tumwater 0.4.2 → 0.4.3

package/dist/src/config/config-request.js

@@ -80,35 +80,158 @@ function buildCandidate(root, current, entries, checkCommand) {
     const customRoles = entries === undefined ? current.customRoles : entries;
     const checkChanged = checkCommand !== undefined && (current.check?.command ?? "") !== checkCommand;
     const unchanged = !checkChanged && isDeepStrictEqual(customRoles, current.customRoles);
-    // Strip roles.<id> entries for custom roles this request removes (see applyConfigRequest's
-    // docstring): structurally valid names only; anything else stays for validateConfig to
-    // reject — never dereference a request entry before validation.
+    const requestedNames = requestedRoleNames(customRoles);
+    const fileRoles = fileRolesAfterRemoval(root, current.customRoles, requestedNames);
+    const candidate = { ...current, customRoles };
+    withCheckCommand(candidate, current.check, checkCommand, checkChanged);
+    withRolesSection(candidate, fileRoles.raw, fileRoles.roles);
+    return { candidate: candidate, changed: !unchanged };
+}
+/** The structurally valid role names a request's customRoles array carries (see
+ * applyConfigRequest's docstring): only names on structurally valid entries feed the roles
+ * strip; anything else stays for validateConfig to reject — never dereference a request
+ * entry before validation. */
+function requestedRoleNames(customRoles) {
     const requestedNames = new Set();
     for (const entry of customRoles) {
         if (isJsonObject(entry) && typeof entry.name === "string")
             requestedNames.add(entry.name);
     }
-    // Base the roles rewrite on the FILE's own section, not the loaded (catalog-merged) map:
-    // this whole-config write must not re-expand a partial section to every built-in
-    // (preserveFileRoles' rule). Only the removed custom roles' entries are stripped, and only
-    // from what the file actually holds.
-    const rawRolesCandidate = rawConfigObject(root).roles;
-    const roles = isJsonObject(rawRolesCandidate) ? { ...(rawRolesCandidate) } : {};
-    for (const c of current.customRoles) {
+    return requestedNames;
+}
+/** The FILE's own roles section (not the loaded, catalog-merged map — this whole-config
+ * write must not re-expand a partial section to every built-in, preserveFileRoles' rule)
+ * with the removed custom roles' entries stripped: only the requested names the caller
+ * passes are removed, and only from what the file actually holds. Returns both the raw value
+ * (for when the file had no roles section) and the stripped map. */
+function fileRolesAfterRemoval(root, currentRoles, requestedNames) {
+    const raw = rawConfigObject(root).roles;
+    const roles = isJsonObject(raw) ? { ...(raw) } : {};
+    for (const c of currentRoles) {
         if (!requestedNames.has(c.name))
             delete roles[c.name];
     }
-    const candidate = { ...current, customRoles };
+    return { raw, roles };
+}
+/** Replace only `check.command` on the candidate when the request declares one, preserving
+ * the rest of the check section (gateCommand/mergeCommand/timeoutSeconds). */
+function withCheckCommand(candidate, currentCheck, checkCommand, checkChanged) {
     if (checkChanged && checkCommand !== undefined) {
-        // Preserve the rest of the check section (gateCommand/mergeCommand/timeoutSeconds);
-        // only `command` is declared by the request.
-        candidate.check = { ...current.check, command: checkCommand };
+        candidate.check = { ...currentCheck, command: checkCommand };
     }
+}
+/** Set the candidate's roles section to the stripped map, or drop it when the file had none. */
+function withRolesSection(candidate, rawRolesCandidate, roles) {
     if (rawRolesCandidate === undefined)
         delete candidate.roles;
     else
         candidate.roles = roles;
-    return { candidate: candidate, changed: !unchanged };
+}
+/** Parse the request JSON into its customRoles entries and raw `check` value: the isJsonObject
+ * throw, the old-key normalization and the top-level disallowed-key scan into `ignored`; the
+ * `check` value is returned untouched for checkCommandFrom. */
+function parseConfigRequest(raw, ignored) {
+    const unnormalized = JSON.parse(raw);
+    if (!isJsonObject(unnormalized))
+        throw new Error(`config request must be a JSON object (got ${show(unnormalized)})`);
+    // Old key spellings read as the new ones; a request setting both fails with the pair named.
+    const normalized = normalizeConfigKeys(unnormalized);
+    if (normalized.problems.length > 0)
+        throw new Error(normalized.problems.join("; "));
+    const parsed = normalized.raw;
+    for (const key of Object.keys(parsed)) {
+        if (key !== "customRoles" && key !== "check")
+            ignored.push(key);
+    }
+    return { entries: parsed.customRoles, check: parsed.check };
+}
+/** Extract the declared check command from a request's `check` object: the isJsonObject throw,
+ * the sub-key scan that pushes the dropped `check.<key>` names into `ignored`, and the
+ * non-blank `command` (or its collected drop). */
+function checkCommandFrom(check, ignored) {
+    // A check request is read only for its `command` (a non-blank string). Every other
+    // sub-key — and a blank `command` — is dropped into `ignored`, so it can never turn the
+    // safety gates off; a blank/absent command simply declares nothing.
+    if (check !== undefined) {
+        const checkReq = check;
+        if (!isJsonObject(checkReq))
+            throw new Error(`config request's check must be an object (got ${show(checkReq)})`);
+        for (const key of Object.keys(checkReq)) {
+            if (key !== "command")
+                ignored.push(`check.${key}`);
+        }
+        if (isNonBlankString(checkReq.command))
+            return checkReq.command;
+        else if (checkReq.command !== undefined)
+            ignored.push("check.command");
+    }
+    return undefined;
+}
+/** Verify a declared check.command before it is written (part 1/2): a declared check is
+ * fail-closed — the gate's pre-check rejects a red run and a failure that reproduces on main
+ * parks every queued pin behind a red main no role can repair by code — so the declared
+ * command must be observed green in the requesting worktree BEFORE it is written. Only a
+ * `passed` outcome writes; failed, timed-out, or skipped writes nothing and returns an error
+ * naming what was observed. Each candidate is run at `check.cwd` resolved against the
+ * worktree (default `.`) under the config-resolved timeout, and when a `check.gateCommand` is
+ * set and differs the gate command is verified first too — the declared command is the
+ * fail-closed promise, the gate command is what the gate scope will actually run — so a green
+ * here is a green at the gate for every command the write leaves live. */
+async function verifyDeclaredCheck(root, wt, entries, checkCommand, runCheck) {
+    // Read the current config only for the guard — the write reloads fresh under the lock.
+    const currentForGuard = loadConfig(root);
+    // Pre-validate what the request would write BEFORE the declared check runs: a request
+    // that pairs a valid check.command with an invalid customRoles entry must be rejected
+    // without ever spawning the check (it would fail validation anyway). The locked write
+    // re-loads fresh and re-validates, so a config change between here and the write is
+    // still caught.
+    const { candidate: preCandidate } = buildCandidate(root, currentForGuard, entries, checkCommand);
+    validateConfig(collapseBackendAliases(preCandidate));
+    for (const check of guardChecks(currentForGuard, wt, checkCommand)) {
+        const outcome = await runCheck(wt, check, currentForGuard);
+        if (outcome.status !== "passed") {
+            throw new Error(`check.command not declared: \`${outcome.script}\` ${describeGuardFailure(outcome)} in the worktree`);
+        }
+    }
+}
+/** The locked whole-config write of a config request: the load-to-write sequence is one
+ * critical section under withConfigLock — a concurrent `config set`/dashboard write between
+ * the load and this write must not be dropped by the whole-file overwrite (see
+ * writeConfigMutation). Returns whether the request changed nothing and the now-live custom
+ * role names. */
+function writeConfigRequest(root, entries, checkCommand) {
+    let applied = [];
+    let unchanged = false;
+    withConfigLock(root, () => {
+        const current = loadConfig(root); // fresh — bypasses the stat cache: a writer sees the latest file
+        const { candidate, changed } = buildCandidate(root, current, entries, checkCommand);
+        // Nothing the request would change: write nothing, like writeConfigMutation's no-op skip.
+        if (!changed) {
+            unchanged = true;
+            return;
+        }
+        // Collapse legacy/new pi spellings before writing so a merged config (which always
+        // carries the default piArgs) never lands both forms in the file — the next load's raw
+        // pass rejects a file holding both `piArgs` and `backends.pi.args`.
+        const collapsed = collapseBackendAliases(candidate);
+        validateConfig(collapsed); // throws listing every problem — nothing is written on failure
+        writeJsonAtomic(configPath(root), collapsed, true);
+        applied = collapsed.customRoles.map((c) => c.name);
+    });
+    return { unchanged, applied };
+}
+/** Delete the request on EVERY path — success, rejection, malformed JSON — so it can never be
+ * staged by commitAll, reach a review gate, or retry forever. A failed unlink is surfaced as
+ * an error so the caller logs it (the file would otherwise survive into the diff); a passed-in
+ * error outranks the failed-deletion message. Returns the error to surface. */
+function discardConfigRequest(requestFile, error) {
+    try {
+        fs.unlinkSync(requestFile);
+    }
+    catch (err) {
+        return error ?? `config request file could not be deleted: ${errorMessage(err)}`;
+    }
+    return error;
 }
 /** Consume the role's config-write request file (plans/portability.md §3/7). After its pi
  * run the director may leave `.tumwater-config-request.json` at its worktree root:
@@ -154,7 +277,9 @@ function buildCandidate(root, current, entries, checkCommand) {
  * unless the write happened); `ignored` lists the discarded keys (top-level keys and, named
  * `check.<key>`, the check sub-keys that were dropped); `error`, when set, names why nothing
  * (or only part of the work) was done — the caller turns it and `ignored` into warning events.
- * `unchanged` is set when the request changes nothing; nothing is written. */
+ * `unchanged` is set when the request changes nothing; nothing is written. The body delegates
+ * each phase to a named helper — parseConfigRequest, checkCommandFrom, verifyDeclaredCheck,
+ * writeConfigRequest and discardConfigRequest. */
 export async function applyConfigRequest(root, wt, runCheck = defaultCheckGuard) {
     const requestFile = configRequestPath(wt);
     const raw = readTextOrNull(requestFile);
@@ -165,98 +290,24 @@ export async function applyConfigRequest(root, wt, runCheck = defaultCheckGuard)
     let error;
     let unchanged;
     try {
-        const unnormalized = JSON.parse(raw);
-        if (!isJsonObject(unnormalized))
-            throw new Error(`config request must be a JSON object (got ${show(unnormalized)})`);
-        // Old key spellings read as the new ones; a request setting both fails with the pair named.
-        const normalized = normalizeConfigKeys(unnormalized);
-        if (normalized.problems.length > 0)
-            throw new Error(normalized.problems.join("; "));
-        const parsed = normalized.raw;
-        for (const key of Object.keys(parsed)) {
-            if (key !== "customRoles" && key !== "check")
-                ignored.push(key);
-        }
-        // A check request is read only for its `command` (a non-blank string). Every other
-        // sub-key — and a blank `command` — is dropped into `ignored`, so it can never turn the
-        // safety gates off; a blank/absent command simply declares nothing.
-        let checkCommand;
-        if (parsed.check !== undefined) {
-            const checkReq = parsed.check;
-            if (!isJsonObject(checkReq))
-                throw new Error(`config request's check must be an object (got ${show(checkReq)})`);
-            for (const key of Object.keys(checkReq)) {
-                if (key !== "command")
-                    ignored.push(`check.${key}`);
-            }
-            if (isNonBlankString(checkReq.command))
-                checkCommand = checkReq.command;
-            else if (checkReq.command !== undefined)
-                ignored.push("check.command");
-        }
-        const entriesRaw = parsed.customRoles;
-        if (entriesRaw !== undefined && !Array.isArray(entriesRaw))
-            throw new Error(`config request's customRoles must be an array (got ${show(entriesRaw)})`);
-        const entries = entriesRaw;
-        // Verified declaration (part 1/2): a declared check is fail-closed — the gate's pre-check
-        // rejects a red run and a failure that reproduces on main parks every queued pin behind a
-        // red main no role can repair by code — so the declared command must be observed green in
-        // the requesting worktree BEFORE it is written. Only a `passed` outcome writes; failed,
-        // timed-out, or skipped writes nothing and returns an error naming what was observed. Each
-        // candidate is run at `check.cwd` resolved against the worktree (default `.`) under the
-        // config-resolved timeout, and when a `check.gateCommand` is set and differs the gate
-        // command is verified first too — the declared command is the fail-closed promise, the
-        // gate command is what the gate scope will actually run — so a green here is a green at
-        // the gate for every command the write leaves live.
+        const { entries, check } = parseConfigRequest(raw, ignored);
+        const checkCommand = checkCommandFrom(check, ignored);
+        // The array-shape check runs after the check-subkey scan in checkCommandFrom, preserving the
+        // original ordering so a doubly-malformed request still reports its dropped `check.<key>`
+        // warnings before the malformed-customRoles error.
+        if (entries !== undefined && !Array.isArray(entries))
+            throw new Error(`config request's customRoles must be an array (got ${show(entries)})`);
         if (checkCommand !== undefined) {
-            // Read the current config only for the guard — the write reloads fresh under the lock.
-            const currentForGuard = loadConfig(root);
-            // Pre-validate what the request would write BEFORE the declared check runs: a request
-            // that pairs a valid check.command with an invalid customRoles entry must be rejected
-            // without ever spawning the check (it would fail validation anyway). The locked write
-            // re-loads fresh and re-validates, so a config change between here and the write is
-            // still caught.
-            const { candidate: preCandidate } = buildCandidate(root, currentForGuard, entries, checkCommand);
-            validateConfig(collapseBackendAliases(preCandidate));
-            for (const check of guardChecks(currentForGuard, wt, checkCommand)) {
-                const outcome = await runCheck(wt, check, currentForGuard);
-                if (outcome.status !== "passed") {
-                    throw new Error(`check.command not declared: \`${outcome.script}\` ${describeGuardFailure(outcome)} in the worktree`);
-                }
-            }
+            await verifyDeclaredCheck(root, wt, entries, checkCommand, runCheck);
         }
-        // The load-to-write sequence is one critical section under withConfigLock: a concurrent
-        // `config set`/dashboard write between the load and this write must not be dropped by the
-        // whole-file overwrite (see writeConfigMutation).
-        withConfigLock(root, () => {
-            const current = loadConfig(root); // fresh — bypasses the stat cache: a writer sees the latest file
-            const { candidate, changed } = buildCandidate(root, current, entries, checkCommand);
-            // Nothing the request would change: write nothing, like writeConfigMutation's no-op skip.
-            if (!changed) {
-                unchanged = true;
-                return;
-            }
-            // Collapse legacy/new pi spellings before writing so a merged config (which always
-            // carries the default piArgs) never lands both forms in the file — the next load's raw
-            // pass rejects a file holding both `piArgs` and `backends.pi.args`.
-            const collapsed = collapseBackendAliases(candidate);
-            validateConfig(collapsed); // throws listing every problem — nothing is written on failure
-            writeJsonAtomic(configPath(root), collapsed, true);
-            applied = collapsed.customRoles.map((c) => c.name);
-        });
+        const written = writeConfigRequest(root, entries, checkCommand);
+        applied = written.applied;
+        unchanged = written.unchanged ? true : undefined;
     }
     catch (err) {
         applied = []; // no write happened, or it must not be reported as applied
         error = errorMessage(err);
     }
-    // Delete the request on EVERY path — success, rejection, malformed JSON — so it can never be
-    // staged by commitAll, reach a review gate, or retry forever. A failed unlink is surfaced as
-    // an error so the caller logs it (the file would otherwise survive into the diff).
-    try {
-        fs.unlinkSync(requestFile);
-    }
-    catch (err) {
-        error ??= `config request file could not be deleted: ${errorMessage(err)}`;
-    }
+    error = discardConfigRequest(requestFile, error);
     return unchanged ? { applied, ignored, error, unchanged } : { applied, ignored, error };
 }

package/dist/src/config/config-schema.js

@@ -5,7 +5,7 @@
  * its default (config.ts), and its allow-list entry sit beside each other. Split out of the former
  * types.ts grab-bag — the runtime types a run produces now live beside their consumers
  * (RunResult and RunOutcome in run-outcome.ts, RunnerState in runner-state.ts, HarnessEvent
- * in events.ts, MergeEntry in merge-queue.ts, and the pi-run types in run-agent.ts and
+ * in events.ts, MergeEntry in merge-queue.ts, and the pi-run types in agent-run.ts and
  * pi-run-result.ts) — so the schema the file on disk is validated against and the runtime
  * state the harness runs with
  * are two layers, changed for different reasons by different readers: a tumwater.json knob
@@ -59,8 +59,6 @@ export const TOP_LEVEL_KEYS = [
     "check",
     "piArgs",
     "maxConcurrent",
-    "maxConcurrentPerProvider",
-    "claudeWindowReserve",
     "mergeBatchMax",
     "maxConcurrentChecks",
     "worktreeSlots",
@@ -93,16 +91,16 @@ export const TOP_LEVEL_KEYS = [
 export const BACKOFF_KEYS = ["initialSeconds", "factor", "maxSeconds"];
 /** The keys an `backends.<id>` entry may hold; validation feeds checkKnownKeys so a typo'd
  * field (`backends.claude.binary`) is a load error rather than a silently inert entry.
- * `configDir`/`windowReserve` are claude/codex-only (CLAUDE_AGENT_KEYS / CODEX_BACKEND_KEYS),
- * so they are not silently inert on pi/opencode. */
+ * `configDir` is claude/codex-only (CLAUDE_AGENT_KEYS / CODEX_BACKEND_KEYS),
+ * so it is not silently inert on pi/opencode. */
 export const BACKEND_KEYS = ["bin", "args"];
-/** The keys a claude `backends.claude` entry may hold — the shared agent keys plus `configDir`
- * and `windowReserve`, the per-backend fields only the claude adapter reads. */
-export const CLAUDE_AGENT_KEYS = [...BACKEND_KEYS, "configDir", "windowReserve"];
+/** The keys a claude `backends.claude` entry may hold — the shared agent keys plus `configDir`,
+ * the per-backend field only the claude adapter reads. */
+export const CLAUDE_AGENT_KEYS = [...BACKEND_KEYS, "configDir"];
 /** The keys a codex `backends.codex` entry may hold — the same as claude's: the shared agent keys
- * plus `configDir` (which becomes `CODEX_HOME` for the codex processes, plans/codex-backend.md
- * §4) and `windowReserve` (the part 2 per-backend reserve). */
-export const CODEX_BACKEND_KEYS = [...BACKEND_KEYS, "configDir", "windowReserve"];
+ * plus `configDir`, which becomes `CODEX_HOME` for the codex processes (plans/codex-backend.md
+ * §4). */
+export const CODEX_BACKEND_KEYS = [...BACKEND_KEYS, "configDir"];
 /** The keys tumwater.json's `bootstrap` section may hold. */
 export const BOOTSTRAP_KEYS = ["untilPlansDone"];
 export const ROLE_ENTRY_KEYS = [

package/dist/src/config/config-selector-checks.js

@@ -3,7 +3,7 @@ import { checkKnownKeys, show } from "./config-field-checks.js";
 import { isJsonObject } from "../files/json-object.js";
 import { isNonBlankString } from "../text/text.js";
 import { typoSuffix } from "../text/suggest.js";
-import { isBackendId, parseModelSelector } from "./model-selector.js";
+import { isBackendId, parseModelSelector } from "./config-model-selector.js";
 /** Model-selector and fallback-chain checks that validateConfig (config-validation.ts) runs
  * on each model-choosing section: empty selector halves, `fallback` lists and steps, and an
  * entry's `backend` against its model. Each takes the `problems` list to append to and reads

package/dist/src/config/config-validation-agents.js

@@ -12,7 +12,7 @@
 import { BACKEND_IDS, BACKEND_KEYS, CLAUDE_AGENT_KEYS, CODEX_BACKEND_KEYS, HARNESS_PI_FLAGS, } from "./config-schema.js";
 import { isJsonObject } from "../files/json-object.js";
 import { typoSuffix } from "../text/suggest.js";
-import { isBackendId } from "./model-selector.js";
+import { isBackendId } from "./config-model-selector.js";
 import { reservedPassthroughFlag } from "../agent/backend-traits.js";
 import { checkObjectSection, checkReservedArgs, show, } from "./config-field-checks.js";
 /** Validate the agent-execution block: the bare `backend`, `agentBin`, `baseBranch` and
@@ -27,7 +27,7 @@ export function validateAgentsBlock(r, problems, rawFile, helpers) {
     checkString(r, "", "agentBin", false);
     // The agent backend for bare/no-model selectors (plans/agent-backends.md "Config"): a
     // non-blank id from the schema's reserved set. An unknown id would fall back to pi at run
-    // time (src/agent/run-agent.ts), silently running the wrong backend against a named one.
+    // time (src/agent/agent-run.ts), silently running the wrong backend against a named one.
     checkString(r, "", "backend", false);
     if (typeof r.backend === "string" && !isBackendId(r.backend))
         problems.push(`backend must name a backend (${BACKEND_IDS.join(", ")}; got ${show(r.backend)})${typoSuffix(r.backend, BACKEND_IDS)}`);

package/dist/src/config/config-validation-roles.js

@@ -1,13 +1,12 @@
 /** The per-role and cross-field section rules of tumwater.json validation: the `customRoles`
  * collect-and-check block, the `roles.<id>` entry block, `review.afterMerge`'s name check,
- * the per-role daily cost caps and quiet hours, `maxConcurrentPerProvider`,
- * `claudeWindowReserve` and its mutually-exclusive spelling pair, and the `idleBackoff`
+ * the per-role daily cost caps and quiet hours, and the `idleBackoff`
  * cross-field pair. Extracted from the single validateConfig gate (config-validation.ts) so a
  * per-role or cross-field edit lands as a per-theme diff instead of a whole-gate one; this
  * module runs once, at the gate's end, after every other section has appended its problems,
  * so the overall problem order is unchanged. These rules sit on top of the generic machinery
  * in config-field-checks.ts; the helpers passed in are the closures the gate binds once (the
- * problems-bound checkers and the shared model-triple/window-reserve sequences), and the
+ * problems-bound checkers and the shared model-triple sequence), and the
  * cross-cutting `customNames` set — collected in the customRoles block, consumed by the
  * roles.<id>, afterMerge, cap and quiet-hour blocks — is owned here, so validateConfig
  * passes no set across the boundary. */
@@ -18,11 +17,7 @@ import { isJsonObject } from "../files/json-object.js";
 import { isNonBlankString } from "../text/text.js";
 import { parseQuietHours } from "../scheduling/quiet-hours.js";
 import { TUMWATER_SOURCE } from "../events/events.js";
-import { DOLLAR_CAP, MAX_DURATION_SECONDS, POSITIVE_INTEGER, checkKnownKeys, checkKnownRoleId, checkNumberField, show, } from "./config-field-checks.js";
-const DURATION_NON_NEGATIVE = {
-    ok: (n) => n >= 0 && n <= MAX_DURATION_SECONDS,
-    what: `a number of 0 or more, at most ${MAX_DURATION_SECONDS}`,
-};
+import { DOLLAR_CAP, DURATION_NON_NEGATIVE, checkKnownKeys, checkKnownRoleId, checkNumberField, show, } from "./config-field-checks.js";
 /** A per-role instance count (`roles.feature.instances`): an integer from 1 to 8. Bounded so
  * a typo like `instances: 800` cannot spawn hundreds of runners, and integer so
  * `feature-1.5` — which no role id can name — is refused. */
@@ -52,7 +47,7 @@ function checkPerRoleMap(r, key, expectation, customNames, problems, checkValue)
 }
 /** Validate the per-role and cross-field sections that close the gate: `customRoles`, the
  * `roles.<id>` entries, `review.afterMerge`'s role names, the per-role caps and quiet hours,
- * `maxConcurrentPerProvider`, `claudeWindowReserve` and the `idleBackoff` cross-field pair,
+ * and the `idleBackoff` cross-field pair,
  * each appended to `problems` in the order the gate produced. The single call site in
  * validateConfig is the point where these problems were appended, so the order across the
  * whole pass is unchanged. */
@@ -62,8 +57,6 @@ export function validateRolesAndCrossField(r, problems, helpers) {
     validateReviewAfterMerge(r, problems, customNames);
     validatePerRoleCostCaps(r, problems, customNames);
     validatePerRoleQuietHours(r, problems, customNames);
-    validateMaxConcurrentPerProvider(r, problems);
-    validateClaudeWindowReserve(r, problems, helpers);
     validateIdleBackoff(r, problems);
 }
 /** Collect the `customRoles` names and refuse this block's bad shapes, appending to
@@ -215,47 +208,6 @@ function validatePerRoleQuietHours(r, problems, customNames) {
             problems.push(parsed.error);
     });
 }
-/** Validate per-provider concurrency caps (plans/provider-concurrency.md §1): a map from
- * provider key to a positive integer. Unlike the per-role maps, an unknown provider name is
- * NOT a validation error — providers live in pi's models.json, which validation does not
- * read, and a fallback's provider may only come into use later (doctor warns in part 5/5).
- * Each value must be a positive integer under a non-empty key. */
-function validateMaxConcurrentPerProvider(r, problems) {
-    if (r.maxConcurrentPerProvider !== undefined) {
-        const map = r.maxConcurrentPerProvider;
-        if (!isJsonObject(map)) {
-            problems.push(`maxConcurrentPerProvider must be an object mapping provider names to concurrency caps (got ${show(map)})`);
-        }
-        else {
-            for (const [provider, value] of Object.entries(map)) {
-                if (provider.trim() === "") {
-                    problems.push(`maxConcurrentPerProvider.<empty> — a provider key must not be empty`);
-                    continue;
-                }
-                if (typeof value !== "number" || !Number.isFinite(value) || !POSITIVE_INTEGER.ok(value)) {
-                    problems.push(`maxConcurrentPerProvider.${provider} must be ${POSITIVE_INTEGER.what} (got ${show(value)})`);
-                }
-            }
-        }
-    }
-}
-/** Validate `claudeWindowReserve` (the subscription-window reserve: a map from window type to
- * a fraction, 0 < f <= 1) and its mutually-exclusive spelling pair with
- * `backends.claude.windowReserve`. */
-function validateClaudeWindowReserve(r, problems, helpers) {
-    const { checkWindowReserve } = helpers;
-    // The subscription-window reserve: a map from window type to a fraction, 0 < f <= 1.
-    if (r.claudeWindowReserve !== undefined)
-        checkWindowReserve("claudeWindowReserve", r.claudeWindowReserve);
-    // The reserve's two spellings are mutually exclusive (plans/codex-backend.md part 2b/9): the
-    // nested key is the current one; `claudeWindowReserve` is kept as claude's older spelling. A
-    // file holding both is ambiguous about which drives the window, so it is rejected naming both.
-    if (r.claudeWindowReserve !== undefined &&
-        isJsonObject(r.backends) &&
-        isJsonObject(r.backends.claude) &&
-        r.backends.claude.windowReserve !== undefined)
-        problems.push("claudeWindowReserve and backends.claude.windowReserve set the same value — keep one (backends.claude.windowReserve is the current spelling; claudeWindowReserve is its old name)");
-}
 /** Validate the `idleBackoff` cross-field pair (judged on the merged config, where both sides
  * are always present; on a raw file only when the file itself names both): scheduleBackoff
  * clamps every idle wait — the first included — to min(initialSeconds, maxSeconds), so a

package/dist/src/config/config-validation.js

@@ -7,8 +7,8 @@ import path from "node:path";
 import { isNonBlankString, tooLongMessage } from "../text/text.js";
 import { PREFILL_REASON } from "../text/phrases.js";
 import { parseQuietHours } from "../scheduling/quiet-hours.js";
-import { isBackendId } from "./model-selector.js";
-import { AT_LEAST_ONE, checkBooleanField, checkKnownKeys, checkModelTripleField, checkNumberField, checkObjectSection, codexConfigKey, checkStringArrayField, checkStringField, NON_NEGATIVE, NON_NEGATIVE_OR_DISABLED, DOLLAR_CAP, MAX_DURATION_SECONDS, POSITIVE, POSITIVE_INTEGER, show, typeName, } from "./config-field-checks.js";
+import { isBackendId } from "./config-model-selector.js";
+import { AT_LEAST_ONE, checkBooleanField, checkKnownKeys, checkModelTripleField, checkNumberField, checkObjectSection, codexConfigKey, checkStringArrayField, checkStringField, NON_NEGATIVE, NON_NEGATIVE_OR_DISABLED, DOLLAR_CAP, DURATION_NON_NEGATIVE, DURATION_OR_DISABLED, DURATION_POSITIVE, POSITIVE, POSITIVE_INTEGER, show, typeName, } from "./config-field-checks.js";
 import { checkEntryBackend, checkRetiredSelector, checkSelectorHalves, } from "./config-selector-checks.js";
 import { validateAgentsBlock } from "./config-validation-agents.js";
 import { validateFallbackBlock, validateModelBlock, } from "./config-validation-model.js";
@@ -24,18 +24,6 @@ import { validateRolesAndCrossField } from "./config-validation-roles.js";
  * unknown-key and known-role guards, the NumberRule table, and the per-field type checkers —
  * lives in config-field-checks.ts; this module is the section-by-section rules plus the
  * cross-field checks, and the one export gate (validateConfig) for them. */
-const DURATION_POSITIVE = {
-    ok: (n) => n > 0 && n <= MAX_DURATION_SECONDS,
-    what: `a number greater than 0, at most ${MAX_DURATION_SECONDS}`,
-};
-const DURATION_NON_NEGATIVE = {
-    ok: (n) => n >= 0 && n <= MAX_DURATION_SECONDS,
-    what: `a number of 0 or more, at most ${MAX_DURATION_SECONDS}`,
-};
-const DURATION_OR_DISABLED = {
-    ok: (n) => n >= 0 && n <= MAX_DURATION_SECONDS,
-    what: `a number of 0 or more, at most ${MAX_DURATION_SECONDS} (0 disables)`,
-};
 /** Validate tumwater.json values, so a typo fails fast with an actionable message instead
  * of misbehaving at runtime — e.g. a non-numeric runTimeoutSeconds becomes NaN and kills
  * every pi run instantly, a non-numeric logMaxBytes rotates the event log on every write, an
@@ -72,37 +60,16 @@ export function validateConfig(raw, label = "tumwater.json", rawFile = false) {
         if (typeof value === "string" && value.length > max)
             problems.push(tooLongMessage(label, value.length, max, PREFILL_REASON));
     };
-    // The window-reserve map validation shared by a backend's nested `windowReserve` (via
-    // checkBackendConfig) and the top-level `claudeWindowReserve` legacy spelling, so their
-    // object/empty-type/fraction messages cannot drift. `label` is the message path — the
-    // `.windowReserve`-suffixed prefix for a backend, `claudeWindowReserve` at top level.
-    const checkWindowReserve = (label, value) => {
-        if (!isJsonObject(value)) {
-            problems.push(`${label} must be an object mapping window types to fractions (got ${show(value)})`);
-            return;
-        }
-        for (const [type, v] of Object.entries(value)) {
-            if (type.trim() === "")
-                problems.push(`${label}.<empty> — a window type must not be empty`);
-            else if (typeof v !== "number" || !Number.isFinite(v) || v <= 0 || v > 1)
-                problems.push(`${label}.${type} must be a fraction above 0 and at most 1 (got ${show(v)})`);
-        }
-    };
     // claude's and codex's per-backend config dir (plans/notes-command.md "Keeping funes out
     // of team runs" and plans/codex-backend.md §4): a leading `~` expands; the value must be an
     // absolute path after expansion, or claude would resolve a relative CLAUDE_CONFIG_DIR (and
     // codex a relative CODEX_HOME) from the run's cwd and write transcripts somewhere
-    // unexpected. Only claude and codex accept the key, so it is inert nowhere else. The nested
-    // reserve spelling (part 2b/9): the same 0 < f ≤ 1 rule the top-level `claudeWindowReserve`
-    // map gets, so a bad entry can never silently no-op a reserve.
+    // unexpected. Only claude and codex accept the key, so it is inert nowhere else.
     const checkBackendConfig = (entry, prefix) => {
         checkString(entry, `${prefix}.`, "configDir", false);
         if (typeof entry.configDir === "string" && entry.configDir !== "")
             if (!path.isAbsolute(expandHomeTilde(entry.configDir, os.homedir())))
                 problems.push(`${prefix}.configDir must be an absolute path after ~ expansion (got ${show(entry.configDir)})`);
-        if (entry.windowReserve === undefined)
-            return;
-        checkWindowReserve(`${prefix}.windowReserve`, entry.windowReserve);
     };
     // codex's `-c <key>=…` / `--config <key>=…` passthrough (plans/codex-backend.md §2/§3): a
     // key tumwater sets on every run (HARNESS_CODEX_CONFIG_KEYS) — or one the write guard owns,
@@ -227,7 +194,7 @@ export function validateConfig(raw, label = "tumwater.json", rawFile = false) {
         if (!parsed.ok)
             problems.push(parsed.error);
     }
-    // The operator notify hook (src/events/notify.ts): absent or empty string means off,
+    // The operator notify hook (src/events/event-notify.ts): absent or empty string means off,
     // otherwise the value is the shell command the orchestrator runs on notable events — so it
     // must be a string when present, and an empty string stays valid (it is how `config set
     // notify ""` clears the hook).
@@ -296,7 +263,6 @@ export function validateConfig(raw, label = "tumwater.json", rawFile = false) {
         checkNumber,
         checkPromptLength,
         checkModelTripleEntry,
-        checkWindowReserve,
     });
     if (problems.length > 0) {
         throw new Error(`invalid ${label}:\n  - ${problems.join("\n  - ")}`);

package/dist/src/config/config-views.js

@@ -7,7 +7,7 @@
  * saving, the role-selection helpers) lives in config.ts, the write side in config-write.ts
  * (editor verbs) and config-request.ts (the director's staged request). */
 import { MODEL_TIERS } from "./config-schema.js";
-import { formatModelSelector, parseModelSelector, routeModel } from "./model-selector.js";
+import { formatModelSelector, parseModelSelector, routeModel } from "./config-model-selector.js";
 import { modelPairName } from "../budget/budget.js";
 import { isJsonObject } from "../files/json-object.js";
 import { DIRECTOR_ROLE, roleById } from "../roles/roles.js";
@@ -31,20 +31,6 @@ export function resolvedBackendConfig(config, id) {
     }
     return { bin: entry?.bin ?? config.agentBin, args: (entry?.args ?? config.piArgs ?? []).slice() };
 }
-/** A backend's subscription-window reserve (plans/codex-backend.md part 2b/9): the nested
- * `backends[backend].windowReserve` when the backend has one, else the top-level
- * `claudeWindowReserve` for claude (its older spelling), else undefined. The two spellings are
- * mutually exclusive in a loaded file (validateConfig rejects one holding both), so the
- * fallback only ever answers for a config written before the rename. Pure: it never writes a
- * spelling back into the file. */
-export function windowReserveFor(config, backend) {
-    const nested = config.backends?.[backend]?.windowReserve;
-    if (nested !== undefined)
-        return nested;
-    if (backend === "claude")
-        return config.claudeWindowReserve;
-    return undefined;
-}
 /** True when `s` names one of the three tiers — the form `roles.<id>.model` /
  * `review.model` may take to point at that tier of the top-level `model` map. */
 export function isTierName(s) {
@@ -109,7 +95,12 @@ export function tierModel(config, tier) {
  * key it overrides would.
  *
  * `tier` is the seam's effective tier, already resolved by the caller from any tier-name
- * override — so `o.model` here is always a selector string, never a tier reference. */
+ * override — so `o.model` here is always a selector string, never a tier reference.
+ *
+ * Exported so imageRerouteTarget (src/agent/image-input.ts) can probe a peer tier's
+ * top-level model (`withModelOverrides(config, tier, {})`, the same shape resolverConfig
+ * builds strong with) and reshape a tier's fallback pair into a runnable config — the
+ * tier-config builder the plan names. */
 export function withModelOverrides(config, tier, o) {
     // The top-level model resolves at the seam's tier: a string form is the default tier's
     // selector; a map form takes the tier's entry, else `default`'s.
@@ -266,8 +257,8 @@ export function reviewRunConfig(config) {
 /** The optional provider/model/thinking fields of a resolved model seam, with each unset
  * (empty) field left out so the result carries only what was resolved — the one home of that
  * assembly. The fallback layer (config-fallbacks.ts's fallbackSelectorFields and
- * fallbackPair/tierOwnFallback/modelFallbackView) and role-view's RoleViewPayload (its
- * model fields) all build a triple this way and follow the same rule — an absent or empty
+ * fallbackPair/tierOwnFallback) and role-view's RoleViewPayload (its model fields) all
+ * build a triple this way and follow the same rule — an absent or empty
  * value is
  * omitted rather than written as undefined/"" (an empty selector field would read as
  * "override present," so it must not appear). */
@@ -317,22 +308,6 @@ export function seamHoldKey(cfg) {
 export function seamPairName(cfg) {
     return modelPairName({ provider: seamHoldKey(cfg), model: cfg.model });
 }
-/** The key a resolved seam's run counts against the per-provider cap
- * (plans/provider-concurrency.md §2): its hold key, else — for a pi seam that names no model
- * at all and so runs pi's saved default — the default provider from pi's settings
- * (`piDefault`, the caller's cached readPiDefaultModel result, so this view stays free of
- * I/O). A bare id with no provider, or a seam whose pi settings cannot name a default, yields
- * undefined: only the team total bounds it. HF sub-provider pins (`huggingface/…:deepinfra`)
- * share the base provider, and billing does not split claude, because this reuses the hold key
- * — "omlx is held" and "omlx is full" name the same thing on every surface. */
-export function seamConcurrencyKey(cfg, piDefault) {
-    const hold = seamHoldKey(cfg);
-    if (hold !== undefined)
-        return hold;
-    if (cfg.model === undefined)
-        return piDefault?.provider;
-    return undefined;
-}
 /** The team's model wiring as one human-readable label, for the live-reload `model_changed`
  * event: null when no tier resolves to a model (pi's own default), the single selector when
  * every set tier agrees (the string-form `model`), and the `small=…, default=…, strong=…`