tumwater 0.1.2 → 0.2.0

package/dist/src/gates/budget-gates.js

@@ -2,16 +2,21 @@
  * fallback config view it derives, as the orchestrator polls it each cycle. Extracted from
  * orchestrator.ts's poll loop: the spend check, the fallback breaker's re-key, the
  * edge-triggered budget_* events, and the fallback view derivation are one concern beside the
- * other fleet gates (src/gates/pause-gates.ts, src/fleet/fleet-hold.ts's fleet hold) — the
+ * other team gates (src/gates/pause-gates.ts, src/team/team-hold.ts's team hold) — the
  * orchestrator owns only the wiring (the demotion publish and the per-runner config assignment). */
 import { MODEL_TIERS } from "../config/config-schema.js";
-import { budgetGate, budgetReached, budgetSpend, budgetWarning, modelPairName, } from "../budget/budget.js";
+import { budgetGate, budgetReached, budgetSpend, budgetWarning, modelPairName, pairDailyCost, } from "../budget/budget.js";
 import { fallbackServingPair, rekeyFallbackBreakers, } from "../budget/fallback-breaker.js";
-import { applyFallbackModel, fallbackPair, resolveTierFallbacks, tierFallbackLabels, tiersResolveDistinctPairs, } from "../config/config-views.js";
+import { applyFallbackModel, fallbackPair, resolveTierFallbacks, tierChainSteps, tierFallbackLabels, tiersResolveDistinctPairs, } from "../config/config-fallbacks.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
-import { logEventBestEffort } from "../events/events.js";
+import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
+import { enabledRoleIds } from "../config/config.js";
+import { formatModelSelector, seamAgent } from "../config/model-selector.js";
+import { configForRole, isTierName, reviewConfig, roleSeamTier, withModelOverrides } from "../config/config-views.js";
 import { piPairFree, readPiProviders, seamFree } from "../pi/pi-models.js";
-import { readClaudeAccount } from "../agent/claude/claude-account.js";
+import { readOpencodeCache } from "../agent/opencode/opencode-catalog.js";
+import { claudeWindowUsedUp, readClaudeAccount } from "../agent/claude/claude-account.js";
+import { dayAt } from "../text/datetime.js";
 /** A fresh budget-gate poll state: gate open, no fallback breakers yet, no fallback view cached
  * yet (so the first poll of an unchanged config logs nothing). */
 export function newBudgetGateState(config) {
@@ -20,10 +25,33 @@ export function newBudgetGateState(config) {
         breakers: {},
         engaged: null,
         from: null,
+        fromKey: "",
+        prevWindowMoved: false,
+        directorFrom: null,
+        directorView: config,
+        directorKey: "",
         fallbackConfig: config,
         warned: false,
+        prevChain: {},
     };
 }
+/** Is this fallback pair a claude one (the agent namespace in the pair's provider)? */
+function pairIsClaude(p) {
+    return p.provider === "claude";
+}
+/** Can the account not take extra usage: some window is rejected, or the newest non-reset
+ * window's `overageStatus` is `rejected`. */
+function claudeOverageRefused(account) {
+    const live = Object.values(account.windows).filter((w) => w.status !== "reset");
+    if (live.some((w) => w.status === "rejected"))
+        return true;
+    const newest = live.reduce((a, w) => (a === null || w.observedAt > a.observedAt ? w : a), null);
+    return newest?.overageStatus === "rejected";
+}
+/** Does this model seam route to the claude backend? */
+function seamIsClaude(seam) {
+    return seamAgent(seam) === "claude";
+}
 /** Does an in-flight tick's captured model pair (LoopRunner.tickModel()) match the fallback
  * pair a reopening budget gate just left? The orchestrator hands back exactly those ticks
  * (PLANS.md 2026-09-30): both sides must be present — no fallback pair means no tick ran on
@@ -36,16 +64,18 @@ export function tickOnPair(tickModel, pair) {
         tickModel.provider === pair.provider &&
         tickModel.model === pair.model);
 }
-/** The config a runner runs on while the budget gate stands: the director keeps the live
- * config — an explicit human prompt outranks the autonomous-spend cap — and every other role
- * takes the gate's derived view (pollBudgetGate's returned `roleConfig`). Single home for the
- * rule, so the scheduler's per-poll assignment (src/gates/gate-polls.ts) and a throwaway landing
- * author's construction (src/landing/landing-vetting.ts's resolveAuthor) cannot drift apart —
- * say, an exemption granted to one more role in one copy and not the other. */
-export function gateRoleConfig(role, liveConfig, roleConfig) {
-    return role === DIRECTOR_ROLE ? liveConfig : roleConfig;
+/** The config a runner runs on while the budget gate stands: the director keeps the live config —
+ * an explicit human prompt outranks the autonomous-spend cap — except while a used-up window has
+ * its own subscription claude model unable to run, when it takes `directorConfig` (pollBudgetGate's
+ * view: the tier's fallback pair; omitted means the live config). Every other role takes the gate's
+ * derived view (pollBudgetGate's returned `roleConfig`). Single home for the rule, so the
+ * scheduler's per-poll assignment (src/gates/gate-polls.ts) and a throwaway merge author's
+ * construction (src/merge/merge-verify.ts's resolveAuthor) cannot drift apart — say, an exemption
+ * granted to one more role in one copy and not the other. */
+export function gateRoleConfig(role, liveConfig, roleConfig, directorConfig = liveConfig) {
+    return role === DIRECTOR_ROLE ? directorConfig : roleConfig;
 }
-/** Poll the daily cost budget gate: once the fleet's spend for the local day has reached
+/** Poll the daily cost budget gate: once the team's spend for the local day has reached
  * maxDailyCostUsd, role loops either switch to the configured cost-free fallback model and
  * keep working, or — with no usable one — start no new ticks at all (scheduled, main-moved
  * wake, or startup). The director is outside both: an explicit human prompt outranks the
@@ -66,20 +96,54 @@ export function pollBudgetGate(state, ctx) {
     const reviewOn = liveConfig.review.enabled;
     // Whether the fallback is usable is a live question too: models.json is stat-cached
     // inside pi-models.ts, so an unchanged catalog costs one stat per poll, and an operator
-    // who fixes a mistyped model id sees the fleet switch over within a cycle. One snapshot
+    // who fixes a mistyped model id sees the team switch over within a cycle. One snapshot
     // serves both the engaged pair's check and the per-tier resolution below.
     const providers = readPiProviders(modelsPath);
     // The persisted billing answer (6a/7): a subscription claude seam is free money, so the
     // predicates below never move it to a fallback and accept a subscription claude pair as a
     // budget fallback. One read per poll; an absent file reads as "no subscription".
     const account = readClaudeAccount(root);
+    // The cached opencode models catalog (part 6b/7), seeded at the startup gate and read once
+    // per poll so every free-ness verdict below prices opencode seams against the same snapshot.
+    // Absent (no cache yet), an opencode seam reads NOT free — the safe direction until the
+    // startup seed fills the file in.
+    const catalog = readOpencodeCache(root);
     // The usable predicate's two halves (part 5b/8): pi prices the pair at zero — a pair
     // routed to a non-pi backend (e.g. `claude/<id>`) is never free, the same predicate the
     // badge uses — and its breaker entry holds no demotion, tiers sharing a pair share the
     // verdict. The resolution below deliberately prices alone (the map's keys are the pairs
     // that would run absent a demotion, so a demotion cannot churn them); part 5c/8 wires the
     // full predicate into the resolution so a demoted pair re-resolves only the tiers using it.
-    const pairFreeAt = (p) => piPairFree(providers, p.provider, p.model, account);
+    // A used-up subscription window (claudeWindowUsedUp, the rule the team hold reads too): while
+    // it stands a subscription claude pair is no fallback — it would meet the same window.
+    // `claudeWindowReserve` makes a window past its fraction count as used up for the team; the
+    // director's own reading (directorWindowOut) ignores it, as it runs the operator's prompts.
+    const windowOut = claudeWindowUsedUp(account, now, true, liveConfig.claudeWindowReserve);
+    const directorWindowOut = claudeWindowUsedUp(account, now);
+    // A priced step (one pi does not price at zero, or claude on API billing) is usable only
+    // while the team is under its cap and the step is under its own `maxDailyCostUsd`, so no cap
+    // can be passed; at the cap only free steps remain, as before.
+    const pairFreeAt = (p) => {
+        if (account?.billing === "subscription" && pairIsClaude(p)) {
+            // The first Claude model runs on the subscription only; a later one (extraUsage) may
+            // spend extra usage within its cap while no window is rejected or refuses overage.
+            if (!p.extraUsage)
+                return windowOut === null && piPairFree(providers, p.provider, p.model, account, catalog);
+            // Past the reserve this step would spend the reserved quota before reaching extra usage:
+            // it waits until a reading shows the account already spending overage.
+            if (windowOut?.reserve === true && !Object.values(account.windows).some((w) => w.isUsingOverage === true))
+                return false;
+            return (!reached &&
+                !claudeOverageRefused(account) &&
+                (p.maxDailyCostUsd === undefined || pairDailyCost(states, modelPairName(p), now) < p.maxDailyCostUsd));
+        }
+        if (piPairFree(providers, p.provider, p.model, account, catalog))
+            return !(windowOut !== null && pairIsClaude(p));
+        if (reached)
+            return false;
+        return (p.maxDailyCostUsd === undefined ||
+            pairDailyCost(states, modelPairName(p), now) < p.maxDailyCostUsd);
+    };
     // The breaker map is keyed by every pair the tiers would run on absent a demotion
     // (resolveTierFallbacks over the price check alone), re-keyed per pair each poll: a pair's
     // judgment survives while its subject (pair + cap) is unchanged, and a changed cap, a pair
@@ -90,10 +154,10 @@ export function pollBudgetGate(state, ctx) {
     // runs on it — and the paused tiers the demotion produces are held by the scheduler's
     // per-role set, so nobody but the probe ever reaches the demoted pair.
     const priceResolved = resolveTierFallbacks(liveConfig, pairFreeAt);
-    // The fleet-level engagement is the price-resolved `default` tier's pair: a map with no
+    // The team-level engagement is the price-resolved `default` tier's pair: a map with no
     // `default` entry still reports the free pair the tier borrows, so state.engaged and the
     // budget_fallback event name what the gate actually engages instead of reading null while
-    // the fleet runs one. fallbackReady is exactly a non-null resolved default. rejectedPair is
+    // the team runs one. fallbackReady is exactly a non-null resolved default. rejectedPair is
     // the default tier's own declared pair (fallbackPair's borrow order included) — the pair
     // the operator asked for when the price check refused it, named by the pause event.
     const pair = priceResolved.default.pair;
@@ -109,12 +173,22 @@ export function pollBudgetGate(state, ctx) {
                 pairNames.push(n);
         }
     }
+    // Every price-free step of every tier's chain gets a breaker entry too: a demoted step's
+    // successor must have one, or fallbackServingPair would read it as not serving.
+    const chainPairs = tierChainSteps(liveConfig)
+        .map((s) => s.pair)
+        .filter(pairFreeAt);
+    for (const p of chainPairs) {
+        const n = modelPairName(p);
+        if (!pairNames.includes(n))
+            pairNames.push(n);
+    }
     state.breakers = rekeyFallbackBreakers(state.breakers, pairNames, liveConfig.maxDailyCostUsd);
     state.engaged = reached && fallbackReady ? pairName : null;
     // The demotion-aware resolution (part 5c/8): the same engine over the FULL usable predicate —
     // priced at zero AND its breaker entry serving — so a demoted pair re-resolves only the tiers
     // that use it: a demoted strong pair holds the strong roles beside the per-role cap set while
-    // small and default keep their own pairs, instead of the fleet-wide pause the single-pair
+    // small and default keep their own pairs, instead of the team-wide pause the single-pair
     // gate produced.
     const usable = (p) => pairFreeAt(p) && fallbackServingPair(state.breakers, modelPairName(p));
     const servingResolved = resolveTierFallbacks(liveConfig, usable);
@@ -132,7 +206,7 @@ export function pollBudgetGate(state, ctx) {
     // doubles the page on the poll the cap itself is reached.
     const warn = gate === "open" && budgetWarning({ spentUsd, capUsd });
     if (warn && !state.warned) {
-        logEventBestEffort(root, { loop: "harness", type: "budget_warning", spentUsd, capUsd });
+        logEventBestEffort(root, { source: TUMWATER_SOURCE, type: "budget_warning", spentUsd, capUsd });
         state.warned = true;
     }
     else if (!warn) {
@@ -140,7 +214,7 @@ export function pollBudgetGate(state, ctx) {
     }
     if (gate !== state.prevGate) {
         logEventBestEffort(root, {
-            loop: "harness",
+            source: TUMWATER_SOURCE,
             type: gate === "open" ? "budget_resumed" : gate === "fallback" ? "budget_fallback" : "budget_paused",
             spentUsd,
             capUsd,
@@ -180,37 +254,179 @@ export function pollBudgetGate(state, ctx) {
         });
         state.prevGate = gate;
     }
-    // While the fallback holds, role loops run under the derived view — the free pair
-    // installed top-level and every per-role/reviewer model override dropped, so no seam can
-    // reach a priced model. A breaker-demoted fallback keeps the view too: its gate is
-    // `paused`, but a tick parked in the semaphore when it tripped, the half-open probe, and
-    // the landings must still run on the free pair — a demotion must never promote them to
-    // the priced model the cap already spent.
+    // While the fallback holds, role loops run under the derived view — the free pair installed
+    // top-level and every per-role/reviewer model override dropped, so no seam can reach a priced
+    // model. A breaker-demoted fallback keeps the view too: its gate is `paused`, but a tick parked
+    // in the semaphore when it tripped, the half-open probe, and the merges must still run on the
+    // free pair — a demotion must never promote them to the priced model the cap already spent.
     const onFallback = reached && pairNames.length > 0;
-    if (onFallback && state.from !== liveConfig) {
+    // A used-up window moves the subscription claude jobs to their tier's fallback below the cap
+    // too; with no fallback to move to, nothing changes and the claude hold applies.
+    const windowMove = windowOut !== null && pairNames.length > 0;
+    // The resolved pairs are part of the key: a priced step crossing its own daily cap changes
+    // the resolution without a config or window change, and the view must follow it.
+    const resolvedKey = MODEL_TIERS.map((t) => {
+        const rp = priceResolved[t].pair;
+        return rp ? modelPairName(rp) : "-";
+    }).join(",");
+    const fromKey = `${windowMove ? "w" : ""}${reached ? "c" : ""}|${resolvedKey}`;
+    if ((onFallback || windowMove) && (state.from !== liveConfig || state.fromKey !== fromKey)) {
         state.from = liveConfig;
-        state.fallbackConfig = applyFallbackModel(liveConfig, priceResolved, (seam) => seamFree(providers, seam, account));
+        state.fromKey = fromKey;
+        // A job keeps its own model while that model is available: below the cap every seam but a
+        // subscription claude one during a used-up window; at the cap it must also be free.
+        const available = (seam) => !(windowOut !== null && seamIsClaude(seam)) && (!reached || seamFree(providers, seam, account, catalog));
+        const view = applyFallbackModel(liveConfig, priceResolved, available);
+        // A role pinned to subscription claude under a tier that is not claude has no tier pair to fall
+        // onto — dropping its override would put it on the tier's priced primary — so it keeps its
+        // pin and the claude hold stops it, as before the window move.
+        if (windowOut !== null) {
+            for (const role of enabledRoleIds(liveConfig)) {
+                const tier = roleSeamTier(liveConfig, role);
+                const pin = liveConfig.roles[role];
+                if (pin && seamIsClaude(configForRole(liveConfig, role)) && !seamIsClaude(withModelOverrides(liveConfig, tier, {})))
+                    view.roles[role] = pin;
+            }
+            // A reviewer pinned to subscription claude under such a tier would likewise end up on the
+            // tier's priced primary; it goes to the tier's fallback pair instead (a held reviewer would
+            // stop the whole team).
+            const rm = liveConfig.review.model;
+            const reviewTier = isTierName(rm) ? rm : "strong";
+            const reviewPair = priceResolved[reviewTier].pair;
+            if (reviewPair &&
+                seamIsClaude(reviewConfig(liveConfig)) &&
+                !seamIsClaude(withModelOverrides(liveConfig, reviewTier, {})))
+                view.review = {
+                    ...view.review,
+                    provider: undefined,
+                    model: formatModelSelector({
+                        provider: reviewPair.provider,
+                        model: reviewPair.model ?? "",
+                        thinking: reviewPair.thinking,
+                    }),
+                    thinking: undefined,
+                };
+        }
+        state.fallbackConfig = view;
+    }
+    // The tiers the window move put on a fallback pair: those whose own seam is subscription claude.
+    const windowTiers = {};
+    if (windowMove) {
+        const moved = new Set();
+        for (const tier of MODEL_TIERS)
+            if (seamIsClaude(withModelOverrides(liveConfig, tier, {})))
+                moved.add(tier);
+        const labels = tierFallbackLabels(priceResolved);
+        for (const tier of MODEL_TIERS)
+            if (moved.has(tier) && labels[tier] !== undefined)
+                windowTiers[tier] = labels[tier];
+    }
+    // The director follows availability, not the cap: while the window move stands and its own
+    // model job is subscription claude, its tier's resolved pair replaces the live config (only
+    // subscription claude jobs are unavailable, so a priced director primary keeps its model over
+    // the cap). With no fallback (windowMove false) it stays on the live config and the scheduler
+    // holds it on the claude hold.
+    const directorMoved = directorWindowOut !== null && pairNames.length > 0 && seamIsClaude(configForRole(liveConfig, DIRECTOR_ROLE));
+    if (!directorMoved)
+        state.directorFrom = null;
+    else if (state.directorFrom !== liveConfig || state.directorKey !== resolvedKey) {
+        state.directorFrom = liveConfig;
+        state.directorKey = resolvedKey;
+        state.directorView = applyFallbackModel(liveConfig, priceResolved, (seam) => !seamIsClaude(seam));
+    }
+    const windowResumed = state.prevWindowMoved && !windowMove;
+    state.prevWindowMoved = windowMove;
+    const movedTiers = new Set();
+    // The tiers `applyFallbackModel` moved: those whose own seam fails the `available` test above.
+    for (const tier of MODEL_TIERS) {
+        const seam = withModelOverrides(liveConfig, tier, {});
+        const out = (windowMove && seamIsClaude(seam)) || (reached && !seamFree(providers, seam, account, catalog));
+        if (out)
+            movedTiers.add(tier);
     }
+    const chain = chainInfo({
+        config: liveConfig,
+        resolved: servingResolved,
+        moved: movedTiers,
+        breakers: state.breakers,
+        states,
+        now,
+        windowOut,
+        account,
+        isPriced: (p) => !piPairFree(providers, p.provider, p.model, account, catalog),
+    });
     return {
         gate,
+        chain,
         onFallback,
-        roleConfig: onFallback ? state.fallbackConfig : liveConfig,
+        roleConfig: onFallback || windowMove ? state.fallbackConfig : liveConfig,
         spentUsd,
         capUsd,
         resumed,
-        pairs: distinctPairs(priceResolved),
+        pairs: distinctPairs(priceResolved, chainPairs),
         priceResolved,
         servingResolved,
         budgetActive: reached,
+        windowOut,
+        windowTiers,
+        windowResumed,
+        directorConfig: directorMoved ? state.directorView : liveConfig,
     };
 }
+/** The `chain` block: for each tier this poll moved off its primary, the step it runs on and
+ * why the position before it cannot run (plans/fallback-chain.md "Events and surfaces").
+ * `moved` names the tiers the poll moved; a tier the gate pauses (`pair: null`) gets no entry.
+ * The reason is read from the position just before the active step — the previous chain step,
+ * or the tier's primary at step 0 — in the order demoted, step-cap, window/reserve, overage,
+ * cap. */
+export function chainInfo(a) {
+    const out = {};
+    const steps = tierChainSteps(a.config);
+    const midnight = dayAt(-1, new Date(a.now)).getTime();
+    for (const tier of MODEL_TIERS) {
+        const r = a.resolved[tier];
+        if (!a.moved.has(tier) || r.pair === null)
+            continue;
+        const own = steps.filter((s) => s.tier === (r.from ?? tier)).map((s) => s.pair);
+        const idx = r.step ?? 0;
+        const prior = idx > 0 ? own[idx - 1] : null;
+        const primaryClaude = seamIsClaude(withModelOverrides(a.config, tier, {}));
+        const info = { pair: modelPairName(r.pair), step: idx + 1, of: own.length, reason: "cap" };
+        const priorName = prior ? modelPairName(prior) : "";
+        if (prior && a.breakers[priorName] !== undefined && !fallbackServingPair(a.breakers, priorName)) {
+            info.reason = "demoted";
+        }
+        else if (prior?.maxDailyCostUsd !== undefined &&
+            pairDailyCost(a.states, priorName, a.now) >= prior.maxDailyCostUsd) {
+            info.reason = "step-cap";
+            info.returnsAt = midnight;
+        }
+        else if ((prior !== null && pairIsClaude(prior) || primaryClaude) && a.windowOut !== null) {
+            info.reason = a.windowOut.reserve ? "reserve" : "window";
+            info.returnsAt = a.windowOut.resetsAt;
+        }
+        else if (prior && pairIsClaude(prior) && prior.extraUsage && a.account && claudeOverageRefused(a.account)) {
+            info.reason = "overage";
+        }
+        else {
+            info.returnsAt = midnight;
+        }
+        if (r.pair.maxDailyCostUsd !== undefined && a.isPriced(r.pair)) {
+            info.spentUsd = pairDailyCost(a.states, modelPairName(r.pair), a.now);
+            info.capUsd = r.pair.maxDailyCostUsd;
+        }
+        out[tier] = info;
+    }
+    return out;
+}
 /** The distinct non-null fallback pairs a resolution hands out (tier order, first occurrence
  * first) — the handback match list: a reopen hands back every in-flight tick running on any of
  * them (part 5c/8's per-tier handback). */
-function distinctPairs(resolved) {
+function distinctPairs(resolved, chainPairs) {
     const out = [];
-    for (const tier of MODEL_TIERS) {
-        const p = resolved[tier].pair;
+    // The resolved pairs first, then every other price-free chain step: a run can be on any step.
+    const candidates = [...MODEL_TIERS.map((t) => resolved[t].pair), ...chainPairs];
+    for (const p of candidates) {
         if (p !== null && !out.some((q) => modelPairName(q) === modelPairName(p)))
             out.push(p);
     }

package/dist/src/gates/disk-gate.js

@@ -1,33 +1,33 @@
 /** The disk floor's hold (plans/disk-floor.md, "Disk floor 1/4"): when the volume the harness
- * worktrees live on runs low on free space, the fleet starts no new work — role ticks, the
- * director, landing vets and merges — so a fleet of build-heavy checkouts cannot fill the
- * disk. The syscall, the hold's hysteresis, and the edge-triggered `disk_low`/`disk_ok`
- * events live here; the orchestrator owns only the wiring, exactly like the quiet-hours and
- * pause gates. Part 2/4 reclaims build outputs so the hold rarely engages; this part turns
- * "disk full" into "fleet held, with a notification". In-flight work runs on — killing it
- * wastes the work without freeing anything a finished run would not free anyway.
+ * worktrees live on runs low on free space, the team starts no new work — role ticks, the director,
+ * merge verifies and merges — so a team of build-heavy checkouts cannot fill the disk. The syscall,
+ * the hold's hysteresis, and the edge-triggered `disk_low`/`disk_ok` events live here; the
+ * orchestrator owns only the wiring, exactly like the quiet-hours and pause gates. Part 2/4
+ * reclaims build outputs so the hold rarely engages; this part turns "disk full" into "team held,
+ * with a notification". In-flight work runs on — killing it wastes the work without freeing
+ * anything a finished run would not free anyway.
  *
  * The measurement is deliberately language-agnostic: `fs.statfsSync` reports the bytes an
  * unprivileged user can still write, whatever the project builds. */
 import fs from "node:fs";
 import { worktreesDir } from "../paths.js";
-import { logEventBestEffort, warnEventBestEffort } from "../events/events.js";
+import { logEventBestEffort, warnEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 /** GB means 10^9 bytes everywhere — in config and in display (plans/disk-floor.md). Exported
  * so doctor's detail renders the same unit the gate holds on. */
 export const BYTES_PER_GB = 1_000_000_000;
 /** How far free space must climb back ABOVE `diskHoldGB` before the hold lifts. Without it a
- * fleet hovering at the line would flap in and out of the hold every poll. */
+ * team hovering at the line would flap in and out of the hold every poll. */
 export const DISK_HOLD_HYSTERESIS_GB = 5;
-/** The volume the fleet's builds write to: the worktrees dir once it exists, else the root
- * (a fleet that has not created a worktree yet measures the checkout's own volume). One home
+/** The volume the team's builds write to: the worktrees dir once it exists, else the root
+ * (a team that has not created a worktree yet measures the checkout's own volume). One home
  * of the choice so the sampler and doctor's detail name the same path. */
 export function diskVolumePath(root) {
     const worktrees = worktreesDir(root);
     return fs.existsSync(worktrees) ? worktrees : root;
 }
-/** Free bytes available to an unprivileged user on the volume the fleet builds on, or null
+/** Free bytes available to an unprivileged user on the volume the team builds on, or null
  * when statfs throws (an unsupported platform or filesystem). A null sample never holds —
- * the fleet keeps running rather than freezing on a measurement it cannot make. */
+ * the team keeps running rather than freezing on a measurement it cannot make. */
 export function sampleFreeBytes(root, statfs = (p) => fs.statfsSync(p)) {
     try {
         const stats = statfs(diskVolumePath(root));
@@ -37,14 +37,14 @@ export function sampleFreeBytes(root, statfs = (p) => fs.statfsSync(p)) {
         return null;
     }
 }
-/** A fresh gate state: not held, warning unspent — so the first poll of a fleet with room
+/** A fresh gate state: not held, warning unspent — so the first poll of a team with room
  * logs nothing. */
 export function newDiskGateState() {
     return { prevHeld: false, warnedUnmeasurable: false };
 }
 /** Poll the disk gate for one orchestrator cycle: with `freeBytes` in hand, decide the hold
  * (edge-triggered with `DISK_HOLD_HYSTERESIS_GB` of hysteresis) and log exactly one
- * `disk_low` / `disk_ok` event per crossing. `holdGB` 0 disables the hold outright: a fleet
+ * `disk_low` / `disk_ok` event per crossing. `holdGB` 0 disables the hold outright: a team
  * with the key set to 0 never holds, and a live edit to 0 lifts an active hold on the next
  * poll (with its one `disk_ok`). A null sample (statfs threw) logs one `warning` per process
  * and never holds. `waitForReclaim` defers ENTERING the hold while part 2/4's pressure reclaim
@@ -55,7 +55,7 @@ export function pollDiskGate(root, freeBytes, holdGB, state, waitForReclaim = fa
     if (freeBytes === null) {
         if (!state.warnedUnmeasurable) {
             state.warnedUnmeasurable = true;
-            warnEventBestEffort(root, "harness", "cannot measure free disk space (statfs failed) — the disk hold is off for this process");
+            warnEventBestEffort(root, TUMWATER_SOURCE, "cannot measure free disk space (statfs failed) — the disk hold is off for this process");
         }
         state.prevHeld = false;
         return false;
@@ -71,8 +71,8 @@ export function pollDiskGate(root, freeBytes, holdGB, state, waitForReclaim = fa
     if (held !== state.prevHeld) {
         state.prevHeld = held;
         logEventBestEffort(root, held
-            ? { loop: "harness", type: "disk_low", freeGB, holdGB }
-            : { loop: "harness", type: "disk_ok", freeGB });
+            ? { source: TUMWATER_SOURCE, type: "disk_low", freeGB, holdGB }
+            : { source: TUMWATER_SOURCE, type: "disk_ok", freeGB });
     }
     return held;
 }