tumwater 0.2.0 → 0.3.0

package/dist/src/roles/roles.js

@@ -1,35 +1,34 @@
-// vocabulary: plain
 /** The role registries and classification helpers over the built-in role catalog. The catalog
- * itself — each loop's identity and its "find something to do" prompt text — lives in
+ * itself — each role's identity and its "find something to do" prompt text — lives in
  * role-catalog.ts (split out 2026-10-01, organize); this module re-exports ROLES and Role so
  * every importer keeps the single roles.js import path, and derives from them the scheduling
  * registries (work/maintenance/observer tiers, deferrable and baseline-blocked sets) and the
- * lookup helpers the CLI, GUI, and tick prompt share. */
+ * lookup helpers the CLI, GUI, and run prompt share. */
 import { ROLES } from "./role-catalog.js";
-import { baseRoleOf } from "./loop-ids.js";
+import { baseRoleOf } from "./runner-ids.js";
 import { typoSuffix } from "../text/suggest.js";
 export { ROLES };
-/** The director loop's id — a target that is not in ROLES (allRoleIds appends it) and is
+/** The director role's id — a target that is not in ROLES (allRoleIds appends it) and is
  * driven by operator prompts, not a find prompt: an un-targeted `tumwater prompt` queues
- * there. It keeps running through a team-wide `pause` (which stops only the role loops);
+ * there. It keeps running through a team-wide `pause` (which stops only the roles);
  * an un-targeted `stop` signals the whole orchestrator, director included. */
 export const DIRECTOR_ROLE = "director";
-/** The bugfix loop's id. It is the one work role that also defers like a maintenance role while its
- * backlog (BUGS.md `## Open`) is empty — see deferTick in src/scheduling/scheduling.ts. With open
+/** The bugfix role's id. It is the one work role that also defers like a maintenance role while its
+ * backlog (BUGS.md `## Open`) is empty — see deferRun in src/scheduling/scheduling.ts. With open
  * bugs it never defers, but pollRunnerReasons stands it down while all of them are held. */
 export const BUGFIX_ROLE = "bugfix";
 /** Work-tier roles (need-based prioritization): they
- * ship work — feature and bugfix merge code on main, plan feeds them — so their due ticks are
+ * ship work — feature and bugfix merge code on main, plan feeds them — so their due runs are
  * never deferred and slot allocation always orders them ahead of maintenance. */
 const WORK_ROLES = new Set(["feature", "bugfix", "plan"]);
 /** Observer roles (plans/observer-roles.md 1/2): a role whose product is an observation, not a
  * commit, and for which `no_change` means "checked, all well" rather than "found nothing to do".
- * The idle ladder's premise — a loop that keeps finding nothing stops burning model time — does
- * not hold for these, so their no_change tick schedules at `minRunIntervalSeconds` and leaves
+ * The idle ladder's premise — a role that keeps finding nothing stops burning model time — does
+ * not hold for these, so their no_change run schedules at `minRunIntervalSeconds` and leaves
  * `backoffSeconds` at 0 (src/scheduling/backoff.ts). The error ladder still applies in full, and
  * they are removed from DEFERRABLE_ROLES because their input (the running product for `qa`, the
- * event log for `selfcheck`) is not a function of whether main moved. */
-export const OBSERVER_ROLES = new Set(["qa", "selfcheck"]);
+ * event log for `selfcheck` and `feedback`) is not a function of whether main moved. */
+export const OBSERVER_ROLES = new Set(["qa", "selfcheck", "feedback"]);
 /** The built-in maintenance roles that author code on their own cadence — the eight members
  * DEFERRABLE_ROLES and BASELINE_BLOCKED_ROLES share. Both sets list them because both charter
  * the same roles (defer-until-needed scheduling, red-main blocking), so the list lives once
@@ -45,8 +44,8 @@ const CODE_MAINTENANCE_ROLES = [
     "improve",
 ];
 /** Maintenance-tier roles (need-based prioritization): exactly the ten built-ins whose due
- * ticks are deferrable while no feature, bugfix, director, operator or human commit has merged
- * into main since their last tick and that tick did nothing. Unknown/custom roles are
+ * runs are deferrable while no feature, bugfix, director, operator or human commit has merged
+ * into main since their last run and that run did nothing. Unknown/custom roles are
  * deliberately NOT in this
  * set — the harness cannot judge what an arbitrary custom role needs, so they never defer (they
  * still sort into tier 1 for fairOrder via roleTier). Observers are excluded: an unmoved tree
@@ -56,12 +55,12 @@ export const DEFERRABLE_ROLES = new Set([
     ...CODE_MAINTENANCE_ROLES,
     "steward",
 ]);
-/** Does this role's recent yield scale its min-tick gap (yield-scaled clocks, PLANS.md)?
+/** Does this role's recent yield scale its min-run gap (yield-scaled clocks, PLANS.md)?
  * The search/maintenance roles — the deferrable ten, the observers, and bugfix on its
  * empty-backlog search duty (it is the one work role that defers like maintenance, so its
- * idle clock stretches like one too; the open-bugs state is deferTick's concern, not the
- * clock's: ten consecutive empty ticks are empty-yield evidence however many bugs are
- * recorded). Never the work roles whose ticks follow demand — feature, plan, director — a
+ * idle clock stretches like one too; the open-bugs state is deferRun's concern, not the
+ * clock's: ten consecutive empty runs are empty-yield evidence however many bugs are
+ * recorded). Never the work roles whose runs follow demand — feature, plan, director — a
  * role with a queued prompt or a fresh wake bypasses the gap entirely (isEligible), and the
  * multiplier is computed from counted results only (backoff.ts), so feature's errors
  * and quiet kills never stretch anything. */
@@ -76,24 +75,25 @@ export function roleTier(role) {
     return WORK_ROLES.has(baseRoleOf(role)) ? 0 : 1;
 }
 /** The roles blocked from starting an authoring run while main's own build/test suite is known
- * red (the red-main baseline check): every role whose diff
+ * red with no failing test named (the red-main baseline check; a red that names its failing tests
+ * blocks nothing, and these roles get a `<main-known-red>` note instead): every role whose diff
  * can carry non-exempt (code) changes — on a red main such a diff is rejected deterministically
  * by the gate's pre-check, so spending an authoring run on it is pure waste. Exempt: director
  * (human prompts outrank autonomous gates, like the budget gate), bugfix (the designated healer
- * — its tick runs the suite per "leave the project working" and can fix a red main through the
+ * — its run executes the suite per "leave the project working" and can fix a red main through the
  * existing pre-merge gate; blocking it would leave only humans able to unblock the team), and
- * plan/readme/steward/qa/selfcheck (markdown-only charter — their diffs are exempt from the build
- * pre-check via review.exemptPaths, so a red main does not block them). */
+ * plan/readme/steward/qa/selfcheck/feedback (markdown-only charter — their diffs are exempt
+ * from the build pre-check via review.exemptPaths, so a red main does not block them). */
 export const BASELINE_BLOCKED_ROLES = new Set([
     "feature",
     ...CODE_MAINTENANCE_ROLES,
 ]);
-/** Is this loop id blocked from authoring on a red main? True when its base role is in
+/** Is this role id blocked from authoring on a red main? True when its base role is in
  * BASELINE_BLOCKED_ROLES, so `feature-2` is blocked exactly as `feature` is. */
 export function baselineBlocked(role) {
     return BASELINE_BLOCKED_ROLES.has(baseRoleOf(role));
 }
-/** Work ratio 4/4: which commit tier a loop's base role merges into, for the work vs maintenance
+/** Work ratio 4/4: which commit tier a role's base role merges into, for the work vs maintenance
  * split the report and the "Merged today" tile show and the maintenance allowance (Work ratio
  * 1a/4, src/gates/maintenance-quota.ts) counts. The one home of the split. `work` is the
  * shipping tier (feature, bugfix, director); `maintenance` is code upkeep plus readme. Every
@@ -121,17 +121,17 @@ export function roleById(id) {
  * a did-you-mean suggestion when the typed id sits within edit distance 2 of a valid one —
  * the same treatment unknownConfigKeyError gives config keys, so a mistyped `--role feautre`
  * names its fix instead of only the valid list. parseRoleFlag, the operator commands, and
- * tick-prompt's defensive runner path share it so the wording cannot drift between the CLI,
- * the GUI, and a tick's internal error. The hint is text/suggest.ts's typoSuffix —
+ * run-prompt's defensive runner path share it so the wording cannot drift between the CLI,
+ * the GUI, and a run's internal error. The hint is text/suggest.ts's typoSuffix —
  * suggestClosest plus didYouMean composed once, the pairing every other unknown-X error
  * renders through. */
 export function unknownRoleMessage(role, validIds) {
     return `unknown role: ${role} (valid ids: ${validIds.join(", ")})${typoSuffix(role, validIds)}`;
 }
-/** A user-defined loop as a Role (plans/user-defined-loops.md): its task IS the
- * role-specific find-something-to-do text, and the title is what identifies the loop inside
- * its own prompt (`You are the "<name>" loop (user-defined loop)`) and commit context.
- * Custom loops run the `default` tier — the harness cannot judge what an arbitrary loop's
+/** A user-defined role as a Role (plans/user-defined-loops.md): its task IS the
+ * role-specific find-something-to-do text, and the title is what identifies the role inside
+ * its own prompt (`You are the "<name>" role (user-defined role)`) and commit context.
+ * Custom roles run the `default` tier — the harness cannot judge what an arbitrary role's
  * work needs, so it gets the team's ordinary model. */
 export function customRole(name, task) {
     return { id: name, title: "custom role", find: task, tier: "default" };

package/dist/src/roles/runner-ids.js

@@ -0,0 +1,97 @@
+/** Runner-id arithmetic for parallel work instances (plans/parallel-work-instances.md, part 1/7). A
+ * base role may run several runner ids — `feature`, `feature-2`, `bugfix-3`, … — each keying
+ * its own persisted state, branch, refs, session and notes, while every lookup that is ABOUT the
+ * role (its catalog charter, model, tier, caps, scheduling class) resolves through the base role.
+ * With no instances configured, every runner id is bare, so `baseRoleOf` is the identity.
+ *
+ * Only `feature` and `bugfix` may gain instances; any other id is returned unchanged, including a
+ * custom role whose name merely resembles an instance. */
+/** The base roles that may run more than one instance. */
+export const INSTANCE_ROLES = new Set(["feature", "bugfix"]);
+/** How many runner ids an instance role may hold per configured instance. `instances: N` limits the
+ * runs writing code at once; a runner whose change waits in the merge pipeline never runs
+ * (plans/merge-queue.md invariant 3), so tumwater keeps up to N × this many runner ids and the
+ * poll admits another while fewer than N are running (plans/fast-merge.md "Lever 1"). */
+const RUNNERS_PER_INSTANCE = 2;
+/** The instance-id shape: a base role, a dash, and an index of 2 or more (`-1` is not an
+ * instance — the bare id already means instance 1). The source string is also interpolated into
+ * the dashboard script (gui-client-labels.ts). */
+export const INSTANCE_ID_SOURCE = "^(feature|bugfix)-([2-9]|[1-9][0-9]+)$";
+const INSTANCE_RE = new RegExp(INSTANCE_ID_SOURCE);
+/** The base role a runner id belongs to: `feature-2` → `feature`, `bugfix-10` → `bugfix`; any
+ * other id — a bare role, a custom role, `feature-1` — is returned unchanged. */
+export function baseRoleOf(id) {
+    const m = INSTANCE_RE.exec(id);
+    return m ? m[1] : id;
+}
+/** The 1-based instance number of a runner id: 1 for a bare role or any non-instance id, N for
+ * `<role>-N`. */
+export function instanceIndex(id) {
+    const m = INSTANCE_RE.exec(id);
+    return m ? Number(m[2]) : 1;
+}
+/** Whether a runner id is listed in a role scope, directly or through its base role — a scope
+ * naming `feature` takes `feature-2` too. One home for the instance-aware membership test
+ * shared by `logs --role`'s and the merge queue's filters and status snapshot scoping, so the
+ * three cannot drift on whether a bare role id takes its instances. */
+export function roleInScope(id, scope) {
+    return scope.includes(id) || scope.includes(baseRoleOf(id));
+}
+/** The instance count configured for a runner id's base role (`roles.<base>.instances`, default
+ * 1). A caller tells a multi-instance base (whose unassigned runs stage claims for their
+ * siblings) from a single-runner one by this. */
+export function configuredInstances(config, id) {
+    const role = config.roles[baseRoleOf(id)];
+    return role?.instances ?? 1;
+}
+/** How many runner ids a base role holds: its configured instance count, times
+ * RUNNERS_PER_INSTANCE once it runs more than one instance. A role left at one instance keeps its
+ * single bare runner, so its scheduling is exactly the single-runner one. */
+function runnerCount(config, base) {
+    const count = config.roles[base]?.instances ?? 1;
+    return INSTANCE_ROLES.has(base) && count > 1 ? count * RUNNERS_PER_INSTANCE : count;
+}
+/** Is this runner id enabled? True when its base role is enabled in config and the id's instance
+ * index is within the role's runner count (runnerCount). */
+export function runnerEnabled(config, id) {
+    const role = config.roles[baseRoleOf(id)];
+    if (role?.enabled !== true)
+        return false;
+    return instanceIndex(id) <= runnerCount(config, baseRoleOf(id));
+}
+/** Every runner id the config says should exist, in `config.roles` order: each enabled role's
+ * bare id, then `<id>-2`…`<id>-M` for the `INSTANCE_ROLES` at their runner count
+ * (runnerCount: twice the configured instances once there is more than one). Other roles and
+ * custom roles stay bare — only feature and bugfix may split. The one
+ * answer to "which runners should exist", so the orchestrator (part 5b/7) and live reload
+ * enumerate the same set. At the default instance count this returns exactly the bare ids
+ * `enabledRoleIds` returns. */
+export function runnerIds(config) {
+    const ids = [];
+    for (const [id, role] of Object.entries(config.roles)) {
+        if (!role.enabled)
+            continue;
+        ids.push(id);
+        if (!INSTANCE_ROLES.has(id))
+            continue;
+        const count = runnerCount(config, id);
+        for (let i = 2; i <= count; i++)
+            ids.push(`${id}-${i}`);
+    }
+    return ids;
+}
+/** The pause-marker key for a runner id. Instance 1's runner id is the bare role id, which as a
+ * pause key would mean the whole role, so while the role runs several instances instance 1 pauses
+ * under `<role>-1`. `-1` is a pause key only, never a runner id. Every other id is its own key. */
+export function instancePauseKey(config, runnerId) {
+    return INSTANCE_ROLES.has(runnerId) && configuredInstances(config, runnerId) > 1
+        ? `${runnerId}-1`
+        : runnerId;
+}
+/** Does the per-role pause marker stop this runner id? True for its own id, its base role's id (a
+ * whole-role pause), or — for the bare id of an instance role — the `<role>-1` pause key. */
+export function runnerPaused(paused, runnerId) {
+    return (paused.has(runnerId) ||
+        paused.has(baseRoleOf(runnerId)) ||
+        (INSTANCE_ROLES.has(runnerId) && paused.has(`${runnerId}-1`)));
+}

package/dist/src/run/acceptance-greps.js

@@ -0,0 +1,119 @@
+/** The pre-queue self-check's acceptance-grep runner: a finished plan entry that says a `grep …`
+ * "finds nothing" is checked by running that grep in the worktree, so a change is not rejected
+ * for an acceptance grep that still matches. Only the strict "matches nothing" form runs;
+ * criteria worded "prints only …" need judgement and stay out. Staging-only (stage-check.ts). */
+import { execFileAsync } from "../process/process.js";
+import { moreSuffix } from "../text/phrases.js";
+import { collapseWhitespace, truncate } from "../text/text.js";
+const MAX_CRITERIA = 5;
+const GREP_TIMEOUT_MS = 20_000;
+const EMPTY_PHRASE_RE = new RegExp("^\\s*(?:(?:finds|prints|returns|outputs|matches|lists) nothing|is empty|lists none|" +
+    "(?:prints|finds|lists|returns|gives|shows) no (?:lines?|hits?|matches?|output))", "i");
+const ALLOWANCE_RE = /apart from|except|excluding|other than|besides|beyond/i;
+/** The backticked `grep …`/`git grep …` commands in `body` that the text says match nothing
+ * ("finds nothing", "is empty", …), without duplicates, in body order, at most five. A criterion
+ * whose sentence (up to the next `.` or `;`) allows some hits ("apart from", "except", …) is
+ * dropped. */
+export function emptyGrepCriteria(body) {
+    const text = collapseWhitespace(body);
+    const found = [];
+    for (const m of text.matchAll(/`([^`]+)`/g)) {
+        const cmd = m[1] ?? "";
+        if (!/^(?:git )?grep /.test(cmd))
+            continue;
+        const rest = text.slice((m.index ?? 0) + m[0].length);
+        const phrase = EMPTY_PHRASE_RE.exec(rest);
+        if (phrase === null)
+            continue;
+        const sentence = rest.slice(0, rest.search(/[.;]/) === -1 ? undefined : rest.search(/[.;]/));
+        if (ALLOWANCE_RE.test(sentence))
+            continue;
+        if (!found.includes(cmd))
+            found.push(cmd);
+        if (found.length >= MAX_CRITERIA)
+            break;
+    }
+    return found;
+}
+/** A minimal shell-word split of a `grep …`/`git grep …` command, or undefined when it uses
+ * shell syntax (an unquoted `|;&<>$()` or backtick) or leaves a quote open. Nothing runs through
+ * a shell, so `*` stays literal. */
+export function grepArgv(cmd) {
+    const words = [];
+    let cur = "";
+    let inWord = false;
+    let quote = null;
+    for (let i = 0; i < cmd.length; i++) {
+        const c = cmd[i];
+        if (quote === "'") {
+            if (c === "'")
+                quote = null;
+            else
+                cur += c;
+        }
+        else if (quote === '"') {
+            const next = cmd[i + 1];
+            if (c === "\\" && (next === '"' || next === "\\")) {
+                cur += next;
+                i++;
+            }
+            else if (c === '"')
+                quote = null;
+            else
+                cur += c;
+        }
+        else if (c === "'" || c === '"') {
+            quote = c;
+            inWord = true;
+        }
+        else if (c === "\\") {
+            if (i + 1 < cmd.length)
+                cur += cmd[++i];
+            inWord = true;
+        }
+        else if (/[|;&<>$()`]/.test(c)) {
+            return undefined;
+        }
+        else if (/\s/.test(c)) {
+            if (inWord)
+                words.push(cur);
+            cur = "";
+            inWord = false;
+        }
+        else {
+            cur += c;
+            inWord = true;
+        }
+    }
+    if (quote !== null)
+        return undefined;
+    if (inWord)
+        words.push(cur);
+    if (words[0] === "git" && words[1] === "grep")
+        return { file: "git", args: words.slice(1) };
+    if (words[0] === "grep")
+        return { file: "grep", args: words.slice(1) };
+    return undefined;
+}
+/** Run each entry's matches-nothing greps in `wt`; one finding per entry, for its first grep that
+ * still prints lines. An exit of 1 passes; any other failure (exit 2, timeout, spawn error) skips
+ * the criterion, since an unrunnable command is not evidence. */
+export async function acceptanceGrepFindings(wt, entries) {
+    const findings = [];
+    for (const entry of entries) {
+        for (const cmd of emptyGrepCriteria(entry.body)) {
+            const argv = grepArgv(cmd);
+            if (argv === undefined)
+                continue;
+            const out = await execFileAsync(argv.file, argv.args, { cwd: wt, timeout: GREP_TIMEOUT_MS }).then((r) => r.stdout, () => "");
+            const lines = out.split("\n").filter((l) => l !== "");
+            if (lines.length === 0)
+                continue;
+            const shown = lines.slice(0, 5).map((l) => truncate(l, 200)).join("; ");
+            findings.push(`PLANS.md's finished entry "${truncate(entry.title, 160)}" says \`${cmd}\` matches nothing, but it prints ` +
+                `${lines.length} line(s): ${shown}${moreSuffix(lines.length - 5)} — fix those lines, or correct the claim if the criterion is wrong`);
+            break;
+        }
+    }
+    return findings;
+}

package/dist/src/run/feedback-filings.js

@@ -0,0 +1,51 @@
+import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
+import { feedbackFilingsPath } from "../paths.js";
+import { isJsonObject } from "../files/json-object.js";
+import { formatAge } from "../text/datetime.js";
+/** The `feedback` observer's per-install filing ledger (plans/feedback-role.md 2/2). Every
+ * `feedback` run starts a fresh pi session, so the only durable record of which GitHub issues
+ * this install already filed must live in harness state — the same cross-run memory qa's
+ * flow-coverage ledger provides (plans/observer-roles.md 2/2), and what makes the next run's
+ * prompt able to render a "previously filed" block so the charter's dedupe does not rely on the
+ * network alone. The ledger is gitignored runtime state under .tumwater/state/ and degrades to
+ * "no data" on any missing or malformed file: an observer must never fail a run on bookkeeping
+ * (a filing that fails to persist is a warning, never a run failure). */
+/** The newest bound the ledger keeps. A fresh session files at most one issue per run, so this
+ * caps the block's growth and the prompt's size; older filings are dropped (the charter still
+ * dedupes against the live `gh issue list`). */
+export const FEEDBACK_FILINGS_MAX = 100;
+function isFiling(value) {
+    if (!isJsonObject(value))
+        return false;
+    return (typeof value.issue === "number" &&
+        typeof value.title === "string" &&
+        typeof value.filedAt === "number");
+}
+/** Read the ledger, keeping only well-formed entries. A missing, torn, or wrong-shaped file
+ * reads as an empty ledger — the caller renders no block and the run proceeds as before. */
+export function readFeedbackFilings(root) {
+    const file = readJsonFile(feedbackFilingsPath(root));
+    const filings = file?.filings;
+    if (!Array.isArray(filings))
+        return [];
+    return filings.filter(isFiling);
+}
+/** Record that this install filed issue `issue` now (or at `now`, for tests). Reads-modifies-
+ * writes the whole ledger atomically so a concurrent writer cannot leave a torn file behind,
+ * and keeps only the newest FEEDBACK_FILINGS_MAX entries. */
+export function recordFiled(root, issue, title, now = Date.now()) {
+    const filings = readFeedbackFilings(root);
+    const entry = { issue, title, filedAt: now };
+    writeJsonAtomic(feedbackFilingsPath(root), {
+        filings: [entry, ...filings].slice(0, FEEDBACK_FILINGS_MAX),
+    });
+}
+/** Render the "previously filed" block for the next `feedback` prompt; undefined when the
+ * ledger is empty (the common first-run case), so the prompt is unchanged then. Newest-first,
+ * each line `#<n> <title> (<age>)` mirroring qa's coverage lines. */
+export function renderFilingsBlock(filings, now = Date.now()) {
+    if (filings.length === 0)
+        return undefined;
+    const lines = filings.map((f) => `  #${f.issue} ${f.title} (${formatAge(now - f.filedAt)})`);
+    return ["Previously filed from this install:", ...lines].join("\n");
+}

package/dist/src/{tick → run}/qa-coverage.js

@@ -1,14 +1,14 @@
-// vocabulary: plain
 import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
 import { qaCoveragePath } from "../paths.js";
-import { isJsonObject } from "../files/json-object.js";
-/** The `qa` observer's flow-coverage ledger (plans/observer-roles.md 2/2). Every `qa` tick
+import { isJsonObject, setOwn } from "../files/json-object.js";
+import { formatAge } from "../text/datetime.js";
+/** The `qa` observer's flow-coverage ledger (plans/observer-roles.md 2/2). Every `qa` run
  * starts a fresh pi session, so the only durable memory of which flow it last exercised is a
  * runtime file the harness — not pi — maintains. A passing cheap check writes nothing into the
- * repo (a note commit per check would move main and wake every sleeping loop), so without this
- * ledger the model picks a flow blind every tick and converges on the top of its menu. The
+ * repo (a note commit per check would move main and wake every sleeping role), so without this
+ * ledger the model picks a flow blind every run and converges on the top of its menu. The
  * ledger is gitignored runtime state under .tumwater/state/ and degrades to "no data" on any
- * missing or malformed file: an observer must never fail a tick on bookkeeping. */
+ * missing or malformed file: an observer must never fail a run on bookkeeping. */
 /** The flows `qa` exercises, cheapest-first — the ordered menu from plans/qa-role.md, plus the
  * expensive `run (real)` variant. The names are the universe the coverage block renders; a flow
  * recorded by name but absent here (a project-specific flow) still renders, appended after. */
@@ -26,16 +26,8 @@ export const QA_FLOWS = [
 function isResult(value) {
     return value === "passed" || value === "bug";
 }
-/** Store one flow under its name. A plain `coverage[flow] = entry` loses a name of `__proto__`:
- * the assignment hits Object.prototype's setter and rewrites the map's prototype instead of
- * adding an own entry, so the flow vanishes from every reader and from the persisted JSON. The
- * qa model's own FLOW line supplies the name, so it crosses an external boundary; defining the
- * own property keeps even that key, matching claude-account's setWindow. */
-function setFlow(coverage, flow, entry) {
-    Object.defineProperty(coverage, flow, { value: entry, enumerable: true, writable: true, configurable: true });
-}
 /** Read the ledger, keeping only well-formed entries. A missing, torn, or wrong-shaped file
- * reads as an empty ledger — the caller renders no block and the tick proceeds as before. */
+ * reads as an empty ledger — the caller renders no block and the run proceeds as before. */
 export function readQaCoverage(root) {
     const file = readJsonFile(qaCoveragePath(root));
     const flows = file?.flows;
@@ -48,7 +40,7 @@ export function readQaCoverage(root) {
         const entry = raw;
         if (typeof entry.lastRunAt !== "number" || !isResult(entry.result))
             continue;
-        setFlow(out, name, {
+        setOwn(out, name, {
             lastRunAt: entry.lastRunAt,
             result: entry.result,
             ...(typeof entry.summary === "string" ? { summary: entry.summary } : {}),
@@ -60,19 +52,9 @@ export function readQaCoverage(root) {
  * whole ledger atomically so a concurrent writer cannot leave a torn file behind. */
 export function recordFlow(root, flow, result, summary, now = Date.now()) {
     const coverage = readQaCoverage(root);
-    setFlow(coverage, flow, { lastRunAt: now, result, ...(summary ? { summary } : {}) });
+    setOwn(coverage, flow, { lastRunAt: now, result, ...(summary ? { summary } : {}) });
     writeJsonAtomic(qaCoveragePath(root), { flows: coverage });
 }
-/** A short age: minutes under an hour, hours under a day, days beyond (`12m`, `4h`, `6d`). */
-function formatAge(ms) {
-    const minutes = Math.max(0, Math.floor(ms / 60_000));
-    if (minutes < 60)
-        return `${minutes}m`;
-    const hours = Math.floor(minutes / 60);
-    if (hours < 24)
-        return `${hours}h`;
-    return `${Math.floor(hours / 24)}d`;
-}
 /** Render the coverage block for the next `qa` prompt. Never-exercised flows lead (age = ∞),
  * then exercised flows oldest-first, so "exercise the flow at the top" actually rotates through
  * the whole menu instead of re-picking whatever is cheapest. The flow universe is `QA_FLOWS`