tumwater 0.4.1 → 0.4.2

package/dist/src/backlog/question-answer.js

@@ -14,7 +14,7 @@
  * CLI command package for domain logic.
  */
 import path from "node:path";
-import { fencedHeadingTitle, fenceTracker, nextSectionHeading } from "./backlog-md.js";
+import { fencedHeadingTitle, fenceTracker, firstDate, nextSectionHeading } from "./backlog-md.js";
 import { answeredQuestionEntries, entryMatches, openQuestionEntries, ageInDays, ageSuffix } from "./backlog.js";
 import { normalizeEntryBody } from "./backlog-write.js";
 import { collapseWhitespace, firstTrimmedLineStartingWith, trimLeadingBlankLines, trimTrailingBlankLines, truncate } from "../text/text.js";
@@ -43,10 +43,11 @@ function firstBodySuffix(body) {
 /** The open question's filing stamp, `YYYY-MM-DD`, read from the heading's `(asked by <who>
  * YYYY-MM-DD)` clause — the first `YYYY-MM-DD` after an `asked by` word in the title text — or
  * null when the heading carries no such clause. Taken from the title text only, not the body:
- * the stamp is the entry's own, and the body may name other dates. */
+ * the stamp is the entry's own, and the body may name other dates. Routed through
+ * backlog-md.ts's firstDate - the one first-match mechanism filingDate (backlog.ts) uses too -
+ * with the `asked by` verb in place of the plans/bugs stamp verbs. */
 export function questionFilingDate(title) {
-    const m = /(?:asked by)\b[^)]*?\b(\d{4}-\d{2}-\d{2})/.exec(title);
-    return m === null ? null : m[1];
+    return firstDate(title, /(?:asked by)\b[^)]*?\b(\d{4}-\d{2}-\d{2})/);
 }
 /** The role id named in the heading's `(asked by <role> …)` clause — the first word after
  * `asked by` — or null when the heading has no such clause. Taken from the title only, like
@@ -273,40 +274,56 @@ function answerQuestionLocked(root, n, rawDecision, expectedTitle, keepLines) {
     if (expectedTitle !== undefined && block.title !== expectedTitle)
         return { status: "moved", title: block.title };
     const moved = lines.slice(block.start, block.end);
-    trimTrailingBlankLines(moved);
+    const rebuilt = cutOpenBlock(lines, scanned, block);
+    const text = appendAnsweredEntry(rebuilt, moved, decision, scanned.answeredIdx !== -1);
+    writeTextAtomic(file, text);
+    return { status: "answered", title: block.title, decision };
+}
+/** Cut `block` out of `## Open`, returning the rebuilt file text (as lines). When the section
+ * is left with no content at all, restores the `_None yet._` placeholder the skeleton carries,
+ * so an empty outbox still reads as an intentionally empty section. */
+function cutOpenBlock(lines, scan, block) {
     // Cut the block out of ## Open: everything before it, everything from its end on. When the
     // section is left with no content at all, restore the `_None yet._` placeholder the skeleton
     // carries, so an empty outbox still reads as an intentionally empty section.
     // Emptiness is judged against the Open section only (openIdx+1 .. openEnd): with an
     // intermediate section between Open and Answered, judging against answeredIdx would keep
     // the placeholder from returning and, worse, the empty rebuild would drop that section.
-    const openContent = lines.slice(scanned.openIdx + 1, scanned.openEnd);
-    const remaining = openContent.filter((_, i) => i < block.start - scanned.openIdx - 1 || i >= block.end - scanned.openIdx - 1);
+    const openContent = lines.slice(scan.openIdx + 1, scan.openEnd);
+    const remaining = openContent.filter((_, i) => i < block.start - scan.openIdx - 1 || i >= block.end - scan.openIdx - 1);
     const openEmpty = remaining.every((l) => l.trim() === "");
     const rebuilt = [];
     if (openEmpty) {
-        rebuilt.push(...lines.slice(0, scanned.openIdx + 1), "", "_None yet._", 
+        rebuilt.push(...lines.slice(0, scan.openIdx + 1), "", "_None yet._", 
         // Resume at the section that followed Open (openEnd, not answeredIdx — an intermediate
         // section between the two must survive) with the blank separator line the dropped Open
         // content used to carry, so `_None yet._` never reads as a paragraph glued to a heading.
-        "", ...lines.slice(scanned.openEnd));
+        "", ...lines.slice(scan.openEnd));
     }
     else {
         rebuilt.push(...lines.slice(0, block.start), ...lines.slice(block.end));
     }
+    return rebuilt;
+}
+/** Append the moved block at the end of `## Answered` (growing the section when the file has
+ * none, stripping a real `_None yet._` placeholder from it), returning the full text to write.
+ * `hasAnswered` is whether the file already held a `## Answered` section. */
+function appendAnsweredEntry(rebuilt, moved, decision, hasAnswered) {
+    // The moved block's trailing blank lines are dropped, so the appended entry never reads
+    // as a spill of blank lines before the dated answer stamp.
+    trimTrailingBlankLines(moved);
     // Append the block at the end of ## Answered: before the next `## ` heading when one
     // follows, at the file's end otherwise — the section is last in the documented skeleton.
     const stamp = `**Answered ${formatDate(new Date())} by the user:**`;
     const stamped = decision.includes("\n") ? [stamp, "", ...decision.split("\n")] : [`${stamp} ${decision}`];
     const answerLines = moved.concat("", ...stamped, "");
-    if (scanned.answeredIdx === -1) {
+    if (!hasAnswered) {
         // No ## Answered section: grow the file's end with the skeleton section plus the block.
         let out = rebuilt.join("\n");
         if (out !== "" && !out.endsWith("\n"))
             out += "\n";
         out += `\n## Answered\n\n${answerLines.join("\n")}`;
-        writeTextAtomic(file, out);
-        return { status: "answered", title: block.title, decision };
+        return out;
     }
     const fenced2 = fenceTracker();
     let answeredAt = -1;
@@ -342,6 +359,5 @@ function answerQuestionLocked(root, n, rawDecision, expectedTitle, keepLines) {
     trimTrailingBlankLines(head);
     trimLeadingBlankLines(tail);
     const result = head.concat("", answerLines, tail);
-    writeTextAtomic(file, result.join("\n"));
-    return { status: "answered", title: block.title, decision };
+    return result.join("\n");
 }

package/dist/src/baseline/main-baseline.js

@@ -174,6 +174,15 @@ export function noteInheritedGreen(sha, from) {
  * verdict anyway (every code merge seeds one), so this bound only caps the rev-list on a cold
  * cache. */
 const INHERIT_WALK_MAX = 64;
+/** The body of a `git rev-list --first-parent --max-count=<max> <ref>` read — the walk the three
+ * first-parent scans in this module share, spelled the same on purpose so a change to the walk
+ * shape (the bound, the `--first-parent` flag) lands once. `inheritedGreen` and `watchedBaseline`
+ * walk a commit's ancestors (`${sha}^` / `${tip}^`, the commit itself excluded);
+ * `newestGreenAboveBuild` walks `tip` itself and down. Never throws: a git failure is an empty
+ * list, and every caller already treats that as a no-inheritance / no-verdict answer. */
+async function firstParentWalk(wt, ref, max) {
+    return gitLines(await gitTry(wt, "rev-list", "--first-parent", `--max-count=${max}`, ref));
+}
 /** A green for `sha` carried over from its nearest verdict-bearing first-parent ancestor, or null
  * when there is none to carry. The nearest ancestor with a cached verdict must be GREEN, and the
  * tree diff from it to `sha` must touch only `exemptPaths` (config.review.exemptPaths, the same
@@ -185,7 +194,7 @@ const INHERIT_WALK_MAX = 64;
  * past. An uncached ancestor is walked through, since the single diff from the green covers it.
  * Never throws: any git failure means no inheritance, and the caller runs the suite as before. */
 async function inheritedGreen(wt, sha, exemptPaths) {
-    const ancestors = gitLines(await gitTry(wt, "rev-list", "--first-parent", `--max-count=${INHERIT_WALK_MAX}`, `${sha}^`));
+    const ancestors = await firstParentWalk(wt, `${sha}^`, INHERIT_WALK_MAX);
     for (const ancestor of ancestors) {
         const verdict = baselineCache.get(ancestor);
         if (verdict === undefined)
@@ -229,7 +238,7 @@ export async function watchedBaseline(wt, sha) {
     const own = baselineCache.get(tip);
     if (own)
         return own;
-    const ancestors = gitLines(await gitTry(wt, "rev-list", "--first-parent", `--max-count=${INHERIT_WALK_MAX}`, `${tip}^`));
+    const ancestors = await firstParentWalk(wt, `${tip}^`, INHERIT_WALK_MAX);
     for (const ancestor of ancestors) {
         const verdict = baselineCache.get(ancestor);
         if (verdict)
@@ -249,6 +258,23 @@ const REDEPLOY_WALK_MAX = 64;
 export function watchVerifiesMain(root, config) {
     return detectBuildCheck(root, config) !== null && mergeCommandOf(config) !== undefined;
 }
+/** The newest first-parent commit below `tip`, down to and through `buildSha`, with a green
+ * cached verdict — the walk+scan redeployTarget's watched and un-watched branches share. Only
+ * their fallback differs: `notOnHistory` when `buildSha` is not on the first-parent walk at all
+ * (the caller keeps today's answer, `tip`), `onHistoryNone` when it is but nothing above it is
+ * green (watched keeps the build; un-watched keeps `tip`). Never throws: a git failure leaves
+ * the walk empty, so the fallback answers. */
+async function newestGreenAboveBuild(wt, tip, buildSha, notOnHistory, onHistoryNone) {
+    const walk = await firstParentWalk(wt, tip, REDEPLOY_WALK_MAX);
+    const buildAt = walk.indexOf(buildSha);
+    if (buildAt === -1)
+        return notOnHistory;
+    for (const sha of walk.slice(0, buildAt)) {
+        if (baselineCache.get(sha)?.status === "green")
+            return sha;
+    }
+    return onHistoryNone;
+}
 /** The commit self-redeploy should run: main's newest first-parent commit with a green full-check
  * verdict in the cache (observed or inherited) that is newer than the running build `buildSha`,
  * looking at most REDEPLOY_WALK_MAX commits down from `tip`.
@@ -275,28 +301,12 @@ export async function redeployTarget(wt, tip, buildSha, watched = false) {
     if (watched) {
         if (tip === "")
             return tip;
-        const walk = gitLines(await gitTry(wt, "rev-list", "--first-parent", `--max-count=${REDEPLOY_WALK_MAX}`, tip));
-        const buildAt = walk.indexOf(buildSha);
-        if (buildAt === -1)
-            return tip;
-        for (const sha of walk.slice(0, buildAt)) {
-            if (baselineCache.get(sha)?.status === "green")
-                return sha;
-        }
-        return buildSha;
+        return newestGreenAboveBuild(wt, tip, buildSha, tip, buildSha);
     }
     const red = baselineCache.get(tip);
     if (tip === "" || red?.status !== "red" || !(red.redFrom ?? []).includes(mirrorWorktreePath(wt)))
         return tip;
-    const walk = gitLines(await gitTry(wt, "rev-list", "--first-parent", `--max-count=${REDEPLOY_WALK_MAX}`, tip));
-    const buildAt = walk.indexOf(buildSha);
-    if (buildAt === -1)
-        return tip;
-    for (const sha of walk.slice(0, buildAt)) {
-        if (baselineCache.get(sha)?.status === "green")
-            return sha;
-    }
-    return tip;
+    return newestGreenAboveBuild(wt, tip, buildSha, tip, tip);
 }
 /** Verify main's own build/test suite at `wt`'s HEAD — which must be pristine main (the caller
  * is the fresh-run path right after resetWorktreeToMain; a dirty or ahead worktree would

package/dist/src/baseline/main-guardrails.js

@@ -49,25 +49,22 @@ export const QUARANTINE_WARN_COUNT = 10;
 /** How many of the oldest quarantined tests a warning names before folding the rest into a
  * remainder count. */
 const QUARANTINE_DETAIL_MAX = 3;
-/** G1 over `events`: warns when main has been red for more than RED_MAIN_WARN_MS, over the
- * trailing 24 h of `events` from `now`. Only `main_check` events with `durationMs` > 0 and
- * `main_red_hold` events count; a `main_check` with `durationMs` 0 (cached or inherited) is
- * ignored; a pass (including one naming only quarantined tests, recorded passed) ends the red.
- * The phrase names how long main has had no passing full check, the sha it has been red since,
- * its clock time, the newest red's first failing test when one is named, and — when the newest
- * `main_culprit` in the window blames the same sha the phrase names — the merge the main watch
- * blamed (`; the main watch blames <role>'s merge <sha>`, or `; the main watch blames merge
- * <sha>` when no runner is named), the one rule the dashboard alert and this phrase share.
- * Returns null when main is green, or red for RED_MAIN_WARN_MS or less. */
-export function redMainWarning(events, now) {
-    const cutoff = now - DAY_MS;
+/** True when `e` is the newest `main_culprit` seen so far: no contender yet, or a later `ts`.
+ * The newest-in-window pick that `scanRedWindow` folds into its loop. */
+function isNewerCulprit(c, e) {
+    return c === undefined || e.ts > c.ts;
+}
+/** Scans the trailing 24 h of `events` (cutoff `now - DAY_MS`), collecting the events that open,
+ * extend or end a red and picking the newest in-window `main_culprit` with a non-empty string
+ * `commit`. Owns the window scan and the newest-culprit pick. */
+function scanRedWindow(events, cutoff) {
     const relevant = [];
     let culprit;
     for (const e of events) {
         if (typeof e.ts !== "number" || e.ts < cutoff)
             continue;
         if (e.type === "main_culprit") {
-            if (typeof e.commit === "string" && e.commit.length > 0 && (culprit === undefined || e.ts > culprit.ts)) {
+            if (typeof e.commit === "string" && e.commit.length > 0 && isNewerCulprit(culprit, e)) {
                 culprit = e;
             }
             continue;
@@ -75,6 +72,13 @@ export function redMainWarning(events, now) {
         if (isRedMain(e) || isPassingMainCheck(e))
             relevant.push(e);
     }
+    return { relevant, culprit };
+}
+/** Derives the red spell over `window`'s `relevant` events: the start event and duration from
+ * `now`, whether the spell is unbroken, and the 30-minute threshold (null when main is green,
+ * or red for RED_MAIN_WARN_MS or less). Owns the red-spell derivation and the 30-minute bail. */
+function redSpell(window, now) {
+    const relevant = window.relevant;
     if (relevant.length === 0)
         return null;
     let newest = relevant[0];
@@ -99,19 +103,52 @@ export function redMainWarning(events, now) {
     if (durationMs <= RED_MAIN_WARN_MS)
         return null;
     const unbroken = lastPass === undefined && reds.length > 1;
-    const duration = unbroken || durationMs >= DAY_MS ? "more than 24 h" : redDurationPhrase(durationMs);
-    const failing = Array.isArray(newest.failingTests) && typeof newest.failingTests[0] === "string" ? newest.failingTests[0] : undefined;
-    const head = `main has had no passing full check for ${duration}: red since ${shortSha(startEv.sha)} at ${clockHm(startEv.ts)}`;
+    return { startEv, newest, durationMs, unbroken };
+}
+/** "more than 24 h" for an unbroken or full-window red, else the short duration phrase. Owns
+ * the duration wording. */
+function redSpellDuration(spell) {
+    return spell.unbroken || spell.durationMs >= DAY_MS ? "more than 24 h" : redDurationPhrase(spell.durationMs);
+}
+/** The newest red's first failing test, when one is named. Owns the first-failing-test read. */
+function redFailingTest(newest) {
+    return Array.isArray(newest.failingTests) && typeof newest.failingTests[0] === "string" ? newest.failingTests[0] : undefined;
+}
+/** The blame clause naming the merge the main watch blamed, when the newest `culprit` in the
+ * window blames the same sha the phrase names. Owns the blame clause. */
+function redBlameClause(culprit, newest) {
     // The blame names the merge the main watch blamed for the red — the same `main_culprit`
     // commit-equals-tip rule the dashboard alert uses (status-polls only publishes a blame whose
     // commit is the derived tip sha), so a red the watch did not blame never borrows another
     // head's culprit. A culprit naming another commit, or none, leaves the phrase as today.
     const shouldBlame = culprit !== undefined && culprit.commit === newest.sha;
-    const blame = shouldBlame
+    return shouldBlame
         ? typeof culprit.runner === "string" && culprit.runner.length > 0
             ? `; the main watch blames ${roleLabel(culprit.runner)}'s merge ${shortSha(culprit.commit)}`
             : `; the main watch blames merge ${shortSha(culprit.commit)}`
         : "";
+}
+/** G1 over `events`: warns when main has been red for more than RED_MAIN_WARN_MS, over the
+ * trailing 24 h of `events` from `now`. Only `main_check` events with `durationMs` > 0 and
+ * `main_red_hold` events count; a `main_check` with `durationMs` 0 (cached or inherited) is
+ * ignored; a pass (including one naming only quarantined tests, recorded passed) ends the red.
+ * The phrase names how long main has had no passing full check, the sha it has been red since,
+ * its clock time, the newest red's first failing test when one is named, and — when the newest
+ * `main_culprit` in the window blames the same sha the phrase names — the merge the main watch
+ * blamed (`; the main watch blames <role>'s merge <sha>`, or `; the main watch blames merge
+ * <sha>` when no runner is named), the one rule the dashboard alert and this phrase share.
+ * Returns null when main is green, or red for RED_MAIN_WARN_MS or less. The per-job work is
+ * split into the module-private helpers `scanRedWindow`, `redSpell`, `redSpellDuration`,
+ * `redFailingTest` and `redBlameClause`, one per job, so each is found by name. */
+export function redMainWarning(events, now) {
+    const window = scanRedWindow(events, now - DAY_MS);
+    const spell = redSpell(window, now);
+    if (spell === null)
+        return null;
+    const duration = redSpellDuration(spell);
+    const head = `main has had no passing full check for ${duration}: red since ${shortSha(spell.startEv.sha)} at ${clockHm(spell.startEv.ts)}`;
+    const failing = redFailingTest(spell.newest);
+    const blame = redBlameClause(window.culprit, spell.newest);
     return failing ? `${head} — ${squash(failing, 120)}${blame}` : `${head}${blame}`;
 }
 /** G3 over `entries` (the loadQuarantine list): warns when the list holds more than

package/dist/src/baseline/main-watch.js

@@ -6,7 +6,7 @@ import { detectBuildCheck } from "../build/build-check-detect.js";
 import { git, gitTry } from "../git/git-run.js";
 import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { errorMessage } from "../text/text.js";
-import { fileQuarantineBugsOnMain } from "../backlog/backlog-archive.js";
+import { fileQuarantineBugsOnMain } from "../backlog/backlog-file-bugs.js";
 import { loadQuarantine, markQuarantineFiled, onlyQuarantined, quarantinedTests, quarantineTests, releaseQuarantine, } from "../review/known-flakes.js";
 import { shortSha } from "../text/format.js";
 import { treeDiffFiles } from "../git/git-diff.js";

package/dist/src/budget/budget-wiring.js

@@ -59,11 +59,6 @@ function assignRunnerBudgetConfig(runners, liveConfig, view) {
     // the reload, can never run on the wrong model.
     for (const r of runners) {
         r.config = gateRoleConfig(r.role, liveConfig, view.roleConfig, view.directorConfig);
-        // An image reroute must never spend past the daily cap: while the gate has the team on
-        // its free fallback pairs, a reroute looks only among those pairs (plans/image-input.md
-        // "Reroute target" "Regime"). Set beside the config assignment so the scheduler's regime
-        // and the roles' never disagree.
-        r.budgetFallbackActive = view.onFallback;
     }
 }
 function handBackFallbackRuns(root, runners, liveConfig, accounts, view) {

package/dist/src/budget/budget.js

@@ -8,6 +8,7 @@
  * without importing either — the one-way rule that previously kept these functions in
  * runner-state.ts. */
 import { MODEL_TIERS } from "../config/config-schema.js";
+import { compareCodeUnits } from "../collections.js";
 import { nonNegativeNumber, setOwn } from "../files/json-object.js";
 import { dayAt, dayKey } from "../text/datetime.js";
 /** The local calendar day as YYYY-MM-DD — the same local-time convention as every other
@@ -76,7 +77,7 @@ export function topDailySpenders(states, now = Date.now(), limit = 3) {
     return states
         .map((s) => ({ role: s.role, spentUsd: dailyCost(s, now) }))
         .filter((r) => r.spentUsd > 0)
-        .sort((a, b) => b.spentUsd - a.spentUsd || (a.role < b.role ? -1 : a.role > b.role ? 1 : 0))
+        .sort((a, b) => b.spentUsd - a.spentUsd || compareCodeUnits(a.role, b.role))
         .slice(0, limit);
 }
 /** True when today's spend has reached the daily cost budget — the view is non-null, its cap is

package/dist/src/build/build-check-scoped.js

@@ -5,34 +5,11 @@ import { MERGE_SCOPES, SCOPE_WORDS, buildCheckEvent, buildCheckSkipWarning, runW
 import { CHECK_TIER, withCheckPermit } from "../concurrency/check-permit.js";
 import { sampleHostLoad, sampleSleepClock } from "./host-sleep.js";
 import { npmInstall } from "./dep-install.js";
-/** Run the project's declared check for a named scope — the detect → run → build_check event →
- * skip-warning sequence the review gate's pre-check (scope "gate"), the merge path's in-lock
- * re-check (scope "merge"), and the batch merger's one check over the whole stacked tree (scope
- * "batch") previously each ran inline, kept in one place so the event's shape and the skip warning
- * cannot drift between them. Split out of build-check.ts — which keeps the check's execution and
- * outcome classification (runBuildCheck, BuildCheckOutcome) — because orchestration is its own
- * concern: the permit, the event emission, the verdict-less retry, the merge-scope unverified
- * remapping, and the skip warning. Every run is an event with its cost: the deterministic checks
- * are where the team's compute goes after the authoring run, and "how long does npm test take per
- * merge" must be answerable from the feed, not by timing it by hand. Returns null when no check is
- * declared (nothing to run — the caller passes, exactly as before this split), otherwise the
- * declared check plus its classified outcome. A "skipped" outcome also logs its standard warning
- * here (wording keyed on the scope, the timeout as actually set — and, when its deadline fired
- * late, as actually enforced); "failed" and "passed" are the caller's to decide (deterministic
- * reject vs. verifiedHead / baseline seeding). A timeout or signal kill at a merge scope is
- * remapped to a deterministic "failed" — the tree is unverified, so it must not merge. A check
- * killed by a signal the harness did not send is retried once at any scope — the first run's death
- * says nothing about the tree (it is another run's `pkill`), so one verdict from a clean attempt is
- * owed before the skip is honored; a timeout whose deadline demonstrably fired late (the harness's
- * own host-sleep evidence) earns that same one retry at any scope, and a failed run the host slept
- * through does too; each attempt is priced as its own build_check event, carrying when the check
- * itself ran (buildCheckRunFields). A configured `check.gateCommand` replaces the command at scope
- * "gate" only (same cwd and timeout); the in-lock command (Fast merge "Defaults", mergeCommandOf) —
- * `check.mergeCommand` when set, else `check.gateCommand`, else the full check — replaces it at the
- * merge and batch scopes, and those events then carry `full: false`. The red-main baseline, which
- * detects on its own, keeps running check.command. `permitWait` hears
- * about a wait for the check permit (the merge cell's "waiting for a check slot"). Never throws. */
-export async function runScopedBuildCheck(root, role, scope, wt, config, timeoutMs = BUILD_CHECK_TIMEOUT_MS, sampleSleep = sampleSleepClock, install = npmInstall, permitWait, sampleLoad = sampleHostLoad) {
+/** Resolve which command to detect for a scope and the effective deadline it runs under — the
+ * command-swap/detect rule (gateCommandOf/mergeCommandOf over detectBuildCheck), the
+ * merge-scope starved deadline, and the cheaper flag. Returns null when no check is declared
+ * (nothing to run). */
+function resolveScopedCheck(wt, scope, config, timeoutMs, sampleLoad) {
     const swapped = scope === "gate" ? gateCommandOf(config) : MERGE_SCOPES.has(scope) ? mergeCommandOf(config) : undefined;
     const check = detectBuildCheck(wt, swapped === undefined ? config : { check: { ...config?.check, command: swapped } });
     if (!check)
@@ -50,6 +27,12 @@ export async function runScopedBuildCheck(root, role, scope, wt, config, timeout
         ? starvedDeadlineMs(checkTimeoutMs(check, timeoutMs), load)
         : checkTimeoutMs(check, timeoutMs);
     const runCheck = { ...check, timeoutMs: effectiveMs };
+    return { check, cheaper, runCheck, effectiveMs, load };
+}
+/** Run the resolved check under one permit, with the one clean retry for a verdict-less death —
+ * the one-permit-two-attempt rule. Prices the first attempt as its own build_check event and
+ * returns the final outcome and its run duration. */
+async function runScopedCheckWithRetry(root, role, scope, wt, runCheck, timeoutMs, config, sampleSleep, install, permitWait, cheaper) {
     // One permit covers both attempts (the killed-check retry re-runs under the permit it
     // holds); durationMs prices the run itself, not the wait for a permit.
     let durationMs = 0;
@@ -70,6 +53,12 @@ export async function runScopedBuildCheck(root, role, scope, wt, config, timeout
         granted: () => permitWait?.granted?.(),
         waited: (waitedMs, parked) => logCheckWaitEvent(root, role, scope, waitedMs, parked),
     }, `${role} ${scope}`);
+    return { raw, durationMs };
+}
+/** Classify the raw outcome: the merge-scope skip and slept-through rules become a deterministic
+ * unverified reject; anything else passes through. Never logs — the caller warns (see
+ * warnScopedCheck). Returns the unverified reason only when a rule fired. */
+function unverifiedOutcomeFor(scope, check, raw, effectiveMs, load, durationMs) {
     // A signal kill at a merge scope, or a timeout whose deadline fired on time (real slowness, a
     // genuinely hung or oversized suite), made no verdict about the tree — and this is the check
     // whose whole job is to catch a semantic conflict before it merges, so it rejects
@@ -89,6 +78,8 @@ export async function runScopedBuildCheck(root, role, scope, wt, config, timeout
         (((raw.status === "skipped" &&
             (raw.skipReason === "timeout" || raw.skipReason === "killed" || raw.skipReason === "install")) ||
             sleepFailed));
+    if (!unverifiedSkip)
+        return { outcome: raw, unverifiedReason: null };
     const unverifiedReason = raw.skipReason === "install"
         ? installFailedPhrase(SCOPE_WORDS[scope].label, raw.install, UNVERIFIED_TREE)
         : raw.skipReason === "killed"
@@ -99,17 +90,19 @@ export async function runScopedBuildCheck(root, role, scope, wt, config, timeout
                 // An on-time kill (the late-deadline wording already names its own cause) names the
                 // starved host when the load average says the team was the check's competition.
                 (raw.run?.deadlineLateMs ?? 0) > DEADLINE_LATE_TOLERANCE_MS ? "" : loadedHostPhrase(load)}`;
-    const outcome = unverifiedSkip
-        ? {
-            status: "failed",
-            script: checkScriptName(check),
-            outputTail: [unverifiedReason],
-            run: raw.run,
-            unverified: true,
-            ...(raw.install ? { install: raw.install } : {}),
-        }
-        : raw;
-    logEventBestEffort(root, buildCheckEvent(role, scope, outcome, durationMs, cheaper));
+    const outcome = {
+        status: "failed",
+        script: checkScriptName(check),
+        outputTail: [unverifiedReason],
+        run: raw.run,
+        unverified: true,
+        ...(raw.install ? { install: raw.install } : {}),
+    };
+    return { outcome, unverifiedReason };
+}
+/** Warn for the two verdict-less roads: a skipped check (buildCheckSkipWarning) or an unverified
+ * merge reject. Reads the scope word table and the killed signal. */
+function warnScopedCheck(root, role, scope, outcome, effectiveMs, durationMs, unverifiedReason) {
     if (outcome.status === "skipped") {
         // Environmental — deliberately NOT fail-closed, so a hung build script cannot wedge every
         // code run into the 3-strike discard (gate) or a merge behind the merge lock.
@@ -118,8 +111,44 @@ export async function runScopedBuildCheck(root, role, scope, wt, config, timeout
             ? { signal: outcome.killedBy, durationMs }
             : undefined, outcome.run, outcome.install));
     }
-    else if (unverifiedSkip) {
+    else if (unverifiedReason) {
         warnEventBestEffort(root, role, `${unverifiedReason}; rejecting the merge`);
     }
-    return { check, outcome };
+}
+/** Run the project's declared check for a named scope — the detect → run → build_check event →
+ * skip-warning sequence the review gate's pre-check (scope "gate"), the merge path's in-lock
+ * re-check (scope "merge"), and the batch merger's one check over the whole stacked tree (scope
+ * "batch") previously each ran inline, kept in one place so the event's shape and the skip warning
+ * cannot drift between them. Split out of build-check.ts — which keeps the check's execution and
+ * outcome classification (runBuildCheck, BuildCheckOutcome) — because orchestration is its own
+ * concern: the permit, the event emission, the verdict-less retry, the merge-scope unverified
+ * remapping, and the skip warning. Every run is an event with its cost: the deterministic checks
+ * are where the team's compute goes after the authoring run, and "how long does npm test take per
+ * merge" must be answerable from the feed, not by timing it by hand. Returns null when no check is
+ * declared (nothing to run — the caller passes, exactly as before this split), otherwise the
+ * declared check plus its classified outcome. A "skipped" outcome also logs its standard warning
+ * here (wording keyed on the scope, the timeout as actually set — and, when its deadline fired
+ * late, as actually enforced); "failed" and "passed" are the caller's to decide (deterministic
+ * reject vs. verifiedHead / baseline seeding). A timeout or signal kill at a merge scope is
+ * remapped to a deterministic "failed" — the tree is unverified, so it must not merge. A check
+ * killed by a signal the harness did not send is retried once at any scope — the first run's death
+ * says nothing about the tree (it is another run's `pkill`), so one verdict from a clean attempt is
+ * owed before the skip is honored; a timeout whose deadline demonstrably fired late (the harness's
+ * own host-sleep evidence) earns that same one retry at any scope, and a failed run the host slept
+ * through does too; each attempt is priced as its own build_check event, carrying when the check
+ * itself ran (buildCheckRunFields). A configured `check.gateCommand` replaces the command at scope
+ * "gate" only (same cwd and timeout); the in-lock command (Fast merge "Defaults", mergeCommandOf) —
+ * `check.mergeCommand` when set, else `check.gateCommand`, else the full check — replaces it at the
+ * merge and batch scopes, and those events then carry `full: false`. The red-main baseline, which
+ * detects on its own, keeps running check.command. `permitWait` hears
+ * about a wait for the check permit (the merge cell's "waiting for a check slot"). Never throws. */
+export async function runScopedBuildCheck(root, role, scope, wt, config, timeoutMs = BUILD_CHECK_TIMEOUT_MS, sampleSleep = sampleSleepClock, install = npmInstall, permitWait, sampleLoad = sampleHostLoad) {
+    const r = resolveScopedCheck(wt, scope, config, timeoutMs, sampleLoad);
+    if (!r)
+        return null;
+    const { raw, durationMs } = await runScopedCheckWithRetry(root, role, scope, wt, r.runCheck, timeoutMs, config, sampleSleep, install, permitWait, r.cheaper);
+    const { outcome, unverifiedReason } = unverifiedOutcomeFor(scope, r.check, raw, r.effectiveMs, r.load, durationMs);
+    logEventBestEffort(root, buildCheckEvent(role, scope, outcome, durationMs, r.cheaper));
+    warnScopedCheck(root, role, scope, outcome, r.effectiveMs, durationMs, unverifiedReason);
+    return { check: r.check, outcome };
 }

package/dist/src/change/change-data.js

@@ -10,6 +10,7 @@ import { knownRoleIdsCached, loadConfigSafe } from "../config/config.js";
 import { aheadOfMain, branchExists, countCommitsInRange, currentBranch, targetBranch } from "../git/git.js";
 import { gitTry } from "../git/git-run.js";
 import { aheadOfMainDiff, aheadOfMainFiles, changedFiles } from "../git/git-diff.js";
+import { compareCodeUnits } from "../collections.js";
 import { isAbsolute } from "node:path";
 import { branchName } from "../paths.js";
 import { isUsableWorktree } from "../git/worktree.js";
@@ -152,7 +153,8 @@ async function cappedWorkingDiff(wt, spec = []) {
     return (`[uncommitted diff truncated: the full diff is ${full.length} bytes; showing --stat]\n\n` + stat);
 }
 /** The paths two or more distinct roles hold: a role's duplicate path counts once, roles stay
- * in holdings order, paths sort by plain `<` comparison. */
+ * in holdings order, paths sort in code-unit order (`compareCodeUnits`, the locale-independent
+ * order a plain `<` comparison gives). */
 export function fileOverlaps(holdings) {
     const byPath = new Map();
     for (const { role, files } of holdings) {
@@ -166,7 +168,7 @@ export function fileOverlaps(holdings) {
     }
     return [...byPath.entries()]
         .filter(([, roles]) => roles.length >= 2)
-        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+        .sort(([a], [b]) => compareCodeUnits(a, b))
         .map(([path, roles]) => ({ path, roles }));
 }
 /** Keep only the overlaps naming a listed role; each kept entry still names every holder. */