tumwater 0.4.2 → 0.4.3

package/dist/src/run/run-stage.js

@@ -3,7 +3,7 @@ import { changedFiles } from "../git/git-diff.js";
 import { buildCommitMessage, commitTrailer, extractCommitBody, extractSummary, summaryOverCap, fallbackSummary, formatCommitBody, appendSelfCheckNotes, stampedSubject, } from "../git/commit-message.js";
 import { logEventBestEffort } from "../events/events.js";
 import { enqueueMerge, entryRevisionFields, queuedMerges } from "../merge/merge-queue.js";
-import { hasUnmergedPin } from "../runner/leftover.js";
+import { hasUnmergedPin } from "../runner/runner-leftover.js";
 import { plural } from "../text/phrases.js";
 import { squash } from "../text/text.js";
 import { recordDismissedFiling, recordDismissedFlow } from "./run-dismiss.js";
@@ -56,75 +56,114 @@ function revisionFields(ctx) {
         : undefined;
     return { revisionRound, priorReview };
 }
+/** The bounded follow-up turn both recovery paths share: fold the follow-up's commits past the
+ * head it started from, and end the run aborted (returning the outcome to surface) when the
+ * follow-up aborted, else hand back the follow-up run. */
+async function requestSummaryFollowUp(ctx, over) {
+    const base = await headOf(ctx.wt, "HEAD");
+    const followUp = await ctx.requestSummary(ctx.wt, over);
+    await foldAgentCommitsSince(ctx, ctx.wt, base);
+    if (followUp?.aborted)
+        return { aborted: await ctx.finishAbortedRun() };
+    return { followUp };
+}
+/** Recover a summary when the reply left none: take the shared follow-up turn, refill `pending`
+ * from it, fall back to the changed paths when it still yields none, and warn about the recovery.
+ * Returns an outcome only when the follow-up aborted, else `undefined`. */
+async function recoverMissingSummary(ctx, pending) {
+    const result = await requestSummaryFollowUp(ctx);
+    if ("aborted" in result)
+        return result.aborted;
+    const followUp = result.followUp;
+    if (followUp) {
+        pending.summary = extractSummary(followUp.finalText);
+        pending.body = pending.body ?? extractCommitBody(followUp.finalText);
+    }
+    if (pending.summary === null) {
+        pending.summary = fallbackSummary(await changedFiles(ctx.wt), ctx.role, ctx.state.runs);
+        pending.summaryDerived = true;
+    }
+    ctx.warn(missingSummaryWarning(followUp, pending.summary));
+    return undefined;
+}
+/** The missing-SUMMARY warning's four-way wording: "recovered it with a follow-up turn", or the
+ * derived-subject variants naming the follow-up's failure or absence. */
+function missingSummaryWarning(followUp, summary) {
+    return (`reply had no SUMMARY line — ` +
+        (followUp && extractSummary(followUp.finalText) !== null
+            ? "recovered it with a follow-up turn"
+            : followUp && !followUp.ok
+                ? `the follow-up run failed (${followUp.errorMessage || "no error message"}); ` +
+                    `subject derived from the changed files: "${summary}"`
+                : followUp
+                    ? `follow-up gave none; subject derived from the changed files: "${summary}"`
+                    : `no follow-up session was available; subject derived from the changed files: "${summary}"`));
+}
+/** Shorten a SUMMARY the cap would cut mid-word: take the shared follow-up turn asking for it
+ * restated short, keep the restated subject when it fits, and warn. Returns an outcome only when
+ * the follow-up aborted, else `undefined`. */
+async function shortenOverCapSummary(ctx, pending) {
+    const over = summaryOverCap(ctx.finalText);
+    if (over === null)
+        return undefined;
+    // A SUMMARY the cap would cut mid-word gets one follow-up turn asking for it restated short.
+    const result = await requestSummaryFollowUp(ctx, over);
+    if ("aborted" in result)
+        return result.aborted;
+    const followUp = result.followUp;
+    const short = followUp && summaryOverCap(followUp.finalText) === null ? extractSummary(followUp.finalText) : null;
+    if (short !== null) {
+        pending.summary = short;
+        pending.body = pending.body ?? extractCommitBody(followUp.finalText);
+    }
+    ctx.warn(short !== null
+        ? `SUMMARY was ${over} characters — shortened with a follow-up turn`
+        : `SUMMARY was ${over} characters — follow-up gave no shorter one; subject truncated`);
+    return undefined;
+}
 /** Derive the commit's subject and body from the reply's SUMMARY block, running one bounded
  * follow-up turn when the reply left none or a SUMMARY the cap would cut mid-word. Returns the
  * aborted-run outcome when a follow-up aborts, otherwise the description. */
 async function resolveCommitDescription(ctx) {
-    const s = ctx.state;
     // The commit subject and body come from the reply's closing block. A run that changed files
     // without one — a cut-off final message, or plain non-compliance — gets one bounded follow-up
     // turn in its own session to produce it (the session still holds everything the run did);
     // only if that too yields nothing is the subject derived from the changed paths.
-    let summary = extractSummary(ctx.finalText);
-    let body = extractCommitBody(ctx.finalText);
-    // True when no reply named the change, so the subject below is derived from its paths.
-    let summaryDerived = false;
-    if (summary === null) {
-        const base = await headOf(ctx.wt, "HEAD");
-        const followUp = await ctx.requestSummary(ctx.wt);
-        await foldAgentCommitsSince(ctx, ctx.wt, base);
-        if (followUp?.aborted)
-            return ctx.finishAbortedRun();
-        if (followUp) {
-            summary = extractSummary(followUp.finalText);
-            body = body ?? extractCommitBody(followUp.finalText);
-        }
-        if (summary === null) {
-            summary = fallbackSummary(await changedFiles(ctx.wt), ctx.role, s.runs);
-            summaryDerived = true;
-        }
-        ctx.warn(`reply had no SUMMARY line — ` +
-            (followUp && extractSummary(followUp.finalText) !== null
-                ? "recovered it with a follow-up turn"
-                : followUp && !followUp.ok
-                    ? `the follow-up run failed (${followUp.errorMessage || "no error message"}); ` +
-                        `subject derived from the changed files: "${summary}"`
-                    : followUp
-                        ? `follow-up gave none; subject derived from the changed files: "${summary}"`
-                        : `no follow-up session was available; subject derived from the changed files: "${summary}"`));
-    }
-    else {
-        // A SUMMARY the cap would cut mid-word gets one follow-up turn asking for it restated short.
-        const over = summaryOverCap(ctx.finalText);
-        if (over !== null) {
-            const base = await headOf(ctx.wt, "HEAD");
-            const followUp = await ctx.requestSummary(ctx.wt, over);
-            await foldAgentCommitsSince(ctx, ctx.wt, base);
-            if (followUp?.aborted)
-                return ctx.finishAbortedRun();
-            const short = followUp && summaryOverCap(followUp.finalText) === null ? extractSummary(followUp.finalText) : null;
-            if (short !== null) {
-                summary = short;
-                body = body ?? extractCommitBody(followUp.finalText);
-            }
-            ctx.warn(short !== null
-                ? `SUMMARY was ${over} characters — shortened with a follow-up turn`
-                : `SUMMARY was ${over} characters — follow-up gave no shorter one; subject truncated`);
-        }
-    }
-    return { summary, body, summaryDerived };
+    const pending = {
+        summary: extractSummary(ctx.finalText),
+        body: extractCommitBody(ctx.finalText),
+        // True when no reply named the change, so the subject below is derived from its paths.
+        summaryDerived: false,
+    };
+    const outcome = pending.summary === null
+        ? await recoverMissingSummary(ctx, pending)
+        : await shortenOverCapSummary(ctx, pending);
+    if (outcome)
+        return outcome;
+    return { summary: pending.summary, body: pending.body, summaryDerived: pending.summaryDerived };
 }
 /** Run the gate's deterministic backlog checks before the commit, giving the author's session
  * one bounded fix-up turn, and end the run `no_change` when the fix-up reverts the whole change
  * (leaving nothing to commit). Returns an outcome only when the run must end early; otherwise
  * mutates `desc.summary`/`desc.body` with any fix-up recovery, exactly as the inline block did. */
 async function runStageSelfCheck(ctx, desc) {
-    const s = ctx.state;
     // The gate's deterministic backlog checks run here, before the commit, while the authoring
     // session can still be continued: a finding that reaches review costs a queue slot,
     // a verification, and a rejection that discards the work. One bounded follow-up turn on the
     // author's own session gets to fix them; the gate still has the final say, and the change commits
     // and queues either way.
+    const moved = await stagedBacklogMoves(ctx);
+    const movedFindings = recordStagedClaims(ctx, moved);
+    const findings = await ctx.stageCheck(ctx.wt);
+    findings.push(...movedFindings);
+    if (findings.length === 0)
+        return undefined;
+    return applyStageFixUp(ctx, desc, findings);
+}
+/** Decide whether this is a claim-staging run and, if so, read the backlog entries its diff moved
+ * out of their actionable section (plans/parallel-work-instances.md "Claims", part 4/7). Returns
+ * `[]` for every non-claim-staging run and on any unreadable file or git hiccup. */
+async function stagedBacklogMoves(ctx) {
     // Claims made at staging (plans/parallel-work-instances.md "Claims", part 4/7): an
     // unassigned run of a MULTI-instance base whose diff moved a backlog entry out of its
     // actionable section records the claim so a sibling is not assigned it while this change
@@ -139,6 +178,13 @@ async function runStageSelfCheck(ctx, desc) {
         configuredInstances(ctx.config, ctx.role) > 1
         ? await stagedMovedEntries(ctx.wt, ctx.mainBranch, ctx.role).catch(() => [])
         : [];
+    return moved;
+}
+/** Record the run's staged claim for the first claimable moved entry (when it has none yet) and
+ * return the moved-entry findings in the order the inline body pushed them: `assignedMoved`
+ * first, then `heldMoved`. */
+function recordStagedClaims(ctx, moved) {
+    const s = ctx.state;
     const heldBySiblings = new Set(s.claim === undefined ? (s.heldElsewhere ?? []).map(entryKey) : []);
     const heldMoved = heldMovedFinding(heldBySiblings, moved);
     const claimable = moved.filter((m) => !heldBySiblings.has(m.key));
@@ -157,45 +203,50 @@ async function runStageSelfCheck(ctx, desc) {
         });
     }
     const assignedMoved = s.claim ? assignedMovedFinding(s.claim.key, moved) : undefined;
-    const findings = await ctx.stageCheck(ctx.wt);
+    const findings = [];
     if (assignedMoved)
         findings.push(assignedMoved);
     if (heldMoved)
         findings.push(heldMoved);
-    if (findings.length > 0) {
-        const before = findings.length;
-        const fixBase = await headOf(ctx.wt, "HEAD");
-        const fixUp = await ctx.requestStageFix(ctx.wt, findings, {
-            summary: desc.summaryDerived ? null : desc.summary,
-            body: desc.body ? formatCommitBody(desc.body) : "",
-        });
-        await foldAgentCommitsSince(ctx, ctx.wt, fixBase);
-        if (fixUp?.aborted)
+    return findings;
+}
+/** Run the author's one bounded fix-up turn over the stage findings, fold its commits, recover
+ * `desc.summary`/`desc.body` from the reply, and end the run `no_change` when the follow-up left
+ * the worktree clean; otherwise stage-check again and log the outcome warning. Returns an outcome
+ * only when it ends the run early, else `undefined`. */
+async function applyStageFixUp(ctx, desc, findings) {
+    const before = findings.length;
+    const fixBase = await headOf(ctx.wt, "HEAD");
+    const fixUp = await ctx.requestStageFix(ctx.wt, findings, {
+        summary: desc.summaryDerived ? null : desc.summary,
+        body: desc.body ? formatCommitBody(desc.body) : "",
+    });
+    await foldAgentCommitsSince(ctx, ctx.wt, fixBase);
+    if (fixUp) {
+        if (fixUp.aborted)
             return ctx.finishAbortedRun();
-        if (fixUp) {
-            // The fix-up reply answers the findings, not the change, so it never replaces the
-            // change's description (BUGS.md 2026-10-21): its SUMMARY is taken only over a subject
-            // derived from the paths, and its RISK/VERIFIED are appended as self-check notes.
-            const fixSummary = desc.summaryDerived ? extractSummary(fixUp.finalText) : null;
-            if (fixSummary !== null)
-                desc.summary = fixSummary;
-            desc.body = appendSelfCheckNotes(desc.body, extractCommitBody(fixUp.finalText));
-        }
-        // A fix-up turn may resolve its findings by reverting the whole change. With nothing left
-        // in the worktree there is nothing to commit or queue: end the run no_change here instead
-        // of handing a clean tree to commitAll. The worktree is left clean and no pin is taken.
-        // isDirty, not changedFiles: a `git status` that fails must throw, not read as clean — on
-        // 2026-10-21 a spawn failure here ended bugfix-2's 17-minute run no_change and released
-        // its edits unpinned; thrown, the run ends unsettled and its next run gets them back.
-        if (!(await isDirty(ctx.wt))) {
-            logSelfCheckOutcome(ctx, "stage self-check: the follow-up turn left no change; nothing to land", findings);
-            return { result: "no_change" };
-        }
-        const remaining = await ctx.stageCheck(ctx.wt);
-        logSelfCheckOutcome(ctx, remaining.length === 0
-            ? `stage self-check: ${plural(before, "finding")} — fixed by the follow-up turn`
-            : `stage self-check: ${plural(before, "finding")}; ${remaining.length} still open, queued for the gate`, findings, remaining);
+        // The fix-up reply answers the findings, not the change, so it never replaces the
+        // change's description (BUGS.md 2026-10-21): its SUMMARY is taken only over a subject
+        // derived from the paths, and its RISK/VERIFIED are appended as self-check notes.
+        const fixSummary = desc.summaryDerived ? extractSummary(fixUp.finalText) : null;
+        if (fixSummary !== null)
+            desc.summary = fixSummary;
+        desc.body = appendSelfCheckNotes(desc.body, extractCommitBody(fixUp.finalText));
+    }
+    // A fix-up turn may resolve its findings by reverting the whole change. With nothing left
+    // in the worktree there is nothing to commit or queue: end the run no_change here instead
+    // of handing a clean tree to commitAll. The worktree is left clean and no pin is taken.
+    // isDirty, not changedFiles: a `git status` that fails must throw, not read as clean — on
+    // 2026-10-21 a spawn failure here ended bugfix-2's 17-minute run no_change and released
+    // its edits unpinned; thrown, the run ends unsettled and its next run gets them back.
+    if (!(await isDirty(ctx.wt))) {
+        logSelfCheckOutcome(ctx, "stage self-check: the follow-up turn left no change; nothing to land", findings);
+        return { result: "no_change" };
     }
+    const remaining = await ctx.stageCheck(ctx.wt);
+    logSelfCheckOutcome(ctx, remaining.length === 0
+        ? `stage self-check: ${plural(before, "finding")} — fixed by the follow-up turn`
+        : `stage self-check: ${plural(before, "finding")}; ${remaining.length} still open, queued for the gate`, findings, remaining);
     return undefined;
 }
 /** Compute the run's friction signal over this run's pre-commit authoring runs: minutes of wall

package/dist/src/run/run-timing.js

@@ -89,16 +89,22 @@ export async function runTimedRoleRun(signal, acquire, release, run, now = Date.
 /** Sleep up to ms, but wake immediately when `signal` aborts — so shutdown (SIGTERM →
  * abort) is prompt instead of waiting out the current poll cycle. The listener is removed
  * on either exit path so long-running orchestrators don't accumulate one per poll, and an
- * already-aborted signal returns synchronously through runOnAbort. Exported as a unit-test
+ * already-aborted signal returns synchronously through runOnAbort. Without a signal it is a
+ * plain setTimeout sleep. The review gate's retry wait (src/review/review.ts, whose signal is
+ * optional) shares this helper rather than keeping a second copy. Exported as a unit-test
  * seam, like runTimedRoleRun above. */
 export function sleepInterruptible(ms, signal) {
     return new Promise((resolve) => {
+        if (signal === undefined) {
+            setTimeout(resolve, ms);
+            return;
+        }
         const onAbort = () => {
             clearTimeout(timer);
             resolve();
         };
         const timer = setTimeout(() => {
-            signal.removeEventListener("abort", onAbort);
+            signal?.removeEventListener("abort", onAbort);
             resolve();
         }, ms);
         runOnAbort(signal, onAbort);

package/dist/src/run/run-usage.js

@@ -108,9 +108,24 @@ export class RunUsage {
      * through foldMergeUsage: those never advance the run's pre-edit counter, which measures
      * the authoring search. */
     fold(s, run, authoring = true, provider, pair) {
+        this.foldLifetimeTotals(s, run);
+        this.foldCost(s, run, provider, pair);
+        this.foldAccount(run);
+        this.foldPromptTokens(run, authoring);
+        this.turns += run.turns;
+        this.foldEpisodes(run, provider);
+    }
+    /** Grow the role's lifetime totals on `s` from this run: its generated tokens and the real
+     * spend both accumulate through the healed counter, and the peak context is the new max. */
+    foldLifetimeTotals(s, run) {
         s.generatedTokens = counter(s.generatedTokens) + run.outputTokens;
         s.peakContextTokens = Math.max(counter(s.peakContextTokens), run.peakContextTokens);
         s.totalCostUsd = counter(s.totalCostUsd) + run.costUsd;
+    }
+    /** Split this run's cost real from notional: a subscription run's cost is notional and never
+     * charges the daily cap; an API run's — or a run that ever saw overage — is real money.
+     * totalCostUsd still counts both: it is lifetime usage, not a budget figure. */
+    foldCost(s, run, provider, pair) {
         // The billing split (plans/agent-backends.md §7): a subscription run's cost is notional
         // and never charges the daily cap; an API run's — or a run that ever saw overage — is real
         // money. totalCostUsd still counts both: it is lifetime usage, not a budget figure.
@@ -126,12 +141,21 @@ export class RunUsage {
             this.notionalCostUsd += run.costUsd;
             this.bumpProviderCost(provider, run.costUsd, 'notionalCostUsd');
         }
+    }
+    /** Carry the newest account readings this run reported: the billing state, the subscription
+     * rate windows, and the agent they came from (whose name is only meaningful beside them). */
+    foldAccount(run) {
         if (run.billing !== undefined)
             this.billing = run.billing;
         if (run.rateWindows !== undefined)
             this.rateWindows = run.rateWindows;
         if (run.billing !== undefined || run.rateWindows !== undefined)
             this.agent = run.agent;
+    }
+    /** Advance the token counters: the prompt and cache-read shares count every run, while the
+     * pre-edit prefix freezes at the first edit — authoring-only, and skipped for a merge/review
+     * run. */
+    foldPromptTokens(run, authoring) {
         this.promptTokens += run.promptTokens;
         this.cacheReadTokens += run.cacheReadTokens;
         // The pre-edit prefix freezes at the run's first edit: every authoring run while no edit
@@ -143,7 +167,13 @@ export class RunUsage {
             if (run.firstEditTurn !== undefined)
                 this.editSeen = true;
         }
-        this.turns += run.turns;
+    }
+    /** Stamp the team-wide hold's failure observations for a run that ENDED on them: pi exits on
+     * a 429 or backend error, so "now" is when the provider refused. A run that merely logged one
+     * inside pi's own auto-retry and then finished would stamp a false observation, possibly hours
+     * late. The backend kind travels with its stamp (src/pi/pi-failure.ts classified the text at
+     * parse time); a 429 never ends up here — pi-stream checks rate-limit first. */
+    foldEpisodes(run, provider) {
         // The team-wide hold's rate-limit input (lastRateLimit above), from the same
         // once-per-run choke point. Only a run that ENDED on the 429 counts: pi exits on the error,
         // so "now" is when the provider refused — a run that merely logged one inside pi's own

package/dist/src/run/run-verdict.js

@@ -1,3 +1,4 @@
+import { imageReroute } from "../agent/image-input.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { baseRoleOf } from "../roles/runner-ids.js";
 import { isDirty, deleteRef } from "../git/git.js";
@@ -9,6 +10,7 @@ import { errorMessage } from "../text/text.js";
 import { recordParity } from "./ci-parity.js";
 import { resetWorktreeToMain } from "../git/worktree.js";
 import { recordDismissedFiling, recordDismissedFlow } from "./run-dismiss.js";
+import { readPiListedModels } from "../pi/pi-listed-models.js";
 import { rejectedRefName } from "../paths.js";
 import { logEventBestEffort } from "../events/events.js";
 import { subscriptionWindowRejected } from "../agent/claude/claude-account.js";
@@ -23,6 +25,17 @@ function abortWithResume(s, ctx, pi, lastError, result, resumeCause) {
     ctx.pending.requeueForResume(s, ctx.userPrompt);
     return { result, resumeCause };
 }
+/** End a run as an unfulfilled error: record `lastError`, re-queue the raw prompt for a later
+ * fresh run (requeueUnfulfilled) and return the error outcome — the terminal the timeout and
+ * image-blind arms share, filed here so the "record lastError, re-queue unfulfilled, end as
+ * error" contract cannot drift between them (the resume-arming twin is abortWithResume above;
+ * failedRunArm's error path keeps its own split because it arms a resume for a dirty worktree
+ * and sets lastError before that choice). */
+function unfulfilledError(s, ctx, message) {
+    s.lastError = message;
+    ctx.pending.requeueUnfulfilled(ctx.userPrompt);
+    return { result: "error" };
+}
 /** Classify what the finished run left behind; null means the run is fulfillable and staging
  * should take over. Never throws: every branch returns an outcome, recording what went wrong
  * in `state.lastError` or a warning event. */
@@ -134,11 +147,9 @@ function progressingTimeoutArm(ctx) {
 function timeoutArm(ctx) {
     const { pi, state: s } = ctx;
     if (pi.timedOut) {
-        s.lastError = pi.errorMessage ?? "timed out";
         // The request never ran to completion and no work merged: put it back so the next
         // run retries it. (A killed run's half-done edits are discarded by the reset.)
-        ctx.pending.requeueUnfulfilled(ctx.userPrompt);
-        return { result: "error" };
+        return unfulfilledError(s, ctx, pi.errorMessage ?? "timed out");
     }
     return undefined;
 }
@@ -179,21 +190,63 @@ function budgetCappedArm(ctx) {
     return undefined;
 }
 /** The image-blind decision: a run stopped the moment its agent read an image its model cannot
- * see fails with `lastError` and the prompt re-queues. The peer-tier reroute was subtracted
- * (part 5g/6), so a blind read is never handed to another tier (plans/image-input.md "Failing
- * the run"). */
+ * see. One hop to an image-capable reroute target is taken when one exists; otherwise the
+ * run fails and the prompt re-queues (plans/image-input.md "Failing the run"). */
 function imageBlindArm(ctx) {
     const { pi, state: s } = ctx;
     // A run the runner killed the moment its agent read an image its model cannot see
     // (plans/image-input.md "Failing the run"): pi strips such an image from the request, so
     // the agent was about to answer about a picture it never saw. The run was deliberately
     // stopped before it could work on, so its half-done edits are discarded exactly as a
-    // timed-out run's are — nothing to resume, and the prompt re-queues to run fresh later.
-    // The error backoff and streak apply as for any error.
+    // timed-out run's are — nothing to resume, and the prompt re-queues to run fresh on a
+    // model that CAN see (part 4 adds the reroute arm here). The error backoff and streak apply
+    // as for any error.
     if (pi.imageBlind) {
-        s.lastError = pi.errorMessage ?? `read ${pi.imageBlind.path}, but the model cannot read images`;
-        ctx.pending.requeueUnfulfilled(ctx.userPrompt);
-        return { result: "error" };
+        // One hop only (plans/image-input.md "Rerunning on a model that can read images"): a
+        // run that ALREADY started on the image-capable target and still read blind is not
+        // rerouted a second time — it fails, so a misreadable image cannot bounce the role
+        // between tiers forever. Set at run start by runPhase when it routes a run onto the
+        // target (blind-read handoff or attachment preflight).
+        if (s.imageRerouteActive) {
+            // No work was done (the run was killed at the first read): nothing to resume, and the
+            // prompt re-queues to run fresh later like any other error. The error backoff/streak
+            // apply as usual.
+            return unfulfilledError(s, ctx, pi.errorMessage ?? `read ${pi.imageBlind.path}, but the model cannot read images`);
+        }
+        // Otherwise, when the role's tier has an image-capable reroute target, the failed work
+        // is not discarded: the next run starts directly on that target over the kept worktree.
+        // The one-shot field carries the target seam plus the `from`/`path` facts the handoff
+        // note needs; the run ends `aborted` with the `image-reroute` resume cause, and
+        // applyRunOutcome schedules it promptly (nextRunAt = now) while planRunStart hands the
+        // kept worktree off to a FRESH session on the target.
+        const regime = ctx.rerouteRegime ?? "primary";
+        const target = ctx.config !== undefined ? imageReroute(ctx.config, ctx.role, regime, undefined, null, null, readPiListedModels(ctx.root))
+            : null;
+        if (target) {
+            const from = ctx.runModel ?? target.config.model ?? "the model";
+            s.imageReroute = {
+                tier: target.tier,
+                backend: target.config.agent ?? "pi",
+                provider: target.config.provider,
+                model: target.config.model,
+                thinking: target.config.thinking,
+                from,
+                path: pi.imageBlind.path,
+            };
+            s.lastError = `read ${pi.imageBlind.path}, but ${from} cannot read images — rerouting to ${target.tier}`;
+            ctx.pending.requeueForResume(s, ctx.userPrompt);
+            logEventBestEffort(ctx.root, {
+                source: ctx.role,
+                type: "image_reroute",
+                run: s.runs,
+                from,
+                to: target.config.model,
+                tier: target.tier,
+                preflight: false,
+            });
+            return { result: "aborted", resumeCause: "image-reroute" };
+        }
+        return unfulfilledError(s, ctx, pi.errorMessage ?? `read ${pi.imageBlind.path}, but the model cannot read images`);
     }
     return undefined;
 }
@@ -300,51 +353,67 @@ function noChangeArm(ctx, changed) {
         // diagnoseNoChange (src/verdict/no-change.ts) tells which, so the warning event below is
         // diagnosable on its own.
         const diagnosis = diagnoseNoChange(pi);
-        if (!pi.nothingToDo) {
-            ctx.warn(`the agent finished without changes and without declaring nothing-to-do` +
-                (diagnosis.notes.length ? ` (${diagnosis.notes.join(", ")})` : ""));
-        }
+        warnUndeclaredNoChange(ctx, pi, diagnosis.notes);
         // A cut-off run did real work and was NOT fulfilled: a director prompt goes back
         // to the inbox to rerun fresh; a role runner resumes the just-compacted session
         // next run (see the cutOff handling in run()).
         if (diagnosis.cutOff)
             ctx.pending.requeueForResume(s, ctx.userPrompt);
-        // A cut-off run did real work but was truncated before declaring its outcome: the FLOW
-        // line it left mid-stream is not a finished verdict, so recording it would advance the
-        // rotation past a check that did not complete. Only a run that was not cut off records.
-        if (ctx.flow && !diagnosis.cutOff) {
-            // The ledger only orders the qa menu, so a failed write warns rather than failing the run.
-            recordDismissedFlow(ctx, ctx.root, ctx.flow.flow, ctx.flow.result, ctx.flow.result === "bug" ? extractSummary(pi.finalText) ?? undefined : undefined);
-        }
-        // A fulfilled feedback run that filed records its per-install ledger entry and logs the
-        // issue_filed event so the filing is visible in the operator's activity feed. Recording is
-        // bookkeeping that never fails the run: a failed ledger write warns and the no_change
-        // outcome stands. A cut-off run records nothing — truncation is not a filing the run
-        // declared (the same guard the FLOW line carries).
-        if (ctx.filed && !diagnosis.cutOff) {
-            recordDismissedFiling(ctx, ctx.root, ctx.filed);
+        recordNoChangeBookkeeping(ctx, pi, diagnosis.cutOff);
+        return {
+            result: "no_change",
+            cutOff: diagnosis.cutOff || undefined,
+            summary: noChangeSummary(ctx, pi, diagnosis.cutOff),
+        };
+    }
+    return undefined;
+}
+/** Warn when a no-change run declared neither a sentinel nor nothing-to-do, so the non-
+ * compliance or truncation the diagnosis saw is diagnosable on its own. */
+function warnUndeclaredNoChange(ctx, pi, notes) {
+    if (!pi.nothingToDo) {
+        ctx.warn(`the agent finished without changes and without declaring nothing-to-do` +
+            (notes.length ? ` (${notes.join(", ")})` : ""));
+    }
+}
+/** A no-change run's bookkeeping: the qa flow, the filed feedback ledger entry and the ci
+ * parity coverage, each recorded only when its observer saw it and the run was not cut off. */
+function recordNoChangeBookkeeping(ctx, pi, cutOff) {
+    // A cut-off run did real work but was truncated before declaring its outcome: the FLOW
+    // line it left mid-stream is not a finished verdict, so recording it would advance the
+    // rotation past a check that did not complete. Only a run that was not cut off records.
+    if (ctx.flow && !cutOff) {
+        // The ledger only orders the qa menu, so a failed write warns rather than failing the run.
+        recordDismissedFlow(ctx, ctx.root, ctx.flow.flow, ctx.flow.result, ctx.flow.result === "bug" ? extractSummary(pi.finalText) ?? undefined : undefined);
+    }
+    // A fulfilled feedback run that filed records its per-install ledger entry and logs the
+    // issue_filed event so the filing is visible in the operator's activity feed. Recording is
+    // bookkeeping that never fails the run: a failed ledger write warns and the no_change
+    // outcome stands. A cut-off run records nothing — truncation is not a filing the run
+    // declared (the same guard the FLOW line carries).
+    if (ctx.filed && !cutOff) {
+        recordDismissedFiling(ctx, ctx.root, ctx.filed);
+    }
+    // A fulfilled ci run that declared its coverage records it in the parity ledger so the
+    // next fresh session's block knows what the last run covered (part 3/3). The ledger is
+    // bookkeeping that never fails the run: a failed write warns and the no_change outcome
+    // stands. A cut-off run records nothing — truncation is not a coverage the run declared.
+    if (ctx.ci && !cutOff) {
+        try {
+            recordParity(ctx.root, ctx.ci.sha, ctx.ci.result);
         }
-        // A fulfilled ci run that declared its coverage records it in the parity ledger so the
-        // next fresh session's block knows what the last run covered (part 3/3). The ledger is
-        // bookkeeping that never fails the run: a failed write warns and the no_change outcome
-        // stands. A cut-off run records nothing — truncation is not a coverage the run declared.
-        if (ctx.ci && !diagnosis.cutOff) {
-            try {
-                recordParity(ctx.root, ctx.ci.sha, ctx.ci.result);
-            }
-            catch (err) {
-                ctx.warn(`ci parity not recorded: ${errorMessage(err)}`);
-            }
+        catch (err) {
+            ctx.warn(`ci parity not recorded: ${errorMessage(err)}`);
         }
-        // A prompt-driven (director) run that answers a question in prose ends `no_change` with
-        // no SUMMARY block, so its reply would be lost — the dashboard reads a bare "No change"
-        // and the feed carries nothing (BUGS.md 2026-10-14). Keep the prose above the sentinel as
-        // the run's summary so `lastSummary` and the run_end event show the answer where the
-        // operator asked the question. A role runner's bare nothing-to-do stays summary-less.
-        const summary = ctx.userPrompt !== null && !diagnosis.cutOff
-            ? (extractNoChangeAnswer(pi.finalText) ?? undefined)
-            : undefined;
-        return { result: "no_change", cutOff: diagnosis.cutOff || undefined, summary };
     }
-    return undefined;
+}
+/** A prompt-driven (director) run that answers a question in prose ends `no_change` with
+ * no SUMMARY block, so its reply would be lost — the dashboard reads a bare "No change"
+ * and the feed carries nothing (BUGS.md 2026-10-14). Keep the prose above the sentinel as
+ * the run's summary so `lastSummary` and the run_end event show the answer where the
+ * operator asked the question. A role runner's bare nothing-to-do stays summary-less. */
+function noChangeSummary(ctx, pi, cutOff) {
+    return ctx.userPrompt !== null && !cutOff
+        ? (extractNoChangeAnswer(pi.finalText) ?? undefined)
+        : undefined;
 }