tumwater 0.1.2 → 0.2.0

package/dist/src/gates/gate-polls.js

@@ -7,20 +7,22 @@ import { newMaintenanceQuotaGateState, pollMaintenanceQuotaGate, } from "./maint
 import { newBootstrapGateState, pollBootstrapGate, } from "./bootstrap-gates.js";
 import { newQuietHoursGateState, pollQuietHoursGate, roleQuietHold, } from "../scheduling/quiet-hours.js";
 import { BYTES_PER_GB, newDiskGateState, pollDiskGate, sampleFreeBytes, } from "./disk-gate.js";
-import { pollErrorStorm, pollFailureSpread, pollFleetHold, pollClaudeWindowWarning } from "../fleet/fleet-polls.js";
+import { pollErrorStorm, pollFailureSpread, pollTeamHold, pollClaudeWindowWarning, pollClaudeWindowReserve } from "../team/team-polls.js";
 import { readClaudeAccount } from "../agent/claude/claude-account.js";
-import { ERROR_STORM_QUIET } from "../fleet/error-storm.js";
-import { FAILURE_SPREAD_QUIET } from "../fleet/failure-spread.js";
+import { standingHolds } from "../team/team-hold.js";
+import { ERROR_STORM_QUIET } from "../team/error-storm.js";
+import { FAILURE_SPREAD_QUIET } from "../team/failure-spread.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
-import { baseRoleOf, loopEnabled } from "../roles/loop-ids.js";
-import { queuedLandingRoles } from "../landing/landing-queue.js";
-import { logEventBestEffort } from "../events/events.js";
-import { assignInfoFieldIfChanged, writeOrchestratorInfoBestEffort } from "../fleet/orchestrator-info.js";
+import { baseRoleOf, instancePauseKey, loopEnabled } from "../roles/loop-ids.js";
+import { queuedMergeRoles } from "../merge/merge-queue.js";
+import { MODEL_TIERS } from "../config/config-schema.js";
+import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
+import { publishInfoFields } from "../team/orchestrator-info.js";
 import { roleSeamTier } from "../config/config-views.js";
-/** A fresh gate family: nothing seen yet, so the first poll of an unpaused, unheld fleet
+/** A fresh gate family: nothing seen yet, so the first poll of an unpaused, unheld team
  * logs nothing. The budget gate seeds its breaker and derived fallback view from the
  * startup config; a live reload replaces the config on the next poll. */
-export function newFleetGateStates(config) {
+export function newTeamGateStates(config) {
     return {
         budget: newBudgetGateState(config),
         pause: newPauseGateState(),
@@ -30,20 +32,21 @@ export function newFleetGateStates(config) {
         bootstrap: newBootstrapGateState(),
         quiet: newQuietHoursGateState(),
         disk: newDiskGateState(),
-        fleetHold: new Map(),
+        teamHold: new Map(),
         claudeWindowWarned: null,
+        claudeWindowReserved: null,
         errorStorm: ERROR_STORM_QUIET,
         failureSpread: FAILURE_SPREAD_QUIET,
     };
 }
-/** Poll every fleet-wide gate and alarm, advancing `states` in place. */
-export function pollFleetGates(states, ctx) {
+/** Poll every team-wide gate and alarm, advancing `states` in place. */
+export function pollTeamGates(states, ctx) {
     const { root, runners, liveConfig, modelsPath, now, info } = ctx;
     // Daily cost budget gate (src/gates/budget-gates.ts owns the reads, the edge-triggered
     // budget_* events, the breaker re-key, and the fallback config view): the orchestrator
     // owns only the wiring — the demotion publish below and the per-runner assignment at
     // the bottom of this block.
-    const { gate, roleConfig, spentUsd, capUsd, resumed: gateResumed, pairs: fallbackPairs, priceResolved, servingResolved, budgetActive, } = pollBudgetGate(states.budget, {
+    const { gate, roleConfig, spentUsd, capUsd, onFallback, resumed: gateResumed, pairs: fallbackPairs, priceResolved, servingResolved, budgetActive, windowTiers, windowResumed, directorConfig, chain, } = pollBudgetGate(states.budget, {
         root,
         states: runners.map((r) => r.state),
         liveConfig,
@@ -66,36 +69,68 @@ export function pollFleetGates(states, ctx) {
     }
     const engagedDemotion = states.budget.engaged !== null ? demotions[states.budget.engaged] : undefined;
     const budget = { spentUsd, capUsd };
-    const demotionsChanged = assignInfoFieldIfChanged(info, "fallbackDemotions", demotions);
-    const engagedChanged = assignInfoFieldIfChanged(info, "fallbackDemoted", engagedDemotion);
-    const budgetChanged = assignInfoFieldIfChanged(info, "budget", budget);
-    if (demotionsChanged || engagedChanged || budgetChanged)
-        writeOrchestratorInfoBestEffort(root, info);
+    publishInfoFields(root, info, [
+        ["fallbackDemotions", demotions],
+        ["fallbackDemoted", engagedDemotion],
+        ["budget", budget],
+        ["chain", Object.keys(chain).length > 0 ? chain : undefined],
+    ]);
+    // One fallback_switched per poll in which a tier's pair or step changed (a return to the
+    // primary reads `to: null`, reason "available").
+    const switched = {};
+    const prevChain = states.budget.prevChain;
+    for (const tier of MODEL_TIERS) {
+        const was = prevChain[tier];
+        const cur = chain[tier];
+        if (was?.pair === cur?.pair && was?.step === cur?.step)
+            continue;
+        switched[tier] = { from: was?.pair ?? null, to: cur?.pair ?? null, reason: cur?.reason ?? "available" };
+    }
+    if (Object.keys(switched).length > 0)
+        logEventBestEffort(root, { source: TUMWATER_SOURCE, type: "fallback_switched", tiers: switched });
+    states.budget.prevChain = chain;
     // The director keeps the live config — an explicit human prompt outranks the
     // autonomous-spend cap (gateRoleConfig). Assigned every poll (not only on transitions)
     // so a runner created mid-gate, or one left behind by a broken-file poll that skipped
     // the reload, can never tick on the wrong model.
-    for (const r of runners)
-        r.config = gateRoleConfig(r.role, liveConfig, roleConfig);
-    // The budget reopened: a tick that started on a fallback pair keeps it until it ends, so
-    // hand those ticks back — abort them resumably (session and worktree edits kept) and
-    // let their next tick continue the same session on the primary, whose config the
-    // assignment above already installed (PLANS.md 2026-09-30). Per-tier fallbacks put
-    // different roles on different pairs (part 5c/8), so the match runs over EVERY pair the
-    // price-based resolution hands out, not only one. A tick started on the primary keeps
-    // running, the director is exempt, and the landings (the slot's own runs) are untouched.
-    // One event per pair names who was handed back, so the resulting aborted ticks read as
-    // the budget reopening, not as unexplained failures.
-    if (gateResumed && fallbackPairs.length > 0) {
+    for (const r of runners) {
+        r.config = gateRoleConfig(r.role, liveConfig, roleConfig, directorConfig);
+        // An image reroute must never spend past the daily cap: while the gate has the team on
+        // its free fallback pairs, a reroute looks only among those pairs (plans/image-input.md
+        // "Reroute target" "Regime"). Set beside the config assignment so the scheduler's regime
+        // and the loops' never disagree.
+        r.budgetFallbackActive = onFallback;
+    }
+    // The budget reopened: a tick that started on a fallback pair keeps it until it ends, so hand
+    // those ticks back — abort them resumably (session and worktree edits kept) and let their next
+    // tick continue the same session on the primary, whose config the assignment above already
+    // installed (PLANS.md 2026-09-30). Per-tier fallbacks put different roles on different pairs
+    // (part 5c/8), so the match runs over EVERY pair the price-based resolution hands out, not only
+    // one. A tick started on the primary keeps running, the director is exempt, and the merges (the
+    // slot's own runs) are untouched. One event per pair names who was handed back, so the resulting
+    // aborted ticks read as the budget reopening, not as unexplained failures. The subscription
+    // window reset (below the cap): the same hand-back for the pairs the window move used. A window
+    // that resets while the cap still holds hands back nothing.
+    const handBack = gateResumed || (windowResumed && !budgetActive);
+    if (handBack && fallbackPairs.length > 0) {
+        // A cap reopen while the window is still used up leaves the window's tiers on their
+        // fallback pairs: handing those runs back would abort them to restart on the same pair.
+        const stillMoved = Object.keys(windowTiers).flatMap((t) => {
+            const p = priceResolved[t].pair;
+            return p ? [p] : [];
+        });
         for (const leftPair of fallbackPairs) {
+            if (stillMoved.some((p) => p.provider === leftPair.provider && p.model === leftPair.model))
+                continue;
             const matching = runners.filter((r) => r.role !== DIRECTOR_ROLE && tickOnPair(r.tickModel(), leftPair));
             if (matching.length > 0) {
                 logEventBestEffort(root, {
-                    loop: "harness",
+                    source: TUMWATER_SOURCE,
                     type: "budget_handback",
                     roles: matching.map((r) => r.role),
                     provider: leftPair.provider,
                     model: leftPair.model,
+                    ...(gateResumed ? {} : { reason: "window" }),
                 });
                 for (const r of matching)
                     r.handBackTick();
@@ -103,8 +138,8 @@ export function pollFleetGates(states, ctx) {
         }
     }
     // The pause gates (src/gates/pause-gates.ts owns the reads, the edge-triggered pause/resume
-    // events, and the cross-poll bookkeeping): the operator pause's marker and the per-role
-    // pause's set, both read fresh per cycle so a marker change lands on the next poll.
+    // events, and the cross-poll bookkeeping): the operator pause's marker and the per-role pause's
+    // set, both read fresh per cycle so a marker change takes effect on the next poll.
     const { userPaused, pausedRoles } = pollPauseGates(root, states.pause);
     // The error-streak circuit breaker (src/gates/streak-gate.ts): a role past ERROR_STREAK_BREAKER
     // consecutive failed ticks is paused through the same per-role marker the operator's
@@ -112,7 +147,7 @@ export function pollFleetGates(states, ctx) {
     // director is not exempt; a failing director cannot process prompts anyway. Roles it just
     // paused fold into this poll's paused-roles view, so the scheduler blocks them on this very
     // poll instead of the next one.
-    const streakPaused = pollStreakGate(root, states.streak, runners, pausedRoles);
+    const streakPaused = pollStreakGate(root, states.streak, runners, pausedRoles, (role) => instancePauseKey(liveConfig, role));
     // pollPauseGates advanced its edge-triggered bookkeeping BEFORE the breaker wrote its
     // marker, so without this fold the NEXT poll would log a generic role_paused for a pause
     // the breaker already announced as role_streak_paused — one pause, two events, the second
@@ -143,21 +178,20 @@ export function pollFleetGates(states, ctx) {
     // pause gates' edge bookkeeping never sees it. A live config edit applies on the next poll;
     // local midnight lifts the verdict by itself.
     const capPaused = pollRoleCapGate(root, states.cap, runners, liveConfig.maxDailyCostUsdPerRole, now);
-    // The maintenance allowance (plans/work-ratio.md, part 1b/4): code-maintenance landings in a
-    // rolling 24 h window are capped at `maintenancePerWorkLanding × work +
-    // MAINTENANCE_DAILY_FLOOR`.
+    // The maintenance allowance (plans/work-ratio.md, part 1b/4): code-maintenance merges in a
+    // rolling 24 h window are capped at `maintenancePerWorkMerge × work + MAINTENANCE_DAILY_FLOOR`.
     // The gate counts the window, adds the maintenance loops already in flight (running a tick or
-    // holding a queued landing, so six concurrent permits cannot overshoot), and logs the one
+    // holding a queued merge, so six concurrent permits cannot overshoot), and logs the one
     // hold/resume event per transition. Enabled only: a disabled loop runs no tick to count. The
     // scheduling pass spends the returned headroom one due maintenance loop at a time, beside
     // capPaused, with the fresh-wake/queued-prompt override the need-based deferral honors.
-    const queuedRoles = queuedLandingRoles(root);
+    const queuedRoles = queuedMergeRoles(root);
     const maintenanceQuota = pollMaintenanceQuotaGate(root, states.quota, runners.map((r) => ({
         role: r.role,
         enabled: loopEnabled(r.config, r.role),
         running: r.state.running === true,
-        hasQueuedLanding: queuedRoles.has(r.role),
-    })), liveConfig.maintenancePerWorkLanding, now);
+        hasQueuedMerge: queuedRoles.has(r.role),
+    })), liveConfig.maintenancePerWorkMerge, now);
     // New-project bootstrap (src/gates/bootstrap-gates.ts, plans/work-ratio.md part 2/2): a fresh
     // project's maintenance loops start no new ticks until `bootstrap.untilPlansDone` plans are
     // Done. The gate owns the latch write and the one `bootstrap_complete` event; the scheduling
@@ -166,7 +200,7 @@ export function pollFleetGates(states, ctx) {
     const bootstrapHeld = pollBootstrapGate(root, states.bootstrap, runners, liveConfig, now);
     const bootstrapActive = states.bootstrap.active;
     // Per-role quiet hours (src/scheduling/quiet-hours.ts): a role whose own quietHoursPerRole window
-    // covers `now` starts no new ticks — the fleet window's semantics scoped to one loop, the
+    // covers `now` starts no new ticks — the team window's semantics scoped to one loop, the
     // director exempt like every autonomous gate. Stateless, recomputed per poll exactly like
     // capPaused: no crossing events, no state — a live config edit applies on the next poll
     // by construction. A role held by BOTH windows is held once: the scheduling pass folds
@@ -209,8 +243,7 @@ export function pollFleetGates(states, ctx) {
             held: diskHeld,
             ...(ctx.reclaim?.lastReclaim ? { lastReclaim: ctx.reclaim.lastReclaim } : {}),
         };
-    if (assignInfoFieldIfChanged(info, "disk", disk))
-        writeOrchestratorInfoBestEffort(root, info);
+    publishInfoFields(root, info, [["disk", disk]]);
     // Each runner as the two provider-failure polls read it (HoldInputs): the role, its two
     // episodic fields, and the provider its NEXT tick will run on (runProvider — the tier
     // fallback pair while a model-fallback episode is active, else the role's resolved config;
@@ -218,54 +251,69 @@ export function pollFleetGates(states, ctx) {
     // read the same list, like holdObservations on the reducer side. Keying on the effective
     // provider is what lets a storm on the fallback pair form its own hold while the abandoned
     // primary stays clear (PLANS.md "Model failure fallback, part 1/2").
+    //
+    // Each stamp (lastRateLimit/lastBackendFailure) carries the hold key of the backend that
+    // ACTUALLY failed — a reviewer run folded through the author's loop stamps `claude`, not
+    // the pi author's provider — and the polls' observation mapper files each stamp under that
+    // key, falling back to runProvider here for a stamp without one (PLANS.md "Mixed claude +
+    // pi fleets, part 2/4"). The spreads below carry the stamps wholesale, provider included.
     const holdInputs = (rs) => rs.map((r) => ({
         role: r.role,
         provider: r.runProvider(now),
         ...(r.lastRateLimit ? { lastRateLimit: r.lastRateLimit } : {}),
         ...(r.lastBackendFailure ? { lastBackendFailure: r.lastBackendFailure } : {}),
     }));
-    // Fleet-wide failure hold, per provider (src/fleet/fleet-hold.ts, PLANS.md 2026-10-05): once two
-    // roles' runs have ended on the SAME provider AND failure kind within a short window —
-    // 429s, or a connection, timeout, 5xx, or model-load backend failure — role loops on THAT
-    // provider start no new ticks, and the land queue starts no new vet, whose reviewer run
-    // has no retry and would spend a review strike on the storm — until the hold re-opens at
-    // its own deadline (Retry-After honored on the rate-limit kind, doubling on a relapse,
-    // capped). Roles on a healthy provider keep ticking; a hold on the reviewer's provider
-    // (with the review gate on) still blocks everything, since nothing could land — the
-    // orchestrator's scheduling and start passes derive that verdict from this map. The
-    // director's ticks are exempt, as under the budget gate and the operator pause: an
-    // explicit human prompt outranks an autonomous gate, one director run is not the
-    // concurrency that sustains a storm, its 429 runs keep the per-run transient retry
-    // (backend-failure kinds ride this hold alone), and a prompt its tick fails to fulfill
-    // goes back to the inbox. In-flight ticks finish; NEW ticks are gated at scheduling like
-    // both siblings, and a role tick already parked in the semaphore meets the same hold at
-    // its permit (the start gate) and hands its reservation back instead of starting
-    // into the storm. The verdicts are written back to states.fleetHold — one hold per
-    // provider, lifted holds kept keyed for their relapse memory but never reading as held —
-    // and the permit-time closures read the LATEST poll's map there, so a waiter granted its
-    // permit after a later poll sees that poll's world.
+    // Team-wide failure hold, per provider (src/team/team-hold.ts, PLANS.md 2026-10-05): once two
+    // roles' runs have ended on the SAME provider AND failure kind within a short window — 429s, or a
+    // connection, timeout, 5xx, or model-load backend failure — role loops on THAT provider start no
+    // new ticks, and the merge queue starts no new verify, whose reviewer run has no retry and would
+    // spend a review strike on the storm — until the hold re-opens at its own deadline (Retry-After
+    // honored on the rate-limit kind, doubling on a relapse, capped). Roles on a healthy provider
+    // keep ticking; a hold on the reviewer's provider (with the review gate on) still blocks
+    // everything, since nothing could merge — the orchestrator's scheduling and start passes derive
+    // that verdict from this map. The director's ticks are exempt, as under the budget gate and the
+    // operator pause: an explicit human prompt outranks an autonomous gate, one director run is not
+    // the concurrency that sustains a storm, its 429 runs keep the per-run transient retry
+    // (backend-failure kinds ride this hold alone), and a prompt its tick fails to fulfill goes back
+    // to the inbox. In-flight ticks finish; NEW ticks are gated at scheduling like both siblings, and
+    // a role tick already parked in the semaphore meets the same hold at its permit (the start gate)
+    // and hands its reservation back instead of starting into the storm. The verdicts are written
+    // back to states.teamHold — one hold per provider, lifted holds kept keyed for their relapse
+    // memory but never reading as held — and the permit-time closures read the LATEST poll's map
+    // there, so a waiter granted its permit after a later poll sees that poll's world.
     const claudeAccount = readClaudeAccount(root, now);
-    states.fleetHold = pollFleetHold(root, states.fleetHold, holdInputs(runners), now, claudeAccount);
+    states.teamHold = pollTeamHold(root, states.teamHold, holdInputs(runners), now, claudeAccount, windowTiers, liveConfig.claudeWindowReserve);
+    // The standings hold, published for observers (PLANS.md 2026-10-17 "the dashboards and
+    // `tumwater status` name a standing provider failure hold"): `standingHolds` turns the holds
+    // map into the per-provider list the status snapshot and the alert banner name, the same
+    // omit-when-empty idiom as `chain`/`disk`, so an open team leaves the file untouched and a
+    // hold change writes once.
+    const providerHolds = standingHolds(states.teamHold);
+    publishInfoFields(root, info, [
+        ["providerHolds", providerHolds.length > 0 ? providerHolds : undefined],
+    ]);
+    states.claudeWindowReserved = pollClaudeWindowReserve(root, states.claudeWindowReserved, claudeAccount, now, liveConfig.claudeWindowReserve);
     // The subscription usage window's warning is observational (the hold above is the gate): the
     // first allowed_warning logs once per window, and the memory lives beside the holds map.
     states.claudeWindowWarned = pollClaudeWindowWarning(root, states.claudeWindowWarned, claudeAccount, now);
-    // Fleet-wide error-storm warning (src/fleet/error-storm.ts): when several roles' tick streaks
+    // Team-wide error-storm warning (src/team/error-storm.ts): when several roles' tick streaks
     // fail consecutively on one shared cause, each role's own "consecutive tick failures"
-    // warning still fires alone — this adds the one fleet-level warning that names the
+    // warning still fires alone — this adds the one team-level warning that names the
     // cause (and the config knob, when the cause has one) instead of leaving the operator
     // to diff 14 streak lines. Observational only: it gates nothing, so unlike the failure
     // hold above there is no re-open event — the members' own recoveries tell that story.
     states.errorStorm = pollErrorStorm(root, states.errorStorm, runners);
-    // Fleet-wide wide-shallow storm alarm (src/fleet/failure-spread.ts): when many roles each
+    // Team-wide wide-shallow storm alarm (src/team/failure-spread.ts): when many roles each
     // fail a few times on one provider failure kind, the streak bar needs one role deep,
     // the error storm needs several roles deep, and the hold needs the failures close
     // together — this counts raw failures of one kind across roles in a rolling window,
-    // so a degraded backend that fails the fleet widely and shallowly still names itself.
+    // so a degraded backend that fails the team widely and shallowly still names itself.
     // Observational only, like the error storm: it gates nothing.
     states.failureSpread = pollFailureSpread(root, states.failureSpread, holdInputs(runners), now);
     return {
         gate,
         roleConfig,
+        directorConfig,
         userPaused,
         pausedRoles: pausedRolesNow,
         capPaused,

package/dist/src/gates/maintenance-quota.js

@@ -1,17 +1,17 @@
-/** Work ratio 1a/4 and 1b/4 (plans/work-ratio.md, "Maintenance follows work"): the arithmetic,
- * the setting, and the gate behind the maintenance allowance — code-maintenance landings in a
- * rolling 24 h window are capped at `maintenancePerWorkLanding × work landings +
- * MAINTENANCE_DAILY_FLOOR`, and `pollMaintenanceQuotaGate` puts that verdict in front of the
- * scheduler so the enabled maintenance loops stop starting new ticks past it.
+/** Work ratio 1a/4 and 1b/4 (plans/work-ratio.md, "Maintenance follows work"): the arithmetic, the
+ * setting, and the gate behind the maintenance allowance — code-maintenance merges in a rolling
+ * 24 h window are capped at `maintenancePerWorkMerge × work merges + MAINTENANCE_DAILY_FLOOR`, and
+ * `pollMaintenanceQuotaGate` puts that verdict in front of the scheduler so the enabled maintenance
+ * loops stop starting new ticks past it.
  *
  * The window counts `merged` events by `commitTier` (src/roles/roles.ts): feature/bugfix/director
  * are the work count, the code-maintenance roles plus readme the maintenance count, and every other
  * role (plan, steward, observers, custom) is neither. The count is an instant-shaped trailing
- * window — `ts >= now − 24 h` — not a local-day bucket, so it cannot reuse the report's
- * day-keyed fold cache (src/report/report-data.ts): instead the counter folds only the bytes the
- * append-only live log gained since the previous poll (`readCompleteLines`) and keeps the parsed
- * merged records in memory, re-reading the window whole only on the first call or after rotation.
- * Both readers share `parseEventLine`, so there is no second line parser.
+ * window — `ts >= now − 24 h` — not a local-day bucket, so it cannot reuse the report's day-keyed
+ * fold cache (src/report/report-fold.ts): instead the counter folds only the bytes the append-only
+ * live log gained since the previous poll (`readCompleteLines`) and keeps the parsed merged records
+ * in memory, re-reading the window whole only on the first call or after rotation. Both readers
+ * share `parseEventLine`, so there is no second line parser.
  *
  * The verdict is pure and lives here beside the count so the scheduler and every status reader
  * share one definition; `pollMaintenanceQuotaGate` is the one writer (the edge-triggered events)
@@ -25,18 +25,18 @@ import { finiteNumber } from "../files/json-object.js";
 import { dayKey } from "../text/datetime.js";
 import { commitTier } from "../roles/roles.js";
 import { baseRoleOf } from "../roles/loop-ids.js";
-import { logEventBestEffort } from "../events/events.js";
+import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 /** The fixed test-independent part of the allowance: a project whose backlog is empty still gets
- * this many maintenance landings in a rolling day, so hygiene never stops entirely. */
+ * this many maintenance merges in a rolling day, so hygiene never stops entirely. */
 export const MAINTENANCE_DAILY_FLOOR = 12;
 /** The rolling window length: 24 h in ms. */
 const MAINTENANCE_WINDOW_MS = 24 * 60 * 60 * 1000;
-/** The pure allowance verdict: `allowance = perWorkLanding × work + MAINTENANCE_DAILY_FLOOR`;
+/** The pure allowance verdict: `allowance = perWorkMerge × work + MAINTENANCE_DAILY_FLOOR`;
  * `used = maint + inFlight`; held while `used >= allowance`. No I/O — the counts and the
  * in-flight figure come from the caller, so the same verdict serves the scheduler and the
  * dashboards. */
 export function maintenanceQuota(input) {
-    const allowance = input.perWorkLanding * input.work + MAINTENANCE_DAILY_FLOOR;
+    const allowance = input.perWorkMerge * input.work + MAINTENANCE_DAILY_FLOOR;
     const used = input.maint + input.inFlight;
     return { allowance, used, held: used >= allowance };
 }
@@ -95,15 +95,15 @@ function seed(counter, root, cutoff, stat) {
 export function newMaintenanceQuotaGateState() {
     return { counter: newMaintenanceWindowCounter(), prevHeld: false };
 }
-/** Step the gate by one orchestrator poll: count the rolling window, add the maintenance loops
- * in flight, and put 1a's verdict in front of the scheduler. Returns the verdict — `allowance`,
- * `used` (landed maintenance plus the loops already in flight), and `held` (`used >= allowance`)
- * — for the scheduling pass's per-poll admission: it spends the remaining `allowance - used`
- * headroom one due maintenance loop at a time, so two due loops cannot start in the same poll.
- * Logs exactly one fleet-level `maintenance_quota_hold` when the gate goes from open to held and
- * one `maintenance_quota_resumed` when it re-opens — never one per loop. The director is never
+/** Step the gate by one orchestrator poll: count the rolling window, add the maintenance loops in
+ * flight, and put 1a's verdict in front of the scheduler. Returns the verdict — `allowance`, `used`
+ * (merged maintenance plus the loops already in flight), and `held` (`used >= allowance`) — for the
+ * scheduling pass's per-poll admission: it spends the remaining `allowance - used` headroom one due
+ * maintenance loop at a time, so two due loops cannot start in the same poll. Logs exactly one
+ * team-level `maintenance_quota_hold` when the gate goes from open to held and one
+ * `maintenance_quota_resumed` when it re-opens — never one per loop. The director is never
  * maintenance-tier, so no exemption is needed. */
-export function pollMaintenanceQuotaGate(root, state, observers, perWorkLanding, now) {
+export function pollMaintenanceQuotaGate(root, state, observers, perWorkMerge, now) {
     const { work, maint } = countMaintenanceWindow(root, state.counter, now);
     let inFlight = 0;
     for (const o of observers) {
@@ -111,14 +111,14 @@ export function pollMaintenanceQuotaGate(root, state, observers, perWorkLanding,
             continue;
         if (commitTier(baseRoleOf(o.role)) !== "maintenance")
             continue;
-        if (o.running || o.hasQueuedLanding)
+        if (o.running || o.hasQueuedMerge)
             inFlight++;
     }
-    const verdict = maintenanceQuota({ work, maint, inFlight, perWorkLanding });
+    const verdict = maintenanceQuota({ work, maint, inFlight, perWorkMerge });
     if (verdict.held !== state.prevHeld) {
         if (verdict.held) {
             logEventBestEffort(root, {
-                loop: "harness",
+                source: TUMWATER_SOURCE,
                 type: "maintenance_quota_hold",
                 work,
                 maint,
@@ -127,7 +127,7 @@ export function pollMaintenanceQuotaGate(root, state, observers, perWorkLanding,
         }
         else {
             logEventBestEffort(root, {
-                loop: "harness",
+                source: TUMWATER_SOURCE,
                 type: "maintenance_quota_resumed",
                 work,
                 maint,
@@ -138,9 +138,9 @@ export function pollMaintenanceQuotaGate(root, state, observers, perWorkLanding,
     }
     return verdict;
 }
-/** Count `merged` landings by tier over the rolling 24 h ending `now`, folding only the live
- * log's appended bytes since the previous call through `counter`. Returns `{ work, maint }`;
- * records that have aged out of the window are dropped from the memo so it stays bounded. */
+/** Count `merged` events by tier over the rolling 24 h ending `now`, folding only the live log's
+ * appended bytes since the previous call through `counter`. Returns `{ work, maint }`; records that
+ * have aged out of the window are dropped from the memo so it stays bounded. */
 export function countMaintenanceWindow(root, counter, now) {
     const cutoff = now - MAINTENANCE_WINDOW_MS;
     // The log is read through a regular-file guard so a path that is missing or not a regular file

package/dist/src/gates/pause-gates.js

@@ -1,11 +1,11 @@
 /** The operator pause (`tumwater pause`) and the per-role pause (`tumwater pause --role <id>`), as
  * the orchestrator polls them each cycle. Extracted from orchestrator.ts's poll loop: the marker
  * reads, the edge-triggered pause/resume events, and the cross-poll bookkeeping are one concern
- * beside the other fleet gates (src/budget/budget.ts's budget gate, src/fleet/fleet-hold.ts's fleet
+ * beside the other team gates (src/budget/budget.ts's budget gate, src/team/team-hold.ts's team
  * hold) — the orchestrator owns only the wiring. */
-import { isFleetPaused, pausedRoles } from "../fleet/fleet-state.js";
-import { logEventBestEffort } from "../events/events.js";
-/** A fresh pause-gate state: nothing seen paused yet, so the first poll of an unpaused fleet
+import { isTeamPaused, pausedRoles } from "../team/team-state.js";
+import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
+/** A fresh pause-gate state: nothing seen paused yet, so the first poll of an unpaused team
  * logs nothing. */
 export function newPauseGateState() {
     return { prevUserPaused: false, prevPausedRoles: new Set() };
@@ -18,24 +18,24 @@ export function newPauseGateState() {
  * only NEW ticks are blocked, because the gate sits before isEligible.
  *
  * Per-role pause (`tumwater pause --role <id>`): the operator pause's narrower sibling — the
- * same persistent marker read fresh per cycle, but one named loop instead of the fleet. Unlike
- * the fleet pause the director is NOT exempt: the operator named the role deliberately, and its
- * queued prompts simply wait in the inbox (the same effect the fleet pause has on the director).
+ * same persistent marker read fresh per cycle, but one named loop instead of the team. Unlike
+ * the team pause the director is NOT exempt: the operator named the role deliberately, and its
+ * queued prompts simply wait in the inbox (the same effect the team pause has on the director).
  * In-flight ticks finish; only NEW ticks are blocked (the gate sits before isEligible). */
 export function pollPauseGates(root, state) {
-    const userPaused = isFleetPaused(root);
+    const userPaused = isTeamPaused(root);
     if (userPaused !== state.prevUserPaused) {
-        logEventBestEffort(root, { loop: "harness", type: userPaused ? "fleet_paused" : "fleet_resumed" });
+        logEventBestEffort(root, { source: TUMWATER_SOURCE, type: userPaused ? "team_paused" : "team_resumed" });
         state.prevUserPaused = userPaused;
     }
     const pausedRolesNow = pausedRoles(root);
     const pausedRolesSet = new Set(pausedRolesNow);
     for (const r of pausedRolesNow)
         if (!state.prevPausedRoles.has(r))
-            logEventBestEffort(root, { loop: "harness", type: "role_paused", role: r });
+            logEventBestEffort(root, { source: TUMWATER_SOURCE, type: "role_paused", role: r });
     for (const r of state.prevPausedRoles)
         if (!pausedRolesSet.has(r))
-            logEventBestEffort(root, { loop: "harness", type: "role_resumed", role: r });
+            logEventBestEffort(root, { source: TUMWATER_SOURCE, type: "role_resumed", role: r });
     state.prevPausedRoles = pausedRolesSet;
     return { userPaused, pausedRoles: pausedRolesSet };
 }

package/dist/src/gates/readiness.js

@@ -1,3 +1,4 @@
+// vocabulary: plain
 /** The repo preconditions' shared wording behind the readiness gate. startup-gate.ts answers
  * with the first unmet precondition (cmdRun and requireReadyRepo fail on it, the self-redeploy
  * refuses a swap on it) and doctor.ts reports each one individually, but every surface
@@ -7,5 +8,5 @@
  * the spawn in pi/pi-bin.ts. */
 export const NOT_A_REPO_MESSAGE = "not a git repository (run `git init` first)";
 export const NO_COMMITS_MESSAGE = "the repo has no commits yet; `tumwater init` creates the first one";
-export const DETACHED_HEAD_MESSAGE = "the repo's primary checkout is detached; check out your main branch first";
+export const DETACHED_HEAD_MESSAGE = "your checkout is detached; check out your main branch first";
 export const NOT_INITIALIZED_MESSAGE = "not initialized (run `tumwater init <prompt>` first — or a bare `tumwater init` when the project brief (TUMWATER.md or README.md) already carries the prompt)";

package/dist/src/gates/role-cap-gates.js

@@ -1,7 +1,7 @@
 /** The per-role daily cost cap (PLANS.md 2026-09-30, part 1/2): a loop whose local-day spend
  * has reached its own `maxDailyCostUsdPerRole` entry starts no new ticks until the next local
- * day or a live config edit — so one runaway role cannot eat the fleet-wide cap and starve
- * every other loop for the rest of the day. The fleet budget gate (src/gates/budget-gates.ts)
+ * day or a live config edit — so one runaway role cannot eat the team-wide cap and starve
+ * every other loop for the rest of the day. The team budget gate (src/gates/budget-gates.ts)
  * bounds the SUM; this bounds each member. The stateless verdict follows that gate's own rule
  * (budgetPaused's doc: "resume is stateless, so … crossing midnight flips it on the next cycle
  * and nothing can get stuck"): the verdict is recomputed from the loop state every poll, no
@@ -9,7 +9,7 @@
  *
  * Deliberate differences from the streak gate's shape (src/gates/streak-gate.ts), stated in
  * the plan so no implementer re-litigates them:
- * - This gate writes NOTHING to the shared per-role pause marker (src/fleet/fleet-state.ts's
+ * - This gate writes NOTHING to the shared per-role pause marker (src/team/team-state.ts's
  *   pauseRole). The marker is anonymous — after a restart across midnight the harness could
  *   not tell a cap pause from an operator's, and would either refuse to lift the operator's
  *   pause or orphan it. The scheduler blocks the role through the poll's separate `capPaused`
@@ -20,18 +20,19 @@
  *   never silently no-ops a cap.
  *
  * Shape, like every gate in the family (src/gates/gate-polls.ts): the pure verdict and the
- * edge-triggered bookkeeping live here so they are unit-testable without a fleet, and this
+ * edge-triggered bookkeeping live here so they are unit-testable without a team, and this
  * module owns the only event emission — the orchestrator's poll owns only the wiring. The
  * in-memory `prev` and `warned` sets are the whole cross-poll memory: a restart with a
  * still-over-cap role re-logs one `role_cap_paused` on the first poll, and a role already past
  * 80% re-logs one `role_cap_warning` (the durable-cause honest report the streak-gate doc
  * accepts). */
+import { groupBy } from "../collections.js";
 import { budgetWarning, dailyCost, todayStamp } from "../budget/budget.js";
-import { logEventBestEffort } from "../events/events.js";
+import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { baseRoleOf } from "../roles/loop-ids.js";
 /** The stateless verdict: is this role over its own per-role cap as of `now`? True iff a cap
- * is configured, it is a finite number above zero (0 disables that role's cap, like the fleet
+ * is configured, it is a finite number above zero (0 disables that role's cap, like the team
  * cap), and today's spend has reached it. The role→cap lookup stays with the caller
  * (`caps?.[role]`), so part 2/2's observers (src/status/status-data.ts) share this single
  * definition with the scheduler. */
@@ -48,17 +49,11 @@ export function roleCapPaused(state, cap, now = Date.now()) {
  * is exempt. Keyed by base role in first-appearance order; each entry carries the group's loop
  * ids so a caller can log the base (the gate) or flatten the ids (the observer). */
 export function roleCapVerdicts(runners, caps, now) {
-    const groups = new Map();
-    for (const r of runners) {
-        const base = baseRoleOf(r.role);
-        if (base === DIRECTOR_ROLE)
-            continue;
-        const members = groups.get(base);
-        if (members)
-            members.push(r);
-        else
-            groups.set(base, [r]);
-    }
+    // Group by base role via the shared Map-of-arrays step (collections.groupBy, which
+    // time-spend, history-data, and team-polls also fold), then drop the exempt director's
+    // group so it never holds a verdict; first-appearance order is preserved.
+    const groups = groupBy(runners, (r) => baseRoleOf(r.role));
+    groups.delete(DIRECTOR_ROLE);
     const verdicts = new Map();
     for (const [base, members] of groups) {
         const cap = caps?.[base];
@@ -94,7 +89,7 @@ export function pollRoleCapGate(root, state, runners, caps, now) {
         const was = state.prev.has(base);
         if (verdict.over && !was) {
             logEventBestEffort(root, {
-                loop: "harness",
+                source: TUMWATER_SOURCE,
                 type: "role_cap_paused",
                 role: base,
                 spentUsd: verdict.spentUsd,
@@ -102,9 +97,9 @@ export function pollRoleCapGate(root, state, runners, caps, now) {
             });
         }
         else if (!verdict.over && was) {
-            logEventBestEffort(root, { loop: "harness", type: "role_cap_resumed", role: base });
+            logEventBestEffort(root, { source: TUMWATER_SOURCE, type: "role_cap_resumed", role: base });
         }
-        // The 80% early warning (PLANS.md 2026-10-09), the per-role twin of the fleet's
+        // The 80% early warning (PLANS.md 2026-10-09), the per-role twin of the team's
         // budget_warning and edge-triggered with the same reset-on-below: crossing the threshold
         // while still under the cap logs one role_cap_warning, a dip back under re-arms it. Warn
         // only while the cap is open — a poll that jumps straight to the cap already logs its own
@@ -113,7 +108,7 @@ export function pollRoleCapGate(root, state, runners, caps, now) {
         const warn = !verdict.over && cap !== undefined && budgetWarning({ spentUsd: verdict.spentUsd, capUsd: cap });
         if (warn && !state.warned.has(base)) {
             logEventBestEffort(root, {
-                loop: "harness",
+                source: TUMWATER_SOURCE,
                 type: "role_cap_warning",
                 role: base,
                 spentUsd: verdict.spentUsd,