tumwater 0.4.2 → 0.4.3

package/dist/src/gui/gui-history-endpoints.js

@@ -14,7 +14,7 @@ import { eventRole, readEvents } from "../events/event-read.js";
 import { eventFeedItem, eventMatchesGrep } from "../events/event-format.js";
 import { readRunDetail, runCommitSha, runMergedSha } from "../run/run-detail-data.js";
 import { renderRunDetail, runDetailPatch, runDetailStat, runTranscriptLines } from "../run/run-detail-render.js";
-import { resolveRevertTarget } from "../operator/revert.js";
+import { resolveRevertTarget } from "../operator/operator-revert.js";
 import { rolePayload } from "../roles/role-view.js";
 import { clampCount, intQuery, rejectBadRole, sinceMsQuery, untilMsQuery } from "./gui-args.js";
 import { badRequest, sendJson } from "./gui-http-body.js";
@@ -124,36 +124,67 @@ function windowOrCount(q, res) {
     return { kind: "count" };
 }
 export function handleHistory(q, res, root) {
+    const req = historyRequest(q, res);
+    if (req === null)
+        return;
+    const ctl = req.windowCtl;
+    if (ctl.kind === "window")
+        serveHistoryWindow(res, root, req, ctl.sinceMs, ctl.untilMs);
+    else
+        serveHistoryCount(q, res, root, req);
+}
+/** Parse the request prefix `GET /api/history` shares across both shapes: the `role`/`grep`
+ * filters, the `result` class list (resultClassesQuery, a 400 on an unknown class), the `model`
+ * selector list, the `summary` flag's mere presence, and the rival `sinceMs`-vs-`n` shape
+ * (windowOrCount, a 400 on both or a bad cap). Any 400 is already sent and yields null. */
+function historyRequest(q, res) {
     const role = q.get("role") || null; // "" and absent both read all roles
     const grep = q.get("grep") || null; // "" and absent both filter nothing
     // `model` is a comma list of exact selectors (trimmed, deduplicated); "", absent and a list
     // with no non-empty piece all filter nothing, and an unknown selector keeps no rows.
     const classes = resultClassesQuery(q, res);
     if (classes === null)
-        return;
-    const inClasses = (rows) => (classes.length ? rows.filter((r) => classes.includes(historyClass(r.result))) : rows);
+        return null;
     const modelPieces = splitCommaListUnique(q.get("model") ?? "");
-    const onModels = (rows) => (modelPieces.length ? runRowsOnModels(rows, modelPieces) : rows);
     const summary = q.get("summary") !== null; // the flag's presence, whatever its value
     const windowCtl = windowOrCount(q, res);
     if (windowCtl === null)
-        return;
-    if (windowCtl.kind === "window") {
-        const { sinceMs, untilMs } = windowCtl;
-        const { rows, covered } = readRunRowsSince(root, sinceMs, role, untilMs ?? null);
-        const matched = onModels(inClasses(grep === null ? rows : runRowsMatchingGrep(rows, grep)));
-        sendJson(res, 200, { rows: matched, covered, note: covered ? "" : SPARSE_WINDOW_NOTE, ...(summary ? { summary: summarizeRunRows(matched), modelSummary: summarizeRunRowsByModel(matched) } : {}) });
-        return;
-    }
+        return null;
+    return { role, grep, classes, modelPieces, summary, windowCtl };
+}
+/** The shared filter chain both shapes apply to the served rows: grep first, then the `result`
+ * outcome classes, then the `model` selectors — the CLI's `history --grep`, `--result` and
+ * `--model` rules, in that order. */
+function historyRows(rows, req) {
+    const grepped = req.grep === null ? rows : runRowsMatchingGrep(rows, req.grep);
+    const classed = req.classes.length ? grepped.filter((r) => req.classes.includes(historyClass(r.result))) : grepped;
+    return req.modelPieces.length ? runRowsOnModels(classed, req.modelPieces) : classed;
+}
+/** The optional additive fold both answers share: when `summary` is present, `{ summary,
+ * modelSummary }` added to the 200 payload; absent, nothing (so the response is byte-for-byte
+ * today's). */
+function historySummaryFields(rows, summary) {
+    return summary ? { summary: summarizeRunRows(rows), modelSummary: summarizeRunRowsByModel(rows) } : {};
+}
+/** Answer the trailing-window shape ({ rows, covered, note }): rows read through readRunRowsSince
+ * from `sinceMs` (untilMs drops the rows newer than now − untilMs when present, exactly as the
+ * CLI's `history --since … --until` window reads), then the shared historyRows filter, then the
+ * optional summary fold — key order rows, covered, note, summary, modelSummary. */
+function serveHistoryWindow(res, root, req, sinceMs, untilMs) {
+    const { rows, covered } = readRunRowsSince(root, sinceMs, req.role, untilMs ?? null);
+    const matched = historyRows(rows, req);
+    sendJson(res, 200, { rows: matched, covered, note: covered ? "" : SPARSE_WINDOW_NOTE, ...historySummaryFields(matched, req.summary) });
+}
+/** Answer the newest-`n` count shape: `n` parses through intQuery (non-negative, default
+ * HISTORY_DEFAULT_RUNS) and is clamped to [1, HISTORY_MAX_RUNS] — the GUI clamps where the CLI
+ * fails fast — then rows read through readRunRows, filtered and answered through the shared
+ * historyRows/historySummaryFields, key order rows, summary, modelSummary. */
+function serveHistoryCount(q, res, root, req) {
     const parsed = intQuery(q, res, "n", "non-negative", HISTORY_DEFAULT_RUNS);
     if (parsed === null)
         return;
-    const n = clampCount(parsed, HISTORY_MAX_RUNS);
-    let rows = readRunRows(root, n, role);
-    if (grep !== null)
-        rows = runRowsMatchingGrep(rows, grep);
-    rows = onModels(inClasses(rows));
-    sendJson(res, 200, summary ? { rows, summary: summarizeRunRows(rows), modelSummary: summarizeRunRowsByModel(rows) } : { rows });
+    const rows = historyRows(readRunRows(root, clampCount(parsed, HISTORY_MAX_RUNS), req.role), req);
+    sendJson(res, 200, { rows, ...historySummaryFields(rows, req.summary) });
 }
 /** How many of the log's newest events `GET /api/logs` scans by default, and the most it will
  * scan however large `n` asks: the CLI's `-n` shape (n bounds the scanned tail, not the printed
@@ -245,47 +276,64 @@ function transcriptText(root, role, run, detail, includePrompts, grep) {
  * payload's `role` is that run's; `result`/`model` narrow it the same way, and a miss is a 404
  * worded for any role. */
 export async function handleRun(q, res, root) {
-    let role = q.get("role");
+    const target = runSelector(q, res, root);
+    if (target === null)
+        return;
+    const detail = readRunDetail(root, target.role, target.run);
+    if (detail === null) {
+        sendJson(res, 404, { error: runNotFoundMessage(target.role, target.run) });
+        return;
+    }
+    sendJson(res, 200, await runPayload(root, target.role, target.run, detail, q));
+}
+/** Resolve which run the request names — validating the role, then the numbered or `last` form. */
+function runSelector(q, res, root) {
+    const role = q.get("role");
     const bareLast = role === null && q.get("last") !== null;
     if (!bareLast && rejectBadRole(root, res, role))
-        return;
-    let run;
-    if (q.get("last") === null) {
-        if (q.get("result") !== null)
-            return badRequest(res, "result needs last");
-        if (q.get("model") !== null)
-            return badRequest(res, "model needs last");
-        run = intQuery(q, res, "run", "positive");
-        if (run === null)
-            return;
+        return null;
+    return q.get("last") !== null ? lastRunSelector(q, res, root, role) : numberedRunSelector(q, res, role);
+}
+/** Resolve the explicit `run=N` selector of /api/run (three 400s, the miss worded by intQuery). */
+function numberedRunSelector(q, res, role) {
+    if (q.get("result") !== null) {
+        badRequest(res, "result needs last");
+        return null;
     }
-    else {
-        if (q.get("run") !== null)
-            return badRequest(res, "last cannot be combined with run (a number and the newest run are rival selectors)");
-        const classes = resultClassesQuery(q, res);
-        if (classes === null)
-            return;
-        const models = splitCommaListUnique(q.get("model") ?? "");
-        const classFilter = classes.length ? classes : null;
-        const modelFilter = models.length ? models : null;
-        const row = newestRunRow(root, role, classFilter, modelFilter);
-        if (row !== null)
-            role = row.role;
-        run = row?.run ?? null;
-        if (run === null) {
-            sendJson(res, 404, { error: runNotFoundLastMessage(role, classFilter, modelFilter) });
-            return;
-        }
+    if (q.get("model") !== null) {
+        badRequest(res, "model needs last");
+        return null;
     }
-    const detail = readRunDetail(root, role, run);
-    if (detail === null) {
-        sendJson(res, 404, { error: runNotFoundMessage(role, run) });
-        return;
+    const run = intQuery(q, res, "run", "positive");
+    if (run === null)
+        return null;
+    return { role: role, run };
+}
+/** Resolve the `last` selector, narrowed by `result`/`model`, to the role's newest run. */
+function lastRunSelector(q, res, root, role) {
+    if (q.get("run") !== null) {
+        badRequest(res, "last cannot be combined with run (a number and the newest run are rival selectors)");
+        return null;
+    }
+    const classes = resultClassesQuery(q, res);
+    if (classes === null)
+        return null;
+    const models = splitCommaListUnique(q.get("model") ?? "");
+    const classFilter = classes.length ? classes : null;
+    const modelFilter = models.length ? models : null;
+    const row = newestRunRow(root, role, classFilter, modelFilter);
+    if (row === null) {
+        sendJson(res, 404, { error: runNotFoundLastMessage(role, classFilter, modelFilter) });
+        return null;
     }
+    return { role: row.role, run: row.run };
+}
+/** Assemble the 200 payload — the collector plus its rendered, stat and flag-gated fields. */
+async function runPayload(root, role, run, detail, q) {
     const grep = (q.get("grep") ?? "").trim();
     const mergedAs = runMergedSha(detail);
     const target = mergedAs === null ? null : await resolveRevertTarget(root, mergedAs);
-    sendJson(res, 200, {
+    return {
         ...detail,
         text: renderRunDetail(detail),
         stat: await runDetailStat(root, detail),
@@ -293,7 +341,7 @@ export async function handleRun(q, res, root) {
         hasCommit: runCommitSha(detail) !== null,
         ...(q.get("patch") !== null ? { patch: await runDetailPatch(root, detail) } : {}),
         ...(q.get("transcript") !== null ? { transcript: transcriptText(root, role, run, detail, q.get("prompt") !== null, grep === "" ? undefined : grep) } : {}),
-    });
+    };
 }
 /** Handle GET /api/role?role=<id>: one role's inspection payload — rolePayload's object,
  * the same collection behind `tumwater role <id>` — so the drawer's Notes and Next run

package/dist/src/gui/gui-operator-commands.js

@@ -18,15 +18,15 @@ import { loadConfigSafe } from "../config/config.js";
 import { saveRoleNote } from "../agent/role-notes-write.js";
 import { roleNotesPath, MERGE_LOCK_WAIT_MS } from "../paths.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
-import { artifactPhrase, retireRole } from "../operator/retire.js";
-import { previewRevert, revertFollowUp, revertMergedCommit } from "../operator/revert.js";
+import { artifactPhrase, retireRole } from "../operator/operator-retire.js";
+import { previewRevert, revertFollowUp, revertMergedCommit } from "../operator/operator-revert.js";
 import { cancelQueuedMergeBySha } from "../merge/merge-cancel.js";
 import { acceptPostReviewBySha } from "../review/post-merge-review-accept.js";
 import { moveQueuedMergeToTopBySha } from "../merge/merge-top.js";
 import { readMergeQueue } from "../merge/merge-queue.js";
 import { mergeChanges } from "../merge/merge-slot.js";
 import { queueInFlight } from "../status/status-polls.js";
-import { orchestratorAlive } from "../team/orchestrator-info.js";
+import { orchestratorAlive } from "../team/team-orchestrator-info.js";
 import { shortSha } from "../text/format.js";
 import { editBriefText } from "../brief/brief-edit.js";
 import { requireStringField, validRoleIds } from "./gui-args.js";
@@ -34,6 +34,21 @@ import { badRequest, sendJson } from "./gui-http-body.js";
 import { errorMessage, gotSuffix } from "../text/text.js";
 import { readPostBody, readRoleBody, sendRequestResult } from "./gui-endpoint-common.js";
 import { wakeInSecondsMs } from "./gui-team-commands.js";
+/** The shared body of the dashboard's Health/Action buttons that run a domain function and
+ * answer its text lines joined with "; ": readPostBody (400/413 sent on a null return) plus the
+ * one sendJson built from the caller's `ok` predicate and line renderer. kill-orphans,
+ * drop-broken-pins, retire-leftovers and resync-install each restated this read-then-reply
+ * flow, differing only in what they run and how they say ok; this is the one home so the body
+ * discipline and the "; " joining cannot drift between them. commit-backlog and
+ * archive-backlog deliberately do not ride it (they carry extra payload fields or multi-branch
+ * replies), and neither does sendRequestResult's marker family (a different reply shape). */
+async function runLinesAction(req, res, root, run, ok, lines) {
+    const body = await readPostBody(req, res, "{}");
+    if (!body)
+        return;
+    const report = await run(root);
+    sendJson(res, 200, { ok: ok(report), message: lines(report).join("; ") });
+}
 /** Handle POST /api/reset-counters: the dashboard's counter reset — the same marker-writing
  * core `tumwater reset-counters` calls (requestResetCounters). Same body discipline and
  * `{}` → every configured role default as /api/wake. */
@@ -97,22 +112,14 @@ export async function handleReclaim(req, res, root) {
  * killOrphans `tumwater doctor --kill-orphans` runs, answering its lines joined with "; ". Same
  * body discipline as /api/reclaim; `ok` is false when the scan failed or a signal was refused. */
 export async function handleKillOrphans(req, res, root, kill = killOrphans) {
-    const body = await readPostBody(req, res, "{}");
-    if (!body)
-        return;
-    const report = await kill(root);
-    sendJson(res, 200, { ok: !("error" in report) && report.failed.length === 0, message: orphanKillLines(report).join("; ") });
+    return runLinesAction(req, res, root, kill, (r) => !("error" in r) && r.failed.length === 0, orphanKillLines);
 }
 /** Handle POST /api/doctor-drop-broken-pins: the dashboard Health card's Drop broken pins
  * button — the same dropBrokenPins `tumwater doctor --drop-broken-pins` runs, answering its
  * lines joined with "; ". `ok` is false when any pin could not be dropped. Same body discipline
  * as /api/kill-orphans; `drop` is injectable so a test need not touch git. */
 export async function handleDropBrokenPins(req, res, root, drop = dropBrokenPins) {
-    const body = await readPostBody(req, res, "{}");
-    if (!body)
-        return;
-    const result = await drop(root);
-    sendJson(res, 200, { ok: result.failed.length === 0, message: brokenPinDropLines(result).join("; ") });
+    return runLinesAction(req, res, root, drop, (r) => r.failed.length === 0, brokenPinDropLines);
 }
 /** Handle POST /api/doctor-retire-leftovers: the dashboard Health card's Retire leftovers
  * button — the same retireLeftovers `tumwater doctor --retire-leftovers` runs (with the loaded
@@ -120,11 +127,7 @@ export async function handleDropBrokenPins(req, res, root, drop = dropBrokenPins
  * retire was refused. Same body discipline as /api/kill-orphans; `retire` is injectable so a
  * test need not touch git. */
 export async function handleRetireLeftovers(req, res, root, retire = (r) => retireLeftovers(r, loadConfigSafe(r).config)) {
-    const body = await readPostBody(req, res, "{}");
-    if (!body)
-        return;
-    const report = await retire(root);
-    sendJson(res, 200, { ok: report.failed.length === 0, message: leftoverRetireLines(report).join("; ") });
+    return runLinesAction(req, res, root, retire, (r) => r.failed.length === 0, leftoverRetireLines);
 }
 /** Handle POST /api/doctor-commit-backlog: the dashboard Health card's Commit backlog button —
  * the same commitUncommittedBacklog `tumwater doctor --commit-backlog` runs, answering its
@@ -177,11 +180,7 @@ export async function handleArchiveBacklog(req, res, root, archive = (r) => arch
  * hold the merge lock or touch the registry. resyncRootInstall never throws, so a lock/blog
  * failure lands as the failure line, not a 500. */
 export async function handleResyncInstall(req, res, root, resync = resyncRootInstall) {
-    const body = await readPostBody(req, res, "{}");
-    if (!body)
-        return;
-    const r = await resync(root);
-    sendJson(res, 200, { ok: r.ok, message: rootInstallResyncLines(r).join("; ") });
+    return runLinesAction(req, res, root, resync, (r) => r.ok, rootInstallResyncLines);
 }
 /** Handle POST /api/abort: the dashboard's per-row abort control — the same marker-writing
  * core `tumwater abort` calls (requestAbort). The role is required and validated like

package/dist/src/gui/gui-prompt-commands.js

@@ -139,14 +139,20 @@ export async function handlePromptRole(req, res, root) {
     ], "\n");
     sendJson(res, 200, { ok: true, message });
 }
-/** The file-addressed prompt handlers' shared role prologue: validate the optional role
- * (400 sent on a present-but-invalid one and null returned, so the caller stops) and default
- * an absent role to the director's queue. The same optional-role rule handlePromptCancel,
- * handlePromptEdit and handlePromptTop state once instead of a guard-plus-default pair. */
-function promptFileRole(body, res, root) {
+/** The file-addressed prompt handlers' shared role+file prologue: the optional role (400 on
+ * a present-but-invalid one, absent defaulting to the director's queue) and the queue-file
+ * name (400 on a bad one) validate exactly like /api/transcript and /api/prompt-cancel,
+ * with nothing read on disk, and return the resolved role and file — or null when a 400 was
+ * sent (the caller stops). handlePromptCancel, handlePromptEdit and handlePromptTop state the
+ * guard-plus-default pair once here instead of at each call site, so the three endpoints
+ * cannot drift on which role or file they accept. */
+function promptFileTarget(body, res, root) {
     if (body.role !== undefined && rejectBadRole(root, res, body.role))
         return null;
-    return body.role === undefined ? DIRECTOR_ROLE : body.role;
+    const role = body.role === undefined ? DIRECTOR_ROLE : body.role;
+    if (rejectBadQueueFileName(res, body.file))
+        return null;
+    return { role, file: body.file };
 }
 /** Handle POST /api/prompt-cancel: retract one queued prompt addressed by its queue file —
  * the dashboard's per-row cancel affordance, the file-addressed twin of the CLI's
@@ -160,12 +166,10 @@ export async function handlePromptCancel(req, res, root) {
     const body = await readPostBody(req, res, '{"role": "feature", "file": "<stamp>-<seq>-<pid>.md"}');
     if (!body)
         return;
-    const role = promptFileRole(body, res, root);
-    if (role === null)
+    const target = promptFileTarget(body, res, root);
+    if (target === null)
         return;
-    if (rejectBadQueueFileName(res, body.file))
-        return;
-    const outcome = cancelQueuedFile(root, role, body.file);
+    const outcome = cancelQueuedFile(root, target.role, target.file);
     sendJson(res, 200, outcome.status === "cancelled"
         ? { ok: true, status: "cancelled", preview: promptPreview(outcome.text) }
         : OK_GONE);
@@ -186,23 +190,21 @@ export async function handlePromptEdit(req, res, root) {
     const body = await readPostBody(req, res, '{"role": "qa", "file": "<stamp>.md", "text": "..."}');
     if (!body)
         return;
-    const role = promptFileRole(body, res, root);
-    if (role === null)
+    const target = promptFileTarget(body, res, root);
+    if (target === null)
         return;
-    if (rejectBadQueueFileName(res, body.file))
-        return;
-    const fields = checkedPromptFields(res, body, role);
+    const fields = checkedPromptFields(res, body, target.role);
     if (!fields)
         return;
     // Image-input gate (plans/image-input.md "Attachments", part 5/5): an image edited into
     // the queued prompt answers 400 naming the fix when the target role cannot read it (and no
     // tier reroutes it) — the same gate submitRolePrompt enforces — before anything is written.
     // The edit handler does not flash a reroute notice, so it ignores the helper's return.
-    if (promptImageGate(res, root, role, (fields.images?.length ?? 0) > 0) === null)
+    if (promptImageGate(res, root, target.role, (fields.images?.length ?? 0) > 0) === null)
         return;
     let outcome;
     try {
-        outcome = editQueuedFile(root, role, body.file, fields.text, fields.images);
+        outcome = editQueuedFile(root, target.role, target.file, fields.text, fields.images);
     }
     catch (err) {
         badRequest(res, errorMessage(err));
@@ -225,14 +227,12 @@ export async function handlePromptTop(req, res, root) {
     const body = await readPostBody(req, res, '{"role": "qa", "file": "<stamp>.md"}');
     if (!body)
         return;
-    const role = promptFileRole(body, res, root);
-    if (role === null)
-        return;
-    if (rejectBadQueueFileName(res, body.file))
+    const target = promptFileTarget(body, res, root);
+    if (target === null)
         return;
     let outcome;
     try {
-        outcome = topQueuedFile(root, role, body.file);
+        outcome = topQueuedFile(root, target.role, target.file);
     }
     catch (err) {
         badRequest(res, errorMessage(err));

package/dist/src/gui/gui-report-endpoints.js

@@ -9,7 +9,7 @@ import { collectReport } from "../report/report-data.js";
 import { collectReportSince } from "../report/report-since-data.js";
 import { collectFailureReport, collectFailureReportSince } from "../failure/failure-data.js";
 import { renderFailureMarkdown } from "../failure/failure-render.js";
-import { renderSinceReportMarkdown } from "../report/report-render.js";
+import { renderSinceReportMarkdown } from "../report/report-since-render.js";
 import { loadQuarantine } from "../review/known-flakes.js";
 import { quarantineRows, quarantineViewRows } from "../review/quarantine-render.js";
 import { quarantineWarning } from "../baseline/main-guardrails.js";

package/dist/src/history/history-data.js

@@ -179,58 +179,85 @@ export function runRowsOnModels(rows, models) {
  * readEvents returns them), filtered to `role` when given, newest first. Pure: the CLI, the
  * GUI, and the tests share this collector, and none of them writes anything. */
 export function runRows(events, limit, role, join) {
-    const wanted = role === null ? null : new Set(asList(role));
-    const scoped = wanted === null ? events : events.filter((e) => wanted.has(e.source));
-    // The start pairing is the shared helper (events.ts), so history's dash-on-unpaired rule
-    // and the digest's fold cannot drift into different notions of a run's span.
-    const starts = runStartMap(scoped);
-    const models = runStartModelMap(scoped);
-    // The merge bookkeeping resolveQueuedResult joins over: per role, the merge_queued pins
-    // (oldest first) and the merge_done/merge_failed outcomes (oldest first). Both ride the role
-    // filter with their run, so the scoped events hold them exactly when they hold the row.
-    // A since-shaped scan hands a WIDER join read instead (readRunRowsSince): its cutoff cut
-    // the pins of runs that span it, so the maps read the unfiltered-by-cutoff evidence and
-    // resolveQueuedResult guards each claim on the row's run_start being whole in that read.
-    const joinScoped = join
-        ? wanted === null
-            ? join.events
-            : join.events.filter((e) => wanted.has(e.source))
-        : scoped;
-    const joinStarts = join ? runStartMap(joinScoped) : starts;
-    const joinModels = join ? runStartModelMap(joinScoped) : models;
-    const floorTs = join ? join.floorTs : null;
-    const { mergeQueuedByRunner, outcomeByRunner } = bucketMergeEvents(joinScoped);
-    const claimTop = new Map();
+    const wanted = roleWantSet(role);
+    const scoped = scopedEvents(events, wanted);
+    const evidence = runRowEvidence(scoped, join, wanted);
     const rows = [];
     for (let i = scoped.length - 1; i >= 0 && rows.length < limit; i--) {
         const e = scoped[i];
         if (e?.type !== "run_end")
             continue;
-        const rawResult = outcomeText(e);
-        const result = rawResult === "queued"
-            ? (resolveQueuedResult(e, mergeQueuedByRunner, outcomeByRunner, claimTop, joinStarts, floorTs)
-                ?.result ?? rawResult)
-            : rawResult;
-        const usage = eventUsage(e);
-        const peak = nonNegativeNumber(e.peakContextTokens, 0);
-        rows.push({
-            ts: e.ts,
-            time: formatTimestamp(e.ts),
-            tokens: usage.tokens,
-            costUsd: usage.costUsd,
-            ...(peak > 0 ? { peakContextTokens: peak } : {}),
-            ...(e.cutOff === true ? { cutOff: true } : {}),
-            role: eventRole(e),
-            run: eventRun(e),
-            result,
-            model: runStartModel(e, join ? joinModels : models),
-            durationMs: runSpanMs(e, starts),
-            usage: usageText(e),
-            detail: squash(textOr(e.summary, textOr(e.error, "")), DETAIL_MAX),
-        });
+        rows.push(runRowFromEnd(e, evidence));
     }
     return rows;
 }
+/** The role the scan is filtered to, as a direct set lookup: null means no filter (every
+ * event is wanted); otherwise the role list folded into a Set, so both the row scan and the
+ * merge-join read test membership in one `has`. */
+function roleWantSet(role) {
+    return role === null ? null : new Set(asList(role));
+}
+/** The `events` held by the scan: all of them when `wanted` is null (no role filter), else
+ * those whose `source` the role set holds — the one role filter, used for both the row scan
+ * and the join read, so the two cannot drift. */
+function scopedEvents(events, wanted) {
+    return wanted === null ? events : events.filter((e) => wanted.has(e.source));
+}
+/** Build the row scan's evidence from the scoped events and an optional wider join read. The
+ * start pairing is the shared helper (events.ts), so history's dash-on-unpaired rule and the
+ * digest's fold cannot drift into different notions of a run's span. The merge bookkeeping
+ * resolveQueuedResult joins over: per role, the merge_queued pins (oldest first) and the
+ * merge_done/merge_failed outcomes (oldest first). Both ride the role filter with their run,
+ * so the scoped events hold them exactly when they hold the row.
+ * A since-shaped scan hands a WIDER join read instead (readRunRowsSince): its cutoff cut the
+ * pins of runs that span it, so the maps read the unfiltered-by-cutoff evidence and
+ * resolveQueuedResult guards each claim on the row's run_start being whole in that read. */
+function runRowEvidence(scoped, join, wanted) {
+    const starts = runStartMap(scoped);
+    const models = runStartModelMap(scoped);
+    const joinScoped = join ? scopedEvents(join.events, wanted) : scoped;
+    const { mergeQueuedByRunner, outcomeByRunner } = bucketMergeEvents(joinScoped);
+    return {
+        starts,
+        joinStarts: join ? runStartMap(joinScoped) : starts,
+        joinModels: join ? runStartModelMap(joinScoped) : models,
+        floorTs: join ? join.floorTs : null,
+        mergeQueuedByRunner,
+        outcomeByRunner,
+        claimTop: new Map(),
+    };
+}
+/** One run_end's result label: the run's own unless it is `queued`, in which case the queued
+ * row is resolved through its change's merge evidence (resolveQueuedResult's conservative
+ * rule) and falls back to the raw `queued` label when the merge is still in the pipeline or
+ * the evidence is untrustworthy. */
+function queuedRowResult(e, rawResult, evidence) {
+    if (rawResult !== "queued")
+        return rawResult;
+    return (resolveQueuedResult(e, evidence.mergeQueuedByRunner, evidence.outcomeByRunner, evidence.claimTop, evidence.joinStarts, evidence.floorTs)?.result ?? rawResult);
+}
+/** Assemble one row from its `run_end` and the shared evidence: the raw usage numbers folded
+ * into the payload, the positive-only peak and cut-off flags, the join-or-plain model map,
+ * the paired duration, and the detail squash. */
+function runRowFromEnd(e, evidence) {
+    const usage = eventUsage(e);
+    const peak = nonNegativeNumber(e.peakContextTokens, 0);
+    return {
+        ts: e.ts,
+        time: formatTimestamp(e.ts),
+        tokens: usage.tokens,
+        costUsd: usage.costUsd,
+        ...(peak > 0 ? { peakContextTokens: peak } : {}),
+        ...(e.cutOff === true ? { cutOff: true } : {}),
+        role: eventRole(e),
+        run: eventRun(e),
+        result: queuedRowResult(e, outcomeText(e), evidence),
+        model: runStartModel(e, evidence.joinModels),
+        durationMs: runSpanMs(e, evidence.starts),
+        usage: usageText(e),
+        detail: squash(textOr(e.summary, textOr(e.error, "")), DETAIL_MAX),
+    };
+}
 /** The last `limit` completed runs read from root's event log, filtered to `role` when
  * given (newest first) — the scan cmdHistory and the GUI's handleHistory share, so the two
  * surfaces cannot drift. A window twice the ask plus slack: run_start lines and unrelated

package/dist/src/history/history-queued.js

@@ -3,7 +3,7 @@ import { groupBy } from "../collections.js";
 /** The merge bookkeeping resolveQueuedResult joins over: per role, the `merge_queued` pins
  * and the `merge_done`/`merge_failed` outcomes, each list oldest-first (the scan order). Exported
  * as one helper with exactly three call sites — readRunRows' history-row join, the failure
- * digest's time-and-spend fold (time-spend.ts), and run-detail-data.ts — so the collectors
+ * digest's time-and-spend fold (failure-time-spend.ts), and run-detail-data.ts — so the collectors
  * cannot disagree about which events feed the join or in what order they sit: a fourth
  * merge-bookkeeping event
  * type, or a changed order rule, is edited once here. Callers bucket only the events they
@@ -58,41 +58,63 @@ export function bucketMergeEvents(events) {
  * text plus the pin and outcome of the attempt that produced it (and that pin's sha), or null
  * to keep the raw label. Pure apart from the cursor it owns. */
 export function resolveQueuedResult(end, mergeQueuedByRunner, outcomeByRunner, claimTop, joinStarts, floorTs) {
-    // Interlock relief (plans/interlock-relief.md): a held run's commit stayed on the branch and
-    // enqueued nothing, so its queued label names the held commit, not a merge this run made.
-    // Returning null keeps that row's raw queued label and, crucially, leaves the earlier change's
-    // merge pins unclaimed, so the verdict that belongs to the queued entry is not credited to the
-    // held run. One guard covers all three call sites (history-data.ts, time-spend.ts,
-    // run-detail-data.ts).
-    if (end.heldOnBranch === true)
+    if (!queuedRowEvidenceWhole(end, joinStarts, floorTs))
         return null;
-    if (floorTs !== null) {
-        const startTs = joinStarts.get(`${end.source}#${end.run}`);
-        if (startTs !== undefined && startTs < floorTs)
-            return null;
-    }
     const queuedList = mergeQueuedByRunner.get(end.source);
     if (!queuedList || queuedList.length === 0)
         return null;
-    let top = claimTop.get(end.source) ?? queuedList.length - 1;
-    while (top >= 0 && queuedList[top].ts > end.ts)
-        top--;
+    const top = claimQueuedPin(end, queuedList, claimTop);
     if (top < 0)
         return null;
-    claimTop.set(end.source, top - 1);
     const outcomes = outcomeByRunner.get(end.source) ?? [];
-    // A recovery run's row: the attempt it re-enqueued, not the change's final verdict, so the
-    // final verdict shows once (on the authoring row) and each retriable failure once (here).
     const recovered = recoveredAttemptVerdict(queuedList, top, outcomes);
     if (recovered !== null)
         return recovered;
-    // The authoring row: walk forward while the next pin is a recovery re-enqueue and resolve to
-    // the last attempt's verdict. `findLast` picks the newest same-sha outcome so an un-rebased
-    // retry (recovery re-enqueues the identical sha, logged by both pins) does not re-match the
-    // first attempt's outcome inside the recovery pin's walk. The returned pin/outcome ride the
-    // result so a caller correlating sibling evidence (the failure digest's review-failure
-    // message) can key on THIS attempt's position, not a sha a pre-review rebase may have moved
-    // (BUGS.md 2026-10-10).
+    return authoringRowVerdict(queuedList, outcomes, top);
+}
+/** True when the row's join evidence is whole enough to resolve it: neither the interlock-relief
+ * held-run guard nor the since-window floor keeps the row's raw queued label. Interlock relief
+ * (plans/interlock-relief.md): a held run's commit stayed on the branch and enqueued nothing, so
+ * its queued label names the held commit, not a merge this run made. Returning false keeps that
+ * row's raw queued label and, crucially, leaves the earlier change's merge pins unclaimed, so the
+ * verdict that belongs to the queued entry is not credited to the held run. One guard covers all
+ * three call sites (history-data.ts, failure-time-spend.ts, run-detail-data.ts). When `floorTs` (a
+ * since-window's cutoff, null in the count view) sits after the run_start's ts, the row's join
+ * evidence is not whole in the windowed read and the row keeps its raw queued label. A MISSING
+ * start needs no guard — it joins, because rotation drops a prefix, so every pin older than the
+ * lost start is lost with it and nothing can be mis-claimed (and a skipped run has no start at all
+ * but is never queued). */
+function queuedRowEvidenceWhole(end, joinStarts, floorTs) {
+    if (end.heldOnBranch === true)
+        return false;
+    if (floorTs !== null) {
+        const startTs = joinStarts.get(`${end.source}#${end.run}`);
+        if (startTs !== undefined && startTs < floorTs)
+            return false;
+    }
+    return true;
+}
+/** Claim the newest unclaimed merge_queued pin at or before the row's end and consume it from the
+ * caller's `claimTop` cursor. The cursor (mutated in place) walks the pin list newest-first and
+ * hands each queued run the newest unclaimed pin at or before its end, so several queued runs
+ * cannot claim one pin. Returns the pin's index, or -1 when no pin is at or before the
+ * row's end. */
+function claimQueuedPin(end, queuedList, claimTop) {
+    let top = claimTop.get(end.source) ?? queuedList.length - 1;
+    while (top >= 0 && queuedList[top].ts > end.ts)
+        top--;
+    if (top < 0)
+        return -1;
+    claimTop.set(end.source, top - 1);
+    return top;
+}
+/** The authoring row: walk forward while the next pin is a recovery re-enqueue and resolve to the
+ * last attempt's verdict. `findLast` picks the newest same-sha outcome so an un-rebased retry
+ * (recovery re-enqueues the identical sha, logged by both pins) does not re-match the first
+ * attempt's outcome inside the recovery pin's walk. The returned pin/outcome ride the result so a
+ * caller correlating sibling evidence (the failure digest's review-failure message) can key on
+ * THIS attempt's position, not a sha a pre-review rebase may have moved (BUGS.md 2026-10-10). */
+function authoringRowVerdict(queuedList, outcomes, top) {
     let idx = top;
     let resolved = null;
     for (;;) {
@@ -147,7 +169,7 @@ function recoveredAttemptVerdict(queuedList, idx, outcomes) {
     return verdict === null || endsChange(verdict.result) ? null : verdict;
 }
 /** True when a pin re-enqueues the previous attempt's kept pin rather than starting a fresh
- * change. `recoverLeftover` (src/runner/leftover.ts) is the one `merge_queued` producer whose
+ * change. `recoverLeftover` (runner-leftover.ts) is the one `merge_queued` producer whose
  * summary starts with this label, so a fresh change's pin after a conflict-cap discard ends
  * `resolveQueuedResult`'s walk. */
 function isRecoveryPin(pin) {