tumwater 0.4.1 → 0.4.2

package/dist/src/doctor/doctor-backlog-plans.js

@@ -309,24 +309,24 @@ export function checkBacklogHeadings(root) {
         `later entries are invisible; keep one heading per name (the gate blocks only a merge ` +
         `that adds another copy — remove the duplicate in a deliberate edit)`);
 }
-/** Stalled entries — plans or bugs held by a **Needs review …** or **Needs replan …** note,
+/** Stalled entries — plans or bugs held by a **Needs review …** note,
  * parked until the plan role splits or replans them, plus the held-for-operator entries
  * parked until the operator releases them. No role takes a held entry (the claim gate refuses
  * one) and nothing clears the note on its own, so the state is visible only as the
- * `[needs review]`/`[needs replan]` marks in the backlog listings; this names them so an
+ * `[needs review]` marks in the backlog listings; this names them so an
  * operator gets a single-line health signal from `tumwater doctor`. Reads the tree at `root`
  * — the primary checkout IS main's tree — like checkRefusedEntries, which is also where
  * refusal notes (a different hold) are surfaced. entryHold (src/backlog/backlog-eligibility.ts)
  * already classifies the notes, so this check adds no parsing: only the entries whose hold is
- * exactly needs-review, needs-replan, or held-for-operator are collected, from both PLANS.md
+ * exactly needs-review or held-for-operator are collected, from both PLANS.md
  * and BUGS.md. A warn, never a fail — the checkRefusedEntries precedent: a parked entry is
- * operator signal, not a broken environment; the plan role resolves the first two itself, and
+ * operator signal, not a broken environment; the plan role resolves the first itself, and
  * a held-for-operator entry is the operator's to release (`tumwater plan|bug --release`). */
 export function checkStalledEntries(root) {
     const planned = plannedPlanEntries(root);
     const collect = (entry, file) => {
         const hold = entryHold(entry, planned);
-        return hold === "needs-review" || hold === "needs-replan" || hold === "held-for-operator" // vocabulary-ok: the held-for-operator hold's key
+        return hold === "needs-review" || hold === "held-for-operator" // vocabulary-ok: the held-for-operator hold's key
             ? { file, entry }
             : null;
     };
@@ -336,16 +336,16 @@ export function checkStalledEntries(root) {
     ].filter((x) => x !== null);
     const [first, ...rest] = stalled;
     if (!first)
-        return okOutcome("no planned plan or open bug is held by a Needs-review, Needs-replan, or held-for-operator note"); // vocabulary-ok: names the held-for-operator hold
+        return okOutcome("no planned plan or open bug is held by a Needs-review or held-for-operator note"); // vocabulary-ok: names the held-for-operator hold
     const more = andMore(rest, (s) => quoteHeading(s.entry.title));
     const kind = entryKindLabel(first.file); // "Bug" | "Plan"
     const head = `${first.file === "bugs" ? "BUGS.md" : "PLANS.md"} ${kind.toLowerCase()}`;
     const hold = entryHold(first.entry, planned);
-    const note = (first.entry.body.split(/\n/).find((line) => line.trimStart().startsWith("**Needs review ") || line.trimStart().startsWith("**Needs replan ")) ?? "").replace(/^\s*\*\*/, "").replace("**", "");
+    const note = (first.entry.body.split(/\n/).find((line) => line.trimStart().startsWith("**Needs review ")) ?? "").replace(/^\s*\*\*/, "").replace("**", "");
     if (hold === "held-for-operator") { // vocabulary-ok: the held-for-operator hold's key
         return warnOutcome(`${head} ${quoteHeading(first.entry.title)} is held for the operator ${heldCount(first.entry.body)} times${more} — release it with tumwater ${kind.toLowerCase()} --release`); // vocabulary-ok: a held-for-operator entry is the operator's to release
     }
-    return warnOutcome(`${head} ${quoteHeading(first.entry.title)} is held by a ${hold === "needs-review" ? "Needs review" : "Needs replan"} note ` +
+    return warnOutcome(`${head} ${quoteHeading(first.entry.title)} is held by a Needs review note ` +
         `(${truncate(note, REFUSAL_NOTE_MAX)})${more} — the plan role resolves it by splitting or replanning`);
 }
 /** Plan dependencies — mistakes in the planned plans' `requires … landed` clauses that the claim

package/dist/src/doctor/doctor-backlog.js

@@ -50,13 +50,6 @@ export const STALE_QUESTION_DAYS = 7;
  * opinionated default with no knob, like STALE_QUESTION_DAYS. Three days is long enough that a
  * bug filed late one evening and fixed the next day never warns. */
 export const STALE_BUG_DAYS = 3;
-/** The whole days a bug may stay held by a Waiting for the next failure note before the
- * waiting-bugs check warns that its flake has not come back. A note parks a bug until it fails
- * again, but the failure may never come, so a hold has to lapse or the entry parks indefinitely;
- * one week without a recurrence is long enough that a recurring flake would almost surely have
- * shown up, and short enough that a bug which never returns stops squatting in the backlog as
- * an ok. An opinionated default with no knob, like STALE_BUG_DAYS. */
-export const STALE_WAIT_DAYS = 7;
 /** The `(and N more …)` suffix three one-line doctor details append after naming their first
  * suspect (fix claims, stranded plans, duplicated headings): the rest stay visible but
  * shortened, since a doctor check renders one line. `render` makes each extra item's short
@@ -100,7 +93,7 @@ export function readDocChecked(p, file, missingDetail) {
 }
 /** The standard single-file check's read prologue for a backlog document at `root`: the
  * readDocChecked call every per-file doctor check (checkFixClaims, checkValidationGaps,
- * checkStrandedPlans, checkStaleQuestions, and the stale/waiting bug checks) repeats, with the
+ * checkStrandedPlans, checkStaleQuestions, and the stale bug checks) repeats, with the
  * `no <file> — nothing to verify` missing-detail derived from the file name so the file triple
  * (path, display name, message) and the message template cannot drift across the seven call
  * sites. Returns the document, or the outcome the caller should return as-is. */
@@ -111,11 +104,9 @@ export function readBacklogChecked(root, file) {
  * warns: 6 hours, fixed. A verify plus a merge completes in minutes (plans/merge-queue.md), so a
  * full six-hour silence while the team is healthy — not on a hold, which doctor already reports
  * separately — is never a merely busy pipeline: it reads as a drain that has stalled. The one
- * opinionated default, like STALE_QUESTION_DAYS, so no knob. The always-on `stale-merges` team
- * alert (src/ui/alert-feeds.ts staleMerges) reuses this same window through
- * staleQueuedMergeRows, so the doctor's row and the alert cannot drift on the threshold (the
+ * opinionated default, like STALE_QUESTION_DAYS, so no knob (the dead-alert feed is gone; the
  * STALE_PROMPT_MS/STALE_BUG_DAYS precedent). */
-export const MERGE_QUEUE_STALE_MS = 6 * HOUR_MS;
+const MERGE_QUEUE_STALE_MS = 6 * HOUR_MS;
 /** The window of the merge-wait phrase on the stale merge-queue row. */
 const MERGE_WAIT_WINDOW_MS = DAY_MS;
 /** Stale queued merges — a change that has sat in the durable merge queue too long without starting
@@ -151,15 +142,14 @@ export function checkStaleQueuedMerges(root, now) {
     return withWait(warnOutcome(`merge-queue entry of ${roleLabel(first.role)} — ${quoteHeading(first.summary)} — has waited ` +
         `${first.age} to start${more}; a queued change the pipeline neither approves nor flags reads as healthy, so the merge queue has stopped moving`));
 }
-/** The one traversal shared by the doctor's `stale merge-queue entries` row
- * (checkStaleQueuedMerges) and the always-on `stale-merges` team alert
- * (src/ui/alert-feeds.ts staleMerges): every queued merge whose role is not in the in-flight
+/** The one traversal for the doctor's `stale merge-queue entries` row
+ * (checkStaleQueuedMerges): every queued merge whose role is not in the in-flight
  * marker and whose wait strictly exceeds MERGE_QUEUE_STALE_MS (6 h), in queue-file order (oldest
  * first). The in-flight set comes from readMergeMarker via mergeChanges (an absent or
  * never-throwing unreadable marker contributes the empty set) — a slow review is not a stalled
- * drain. Each row carries { role, summary, waitedMs }; the doctor's row adds its age phrase and
- * the alert names the wait, so the rule and its threshold live in one place and cannot drift. */
-export function staleQueuedMergeRows(root, now) {
+ * drain. Each row carries { role, summary, waitedMs }, which the row renders with its age
+ * phrase, so the rule and its threshold live in one place and cannot drift. */
+function staleQueuedMergeRows(root, now) {
     const marker = readMergeMarker(root);
     const inFlight = new Set(marker ? mergeChanges(marker).map((c) => c.role) : []);
     return queuedMerges(root)
@@ -167,9 +157,8 @@ export function staleQueuedMergeRows(root, now) {
         .map((e) => ({ role: e.role, summary: e.summary, waitedMs: now - e.enqueuedAt }));
 }
 /** The merge-queue files `readMergeQueue` skips — torn, foreign, or vanished mid-listing — as
- * checkout-relative paths. One traversal shared by the doctor's `checkMergeQueueFiles` row and
- * the always-on `skipped-merges` team alert (src/ui/alert-feeds.ts skippedMergeFiles), so
- * the two surfaces select the same files and name the same paths and cannot drift. */
+ * checkout-relative paths. The one traversal behind the doctor's `checkMergeQueueFiles` row, so
+ * the row names the same paths the reader actually skips and cannot drift. */
 export function skippedMergeQueueFiles(root) {
     return unreadableMergeQueueFiles(root).map((f) => path.relative(root, f));
 }
@@ -203,9 +192,8 @@ export const POST_REVIEW_AT_RISK_FAILURES = POST_REVIEW_FAILURE_LIMIT - 1;
  * is not waiting on a verdict and must not read as one failed run from being dropped.
  * A review that has already landed its fix (`fixed` set) is left out too — it is a settled
  * record naming both shas, not a verdict-less entry the next run could drop.
- * One traversal shared by the doctor's `post-merge reviews` row (checkPostReviews) and the
- * always-on `post-merge-risk` team alert (src/ui/alert-feeds.ts postReviewRiskAlert), so the
- * two surfaces select the same entries and cannot drift. Reads .tumwater/state/post-review.json
+ * One traversal used by the doctor's `post-merge reviews` row (checkPostReviews), so the row's
+ * selection lives in one place. Reads .tumwater/state/post-review.json
  * through readPostReviews, which degrades a missing or torn file to the well-formed subset or
  * `[]` and never throws. */
 export function atRiskPostReviews(root) {
@@ -215,8 +203,8 @@ export function atRiskPostReviews(root) {
 }
 /** The doctor's one sentence naming the post-merge reviews one failed run from being dropped
  * (the checkStaleQueuedMerges phrase precedent): the first in full — role, short commit, summary
- * and the failures count — the rest folded through andMore, and the one sentence every surface
- * shows, so the doctor row and the alert cannot drift on the wording. null for an empty list. */
+ * and the failures count — the rest folded through andMore, the one sentence the row shows, so
+ * the wording lives in one place. null for an empty list. */
 export function atRiskPostReviewsPhrase(rows) {
     const [first, ...rest] = rows;
     if (!first)
@@ -229,8 +217,8 @@ export function atRiskPostReviewsPhrase(rows) {
  * drain drops an entry at POST_REVIEW_FAILURE_LIMIT failed runs) — the last moment an operator
  * can fix the reviewer backend or deliberately accept the commit unreviewed before the drain
  * drops it from the queue and it stays on main unreviewed. Reads .tumwater/state/post-review.json
- * through the shared atRiskPostReviews traversal the always-on post-merge-risk team alert
- * (src/ui/alert-feeds.ts postReviewRiskAlert) uses, so the two surfaces cannot drift. A warn,
+ * through the shared atRiskPostReviews traversal, so the selection and wording live in one
+ * place. A warn,
  * never a fail — the checkStaleQueuedMerges precedent: a failing reviewer is operator signal,
  * not a broken environment; readPostReviews never throws (a missing or torn file degrades to the
  * well-formed subset or `[]`), so the check needs no read-error arm. */
@@ -242,16 +230,14 @@ export function checkPostReviews(root) {
 /** How long a queued prompt may wait for its role to dequeue it before the stale-prompt check
  * warns: a day, fixed. An opinionated default with no knob, like MERGE_QUEUE_STALE_MS: a day is
  * long enough that a healthy role's next run would have dequeued the prompt, and short enough
- * that a paused or disabled role's stranded prompt shows up. The always-on stale-prompt team
- * alert (src/ui/alert-feeds.ts stalePrompts) reuses this same threshold, so it cannot drift
- * from the doctor's check — the STALE_BUG_DAYS precedent. */
-export const STALE_PROMPT_MS = DAY_MS;
+ * that a paused or disabled role's stranded prompt shows up. The stale-prompt check reads this
+ * same threshold, so it cannot drift — the STALE_BUG_DAYS precedent. */
+const STALE_PROMPT_MS = DAY_MS;
 /** The queued inbox prompts the doctor's stale-prompt rule calls stale — deliverable now (a
  * `--at` prompt still counting down is never stale) and queued more than STALE_PROMPT_MS,
  * oldest-first, `queuedAtMs` narrowed to a number. One traversal shared by the doctor's
- * `checkStalePrompts` check and the always-on `stalePrompts` team alert (src/ui/alert-feeds.ts),
- * so the two surfaces read the same rule at the same threshold and cannot drift. */
-export function staleQueuedPromptRows(root, now) {
+ * `checkStalePrompts` check, so the rule lives in one place at one threshold. */
+function staleQueuedPromptRows(root, now) {
     return queuedListRows(root, null, listWideScope(root))
         .filter((p) => p.queuedAtMs !== null && deliverableAt(p.notBeforeMs, now) && now - p.queuedAtMs > STALE_PROMPT_MS)
         .sort((a, b) => a.queuedAtMs - b.queuedAtMs)
@@ -264,7 +250,7 @@ export function staleQueuedPromptRows(root, now) {
  * views (`tumwater prompt --list`, the dashboard Inbox tab, the TUI Inbox pane) show its age —
  * and only when the operator looks. This names the oldest due-but-undelivered prompt, its role,
  * and the deliver-or-drop commands. Reads the queue through the shared `staleQueuedPromptRows`
- * traversal the always-on stale-prompts alert uses (no new reader in src/inbox/), keeping only
+ * traversal (no new reader in src/inbox/), keeping only
  * rows that are deliverable now — a `--at 7d` prompt still counting down is never stale — and
  * stamped more than STALE_PROMPT_MS ago. A warn, never a fail — the checkStaleQueuedMerges
  * precedent: a stranded prompt is operator signal, not a broken environment. */

package/dist/src/doctor/doctor-check-names.js

@@ -29,7 +29,6 @@ export const DOCTOR_CHECK_NAMES = [
     "over-cap model",
     "fallback chain",
     "models for each tier",
-    "image input",
     "claude auth",
     "claude api key",
     "claude version",
@@ -74,11 +73,12 @@ export const DOCTOR_CHECK_NAMES = [
     "plan dependencies",
     "stale questions",
     "stale bugs",
-    "waiting bugs",
     "regressed fixes",
     "stale merge-queue entries",
     "merge-queue files",
     "post-merge reviews",
+    "main diff rules",
+    "dropped post-merge reviews",
     "stale prompts",
     "uncommitted backlog",
     "update",

package/dist/src/doctor/doctor-claude-checks.js

@@ -10,8 +10,8 @@ import { belowNodeFloor } from "../version.js";
 import { failOutcome, okOutcome, warnOutcome } from "./outcome.js";
 import { claudeSeamsInUse, loadConfigForCheck, versionFromProbe, seamedModels, } from "./doctor-model-checks.js";
 /** The doctor's claude credential and version readiness checks, split out of
- * doctor-model-checks.ts (whose shared seam/model framework and the pi, tier-models and
- * image-input checks stay there): checkClaudeAuth, checkAnthroApiKey and checkClaudeVersion.
+ * doctor-model-checks.ts (whose shared seam/model framework and the pi and tier-models
+ * checks stay there): checkClaudeAuth, checkAnthroApiKey and checkClaudeVersion.
  * These are the doctor's only checks that spawn the `claude` binary and read its auth — a
  * distinct concern from the filesystem/git checks, kept together so a change to how doctor
  * spawns or scrubs claude does not touch the other model checks. The shared report contract

package/dist/src/doctor/doctor-contention-checks.js

@@ -517,7 +517,7 @@ export function providerConcurrencyProblems(config, piDefault) {
     const capSet = new Set(capKeys);
     const keyless = seams.filter((s) => seamConcurrencyKey(s, piDefault) === undefined);
     if (capSet.size > 0 && keyless.length > 0) {
-        warnings.push(`${keyless.length} model job(s) resolve to no provider key (pi's default provider is unreadable, so they cannot be capped): ${keyless.map((s) => s.label).join(", ")}`);
+        warnings.push(`${plural(keyless.length, "model job")} ${agree(keyless.length, "resolves", "resolve")} to no provider key (pi's default provider is unreadable, so they cannot be capped): ${keyless.map((s) => s.label).join(", ")}`);
     }
     return warnings;
 }

package/dist/src/doctor/doctor-holds.js

@@ -1,4 +1,5 @@
 import { roleLabel } from "../roles/role-labels.js";
+import { sortEntriesByKey } from "../collections.js";
 import { pausedRoles, pausedRolesUntil, standingTeamPause } from "../team/team-state.js";
 import { MODEL_TIERS } from "../config/config-schema.js";
 import { withModelOverrides } from "../config/config-views.js";
@@ -32,6 +33,12 @@ export function loadRunnerStates(root, config) {
         .map((id) => loadRunnerState(root, id))
         .sort((a, b) => a.role.localeCompare(b.role));
 }
+/** A doctor row's `not checked` outcome when tumwater.json is unreadable: the row blanks its
+ * verdict rather than claim a state it cannot see (checkInit owns that error). Every check that
+ * reads the config returns this same outcome when the file is unreadable. */
+function uncheckedConfigOutcome() {
+    return okOutcome("not checked — tumwater.json unreadable");
+}
 /** The `pause` check: names a standing operator pause so doctor does not print "ready to run"
  * over a team that starts no run. Read-only: it reads the same team and per-role pause
  * markers the scheduler reads (standingTeamPause, pausedRoles, pausedRolesUntil — all treat
@@ -95,14 +102,11 @@ export function checkQuietHours(config, now = new Date()) {
  * per-role caps reached alone are ok because the operator chose them by name. */
 export function checkBudget(root, config, published, now = Date.now()) {
     if (config === undefined)
-        return okOutcome("not checked — tumwater.json unreadable");
+        return uncheckedConfigOutcome();
     const states = loadRunnerStates(root, config);
     const spent = published?.spentUsd ?? teamDailyCost(states, now);
     const caps = config.maxDailyCostUsdPerRole;
-    const capped = [...roleCapVerdicts(states.map((s) => ({ role: s.role, state: s })), caps, now)]
-        .filter(([, v]) => v.over)
-        .sort(([a], [b]) => a.localeCompare(b))
-        .map(([base, v]) => `${base} (${budgetPhrase(v.spentUsd, caps?.[base])})`);
+    const capped = sortEntriesByKey([...roleCapVerdicts(states.map((s) => ({ role: s.role, state: s })), caps, now)].filter(([, v]) => v.over)).map(([base, v]) => `${base} (${budgetPhrase(v.spentUsd, caps?.[base])})`);
     const cappedPhrase = capped.length > 0 ? `; capped roles: ${capped.join(", ")}` : "";
     const cap = config.maxDailyCostUsd;
     if (!(cap > 0))
@@ -124,7 +128,7 @@ export function checkBudget(root, config, published, now = Date.now()) {
  * because it stops a whole tier. */
 export function checkMaintenanceQuota(root, config, aliveTeam, now = Date.now()) {
     if (config === undefined)
-        return okOutcome("not checked — tumwater.json unreadable");
+        return uncheckedConfigOutcome();
     const runners = loadRunnerStates(root, config).map((s) => ({ role: s.role, running: aliveTeam && s.running === true }));
     const queued = aliveTeam ? new Set(readMergeQueue(root).entries.map((e) => e.role)) : new Set();
     const { allowance, used, held } = maintenanceQuotaForPoll(root, config.maintenancePerWorkMerge, runners, queued, now);
@@ -201,9 +205,7 @@ export function checkProviderHolds(root, now = Date.now()) {
             standing.delete(typeof ev.provider === "string" ? ev.provider : undefined);
         }
     }
-    const held = [...standing.entries()]
-        .filter(([, h]) => h.end > now)
-        .sort(([a], [b]) => (a ?? "").localeCompare(b ?? ""));
+    const held = sortEntriesByKey([...standing.entries()].filter(([, h]) => h.end > now));
     if (held.length === 0)
         return okOutcome("no provider holds");
     const lines = held.map(([provider, h]) => {
@@ -221,7 +223,7 @@ export function checkProviderHolds(root, now = Date.now()) {
  * fail: a failing role does not stop the team from running. */
 export function checkErrorStreaks(root, config) {
     if (config === undefined)
-        return okOutcome("not checked — tumwater.json unreadable");
+        return uncheckedConfigOutcome();
     const failing = loadRunnerStates(root, config)
         .filter((s) => errorStreakAtWarn(s));
     if (failing.length === 0)
@@ -252,7 +254,7 @@ export function checkErrorStreaks(root, config) {
  * the team from running. `now` is injected so a test can pin a red's age. */
 export function checkMainRed(root, config, now = Date.now()) {
     if (config === undefined)
-        return okOutcome("not checked — tumwater.json unreadable");
+        return uncheckedConfigOutcome();
     const mainCheck = mainCheckForPoll(root, config);
     const ids = runnerIds(config);
     const held = loadRunnerStates(root, config)

package/dist/src/doctor/doctor-model-checks.js

@@ -1,31 +1,22 @@
 import { childEnv } from "../process/process.js";
 import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./probe.js";
-import { enabledRoleIds, defaultConfig, loadConfigSafe } from "../config/config.js";
-import { configForRole } from "../config/config-views.js";
-import { resolveTierFallbacks, seamsInUse } from "../config/config-fallbacks.js";
-import { cacheReadUnpriced, piModelsPath, piPairFree, readPiProviders } from "../pi/pi-models.js";
-import { MODEL_TIERS } from "../config/config-schema.js";
-import { imageReroute, seamImageInput } from "../agent/image-input.js";
-import { modelLabel, usesPiModels } from "../agent/backend-traits.js";
-import { backendById } from "../agent/agent-backend.js";
-import { imageProbeEntryFresh, imageProbeKey, readImageProbeCache, runImageProbe, writeImageProbeCache, } from "./image-probe.js";
-import { readClaudeAccount } from "../agent/claude/claude-account.js";
+import { defaultConfig, loadConfigSafe } from "../config/config.js";
+import { seamsInUse } from "../config/config-fallbacks.js";
+import { cacheReadUnpriced, piModelsPath, readPiProviders } from "../pi/pi-models.js";
 import { envPath } from "../files/files.js";
 import { piListedModels, piProviderAuth } from "./doctor-pi-checks.js";
-import { readPiListedModels } from "../pi/pi-listed-models.js";
 import { agree } from "../text/phrases.js";
-import { formatDate } from "../text/datetime.js";
-import { errorMessage, joinParts } from "../text/text.js";
+import { joinParts } from "../text/text.js";
 import { failOutcome, okOutcome, warnOutcome } from "./outcome.js";
 import { belowNodeFloor } from "../version.js";
 /** The one phrase a configured-models check uses when the config declares no models at all:
  * informational (capability falls to pi's own defaults), not a warning. Shared by
- * checkTierModels and checkImageInput so the two checks word the same "nothing configured"
- * stance identically. */
+ * checkTierModels so the check words the same "nothing configured"
+ * stance. */
 const PHRASE_NO_MODELS_DECLARED = "no models declared — every model job uses pi's own default";
 /** The one phrase a configured-models check uses when pi's definitions file could not be read
  * at all: the check cannot answer what it was asked, so it warns instead of guessing. Shared by
- * checkTierModels and checkImageInput so the two checks word the "cannot check" stance
+ * checkTierModels so the check words the "cannot check" stance
  * identically; each appends its own modelsPath after the shared stem, and checkTierModels
  * also appends its ompNote. */
 const PHRASE_CANNOT_READ_MODELS = "cannot check — could not read pi's model definitions at ";
@@ -33,7 +24,7 @@ const PHRASE_CANNOT_READ_MODELS = "cannot check — could not read pi's model de
  * repo-setup checks stay there, and whose state/disk/build checks live in
  * doctor-project-checks.ts), and split apart again so one theme owns one module: this file holds
  * the shared config guard, the seam framework (seamPairs and the per-backend seam predicates),
- * and the declared-tier and image-input checks (checkTierModels, checkImageInput). The cap
+ * and the declared-tier check (checkTierModels). The cap
  * fallback price and fallback-chain checks (checkFallbackModel, checkFallbackChain) live in
  * doctor-fallback-checks.ts, importing this file's loadConfigForCheck just as the per-backend
  * modules do. The claude, opencode, codex and pi provider checks live in their own per-backend
@@ -277,173 +268,6 @@ export async function checkTierModels(root, modelsPath = piModelsPath(), auth =
         return failOutcome(`${base}${ompNote}`);
     return (warns.length > 0 || ompVars.length > 0 ? warnOutcome : okOutcome)(`${base}${ompNote}`);
 }
-/** The doctor's image-input capability check (plans/image-input.md "Doctor", parts 1-2/5):
- * which of the team's seams claim to read images, and whether every text-only enabled role can
- * reroute to one that does. Part 2 adds the live probe — with `probeImages` "missing" (the
- * terminal `tumwater doctor` default) each claimed pi model with no fresh cached verdict is
- * shown a real image and the answer is checked; with "all" (the `--reprobe` flag, the
- * dashboard's Re-probe models button and the TUI Health tab's Ctrl+P) every claimed model is
- * re-probed; with "never" (the TUI Health tab and GUI doctor endpoint on entry and refresh)
- * nothing is spawned and only cached verdicts are read, so a refresh never spends a model call.
- * claude seams are never probed — every Claude model reads images, and a probe would spend
- * subscription window to confirm it.
- *
- * Covers the same seams as `tier models` (seamPairs — the tiers, enabled roles and the
- * reviewer) plus the tiers' fallback pairs (the reroute part picks its target among them, so a
- * text-only fallback would promise a reroute no fallback can serve). A claimed model whose probe
- * failed (fresh verdict) is dropped from the readers and reads false from seamImageInput, so the
- * reroute sweep never sends a text-only role to a model that lost its probe. `providers`,
- * `account`, `pathEnv` and `probe` are injectable so tests need no real pi install or account. */
-export async function checkImageInput(root, modelsPath = piModelsPath(), providers = readPiProviders(modelsPath), account, probeImages = "never", pathEnv = envPath(), probe = runImageProbe) {
-    const config = loadConfigForCheck(root);
-    if ("level" in config)
-        return config;
-    // `tier models` already fails on a missing/unknown pair, so this check names only what it can
-    // answer; unknown (null) pairs are left to that check. A missing definitions file only blocks
-    // this check when a seam actually needs it — an all-claude team reads images without it.
-    const accountNow = account === undefined ? readClaudeAccount(root) : account;
-    // The free-ness lookup reads the image-input check's one claude account (part 2a/9).
-    const accounts = (b) => (b === "claude" ? accountNow : null);
-    const listed = readPiListedModels(root);
-    const pairs = seamPairs(config);
-    const needsDefinitions = pairs.some((p) => usesPiModels(p.agent ?? "pi"));
-    if (providers === null && needsDefinitions)
-        return warnOutcome(`${PHRASE_CANNOT_READ_MODELS}${modelsPath}`);
-    const label = modelLabel;
-    // The catalog claims (raw `input`, ignoring the cache): what to probe and report, including a
-    // model whose earlier probe failed (it must still be named and re-probed by --reprobe).
-    const claimed = new Map();
-    for (const pair of pairs) {
-        if (pair.model === undefined)
-            continue;
-        if (seamImageInput(pair, providers, undefined, listed) === true)
-            claimed.set(imageProbeKey(pair.agent, pair.provider, pair.model), {
-                agent: pair.agent,
-                provider: pair.provider,
-                model: pair.model,
-                thinking: pair.thinking,
-            });
-    }
-    // The tiers' fallback pairs: a reroute target must itself read images to help, and part 4's
-    // fallback regime picks among these, so a text-only fallback team is a coverage gap here.
-    const resolved = resolveTierFallbacks(config, (p) => piPairFree(providers, p, accounts));
-    for (const tier of MODEL_TIERS) {
-        const pair = resolved[tier].pair;
-        if (pair?.model === undefined)
-            continue;
-        // The readers (seamImageInput, imageReroute) resolve a pair with no backend to the "pi"
-        // agent, so the cache key must carry "pi" — keying it `undefined` would write a verdict the
-        // readers never read.
-        const agent = pair.backend ?? "pi";
-        if (seamImageInput({ ...pair, agent }, providers, undefined, listed) === true)
-            claimed.set(imageProbeKey(agent, pair.provider, pair.model), {
-                agent,
-                provider: pair.provider,
-                model: pair.model,
-                thinking: pair.thinking,
-            });
-    }
-    const probes = readImageProbeCache(root);
-    const now = Date.now();
-    const env = childEnv({ PATH: pathEnv });
-    const readsItems = [];
-    const failed = [];
-    const couldNot = [];
-    let probedAny = false;
-    // Settle one claimed seam: probe when asked and uncached, read a fresh cached verdict
-    // otherwise, or report "not verified yet". Only pass/fail are cached; could-not-verify is
-    // reported but never cached.
-    for (const seam of claimed.values()) {
-        const agent = seam.agent;
-        // A backend that registers an imageInput hook trusts the hook (claude today, which reads
-        // every model); a backend without one is probed through its model catalog.
-        if (agent !== undefined && backendById(agent)?.imageInput !== undefined) {
-            readsItems.push(label(agent, seam.provider, seam.model));
-            continue;
-        }
-        const key = imageProbeKey(agent, seam.provider, seam.model);
-        const cached = probes[key];
-        const valid = imageProbeEntryFresh(cached, now);
-        const wantProbe = probeImages !== "never" && (probeImages === "all" || !valid);
-        if (wantProbe) {
-            probedAny = true;
-            const result = await probe(config, { provider: seam.provider, model: seam.model, thinking: seam.thinking }, env);
-            if (result.verdict === "pass") {
-                probes[key] = { verdict: "pass", detail: result.detail, at: now, claim: true };
-                readsItems.push(`${label(agent, seam.provider, seam.model)} (verified ${formatDate(new Date(now))})`);
-            }
-            else if (result.verdict === "fail") {
-                probes[key] = { verdict: "fail", detail: result.detail, at: now, claim: true };
-                failed.push(`${label(agent, seam.provider, seam.model)} failed the image probe — ${result.detail}`);
-            }
-            else {
-                couldNot.push(`${label(agent, seam.provider, seam.model)} could not be verified — ${result.detail}`);
-            }
-        }
-        else if (cached && imageProbeEntryFresh(cached, now)) {
-            if (cached.verdict === "pass") {
-                readsItems.push(`${label(agent, seam.provider, seam.model)} (verified ${formatDate(new Date(cached.at))})`);
-            }
-            else {
-                failed.push(`${label(agent, seam.provider, seam.model)} failed the image probe — ${cached.detail}`);
-            }
-        }
-        else {
-            readsItems.push(`${label(agent, seam.provider, seam.model)} (not verified yet — run \`tumwater doctor\`)`);
-        }
-    }
-    let saveProblem = null;
-    if (probedAny) {
-        try {
-            writeImageProbeCache(root, probes);
-        }
-        catch (err) {
-            saveProblem = errorMessage(err);
-        }
-    }
-    const verdict = () => {
-        // Text-only enabled roles: which can reroute to a tier that reads images (honoring failed
-        // probes), and which cannot.
-        const reroutes = [];
-        const noTarget = [];
-        for (const role of enabledRoleIds(config)) {
-            const rc = configForRole(config, role);
-            if (rc.model === undefined)
-                continue;
-            if (seamImageInput(rc, providers, probes, listed) !== false)
-                continue; // reads images, or unknown (to tier models)
-            const rr = imageReroute(config, role, "primary", modelsPath, accountNow, probes, null, listed);
-            if (rr && seamImageInput(rr.config, providers, probes, listed) === true)
-                reroutes.push(`${role} text-only (${label(rc.agent, rc.provider, rc.model)}) — reroutes to ${rr.tier} (${label(rr.config.agent, rr.config.provider, rr.config.model)})`);
-            else
-                noTarget.push(`${role} text-only (${label(rc.agent, rc.provider, rc.model)})`);
-        }
-        // A team that declared no models at all leaves capability to pi's own defaults — the same
-        // "nothing configured" stance as tier models, informational rather than a warning.
-        const declared = pairs.some((p) => p.model !== undefined) ||
-            MODEL_TIERS.some((t) => resolved[t].pair?.model !== undefined);
-        if (!declared)
-            return okOutcome(PHRASE_NO_MODELS_DECLARED);
-        const readsLine = readsItems.length > 0 ? `reads images: ${[...readsItems].sort().join(", ")}` : "";
-        const details = joinParts([readsLine, ...reroutes]);
-        if (failed.length > 0)
-            return failOutcome(`${failed.join("; ")} — remove "image" from its input in pi's models.json or fix the endpoint, then run \`tumwater doctor --reprobe\``);
-        if (couldNot.length > 0)
-            return warnOutcome(`${couldNot.join("; ")}; ${details}`.replace(/;\s*$/, ""));
-        if (noTarget.length > 0)
-            return warnOutcome(`${noTarget.join("; ")} — no configured model reads images, so a run that reads an image fails; declare image input on a vision model in pi's models.json, or point a tier at one`);
-        if (readsItems.length === 0)
-            return warnOutcome("no configured model reads images — a run that reads an image fails; declare image input on a vision model in pi's models.json, or point a tier at one");
-        return okOutcome(details);
-    };
-    const outcome = verdict();
-    if (saveProblem === null)
-        return outcome;
-    return {
-        level: outcome.level === "ok" ? "warn" : outcome.level,
-        detail: `${outcome.detail} — could not save the image-probe cache (${saveProblem}), so the next doctor probes again`,
-    };
-}
 /** `gh` readiness for the opt-in `feedback` observer (plans/feedback-role.md "Shape" → "Part 1"):
  * the role files issues as the operator's GitHub login through `gh`, so doctor confirms `gh`
  * resolves and `gh auth status` exits 0 before a run tries to file — the codex-login pattern

package/dist/src/doctor/doctor-notify.js

@@ -6,11 +6,8 @@ import { errorMessage, squash } from "../text/text.js";
 import { okOutcome, warnOutcome } from "./outcome.js";
 /** How far back the `notify` check looks for failed pages: a day, fixed. An opinionated
  * default with no knob, like STALE_BUG_DAYS: long enough that a transient hook failure shows
- * up, short enough that a page that did not go through is still the operator's business. The
- * always-on notify team alert (src/ui/alert-feeds.ts notifyFailures) reuses this same
- * threshold and the same isNotifyFailure window, so it cannot drift from the doctor's check
- * — the STALE_BUG_DAYS precedent. */
-export const NOTIFY_CHECK_WINDOW_MS = DAY_MS;
+ * up, short enough that a page that did not go through is still the operator's business. */
+const NOTIFY_CHECK_WINDOW_MS = DAY_MS;
 /** The `notify` check: whether a notify command is configured, and a warning when it failed to
  * page within the last day (a nonzero exit, a kill, or a failed start — the warnings
  * spawnNotifyCommand logs). Warns but never fails, like the hold rows: a dead webhook must not