tumwater 0.4.0 → 0.4.2

package/dist/src/merge/{merge-post-review.js → merge-post-review-drain.js}

@@ -9,7 +9,7 @@ import { POST_REVIEW_FAILURE_LIMIT, addPostReview, readPostReviews, reviewMerged
 import { shortSha } from "../text/format.js";
 import { formatDate } from "../text/datetime.js";
 import { collapseWhitespace, errorMessage } from "../text/text.js";
-import { fileBugsOnMain } from "../backlog/backlog-archive.js";
+import { fileBugsOnMain } from "../backlog/backlog-file-bugs.js";
 import { abortOnShutdown, acquireUnlessAborted, guardMergeTask } from "./merge-pipeline.js";
 import { resolveWaitStage } from "./merge-slot.js";
 import { mergeToMain } from "./merge-to-main.js";

package/dist/src/merge/merge-queue.js

@@ -1,6 +1,7 @@
 import { errCode } from "../errno.js";
 import fs from "node:fs";
 import path from "node:path";
+import { ensureDir } from "../files/files.js";
 import { listQueueFiles, queueFileName, removeQueueFile } from "../files/file-queue.js";
 import { isJsonObject, nonNegativeNumber } from "../files/json-object.js";
 import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
@@ -49,7 +50,7 @@ export function legacyMigrateLandQueueDir(root) {
     const notes = { moved: [], kept: [], failed: [] };
     const files = listQueueFiles(from, ".json");
     if (files.length > 0)
-        fs.mkdirSync(to, { recursive: true });
+        ensureDir(to);
     for (const file of files) {
         const name = path.basename(file);
         const dest = path.join(to, name);

package/dist/src/merge/merge-to-main.js

@@ -4,7 +4,7 @@ import { changeBaseRev, commitMessage, headOf } from "../git/git.js";
 import { aheadOfMainFiles, treeDiffFiles } from "../git/git-diff.js";
 import { resolvedDiffDiverges } from "./merge-diff.js";
 import { conflictedFileHunks, conflictedFiles, continueRebase, ffMainToOrWhy, overwriteBlockedReason, primaryCheckoutBlockers, hasConflictMarkers, mainCommitsTouching, rebaseOntoMain, rebaseOntoMainLeaveConflicts, } from "./merge-git.js";
-import { resolveBacklogInsertConflicts } from "./backlog-conflicts.js";
+import { resolveBacklogInsertConflicts } from "./merge-backlog-conflicts.js";
 import { abortSync } from "../git/worktree.js";
 import { runScopedBuildCheck } from "../build/build-check-scoped.js";
 import { detectBuildCheck, gateCommandOf, mergeCommandOf } from "../build/build-check-detect.js";

package/dist/src/merge/merge-verify.js

@@ -24,8 +24,9 @@ export const VERIFY_TIER = -1;
  * verification parked for a permit, because the merge is the one serial step every queued change
  * waits on. (Nothing that holds a permit ever waits on the merge: no verification takes the merge
  * lock, and the resolver runs outside it — merge-to-main.ts's mergeToMain — so this cannot
- * deadlock.) Shared by merge-drain.ts's merge slot and merge-post-review.ts's fix landing, so the
- * reviewer's fix-merge resolver rides the same tier and the two cannot drift. */
+ * deadlock.) Shared by merge-drain.ts's merge slot and merge-post-review-drain.ts's fix
+ * landing, so the reviewer's fix-merge resolver rides the same tier and the two cannot
+ * drift. */
 export const MERGE_TIER = VERIFY_TIER - 1;
 /** How many verifications may be in flight (parked or running) at once: every `maxConcurrent`
  * permit but one, so a deep merge queue never takes the last slot from the roles that could

package/dist/src/operator/operator-commands.js

@@ -18,7 +18,7 @@ import { normalizePauseReason, pauseTeam, pauseRole, pausedRoles, resumeTeam, re
 import { readOrchestratorInfo } from "../team/orchestrator-info.js";
 import { pidAlive } from "../process/process.js";
 import { inspectReclaimCandidates } from "../team/reclaim.js";
-import { markerApplyNote, NO_HARNESS_ERROR, PAUSE_FOR_MAX_MS, cancelScheduledStopMessage, cancelWakes, listWakes, renderWakeList, requestAbort, requestResetCounters, requestRestart, requestScheduledStop, requestWake, rolePauseMessage, roleResumeMessage, runManualReclaim, timedPauseBits, } from "./operator-intent.js";
+import { markerApplyNote, NO_HARNESS_ERROR, PAUSE_FOR_MAX_MS, cancelScheduledStopMessage, cancelWakes, listWakes, renderWakeList, requestAbort, requestAbortAll, requestResetCounters, requestRestart, requestScheduledStop, requestWake, rolePauseMessage, roleResumeMessage, runManualReclaim, timedPauseBits, } from "./operator-intent.js";
 /** The CLI layer of the operator commands: the `reset-counters`, `wake`, `reclaim`, `abort`,
  * `pause`, `resume`, `stop`, and `retire` commands, split out of cli.ts so the command bodies
  * live beside their shared `--role` resolution. The marker-writing cores and shared
@@ -182,17 +182,28 @@ export async function cmdReclaim(root, args) {
     }
     say(await runManualReclaim(root));
 }
-/** `tumwater abort --role <id>[,<id>...]`: kill the named roles' in-flight runs right now (a
- * comma list writes one marker per role). The CLI cannot
+/** `tumwater abort [--role <id>[,<id>...]] [--all]`: kill the named roles' in-flight runs
+ * right now (a comma list writes one marker per role), or with `--all` every enabled role's in
+ * flight run in one request (one marker per enabled runner). The CLI cannot
  * reach into the orchestrator process, so the request rides on disk like reset-counters':
  * a per-role marker file a running team consumes within one poll cycle (the runner's
  * abortRun kills the pi child and resets the worktree to main). Requires a live harness —
- * with no team there is nothing to consume the marker. The role stays enabled: it backs
+ * with no team there is nothing to consume the marker. The roles stay enabled: they back
  * off normally and later runs proceed as usual. */
 export async function cmdAbort(root, args) {
+    if (args.includes("--all")) {
+        if (flagValue(args, "--role") !== null) {
+            fail("abort takes either --role <id>[,<id>...] or --all, not both");
+        }
+        const result = requestAbortAll(root);
+        if (!result.ok)
+            fail(result.error);
+        say(result.message);
+        return;
+    }
     // As in cmdLogs: the config exists only to validate the id against built-ins plus
     // user-defined roles; a missing --role fails before it is ever needed.
-    const roles = namedRoleList(root, args) ?? fail("abort requires --role <id> (e.g. `--role feature`)");
+    const roles = namedRoleList(root, args) ?? fail("abort requires --role <id>[,<id>...] or --all (e.g. `--role feature`)");
     for (const role of roles) {
         const result = requestAbort(root, role);
         if (!result.ok)
@@ -436,37 +447,10 @@ export async function cmdRetire(root, args) {
         say(`nothing to remove for role ${role}`);
 }
 const REVERT_USAGE = "usage: tumwater revert <sha>|<role> <n>|<role> --last [--dry-run] [--json]";
-/** The sha the run `<role> <n>` (or the newest completed run of `<role>` under `last`) merged
- * under, resolved the way `tumwater history <role> <n>` and the dashboard's revert resolve it
- * (`runMergedSha`). Fails, exit 1, when the run is unknown or did not merge: revert is an
- * action, so a miss is an error rather than history's exit-0 "not found". */
-function revertRunSha(root, positionals, last) {
-    const role = canonicalRoleId(positionals[0]);
-    const ids = knownRoleIdsCached(root);
-    if (!ids.includes(role))
-        fail(`${unknownRoleMessage(role, ids)} (${REVERT_USAGE})`);
-    const run = last
-        ? (readRunRows(root, 1, role)[0]?.run ?? null)
-        : parseCountFlag("revert <n>", positionals[1]);
-    if (run === null)
-        fail(`no completed run of ${role} in the event log`);
-    const detail = readRunDetail(root, role, run);
-    if (detail === null)
-        fail(runNotFoundMessage(role, run));
-    const found = runRevertSha(role, run, detail);
-    if (!found.ok)
-        fail(found.error);
-    const sha = found.sha;
-    return { sha, line: `run ${role} #${run} merged as ${shortSha(sha)}`, role, run };
-}
-/** `tumwater revert <sha>|<role> <n>|<role> --last`: undo one merged change on main,
- * committing the inverse as `tumwater(operator): Revert <short sha>` under the primary-worktree
- * lock. The lock, branch guard, and fail-closed ref/conflict handling live in
- * src/operator/revert.ts; this renderer names the new main head and names the role
- * that made the reverted commit, when one did, as the one that may redo the work.
- * `--json` prints the preview or the revert as one JSON object instead (refusals still fail on
- * stderr). */
-export async function cmdRevert(root, args) {
+/** Scans `args` for `--dry-run`, `--last` and `--json`, refuses a flag-shaped token as a
+ * dropped flag and checks the positional arity, returning the flags and the remaining
+ * positionals. */
+function parseRevertArgs(args) {
     // `--dry-run` and `--last` are the only flags; the positionals select a sha (one), a run
     // (`<role> <n>`) or the newest run of a role (`<role>` with --last). A flag or any other
     // shape fails before anything is looked up or written.
@@ -483,20 +467,24 @@ export async function cmdRevert(root, args) {
         fail(`revert takes only --dry-run, --last and --json (got ${flagged}); pass the commit or run to undo as the argument`);
     if (last ? rest.length !== 1 : rest.length < 1 || rest.length > 2)
         fail(`revert needs a commit or a run (${REVERT_USAGE})`);
+    return { dryRun, last, json, rest };
+}
+/** Resolves the target sha, its run line and its run ref (`revertRunSha` for `<role> <n>` and
+ * `<role> --last`, else the sha positional directly). */
+function revertTarget(root, rest, last) {
     const run = last || rest.length === 2 ? revertRunSha(root, rest, last) : null;
     const sha = run?.sha ?? rest[0];
     const runLine = run?.line ?? null;
     const runRef = run === null ? null : { role: run.role, run: run.run };
-    if (dryRun) {
-        const p = await previewRevert(root, sha);
-        if (!p.ok)
-            fail(p.error);
-        if (json) {
-            sayJson({ dryRun: true, run: runRef, sha: p.sha, subject: p.subject, paths: p.paths, head: p.head, primary: p.primary, applies: p.applies, dirty: p.dirty });
-            if (!p.applies || p.dirty)
-                process.exitCode = 1;
-            return;
-        }
+    return { sha, runLine, runRef };
+}
+/** Renders the `--dry-run` preview (the run line, `would revert …`, the path list,
+ * `applies cleanly`/`would conflict`/the dirty-checkout line) and its exit code. */
+function sayRevertPreview(p, runLine, runRef, json) {
+    if (json) {
+        sayJson({ dryRun: true, run: runRef, sha: p.sha, subject: p.subject, paths: p.paths, head: p.head, primary: p.primary, applies: p.applies, dirty: p.dirty });
+    }
+    else {
         if (runLine !== null)
             say(runLine);
         say(`would revert ${shortSha(p.sha)} ${p.subject}`);
@@ -509,13 +497,12 @@ export async function cmdRevert(root, args) {
             say(`would conflict ${on}`);
         if (p.dirty)
             say("the checkout has staged or unstaged changes, so tumwater revert would refuse until they are committed or stashed; nothing was written");
-        if (!p.applies || p.dirty)
-            process.exitCode = 1;
-        return;
     }
-    const result = await revertMergedCommit(root, sha);
-    if (!result.ok)
-        fail(result.error);
+    if (!p.applies || p.dirty)
+        process.exitCode = 1;
+}
+/** Renders the committed revert (`main is now …`, the role follow-up) or its `--json` payload. */
+function sayRevertOutcome(result, runLine, runRef, json) {
     if (json) {
         sayJson({ dryRun: false, run: runRef, subject: result.subject, headSha: result.headSha, beforeSha: result.beforeSha, followUp: revertFollowUp(result.subject) });
         return;
@@ -527,3 +514,48 @@ export async function cmdRevert(root, args) {
     if (followUp !== null)
         say(followUp);
 }
+/** The sha the run `<role> <n>` (or the newest completed run of `<role>` under `last`) merged
+ * under, resolved the way `tumwater history <role> <n>` and the dashboard's revert resolve it
+ * (`runMergedSha`). Fails, exit 1, when the run is unknown or did not merge: revert is an
+ * action, so a miss is an error rather than history's exit-0 "not found". */
+function revertRunSha(root, positionals, last) {
+    const role = canonicalRoleId(positionals[0]);
+    const ids = knownRoleIdsCached(root);
+    if (!ids.includes(role))
+        fail(`${unknownRoleMessage(role, ids)} (${REVERT_USAGE})`);
+    const run = last
+        ? (readRunRows(root, 1, role)[0]?.run ?? null)
+        : parseCountFlag("revert <n>", positionals[1]);
+    if (run === null)
+        fail(`no completed run of ${role} in the event log`);
+    const detail = readRunDetail(root, role, run);
+    if (detail === null)
+        fail(runNotFoundMessage(role, run));
+    const found = runRevertSha(role, run, detail);
+    if (!found.ok)
+        fail(found.error);
+    const sha = found.sha;
+    return { sha, line: `run ${role} #${run} merged as ${shortSha(sha)}`, role, run };
+}
+/** `tumwater revert <sha>|<role> <n>|<role> --last`: undo one merged change on main,
+ * committing the inverse as `tumwater(operator): Revert <short sha>` under the primary-worktree
+ * lock. The lock, branch guard, and fail-closed ref/conflict handling live in
+ * src/operator/revert.ts; this renderer names the new main head and names the role
+ * that made the reverted commit, when one did, as the one that may redo the work.
+ * `--json` prints the preview or the revert as one JSON object instead (refusals still fail on
+ * stderr). */
+export async function cmdRevert(root, args) {
+    const { dryRun, last, json, rest } = parseRevertArgs(args);
+    const { sha, runLine, runRef } = revertTarget(root, rest, last);
+    if (dryRun) {
+        const p = await previewRevert(root, sha);
+        if (!p.ok)
+            fail(p.error);
+        sayRevertPreview(p, runLine, runRef, json);
+        return;
+    }
+    const result = await revertMergedCommit(root, sha);
+    if (!result.ok)
+        fail(result.error);
+    sayRevertOutcome(result, runLine, runRef, json);
+}

package/dist/src/operator/operator-intent.js

@@ -1,5 +1,4 @@
 import crypto from "node:crypto";
-import fs from "node:fs";
 import path from "node:path";
 import { cancelScheduledStop, isTeamPaused, scheduleStop } from "../team/team-state.js";
 import { orchestratorAlive, readOrchestratorInfo } from "../team/orchestrator-info.js";
@@ -8,12 +7,13 @@ import { formatDate, formatTime, humanUntil, DAY_MS } from "../text/datetime.js"
 import { submitRolePrompt } from "../inbox/inbox-submit.js";
 import { questionAsker } from "../backlog/question-answer.js";
 import { knownRoleIdsCached, loadConfigCached } from "../config/config.js";
-import { baseRoleOf } from "../roles/runner-ids.js";
+import { baseRoleOf, runnerIds } from "../roles/runner-ids.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { saveRunnerState, zeroCounters } from "../runner/runner-state.js";
 import { loadRunnerState } from "../runner/runner-state-load.js";
 import { clearBackoff } from "../scheduling/backoff.js";
 import { writeJsonAtomic } from "../files/json-files.js";
+import { ensureDir } from "../files/files.js";
 import { reclaimPass } from "../team/reclaim.js";
 import { formatGB } from "../text/format.js";
 import { plural } from "../text/phrases.js";
@@ -134,7 +134,7 @@ export function requestWake(root, roles, inMs) {
     // runner immediately, dropping a scheduled wake's notBeforeMs on the floor. A scheduled wake
     // gets its own file so a later wake request, immediate or scheduled, cannot overwrite it.
     if (deferred) {
-        fs.mkdirSync(scheduledWakeDir(root), { recursive: true });
+        ensureDir(scheduledWakeDir(root));
         writeJsonAtomic(path.join(scheduledWakeDir(root), `${now}-${process.pid}-${crypto.randomBytes(4).toString("hex")}.json`), { at: now, roles, notBeforeMs: now + inMs });
     }
     else
@@ -251,6 +251,29 @@ export function requestAbort(root, role) {
     }
     return { ok: true, message: confirmation };
 }
+/** The marker-writing core of `tumwater abort --all`, shared with the GUI's POST /api/abort-all:
+ * drop one per-role marker per enabled runner (the same ids `runnerIds` names, each enabled role's
+ * bare id plus its `-2`… instances) that a running team consumes within one poll cycle — the
+ * team-wide twin of `requestAbort`'s one marker for one role. Idle roles' markers are swept by
+ * `consumeAbortRequests`' per-marker pass without aborting anything (`removeQuiet` runs even when
+ * no runner matches), so passing every enabled id is the same safe no-op `abort --role` of an idle
+ * role is. Reports the liveness gate structurally ({ok, message|error}) like requestAbort so the
+ * CLI can fail() and the GUI can shape its 409/200. */
+export function requestAbortAll(root) {
+    if (!orchestratorAlive(root)) {
+        return { ok: false, error: NO_HARNESS_ERROR };
+    }
+    const { config } = loadConfigCached(root);
+    const ids = config ? runnerIds(config) : [];
+    if (ids.length === 0)
+        return { ok: false, error: "no roles are enabled to abort" };
+    for (const id of ids)
+        writeJsonAtomic(abortRequestPath(root, id), { at: Date.now() });
+    return {
+        ok: true,
+        message: `abort requested for ${plural(ids.length, "role", "roles")} — the running team applies each within ~2s`,
+    };
+}
 /** The timed-pause clauses both pause confirmations share, in the plan's "… paused for
  * 30m — resumes automatically at 14:05" shape. The duration phrase comes from the parsed
  * value, not from until minus the message's own now — a few ms of clock skew between the two

package/dist/src/operator/retire.js

@@ -5,6 +5,7 @@ import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { runnerEnabled } from "../roles/runner-ids.js";
 import { branchExists, countCommitsInRange, currentBranch, deleteRef, isDirty, isMergedInto, refSha, targetBranch, } from "../git/git.js";
 import { errorMessage } from "../text/text.js";
+import { plural } from "../text/phrases.js";
 import { loadRunnerState } from "../runner/runner-state-load.js";
 import { branchName, mergeRefName, legacyLandingRefName, worktreePath } from "../paths.js";
 import { isUsableWorktree, removeWorktree } from "../git/worktree.js";
@@ -77,7 +78,7 @@ function objections(status) {
     if (status.enabledInConfig)
         reasons.push(`role ${status.role} is still enabled in tumwater.json — disable it first`);
     if (status.aheadOfMain > 0)
-        reasons.push(`branch ${branchName(status.role)} holds ${status.aheadOfMain} unmerged commit(s) — merge or discard them first`);
+        reasons.push(`branch ${branchName(status.role)} holds ${plural(status.aheadOfMain, "unmerged commit")} — merge or discard them first`);
     if (status.worktreePresent && !status.worktreeUsable)
         reasons.push("the worktree is unusable and cannot be checked for uncommitted changes — remove it manually or use --force");
     if (status.dirty)

package/dist/src/operator/revert.js

@@ -52,6 +52,20 @@ export async function resolveRevertTarget(root, ref) {
         return { ok: false, error: `${shortSha(full)} is not on ${primary}` };
     return { ok: true, full, primary };
 }
+/** The shared read-only prologue of a revert and its preview, so the two cannot drift: resolve
+ * `ref` to a merged single-parent commit (the resolveRevertTarget/parentRefusal refusals), then
+ * read its subject. The subject is what the reverted-role follow-up and the event log read, and
+ * both callers needed exactly these three steps before diverging into their own work. */
+async function resolveRevertSubject(root, ref) {
+    const target = await resolveRevertTarget(root, ref);
+    if (!target.ok)
+        return target;
+    const refusal = await parentRefusal(root, target.full);
+    if (refusal !== null)
+        return { ok: false, error: refusal };
+    const subject = await runGit(root, ["log", "-1", "--format=%s", target.full]);
+    return { ok: true, full: target.full, primary: target.primary, subject };
+}
 /** The refusal for a commit without exactly one parent (a root or a merge), or null. Shared by
  * the revert and its preview: `git revert` of a root deletes the whole tree, of a merge needs
  * `-m`. */
@@ -78,14 +92,10 @@ export function runRevertSha(role, run, detail) {
  * touches the index, the worktree or a ref. Never throws. */
 export async function previewRevert(root, ref) {
     try {
-        const target = await resolveRevertTarget(root, ref);
+        const target = await resolveRevertSubject(root, ref);
         if (!target.ok)
             return target;
-        const { full, primary } = target;
-        const refusal = await parentRefusal(root, full);
-        if (refusal !== null)
-            return { ok: false, error: refusal };
-        const subject = await runGit(root, ["log", "-1", "--format=%s", full]);
+        const { full, primary, subject } = target;
         const paths = (await runGit(root, ["diff", "--name-only", "--no-renames", full + "^", full]))
             .split("\n")
             .filter((p) => p.length > 0);
@@ -137,16 +147,12 @@ export async function revertMergedCommit(root, ref) {
         // awaits would block its event loop until the lock times out.
         await new Promise((resolve) => setImmediate(resolve));
         return await withPrimaryWorktreeLockAsync(root, async () => {
-            const target = await resolveRevertTarget(root, ref);
+            const target = await resolveRevertSubject(root, ref);
             if (!target.ok)
                 return target;
-            const { full } = target;
-            const refusal = await parentRefusal(root, full);
-            if (refusal !== null)
-                return { ok: false, error: refusal };
+            const { full, subject } = target;
             // `head` is captured before the revert so a future caller can compare before/after.
             const head = await headOf(root, "HEAD");
-            const subject = await runGit(root, ["log", "-1", "--format=%s", full]);
             // Fail-closed on any staged or unstaged change to a tracked path: we refuse to revert a
             // checkout that has one (untracked files are tolerated — the lock dir we just created is
             // one). This keeps the inverse commit free of unrelated content and, just as important,

package/dist/src/orchestrator/orchestrator-poll.js

@@ -13,7 +13,7 @@ import { TUMWATER_SOURCE } from "../events/events.js";
 import { consumeAbortRequests, consumeReclaimRequest, consumeRestartRequest, consumeResetRequest, consumeWakeRequest, } from "../operator/operator-requests.js";
 import { checkPermitSnapshot } from "../concurrency/check-permit.js";
 import { slotPoolSnapshot } from "../git/worktree-pool.js";
-import { redeployTarget } from "../baseline/main-baseline.js";
+import { redeployTarget, watchVerifiesMain } from "../baseline/main-baseline.js";
 import { p75RunDurationMs } from "../run/run-timing.js";
 import { pollTeamGates } from "../gates/gate-polls.js";
 import { heldProviders, windowHeldProviders } from "../team/team-hold.js";
@@ -175,7 +175,7 @@ export async function pollRedeploy(ctx, state, { liveConfig, mainHead, now }) {
         ctx.mainWatch.poll(mainHead, state.holdForRestart || state.diskHeld, liveConfig);
     if (!redeploy)
         return false;
-    const action = await redeploy.poll(await redeployTarget(ctx.root, mainHead, redeploy.build.sha), {
+    const action = await redeploy.poll(await redeployTarget(ctx.root, mainHead, redeploy.build.sha, watchVerifiesMain(ctx.root, liveConfig)), {
         roleInFlight: ctx.rolePermitHolders.size,
         directorInFlight: ctx.directorInFlight.size,
         roleRunP75Ms: p75RunDurationMs(ctx.roleRunDurationsMs),

package/dist/src/orchestrator/orchestrator.js

@@ -5,7 +5,7 @@ import { FALLBACK_BREAKER_POLICY, } from "../budget/fallback-breaker.js";
 import { newPollState, pollGatesAndHolds, pollMergeDrain, pollRedeploy, pollRequestsAndWatch, pollReserveAndExit, pollSchedule, } from "./orchestrator-poll.js";
 import { RoleRunner } from "../runner/runner.js";
 import { dropDanglingTumwaterPins, removeLegacyLandWorktrees } from "../git/worktree.js";
-import { pinCrashedRuns, retireLegacyRoleWorktrees } from "../git/worktree-pool.js";
+import { pinCrashedRuns, retireLegacyRoleWorktrees } from "../git/worktree-pool-startup.js";
 import { mergeTasks, newMergePipeline } from "../merge/merge-pipeline.js";
 import { bestEffortEventLogger, logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { removeQuiet } from "../files/files.js";

package/dist/src/orchestrator/retention.js

@@ -6,6 +6,7 @@
  * and the orchestrator only hands it the (possibly live-reloaded) window. */
 import { logEventBestEffort, warnEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { DAY_MS } from "../text/datetime.js";
+import { plural } from "../text/phrases.js";
 import { ensureParentDir, pruneOldFiles } from "../files/files.js";
 import { pruneSessionLedgers, pruneOpencodeSessions, pruneCodexSessions } from "../agent/session-ledger.js";
 import { loadConfigSafe } from "../config/config.js";
@@ -90,7 +91,7 @@ export class RetentionPruner {
             spillDir: opencodeSpillDir(root),
         });
         if (deleted > 0)
-            warnEventBestEffort(root, TUMWATER_SOURCE, `deleted ${deleted} expired opencode session(s)`);
+            warnEventBestEffort(root, TUMWATER_SOURCE, `deleted ${plural(deleted, "expired opencode session")}`);
         // Codex's sessions also live outside .tumwater — under the team's CODEX_HOME (part 8/9).
         // Resolve its binary and home exactly as a run's invocation would and purge its expired
         // sessions from the ledger BEFORE the file pass below ages it out. Like the OpenCode twin,
@@ -106,21 +107,21 @@ export class RetentionPruner {
             env: { ...process.env, CODEX_HOME: codexHomeDir },
         });
         if (deletedCodex > 0)
-            warnEventBestEffort(root, TUMWATER_SOURCE, `deleted ${deletedCodex} expired codex session(s)`);
+            warnEventBestEffort(root, TUMWATER_SOURCE, `deleted ${plural(deletedCodex, "expired codex session")}`);
         // Age out session/tool-output files now: an entirely stale dir is gone before the line
         // pass reads it. A running role's ledger mtime stays young, so pruneOldFiles never ages
         // that file out; each warning must name the unit it pruned.
         const pruned = pruneOldFiles(sessions, days) + pruneOldFiles(toolOutputDir(root), days);
         if (pruned > 0)
-            warnEventBestEffort(root, TUMWATER_SOURCE, `pruned ${pruned} old agent session/tool-output file(s)`);
+            warnEventBestEffort(root, TUMWATER_SOURCE, `pruned ${plural(pruned, "old agent session/tool-output file")}`);
         const prunedLines = pruneSessionLedgers(sessions, days);
         if (prunedLines > 0)
-            warnEventBestEffort(root, TUMWATER_SOURCE, `pruned ${prunedLines} stale session ledger line(s)`);
+            warnEventBestEffort(root, TUMWATER_SOURCE, `pruned ${plural(prunedLines, "stale session ledger line")}`);
         // Salvaged slot leftovers (src/git/slot-salvage.ts) age out on the same window as the
         // sessions that made them: a patch still waiting by then belongs to a role that has not run
         // since, and the operator had the window's length to take a kept one.
         const prunedPatches = pruneOldFiles(salvageDir(root), days);
         if (prunedPatches > 0)
-            warnEventBestEffort(root, TUMWATER_SOURCE, `pruned ${prunedPatches} old salvaged workspace patch(es)`);
+            warnEventBestEffort(root, TUMWATER_SOURCE, `pruned ${plural(prunedPatches, "old salvaged workspace patch", "old salvaged workspace patches")}`);
     }
 }

package/dist/src/paths.js

@@ -123,12 +123,6 @@ export function worktreeUseLockPath(root) {
 export function orchestratorStatePath(root) {
     return path.join(tumwaterDir(root), "state", "orchestrator.json");
 }
-/** The doctor's image-probe verdict cache (src/doctor/image-probe.ts): how each claimed
- * image-input model actually answered a live probe, keyed agent/provider/model. Runtime state
- * under .tumwater/state/, never committed. */
-export function imageProbesPath(root) {
-    return path.join(tumwaterDir(root), "state", "image-probes.json");
-}
 /** The images column `tumwater doctor` last read from `pi --list-models`, keyed provider/model.
  * Runtime state under .tumwater/state/, never committed. */
 export function piListedModelsPath(root) {
@@ -313,7 +307,7 @@ export function sessionDir(root, role) {
     return path.join(sessionsRootDir(root), role);
 }
 /** `sessionDir`'s real team root — the nearest ancestor holding a `.tumwater` directory — or
- * undefined when none does. run-agent installs the notes shim from THIS (never from teamRootOf,
+ * undefined when none does. run-spawn installs the notes shim from THIS (never from teamRootOf,
  * whose no-ancestor fallback can be a shared directory): writing `.tumwater` at the fallback
  * would mint a phantom harness root every other suite on the host then found — BUGS.md
  * 2026-10-18's `$TMPDIR/.tumwater/bin/tumwater-notes`. */
@@ -347,15 +341,15 @@ export function owningTeamRoot(dir) {
  * unreachable in a harness run and used only by OpenCode's harness-only read-back lookups
  * (opencodeDbPath, loadConfigSafe), which always see a real root. Never use this to decide
  * where to WRITE a `.tumwater`: the fallback can be a shared directory, and creating `.tumwater`
- * there mints a phantom root (BUGS.md 2026-10-18); run-agent's shim install uses
+ * there mints a phantom root (BUGS.md 2026-10-18); run-spawn's shim install uses
  * nearestTumwaterRoot instead. Moved here from the opencode adapter (plans/notes-command.md) so
- * run-agent's shim install — which every backend's run needs — shares the one lookup instead of
+ * run-spawn's shim install — which every backend's run needs — shares the one lookup instead of
  * the opencode adapter keeping it private. */
 export function teamRootOf(sessionDir) {
     return nearestTumwaterRoot(sessionDir) ?? path.dirname(path.dirname(sessionDir));
 }
 /** The directory the notes shim lands in, under a team root: `<root>/.tumwater/bin`.
- * run-agent installs the `tumwater-notes` command there (src/agent/notes-shim.ts) and
+ * run-spawn installs the `tumwater-notes` command there (src/agent/notes-shim.ts) and
  * run-marker's backendBaseEnv prepends it to every run's PATH, so a run on any backend finds
  * the command (plans/notes-command.md "Reaching it from a run"). */
 export function notesShimDir(root) {
@@ -450,6 +444,12 @@ export function witnessWorktreePath(root) {
 export function slotWorktreePath(root, n) {
     return path.join(worktreesDir(root), `_slot-${n}`);
 }
+/** A slot dir is canonical when it is exactly a `_slot-<n>` checkout under the worktrees dir.
+ * A migrated legacy `<role>` dir is not, which marks it for retirement once its resume finishes
+ * (retireLegacyRoleWorktrees in worktree-pool-startup.ts and releaseSlot in worktree-pool.ts). */
+export function isCanonicalSlotDir(dir) {
+    return /^_slot-\d+$/.test(path.basename(dir));
+}
 /** The worktree pool's dedicated checkout for the merge drain's merge-side work
  * (plans/worktree-pool.md, "Layout"): a single change, a stack and its bisect, the conflict
  * resolver and the post-resolve re-review. Kept out of the pool so a permit-waiting lease can

package/dist/src/pi/pi-bin.js

@@ -5,7 +5,7 @@ import { envPath, findOnPath, isExecutableFile } from "../files/files.js";
  * resolution `TUMWATER_<ID>_BIN` → `backends.<id>.bin` (pi's legacy `agentBin` alias) → the
  * backends' defaults (plans/agent-backends.md "Config"; plans/portability.md §5/7), the
  * executability rule the preflight askers share, and the missing-binary wording they quote.
- * The spawn (src/agent/run-agent.ts) resolves through each backend's resolveBin; the startup
+ * The spawn (src/agent/run-spawn.ts) resolves through each backend's resolveBin; the startup
  * gate (gates/startup-gate.ts) walks every enabled seam's backend through the same resolution and
  * executability rule, and doctor (doctor/doctor-checks.ts) asks them for every backend in use
  * (backendsInUse, the startup gate's rule). Each surface quotes this module's wording, so the
@@ -15,7 +15,7 @@ import { envPath, findOnPath, isExecutableFile } from "../files/files.js";
  * layer. */
 const PI_MISSING_MESSAGE = "pi not found on PATH — install it (https://github.com/badlogic/pi-mono) or add its bin directory to your PATH";
 /** The operator-facing name of each source, as it appears in failure text and doctor's
- * report. Exported so src/agent/run-agent.ts's spawn errors and doctor's checks quote the same
+ * report. Exported so src/agent/run-settle.ts's spawn errors and doctor's checks quote the same
  * string. `binEnv` is the environment variable a backend reads (pi's TUMWATER_PI_BIN by
  * default; claude's adapter passes TUMWATER_CLAUDE_BIN), and `configKey` is the tumwater.json
  * key the "config" source names (pi's legacy `agentBin`, or `backends.<id>.bin`), so a claude

package/dist/src/pi/pi-models.js

@@ -141,6 +141,15 @@ export function seamContextWindow(seam, projectRoot, modelsPath = piModelsPath()
             return null;
     }
 }
+/** The resolved primary seam's declared context window for a role — `configForRole` resolves
+ * the role's seam (the view the role page, status table/drawer and run history all print), then
+ * `seamContextWindow` names the window that seam declares, or null when it cannot be known. The
+ * one home of that resolution so the role page, the status table/drawer and a run's history
+ * header cannot disagree about the peak-ctx denominator. `modelsPath` defaults to pi's own
+ * catalog path, as `seamContextWindow` does, for read-only callers that have no seam handle. */
+export function seamContextWindowForRole(cfg, role, projectRoot, modelsPath = piModelsPath()) {
+    return seamContextWindow(configForRole(cfg, role), projectRoot, modelsPath);
+}
 /** A provider's `baseUrl` from pi's models.json, or null when the file, the provider or the
  * field is missing — what doctor probes to tell a local server that is down from one that is up. */
 export function piProviderBaseUrl(modelsPath, provider) {