tumwater 0.4.1 → 0.4.2

package/dist/src/doctor/image-probe.js

@@ -1,257 +0,0 @@
-/** The doctor's live image-input probe (plans/image-input.md "Doctor", part 2/5): a claimed
- * image-input capability in pi's models.json is only a claim — doctor shows each claimed model
- * a real image and checks the answer. This module owns three things: the in-process PNG
- * generator (a random 4-digit code drawn with a built-in 5×7 bitmap, encoded with
- * `zlib.deflateSync` + `zlib.crc32` is newer than the `>=20.3` node floor, so the CRC-32 here is
- * hand-rolled), the probe runner (the resolved pi binary in a run's environment, bounded like
- * the doctor's other binary probes), and the `.tumwater/state/image-probes.json` cache the
- * doctor check reads back. No new dependency; runs entirely offline against the operator's pi. */
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { randomInt } from "node:crypto";
-import zlib from "node:zlib";
-import { DAY_MS } from "../text/datetime.js";
-import { PiStreamParser } from "../pi/pi-stream.js";
-import { resolveBackendBin } from "../pi/pi-bin.js";
-import { imageProbesPath } from "../paths.js";
-import { removeTree } from "../files/files.js";
-import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
-import { isJsonObject, validEntries } from "../files/json-object.js";
-import { boundedProbe } from "./probe.js";
-/** How long a cached image-probe verdict stays valid while the claim is unchanged (7 days) —
- * a model's endpoint can change underneath a stale pass, so the answer is dated. */
-export const IMAGE_PROBE_TTL_MS = 7 * DAY_MS;
-/** The probe's deadline (90 s): a local model may need to load, far beyond the quick credential
- * probes, but a doctor run is still a pre-flight — a hung backend must lose, not stall the
- * report. */
-const PROBE_TIMEOUT_MS = 90_000;
-/** Cap on the probe's captured stdout, the same guard as the auth probes: a doctor run must not
- * grow an unbounded buffer off a runaway log. */
-const PROBE_MAX_OUTPUT_BYTES = 1024 * 1024;
-/** The cache-file key for one seam — agent/provider/model, the natural identity of a team
- * model, joined on `/` (agent and provider never contain it and a model id is fully qualified,
- * so the key cannot collide with another seam's). */
-export function imageProbeKey(agent, provider, model) {
-    return [agent ?? "", provider ?? "", model ?? ""].join("/");
-}
-/** Whether a cached entry still stands for the current claim: it exists, it recorded a real
- * verdict (never `could-not-verify`, which is never cached), it tested the image-input claim,
- * and it is younger than the TTL. */
-export function imageProbeEntryFresh(entry, now = Date.now()) {
-    return (entry !== undefined &&
-        (entry.verdict === "pass" || entry.verdict === "fail") &&
-        entry.claim &&
-        now - entry.at <= IMAGE_PROBE_TTL_MS);
-}
-/** Whether a parsed cache entry has the shape of an `ImageProbeCacheEntry`. */
-function isImageProbeCacheEntry(value) {
-    return (isJsonObject(value) &&
-        (value.verdict === "pass" || value.verdict === "fail") &&
-        typeof value.detail === "string" &&
-        typeof value.at === "number" &&
-        Number.isFinite(value.at) &&
-        typeof value.claim === "boolean");
-}
-/** Read the probe cache, or an empty cache when the file is missing or torn (the harness's
- * no-data policy: a crashed writer never takes down a reader). An entry of a foreign shape is
- * dropped, so it reads as unprobed, and the doctor's next cache write leaves it out. */
-export function readImageProbeCache(root) {
-    return validEntries(readJsonFile(imageProbesPath(root)), isImageProbeCacheEntry);
-}
-/** Write the probe cache atomically (tmp+rename) so a concurrent reader never sees a torn
- * file. */
-export function writeImageProbeCache(root, cache) {
-    writeJsonAtomic(imageProbesPath(root), cache);
-}
-// ── PNG generator ─────────────────────────────────────────────────────────────────────────
-/** Each digit as 7 rows of 5 bits, '1' = drawn (black); the standard 5×7 seven-segment-ish
- * font, big enough for a vision model to read and small enough to stay a trivial payload. */
-const DIGIT_BITMAP = {
-    "0": ["01110", "10001", "10011", "10101", "11001", "10001", "01110"],
-    "1": ["00100", "01100", "00100", "00100", "00100", "00100", "01110"],
-    "2": ["01110", "10001", "00001", "00110", "01000", "10000", "11111"],
-    "3": ["11111", "00010", "00100", "00010", "00001", "10001", "01110"],
-    "4": ["00010", "00110", "01010", "10010", "11111", "00010", "00010"],
-    "5": ["11111", "10000", "11110", "00001", "00001", "10001", "01110"],
-    "6": ["00110", "01000", "10000", "11110", "10001", "10001", "01110"],
-    "7": ["11111", "00001", "00010", "00100", "01000", "01000", "01000"],
-    "8": ["01110", "10001", "10001", "01110", "10001", "10001", "01110"],
-    "9": ["01110", "10001", "10001", "01111", "00001", "00010", "01100"],
-};
-/** A hand-rolled CRC-32 (the PNG chunk checksum): `zlib.crc32` is newer than the `>=20.3` node
- * floor, so this bitwise table version is the one home of the polynomial. */
-const CRC32_TABLE = (() => {
-    const table = new Uint32Array(256);
-    for (let n = 0; n < 256; n++) {
-        let c = n;
-        for (let k = 0; k < 8; k++)
-            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
-        table[n] = c >>> 0;
-    }
-    return table;
-})();
-function crc32(buf) {
-    let c = 0xffffffff;
-    for (let i = 0; i < buf.length; i++)
-        c = (CRC32_TABLE[(c ^ (buf[i] ?? 0)) & 0xff] ?? 0) ^ (c >>> 8);
-    return (c ^ 0xffffffff) >>> 0;
-}
-/** One PNG chunk: 4-byte big-endian length, the 4-byte ASCII type, the data, and the CRC over
- * type+data. */
-function pngChunk(type, data) {
-    const len = Buffer.alloc(4);
-    len.writeUInt32BE(data.length, 0);
-    const typeBuf = Buffer.from(type, "ascii");
-    const crc = Buffer.alloc(4);
-    crc.writeUInt32BE(crc32(Buffer.concat([typeBuf, data])), 0);
-    return Buffer.concat([len, typeBuf, data, crc]);
-}
-/** A PNG showing `code` black on white, drawn with the 5×7 bitmap scaled `scale`-fold (each
- * font cell becomes a `scale`×`scale` block) and one `scale`-wide gap between digits. Truecolor
- * (color type 2) so any reader handles it and the decode-check in the tests is trivial. Exported
- * for tests (and the doctor's own validity check of a generated image). */
-export function makeProbePng(code, scale = 8) {
-    const digits = [...code].map((d) => DIGIT_BITMAP[d] ?? DIGIT_BITMAP["0"]);
-    const width = digits.length * 5 * scale + (digits.length - 1) * scale;
-    const height = 7 * scale;
-    // Truecolor RGB scanlines, each prefixed with filter byte 0 (none).
-    const raw = Buffer.alloc(height * (1 + width * 3));
-    for (let y = 0; y < height; y++) {
-        const rowStart = y * (1 + width * 3);
-        raw[rowStart] = 0;
-        for (let x = 0; x < width; x++) {
-            // Which font cell does this pixel fall in?
-            const cell = Math.floor(x / (5 * scale + scale));
-            const inCellX = x - cell * (5 * scale + scale);
-            const cellDigit = digits[cell];
-            const row = Math.floor(y / scale);
-            const col = Math.floor(inCellX / scale);
-            const bit = inCellX < 5 * scale && cellDigit !== undefined
-                ? ((cellDigit[row] ?? "")[col] ?? "")
-                : "";
-            const on = bit === "1";
-            const p = rowStart + 1 + x * 3;
-            raw[p] = on ? 0 : 255;
-            raw[p + 1] = on ? 0 : 255;
-            raw[p + 2] = on ? 0 : 255;
-        }
-    }
-    const ihdr = Buffer.alloc(13);
-    ihdr.writeUInt32BE(width, 0);
-    ihdr.writeUInt32BE(height, 4);
-    ihdr[8] = 8; // bit depth
-    ihdr[9] = 2; // color type: truecolor RGB
-    const idat = zlib.deflateSync(raw, { level: 9 });
-    return Buffer.concat([
-        Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
-        pngChunk("IHDR", ihdr),
-        pngChunk("IDAT", idat),
-        pngChunk("IEND", Buffer.alloc(0)),
-    ]);
-}
-/** A random 4-digit code for one probe attempt. */
-function randomCode() {
-    let out = "";
-    for (let i = 0; i < 4; i++)
-        out += String(randomInt(0, 10));
-    return out;
-}
-// ── Probe runner ──────────────────────────────────────────────────────────────────────────
-/** Parse the resolved probe's stdout (pi's `--mode json` event stream) the same way a real run
- * is parsed, so a live probe sees the same final text and error classification the harness
- * would. */
-function parseProbeOutput(stdout) {
-    const parser = new PiStreamParser();
-    parser.feed(stdout);
-    return {
-        finalText: parser.finalText,
-        configError: parser.configError,
-        transientRateLimit: parser.transientRateLimit,
-        transientBackend: parser.transientBackend,
-    };
-}
-/** Whether an answer looks like a (wrong) read of the 4-digit code rather than a refusal: the
- * text contains a 4-digit run of digits (e.g. "The number is 5825."). A model that cannot see
- * at all does not emit a number. */
-function isFourDigitNumber(text) {
-    return /\b\d{4}\b/.test(text);
-}
-/** Probe one claimed pi seam with a real image (plans/image-input.md "Doctor"). Runs the
- * resolved pi binary in a run's environment (the caller passes `env`, typically
- * `childEnv({ PATH: pathEnv })` which inherits `PI_CODING_AGENT_DIR`, so the probe reads the
- * same models.json a real run would):
- *
- *   `pi --print --mode json --no-session --no-tools --no-mcp --provider P --model M
- *        --thinking <level> @<png> "Reply with only the 4-digit number shown in the image."`
- *
- * Pass: the final assistant text contains the code. A wrong answer retries once with a fresh
- * code (a misread is not blindness). Two wrong answers that are not both numbers fail (a
- * refusal or empty answer is blindness), and so does a 4xx. Two wrong *numbers* — the model
- * read a number, wrongly — cannot be told from a flaky misread, so it is `could-not-verify`
- * rather than `fail` and is never cached: the next doctor run probes again instead of turning
- * a capable seam text-only for a week. A timeout, spawn failure, 429, 5xx, or connection error
- * is also `could-not-verify` — it says nothing about capability and is never cached. `code` is
- * a test seam (a real probe always draws a fresh random code); `env` and `timeoutMs` are
- * injectable so tests need no real pi. */
-export async function runImageProbe(config, seam, env, timeoutMs = PROBE_TIMEOUT_MS, code) {
-    const envBin = env.TUMWATER_PI_BIN?.trim();
-    // Resolve from the run's own environment (env override → config), exactly as a real run's
-    // spawn would rather than only the harness process env — so tests can point a fake pi there.
-    const bin = envBin
-        ? envBin.includes("/")
-            ? path.resolve(envBin)
-            : envBin
-        : resolveBackendBin(config).bin;
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "tumwater-image-probe-"));
-    const wrong = []; // the per-attempt "answered …" detail for a wrong answer
-    const misread = []; // whether each wrong answer was a (wrong) 4-digit number
-    try {
-        for (let attempt = 0; attempt < 2; attempt++) {
-            const thisCode = code ?? randomCode();
-            const png = makeProbePng(thisCode);
-            const pngPath = path.join(dir, `probe-${attempt}.png`);
-            fs.writeFileSync(pngPath, png);
-            const args = ["--print", "--mode", "json", "--no-session", "--no-tools", "--no-mcp"];
-            if (seam.provider)
-                args.push("--provider", seam.provider);
-            if (seam.model)
-                args.push("--model", seam.model);
-            if (seam.thinking)
-                args.push("--thinking", seam.thinking);
-            args.push(`@${pngPath}`, "Reply with only the 4-digit number shown in the image.");
-            const result = await boundedProbe(bin, args, env, timeoutMs, PROBE_MAX_OUTPUT_BYTES);
-            if (result === null)
-                return { verdict: "could-not-verify", detail: "the probe could not run or timed out" };
-            const parsed = parseProbeOutput(result.stdout);
-            if (parsed.configError)
-                return { verdict: "fail", detail: "the provider rejected the request (4xx)" };
-            if (parsed.transientRateLimit)
-                return { verdict: "could-not-verify", detail: "the provider rate-limited the request (429)" };
-            if (parsed.transientBackend)
-                return { verdict: "could-not-verify", detail: "the provider backend failed (5xx or connection)" };
-            const text = parsed.finalText.trim();
-            if (text.includes(thisCode))
-                return { verdict: "pass", detail: `answered "${text}"` };
-            // A wrong 4-digit number says "I looked and got the digits wrong"; a refusal or empty
-            // answer says "I cannot see". The drawn code is exactly 4 digits, so a 4-digit answer is
-            // a plausible (wrong) read.
-            misread.push(isFourDigitNumber(text));
-            wrong.push(text ? `answered "${text}"` : "answered nothing");
-        }
-        // A refusal or empty answer on either attempt is blindness — the two-strikes rule: fail,
-        // cached. Two wrong *numbers* cannot be told from a flaky misread, so it is could-not-verify
-        // and never cached: the next doctor run probes again instead of turning a capable seam
-        // text-only for a week. Either way the detail names what the model said, so the doctor
-        // line, the alert, and a bug report can tell blindness from a misread.
-        return misread[0] && misread[1]
-            ? {
-                verdict: "could-not-verify",
-                detail: `two misreads (${wrong.join(", ")}) — the model read a number, wrongly; not blindness, re-probe on the next doctor run`,
-            }
-            : { verdict: "fail", detail: `two wrong answers (${wrong[1]})` };
-    }
-    finally {
-        removeTree(dir);
-    }
-}

package/dist/src/ui/team-alert-backlog-feed.js

@@ -1,181 +0,0 @@
-/** The backlog-feed team alerts, in emission order: stale open bugs, a failed notify page,
- * waiting bugs, stranded inbox prompts, a stalled merge queue, skipped merge-queue files, and
- * merges refused by an uncommitted primary checkout. One of the per-domain builders split out of
- * src/ui/team-alerts.ts; the shared types and wording helpers live in team-alert-shared.ts. */
-import { moreDetail, openBacklogAction } from "./team-alert-shared.js";
-import { plural } from "../text/phrases.js";
-import { roleLabel } from "../roles/role-labels.js";
-import { duration } from "./run-progress-model.js";
-import { humanAgo } from "../text/datetime.js";
-import { joinWithMore, squash } from "../text/text.js";
-// The per-arm builders below follow the push convention shared with the sibling splits: each
-// takes the `out` array plus the one input field its arm reads and pushes exactly the alert the
-// arm pushes, so buildBacklogFeedAlerts's emission order is its call order.
-function pushStaleBugsAlert(out, staleBugs) {
-    // A stale bug (doctor's STALE_BUG_DAYS rule, src/doctor/doctor-backlog-bugs.ts) sits when no
-    // role fixes it — the bugfix role is disabled or failing — so it asks (amber) the way the
-    // refused alert does, naming the oldest, its age, and the doctor's retract advice. Its
-    // callers pass it oldest-first (alert-feeds.ts staleOpenBugs sorts most-days-waited first),
-    // so the first element is the most-stale bug and is named with its position and age; the rest
-    // are folded through entryListDetail like the questions and refused alerts, so the wording and
-    // counts cannot drift.
-    if (staleBugs.length) {
-        const first = staleBugs[0];
-        const rest = staleBugs.slice(1);
-        out.push({
-            key: "stale-bugs",
-            tone: "amber",
-            title: `${plural(staleBugs.length, "open bug waited", "open bugs waited")} 3+ days for a fix`,
-            detail: `#${first.position} "${first.title}" has waited ${first.days}d for a fix` +
-                moreDetail(rest.map((r) => r.title)) +
-                ` · check that the bugfix role is enabled and not failing, or retract it with \`tumwater bug --cancel ${first.position}\``,
-            // The action lands the operator on the first stale bug.
-            actions: openBacklogAction({ file: "bugs", index: first.index }),
-        });
-    }
-}
-function pushNotifyAlert(out, notifyFailure, now) {
-    // A failed notify page (doctor's NOTIFY_CHECK_WINDOW_MS rule, src/doctor/doctor-notify.ts
-    // checkNotify) leaves the team unsupervised — a dead webhook must not page the operator when
-    // something else goes wrong — so a page that failed within the last day asks (amber) the way
-    // the stale-bug alert does, naming the count, the age of the latest, its squashed message,
-    // and the `tumwater notify --test` fix. Its callers feed it the latest failure's message via
-    // alert-feeds.ts's notifyFailures (the same isNotifyFailure filter and window), so the
-    // alert and the doctor cannot drift.
-    if (notifyFailure) {
-        out.push({
-            key: "notify",
-            tone: "amber",
-            title: `${plural(notifyFailure.count, "failed notify page", "failed notify pages")} in the last day`,
-            detail: `the notify hook could not reach you ${humanAgo(notifyFailure.latestTs, now)}: ${squash(notifyFailure.message, 160)} — check it with \`tumwater notify --test\``,
-            actions: [],
-        });
-    }
-}
-function pushWaitingBugsAlert(out, staleWaitingBugs) {
-    // A waiting bug (doctor's STALE_WAIT_DAYS rule, src/doctor/doctor-backlog-bugs.ts
-    // checkWaitingBugs) whose flake has not come back parks indefinitely, so a hold that has
-    // outlived a week asks (amber) the way the stale-bug alert does, naming the oldest hold, its
-    // age, and the release-or-keep advice. Its callers pass it most-days-first (alert-feeds.ts
-    // staleWaitingBugs sorts by days descending, ties in file order), so the first element is the
-    // longest-held bug and is named with its position and days; the rest are folded through
-    // entryListDetail like the questions and refused alerts, so the wording and counts cannot
-    // drift.
-    if (staleWaitingBugs.length) {
-        const first = staleWaitingBugs[0];
-        const rest = staleWaitingBugs.slice(1);
-        out.push({
-            key: "waiting-bugs", // vocabulary-ok: the waiting-bugs amber alert's key
-            tone: "amber",
-            title: `${plural(staleWaitingBugs.length, "waiting bug held", "waiting bugs held")} 7+ days`,
-            detail: `#${first.position} "${first.title}" has waited ${first.days}d for its next failure` +
-                moreDetail(rest.map((r) => `#${r.position} "${r.title}"`)) +
-                ` · the hold has outlived a week and this surface omits the doctor's recurrence scan — \`tumwater doctor\` reports whether the flake came back; release it with \`tumwater bug --release ${first.position}\`, or keep the hold if the failure is still expected`,
-            // The action lands the operator on the first stale waiting bug.
-            actions: openBacklogAction({ file: "bugs", index: first.index }),
-        });
-    }
-}
-function pushStalePromptsAlert(out, stalePrompts) {
-    // A stranded inbox prompt (doctor's STALE_PROMPT_MS rule, src/doctor/doctor-backlog.ts) sits
-    // when a role is paused, disabled, or failing and never reaches the run that would dequeue the
-    // prompt, so it asks (amber) the way the stale-bug alert does, naming the oldest prompt, its
-    // wait, and the deliver-or-drop advice. Its callers feed it oldest-first (alert-feeds.ts
-    // stalePrompts sorts by queuedAtMs ascending), so the first element is the most-stale prompt
-    // and is named with its role, position and wait; the rest are folded through entryListDetail
-    // like the questions and refused alerts, so the wording and counts cannot drift.
-    if (stalePrompts.length) {
-        const first = stalePrompts[0];
-        const rest = stalePrompts.slice(1);
-        out.push({
-            key: "stale-prompts",
-            tone: "amber",
-            title: `${plural(stalePrompts.length, "queued prompt waited", "queued prompts waited")} 1+ day for its role`,
-            detail: `inbox prompt for ${roleLabel(first.role)} #${first.position} has waited ${duration(first.waitedMs)} — the role is not dequeuing it (paused, disabled, or failing); resume or enable it, or drop the prompt with \`tumwater prompt --cancel ${first.position} --role ${first.role}\`` +
-                moreDetail(rest.map((p) => `${roleLabel(p.role)} #${p.position}`)),
-            // The action lands the operator on the Inbox tab (the dashboard's backlog arm reads `act:
-            // "queued"` as the Inbox view), where the stranded prompt is cancellable.
-            actions: [{ label: "Open inbox", act: "queued" }],
-        });
-    }
-}
-function pushStaleMergesAlert(out, staleMerges) {
-    // A stalled merge queue (the doctor's MERGE_QUEUE_STALE_MS rule,
-    // src/doctor/doctor-backlog.ts, set by the stale-merges alert) sits when a queued change
-    // never starts — neither verified nor flagged — so a drain that has stopped reads healthy
-    // except for this row. Its callers feed it oldest-first (alert-feeds.ts staleMerges reads
-    // queuedMerges in queue-file order), so the first element is the longest-waiting merge and is
-    // named with its role, summary and wait; the rest are folded through joinWithMore like the
-    // actions and no-image alerts, so the wording and counts cannot drift.
-    if (staleMerges.length) {
-        const first = staleMerges[0];
-        const rest = staleMerges.slice(1);
-        out.push({
-            key: "stale-merges",
-            tone: "amber",
-            title: `${plural(staleMerges.length, "queued merge waited", "queued merges waited")} 6+ hours to start`,
-            detail: `${roleLabel(first.role)} — "${first.summary}" — has waited ${duration(first.waitedMs)} to start` +
-                moreDetail(rest.map((m) => roleLabel(m.role)), (labels) => joinWithMore(labels, 3)) +
-                ` — the merge queue has stopped moving; run \`tumwater queue\` to see it, or drop the entry with \`tumwater queue --cancel <n>\``,
-            // The header's `merge queue: N` badge and the Pending view already carry the drill-in.
-            actions: [],
-        });
-    }
-}
-function pushSkippedMergesAlert(out, skippedMergeFiles) {
-    // A merge-queue file `readMergeQueue` skips (torn, foreign, or vanished mid-listing) is the
-    // always-on twin of the doctor's `merge-queue files` row (doctor-backlog.ts
-    // skippedMergeQueueFiles, feeding this from alert-feeds.ts's skippedMergeFiles): it sits
-    // in .tumwater/merge-queue/ forever because the drain drops only an unreadable head, so a
-    // skipped file after a healthy entry strands its merge until someone removes it. The stale-
-    // merges alert above reads only readable entries, so it can never cover one. The doctor's row
-    // and this alert share the one relative-path list, so they name the same files; the count and
-    // the first skipped file are shown, the rest folded through joinWithMore.
-    if (skippedMergeFiles.length) {
-        const [first, ...rest] = skippedMergeFiles;
-        out.push({
-            key: "skipped-merges",
-            tone: "amber",
-            title: `${plural(skippedMergeFiles.length, "merge-queue file is", "merge-queue files are")} unreadable`,
-            detail: `the queue reader skips ${first} — a torn or foreign file never clears itself, so its merge is stranded; remove it (a crashed enqueue's merge ref still recovers on the next run)` +
-                moreDetail(rest, (labels) => joinWithMore(labels, 3)),
-            actions: [],
-        });
-    }
-}
-function pushPrimaryOverwriteAlert(out, primaryOverwrite, now) {
-    // A merge the primary checkout blocked (merge-git.ts primaryCheckoutBlockers, the
-    // overwriteBlockedReason `warning` the merge path writes) — the always-on twin of the doctor's
-    // `uncommitted backlog` row, but read off events so it reaches the status poll (the doctor's
-    // git read is async and never gets there). A team stuck retrying one dirty file is a single
-    // amber banner until the file is committed and the refusals age out; alert-feeds.ts's
-    // primaryOverwriteBlocks feeds it the last day's refusals, counting them and naming the
-    // latest's age, squashed message, and the commit fix.
-    if (primaryOverwrite) {
-        out.push({
-            key: "primary-overwrite",
-            tone: "amber",
-            title: `${plural(primaryOverwrite.count, "merge was", "merges were")} refused by files uncommitted in your primary checkout`,
-            detail: `most recently ${humanAgo(primaryOverwrite.latestTs, now)}: ${squash(primaryOverwrite.message, 160)} — roles cannot commit your checkout; commit the file(s) on main with \`tumwater doctor --commit-backlog\` (or by hand) so merges can proceed`,
-            actions: [],
-        });
-    }
-}
-/** The backlog-feed alerts, in emission order: stale open bugs, a failed notify page, waiting
- * bugs, stranded inbox prompts, a stalled merge queue, skipped merge-queue files, and merges
- * refused by an uncommitted primary checkout. Extracted from teamAlerts (part 3/5 of the
- * teamAlerts split) so the shared module stays small; the input names exactly the fields this
- * run reads. Each arm is one module-private builder named push<Alert>Alert, called here in arm
- * order, so a backlog-feed alert is found by name and the caller's emission order is preserved. */
-export function buildBacklogFeedAlerts(input) {
-    const out = [];
-    const { staleBugs, notifyFailure, staleWaitingBugs, stalePrompts, staleMerges, skippedMergeFiles, primaryOverwrite, now, } = input;
-    pushStaleBugsAlert(out, staleBugs);
-    pushNotifyAlert(out, notifyFailure, now);
-    pushWaitingBugsAlert(out, staleWaitingBugs);
-    pushStalePromptsAlert(out, stalePrompts);
-    pushStaleMergesAlert(out, staleMerges);
-    pushSkippedMergesAlert(out, skippedMergeFiles);
-    pushPrimaryOverwriteAlert(out, primaryOverwrite, now);
-    return out;
-}

package/dist/src/ui/team-alert-merge.js

@@ -1,183 +0,0 @@
-/** The quarantine, flapped-check, and post-merge review team alerts, in emission order: a stale
- * or oversized flake quarantine, checks flapping more than once, a burst of post-merge review
- * rejections, a post-merge review one failed run from being dropped, a post-merge review the
- * drain dropped leaves its commit on main unreviewed, a main tip the watch's diff rules
- * rejected, and the ci role's full suite stalled over three days without covering a new tip.
- * One of the per-domain builders split out of src/ui/team-alerts.ts; the shared types and
- * wording helpers live in team-alert-shared.ts. */
-import { seeFailures } from "./team-alert-shared.js";
-import { CI_PARITY_STALE_MS, ciParityStalled } from "../run/ci-parity.js";
-import { QA_COVERAGE_STALE_MS } from "../run/qa-coverage.js";
-import { plural } from "../text/phrases.js";
-import { humanAgo, DAY_MS } from "../text/datetime.js";
-import { squash } from "../text/text.js";
-import { roleLabel } from "../roles/role-labels.js";
-import { shortSha } from "../text/format.js";
-// A stale or oversized flake quarantine — the always-on twin of the doctor's `flaky checks`
-// row (main-guardrails.ts checkFlakyChecks, quarantineWarning): a quarantined test counts as
-// a known failure until its filed bug leaves BUGS.md `## Open`, so an old entry means the
-// team is merging on a suite whose red is being excused. alert-feeds.ts's quarantineAlert
-// feeds it from the same quarantineWarning the doctor calls, so the alert and the doctor
-// cannot drift on when the list is a problem; the warning phrase and the oldest test's age
-// are shown, folded through squash like other long names.
-function pushQuarantineAlert(out, quarantined, now) {
-    if (quarantined) {
-        out.push({
-            key: "quarantine",
-            tone: "amber",
-            title: `${plural(quarantined.count, "test")} in the flake quarantine — the gate is excusing their failures`,
-            detail: `${quarantined.warning} · oldest: ${squash(quarantined.oldestTest, 80)} (${humanAgo(quarantined.oldestFirstSeen, now)}) — a quarantined test counts as a known failure until its filed bug leaves BUGS.md \`## Open\`, so fix the test or file the missing bug`,
-            actions: seeFailures(),
-        });
-    }
-}
-// Checks that flapped more than once in the last day — the always-on twin of the doctor's
-// `flaky checks` row (doctor-project-checks.ts checkFlakyChecks): the gate's single re-run
-// absorbs a one-off flake, but a check flapping twice silently pays that re-run on every
-// merge it touches, so the tally belongs on every observer surface while it happens.
-// alert-feeds.ts's flappedChecksAlert feeds it from the same repeatedFlakeCounts and
-// flappedChecksPhrase the doctor calls, so the alert and the doctor cannot drift on the
-// count or the wording.
-function pushFlappedChecksAlert(out, flappedChecks) {
-    if (flappedChecks) {
-        out.push({
-            key: "flapped-checks",
-            tone: "amber",
-            title: `${plural(flappedChecks.count, "check has", "checks have")} flapped more than once in the last day`,
-            detail: `${flappedChecks.detail} — a flapping check pays the gate's one re-run on every merge it touches; fix it or file it with \`tumwater bug\``,
-            actions: seeFailures(),
-        });
-    }
-}
-// Last day's post-merge review rejections — the reviewer-fix signal for the `review.afterMerge`
-// tiering (src/review/post-merge-review.ts `reviewMergedCommit`). A post-merge rejection is the
-// costly kind: the commit already reached main, so the rejection is answered only by the
-// reviewer's own fix, and the always-on signal for a day crossing POST_MERGE_REJECT_WARN is
-// this alert. alert-feeds.ts's postMergeChurnAlert feeds it
-// from the same `afterMerge: true` `review_rejected` events the report's
-// postMergeRejectionsByRole folds, so the alert and the report cannot disagree on which
-// rejections are post-merge.
-function pushPostMergeChurnAlert(out, postMergeChurn) {
-    if (postMergeChurn) {
-        out.push({
-            key: "post-merge-churn",
-            tone: "amber",
-            title: `${plural(postMergeChurn.count, "post-merge review rejection", "post-merge review rejections")} in the last day`,
-            detail: `${postMergeChurn.roles.map((r) => `${roleLabel(r.role)} ×${r.count}`).join(", ")} — each commit already reached main and stays there with the reviewer's recorded reasons (never re-reviewed — Forward, never back); narrow \`review.afterMerge\` for the noisy role or raise the authoring bar`,
-            actions: seeFailures(),
-        });
-    }
-}
-// A post-merge review one failed run from being dropped — the always-on twin of the doctor's
-// `post-merge reviews` row (src/doctor/doctor-backlog.ts checkPostReviews) — the last moment
-// an operator can fix the reviewer backend or deliberately accept the commit unreviewed.
-// postReviewRiskAlert feeds it from the same atRiskPostReviews traversal and phrase the doctor
-// calls, so the alert and the doctor cannot drift on the trigger or the wording.
-function pushPostMergeRiskAlert(out, postReviewRisk) {
-    if (postReviewRisk) {
-        out.push({
-            key: "post-merge-risk",
-            tone: "amber",
-            title: `${plural(postReviewRisk.count, "post-merge review is", "post-merge reviews are")} one failed run from being dropped`,
-            detail: postReviewRisk.detail,
-            actions: seeFailures(),
-        });
-    }
-}
-// A post-merge review the drain actually dropped — the commit it leaves on main unreviewed
-// (src/merge/merge-post-review-drain.ts `startPostReview` at POST_REVIEW_FAILURE_LIMIT).
-// Reads only the `warning` event the drop branch writes, after the at-risk alert is moot:
-// the entry is gone, so no surface names the commit without this.
-// droppedPostReviewsAlert feeds it from the same DROPPED_POST_REVIEW_MARKER the drain's
-// cannot drift on what a drop is (the per-run failed-review warning never matches).
-function pushDroppedPostReviewsAlert(out, droppedPostReviews, now) {
-    if (droppedPostReviews) {
-        out.push({
-            key: "dropped-post-reviews",
-            tone: "amber",
-            title: `${plural(droppedPostReviews.count, "post-merge review was dropped", "post-merge reviews were dropped")} in the last day — ${plural(droppedPostReviews.count, "the commit sits", "the commits sit")} on main unreviewed`,
-            detail: `most recently ${humanAgo(droppedPostReviews.latestTs, now)}: ${squash(droppedPostReviews.latestMessage, 160)} — the reviewer kept failing past \`POST_REVIEW_FAILURE_LIMIT\`, so the commit is beyond the review gate; fix the reviewer backend so later commits are reviewed`,
-            actions: [{ label: "See failures", act: "view", arg: "failures" }],
-        });
-    }
-}
-// A main tip the watch's five diff rules rejected in the trailing day — the always-on
-// surface for the `warning` main-watch.ts's `watchRules` logs (`main's tip <short sha> fails
-// the diff rules: <reason>`). The gate judges one change; the watch judges each first-parent
-// commit's own diff, so a conflict marker, a protected edit, a leaked secret, a phantom fix
-// claim or a broken backlog structure that reached main through a gate blind spot sits on
-// main with only that event log to say so. alert-feeds.ts's mainRuleFailures feeds it
-// from the same marker, so the alert and the watch cannot drift on what a rule failure is (a
-// `main_check` or `review_rejected` carrying the same text never matches).
-function pushMainDiffRulesAlert(out, mainRuleFailure, now) {
-    if (mainRuleFailure) {
-        out.push({
-            key: "main-diff-rules",
-            tone: "amber",
-            title: `${plural(mainRuleFailure.count, "diff-rule failure on main", "diff-rule failures on main")} in the last day`,
-            detail: `most recently ${humanAgo(mainRuleFailure.latestTs, now)}: ${squash(mainRuleFailure.latestMessage, 160)} — the gate approved a diff the watch's five rules reject, so main carries what the gate would refuse; repair the tip or revert it with \`tumwater revert <sha>\``,
-            actions: seeFailures(),
-        });
-    }
-}
-// The ci role's full suite silently stopped covering new tips — the always-on twin of the
-// doctor's `ci parity` row (doctor-project-checks.ts checkCiParity), read from the same
-// ciParityStalled predicate and CI_PARITY_STALE_MS threshold so the alert and the row cannot
-// disagree on when a post-merge gap is a stall. A `stale` record is normal right after a
-// merge (main moves on every merge and the role runs on its own clock), but one that stays
-// stale past three days means the role that is now the full suite's own runner has silently
-// stopped covering new tips (disabled, paused, wedged, or failing before it records). The
-// fix is a role toggle the role drawer already has, so there is no action button here.
-function pushCiStaleAlert(out, ciParity, now) {
-    if (ciParity && ciParityStalled(ciParity, now)) {
-        out.push({
-            key: "ci-stale",
-            tone: "amber",
-            title: `main's full suite has not covered a tip in over ${CI_PARITY_STALE_MS / DAY_MS} days`,
-            detail: `the ci role's last full-suite run covered ${shortSha(ciParity.covered)} ${humanAgo(ciParity.lastRunAt, now)}; main has moved since, so no full-suite run covers the current tip — the ci role is disabled, paused, or unable to record; resume or enable it, or check \`tumwater doctor\``,
-            actions: [],
-        });
-    }
-}
-// The qa role's flow coverage silently stopped advancing — the always-on twin of the
-// doctor's `qa coverage` row (doctor-project-checks.ts checkQaCoverage), fed from the same
-// qaCoverageStalled predicate via alert-feeds.ts's qaCoverageAlert so the alert and the
-// row cannot disagree on when a quiet qa is a stall. A missing ledger (no record yet) is not
-// a stall, so this fires only once a recorded flow's newest exercise is over three days old —
-// the team's only flow-level observer has silently stopped recording (disabled, paused,
-// wedged, or failing before it records). The fix is a role toggle the role drawer already has,
-// so there is no action button here.
-function pushQaStaleAlert(out, qaCoverage, now) {
-    if (qaCoverage) {
-        out.push({
-            key: "qa-stale",
-            tone: "amber",
-            title: `qa's flow coverage has not advanced in over ${QA_COVERAGE_STALE_MS / DAY_MS} days`,
-            detail: `the qa role's newest flow ${qaCoverage.newestFlow} was exercised ${humanAgo(qaCoverage.newestAt, now)}; coverage has not advanced since, so the qa role is disabled, paused, or unable to record; resume or enable it, or check \`tumwater doctor\``,
-            actions: [],
-        });
-    }
-}
-/** The quarantine, flapped-check, and post-merge review alerts, in emission order: a
- * stale or oversized flake quarantine, checks flapping more than once, a
- * burst of post-merge review rejections, a post-merge review one failed run from being
- * dropped, a post-merge review the drain dropped leaves its commit on main unreviewed, a
- * main tip the watch's diff rules rejected, and the ci role's full suite stalled over three
- * days without covering a new tip.
- * Extracted from teamAlerts (part 4/5 of the teamAlerts split) so the shared module stays
- * small; the input names exactly the fields this run reads (including `now`, which the
- * quarantine and dropped-post-reviews age lines need). The caller pushes the returned alerts
- * at the position this run used to occupy, so the emitted key order is unchanged. */
-export function buildMergeAlerts(input) {
-    const out = [];
-    const { quarantined, flappedChecks, postMergeChurn, postReviewRisk, droppedPostReviews, mainRuleFailure, ciParity, qaCoverage, now } = input;
-    pushQuarantineAlert(out, quarantined, now);
-    pushFlappedChecksAlert(out, flappedChecks);
-    pushPostMergeChurnAlert(out, postMergeChurn);
-    pushPostMergeRiskAlert(out, postReviewRisk);
-    pushDroppedPostReviewsAlert(out, droppedPostReviews, now);
-    pushMainDiffRulesAlert(out, mainRuleFailure, now);
-    pushCiStaleAlert(out, ciParity, now);
-    pushQaStaleAlert(out, qaCoverage, now);
-    return out;
-}