tumwater 0.1.2 → 0.2.0

package/dist/src/review/review-precheck.js

@@ -1,3 +1,4 @@
+// vocabulary: plain
 /** The review gate's deterministic build pre-check — split out of review.ts so the gate keeps
  * one responsibility (running the model reviewer and acting on its verdict) while this module
  * owns the pre-review verification: the one scoped build-check run, its flake re-run, the
@@ -13,7 +14,7 @@ import { sampleSleepClock } from "../build/host-sleep.js";
 import { recordReview } from "../tick/tick-apply.js";
 import { mainRedNotMine } from "../text/phrases.js";
 import { shortSha } from "../text/format.js";
-import { checkWaitStage, setLandingStage } from "../landing/landing-slot.js";
+import { checkWaitStage, setMergeStage } from "../merge/merge-slot.js";
 import { mainTipVerdict } from "../baseline/main-red.js";
 import { FLAKY_WARNING_PREFIX, isKnownFlake } from "./known-flakes.js";
 /** Run the gate's deterministic build pre-check. `reject` is the gate's one shared rejection
@@ -22,10 +23,10 @@ import { FLAKY_WARNING_PREFIX, isKnownFlake } from "./known-flakes.js";
  * model-verdict path. */
 export async function gateBuildPrecheck(ctx, state, head, reject) {
     const { root, role, wt, mainBranch, config } = ctx;
-    // The landing cell's stage (a no-op outside a queued landing — see setLandingStage): the
+    // The merge cell's stage (a no-op outside a queued merge — see setMergeStage): the
     // pre-check, its one re-run, and any attribution check behind them are the gate's first
     // long phase.
-    setLandingStage(root, role, "build-check");
+    setMergeStage(root, role, "build-check");
     // The gate's one check invocation — the pre-check and its one flake re-run below are the
     // same run in the same scope, worktree, and config with the same resolved timeout, so the
     // scope and timeout resolution live here once and cannot drift between the two calls.
@@ -65,9 +66,9 @@ export async function gateBuildPrecheck(ctx, state, head, reject) {
             // The run spanned a host sleep past the tolerance and no clean attempt judged the tree
             // (runScopedBuildCheck already retried once): nothing here is the change's failure, so
             // the gate attributes nothing — it keeps the commit and reports the sleep, and the
-            // landing path keeps the pin for a re-land (BUGS.md 2026-09-30).
+            // merge path keeps the pin for a re-merge (BUGS.md 2026-09-30).
             const detail = sleptPhrase("gate check", outcome.run.sleptMs, UNVERIFIED_TREE);
-            warnEventBestEffort(root, role, `${detail}; keeping the commit for a re-land`);
+            warnEventBestEffort(root, role, `${detail}; keeping the commit for another merge attempt`);
             return { resolved: { decision: "failed", detail, unverified: true } };
         }
         if (outcome.status === "failed") {
@@ -75,23 +76,23 @@ export async function gateBuildPrecheck(ctx, state, head, reject) {
             // re-run passed on this exact headline) says nothing about this change: attribute nothing
             // — keep the commit and the pin, count no strike — and name the flake, exactly as the
             // host-sleep path above does. Before this, the repeat was attributed through main's
-            // per-SHA baseline cache (usually a green seeded by an earlier landing), so a load- or
+            // per-SHA baseline cache (usually a green seeded by an earlier merge), so a load- or
             // clock-sensitive test rejected whichever unrelated change hit it (BUGS.md 2026-10-06).
             const flaky = failureHeadline(outcome.outputTail) ?? describeCheck(check);
             if (isKnownFlake(root, flaky)) {
-                const detail = `known-flaky failure, landing kept: ${flaky}`;
+                const detail = `known-flaky failure, merge kept: ${flaky}`;
                 recordReview(state, "failed", [detail], head);
                 warnEventBestEffort(root, role, detail);
                 return { resolved: { decision: "failed", detail, unverified: true } };
             }
             const reasons = checkFailureReasons(check, outcome);
-            // A failure that reproduced is attributed, never fixed here: the one landing slot the
+            // A failure that reproduced is attributed, never fixed here: the one merge slot the
             // whole queue waits on is no place for a model run (the in-slot build-fix run this
-            // replaces held it for hours and never once led to a landing — PLANS.md "Land-queue
+            // replaces held it for hours and never once led to a merge — PLANS.md "Land-queue
             // speed 1/3"). The question is whose failure it is, and main's own verdict at its tip
             // answers it. A failure matching no recorded flake bypasses the per-SHA cache and runs
             // main's check now (forceFresh): a clock- or load-sensitive test can pass on an immutable
-            // SHA early and fail later, so a cached green — usually seeded by an earlier landing —
+            // SHA early and fail later, so a cached green — usually seeded by an earlier merge —
             // may no longer be true, and trusting it rejected an unrelated change (BUGS.md
             // 2026-10-06). A shutdown already under way skips the question and fails closed like any
             // abort.
@@ -105,10 +106,10 @@ export async function gateBuildPrecheck(ctx, state, head, reject) {
                 // Main fails too: not this change's failure. Leave the commit (and with it the pin) and
                 // do not advance the discard counter — the transport-failure rule (BUGS.md 2026-09-20):
                 // nothing judged this diff. main-red.ts's gate and the bugfix handoff own the repair,
-                // and the author's next tick re-lands the change once main is green again.
+                // and the author's next tick re-merges the change once main is green again.
                 const detail = mainRedNotMine(main.sha);
                 recordReview(state, "failed", [detail], head);
-                warnEventBestEffort(root, role, `gate check failed on ${shortSha(head)}, but ${detail}; landing kept`);
+                warnEventBestEffort(root, role, `gate check failed on ${shortSha(head)}, but ${detail}; merge kept`);
                 return { resolved: { decision: "failed", detail, mainRed: true } };
             }
             // Main green: the change broke the check — rejected deterministically through the shared
@@ -123,7 +124,7 @@ export async function gateBuildPrecheck(ctx, state, head, reject) {
         }
         if (outcome.status === "passed") {
             // Passed: this exact tree just went green under the project's own declared check. Hand
-            // the verdict to the landing path via verifiedHead — it seeds the red-main baseline with
+            // the verdict to the merge path via verifiedHead — it seeds the red-main baseline with
             // the SHA that actually becomes main (the rebased head, which may differ from `head`),
             // so every role's next fresh tick is a cache hit instead of one redundant full-suite
             // re-run on an already-verified tree.

package/dist/src/review/review-verdict.js

@@ -7,6 +7,20 @@ import { verdictLines } from "../verdict/reply-contract.js";
 import { clipReason } from "../build/build-check-report.js";
 /** Cap on recorded reasons, so a chatty reviewer cannot bloat persisted state. */
 const MAX_REASONS = 10;
+/** The prior-objection number a reviewer reason is tagged with at its start — `(prior N)`, N
+ * the objection's 1-based number in the prior list the re-review prompt showed — or null when
+ * the reason is a newly raised (untagged) objection. The repeat-finality policy (BUGS.md
+ * 2026-10-14) asks a re-review to restate a still-open prior objection with this tag so the
+ * harness can tell a repeat from a new finding and end a chain whose objection has stopped
+ * converging. Anything else that merely begins with the word "prior" (e.g. "prior to the
+ * change…") is not a tag and reads as an untagged reason. */
+export function priorObjectionNumber(reason) {
+    const m = /^\(prior\s+(\d+)\)/i.exec(reason.trim());
+    if (!m)
+        return null;
+    const n = Number(m[1]);
+    return Number.isInteger(n) && n >= 1 ? n : null;
+}
 /** Parse the reviewer's reply: the LAST VERDICT line wins (the prompt asks for exactly one),
  * followed by its reasons — numbered/bulleted lines first, any other non-empty prose as a
  * fallback. Null when no parseable verdict exists: that is a FAILED review, never an approval

package/dist/src/review/review.js

@@ -1,5 +1,5 @@
 import { REVIEW_RESUME_LIMIT, saveLoopState } from "../loop/loop-state.js";
-import { modelSelectorField, reviewRunConfig } from "../config/config-views.js";
+import { modelSelectorField, resolvedAgentConfig, reviewRunConfig } from "../config/config-views.js";
 import { logEventBestEffort, warnEventBestEffort } from "../events/events.js";
 import { git } from "../git/git-run.js";
 import { changeBaseRev, headOf, patchId } from "../git/git.js";
@@ -16,16 +16,18 @@ import { shortSha } from "../text/format.js";
 import { firstReason } from "../text/phrases.js";
 import { isExemptDiff } from "./exemptions.js";
 import { falseFixReason } from "../verdict/fix-claim.js";
-import { conflictMarkerReason } from "../landing/landing-git.js";
+import { conflictMarkerReason } from "../merge/merge-git.js";
+import { protectedEditReason } from "./protected-edits.js";
+import { secretLeakReason } from "./secret-leaks.js";
 import { backlogStructureReason } from "../backlog/backlog-structure.js";
 import { suiteRerunWarning } from "./suite-rerun.js";
-import { setLandingStage } from "../landing/landing-slot.js";
+import { setMergeStage } from "../merge/merge-slot.js";
 import { gateBuildPrecheck } from "./review-precheck.js";
 /** Attach the review gate's pi runs onto a partial GateResult — `run` plus the optional
  * verdict-recovery follow-up (`followUpRun`) and no-re-run nudge (`nudgeRun`) fields, each
  * present only when its turn actually ran. Spelled once so every return site of
  * reviewAheadOfMain that carries runs shares one shape for the usage-folding caller
- * (landing-core.ts folds run, then followUpRun, then nudgeRun), instead of one conditional
+ * (merge-core.ts folds run, then followUpRun, then nudgeRun), instead of one conditional
  * spread per site that a new run kind would have to update everywhere. */
 function withRuns(r, run, followUp, nudge) {
     return {
@@ -35,6 +37,15 @@ function withRuns(r, run, followUp, nudge) {
         ...(nudge ? { nudgeRun: nudge } : {}),
     };
 }
+/** Put the worktree back on the exact head the gate reviewed: the reviewer's only output is its
+ * verdict, so a commit it made must never reach the merge pin or the next re-review. */
+async function restoreReviewedHead(wt, head, root, role) {
+    const now = await headOf(wt, "HEAD").catch(() => null);
+    if (now && now !== head) {
+        warnEventBestEffort(root, role, `the reviewer moved HEAD to ${shortSha(now)} during review; restored the reviewed head ${shortSha(head)}`);
+    }
+    await git(wt, "reset", "--hard", head);
+}
 /** Consecutive failed reviews of one branch HEAD after which the leftover is discarded with
  * a warning: a misconfigured reviewer model must not be able to wedge a loop into re-reviewing
  * the same commit forever. */
@@ -84,7 +95,7 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
         state.unreviewFailures = 0;
         await resetWorktreeToMain(wt, mainBranch);
         logEventBestEffort(root, {
-            loop: role,
+            source: role,
             type: "review_rejected",
             head,
             reasons,
@@ -99,23 +110,32 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
     }
     const files = await aheadOfMainFiles(wt, mainBranch);
     // A change handed back to its author with the conflict markers left in place (PLANS.md
-    // "Robust conflict landing, part 2/2") must not land raw `<<<<<<<` lines. The stage check
+    // "Robust conflict landing, part 2/2") must not merge raw `<<<<<<<` lines. The stage check
     // flags them for one fix-up turn, but only this deterministic gate rejection makes it a
     // hard stop — an md-only diff skips the reviewer entirely, so nothing else would catch it.
     const markerReason = conflictMarkerReason(wt, files);
     if (markerReason !== undefined)
         return reject([markerReason]);
+    // The prompt block and PRINCIPLES.md are markdown, so the exempt fast path below would merge
+    // an edit to either unreviewed; reject it here, for md-only and code diffs alike.
+    const protectedReason = await protectedEditReason(wt, mainBranch, files, role);
+    if (protectedReason !== undefined)
+        return reject([protectedReason]);
+    // A leaked credential is just as invisible to the exempt fast path: reject it here too.
+    const secretReason = await secretLeakReason(wt, mainBranch, files);
+    if (secretReason !== undefined)
+        return reject([secretReason]);
     if (isExemptDiff(files, config.review.exemptPaths)) {
         // The exemption is a fast path, not a blind eye: an md-only diff that moves a bug to
         // Fixed must have its fix's symbols on this tree, or it records code that does not
-        // exist (BUGS.md 2026-09-22 — 9cea8c3 landed a Fix paragraph naming runScriptGroup
+        // exist (BUGS.md 2026-09-22 — 9cea8c3 merged a Fix paragraph naming runScriptGroup
         // and signalTree with no source behind it). A deterministic rejection, like the
         // pre-check below: no pi run consumed, reasons injected into the author's next tick.
         const falseFix = await falseFixReason(wt, mainBranch, files);
         if (falseFix)
             return reject([falseFix]);
-        // Same cross-check as the landing path (backlog-structure.ts): an md-only diff that
-        // duplicates or drops a `## ` section heading would land unreviewed — md-only edits skip
+        // Same cross-check as the merge path (backlog-structure.ts): an md-only diff that
+        // duplicates or drops a `## ` section heading would merge unreviewed — md-only edits skip
         // the reviewer by design, and a malformed backlog stays invisible until an entry ends up
         // on the wrong side of a heading (PLANS.md 2026-09-25, 52cbadd1).
         const structure = await backlogStructureReason(wt, mainBranch, files);
@@ -126,7 +146,7 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
     }
     // The backlog-structure check for code diffs too, before the build pre-check: a change that
     // duplicates or drops a `## ` section heading in PLANS.md, BUGS.md, or QUESTIONS.md cannot
-    // land, and the rejection is deterministic — no pi run and no check run spent on a tree the
+    // merge, and the rejection is deterministic — no pi run and no check run spent on a tree the
     // heading set already condemns.
     const structure = await backlogStructureReason(wt, mainBranch, files);
     if (structure)
@@ -136,9 +156,9 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
     // "reviewing": a deterministic rejection never shows as reviewing on the dashboards. Both
     // gate callers (the tick path and leftover.ts's recoverLeftover) get it for free. Its run,
     // flake re-run, and attribution live in review-precheck.ts (the check run itself lives in
-    // runScopedBuildCheck, shared with the landing path's in-lock re-check); a resolved result
-    // here is returned verbatim and a pass hands the verified head to the landing path below.
-    // The pre-check sets the landing cell's stage (a no-op outside a queued landing) —
+    // runScopedBuildCheck, shared with the merge path's in-lock re-check); a resolved result
+    // here is returned verbatim and a pass hands the verified head to the merge path below.
+    // The pre-check sets the merge cell's stage (a no-op outside a queued merge) —
     // "build-check" while it runs, "reviewing" when the reviewer run starts below.
     const pre = await gateBuildPrecheck(ctx, state, head, reject);
     if (pre.resolved) {
@@ -163,6 +183,10 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
     // same config the run below gets, so the event names what the reviewer actually runs on —
     // the budget fallback included. Omitted when no model is configured (pi's own default).
     const reviewCfg = reviewRunConfig(config);
+    // The team claude config dir (plans/notes-command.md "Keeping funes out of team runs"), so
+    // a claude review's resume guard looks under the same dir the review run writes its transcript
+    // to — a team that set one must resume under it, not the default ~/.claude.
+    const claudeConfigDir = resolvedAgentConfig(config, "claude").configDir;
     // A progressing timeout left this run's session for the next attempt (LoopState.reviewResume):
     // resume it only while the patch is unchanged (the same diff), the resume budget lasts, and
     // the directory still holds a gate session to `--continue`. Otherwise the stale marker is
@@ -174,7 +198,7 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
         agentSessionResumable(priorResume.sessionDir, {
             kind: "gate",
             agent: reviewCfg.agent ?? "pi",
-        });
+        }, claudeConfigDir);
     if (resuming) {
         // Count the resume before the run: a crash must not let the same session be resumed
         // forever without ever spending the budget.
@@ -194,7 +218,7 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
     // needs the override.
     const followupCtx = reviewSessionDir === ctx.sessionDir ? ctx : { ...ctx, sessionDir: reviewSessionDir };
     logEventBestEffort(root, {
-        loop: role,
+        source: role,
         type: "review_start",
         head,
         ...(ctx.revisionRound !== undefined ? { revision: ctx.revisionRound } : {}),
@@ -207,8 +231,8 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
     state.phase = "review";
     saveLoopState(root, state);
     // Freeze the revision the diff is measured from once, before the run: main moves while a
-    // landing is vetted, and a reviewer comparing against the live `main` ref reads another loop's
-    // just-landed work as this change reverting it (BUGS.md 2026-10-06). The prompt names this SHA
+    // merge is approved, and a reviewer comparing against the live `main` ref reads another loop's
+    // just-merged work as this change reverting it (BUGS.md 2026-10-06). The prompt names this SHA
     // and tells the reviewer to compare against it instead.
     const base = await changeBaseRev(wt, mainBranch);
     const diff = await aheadOfMainDiff(wt, mainBranch);
@@ -224,17 +248,17 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
         }
         : undefined;
     // The reviewer run's wall time rides on its verdict event: a reviewer that takes an hour per
-    // merge on local hardware is a fleet-level cost an operator must be able to see.
+    // merge on local hardware is a team-level cost an operator must be able to see.
     const reviewStartedAt = Date.now();
     // The reviewer's started tool calls, collected only when the no-re-run rule stands (a verified
     // pre-check) — the one case the suite-rerun tripwire below can fire.
     const reviewerCalls = [];
-    // The landing cell switches to the reviewer run's live detail (no-op outside a queued
-    // landing). runPi writes the run's `tumwater_run` label line before spawning pi, and that
+    // The merge cell switches to the reviewer run's live detail (no-op outside a queued
+    // merge). runPi writes the run's `tumwater_run` label line before spawning pi, and that
     // line resets the gate progress accumulator, so the cell never shows a previous run's counts.
-    setLandingStage(root, role, "reviewing");
+    setMergeStage(root, role, "reviewing");
     // The author's claimed WHY/RISK/VERIFIED ride along when present — checking those claims
-    // against the actual diff is exactly the adversarial angle (recovery landings reconstruct
+    // against the actual diff is exactly the adversarial angle (recovery merges reconstruct
     // them from the pinned commit's message).
     const pi = await ctx.runGatePi({
         cwd: wt,
@@ -244,8 +268,8 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
             : buildReviewPrompt(diff, summary, commitBody, readPrinciples(root), highFriction, verifiedByHarness, base, undefined, priorReview),
         // The reviewer runs on its own time budget (review.timeoutSeconds), never longer than a
         // tick's: a timed-out review is a FAILED run (pi.ok false), so it takes the dead-backend
-        // path below — commit kept, no strike — and re-lands through the author's next tick
-        // instead of holding the land queue for a whole authoring tick.
+        // path below — commit kept, no strike — and re-merges through the author's next tick
+        // instead of holding the merge queue for a whole authoring tick.
         config: reviewCfg,
         // This run's own session directory (per-run, keyed by tick and pinned sha): a follow-up
         // turn, or a later attempt that resumes this review, continues exactly this run instead
@@ -269,21 +293,38 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
                 reviewerCalls.push({ toolName, args });
             }
             : undefined,
+        // A gate run that read an image its model cannot see is logged, not killed (plans/
+        // image-input.md "Detecting a blind read"): the reviewer keeps working from what it CAN
+        // see, and the image_blind line names the file, the model, and this tick so the operator
+        // knows the diff was judged under a blind read.
+        onBlindRead: (path, action) => logEventBestEffort(root, {
+            source: role,
+            type: "image_blind",
+            run: ctx.tick,
+            path,
+            model: reviewCfg.model,
+            action,
+        }),
     });
-    // A reviewer told the pre-check passed that re-ran the full suite anyway held the landing
+    // A reviewer told the pre-check passed that re-ran the full suite anyway held the merge
     // slot and loaded the shared host for a result the harness already had (BUGS.md 2026-09-23:
     // scratch copies under /tmp, `npm ci` and `npm test` there). Warned on every outcome, abort
     // included — the run happened either way; the verdict itself is not touched.
     const rerun = suiteRerunWarning(reviewerCalls);
     if (rerun)
         warnEventBestEffort(root, role, rerun);
+    // Every exit below that keeps the change leaves the worktree at the head this gate reviewed.
+    const keep = async (r) => {
+        await restoreReviewedHead(wt, head, root, role);
+        return r;
+    };
     if (pi.aborted) {
         // Shutdown mid-review: fail closed — the commit stays on the branch and the
         // resumed/following tick re-reviews it via the combined ahead-of-main diff. Any resume
         // marker from an earlier attempt is dropped: an abort says nothing about the diff, and the
         // next attempt starts clean rather than inheriting a half-counted session.
         state.reviewResume = undefined;
-        return withRuns({ decision: "failed", aborted: true }, pi, null, null);
+        return keep(withRuns({ decision: "failed", aborted: true }, pi, null, null));
     }
     // The bounded nudge (BUGS.md 2026-10-02): the reviewer broke the no-re-run rule despite a
     // green pre-check, so one turn on its own session names the call and asks it to finish
@@ -295,11 +336,11 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
         const nudgeCalls = [];
         nudge = await requestNoRerun(followupCtx, rerun, nudgeCalls);
         if (nudge?.aborted) {
-            return withRuns({ decision: "failed", aborted: true }, pi, null, nudge);
+            return keep(withRuns({ decision: "failed", aborted: true }, pi, null, nudge));
         }
         nudgeRepeat = nudge ? (suiteRerunWarning(nudgeCalls) ?? null) : null;
         if (nudgeRepeat) {
-            warnEventBestEffort(root, role, `${nudgeRepeat} the repeat fails this review: the commit stays, and the landing re-reviews it without a third suite run`);
+            warnEventBestEffort(root, role, `${nudgeRepeat} the repeat fails this review: the commit stays, and the merge re-reviews it without a third suite run`);
         }
     }
     let verdict = parseVerdict(pi.verdictText ?? "");
@@ -324,7 +365,7 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
     if (!verdict && pi.ok && !nudge) {
         followUp = await requestVerdict(followupCtx);
         if (followUp?.aborted)
-            return withRuns({ decision: "failed", aborted: true }, pi, followUp, nudge);
+            return keep(withRuns({ decision: "failed", aborted: true }, pi, followUp, nudge));
         const recovered = followUp ? parseVerdict(followUp.verdictText ?? "") : null;
         if (recovered) {
             verdict = recovered;
@@ -333,14 +374,14 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
     }
     // A repeat after the nudge (BUGS.md 2026-10-02): the reviewer re-ran the suite on the nudge
     // turn too. Fail the review — strike-free like a dead backend (BUGS.md 2026-09-20): the
-    // commit stays for the next landing's re-review, the discard counter never advances, and no
+    // commit stays for the next merge's re-review, the discard counter never advances, and no
     // rejection is recorded against the author's diff.
     if (nudgeRepeat) {
-        const message = `${nudgeRepeat} The review is failed on this repeat: the commit is kept, and the landing re-reviews it under the normal path.`;
-        logEventBestEffort(root, { loop: role, type: "review_failed", head, message, durationMs: Date.now() - reviewStartedAt });
+        const message = `${nudgeRepeat} The review is failed on this repeat: the commit is kept, and the merge re-reviews it under the normal path.`;
+        logEventBestEffort(root, { source: role, type: "review_failed", head, message, durationMs: Date.now() - reviewStartedAt });
         state.reviewResume = undefined;
         recordReview(state, "failed", [message], head);
-        return withRuns({ decision: "failed", detail: message }, pi, followUp, nudge);
+        return keep(withRuns({ decision: "failed", detail: message }, pi, followUp, nudge));
     }
     if (!verdict) {
         const followUpError = followUp && !followUp.ok ? followUp.errorMessage : undefined;
@@ -369,7 +410,7 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
             agentSessionResumable(reviewSessionDir, {
                 kind: "gate",
                 agent: reviewCfg.agent ?? "pi",
-            });
+            }, claudeConfigDir);
         const reviewTimeoutRewrite = (message) => message.replace(" — session and worktree edits preserved for resume", resumeRemains
             ? " — the commit is kept; the next attempt continues this review"
             : " — the commit is kept; the next attempt reviews it from scratch");
@@ -381,7 +422,7 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
                 : followUp
                     ? ", even after a follow-up turn on its session"
                     : ""}`);
-        logEventBestEffort(root, { loop: role, type: "review_failed", head, message, durationMs: Date.now() - reviewStartedAt });
+        logEventBestEffort(root, { source: role, type: "review_failed", head, message, durationMs: Date.now() - reviewStartedAt });
         // A dead reviewer must never destroy committed work (BUGS.md 2026-09-20): leave the commit
         // for the next tick's re-review and do not advance the per-HEAD discard counter. That
         // holds for the review run itself (BUGS.md 2026-09-20), for the verdict-recovery
@@ -405,7 +446,7 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
             }
             recordReview(state, "failed", [message], head);
             const configError = pi.configError || Boolean(followUp?.configError) || Boolean(nudge?.configError);
-            return withRuns({ decision: "failed", detail: message, ...(configError ? { configError: true } : {}) }, pi, followUp, nudge);
+            return keep(withRuns({ decision: "failed", detail: message, ...(configError ? { configError: true } : {}) }, pi, followUp, nudge));
         }
         // Consecutive failures of THIS HEAD only: a new commit (new HEAD) starts fresh. Read
         // *before* overwriting lastReview with this failure.
@@ -421,7 +462,8 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
             discarded = true;
             warnEventBestEffort(root, role, `discarding unreviewed leftover after ${REVIEW_FAILURE_LIMIT} failed reviews (${shortSha(head)})`);
         }
-        return { ...withRuns({ decision: "failed", detail: message }, pi, followUp, nudge), ...(discarded ? { discarded: true } : {}) };
+        const failed = { ...withRuns({ decision: "failed", detail: message }, pi, followUp, nudge), ...(discarded ? { discarded: true } : {}) };
+        return discarded ? failed : keep(failed);
     }
     if (verdict.verdict === "reject") {
         const rejected = await reject(verdict.reasons, Date.now() - reviewStartedAt);
@@ -435,9 +477,9 @@ export async function reviewAheadOfMain(ctx, state, summary, commitBody, highFri
     state.reviewResume = undefined;
     recordReview(state, "approve", verdict.reasons, head);
     state.unreviewFailures = 0;
-    await git(wt, "reset", "--hard", "HEAD");
+    await restoreReviewedHead(wt, head, root, role);
     logEventBestEffort(root, {
-        loop: role,
+        source: role,
         type: "review_verdict",
         head,
         reason: verdict.reasons[0],

package/dist/src/review/secret-leaks.js

@@ -0,0 +1,127 @@
+// vocabulary: plain
+import fs from "node:fs";
+import path from "node:path";
+import { readTextOrNull } from "../files/files.js";
+import { readJsonFile } from "../files/json-files.js";
+import { changeBaseRev, fileContentAt } from "../git/git.js";
+import { piModelsPath } from "../pi/pi-models.js";
+import { moreSuffix } from "../text/phrases.js";
+/** Environment variable names that hold credentials. */
+const SECRET_NAME = /(TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY)/i;
+/** A value shorter than this is a setting (a token limit), not a credential. */
+const MIN_SECRET_LENGTH = 16;
+/** Files larger than this are not scanned. */
+const MAX_SCAN_BYTES = 8 * 1024 * 1024;
+/** Most files named in one reason. */
+const MAX_NAMED = 10;
+/** A credential-shaped value: at least 16 characters, no whitespace, not a path. */
+function looksLikeSecret(value) {
+    return value.length >= MIN_SECRET_LENGTH && !/\s/.test(value) && !value.startsWith("/");
+}
+/** The environment entries that look like credentials: a secret-like name and a value of at
+ * least 16 characters with no whitespace that is not a path (so `GOOGLE_APPLICATION_CREDENTIALS`
+ * pointing at a key file is not a secret). */
+export function secretEnvValues(env) {
+    const out = [];
+    for (const [name, value] of Object.entries(env)) {
+        if (value === undefined || !SECRET_NAME.test(name))
+            continue;
+        if (!looksLikeSecret(value))
+            continue;
+        out.push({ name, value });
+    }
+    return out;
+}
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** The credentials pi stores: literal `apiKey`s and header values in `models.json`, and the
+ * `key`/`access`/`refresh` fields (plus secret-named `env` values) of the sibling `auth.json`.
+ * `$NAME` interpolations (secretEnvValues covers those) and `!command` values are skipped. A
+ * missing or torn file yields nothing; never throws. */
+export function piCredentialValues(modelsPath = piModelsPath()) {
+    const out = [];
+    const add = (name, value) => {
+        if (typeof value !== "string" || value.startsWith("$") || value.startsWith("!"))
+            return;
+        if (looksLikeSecret(value))
+            out.push({ name, value });
+    };
+    const models = readJsonFile(modelsPath);
+    if (models && isRecord(models.providers)) {
+        for (const [p, cfg] of Object.entries(models.providers)) {
+            if (!isRecord(cfg))
+                continue;
+            add(`models.json ${p}.apiKey`, cfg.apiKey);
+            if (isRecord(cfg.headers)) {
+                for (const [h, v] of Object.entries(cfg.headers))
+                    add(`models.json ${p}.headers.${h}`, v);
+            }
+        }
+    }
+    const auth = readJsonFile(path.join(path.dirname(modelsPath), "auth.json"));
+    if (auth) {
+        for (const [p, cred] of Object.entries(auth)) {
+            if (!isRecord(cred))
+                continue;
+            for (const f of ["key", "access", "refresh"])
+                add(`auth.json ${p}.${f}`, cred[f]);
+            if (isRecord(cred.env)) {
+                for (const [n, v] of Object.entries(cred.env)) {
+                    if (SECRET_NAME.test(n))
+                        add(`auth.json ${p}.env.${n}`, v);
+                }
+            }
+        }
+    }
+    return out;
+}
+/** Every secret the gate knows: secret-named environment values (named `$NAME`) then pi's stored
+ * credentials (named `pi <file> <path>`), the first entry winning when two share a value. */
+export function knownSecrets(env = process.env, modelsPath = piModelsPath()) {
+    const all = [
+        ...secretEnvValues(env).map((s) => ({ name: `$${s.name}`, value: s.value })),
+        ...piCredentialValues(modelsPath).map((s) => ({ name: `pi ${s.name}`, value: s.value })),
+    ];
+    return all.filter((s, i) => all.findIndex((o) => o.value === s.value) === i);
+}
+/** The deterministic gate/stage finding for a change that writes the value of a secret
+ * environment variable or stored pi credential into a file (a Node diagnostic report dumps
+ * the whole environment). A value already present in the file at the merge-base is not this
+ * change's leak. The reason
+ * names files and variables, never the value. undefined when nothing leaked; never throws on
+ * an unreadable file. */
+export async function secretLeakReason(wt, mainBranch, files, secrets = knownSecrets()) {
+    if (secrets.length === 0)
+        return undefined;
+    let baseRev;
+    const leaks = [];
+    for (const file of files) {
+        const full = path.join(wt, file);
+        let stat;
+        try {
+            stat = fs.statSync(full);
+        }
+        catch {
+            continue;
+        }
+        if (!stat.isFile() || stat.size > MAX_SCAN_BYTES)
+            continue;
+        const head = readTextOrNull(full);
+        if (head === null)
+            continue;
+        const hits = secrets.filter((s) => head.includes(s.value));
+        if (hits.length === 0)
+            continue;
+        baseRev ??= await changeBaseRev(wt, mainBranch);
+        const base = await fileContentAt(wt, baseRev, file);
+        for (const s of hits) {
+            if (!base.includes(s.value))
+                leaks.push(`\`${file}\` contains the value of ${s.name}`);
+        }
+    }
+    if (leaks.length === 0)
+        return undefined;
+    const shown = leaks.slice(0, MAX_NAMED).join("; ");
+    return `${shown}${moreSuffix(leaks.length - MAX_NAMED)} — delete the file or remove the value; never commit credentials (a Node diagnostic report, report.*.json, dumps the whole environment)`;
+}

package/dist/src/review/suite-rerun.js

@@ -1,8 +1,9 @@
+// vocabulary: plain
 /** Detecting a reviewer run that re-ran the full suite on a tree the gate's pre-check already
  * verified — pure string logic over the bash command lines a pi run started, no subprocess or
  * file I/O. The review prompt tells such a reviewer not to (src/prompt/gate-prompts.ts), but on
- * 2026-09-23 two reviewers that got the instruction copied their lander worktree to /tmp and ran
- * `npm ci` and `npm test` there anyway, holding the landing slot and loading the shared host;
+ * 2026-09-23 two reviewers that got the instruction copied their merger worktree to /tmp and ran
+ * `npm ci` and `npm test` there anyway, holding the merge slot and loading the shared host;
  * 102 of 429 retained review sessions ran a suite or `npm ci` themselves (BUGS.md 2026-09-23).
  * The prompt is the fix, this is the tripwire: review.ts feeds the reviewer's tool calls through
  * suiteRerunWarning and logs a warning when the rule was broken, so the digest can count it.
@@ -174,5 +175,5 @@ export function suiteRerunWarning(calls) {
     if (first === undefined)
         return undefined;
     const more = moreSuffix(reruns.length - 1);
-    return `reviewer re-ran the suite the harness's pre-check already verified: ${squash(first, 160)}${more}`;
+    return `reviewer re-ran the suite tumwater's pre-check already verified: ${squash(first, 160)}${more}`;
 }

package/dist/src/roles/legacy-role-ids.js

@@ -0,0 +1,21 @@
+/** The one table of retired role ids, old id → new id. The switch parts of the plain-terms role
+ * rename add a row each; a row is never removed, because old events, state files and typed
+ * flags keep naming the old id. */
+export const LEGACY_ROLE_IDS = {
+    dry: "dedupe",
+    telemetry: "selfcheck",
+};
+/** Today's id for a role id a person typed or an old file holds; any other id comes back
+ * unchanged. `legacy` is a test seam. */
+export function canonicalRoleId(id, legacy = LEGACY_ROLE_IDS) {
+    return Object.hasOwn(legacy, id) ? legacy[id] : id;
+}
+/** The retired ids that now map to `id`. */
+export function legacyRoleIdsOf(id, legacy = LEGACY_ROLE_IDS) {
+    return Object.entries(legacy).filter(([, next]) => next === id).map(([old]) => old);
+}
+/** `--grep` arguments matching a role's commit subjects under its current id and every retired
+ * one. git ORs repeated `--grep`s, so a history search sees both. */
+export function roleCommitGrep(id, legacy = LEGACY_ROLE_IDS) {
+    return [id, ...legacyRoleIdsOf(id, legacy)].map((r) => `--grep="tumwater(${r})"`).join(" ");
+}