tumwater 0.4.2 → 0.4.3

package/dist/src/scheduling/scheduling.js

@@ -13,91 +13,78 @@ import { BUGFIX_ROLE, DEFERRABLE_ROLES, DIRECTOR_ROLE, roleTier, } from "../role
 import { baseRoleOf, runnerEnabled } from "../roles/runner-ids.js";
 import { HOUR_MS } from "../text/datetime.js";
 import { yieldMultiplierFor } from "./backoff.js";
-/** Should this role run now? `inboxCount` is the calling role's own queued-prompt count
- * (the director's queue for the director, the per-role queue for everyone else) — see the
- * inbox check below. Exported for tests. */
-export function isEligible(runner, now, mainHead, inboxCount, opts = {}) {
-    const s = runner.state;
-    // A role disabled in tumwater.json stops running immediately (live-reload); re-enabling
-    // resumes within one poll cycle because the runner and its persisted state survive.
-    if (!runnerEnabled(runner.config, runner.role))
-        return { run: false };
-    if (s.running)
-        return { run: false };
-    // The director carries the user's own requests: no min-gap, no backoff — a queued
-    // prompt runs as soon as the previous one finishes.
-    if (runner.role === DIRECTOR_ROLE) {
-        if (inboxCount > 0)
-            return { run: true, reason: "inbox" };
-        if (opts.leftoverPending)
-            return now >= s.nextRunAt ? { run: true, reason: "leftover" } : { run: false };
-        return { run: false };
-    }
-    // An interrupted run (graceful abort or crash) leaves half-finished work in its pi
-    // session and worktree: resume it promptly on restart instead of holding it for a full
-    // interval — the min gap below throttles scheduled runs, not recovery. nextRunAt still
-    // gates cut-off resumes, which deliberately wait one interval from their compacted context.
-    // A queued prompt never preempts this gate: a resuming run assembles buildResumePrompt
-    // and does not dequeue the per-role queue, so an early run would only resume sooner than
-    // its deliberate wait — the prompt is consumed by the fresh run the inbox check below
-    // makes due the moment the resume finishes.
+/** Can the runner start at all right now? A role disabled in tumwater.json stops running
+ * immediately (live-reload; re-enabling resumes within one poll cycle because the runner and
+ * its persisted state survive), and an already-running role is never eligible. Either way the
+ * runner holds this poll — the single gate behind isEligible's two early returns. */
+function blockedFromRunning(runner, s) {
+    return !runnerEnabled(runner.config, runner.role) || s.running === true;
+}
+/** The director carries the user's own requests: no min-gap, no backoff — a queued prompt
+ * runs as soon as the previous one finishes. Reaches either arm and always resolves. */
+function directorGate(s, now, inboxCount, opts) {
+    if (inboxCount > 0)
+        return { run: true, reason: "inbox" };
+    if (opts.leftoverPending)
+        return now >= s.nextRunAt ? { run: true, reason: "leftover" } : { run: false };
+    return { run: false };
+}
+/** An interrupted run (graceful abort or crash) resumes promptly on restart; nextRunAt still
+ * gates cut-off resumes, which deliberately wait one interval. A queued prompt never preempts
+ * this gate. Resolves only when a resume is pending, else undefined. */
+function resumeGate(s, now) {
     if (s.resumePending) {
         return now >= s.nextRunAt ? { run: true, reason: "resume" } : { run: false };
     }
-    // A queued per-role prompt is due on its own existence, exactly like the director's inbox:
-    // no min-gap, no backoff, no scheduled clock. The queue is the durable record of the
-    // demand, so it survives every race a wake marker cannot — a wake consumed while a run
-    // is in flight is overwritten by that run's end-save (runner.ts's wake() contract), but the
-    // prompt file it enqueued is not, and this check picks the demand up on the first poll
-    // after the run ends.
+    return undefined;
+}
+/** A queued per-role prompt is due on its own existence, exactly like the director's inbox: no
+ * min-gap, no backoff, no scheduled clock. The queue is the durable record of the demand. */
+function inboxGate(inboxCount) {
     if (inboxCount > 0)
         return { run: true, reason: "inbox" };
-    // The per-role interval (a slow clock, e.g. the steward's ~6 h) gates scheduled runs and
-    // "main moved" early wakes — resolved here so a live-reloaded config applies. An operator
-    // wake overrides it (the woken check below): it is an explicit demand, the same class of
-    // request the director's inbox runs without any gap.
-    //
-    // Yield scaling: for a scalable role the gap is
-    // multiplied by the multiplier its recent results earned — a search role that keeps
-    // finding nothing slows down, and the multiplication gates the "main moved" wake below
-    // too, which is where the cost actually comes from (the gap check above runs first, so a
-    // scaled role inside its stretched gap neither runs on schedule nor on a main move).
-    // One merge in the last ten counted runs restores the plain gap; error-class results
-    // never enter the ring (backoff.ts), so a failing backend does not stretch anything;
-    // `--once`, an operator wake, and a queued prompt all bypass the gap check entirely.
+    return undefined;
+}
+/** The per-role interval (a slow clock) gates scheduled runs and "main moved" early wakes.
+ * Yield scaling multiplies the gap; an operator wake overrides it. Resolves with the hold when
+ * the runner is inside the (possibly stretched) gap, else undefined. */
+function gapGate(runner, s, now, opts) {
     const mult = yieldMultiplierFor(runner.state);
-    // The same planBacklogOpen rule (scheduleConfigForRole) runner-run.ts schedules nextRunAt
-    // from: while PLANS.md has planning room, plan runs on a zero gap; once the target is met it
-    // drops to its 3600 s default (the plans-full deferral then holds the run). Yield scaling
-    // still applies to whatever gap is chosen.
     const minGapSeconds = scheduleConfigForRole(runner.config, runner.role, opts.planBacklogOpen === true).minRunIntervalSeconds;
     const minGap = opts.once ? 0 : minGapSeconds * 1000 * mult;
     const sinceLast = now - (s.lastRunEndedAt ?? 0);
-    // An operator wake newer than the gap window's opening run overrides the interval
-    // (RunnerState.wokenAt): an explicit "try again now" with an empty queue must not silently
-    // wait out the remaining slow clock it ran inside — a queued prompt carries its own
-    // due-ness in the inbox check above, so it never depends on this stamp surviving.
     const woken = freshlyWoken(s);
     if (sinceLast < minGap && !woken) {
-        // Held inside the stretched gap: the runner is not due this poll (a schedule clock with
-        // the plain gap, or a main move under the multiplier, would otherwise admit it). Report
-        // the yield-scaled hold so the phase cell reads "waiting out its gap" instead of the
-        // bare "due — starts on the next poll" of the no-reason fallback (RunnerState.skipReason).
         return mult > 1 ? { run: false, skip: "yield-gap" } : { run: false };
     }
-    // Once mode's clock override, second half: a raised backoffSeconds means nextRunAt is a
-    // backoff deadline, not the scheduled clock, and is honored; at zero it is the clock a
-    // productive run scheduled, and the explicit round demand overrides it.
+    return undefined;
+}
+/** The scheduled clock, then the "main moved" wake. Once mode overrides the clock when
+ * backoffSeconds is 0 (a productive run scheduled it); a raised backoff honors the deadline.
+ * Resolves only once a scheduled reason applies, else undefined. */
+function scheduledGate(s, now, mainHead, opts) {
     if (now >= s.nextRunAt || (opts.once && s.backoffSeconds === 0)) {
         return { run: true, reason: s.runs === 0 ? "startup" : "scheduled" };
     }
-    // The world changed under a sleeping role: main moved since its last run. The stretched
-    // gap above gates this wake too (the gap check runs first), so a role whose recent runs
-    // merged nothing does not re-check on every merge — the multiplier's whole point.
     if (s.lastMainHead && mainHead && mainHead !== s.lastMainHead) {
         return { run: true, reason: "main moved" };
     }
-    return { run: false };
+    return undefined;
+}
+/** Should this role run now? `inboxCount` is the calling role's own queued-prompt count
+ * (the director's queue for the director, the per-role queue for everyone else) — see the
+ * inbox check below. Exported for tests. */
+export function isEligible(runner, now, mainHead, inboxCount, opts = {}) {
+    const s = runner.state;
+    if (blockedFromRunning(runner, s))
+        return { run: false };
+    if (runner.role === DIRECTOR_ROLE)
+        return directorGate(s, now, inboxCount, opts);
+    return (resumeGate(s, now) ??
+        inboxGate(inboxCount) ??
+        gapGate(runner, s, now, opts) ??
+        scheduledGate(s, now, mainHead, opts) ??
+        { run: false });
 }
 /** Fair scheduling order for one poll's eligible roles: the director always leads (it runs
  * the user's prompts), then the work tier (feature/bugfix/plan) before maintenance — a long-idle

package/dist/src/status/status-data.js

@@ -6,7 +6,7 @@ import { configForStatus, queueInFlight, mainCheckForPoll, maintenanceQuotaForPo
 import { quietHoursStatus, roleQuietHold } from "../scheduling/quiet-hours.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { pausedRoles, pausedRolesUntil, scheduledStopAt, scheduledWakes, standingTeamPause } from "../team/team-state.js";
-import { orchestratorAlive, readOrchestratorInfo, } from "../team/orchestrator-info.js";
+import { orchestratorAlive, readOrchestratorInfo, } from "../team/team-orchestrator-info.js";
 import { bootstrapHoldsRole, bootstrapStatus } from "../gates/bootstrap-gates.js";
 import { readMergeQueue } from "../merge/merge-queue.js";
 import { collectRoleRows } from "./status-roles.js";
@@ -175,7 +175,7 @@ export function snapshot(root, modelsPath = piModelsPath(), now = Date.now()) {
     // run or verification) or is pinned to — threaded into the roles collector so `running`,
     // `disk` and the rows agree.
     const slots = readSlotsState(root).slots;
-    const roleRows = collectRoleRows(root, cfg, now, slots, modelsPath, markerSet);
+    const roleRows = collectRoleRows(root, cfg, slots, modelsPath, markerSet);
     // Every role whose notes file runs past the read bound (status-role-notes.ts): the standing
     // twin of the doctor `role notes` row, raised as the amber role-notes-truncated alert.
     const roleNotesOverCap = collectRoleNotesOverCap(root);

package/dist/src/status/status-role-notes.js

@@ -1,6 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
-import { readTextOrNull } from "../files/files.js";
+import { readRegularTextOrNull } from "../files/files.js";
 import { cachedByStat } from "../files/stat-cache.js";
 import { roleNotesPath } from "../paths.js";
 import { ROLE_NOTES_MAX_BYTES } from "../agent/role-notes-write.js";
@@ -34,7 +34,7 @@ export function readRoleNotesOverCap(root) {
             continue;
         const file = path.join(notesDir, name);
         const chars = cachedByStat(noteLengthCache, file, file, () => {
-            const text = readTextOrNull(file);
+            const text = readRegularTextOrNull(file);
             return text === null ? null : text.length;
         }, (n) => n);
         if (chars === null)

package/dist/src/status/status-roles.js

@@ -1,12 +1,11 @@
 import path from "node:path";
 import { configForRole, modelSelectorField, roleSeamTier, } from "../config/config-views.js";
-import { modelFallbackView } from "../config/config-fallbacks.js";
 import { isCustomRole } from "../config/config.js";
 import { baseRoleOf, configuredInstances, instanceIndex, runnerIds, runnerPaused } from "../roles/runner-ids.js";
 import { errorStreakAtWarn, QUIET_KILL_RESUME_LIMIT } from "../run/run-apply.js";
 import { queuedMergeRoles } from "../merge/merge-queue.js";
 import { hasOutstandingWork } from "../runner/runner-state.js";
-import { formatModelSelector } from "../config/model-selector.js";
+import { formatModelSelector } from "../config/config-model-selector.js";
 import { piSettingsPath, readPiDefaultModel } from "../pi/pi-settings.js";
 import { isJsonObject } from "../files/json-object.js";
 import { runnerStateForPoll } from "./status-polls.js";
@@ -14,14 +13,14 @@ import { roleImageInfo } from "../agent/image-input.js";
 import { backendDefaultLabel } from "../agent/backend-traits.js";
 import { readPiListedModels } from "../pi/pi-listed-models.js";
 import { seamContextWindowForRole } from "../pi/pi-models.js";
-/** One row per enabled role id (part 5b/7). `configForRole`, `modelFallbackView`, the leased /
+/** One row per enabled role id (part 5b/7). `configForRole`, the leased /
  * pinned slot and the pi-default seam all resolve against the values `snapshot()` already
  * read once for the poll — the info and slots pins (threaded as `slots`) keep rows, `running`
- * and `disk` on the same shared reads, and `now` is the snapshot's pinned clock so every row
- * agrees on what "active" means. One read of pi's own saved default per poll (docs/backends.md)
- * serves the rows whose seam runs pi and resolves no model — its settings.json sits beside the
- * models catalog this snapshot reads (piSettingsPath), so one seam serves both. */
-export function collectRoleRows(root, cfg, now, slots, modelsPath, paused) {
+ * and `disk` on the same shared reads. One read of pi's own saved default per poll
+ * (docs/backends.md) serves the rows whose seam runs pi and resolves no model — its
+ * settings.json sits beside the models catalog this snapshot reads (piSettingsPath), so one
+ * seam serves both. */
+export function collectRoleRows(root, cfg, slots, modelsPath, paused) {
     // A surplus runner (index above `instances`, from the runner pool of plans/fast-merge.md
     // "Lever 1") with nothing to show gets no row, so the table does not list idle extras.
     // The exceptions are exactly the surplus runners an operator most needs to see and resume
@@ -59,19 +58,13 @@ export function collectRoleRows(root, cfg, now, slots, modelsPath, paused) {
         // only with a tier map declared, where it names the tier a role rides.
         const eff = configForRole(cfg, r);
         // The image-input surface (plans/image-input.md "Surfaces", part 5/5): the role's own
-        // capability and its reroute target, one shared resolver so the status rows, the role
-        // page, and the submit gate cannot disagree about who reads images or where a blind
-        // prompt would run.
+        // capability, one shared resolver so the status rows, the role page, and the submit gate
+        // cannot disagree about who reads images.
         const image = roleImageInfo(cfg, r, modelsPath, listed);
         // The peak-ctx share denominator (the role's context window, part 3c): resolved once per
         // poll here, beside `eff` (the same seam the role page resolves and names) — the same seam
         // `seamContextWindow` run against, so row, page and drawer cannot disagree.
         const contextWindow = seamContextWindowForRole(cfg, r, root, modelsPath);
-        // Model failure fallback, part 2/2: while the role's episode is active its agent runs use
-        // the tier-resolved fallback pair, so the row names that pair, the episode's start, and
-        // the failure that tripped it. `now` is the poll's own clock (the snapshot seam), so
-        // every row agrees on what "active" means.
-        const episode = modelFallbackView(base.modelFallback, cfg, r, now);
         // A seam that runs pi and resolves neither a provider nor a model starts on pi's own
         // saved default — name it in the row (modelFromPi) so the operator sees which model the
         // role runs. The config's `thinking` wins over the default's because tumwater passes it
@@ -106,7 +99,6 @@ export function collectRoleRows(root, cfg, now, slots, modelsPath, paused) {
                 ? {}
                 : { model: backendDefaultLabel(eff.agent) }),
             ...(isJsonObject(cfg.model) ? { modelTier: roleSeamTier(cfg, r) } : {}),
-            ...(episode !== null ? { fallback: episode } : {}),
             ...(contextWindow !== null ? { contextWindow } : {}),
             ...(slot ? { slot: path.basename(slot.dir), slotPinned: pinned !== undefined } : {}),
             ...(baseRoleOf(r) === r ? {} : { instanceOf: baseRoleOf(r) }),

package/dist/src/team/{error-storm.js → team-error-storm.js}

@@ -22,7 +22,7 @@ export const ERROR_STORM_ROLES = 3;
 export const ERROR_STORM_QUIET = { key: null, roles: [] };
 /** The config knob a shared cause points at, when one is known. Only the timeout cause is
  * mapped: `timed out after <dur>` is the reducer's pooled rendering of the run-timeout errors
- * (src/agent/run-agent.ts's two `timed out after ${runTimeoutSeconds}s` shapes, pooled into one
+ * (src/agent/agent-run.ts's two `timed out after ${runTimeoutSeconds}s` shapes, pooled into one
  * key by poolTimeoutKey — src/failure/failure-cluster.ts owns the two shapes and their
  * pooling), and a team-wide
  * run of it means the run budget does not fit the serving model — the one cause with a knob

package/dist/src/team/{failure-spread.js → team-failure-spread.js}

@@ -2,12 +2,12 @@
  * 2026-09-29 connection-storm entry): when many roles each fail a few times on one provider
  * failure kind, no existing bar trips — the per-role streak alarm needs one role DEEP
  * (ERROR_STREAK_WARN consecutive, src/run/run-apply.ts), the error-storm warning needs several
- * roles deep at once (src/team/error-storm.ts), and the team hold needs failures COALESCED within
- * a two-minute window (src/team/team-hold.ts). A degraded backend that fails the team widely and
- * shallowly — six runs across as many roles, each failure minutes apart — rides all three
- * gaps in silence. This alarm counts raw failures of one kind across roles in a rolling
+ * roles deep at once (src/team/team-error-storm.ts), and the team hold needs failures COALESCED
+ * within a two-minute window (src/team/team-hold.ts). A degraded backend that fails the team
+ * widely and shallowly — six runs across as many roles, each failure minutes apart — rides all
+ * three gaps in silence. This alarm counts raw failures of one kind across roles in a rolling
  * window, independent of any role's streak depth: the fourth bar, shaped for the spread the
- * other three cannot see. POLICY, on the shape of its siblings (src/team/error-storm.ts,
+ * other three cannot see. POLICY, on the shape of its siblings (src/team/team-error-storm.ts,
  * src/team/team-hold.ts): a pure reducer over the observations the orchestrator collects each
  * poll and the previous state, so the rule is unit-testable without a team and the
  * orchestrator owns only the wiring (the warning event). Like both siblings it has memory —

package/dist/src/team/team-hold.js

@@ -94,88 +94,121 @@ export function standingHolds(holds) {
     out.sort((a, b) => (a.provider ?? "").localeCompare(b.provider ?? ""));
     return out;
 }
-/** Step the hold by one orchestrator poll: from `prev` and every role's latest failure
- * observations, decide what holds at `now`. A held team stays held until `until` and then
- * re-opens by itself — nothing can get stuck, the same guarantee the budget gate's stateless
- * re-evaluation gives. An open team trips when HOLD_STORM_ROLES distinct roles each
- * ended a run on the same failure kind within the storm window (and after the last re-open) —
- * the first qualifying kind in observation order wins, since one poll can hold about only one
- * kind — for the longest of the escalated base hold and, for a rate-limit storm, the furthest
- * Retry-After deadline among those observations (each measured from its own 429, since that is
- * when the provider said it), capped at HOLD_CAP_MS. Returns `prev` itself when
- * nothing changed, so a caller can compare `until` across the step to find transitions. */
-export function teamHold(prev, observations, now) {
-    if (prev.until !== null) {
-        // A reserve hold is re-evaluated every poll: the window may since have been rejected (the
-        // director keeps running) or the reserve removed from the config, and either must show now.
-        if (now < prev.until && prev.reserve !== true)
-            return prev;
-        // The deadline passed: re-open, keeping provider/kind/escalation as the next storm's
-        // relapse memory, then fall through so a still-rejected subscription window (or a storm
-        // whose observations survived) holds again on this very poll rather than leaving one poll
-        // open. kind and provider stay because the next storm's relapse test compares against the
-        // hold that just ended.
-        prev = {
-            provider: prev.provider,
-            until: null,
-            kind: prev.kind,
-            roles: [],
-            escalation: prev.escalation,
-            reopenedAt: prev.reserve === true ? prev.reopenedAt : now,
-        };
-    }
-    // A rejected subscription usage window is the account-level throttle: it holds every seam on
-    // its provider until `resetsAt`, whatever the role count — the one observation kind the
-    // per-role storm rule below does not gate. Overage is real money and never holds (the run
-    // continues into paid overflow); a window with no future `resetsAt` holds nothing.
+/** Decide whether the current hold still stands or the deadline re-opens it: return `prev`
+ * itself while open or still held (and not a re-evaluated reserve), else the re-opened
+ * skeleton. A reserve hold is re-evaluated every poll: the window may since have been
+ * rejected (the director keeps running) or the reserve removed from the config, and either
+ * must show now. The deadline passed: re-open, keeping provider/kind/escalation as the next
+ * storm's relapse memory, then fall through so a still-rejected subscription window (or a
+ * storm whose observations survived) holds again on this very poll rather than leaving one
+ * poll open. kind and provider stay because the next storm's relapse test compares against
+ * the hold that just ended. */
+function reopenTeamHold(prev, now) {
+    if (prev.until === null)
+        return prev;
+    if (now < prev.until && prev.reserve !== true)
+        return prev;
+    return {
+        provider: prev.provider,
+        until: null,
+        kind: prev.kind,
+        roles: [],
+        escalation: prev.escalation,
+        reopenedAt: prev.reserve === true ? prev.reopenedAt : now,
+    };
+}
+/** The account-level subscription window hold, or undefined when none is rejected. A rejected
+ * subscription usage window is the account-level throttle: it holds every seam on its
+ * provider until `resetsAt`, whatever the role count — the one observation kind the
+ * per-role storm rule below does not gate. Overage is real money and never holds (the run
+ * continues into paid overflow); a window with no future `resetsAt` holds nothing. */
+function subscriptionWindowHold(observations, now, reopenedAt) {
     const window = observations.find((o) => o.kind === "subscription-window" && (o.resetsAt ?? 0) > now);
-    if (window !== undefined) {
-        return {
-            provider: window.provider,
-            until: window.resetsAt,
-            kind: "subscription-window",
-            roles: [],
-            escalation: 0,
-            reopenedAt: prev.reopenedAt,
-            ...(window.reserve === true ? { reserve: true } : {}),
-        };
-    }
-    const recent = observations.filter((o) => (prev.reopenedAt === null || o.at > prev.reopenedAt) && now - o.at <= HOLD_STORM_WINDOW_MS);
-    // Group the recent failures by provider+kind (in first-seen order, so the pick is
-    // deterministic) and hold about the first pair that has enough distinct roles behind it.
-    // undefined providers share one key: an unconfigured team is one backend by construction.
+    if (window === undefined)
+        return undefined;
+    return {
+        provider: window.provider,
+        until: window.resetsAt,
+        kind: "subscription-window",
+        roles: [],
+        escalation: 0,
+        reopenedAt,
+        ...(window.reserve === true ? { reserve: true } : {}),
+    };
+}
+/** The observations that can still count toward the next storm: failures after the last
+ * re-open (the storm that hold already answered, and any an in-flight run hit while it
+ * held — that run's own retry is already waiting it out) and inside the storm window. */
+function recentStormObservations(prev, observations, now) {
+    return observations.filter((o) => (prev.reopenedAt === null || o.at > prev.reopenedAt) && now - o.at <= HOLD_STORM_WINDOW_MS);
+}
+/** The first provider+kind group (in first-seen order, so the pick is deterministic) with
+ * HOLD_STORM_ROLES distinct roles behind it, or undefined when none qualifies — the answer
+ * to "which storm wins one poll?", since one poll can hold about only one kind. Undefined
+ * providers share one key: an unconfigured team is one backend by construction. */
+function firstStormGroup(recent) {
     const byProviderKind = new Map();
     for (const o of recent) {
         const key = `${o.provider ?? ""}\n${o.kind}`;
         getOrCreate(byProviderKind, key, () => ({ provider: o.provider, kind: o.kind, group: [] })).group.push(o);
     }
-    let storm = [];
-    let kind = null;
-    let provider;
     for (const entry of byProviderKind.values()) {
         const roles = new Set(entry.group.map((o) => o.role));
         if (roles.size >= HOLD_STORM_ROLES) {
-            storm = entry.group;
-            kind = entry.kind;
-            provider = entry.provider;
-            break;
+            return { provider: entry.provider, kind: entry.kind, storm: entry.group };
         }
     }
-    if (kind === null)
-        return prev;
-    const roles = sortedRoles(new Set(storm.map((o) => o.role)));
-    // A relapse is per provider AND kind: the same storm re-tripping inside the window
-    // escalates, while a different kind — or the same kind at a DIFFERENT provider — after a
-    // re-open is a new incident at the base.
+    return undefined;
+}
+/** The hold severity this storm earns: +1 on the previous escalation when it is a relapse of
+ * the just-ended hold, else 0. A relapse is per provider AND kind: the same storm re-tripping
+ * inside the window escalates, while a different kind — or the same kind at a DIFFERENT
+ * provider — after a re-open is a new incident at the base. */
+function holdEscalation(prev, provider, kind, now) {
     const relapse = prev.kind !== null &&
         prev.kind === kind &&
         prev.provider === provider &&
         prev.reopenedAt !== null &&
         now - prev.reopenedAt <= HOLD_RELAPSE_MS;
-    const escalation = relapse ? prev.escalation + 1 : 0;
+    return relapse ? prev.escalation + 1 : 0;
+}
+/** How long this storm's hold lasts: the longest of the escalated base hold and, for a
+ * rate-limit storm, the furthest Retry-After deadline among its observations (each measured
+ * from its own 429, since that is when the provider said it), capped at HOLD_CAP_MS. */
+function holdDurationMs(escalation, storm, now) {
     const retryAfterMs = Math.max(0, ...storm.map((o) => o.at + (o.retryAfterSeconds ?? 0) * 1000 - now));
-    const holdMs = Math.min(HOLD_CAP_MS, Math.max(HOLD_BASE_MS * 2 ** escalation, retryAfterMs));
-    return { provider, until: now + holdMs, kind, roles, escalation, reopenedAt: prev.reopenedAt };
+    return Math.min(HOLD_CAP_MS, Math.max(HOLD_BASE_MS * 2 ** escalation, retryAfterMs));
+}
+/** Step the hold by one orchestrator poll: from `prev` and every role's latest failure
+ * observations, decide what holds at `now`. A held team stays held until `until` and then
+ * re-opens by itself — nothing can get stuck, the same guarantee the budget gate's stateless
+ * re-evaluation gives. An open team trips when HOLD_STORM_ROLES distinct roles each
+ * ended a run on the same failure kind within the storm window (and after the last re-open) —
+ * the first qualifying kind in observation order wins, since one poll can hold about only one
+ * kind — for the longest of the escalated base hold and, for a rate-limit storm, the furthest
+ * Retry-After deadline among those observations (each measured from its own 429, since that is
+ * when the provider said it), capped at HOLD_CAP_MS. Returns `prev` itself when
+ * nothing changed, so a caller can compare `until` across the step to find transitions. */
+export function teamHold(prev, observations, now) {
+    const reopened = reopenTeamHold(prev, now);
+    if (reopened.until !== null)
+        return reopened;
+    const window = subscriptionWindowHold(observations, now, reopened.reopenedAt);
+    if (window !== undefined)
+        return window;
+    const group = firstStormGroup(recentStormObservations(reopened, observations, now));
+    if (group === undefined)
+        return reopened;
+    const escalation = holdEscalation(reopened, group.provider, group.kind, now);
+    const roles = sortedRoles(new Set(group.storm.map((o) => o.role)));
+    return {
+        provider: group.provider,
+        until: now + holdDurationMs(escalation, group.storm, now),
+        kind: group.kind,
+        roles,
+        escalation,
+        reopenedAt: reopened.reopenedAt,
+    };
 }
 /** The providers whose standing hold is the account's rejected subscription window (kind
  * "subscription-window", not a reserve crossing — the director is exempt from the reserve): the

package/dist/src/team/{orchestrator-info.js → team-orchestrator-info.js}

@@ -84,9 +84,7 @@ function parseBuild(v) {
         build.restartBlocked = v.restartBlocked;
     return build;
 }
-/** The published permit snapshot, or undefined for any foreign shape. Each `byKey` entry must
- * carry its two numbers; `limit` is kept only when it is a number, so a malformed provider
- * map is dropped to `undefined` rather than reaching a render that reads it as a valid cap. */
+/** The published permit snapshot, or undefined for any foreign shape. */
 /** One entry of the published provider-holds list, or undefined for any foreign shape: a
  * well-formed entry is an object with a finite `until` and a string `kind`; a `provider` that
  * is present but not a string drops the entry, so a guarded list keeps its well-formed
@@ -106,18 +104,7 @@ function parseCheckPermits(v) {
 function parsePermits(v) {
     if (!isJsonObject(v) || !isFiniteNumber(v.inUse) || !isFiniteNumber(v.limit) || !isFiniteNumber(v.reserve))
         return undefined;
-    if (!isJsonObject(v.byKey))
-        return undefined;
-    const byKey = {};
-    for (const [key, value] of Object.entries(v.byKey)) {
-        if (!isJsonObject(value) || !isFiniteNumber(value.inUse) || !isFiniteNumber(value.waiting))
-            continue;
-        const entry = { inUse: value.inUse, waiting: value.waiting };
-        if (isFiniteNumber(value.limit))
-            entry.limit = value.limit;
-        byKey[key] = entry;
-    }
-    return { inUse: v.inUse, limit: v.limit, reserve: v.reserve, byKey };
+    return { inUse: v.inUse, limit: v.limit, reserve: v.reserve };
 }
 function parseSlotPool(v) {
     if (!isJsonObject(v) || !isFiniteNumber(v.leased) || !isFiniteNumber(v.limit) || !isFiniteNumber(v.waiting))