tumwater 0.4.2 → 0.4.4

package/dist/src/report/report-since-render.js

@@ -0,0 +1,173 @@
+import { compactTokens, usd } from "../text/format.js";
+import { durationLabel } from "../cli/cli-args.js";
+import { boundedWindowLine, sinceWindowLine } from "../text/datetime.js";
+import { SPARSE_WINDOW_NOTE } from "../events/event-window.js";
+import { foldBaseRoles } from "./report-fold.js";
+import { rankedRoleMap, rankedRoleLine, promptTokensLine, pushRankedRoleLine, pushPresentRankedLine, pushProviderCostLines, pushReportSummary, costPerCommitPairsFrom, costPerCommitLine, } from "./report-render.js";
+/** Render a trailing-window totals report as Markdown — the aggregate sibling of the
+ * `logs --since` raw stream ("how much" here, "what exactly" there). Pure function of
+ * SinceReport: no I/O, no clock reads (the window line's local time is rendered from the
+ * collector's captured cutoff, so the printed window matches the aggregated one). */
+export function renderSinceReportMarkdown(data) {
+    const lines = [];
+    pushSinceWindowHeader(lines, data);
+    pushSinceSummary(lines, data);
+    pushSinceRoleLines(lines, data);
+    pushSinceProviderModelLines(lines, data);
+    pushSinceMainRedLines(lines, data);
+    pushSinceFrictionLines(lines, data);
+    pushSinceDeferralLines(lines, data);
+    pushSinceCommitLines(lines, data);
+    pushSinceCostLines(lines, data);
+    pushSinceCoverageLines(lines, data);
+    return lines.join("\n");
+}
+/** The window header: the title, the bounded-or-since window line and the role scope line. */
+function pushSinceWindowHeader(lines, data) {
+    lines.push("# tumwater usage report");
+    lines.push("");
+    lines.push(data.untilMs !== undefined && data.toIso !== undefined
+        ? boundedWindowLine(durationLabel(data.sinceMs), durationLabel(data.untilMs), data.fromIso, data.toIso)
+        : sinceWindowLine(durationLabel(data.sinceMs), data.fromIso));
+    if (data.role !== undefined)
+        lines.push(`role: ${data.role}`);
+    lines.push("");
+}
+/** The shared totals voice (minus features/bugs/filing cells, stated at the tail), gated
+ * to the team report like the day sibling's. */
+function pushSinceSummary(lines, data) {
+    const t = data.totals;
+    // Same totals voice as the day report, minus the features/bugs and filing cells: those tallies
+    // come from day-granular backlog-file dates that cannot subdivide a sub-day window, so the
+    // final line below states the omission instead of showing a day-rounded number.
+    pushReportSummary(lines, t, "", data.role !== undefined);
+    lines.push("");
+}
+/** Runs / tokens / prompt-tokens / cost breakdowns by role. */
+function pushSinceRoleLines(lines, data) {
+    lines.push(rankedRoleLine("Runs by role", rankedRoleMap(data.runsByRole), String));
+    // Same breakdown for token spend: ranked by tokens desc then name asc, zero-token roles
+    // omitted — an all-zero window renders "-" like the other lines. Output tokens are the
+    // resource the budget charges, so this is the line an operator reads to find which role's
+    // prompt loop burned the window's tokens.
+    pushRankedRoleLine(lines, "Tokens by role", rankedRoleMap(data.tokensByRole), compactTokens);
+    // The prompt side of the same breakdown, straight after the output-token line: how many
+    // prompt tokens each role sent and the share of them its backend served from cache — the
+    // input side of the bill an operator cannot see from Tokens by role. Zero-prompt roles are
+    // omitted, and an all-zero window renders "-" like the sibling lines.
+    lines.push(promptTokensLine(rankedRoleMap(data.promptTokensByRole ?? {}), rankedRoleMap(data.cacheReadTokensByRole ?? {})));
+    // Same breakdown for spend: ranked by spend desc then name asc, zero-spend roles omitted —
+    // an all-zero window renders "-" like the runs line.
+    pushRankedRoleLine(lines, "Cost by role", rankedRoleMap(data.costByRole), usd);
+}
+/** The provider cost lines and the per-model line, gated to the team report. */
+function pushSinceProviderModelLines(lines, data) {
+    // The same breakdown per PROVIDER (plans: per-provider spend), gated to the team report
+    // like its day sibling. SinceReport.costByProvider is always present (empty when none), so
+    // the zero-means-absent gate prints no line for a window with no provider spend.
+    if (data.role === undefined) {
+        pushProviderCostLines(lines, () => rankedRoleMap(data.costByProvider), () => rankedRoleMap(data.notionalByProvider));
+        // The same breakdown per MODEL (each run_start's agent-qualified selector — the model a
+        // team mixing providers, per-role overrides and fallbacks actually ran on), gated to the
+        // team report like the provider lines: a model is not a role, so a role-scoped window
+        // omits it. SinceReport.runsByModel is always present, so a window with no modelled
+        // start prints no line (keeping a model-less day's output unchanged), exactly as the
+        // provider lines stay absent when no provider spent.
+        pushPresentRankedLine(lines, "Runs by model", rankedRoleMap(data.runsByModel));
+    }
+}
+/** Main's red time and the test/merge culprits behind it, gated like the day sibling. */
+function pushSinceMainRedLines(lines, data) {
+    // Main's red wall-clock over the window (main's own, not any role's — a role-scoped
+    // collector carries 0, so this never prints for a scoped window). Zero-absent: no line for
+    // a window main was never red.
+    if (data.mainRedMs > 0)
+        lines.push(`**Main red:** ${durationLabel(data.mainRedMs)}`);
+    // The same "what kept main red" detail named by failing test — which tests main's own red
+    // checks named over the window. Team-only like main's red time, so a role-scoped window
+    // omits it; zero-absent: no line when the window's red checks named no test.
+    if (data.role === undefined) {
+        pushPresentRankedLine(lines, "Main red by test", rankedRoleMap(data.mainRedByTest ?? {}));
+        // The same "what kept main red" detail named by merge — the landed merges the watch's
+        // own main_culprit events blamed, mirroring the failing-test line right above. Team-only
+        // like main's red time and zero-absent: no line when the window blamed no merge.
+        pushPresentRankedLine(lines, "Main red by merge", rankedRoleMap(data.mainRedByCulprit ?? {}));
+    }
+}
+/** The review-friction and failed-run breakdowns by role. */
+function pushSinceFrictionLines(lines, data) {
+    // The same breakdown for review friction: rejections per role from review_rejected events;
+    // a window with none renders "-" like the other lines. The post-merge line is the
+    // afterMerge: true subset — rejections that reached an already-merged commit.
+    pushRankedRoleLine(lines, "Rejections by role", rankedRoleMap(data.rejectionsByRole));
+    pushRankedRoleLine(lines, "Post-merge rejections by role", rankedRoleMap(data.postMergeRejectionsByRole));
+    pushRankedRoleLine(lines, "Revisions by role", rankedRoleMap(data.revisionsByRole));
+    pushRankedRoleLine(lines, "Refusals by role", rankedRoleMap(data.refusalsByRole));
+    // The same breakdown for outright failures: error-class run_ends per role under the
+    // digest's OUTCOME_CLASS — the runs that burned agent time and merged nothing without
+    // going through review, which rejections/revisions would miss entirely. A window with
+    // none renders "-" like the other lines.
+    pushRankedRoleLine(lines, "Failed runs by role", rankedRoleMap(data.failedRunsByRole));
+    pushRankedRoleLine(lines, "Image reroutes by role", rankedRoleMap(data.imageReroutesByRole));
+}
+/** Deferred maintenance runs by reason code, gated to the team report. */
+function pushSinceDeferralLines(lines, data) {
+    // Deferred maintenance runs per reason code, the --since twin of the day render's line:
+    // how many due maintenance runs stood down and why (backlog / no-work / plans-full).
+    // Gated to the team report — a reason is not a role, so a role-scoped window omits it.
+    // Zero-means-absent: a window with no deferral prints no line.
+    if (data.role === undefined) {
+        pushPresentRankedLine(lines, "Deferred runs by reason", rankedRoleMap(data.deferredByReason ?? {}));
+    }
+}
+/** Commits by role and the merged/merge-failure split, gated to the team report. */
+function pushSinceCommitLines(lines, data) {
+    // The merged-commits split by base role, matching the day render's unfiltered line: the
+    // window's totals.commits carries the count; this line says which role's commits it was.
+    lines.push(rankedRoleLine("Commits by role", rankedRoleMap(data.commitsByRole), String));
+    // The merged-outcomes split by base role, mirroring the day render's line: which roles'
+    // changes reach main and which bounce off the gate (merge_failed). Gated to the team
+    // report — a role-scoped window omits merge (ROLE_SCOPE_NOTE), so the per-role
+    // attribution would contradict it. Zero-means-absent: the failures line prints only when
+    // some role has one; a merge-free window renders `-` like the other lines.
+    if (data.role === undefined) {
+        lines.push(rankedRoleLine("Merged by role", rankedRoleMap(data.mergedByRole), String));
+        pushPresentRankedLine(lines, "Merge failures by role", rankedRoleMap(data.mergeFailedByRole));
+        // WHY the window's merges failed, from each merge_failed's result code — the day
+        // report's reason twin of the role line above, so an operator can tell a review
+        // rejection (fix the change) from a conflict/block (rebase) from a shutdown abort
+        // (capacity). Ranked the same way (count desc then code asc), reason-free only.
+        pushPresentRankedLine(lines, "Merge failures by reason", rankedRoleMap(data.mergeFailedByReason ?? {}));
+    }
+}
+/** Cost/estimated per commit and the notional Estimated by role lines. */
+function pushSinceCostLines(lines, data) {
+    // Spend per merged commit, the --since twin of the day render's `Cost per commit:` line:
+    // costByRole is keyed by role id (instances not folded, so `feature-2` joins `feature`),
+    // commitsByRole is already base-role keyed. Prints for a spend-free window as `-` and for a
+    // role-scoped window from its scoped maps, matching the day render.
+    lines.push(costPerCommitLine("Cost per commit", costPerCommitPairsFrom(foldBaseRoles(data.costByRole), data.commitsByRole)));
+    // Subscription spend is notional: its own line, only when the window has any — the same
+    // conditional/filtered `usd` form the day render's "Estimated by role" uses.
+    if (data.notionalByRole !== undefined) {
+        pushRankedRoleLine(lines, "Estimated by role", rankedRoleMap(data.notionalByRole), usd);
+        // The day render's `Estimated per commit:` twin, after `Estimated by role`, from the same
+        // notionalByRole source folded to base roles and the base-keyed commitsByRole.
+        lines.push(costPerCommitLine("Estimated per commit", costPerCommitPairsFrom(foldBaseRoles(data.notionalByRole), data.commitsByRole)));
+    }
+}
+/** The trailing blank and the exactly-one coverage/backlog-omission note. */
+function pushSinceCoverageLines(lines, data) {
+    lines.push("");
+    // Exactly one final line, chosen by the collector's coverage proof: either a hedged note
+    // that stays true whenever it prints (the oldest retained event lies inside the window —
+    // whether from rotation or a log born inside the window), or the one-time statement of the
+    // backlog-tally omission. A flat "rotated out" claim would be false for a log that never
+    // had the older events, so the wording names only what is provably the case. A role-scoped
+    // report already states the omission in ROLE_SCOPE_NOTE, so it does not repeat the --days
+    // pointer, which would imply a scoped day report shows the tallies it too omits.
+    if (!data.coversFullWindow)
+        lines.push(SPARSE_WINDOW_NOTE);
+    else if (data.role === undefined)
+        lines.push("backlog tallies (features done / bugs fixed / plans added / bugs filed) need the day report (--days)");
+}

package/dist/src/report/report-usage-fold.js

@@ -10,7 +10,7 @@ import { addTo } from "../collections.js";
 import { isPassingFullCheck, isRedFullCheck } from "../build/build-check-events.js";
 import { eventRole, eventUsage } from "../events/event-read.js";
 import { finiteNumber, nonNegativeNumber } from "../files/json-object.js";
-import { OUTCOME_CLASS } from "../failure/time-spend.js";
+import { OUTCOME_CLASS } from "../failure/failure-time-spend.js";
 import { commitTier } from "../roles/roles.js";
 import { baseRoleOf } from "../roles/runner-ids.js";
 /** Fold one event's `providerCost` map (`Record<provider, {costUsd, notionalCostUsd}>` — the
@@ -139,10 +139,10 @@ function foldRedCheck(target, _ev) {
     // The merge slot's red full-suite checks, for the day report's red-check count.
     target.checkFailures++;
 }
-/** Fold a model_fallback_started: one episode per start event, per role. */
-function foldFallbackStarted(target, ev) {
-    // One episode per start event; durations are not summed (an episode can span the window edge).
-    addTo(target.fallbacksByRole, eventRole(ev), 1);
+/** Fold an image_reroute: one reroute per event, preflight or after a blind read. */
+function foldImageReroute(target, ev) {
+    // One reroute per event, preflight or after a blind read.
+    addTo(target.imageReroutesByRole, eventRole(ev), 1);
 }
 /** Fold a run_deferred: one deferral per event, bucketed by the raw reason code (team-only). */
 function foldDeferred(target, ev) {
@@ -245,7 +245,7 @@ function foldMergeOutcome(target, ev) {
 }
 /** Fold one event into a usage accumulator by dispatching to a per-family builder —
  * foldRunEnd, foldReviewRejected, foldReviewVerdict, foldRevision, foldPassingCheck,
- * foldRedCheck, foldFallbackStarted, foldDeferred, foldMerged,
+ * foldRedCheck, foldImageReroute, foldDeferred, foldMerged,
  * foldRunStarted, foldProviderWait, foldSlotWait, foldCheckWait or foldMergeOutcome — each
  * named for the family it folds, so how a family folds is found by name. The dispatch holds
  * no accumulation of its own. All behavior lives in the builders: run_end events add a run
@@ -269,8 +269,8 @@ export function foldUsageEvent(target, ev) {
         foldPassingCheck(target, ev);
     else if (isRedFullCheck(ev))
         foldRedCheck(target, ev);
-    else if (ev.type === "model_fallback_started")
-        foldFallbackStarted(target, ev);
+    else if (ev.type === "image_reroute")
+        foldImageReroute(target, ev);
     else if (ev.type === "run_deferred")
         foldDeferred(target, ev);
     else if (ev.type === "merged")

package/dist/src/report/report.js

@@ -6,7 +6,8 @@ import { collectReport } from "./report-data.js";
 import { collectReportSince } from "./report-since-data.js";
 import { collectFailureReport, collectFailureReportSince } from "../failure/failure-data.js";
 import { renderFailureMarkdown } from "../failure/failure-render.js";
-import { renderReportMarkdown, renderSinceReportMarkdown } from "./report-render.js";
+import { renderReportMarkdown } from "./report-render.js";
+import { renderSinceReportMarkdown } from "./report-since-render.js";
 import { fail, say, sayJson, sayJsonOrRender } from "../cli/cli-output.js";
 import { followView } from "../cli/follow-view.js";
 import { failRivalShapes, failUntilShorterThanSince, flagValue, parseCountFlag, parseRoleListScope, parseSinceFlag } from "../cli/cli-args.js";
@@ -26,31 +27,47 @@ export async function cmdReport(root, args, seams = {}) {
     // digest, whose day and --since collectors take the same optional list of base roles.
     const role = parseRoleListScope(root, args);
     const follow = hasFollowFlag(args);
+    failOnFollowJson(follow, args);
+    if (ms !== null) {
+        sinceReportShape(root, args, ms, role, untilMs, follow);
+        return;
+    }
+    await dayReportShape(root, args, reportDays(args), role, follow, seams);
+}
+/** `-f/--follow` with `--json` is refused before either shape dispatches: the live view
+ * repaints a document, `--json` prints one — drop one of them. */
+function failOnFollowJson(follow, args) {
     if (follow && args.includes("--json"))
         fail("report --json prints one document; -f/--follow repaints a live view — drop one of them");
-    if (ms !== null) {
-        // --days is still a rival shape: it counts whole local days, while --since totals a trailing
-        // window. --failures is not a rival anymore — the digest has a windowed-since collector that
-        // reuses the day digest's own sections, so `report --failures --since <d>` dispatches it
-        // through the existing --json / render choice; --until bounds its window's end.
-        if (follow)
-            failRivalShapes("report --since", "-f/--follow", 'follow means "from now on"; --since shows a bounded past window');
-        if (args.includes("--days"))
-            failRivalShapes("report --since", "--days", "--days counts whole local days; --since totals a trailing window");
-        if (args.includes("--failures")) {
-            const digest = collectFailureReportSince(root, ms, role ?? undefined, untilMs ?? undefined);
-            if (args.includes("--json"))
-                sayJson(digest);
-            else
-                say(renderFailureMarkdown(digest));
-            return;
-        }
-        // --json swaps the renderer for the collector's own payload, exactly as status --json
-        // does: bounds and cap checks above are shared, only the printing differs.
-        const since = collectReportSince(root, ms, role ?? undefined, untilMs ?? undefined);
-        sayJsonOrRender(args, since, renderSinceReportMarkdown);
+}
+/** The `--since`/`--until` trailing-window shape: its rival-shape guards against
+ * `-f/--follow` and `--days`, then the `--failures` digest or the plain totals, both through
+ * the `--json` / render choice. Fatal on any rival flag; returns only after printing. */
+function sinceReportShape(root, args, ms, role, untilMs, follow) {
+    // --days is still a rival shape: it counts whole local days, while --since totals a trailing
+    // window. --failures is not a rival anymore — the digest has a windowed-since collector that
+    // reuses the day digest's own sections, so `report --failures --since <d>` dispatches it
+    // through the existing --json / render choice; --until bounds its window's end.
+    if (follow)
+        failRivalShapes("report --since", "-f/--follow", 'follow means "from now on"; --since shows a bounded past window');
+    if (args.includes("--days"))
+        failRivalShapes("report --since", "--days", "--days counts whole local days; --since totals a trailing window");
+    if (args.includes("--failures")) {
+        const digest = collectFailureReportSince(root, ms, role ?? undefined, untilMs ?? undefined);
+        if (args.includes("--json"))
+            sayJson(digest);
+        else
+            say(renderFailureMarkdown(digest));
         return;
     }
+    // --json swaps the renderer for the collector's own payload, exactly as status --json
+    // does: bounds and cap checks above are shared, only the printing differs.
+    const since = collectReportSince(root, ms, role ?? undefined, untilMs ?? undefined);
+    sayJsonOrRender(args, since, renderSinceReportMarkdown);
+}
+/** The `--days` parse: the explicit flag's value checked against REPORT_MAX_DAYS, or the
+ * default series length when absent. Fatal on a value past the shared bound. */
+function reportDays(args) {
     const daysRaw = flagValue(args, "--days");
     let days = REPORT_DEFAULT_DAYS;
     if (daysRaw !== null) {
@@ -61,6 +78,13 @@ export async function cmdReport(root, args, seams = {}) {
         // rejected 0, non-decimals, and a missing value.
         days = parseCountFlag("--days", daysRaw, REPORT_MAX_DAYS);
     }
+    return days;
+}
+/** The whole-day report shape: the `-f/--follow` live repaint, the `--failures --json`
+ * digest, the plain `--json` payload, or the day Markdown/failure-digest render. Fatal on a
+ * `follow && --json` clash (already refused by cmdReport's failOnFollowJson); returns only
+ * after printing. */
+async function dayReportShape(root, args, days, role, follow, seams) {
     // --failures --json prints the collector's own payload (the FailureReportData object), the
     // report --json and doctor --json precedent: the time-and-spend fold gave the digest a
     // stable data shape, so the machine-readable form is the data itself, not a re-parse of the

package/dist/src/review/diff-rules.js

@@ -1,17 +1,23 @@
-/** The review gate's five deterministic diff rules, in the gate's own order and scope — the one
- * call site both the gate (review.ts) and the main watch (main-watch.ts) use, so a finding reads
- * the same on a changed tree and on main's tip. `baseRev` is a commit or branch name the async
+/** The deterministic diff rules the review gate and the main watch share, each run in its own
+ * `scope` and order — the one call site both the gate (review.ts) and the main watch
+ * (main-watch.ts) use, so a finding reads the same on a changed tree and on main's tip.
+ * `baseRev` is a commit or branch name the async
  * rules resolve with changeBaseRev (merge-base of HEAD and it), so the watch passes a commit
- * while the gate passes the main branch. Runs conflictMarkerReason, then protectedEditReason,
- * then secretLeakReason, then — only for an exempt (md-only) diff — falseFixReason, then
- * backlogStructureReason for every diff, short-circuiting on the first finding exactly as the
- * original gate did: a later rule never runs once an earlier one already rejects. Returns a
- * one-reason array when a rule fires (the reason the gate rejects on and the watch reports) and
- * `[]` when nothing is wrong. An empty `role` (the watch cannot name the tip's merging role) is
- * no basis for calling a PRINCIPLES.md edit unauthorized, so the role-dependent half of the
- * protected-edit rule is skipped — but its role-independent half, the brief-block rule
- * (briefEditReason), still runs, so a brief edit on an unattributed head is still reported; the
- * gate always passes a known role, so its rejections are unchanged.
+ * while the gate passes the main branch. The final `scope` argument picks which set runs and in
+ * what order: `"watch"` runs all five — conflictMarkerReason, then protectedEditReason, then
+ * secretLeakReason, then — only for an exempt (md-only) diff — falseFixReason, then
+ * backlogStructureReason for every diff — while `"gate"` (the pre-merge gate) runs only the
+ * three a later commit cannot repair: briefEditReason, protectedEditReason, then
+ * secretLeakReason. A conflict marker, a false fix claim and a broken backlog structure can all
+ * be repaired by a later commit, so they stop refusing a diff pre-merge and the main watch
+ * reports them on main's tip instead. Both scopes short-circuit on their first finding exactly
+ * as the original gate did: a later rule never runs once an earlier one already rejects.
+ * Returns a one-reason array when a rule fires (the reason the gate rejects on and the watch
+ * reports) and `[]` when nothing is wrong. An empty `role` (the watch cannot name the tip's
+ * merging role) is no basis for calling a PRINCIPLES.md edit unauthorized, so the
+ * role-dependent half of the protected-edit rule is skipped — but its role-independent half,
+ * the brief-block rule (briefEditReason), still runs, so a brief edit on an unattributed head
+ * is still reported; the gate always passes a known role, so its rejections are unchanged.
  *
  * This module lives apart from review-precheck.ts so the main watch can share the rules without a
  * runtime import cycle: review-precheck.ts imports src/baseline/main-watch.ts
@@ -25,10 +31,16 @@ import { briefEditReason, protectedEditReason } from "./protected-edits.js";
 import { secretLeakReason } from "./secret-leaks.js";
 import { falseFixReason } from "../verdict/fix-claim.js";
 import { backlogStructureReason } from "../backlog/backlog-structure.js";
-export async function diffRuleReasons(wt, baseRev, files, role, exempt) {
-    const marker = conflictMarkerReason(wt, files);
-    if (marker !== undefined)
-        return [marker];
+export async function diffRuleReasons(wt, baseRev, files, role, exempt, scope) {
+    // The gate scope rejects only the three findings a later commit cannot repair (a brief-block
+    // edit, a protected edit, a leaked credential); the watch scope runs the full set, because a
+    // conflict marker, a false fix claim and a broken backlog structure are all repairable and so
+    // bare waiting for the main watch to report them on main's tip.
+    if (scope === "watch") {
+        const marker = conflictMarkerReason(wt, files);
+        if (marker !== undefined)
+            return [marker];
+    }
     // The brief-block rule is role-independent — its edit is forbidden for every role alike — so it
     // runs even when the watch cannot name the tip's merging role (role === ""). Only the
     // PRINCIPLES.md half of protectedEditReason needs a known role to condemn an edit.
@@ -41,13 +53,15 @@ export async function diffRuleReasons(wt, baseRev, files, role, exempt) {
     const secretReason = await secretLeakReason(wt, baseRev, files);
     if (secretReason !== undefined)
         return [secretReason];
-    if (exempt) {
+    if (scope === "watch" && exempt) {
         const falseFix = await falseFixReason(wt, baseRev, files);
         if (falseFix)
             return [falseFix];
     }
-    const structure = await backlogStructureReason(wt, baseRev, files);
-    if (structure)
-        return [structure];
+    if (scope === "watch") {
+        const structure = await backlogStructureReason(wt, baseRev, files);
+        if (structure)
+            return [structure];
+    }
     return [];
 }

package/dist/src/review/post-merge-review-render.js

@@ -33,7 +33,9 @@ export function postReviewState(entry) {
 export const POST_REVIEW_STATES = ["waiting", "failing", "rejected", "fixed"];
 /** The bracketed status suffix one post-merge review entry carries on every observer surface
  * (`tumwater reviews`, the dashboard's Post-merge reviews card, and the TUI Pending pane's
- * review block): the reviewer's recorded rejected reasons when `rejected` is set; else the
+ * review block): the reviewer's recorded rejected reasons when `rejected` is set — or just
+ * `[rejected]` when the recorded list is empty, so a rejection with no reasons never renders
+ * a dangling `rejected — `; else the
  * number of verdict-less review runs when `failures` is positive, naming the
  * last failure's reason beside the count when `lastFailure` is a non-empty string; else `""`.
  * Reasons are squashed to 60 as `tumwater reviews` has always printed them, and the failure
@@ -44,8 +46,12 @@ export function postReviewStatusLabel(entry) {
     switch (postReviewState(entry)) {
         case "fixed":
             return `[fixed — the repair ${shortSha(entry.fixed)} already merged on main]`;
-        case "rejected":
-            return `[rejected — ${entry.rejected.map((r) => squash(r, 60)).join("; ")}]`;
+        case "rejected": {
+            const reasons = entry.rejected; // postReviewState only says "rejected" when rejected is an array
+            return reasons.length === 0
+                ? "[rejected]"
+                : `[rejected — ${reasons.map((r) => squash(r, 60)).join("; ")}]`;
+        }
         case "failing": {
             const failures = entry.failures; // postReviewState only says "failing" when failures > 0
             if (typeof entry.lastFailure === "string" && entry.lastFailure.length > 0) {

package/dist/src/review/post-merge-review.js

@@ -1,7 +1,8 @@
 import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
+import { cachedByStat } from "../files/stat-cache.js";
 import { compareCodeUnits } from "../collections.js";
 import { postReviewPath, postReviewWorktreePath, nativeLogPath, piLogPath, reviewRunSessionDir, reviewFixRef } from "../paths.js";
-import { reviewedAfterMerge, reviewRunConfig } from "../config/config-views.js";
+import { reviewRunConfig } from "../config/config-views.js";
 import { logEventBestEffort, TUMWATER_SOURCE, tryOrWarn } from "../events/events.js";
 import { isJsonObject } from "../files/json-object.js";
 import { git, gitCouldNotStart, gitTry } from "../git/git-run.js";
@@ -11,9 +12,10 @@ import { useWorktree } from "../git/worktree-use.js";
 import { readPrinciples } from "../prompt/principles.js";
 import { buildReviewPrompt } from "../prompt/gate-prompts.js";
 import { shortSha } from "../text/format.js";
+import { DAY_MS } from "../text/datetime.js";
 import { errorMessage } from "../text/text.js";
 import { revisionRoundOf } from "../git/commit-message.js";
-import { REVISION_BACKSTOP } from "../runner/revision.js";
+import { REVISION_BACKSTOP } from "../runner/runner-revision.js";
 import { eventRole } from "../events/event-read.js";
 import { baseRoleOf } from "../roles/runner-ids.js";
 import { fixLine } from "../verdict/reply-contract.js";
@@ -23,19 +25,18 @@ export const POST_REVIEW_FAILURE_LIMIT = 3;
 /** The bar a day's post-merge rejections must reach before the doctor's `post-merge churn` row
  * fires: one post-merge rejection is the tiering's ordinary cost,
  * two in a day is a role whose already-landed changes keep being turned back — the
- * reviewer-fix signal for an operator to narrow `review.afterMerge` or raise the
- * authoring bar. */
+ * reviewer-fix signal for an operator to raise the authoring bar. */
 export const POST_MERGE_REJECT_WARN = 2;
 /** How far back the post-merge-churn rule looks — one day, the 24 h event-window convention
  * every event-reading doctor row uses. */
-export const POST_MERGE_REJECT_WINDOW_MS = 24 * 60 * 60_000;
+export const POST_MERGE_REJECT_WINDOW_MS = DAY_MS;
 /** Group the `afterMerge: true` `review_rejected` events of `events` by base role — the same
  * `e.type === "review_rejected" && e.afterMerge === true` test the report fold
  * (src/report/report-fold.ts `postMergeRejectionsByRole`) applies, so the churn row and the
  * report cannot disagree on which rejections are post-merge. The key is the event's base role
  * (`baseRoleOf(eventRole(ev))`), not the raw source: an event's `source` is the runner id
- * (`bugfix-2`), and both the row's remedy ("narrow `review.afterMerge`") and the scoped
- * report are keyed by base role, so one base role's churn must read as one row. Pre-merge
+ * (`bugfix-2`), and both the row's remedy and the scoped report are keyed by base role, so
+ * one base role's churn must read as one row. Pre-merge
  * rejections and other event types contribute nothing. */
 export function postMergeRejectionCounts(events) {
     const byRole = new Map();
@@ -60,44 +61,50 @@ export function postMergeChurn(events) {
     const count = roles.reduce((n, r) => n + r.count, 0);
     return count >= POST_MERGE_REJECT_WARN ? { count, roles } : null;
 }
-/** Whether `role`'s changes are reviewed after merging instead of before. One home for the
- * membership test, config-views.ts's reviewedAfterMerge — the same predicate the review gate,
- * the runner's `already_queued` recovery arm and the role view read. */
-export function isAfterMergeRole(config, role) {
-    return reviewedAfterMerge(config, role);
-}
+// One stat-cached read of the review queue, keyed by the queue file (merge-queue.ts's readEntry
+// caches its single JSON file the same way): the dashboard's /api/status poll asks this every
+// second, and the file only changes when a merge settles its review — an unchanged file costs
+// one stat per poll instead of a whole-file read plus a JSON.parse on every request. Any write
+// (addPostReview/settlePostReview's tmp+rename) lands a fresh inode and mtime/size, so the same
+// dev/ino/mtime/size check invalidates it exactly like the other polled files; each caller gets
+// a deep-enough copy (the entry objects and their `rejected` arrays) so treating a read result
+// as one's own cannot poison a later poll.
 /** The queued entries. A torn or hand-edited entry (not an object with a string commit, role and
  * summary, or a `rejected` that is not an array — a non-string `lastFailure` is dropped like the
  * other fields) is dropped, and the next write leaves it out. */
+const postReviewCache = new Map();
 export function readPostReviews(root) {
-    const saved = readJsonFile(postReviewPath(root));
-    if (!Array.isArray(saved?.pending))
-        return [];
-    const entries = [];
-    for (const raw of saved.pending) {
-        if (!isJsonObject(raw))
-            continue;
-        const { commit, role, summary, body, failures, lastFailure, rejected, enqueuedAt, fixed } = raw;
-        if (typeof commit !== "string" || typeof role !== "string" || typeof summary !== "string")
-            continue;
-        if (rejected !== undefined && !Array.isArray(rejected))
-            continue;
-        const entry = { commit, role, summary };
-        if (typeof body === "string")
-            entry.body = body;
-        if (typeof failures === "number" && Number.isFinite(failures))
-            entry.failures = failures;
-        if (typeof lastFailure === "string")
-            entry.lastFailure = lastFailure;
-        if (Array.isArray(rejected))
-            entry.rejected = rejected.filter((r) => typeof r === "string");
-        if (typeof fixed === "string")
-            entry.fixed = fixed;
-        if (typeof enqueuedAt === "number" && Number.isFinite(enqueuedAt) && enqueuedAt >= 0)
-            entry.enqueuedAt = enqueuedAt;
-        entries.push(entry);
-    }
-    return entries;
+    const file = postReviewPath(root);
+    return (cachedByStat(postReviewCache, file, file, () => {
+        const saved = readJsonFile(file);
+        if (!Array.isArray(saved?.pending))
+            return [];
+        const entries = [];
+        for (const raw of saved.pending) {
+            if (!isJsonObject(raw))
+                continue;
+            const { commit, role, summary, body, failures, lastFailure, rejected, enqueuedAt, fixed } = raw;
+            if (typeof commit !== "string" || typeof role !== "string" || typeof summary !== "string")
+                continue;
+            if (rejected !== undefined && !Array.isArray(rejected))
+                continue;
+            const entry = { commit, role, summary };
+            if (typeof body === "string")
+                entry.body = body;
+            if (typeof failures === "number" && Number.isFinite(failures))
+                entry.failures = failures;
+            if (typeof lastFailure === "string")
+                entry.lastFailure = lastFailure;
+            if (Array.isArray(rejected))
+                entry.rejected = rejected.filter((r) => typeof r === "string");
+            if (typeof fixed === "string")
+                entry.fixed = fixed;
+            if (typeof enqueuedAt === "number" && Number.isFinite(enqueuedAt) && enqueuedAt >= 0)
+                entry.enqueuedAt = enqueuedAt;
+            entries.push(entry);
+        }
+        return entries;
+    }, (entries) => entries.map((e) => ({ ...e, ...(e.rejected !== undefined ? { rejected: [...e.rejected] } : {}) }))) ?? []);
 }
 function writePostReviews(root, pending) {
     tryOrWarn(root, TUMWATER_SOURCE, "write post-review.json", () => writeJsonAtomic(postReviewPath(root), { pending }));

package/dist/src/review/review-precheck.js

@@ -7,7 +7,7 @@
 import { warnEventBestEffort } from "../events/events.js";
 import { BUILD_CHECK_TIMEOUT_MS } from "../build/build-check-detect.js";
 import { runScopedBuildCheck } from "../build/build-check-scoped.js";
-import { checkFailureReasons, describeCheck, failureHeadline, FAILING_TESTS_MAX } from "../build/build-check-report.js";
+import { checkFailureReasons, FAILING_TESTS_MAX, redCheckHeadline } from "../build/build-check-report.js";
 import { sleptPhrase, UNVERIFIED_TREE, unverifiedTreeOutcome } from "../build/build-check-events.js";
 import { sampleSleepClock } from "../build/host-sleep.js";
 import { recordReview } from "../run/run-apply.js";
@@ -56,8 +56,18 @@ export async function gateBuildPrecheck(ctx, state, head, reject) {
     // The gate's one check invocation — the pre-check and its one flake re-run below are the
     // same run in the same scope, worktree, and config with the same resolved timeout, so the
     // scope and timeout resolution live here once and cannot drift between the two calls.
-    const runGateCheck = () => runScopedBuildCheck(root, role, "gate", wt, config, ctx.buildCheckTimeoutMs ?? BUILD_CHECK_TIMEOUT_MS, ctx.sampleSleep ?? sampleSleepClock, undefined, checkWaitStage(root, [role]));
+    const runGateCheck = () => runScopedBuildCheck(root, role, "gate", wt, config, ctx.buildCheckTimeoutMs ?? BUILD_CHECK_TIMEOUT_MS, ctx.sampleSleep ?? sampleSleepClock, undefined, checkWaitStage(root, [role]), undefined, ctx.signal);
     const preCheck = await runGateCheck();
+    // A check the harness stopped on the verify's abort (a user abort or a shutdown) is not the
+    // tree's verdict and not a flake: fail closed as aborted before the re-run, the quarantine
+    // and the attribution — the signal fires MID-check (runScriptGroup returns an `aborted`
+    // skip), and `reviewPinnedChange` settles the verify `aborted` on this result so an abort
+    // never has to wait a parked check out. A signal already aborted before the check started is
+    // caught by the `aborted` checks in the attribution path below (the check ran and reached
+    // its own verdict), so the pre-existing shutdown case keeps its two attempts.
+    if (preCheck?.outcome.skipReason === "aborted") {
+        return { resolved: { decision: "failed", aborted: true } };
+    }
     if (preCheck) {
         const { check } = preCheck;
         let { outcome } = preCheck;
@@ -81,7 +91,7 @@ export async function gateBuildPrecheck(ctx, state, head, reject) {
                     warnEventBestEffort(root, role, sleptPhrase("gate check", outcome.run.sleptMs, "then passed on retry"));
                 }
                 else {
-                    const flaky = failureHeadline(outcome.outputTail) ?? describeCheck(check);
+                    const flaky = redCheckHeadline(check, outcome.outputTail);
                     warnEventBestEffort(root, role, `${FLAKY_WARNING_PREFIX}${flaky}`);
                     // Each test the failed run named failed and then passed on this same tree: quarantined.
                     quarantineTests(root, outcome.failingTests, outcome.outputTail);
@@ -112,7 +122,7 @@ export async function gateBuildPrecheck(ctx, state, head, reject) {
             // instead of ending the merge attempt as review_error and paying a requeue. It carries no
             // verifiedHead — the tree was not verified — so the merge
             // path's own check still judges the tree before it reaches main.
-            const flaky = failureHeadline(outcome.outputTail) ?? describeCheck(check);
+            const flaky = redCheckHeadline(check, outcome.outputTail);
             // A failure that names only tests main already fails is main's, not this change's: it goes
             // on to review with no fresh run on main. No verifiedHead — the tree did not pass, so the
             // merge path must not seed a green for it — and the merge check judges it by the same rule.