tumwater 0.1.2 → 0.2.0

package/dist/src/agent/mcp/role-notes-server.js

@@ -1,160 +0,0 @@
-/**
- * claude's `role_notes` surface (plans/agent-backends.md "What the pi extensions did, per
- * backend"): a dependency-free stdio MCP server shipped in dist. claude does not load pi's
- * bundled extensions, so the claude adapter passes this server via `--mcp-config` whenever the
- * run carries a notebook, and the model calls `mcp__tumwater__role_notes`. It is MCP rather
- * than "edit this file" because the notebook lives under `.tumwater/`, which the prompts
- * forbid touching, and because every future agent CLI speaks MCP.
- *
- * The write path is shared with the pi extension (src/agent/role-notes-write.ts), so the 4 KB
- * cap, the parameter schema, and the atomic write are the same on both backends. Only the
- * JSON-RPC framing lives here.
- *
- * Transport is the MCP stdio convention: one JSON-RPC 2.0 message per line on stdin/stdout,
- * and nothing else on stdout (logs would corrupt the stream). The server exits when stdin
- * closes — exactly the lifetime claude gives a configured MCP server.
- */
-import { pathToFileURL } from "node:url";
-import { errorMessage } from "../../text/text.js";
-import { ROLE_NOTES_DESCRIPTION, ROLE_NOTES_PARAMETERS, saveRoleNote } from "../role-notes-write.js";
-const SERVER_NAME = "tumwater";
-const SERVER_VERSION = "0.1.0";
-const DEFAULT_PROTOCOL_VERSION = "2024-11-05";
-const ROLE_NOTES_TOOL = "role_notes";
-/** Handle one JSON-RPC line and return the response line to write, or null for a
- * notification (no `id`). `notesPath` is the server's own TUMWATER_NOTES_PATH. */
-function handleMcpLine(line, notesPath) {
-    let msg;
-    try {
-        msg = JSON.parse(line);
-    }
-    catch {
-        return errorResponse(null, -32700, "Parse error");
-    }
-    if (msg === null || typeof msg !== "object" || Array.isArray(msg)) {
-        return errorResponse(null, -32600, "Invalid Request");
-    }
-    const method = msg.method;
-    // A message with no method is a response to a request the server never sends; the CLIENT
-    // does not send one, so ignoring it is correct. A notification (no id) is answered with
-    // nothing in every case.
-    if (typeof method !== "string")
-        return null;
-    const id = msg.id;
-    const isNotification = id === undefined || id === null;
-    const result = (value) => ({ jsonrpc: "2.0", id, result: value });
-    const respond = (value) => (isNotification ? null : result(value));
-    switch (method) {
-        case "initialize": {
-            const params = (msg.params ?? {});
-            const requested = typeof params.protocolVersion === "string" ? params.protocolVersion : DEFAULT_PROTOCOL_VERSION;
-            return respond({
-                protocolVersion: requested,
-                capabilities: { tools: {} },
-                serverInfo: { name: SERVER_NAME, version: SERVER_VERSION },
-            });
-        }
-        case "notifications/initialized":
-        case "notifications/cancelled":
-            return null;
-        case "ping":
-            return respond({});
-        case "tools/list":
-            return respond({
-                tools: [
-                    {
-                        name: ROLE_NOTES_TOOL,
-                        description: ROLE_NOTES_DESCRIPTION,
-                        inputSchema: ROLE_NOTES_PARAMETERS,
-                    },
-                ],
-            });
-        case "tools/call": {
-            const params = (msg.params ?? {});
-            if (params.name !== ROLE_NOTES_TOOL) {
-                return respond(toolError(`unknown tool ${JSON.stringify(params.name)}; this server exposes ${ROLE_NOTES_TOOL}`));
-            }
-            if (notesPath === undefined) {
-                return respond(toolError("no notebook path is configured for this run"));
-            }
-            const args = (params.arguments ?? {});
-            try {
-                return respond({ content: [{ type: "text", text: saveRoleNote(notesPath, args.text) }] });
-            }
-            catch (err) {
-                // Per MCP, a tool's own failure (bad input, a write error) is a successful JSON-RPC
-                // response carrying isError, so the model sees a tool error and can retry — while a
-                // JSON-RPC error would read as a transport failure of the whole server.
-                return respond(toolError(errorMessage(err)));
-            }
-        }
-        default:
-            return isNotification ? null : errorResponse(id, -32601, `Method not found: ${method}`);
-    }
-}
-function toolError(text) {
-    return { content: [{ type: "text", text }], isError: true };
-}
-function errorResponse(id, code, message) {
-    return { jsonrpc: "2.0", id: id ?? null, error: { code, message } };
-}
-/** The largest buffered stdin line before the server treats the stream as malformed. This
- * server only ever receives small control frames (the tool it exposes caps its `text` at 4 KB),
- * so a message this size is not a legitimate request. Past it the buffered line is discarded
- * and resynchronized on the next newline (the same policy the agent runner's
- * MAX_NATIVE_LINE_CHARS applies to a byte stream with no newline), so a client that streams
- * bytes without ever terminating a line cannot grow the buffer until the process is OOM-killed. */
-export const MAX_MCP_LINE_CHARS = 1024 * 1024;
-/** Wire the handler to stdin/stdout and exit on EOF. */
-function runRoleNotesServer() {
-    const notesPath = process.env.TUMWATER_NOTES_PATH;
-    let buffer = "";
-    // Set when a buffered line passed MAX_MCP_LINE_CHARS without a newline: the rest of that
-    // line is then skipped through its newline so the stream resynchronizes on the next frame.
-    let overflow = false;
-    const flush = (line) => {
-        if (line.trim() === "")
-            return;
-        const response = handleMcpLine(line, notesPath);
-        if (response !== null)
-            process.stdout.write(JSON.stringify(response) + "\n");
-    };
-    /** Answer an over-cap frame with the JSON-RPC parse error its unparseable line would have
-     * produced, so the client sees a malformed request rather than a dead server. */
-    const discardOversized = () => {
-        buffer = "";
-        overflow = true;
-        const message = `Parse error: frame exceeded ${MAX_MCP_LINE_CHARS / (1024 * 1024)} MiB without a newline`;
-        process.stdout.write(JSON.stringify(errorResponse(null, -32700, message)) + "\n");
-    };
-    process.stdin.setEncoding("utf8");
-    process.stdin.on("data", (chunk) => {
-        buffer += chunk;
-        if (overflow) {
-            const nl = buffer.indexOf("\n");
-            if (nl < 0) {
-                buffer = ""; // Still inside the discarded frame; keep the buffer bounded.
-                return;
-            }
-            overflow = false;
-            buffer = buffer.slice(nl + 1);
-        }
-        let nl;
-        while ((nl = buffer.indexOf("\n")) >= 0) {
-            flush(buffer.slice(0, nl));
-            buffer = buffer.slice(nl + 1);
-        }
-        if (buffer.length > MAX_MCP_LINE_CHARS)
-            discardOversized();
-    });
-    process.stdin.on("end", () => {
-        // A discarded over-cap frame has no complete line to flush.
-        if (!overflow && buffer !== "")
-            flush(buffer);
-    });
-}
-// Only run the transport when executed as the server; importing this module (the tests) must
-// not attach stdin handlers. import.meta.url is the compiled file claude spawns by path.
-if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href) {
-    runRoleNotesServer();
-}

package/dist/src/landing/backlog-conflicts.js

@@ -1,116 +0,0 @@
-/** Deterministic first pass over a conflicted rebase for the backlog markdown files
- * (plans/parallel-work-instances.md, "Insert-only backlog conflicts", part 3/7).
- *
- * The move guidance pastes every finished entry as the first one under `## Done` or
- * `## Fixed`, so two landings off the same base insert different entries at the same
- * location. Git's diff3 conflict for that shape has an empty base section and both sides
- * non-empty; keeping both inserted sides adds no authored bytes, so no model run is
- * needed. Anything else — the same entry edited on both sides, a code file, a deleted
- * side — goes to the pi resolver untouched. */
-import fs from "node:fs";
-import path from "node:path";
-import { BACKLOG_FILES } from "../backlog/backlog-md.js";
-import { writeTextAtomic } from "../files/files.js";
-import { git } from "../git/git-run.js";
-/** Rewrite every insert-only conflict hunk in `text` and return the result, or null when any
- * hunk is not insert-only (or the markers are malformed) — the caller then leaves the file
- * for the model resolver. A hunk is insert-only when its base section is empty and both sides
- * carry lines; it is replaced by the change's (theirs) lines, a blank separator when neither
- * side already supplies one, then main's (ours) lines, so the later landing stays first. */
-export function resolveInsertOnlyText(text) {
-    const lines = text.split("\n");
-    const hunks = parseHunks(lines);
-    if (hunks === null)
-        return null;
-    if (hunks.length === 0)
-        return null;
-    for (const hunk of hunks) {
-        if (hunk.base.length !== 0 || hunk.ours.length === 0 || hunk.theirs.length === 0)
-            return null;
-    }
-    // Replace from the end so earlier indices stay valid.
-    for (const hunk of [...hunks].sort((a, b) => b.start - a.start)) {
-        const separated = hunk.theirs[hunk.theirs.length - 1] === "" || hunk.ours[0] === "";
-        const replacement = separated
-            ? [...hunk.theirs, ...hunk.ours]
-            : [...hunk.theirs, "", ...hunk.ours];
-        lines.splice(hunk.start, hunk.end - hunk.start + 1, ...replacement);
-    }
-    return lines.join("\n");
-}
-/** Split `lines` into conflict hunks. Returns null when a marker sequence is malformed (an
- * unterminated hunk, or a missing `|||||||`/`=======`), so the caller can bail out. */
-function parseHunks(lines) {
-    const hunks = [];
-    let i = 0;
-    while (i < lines.length) {
-        if (!lines[i].startsWith("<<<<<<<")) {
-            i++;
-            continue;
-        }
-        const start = i;
-        const ours = [];
-        const base = [];
-        const theirs = [];
-        // Consume each side up to its marker (the `<<<<<<<` line itself is skipped by starting
-        // at i + 1); a missing marker means the diff3 hunk is malformed and the parse aborts.
-        const afterOurs = collectUntilMarker(lines, i + 1, "|||||||", ours);
-        if (afterOurs === null)
-            return null; // no base marker
-        const afterBase = collectUntilMarker(lines, afterOurs, "=======", base);
-        if (afterBase === null)
-            return null; // no separator
-        const afterTheirs = collectUntilMarker(lines, afterBase, ">>>>>>>", theirs);
-        if (afterTheirs === null)
-            return null; // no end marker
-        hunks.push({ start, end: afterTheirs - 1, ours, base, theirs });
-        i = afterTheirs;
-    }
-    return hunks;
-}
-/** Append lines from `start` into `into` until one starts with `marker` (the marker itself is
- * consumed, not kept), and return the index just past it. Returns null when no line from
- * `start` on carries the marker — the malformed-hunk signal parseHunks turns into a bail-out.
- * The one home of the drain-until-marker step shared by parseHunks's three sides, so the
- * marker-consumption rule cannot drift between `|||||||`, `=======`, and `>>>>>>>`. */
-function collectUntilMarker(lines, start, marker, into) {
-    let i = start;
-    while (i < lines.length && !lines[i].startsWith(marker))
-        into.push(lines[i++]);
-    return i >= lines.length ? null : i + 1;
-}
-/** Settle the insert-only conflicts among `files` in `wt` (plans/parallel-work-instances.md,
- * part 3/7): every conflicted repo-root PLANS.md, BUGS.md or QUESTIONS.md whose hunks are all
- * insert-only is rewritten without markers and staged. Returns the files still conflicted —
- * every file that was not fully settled, including non-backlog files and files with any other
- * hunk — so the caller runs the model resolver only over those. */
-export async function resolveBacklogInsertConflicts(wt, files) {
-    const remaining = [];
-    for (const file of files) {
-        if (path.dirname(file) !== "." || !BACKLOG_FILES.has(file)) {
-            remaining.push(file);
-            continue;
-        }
-        const p = path.join(wt, file);
-        let text;
-        try {
-            text = fs.readFileSync(p, "utf8");
-        }
-        catch {
-            remaining.push(file); // deleted side or unreadable path — leave it to the resolver
-            continue;
-        }
-        const resolved = resolveInsertOnlyText(text);
-        if (resolved === null) {
-            remaining.push(file);
-            continue;
-        }
-        // Atomic (tmp + rename): a landing process killed mid-write (SIGKILL, the timeout
-        // group-kill) must leave either the conflicted file or the fully resolved one, never a
-        // truncated backlog — the CLI's backlog writers (backlog-write.ts, question-commands.ts)
-        // already write these unbounded-history files through this helper.
-        writeTextAtomic(p, resolved);
-        await git(wt, "add", "--", file);
-    }
-    return remaining;
-}

package/dist/src/landing/landing-drain.js

@@ -1,204 +0,0 @@
-import { landVetted } from "./landing-batch.js";
-import { removeLandingChange, resolveWaitStage, setLandingChangeStatus } from "./landing-slot.js";
-import { dropLanding, queuedLandingFiles } from "./landing-queue.js";
-import { errorMessage } from "../text/text.js";
-import { warnEventBestEffort } from "../events/events.js";
-import { saveLoopState } from "../loop/loop-state.js";
-import { abortOnShutdown, discardPinnedRefs, guardLandingTask, settleLandingOutcome, } from "./landing-pipeline.js";
-import { drainVetting, LANDING_TIER } from "./landing-vetting.js";
-/** The tier the merge slot's conflict-resolution runs wait at: ahead of any vet parked for a
- * permit, because the merge is the one serial step every queued change waits on. (Nothing that
- * holds a permit ever waits on the merge: no vet takes the merge lock, and the resolver runs
- * outside it — landing-merge.ts's mergeToMain — so this cannot deadlock.) */
-const MERGE_TIER = LANDING_TIER - 1;
-/** One poll of the land queue (the scheduler's WHEN: after the gates, never while a restart or
- * a fleet hold is pending): start a vet for every queued change the pipeline does not already
- * hold (drainVetting, in landing-vetting.ts), and start the merge when the slot is free and
- * something is vetted (drainMerge). A queued landing is COMMITTED work awaiting completion, not
- * a new tick, so the budget and user-pause gates deliberately do not hold it (pausing it would
- * leave main behind while the interlock blocks that role's next tick forever). Starts tasks and
- * returns; never awaits them — authors keep ticking behind them, which is the entire point. */
-export async function drainLandings(ctx, p) {
-    await drainVetting(ctx, p);
-    drainMerge(ctx, p);
-}
-/** Settle every vetted change `tumwater abort --role` flagged (consumeAbortRequests over
- * abortableLandings): it has no task to stop, so it ends here exactly as an aborted landing
- * does — "aborted" written back, entry dropped, pin discarded (the deliberate stop throws the
- * committed work away). The scheduler runs it every poll right after consuming the requests,
- * held or not: a restart hold that skipped it would hand the flagged change, pin intact, to
- * the next generation to land.
- *
- * Unlike a vet or a merge, this settles in the poll body with nothing to guard it: a throw out
- * of the outcome write — an unwritable state file — would end the fleet's run. It must also
- * never leave the deliberately aborted change queued (an abandoned queue file would be
- * re-vetted and landed next poll, against the operator's intent) or keep its pin. So a failed
- * write is reported and the abort honored by hand: queue file and marker dropped, pin
- * discarded. */
-export async function settleAbortedVetted(root, p) {
-    for (const [role, v] of [...p.vetted]) {
-        if (!v.userAborted)
-            continue;
-        p.vetted.delete(role);
-        try {
-            await settleLandingOutcome(root, v.entry, v.author.state, "aborted", Date.now() - v.startedAt, v.usage, v.file);
-        }
-        catch (err) {
-            warnEventBestEffort(root, "harness", `the aborted landing for ${role} could not be settled: ${errorMessage(err)}`);
-            dropLanding(v.file);
-            removeLandingChange(root, role);
-        }
-        await discardPinnedRefs(root, [role]);
-    }
-}
-/** Start the merge when the slot is free and something is vetted: every vetted change, up to
- * landBatchMax, in queue order among the vetted — an unvetted entry ahead of them in the queue
- * (a slow review) does not hold them back. A vetted change whose queue entry is gone is
- * forgotten (nothing in-process drops one; defensive). */
-export function drainMerge(ctx, p) {
-    if (p.merge !== null || p.vetted.size === 0)
-        return;
-    const queued = queuedLandingFiles(ctx.root);
-    const files = new Set(queued.map((q) => q.file));
-    for (const [role, v] of [...p.vetted]) {
-        if (files.has(v.file))
-            continue;
-        p.vetted.delete(role);
-        removeLandingChange(ctx.root, role);
-    }
-    const picks = queued.flatMap((q) => {
-        const v = p.vetted.get(q.entry.role);
-        return v?.file === q.file ? [v] : [];
-    });
-    picks.splice(ctx.liveConfig.landBatchMax);
-    if (picks.length === 0)
-        return;
-    for (const v of picks)
-        p.vetted.delete(v.entry.role);
-    p.merge = startMerge(ctx, p, picks);
-}
-/** The merge task — main's one writer in the pipeline: land `picks` through landVetted on
- * main's current tip — one change through landApprovedChange, two or more as one stack with one
- * scope-`batch` check, one fast-forward, and 3d's largest-passing-prefix bisect — with no second
- * review. A vetted change whose main moved since its vet is re-checked on the tree that lands
- * (the in-lock re-check, or the stack's check), so an approval that outlived its base never
- * lands unverified. Each defined result is written back and its entry dropped; an unattempted
- * change (behind a bisect's attributed one) goes back to `vetted` for the next merge. A plumbing
- * throw keeps every entry queued, but un-vetted: each is vetted afresh from its pin next poll. A
- * user abort of any merged role stops the whole stack, and every change it had not landed ends
- * "aborted" with its pin discarded; a shutdown keeps the pins. The task takes no permit of its
- * own — its only model run is mergeToMain's conflict resolver, which takes a shared permit at
- * MERGE_TIER for the run's length, outside the merge lock. */
-function startMerge(ctx, p, picks) {
-    const { root, mainBranch, signal, roleConfig, semaphore } = ctx;
-    const merge = {
-        promise: Promise.resolve(), // Replaced below; the placeholder satisfies the type.
-        controller: new AbortController(),
-        roles: picks.map((v) => v.entry.role),
-        userAborted: false,
-    };
-    const detachShutdown = abortOnShutdown(signal, merge.controller);
-    const wiring = new Map(picks.map((v) => [
-        v.entry.role,
-        {
-            state: v.author.state,
-            foldUsage: v.foldUsage,
-            runGatePi: (opts) => v.author.runGatePi(opts),
-            runPi: async (w, prompt, s, cfg) => {
-                // A parked resolver names its wait (resolve-wait, then resolving once granted) the way
-                // a parked check does (withCheckPermit): on 2026-10-12 one waited 2.5 min for a permit
-                // with the merge queue behind it, reading as "merging". tryAcquire is acquire's own
-                // fast path for this tier (MERGE_TIER ignores the maintenance reserve).
-                if (!semaphore.tryAcquire()) {
-                    const hooks = resolveWaitStage(root, v.entry.role);
-                    hooks.waiting();
-                    await semaphore.acquire(MERGE_TIER);
-                    hooks.granted();
-                }
-                try {
-                    return await v.author.runLandingPi(w, prompt, s, cfg);
-                }
-                finally {
-                    semaphore.release();
-                }
-            },
-        },
-    ]));
-    const task = (async () => {
-        let results;
-        let threw = false;
-        // A result reaches settleLandingOutcome the moment landVetted finalizes it, not after the
-        // whole batch; this set lets the end-of-batch loop skip what is already written back.
-        const settled = new Set();
-        const settleOne = async (s, result) => {
-            const v = picks[s];
-            settled.add(s);
-            await settleLandingOutcome(root, v.entry, v.author.state, result, Date.now() - v.startedAt, v.usage, v.file);
-        };
-        try {
-            results = await landVetted({
-                root,
-                mainBranch,
-                config: roleConfig,
-                signal: () => merge.controller.signal,
-                onChangeStatus: (role, status) => setLandingChangeStatus(root, role, status),
-                onResult: settleOne,
-                runGatePi: (opts) => picks[0].author.runGatePi(opts),
-            }, picks.map((v) => ({
-                role: v.entry.role,
-                sha: v.sha,
-                tick: v.entry.tick,
-                summary: v.entry.summary,
-                body: v.entry.body,
-                highFriction: v.entry.highFriction,
-                ...(v.entry.revisionRound !== undefined ? { revisionRound: v.entry.revisionRound } : {}),
-                ...(v.entry.priorReview !== undefined ? { priorReview: v.entry.priorReview } : {}),
-                ...(v.verifiedHead !== undefined ? { verifiedHead: v.verifiedHead } : {}),
-            })), (role) => wiring.get(role));
-        }
-        catch (err) {
-            threw = true;
-            results = picks.map(() => undefined);
-            const head = picks[0].author;
-            head.state.lastError = errorMessage(err);
-            // The catch exists to keep every entry queued and un-vetted when landVetted throws. A
-            // throw out of this write — an unwritable state file — must not skip the settle loop
-            // and the finally that frees the merge slot, or the pipeline wedges with p.merge set
-            // forever; the write is bookkeeping a later save retries, so warn and keep going.
-            try {
-                saveLoopState(root, head.state);
-            }
-            catch (writeErr) {
-                warnEventBestEffort(root, "harness", `the merge error for ${head.state.role} could not be saved: ${errorMessage(writeErr)}`);
-            }
-        }
-        try {
-            for (let s = 0; s < picks.length; s++) {
-                const v = picks[s];
-                const { role } = v.entry;
-                if (settled.has(s))
-                    continue; // already written back through onResult
-                const result = results[s] ?? (merge.userAborted ? "aborted" : undefined);
-                if (result === undefined && !threw) {
-                    p.vetted.set(role, v);
-                    setLandingChangeStatus(root, role, "vetted");
-                    continue;
-                }
-                if (result !== undefined) {
-                    await settleOne(s, result);
-                }
-                else {
-                    removeLandingChange(root, role);
-                }
-            }
-        }
-        finally {
-            detachShutdown();
-            if (merge.userAborted)
-                await discardPinnedRefs(root, merge.roles);
-            p.merge = null;
-        }
-    })();
-    merge.promise = guardLandingTask(root, merge.roles.join(", "), task);
-    return merge;
-}

package/dist/src/landing/landing-pipeline.js

@@ -1,96 +0,0 @@
-import { runOnAbort } from "../process/process.js";
-import { warnEventBestEffort } from "../events/events.js";
-import { errorMessage } from "../text/text.js";
-import { deleteRef } from "../git/git.js";
-import { removeLandingChange, writeLandingOutcome } from "./landing-slot.js";
-import { landingRefName, rejectedRefName } from "../paths.js";
-/** A fresh pipeline: nothing in flight anywhere — no vet running, no approved change waiting,
- * no merge holding main. The orchestrator builds one per fleet start (orchestrator.ts). */
-export function newLandingPipeline() {
-    return { vetting: new Map(), vetted: new Map(), merge: null };
-}
-/** Every landing task in flight — each vet holding its permit, and the merge — for the shutdown
- * and restart waits. A parked vet is not one of them: it has started nothing, and a shutdown
- * (its controller) or a closed start gate (at its grant) settles it without a run. */
-export function landingTasks(p) {
-    return [...[...p.vetting.values()].filter((v) => !v.parked), ...(p.merge ? [p.merge] : [])];
-}
-/** Everything `tumwater abort --role` can reach: every task in flight, plus each vetted change
- * waiting with no task of its own. A parked vet is out of reach, as a plainly queued entry
- * always was: its change has not started landing. */
-export function abortableLandings(p) {
-    return [...landingTasks(p), ...p.vetted.values()];
-}
-/** Wire harness shutdown to one task's own controller — through the shared register/abort
- * race helper, so an already-fired signal aborts at once. Returns the detach function. The
- * fleet shutdown signal outlives every landing, so each task that settles while the signal is
- * still live must detach in its own finally; without that, the one long-lived signal
- * accumulates a listener (and the retained controller behind it) for every landing the fleet
- * ever runs, growing without bound until the shutdown it was waiting for. */
-export function abortOnShutdown(signal, controller) {
-    return runOnAbort(signal, () => controller.abort());
-}
-/** Wrap a landing task's stored promise so it can never reject: the tasks are fire-and-forget
- * during normal operation (only the shutdown/restart drain awaits them), and an unexpected
- * throw out of their bookkeeping — an unwritable state file, event feed, or marker while
- * settling an outcome — would otherwise surface as an unhandled rejection and take the
- * orchestrator down. The throw is reported best-effort; the task's own finally has already
- * released its slot and controller, and the surviving queue entry and pin recover on the next
- * poll. */
-export function guardLandingTask(root, role, promise) {
-    return promise.catch((err) => {
-        warnEventBestEffort(root, "harness", `landing task for ${role} could not settle: ${errorMessage(err)}`);
-    });
-}
-/** Take a permit at `tier` unless `signal` fires first: resolves to its release, or to null
- * when the signal won — a grant that arrives after that is handed straight back (a hop, never
- * a leak), so a parked vet that a shutdown settles holds nothing. */
-export async function acquireUnlessAborted(semaphore, tier, signal) {
-    if (signal.aborted)
-        return null;
-    const granted = semaphore.acquire(tier).then(() => true);
-    const stopped = new Promise((resolve) => signal.addEventListener("abort", () => resolve(false), { once: true }));
-    if (await Promise.race([granted, stopped]))
-        return () => semaphore.release();
-    void granted.then(() => semaphore.release());
-    return null;
-}
-/** The roles the pipeline holds right now — vetting (parked or not), vetted, or merging. */
-export function liveRoles(p) {
-    return new Set([...p.vetting.keys(), ...p.vetted.keys(), ...(p.merge?.roles ?? [])]);
-}
-/** Discard the pinned landing refs of every role in a deliberately-aborted landing.
- * `tumwater abort --role` throws the committed work away, and the pin is what would otherwise
- * recover it, so the ref must go; a shutdown abort leaves `userAborted` unset and every ref
- * survives for recovery. Shared by every task's settling code so their discard semantics
- * cannot drift. A ref that is already gone is not an error. */
-export async function discardPinnedRefs(root, roles) {
-    for (const role of roles) {
-        try {
-            await deleteRef(root, landingRefName(role));
-        }
-        catch {
-            /* already gone */
-        }
-    }
-}
-/** Settle a landing queue entry that reached a terminal outcome — the one home of the
- * write-plus-drop pairing every settled landing goes through: the result lands in the role's
- * state and the landed/land_failed event (writeLandingOutcome), then the change's marker record
- * is dropped (removeLandingChange — landing-slot leaves the marker to the caller). Shared by
- * settleAbortedVetted, the vet's final-verdict branch, and the merge's per-change write-back, so
- * no settled entry can keep a stale marker or lose its outcome write. The pinned-ref discard
- * stays with the callers: only a user abort throws work away, and the merge discards its whole
- * stack at once rather than change by change. */
-export async function settleLandingOutcome(root, entry, state, result, durationMs, usage, file) {
-    writeLandingOutcome(root, entry, state, result, durationMs, usage, file);
-    // A revision that lands ends the rejected change's life: drop the rejected ref (plans/revise-
-    // rejected.md). A rejection repoints or deletes it in landing-core.ts, so this is the only
-    // ref cleanup a landed revision needs here. Guarded on the entry's revisionRound, not just a
-    // `changed` result: a fresh change can land while a different rejection's revision is still
-    // pending, and its landing must leave that pending revision's ref alone.
-    if (result === "changed" && entry.revisionRound !== undefined) {
-        await deleteRef(root, rejectedRefName(entry.role));
-    }
-    removeLandingChange(root, entry.role);
-}

package/dist/src/landing/landing-queue-render.js

@@ -1,31 +0,0 @@
-/** The renderer behind `tumwater queue` — the operator-facing text for the land queue view the
- * reader gathers (landing-queue.ts's readLandingQueue, beside it): one line per queued landing
- * in execution order, plus the count of queue files the reader skipped. Pure function of the
- * collected view and a `now` instant — no I/O, no clock reads — so the age it prints can be
- * pinned by a test. */
-import { humanSeconds, secondsSince } from "../text/datetime.js";
-import { shortSha } from "../text/format.js";
-import { plural } from "../text/phrases.js";
-/** Render the queue as the text `tumwater queue` prints: a `land queue (<depth>):` header then
- * one 1-based line per readable entry, oldest first, carrying the loop, tick number, short
- * pinned sha, age, and summary. An empty queue (no entries and nothing skipped) prints
- * `land queue empty`; a non-zero skip count appends one `(+N unreadable queue file(s) skipped)`
- * line so a torn or foreign file the reader dropped is visible rather than silent. */
-export function renderLandingQueue(view, now) {
-    const depth = view.entries.length + view.unreadable;
-    const lines = [];
-    if (depth === 0) {
-        lines.push("land queue empty");
-    }
-    else {
-        lines.push(`land queue (${depth}):`);
-        view.entries.forEach((e, i) => {
-            const age = humanSeconds(secondsSince(e.enqueuedAt, now));
-            lines.push(`  ${i + 1}. ${e.role} tick #${e.tick} · ${shortSha(e.sha)} · ${age} ago · ${e.summary}`);
-        });
-    }
-    if (view.unreadable > 0) {
-        lines.push(`  (+${plural(view.unreadable, "unreadable queue file")} skipped)`);
-    }
-    return lines.join("\n");
-}