tumwater 0.2.0 → 0.3.0

package/dist/src/{tick/tick-usage.js → run/run-usage.js}

@@ -1,18 +1,18 @@
 import { runCostIsReal } from "../pi/pi-run-result.js";
 import { recordDailyCost } from "../budget/budget.js";
 import { nonNegativeNumber } from "../files/json-object.js";
-/** Usage accounting for one role loop, split out of loop.ts — which keeps the tick lifecycle —
- * because token/cost/turn bookkeeping is a self-contained concern with its own consumers: the
+/** Usage accounting for one role runner, split out of runner.ts — which keeps the run lifecycle
+ * — because token/cost/turn bookkeeping is a self-contained concern with its own consumers: the
  * commit trailer reads turns, the run_end event reads costUsd, and the orchestrator's team-wide
  * hold reads lastRateLimit and lastBackendFailure (src/team/team-hold.ts,
  * src/team/team-polls.ts).
  *
- * fold() is the once-per-run choke point: every pi run of a tick — main attempt, transient
+ * fold() is the once-per-run choke point: every pi run of a run — main attempt, transient
  * retry, conflict resolution, merge runs via foldMergeUsage — ends up here exactly once, so
  * adding a usage field to PiRunResult touches this single place. */
 /** One persisted counter, healed to a finite non-negative number before it is read and
- * rewritten: `generatedTokens`/`peakContextTokens` are per-tick windows and `totalCostUsd` a
- * lifetime total. `loadLoopState` already heals every top-level numeric state field on read,
+ * rewritten: `generatedTokens`/`peakContextTokens` are per-run windows and `totalCostUsd` a
+ * lifetime total. `loadRunnerState` already heals every top-level numeric state field on read,
  * but fold keeps its own invariant at this write choke point so a hand-edited or torn field (a
  * string that would make `+=` concatenate, NaN/±Infinity that would propagate through Math.max
  * and every display of the figure, or a negative that would run a total backwards) can never
@@ -21,46 +21,51 @@ import { nonNegativeNumber } from "../files/json-object.js";
 function counter(value) {
     return nonNegativeNumber(value, 0);
 }
-/** One role loop's per-tick usage accounting: the counters fold() grows from each pi run, plus
- * the billing and rate-window readings the orchestrator persists at tick end. */
-export class TickUsage {
-    /** Assistant turns folded into THIS tick so far (non-persisted): reset at tick start,
+/** One role runner's per-run usage accounting: the counters fold() grows from each pi run, plus
+ * the billing and rate-window readings the orchestrator persists at run end. */
+export class RunUsage {
+    /** Assistant turns folded into THIS run so far (non-persisted): reset at run start,
      * grown in fold. Read at commit time for the trailer, where it holds exactly the
      * pre-commit runs' total (main + transient retry) — conflict-resolution and review runs
-     * fold after the commit and never inflate it. Deliberately not on LoopState: its only
+     * fold after the commit and never inflate it. Deliberately not on RunnerState: its only
      * consumer is the trailer stamped into the commit message itself, which is durable. */
     turns = 0;
-    /** USD cost folded into THIS tick so far (non-persisted): reset at tick start alongside
-     * turns, grown in fold. Deliberately not on LoopState — unlike generatedTokens, no
+    /** USD cost folded into THIS run so far (non-persisted): reset at run start alongside
+     * turns, grown in fold. Deliberately not on RunnerState — unlike generatedTokens, no
      * dashboard reads it mid-run; its only consumer is the run_end event, which fires before
-     * the next tick resets it (plans: per-tick usage in the event feed). */
+     * the next run resets it (plans: per-run usage in the event feed). */
     costUsd = 0;
-    /** Subscription runs' cost folded into THIS tick (non-persisted): API-equivalent spend the
+    /** Subscription runs' cost folded into THIS run (non-persisted): API-equivalent spend the
      * run reported but that never charges the daily cap (plans/agent-backends.md part 6a). The
-     * run_end event carries it and the report shows it on its own notional line. Reset at tick
+     * run_end event carries it and the report shows it on its own notional line. Reset at run
      * start like costUsd. */
     notionalCostUsd = 0;
-    /** How the tick's runs were last reported as paid for, and the newest subscription
+    /** How the run's runs were last reported as paid for, and the newest subscription
      * rate-window readings any of them carried — the account state (claude-account.ts) the
-     * orchestrator persists at tick end. Per-tick windows: reset at tick start, the last
-     * reporting run of the tick wins. Undefined until a run reports them. */
+     * orchestrator persists at run end. Per-run windows: reset at run start, the last
+     * reporting run of the run wins. Undefined until a run reports them. */
     billing;
     rateWindows;
-    /** Prompt tokens folded into THIS tick so far (non-persisted, reset at tick start). Every
-     * pi run of the tick contributes — the authoring run, its transient retry, the SUMMARY
+    /** The backend id whose run last reported billing or rate windows (subscription-account.ts's
+     * per-backend file owner): "claude" for example. Undefined until a run that reported either
+     * folds in. Only meaningful beside billing/rateWindows — a pi run reports neither and owns
+     * no account file. */
+    agent;
+    /** Prompt tokens folded into THIS run so far (non-persisted, reset at run start). Every
+     * pi run of the run contributes — the authoring run, its transient retry, the SUMMARY
      * follow-up, and (through foldMergeUsage) review and conflict-resolution runs — because
      * all of them re-send context the operator paid for. */
     promptTokens = 0;
     /** The cache-read share of promptTokens folded so far. */
     cacheReadTokens = 0;
-    /** Prompt tokens folded before the tick's first edit: authoring runs only, frozen once an
-     * authoring run reports an edit (plans/per-tick-prompt-telemetry). Merge, review and
+    /** Prompt tokens folded before the run's first edit: authoring runs only, frozen once an
+     * authoring run reports an edit (plans/per-run-prompt-telemetry). Merge, review and
      * conflict-resolution runs are excluded — their context is the gate's, not the authoring
-     * tick's pre-edit search. */
+     * run's pre-edit search. */
     preEditPromptTokens = 0;
     /** True once an authoring run has reported a first edit; the pre-edit counter freezes. */
     editSeen = false;
-    /** This loop's most recent pi run that ended on a provider 429 — author run, retry,
+    /** This role's most recent pi run that ended on a provider 429 — author run, retry,
      * reviewer or merge run alike, since every one folds through fold — with the provider's
      * Retry-After hint when it sent one. The orchestrator reads it every poll as this role's
      * rate-limit input to the team-wide hold (src/team/team-hold.ts): the per-run retry has no
@@ -68,38 +73,39 @@ export class TickUsage {
      * fact without a new cross-module channel. In memory only — a hold is minutes long, so a
      * restart forgetting it costs nothing. Undefined until the first such run. */
     lastRateLimit;
-    /** Per-provider spend folded into THIS tick (non-persisted, reset at tick start): each
+    /** Per-provider spend folded into THIS run (non-persisted, reset at run start): each
      * run's real/notional cost keyed by the provider it ran on, so the run_end event can say
      * which seam of a mixed team spent what (plans: per-provider spend in the day report). A
      * run whose provider was never resolved attributes nothing — the `provider !== undefined`
-     * guard below skips the bump — so an old single-provider tick keeps today's byte-identical
+     * guard below skips the bump — so an old single-provider run keeps today's byte-identical
      * behavior. Parallel to costUsd/notionalCostUsd, never subtracted from them. */
     providerCost = new Map();
-    /** This loop's most recent pi run that ended on a provider-wide failure that was NOT rate
+    /** This role's most recent pi run that ended on a provider-wide failure that was NOT rate
      * limiting — the connection down, a 5xx, the model failing to load (PiRunResult.
      * transientBackend) — with the kind the hold's storm test groups storms by. Stamped under
      * the same rule and for the same consumer as lastRateLimit above: the team-wide hold
      * (src/team/team-hold.ts) reads it every poll. In memory only, like lastRateLimit.
      * Undefined until the first such run. */
     lastBackendFailure;
-    /** Clear the per-tick windows (turns, costUsd, the prompt-token counters) at tick start.
+    /** Clear the per-run windows (turns, costUsd, the prompt-token counters) at run start.
      * lastRateLimit and lastBackendFailure are NOT cleared: they are episodic observations the
-     * orchestrator's hold consumes, not per-tick windows. */
+     * orchestrator's hold consumes, not per-run windows. */
     reset() {
         this.turns = 0;
         this.costUsd = 0;
         this.notionalCostUsd = 0;
         this.billing = undefined;
         this.rateWindows = undefined;
+        this.agent = undefined;
         this.promptTokens = 0;
         this.cacheReadTokens = 0;
         this.preEditPromptTokens = 0;
         this.editSeen = false;
         this.providerCost = new Map();
     }
-    /** Fold one pi run's usage into the tick's counters (gen / peak ctx / cost / turns) and
-     * the loop's lifetime totals on `s`. `authoring` is false for a merge/review run folded
-     * through foldMergeUsage: those never advance the tick's pre-edit counter, which measures
+    /** Fold one pi run's usage into the run's counters (gen / peak ctx / cost / turns) and
+     * the role's lifetime totals on `s`. `authoring` is false for a merge/review run folded
+     * through foldMergeUsage: those never advance the run's pre-edit counter, which measures
      * the authoring search. */
     fold(s, run, authoring = true, provider, pair) {
         s.generatedTokens = counter(s.generatedTokens) + run.outputTokens;
@@ -111,8 +117,8 @@ export class TickUsage {
         if (runCostIsReal(run)) {
             this.costUsd += run.costUsd;
             // The daily cost budget window (plans/daily-cost-budget.md): every real-money pi run of
-            // a tick folds here exactly once, so the team's spend for the local day is complete at
-            // each tick end.
+            // a run folds here exactly once, so the team's spend for the local day is complete at
+            // each run end.
             recordDailyCost(s, run.costUsd, Date.now(), pair);
             this.bumpProviderCost(provider, run.costUsd, 'costUsd');
         }
@@ -124,9 +130,11 @@ export class TickUsage {
             this.billing = run.billing;
         if (run.rateWindows !== undefined)
             this.rateWindows = run.rateWindows;
+        if (run.billing !== undefined || run.rateWindows !== undefined)
+            this.agent = run.agent;
         this.promptTokens += run.promptTokens;
         this.cacheReadTokens += run.cacheReadTokens;
-        // The pre-edit prefix freezes at the tick's first edit: every authoring run while no edit
+        // The pre-edit prefix freezes at the run's first edit: every authoring run while no edit
         // has been seen adds its pre-edit count (including the run that edits), and once one
         // reports an edit later runs add nothing. A review/merge run is skipped entirely.
         if (authoring) {
@@ -149,7 +157,7 @@ export class TickUsage {
         if (run.transientBackend && !run.ok && run.backendKind)
             this.lastBackendFailure = { at: Date.now(), kind: run.backendKind, provider };
     }
-    /** Add `amount` to one field of the tick's per-provider spend ledger, initializing the
+    /** Add `amount` to one field of the run's per-provider spend ledger, initializing the
      * provider's entry on first contact. `provider` undefined (a run that never resolved one)
      * is a no-op, matching how fold calls it: only runs with a provider reach this. */
     bumpProviderCost(provider, amount, field) {
@@ -161,7 +169,7 @@ export class TickUsage {
     }
     /** Serialize the per-provider split for the run_end payload: a `Record<provider,
      * {costUsd, notionalCostUsd}>`, or `{}` when no run carried a provider — the
-     * omit-when-empty idiom tick-finalize.ts applies, so a tick whose runs never resolved a
+     * omit-when-empty idiom run-finalize.ts applies, so a run whose runs never resolved a
      * provider renders no providerCost field at all. */
     serializeProviderCost() {
         const out = {};

package/dist/src/{tick/tick-verdict.js → run/run-verdict.js}

@@ -1,33 +1,47 @@
 import { imageReroute } from "../agent/image-input.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { isDirty, deleteRef } from "../git/git.js";
-import { applyConfigRequest } from "../config/config-write.js";
+import { applyConfigRequest } from "../config/config-request.js";
 import { diagnoseNoChange, extractNoChangeAnswer } from "../verdict/no-change.js";
 import { handleRefusal, refusalContradiction } from "../verdict/refusal.js";
 import { extractSummary } from "../git/commit-message.js";
+import { errorMessage } from "../text/text.js";
 import { recordFlow } from "./qa-coverage.js";
+import { recordFiled } from "./feedback-filings.js";
 import { resetWorktreeToMain } from "../git/worktree.js";
+import { readPiListedModels } from "../pi/pi-listed-models.js";
 import { rejectedRefName } from "../paths.js";
 import { logEventBestEffort } from "../events/events.js";
 import { subscriptionWindowRejected } from "../agent/claude/claude-account.js";
+/** End a run as an abort that arms a resume, the arming the subscription-rejected and
+ * budget-capped arms share: the lease release reads `resumePending` as soon as the run
+ * returns (runOnceInLeasePhase), before applyRunOutcome runs, so without this the slot is
+ * detached and the kept worktree/session edits are lost. Filed here so that arming's timing
+ * invariant cannot drift between the two arms (the error-dirty arm arming itself inline). */
+function abortWithResume(s, ctx, pi, lastError, result, resumeCause) {
+    s.lastError = pi.errorMessage ?? lastError;
+    s.resumePending = true;
+    ctx.pending.requeueForResume(s, ctx.userPrompt);
+    return { result, resumeCause };
+}
 /** Classify what the finished run left behind; null means the run is fulfillable and staging
  * should take over. Never throws: every branch returns an outcome, recording what went wrong
  * in `state.lastError` or a warning event. */
-export async function resolveTickVerdict(ctx) {
+export async function resolveRunVerdict(ctx) {
     const { pi, state: s } = ctx;
     // A run whose `--resume` target the backend no longer holds records why before any branch
-    // returns: the resume guard the next tick consults is the transcript FILE, which can outlive
+    // returns: the resume guard the next run consults is the transcript FILE, which can outlive
     // the conversation (a torn/empty file, or the fake's planted one), so this verdict must
     // outrank it. The failed-dirty arm below is the common case, but an aborted, quiet-killed, or
-    // progressing-timeout run keeps the same session and arms the same resume (tick-apply.ts), so
-    // recording it once here covers every path that resumes (BUGS.md 2026-10-09). Director ticks
+    // progressing-timeout run keeps the same session and arms the same resume (run-apply.ts), so
+    // recording it once here covers every path that resumes (BUGS.md 2026-10-09). Director runs
     // never resume, so the flag is role-only.
     if (pi.resumeMissing && ctx.role !== DIRECTOR_ROLE)
         s.resumeMissing = true;
     // A killed run (shutdown or timeout) may leave half-done edits; never commit those.
-    // The next tick's reset discards them.
+    // The next run's reset discards them.
     if (pi.aborted)
-        return ctx.finishAbortedTick();
+        return ctx.finishAbortedRun();
     ctx.pending.clear();
     // Harness-mediated config writes (plans/portability.md §3/7): the director may have left a
     // config request in its worktree. Consume it here — after the abort return (a deliberate
@@ -35,7 +49,7 @@ export async function resolveTickVerdict(ctx) {
     // timeout, refusal, isDirty, commitAll) — so the request file never enters a diff or a
     // review prompt, and a quiet-killed/timeout re-run starts clean instead of losing the
     // request to the reset. Applied names are announced by the orchestrator's ~2 s live reload
-    // (one config_changed event naming the keys); this tick logs only the rejection paths.
+    // (one config_changed event naming the keys); this run logs only the rejection paths.
     if (ctx.role === DIRECTOR_ROLE) {
         const request = applyConfigRequest(ctx.root, ctx.wt);
         if (request) {
@@ -47,8 +61,8 @@ export async function resolveTickVerdict(ctx) {
     }
     if (pi.quietKilled) {
         // A hung tool call, not a slow run: the session and the worktree's edits are intact.
-        // Preserve both — applyTickOutcome resumes them promptly like an interruption instead of
-        // leaving hours of work for the next tick's reset to discard. Director ticks never resume;
+        // Preserve both — applyRunOutcome resumes them promptly like an interruption instead of
+        // leaving hours of work for the next run's reset to discard. Director runs never resume;
         // their prompt goes back to the inbox to run fresh, as on any other unfulfilled kill.
         s.lastError = pi.errorMessage ?? "killed as hung";
         ctx.pending.requeueForResume(s, ctx.userPrompt);
@@ -60,8 +74,8 @@ export async function resolveTickVerdict(ctx) {
         // 97 timeouts in 8 hours, ~55 agent-hours discarded). Handle it the way a quiet kill is
         // handled — keep the session and the worktree's edits, resume promptly, bounded by the
         // same quiet-kill streak — while a run with no recent progress keeps the discard path
-        // below. Director ticks never resume; requeueForResume re-queues their prompt
-        // fresh (src/inbox/pending-prompt.ts), and applyTickOutcome schedules the immediate retry
+        // below. Director runs never resume; requeueForResume re-queues their prompt
+        // fresh (src/inbox/pending-prompt.ts), and applyRunOutcome schedules the immediate retry
         // without a resume.
         s.lastError = pi.errorMessage ?? "timed out while still making progress";
         ctx.pending.requeueForResume(s, ctx.userPrompt);
@@ -70,44 +84,36 @@ export async function resolveTickVerdict(ctx) {
     if (pi.timedOut) {
         s.lastError = pi.errorMessage ?? "timed out";
         // The request never ran to completion and no work merged: put it back so the next
-        // tick retries it. (A killed run's half-done edits are discarded by the reset.)
+        // run retries it. (A killed run's half-done edits are discarded by the reset.)
         ctx.pending.requeueUnfulfilled(ctx.userPrompt);
         return { result: "error" };
     }
     // A subscription claude run the usage window rejected is a hold, not a run failure: the
     // team hold keeps every subscription claude seam from starting until `resetsAt`
     // (plans/agent-backends.md §8, part 6c), and this run's session and worktree edits must
-    // survive the wait — the next eligible tick resumes them (part 6e) instead of committing
+    // survive the wait — the next eligible run resumes them (part 6e) instead of committing
     // partial work or resetting the worktree to main. The rejected-window reading is the
     // signal (subscriptionWindowRejected), so a pi 429, an API-billed run, or an overage
     // window keeps the paths below.
     if (!pi.ok && ctx.role !== DIRECTOR_ROLE && subscriptionWindowRejected(pi)) {
-        s.lastError = pi.errorMessage ?? "claude subscription usage window rejected";
-        // Arm the resume here rather than in applyTickOutcome: the lease release reads
-        // `resumePending` as soon as the tick returns (runTickInLeasePhase), before
-        // applyTickOutcome runs, so without this the slot is detached and the edits above are
-        // lost. This is the same inline arming the error-dirty arm below does.
-        s.resumePending = true;
-        ctx.pending.requeueForResume(s, ctx.userPrompt);
-        return { result: "error", resumeCause: "rate-limit" };
+        // The rejection is a hold, not a run failure: arm the resume (the arming the lease
+        // release reads as soon as the run returns, before applyRunOutcome) so the kept worktree
+        // and session survive the wait. This is the same arming the budget-capped arm below does.
+        return abortWithResume(s, ctx, pi, "claude subscription usage window rejected", "error", "rate-limit");
     }
     // An API-billed claude run cut off at its per-run `--max-budget-usd` cap is a budget
-    // handback, not a failed tick: the remaining daily budget is spent, so the run stopped with
-    // its session and worktree edits intact. Keep both and let the next tick hand off over the
+    // handback, not a failed run: the remaining daily budget is spent, so the run stopped with
+    // its session and worktree edits intact. Keep both and let the next run hand off over the
     // kept worktree (plans/agent-backends.md §7, part 7a/7); the cap is what keeps one runaway
     // run from overshooting the daily cap. `aborted` is the budget-handback result
-    // (src/loop/loop-recovery.ts) and schedules the resume promptly.
+    // (src/runner/runner-recovery.ts) and schedules the resume promptly.
     if (!pi.ok && ctx.role !== DIRECTOR_ROLE && pi.budgetCapped) {
-        s.lastError = pi.errorMessage ?? "claude per-run budget cap reached";
-        // Arm the resume here rather than in applyTickOutcome: the lease release reads
-        // `resumePending` as soon as the tick returns (runTickInLeasePhase), before
-        // applyTickOutcome runs, so without this the slot is detached and the edits are lost.
-        s.resumePending = true;
-        ctx.pending.requeueForResume(s, ctx.userPrompt);
-        return { result: "aborted", resumeCause: "budget-capped" };
+        // The per-run cap is a handback, not a failure: arm the resume (shared with the
+        // subscription-rejected arm above) so the next run hands off over the kept worktree.
+        return abortWithResume(s, ctx, pi, "claude per-run budget cap reached", "aborted", "budget-capped");
     }
     // A run the runner killed the moment its agent read an image its model cannot see
-    // (plans/image-input.md "Failing the tick"): pi strips such an image from the request, so
+    // (plans/image-input.md "Failing the run"): pi strips such an image from the request, so
     // the agent was about to answer about a picture it never saw. The run was deliberately
     // stopped before it could work on, so its half-done edits are discarded exactly as a
     // timed-out run's are — nothing to resume, and the prompt re-queues to run fresh on a
@@ -115,9 +121,9 @@ export async function resolveTickVerdict(ctx) {
     // as for any error.
     if (pi.imageBlind) {
         // One hop only (plans/image-input.md "Rerunning on a model that can read images"): a
-        // tick that ALREADY started on the image-capable target and still read blind is not
-        // rerouted a second time — it fails, so a misreadable image cannot bounce the loop
-        // between tiers forever. Set at tick start by tickPhase when it routes a tick onto the
+        // run that ALREADY started on the image-capable target and still read blind is not
+        // rerouted a second time — it fails, so a misreadable image cannot bounce the role
+        // between tiers forever. Set at run start by runPhase when it routes a run onto the
         // target (blind-read handoff or attachment preflight).
         if (s.imageRerouteActive) {
             s.lastError = pi.errorMessage ?? `read ${pi.imageBlind.path}, but the model cannot read images`;
@@ -128,17 +134,19 @@ export async function resolveTickVerdict(ctx) {
             return { result: "error" };
         }
         // Otherwise, when the role's tier has an image-capable reroute target, the failed work
-        // is not discarded: the next tick starts directly on that target over the kept worktree.
+        // is not discarded: the next run starts directly on that target over the kept worktree.
         // The one-shot field carries the target seam plus the `from`/`path` facts the handoff
-        // note needs; the tick ends `aborted` with the `image-reroute` resume cause, and
-        // applyTickOutcome schedules it promptly (nextRunAt = now) while planTickStart hands the
+        // note needs; the run ends `aborted` with the `image-reroute` resume cause, and
+        // applyRunOutcome schedules it promptly (nextRunAt = now) while planRunStart hands the
         // kept worktree off to a FRESH session on the target.
         const regime = ctx.rerouteRegime ?? "primary";
-        const target = ctx.config !== undefined ? imageReroute(ctx.config, ctx.role, regime) : null;
+        const target = ctx.config !== undefined ? imageReroute(ctx.config, ctx.role, regime, undefined, null, undefined, null, readPiListedModels(ctx.root))
+            : null;
         if (target) {
             const from = ctx.runModel ?? target.config.model ?? "the model";
             s.imageReroute = {
                 tier: target.tier,
+                backend: target.config.agent ?? "pi",
                 provider: target.config.provider,
                 model: target.config.model,
                 thinking: target.config.thinking,
@@ -180,6 +188,7 @@ export async function resolveTickVerdict(ctx) {
                 root: ctx.root,
                 mainBranch: ctx.mainBranch,
                 turns: ctx.turns,
+                modelLine: ctx.modelLine,
                 merge: (w, sum) => ctx.merge(w, sum),
             }, s, ctx.wt, pi);
         }
@@ -189,16 +198,16 @@ export async function resolveTickVerdict(ctx) {
     // 4xx config error, an auth failure, or a dead backend ends on an assistant message_end with
     // empty `content` and stopReason "error" — one completed turn, zero content — so
     // `producedAssistantContent` stays false, while a run that did real work (tool calls, text)
-    // before failing sets it true. On a resume the dirty files are the interrupted tick's
+    // before failing sets it true. On a resume the dirty files are the interrupted run's
     // half-done edits, which the abort branch above deliberately refuses to commit; staging them
     // would ship unfinished work under a diff-derived subject and drop the resumable session
     // (BUGS.md 2026-10-06). Keep the worktree and session for the next resume.
     if (!pi.ok && (!changed || !pi.producedAssistantContent)) {
         s.lastError = pi.errorMessage ?? "the agent failed";
-        // A dirty worktree on a run that added nothing of its own is a prior tick's work: arm the
-        // resume so the next tick continues that session instead of resetting the edits. A role
-        // loop re-queues through requeueForResume, so the resume reclaims exactly this prompt
-        // rather than leaving a duplicate for a later fresh tick to run again (BUGS.md 2026-09-25);
+        // A dirty worktree on a run that added nothing of its own is a prior run's work: arm the
+        // resume so the next run continues that session instead of resetting the edits. A role
+        // runner re-queues through requeueForResume, so the resume reclaims exactly this prompt
+        // rather than leaving a duplicate for a later fresh run to run again (BUGS.md 2026-09-25);
         // the director never resumes, so its prompt always re-runs fresh. A clean worktree has
         // nothing to carry forward, so the plain re-queue still applies.
         if (changed && ctx.role !== DIRECTOR_ROLE) {
@@ -213,14 +222,14 @@ export async function resolveTickVerdict(ctx) {
         }
         return { result: "error" };
     }
-    // A revision tick that declares nothing-to-do drops the rejected change (the revise-rejected plan
+    // A revision run that declares nothing-to-do drops the rejected change (the revise-rejected plan
     // in PLANS.md): the author judged the objections show the change should not exist, so reset the
     // re-applied diff away, delete the rejected ref, and end no_change without staging anything.
-    // Guarded on the tick's own revisionRound, not state.revision: a dirty user-request tick that
+    // Guarded on the run's own revisionRound, not state.revision: a dirty user-request run that
     // happens to leave a pending revision untouched must not drop it. Checked before the
     // clean-worktree branch because the re-applied diff can leave the worktree clean — an empty
     // cherry-pick range, or the author reverting the edits while deciding — and the author's
-    // NOTHING_TO_DO must end the change anyway, or every later tick re-applies the same rejected
+    // NOTHING_TO_DO must end the change anyway, or every later run re-applies the same rejected
     // diff.
     if (ctx.revisionRound !== undefined && s.revision && pi.nothingToDo) {
         const { sha } = s.revision;
@@ -229,7 +238,7 @@ export async function resolveTickVerdict(ctx) {
         await deleteRef(ctx.root, rejectedRefName(ctx.role));
         // The drop's durable effects — the worktree reset, the rejected ref's deletion, and the
         // cleared state — have all taken effect; the event is observability, so an unwritable feed must
-        // not end the tick as an error and mask a change that really was dropped.
+        // not end the run as an error and mask a change that really was dropped.
         logEventBestEffort(ctx.root, { source: ctx.role, type: "revision", action: "dropped", round: ctx.revisionRound, sha });
         return { result: "no_change" };
     }
@@ -243,20 +252,46 @@ export async function resolveTickVerdict(ctx) {
                 (diagnosis.notes.length ? ` (${diagnosis.notes.join(", ")})` : ""));
         }
         // A cut-off run did real work and was NOT fulfilled: a director prompt goes back
-        // to the inbox to rerun fresh; a role loop resumes the just-compacted session
-        // next tick (see the cutOff handling in tick()).
+        // to the inbox to rerun fresh; a role runner resumes the just-compacted session
+        // next run (see the cutOff handling in run()).
         if (diagnosis.cutOff)
             ctx.pending.requeueForResume(s, ctx.userPrompt);
         // A cut-off run did real work but was truncated before declaring its outcome: the FLOW
         // line it left mid-stream is not a finished verdict, so recording it would advance the
         // rotation past a check that did not complete. Only a run that was not cut off records.
-        if (ctx.flow && !diagnosis.cutOff)
-            recordFlow(ctx.root, ctx.flow.flow, ctx.flow.result, ctx.flow.result === "bug" ? extractSummary(pi.finalText) ?? undefined : undefined);
-        // A prompt-driven (director) tick that answers a question in prose ends `no_change` with
+        if (ctx.flow && !diagnosis.cutOff) {
+            // The ledger only orders the qa menu, so a failed write warns rather than failing the run.
+            try {
+                recordFlow(ctx.root, ctx.flow.flow, ctx.flow.result, ctx.flow.result === "bug" ? extractSummary(pi.finalText) ?? undefined : undefined);
+            }
+            catch (err) {
+                ctx.warn(`qa flow "${ctx.flow.flow}" not recorded: ${errorMessage(err)}`);
+            }
+        }
+        // A fulfilled feedback run that filed records its per-install ledger entry and logs the
+        // issue_filed event so the filing is visible in the operator's activity feed. Recording is
+        // bookkeeping that never fails the run: a failed ledger write warns and the no_change
+        // outcome stands. A cut-off run records nothing — truncation is not a filing the run
+        // declared (the same guard the FLOW line carries).
+        if (ctx.filed && !diagnosis.cutOff) {
+            logEventBestEffort(ctx.root, {
+                source: ctx.role,
+                type: "issue_filed",
+                issue: ctx.filed.issue,
+                title: ctx.filed.title,
+            });
+            try {
+                recordFiled(ctx.root, ctx.filed.issue, ctx.filed.title);
+            }
+            catch (err) {
+                ctx.warn(`feedback filing #${ctx.filed.issue} not recorded: ${errorMessage(err)}`);
+            }
+        }
+        // A prompt-driven (director) run that answers a question in prose ends `no_change` with
         // no SUMMARY block, so its reply would be lost — the dashboard reads a bare "No change"
         // and the feed carries nothing (BUGS.md 2026-10-14). Keep the prose above the sentinel as
-        // the tick's summary so `lastSummary` and the run_end event show the answer where the
-        // operator asked the question. A role loop's bare nothing-to-do stays summary-less.
+        // the run's summary so `lastSummary` and the run_end event show the answer where the
+        // operator asked the question. A role runner's bare nothing-to-do stays summary-less.
         const summary = ctx.userPrompt !== null && !diagnosis.cutOff
             ? (extractNoChangeAnswer(pi.finalText) ?? undefined)
             : undefined;

package/dist/src/run/selfcheck-digest.js

@@ -0,0 +1,40 @@
+/** The `selfcheck` and `feedback` observers' run-time evidence: the failure digest rendered
+ * over the trailing 24 h window both share. Split out of src/failure/failure-render.ts — which
+ * stays the pure renderer — so every observer role's evidence builder has its own module the way
+ * qa-coverage.ts and backlog-structure.ts do, and the run lifecycle (run-prompt.ts) injects
+ * it from there instead of reaching into a report module. */
+import { DAY_MS } from "../text/datetime.js";
+import { collectFailureReportSince } from "../failure/failure-data.js";
+import { renderFailureMarkdown } from "../failure/failure-render.js";
+import { guardrailWarnings } from "../baseline/main-guardrails.js";
+/** The `selfcheck` and `feedback` observers' shared digest window: the trailing 24 h ending now,
+ * not the local calendar day. A calendar day starts at midnight, so a run at 06:32 would never
+ * see the previous evening. The CLI keeps the usage report's 14-day default; the role reads 24 h
+ * so a cluster re-surfaces only while it is live. The collector's equal-length prior window is
+ * what makes the delta line meaningful. */
+export const SELFCHECK_DIGEST_MS = DAY_MS;
+/** The `selfcheck` and `feedback` observers' run-time evidence: the failure digest rendered over
+ * their shared trailing 24 h window. A missing or corrupt log omits the block (undefined) and
+ * never fails the run — an observer must not break on bookkeeping (plans/telemetry-role.md). The
+ * window and the swallow-errors policy live with the digest, not in the run lifecycle that
+ * injects it. */
+export function selfcheckDigest(root) {
+    let digest;
+    try {
+        digest = renderFailureMarkdown(collectFailureReportSince(root, SELFCHECK_DIGEST_MS));
+    }
+    catch {
+        return undefined;
+    }
+    // The guardrails section is own-evidence extra that must never cost the digest: a throw in
+    // guardrailWarnings (an unreadable log or quarantine) drops only the section.
+    try {
+        const warnings = guardrailWarnings(root);
+        if (warnings.length === 0)
+            return digest;
+        return `${digest}\n## Fast merge guardrails\n${warnings.join("\n")}\n`;
+    }
+    catch {
+        return digest;
+    }
+}