tumwater 0.4.2 → 0.4.4

package/dist/src/config/config-fallbacks.js

@@ -1,19 +1,17 @@
 /** The budget/tier FALLBACK side of the config views, split out of config-views.ts: how the
  * team falls back at the daily spend cap — which free pair each tier runs on
- * (resolveTierFallbacks and its BORROW_ORDER), the per-role fallback config a model-failure
- * or cap episode hands a role (fallbackRoleConfig, applyFallbackModel), and the surfaces
- * that name those pairs (seamsInUse, modelFallbackView, tierFallbackLabels). The per-seam
+ * (resolveTierFallbacks and its BORROW_ORDER), the per-role fallback config a cap episode
+ * hands a role (applyFallbackModel), and the surfaces
+ * that name those pairs (seamsInUse, tierFallbackLabels). The per-seam
  * resolution these build on — how one role/reviewer/resolver provider/model/thinking resolves
  * (configForRole, reviewConfig, withModelOverrides, …) — stays in config-views.ts, so the
  * one-way dependency runs fallback → seam and never back. Pure, like its sibling: no I/O and
  * no caching. */
 import { MODEL_TIERS, } from "./config-schema.js";
-import { formatModelSelector, parseModelSelector, routeModel } from "./model-selector.js";
+import { formatModelSelector, parseModelSelector, routeModel } from "./config-model-selector.js";
 import { modelPairName } from "../budget/budget.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
-import { baseRoleOf } from "../roles/runner-ids.js";
 import { enabledRoleIds } from "./config.js";
-import { modelFallbackActive } from "../runner/model-fallback.js";
 import { FALLBACK_REVIEW_TIMEOUT_S, REVIEW_TIMEOUT_S, configForRole, isTierName, pairOverrides, resolvedModelFields, resolverConfig, reviewConfig, reviewRunConfig, roleSeamTier, topTierBackend, topTierSelector, withModelOverrides, } from "./config-views.js";
 /** The resolved fields of one fallback step, keyed by the seam it routes to (PLANS.md "Mixed
  * claude + pi fleets, part 2/4"): the backend is the step's own, else its tier primary's
@@ -80,6 +78,9 @@ const BORROW_ORDER = {
     default: ["default", "strong", "small"],
     strong: ["strong", "default"],
 };
+/** Exported for imageRerouteTarget (src/agent/image-input.ts), which walks a rerouting role's
+ * tier through the same borrow order the budget fallback uses (skipping the tier itself). */
+export { BORROW_ORDER };
 /** A tier's OWN fallback chain, first step first — what the `fallback` key declares at that
  * tier's map entry (a selector or a list of them), or (default only) the string/list form of
  * `fallback` or the legacy `fallbackModel` object (a one-element chain). Empty when the tier
@@ -163,27 +164,10 @@ export function resolveTierFallbacks(config, usable) {
     };
     return { small: resolve("small"), default: resolve("default"), strong: resolve("strong") };
 }
-/** The config a role's runs use while a model-fallback episode is active (PLANS.md "Model
- * failure fallback, part 1/2"): the role's tier pair from resolveTierFallbacks (the tier's own
- * pair, else BORROW_ORDER's borrow), shaped like configForRole — provider/model/thinking over
- * the role's own and top-level values, plus the role's minRunIntervalSeconds. Null when the
- * tier resolves to pause (no fallback configured), so the feature stays off. Pure. */
-export function fallbackRoleConfig(config, role) {
-    const tier = roleSeamTier(config, role);
-    const pair = resolveTierFallbacks(config, () => true)[tier].pair;
-    if (pair === null)
-        return null;
-    const rc = config.roles[baseRoleOf(role)];
-    return {
-        ...withModelOverrides(config, tier, pairOverrides(pair)),
-        minRunIntervalSeconds: rc?.minRunIntervalSeconds ?? config.minRunIntervalSeconds,
-    };
-}
 /** Every seam the team can spawn, each with its label: every enabled role's resolved config
  * (configForRole), the review gate when it is on (reviewRunConfig), the conflict resolver
  * (resolverConfig), the director (a catalog role, named explicitly so it is never missed), and
- * each tier's budget fallback (resolveTierFallbacks) — the model-failure fallback
- * (fallbackRoleConfig) runs the same tier pair, so one enumeration covers it. Deduplicated by
+ * each tier's budget fallback (resolveTierFallbacks). Deduplicated by
  * label + routed pair so a seam reached through several surfaces is listed once. Read by the
  * startup gate's agent list, doctor's pair sweep (and so its binary/credential/version checks
  * and routing table), and the live-edit reload's newly-routed-backend check — no surface can
@@ -211,25 +195,6 @@ export function seamsInUse(config) {
     }
     return [...seams.values()];
 }
-/** Build a ModelFallbackView for an episode, or null while the episode is not running the
- * fallback (no episode, or a due probe on the primary). role-view.ts's
- * RoleViewPayload.modelFallback and status/status-data.ts's per-role row both build this
- * shape, so one function keeps the two surfaces from disagreeing about the pair, its start,
- * and its reason. `now` is the caller's clock (the status snapshot passes its own poll
- * clock), so a row and its poll agree on what "active" means. */
-export function modelFallbackView(episode, config, role, now = Date.now()) {
-    if (episode === undefined || !modelFallbackActive(episode, now))
-        return null;
-    const episodeConfig = fallbackRoleConfig(config, role);
-    if (episodeConfig === null)
-        return null;
-    return {
-        ...resolvedModelFields(episodeConfig.provider, episodeConfig.model, episodeConfig.thinking),
-        ...(episodeConfig.agent !== undefined && episodeConfig.agent !== "pi" ? { backend: episodeConfig.agent } : {}),
-        since: episode.since,
-        reason: episode.reason,
-    };
-}
 /** The per-tier fallback labels the observability surfaces render (part 7b/8): tier →
  * `provider/model[ (from <tier>)]` for every tier the resolution gives a pair, in tier order.
  * The `(from …)` suffix marks a borrowed pair — a strong-tier borrow is the fact an operator
@@ -300,6 +265,74 @@ function freeRoleModels(config, free) {
         return [id, isTierName(rc?.model) ? stripBackend(rc) : stripModel(rc)];
     }));
 }
+/** A pair's selector as a tier-map entry. Keeps pi's provider; a non-pi pair's model is
+ * already the whole id. On a team whose backend is not pi — or a pair routed off pi — the
+ * entry names the pair's backend, so the team's own backend cannot take a pi pair's id as
+ * its own: a bare selector when the pair rides the team backend and it is pi, else an
+ * object entry naming the pair's backend. */
+function pairSelectorOf(config, pair) {
+    if (!pair)
+        return undefined;
+    const selector = formatModelSelector({
+        provider: pair.backend === undefined ? pair.provider : undefined,
+        model: pair.model ?? "",
+        thinking: pair.backend === undefined ? pair.thinking : undefined,
+    });
+    if (pair.backend === undefined && (config.backend ?? "pi") === "pi")
+        return formatModelSelector({ provider: pair.provider, model: pair.model ?? "", thinking: pair.thinking });
+    return {
+        backend: pair.backend ?? "pi",
+        model: selector,
+        ...(pair.thinking !== undefined ? { thinking: pair.thinking } : {}),
+    };
+}
+/** What a free seam keeps running: the tier's own primary selector — the backend namespace a
+ * resolved seam has cleared, plus the ambient thinking level `topTierSelector` alone omits.
+ * A moved seam gets its pair selector, which already carries that ambient level. */
+function freeTierEntry(config, tier, seam) {
+    const own = topTierSelector(config, tier);
+    // A tier entry that names a backend keeps it as an object entry: a bare selector string
+    // would route by namespace and drop the backend the entry chose.
+    const backend = topTierBackend(config, tier);
+    if (own !== undefined) {
+        const thinking = own.thinking ?? config.thinking;
+        if (backend !== undefined)
+            return {
+                backend,
+                model: formatModelSelector({ ...own, thinking: undefined }),
+                ...(thinking !== undefined ? { thinking } : {}),
+            };
+        else
+            return formatModelSelector({ ...own, thinking });
+    }
+    // A tier with no top-level selector — `agent: "claude"` riding its agent default —
+    // has no own selector to carry the level, so name the routed default plus it.
+    if (seam.model !== undefined) {
+        const routed = { provider: seam.provider, model: seam.model };
+        return backend !== undefined
+            ? {
+                backend,
+                model: formatModelSelector(routed),
+                ...(seam.thinking !== undefined ? { thinking: seam.thinking } : {}),
+            }
+            : formatModelSelector({ ...routed, thinking: seam.thinking });
+    }
+    return undefined;
+}
+/** A config with no resolved tier map installs the single fallback pair at the top level,
+ * keeping every other value (and the reviewer's time budget floor) as in the resolved-map
+ * path's legacy peer. */
+function legacyPairConfig(config, pair) {
+    return {
+        ...config,
+        ...(pair.backend !== undefined || config.backend !== undefined ? { backend: pair.backend ?? "pi" } : {}),
+        provider: pair.backend === undefined ? pair.provider : undefined,
+        model: pair.model,
+        thinking: pair.thinking,
+        review: fallbackReview(config.review),
+        roles: stripRoleModels(config.roles, false),
+    };
+}
 /** The config as seen by a role running on the free fallback model
  * (plans/fallback-model.md): the fallback's provider/model/thinking installed as the top-level
  * values AND every per-role and reviewer model override dropped, so that EVERY seam that could
@@ -323,26 +356,6 @@ function freeRoleModels(config, free) {
  * model, while every priced seam still lands on its tier's fallback pair. */
 export function applyFallbackModel(config, resolved, free) {
     if (resolved) {
-        // A pair's selector keeps pi's provider; a non-pi pair's model is already the whole id. On a
-        // team whose backend is not pi — or a pair routed off pi — the entry names the pair's
-        // backend, so the team's own backend cannot take a pi pair's id as its own.
-        const selectorOf = (f) => {
-            const pair = f.pair;
-            if (!pair)
-                return undefined;
-            const selector = formatModelSelector({
-                provider: pair.backend === undefined ? pair.provider : undefined,
-                model: pair.model ?? "",
-                thinking: pair.backend === undefined ? pair.thinking : undefined,
-            });
-            if (pair.backend === undefined && (config.backend ?? "pi") === "pi")
-                return formatModelSelector({ provider: pair.provider, model: pair.model ?? "", thinking: pair.thinking });
-            return {
-                backend: pair.backend ?? "pi",
-                model: selector,
-                ...(pair.thinking !== undefined ? { thinking: pair.thinking } : {}),
-            };
-        };
         const model = {};
         const stepCaps = {};
         for (const tier of MODEL_TIERS) {
@@ -351,37 +364,12 @@ export function applyFallbackModel(config, resolved, free) {
             // seam gets its pair selector, which already carries that ambient level.
             const seam = withModelOverrides(config, tier, {});
             if (free?.(seam)) {
-                const own = topTierSelector(config, tier);
-                // A tier entry that names a backend keeps it as an object entry: a bare selector string
-                // would route by namespace and drop the backend the entry chose.
-                const backend = topTierBackend(config, tier);
-                if (own !== undefined) {
-                    const thinking = own.thinking ?? config.thinking;
-                    if (backend !== undefined)
-                        model[tier] = {
-                            backend,
-                            model: formatModelSelector({ ...own, thinking: undefined }),
-                            ...(thinking !== undefined ? { thinking } : {}),
-                        };
-                    else
-                        model[tier] = formatModelSelector({ ...own, thinking });
-                }
-                // A tier with no top-level selector — `agent: "claude"` riding its agent default —
-                // has no own selector to carry the level, so name the routed default plus it.
-                else if (seam.model !== undefined) {
-                    const routed = { provider: seam.provider, model: seam.model };
-                    model[tier] =
-                        backend !== undefined
-                            ? {
-                                backend,
-                                model: formatModelSelector(routed),
-                                ...(seam.thinking !== undefined ? { thinking: seam.thinking } : {}),
-                            }
-                            : formatModelSelector({ ...routed, thinking: seam.thinking });
-                }
+                const own = freeTierEntry(config, tier, seam);
+                if (own !== undefined)
+                    model[tier] = own;
                 continue;
             }
-            const sel = selectorOf(resolved[tier]);
+            const sel = pairSelectorOf(config, resolved[tier].pair);
             if (sel !== undefined)
                 model[tier] = sel;
             const cap = resolved[tier].pair?.maxDailyCostUsd;
@@ -401,13 +389,5 @@ export function applyFallbackModel(config, resolved, free) {
     const pair = fallbackPair(config);
     if (!pair)
         return config;
-    return {
-        ...config,
-        ...(pair.backend !== undefined || config.backend !== undefined ? { backend: pair.backend ?? "pi" } : {}),
-        provider: pair.backend === undefined ? pair.provider : undefined,
-        model: pair.model,
-        thinking: pair.thinking,
-        review: fallbackReview(config.review),
-        roles: stripRoleModels(config.roles, false),
-    };
+    return legacyPairConfig(config, pair);
 }

package/dist/src/config/config-field-checks.js

@@ -96,6 +96,22 @@ export const AT_LEAST_ONE = { ok: (n) => n >= 1, what: "a number of at least 1"
  * duration rules (config-validation.ts) and checkMinRunInterval (config-keys.ts), so the
  * dashboard's interval editor cannot drift from the schema's bound. */
 export const MAX_DURATION_SECONDS = 2147483;
+/** The seconds-valued duration rules, bounded by MAX_DURATION_SECONDS so a `×1000` delay stays
+ * inside node's signed-32-bit range. One home for the family, so the whole-gate section
+ * (config-validation.ts) and the per-role section (config-validation-roles.ts) name the same
+ * rules instead of each declaring DURATION_NON_NEGATIVE for itself. */
+export const DURATION_POSITIVE = {
+    ok: (n) => n > 0 && n <= MAX_DURATION_SECONDS,
+    what: `a number greater than 0, at most ${MAX_DURATION_SECONDS}`,
+};
+export const DURATION_NON_NEGATIVE = {
+    ok: (n) => n >= 0 && n <= MAX_DURATION_SECONDS,
+    what: `a number of 0 or more, at most ${MAX_DURATION_SECONDS}`,
+};
+export const DURATION_OR_DISABLED = {
+    ok: (n) => n >= 0 && n <= MAX_DURATION_SECONDS,
+    what: `a number of 0 or more, at most ${MAX_DURATION_SECONDS} (0 disables)`,
+};
 /** Shared known-role guard for the per-role config sections (`roles.<id>` entries and
  * `maxDailyCostUsdPerRole.<id>` keys): an id outside the role catalog and customRoles cannot
  * work — a `roles` typo spawns a phantom role that errors every run forever; a caps typo
@@ -120,6 +136,53 @@ export function checkStringField(problems, obj, prefix, key, allowEmpty = true)
             problems.push(`${prefix}${key} must not be empty (got ${show(v)})`);
     });
 }
+function checkModelSiblingFields(problems, obj, prefix) {
+    for (const key of MODEL_TRIPLE_KEYS)
+        if (key !== "model")
+            checkStringField(problems, obj, prefix, key, false);
+    const t = obj.thinking;
+    if (isNonBlankString(t) && !THINKING_LEVELS.has(t))
+        problems.push(`${prefix}thinking must be one of ${[...THINKING_LEVELS].join(", ")} (got ${show(t)})${typoSuffix(t, [...THINKING_LEVELS])}`);
+}
+function checkTierMapModel(problems, obj, prefix, m) {
+    checkKnownKeys(m, TIER_MAP_KEYS, `${prefix}model`, problems);
+    if (obj.provider !== undefined)
+        problems.push(`${prefix}model as a map by tier cannot coexist with ${prefix ? prefix : "the legacy top-level "}provider — move the provider into each tier's model id (got provider ${show(obj.provider)})`);
+    for (const [tier, v] of Object.entries(m))
+        // An object entry (`{ backend?, model?, thinking? }`) is validated by validateConfig.
+        if (!isNonBlankString(v) && !isJsonObject(v))
+            problems.push(`${prefix}model.${tier} must be a non-empty model id (got ${show(v)})`);
+}
+function whatModelMustBe(modelShape) {
+    return modelShape === "tier-map"
+        ? "a model id or a map by tier (small, default, strong)"
+        : modelShape === "tier-name"
+            ? "a model id or a tier name (small, default, strong)"
+            : "a string";
+}
+function checkStringModel(problems, obj, prefix, m, modelShape) {
+    if (typeof m !== "string") {
+        problems.push(`${prefix}model must be ${whatModelMustBe(modelShape)} (got ${show(m)})`);
+        return;
+    }
+    if (m.trim() === "") {
+        problems.push(`${prefix}model must not be empty (got ${show(m)})`);
+        return;
+    }
+    if (MODEL_TIERS.includes(m)) {
+        if (modelShape === "tier-name")
+            return; // A valid tier reference.
+        problems.push(`${prefix}model must name a model id — tier names are valid only as roles.<id>.model or review.model values (got ${show(m)})`);
+        return;
+    }
+    if (modelShape === "tier-name" && !m.includes("/") && obj.provider === undefined)
+        suggestTierFix(problems, prefix, m);
+}
+function suggestTierFix(problems, prefix, m) {
+    const tier = suggestClosest(m, MODEL_TIERS);
+    if (tier !== null)
+        problems.push(`${prefix}model ${show(m)} is not a tier name or a model id pi can resolve${didYouMean(tier)}`);
+}
 /** Every model-override section validates the same provider/model/thinking triple the same
  * way: empty strings are rejected (see checkStringField) and thinking is value-checked —
  * pi only recognizes THINKING_LEVELS and silently drops anything else, so a typo would run
@@ -137,49 +200,15 @@ export function checkStringField(problems, obj, prefix, key, allowEmpty = true)
  * places that accept it, so a misplaced `"model": "strong"` is an error naming its fix instead of a
  * bare model pattern pi can never resolve. */
 export function checkModelTripleField(problems, obj, prefix, modelShape = "selector") {
-    for (const key of MODEL_TRIPLE_KEYS)
-        if (key !== "model")
-            checkStringField(problems, obj, prefix, key, false);
-    const t = obj.thinking;
-    if (isNonBlankString(t) && !THINKING_LEVELS.has(t))
-        problems.push(`${prefix}thinking must be one of ${[...THINKING_LEVELS].join(", ")} (got ${show(t)})${typoSuffix(t, [...THINKING_LEVELS])}`);
+    checkModelSiblingFields(problems, obj, prefix);
     const m = obj.model;
     if (m === undefined)
         return;
     if (modelShape === "tier-map" && isJsonObject(m)) {
-        checkKnownKeys(m, TIER_MAP_KEYS, `${prefix}model`, problems);
-        if (obj.provider !== undefined)
-            problems.push(`${prefix}model as a map by tier cannot coexist with ${prefix ? prefix : "the legacy top-level "}provider — move the provider into each tier's model id (got provider ${show(obj.provider)})`);
-        for (const [tier, v] of Object.entries(m))
-            // An object entry (`{ backend?, model?, thinking? }`) is validated by validateConfig.
-            if (!isNonBlankString(v) && !isJsonObject(v))
-                problems.push(`${prefix}model.${tier} must be a non-empty model id (got ${show(v)})`);
-        return;
-    }
-    if (typeof m !== "string") {
-        const what = modelShape === "tier-map"
-            ? "a model id or a map by tier (small, default, strong)"
-            : modelShape === "tier-name"
-                ? "a model id or a tier name (small, default, strong)"
-                : "a string";
-        problems.push(`${prefix}model must be ${what} (got ${show(m)})`);
+        checkTierMapModel(problems, obj, prefix, m);
         return;
     }
-    if (m.trim() === "") {
-        problems.push(`${prefix}model must not be empty (got ${show(m)})`);
-        return;
-    }
-    if (MODEL_TIERS.includes(m)) {
-        if (modelShape === "tier-name")
-            return; // A valid tier reference.
-        problems.push(`${prefix}model must name a model id — tier names are valid only as roles.<id>.model or review.model values (got ${show(m)})`);
-        return;
-    }
-    if (modelShape === "tier-name" && !m.includes("/") && obj.provider === undefined) {
-        const tier = suggestClosest(m, MODEL_TIERS);
-        if (tier !== null)
-            problems.push(`${prefix}model ${show(m)} is not a tier name or a model id pi can resolve${didYouMean(tier)}`);
-    }
+    checkStringModel(problems, obj, prefix, m, modelShape);
 }
 /** Validate one numeric field against a NumberRule when present. */
 export function checkNumberField(problems, obj, prefix, key, rule) {

package/dist/src/config/config-keys.js

@@ -11,7 +11,7 @@
  * writers and the read side show. */
 import { BACKEND_KEYS, BACKOFF_KEYS, BOOTSTRAP_KEYS, CHECK_KEYS, CLAUDE_AGENT_KEYS, CODEX_BACKEND_KEYS, REVIEW_KEYS, ROLE_ENTRY_KEYS, TIER_MAP_KEYS, TOP_LEVEL_KEYS } from "./config-schema.js";
 import { typoSuffix } from "../text/suggest.js";
-import { MAX_DURATION_SECONDS, POSITIVE_INTEGER, show } from "./config-field-checks.js";
+import { MAX_DURATION_SECONDS, show } from "./config-field-checks.js";
 import { parseQuietHours } from "../scheduling/quiet-hours.js";
 /** One definition of "a valid daily budget cap" (the TUI's Ctrl+B editor and the GUI's
  * /api/budget endpoint both run their input through it): a finite number of 0 or more —
@@ -31,18 +31,6 @@ export function checkDailyBudgetUsd(value, key = "maxDailyCostUsd") {
         return `${key} must be a number of 0 or more, at most ${Number.MAX_SAFE_INTEGER}, 0 disables (got ${show(value)})`;
     return null;
 }
-/** One definition of "a valid per-provider concurrency cap" (plans/provider-concurrency.md
- * §1): a positive integer, accepted for any (possibly unknown) provider name — a fallback's
- * provider may only come into use later, so the key is not checked against a catalog. The one
- * validation both `config set maxConcurrentPerProvider.<provider>` and validateConfig show,
- * so they cannot drift apart on what a valid cap is. `key` names the config key in the error,
- * defaulting to the map name; the dotted map passes `maxConcurrentPerProvider.<provider>`
- * so a rejected entry names the key actually set. */
-export function checkProviderConcurrencyCap(value, key = "maxConcurrentPerProvider") {
-    if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value < 1)
-        return `${key} must be ${POSITIVE_INTEGER.what} (got ${show(value)})`;
-    return null;
-}
 /** One definition of "a valid quietHours window" (src/scheduling/quiet-hours.ts owns the format):
  * "HH:MM-HH:MM" in local time, wrapping permitted, empty means off. parseQuietHours's
  * message is the one wording every surface (validateConfig, `config set`, the TUI/GUI
@@ -78,12 +66,9 @@ export const PER_KEY_VALIDATORS = {
 };
 /** The per-role maps `config get/set` reaches with dotted keys: each names ONE entry
  * (`maxDailyCostUsdPerRole.<role>`, `quietHoursPerRole.<role>`) that merges into the
- * existing map, so raising one role's cap never requires re-typing another's. The
- * `maxConcurrentPerProvider` map is dotted the same way (`maxConcurrentPerProvider.<provider>`);
- * its keys are provider names, not role ids, so its per-key validation skips the role-catalog
- * check the per-role maps apply. The per-key value validator runs before the write, the same
- * screening a bare top-level key gets. */
-export const DOTTED_MAP_KEYS = ["maxDailyCostUsdPerRole", "quietHoursPerRole", "maxConcurrentPerProvider"];
+ * existing map, so raising one role's cap never requires re-typing another's. The per-key
+ * value validator runs before the write, the same screening a bare top-level key gets. */
+export const DOTTED_MAP_KEYS = ["maxDailyCostUsdPerRole", "quietHoursPerRole"];
 /** The fixed-shape top-level sections `config get/set/unset` reaches one field of with a
  * two-segment key (`review.model`, `bootstrap.untilPlansDone`), each with its field list. */
 export const DOTTED_SECTION_FIELDS = {
@@ -97,26 +82,36 @@ export const DOTTED_SECTION_FIELDS = {
  * (`modle.small`, `maxDailyCostUsdPerRoll.feature`) gets the same did-you-mean the sibling
  * unknown-key errors attach. */
 const DOTTED_KEY_HEADS = [...DOTTED_MAP_KEYS, "roles", "model", "backends", ...Object.keys(DOTTED_SECTION_FIELDS)];
-/** Split a config key into its write/get shape: `foo` is top-level,
- * `maxDailyCostUsdPerRole.feature` / `quietHoursPerRole.qa` name one map entry,
- * `roles.qa.model` names one role-entry field, and anything else dotted is an error
- * naming the supported dotted forms. */
-export function parseConfigKey(key) {
-    if (!key.includes("."))
-        return { kind: "top", key };
-    const parts = key.split(".");
+/** The per-role map entry `maxDailyCostUsdPerRole.<role>` / `quietHoursPerRole.<role>` — a
+ * whole-value bare key with no deeper segment names one map entry. Returns undefined when
+ * the shape is not that of a two-segment per-role map entry. */
+function parseMapEntry(parts) {
     const first = parts[0] ?? "";
     const second = parts.length > 1 ? parts[1] ?? "" : undefined;
     const third = parts.length > 2 ? parts[2] ?? "" : undefined;
     if (third === undefined && second !== undefined && second !== "" && DOTTED_MAP_KEYS.includes(first))
         return { kind: "map", map: first, role: second };
+    return undefined;
+}
+/** One role-entry field `roles.<id>.<field>` (e.g. `roles.qa.model`), with both segments
+ * non-empty. Returns undefined when the shape is not a three-segment `roles.` key. */
+function parseRoleField(parts) {
+    const first = parts[0] ?? "";
+    const second = parts.length > 1 ? parts[1] ?? "" : undefined;
+    const third = parts.length > 2 ? parts[2] ?? "" : undefined;
     if (parts.length === 3 && first === "roles" && second !== undefined && second !== "" && third !== undefined && third !== "")
         return { kind: "role", id: second, field: third };
-    // `backends.<id>.<field>` names one field of one agent backend's entry (the way
-    // `roles.<id>.<field>` names one role field). The id is shape-checked only — routing owns
-    // which agent ids exist (part 4b); a typo'd field is refused here with the valid ones named.
+    return undefined;
+}
+/** `backends.<id>.<field>` names one field of one agent backend's entry (the way
+ * `roles.<id>.<field>` names one role field). The id is shape-checked only — routing owns
+ * which agent ids exist (part 4b); a typo'd field is refused here with the valid ones named. */
+function parseBackendField(parts) {
+    const first = parts[0] ?? "";
+    const second = parts.length > 1 ? parts[1] ?? "" : undefined;
+    const third = parts.length > 2 ? parts[2] ?? "" : undefined;
     if (parts.length === 3 && first === "backends" && second !== undefined && second !== "" && third !== undefined) {
-        // configDir/windowReserve are claude/codex-only (CLAUDE_AGENT_KEYS / CODEX_BACKEND_KEYS):
+        // configDir is claude/codex-only (CLAUDE_AGENT_KEYS / CODEX_BACKEND_KEYS):
         // a config set backends.pi.configDir would write a key nothing reads, so it is refused
         // everywhere but claude and codex.
         const validKeys = second === "claude" ? CLAUDE_AGENT_KEYS : second === "codex" ? CODEX_BACKEND_KEYS : BACKEND_KEYS;
@@ -127,10 +122,15 @@ export function parseConfigKey(key) {
             error: `unknown backend field "${third}" for backends.${second} (valid fields: ${validKeys.join(", ")})${typoSuffix(third, validKeys)}`,
         };
     }
-    // `model.<tier>` names one entry of the tier model map — the way `roles.<id>.model`
-    // names one role field, `maxDailyCostUsdPerRole.<role>` names one map entry. The tier
-    // must be a real tier: `config set model.turbo x` would otherwise write a dead map key
-    // the runtime (and doctor's checkKnownKeys) would silently never resolve.
+    return undefined;
+}
+/** `model.<tier>` names one entry of the tier model map — the way `roles.<id>.model`
+ * names one role field, `maxDailyCostUsdPerRole.<role>` names one map entry. The tier
+ * must be a real tier: `config set model.turbo x` would otherwise write a dead map key
+ * the runtime (and doctor's checkKnownKeys) would silently never resolve. */
+function parseModelTier(parts) {
+    const first = parts[0] ?? "";
+    const second = parts.length > 1 ? parts[1] ?? "" : undefined;
     if (parts.length === 2 && first === "model") {
         if ((TIER_MAP_KEYS).includes(second ?? ""))
             return { kind: "tier", map: "model", tier: second };
@@ -139,8 +139,13 @@ export function parseConfigKey(key) {
             error: `unknown model tier "${second ?? ""}" — a dotted \`model.<tier>\` names one of ${TIER_MAP_KEYS.join(", ")} (e.g. \`config set model.strong huggingface/zai-org/GLM-5.3-Flash:together:low\`)${typoSuffix(second ?? "", TIER_MAP_KEYS)}`,
         };
     }
-    // `<section>.<field>` names one field of a fixed-shape section (review, check, idleBackoff,
-    // bootstrap); the field must be one the schema lists, or the write would be a dead key.
+    return undefined;
+}
+/** `<section>.<field>` names one field of a fixed-shape section (review, check, idleBackoff,
+ * bootstrap); the field must be one the schema lists, or the write would be a dead key. */
+function parseSectionField(parts) {
+    const first = parts[0] ?? "";
+    const second = parts.length > 1 ? parts[1] ?? "" : undefined;
     if (parts.length === 2 && Object.hasOwn(DOTTED_SECTION_FIELDS, first)) {
         const section = first;
         const fields = DOTTED_SECTION_FIELDS[section];
@@ -151,9 +156,14 @@ export function parseConfigKey(key) {
             error: `unknown ${first} field "${second ?? ""}" (valid fields: ${fields.join(", ")})${typoSuffix(second ?? "", fields)}`,
         };
     }
-    // A typo'd first segment is the common miss (`maxDailyCostUsdPerRoll.feature`,
-    // `modle.small`); when the head is one of the valid ones the shape itself is wrong, so
-    // suggesting that head back would mislead — the generic wording is the whole story there.
+    return undefined;
+}
+/** The generic dotted-shape rejection: the head is not one of the accepted shapes in a way
+ * the earlier parsers would have claimed, so name the supported dotted forms wholesale. A
+ * typo'd first segment is the common miss (`maxDailyCostUsdPerRoll.feature`, `modle.small`);
+ * when the head is one of the valid ones the shape itself is wrong, so suggesting that head
+ * back would mislead — hence the hint only when the head is unknown. */
+function dottedShapeError(key, first) {
     const headHint = DOTTED_KEY_HEADS.includes(first)
         ? ""
         : typoSuffix(first, DOTTED_KEY_HEADS);
@@ -162,6 +172,22 @@ export function parseConfigKey(key) {
         error: `unknown config key "${key}" — dotted keys name one entry of a per-role map or one field of a role entry (e.g. \`maxDailyCostUsdPerRole.feature 1.5\`, \`roles.qa.model x\`, \`review.model x\`); a bare key names a whole top-level value${headHint}`,
     };
 }
+/** Split a config key into its write/get shape: `foo` is top-level,
+ * `maxDailyCostUsdPerRole.feature` / `quietHoursPerRole.qa` name one map entry,
+ * `roles.qa.model` names one role-entry field, and anything else dotted is an error
+ * naming the supported dotted forms. */
+export function parseConfigKey(key) {
+    if (!key.includes("."))
+        return { kind: "top", key };
+    const parts = key.split(".");
+    const first = parts[0] ?? "";
+    return (parseMapEntry(parts) ??
+        parseRoleField(parts) ??
+        parseBackendField(parts) ??
+        parseModelTier(parts) ??
+        parseSectionField(parts) ??
+        dottedShapeError(key, first));
+}
 /** The error `tumwater config get <key>` and `config set <key> <value>` both surface for a
  * key outside TOP_LEVEL_KEYS — the valid-keys list plus text.ts's did-you-mean suggestion —
  * or null when the key is known. One home for the phrasing so whichever verb misspells a

package/dist/src/config/config-live.js

@@ -5,9 +5,9 @@ import { bestEffortEventLogger, TUMWATER_SOURCE } from "../events/events.js";
 import { RoleRunner } from "../runner/runner.js";
 import { configPath } from "../paths.js";
 import { errorMessage } from "../text/text.js";
-import { backendsInUse, seedOpencodeCatalog } from "../gates/startup-gate.js";
+import { backendsInUse, seedOpencodeCatalog } from "../gates/startup-gates.js";
 import { seedClaudeAccount } from "../agent/claude/claude-account.js";
-import { seedCodexAccount, readCodexAccount } from "../agent/codex/codex-account.js";
+import { codexApiKeyRefusalMessage, seedCodexAccount, readCodexAccount } from "../agent/codex/codex-account.js";
 import { backendMissingMessage, findBackendBinary, resolveBackendBin } from "../pi/pi-bin.js";
 /** A live config reloader over the given wiring; poll it once per scheduler cycle (see
  * LiveConfigReload for the contract). */
@@ -26,10 +26,6 @@ export function newLiveConfigReload(deps) {
     // The cap last applied to the semaphore (live-resized on each reload), so a change logs
     // exactly one event per distinct value — not once per poll.
     let lastMaxConcurrent = Math.max(1, deps.config.maxConcurrent);
-    // The per-provider caps last applied to the semaphore (live-resized on each reload), so a
-    // change logs exactly one event per distinct value — not once per poll. Seeded from the
-    // startup config, so the first poll of an unchanged file emits nothing.
-    let lastKeyCaps = deps.config.maxConcurrentPerProvider ?? {};
     // Roots this process has already attempted a live-edit claude-account seed for (see the
     // reload block below), so repeated polls of a config that keeps a claude seam cannot respawn
     // `claude auth status` on every cycle.
@@ -86,7 +82,7 @@ export function newLiveConfigReload(deps) {
             if (codexLiveRefused)
                 return true;
             codexLiveRefused = true;
-            warn("refusing live edit: Codex is logged in with an API key; tumwater runs Codex on a ChatGPT subscription only — run `CODEX_HOME=<home> codex login --device-auth`");
+            warn(`refusing live edit: ${codexApiKeyRefusalMessage("<home>")}`);
             return true;
         }
         // A poll that did not refuse clears the warn-once marker so a later re-entry into the
@@ -154,7 +150,7 @@ export function newLiveConfigReload(deps) {
             }
         }
     }
-    // Live-resize the concurrency cap and the per-provider key caps.
+    // Live-resize the concurrency cap.
     function resizeConcurrency(nextConfig) {
         // Live-resize the concurrency cap: a mid-run edit changes how many pi runs execute
         // concurrently within this poll — no restart. Growing admits already-queued runs;
@@ -165,26 +161,6 @@ export function newLiveConfigReload(deps) {
             emit({ source: TUMWATER_SOURCE, type: "max_concurrent_changed", from: lastMaxConcurrent, to: newMaxConcurrent });
             lastMaxConcurrent = newMaxConcurrent;
         }
-        // Live-resize the per-provider caps (plans/provider-concurrency.md §7): an edit
-        // re-applies the whole map to the pool, and each changed provider fires its own
-        // `provider_concurrency_changed` event. setKeyCaps never preempts — shrinking only
-        // withholds future grants on that key until releases drain it under the new cap.
-        const nextKeyCaps = nextConfig.maxConcurrentPerProvider ?? {};
-        deps.semaphore.setKeyCaps(nextKeyCaps);
-        for (const provider of new Set([...Object.keys(lastKeyCaps), ...Object.keys(nextKeyCaps)])) {
-            const from = lastKeyCaps[provider];
-            const to = nextKeyCaps[provider];
-            if (from !== to) {
-                emit({
-                    source: TUMWATER_SOURCE,
-                    type: "provider_concurrency_changed",
-                    provider,
-                    from: from ?? 0,
-                    to: to ?? 0,
-                });
-            }
-        }
-        lastKeyCaps = nextKeyCaps;
     }
     // Sync the runner list to newly enabled roles and warn on enable/disable.
     function syncRunners(nextConfig) {

package/dist/src/config/{model-selector.js → config-model-selector.js}

@@ -65,12 +65,12 @@ const BACKEND_DEFAULT_MODELS = {
     // belongs in tumwater.json, not in code.
     opencode: {},
     // codex's tier defaults (plans/codex-backend.md decision 4), from the catalog's own
-    // descriptions (design finding 14): strong is `gpt-6-astra`, default is `gpt-6.1-sol` (Codex's
-    // own default), small is `gpt-6-luna`. The director runs the strong tier, as on claude.
+    // descriptions (design finding 14): strong is `gpt-6.1-sol`, default and small are
+    // `gpt-6-luna`. The director runs the strong tier, as on claude.
     codex: {
         small: "gpt-6-luna",
-        default: "gpt-6.1-sol",
-        strong: "gpt-6-astra",
+        default: "gpt-6-luna",
+        strong: "gpt-6.1-sol",
     },
 };
 /** The backend and concrete model a resolved seam's provider/model pair routes to