tumwater 0.2.0 → 0.3.0

package/dist/src/gates/gate-polls.js

@@ -1,4 +1,5 @@
-import { gateRoleConfig, newBudgetGateState, pollBudgetGate, tickOnPair, } from "./budget-gates.js";
+import { gateRoleConfig, newBudgetGateState, pollBudgetGate, runOnPair, subscriptionBackendOf, } from "./budget-gates.js";
+import { backendsInUse } from "./startup-gate.js";
 import { fallbackDemotion } from "../budget/fallback-breaker.js";
 import { newPauseGateState, pollPauseGates } from "./pause-gates.js";
 import { newStreakGateState, pollStreakGate } from "./streak-gate.js";
@@ -7,18 +8,18 @@ import { newMaintenanceQuotaGateState, pollMaintenanceQuotaGate, } from "./maint
 import { newBootstrapGateState, pollBootstrapGate, } from "./bootstrap-gates.js";
 import { newQuietHoursGateState, pollQuietHoursGate, roleQuietHold, } from "../scheduling/quiet-hours.js";
 import { BYTES_PER_GB, newDiskGateState, pollDiskGate, sampleFreeBytes, } from "./disk-gate.js";
-import { pollErrorStorm, pollFailureSpread, pollTeamHold, pollClaudeWindowWarning, pollClaudeWindowReserve } from "../team/team-polls.js";
-import { readClaudeAccount } from "../agent/claude/claude-account.js";
+import { pollErrorStorm, pollFailureSpread, pollTeamHold, pollClaudeWindowWarning, pollClaudeWindowReserve, windowObservation } from "../team/team-polls.js";
+import { readAccount } from "../agent/subscription-account.js";
 import { standingHolds } from "../team/team-hold.js";
 import { ERROR_STORM_QUIET } from "../team/error-storm.js";
 import { FAILURE_SPREAD_QUIET } from "../team/failure-spread.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
-import { baseRoleOf, instancePauseKey, loopEnabled } from "../roles/loop-ids.js";
+import { baseRoleOf, instancePauseKey, runnerEnabled } from "../roles/runner-ids.js";
 import { queuedMergeRoles } from "../merge/merge-queue.js";
 import { MODEL_TIERS } from "../config/config-schema.js";
 import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { publishInfoFields } from "../team/orchestrator-info.js";
-import { roleSeamTier } from "../config/config-views.js";
+import { configForRole, roleSeamTier, windowReserveFor, withModelOverrides } from "../config/config-views.js";
 /** A fresh gate family: nothing seen yet, so the first poll of an unpaused, unheld team
  * logs nothing. The budget gate seeds its breaker and derived fallback view from the
  * startup config; a live reload replaces the config on the next poll. */
@@ -33,8 +34,8 @@ export function newTeamGateStates(config) {
         quiet: newQuietHoursGateState(),
         disk: newDiskGateState(),
         teamHold: new Map(),
-        claudeWindowWarned: null,
-        claudeWindowReserved: null,
+        claudeWindowWarned: new Set(),
+        claudeWindowReserved: new Set(),
         errorStorm: ERROR_STORM_QUIET,
         failureSpread: FAILURE_SPREAD_QUIET,
     };
@@ -42,11 +43,16 @@ export function newTeamGateStates(config) {
 /** Poll every team-wide gate and alarm, advancing `states` in place. */
 export function pollTeamGates(states, ctx) {
     const { root, runners, liveConfig, modelsPath, now, info } = ctx;
+    // The per-backend subscription account lookup (part 2e/9): each backend's account is read on
+    // demand — the window hold/reserve/warning loop, the window-move and the handback reads each
+    // call accounts fresh — so a second subscription backend is judged from its own account, never
+    // from claude's.
+    const accounts = (backend) => readAccount(root, backend, now);
     // Daily cost budget gate (src/gates/budget-gates.ts owns the reads, the edge-triggered
     // budget_* events, the breaker re-key, and the fallback config view): the orchestrator
     // owns only the wiring — the demotion publish below and the per-runner assignment at
     // the bottom of this block.
-    const { gate, roleConfig, spentUsd, capUsd, onFallback, resumed: gateResumed, pairs: fallbackPairs, priceResolved, servingResolved, budgetActive, windowTiers, windowResumed, directorConfig, chain, } = pollBudgetGate(states.budget, {
+    const { gate, roleConfig, spentUsd, capUsd, onFallback, resumed: gateResumed, pairs: fallbackPairs, priceResolved, servingResolved, budgetActive, windowTiers, windowResumedBackends, directorConfig, chain, } = pollBudgetGate(states.budget, {
         root,
         states: runners.map((r) => r.state),
         liveConfig,
@@ -54,7 +60,7 @@ export function pollTeamGates(states, ctx) {
     });
     // Publish what observers cannot derive themselves: every pair's demotion — a per-tier
     // fallback can demote a pair the legacy single `fallback` never names, and a dashboard that
-    // only sees the engaged pair's verdict would show a tier's roles ticking while the
+    // only sees the engaged pair's verdict would show a tier's roles running while the
     // scheduler holds them (part 5c/8) — plus the engaged pair's own (the legacy
     // `fallbackDemoted` field, what `tumwater doctor` and the failure digest read) and the
     // gate's own spend/cap pair — summed over the runners' live states, which every
@@ -92,26 +98,42 @@ export function pollTeamGates(states, ctx) {
     // The director keeps the live config — an explicit human prompt outranks the
     // autonomous-spend cap (gateRoleConfig). Assigned every poll (not only on transitions)
     // so a runner created mid-gate, or one left behind by a broken-file poll that skipped
-    // the reload, can never tick on the wrong model.
+    // the reload, can never run on the wrong model.
     for (const r of runners) {
         r.config = gateRoleConfig(r.role, liveConfig, roleConfig, directorConfig);
         // An image reroute must never spend past the daily cap: while the gate has the team on
         // its free fallback pairs, a reroute looks only among those pairs (plans/image-input.md
         // "Reroute target" "Regime"). Set beside the config assignment so the scheduler's regime
-        // and the loops' never disagree.
+        // and the roles' never disagree.
         r.budgetFallbackActive = onFallback;
     }
-    // The budget reopened: a tick that started on a fallback pair keeps it until it ends, so hand
-    // those ticks back — abort them resumably (session and worktree edits kept) and let their next
-    // tick continue the same session on the primary, whose config the assignment above already
+    // The budget reopened: a run that started on a fallback pair keeps it until it ends, so hand
+    // those runs back — abort them resumably (session and worktree edits kept) and let their next
+    // run continue the same session on the primary, whose config the assignment above already
     // installed (PLANS.md 2026-09-30). Per-tier fallbacks put different roles on different pairs
     // (part 5c/8), so the match runs over EVERY pair the price-based resolution hands out, not only
-    // one. A tick started on the primary keeps running, the director is exempt, and the merges (the
+    // one. A run started on the primary keeps running, the director is exempt, and the merges (the
     // slot's own runs) are untouched. One event per pair names who was handed back, so the resulting
-    // aborted ticks read as the budget reopening, not as unexplained failures. The subscription
+    // aborted runs read as the budget reopening, not as unexplained failures. The subscription
     // window reset (below the cap): the same hand-back for the pairs the window move used. A window
     // that resets while the cap still holds hands back nothing.
-    const handBack = gateResumed || (windowResumed && !budgetActive);
+    const handBack = gateResumed || (windowResumedBackends.length > 0 && !budgetActive);
+    // The window handback names the backend whose window resumed (the entry's goal) — not the
+    // handed-back pair's own backend: for claude-only the fallback pair carries no backend (it would
+    // read undefined), and with two subscription backends it would name the opposite one. A pair
+    // belongs to those resumed backends whose tiers' price-resolved pair it is.
+    const resumedBackendSet = new Set(windowResumedBackends);
+    const resumedBackendForPair = (leftPair) => {
+        for (const tier of MODEL_TIERS) {
+            const p = priceResolved[tier]?.pair;
+            if (p && p.provider === leftPair.provider && p.model === leftPair.model) {
+                const b = subscriptionBackendOf(withModelOverrides(liveConfig, tier, {}), accounts);
+                if (b !== null && resumedBackendSet.has(b))
+                    return b;
+            }
+        }
+        return undefined;
+    };
     if (handBack && fallbackPairs.length > 0) {
         // A cap reopen while the window is still used up leaves the window's tiers on their
         // fallback pairs: handing those runs back would abort them to restart on the same pair.
@@ -122,7 +144,7 @@ export function pollTeamGates(states, ctx) {
         for (const leftPair of fallbackPairs) {
             if (stillMoved.some((p) => p.provider === leftPair.provider && p.model === leftPair.model))
                 continue;
-            const matching = runners.filter((r) => r.role !== DIRECTOR_ROLE && tickOnPair(r.tickModel(), leftPair));
+            const matching = runners.filter((r) => r.role !== DIRECTOR_ROLE && runOnPair(r.runModelPair(), leftPair));
             if (matching.length > 0) {
                 logEventBestEffort(root, {
                     source: TUMWATER_SOURCE,
@@ -130,10 +152,12 @@ export function pollTeamGates(states, ctx) {
                     roles: matching.map((r) => r.role),
                     provider: leftPair.provider,
                     model: leftPair.model,
-                    ...(gateResumed ? {} : { reason: "window" }),
+                    ...(gateResumed
+                        ? {}
+                        : { reason: "window", backend: resumedBackendForPair(leftPair) }),
                 });
                 for (const r of matching)
-                    r.handBackTick();
+                    r.handBackRun();
             }
         }
     }
@@ -142,7 +166,7 @@ export function pollTeamGates(states, ctx) {
     // set, both read fresh per cycle so a marker change takes effect on the next poll.
     const { userPaused, pausedRoles } = pollPauseGates(root, states.pause);
     // The error-streak circuit breaker (src/gates/streak-gate.ts): a role past ERROR_STREAK_BREAKER
-    // consecutive failed ticks is paused through the same per-role marker the operator's
+    // consecutive failed runs is paused through the same per-role marker the operator's
     // `pause --role` writes — act-on-it where the warn bar and the storm alarms only talk. The
     // director is not exempt; a failing director cannot process prompts anyway. Roles it just
     // paused fold into this poll's paused-roles view, so the scheduler blocks them on this very
@@ -157,22 +181,36 @@ export function pollTeamGates(states, ctx) {
         states.pause.prevPausedRoles.add(role);
     const pausedRolesNow = streakPaused.length > 0 ? new Set([...pausedRoles, ...streakPaused]) : pausedRoles;
     // The per-tier budget pause (part 5c/8): a role whose model tier resolved to no usable free
-    // pair while the cap is reached starts no new ticks — the stateless verdict recomputed every
+    // pair while the cap is reached starts no new runs — the stateless verdict recomputed every
     // poll from the SAME resolution the gate's value came from, beside `capPaused` (the
     // scheduling pass folds the sets; the director is exempt, as under every autonomous gate).
     // The demoted pair's probe pierces the set for its own tier's roles only — probeRoles in the
     // orchestrator's scheduling pass.
     const budgetPausedRoles = new Set();
-    if (budgetActive) {
-        for (const r of runners) {
-            if (r.role === DIRECTOR_ROLE)
-                continue;
-            if (servingResolved[roleSeamTier(liveConfig, r.role)].pair === null)
-                budgetPausedRoles.add(r.role);
-        }
+    const windowMovedRoles = new Set();
+    const movedTiers = Object.keys(windowTiers);
+    // The backend whose used-up window moved a given tier: the tier's own seam's backend — the same
+    // read budget-gates made to put it in `windowTiers`. A role on a moved tier whose own backend is
+    // DIFFERENT (a healthy backend riding the same tier) keeps its pair: only the role whose own
+    // backend owns the out window is moved.
+    const tierMovedBackend = (tier) => subscriptionBackendOf(withModelOverrides(liveConfig, tier, {}), accounts);
+    for (const r of runners) {
+        if (r.role === DIRECTOR_ROLE)
+            continue;
+        const tier = roleSeamTier(liveConfig, r.role);
+        // A role pinned to the moved tier's own subscription backend keeps it through the window move
+        // (it is not on a pair); a role on the same tier pinning a healthy backend does not.
+        if (movedTiers.includes(tier) &&
+            subscriptionBackendOf(configForRole(liveConfig, r.role), accounts) === tierMovedBackend(tier))
+            windowMovedRoles.add(r.role);
+        // Below the cap only a window-moved role can sit on a demoted fallback.
+        if (!budgetActive && !windowMovedRoles.has(r.role))
+            continue;
+        if (servingResolved[tier].pair === null)
+            budgetPausedRoles.add(r.role);
     }
-    // The per-role daily cost cap (src/gates/role-cap-gates.ts): a loop whose local-day spend has
-    // reached its own maxDailyCostUsdPerRole entry starts no new ticks — the stateless verdict
+    // The per-role daily cost cap (src/gates/role-cap-gates.ts): a role whose local-day spend has
+    // reached its own maxDailyCostUsdPerRole entry starts no new runs — the stateless verdict
     // recomputed every poll, no pause marker written (the marker is anonymous; a cap pause must
     // never masquerade as an operator's), so this returns its own set beside pausedRoles and the
     // pause gates' edge bookkeeping never sees it. A live config edit applies on the next poll;
@@ -180,27 +218,26 @@ export function pollTeamGates(states, ctx) {
     const capPaused = pollRoleCapGate(root, states.cap, runners, liveConfig.maxDailyCostUsdPerRole, now);
     // The maintenance allowance (plans/work-ratio.md, part 1b/4): code-maintenance merges in a
     // rolling 24 h window are capped at `maintenancePerWorkMerge × work + MAINTENANCE_DAILY_FLOOR`.
-    // The gate counts the window, adds the maintenance loops already in flight (running a tick or
+    // The gate counts the window, adds the maintenance roles already in flight (running or
     // holding a queued merge, so six concurrent permits cannot overshoot), and logs the one
-    // hold/resume event per transition. Enabled only: a disabled loop runs no tick to count. The
-    // scheduling pass spends the returned headroom one due maintenance loop at a time, beside
+    // hold/resume event per transition. Enabled only: a disabled role has no runs to count. The
+    // scheduling pass spends the returned headroom one due maintenance role at a time, beside
     // capPaused, with the fresh-wake/queued-prompt override the need-based deferral honors.
     const queuedRoles = queuedMergeRoles(root);
     const maintenanceQuota = pollMaintenanceQuotaGate(root, states.quota, runners.map((r) => ({
         role: r.role,
-        enabled: loopEnabled(r.config, r.role),
+        enabled: runnerEnabled(r.config, r.role),
         running: r.state.running === true,
         hasQueuedMerge: queuedRoles.has(r.role),
     })), liveConfig.maintenancePerWorkMerge, now);
     // New-project bootstrap (src/gates/bootstrap-gates.ts, plans/work-ratio.md part 2/2): a fresh
-    // project's maintenance loops start no new ticks until `bootstrap.untilPlansDone` plans are
+    // project's maintenance roles start no new runs until `bootstrap.untilPlansDone` plans are
     // Done. The gate owns the latch write and the one `bootstrap_complete` event; the scheduling
     // pass folds the held set in beside capPaused (with the fresh-wake/queued-prompt override the
     // need-based deferral honors).
     const bootstrapHeld = pollBootstrapGate(root, states.bootstrap, runners, liveConfig, now);
-    const bootstrapActive = states.bootstrap.active;
     // Per-role quiet hours (src/scheduling/quiet-hours.ts): a role whose own quietHoursPerRole window
-    // covers `now` starts no new ticks — the team window's semantics scoped to one loop, the
+    // covers `now` starts no new runs — the team window's semantics scoped to one role, the
     // director exempt like every autonomous gate. Stateless, recomputed per poll exactly like
     // capPaused: no crossing events, no state — a live config edit applies on the next poll
     // by construction. A role held by BOTH windows is held once: the scheduling pass folds
@@ -213,9 +250,9 @@ export function pollTeamGates(states, ctx) {
             roleQuietHeld.add(r.role);
     }
     // Quiet hours (src/scheduling/quiet-hours.ts): the config-driven daily local-time window during
-    // which role loops start no new ticks — the operator pause's semantics on a schedule.
+    // which roles start no new runs — the operator pause's semantics on a schedule.
     // The config value is read fresh per cycle, so a live edit applies on the next poll;
-    // exactly one quiet_hours_started/ended event per crossing. In-flight ticks finish;
+    // exactly one quiet_hours_started/ended event per crossing. In-flight runs finish;
     // the gate folds into the same hold site as the pause gates.
     const quietNow = pollQuietHoursGate(root, liveConfig.quietHours, states.quiet, new Date(now));
     const freeBytes = (ctx.sampleFree ?? sampleFreeBytes)(root);
@@ -245,7 +282,7 @@ export function pollTeamGates(states, ctx) {
         };
     publishInfoFields(root, info, [["disk", disk]]);
     // Each runner as the two provider-failure polls read it (HoldInputs): the role, its two
-    // episodic fields, and the provider its NEXT tick will run on (runProvider — the tier
+    // episodic fields, and the provider its NEXT run will run on (runProvider — the tier
     // fallback pair while a model-fallback episode is active, else the role's resolved config;
     // undefined when pi's default is in charge). Built ONCE per poll so the hold and the spread
     // read the same list, like holdObservations on the reducer side. Keying on the effective
@@ -253,7 +290,7 @@ export function pollTeamGates(states, ctx) {
     // primary stays clear (PLANS.md "Model failure fallback, part 1/2").
     //
     // Each stamp (lastRateLimit/lastBackendFailure) carries the hold key of the backend that
-    // ACTUALLY failed — a reviewer run folded through the author's loop stamps `claude`, not
+    // ACTUALLY failed — a reviewer run folded through the author's role stamps `claude`, not
     // the pi author's provider — and the polls' observation mapper files each stamp under that
     // key, falling back to runProvider here for a stamp without one (PLANS.md "Mixed claude +
     // pi fleets, part 2/4"). The spreads below carry the stamps wholesale, provider included.
@@ -265,24 +302,32 @@ export function pollTeamGates(states, ctx) {
     }));
     // Team-wide failure hold, per provider (src/team/team-hold.ts, PLANS.md 2026-10-05): once two
     // roles' runs have ended on the SAME provider AND failure kind within a short window — 429s, or a
-    // connection, timeout, 5xx, or model-load backend failure — role loops on THAT provider start no
-    // new ticks, and the merge queue starts no new verify, whose reviewer run has no retry and would
+    // connection, timeout, 5xx, or model-load backend failure — roles on THAT provider start no
+    // new runs, and the merge queue starts no new verify, whose reviewer run has no retry and would
     // spend a review strike on the storm — until the hold re-opens at its own deadline (Retry-After
     // honored on the rate-limit kind, doubling on a relapse, capped). Roles on a healthy provider
-    // keep ticking; a hold on the reviewer's provider (with the review gate on) still blocks
+    // keep running; a hold on the reviewer's provider (with the review gate on) still blocks
     // everything, since nothing could merge — the orchestrator's scheduling and start passes derive
-    // that verdict from this map. The director's ticks are exempt, as under the budget gate and the
+    // that verdict from this map. The director's runs are exempt, as under the budget gate and the
     // operator pause: an explicit human prompt outranks an autonomous gate, one director run is not
     // the concurrency that sustains a storm, its 429 runs keep the per-run transient retry
-    // (backend-failure kinds ride this hold alone), and a prompt its tick fails to fulfill goes back
-    // to the inbox. In-flight ticks finish; NEW ticks are gated at scheduling like both siblings, and
-    // a role tick already parked in the semaphore meets the same hold at its permit (the start gate)
+    // (backend-failure kinds ride this hold alone), and a prompt its run fails to fulfill goes back
+    // to the inbox. In-flight runs finish; NEW runs are gated at scheduling like both siblings, and
+    // a role run already parked in the semaphore meets the same hold at its permit (the start gate)
     // and hands its reservation back instead of starting into the storm. The verdicts are written
     // back to states.teamHold — one hold per provider, lifted holds kept keyed for their relapse
     // memory but never reading as held — and the permit-time closures read the LATEST poll's map
     // there, so a waiter granted its permit after a later poll sees that poll's world.
-    const claudeAccount = readClaudeAccount(root, now);
-    states.teamHold = pollTeamHold(root, states.teamHold, holdInputs(runners), now, claudeAccount, windowTiers, liveConfig.claudeWindowReserve);
+    const windowAccountReads = backendsInUse(liveConfig).map((backend) => [backend, accounts(backend)]);
+    // The subscription-window hold, reserve and warning, read per backend in use (part 2e/9): a
+    // second subscription backend gets its own hold, reserve and warning memory keyed by its own
+    // `backend`, so claude's roles, hold and events are untouched by another backend's window.
+    // One account read per backend feeds both the hold observations and the reserve/warning polls;
+    // a backend whose account implies no hold contributes no observation.
+    const windowObservations = windowAccountReads
+        .map(([backend, account]) => windowObservation(backend, account, now, windowReserveFor(liveConfig, backend)))
+        .filter((o) => o !== null);
+    states.teamHold = pollTeamHold(root, states.teamHold, holdInputs(runners), now, windowObservations, windowTiers);
     // The standings hold, published for observers (PLANS.md 2026-10-17 "the dashboards and
     // `tumwater status` name a standing provider failure hold"): `standingHolds` turns the holds
     // map into the per-provider list the status snapshot and the alert banner name, the same
@@ -292,12 +337,17 @@ export function pollTeamGates(states, ctx) {
     publishInfoFields(root, info, [
         ["providerHolds", providerHolds.length > 0 ? providerHolds : undefined],
     ]);
-    states.claudeWindowReserved = pollClaudeWindowReserve(root, states.claudeWindowReserved, claudeAccount, now, liveConfig.claudeWindowReserve);
-    // The subscription usage window's warning is observational (the hold above is the gate): the
-    // first allowed_warning logs once per window, and the memory lives beside the holds map.
-    states.claudeWindowWarned = pollClaudeWindowWarning(root, states.claudeWindowWarned, claudeAccount, now);
-    // Team-wide error-storm warning (src/team/error-storm.ts): when several roles' tick streaks
-    // fail consecutively on one shared cause, each role's own "consecutive tick failures"
+    // The reserve and warning polls, one per subscription backend in use: each logs its own
+    // events keyed by its own backend (the `backend:type:resetsAt` keys), so claude's own reserve
+    // and warning memory is unaffected by another backend's crossings (part 2e/9).
+    for (const [backend, account] of windowAccountReads) {
+        states.claudeWindowReserved = pollClaudeWindowReserve(root, states.claudeWindowReserved, account, now, backend, windowReserveFor(liveConfig, backend));
+        // The subscription usage window's warning is observational (the hold above is the gate): the
+        // first allowed_warning logs once per window, and the memory lives beside the holds map.
+        states.claudeWindowWarned = pollClaudeWindowWarning(root, states.claudeWindowWarned, account, now, backend);
+    }
+    // Team-wide error-storm warning (src/team/error-storm.ts): when several roles' run streaks
+    // fail consecutively on one shared cause, each role's own "consecutive run failures"
     // warning still fires alone — this adds the one team-level warning that names the
     // cause (and the config knob, when the cause has one) instead of leaving the operator
     // to diff 14 streak lines. Observational only: it gates nothing, so unlike the failure
@@ -319,11 +369,11 @@ export function pollTeamGates(states, ctx) {
         capPaused,
         maintenanceQuota,
         bootstrapHeld,
-        bootstrapActive,
         budgetPausedRoles,
         servingResolved,
         priceResolved,
         budgetActive,
+        windowMovedRoles,
         roleQuietHeld,
         quietNow,
         diskHeld,

package/dist/src/gates/maintenance-quota.js

@@ -2,7 +2,7 @@
  * setting, and the gate behind the maintenance allowance — code-maintenance merges in a rolling
  * 24 h window are capped at `maintenancePerWorkMerge × work merges + MAINTENANCE_DAILY_FLOOR`, and
  * `pollMaintenanceQuotaGate` puts that verdict in front of the scheduler so the enabled maintenance
- * loops stop starting new ticks past it.
+ * roles stop starting new runs past it.
  *
  * The window counts `merged` events by `commitTier` (src/roles/roles.ts): feature/bugfix/director
  * are the work count, the code-maintenance roles plus readme the maintenance count, and every other
@@ -16,21 +16,21 @@
  * The verdict is pure and lives here beside the count so the scheduler and every status reader
  * share one definition; `pollMaintenanceQuotaGate` is the one writer (the edge-triggered events)
  * and the one reader the scheduler holds from. */
-import { sameStatIdentity, statOrNull } from "../files/files.js";
+import { sameStatIdentity, statIdentityOrZero, statOrNull } from "../files/files.js";
 import { readCompleteLines } from "../files/tail.js";
 import { eventsLogPath } from "../paths.js";
 import { readWindowEvents } from "../events/event-window.js";
 import { eventRole, parseEventLine } from "../events/event-read.js";
 import { finiteNumber } from "../files/json-object.js";
-import { dayKey } from "../text/datetime.js";
+import { dayKey, DAY_MS } from "../text/datetime.js";
 import { commitTier } from "../roles/roles.js";
-import { baseRoleOf } from "../roles/loop-ids.js";
+import { baseRoleOf } from "../roles/runner-ids.js";
 import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 /** The fixed test-independent part of the allowance: a project whose backlog is empty still gets
  * this many maintenance merges in a rolling day, so hygiene never stops entirely. */
 export const MAINTENANCE_DAILY_FLOOR = 12;
 /** The rolling window length: 24 h in ms. */
-const MAINTENANCE_WINDOW_MS = 24 * 60 * 60 * 1000;
+const MAINTENANCE_WINDOW_MS = DAY_MS;
 /** The pure allowance verdict: `allowance = perWorkMerge × work + MAINTENANCE_DAILY_FLOOR`;
  * `used = maint + inFlight`; held while `used >= allowance`. No I/O — the counts and the
  * in-flight figure come from the caller, so the same verdict serves the scheduler and the
@@ -95,13 +95,13 @@ function seed(counter, root, cutoff, stat) {
 export function newMaintenanceQuotaGateState() {
     return { counter: newMaintenanceWindowCounter(), prevHeld: false };
 }
-/** Step the gate by one orchestrator poll: count the rolling window, add the maintenance loops in
+/** Step the gate by one orchestrator poll: count the rolling window, add the maintenance roles in
  * flight, and put 1a's verdict in front of the scheduler. Returns the verdict — `allowance`, `used`
- * (merged maintenance plus the loops already in flight), and `held` (`used >= allowance`) — for the
+ * (merged maintenance plus the roles already in flight), and `held` (`used >= allowance`) — for the
  * scheduling pass's per-poll admission: it spends the remaining `allowance - used` headroom one due
- * maintenance loop at a time, so two due loops cannot start in the same poll. Logs exactly one
+ * maintenance role at a time, so two due roles cannot start in the same poll. Logs exactly one
  * team-level `maintenance_quota_hold` when the gate goes from open to held and one
- * `maintenance_quota_resumed` when it re-opens — never one per loop. The director is never
+ * `maintenance_quota_resumed` when it re-opens — never one per role. The director is never
  * maintenance-tier, so no exemption is needed. */
 export function pollMaintenanceQuotaGate(root, state, observers, perWorkMerge, now) {
     const { work, maint } = countMaintenanceWindow(root, state.counter, now);
@@ -150,10 +150,7 @@ export function countMaintenanceWindow(root, counter, now) {
     // mid-poll (replaced between the stat and the read), so the folding itself is guarded too.
     const stat = statOrNull(eventsLogPath(root));
     const readable = stat?.isFile() ? stat : null;
-    const size = readable?.size ?? 0;
-    const mtimeMs = readable?.mtimeMs ?? 0;
-    const dev = readable?.dev ?? 0;
-    const ino = readable?.ino ?? 0;
+    const { size, mtimeMs, dev, ino } = statIdentityOrZero(readable);
     const unchanged = sameStatIdentity({ dev, ino, mtimeMs, size }, { dev: counter.dev, ino: counter.ino, mtimeMs: counter.mtimeMs, size: counter.offset });
     if (readable) {
         try {

package/dist/src/gates/pause-gates.js

@@ -3,7 +3,7 @@
  * reads, the edge-triggered pause/resume events, and the cross-poll bookkeeping are one concern
  * beside the other team gates (src/budget/budget.ts's budget gate, src/team/team-hold.ts's team
  * hold) — the orchestrator owns only the wiring. */
-import { isTeamPaused, pausedRoles } from "../team/team-state.js";
+import { standingRolePause, standingTeamPause } from "../team/team-state.js";
 import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 /** A fresh pause-gate state: nothing seen paused yet, so the first poll of an unpaused team
  * logs nothing. */
@@ -14,28 +14,46 @@ export function newPauseGateState() {
  * human intent instead of spend. The marker is persistent state (presence means paused until
  * `resume` removes it), so one existsSync per cycle reads it fresh. The director is exempt for
  * the same reason as under the budget gate — a human typing prompts outranks an operator gate
- * (queued prompts simply wait in the inbox if full silence is wanted). In-flight ticks finish;
- * only NEW ticks are blocked, because the gate sits before isEligible.
+ * (queued prompts simply wait in the inbox if full silence is wanted). In-flight runs finish;
+ * only NEW runs are blocked, because the gate sits before isEligible.
  *
  * Per-role pause (`tumwater pause --role <id>`): the operator pause's narrower sibling — the
- * same persistent marker read fresh per cycle, but one named loop instead of the team. Unlike
+ * same persistent marker read fresh per cycle, but one named role instead of the team. Unlike
  * the team pause the director is NOT exempt: the operator named the role deliberately, and its
  * queued prompts simply wait in the inbox (the same effect the team pause has on the director).
- * In-flight ticks finish; only NEW ticks are blocked (the gate sits before isEligible). */
+ * In-flight runs finish; only NEW runs are blocked (the gate sits before isEligible).
+ * A timed role pause's `role_paused` events carry its shared deadline as `until`:
+ * `standingRolePause` returns it only while the set is non-empty and an expired marker reads as
+ * empty, so a logged `until` is the live deadline. */
 export function pollPauseGates(root, state) {
-    const userPaused = isTeamPaused(root);
+    const marker = standingTeamPause(root);
+    const userPaused = marker !== null;
     if (userPaused !== state.prevUserPaused) {
-        logEventBestEffort(root, { source: TUMWATER_SOURCE, type: userPaused ? "team_paused" : "team_resumed" });
+        logEventBestEffort(root, marker
+            ? {
+                source: TUMWATER_SOURCE,
+                type: "team_paused",
+                ...(marker.until !== undefined ? { until: marker.until } : {}),
+                ...(marker.reason ? { reason: marker.reason } : {}),
+            }
+            : {
+                source: TUMWATER_SOURCE,
+                type: "team_resumed",
+                ...(state.prevTeamUntil !== undefined && state.prevTeamUntil <= Date.now() ? { expired: true } : {}),
+            });
         state.prevUserPaused = userPaused;
     }
-    const pausedRolesNow = pausedRoles(root);
+    state.prevTeamUntil = marker?.until;
+    const { roles: pausedRolesNow, until: rolesUntil } = standingRolePause(root);
+    const rolesExpired = state.prevRolesUntil !== undefined && state.prevRolesUntil <= Date.now();
     const pausedRolesSet = new Set(pausedRolesNow);
     for (const r of pausedRolesNow)
         if (!state.prevPausedRoles.has(r))
-            logEventBestEffort(root, { source: TUMWATER_SOURCE, type: "role_paused", role: r });
+            logEventBestEffort(root, { source: TUMWATER_SOURCE, type: "role_paused", role: r, ...(rolesUntil !== undefined ? { until: rolesUntil } : {}) });
     for (const r of state.prevPausedRoles)
         if (!pausedRolesSet.has(r))
-            logEventBestEffort(root, { source: TUMWATER_SOURCE, type: "role_resumed", role: r });
+            logEventBestEffort(root, { source: TUMWATER_SOURCE, type: "role_resumed", role: r, ...(rolesExpired ? { expired: true } : {}) });
     state.prevPausedRoles = pausedRolesSet;
+    state.prevRolesUntil = rolesUntil;
     return { userPaused, pausedRoles: pausedRolesSet };
 }

package/dist/src/gates/readiness.js

@@ -1,12 +1,16 @@
-// vocabulary: plain
 /** The repo preconditions' shared wording behind the readiness gate. startup-gate.ts answers
- * with the first unmet precondition (cmdRun and requireReadyRepo fail on it, the self-redeploy
+ * with the first unmet precondition (cmdStart and requireReadyRepo fail on it, the self-redeploy
  * refuses a swap on it) and doctor.ts reports each one individually, but every surface
  * describes the same problems — so the wording lives here once and cannot drift.
  * `GIT_MISSING_MESSAGE` (git/git-run.ts) is the sibling for a machine with no git binary; the
- * agent-binary preconditions (resolveAgentBin, findAgentBinary, piMissingMessage) live beside
+ * agent-binary preconditions (resolveBackendBin, findBackendBinary, piMissingMessage) live beside
  * the spawn in pi/pi-bin.ts. */
 export const NOT_A_REPO_MESSAGE = "not a git repository (run `git init` first)";
 export const NO_COMMITS_MESSAGE = "the repo has no commits yet; `tumwater init` creates the first one";
 export const DETACHED_HEAD_MESSAGE = "your checkout is detached; check out your main branch first";
 export const NOT_INITIALIZED_MESSAGE = "not initialized (run `tumwater init <prompt>` first — or a bare `tumwater init` when the project brief (TUMWATER.md or README.md) already carries the prompt)";
+/** What a command run inside a team workspace (`<root>/.tumwater/worktrees/<slot>`) says in place
+ * of NOT_INITIALIZED_MESSAGE: the workspace is no project of its own, the team root is. */
+export function teamWorkspaceMessage(teamRoot) {
+    return `this is a tumwater workspace of the team at ${teamRoot}, not a project — run tumwater from ${teamRoot} (\`cd ${teamRoot}\`)`;
+}

package/dist/src/gates/role-cap-gates.js

@@ -1,10 +1,10 @@
-/** The per-role daily cost cap (PLANS.md 2026-09-30, part 1/2): a loop whose local-day spend
- * has reached its own `maxDailyCostUsdPerRole` entry starts no new ticks until the next local
+/** The per-role daily cost cap (PLANS.md 2026-09-30, part 1/2): a role whose local-day spend
+ * has reached its own `maxDailyCostUsdPerRole` entry starts no new runs until the next local
  * day or a live config edit — so one runaway role cannot eat the team-wide cap and starve
- * every other loop for the rest of the day. The team budget gate (src/gates/budget-gates.ts)
+ * every other role for the rest of the day. The team budget gate (src/gates/budget-gates.ts)
  * bounds the SUM; this bounds each member. The stateless verdict follows that gate's own rule
  * (budgetPaused's doc: "resume is stateless, so … crossing midnight flips it on the next cycle
- * and nothing can get stuck"): the verdict is recomputed from the loop state every poll, no
+ * and nothing can get stuck"): the verdict is recomputed from the runner state every poll, no
  * marker is written, and local midnight lifts it by itself.
  *
  * Deliberate differences from the streak gate's shape (src/gates/streak-gate.ts), stated in
@@ -30,7 +30,7 @@ import { groupBy } from "../collections.js";
 import { budgetWarning, dailyCost, todayStamp } from "../budget/budget.js";
 import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
-import { baseRoleOf } from "../roles/loop-ids.js";
+import { baseRoleOf } from "../roles/runner-ids.js";
 /** The stateless verdict: is this role over its own per-role cap as of `now`? True iff a cap
  * is configured, it is a finite number above zero (0 disables that role's cap, like the team
  * cap), and today's spend has reached it. The role→cap lookup stays with the caller
@@ -44,9 +44,9 @@ export function roleCapPaused(state, cap, now = Date.now()) {
 /** The grouped, stateless per-role cap verdict — the single definition the scheduler's gate
  * (`pollRoleCapGate`) and the snapshot's `capPaused` observer (src/status/status-data.ts) both
  * fold, so the hold an operator sees cannot diverge from the one the scheduler enforces.
- * Instance loop ids share their base role's cap and its SUMMED spend (`feature` and `feature-2`
+ * Instance role ids share their base role's cap and its SUMMED spend (`feature` and `feature-2`
  * at $0.60 each cross a `maxDailyCostUsdPerRole.feature` cap of $1 together), and the director
- * is exempt. Keyed by base role in first-appearance order; each entry carries the group's loop
+ * is exempt. Keyed by base role in first-appearance order; each entry carries the group's role
  * ids so a caller can log the base (the gate) or flatten the ids (the observer). */
 export function roleCapVerdicts(runners, caps, now) {
     // Group by base role via the shared Map-of-arrays step (collections.groupBy, which
@@ -80,7 +80,7 @@ export function newRoleCapGateState() {
 export function pollRoleCapGate(root, state, runners, caps, now) {
     // Grouping and the verdict itself live in roleCapVerdicts, shared with the snapshot's
     // `capPaused` observer (src/status/status-data.ts) so the two cannot diverge. The returned
-    // set holds the paused loop ids so the scheduler can keep checking `capPaused.has(runner.role)`
+    // set holds the paused role ids so the scheduler can keep checking `capPaused.has(runner.role)`
     // unchanged.
     const verdicts = roleCapVerdicts(runners, caps, now);
     const paused = new Set();