tumwater 0.4.2 → 0.4.3

package/dist/src/orchestrator/orchestrator-poll.js

@@ -1,8 +1,7 @@
-import { publishInfoFields } from "../team/orchestrator-info.js";
+import { publishInfoFields } from "../team/team-orchestrator-info.js";
 import { baseRoleOf, runnerEnabled } from "../roles/runner-ids.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { reviewHoldKey, pollDeferralInputs, pollRunnerReasons } from "./orchestrator-scheduling.js";
-import { seamConcurrencyKey } from "../config/config-views.js";
 import { launchDueRuns } from "./orchestrator-launch.js";
 import { branchHead, currentBranch } from "../git/git.js";
 import { queuedMergeFiles, queuedMergeRoles } from "../merge/merge-queue.js";
@@ -15,11 +14,21 @@ import { checkPermitSnapshot } from "../concurrency/check-permit.js";
 import { slotPoolSnapshot } from "../git/worktree-pool.js";
 import { redeployTarget, watchVerifiesMain } from "../baseline/main-baseline.js";
 import { p75RunDurationMs } from "../run/run-timing.js";
+import { reapAttributableOrphans } from "../doctor/doctor-orphans.js";
 import { pollTeamGates } from "../gates/gate-polls.js";
 import { heldProviders, windowHeldProviders } from "../team/team-hold.js";
 import { workReserveCount } from "../scheduling/claims.js";
 export function newPollState() {
-    return { restart: false, holdForRestart: false, diskHeld: false, warnedBranchDivergence: false, lastReserve: 0 };
+    return { restart: false, holdForRestart: false, diskHeld: false, warnedBranchDivergence: false, lastReserve: 0, lastOrphanReapAt: 0 };
+}
+/** How often the orchestrator's poll loop stands down the orphan reap — a once-per-interval
+ * throttle so a slow process-table scan never runs on the busy per-poll hot path. */
+export const ORPHAN_REAP_INTERVAL_MS = 15 * 60 * 1000;
+/** Whether the orphan reap is due now, given the last poll it ran: true at and after
+ * `now >= last + intervalMs`. Purely a clock comparison so tests pin it from literal
+ * numbers. A fresh state's `last` of 0 is always due against a real `now`. */
+export function dueForOrphanReap(last, now, intervalMs = ORPHAN_REAP_INTERVAL_MS) {
+    return now - last >= intervalMs;
 }
 /** The start gate every reserved run passes the moment its permit is granted
  * (runTimedRoleRun's `held`): closed while a restart is pending, and after one is decided so
@@ -52,7 +61,7 @@ export async function pollRequestsAndWatch(ctx, state) {
     // src/config/config-live.ts owns the last-known-good retention and the edge-triggered
     // warnings/events around it.
     const liveConfig = ctx.liveReload.poll();
-    // The notify command rides the same last-known-good reload (src/events/notify.ts): a live
+    // The notify command rides the same last-known-good reload (src/events/event-notify.ts): a live
     // `config set notify` edit takes effect on the next poll, no restart.
     ctx.notifier.update(liveConfig);
     // Live session retention (the last restart-only setting): the edge-triggered
@@ -60,6 +69,15 @@ export async function pollRequestsAndWatch(ctx, state) {
     // src/orchestrator/retention.ts. The live config (last-known-good while the file is broken or
     // missing) drives the check, like the budget gate.
     ctx.retentionPruner.poll(root, liveConfig.sessionRetentionDays);
+    // The orphan reap (src/doctor/doctor-orphans.ts): at most once per interval, kill the
+    // orphans the doctor row already reports that are old enough to be certain a live run no
+    // longer owns them — the automatic counterpart to the human click `doctor
+    // --kill-orphans`/dashboard/TUI makes. The time is stamped before the await, so a slow
+    // scan cannot overlap the next poll's reap (and this await anyway holds the poll step).
+    if (dueForOrphanReap(state.lastOrphanReapAt, Date.now())) {
+        state.lastOrphanReapAt = Date.now();
+        await reapAttributableOrphans(root);
+    }
     // A missing or stale opencode catalog is refetched at most once an hour while opencode is routed.
     ctx.opencodeCatalogRefresh.poll(liveConfig);
     // launchservicesd's Mach-port budget (src/process/launch-services.ts owns it):
@@ -119,9 +137,8 @@ export function pollGatesAndHolds(ctx, state, { liveConfig, now }) {
     state.diskHeld = gates.diskHeld;
     // Publish the permit pool's live state (plans/provider-concurrency.md §8): observers
     // (status, TUI, GUI) read one file instead of coupling to this Semaphore, and the team
-    // line shows per-provider counts only while a cap map is configured. Written only when
-    // it changes, like budget and disk; a map-less team publishes `byKey` empty, which
-    // renders exactly as before. The check-permit pool rides along, so status can show checks
+    // line shows the team total. Written only when it changes, like budget and disk. The
+    // check-permit pool rides along, so status can show checks
     // running and waiting while merges stall. The workspace pool's live state rides along too:
     // one small slots.json read per poll, and publishInfoFields rewrites the info file only
     // when a value changed.
@@ -150,7 +167,7 @@ export function pollGatesAndHolds(ctx, state, { liveConfig, now }) {
         teamHeldNow,
         reviewHeldNow: () => liveConfig.review.enabled && teamHeldNow().has(reviewSeamKey),
         reviewHeld: liveConfig.review.enabled && teamHeldProviders.has(reviewSeamKey),
-        roleProviders: new Map(runners.map((r) => [r.role, r.runProvider(now)])),
+        roleProviders: new Map(runners.map((r) => [r.role, r.runProvider()])),
     };
 }
 /** Self-redeploy (src/redeploy/redeployer.ts): with main's head in hand, let the state
@@ -222,8 +239,7 @@ export async function pollMergeDrain(ctx, state, { liveConfig, mainHead }, gates
         runners: ctx.runners,
         liveConfig,
         roleConfig: gates.roleConfig,
-        directorConfig: gates.directorConfig,
-        piDefault: ctx.piDefault,
+        directorConfig: liveConfig,
         startHeld: (role) => mergeStartHeld(runStartHeld(state), gates.reviewHeldNow(), afterMergeRoles, role),
     }, ctx.merges);
 }
@@ -280,9 +296,7 @@ export async function pollSchedule(ctx, state, { liveConfig, mainHead, now }, ga
         probePair: inputs.probePair,
         probeRoles: inputs.probeRoles,
         budgetActive: gates.budgetActive,
-        windowMovedRoles: gates.windowMovedRoles,
         semaphore: ctx.semaphore,
-        piDefault: ctx.piDefault,
         rolePermitHolders: ctx.rolePermitHolders,
         roleInFlight: ctx.roleInFlight,
         directorInFlight: ctx.directorInFlight,
@@ -296,36 +310,17 @@ export async function pollSchedule(ctx, state, { liveConfig, mainHead, now }, ga
 }
 /** Priority headroom, then once mode's exit; returns whether the loop should stop. Writes
  * state.lastReserve and, in once mode, fires internalStop. */
-export function pollReserveAndExit(ctx, state, { liveConfig, now }) {
+export function pollReserveAndExit(ctx, state, { liveConfig }) {
     const { root, runners, semaphore } = ctx;
     // Priority headroom (plans/parallel-work-instances.md part 7/7): withhold a few permits
     // from maintenance while a work role has work to take, so a due work run never waits out
     // a whole maintenance run. Sized after the launch pass, so a runner launched this poll
     // already reads as running and reserves nothing for itself.
-    const poolSnapshot = semaphore.snapshot();
-    // The provider-headroom predicate receives the structural ClaimRunner; the config that
-    // names the provider lives on the real RoleRunners, so look the runner up by role.
-    const runnerByRole = new Map(runners.map((r) => [r.role, r]));
     const reserve = workReserveCount(root, runners, {
         maxConcurrent: liveConfig.maxConcurrent,
         enabled: new Set(runners.filter((r) => runnerEnabled(r.config, r.role)).map((r) => r.role)),
         queuedMergeRoles: queuedMergeRoles(root),
         instancesOf: (base) => liveConfig.roles[base]?.instances ?? 1,
-        // Per-provider headroom (plans/provider-concurrency.md §6): an idle work role reserves a
-        // permit only when its own provider could use it — capped and full, it would only idle
-        // the slot another provider's maintenance run could take. Read from the pool's live
-        // snapshot; an uncapped key (or the team-total-only case) always has headroom.
-        providerHasHeadroom: (r) => {
-            const runner = runnerByRole.get(r.role);
-            const cfg = runner && runner.role !== DIRECTOR_ROLE ? runner.runConfig(now) : null;
-            const key = cfg ? seamConcurrencyKey(cfg, ctx.piDefault) : undefined;
-            if (key === undefined)
-                return true;
-            const k = poolSnapshot.byKey[key];
-            if (k?.limit === undefined)
-                return true;
-            return k.inUse < k.limit;
-        },
     });
     semaphore.setReserve(reserve);
     if ((state.lastReserve === 0) !== (reserve === 0)) {

package/dist/src/orchestrator/orchestrator.js

@@ -1,4 +1,4 @@
-import { readOrchestratorInfo, writeOrchestratorInfo } from "../team/orchestrator-info.js";
+import { readOrchestratorInfo, writeOrchestratorInfo } from "../team/team-orchestrator-info.js";
 import { runnerIds } from "../roles/runner-ids.js";
 import { newLiveConfigReload } from "../config/config-live.js";
 import { FALLBACK_BREAKER_POLICY, } from "../budget/fallback-breaker.js";
@@ -10,20 +10,18 @@ import { mergeTasks, newMergePipeline } from "../merge/merge-pipeline.js";
 import { bestEffortEventLogger, logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { removeQuiet } from "../files/files.js";
 import { OnceRound } from "../scheduling/once-round.js";
-import { newNotifier } from "../events/notify.js";
+import { newNotifier } from "../events/event-notify.js";
 import { piModelsPath } from "../pi/pi-models.js";
-import { piSettingsPath, readPiDefaultModel } from "../pi/pi-settings.js";
 import { Semaphore } from "../concurrency/semaphore.js";
 import { orchestratorStatePath } from "../paths.js";
 import { createMainWatch } from "../baseline/main-watch.js";
 import { queueCulpritHeal } from "../baseline/main-red.js";
 import { RetentionPruner } from "./retention.js";
-import { newOpencodeCatalogRefresh } from "../gates/startup-gate.js";
+import { newOpencodeCatalogRefresh } from "../gates/startup-gates.js";
 import { WorkMergedCache } from "../scheduling/work-merged-cache.js";
 import { drainInFlightWork, HANDOFF_MERGE_WINDOW_MS, sleepInterruptible, } from "../run/run-timing.js";
 import { newTeamGateStates } from "../gates/gate-polls.js";
-import { loggedWindowKeys } from "../team/team-polls.js";
-import { ReclaimController } from "../team/reclaim.js";
+import { ReclaimController } from "../team/team-reclaim.js";
 import { reapPreviousTeamOrphans } from "../doctor/doctor-orphans.js";
 import { runStartupMigrations } from "./startup-migration-steps.js";
 import { archiveAtTeamStart } from "../backlog/backlog-archive.js";
@@ -34,9 +32,6 @@ export async function runOrchestrator(opts) {
     const { root, config, mainBranch, signal: externalSignal } = opts;
     const pollMs = opts.pollMs ?? POLL_MS;
     const modelsPath = opts.modelsPath ?? piModelsPath();
-    // pi's saved default model — the same stat-cached read status-roles.ts makes — used as the
-    // fallback provider key for a pi seam that names no model (plans/provider-concurrency.md §2).
-    const piDefault = readPiDefaultModel(piSettingsPath(modelsPath), root);
     const breakerPolicy = opts.fallbackBreakerPolicy ?? FALLBACK_BREAKER_POLICY;
     const breakerNow = opts.breakerNow ?? Date.now;
     // Parallel work instances (part 5b/7): the runner list is every runner id the config enables
@@ -77,10 +72,6 @@ export async function runOrchestrator(opts) {
     // resolver — merge-drain.ts) all hold a permit; see its MergePipelineContext for why a
     // merge is not exempt.
     const semaphore = new Semaphore(Math.max(1, config.maxConcurrent));
-    // Seed the pool's per-provider caps from the startup config (plans/provider-concurrency.md
-    // §7): a role run's lease is bounded by its provider key from the first launch onward, not
-    // just after a live edit. A config without the key passes an empty map, the no-change case.
-    semaphore.setKeyCaps(config.maxConcurrentPerProvider ?? {});
     const infoFile = orchestratorStatePath(root);
     const info = { pid: process.pid, startedAt: Date.now(), roles: enabled };
     if (redeploy)
@@ -174,9 +165,6 @@ export async function runOrchestrator(opts) {
     // the start gate reads gateStates.teamHold at permit time, so its closures always see
     // the latest poll's hold verdict rather than the poll that created them.
     const gateStates = newTeamGateStates(config);
-    // A restart must not re-announce a window that is still open.
-    gateStates.claudeWindowWarned = loggedWindowKeys(root, "subscription_window_warning", Date.now());
-    gateStates.claudeWindowReserved = loggedWindowKeys(root, "subscription_window_reserved", Date.now());
     // The live config the last successful reload produced (last-known-good while the file is
     // broken or missing). The reload bookkeeping itself lives in src/config/config-live.ts.
     const liveReload = newLiveConfigReload({ root, config, mainBranch, runnerSignal: roleSignal, runners, semaphore, roleFilter: opts.roleFilter });
@@ -194,10 +182,10 @@ export async function runOrchestrator(opts) {
     // logs exactly once — on the transition in, never while merely not-due and never on exit.
     // In-memory only: a restart mid-episode can re-log at most one event.
     const deferredDue = new Map();
-    // The operator notify hook (src/events/notify.ts owns the whole concern): one configured shell
-    // command run on notable events (budget_paused, role_streak_paused, merge_failed,
-    // restart_blocked). Subscribed here so it sees every event this process logs from start;
-    // disposed beside the orchestrator_stop event below.
+    // The operator notify hook (src/events/event-notify.ts owns the whole concern): one
+    // configured shell command run on notable events (budget_paused, role_streak_paused,
+    // merge_failed, restart_blocked). Subscribed here so it sees every event this
+    // process logs from start; disposed beside the orchestrator_stop event below.
     const notifier = newNotifier(root);
     // Best-effort event logging in the poll loop (bestEffortEventLogger, events.ts): this loop
     // and its finally run with no catch, so an unwritable feed (ENOSPC, EACCES, the path replaced
@@ -221,7 +209,6 @@ export async function runOrchestrator(opts) {
         once,
         info,
         modelsPath,
-        piDefault,
         redeploy,
         launchServicesWatch,
         reclaim,

package/dist/src/orchestrator/scheduling-admit.js

@@ -19,52 +19,73 @@ import { noteSkip } from "./scheduling-scope.js";
  * runner's claim/heldElsewhere state, the claim group's held set, and once-mode settlement on
  * the skip paths. */
 export function admitRunner(scope, runner, reason) {
-    // Parallel work instances (part 4/7): a multi-runner base role's claim assignment, after
-    // every gate has admitted this runner. A runner that already holds a claim proceeds — its
-    // revision, resume or retry is the same entry. An unclaimed runner with outstanding work
-    // (a revision) is the mid-entry runner the group hold waits on: it proceeds unassigned —
-    // holding it too would deadlock the whole group, since only its run can settle the hold.
-    // Otherwise, when the run is not an inbox/resume run, it takes the first free entry; an
-    // extra instance with none free is skipped without touching its backoff, and the primary
-    // stands down too while siblings hold every eligible entry, unless an operator wake is fresh
-    // (then it runs unassigned).
-    // Stand-down: the feature charter says "If PLANS.md is empty or everything is done, there is
-    // nothing to do" and the bugfix charter says "when every open entry carries [a Refused note],
-    // there is nothing to do", so a feature runner (primary included) with no eligible plan at all,
-    // or a bugfix runner whose open bugs are all held (no open bugs at all is search mode, which
-    // still runs), skips its scheduled and main-moved runs instead of paying a model run that
-    // can only end in
-    // nothing-to-do. Startup, inbox and resume runs, a fresh operator wake, and a runner with a
-    // claim or outstanding work still run. nextRunAt and backoff stay put, so the first poll
-    // after a plan turns eligible starts a run for it.
-    const standDownBase = baseRoleOf(runner.role);
-    if ((standDownBase === "feature" || (standDownBase === BUGFIX_ROLE && scope.openBugsNow)) &&
+    if (standDownForNoWork(scope, runner, reason))
+        return "skipped";
+    return claimGroupAdmission(scope, runner, reason);
+}
+/** The candidate half of the stand-down test: true when a feature runner, or a bugfix runner
+ * whose open bugs are non-empty (no open bugs at all is search mode, which still runs), is due
+ * a scheduled or main-moved run, is not freshly woken, and holds no claim or outstanding work —
+ * so startup, inbox and resume runs, a fresh operator wake, and a claimed or mid-entry runner
+ * all pass through. The caller stands the runner down only when this holds and no entry is
+ * eligible. */
+function noWorkScheduledRun(scope, runner, reason) {
+    const base = baseRoleOf(runner.role);
+    return ((base === "feature" || (base === BUGFIX_ROLE && scope.openBugsNow)) &&
         (reason === "scheduled" || reason === "main moved") &&
         !freshlyWoken(runner.state) &&
         runner.state.claim === undefined &&
-        !hasOutstandingWork(runner.state)) {
-        let eligible = scope.eligibleMemo.get(standDownBase);
-        if (eligible === undefined) {
-            eligible =
-                scope.claimGroups.get(standDownBase)?.eligible ??
-                    eligibleEntries(scope.root, standDownBase);
-            scope.eligibleMemo.set(standDownBase, eligible);
-        }
-        if (eligible.length === 0) {
-            noteSkip(scope.root, runner, "no-free-entry");
-            runner.state.heldElsewhere = undefined;
-            if (scope.once.active)
-                scope.once.settle(runner.role, "no free entry");
-            return "skipped";
-        }
+        !hasOutstandingWork(runner.state));
+}
+/** The eligible-entries list for a base role, computed once per poll and memoized on the
+ * scope so the stand-down and claim-group paths share it. */
+function eligibleForBase(scope, base) {
+    let eligible = scope.eligibleMemo.get(base);
+    if (eligible === undefined) {
+        eligible =
+            scope.claimGroups.get(base)?.eligible ?? eligibleEntries(scope.root, base);
+        scope.eligibleMemo.set(base, eligible);
     }
+    return eligible;
+}
+/** Stand down a runner with no eligible entry at all on its scheduled and main-moved runs: the
+ * feature charter says "If PLANS.md is empty or everything is done, there is nothing to do" and
+ * the bugfix charter says "when every open entry carries [a Refused note], there is nothing to
+ * do", so a feature runner (primary included) with no eligible plan at all, or a bugfix runner
+ * whose open bugs are all held (no open bugs at all is search mode, which still runs), skips
+ * its scheduled and main-moved runs instead of paying a model run that can only end in
+ * nothing-to-do. nextRunAt and backoff stay put, so the first poll after a plan turns eligible
+ * starts a run for it. */
+function standDownForNoWork(scope, runner, reason) {
+    if (!noWorkScheduledRun(scope, runner, reason))
+        return false;
+    if (eligibleForBase(scope, baseRoleOf(runner.role)).length > 0)
+        return false;
+    noteSkip(scope.root, runner, "no-free-entry");
+    runner.state.heldElsewhere = undefined;
+    if (scope.once.active)
+        scope.once.settle(runner.role, "no free entry");
+    return true;
+}
+/** Parallel work instances (part 4/7): a multi-runner base role's claim assignment, after
+ * every gate has admitted this runner. A runner that already holds a claim proceeds — its
+ * revision, resume or retry is the same entry. An unclaimed runner with outstanding work
+ * (a revision) is the mid-entry runner the group hold waits on: it proceeds unassigned —
+ * holding it too would deadlock the whole group, since only its run can settle the hold.
+ * Otherwise, when the run is not an inbox/resume run, it takes the first free entry; an
+ * extra instance with none free is skipped without touching its backoff, and the primary
+ * stands down too while siblings hold every eligible entry, unless an operator wake is fresh
+ * (then it runs unassigned). */
+function claimGroupAdmission(scope, runner, reason) {
     const claimGroup = scope.claimGroups.get(baseRoleOf(runner.role));
     if (claimGroup) {
         if (runner.state.claim) {
             // keeps its claim
+            return "admitted";
         }
         else if (hasOutstandingWork(runner.state)) {
             // finishes its own unrecorded entry
+            return "admitted";
         }
         else if (reason !== "inbox" && reason !== "resume") {
             // The group holds an unclaimed mid-entry sibling: assign nothing this poll, or a
@@ -74,39 +95,7 @@ export function admitRunner(scope, runner, reason) {
                 noteSkip(scope.root, runner, "claim-hold");
                 return "skipped";
             }
-            const free = claimGroup.eligible.filter((e) => !claimGroup.held.has(e.key));
-            const pick = assignNext(free);
-            // An unassigned runner is told which entries its siblings hold (cleared when none).
-            const heldTitles = claimGroup.eligible
-                .filter((e) => claimGroup.held.has(e.key))
-                .map((e) => e.title);
-            runner.state.heldElsewhere = !pick && heldTitles.length > 0 ? heldTitles : undefined;
-            if (pick) {
-                runner.state.claim = {
-                    file: baseRoleOf(runner.role) === BUGFIX_ROLE ? "BUGS.md" : "PLANS.md",
-                    key: pick.key,
-                    title: pick.title,
-                    at: scope.now,
-                    source: "assigned",
-                };
-                claimGroup.held.add(pick.key);
-                logEventBestEffort(scope.root, {
-                    source: runner.role,
-                    type: "claim",
-                    action: "assigned",
-                    key: pick.key,
-                    title: pick.title,
-                });
-            }
-            else if (instanceIndex(runner.role) >= 2 ||
-                (heldTitles.length > 0 && !freshlyWoken(runner.state))) {
-                // An idle extra instance, or a primary whose eligible entries siblings all hold
-                // (unless an operator wake is fresh): no run, no backoff climb.
-                noteSkip(scope.root, runner, "no-free-entry");
-                if (scope.once.active)
-                    scope.once.settle(runner.role, "no free entry");
-                return "skipped";
-            }
+            return assignClaim(scope, runner, claimGroup.eligible, claimGroup.held);
         }
     }
     else {
@@ -114,3 +103,47 @@ export function admitRunner(scope, runner, reason) {
     }
     return "admitted";
 }
+/** Assign the first free eligible entry to an unclaimed admitted runner: record the claim on
+ * the runner, add it to the group's held set, and log the assignment. With no free entry, an
+ * idle extra instance, or a primary whose eligible entries siblings all hold (unless an
+ * operator wake is fresh), stands down rather than run unassigned. */
+function assignClaim(scope, runner, eligible, held) {
+    const free = eligible.filter((e) => !held.has(e.key));
+    const pick = assignNext(free);
+    // An unassigned runner is told which entries its siblings hold (cleared when none).
+    const heldTitles = eligible.filter((e) => held.has(e.key)).map((e) => e.title);
+    runner.state.heldElsewhere = !pick && heldTitles.length > 0 ? heldTitles : undefined;
+    if (pick) {
+        recordAssignedClaim(scope, runner, pick, held);
+        return "admitted";
+    }
+    else if (instanceIndex(runner.role) >= 2 ||
+        (heldTitles.length > 0 && !freshlyWoken(runner.state))) {
+        // An idle extra instance, or a primary whose eligible entries siblings all hold
+        // (unless an operator wake is fresh): no run, no backoff climb.
+        noteSkip(scope.root, runner, "no-free-entry");
+        if (scope.once.active)
+            scope.once.settle(runner.role, "no free entry");
+        return "skipped";
+    }
+    return "admitted";
+}
+/** Build the runner's claim record, add the picked entry to the group's held set, and log the
+ * assignment to the events feed. */
+function recordAssignedClaim(scope, runner, pick, held) {
+    runner.state.claim = {
+        file: baseRoleOf(runner.role) === BUGFIX_ROLE ? "BUGS.md" : "PLANS.md",
+        key: pick.key,
+        title: pick.title,
+        at: scope.now,
+        source: "assigned",
+    };
+    held.add(pick.key);
+    logEventBestEffort(scope.root, {
+        source: runner.role,
+        type: "claim",
+        action: "assigned",
+        key: pick.key,
+        title: pick.title,
+    });
+}

package/dist/src/orchestrator/scheduling-scope.js

@@ -13,7 +13,7 @@ import { readMergeMarker, mergeChanges } from "../merge/merge-slot.js";
 import { isAfterMergeRole } from "../review/post-merge-review.js";
 import { aheadOfMainBranch, branchExists } from "../git/git.js";
 import { branchName } from "../paths.js";
-import { hasUnmergedPin } from "../runner/leftover.js";
+import { hasUnmergedPin } from "../runner/runner-leftover.js";
 import { logEventBestEffort, warnEventBestEffort } from "../events/events.js";
 import { eligibleEntries } from "../backlog/backlog-eligibility.js";
 import { CLAIM_IDLE_MAX_MS, claimReleaseReason, heldKeys, listedKeys, } from "../scheduling/claims.js";

package/dist/src/orchestrator/scheduling-skip.js

@@ -5,7 +5,7 @@ import { isAfterMergeRole } from "../review/post-merge-review.js";
 import { deferRunReason, isEligible } from "../scheduling/scheduling.js";
 import { inboxSize } from "../inbox/inbox.js";
 import { freshlyWoken } from "../runner/runner-state.js";
-import { MERGE_CONFLICT_LIMIT } from "../runner/leftover.js";
+import { MERGE_CONFLICT_LIMIT } from "../runner/runner-leftover.js";
 import { noteSkip } from "./scheduling-scope.js";
 /** Decide whether this runner is due this poll, running every skip gate and the once/deferral
  * bookkeeping against scheduling-scope.ts's scope. Returns skip:true when a gate declined the

package/dist/src/orchestrator/startup-migrations.js

@@ -1,5 +1,5 @@
 import { logEvent, TUMWATER_SOURCE, warnEventBestEffort } from "../events/events.js";
-import { orchestratorAlive } from "../team/orchestrator-info.js";
+import { orchestratorAlive } from "../team/team-orchestrator-info.js";
 import { errorMessage } from "../text/text.js";
 const registry = [];
 /** Append one step to the registry; a duplicate name throws. */

package/dist/src/paths.js

@@ -36,7 +36,8 @@ export function configLockPath(root) {
 }
 /** The cross-process lock serializing writes to the primary checkout's tracked backlog files:
  * `tumwater bug`/`plan` (backlog-write.ts's appendEntry) and `tumwater questions answer`
- * (backlog/question-answer.ts's tryAnswerQuestion) each read a whole backlog file and rewrite
+ * (src/backlog/backlog-question-answer.ts's tryAnswerQuestion) each read a whole backlog file and
+ * rewrite
  * it, while a merge's working-tree fast-forward (merge-git.ts's ffMainTo) updates those
  * same files in
  * the same checkout by `git merge --ff-only`. Without a shared lock the CLI's stale read can
@@ -119,7 +120,7 @@ export function worktreeUseLockPath(root) {
     return path.join(tumwaterDir(root), "state", "worktree-use.lock");
 }
 /** The orchestrator's own info file (its pid, for liveness checks —
- * team/orchestrator-info.ts). */
+ * team/team-orchestrator-info.ts). */
 export function orchestratorStatePath(root) {
     return path.join(tumwaterDir(root), "state", "orchestrator.json");
 }
@@ -286,7 +287,7 @@ export function piLogPath(root, role) {
 /** A role's backend-native stdout log (.tumwater/log/<role>.<backend>.native.jsonl), written
  * beside the canonical raw log and kept for debugging only: no reader folds it, and the backend
  * is in the name because one role's runs may switch backends and the two dialects must not
- * mix. Written and rotated like the raw log (src/agent/run-agent.ts). */
+ * mix. Written and rotated like the raw log (src/agent/agent-run.ts). */
 export function nativeLogPath(root, role, backend) {
     return path.join(tumwaterDir(root), "log", `${role}.${backend}.native.jsonl`);
 }
@@ -307,7 +308,7 @@ export function sessionDir(root, role) {
     return path.join(sessionsRootDir(root), role);
 }
 /** `sessionDir`'s real team root — the nearest ancestor holding a `.tumwater` directory — or
- * undefined when none does. run-spawn installs the notes shim from THIS (never from teamRootOf,
+ * undefined when none does. agent-spawn installs the notes shim from THIS (never from teamRootOf,
  * whose no-ancestor fallback can be a shared directory): writing `.tumwater` at the fallback
  * would mint a phantom harness root every other suite on the host then found — BUGS.md
  * 2026-10-18's `$TMPDIR/.tumwater/bin/tumwater-notes`. */
@@ -341,15 +342,15 @@ export function owningTeamRoot(dir) {
  * unreachable in a harness run and used only by OpenCode's harness-only read-back lookups
  * (opencodeDbPath, loadConfigSafe), which always see a real root. Never use this to decide
  * where to WRITE a `.tumwater`: the fallback can be a shared directory, and creating `.tumwater`
- * there mints a phantom root (BUGS.md 2026-10-18); run-spawn's shim install uses
+ * there mints a phantom root (BUGS.md 2026-10-18); agent-spawn's shim install uses
  * nearestTumwaterRoot instead. Moved here from the opencode adapter (plans/notes-command.md) so
- * run-spawn's shim install — which every backend's run needs — shares the one lookup instead of
+ * agent-spawn's shim install — which every backend's run needs — shares the one lookup instead of
  * the opencode adapter keeping it private. */
 export function teamRootOf(sessionDir) {
     return nearestTumwaterRoot(sessionDir) ?? path.dirname(path.dirname(sessionDir));
 }
 /** The directory the notes shim lands in, under a team root: `<root>/.tumwater/bin`.
- * run-spawn installs the `tumwater-notes` command there (src/agent/notes-shim.ts) and
+ * agent-spawn installs the `tumwater-notes` command there (src/agent/notes-shim.ts) and
  * run-marker's backendBaseEnv prepends it to every run's PATH, so a run on any backend finds
  * the command (plans/notes-command.md "Reaching it from a run"). */
 export function notesShimDir(root) {

package/dist/src/pi/pi-args.js

@@ -1,6 +1,6 @@
 /** Building the pi command line for one run — pure argv construction with no subprocess or
  * file I/O. Split out of pi.ts; the child-process integration (runPi) now lives in
- * src/agent/run-agent.ts and the run's result types in src/pi/pi-run-result.ts, while
+ * src/agent/agent-run.ts and the run's result types in src/pi/pi-run-result.ts, while
  * test/pi-args.test.ts pins how config and session choices shape the command line. */
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -10,7 +10,9 @@ import { fileURLToPath } from "node:url";
  * context-budget appends its context-usage note to the (already bounded) result that crosses a
  * threshold, strip-thinking drops the model's replayed thinking from each request on a
  * small-window chat-completions model, trim-system-prompt drops pi's docs section from the
- * system prompt, and write-guard refuses an edit or write outside the run's worktree. Notes ride
+ * system prompt, and write-guard refuses an edit or write outside the run's worktree, while
+ * kill-guard refuses a bash call that kills processes by pattern (pkill/killall and ps/pgrep fed
+ * into kill). Notes ride
  * the `tumwater-notes` command on
  * every backend from part 2/4 on, so the role-notes extension is no longer bundled. */
 export function bundledExtensionPaths() {
@@ -21,6 +23,7 @@ export function bundledExtensionPaths() {
         "strip-thinking.js",
         "trim-system-prompt.js",
         "write-guard.js",
+        "kill-guard.js",
     ].map((file) => fileURLToPath(new URL(`../pi-extension/${file}`, import.meta.url)));
 }
 /** pi 1.2.0's built-in extensions other than `mcp`, read from pi's own `dist/extensions/index.js`.

package/dist/src/pi/pi-backend.js

@@ -1,8 +1,8 @@
 /** The pi adapter for the agent seam (plans/agent-backends.md "The seam"). Every piece here
  * is today's pi-specific behavior moved behind the `AgentBackend` interface — argv via
  * pi-args, the identity translator (pi's event vocabulary IS the canonical stream), the
- * stderr exit rules, and the model-fallback-clone warning — so src/agent/run-agent.ts stays
- * backend-neutral. The claude adapter registers alongside it in src/agent/run-agent.ts. */
+ * stderr exit rules, and the model-fallback-clone warning — so src/agent/agent-run.ts stays
+ * backend-neutral. The claude adapter registers alongside it in src/agent/agent-run.ts. */
 import { piArgs } from "./pi-args.js";
 import { resolveBinForBackend } from "./pi-bin.js";
 import { backendRunEnv } from "../process/run-marker.js";

package/dist/src/pi/pi-bin.js

@@ -5,8 +5,8 @@ import { envPath, findOnPath, isExecutableFile } from "../files/files.js";
  * resolution `TUMWATER_<ID>_BIN` → `backends.<id>.bin` (pi's legacy `agentBin` alias) → the
  * backends' defaults (plans/agent-backends.md "Config"; plans/portability.md §5/7), the
  * executability rule the preflight askers share, and the missing-binary wording they quote.
- * The spawn (src/agent/run-spawn.ts) resolves through each backend's resolveBin; the startup
- * gate (gates/startup-gate.ts) walks every enabled seam's backend through the same resolution and
+ * The spawn (src/agent/agent-spawn.ts) resolves through each backend's resolveBin; the startup
+ * gate (gates/startup-gates.ts) walks every enabled seam's backend through the same resolution and
  * executability rule, and doctor (doctor/doctor-checks.ts) asks them for every backend in use
  * (backendsInUse, the startup gate's rule). Each surface quotes this module's wording, so the
  * executability verdict and the pi text cannot drift between them. Split out of
@@ -15,7 +15,7 @@ import { envPath, findOnPath, isExecutableFile } from "../files/files.js";
  * layer. */
 const PI_MISSING_MESSAGE = "pi not found on PATH — install it (https://github.com/badlogic/pi-mono) or add its bin directory to your PATH";
 /** The operator-facing name of each source, as it appears in failure text and doctor's
- * report. Exported so src/agent/run-settle.ts's spawn errors and doctor's checks quote the same
+ * report. Exported so src/agent/agent-settle.ts's spawn errors and doctor's checks quote the same
  * string. `binEnv` is the environment variable a backend reads (pi's TUMWATER_PI_BIN by
  * default; claude's adapter passes TUMWATER_CLAUDE_BIN), and `configKey` is the tumwater.json
  * key the "config" source names (pi's legacy `agentBin`, or `backends.<id>.bin`), so a claude

package/dist/src/pi/pi-event-line.js

@@ -1,6 +1,6 @@
 /** Parsing one line of pi's JSONL event stream — pure string functions with no subprocess or file
  * I/O. Split out of pi.ts, whose child-process integration (runPi) now lives in
- * src/agent/run-agent.ts and whose PiStreamParser in pi-stream.ts folds those lines into a run
+ * src/agent/agent-run.ts and whose PiStreamParser in pi-stream.ts folds those lines into a run
  * result — because these are shared
  * by every observer that folds raw pi log lines into per-type state (src/ui/progress-data.ts's live
  * tail, transcript.ts's renderer), and those display modules should not import from the subprocess