tumwater 0.2.0 → 0.3.0

package/dist/src/gates/startup-gate.js

@@ -1,4 +1,3 @@
-// vocabulary: plain
 import fs from "node:fs";
 import path from "node:path";
 import { loadConfigSafe } from "../config/config.js";
@@ -6,11 +5,16 @@ import { seamsInUse } from "../config/config-fallbacks.js";
 import { findOnPath } from "../files/files.js";
 import { GIT_MISSING_MESSAGE } from "../git/git-run.js";
 import { branchesPhrase, branchExists, currentBranch, hasCommits, isGitRepo } from "../git/git.js";
-import { DETACHED_HEAD_MESSAGE, NOT_A_REPO_MESSAGE, NOT_INITIALIZED_MESSAGE, NO_COMMITS_MESSAGE, } from "./readiness.js";
-import { agentMissingMessage, findAgentBinary, resolveAgentBin } from "../pi/pi-bin.js";
+import { DETACHED_HEAD_MESSAGE, NOT_A_REPO_MESSAGE, NOT_INITIALIZED_MESSAGE, NO_COMMITS_MESSAGE, teamWorkspaceMessage, } from "./readiness.js";
+import { owningTeamRoot } from "../paths.js";
+import { backendMissingMessage, findBackendBinary, resolveBackendBin } from "../pi/pi-bin.js";
 import { seedClaudeAccount } from "../agent/claude/claude-account.js";
-import { refreshOpencodeCatalog } from "../agent/opencode/opencode-catalog.js";
-import { agentBackend } from "../agent/agent-backend.js";
+import { seedCodexAccount } from "../agent/codex/codex-account.js";
+import { opencodeCatalogStale, readOpencodeCache, refreshOpencodeCatalog, } from "../agent/opencode/opencode-catalog.js";
+import { warnEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
+import { HOUR_MS } from "../text/datetime.js";
+import { errorMessage } from "../text/text.js";
+import { backendById } from "../agent/agent-backend.js";
 // Register the built-in pi and claude adapters into the registry this module reads (see
 // unregisteredBackendInUse) — importing run-agent.ts is the one place they register.
 import "../agent/run-agent.js";
@@ -26,13 +30,15 @@ export async function repoNotReady(root) {
         return GIT_MISSING_MESSAGE;
     if (!(await isGitRepo(root)))
         return NOT_A_REPO_MESSAGE;
-    if (!fs.existsSync(path.join(root, "tumwater.json")))
-        return NOT_INITIALIZED_MESSAGE;
+    if (!fs.existsSync(path.join(root, "tumwater.json"))) {
+        const owner = owningTeamRoot(root);
+        return owner === undefined ? NOT_INITIALIZED_MESSAGE : teamWorkspaceMessage(owner);
+    }
     if (!(await hasCommits(root)))
         return NO_COMMITS_MESSAGE;
     return null;
 }
-/** Every precondition a `tumwater run` generation checks before its orchestrator starts, in the
+/** Every precondition a `tumwater start` generation checks before its orchestrator starts, in the
  * order it checks them: the repo gate, a tumwater.json that loads and validates, a resolvable
  * agent binary, and a main branch it can target. Either the values the generation starts with,
  * or the first unmet precondition's message — never a throw, so a poll can ask it safely. */
@@ -57,18 +63,18 @@ opencodeSeed = {}) {
     if (unregistered !== undefined) {
         return { problem: `backend ${unregistered} is configured but this build has no adapter for it` };
     }
-    // Fail fast instead of starting loops whose every tick dies with "spawn <bin> ENOENT". Every
-    // enabled seam's agent — the top-level `agent` plus each enabled loop's resolved view and the
-    // reviewer — resolves through the same resolveAgentBin the spawn uses (and doctor's pi check);
-    // a missing one names its own agent's binary, not pi's. resolveAgentBin normalizes path-shaped
+    // Fail fast instead of starting roles whose every run dies with "spawn <bin> ENOENT". Every
+    // enabled seam's agent — the top-level `agent` plus each enabled role's resolved view and the
+    // reviewer — resolves through the same resolveBackendBin the spawn uses (and doctor's pi check);
+    // a missing one names its own agent's binary, not pi's. resolveBackendBin normalizes path-shaped
     // values against THIS process's cwd, which every generation inherits, so what is checked here
-    // is exactly what the ticks spawn.
-    for (const agent of agentsInUse(config)) {
-        const resolved = resolveAgentBin(config, agent);
-        // The shared executability rule (pi/pi-bin.ts's findAgentBinary — the one doctor's pi check
+    // is exactly what the runs spawn.
+    for (const agent of backendsInUse(config)) {
+        const resolved = resolveBackendBin(config, agent);
+        // The shared executability rule (pi/pi-bin.ts's findBackendBinary — the one doctor's pi check
         // asks too), so a seam's missing binary reads the same way on both surfaces.
-        if (!findAgentBinary(resolved))
-            return { problem: agentMissingMessage(resolved, agent) };
+        if (!findBackendBinary(resolved))
+            return { problem: backendMissingMessage(resolved, agent) };
     }
     // Seed the claude account state before the first run (plans/agent-backends.md part 6a):
     // `claude auth status` decides subscription vs API key, and an existing file is left alone.
@@ -76,24 +82,36 @@ opencodeSeed = {}) {
     // process: runStartupCheck is also the redeploy/supervisor poll's ask (runStartupProblem),
     // and a logged-out claude would otherwise spawn a bounded probe on every poll. If the seed
     // fails, the first claude run's observation fills the file in.
-    if (!claudeSeedAttempted.has(root) && agentsInUse(config).includes("claude")) {
+    if (!claudeSeedAttempted.has(root) && backendsInUse(config).includes("claude")) {
         claudeSeedAttempted.add(root);
         seedClaudeAccount(root, config);
     }
+    // Seed the codex account state before the first codex run (plans/codex-backend.md §7):
+    // `codex login status` decides subscription vs API key, and an existing file is left alone.
+    // Gated on a codex seam like the claude seed above, and attempted once per root per process.
+    // API-key billing is refused (decision 5): Codex reports no cost, so per-token billing would
+    // spend money the cap cannot see. If the seed fails or reads something else, the first codex
+    // run's observation fills the file in.
+    if (!codexSeedAttempted.has(root) && backendsInUse(config).includes("codex")) {
+        codexSeedAttempted.add(root);
+        const codexAccount = seedCodexAccount(root, config);
+        if (codexAccount?.billing === "api") {
+            return {
+                problem: "Codex is logged in with an API key; tumwater runs Codex on a ChatGPT subscription only — run `CODEX_HOME=<home> codex login --device-auth`",
+            };
+        }
+    }
     // Seed the opencode models catalog (part 6b/7) before the first run: the poll surfaces price
     // opencode seams from the cached `.tumwater/state/opencode-models.json`, and an absent cache
     // reads every opencode seam NOT free (the safe direction for the budget gate). Mirroring the
     // claude seed above, it runs once per root per process when a model job routes to opencode;
-    // a failed fetch keeps the last good cache (or an empty one) and never blocks startup.
-    if (!opencodeSeedAttempted.has(root) && agentsInUse(config).includes("opencode")) {
+    // a failed fetch keeps the last good cache (or an empty one) and never blocks startup; a
+    // failed fetch or cache write logs one warning event.
+    if (!opencodeSeedAttempted.has(root) && backendsInUse(config).includes("opencode")) {
         opencodeSeedAttempted.add(root);
-        await refreshOpencodeCatalog(root, {
-            providers: opencodeProviders(config),
-            // Probe the configured opencode binary (not a different one on PATH) for the version, so
-            // the freshness check compares against the binary the team actually runs.
-            cliBin: resolveAgentBin(config, "opencode").bin,
-            fetch: opencodeSeed.fetch,
-            now: opencodeSeed.now,
+        await seedOpencodeCatalog(root, config, {
+            ...opencodeSeed,
+            warn: (message) => warnEventBestEffort(root, TUMWATER_SOURCE, message),
         });
     }
     const branch = await resolveMainBranch(root, config, branchArg);
@@ -101,10 +119,54 @@ opencodeSeed = {}) {
         return branch;
     return { config, mainBranch: branch.mainBranch };
 }
+/** Refresh the opencode models catalog for the config's opencode seams: the one seed both the
+ * startup check and a live edit that first routes a seam to opencode run. `warn` receives the
+ * refresh's own warnings; every caller passes one (startup logs through warnEventBestEffort). */
+export function seedOpencodeCatalog(root, config, opts = {}) {
+    return refreshOpencodeCatalog(root, {
+        providers: opencodeProviders(config),
+        // Probe the configured opencode binary (not a different one on PATH) for the version, so
+        // the freshness check compares against the binary the team actually runs.
+        cliBin: resolveBackendBin(config, "opencode").bin,
+        fetch: opts.fetch,
+        now: opts.now,
+        warn: opts.warn,
+    });
+}
+/** How long a running team waits between attempts to refetch a missing or stale opencode
+ * catalog. */
+export const OPENCODE_CATALOG_RETRY_MS = HOUR_MS;
+/** The poll-driven catalog refresh: a running team refetches a missing or stale catalog, so a
+ * failed startup fetch or a days-long run does not price by nothing or by an old copy. The poll
+ * path checks only the cache's age. It skips the `opencode --version` comparison, so no binary is
+ * spawned on every poll; the version check still runs inside refreshOpencodeCatalog once a
+ * refresh is due. The throttle starts at construction (the startup check has just tried) and
+ * moves on every attempt, so a fetch that keeps failing warns at most once per
+ * OPENCODE_CATALOG_RETRY_MS, through refreshOpencodeCatalog's own fetch-failed warning. */
+export function newOpencodeCatalogRefresh(root, seed, warn) {
+    const clock = seed.now ?? Date.now;
+    let lastAttempt = clock();
+    return {
+        poll(config) {
+            if (!backendsInUse(config).includes("opencode"))
+                return;
+            if (clock() - lastAttempt < OPENCODE_CATALOG_RETRY_MS)
+                return;
+            if (!opencodeCatalogStale(readOpencodeCache(root), clock()))
+                return;
+            lastAttempt = clock();
+            void seedOpencodeCatalog(root, config, { ...seed, warn }).catch((err) => warn(`open code model catalog refresh failed: ${errorMessage(err)}`));
+        },
+    };
+}
 /** Roots this process has already attempted a claude-account seed for (see runStartupCheck),
  * so the supervisor's and redeploy's repeated startup checks do not respawn `claude auth
  * status` on every poll when the probe fails. */
 const claudeSeedAttempted = new Set();
+/** Roots this process has already attempted a codex-account seed for (see runStartupCheck),
+ * so the supervisor's and redeploy's repeated startup checks do not respawn `codex login
+ * status` on every poll when the probe fails. */
+const codexSeedAttempted = new Set();
 /** Roots this process has already attempted an opencode-catalog seed for (see runStartupCheck),
  * so the supervisor's and redeploy's repeated startup checks do not respawn the models.dev
  * fetch on every poll when it fails. */
@@ -131,7 +193,7 @@ export function opencodeProviders(config) {
  * as a fallback, the resolver, or the director is checked exactly like a primary seam.
  * One list the startup gate and doctor's binary check share, so a route the harness would
  * spawn is checked on both surfaces. */
-export function agentsInUse(config) {
+export function backendsInUse(config) {
     return [...new Set(seamsInUse(config).map((s) => s.agent ?? "pi"))];
 }
 /** The first backend an enabled seam routes to that this build has no registered adapter for,
@@ -139,10 +201,10 @@ export function agentsInUse(config) {
  * are registered by importing src/agent/run-agent.ts (see the import above); a seam backend
  * that is not in the registry is one this build cannot run. Doctor's binary check asks the
  * same question, so the startup gate and doctor cannot disagree about which backend a build
- * can serve. After the opencode adapter lands (part 5/7) this stays the general rule for any
- * future id. */
+ * can serve. opencode's and codex's adapters now register like pi's and claude's, so only a
+ * future id without an adapter trips this rule. */
 export function unregisteredBackendInUse(config) {
-    return agentsInUse(config).find((agent) => agentBackend(agent) === undefined);
+    return backendsInUse(config).find((agent) => backendById(agent) === undefined);
 }
 /** runStartupCheck reduced to its verdict: the message a generation would fail on right now, or
  * null when one would boot — what the redeploy and the supervisor ask. */

package/dist/src/gates/streak-gate.js

@@ -1,11 +1,11 @@
-/** The error-streak circuit breaker (PLANS.md 2026-09-30): a role whose ticks keep failing
- * consecutively is warned at ERROR_STREAK_WARN (src/tick/tick-apply.ts) and named by the team-wide
+/** The error-streak circuit breaker (PLANS.md 2026-09-30): a role whose runs keep failing
+ * consecutively is warned at ERROR_STREAK_WARN (src/run/run-apply.ts) and named by the team-wide
  * storm alarms (src/team/error-storm.ts, src/team/failure-spread.ts), but both only talk — the
- * role keeps ticking on the error ladder's 600 s max backoff forever, burning a model slot and
- * spend on a loop that cannot succeed. Past ERROR_STREAK_BREAKER consecutive failed ticks this gate
+ * role keeps running on the error ladder's 600 s max backoff forever, burning a model slot and
+ * spend on a role that cannot succeed. Past ERROR_STREAK_BREAKER consecutive failed runs this gate
  * pauses the role through the same per-role pause marker the operator's `tumwater pause --role
  * <id>` writes (src/team/team-state.ts's pauseRole — the marker, lock, and idempotence come
- * free), so the scheduler's existing pausedRolesSet skip blocks new ticks with zero scheduler
+ * free), so the scheduler's existing pausedRolesSet skip blocks new runs with zero scheduler
  * changes. The director is NOT exempt: a failing director cannot process prompts anyway, and one
  * uniform rule needs no carve-out. `tumwater resume --role <id>` (or the dashboard's per-row
  * toggle) lifts it, as today.
@@ -14,27 +14,33 @@
  * here so it is unit-testable without a team, and the module owns the only event emission — the
  * orchestrator's poll owns only the wiring.
  *
- * Ack bookkeeping. The marker itself is the ack carrier: every poll, each role present in the
- * paused set has its streak recorded in the in-memory `acked` map, so after the operator resumes a
- * breaker-paused role, re-tripping requires ERROR_STREAK_BREAKER *more* consecutive failures, not
- * one — the same grace an operator-paused failing role gets (its streak is acked while the pause
- * stands, so resuming it does not instantly re-trip on the pre-pause streak), and the same
- * durability a harness restart mid-pause gets (the in-memory state is lost, but the standing marker
- * freezes the ack on the first poll after the restart). If the operator had already resumed before
- * a restart, a still-live streak at or past the breaker re-trips once — the cause is durable, and
- * one event is the honest report. A streak that resets to 0 through the role's own success clears
- * the ack: the next episode trips on its own fresh ERROR_STREAK_BREAKER failures.
+ * Ack bookkeeping. The marker is the ack carrier within a run, and the durable copy of the
+ * ack lives in each runner's persisted `RunnerState.streakAcked`: every poll, each role present
+ * in the paused set has its streak recorded in the in-memory `acked` cache (and flushed to the
+ * runner's state), so after the operator resumes a breaker-paused role, re-tripping
+ * requires ERROR_STREAK_BREAKER *more* consecutive failures, not one — the same grace an
+ * operator-paused failing role gets (its streak is acked while the pause stands, so resuming
+ * it does not instantly re-trip on the pre-pause streak). Because the ack is
+ * persisted, a harness restart after a resume does NOT re-trip a role whose frozen streak
+ * never ran down — the durable cause's first poll finds the persisted ack and leaves the role
+ * alone (BUGS.md 2026-10-23: the old in-memory-only ack re-paused a resumed role on every
+ * auto-redeploy). A streak that resets to 0 through the role's own success clears the ack
+ * (from the cache and the runner's state): the next episode trips on its own fresh
+ * ERROR_STREAK_BREAKER failures.
  *
- * Accepted behavior, stated here and not fixed in this change: the dashboards' "failing tick after
- * tick" alert (src/ui/team-alerts.ts) reads consecutiveErrors regardless of pause, so it keeps
- * listing a breaker-paused role until the streak clears; the loop cell's paused badge explains why
- * it is not ticking, and the role_streak_paused event tells the operator why. */
-import { ERROR_STREAK_BREAKER } from "../tick/tick-apply.js";
-import { loopPaused } from "../roles/loop-ids.js";
+ * Accepted behavior, stated here and not fixed in this change: the dashboards' "failing run after
+ * run" alert (src/ui/team-alerts.ts) reads consecutiveErrors regardless of pause, so it keeps
+ * listing a breaker-paused role until the streak clears; the role cell's paused badge explains why
+ * it is not running, and the role_streak_paused event tells the operator why. */
+import { ERROR_STREAK_BREAKER } from "../run/run-apply.js";
+import { saveRunnerStateBestEffort } from "../runner/runner-state.js";
+import { runnerPaused } from "../roles/runner-ids.js";
 import { pauseRole } from "../team/team-state.js";
 import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
-/** A fresh gate state: nothing acked, so a live streak at or past the breaker trips on the
- * first poll (the durable-cause case a restart after an operator resume relies on). */
+/** A fresh gate state: nothing cached yet, so the first poll of a runner whose persisted
+ * `streakAcked` is set seeds it from there — a restart does NOT re-trip a role the breaker
+ * already excused (the bug this state exists to fix). A runner with no persisted ack that
+ * is at or past the breaker trips on the first poll, as before. */
 export function newStreakGateState() {
     return { acked: new Map() };
 }
@@ -42,7 +48,7 @@ export function newStreakGateState() {
  * has reached ERROR_STREAK_BREAKER plus what its ack already excused, and whose role is not
  * in `pausedRoles`: write the per-role pause marker and log one `role_streak_paused` event
  * carrying the role, the streak, and the last error. Returns the pause keys this poll wrote
- * (`pauseKey` maps a loop id to its marker key; instance 1 of a multi-instance role pauses as
+ * (`pauseKey` maps a role id to its marker key; instance 1 of a multi-instance role pauses as
  * `<role>-1`), so the wiring can fold them into the poll's paused-roles view and the scheduler
  * blocks them on this very poll, not the next one.
  *
@@ -54,16 +60,30 @@ export function pollStreakGate(root, state, runners, pausedRoles, pauseKey = (r)
     const tripped = [];
     for (const { role, state: s } of runners) {
         const streak = s.consecutiveErrors ?? 0;
+        // Seed a fresh in-run ack cache from the persisted excused streak, so a restart keeps the
+        // grace the breaker (and a later operator resume) relies on instead of re-pausing a role
+        // whose frozen streak never ran down (BUGS.md 2026-10-23).
+        if (!state.acked.has(role) && s.streakAcked !== undefined) {
+            state.acked.set(role, s.streakAcked);
+        }
         // Ack while paused: the marker is the ack carrier. The streak is frozen while a role is
-        // paused (no ticks run), so recording it here is exactly the level the resume excuses.
-        if (loopPaused(pausedRoles, role)) {
-            state.acked.set(role, streak);
+        // paused (no new runs start), so recording it here is exactly the level the resume excuses.
+        if (runnerPaused(pausedRoles, role)) {
+            if ((state.acked.get(role) ?? 0) !== streak) {
+                state.acked.set(role, streak);
+                s.streakAcked = streak;
+                saveRunnerStateBestEffort(root, s);
+            }
             continue;
         }
         if (streak === 0) {
             // A streak that reset through the role's own success ends the excused episode: the
-            // next one must climb a fresh ERROR_STREAK_BREAKER of its own.
-            state.acked.delete(role);
+            // next one must climb a fresh ERROR_STREAK_BREAKER of its own, so drop the durable ack too.
+            if (state.acked.get(role) !== undefined) {
+                state.acked.delete(role);
+                delete s.streakAcked;
+                saveRunnerStateBestEffort(root, s);
+            }
             continue;
         }
         const ack = state.acked.get(role) ?? 0;
@@ -71,9 +91,13 @@ export function pollStreakGate(root, state, runners, pausedRoles, pauseKey = (r)
             continue;
         // Ack at trip time, before the pause is observed: the bar for the next trip is
         // ERROR_STREAK_BREAKER more failures from this level, whether or not any poll sees the
-        // role paused in between (an operator resume racing the next poll must not re-trip).
+        // role paused in between (an operator resume racing the next poll must not re-trip). The
+        // durable copy is written only once the pause is confirmed below — a failed or crashed
+        // pauseRole must not leave a permanent excused ack with no marker behind it.
         state.acked.set(role, streak);
         if (pauseRole(root, pauseKey(role))) {
+            s.streakAcked = streak;
+            saveRunnerStateBestEffort(root, s);
             logEventBestEffort(root, {
                 source: TUMWATER_SOURCE,
                 type: "role_streak_paused",

package/dist/src/git/commit-message.js

@@ -1,13 +1,13 @@
-// vocabulary: plain
-import { truncate } from "../text/text.js";
+import { truncate, joinParts } from "../text/text.js";
 import { compactTokens } from "../text/format.js";
+import { modelLabel } from "../agent/backend-traits.js";
 import { labeledLine } from "../verdict/reply-contract.js";
-/** Assembling tick commit messages from pi's final reply: the SUMMARY line becomes the
+/** Assembling run commit messages from pi's final reply: the SUMMARY line becomes the
  * subject, the WHY/RISK/VERIFIED block becomes the body, and the harness stamps a trailer
- * with tick metadata. Split out of prompt.ts — which keeps building the prompts that declare
+ * with run metadata. Split out of prompt.ts — which keeps building the prompts that declare
  * this contract (the machine-detectable half — sentinel and verdict-line detection — lives in
  * reply-contract.ts) — because turning a reply into what `git commit` receives is the git side
- * of the contract, consumed by the tick pipeline (tick-stage.ts, tick-verdict.ts) and
+ * of the contract, consumed by the run pipeline (run-stage.ts, run-verdict.ts) and
  * refusal.ts. */
 /** Cap on the commit subject's summary portion (the SUMMARY line), so a verbose model cannot
  * bloat every commit subject. Truncated with an ellipsis — like the body fields below — rather
@@ -25,23 +25,39 @@ export function extractSummary(finalText) {
     const summary = labeledLine(finalText, "SUMMARY");
     return summary === null ? null : truncate(summary, COMMIT_SUMMARY_MAX);
 }
-/** The subject for a changed tick whose reply — and whose follow-up request — carried no
+/** The subject for a changed run whose reply — and whose follow-up request — carried no
  * SUMMARY line: named from what actually changed, so the log still says what the commit touched
- * instead of only which loop made it. Up to three repo-relative paths (worktree order), then a
+ * instead of only which role made it. Up to three repo-relative paths (worktree order), then a
  * count; capped like a real summary. Falls back to the bare "<role> run N" only when nothing is
  * known. */
-export function fallbackSummary(files, role, tick) {
+export function fallbackSummary(files, role, runNumber) {
     if (files.length === 0)
-        return `${role} run ${tick}`;
+        return `${role} run ${runNumber}`;
     const shown = files.slice(0, 3).join(", ");
     const rest = files.length > 3 ? ` and ${files.length - 3} more` : "";
     return truncate(`Update ${shown}${rest}`, COMMIT_SUMMARY_MAX);
 }
-/** Cap on each commit-body field, so a verbose model cannot bloat every commit. */
-const COMMIT_BODY_FIELD_MAX = 200;
+/** Cap on each commit-body field. It only bounds a runaway reply: at 200 it cut almost half of
+ * all body lines, which reviewers rejected as incomplete claims. */
+const COMMIT_BODY_FIELD_MAX = 1000;
+/** A numbered `Objection N: <disposition>` line a revision run's reply carries (the closing
+ * contract buildRevisionNote teaches, gate-notes.ts) — the author's answer to the prior
+ * review's Nth numbered objection. Anchored at line start so prose that merely mentions an
+ * objection mid-sentence cannot be read as one. */
+const OBJECTION_LINE = /^\s*Objection (\d+):\s*(.+)\s*$/gm;
+/** Pull the numbered Objection lines out of a reply, each capped like a body field. */
+function extractObjections(finalText) {
+    const out = [];
+    for (const m of finalText.matchAll(OBJECTION_LINE)) {
+        out.push({ n: Number(m[1]), text: truncate(m[2] ?? "", COMMIT_BODY_FIELD_MAX) });
+    }
+    // Preserve the numbered order regardless of where the author placed each line.
+    out.sort((a, b) => a.n - b.n);
+    return out;
+}
 /** Pull the WHY:/RISK:/VERIFIED: lines out of a pi final reply via the shared labeled-line
  * parser, tolerant of any subset being absent (a non-compliant reply still commits), each field
- * capped at 200 chars (truncate + ellipsis). Null when none were found. */
+ * capped at COMMIT_BODY_FIELD_MAX (truncate + ellipsis). Null when none were found. */
 export function extractCommitBody(finalText) {
     const pick = (label) => {
         const v = labeledLine(finalText, label);
@@ -52,50 +68,59 @@ export function extractCommitBody(finalText) {
         risk: pick("RISK"),
         verified: pick("VERIFIED"),
     };
-    return body.why || body.risk || body.verified ? body : null;
-}
-/** Merge a follow-up reply's body over the tick's original body, field by field: a follow-up that
- * restates only some of WHY/RISK/VERIFIED overrides those fields and leaves the others intact. A
- * wholesale replacement would silently drop the fields a partial reply did not restate, losing the
- * authoring run's recorded reasoning; returns `base` unchanged when `update` carries no field. */
-export function mergeCommitBody(base, update) {
-    if (!update)
+    const objections = extractObjections(finalText);
+    if (objections.length > 0)
+        body.objections = objections;
+    return body.why || body.risk || body.verified || objections.length > 0 ? body : null;
+}
+/** Add the pre-queue self-check fix-up turn's RISK and VERIFIED lines to the run's body, each
+ * after the authoring run's own line as `(self-check: …)`. The fix-up turn answers the
+ * self-check's findings, not the change. When its lines replaced the authoring run's, the commit
+ * described that answer over the whole diff ("No code changed" on a full feature), and review
+ * rejected it as claims-vs-diff (BUGS.md 2026-10-21). Its WHY is dropped for the same reason.
+ * Returns `base` unchanged when the reply has neither line. */
+export function appendSelfCheckNotes(base, fixUp) {
+    if (!fixUp?.risk && !fixUp?.verified)
         return base;
-    const merged = {
-        why: update.why ?? base?.why,
-        risk: update.risk ?? base?.risk,
-        verified: update.verified ?? base?.verified,
-    };
-    return merged.why || merged.risk || merged.verified ? merged : null;
+    const note = (own, added) => added === undefined ? own : own === undefined ? `self-check: ${added}` : `${own} (self-check: ${added})`;
+    return { ...base, risk: note(base?.risk, fixUp.risk), verified: note(base?.verified, fixUp.verified) };
 }
-/** The body's lines in commit order ("WHY: …\nRISK: …\nVERIFIED: …"); "" when the body is
- * empty. */
+/** The body's lines in commit order ("WHY: …\nRISK: …\nVERIFIED: …\nObjection N: …"); "" when
+ * the body has no fields. Objection lines follow the VERIFIED line, numbered as the author
+ * wrote them. Empty when the body is empty. */
 export function formatCommitBody(body) {
-    return [
+    return joinParts([
         body.why && `WHY: ${body.why}`,
         body.risk && `RISK: ${body.risk}`,
         body.verified && `VERIFIED: ${body.verified}`,
-    ]
-        .filter(Boolean)
-        .join("\n");
+        ...(body.objections ?? []).map((o) => `Objection ${o.n}: ${o.text}`),
+    ], "\n");
 }
-/** The harness-stamped trailer line of every tick commit — truth from the run's counters, not
- * model claims. `turns` sums this tick's pre-commit pi runs (main + transient retry); `peakCtx`
- * is their largest single-request context. A changed tick flagged high-friction (plans/
+/** The harness-stamped trailer line of every run commit — truth from the run's counters, not
+ * model claims. `turns` sums this run's pre-commit pi runs (main + transient retry); `peakCtx`
+ * is their largest single-request context. A changed run flagged high-friction (plans/
  * refusal-and-thrash.md) appends a sibling Friction line after the Run line — minutes rounded,
- * e.g. `Friction: high (41 turns / 62m)`; only changed ticks carry it, so the refusal path
- * never passes the argument and the Run line's asserted format stays stable. */
-export function commitTrailer(role, tick, turns, peakCtx, highFrictionMinutes, revisionRound) {
-    const base = `Run: ${role} #${tick} · turns ${turns} · ctx ${compactTokens(peakCtx)}`;
+ * e.g. `Friction: high (41 turns / 62m)`; only changed runs carry it, so the refusal path
+ * never passes the argument and the Run line's asserted format stays stable. A `modelLine` (see
+ * modelTrailerLine) goes on its own line directly after the Run line, before Friction and
+ * Revision, so Revision stays last. */
+export function commitTrailer(role, runNumber, turns, peakCtx, highFrictionMinutes, revisionRound, modelLine) {
+    const base = `Run: ${role} #${runNumber} · turns ${turns} · ctx ${compactTokens(peakCtx)}`;
+    const model = modelLine === undefined ? "" : `\n${modelLine}`;
     const friction = highFrictionMinutes === undefined
         ? ""
         : `\nFriction: high (${turns} turns / ${Math.round(highFrictionMinutes)}m)`;
     // The revision line is last and absent on a fresh change: leftover recovery reads it back to
     // keep the rejected change's round when the queue marker is lost (plans/revise-rejected.md).
     const revision = revisionRound === undefined ? "" : `\nRevision: ${revisionRound}`;
-    return `${base}${friction}${revision}`;
+    return `${base}${model}${friction}${revision}`;
 }
-/** The high-friction trailer line a flagged tick's commit carries (see commitTrailer) — the
+/** The trailer's Model line: the model and backend a run's seam started on, e.g.
+ * `Model: claude-opus-5-5 · backend claude`; `default` when the seam names no model. */
+export function modelTrailerLine(agent, provider, model) {
+    return `Model: ${model === undefined ? "default" : modelLabel(agent, provider, model)} · backend ${agent}`;
+}
+/** The high-friction trailer line a flagged run's commit carries (see commitTrailer) — the
  * durable record recovery reads back. Anchored to the whole line so prose that merely mentions
  * friction cannot set the flag. */
 const FRICTION_TRAILER = /^Friction: high \(\d+ turns \/ \d+m\)$/m;
@@ -110,15 +135,15 @@ const REVISION_TRAILER = /^Revision: (\d+)$/m;
  * undefined for a fresh change. Leftover recovery reads this off the pinned commit so a
  * retriable revision keeps its round (and its rejected ref's cleanup) across a lost queue
  * marker (plans/revise-rejected.md). */
-function revisionRoundOf(message) {
+export function revisionRoundOf(message) {
     const m = REVISION_TRAILER.exec(message);
     return m ? Number(m[1]) : undefined;
 }
-/** The harness-stamped commit-subject prefix — the `tumwater(<role>):` part tick-stage.ts (and
+/** The harness-stamped commit-subject prefix — the `tumwater(<role>):` part run-stage.ts (and
  * refusal.ts) adds before the SUMMARY line, space included when a summary follows. */
-const SUBJECT_PREFIX = /^tumwater\([^)]+\):(?:\s|$)/;
+const SUBJECT_PREFIX = /^tumwater\(([^)]+)\):(?:\s|$)/;
 /** Build a harness-stamped commit subject: `tumwater(<role>): <summary>` — the exact shape
- * SUBJECT_PREFIX below matches, so the stamp's writers (tick-stage.ts's normal tick commit and
+ * SUBJECT_PREFIX below matches, so the stamp's writers (run-stage.ts's normal run commit and
  * refusal.ts's refusal note) and its parser live in one file and cannot drift apart. */
 export function stampedSubject(role, summary) {
     return `tumwater(${role}): ${summary}`;
@@ -137,6 +162,12 @@ export function commitSubject(message) {
     const rest = line.slice(m[0].length).trim();
     return rest === "" ? undefined : rest;
 }
+/** The `<role>` of a commit subject the harness stamped (`tumwater(<role>): …`); undefined for an
+ * unstamped line. */
+export function stampedRole(message) {
+    const line = (message.split("\n", 1)[0] ?? "").trim();
+    return SUBJECT_PREFIX.exec(line)?.[1];
+}
 /** Reconstruct the review-gate metadata from a commit message the harness stamped itself.
  * Leftover recovery has no authoring run to read from, so the pinned commit's message is the
  * only source of truth: without this a recovered high-friction change loses both its flag and
@@ -153,7 +184,7 @@ export function parseCommitMetadata(message) {
         ...(revisionRound !== undefined ? { revisionRound } : {}),
     };
 }
-/** Assemble a tick's full commit message — the single place that builds one. The subject is
+/** Assemble a run's full commit message — the single place that builds one. The subject is
  * the existing "tumwater(<role>): <summary>" line; the author's body (omitted when absent)
  * and the harness-stamped trailer follow as separate paragraphs. Refusal commits route
  * through here too (subject + trailer only). */

package/dist/src/git/git-diff.js

@@ -3,7 +3,7 @@
  * ahead-of-main diff extraction (including its oversized-diff truncation). Everything here
  * interprets git output; spawning git stays in git.ts. */
 import { changeBaseRev, gitLines } from "./git.js";
-import { gitTry } from "./git-run.js";
+import { git, gitTry } from "./git-run.js";
 import { cutSplitsSurrogatePair } from "../text/text.js";
 /** Git's C-quoting short escapes (its `sq_lookup` table) and the byte each decodes to. The
  * mapping was a nine-case switch that repeated `bytes += …; break;` per entry; keeping it as
@@ -68,7 +68,10 @@ export function unquotePorcelainPath(p) {
 }
 /** Repo-relative paths of every change in the worktree — modified, untracked, and deleted, parsed
  * from `git status --porcelain -z` (paths only). The refusal path uses this to classify what a
- * refusing run left behind: markdown notes may be kept, everything else is discarded.
+ * refusing run left behind: markdown notes may be kept, everything else is discarded. A failed
+ * `git status` throws: read as "no changes", it once sent a refusal's or a self-check's
+ * decision down the path that drops the run's work (2026-10-21's spawn wedge), so a caller that
+ * only reports (a view, a warning) catches it itself.
  *
  * The `-z` format is what git recommends for machine parsing: records are NUL-terminated and
  * paths are emitted verbatim, never C-quoted, so a path with whitespace, a quote, a control
@@ -79,7 +82,7 @@ export function unquotePorcelainPath(p) {
  * `-z` a rename/copy is two records — `XY <to>\0<from>\0`, destination first — so this reads
  * the destination (the path that exists now) and skips the extra origin record. */
 export async function changedFiles(wt) {
-    const out = await gitTry(wt, "status", "--porcelain", "-z");
+    const out = await git(wt, "status", "--porcelain", "-z");
     if (!out)
         return [];
     const files = [];
@@ -101,9 +104,11 @@ export async function changedFiles(wt) {
 }
 /** Repo-relative paths changed between the branch's fork point from main and its HEAD —
  * everything a merge of this branch would bring in (the three-dot range diffs against the
- * merge-base, so commits main gained during the tick are not included). */
+ * merge-base, so commits main gained during the run are not included). A failed `git diff`
+ * throws: an empty list is vacuously review-exempt (isExemptDiff), so the gate skipped its
+ * reviewer and the in-lock re-check its build check. A view catches it itself. */
 export async function aheadOfMainFiles(wt, mainBranch) {
-    const out = await gitTry(wt, "diff", "--name-only", `${mainBranch}...HEAD`);
+    const out = await git(wt, "diff", "--name-only", `${mainBranch}...HEAD`);
     // Decode git's C-quoted names (same convention as `git status --porcelain`): every caller
     // uses these as real worktree paths or matches them against plain HEAD-provided names, and
     // an undecoded `"h\303\251llo.md"` reads as a nonexistent file (hasConflictMarkers) and
@@ -143,19 +148,20 @@ function splitDiffByFile(diff) {
  * oversized diff is itself reviewable information, and the reviewer can read any file in the
  * worktree directly). The per-file sections are split out of the one full diff already fetched —
  * spawning a diff per file would re-diff the entire range once per file for text we already hold in
- * memory (measured ~0.5 s of redundant git work on a 530 KB / 39-file tick). Section byte length
+ * memory (measured ~0.5 s of redundant git work on a 530 KB / 39-file run). Section byte length
  * ranks files at least as well as numstat's added+deleted: it is exactly what the reviewer will
  * see, and a binary file's short "Binary files differ" stub naturally ranks below any real text
- * change. */
-export async function aheadOfMainDiff(wt, mainBranch, maxBytes = 200_000) {
+ * change. A failed `git diff` throws: the reviewer handed an empty diff judged no change at
+ * all. A view catches it itself. */
+export async function aheadOfMainDiff(wt, mainBranch, maxBytes = 200_000, pathspec = []) {
     const range = `${mainBranch}...HEAD`;
-    const full = (await gitTry(wt, "diff", range)) ?? "";
+    const full = await git(wt, "diff", range, ...pathspec);
     if (full.length <= maxBytes)
         return full;
     // Over the cap: rank files by change size and include the largest while budget allows.
     const ranked = splitDiffByFile(full).sort((a, b) => b.length - a.length);
     let out = `[diff truncated: the full ahead-of-main diff is ${full.length} bytes; ` +
-        `showing --stat plus the largest files]\n\n` + ((await gitTry(wt, "diff", "--stat", range)) ?? "") + "\n";
+        `showing --stat plus the largest files]\n\n` + (await git(wt, "diff", "--stat", range, ...pathspec)) + "\n";
     for (const d of ranked) {
         // Account for the surrounding newlines in the budget check so the output never exceeds maxBytes
         // even when a section ends exactly on the boundary.