tumwater 0.4.3 → 0.4.4

package/dist/src/config/config-write.js

@@ -392,6 +392,106 @@ export function setRoleModelFields(root, base, fields) {
         return { ok: true, unchanged: true };
     return result;
 }
+/** Unset the top-level key `parsed.key` from the raw file, reverting it to its default or to
+ * absence (a whole-config write). Absent from the file (only a default carries it): nothing to
+ * remove — return the config unchanged so writeConfigMutation skips the write. */
+function unsetTopKey(root, cfg, raw, parsed) {
+    // Absent from the file (only a default carries it): nothing to remove.
+    if (!Object.hasOwn(raw, parsed.key))
+        return { cfg, oldValue: undefined };
+    const oldValue = raw[parsed.key];
+    const record = cfg;
+    const next = without(record, parsed.key);
+    // An unrelated unset is a whole-config write too: keep the file's own roles section.
+    if (parsed.key !== "roles")
+        preserveFileRoles(root, next);
+    return { cfg: next, oldValue };
+}
+/** Unset ONE dotted-map entry (`maxDailyCostUsdPerRole.<role>` / `quietHoursPerRole.<role>`),
+ * preserving its siblings; the `parsed.map` section is dropped when it empties. An absent file
+ * entry is a no-op success that leaves the config unchanged. */
+function unsetMapEntry(root, cfg, raw, parsed) {
+    const rawMap = objectOrEmpty(raw[parsed.map]);
+    if (!Object.hasOwn(rawMap, parsed.role))
+        return { cfg, oldValue: undefined }; // absent file entry: a no-op success
+    const oldValue = rawMap[parsed.role];
+    const record = cfg;
+    const existing = record[parsed.map] ?? {};
+    const next = without(existing, parsed.role);
+    return { cfg: withSectionOrDropped(root, cfg, parsed.map, next), oldValue };
+}
+/** Unset one `model.<tier>`; a string `model` resolves to { default } (modelTierMap), so unsetting
+ * a tier the FILE does not hold is a no-op that leaves the string untouched. The `model` section
+ * is dropped when it empties. */
+function unsetModelTier(root, cfg, raw, parsed) {
+    // A string `model` resolves to { default } (modelTierMap); unsetting a tier the FILE
+    // does not hold is a no-op that leaves the string untouched.
+    const rawTiers = modelTierMap(raw.model);
+    if (!Object.hasOwn(rawTiers, parsed.tier))
+        return { cfg, oldValue: undefined };
+    const oldValue = rawTiers[parsed.tier];
+    const existing = modelTierMap(cfg.model);
+    const next = without(existing, parsed.tier);
+    return { cfg: withSectionOrDropped(root, cfg, "model", next), oldValue };
+}
+/** Unset ONE dotted section field (`backoff.<field>` / `bootstrap.<field>` …), preserving its
+ * siblings; the section is dropped when it empties. Presence is judged against the FILE: a field
+ * only the default carries is a no-op success. */
+function unsetSectionField(root, cfg, raw, parsed) {
+    // Presence is judged against the FILE: a field only the default carries is a no-op
+    // success, and an emptied section leaves the file.
+    const rawSection = objectOrEmpty(raw[parsed.section]);
+    if (!Object.hasOwn(rawSection, parsed.field))
+        return { cfg, oldValue: undefined };
+    const oldValue = rawSection[parsed.field];
+    const record = cfg;
+    const existing = record[parsed.section] ?? {};
+    return { cfg: withSectionOrDropped(root, cfg, parsed.section, without(existing, parsed.field)), oldValue };
+}
+/** Unset ONE `backends.<id>` field (`bin`/`args`/`configDir`); the entry and the `backends`
+ * section are dropped when they empty, so the file never keeps an empty object. Presence is
+ * judged against the FILE, so a field only the default (or the legacy alias's resolved view)
+ * carries is a no-op success. */
+function unsetBackendField(root, cfg, raw, parsed) {
+    // Presence is judged against the FILE, so unsetting a field only the default (or the
+    // legacy alias's resolved view) carries is a no-op success. The entry and the `backends`
+    // section are dropped when they empty, so the file never keeps an empty object.
+    const rawBackends = objectOrEmpty(raw.backends);
+    const rawEntry = objectOrEmpty(rawBackends[parsed.id]);
+    if (!Object.hasOwn(rawEntry, parsed.field))
+        return { cfg, oldValue: undefined }; // absent file field: a no-op success
+    const oldValue = rawEntry[parsed.field];
+    const record = cfg;
+    const backends = { ...record.backends };
+    const entry = { ...(backends[parsed.id] ?? {}) };
+    delete entry[parsed.field];
+    if (Object.keys(entry).length === 0)
+        delete backends[parsed.id];
+    else
+        backends[parsed.id] = entry;
+    return { cfg: withSectionOrDropped(root, cfg, "backends", backends), oldValue };
+}
+/** Unset ONE `roles.<id>` field, based on the FILE's own roles — not the loaded (catalog-merged)
+ * map — so the write must not re-expand the operator's partial section to every built-in. The
+ * entry is dropped when it empties, and the whole `roles` section when it was the last one. */
+function unsetRoleField(cfg, raw, parsed) {
+    const rawRoles = objectOrEmpty(raw.roles);
+    const rawEntry = objectOrEmpty(rawRoles[parsed.id]);
+    if (!Object.hasOwn(rawEntry, parsed.field))
+        return { cfg, oldValue: undefined }; // absent file field: a no-op success
+    const oldValue = rawEntry[parsed.field];
+    // Base the removal on the FILE's own roles, not the loaded (catalog-merged) map: the
+    // write must not re-expand the operator's partial section to every built-in.
+    const record = cfg;
+    const nextEntry = without(rawEntry, parsed.field); // the file's own entry (its field was present, checked above)
+    if (Object.keys(nextEntry).length > 0)
+        return { cfg: { ...cfg, roles: { ...rawRoles, [parsed.id]: nextEntry } }, oldValue };
+    // The entry emptied: drop it, and the whole `roles` section when it was the last one.
+    const nextRoles = without(rawRoles, parsed.id);
+    if (Object.keys(nextRoles).length === 0)
+        return { cfg: without(record, "roles"), oldValue };
+    return { cfg: { ...cfg, roles: nextRoles }, oldValue };
+}
 /** Remove ONE value of tumwater.json from its raw CLI text (`tumwater config unset <key>`):
  * the inverse of setConfigKey. A bare top-level key is deleted (reverting to its default or
  * to absence); a dotted key (`maxDailyCostUsdPerRole.<role>`, `quietHoursPerRole.<role>`,
@@ -427,86 +527,29 @@ export function unsetConfigKey(root, key) {
     let oldValue;
     const result = writeConfigMutation(root, (cfg) => {
         const raw = rawConfigObject(root); // the file's own keys, before defaults fill them in
-        const record = cfg;
-        if (parsed.kind === "top") {
-            // Absent from the file (only a default carries it): nothing to remove.
-            if (!Object.hasOwn(raw, parsed.key))
-                return cfg;
-            oldValue = raw[parsed.key];
-            const next = without(record, parsed.key);
-            // An unrelated unset is a whole-config write too: keep the file's own roles section.
-            if (parsed.key !== "roles")
-                preserveFileRoles(root, next);
-            return next;
-        }
-        if (parsed.kind === "map") {
-            const rawMapCandidate = raw[parsed.map];
-            const rawMap = objectOrEmpty(rawMapCandidate);
-            if (!Object.hasOwn(rawMap, parsed.role))
-                return cfg; // absent file entry: a no-op success
-            oldValue = rawMap[parsed.role];
-            const existing = record[parsed.map] ?? {};
-            const next = without(existing, parsed.role);
-            return withSectionOrDropped(root, cfg, parsed.map, next);
+        let moved;
+        switch (parsed.kind) {
+            case "top":
+                moved = unsetTopKey(root, cfg, raw, parsed);
+                break;
+            case "map":
+                moved = unsetMapEntry(root, cfg, raw, parsed);
+                break;
+            case "tier":
+                moved = unsetModelTier(root, cfg, raw, parsed);
+                break;
+            case "section":
+                moved = unsetSectionField(root, cfg, raw, parsed);
+                break;
+            case "agent":
+                moved = unsetBackendField(root, cfg, raw, parsed);
+                break;
+            case "role":
+                moved = unsetRoleField(cfg, raw, parsed);
+                break;
         }
-        if (parsed.kind === "tier") {
-            // A string `model` resolves to { default } (modelTierMap); unsetting a tier the FILE
-            // does not hold is a no-op that leaves the string untouched.
-            const rawTiers = modelTierMap(raw.model);
-            if (!Object.hasOwn(rawTiers, parsed.tier))
-                return cfg;
-            oldValue = rawTiers[parsed.tier];
-            const existing = modelTierMap(record.model);
-            const next = without(existing, parsed.tier);
-            return withSectionOrDropped(root, cfg, "model", next);
-        }
-        if (parsed.kind === "section") {
-            // Presence is judged against the FILE: a field only the default carries is a no-op
-            // success, and an emptied section leaves the file.
-            const rawSection = objectOrEmpty(raw[parsed.section]);
-            if (!Object.hasOwn(rawSection, parsed.field))
-                return cfg;
-            oldValue = rawSection[parsed.field];
-            const existing = record[parsed.section] ?? {};
-            return withSectionOrDropped(root, cfg, parsed.section, without(existing, parsed.field));
-        }
-        if (parsed.kind === "agent") {
-            // Presence is judged against the FILE, so unsetting a field only the default (or the
-            // legacy alias's resolved view) carries is a no-op success. The entry and the `backends`
-            // section are dropped when they empty, so the file never keeps an empty object.
-            const rawBackends = objectOrEmpty(raw.backends);
-            const rawEntryCandidate = rawBackends[parsed.id];
-            const rawEntry = objectOrEmpty(rawEntryCandidate);
-            if (!Object.hasOwn(rawEntry, parsed.field))
-                return cfg; // absent file field: a no-op success
-            oldValue = rawEntry[parsed.field];
-            const backends = { ...record.backends };
-            const entry = { ...(backends[parsed.id] ?? {}) };
-            delete entry[parsed.field];
-            if (Object.keys(entry).length === 0)
-                delete backends[parsed.id];
-            else
-                backends[parsed.id] = entry;
-            return withSectionOrDropped(root, cfg, "backends", backends);
-        }
-        const rawRolesCandidate = raw.roles;
-        const rawRoles = objectOrEmpty(rawRolesCandidate);
-        const rawEntryCandidate = rawRoles[parsed.id];
-        const rawEntry = objectOrEmpty(rawEntryCandidate);
-        if (!Object.hasOwn(rawEntry, parsed.field))
-            return cfg; // absent file field: a no-op success
-        oldValue = rawEntry[parsed.field];
-        // Base the removal on the FILE's own roles, not the loaded (catalog-merged) map: the
-        // write must not re-expand the operator's partial section to every built-in.
-        const existing = rawEntry; // the file's own entry (its field was present, checked above)
-        const nextEntry = without(existing, parsed.field);
-        if (Object.keys(nextEntry).length > 0)
-            return { ...cfg, roles: { ...rawRoles, [parsed.id]: nextEntry } };
-        // The entry emptied: drop it, and the whole `roles` section when it was the last one.
-        const nextRoles = without(rawRoles, parsed.id);
-        if (Object.keys(nextRoles).length === 0)
-            return without(record, "roles");
-        return { ...cfg, roles: nextRoles };
+        oldValue = moved.oldValue;
+        return moved.cfg;
     });
     if (!result.ok)
         return result;

package/dist/src/config/config.js

@@ -143,15 +143,7 @@ export function defaultConfig() {
         // explicit user instruction from being discarded by a rejected review — has nothing left
         // to exempt. Removing it also closes the path where a director run could merge a mixed
         // doc-plus-config diff unreviewed.
-        // Reviewer as a regular role (part 1/4): the high-volume, low-blast-radius roles — bugfix,
-        // readme, organize, plus clean, dedupe, coverage — are reviewed AFTER they merge, on their
-        // merged commit (src/review/post-merge-review.ts), instead of holding the merge queue for a
-        // reviewer run on their (usually trivial) diff; a rejection keeps the commit on main
-        // with the reviewer's reasons. feature, director, perf, improve and custom roles stay
-        // pre-merge. A
-        // config that omits `review.afterMerge` inherits this, and `"afterMerge": []` opts out (back
-        // to reviewing before merging).
-        review: { enabled: true, exemptPaths: ["*.md", "docs/**"], afterMerge: ["bugfix", "clean", "coverage", "dedupe", "organize", "readme"] },
+        review: { enabled: true, exemptPaths: ["*.md", "docs/**"] },
         customRoles: [],
         roles,
     };

package/dist/src/doctor/doctor-backlog-plans.js

@@ -7,11 +7,10 @@ import { truncate } from "../text/text.js";
 import { donePlans, fixedBugEntries, openBugEntries, plannedPlanEntries } from "../backlog/backlog.js";
 import { entryHold, entryKindLabel, isPlanStalled } from "../backlog/backlog-eligibility.js";
 import { planDependencyProblems } from "../backlog/backlog-parts.js";
-import { BACKLOG_FILES, FINISHED_ARCHIVES, validationGapTag } from "../backlog/backlog-md.js";
-import { statOrNull } from "../files/files.js";
+import { BACKLOG_FILES, validationGapTag } from "../backlog/backlog-md.js";
 import { duplicateHeadings, strandedPlanEntriesFor } from "../backlog/backlog-structure.js";
 import { liveFinishedHistory, liveFinishedRowList } from "../backlog/backlog-archive.js";
-import { fixSymbols, missingSymbolNames, cachedSourceHaystack, unbackedSymbols } from "../verdict/fix-claim.js";
+import { fixSymbols, isCommitRef, missingSymbolNames, cachedSourceHaystack, unbackedSymbols } from "../verdict/fix-claim.js";
 import { okOutcome, warnOutcome } from "./doctor-outcome.js";
 /** The doctor's PLANS.md-structure and fix-claim checks, split out of doctor-backlog.ts: the
  * checks that re-verify BUGS.md's newest Fixed records against the tree (checkFixClaims,
@@ -49,16 +48,18 @@ export function checkFixClaims(root) {
     return warnOutcome(`BUGS.md records "${heading}" as Fixed, but none of the symbols its Fix paragraph names ` +
         `exist on this tree: ${names}${more} — land the fix or keep the bug Open / refresh a stale record`);
 }
-/** The fix-claim rows shared by the doctor's check and the always-on alert: each newest Fixed
+/** The fix-claim rows the doctor's check warns about: each newest Fixed
  * record classified through fixSymbols and unbackedSymbols — the gate's own parsing and
  * existence rules — against ONE cachedSourceHaystack built for the whole scan, keeping a record
  * only when EVERY symbol its Fix paragraph names is absent, and skipping a record that names no
- * symbols (pure-documentation fixes are legitimate). */
+ * symbols (pure-documentation fixes are legitimate). A commit id is a citation, not a symbol:
+ * this synchronous scan cannot ask git whether it exists (the gate does), so a record that cites
+ * only the commit it reviewed names nothing checkable. */
 function classifyFixClaims(records, root) {
     const problems = [];
     let haystack;
     for (const { title, body } of records) {
-        const symbols = fixSymbols(body);
+        const symbols = fixSymbols(body).filter((symbol) => !isCommitRef(symbol));
         if (symbols.length === 0)
             continue;
         haystack ??= cachedSourceHaystack(root);
@@ -71,24 +72,20 @@ function classifyFixClaims(records, root) {
 /** The ONE shared fix-claim scan: the newest Fixed records (bounded to FIX_CLAIMS_CHECKED so
  * pre-convention history never warns forever) as fixedBugEntries reads them — the stat-cached
  * section reader BUGS.md + BUGS-FIXED.md, bodies kept whole — classified through
- * classifyFixClaims. Reading through this same reader (and not a one-off fixedEntriesAt walk) is
- * what keeps the alert and the doctor on the identical problem set; there is only one scan. */
+ * classifyFixClaims. */
 function fixClaimRecords(root) {
     return fixedBugEntries(root).slice(0, FIX_CLAIMS_CHECKED);
 }
-/** The problems the ONE shared fix-claim scan found among the newest Fixed records at `root`
+/** The problems the ONE fix-claim scan found among the newest Fixed records at `root`
  * (empty when BUGS.md is unreadable or every newest Fixed record names at least one live
- * symbol). Feeds the always-on amber alert through the stat-cached fixedBugEntries reader and
- * cachedSourceHaystack, so it stays in step with the doctor and adds no re-read to the 1 Hz TUI
- * and status-poll path. */
+ * symbol). */
 export function fixClaimProblems(root) {
     return classifyFixClaims(fixClaimRecords(root), root);
 }
-/** The validation-gap rows shared by the doctor's check and the always-on alert: each newest
+/** The validation-gap rows the doctor's check warns about: each newest
  * Fixed record classified against the closed `**Validation gap:**` vocabulary through
  * validationGapTag, which is fence-aware — suspects (missing/unrecognized) first, then
- * `unpinned`, so the first row is the one the doctor's message names and the alert's reason
- * picks. */
+ * `unpinned`, so the first row is the one the doctor's message names. */
 function classifyValidationGaps(records) {
     const suspects = [];
     const unpinned = [];
@@ -103,22 +100,13 @@ function classifyValidationGaps(records) {
     }
     return [...suspects, ...unpinned];
 }
-/** The ONE scan the doctor's `validation gaps` check and the always-on alert both hand their
- * rows from: the newest Fixed records (bounded to FIX_CLAIMS_CHECKED so pre-convention history
- * never warns forever) as fixedBugEntries reads them — the stat-cached section reader BUGS.md +
- * BUGS-FIXED.md, bodies kept whole — classified through classifyValidationGaps. Reading both
- * through this same reader (and not the doctor's one-off fixedEntriesAt/fixedSection walk) is
- * what keeps the alert and the doctor on the identical problem set; there is only one scan. */
+/** The ONE scan the doctor's `validation gaps` check hands its rows from: the newest Fixed
+ * records (bounded to FIX_CLAIMS_CHECKED so pre-convention history never warns forever) as
+ * fixedBugEntries reads them — the stat-cached section reader BUGS.md + BUGS-FIXED.md, bodies
+ * kept whole — classified through classifyValidationGaps. */
 function validationGapRecords(root) {
     return fixedBugEntries(root).slice(0, FIX_CLAIMS_CHECKED);
 }
-/** The problems the ONE shared validation-gap scan found among the newest Fixed records at `root`
- * (empty when BUGS.md/BUGS-FIXED.md are unreadable or every newest Fixed record carries a known
- * tag/trace). Feeds the always-on amber alert through the stat-cached fixedBugEntries reader, so
- * it stays in step with the doctor and adds no re-read to the 1 Hz TUI and status-poll path. */
-export function validationGapProblems(root) {
-    return classifyValidationGaps(validationGapRecords(root));
-}
 /** The fixed-record validation-gap twin of checkFixClaims, standing in for plans/repair-traces.md's
  * invariant 2 ("the vocabulary is closed and lives in one place"): the bugfix guidance tells every
  * run to write exactly one `**Validation gap:**` line with a known tag, and `none` rather than no
@@ -136,8 +124,7 @@ export function validationGapProblems(root) {
 export function checkValidationGaps(root) {
     // The doctor's check reads BUGS.md itself so it can return its no-file outcome (a missing
     // BUGS.md — nothing to verify); the classification then runs on the SAME fixedBugEntries
-    // reader the always-on alert feeds from, so the two cannot drift on the problem set. There
-    // is only one scan (validationGapRecords).
+    // reader, so the problem set cannot drift. There is only one scan (validationGapRecords).
     const doc = readBacklogChecked(root, "BUGS.md");
     if (typeof doc !== "string")
         return doc;
@@ -202,22 +189,17 @@ export function checkLiveFinished(root) {
     return warnOutcome(`${liveFinishedRowList(live)} — every run that reads the file pays for them; ` +
         "`tumwater archive` moves them to the archive files and commits them (a starting team does too)");
 }
-/** The always-on `backlog-headings` alert polls this on every observer surface and every
- * observer tick, so the per-file read must be stat-cached: a steady-state poll pays one stat
- * per file, not a full re-read of every BACKLOG_FILES member — the archives grow without bound
- * (PLANS-DONE.md and BUGS-FIXED.md run to MBs), and an uncached read on every poll would copy
- * them wholesale each time, unlike the stat-cached section readers the rest of the poll path
- * uses. cachedByStat serves an unchanged file from cache (dev/ino/mtime/size) and re-reads on
- * a change, so this shares the poll path's freshness contract. The one loop over BACKLOG_FILES
- * that feeds both checkBacklogHeadings and the always-on `backlog-headings` team alert: absent
+/** The one loop over BACKLOG_FILES the doctor's `backlog headings` check scans for duplicated
+ * `## ` titles. The per-file read is stat-cached (backlogHeadingFileCache) so repeated checks
+ * pay one stat per unchanged file rather than re-reading the whole BACKLOG_FILES member — the
+ * archives grow without bound (PLANS-DONE.md and BUGS-FIXED.md run to MBs) — and cachedByStat
+ * serves an unchanged file from cache (dev/ino/mtime/size) and re-reads on a change. Absent
  * files (an early repo) contribute nothing, an existing file that cannot be read adds
  * `${file} (unreadable)` to `rows` (its duplicate headings, if any, are invisible to every
- * reader), and each duplicate `## ` title joins both `duplicates` and, as
- * `${file} "## ${title}"`, `rows` — which therefore keeps BACKLOG_FILES order, the order the
- * doctor's `backlog headings` row lists its messages in. Two public functions share this so
- * they cannot drift on the file set, the unreadable clause, or the headings. */
+ * reader), and each duplicate `## ` title appears as `${file} "## ${title}"` in
+ * `rows` — which therefore keeps BACKLOG_FILES order, the order the doctor's `backlog
+ * headings` row lists its messages in. */
 function scanBacklogHeadings(root) {
-    const duplicates = [];
     const rows = [];
     for (const file of BACKLOG_FILES) {
         const p = path.join(root, file);
@@ -234,63 +216,14 @@ function scanBacklogHeadings(root) {
             continue;
         }
         for (const heading of scan.headings) {
-            duplicates.push({ file, heading });
             rows.push(`${file} "## ${heading}"`);
         }
     }
-    return { duplicates, rows };
+    return rows;
 }
-/** The module-level stat cache backing scanBacklogHeadings, shared by the doctor row and the
- * always-on alert so the poll path never re-reads an unchanged backlog or archive file. */
+/** The module-level stat cache backing scanBacklogHeadings, so a repeated check never re-reads
+ * an unchanged backlog or archive file. */
 const backlogHeadingFileCache = new Map();
-/** The duplicated `## ` headings already on main, exported so the always-on `backlog-headings`
- * team alert (src/ui/team-alert-backlog.ts) renders the same set the doctor's `backlog
- * headings` row warns about. */
-export function duplicatedBacklogHeadings(root) {
-    return scanBacklogHeadings(root).duplicates;
-}
-/** The module-level stat cache backing liveFinishedEntriesFor, keyed by root, so a steady-state
- * status poll pays four stat calls (two live files, two archives) instead of re-parsing the
- * live files and the unbounded archives (PLANS-DONE.md runs to MBs) on every poll. Keyed by a
- * combined stat signature rather than the shared cachedByStat because each row spans FOUR files
- * (a live file, its finished entries, and the archive it empties into), so no single-file
- * stat-keyed cache entry can serve it. */
-const liveFinishedCache = new Map();
-/** The finished-history rows already on main, exported so the always-on `backlog-archive` team
- * alert (src/ui/team-alert-backlog.ts) renders the same set the doctor's `backlog archive`
- * row warns about — stat-gated so a steady-state poll pays four stats, not a full re-parse.
- * The cache key is the stat identity (`dev:ino:mtimeMs:size`, `absent` when the stat is
- * null) of every
- * FINISHED_ARCHIVES live file and archive under `root`, so any write that changes finished
- * history or the archive refreshes the rows on the next call without a process restart. Returns
- * a copy on a hit; on a miss it recomputes via liveFinishedHistory, and returns `[]` (uncached)
- * when that throws, so an unreadable file stays checkLiveFinished's loud signal and never
- * breaks a status poll. checkLiveFinished keeps calling liveFinishedHistory directly and is
- * unchanged. */
-export function liveFinishedEntriesFor(root) {
-    const key = FINISHED_ARCHIVES
-        .flatMap((spec) => [path.join(root, spec.file), path.join(root, spec.archive)])
-        .map((p) => {
-        const st = statOrNull(p);
-        return st ? `${st.dev}:${st.ino}:${st.mtimeMs}:${st.size}` : "absent";
-    })
-        .join("|");
-    const cached = liveFinishedCache.get(root);
-    if (cached?.key === key)
-        return cached.rows.map((r) => ({ ...r }));
-    let rows;
-    try {
-        rows = liveFinishedHistory(root);
-    }
-    catch {
-        liveFinishedCache.delete(root); // Never serve a stale read for an unreadable tree.
-        return []; // Unreadable — checkLiveFinished's signal; a status poll must not throw.
-    }
-    if (liveFinishedCache.size >= 64)
-        liveFinishedCache.clear(); // Safety cap, like backlogHeadingFileCache.
-    liveFinishedCache.set(root, { key, rows });
-    return rows.map((r) => ({ ...r }));
-}
 /** Duplicated `## ` headings already on main (the duplicate-heading half of the backlog-structure
  * check, src/backlog/backlog-structure.ts): a `## Done` a past merge or conflict resolution added
  * twice leaves every later entry after the first section invisible to the section readers, and
@@ -301,7 +234,7 @@ export function liveFinishedEntriesFor(root) {
  * that leaves an existing duplicate alone passes and the duplicate itself needs a deliberate
  * removal edit. */
 export function checkBacklogHeadings(root) {
-    const { rows } = scanBacklogHeadings(root);
+    const rows = scanBacklogHeadings(root);
     if (rows.length === 0)
         return okOutcome("no duplicated ## section headings in the backlog files");
     const [first, ...rest] = rows;

package/dist/src/doctor/doctor-backlog.js

@@ -4,11 +4,11 @@ import path from "node:path";
 import { errorMessage, truncate } from "../text/text.js";
 import { shortSha } from "../text/format.js";
 import { readPostReviews, POST_REVIEW_FAILURE_LIMIT } from "../review/post-merge-review.js";
-import { humanSeconds, secondsSince, HOUR_MS, DAY_MS } from "../text/datetime.js";
+import { humanSeconds, humanSince, HOUR_MS, DAY_MS } from "../text/datetime.js";
 import { eventsSince } from "../events/event-window.js";
 import { finiteNumber } from "../files/json-object.js";
-import { lowerMedian } from "../collections.js";
-import { agree, plural, shortSpanPhrase } from "../text/phrases.js";
+import { distinctOrdered, lowerMedian } from "../collections.js";
+import { agree, plural, trailingDayMedianPhrase } from "../text/phrases.js";
 import { queuedMerges, unreadableMergeQueueFiles } from "../merge/merge-queue.js";
 import { mergeChanges, readMergeMarker } from "../merge/merge-slot.js";
 import { listWideScope, queuedListRows } from "../inbox/inbox.js";
@@ -136,7 +136,7 @@ export function checkStaleQueuedMerges(root, now) {
         }
         return phrase ? { ...out, detail: `${out.detail} · ${phrase}` } : out;
     };
-    const stale = staleQueuedMergeRows(root, now).map((e) => ({ ...e, age: humanSeconds(secondsSince(now - e.waitedMs, now)) }));
+    const stale = staleQueuedMergeRows(root, now).map((e) => ({ ...e, age: humanSince(now - e.waitedMs, now) }));
     const [first, ...rest] = stale;
     if (!first)
         return withWait(okOutcome(`no merge-queue entry has waited more than ${humanSeconds(MERGE_QUEUE_STALE_MS / 1000)} to start`));
@@ -262,7 +262,7 @@ export function checkStalePrompts(root, now) {
     if (!first)
         return okOutcome("no queued prompt has waited more than 1 day for a role to dequeue it");
     const more = andMore(rest, (p) => `${p.role} #${p.position}`);
-    return warnOutcome(`inbox prompt for ${roleLabel(first.role)} #${first.position} has waited ${humanSeconds(secondsSince(first.queuedAtMs, now))} — ` +
+    return warnOutcome(`inbox prompt for ${roleLabel(first.role)} #${first.position} has waited ${humanSince(first.queuedAtMs, now)} — ` +
         "the role is not dequeuing it (paused, disabled, or failing); resume or enable it, or drop the prompt with " +
         `\`tumwater prompt --cancel ${first.position} --role ${first.role}\`${more}`);
 }
@@ -279,7 +279,7 @@ export function mergeWaitPhrase(events) {
         return undefined;
     const median = lowerMedian(waits);
     const longest = Math.max(...waits);
-    return `merges in the last 24h waited ${shortSpanPhrase(median)} median, ${shortSpanPhrase(longest)} longest (${plural(waits.length, "merge")})`;
+    return `merges in the last 24h waited ${trailingDayMedianPhrase(median, longest, "longest", waits.length, "merge")}`;
 }
 /** Discover the tracked backlog/brief files with uncommitted edits in the primary checkout (the
  * shared discovery behind checkUncommittedBacklog and commitUncommittedBacklog). A primary off
@@ -301,7 +301,7 @@ export async function dirtyBacklogFiles(root, config) {
         // An unreadable brief is a doctor finding of its own; it must not abort the uncommitted-backlog
         // check or `--commit-backlog`, so the tracked backlog set is watched without it.
     }
-    const watched = [...new Set([...BACKLOG_FILES, ...(brief ? [brief] : [])])];
+    const watched = distinctOrdered([...BACKLOG_FILES, ...(brief ? [brief] : [])]);
     const out = await gitTry(root, "status", "--porcelain", "--", ...watched);
     if (out === null)
         return { base, primary, watched, dirty: null };
@@ -359,9 +359,9 @@ export async function commitUncommittedBacklog(root, config) {
  * for a BacklogCommitReport, so the three surfaces cannot drift: one `committed <file> on
  * <base>` line per committed file, one `could not commit <file> — commit it by hand` line per
  * failed file, then the skipped sentence when set. `[]` when the report committed nothing,
- * failed nothing, and carried no skip sentence. `tumwater doctor --commit-backlog` (src/cli.ts),
- * the dashboard Health card's Commit backlog (handleCommitBacklog) and the TUI Health tab's
- * Ctrl+A all render from this one source. */
+ * failed nothing, and carried no skip sentence. `tumwater doctor --commit-backlog`
+ * (src/cli/cli-doctor-command.ts), the dashboard Health card's Commit backlog
+ * (handleCommitBacklog) and the TUI Health tab's Ctrl+A all render from this one source. */
 export function backlogCommitLines(report) {
     const lines = [
         ...report.committed.map((file) => `committed ${file} on ${report.base}`),

package/dist/src/doctor/doctor-checks.js

@@ -18,7 +18,7 @@ import { formatBytes } from "../text/format.js";
 import { BRIEF_TEXT_MAX_CHARS, briefFile, promptBlockOf, readBrief } from "../brief/brief.js";
 import { plural } from "../text/phrases.js";
 import { backendsInUse, unregisteredBackendInUse } from "../gates/startup-gates.js";
-import { claudeSeamsInUse, minVersionOutcome, opencodeSeamsInUse, versionFromProbe, piSeamsInUse } from "./doctor-model-checks.js";
+import { claudeSeamsInUse, loadConfigForCheck, minVersionOutcome, opencodeSeamsInUse, versionFromProbe, piSeamsInUse } from "./doctor-model-checks.js";
 import { claudeConfigDir } from "../agent/claude/claude-backend.js";
 import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./doctor-probe.js";
 import { childEnv } from "../process/process.js";
@@ -236,9 +236,9 @@ export function checkBackendBinary(root, pathEnv = envPath()) {
  * (a 1.x binary included) fails naming `brew install opencode`; at or above it reads the
  * version. Stands down when no seam routes to opencode, so a pi-only team spawns no opencode. */
 export async function checkOpencodeVersion(root, pathEnv = envPath(), timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
-    const { config } = loadConfigSafe(root);
-    if (config === undefined)
-        return noConfigOutcome();
+    const config = loadConfigForCheck(root);
+    if ("level" in config)
+        return config;
     if (!opencodeSeamsInUse(config))
         return okOutcome("no model jobs run on opencode");
     const resolved = opencodeBackend.resolveBin(config);

package/dist/src/doctor/doctor-claude-checks.js

@@ -19,6 +19,21 @@ import { claudeSeamsInUse, loadConfigForCheck, versionFromProbe, seamedModels, }
  * seamPairs) come from doctor-model-checks.ts, and the AUTH_CHECK_* probe budgets
  * from doctor-probe.ts, with the shared report contract (CheckOutcome) from
  * doctor-outcome.ts, exactly as the other doctor-* modules share them. */
+/** The config a claude readiness row reads, or the warn outcome a broken `tumwater.json`
+ * earns, or the ok stand-down when no seam routes to claude. The claude rows repeat the same
+ * three-line guard and the same seam stand-down (`loadConfigForCheck` + `claudeSeamsInUse`);
+ * folding them here mirrors codexCheckBase so a change to how doctor guards a claude check
+ * touches one spot instead of three. Each caller still checks the seams it needs — the auth
+ * rows use `claudeSeamsInUse` directly (folded here), the version row goes on to
+ * `seamedModels` for the floors. */
+function claudeCheckBase(root) {
+    const config = loadConfigForCheck(root);
+    if ("level" in config)
+        return config;
+    if (!claudeSeamsInUse(config))
+        return okOutcome("no model jobs run on claude");
+    return config;
+}
 /** One bounded probe of the resolved `claude` binary under the scrubbed run environment a real
  * run gets: resolve the binary through the claude adapter that would spawn it and run `args`
  * with a short deadline. Null when the probe could not run, the child errored, or the deadline
@@ -47,6 +62,13 @@ async function claudeAuthProbe(config, pathEnv, timeoutMs) {
         return null;
     return parseClaudeAuthStatus(result.stdout);
 }
+/** The warn verdict both auth-driven claude rows return when `claude auth status` could not
+ * run or its reply was unreadable — the one home of the wording so checkClaudeAuth and
+ * checkAnthroApiKey cannot drift on the unreadable-probe message. Each caller makes its own
+ * solitary `claudeAuthProbe` call and branches on null through it. */
+function claudeAuthUnreadable() {
+    return warnOutcome("could not check — `claude auth status` did not run or its output was unreadable");
+}
 /** claude credential readiness (plans/agent-backends.md "Every seam, checked"): a claude seam
  * whose login is gone fails every run before it can work, so doctor runs `claude auth status`
  * under the scrubbed run environment and fails when it reports `loggedIn: false`. An ok detail
@@ -55,14 +77,12 @@ async function claudeAuthProbe(config, pathEnv, timeoutMs) {
  * probe that could not run or a reply this cannot read warns rather than guesses. Stands down
  * (ok) when no seam routes to claude, so a pi-only team spawns nothing. */
 export async function checkClaudeAuth(root, pathEnv = envPath(), timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
-    const config = loadConfigForCheck(root);
+    const config = claudeCheckBase(root);
     if ("level" in config)
         return config;
-    if (!claudeSeamsInUse(config))
-        return okOutcome("no model jobs run on claude");
     const auth = await claudeAuthProbe(config, pathEnv, timeoutMs);
     if (auth === null)
-        return warnOutcome("could not check — `claude auth status` did not run or its output was unreadable");
+        return claudeAuthUnreadable();
     if (!auth.loggedIn)
         return failOutcome("claude reports logged in: false — run `claude auth login`");
     const subscription = claudeAuthUsesSubscription(auth);
@@ -80,17 +100,15 @@ export async function checkClaudeAuth(root, pathEnv = envPath(), timeoutMs = AUT
  * an API-key login (then there is no subscription to lose). `env` is injectable so the check
  * stays hermetic; a probe that cannot run warns rather than guesses like checkClaudeAuth. */
 export async function checkAnthroApiKey(root, env = process.env, pathEnv = envPath(), timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
-    const config = loadConfigForCheck(root);
+    const config = claudeCheckBase(root);
     if ("level" in config)
         return config;
-    if (!claudeSeamsInUse(config))
-        return okOutcome("no model jobs run on claude");
     const apiKey = env.ANTHROPIC_API_KEY;
     if (apiKey === undefined || apiKey === "")
         return okOutcome("no ANTHROPIC_API_KEY set");
     const auth = await claudeAuthProbe(config, pathEnv, timeoutMs);
     if (auth === null)
-        return warnOutcome("could not check — `claude auth status` did not run or its output was unreadable");
+        return claudeAuthUnreadable();
     if (!auth.loggedIn || !claudeAuthUsesSubscription(auth))
         return okOutcome("ANTHROPIC_API_KEY is set, but claude reports no claude.ai login");
     return warnOutcome("ANTHROPIC_API_KEY is set while claude reports a claude.ai login — model jobs on claude will bill the API key, not the subscription; unset it or route every anthropic model job on pi explicitly");
@@ -143,7 +161,7 @@ function claudeVersionOutcome(found, floors, clampNote) {
  * The `off`/`minimal` thinking clamp is noted here too, since this check already has the
  * claude seams in hand. Stands down when no seam routes to claude. */
 export async function checkClaudeVersion(root, pathEnv = envPath(), timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
-    const config = loadConfigForCheck(root);
+    const config = claudeCheckBase(root);
     if ("level" in config)
         return config;
     const seams = seamedModels(config, "claude");