tumwater 0.4.2 → 0.4.3

package/dist/src/gates/budget-gates.js

@@ -10,11 +10,9 @@ import { fallbackServingPair, rekeyFallbackBreakers, } from "../budget/fallback-
 import { fallbackPair, resolveTierFallbacks, tierChainSteps, tierFallbackLabels, tiersResolveDistinctPairs, } from "../config/config-fallbacks.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
-import { windowReserveFor } from "../config/config-views.js";
 import { piPairFree, readPiProviders } from "../pi/pi-models.js";
 import { readOpencodeCache } from "../agent/opencode/opencode-catalog.js";
 import { readAccount } from "../agent/subscription-account.js";
-import { claudeWindowUsedUp } from "../agent/claude/claude-account.js";
 import { budgetFallbackView, chainInfo, claudeOverageRefused, subscriptionBackendOf, } from "../budget/budget-fallback-view.js";
 // Re-export the names moved into budget-fallback-view.ts so no importer's import changes
 // (gate-polls.ts reads subscriptionBackendOf; budget-chain-info.test.ts reads chainInfo).
@@ -28,31 +26,25 @@ export function newBudgetGateState(config) {
         engaged: null,
         from: null,
         fromKey: "",
-        prevWindowMoved: new Set(),
-        directorFrom: null,
-        directorView: config,
-        directorKey: "",
         fallbackConfig: config,
         warned: false,
         prevChain: {},
     };
 }
-/** The budget gate's warning-and-transition half (split out of pollBudgetGate so a
- * budget_warning event field or an edge-trigger rule is found by name): edge-triggers the
- * 80%-of-cap warning into one budget_warning, computes the top spenders for whichever event
- * fires, logs exactly one budget_resumed/budget_fallback/budget_paused on a gate crossing
- * with the per-tier story and the pause cause, and advances state.prevGate. */
-function logBudgetGateEvents(input) {
-    const { root, state, states, now, gate, spentUsd, capUsd, pair, pairName, rejectedPair, priceResolved, servingResolved, } = input;
-    // The 80% early warning (PLANS.md 2026-09-30), edge-triggered with reset-on-below — the
-    // whole state machine: crossing the threshold while the gate is still open logs one
-    // budget_warning, midnight or a cap raise drops spend back under and re-arms it, and a
-    // second crossing the same day warns again. Warn only while the gate is open: a poll that
-    // engages fallback/paused already logs its own transition event, so the warning never
-    // doubles the page on the poll the cap itself is reached.
-    const warn = gate === "open" && budgetWarning({ spentUsd, capUsd });
-    // Who spent the most today, read once for whichever of the warning or a transition fires.
-    const topRoles = (warn && !state.warned) || gate !== state.prevGate ? topDailySpenders(states, now) : [];
+/** Which `budget_*` type a gate crossing logs: the resumed/fallback/paused pick on the
+ * direction of the transition (resumed only back to open; paused only when neither the
+ * default nor, with review on, the strong tier serves). */
+function budgetTransitionType(gate) {
+    return gate === "open" ? "budget_resumed" : gate === "fallback" ? "budget_fallback" : "budget_paused";
+}
+/** The 80%-of-cap warning edge (PLANS.md 2026-09-30), edge-triggered with reset-on-below — the
+ * whole state machine: crossing the threshold while the gate is still open logs one
+ * budget_warning, midnight or a cap raise drops spend back under and re-arms it, and a
+ * second crossing the same day warns again. Warn only while the gate is open: a poll that
+ * engages fallback/paused already logs its own transition event, so the warning never
+ * doubles the page on the poll the cap itself is reached. */
+function budgetWarningEdge(input, warn, topRoles) {
+    const { root, state, spentUsd, capUsd } = input;
     if (warn && !state.warned) {
         logEventBestEffort(root, {
             source: TUMWATER_SOURCE,
@@ -66,49 +58,71 @@ function logBudgetGateEvents(input) {
     else if (!warn) {
         state.warned = false;
     }
+}
+/** The identity fields a `budget_fallback` event carries so a reader can resolve the operator's
+ * "why this and not the other one" — which free pair took over, which configured pair was
+ * refused because pi's definitions do not price it at zero, or which free pair the breaker
+ * demoted after its runs kept failing (and after how many). */
+function fallbackTransitionFields(input) {
+    const { gate, pair, servingResolved } = input;
+    return gate === "fallback"
+        ? {
+            provider: pair?.provider,
+            model: pair?.model,
+            // The per-tier story (part 7b/8): which pair each tier resolved to, borrowed
+            // ones marked. Carried only when the tiers resolve to two or more distinct
+            // pairs — a single fallback (its pair borrowed by the other tiers) keeps the
+            // event tier-free, so today's single-pair readers keep today's text.
+            ...(tiersResolveDistinctPairs(servingResolved)
+                ? { tiers: tierFallbackLabels(servingResolved) }
+                : {}),
+        }
+        : {};
+}
+/** The paused gate's cause, named by the pair story that produced it. The default tier is the
+ * cause only when it failed to serve: a price-free default the breaker dropped is its own
+ * demotion (with the failure count), and a default with no price-free pair at all names the
+ * declared pair the price check refused. When the default serves, the review-on pause is the
+ * strong tier's: name its price-free pair when the breaker demoted it, and leave the cause
+ * unset when strong simply had no pair to borrow. */
+function pausedTransitionFields(input) {
+    const { gate, state, pair, pairName, rejectedPair, priceResolved, servingResolved } = input;
+    return gate === "paused" && servingResolved.default.pair === null && pair
+        ? { fallbackDemoted: pairName, failures: state.breakers[pairName]?.failures ?? 0 }
+        : gate === "paused" && servingResolved.default.pair === null && rejectedPair
+            ? { fallbackRejected: modelPairName(rejectedPair) }
+            : gate === "paused" && priceResolved.strong.pair !== null
+                ? {
+                    fallbackDemoted: modelPairName(priceResolved.strong.pair),
+                    failures: state.breakers[modelPairName(priceResolved.strong.pair)]?.failures ?? 0,
+                }
+                : {};
+}
+/** The budget gate's warning-and-transition half (split out of pollBudgetGate so a
+ * budget_warning event field or an edge-trigger rule is found by name): edge-triggers the
+ * 80%-of-cap warning into one budget_warning, computes the top spenders for whichever event
+ * fires, logs exactly one budget_resumed/budget_fallback/budget_paused on a gate crossing
+ * with the per-tier story and the pause cause, and advances state.prevGate. */
+function logBudgetGateEvents(input) {
+    const { root, state, states, now, gate, spentUsd, capUsd, } = input;
+    // The 80% early warning, computed once below budgetWarningEdge (which holds its state
+    // machine): a poll at or past the 80% threshold while still open warrants the edge.
+    const warn = gate === "open" && budgetWarning({ spentUsd, capUsd });
+    // Who spent the most today, read once for whichever of the warning or a transition fires.
+    const topRoles = (warn && !state.warned) || gate !== state.prevGate ? topDailySpenders(states, now) : [];
+    budgetWarningEdge(input, warn, topRoles);
     if (gate !== state.prevGate) {
         logEventBestEffort(root, {
             source: TUMWATER_SOURCE,
-            type: gate === "open" ? "budget_resumed" : gate === "fallback" ? "budget_fallback" : "budget_paused",
+            type: budgetTransitionType(gate),
             spentUsd,
             capUsd,
             // The cap pages say where the money went, since a poll can jump past the cap with no
             // warning first; a resume does not (midnight reads zero spend, a cap raise is the
             // operator's own act).
             ...(gate !== "open" && topRoles.length > 0 ? { topRoles } : {}),
-            // On the way into a gate the fallback's identity is the operator's answer to "why
-            // this and not the other one": which free pair took over, which configured pair was
-            // refused because pi's definitions do not price it at zero, or which free pair the
-            // breaker demoted after its runs kept failing (and after how many).
-            ...(gate === "fallback"
-                ? {
-                    provider: pair?.provider,
-                    model: pair?.model,
-                    // The per-tier story (part 7b/8): which pair each tier resolved to, borrowed
-                    // ones marked. Carried only when the tiers resolve to two or more distinct
-                    // pairs — a single fallback (its pair borrowed by the other tiers) keeps the
-                    // event tier-free, so today's single-pair readers keep today's text.
-                    ...(tiersResolveDistinctPairs(servingResolved)
-                        ? { tiers: tierFallbackLabels(servingResolved) }
-                        : {}),
-                }
-                : {}),
-            // The pause's cause, named by the pair story that produced it. The default tier is the
-            // cause only when it failed to serve: a price-free default the breaker dropped is its
-            // own demotion (with the failure count), and a default with no price-free pair at all
-            // names the declared pair the price check refused. When the default serves, the
-            // review-on pause is the strong tier's: name its price-free pair when the breaker
-            // demoted it, and leave the cause unset when strong simply had no pair to borrow.
-            ...(gate === "paused" && servingResolved.default.pair === null && pair
-                ? { fallbackDemoted: pairName, failures: state.breakers[pairName]?.failures ?? 0 }
-                : gate === "paused" && servingResolved.default.pair === null && rejectedPair
-                    ? { fallbackRejected: modelPairName(rejectedPair) }
-                    : gate === "paused" && priceResolved.strong.pair !== null
-                        ? {
-                            fallbackDemoted: modelPairName(priceResolved.strong.pair),
-                            failures: state.breakers[modelPairName(priceResolved.strong.pair)]?.failures ?? 0,
-                        }
-                        : {}),
+            ...fallbackTransitionFields(input),
+            ...pausedTransitionFields(input),
         });
         state.prevGate = gate;
     }
@@ -126,13 +140,12 @@ export function runOnPair(runModelPair, pair) {
         runModelPair.model === pair.model);
 }
 /** The config a runner runs on while the budget gate stands: the director keeps the live config —
- * an explicit human prompt outranks the autonomous-spend cap — except while a used-up window has
- * its own subscription claude model unable to run, when it takes `directorConfig` (pollBudgetGate's
- * view: the tier's fallback pair; omitted means the live config). Every other role takes the gate's
- * derived view (pollBudgetGate's returned `roleConfig`). Single home for the rule, so the
- * scheduler's per-poll assignment (src/budget/budget-wiring.ts) and a throwaway merge author's
- * construction (src/merge/merge-verify.ts's resolveAuthor) cannot drift apart — say, an exemption
- * granted to one more role in one copy and not the other. */
+ * an explicit human prompt outranks the autonomous-spend cap (and, part 5d/6, no usage window
+ * moves it either) — so it takes `directorConfig` (always the live config; omitted means the live
+ * config). Every other role takes the gate's derived view (pollBudgetGate's returned `roleConfig`).
+ * Single home for the rule, so the scheduler's per-poll assignment (src/budget/budget-wiring.ts)
+ * and a throwaway merge author's construction (src/merge/merge-verify.ts's resolveAuthor) cannot
+ * drift apart — say, an exemption granted to one more role in one copy and not the other. */
 export function gateRoleConfig(role, liveConfig, roleConfig, directorConfig = liveConfig) {
     return role === DIRECTOR_ROLE ? directorConfig : roleConfig;
 }
@@ -179,13 +192,8 @@ export function pollBudgetGate(state, ctx) {
     // verdict. The resolution below deliberately prices alone (the map's keys are the pairs
     // that would run absent a demotion, so a demotion cannot churn them); part 5c/8 wires the
     // full predicate into the resolution so a demoted pair re-resolves only the tiers using it.
-    // A backend's used-up subscription window (windowUsedUp, the rule the team hold reads too):
-    // while it stands a subscription pair of that backend is no fallback — it would meet the
-    // same window. `windowReserveFor(config, backend)` makes a window past its reserve fraction
-    // count as used up for the team; the director's own reading (directorWindowOutFor) ignores
-    // it, as it runs the operator's prompts.
-    const windowOutFor = (backend) => claudeWindowUsedUp(accounts(backend), now, true, windowReserveFor(liveConfig, backend));
-    const directorWindowOutFor = (backend) => claudeWindowUsedUp(accounts(backend), now);
+    // A used-up subscription window no longer moves a tier to its fallback (part 5d/6): only a
+    // spent maxDailyCostUsd does, so the free-ness predicate below is purely the cap rule.
     // A priced step (one pi does not price at zero, or claude on API billing) is usable only
     // while the team is under its cap and the step is under its own `maxDailyCostUsd`, so no cap
     // can be passed; at the cap only free steps remain, as before.
@@ -196,18 +204,13 @@ export function pollBudgetGate(state, ctx) {
             // (extraUsage, claude-only) may spend extra usage within its cap while no window is
             // rejected or refuses overage.
             if (!p.extraUsage)
-                return windowOutFor(subBackend) === null && piPairFree(providers, p, accounts, catalog);
-            // Past the reserve this step would spend the reserved quota before reaching extra usage:
-            // it waits until a reading shows the account already spending overage.
+                return piPairFree(providers, p, accounts, catalog);
             const subAccount = accounts(subBackend);
-            if (windowOutFor(subBackend)?.reserve === true &&
-                !Object.values(subAccount.windows).some((w) => w.isUsingOverage === true))
-                return false;
             return (!reached &&
                 !claudeOverageRefused(subAccount) &&
                 (p.maxDailyCostUsd === undefined || pairDailyCost(states, modelPairName(p), now) < p.maxDailyCostUsd));
         }
-        // The subscription-window rule lives entirely in the branch above (it returns early for
+        // The subscription rule lives entirely in the branch above (it returns early for
         // any subscription pair); below that branch a pair is never a subscription, so only the
         // free-ness and cap rules apply.
         if (piPairFree(providers, p, accounts, catalog))
@@ -285,11 +288,11 @@ export function pollBudgetGate(state, ctx) {
         priceResolved,
         servingResolved,
     });
-    // The fallback config view — the derived config roles run under, the used-up window moves
-    // (windowOut/windowTiers/windowResumedBackends), the chain block, and the handback pairs —
-    // lives in src/budget/budget-fallback-view.ts (the view half, plan's part 5b/8, 5c/8, 6a/7):
-    // it reads these verdict half's resolved inputs and writes the cross-poll view state, and
-    // pollBudgetGate keeps this call signature so gate-polls.ts's destructure is unchanged.
+    // The fallback config view — the derived config roles run under, the chain block, and the
+    // handback pairs — lives in src/budget/budget-fallback-view.ts (the view half, plan's parts
+    // 5b/8, 5c/8, 6a/7): it reads these verdict half's resolved inputs and writes the cross-poll
+    // view state, and pollBudgetGate keeps this call signature so gate-polls.ts's destructure is
+    // unchanged.
     const view = budgetFallbackView({
         state,
         config: liveConfig,
@@ -298,8 +301,6 @@ export function pollBudgetGate(state, ctx) {
         providers,
         catalog,
         accounts,
-        windowOutFor,
-        directorWindowOutFor,
         priceResolved,
         servingResolved,
         chainPairs,

package/dist/src/gates/gate-polls.js

@@ -1,23 +1,20 @@
 import { applyBudgetGateWiring, budgetPausedSubjects } from "../budget/budget-wiring.js";
 import { newBudgetGateState, pollBudgetGate, } from "./budget-gates.js";
-import { backendsInUse } from "./startup-gate.js";
 import { newPauseGateState, pollPauseGates } from "./pause-gates.js";
-import { newStreakGateState, pollStreakGate } from "./streak-gate.js";
+import { newStreakGateState, pollStreakGate } from "./streak-gates.js";
 import { newRoleCapGateState, pollRoleCapGate, } from "./role-cap-gates.js";
 import { newMaintenanceQuotaGateState, pollMaintenanceQuotaGate, } from "./maintenance-quota.js";
 import { newBootstrapGateState, pollBootstrapGate, } from "./bootstrap-gates.js";
 import { newQuietHoursGateState, pollQuietHoursGate, roleQuietHold, } from "../scheduling/quiet-hours.js";
-import { BYTES_PER_GB, newDiskGateState, pollDiskGate, sampleFreeBytes, } from "./disk-gate.js";
-import { pollErrorStorm, pollFailureSpread, pollTeamHold, pollClaudeWindowWarning, pollClaudeWindowReserve, windowObservation } from "../team/team-polls.js";
-import { readAccount } from "../agent/subscription-account.js";
+import { BYTES_PER_GB, newDiskGateState, pollDiskGate, sampleFreeBytes, } from "./disk-gates.js";
+import { pollErrorStorm, pollFailureSpread, pollTeamHold } from "../team/team-polls.js";
 import { standingHolds } from "../team/team-hold.js";
-import { ERROR_STORM_QUIET } from "../team/error-storm.js";
-import { FAILURE_SPREAD_QUIET } from "../team/failure-spread.js";
+import { ERROR_STORM_QUIET } from "../team/team-error-storm.js";
+import { FAILURE_SPREAD_QUIET } from "../team/team-failure-spread.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { baseRoleOf, instancePauseKey, runnerEnabled } from "../roles/runner-ids.js";
 import { queuedMergeRoles } from "../merge/merge-queue.js";
-import { publishInfoFields } from "../team/orchestrator-info.js";
-import { windowReserveFor } from "../config/config-views.js";
+import { publishInfoFields } from "../team/team-orchestrator-info.js";
 /** A fresh gate family: nothing seen yet, so the first poll of an unpaused, unheld team
  * logs nothing. The budget gate seeds its breaker and derived fallback view from the
  * startup config; a live reload replaces the config on the next poll. */
@@ -32,28 +29,19 @@ export function newTeamGateStates(config) {
         quiet: newQuietHoursGateState(),
         disk: newDiskGateState(),
         teamHold: new Map(),
-        claudeWindowWarned: new Set(),
-        claudeWindowReserved: new Set(),
         errorStorm: ERROR_STORM_QUIET,
         failureSpread: FAILURE_SPREAD_QUIET,
     };
 }
 /** Poll every team-wide gate and alarm, advancing `states` in place. */
 export function pollTeamGates(states, ctx) {
-    const { root, now } = ctx;
-    // The per-backend subscription account lookup (part 2e/9): each backend's account is read on
-    // demand — the window hold/reserve/warning loop, the window-move and the handback reads each
-    // call accounts fresh — so a second subscription backend is judged from its own account, never
-    // from claude's.
-    const accounts = (backend) => readAccount(root, backend, now);
-    const budget = pollBudgetPhase(states, ctx, accounts);
+    const budget = pollBudgetPhase(states, ctx);
     const holds = pollHoldGates(states, ctx);
     const quietDisk = pollQuietAndDiskGates(states, ctx);
-    pollTeamFailureAlarms(states, ctx, accounts, budget.windowTiers);
+    pollTeamFailureAlarms(states, ctx);
     return {
         gate: budget.gate,
         roleConfig: budget.roleConfig,
-        directorConfig: budget.directorConfig,
         userPaused: holds.userPaused,
         pausedRoles: holds.pausedRoles,
         capPaused: holds.capPaused,
@@ -63,7 +51,6 @@ export function pollTeamGates(states, ctx) {
         servingResolved: budget.servingResolved,
         priceResolved: budget.priceResolved,
         budgetActive: budget.budgetActive,
-        windowMovedRoles: budget.windowMovedRoles,
         roleQuietHeld: quietDisk.roleQuietHeld,
         quietNow: quietDisk.quietNow,
         diskHeld: quietDisk.diskHeld,
@@ -75,66 +62,54 @@ export function pollTeamGates(states, ctx) {
 // owns only the wiring — the demotion publish below and the per-runner assignment at
 // the bottom of this block — and the per-tier budget pause (src/budget/budget-wiring.ts,
 // part 5c/8): a role whose model tier resolved to no usable free pair while the cap is
-// reached starts no new runs, and a role on a window-moved tier whose own backend owns
-// the out window is moved off it.
-function pollBudgetPhase(states, ctx, accounts) {
+// reached starts no new runs.
+function pollBudgetPhase(states, ctx) {
     const { root, runners, liveConfig, modelsPath, info } = ctx;
-    const { gate, roleConfig, spentUsd, capUsd, onFallback, resumed: gateResumed, pairs: fallbackPairs, priceResolved, servingResolved, budgetActive, windowTiers, windowResumedBackends, directorConfig, chain, } = pollBudgetGate(states.budget, {
+    const { gate, roleConfig, spentUsd, capUsd, onFallback, resumed: gateResumed, pairs: fallbackPairs, priceResolved, servingResolved, budgetActive, chain, } = pollBudgetGate(states.budget, {
         root,
         states: runners.map((r) => r.state),
         liveConfig,
         modelsPath,
     });
     // The budget wiring (demotions publish, fallback_switched event, per-runner config/cap
-    // assignment, cap-reopen and window hand-back) lives in src/budget/budget-wiring.ts
-    // (part 5c/8, part 2e/9) along with the whole budget concern.
+    // assignment, cap-reopen hand-back) lives in src/budget/budget-wiring.ts
+    // (part 5c/8) along with the whole budget concern.
     applyBudgetGateWiring({
         root,
         runners,
         liveConfig,
         info,
-        accounts,
         budget: states.budget,
         view: {
             roleConfig,
-            directorConfig,
             onFallback,
             resumed: gateResumed,
             pairs: fallbackPairs,
-            priceResolved,
             budgetActive,
-            windowTiers,
-            windowResumedBackends,
             chain,
             spentUsd,
             capUsd,
         },
     });
     // The per-tier budget pause (src/budget/budget-wiring.ts, part 5c/8): a role whose model
-    // tier resolved to no usable free pair while the cap is reached starts no new runs, and a
-    // role on a window-moved tier whose own backend owns the out window is moved off it — the
+    // tier resolved to no usable free pair while the cap is reached starts no new runs — the
     // stateless verdict recomputed every poll from the SAME resolution the gate's value came
     // from, beside `capPaused` (the scheduling pass folds the sets; the director is exempt, as
     // under every autonomous gate, and the demoted pair's probe pierces the set for its own
     // tier's roles only — probeRoles in the orchestrator's scheduling pass).
-    const { budgetPausedRoles, windowMovedRoles } = budgetPausedSubjects({
+    const { budgetPausedRoles } = budgetPausedSubjects({
         runners,
         liveConfig,
-        accounts,
         budgetActive,
         servingResolved,
-        windowTiers,
     });
     return {
         gate,
         roleConfig,
-        directorConfig,
         budgetPausedRoles,
-        windowMovedRoles,
         servingResolved,
         priceResolved,
         budgetActive,
-        windowTiers,
     };
 }
 // The pause gates (src/gates/pause-gates.ts owns the reads, the edge-triggered pause/resume
@@ -145,7 +120,7 @@ function pollBudgetPhase(states, ctx, accounts) {
 function pollHoldGates(states, ctx) {
     const { root, runners, liveConfig, now } = ctx;
     const { userPaused, pausedRoles } = pollPauseGates(root, states.pause);
-    // The error-streak circuit breaker (src/gates/streak-gate.ts): a role past ERROR_STREAK_BREAKER
+    // The error-streak circuit breaker (src/gates/streak-gates.ts): a role past ERROR_STREAK_BREAKER
     // consecutive failed runs is paused through the same per-role marker the operator's
     // `pause --role` writes — act-on-it where the warn bar and the storm alarms only talk. The
     // director is not exempt; a failing director cannot process prompts anyway. Roles it just
@@ -240,19 +215,21 @@ function pollQuietAndDiskGates(states, ctx) {
 }
 // Each runner as the two provider-failure polls read it (HoldInputs) is built ONCE here so
 // the hold and the spread read the same list, like holdObservations on the reducer side.
-// Keying on the effective provider is what lets a storm on the fallback pair form its own
-// hold while the abandoned primary stays clear (PLANS.md "Model failure fallback, part 1/2").
+// Keying on the effective provider is what lets a storm on the budget fallback pair form its
+// own hold while the abandoned primary stays clear.
 //
 // Each stamp (lastRateLimit/lastBackendFailure) carries the hold key of the backend that
 // ACTUALLY failed — a reviewer run folded through the author's role stamps `claude`, not
 // the pi author's provider — and the polls' observation mapper files each stamp under that
 // key, falling back to runProvider here for a stamp without one (PLANS.md "Mixed claude +
-// pi fleets, part 2/4"). The spreads below carry the stamps wholesale, provider included.
-function pollTeamFailureAlarms(states, ctx, accounts, windowTiers) {
-    const { root, runners, liveConfig, now, info } = ctx;
+// pi fleets, part 2/4"). The spreads below carry the stamps wholesale, provider included;
+// the provider is each runner's resolved seam key (runProvider), naming the budget fallback
+// pair when a cap episode is active — the pair the run actually uses.
+function pollTeamFailureAlarms(states, ctx) {
+    const { root, runners, now, info } = ctx;
     const holdInputs = (rs) => rs.map((r) => ({
         role: r.role,
-        provider: r.runProvider(now),
+        provider: r.runProvider(),
         ...(r.lastRateLimit ? { lastRateLimit: r.lastRateLimit } : {}),
         ...(r.lastBackendFailure ? { lastBackendFailure: r.lastBackendFailure } : {}),
     }));
@@ -275,16 +252,7 @@ function pollTeamFailureAlarms(states, ctx, accounts, windowTiers) {
     // back to states.teamHold — one hold per provider, lifted holds kept keyed for their relapse
     // memory but never reading as held — and the permit-time closures read the LATEST poll's map
     // there, so a waiter granted its permit after a later poll sees that poll's world.
-    const windowAccountReads = backendsInUse(liveConfig).map((backend) => [backend, accounts(backend)]);
-    // The subscription-window hold, reserve and warning, read per backend in use (part 2e/9): a
-    // second subscription backend gets its own hold, reserve and warning memory keyed by its own
-    // `backend`, so claude's roles, hold and events are untouched by another backend's window.
-    // One account read per backend feeds both the hold observations and the reserve/warning polls;
-    // a backend whose account implies no hold contributes no observation.
-    const windowObservations = windowAccountReads
-        .map(([backend, account]) => windowObservation(backend, account, now, windowReserveFor(liveConfig, backend)))
-        .filter((o) => o !== null);
-    states.teamHold = pollTeamHold(root, states.teamHold, holdInputs(runners), now, windowObservations, windowTiers);
+    states.teamHold = pollTeamHold(root, states.teamHold, holdInputs(runners), now);
     // The standings hold, published for observers (PLANS.md 2026-10-17 "the dashboards and
     // `tumwater status` name a standing provider failure hold"): `standingHolds` turns the holds
     // map into the per-provider list the status snapshot and the alert banner name, the same
@@ -294,23 +262,14 @@ function pollTeamFailureAlarms(states, ctx, accounts, windowTiers) {
     publishInfoFields(root, info, [
         ["providerHolds", providerHolds.length > 0 ? providerHolds : undefined],
     ]);
-    // The reserve and warning polls, one per subscription backend in use: each logs its own
-    // events keyed by its own backend (the `backend:type:resetsAt` keys), so claude's own reserve
-    // and warning memory is unaffected by another backend's crossings (part 2e/9).
-    for (const [backend, account] of windowAccountReads) {
-        states.claudeWindowReserved = pollClaudeWindowReserve(root, states.claudeWindowReserved, account, now, backend, windowReserveFor(liveConfig, backend));
-        // The subscription usage window's warning is observational (the hold above is the gate): the
-        // first allowed_warning logs once per window, and the memory lives beside the holds map.
-        states.claudeWindowWarned = pollClaudeWindowWarning(root, states.claudeWindowWarned, account, now, backend);
-    }
-    // Team-wide error-storm warning (src/team/error-storm.ts): when several roles' run streaks
+    // Team-wide error-storm warning (src/team/team-error-storm.ts): when several roles' run streaks
     // fail consecutively on one shared cause, each role's own "consecutive run failures"
     // warning still fires alone — this adds the one team-level warning that names the
     // cause (and the config knob, when the cause has one) instead of leaving the operator
     // to diff 14 streak lines. Observational only: it gates nothing, so unlike the failure
     // hold above there is no re-open event — the members' own recoveries tell that story.
     states.errorStorm = pollErrorStorm(root, states.errorStorm, runners);
-    // Team-wide wide-shallow storm alarm (src/team/failure-spread.ts): when many roles each
+    // Team-wide wide-shallow storm alarm (src/team/team-failure-spread.ts): when many roles each
     // fail a few times on one provider failure kind, the streak bar needs one role deep,
     // the error storm needs several roles deep, and the hold needs the failures close
     // together — this counts raw failures of one kind across roles in a rolling window,

package/dist/src/gates/pause-gates.js

@@ -27,6 +27,15 @@ export function newPauseGateState() {
  * empty, so a logged `until` is the live deadline. */
 export function pollPauseGates(root, state) {
     const marker = standingTeamPause(root);
+    const userPaused = pollTeamPauseCrossing(root, state, marker);
+    const { roles: pausedRolesNow, until: rolesUntil } = standingRolePause(root);
+    const pausedRolesSet = pollRolePauseCrossing(root, state, pausedRolesNow, rolesUntil);
+    return { userPaused, pausedRoles: pausedRolesSet };
+}
+/** The team-pause crossing: one `team_paused`/`team_resumed` event on the poll where the
+ * marker's presence flips, carrying a timed pause's `until`/`reason` or the `expired` mark
+ * when the previous poll's deadline ran out. Returns whether the team is paused now. */
+function pollTeamPauseCrossing(root, state, marker) {
     const userPaused = marker !== null;
     if (userPaused !== state.prevUserPaused) {
         logEventBestEffort(root, marker
@@ -44,7 +53,12 @@ export function pollPauseGates(root, state) {
         state.prevUserPaused = userPaused;
     }
     state.prevTeamUntil = marker?.until;
-    const { roles: pausedRolesNow, until: rolesUntil } = standingRolePause(root);
+    return userPaused;
+}
+/** The per-role crossings: one `role_paused` per role that just entered the set, and one
+ * `role_resumed` per role that left it, carrying the shared deadline or `expired` mark when
+ * the previous poll's deadline ran out. Returns the now-paused role set. */
+function pollRolePauseCrossing(root, state, pausedRolesNow, rolesUntil) {
     const rolesExpired = state.prevRolesUntil !== undefined && state.prevRolesUntil <= Date.now();
     const pausedRolesSet = new Set(pausedRolesNow);
     for (const r of pausedRolesNow)
@@ -55,5 +69,5 @@ export function pollPauseGates(root, state) {
             logEventBestEffort(root, { source: TUMWATER_SOURCE, type: "role_resumed", role: r, ...(rolesExpired ? { expired: true } : {}) });
     state.prevPausedRoles = pausedRolesSet;
     state.prevRolesUntil = rolesUntil;
-    return { userPaused, pausedRoles: pausedRolesSet };
+    return pausedRolesSet;
 }

package/dist/src/gates/readiness.js

@@ -1,4 +1,4 @@
-/** The repo preconditions' shared wording behind the readiness gate. startup-gate.ts answers
+/** The repo preconditions' shared wording behind the readiness gate. startup-gates.ts answers
  * with the first unmet precondition (cmdStart and requireReadyRepo fail on it, the self-redeploy
  * refuses a swap on it) and doctor.ts reports each one individually, but every surface
  * describes the same problems — so the wording lives here once and cannot drift.

package/dist/src/gates/role-cap-gates.js

@@ -7,7 +7,7 @@
  * and nothing can get stuck"): the verdict is recomputed from the runner state every poll, no
  * marker is written, and local midnight lifts it by itself.
  *
- * Deliberate differences from the streak gate's shape (src/gates/streak-gate.ts), stated in
+ * Deliberate differences from the streak gate's shape (src/gates/streak-gates.ts), stated in
  * the plan so no implementer re-litigates them:
  * - This gate writes NOTHING to the shared per-role pause marker (src/team/team-state.ts's
  *   pauseRole). The marker is anonymous — after a restart across midnight the harness could
@@ -24,7 +24,7 @@
  * module owns the only event emission — the orchestrator's poll owns only the wiring. The
  * in-memory `prev` and `warned` sets are the whole cross-poll memory: a restart with a
  * still-over-cap role re-logs one `role_cap_paused` on the first poll, and a role already past
- * 80% re-logs one `role_cap_warning` (the durable-cause honest report the streak-gate doc
+ * 80% re-logs one `role_cap_warning` (the durable-cause honest report the streak-gates doc
  * accepts). */
 import { groupBy } from "../collections.js";
 import { budgetWarning, dailyCost, todayStamp } from "../budget/budget.js";
@@ -50,7 +50,7 @@ export function roleCapPaused(state, cap, now = Date.now()) {
  * ids so a caller can log the base (the gate) or flatten the ids (the observer). */
 export function roleCapVerdicts(runners, caps, now) {
     // Group by base role via the shared Map-of-arrays step (collections.groupBy, which
-    // time-spend, history-data, and team-polls also fold), then drop the exempt director's
+    // failure-time-spend, history-data, and team-polls also fold), then drop the exempt director's
     // group so it never holds a verdict; first-appearance order is preserved.
     const groups = groupBy(runners, (r) => baseRoleOf(r.role));
     groups.delete(DIRECTOR_ROLE);
@@ -71,6 +71,45 @@ export function roleCapVerdicts(runners, caps, now) {
 export function newRoleCapGateState() {
     return { prev: new Set(), warned: new Set() };
 }
+/** One base role's pause/resume edge, logged by the poll's loop: reads whether the role was
+ * already judged over its cap at the last poll (`state.prev`) and on ENTER logs one
+ * `role_cap_paused` (role, spentUsd, capUsd); on EXIT logs one `role_cap_resumed` (role). */
+function logCapCrossing(root, base, verdict, cap, state) {
+    const was = state.prev.has(base);
+    if (verdict.over && !was) {
+        logEventBestEffort(root, {
+            source: TUMWATER_SOURCE,
+            type: "role_cap_paused",
+            role: base,
+            spentUsd: verdict.spentUsd,
+            capUsd: cap,
+        });
+    }
+    else if (!verdict.over && was) {
+        logEventBestEffort(root, { source: TUMWATER_SOURCE, type: "role_cap_resumed", role: base });
+    }
+}
+/** The 80% early warning (PLANS.md 2026-10-09), the per-role twin of the team's
+ * budget_warning and edge-triggered with the same reset-on-below: crossing the threshold
+ * while still under the cap logs one `role_cap_warning`, a dip back under re-arms it. Warn
+ * only while the cap is open — a poll that jumps straight to the cap already logs its own
+ * `role_cap_paused`, so the warning never doubles the page on the poll the cap is reached. */
+function logCapWarning(root, base, verdict, cap, state) {
+    const warn = !verdict.over && cap !== undefined && budgetWarning({ spentUsd: verdict.spentUsd, capUsd: cap });
+    if (warn && !state.warned.has(base)) {
+        logEventBestEffort(root, {
+            source: TUMWATER_SOURCE,
+            type: "role_cap_warning",
+            role: base,
+            spentUsd: verdict.spentUsd,
+            capUsd: cap,
+        });
+        state.warned.add(base);
+    }
+    else if (!warn) {
+        state.warned.delete(base);
+    }
+}
 /** Step the gate by one orchestrator poll. Per runner (the director exempt, like every
  * autonomous gate): judge `roleCapPaused` against its configured cap; on ENTER log one
  * `role_cap_paused` carrying the role, its spend, and its cap; on EXIT log one
@@ -86,39 +125,9 @@ export function pollRoleCapGate(root, state, runners, caps, now) {
     const paused = new Set();
     const overBases = new Set();
     for (const [base, verdict] of verdicts) {
-        const was = state.prev.has(base);
-        if (verdict.over && !was) {
-            logEventBestEffort(root, {
-                source: TUMWATER_SOURCE,
-                type: "role_cap_paused",
-                role: base,
-                spentUsd: verdict.spentUsd,
-                capUsd: caps?.[base],
-            });
-        }
-        else if (!verdict.over && was) {
-            logEventBestEffort(root, { source: TUMWATER_SOURCE, type: "role_cap_resumed", role: base });
-        }
-        // The 80% early warning (PLANS.md 2026-10-09), the per-role twin of the team's
-        // budget_warning and edge-triggered with the same reset-on-below: crossing the threshold
-        // while still under the cap logs one role_cap_warning, a dip back under re-arms it. Warn
-        // only while the cap is open — a poll that jumps straight to the cap already logs its own
-        // role_cap_paused, so the warning never doubles the page on the poll the cap is reached.
         const cap = caps?.[base];
-        const warn = !verdict.over && cap !== undefined && budgetWarning({ spentUsd: verdict.spentUsd, capUsd: cap });
-        if (warn && !state.warned.has(base)) {
-            logEventBestEffort(root, {
-                source: TUMWATER_SOURCE,
-                type: "role_cap_warning",
-                role: base,
-                spentUsd: verdict.spentUsd,
-                capUsd: cap,
-            });
-            state.warned.add(base);
-        }
-        else if (!warn) {
-            state.warned.delete(base);
-        }
+        logCapCrossing(root, base, verdict, cap, state);
+        logCapWarning(root, base, verdict, cap, state);
         if (verdict.over) {
             overBases.add(base);
             for (const id of verdict.roleIds)