tumwater 0.4.2 → 0.4.3

package/dist/src/history/history.js

@@ -166,11 +166,9 @@ function applyHistoryModelFilter(rows, rest) {
     }
     return { rows, models };
 }
-/** Render the collected-and-filtered rows: the `--by`/`--summary` summary grouping, the `--json`
- * document, the empty-state wording (blaming the filter that emptied the set, else the log or
- * window), the aligned table, and the sparse-window note. A bad `--by` value fails here, after
- * row collection and filtering and before `--json`. */
-function sayHistory(rows, q, covered, filtered) {
+/** Validate `--by`'s value and its `--summary` requirement; return whether the grouping is by
+ * model (false for `role`). One home for "can this `--by` proceed, and does it group by model?" */
+function historySummaryGroup(q) {
     // `--by role|model` picks how --summary groups its lines (role by default).
     const byRaw = flagValue(q.rest, "--by");
     let byModel = false;
@@ -184,6 +182,52 @@ function sayHistory(rows, q, covered, filtered) {
             fail("history --by needs --summary (it picks how the summary groups runs)");
         byModel = byRaw === "model";
     }
+    return byModel;
+}
+/** The empty-set prose: blame the filter that emptied the set (model, then result, then grep),
+ * else the log or window. Never the `no runs yet`/`no runs in <window>` prose when rows were
+ * scanned and filtered out — the runs are there, none match. */
+function sayHistoryEmpty(q, filtered) {
+    // A grep that matched nothing must not borrow the empty-log prose: `no runs yet` and
+    // `no runs in 2h` are statements about the LOG and the WINDOW, and both are false when
+    // rows were scanned and filtered out — the operator would read a quiet team where the
+    // truth is `the runs are there, none match`. The logs --grep rule (its `no events
+    // matching "<pattern>"`, src/cli/log-commands.ts) names the pattern instead; --json stays
+    // a bare {"rows":[]} document above, never prose in either form.
+    //
+    // The result class is named only when it emptied a non-empty set (`afterGrep > 0`): an
+    // empty log or window scanned no rows, so the result filter removed nothing and the
+    // empty-log/window prose is the true one — the dashboard's History view draws the same
+    // line. A grep that admitted nothing keeps its own wording regardless of --result.
+    say(filtered.models !== null && filtered.afterResult > 0
+        ? `no runs on model "${filtered.models.join(",")}"`
+        : filtered.classes !== null && filtered.afterGrep > 0
+            ? `no runs with result "${filtered.classes.join(",")}"`
+            : q.grepPattern !== null
+                ? `no runs matching "${q.grepPattern}"`
+                : q.sinceMs === null
+                    ? "no runs yet"
+                    : q.untilMs === null
+                        ? `no runs in ${durationLabel(q.sinceMs)}`
+                        : `no runs ${betweenWindow(q.sinceMs, q.untilMs)}`);
+}
+/** Render the non-empty rows: the summary (model or role) when `--summary`, else the aligned
+ * table. Called only with `rows.length > 0`.
+ */
+function sayHistoryRows(rows, summary, byModel) {
+    if (summary)
+        say(byModel ? renderModelSummary(summarizeRunRowsByModel(rows)) : renderSummary(summarizeRunRows(rows)));
+    else {
+        const widths = widestWidths(rows);
+        say(rows.map((r) => renderRow(r, widths)).join("\n"));
+    }
+}
+/** Render the collected-and-filtered rows: the `--by`/`--summary` summary grouping, the `--json`
+ * document, the empty-state wording (blaming the filter that emptied the set, else the log or
+ * window), the aligned table, and the sparse-window note. A bad `--by` value fails here, after
+ * row collection and filtering and before `--json`. */
+function sayHistory(rows, q, covered, filtered) {
+    const byModel = historySummaryGroup(q);
     const summary = q.rest.includes("--summary") && rows.length > 0;
     // --json swaps the renderer for the collector's own payload, exactly as status --json and
     // report --json: the same rows the table prints, each with ts/tokens/costUsd kept raw. A
@@ -194,36 +238,10 @@ function sayHistory(rows, q, covered, filtered) {
         return;
     }
     if (rows.length === 0) {
-        // A grep that matched nothing must not borrow the empty-log prose: `no runs yet` and
-        // `no runs in 2h` are statements about the LOG and the WINDOW, and both are false when
-        // rows were scanned and filtered out — the operator would read a quiet team where the
-        // truth is `the runs are there, none match`. The logs --grep rule (its `no events
-        // matching "<pattern>"`, src/cli/log-commands.ts) names the pattern instead; --json stays
-        // a bare {"rows":[]} document above, never prose in either form.
-        //
-        // The result class is named only when it emptied a non-empty set (`afterGrep > 0`): an
-        // empty log or window scanned no rows, so the result filter removed nothing and the
-        // empty-log/window prose is the true one — the dashboard's History view draws the same
-        // line. A grep that admitted nothing keeps its own wording regardless of --result.
-        say(filtered.models !== null && filtered.afterResult > 0
-            ? `no runs on model "${filtered.models.join(",")}"`
-            : filtered.classes !== null && filtered.afterGrep > 0
-                ? `no runs with result "${filtered.classes.join(",")}"`
-                : q.grepPattern !== null
-                    ? `no runs matching "${q.grepPattern}"`
-                    : q.sinceMs === null
-                        ? "no runs yet"
-                        : q.untilMs === null
-                            ? `no runs in ${durationLabel(q.sinceMs)}`
-                            : `no runs ${betweenWindow(q.sinceMs, q.untilMs)}`);
+        sayHistoryEmpty(q, filtered);
         return;
     }
-    if (summary)
-        say(byModel ? renderModelSummary(summarizeRunRowsByModel(rows)) : renderSummary(summarizeRunRows(rows)));
-    else {
-        const widths = widestWidths(rows);
-        say(rows.map((r) => renderRow(r, widths)).join("\n"));
-    }
+    sayHistoryRows(rows, summary, byModel);
     // A sparse window is never mistaken for a quiet team — but the note only ever rides rows
     // (an empty window returned above), it never touches --json output, and it is the shared
     // SPARSE_WINDOW_NOTE wording: the oldest retained event being inside the window is exactly

package/dist/src/inbox/prompt-commands.js

@@ -179,10 +179,10 @@ function runPromptImageGate(root, target) {
     if (guidance.notice)
         say(guidance.notice);
 }
-/** `--edit <n>` mode — replace a queued prompt's body by position: the attachment gate, then
- * the editor for a bare position or the typed/`--file` text, list-wide or `--role`-scoped. One
- * helper so `--edit`'s rules are found by name. */
-function runPromptEdit(root, position, text, attachPaths, role) {
+/** The `--edit` attachment phase: read the `--attach` image list (undefined when there is
+ * none) and run the image-input gate under the role the edit targets — the position's
+ * resolved role when no `--role` narrows it. */
+function readEditAttachments(root, position, attachPaths, role) {
     // The same broken-config policy and list-wide resolution as cancel, one verb over: the
     // file's new content rides the same queue file (position, enqueue stamp, and a pending
     // --at deferral untouched), and a concurrent dequeue reports gone and exits clean. An
@@ -200,48 +200,66 @@ function runPromptEdit(root, position, text, attachPaths, role) {
         const targetRole = role ?? resolveListedRole(root, position);
         runPromptImageGate(root, targetRole);
     }
-    const typed = text;
-    if (typed === null) {
-        // Bare `--edit <n>`: open the prompt's body in the editor. The role is resolved first
-        // and the write goes by file name, so a dequeue while the editor is open reports gone
-        // instead of editing the neighbour that shifted into the position.
-        const targetRole = role ?? resolveListedRole(root, position);
-        let name;
-        let body;
-        try {
-            name = path.basename(queuedFileAtPosition(root, targetRole, position));
-            body = readQueuedPromptBody(root, targetRole, name);
-        }
-        catch (err) {
-            return fail(errorMessage(err));
-        }
-        if (body === null) {
-            sayPromptOutcome(position, targetRole, { status: "gone" }, role === null);
-            return;
-        }
-        const after = editInEditor(body, "prompt.md");
-        // An emptied buffer is an abort, not a blank prompt: the queue would otherwise hold a
-        // prompt with no text, which the enqueue forms refuse.
-        if (after.trim() === "" && body.trim() !== "")
-            fail("the edited prompt is empty; nothing changed (use --cancel <n> to drop it)");
-        if (after.trim() === body.trim() && images === undefined) {
-            say(`prompt ${position} unchanged`);
-            return;
-        }
-        try {
-            sayPromptOutcome(position, targetRole, editQueuedFile(root, targetRole, name, after, images), role === null);
-        }
-        catch (err) {
-            fail(errorMessage(err));
-        }
+    return images;
+}
+/** The bare `--edit <n>` arm: resolve the role, read the queued body by file name (so a
+ * concurrent dequeue reports gone), open it in the editor and write the result back —
+ * unchanged, emptied or edited — with the carried `images`. */
+function editBareQueuedPrompt(root, position, role, images) {
+    // Bare `--edit <n>`: open the prompt's body in the editor. The role is resolved first
+    // and the write goes by file name, so a dequeue while the editor is open reports gone
+    // instead of editing the neighbour that shifted into the position.
+    const targetRole = role ?? resolveListedRole(root, position);
+    let name;
+    let body;
+    try {
+        name = path.basename(queuedFileAtPosition(root, targetRole, position));
+        body = readQueuedPromptBody(root, targetRole, name);
+    }
+    catch (err) {
+        return fail(errorMessage(err));
+    }
+    if (body === null) {
+        sayPromptOutcome(position, targetRole, { status: "gone" }, role === null);
         return;
     }
+    const after = editInEditor(body, "prompt.md");
+    // An emptied buffer is an abort, not a blank prompt: the queue would otherwise hold a
+    // prompt with no text, which the enqueue forms refuse.
+    if (after.trim() === "" && body.trim() !== "")
+        fail("the edited prompt is empty; nothing changed (use --cancel <n> to drop it)");
+    if (after.trim() === body.trim() && images === undefined) {
+        say(`prompt ${position} unchanged`);
+        return;
+    }
+    try {
+        sayPromptOutcome(position, targetRole, editQueuedFile(root, targetRole, name, after, images), role === null);
+    }
+    catch (err) {
+        fail(errorMessage(err));
+    }
+}
+/** The typed `--edit <n> <text>` / `--file` arm: the list-wide `editListedPrompt` path when
+ * no `--role`, else the role-scoped `editRolePrompt` command, with the carried `images`. */
+function editTypedQueuedPrompt(root, position, text, role, images) {
     if (role === null) {
-        sayListedOutcome(editListedPrompt(root, listWideScope(root), position, typed, images), position);
+        sayListedOutcome(editListedPrompt(root, listWideScope(root), position, text, images), position);
         return;
     }
     const target = role ?? DIRECTOR_ROLE;
-    sayPromptOutcome(position, target, runRolePromptCommand(root, target, position, (r, role, position) => editRolePrompt(r, role, position, typed, images)), false);
+    sayPromptOutcome(position, target, runRolePromptCommand(root, target, position, (r, role, position) => editRolePrompt(r, role, position, text, images)), false);
+}
+/** `--edit <n>` mode — replace a queued prompt's body by position: read the `--attach` image
+ * list through the gate, then the editor for a bare position or the typed/`--file` text,
+ * list-wide or `--role`-scoped. The three phases live in `readEditAttachments`,
+ * `editBareQueuedPrompt` and `editTypedQueuedPrompt`, so each `--edit` job is found by name. */
+function runPromptEdit(root, position, text, attachPaths, role) {
+    const images = readEditAttachments(root, position, attachPaths, role);
+    if (text === null) {
+        editBareQueuedPrompt(root, position, role, images);
+        return;
+    }
+    editTypedQueuedPrompt(root, position, text, role, images);
 }
 /** `--top <n>` mode — move a queued prompt to the head of its queue by position, list-wide or
  * `--role`-scoped. One helper so `--top`'s rules are found by name. */
@@ -283,8 +301,7 @@ function runPromptSubmit(root, text, atDelayMs, attachPaths, role) {
     // `--attach <path>`: read and validate through the shared helper (a bad path fails by name
     // before anything is queued). An attachment the target role cannot read is refused here by
     // name — the same gate submitRolePrompt enforces, surfaced early so the CLI exits non-zero
-    // with the fix before anything is written or queued; a role that reroutes a blind read is
-    // not refused, but the operator is told where the prompt will actually run.
+    // with the fix before anything is written or queued.
     const images = attachPaths.length > 0 ? readPromptImages(attachPaths) : undefined;
     if (images && images.length > 0) {
         runPromptImageGate(root, target);

package/dist/src/init/init.js

@@ -234,26 +234,8 @@ async function resolveInitPlan(root, briefText, branch, opts) {
     const preferredBranch = await resolveInitPreferredBranch(root, branch, wasRepo);
     return { dryRun, tpl, combinedPrompt, brief, readmeExists, adopted, wasRepo, preferredBranch };
 }
-/** Seed `root` from a resolved `InitPlan`: git init (a new repo only), every absent project
- * file and starter directory, the config, and the commit. Holds the `created`/`leftAlone`
- * bookkeeping locally; performs no validation and never refuses. Returns everything the
- * composed `InitResult` needs except `adopted`, `dryRun` and `template`, which `initProject`
- * reads off `plan`. */
-async function seedProject(root, plan) {
-    const { dryRun, tpl, combinedPrompt, brief, readmeExists, adopted, wasRepo, preferredBranch } = plan;
-    let repoInitialized = false;
-    let createdBranch;
-    if (!wasRepo) {
-        if (!dryRun)
-            await git(root, "init", "-b", preferredBranch);
-        repoInitialized = true;
-        createdBranch = preferredBranch;
-    }
-    // Decided before any project file is written (init only seeds bootstrap on a fresh project).
-    // A repo the `git init` above just created (or a dry run would) has no commits, and init
-    // itself commits nothing before the end, so this one answer also picks the commit message.
-    const withCommits = wasRepo && (await hasCommits(root));
-    const fresh = await isFreshProject(root, withCommits);
+/** The `created`/`leftAlone` arrays and the `claim`/`write` closures above them. */
+function seedWriters(root, dryRun) {
     const created = [];
     const leftAlone = [];
     /** Record a template path this run either created (via `make`, under a real run only) or
@@ -275,33 +257,64 @@ async function seedProject(root, plan) {
     // because claim's existsSync would then treat the torn file as complete on a re-run and
     // never repair it.
     const write = (name, content) => claim(name, path.join(root, name), () => writeTextAtomic(path.join(root, name), content));
+    return { created, leftAlone, claim, write };
+}
+/** The new-repo `git init` job: seed the preferred branch unless the run is a dry run. */
+async function initSeedRepo(root, plan) {
+    let repoInitialized = false;
+    let createdBranch;
+    if (!plan.wasRepo) {
+        if (!plan.dryRun)
+            await git(root, "init", "-b", plan.preferredBranch);
+        repoInitialized = true;
+        createdBranch = plan.preferredBranch;
+    }
+    return { repoInitialized, createdBranch };
+}
+/** Whether `root` is a fresh project and the repo has commits — decided before any project
+ * file is written (init only seeds bootstrap on a fresh project). A repo the `git init`
+ * above just created (or a dry run would) has no commits, and init itself commits nothing
+ * before the end, so this one answer also picks the commit message. */
+async function resolveSeedFreshness(root, plan) {
+    const withCommits = plan.wasRepo && (await hasCommits(root));
+    const fresh = await isFreshProject(root, withCommits);
+    return { withCommits, fresh };
+}
+/** Where the brief goes: the existing brief file, TUMWATER.md (adopted), or README.md. */
+function seedBriefFile(root, plan, writers) {
     // README.md is the brief only when none exists yet and there is no README to adopt (a fresh
     // repo): with TUMWATER.md owning the managed sections, a created README.md would carry a
     // duplicate prompt + status block that readBriefText never reaches and the readme role
     // never maintains.
     const name = projectName(root);
-    if (brief !== null)
-        leftAlone.push(brief);
-    else if (adopted) {
-        if (readmeExists)
-            leftAlone.push("README.md");
-        write("TUMWATER.md", briefTemplate(name, combinedPrompt));
+    if (plan.brief !== null)
+        writers.leftAlone.push(plan.brief);
+    else if (plan.adopted) {
+        if (plan.readmeExists)
+            writers.leftAlone.push("README.md");
+        writers.write("TUMWATER.md", briefTemplate(name, plan.combinedPrompt));
     }
     else
-        write("README.md", readmeTemplate(name, combinedPrompt));
+        writers.write("README.md", readmeTemplate(name, plan.combinedPrompt));
+}
+/** The template backlog files: PLANS/BUGS/QUESTIONS/PRINCIPLES, with starter-plans subst. */
+function seedBacklogFiles(tpl, writers) {
     // A template with starter plans seeds the backlog with them, rendered as `### ` entries —
     // the primary entry format every backlog reader parses — so the team's first runs land on
     // real work. blank keeps the `_None yet._` placeholder byte-identical to today.
     const plansContent = tpl.starterPlans.length > 0
         ? PLANS_TEMPLATE.replace("_None yet._", tpl.starterPlans.map((p) => `### ${p}`).join("\n\n"))
         : PLANS_TEMPLATE;
-    write("PLANS.md", plansContent);
-    write("BUGS.md", BUGS_TEMPLATE);
-    write("QUESTIONS.md", QUESTIONS_TEMPLATE);
-    write("PRINCIPLES.md", PRINCIPLES_TEMPLATE);
+    writers.write("PLANS.md", plansContent);
+    writers.write("BUGS.md", BUGS_TEMPLATE);
+    writers.write("QUESTIONS.md", QUESTIONS_TEMPLATE);
+    writers.write("PRINCIPLES.md", PRINCIPLES_TEMPLATE);
+}
+/** The config seed and its fresh-project bootstrap; returns the seeded bootstrap count. */
+function seedConfigFile(root, fresh, dryRun, writers) {
     let bootstrap = null;
     if (fs.existsSync(configPath(root)))
-        leftAlone.push(CONFIG_BASENAME);
+        writers.leftAlone.push(CONFIG_BASENAME);
     else {
         const seed = seedConfig(root);
         if (fresh) {
@@ -310,26 +323,36 @@ async function seedProject(root, plan) {
         }
         if (!dryRun)
             saveConfig(root, seed);
-        created.push(CONFIG_BASENAME);
+        writers.created.push(CONFIG_BASENAME);
     }
+    return bootstrap;
+}
+/** The .gitignore edit: gain the missing lines, or record it as left alone. */
+function seedGitignore(root, dryRun, writers) {
     if (ensureGitignore(root, dryRun))
-        created.push(".gitignore");
+        writers.created.push(".gitignore");
     else if (fs.existsSync(path.join(root, ".gitignore")))
-        leftAlone.push(".gitignore");
+        writers.leftAlone.push(".gitignore");
+}
+/** The template's starter directories — empty ones only, before the first run. */
+function seedStarterDirs(root, tpl, writers) {
     // The template's starter directories: empty ones only, before the first run — the team's
     // own runs write any code. Existing directories are left alone, like existing files above.
     for (const dir of tpl.starterDirs) {
-        claim(dir, path.join(root, dir), () => ensureDir(path.join(root, dir)));
+        writers.claim(dir, path.join(root, dir), () => ensureDir(path.join(root, dir)));
     }
+}
+/** What gets committed: the committable filter and the `git add` / staged-check / commit. */
+async function commitSeeded(root, plan, withCommits, writers) {
     // The config stays out of the commit pathspec: `git add -- tumwater.json` fails on a path
     // the just-written .gitignore ignores (plans/portability.md §4a/7). It still heads the
     // `created …` line the CLI prints — the file WAS created, it just must not be tracked. When
     // that leaves the pathspec empty (`git add --` with no pathspec exits 1), there is nothing
     // to commit: a repo that only gained a config reports it and stays uncommitted.
-    const dirSet = new Set(tpl.starterDirs);
-    const committable = created.filter((name) => name !== CONFIG_BASENAME && !dirSet.has(name));
+    const dirSet = new Set(plan.tpl.starterDirs);
+    const committable = writers.created.filter((name) => name !== CONFIG_BASENAME && !dirSet.has(name));
     let committed = false;
-    if (!dryRun && committable.length > 0) {
+    if (!plan.dryRun && committable.length > 0) {
         await git(root, "add", "--", ...committable);
         const staged = await gitTry(root, "diff", "--cached", "--quiet");
         if (staged === null) {
@@ -339,7 +362,32 @@ async function seedProject(root, plan) {
             committed = true;
         }
     }
-    return { created, leftAlone, committed, repoInitialized, branch: createdBranch, bootstrap };
+    return committed;
+}
+/** Seed `root` from a resolved `InitPlan`: git init (a new repo only), every absent project
+ * file and starter directory, the config, and the commit. Holds the `created`/`leftAlone`
+ * bookkeeping locally; performs no validation and never refuses. Returns everything the
+ * composed `InitResult` needs except `adopted`, `dryRun` and `template`, which `initProject`
+ * reads off `plan`. */
+async function seedProject(root, plan) {
+    const { dryRun, tpl } = plan;
+    const { repoInitialized, createdBranch } = await initSeedRepo(root, plan);
+    const { withCommits, fresh } = await resolveSeedFreshness(root, plan);
+    const writers = seedWriters(root, dryRun);
+    seedBriefFile(root, plan, writers);
+    seedBacklogFiles(tpl, writers);
+    const bootstrap = seedConfigFile(root, fresh, dryRun, writers);
+    seedGitignore(root, dryRun, writers);
+    seedStarterDirs(root, tpl, writers);
+    const committed = await commitSeeded(root, plan, withCommits, writers);
+    return {
+        created: writers.created,
+        leftAlone: writers.leftAlone,
+        committed,
+        repoInitialized,
+        branch: createdBranch,
+        bootstrap,
+    };
 }
 /** Initialize a repo for tumwater: README (with prompt + status) when no project brief exists
  * yet, PLANS, BUGS, QUESTIONS, PRINCIPLES, tumwater.json, .gitignore — then commit whatever was

package/dist/src/merge/merge-backlog-conflicts.js

@@ -314,7 +314,7 @@ export async function resolveBacklogInsertConflicts(wt, files) {
         }
         // Atomic (tmp + rename): a merge process killed mid-write (SIGKILL, the timeout
         // group-kill) must leave either the conflicted file or the fully resolved one, never a
-        // truncated backlog — the CLI's backlog writers (backlog-write.ts, question-answer.ts)
+        // truncated backlog — the CLI's backlog writers (backlog-write.ts, backlog-question-answer.ts)
         // already write these unbounded-history files through this helper.
         writeTextAtomic(p, resolved);
         await git(wt, "add", "--", file);

package/dist/src/merge/merge-core.js

@@ -11,7 +11,7 @@ import { reviewAheadOfMain } from "../review/review.js";
 import { reviewRunConfig, modelSelectorField } from "../config/config-views.js";
 import { warnEventBestEffort, logEventBestEffort } from "../events/events.js";
 import { saveRunnerStateBestEffort } from "../runner/runner-state.js";
-import { REVISION_FINAL_ON_REPEAT, REVISION_BACKSTOP, holdEntryAfterExhaustion } from "../runner/revision.js";
+import { REVISION_FINAL_ON_REPEAT, REVISION_BACKSTOP, holdEntryAfterExhaustion } from "../runner/runner-revision.js";
 import { priorObjectionNumber } from "../review/review-verdict.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { shortSha } from "../text/format.js";

package/dist/src/merge/merge-drain.js

@@ -1,7 +1,6 @@
 import { mergeApproved } from "./merge-batch.js";
 import { removeMergeChange, resolveWaitStage, setMergeChangeStatus } from "./merge-slot.js";
-import { seamConcurrencyKey } from "../config/config-views.js";
-import { withProviderLease } from "../concurrency/provider-lease.js";
+import { withRunPermit } from "../concurrency/run-permit.js";
 import { dropMerge, entryRevisionFields, queuedMergeFiles } from "./merge-queue.js";
 import { errorMessage } from "../text/text.js";
 import { warnEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
@@ -123,22 +122,20 @@ function startMerge(ctx, p, picks) {
             runPi: async (w, prompt, s, cfg) => {
                 // A parked resolver names its wait (resolve-wait, then resolving once granted) the way
                 // a parked check does (withCheckPermit): on 2026-10-12 one waited 2.5 min for a permit
-                // with the merge queue behind it, reading as "merging". The lease is keyed on the
-                // resolver config's provider (the `cfg` it is handed), so the conflict resolution
-                // counts against the strong tier's provider cap like any other strong-tier run
+                // with the merge queue behind it, reading as "merging". The resolution waits on the
+                // one team total (maxConcurrent) like any other MERGE_TIER run
                 // (plans/provider-concurrency.md §4). canLeaseAtOnce is acquireLease's own fast path
                 // decided synchronously, so a free permit shows no wait; MERGE_TIER ignores the
                 // maintenance reserve.
-                const key = cfg ? seamConcurrencyKey(cfg, ctx.piDefault) : undefined;
                 const hooks = resolveWaitStage(root, v.entry.role);
-                if (!semaphore.canLeaseAtOnce(MERGE_TIER, key))
+                if (!semaphore.canLeaseAtOnce(MERGE_TIER))
                     hooks.waiting();
-                const lease = await semaphore.acquireLease(MERGE_TIER, key);
+                const lease = await semaphore.acquireLease(MERGE_TIER);
                 hooks.granted();
                 try {
-                    // The resolver's lease rides in the provider-lease store for its run, so the run
-                    // re-keys it to the provider it actually uses (plans/provider-concurrency.md §5).
-                    return await withProviderLease(lease, semaphore, () => v.author.runMergePi(w, prompt, s, cfg), { piDefault: ctx.piDefault });
+                    // The resolver's lease rides in the run-permit store for its run, so an idle
+                    // pause inside it (a failed review's in-place retry) re-takes the same permit.
+                    return await withRunPermit(lease, () => v.author.runMergePi(w, prompt, s, cfg));
                 }
                 finally {
                     lease.release();

package/dist/src/merge/merge-pipeline.js

@@ -43,15 +43,14 @@ export function guardMergeTask(root, role, promise) {
         warnEventBestEffort(root, TUMWATER_SOURCE, `merge task for ${role} could not settle: ${errorMessage(err)}`);
     });
 }
-/** Take a permit at `tier` (on `key` when given) unless `signal` fires first: resolves to its
- * release, or to null when the signal won — a grant that arrives after that is handed straight
- * back (a hop, never a leak), so a parked verification that a shutdown settles holds nothing. When
- * `key` is set the permit is a keyed lease, so the verification also counts against its provider's
- * cap (plans/provider-concurrency.md §4). */
-export async function acquireUnlessAborted(semaphore, tier, signal, key) {
+/** Take a permit at `tier` unless `signal` fires first: resolves to its release, or to null
+ * when the signal won — a grant that arrives after that is handed straight back (a hop, never a
+ * leak), so a parked verification that a shutdown settles holds nothing. A verification's
+ * permit is the one team total (`maxConcurrent`). */
+export async function acquireUnlessAborted(semaphore, tier, signal) {
     if (signal.aborted)
         return null;
-    const granted = semaphore.acquireLease(tier, key);
+    const granted = semaphore.acquireLease(tier);
     const stopped = new Promise((resolve) => signal.addEventListener("abort", () => resolve(false), { once: true }));
     if (await Promise.race([granted, stopped])) {
         return granted;

package/dist/src/merge/merge-post-review-drain.js

@@ -1,5 +1,4 @@
-import { withProviderLease } from "../concurrency/provider-lease.js";
-import { reviewRunConfig, seamConcurrencyKey } from "../config/config-views.js";
+import { withRunPermit } from "../concurrency/run-permit.js";
 import { subscribeEvents, warnEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { deleteRef, headOf, subjectOfCommit } from "../git/git.js";
 import { ensureDetachedWorktree } from "../git/worktree.js";
@@ -35,12 +34,11 @@ function startPostReview(ctx, p, entry) {
     const task = { promise: Promise.resolve(), controller: new AbortController(), roles: [], userAborted: false, parked: true };
     const detach = abortOnShutdown(ctx.signal, task.controller);
     const author = resolveAuthor(ctx, entry.role);
-    const key = seamConcurrencyKey(reviewRunConfig(ctx.liveConfig), ctx.piDefault);
     const run = (async () => {
         try {
-            if (!semaphore.canLeaseAtOnce(VERIFY_TIER, key))
+            if (!semaphore.canLeaseAtOnce(VERIFY_TIER))
                 return; // permits are busy; try again next poll
-            const lease = await acquireUnlessAborted(semaphore, VERIFY_TIER, task.controller.signal, key);
+            const lease = await acquireUnlessAborted(semaphore, VERIFY_TIER, task.controller.signal);
             task.parked = false;
             if (lease === null)
                 return;
@@ -125,19 +123,18 @@ async function fileDroppedReview(ctx, entry, failure) {
  * is never a throw. */
 async function mergeReviewerFix(ctx, entry, fix) {
     const author = resolveAuthor(ctx, entry.role);
-    // The fix merge's conflict resolver rides the same provider lease the merge slot's resolver
-    // does (merge-drain.ts startMerge): the MERGE_TIER lease is keyed on the resolver config's
-    // provider and rides in the provider-lease store, so a conflict resolution counts against the
-    // strong tier's cap like any other strong-tier run instead of acquiring a provider unchecked.
+    // The fix merge's conflict resolver rides the same team permit the merge slot's resolver
+    // does (merge-drain.ts startMerge): the MERGE_TIER lease is acquired on the one team total
+    // and rides in the run-permit store, so a conflict resolution counts against maxConcurrent
+    // like any other strong-tier run.
     const runPi = async (wt, prompt, sessionName, config) => {
-        const key = config ? seamConcurrencyKey(config, ctx.piDefault) : undefined;
         const hooks = resolveWaitStage(ctx.root, entry.role);
-        if (!ctx.semaphore.canLeaseAtOnce(MERGE_TIER, key))
+        if (!ctx.semaphore.canLeaseAtOnce(MERGE_TIER))
             hooks.waiting();
-        const lease = await ctx.semaphore.acquireLease(MERGE_TIER, key);
+        const lease = await ctx.semaphore.acquireLease(MERGE_TIER);
         hooks.granted();
         try {
-            return await withProviderLease(lease, ctx.semaphore, () => author.runMergePi(wt, prompt, sessionName, config), { piDefault: ctx.piDefault });
+            return await withRunPermit(lease, () => author.runMergePi(wt, prompt, sessionName, config));
         }
         finally {
             lease.release();

package/dist/src/merge/merge-requeue.js

@@ -6,7 +6,7 @@
  * retriable result) or once main's head stops being red (a `main_red` pin). */
 import { enqueueMerge, queuedMerges } from "./merge-queue.js";
 import { RETRIABLE_MERGE_RESULTS } from "./merge-core.js";
-import { pinnedRetrySha } from "../runner/leftover.js";
+import { pinnedRetrySha } from "../runner/runner-leftover.js";
 import { branchHead } from "../git/git.js";
 import { cachedBaselineVerdict } from "../baseline/main-baseline.js";
 import { saveRunnerStateBestEffort } from "../runner/runner-state.js";

package/dist/src/merge/merge-slot.js

@@ -192,14 +192,6 @@ export function checkWaitStage(root, roles) {
 export function resolveWaitStage(root, role) {
     return waitStageHooks(root, [role], "resolve-wait", "resolving");
 }
-/** The verification's hooks around a re-key onto a full provider (plans/provider-concurrency.md §5,
- * "A re-key wait is visible"): `provider-wait` while the verification's lease parks on the target
- * provider's full cap, `reviewing` once the key frees and the review proceeds. resolveWaitStage's
- * shape for the re-key path — a verification that normally shares its review seam never
- * re-keys, so the stage fires only when a run actually moves to a different, full provider. */
-export function providerWaitStage(root, role) {
-    return waitStageHooks(root, [role], "provider-wait", "reviewing");
-}
 /** The marker's per-change records, whichever shape it has: `changes` as written, or — for a
  * marker an older generation wrote with one top-level change — that change, `merging` since the
  * marker's start at the marker's stage. Reads both shapes into records, so addMergeChange's