tumwater 0.1.2 → 0.2.0

package/dist/src/gates/startup-gate.js

@@ -1,34 +1,24 @@
+// vocabulary: plain
 import fs from "node:fs";
 import path from "node:path";
 import { loadConfigSafe } from "../config/config.js";
-import { configForRole, reviewConfig } from "../config/config-views.js";
+import { seamsInUse } from "../config/config-fallbacks.js";
 import { findOnPath } from "../files/files.js";
 import { GIT_MISSING_MESSAGE } from "../git/git-run.js";
 import { branchesPhrase, branchExists, currentBranch, hasCommits, isGitRepo } from "../git/git.js";
 import { DETACHED_HEAD_MESSAGE, NOT_A_REPO_MESSAGE, NOT_INITIALIZED_MESSAGE, NO_COMMITS_MESSAGE, } from "./readiness.js";
 import { agentMissingMessage, findAgentBinary, resolveAgentBin } from "../pi/pi-bin.js";
 import { seedClaudeAccount } from "../agent/claude/claude-account.js";
-import { loopIds } from "../roles/loop-ids.js";
-/** The startup gate of `tumwater run` as one function: every precondition an orchestrator
- * generation checks before it starts. "Can a generation boot in this repo's current state?" has
- * three askers and they must get one answer: cmdRun (cli/cli-run.ts) fails fast on it at startup,
- * the self-redeploy (src/redeploy/redeployer.ts) asks it before it holds the fleet and again right
- * before its swap, and the supervisor (src/process/supervisor.ts) asks it to name why a generation
- * died. On 2026-09-22 only the first existed: a redeploy swapped onto a build whose child found
- * tumwater.json missing, exited "not initialized", and the supervisor exited with it — 4 h 44 m
- * of a dead fleet and no event (BUGS.md 2026-09-23). The operator-facing wording lives in
- * readiness.ts, shared with doctor's per-check report.
- *
- * The one startup check deliberately outside the gate is cmdRun's "an orchestrator is already
- * running": to a redeploy asking on behalf of its successor, the live orchestrator is itself —
- * gone by the time the successor boots. The gate is the ASKER's build's rule, so a redeploy checks
- * what the running build knows of startup; a precondition the new build adds is invisible to it
- * until that build runs. */
+import { refreshOpencodeCatalog } from "../agent/opencode/opencode-catalog.js";
+import { agentBackend } from "../agent/agent-backend.js";
+// Register the built-in pi and claude adapters into the registry this module reads (see
+// unregisteredBackendInUse) — importing run-agent.ts is the one place they register.
+import "../agent/run-agent.js";
 /** The repo-level preconditions every repo-bound command shares (requireReadyRepo in
  * cli/cli-repo-gate.ts): git
  * on PATH, a repository, tumwater.json present, at least one commit. The first unmet one's
  * message, or null when the repo is ready. A missing tumwater.json is "not initialized" here,
- * never "use defaults": starting a fleet is the moment an operator's config must exist. */
+ * never "use defaults": starting a team is the moment an operator's config must exist. */
 export async function repoNotReady(root) {
     // Fail fast on a missing binary: without this, the probe below reads as "not a git
     // repository" — pointing at the wrong fix for a machine with no git installed.
@@ -49,13 +39,24 @@ export async function repoNotReady(root) {
 export async function runStartupCheck(root, 
 /** The `--branch` flag of the invocation (null when absent) — the supervisor forwards it to
  * every generation, so every asker must pass the same one. */
-branchArg) {
+branchArg, 
+/** The opencode-catalog seed's injectable parts — tests only; production callers omit it and
+ * the seed uses the real models.dev fetch (see OpenCodeSeedOptions). */
+opencodeSeed = {}) {
     const notReady = await repoNotReady(root);
     if (notReady !== null)
         return { problem: notReady };
     const { config, error } = loadConfigSafe(root);
     if (config === undefined)
         return { problem: error };
+    // A backend an enabled seam routes to that this build has no registered adapter for cannot
+    // run its jobs: refuse to start rather than letting the run fall through to pi with a model
+    // id pi cannot serve (plans/opencode-backend.md part 2/7). Read the registry through
+    // run-agent.ts, whose module scope registers the built-in pi and claude adapters.
+    const unregistered = unregisteredBackendInUse(config);
+    if (unregistered !== undefined) {
+        return { problem: `backend ${unregistered} is configured but this build has no adapter for it` };
+    }
     // Fail fast instead of starting loops whose every tick dies with "spawn <bin> ENOENT". Every
     // enabled seam's agent — the top-level `agent` plus each enabled loop's resolved view and the
     // reviewer — resolves through the same resolveAgentBin the spawn uses (and doctor's pi check);
@@ -71,7 +72,7 @@ branchArg) {
     }
     // Seed the claude account state before the first run (plans/agent-backends.md part 6a):
     // `claude auth status` decides subscription vs API key, and an existing file is left alone.
-    // Gated on a claude seam so a pi-only fleet spawns nothing, and attempted once per root per
+    // Gated on a claude seam so a pi-only team spawns nothing, and attempted once per root per
     // process: runStartupCheck is also the redeploy/supervisor poll's ask (runStartupProblem),
     // and a logged-out claude would otherwise spawn a bounded probe on every poll. If the seed
     // fails, the first claude run's observation fills the file in.
@@ -79,6 +80,22 @@ branchArg) {
         claudeSeedAttempted.add(root);
         seedClaudeAccount(root, config);
     }
+    // Seed the opencode models catalog (part 6b/7) before the first run: the poll surfaces price
+    // opencode seams from the cached `.tumwater/state/opencode-models.json`, and an absent cache
+    // reads every opencode seam NOT free (the safe direction for the budget gate). Mirroring the
+    // claude seed above, it runs once per root per process when a model job routes to opencode;
+    // a failed fetch keeps the last good cache (or an empty one) and never blocks startup.
+    if (!opencodeSeedAttempted.has(root) && agentsInUse(config).includes("opencode")) {
+        opencodeSeedAttempted.add(root);
+        await refreshOpencodeCatalog(root, {
+            providers: opencodeProviders(config),
+            // Probe the configured opencode binary (not a different one on PATH) for the version, so
+            // the freshness check compares against the binary the team actually runs.
+            cliBin: resolveAgentBin(config, "opencode").bin,
+            fetch: opencodeSeed.fetch,
+            now: opencodeSeed.now,
+        });
+    }
     const branch = await resolveMainBranch(root, config, branchArg);
     if ("problem" in branch)
         return branch;
@@ -88,17 +105,44 @@ branchArg) {
  * so the supervisor's and redeploy's repeated startup checks do not respawn `claude auth
  * status` on every poll when the probe fails. */
 const claudeSeedAttempted = new Set();
-/** Every agent backend an enabled seam resolves to: the top-level `agent` plus each enabled
- * loop's configForRole view and, when the review gate is on, the reviewer's view
- * (reviewConfig). One list the startup gate and doctor's binary check share, so a claude route
- * the harness would spawn is checked exactly like pi on both surfaces. */
+/** Roots this process has already attempted an opencode-catalog seed for (see runStartupCheck),
+ * so the supervisor's and redeploy's repeated startup checks do not respawn the models.dev
+ * fetch on every poll when it fails. */
+const opencodeSeedAttempted = new Set();
+/** The models.dev providers the config routes through OpenCode beyond its own gateway, which
+ * the catalog parse (part 6a/7) keeps only when named here (finding 10's `opencode-go` and so
+ * on). A bare gateway seam (`opencode/<id>`) adds nothing — `opencode` is always kept. Each
+ * provider is the model id's segment before the first `/` — `opencode/anthropic/…` routes to
+ * models.dev's `anthropic` provider, so its catalog key is `anthropic/<id>` — read from the
+ * same seam enumeration the startup gate already sweeps for binaries. */
+export function opencodeProviders(config) {
+    const providers = new Set();
+    for (const seam of seamsInUse(config)) {
+        if (seam.agent !== "opencode")
+            continue;
+        const m = seam.model;
+        if (m?.includes("/"))
+            providers.add(m.slice(0, m.indexOf("/")));
+    }
+    return [...providers];
+}
+/** Every agent backend an enabled seam resolves to — the distinct agents of the one
+ * seamsInUse list (startup-gate's consumer of it), so a claude or pi clause that exists only
+ * as a fallback, the resolver, or the director is checked exactly like a primary seam.
+ * One list the startup gate and doctor's binary check share, so a route the harness would
+ * spawn is checked on both surfaces. */
 export function agentsInUse(config) {
-    const agents = new Set([config.agent ?? "pi"]);
-    for (const id of loopIds(config))
-        agents.add(configForRole(config, id).agent ?? "pi");
-    if (config.review.enabled)
-        agents.add(reviewConfig(config).agent ?? "pi");
-    return [...agents];
+    return [...new Set(seamsInUse(config).map((s) => s.agent ?? "pi"))];
+}
+/** The first backend an enabled seam routes to that this build has no registered adapter for,
+ * or undefined when every seam's backend is registered. The built-in pi and claude adapters
+ * are registered by importing src/agent/run-agent.ts (see the import above); a seam backend
+ * that is not in the registry is one this build cannot run. Doctor's binary check asks the
+ * same question, so the startup gate and doctor cannot disagree about which backend a build
+ * can serve. After the opencode adapter lands (part 5/7) this stays the general rule for any
+ * future id. */
+export function unregisteredBackendInUse(config) {
+    return agentsInUse(config).find((agent) => agentBackend(agent) === undefined);
 }
 /** runStartupCheck reduced to its verdict: the message a generation would fail on right now, or
  * null when one would boot — what the redeploy and the supervisor ask. */
@@ -106,7 +150,7 @@ export async function runStartupProblem(root, branchArg) {
     const check = await runStartupCheck(root, branchArg);
     return "problem" in check ? check.problem : null;
 }
-/** The branch the fleet targets: `--branch <name>` wins, then `baseBranch` in config, then
+/** The branch the team targets: `--branch <name>` wins, then `baseBranch` in config, then
  * whatever the primary checkout has checked out — the branch-agnostic default. An explicit
  * value must exist: failing at startup with the branches that do exist beats failing at the
  * first `git worktree add`. */

package/dist/src/gates/streak-gate.js

@@ -1,17 +1,17 @@
 /** The error-streak circuit breaker (PLANS.md 2026-09-30): a role whose ticks keep failing
- * consecutively is warned at ERROR_STREAK_WARN (src/tick/tick-apply.ts) and named by the fleet-wide
- * storm alarms (src/fleet/error-storm.ts, src/fleet/failure-spread.ts), but both only talk — the
+ * consecutively is warned at ERROR_STREAK_WARN (src/tick/tick-apply.ts) and named by the team-wide
+ * storm alarms (src/team/error-storm.ts, src/team/failure-spread.ts), but both only talk — the
  * role keeps ticking on the error ladder's 600 s max backoff forever, burning a model slot and
  * spend on a loop that cannot succeed. Past ERROR_STREAK_BREAKER consecutive failed ticks this gate
  * pauses the role through the same per-role pause marker the operator's `tumwater pause --role
- * <id>` writes (src/fleet/fleet-state.ts's pauseRole — the marker, lock, and idempotence come
+ * <id>` writes (src/team/team-state.ts's pauseRole — the marker, lock, and idempotence come
  * free), so the scheduler's existing pausedRolesSet skip blocks new ticks with zero scheduler
  * changes. The director is NOT exempt: a failing director cannot process prompts anyway, and one
  * uniform rule needs no carve-out. `tumwater resume --role <id>` (or the dashboard's per-row
  * toggle) lifts it, as today.
  *
  * Shape, like every gate in the family (src/gates/gate-polls.ts): the pure trip bookkeeping lives
- * here so it is unit-testable without a fleet, and the module owns the only event emission — the
+ * here so it is unit-testable without a team, and the module owns the only event emission — the
  * orchestrator's poll owns only the wiring.
  *
  * Ack bookkeeping. The marker itself is the ack carrier: every poll, each role present in the
@@ -26,12 +26,13 @@
  * the ack: the next episode trips on its own fresh ERROR_STREAK_BREAKER failures.
  *
  * Accepted behavior, stated here and not fixed in this change: the dashboards' "failing tick after
- * tick" alert (src/ui/fleet-alerts.ts) reads consecutiveErrors regardless of pause, so it keeps
+ * tick" alert (src/ui/team-alerts.ts) reads consecutiveErrors regardless of pause, so it keeps
  * listing a breaker-paused role until the streak clears; the loop cell's paused badge explains why
  * it is not ticking, and the role_streak_paused event tells the operator why. */
 import { ERROR_STREAK_BREAKER } from "../tick/tick-apply.js";
-import { pauseRole } from "../fleet/fleet-state.js";
-import { logEventBestEffort } from "../events/events.js";
+import { loopPaused } from "../roles/loop-ids.js";
+import { pauseRole } from "../team/team-state.js";
+import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 /** A fresh gate state: nothing acked, so a live streak at or past the breaker trips on the
  * first poll (the durable-cause case a restart after an operator resume relies on). */
 export function newStreakGateState() {
@@ -40,21 +41,22 @@ export function newStreakGateState() {
 /** Step the gate by one orchestrator poll. For each runner whose consecutive error streak
  * has reached ERROR_STREAK_BREAKER plus what its ack already excused, and whose role is not
  * in `pausedRoles`: write the per-role pause marker and log one `role_streak_paused` event
- * carrying the role, the streak, and the last error. Returns the roles this poll paused, so
- * the wiring can fold them into the poll's paused-roles view and the scheduler blocks them
- * on this very poll, not the next one.
+ * carrying the role, the streak, and the last error. Returns the pause keys this poll wrote
+ * (`pauseKey` maps a loop id to its marker key; instance 1 of a multi-instance role pauses as
+ * `<role>-1`), so the wiring can fold them into the poll's paused-roles view and the scheduler
+ * blocks them on this very poll, not the next one.
  *
  * Roles already paused are acked instead of tripped (the ack carrier is the marker itself,
  * per the module doc), a healthy streak clears its ack, and a streak below its bar leaves
  * the state untouched — so repeated polls while a breaker-paused role stays paused log
  * nothing more, and pauseRole's own idempotence backstops any race. */
-export function pollStreakGate(root, state, runners, pausedRoles) {
+export function pollStreakGate(root, state, runners, pausedRoles, pauseKey = (r) => r) {
     const tripped = [];
     for (const { role, state: s } of runners) {
         const streak = s.consecutiveErrors ?? 0;
         // Ack while paused: the marker is the ack carrier. The streak is frozen while a role is
         // paused (no ticks run), so recording it here is exactly the level the resume excuses.
-        if (pausedRoles.has(role)) {
+        if (loopPaused(pausedRoles, role)) {
             state.acked.set(role, streak);
             continue;
         }
@@ -71,15 +73,15 @@ export function pollStreakGate(root, state, runners, pausedRoles) {
         // ERROR_STREAK_BREAKER more failures from this level, whether or not any poll sees the
         // role paused in between (an operator resume racing the next poll must not re-trip).
         state.acked.set(role, streak);
-        if (pauseRole(root, role)) {
+        if (pauseRole(root, pauseKey(role))) {
             logEventBestEffort(root, {
-                loop: "harness",
+                source: TUMWATER_SOURCE,
                 type: "role_streak_paused",
-                role,
+                role: pauseKey(role),
                 streak,
                 ...(s.lastError ? { lastError: s.lastError } : {}),
             });
-            tripped.push(role);
+            tripped.push(pauseKey(role));
         }
     }
     return tripped;

package/dist/src/git/commit-message.js

@@ -1,3 +1,4 @@
+// vocabulary: plain
 import { truncate } from "../text/text.js";
 import { compactTokens } from "../text/format.js";
 import { labeledLine } from "../verdict/reply-contract.js";
@@ -12,6 +13,12 @@ import { labeledLine } from "../verdict/reply-contract.js";
  * bloat every commit subject. Truncated with an ellipsis — like the body fields below — rather
  * than silently cut mid-word, which would read as if the subject were complete. */
 const COMMIT_SUMMARY_MAX = 100;
+/** The untruncated SUMMARY length when it exceeds COMMIT_SUMMARY_MAX (extractSummary would cut
+ * it); null when it fits or the reply has no SUMMARY line. */
+export function summaryOverCap(finalText) {
+    const summary = labeledLine(finalText, "SUMMARY");
+    return summary !== null && summary.length > COMMIT_SUMMARY_MAX ? summary.length : null;
+}
 /** Pull the SUMMARY: line out of a pi final reply; null when absent. Capped at
  * COMMIT_SUMMARY_MAX chars with an ellipsis (consistent with extractCommitBody's field cap). */
 export function extractSummary(finalText) {
@@ -21,11 +28,11 @@ export function extractSummary(finalText) {
 /** The subject for a changed tick whose reply — and whose follow-up request — carried no
  * SUMMARY line: named from what actually changed, so the log still says what the commit touched
  * instead of only which loop made it. Up to three repo-relative paths (worktree order), then a
- * count; capped like a real summary. Falls back to the bare "<role> tick N" only when nothing is
+ * count; capped like a real summary. Falls back to the bare "<role> run N" only when nothing is
  * known. */
 export function fallbackSummary(files, role, tick) {
     if (files.length === 0)
-        return `${role} tick ${tick}`;
+        return `${role} run ${tick}`;
     const shown = files.slice(0, 3).join(", ");
     const rest = files.length > 3 ? ` and ${files.length - 3} more` : "";
     return truncate(`Update ${shown}${rest}`, COMMIT_SUMMARY_MAX);
@@ -75,11 +82,11 @@ export function formatCommitBody(body) {
 /** The harness-stamped trailer line of every tick commit — truth from the run's counters, not
  * model claims. `turns` sums this tick's pre-commit pi runs (main + transient retry); `peakCtx`
  * is their largest single-request context. A changed tick flagged high-friction (plans/
- * refusal-and-thrash.md) appends a sibling Friction line after the Tick line — minutes rounded,
+ * refusal-and-thrash.md) appends a sibling Friction line after the Run line — minutes rounded,
  * e.g. `Friction: high (41 turns / 62m)`; only changed ticks carry it, so the refusal path
- * never passes the argument and the Tick line's asserted format stays stable. */
+ * never passes the argument and the Run line's asserted format stays stable. */
 export function commitTrailer(role, tick, turns, peakCtx, highFrictionMinutes, revisionRound) {
-    const base = `Tick: ${role} #${tick} · turns ${turns} · ctx ${compactTokens(peakCtx)}`;
+    const base = `Run: ${role} #${tick} · turns ${turns} · ctx ${compactTokens(peakCtx)}`;
     const friction = highFrictionMinutes === undefined
         ? ""
         : `\nFriction: high (${turns} turns / ${Math.round(highFrictionMinutes)}m)`;

package/dist/src/git/git-diff.js

@@ -28,7 +28,7 @@ const C_QUOTE_ESCAPES = {
  * Non-ASCII arrives one octal escape per UTF-8 byte, so the escapes are first collected into
  * a latin1 byte string and only then reassembled as UTF-8 (decoding each escape to a character
  * on its own yields mojibake — `héllo.md` would come back as `héllo.md`). Used by
- * conflictedFiles in landing-git.ts; changedFiles reads git's NUL-terminated `-z` format, which
+ * conflictedFiles in merge-git.ts; changedFiles reads git's NUL-terminated `-z` format, which
  * emits paths verbatim (no quoting), so it has no encoded path to decode. */
 export function unquotePorcelainPath(p) {
     if (!p.startsWith('"'))
@@ -66,9 +66,9 @@ export function unquotePorcelainPath(p) {
     }
     return Buffer.from(bytes, "latin1").toString("utf8");
 }
-/** Repo-relative paths of every change in the worktree — modified, untracked, and deleted,
- * parsed from `git status --porcelain -z` (paths only). The refusal path uses this to classify
- * what a refusing run left behind: markdown notes may land, everything else is discarded.
+/** Repo-relative paths of every change in the worktree — modified, untracked, and deleted, parsed
+ * from `git status --porcelain -z` (paths only). The refusal path uses this to classify what a
+ * refusing run left behind: markdown notes may be kept, everything else is discarded.
  *
  * The `-z` format is what git recommends for machine parsing: records are NUL-terminated and
  * paths are emitted verbatim, never C-quoted, so a path with whitespace, a quote, a control
@@ -100,7 +100,7 @@ export async function changedFiles(wt) {
     return files;
 }
 /** Repo-relative paths changed between the branch's fork point from main and its HEAD —
- * everything a merge of this branch would land (the three-dot range diffs against the
+ * everything a merge of this branch would bring in (the three-dot range diffs against the
  * merge-base, so commits main gained during the tick are not included). */
 export async function aheadOfMainFiles(wt, mainBranch) {
     const out = await gitTry(wt, "diff", "--name-only", `${mainBranch}...HEAD`);
@@ -138,15 +138,15 @@ function splitDiffByFile(diff) {
         sections.push(cur.join("\n"));
     return sections;
 }
-/** The combined ahead-of-main diff — everything a merge of this branch would land. Capped:
- * over `maxBytes`, the result is a truncation note plus `--stat` and the largest files' full
- * diffs (an oversized diff is itself reviewable information, and the reviewer can read any
- * file in the worktree directly). The per-file sections are split out of the one full diff
- * already fetched — spawning a diff per file would re-diff the entire range once per file for
- * text we already hold in memory (measured ~0.5 s of redundant git work on a 530 KB / 39-file
- * tick). Section byte length ranks files at least as well as numstat's added+deleted: it is
- * exactly what the reviewer will see, and a binary file's short "Binary files differ" stub
- * naturally ranks below any real text change. */
+/** The combined ahead-of-main diff — everything a merge of this branch would bring in. Capped: over
+ * `maxBytes`, the result is a truncation note plus `--stat` and the largest files' full diffs (an
+ * oversized diff is itself reviewable information, and the reviewer can read any file in the
+ * worktree directly). The per-file sections are split out of the one full diff already fetched —
+ * spawning a diff per file would re-diff the entire range once per file for text we already hold in
+ * memory (measured ~0.5 s of redundant git work on a 530 KB / 39-file tick). Section byte length
+ * ranks files at least as well as numstat's added+deleted: it is exactly what the reviewer will
+ * see, and a binary file's short "Binary files differ" stub naturally ranks below any real text
+ * change. */
 export async function aheadOfMainDiff(wt, mainBranch, maxBytes = 200_000) {
     const range = `${mainBranch}...HEAD`;
     const full = (await gitTry(wt, "diff", range)) ?? "";
@@ -157,8 +157,8 @@ export async function aheadOfMainDiff(wt, mainBranch, maxBytes = 200_000) {
     let out = `[diff truncated: the full ahead-of-main diff is ${full.length} bytes; ` +
         `showing --stat plus the largest files]\n\n` + ((await gitTry(wt, "diff", "--stat", range)) ?? "") + "\n";
     for (const d of ranked) {
-        // Account for the surrounding newlines in the budget check so the output never exceeds
-        // maxBytes even when a section lands exactly on the boundary.
+        // Account for the surrounding newlines in the budget check so the output never exceeds maxBytes
+        // even when a section ends exactly on the boundary.
         if (out.length + d.length + 2 > maxBytes)
             break;
         out += `\n${d}\n`;

package/dist/src/git/git-run.js

@@ -8,12 +8,12 @@ import { realGitFromXcrun } from "./xcrun-git.js";
 import { EXEC_MAX_BUFFER, childEnv, releaseChildHandles, signalTree } from "../process/process.js";
 import { KILL_GRACE_MS, armGroupDeadline } from "../process/process-group.js";
 import { errorMessage } from "../text/text.js";
-/** The wall-clock bound on one git subprocess. Generous enough for a large rebase or diff on
- * a slow disk, but finite: a git wedged on a stuck filesystem or a dead helper otherwise
- * stalls its awaited landing/scheduling path with no bound at all. `runGit`'s optional
- * timeoutMs overrides it — tests drive the deadline down to exercise the timeout; production
- * callers need no override. The SIGTERM → SIGKILL escalation then runs for KILL_GRACE_MS, so
- * one call is bounded at timeoutMs + KILL_GRACE_MS whatever the child does. */
+/** The wall-clock bound on one git subprocess. Generous enough for a large rebase or diff on a slow
+ * disk, but finite: a git wedged on a stuck filesystem or a dead helper otherwise stalls its
+ * awaited merge/scheduling path with no bound at all. `runGit`'s optional timeoutMs overrides it —
+ * tests drive the deadline down to exercise the timeout; production callers need no override. The
+ * SIGTERM → SIGKILL escalation then runs for KILL_GRACE_MS, so one call is bounded at timeoutMs +
+ * KILL_GRACE_MS whatever the child does. */
 export const GIT_TIMEOUT_MS = 600_000;
 /** Identity used for harness-authored commits so ticks work without global git config. */
 export const COMMIT_IDENT = [
@@ -50,7 +50,7 @@ let resolvedGit;
 /** Wall-clock bound on the one-time macOS `xcrun --find git` probe. Unlike a git command, the
  * probe is a synchronous spawnSync, so a wedged xcrun (an Xcode license prompt, a corrupt
  * developer directory) blocks the whole event loop — no timer or watchdog can run until it
- * returns. A short bound keeps that from freezing the fleet: on timeout the probe reads as
+ * returns. A short bound keeps that from freezing the team: on timeout the probe reads as
  * "no answer" and the harness spawns `git` by name, exactly as a machine without the stub
  * does. */
 const GIT_RESOLVE_TIMEOUT_MS = 10_000;
@@ -200,7 +200,7 @@ export function execGitBounded(args, opts) {
     return Object.assign(promise, { child });
 }
 /** Like git(), with extra environment variables (e.g. GIT_EDITOR for rebase --continue, which the
- * landing flow in landing-merge.ts needs so `rebase --continue` can never block on a commit-message
+ * merge flow in merge-to-main.ts needs so `rebase --continue` can never block on a commit-message
  * prompt; and the harness ident for rewritten committer identity). The subprocess is bounded by
  * GIT_TIMEOUT_MS plus the KILL_GRACE_MS escalation (an optional `timeoutMs`/`killGraceMs` override
  * both for tests), so a hung or signal-ignoring git fails loudly as a GitError instead of stalling