tumwater 0.4.2 → 0.4.3

package/dist/src/run/stage-prose-checks.js

@@ -196,64 +196,79 @@ function spanningGarbled(joined, joinAt, patterns) {
     }
     return null;
 }
-/** (e) Added lines, outside record prose, that match GARBLED_WORDING: at most one hit per line,
- * reported as `file:line "matched text"` in a single finding. A phrase split across two
- * consecutive added lines is reported as `file:N-M`. */
-export function garbledWordingFindings(diff) {
-    const hits = [];
+/** The added lines of a diff, in order, each with the added line that precedes it. */
+function addedDiffLines(diff) {
+    const out = [];
     let file = null;
     let lineNo = 0;
-    let prevAdded = null;
+    let prev = null;
     for (const line of diff.split("\n")) {
         const header = /^diff --git a\/.* b\/(.*)$/.exec(line);
         if (header) {
             file = header[1];
-            prevAdded = null;
+            prev = null;
             continue;
         }
         const hunk = /^@@ .*\+(\d+)(?:,\d+)? @@/.exec(line);
         if (hunk) {
             lineNo = Number(hunk[1]);
-            prevAdded = null;
+            prev = null;
             continue;
         }
         if (!line.startsWith("+") || line.startsWith("+++ ")) {
-            prevAdded = null;
+            prev = null;
             continue;
         }
-        const cur = line.slice(1);
-        if (file !== null && !isRecordProse(file)) {
-            let hit = false;
-            for (const re of GARBLED_WORDING) {
-                const m = re.exec(cur);
-                if (m) {
-                    hits.push(`${file}:${lineNo} "${m[0]}"`);
-                    hit = true;
-                    break;
-                }
-            }
-            const prose = proseOf(file, cur);
-            if (!hit && prose !== null) {
-                const m = DOUBLED_WORD.exec(prose);
-                if (m) {
-                    hits.push(`${file}:${lineNo} "${m[0]}"`);
-                    hit = true;
-                }
-            }
-            if (!hit && prevAdded !== null) {
-                const head = prevAdded.trimEnd();
-                const joined = head + " " + cur.replace(/^\s*(?:\/\/+|\*|#)\s*/, "");
-                let split = spanningGarbled(joined, head.length, GARBLED_WORDING);
-                if (!split && prose !== null && proseOf(file, prevAdded) !== null) {
-                    split = spanningGarbled(joined, head.length, [DOUBLED_WORD]);
-                }
-                if (split)
-                    hits.push(`${file}:${lineNo - 1}-${lineNo} "${split}"`);
-            }
-        }
-        prevAdded = cur;
+        const text = line.slice(1);
+        if (file !== null)
+            out.push({ file, lineNo, text, prev });
+        prev = text;
         lineNo++;
     }
+    return out;
+}
+/** The first GARBLED_WORDING hit on a single added line, or the DOUBLED_WORD hit in its prose. */
+function singleLineGarbledHit(file, lineNo, cur) {
+    for (const re of GARBLED_WORDING) {
+        const m = re.exec(cur);
+        if (m)
+            return `${file}:${lineNo} "${m[0]}"`;
+    }
+    const prose = proseOf(file, cur);
+    if (prose !== null) {
+        const m = DOUBLED_WORD.exec(prose);
+        if (m)
+            return `${file}:${lineNo} "${m[0]}"`;
+    }
+    return null;
+}
+/** A garbled or doubled phrase split across two consecutive added lines, joined at their seam. */
+function spanningGarbledHit(file, lineNo, cur, prevAdded) {
+    if (prevAdded === null)
+        return null;
+    const head = prevAdded.trimEnd();
+    const joined = head + " " + cur.replace(/^\s*(?:\/\/+|\*|#)\s*/, "");
+    let split = spanningGarbled(joined, head.length, GARBLED_WORDING);
+    const prose = proseOf(file, cur);
+    if (!split && prose !== null && proseOf(file, prevAdded) !== null) {
+        split = spanningGarbled(joined, head.length, [DOUBLED_WORD]);
+    }
+    if (split)
+        return `${file}:${lineNo - 1}-${lineNo} "${split}"`;
+    return null;
+}
+/** (e) Added lines, outside record prose, that match GARBLED_WORDING: at most one hit per line,
+ * reported as `file:line "matched text"` in a single finding. A phrase split across two
+ * consecutive added lines is reported as `file:N-M`. */
+export function garbledWordingFindings(diff) {
+    const hits = [];
+    for (const { file, lineNo, text, prev } of addedDiffLines(diff)) {
+        if (isRecordProse(file))
+            continue;
+        const hit = singleLineGarbledHit(file, lineNo, text) ?? spanningGarbledHit(file, lineNo, text, prev);
+        if (hit !== null)
+            hits.push(hit);
+    }
     if (hits.length === 0)
         return [];
     const lead = 'added lines carry garbled rename wording (reword them; a rote word swap such as "tick" → "run" reads wrong here or leaves a word doubled): '; // vocabulary-ok: quotes the retired word

package/dist/src/runner/runner-outcome.js

@@ -10,7 +10,7 @@ import { mergeToMain } from "../merge/merge-to-main.js";
 import { MERGE_LOCK_WAIT_MS } from "../paths.js";
 import { resolveRunVerdict } from "../run/run-verdict.js";
 import { modelTrailerLine } from "../git/commit-message.js";
-import { seamAgent } from "../config/model-selector.js";
+import { seamAgent } from "../config/config-model-selector.js";
 import { stageRunMerge } from "../run/run-stage.js";
 import { stageCheckFindings } from "../run/stage-check.js";
 /** Merge the worktree branch on main (see src/merge/merge-to-main.ts for the
@@ -62,6 +62,11 @@ export async function handlePiResultPhase(ctx, pi, userPrompt, revisionRound, wt
         flow,
         filed,
         ci,
+        // The image-reroute arm resolves its target from the live config and the current
+        // regime, and names the model this run ran on as the handoff's `from`.
+        config: ctx.config,
+        rerouteRegime: ctx.rerouteRegime(),
+        runModel: cfg.model,
         warn: (message) => ctx.warn(message),
         merge: (w, sum) => mergePhase(ctx, w, sum),
         finishAbortedRun: () => ctx.finishAbortedRun(userPrompt, wt),

package/dist/src/runner/runner-pi.js

@@ -3,7 +3,6 @@ import { backendSessionResumable } from "../agent/agent-backend.js";
 import { HOLD_BASE_MS } from "../team/team-hold.js";
 import { backendKindPhrase } from "../text/phrases.js";
 import { configForRole, resolvedBackendConfig, seamHoldKey, seamPairName } from "../config/config-views.js";
-import { ensureProviderLease } from "../concurrency/provider-lease.js";
 import { buildSummaryRequestPrompt } from "../prompt/prompt-followup.js";
 import { readClaudeAccount, subscriptionWindowRejected } from "../agent/claude/claude-account.js";
 import { observeOpencodeRun, opencodeModelKey } from "../agent/opencode/opencode-catalog.js";
@@ -223,12 +222,6 @@ export class RunnerPi {
         // Names the seam in per-run provider warnings; omitted when pi picks its own default model.
         const on = opts.config.model !== undefined ? ` on ${pair}` : "";
         const fold = (run) => authoring ? this.host.foldUsage(run, provider, pair) : this.host.foldMergeUsage(run, provider, pair);
-        // The agent run re-keys the calling run's provider lease to the provider THIS agent run uses,
-        // if it is not already there (plans/provider-concurrency.md §5): a budget handback or a
-        // model-failure switch that moved this agent run onto another seam moves the run's lease with
-        // it, so a claude-authored run whose gate agent run lands on omlx is counted there. No-op when
-        // the run carries no lease (a bare RunnerPi unit test, `tumwater history`).
-        await ensureProviderLease(opts.config);
         const pi = await runPi(opts);
         this.warnFallbackClone(pi);
         this.observeFreeModelCost(pi, opts.config);
@@ -358,7 +351,7 @@ export class RunnerPi {
     }
     /** Run pi for this runner's authoring run in worktree `wt`: the shared per-runner wiring and
      * the transient-failure retry, with usage folded into the run's counters. It is the ONE
-     * entry point that carries the role notes (PLANS.md "Role notebook": TUMWATER_NOTES_PATH,
+     * entry point that carries the role notes (TUMWATER_NOTES_PATH,
      * read by the `tumwater-notes` command): every other agent run (runRolePi's merge/conflict path,
      * runMergePi, runGatePi) leaves it unset, and the director is excluded because its work is
      * the operator's prompt, not a recurring search.
@@ -409,8 +402,8 @@ export class RunnerPi {
      * abort.
      *
      * The follow-up continues this run's own session, so it must run on the same pair that
-     * session ran on: the caller passes the run's effective config (the fallback pair while a
-     * model-fallback episode is active). A caller without one rides the role's own config. The
+     * session ran on: the caller passes the run's effective config (a budget cap's fallback
+     * pair while a cap episode is active). A caller without one rides the role's own config. The
      * shared per-runner wiring (runnerPiOpts) takes the follow-up's hard caps overriding the
      * authoring run's budget: one short reply on a warm session. The agent run takes the runner's
      * SHARED transient-failure retry (BUGS.md 2026-10-01): a 429 on the follow-up turn waits its

package/dist/src/runner/runner-recovery.js

@@ -48,7 +48,7 @@ export async function pinAndResetPhase(ctx, wt, sha) {
     await resetWorktreeToMain(wt, ctx.mainBranch);
     return true;
 }
-/** End a run whose leftover recovery found work to salvage (src/runner/leftover.ts) without an
+/** End a run whose leftover recovery found work to salvage (runner-leftover.ts) without an
  * authoring run — the leftover owns the role's one merge ref until its merge resolves. A
  * run's dequeued user prompt goes back to its queue, since nothing ran it. A pin put on
  * the merge queue ends the run `queued` exactly like a fresh changed run (the merge-queue

package/dist/src/runner/{revision.js → runner-revision.js}

@@ -39,7 +39,7 @@ export const REVISION_BACKSTOP = 6;
  * sees exactly what would not converge. PLANS.md plans only, by design: the convergence hold
  * parks a revised plan whose author hit the round cap, so only the plan role needs to clear it;
  * a role's own too-large Needs-review note on a BUGS.md entry is the bug path (the
- * stalledEntries/operatorHeldEntries comments in src/backlog/backlog-eligibility.ts), which the
+ * stalledEntries comment in src/backlog/backlog-eligibility.ts), which the
  * plan role resolves by splitting it. A bug that cannot converge stays with the existing re-pick
  * behaviour (reviewer-feedback delivery, part 4/4, addresses that churn).
  * Written through the primary worktree lock, as every other backlog write is, and then committed

package/dist/src/runner/runner-run.js

@@ -6,23 +6,25 @@ import { abortSync, ensureWorktree, resetWorktreeToMain } from "../git/worktree.
 import { leaseSlot } from "../git/worktree-pool.js";
 import { slotCount } from "../config/config.js";
 import { useWorktree } from "../git/worktree-use.js";
+import { readPiListedModels } from "../pi/pi-listed-models.js";
 import { branchName, worktreePath, mergeRefName, rejectedRefName } from "../paths.js";
 import { logEventBestEffort } from "../events/events.js";
 import { buildConflictHandbackNote, buildSalvageRestoreNote } from "../prompt/gate-prompts.js";
 import { buildConflictDiscardNote, buildMainKnownRedNote, buildRevisionNote, buildRejectedReviewNote, } from "../prompt/gate-notes.js";
-import { modelSelectorField, resolvedBackendConfig, reviewRunConfig, reviewedAfterMerge, scheduleConfigForRole, seamHoldKey, } from "../config/config-views.js";
-import { fallbackRoleConfig } from "../config/config-fallbacks.js";
+import { modelSelectorField, resolvedBackendConfig, reviewRunConfig, reviewedAfterMerge, scheduleConfigForRole, seamHoldKey, withModelOverrides, } from "../config/config-views.js";
+import { imageReroute, seamImageInput } from "../agent/image-input.js";
+import { piModelsPath, readPiProviders } from "../pi/pi-models.js";
+import { peekPrompt, peekRolePrompt } from "../inbox/inbox.js";
 import { planRunStart, planWithSalvagedWork, takesSalvagedWork } from "../run/run-resume.js";
 import { restoreSalvagedWork } from "../git/slot-salvage.js";
 import { DEFAULT_BACKEND } from "../agent/agent-backend.js";
 import { foldAgentCommitsSince } from "../run/run-stage.js";
 import { planBacklogFull } from "../scheduling/claims.js";
-import { modelFallbackActive, modelFallbackProbe } from "./model-fallback.js";
 import { finalizeRun } from "../run/run-finalize.js";
 import { errorMessage } from "../text/text.js";
 import { appendPromptNote, prependPromptNote } from "../text/format.js";
-import { hasUnmergedPin, recoverLeftover } from "./leftover.js";
-import { applyRevision, applyWithConflicts } from "./revision.js";
+import { hasUnmergedPin, recoverLeftover } from "./runner-leftover.js";
+import { applyRevision, applyWithConflicts } from "./runner-revision.js";
 import { conflictedFileHunks, hasConflictMarkers, mainCommitsTouching } from "../merge/merge-git.js";
 import { changedFiles } from "../git/git-diff.js";
 import { handlePiResultPhase } from "./runner-outcome.js";
@@ -57,10 +59,9 @@ async function markerBearingFiles(wt) {
     const files = await changedFiles(wt);
     return files.filter((f) => hasConflictMarkers(wt, [f]));
 }
-/** Run one full run of a role runner: resolve the config (including the model-fallback probe),
- * log the start, run the pipeline, then let finalizeRun schedule the next run. Never throws: a
- * failed run is an "error" result, saved and logged like any other so the runner stays
- * resumable and observable. */
+/** Run one full run of a role runner: resolve the config, log the start, run the pipeline, then
+ * let finalizeRun schedule the next run. Never throws: a failed run is an "error" result,
+ * saved and logged like any other so the runner stays resumable and observable. */
 export async function runPhase(ctx) {
     const s = ctx.state;
     // This role's view of the config (per-role provider/model/thinking + minRunIntervalSeconds
@@ -73,20 +74,67 @@ export async function runPhase(ctx) {
     // the one home of the rule, so the scheduler that admits plan and the nextRunAt this run
     // writes cannot disagree.
     const planBacklogOpen = !planBacklogFull(ctx.root, ctx.config);
+    // This run's effective config: the role's own resolved config (a run always resolves its
+    // role's own config — the model-fallback episode is gone, Subtract part 5o/6) unless an image
+    // reroute below moves it. The budget gate's fallback pair, when a cap episode is active, is
+    // installed into the live config itself, so the config here already names the pair the run
+    // uses.
     const primaryCfg = scheduleConfigForRole(ctx.config, ctx.role, planBacklogOpen);
-    // Model-fallback episode (src/runner/model-fallback.ts): while one is active the run runs
-    // on the role's tier fallback pair, and once the cooldown elapses it runs on the primary
-    // as the probe. Resolved at run start so the authoring run below and the end-of-run fold
-    // agree on which pair ran. Null fallback (the tier resolves to pause) keeps the feature off.
-    const now = Date.now();
-    const fallback = fallbackRoleConfig(ctx.config, ctx.role);
-    const probing = fallback !== null && modelFallbackProbe(s.modelFallback, now);
-    const onFallback = fallback !== null && modelFallbackActive(s.modelFallback, now);
-    // The fallback pair keeps primaryCfg's gap (they resolve the same one outside the plan
-    // schedule's zero-gap window), so a plan on its model fallback still schedules the same gap.
-    let cfg = onFallback && fallback !== null
-        ? { ...fallback, minRunIntervalSeconds: primaryCfg.minRunIntervalSeconds }
-        : primaryCfg;
+    let cfg = primaryCfg;
+    // Image-input reroute (plans/image-input.md part 4/5). A pending one-shot marker means
+    // THIS run is the blind-read reroute: start directly on the image-capable target the
+    // prior run recorded, over the kept worktree, in a fresh session. The marker is consumed
+    // (cleared) here so it does not route a later run; imageRerouteActive stays true for the
+    // whole run so the verdict's one-hop guard fails a second blind read instead of
+    // rerouting again. A preflight (below) sets the same active flag without a marker.
+    s.imageRerouteActive = false;
+    let preflightBlocked = false;
+    if (s.imageReroute) {
+        const r = s.imageReroute;
+        cfg = withModelOverrides(ctx.config, r.tier, {
+            backend: r.backend,
+            provider: r.provider,
+            model: r.model,
+            thinking: r.thinking,
+        });
+        // The marker is NOT cleared here: planRunStart reads its `from`/`path` when it builds
+        // the handoff note (and clears it then), so a run skipped before the plan (an empty
+        // inbox) leaves the reroute pending for the next eligible run.
+        s.imageRerouteActive = true;
+    }
+    else {
+        // Preflight (plans/image-input.md "Attachments"): a queued prompt carrying an
+        // `[image attached: …]` line needs a model that can read images BEFORE any run starts,
+        // so a text-only run hops straight to the target instead of spending a failed run
+        // learning it; with no target the run errors without spawning pi.
+        const nextPrompt = ctx.role === DIRECTOR_ROLE ? peekPrompt(ctx.root) : peekRolePrompt(ctx.root, ctx.role);
+        const carriesImages = nextPrompt !== null && /^\[image attached: .+\]$/m.test(nextPrompt);
+        if (carriesImages) {
+            const providers = readPiProviders(piModelsPath());
+            const listed = readPiListedModels(ctx.root);
+            if (seamImageInput(cfg, providers, listed) !== true) {
+                const target = imageReroute(ctx.config, ctx.role, ctx.rerouteRegime(), undefined, null, null, listed);
+                if (target !== null) {
+                    cfg = target.config;
+                    s.imageRerouteActive = true;
+                    logEventBestEffort(ctx.root, {
+                        source: ctx.role,
+                        type: "image_reroute",
+                        run: s.runs + 1,
+                        from: primaryCfg.model,
+                        to: target.config.model,
+                        tier: target.tier,
+                        preflight: true,
+                    });
+                }
+                else {
+                    preflightBlocked = true;
+                    s.lastError =
+                        `an inbox message for ${ctx.role} attaches an image, but no configured tier can read it`;
+                }
+            }
+        }
+    }
     // Capture what this run runs on (the orchestrator's budget handback matches it against
     // the fallback pair) and clear any stale handback flag: an abort request that lands while
     // the runner is idle must not name a later run's resume.
@@ -122,11 +170,17 @@ export async function runPhase(ctx) {
         source: ctx.role,
         type: "run_start",
         run: runNumber,
+        // A run routed onto the image-capable target — a blind-read handoff or an attachment
+        // preflight — is stamped so the feed shows the reroute and the model it landed on.
+        ...(s.imageRerouteActive ? { reroute: "image" } : {}),
         ...modelSelectorField(cfg),
     });
     let outcome;
     try {
-        outcome = await ctx.runOnce(cfg, { fallback, probe: probing, primary: primaryCfg });
+        // The preflight can end the run before any pi spawns: a text-only runner with an image
+        // attachment and no image-capable target has nothing to run, so it errors without
+        // spending a model call. Everything else runs the pipeline as usual.
+        outcome = preflightBlocked ? { result: "error" } : await ctx.runOnce(cfg);
     }
     catch (err) {
         outcome = { result: "error" };
@@ -170,7 +224,7 @@ export async function runPhase(ctx) {
 /** The run pipeline's start half: resume-or-fresh policy, then run in the director's own
  * worktree or on a leased pool slot. Returns the setup's outcome; a null plan means nothing to
  * run. */
-export async function runOncePhase(ctx, cfg, fallbackCtx) {
+export async function runOncePhase(ctx, cfg) {
     const s = ctx.state;
     // How this run starts — resume the interrupted session or run fresh, and which prompt —
     // is the resume policy, not runner mechanics: it lives in src/run/run-resume.ts, which also
@@ -192,14 +246,25 @@ export async function runOncePhase(ctx, cfg, fallbackCtx) {
     if (plan === null)
         return { result: "skipped" };
     if (ctx.role === DIRECTOR_ROLE) {
+        // The image-reroute one-shot marker routes exactly ONE run onto the image-capable
+        // target (plans/image-input.md part 4/5, INV-J2): for a role runner, planRunStart consumes
+        // it after reading its handoff-note facts. The director never resumes, so planRunStart's
+        // image-reroute branch never runs for it and the marker would otherwise linger and
+        // re-route every later director run off its own tier. It is cleared here — after this
+        // run is confirmed to run (an empty-inbox skip above returns before this, leaving the
+        // reroute pending for the next eligible run) — so the rerouted director prompt is
+        // delivered exactly once and the director is back on its own tier next.
+        // A promptless recovery run delivers no prompt, so it leaves a pending reroute for the next.
+        if (plan.prompt !== null)
+            s.imageReroute = undefined;
         // The director keeps its dedicated worktree (it runs outside the permit, consumes its
         // config-request file at that exact path, and never resumes). Hold it from before
         // ensureWorktree — creating or resetting it is part of the use — to the run's end
         // (plans/disk-floor.md, part 2/4), so a concurrent pressure reclaim never cleans a tree
         // this run is creating or working in.
-        return useWorktree(ctx.root, worktreePath(ctx.root, ctx.role), () => runWithWorktreePhase(ctx, plan, cfg, fallbackCtx));
+        return useWorktree(ctx.root, worktreePath(ctx.root, ctx.role), () => runWithWorktreePhase(ctx, plan, cfg));
     }
-    return runOnceInLeasePhase(ctx, plan, cfg, fallbackCtx);
+    return runOnceInLeasePhase(ctx, plan, cfg);
 }
 /** Whether a finished role run's leased slot must stay pinned for the next run's resume —
  * the resume flag a verdict armed inside the run (`resumePending`), an abort or quiet kill,
@@ -220,7 +285,7 @@ export function slotPinnedForResume(state, outcome) {
  * leases next. A run an exception ends releases its slot unsettled, so edits it leaves there
  * are saved for the role's next run, and a run on a fresh checkout first takes back any such
  * work an earlier run of the role left (restoreSalvagedPhase). */
-async function runOnceInLeasePhase(ctx, plan, cfg, fallbackCtx) {
+async function runOnceInLeasePhase(ctx, plan, cfg) {
     const lease = await leaseSlot(ctx.root, {
         role: ctx.role,
         purpose: "run",
@@ -238,7 +303,7 @@ async function runOnceInLeasePhase(ctx, plan, cfg, fallbackCtx) {
             await checkoutRoleBranchPhase(ctx, lease.dir);
             run = await restoreSalvagedPhase(ctx, plan, lease.dir);
         }
-        outcome = await runWithWorktreePhase(ctx, run, cfg, fallbackCtx, lease.dir);
+        outcome = await runWithWorktreePhase(ctx, run, cfg, lease.dir);
         return outcome;
     }
     finally {
@@ -288,7 +353,7 @@ async function checkoutRoleBranchPhase(ctx, dir) {
     }
     await git(dir, "clean", "-fd");
 }
-async function runWithWorktreePhase(ctx, plan, cfg, fallbackCtx, 
+async function runWithWorktreePhase(ctx, plan, cfg, 
 /** The leased slot the run runs in; omitted by the director, which ensures its own. */
 leasedDir) {
     const s = ctx.state;
@@ -309,7 +374,7 @@ leasedDir) {
         });
     }
     else {
-        // Salvage a commit a previous run left unmerged (src/runner/leftover.ts): recovery puts it
+        // Salvage a commit a previous run left unmerged (runner-leftover.ts): recovery puts it
         // back on the merge queue, so it merges through the orchestrator's merge pipeline — the
         // same gate as a fresh run's change, and main keeps exactly one writer (an in-run
         // recovery merge raced the slot's batches into `merge_blocked`). A salvaged leftover
@@ -526,17 +591,14 @@ leasedDir) {
     await foldAgentCommitsSince(ctx, wt, runBase);
     // A write that landed in the primary checkout never reaches the worktree's commit, so the run
     // can read as no_change with its work orphaned (BUGS.md, 2026-10-20). The before/after diff
-    // cannot attribute paths to this run when roles overlap, so only warn: the verdict, resume
-    // handling and model-fallback fold below stay as they were.
+    // cannot attribute paths to this run when roles overlap, so only warn: the verdict and
+    // resume handling below stay as they were.
     const primaryAfter = primaryBefore === null ? null : await changedFiles(ctx.root).catch(() => null);
     const strayed = primaryAfter === null ? [] : primaryAfter.filter((f) => !primaryBefore.includes(f));
     if (strayed.length > 0 && !pi.aborted) {
         const shown = strayed.slice(0, 10).join(", ") + (strayed.length > 10 ? `, … (${strayed.length} paths)` : "");
         ctx.warn(`wrote outside the worktree (possibly another writer's): ${shown}`);
     }
-    // Fold the authoring run's verdict into the role's model-fallback episode NOW, before the
-    // post-run handlers spend any more pi runs: only this run is evidence about the primary.
-    ctx.foldModelFallback(fallbackCtx, pi);
     // The `qa` observer's reply ends with a result-carrying `FLOW:` line (plans/observer-roles.md
     // 2/2). Extracted once here, recorded only at the success returns below — an interrupted or
     // failed run must not advance the rotation. The harness records it, never pi.

package/dist/src/runner/runner-state-load.js

@@ -139,8 +139,8 @@ export function loadRunnerState(root, role) {
             r && typeof r.patchId === "string" && typeof r.sessionDir === "string" ? r : undefined;
     }
     // The nested scheduling records carry the same numeric class — epoch-ms stamps, recovery
-    // counts, and the fallback episode's clock — and are read by comparison or arithmetic
-    // (`ctx.now - claim.at > CLAIM_IDLE_MAX_MS`, `prior.count + 1`, `cooldownMs * 2`), so a
+    // counts, and retry/review counts — and are read by comparison or arithmetic
+    // (`ctx.now - claim.at > CLAIM_IDLE_MAX_MS`, `prior.count + 1`, `attempts + 1`), so a
     // foreign value there is healed the same way the top-level fields are.
     if (s.lastReview !== undefined)
         s.lastReview = healRecord(s.lastReview, (v) => {
@@ -201,13 +201,16 @@ export function loadRunnerState(root, role) {
         });
     if (s.mergeFlakeExcused !== undefined && typeof s.mergeFlakeExcused !== "string")
         delete s.mergeFlakeExcused;
-    if (s.modelFallback !== undefined)
-        s.modelFallback = healRecord(s.modelFallback, (v) => {
-            v.failures = healNumber(v.failures, 0);
-            v.since = healNumber(v.since, 0);
-            v.probeAt = healNumber(v.probeAt, 0);
-            v.cooldownMs = healNumber(v.cooldownMs, 0);
-        });
+    // The image-reroute marker is a one-shot nested record consumed by the next run; a torn
+    // scalar is dropped (its consumers read/mutate fields), and the tier is repaired to a
+    // known tier name so a corrupt tier cannot route a rerouted run to a phantom seam.
+    if (s.imageReroute !== undefined) {
+        const healed = healRecord(s.imageReroute, () => { });
+        s.imageReroute =
+            healed && (healed.tier === "small" || healed.tier === "default" || healed.tier === "strong")
+                ? healed
+                : undefined;
+    }
     return s;
 }
 /** Per-role cache of the persisted live claim, keyed by the state file's stat — one stat per

package/dist/src/runner/runner.js

@@ -6,15 +6,12 @@ import { logEventBestEffort, warnEventBestEffort } from "../events/events.js";
 import { promptPreview } from "../inbox/inbox.js";
 import { assembleRunPrompt } from "../run/run-prompt.js";
 import { RunnerPi } from "./runner-pi.js";
-import { configForRole, seamHoldKey, } from "../config/config-views.js";
-import { fallbackRoleConfig } from "../config/config-fallbacks.js";
+import { configForRole, seamHoldKey, withModelOverrides, } from "../config/config-views.js";
 import { PendingPrompt } from "../inbox/pending-prompt.js";
-import { modelFallbackActive } from "./model-fallback.js";
 import { clearBackoff } from "../scheduling/backoff.js";
 import { RunUsage } from "../run/run-usage.js";
 import { runOncePhase, runPhase, } from "./runner-run.js";
 import { finishAbortedRunPhase, finishRecoveryRunPhase, pinAndResetPhase, } from "./runner-recovery.js";
-import { foldModelFallbackPhase } from "./runner-fallback.js";
 /** One role runner: owns a persistent worktree + branch and runs one run at a time. */
 export class RoleRunner {
     root;
@@ -73,6 +70,13 @@ export class RoleRunner {
      * resolve to, since different roles may run on different pairs.
      * Transient — never persisted — and captured fresh at every run start. */
     runPair;
+    /** Whether the budget gate currently has the team on its free fallback pairs (src/gates/
+     * budget-gates.ts onFallback, set alongside `config` by the orchestrator's poll): an
+     * image reroute may then look only among the free fallback pairs, never a priced primary
+     * (plans/image-input.md "Reroute target" "Regime"). Pure scheduler input, never whether
+     * the runner itself is mid-fallback; defaults false, so standalone-runner tests stay on the
+     * primary regime unless they set it. */
+    budgetFallbackActive = false;
     /** The merge failure this run's leftover recovery is retrying, if any (a retriable merger
      * outcome that kept the pin, which recovery re-queued): set in finishRecoveryRun and
      * attached to the returned RunOutcome so applyRunOutcome can feed it into the error streak
@@ -117,7 +121,6 @@ export class RoleRunner {
             this.state.resumePending = true;
         this.state.running = false;
         this.state.parkedSince = undefined;
-        this.state.parkedOn = undefined;
     }
     save() {
         saveRunnerState(this.root, this.state);
@@ -174,22 +177,39 @@ export class RoleRunner {
     runModelPair() {
         return this.state.running ? (this.runPair ?? null) : null;
     }
-    /** The config this role's NEXT run will run on: the tier fallback pair while the episode is
-     * active (a due probe runs the primary), else the role's own resolved config. The hold and
-     * start passes read this so a role mid-episode is keyed by the provider it will actually use.
-     * Pure read of config + state + the caller's clock. */
-    runConfig(now) {
-        const fallback = fallbackRoleConfig(this.config, this.role);
-        if (fallback !== null && modelFallbackActive(this.state.modelFallback, now))
-            return fallback;
+    /** Which pair set an image reroute may look among (plans/image-input.md "Reroute target"
+     * "Regime"): the free fallback pairs while the budget gate is on fallback; otherwise the
+     * primary tiers. One home for the rule, shared by the target-resolution sites (the verdict's
+     * reroute arm, the attachment preflight). */
+    rerouteRegime() {
+        return this.budgetFallbackActive ? "fallback" : "primary";
+    }
+    /** The config this role's NEXT run will run on: a pending image reroute's target, else the
+     * role's own resolved config (configForRole). The hold and start passes read this so a role
+     * is keyed by the provider it will use. The budget gate's fallback pair, when a cap episode
+     * is active, is installed into the live config itself, so this read already names the pair
+     * the run uses. */
+    runConfig() {
+        // A pending image-input reroute (plans/image-input.md part 4/5) outranks the role's own
+        // tier: the next run starts on the image-capable target the blind-read run recorded,
+        // rebuilt from the stored seam over the live config.
+        if (this.state.imageReroute) {
+            const r = this.state.imageReroute;
+            return withModelOverrides(this.config, r.tier, {
+                backend: r.backend,
+                provider: r.provider,
+                model: r.model,
+                thinking: r.thinking,
+            });
+        }
         return configForRole(this.config, this.role);
     }
-    /** The seam key `runConfig(now)` resolves to (config-views.ts seamHoldKey): the agent id
+    /** The seam key `runConfig()` resolves to (config-views.ts seamHoldKey): the agent id
      * for a non-pi backend (claude seams carry no pi provider), else the pi provider. The hold
      * and start passes read only this, so a claude seam is gated by a `claude` hold and pi's
      * default seams (undefined) are not. */
-    runProvider(now) {
-        return seamHoldKey(this.runConfig(now));
+    runProvider() {
+        return seamHoldKey(this.runConfig());
     }
     /** The signal every pi run of the current run watches: harness shutdown OR a per-run user
      * abort (Node ≥ 20's AbortSignal.any). */
@@ -258,19 +278,15 @@ export class RoleRunner {
         this.usage.fold(this.state, run, false, provider, pair);
     }
     /** Run one full run of this role runner (the pipeline lives in src/runner/runner-run.ts):
-     * `runPhase` resolves the config and fallback episode, logs run_start, runs the pipeline,
+     * `runPhase` resolves the role's own config, logs run_start, runs the pipeline,
      * and finalizes. Never throws: a failed run is an "error" result, saved and logged. */
     async run() {
         return runPhase(this.runContext());
     }
-    /** Thin delegate to foldModelFallbackPhase (src/runner/runner-fallback.ts). */
-    foldModelFallback(fallbackCtx, pi) {
-        foldModelFallbackPhase(this.runContext(), fallbackCtx, pi);
-    }
     /** The run pipeline's entry (src/runner/runner-run.ts): a thin delegate so `run` assembles
      * phase context once and tests can still override `runOnce` to bypass the pipeline. */
-    async runOnce(cfg, fallbackCtx) {
-        return runOncePhase(this.runContext(), cfg, fallbackCtx);
+    async runOnce(cfg) {
+        return runOncePhase(this.runContext(), cfg);
     }
     /** Assemble the run pipeline's host context (src/runner/runner-run.ts) from this runner's
      * fields. `config` and `recoveryFailure` are live getters, so a mid-run change is seen as
@@ -293,13 +309,14 @@ export class RoleRunner {
             warn: (message) => this.warn(message),
             runSignal: () => this.runSignal(),
             runPrompt: (backend) => this.runPrompt(backend),
+            rerouteRegime: () => this.rerouteRegime(),
             get recoveryFailure() {
                 return self.recoveryFailure;
             },
             setRecoveryFailure: (message) => {
                 self.recoveryFailure = message;
             },
-            runOnce: (cfg, fallbackCtx) => this.runOnce(cfg, fallbackCtx),
+            runOnce: (cfg) => this.runOnce(cfg),
             setRunPair: (pair) => {
                 self.runPair = pair;
             },
@@ -312,7 +329,6 @@ export class RoleRunner {
             },
             finishAbortedRun: (userPrompt, wt) => this.finishAbortedRun(userPrompt, wt),
             pinAndReset: (wt, sha) => this.pinAndReset(wt, sha),
-            foldModelFallback: (fallbackCtx, pi) => this.foldModelFallback(fallbackCtx, pi),
             finishRecoveryRun: (recovered, userPrompt, wt, priorMergeFailure) => this.finishRecoveryRun(recovered, userPrompt, wt, priorMergeFailure),
         };
     }

package/dist/src/scheduling/claims.js

@@ -152,10 +152,6 @@ export function workReserveCount(root, runners, opts) {
             continue;
         if (r.state.running || opts.queuedMergeRoles.has(r.role))
             continue;
-        // A work role whose provider is full (capped and at its cap) cannot use a reserved permit
-        // anyway, so it must not withhold one from another provider's maintenance run (§6).
-        if (opts.providerHasHeadroom !== undefined && !opts.providerHasHeadroom(r))
-            continue;
         const eligible = eligibleFor(base);
         const holdsClaim = r.state.claim !== undefined && eligible.has(r.state.claim.key);
         const hasFreeEntry = [...eligible].some((k) => !(heldByBase.get(base)?.has(k) ?? false));