tumwater 0.4.0 → 0.4.2

package/dist/src/collections.js

@@ -65,17 +65,28 @@ export function increment(map, key) {
  * step (the seed matters because `noUncheckedIndexedAccess` reads every entry as possibly
  * undefined), shared by the failure digest's outcome tally per role (failure-data.ts), the
  * usage report's window role totals (report-render.ts), and its per-day fold's run and cost
- * tallies (report-fold.ts), so those sites cannot drift on how a missing key is seeded. The
+ * tallies (report-usage-fold.ts), so those sites cannot drift on how a missing key is seeded. The
  * test duration reporter (test/test-durations-reporter.ts) keeps its own copy: it imports no
  * tumwater module by design, since node --test loads it into its own parent process.
  *
  * The seed reads an OWN property (Object.hasOwn), not a bare `record[key] ?? 0`: the
  * custom-role name charset admits "constructor", an Object.prototype key, whose inherited
  * function would otherwise be the seed — storing `function Object() …5` and turning every
- * later `roleSum`/report total into string concatenation (BUGS.md 2026-10-10). */
+ * later `roleSum`/report total into string concatenation (BUGS.md 2026-10-10). The write is
+ * an `Object.defineProperty`, not a plain `record[key] = …`: the latter assignment to
+ * `__proto__` (another Object.prototype key, reachable through a failing-test name) would
+ * trigger the inherited setter and create no own key, silently dropping the count. A
+ * defineProperty with the default attribute flags (writable, enumerable, configurable)
+ * writes every other key exactly as plain assignment would, so an own `__proto__` key is
+ * the only behavior this changes. */
 export function addTo(record, key, amount) {
     const current = Object.hasOwn(record, key) ? record[key] : 0;
-    record[key] = (current ?? 0) + amount;
+    Object.defineProperty(record, key, {
+        value: (current ?? 0) + amount,
+        writable: true,
+        enumerable: true,
+        configurable: true,
+    });
 }
 /** Set `key` to `value` in a bounded memo `cache`, moving an existing key to the LRU tail
  * (delete + re-set, so a re-read at the cap does not evict itself) and, when the map would
@@ -127,6 +138,18 @@ export function trimToLast(arr, max) {
 export function rankByCount(items, count, key) {
     return [...items].sort((a, b) => count(b) - count(a) || key(a).localeCompare(key(b)));
 }
+/** Split a list into its first `top` entries and how many were cut off — the pairing five call
+ * sites built by hand as `items.slice(0, N)` beside `Math.max(0, items.length - N)`. `visible`
+ * aliases `items` when it already fits; `hidden` is `max(0, items.length - top)`, which the
+ * slice-length arithmetic yields without the explicit clamp (a slice never returns more than
+ * `top` even when the list is shorter). Shared by the merge-intent and conflict-hunk caps
+ * (merge-git.ts), the failure digest's loss-cause and message-cluster tops
+ * (time-spend.ts, failure-cluster.ts), and the answered-questions cap (question-answer.ts),
+ * so those cuts cannot drift on how the remainder is counted. */
+export function topAndHidden(items, top) {
+    const visible = items.slice(0, top);
+    return { visible, hidden: items.length - visible.length };
+}
 /** The lower median of a non-empty numeric list: the middle value, or the smaller of the
  * middle two for an even count. Returns a fresh sorted copy; the input is never mutated.
  * Shared by report-data.ts's per-day medians, doctor-project-checks.ts's and doctor-backlog.ts's
@@ -137,18 +160,18 @@ export function lowerMedian(values) {
     return sorted[Math.floor((sorted.length - 1) / 2)];
 }
 /** Most-days-waited-first comparator, ties in ascending index (file order) — `b.days - a.days ||
- * a.index - b.index`, the single home of that one-line ordering. Shared by the stale-bug
- * alert (src/ui/status-payload.ts's staleOpenBugs) and the stale-waiting-bug doctor row
- * (src/doctor/doctor-backlog-bugs.ts's staleWaitingBugRows), which both build `{index, days}`
- * rows off the same backlog scan, so the two cannot drift on how ties order. The generic holds
+ * a.index - b.index`, the single home of that one-line ordering. Shared by the stale-questions
+ * feed (src/ui/alert-feeds.ts's staleOpenQuestions), which builds `{index, days}`
+ * rows off the same backlog scan, so its tie order cannot drift. The generic holds
  * any row type carrying both fields; a row without a natural index passes its first-seen order. */
 export function byDaysThenIndex(a, b) {
     return b.days - a.days || a.index - b.index;
 }
 /** Ascending string comparator by UTF-16 code unit — the locale-independent order a bare `.sort()`
  * uses, unlike `localeCompare` (which `rankByCount` uses for its tiebreak). Used directly by
- * src/cli/cli-start-summary.ts, src/cli/log-commands.ts and src/history/history-data.ts, and by
- * `sortByValueDesc` for its tiebreak. */
+ * src/cli/cli-start-summary.ts, src/cli/completion.ts, src/cli/log-commands.ts,
+ * src/history/history-data.ts, src/review/post-merge-review.ts, src/review/quarantine-render.ts,
+ * src/budget/budget.ts and src/change/change-data.ts, and by `sortByValueDesc` for its tiebreak. */
 export function compareCodeUnits(a, b) {
     return a < b ? -1 : a > b ? 1 : 0;
 }
@@ -162,6 +185,20 @@ export function compareCodeUnits(a, b) {
 export function sortByValueDesc(entries) {
     return entries.sort((a, b) => b[1] - a[1] || compareCodeUnits(a[0], b[0]));
 }
+/** Sort `[key, …]` entry pairs by their string key ascending — the single home of the
+ * `entries.sort(([a], [b]) => a.localeCompare(b))` step, shared by the budget check's
+ * capped-role rows (doctor-holds.ts's checkBudget), the permit pool's provider fragment
+ * (ui/badges.ts's permitsBadge), and the doctor's rate-limit standing-holds rows
+ * (doctor-holds.ts's checkRateLimitHolds), so those sites cannot drift on how a possibly
+ * `undefined` key (a rate-limit hold recorded with no provider) orders. A missing key sorts
+ * first, matching the `(a ?? "")` guard the hold site alone needed; on a defined string the
+ * guard is a no-op, so the comparator is identical for the other two. Returns a fresh sorted
+ * array; the input is never mutated. (Deliberately unlike the value-descending `sortByValueDesc`
+ * and the count-then-key `rankCountEntries` above, which sort by a different axis. Also used to
+ * stabilize a Map's insertion order before an assertion in test/once-round.test.ts.) */
+export function sortEntriesByKey(entries) {
+    return [...entries].sort(([a], [b]) => (a ?? "").localeCompare(b ?? ""));
+}
 /** rankByCount for `[key, count]` entry pairs (count first): src/report/report-render.ts's
  * rankedRoleMap, src/team/failure-spread.ts's strongest-kind pick, and
  * src/doctor/doctor-contention-checks.ts's check-wait and provider-wait rankings. */

package/dist/src/config/config-fallbacks.js

@@ -80,10 +80,6 @@ const BORROW_ORDER = {
     default: ["default", "strong", "small"],
     strong: ["strong", "default"],
 };
-/** Exported for imageRerouteTarget (src/agent/image-input.ts), which walks a rerouting role's
- * tier through the same borrow order the budget fallback uses (skipping the tier itself), and
- * for the doctor's `image input` check naming the tier a text-only role reroutes to. */
-export { BORROW_ORDER };
 /** A tier's OWN fallback chain, first step first — what the `fallback` key declares at that
  * tier's map entry (a selector or a list of them), or (default only) the string/list form of
  * `fallback` or the legacy `fallbackModel` object (a one-element chain). Empty when the tier

package/dist/src/config/config-live.js

@@ -47,163 +47,195 @@ export function newLiveConfigReload(deps) {
     // the config application that follows the emission. bestEffortEventLogger (events.ts) holds
     // the shared "logging must not throw" policy.
     const { emit, warn } = bestEffortEventLogger(deps.root);
+    // Warn once per vanish and once per reappearance of tumwater.json.
+    function noteConfigPresence(reloaded) {
+        // A missing file keeps the last-known-good config too, and never reloads as defaults: the
+        // team was started on a real file (startup refuses to run without one), so its vanishing
+        // mid-run is an incident — a merge's fast-forward deleted it on 2026-09-22 and the team
+        // silently ran 8.6 h on defaults (BUGS.md 2026-09-23). One warning per vanish, not per
+        // poll; its return logs one line, then the normal reload below diffs it against the
+        // retained config — so config_changed names only what the returned file really changed.
+        if (reloaded.missing) {
+            if (!configMissing) {
+                warn(`tumwater.json missing — keeping current config until it returns (${configPath(deps.root)})`);
+                configMissing = true;
+                lastConfigError = null; // Whatever state it returns in is stated afresh.
+            }
+        }
+        else if (configMissing) {
+            warn("tumwater.json reappeared — reloading it");
+            configMissing = false;
+        }
+    }
+    // Refuse a live edit that routes a seam to an API-key-logged-in codex, keeping prevLive.
+    function refuseApiKeyCodex(nextConfig, prevBackends) {
+        // A live edit that routes a seam to a codex logged in with an API key is refused before
+        // the reload is applied: startup refuses the same codex seam (decision 5), and here a
+        // warn-only would let the running team spend per-token Codex the budget cap cannot see
+        // (review objection 1). Refusing keeps the last-known-good config, like a missing or
+        // broken file. The seed runs once per root (`codex login status` is a real probe); the
+        // persisted account file is the voice of the refusal on later polls, re-probing a stale
+        // api answer (codex-account.ts) so the operator's `codex login --device-auth` remedy
+        // clears it at the next seed. A subscription codex passes through to the backend loop.
+        const newlyRoutedCodex = !prevBackends.has("codex") && backendsInUse(nextConfig).includes("codex");
+        if (newlyRoutedCodex && !liveCodexSeedAttempted.has(deps.root)) {
+            liveCodexSeedAttempted.add(deps.root);
+            seedCodexAccount(deps.root, nextConfig);
+        }
+        if (newlyRoutedCodex && readCodexAccount(deps.root)?.billing === "api") {
+            if (codexLiveRefused)
+                return true;
+            codexLiveRefused = true;
+            warn("refusing live edit: Codex is logged in with an API key; tumwater runs Codex on a ChatGPT subscription only — run `CODEX_HOME=<home> codex login --device-auth`");
+            return true;
+        }
+        // A poll that did not refuse clears the warn-once marker so a later re-entry into the
+        // refusal (the operator reverts, then re-adds the API-billed codex seam) warns again.
+        codexLiveRefused = false;
+        return false;
+    }
+    // Emit config_changed and model_changed for what this reload actually changed.
+    function emitConfigChangeEvents(nextConfig) {
+        // A live edit that changes behavior elsewhere logs one event naming the settings that
+        // changed (maxConcurrent and sessionRetentionDays have their own events elsewhere).
+        const changedKeys = changedConfigKeys(prevLive, nextConfig);
+        if (changedKeys.length > 0) {
+            emit({ source: TUMWATER_SOURCE, type: "config_changed", keys: changedKeys });
+            // A real model-wiring change gets its own event naming the new selector(s), which the
+            // key list cannot show; a non-model edit (instructions, an interval) emits nothing.
+            const fromModel = teamModelLabel(prevLive);
+            const toModel = teamModelLabel(nextConfig);
+            const roleDiffs = changedKeys
+                .filter((key) => key.startsWith("roles."))
+                .map((key) => {
+                const role = key.slice("roles.".length);
+                const from = modelSelectorField(configForRole(prevLive, role)).model ?? null;
+                const to = modelSelectorField(configForRole(nextConfig, role)).model ?? null;
+                return { role, from, to };
+            })
+                .filter((d) => d.from !== d.to);
+            if (fromModel !== toModel || roleDiffs.length > 0)
+                emit({
+                    source: TUMWATER_SOURCE,
+                    type: "model_changed",
+                    from: fromModel,
+                    to: toModel,
+                    ...(roleDiffs.length > 0 ? { roles: roleDiffs } : {}),
+                });
+        }
+    }
+    // Verify and seed each backend a live edit newly routes to.
+    function seedNewlyRoutedBackends(nextConfig, prevBackends) {
+        // A live edit that routes a seam to a backend the previous config did not use: the
+        // team keeps running, but that backend must be verified and its account (claude) or
+        // models catalog (opencode) seeded, exactly as startup would — so a claude reviewer
+        // added to a pi team does not start uncheckable. A missing binary is a warning event,
+        // never a crash; a present one logs its verdict as a backend_binary event. The seed is
+        // attempted once per root. (The codex seed moved to the refusal check at the top of
+        // this block, which also refuses an API-key-logged-in codex seam.)
+        for (const backend of backendsInUse(nextConfig)) {
+            if (prevBackends.has(backend))
+                continue;
+            const resolved = resolveBackendBin(nextConfig, backend);
+            if (findBackendBinary(resolved)) {
+                emit({ source: TUMWATER_SOURCE, type: "backend_binary", agent: backend, found: true });
+            }
+            else {
+                warn(`newly routed ${backend} backend: ${backendMissingMessage(resolved, backend)}`);
+            }
+            if (backend === "claude" && !liveClaudeSeedAttempted.has(deps.root)) {
+                liveClaudeSeedAttempted.add(deps.root);
+                seedClaudeAccount(deps.root, nextConfig);
+            }
+            if (backend === "opencode" && !liveOpencodeSeedAttempted.has(deps.root)) {
+                liveOpencodeSeedAttempted.add(deps.root);
+                // Not awaited: poll() is synchronous and a models.dev fetch must not stall the loop.
+                void seedOpencodeCatalog(deps.root, nextConfig, { ...deps.opencodeSeed, warn }).catch((err) => warn(`open code model catalog seed failed: ${errorMessage(err)}`));
+            }
+        }
+    }
+    // Live-resize the concurrency cap and the per-provider key caps.
+    function resizeConcurrency(nextConfig) {
+        // Live-resize the concurrency cap: a mid-run edit changes how many pi runs execute
+        // concurrently within this poll — no restart. Growing admits already-queued runs;
+        // shrinking never preempts in-flight work, it only caps future grants.
+        const newMaxConcurrent = Math.max(1, nextConfig.maxConcurrent);
+        if (newMaxConcurrent !== lastMaxConcurrent) {
+            deps.semaphore.setCapacity(newMaxConcurrent);
+            emit({ source: TUMWATER_SOURCE, type: "max_concurrent_changed", from: lastMaxConcurrent, to: newMaxConcurrent });
+            lastMaxConcurrent = newMaxConcurrent;
+        }
+        // Live-resize the per-provider caps (plans/provider-concurrency.md §7): an edit
+        // re-applies the whole map to the pool, and each changed provider fires its own
+        // `provider_concurrency_changed` event. setKeyCaps never preempts — shrinking only
+        // withholds future grants on that key until releases drain it under the new cap.
+        const nextKeyCaps = nextConfig.maxConcurrentPerProvider ?? {};
+        deps.semaphore.setKeyCaps(nextKeyCaps);
+        for (const provider of new Set([...Object.keys(lastKeyCaps), ...Object.keys(nextKeyCaps)])) {
+            const from = lastKeyCaps[provider];
+            const to = nextKeyCaps[provider];
+            if (from !== to) {
+                emit({
+                    source: TUMWATER_SOURCE,
+                    type: "provider_concurrency_changed",
+                    provider,
+                    from: from ?? 0,
+                    to: to ?? 0,
+                });
+            }
+        }
+        lastKeyCaps = nextKeyCaps;
+    }
+    // Sync the runner list to newly enabled roles and warn on enable/disable.
+    function syncRunners(nextConfig) {
+        const nowEnabled = runnerIds(nextConfig);
+        // Enabling a role — or raising `roles.<id>.instances` — mid-run starts it: create the
+        // runner for each newly present role id (its persisted state survives). A lowered
+        // instance count keeps its runner; `runnerEnabled` skips its future runs. A scoped round
+        // skips every other id: the enabling is logged (the warn loop below), but its runner
+        // waits for the next unscoped round.
+        for (const role of nowEnabled) {
+            if (deps.roleFilter !== undefined && !deps.roleFilter.includes(role))
+                continue;
+            if (!deps.runners.some((r) => r.role === role))
+                deps.runners.push(new RoleRunner(deps.root, role, nextConfig, deps.mainBranch, deps.runnerSignal));
+        }
+        for (const role of prevEnabled)
+            if (!nowEnabled.includes(role))
+                warn(`role ${role} disabled — no new runs`);
+        for (const role of nowEnabled)
+            if (!prevEnabled.has(role))
+                warn(`role ${role} enabled — starting runs`);
+        prevEnabled = new Set(nowEnabled);
+    }
+    // Warn once per distinct broken-file error text.
+    function noteInvalidConfig(reloaded) {
+        if (reloaded.error && reloaded.error !== lastConfigError) {
+            warn(`tumwater.json invalid — keeping current config: ${reloaded.error}`);
+            lastConfigError = reloaded.error;
+        }
+    }
     return {
         poll() {
             const reloaded = loadConfigCached(deps.root);
-            // A missing file keeps the last-known-good config too, and never reloads as defaults: the
-            // team was started on a real file (startup refuses to run without one), so its vanishing
-            // mid-run is an incident — a merge's fast-forward deleted it on 2026-09-22 and the team
-            // silently ran 8.6 h on defaults (BUGS.md 2026-09-23). One warning per vanish, not per
-            // poll; its return logs one line, then the normal reload below diffs it against the
-            // retained config — so config_changed names only what the returned file really changed.
-            if (reloaded.missing) {
-                if (!configMissing) {
-                    warn(`tumwater.json missing — keeping current config until it returns (${configPath(deps.root)})`);
-                    configMissing = true;
-                    lastConfigError = null; // Whatever state it returns in is stated afresh.
-                }
-            }
-            else if (configMissing) {
-                warn("tumwater.json reappeared — reloading it");
-                configMissing = false;
-            }
+            noteConfigPresence(reloaded);
             if (reloaded.config) {
                 const nextConfig = reloaded.config;
-                // A live edit that routes a seam to a codex logged in with an API key is refused before
-                // the reload is applied: startup refuses the same codex seam (decision 5), and here a
-                // warn-only would let the running team spend per-token Codex the budget cap cannot see
-                // (review objection 1). Refusing keeps the last-known-good config, like a missing or
-                // broken file. The seed runs once per root (`codex login status` is a real probe); the
-                // persisted account file is the voice of the refusal on later polls, re-probing a stale
-                // api answer (codex-account.ts) so the operator's `codex login --device-auth` remedy
-                // clears it at the next seed. A subscription codex passes through to the backend loop.
                 const prevBackends = new Set(backendsInUse(prevLive));
-                const newlyRoutedCodex = !prevBackends.has("codex") && backendsInUse(nextConfig).includes("codex");
-                if (newlyRoutedCodex && !liveCodexSeedAttempted.has(deps.root)) {
-                    liveCodexSeedAttempted.add(deps.root);
-                    seedCodexAccount(deps.root, nextConfig);
-                }
-                if (newlyRoutedCodex && readCodexAccount(deps.root)?.billing === "api") {
-                    if (codexLiveRefused)
-                        return prevLive;
-                    codexLiveRefused = true;
-                    warn("refusing live edit: Codex is logged in with an API key; tumwater runs Codex on a ChatGPT subscription only — run `CODEX_HOME=<home> codex login --device-auth`");
+                if (refuseApiKeyCodex(nextConfig, prevBackends))
                     return prevLive;
-                }
-                // A poll that did not refuse clears the warn-once marker so a later re-entry into the
-                // refusal (the operator reverts, then re-adds the API-billed codex seam) warns again.
-                codexLiveRefused = false;
-                live = reloaded.config;
-                // A live edit that changes behavior elsewhere logs one event naming the settings that
-                // changed (maxConcurrent and sessionRetentionDays have their own events elsewhere).
-                const changedKeys = changedConfigKeys(prevLive, reloaded.config);
-                if (changedKeys.length > 0) {
-                    emit({ source: TUMWATER_SOURCE, type: "config_changed", keys: changedKeys });
-                    // A real model-wiring change gets its own event naming the new selector(s), which the
-                    // key list cannot show; a non-model edit (instructions, an interval) emits nothing.
-                    const fromModel = teamModelLabel(prevLive);
-                    const toModel = teamModelLabel(reloaded.config);
-                    const roleDiffs = changedKeys
-                        .filter((key) => key.startsWith("roles."))
-                        .map((key) => {
-                        const role = key.slice("roles.".length);
-                        const from = modelSelectorField(configForRole(prevLive, role)).model ?? null;
-                        const to = modelSelectorField(configForRole(nextConfig, role)).model ?? null;
-                        return { role, from, to };
-                    })
-                        .filter((d) => d.from !== d.to);
-                    if (fromModel !== toModel || roleDiffs.length > 0)
-                        emit({
-                            source: TUMWATER_SOURCE,
-                            type: "model_changed",
-                            from: fromModel,
-                            to: toModel,
-                            ...(roleDiffs.length > 0 ? { roles: roleDiffs } : {}),
-                        });
-                }
-                // A live edit that routes a seam to a backend the previous config did not use: the
-                // team keeps running, but that backend must be verified and its account (claude) or
-                // models catalog (opencode) seeded, exactly as startup would — so a claude reviewer
-                // added to a pi team does not start uncheckable. A missing binary is a warning event,
-                // never a crash; a present one logs its verdict as a backend_binary event. The seed is
-                // attempted once per root. (The codex seed moved to the refusal check at the top of
-                // this block, which also refuses an API-key-logged-in codex seam.)
-                for (const backend of backendsInUse(reloaded.config)) {
-                    if (prevBackends.has(backend))
-                        continue;
-                    const resolved = resolveBackendBin(reloaded.config, backend);
-                    if (findBackendBinary(resolved)) {
-                        emit({ source: TUMWATER_SOURCE, type: "backend_binary", agent: backend, found: true });
-                    }
-                    else {
-                        warn(`newly routed ${backend} backend: ${backendMissingMessage(resolved, backend)}`);
-                    }
-                    if (backend === "claude" && !liveClaudeSeedAttempted.has(deps.root)) {
-                        liveClaudeSeedAttempted.add(deps.root);
-                        seedClaudeAccount(deps.root, reloaded.config);
-                    }
-                    if (backend === "opencode" && !liveOpencodeSeedAttempted.has(deps.root)) {
-                        liveOpencodeSeedAttempted.add(deps.root);
-                        // Not awaited: poll() is synchronous and a models.dev fetch must not stall the loop.
-                        void seedOpencodeCatalog(deps.root, reloaded.config, { ...deps.opencodeSeed, warn }).catch((err) => warn(`open code model catalog seed failed: ${errorMessage(err)}`));
-                    }
-                }
-                prevLive = reloaded.config;
+                live = nextConfig;
+                emitConfigChangeEvents(nextConfig);
+                seedNewlyRoutedBackends(nextConfig, prevBackends);
+                prevLive = nextConfig;
                 for (const r of deps.runners)
-                    r.config = reloaded.config;
-                // Live-resize the concurrency cap: a mid-run edit changes how many pi runs execute
-                // concurrently within this poll — no restart. Growing admits already-queued runs;
-                // shrinking never preempts in-flight work, it only caps future grants.
-                const newMaxConcurrent = Math.max(1, reloaded.config.maxConcurrent);
-                if (newMaxConcurrent !== lastMaxConcurrent) {
-                    deps.semaphore.setCapacity(newMaxConcurrent);
-                    emit({ source: TUMWATER_SOURCE, type: "max_concurrent_changed", from: lastMaxConcurrent, to: newMaxConcurrent });
-                    lastMaxConcurrent = newMaxConcurrent;
-                }
-                // Live-resize the per-provider caps (plans/provider-concurrency.md §7): an edit
-                // re-applies the whole map to the pool, and each changed provider fires its own
-                // `provider_concurrency_changed` event. setKeyCaps never preempts — shrinking only
-                // withholds future grants on that key until releases drain it under the new cap.
-                const nextKeyCaps = reloaded.config.maxConcurrentPerProvider ?? {};
-                deps.semaphore.setKeyCaps(nextKeyCaps);
-                for (const provider of new Set([...Object.keys(lastKeyCaps), ...Object.keys(nextKeyCaps)])) {
-                    const from = lastKeyCaps[provider];
-                    const to = nextKeyCaps[provider];
-                    if (from !== to) {
-                        emit({
-                            source: TUMWATER_SOURCE,
-                            type: "provider_concurrency_changed",
-                            provider,
-                            from: from ?? 0,
-                            to: to ?? 0,
-                        });
-                    }
-                }
-                lastKeyCaps = nextKeyCaps;
-                const nowEnabled = runnerIds(reloaded.config);
-                // Enabling a role — or raising `roles.<id>.instances` — mid-run starts it: create the
-                // runner for each newly present role id (its persisted state survives). A lowered
-                // instance count keeps its runner; `runnerEnabled` skips its future runs. A scoped round
-                // skips every other id: the enabling is logged (the warn loop below), but its runner
-                // waits for the next unscoped round.
-                for (const role of nowEnabled) {
-                    if (deps.roleFilter !== undefined && !deps.roleFilter.includes(role))
-                        continue;
-                    if (!deps.runners.some((r) => r.role === role))
-                        deps.runners.push(new RoleRunner(deps.root, role, reloaded.config, deps.mainBranch, deps.runnerSignal));
-                }
-                for (const role of prevEnabled)
-                    if (!nowEnabled.includes(role))
-                        warn(`role ${role} disabled — no new runs`);
-                for (const role of nowEnabled)
-                    if (!prevEnabled.has(role))
-                        warn(`role ${role} enabled — starting runs`);
-                prevEnabled = new Set(nowEnabled);
+                    r.config = nextConfig;
+                resizeConcurrency(nextConfig);
+                syncRunners(nextConfig);
                 lastConfigError = null;
             }
-            else if (reloaded.error && reloaded.error !== lastConfigError) {
-                warn(`tumwater.json invalid — keeping current config: ${reloaded.error}`);
-                lastConfigError = reloaded.error;
+            else {
+                noteInvalidConfig(reloaded);
             }
             return live;
         },