tumwater 0.1.2 → 0.2.0

package/dist/src/tick/tick-verdict.js

@@ -1,7 +1,8 @@
+import { imageReroute } from "../agent/image-input.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { isDirty, deleteRef } from "../git/git.js";
 import { applyConfigRequest } from "../config/config-write.js";
-import { diagnoseNoChange } from "../verdict/no-change.js";
+import { diagnoseNoChange, extractNoChangeAnswer } from "../verdict/no-change.js";
 import { handleRefusal, refusalContradiction } from "../verdict/refusal.js";
 import { extractSummary } from "../git/commit-message.js";
 import { recordFlow } from "./qa-coverage.js";
@@ -41,7 +42,7 @@ export async function resolveTickVerdict(ctx) {
             if (request.error)
                 ctx.warn(`config request rejected: ${request.error}`);
             if (request.ignored.length)
-                ctx.warn(`config request ignored key(s): ${request.ignored.join(", ")} — only customLoops is accepted`);
+                ctx.warn(`config request ignored key(s): ${request.ignored.join(", ")} — only customRoles is accepted`);
         }
     }
     if (pi.quietKilled) {
@@ -68,13 +69,13 @@ export async function resolveTickVerdict(ctx) {
     }
     if (pi.timedOut) {
         s.lastError = pi.errorMessage ?? "timed out";
-        // The request never ran to completion and no work landed: put it back so the next
+        // The request never ran to completion and no work merged: put it back so the next
         // tick retries it. (A killed run's half-done edits are discarded by the reset.)
         ctx.pending.requeueUnfulfilled(ctx.userPrompt);
         return { result: "error" };
     }
     // A subscription claude run the usage window rejected is a hold, not a run failure: the
-    // fleet hold keeps every subscription claude seam from starting until `resetsAt`
+    // team hold keeps every subscription claude seam from starting until `resetsAt`
     // (plans/agent-backends.md §8, part 6c), and this run's session and worktree edits must
     // survive the wait — the next eligible tick resumes them (part 6e) instead of committing
     // partial work or resetting the worktree to main. The rejected-window reading is the
@@ -105,6 +106,62 @@ export async function resolveTickVerdict(ctx) {
         ctx.pending.requeueForResume(s, ctx.userPrompt);
         return { result: "aborted", resumeCause: "budget-capped" };
     }
+    // A run the runner killed the moment its agent read an image its model cannot see
+    // (plans/image-input.md "Failing the tick"): pi strips such an image from the request, so
+    // the agent was about to answer about a picture it never saw. The run was deliberately
+    // stopped before it could work on, so its half-done edits are discarded exactly as a
+    // timed-out run's are — nothing to resume, and the prompt re-queues to run fresh on a
+    // model that CAN see (part 4 adds the reroute arm here). The error backoff and streak apply
+    // as for any error.
+    if (pi.imageBlind) {
+        // One hop only (plans/image-input.md "Rerunning on a model that can read images"): a
+        // tick that ALREADY started on the image-capable target and still read blind is not
+        // rerouted a second time — it fails, so a misreadable image cannot bounce the loop
+        // between tiers forever. Set at tick start by tickPhase when it routes a tick onto the
+        // target (blind-read handoff or attachment preflight).
+        if (s.imageRerouteActive) {
+            s.lastError = pi.errorMessage ?? `read ${pi.imageBlind.path}, but the model cannot read images`;
+            // No work was done (the run was killed at the first read): nothing to resume, and the
+            // prompt re-queues to run fresh later like any other error. The error backoff/streak
+            // apply as usual.
+            ctx.pending.requeueUnfulfilled(ctx.userPrompt);
+            return { result: "error" };
+        }
+        // Otherwise, when the role's tier has an image-capable reroute target, the failed work
+        // is not discarded: the next tick starts directly on that target over the kept worktree.
+        // The one-shot field carries the target seam plus the `from`/`path` facts the handoff
+        // note needs; the tick ends `aborted` with the `image-reroute` resume cause, and
+        // applyTickOutcome schedules it promptly (nextRunAt = now) while planTickStart hands the
+        // kept worktree off to a FRESH session on the target.
+        const regime = ctx.rerouteRegime ?? "primary";
+        const target = ctx.config !== undefined ? imageReroute(ctx.config, ctx.role, regime) : null;
+        if (target) {
+            const from = ctx.runModel ?? target.config.model ?? "the model";
+            s.imageReroute = {
+                tier: target.tier,
+                provider: target.config.provider,
+                model: target.config.model,
+                thinking: target.config.thinking,
+                from,
+                path: pi.imageBlind.path,
+            };
+            s.lastError = `read ${pi.imageBlind.path}, but ${from} cannot read images — rerouting to ${target.tier}`;
+            ctx.pending.requeueForResume(s, ctx.userPrompt);
+            logEventBestEffort(ctx.root, {
+                source: ctx.role,
+                type: "image_reroute",
+                run: s.runs,
+                from,
+                to: target.config.model,
+                tier: target.tier,
+                preflight: false,
+            });
+            return { result: "aborted", resumeCause: "image-reroute" };
+        }
+        s.lastError = pi.errorMessage ?? `read ${pi.imageBlind.path}, but the model cannot read images`;
+        ctx.pending.requeueUnfulfilled(ctx.userPrompt);
+        return { result: "error" };
+    }
     // A refusal is a decision, not a failure: even when pi's exit was abnormal, the sentinel
     // and any note it left are the run's verdict — classify what it left behind
     // (src/verdict/refusal.ts).
@@ -120,6 +177,7 @@ export async function resolveTickVerdict(ctx) {
         else {
             return handleRefusal({
                 role: ctx.role,
+                root: ctx.root,
                 mainBranch: ctx.mainBranch,
                 turns: ctx.turns,
                 merge: (w, sum) => ctx.merge(w, sum),
@@ -136,7 +194,7 @@ export async function resolveTickVerdict(ctx) {
     // would ship unfinished work under a diff-derived subject and drop the resumable session
     // (BUGS.md 2026-10-06). Keep the worktree and session for the next resume.
     if (!pi.ok && (!changed || !pi.producedAssistantContent)) {
-        s.lastError = pi.errorMessage ?? "pi failed";
+        s.lastError = pi.errorMessage ?? "the agent failed";
         // A dirty worktree on a run that added nothing of its own is a prior tick's work: arm the
         // resume so the next tick continues that session instead of resetting the edits. A role
         // loop re-queues through requeueForResume, so the resume reclaims exactly this prompt
@@ -148,7 +206,7 @@ export async function resolveTickVerdict(ctx) {
             ctx.pending.requeueForResume(s, ctx.userPrompt);
         }
         else {
-            // No work landed, so the request was not fulfilled: re-queue it. A no_change outcome
+            // No work merged, so the request was not fulfilled: re-queue it. A no_change outcome
             // IS fulfillment (a question-type prompt answered without file changes) — never
             // re-queue that, or such prompts would loop forever.
             ctx.pending.requeueUnfulfilled(ctx.userPrompt);
@@ -170,9 +228,9 @@ export async function resolveTickVerdict(ctx) {
         await resetWorktreeToMain(ctx.wt, ctx.mainBranch);
         await deleteRef(ctx.root, rejectedRefName(ctx.role));
         // The drop's durable effects — the worktree reset, the rejected ref's deletion, and the
-        // cleared state — have all landed; the event is observability, so an unwritable feed must
+        // cleared state — have all taken effect; the event is observability, so an unwritable feed must
         // not end the tick as an error and mask a change that really was dropped.
-        logEventBestEffort(ctx.root, { loop: ctx.role, type: "revision", action: "dropped", round: ctx.revisionRound, sha });
+        logEventBestEffort(ctx.root, { source: ctx.role, type: "revision", action: "dropped", round: ctx.revisionRound, sha });
         return { result: "no_change" };
     }
     if (!changed) {
@@ -181,7 +239,7 @@ export async function resolveTickVerdict(ctx) {
         // diagnosable on its own.
         const diagnosis = diagnoseNoChange(pi);
         if (!pi.nothingToDo) {
-            ctx.warn(`pi finished without changes and without declaring nothing-to-do` +
+            ctx.warn(`the agent finished without changes and without declaring nothing-to-do` +
                 (diagnosis.notes.length ? ` (${diagnosis.notes.join(", ")})` : ""));
         }
         // A cut-off run did real work and was NOT fulfilled: a director prompt goes back
@@ -194,7 +252,15 @@ export async function resolveTickVerdict(ctx) {
         // rotation past a check that did not complete. Only a run that was not cut off records.
         if (ctx.flow && !diagnosis.cutOff)
             recordFlow(ctx.root, ctx.flow.flow, ctx.flow.result, ctx.flow.result === "bug" ? extractSummary(pi.finalText) ?? undefined : undefined);
-        return { result: "no_change", cutOff: diagnosis.cutOff || undefined };
+        // A prompt-driven (director) tick that answers a question in prose ends `no_change` with
+        // no SUMMARY block, so its reply would be lost — the dashboard reads a bare "No change"
+        // and the feed carries nothing (BUGS.md 2026-10-14). Keep the prose above the sentinel as
+        // the tick's summary so `lastSummary` and the run_end event show the answer where the
+        // operator asked the question. A role loop's bare nothing-to-do stays summary-less.
+        const summary = ctx.userPrompt !== null && !diagnosis.cutOff
+            ? (extractNoChangeAnswer(pi.finalText) ?? undefined)
+            : undefined;
+        return { result: "no_change", cutOff: diagnosis.cutOff || undefined, summary };
     }
     return null;
 }

package/dist/src/ui/badges.js

@@ -1,19 +1,21 @@
-import { claudeWindowLabel } from "../agent/claude/claude-account.js";
+import { claudeUtilizationPct, claudeWindowLabel } from "../agent/claude/claude-account.js";
+import { MODEL_TIERS } from "../config/config-schema.js";
 import { budgetGate, budgetReached, fallbackTierEntries } from "../budget/budget.js";
+import { fallbackDisplayPair } from "../config/config-views.js";
 import { quietWindowEnd } from "../scheduling/quiet-hours.js";
-import { humanSeconds, pad2, secondsSince, secondsUntil } from "../text/datetime.js";
-import { pauseReasonSuffix } from "../text/phrases.js";
+import { clockHm, humanUntil } from "../text/datetime.js";
+import { pauseReasonSuffix, plural } from "../text/phrases.js";
 import { formatGB, shortSha, usd, usdCap } from "../text/format.js";
 /** The status header's BADGE fragments, phrased once for both observer surfaces: the terminal
  * table (status-render.ts's renderStatus header) and the JSON/GUI payload
  * (status-payload.ts's preformatted badge fields). Split from status-model.ts, which keeps the
- * per-loop display model (phase, rows, token metrics) — the badges are header-scale fleet
- * facts (build, main check, budget, land queue, timed pause) rather than per-loop state, and
+ * per-loop display model (phase, rows, token metrics) — the badges are header-scale team
+ * facts (build, main check, budget, merge queue, timed pause) rather than per-loop state, and
  * their one-home rule ("the page cannot re-derive and drift from these strings") is easier to
  * see when the module is exactly the badges. The duration phrasing they share (humanSeconds)
  * lives in datetime.ts — core modules need it too, so it sits below the ui layer. */
 /** The header's build fragment: which commit the running harness was compiled from and, when
- * main's build inputs have moved past it, how far — the fleet is then executing code main no
+ * main's build inputs have moved past it, how far — the team is then executing code main no
  * longer describes (auto-restart lands the new build; off, restart `tumwater run` by hand).
  * A stale build also says what auto-restart is doing about it: `restart pending` resolves
  * itself, `restart BLOCKED` never will until main moves, and telling them apart at a glance is
@@ -22,11 +24,11 @@ import { formatGB, shortSha, usd, usdCap } from "../text/format.js";
 export function buildBadge(build) {
     if (!build)
         return "";
-    const stale = build.stale ? ` — STALE: main +${build.aheadCommits ?? 0} commit(s) since` : "";
+    const stale = build.stale ? ` — update available (${plural(build.aheadCommits ?? 0, "commit")} behind)` : "";
     const restart = build.restartBlocked
-        ? `; restart BLOCKED: ${build.restartBlocked}`
+        ? `; restart blocked: ${build.restartBlocked}`
         : build.restartPending
-            ? "; restart pending"
+            ? " — restarts when idle"
             : "";
     return `, build ${shortSha(build.sha)}${stale}${restart}`;
 }
@@ -52,7 +54,7 @@ export function mainCountsFragment(counts) {
  * its raw status word with `fallbackTone` for color — callers pick the tone their palette
  * uses (the TUI's status header renders yellow, the GUI sidebar amber). The verdict word
  * never reads green for an unverified tree. Readers: mainCheckBadge (below) and the header
- * badge tone in status-render.ts. The GUI sidebar's status row (gui-client-fleet.ts) ships
+ * badge tone in status-render.ts. The GUI sidebar's status row (gui-client-team.ts) ships
  * its own copy of the mapping — it is browser-side JS spliced into gui-client.ts and cannot
  * import this module; its three-line ternary block is deliberately left as is. */
 export function mainCheckVerdict(status, fallbackTone = status) {
@@ -67,7 +69,7 @@ export function mainCheckVerdict(status, fallbackTone = status) {
 /** Main's newest merge-scope check as a header badge (PLANS.md "Retire the README freshness
  * stamp"): `· main <sha>: green · N/N (N skipped)` — the live replacement for the committed
  * README stamp the readme role used to maintain. Empty when the snapshot carries no check
- * (none has run yet), so a quiet header stays byte-identical to a pre-check fleet. The
+ * (none has run yet), so a quiet header stays byte-identical to a pre-check team. The
  * verdict maps passed→green, failed→red; anything else (a skipped scope check) renders its
  * raw word — an unverified tree must not read green. The counts fragment (mainCountsFragment)
  * omits parentheticals for zero counts, matching the stamp wording the README carried. */
@@ -80,11 +82,11 @@ export function mainCheckBadge(mainCheck) {
     const sha = mainCheck.sha ? `${shortSha(mainCheck.sha)}: ` : "";
     return ` · main ${sha}${verdict}${counts}`;
 }
-/** The fleet's current budget-gate state, derived from a snapshot's budget block — the header
- * badge's default-tier story (part 5c/8): the badge names the fleet's bulk fallback, so it
+/** The team's current budget-gate state, derived from a snapshot's budget block — the header
+ * badge's default-tier story (part 5c/8): the badge names the team's bulk fallback, so it
  * reads the `default` tier's verdict alone (the per-tier pause lives on the loop rows, via
  * status-data.ts's budgetPausedRoles). */
-function fleetBudgetGate(budget) {
+function teamBudgetGate(budget) {
     return budgetGate(budgetReached(budget), { default: budget.fallback !== null, strong: budget.fallback !== null }, false);
 }
 /** The new-project bootstrap's progress fragment (plans/work-ratio.md, part 2/2):
@@ -103,32 +105,63 @@ function claudeWindowStatusWord(status) {
         return "limited";
     return status === "reset" ? "reset" : "ok";
 }
-/** The local wall-clock `HH:MM` of a window instant, the same hours/minutes-only shape the
- * burn-rate forecast uses. */
-function clockHm(ms) {
-    const d = new Date(ms);
-    return `${pad2(d.getHours())}:${pad2(d.getMinutes())}`;
+/** How far off a window's reset is, two units wide: `4h 12m`, `5d 3h`, `37m`. A clock time
+ * alone cannot tell a 7d window resetting Monday from one resetting tonight. */
+function untilReset(resetsAt, now) {
+    const minutes = Math.floor((resetsAt - now) / 60_000);
+    if (minutes < 60)
+        return `${minutes}m`;
+    const hours = Math.floor(minutes / 60);
+    if (hours < 24)
+        return `${hours}h ${minutes % 60}m`;
+    return `${Math.floor(hours / 24)}d ${hours % 24}h`;
 }
 /** The subscription usage-window fragment (plans/agent-backends.md §8, PLANS.md part 6d/7):
- * `· Claude 5h · 64% · resets 14:30`, with the status word when no `utilization` was reported
- * and an `overage` marker while the account spends into overage. A rejected window reads
- * `claude seams held until 14:30` in place of `resets` while a future deadline holds the
+ * `· Claude 5h · 64% · resets in 4h 12m` (`resets now` once the deadline has passed), with
+ * the status word when no `utilization` was reported and an `overage` marker while the
+ * account spends into overage. A rejected window reads
+ * `claude model jobs wait until 14:30` in place of `resets` while a future deadline holds the
  * seams; a reset reading names neither. The one home of the string, so the TUI header and the
  * payload's preformatted badge cannot drift. */
-function claudeWindowBadge(claudeWindow) {
+function claudeWindowBadge(claudeWindow, now, moved = false) {
     const w = claudeWindow.primary;
     const parts = [`Claude ${claudeWindowLabel(w.type)}`];
-    parts.push(typeof w.utilization === "number" ? `${Math.round(w.utilization * 100)}%` : claudeWindowStatusWord(w.status));
+    parts.push(typeof w.utilization === "number" ? `${claudeUtilizationPct(w.utilization)}%` : claudeWindowStatusWord(w.status));
     if (w.isUsingOverage === true)
         parts.push("overage");
     if (w.status === "rejected" && claudeWindow.heldUntil !== null) {
-        parts.push(`claude seams held until ${clockHm(claudeWindow.heldUntil)}`);
+        parts.push(`${moved ? "on fallback" : "claude model jobs wait"} until ${clockHm(claudeWindow.heldUntil)}`);
     }
     else if (w.status !== "reset" && typeof w.resetsAt === "number") {
-        parts.push(`resets ${clockHm(w.resetsAt)}`);
+        parts.push(w.resetsAt - now < 60_000 ? "resets now" : `resets in ${untilReset(w.resetsAt, now)}`);
     }
     return ` · ${parts.join(" · ")}`;
 }
+/** Whether any tier of a chain block runs on a fallback because the Claude window (or its
+ * reserve) is used up. */
+function chainMovedByWindow(chain) {
+    return Object.values(chain ?? {}).some((t) => t.reason === "window" || t.reason === "reserve");
+}
+/** The tiers' fallback steps as badge text, ` · `-joined without a leading separator:
+ * `default → DeepSeek-V4-Flash $3.10/$5 until 17:40`, one fragment per tier in MODEL_TIERS
+ * order. Empty when the block is absent or empty. */
+export function chainFragments(chain) {
+    const out = [];
+    for (const tier of MODEL_TIERS) {
+        const t = chain?.[tier];
+        if (!t)
+            continue;
+        const money = t.spentUsd !== undefined && t.capUsd !== undefined ? ` ${usd(t.spentUsd)}/${usdCap(t.capUsd)}` : "";
+        const until = t.returnsAt !== undefined ? ` until ${clockHm(t.returnsAt)}` : "";
+        out.push(`${tier} → ${t.pair}${money}${until}`);
+    }
+    return out.join(" · ");
+}
+/** The chain block as a header fragment: ` · ` plus chainFragments, empty without a chain. */
+export function chainBadge(chain) {
+    const text = chainFragments(chain);
+    return text ? ` · ${text}` : "";
+}
 /** The window fragment's tone rank, for the header badge and the GUI meter: a rejected window
  * is red, an allowed_warning amber, anything else no tone. */
 export function claudeWindowTone(claudeWindow) {
@@ -141,8 +174,8 @@ export function claudeWindowTone(claudeWindow) {
     return undefined;
 }
 /** The header's daily-cost-budget fragment, standing in every cap state (the badge is also
- * the affordance for editing the cap, so a disabled fleet needs it too): `· budget: n/a`
- * for a fleet whose models are all free (spend can never accumulate against a cap that
+ * the affordance for editing the cap, so a disabled team needs it too): `· budget: n/a`
+ * for a team whose models are all free (spend can never accumulate against a cap that
  * cannot be reached — and no priced model means no daily spend to count, hence no "today"
  * — checked first, in every cap state), `· budget: $X.XX/$Y today` while enabled with
  * priced models, and `· budget: $X today · no cap` when disabled. One
@@ -160,16 +193,16 @@ export function claudeWindowTone(claudeWindow) {
  * needs no forecast slot: a disabled cap never carries a capHitAt (projectCapHit returns null
  * for capUsd <= 0), and the fallback fragment only stands once the cap IS reached — the one
  * state where the forecast is itself null — so the fragments can never compete for the line. */
-export function budgetBadge(budget, claudeWindow) {
-    const window = claudeWindow ? claudeWindowBadge(claudeWindow) : "";
+export function budgetBadge(budget, claudeWindow, now = Date.now(), chain) {
+    const window = (claudeWindow ? claudeWindowBadge(claudeWindow, now, chainMovedByWindow(chain)) : "") + chainBadge(chain);
     // Subscription-only: the window stands IN PLACE of the daily spend — there is no priced
     // spend for a dollar figure to report. Mixed and none fall through to the daily spend.
     if (claudeWindow?.only)
         return window;
     if (budget.free)
         return ` · budget: n/a${window}`;
-    // Only while the fallback is actually carrying the fleet (plans/fallback-model.md): the cap
-    // is spent, so the dollar figure alone would read like a stopped fleet. Naming the model
+    // Only while the fallback is actually carrying the team (plans/fallback-model.md): the cap
+    // is spent, so the dollar figure alone would read like a stopped team. Naming the model
     // answers the operator's next question — what is it running on now? Its cost is n/a by
     // construction (the gate engages nothing else), so no second figure is shown. When the
     // snapshot carries the per-tier map (tiers, part 7b/8 — non-null exactly when the tiers
@@ -179,12 +212,12 @@ export function budgetBadge(budget, claudeWindow) {
     // identical to before either way.
     const tierEntries = fallbackTierEntries(budget.tiers);
     // The backend-default label when the engaged pair names neither half: `<agent> default`
-    // (plans/agent-backends.md part 4f/7), `pi default` for a pi fleet as before.
-    const agentDefault = `${budget.agent && budget.agent !== "pi" ? budget.agent : "pi"} default`;
-    const fallback = fleetBudgetGate(budget) === "fallback"
+    // (plans/agent-backends.md part 4f/7), `pi default` for a pi team as before.
+    const agentDefault = `${budget.backend && budget.backend !== "pi" ? budget.backend : "pi"} default`;
+    const fallback = teamBudgetGate(budget) === "fallback"
         ? tierEntries.length >= 2
-            ? ` · fallback: ${tierEntries.join(", ")} (cost n/a)`
-            : ` · fallback: ${budget.fallback?.model ?? budget.fallback?.provider ?? agentDefault} (cost n/a)`
+            ? ` · over-cap model: ${tierEntries.join(", ")} (cost n/a)`
+            : ` · over-cap model: ${fallbackDisplayPair(budget.fallback, agentDefault)} (cost n/a)`
         : "";
     const forecast = budget.capHitAt !== null
         ? ` · ~cap at ${clockHm(budget.capHitAt)}`
@@ -193,13 +226,20 @@ export function budgetBadge(budget, claudeWindow) {
         return ` · budget: ${usd(budget.spentUsd)}/${usdCap(budget.capUsd)} today${forecast}${fallback}${window}`;
     return ` · budget: ${usd(budget.spentUsd)} today · no cap${window}`;
 }
-/** The header's land-queue fragment (plans/merge-queue.md 4/5): `· land queue: N` while any
- * landing is queued or in flight, empty when the queue is idle — so an idle fleet keeps
+/** The header's merge queue fragment (plans/merge-queue.md 4/5): `· merge queue: N` while any
+ * merge is queued or in flight, empty when the queue is idle — so an idle team keeps
  * every existing header byte intact. One home for the rule, like buildBadge and budgetBadge:
  * renderStatus renders it in the TUI/status header and status-payload.ts ships its output
  * preformatted, so the GUI page cannot drift from this string. */
-export function landingBadge(landQueue) {
-    return landQueue.depth > 0 ? ` · land queue: ${landQueue.depth}` : "";
+export function mergeBadge(mergeQueue) {
+    return mergeQueue.depth > 0 ? ` · merge queue: ${mergeQueue.depth}` : "";
+}
+/** The header's `run --for` window fragment: ` · stops in <duration>` while the deadline is
+ * ahead, ` · stopping` once it has passed (the drain), empty for an unwindowed team. */
+export function runWindowBadge(stopsAt, now) {
+    if (stopsAt === undefined)
+        return "";
+    return stopsAt > now ? ` · stops in ${humanUntil(stopsAt, now)}` : " · stopping";
 }
 /** The header's scheduled-wake fragment: `· wake scheduled in <duration> (<roles>)` while a
  * `wake --in` marker stands, empty otherwise. It exists because a scheduled wake is otherwise
@@ -207,7 +247,7 @@ export function landingBadge(landQueue) {
 export function wakeBadge(wake, now) {
     if (!wake || wake.atMs <= now)
         return "";
-    return ` · wake scheduled in ${humanSeconds(secondsUntil(wake.atMs, now))} (${wake.roles.join(", ")})`;
+    return ` · wake scheduled in ${humanUntil(wake.atMs, now)} (${wake.roles.join(", ")})`;
 }
 /** One loop's own pending-wake marker for its state cell: ` · wake in <duration>` for the
  * earliest future wake naming `role` (or `instanceOf`, the base role an extra instance runs),
@@ -221,13 +261,13 @@ export function loopWakeMarker(wakes, role, instanceOf, now) {
         if (at === undefined || w.atMs < at)
             at = w.atMs;
     }
-    return at === undefined ? "" : ` · wake in ${humanSeconds(secondsUntil(at, now))}`;
+    return at === undefined ? "" : ` · wake in ${humanUntil(at, now)}`;
 }
-/** The header's fleet timed-pause fragment: `· paused — auto-resumes in <duration>` while a
+/** The header's team timed-pause fragment: `· paused — auto-resumes in <duration>` while a
  * timed pause stands, empty otherwise — so an operator can tell at a glance whether a paused
- * fleet will come back on its own or needs a manual `resume` (the Timed pause plan left the
- * display out on purpose). The snapshot's `pausedUntil` is the FLEET marker's deadline (ms
- * epoch, plans/daily-cost-budget.md item 5), so the badge stands exactly when the fleet
+ * team will come back on its own or needs a manual `resume` (the Timed pause plan left the
+ * display out on purpose). The snapshot's `pausedUntil` is the TEAM marker's deadline (ms
+ * epoch, plans/daily-cost-budget.md item 5), so the badge stands exactly when the team
  * itself is timed-paused: a role-only timed pause leaves the header unchanged, and an absent
  * or already-expired deadline renders nothing — the read side treats an expired marker as
  * unpaused, so the badge never claims a countdown that is over. The duration goes through
@@ -249,10 +289,10 @@ export function pauseBadge(pausedUntil, now, reason) {
         return "";
     return left ? ` · paused — auto-resumes in ${left}${why}` : ` · paused${why}`;
 }
-/** The countdown a timed fleet pause has left, as humanSeconds — `null` when there is none
+/** The countdown a timed team pause has left, as humanSeconds — `null` when there is none
  * (no deadline, or an already-expired one: the read side treats an expired marker as
- * unpaused). The one home of the guard + ms→seconds rounding behind the fleet's pause
- * countdowns, shared by pauseBadge's header fragment and fleet-alerts.ts's paused alert
+ * unpaused). The one home of the guard + ms→seconds rounding behind the team's pause
+ * countdowns, shared by pauseBadge's header fragment and team-alerts.ts's paused alert
  * title, so the two surfaces cannot disagree about how much time remains. The guard is this
  * function's own; the ms→seconds rounding rides datetime.ts's secondsUntil. The GUI's pause
  * control recomputes the ticking number client-side from the payload's raw `pausedUntil`
@@ -260,19 +300,19 @@ export function pauseBadge(pausedUntil, now, reason) {
 export function pauseCountdown(pausedUntil, now) {
     if (pausedUntil === undefined || pausedUntil <= now)
         return null;
-    return humanSeconds(secondsUntil(pausedUntil, now));
+    return humanUntil(pausedUntil, now);
 }
 /** The header's quiet-hours fragment (plans: "Quiet hours … part 2/2, observability"): the
  * schedule as standing information in every configured state — `· quiet until 07:00` while
  * the local clock sits inside the window (the active reading answers "why are the loops
  * idle?" with when they start again) and `· quiet 23:00-07:00` otherwise — and empty when
- * the snapshot carries no window, so a fleet without the schedule keeps its header
+ * the snapshot carries no window, so a team without the schedule keeps its header
  * byte-identical. The window end comes from quiet-hours.ts's quietWindowEnd — read back out of
  * the window string, not re-parsed into minutes — so the badge renders the operator's own
  * spelling.
  * renderStatus renders it in the TUI/status header after the pause badge; the GUI page
  * renders its sidebar chip from the payload's raw fields and its active indicator from
- * fleet-alerts' quiet alert, so both dashboards say the same thing. */
+ * team-alerts' quiet alert, so both dashboards say the same thing. */
 export function quietBadge(quietHours, inQuietHours) {
     if (!quietHours)
         return "";
@@ -281,25 +321,36 @@ export function quietBadge(quietHours, inQuietHours) {
 }
 /** The header's disk-floor fragment (plans/disk-floor.md, part 4/4): shown while the disk hold
  * is on (`— holding new work`) or free space sits below the reclaim threshold, so an operator
- * sees why the fleet stopped without reading events. The most recent reclaim's freed size and
- * age ride the same fragment whenever one has run — standing information, so an operator
- * watching a volume recover can see what the clean bought even after space rises above the
- * threshold. Empty when the snapshot carries no disk block (an older orchestrator, or an
- * unmeasurable volume) and space is comfortable with no reclaim on record — a quiet header
- * reads exactly as before. One home for the rule, like budgetBadge: renderStatus renders it in
- * the TUI/status header and status-payload.ts ships it preformatted. `now` pins the reclaim
- * age (the same elapsed-seconds rule status-render.ts's own `ago` uses). */
-export function diskBadge(disk, now = Date.now()) {
+ * sees why the team stopped without reading events. A finished reclaim is not standing
+ * information here; it surfaces as a `disk_reclaim` item in the Activity log's Notable feed.
+ * Empty when the snapshot carries no disk block (an older orchestrator, or an unmeasurable
+ * volume) and space is comfortable. One home for the rule, like budgetBadge: renderStatus
+ * renders it in the TUI/status header and status-payload.ts ships it preformatted. */
+export function diskBadge(disk) {
     if (!disk)
         return "";
     const free = `${formatGB(disk.freeGB)} free`;
-    const reading = disk.held
+    return disk.held
         ? ` · disk ${free} — holding new work`
         : disk.reclaimGB > 0 && disk.freeGB < disk.reclaimGB
             ? ` · disk ${free}`
             : "";
-    const reclaim = disk.lastReclaim
-        ? ` · last reclaim freed ${formatGB(disk.lastReclaim.freedGB)} ${humanSeconds(secondsSince(disk.lastReclaim.at, now))} ago`
-        : "";
-    return reading + reclaim;
+}
+/** The permit pool's header fragment (plans/provider-concurrency.md §8): `slots 5/8 · omlx
+ * 3/3 · claude 2/6` — the team total's in-use/cap followed by each capped provider key's own
+ * in-use/cap. The WHOLE fragment appears only while at least one key carries a cap (the
+ * `maxConcurrentPerProvider` map is set), so a team without it renders the header exactly
+ * as before; uncapped keys that happen to be in the snapshot are dropped rather than shown
+ * with a bare in-use that would read like a cap. */
+export function permitsBadge(permits) {
+    if (!permits)
+        return "";
+    const providers = Object.entries(permits.byKey)
+        .filter(([, e]) => e.limit !== undefined)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([k, e]) => `${k} ${e.inUse}/${e.limit}`)
+        .join(" · ");
+    if (providers.length === 0)
+        return "";
+    return ` · running ${permits.inUse} of ${permits.limit} · ${providers}`;
 }