tumwater 0.2.0 → 0.3.0

package/dist/src/{loop/loop-tick.js → runner/runner-run.js}

@@ -1,3 +1,4 @@
+import path from "node:path";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { branchExists, deleteRef, commitMessage, changeBaseRev, headOf } from "../git/git.js";
 import { git, gitTry } from "../git/git-run.js";
@@ -5,32 +6,32 @@ import { abortSync, ensureWorktree, resetWorktreeToMain } from "../git/worktree.
 import { leaseSlot } from "../git/worktree-pool.js";
 import { slotCount } from "../config/config.js";
 import { useWorktree } from "../git/worktree-use.js";
+import { readPiListedModels } from "../pi/pi-listed-models.js";
 import { branchName, worktreePath, mergeRefName, rejectedRefName } from "../paths.js";
 import { logEventBestEffort } from "../events/events.js";
-import { buildConflictDiscardNote, buildConflictHandbackNote, buildRevisionNote, buildRejectedReviewNote, } from "../prompt/gate-prompts.js";
-import { modelSelectorField, resolvedAgentConfig, reviewRunConfig, scheduleConfigForRole, seamHoldKey, withModelOverrides, } from "../config/config-views.js";
+import { buildConflictHandbackNote, buildSalvageRestoreNote } from "../prompt/gate-prompts.js";
+import { buildConflictDiscardNote, buildMainKnownRedNote, buildRevisionNote, buildRejectedReviewNote, } from "../prompt/gate-notes.js";
+import { modelSelectorField, resolvedBackendConfig, reviewRunConfig, scheduleConfigForRole, seamHoldKey, withModelOverrides, } from "../config/config-views.js";
 import { fallbackRoleConfig } from "../config/config-fallbacks.js";
 import { imageReroute, seamImageInput } from "../agent/image-input.js";
 import { piModelsPath, readPiProviders } from "../pi/pi-models.js";
 import { peekPrompt, peekRolePrompt } from "../inbox/inbox.js";
-import { planTickStart } from "../tick/tick-resume.js";
-import { DEFAULT_AGENT } from "../agent/agent-backend.js";
-import { stageTickMerge, foldAgentCommitsSince } from "../tick/tick-stage.js";
-import { stageCheckFindings } from "../tick/stage-check.js";
-import { bootstrapStatus } from "../gates/bootstrap-gates.js";
-import { briefStatusIncomplete } from "../brief/brief.js";
+import { planRunStart, planWithSalvagedWork, takesSalvagedWork } from "../run/run-resume.js";
+import { restoreSalvagedWork } from "../git/slot-salvage.js";
+import { DEFAULT_BACKEND } from "../agent/agent-backend.js";
+import { foldAgentCommitsSince } from "../run/run-stage.js";
+import { planBacklogFull } from "../scheduling/claims.js";
 import { modelFallbackActive, modelFallbackProbe } from "./model-fallback.js";
-import { finalizeTick } from "../tick/tick-finalize.js";
+import { finalizeRun } from "../run/run-finalize.js";
 import { errorMessage } from "../text/text.js";
-import { appendPromptNote } from "../text/format.js";
-import { recoverLeftover } from "./leftover.js";
+import { appendPromptNote, prependPromptNote } from "../text/format.js";
+import { hasUnmergedPin, recoverLeftover } from "./leftover.js";
 import { applyRevision, applyWithConflicts } from "./revision.js";
 import { conflictedFileHunks, hasConflictMarkers, mainCommitsTouching } from "../merge/merge-git.js";
 import { changedFiles } from "../git/git-diff.js";
-import { mergeToMain } from "../merge/merge-to-main.js";
+import { handlePiResultPhase } from "./runner-outcome.js";
 import { bugfixMainRedNote, mainRedGate } from "../baseline/main-red.js";
-import { resolveTickVerdict } from "../tick/tick-verdict.js";
-import { extractFlow } from "../verdict/reply-contract.js";
+import { extractFlow, extractFiled } from "../verdict/reply-contract.js";
 /** The intent the author needs to resolve a handed-back change: the change's own commit message
  * and the main commits that touched its conflicted files since its merge-base. Mirrors what
  * resolveConflict gathers for the merge resolver (src/merge/merge-to-main.ts) and feeds the
@@ -59,68 +60,69 @@ async function markerBearingFiles(wt) {
     const files = await changedFiles(wt);
     return files.filter((f) => hasConflictMarkers(wt, [f]));
 }
-/** Run one full tick of a role loop: resolve the config (including the model-fallback probe),
- * log the start, run the pipeline, then let finalizeTick schedule the next run. Never throws: a
- * failed tick is an "error" result, saved and logged like any other so the loop stays resumable
- * and observable. */
-export async function tickPhase(ctx) {
+/** Run one full run of a role runner: resolve the config (including the model-fallback probe),
+ * log the start, run the pipeline, then let finalizeRun schedule the next run. Never throws: a
+ * failed run is an "error" result, saved and logged like any other so the runner stays
+ * resumable and observable. */
+export async function runPhase(ctx) {
     const s = ctx.state;
     // This role's view of the config (per-role provider/model/thinking + minRunIntervalSeconds
     // overrides): resolved once so every interval-based scheduling branch honors a slow
-    // clock (e.g. the steward's ~6 h) and a live-reloaded config applies from this tick on.
-    // New-project bootstrap (plans/work-ratio.md, part 2/2): while active, plan schedules on the
-    // global min-tick gap rather than its 3600 s default. And while the brief's status section is
-    // still the placeholder (briefStatusIncomplete), plan schedules with a zero gap so a fresh
-    // project plans back-to-back until a run changes nothing. The shared verdict below is the
-    // same one the gate and isEligible read, and scheduleConfigForRole is the one home of the
-    // rule, so the scheduler that admits plan and the nextRunAt this tick writes cannot disagree.
-    const bootstrapActive = bootstrapStatus(ctx.root, ctx.config)?.active === true;
-    const descriptionIncomplete = briefStatusIncomplete(ctx.root);
-    const primaryCfg = scheduleConfigForRole(ctx.config, ctx.role, bootstrapActive, descriptionIncomplete);
-    // Model-fallback episode (src/loop/model-fallback.ts): while one is active the tick runs
+    // clock (e.g. the steward's ~6 h) and a live-reloaded config applies from this run on.
+    // While PLANS.md still has planning room (planBacklogFull false), plan schedules with a zero
+    // gap so a productive plan run reruns on the next poll; an unproductive run drops to the
+    // idle backoff, and once the target is met the plans-full deferral holds the run. The shared
+    // verdict below is the same one the gate and isEligible read, and scheduleConfigForRole is
+    // the one home of the rule, so the scheduler that admits plan and the nextRunAt this run
+    // writes cannot disagree.
+    const planBacklogOpen = !planBacklogFull(ctx.root, ctx.config);
+    const primaryCfg = scheduleConfigForRole(ctx.config, ctx.role, planBacklogOpen);
+    // Model-fallback episode (src/runner/model-fallback.ts): while one is active the run runs
     // on the role's tier fallback pair, and once the cooldown elapses it runs on the primary
-    // as the probe. Resolved at tick start so the authoring run below and the end-of-tick fold
+    // as the probe. Resolved at run start so the authoring run below and the end-of-run fold
     // agree on which pair ran. Null fallback (the tier resolves to pause) keeps the feature off.
     const now = Date.now();
     const fallback = fallbackRoleConfig(ctx.config, ctx.role);
     const probing = fallback !== null && modelFallbackProbe(s.modelFallback, now);
     const onFallback = fallback !== null && modelFallbackActive(s.modelFallback, now);
-    // The fallback pair keeps primaryCfg's gap (they resolve the same one outside bootstrap),
-    // so a plan on its model fallback during bootstrap still schedules on the global clock.
+    // The fallback pair keeps primaryCfg's gap (they resolve the same one outside the plan
+    // schedule's zero-gap window), so a plan on its model fallback still schedules the same gap.
     let cfg = onFallback && fallback !== null
         ? { ...fallback, minRunIntervalSeconds: primaryCfg.minRunIntervalSeconds }
         : primaryCfg;
     // Image-input reroute (plans/image-input.md part 4/5). A pending one-shot marker means
-    // THIS tick is the blind-read reroute: start directly on the image-capable target the
-    // prior tick recorded, over the kept worktree, in a fresh session. The marker is consumed
-    // (cleared) here so it does not route a later tick; imageRerouteActive stays true for the
-    // whole tick so the verdict's one-hop guard fails a second blind read instead of
+    // THIS run is the blind-read reroute: start directly on the image-capable target the
+    // prior run recorded, over the kept worktree, in a fresh session. The marker is consumed
+    // (cleared) here so it does not route a later run; imageRerouteActive stays true for the
+    // whole run so the verdict's one-hop guard fails a second blind read instead of
     // rerouting again. A preflight (below) sets the same active flag without a marker.
     s.imageRerouteActive = false;
     let preflightBlocked = false;
     if (s.imageReroute) {
         const r = s.imageReroute;
         cfg = withModelOverrides(ctx.config, r.tier, {
+            backend: r.backend,
             provider: r.provider,
             model: r.model,
             thinking: r.thinking,
         });
-        // The marker is NOT cleared here: planTickStart reads its `from`/`path` when it builds
-        // the handoff note (and clears it then), so a tick skipped before the plan (an empty
-        // inbox) leaves the reroute pending for the next eligible tick.
+        // The marker is NOT cleared here: planRunStart reads its `from`/`path` when it builds
+        // the handoff note (and clears it then), so a run skipped before the plan (an empty
+        // inbox) leaves the reroute pending for the next eligible run.
         s.imageRerouteActive = true;
     }
     else {
         // Preflight (plans/image-input.md "Attachments"): a queued prompt carrying an
         // `[image attached: …]` line needs a model that can read images BEFORE any run starts,
-        // so a text-only tick hops straight to the target instead of spending a failed tick
-        // learning it; with no target the tick errors without spawning pi.
+        // so a text-only run hops straight to the target instead of spending a failed run
+        // learning it; with no target the run errors without spawning pi.
         const nextPrompt = ctx.role === DIRECTOR_ROLE ? peekPrompt(ctx.root) : peekRolePrompt(ctx.root, ctx.role);
         const carriesImages = nextPrompt !== null && /^\[image attached: .+\]$/m.test(nextPrompt);
         if (carriesImages) {
             const providers = readPiProviders(piModelsPath());
-            if (seamImageInput(cfg, providers) !== true) {
-                const target = imageReroute(ctx.config, ctx.role, ctx.rerouteRegime(now));
+            const listed = readPiListedModels(ctx.root);
+            if (seamImageInput(cfg, providers, undefined, listed) !== true) {
+                const target = imageReroute(ctx.config, ctx.role, ctx.rerouteRegime(now), undefined, null, undefined, null, listed);
                 if (target !== null) {
                     cfg = target.config;
                     s.imageRerouteActive = true;
@@ -142,142 +144,143 @@ export async function tickPhase(ctx) {
             }
         }
     }
-    // Capture what this tick runs on (the orchestrator's budget handback matches it against
+    // Capture what this run runs on (the orchestrator's budget handback matches it against
     // the fallback pair) and clear any stale handback flag: an abort request that lands while
-    // the loop is idle must not name a later tick's resume.
+    // the runner is idle must not name a later run's resume.
     // The pair is keyed by the seam that ran (seamHoldKey), not the pi provider: a claude
-    // fallback tick carries `claude`, matching the configured fallback pair that tickOnPair
-    // (src/gates/budget-gates.ts) compares against, so a tick on a claude fallback is handed
+    // fallback run carries `claude`, matching the configured fallback pair that runOnPair
+    // (src/gates/budget-gates.ts) compares against, so a run on a claude fallback is handed
     // back when the budget gate reopens (PLANS.md "Mixed claude + pi fleets, part 2/4").
-    ctx.setTickPair({ provider: seamHoldKey(cfg), model: cfg.model });
+    ctx.setRunPair({ provider: seamHoldKey(cfg), model: cfg.model });
     ctx.setHandedBack(false);
     s.runs += 1;
-    // gen / peak ctx are per-tick windows, not lifetime totals (user decision 2026-08-25):
-    // reset before the start-of-tick save so a working loop's columns grow live from 0 and
-    // an idle loop's show its last completed tick. The loop's pi plumbing accumulates every pi
-    // run of this tick (main + transient-timeout retry + conflict resolution) into them, and the
-    // end-of-tick save persists the finished run's totals.
+    // gen / peak ctx are per-run windows, not lifetime totals (user decision 2026-08-25):
+    // reset before the start-of-run save so a working runner's columns grow live from 0 and
+    // an idle runner's show its last completed run. The runner's pi plumbing accumulates every pi
+    // run of this run (main + transient-timeout retry + conflict resolution) into them, and the
+    // end-of-run save persists the finished run's totals.
     s.generatedTokens = 0;
     s.peakContextTokens = 0;
     ctx.usage.reset();
     ctx.setRecoveryFailure(undefined);
-    // A fresh per-tick abort controller and a cleared user-abort flag: an abort request that
-    // lands while the loop is idle must not leak into the next tick.
-    ctx.resetTickAbort();
+    // A fresh per-run abort controller and a cleared user-abort flag: an abort request that
+    // lands while the runner is idle must not leak into the next run.
+    ctx.resetRunAbort();
     s.running = true;
     s.lastRunStartedAt = Date.now();
-    const tick = s.runs;
-    const tickStartedAt = s.lastRunStartedAt;
+    const runNumber = s.runs;
+    const runStartedAt = s.lastRunStartedAt;
     ctx.save();
-    // The selector this tick's runs start on (plans/model-tiers.md "Observability"): with
+    // The selector this run's runs start on (plans/model-tiers.md "Observability"): with
     // the budget fallback active the config already names the fallback pair, so the logged
     // string is what the runs actually use. Omitted when no model is configured (pi's own
     // default), so old logs and old configs render unchanged.
     logEventBestEffort(ctx.root, {
         source: ctx.role,
         type: "run_start",
-        run: tick,
-        // A tick routed onto the image-capable target — a blind-read handoff or an attachment
+        run: runNumber,
+        // A run routed onto the image-capable target — a blind-read handoff or an attachment
         // preflight — is stamped so the feed shows the reroute and the model it landed on.
         ...(s.imageRerouteActive ? { reroute: "image" } : {}),
         ...modelSelectorField(cfg),
     });
     let outcome;
     try {
-        // The preflight can end the tick before any pi spawns: a text-only loop with an image
+        // The preflight can end the run before any pi spawns: a text-only runner with an image
         // attachment and no image-capable target has nothing to run, so it errors without
         // spending a model call. Everything else runs the pipeline as usual.
         outcome = preflightBlocked
             ? { result: "error" }
-            : await ctx.runTick(cfg, { fallback, probe: probing, primary: primaryCfg });
+            : await ctx.runOnce(cfg, { fallback, probe: probing, primary: primaryCfg });
     }
     catch (err) {
         outcome = { result: "error" };
         s.lastError = errorMessage(err);
         // An exception between the dequeue/reclaim and the pi run leaves the request only in
-        // the pending field — memory this failed tick is about to drop, with no outcome handler
-        // left to re-queue it (the handlers run inside runTick, after the pi run). The queue is
+        // the pending field — memory this failed run is about to drop, with no outcome handler
+        // left to re-queue it (the handlers run inside runOnce, after the pi run). The queue is
         // the durable store, so the catch re-queues whatever is still pending, like every
         // unfulfilled outcome does; it is always null once a pi run has been accounted for.
         ctx.pending.requeuePendingUnfulfilled();
     }
-    // The tick that owned the dequeued request is over: remove its image files unless an
+    // The run that owned the dequeued request is over: remove its image files unless an
     // unfulfilled outcome handed the request back to the queue (settleImages). Runs after the
     // catch above, which is the last point a requeue can happen.
     ctx.pending.settleImages();
     // Everything after the pi run — the outcome folds, the main-head read, next-run
-    // scheduling, the episode warnings, and the run_end event — is the tick's per-result
-    // bookkeeping policy, not runner lifecycle: it lives in src/tick/tick-finalize.ts, which owns
+    // scheduling, the episode warnings, and the run_end event — is the run's per-result
+    // bookkeeping policy, not runner lifecycle: it lives in src/run/run-finalize.ts, which owns
     // the ordering (the folds land on state before the schedule, the head read happens while
-    // `running` is still true) and the per-episode warning crossings. The tick number and
-    // start time are passed through as captured above: both must describe the tick run_start
-    // announced, not whatever resetCounters (a documented mid-tick operation) may have left
+    // `running` is still true) and the per-episode warning crossings. The run number and
+    // start time are passed through as captured above: both must describe the run run_start
+    // announced, not whatever resetCounters (a documented mid-run operation) may have left
     // on the shared state by finalize time.
-    const finalizeResult = await finalizeTick({
+    const finalizeResult = await finalizeRun({
         root: ctx.root,
         role: ctx.role,
         mainBranch: ctx.mainBranch,
         config: cfg,
         state: s,
         outcome,
-        tick,
-        tickStartedAt,
+        runNumber,
+        runStartedAt: runStartedAt,
         usage: ctx.usage,
         recoveryFailure: ctx.recoveryFailure,
     });
-    // The tick is over: the captured pair must not outlive it (a later poll must never match
-    // an idle loop's stale pair against a resumed fallback).
-    ctx.setTickPair(undefined);
+    // The run is over: the captured pair must not outlive it (a later poll must never match
+    // an idle runner's stale pair against a resumed fallback).
+    ctx.setRunPair(undefined);
     return finalizeResult;
 }
-/** The tick pipeline's start half: resume-or-fresh policy, then run in the director's own
+/** The run pipeline's start half: resume-or-fresh policy, then run in the director's own
  * worktree or on a leased pool slot. Returns the setup's outcome; a null plan means nothing to
  * run. */
-export async function runTickPhase(ctx, cfg, fallbackCtx) {
+export async function runOncePhase(ctx, cfg, fallbackCtx) {
     const s = ctx.state;
-    // How this tick starts — resume the interrupted session or run fresh, and which prompt —
-    // is the resume policy, not runner mechanics: it lives in src/tick/tick-resume.ts, which also
-    // consumes the resume flags and reclaims the interrupted tick's re-queued prompt. A null
-    // plan means the loop has nothing to run.
-    const plan = planTickStart({
+    // How this run starts — resume the interrupted session or run fresh, and which prompt —
+    // is the resume policy, not runner mechanics: it lives in src/run/run-resume.ts, which also
+    // consumes the resume flags and reclaims the interrupted run's re-queued prompt. A null
+    // plan means the runner has nothing to run.
+    const plan = planRunStart({
         root: ctx.root,
         role: ctx.role,
         state: s,
         pending: ctx.pending,
-        tickPrompt: (agent, compact) => ctx.tickPrompt(agent, compact),
-        agent: cfg.agent ?? DEFAULT_AGENT,
-        // The team's configured claude config dir, so planTickStart's claude resume guard looks
+        runPrompt: (backend) => ctx.runPrompt(backend),
+        agent: cfg.agent ?? DEFAULT_BACKEND,
+        // The team's configured claude config dir, so planRunStart's claude resume guard looks
         // under the same dir the run's env writes its transcript to (note 4/4). Unset → undefined.
-        claudeConfigDir: resolvedAgentConfig(cfg, "claude").configDir,
-        // Every run gets the compact prompt (prompt.ts CompactPrompt), whatever window its model
-        // declares: it re-sends ~3k fewer tokens on every turn (2026-10-18, to cut token spend).
-        compact: true,
+        claudeConfigDir: resolvedBackendConfig(cfg, "claude").configDir,
+        // A director with no prompt but a kept merge pin still goes through the run, for its recovery.
+        recoveryOnly: ctx.role === DIRECTOR_ROLE && ctx.pending.get() === null && (await hasUnmergedPin(ctx.root, ctx.role)),
     });
     if (plan === null)
         return { result: "skipped" };
     if (ctx.role === DIRECTOR_ROLE) {
-        // The image-reroute one-shot marker routes exactly ONE tick onto the image-capable
-        // target (plans/image-input.md part 4/5, INV-J2): for a role loop, planTickStart consumes
-        // it after reading its handoff-note facts. The director never resumes, so planTickStart's
+        // The image-reroute one-shot marker routes exactly ONE run onto the image-capable
+        // target (plans/image-input.md part 4/5, INV-J2): for a role runner, planRunStart consumes
+        // it after reading its handoff-note facts. The director never resumes, so planRunStart's
         // image-reroute branch never runs for it and the marker would otherwise linger and
-        // re-route every later director tick off its own tier. It is cleared here — after this
-        // tick is confirmed to run (an empty-inbox skip above returns before this, leaving the
-        // reroute pending for the next eligible tick) — so the rerouted director prompt is
+        // re-route every later director run off its own tier. It is cleared here — after this
+        // run is confirmed to run (an empty-inbox skip above returns before this, leaving the
+        // reroute pending for the next eligible run) — so the rerouted director prompt is
         // delivered exactly once and the director is back on its own tier next.
-        s.imageReroute = undefined;
+        // A promptless recovery run delivers no prompt, so it leaves a pending reroute for the next.
+        if (plan.prompt !== null)
+            s.imageReroute = undefined;
         // The director keeps its dedicated worktree (it runs outside the permit, consumes its
         // config-request file at that exact path, and never resumes). Hold it from before
-        // ensureWorktree — creating or resetting it is part of the use — to the tick's end
+        // ensureWorktree — creating or resetting it is part of the use — to the run's end
         // (plans/disk-floor.md, part 2/4), so a concurrent pressure reclaim never cleans a tree
-        // this tick is creating or working in.
-        return useWorktree(ctx.root, worktreePath(ctx.root, ctx.role), () => tickWithWorktreePhase(ctx, plan, cfg, fallbackCtx));
+        // this run is creating or working in.
+        return useWorktree(ctx.root, worktreePath(ctx.root, ctx.role), () => runWithWorktreePhase(ctx, plan, cfg, fallbackCtx));
     }
-    return runTickInLeasePhase(ctx, plan, cfg, fallbackCtx);
+    return runOnceInLeasePhase(ctx, plan, cfg, fallbackCtx);
 }
-/** Whether a finished role tick's leased slot must stay pinned for the next tick's resume —
- * the resume flag a verdict armed inside the tick (`resumePending`), an abort or quiet kill,
+/** Whether a finished role run's leased slot must stay pinned for the next run's resume —
+ * the resume flag a verdict armed inside the run (`resumePending`), an abort or quiet kill,
  * or a context cut-off. Exported so a test can evaluate the exact condition the lease release
- * uses: a resume flag set only later, by applyTickOutcome, is too late to keep the worktree. A
+ * uses: a resume flag set only later, by applyRunOutcome, is too late to keep the worktree. A
  * user abort discards its work and is never pinned. */
 export function slotPinnedForResume(state, outcome) {
     return (state.resumePending === true ||
@@ -285,13 +288,15 @@ export function slotPinnedForResume(state, outcome) {
         outcome?.result === "quiet_killed" ||
         outcome?.cutOff === true);
 }
-/** A non-director tick's whole life on a pooled slot (plans/worktree-pool.md, "Role ticks
+/** A non-director run's whole life on a pooled slot (plans/worktree-pool.md, "Role runs
  * lease slots"): lease, author on the role's branch, release. The release pins the slot for
- * a tick whose next run resumes (aborted, quiet-killed, cut off, or a failed dirty run),
+ * a run whose next run resumes (aborted, quiet-killed, cut off, or a failed dirty run),
  * keeping the branch checked out and the uncommitted edits in the same cwd pi's `--continue`
  * needs; every other release detaches first so the branch is free for whichever slot the role
- * leases next. */
-async function runTickInLeasePhase(ctx, plan, cfg, fallbackCtx) {
+ * leases next. A run an exception ends releases its slot unsettled, so edits it leaves there
+ * are saved for the role's next run, and a run on a fresh checkout first takes back any such
+ * work an earlier run of the role left (restoreSalvagedPhase). */
+async function runOnceInLeasePhase(ctx, plan, cfg, fallbackCtx) {
     const lease = await leaseSlot(ctx.root, {
         role: ctx.role,
         purpose: "run",
@@ -299,30 +304,50 @@ async function runTickInLeasePhase(ctx, plan, cfg, fallbackCtx) {
         keep: plan.resuming || plan.handoff,
         signal: ctx.runSignal(),
         // The live view's pool budget: this read must not depend on tumwater.json being
-        // readable right now (a broken file must not error the tick before its pi run).
+        // readable right now (a broken file must not error the run before its pi run).
         slotBudget: slotCount(ctx.config),
     });
     let outcome;
     try {
-        if (!lease.preserved)
+        let run = plan;
+        if (!lease.preserved) {
             await checkoutRoleBranchPhase(ctx, lease.dir);
-        outcome = await tickWithWorktreePhase(ctx, plan, cfg, fallbackCtx, lease.dir);
+            run = await restoreSalvagedPhase(ctx, plan, lease.dir);
+        }
+        outcome = await runWithWorktreePhase(ctx, run, cfg, fallbackCtx, lease.dir);
         return outcome;
     }
     finally {
-        // The slot is pinned for the next tick's resume when the verdict armed `resumePending`
-        // inside the tick (the error-dirty and rate-limit arms in src/tick/tick-verdict.ts), or
-        // when the outcome is an abort, quiet kill, or context cut-off. applyTickOutcome sets
-        // `resumePending` for the other outcomes only after runTick returns, so those are read off
+        // The slot is pinned for the next run's resume when the verdict armed `resumePending`
+        // inside the run (the error-dirty and rate-limit arms in src/run/run-verdict.ts), or
+        // when the outcome is an abort, quiet kill, or context cut-off. applyRunOutcome sets
+        // `resumePending` for the other outcomes only after runOnce returns, so those are read off
         // the outcome here instead.
         const pin = slotPinnedForResume(ctx.state, outcome);
-        // Detach is best-effort so it can never mask the tick's own outcome or error; the release
+        // Detach is best-effort so it can never mask the run's own outcome or error; the release
         // still runs, and the next lease's checkout recovers an undetached branch either way.
         if (!pin)
             await gitTry(lease.dir, "checkout", "--detach");
-        lease.release({ pin });
+        // An exception escaped the run (no outcome), so nothing settled the worktree — not even a
+        // dirty check, when the exception was git itself failing (2026-10-21's spawn wedge): any
+        // edits left in the slot are this role's unfinished work, saved for its next run.
+        lease.release({ pin, unsettled: outcome === undefined });
     }
 }
+/** Give a run on a fresh checkout back the work an earlier run of its role left unsettled
+ * (src/git/slot-salvage.ts): restore the newest waiting patch into `dir` and run over it as
+ * planWithSalvagedWork says, told which files carry conflict markers and which hunks it must
+ * place by hand when the branch moved under the patch. A run that does not take such work, or
+ * has none waiting or cannot restore it now, keeps its plan. */
+async function restoreSalvagedPhase(ctx, plan, dir) {
+    if (!takesSalvagedWork(plan))
+        return plan;
+    const restored = await restoreSalvagedWork(ctx.root, ctx.role, dir);
+    if (restored === null)
+        return plan;
+    const note = buildSalvageRestoreNote(conflictedFileHunks(dir, restored.conflicted), restored.unplaced, restored.patch);
+    return planWithSalvagedWork(ctx.role, plan, path.relative(ctx.root, restored.patch), note);
+}
 /** Put `tumwater/<role>` on the leased slot before authoring. An existing branch is checked
  * out, never reset — `-B` would discard the unmerged commit it durably holds; an absent one
  * is created from main. `--ignore-other-worktrees` lets the slot take the branch while a
@@ -339,26 +364,32 @@ async function checkoutRoleBranchPhase(ctx, dir) {
     }
     await git(dir, "clean", "-fd");
 }
-async function tickWithWorktreePhase(ctx, plan, cfg, fallbackCtx, 
-/** The leased slot the tick runs in; omitted by the director, which ensures its own. */
+async function runWithWorktreePhase(ctx, plan, cfg, fallbackCtx, 
+/** The leased slot the run runs in; omitted by the director, which ensures its own. */
 leasedDir) {
     const s = ctx.state;
     const { priorMergeFailure, resuming, handoff, resumeCause, userPrompt } = plan;
-    let prompt = plan.prompt;
+    // Empty only for a promptless recovery run, which ends before any use of it (see below).
+    let prompt = plan.prompt ?? "";
     const wt = leasedDir ?? (await ensureWorktree(ctx.root, ctx.role, ctx.mainBranch));
     if (resuming || handoff) {
         // Keep the interrupted run's uncommitted edits; clear only stray merge/rebase state. A
         // handoff resumes a FRESH session over those same edits (the newest author session belongs
         // to another agent), so it preserves the worktree exactly as a resume does.
         await abortSync(wt);
-        logEventBestEffort(ctx.root, { source: ctx.role, type: "resume", cause: resumeCause });
+        logEventBestEffort(ctx.root, {
+            source: ctx.role,
+            type: "resume",
+            cause: resumeCause,
+            ...(plan.restored !== undefined ? { restored: plan.restored } : {}),
+        });
     }
     else {
-        // Salvage a commit a previous tick left unmerged (src/loop/leftover.ts): recovery puts it
+        // Salvage a commit a previous run left unmerged (src/runner/leftover.ts): recovery puts it
         // back on the merge queue, so it merges through the orchestrator's merge pipeline — the
-        // same gate as a fresh tick's change, and main keeps exactly one writer (an in-tick
+        // same gate as a fresh run's change, and main keeps exactly one writer (an in-run
         // recovery merge raced the slot's batches into `merge_blocked`). A salvaged leftover
-        // ENDS the tick: the role holds one merge ref, and the leftover owns it until its
+        // ENDS the run: the role holds one merge ref, and the leftover owns it until its
         // merge resolves. With nothing to salvage the branch holds nothing either, so the reset
         // below leaves pristine main for the red-main gate.
         // A permanent reviewer config error — held from re-queueing — clears once the resolved
@@ -371,12 +402,20 @@ leasedDir) {
             root: ctx.root,
             role: ctx.role,
             mainBranch: ctx.mainBranch,
-            tick: s.runs,
+            runNumber: s.runs,
             wt,
             mergeConflicts: s.mergeConflicts,
             conflictHandback: s.conflictHandback,
             mergeReviewError: s.mergeReviewError,
+            mainRedRetry: s.mainRedRetry,
         });
+        if (recovered?.kind === "handback" && plan.prompt === null) {
+            // A promptless recovery run has no authoring run to hand the pin back to: leave the pin and
+            // the conflict state exactly as they are, so the one hand-back the lineage is owed happens on
+            // the director's next prompt-driven run.
+            await resetWorktreeToMain(wt, ctx.mainBranch);
+            return { result: "skipped" };
+        }
         if (recovered?.kind === "handback") {
             // The pin hit the conflict cap and its lineage has not been handed back yet: keep the
             // pin, record the hand-back, and fall through to author the resolution on current main.
@@ -392,22 +431,26 @@ leasedDir) {
         }
         else if (recovered?.kind === "discarded") {
             // The pin hit the conflict cap and is gone: nothing holds the role any more, so this
-            // tick authors on a fresh main like any other — told what was dropped and why.
+            // run authors on a fresh main like any other — told what was dropped and why.
             s.mergeConflicts = undefined;
             s.conflictHandback = undefined;
             s.conflictDiscard = { sha: recovered.sha, summary: recovered.summary, attempts: recovered.attempts, at: Date.now() };
             prompt = appendPromptNote(prompt, buildConflictDiscardNote(recovered.summary, recovered.attempts));
         }
         else if (recovered)
-            return ctx.finishRecoveryTick(recovered, userPrompt, wt, priorMergeFailure);
+            return ctx.finishRecoveryRun(recovered, userPrompt, wt, priorMergeFailure);
         await resetWorktreeToMain(wt, ctx.mainBranch);
+        // A promptless recovery run found nothing to salvage (or deleted a stale pin): it authors
+        // nothing, so it ends here rather than reach the authoring run with a null prompt.
+        if (plan.prompt === null)
+            return { result: "skipped" };
         // Red-main baseline gate (src/baseline/main-red.ts): the worktree is pristine main right
         // now — verify main's own suite before spending an authoring run on top of it. Only roles
-        // whose diff can carry code changes are blocked; resume ticks skip this by construction
+        // whose diff can carry code changes are blocked; resume runs skip this by construction
         // (their worktree is not pristine main). The `bugfix` healer is exempt because its fix is
         // the team's only way back to green, so instead of blocking it we hand it the failure
         //the same check runs, but a red main appends a <main-red>
-        // note to this tick's prompt so it reproduces and fixes that failure rather than hunting
+        // note to this run's prompt so it reproduces and fixes that failure rather than hunting
         // blind.
         if (ctx.baseRole === "bugfix") {
             const note = await bugfixMainRedNote(ctx.root, ctx.role, wt);
@@ -415,21 +458,24 @@ leasedDir) {
                 prompt = appendPromptNote(prompt, note);
         }
         else {
-            const blocked = await mainRedGate(ctx.root, ctx.role, wt);
+            const knownRed = [];
+            const blocked = await mainRedGate(ctx.root, ctx.role, wt, undefined, (tests) => knownRed.push(tests));
             if (blocked) {
                 // The dequeued prompt never ran: put it back in its queue before returning, so it is
                 // not lost to a restart (the pending field is memory-only) or dropped by the next
-                // tick's outcome handling — the queue is the durable store, and once main is green
-                // the next tick dequeues it again (criterion b).
+                // run's outcome handling — the queue is the durable store, and once main is green
+                // the next run dequeues it again (criterion b).
                 ctx.pending.requeueUnfulfilled(userPrompt);
                 ctx.pending.clear();
                 return blocked;
             }
+            if (knownRed[0])
+                prompt = appendPromptNote(prompt, buildMainKnownRedNote(knownRed[0]));
         }
     }
     // A change handed back after its merges kept conflicting — or a persisted hand-back the
-    // author's tick has not applied yet — is re-applied over current main with the conflict
-    // markers left as ordinary uncommitted edits so this tick resolves them (PLANS.md "Robust
+    // author's run has not applied yet — is re-applied over current main with the conflict
+    // markers left as ordinary uncommitted edits so this run resolves them (PLANS.md "Robust
     // conflict landing, part 2/2"). The merge ref is deleted once the diff is in the worktree.
     // Runs before the revision branch, which applies a revision hand-back itself. A resume or
     // handoff keeps the interrupted worktree as-is, so re-applying here would cherry-pick onto
@@ -457,7 +503,7 @@ leasedDir) {
         }
         else {
             // The object is gone or the apply failed for a non-conflict reason: drop the hand-back
-            // so the author starts fresh rather than retrying it every tick.
+            // so the author starts fresh rather than retrying it every run.
             s.conflictHandback = undefined;
             await deleteRef(ctx.root, mergeRefName(ctx.role));
             logEventBestEffort(ctx.root, { source: ctx.role, type: "conflict_handback", action: "failed", sha: hb.sha, reason: hb.reason });
@@ -465,40 +511,40 @@ leasedDir) {
     }
     const piStartedAt = Date.now();
     // A rejected change owes a revision (plans/revise-rejected.md): re-apply its diff to current
-    // main as uncommitted edits so this tick revises it instead of authoring from scratch, and
-    // append the revision note the prompt skipped. `revisionRound` records that THIS tick holds
+    // main as uncommitted edits so this run revises it instead of authoring from scratch, and
+    // append the revision note the prompt skipped. `revisionRound` records that THIS run holds
     // the rejected diff — set only when the revision is applied here, or a resume carries the
-    // prior attempt's already-applied edits — so the post-run handlers read the tick rather than
-    // `state.revision`, which a per-role user-request tick leaves set by design. A conflict (or a
+    // prior attempt's already-applied edits — so the post-run handlers read the run rather than
+    // `state.revision`, which a per-role user-request run leaves set by design. A conflict (or a
     // gone object) clears the revision, deletes the rejected ref, and falls back to the plain
     // rejection note.
     let revisionRound;
     if (s.revision && ctx.role !== DIRECTOR_ROLE && userPrompt === null) {
         const { sha, round } = s.revision;
-        // The prompt's rejected/revision notes read the loop's most recent rejection; an absent
-        // one (a fresh loop or a hand-edited state) reads the empty reasons list. Computed once
+        // The prompt's rejected/revision notes read the runner's most recent rejection; an absent
+        // one (a fresh runner or a hand-edited state) reads the empty reasons list. Computed once
         // for the three revision-append sites and the rejected-note fallback below, so the
         // get-or-default idiom cannot drift between them.
         const lastReviewOrEmpty = s.lastReview ?? { reasons: [] };
         const revisionNote = buildRevisionNote(lastReviewOrEmpty, round);
         if (resuming || handoff) {
             // The interrupted revision run's applied edits are still in the worktree (both the
-            // resume and the cross-agent handoff keep uncommitted work), so this tick still owns
+            // resume and the cross-agent handoff keep uncommitted work), so this run still owns
             // the revision. A handoff runs the revision in a fresh session rather than
             // re-cherry-picking it onto the already-dirty worktree.
             revisionRound = round;
             if (handoff) {
                 // A handoff is a FRESH session: it has none of the interrupted run's context, and
-                // tick-prompt.ts suppresses the rejected-review note whenever state.revision is set,
+                // run-prompt.ts suppresses the rejected-review note whenever state.revision is set,
                 // so without this the fresh run would see neither the objections nor the revision
                 // instructions. A resume keeps its session context and must not see the note twice.
-                prompt = appendPromptNote(prompt, revisionNote);
+                prompt = prependPromptNote(prompt, revisionNote);
             }
         }
         else if (await applyRevision(wt, ctx.mainBranch, sha)) {
             revisionRound = round;
             logEventBestEffort(ctx.root, { source: ctx.role, type: "revision", action: "applied", round, sha });
-            prompt = appendPromptNote(prompt, revisionNote);
+            prompt = prependPromptNote(prompt, revisionNote);
         }
         else {
             // The clean re-apply conflicted: re-apply with the markers left in place so the author
@@ -523,19 +569,19 @@ leasedDir) {
                     reason: "revision",
                     conflicted: withConflicts.conflicted,
                 });
-                prompt = appendPromptNote(prompt, revisionNote);
+                prompt = prependPromptNote(prompt, revisionNote);
                 prompt = await appendHandbackNote(prompt, wt, ctx.mainBranch, sha, "revision", withConflicts.conflicted);
             }
             else {
                 s.revision = undefined;
                 await deleteRef(ctx.root, rejectedRefName(ctx.role));
                 logEventBestEffort(ctx.root, { source: ctx.role, type: "revision", action: "conflict", round, sha });
-                prompt = appendPromptNote(prompt, buildRejectedReviewNote(lastReviewOrEmpty, ctx.role));
+                prompt = prependPromptNote(prompt, buildRejectedReviewNote(lastReviewOrEmpty, ctx.role));
                 prompt = appendPromptNote(prompt, "The rejected diff no longer applies to current main.");
             }
         }
     }
-    // A handoff runs a FRESH session over the interrupted tick's kept worktree. When that tick had
+    // A handoff runs a FRESH session over the interrupted run's kept worktree. When that run had
     // already applied a conflict hand-back, the marker-bearing files are still there but the fresh
     // run has none of the interrupted session's context explaining them, so re-send the hand-back
     // note (a resume keeps its session context and must not see the note twice). The revision
@@ -547,101 +593,33 @@ leasedDir) {
         const conflicted = await markerBearingFiles(wt);
         prompt = await appendHandbackNote(prompt, wt, ctx.mainBranch, hb.sha, hb.reason, conflicted);
     }
-    const tickBase = await headOf(wt, "HEAD");
+    const runBase = await headOf(wt, "HEAD");
+    // The stray-write warning only reports, so a `git status` that fails on either side skips it.
+    const primaryBefore = await changedFiles(ctx.root).catch(() => null);
     const pi = await ctx.pi.runAuthoringPi(wt, prompt, `tumwater-${ctx.role}-${s.runs}`, resuming, cfg);
-    // The harness owns every commit (INV-H1): fold any the agent made into the tick's one commit.
-    await foldAgentCommitsSince(ctx, wt, tickBase);
+    // The harness owns every commit (INV-H1): fold any the agent made into the run's one commit.
+    await foldAgentCommitsSince(ctx, wt, runBase);
+    // A write that landed in the primary checkout never reaches the worktree's commit, so the run
+    // can read as no_change with its work orphaned (BUGS.md, 2026-10-20). The before/after diff
+    // cannot attribute paths to this run when roles overlap, so only warn: the verdict, resume
+    // handling and model-fallback fold below stay as they were.
+    const primaryAfter = primaryBefore === null ? null : await changedFiles(ctx.root).catch(() => null);
+    const strayed = primaryAfter === null ? [] : primaryAfter.filter((f) => !primaryBefore.includes(f));
+    if (strayed.length > 0 && !pi.aborted) {
+        const shown = strayed.slice(0, 10).join(", ") + (strayed.length > 10 ? `, … (${strayed.length} paths)` : "");
+        ctx.warn(`wrote outside the worktree (possibly another writer's): ${shown}`);
+    }
     // Fold the authoring run's verdict into the role's model-fallback episode NOW, before the
     // post-run handlers spend any more pi runs: only this run is evidence about the primary.
     ctx.foldModelFallback(fallbackCtx, pi);
     // The `qa` observer's reply ends with a result-carrying `FLOW:` line (plans/observer-roles.md
     // 2/2). Extracted once here, recorded only at the success returns below — an interrupted or
-    // failed tick must not advance the rotation. The harness records it, never pi.
+    // failed run must not advance the rotation. The harness records it, never pi.
     const flow = ctx.baseRole === "qa" ? extractFlow(pi.finalText) : null;
-    return handlePiResultPhase(ctx, pi, userPrompt, revisionRound, wt, flow, piStartedAt, cfg);
-}
-/** Merge the worktree branch on main (see src/merge/merge-to-main.ts for the
- * rebase → verify → ff-merge → conflict-retry flow): delegates with the loop identity, tick
- * number, and shared pi wiring so a conflict-resolution run folds into this tick's counters
- * like any other pi run. Only the refusal-note merge (src/verdict/refusal.ts) still uses it —
- * reviewed changes merge through the merge pipeline's leased verification slot instead; md-only
- * notes are review-exempt by construction, so they keep this branch path (plans/merge-queue.md
- * 2/5). */
-async function mergePhase(ctx, wt, summary) {
-    return mergeToMain({
-        root: ctx.root,
-        role: ctx.role,
-        mainBranch: ctx.mainBranch,
-        exemptPaths: ctx.config.review.exemptPaths,
-        config: ctx.config,
-        tick: ctx.state.runs,
-        runPi: (w, prompt, sessionName, config) => ctx.pi.runRolePi(w, prompt, sessionName, false, config),
-    }, wt, summary);
-}
-/** Turn a finished pi run into its TickOutcome: the post-run half of runTick, split off so each
- * half reads on its own screen — the setup above ends at the pi return. The verdict
- * classification (abort, config request, quiet kill, timeout, refusal, failure, no-change) lives
- * in resolveTickVerdict (src/tick/tick-verdict.ts), and the fulfillable path — staging —
- * stays here. `userPrompt` is the raw director prompt this tick is executing (null for role
- * loops) so unfulfilled outcomes can re-queue it; `revisionRound` is the revision this tick holds
- * (undefined when it is not a revision); `flow` is the qa observer's FLOW line (null for every
- * other role). */
-export async function handlePiResultPhase(ctx, pi, userPrompt, revisionRound, wt, flow, piStartedAt, cfg) {
-    // Everything that decides the run left nothing mergeable — abort, config request,
-    // quiet kill, timeout, refusal, failure without changes, no change — lives in
-    // resolveTickVerdict (src/tick/tick-verdict.ts); null means the run IS fulfillable.
-    const verdict = await resolveTickVerdict({
-        root: ctx.root,
-        role: ctx.role,
-        mainBranch: ctx.mainBranch,
-        state: ctx.state,
-        pending: ctx.pending,
-        turns: ctx.usage.turns,
-        userPrompt,
-        revisionRound,
-        wt,
-        pi,
-        flow,
-        // The image-reroute arm resolves its target from the live config and the current
-        // regime, and names the model this tick ran on as the handoff's `from`.
-        config: ctx.config,
-        rerouteRegime: ctx.rerouteRegime(piStartedAt),
-        runModel: cfg.model,
-        warn: (message) => ctx.warn(message),
-        merge: (w, sum) => mergePhase(ctx, w, sum),
-        finishAbortedTick: () => ctx.finishAbortedTick(userPrompt, wt),
-    });
-    if (verdict)
-        return verdict;
-    // The commit is pinned and the worktree is free (src/tick/tick-stage.ts): stage it for the
-    // merge queue and END the tick — the orchestrator drains the queue on its single merge
-    // slot, outside the author semaphore, so this slot is free the moment the work is
-    // committed (plans/merge-queue.md 3/5). Staging derives the commit message from the reply's
-    // SUMMARY block (one bounded follow-up turn when the run left none), flags high-friction
-    // ticks, pins the commit by the role's merge ref BEFORE freeing the worktree (invariant
-    // 4 — a failed pin defers to next-tick recovery), and enqueues the merge, which runs the
-    // same gate + merge flow through runMergePi/foldMergeUsage on this same state object
-    // — recording the commit count, the outcome, and the reviewer spend into it — and logs
-    // merge_done/merge_failed; a non-terminal outcome keeps the pin for next-tick leftover recovery.
-    // `commits` was NOT incremented above: it counts merged changes only.
-    return stageTickMerge({
-        root: ctx.root,
-        role: ctx.role,
-        state: ctx.state,
-        config: ctx.config,
-        tickTurns: ctx.usage.turns,
-        userPrompt,
-        revisionRound,
-        mainBranch: ctx.mainBranch,
-        wt,
-        finalText: pi.finalText,
-        flow,
-        piStartedAt,
-        warn: (message) => ctx.warn(message),
-        requestSummary: (w, n) => ctx.pi.requestSummary(w, cfg, n),
-        stageCheck: (w) => stageCheckFindings(w, ctx.mainBranch, ctx.config.review.exemptPaths, ctx.role),
-        requestStageFix: (w, findings) => ctx.pi.requestStageFix(w, findings, cfg),
-        pinAndReset: (w, sha) => ctx.pinAndReset(w, sha),
-        finishAbortedTick: () => ctx.finishAbortedTick(userPrompt, wt),
-    });
+    // The `feedback` observer's reply ends with a result-carrying `FILED: #<n> — <title>` line
+    // (plans/feedback-role.md 2/2). Extracted once here, recorded only at the success returns
+    // below — an interrupted or failed run must not record a filing it never declared. The
+    // harness records it, never pi.
+    const filed = ctx.baseRole === "feedback" ? extractFiled(pi.finalText) : null;
+    return handlePiResultPhase(ctx, pi, userPrompt, revisionRound, wt, flow, filed, piStartedAt, cfg);
 }