tumwater 0.4.2 → 0.4.3

package/dist/src/config/config-write.js

@@ -18,12 +18,11 @@ import { show } from "./config-field-checks.js";
 import { canonicalConfigKey } from "./config-aliases.js";
 import { unknownRoleMessage } from "../roles/roles.js";
 import { loadConfig, collapseBackendAliases, knownRoleIdsCached, } from "./config.js";
-import { checkDailyBudgetUsd, checkProviderConcurrencyCap, checkQuietHours, parseConfigKey, PER_KEY_VALIDATORS, unknownConfigKeyError, unknownRoleFieldError, } from "./config-keys.js";
+import { checkDailyBudgetUsd, checkQuietHours, parseConfigKey, PER_KEY_VALIDATORS, unknownConfigKeyError, unknownRoleFieldError, } from "./config-keys.js";
 import { writeConfigMutation, fail, rawConfigObject, without, preservingFileRoles, preserveFileRoles, withSectionOrDropped, } from "./config-write-core.js";
 /** Drop `field` from the `backends.<backend>` entry of the config `next`, dropping the whole
  * backend entry when it empties. The one home of the "remove a nested backend field, drop the
- * backend when empty" step the legacy `agentBin`/`piArgs` collapse and the `claudeWindowReserve`
- * collapse share, so the empty-entry rule cannot drift between the two. */
+ * backend when empty" step the legacy `agentBin`/`piArgs` collapse uses. */
 function dropNestedBackendField(next, backend, field) {
     const record = next;
     const backends = { ...(record.backends ?? {}) };
@@ -62,8 +61,7 @@ export function setDailyBudgetUsd(root, value) {
  * that setConfigKey's JSON.parse would read past validateConfig's integer check and silently
  * write — the same silent misread the per-role instances/interval guards, the TUI team-key
  * editors, and the GUI Settings rows refuse — so setConfigKey refuses it, naming the key and
- * writing nothing. The per-provider map (maxConcurrentPerProvider.<provider>) has its own
- * checkProviderConcurrencyCap screen and is not in this set. */
+ * writing nothing. */
 const PLAIN_INTEGER_TOP_LEVEL_KEYS = new Set([
     "maxConcurrent",
     "mergeBatchMax",
@@ -93,7 +91,6 @@ export function setConfigKey(root, key, rawValue) {
     // and the per-kind merge groups close over that call's `value`/`unchanged`/`oldValue`.
     const exponentRefusal = (parsed, key, trimmed) => {
         const isPlainIntegerKey = (parsed.kind === "top" && PLAIN_INTEGER_TOP_LEVEL_KEYS.has(key)) ||
-            (parsed.kind === "map" && parsed.map === "maxConcurrentPerProvider") ||
             (parsed.kind === "role" && parsed.field === "instances") ||
             (parsed.kind === "section" && parsed.section === "bootstrap" && parsed.field === "untilPlansDone");
         if (isPlainIntegerKey && trimmed !== "" && isExponentSpelling(trimmed))
@@ -112,9 +109,7 @@ export function setConfigKey(root, key, rawValue) {
             const label = `${parsed.map}.${parsed.role}`;
             const validator = parsed.map === "maxDailyCostUsdPerRole"
                 ? checkDailyBudgetUsd
-                : parsed.map === "maxConcurrentPerProvider"
-                    ? checkProviderConcurrencyCap
-                    : checkQuietHours;
+                : checkQuietHours;
             const problem = validator(value, label);
             if (problem)
                 return fail(problem);
@@ -185,12 +180,6 @@ export function setConfigKey(root, key, rawValue) {
                 else
                     delete nextRecord.piArgs;
             }
-            // Setting the nested claude reserve drops the top-level spelling, so the file can never
-            // hold both (validateConfig rejects a file that does, mirroring the agentBin/piArgs pair).
-            if (parsed.id === "claude" && parsed.field === "windowReserve") {
-                const nextRecord = next;
-                delete nextRecord.claudeWindowReserve;
-            }
             return preservingFileRoles(root, next);
         };
         const mergeRoleEntry = (record, parsed) => {
@@ -281,10 +270,6 @@ export function setConfigKey(root, key, rawValue) {
         // Writers keep one spelling: a legacy top-level set drops the matching backends.pi field, so
         // the file can never hold both (validateConfig's raw pass rejects a file that does).
         const dropLegacyPiAlias = (next, key) => dropNestedBackendField(next, "pi", key === "agentBin" ? "bin" : "args");
-        // Writers keep one spelling: setting the top-level `claudeWindowReserve` drops the nested
-        // `backends.claude.windowReserve`, so a supported `config set` never writes the rejected pair
-        // (validateConfig still refuses a hand-edited file holding both).
-        const dropNestedReserve = (next) => dropNestedBackendField(next, "claude", "windowReserve");
         const result = writeConfigMutation(root, (cfg) => {
             oldValue = cfg[key];
             if (isDeepStrictEqual(oldValue, value)) {
@@ -306,8 +291,6 @@ export function setConfigKey(root, key, rawValue) {
                 return collapseBackendAliases(next);
             if (key === "agentBin" || key === "piArgs")
                 return dropLegacyPiAlias(next, key);
-            if (key === "claudeWindowReserve")
-                return dropNestedReserve(next);
             return next;
         });
         if (!result.ok)
@@ -322,8 +305,8 @@ export function setConfigKey(root, key, rawValue) {
         return fail(parsed.error);
     // Shape, before the JSON.parse, for every plain-positive-integer key this verb can write —
     // the top-level run-concurrency knobs and legacy merge batch cap, plus the integer-bound
-    // team-scope keys that arrive as a dotted key (`maxConcurrentPerProvider.<provider>`,
-    // `roles.<id>.instances`, the `bootstrap.untilPlansDone` section field): refuse an exponent
+    // team-scope keys that arrive as a dotted key (`roles.<id>.instances`, the
+    // `bootstrap.untilPlansDone` section field): refuse an exponent
     // spelling ("4e1" → 40) that JSON.parse would read past validateConfig's integer check and
     // silently write, naming the key and writing nothing — the twin of the per-role guards, the
     // TUI team-key editors, and the GUI Settings rows. A non-exponent invalid falls through for

package/dist/src/config/config.js

@@ -34,7 +34,7 @@ export function parseJsonConfig(file, basename) {
  * defaults for concurrency, timeouts, log size, retention, thrash detection, idle backoff,
  * self-redeploy, and review settings. The return type is the resolved view (config-views.ts): a
  * freshly defaulted config has no model map to resolve — only a loaded file can carry one — so
- * every call site that hands a default into a pi run (run-agent.ts's PiRunOptions, tests)
+ * every call site that hands a default into a pi run (agent-run.ts's PiRunOptions, tests)
  * satisfies ResolvedModelConfig directly. */
 export function defaultConfig() {
     const roles = {};
@@ -285,7 +285,7 @@ function cloneConfig(c) {
  * reconfiguration (BUGS.md 2026-09-23: a merge's fast-forward deleted it and the team ran
  * 8.6 h on defaults), so callers keep their last-known-good exactly as for a broken file, or
  * fall back to defaults only when they never saw one. Startup's "missing ⇒ not initialized"
- * gate (startup-gate.ts) and loadConfig's first-run defaults are unaffected. */
+ * gate (startup-gates.ts) and loadConfig's first-run defaults are unaffected. */
 export function loadConfigCached(root) {
     const file = configPath(root);
     try {
@@ -353,13 +353,12 @@ function stableJson(value) {
 }
 /** Sorted names of the config settings whose value differs between two loaded configs, for the
  * orchestrator's live-reload event. `maxConcurrent` and `sessionRetentionDays` are skipped: each
- * already has its own, more informative event. `maxConcurrentPerProvider` is skipped too — each
- * changed provider fires its own `provider_concurrency_changed` event. The `roles` map is never
+ * already has its own, more informative event. The `roles` map is never
  * reported whole — only
  * each differing `roles.<id>` — so a `customRoles` add/remove names both the section and the
  * affected role. */
 export function changedConfigKeys(prev, next) {
-    const skip = new Set(["maxConcurrent", "maxConcurrentPerProvider", "sessionRetentionDays", "roles"]);
+    const skip = new Set(["maxConcurrent", "sessionRetentionDays", "roles"]);
     const keys = [];
     const prevRecord = prev;
     const nextRecord = next;

package/dist/src/doctor/doctor-backlog-bugs.js

@@ -2,14 +2,14 @@ import { andMore, quoteHeading, readBacklogChecked, FIX_CLAIMS_CHECKED, REFUSAL_
 import { truncate } from "../text/text.js";
 import { plural, agree } from "../text/phrases.js";
 import { ageInDays, filingDate, fixedBugEntries, openBugEntries, openQuestionEntries, plannedPlanEntries } from "../backlog/backlog.js";
-import { questionFilingDate } from "../backlog/question-answer.js";
+import { questionFilingDate } from "../backlog/backlog-question-answer.js";
 import { needsReviewNote, refusalNote } from "../backlog/backlog-eligibility.js";
 import { plannedPartKeys, plansWaitingOn, prerequisitesMerged } from "../backlog/backlog-parts.js";
 import { lastDate } from "../backlog/backlog-md.js";
 import { formatTimestamp } from "../text/datetime.js";
 import { stringList } from "../files/json-object.js";
 import { readEventsSince } from "../events/event-window.js";
-import { okOutcome, warnOutcome } from "./outcome.js";
+import { okOutcome, warnOutcome } from "./doctor-outcome.js";
 /** The doctor's open-bug and question checks, split out of doctor-backlog.ts: questions that
  * have waited too long for an answer (checkStaleQuestions), bugs left unfixed (checkStaleBugs),
  * fixed records whose quoted test regressed (checkRegressedFixes), and
@@ -17,7 +17,8 @@ import { okOutcome, warnOutcome } from "./outcome.js";
  * (readBacklogChecked, andMore) from doctor-backlog.ts, plus the age/trim bounds, and
  * all warn instead of failing: a stale or
  * parked entry is operator signal, not a broken environment. doctor.ts composes them beside the
- * plan-structure and queue checks; the shared CheckOutcome shape is imported from outcome.ts. */
+ * plan-structure and queue checks; the shared CheckOutcome shape is imported from
+ * doctor-outcome.ts. */
 /** Stale questions — open QUESTIONS.md questions that have waited more than 7 days for an
  * answer. A team can stay parked on a question for days while `tumwater doctor` reports
  * nothing; the `--list` age (`questionAgeSuffix` on `tumwater questions`) is the only other
@@ -143,7 +144,7 @@ function sinceWindowMs(sinces) {
  * cannot drift on the selection. `since` is the day-after the fix date — the recurrence scan's
  * boundary (the heading carries only a date, so a same-day failure cannot be told from the one
  * the fix answered). Returns `[]` when no candidate has both a quoted test and a date. */
-export function regressedFixCandidates(root) {
+function regressedFixCandidates(root) {
     const candidates = fixedBugEntries(root).slice(0, FIX_CLAIMS_CHECKED).flatMap((entry) => {
         const name = quotedTestName(entry.title);
         const date = lastDate(entry.title, /(\d{4}-\d{2}-\d{2})/);
@@ -159,14 +160,14 @@ export function regressedFixCandidates(root) {
  * `failureMentions` per candidate over `events`, keeping the last mention (the doctor's exact
  * match). The caller supplies the event window — the doctor reads back to the oldest candidate's
  * day-after, the always-on alert the trailing day. */
-export function matchedRegressedFixes(candidates, events) {
+function matchedRegressedFixes(candidates, events) {
     return candidates.flatMap((c) => {
         const newest = lastFailureMention(events, c.name, c.since);
         return newest ? [{ ...c, newest }] : [];
     });
 }
 /** The doctor's `regressed fixes` warn sentence, verbatim, or null when nothing regressed. */
-export function regressedFixesPhrase(regressed) {
+function regressedFixesPhrase(regressed) {
     const [first, ...rest] = regressed;
     if (!first)
         return null;

package/dist/src/doctor/doctor-backlog-plans.js

@@ -1,17 +1,18 @@
 import { andMore, quoteHeading, readDoc, readBacklogChecked, FIX_CLAIMS_CHECKED, REFUSAL_NOTE_MAX } from "./doctor-backlog.js";
+import { agree } from "../text/phrases.js";
 import { cachedByStat } from "../files/stat-cache.js";
 import { VALIDATION_GAP_TAGS } from "../roles/role-guidance.js";
 import path from "node:path";
 import { truncate } from "../text/text.js";
 import { donePlans, fixedBugEntries, openBugEntries, plannedPlanEntries } from "../backlog/backlog.js";
-import { entryHold, entryKindLabel, heldCount } from "../backlog/backlog-eligibility.js";
+import { entryHold, entryKindLabel, isPlanStalled } from "../backlog/backlog-eligibility.js";
 import { planDependencyProblems } from "../backlog/backlog-parts.js";
 import { BACKLOG_FILES, FINISHED_ARCHIVES, validationGapTag } from "../backlog/backlog-md.js";
 import { statOrNull } from "../files/files.js";
 import { duplicateHeadings, strandedPlanEntriesFor } from "../backlog/backlog-structure.js";
 import { liveFinishedHistory, liveFinishedRowList } from "../backlog/backlog-archive.js";
 import { fixSymbols, missingSymbolNames, cachedSourceHaystack, unbackedSymbols } from "../verdict/fix-claim.js";
-import { okOutcome, warnOutcome } from "./outcome.js";
+import { okOutcome, warnOutcome } from "./doctor-outcome.js";
 /** The doctor's PLANS.md-structure and fix-claim checks, split out of doctor-backlog.ts: the
  * checks that re-verify BUGS.md's newest Fixed records against the tree (checkFixClaims,
  * checkValidationGaps) and the PLANS.md / backlog-file integrity checks that read sections and
@@ -21,7 +22,7 @@ import { okOutcome, warnOutcome } from "./outcome.js";
  * heading-trim bounds,
  * and all of them warn instead of failing: damaged documentation is operator signal, not a
  * broken environment. doctor.ts composes them beside the open-item and queue checks; the shared
- * CheckOutcome shape is imported from outcome.ts. */
+ * CheckOutcome shape is imported from doctor-outcome.ts. */
 /** Fix claims — the standalone half of the merge gate's false-fix check (src/verdict/fix-claim.ts):
  * that gate fires only when an md-only diff moves a BUGS.md entry to Fixed, so a phantom fix that
  * reached main any other way (merged before the gate existed, or through a path it never sees) was
@@ -44,7 +45,7 @@ export function checkFixClaims(root) {
     const { heading, missing } = first;
     const names = missingSymbolNames(missing);
     // Every other suspect is still named, shortened: a doctor check is one line.
-    const more = andMore(rest, (p) => quoteHeading(p.heading), "record(s)");
+    const more = andMore(rest, (p) => quoteHeading(p.heading), agree(rest.length, "record", "records"));
     return warnOutcome(`BUGS.md records "${heading}" as Fixed, but none of the symbols its Fix paragraph names ` +
         `exist on this tree: ${names}${more} — land the fix or keep the bug Open / refresh a stale record`);
 }
@@ -147,14 +148,14 @@ export function checkValidationGaps(root) {
     if (!first) {
         if (unpinned.length > 0) {
             const up = unpinned[0];
-            const more = andMore(unpinned.slice(1), (s) => quoteHeading(s.title), "record(s)");
+            const more = andMore(unpinned.slice(1), (s) => quoteHeading(s.title), agree(unpinned.slice(1).length, "record", "records"));
             return warnOutcome(`BUGS.md record "${up.title}" is an \`unclear-invariant\` fix but names no ` +
                 `docs/invariants.md section — record the reconstructed guarantee there (a "Pinned by" line) in the ` +
                 `same commit so the next bug in that area does not reconstruct it again${more}`);
         }
         return okOutcome(`newest ${validationGapRecords(root).length} Fixed record(s) carry a known Validation gap tag`);
     }
-    const more = andMore(rest, (s) => quoteHeading(s.title), "record(s)");
+    const more = andMore(rest, (s) => quoteHeading(s.title), agree(rest.length, "record", "records"));
     const what = first.kind === "missing"
         ? `BUGS.md record "${first.title}" has no **Validation gap:** line`
         : `BUGS.md record "${first.title}" names unrecognized Validation gap tag "${first.tag}"`;
@@ -309,24 +310,27 @@ export function checkBacklogHeadings(root) {
         `later entries are invisible; keep one heading per name (the gate blocks only a merge ` +
         `that adds another copy — remove the duplicate in a deliberate edit)`);
 }
-/** Stalled entries — plans or bugs held by a **Needs review …** note,
- * parked until the plan role splits or replans them, plus the held-for-operator entries
- * parked until the operator releases them. No role takes a held entry (the claim gate refuses
- * one) and nothing clears the note on its own, so the state is visible only as the
+/** Stalled entries — plans or bugs parked with the plan role by a **Needs review …** note
+ * that the plan role clears by splitting or replanning (the feature role's too-large note, the
+ * convergence hold, a final-round rejection). The bugfix role's wait-for-the-next-failure
+ * parks ("by bugfix:") are excluded — selfcheck lifts them, not the plan role, so they are
+ * not the plan role's stalled work. No role takes a held entry (the claim gate refuses one)
+ * and nothing clears a plan-role note on its own, so the state is visible only as the
  * `[needs review]` marks in the backlog listings; this names them so an
  * operator gets a single-line health signal from `tumwater doctor`. Reads the tree at `root`
  * — the primary checkout IS main's tree — like checkRefusedEntries, which is also where
- * refusal notes (a different hold) are surfaced. entryHold (src/backlog/backlog-eligibility.ts)
- * already classifies the notes, so this check adds no parsing: only the entries whose hold is
- * exactly needs-review or held-for-operator are collected, from both PLANS.md
+ * refusal notes (a different hold) are surfaced. entryHold + isPlanStalled
+ * (src/backlog/backlog-eligibility.ts) already classify the notes, so this check adds no
+ * parsing: only the entries whose hold is exactly needs-review and which isPlanStalled
+ * accepts are collected, from both PLANS.md
  * and BUGS.md. A warn, never a fail — the checkRefusedEntries precedent: a parked entry is
- * operator signal, not a broken environment; the plan role resolves the first itself, and
- * a held-for-operator entry is the operator's to release (`tumwater plan|bug --release`). */
+ * operator signal, not a broken environment; the plan role resolves it by splitting or
+ * replanning. */
 export function checkStalledEntries(root) {
     const planned = plannedPlanEntries(root);
     const collect = (entry, file) => {
         const hold = entryHold(entry, planned);
-        return hold === "needs-review" || hold === "held-for-operator" // vocabulary-ok: the held-for-operator hold's key
+        return hold === "needs-review" && isPlanStalled(entry)
             ? { file, entry }
             : null;
     };
@@ -336,15 +340,11 @@ export function checkStalledEntries(root) {
     ].filter((x) => x !== null);
     const [first, ...rest] = stalled;
     if (!first)
-        return okOutcome("no planned plan or open bug is held by a Needs-review or held-for-operator note"); // vocabulary-ok: names the held-for-operator hold
+        return okOutcome("no planned plan or open bug is held by a Needs-review note");
     const more = andMore(rest, (s) => quoteHeading(s.entry.title));
     const kind = entryKindLabel(first.file); // "Bug" | "Plan"
     const head = `${first.file === "bugs" ? "BUGS.md" : "PLANS.md"} ${kind.toLowerCase()}`;
-    const hold = entryHold(first.entry, planned);
     const note = (first.entry.body.split(/\n/).find((line) => line.trimStart().startsWith("**Needs review ")) ?? "").replace(/^\s*\*\*/, "").replace("**", "");
-    if (hold === "held-for-operator") { // vocabulary-ok: the held-for-operator hold's key
-        return warnOutcome(`${head} ${quoteHeading(first.entry.title)} is held for the operator ${heldCount(first.entry.body)} times${more} — release it with tumwater ${kind.toLowerCase()} --release`); // vocabulary-ok: a held-for-operator entry is the operator's to release
-    }
     return warnOutcome(`${head} ${quoteHeading(first.entry.title)} is held by a Needs review note ` +
         `(${truncate(note, REFUSAL_NOTE_MAX)})${more} — the plan role resolves it by splitting or replanning`);
 }
@@ -375,16 +375,16 @@ export function planDependencyProblem(root) {
     }
     if (firstDangling) {
         return { kind: "dangling", message: danglingMsg(firstDangling) +
-                andMore(restDangling, (d) => `${quote(d.title)} → ${d.ref}`, "ref(s)") +
+                andMore(restDangling, (d) => `${quote(d.title)} → ${d.ref}`, agree(restDangling.length, "ref", "refs")) +
                 others([[unparsed.length, "unparsed clause(s)"], [misworded.length, "misworded dependency(ies)"]]) };
     }
     if (firstUnparsed) {
-        return { kind: "unparsed", message: unparsedMsg(firstUnparsed) + andMore(restUnparsed, quote, "clause(s)") +
+        return { kind: "unparsed", message: unparsedMsg(firstUnparsed) + andMore(restUnparsed, quote, agree(restUnparsed.length, "clause", "clauses")) +
                 others([[misworded.length, "misworded dependency(ies)"]]) };
     }
     if (firstMisworded) {
         return { kind: "misworded", message: miswordedMsg(firstMisworded) +
-                andMore(restMisworded, (w) => `${quote(w.title)} → ${w.ref}`, "dependency(ies)") };
+                andMore(restMisworded, (w) => `${quote(w.title)} → ${w.ref}`, agree(restMisworded.length, "dependency", "dependencies")) };
     }
     return null;
 }

package/dist/src/doctor/doctor-backlog.js

@@ -8,7 +8,7 @@ import { humanSeconds, secondsSince, HOUR_MS, DAY_MS } from "../text/datetime.js
 import { eventsSince } from "../events/event-window.js";
 import { finiteNumber } from "../files/json-object.js";
 import { lowerMedian } from "../collections.js";
-import { plural, shortSpanPhrase } from "../text/phrases.js";
+import { agree, plural, shortSpanPhrase } from "../text/phrases.js";
 import { queuedMerges, unreadableMergeQueueFiles } from "../merge/merge-queue.js";
 import { mergeChanges, readMergeMarker } from "../merge/merge-slot.js";
 import { listWideScope, queuedListRows } from "../inbox/inbox.js";
@@ -19,7 +19,7 @@ import { stampedSubject } from "../git/commit-message.js";
 import { commitOperatorBacklogEdit } from "../backlog/backlog-commit.js";
 import { briefFile } from "../brief/brief.js";
 import { BACKLOG_FILES } from "../backlog/backlog-md.js";
-import { okOutcome, warnOutcome } from "./outcome.js";
+import { okOutcome, warnOutcome } from "./doctor-outcome.js";
 /** The doctor's backlog modules' shared scaffolding and the check groups that do not read a
  * single backlog document: the merge-queue, post-merge-review and queued-prompt checks
  * (checkStaleQueuedMerges, checkMergeQueueFiles, checkPostReviews, checkStalePrompts and the
@@ -30,7 +30,8 @@ import { okOutcome, warnOutcome } from "./outcome.js";
  * checks live in doctor-backlog-plans.ts (the plan-document structure and fix-claim checks) and
  * doctor-backlog-bugs.ts (open bugs, questions and holds). All of them warn instead of failing:
  * damaged documentation is operator signal, not a broken environment. doctor.ts composes them
- * beside the environment checks; the shared CheckOutcome shape is imported from outcome.ts. */
+ * beside the environment checks; the shared CheckOutcome shape is imported from
+ * doctor-outcome.ts. */
 /** How many Fixed records the two newest-first Fixed-record checks (fix claims and validation
  * gaps) verify: the newest, since the section is newest-first by template convention. Older
  * records drift as the code evolves — a symbol legitimately fixed long ago gets renamed later,
@@ -55,7 +56,8 @@ export const STALE_BUG_DAYS = 3;
  * shortened, since a doctor check renders one line. `render` makes each extra item's short
  * form — the fix-claim and stranded-plan sites quote a heading trimmed to
  * FIX_CLAIM_HEADING_MAX, the duplicate-headings site passes its items through as built;
- * `noun` names what the extras are ("record(s)" for fix claims, empty for the other two).
+ * `noun` names what the extras are and must already agree with `rest.length` — callers pass
+ * `agree(rest.length, "record", "records")`, or empty where no noun is named.
  * Empty string when there are no extras. */
 export function andMore(rest, render, noun = "") {
     return rest.length > 0
@@ -175,7 +177,7 @@ export function checkMergeQueueFiles(root) {
     if (files.length === 0)
         return okOutcome("the queue reader skips no merge-queue file");
     const [first, ...rest] = files;
-    const more = andMore(rest, (f) => f, "file(s)");
+    const more = andMore(rest, (f) => f, agree(rest.length, "file", "files"));
     return warnOutcome(`the merge queue holds ${plural(files.length, "file")} the reader skips — ${first}${more}; ` +
         `a torn or foreign file is never cleared, so nothing ages it or surfaces its merge — remove it (a crashed enqueue's merge ref still recovers on the next run)`);
 }

package/dist/src/doctor/doctor-check-names.js

@@ -1,9 +1,8 @@
 /** Every row name `tumwater doctor` can print, in report order — the names `tumwater doctor
  * <check>...` accepts. A leaf with no imports: cli.ts loads doctor.ts with a dynamic import()
  * while cli-command-args.ts is imported eagerly, so the argument parser reads the names from
- * here instead of pulling every check module into each CLI start. `pi extensions`, `funes`, and
- * the `claude window`/`codex window` subscription rows are conditional: a named one whose check
- * returns null leaves no row. */
+ * here instead of pulling every check module into each CLI start. `pi extensions` and `funes`
+ * are conditional: a named one whose check returns null leaves no row. */
 export const DOCTOR_CHECK_NAMES = [
     "node",
     "node binary",
@@ -17,11 +16,8 @@ export const DOCTOR_CHECK_NAMES = [
     "pause",
     "quiet hours",
     "budget",
-    "claude window",
-    "codex window",
     "provider waits",
     "maintenance allowance",
-    "provider concurrency",
     "provider contention",
     "check contention",
     "repeated failures",
@@ -29,6 +25,7 @@ export const DOCTOR_CHECK_NAMES = [
     "over-cap model",
     "fallback chain",
     "models for each tier",
+    "image input",
     "claude auth",
     "claude api key",
     "claude version",

package/dist/src/doctor/doctor-checks.js

@@ -17,13 +17,13 @@ import { errorMessage } from "../text/text.js";
 import { formatBytes } from "../text/format.js";
 import { BRIEF_TEXT_MAX_CHARS, briefFile, promptBlockOf, readBrief } from "../brief/brief.js";
 import { plural } from "../text/phrases.js";
-import { backendsInUse, unregisteredBackendInUse } from "../gates/startup-gate.js";
+import { backendsInUse, unregisteredBackendInUse } from "../gates/startup-gates.js";
 import { claudeSeamsInUse, minVersionOutcome, opencodeSeamsInUse, versionFromProbe, piSeamsInUse } from "./doctor-model-checks.js";
 import { claudeConfigDir } from "../agent/claude/claude-backend.js";
-import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./probe.js";
+import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./doctor-probe.js";
 import { childEnv } from "../process/process.js";
 import { opencodeBackend, OPENCODE_MIN_VERSION } from "../agent/opencode/opencode-backend.js";
-import { failOutcome, okOutcome, warnOutcome } from "./outcome.js";
+import { failOutcome, noConfigOutcome, okOutcome, warnOutcome } from "./doctor-outcome.js";
 import { spawnSync } from "node:child_process";
 /** The floor doctor falls back to when package.json — the one source of the declared
  * engines.node spec, read below — cannot be read (a broken install, the version command's
@@ -238,7 +238,7 @@ export function checkBackendBinary(root, pathEnv = envPath()) {
 export async function checkOpencodeVersion(root, pathEnv = envPath(), timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
     const { config } = loadConfigSafe(root);
     if (config === undefined)
-        return okOutcome("no readable tumwater.json — nothing to verify");
+        return noConfigOutcome();
     if (!opencodeSeamsInUse(config))
         return okOutcome("no model jobs run on opencode");
     const resolved = opencodeBackend.resolveBin(config);
@@ -255,7 +255,7 @@ export async function checkOpencodeVersion(root, pathEnv = envPath(), timeoutMs
  * `homeDir` and `env` are test seams. */
 export function checkClaudeTranscripts(config, homeDir = os.homedir(), env = process.env) {
     if (!config)
-        return okOutcome("no readable tumwater.json — nothing to verify");
+        return noConfigOutcome();
     if (!claudeSeamsInUse(config))
         return okOutcome("no model jobs run on claude");
     const configDir = resolvedBackendConfig(config, "claude").configDir;

package/dist/src/doctor/doctor-claude-checks.js

@@ -1,13 +1,13 @@
 import os from "node:os";
 import { childEnv } from "../process/process.js";
-import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./probe.js";
+import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./doctor-probe.js";
 import { claudeBackend, claudeConfigDir } from "../agent/claude/claude-backend.js";
 import { claudeEnv } from "../agent/claude/claude-env.js";
 import { claudeAuthUsesSubscription, parseClaudeAuthStatus } from "../agent/claude/claude-account.js";
 import { resolvedBackendConfig } from "../config/config-views.js";
 import { envPath } from "../files/files.js";
 import { belowNodeFloor } from "../version.js";
-import { failOutcome, okOutcome, warnOutcome } from "./outcome.js";
+import { failOutcome, okOutcome, warnOutcome } from "./doctor-outcome.js";
 import { claudeSeamsInUse, loadConfigForCheck, versionFromProbe, seamedModels, } from "./doctor-model-checks.js";
 /** The doctor's claude credential and version readiness checks, split out of
  * doctor-model-checks.ts (whose shared seam/model framework and the pi and tier-models
@@ -16,9 +16,9 @@ import { claudeSeamsInUse, loadConfigForCheck, versionFromProbe, seamedModels, }
  * distinct concern from the filesystem/git checks, kept together so a change to how doctor
  * spawns or scrubs claude does not touch the other model checks. The shared report contract
  * (CheckOutcome) and the seam/model framework (loadConfigForCheck, claudeSeamsInUse,
- * seamPairs) come from doctor-model-checks.ts, and the AUTH_CHECK_* probe budgets from probe.ts,
- * with the shared report contract (CheckOutcome) from outcome.ts, exactly as the other doctor-*
- * modules share them. */
+ * seamPairs) come from doctor-model-checks.ts, and the AUTH_CHECK_* probe budgets
+ * from doctor-probe.ts, with the shared report contract (CheckOutcome) from
+ * doctor-outcome.ts, exactly as the other doctor-* modules share them. */
 /** One bounded probe of the resolved `claude` binary under the scrubbed run environment a real
  * run gets: resolve the binary through the claude adapter that would spawn it and run `args`
  * with a short deadline. Null when the probe could not run, the child errored, or the deadline
@@ -95,39 +95,27 @@ export async function checkAnthroApiKey(root, env = process.env, pathEnv = envPa
         return okOutcome("ANTHROPIC_API_KEY is set, but claude reports no claude.ai login");
     return warnOutcome("ANTHROPIC_API_KEY is set while claude reports a claude.ai login — model jobs on claude will bill the API key, not the subscription; unset it or route every anthropic model job on pi explicitly");
 }
-/** claude CLI-version readiness (plans/agent-backends.md finding 9): an installed CLI below a
- * configured model's minimum fails or misprices that model, and team runs disable the
- * auto-updater, so the version an operator has is the version agent runs use. Fails below the
- * highest floor among the claude-routed models, naming which model needs it; an ok detail
- * prints the installed version and the floor it satisfied (or no floor when none applies).
- * The `off`/`minimal` thinking clamp is noted here too, since this check already has the
- * claude seams in hand. Stands down when no seam routes to claude. */
-export async function checkClaudeVersion(root, pathEnv = envPath(), timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
-    const config = loadConfigForCheck(root);
-    if ("level" in config)
-        return config;
-    const seams = seamedModels(config, "claude");
-    if (seams.length === 0)
-        return okOutcome("no model jobs run on claude");
-    // The floor each configured model needs; a model the adapter does not gate contributes none.
+/** The floor each configured model needs, keyed by model; a model the adapter does not gate
+ * contributes none. */
+function claudeVersionFloors(seams) {
     const floors = new Map();
     for (const seam of seams) {
         const min = claudeBackend.minVersion?.(seam.model);
         if (min !== undefined)
             floors.set(seam.model, min);
     }
-    const result = await claudeProbe(config, ["--version"], pathEnv, timeoutMs);
-    const found = versionFromProbe(result);
-    if (found === undefined)
-        return warnOutcome("could not check — `claude --version` did not run or its output was unreadable");
+    return floors;
+}
+/** The clamp note when any claude seam clamps thinking, else empty. */
+function claudeVersionClampNote(seams) {
     const clamped = seams.some((seam) => seam.thinking === "off" || seam.thinking === "minimal");
     const clampNote = clamped
         ? "; `off`/`minimal` thinking clamps to `--effort low` (claude has no lower setting)"
         : "";
-    if (floors.size === 0)
-        return okOutcome(`claude ${found}${clampNote}`);
-    // The highest floor decides: whichever model needs the newest CLI. Below it, fail and name
-    // that model; at or above, print the version against the floor.
+    return clampNote;
+}
+/** The highest floor decides: whichever model needs the newest CLI. */
+function claudeVersionNeededBy(floors) {
     let required = "";
     let neededBy = "";
     for (const [model, min] of floors) {
@@ -136,7 +124,35 @@ export async function checkClaudeVersion(root, pathEnv = envPath(), timeoutMs =
             neededBy = model;
         }
     }
+    return { required, neededBy };
+}
+/** Verdict on the found version against the claude seams' floors, carrying the clamp note. */
+function claudeVersionOutcome(found, floors, clampNote) {
+    if (floors.size === 0)
+        return okOutcome(`claude ${found}${clampNote}`);
+    const { required, neededBy } = claudeVersionNeededBy(floors);
     if (belowNodeFloor(found, `>=${required}`))
         return failOutcome(`claude ${found} is older than ${required} required by ${neededBy} — run \`claude update\``);
     return okOutcome(`claude ${found} (>= ${required} for ${neededBy})${clampNote}`);
 }
+/** claude CLI-version readiness (plans/agent-backends.md finding 9): an installed CLI below a
+ * configured model's minimum fails or misprices that model, and team runs disable the
+ * auto-updater, so the version an operator has is the version agent runs use. Fails below the
+ * highest floor among the claude-routed models, naming which model needs it; an ok detail
+ * prints the installed version and the floor it satisfied (or no floor when none applies).
+ * The `off`/`minimal` thinking clamp is noted here too, since this check already has the
+ * claude seams in hand. Stands down when no seam routes to claude. */
+export async function checkClaudeVersion(root, pathEnv = envPath(), timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
+    const config = loadConfigForCheck(root);
+    if ("level" in config)
+        return config;
+    const seams = seamedModels(config, "claude");
+    if (seams.length === 0)
+        return okOutcome("no model jobs run on claude");
+    const floors = claudeVersionFloors(seams);
+    const result = await claudeProbe(config, ["--version"], pathEnv, timeoutMs);
+    const found = versionFromProbe(result);
+    if (found === undefined)
+        return warnOutcome("could not check — `claude --version` did not run or its output was unreadable");
+    return claudeVersionOutcome(found, floors, claudeVersionClampNote(seams));
+}

package/dist/src/doctor/doctor-codex-checks.js

@@ -1,19 +1,19 @@
 import fs from "node:fs";
 import path from "node:path";
 import { childEnv } from "../process/process.js";
-import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./probe.js";
+import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./doctor-probe.js";
 import { codexBackend, CODEX_MIN_VERSION } from "../agent/codex/codex-backend.js";
 import { codexEffort, EFFORT_BY_THINKING } from "../agent/codex/codex-args.js";
 import { codexEnv } from "../agent/codex/codex-env.js";
 import { codexHome, readCodexCatalog } from "../agent/codex/codex-catalog.js";
 import { codexHookTrust } from "../agent/codex/codex-hook-trust.js";
-import { parseCodexLoginStatus } from "../agent/codex/codex-account.js";
+import { codexApiKeyRefusalMessage, parseCodexLoginStatus } from "../agent/codex/codex-account.js";
 import { codexWriteGuardDefinition } from "../agent/codex/codex-write-guard.js";
 import { resolvedBackendConfig } from "../config/config-views.js";
 import { envPath, isDirectory, readTextOrNull, statOrNull, treeBytes, walkFiles } from "../files/files.js";
 import { formatBytes, tokenWindowLabel } from "../text/format.js";
 import { errorMessage } from "../text/text.js";
-import { failOutcome, okOutcome, warnOutcome } from "./outcome.js";
+import { failOutcome, okOutcome, warnOutcome } from "./doctor-outcome.js";
 import { codexSeamsInUse, loadConfigForCheck, minVersionOutcome, versionFromProbe, seamedModels, } from "./doctor-model-checks.js";
 /** The doctor's codex rows (part 9a/9, plans/codex-backend.md §4, §7, "Hand steps"): one
  * exported check per row — install/version, login, home, models, account, leaks, sessions
@@ -25,8 +25,8 @@ import { codexSeamsInUse, loadConfigForCheck, minVersionOutcome, versionFromProb
  * pi-only team shows no codex row and spawns nothing and reads nothing. The shared
  * report contract (CheckOutcome) and the seam/model framework (loadConfigForCheck,
  * codexSeamsInUse, seamPairs) come from doctor-model-checks.ts, the AUTH_CHECK_* probe budgets
- * from probe.ts, and the shared report contract (CheckOutcome) from outcome.ts, as the other
- * doctor-* modules share them. */
+ * from doctor-probe.ts, and the shared report contract (CheckOutcome) from
+ * doctor-outcome.ts, as the other doctor-* modules share them. */
 /** The config and codex home a codex readiness row reads, or the warn outcome a broken
  * `tumwater.json` earns, or null when no seam routes to codex (the row's stand-down). All
  * eight rows repeat the same three-line guard and the same home lookup
@@ -83,7 +83,7 @@ export async function checkCodexAuth(root, pathEnv = envPath(), timeoutMs = AUTH
     if (status === "subscription")
         return okOutcome("logged in using ChatGPT — billing: subscription");
     if (status === "api")
-        return failOutcome(`Codex is logged in with an API key; tumwater runs Codex on a ChatGPT subscription only — run \`CODEX_HOME=${home} codex login --device-auth\``);
+        return failOutcome(codexApiKeyRefusalMessage(home));
     if (/Not logged in/i.test(result.stdout ?? ""))
         return failOutcome(`codex is not logged in — run \`CODEX_HOME=${home} codex login --device-auth\``);
     return warnOutcome("could not check — `codex login status` reply was unreadable");