tumwater 0.2.0 → 0.3.0

package/dist/src/{tick/tick-stage.js → run/run-stage.js}

@@ -1,18 +1,39 @@
-import { commitAll, foldCommitsSince, headOf } from "../git/git.js";
+import { commitAll, foldCommitsSince, headOf, isDirty } from "../git/git.js";
 import { changedFiles } from "../git/git-diff.js";
-import { buildCommitMessage, commitTrailer, extractCommitBody, extractSummary, summaryOverCap, fallbackSummary, formatCommitBody, mergeCommitBody, stampedSubject, } from "../git/commit-message.js";
+import { buildCommitMessage, commitTrailer, extractCommitBody, extractSummary, summaryOverCap, fallbackSummary, formatCommitBody, appendSelfCheckNotes, stampedSubject, } from "../git/commit-message.js";
 import { logEventBestEffort } from "../events/events.js";
 import { enqueueMerge, entryRevisionFields } from "../merge/merge-queue.js";
 import { plural } from "../text/phrases.js";
+import { errorMessage, squash } from "../text/text.js";
 import { recordFlow } from "./qa-coverage.js";
-import { INSTANCE_ROLES, baseRoleOf, configuredInstances } from "../roles/loop-ids.js";
+import { recordFiled } from "./feedback-filings.js";
+import { INSTANCE_ROLES, baseRoleOf, configuredInstances } from "../roles/runner-ids.js";
 import { stagedMovedEntries } from "../scheduling/claims.js";
-import { entryKey } from "../backlog/backlog-eligibility.js";
-import { assignedMovedFinding, heldMovedFinding } from "./stage-check.js";
+import { entryKey } from "../backlog/backlog-parts.js";
+import { assignedMovedFinding, heldMovedFinding } from "./stage-backlog-checks.js";
 import { archiveNewFinishedEntries } from "../backlog/backlog-archive.js";
-/** Fold commits an agent run made since `base` into the tick's tree, keeping the harness commit
- * the tick's only one (INV-H1); warns when any were folded. The one home of the fold-and-warn
- * policy and its wording, shared by the two fold sites — the authoring run (loop-tick.ts) and
+/** The most findings one self-check outcome event carries. */
+const SELF_CHECK_LOGGED_FINDINGS = 12;
+/** The cap on each logged finding's text. */
+const SELF_CHECK_FINDING_CHARS = 300;
+/** The findings as the outcome event records them: capped in count and in each text's length. */
+function findingDigest(findings) {
+    return findings.slice(0, SELF_CHECK_LOGGED_FINDINGS).map((f) => squash(f, SELF_CHECK_FINDING_CHARS));
+}
+/** The self-check's outcome warning. It bypasses `ctx.warn` because it carries fields beyond a
+ * message (the finding texts, and those still open); the event shape is otherwise the same. */
+function logSelfCheckOutcome(ctx, message, findings, remaining = []) {
+    logEventBestEffort(ctx.root, {
+        source: ctx.role,
+        type: "warning",
+        message,
+        findings: findingDigest(findings),
+        ...(remaining.length > 0 ? { open: findingDigest(remaining) } : {}),
+    });
+}
+/** Fold commits an agent run made since `base` into the run's tree, keeping the harness commit
+ * the run's only one (INV-H1); warns when any were folded. The one home of the fold-and-warn
+ * policy and its wording, shared by the two fold sites — the authoring run (runner-run.ts) and
  * this module's follow-up turns — so they cannot drift. */
 export async function foldAgentCommitsSince(ctx, wt, base) {
     const folded = await foldCommitsSince(wt, base);
@@ -20,24 +41,24 @@ export async function foldAgentCommitsSince(ctx, wt, base) {
         ctx.warn(`agent made ${plural(folded, "commit")} during the run; folded into tumwater's commit`);
 }
 /** Stage a changed worktree for the merge queue: derive the commit message from the reply's
- * SUMMARY block (one bounded follow-up turn when the run left none), flag high-friction ticks,
+ * SUMMARY block (one bounded follow-up turn when the run left none), flag high-friction runs,
  * commit, pin the commit by the role's merge ref, and enqueue the merge. Extracted from
- * LoopRunner.runTick so the tick's own method stays the outcome classifier and this module is
- * the commit-staging layer — the only place a fresh tick's work becomes a queued merge.
- * Returns the tick's outcome; a failed pin or an aborted follow-up returns an error/aborted
+ * RoleRunner.runOnce so the run's own method stays the outcome classifier and this module is
+ * the commit-staging layer — the only place a fresh run's work becomes a queued merge.
+ * Returns the run's outcome; a failed pin or an aborted follow-up returns an error/aborted
  * outcome without anything queued. */
-export async function stageTickMerge(ctx) {
+export async function stageRunMerge(ctx) {
     const s = ctx.state;
-    // A revision tick carries the round it applied on its context (loop-tick.ts): it rides onto the
+    // A revision run carries the round it applied on its context (runner-run.ts): it rides onto the
     // queued merge so a rejection of this change records the NEXT round (plans/revise-rejected.md).
-    // Undefined for a fresh change — including a user-request tick that leaves a pending revision
-    // untouched — so only the tick that actually held the rejected diff is labeled a revision.
+    // Undefined for a fresh change — including a user-request run that leaves a pending revision
+    // untouched — so only the run that actually held the rejected diff is labeled a revision.
     const revisionRound = ctx.revisionRound;
     // A revision merge carries the review that rejected the change (plans/revise-rejected.md
     // part 2/2): the prior head, its numbered objections, and each objection's persistence count
     // ride the queued entry so the re-review can check each one against the interdiff and the next
-    // rejection can resolve a `(prior N)` restatement (BUGS.md 2026-10-14). Only a tick that
-    // actually held the rejected diff attaches it; a fresh change — including a user-request tick
+    // rejection can resolve a `(prior N)` restatement (BUGS.md 2026-10-14). Only a run that
+    // actually held the rejected diff attaches it; a fresh change — including a user-request run
     // that leaves a pending revision untouched — and a recovery merge carry none.
     const priorReview = revisionRound !== undefined && s.lastReview?.head
         ? {
@@ -52,18 +73,22 @@ export async function stageTickMerge(ctx) {
     // only if that too yields nothing is the subject derived from the changed paths.
     let summary = extractSummary(ctx.finalText);
     let body = extractCommitBody(ctx.finalText);
+    // True when no reply named the change, so the subject below is derived from its paths.
+    let summaryDerived = false;
     if (summary === null) {
         const base = await headOf(ctx.wt, "HEAD");
         const followUp = await ctx.requestSummary(ctx.wt);
         await foldAgentCommitsSince(ctx, ctx.wt, base);
         if (followUp?.aborted)
-            return ctx.finishAbortedTick();
+            return ctx.finishAbortedRun();
         if (followUp) {
             summary = extractSummary(followUp.finalText);
             body = body ?? extractCommitBody(followUp.finalText);
         }
-        if (summary === null)
+        if (summary === null) {
             summary = fallbackSummary(await changedFiles(ctx.wt), ctx.role, s.runs);
+            summaryDerived = true;
+        }
         ctx.warn(`reply had no SUMMARY line — ` +
             (followUp && extractSummary(followUp.finalText) !== null
                 ? "recovered it with a follow-up turn"
@@ -82,7 +107,7 @@ export async function stageTickMerge(ctx) {
             const followUp = await ctx.requestSummary(ctx.wt, over);
             await foldAgentCommitsSince(ctx, ctx.wt, base);
             if (followUp?.aborted)
-                return ctx.finishAbortedTick();
+                return ctx.finishAbortedRun();
             const short = followUp && summaryOverCap(followUp.finalText) === null ? extractSummary(followUp.finalText) : null;
             if (short !== null) {
                 summary = short;
@@ -99,11 +124,11 @@ export async function stageTickMerge(ctx) {
     // author's own session gets to fix them; the gate still has the final say, and the change commits
     // and queues either way.
     // Claims made at staging (plans/parallel-work-instances.md "Claims", part 4/7): an
-    // unassigned tick of a MULTI-instance base whose diff moved a backlog entry out of its
+    // unassigned run of a MULTI-instance base whose diff moved a backlog entry out of its
     // actionable section records the claim so a sibling is not assigned it while this change
     // merges. A single-runner base has no sibling to hold the entry from, so it stages nothing
-    // and is unchanged by claims. An assigned tick that moved a DIFFERENT entry gets a finding,
-    // so the one fix-up turn can put it back. So does an unassigned tick that moved an entry a
+    // and is unchanged by claims. An assigned run that moved a DIFFERENT entry gets a finding,
+    // so the one fix-up turn can put it back. So does an unassigned run that moved an entry a
     // sibling holds (the poll's heldElsewhere, which its prompt listed as off-limits): that entry
     // is never claimed a second time, and the fix-up turn is asked to drop the duplicate work
     // (BUGS.md 2026-10-12). An unreadable file or git hiccup yields no move and no finding.
@@ -119,7 +144,7 @@ export async function stageTickMerge(ctx) {
         const first = claimable[0];
         s.claim = { file: first.file, key: first.key, title: first.title, at: Date.now(), source: "staged" };
         // The assignment is durable in state before this event; an unwritable feed must not reject
-        // the tick and make a claim that did take effect look unapplied (logEventBestEffort).
+        // the run and make a claim that did take effect look unapplied (logEventBestEffort).
         logEventBestEffort(ctx.root, {
             source: ctx.role,
             type: "claim",
@@ -138,50 +163,59 @@ export async function stageTickMerge(ctx) {
     if (findings.length > 0) {
         const before = findings.length;
         const fixBase = await headOf(ctx.wt, "HEAD");
-        const fixUp = await ctx.requestStageFix(ctx.wt, findings);
+        const fixUp = await ctx.requestStageFix(ctx.wt, findings, {
+            summary: summaryDerived ? null : summary,
+            body: body ? formatCommitBody(body) : "",
+        });
         await foldAgentCommitsSince(ctx, ctx.wt, fixBase);
         if (fixUp?.aborted)
-            return ctx.finishAbortedTick();
+            return ctx.finishAbortedRun();
         if (fixUp) {
-            summary = extractSummary(fixUp.finalText) ?? summary;
-            // Field-by-field: a fix-up reply need only restate the fields it changed, so the
-            // authoring run's other WHY/RISK/VERIFIED lines survive it.
-            body = mergeCommitBody(body, extractCommitBody(fixUp.finalText));
+            // The fix-up reply answers the findings, not the change, so it never replaces the
+            // change's description (BUGS.md 2026-10-21): its SUMMARY is taken only over a subject
+            // derived from the paths, and its RISK/VERIFIED are appended as self-check notes.
+            const fixSummary = summaryDerived ? extractSummary(fixUp.finalText) : null;
+            if (fixSummary !== null)
+                summary = fixSummary;
+            body = appendSelfCheckNotes(body, extractCommitBody(fixUp.finalText));
         }
         // A fix-up turn may resolve its findings by reverting the whole change. With nothing left
-        // in the worktree there is nothing to commit or queue: end the tick no_change here instead
+        // in the worktree there is nothing to commit or queue: end the run no_change here instead
         // of handing a clean tree to commitAll. The worktree is left clean and no pin is taken.
-        if ((await changedFiles(ctx.wt)).length === 0) {
-            ctx.warn("stage self-check: the follow-up turn left no change; nothing to land");
+        // isDirty, not changedFiles: a `git status` that fails must throw, not read as clean — on
+        // 2026-10-21 a spawn failure here ended bugfix-2's 17-minute run no_change and released
+        // its edits unpinned; thrown, the run ends unsettled and its next run gets them back.
+        if (!(await isDirty(ctx.wt))) {
+            logSelfCheckOutcome(ctx, "stage self-check: the follow-up turn left no change; nothing to land", findings);
             return { result: "no_change" };
         }
         const remaining = await ctx.stageCheck(ctx.wt);
-        ctx.warn(remaining.length === 0
+        logSelfCheckOutcome(ctx, remaining.length === 0
             ? `stage self-check: ${plural(before, "finding")} — fixed by the follow-up turn`
-            : `stage self-check: ${plural(before, "finding")}; ${remaining.length} still open, queued for the gate`);
+            : `stage self-check: ${plural(before, "finding")}; ${remaining.length} still open, queued for the gate`, findings, remaining);
     }
-    // Friction as a signal (plans/refusal-and-thrash.md): a changed tick that burned BOTH more
+    // Friction as a signal (plans/refusal-and-thrash.md): a changed run that burned BOTH more
     // than thrashTurns turns and thrashMinutes of wall clock is flagged high-friction —
     // difficulty suggests the work may not fit, so it goes to review marked and leaves a warning
     // event. Requiring both (not either) keeps the absolute turn count from measuring model
     // speed: a fast model emits 40+ turns in a few minutes, which is ordinary work, not
-    // difficulty (BUGS.md 2026-09-19). Measured over this tick's main authoring run (a transient
+    // difficulty (BUGS.md 2026-09-19). Measured over this run's main authoring run (a transient
     // retry included via runAuthoringPi), like the trailer; conflict-resolution runs happen later
     // inside merge().
     const minutes = (Date.now() - ctx.piStartedAt) / 60_000;
-    // Friction is measured over this tick's authoring runs only — the review gate folds its
-    // run into tickTurns AFTER the commit, so every friction artifact (flag, warning event,
+    // Friction is measured over this run's authoring runs only — the review gate folds its
+    // run into runTurns AFTER the commit, so every friction artifact (flag, warning event,
     // trailer line, final summary) reads this pre-gate snapshot instead of the live counter.
-    const authoringTurns = ctx.tickTurns;
+    const authoringTurns = ctx.runTurns;
     const highFriction = authoringTurns > ctx.config.thrashTurns && minutes > ctx.config.thrashMinutes;
     if (highFriction) {
         ctx.warn(`high-friction run: ${authoringTurns} turns in ${Math.round(minutes)} min ` +
             `(thresholds: ${ctx.config.thrashTurns} turns / ${ctx.config.thrashMinutes} min)`);
     }
-    // The trailer is harness-stamped truth: turns and peak ctx over this tick's pre-commit
+    // The trailer is harness-stamped truth: turns and peak ctx over this run's pre-commit
     // runs only (conflict-resolution and review runs fold after the commit). A high-friction
-    // tick appends its Friction line here — both values are already computed above.
-    const message = buildCommitMessage(stampedSubject(baseRoleOf(ctx.role), summary), body, commitTrailer(ctx.role, s.runs, authoringTurns, s.peakContextTokens, highFriction ? minutes : undefined, revisionRound));
+    // run appends its Friction line here — both values are already computed above.
+    const message = buildCommitMessage(stampedSubject(baseRoleOf(ctx.role), summary), body, commitTrailer(ctx.role, s.runs, authoringTurns, s.peakContextTokens, highFriction ? minutes : undefined, revisionRound, ctx.modelLine));
     // The backlog archive (plans/backlog-archive.md): an entry this change pasted under PLANS.md's
     // ## Done or BUGS.md's ## Fixed moves to the top of PLANS-DONE.md or BUGS-FIXED.md now, after
     // the self-check and its fix-up turn worked on the tree the author wrote and before the
@@ -193,19 +227,19 @@ export async function stageTickMerge(ctx) {
     // Pin the commit by its merge ref BEFORE freeing the worktree (invariant 4), then hand it
     // to the merge queue: from here on the review gate and the rebase run in a verification's
     // leased pool slot, never in this worktree (plans/merge-queue.md 2/5). A failed pin defers to
-    // next-tick recovery — merge without a pin would lose the ref lifecycle this whole flow depends
+    // next-run recovery — merge without a pin would lose the ref lifecycle this whole flow depends
     // on. The reviewer checks the author's claimed WHY/VERIFIED against the actual diff; no diff
     // reaches main unreviewed.
     if (!(await ctx.pinAndReset(ctx.wt, commit))) {
         s.lastError = "failed to pin the merge ref; left for the next run's recovery";
         return { result: "error", summary: s.lastError };
     }
-    // The commit is pinned and the worktree is free: enqueue the merge and END the tick — the
+    // The commit is pinned and the worktree is free: enqueue the merge and END the run — the
     // orchestrator drains the queue on its single merge slot, outside the author semaphore, so
     // this slot is free the moment the work is committed (plans/merge-queue.md 3/5). The merge
     // runs the same gate + merge flow through runMergePi/foldMergeUsage on this same state
     // object — recording the commit count, the outcome, and the reviewer spend into it — and logs
-    // merge_done/merge_failed; a non-terminal outcome keeps the pin for next-tick leftover recovery.
+    // merge_done/merge_failed; a non-terminal outcome keeps the pin for next-run leftover recovery.
     // `commits` was NOT incremented above: it counts merged changes only.
     enqueueMerge(ctx.root, {
         role: ctx.role,
@@ -224,14 +258,38 @@ export async function stageTickMerge(ctx) {
     if (revisionRound !== undefined)
         s.revision = undefined;
     // The merge sits in the durable queue above and the commit is pinned; the event is
-    // observability, so an unwritable feed must not reject a tick whose work is already queued.
+    // observability, so an unwritable feed must not reject a run whose work is already queued.
     logEventBestEffort(ctx.root, { source: ctx.role, type: "merge_queued", commit, summary });
     // The flag's durable record is the Friction trailer line stamped on the commit above;
     // lastSummary and the run_end event carry it too for dashboards and logs.
     const finalSummary = highFriction
         ? `${summary} (high friction: ${authoringTurns} turns / ${Math.round(minutes)}m)`
         : summary;
-    if (ctx.flow)
-        recordFlow(ctx.root, ctx.flow.flow, ctx.flow.result, ctx.flow.result === "bug" ? summary : undefined);
+    if (ctx.flow) {
+        // The merge is already queued and the ledger only orders the qa menu, so a failed write
+        // warns rather than failing the run.
+        try {
+            recordFlow(ctx.root, ctx.flow.flow, ctx.flow.result, ctx.flow.result === "bug" ? summary : undefined);
+        }
+        catch (err) {
+            ctx.warn(`qa flow "${ctx.flow.flow}" not recorded: ${errorMessage(err)}`);
+        }
+    }
+    // A feedback run that somehow changed the tree still records its filing, exactly as the
+    // qa flow does above — a filing is a result independent of the run leaving files behind.
+    if (ctx.filed) {
+        logEventBestEffort(ctx.root, {
+            source: ctx.role,
+            type: "issue_filed",
+            issue: ctx.filed.issue,
+            title: ctx.filed.title,
+        });
+        try {
+            recordFiled(ctx.root, ctx.filed.issue, ctx.filed.title);
+        }
+        catch (err) {
+            ctx.warn(`feedback filing #${ctx.filed.issue} not recorded: ${errorMessage(err)}`);
+        }
+    }
     return { result: "queued", summary: finalSummary, commit, highFriction };
 }

package/dist/src/{tick/tick-timing.js → run/run-timing.js}

@@ -1,26 +1,25 @@
-// vocabulary: plain
 import { BUILD_CHECK_TIMEOUT_MS } from "../build/build-check-detect.js";
-import { warnEvent, TUMWATER_SOURCE } from "../events/events.js";
+import { warnEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { removeQuiet } from "../files/files.js";
 import { mergeStatePath } from "../paths.js";
 import { runOnAbort } from "../process/process.js";
-/** The orchestrator's tick-timing and scheduling seams (src/orchestrator/orchestrator.ts
+/** The orchestrator's run-timing and scheduling seams (src/orchestrator/orchestrator.ts
  * keeps the poll loop itself — the control flow that calls these). Each is exported as a
- * unit-test seam (test/orchestrator-seams.test.ts): timing a semaphore-gated tick, an
+ * unit-test seam (test/orchestrator-seams.test.ts): timing a semaphore-gated run, an
  * abort-interruptible sleep, and the restart hand-off's bounded wait on the in-flight merge.
  * Split out of orchestrator.ts — which had grown into both the poll loop and the timing helpers
  * it schedules with — so the loop reads as control flow over these named steps. The team-health
  * polls (the team hold, the error-storm warning, the failure-spread alarm) are their own family
  * in src/team/team-polls.ts. */
-/** How many completed role-tick samples the p75 needs before it is trusted as the drain window.
+/** How many completed role-run samples the p75 needs before it is trusted as the drain window.
  * Below this the orchestrator reports no p75 and poll keeps the cold-start constant. */
 const DRAIN_P75_MIN_SAMPLES = 10;
-/** The p75 of completed role-tick durations (ms), or null when there are too few samples to
- * trust. The orchestrator's half of the adaptive drain window (BUGS.md 2026-09-18): a tick that
+/** The p75 of completed role-run durations (ms), or null when there are too few samples to
+ * trust. The orchestrator's half of the adaptive drain window (BUGS.md 2026-09-18): a run that
  * finishes inside it is waited for, a longer one is aborted resumably. The samples come from
- * runTimedRoleTick above; the consumer is the redeploy policy's InFlightCounts.roleTickP75Ms.
+ * runTimedRoleRun above; the consumer is the redeploy policy's InFlightCounts.roleRunP75Ms.
  * Exported for its unit test; the p75 is the statistic the bug's expected fix names. */
-export function p75TickDurationMs(durations) {
+export function p75RunDurationMs(durations) {
     if (durations.length < DRAIN_P75_MIN_SAMPLES)
         return null;
     const sorted = [...durations].sort((a, b) => a - b);
@@ -29,8 +28,8 @@ export function p75TickDurationMs(durations) {
 /** How long a restart's hand-off waits on an in-flight merge, per phase: one window for it to
  * finish on its own, then — having aborted it — one more for the step it was in to end
  * (awaitMergeForHandoff; BUGS.md 2026-09-23). By the time a restart reaches its `finally` the new
- * build is already in dist/ and every role tick is done or aborted, so the merge is all the team
- * is still running: each minute spent on it is a minute nothing else ticks. A merge's unbounded
+ * build is already in dist/ and every role run is done or aborted, so the merge is all the team
+ * is still running: each minute spent on it is a minute nothing else runs. A merge's unbounded
  * part is model work — its reviewer run (and, until 2026-09-24, a gate build-fix run: the
  * 2026-09-23 one held the slot for 4 h 35 m and that day's hand-off sat through 97 minutes of it).
  * Its deterministic part is bounded: at most one build check (BUILD_CHECK_TIMEOUT_MS) plus git
@@ -38,35 +37,35 @@ export function p75TickDurationMs(durations) {
  * last check and fast-forward — merge, and gives an aborted merge's current step (a check, which
  * no abort reaches) time to end, so the hand-off does not leave a check running in a merger
  * worktree the next generation is about to reset. Not the drain's window: that is the p75 of whole
- * role ticks (over an hour on this team) — the very lag this bounds. */
+ * role runs (over an hour on this team) — the very lag this bounds. */
 export const HANDOFF_MERGE_WINDOW_MS = BUILD_CHECK_TIMEOUT_MS + 60_000;
-/** Run one role tick under the concurrency semaphore and return how long the tick itself ran,
+/** Run one role run under the concurrency semaphore and return how long the run itself ran,
  * in ms — null when it never started (the harness is already stopping, or `held`) or was cut
  * off by an abort. This is the restart drain's p75 sample (BUGS.md 2026-09-18). The clock starts
- * only once the permit is granted, so time a tick spends parked in the semaphore queue is not
- * counted as work: the drain waits on ticks that are already running, and folding queue wait
+ * only once the permit is granted, so time a run spends parked in the semaphore queue is not
+ * counted as work: the drain waits on runs that are already running, and folding queue wait
  * into the window would overstate how long they have left (the `run_start`..`run_end` span
- * the window was sized against excludes it too). Aborted ticks return null so their short
- * cut-off lengths cannot drag the window down. So do ticks that ended with nothing to show
+ * the window was sized against excludes it too). Aborted runs return null so their short
+ * cut-off lengths cannot drag the window down. So do runs that ended with nothing to show
  * (`no_change`, `skipped`): a `main moved` re-check runs the model and still finishes in
  * seconds, and sampling it equally let a team's window collapse to the re-check scale and
  * cut real work off minutes into its run (BUGS.md 2026-09-30) — only a work-bearing outcome
  * says how long the work the drain waits on takes. `now` is a test seam.
  *
- * `held` is the team-wide hold on new ticks (today the restart drain's), re-checked at the one
- * moment a reserved tick actually begins: when its permit is granted. A tick scheduled before
+ * `held` is the team-wide hold on new runs (today the restart drain's), re-checked at the one
+ * moment a reserved run actually begins: when its permit is granted. A run scheduled before
  * the hold may have parked in the semaphore queue long before it; checking the hold only at
  * scheduling let every such waiter start a fresh pi run mid-drain as slots freed — the very
- * ticks the restart then aborted (BUGS.md 2026-09-23). A held tick releases its permit without
- * calling `tick`, so it writes no state and logs no run_start/run_end; the caller hands its
+ * runs the restart then aborted (BUGS.md 2026-09-23). A held run releases its permit without
+ * calling `run`, so it writes no state and logs no run_start/run_end; the caller hands its
  * reservation back. */
-export async function runTimedRoleTick(signal, acquire, release, tick, now = Date.now, held = () => false) {
+export async function runTimedRoleRun(signal, acquire, release, run, now = Date.now, held = () => false) {
     await acquire();
     try {
         if (signal.aborted || held())
             return null;
         const startedAt = now();
-        const outcome = await tick();
+        const outcome = await run();
         if (outcome.result === "aborted" || outcome.result === "user_aborted")
             return null;
         if (outcome.result === "no_change" || outcome.result === "skipped")
@@ -81,7 +80,7 @@ export async function runTimedRoleTick(signal, acquire, release, tick, now = Dat
  * abort) is prompt instead of waiting out the current poll cycle. The listener is removed
  * on either exit path so long-running orchestrators don't accumulate one per poll, and an
  * already-aborted signal returns synchronously through runOnAbort. Exported as a unit-test
- * seam, like runTimedRoleTick above. */
+ * seam, like runTimedRoleRun above. */
 export function sleepInterruptible(ms, signal) {
     return new Promise((resolve) => {
         const onAbort = () => {
@@ -126,7 +125,7 @@ function settlesWithin(promise, ms, after) {
  * swap by 97 minutes, in silence. The wait is announced as it starts (one warning naming the
  * merge's roles), so the feed says why `restarting onto build …` is not yet followed by
  * `orchestrator stopped`. Past `windowMs` the merge is stopped the way the drain gives up on role
- * ticks: `abort` fires the harness's internal stop, which kills its pi runs at once and makes it
+ * runs: `abort` fires the harness's internal stop, which kills its pi runs at once and makes it
  * stop at its next step boundary (merge-core.ts, merge-batch.ts, and merge-stack.ts check the
  * signal before every gate, every approved merge, and each of a stack's check attempts), and a
  * warning names what was still awaited. An aborted merge records `aborted` like any shutdown
@@ -134,24 +133,25 @@ function settlesWithin(promise, ms, after) {
  * new build. One still running a window after the abort (a step wedged past its own bound) is left
  * behind: its 4/5 marker is cleared here, since this process exits the moment the hand-off returns,
  * and its entries and pins survive exactly as a crash leaves them — the next generation's first
- * drain re-merges them. Exported as a unit-test seam, like runTimedRoleTick. */
+ * drain re-merges them. Its announcements are best-effort: an events feed that cannot be written
+ * does not shorten the wait. Exported as a unit-test seam, like runTimedRoleRun. */
 export async function awaitMergeForHandoff(root, merge, windowMs, abort, after = realAfterDelay) {
     const roles = merge.roles.join(", ");
     const deadline = `${windowMs / 1000}s`;
-    warnEvent(root, TUMWATER_SOURCE, `restart waiting on the merge in progress for ${roles} (deadline ${deadline})`);
+    warnEventBestEffort(root, TUMWATER_SOURCE, `restart waiting on the merge in progress for ${roles} (deadline ${deadline})`);
     if (await settlesWithin(merge.promise, windowMs, after))
         return "finished";
     abort();
-    warnEvent(root, TUMWATER_SOURCE, `restart: the merge for ${roles} outlived its ${deadline} deadline — aborted; its pinned commits survive for the next restart`);
+    warnEventBestEffort(root, TUMWATER_SOURCE, `restart: the merge for ${roles} outlived its ${deadline} deadline — aborted; its pinned commits survive for the next restart`);
     if (await settlesWithin(merge.promise, windowMs, after))
         return "aborted";
     removeQuiet(mergeStatePath(root));
-    warnEvent(root, TUMWATER_SOURCE, `restart: the aborted merge for ${roles} was still running ${deadline} later — restarting without it; its queue entries and pinned commits survive for the next restart`);
+    warnEventBestEffort(root, TUMWATER_SOURCE, `restart: the aborted merge for ${roles} was still running ${deadline} later — restarting without it; its queue entries and pinned commits survive for the next restart`);
     return "abandoned";
 }
 /**
  * Drain the orchestrator's in-flight work at shutdown: wait out the reserved role and director
- * ticks, and await the merge pipeline's tasks beside them — and how depends on what comes
+ * runs, and await the merge pipeline's tasks beside them — and how depends on what comes
  * next. On an operator stop the harness signal has already aborted the merge — its pi runs die
  * and it stops at its next step boundary, ending "aborted" with its ref kept and its entry
  * dropped for next-start recovery — and it is waited out: returning early would remove
@@ -159,15 +159,16 @@ export async function awaitMergeForHandoff(root, merge, windowMs, abort, after =
  * concurrent merger (a second Ctrl+C still forces the exit). On a restart the caller exits for
  * the next generation the moment this returns, and a merge is not bounded by one reviewer run
  * — a merge's check follows the verifications' — so the wait is a bounded hand-off that
- * announces itself (awaitMergeForHandoff; BUGS.md 2026-09-23). "The merge" is every merge task
- * at once — each verification holding a permit, and the merge — waited on (and, past the hand-off's
- * window, aborted) together under the roles of them all. The approved changes waiting for the
- * merge have no task, and a verification still parked for its permit has started nothing (a
+ * announces itself (awaitMergeForHandoff; BUGS.md 2026-09-23). The announcements are best-effort:
+ * an events feed that cannot be written does not shorten the wait. "The merge" is every merge task
+ * at once — each verification holding a permit, and the merge — waited on (and, past the
+ * hand-off's window, aborted) together under the roles of them all. The approved changes waiting
+ * for the merge have no task, and a verification still parked for its permit has started nothing (a
  * shutdown settles it at once; a restart's closed start gate at its grant): all of them keep their
  * entries and pins for the next start.
  */
 export async function drainInFlightWork(root, roleInFlight, directorInFlight, inFlight, restart, handoffWindowMs, abort, after = realAfterDelay) {
-    const ticks = Promise.allSettled([...roleInFlight, ...directorInFlight]);
+    const runs = Promise.allSettled([...roleInFlight, ...directorInFlight]);
     const merge = inFlight.length === 0
         ? null
         : {
@@ -179,18 +180,19 @@ export async function drainInFlightWork(root, roleInFlight, directorInFlight, in
         // wires the harness signal to its controller, and a conflict-resolution run watches the
         // harness signal alone (runMergePi). Nothing else it reaches can start work here — the
         // director has finished, permit holders were aborted at the restart, and a parked waiter
-        // meets the closed start gate (tickStartHeld) whenever it is granted a permit.
+        // meets the closed start gate (runStartHeld) whenever it is granted a permit.
         const outcome = await awaitMergeForHandoff(root, merge, handoffWindowMs, abort, after);
         // An abandoned merge still holds its permit, so a waiter parked behind it would never be
-        // granted one and never settle. The ticks have had both windows beside the hand-off, so
+        // granted one and never settle. The runs have had both windows beside the hand-off, so
         // whatever is still reserved then started nothing (or is wedged like the merge): the
         // hand-off goes ahead without it too.
         if (outcome !== "abandoned")
-            await ticks;
+            await runs;
     }
     else {
-        if (merge)
-            warnEvent(root, TUMWATER_SOURCE, `shutdown waiting on the merge in progress for ${merge.roles.join(", ")}`);
-        await Promise.allSettled([ticks, merge?.promise]);
+        if (merge) {
+            warnEventBestEffort(root, TUMWATER_SOURCE, `shutdown waiting on the merge in progress for ${merge.roles.join(", ")}`);
+        }
+        await Promise.allSettled([runs, merge?.promise]);
     }
 }