tumwater 0.4.2 → 0.4.4

package/dist/src/config/config-views.js

@@ -7,11 +7,13 @@
  * saving, the role-selection helpers) lives in config.ts, the write side in config-write.ts
  * (editor verbs) and config-request.ts (the director's staged request). */
 import { MODEL_TIERS } from "./config-schema.js";
-import { formatModelSelector, parseModelSelector, routeModel } from "./model-selector.js";
+import { formatModelSelector, parseModelSelector, routeModel } from "./config-model-selector.js";
 import { modelPairName } from "../budget/budget.js";
 import { isJsonObject } from "../files/json-object.js";
 import { DIRECTOR_ROLE, roleById } from "../roles/roles.js";
 import { baseRoleOf } from "../roles/runner-ids.js";
+import { sampleHostLoad } from "../build/host-sleep.js";
+import { starvedDeadlineMs } from "../build/build-check-events.js";
 /** The effective `backends.<id>` entry as a run sees it (plans/agent-backends.md "Back-compat"):
  * the file's own entry, with the legacy top-level `agentBin`/`piArgs` read as the pi backend's
  * `bin`/`args` when the new form leaves a field absent. Pure — it never writes those legacy
@@ -31,20 +33,6 @@ export function resolvedBackendConfig(config, id) {
     }
     return { bin: entry?.bin ?? config.agentBin, args: (entry?.args ?? config.piArgs ?? []).slice() };
 }
-/** A backend's subscription-window reserve (plans/codex-backend.md part 2b/9): the nested
- * `backends[backend].windowReserve` when the backend has one, else the top-level
- * `claudeWindowReserve` for claude (its older spelling), else undefined. The two spellings are
- * mutually exclusive in a loaded file (validateConfig rejects one holding both), so the
- * fallback only ever answers for a config written before the rename. Pure: it never writes a
- * spelling back into the file. */
-export function windowReserveFor(config, backend) {
-    const nested = config.backends?.[backend]?.windowReserve;
-    if (nested !== undefined)
-        return nested;
-    if (backend === "claude")
-        return config.claudeWindowReserve;
-    return undefined;
-}
 /** True when `s` names one of the three tiers — the form `roles.<id>.model` /
  * `review.model` may take to point at that tier of the top-level `model` map. */
 export function isTierName(s) {
@@ -109,7 +97,12 @@ export function tierModel(config, tier) {
  * key it overrides would.
  *
  * `tier` is the seam's effective tier, already resolved by the caller from any tier-name
- * override — so `o.model` here is always a selector string, never a tier reference. */
+ * override — so `o.model` here is always a selector string, never a tier reference.
+ *
+ * Exported so imageRerouteTarget (src/agent/image-input.ts) can probe a peer tier's
+ * top-level model (`withModelOverrides(config, tier, {})`, the same shape resolverConfig
+ * builds strong with) and reshape a tier's fallback pair into a runnable config — the
+ * tier-config builder the plan names. */
 export function withModelOverrides(config, tier, o) {
     // The top-level model resolves at the seam's tier: a string form is the default tier's
     // selector; a map form takes the tier's entry, else `default`'s.
@@ -174,14 +167,6 @@ export function roleSeamTier(config, role) {
         return "strong";
     return roleById(role)?.tier ?? "default";
 }
-/** Whether the review gate reviews this role's commits AFTER they merge (review.afterMerge
- * lists the role's base id). One home for the membership test the review gate (review.ts's
- * reviewAttempt), the runner's `already_queued` recovery arm (runner-run.ts) and the role
- * view (`tumwater role <id>` / the dashboard role drawer) all share, so an operator reading
- * one surface sees the same answer every consumer enforces. Pure, no I/O. */
-export function reviewedAfterMerge(config, role) {
-    return (config.review.afterMerge ?? []).includes(baseRoleOf(role));
-}
 /** The config as seen by one role: role-level provider/model/thinking overrides applied
  * over the top-level values, plus the per-role minRunIntervalSeconds (a slow clock for
  * roles that should act rarely) falling back to the global value when unset. The role's
@@ -240,7 +225,9 @@ export function resolverConfig(config) {
  * the merge slot the whole queue waits on, and its only other limits were the run's budget
  * and the quiet watchdog: reviews measured 2026-09-22/23 ran 2.3 min median, 9.2 min p90 and
  * 24.6 min max, while earlier days had 1.5–3.5 h reviews. 15 min clears the ordinary review and
- * kills a wedged one in minutes instead of the run's hours. */
+ * kills a wedged one in minutes instead of the run's hours. Under a starved host the budget
+ * stretches by the load-to-cores ratio (see reviewRunConfig), so a progressing review on a
+ * loaded box is not killed at the wall by load it does not control. */
 export const REVIEW_TIMEOUT_S = 900;
 /** The reviewer's wall-clock floor while the budget fallback carries the team. The free model
  * is typically local and far slower per turn than the budgeted one it replaces, but a review
@@ -253,21 +240,26 @@ export const REVIEW_TIMEOUT_S = 900;
 export const FALLBACK_REVIEW_TIMEOUT_S = 3600;
 /** The config as seen by the gate's reviewer run: the reviewer's model wiring (reviewConfig)
  * with its own time budget — `review.timeoutSeconds`, default REVIEW_TIMEOUT_S — overriding
- * the run's. A smaller runTimeoutSeconds still wins. A still-progressing gate run gets one
- * extension of the same length (src/pi/pi-watchdogs.ts), so the effective ceiling on a large
- * diff's review is twice this budget. */
-export function reviewRunConfig(config) {
+ * the run's. A smaller runTimeoutSeconds still wins. Under a starved host the budget stretches
+ * by `starvedDeadlineMs` (the merge-scope precedent in build-check-events.ts): the load-to-cores
+ * ratio caps it at double the base, so on an ordinary quiet host the value is exactly today's
+ * budget while a progressing review on a loaded box is not killed at the wall by load it does
+ * not control. A still-progressing gate run gets one extension of the same length
+ * (src/pi/pi-watchdogs.ts), so the effective ceiling on a large diff's review is twice this
+ * stretched budget. `load` defaults to `sampleHostLoad` and is injectable for offline tests. */
+export function reviewRunConfig(config, load = sampleHostLoad) {
     const cfg = reviewConfig(config);
+    const baseMs = (config.review.timeoutSeconds ?? REVIEW_TIMEOUT_S) * 1000;
     return {
         ...cfg,
-        runTimeoutSeconds: Math.min(cfg.runTimeoutSeconds, config.review.timeoutSeconds ?? REVIEW_TIMEOUT_S),
+        runTimeoutSeconds: Math.min(cfg.runTimeoutSeconds, starvedDeadlineMs(baseMs, load()) / 1000),
     };
 }
 /** The optional provider/model/thinking fields of a resolved model seam, with each unset
  * (empty) field left out so the result carries only what was resolved — the one home of that
  * assembly. The fallback layer (config-fallbacks.ts's fallbackSelectorFields and
- * fallbackPair/tierOwnFallback/modelFallbackView) and role-view's RoleViewPayload (its
- * model fields) all build a triple this way and follow the same rule — an absent or empty
+ * fallbackPair/tierOwnFallback) and role-view's RoleViewPayload (its model fields) all
+ * build a triple this way and follow the same rule — an absent or empty
  * value is
  * omitted rather than written as undefined/"" (an empty selector field would read as
  * "override present," so it must not appear). */
@@ -285,8 +277,8 @@ export function resolvedModelFields(provider, model, thinking) {
  * provider/model/thinking triple formatted as one selector string, or an empty object when
  * no model id is resolved (pi's own default) — the key stays absent rather than empty, the
  * same empty-means-unset rule resolvedModelFields applies to the raw halves. One home of
- * that assembly and guard, shared by the two run-start event writers (runner-run.ts's run_start,
- * review-run.ts's review_start) and the per-role status snapshot (status-data.ts) so the three
+ * that assembly and guard, shared by the run-start event writer (runner-run.ts's run_start)
+ * and the per-role status snapshot (status-data.ts) so the two
  * observability surfaces cannot disagree about which model a run starts on. A non-pi backend is
  * named as the selector's provider namespace (backendQualifiedSelector), so a claude run reads
  * `claude/claude-sonnet-5-5` in every surface instead of a bare model id. */
@@ -317,22 +309,6 @@ export function seamHoldKey(cfg) {
 export function seamPairName(cfg) {
     return modelPairName({ provider: seamHoldKey(cfg), model: cfg.model });
 }
-/** The key a resolved seam's run counts against the per-provider cap
- * (plans/provider-concurrency.md §2): its hold key, else — for a pi seam that names no model
- * at all and so runs pi's saved default — the default provider from pi's settings
- * (`piDefault`, the caller's cached readPiDefaultModel result, so this view stays free of
- * I/O). A bare id with no provider, or a seam whose pi settings cannot name a default, yields
- * undefined: only the team total bounds it. HF sub-provider pins (`huggingface/…:deepinfra`)
- * share the base provider, and billing does not split claude, because this reuses the hold key
- * — "omlx is held" and "omlx is full" name the same thing on every surface. */
-export function seamConcurrencyKey(cfg, piDefault) {
-    const hold = seamHoldKey(cfg);
-    if (hold !== undefined)
-        return hold;
-    if (cfg.model === undefined)
-        return piDefault?.provider;
-    return undefined;
-}
 /** The team's model wiring as one human-readable label, for the live-reload `model_changed`
  * event: null when no tier resolves to a model (pi's own default), the single selector when
  * every set tier agrees (the string-form `model`), and the `small=…, default=…, strong=…`

package/dist/src/config/config-write.js

@@ -18,12 +18,11 @@ import { show } from "./config-field-checks.js";
 import { canonicalConfigKey } from "./config-aliases.js";
 import { unknownRoleMessage } from "../roles/roles.js";
 import { loadConfig, collapseBackendAliases, knownRoleIdsCached, } from "./config.js";
-import { checkDailyBudgetUsd, checkProviderConcurrencyCap, checkQuietHours, parseConfigKey, PER_KEY_VALIDATORS, unknownConfigKeyError, unknownRoleFieldError, } from "./config-keys.js";
+import { checkDailyBudgetUsd, checkQuietHours, parseConfigKey, PER_KEY_VALIDATORS, unknownConfigKeyError, unknownRoleFieldError, } from "./config-keys.js";
 import { writeConfigMutation, fail, rawConfigObject, without, preservingFileRoles, preserveFileRoles, withSectionOrDropped, } from "./config-write-core.js";
 /** Drop `field` from the `backends.<backend>` entry of the config `next`, dropping the whole
  * backend entry when it empties. The one home of the "remove a nested backend field, drop the
- * backend when empty" step the legacy `agentBin`/`piArgs` collapse and the `claudeWindowReserve`
- * collapse share, so the empty-entry rule cannot drift between the two. */
+ * backend when empty" step the legacy `agentBin`/`piArgs` collapse uses. */
 function dropNestedBackendField(next, backend, field) {
     const record = next;
     const backends = { ...(record.backends ?? {}) };
@@ -62,8 +61,7 @@ export function setDailyBudgetUsd(root, value) {
  * that setConfigKey's JSON.parse would read past validateConfig's integer check and silently
  * write — the same silent misread the per-role instances/interval guards, the TUI team-key
  * editors, and the GUI Settings rows refuse — so setConfigKey refuses it, naming the key and
- * writing nothing. The per-provider map (maxConcurrentPerProvider.<provider>) has its own
- * checkProviderConcurrencyCap screen and is not in this set. */
+ * writing nothing. */
 const PLAIN_INTEGER_TOP_LEVEL_KEYS = new Set([
     "maxConcurrent",
     "mergeBatchMax",
@@ -93,7 +91,6 @@ export function setConfigKey(root, key, rawValue) {
     // and the per-kind merge groups close over that call's `value`/`unchanged`/`oldValue`.
     const exponentRefusal = (parsed, key, trimmed) => {
         const isPlainIntegerKey = (parsed.kind === "top" && PLAIN_INTEGER_TOP_LEVEL_KEYS.has(key)) ||
-            (parsed.kind === "map" && parsed.map === "maxConcurrentPerProvider") ||
             (parsed.kind === "role" && parsed.field === "instances") ||
             (parsed.kind === "section" && parsed.section === "bootstrap" && parsed.field === "untilPlansDone");
         if (isPlainIntegerKey && trimmed !== "" && isExponentSpelling(trimmed))
@@ -112,9 +109,7 @@ export function setConfigKey(root, key, rawValue) {
             const label = `${parsed.map}.${parsed.role}`;
             const validator = parsed.map === "maxDailyCostUsdPerRole"
                 ? checkDailyBudgetUsd
-                : parsed.map === "maxConcurrentPerProvider"
-                    ? checkProviderConcurrencyCap
-                    : checkQuietHours;
+                : checkQuietHours;
             const problem = validator(value, label);
             if (problem)
                 return fail(problem);
@@ -185,12 +180,6 @@ export function setConfigKey(root, key, rawValue) {
                 else
                     delete nextRecord.piArgs;
             }
-            // Setting the nested claude reserve drops the top-level spelling, so the file can never
-            // hold both (validateConfig rejects a file that does, mirroring the agentBin/piArgs pair).
-            if (parsed.id === "claude" && parsed.field === "windowReserve") {
-                const nextRecord = next;
-                delete nextRecord.claudeWindowReserve;
-            }
             return preservingFileRoles(root, next);
         };
         const mergeRoleEntry = (record, parsed) => {
@@ -281,10 +270,6 @@ export function setConfigKey(root, key, rawValue) {
         // Writers keep one spelling: a legacy top-level set drops the matching backends.pi field, so
         // the file can never hold both (validateConfig's raw pass rejects a file that does).
         const dropLegacyPiAlias = (next, key) => dropNestedBackendField(next, "pi", key === "agentBin" ? "bin" : "args");
-        // Writers keep one spelling: setting the top-level `claudeWindowReserve` drops the nested
-        // `backends.claude.windowReserve`, so a supported `config set` never writes the rejected pair
-        // (validateConfig still refuses a hand-edited file holding both).
-        const dropNestedReserve = (next) => dropNestedBackendField(next, "claude", "windowReserve");
         const result = writeConfigMutation(root, (cfg) => {
             oldValue = cfg[key];
             if (isDeepStrictEqual(oldValue, value)) {
@@ -306,8 +291,6 @@ export function setConfigKey(root, key, rawValue) {
                 return collapseBackendAliases(next);
             if (key === "agentBin" || key === "piArgs")
                 return dropLegacyPiAlias(next, key);
-            if (key === "claudeWindowReserve")
-                return dropNestedReserve(next);
             return next;
         });
         if (!result.ok)
@@ -322,8 +305,8 @@ export function setConfigKey(root, key, rawValue) {
         return fail(parsed.error);
     // Shape, before the JSON.parse, for every plain-positive-integer key this verb can write —
     // the top-level run-concurrency knobs and legacy merge batch cap, plus the integer-bound
-    // team-scope keys that arrive as a dotted key (`maxConcurrentPerProvider.<provider>`,
-    // `roles.<id>.instances`, the `bootstrap.untilPlansDone` section field): refuse an exponent
+    // team-scope keys that arrive as a dotted key (`roles.<id>.instances`, the
+    // `bootstrap.untilPlansDone` section field): refuse an exponent
     // spelling ("4e1" → 40) that JSON.parse would read past validateConfig's integer check and
     // silently write, naming the key and writing nothing — the twin of the per-role guards, the
     // TUI team-key editors, and the GUI Settings rows. A non-exponent invalid falls through for
@@ -409,6 +392,106 @@ export function setRoleModelFields(root, base, fields) {
         return { ok: true, unchanged: true };
     return result;
 }
+/** Unset the top-level key `parsed.key` from the raw file, reverting it to its default or to
+ * absence (a whole-config write). Absent from the file (only a default carries it): nothing to
+ * remove — return the config unchanged so writeConfigMutation skips the write. */
+function unsetTopKey(root, cfg, raw, parsed) {
+    // Absent from the file (only a default carries it): nothing to remove.
+    if (!Object.hasOwn(raw, parsed.key))
+        return { cfg, oldValue: undefined };
+    const oldValue = raw[parsed.key];
+    const record = cfg;
+    const next = without(record, parsed.key);
+    // An unrelated unset is a whole-config write too: keep the file's own roles section.
+    if (parsed.key !== "roles")
+        preserveFileRoles(root, next);
+    return { cfg: next, oldValue };
+}
+/** Unset ONE dotted-map entry (`maxDailyCostUsdPerRole.<role>` / `quietHoursPerRole.<role>`),
+ * preserving its siblings; the `parsed.map` section is dropped when it empties. An absent file
+ * entry is a no-op success that leaves the config unchanged. */
+function unsetMapEntry(root, cfg, raw, parsed) {
+    const rawMap = objectOrEmpty(raw[parsed.map]);
+    if (!Object.hasOwn(rawMap, parsed.role))
+        return { cfg, oldValue: undefined }; // absent file entry: a no-op success
+    const oldValue = rawMap[parsed.role];
+    const record = cfg;
+    const existing = record[parsed.map] ?? {};
+    const next = without(existing, parsed.role);
+    return { cfg: withSectionOrDropped(root, cfg, parsed.map, next), oldValue };
+}
+/** Unset one `model.<tier>`; a string `model` resolves to { default } (modelTierMap), so unsetting
+ * a tier the FILE does not hold is a no-op that leaves the string untouched. The `model` section
+ * is dropped when it empties. */
+function unsetModelTier(root, cfg, raw, parsed) {
+    // A string `model` resolves to { default } (modelTierMap); unsetting a tier the FILE
+    // does not hold is a no-op that leaves the string untouched.
+    const rawTiers = modelTierMap(raw.model);
+    if (!Object.hasOwn(rawTiers, parsed.tier))
+        return { cfg, oldValue: undefined };
+    const oldValue = rawTiers[parsed.tier];
+    const existing = modelTierMap(cfg.model);
+    const next = without(existing, parsed.tier);
+    return { cfg: withSectionOrDropped(root, cfg, "model", next), oldValue };
+}
+/** Unset ONE dotted section field (`backoff.<field>` / `bootstrap.<field>` …), preserving its
+ * siblings; the section is dropped when it empties. Presence is judged against the FILE: a field
+ * only the default carries is a no-op success. */
+function unsetSectionField(root, cfg, raw, parsed) {
+    // Presence is judged against the FILE: a field only the default carries is a no-op
+    // success, and an emptied section leaves the file.
+    const rawSection = objectOrEmpty(raw[parsed.section]);
+    if (!Object.hasOwn(rawSection, parsed.field))
+        return { cfg, oldValue: undefined };
+    const oldValue = rawSection[parsed.field];
+    const record = cfg;
+    const existing = record[parsed.section] ?? {};
+    return { cfg: withSectionOrDropped(root, cfg, parsed.section, without(existing, parsed.field)), oldValue };
+}
+/** Unset ONE `backends.<id>` field (`bin`/`args`/`configDir`); the entry and the `backends`
+ * section are dropped when they empty, so the file never keeps an empty object. Presence is
+ * judged against the FILE, so a field only the default (or the legacy alias's resolved view)
+ * carries is a no-op success. */
+function unsetBackendField(root, cfg, raw, parsed) {
+    // Presence is judged against the FILE, so unsetting a field only the default (or the
+    // legacy alias's resolved view) carries is a no-op success. The entry and the `backends`
+    // section are dropped when they empty, so the file never keeps an empty object.
+    const rawBackends = objectOrEmpty(raw.backends);
+    const rawEntry = objectOrEmpty(rawBackends[parsed.id]);
+    if (!Object.hasOwn(rawEntry, parsed.field))
+        return { cfg, oldValue: undefined }; // absent file field: a no-op success
+    const oldValue = rawEntry[parsed.field];
+    const record = cfg;
+    const backends = { ...record.backends };
+    const entry = { ...(backends[parsed.id] ?? {}) };
+    delete entry[parsed.field];
+    if (Object.keys(entry).length === 0)
+        delete backends[parsed.id];
+    else
+        backends[parsed.id] = entry;
+    return { cfg: withSectionOrDropped(root, cfg, "backends", backends), oldValue };
+}
+/** Unset ONE `roles.<id>` field, based on the FILE's own roles — not the loaded (catalog-merged)
+ * map — so the write must not re-expand the operator's partial section to every built-in. The
+ * entry is dropped when it empties, and the whole `roles` section when it was the last one. */
+function unsetRoleField(cfg, raw, parsed) {
+    const rawRoles = objectOrEmpty(raw.roles);
+    const rawEntry = objectOrEmpty(rawRoles[parsed.id]);
+    if (!Object.hasOwn(rawEntry, parsed.field))
+        return { cfg, oldValue: undefined }; // absent file field: a no-op success
+    const oldValue = rawEntry[parsed.field];
+    // Base the removal on the FILE's own roles, not the loaded (catalog-merged) map: the
+    // write must not re-expand the operator's partial section to every built-in.
+    const record = cfg;
+    const nextEntry = without(rawEntry, parsed.field); // the file's own entry (its field was present, checked above)
+    if (Object.keys(nextEntry).length > 0)
+        return { cfg: { ...cfg, roles: { ...rawRoles, [parsed.id]: nextEntry } }, oldValue };
+    // The entry emptied: drop it, and the whole `roles` section when it was the last one.
+    const nextRoles = without(rawRoles, parsed.id);
+    if (Object.keys(nextRoles).length === 0)
+        return { cfg: without(record, "roles"), oldValue };
+    return { cfg: { ...cfg, roles: nextRoles }, oldValue };
+}
 /** Remove ONE value of tumwater.json from its raw CLI text (`tumwater config unset <key>`):
  * the inverse of setConfigKey. A bare top-level key is deleted (reverting to its default or
  * to absence); a dotted key (`maxDailyCostUsdPerRole.<role>`, `quietHoursPerRole.<role>`,
@@ -444,86 +527,29 @@ export function unsetConfigKey(root, key) {
     let oldValue;
     const result = writeConfigMutation(root, (cfg) => {
         const raw = rawConfigObject(root); // the file's own keys, before defaults fill them in
-        const record = cfg;
-        if (parsed.kind === "top") {
-            // Absent from the file (only a default carries it): nothing to remove.
-            if (!Object.hasOwn(raw, parsed.key))
-                return cfg;
-            oldValue = raw[parsed.key];
-            const next = without(record, parsed.key);
-            // An unrelated unset is a whole-config write too: keep the file's own roles section.
-            if (parsed.key !== "roles")
-                preserveFileRoles(root, next);
-            return next;
+        let moved;
+        switch (parsed.kind) {
+            case "top":
+                moved = unsetTopKey(root, cfg, raw, parsed);
+                break;
+            case "map":
+                moved = unsetMapEntry(root, cfg, raw, parsed);
+                break;
+            case "tier":
+                moved = unsetModelTier(root, cfg, raw, parsed);
+                break;
+            case "section":
+                moved = unsetSectionField(root, cfg, raw, parsed);
+                break;
+            case "agent":
+                moved = unsetBackendField(root, cfg, raw, parsed);
+                break;
+            case "role":
+                moved = unsetRoleField(cfg, raw, parsed);
+                break;
         }
-        if (parsed.kind === "map") {
-            const rawMapCandidate = raw[parsed.map];
-            const rawMap = objectOrEmpty(rawMapCandidate);
-            if (!Object.hasOwn(rawMap, parsed.role))
-                return cfg; // absent file entry: a no-op success
-            oldValue = rawMap[parsed.role];
-            const existing = record[parsed.map] ?? {};
-            const next = without(existing, parsed.role);
-            return withSectionOrDropped(root, cfg, parsed.map, next);
-        }
-        if (parsed.kind === "tier") {
-            // A string `model` resolves to { default } (modelTierMap); unsetting a tier the FILE
-            // does not hold is a no-op that leaves the string untouched.
-            const rawTiers = modelTierMap(raw.model);
-            if (!Object.hasOwn(rawTiers, parsed.tier))
-                return cfg;
-            oldValue = rawTiers[parsed.tier];
-            const existing = modelTierMap(record.model);
-            const next = without(existing, parsed.tier);
-            return withSectionOrDropped(root, cfg, "model", next);
-        }
-        if (parsed.kind === "section") {
-            // Presence is judged against the FILE: a field only the default carries is a no-op
-            // success, and an emptied section leaves the file.
-            const rawSection = objectOrEmpty(raw[parsed.section]);
-            if (!Object.hasOwn(rawSection, parsed.field))
-                return cfg;
-            oldValue = rawSection[parsed.field];
-            const existing = record[parsed.section] ?? {};
-            return withSectionOrDropped(root, cfg, parsed.section, without(existing, parsed.field));
-        }
-        if (parsed.kind === "agent") {
-            // Presence is judged against the FILE, so unsetting a field only the default (or the
-            // legacy alias's resolved view) carries is a no-op success. The entry and the `backends`
-            // section are dropped when they empty, so the file never keeps an empty object.
-            const rawBackends = objectOrEmpty(raw.backends);
-            const rawEntryCandidate = rawBackends[parsed.id];
-            const rawEntry = objectOrEmpty(rawEntryCandidate);
-            if (!Object.hasOwn(rawEntry, parsed.field))
-                return cfg; // absent file field: a no-op success
-            oldValue = rawEntry[parsed.field];
-            const backends = { ...record.backends };
-            const entry = { ...(backends[parsed.id] ?? {}) };
-            delete entry[parsed.field];
-            if (Object.keys(entry).length === 0)
-                delete backends[parsed.id];
-            else
-                backends[parsed.id] = entry;
-            return withSectionOrDropped(root, cfg, "backends", backends);
-        }
-        const rawRolesCandidate = raw.roles;
-        const rawRoles = objectOrEmpty(rawRolesCandidate);
-        const rawEntryCandidate = rawRoles[parsed.id];
-        const rawEntry = objectOrEmpty(rawEntryCandidate);
-        if (!Object.hasOwn(rawEntry, parsed.field))
-            return cfg; // absent file field: a no-op success
-        oldValue = rawEntry[parsed.field];
-        // Base the removal on the FILE's own roles, not the loaded (catalog-merged) map: the
-        // write must not re-expand the operator's partial section to every built-in.
-        const existing = rawEntry; // the file's own entry (its field was present, checked above)
-        const nextEntry = without(existing, parsed.field);
-        if (Object.keys(nextEntry).length > 0)
-            return { ...cfg, roles: { ...rawRoles, [parsed.id]: nextEntry } };
-        // The entry emptied: drop it, and the whole `roles` section when it was the last one.
-        const nextRoles = without(rawRoles, parsed.id);
-        if (Object.keys(nextRoles).length === 0)
-            return without(record, "roles");
-        return { ...cfg, roles: nextRoles };
+        oldValue = moved.oldValue;
+        return moved.cfg;
     });
     if (!result.ok)
         return result;

package/dist/src/config/config.js

@@ -34,7 +34,7 @@ export function parseJsonConfig(file, basename) {
  * defaults for concurrency, timeouts, log size, retention, thrash detection, idle backoff,
  * self-redeploy, and review settings. The return type is the resolved view (config-views.ts): a
  * freshly defaulted config has no model map to resolve — only a loaded file can carry one — so
- * every call site that hands a default into a pi run (run-agent.ts's PiRunOptions, tests)
+ * every call site that hands a default into a pi run (agent-run.ts's PiRunOptions, tests)
  * satisfies ResolvedModelConfig directly. */
 export function defaultConfig() {
     const roles = {};
@@ -143,15 +143,7 @@ export function defaultConfig() {
         // explicit user instruction from being discarded by a rejected review — has nothing left
         // to exempt. Removing it also closes the path where a director run could merge a mixed
         // doc-plus-config diff unreviewed.
-        // Reviewer as a regular role (part 1/4): the high-volume, low-blast-radius roles — bugfix,
-        // readme, organize, plus clean, dedupe, coverage — are reviewed AFTER they merge, on their
-        // merged commit (src/review/post-merge-review.ts), instead of holding the merge queue for a
-        // reviewer run on their (usually trivial) diff; a rejection keeps the commit on main
-        // with the reviewer's reasons. feature, director, perf, improve and custom roles stay
-        // pre-merge. A
-        // config that omits `review.afterMerge` inherits this, and `"afterMerge": []` opts out (back
-        // to reviewing before merging).
-        review: { enabled: true, exemptPaths: ["*.md", "docs/**"], afterMerge: ["bugfix", "clean", "coverage", "dedupe", "organize", "readme"] },
+        review: { enabled: true, exemptPaths: ["*.md", "docs/**"] },
         customRoles: [],
         roles,
     };
@@ -285,7 +277,7 @@ function cloneConfig(c) {
  * reconfiguration (BUGS.md 2026-09-23: a merge's fast-forward deleted it and the team ran
  * 8.6 h on defaults), so callers keep their last-known-good exactly as for a broken file, or
  * fall back to defaults only when they never saw one. Startup's "missing ⇒ not initialized"
- * gate (startup-gate.ts) and loadConfig's first-run defaults are unaffected. */
+ * gate (startup-gates.ts) and loadConfig's first-run defaults are unaffected. */
 export function loadConfigCached(root) {
     const file = configPath(root);
     try {
@@ -353,13 +345,12 @@ function stableJson(value) {
 }
 /** Sorted names of the config settings whose value differs between two loaded configs, for the
  * orchestrator's live-reload event. `maxConcurrent` and `sessionRetentionDays` are skipped: each
- * already has its own, more informative event. `maxConcurrentPerProvider` is skipped too — each
- * changed provider fires its own `provider_concurrency_changed` event. The `roles` map is never
+ * already has its own, more informative event. The `roles` map is never
  * reported whole — only
  * each differing `roles.<id>` — so a `customRoles` add/remove names both the section and the
  * affected role. */
 export function changedConfigKeys(prev, next) {
-    const skip = new Set(["maxConcurrent", "maxConcurrentPerProvider", "sessionRetentionDays", "roles"]);
+    const skip = new Set(["maxConcurrent", "sessionRetentionDays", "roles"]);
     const keys = [];
     const prevRecord = prev;
     const nextRecord = next;

package/dist/src/doctor/doctor-backlog-bugs.js

@@ -2,14 +2,14 @@ import { andMore, quoteHeading, readBacklogChecked, FIX_CLAIMS_CHECKED, REFUSAL_
 import { truncate } from "../text/text.js";
 import { plural, agree } from "../text/phrases.js";
 import { ageInDays, filingDate, fixedBugEntries, openBugEntries, openQuestionEntries, plannedPlanEntries } from "../backlog/backlog.js";
-import { questionFilingDate } from "../backlog/question-answer.js";
+import { questionFilingDate } from "../backlog/backlog-question-answer.js";
 import { needsReviewNote, refusalNote } from "../backlog/backlog-eligibility.js";
 import { plannedPartKeys, plansWaitingOn, prerequisitesMerged } from "../backlog/backlog-parts.js";
 import { lastDate } from "../backlog/backlog-md.js";
 import { formatTimestamp } from "../text/datetime.js";
 import { stringList } from "../files/json-object.js";
 import { readEventsSince } from "../events/event-window.js";
-import { okOutcome, warnOutcome } from "./outcome.js";
+import { okOutcome, warnOutcome } from "./doctor-outcome.js";
 /** The doctor's open-bug and question checks, split out of doctor-backlog.ts: questions that
  * have waited too long for an answer (checkStaleQuestions), bugs left unfixed (checkStaleBugs),
  * fixed records whose quoted test regressed (checkRegressedFixes), and
@@ -17,7 +17,8 @@ import { okOutcome, warnOutcome } from "./outcome.js";
  * (readBacklogChecked, andMore) from doctor-backlog.ts, plus the age/trim bounds, and
  * all warn instead of failing: a stale or
  * parked entry is operator signal, not a broken environment. doctor.ts composes them beside the
- * plan-structure and queue checks; the shared CheckOutcome shape is imported from outcome.ts. */
+ * plan-structure and queue checks; the shared CheckOutcome shape is imported from
+ * doctor-outcome.ts. */
 /** Stale questions — open QUESTIONS.md questions that have waited more than 7 days for an
  * answer. A team can stay parked on a question for days while `tumwater doctor` reports
  * nothing; the `--list` age (`questionAgeSuffix` on `tumwater questions`) is the only other
@@ -143,7 +144,7 @@ function sinceWindowMs(sinces) {
  * cannot drift on the selection. `since` is the day-after the fix date — the recurrence scan's
  * boundary (the heading carries only a date, so a same-day failure cannot be told from the one
  * the fix answered). Returns `[]` when no candidate has both a quoted test and a date. */
-export function regressedFixCandidates(root) {
+function regressedFixCandidates(root) {
     const candidates = fixedBugEntries(root).slice(0, FIX_CLAIMS_CHECKED).flatMap((entry) => {
         const name = quotedTestName(entry.title);
         const date = lastDate(entry.title, /(\d{4}-\d{2}-\d{2})/);
@@ -159,14 +160,14 @@ export function regressedFixCandidates(root) {
  * `failureMentions` per candidate over `events`, keeping the last mention (the doctor's exact
  * match). The caller supplies the event window — the doctor reads back to the oldest candidate's
  * day-after, the always-on alert the trailing day. */
-export function matchedRegressedFixes(candidates, events) {
+function matchedRegressedFixes(candidates, events) {
     return candidates.flatMap((c) => {
         const newest = lastFailureMention(events, c.name, c.since);
         return newest ? [{ ...c, newest }] : [];
     });
 }
 /** The doctor's `regressed fixes` warn sentence, verbatim, or null when nothing regressed. */
-export function regressedFixesPhrase(regressed) {
+function regressedFixesPhrase(regressed) {
     const [first, ...rest] = regressed;
     if (!first)
         return null;