tumwater 0.4.1 → 0.4.2

package/dist/src/doctor/doctor-opencode-checks.js

@@ -12,7 +12,7 @@ import { escapeRegExp } from "../text/text.js";
 import { failOutcome, okOutcome, warnOutcome } from "./outcome.js";
 import { loadConfigForCheck, opencodeSeamsInUse, seamedModels, } from "./doctor-model-checks.js";
 /** The doctor's opencode credential and leak readiness check, split out of doctor-model-checks.ts
- * (whose shared seam/model framework and the pi, tier-models and image-input checks stay there):
+ * (whose shared seam/model framework and the pi and tier-models checks stay there):
  * checkOpencode and its helpers (opencodeProviderOf, opencodeAuthLists, jsonKeyPresent,
  * opencodeConfigLeaks). This is the doctor's only check that spawns the `opencode` CLI and reads
  * its catalog and the operator's global opencode config — a distinct concern from the
@@ -108,6 +108,80 @@ function opencodeConfigLeaks(configHome) {
         warns.push(`${agentsMd} still loads into team runs`);
     return warns;
 }
+/** A catalog model's price text — "free" when free, the billed-demotion phrase when `billedAt`
+ * is set, else the per-M prices — so opencodeModelRow can name the price without the nested
+ * ternary and its two `?? 0` fallbacks. */
+function opencodePriceText(free, billedAt, inputPerM, outputPerM) {
+    if (free)
+        return "free";
+    if (billedAt !== undefined)
+        return `no longer free (billed ${formatDate(new Date(billedAt))})`;
+    return `$${inputPerM ?? 0}/$${outputPerM ?? 0} per M`;
+}
+/** One opencode catalog model's row: today's per-model body from the cache key through the
+ * dropped-effort warning, returning the catalog note and any warnings, or undefined when the
+ * model is missing from the cache (the caller owns that failure message). `warnings` holds the
+ * billed-at demotion line and the dropped-effort line in today's order. */
+function opencodeModelRow(cache, model, thinking) {
+    const key = opencodeModelKey(model);
+    const entry = cache.models[key];
+    if (entry === undefined)
+        return undefined;
+    const warnings = [];
+    const free = opencodeModelFree(cache, key);
+    if (entry.billedAt !== undefined) {
+        warnings.push(`${model} was free in the catalog but billed once on ${formatDate(new Date(entry.billedAt))} — the budget gate now prices it`);
+    }
+    const window = entry.context !== undefined ? `, ${tokenWindowLabel(entry.context)}` : "";
+    const note = `${model} — ${opencodePriceText(free, entry.billedAt, entry.inputPerM, entry.outputPerM)}${window}`;
+    // A model with no effort list at all supports no thinking level, so a requested level is
+    // dropped just the same as one the list omits.
+    if (thinking !== undefined && thinking !== "" && !entry.efforts?.includes(thinking)) {
+        warnings.push(`${model} has no ${thinking} effort — that thinking level is dropped`);
+    }
+    return { note, warnings };
+}
+/** The team's opencode database and spill directory sizes as one information line (`db …,
+ * spill …`), reading the db, the spill dir and their byte formatting — today's storage tail. */
+function opencodeStorageNote(root) {
+    const db = statOrNull(opencodeDbPath(root));
+    const spillDir = opencodeSpillDir(root);
+    const spill = spillDir !== "" && isDirectory(spillDir) ? treeBytes(spillDir) : null;
+    return `db ${formatBytes(db?.size ?? 0)}${spill !== null ? `, spill ${formatBytes(spill)}` : ", no spill dir"}`;
+}
+/** Walk the opencode-routed model pairs into today's per-model fails, warns and notes: the
+ * catalog-miss failure, the catalog note and its warnings from opencodeModelRow, and the
+ * non-gateway credential probe each provider. Returns the three arrays checkOpencode assembles. */
+async function collectOpencodeModelRows(cache, models, config, pathEnv, timeoutMs) {
+    const fails = [];
+    const warns = [];
+    const notes = [];
+    for (const pair of models) {
+        const model = pair.model;
+        const row = opencodeModelRow(cache, model, pair.thinking);
+        if (row === undefined) {
+            fails.push(`${model} is not in the opencode catalog cache`);
+            continue;
+        }
+        notes.push(row.note);
+        warns.push(...row.warnings);
+        const provider = opencodeProviderOf(model);
+        if (provider !== undefined && !(await opencodeAuthLists(config, provider, pathEnv, timeoutMs))) {
+            warns.push(`${model} is a non-gateway provider opencode does not list a credential for`);
+        }
+    }
+    return { fails, warns, notes };
+}
+/** The check's outcome from the accumulated fails/warns/notes and the storage tail: the joined
+ * base line ("opencode ready — …" when nothing is wrong, else the found lines) and the
+ * fail/warn/ok verdict by severity. */
+function opencodeOutcome(fails, warns, notes, sizeNotes) {
+    const found = [...fails, ...warns];
+    const base = found.length === 0 ? `opencode ready — ${notes.join("; ")}; ${sizeNotes}` : found.join("; ");
+    if (fails.length > 0)
+        return failOutcome(base);
+    return (warns.length > 0 ? warnOutcome : okOutcome)(base);
+}
 /** OpenCode model, credential and leak readiness (plans/opencode-backend.md §7, part 7/7):
  * every model routed to opencode must be in the catalog cache — an unknown model fails, a
  * cached one reads "free" or its per-M prices and context window, and a thinking level with no
@@ -120,57 +194,20 @@ function opencodeConfigLeaks(configHome) {
  * PATH or HOME. A model's freeness is read from opencodeModelFree — the same call the budget
  * gate and status use — so a catalog-free model that an observed bill demoted to billed reads
  * as billed here, not free, keeping the row from drifting from what the team is billed. The
- * version half of the opencode pre-flight is the sibling checkOpencodeVersion in
- * doctor-checks.ts. */
+ * per-model catalog row lives in opencodeModelRow, the database-and-spill size line in
+ * opencodeStorageNote; both are the two extracted jobs the reader names by. The version half of
+ * the opencode pre-flight is the sibling checkOpencodeVersion in doctor-checks.ts. */
 export async function checkOpencode(root, pathEnv = envPath(), home = os.homedir(), xdgConfigHome = process.env.XDG_CONFIG_HOME ?? "", timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
     const config = loadConfigForCheck(root);
     if ("level" in config)
         return config;
     if (!opencodeSeamsInUse(config))
         return okOutcome("no model jobs run on opencode");
-    const models = seamedModels(config, "opencode");
-    const cache = readOpencodeCache(root);
-    const fails = [];
-    const warns = [];
-    const notes = [];
-    for (const pair of models) {
-        const key = opencodeModelKey(pair.model);
-        const entry = cache.models[key];
-        if (entry === undefined) {
-            fails.push(`${pair.model} is not in the opencode catalog cache`);
-            continue;
-        }
-        const free = opencodeModelFree(cache, key);
-        if (entry.billedAt !== undefined) {
-            warns.push(`${pair.model} was free in the catalog but billed once on ${formatDate(new Date(entry.billedAt))} — the budget gate now prices it`);
-        }
-        const price = free
-            ? "free"
-            : entry.billedAt !== undefined
-                ? `no longer free (billed ${formatDate(new Date(entry.billedAt))})`
-                : `$${entry.inputPerM ?? 0}/$${entry.outputPerM ?? 0} per M`;
-        const window = entry.context !== undefined ? `, ${tokenWindowLabel(entry.context)}` : "";
-        notes.push(`${pair.model} — ${price}${window}`);
-        // A model with no effort list at all supports no thinking level, so a requested level is
-        // dropped just the same as one the list omits.
-        if (pair.thinking !== undefined &&
-            pair.thinking !== "" &&
-            !entry.efforts?.includes(pair.thinking)) {
-            warns.push(`${pair.model} has no ${pair.thinking} effort — that thinking level is dropped`);
-        }
-        const provider = opencodeProviderOf(pair.model);
-        if (provider !== undefined && !(await opencodeAuthLists(config, provider, pathEnv, timeoutMs))) {
-            warns.push(`${pair.model} is a non-gateway provider opencode does not list a credential for`);
-        }
-    }
-    warns.push(...opencodeConfigLeaks(xdgConfigHome !== "" ? xdgConfigHome : path.join(home, ".config")));
-    const db = statOrNull(opencodeDbPath(root));
-    const spillDir = opencodeSpillDir(root);
-    const spill = spillDir !== "" && isDirectory(spillDir) ? treeBytes(spillDir) : null;
-    const sizeNotes = `db ${formatBytes(db?.size ?? 0)}${spill !== null ? `, spill ${formatBytes(spill)}` : ", no spill dir"}`;
-    const found = [...fails, ...warns];
-    const base = found.length === 0 ? `opencode ready — ${notes.join("; ")}; ${sizeNotes}` : found.join("; ");
-    if (fails.length > 0)
-        return failOutcome(base);
-    return (warns.length > 0 ? warnOutcome : okOutcome)(base);
+    const rows = await collectOpencodeModelRows(readOpencodeCache(root), seamedModels(config, "opencode"), config, pathEnv, timeoutMs);
+    const warns = [
+        ...rows.warns,
+        ...opencodeConfigLeaks(xdgConfigHome !== "" ? xdgConfigHome : path.join(home, ".config")),
+    ];
+    const sizeNotes = opencodeStorageNote(root);
+    return opencodeOutcome(rows.fails, warns, rows.notes, sizeNotes);
 }

package/dist/src/doctor/doctor-project-checks.js

@@ -267,13 +267,10 @@ export function checkFlakyChecks(root, now = Date.now()) {
     return warnOutcome(phrases.join("; "));
 }
 /** A trailing day of at least `POST_MERGE_REJECT_WARN` post-merge `review_rejected` events — the
- * audit twin of the always-on `post-merge-churn` amber alert (src/ui/alert-feeds.ts
- * `postMergeChurnAlert`). Each rejection is an already-landed commit the reviewer turned back, so
- * it stays on main with the reviewer's reasons, so a churn day must not read as a clean
- * main. Shares the alert's
- * window, threshold and
- * event selection through `postMergeChurn`, so the doctor row and the alert cannot disagree on
- * when churn fires. ok/warn only — a churn burst does not stop the team. */
+ * audit of a day that must not read as a clean main: each rejection is an already-landed commit
+ * the reviewer turned back, so it stays on main with the reviewer's reasons. Reads the
+ * `POST_MERGE_REJECT_WINDOW_MS` window and
+ * threshold through `postMergeChurn`. ok/warn only — a churn burst does not stop the team. */
 export function checkPostMergeChurn(root) {
     const { events } = readEventsSince(root, POST_MERGE_REJECT_WINDOW_MS);
     const churn = postMergeChurn(events);
@@ -284,10 +281,10 @@ export function checkPostMergeChurn(root) {
         .join(", ")}) — each commit had already reached main and stays there with the reviewer's reasons; narrow \`review.afterMerge\` for the noisy role or raise the authoring bar`);
 }
 /** The one home of the doctor's `flaky checks` sentence: names each check that flapped more than
- * once, most frequent first, with how many times it flapped — the same wording the always-on
- * flapped-checks alert carries, so the doctor row and the alert cannot drift. null when `flapped`
+ * once, most frequent first, with how many times it flapped — the one sentence the doctor's
+ * `flaky checks` row shows. null when `flapped`
  * is empty (nothing crossed the bar). */
-export function flappedChecksPhrase(flapped) {
+function flappedChecksPhrase(flapped) {
     if (flapped.length === 0)
         return null;
     const render = ([k, n]) => `"${k}" ×${n}`;
@@ -325,7 +322,7 @@ running = null) {
             : running?.restartPending
                 ? "; auto-restart is under way"
                 : "; run `npm run build` and restart `tumwater start` (auto-restart does this for a running team)";
-        return warnOutcome(`dist/ from ${sha} is stale — main has ${stale.aheadCommits} later commit(s) touching ${STALE_INPUTS_LABEL}${next}`);
+        return warnOutcome(`dist/ from ${sha} is stale — main has ${plural(stale.aheadCommits, "later commit")} touching ${STALE_INPUTS_LABEL}${next}`);
     }
     return okOutcome(`dist/ from ${sha}, matches main`);
 }
@@ -344,7 +341,7 @@ function currentHead(root) {
  * on every merge and the ci role runs on its own clock, so a post-merge gap is normal and must
  * not turn the Health card or the exit code red. A stale verdict that stays stale past
  * `CI_PARITY_STALE_MS` (ciParityStalled) is a stall — the full suite has silently stopped
- * covering new tips — and warns, alongside the standing `ci-stale` alert. Read-only against
+ * covering new tips — and warns. Read-only against
  * .tumwater/. */
 export function checkCiParity(root, config, now = Date.now()) {
     const entry = readCiParity(root);
@@ -360,9 +357,9 @@ export function checkCiParity(root, config, now = Date.now()) {
     }
     // A stale verdict is normal right after a merge (main moves and the ci role runs on its own
     // clock), but one that stays stale past CI_PARITY_STALE_MS is a stall: the full suite has
-    // silently stopped covering new tips. The doctor warn and the standing `ci-stale` alert share
-    // this one predicate (ciParityStalled), so the row and the alert cannot disagree on when a
-    // gap is a problem. Inside the window the existing friendly stale wording stands.
+    // silently stopped covering new tips. This warn is the one place ciParityStalled is applied —
+    // the row is the standing signal. Inside the window the existing friendly stale wording
+    // stands.
     if (ciParityStalled({ state: "stale", lastRunAt: entry.lastRunAt }, now)) {
         return warnOutcome(`stale and stalled — the last run covered ${shortSha(entry.tip)} @ lock ${shortSha(entry.lockHash)} ${age} ago (${entry.result}); main is now ${shortSha(tip)} @ lock ${shortSha(lockHash)} — no full-suite run has covered a tip in over ${CI_PARITY_STALE_MS / DAY_MS} days, so the ci role is disabled, paused, or unable to record`);
     }
@@ -375,8 +372,8 @@ export function checkCiParity(root, config, now = Date.now()) {
  * is not a stall); a fresh ledger reads ok naming the newest exercised flow and its age. A
  * ledger whose newest exercise is older than `QA_COVERAGE_STALE_MS` (qaCoverageStalled) is a
  * `warn` naming that flow and its age — the role is disabled, paused, or unable to record —
- * alongside the standing `qa-stale` alert, both through the one `qaCoverageStalled` predicate
- * so the row and the alert cannot disagree. Read-only against .tumwater/. */
+ * via the one `qaCoverageStalled` predicate, this row the standing signal. Read-only against
+ * .tumwater/. */
 export function checkQaCoverage(root, now = Date.now()) {
     const coverage = readQaCoverage(root);
     const entries = Object.entries(coverage);
@@ -396,3 +393,55 @@ export function checkQaCoverage(root, now = Date.now()) {
     }
     return okOutcome(`newest flow coverage: ${newestFlow} exercised ${age} ago`);
 }
+/** How far back the `main diff rules` row looks — one day, the same 24 h trailing-day convention
+ * every event-reading doctor row uses, so a diff-rule failure the main watch logged stays a
+ * standing warn until a day passes. Owned here (the check that reads it). */
+const MAIN_RULE_FAILURE_WINDOW_MS = 24 * 60 * 60_000;
+/** The exact substring src/baseline/main-watch.ts's `watchRules` logs in its warning, so this
+ * check matches a real rule failure and cannot drift from the wording the watch writes. */
+const MAIN_RULE_FAILURE_MARKER = "fails the diff rules";
+/** The doctor's `main diff rules` row: a `warning` the main watch logged when the review gate's
+ * diff rules rejected main's tip in the trailing day. The gate judges one change; the watch
+ * judges each first-parent commit's own diff, so a conflict marker, a protected edit, a leaked
+ * secret, a phantom fix claim or a broken backlog structure that reached main through a gate
+ * blind spot sits on main with only this event log to say so. Reads only the `warning` event
+ * the watch already writes, so the row cannot drift from the watch's wording; the most recent
+ * hit names the tip and the rule. ok/warn only — it never fails a scripted pre-flight. */
+export function checkMainDiffRules(root) {
+    const { events } = readEventsSince(root, MAIN_RULE_FAILURE_WINDOW_MS);
+    const hits = events.filter((e) => e.type === "warning" && typeof e.message === "string" && e.message.includes(MAIN_RULE_FAILURE_MARKER));
+    if (hits.length === 0)
+        return okOutcome("no diff-rule failure on main in the last day");
+    const latest = hits[hits.length - 1];
+    return warnOutcome(`${plural(hits.length, "diff-rule failure on main", "diff-rule failures on main")} in the last day — most recently ${String(latest.message)} — the gate approved a diff the watch's rules reject; repair the tip or revert it with \`tumwater revert <sha>\``);
+}
+/** The exact prefix src/merge/merge-post-review-drain.ts logs when it drops a post-merge
+ * review at POST_REVIEW_FAILURE_LIMIT. The drain drops in two ways and logs each with its own
+ * tail — "it stays on main unreviewed" after failed runs (the commit never got a review) and
+ * "the fix stays unreviewed" after failed fix merges (the fix ref is deleted, main unmoved) —
+ * so this check matches the shared "dropping the post-merge review of" prefix both share, not
+ * either tail. The drain also files the drop in BUGS.md as best-effort ordinary backlog work
+ * (fileDroppedReview), but a skipped filing (off-base checkout or a dirty BUGS.md) leaves only
+ * this event log standing, so this check matches the drain's own wording. */
+const DROPPED_REVIEW_MARKER = "dropping the post-merge review of";
+/** How far back the `dropped post-merge reviews` row looks — one day, the same 24 h trailing-day
+ * convention every event-reading doctor row uses. Owned here (the check that reads it). */
+const DROPPED_REVIEW_WINDOW_MS = 24 * 60 * 60_000;
+/** The doctor's `dropped post-merge reviews` row: a `warning` the post-merge-review drain
+ * (src/merge/merge-post-review-drain.ts) wrote when it dropped a review at
+ * POST_REVIEW_FAILURE_LIMIT — after failed runs its commit stays on main unreviewed, and
+ * after failed fix merges the fix ref is deleted (main unmoved) so the commit stays
+ * unreviewed; either way the review is gone and no longer in the queue the `post-merge
+ * reviews` row reads. The drain files the dropped review in BUGS.md as best-effort ordinary
+ * backlog work, so when that filing is skipped this row is the standing signal naming the
+ * dropped review. Reads only the `warning` event the drain already writes, so it cannot drift
+ * from the drain's wording; the most recent hit names the commit. ok/warn only — an
+ * unreviewed commit is operator signal, not a broken environment. */
+export function checkDroppedPostMergeReviews(root) {
+    const { events } = readEventsSince(root, DROPPED_REVIEW_WINDOW_MS);
+    const hits = events.filter((e) => e.type === "warning" && typeof e.message === "string" && e.message.includes(DROPPED_REVIEW_MARKER));
+    if (hits.length === 0)
+        return okOutcome("no post-merge review was dropped in the last day");
+    const latest = hits[hits.length - 1];
+    return warnOutcome(`${plural(hits.length, "post-merge review was dropped", "post-merge reviews were dropped")} in the last day — the dropped review is gone and its commit stays unreviewed; most recently ${String(latest.message)}`);
+}

package/dist/src/doctor/doctor-role-notes.js

@@ -1,7 +1,4 @@
-import fs from "node:fs";
-import path from "node:path";
-import { readTextOrNull } from "../files/files.js";
-import { roleNotesPath } from "../paths.js";
+import { readRoleNotesOverCap } from "../status/status-role-notes.js";
 import { ROLE_NOTES_MAX_BYTES } from "../agent/role-notes-write.js";
 import { agree, plural } from "../text/phrases.js";
 import { okOutcome, warnOutcome } from "./outcome.js";
@@ -14,34 +11,19 @@ const ROLE_NOTES_NAMED_CAP = 3;
  * ROLE_NOTES_MAX_BYTES *characters* on read (truncateWithNote's text.length bound), but every
  * operator surface reads the file whole — so a hand edit or old build can leave a note the
  * operator sees and the role never does. This row warns on that gap without touching the file.
+ * The over-cap walk is shared with the status snapshot's collectRoleNotesOverCap
+ * (src/status/status-role-notes.ts), so the row and the status alert cannot disagree about
+ * which notes are over the bound; null means the notes dir is missing or unreadable.
  * Read-only against .tumwater/, like every check. Never throws. */
 export function checkRoleNotes(root) {
-    const notesDir = path.dirname(roleNotesPath(root, "role"));
-    let entries;
-    try {
-        entries = fs.readdirSync(notesDir);
-    }
-    catch {
+    const over = readRoleNotesOverCap(root);
+    if (over === null) {
         // Missing or unreadable notes dir: nothing recorded yet (the write path creates it).
         return okOutcome("no role notes recorded yet");
     }
-    // The bound is the read's own unit — truncateWithNote cuts on text.length (UTF-16
-    // characters), not the write path's Buffer.byteLength, so compare characters too or a
-    // multibyte note the prompt reads in full would false-positive; never statSync().size.
-    const over = [];
-    for (const name of entries) {
-        if (!name.endsWith(".md"))
-            continue;
-        const text = readTextOrNull(path.join(notesDir, name));
-        if (text === null)
-            continue;
-        if (text.length > ROLE_NOTES_MAX_BYTES)
-            over.push({ role: name.slice(0, -3), chars: text.length });
-    }
     if (over.length === 0) {
         return okOutcome(`every role note is within the ${ROLE_NOTES_MAX_BYTES}-character read bound`);
     }
-    over.sort((a, b) => b.chars - a.chars);
     const first = over
         .slice(0, ROLE_NOTES_NAMED_CAP)
         .map((o) => `${o.role} (${o.chars})`)

package/dist/src/doctor/doctor.js

@@ -14,10 +14,10 @@ import { failOutcome } from "./outcome.js";
 import { errorMessage } from "../text/text.js";
 import { checkBackendBinary, checkBrief, checkBootstrap, checkClaudeTranscripts, checkExecPath, checkFunes, checkGitBinary, checkConfigKeyNames, checkInit, checkOpencodeVersion, checkNodeVersion, checkPiExtensions, checkRepo, } from "./doctor-checks.js";
 import { checkPrinciples } from "./doctor-principles.js";
-import { checkBuild, checkBuildCheck, checkCiParity, checkDiskSpace, checkEventLog, checkFlakyChecks, checkPostMergeChurn, checkQaCoverage, checkStateDir, } from "./doctor-project-checks.js";
+import { checkBuild, checkBuildCheck, checkCiParity, checkDiskSpace, checkDroppedPostMergeReviews, checkEventLog, checkFlakyChecks, checkMainDiffRules, checkPostMergeChurn, checkQaCoverage, checkStateDir, } from "./doctor-project-checks.js";
 import { sampleFreeBytes } from "../gates/disk-gate.js";
 import { checkCheckContention, checkLeftoverRoleBranches, checkMergeLock, checkProviderConcurrency, checkProviderContention, checkTumwaterPins, checkWorkInstances, checkWorktreePool, } from "./doctor-contention-checks.js";
-import { checkFeedbackFiling, checkImageInput, checkTierModels } from "./doctor-model-checks.js";
+import { checkFeedbackFiling, checkTierModels } from "./doctor-model-checks.js";
 import { checkFallbackChain, checkFallbackModel } from "./doctor-fallback-checks.js";
 import { checkAnthroApiKey, checkClaudeAuth, checkClaudeVersion } from "./doctor-claude-checks.js";
 import { checkOpencode } from "./doctor-opencode-checks.js";
@@ -25,7 +25,7 @@ import { checkCodexAccount, checkCodexAuth, checkCodexHome, checkCodexLeaks, che
 import { backendQualifiedSelector } from "../config/config-views.js";
 import { seamsInUse } from "../config/config-fallbacks.js";
 import { checkBacklogHeadings, checkFixClaims, checkLiveFinished, checkPlanDependencies, checkStalledEntries, checkStrandedPlans, checkValidationGaps } from "./doctor-backlog-plans.js";
-import { checkRefusedEntries, checkRegressedFixes, checkStaleBugs, checkStaleQuestions, checkWaitingBugs } from "./doctor-backlog-bugs.js";
+import { checkRefusedEntries, checkRegressedFixes, checkStaleBugs, checkStaleQuestions } from "./doctor-backlog-bugs.js";
 import { checkMergeQueueFiles, checkPostReviews, checkStaleQueuedMerges, checkStalePrompts, checkUncommittedBacklog } from "./doctor-backlog.js";
 /** Pre-flight environment check (`tumwater doctor`). The harness's preconditions are
  * scattered across fail-fast checks that each command re-runs on its own (requireReadyRepo in
@@ -61,7 +61,7 @@ export async function runDoctorCheck(run) {
  * just the named checks, in report order; a skipped check is never evaluated, and a named
  * conditional check that returns null leaves no row. A check that throws becomes its own fail
  * row, and every other check still runs. */
-export async function runDoctor(root, pathEnv = envPath(), probe = systemProcessProbe, probeImages = "never", only, diskSample = sampleFreeBytes) {
+export async function runDoctor(root, pathEnv = envPath(), probe = systemProcessProbe, only, diskSample = sampleFreeBytes) {
     // Loaded once for the checks that read config (repo's baseBranch); a broken file stays
     // undefined — checkInit reports it verbatim — so doctor still runs every other check.
     const { config } = loadConfigSafe(root);
@@ -107,7 +107,6 @@ export async function runDoctor(root, pathEnv = envPath(), probe = systemProcess
         { name: "over-cap model", run: () => checkFallbackModel(root, undefined, (orchestratorAlive(root, info) && info?.fallbackDemoted) || null) },
         { name: "fallback chain", run: () => checkFallbackChain(root) },
         { name: "models for each tier", run: () => checkTierModels(root) },
-        { name: "image input", run: () => checkImageInput(root, undefined, undefined, undefined, probeImages, pathEnv) },
         { name: "claude auth", run: () => checkClaudeAuth(root, pathEnv) },
         { name: "claude api key", run: () => checkAnthroApiKey(root, undefined, pathEnv) },
         { name: "claude version", run: () => checkClaudeVersion(root, pathEnv) },
@@ -165,11 +164,12 @@ export async function runDoctor(root, pathEnv = envPath(), probe = systemProcess
         { name: "plan dependencies", run: () => checkPlanDependencies(root) },
         { name: "stale questions", run: () => checkStaleQuestions(root) },
         { name: "stale bugs", run: () => checkStaleBugs(root) },
-        { name: "waiting bugs", run: () => checkWaitingBugs(root) },
         { name: "regressed fixes", run: () => checkRegressedFixes(root) },
         { name: "stale merge-queue entries", run: () => checkStaleQueuedMerges(root, Date.now()) },
         { name: "merge-queue files", run: () => checkMergeQueueFiles(root) },
         { name: "post-merge reviews", run: () => checkPostReviews(root) },
+        { name: "main diff rules", run: () => checkMainDiffRules(root) },
+        { name: "dropped post-merge reviews", run: () => checkDroppedPostMergeReviews(root) },
         { name: "stale prompts", run: () => checkStalePrompts(root, Date.now()) },
         { name: "uncommitted backlog", run: () => checkUncommittedBacklog(root, config) },
         // The running team's own view of its build (staleness and what auto-restart made of it)

package/dist/src/doctor/probe.js

@@ -20,7 +20,7 @@ export const AUTH_CHECK_MAX_OUTPUT_BYTES = 1024 * 1024;
  * spawn closes for git). stderr is ignored rather than piped, since nothing reads it and a
  * full stderr pipe would block the child. `timeoutMs` and `maxOutputBytes` are test seams;
  * production callers pass their own named constants. One home of the shape, shared by the
- * model checks' credential/version probes, the tier-model probes, and the image-input probe —
+ * model checks' credential/version probes, and the tier-model probes —
  * before the split each doctor module carried its own byte-for-byte copy. The credential probes'
  * named budgets (AUTH_CHECK_TIMEOUT_MS, AUTH_CHECK_MAX_OUTPUT_BYTES) live beside it here, so the
  * backend check modules share them without importing them from one another. */

package/dist/src/events/event-format.js

@@ -213,11 +213,9 @@ function runEventMessage(e) {
                 ? "resuming the run cut off at the context ceiling (compacted pi session, same workspace)"
                 : e.cause === "handoff"
                     ? "handing the interrupted run off to a fresh session on another agent (same workspace, uncommitted edits kept)"
-                    : e.cause === "image-reroute"
-                        ? "handing the blind-read run off to a fresh session on an image-capable model (same workspace, uncommitted edits kept)"
-                        : e.cause === "salvaged"
-                            ? "handing the work an earlier run left unsaved to a fresh session"
-                            : "resuming the run a shutdown interrupted (same agent session and workspace)") + restored);
+                    : e.cause === "salvaged"
+                        ? "handing the work an earlier run left unsaved to a fresh session"
+                        : "resuming the run a shutdown interrupted (same agent session and workspace)") + restored);
         }
         case "wake":
             return `woke (${textOr(e.reason)})`;
@@ -238,7 +236,7 @@ function runEventMessage(e) {
             // Priority headroom (part 7/7): a reserve appearing or vanishing is the scheduler working
             // as designed; it names the permits withheld for the work tier so an operator can see why
             // maintenance concurrency dipped.
-            return `${finiteNumber(e.reserve, 0)} permit(s) reserved for work roles that have work to take`;
+            return `${plural(finiteNumber(e.reserve, 0), "permit")} reserved for work roles that have work to take`;
         default: return textOr(e.type);
     }
 }
@@ -616,13 +614,6 @@ function imageRestartEventMessage(e) {
                     : "";
             return `blind image read: ${textOr(e.path)} on ${textOr(e.model, "the model")}${action}`;
         }
-        case "image_reroute":
-            // The run's work moves to a model that can read the image (plans/image-input.md part
-            // 4/5). Routine-with-explanation — no warning prefix: names the hop the way the
-            // handoff reads, and whether the traits-of-attachment preflight avoided a failed run.
-            return e.preflight === true
-                ? `image attachment routed to ${textOr(e.to, "the target")} (${textOr(e.tier, "a peer tier")}) to read its image — no failed run`
-                : `image rerouted to ${textOr(e.to, "the target")} (${textOr(e.tier, "a peer tier")}) — next run goes there after a blind read on ${textOr(e.from, "the prior model")}`;
         case "build_stale":
             // Self-hosting teams only (src/redeploy/redeploy.ts): the code main describes is not the
             // code running. Not a warning prefix — a stale build is a state, and auto-restart resolves
@@ -632,7 +623,7 @@ function imageRestartEventMessage(e) {
             return `restart pending — main ${shortSha(e.head)} is green; finishing current runs (no new runs start)`;
         case "restart": {
             const aborted = finiteNumber(e.abortedRuns, 0);
-            return `restarting onto update ${shortSha(e.to)} (finished current work in ${minutes(e.finishedMs)}m${aborted > 0 ? `, ${aborted} run(s) resume after the restart` : ""})`;
+            return `restarting onto update ${shortSha(e.to)} (finished current work in ${minutes(e.finishedMs)}m${aborted > 0 ? `, ${plural(aborted, "run")} resume after the restart` : ""})`;
         }
         case "restart_refused":
             // The restart is refused, not failed: the running build stays and the gate is re-asked
@@ -798,7 +789,6 @@ export function eventMessage(e) {
         case "orchestrator_start":
         case "orchestrator_stop": return configEventMessage(e);
         case "image_blind":
-        case "image_reroute":
         case "build_stale":
         case "restart_pending":
         case "restart":

package/dist/src/events/event-labels.js

@@ -84,7 +84,6 @@ export const EVENT_TYPE_LABELS = {
     model_fallback_ended: "fallback model ended",
     opencode_free_model_billed: "free model billed",
     image_blind: "image not seen",
-    image_reroute: "image sent to another model",
     build_stale: "update available",
     restart_pending: "update waits for idle",
     restart: "restarted onto update",

package/dist/src/events/event-legacy.js

@@ -34,7 +34,7 @@ const LEGACY_EVENT_TYPES = {
 /** The ordered field rewrites; later parts of the series append here, and they run in order. */
 const LEGACY_EVENT_REWRITES = [
     {
-        // The run number rode `tick` on run_start, run_end, prompt_taken, image_blind, image_reroute.
+        // The run number rode `tick` on run_start, run_end, prompt_taken, image_blind.
         name: "tick-to-run", // retired-name-ok: legacy name
         apply(ev) {
             const e = ev;

package/dist/src/events/event-window.js

@@ -349,7 +349,7 @@ export function eventsSince(root, sinceMs, now, keep = () => true) {
     return readEventsSince(root, sinceMs).events.filter((ev) => keep(ev) && ev.ts >= now - sinceMs);
 }
 /** The `--since` / `?sinceMs=` trailing window's bounds and identity slice, shared by the two
- * trailing-window collectors (`collectReportSince` in report-data.ts and
+ * trailing-window collectors (`collectReportSince` in report-since-data.ts and
  * `collectFailureReportSince` in failure-data.ts): an open-ended window (cutoff = now − sinceMs,
  * end = now) when `untilMs` is absent, else the bounded [now − sinceMs, now − untilMs). Both
  * collectors budget events with the same open/closed comparisons against `cutoff`/`end` (and

package/dist/src/events/events.js

@@ -58,8 +58,21 @@ export function logEvent(root, event) {
     ensureParentDir(file);
     rotateIfLarge(file, EVENTS_MAX_BYTES, EVENTS_KEEP);
     appendEventLine(file, JSON.stringify(full) + "\n");
-    for (const listener of listeners)
-        listener(full);
+    // The event is committed to the log before dispatch, so a subscriber's own failure must not
+    // make the write look like it failed to the caller, starve the other subscribers of this or
+    // any later event, or crash an unwrapped writer (the orchestrator's poll-loop warn site)
+    // for one listener's bug. Each listener is isolated: its throw is surfaced loudly on stderr
+    // (a terminal boundary, so the text is sanitized) and the dispatch moves on. The set is
+    // snapshotted so a listener that unsubscribes itself mid-dispatch cannot skip or double-run
+    // a sibling.
+    for (const listener of [...listeners]) {
+        try {
+            listener(full);
+        }
+        catch (err) {
+            process.stderr.write(`tumwater: event subscriber failed: ${stripTerminalControls(errorMessage(err))}\n`);
+        }
+    }
     return full;
 }
 /** Log a warning event: the harness's "something is off but the loop continues" signal. The