tumwater 0.1.2 → 0.2.0

package/dist/src/tick/tick-stage.js

@@ -1,35 +1,50 @@
-import { commitAll } from "../git/git.js";
+import { commitAll, foldCommitsSince, headOf } from "../git/git.js";
 import { changedFiles } from "../git/git-diff.js";
-import { buildCommitMessage, commitTrailer, extractCommitBody, extractSummary, fallbackSummary, formatCommitBody, mergeCommitBody, stampedSubject, } from "../git/commit-message.js";
+import { buildCommitMessage, commitTrailer, extractCommitBody, extractSummary, summaryOverCap, fallbackSummary, formatCommitBody, mergeCommitBody, stampedSubject, } from "../git/commit-message.js";
 import { logEventBestEffort } from "../events/events.js";
-import { enqueueLanding } from "../landing/landing-queue.js";
+import { enqueueMerge, entryRevisionFields } from "../merge/merge-queue.js";
 import { plural } from "../text/phrases.js";
 import { recordFlow } from "./qa-coverage.js";
 import { INSTANCE_ROLES, baseRoleOf, configuredInstances } from "../roles/loop-ids.js";
 import { stagedMovedEntries } from "../scheduling/claims.js";
 import { entryKey } from "../backlog/backlog-eligibility.js";
 import { assignedMovedFinding, heldMovedFinding } from "./stage-check.js";
-/** Stage a changed worktree for the land queue: derive the commit message from the reply's
+import { archiveNewFinishedEntries } from "../backlog/backlog-archive.js";
+/** Fold commits an agent run made since `base` into the tick's tree, keeping the harness commit
+ * the tick's only one (INV-H1); warns when any were folded. The one home of the fold-and-warn
+ * policy and its wording, shared by the two fold sites — the authoring run (loop-tick.ts) and
+ * this module's follow-up turns — so they cannot drift. */
+export async function foldAgentCommitsSince(ctx, wt, base) {
+    const folded = await foldCommitsSince(wt, base);
+    if (folded > 0)
+        ctx.warn(`agent made ${plural(folded, "commit")} during the run; folded into tumwater's commit`);
+}
+/** Stage a changed worktree for the merge queue: derive the commit message from the reply's
  * SUMMARY block (one bounded follow-up turn when the run left none), flag high-friction ticks,
- * commit, pin the commit by the role's landing ref, and enqueue the landing. Extracted from
+ * commit, pin the commit by the role's merge ref, and enqueue the merge. Extracted from
  * LoopRunner.runTick so the tick's own method stays the outcome classifier and this module is
- * the commit-staging layer — the only place a fresh tick's work becomes a queued landing.
+ * the commit-staging layer — the only place a fresh tick's work becomes a queued merge.
  * Returns the tick's outcome; a failed pin or an aborted follow-up returns an error/aborted
  * outcome without anything queued. */
-export async function stageTickLanding(ctx) {
+export async function stageTickMerge(ctx) {
     const s = ctx.state;
     // A revision tick carries the round it applied on its context (loop-tick.ts): it rides onto the
-    // queued landing so a rejection of this change records the NEXT round (plans/revise-rejected.md).
+    // queued merge so a rejection of this change records the NEXT round (plans/revise-rejected.md).
     // Undefined for a fresh change — including a user-request tick that leaves a pending revision
     // untouched — so only the tick that actually held the rejected diff is labeled a revision.
     const revisionRound = ctx.revisionRound;
-    // A revision landing carries the review that rejected the change (plans/revise-rejected.md
-    // part 2/2): the prior head and its numbered objections ride the queued entry so the re-review
-    // can check each one against the interdiff. Only a tick that actually held the rejected diff
-    // attaches it; a fresh change — including a user-request tick that leaves a pending revision
-    // untouched — and a recovery landing carry none.
+    // A revision merge carries the review that rejected the change (plans/revise-rejected.md
+    // part 2/2): the prior head, its numbered objections, and each objection's persistence count
+    // ride the queued entry so the re-review can check each one against the interdiff and the next
+    // rejection can resolve a `(prior N)` restatement (BUGS.md 2026-10-14). Only a tick that
+    // actually held the rejected diff attaches it; a fresh change — including a user-request tick
+    // that leaves a pending revision untouched — and a recovery merge carry none.
     const priorReview = revisionRound !== undefined && s.lastReview?.head
-        ? { sha: s.lastReview.head, reasons: s.lastReview.reasons }
+        ? {
+            sha: s.lastReview.head,
+            reasons: s.lastReview.reasons,
+            ...(s.revision?.reasonCounts?.length ? { counts: s.revision.reasonCounts } : {}),
+        }
         : undefined;
     // The commit subject and body come from the reply's closing block. A run that changed files
     // without one — a cut-off final message, or plain non-compliance — gets one bounded follow-up
@@ -38,7 +53,9 @@ export async function stageTickLanding(ctx) {
     let summary = extractSummary(ctx.finalText);
     let body = extractCommitBody(ctx.finalText);
     if (summary === null) {
+        const base = await headOf(ctx.wt, "HEAD");
         const followUp = await ctx.requestSummary(ctx.wt);
+        await foldAgentCommitsSince(ctx, ctx.wt, base);
         if (followUp?.aborted)
             return ctx.finishAbortedTick();
         if (followUp) {
@@ -46,7 +63,7 @@ export async function stageTickLanding(ctx) {
             body = body ?? extractCommitBody(followUp.finalText);
         }
         if (summary === null)
-            summary = fallbackSummary(await changedFiles(ctx.wt), ctx.role, s.ticks);
+            summary = fallbackSummary(await changedFiles(ctx.wt), ctx.role, s.runs);
         ctx.warn(`reply had no SUMMARY line — ` +
             (followUp && extractSummary(followUp.finalText) !== null
                 ? "recovered it with a follow-up turn"
@@ -57,15 +74,34 @@ export async function stageTickLanding(ctx) {
                         ? `follow-up gave none; subject derived from the changed files: "${summary}"`
                         : `no follow-up session was available; subject derived from the changed files: "${summary}"`));
     }
+    else {
+        // A SUMMARY the cap would cut mid-word gets one follow-up turn asking for it restated short.
+        const over = summaryOverCap(ctx.finalText);
+        if (over !== null) {
+            const base = await headOf(ctx.wt, "HEAD");
+            const followUp = await ctx.requestSummary(ctx.wt, over);
+            await foldAgentCommitsSince(ctx, ctx.wt, base);
+            if (followUp?.aborted)
+                return ctx.finishAbortedTick();
+            const short = followUp && summaryOverCap(followUp.finalText) === null ? extractSummary(followUp.finalText) : null;
+            if (short !== null) {
+                summary = short;
+                body = body ?? extractCommitBody(followUp.finalText);
+            }
+            ctx.warn(short !== null
+                ? `SUMMARY was ${over} characters — shortened with a follow-up turn`
+                : `SUMMARY was ${over} characters — follow-up gave no shorter one; subject truncated`);
+        }
+    }
     // The gate's deterministic backlog checks run here, before the commit, while the authoring
-    // session can still be continued: a finding that reaches review costs a queue slot, a vet,
-    // and a rejection that discards the work. One bounded follow-up turn on the author's own
-    // session gets to fix them; the gate still has the final say, and the change commits and
-    // queues either way.
+    // session can still be continued: a finding that reaches review costs a queue slot,
+    // a verification, and a rejection that discards the work. One bounded follow-up turn on the
+    // author's own session gets to fix them; the gate still has the final say, and the change commits
+    // and queues either way.
     // Claims made at staging (plans/parallel-work-instances.md "Claims", part 4/7): an
     // unassigned tick of a MULTI-instance base whose diff moved a backlog entry out of its
     // actionable section records the claim so a sibling is not assigned it while this change
-    // lands. A single-runner base has no sibling to hold the entry from, so it stages nothing
+    // merges. A single-runner base has no sibling to hold the entry from, so it stages nothing
     // and is unchanged by claims. An assigned tick that moved a DIFFERENT entry gets a finding,
     // so the one fix-up turn can put it back. So does an unassigned tick that moved an entry a
     // sibling holds (the poll's heldElsewhere, which its prompt listed as off-limits): that entry
@@ -83,14 +119,14 @@ export async function stageTickLanding(ctx) {
         const first = claimable[0];
         s.claim = { file: first.file, key: first.key, title: first.title, at: Date.now(), source: "staged" };
         // The assignment is durable in state before this event; an unwritable feed must not reject
-        // the tick and make a claim that did land look unapplied (logEventBestEffort).
+        // the tick and make a claim that did take effect look unapplied (logEventBestEffort).
         logEventBestEffort(ctx.root, {
-            loop: ctx.role,
+            source: ctx.role,
             type: "claim",
             action: "assigned",
             key: first.key,
             title: first.title,
-            source: "staged",
+            origin: "staged",
         });
     }
     const assignedMoved = s.claim ? assignedMovedFinding(s.claim.key, moved) : undefined;
@@ -101,7 +137,9 @@ export async function stageTickLanding(ctx) {
         findings.push(heldMoved);
     if (findings.length > 0) {
         const before = findings.length;
+        const fixBase = await headOf(ctx.wt, "HEAD");
         const fixUp = await ctx.requestStageFix(ctx.wt, findings);
+        await foldAgentCommitsSince(ctx, ctx.wt, fixBase);
         if (fixUp?.aborted)
             return ctx.finishAbortedTick();
         if (fixUp) {
@@ -137,53 +175,59 @@ export async function stageTickLanding(ctx) {
     const authoringTurns = ctx.tickTurns;
     const highFriction = authoringTurns > ctx.config.thrashTurns && minutes > ctx.config.thrashMinutes;
     if (highFriction) {
-        ctx.warn(`high-friction tick: ${authoringTurns} turns in ${Math.round(minutes)} min ` +
+        ctx.warn(`high-friction run: ${authoringTurns} turns in ${Math.round(minutes)} min ` +
             `(thresholds: ${ctx.config.thrashTurns} turns / ${ctx.config.thrashMinutes} min)`);
     }
     // The trailer is harness-stamped truth: turns and peak ctx over this tick's pre-commit
     // runs only (conflict-resolution and review runs fold after the commit). A high-friction
     // tick appends its Friction line here — both values are already computed above.
-    const message = buildCommitMessage(stampedSubject(baseRoleOf(ctx.role), summary), body, commitTrailer(ctx.role, s.ticks, authoringTurns, s.peakContextTokens, highFriction ? minutes : undefined, revisionRound));
+    const message = buildCommitMessage(stampedSubject(baseRoleOf(ctx.role), summary), body, commitTrailer(ctx.role, s.runs, authoringTurns, s.peakContextTokens, highFriction ? minutes : undefined, revisionRound));
+    // The backlog archive (plans/backlog-archive.md): an entry this change pasted under PLANS.md's
+    // ## Done or BUGS.md's ## Fixed moves to the top of PLANS-DONE.md or BUGS-FIXED.md now, after
+    // the self-check and its fix-up turn worked on the tree the author wrote and before the
+    // commit, so the review and the merge see the archived form and the live files keep only
+    // open work. A failed sweep leaves the entry where the author put it; nothing reads it lost.
+    if (ctx.mainBranch)
+        await archiveNewFinishedEntries(ctx.wt, ctx.mainBranch).catch(() => []);
     const commit = await commitAll(ctx.wt, message);
-    // Pin the commit by its landing ref BEFORE freeing the worktree (invariant 4), then hand it
-    // to the land queue: from here on the review gate and the rebase run in a vet's leased pool
-    // slot, never in this worktree (plans/merge-queue.md 2/5). A failed pin defers to next-tick
-    // recovery — landing without a pin would lose the ref lifecycle this whole flow depends on.
-    // The reviewer checks the author's claimed WHY/VERIFIED against the actual diff; no diff
+    // Pin the commit by its merge ref BEFORE freeing the worktree (invariant 4), then hand it
+    // to the merge queue: from here on the review gate and the rebase run in a verification's
+    // leased pool slot, never in this worktree (plans/merge-queue.md 2/5). A failed pin defers to
+    // next-tick recovery — merge without a pin would lose the ref lifecycle this whole flow depends
+    // on. The reviewer checks the author's claimed WHY/VERIFIED against the actual diff; no diff
     // reaches main unreviewed.
     if (!(await ctx.pinAndReset(ctx.wt, commit))) {
-        s.lastError = "failed to pin the landing ref; left for next-tick recovery";
+        s.lastError = "failed to pin the merge ref; left for the next run's recovery";
         return { result: "error", summary: s.lastError };
     }
-    // The commit is pinned and the worktree is free: enqueue the landing and END the tick — the
-    // orchestrator drains the queue on its single landing slot, outside the author semaphore, so
-    // this slot is free the moment the work is committed (plans/merge-queue.md 3/5). The landing
-    // runs the same gate + landing flow through runLandingPi/foldLandingUsage on this same state
+    // The commit is pinned and the worktree is free: enqueue the merge and END the tick — the
+    // orchestrator drains the queue on its single merge slot, outside the author semaphore, so
+    // this slot is free the moment the work is committed (plans/merge-queue.md 3/5). The merge
+    // runs the same gate + merge flow through runMergePi/foldMergeUsage on this same state
     // object — recording the commit count, the outcome, and the reviewer spend into it — and logs
-    // landed/land_failed; a non-terminal outcome keeps the pin for next-tick leftover recovery.
-    // `commits` was NOT incremented above: it counts landed changes only.
-    enqueueLanding(ctx.root, {
+    // merge_done/merge_failed; a non-terminal outcome keeps the pin for next-tick leftover recovery.
+    // `commits` was NOT incremented above: it counts merged changes only.
+    enqueueMerge(ctx.root, {
         role: ctx.role,
         sha: commit,
-        tick: s.ticks,
+        run: s.runs,
         summary,
         body: body ? formatCommitBody(body) : undefined,
         highFriction: highFriction || undefined,
-        ...(revisionRound !== undefined ? { revisionRound } : {}),
-        ...(priorReview !== undefined ? { priorReview } : {}),
+        ...entryRevisionFields({ revisionRound, priorReview }),
         enqueuedAt: Date.now(),
     });
-    // The revision is now in flight: the rejected ref's lifecycle continues in the lander
-    // (landing-core.ts), which deletes it when this landing lands and repoints it on a rejection.
+    // The revision is now in flight: the rejected ref's lifecycle continues in the merger
+    // (merge-core.ts), which deletes it when this merge merges and repoints it on a rejection.
     // The round is also stamped on the commit's Revision trailer above, so leftover recovery can
-    // rebuild a retriable revision's landing entry with its round when the queue marker is lost.
+    // rebuild a retriable revision's merge entry with its round when the queue marker is lost.
     if (revisionRound !== undefined)
         s.revision = undefined;
-    // The landing sits in the durable queue above and the commit is pinned; the event is
+    // The merge sits in the durable queue above and the commit is pinned; the event is
     // observability, so an unwritable feed must not reject a tick whose work is already queued.
-    logEventBestEffort(ctx.root, { loop: ctx.role, type: "land_queued", commit, summary });
+    logEventBestEffort(ctx.root, { source: ctx.role, type: "merge_queued", commit, summary });
     // The flag's durable record is the Friction trailer line stamped on the commit above;
-    // lastSummary and the tick_end event carry it too for dashboards and logs.
+    // lastSummary and the run_end event carry it too for dashboards and logs.
     const finalSummary = highFriction
         ? `${summary} (high friction: ${authoringTurns} turns / ${Math.round(minutes)}m)`
         : summary;

package/dist/src/tick/tick-timing.js

@@ -1,16 +1,17 @@
+// vocabulary: plain
 import { BUILD_CHECK_TIMEOUT_MS } from "../build/build-check-detect.js";
-import { warnEvent } from "../events/events.js";
+import { warnEvent, TUMWATER_SOURCE } from "../events/events.js";
 import { removeQuiet } from "../files/files.js";
-import { landingStatePath } from "../paths.js";
+import { mergeStatePath } from "../paths.js";
 import { runOnAbort } from "../process/process.js";
 /** The orchestrator's tick-timing and scheduling seams (src/orchestrator/orchestrator.ts
  * keeps the poll loop itself — the control flow that calls these). Each is exported as a
  * unit-test seam (test/orchestrator-seams.test.ts): timing a semaphore-gated tick, an
- * abort-interruptible sleep, and the restart hand-off's bounded wait on the in-flight landing.
+ * abort-interruptible sleep, and the restart hand-off's bounded wait on the in-flight merge.
  * Split out of orchestrator.ts — which had grown into both the poll loop and the timing helpers
- * it schedules with — so the loop reads as control flow over these named steps. The fleet-health
- * polls (the fleet hold, the error-storm warning, the failure-spread alarm) are their own family
- * in src/fleet/fleet-polls.ts. */
+ * it schedules with — so the loop reads as control flow over these named steps. The team-health
+ * polls (the team hold, the error-storm warning, the failure-spread alarm) are their own family
+ * in src/team/team-polls.ts. */
 /** How many completed role-tick samples the p75 needs before it is trusted as the drain window.
  * Below this the orchestrator reports no p75 and poll keeps the cold-start constant. */
 const DRAIN_P75_MIN_SAMPLES = 10;
@@ -25,39 +26,39 @@ export function p75TickDurationMs(durations) {
     const sorted = [...durations].sort((a, b) => a - b);
     return sorted[Math.min(sorted.length - 1, Math.floor(sorted.length * 0.75))] ?? null;
 }
-/** How long a restart's hand-off waits on an in-flight landing, per phase: one window for it to
+/** How long a restart's hand-off waits on an in-flight merge, per phase: one window for it to
  * finish on its own, then — having aborted it — one more for the step it was in to end
- * (awaitLandingForHandoff; BUGS.md 2026-09-23). By the time a restart reaches its `finally` the new
- * build is already in dist/ and every role tick is done or aborted, so the landing is all the fleet
- * is still running: each minute spent on it is a minute nothing else ticks. A landing's unbounded
+ * (awaitMergeForHandoff; BUGS.md 2026-09-23). By the time a restart reaches its `finally` the new
+ * build is already in dist/ and every role tick is done or aborted, so the merge is all the team
+ * is still running: each minute spent on it is a minute nothing else ticks. A merge's unbounded
  * part is model work — its reviewer run (and, until 2026-09-24, a gate build-fix run: the
  * 2026-09-23 one held the slot for 4 h 35 m and that day's hand-off sat through 97 minutes of it).
  * Its deterministic part is bounded: at most one build check (BUILD_CHECK_TIMEOUT_MS) plus git
- * steps. So a check's bound plus a minute lets a landing already past its model runs — in its
- * last check and fast-forward — land, and gives an aborted landing's current step (a check, which
- * no abort reaches) time to end, so the hand-off does not leave a check running in a lander
+ * steps. So a check's bound plus a minute lets a merge already past its model runs — in its
+ * last check and fast-forward — merge, and gives an aborted merge's current step (a check, which
+ * no abort reaches) time to end, so the hand-off does not leave a check running in a merger
  * worktree the next generation is about to reset. Not the drain's window: that is the p75 of whole
- * role ticks (over an hour on this fleet) — the very lag this bounds. */
-export const HANDOFF_LANDING_WINDOW_MS = BUILD_CHECK_TIMEOUT_MS + 60_000;
+ * role ticks (over an hour on this team) — the very lag this bounds. */
+export const HANDOFF_MERGE_WINDOW_MS = BUILD_CHECK_TIMEOUT_MS + 60_000;
 /** Run one role tick under the concurrency semaphore and return how long the tick itself ran,
  * in ms — null when it never started (the harness is already stopping, or `held`) or was cut
  * off by an abort. This is the restart drain's p75 sample (BUGS.md 2026-09-18). The clock starts
  * only once the permit is granted, so time a tick spends parked in the semaphore queue is not
  * counted as work: the drain waits on ticks that are already running, and folding queue wait
- * into the window would overstate how long they have left (the `tick_start`..`tick_end` span
+ * into the window would overstate how long they have left (the `run_start`..`run_end` span
  * the window was sized against excludes it too). Aborted ticks return null so their short
  * cut-off lengths cannot drag the window down. So do ticks that ended with nothing to show
  * (`no_change`, `skipped`): a `main moved` re-check runs the model and still finishes in
- * seconds, and sampling it equally let a fleet's window collapse to the re-check scale and
+ * seconds, and sampling it equally let a team's window collapse to the re-check scale and
  * cut real work off minutes into its run (BUGS.md 2026-09-30) — only a work-bearing outcome
  * says how long the work the drain waits on takes. `now` is a test seam.
  *
- * `held` is the fleet-wide hold on new ticks (today the restart drain's), re-checked at the one
+ * `held` is the team-wide hold on new ticks (today the restart drain's), re-checked at the one
  * moment a reserved tick actually begins: when its permit is granted. A tick scheduled before
  * the hold may have parked in the semaphore queue long before it; checking the hold only at
  * scheduling let every such waiter start a fresh pi run mid-drain as slots freed — the very
  * ticks the restart then aborted (BUGS.md 2026-09-23). A held tick releases its permit without
- * calling `tick`, so it writes no state and logs no tick_start/tick_end; the caller hands its
+ * calling `tick`, so it writes no state and logs no run_start/run_end; the caller hands its
  * reservation back. */
 export async function runTimedRoleTick(signal, acquire, release, tick, now = Date.now, held = () => false) {
     await acquire();
@@ -118,78 +119,78 @@ function settlesWithin(promise, ms, after) {
         promise.then(() => done(true), () => done(true));
     });
 }
-/** The restart hand-off's bounded wait on the in-flight landing (BUGS.md 2026-09-23): the shutdown
- * `finally`'s landing await when this process is about to exit for the next generation. The
- * landings run a reviewer and a build check per change and a merge's check after them, so an
- * unbounded await here is a fleet-wide drain in disguise — the 2026-09-23 hand-off lagged its own
+/** The restart hand-off's bounded wait on the in-flight merge (BUGS.md 2026-09-23): the shutdown
+ * `finally`'s merge await when this process is about to exit for the next generation. The
+ * merges run a reviewer and a build check per change and a merge's check after them, so an
+ * unbounded await here is a team-wide drain in disguise — the 2026-09-23 hand-off lagged its own
  * swap by 97 minutes, in silence. The wait is announced as it starts (one warning naming the
- * landing's roles), so the feed says why `restarting onto build …` is not yet followed by
- * `orchestrator stopped`. Past `windowMs` the landing is stopped the way the drain gives up on role
+ * merge's roles), so the feed says why `restarting onto build …` is not yet followed by
+ * `orchestrator stopped`. Past `windowMs` the merge is stopped the way the drain gives up on role
  * ticks: `abort` fires the harness's internal stop, which kills its pi runs at once and makes it
- * stop at its next step boundary (landing-core.ts, landing-batch.ts, and landing-stack.ts check the
- * signal before every gate, every approved landing, and each of a stack's check attempts), and a
- * warning names what was still awaited. An aborted landing records `aborted` like any shutdown
+ * stop at its next step boundary (merge-core.ts, merge-batch.ts, and merge-stack.ts check the
+ * signal before every gate, every approved merge, and each of a stack's check attempts), and a
+ * warning names what was still awaited. An aborted merge records `aborted` like any shutdown
  * abort — pins kept, entries dropped, marker removed — for its roles' leftover recovery on the
  * new build. One still running a window after the abort (a step wedged past its own bound) is left
  * behind: its 4/5 marker is cleared here, since this process exits the moment the hand-off returns,
  * and its entries and pins survive exactly as a crash leaves them — the next generation's first
- * drain re-lands them. Exported as a unit-test seam, like runTimedRoleTick. */
-export async function awaitLandingForHandoff(root, landing, windowMs, abort, after = realAfterDelay) {
-    const roles = landing.roles.join(", ");
+ * drain re-merges them. Exported as a unit-test seam, like runTimedRoleTick. */
+export async function awaitMergeForHandoff(root, merge, windowMs, abort, after = realAfterDelay) {
+    const roles = merge.roles.join(", ");
     const deadline = `${windowMs / 1000}s`;
-    warnEvent(root, "harness", `restart hand-off waiting on the in-flight landing of ${roles} (deadline ${deadline})`);
-    if (await settlesWithin(landing.promise, windowMs, after))
+    warnEvent(root, TUMWATER_SOURCE, `restart waiting on the merge in progress for ${roles} (deadline ${deadline})`);
+    if (await settlesWithin(merge.promise, windowMs, after))
         return "finished";
     abort();
-    warnEvent(root, "harness", `restart hand-off: the landing of ${roles} outlived its ${deadline} deadline — aborted; its pinned commits survive for the next generation`);
-    if (await settlesWithin(landing.promise, windowMs, after))
+    warnEvent(root, TUMWATER_SOURCE, `restart: the merge for ${roles} outlived its ${deadline} deadline — aborted; its pinned commits survive for the next restart`);
+    if (await settlesWithin(merge.promise, windowMs, after))
         return "aborted";
-    removeQuiet(landingStatePath(root));
-    warnEvent(root, "harness", `restart hand-off: the aborted landing of ${roles} was still running ${deadline} later — handing off without it; its queue entries and pinned commits survive for the next generation`);
+    removeQuiet(mergeStatePath(root));
+    warnEvent(root, TUMWATER_SOURCE, `restart: the aborted merge for ${roles} was still running ${deadline} later — restarting without it; its queue entries and pinned commits survive for the next restart`);
     return "abandoned";
 }
 /**
  * Drain the orchestrator's in-flight work at shutdown: wait out the reserved role and director
- * ticks, and await the landing pipeline's tasks beside them — and how depends on what comes
- * next. On an operator stop the harness signal has already aborted the landing — its pi runs die
+ * ticks, and await the merge pipeline's tasks beside them — and how depends on what comes
+ * next. On an operator stop the harness signal has already aborted the merge — its pi runs die
  * and it stops at its next step boundary, ending "aborted" with its ref kept and its entry
  * dropped for next-start recovery — and it is waited out: returning early would remove
- * orchestrator.json while the process still lands, letting a second `tumwater run` start a
- * concurrent lander (a second Ctrl+C still forces the exit). On a restart the caller exits for
- * the next generation the moment this returns, and a landing is not bounded by one reviewer run
- * — a merge's check follows the vets' — so the wait is a bounded hand-off that announces itself
- * (awaitLandingForHandoff; BUGS.md 2026-09-23). "The landing" is every landing task at once —
- * each vet holding a permit, and the merge — waited on (and, past the hand-off's window,
- * aborted) together under the roles of them all. The vetted changes waiting for the merge have
- * no task, and a vet still parked for its permit has started nothing (a shutdown settles it at
- * once; a restart's closed start gate at its grant): all of them keep their entries and pins
- * for the next start.
+ * orchestrator.json while the process is still merging, letting a second `tumwater run` start a
+ * concurrent merger (a second Ctrl+C still forces the exit). On a restart the caller exits for
+ * the next generation the moment this returns, and a merge is not bounded by one reviewer run
+ * — a merge's check follows the verifications' — so the wait is a bounded hand-off that
+ * announces itself (awaitMergeForHandoff; BUGS.md 2026-09-23). "The merge" is every merge task
+ * at once — each verification holding a permit, and the merge — waited on (and, past the hand-off's
+ * window, aborted) together under the roles of them all. The approved changes waiting for the
+ * merge have no task, and a verification still parked for its permit has started nothing (a
+ * shutdown settles it at once; a restart's closed start gate at its grant): all of them keep their
+ * entries and pins for the next start.
  */
 export async function drainInFlightWork(root, roleInFlight, directorInFlight, inFlight, restart, handoffWindowMs, abort, after = realAfterDelay) {
     const ticks = Promise.allSettled([...roleInFlight, ...directorInFlight]);
-    const landing = inFlight.length === 0
+    const merge = inFlight.length === 0
         ? null
         : {
             promise: Promise.allSettled(inFlight.map((t) => t.promise)).then(() => { }),
             roles: inFlight.flatMap((t) => t.roles),
         };
-    if (landing && restart) {
-        // The abort is the caller's internal stop, not just the landing's own controller: each task
+    if (merge && restart) {
+        // The abort is the caller's internal stop, not just the merge's own controller: each task
         // wires the harness signal to its controller, and a conflict-resolution run watches the
-        // harness signal alone (runLandingPi). Nothing else it reaches can start work here — the
+        // harness signal alone (runMergePi). Nothing else it reaches can start work here — the
         // director has finished, permit holders were aborted at the restart, and a parked waiter
         // meets the closed start gate (tickStartHeld) whenever it is granted a permit.
-        const outcome = await awaitLandingForHandoff(root, landing, handoffWindowMs, abort, after);
-        // An abandoned landing still holds its permit, so a waiter parked behind it would never be
+        const outcome = await awaitMergeForHandoff(root, merge, handoffWindowMs, abort, after);
+        // An abandoned merge still holds its permit, so a waiter parked behind it would never be
         // granted one and never settle. The ticks have had both windows beside the hand-off, so
-        // whatever is still reserved then started nothing (or is wedged like the landing): the
+        // whatever is still reserved then started nothing (or is wedged like the merge): the
         // hand-off goes ahead without it too.
         if (outcome !== "abandoned")
             await ticks;
     }
     else {
-        if (landing)
-            warnEvent(root, "harness", `shutdown waiting on the in-flight landing of ${landing.roles.join(", ")}`);
-        await Promise.allSettled([ticks, landing?.promise]);
+        if (merge)
+            warnEvent(root, TUMWATER_SOURCE, `shutdown waiting on the merge in progress for ${merge.roles.join(", ")}`);
+        await Promise.allSettled([ticks, merge?.promise]);
     }
 }

package/dist/src/tick/tick-usage.js

@@ -3,12 +3,12 @@ import { recordDailyCost } from "../budget/budget.js";
 import { nonNegativeNumber } from "../files/json-object.js";
 /** Usage accounting for one role loop, split out of loop.ts — which keeps the tick lifecycle —
  * because token/cost/turn bookkeeping is a self-contained concern with its own consumers: the
- * commit trailer reads turns, the tick_end event reads costUsd, and the orchestrator's fleet-wide
- * hold reads lastRateLimit and lastBackendFailure (src/fleet/fleet-hold.ts,
- * src/fleet/fleet-polls.ts).
+ * commit trailer reads turns, the run_end event reads costUsd, and the orchestrator's team-wide
+ * hold reads lastRateLimit and lastBackendFailure (src/team/team-hold.ts,
+ * src/team/team-polls.ts).
  *
  * fold() is the once-per-run choke point: every pi run of a tick — main attempt, transient
- * retry, conflict resolution, landing runs via foldLandingUsage — lands here exactly once, so
+ * retry, conflict resolution, merge runs via foldMergeUsage — ends up here exactly once, so
  * adding a usage field to PiRunResult touches this single place. */
 /** One persisted counter, healed to a finite non-negative number before it is read and
  * rewritten: `generatedTokens`/`peakContextTokens` are per-tick windows and `totalCostUsd` a
@@ -32,12 +32,12 @@ export class TickUsage {
     turns = 0;
     /** USD cost folded into THIS tick so far (non-persisted): reset at tick start alongside
      * turns, grown in fold. Deliberately not on LoopState — unlike generatedTokens, no
-     * dashboard reads it mid-run; its only consumer is the tick_end event, which fires before
+     * dashboard reads it mid-run; its only consumer is the run_end event, which fires before
      * the next tick resets it (plans: per-tick usage in the event feed). */
     costUsd = 0;
     /** Subscription runs' cost folded into THIS tick (non-persisted): API-equivalent spend the
      * run reported but that never charges the daily cap (plans/agent-backends.md part 6a). The
-     * tick_end event carries it and the report shows it on its own notional line. Reset at tick
+     * run_end event carries it and the report shows it on its own notional line. Reset at tick
      * start like costUsd. */
     notionalCostUsd = 0;
     /** How the tick's runs were last reported as paid for, and the newest subscription
@@ -48,31 +48,38 @@ export class TickUsage {
     rateWindows;
     /** Prompt tokens folded into THIS tick so far (non-persisted, reset at tick start). Every
      * pi run of the tick contributes — the authoring run, its transient retry, the SUMMARY
-     * follow-up, and (through foldLandingUsage) review and conflict-resolution runs — because
+     * follow-up, and (through foldMergeUsage) review and conflict-resolution runs — because
      * all of them re-send context the operator paid for. */
     promptTokens = 0;
     /** The cache-read share of promptTokens folded so far. */
     cacheReadTokens = 0;
     /** Prompt tokens folded before the tick's first edit: authoring runs only, frozen once an
-     * authoring run reports an edit (plans/per-tick-prompt-telemetry). Landing, review and
+     * authoring run reports an edit (plans/per-tick-prompt-telemetry). Merge, review and
      * conflict-resolution runs are excluded — their context is the gate's, not the authoring
      * tick's pre-edit search. */
     preEditPromptTokens = 0;
     /** True once an authoring run has reported a first edit; the pre-edit counter freezes. */
     editSeen = false;
     /** This loop's most recent pi run that ended on a provider 429 — author run, retry,
-     * reviewer or landing run alike, since every one folds through fold — with the provider's
+     * reviewer or merge run alike, since every one folds through fold — with the provider's
      * Retry-After hint when it sent one. The orchestrator reads it every poll as this role's
-     * rate-limit input to the fleet-wide hold (src/fleet/fleet-hold.ts): the per-run retry has no
+     * rate-limit input to the team-wide hold (src/team/team-hold.ts): the per-run retry has no
      * cross-role view, and a field on the runner the orchestrator already holds carries the
      * fact without a new cross-module channel. In memory only — a hold is minutes long, so a
      * restart forgetting it costs nothing. Undefined until the first such run. */
     lastRateLimit;
+    /** Per-provider spend folded into THIS tick (non-persisted, reset at tick start): each
+     * run's real/notional cost keyed by the provider it ran on, so the run_end event can say
+     * which seam of a mixed team spent what (plans: per-provider spend in the day report). A
+     * run whose provider was never resolved attributes nothing — the `provider !== undefined`
+     * guard below skips the bump — so an old single-provider tick keeps today's byte-identical
+     * behavior. Parallel to costUsd/notionalCostUsd, never subtracted from them. */
+    providerCost = new Map();
     /** This loop's most recent pi run that ended on a provider-wide failure that was NOT rate
      * limiting — the connection down, a 5xx, the model failing to load (PiRunResult.
      * transientBackend) — with the kind the hold's storm test groups storms by. Stamped under
-     * the same rule and for the same consumer as lastRateLimit above: the fleet-wide hold
-     * (src/fleet/fleet-hold.ts) reads it every poll. In memory only, like lastRateLimit.
+     * the same rule and for the same consumer as lastRateLimit above: the team-wide hold
+     * (src/team/team-hold.ts) reads it every poll. In memory only, like lastRateLimit.
      * Undefined until the first such run. */
     lastBackendFailure;
     /** Clear the per-tick windows (turns, costUsd, the prompt-token counters) at tick start.
@@ -88,12 +95,13 @@ export class TickUsage {
         this.cacheReadTokens = 0;
         this.preEditPromptTokens = 0;
         this.editSeen = false;
+        this.providerCost = new Map();
     }
     /** Fold one pi run's usage into the tick's counters (gen / peak ctx / cost / turns) and
-     * the loop's lifetime totals on `s`. `authoring` is false for a landing/review run folded
-     * through foldLandingUsage: those never advance the tick's pre-edit counter, which measures
+     * the loop's lifetime totals on `s`. `authoring` is false for a merge/review run folded
+     * through foldMergeUsage: those never advance the tick's pre-edit counter, which measures
      * the authoring search. */
-    fold(s, run, authoring = true) {
+    fold(s, run, authoring = true, provider, pair) {
         s.generatedTokens = counter(s.generatedTokens) + run.outputTokens;
         s.peakContextTokens = Math.max(counter(s.peakContextTokens), run.peakContextTokens);
         s.totalCostUsd = counter(s.totalCostUsd) + run.costUsd;
@@ -103,12 +111,14 @@ export class TickUsage {
         if (runCostIsReal(run)) {
             this.costUsd += run.costUsd;
             // The daily cost budget window (plans/daily-cost-budget.md): every real-money pi run of
-            // a tick folds here exactly once, so the fleet's spend for the local day is complete at
+            // a tick folds here exactly once, so the team's spend for the local day is complete at
             // each tick end.
-            recordDailyCost(s, run.costUsd);
+            recordDailyCost(s, run.costUsd, Date.now(), pair);
+            this.bumpProviderCost(provider, run.costUsd, 'costUsd');
         }
         else {
             this.notionalCostUsd += run.costUsd;
+            this.bumpProviderCost(provider, run.costUsd, 'notionalCostUsd');
         }
         if (run.billing !== undefined)
             this.billing = run.billing;
@@ -118,7 +128,7 @@ export class TickUsage {
         this.cacheReadTokens += run.cacheReadTokens;
         // The pre-edit prefix freezes at the tick's first edit: every authoring run while no edit
         // has been seen adds its pre-edit count (including the run that edits), and once one
-        // reports an edit later runs add nothing. A review/landing run is skipped entirely.
+        // reports an edit later runs add nothing. A review/merge run is skipped entirely.
         if (authoring) {
             if (!this.editSeen)
                 this.preEditPromptTokens += run.preEditPromptTokens;
@@ -126,17 +136,37 @@ export class TickUsage {
                 this.editSeen = true;
         }
         this.turns += run.turns;
-        // The fleet-wide hold's rate-limit input (lastRateLimit above), from the same
+        // The team-wide hold's rate-limit input (lastRateLimit above), from the same
         // once-per-run choke point. Only a run that ENDED on the 429 counts: pi exits on the error,
         // so "now" is when the provider refused — a run that merely logged one inside pi's own
         // auto-retry and then
         // finished would stamp a 429 at its end, possibly hours late, and could trip a false storm.
         if (run.transientRateLimit && !run.ok)
-            this.lastRateLimit = { at: Date.now(), retryAfterSeconds: run.retryAfterSeconds };
+            this.lastRateLimit = { at: Date.now(), retryAfterSeconds: run.retryAfterSeconds, provider };
         // The backend-failure sibling of the stamp above, same rule: only a run that ENDED on the
-        // failure counts, and the kind travels with it (src/pi/pi-stream.ts backendKind classified
-        // the text at parse time). A 429 never lands here — pi-stream checks rate-limit first.
+        // failure counts, and the kind travels with it (src/pi/pi-failure.ts backendKind classified
+        // the text at parse time). A 429 never ends up here — pi-stream checks rate-limit first.
         if (run.transientBackend && !run.ok && run.backendKind)
-            this.lastBackendFailure = { at: Date.now(), kind: run.backendKind };
+            this.lastBackendFailure = { at: Date.now(), kind: run.backendKind, provider };
+    }
+    /** Add `amount` to one field of the tick's per-provider spend ledger, initializing the
+     * provider's entry on first contact. `provider` undefined (a run that never resolved one)
+     * is a no-op, matching how fold calls it: only runs with a provider reach this. */
+    bumpProviderCost(provider, amount, field) {
+        if (provider === undefined)
+            return;
+        const e = this.providerCost.get(provider) ?? { costUsd: 0, notionalCostUsd: 0 };
+        e[field] += amount;
+        this.providerCost.set(provider, e);
+    }
+    /** Serialize the per-provider split for the run_end payload: a `Record<provider,
+     * {costUsd, notionalCostUsd}>`, or `{}` when no run carried a provider — the
+     * omit-when-empty idiom tick-finalize.ts applies, so a tick whose runs never resolved a
+     * provider renders no providerCost field at all. */
+    serializeProviderCost() {
+        const out = {};
+        for (const [provider, e] of this.providerCost)
+            out[provider] = e;
+        return out;
     }
 }