tumwater 0.4.4 → 0.4.5

package/dist/src/baseline/main-guardrails.js

@@ -115,13 +115,17 @@ function redFailingTest(newest) {
     return Array.isArray(newest.failingTests) && typeof newest.failingTests[0] === "string" ? newest.failingTests[0] : undefined;
 }
 /** The blame clause naming the merge the main watch blamed, when the newest `culprit` in the
- * window blames the same sha the phrase names. Owns the blame clause. */
-function redBlameClause(culprit, newest) {
+ * window names the spell's opener or its newest red. Owns the blame clause. */
+function redBlameClause(culprit, startEv, newest) {
     // The blame names the merge the main watch blamed for the red — the same `main_culprit`
     // commit-equals-tip rule the dashboard alert uses (status-polls only publishes a blame whose
     // commit is the derived tip sha), so a red the watch did not blame never borrows another
     // head's culprit. A culprit naming another commit, or none, leaves the phrase as today.
-    const shouldBlame = culprit !== undefined && culprit.commit === newest.sha;
+    // The watch names the commit that OPENED the red (its first red tip since the last green)
+    // even when a later tip re-checks red, so the match accepts the spell's opener as well as the
+    // newest red tip: the opener is what the watch blames for the ongoing spell, and a
+    // pre-fix log that named the newest tip instead still matches its own newest red.
+    const shouldBlame = culprit !== undefined && (culprit.commit === newest.sha || culprit.commit === startEv.sha);
     return shouldBlame
         ? typeof culprit.runner === "string" && culprit.runner.length > 0
             ? `; the main watch blames ${roleLabel(culprit.runner)}'s merge ${shortSha(culprit.commit)}`
@@ -134,9 +138,9 @@ function redBlameClause(culprit, newest) {
  * ignored; a pass (including one naming only quarantined tests, recorded passed) ends the red.
  * The phrase names how long main has had no passing full check, the sha it has been red since,
  * its clock time, the newest red's first failing test when one is named, and — when the newest
- * `main_culprit` in the window blames the same sha the phrase names — the merge the main watch
- * blamed (`; the main watch blames <role>'s merge <sha>`, or `; the main watch blames merge
- * <sha>` when no runner is named), the one rule the dashboard alert and this phrase share.
+ * `main_culprit` in the window names the spell's opener or its newest red tip — the merge the
+ * main watch blamed (`; the main watch blames <role>'s merge <sha>`, or `; the main watch blames
+ * merge <sha>` when no runner is named), the one rule the dashboard alert and this phrase share.
  * Returns null when main is green, or red for RED_MAIN_WARN_MS or less. The per-job work is
  * split into the module-private helpers `scanRedWindow`, `redSpell`, `redSpellDuration`,
  * `redFailingTest` and `redBlameClause`, one per job, so each is found by name. */
@@ -148,7 +152,7 @@ export function redMainWarning(events, now) {
     const duration = redSpellDuration(spell);
     const head = `main has had no passing full check for ${duration}: red since ${shortSha(spell.startEv.sha)} at ${clockHm(spell.startEv.ts)}`;
     const failing = redFailingTest(spell.newest);
-    const blame = redBlameClause(window.culprit, spell.newest);
+    const blame = redBlameClause(window.culprit, spell.startEv, spell.newest);
     return failing ? `${head} — ${squash(failing, 120)}${blame}` : `${head}${blame}`;
 }
 /** G3 over `entries` (the loadQuarantine list): warns when the list holds more than

package/dist/src/baseline/main-red.js

@@ -1,17 +1,18 @@
 import { baseRoleOf } from "../roles/runner-ids.js";
 import { enqueueRolePrompt } from "../inbox/inbox.js";
 import { liveConfig } from "../config/config.js";
-import { mergeCommandOf } from "../build/build-check-detect.js";
+import { mergeCommandOf, rerunCommandOf } from "../build/build-check-detect.js";
+import { canRerun, rerunCommandLine, rerunTests } from "../build/build-check-rerun.js";
 import { failureHeadline, FAILING_TESTS_MAX } from "../build/build-check-report.js";
 import { baselineCheckEventLogger } from "../build/build-check-events.js";
-import { checkMainBaseline, watchedBaseline } from "./main-baseline.js";
+import { checkMainBaseline, newestObservedBaseline, watchedBaseline } from "./main-baseline.js";
 import { buildMainRedNote } from "../prompt/gate-notes.js";
 import { logEventBestEffort, warnEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { errorMessage } from "../text/text.js";
 import { mainRedPhrase, plural } from "../text/phrases.js";
 import { clipToWidth } from "../text/text-width.js";
 import { shortSha } from "../text/format.js";
-import { branchHead } from "../git/git.js";
+import { branchHead, headOf, isMergedInto } from "../git/git.js";
 import { gateMainWorktreePath } from "../paths.js";
 import { useWorktree } from "../git/worktree-use.js";
 import { ensureDetachedWorktree } from "../git/worktree.js";
@@ -41,8 +42,8 @@ let lastHealKey = null;
 /** The failing tests a red verdict names, when the list is complete — non-empty and short of
  * FAILING_TESTS_MAX, which may have been cut short (the same rule as onlyKnownMainFailures).
  * Empty when it names none: main's red is then not a set of known failures, and the heal is
- * keyed to the red SHA rather than a failing set (the event reads "code merges blocked until
- * main is green"). */
+ * keyed to the red SHA rather than a failing set (the event reads "a change whose own check
+ * fails is kept until main moves"). */
 export function namedFailures(red) {
     const tests = red.failingTests ?? [];
     return tests.length > 0 && tests.length < FAILING_TESTS_MAX ? tests : [];
@@ -81,7 +82,7 @@ function warnMainRedOnce(root, red, foundBy) {
         ...(named.length > 0 ? { failingTests: named } : {}),
         message: named.length > 0
             ? `${mainRedPhrase(red.sha)} (${plural(named.length, "failing test")}: ${clipToWidth(named[0] ?? "", 80)}${named.length > 1 ? `, +${named.length - 1} more` : ""}); changes that add no new failures still merge`
-            : redMainMessage(red, "code merges blocked until main is green"),
+            : redMainMessage(red, "a change whose own check fails is kept until main moves"),
     });
     // The ci role is the healer, and it schedules as an observer, so a red main discovered by any
     // other path could sit unrepaired until ci's own interval or a coincidental wake.
@@ -116,8 +117,22 @@ export function mainRedHealPrompt(sha, detail) {
     if (!detail)
         return base;
     const tests = detail.failingTests.length > 0 ? ` Failing: ${detail.failingTests.join("; ")}.` : "";
+    const rerun = detail.rerun ? ` ${rerunAdvice(detail.rerun)}` : "";
     const tail = detail.outputTail && detail.outputTail.length > 0 ? ` Output tail: ${detail.outputTail.join(" | ")}` : "";
-    return `${base} The watch named ${shortSha(detail.culprit)} as the commit that turned it red.${tests}${tail}`;
+    return `${base} The watch named ${shortSha(detail.culprit)} as the commit that turned it red.${tests}${rerun}${tail}`;
+}
+/** The heal's one instruction about re-running: the command that runs only main's failing tests,
+ * for reproducing them and for proving the fix, instead of the whole suite. */
+function rerunAdvice(command) {
+    return `Run only the failing tests, to reproduce them and again to prove the fix, with: ${command}`;
+}
+/** The command line that re-runs `red`'s named failures on their own (rerunCommandLine), or
+ * undefined when they cannot be re-run alone (canRerun) — the healer is then left to the full
+ * check. */
+function healRerunLine(root, config, red) {
+    const tests = namedFailures(red);
+    const command = canRerun(root, config, tests) ? rerunCommandOf(root, config) : undefined;
+    return command === undefined ? undefined : rerunCommandLine(command, tests, red.failingTestFiles);
 }
 /** Queue the heal prompt for ci with the culprit's detail: the one way a named red-main culprit
  * is answered (Forward, never back, part 4/6): the watch's onCulprit hand-off routes through
@@ -128,7 +143,8 @@ export function mainRedHealPrompt(sha, detail) {
  * the orchestrator. */
 export function queueCulpritHeal(root, tip, detail) {
     try {
-        enqueueRolePrompt(root, "ci", mainRedHealPrompt(tip, detail));
+        const rerun = healRerunLine(root, liveConfig(root), { failingTests: [...detail.failingTests], failingTestFiles: detail.failingTestFiles });
+        enqueueRolePrompt(root, "ci", mainRedHealPrompt(tip, { ...detail, ...(rerun ? { rerun } : {}) }));
     }
     catch (err) {
         warnEventBestEffort(root, TUMWATER_SOURCE, `could not queue the heal prompt for ci: ${errorMessage(err)}`);
@@ -138,8 +154,8 @@ export function queueCulpritHeal(root, tip, detail) {
  * that paid for it, with its duration — the gate's build_check sibling, so both halves of the
  * team's deterministic verification are priced in the feed. The one logger for every baseline
  * check this module runs — the ci handoff, the main watch, and mainTipVerdict's tip
- * check (which review.ts's gate and merge-check-failures.ts's attributeRedCheck reach
- * through it) — so the event's shape cannot drift between them. */
+ * check (which the review pre-check reaches through it) — so the event's shape cannot drift
+ * between them. */
 export function baselineCheckLogger(root, role) {
     return baselineCheckEventLogger(role, (event) => logEventBestEffort(root, event));
 }
@@ -169,7 +185,7 @@ export async function mainRedHealNote(root, role, wt) {
     if (red?.status !== "red")
         return undefined;
     warnMainRedOnce(root, red, role);
-    return buildMainRedNote(red.sha, red.script, failureHeadline(red.outputTail), red.outputTail);
+    return buildMainRedNote(red.sha, red.script, failureHeadline(red.outputTail), red.outputTail, healRerunLine(wt, config, red));
 }
 /** Serializes mainTipVerdict's use of its one worktree: the merge pipeline's verifies run their
  * gates concurrently, and a second gate re-pointing the checkout at a newer main while the first's
@@ -233,7 +249,7 @@ async function verdictAtMainTipIn(root, role, mainBranch, config, forceFresh) {
             return { status: "green", sha: baseline.sha };
         if (baseline?.status === "red") {
             warnMainRedOnce(root, baseline, role);
-            return { status: "red", sha: baseline.sha };
+            return { status: "red", sha: baseline.sha, failingTests: baseline.failingTests ?? [] };
         }
         return {
             status: "unavailable",
@@ -248,3 +264,75 @@ async function verdictAtMainTipIn(root, role, mainBranch, config, forceFresh) {
         return { status: "unavailable", why: errorMessage(err) };
     }
 }
+/** Main's verdict at its tip on a gate's twice-failed check, for an attribution that has to run
+ * something: when the failures name their tests and those can be re-run alone (canRerun), only
+ * they run, in the `_gate-main` mirror at main's tip — a red names the ones that fail there too,
+ * a green says none does. Otherwise, or when the re-run reaches no verdict, main's full check runs
+ * fresh (mainTipVerdict with forceFresh), as before. A re-run is no full check: it never touches
+ * the verdict cache and warns nothing. Never throws. */
+export async function mainTipFailures(root, role, wt, mainBranch, config, failed) {
+    const rerun = failed ? await rerunAtMainTip(root, role, wt, mainBranch, config, failed) : null;
+    return rerun ?? mainTipVerdict(root, role, mainBranch, config, true);
+}
+/** mainTipFailures's re-run alone: `failed`'s tests run on their own in the `_gate-main` mirror at
+ * main's tip, queued behind the gates and the main watch that share it. Null when they cannot be
+ * re-run alone (canRerun) or the re-run reaches no verdict. Never throws. */
+export async function rerunAtMainTip(root, role, wt, mainBranch, config, failed) {
+    if (!canRerun(wt, config, failed.tests))
+        return null;
+    const rerun = await withMainTipWorktree(root, mainBranch, async (mirror) => {
+        const result = await rerunTests(root, role, mirror, config, failed.tests, failed.files);
+        return result ? { result, sha: await headOf(mirror, "HEAD") } : null;
+    }).catch(() => null);
+    if (!rerun)
+        return null;
+    const { result, sha } = rerun;
+    return result.failing.length === 0 ? { status: "green", sha } : { status: "red", sha, failingTests: result.failing };
+}
+/** The main watch's newest observed verdict at or below `tip` (newestObservedBaseline), and
+ * whether it covers `base`: it was observed on `base` itself or on a commit that contains it, so
+ * the tree the change was rebased onto is part of what the watch checked. Shared by the gate's
+ * attribution and the kept change's re-queue, so the two agree on when the wait is over. Never
+ * throws: a git failure reads as not covered. */
+export async function watchVerdictCovering(wt, tip, base) {
+    const verdict = await newestObservedBaseline(wt, tip);
+    const covers = verdict !== null && (verdict.sha === base || (await isMergedInto(wt, base, verdict.sha)));
+    return { verdict, covers };
+}
+/** Main's verdict for attributing a gate check that failed twice, read from the main watch's
+ * verdicts instead of a full check of the gate's own (plans/fast-merge.md part 6/14). The gate
+ * used to run main's whole suite here, queued behind the watch's own runs in `_gate-main`: on
+ * 2026-10-30 that took 166–2,282 s for a 30 s gate, and two of five runs repeated a commit the
+ * watch or an earlier attribution had just checked.
+ *
+ * `base` is the commit the change was rebased onto (its merge-base with main). When the watch's
+ * newest observed verdict covers it (watchVerdictCovering), that verdict answers at once. When the
+ * watch is still behind it, the answer is `awaiting`: the gate keeps the change with no strike
+ * and the merge pipeline re-queues it once the watch catches up. Waiting instead of judging
+ * against an older verdict matters: a commit the watch has not reached yet may be what broke the
+ * test, and the change would be rejected for main's failure.
+ *
+ * `waited` is set on the retry after such a wait, and the gate does not wait twice: after
+ * `covered` the newest observed verdict answers even if main moved past it again; after
+ * `timed_out` (the watch never got there — held, failing, or main's tip only carried doc commits
+ * past its last observed check) main is asked here (mainTipFailures: the gate's `failed` tests
+ * re-run alone on main's tip when they can be, else main's full check). The same fallback answers a
+ * `covered` retry that finds no observed verdict at all. A red is not warned again here: the watch
+ * that observed it reported it. Never throws. */
+export async function watchedMainVerdict(root, role, wt, mainBranch, config, base, waited, failed) {
+    const fallback = () => mainTipFailures(root, role, wt, mainBranch, config, failed);
+    if (waited === "timed_out")
+        return fallback();
+    const tip = await branchHead(root, mainBranch);
+    if (!tip)
+        return { status: "unavailable", why: `${mainBranch} is unreadable` };
+    const { verdict, covers } = await watchVerdictCovering(wt, tip, base);
+    if (verdict && (covers || waited === "covered")) {
+        return verdict.status === "red"
+            ? { status: "red", sha: verdict.sha, failingTests: verdict.failingTests ?? [] }
+            : { status: "green", sha: verdict.sha };
+    }
+    if (waited === "covered")
+        return fallback();
+    return { status: "awaiting", ...(verdict ? { sha: verdict.sha } : {}) };
+}

package/dist/src/baseline/main-watch.js

@@ -1,5 +1,6 @@
 import { distinctOrdered } from "../collections.js";
-import { checkMainBaseline } from "./main-baseline.js";
+import { checkMainBaseline, settleRedByRerun } from "./main-baseline.js";
+import { canRerun, rerunTests } from "../build/build-check-rerun.js";
 import { baselineCheckLogger, clearHealKeyOnGreen, withMainTipWorktree } from "./main-red.js";
 import { CHECK_TIER } from "../concurrency/check-permit.js";
 import { FAILING_TESTS_MAX } from "../build/build-check-report.js";
@@ -32,6 +33,14 @@ function mainCheckEvent(baseline, red, quarantined, covered, durationMs) {
 }
 /** The failing tests of each root's newest watch verdict, keyed by root. */
 const knownFailures = new Map();
+/** The commit each root's red spell was opened at, keyed by root — the tip of the first red
+ * verdict since the last green. It stays the named culprit while the spell is open: a later tip
+ * re-checks red (the red never inherits across a doc commit) but did not open it, so it is not
+ * re-attributed. A green verdict clears it, so a red that opens after a green names its own
+ * opener. In-memory only: a restart mid-red loses the spell's opener, and the next settled red
+ * tip then names itself as culprit — the pre-fix behaviour, and a bounded one (one tip per
+ * restart, since a spell's later tips inherit the red and settle without a re-run). */
+const redSpellOpeners = new Map();
 /** Main's known failures: the failing tests of the watch's newest verdict — main's tip, or the
  * nearest tip it checked while the newest head waits — and every quarantined flaky test
  * (review/known-flakes.ts). Empty when the verdict is green, red with no parsed test, or none has
@@ -138,10 +147,14 @@ export function createMainWatch(root, mainBranch, onCulprit) {
                 }
             }
         };
-        /** Run the declared build check on main's tip, re-running a red once and quarantining a flake
-         * whose re-run turns green. Returns the check's result and whether any run actually executed
-         * (false for a cache hit, a skip, or a sleep-spanned run). `config` and `root` are captured
-         * from `watchOnce`. */
+        /** Run the declared build check on main's tip, confirming a red once and quarantining a flake
+         * whose confirmation passes. A red whose failing tests can be re-run on their own (canRerun) is
+         * confirmed by re-running just those tests, so the full check runs once per tip: a test that
+         * passes there is quarantined, and the red narrows to the tests that failed again (or turns
+         * green when none did). A re-run that reaches no verdict leaves the first red standing. Without
+         * a re-run command the whole check runs again, as before. Returns the check's result and
+         * whether any full run actually executed (false for a cache hit, a skip, or a sleep-spanned
+         * run). `config` and `root` are captured from `watchOnce`. */
         async function runBaselineCheck(wt) {
             let ran = false;
             const onRun = baselineCheckLogger(root, TUMWATER_SOURCE);
@@ -150,13 +163,27 @@ export function createMainWatch(root, mainBranch, onCulprit) {
                 onRun(run);
             };
             let check = await checkMainBaseline(wt, config, hook, false, false, undefined, false, CHECK_TIER.merge);
-            if (check.baseline?.status === "red") {
-                const first = check.baseline;
-                check = await checkMainBaseline(wt, config, hook, true, false, undefined, false, CHECK_TIER.merge);
-                // A red the same tree's confirming re-run turns green is a flake: quarantine its tests.
-                if (check.baseline?.status === "green")
-                    quarantineTests(root, first.failingTests, (first.failingTests ?? []).join("\n"));
+            if (check.baseline?.status !== "red")
+                return { check, ran };
+            const first = check.baseline;
+            const named = first.failingTests ?? [];
+            if (canRerun(wt, config, named)) {
+                const rerun = await rerunTests(root, TUMWATER_SOURCE, wt, config, named, first.failingTestFiles, CHECK_TIER.merge);
+                if (rerun) {
+                    // Each test that failed and then passed on this same tree is a flake.
+                    const passed = named.filter((t) => !rerun.failing.includes(t));
+                    if (passed.length > 0)
+                        quarantineTests(root, passed, passed.join("\n"));
+                    const settled = settleRedByRerun(first.sha, rerun.failing);
+                    if (settled)
+                        check = { baseline: settled };
+                }
+                return { check, ran };
             }
+            check = await checkMainBaseline(wt, config, hook, true, false, undefined, false, CHECK_TIER.merge);
+            // A red the same tree's confirming re-run turns green is a flake: quarantine its tests.
+            if (check.baseline?.status === "green")
+                quarantineTests(root, named, named.join("\n"));
             return { check, ran };
         }
         /** The covered-commit count for a main_check event: the first-parent commits between the
@@ -179,24 +206,37 @@ export function createMainWatch(root, mainBranch, onCulprit) {
             logEventBestEffort(root, mainCheckEvent(baseline, red, quarantined, covered, ran ? Date.now() - started : 0));
             return red;
         }
-        /** Name a settled red tip as the culprit: its merging runner, the main_culprit event, and
-         * the onCulprit callback with the tip and its failing tests. */
+        /** Name a settled red tip's spell as the culprit: the merging runner, the main_culprit
+         * event, and the onCulprit callback with the tip and its failing tests. The commit named is
+         * the one that OPENED the red — the first red tip since the last green — not the newest red
+         * tip: a doc-exempt tip that lands after the red opened cannot have changed the suite, so
+         * blaming it would name a merge in the G1 phrase (src/baseline/main-guardrails.ts) and the
+         * ci heal prompt (src/baseline/main-red.ts) that did not break anything. The opener is named
+         * once per spell with the tip's failing tests and, when the newest merged event names the
+         * opener, its runner; while the spell is open a later tip re-settling red re-attributes
+         * nothing. */
         function reportCulprit(baseline) {
-            // The newest head is the culprit ("Every commit is verified on main, part 2/3"): the watch
-            // checks each new red tip, so whatever it found belongs to the head it checked. Once per red
-            // head — lastWatched already holds it, so a later poll does not attribute it again — name
-            // the tip with its own failing tests and, when the newest merged event names it, its runner.
-            const runner = mergingRoleOf(root, baseline.sha);
+            // A red spell that is already open keeps its opener named: the first red tip since the
+            // last green caused the red, so a later tip re-settling red (a doc-exempt tip cannot
+            // change the suite, and a code tip does not open a SECOND spell until a green closed the
+            // first) is not re-attributed — no new event, no new heal prompt (the heal dedup already
+            // re-queues when the failing set returns after a green).
+            if (redSpellOpeners.has(root))
+                return;
+            const culprit = baseline.sha;
+            redSpellOpeners.set(root, culprit);
+            const runner = mergingRoleOf(root, culprit);
             logEventBestEffort(root, {
                 source: TUMWATER_SOURCE,
                 type: "main_culprit",
-                commit: baseline.sha,
+                commit: culprit,
                 ...(runner !== undefined ? { runner } : {}),
                 failingTests: baseline.failingTests ?? [],
             });
             onCulprit?.({
-                commit: baseline.sha,
+                commit: culprit,
                 failingTests: baseline.failingTests ?? [],
+                ...(baseline.failingTestFiles ? { failingTestFiles: baseline.failingTestFiles } : {}),
                 tip: baseline.sha,
             });
         }
@@ -232,8 +272,14 @@ export function createMainWatch(root, mainBranch, onCulprit) {
             // is red.
             if (!red) {
                 clearHealKeyOnGreen();
+                redSpellOpeners.delete(root); // a green closes the red spell; the next red names its own opener
                 return;
             }
+            // The spell's opener is blamed once: the first settled red tip since the last green names
+            // itself, and a later tip re-settling the same open red re-checks the suite without re-
+            // naming the culprit (BUGS.md 2026-10-30 mis-attribution). The map holds the open spell's
+            // opener, so a second red while the spell is still open re-checks without re-naming; a
+            // green clears the entry (above) so a later red names its own opener.
             reportCulprit(baseline);
         });
     }

package/dist/src/budget/budget-fallback-view.js

@@ -4,18 +4,19 @@
  * stage-check.ts). This module owns everything pollBudgetGate does from its `onFallback` seam
  * through the end of the function: the seam/backends walk, the motion key (`resolvedKey`,
  * `fromKey`), the fallback view derivation (`fallbackConfig`), `chainInfo`, and the `pairs`
- * handback list. It no longer moves any tier for a used-up subscription window (part 5d/6): only
- * a spent `maxDailyCostUsd` triggers a move, so the view's one job is the cap's free-seam
- * install. Its one entry reads the inputs pollBudgetGate's first half already resolved and
- * returns the view fields `BudgetGatePoll` carries, so pollBudgetGate keeps its call signature
- * and src/gates/gate-polls.ts's destructure of it is unchanged. The plan references the moved
- * comments carry (part 5b/8, part 5c/8, 6a/7) hold here. */
+ * handback list. It no longer moves any tier for a used-up subscription window (part 5d/6): a
+ * spent `maxDailyCostUsd` moves every priced tier to its free seam, and, at any spend, a tier
+ * whose own primary failed its model check moves to a verified step of its chain
+ * (plans/model-check.md "Fallback"). Its one entry reads the inputs pollBudgetGate's first half
+ * already resolved and returns the view fields `BudgetGatePoll` carries, so pollBudgetGate keeps
+ * its call signature and src/gates/gate-polls.ts's destructure of it is unchanged. The plan
+ * references the moved comments carry (part 5b/8, part 5c/8, 6a/7) hold here. */
 import { MODEL_TIERS, } from "../config/config-schema.js";
 import { modelPairName, pairDailyCost } from "../budget/budget.js";
 import { fallbackServingPair, } from "../budget/fallback-breaker.js";
 import { applyFallbackModel, tierChainSteps, } from "../config/config-fallbacks.js";
 import { seamAgent } from "../config/config-model-selector.js";
-import { withModelOverrides } from "../config/config-views.js";
+import { seamPairName, withModelOverrides } from "../config/config-views.js";
 import { piPairFree, seamFree } from "../pi/pi-models.js";
 import { dayAt } from "../text/datetime.js";
 /** Can the account not take extra usage: some window is rejected, or the newest non-reset
@@ -44,21 +45,41 @@ export function subscriptionBackendOf(x, accounts) {
     const account = accounts(id);
     return account?.billing === "subscription" ? id : null;
 }
+/** The pair a tier's own primary resolves to under the live config — the name the model check
+ * keys it by. */
+function tierPrimaryPair(config, tier) {
+    return seamPairName(withModelOverrides(config, tier, {}));
+}
+/** `base` with each check-moved tier's entry replaced by its verified step. */
+function withCheckMoves(base, checkResolved, checkMoved) {
+    const out = { ...base };
+    for (const tier of checkMoved)
+        out[tier] = checkResolved[tier];
+    return out;
+}
 /** Install `state.fallbackConfig` when the fallback changed the view key: at the cap, the free
  * pair installed top-level and every per-role/reviewer model override dropped, so no seam can
  * reach a priced model. A breaker-demoted fallback keeps the view too: its gate is `paused`,
  * but a run parked in the semaphore when it tripped, the half-open probe, and the merges must
  * still run on the free pair — a demotion must never promote them to the priced model the cap
- * already spent. */
-function installFallbackConfig(a, fromKey) {
+ * already spent. A tier the model check moved (deriveCheckMovedTiers) installs its verified
+ * step at any spend, and only its own primary seams move: every other tier, and a role or
+ * reviewer pinned to some other pair, keeps its model. */
+function installFallbackConfig(a, fromKey, checkMoved) {
     const { state, config: liveConfig, providers, catalog, accounts, priceResolved, reached } = a;
-    if (reached && (state.from !== liveConfig || state.fromKey !== fromKey)) {
+    if ((reached || checkMoved.size > 0) && (state.from !== liveConfig || state.fromKey !== fromKey)) {
         state.from = liveConfig;
         state.fromKey = fromKey;
+        const primaries = new Map([...checkMoved].map((t) => [t, tierPrimaryPair(liveConfig, t)]));
+        const checkKeeps = (seam, tier) => primaries.get(tier) !== seamPairName(seam);
         // At the cap only free seams are available (a subscription claude seam is free money), so
         // every role/reviewer override that resolves to a priced seam drops to the fallback pair.
-        const available = (seam) => seamFree(providers, seam, accounts, catalog);
-        state.fallbackConfig = applyFallbackModel(liveConfig, priceResolved, available);
+        const keeps = reached
+            ? (seam, tier) => seamFree(providers, seam, accounts, catalog) && checkKeeps(seam, tier)
+            : checkKeeps;
+        // The cap's base view is the check-aware resolution while the check is on (a cap-moved
+        // tier's failed step stays out of the config its roles run under), else the price view.
+        state.fallbackConfig = applyFallbackModel(liveConfig, withCheckMoves(a.checkFreeResolved ?? priceResolved, a.checkResolved, checkMoved), keeps);
     }
 }
 /** The tiers `applyFallbackModel` moved at the cap: those whose own seam fails the `available`
@@ -73,28 +94,64 @@ function deriveMovedTiers(a) {
     }
     return movedTiers;
 }
+/** The tiers the model check moves (plans/model-check.md "Fallback"): a tier still on its own
+ * primary — every tier below the cap, at it only one the cap leaves in place (`capMoved` holds
+ * the rest) — whose primary failed its check while the tier's verified-only resolution has a
+ * step to run on. A tier whose primary failed with no verified step stays held on it. */
+function deriveCheckMovedTiers(a, capMoved) {
+    const moved = new Set();
+    if (a.checkResolved === undefined || a.checkFailed === undefined)
+        return moved;
+    for (const tier of MODEL_TIERS) {
+        if (capMoved.has(tier) || a.checkResolved[tier].pair === null)
+            continue;
+        if (a.checkFailed(tierPrimaryPair(a.config, tier)))
+            moved.add(tier);
+    }
+    return moved;
+}
 /** Derive the fallback view for one poll from the verdict half's already-resolved inputs
- * (`priceResolved`, `servingResolved`, `chainPairs`, `pairNames`) and the `reached` flag and
- * the shared reads (`state`, `config`, `accounts`, `providers`, `catalog`), writing the
- * cross-poll view state (`from`/`fromKey`/`fallbackConfig`) and returning the view fields
- * pollBudgetGate hands back. The director always keeps the live config (part 5d/6): with the
- * window move gone no input moves it, so `directorConfig` is the live config by construction. */
+ * (`priceResolved`, `servingResolved`, `checkResolved`, `checkFreeResolved`, `chainPairs`,
+ * `pairNames`) and the `reached` flag and the shared reads (`state`, `config`, `accounts`,
+ * `providers`, `catalog`), writing the cross-poll view state (`from`/`fromKey`/
+ * `fallbackConfig`) and returning the view
+ * fields pollBudgetGate hands back. The view is installed at the cap, and below it while a tier
+ * the model check moved runs on its verified step; `onFallback` (the image-reroute regime) stays
+ * the cap's alone. The director always keeps the live config (part 5d/6): with the window move
+ * gone no input moves it, so `directorConfig` is the live config by construction. */
 export function budgetFallbackView(a) {
     const { state, config: liveConfig, reached, priceResolved } = a;
     const onFallback = reached && a.pairNames.length > 0;
+    const movedTiers = deriveMovedTiers(a);
+    const checkMoved = deriveCheckMovedTiers(a, movedTiers);
     // The resolved pairs are part of the key: a priced step crossing its own daily cap changes
-    // the resolution without a config or window change, and the view must follow it.
+    // the resolution without a config or window change, and the view must follow it. So are the
+    // model check's moves, appended only while there are some.
     const resolvedKey = MODEL_TIERS.map((t) => {
         const rp = priceResolved[t].pair;
         return rp ? modelPairName(rp) : "-";
     }).join(",");
-    const fromKey = `${reached ? "c" : ""}|${resolvedKey}`;
-    installFallbackConfig(a, fromKey);
-    const movedTiers = deriveMovedTiers(a);
+    const checkKey = MODEL_TIERS.map((t) => (checkMoved.has(t) ? modelPairName(a.checkResolved[t].pair) : "-")).join(",");
+    // The cap view's check-aware pairs follow the price pairs when present: a check verdict
+    // failing or clearing a step changes the installed config without a price change, so the
+    // view must re-install on the next poll. Absent while the check is off, so the key is
+    // unchanged then.
+    const checkFreeKey = a.checkFreeResolved
+        ? "|" +
+            MODEL_TIERS.map((t) => {
+                const rp = a.checkFreeResolved[t].pair;
+                return rp ? modelPairName(rp) : "-";
+            }).join(",")
+        : "";
+    const fromKey = `${reached ? "c" : ""}|${resolvedKey}${checkMoved.size > 0 ? `|${checkKey}` : ""}${checkFreeKey}`;
+    installFallbackConfig(a, fromKey, checkMoved);
     const chain = chainInfo({
         config: liveConfig,
-        resolved: a.servingResolved,
-        moved: movedTiers,
+        resolved: withCheckMoves(a.servingResolved, a.checkResolved, checkMoved),
+        moved: new Set([...movedTiers, ...checkMoved]),
+        checkMoved,
+        ...(a.checkFailed !== undefined ? { modelCheckFailed: a.checkFailed } : {}),
+        ...(a.checkVerified !== undefined ? { modelCheckVerified: a.checkVerified } : {}),
         breakers: state.breakers,
         states: a.states,
         now: a.now,
@@ -104,16 +161,20 @@ export function budgetFallbackView(a) {
     return {
         onFallback,
         chain,
-        roleConfig: onFallback ? state.fallbackConfig : liveConfig,
+        roleConfig: onFallback || checkMoved.size > 0 ? state.fallbackConfig : liveConfig,
         pairs: distinctPairs(priceResolved, a.chainPairs),
         directorConfig: liveConfig,
+        checkMoved,
     };
 }
 /** The `chain` block: for each tier this poll moved off its primary, the step it runs on and
  * why the position before it cannot run (plans/fallback-chain.md "Events and surfaces").
  * `moved` names the tiers the poll moved; a tier the gate pauses (`pair: null`) gets no entry.
  * The reason is read from the position just before the active step — the previous chain step,
- * or the tier's primary at step 0 — in the order demoted, step-cap, overage, cap. */
+ * or the tier's primary at step 0 — in the order demoted, step-cap, overage, model-check, cap.
+ * `checkMoved` names the moved tiers whose primary failed its model check rather than the cap
+ * moving them; the model check's verdicts say whether a previous step failed (or, for such a
+ * tier, which moves only to verified steps, has not answered yet). */
 export function chainInfo(a) {
     const out = {};
     const steps = tierChainSteps(a.config);
@@ -127,7 +188,7 @@ export function chainInfo(a) {
             pair: modelPairName(r.pair),
             step: position.step,
             of: position.of,
-            ...movedTierReason(a, position.prior, position.priorName, midnight),
+            ...movedTierReason(a, tier, position.prior, position.priorName, midnight),
         };
         Object.assign(info, movedTierSpend(a, r.pair));
         out[tier] = info;
@@ -146,10 +207,11 @@ function movedTierPosition(steps, tier, r) {
     return { step: idx + 1, of: own.length, prior, priorName: prior ? modelPairName(prior) : "" };
 }
 /** Why the position before the active step cannot run, in INV-BN1's fixed order (demoted,
- * step-cap, overage, cap). A demoted or overage result carries no `returnsAt`; a step-cap or
+ * step-cap, overage, model-check, cap). A demoted, overage or model-check result carries no
+ * `returnsAt` (a model check lifts when a re-check answers, not at a clock time); a step-cap or
  * cap result pins it to `midnight` (INV-BN2: local midnight only for step-cap and cap).
  * Answers "why can't the position before the active step run, and when does it come back?". */
-function movedTierReason(a, prior, priorName, midnight) {
+function movedTierReason(a, tier, prior, priorName, midnight) {
     if (prior && a.breakers[priorName] !== undefined && !fallbackServingPair(a.breakers, priorName)) {
         return { reason: "demoted" };
     }
@@ -163,6 +225,12 @@ function movedTierReason(a, prior, priorName, midnight) {
         claudeOverageRefused(a.accounts("claude"))) {
         return { reason: "overage" };
     }
+    const checkMoved = a.checkMoved?.has(tier) === true;
+    const priorChecked = prior === null
+        ? checkMoved
+        : a.modelCheckFailed?.(priorName) === true || (checkMoved && a.modelCheckVerified?.(priorName) !== true);
+    if (priorChecked)
+        return { reason: "model-check" };
     return { reason: "cap", returnsAt: midnight };
 }
 /** What the active step has spent against its own cap: both keys absent unless the step is a

package/dist/src/build/build-check-detect.js

@@ -119,9 +119,8 @@ export function detectBuildCheck(startDir, config, maxLevels = WALK_UP_LEVELS) {
 /** The configured per-change gate command (`check.gateCommand`, PLANS.md Land-queue speed 3e) when
  * it is a non-blank string, else undefined — off. Opt-in: when no `mergeCommand` is declared, a
  * project that sets one merges on it, not the full check (mergeCommandOf's fallback, PLANS.md
- * "Fast merge" "Defaults"). One reading shared by runScopedBuildCheck (which runs it at scope
- * "gate") and merge-to-main.ts's verifyMerge (which must then never treat the gate's green as the
- * full check's), so the two cannot disagree about whether it is on. */
+ * "Fast merge" "Defaults"). One reading every caller shares (runScopedBuildCheck runs it at
+ * scope "gate"), so none can disagree about whether it is on. */
 export function gateCommandOf(config) {
     const g = config?.check?.gateCommand;
     return isNonBlankString(g) ? g : undefined;
@@ -141,6 +140,26 @@ export function mergeCommandOf(config) {
         return gateCommandOf(config);
     return isNonBlankString(m) ? m : undefined;
 }
+/** The npm script the re-run of named tests auto-detects (rerunCommandOf). */
+const RERUN_SCRIPT = "test:rerun";
+/** The command that re-runs only named tests (`check.rerunCommand`, build-check-rerun.ts), or
+ * undefined — off, and its callers run the full check instead. A configured non-blank string
+ * wins; a blank one (`""`) is the explicit opt-out. Absent, a project whose check is the npm
+ * walk-up (no `check.command`) re-runs with `npm run test:rerun --` when the package.json the
+ * walk-up finds declares that script, so an npm project opts in from its own manifest. Never
+ * throws. */
+export function rerunCommandOf(startDir, config) {
+    const r = config?.check?.rerunCommand;
+    if (r !== undefined)
+        return isNonBlankString(r) ? r : undefined;
+    if (isNonBlankString(config?.check?.command))
+        return undefined;
+    const root = walkUp(startDir, WALK_UP_LEVELS, (dir) => (hasInstall(dir) ? dir : null));
+    if (root === null)
+        return undefined;
+    const scripts = readJsonFile(path.join(root, "package.json"))?.scripts;
+    return isJsonObject(scripts) && isCheckScript(scripts, RERUN_SCRIPT) ? `npm run ${RERUN_SCRIPT} --` : undefined;
+}
 /** Resolve `node_modules/<rel>` by walking UP from `startDir` — the same climb detectBuildCheck
  * makes, and the same one npm's run-script PATH walk makes: a tumwater worktree has no install
  * of its own (node_modules is gitignored, so it exists only where someone ran npm install), and