tumwater 0.1.2 → 0.2.0

package/dist/src/operator/operator-intent.js

@@ -1,63 +1,67 @@
+// vocabulary: plain
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import { isFleetPaused } from "../fleet/fleet-state.js";
-import { orchestratorAlive, readOrchestratorInfo } from "../fleet/orchestrator-info.js";
+import { cancelScheduledStop, isTeamPaused, scheduleStop } from "../team/team-state.js";
+import { orchestratorAlive, readOrchestratorInfo } from "../team/orchestrator-info.js";
 import { durationLabel } from "../cli/cli-args.js";
-import { formatDate, formatTime, humanSeconds, secondsUntil } from "../text/datetime.js";
+import { formatDate, formatTime, humanUntil } from "../text/datetime.js";
 import { submitRolePrompt } from "../inbox/inbox-submit.js";
+import { questionAsker } from "../backlog/question-answer.js";
+import { knownRoleIdsCached } from "../config/config.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { loadLoopState, saveLoopState, zeroCounters } from "../loop/loop-state.js";
 import { clearBackoff } from "../scheduling/backoff.js";
 import { writeJsonAtomic } from "../files/json-files.js";
-import { reclaimPass } from "../fleet/reclaim.js";
+import { reclaimPass } from "../team/reclaim.js";
 import { formatGB } from "../text/format.js";
+import { plural } from "../text/phrases.js";
 import { cancelScheduledWakes, pendingScheduledWakes } from "./operator-requests.js";
 import { abortRequestPath, reclaimRequestPath, resetRequestPath, restartRequestPath, scheduledWakeDir, wakeRequestPath, } from "../paths.js";
 /** The marker-writing cores of the operator-intent protocol, shared by every surface that writes
  * one (the `cmd*` CLI commands in src/operator/operator-commands.ts, the dashboard's POST routes
  * in src/gui/gui-endpoint-commands.ts, and the TUI's key bindings in src/ui/tui/tui-keys.ts): each
  * core returns the confirmation its caller prints verbatim, so the surfaces cannot drift on marker
- * format, idempotence, or wording. The fleet-side consumer half is
+ * format, idempotence, or wording. The team-side consumer half is
  * src/operator/operator-requests.ts; this module holds the producer half's shared core, split out
  * of operator/operator-commands.ts so the UI layer never depends on the CLI's arg parsing. */
 /** The error every live-harness-only command reports (abort, stop): one literal so the two
  * surfaces cannot drift on the message an operator sees when nothing is running. */
-export const NO_HARNESS_ERROR = "no harness is running — start it with `tumwater run` first";
+export const NO_HARNESS_ERROR = "tumwater is not running — start it with `tumwater start` first";
 /** How a marker command reports when its marker takes effect, derived from one liveness
- * check: `live` says whether a fleet will consume it now, `when` is the " within ~2s" such a
- * fleet picks it up in, and `tail` names the fallback ("takes effect on the next `tumwater
- * run`") while no harness is running. Every marker command shares this so none can promise a
+ * check: `live` says whether a team will consume it now, `when` is the " within ~2s" such a
+ * team picks it up in, and `tail` names the fallback ("takes effect on the next `tumwater
+ * run`") while tumwater is not running. Every marker command shares this so none can promise a
  * timing the others deny — the one place that user-facing contract lives. */
 export function markerApplyNote(root) {
     const live = orchestratorAlive(root);
     return {
         live,
         when: live ? " within ~2s" : "",
-        tail: live ? "" : "; no harness is running, so it takes effect on the next `tumwater run`",
+        tail: live ? "" : "; tumwater is not running, so it takes effect on the next `tumwater start`",
     };
 }
-/** The trailing liveness clause of a one-shot marker command's confirmation (reset-counters, wake,
- * and restart): with a live fleet, "a running fleet <verb><when>"; without one, where the marker
- * lands instead. The request* cores share this so their wording cannot drift — pause and resume
- * phrase their own confirmations around markerApplyNote's when/tail because their sentences
- * differ. */
+/** The trailing liveness clause of a one-shot marker command's confirmation (reset-counters,
+ * wake, and restart): with a live team, "a running team <verb><when>"; without one, where the
+ * marker goes instead. The request* cores share this so their wording cannot drift — pause and
+ * resume phrase their own confirmations around markerApplyNote's when/tail because their
+ * sentences differ. */
 function applyClause(live, when, verb) {
     return live
-        ? `a running fleet ${verb}${when}`
-        : "takes effect on the next `tumwater run` (no harness is running)";
+        ? `the running team ${verb}${when}`
+        : "takes effect on the next `tumwater start` (tumwater is not running)";
 }
 /** The marker-writing core of `reset-counters`: zero each target's state file directly when no
- * fleet is running, and drop the fleet marker a running fleet consumes within one poll cycle.
+ * team is running, and drop the team marker a running team consumes within one poll cycle.
  * Returns the confirmation the CLI prints verbatim. The CLI and the GUI's
  * POST /api/reset-counters share this core. */
 export function requestResetCounters(root, roles) {
-    // A live fleet's orchestrator is the state files' single writer: consumeResetRequest zeroes
+    // A live team's orchestrator is the state files' single writer: consumeResetRequest zeroes
     // the affected runners' in-memory copies and the runners save them, and writes the file for a
     // requested role that has no runner (a disabled role). Rewriting the files here too would be
     // a second writer racing those whole-file saves — an overwrite from a snapshot the
     // orchestrator has since moved past (a just-ended tick's result, a claim, a schedule), which
-    // the lost update discards. So with a live fleet only the marker is written; with none there
+    // the lost update discards. So with a live team only the marker is written; with none there
     // is no concurrent writer and the direct write is what carries the reset to the next run.
     const { live, when } = markerApplyNote(root);
     if (!live)
@@ -67,18 +71,25 @@ export function requestResetCounters(root, roles) {
     // readJsonFile folds to null — the corrupt-marker superset that wakes/resets EVERY runner.
     // For a scheduled wake (`--in`) that superset drops notBeforeMs, firing the wake hours early.
     writeJsonAtomic(resetRequestPath(root), { at: Date.now(), roles });
-    // Only a live fleet consumes the marker; without one the state files are already zeroed and
-    // the next `tumwater run` is when the in-memory copies catch up. Name which case this is
+    // Only a live team consumes the marker; without one the state files are already zeroed and
+    // the next `tumwater start` is when the in-memory copies catch up. Name which case this is
     // rather than promising a ~2s pickup that no process will make.
     return `counters reset for ${roles.join(", ")} — ${applyClause(live, when, "picks this up")}`;
 }
+/** The empty-list wording both wake-list renderers share — `cancelWakes`'s no-op arm and
+ * `renderWakeList`'s empty list: one literal so the two surfaces cannot drift on what an
+ * operator sees when nothing is pending, plus a ` for <role>` suffix when the view was
+ * role-scoped. */
+function noWakePending(role) {
+    return `no scheduled wake pending${role ? ` for ${role}` : ""}`;
+}
 /** Drop pending scheduled wakes (`tumwater wake --cancel`, the dashboard's POST /api/wake-cancel):
  * every pending wake, or only `role`'s share of them. Returns the confirmation the CLI prints
  * verbatim and the GUI flashes, so the surfaces cannot drift on wording. */
 export function cancelWakes(root, role) {
     const n = cancelScheduledWakes(root, role);
     const forRole = role ? ` for ${role}` : "";
-    return n > 0 ? `cancelled ${n} scheduled wake${n === 1 ? "" : "s"}${forRole}` : `no scheduled wake pending${forRole}`;
+    return n > 0 ? `cancelled ${plural(n, "scheduled wake")}${forRole}` : noWakePending(role);
 }
 /** The pending scheduled wakes (`tumwater wake --list`), earliest first; with `role`, only the
  * wakes naming that loop. Entries keep their full roles list. Read-only. */
@@ -89,18 +100,18 @@ export function listWakes(root, role, now) {
 /** `wake --list`'s text: one numbered line per wake, or the empty wording `cancelWakes` uses. */
 export function renderWakeList(wakes, now, role) {
     if (wakes.length === 0)
-        return `no scheduled wake pending${role ? ` for ${role}` : ""}`;
+        return noWakePending(role);
     return wakes
-        .map((w, i) => `${i + 1}. in ${humanSeconds(secondsUntil(w.atMs, now))} — ${w.roles.join(", ")}`)
+        .map((w, i) => `${i + 1}. in ${humanUntil(w.atMs, now)} — ${w.roles.join(", ")}`)
         .join("\n");
 }
 /** The marker-writing core of `wake [--in <duration>]`, shared with the GUI's POST /api/wake:
  * clear the named roles' backoff and pull nextRunAt to now (touching ONLY the schedule —
  * counters, wake tracking, and session continuity are untouched), and drop the marker a
- * running fleet consumes within one poll. With a positive `inMs` (`wake --in`'s parsed
+ * running team consumes within one poll. With a positive `inMs` (`wake --in`'s parsed
  * duration) the wake is SCHEDULED: only the marker is written, its deadline this call's one
  * clock read plus inMs — the state change belongs to the deadline, not to the submit, so a
- * fleet stopped at submit (or restarted before the deadline) does not wake early;
+ * team stopped at submit (or restarted before the deadline) does not wake early;
  * consumeWakeRequest clears the schedules when it consumes the marker at or after the
  * deadline. The "wakes in" phrase is inMs itself, not the deadline minus a second clock read
  * (the rule timedPauseBits follows): a caller-computed deadline let a millisecond tick between
@@ -111,10 +122,10 @@ export function requestWake(root, roles, inMs) {
     // Deferred only for a genuinely positive delay: zero or less reads as immediate, so the
     // immediate and scheduled paths share one consumer contract.
     const deferred = inMs !== undefined && inMs > 0;
-    // Same single-writer rule as requestResetCounters: with a live fleet consumeWakeRequest
+    // Same single-writer rule as requestResetCounters: with a live team consumeWakeRequest
     // clears the affected runners' in-memory schedules and the runners save them, and writes the
     // file for a requested role that has no runner (a disabled role), so a direct state rewrite
-    // here would race those whole-file saves and lose one side's update. Without a fleet there is
+    // here would race those whole-file saves and lose one side's update. Without a team there is
     // no concurrent writer, and the file write is what carries the wake to the next run. A
     // scheduled wake already skips the direct write — see the docstring.
     const { live, when } = markerApplyNote(root);
@@ -130,27 +141,44 @@ export function requestWake(root, roles, inMs) {
     }
     else
         writeJsonAtomic(wakeRequestPath(root), { at: now, roles });
-    // Same liveness contract as reset-counters and pause/resume: only a live fleet consumes the
+    // Same liveness contract as reset-counters and pause/resume: only a live team consumes the
     // marker, so say so instead of promising a poll that will not happen.
     if (deferred)
         return (`wake scheduled for ${roles.join(", ")} — wakes in ${durationLabel(inMs)} — ` +
             (live
-                ? "a running fleet applies it within one poll after the deadline"
-                : "no harness is running — the next `tumwater run` applies it after the deadline"));
+                ? "the running team applies it within one poll after the deadline"
+                : "tumwater is not running — the next `tumwater start` applies it after the deadline"));
     return `wake requested for ${roles.join(", ")} — ${applyClause(live, when, "applies it")}`;
 }
+/** Schedule a graceful team stop `inMs` from now (`tumwater stop --in`, the dashboard's "Stop the
+ * team later"): the marker means nothing without a live team to consume it, so a stopped one
+ * refuses with NO_HARNESS_ERROR. The caller has already validated `inMs` (positive, within
+ * PAUSE_FOR_MAX_MS). */
+export function requestScheduledStop(root, inMs) {
+    if (!orchestratorAlive(root))
+        return { ok: false, error: NO_HARNESS_ERROR };
+    scheduleStop(root, Date.now() + inMs);
+    return {
+        ok: true,
+        message: `stop scheduled in ${durationLabel(inMs)} — the team finishes current work, then stops; \`tumwater stop --cancel\` drops it`,
+    };
+}
+/** Drop a scheduled stop; needs no live team. The confirmation `stop --cancel` prints. */
+export function cancelScheduledStopMessage(root) {
+    return cancelScheduledStop(root) ? "scheduled stop cancelled" : "no stop scheduled";
+}
 /** The marker-writing core of the forced restart, shared with the GUI's POST /api/restart:
- * drop the marker a running fleet consumes within one poll, telling the redeployer to waive
+ * drop the marker a running team consumes within one poll, telling the redeployer to waive
  * its post-restart cooldown. Forcing never bypasses a refusal — a red main, a failed compile,
  * a swap error, or a boot refusal still blocks — so a press is only meaningful while a restart
- * is actually pending: with a live fleet whose published build is not stale, nothing is written
- * and the reply says so. With no fleet running the marker is written harmlessly (the next `run`
+ * is actually pending: with a live team whose published build is not stale, nothing is written
+ * and the reply says so. With no team running the marker is written harmlessly (the next `run`
  * consumes it on its first poll) and the reply carries the same liveness contract as `wake`.
  * Returns the structured confirmation the CLI prints verbatim and the GUI flashes. */
 export function requestRestart(root) {
     const info = readOrchestratorInfo(root);
     if (info?.build && info.build.stale !== true) {
-        return { ok: false, error: "no restart is pending — the running build is current with main" };
+        return { ok: false, error: "no update is waiting — tumwater is current with main" };
     }
     writeJsonAtomic(restartRequestPath(root), { at: Date.now() });
     const { live, when } = markerApplyNote(root);
@@ -161,7 +189,7 @@ export function requestRestart(root) {
 /** The marker-writing core of `tumwater reclaim` (plans/disk-floor.md, part 3/4): drop the
  * marker a running orchestrator consumes within one poll and run one manual pass over every
  * candidate, in-use worktrees respected. Returns the confirmation the CLI prints. A caller
- * with no live fleet must run the pass in-process instead (cmdReclaim), because nothing would
+ * with no live team must run the pass in-process instead (cmdReclaim), because nothing would
  * consume the marker. */
 function requestReclaim(root) {
     writeJsonAtomic(reclaimRequestPath(root), { at: Date.now() });
@@ -171,9 +199,9 @@ function requestReclaim(root) {
 /** Queue a prompt for one loop and wake that loop — the one workflow `tumwater prompt
  * --role`, the dashboard's POST /api/prompt-role, and the TUI's Ctrl+R submit all share:
  * submitRolePrompt enqueues into the loop's own queue (length-capped by the shared rule)
- * and logs under the loop, then requestWake's single-role marker brings a live fleet's
+ * and logs under the loop, then requestWake's single-role marker brings a live team's
  * loop in within one poll instead of whenever its backoff next expires (and is safe with
- * no fleet running — the same contract as `tumwater wake`). Returns requestWake's
+ * no team running — the same contract as `tumwater wake`). Returns requestWake's
  * confirmation so a surface can show what the wake did. Keeping enqueue and wake in one
  * call keeps a surface from ever queueing a prompt without the wake that delivers it
  * promptly — the pairing is the invariant, not each surface's private discipline. An optional
@@ -185,7 +213,7 @@ export function submitRolePromptAndWake(root, role, text, images, notBeforeMs) {
     return requestWake(root, [role]);
 }
 /** The marker-writing core of `abort`, shared with the GUI's POST /api/abort: drop the
- * per-role marker a running fleet consumes within one poll cycle. Reports the liveness gate
+ * per-role marker a running team consumes within one poll cycle. Reports the liveness gate
  * and the director's discarded-prompt note structurally ({ok, message|error}) so the CLI can
  * fail() and the GUI can shape its 409/200 — neither re-derives the wording. */
 export function requestAbort(root, role) {
@@ -193,7 +221,7 @@ export function requestAbort(root, role) {
         return { ok: false, error: NO_HARNESS_ERROR };
     }
     writeJsonAtomic(abortRequestPath(root, role), { at: Date.now() });
-    let confirmation = `abort requested for ${role} — a running fleet applies it within ~2s`;
+    let confirmation = `abort requested for ${role} — the running team applies it within ~2s`;
     if (role === DIRECTOR_ROLE) {
         // The director's in-flight prompt was dequeued from the inbox file at tick start and an
         // abort discards it without re-queueing — say so, since the discard is otherwise silent.
@@ -235,11 +263,11 @@ export function rolePauseMessage(root, role, changed, timed, now = Date.now()) {
         return `role ${role} is already paused`;
     const { when, tail } = markerApplyNote(root);
     const { forPhrase, note } = timedPauseBits(timed, now);
-    return `role ${role} paused${forPhrase} — it stops starting new ticks at its next eligibility check${when} (in-flight ticks finish; the rest of the fleet is unaffected)${note}${tail}`;
+    return `role ${role} paused${forPhrase} — it starts no new runs${when} (current runs finish; the rest of the team is unaffected)${note}${tail}`;
 }
 /** The per-role resume confirmation, shared between `tumwater resume --role` and the TUI's
- * Ctrl+P for the same no-drift reason. Carries the fleet-pause interplay note cmdResume
- * phrases: the fleet pause is the stronger gate, so with its marker present a freshly
+ * Ctrl+P for the same no-drift reason. Carries the team-pause interplay note cmdResume
+ * phrases: the team pause is the stronger gate, so with its marker present a freshly
  * resumed role still starts no ticks (the director is exempt from that gate, so its
  * resumption is real) — saying nothing would promise ticking the scheduler then deny, the
  * same honest-confirmation contract markerApplyNote's tail serves. */
@@ -247,13 +275,13 @@ export function roleResumeMessage(root, role, changed) {
     if (!changed)
         return `role ${role} was not paused`;
     const { when, tail } = markerApplyNote(root);
-    const fleetNote = isFleetPaused(root) && role !== DIRECTOR_ROLE
-        ? " (the fleet pause is still active — `tumwater resume` lifts it)"
+    const teamNote = isTeamPaused(root) && role !== DIRECTOR_ROLE
+        ? " (the team pause is still active — `tumwater resume` lifts it)"
         : "";
-    return `role ${role} resumed — it starts ticking again at its next eligibility check${when}${fleetNote}${tail}`;
+    return `role ${role} resumed — it starts new runs again${when}${teamNote}${tail}`;
 }
 /** The `tumwater pause --for <duration>` cap: 90 days. A timed pause is meant to answer "step
- * away for a while and come back to a resumed fleet" — the same bound the report's day windows
+ * away for a while and come back to a resumed team" — the same bound the report's day windows
  * enforce (REPORT_MAX_DAYS in event-window.ts), and comfortably past any absence a deadline
  * should encode. Beyond it the deadline stops being a timed pause and becomes a standing one:
  * bare `pause` (lifted with `resume`) is that, and it says so instead of silently accepting a
@@ -262,7 +290,7 @@ export function roleResumeMessage(root, role, changed) {
  * every surface shares, so no new `--for` consumer can outgrow it unnoticed. */
 export const PAUSE_FOR_MAX_MS = 90 * 24 * 60 * 60 * 1000;
 /** One manual reclaim, shared by `tumwater reclaim` and the dashboard's POST /api/reclaim: with
- * a live fleet the pass is requested through the marker the orchestrator consumes (so in-use
+ * a live team the pass is requested through the marker the orchestrator consumes (so in-use
  * worktrees are respected); with none running it runs in-process, since nothing is in use.
  * Returns the confirmation its caller prints verbatim and never fails, so a server can call it. */
 export async function runManualReclaim(root) {
@@ -273,3 +301,13 @@ export async function runManualReclaim(root) {
         return "nothing to reclaim";
     return `reclaimed ${result.worktrees.join(", ")} — freed ${formatGB(result.freedGB)}`;
 }
+/** Wake the role named in an answered question's `(asked by <role> …)` clause, so it reads the
+ * decision it was blocked on without waiting out its backoff. Returns requestWake's confirmation,
+ * or null when the heading names no known role (asked by the user, an unknown or removed role,
+ * or no clause) — never throws for an unknown asker. */
+export function wakeQuestionAsker(root, title) {
+    const asker = questionAsker(title);
+    if (asker === null || !knownRoleIdsCached(root).includes(asker))
+        return null;
+    return requestWake(root, [asker]);
+}

package/dist/src/operator/operator-requests.js

@@ -1,11 +1,13 @@
+// vocabulary: plain
 import fs from "node:fs";
 import path from "node:path";
-import { logEvent, warnEvent, warnEventBestEffort } from "../events/events.js";
+import { logEvent, warnEvent, warnEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { removeQuiet } from "../files/files.js";
 import { errorMessage } from "../text/text.js";
 import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
 import { finiteNumber } from "../files/json-object.js";
 import { loadLoopState, saveLoopState, zeroCounters } from "../loop/loop-state.js";
+import { canonicalRoleId } from "../roles/legacy-role-ids.js";
 import { clearBackoff } from "../scheduling/backoff.js";
 import { abortRequestPath, reclaimRequestPath, resetRequestPath, restartRequestPath, scheduledWakeDir, statePath, wakeRequestPath, STATE_DIR, } from "../paths.js";
 /** Read the optional `roles` request marker the `reset-counters` and `wake` CLI commands drop
@@ -28,13 +30,13 @@ function roleRequestTargets(markerFile, runners) {
 function requestedRoles(markerFile) {
     const marker = readJsonFile(markerFile);
     return marker && Array.isArray(marker.roles) && marker.roles.every((r) => typeof r === "string")
-        ? marker.roles
+        ? marker.roles.map((r) => canonicalRoleId(r))
         : null;
 }
 /** The requested roles that hold NO live runner and already have a persisted state file. A
  * runner carries the operation to the role's in-memory copy and saves it; a role without one
  * (disabled in tumwater.json, or outside a scoped round) is reached only through its state
- * file, and while a fleet is live this process is that file's single writer — the CLI wrote
+ * file, and while a team is live this process is that file's single writer — the CLI wrote
  * only the marker. A role with no state file has no counters or schedule to change, and a
  * corrupt marker (no role list) yields none: the runner superset must not conjure new files
  * for roles the marker never named. */
@@ -47,7 +49,7 @@ function runnerlessTargets(root, markerFile, runners) {
 }
 /** Best-effort write of one operator-request event. The request's side effects have already
  * applied by the time this runs, so an unwritable events log must neither un-acknowledge the
- * marker nor escape the orchestrator's poll body (whose loop has no catch) and end the fleet.
+ * marker nor escape the orchestrator's poll body (whose loop has no catch) and end the team.
  * One wake consumer logs per role, so a throw that escaped would also starve the roles after
  * the first. A failure is still reported on the same feed when that feed is writable. */
 function logRequestEvent(root, event) {
@@ -56,7 +58,7 @@ function logRequestEvent(root, event) {
     }
     catch (err) {
         try {
-            warnEvent(root, "harness", `could not record ${event.type} request: ${errorMessage(err)}`);
+            warnEvent(root, TUMWATER_SOURCE, `could not record ${event.type} request: ${errorMessage(err)}`);
         }
         catch {
             // The event feed is the failure; there is nothing left to report on.
@@ -65,15 +67,15 @@ function logRequestEvent(root, event) {
 }
 /** Report one role's failed state save for a consumed request, best-effort. These consumers run
  * inside the orchestrator's catch-less poll loop, so an unwritable state file (ENOSPC, EACCES,
- * the path replaced by a directory) must not throw out of the poll and end the fleet — the very
- * disk pressure the fleet guards against would otherwise crash it. The caller has already applied
+ * the path replaced by a directory) must not throw out of the poll and end the team — the very
+ * disk pressure the team guards against would otherwise crash it. The caller has already applied
  * the in-memory side effect where it can (a live runner), and a runnerless role's file keeps its
  * previous content, so the warning is what names the un-persisted change. */
 function warnStatePersistFailed(root, role, err) {
-    warnEventBestEffort(root, "harness", `could not persist ${role}'s state for an operator request: ${errorMessage(err)}`);
+    warnEventBestEffort(root, TUMWATER_SOURCE, `could not persist ${role}'s state for your request: ${errorMessage(err)}`);
 }
 /** Consume a pending reset request from `tumwater reset-counters`, if any: the CLI zeroed the
- * state files only when no fleet was running; this zeroes the affected runners' in-memory
+ * state files only when no team was running; this zeroes the affected runners' in-memory
  * copies (which then re-save), or their next tick's save would resurrect the pre-reset values,
  * and writes the zeroed state file directly for requested roles with no runner, which the CLI
  * left to its marker. */
@@ -109,27 +111,26 @@ export function consumeResetRequest(root, runners) {
         const [only] = applied;
         // One role → filed under that loop; several → one harness-level event listing them.
         if (applied.length === 1 && only)
-            logRequestEvent(root, { loop: only, type: "counters_reset" });
+            logRequestEvent(root, { source: only, type: "counters_reset" });
         else
-            logRequestEvent(root, { loop: "harness", type: "counters_reset", roles: applied });
+            logRequestEvent(root, { source: TUMWATER_SOURCE, type: "counters_reset", roles: applied });
     }
     removeQuiet(markerFile);
 }
-/** Consume a pending wake request from `tumwater wake [--role <id>] [--in <duration>]`, if
- * any. Immediate wakes find the state files already cleared by the CLI when no fleet was
- * running; this clears the affected runners' in-memory schedules (backoffSeconds, nextRunAt),
- * or their next save would resurrect the pre-wake sleep window and the loops would keep
- * sleeping until the original backoff expired, and writes the cleared schedule directly for
- * requested roles with no runner, which the CLI left to its marker. A scheduled wake
- * (`--in`) carries a `notBeforeMs`: before the deadline the
- * marker is left in place (a later poll retries it — the wake lands within one poll cycle
- * after the deadline, the same delivery granularity prompt --at's consumer gives), and the
- * deadline-crossing poll's `wake()` call is what applies the state change, since the submit
+/** Consume a pending wake request from `tumwater wake [--role <id>] [--in <duration>]`, if any.
+ * Immediate wakes find the state files already cleared by the CLI when no team was running; this
+ * clears the affected runners' in-memory schedules (backoffSeconds, nextRunAt), or their next save
+ * would resurrect the pre-wake sleep window and the loops would keep sleeping until the original
+ * backoff expired, and writes the cleared schedule directly for requested roles with no runner,
+ * which the CLI left to its marker. A scheduled wake (`--in`) carries a `notBeforeMs`: before the
+ * deadline the marker is left in place (a later poll retries it — the wake takes effect within one
+ * poll cycle after the deadline, the same delivery granularity prompt --at's consumer gives), and
+ * the deadline-crossing poll's `wake()` call is what applies the state change, since the submit
  * deliberately skipped it. A non-numeric or non-finite value (a hand edit's `1e999`) reads as
- * immediate (defensive; validation happens at the CLI) — leaving Infinity as a deadline would
- * hold `notBefore > Date.now()` true forever and strand the marker, which nothing else deletes.
- * Each woken role logs the existing `wake` event with the operator reason, so the fleet's early
- * ticks read in the feed as deliberate. */
+ * immediate (defensive; validation happens at the CLI) — leaving Infinity as a deadline would hold
+ * `notBefore > Date.now()` true forever and strand the marker, which nothing else deletes. Each
+ * woken role logs the existing `wake` event with the operator reason, so the team's early ticks
+ * read in the feed as deliberate. */
 export function consumeWakeRequest(root, runners) {
     // A legacy wake.json (the pre-upgrade build wrote scheduled wakes here) keeps its deadline.
     const markerFile = wakeRequestPath(root);
@@ -229,7 +230,7 @@ function applyWakeMarker(root, markerFile, runners) {
             warnStatePersistFailed(root, r.role, err);
             continue; // warn stands in for the wake event; nothing persisted to celebrate
         }
-        logRequestEvent(root, { loop: r.role, type: "wake", reason: "operator" });
+        logRequestEvent(root, { source: r.role, type: "wake", reason: "operator" }); // vocabulary-ok: wake reason code
     }
     for (const role of runnerlessTargets(root, markerFile, runners)) {
         try {
@@ -239,7 +240,7 @@ function applyWakeMarker(root, markerFile, runners) {
             warnStatePersistFailed(root, role, err);
             continue;
         }
-        logRequestEvent(root, { loop: role, type: "wake", reason: "operator" });
+        logRequestEvent(root, { source: role, type: "wake", reason: "operator" }); // vocabulary-ok: wake reason code
     }
     removeQuiet(markerFile);
 }
@@ -256,7 +257,7 @@ function consumeMarkerRequest(markerFile, act) {
 /** Consume a pending restart request from the dashboard's build-stale alert (POST /api/restart),
  * if any: tell the redeployer to force its next poll past the restart cooldown, then remove the
  * marker. The redeployer logs the `restart_forced` event itself; with no redeployer (a
- * non-self-hosting fleet never has a stale build, so nothing could have written the marker) it
+ * non-self-hosting team never has a stale build, so nothing could have written the marker) it
  * is still cleaned up. */
 export function consumeRestartRequest(root, redeployer) {
     consumeMarkerRequest(restartRequestPath(root), () => redeployer?.forceRestart());
@@ -264,26 +265,25 @@ export function consumeRestartRequest(root, redeployer) {
 /** Consume a pending manual reclaim request from `tumwater reclaim` (plans/disk-floor.md, part
  * 3/4), if any: arm one background pass over every candidate on the controller — the same
  * single-flight runner as pressure and idle reclaim — then remove the marker. With no
- * controller (a fleet that predates the feature) the marker is still cleaned up. */
+ * controller (a team that predates the feature) the marker is still cleaned up. */
 export function consumeReclaimRequest(root, reclaim) {
     consumeMarkerRequest(reclaimRequestPath(root), () => reclaim?.requestManual());
 }
-/** Consume per-role abort requests from `tumwater abort --role <id>`: one marker file per
- * role (no parsing needed), so a request for an idle OR disabled loop is still cleaned up. A
- * running tick gets killed and logs exactly one event; anything else is a silent no-op — the
- * marker's presence IS the request, removing it acknowledges. Since merge queue 3/5 a role's
- * in-flight work is often a LANDING rather than a tick, so the landing's controller is passed
- * in: an abort for the role landing right now kills that too (the drain's task sees
- * `userAborted` and discards the pinned ref when the landing ends). There can be several
- * in-flight units at once (land-queue speed 2c) — one per change being vetted, the merge
- * slot's stack, and each vetted change waiting for it (flagged, then settled by the drain) — so
- * `landings` lists them all and the request stops whichever holds the role. The merge is a
- * whole STACK (merge queue 5/5), so the request matches ANY of its roles — `roles` is every role
- * it is landing right now, and a stop for one of them kills the whole stack: the lander cannot
- * split it (abandoning mid-stack would leave the pinned refs of the not-yet-processed changes
- * for one-at-a-time recovery, which is already the fallback), and the merge discards every
- * stacked ref when it ends. */
-export function consumeAbortRequests(root, runners, landings) {
+/** Consume per-role abort requests from `tumwater abort --role <id>`: one marker file per role (no
+ * parsing needed), so a request for an idle OR disabled loop is still cleaned up. A running tick
+ * gets killed and logs exactly one event; anything else is a silent no-op — the marker's presence
+ * IS the request, removing it acknowledges. Since merge queue 3/5 a role's in-flight work is often
+ * a MERGE rather than a tick, so the merge's controller is passed in: an abort for the role being
+ * merged right now kills that too (the drain's task sees `userAborted` and discards the pinned ref
+ * when the merge ends). There can be several in-flight units at once (land-queue speed 2c) — one
+ * per change being verified, the merge slot's stack, and each verified change waiting for it
+ * (flagged, then settled by the drain) — so `merges` lists them all and the request stops
+ * whichever holds the role. The merge is a whole STACK (merge queue 5/5), so the request matches
+ * ANY of its roles — `roles` is every role it is merging right now, and a stop for one of them
+ * kills the whole stack: the merger cannot split it (abandoning mid-stack would leave the pinned
+ * refs of the not-yet-processed changes for one-at-a-time recovery, which is already the
+ * fallback), and the merge discards every stacked ref when it ends. */
+export function consumeAbortRequests(root, runners, merges) {
     let markers;
     try {
         markers = fs.readdirSync(path.join(root, STATE_DIR));
@@ -295,7 +295,7 @@ export function consumeAbortRequests(root, runners, landings) {
     // unwritable event feed is what failed, and there is nothing left to report on then.
     const warnFailure = (role, err) => {
         try {
-            warnEvent(root, "harness", `could not consume abort request for ${role}: ${errorMessage(err)}`);
+            warnEvent(root, TUMWATER_SOURCE, `could not consume abort request for ${role}: ${errorMessage(err)}`);
         }
         catch {
             // The feed is the failure; the remaining markers still get their turn below.
@@ -312,11 +312,11 @@ export function consumeAbortRequests(root, runners, landings) {
         // after it forever. Apply the side effects first; a failure there keeps the marker for the
         // next poll (retry), but still moves on so it cannot starve the others.
         try {
-            for (const landing of landings) {
-                if (!landing.roles.includes(role))
+            for (const merge of merges) {
+                if (!merge.roles.includes(role))
                     continue;
-                landing.userAborted = true;
-                landing.controller.abort();
+                merge.userAborted = true;
+                merge.controller.abort();
             }
             if (runner?.state.running)
                 runner.abortTick();
@@ -325,12 +325,12 @@ export function consumeAbortRequests(root, runners, landings) {
             warnFailure(role, err);
             continue;
         }
-        // The side effects applied: acknowledge the request. The tick_aborted event is
+        // The side effects applied: acknowledge the request. The run_aborted event is
         // observability, so a log failure must not un-acknowledge an abort that already happened.
         removeQuiet(abortRequestPath(root, role));
         if (runner?.state.running) {
             try {
-                logEvent(root, { loop: role, type: "tick_aborted" });
+                logEvent(root, { source: role, type: "run_aborted" });
             }
             catch (err) {
                 warnFailure(role, err);