checkRegressedFixes, checkStaleBugs, checkStaleQuestions, checkWaitingBugs } from "./doctor-backlog-bugs.js";
+import { checkRefusedEntries, checkRegressedFixes, checkStaleBugs, checkStaleQuestions } from "./doctor-backlog-bugs.js";
 import { checkMergeQueueFiles, checkPostReviews, checkStaleQueuedMerges, checkStalePrompts, checkUncommittedBacklog } from "./doctor-backlog.js";
 /** Pre-flight environment check (`tumwater doctor`). The harness's preconditions are
  * scattered across fail-fast checks that each command re-runs on its own (requireReadyRepo in
@@ -59,7 +61,7 @@ export async function runDoctorCheck(run) {
  * just the named checks, in report order; a skipped check is never evaluated, and a named
  * conditional check that returns null leaves no row. A check that throws becomes its own fail
  * row, and every other check still runs. */
-export async function runDoctor(root, pathEnv = envPath(), probe = systemProcessProbe, probeImages = "never", only, diskSample = sampleFreeBytes) {
+export async function runDoctor(root, pathEnv = envPath(), probe = systemProcessProbe, only, diskSample = sampleFreeBytes) {
     // Loaded once for the checks that read config (repo's baseBranch); a broken file stays
     // undefined — checkInit reports it verbatim — so doctor still runs every other check.
     const { config } = loadConfigSafe(root);
@@ -86,6 +88,7 @@ export async function runDoctor(root, pathEnv = envPath(), probe = systemProcess
         { name: "init", run: () => checkInit(root) },
         { name: "config key names", run: () => checkConfigKeyNames(root) },
         { name: "brief", run: () => checkBrief(root) },
+        { name: "principles", run: () => checkPrinciples(root) },
         // New-project bootstrap (plans/work-ratio.md, part 2/2): an active hold reports as ok
         // information, never a warning — a young project is not misconfigured.
         { name: "bootstrap", run: () => checkBootstrap(root, config) },
@@ -104,7 +107,6 @@ export async function runDoctor(root, pathEnv = envPath(), probe = systemProcess
         { name: "over-cap model", run: () => checkFallbackModel(root, undefined, (orchestratorAlive(root, info) && info?.fallbackDemoted) || null) },
         { name: "fallback chain", run: () => checkFallbackChain(root) },
         { name: "models for each tier", run: () => checkTierModels(root) },
-        { name: "image input", run: () => checkImageInput(root, undefined, undefined, undefined, probeImages, pathEnv) },
         { name: "claude auth", run: () => checkClaudeAuth(root, pathEnv) },
         { name: "claude api key", run: () => checkAnthroApiKey(root, undefined, pathEnv) },
         { name: "claude version", run: () => checkClaudeVersion(root, pathEnv) },
@@ -143,6 +145,10 @@ export async function runDoctor(root, pathEnv = envPath(), probe = systemProcess
         { name: "check", run: () => checkBuildCheck(root, config) },
         { name: "ci parity", run: () => checkCiParity(root, config, Date.now()) },
         { name: "qa coverage", run: () => checkQaCoverage(root, Date.now()) },
+        // The role-notes read gap (plans/role-notes): every operator surface reads a role's notes
+        // file whole while the run prompt truncates it at ROLE_NOTES_MAX_BYTES; this row surfaces the
+        // gap read-only, beside the other per-role observer rows (feedback filing, workspaces).
+        { name: "role notes", run: () => checkRoleNotes(root) },
         { name: "root install", run: () => checkRootInstall(root) },
         // The review gate's flake memory, surfaced read-only: naming which checks the gate kept
         // excusing as flakes (ok/warn only, so a flaky suite never fails a scripted pre-flight).
@@ -158,11 +164,12 @@ export async function runDoctor(root, pathEnv = envPath(), probe = systemProcess
         { name: "plan dependencies", run: () => checkPlanDependencies(root) },
         { name: "stale questions", run: () => checkStaleQuestions(root) },
         { name: "stale bugs", run: () => checkStaleBugs(root) },
-        { name: "waiting bugs", run: () => checkWaitingBugs(root) },
         { name: "regressed fixes", run: () => checkRegressedFixes(root) },
         { name: "stale merge-queue entries", run: () => checkStaleQueuedMerges(root, Date.now()) },
         { name: "merge-queue files", run: () => checkMergeQueueFiles(root) },
         { name: "post-merge reviews", run: () => checkPostReviews(root) },
+        { name: "main diff rules", run: () => checkMainDiffRules(root) },
+        { name: "dropped post-merge reviews", run: () => checkDroppedPostMergeReviews(root) },
         { name: "stale prompts", run: () => checkStalePrompts(root, Date.now()) },
         { name: "uncommitted backlog", run: () => checkUncommittedBacklog(root, config) },
         // The running team's own view of its build (staleness and what auto-restart made of it)

package/dist/src/doctor/probe.js

@@ -20,7 +20,7 @@ export const AUTH_CHECK_MAX_OUTPUT_BYTES = 1024 * 1024;
  * spawn closes for git). stderr is ignored rather than piped, since nothing reads it and a
  * full stderr pipe would block the child. `timeoutMs` and `maxOutputBytes` are test seams;
  * production callers pass their own named constants. One home of the shape, shared by the
- * model checks' credential/version probes, the tier-model probes, and the image-input probe —
+ * model checks' credential/version probes, and the tier-model probes —
  * before the split each doctor module carried its own byte-for-byte copy. The credential probes'
  * named budgets (AUTH_CHECK_TIMEOUT_MS, AUTH_CHECK_MAX_OUTPUT_BYTES) live beside it here, so the
  * backend check modules share them without importing them from one another. */