tumwater 0.4.4 → 0.4.6

package/dist/src/baseline/main-watch.js

@@ -1,6 +1,7 @@
 import { distinctOrdered } from "../collections.js";
-import { checkMainBaseline } from "./main-baseline.js";
-import { baselineCheckLogger, clearHealKeyOnGreen, withMainTipWorktree } from "./main-red.js";
+import { checkMainBaseline, settleRedByRerun } from "./main-baseline.js";
+import { canRerun, rerunTests } from "../build/build-check-rerun.js";
+import { baselineCheckLogger, clearHealKeyOnGreen, dropHealPromptsCoveredBy, withMainTipWorktree } from "./main-red.js";
 import { CHECK_TIER } from "../concurrency/check-permit.js";
 import { FAILING_TESTS_MAX } from "../build/build-check-report.js";
 import { detectBuildCheck } from "../build/build-check-detect.js";
@@ -32,6 +33,14 @@ function mainCheckEvent(baseline, red, quarantined, covered, durationMs) {
 }
 /** The failing tests of each root's newest watch verdict, keyed by root. */
 const knownFailures = new Map();
+/** The commit each root's red spell was opened at, keyed by root — the tip of the first red
+ * verdict since the last green. It stays the named culprit while the spell is open: a later tip
+ * re-checks red (the red never inherits across a doc commit) but did not open it, so it is not
+ * re-attributed. A green verdict clears it, so a red that opens after a green names its own
+ * opener. In-memory only: a restart mid-red loses the spell's opener, and the next settled red
+ * tip then names itself as culprit — the pre-fix behaviour, and a bounded one (one tip per
+ * restart, since a spell's later tips inherit the red and settle without a re-run). */
+const redSpellOpeners = new Map();
 /** Main's known failures: the failing tests of the watch's newest verdict — main's tip, or the
  * nearest tip it checked while the newest head waits — and every quarantined flaky test
  * (review/known-flakes.ts). Empty when the verdict is green, red with no parsed test, or none has
@@ -138,10 +147,14 @@ export function createMainWatch(root, mainBranch, onCulprit) {
                 }
             }
         };
-        /** Run the declared build check on main's tip, re-running a red once and quarantining a flake
-         * whose re-run turns green. Returns the check's result and whether any run actually executed
-         * (false for a cache hit, a skip, or a sleep-spanned run). `config` and `root` are captured
-         * from `watchOnce`. */
+        /** Run the declared build check on main's tip, confirming a red once and quarantining a flake
+         * whose confirmation passes. A red whose failing tests can be re-run on their own (canRerun) is
+         * confirmed by re-running just those tests, so the full check runs once per tip: a test that
+         * passes there is quarantined, and the red narrows to the tests that failed again (or turns
+         * green when none did). A re-run that reaches no verdict leaves the first red standing. Without
+         * a re-run command the whole check runs again, as before. Returns the check's result and
+         * whether any full run actually executed (false for a cache hit, a skip, or a sleep-spanned
+         * run). `config` and `root` are captured from `watchOnce`. */
         async function runBaselineCheck(wt) {
             let ran = false;
             const onRun = baselineCheckLogger(root, TUMWATER_SOURCE);
@@ -150,13 +163,27 @@ export function createMainWatch(root, mainBranch, onCulprit) {
                 onRun(run);
             };
             let check = await checkMainBaseline(wt, config, hook, false, false, undefined, false, CHECK_TIER.merge);
-            if (check.baseline?.status === "red") {
-                const first = check.baseline;
-                check = await checkMainBaseline(wt, config, hook, true, false, undefined, false, CHECK_TIER.merge);
-                // A red the same tree's confirming re-run turns green is a flake: quarantine its tests.
-                if (check.baseline?.status === "green")
-                    quarantineTests(root, first.failingTests, (first.failingTests ?? []).join("\n"));
+            if (check.baseline?.status !== "red")
+                return { check, ran };
+            const first = check.baseline;
+            const named = first.failingTests ?? [];
+            if (canRerun(wt, config, named)) {
+                const rerun = await rerunTests(root, TUMWATER_SOURCE, wt, config, named, first.failingTestFiles, CHECK_TIER.merge);
+                if (rerun) {
+                    // Each test that failed and then passed on this same tree is a flake.
+                    const passed = named.filter((t) => !rerun.failing.includes(t));
+                    if (passed.length > 0)
+                        quarantineTests(root, passed, passed.join("\n"));
+                    const settled = settleRedByRerun(first.sha, rerun.failing);
+                    if (settled)
+                        check = { baseline: settled };
+                }
+                return { check, ran };
             }
+            check = await checkMainBaseline(wt, config, hook, true, false, undefined, false, CHECK_TIER.merge);
+            // A red the same tree's confirming re-run turns green is a flake: quarantine its tests.
+            if (check.baseline?.status === "green")
+                quarantineTests(root, named, named.join("\n"));
             return { check, ran };
         }
         /** The covered-commit count for a main_check event: the first-parent commits between the
@@ -179,24 +206,37 @@ export function createMainWatch(root, mainBranch, onCulprit) {
             logEventBestEffort(root, mainCheckEvent(baseline, red, quarantined, covered, ran ? Date.now() - started : 0));
             return red;
         }
-        /** Name a settled red tip as the culprit: its merging runner, the main_culprit event, and
-         * the onCulprit callback with the tip and its failing tests. */
+        /** Name a settled red tip's spell as the culprit: the merging runner, the main_culprit
+         * event, and the onCulprit callback with the tip and its failing tests. The commit named is
+         * the one that OPENED the red — the first red tip since the last green — not the newest red
+         * tip: a doc-exempt tip that lands after the red opened cannot have changed the suite, so
+         * blaming it would name a merge in the G1 phrase (src/baseline/main-guardrails.ts) and the
+         * ci heal prompt (src/baseline/main-red.ts) that did not break anything. The opener is named
+         * once per spell with the tip's failing tests and, when the newest merged event names the
+         * opener, its runner; while the spell is open a later tip re-settling red re-attributes
+         * nothing. */
         function reportCulprit(baseline) {
-            // The newest head is the culprit ("Every commit is verified on main, part 2/3"): the watch
-            // checks each new red tip, so whatever it found belongs to the head it checked. Once per red
-            // head — lastWatched already holds it, so a later poll does not attribute it again — name
-            // the tip with its own failing tests and, when the newest merged event names it, its runner.
-            const runner = mergingRoleOf(root, baseline.sha);
+            // A red spell that is already open keeps its opener named: the first red tip since the
+            // last green caused the red, so a later tip re-settling red (a doc-exempt tip cannot
+            // change the suite, and a code tip does not open a SECOND spell until a green closed the
+            // first) is not re-attributed — no new event, no new heal prompt (the heal dedup already
+            // re-queues when the failing set returns after a green).
+            if (redSpellOpeners.has(root))
+                return;
+            const culprit = baseline.sha;
+            redSpellOpeners.set(root, culprit);
+            const runner = mergingRoleOf(root, culprit);
             logEventBestEffort(root, {
                 source: TUMWATER_SOURCE,
                 type: "main_culprit",
-                commit: baseline.sha,
+                commit: culprit,
                 ...(runner !== undefined ? { runner } : {}),
                 failingTests: baseline.failingTests ?? [],
             });
             onCulprit?.({
-                commit: baseline.sha,
+                commit: culprit,
                 failingTests: baseline.failingTests ?? [],
+                ...(baseline.failingTestFiles ? { failingTestFiles: baseline.failingTestFiles } : {}),
                 tip: baseline.sha,
             });
         }
@@ -227,13 +267,20 @@ export function createMainWatch(root, mainBranch, onCulprit) {
             // names the whole tip as the culprit, so the two red kinds are judged independently.
             await watchRules(wt, previous, baseline.sha);
             // A settled non-red verdict (a green, or a red naming only quarantined tests) clears the
-            // heal-dedup key, so a failing set that returns after a green main is healed again. A
-            // settled red verdict below does NOT clear it: the heal-dedup key stays set while main
-            // is red.
+            // heal-dedup key, so a failing set that returns after a green main is healed again, and
+            // drops the heal prompts still waiting for a red this tip has passed. A settled red
+            // verdict below does NOT clear it: the heal-dedup key stays set while main is red.
             if (!red) {
                 clearHealKeyOnGreen();
+                await dropHealPromptsCoveredBy(root, wt, baseline.sha);
+                redSpellOpeners.delete(root); // a green closes the red spell; the next red names its own opener
                 return;
             }
+            // The spell's opener is blamed once: the first settled red tip since the last green names
+            // itself, and a later tip re-settling the same open red re-checks the suite without re-
+            // naming the culprit (BUGS.md 2026-10-30 mis-attribution). The map holds the open spell's
+            // opener, so a second red while the spell is still open re-checks without re-naming; a
+            // green clears the entry (above) so a later red names its own opener.
             reportCulprit(baseline);
         });
     }

package/dist/src/budget/budget-fallback-view.js

@@ -4,18 +4,19 @@
  * stage-check.ts). This module owns everything pollBudgetGate does from its `onFallback` seam
  * through the end of the function: the seam/backends walk, the motion key (`resolvedKey`,
  * `fromKey`), the fallback view derivation (`fallbackConfig`), `chainInfo`, and the `pairs`
- * handback list. It no longer moves any tier for a used-up subscription window (part 5d/6): only
- * a spent `maxDailyCostUsd` triggers a move, so the view's one job is the cap's free-seam
- * install. Its one entry reads the inputs pollBudgetGate's first half already resolved and
- * returns the view fields `BudgetGatePoll` carries, so pollBudgetGate keeps its call signature
- * and src/gates/gate-polls.ts's destructure of it is unchanged. The plan references the moved
- * comments carry (part 5b/8, part 5c/8, 6a/7) hold here. */
+ * handback list. It no longer moves any tier for a used-up subscription window (part 5d/6): a
+ * spent `maxDailyCostUsd` moves every priced tier to its free seam, and, at any spend, a tier
+ * whose own primary failed its model check moves to a verified step of its chain
+ * (plans/model-check.md "Fallback"). Its one entry reads the inputs pollBudgetGate's first half
+ * already resolved and returns the view fields `BudgetGatePoll` carries, so pollBudgetGate keeps
+ * its call signature and src/gates/gate-polls.ts's destructure of it is unchanged. The plan
+ * references the moved comments carry (part 5b/8, part 5c/8, 6a/7) hold here. */
 import { MODEL_TIERS, } from "../config/config-schema.js";
 import { modelPairName, pairDailyCost } from "../budget/budget.js";
 import { fallbackServingPair, } from "../budget/fallback-breaker.js";
 import { applyFallbackModel, tierChainSteps, } from "../config/config-fallbacks.js";
 import { seamAgent } from "../config/config-model-selector.js";
-import { withModelOverrides } from "../config/config-views.js";
+import { seamPairName, withModelOverrides } from "../config/config-views.js";
 import { piPairFree, seamFree } from "../pi/pi-models.js";
 import { dayAt } from "../text/datetime.js";
 /** Can the account not take extra usage: some window is rejected, or the newest non-reset
@@ -44,21 +45,41 @@ export function subscriptionBackendOf(x, accounts) {
     const account = accounts(id);
     return account?.billing === "subscription" ? id : null;
 }
+/** The pair a tier's own primary resolves to under the live config — the name the model check
+ * keys it by. */
+function tierPrimaryPair(config, tier) {
+    return seamPairName(withModelOverrides(config, tier, {}));
+}
+/** `base` with each check-moved tier's entry replaced by its verified step. */
+function withCheckMoves(base, checkResolved, checkMoved) {
+    const out = { ...base };
+    for (const tier of checkMoved)
+        out[tier] = checkResolved[tier];
+    return out;
+}
 /** Install `state.fallbackConfig` when the fallback changed the view key: at the cap, the free
  * pair installed top-level and every per-role/reviewer model override dropped, so no seam can
  * reach a priced model. A breaker-demoted fallback keeps the view too: its gate is `paused`,
  * but a run parked in the semaphore when it tripped, the half-open probe, and the merges must
  * still run on the free pair — a demotion must never promote them to the priced model the cap
- * already spent. */
-function installFallbackConfig(a, fromKey) {
+ * already spent. A tier the model check moved (deriveCheckMovedTiers) installs its verified
+ * step at any spend, and only its own primary seams move: every other tier, and a role or
+ * reviewer pinned to some other pair, keeps its model. */
+function installFallbackConfig(a, fromKey, checkMoved) {
     const { state, config: liveConfig, providers, catalog, accounts, priceResolved, reached } = a;
-    if (reached && (state.from !== liveConfig || state.fromKey !== fromKey)) {
+    if ((reached || checkMoved.size > 0) && (state.from !== liveConfig || state.fromKey !== fromKey)) {
         state.from = liveConfig;
         state.fromKey = fromKey;
+        const primaries = new Map([...checkMoved].map((t) => [t, tierPrimaryPair(liveConfig, t)]));
+        const checkKeeps = (seam, tier) => primaries.get(tier) !== seamPairName(seam);
         // At the cap only free seams are available (a subscription claude seam is free money), so
         // every role/reviewer override that resolves to a priced seam drops to the fallback pair.
-        const available = (seam) => seamFree(providers, seam, accounts, catalog);
-        state.fallbackConfig = applyFallbackModel(liveConfig, priceResolved, available);
+        const keeps = reached
+            ? (seam, tier) => seamFree(providers, seam, accounts, catalog) && checkKeeps(seam, tier)
+            : checkKeeps;
+        // The cap's base view is the check-aware resolution while the check is on (a cap-moved
+        // tier's failed step stays out of the config its roles run under), else the price view.
+        state.fallbackConfig = applyFallbackModel(liveConfig, withCheckMoves(a.checkFreeResolved ?? priceResolved, a.checkResolved, checkMoved), keeps);
     }
 }
 /** The tiers `applyFallbackModel` moved at the cap: those whose own seam fails the `available`
@@ -73,28 +94,64 @@ function deriveMovedTiers(a) {
     }
     return movedTiers;
 }
+/** The tiers the model check moves (plans/model-check.md "Fallback"): a tier still on its own
+ * primary — every tier below the cap, at it only one the cap leaves in place (`capMoved` holds
+ * the rest) — whose primary failed its check while the tier's verified-only resolution has a
+ * step to run on. A tier whose primary failed with no verified step stays held on it. */
+function deriveCheckMovedTiers(a, capMoved) {
+    const moved = new Set();
+    if (a.checkResolved === undefined || a.checkFailed === undefined)
+        return moved;
+    for (const tier of MODEL_TIERS) {
+        if (capMoved.has(tier) || a.checkResolved[tier].pair === null)
+            continue;
+        if (a.checkFailed(tierPrimaryPair(a.config, tier)))
+            moved.add(tier);
+    }
+    return moved;
+}
 /** Derive the fallback view for one poll from the verdict half's already-resolved inputs
- * (`priceResolved`, `servingResolved`, `chainPairs`, `pairNames`) and the `reached` flag and
- * the shared reads (`state`, `config`, `accounts`, `providers`, `catalog`), writing the
- * cross-poll view state (`from`/`fromKey`/`fallbackConfig`) and returning the view fields
- * pollBudgetGate hands back. The director always keeps the live config (part 5d/6): with the
- * window move gone no input moves it, so `directorConfig` is the live config by construction. */
+ * (`priceResolved`, `servingResolved`, `checkResolved`, `checkFreeResolved`, `chainPairs`,
+ * `pairNames`) and the `reached` flag and the shared reads (`state`, `config`, `accounts`,
+ * `providers`, `catalog`), writing the cross-poll view state (`from`/`fromKey`/
+ * `fallbackConfig`) and returning the view
+ * fields pollBudgetGate hands back. The view is installed at the cap, and below it while a tier
+ * the model check moved runs on its verified step; `onFallback` (the image-reroute regime) stays
+ * the cap's alone. The director always keeps the live config (part 5d/6): with the window move
+ * gone no input moves it, so `directorConfig` is the live config by construction. */
 export function budgetFallbackView(a) {
     const { state, config: liveConfig, reached, priceResolved } = a;
     const onFallback = reached && a.pairNames.length > 0;
+    const movedTiers = deriveMovedTiers(a);
+    const checkMoved = deriveCheckMovedTiers(a, movedTiers);
     // The resolved pairs are part of the key: a priced step crossing its own daily cap changes
-    // the resolution without a config or window change, and the view must follow it.
+    // the resolution without a config or window change, and the view must follow it. So are the
+    // model check's moves, appended only while there are some.
     const resolvedKey = MODEL_TIERS.map((t) => {
         const rp = priceResolved[t].pair;
         return rp ? modelPairName(rp) : "-";
     }).join(",");
-    const fromKey = `${reached ? "c" : ""}|${resolvedKey}`;
-    installFallbackConfig(a, fromKey);
-    const movedTiers = deriveMovedTiers(a);
+    const checkKey = MODEL_TIERS.map((t) => (checkMoved.has(t) ? modelPairName(a.checkResolved[t].pair) : "-")).join(",");
+    // The cap view's check-aware pairs follow the price pairs when present: a check verdict
+    // failing or clearing a step changes the installed config without a price change, so the
+    // view must re-install on the next poll. Absent while the check is off, so the key is
+    // unchanged then.
+    const checkFreeKey = a.checkFreeResolved
+        ? "|" +
+            MODEL_TIERS.map((t) => {
+                const rp = a.checkFreeResolved[t].pair;
+                return rp ? modelPairName(rp) : "-";
+            }).join(",")
+        : "";
+    const fromKey = `${reached ? "c" : ""}|${resolvedKey}${checkMoved.size > 0 ? `|${checkKey}` : ""}${checkFreeKey}`;
+    installFallbackConfig(a, fromKey, checkMoved);
     const chain = chainInfo({
         config: liveConfig,
-        resolved: a.servingResolved,
-        moved: movedTiers,
+        resolved: withCheckMoves(a.servingResolved, a.checkResolved, checkMoved),
+        moved: new Set([...movedTiers, ...checkMoved]),
+        checkMoved,
+        ...(a.checkFailed !== undefined ? { modelCheckFailed: a.checkFailed } : {}),
+        ...(a.checkVerified !== undefined ? { modelCheckVerified: a.checkVerified } : {}),
         breakers: state.breakers,
         states: a.states,
         now: a.now,
@@ -104,16 +161,20 @@ export function budgetFallbackView(a) {
     return {
         onFallback,
         chain,
-        roleConfig: onFallback ? state.fallbackConfig : liveConfig,
+        roleConfig: onFallback || checkMoved.size > 0 ? state.fallbackConfig : liveConfig,
         pairs: distinctPairs(priceResolved, a.chainPairs),
         directorConfig: liveConfig,
+        checkMoved,
     };
 }
 /** The `chain` block: for each tier this poll moved off its primary, the step it runs on and
  * why the position before it cannot run (plans/fallback-chain.md "Events and surfaces").
  * `moved` names the tiers the poll moved; a tier the gate pauses (`pair: null`) gets no entry.
  * The reason is read from the position just before the active step — the previous chain step,
- * or the tier's primary at step 0 — in the order demoted, step-cap, overage, cap. */
+ * or the tier's primary at step 0 — in the order demoted, step-cap, overage, model-check, cap.
+ * `checkMoved` names the moved tiers whose primary failed its model check rather than the cap
+ * moving them; the model check's verdicts say whether a previous step failed (or, for such a
+ * tier, which moves only to verified steps, has not answered yet). */
 export function chainInfo(a) {
     const out = {};
     const steps = tierChainSteps(a.config);
@@ -127,7 +188,7 @@ export function chainInfo(a) {
             pair: modelPairName(r.pair),
             step: position.step,
             of: position.of,
-            ...movedTierReason(a, position.prior, position.priorName, midnight),
+            ...movedTierReason(a, tier, position.prior, position.priorName, midnight),
         };
         Object.assign(info, movedTierSpend(a, r.pair));
         out[tier] = info;
@@ -146,10 +207,11 @@ function movedTierPosition(steps, tier, r) {
     return { step: idx + 1, of: own.length, prior, priorName: prior ? modelPairName(prior) : "" };
 }
 /** Why the position before the active step cannot run, in INV-BN1's fixed order (demoted,
- * step-cap, overage, cap). A demoted or overage result carries no `returnsAt`; a step-cap or
+ * step-cap, overage, model-check, cap). A demoted, overage or model-check result carries no
+ * `returnsAt` (a model check lifts when a re-check answers, not at a clock time); a step-cap or
  * cap result pins it to `midnight` (INV-BN2: local midnight only for step-cap and cap).
  * Answers "why can't the position before the active step run, and when does it come back?". */
-function movedTierReason(a, prior, priorName, midnight) {
+function movedTierReason(a, tier, prior, priorName, midnight) {
     if (prior && a.breakers[priorName] !== undefined && !fallbackServingPair(a.breakers, priorName)) {
         return { reason: "demoted" };
     }
@@ -163,6 +225,12 @@ function movedTierReason(a, prior, priorName, midnight) {
         claudeOverageRefused(a.accounts("claude"))) {
         return { reason: "overage" };
     }
+    const checkMoved = a.checkMoved?.has(tier) === true;
+    const priorChecked = prior === null
+        ? checkMoved
+        : a.modelCheckFailed?.(priorName) === true || (checkMoved && a.modelCheckVerified?.(priorName) !== true);
+    if (priorChecked)
+        return { reason: "model-check" };
     return { reason: "cap", returnsAt: midnight };
 }
 /** What the active step has spent against its own cap: both keys absent unless the step is a

package/dist/src/build/build-check-detect.js

@@ -119,9 +119,8 @@ export function detectBuildCheck(startDir, config, maxLevels = WALK_UP_LEVELS) {
 /** The configured per-change gate command (`check.gateCommand`, PLANS.md Land-queue speed 3e) when
  * it is a non-blank string, else undefined — off. Opt-in: when no `mergeCommand` is declared, a
  * project that sets one merges on it, not the full check (mergeCommandOf's fallback, PLANS.md
- * "Fast merge" "Defaults"). One reading shared by runScopedBuildCheck (which runs it at scope
- * "gate") and merge-to-main.ts's verifyMerge (which must then never treat the gate's green as the
- * full check's), so the two cannot disagree about whether it is on. */
+ * "Fast merge" "Defaults"). One reading every caller shares (runScopedBuildCheck runs it at
+ * scope "gate"), so none can disagree about whether it is on. */
 export function gateCommandOf(config) {
     const g = config?.check?.gateCommand;
     return isNonBlankString(g) ? g : undefined;
@@ -141,6 +140,26 @@ export function mergeCommandOf(config) {
         return gateCommandOf(config);
     return isNonBlankString(m) ? m : undefined;
 }
+/** The npm script the re-run of named tests auto-detects (rerunCommandOf). */
+const RERUN_SCRIPT = "test:rerun";
+/** The command that re-runs only named tests (`check.rerunCommand`, build-check-rerun.ts), or
+ * undefined — off, and its callers run the full check instead. A configured non-blank string
+ * wins; a blank one (`""`) is the explicit opt-out. Absent, a project whose check is the npm
+ * walk-up (no `check.command`) re-runs with `npm run test:rerun --` when the package.json the
+ * walk-up finds declares that script, so an npm project opts in from its own manifest. Never
+ * throws. */
+export function rerunCommandOf(startDir, config) {
+    const r = config?.check?.rerunCommand;
+    if (r !== undefined)
+        return isNonBlankString(r) ? r : undefined;
+    if (isNonBlankString(config?.check?.command))
+        return undefined;
+    const root = walkUp(startDir, WALK_UP_LEVELS, (dir) => (hasInstall(dir) ? dir : null));
+    if (root === null)
+        return undefined;
+    const scripts = readJsonFile(path.join(root, "package.json"))?.scripts;
+    return isJsonObject(scripts) && isCheckScript(scripts, RERUN_SCRIPT) ? `npm run ${RERUN_SCRIPT} --` : undefined;
+}
 /** Resolve `node_modules/<rel>` by walking UP from `startDir` — the same climb detectBuildCheck
  * makes, and the same one npm's run-script PATH walk makes: a tumwater worktree has no install
  * of its own (node_modules is gitignored, so it exists only where someone ran npm install), and

package/dist/src/build/build-check-events.js

@@ -8,6 +8,7 @@
  * runScopedBuildCheck (build-check-scoped.ts) is the only caller that both runs a check and
  * uses this wording; the baseline surfaces use the event/warning helpers alone. */
 import { logEventBestEffort } from "../events/events.js";
+import { hostLoadStarved } from "./host-sleep.js";
 /** Does this build_check scope stand for a full-suite verdict — merge, batch, or the red-main
  * baseline? A gate check can run a subset of the tree, so a scope outside this set is never a
  * full-suite check. The one vocabulary the three predicates that recognize a full-suite check
@@ -143,16 +144,36 @@ const STARVED_DEADLINE_MAX_FACTOR = 2;
  * firing on time under the team's own load, with a passing tail at 299.97 s — the check was
  * measuring the load, not the tree (BUGS.md 2026-10-12). */
 export function starvedDeadlineMs(baseMs, load) {
-    if (!(load.cpus > 0) || !(load.load1 > load.cpus))
+    if (!hostLoadStarved(load))
         return baseMs;
     return Math.round(baseMs * Math.min(load.load1 / load.cpus, STARVED_DEADLINE_MAX_FACTOR));
 }
+/** The reviewed diff's size against which the post-merge reviewer's wall stretches. Calibrated
+ * to the class this exists for: the largest-diff member (BUGS-FIXED.md "post-merge review of
+ * 3b682bed …", a 270/247-line split, ~41 KB of diff) timed out 21× at the 900 s wall even after
+ * the load-only stretch landed, so a diff of that size must already sit past the reference and
+ * earn the 2× factor. It is deliberately NOT the reviewer's own `DIFF_MAX_BYTES` diff cap
+ * (src/git/git-diff.ts, 200 KB): that cap bounds the prompt's text, not how many turns a
+ * strong-tier review of the diff needs, and it sits well above every diff that has timed out,
+ * so referencing it would stretch none of the class's members. */
+export const REVIEW_DIFF_REFERENCE_BYTES = 20_000;
+/** The budget the post-merge reviewer's wall gets for the reviewed diff's size: `baseMs` at or
+ * under REVIEW_DIFF_REFERENCE_BYTES (see its calibration), and above it the overage ratio capped
+ * at STARVED_DEADLINE_MAX_FACTOR — the same cap as the load stretch, so load and diff each
+ * contribute at most 2× and a wedged review's quiet-watchdog wall is untouched (it is
+ * independent of the run budget). A review of a large diff needs the diff's proportionally more
+ * turns, so a wall that ignores its size kills a progressing review before its VERDICT. */
+export function diffScaledMs(baseMs, diffBytes) {
+    if (!(diffBytes > REVIEW_DIFF_REFERENCE_BYTES))
+        return baseMs;
+    return Math.round(baseMs * Math.min(diffBytes / REVIEW_DIFF_REFERENCE_BYTES, STARVED_DEADLINE_MAX_FACTOR));
+}
 /** The note an on-time deadline kill carries when the host was starved: the load average
  * beyond the core count means the check shared the machine with the rest of the team, so the
  * 300 s kill is a statement about the deadline under load, not a measured verdict on the
  * change (BUGS.md 2026-10-12). Empty when the host had a core to spare. */
 export function loadedHostPhrase(load) {
-    if (!(load.cpus > 0) || !(load.load1 > load.cpus))
+    if (!hostLoadStarved(load))
         return "";
     return ` (host load average ${Math.round(load.load1)} on ${load.cpus} cores: the check ran starved, so the kill says nothing about the change itself)`;
 }
@@ -187,9 +208,8 @@ export function installFailedPhrase(label, install, proceeding) {
 /** Did this outcome make no verdict about the tree? runScopedBuildCheck records that verdict-
  * less shape explicitly (`unverified: true`) at the merge scopes; a gate-scope failure carries
  * only the run's own sleep evidence (BuildCheckRun.sleptMs), so both spellings count. The
- * consumers that attribute a red — review.ts's gate, merge-check-failures.ts's attribution, the
- * red-main baseline — ask this instead of re-deriving the evidence, so the attribution policy
- * cannot drift between them (BUGS.md 2026-09-30). */
+ * consumer that attributes a red — the review gate (review-precheck.ts) — asks this instead of
+ * re-deriving the evidence, so the attribution policy cannot drift (BUGS.md 2026-09-30). */
 export function unverifiedTreeOutcome(outcome) {
     return outcome.unverified === true || (outcome.run?.sleptMs ?? 0) > SLEEP_SPAN_TOLERANCE_MS;
 }

package/dist/src/build/build-check-report.js

@@ -47,7 +47,7 @@ export function parseFailingTests(output) {
         const line = raw.trim();
         if (!FAILED_TEST_LINE.test(line))
             continue;
-        const title = line.slice(2).replace(/ \([\d.]+m?s\)$/, "").trim();
+        const title = resultTitle(line);
         if (title !== "")
             titles.add(title);
         if (titles.size >= FAILING_TESTS_MAX)
@@ -55,6 +55,43 @@ export function parseFailingTests(output) {
     }
     return [...titles];
 }
+/** A failed test's line title: the `✖ ` mark and the trailing duration stripped. */
+function resultTitle(line) {
+    return line.slice(2).replace(/ \([\d.]+m?s\)$/, "").trim();
+}
+/** A failure's location line in node:test's `✖ failing tests:` section, printed right above the
+ * failed test's `✖` line: `test at <file>:<line>:<col>`. */
+const FAILED_TEST_AT = /^test at (.+):\d+:\d+$/;
+/** The file each failing test lives in, keyed by the title parseFailingTests reports, read from the
+ * `test at <file>:<line>:<col>` line node:test's `✖ failing tests:` section prints above each
+ * failure. A file is named by its base name without the extension (`merger.test` for
+ * dist/test/merger.test.js): the form a re-run's `<file>#<name>` filter takes, the same in
+ * every worktree. A title whose location the output does not print is absent. */
+export function parseFailingTestFiles(output) {
+    const files = new Map();
+    let at;
+    for (const raw of output.split("\n")) {
+        const line = raw.trim();
+        const location = FAILED_TEST_AT.exec(line);
+        if (location) {
+            at = location[1];
+            continue;
+        }
+        if (at !== undefined && FAILED_TEST_LINE.test(line)) {
+            const title = resultTitle(line);
+            if (title !== "" && !files.has(title))
+                files.set(title, fileStem(at));
+        }
+        at = undefined;
+    }
+    return Object.fromEntries(files);
+}
+/** A test file's base name without its extension, from a path or a `file://` URL. */
+function fileStem(file) {
+    const base = file.replace(/^file:\/\//, "").split(/[\\/]/).pop() ?? "";
+    const dot = base.lastIndexOf(".");
+    return dot > 0 ? base.slice(0, dot) : base;
+}
 /** Keep the TAIL of a build's combined output: last ≤10 meaningful lines, each via clipReason —
  * so a chatty build cannot bloat persisted state or the injected next-run note. Blank lines
  * and npm's own script banner (`> pkg@1.0 script`, `> <command>`) are dropped: they name the
@@ -127,10 +164,9 @@ export function describeCheck(check) {
 }
 /** The single-line headline of a red check — the failureHeadline when the tail has one to
  * offer (a test name or marker plus a non-framing message), else the check's describeCheck
- * command name — the name the gate, merge, and review warnings print for a failed check.
+ * command name — the name the gate and review warnings print for a failed check.
  * One definition for every red that names itself to a human: review-precheck's two
- * flake/failure warnings, merge-to-main's merge-retry quarantine warning, and
- * merge-check-failures's kept-pin headline record and attributeRedCheck absent-tail headline.
+ * flake/failure warnings.
  */
 export function redCheckHeadline(check, tail) {
     return failureHeadline(tail) ?? describeCheck(check);

package/dist/src/build/build-check-rerun.js

@@ -0,0 +1,62 @@
+/** Re-running only named failing tests (`check.rerunCommand`, rerunCommandOf), instead of the whole
+ * check: the main watch confirms a red tip with it, and the review gate asks it whether a change's
+ * failing tests also fail on main. The full check runs at most once per main commit — the watch's
+ * own run — and every later question about the same failures is answered in seconds by running
+ * just those tests. Split out of build-check.ts, which keeps running and classifying the declared
+ * check: this module only builds the narrower command and reads back which named tests still
+ * fail. */
+import { runBuildCheck } from "./build-check.js";
+import { BUILD_CHECK_TIMEOUT_MS, detectBuildCheck, rerunCommandOf } from "./build-check-detect.js";
+import { FAILING_TESTS_MAX } from "./build-check-report.js";
+import { buildCheckEvent } from "./build-check-events.js";
+import { CHECK_TIER, withCheckPermit } from "../concurrency/check-permit.js";
+import { logEventBestEffort } from "../events/events.js";
+import { shellQuote } from "../agent/write-guard.js";
+/** The re-run's filter arguments, one per test: `<file>#<name>`, with the file's base name from
+ * the failure output (BuildCheckOutcome.failingTestFiles). When any test's file is unknown every
+ * argument is a bare `#<name>`: a runner that selects files by the named ones would otherwise
+ * never load the unlocated test. */
+function rerunFilters(tests, files) {
+    const located = tests.every((t) => files?.[t] !== undefined);
+    return tests.map((t) => `${located ? files?.[t] : ""}#${t}`);
+}
+/** The shell command that re-runs `tests`: `command` followed by each filter, single-quoted. The
+ * line the harness runs, and the one a heal prompt hands an agent to reproduce the failures. */
+export function rerunCommandLine(command, tests, files) {
+    return [command, ...rerunFilters(tests, files).map(shellQuote)].join(" ");
+}
+/** Can `tests` be re-run on their own: a re-run command is in effect at `wt` and the list is
+ * complete — non-empty and short of FAILING_TESTS_MAX, which may have been cut short. */
+export function canRerun(wt, config, tests) {
+    return tests.length > 0 && tests.length < FAILING_TESTS_MAX && rerunCommandOf(wt, config) !== undefined;
+}
+/** Re-run only `tests` in `wt` under the process-wide check permit, logged as a `rerun`-scope
+ * build_check event under `source`. Null when no verdict came of it: no re-run command, an
+ * incomplete list (canRerun), a skipped run (timeout, kill, broken toolchain, a host sleep), or a
+ * failure that names none of `tests` — a compile error, a test file that would not load, or a
+ * filter that matched nothing. Never throws. */
+export async function rerunTests(root, source, wt, config, tests, files, tier = CHECK_TIER.other) {
+    const command = canRerun(wt, config, tests) ? rerunCommandOf(wt, config) : undefined;
+    if (command === undefined)
+        return null;
+    const check = detectBuildCheck(wt, { ...config, check: { ...config?.check, command: rerunCommandLine(command, tests, files) } });
+    if (check === null)
+        return null;
+    try {
+        const started = Date.now();
+        const outcome = await withCheckPermit(config, tier, () => runBuildCheck(wt, check, BUILD_CHECK_TIMEOUT_MS), undefined, `${source} rerun`);
+        logEventBestEffort(root, buildCheckEvent(source, "rerun", outcome, Date.now() - started));
+        if (outcome.status === "passed")
+            return { failing: [] };
+        if (outcome.status !== "failed")
+            return null;
+        // A failure naming none of the tests asked about (a test file that would not load names
+        // itself) says nothing about them.
+        const named = outcome.failingTests ?? [];
+        const failing = tests.filter((t) => named.includes(t));
+        return failing.length > 0 ? { failing } : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/src/build/build-check-scoped.js

@@ -50,7 +50,16 @@ async function runScopedCheckWithRetry(root, role, scope, wt, runCheck, timeoutM
         waiting: () => permitWait?.waiting?.(),
         granted: () => permitWait?.granted?.(),
         waited: (waitedMs, parked) => logCheckWaitEvent(root, role, scope, waitedMs, parked),
-    }, `${role} ${scope}`);
+    }, `${role} ${scope}`, 
+    // A check whose caller was stopped (a user abort, a lapsed restart hand-off, a shutdown) while
+    // it waited for a permit settles the way a mid-run abort does, without spawning: otherwise
+    // the grant would run the whole suite for a merge that no longer exists, holding a permit
+    // other checks need. A check granted a free permit under a fired signal still runs (see
+    // PermitWaitAbort).
+    {
+        signal,
+        outcome: () => ({ status: "skipped", script: checkScriptName(runCheck), skipReason: "aborted" }),
+    });
     return { raw, durationMs };
 }
 /** Classify the raw outcome: the merge-scope skip and slept-through rules become a deterministic
@@ -163,7 +172,9 @@ function warnScopedCheck(root, role, scope, outcome, effectiveMs, durationMs, un
  * `check.mergeCommand` when set, else `check.gateCommand`, else the full check — replaces it at the
  * merge and batch scopes, and those events then carry `full: false`. The red-main baseline, which
  * detects on its own, keeps running check.command. `permitWait` hears
- * about a wait for the check permit (the merge cell's "waiting for a check slot"). Never throws. */
+ * about a wait for the check permit (the merge cell's "waiting for a check slot"). `signal` firing
+ * mid-run stops the check's tree, and firing while the check waits for its permit ends the wait
+ * unspawned — both settle `skipped` with skipReason "aborted". Never throws. */
 export async function runScopedBuildCheck(root, role, scope, wt, config, timeoutMs = BUILD_CHECK_TIMEOUT_MS, sampleSleep = sampleSleepClock, install = npmInstall, permitWait, sampleLoad = sampleHostLoad, signal) {
     const r = resolveScopedCheck(wt, scope, config, timeoutMs, sampleLoad);
     if (!r)