tumwater 0.4.0 → 0.4.2

package/dist/src/status/status-polls.js

@@ -59,6 +59,7 @@ function scanMainCheck(root) {
     // The final window's merged events, in scan order — collected in the same pass that
     // finds the check instead of a second full scan of the window below.
     let mergeDone = [];
+    let culprit;
     const grewFull = mainCheckGrewFull.has(root);
     // A set note means the previous scan reached the cap without finding a check, so start
     // there: starting at DEFAULT_EVENT_TAIL would only re-read (and re-parse on a cache miss)
@@ -68,9 +69,11 @@ function scanMainCheck(root) {
         const events = readEvents(root, window);
         check = undefined;
         mergeDone = [];
-        // One pass collects both facts the derivation needs: the newest merge-scope check and
-        // every merged event. The merges are re-read against the check's ts below — a pass
-        // over the merges alone, not a second pass over every event in the window.
+        culprit = undefined;
+        // One pass collects all three facts the derivation needs: the newest merge-scope check,
+        // every merged event, and the newest main_culprit blame. The merges are re-read against
+        // the check's ts below — a pass over the merges alone, not a second pass over every
+        // event in the window.
         for (const e of events) {
             if (e.type === "build_check" && isFullCheckScope(e.scope, e.full)) {
                 check = e;
@@ -78,6 +81,9 @@ function scanMainCheck(root) {
             else if (e.type === "merge_done" && typeof e.ts === "number") {
                 mergeDone.push(e);
             }
+            else if (e.type === "main_culprit") {
+                culprit = e;
+            }
         }
         // Found, the log is shorter than the window (nothing older exists to find), or the cap
         // is reached: the tail is final. A stale `check` from a previous, smaller window cannot
@@ -93,7 +99,7 @@ function scanMainCheck(root) {
     else
         mainCheckGrewFull.add(root);
     if (!check || typeof check.ts !== "number" || !isMainCheckStatus(check.status)) {
-        return { check: undefined };
+        return { ...(culprit ? { culprit } : {}) };
     }
     let mergeDoneAfter;
     let mergeDoneBefore;
@@ -105,6 +111,7 @@ function scanMainCheck(root) {
     }
     return {
         check,
+        ...(culprit ? { culprit } : {}),
         ...(typeof mergeDoneAfter?.commit === "string" ? { mergeDoneAfterCommit: mergeDoneAfter.commit } : {}),
         ...(typeof mergeDoneBefore?.commit === "string" ? { mergeDoneBeforeCommit: mergeDoneBefore.commit } : {}),
     };
@@ -113,7 +120,11 @@ function scanMainCheck(root) {
  * copies the one check event and the record, so a caller never receives the cached object
  * itself. */
 function mainCheckScanFor(root) {
-    return (cachedByStat(mainCheckScanCache, root, eventsLogPath(root), () => scanMainCheck(root), (v) => ({ ...v, ...(v.check ? { check: { ...v.check } } : {}) })) ?? { check: undefined });
+    return (cachedByStat(mainCheckScanCache, root, eventsLogPath(root), () => scanMainCheck(root), (v) => ({
+        ...v,
+        ...(v.check ? { check: { ...v.check } } : {}),
+        ...(v.culprit ? { culprit: { ...v.culprit } } : {}),
+    })) ?? { check: undefined });
 }
 /** Has main's newest merge-scope check retired a role's stale `main_red` verdict? Only a
  * PASSED check stamped strictly after the role's red run ended counts — the team-level
@@ -143,11 +154,36 @@ export function mainCheckForPoll(root, cfg) {
     const branch = targetBranch(cfg.baseBranch, currentBranchFromHeadFile(root));
     const sha = scan.mergeDoneAfterCommit ?? readBranchHead(root, branch) ?? scan.mergeDoneBeforeCommit;
     const counts = asTestCounts(check.counts);
+    // The red evidence names the failing test and the merge the main watch blamed — and that
+    // data lives only on the main_culprit event (the main watch's verdict on the red tip; the
+    // build_check event itself carries no failing tests), attributed only when the verdict's
+    // commit is exactly the sha this poll derived, so a newer build_check failure can't borrow
+    // a blame the watch wrote for a different head. A passing/skipped check, or a failing one
+    // whose tip the watch hasn't blamed, keeps today's exact MainCheckStatus shape (no `red`).
+    let red;
+    if (check.status === "failed" && sha !== undefined && scan.culprit && typeof scan.culprit.commit === "string") {
+        const c = scan.culprit;
+        if (c.commit === sha) {
+            const failing = Array.isArray(c.failingTests) && typeof c.failingTests[0] === "string"
+                ? c.failingTests.filter((f) => typeof f === "string")
+                : undefined;
+            if (failing) {
+                red = {
+                    failingTests: failing,
+                    culprit: {
+                        commit: c.commit,
+                        ...(typeof c.runner === "string" ? { runner: c.runner } : {}),
+                    },
+                };
+            }
+        }
+    }
     return {
         ...(sha ? { sha } : {}),
         status: check.status,
         ...(counts ? { counts } : {}),
         at: check.ts,
+        ...(red ? { red } : {}),
     };
 }
 /** The parity ledger's glance verdict for one status poll, or undefined when there is no

package/dist/src/status/status-role-notes.js

@@ -0,0 +1,53 @@
+import fs from "node:fs";
+import path from "node:path";
+import { readTextOrNull } from "../files/files.js";
+import { cachedByStat } from "../files/stat-cache.js";
+import { roleNotesPath } from "../paths.js";
+import { ROLE_NOTES_MAX_BYTES } from "../agent/role-notes-write.js";
+/** The per-file lengths, keyed by absolute path. One stat per unchanged file per poll (the
+ * same stat-keyed contract status-inbox.ts relies on for the inbox's prompt cache), so the
+ * dashboards' once-a-second poll never re-reads an unchanged notes file. */
+const noteLengthCache = new Map();
+/** Every role whose notes file runs past the read bound, in descending-char order — the
+ * single home of the role-notes over-cap walk, shared by the status snapshot's
+ * `collectRoleNotesOverCap` and the doctor `role notes` row
+ * (src/doctor/doctor-role-notes.ts's checkRoleNotes), so the alert and the doctor row cannot
+ * disagree about which notes are over the bound. `readRoleNote` (src/run/run-prompt.ts) cuts
+ * every notes file at ROLE_NOTES_MAX_BYTES *characters* on read, but every operator surface
+ * reads the file whole — so a hand-edited or old-build note past the bound reaches that role's
+ * run prompt as only its head plus a truncation marker while `tumwater status` looks green.
+ * Returns null when the notes dir is missing or unreadable (the write path creates it on first
+ * write), whose callers each map to their own "nothing recorded yet" reading. Never throws. */
+export function readRoleNotesOverCap(root) {
+    const notesDir = path.dirname(roleNotesPath(root, "role"));
+    let entries;
+    try {
+        entries = fs.readdirSync(notesDir);
+    }
+    catch {
+        // Missing or unreadable notes dir: nothing recorded yet (the write path creates it).
+        return null;
+    }
+    const over = [];
+    for (const name of entries) {
+        if (!name.endsWith(".md"))
+            continue;
+        const file = path.join(notesDir, name);
+        const chars = cachedByStat(noteLengthCache, file, file, () => {
+            const text = readTextOrNull(file);
+            return text === null ? null : text.length;
+        }, (n) => n);
+        if (chars === null)
+            continue;
+        if (chars > ROLE_NOTES_MAX_BYTES)
+            over.push({ role: name.slice(0, -3), chars });
+    }
+    over.sort((a, b) => b.chars - a.chars);
+    return over;
+}
+/** The role-notes slice of a status snapshot as a plain array for the dashboard payloads:
+ * every over-cap note in descending-char order, or [] when the notes dir is missing (the same
+ * "nothing recorded yet" degrade the doctor's checkRoleNotes treats as a pass). */
+export function collectRoleNotesOverCap(root) {
+    return readRoleNotesOverCap(root) ?? [];
+}

package/dist/src/status/status-roles.js

@@ -3,17 +3,17 @@ import { configForRole, modelSelectorField, roleSeamTier, } from "../config/conf
 import { modelFallbackView } from "../config/config-fallbacks.js";
 import { isCustomRole } from "../config/config.js";
 import { baseRoleOf, configuredInstances, instanceIndex, runnerIds, runnerPaused } from "../roles/runner-ids.js";
-import { ERROR_STREAK_WARN, QUIET_KILL_RESUME_LIMIT } from "../run/run-apply.js";
+import { errorStreakAtWarn, QUIET_KILL_RESUME_LIMIT } from "../run/run-apply.js";
 import { queuedMergeRoles } from "../merge/merge-queue.js";
 import { hasOutstandingWork } from "../runner/runner-state.js";
 import { formatModelSelector } from "../config/model-selector.js";
 import { piSettingsPath, readPiDefaultModel } from "../pi/pi-settings.js";
 import { isJsonObject } from "../files/json-object.js";
 import { runnerStateForPoll } from "./status-polls.js";
-import { roleImageInfo, seamImageLabel } from "../agent/image-input.js";
+import { roleImageInfo } from "../agent/image-input.js";
 import { backendDefaultLabel } from "../agent/backend-traits.js";
 import { readPiListedModels } from "../pi/pi-listed-models.js";
-import { imageProbeEntryFresh, readImageProbeCache } from "../doctor/image-probe.js";
+import { seamContextWindowForRole } from "../pi/pi-models.js";
 /** One row per enabled role id (part 5b/7). `configForRole`, `modelFallbackView`, the leased /
  * pinned slot and the pi-default seam all resolve against the values `snapshot()` already
  * read once for the poll — the info and slots pins (threaded as `slots`) keep rows, `running`
@@ -42,13 +42,10 @@ export function collectRoleRows(root, cfg, now, slots, modelsPath, paused) {
             queued.has(r) ||
             s.claim !== undefined ||
             hasOutstandingWork(s) ||
-            (s.consecutiveErrors ?? 0) >= ERROR_STREAK_WARN ||
+            errorStreakAtWarn(s) ||
             (s.lastResult === "quiet_killed" && (s.quietKillStreak ?? 0) >= QUIET_KILL_RESUME_LIMIT));
     });
     const piDefault = readPiDefaultModel(piSettingsPath(modelsPath), root);
-    // One probe-cache read per poll serves every row's image-input surface (same no-data policy
-    // as every other degraded read: a missing cache is an empty one).
-    const probes = readImageProbeCache(root);
     const listed = readPiListedModels(root);
     return roles.map((r) => {
         const base = { ...runnerStateForPoll(root, r), custom: isCustomRole(cfg, r) };
@@ -65,7 +62,11 @@ export function collectRoleRows(root, cfg, now, slots, modelsPath, paused) {
         // capability and its reroute target, one shared resolver so the status rows, the role
         // page, and the submit gate cannot disagree about who reads images or where a blind
         // prompt would run.
-        const image = roleImageInfo(cfg, r, modelsPath, probes, listed);
+        const image = roleImageInfo(cfg, r, modelsPath, listed);
+        // The peak-ctx share denominator (the role's context window, part 3c): resolved once per
+        // poll here, beside `eff` (the same seam the role page resolves and names) — the same seam
+        // `seamContextWindow` run against, so row, page and drawer cannot disagree.
+        const contextWindow = seamContextWindowForRole(cfg, r, root, modelsPath);
         // Model failure fallback, part 2/2: while the role's episode is active its agent runs use
         // the tier-resolved fallback pair, so the row names that pair, the episode's start, and
         // the failure that tripped it. `now` is the poll's own clock (the snapshot seam), so
@@ -106,37 +107,9 @@ export function collectRoleRows(root, cfg, now, slots, modelsPath, paused) {
                 : { model: backendDefaultLabel(eff.agent) }),
             ...(isJsonObject(cfg.model) ? { modelTier: roleSeamTier(cfg, r) } : {}),
             ...(episode !== null ? { fallback: episode } : {}),
+            ...(contextWindow !== null ? { contextWindow } : {}),
             ...(slot ? { slot: path.basename(slot.dir), slotPinned: pinned !== undefined } : {}),
             ...(baseRoleOf(r) === r ? {} : { instanceOf: baseRoleOf(r) }),
         };
     });
 }
-/** The doctor's live-probe failures (plans/image-input.md "Surfaces", part 5/5): every cached
- * probe verdict of `fail` that is still fresh (the claim is unchanged and within the 7-day
- * TTL), labelled as `<provider>/<model>`. A claimed model that failed the probe reads `false`
- * everywhere (seamImageInput honors a fresh failure), but the observability value is naming
- * it — a claim the doctor contradicted is exactly what the amber probe alert and the role/status
- * rows should surface, not just "this role is text-only". A torn or missing cache answers
- * empty (the same no-data policy as the per-role read). */
-export function collectImageProbeFailures(root, now = Date.now()) {
-    const probes = readImageProbeCache(root);
-    const out = [];
-    for (const [key, entry] of Object.entries(probes)) {
-        if (entry.verdict !== "fail" || !imageProbeEntryFresh(entry, now))
-            continue;
-        // The cache key is agent/provider/model, and a pi model id is itself fully qualified (the
-        // key's third segment can carry embedded '/' — parseModelSelector keeps the id whole), so
-        // split only the first two separators and keep the rest as the model. A naive split("/")
-        // destructured to three parts would truncate a qualified id to its org, mislabelling the
-        // model the doctor flagged.
-        const first = key.indexOf("/");
-        const second = key.indexOf("/", first + 1);
-        if (first === -1 || second === -1)
-            continue;
-        const agent = key.slice(0, first) || undefined;
-        const provider = key.slice(first + 1, second) || undefined;
-        const model = key.slice(second + 1) || undefined;
-        out.push(seamImageLabel(agent, provider, model));
-    }
-    return out.sort();
-}

package/dist/src/text/datetime.js

@@ -16,7 +16,7 @@ import { EVENTS_LOG_BASENAME } from "../paths.js";
  * (or `N * DAY_MS`) below. */
 export const HOUR_MS = 60 * 60 * 1000;
 /** Milliseconds in a day — the sibling of `HOUR_MS`: the shared day unit for the
- * day-sized retention and lookback constants (the opencode-catalog and image-probe TTLs,
+ * day-sized retention and lookback constants (the opencode-catalog TTL,
  * the doctor's stale-pin/merge/prompt/wait checks, the known-flake and selfcheck
  * windows, the dashboard-history since bound, the retention prune, the claude-window
  * lookback) so one day cannot mean slightly different spans per consumer. */
@@ -52,6 +52,13 @@ export function secondsSince(sinceMs, now) {
 export function secondsUntil(atMs, now) {
     return Math.max(0, Math.round((atMs - now) / 1000));
 }
+/** Whole seconds from `now` to a unix-seconds instant (stamps providers emit as whole seconds,
+ * not millis), clamped at zero — the secondsUntil ×1000 fold shared by the claude and codex
+ * stream translators' rate-limit retry-after computations (both carry a `resetsAt`/`resets_at`
+ * unix-seconds stamp), so the unix-seconds-to-epoch-ms conversion lives in one place. */
+export function secondsUntilUnixStamp(seconds, now) {
+    return secondsUntil(seconds * 1000, now);
+}
 /** Calendar date as `YYYY-MM-DD` in local time — shared by the transcript run separators,
  * the daily-budget day stamp (todayStamp), and the usage report's per-day buckets, which must
  * all agree on what counts as one day. */

package/dist/src/text/format.js

@@ -36,6 +36,18 @@ export function compactTokens(n) {
         return `${(n / 1_000_000).toFixed(1)}M`;
     return n >= 10_000 ? `${(n / 1000).toFixed(1)}k` : String(n);
 }
+/** A peak context reading its share of the role's declared context window (`110.0k (84%)`) —
+ * the single home of the share format so the status table's `peak ctx` cell, the GUI/`status
+ * --json` role payload, the dashboard role drawer, and the `history <role> <n>` summary header
+ * all render a peak against a window identically. When the window is unknown
+ * (null/undefined/0) or the peak is 0 there is no meaningful share, so it returns exactly
+ * `compactTokens(peakTokens)` — the bare peak today's surfaces print. The percentage is
+ * floor-free rounded: `Math.round((100 * peak) / window)`. */
+export function contextShareLabel(peakTokens, windowTokens) {
+    if (!windowTokens || !peakTokens)
+        return compactTokens(peakTokens);
+    return `${compactTokens(peakTokens)} (${Math.round((100 * peakTokens) / windowTokens)}%)`;
+}
 /** The abbreviated form of a commit hash for human-facing text — its first 8 characters.
  * The single home of this format: the event feed's merged/review lines and the review gate's
  * discard warning all render hashes through it, so the abbreviation length cannot drift per
@@ -68,7 +80,7 @@ export function usdCap(n) {
 }
 /** A disk size in GB for display: one decimal and the unit (`12.3 GB`) — the single home of
  * the disk-size format shared by the event feed's disk lines (event-format.ts), the status
- * header's disk badge (badges.ts's `diskBadge`), the team's low-disk alert (team-alerts.ts),
+ * header's disk badge (badges.ts's `diskBadge`), the team's low-disk alert (team-alert-status.ts),
  * the doctor's disk check detail (doctor-project-checks.ts), and `tumwater reclaim`'s
  * freed-size line (operator-commands.ts), so the decimal width and unit cannot drift per
  * consumer. A caller

package/dist/src/text/phrases.js

@@ -80,8 +80,9 @@ export function mainRedNotMine(sha) {
 }
 /** The ` — "<reason>"` suffix the operator's pause reason (`pause --reason <text>`) rides on —
  * one home so the CLI's confirmation line (operator/operator-commands.ts), the status header's
- * pause badge (ui/badges.ts), and the paused alert's title (ui/team-alerts.ts) cannot drift on the
- * quoting. No reason, no suffix: every caller's reasonless phrasing keeps today's byte-exact form.
+ * pause badge (ui/badges.ts), and the paused alert's title (ui/team-alert-tail.ts) cannot
+ * drift on the quoting. No reason, no suffix: every caller's reasonless phrasing keeps
+ * today's byte-exact form.
  * (The GUI keeps its own JS copies in gui-client.ts: a separate runtime that cannot import
  * TypeScript.) */
 export function pauseReasonSuffix(reason) {
@@ -220,6 +221,19 @@ export function backendKindPhrase(kind) {
             return "backend failure";
     }
 }
+/** True when a hold/resume event's kind names an actual backend failure rather than a
+ * rate-limit (or an unreadable, torn-line kind). The one home of the "not a 429"
+ * discriminator: an absent, blank, or `"rate-limit"` kind keeps the 429 wording every
+ * historical event already has, and only a real non-empty backend kind names itself
+ * (through backendKindPhrase). Shared by the event feed (event-format.ts's
+ * rate_limit_hold/recovered lines) and the failure digest's Team state-change lines
+ * (src/failure/failure-state-change.ts's rate_limit_hold/resumed), so the two cannot
+ * disagree. Not to be confused with isBackendFailureKind in pi-failure.ts, which is a
+ * strict enum-membership guard for the 5 BACKEND_FAILURE_KINDS: this predicate instead
+ * accepts any non-empty kind that isn't "rate-limit". */
+export function rendersAsBackendFailure(kind) {
+    return !!kind && kind !== "rate-limit";
+}
 const LEADING_CD = /^\s*cd\s+(?:"[^"]*"|'[^']*'|\S+)\s*(?:&&|;)\s*/;
 function withoutLeadingCd(command) {
     let rest = command;

package/dist/src/text/text.js

@@ -243,6 +243,18 @@ export function parsePositiveInt(raw) {
 export function parseNonNegativeInt(raw) {
     return parseDecimalInt(raw);
 }
+/** Whether a string is an exponent spelling of a number ("1e2", "2.5E-3", "4e1") rather
+ * than a plain decimal: a run of digits Number() represents exactly. `Number()` would read an
+ * exponent spelling as a real number ("1e2" → 100), which is why every integer-writing
+ * surface refuses it — JSON.parse would silently read it past an integer validator — while
+ * the plain-decimal rule above admits only the literal spelling. The two shapes are mutually
+ * exclusive (a plain decimal has no `e`), so the plain-decimal exclusion is kept here as the
+ * shape's honest statement: one home for the predicate the config writer, the TUI team-key
+ * editor, the per-role instances editor, and the CLI role writes' local helper each
+ * hand-rolled. */
+export function isExponentSpelling(raw) {
+    return !/^\d*\.?\d+$/.test(raw) && /^\d+(\.\d+)?[eE][+-]?\d+$/.test(raw);
+}
 /** The shared over-long-text message: `<subject> is <n> chars — shorten it to at most <max>`,
  * with `tail` naming where the text rides once accepted. The one home of that phrasing, used
  * by init's seed check (init.ts, "the brief text … every run's prefill"), inbox-submit's

package/dist/src/ui/alert-feeds.js

@@ -0,0 +1,115 @@
+import { openQuestionEntries, ageInDays } from "../backlog/backlog.js";
+import { stripEntryStamp } from "../backlog/backlog-structure.js";
+import { questionFilingDate } from "../backlog/question-answer.js";
+import { byDaysThenIndex } from "../collections.js";
+import { eventsSince } from "../events/event-window.js";
+import { STALE_QUESTION_DAYS } from "../doctor/doctor-backlog.js";
+import { regressedFixCandidates, matchedRegressedFixes, regressedFixesPhrase } from "../doctor/doctor-backlog-bugs.js";
+import { planDependencyProblem } from "../doctor/doctor-backlog-plans.js";
+import { checkWaitContention, providerConcurrencyProblems, providerWaitContention, slotWaitContention, smallPoolProblems, staleWorkspacePins, CHECK_WAIT_CHECK_WINDOW_MS, PROVIDER_WAIT_CHECK_WINDOW_MS, SLOT_WAIT_CHECK_WINDOW_MS } from "../doctor/doctor-contention-checks.js";
+import { readSlotsState } from "../git/slots-state.js";
+import { configForStatus } from "../status/status-polls.js";
+import { piModelsPath } from "../pi/pi-models.js";
+import { piSettingsPath, readPiDefaultModel } from "../pi/pi-settings.js";
+/** This module is the alert-feed half of src/ui/status-payload.ts: each always-on team alert's
+ * data-sourcing function (capacityContention, …) lives here, a
+ * sibling of the src/ui/team-alert-*.ts builders that turn them into banners. status-payload.ts
+ * stays the one status-document builder, importing these feeds and folding each feed's result
+ * into the `alerts` field; status-render.ts reads the feeds directly for the TUI. */
+/** The open questions the doctor's 7-day rule (src/doctor/doctor-backlog-bugs.ts
+ * checkStaleQuestions, STALE_QUESTION_DAYS) calls stale: an open QUESTIONS.md entry whose
+ * `(asked by …)` stamp is at least 7 days old. This is the always-on feed for the stale-questions
+ * team alert — the shared rule's twin on every observer surface, computed from the same threshold
+ * and the same questionFilingDate parser the doctor's check uses, so the two cannot drift on which
+ * questions are stale. An undated heading is skipped (like the doctor's check); questions carry no
+ * refused note to filter. The returned objects carry the 1-based position (for
+ * `tumwater questions answer <n>`), the 0-based index (kept only as the file-order tiebreak), the
+ * stamp-stripped title, and the whole-day age. Returned oldest-first — most days waited, ties in
+ * file order — so a caller naming the first element names the most-stale question. */
+export function staleOpenQuestions(root, now = Date.now()) {
+    return openQuestionEntries(root)
+        .flatMap((entry, index) => {
+        const stamp = questionFilingDate(entry.title);
+        if (stamp === null)
+            return [];
+        const days = ageInDays(stamp, now);
+        return days >= STALE_QUESTION_DAYS ? [{ index, position: index + 1, title: stripEntryStamp(entry.title), days }] : [];
+    })
+        .sort(byDaysThenIndex);
+}
+/** A broken plan-dependency clause, the always-on twin of the doctor's `plan dependencies` row
+ * (src/doctor/doctor-backlog-plans.ts checkPlanDependencies): the same rule's problem set,
+ * severity order, and exact message, so the alert and the doctor cannot drift. The reader owns
+ * the rule — planDependencyAlert passes the doctor's planDependencyProblem through unchanged,
+ * like staleOpenQuestions and the other stale feeds do their doctor's rules. null when PLANS.md's
+ * planned entries have no cycle, dangling ref, unparsed clause, or misworded dependency. */
+export function planDependencyAlert(root) {
+    return planDependencyProblem(root);
+}
+/** @see CapacityBottleneck */
+export function capacityContention(root, now = Date.now()) {
+    const out = [];
+    /** Resolve one capacity verdict and push a "capacity bottleneck" row when it warns. Shared
+     * by the three capacity checks (workspace, provider, check slots) so the try/catch that keeps
+     * each one from crying wolf on an unreadable event log lives in one place, and the row's
+     * `name`/`detail` shape cannot drift between them. */
+    const maybeWarn = (name, windowMs, keep, resolve) => {
+        try {
+            const verdict = resolve(eventsSince(root, windowMs, now, keep));
+            if (verdict.warn)
+                out.push({ name, detail: verdict.detail });
+        }
+        catch {
+            // A read error skips this row, so the alert never cries wolf on an unreadable log.
+        }
+    };
+    maybeWarn("workspace slots", SLOT_WAIT_CHECK_WINDOW_MS, (ev) => ev.type === "slot_wait", (waits) => slotWaitContention(waits, readSlotsState(root).slots.length));
+    maybeWarn("provider slots", PROVIDER_WAIT_CHECK_WINDOW_MS, (ev) => ev.type === "provider_wait", (waits) => providerWaitContention(waits, configForStatus(root)));
+    maybeWarn("check slots", CHECK_WAIT_CHECK_WINDOW_MS, (e) => e.type === "check_wait", (waits) => checkWaitContention(waits, configForStatus(root)));
+    return out;
+}
+/** A `maxConcurrentPerProvider` map that cannot do its job — the always-on twin of the doctor's
+ * `provider concurrency` row (src/doctor/doctor-contention-checks.ts checkProviderConcurrency):
+ * a cap key no seam resolves to (a typo, or a provider the team never runs on), a cap at or
+ * above `maxConcurrent` (it never binds), or a keyless seam in a capped team. The `contention`
+ * and `provider-hold` alerts fire only once a too-small cap has already parked runs or a storm
+ * has struck; this standing alert names the static misconfiguration itself, which the doctor
+ * row is the only other surface that otherwise exposes. Reads the same last-known-good config
+ * the snapshot uses (configForStatus) and audits it through the row's own
+ * providerConcurrencyProblems, so the alert and the row cannot drift on the trigger or the
+ * wording; `[]` when no cap is configured or the map is well-formed. */
+export function providerCapProblems(root) {
+    return providerConcurrencyProblems(configForStatus(root), readPiDefaultModel(piSettingsPath(piModelsPath()), root));
+}
+/** The always-on twin of the doctor `parallel instances` row's pool-mismatch clause
+ * (doctor-contention-checks.ts smallPoolProblems): an enabled `feature`/`bugfix` running
+ * more than one instance while slotCount(config) sits below maxConcurrent — the shared pool
+ * is smaller than the run cap, so those instances contend for the same checkouts. Built from
+ * the same smallPoolProblems selector the doctor row uses, so the alert and the row cannot
+ * drift on the trigger, the role list, or the wording. configForStatus never returns
+ * undefined (an unreadable tumwater.json falls back to defaultConfig(), whose pool is the
+ * default maxConcurrent + 1 — never below maxConcurrent), so the [] is the only silent
+ * outcome. */
+export function instancePoolProblems(root) {
+    return smallPoolProblems(configForStatus(root));
+}
+/** How far back the regressed-fixes alert looks — one day, so a recently Fixed test that failed
+ * again is a standing amber alert until a day passes (or the failure is filed). The doctor's
+ * own `regressed fixes` row keeps its since-the-fix read; this is the alert's daily trigger, the
+ * same trailing day the regressed-fixes alert reads. */
+export const REGRESSED_FIX_WINDOW_MS = 24 * 60 * 60_000;
+/** The always-on twin of the doctor's `regressed fixes` row (src/doctor/doctor-backlog-bugs.ts
+ * checkRegressedFixes): the same candidate selection (regressedFixCandidates) and the same
+ * failureMentions match (matchedRegressedFixes) and sentence (regressedFixesPhrase), read off the
+ * trailing REGRESSED_FIX_WINDOW_MS of events (the doctor, whose window is since each fix, still
+ * warns on an older recurrence). An unreadable event log yields none. */
+export function regressedFixesAlert(root, now = Date.now()) {
+    const candidates = regressedFixCandidates(root);
+    const rows = matchedRegressedFixes(candidates, eventsSince(root, REGRESSED_FIX_WINDOW_MS, now));
+    const detail = regressedFixesPhrase(rows);
+    return detail === null ? null : { count: rows.length, detail };
+}
+/** Re-export so the always-on alert's stale-pin selector stays in its one home
+ * (src/doctor/doctor-contention-checks.ts) while tui.tsx keeps importing every alert feed from
+ * this one module. */
+export { staleWorkspacePins };

package/dist/src/ui/badges.js

@@ -1,3 +1,4 @@
+import { sortEntriesByKey } from "../collections.js";
 import { utilizationPct, windowLabel } from "../agent/subscription-account.js";
 import { MODEL_TIERS } from "../config/config-schema.js";
 import { budgetGate, budgetReached, fallbackTierEntries } from "../budget/budget.js";
@@ -338,7 +339,7 @@ export function pauseBadge(pausedUntil, now, reason) {
 /** The countdown a timed team pause has left, as humanSeconds — `null` when there is none
  * (no deadline, or an already-expired one: the read side treats an expired marker as
  * unpaused). The one home of the guard + ms→seconds rounding behind the team's pause
- * countdowns, shared by pauseBadge's header fragment and team-alerts.ts's paused alert
+ * countdowns, shared by pauseBadge's header fragment and team-alert-tail.ts's paused alert
  * title, so the two surfaces cannot disagree about how much time remains. The guard is this
  * function's own; the ms→seconds rounding rides datetime.ts's secondsUntil. The GUI's pause
  * control recomputes the counting-down number client-side from the payload's raw `pausedUntil`
@@ -391,9 +392,7 @@ export function diskBadge(disk) {
 export function permitsBadge(permits) {
     if (!permits)
         return "";
-    const providers = Object.entries(permits.byKey)
-        .filter(([, e]) => e.limit !== undefined)
-        .sort(([a], [b]) => a.localeCompare(b))
+    const providers = sortEntriesByKey(Object.entries(permits.byKey).filter(([, e]) => e.limit !== undefined))
         .map(([k, e]) => `${k} ${e.inUse}/${e.limit}`)
         .join(" · ");
     if (providers.length === 0)