tumwater 0.4.0 → 0.4.2

package/dist/src/roles/role-guidance.js

@@ -121,62 +121,45 @@ export const VALIDATION_GAP_TALLY = `One query counts both the verbatim line and
 export const VALIDATION_GAP_QUERY = `grep -snE '\\*\\*Validation gap:\\*\\* (${VALIDATION_GAP_TAGS.filter((t) => t !== "none").join("|")})' BUGS.md BUGS-FIXED.md | head -20`;
 /** The literal prefix every Needs-review note starts with. Exported so a reader that only has
  * to recognize one (the backlog index's ` [blocked: needs review]` mark) can match on it instead of
- * parsing the date or the wording out of the full template — the same split as
- * NEEDS_REPLAN_PREFIX. */
+ * parsing the date or the wording out of the full template. The rejected-final-round note the
+ * feature role appends (gate-notes.ts) also begins with this prefix, so it reads as a Needs-review
+ * note and is classified by entryHold accordingly. */
 export const NEEDS_REVIEW_PREFIX = `**Needs review `;
-/** The tag text before the held count, shared by the note templates and the parser
- * (backlog-eligibility's heldCount) so the two cannot drift: the live count on a Needs-review
- * or Needs-replan note is written inline as `(held N)`, with `N` one past the surviving prior
- * count (the feature role appends it, the plan role's split carries it via PRIOR_HELD_NOTE). */
+/** The tag text before a held count, read by the backlog (backlog-eligibility's heldCount) so
+ * the note form and the parser cannot drift. No writer emits `(held N)` anymore — the feature
+ * note is flat — but heldCount still parses the tag from a Needs-review note line already on
+ * disk until part 2f/6 removes the reader. */
 export const HELD_TAG_PREFIX = `(held `;
 /** The markdown note the feature role appends to a plan it cannot finish in one run, so the plan
  * role can split it. Mirrors the **Refused …** note convention: a note the next fresh run reads,
  * with no code parsing it. Defined once so the feature and plan texts and the director's routing
- * clause cannot drift. The trailing `(held <N>)` tag (HELD_TAG_PREFIX) is the live held count,
- * written as one past the count surviving on the entry; it sits inside the line, so
- * NEEDS_REVIEW_PREFIX still recognizes the note. */
-export const NEEDS_REVIEW_NOTE = `${NEEDS_REVIEW_PREFIX}<YYYY-MM-DD> by feature: too large for one run ${HELD_TAG_PREFIX}<N>)**`;
+ * clause cannot drift. No writer carries a `(held <N>)` count anymore: a too-large note stays
+ * flat, so a new hold never escalates to the operator's desk. */
+export const NEEDS_REVIEW_NOTE = `${NEEDS_REVIEW_PREFIX}<YYYY-MM-DD> by feature: too large for one run**`;
 /** The literal reason the automatic convergence hold writes into a held plan's note
  * (holdEntryAfterExhaustion, src/runner/revision.ts, builds the note as
  * `**Needs review … by <role>: could not converge — <surviving objections>**`, INV-BH4).
  * Exported so the writer and the reader share one literal: it sits between holdEntryAfterExhaustion
  * (which writes the note) and the plan role's charter (role-catalog.ts `find`) which reads it, so
  * reason to recognize the automatic hold as distinct from the feature role's too-large
- * ${NEEDS_REVIEW_NOTE} note and the ${NEEDS_REPLAN_PREFIX} note — both carry no
- * `could not converge` text, so the charter routes each hold to its own action without matching
- * on a second literal. Add no second spelling of this text. */
+ * ${NEEDS_REVIEW_NOTE} note — it carries no `could not converge` text, so the charter routes
+ * each hold to its own action without matching on a second literal. Add no second spelling of
+ * this text. */
 export const CONVERGENCE_HOLD_MARKER = "could not converge";
-/** The marker a lifted hold leaves behind, so a split or rewrite carries the count instead of
- * letting it reset: `**Previously held N**` on the note's line. The live count is `(held N)` on
- * the note; the surviving marker after a lift is `**Previously held N**` — heldCount reads the
- * first as the priority, then the second. */
+/** The marker a lifted hold leaves behind, so a split or rewrite carried the count instead of
+ * letting it reset: `**Previously held N**` on the note's line. No writer emits this anymore (the
+ * plan role's split no longer carries a count) and heldCount no longer reads it, so it is inert;
+ * withoutHeldForOperatorNotes still drops a surviving `**Previously held N−1**` line beside a
+ * released at-threshold note until part 2f/6 retires the count machinery. */
 export const PRIOR_HELD_PREFIX = `**Previously held `;
-/** The literal marker a lift leaves on a split or rewrite so the held count survives instead of
- * resetting: a `**Previously held <N>**` line at the same count the lifted note carried (the
- * <N> here is the value the note's `(held N)` tag held). heldCount reads this as the fallback
- * when no live note is present, so the count round-trips a split. */
-export const PRIOR_HELD_NOTE = `${PRIOR_HELD_PREFIX}<N>**`;
-/** The literal prefix every Needs-replan note starts with. Exported so a reader that only has to
- * recognize one (the backlog index's ` [blocked: needs replan]` mark) can match on it instead of
- * parsing the date or the round count out of the full template. */
-export const NEEDS_REPLAN_PREFIX = `**Needs replan `;
-/** The markdown note the feature role appends under a plan whose change was rejected after its
- * final revision round, carrying the reviewer's objections back to the strong-tier plan role
- * instead of letting feature re-author the same plan. Same convention as NEEDS_REVIEW_NOTE: a
- * note a later fresh run reads, with no code parsing it. The trailing `(held <H>)` tag
- * (HELD_TAG_PREFIX) is the live held count, one past the count surviving on the entry; the
- * placeholder is `<H>` (for held) so it reads apart from the `<N>` review-round count earlier
- * in the same line. It sits inside the line, so NEEDS_REPLAN_PREFIX still recognizes the note. */
-export const NEEDS_REPLAN_NOTE = `${NEEDS_REPLAN_PREFIX}<YYYY-MM-DD> by feature: rejected after <N> review rounds ${HELD_TAG_PREFIX}<H>)**`;
-/** The literal prefix every Waiting-for-the-next-failure note starts with. Exported so a reader
- * that only has to recognize one (the backlog index's ` [blocked: waiting for the next failure]`
- * mark) can match on it instead of parsing the date or the wording out of the full template. */
-export const WAITING_FOR_FAILURE_PREFIX = `**Waiting for the next failure `;
-/** The markdown note the bugfix role writes under an open bug it cannot reproduce once it has made
- * the failure explain itself, so bugfix stops spending runs without new evidence. Same convention
- * as NEEDS_REPLAN_NOTE: a note a later fresh run reads. It lifts when whoever records the next
- * occurrence deletes the line, or by `tumwater bug --release <n>`. */
-export const WAITING_FOR_FAILURE_NOTE = `${WAITING_FOR_FAILURE_PREFIX}<YYYY-MM-DD> by bugfix: <what the next failure's message will show>**`;
+/** The literal marker the plan role writes as its own line under the PLANS.md `## Planned` entry
+ * that declares this project's deterministic check, and the feature role reads as that entry's
+ * identity. It is the one decision point between the two no-check notes (gate-notes.ts
+ * buildNoCheckNote): no marker → the plan note (write the declaration entry); marker → the
+ * feature note (implement it). Defined once so the marker the plan note names, the one
+ * declarationPlanEntry recognizes (src/backlog/backlog.ts), and the catalog texts interpolate stay
+ * identical. */
+export const CHECK_DECLARATION_MARKER = `**Declares the project check**`;
 /** How a role with no backlog (organize, clean, dedupe, perf, security, robustness, improve) finds
  * its one task, as numbered steps. Written against the observed failure: with nothing to point
  * at, a local model reads the codebase file by file — thirty whole-file reads, ~300 KB of tool

package/dist/src/roles/role-render.js

@@ -74,6 +74,23 @@ function inspectBodyLines(p, now) {
         }
         lines.push("");
     }
+    // The feedback observer's per-install filing ledger (role-view.ts's filings,
+    // feedback-filings.ts's filingRows): each issue this install filed, newest-first, its number,
+    // title, and age — the operator twin of the ledger that is otherwise the observer's only
+    // memory. Present only for feedback, so every other role's render stays byte-identical; an
+    // enabled-but-quiet observer reads as "none filed yet" rather than a truncated report.
+    if (p.filings) {
+        lines.push("## Filings", "");
+        if (p.filings.length === 0) {
+            lines.push("- none filed yet");
+        }
+        else {
+            for (const f of p.filings) {
+                lines.push(`- #${f.issue} ${f.title} — ${formatAge(now - f.filedAt)} ago`);
+            }
+        }
+        lines.push("");
+    }
     lines.push(...fencedOrNone("Next run's prompt", p.nextPrompt, "nothing to do this run"));
     // run-prompt.ts dequeues exactly one queued prompt per run, so with more than one
     // waiting the block above shows only the oldest — say so, so the count line and the
@@ -306,6 +323,8 @@ export function renderRoleMarkdown(p, now = Date.now()) {
         let cap = `- Daily cap: ${usd(dc.spentUsd)} of ${usd(dc.capUsd)} spent today (${dc.over ? "holding now — no new runs until local midnight" : "not holding"})`;
         if (dc.roleIds.length > 1)
             cap += ` · shared by ${dc.roleIds.join(", ")}`;
+        if (p.dailyCapHitAt !== undefined)
+            cap += ` · ~cap at ${clockHm(p.dailyCapHitAt)}`;
         lines.push(cap);
     }
     // The role's schedule (role-view.ts's nextRunAt/backoffSeconds/lastRunEndedAt, read from

package/dist/src/roles/role-view.js

@@ -15,22 +15,23 @@ import { pausedRoles } from "../team/team-state.js";
 import { loadRunnerState } from "../runner/runner-state-load.js";
 import { baseRoleOf, runnerIds, runnerPaused } from "./runner-ids.js";
 import { roleCapVerdicts } from "../gates/role-cap-gates.js";
+import { projectCapHit } from "../budget/budget.js";
 import { yieldMultiplierFor } from "../scheduling/backoff.js";
 import { quietHoursStatus } from "../scheduling/quiet-hours.js";
 import { assembleRunPrompt } from "../run/run-prompt.js";
 import { configForRole, resolvedModelFields, reviewedAfterMerge, reviewRunConfig, roleSeamTier, seamConcurrencyKey } from "../config/config-views.js";
 import { fallbackPair, modelFallbackView } from "../config/config-fallbacks.js";
-import { fallbackModelPair, piModelsPath, seamContextWindow } from "../pi/pi-models.js";
+import { fallbackModelPair, piModelsPath, seamContextWindowForRole } from "../pi/pi-models.js";
 import { readOpencodeCache } from "../agent/opencode/opencode-catalog.js";
 import { formatModelSelector } from "../config/model-selector.js";
 import { roleImageInfo } from "../agent/image-input.js";
 import { readPiListedModels } from "../pi/pi-listed-models.js";
-import { readImageProbeCache } from "../doctor/image-probe.js";
 import { piSettingsPath, readPiDefaultModel } from "../pi/pi-settings.js";
 import { readClaudeAccount } from "../agent/claude/claude-account.js";
 import { readAccount, windowEntries } from "../agent/subscription-account.js";
 import { CONFIG_BASENAME, configPath, roleNotesPath } from "../paths.js";
 import { coverageRows, readQaCoverage } from "../run/qa-coverage.js";
+import { filingRows, readFeedbackFilings } from "../run/feedback-filings.js";
 import { readTextOrNull, statOrNull } from "../files/files.js";
 import { eventRole, eventUsage, readEvents } from "../events/event-read.js";
 import { finiteNumber, objectOrEmpty } from "../files/json-object.js";
@@ -210,14 +211,19 @@ export function rolePayload(root, typedRole, modelsPath = piModelsPath(), now =
     const backendOverride = typeof backendOverrideRaw === "string" ? backendOverrideRaw : undefined;
     const capUsd = cfg.maxDailyCostUsdPerRole?.[base];
     let dailyCap;
+    let dailyCapHitAt;
     if (role !== DIRECTOR_ROLE && typeof capUsd === "number" && Number.isFinite(capUsd) && capUsd > 0) {
         const ids = runnerIds(cfg).filter((id) => baseRoleOf(id) === base);
         if (!ids.includes(role))
             ids.push(role);
         const runners = ids.map((id) => ({ role: id, state: id === role ? state : loadRunnerState(root, id) }));
         const verdict = roleCapVerdicts(runners, cfg.maxDailyCostUsdPerRole, now.getTime()).get(base);
-        if (verdict)
+        if (verdict) {
             dailyCap = { capUsd, spentUsd: verdict.spentUsd, over: verdict.over, roleIds: verdict.roleIds };
+            const hitAt = projectCapHit({ spentUsd: verdict.spentUsd, capUsd }, now.getTime());
+            if (hitAt !== null)
+                dailyCapHitAt = hitAt;
+        }
     }
     // The role's notes, read for display. The same degradation as every other read here: a
     // missing, empty, or unreadable file is simply "no note yet". The director has none.
@@ -245,7 +251,7 @@ export function rolePayload(root, typedRole, modelsPath = piModelsPath(), now =
     }
     // The resolved primary seam's declared context window. A run currently on the model
     // fallback may use a different window, which is the fallback's own documented state.
-    const contextWindow = seamContextWindow(configForRole(cfg, role), root, modelsPath);
+    const contextWindow = seamContextWindowForRole(cfg, role, root, modelsPath);
     return {
         id: role,
         title: resolved.title,
@@ -272,7 +278,7 @@ export function rolePayload(root, typedRole, modelsPath = piModelsPath(), now =
         ...(account !== null ? { billing: account.billing, billingBackend } : {}),
         ...(billingWindow !== undefined ? { billingWindow } : {}),
         chainStep,
-        ...roleImageInfo(cfg, role, modelsPath, readImageProbeCache(root), readPiListedModels(root)),
+        ...roleImageInfo(cfg, role, modelsPath, readPiListedModels(root)),
         minRunIntervalSeconds: effective.minRunIntervalSeconds,
         ...(minRunIntervalOverride !== undefined ? { minRunIntervalOverride } : {}),
         ...(providerOverride !== undefined ? { providerOverride } : {}),
@@ -306,6 +312,13 @@ export function rolePayload(root, typedRole, modelsPath = piModelsPath(), now =
         // payload and Markdown render stay byte-identical. The ledger read degrades to empty
         // coverage on a missing or torn file exactly as readQaCoverage already does.
         ...(role === "qa" ? { flowCoverage: coverageRows(readQaCoverage(root), now.getTime()) } : {}),
+        // The feedback observer's per-install filing ledger (plans/feedback-role.md 2/2), the twin
+        // of qa's flowCoverage block above: each issue this install filed, newest-first via the one
+        // filingRows ordering the prompt block and the operator read share. Present only for the
+        // canonical feedback id, so every other role's --json payload and Markdown render stay
+        // byte-identical. The ledger read degrades to an empty list on a missing or torn file
+        // exactly as readFeedbackFilings already does.
+        ...(role === "feedback" ? { filings: filingRows(readFeedbackFilings(root)) } : {}),
         inboxCount: queuedRolePromptCount(root, role),
         // The resolved primary seam's declared context window in tokens, or null when it cannot
         // be known (a non-pi seam, an unresolvable provider/model pair, or a model with no
@@ -332,5 +345,6 @@ export function rolePayload(root, typedRole, modelsPath = piModelsPath(), now =
         ...(recentOutcomes.length > 0 ? { recentOutcomes } : {}),
         ...(usage.tokens !== 0 || usage.costUsd !== 0 || usage.notionalCostUsd !== 0 ? { usage } : {}),
         ...(dailyCap ? { dailyCap } : {}),
+        ...(dailyCapHitAt !== undefined ? { dailyCapHitAt } : {}),
     };
 }

package/dist/src/roles/roles.js

@@ -30,9 +30,8 @@ const WORK_ROLES = new Set(["feature", "bugfix", "plan"]);
  * event log for `selfcheck` and `feedback`) is not a function of whether main moved. */
 export const OBSERVER_ROLES = new Set(["qa", "selfcheck", "feedback", "ci"]);
 /** The built-in maintenance roles that author code on their own cadence — the eight members
- * DEFERRABLE_ROLES and BASELINE_BLOCKED_ROLES share. Both sets list them because both charter
- * the same roles (defer-until-needed scheduling, red-main blocking), so the list lives once
- * here and a new maintenance role cannot be added to one set and missed in the other. */
+ * DEFERRABLE_ROLES charts. The list lives once here so a new maintenance role cannot be added
+ * to one list and missed in the other. */
 const CODE_MAINTENANCE_ROLES = [
     "organize",
     "coverage",
@@ -74,25 +73,6 @@ export function yieldScaledRole(role) {
 export function roleTier(role) {
     return WORK_ROLES.has(baseRoleOf(role)) ? 0 : 1;
 }
-/** The roles blocked from starting an authoring run while main's own build/test suite is known
- * red with no failing test named (the red-main baseline check; a red that names its failing tests
- * blocks nothing, and these roles get a `<main-known-red>` note instead): every role whose diff
- * can carry non-exempt (code) changes — on a red main such a diff is rejected deterministically
- * by the gate's pre-check, so spending an authoring run on it is pure waste. Exempt: director
- * (human prompts outrank autonomous gates, like the budget gate), ci (the designated healer
- * — its run executes the suite per "leave the project working" and can fix a red main through the
- * existing pre-merge gate; blocking it would leave only the ci role able to unblock the team), and
- * plan/readme/steward/qa/selfcheck/feedback (markdown-only charter — their diffs are exempt
- * from the build pre-check via review.exemptPaths, so a red main does not block them). */
-export const BASELINE_BLOCKED_ROLES = new Set([
-    "feature",
-    ...CODE_MAINTENANCE_ROLES,
-]);
-/** Is this role id blocked from authoring on a red main? True when its base role is in
- * BASELINE_BLOCKED_ROLES, so `feature-2` is blocked exactly as `feature` is. */
-export function baselineBlocked(role) {
-    return BASELINE_BLOCKED_ROLES.has(baseRoleOf(role));
-}
 /** Work ratio 4/4: which commit tier a role's base role merges into, for the work vs maintenance
  * split the report and the "Merged today" tile show and the maintenance allowance (Work ratio
  * 1a/4, src/gates/maintenance-quota.ts) counts. The one home of the split. `work` is the

package/dist/src/run/ci-parity.js

@@ -8,8 +8,8 @@
  * under .tumwater/state/ and degrades to "no data" on any missing or malformed file: an
  * observer must never fail a run on bookkeeping (the same policy as qa-coverage.ts). A stale
  * verdict that stays stale past `CI_PARITY_STALE_MS` is a stall — the full suite has silently
- * stopped covering new tips — surfaced as a doctor warn and a standing `ci-stale` alert through
- * the one `ciParityStalled` predicate. */
+ * stopped covering new tips — surfaced as the doctor `ci parity` warn through the one
+ * `ciParityStalled` predicate. */
 import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
 import { ciParityPath } from "../paths.js";
 import { isJsonObject } from "../files/json-object.js";
@@ -20,14 +20,13 @@ import * as fs from "node:fs";
 import path from "node:path";
 /** A stale verdict that stays stale past this window is a stall: the `ci` role — now the
  * full suite's own runner — has silently stopped covering new tips (disabled, paused, wedged,
- * or failing before it records). The doctor `ci parity` warn and the standing `ci-stale` alert
- * share this one threshold, so the surfaces cannot disagree on when stale is a problem. */
+ * or failing before it records). The doctor `ci parity` warn reads this one threshold, so the
+ * row and the ledger cannot disagree on when stale is a problem. */
 export const CI_PARITY_STALE_MS = 3 * DAY_MS;
 /** True only when a parity record exists, reads `stale` (a `failed` record already warns and
  * a `current` one is verified for the tip), and has not covered a tip within the stall
  * window. Parameter is structural — not `CiParityStatus` — so the status-polls → ci-parity
- * import edge stays one-way. This is the single stall predicate shared by the doctor row and
- * the alert. */
+ * import edge stays one-way. This is the single stall predicate the doctor row reads. */
 export function ciParityStalled(parity, now) {
     return !!parity && parity.state === "stale" && now - parity.lastRunAt > CI_PARITY_STALE_MS;
 }

package/dist/src/run/feedback-filings.js

@@ -14,6 +14,13 @@ import { formatAge } from "../text/datetime.js";
  * caps the block's growth and the prompt's size; older filings are dropped (the charter still
  * dedupes against the live `gh issue list`). */
 export const FEEDBACK_FILINGS_MAX = 100;
+/** Collect the ledger into `FilingRow`s newest-first by `filedAt` — a stable sort, so two
+ * filings sharing a timestamp keep their ledger (insertion) order. A ledger stored by
+ * `recordFiled` is already newest-first, so this reorders nothing on the normal path; it
+ * guarantees a hand-edited or torn file that is not already ordered still reads consistently. */
+export function filingRows(filings) {
+    return [...filings].sort((a, b) => b.filedAt - a.filedAt);
+}
 function isFiling(value) {
     if (!isJsonObject(value))
         return false;
@@ -46,6 +53,8 @@ export function recordFiled(root, issue, title, now = Date.now()) {
 export function renderFilingsBlock(filings, now = Date.now()) {
     if (filings.length === 0)
         return undefined;
-    const lines = filings.map((f) => `  #${f.issue} ${f.title} (${formatAge(now - f.filedAt)})`);
+    // Render through filingRows, the one ordering the prompt block and the operator read share,
+    // so a ledger not already newest-first still reads that way in both places.
+    const lines = filingRows(filings).map((f) => `  #${f.issue} ${f.title} (${formatAge(now - f.filedAt)})`);
     return ["Previously filed from this install:", ...lines].join("\n");
 }

package/dist/src/run/qa-coverage.js

@@ -26,15 +26,15 @@ export const QA_FLOWS = [
 /** A coverage ledger whose newest exercise is older than this window is a stall: the `qa`
  * role — the team's only flow-level observer, the one role that exercises the product's own
  * flows like a user — has silently stopped recording any exercise (disabled, paused, wedged,
- * or failing before it records). The doctor `qa coverage` warn and the standing `qa-stale`
- * alert share this one threshold, mirroring `ciParityStalled`'s `CI_PARITY_STALE_MS`. */
+ * or failing before it records). The doctor `qa coverage` warn fires through this one
+ * threshold, mirroring `ciParityStalled`'s `CI_PARITY_STALE_MS`. */
 export const QA_COVERAGE_STALE_MS = 3 * DAY_MS;
 /** True only when the ledger has at least one well-formed entry and every entry's `lastRunAt`
  * is older than the stall window (`now - max(lastRunAt) > QA_COVERAGE_STALE_MS`). An empty
  * ledger — a missing file, or a project that never ran qa — is not a stall: "no record yet" is
  * not "stopped recording", the same rule `ciParityStalled` applies to a missing parity record.
- * This is the one stall predicate the doctor row (`checkQaCoverage`) and the alert
- * (`qaCoverageAlert`) share, so the surfaces cannot disagree on when a quiet qa is a problem. */
+ * This is the one stall predicate the doctor's `qa coverage` row (`checkQaCoverage`) reads, so
+ * the row and the ledger cannot disagree on when a quiet qa is a problem. */
 export function qaCoverageStalled(coverage, now) {
     let newest = 0;
     let has = false;

package/dist/src/run/run-apply.js

@@ -36,6 +36,16 @@ export function clearSupersededRejection(s) {
  * quiet team). Small on purpose — at 3 the error ladder has already doubled twice and
  * the failure is clearly not transient. */
 export const ERROR_STREAK_WARN = 3;
+/** Whether a role's consecutive-error count is at or past the warn bar (ERROR_STREAK_WARN) —
+ * the "failing" predicate the status phase cell (status-model.ts's onErrorStreak), the status
+ * poll's slot-demand read (status-roles.ts), and the doctor's error-streaks check
+ * (doctor-holds.ts) each test, so the threshold comparison cannot drift between them. The
+ * `=== ERROR_STREAK_WARN` crossing edges (run-finalize.ts, merge-slot.ts) are a different
+ * comparison (the single run that reached the bar, not the at-or-past state) and stay
+ * inline. */
+export function errorStreakAtWarn(s) {
+    return (s.consecutiveErrors ?? 0) >= ERROR_STREAK_WARN;
+}
 /** Consecutive failed runs after which the error-streak circuit breaker (src/gates/streak-gate.ts)
  * auto-pauses the role through the per-role pause marker — the same act-on-it escalation the
  * budget gate and the pause gates perform, applied to a role failing on its own cause. Ten,
@@ -47,8 +57,10 @@ export const ERROR_STREAK_BREAKER = 10;
 /** Resumes granted to one context-ceiling cut-off streak before the role stops resuming the
  * task and falls back to a fresh run: a task that outruns the ceiling on every attempt (even
  * from a freshly compacted context) is too big to converge, and each cycle costs an hour-plus
- * of model time on local hardware. The streak itself keeps counting (RunnerState.cutOffStreak). */
-const CUT_OFF_RESUME_LIMIT = 3;
+ * of model time on local hardware. The streak itself keeps counting (RunnerState.cutOffStreak)
+ * so one warning per episode can be raised (run-finalize.ts) and the resting cell can read
+ * ` · cut off ×N` (status-model.ts rolePhase). */
+export const CUT_OFF_RESUME_LIMIT = 3;
 /** Resumes granted to one quiet-kill streak before the role abandons the starved pi session
  * and takes a fresh run on the idle ladder. A session the backend defers past the quiet
  * watchdog every attempt would otherwise re-send the same input immediately and forever,

package/dist/src/run/run-detail-data.js

@@ -14,6 +14,9 @@ import { bucketMergeEvents, resolveQueuedResult } from "../history/history-queue
 import { eventUsage, readEvents, runSpanMs, runStartMap } from "../events/event-read.js";
 import { outcomeText, usageText } from "../events/event-format.js";
 import { baseRoleOf } from "../roles/runner-ids.js";
+import { loadConfigSafe, defaultConfig } from "../config/config.js";
+import { seamContextWindowForRole } from "../pi/pi-models.js";
+import { nonNegativeNumber } from "../files/json-object.js";
 /** The commit a run pinned: the `commit` of the first `merge_queued`/`merge_done` event in its
  * block carrying a non-empty one, else null. The one rule both the header's sha and --stat use. */
 export function runCommitSha(d) {
@@ -58,7 +61,7 @@ export function readRunDetail(root, role, runNumber) {
         for (let i = events.length - 1; i >= 0; i--) {
             const e = events[i];
             if (e.type === "run_end" && e.run === runNumber)
-                return detailFrom(role, runNumber, all, events, [e], e, null);
+                return detailFrom(root, role, runNumber, all, events, [e], e, null);
         }
         return null;
     }
@@ -89,13 +92,19 @@ export function readRunDetail(root, role, runNumber) {
             break;
         block.push(e);
     }
-    return detailFrom(role, runNumber, all, events, block, end, start);
+    return detailFrom(root, role, runNumber, all, events, block, end, start);
 }
 /** Fill the payload around a collected block: usage from the run_end via eventUsage/usageText,
  * duration via runSpanMs against the role's own start map (the shared pairing helper, so this
  * view and the history rows cannot drift on what a span is), events oldest-first. */
-function detailFrom(role, runNumber, all, scoped, block, end, start) {
+function detailFrom(root, role, runNumber, all, scoped, block, end, start) {
     const usageNums = end === null ? { tokens: 0, costUsd: 0 } : eventUsage(end);
+    // The run_end's prompt-token total and its cache-read subset, corrupt-field-guarded reads
+    // (nonNegativeNumber, the same guard peakContextTokens applies) with the cache subset
+    // clamped to the total so the rendered share never exceeds 100%; 0 on an in-flight run.
+    const promptTokens = end === null ? 0 : nonNegativeNumber(end.promptTokens, 0);
+    const cacheReadTokens = end === null ? 0 : Math.min(nonNegativeNumber(end.cacheReadTokens, 0), promptTokens);
+    const preEditPromptTokens = end === null ? 0 : Math.min(nonNegativeNumber(end.preEditPromptTokens, 0), promptTokens);
     let result = end === null ? null : outcomeText(end);
     let merge = null;
     if (end !== null && result === "queued") {
@@ -108,6 +117,7 @@ function detailFrom(role, runNumber, all, scoped, block, end, start) {
             merge = resolved.outcome;
         }
     }
+    const mergedEvent = mergedEventOf(result, merge, scoped, block);
     const detail = {
         role,
         run: runNumber,
@@ -119,9 +129,30 @@ function detailFrom(role, runNumber, all, scoped, block, end, start) {
         tokens: usageNums.tokens,
         costUsd: usageNums.costUsd,
         usage: end === null ? "" : usageText(end),
+        // The peak is a corrupt-field-guarded read of the run_end (nonNegativeNumber, the same
+        // guard promptStatsFor applies); the window comes from the shared seamContextWindowForRole —
+        // same seam the role view and status table print — with loadConfigSafe falling back to
+        // defaults, so a broken tumwater.json yields a null window rather than failing this read-only
+        // view.
+        peakContextTokens: end === null ? 0 : nonNegativeNumber(end.peakContextTokens, 0),
+        // The run's prompt-token total and its cache-read subset, spread so a prompt-free or
+        // in-flight run keeps today's exact payload (no prompt/cache keys) and a cache subset > 0.
+        ...(promptTokens > 0 ? { promptTokens } : {}),
+        ...(cacheReadTokens > 0 ? { cacheReadTokens } : {}),
+        ...(preEditPromptTokens > 0 ? { preEditPromptTokens } : {}),
+        // The run_end's ceiling-truncation flag, spread so an in-flight, older, or normal run
+        // keeps today's exact payload (no cutOff key).
+        ...(end !== null && end.cutOff === true ? { cutOff: true } : {}),
+        contextWindow: seamContextWindowForRole(loadConfigSafe(root).config ?? defaultConfig(), role, root),
         events: block,
         merge,
         mergedSha: mergedShaOf(result, merge, scoped, block),
+        // The end-of-run → on-main landing latency (the landing `merged` event's ts minus the run
+        // end's), spread so a run without both an end and a landing event — or a landing before its
+        // end, or a negative difference — keeps today's exact payload (no key).
+        ...(end !== null && mergedEvent !== null && mergedEvent.ts - end.ts >= 0
+            ? { mergeAfterRunMs: mergedEvent.ts - end.ts }
+            : {}),
         reverted: null,
     };
     detail.reverted = revertedOf(detail, all);
@@ -153,23 +184,32 @@ function revertedOf(d, all) {
     }
     return null;
 }
-/** The commit of the newest `merged` event in `pool` (oldest-first) inside [from, to]. */
-function newestMergedCommit(pool, from, to) {
+/** The newest `merged` event in `pool` (oldest-first) inside [from, to], or null when none. */
+function newestMergedEvent(pool, from, to) {
     for (let i = pool.length - 1; i >= 0; i--) {
         const e = pool[i];
         if (e.type === "merged" && e.ts >= from && e.ts <= to && typeof e.commit === "string" && e.commit !== "") {
-            return e.commit;
+            return e;
         }
     }
     return null;
 }
-/** The landed sha for a detail: see RunDetail.mergedSha. */
-function mergedShaOf(result, merge, scoped, block) {
+/** The landing `merged` event for a detail, the one behind its `mergedSha` and its
+ * `mergeAfterRunMs` span: the newest in the block for a run that merged directly (result
+ * `changed`, no queued resolve) or the newest inside the merge's own window (`merge_done` ts
+ * minus its `durationMs`, up to its ts) for a queued run; null for every other run and when
+ * the event rotated out or the merge was a no-op fast-forward (which logs none). */
+function mergedEventOf(result, merge, scoped, block) {
     if (merge === null) {
-        return result === "changed" ? newestMergedCommit(block, -Infinity, Infinity) : null;
+        return result === "changed" ? newestMergedEvent(block, -Infinity, Infinity) : null;
     }
     if (merge.type !== "merge_done" || typeof merge.durationMs !== "number" || !Number.isFinite(merge.durationMs)) {
         return null;
     }
-    return newestMergedCommit(scoped, merge.ts - merge.durationMs, merge.ts);
+    return newestMergedEvent(scoped, merge.ts - merge.durationMs, merge.ts);
+}
+/** The landed sha for a detail: see RunDetail.mergedSha. */
+function mergedShaOf(result, merge, scoped, block) {
+    const e = mergedEventOf(result, merge, scoped, block);
+    return e === null ? null : e.commit;
 }

package/dist/src/run/run-detail-render.js

@@ -3,7 +3,7 @@ import { formatEvent } from "../events/event-format.js";
 import { eventTypeLabel } from "../events/event-labels.js";
 import { roleLabel } from "../roles/role-labels.js";
 import { shortSpanPhrase } from "../text/phrases.js";
-import { shortSha } from "../text/format.js";
+import { shortSha, contextShareLabel, compactTokens } from "../text/format.js";
 import { piLogPath } from "../paths.js";
 import { readRunTranscript } from "../ui/transcript-run.js";
 import { gitTry } from "../git/git-run.js";
@@ -47,10 +47,35 @@ export function renderRunDetail(d) {
         summary.push(d.startTs === null ? "unpaired" : "in flight");
     else
         summary.push(d.result ? eventTypeLabel(d.result) : "?");
+    // The ceiling-truncation marker, straight after the result cell. It only rides a
+    // completed end (cutOff is set from the run_end), so it can never follow in flight/unpaired.
+    if (d.cutOff === true)
+        summary.push("cut off at the context ceiling");
     if (d.durationMs !== null)
         summary.push(shortSpanPhrase(d.durationMs));
     if (d.usage !== "")
         summary.push(d.usage);
+    // The run's prompt-token total and the share the backend served from cache, the input
+    // side a cost-only header hides. The `${n}% cached` wording and rounding are the usage
+    // report's `Prompt tokens by role` share; a run with prompt tokens but no cache reads
+    // shows no parenthetical, and a run that reported neither keeps today's header
+    // byte-identical (the omit-when-zero convention).
+    const prompt = d.promptTokens ?? 0;
+    const cached = Math.min(d.cacheReadTokens ?? 0, prompt);
+    if (prompt > 0)
+        summary.push(cached > 0 ? `prompt ${compactTokens(prompt)} tok (${Math.round((100 * cached) / prompt)}% cached)` : `prompt ${compactTokens(prompt)} tok`);
+    // The run's pre-edit prompt-token share, the `… before first edit` signal a cost-only
+    // header hides: how much of the prompt budget went out before the run made its first
+    // edit. Clamped to the total (run-detail-data.ts), written after the prompt cell and
+    // before the peak-context cell; a run that reported no pre-edit reading — and an
+    // in-flight run — keeps today's header byte-identical.
+    const preEdit = Math.min(d.preEditPromptTokens ?? 0, prompt);
+    if (preEdit > 0)
+        summary.push(`pre-edit ${compactTokens(preEdit)} tok`);
+    // The run's peak context against the seam's declared window, the one header every surface
+    // renders. Omitted when the run reported no peak (byte-identical to today's header).
+    if ((d.peakContextTokens ?? 0) > 0)
+        summary.push(`peak ctx ${contextShareLabel(d.peakContextTokens ?? 0, d.contextWindow)}`);
     if (d.model !== null)
         summary.push(d.model);
     const sha = runCommitSha(d);
@@ -59,6 +84,12 @@ export function renderRunDetail(d) {
         header += ` · commit ${shortSha(sha)}`;
     if (d.mergedSha !== null && d.mergedSha !== sha)
         header += ` · merged as ${shortSha(d.mergedSha)}`;
+    // The end-of-run → on-main landing latency, the per-change twin of the day report's `Merge
+    // wait median`. shortSpanPhrase is the duration cell's renderer, so both spans read alike; a
+    // run without the field (rejected/failed merge, in flight, landing rotated out, no-op
+    // fast-forward) keeps today's header byte-identical.
+    if (d.mergeAfterRunMs !== undefined)
+        header += ` · merged ${shortSpanPhrase(d.mergeAfterRunMs)} after the run`;
     if (d.reverted !== null) {
         header += ` · reverted ${shortSha(d.reverted.sha)} (by operator)`; // vocabulary-ok: the deliberate-revert writer this header names
     }