tumwater 0.4.4 → 0.4.5

package/README.md

@@ -42,7 +42,7 @@ and is also outside `npm test`.
 ## Status
 
 <!-- tumwater:status:start -->
-**v0.4.4**: working tumwater. The director and 15 of the 17 roles are enabled by default; `selfcheck`,
+**v0.4.5**: working tumwater. The director and 15 of the 17 roles are enabled by default; `selfcheck`,
 which files tumwater bugs from tumwater's own event log, and `feedback`, which files them as GitHub
 issues on znation/tumwater, are opt-in (`roles.selfcheck.enabled`, `roles.feedback.enabled`).
 

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "sha": "1f6978ed5d8061b12afc907b017f0164426f49ee",
-  "builtAt": 1793345933702,
+  "sha": "6440aaa1705f2accb491fa2155a5da6aadee05d8",
+  "builtAt": 1793604373395,
   "root": "/home/runner/work/tumwater/tumwater"
 }

package/dist/src/agent/agent-run.js

@@ -122,6 +122,7 @@ export function runAgent(opts) {
                 extendOnProgress: opts.kind === "gate",
                 kill: () => terminateChild(child),
                 onStallWarning: opts.onStallWarning,
+                onUnansweredReply: opts.onUnansweredReply,
             });
             let aborted = false;
             // A blind image read on an authoring run deliberately kills it, like the watchdogs do.

package/dist/src/agent/opencode/write-guard-plugin/index.js

@@ -4,20 +4,23 @@
  *
  * OpenCode 2.x has no hook that blocks a tool from running. It has a permission `evaluate` hook
  * that may turn a decision to `deny` with a `message`, which reaches the model as the tool's error
- * while the run goes on. Every file-writing tool asks for the `edit` action with the absolute
- * paths it writes as `resources`, and the hook runs under `--auto` too, since `--auto` only
- * answers what would otherwise be asked. Checked live on opencode 2.1.0 on 2026-10-23. A
- * configured plugin path must be a directory, which is why this is `index.js` in a directory of
- * its own.
+ * while the run goes on. The file-writing tools ask for the `edit` action (edit in place) and the
+ * `write` action (create or overwrite a file — a new path a `../` climb can point outside the
+ * checkout) with the absolute paths they write as `resources`, and the hook runs under `--auto`
+ * too, since `--auto` only answers what would otherwise be asked. Checked live on opencode 2.1.0
+ * on 2026-10-23. A configured plugin path must be a directory, which is why this is `index.js` in
+ * a directory of its own.
  *
  * The plugin's context names the run's directory (`location.directory`, the worktree OpenCode
  * runs in), which is the run directory the rule reads its checkout from. A failure of its own
  * leaves the decision alone, so a broken guard cannot stop every edit of a run. */
 import { strayWriteRefusal } from "../../write-guard.js";
-/** Deny an `edit` decision whose resources include a stray path from a run in `runDir`, naming
- * the first such path's refusal. Every other decision is left as it is. Exported for tests. */
+/** Deny an `edit` or `write` decision whose resources include a stray path from a run in
+ * `runDir`, naming the first such path's refusal. Every other decision is left as it is. Exported
+ * for tests. */
+const FILE_WRITE_ACTIONS = new Set(["edit", "write"]);
 export function guardEvaluate(event, runDir) {
-    if (event.action !== "edit" || !Array.isArray(event.resources))
+    if (!FILE_WRITE_ACTIONS.has(event.action) || !Array.isArray(event.resources))
         return;
     for (const resource of event.resources) {
         if (typeof resource !== "string" || resource === "")

package/dist/src/agent/subscription-account.js

@@ -3,7 +3,8 @@
  * "Billing" and §8 "The subscription usage window"). Persisted at
  * `.tumwater/state/<backend>-account.json` (plan design grounds/codex-backend.md "Groundwork:
  * the subscription account is per backend", item 1), written only by the orchestrator process,
- * so the sibling parts read one answer instead of re-deriving it per surface.
+ * so the free-ness rule and the window displays read one answer instead of re-deriving it per
+ * surface.
  *
  * The file is a cache, never a source of truth: a run that reports billing overwrites it, and a
  * missing or unreadable file reads as "no subscription". `resetsAt` is stored as epoch
@@ -14,6 +15,7 @@
  * keeps today's shape. */
 import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
 import { finiteNumber, isJsonObject, setOwn } from "../files/json-object.js";
+import { cachedByStat } from "../files/stat-cache.js";
 import { accountPath } from "../paths.js";
 /** True when a failed run ended on a subscription usage window the account reported as
  * `rejected` without overage — the signal the team hold throttles on (plans/agent-backends.md
@@ -27,12 +29,74 @@ export function subscriptionWindowRejected(run) {
         run.billing === "subscription" &&
         (run.rateWindows ?? []).some((w) => w.status === "rejected" && w.isUsingOverage !== true));
 }
+/** Status severity for ordering: a rejected window limits, an allowed_warning nears its limit,
+ * every other reading (allowed/ok) rides at the bottom, and a reset one no longer limits. */
+const WINDOW_RANK = { rejected: 3, allowed_warning: 2, reset: 0 };
+/** The window type as a compact label: `five_hour` → `5h`, `seven_day` → `7d`; an unknown
+ * type falls back to its words with underscores as spaces. The one home of the window spelling
+ * the status badge and the role view share (the browser dashboard keeps its inline copy). */
+export function windowLabel(type) {
+    const m = /^(\w+)_(hour|day|week)$/.exec(type);
+    if (!m)
+        return type.replace(/_/g, " ");
+    const words = { one: "1", two: "2", three: "3", four: "4", five: "5", six: "6", seven: "7", eight: "8", nine: "9", ten: "10" };
+    const unit = m[2] === "hour" ? "h" : m[2] === "day" ? "d" : "w";
+    const word = m[1] ?? "";
+    return `${words[word] ?? word}${unit}`;
+}
+/** The fraction of a subscription usage window consumed (0–1) as a whole-number percent: a
+ * `0.64` utilization reads `64`. The one node-side home of the fraction→percent conversion
+ * (the browser dashboard's own window line is embedded client-side and keeps its inline copy). */
+export function utilizationPct(utilization) {
+    return Math.round(utilization * 100);
+}
+/** Order two window entries by the windowEntries rule: status severity, then the reported
+ * utilization (a missing reading sorts below any number), then the earlier reset, then the
+ * type name. Exported so a list of per-backend blocks can be ordered by their primary entry
+ * the same way windowEntries orders one account's windows (part 3a/9). */
+export function compareWindowEntries(a, b) {
+    const rank = (WINDOW_RANK[b.status] ?? 1) - (WINDOW_RANK[a.status] ?? 1);
+    if (rank !== 0)
+        return rank;
+    const util = (b.utilization ?? -1) - (a.utilization ?? -1);
+    if (util !== 0)
+        return util;
+    const reset = (a.resetsAt ?? Number.POSITIVE_INFINITY) - (b.resetsAt ?? Number.POSITIVE_INFINITY);
+    if (reset !== 0)
+        return reset;
+    return a.type.localeCompare(b.type);
+}
+/** The account's windows as a list, most constrained first (by compareWindowEntries). Empty
+ * when the account reported none. */
+export function windowEntries(account) {
+    return Object.entries(account.windows)
+        .map(([type, w]) => ({ type, ...w }))
+        .sort((a, b) => compareWindowEntries(a, b));
+}
+/** The parsed raw body of one backend's account file, keyed by that file's own stat — the same
+ * stat-keyed contract cachedByStat gives every observer that polls a slowly-changing file. The
+ * account file is written only by the orchestrator on a run's billing/window report, so it
+ * changes no faster than runs; on the status snapshot path readAccount ran per backend per poll
+ * as one more readJsonFile (read + parse) alongside the already stat-cached marker reads, and
+ * budget-gates/role-view read it on other polling surfaces. Writes go through writeJsonAtomic's
+ * tmp+rename (writeAccount), which bumps dev/ino/mtime/size, so a refresh invalidates like any
+ * edit. The `now`-dependent heal is NOT cached: only the raw body is, and readAccount reapplies
+ * its window/observedAt rules against each call's own `now` on a per-call copy, so a window
+ * whose `resetsAt` lapses still reads back as reset on the very call it does. Bounded inside
+ * cachedByStat. */
+const accountBodyCache = new Map();
+/** Serve `file`'s parsed raw JSON-object body from accountBodyCache: null when the file is
+ * missing, unreadable, torn, or not a plain object — the same no-data policy as readJsonFile —
+ * and a fresh per-call copy so readAccount's owns the object it reads fields off. Never throws. */
+function readAccountBody(file) {
+    return cachedByStat(accountBodyCache, file, file, () => readJsonFile(file), (body) => ({ ...body }));
+}
 /** Read the persisted account state for a backend, or null when it is absent or unreadable. A
  * file without a usable top-level `observedAt` reads as absent (the plan's torn-file rule),
  * and a window whose `resetsAt` is at or before `now` reads back with `status: "reset"` — the
  * reader, not every consumer, decides that the window no longer limits. */
 export function readAccount(root, backend, now = Date.now()) {
-    const doc = readJsonFile(accountPath(root, backend));
+    const doc = readAccountBody(accountPath(root, backend));
     if (doc === null)
         return null;
     const billing = doc.billing === "subscription" || doc.billing === "api" ? (doc.billing) : undefined;
@@ -64,7 +128,8 @@ function readWindow(value, fileObservedAt, now) {
     const resetsAt = finiteNumber(value.resetsAt, Number.NaN);
     const resets = Number.isFinite(resetsAt);
     // utilization heals like the two stamps above: JSON's `1e999` parses to Infinity, and a
-    // non-finite fraction would poison any consumer's utilization read.
+    // non-finite fraction would render as `Infinity%` in the badges and poison the
+    // windowEntries comparator (Infinity - Infinity is NaN).
     const utilization = finiteNumber(value.utilization, undefined);
     const reset = resets && resetsAt <= now;
     const window = {

package/dist/src/agent/write-guard.js

@@ -27,25 +27,62 @@ function isWithin(p, dir) {
     const rel = path.relative(dir, p);
     return rel === "" || (rel !== ".." && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel));
 }
-/** `p` with its longest existing prefix resolved through realpath, so a symlink, a `/tmp` that is
- * `/private/tmp`, or a path typed in the wrong case on a case-insensitive disk compares as the
- * file it reaches. The part that does not exist yet (a file a write would create) is appended
- * unchanged. */
+/** `p` with its symlinks resolved as the file it reaches: each component is peeled and a
+ * symlink is followed to its target, so a symlinked checkout or a `/tmp` that is `/private/tmp`
+ * compares as the path it reaches. The not-yet-existing tail (a file a write would create) is
+ * appended unchanged. A broken symlink — target absent, the write/create case, where
+ * `realpathSync` throws ENOENT and the old longest-existing-prefix walk read the link as its
+ * own location inside the checkout — is followed to its target instead: the write would follow
+ * it, so the guard must see where it points. */
 function realish(p) {
-    let existing = p;
-    const rest = [];
-    for (;;) {
+    // Peel the path component by component, exactly as `realpath` does: a regular component is
+    // kept, a symlink is replaced by the components its target resolves to, and the first absent
+    // component ends the walk, so a not-yet-existing tail is appended unchanged. Replacing the
+    // link with its target — instead of keeping the link's own path — is what catches a broken
+    // symlink: its target is absent (the write/create case, where `realpathSync` throws ENOENT
+    // and the old longest-existing-prefix walk read the link as its location inside the
+    // checkout), yet the write would still follow it, so the guard must see where it points. A
+    // depth bound stops a symlink cycle (a → b → a) from looping instead of escaping through the
+    // tail.
+    let q = path.resolve(p).split(path.sep).filter(Boolean);
+    const out = [];
+    let depth = 0;
+    while (q.length > 0) {
+        const part = q[0]; // the loop's length check guarantees a first component
+        const here = path.join(path.sep, ...out, part);
+        let st;
         try {
-            return path.join(fs.realpathSync.native(existing), ...rest);
+            st = fs.lstatSync(here);
         }
         catch {
-            const parent = path.dirname(existing);
-            if (parent === existing)
-                return p;
-            rest.unshift(path.basename(existing));
-            existing = parent;
+            out.push(part, ...q.slice(1)); // absent: this and the rest are the not-yet-existing tail
+            break;
+        }
+        if (!st.isSymbolicLink()) {
+            out.push(part);
+            q = q.slice(1);
+        }
+        else if (depth++ > 100) {
+            out.push(part, ...q.slice(1)); // cycle: give up rather than loop
+            break;
+        }
+        else {
+            let raw;
+            try {
+                raw = fs.readlinkSync(here); // a relative target is relative to the link's dir
+            }
+            catch {
+                out.push(part, ...q.slice(1)); // unreadable: treat as the not-yet-existing tail
+                break;
+            }
+            // The target, absolute-resolved, becomes the whole remaining path to peel: the link's
+            // own directory is dropped and replaced by wherever the link points.
+            const target = path.isAbsolute(raw) ? raw : path.resolve(path.join(path.sep, ...out), raw);
+            q = [...target.split(path.sep).filter(Boolean), ...q.slice(1)];
+            out.length = 0;
         }
     }
+    return path.join(path.sep, ...out);
 }
 /** A tool's path argument as pi's tools resolve it (pi `resolveToCwd`): a leading `@` dropped,
  * `~` expanded to the home directory, and a relative path taken from `base`. */

package/dist/src/backlog/backlog-eligibility.js

@@ -53,8 +53,11 @@ export function needsReviewNote(body) {
  * which the plan role clears by splitting or replanning (role-catalog.ts `plan` find). False
  * for the bugfix role's wait-for-the-next-failure note ("by bugfix: …"), which parks the
  * entry for selfcheck to lift when the cluster fails again (selfcheck step 4) and which no
- * role can act on until then. entryHold returns "needs-review" for every such note (all of
- * them park the entry), so the doctor's `stalled entries` row (checkStalledEntries) — the
+ * role can act on until then, and for the director's user fallback ("by director: …", the
+ * director-request handoff's final park) — the director has already reviewed the entry and the
+ * park names what the user must decide, so it is not plan-role work either. entryHold returns
+ * "needs-review" for every such note (all of them park the entry), so the doctor's `stalled
+ * entries` row (checkStalledEntries) — the
  * stalled-with-the-plan-role surface — classifies by this agreed subset, keeping the bugfix
  * parks out of the plan-role blame. Reads the note's text after the NEEDS_REVIEW_PREFIX once,
  * so the row cannot disagree on which notes the plan role clears; the eligibility mark
@@ -63,8 +66,9 @@ export function isPlanStalled(entry) {
     const note = needsReviewNote(entry.body);
     if (note === null)
         return false;
-    // A "by bugfix:" note is a wait for evidence that selfcheck clears, not plan-role work.
-    return !note.includes("by bugfix");
+    // A "by bugfix:" note is a wait for evidence that selfcheck clears, and a "by director:"
+    // note is the director's reviewed user fallback (INV-B8) — neither is plan-role work.
+    return !note.includes("by bugfix") && !note.includes("by director");
 }
 /** `lines` without any line starting with `prefix` (the same line-prefix rule hasNoteLine
  * applies). When a dropped note sat between two blank lines, the blank line after it goes too,

package/dist/src/backlog/backlog-index.js

@@ -15,7 +15,7 @@ import { collapseWhitespace, truncate } from "../text/text.js";
 import { actionableEntryRanges, groupBlockedSeries, partsLabel, } from "./backlog-index-data.js";
 import { stripEntryStamp } from "./backlog-structure.js";
 import { entryHoldAgainst, holdMark } from "./backlog-eligibility.js";
-import { plannedPartKeys } from "./backlog-parts.js";
+import { entryKey, plannedPartKeys } from "./backlog-parts.js";
 import { plannedPlanEntries } from "./backlog.js";
 /** Max characters an index title keeps before a trailing ellipsis, so one very long BUGS.md
  * heading cannot dominate the block. */
@@ -110,7 +110,7 @@ export function renderBacklogIndexBlock(root) {
         // plan) — BUGS.md and QUESTIONS.md sections keep every entry on its own line.
         const rows = entries.map((e) => {
             const hold = entryHoldAgainst({ title: e.title, body: e.body }, plannedParts);
-            const key = collapseWhitespace(stripEntryStamp(e.title)).toLowerCase();
+            const key = entryKey(e.title);
             return {
                 start: e.start,
                 end: e.end,

package/dist/src/backlog/backlog-md.js

@@ -342,9 +342,20 @@ export function entryLags(md, sectionTitle, dateRe, filingRe) {
 export function headingMetadata(lines, start) {
     const line = lines[start] ?? "";
     const meta = [line];
+    const j = collectHeadingContinuation(lines, start, meta, headingIsWrapped(line));
+    return { text: meta.join(" "), next: j };
+}
+/** Whether a `### ` heading line opens an unbalanced parenthetical: the only shape whose
+ * metadata runs beyond its first line. */
+function headingIsWrapped(line) {
     // A wrapped heading's first line opens a parenthetical its continuation will close; an
     // unbalanced count is therefore the only shape that has metadata beyond the first line.
-    const wrapped = (line.match(/\(/g) ?? []).length > (line.match(/\)/g) ?? []).length;
+    return (line.match(/\(/g) ?? []).length > (line.match(/\)/g) ?? []).length;
+}
+/** Append a wrapped `### ` heading's continuation lines to `meta`, stopping at the next entry
+ * start, the 3-line cap, or a line ending in `)`; returns the first line index not consumed. */
+function collectHeadingContinuation(lines, start, meta, wrapped) {
+    const line = lines[start] ?? "";
     let closed = line.endsWith(")");
     let j = start + 1;
     // Continuation is a heading-only concern (wrapped headings); bullets are single-line.
@@ -356,7 +367,7 @@ export function headingMetadata(lines, start) {
         j++;
         closed = next.endsWith(")");
     }
-    return { text: meta.join(" "), next: j };
+    return j;
 }
 /** A `- ` line's or `### ` heading's trailing parenthetical's inner text, nesting-aware: a
  * backward scan from the text's closing ")" to its matching "(" returns the group's FULL inner

package/dist/src/backlog/backlog-release.js

@@ -4,7 +4,7 @@
  * section. Each comes as an exiting writer (the CLI) and a non-exiting `try…` core that refuses as
  * data (the TUI and dashboard); entry lookup and the section's file target are
  * backlog-write.ts's. */
-import { backlogTarget, findEntry, locateDashboardEntry, readEntryLines } from "./backlog-write.js";
+import { backlogTarget, findEntry, readEntryLines, withLocatedEntry } from "./backlog-write.js";
 import { withoutNeedsReviewNotes, withoutRefusalNotes } from "./backlog-eligibility.js";
 import { writeTextAtomic } from "../files/files.js";
 import { fail } from "../cli/cli-output.js";
@@ -38,11 +38,7 @@ function liftRefusal(lines, entry) {
  * title check, all decided inside the lock. */
 export function tryReleaseEntry(root, kind, n, expectedTitle) {
     const { fileName, sectionTitle } = backlogTarget(kind);
-    return withPrimaryWorktreeLock(root, () => {
-        const located = locateDashboardEntry(root, fileName, sectionTitle, n, expectedTitle);
-        if (located.status !== "ok")
-            return located;
-        const { file, md, entry } = located;
+    return withLocatedEntry(root, fileName, sectionTitle, n, expectedTitle, ({ file, md, entry }) => {
         const lines = md.split("\n");
         const lifted = liftRefusal(lines, entry);
         if (lifted === null)
@@ -104,11 +100,7 @@ function spliceEntryToTop(lines, sectionTitle, entry) {
  * title check, all decided inside the lock. */
 export function tryMoveEntryToTop(root, kind, n, expectedTitle) {
     const { fileName, sectionTitle } = backlogTarget(kind);
-    return withPrimaryWorktreeLock(root, () => {
-        const located = locateDashboardEntry(root, fileName, sectionTitle, n, expectedTitle);
-        if (located.status !== "ok")
-            return located;
-        const { file, md, entry } = located;
+    return withLocatedEntry(root, fileName, sectionTitle, n, expectedTitle, ({ file, md, entry }) => {
         if (n === 1)
             return { status: "already_first", title: entry.title };
         const lines = md.split("\n");

package/dist/src/backlog/backlog-write.js

@@ -147,7 +147,7 @@ export function readEntryLines(root, fileName, sectionTitle, n) {
  * refuse as data without writing; on success returns the `ok` file path, raw markdown and entry
  * for the caller to splice and write its own outcome. A pure lookup, decided inside the caller's
  * lock. */
-export function locateDashboardEntry(root, fileName, sectionTitle, n, expectedTitle) {
+function locateDashboardEntry(root, fileName, sectionTitle, n, expectedTitle) {
     const file = path.join(root, fileName);
     const md = readTextIfExists(file) ?? "";
     const entry = findEntry(md, sectionTitle, n);
@@ -157,6 +157,22 @@ export function locateDashboardEntry(root, fileName, sectionTitle, n, expectedTi
         return { status: "moved", title: entry.title };
     return { status: "ok", file, md, entry };
 }
+/** The shared lock-and-locate prologue of the four non-exiting dashboard writers (tryCancelEntry
+ * and tryEditEntry here; tryReleaseEntry and tryMoveEntryToTop in backlog-release.ts): take the
+ * cross-process lock, locate the `n`th entry by position and expected title, and refuse as data —
+ * returning `located`'s `gone`/`moved` verbatim when the lookup fails — without writing. On a
+ * match it calls `splice` with the located file, markdown and entry and returns whatever the
+ * splice returns, so each writer keeps its own `ok`-branch outcome; the return is the union of the
+ * two refusals and `splice`'s own return, which is exactly each writer's outcome type. The
+ * `splice` runs inside the lock, the same window the inline prologue held. */
+export function withLocatedEntry(root, fileName, sectionTitle, n, expectedTitle, splice) {
+    return withPrimaryWorktreeLock(root, () => {
+        const located = locateDashboardEntry(root, fileName, sectionTitle, n, expectedTitle);
+        if (located.status !== "ok")
+            return located;
+        return splice({ file: located.file, md: located.md, entry: located.entry });
+    });
+}
 /** The section-remove entry point, the appendEntry analogue: the same cross-process lock, so a
  * cancel and a merge's working-tree fast-forward cannot each clobber the other's
  * read-modify-write. */
@@ -189,11 +205,7 @@ function spliceOutEntry(file, lines, entry) {
  * `plans`/`bugs` strings, the same `### ` text as ActionableEntryRange.title). */
 export function tryCancelEntry(root, kind, n, expectedTitle) {
     const { fileName, sectionTitle } = backlogTarget(kind);
-    return withPrimaryWorktreeLock(root, () => {
-        const located = locateDashboardEntry(root, fileName, sectionTitle, n, expectedTitle);
-        if (located.status !== "ok")
-            return located;
-        const { file, md, entry } = located;
+    return withLocatedEntry(root, fileName, sectionTitle, n, expectedTitle, ({ file, md, entry }) => {
         spliceOutEntry(file, md.split("\n"), entry);
         return { status: "cancelled", file: fileName, title: entry.title };
     });
@@ -264,11 +276,7 @@ export function tryEditEntry(root, kind, n, expectedTitle, rawTitle, rawBody) {
     const { fileName, sectionTitle } = backlogTarget(kind);
     const title = stripEntryStamp(collapseWhitespace(rawTitle));
     const body = rawBody.replace(/\r\n?/g, "\n").trim();
-    return withPrimaryWorktreeLock(root, () => {
-        const located = locateDashboardEntry(root, fileName, sectionTitle, n, expectedTitle);
-        if (located.status !== "ok")
-            return located;
-        const { file, md, entry } = located;
+    return withLocatedEntry(root, fileName, sectionTitle, n, expectedTitle, ({ file, md, entry }) => {
         const wrote = spliceInEditedEntry(file, md.split("\n"), entry, title, body);
         return { status: wrote ? "edited" : "unchanged", file: fileName, title };
     });

package/dist/src/baseline/main-baseline.js

@@ -9,10 +9,14 @@ import { treeDiffFiles } from "../git/git-diff.js";
 import { isExemptDiff } from "../review/exemptions.js";
 import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
 import { isJsonObject } from "../files/json-object.js";
-import { baselineVerdictsPath, mirrorWorktreePath } from "../paths.js";
+import { baselineVerdictsPath } from "../paths.js";
 import { memoSetLru } from "../collections.js";
-/** Team-shared verdict cache, keyed by main SHA. In-memory only: after a restart the cache is cold
- * and one re-check per red SHA happens — cheap and deterministic, mirroring the budget gate's
+/** Team-shared verdict cache, keyed by main SHA. Exported read-only to the one consumer outside
+ * this module that decides redeploy's target from it (src/redeploy/redeploy-target.ts's
+ * `redeployTarget`); writes stay here — `rememberBaseline`, `noteGreenBaseline` and
+ * `noteInheritedGreen` — so the cache's write policy has one home. In-memory only: after a
+ * restart the cache is cold and one re-check per red SHA happens — cheap and deterministic,
+ * mirroring the budget gate's
  * stateless resume. Entries come from two sources: checkMainBaseline's own runs, and
  * noteGreenBaseline seeding a green verdict for a SHA that just became main
  * (src/merge/merge-to-main.ts: either its in-lock post-rebase re-check passed on exactly that
@@ -33,7 +37,7 @@ import { memoSetLru } from "../collections.js";
  * not opt-in only: a red carries the worktrees that observed it (`redFrom`) and is re-run by the
  * next DIFFERENT worktree to consult it, so a single environmental red can no longer block every
  * role until main moves — see shouldRerunRed. */
-const baselineCache = new Map();
+export const baselineCache = new Map();
 /** Safety cap so the per-process verdict cache can never grow unbounded: it is keyed by every
  * merged code SHA and a red entry carries the failed run's output tail, so a team running for
  * weeks would accumulate one entry per merge forever. Evicting the oldest entry (Map's insertion
@@ -150,15 +154,10 @@ function shouldRerunRed(cached, wt, reverifyRed) {
     const seen = cached.redFrom ?? [];
     return seen.length < 2 && !seen.includes(wt);
 }
-/** Record a green baseline verdict for `sha` WITHOUT running anything. The callers are the merge
- * path (src/merge/merge-to-main.ts's verifyMerge) and the stack lander
- * (src/merge/merge-stack.ts' mergeStack) — both call it only after their fast-forward SUCCEEDED,
- * with the exact SHA that just became main: verifyMerge with the POST-rebase head in two cases —
- * its own in-lock re-check just ran this project's declared check green on that tree, or the
- * rebase was a no-op so the review gate's pre-check (which runs outside the merge lock) had
- * already run green on exactly this tree — and mergeStack with the stacked tip when a
- * scope-`batch` check ran green on exactly it (a skipped check seeds nothing, and neither does a
- * merge_blocked stack or a doc-only re-stack that merged without a check of its own). Seeding
+/** Record a green baseline verdict for `sha` WITHOUT running anything. The caller is the merge
+ * path (src/merge/merge-to-main.ts's mergeToMain), called only after its fast-forward SUCCEEDED,
+ * with the exact SHA that just became main.
+ * Seeding
  * here means that once the merge completes — main now points at this very SHA — the next fresh
  * run's checkMainBaseline is a cache hit instead of re-running the full suite on an
  * already-verified tree: for tumwater itself that saves one redundant `npm test` (~1 min) per
@@ -171,11 +170,23 @@ function shouldRerunRed(cached, wt, reverifyRed) {
 export function noteGreenBaseline(sha) {
     rememberBaseline(sha, { status: "green", sha });
 }
+/** Settle `sha`'s red verdict by a re-run of only its failing tests on the same tree
+ * (build-check-rerun.ts; the main watch's confirmation, which replaced a second full run): with
+ * none failing again the SHA is promoted green, as the full re-run's green promoted it — every test
+ * has now passed on this tree — and otherwise the red narrows to the tests that failed again.
+ * Returns the settled verdict, or null when `sha` holds no red to settle. */
+export function settleRedByRerun(sha, failing) {
+    const red = baselineCache.get(sha);
+    if (red?.status !== "red")
+        return null;
+    const settled = failing.length === 0 ? { status: "green", sha } : { ...red, failingTests: [...failing] };
+    rememberBaseline(sha, settled);
+    return settled;
+}
 /** Record an INHERITED green for `sha` (MainBaseline.inheritedFrom): a tree no check ran on, whose
- * only difference from the green-verified `from` is in review-exempt paths. The caller is
- * merge-to-main.ts's verifyMerge, after it skipped the in-lock check because main moved
- * under the gate-verified head only by doc commits. It seeds the head about to become main, as
- * verifyMerge's own noteGreenBaseline calls do. If the fast-forward then fails, the entry is
+ * only difference from the green-verified `from` is in review-exempt paths. It seeds the head
+ * about to become main, as
+ * noteGreenBaseline calls do. If the fast-forward then fails, the entry is
  * still true of that tree and simply never consulted. It never displaces an observed verdict: a
  * check that actually ran on this tree knows more than the carry-over. */
 export function noteInheritedGreen(sha, from) {
@@ -193,7 +204,7 @@ const INHERIT_WALK_MAX = 64;
  * first-parent scans in this module share, spelled the same on purpose so a change to the walk
  * shape (the bound, the `--first-parent` flag) lands once. `inheritedGreen` and `watchedBaseline`
  * walk a commit's ancestors (`${sha}^` / `${tip}^`, the commit itself excluded);
- * `newestGreenAboveBuild` walks `tip` itself and down. Never throws: a git failure is an empty
+ * `newestObservedBaseline` walks `tip` itself and down. Never throws: a git failure is an empty
  * list, and every caller already treats that as a no-inheritance / no-verdict answer. */
 async function firstParentWalk(wt, ref, max) {
     return gitLines(await gitTry(wt, "rev-list", "--first-parent", `--max-count=${max}`, ref));
@@ -261,8 +272,21 @@ export async function watchedBaseline(wt, sha) {
     }
     return null;
 }
-/** How many first-parent commits below main's tip redeployTarget looks at. */
-const REDEPLOY_WALK_MAX = 64;
+/** The newest verdict a check OBSERVED on `tip` or its first-parent ancestors — `tip` itself
+ * first, looking at most INHERIT_WALK_MAX commits down — WITHOUT running anything; null when
+ * there is none. An inherited green is walked past: no check ran on that tree, and a doc edit can
+ * break a test that reads the docs (checkMainBaseline's `observedOnly`). The review gate's
+ * attribution reads this when the main watch verifies main (main-red.ts's watchedMainVerdict):
+ * with `check.mergeCommand` in effect every observed verdict is a full check the watch or
+ * another consumer ran. Never throws: a git failure reads as no verdict. */
+export async function newestObservedBaseline(wt, tip) {
+    for (const sha of await firstParentWalk(wt, tip, INHERIT_WALK_MAX)) {
+        const verdict = baselineCache.get(sha);
+        if (verdict && verdict.inheritedFrom === undefined)
+            return verdict;
+    }
+    return null;
+}
 /** True when the main watch (src/baseline/main-watch.ts) verifies main — the configs where no
  * merge seeds a green verdict (`watchedBaseline`'s doc) and the watch has a check to run: a
  * declared check and a `check.mergeCommand` (or its gate-command fallback) in effect. In this
@@ -273,56 +297,6 @@ const REDEPLOY_WALK_MAX = 64;
 export function watchVerifiesMain(root, config) {
     return detectBuildCheck(root, config) !== null && mergeCommandOf(config) !== undefined;
 }
-/** The newest first-parent commit below `tip`, down to and through `buildSha`, with a green
- * cached verdict — the walk+scan redeployTarget's watched and un-watched branches share. Only
- * their fallback differs: `notOnHistory` when `buildSha` is not on the first-parent walk at all
- * (the caller keeps today's answer, `tip`), `onHistoryNone` when it is but nothing above it is
- * green (watched keeps the build; un-watched keeps `tip`). Never throws: a git failure leaves
- * the walk empty, so the fallback answers. */
-async function newestGreenAboveBuild(wt, tip, buildSha, notOnHistory, onHistoryNone) {
-    const walk = await firstParentWalk(wt, tip, REDEPLOY_WALK_MAX);
-    const buildAt = walk.indexOf(buildSha);
-    if (buildAt === -1)
-        return notOnHistory;
-    for (const sha of walk.slice(0, buildAt)) {
-        if (baselineCache.get(sha)?.status === "green")
-            return sha;
-    }
-    return onHistoryNone;
-}
-/** The commit self-redeploy should run: main's newest first-parent commit with a green full-check
- * verdict in the cache (observed or inherited) that is newer than the running build `buildSha`,
- * looking at most REDEPLOY_WALK_MAX commits down from `tip`.
- *
- * With `watched` false (the default, a project whose main the watch does not verify), a tip the
- * cache has no verdict for is the target as is — the redeployer checks it. A tip whose cached red
- * was observed in the redeployer's mirror worktree (mirrorWorktreePath of `wt`) falls back to the
- * newest older green above the build. Any other red may be another worktree's environmental one,
- * which the redeployer re-verifies; a build that is not a first-parent ancestor of `tip`, or no
- * green, also leaves the tip the target, and the redeployer blocks that commit alone.
- *
- * With `watched` true (watchVerifiesMain), the watch supplies the verdicts and the redeployer only
- * reads them: walk `tip`'s first-parent history down to `buildSha` and return the first commit
- * whose cached verdict is green — a cached red is walked past, never targeted. With no green
- * above the build, target `buildSha` itself, so buildStaleness reads it as not stale and no
- * episode, hold or pre-warm starts until the watch calls a newer commit green. A build that is
- * not a first-parent ancestor of `tip` keeps today's answer (`tip`, which the redeployer
- * checks), as does `watched` false. Every target `watched` picks has a cached green, so
- * mainIsGreen on it is a cache hit and the redeployer starts no suite.
- * The cache holds only full-check verdicts, so a cheaper command's green never makes a commit
- * deployable.
- * Never throws: a git failure leaves the tip as the target. */
-export async function redeployTarget(wt, tip, buildSha, watched = false) {
-    if (watched) {
-        if (tip === "")
-            return tip;
-        return newestGreenAboveBuild(wt, tip, buildSha, tip, buildSha);
-    }
-    const red = baselineCache.get(tip);
-    if (tip === "" || red?.status !== "red" || !(red.redFrom ?? []).includes(mirrorWorktreePath(wt)))
-        return tip;
-    return newestGreenAboveBuild(wt, tip, buildSha, tip, tip);
-}
 /** Verify main's own build/test suite at `wt`'s HEAD — which must be pristine main (the caller
  * is the fresh-run path right after resetWorktreeToMain; a dirty or ahead worktree would
  * measure the wrong thing). Cache hit returns immediately; on miss runs detectBuildCheck +
@@ -451,6 +425,7 @@ function baselineFromOutcome(sha, wt, outcome) {
             script: outcome.script,
             outputTail: outcome.outputTail,
             failingTests: outcome.failingTests ?? [],
+            ...(outcome.failingTestFiles ? { failingTestFiles: outcome.failingTestFiles } : {}),
             redFrom: priorRedFrom.includes(wt) ? priorRedFrom : [...priorRedFrom, wt],
         };
 }
@@ -495,8 +470,8 @@ async function runBaselineOnce(sha, wt, config, onRun, sampleSleep, tier) {
     return { baseline };
 }
 /** Is main green at the mirror worktree's HEAD? The merge path seeds a green verdict for every
- * merged code SHA (noteGreenBaseline — its in-lock post-rebase re-check, or the gate's pre-check
- * when the rebase was a no-op), so the common case is a cache hit. A head that only added doc
+ * merged code SHA (noteGreenBaseline — the stack lander's scope-`batch` check on the merged tip,
+ * or a no-op gate pre-check, so the common case is a cache hit. A head that only added doc
  * commits on top of such a SHA inherits its green (checkMainBaseline's inheritedGreen). The
  * redeployer's cooldown pre-warm asks this for every new head, and those doc heads were most of the
  * harness's baseline runs (247 of 319 over 2026-10-02..12). Otherwise the project's declared check