tumwater 0.4.4 → 0.4.6

package/dist/src/baseline/main-baseline.js

@@ -9,10 +9,14 @@ import { treeDiffFiles } from "../git/git-diff.js";
 import { isExemptDiff } from "../review/exemptions.js";
 import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
 import { isJsonObject } from "../files/json-object.js";
-import { baselineVerdictsPath, mirrorWorktreePath } from "../paths.js";
+import { baselineVerdictsPath } from "../paths.js";
 import { memoSetLru } from "../collections.js";
-/** Team-shared verdict cache, keyed by main SHA. In-memory only: after a restart the cache is cold
- * and one re-check per red SHA happens — cheap and deterministic, mirroring the budget gate's
+/** Team-shared verdict cache, keyed by main SHA. Exported read-only to the one consumer outside
+ * this module that decides redeploy's target from it (src/redeploy/redeploy-target.ts's
+ * `redeployTarget`); writes stay here — `rememberBaseline`, `noteGreenBaseline` and
+ * `noteInheritedGreen` — so the cache's write policy has one home. In-memory only: after a
+ * restart the cache is cold and one re-check per red SHA happens — cheap and deterministic,
+ * mirroring the budget gate's
  * stateless resume. Entries come from two sources: checkMainBaseline's own runs, and
  * noteGreenBaseline seeding a green verdict for a SHA that just became main
  * (src/merge/merge-to-main.ts: either its in-lock post-rebase re-check passed on exactly that
@@ -33,7 +37,7 @@ import { memoSetLru } from "../collections.js";
  * not opt-in only: a red carries the worktrees that observed it (`redFrom`) and is re-run by the
  * next DIFFERENT worktree to consult it, so a single environmental red can no longer block every
  * role until main moves — see shouldRerunRed. */
-const baselineCache = new Map();
+export const baselineCache = new Map();
 /** Safety cap so the per-process verdict cache can never grow unbounded: it is keyed by every
  * merged code SHA and a red entry carries the failed run's output tail, so a team running for
  * weeks would accumulate one entry per merge forever. Evicting the oldest entry (Map's insertion
@@ -150,15 +154,10 @@ function shouldRerunRed(cached, wt, reverifyRed) {
     const seen = cached.redFrom ?? [];
     return seen.length < 2 && !seen.includes(wt);
 }
-/** Record a green baseline verdict for `sha` WITHOUT running anything. The callers are the merge
- * path (src/merge/merge-to-main.ts's verifyMerge) and the stack lander
- * (src/merge/merge-stack.ts' mergeStack) — both call it only after their fast-forward SUCCEEDED,
- * with the exact SHA that just became main: verifyMerge with the POST-rebase head in two cases —
- * its own in-lock re-check just ran this project's declared check green on that tree, or the
- * rebase was a no-op so the review gate's pre-check (which runs outside the merge lock) had
- * already run green on exactly this tree — and mergeStack with the stacked tip when a
- * scope-`batch` check ran green on exactly it (a skipped check seeds nothing, and neither does a
- * merge_blocked stack or a doc-only re-stack that merged without a check of its own). Seeding
+/** Record a green baseline verdict for `sha` WITHOUT running anything. The caller is the merge
+ * path (src/merge/merge-to-main.ts's mergeToMain), called only after its fast-forward SUCCEEDED,
+ * with the exact SHA that just became main.
+ * Seeding
  * here means that once the merge completes — main now points at this very SHA — the next fresh
  * run's checkMainBaseline is a cache hit instead of re-running the full suite on an
  * already-verified tree: for tumwater itself that saves one redundant `npm test` (~1 min) per
@@ -171,11 +170,23 @@ function shouldRerunRed(cached, wt, reverifyRed) {
 export function noteGreenBaseline(sha) {
     rememberBaseline(sha, { status: "green", sha });
 }
+/** Settle `sha`'s red verdict by a re-run of only its failing tests on the same tree
+ * (build-check-rerun.ts; the main watch's confirmation, which replaced a second full run): with
+ * none failing again the SHA is promoted green, as the full re-run's green promoted it — every test
+ * has now passed on this tree — and otherwise the red narrows to the tests that failed again.
+ * Returns the settled verdict, or null when `sha` holds no red to settle. */
+export function settleRedByRerun(sha, failing) {
+    const red = baselineCache.get(sha);
+    if (red?.status !== "red")
+        return null;
+    const settled = failing.length === 0 ? { status: "green", sha } : { ...red, failingTests: [...failing] };
+    rememberBaseline(sha, settled);
+    return settled;
+}
 /** Record an INHERITED green for `sha` (MainBaseline.inheritedFrom): a tree no check ran on, whose
- * only difference from the green-verified `from` is in review-exempt paths. The caller is
- * merge-to-main.ts's verifyMerge, after it skipped the in-lock check because main moved
- * under the gate-verified head only by doc commits. It seeds the head about to become main, as
- * verifyMerge's own noteGreenBaseline calls do. If the fast-forward then fails, the entry is
+ * only difference from the green-verified `from` is in review-exempt paths. It seeds the head
+ * about to become main, as
+ * noteGreenBaseline calls do. If the fast-forward then fails, the entry is
  * still true of that tree and simply never consulted. It never displaces an observed verdict: a
  * check that actually ran on this tree knows more than the carry-over. */
 export function noteInheritedGreen(sha, from) {
@@ -193,7 +204,7 @@ const INHERIT_WALK_MAX = 64;
  * first-parent scans in this module share, spelled the same on purpose so a change to the walk
  * shape (the bound, the `--first-parent` flag) lands once. `inheritedGreen` and `watchedBaseline`
  * walk a commit's ancestors (`${sha}^` / `${tip}^`, the commit itself excluded);
- * `newestGreenAboveBuild` walks `tip` itself and down. Never throws: a git failure is an empty
+ * `newestObservedBaseline` walks `tip` itself and down. Never throws: a git failure is an empty
  * list, and every caller already treats that as a no-inheritance / no-verdict answer. */
 async function firstParentWalk(wt, ref, max) {
     return gitLines(await gitTry(wt, "rev-list", "--first-parent", `--max-count=${max}`, ref));
@@ -261,8 +272,21 @@ export async function watchedBaseline(wt, sha) {
     }
     return null;
 }
-/** How many first-parent commits below main's tip redeployTarget looks at. */
-const REDEPLOY_WALK_MAX = 64;
+/** The newest verdict a check OBSERVED on `tip` or its first-parent ancestors — `tip` itself
+ * first, looking at most INHERIT_WALK_MAX commits down — WITHOUT running anything; null when
+ * there is none. An inherited green is walked past: no check ran on that tree, and a doc edit can
+ * break a test that reads the docs (checkMainBaseline's `observedOnly`). The review gate's
+ * attribution reads this when the main watch verifies main (main-red.ts's watchedMainVerdict):
+ * with `check.mergeCommand` in effect every observed verdict is a full check the watch or
+ * another consumer ran. Never throws: a git failure reads as no verdict. */
+export async function newestObservedBaseline(wt, tip) {
+    for (const sha of await firstParentWalk(wt, tip, INHERIT_WALK_MAX)) {
+        const verdict = baselineCache.get(sha);
+        if (verdict && verdict.inheritedFrom === undefined)
+            return verdict;
+    }
+    return null;
+}
 /** True when the main watch (src/baseline/main-watch.ts) verifies main — the configs where no
  * merge seeds a green verdict (`watchedBaseline`'s doc) and the watch has a check to run: a
  * declared check and a `check.mergeCommand` (or its gate-command fallback) in effect. In this
@@ -273,56 +297,6 @@ const REDEPLOY_WALK_MAX = 64;
 export function watchVerifiesMain(root, config) {
     return detectBuildCheck(root, config) !== null && mergeCommandOf(config) !== undefined;
 }
-/** The newest first-parent commit below `tip`, down to and through `buildSha`, with a green
- * cached verdict — the walk+scan redeployTarget's watched and un-watched branches share. Only
- * their fallback differs: `notOnHistory` when `buildSha` is not on the first-parent walk at all
- * (the caller keeps today's answer, `tip`), `onHistoryNone` when it is but nothing above it is
- * green (watched keeps the build; un-watched keeps `tip`). Never throws: a git failure leaves
- * the walk empty, so the fallback answers. */
-async function newestGreenAboveBuild(wt, tip, buildSha, notOnHistory, onHistoryNone) {
-    const walk = await firstParentWalk(wt, tip, REDEPLOY_WALK_MAX);
-    const buildAt = walk.indexOf(buildSha);
-    if (buildAt === -1)
-        return notOnHistory;
-    for (const sha of walk.slice(0, buildAt)) {
-        if (baselineCache.get(sha)?.status === "green")
-            return sha;
-    }
-    return onHistoryNone;
-}
-/** The commit self-redeploy should run: main's newest first-parent commit with a green full-check
- * verdict in the cache (observed or inherited) that is newer than the running build `buildSha`,
- * looking at most REDEPLOY_WALK_MAX commits down from `tip`.
- *
- * With `watched` false (the default, a project whose main the watch does not verify), a tip the
- * cache has no verdict for is the target as is — the redeployer checks it. A tip whose cached red
- * was observed in the redeployer's mirror worktree (mirrorWorktreePath of `wt`) falls back to the
- * newest older green above the build. Any other red may be another worktree's environmental one,
- * which the redeployer re-verifies; a build that is not a first-parent ancestor of `tip`, or no
- * green, also leaves the tip the target, and the redeployer blocks that commit alone.
- *
- * With `watched` true (watchVerifiesMain), the watch supplies the verdicts and the redeployer only
- * reads them: walk `tip`'s first-parent history down to `buildSha` and return the first commit
- * whose cached verdict is green — a cached red is walked past, never targeted. With no green
- * above the build, target `buildSha` itself, so buildStaleness reads it as not stale and no
- * episode, hold or pre-warm starts until the watch calls a newer commit green. A build that is
- * not a first-parent ancestor of `tip` keeps today's answer (`tip`, which the redeployer
- * checks), as does `watched` false. Every target `watched` picks has a cached green, so
- * mainIsGreen on it is a cache hit and the redeployer starts no suite.
- * The cache holds only full-check verdicts, so a cheaper command's green never makes a commit
- * deployable.
- * Never throws: a git failure leaves the tip as the target. */
-export async function redeployTarget(wt, tip, buildSha, watched = false) {
-    if (watched) {
-        if (tip === "")
-            return tip;
-        return newestGreenAboveBuild(wt, tip, buildSha, tip, buildSha);
-    }
-    const red = baselineCache.get(tip);
-    if (tip === "" || red?.status !== "red" || !(red.redFrom ?? []).includes(mirrorWorktreePath(wt)))
-        return tip;
-    return newestGreenAboveBuild(wt, tip, buildSha, tip, tip);
-}
 /** Verify main's own build/test suite at `wt`'s HEAD — which must be pristine main (the caller
  * is the fresh-run path right after resetWorktreeToMain; a dirty or ahead worktree would
  * measure the wrong thing). Cache hit returns immediately; on miss runs detectBuildCheck +
@@ -451,6 +425,7 @@ function baselineFromOutcome(sha, wt, outcome) {
             script: outcome.script,
             outputTail: outcome.outputTail,
             failingTests: outcome.failingTests ?? [],
+            ...(outcome.failingTestFiles ? { failingTestFiles: outcome.failingTestFiles } : {}),
             redFrom: priorRedFrom.includes(wt) ? priorRedFrom : [...priorRedFrom, wt],
         };
 }
@@ -495,8 +470,8 @@ async function runBaselineOnce(sha, wt, config, onRun, sampleSleep, tier) {
     return { baseline };
 }
 /** Is main green at the mirror worktree's HEAD? The merge path seeds a green verdict for every
- * merged code SHA (noteGreenBaseline — its in-lock post-rebase re-check, or the gate's pre-check
- * when the rebase was a no-op), so the common case is a cache hit. A head that only added doc
+ * merged code SHA (noteGreenBaseline — the stack lander's scope-`batch` check on the merged tip,
+ * or a no-op gate pre-check, so the common case is a cache hit. A head that only added doc
  * commits on top of such a SHA inherits its green (checkMainBaseline's inheritedGreen). The
  * redeployer's cooldown pre-warm asks this for every new head, and those doc heads were most of the
  * harness's baseline runs (247 of 319 over 2026-10-02..12). Otherwise the project's declared check

package/dist/src/baseline/main-guardrails.js

@@ -115,13 +115,17 @@ function redFailingTest(newest) {
     return Array.isArray(newest.failingTests) && typeof newest.failingTests[0] === "string" ? newest.failingTests[0] : undefined;
 }
 /** The blame clause naming the merge the main watch blamed, when the newest `culprit` in the
- * window blames the same sha the phrase names. Owns the blame clause. */
-function redBlameClause(culprit, newest) {
+ * window names the spell's opener or its newest red. Owns the blame clause. */
+function redBlameClause(culprit, startEv, newest) {
     // The blame names the merge the main watch blamed for the red — the same `main_culprit`
     // commit-equals-tip rule the dashboard alert uses (status-polls only publishes a blame whose
     // commit is the derived tip sha), so a red the watch did not blame never borrows another
     // head's culprit. A culprit naming another commit, or none, leaves the phrase as today.
-    const shouldBlame = culprit !== undefined && culprit.commit === newest.sha;
+    // The watch names the commit that OPENED the red (its first red tip since the last green)
+    // even when a later tip re-checks red, so the match accepts the spell's opener as well as the
+    // newest red tip: the opener is what the watch blames for the ongoing spell, and a
+    // pre-fix log that named the newest tip instead still matches its own newest red.
+    const shouldBlame = culprit !== undefined && (culprit.commit === newest.sha || culprit.commit === startEv.sha);
     return shouldBlame
         ? typeof culprit.runner === "string" && culprit.runner.length > 0
             ? `; the main watch blames ${roleLabel(culprit.runner)}'s merge ${shortSha(culprit.commit)}`
@@ -134,9 +138,9 @@ function redBlameClause(culprit, newest) {
  * ignored; a pass (including one naming only quarantined tests, recorded passed) ends the red.
  * The phrase names how long main has had no passing full check, the sha it has been red since,
  * its clock time, the newest red's first failing test when one is named, and — when the newest
- * `main_culprit` in the window blames the same sha the phrase names — the merge the main watch
- * blamed (`; the main watch blames <role>'s merge <sha>`, or `; the main watch blames merge
- * <sha>` when no runner is named), the one rule the dashboard alert and this phrase share.
+ * `main_culprit` in the window names the spell's opener or its newest red tip — the merge the
+ * main watch blamed (`; the main watch blames <role>'s merge <sha>`, or `; the main watch blames
+ * merge <sha>` when no runner is named), the one rule the dashboard alert and this phrase share.
  * Returns null when main is green, or red for RED_MAIN_WARN_MS or less. The per-job work is
  * split into the module-private helpers `scanRedWindow`, `redSpell`, `redSpellDuration`,
  * `redFailingTest` and `redBlameClause`, one per job, so each is found by name. */
@@ -148,7 +152,7 @@ export function redMainWarning(events, now) {
     const duration = redSpellDuration(spell);
     const head = `main has had no passing full check for ${duration}: red since ${shortSha(spell.startEv.sha)} at ${clockHm(spell.startEv.ts)}`;
     const failing = redFailingTest(spell.newest);
-    const blame = redBlameClause(window.culprit, spell.newest);
+    const blame = redBlameClause(window.culprit, spell.startEv, spell.newest);
     return failing ? `${head} — ${squash(failing, 120)}${blame}` : `${head}${blame}`;
 }
 /** G3 over `entries` (the loadQuarantine list): warns when the list holds more than

package/dist/src/baseline/main-red.js

@@ -1,17 +1,20 @@
+import path from "node:path";
 import { baseRoleOf } from "../roles/runner-ids.js";
-import { enqueueRolePrompt } from "../inbox/inbox.js";
+import { enqueueRolePrompt, queuedRolePromptRecords } from "../inbox/inbox.js";
+import { cancelQueuedFile } from "../inbox/inbox-cancel.js";
 import { liveConfig } from "../config/config.js";
-import { mergeCommandOf } from "../build/build-check-detect.js";
+import { mergeCommandOf, rerunCommandOf } from "../build/build-check-detect.js";
+import { canRerun, rerunCommandLine, rerunTests } from "../build/build-check-rerun.js";
 import { failureHeadline, FAILING_TESTS_MAX } from "../build/build-check-report.js";
 import { baselineCheckEventLogger } from "../build/build-check-events.js";
-import { checkMainBaseline, watchedBaseline } from "./main-baseline.js";
+import { checkMainBaseline, newestObservedBaseline, watchedBaseline } from "./main-baseline.js";
 import { buildMainRedNote } from "../prompt/gate-notes.js";
 import { logEventBestEffort, warnEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { errorMessage } from "../text/text.js";
 import { mainRedPhrase, plural } from "../text/phrases.js";
 import { clipToWidth } from "../text/text-width.js";
 import { shortSha } from "../text/format.js";
-import { branchHead } from "../git/git.js";
+import { branchHead, headOf, isMergedInto } from "../git/git.js";
 import { gateMainWorktreePath } from "../paths.js";
 import { useWorktree } from "../git/worktree-use.js";
 import { ensureDetachedWorktree } from "../git/worktree.js";
@@ -36,13 +39,14 @@ let lastMainRedSha = null;
  * names, or the red SHA when the red names none. Two red commits with the same failing set send
  * one heal prompt, not one per commit; a green main observed by the ci handoff
  * (`mainRedHealNote`) or the main watch (`clearHealKeyOnGreen`) clears it, so a set that
- * returns after green is healed again. */
+ * returns after green is healed again. The key is per process; what bounds ci's inbox across
+ * restarts is queueHealPrompt's replacement of a waiting heal prompt. */
 let lastHealKey = null;
 /** The failing tests a red verdict names, when the list is complete — non-empty and short of
  * FAILING_TESTS_MAX, which may have been cut short (the same rule as onlyKnownMainFailures).
  * Empty when it names none: main's red is then not a set of known failures, and the heal is
- * keyed to the red SHA rather than a failing set (the event reads "code merges blocked until
- * main is green"). */
+ * keyed to the red SHA rather than a failing set (the event reads "a change whose own check
+ * fails is kept until main moves"). */
 export function namedFailures(red) {
     const tests = red.failingTests ?? [];
     return tests.length > 0 && tests.length < FAILING_TESTS_MAX ? tests : [];
@@ -59,7 +63,8 @@ function redMainMessage(red, action) {
  * lastMainRedSha) so the ci handoff (`mainRedHealNote`) and mainTipVerdict share one guard:
  * whichever observes the red first logs it, the other stays silent. `foundBy` is the role
  * whose path verified the red — when that role is not ci itself, one prompt is enqueued to
- * ci's own inbox so the healer runs on the orchestrator's next poll instead of waiting out
+ * ci's own inbox (replacing a heal prompt already waiting there, queueHealPrompt) so the
+ * healer runs on the orchestrator's next poll instead of waiting out
  * its own interval or deferral; ci finding its own red skips the enqueue because its running
  * run already carries the note and IS the heal (and enqueuing from inside it would queue a
  * second run). A queued per-role prompt makes the role due by itself (`isEligible`,
@@ -81,7 +86,7 @@ function warnMainRedOnce(root, red, foundBy) {
         ...(named.length > 0 ? { failingTests: named } : {}),
         message: named.length > 0
             ? `${mainRedPhrase(red.sha)} (${plural(named.length, "failing test")}: ${clipToWidth(named[0] ?? "", 80)}${named.length > 1 ? `, +${named.length - 1} more` : ""}); changes that add no new failures still merge`
-            : redMainMessage(red, "code merges blocked until main is green"),
+            : redMainMessage(red, "a change whose own check fails is kept until main moves"),
     });
     // The ci role is the healer, and it schedules as an observer, so a red main discovered by any
     // other path could sit unrepaired until ci's own interval or a coincidental wake.
@@ -94,7 +99,7 @@ function warnMainRedOnce(root, red, foundBy) {
     lastHealKey = healKey;
     if (baseRoleOf(foundBy) !== "ci") {
         try {
-            enqueueRolePrompt(root, "ci", mainRedHealPrompt(red.sha));
+            queueHealPrompt(root, mainRedHealPrompt(red.sha));
         }
         catch (err) {
             // Clear the key so a later verification retries the heal. lastMainRedSha stays set, so a
@@ -112,23 +117,96 @@ function warnMainRedOnce(root, red, foundBy) {
  * before the healer consumes the prompt, mainRedHealNote returns undefined (no `<main-red>`
  * note is appended) and the "verify green" clause makes the run a no-op. */
 export function mainRedHealPrompt(sha, detail) {
-    const base = `Main was reported red at commit ${shortSha(sha)}. Verify main is green now; if it is still red, reproduce the failure and land the fix.`;
+    const base = `${HEAL_PROMPT_OPENING}${shortSha(sha)}. Verify main is green now; if it is still red, reproduce the failure and land the fix.`;
     if (!detail)
         return base;
     const tests = detail.failingTests.length > 0 ? ` Failing: ${detail.failingTests.join("; ")}.` : "";
+    const rerun = detail.rerun ? ` ${rerunAdvice(detail.rerun)}` : "";
     const tail = detail.outputTail && detail.outputTail.length > 0 ? ` Output tail: ${detail.outputTail.join(" | ")}` : "";
-    return `${base} The watch named ${shortSha(detail.culprit)} as the commit that turned it red.${tests}${tail}`;
+    return `${base} The watch named ${shortSha(detail.culprit)} as the commit that turned it red.${tests}${rerun}${tail}`;
+}
+/** The heal's one instruction about re-running: the command that runs only main's failing tests,
+ * for reproducing them and for proving the fix, instead of the whole suite. */
+function rerunAdvice(command) {
+    return `Run only the failing tests, to reproduce them and again to prove the fix, with: ${command}`;
+}
+/** How every heal prompt opens: mainRedHealPrompt writes it, and queuedHealPrompts recognizes a
+ * waiting heal prompt in ci's inbox by it and reads back the SHA that follows. */
+const HEAL_PROMPT_OPENING = "Main was reported red at commit ";
+/** The heal prompts waiting in ci's inbox, oldest first: each queue file's basename and the
+ * short SHA it was reported red at. Every other prompt in the inbox (an operator's, a resume's
+ * re-queued non-heal request) is left out. An inbox that cannot be listed is warned and reads
+ * as holding none. */
+function queuedHealPrompts(root) {
+    try {
+        return queuedRolePromptRecords(root, "ci").flatMap((e) => {
+            if (!e.text.startsWith(HEAL_PROMPT_OPENING))
+                return [];
+            const sha = /^[0-9a-f]+(?=\.)/.exec(e.text.slice(HEAL_PROMPT_OPENING.length))?.[0];
+            return sha ? [{ file: e.file, sha }] : [];
+        });
+    }
+    catch (err) {
+        warnEventBestEffort(root, TUMWATER_SOURCE, `could not list ci's inbox for waiting heal prompts: ${errorMessage(err)}`);
+        return [];
+    }
+}
+/** Remove waiting heal prompts from ci's inbox, each logged as a prompt_cancelled under ci
+ * (cancelQueuedFile). Best-effort: a prompt that cannot be removed is warned and stays queued,
+ * so the heal just queued or the green just settled never fails on it. */
+function dropHealPrompts(root, files) {
+    for (const file of files) {
+        try {
+            cancelQueuedFile(root, "ci", file);
+        }
+        catch (err) {
+            warnEventBestEffort(root, TUMWATER_SOURCE, `could not drop the stale heal prompt ${file} from ci's inbox: ${errorMessage(err)}`);
+        }
+    }
+}
+/** Queue `prompt` for the ci healer in place of every heal prompt already waiting. A waiting one
+ * names an older red, and the healer verifies main as it is now whichever prompt it reads, so
+ * one waiting heal prompt is enough: without the replacement each red commit on a long red
+ * added one, and a healer that clears one per run fell 69 behind (2026-10-30 to 11-01). The new
+ * prompt is written first, so a write that fails throws with the older prompts still queued. */
+function queueHealPrompt(root, prompt) {
+    const queued = path.basename(enqueueRolePrompt(root, "ci", prompt));
+    dropHealPrompts(root, queuedHealPrompts(root).filter((p) => p.file !== queued).map((p) => p.file));
+}
+/** Drop each heal prompt waiting in ci's inbox whose red commit `greenSha` contains: main has
+ * passed its check since that red, so the run the prompt would start could only find main
+ * green. A prompt naming a commit `greenSha` does not contain (a red reported on a newer tip)
+ * stays queued. `wt` is any checkout of the repository, for the ancestry check. Called beside
+ * clearHealKeyOnGreen by the main watch's settled green and the ci hand-off's own green.
+ * Never throws. */
+export async function dropHealPromptsCoveredBy(root, wt, greenSha) {
+    const covered = [];
+    for (const { file, sha } of queuedHealPrompts(root)) {
+        if (await isMergedInto(wt, sha, greenSha))
+            covered.push(file);
+    }
+    dropHealPrompts(root, covered);
+}
+/** The command line that re-runs `red`'s named failures on their own (rerunCommandLine), or
+ * undefined when they cannot be re-run alone (canRerun) — the healer is then left to the full
+ * check. */
+function healRerunLine(root, config, red) {
+    const tests = namedFailures(red);
+    const command = canRerun(root, config, tests) ? rerunCommandOf(root, config) : undefined;
+    return command === undefined ? undefined : rerunCommandLine(command, tests, red.failingTestFiles);
 }
 /** Queue the heal prompt for ci with the culprit's detail: the one way a named red-main culprit
  * is answered (Forward, never back, part 4/6): the watch's onCulprit hand-off routes through
  * this, and nothing is ever reverted. (The ci gate's own red-main hand-off is the separate
- * direct `enqueueRolePrompt` in warnMainRedOnce.) Never throws: a prompt that cannot be
+ * queueHealPrompt call in warnMainRedOnce; both replace a heal prompt already waiting.) Never
+ * throws: a prompt that cannot be
  * queued (an unwritable inbox) is warned, like that hand-off guard in warnMainRedOnce — so
  * the watch's onCulprit (whose caller discards the result) cannot derail a watch run or end
  * the orchestrator. */
 export function queueCulpritHeal(root, tip, detail) {
     try {
-        enqueueRolePrompt(root, "ci", mainRedHealPrompt(tip, detail));
+        const rerun = healRerunLine(root, liveConfig(root), { failingTests: [...detail.failingTests], failingTestFiles: detail.failingTestFiles });
+        queueHealPrompt(root, mainRedHealPrompt(tip, { ...detail, ...(rerun ? { rerun } : {}) }));
     }
     catch (err) {
         warnEventBestEffort(root, TUMWATER_SOURCE, `could not queue the heal prompt for ci: ${errorMessage(err)}`);
@@ -138,8 +216,8 @@ export function queueCulpritHeal(root, tip, detail) {
  * that paid for it, with its duration — the gate's build_check sibling, so both halves of the
  * team's deterministic verification are priced in the feed. The one logger for every baseline
  * check this module runs — the ci handoff, the main watch, and mainTipVerdict's tip
- * check (which review.ts's gate and merge-check-failures.ts's attributeRedCheck reach
- * through it) — so the event's shape cannot drift between them. */
+ * check (which the review pre-check reaches through it) — so the event's shape cannot drift
+ * between them. */
 export function baselineCheckLogger(root, role) {
     return baselineCheckEventLogger(role, (event) => logEventBestEffort(root, event));
 }
@@ -164,12 +242,14 @@ export async function mainRedHealNote(root, role, wt) {
         ? { baseline: await watchedBaseline(wt) }
         : await checkMainBaseline(wt, config, baselineCheckLogger(root, role));
     const red = baseline.baseline;
-    if (red?.status === "green")
+    if (red?.status === "green") {
         clearHealKeyOnGreen();
+        await dropHealPromptsCoveredBy(root, wt, red.sha);
+    }
     if (red?.status !== "red")
         return undefined;
     warnMainRedOnce(root, red, role);
-    return buildMainRedNote(red.sha, red.script, failureHeadline(red.outputTail), red.outputTail);
+    return buildMainRedNote(red.sha, red.script, failureHeadline(red.outputTail), red.outputTail, healRerunLine(wt, config, red));
 }
 /** Serializes mainTipVerdict's use of its one worktree: the merge pipeline's verifies run their
  * gates concurrently, and a second gate re-pointing the checkout at a newer main while the first's
@@ -233,7 +313,7 @@ async function verdictAtMainTipIn(root, role, mainBranch, config, forceFresh) {
             return { status: "green", sha: baseline.sha };
         if (baseline?.status === "red") {
             warnMainRedOnce(root, baseline, role);
-            return { status: "red", sha: baseline.sha };
+            return { status: "red", sha: baseline.sha, failingTests: baseline.failingTests ?? [] };
         }
         return {
             status: "unavailable",
@@ -248,3 +328,75 @@ async function verdictAtMainTipIn(root, role, mainBranch, config, forceFresh) {
         return { status: "unavailable", why: errorMessage(err) };
     }
 }
+/** Main's verdict at its tip on a gate's twice-failed check, for an attribution that has to run
+ * something: when the failures name their tests and those can be re-run alone (canRerun), only
+ * they run, in the `_gate-main` mirror at main's tip — a red names the ones that fail there too,
+ * a green says none does. Otherwise, or when the re-run reaches no verdict, main's full check runs
+ * fresh (mainTipVerdict with forceFresh), as before. A re-run is no full check: it never touches
+ * the verdict cache and warns nothing. Never throws. */
+export async function mainTipFailures(root, role, wt, mainBranch, config, failed) {
+    const rerun = failed ? await rerunAtMainTip(root, role, wt, mainBranch, config, failed) : null;
+    return rerun ?? mainTipVerdict(root, role, mainBranch, config, true);
+}
+/** mainTipFailures's re-run alone: `failed`'s tests run on their own in the `_gate-main` mirror at
+ * main's tip, queued behind the gates and the main watch that share it. Null when they cannot be
+ * re-run alone (canRerun) or the re-run reaches no verdict. Never throws. */
+export async function rerunAtMainTip(root, role, wt, mainBranch, config, failed) {
+    if (!canRerun(wt, config, failed.tests))
+        return null;
+    const rerun = await withMainTipWorktree(root, mainBranch, async (mirror) => {
+        const result = await rerunTests(root, role, mirror, config, failed.tests, failed.files);
+        return result ? { result, sha: await headOf(mirror, "HEAD") } : null;
+    }).catch(() => null);
+    if (!rerun)
+        return null;
+    const { result, sha } = rerun;
+    return result.failing.length === 0 ? { status: "green", sha } : { status: "red", sha, failingTests: result.failing };
+}
+/** The main watch's newest observed verdict at or below `tip` (newestObservedBaseline), and
+ * whether it covers `base`: it was observed on `base` itself or on a commit that contains it, so
+ * the tree the change was rebased onto is part of what the watch checked. Shared by the gate's
+ * attribution and the kept change's re-queue, so the two agree on when the wait is over. Never
+ * throws: a git failure reads as not covered. */
+export async function watchVerdictCovering(wt, tip, base) {
+    const verdict = await newestObservedBaseline(wt, tip);
+    const covers = verdict !== null && (verdict.sha === base || (await isMergedInto(wt, base, verdict.sha)));
+    return { verdict, covers };
+}
+/** Main's verdict for attributing a gate check that failed twice, read from the main watch's
+ * verdicts instead of a full check of the gate's own (plans/fast-merge.md part 6/14). The gate
+ * used to run main's whole suite here, queued behind the watch's own runs in `_gate-main`: on
+ * 2026-10-30 that took 166–2,282 s for a 30 s gate, and two of five runs repeated a commit the
+ * watch or an earlier attribution had just checked.
+ *
+ * `base` is the commit the change was rebased onto (its merge-base with main). When the watch's
+ * newest observed verdict covers it (watchVerdictCovering), that verdict answers at once. When the
+ * watch is still behind it, the answer is `awaiting`: the gate keeps the change with no strike
+ * and the merge pipeline re-queues it once the watch catches up. Waiting instead of judging
+ * against an older verdict matters: a commit the watch has not reached yet may be what broke the
+ * test, and the change would be rejected for main's failure.
+ *
+ * `waited` is set on the retry after such a wait, and the gate does not wait twice: after
+ * `covered` the newest observed verdict answers even if main moved past it again; after
+ * `timed_out` (the watch never got there — held, failing, or main's tip only carried doc commits
+ * past its last observed check) main is asked here (mainTipFailures: the gate's `failed` tests
+ * re-run alone on main's tip when they can be, else main's full check). The same fallback answers a
+ * `covered` retry that finds no observed verdict at all. A red is not warned again here: the watch
+ * that observed it reported it. Never throws. */
+export async function watchedMainVerdict(root, role, wt, mainBranch, config, base, waited, failed) {
+    const fallback = () => mainTipFailures(root, role, wt, mainBranch, config, failed);
+    if (waited === "timed_out")
+        return fallback();
+    const tip = await branchHead(root, mainBranch);
+    if (!tip)
+        return { status: "unavailable", why: `${mainBranch} is unreadable` };
+    const { verdict, covers } = await watchVerdictCovering(wt, tip, base);
+    if (verdict && (covers || waited === "covered")) {
+        return verdict.status === "red"
+            ? { status: "red", sha: verdict.sha, failingTests: verdict.failingTests ?? [] }
+            : { status: "green", sha: verdict.sha };
+    }
+    if (waited === "covered")
+        return fallback();
+    return { status: "awaiting", ...(verdict ? { sha: verdict.sha } : {}) };
+}