tumwater 0.4.2 → 0.4.3

package/dist/src/verdict/fix-claim.js

@@ -263,12 +263,13 @@ function sourceHaystackSignature(root) {
     sigs.sort();
     return sigs.join("|");
 }
-/** Every file under the source dirs the haystack reads (src/, test/, scripts/), node_modules and
- * dist trees skipped at any depth. */
+/** Every file under the tree the haystack reads — the whole root, so a project whose code lives
+ * outside src//test//scripts/ (tools/, tests/, lib/, …) backs its symbols like a src/ one — with
+ * build output, vendored code, VCS and harness state skipped at any depth: node_modules, dist,
+ * .git and .tumwater. */
 function walkSourceFiles(root, visit) {
-    const skipDirs = new Set(["node_modules", "dist"]);
-    for (const dir of ["src", "test", "scripts"])
-        walkFiles(join(root, dir), visit, skipDirs);
+    const skipDirs = new Set(["node_modules", "dist", ".git", ".tumwater"]);
+    walkFiles(root, visit, skipDirs);
 }
 /** A slash-free name with a file extension: `status-roles.ts`, not `src/a.ts` or `signalTree`. */
 const FILE_NAME_RE = /^[^/]+\.[A-Za-z][\w-]*$/;
@@ -297,23 +298,15 @@ export function unbackedSymbols(root, symbols, haystack) {
 export function missingSymbolNames(missing) {
     return missing.length <= 3 ? missing.join(", ") : `${missing.slice(0, 3).join(", ")}…`;
 }
-/** The first false-fix claim in an md-only diff that touches BUGS.md, or undefined when the
- * diff backs its Fixed transitions (or makes none). `files` is the ahead-of-main path list
- * of the diff merging on `mainBranch`; the worktree `wt` holds the tree being merged. */
-export async function falseFixReason(wt, mainBranch, files) {
-    // Fixed entries live in BUGS.md's own section and in its archive, BUGS-FIXED.md
-    // (plans/backlog-archive.md): tumwater moves a fixed bug there right before the commit, so a
-    // fix claim reaches the gate as an archive edit, and an archived entry whose body is intact
-    // is no claim at all. Both sides of the comparison read both files.
-    if (!files.includes("BUGS.md") && !files.includes(BUGS_ARCHIVE))
-        return undefined;
-    // A deleted, unreadable, or non-regular (symlinked) file reads as empty: there is no Fixed
-    // transition to verify, so this check passes and lets the gate's sibling structural check
-    // (backlog-structure.ts) report the dropped section. Reading a symlink raw would pull an
-    // outside host file's `## Fixed` heading into this gate's verdict (the same lstat policy the
-    // backlog-conflict resolver and backlogStructureReason pin under INV-G3), so a head is read
-    // only when lstat shows a regular file; ENOENT and symlinks both read as empty.
-    const heads = ["BUGS.md", BUGS_ARCHIVE].map((f) => {
+/** The `## Fixed` heads of BUGS.md and its archive as read under the lstat policy: a deleted,
+ * unreadable, or non-regular (symlinked) file reads as empty — there is no Fixed transition to
+ * verify, so the gate's sibling structural check (backlog-structure.ts) reports the dropped
+ * section instead. Reading a symlink raw would pull an outside host file's `## Fixed` heading
+ * into the gate's verdict (the same lstat policy the backlog-conflict resolver and
+ * backlogStructureReason pin under INV-G3), so a head is read only when lstat shows a regular
+ * file; ENOENT and symlinks both read as empty. */
+function readFixedHeads(wt) {
+    return ["BUGS.md", BUGS_ARCHIVE].map((f) => {
         const full = join(wt, f);
         try {
             if (!lstatSync(full).isFile())
@@ -324,40 +317,40 @@ export async function falseFixReason(wt, mainBranch, files) {
         }
         return readTextOrNull(full) ?? "";
     });
-    if (!heads.some((head) => head.includes("## Fixed")))
-        return undefined;
-    // The diff's own base, not main's tip: the gate diffs `mainBranch...HEAD` against the
-    // merge-base, and the entry's Open/Fixed state lives in the tree the change builds on —
-    // pre-batch main can still carry the record as (falsely) Fixed and make an Open→Fixed
-    // restoration in a stacked batch compare as already done (BUGS.md 2026-09-23).
+}
+/** The base Fixed section bodies the diff's own merge-base holds, keyed by normalized heading.
+ * The base is the diff's own merge-base, not main's tip: the gate diffs `mainBranch...HEAD`
+ * against the merge-base, and the entry's Open/Fixed state lives in the tree the change builds
+ * on — pre-batch main can still carry the record as (falsely) Fixed and make an Open→Fixed
+ * restoration in a stacked batch compare as already done (BUGS.md 2026-09-23). Every base body
+ * under a heading counts: two distinct entries can share one normalized heading, and keeping
+ * only the last made the other read as rewritten (BUGS.md 2026-10-23). */
+async function baseFixedBodies(wt, mainBranch) {
     const baseRev = await changeBaseRev(wt, mainBranch);
     const bases = [await fileContentAt(wt, baseRev, "BUGS.md"), await fileContentAt(wt, baseRev, BUGS_ARCHIVE)];
-    // An already-Fixed entry is skipped only when its body is unchanged: an md-only edit that
-    // rewrites an existing Fixed record's narrative must face the symbol check too (BUGS.md
-    // 2026-09-23 — the in-place narrative rewrite is how a second phantom merge evaded it).
-    // Every base body under a heading counts: two distinct entries can share one normalized
-    // heading, and keeping only the last made the other read as rewritten (BUGS.md 2026-10-23).
-    const baseBodies = new Map();
+    const bodies = new Map();
     for (const e of bases.flatMap((base) => fixedEntries(base))) {
         const key = normalizeFixedHeading(e.title);
-        const bodies = baseBodies.get(key) ?? new Set();
-        bodies.add(e.body);
-        baseBodies.set(key, bodies);
+        const known = bodies.get(key) ?? new Set();
+        known.add(e.body);
+        bodies.set(key, known);
     }
-    // Built lazily, only once a Fixed record's body actually changed: the haystack walks and
-    // reads the entire source tree (~5 MB here), and the common BUGS.md edit moves nothing to
-    // Fixed — an Open bug added, a narrative touched elsewhere — so the gate and the in-lock
-    // recheck each paid that walk for a check that never reached a symbol.
-    let haystack;
-    const sections = heads.map((head) => fixedSection(head));
-    const entries = sections.flatMap((section) => section.entries);
-    const records = sections.flatMap((section) => section.records);
+    return { bases, bodies };
+}
+/** A changed full Fixed entry's rejection, or undefined when every changed entry backs its
+ * symbols. An already-Fixed entry is skipped only when its body is unchanged: an md-only edit
+ * that rewrites an existing Fixed record's narrative must face the symbol check too (BUGS.md
+ * 2026-09-23 — the in-place narrative rewrite is how a second phantom merge evaded it). The
+ * haystack is built lazily — only once a Fixed record's body actually changed — because it
+ * walks and reads the entire source tree (~5 MB here), and the common BUGS.md edit moves
+ * nothing to Fixed: an Open bug added, a narrative touched elsewhere, so the gate and the
+ * in-lock recheck each paid that walk for a check that never reached a symbol. */
+function movedEntryReason(wt, entries, bodies, getHaystack) {
     for (const { title: heading, body } of entries) {
-        const knownBodies = baseBodies.get(normalizeFixedHeading(heading));
+        const knownBodies = bodies.get(normalizeFixedHeading(heading));
         if (knownBodies?.has(body))
             continue;
-        haystack ??= sourceHaystack(wt);
-        const missing = unbackedSymbols(wt, fixSymbols(body), haystack);
+        const missing = unbackedSymbols(wt, fixSymbols(body), getHaystack());
         if (missing.length === 0)
             continue;
         const names = missingSymbolNames(missing);
@@ -372,10 +365,15 @@ export async function falseFixReason(wt, mainBranch, files) {
                 `paragraph now names code that exists nowhere on this tree: ${names} — include that ` +
                 `code in the same commit, or leave the entry's text as it was`;
     }
-    // One-line records are compressions of entries the base already holds as Fixed, and history
-    // keeps a renamed symbol's old name, so a record the diff adds or edits may carry forward any
-    // name the base's Fixed section already records. A name it introduces must exist on the tree:
-    // a bug moved straight from Open into a one-line record faces the same check as a full entry.
+    return undefined;
+}
+/** An added or edited one-line Fixed record's rejection, or undefined when each record either
+ * reproduces a base line or carries only names the base already holds. One-line records are
+ * compressions of entries the base already holds as Fixed, and history keeps a renamed symbol's
+ * old name, so a record the diff adds or edits may carry forward any name the base's Fixed
+ * section already records. A name it introduces must exist on the tree: a bug moved straight
+ * from Open into a one-line record faces the same check as a full entry. */
+function addedRecordReason(wt, records, bases, getHaystack) {
     const baseLines = bases.flatMap((base) => sectionLines(base, "Fixed")).map((line) => line.trim());
     const seen = new Set(baseLines);
     const baseText = baseLines.join("\n");
@@ -385,8 +383,7 @@ export async function falseFixReason(wt, mainBranch, files) {
         const introduced = fixSymbols(record).filter((symbol) => !baseText.includes(symbol));
         if (introduced.length === 0)
             continue;
-        haystack ??= sourceHaystack(wt);
-        const missing = unbackedSymbols(wt, introduced, haystack);
+        const missing = unbackedSymbols(wt, introduced, getHaystack());
         if (missing.length === 0)
             continue;
         return (`md-only BUGS.md edit adds the one-line Fixed record "${truncate(record, RECORD_QUOTE_MAX)}", ` +
@@ -396,3 +393,28 @@ export async function falseFixReason(wt, mainBranch, files) {
     }
     return undefined;
 }
+/** The first false-fix claim in an md-only diff that touches BUGS.md, or undefined when the
+ * diff backs its Fixed transitions (or makes none). `files` is the ahead-of-main path list
+ * of the diff merging on `mainBranch`; the worktree `wt` holds the tree being merged. */
+export async function falseFixReason(wt, mainBranch, files) {
+    // Fixed entries live in BUGS.md's own section and in its archive, BUGS-FIXED.md
+    // (plans/backlog-archive.md): tumwater moves a fixed bug there right before the commit, so a
+    // fix claim reaches the gate as an archive edit, and an archived entry whose body is intact
+    // is no claim at all. Both sides of the comparison read both files.
+    if (!files.includes("BUGS.md") && !files.includes(BUGS_ARCHIVE))
+        return undefined;
+    const heads = readFixedHeads(wt);
+    if (!heads.some((head) => head.includes("## Fixed")))
+        return undefined;
+    const { bases, bodies } = await baseFixedBodies(wt, mainBranch);
+    const sections = heads.map((head) => fixedSection(head));
+    const entries = sections.flatMap((section) => section.entries);
+    const records = sections.flatMap((section) => section.records);
+    // Built lazily, shared by both checks, only once a Fixed record's body actually changed: the
+    // haystack walks and reads the entire source tree (~5 MB here), and the common BUGS.md edit
+    // moves nothing to Fixed — an Open bug added, a narrative touched elsewhere — so the gate and
+    // the in-lock recheck each paid that walk for a check that never reached a symbol.
+    let haystack;
+    const getHaystack = () => (haystack ??= sourceHaystack(wt));
+    return movedEntryReason(wt, entries, bodies, getHaystack) ?? addedRecordReason(wt, records, bases, getHaystack);
+}

package/dist/src/verdict/refusal.js

@@ -106,7 +106,7 @@ async function stripBlockedPlanRefusalNotes(ctx, wt) {
             // and a plain writeFileSync that a kill interrupted would commit a truncated file,
             // permanently dropping the plan entries past the cut point. writeTextAtomic is the
             // harness's one write-to-temp-then-rename entry point — the same one backlog-write.ts
-            // and question-answer.ts use for the markdown backlog files.
+            // and backlog-question-answer.ts use for the markdown backlog files.
             try {
                 writeTextAtomic(plansFile, md);
                 for (const title of dropped) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tumwater",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Opinionated autonomous development harness built on pi. You write the initial prompt; role-driven loops build the project.",
   "type": "module",
   "license": "MIT",
@@ -37,10 +37,10 @@
     "build": "rm -rf dist && tsc && node scripts/stamp-build.mjs",
     "prepack": "npm run build",
     "lint": "eslint . --cache",
-    "test": "node scripts/live-checkout-guard.mjs && eslint . --cache && tsc --incremental && node scripts/stamp-build.mjs && node dist/test/test-runner.js",
-    "test:gate": "node scripts/live-checkout-guard.mjs && eslint . --cache && tsc --incremental && node scripts/stamp-build.mjs && node dist/test/test-runner.js --affected",
-    "test:e2e": "node scripts/live-checkout-guard.mjs && tsc --incremental && node scripts/stamp-build.mjs && node dist/test/test-runner.js e2e",
-    "test:coverage": "node scripts/live-checkout-guard.mjs && tsc --incremental && node scripts/stamp-build.mjs && node dist/test/test-runner.js --coverage",
+    "test": "node scripts/live-checkout-guard.mjs && eslint . --cache && tsc --incremental && node scripts/stamp-build.mjs && node scripts/check-permit.mjs node dist/test/test-runner.js",
+    "test:gate": "node scripts/live-checkout-guard.mjs && eslint . --cache && tsc --incremental && node scripts/stamp-build.mjs && node scripts/check-permit.mjs node dist/test/test-runner.js --affected",
+    "test:e2e": "node scripts/live-checkout-guard.mjs && tsc --incremental && node scripts/stamp-build.mjs && node scripts/check-permit.mjs node dist/test/test-runner.js e2e",
+    "test:coverage": "node scripts/live-checkout-guard.mjs && tsc --incremental && node scripts/stamp-build.mjs && node scripts/check-permit.mjs node dist/test/test-runner.js --coverage",
     "smoke:claude": "node scripts/smoke-claude.mjs",
     "smoke:opencode": "node scripts/smoke-opencode.mjs",
     "smoke:codex": "node scripts/smoke-codex.mjs",

package/dist/src/concurrency/provider-lease.js

@@ -1,105 +0,0 @@
-/** The AsyncLocalStorage store that lets a run's lease follow its runs across providers
- * (plans/provider-concurrency.md §5): a lease rides here for the length of a run, a verify task,
- * or a resolver run, and `RunnerPi.runWithTransientRetry` re-keys it to the provider each run
- * actually uses. The one choke point every run a role makes (authoring, gate, merge and resolver)
- * passes through, so a budget handback or a model-failure switch that moves a run in flight to
- * another provider moves the lease with it instead of leaving it parked on the key it was admitted
- * on. The check-permit.ts `holdingPermit` store is the pattern: nothing here is a separate permit,
- * only the single lease the run path already holds.
- *
- * The store carries the `piDefault` (the caller's cached readPiDefaultModel result) beside the
- * lease so `ensureProviderLease` can resolve a bare no-model pi seam's key exactly as the
- * admission/review seam did — a run whose key were computed without it would re-key a default
- * team's run off pi's own provider. It also carries the semaphore and, optionally, wait
- * hooks, so a re-key that has to park on a full target key reports its wait the way a parked
- * resolver does (merge-verify.ts's providerWaitStage). */
-import { AsyncLocalStorage } from "node:async_hooks";
-import { seamConcurrencyKey } from "../config/config-views.js";
-const providerLeaseStore = new AsyncLocalStorage();
-/** Run `run` with `lease` in the provider-lease store, so any run it makes re-keys that lease to
- * the provider it actually uses (ensureProviderLease). `opts.piDefault` is the caller's cached pi
- * default model, so a bare no-model seam resolves to the same key the admission or review seam
- * used; `opts.hooks` (the verify: providerWaitStage) hears a re-key wait, if there is one. The same
- * lease object is released by the caller after the store is unwrapped — a re-key mutates it in
- * place, so release() frees whatever key the run path ended on. */
-export function withProviderLease(lease, semaphore, run, opts = {}) {
-    return providerLeaseStore.run({ lease, semaphore, piDefault: opts.piDefault, hooks: opts.hooks }, run);
-}
-/** Re-key the calling lease to the provider `cfg` runs on, if it is not there yet. No-op when
- * the current async context carries no lease (a direct RunnerPi unit test, `tumwater history`) or
- * when the run is already on the lease's key. When it does re-key and `hooks` are present and
- * the target key is at its cap, the hooks hear `waiting` before the lease parks and `granted`
- * once the key frees — a re-key never waits on the team total (it already holds a team
- * permit), only on the target key's headroom. */
-export async function ensureProviderLease(cfg) {
-    const ctx = providerLeaseStore.getStore();
-    if (!ctx)
-        return;
-    const key = seamConcurrencyKey(cfg, ctx.piDefault);
-    if (ctx.lease.key === key)
-        return;
-    // The leased currently holds `old` (or nothing); the target key's in-use does not include it,
-    // so the key being at its cap is exactly whether rekey() will park.
-    const parks = ctx.hooks !== undefined && keyAtCap(ctx, key);
-    if (parks)
-        ctx.hooks.waiting();
-    await ctx.lease.rekey(key);
-    if (parks)
-        ctx.hooks.granted();
-}
-/** Whether `key` is at its configured cap right now (an absent or uncapped key is not) — the
- * same test semaphore.drive uses to withhold a re-key grant, decided from the live snapshot so
- * a re-key wait can be announced before the lease parks (providerWaitStage). */
-function keyAtCap(ctx, key) {
-    if (key === undefined)
-        return false;
-    const entry = ctx.semaphore.snapshot().byKey[key];
-    return entry?.limit !== undefined && entry.inUse >= entry.limit;
-}
-/** The pool-slot wait rule (plans/provider-concurrency.md §5 "No deadlock"): a lease never holds a
- * provider key while it waits for a worktree pool slot. Called by leaseSlot just before it parks on
- * a busy pool; it re-keys the calling lease to no key (which never waits), so a run or verify
- * waiting for a slot does not hold — and cannot deadlock — a provider slot whose in-use a re-key
- * waiter is waiting to drain. No-op without a lease in context. */
-export async function dropProviderLeaseKey() {
-    const ctx = providerLeaseStore.getStore();
-    if (!ctx)
-        return;
-    await ctx.lease.rekey(undefined);
-}
-/** Run `wait`, an idle stretch inside the calling lease's work, with the lease's team permit and
- * key slot handed back (SemaphoreLease.pause), so a parked run can use them meanwhile, then take
- * them back (resume) before returning. A failed review's in-place retry pause is the caller: with
- * one team permit, a reviewer that kept failing held it through two 30 s pauses and starved every
- * other role. Once `signal` has fired, nothing is taken back and the caller's release() settles a
- * still-paused lease. No-op without a lease in context. */
-export async function idleWithoutProviderLease(wait, signal) {
-    const ctx = providerLeaseStore.getStore();
-    if (!ctx)
-        return wait();
-    ctx.lease.pause();
-    try {
-        await wait();
-    }
-    finally {
-        if (!signal?.aborted)
-            await untilAborted(ctx.lease.resume(), signal);
-    }
-}
-/** `p`, or an earlier return once `signal` fires: a resume parked on a full team must not keep an
- * aborted verification waiting for a permit it no longer needs. */
-async function untilAborted(p, signal) {
-    if (!signal)
-        return p;
-    let onAbort = () => { };
-    const aborted = new Promise((resolve) => {
-        onAbort = resolve;
-        signal.addEventListener("abort", onAbort, { once: true });
-    });
-    try {
-        await Promise.race([p, aborted]);
-    }
-    finally {
-        signal.removeEventListener("abort", onAbort);
-    }
-}

package/dist/src/runner/model-fallback.js

@@ -1,76 +0,0 @@
-/** Consecutive provider-class failures that trip a fallback episode. */
-export const MODEL_FALLBACK_FAILURES = 3;
-/** The first probe cooldown after a trip; a failed probe doubles it. */
-export const MODEL_FALLBACK_COOLDOWN_MS = 5 * 60_000;
-/** The ceiling a repeatedly-failing probe's cooldown doubles toward. */
-export const MODEL_FALLBACK_MAX_COOLDOWN_MS = 30 * 60_000;
-/** True only while the role is in a fallback episode whose probe is still in the future — the
- * runs that use the fallback pair. */
-export function modelFallbackActive(state, now) {
-    return state !== undefined && state.since > 0 && now < state.probeAt;
-}
-/** True only while the role is in a fallback episode whose cooldown has elapsed: the next
- * run uses the primary as the probe. */
-export function modelFallbackProbe(state, now) {
-    return state !== undefined && state.since > 0 && now >= state.probeAt;
-}
-/** Classify one authoring agent run's verdict about the primary (src/run/run-usage.ts records the
- * same flags for the team-wide hold). An agent run that was aborted, quiet-killed, or timed out
- * — or that read an image its model cannot see (the runner killed it, plans/image-input.md) — is
- * inconclusive even when it also reports provider evidence: the harness killed it, so it is
- * no verdict about the primary's health. */
-export function modelFallbackVerdict(pi) {
-    if (pi.aborted || pi.quietKilled || pi.timedOut || pi.imageBlind)
-        return "inconclusive";
-    if (!pi.ok && (pi.transientRateLimit || pi.transientBackend))
-        return "provider-failure";
-    return "answered";
-}
-/** Fold one authoring agent run's verdict into the role's fallback state, returning the next state
- * or undefined for "running the primary" (no episode).
- *
- * - Not in fallback, provider failure: increment the consecutive count; the
- *   MODEL_FALLBACK_FAILURES-th trips the episode.
- * - Not in fallback, an answering agent run: clear the running count (undefined).
- * - Not in fallback, an inconclusive agent run: unchanged — a harness kill is not evidence the
- *   primary recovered, so the running count survives it.
- * - In fallback, a fallback run (`probe` false): unchanged — its outcome neither returns
- *   the role to primary nor re-trips it.
- * - In fallback, a probe run: an inconclusive probe is unchanged (retried on the next run);
- *   an answering probe clears the episode; a provider-class failed probe doubles the cooldown
- *   (capped) and schedules the next one.
- */
-export function recordModelFallback(state, outcome) {
-    const { verdict, probe, now, reason } = outcome;
-    if (state !== undefined && state.since > 0) {
-        if (!probe)
-            return state;
-        if (verdict === "inconclusive")
-            return state;
-        if (verdict === "answered")
-            return undefined;
-        const cooldownMs = Math.min(state.cooldownMs * 2, MODEL_FALLBACK_MAX_COOLDOWN_MS);
-        return { ...state, cooldownMs, probeAt: now + cooldownMs, reason: reason || state.reason };
-    }
-    if (verdict === "inconclusive")
-        return state;
-    if (verdict === "answered")
-        return undefined;
-    const failures = (state?.failures ?? 0) + 1;
-    if (failures >= MODEL_FALLBACK_FAILURES) {
-        return {
-            failures: 0,
-            since: now,
-            probeAt: now + MODEL_FALLBACK_COOLDOWN_MS,
-            cooldownMs: MODEL_FALLBACK_COOLDOWN_MS,
-            reason: reason || "backend failure",
-        };
-    }
-    return { failures, since: 0, probeAt: 0, cooldownMs: 0, reason };
-}
-/** The reason label one agent run's provider evidence yields: "rate-limit" for a 429, else the
- * backend-failure kind. Exported so the runner's evidence assembly and tests share one
- * spelling. */
-export function providerFailureReason(rateLimit, kind) {
-    return rateLimit ? "rate-limit" : (kind ?? "backend failure");
-}

package/dist/src/runner/runner-fallback.js

@@ -1,66 +0,0 @@
-import { logEventBestEffort } from "../events/events.js";
-import { modelFallbackVerdict, providerFailureReason, recordModelFallback } from "./model-fallback.js";
-/** Fold one AUTHORING agent run's verdict into the role's model-fallback state
- * (src/runner/model-fallback.ts) and emit the episode's started/ended events. Only the agent run
- * that actually happened is evidence: a run that never invoked pi (a skipped director
- * inbox, a recovered leftover, a merge-side `main_red` pin) returns from runOnce before this is
- * reached, and modelFallbackVerdict reports an aborted/killed/timed-out agent run as
- * inconclusive — so neither can end an episode without the primary having answered.
- * A role whose tier resolves to no fallback pair never trips, and an episode persisted from a
- * config that HAD a pair is cleared when a live edit removes it (or sets it to "pause"), so a
- * stale "on fallback" mark cannot outlive the config that created it. Persists on any state
- * change; the run's own finalize save carries it too. */
-export function foldModelFallbackPhase(ctx, fallbackCtx, pi) {
-    const s = ctx.state;
-    const prior = s.modelFallback;
-    const now = Date.now();
-    const verdict = modelFallbackVerdict(pi);
-    const reason = providerFailureReason(pi.transientRateLimit, pi.backendKind);
-    const wasIn = prior !== undefined && prior.since > 0;
-    if (fallbackCtx.fallback === null) {
-        // No fallback pair resolves any more: the feature is off for this role. End a persisted
-        // episode (the primary just ran, so this run IS the return), and drop any pre-trip count
-        // so a later config starts from zero. A killed/aborted/timed-out agent run is no verdict, so it
-        // leaves the episode in place exactly as it does on a configured fallback.
-        if (prior === undefined)
-            return;
-        if (wasIn && verdict === "inconclusive")
-            return;
-        emitFallbackEnded(ctx, prior, fallbackCtx.primary, now, wasIn);
-        s.modelFallback = undefined;
-        ctx.save();
-        return;
-    }
-    const next = recordModelFallback(prior, { verdict, probe: fallbackCtx.probe, now, reason });
-    const willBeIn = next !== undefined && next.since > 0;
-    if (!wasIn && willBeIn) {
-        logEventBestEffort(ctx.root, {
-            source: ctx.role,
-            type: "model_fallback_started",
-            provider: fallbackCtx.fallback.provider,
-            model: fallbackCtx.fallback.model,
-            reason: next?.reason,
-        });
-    }
-    else if (wasIn && !willBeIn && prior !== undefined) {
-        emitFallbackEnded(ctx, prior, fallbackCtx.primary, now, wasIn);
-    }
-    if (next !== prior) {
-        s.modelFallback = next;
-        ctx.save();
-    }
-}
-/** Log the model_fallback_ended event for an episode that was active. Split out so the two
- * ending paths — a successful probe and a config that dropped the pair — name the primary
- * pair and duration the same way. A pre-trip state (no episode) has no ended event. */
-function emitFallbackEnded(ctx, prior, primary, now, wasIn) {
-    if (!wasIn)
-        return;
-    logEventBestEffort(ctx.root, {
-        source: ctx.role,
-        type: "model_fallback_ended",
-        provider: primary.provider,
-        model: primary.model,
-        durationMs: now - (prior.since || now),
-    });
-}

package/dist/src/ui/tui/tui-editor-claude-reserve.js

@@ -1,24 +0,0 @@
-import { loadConfigSafe } from "../../config/config.js";
-import { createTeamConfigKeyEditor } from "./tui-editor-config.js";
-/** The Ctrl+Y claude subscription-window reserve editor on the Activity view's shared prompt
- * line — the terminal twin of the dashboard Settings `Claude window reserve
- * (backends.claude.windowReserve)` field and `tumwater config set claudeWindowReserve`. Enter
- * writes the top-level `claudeWindowReserve`
- * through the shared setConfigKey/unsetConfigKey family, so validateConfig's claudeWindowReserve
- * block owns the value's truth. The team scope is the only scope, so the editor takes the line
- * on the Activity view (view 0) alone; a History pane keeps Ctrl+Y for its per-role Summary
- * toggle, which runs after this arm. */
-export function createClaudeReserveEditor(session) {
-    return createTeamConfigKeyEditor(session, {
-        mode: "claudeReserve",
-        openCtrl: "y",
-        configKey: "claudeWindowReserve",
-        prefill: (s) => {
-            const existing = loadConfigSafe(s.root).config?.claudeWindowReserve;
-            return existing !== undefined ? JSON.stringify(existing) : "";
-        },
-        openFlash: "edit the team's claude subscription-window reserve (backends.claude.windowReserve, a JSON object like {\"seven_day\":0.8}; empty clears): Enter to save, Esc to cancel",
-        clearedFlash: "claude window reserve cleared",
-        setFlash: (text) => `claude window reserve set to ${text}`,
-    });
-}

package/dist/src/ui/tui/tui-editor-provider-caps.js

@@ -1,27 +0,0 @@
-import { loadConfigSafe } from "../../config/config.js";
-import { createTeamConfigKeyEditor } from "./tui-editor-config.js";
-/** The Ctrl+P provider-concurrency-caps editor on the Activity view's shared prompt line — the
- * terminal twin of the dashboard Settings `Provider concurrency caps (JSON)` field and
- * `tumwater config set maxConcurrentPerProvider`, completing the run-concurrency knob set
- * `tumwater doctor`'s checkProviderContention points at. Enter writes the top-level
- * `maxConcurrentPerProvider` through the shared setConfigKey/unsetConfigKey family the CLI and
- * the dashboard use — so setConfigKey JSON-parses the typed text and validateConfig's map block
- * owns the value's truth — and Esc, Ctrl+P again, and Ctrl+T cancel by restoring the prompt
- * draft. Mutually exclusive with the other editors on the one prompt line via the session's
- * held registry. The Team scope is the only scope, so the editor takes the line on the Activity
- * view (view 0) alone; a role's Transcript keeps Ctrl+P for its pause editor, which runs after
- * this arm. */
-export function createProviderCapsEditor(session) {
-    return createTeamConfigKeyEditor(session, {
-        mode: "providerCaps",
-        openCtrl: "p",
-        configKey: "maxConcurrentPerProvider",
-        prefill: (s) => {
-            const existing = loadConfigSafe(s.root).config?.maxConcurrentPerProvider;
-            return existing !== undefined ? JSON.stringify(existing) : "";
-        },
-        openFlash: "edit the team's provider concurrency caps (maxConcurrentPerProvider, a JSON object like {\"anthropic\":2}; empty clears): Enter to save, Esc to cancel",
-        clearedFlash: "provider concurrency caps cleared",
-        setFlash: (text) => `provider concurrency caps set to ${text}`,
-    });
-}