tumwater 0.4.2 → 0.4.3

package/dist/src/team/team-polls.js

@@ -1,12 +1,10 @@
-import { errorStorm, errorStormKnob } from "./error-storm.js";
+import { errorStorm, errorStormKnob } from "./team-error-storm.js";
 import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { teamHold, TEAM_OPEN } from "./team-hold.js";
-import { claudeWindowUsedUp, windowReserved } from "../agent/claude/claude-account.js";
+import { claudeWindowUsedUp } from "../agent/claude/claude-account.js";
 import { sortedRoles } from "../failure/failure-cluster.js";
-import { FAILURE_SPREAD_WINDOW_MS, failureSpread } from "./failure-spread.js";
+import { FAILURE_SPREAD_WINDOW_MS, failureSpread } from "./team-failure-spread.js";
 import { groupBy } from "../collections.js";
-import { eventsSince } from "../events/event-window.js";
-import { DAY_MS } from "../text/datetime.js";
 /** The HoldObservation list both team-wide failure polls step their reducer with, gathered
  * from each runner's two episodic fields: lastRateLimit (stamped "rate-limit", carrying the
  * server's retry-after when present) and lastBackendFailure. One copy of that flatMap so the
@@ -37,14 +35,13 @@ function holdObservations(runners) {
  * heldProviders() (until non-null), never bare key presence: a lifted hold must never
  * keep blocking. Events carry the provider when one is configured (an undefined provider
  * — pi's default — omits it, so an unconfigured team's events render exactly as before).
- * `windowTiers` is the budget poll's window move (tier → the pair its work went to), stamped on
- * the subscription window's limited event. `observations` is the per-subscription-backend hold
- * observations (one per backend in use; part 2e passes them), each stamped by the caller from
- * its account via windowObservation — the account's own `claudeWindowReserve`: crossings held
- * like a rejected window (but never the director) log pollClaudeWindowReserve's event instead
- * of the limited one. Returns the new map for the caller to keep. Exported as a unit-test
- * seam, like its sibling polls below. */
-export function pollTeamHold(root, prev, runners, now, observations = [], windowTiers = {}) {
+ * `observations` is the per-subscription-backend hold
+ * observations (one per backend in use), each stamped by the caller from its account via
+ * windowObservation. The gate no longer passes them and no doctor row reads them (Subtract
+ * parts 5u/6 and 5w/6); the seam stays for the unit tests. Returns the new map for the
+ * caller to keep.
+ * Exported as a unit-test seam, like its sibling polls below. */
+export function pollTeamHold(root, prev, runners, now, observations = []) {
     const steps = [...holdObservations(runners), ...observations];
     const byProvider = groupBy(steps, (o) => o.provider);
     const next = new Map();
@@ -73,9 +70,6 @@ export function pollTeamHold(root, prev, runners, now, observations = [], window
                 ...providerFields,
                 windowType: subObs?.windowType,
                 resetsAt: pNext.until,
-                // Where each moved tier's work went (the budget poll's window move); absent when
-                // nothing moved, so a no-fallback team's event is today's.
-                ...(Object.keys(windowTiers).length > 0 ? { tiers: windowTiers } : {}),
             });
         };
         if (pPrev.until !== null && pPrev.kind === "subscription-window" && pPrev.reserve === true &&
@@ -85,7 +79,7 @@ export function pollTeamHold(root, prev, runners, now, observations = [], window
         }
         else if (pPrev.until === null && pNext.until !== null) {
             if (pNext.kind === "subscription-window" && pNext.reserve === true) {
-                // A reserve crossing logs subscription_window_reserved (pollClaudeWindowReserve), not this.
+                // A reserve crossing logs nothing here; the reserve event loop was removed (5u/6).
             }
             else if (pNext.kind === "subscription-window") {
                 limitedEvent();
@@ -143,107 +137,15 @@ export function windowObservation(backend, account, now, reserve) {
         ...(furthest.reserve === true ? { reserve: true } : {}),
     };
 }
-/** A claude usage window is open for at most `seven_day`, so any window still open was logged
- * within this span of the event log. */
-const CLAUDE_WINDOW_LOOKBACK_MS = 7 * DAY_MS;
-/** The `backend:windowType:resetsAt` keys of the still-open windows whose `type` event is already
- * in the event log, so a restart does not re-announce a window that is still open. Keyed by the
- * event's own `backend` (falling back to `"claude"` for an event written before the window
- * events carried one), so two backends' windows of the same type and reset instant keep their
- * own keys. Events without a numeric `resetsAt` cannot name their window and are skipped. */
-export function loggedWindowKeys(root, type, now) {
-    const keys = new Set();
-    for (const e of eventsSince(root, CLAUDE_WINDOW_LOOKBACK_MS, now, (ev) => ev.type === type)) {
-        if (typeof e.windowType === "string" && typeof e.resetsAt === "number" && e.resetsAt > now) {
-            keys.add(`${typeof e.backend === "string" ? e.backend : "claude"}:${e.windowType}:${e.resetsAt}`);
-        }
-    }
-    return keys;
-}
-/** Log each subscription-window event once per window key. The reserve and the warning polls
- * (below) both walk every window of the account and log one event for each that crosses its mark
- * this poll, deduplicated by the `backend:type:resetsAt` key so many polls across one window log
- * once (a later window's crossing is its own key). They differ only in WHICH window marks (the
- * reserve fraction vs the `allowed_warning` status) and the event's payload, so the traversal, the
- * "reset instant already past" skip, the key build, the key dedup, and the returned-set contract
- * live here and each caller supplies the mark-and-payload predicate (`eventFor` returns the event
- * to log, or null to skip that window). The returned set drops keys whose reset instant has passed,
- * and is `logged` itself when nothing was added or dropped. */
-function logWindowEventOnce(root, logged, account, now, backend, eventFor) {
-    if (account?.billing !== "subscription")
-        return logged;
-    let next = null;
-    for (const key of logged) {
-        const suffix = key.slice(key.lastIndexOf(":") + 1);
-        if (suffix !== "" && Number(suffix) <= now)
-            (next ??= new Set(logged)).delete(key);
-    }
-    for (const [type, w] of Object.entries(account.windows)) {
-        const ev = eventFor(type, w);
-        if (ev === null)
-            continue;
-        // A window whose reset instant is in the past (or unreadable) no longer marks a crossing.
-        if (typeof w.resetsAt === "number" && w.resetsAt <= now)
-            continue;
-        // Keyed by this poll's backend (the `backend:windowType:resetsAt` shape loggedWindowKeys
-        // seeds), so a different backend's identical window keeps its own key. The backend rides
-        // the event, stamped here so each caller's event needs no backend of its own.
-        const key = `${backend}:${type}:${w.resetsAt ?? ""}`;
-        if ((next ?? logged).has(key))
-            continue;
-        logEventBestEffort(root, { ...ev, backend });
-        (next ??= new Set(logged)).add(key);
-    }
-    return next ?? logged;
-}
-/** One poll of the reserve crossing: each window at or past its windowReserve fraction (read
- * through `windowReserveFor(config, "claude")`) logs `subscription_window_reserved` once per
- * window key (`backend:type:resetsAt`, kept in `logged`), so several windows crossing in one
- * poll each log their own event. Returns the keys to keep. */
-export function pollClaudeWindowReserve(root, logged, account, now, backend, reserve) {
-    if (reserve === undefined)
-        return logged;
-    return logWindowEventOnce(root, logged, account, now, backend, (type, w) => {
-        const fraction = reserve[type];
-        if (!windowReserved(w, fraction) || typeof w.resetsAt !== "number")
-            return null;
-        return {
-            source: TUMWATER_SOURCE,
-            type: "subscription_window_reserved",
-            windowType: type,
-            utilization: w.utilization,
-            reserve: fraction,
-            resetsAt: w.resetsAt,
-        };
-    });
-}
-/** One poll of the subscription-window warning: each `allowed_warning` window logs
- * `subscription_window_warning` once per window key (`backend:type:resetsAt`, kept in `logged`;
- * carrying the window's utilization when the account reported one), so many polls across one
- * window warn once and several windows warning in one poll each log their own event. Returns
- * the keys to keep. */
-export function pollClaudeWindowWarning(root, logged, account, now, backend) {
-    return logWindowEventOnce(root, logged, account, now, backend, (type, w) => {
-        if (w.status !== "allowed_warning")
-            return null;
-        return {
-            source: TUMWATER_SOURCE,
-            type: "subscription_window_warning",
-            windowType: type,
-            ...(typeof w.utilization === "number" ? { utilization: w.utilization } : {}),
-            ...(typeof w.resetsAt === "number" ? { resetsAt: w.resetsAt } : {}),
-        };
-    });
-}
-/** One poll of the team-wide error-storm warning (src/team/error-storm.ts): gather each runner's
- * current error streak (RunnerState.consecutiveErrors/lastError — the same fields the per-role
- * "consecutive run failures" warning reads, the director's included, since its failures are
- * the team's evidence too), step the pure reducer, and log exactly one warning per episode,
+/** One poll of the team-wide error-storm warning (src/team/team-error-storm.ts): gather each
+ * runner's current error streak (RunnerState.consecutiveErrors/lastError — the same fields the
+ * per-role "consecutive run failures" warning reads, the director's included, since its failures
+ * are the team's evidence too), step the pure reducer, and log exactly one warning per episode,
  * like the per-role warning's once-per-streak-crossing shape: on the quiet→storm crossing,
- * naming the roles, the shared normalized cause, and the config knob when the cause has one
- * (a team timing out together means runTimeoutSeconds does not fit the serving model).
- * Storms clear silently — the members' own recoveries already tell that story — and the
- * reducer's `prev` pass-through keeps a held storm event-free. Returns the new storm for the
+ * naming the roles, the shared normalized cause, and the config knob when the cause has one (a
+ * team timing out together means runTimeoutSeconds does not fit the serving model). Storms clear
+ * silently — the members' own recoveries already tell that story — and the reducer's `prev`
+ * pass-through keeps a held storm event-free. Returns the new storm for the
  * caller to keep. Exported as a unit-test seam, like pollTeamHold above. */
 export function pollErrorStorm(root, prev, runners) {
     const observations = runners.map((r) => ({
@@ -267,15 +169,15 @@ export function pollErrorStorm(root, prev, runners) {
     }
     return next;
 }
-/** One poll of the team-wide wide-shallow storm alarm (src/team/failure-spread.ts): gather each
- * runner's latest provider-failure observations — the same two the team hold reads, the
- * director's included, since its failures are the team's evidence too — step the pure
- * reducer, and log exactly one warning per episode: on the quiet→active crossing (and again
- * when a DIFFERENT kind becomes the episode while one is sounding, the reducer's new-episode
- * rule), naming the failure count, the kind, the window, and the roles behind it. The wiring
- * keys its log off active/kind, not object identity — `recent` moves almost every poll, so
- * unlike the hold's poll there is no prev pass-through to compare. Exported as a unit-test
- * seam, like pollTeamHold above. */
+/** One poll of the team-wide wide-shallow storm alarm (src/team/team-failure-spread.ts): gather
+ * each runner's latest provider-failure observations — the same two the team hold reads, the
+ * director's included, since its failures are the team's evidence too — step the pure reducer,
+ * and log exactly one warning per episode: on the quiet→active crossing (and again when a
+ * DIFFERENT kind becomes the episode while one is sounding, the reducer's new-episode rule),
+ * naming the failure count, the kind, the window, and the roles behind it. The wiring keys its
+ * log off active/kind, not object identity — `recent` moves almost every poll, so unlike the
+ * hold's poll there is no prev pass-through to compare. Exported as a unit-test seam, like
+ * pollTeamHold above. */
 export function pollFailureSpread(root, prev, runners, now) {
     const observations = holdObservations(runners);
     const next = failureSpread(prev, observations, now);

package/dist/src/team/{reclaim.js → team-reclaim.js}

@@ -6,14 +6,14 @@
  * an interrupted run's uncommitted edits survive.
  *
  * The candidate list and the guard that keeps a clean off the primary checkout live here; the
- * in-use half lives in src/git/worktree-use.ts and the hold half in src/gates/disk-gate.ts. */
+ * in-use half lives in src/git/worktree-use.ts and the hold half in src/gates/disk-gates.ts. */
 import path from "node:path";
 import { HOUR_MS } from "../text/datetime.js";
 import { worktreesDir } from "../paths.js";
 import { git, gitTry } from "../git/git-run.js";
 import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { loadRunnerState } from "../runner/runner-state-load.js";
-import { BYTES_PER_GB, sampleFreeBytes } from "../gates/disk-gate.js";
+import { BYTES_PER_GB, sampleFreeBytes } from "../gates/disk-gates.js";
 import { subdirectoryNames } from "../files/files.js";
 import { claimForReclaim, isReclaimInProgress, isWorktreeInUse, readWorktreeUse, releaseReclaim, updateWorktreeUse, } from "../git/worktree-use.js";
 /** Worktree basenames that pressure reclaim never touches: the self-hosting mirrors the
@@ -126,55 +126,85 @@ async function cleanIgnored(dir) {
     const out = await git(dir, "clean", "-fdX");
     return out.split("\n").some((line) => line.startsWith("Removing "));
 }
-/** Clean pressure candidates until free space reaches `reclaimGB`, re-sampling after each, and
- * log exactly one `disk_reclaim` when anything was cleaned. `idle` mode ignores the threshold
- * and walks every candidate once (part 3/4). Returns null when nothing was reclaimed. */
-export async function reclaimPass(root, mode, opts) {
-    const sample = opts.sample ?? sampleFreeBytes;
-    const candidates = opts.candidates ?? reclaimCandidates(root);
-    const startedAt = Date.now();
-    const before = sample(root);
+/** True when a pressure or manual pass should stop: the sampler reports free space at or
+ * above `reclaimGB`. A null sample (sampling failed) is not the floor, so it keeps reclaiming. */
+function pressureFloorReached(free, reclaimGB) {
+    return free !== null && reclaimGB > 0 && free >= reclaimGB * BYTES_PER_GB;
+}
+/** Clean one candidate, treating a guard failure as a skip, not a reason to abort the pass. */
+async function reclaimOneCandidate(root, candidate) {
+    try {
+        return await reclaimWorktree(root, candidate.dir);
+    }
+    catch {
+        // A guard failure (a directory that stopped being a linked worktree) is not a reason to
+        // abort the pass; the remaining candidates are still safe to clean.
+        return false;
+    }
+}
+/** Walk the candidates once, collecting the ones actually cleaned. Idle mode keeps only the
+ * `isIdleExpired` candidates and never re-samples; pressure and manual modes re-sample before
+ * each and stop once the pressure floor is reached. */
+async function collectReclaimed(root, candidates, mode, idleHours, reclaimGB, sample, startedAt) {
     const cleaned = [];
     for (const candidate of candidates) {
         if (mode === "idle") {
-            if (!isIdleExpired(candidate, opts.idleHours ?? 0, startedAt))
+            if (!isIdleExpired(candidate, idleHours, startedAt))
                 continue;
         }
-        else {
-            const free = sample(root);
-            if (free !== null && opts.reclaimGB > 0 && free >= opts.reclaimGB * BYTES_PER_GB)
-                break;
-        }
-        try {
-            if (await reclaimWorktree(root, candidate.dir))
-                cleaned.push(candidate.name);
-        }
-        catch {
-            // A guard failure (a directory that stopped being a linked worktree) is not a reason to
-            // abort the pass; the remaining candidates are still safe to clean.
+        else if (pressureFloorReached(sample(root), reclaimGB)) {
+            break;
         }
+        if (await reclaimOneCandidate(root, candidate))
+            cleaned.push(candidate.name);
     }
-    if (cleaned.length === 0)
-        return null;
-    const after = sample(root);
+    return cleaned;
+}
+/** Freed space as the before/after free-space difference, clamped at zero: another writer can
+ * consume space during the pass, and a negative "freed" would render as nonsense in the event
+ * and the digest. A null sample keeps the zero fallback. */
+function reclaimFreedGB(before, after) {
+    return before !== null && after !== null ? Math.max(0, (after - before) / BYTES_PER_GB) : 0;
+}
+/** The pass result: the cleaned worktrees, the clamped freed and current free figures, and the
+ * pass duration. `freeGB` falls back to whichever sample we have when the other is null. */
+function buildReclaimResult(cleaned, before, after, startedAt) {
     const freeBytes = after ?? before ?? 0;
-    const result = {
+    return {
         worktrees: cleaned,
-        // Clamped: another writer can consume space during the pass, and a negative "freed"
-        // would render as nonsense in the event and the digest.
-        freedGB: before !== null && after !== null ? Math.max(0, (after - before) / BYTES_PER_GB) : 0,
+        freedGB: reclaimFreedGB(before, after),
         freeGB: freeBytes / BYTES_PER_GB,
         durationMs: Date.now() - startedAt,
     };
+}
+/** Log exactly one `disk_reclaim` event with the result's figures. */
+function logReclaim(root, mode, result) {
     logEventBestEffort(root, {
         source: TUMWATER_SOURCE,
         type: "disk_reclaim",
         mode,
-        worktrees: cleaned,
+        worktrees: result.worktrees,
         freedGB: result.freedGB,
         freeGB: result.freeGB,
         durationMs: result.durationMs,
     });
+}
+/** Clean pressure candidates until free space reaches `reclaimGB`, re-sampling after each, and
+ * log exactly one `disk_reclaim` when anything was cleaned. `idle` mode ignores the threshold
+ * and walks every candidate once (part 3/4). Returns null when nothing was reclaimed. */
+export async function reclaimPass(root, mode, opts) {
+    const sample = opts.sample ?? sampleFreeBytes;
+    const candidates = opts.candidates ?? reclaimCandidates(root);
+    const startedAt = Date.now();
+    const before = sample(root);
+    // With no candidates the pass resolves synchronously (no re-sampling or cleaning to await),
+    // so a no-live-team Ctrl+E flashes "nothing to reclaim" within the caller's same turn.
+    const cleaned = candidates.length === 0 ? [] : await collectReclaimed(root, candidates, mode, opts.idleHours ?? 0, opts.reclaimGB, sample, startedAt);
+    if (cleaned.length === 0)
+        return null;
+    const after = sample(root);
+    const result = buildReclaimResult(cleaned, before, after, startedAt);
+    logReclaim(root, mode, result);
     return result;
 }
 /** Dry run: every reclaim candidate with its idle age and what `git clean -ndX` would remove,

package/dist/src/team/team-state.js

@@ -1,7 +1,6 @@
-import fs from "node:fs";
 import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
 import { finiteNumber, stringList } from "../files/json-object.js";
-import { removeQuiet } from "../files/files.js";
+import { removeIfPresent, removeQuiet } from "../files/files.js";
 import { withStateLock } from "../concurrency/lock.js";
 import { collapseWhitespace, truncate } from "../text/text.js";
 import { pausedPath, pausedRolesLockPath, pausedRolesPath, scheduledStopPath } from "../paths.js";
@@ -128,15 +127,11 @@ export function pauseTeam(root, untilMs, reason) {
     return true;
 }
 /** Resume the team by removing its marker (a no-op if absent); returns whether a marker was
- * there to lift, mirroring pauseTeam's changed-state contract. Uses removeQuiet's
+ * there to lift, mirroring pauseTeam's changed-state contract. Uses removeIfPresent's
  * never-throws delete: a marker vanishing between the check and the unlink is success, not a
  * failure worth surfacing from a toggle. */
 export function resumeTeam(root) {
-    const marker = pausedPath(root);
-    if (!fs.existsSync(marker))
-        return false;
-    removeQuiet(marker);
-    return true;
+    return removeIfPresent(pausedPath(root));
 }
 /** Schedule a graceful team stop at `untilMs` (epoch ms): `tumwater stop --in`. Overwrites the
  * marker, so the last write wins. */
@@ -156,11 +151,7 @@ export function scheduledStopAt(root) {
 }
 /** Drop the scheduled stop; returns whether a marker was there (resumeTeam's contract). */
 export function cancelScheduledStop(root) {
-    const marker = scheduledStopPath(root);
-    if (!fs.existsSync(marker))
-        return false;
-    removeQuiet(marker);
-    return true;
+    return removeIfPresent(scheduledStopPath(root));
 }
 /** The roles the operator has individually paused (`tumwater pause --role <id>`): a role in
  * this set starts no new runs — in-flight ones finish, every other role keeps running, the

package/dist/src/text/markdown.js

@@ -22,7 +22,7 @@ export function markdownTable(header, rows, align = []) {
  * the `map((item, i) => `${i + 1}. ${item}`).join("\n")` step, shared by the review prompt's
  * prior objections, its stage-fix findings, and the rejected/revision notes
  * (prompt/gate-notes.ts), `tumwater questions`' open-question list
- * (backlog/question-answer.ts) and `tumwater wake --list`'s wake lines
+ * (backlog/backlog-question-answer.ts) and `tumwater wake --list`'s wake lines
  * (operator/operator-intent.ts `renderWakeList`), so the numbering shape cannot drift between
  * those surfaces (the TUI queued-prompt rows and the merge queue rows number their own
  * lines). `empty` is returned verbatim when `items` is empty

package/dist/src/text/phrases.js

@@ -25,8 +25,9 @@ export const PREFILL_REASON = "it rides into every run's prefill";
  * drift across the four surfaces that show just that first reason: the review gate's returned
  * detail (review.ts), the event feed's one-line reject (event-format.ts), the failure digest's
  * rejection clusters (failure-data.ts), and the error a role's next run records (run-apply.ts).
- * Sites that render the whole reason list, or intentionally omit the fallback (time-spend.ts's
- * first-reason example, review.ts's rejection event `reason`), keep their own handling. */
+ * Sites that render the whole reason list, or intentionally omit the fallback
+ * (failure-time-spend.ts's first-reason example, review.ts's rejection event `reason`), keep
+ * their own handling. */
 export function firstReason(reasons) {
     const first = reasons?.[0];
     return typeof first === "string" ? first : NO_REASONS_GIVEN;
@@ -241,6 +242,21 @@ function withoutLeadingCd(command) {
         rest = rest.replace(LEADING_CD, "");
     return rest.trim() ? rest : command;
 }
+/** The first present candidate string in a tool call's args, or "" when none is a string.
+ * The read order — path, file_path, command, cmd, pattern, url — is the order INV-AE4 pins. */
+function toolCallCandidate(args) {
+    const candidate = args.path ?? args.file_path ?? args.command ?? args.cmd ?? args.pattern ?? args.url;
+    return typeof candidate === "string" ? candidate : "";
+}
+/** How one candidate reads as a detail: a path-like key reduces to its file name, a
+ * command-like key drops a leading `cd`, and any other key shows verbatim. */
+function toolCallDetail(candidate, args) {
+    if (candidate === args.path || candidate === args.file_path)
+        return path.basename(candidate);
+    if (candidate === args.command || candidate === args.cmd)
+        return withoutLeadingCd(candidate);
+    return candidate;
+}
 /** One-line description of a tool call from its name and args — shared by live progress data
  * collection (LiveProgress.lastTool), transcript rendering, and the harness's stalled-tool-call
  * warning (src/pi/pi-stream.ts builds the label src/pi/pi-watchdogs.ts renders). Path-like keys
@@ -248,19 +264,8 @@ function withoutLeadingCd(command) {
  * is dropped from a command, because the run's cwd is implied and the path would use up the
  * 32-character budget. */
 export function describeToolCall(toolName, args) {
-    let detail = "";
-    if (isJsonObject(args)) {
-        const candidate = args.path ?? args.file_path ?? args.command ?? args.cmd ?? args.pattern ?? args.url;
-        if (typeof candidate === "string") {
-            detail =
-                candidate === args.path || candidate === args.file_path
-                    ? path.basename(candidate)
-                    : candidate === args.command || candidate === args.cmd
-                        ? withoutLeadingCd(candidate)
-                        : candidate;
-        }
-    }
-    detail = squash(detail, 32);
+    const raw = isJsonObject(args) ? toolCallDetail(toolCallCandidate(args), args) : "";
+    const detail = squash(raw, 32);
     // An empty name (pi omits toolName on some start events) yields the bare detail — no
     // leading space in front of it.
     return detail ? (toolName ? `${toolName} ${detail}` : detail) : toolName;

package/dist/src/text/text.js

@@ -94,9 +94,9 @@ export function gotSuffix(v) {
  * and its legacy provider, exempt paths, custom-role tasks), pi-event-line.ts's tool-result content
  * test, quiet-hours.ts's per-role window lookup, and inbox-attachments.ts's image-name check, so
  * the blank-means-unset rule cannot drift per call site. Callers where a bare empty string means
- * unset rather than blank text (notify.ts, version.ts, inbox-cancel.ts) keep their own `=== ""`
- * check; typed-string callers (checkStringField's two-branch shape, checkStringArray's blank-index
- * report) spell the trim test inline. */
+ * unset rather than blank text (event-notify.ts, version.ts, inbox-cancel.ts) keep their own
+ * `=== ""` check; typed-string callers (checkStringField's two-branch shape,
+ * checkStringArray's blank-index report) spell the trim test inline. */
 export function isNonBlankString(v) {
     return typeof v === "string" && v.trim() !== "";
 }

package/dist/src/ui/alert-feeds.js

@@ -1,18 +1,13 @@
 import { openQuestionEntries, ageInDays } from "../backlog/backlog.js";
 import { stripEntryStamp } from "../backlog/backlog-structure.js";
-import { questionFilingDate } from "../backlog/question-answer.js";
+import { questionFilingDate } from "../backlog/backlog-question-answer.js";
 import { byDaysThenIndex } from "../collections.js";
-import { eventsSince } from "../events/event-window.js";
 import { STALE_QUESTION_DAYS } from "../doctor/doctor-backlog.js";
-import { regressedFixCandidates, matchedRegressedFixes, regressedFixesPhrase } from "../doctor/doctor-backlog-bugs.js";
 import { planDependencyProblem } from "../doctor/doctor-backlog-plans.js";
-import { checkWaitContention, providerConcurrencyProblems, providerWaitContention, slotWaitContention, smallPoolProblems, staleWorkspacePins, CHECK_WAIT_CHECK_WINDOW_MS, PROVIDER_WAIT_CHECK_WINDOW_MS, SLOT_WAIT_CHECK_WINDOW_MS } from "../doctor/doctor-contention-checks.js";
-import { readSlotsState } from "../git/slots-state.js";
-import { configForStatus } from "../status/status-polls.js";
-import { piModelsPath } from "../pi/pi-models.js";
-import { piSettingsPath, readPiDefaultModel } from "../pi/pi-settings.js";
+import { findOrphans, orphanFailDetail } from "../doctor/doctor-orphans.js";
+import { systemProcessProbe } from "../process/process-table.js";
 /** This module is the alert-feed half of src/ui/status-payload.ts: each always-on team alert's
- * data-sourcing function (capacityContention, …) lives here, a
+ * data-sourcing function lives here, a
  * sibling of the src/ui/team-alert-*.ts builders that turn them into banners. status-payload.ts
  * stays the one status-document builder, importing these feeds and folding each feed's result
  * into the `alerts` field; status-render.ts reads the feeds directly for the TUI. */
@@ -46,70 +41,51 @@ export function staleOpenQuestions(root, now = Date.now()) {
 export function planDependencyAlert(root) {
     return planDependencyProblem(root);
 }
-/** @see CapacityBottleneck */
-export function capacityContention(root, now = Date.now()) {
-    const out = [];
-    /** Resolve one capacity verdict and push a "capacity bottleneck" row when it warns. Shared
-     * by the three capacity checks (workspace, provider, check slots) so the try/catch that keeps
-     * each one from crying wolf on an unreadable event log lives in one place, and the row's
-     * `name`/`detail` shape cannot drift between them. */
-    const maybeWarn = (name, windowMs, keep, resolve) => {
-        try {
-            const verdict = resolve(eventsSince(root, windowMs, now, keep));
-            if (verdict.warn)
-                out.push({ name, detail: verdict.detail });
-        }
-        catch {
-            // A read error skips this row, so the alert never cries wolf on an unreadable log.
-        }
-    };
-    maybeWarn("workspace slots", SLOT_WAIT_CHECK_WINDOW_MS, (ev) => ev.type === "slot_wait", (waits) => slotWaitContention(waits, readSlotsState(root).slots.length));
-    maybeWarn("provider slots", PROVIDER_WAIT_CHECK_WINDOW_MS, (ev) => ev.type === "provider_wait", (waits) => providerWaitContention(waits, configForStatus(root)));
-    maybeWarn("check slots", CHECK_WAIT_CHECK_WINDOW_MS, (e) => e.type === "check_wait", (waits) => checkWaitContention(waits, configForStatus(root)));
-    return out;
+/** The orphan scan's alert shape, given a scan it is handed — the pure feed, so a test stages a
+ * fake probe's scan and gets exactly the row's message without a real host (the shared
+ * findOrphans/orphanFailDetail the doctor row reads, so the two cannot drift). `root` trims this
+ * repo's path from the commands, like the doctor row. */
+export function orphanAlertFromScan(scan, root = "") {
+    if ("error" in scan || scan.orphans.length === 0)
+        return null;
+    const detail = orphanFailDetail(root, scan);
+    return detail === null ? null : { count: scan.orphans.length, detail };
 }
-/** A `maxConcurrentPerProvider` map that cannot do its job — the always-on twin of the doctor's
- * `provider concurrency` row (src/doctor/doctor-contention-checks.ts checkProviderConcurrency):
- * a cap key no seam resolves to (a typo, or a provider the team never runs on), a cap at or
- * above `maxConcurrent` (it never binds), or a keyless seam in a capped team. The `contention`
- * and `provider-hold` alerts fire only once a too-small cap has already parked runs or a storm
- * has struck; this standing alert names the static misconfiguration itself, which the doctor
- * row is the only other surface that otherwise exposes. Reads the same last-known-good config
- * the snapshot uses (configForStatus) and audits it through the row's own
- * providerConcurrencyProblems, so the alert and the row cannot drift on the trigger or the
- * wording; `[]` when no cap is configured or the map is well-formed. */
-export function providerCapProblems(root) {
-    return providerConcurrencyProblems(configForStatus(root), readPiDefaultModel(piSettingsPath(piModelsPath()), root));
+/** Run the doctor's orphan scan and shape it into the standing alert. Async (it does the real
+ * process-table read); the always-on surfaces read it through getOrphanAlert's cache below, so
+ * a status frame never blocks on the host scan. */
+export async function refreshOrphanAlert(root, probe = systemProcessProbe) {
+    return orphanAlertFromScan(await findOrphans(root, probe), root);
 }
-/** The always-on twin of the doctor `parallel instances` row's pool-mismatch clause
- * (doctor-contention-checks.ts smallPoolProblems): an enabled `feature`/`bugfix` running
- * more than one instance while slotCount(config) sits below maxConcurrent — the shared pool
- * is smaller than the run cap, so those instances contend for the same checkouts. Built from
- * the same smallPoolProblems selector the doctor row uses, so the alert and the row cannot
- * drift on the trigger, the role list, or the wording. configForStatus never returns
- * undefined (an unreadable tumwater.json falls back to defaultConfig(), whose pool is the
- * default maxConcurrent + 1 — never below maxConcurrent), so the [] is the only silent
- * outcome. */
-export function instancePoolProblems(root) {
-    return smallPoolProblems(configForStatus(root));
-}
-/** How far back the regressed-fixes alert looks — one day, so a recently Fixed test that failed
- * again is a standing amber alert until a day passes (or the failure is filed). The doctor's
- * own `regressed fixes` row keeps its since-the-fix read; this is the alert's daily trigger, the
- * same trailing day the regressed-fixes alert reads. */
-export const REGRESSED_FIX_WINDOW_MS = 24 * 60 * 60_000;
-/** The always-on twin of the doctor's `regressed fixes` row (src/doctor/doctor-backlog-bugs.ts
- * checkRegressedFixes): the same candidate selection (regressedFixCandidates) and the same
- * failureMentions match (matchedRegressedFixes) and sentence (regressedFixesPhrase), read off the
- * trailing REGRESSED_FIX_WINDOW_MS of events (the doctor, whose window is since each fix, still
- * warns on an older recurrence). An unreadable event log yields none. */
-export function regressedFixesAlert(root, now = Date.now()) {
-    const candidates = regressedFixCandidates(root);
-    const rows = matchedRegressedFixes(candidates, eventsSince(root, REGRESSED_FIX_WINDOW_MS, now));
-    const detail = regressedFixesPhrase(rows);
-    return detail === null ? null : { count: rows.length, detail };
+/** How stale a cached orphan scan may be before the next status read starts a fresh one:
+ * orphan leaks grow over days, so a sixty-second refresh is plenty and keeps the host scan
+ * (one `ps`, plus cwd reads only for the parentless candidates argv did not settle) off the
+ * hot render path. */
+const ORPHAN_ALERT_REFRESH_MS = 60_000;
+let orphanCache = null;
+let orphanLoading = false;
+/** The synchronous orphan feed the always-on surfaces (status-payload, status-render, the TUI)
+ * read each frame: the last scan's value while it is fresher than ORPHAN_ALERT_REFRESH_MS, else a
+ * background refresh is kicked (one at a time) and the previous value — null on the first ever
+ * read — is returned until that scan lands. The refresh runs off the render path, so a slow host
+ * scan never stalls a status frame. Per-process: each long-lived surface (the GUI server, the
+ * TUI) and the CLI each run their own throttled scan against the same doctor rule. */
+export function getOrphanAlert(root, probe = systemProcessProbe, now = Date.now()) {
+    if (orphanCache === null || now - orphanCache.at >= ORPHAN_ALERT_REFRESH_MS) {
+        if (!orphanLoading) {
+            orphanLoading = true;
+            void (async () => {
+                try {
+                    orphanCache = { value: await refreshOrphanAlert(root, probe), at: Date.now() };
+                }
+                catch {
+                    orphanCache = { value: null, at: Date.now() };
+                }
+                finally {
+                    orphanLoading = false;
+                }
+            })();
+        }
+    }
+    return orphanCache === null ? null : orphanCache.value;
 }
-/** Re-export so the always-on alert's stale-pin selector stays in its one home
- * (src/doctor/doctor-contention-checks.ts) while tui.tsx keeps importing every alert feed from
- * this one module. */
-export { staleWorkspacePins };