tumwater 0.4.2 → 0.4.4

package/dist/src/doctor/doctor-claude-checks.js

@@ -1,13 +1,13 @@
 import os from "node:os";
 import { childEnv } from "../process/process.js";
-import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./probe.js";
+import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./doctor-probe.js";
 import { claudeBackend, claudeConfigDir } from "../agent/claude/claude-backend.js";
 import { claudeEnv } from "../agent/claude/claude-env.js";
 import { claudeAuthUsesSubscription, parseClaudeAuthStatus } from "../agent/claude/claude-account.js";
 import { resolvedBackendConfig } from "../config/config-views.js";
 import { envPath } from "../files/files.js";
 import { belowNodeFloor } from "../version.js";
-import { failOutcome, okOutcome, warnOutcome } from "./outcome.js";
+import { failOutcome, okOutcome, warnOutcome } from "./doctor-outcome.js";
 import { claudeSeamsInUse, loadConfigForCheck, versionFromProbe, seamedModels, } from "./doctor-model-checks.js";
 /** The doctor's claude credential and version readiness checks, split out of
  * doctor-model-checks.ts (whose shared seam/model framework and the pi and tier-models
@@ -16,9 +16,24 @@ import { claudeSeamsInUse, loadConfigForCheck, versionFromProbe, seamedModels, }
  * distinct concern from the filesystem/git checks, kept together so a change to how doctor
  * spawns or scrubs claude does not touch the other model checks. The shared report contract
  * (CheckOutcome) and the seam/model framework (loadConfigForCheck, claudeSeamsInUse,
- * seamPairs) come from doctor-model-checks.ts, and the AUTH_CHECK_* probe budgets from probe.ts,
- * with the shared report contract (CheckOutcome) from outcome.ts, exactly as the other doctor-*
- * modules share them. */
+ * seamPairs) come from doctor-model-checks.ts, and the AUTH_CHECK_* probe budgets
+ * from doctor-probe.ts, with the shared report contract (CheckOutcome) from
+ * doctor-outcome.ts, exactly as the other doctor-* modules share them. */
+/** The config a claude readiness row reads, or the warn outcome a broken `tumwater.json`
+ * earns, or the ok stand-down when no seam routes to claude. The claude rows repeat the same
+ * three-line guard and the same seam stand-down (`loadConfigForCheck` + `claudeSeamsInUse`);
+ * folding them here mirrors codexCheckBase so a change to how doctor guards a claude check
+ * touches one spot instead of three. Each caller still checks the seams it needs — the auth
+ * rows use `claudeSeamsInUse` directly (folded here), the version row goes on to
+ * `seamedModels` for the floors. */
+function claudeCheckBase(root) {
+    const config = loadConfigForCheck(root);
+    if ("level" in config)
+        return config;
+    if (!claudeSeamsInUse(config))
+        return okOutcome("no model jobs run on claude");
+    return config;
+}
 /** One bounded probe of the resolved `claude` binary under the scrubbed run environment a real
  * run gets: resolve the binary through the claude adapter that would spawn it and run `args`
  * with a short deadline. Null when the probe could not run, the child errored, or the deadline
@@ -47,6 +62,13 @@ async function claudeAuthProbe(config, pathEnv, timeoutMs) {
         return null;
     return parseClaudeAuthStatus(result.stdout);
 }
+/** The warn verdict both auth-driven claude rows return when `claude auth status` could not
+ * run or its reply was unreadable — the one home of the wording so checkClaudeAuth and
+ * checkAnthroApiKey cannot drift on the unreadable-probe message. Each caller makes its own
+ * solitary `claudeAuthProbe` call and branches on null through it. */
+function claudeAuthUnreadable() {
+    return warnOutcome("could not check — `claude auth status` did not run or its output was unreadable");
+}
 /** claude credential readiness (plans/agent-backends.md "Every seam, checked"): a claude seam
  * whose login is gone fails every run before it can work, so doctor runs `claude auth status`
  * under the scrubbed run environment and fails when it reports `loggedIn: false`. An ok detail
@@ -55,14 +77,12 @@ async function claudeAuthProbe(config, pathEnv, timeoutMs) {
  * probe that could not run or a reply this cannot read warns rather than guesses. Stands down
  * (ok) when no seam routes to claude, so a pi-only team spawns nothing. */
 export async function checkClaudeAuth(root, pathEnv = envPath(), timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
-    const config = loadConfigForCheck(root);
+    const config = claudeCheckBase(root);
     if ("level" in config)
         return config;
-    if (!claudeSeamsInUse(config))
-        return okOutcome("no model jobs run on claude");
     const auth = await claudeAuthProbe(config, pathEnv, timeoutMs);
     if (auth === null)
-        return warnOutcome("could not check — `claude auth status` did not run or its output was unreadable");
+        return claudeAuthUnreadable();
     if (!auth.loggedIn)
         return failOutcome("claude reports logged in: false — run `claude auth login`");
     const subscription = claudeAuthUsesSubscription(auth);
@@ -80,54 +100,40 @@ export async function checkClaudeAuth(root, pathEnv = envPath(), timeoutMs = AUT
  * an API-key login (then there is no subscription to lose). `env` is injectable so the check
  * stays hermetic; a probe that cannot run warns rather than guesses like checkClaudeAuth. */
 export async function checkAnthroApiKey(root, env = process.env, pathEnv = envPath(), timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
-    const config = loadConfigForCheck(root);
+    const config = claudeCheckBase(root);
     if ("level" in config)
         return config;
-    if (!claudeSeamsInUse(config))
-        return okOutcome("no model jobs run on claude");
     const apiKey = env.ANTHROPIC_API_KEY;
     if (apiKey === undefined || apiKey === "")
         return okOutcome("no ANTHROPIC_API_KEY set");
     const auth = await claudeAuthProbe(config, pathEnv, timeoutMs);
     if (auth === null)
-        return warnOutcome("could not check — `claude auth status` did not run or its output was unreadable");
+        return claudeAuthUnreadable();
     if (!auth.loggedIn || !claudeAuthUsesSubscription(auth))
         return okOutcome("ANTHROPIC_API_KEY is set, but claude reports no claude.ai login");
     return warnOutcome("ANTHROPIC_API_KEY is set while claude reports a claude.ai login — model jobs on claude will bill the API key, not the subscription; unset it or route every anthropic model job on pi explicitly");
 }
-/** claude CLI-version readiness (plans/agent-backends.md finding 9): an installed CLI below a
- * configured model's minimum fails or misprices that model, and team runs disable the
- * auto-updater, so the version an operator has is the version agent runs use. Fails below the
- * highest floor among the claude-routed models, naming which model needs it; an ok detail
- * prints the installed version and the floor it satisfied (or no floor when none applies).
- * The `off`/`minimal` thinking clamp is noted here too, since this check already has the
- * claude seams in hand. Stands down when no seam routes to claude. */
-export async function checkClaudeVersion(root, pathEnv = envPath(), timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
-    const config = loadConfigForCheck(root);
-    if ("level" in config)
-        return config;
-    const seams = seamedModels(config, "claude");
-    if (seams.length === 0)
-        return okOutcome("no model jobs run on claude");
-    // The floor each configured model needs; a model the adapter does not gate contributes none.
+/** The floor each configured model needs, keyed by model; a model the adapter does not gate
+ * contributes none. */
+function claudeVersionFloors(seams) {
     const floors = new Map();
     for (const seam of seams) {
         const min = claudeBackend.minVersion?.(seam.model);
         if (min !== undefined)
             floors.set(seam.model, min);
     }
-    const result = await claudeProbe(config, ["--version"], pathEnv, timeoutMs);
-    const found = versionFromProbe(result);
-    if (found === undefined)
-        return warnOutcome("could not check — `claude --version` did not run or its output was unreadable");
+    return floors;
+}
+/** The clamp note when any claude seam clamps thinking, else empty. */
+function claudeVersionClampNote(seams) {
     const clamped = seams.some((seam) => seam.thinking === "off" || seam.thinking === "minimal");
     const clampNote = clamped
         ? "; `off`/`minimal` thinking clamps to `--effort low` (claude has no lower setting)"
         : "";
-    if (floors.size === 0)
-        return okOutcome(`claude ${found}${clampNote}`);
-    // The highest floor decides: whichever model needs the newest CLI. Below it, fail and name
-    // that model; at or above, print the version against the floor.
+    return clampNote;
+}
+/** The highest floor decides: whichever model needs the newest CLI. */
+function claudeVersionNeededBy(floors) {
     let required = "";
     let neededBy = "";
     for (const [model, min] of floors) {
@@ -136,7 +142,35 @@ export async function checkClaudeVersion(root, pathEnv = envPath(), timeoutMs =
             neededBy = model;
         }
     }
+    return { required, neededBy };
+}
+/** Verdict on the found version against the claude seams' floors, carrying the clamp note. */
+function claudeVersionOutcome(found, floors, clampNote) {
+    if (floors.size === 0)
+        return okOutcome(`claude ${found}${clampNote}`);
+    const { required, neededBy } = claudeVersionNeededBy(floors);
     if (belowNodeFloor(found, `>=${required}`))
         return failOutcome(`claude ${found} is older than ${required} required by ${neededBy} — run \`claude update\``);
     return okOutcome(`claude ${found} (>= ${required} for ${neededBy})${clampNote}`);
 }
+/** claude CLI-version readiness (plans/agent-backends.md finding 9): an installed CLI below a
+ * configured model's minimum fails or misprices that model, and team runs disable the
+ * auto-updater, so the version an operator has is the version agent runs use. Fails below the
+ * highest floor among the claude-routed models, naming which model needs it; an ok detail
+ * prints the installed version and the floor it satisfied (or no floor when none applies).
+ * The `off`/`minimal` thinking clamp is noted here too, since this check already has the
+ * claude seams in hand. Stands down when no seam routes to claude. */
+export async function checkClaudeVersion(root, pathEnv = envPath(), timeoutMs = AUTH_CHECK_TIMEOUT_MS) {
+    const config = claudeCheckBase(root);
+    if ("level" in config)
+        return config;
+    const seams = seamedModels(config, "claude");
+    if (seams.length === 0)
+        return okOutcome("no model jobs run on claude");
+    const floors = claudeVersionFloors(seams);
+    const result = await claudeProbe(config, ["--version"], pathEnv, timeoutMs);
+    const found = versionFromProbe(result);
+    if (found === undefined)
+        return warnOutcome("could not check — `claude --version` did not run or its output was unreadable");
+    return claudeVersionOutcome(found, floors, claudeVersionClampNote(seams));
+}

package/dist/src/doctor/doctor-codex-checks.js

@@ -1,19 +1,19 @@
 import fs from "node:fs";
 import path from "node:path";
 import { childEnv } from "../process/process.js";
-import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./probe.js";
+import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./doctor-probe.js";
 import { codexBackend, CODEX_MIN_VERSION } from "../agent/codex/codex-backend.js";
 import { codexEffort, EFFORT_BY_THINKING } from "../agent/codex/codex-args.js";
 import { codexEnv } from "../agent/codex/codex-env.js";
 import { codexHome, readCodexCatalog } from "../agent/codex/codex-catalog.js";
 import { codexHookTrust } from "../agent/codex/codex-hook-trust.js";
-import { parseCodexLoginStatus } from "../agent/codex/codex-account.js";
+import { codexApiKeyRefusalMessage, parseCodexLoginStatus } from "../agent/codex/codex-account.js";
 import { codexWriteGuardDefinition } from "../agent/codex/codex-write-guard.js";
 import { resolvedBackendConfig } from "../config/config-views.js";
 import { envPath, isDirectory, readTextOrNull, statOrNull, treeBytes, walkFiles } from "../files/files.js";
 import { formatBytes, tokenWindowLabel } from "../text/format.js";
 import { errorMessage } from "../text/text.js";
-import { failOutcome, okOutcome, warnOutcome } from "./outcome.js";
+import { failOutcome, okOutcome, warnOutcome } from "./doctor-outcome.js";
 import { codexSeamsInUse, loadConfigForCheck, minVersionOutcome, versionFromProbe, seamedModels, } from "./doctor-model-checks.js";
 /** The doctor's codex rows (part 9a/9, plans/codex-backend.md §4, §7, "Hand steps"): one
  * exported check per row — install/version, login, home, models, account, leaks, sessions
@@ -25,8 +25,8 @@ import { codexSeamsInUse, loadConfigForCheck, minVersionOutcome, versionFromProb
  * pi-only team shows no codex row and spawns nothing and reads nothing. The shared
  * report contract (CheckOutcome) and the seam/model framework (loadConfigForCheck,
  * codexSeamsInUse, seamPairs) come from doctor-model-checks.ts, the AUTH_CHECK_* probe budgets
- * from probe.ts, and the shared report contract (CheckOutcome) from outcome.ts, as the other
- * doctor-* modules share them. */
+ * from doctor-probe.ts, and the shared report contract (CheckOutcome) from
+ * doctor-outcome.ts, as the other doctor-* modules share them. */
 /** The config and codex home a codex readiness row reads, or the warn outcome a broken
  * `tumwater.json` earns, or null when no seam routes to codex (the row's stand-down). All
  * eight rows repeat the same three-line guard and the same home lookup
@@ -83,7 +83,7 @@ export async function checkCodexAuth(root, pathEnv = envPath(), timeoutMs = AUTH
     if (status === "subscription")
         return okOutcome("logged in using ChatGPT — billing: subscription");
     if (status === "api")
-        return failOutcome(`Codex is logged in with an API key; tumwater runs Codex on a ChatGPT subscription only — run \`CODEX_HOME=${home} codex login --device-auth\``);
+        return failOutcome(codexApiKeyRefusalMessage(home));
     if (/Not logged in/i.test(result.stdout ?? ""))
         return failOutcome(`codex is not logged in — run \`CODEX_HOME=${home} codex login --device-auth\``);
     return warnOutcome("could not check — `codex login status` reply was unreadable");

package/dist/src/doctor/doctor-contention-checks.js

@@ -18,24 +18,20 @@ import { finiteNumber, stringList } from "../files/json-object.js";
 import { commitExists, deleteRefIfAt, listBranches, refSha, refsUnder } from "../git/git.js";
 import { readSlotsState } from "../git/slots-state.js";
 import { eventsSince } from "../events/event-window.js";
-import { DAY_MS } from "../text/datetime.js";
+import { DAY_MS, HOUR_MS } from "../text/datetime.js";
 import { shortSha } from "../text/format.js";
 import { errorMessage, joinParts, textOr } from "../text/text.js";
 import { rankCountEntries } from "../collections.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
+import { sampleHostLoad } from "../build/host-sleep.js";
 import { INSTANCE_ROLES, runnerEnabled, runnerIds } from "../roles/runner-ids.js";
 import { staleClaimDetail, staleClaimEntries } from "../scheduling/claim-entries.js";
-import { piModelsPath } from "../pi/pi-models.js";
-import { piSettingsPath, readPiDefaultModel } from "../pi/pi-settings.js";
-import { seamConcurrencyKey } from "../config/config-views.js";
-import { seamsInUse } from "../config/config-fallbacks.js";
-import { enforcedKeyCaps } from "../concurrency/semaphore.js";
 import { classifyLock, readLockPid } from "../concurrency/lock.js";
 import { branchName, mergeLockDir, worktreesDir } from "../paths.js";
-import { artifactPhrase, retireRole } from "../operator/retire.js";
+import { artifactPhrase, retireRole } from "../operator/operator-retire.js";
 import { loadRunnerState } from "../runner/runner-state-load.js";
 import { agree, plural, shortSpanPhrase } from "../text/phrases.js";
-import { failOutcome, okOutcome, warnOutcome } from "./outcome.js";
+import { failOutcome, noConfigOutcome, okOutcome, warnOutcome } from "./doctor-outcome.js";
 /** Merge lock — read-only classification via classifyLock (the same three cases the breaker
  * uses). A stale lock is a warning, not a failure: it self-heals on the next merge. */
 export function checkMergeLock(root) {
@@ -75,8 +71,8 @@ export function staleWorkspacePins(root, now = Date.now()) {
  * the pin's whole-ms age). `role` is a non-optional string on StaleWorkspacePin, but the
  * clause renders it through textOr like the row always did, so a malformed pin can never
  * print nothing where the phrase expects a role. */
-export function stalePinPhrase(pin) {
-    return `${textOr(pin.role)} pinned on ${pin.dir} for ${Math.round(pin.ageMs / 3_600_000)}h`;
+function stalePinPhrase(pin) {
+    return `${textOr(pin.role)} pinned on ${pin.dir} for ${Math.round(pin.ageMs / HOUR_MS)}h`;
 }
 /** Directory names under the worktrees root that the pool no longer owns: a legacy per-role
  * `<role>` checkout (the pre-pool layout) or a `_land-<role>` checkout from the merge queue. The
@@ -86,11 +82,11 @@ function leftoverWorktreeDirs(root) {
     return subdirectoryNames(worktreesDir(root), (name) => name !== DIRECTOR_ROLE && !(name.startsWith("_") && !name.startsWith("_land-")));
 }
 /** The window of `slot_wait` events the pool row sums, and the total wait inside it that warns. */
-export const SLOT_WAIT_CHECK_WINDOW_MS = DAY_MS;
+const SLOT_WAIT_CHECK_WINDOW_MS = DAY_MS;
 const SLOT_WAIT_WARN_TOTAL_MS = 10 * 60_000;
-export const PROVIDER_WAIT_CHECK_WINDOW_MS = DAY_MS;
+const PROVIDER_WAIT_CHECK_WINDOW_MS = DAY_MS;
 const PROVIDER_WAIT_WARN_TOTAL_MS = 10 * 60_000;
-export const CHECK_WAIT_CHECK_WINDOW_MS = DAY_MS;
+const CHECK_WAIT_CHECK_WINDOW_MS = DAY_MS;
 const CHECK_WAIT_WARN_TOTAL_MS = 10 * 60_000;
 /** Fold a window's `*_wait` events into the three numbers every contention check reads: how
  * many waits there were (each event counts once), the total ms they waited, and the longest
@@ -116,26 +112,34 @@ function sumWaits(waits) {
     }
     return { count, totalMs, longestMs, longest };
 }
+/** The leading wait-summary clause every `*_wait` contention row shares — the wait count, the
+ * total and the longest span over the trailing day. Only the verb naming the waited-for thing
+ * differs between the three rows ("to start", "for a provider slot", "for a check slot"), so
+ * this single home keeps the shared wording — the same `plural("wait")`/`shortSpanPhrase`
+ * bucketing — from drifting between them. Each row appends its own bucket/knob tail after it. */
+function waitDetail(count, verb, totalMs, longestMs) {
+    return `${plural(count, "wait")} ${verb} in the last 24h, ${shortSpanPhrase(totalMs)} total, longest ${shortSpanPhrase(longestMs)}`;
+}
 /** The `slot_wait` half of checkWorktreePool's rule: whether the window's waits cross
  * SLOT_WAIT_WARN_TOTAL_MS and the pool row's exact detail clause — the wait count, total and
  * longest spans (naming the role and whether it was a check or a run), and, on a warn, the
  * knob to raise past `slotCount`. Shared by the doctor's `workspaces` row and the always-on
  * contention alert, so the trigger and the advice cannot drift. */
-export function slotWaitContention(waits, slotCount) {
+function slotWaitContention(waits, slotCount) {
     const { count, totalMs, longestMs, longest } = sumWaits(waits);
     const contended = totalMs >= SLOT_WAIT_WARN_TOTAL_MS;
     const purpose = longest.purpose === "verify" ? "check" : "run";
-    const detail = `${plural(count, "wait")} to start in the last 24h, ${shortSpanPhrase(totalMs)} total, longest ${shortSpanPhrase(longestMs)} (${textOr(longest.role)} ${purpose})${contended ? ` — raise worktreeSlots above ${slotCount}` : ""}`;
+    const detail = `${waitDetail(count, "to start", totalMs, longestMs)} (${textOr(longest.role)} ${purpose})${contended ? ` — raise worktreeSlots above ${slotCount}` : ""}`;
     return { warn: contended, detail };
 }
 /** Provider-slot contention's rule (the body of checkProviderContention from `sumWaits` on):
  * sums the waits, ranks the per-key buckets busiest first (the key-less bucket, which also
  * takes every team-cap wait whatever its key, reads "the run cap") and, on a warn past
- * PROVIDER_WAIT_WARN_TOTAL_MS, names each key's maxConcurrentPerProvider cap to raise plus
- * maxConcurrent for the run cap. Shared by the doctor's `provider contention` row and the
- * always-on contention alert, so the trigger and the advice cannot drift. The shared rule
- * leaves the count-zero and read-error arms to checkProviderContention. */
-export function providerWaitContention(waits, config) {
+ * PROVIDER_WAIT_WARN_TOTAL_MS, names `maxConcurrent` to raise. Shared by the doctor's
+ * `provider contention` row and the always-on contention alert, so the trigger and the advice
+ * cannot drift. The shared rule leaves the count-zero and read-error arms to
+ * checkProviderContention. */
+function providerWaitContention(waits, config) {
     const perKey = new Map();
     const { count, totalMs, longestMs } = sumWaits(waits);
     for (const ev of waits) {
@@ -154,17 +158,13 @@ export function providerWaitContention(waits, config) {
     const parenthetical = ranked.length === 1
         ? `(${bucketLabel(ranked[0].key)})`
         : `(${cells[0]}, also ${cells.slice(1).join(", ")})`;
-    let detail = `${plural(count, "wait")} for a provider slot in the last 24h, ${shortSpanPhrase(totalMs)} total, longest ${shortSpanPhrase(longestMs)} ${parenthetical}`;
+    let detail = `${waitDetail(count, "for a provider slot", totalMs, longestMs)} ${parenthetical}`;
     const contended = totalMs >= PROVIDER_WAIT_WARN_TOTAL_MS;
-    if (contended) {
-        const advice = ranked
-            .filter((b) => b.key !== "" && config?.maxConcurrentPerProvider?.[b.key] !== undefined)
-            .map((b) => `raise maxConcurrentPerProvider.${b.key} above ${config?.maxConcurrentPerProvider?.[b.key]}`)
-            .join(" and ");
-        const teamAdvice = perKey.has("") && config !== undefined ? [`raise maxConcurrent above ${config.maxConcurrent}`] : [];
-        const all = [...(advice ? [advice] : []), ...teamAdvice].join(" and ");
-        if (all)
-            detail += ` — ${all}`;
+    // The one configurable bound is the team total, so a warn names `maxConcurrent` to raise —
+    // but only for a team-cap wait, the only kind that bound can affect (a keyed-only wait from
+    // an old event shape has no knob to name).
+    if (contended && config !== undefined && perKey.has("")) {
+        detail += ` — raise maxConcurrent above ${config.maxConcurrent}`;
     }
     return { warn: contended, detail };
 }
@@ -174,7 +174,7 @@ export function providerWaitContention(waits, config) {
  * busiest first. Shared by the doctor's `check contention` row and the always-on contention
  * alert, so the trigger and the advice cannot drift. The shared rule leaves the count-zero
  * and read-error arms to checkCheckContention. */
-export function checkWaitContention(waits, config) {
+function checkWaitContention(waits, config, load) {
     const perKind = new Map();
     const { count, totalMs, longestMs } = sumWaits(waits);
     for (const ev of waits) {
@@ -183,21 +183,31 @@ export function checkWaitContention(waits, config) {
             perKind.set(kind, (perKind.get(kind) ?? 0) + waited);
         }
     }
-    let detail = `${plural(count, "wait")} for a check slot in the last 24h, ${shortSpanPhrase(totalMs)} total, longest ${shortSpanPhrase(longestMs)}`;
+    let detail = waitDetail(count, "for a check slot", totalMs, longestMs);
     if (perKind.size > 0) {
         const ranked = rankCountEntries(perKind);
         detail += ` (behind ${ranked.map(([kind, ms]) => `${kind} ${shortSpanPhrase(ms)}`).join(", ")})`;
     }
     if (totalMs < CHECK_WAIT_WARN_TOTAL_MS)
         return { warn: false, detail };
-    detail += ` — raise maxConcurrentChecks above ${config?.maxConcurrentChecks ?? defaultConfig().maxConcurrentChecks}`;
+    // The cap is only the right lever while the host can actually run more work: once the
+    // one-minute load average exceeds the core count (the same "starved" bar build-check-events
+    // uses for an on-time deadline kill), the wait is the host's own load, not an under-sized
+    // pool — so name the load and suppress the raise advice rather than telling an overloaded
+    // host to admit still more concurrent checks. The check still warns: the waits are real.
+    if (load.load1 > load.cpus) {
+        detail += ` — host load average ${Math.round(load.load1)} on ${load.cpus} cores: saturated, so raising maxConcurrentChecks is not the lever`;
+    }
+    else {
+        detail += ` — raise maxConcurrentChecks above ${config?.maxConcurrentChecks ?? defaultConfig().maxConcurrentChecks}`;
+    }
     return { warn: true, detail };
 }
 /** Worktree pool (plans/worktree-pool.md, part 5/5): report the pooled slots and warn on the
  * states an operator should act on — a legacy `<role>` or `_land-*` checkout the pool migration
  * left behind, a pin older than PIN_STALE_MS (a paused role holding a checkout), and the last
- * 24 h of `slot_wait` events totalling SLOT_WAIT_WARN_TOTAL_MS (the pool is too small). The stale
- * pin is also the standing `workspace-pins` alert's selection (staleWorkspacePins). Read-only,
+ * 24 h of `slot_wait` events totalling SLOT_WAIT_WARN_TOTAL_MS (the pool is too small). A stale
+ * pin is named by this row's stale-pins clause. Read-only,
  * like every doctor check; `now` is a test seam for the pin-age arithmetic. */
 export function checkWorktreePool(root, now = Date.now()) {
     const slots = readSlotsState(root).slots;
@@ -209,8 +219,8 @@ export function checkWorktreePool(root, now = Date.now()) {
     if (leftover.length > 0)
         parts.push(`legacy worktrees still present: ${leftover.join(", ")}`);
     if (stale.length > 0) {
-        // The stale-pin clause renders the shared staleWorkspacePins selection (the same list the
-        // standing `workspace-pins` alert carries), so the row's wording and the alert's selection
+        // The stale-pin clause renders the shared staleWorkspacePins selection (the same list this
+        // row's detail words), so the row's wording and the shared selection cannot drift.
         // cannot disagree on what a stale pin is or how old it is.
         parts.push(stale.map(stalePinPhrase).join("; "));
     }
@@ -236,13 +246,13 @@ export function checkWorktreePool(root, now = Date.now()) {
  * ok-fallback arms the two siblings repeated, so they cannot drift on which inputs read ok;
  * the row-specific rule (`providerWaitContention` / `checkWaitContention`) is `rule`. `noun`
  * names the waits in the ok message. */
-function waitContentionRow(root, windowMs, type, noun, rule, config, now) {
+function waitContentionRow(root, windowMs, type, noun, rule, config, now, load = sampleHostLoad) {
     let count = 0;
     let verdict;
     try {
         const waits = eventsSince(root, windowMs, now, (ev) => ev.type === type);
         count = sumWaits(waits).count;
-        verdict = rule(waits, config);
+        verdict = rule(waits, config, load());
     }
     catch (err) {
         // A read error leaves the level ok, exactly like the slot-wait branch's own read: the
@@ -258,7 +268,7 @@ function waitContentionRow(root, windowMs, type, noun, rule, config, now) {
  * orchestrator-launch.ts) and warns when the total reaches PROVIDER_WAIT_WARN_TOTAL_MS — the
  * provider cap is too small. Names every key that waited, busiest first (the key-less
  * bucket, which also takes every team-cap wait whatever its key, reads "the run cap") and, on
- * a warn, each key's maxConcurrentPerProvider cap to raise, plus maxConcurrent for the run cap.
+ * a warn, names `maxConcurrent` for the run cap.
  * A counterpoint to checkWorktreePool's slot-wait half; read-only, like every doctor check.
  * `now` is a test seam for the window. */
 export function checkProviderContention(root, config, now = Date.now()) {
@@ -279,8 +289,8 @@ function checkHolderKind(label) {
  * detail gains `(behind <kind> <span>, …)` after the longest clause, kinds busiest first: a
  * wait counts once toward each distinct kind that held a slot. `now` is a test seam for the
  * window. */
-export function checkCheckContention(root, config, now = Date.now()) {
-    return waitContentionRow(root, CHECK_WAIT_CHECK_WINDOW_MS, "check_wait", "check waits", checkWaitContention, config, now);
+export function checkCheckContention(root, config, now = Date.now(), load = sampleHostLoad) {
+    return waitContentionRow(root, CHECK_WAIT_CHECK_WINDOW_MS, "check_wait", "check waits", checkWaitContention, config, now, load);
 }
 /** The ids `leftover role branches` calls retirable and the branches it leaves for manual
  * deletion — the one walk the row and the reap share, so the two can never disagree on what a
@@ -317,7 +327,7 @@ export async function retirableLeftoverRoles(root, config) {
  * an unreadable tumwater.json skips it. */
 export async function checkLeftoverRoleBranches(root, config) {
     if (!config)
-        return okOutcome("no readable tumwater.json — nothing to verify");
+        return noConfigOutcome();
     const { retirable, unknown } = await retirableLeftoverRoles(root, config);
     const parts = [];
     if (retirable.length > 0) {
@@ -440,7 +450,7 @@ function claimCounts(claims) {
  * tumwater.json (config undefined) skips the walk — checkInit reports the config itself. */
 export function checkWorkInstances(root, config, now = Date.now()) {
     if (!config)
-        return okOutcome("no readable tumwater.json — nothing to verify");
+        return noConfigOutcome();
     const claims = runnerIds(config).map((id) => loadRunnerState(root, id).claim).filter((c) => c !== undefined);
     const entries = staleClaimEntries(root, runnerIds(config), now);
     const gone = entries.filter((e) => e.kind === "gone");
@@ -453,13 +463,11 @@ export function checkWorkInstances(root, config, now = Date.now()) {
     return warnOutcome(parts.join("; "));
 }
 /** An enabled multi-instance role contending for a worktree pool smaller than the run cap —
- * the pool-mismatch clause of the doctor's `parallel instances` row (checkWorkInstances) and
- * the always-on `instance-pool` alert (alert-feeds.ts instancePoolProblems). Returns the
- * `INSTANCE_ROLES` ids with more than one configured instance while `slotCount(config)`
+ * the pool-mismatch clause of the doctor's `parallel instances` row (checkWorkInstances):
+ * the `INSTANCE_ROLES` ids with more than one configured instance while `slotCount(config)`
  * (worktreeSlots, else maxConcurrent + 1) is below `config.maxConcurrent`, phrased as the
  * row's one clause; `[]` when no such role or the pool is at least `maxConcurrent`. Shared by
- * the doctor row and the alert so they cannot drift on the trigger, the role list, or the
- * wording. */
+ * the row and its clause so they cannot drift on the trigger, the role list, or the wording. */
 export function smallPoolProblems(config) {
     const multi = Object.entries(config.roles)
         .filter(([id, role]) => INSTANCE_ROLES.has(id) && role.enabled && (role.instances ?? 1) > 1)
@@ -469,71 +477,3 @@ export function smallPoolProblems(config) {
         return [];
     return [`${multi.join(", ")} run instances but worktreeSlots ${slots} is below maxConcurrent ${config.maxConcurrent}`];
 }
-/** Provider concurrency caps (plans/provider-concurrency.md §8): audit the
- * `maxConcurrentPerProvider` map against the seams the config can actually spawn — each role,
- * the review gate, the resolver, the director, and each tier's fallback — so the operator
- * sees whether every cap names a provider in use and whether any cap actually binds. Warns on
- * a cap key no seam resolves to (a typo, or a provider not in use), a cap at or above
- * `maxConcurrent` (which never binds — the team total is the real ceiling), and a capped
- * team whose seams include one with no key (pi's default provider is unreadable, so that
- * seam cannot be capped). A config with no per-provider map or no caps is fine, and so is a
- * well-formed map; a broken config is reported by the init check. Takes `root` to read pi's
- * own default model (piSettingsPath), the same seam the orchestrator's admission uses, so a
- * bare no-model pi seam keys exactly as the team would key it. */
-/** The warnings behind checkProviderConcurrency, as a pure function of the config and pi's
- * default model name: a cap key no seam resolves to (a typo, or a provider not in use), a cap
- * at or above `maxConcurrent` (which never binds), and a capped team whose seams include one
- * with no key (pi's default provider is unreadable, so that seam cannot be capped). The doctor's
- * `provider concurrency` row and the always-on `provider-caps` team alert both read this one
- * computation, so the row and the alert cannot drift on the trigger or the wording. `[]` for no
- * config, a map with no enforcedKeyCaps entries, or a map with no problem. `piDefault` is the
- * bare default model the orchestrator's admission seam carries, read once by the callers
- * through readPiDefaultModel(piSettingsPath(piModelsPath()), root). */
-export function providerConcurrencyProblems(config, piDefault) {
-    if (!config)
-        return [];
-    const caps = config.maxConcurrentPerProvider;
-    const capEntries = enforcedKeyCaps(caps);
-    if (capEntries.length === 0)
-        return [];
-    const seams = seamsInUse(config);
-    const keyed = [];
-    for (const s of seams) {
-        const k = seamConcurrencyKey(s, piDefault);
-        if (k !== undefined && !keyed.includes(k))
-            keyed.push(k);
-    }
-    const keySet = new Set(keyed);
-    const capKeys = capEntries.map(([k]) => k);
-    const warnings = [];
-    for (const key of capKeys) {
-        if (!keySet.has(key))
-            warnings.push(`cap key "${key}" resolves to no model job (a typo, or a provider not in use)`);
-    }
-    for (const [key, cap] of capEntries) {
-        if (cap >= config.maxConcurrent)
-            warnings.push(`cap "${key}" ${cap} is at or above maxConcurrent ${config.maxConcurrent} — it never binds`);
-    }
-    const capSet = new Set(capKeys);
-    const keyless = seams.filter((s) => seamConcurrencyKey(s, piDefault) === undefined);
-    if (capSet.size > 0 && keyless.length > 0) {
-        warnings.push(`${plural(keyless.length, "model job")} ${agree(keyless.length, "resolves", "resolve")} to no provider key (pi's default provider is unreadable, so they cannot be capped): ${keyless.map((s) => s.label).join(", ")}`);
-    }
-    return warnings;
-}
-export function checkProviderConcurrency(config, root) {
-    if (!config)
-        return okOutcome("no config to audit");
-    const caps = config.maxConcurrentPerProvider;
-    const capEntries = enforcedKeyCaps(caps);
-    if (capEntries.length === 0)
-        return okOutcome("no per-provider caps configured");
-    // The pi default model the orchestrator's admission seam carries: a bare no-model pi seam
-    // resolves its key only through it, so a team whose default is readable has keyed seams and
-    // only an unreadable default leaves a key-less seam to warn about.
-    const piDefault = readPiDefaultModel(piSettingsPath(piModelsPath()), root);
-    const problems = providerConcurrencyProblems(config, piDefault);
-    if (problems.length === 0)
-        return okOutcome(`${plural(capEntries.length, "provider cap")} — all model jobs resolve`);
-    return warnOutcome(problems.join("; "));
-}