tumwater 0.4.2 → 0.4.4

package/dist/src/doctor/doctor-fallback-checks.js

@@ -6,7 +6,7 @@ import { formatClock } from "../text/datetime.js";
 import { loadRunnerStates } from "./doctor-holds.js";
 import { modelPairName, pairDailyCost } from "../budget/budget.js";
 import { usd, usdCap } from "../text/format.js";
-import { okOutcome, warnOutcome } from "./outcome.js";
+import { okOutcome, warnOutcome } from "./doctor-outcome.js";
 /** The doctor's cap-fallback checks, split out of doctor-model-checks.ts (whose seam framework
  * and declared-tier/image checks stay in a module whose per-backend provider checks live in
  * doctor-{claude,opencode,codex,pi}-checks.ts): the daily-cost budget's third state — whether
@@ -18,7 +18,7 @@ import { okOutcome, warnOutcome } from "./outcome.js";
  * kept separate so a change to fallback pricing does not touch how doctor reads seams. The
  * config guard (loadConfigForCheck) is imported from doctor-model-checks, exactly as the
  * per-backend modules import that file's seam framework. The shared report contract
- * (CheckOutcome) is imported from outcome.ts. */
+ * (CheckOutcome) is imported from doctor-outcome.ts. */
 /** Fallback model readiness — the daily-cost budget's third state (plans/fallback-model.md): with
  * `fallbackModel` set, pi's definitions must price that pair at zero or the gate refuses it and
  * roles pause at the cap exactly as if no fallback existed. That refusal is the right runtime
@@ -77,6 +77,48 @@ const isLocalUrl = (url) => {
         return false;
     }
 };
+/** Which URL this step probes, and did it answer. A provider that names a backend other than
+ * pi (claude today; opencode from part 2) never asks pi for a base URL or runs pi's price
+ * probe — only a pi step may. Returns the step's backend-ness, the resolved base URL and
+ * whether a local pi step answered; a non-local or non-pi step never probes (up stays null). */
+async function resolveStepProbe(modelsPath, pair, probe) {
+    const nonPiBackend = pair.backend !== undefined && pair.backend !== "pi";
+    const base = !nonPiBackend && pair.provider ? piProviderBaseUrl(modelsPath, pair.provider) : null;
+    const local = base !== null && isLocalUrl(base);
+    const up = local ? await probe(`${base}/models`) : null;
+    return { nonPiBackend, base, up };
+}
+/** The claude step's billing display: extra usage when the step follows an earlier claude
+ * model, else the persisted account's billing answer (or unknowns when the account is absent). */
+function claudeVerdict(extra, account) {
+    return extra ? "extra usage" : (account?.billing ?? "billing unknown");
+}
+/** Why this step is not runnable now (or is, when no arm fires): the five-way verdict, and
+ * whether the chain is down. The `up === false` arm is the only one that marks the chain down.
+ * `accounts` prices a free/claude pair for the one claude account held by the caller. */
+function stepVerdict(pair, ctx) {
+    const { up, base, cap, spent, providers, accounts } = ctx;
+    if (up === false) {
+        return { verdict: `not running (GET ${base}/models failed)`, down: true };
+    }
+    else if (cap !== undefined && spent >= cap) {
+        return { verdict: `cap reached (${usd(spent)}/${usdCap(cap)})`, down: false };
+    }
+    else if (pair.backend !== undefined && pair.backend !== "pi") {
+        return { verdict: `claude ${claudeVerdict(pair.extraUsage, accounts("claude"))}`, down: false };
+    }
+    else if (piPairFree(providers, pair, accounts)) {
+        return { verdict: up ? "free · server up" : "free", down: false };
+    }
+    return {
+        verdict: cap !== undefined ? `priced, ${usd(spent)}/${usdCap(cap)} today` : "priced, team cap only",
+        down: false,
+    };
+}
+/** One chain fragment's line: the tier, the 1-based step number and the step's pair and verdict. */
+function chainFragment(tier, step, pair, verdict) {
+    return `${tier} ${step + 1}: ${pair.provider ?? "?"}/${pair.model ?? "?"} — ${verdict}`;
+}
 /** The `fallback chain` check: one fragment per step of every tier's chain saying whether the
  * step can run now — a local pi server that does not answer (warn), a step whose own daily cap is
  * spent, a free pair, a claude step with its billing, or a priced pair. Reads config, pi's
@@ -98,32 +140,12 @@ export async function checkFallbackChain(root, modelsPath = piModelsPath(), prob
     let down = false;
     const fragments = [];
     for (const { tier, step, pair } of steps) {
-        // A provider that names a backend other than pi (claude today; opencode from part 2) never
-        // asks pi for a base URL or runs pi's price probe — only a pi step may.
-        const nonPiBackend = pair.backend !== undefined && pair.backend !== "pi";
-        const base = !nonPiBackend && pair.provider ? piProviderBaseUrl(modelsPath, pair.provider) : null;
-        const local = base !== null && isLocalUrl(base);
-        const up = local ? await probe(`${base}/models`) : null;
+        const { base, up } = await resolveStepProbe(modelsPath, pair, probe);
         const cap = pair.maxDailyCostUsd;
         const spent = cap !== undefined ? pairDailyCost(states, modelPairName(pair), now) : 0;
-        let verdict;
-        if (up === false) {
-            down = true;
-            verdict = `not running (GET ${base}/models failed)`;
-        }
-        else if (cap !== undefined && spent >= cap) {
-            verdict = `cap reached (${usd(spent)}/${usdCap(cap)})`;
-        }
-        else if (nonPiBackend) {
-            verdict = `claude ${pair.extraUsage ? "extra usage" : (account?.billing ?? "billing unknown")}`;
-        }
-        else if (piPairFree(providers, pair, accounts)) {
-            verdict = up ? "free · server up" : "free";
-        }
-        else {
-            verdict = cap !== undefined ? `priced, ${usd(spent)}/${usdCap(cap)} today` : "priced, team cap only";
-        }
-        fragments.push(`${tier} ${step + 1}: ${pair.provider ?? "?"}/${pair.model ?? "?"} — ${verdict}`);
+        const { verdict, down: isDown } = stepVerdict(pair, { up, base, cap, spent, providers, accounts });
+        down ||= isDown;
+        fragments.push(chainFragment(tier, step, pair, verdict));
     }
     const detail = fragments.join("; ");
     return down ? warnOutcome(detail) : okOutcome(detail);

package/dist/src/doctor/doctor-holds.js

@@ -1,8 +1,6 @@
 import { roleLabel } from "../roles/role-labels.js";
 import { sortEntriesByKey } from "../collections.js";
 import { pausedRoles, pausedRolesUntil, standingTeamPause } from "../team/team-state.js";
-import { MODEL_TIERS } from "../config/config-schema.js";
-import { withModelOverrides } from "../config/config-views.js";
 import { commitTier, DIRECTOR_ROLE } from "../roles/roles.js";
 import { budgetReached, budgetWarning, teamDailyCost } from "../budget/budget.js";
 import { roleCapVerdicts } from "../gates/role-cap-gates.js";
@@ -17,17 +15,13 @@ import { usd } from "../text/format.js";
 import { parseQuietHours, quietHoursStatus, quietWindowEnd, roleQuietHold } from "../scheduling/quiet-hours.js";
 import { DAY_MS, HOUR_MS, humanUntil } from "../text/datetime.js";
 import { budgetPhrase, pauseReasonSuffix, plural } from "../text/phrases.js";
-import { readAccount, utilizationPct, windowEntries, windowLabel } from "../agent/subscription-account.js";
-import { backendDisplayName } from "../agent/backend-traits.js";
-import { windowObservation } from "../team/team-polls.js";
 import { readEventsSince } from "../events/event-window.js";
 import { errorMessage } from "../text/text.js";
-import { okOutcome, warnOutcome } from "./outcome.js";
+import { okOutcome, warnOutcome } from "./doctor-outcome.js";
 import { redMainWarning } from "../baseline/main-guardrails.js";
-/** The standing-hold checks: `pause` (checkPause), `quiet hours` (checkQuietHours), and `budget`
- * (checkBudget), the `claude window`/`codex window` rows (checkSubscriptionWindow),
- * `maintenance quota` (checkMaintenanceQuota), and `error streaks` (checkErrorStreaks), all
- * read-only reports of holds on running. */
+/** The standing-hold checks: `pause` (checkPause), `quiet hours` (checkQuietHours), `budget`
+ * (checkBudget), `maintenance quota` (checkMaintenanceQuota), and `error streaks`
+ * (checkErrorStreaks), all read-only reports of holds on running. */
 export function loadRunnerStates(root, config) {
     return runnerIds(config)
         .map((id) => loadRunnerState(root, id))
@@ -139,39 +133,6 @@ export function checkMaintenanceQuota(root, config, aliveTeam, now = Date.now())
     const anyMaintenance = runners.some((l) => commitTier(l.role) === "maintenance");
     return okOutcome(anyMaintenance ? base : `${base}; no maintenance role enabled`);
 }
-/** The `<backend> window` check, one row per subscription backend in use (claude and codex):
- * whether a rejected subscription window holds the subscription `<backend>` seams. Read-only and
- * built on windowObservation (the backend's own), the verdict the scheduler's team hold uses, so
- * it cannot disagree with the hold. A hold is a warn because it stops every subscription seam on
- * that backend until the window resets; otherwise the most constrained window's state is
- * reported as ok (a rejected window spending overage reads `rejected` here: overage spends, it
- * does not hold). Returns null (omitting the row from doctor) when the backend has no
- * subscription account — the same omit-a-row pattern as `pi extensions` — because an absent or
- * API-billed account never holds. */
-export function checkSubscriptionWindow(backend, root, now = Date.now(), chain, config) {
-    const account = readAccount(root, backend, now);
-    if (account?.billing !== "subscription")
-        return null;
-    const held = windowObservation(backend, account, now);
-    if (held?.kind === "subscription-window" && held.windowType !== undefined && held.resetsAt !== undefined) {
-        const label = windowLabel(held.windowType);
-        const resets = humanUntil(held.resetsAt, now);
-        const moved = MODEL_TIERS.filter((t) => (chain?.[t]?.reason === "window" || chain?.[t]?.reason === "reserve") &&
-            config !== undefined &&
-            withModelOverrides(config, t, {}).agent === backend);
-        if (moved.length > 0) {
-            const waiting = MODEL_TIERS.filter((t) => !chain?.[t] && config !== undefined && withModelOverrides(config, t, {}).agent === backend);
-            return warnOutcome(`${label} window rejected — ${moved.join(", ")} moved to fallbacks until it resets in ${resets}${waiting.length > 0 ? `; ${waiting.join(", ")} wait` : ""}`);
-        }
-        return warnOutcome(`${label} window rejected — subscription ${backendDisplayName(backend)} model jobs wait until it resets in ${resets}`);
-    }
-    const top = windowEntries(account)[0];
-    if (top === undefined)
-        return okOutcome("subscription; no window reported yet");
-    const pct = typeof top.utilization === "number" ? ` (${utilizationPct(top.utilization)}% used)` : "";
-    const label = windowLabel(top.type);
-    return okOutcome(top.status === "allowed_warning" ? `${label} window nearing its limit${pct}` : `${label} window ${top.status}${pct}`);
-}
 /** How far back the `provider hold` check reads for hold/resume crossings. The longest a
  * hold can stay is HOLD_CAP_MS (team-hold's 15-minute cap that escalation doubles against),
  * so a window a comfortable multiple of that covers any standing hold's crossing event plus
@@ -182,8 +143,8 @@ const HOLD_CHECK_WINDOW_MS = 2 * HOUR_MS;
  * that stops the roles on that provider from starting new runs until it re-opens. Read-only:
  * it infers the standing set from the event log's own `rate_limit_hold`/`rate_limit_resumed`
  * crossings, the events pollTeamHold writes, so it cannot disagree with the hold. A standing
- * hold is a warn (as with the `claude window` row) because it stops every role on that
- * provider; `now` is injected so a test can pin a hold standing before its deadline and
+ * hold is a warn because it stops every role on that provider; `now` is injected so a test
+ * can pin a hold standing before its deadline and
  * re-opened after. The ended hold's kind rides the resumed event (see pollTeamHold), and any
  * resumed event ends that provider's current hold whatever its kind. */
 export function checkProviderHolds(root, now = Date.now()) {
@@ -246,8 +207,8 @@ export function checkErrorStreaks(root, config) {
     return warnOutcome(`failing run after run: ${phrases.join("; ")}`);
 }
 /** The `main red` check: the row lists the runs the merge-side `main_red` pin ended — a red
- * main is still recorded as the `main_red` outcome that ended those runs until parts 3d/3–3f/3
- * land — and warns when main has been red over RED_MAIN_WARN_MS even with no role held (the
+ * main is still recorded as the `main_red` outcome that ended those runs until part 3f/3
+ * lands — and warns when main has been red over RED_MAIN_WARN_MS even with no role held (the
  * guardrail, G1). Read-only: it asks heldByMainRed, the predicate the status phase's `main red`
  * label reads, so the two cannot disagree on the held runs, and redMainWarning over the event
  * trail, so both phrases can appear in one row. A warn, not a fail: a red main does not stop

package/dist/src/doctor/doctor-install.js

@@ -8,7 +8,7 @@ import { readEventsSince } from "../events/event-window.js";
 import { DAY_MS } from "../text/datetime.js";
 import { plural, shortSpanPhrase } from "../text/phrases.js";
 import { errorMessage, textOr } from "../text/text.js";
-import { okOutcome, warnOutcome } from "./outcome.js";
+import { okOutcome, warnOutcome } from "./doctor-outcome.js";
 /** How far back a failed `dep_install` event may sit and still explain the drift. */
 const DEP_INSTALL_CHECK_WINDOW_MS = DAY_MS;
 export function checkRootInstall(root, now = Date.now()) {

package/dist/src/doctor/doctor-launch-services.js

@@ -6,7 +6,7 @@
  * launchservicesd facts this reads — the thresholds and the warning text — stay in
  * src/process/launch-services.ts, shared with the running team's watch. `platform` is a
  * parameter so the macOS branches are testable on any host. */
-import { okOutcome, warnOutcome } from "./outcome.js";
+import { okOutcome, warnOutcome } from "./doctor-outcome.js";
 import { systemProcessProbe } from "../process/process-table.js";
 import { LAUNCH_SERVICES_KILL_PORTS, LAUNCH_SERVICES_WARN_PORTS, launchServicesWarning, } from "../process/launch-services.js";
 import { compactTokens } from "../text/format.js";

package/dist/src/doctor/doctor-model-checks.js

@@ -1,13 +1,16 @@
 import { childEnv } from "../process/process.js";
-import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./probe.js";
+import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./doctor-probe.js";
 import { defaultConfig, loadConfigSafe } from "../config/config.js";
 import { seamsInUse } from "../config/config-fallbacks.js";
 import { cacheReadUnpriced, piModelsPath, readPiProviders } from "../pi/pi-models.js";
+import { roleImageInfo } from "../agent/image-input.js";
+import { readPiListedModels } from "../pi/pi-listed-models.js";
+import { runnerIds } from "../roles/runner-ids.js";
 import { envPath } from "../files/files.js";
 import { piListedModels, piProviderAuth } from "./doctor-pi-checks.js";
 import { agree } from "../text/phrases.js";
 import { joinParts } from "../text/text.js";
-import { failOutcome, okOutcome, warnOutcome } from "./outcome.js";
+import { failOutcome, okOutcome, warnOutcome } from "./doctor-outcome.js";
 import { belowNodeFloor } from "../version.js";
 /** The one phrase a configured-models check uses when the config declares no models at all:
  * informational (capability falls to pi's own defaults), not a warning. Shared by
@@ -30,8 +33,9 @@ const PHRASE_CANNOT_READ_MODELS = "cannot check — could not read pi's model de
  * modules do. The claude, opencode, codex and pi provider checks live in their own per-backend
  * modules (doctor-claude-checks.ts, doctor-opencode-checks.ts, doctor-codex-checks.ts,
  * doctor-pi-checks.ts), each importing this file's shared seam framework and the AUTH_CHECK_*
- * probe budgets from probe.ts rather than duplicating them. The shared report contract
- * (CheckOutcome) is imported from outcome.ts, exactly as the other doctor-* modules do. Together
+ * probe budgets from doctor-probe.ts rather than duplicating them. The shared report contract
+ * (CheckOutcome) is imported from doctor-outcome.ts, exactly as the other doctor-*
+ * modules do. Together
  * these are the doctor's only checks that read pi's model definitions and, for the probes, spawn
  * an agent binary — a distinct concern from the filesystem/git checks, kept together so a change
  * to how doctor reads models does not touch the environment checks. */
@@ -131,30 +135,8 @@ export function codexSeamsInUse(config) {
 export function piSeamsInUse(config) {
     return seamsInUse(config).some((s) => s.agent === "pi");
 }
-/** Declared model readiness — plans/model-tiers.md "Doctor" (part 7c/8): every model the config can
- * put on a seam must resolve in pi's definitions, and its provider must report `ready` from the
- * agent binary's own auth check. A strong tier pi cannot resolve would fail every review, and so
- * every merge — the check exists so the operator finds out before the team does, mid-review. Pairs
- * collected in the same sweep teamModelsFree prices: each tier's top-level selector (a string is
- * default's), every enabled role's resolved pair (per-role overrides included; tier-name overrides
- * resolve through configForRole), and the reviewer's while review is on. A pair with no model is
- * pi's own default and out of scope; fallback pairs are the sibling check's (checkFallbackModel
- * prices the cap pair). Levels: an unresolvable pair fails, a provider that is not ready warns
- * (credentials are fixable without a config edit), a probe that cannot run warns rather than
- * guesses, and a priced model whose cache reads declare $0 warns — the daily budget would
- * undercount it (BUGS.md 2026-10-06). When one of PI_SMOL_MODEL / PI_SLOW_MODEL / PI_PLAN_MODEL is
- * set the check also reports that tumwater does not read it — the variables are oh-my-pi's, pi
- * ignores them, and with omp as `agentBin` they still reach omp through the inherited environment
- * (src/pi/pi-backend.ts, built on src/process/run-marker.ts's backendBaseEnv) — pointing at the
- * tier keys that do the same job (`model.small` / `model.strong`). `auth` is injectable so tests
- * need no pi on PATH; `env` so the PI_* branches stay hermetic. */
-export async function checkTierModels(root, modelsPath = piModelsPath(), auth = (provider) => piProviderAuth(loadConfigSafe(root).config ?? defaultConfig(), provider), env = process.env, listModels = () => piListedModels(loadConfigSafe(root).config ?? defaultConfig(), envPath(), AUTH_CHECK_TIMEOUT_MS, root)) {
-    const config = loadConfigForCheck(root);
-    if ("level" in config)
-        return config;
-    // Asked lazily and at most once: only a pair models.json does not declare needs the listing.
-    let listing;
-    const listed = () => (listing ??= listModels());
+/** One job: sweep the config's seam pairs into the pair map and the routed-models map. */
+function collectTierPairs(config) {
     const pairs = new Map();
     // Routed (non-pi) models keyed by the backend they resolved to, so the routing note names
     // each backend correctly; opencode is not claude.
@@ -175,75 +157,100 @@ export async function checkTierModels(root, modelsPath = piModelsPath(), auth =
     };
     for (const pair of seamPairs(config))
         add(pair.agent, pair.provider, pair.model);
+    return { pairs, routedModels };
+}
+/** One job: compute the oh-my-pi variables note, and whether any is set. */
+function ompTierNote(env) {
     const ompVars = ["PI_SMOL_MODEL", "PI_SLOW_MODEL", "PI_PLAN_MODEL"].filter((v) => env[v] !== undefined && env[v] !== "");
-    const ompNote = ompVars.length === 0
-        ? ""
-        : ` — ${ompVars.join(" and ")} ${agree(ompVars.length, "is", "are")} set: tumwater does not read ${agree(ompVars.length, "it", "them")} (oh-my-pi's variables; pi ignores them; with omp as agentBin they still reach omp through the inherited environment) — set model.small / model.strong instead`;
-    if (pairs.size === 0 && routedModels.size === 0)
-        return (ompVars.length === 0 ? okOutcome : warnOutcome)(`${PHRASE_NO_MODELS_DECLARED}${ompNote}`);
+    return {
+        set: ompVars.length > 0,
+        note: ompVars.length === 0
+            ? ""
+            : ` — ${ompVars.join(" and ")} ${agree(ompVars.length, "is", "are")} set: tumwater does not read ${agree(ompVars.length, "it", "them")} (oh-my-pi's variables; pi ignores them; with omp as agentBin they still reach omp through the inherited environment) — set model.small / model.strong instead`,
+    };
+}
+/** One job: read pi's provider definitions, or the empty map when the file is unreadable but
+ * every pair names a provider the listing can back (the unreadable case the caller warns on). */
+async function readTierProviders(modelsPath, pairs, listed) {
     let providers = readPiProviders(modelsPath);
     if (!providers && [...pairs.values()].some((p) => p.provider !== undefined) && (await listed()))
         providers = new Map();
-    const fails = [];
+    return providers;
+}
+/** One job: the fail string for a pair neither pi's definitions nor (when reachable) its
+ * listing resolve, or undefined when the listing does contain it. */
+function unresolvedModelFail(provider, model, defs, listedModels, modelsPath) {
+    if (listedModels?.has(`${provider}/${model}`))
+        return undefined;
+    const providerListed = listedModels != null && [...listedModels].some((k) => k.startsWith(`${provider}/`));
+    if (!defs && !providerListed) {
+        return listedModels === null
+            ? `provider ${provider} is not in pi's definitions (${modelsPath})`
+            : `provider ${provider} is not in pi's definitions (${modelsPath}) and \`pi --list-models\` lists none of its models — pi lists only providers it has credentials for`;
+    }
+    if (listedModels === null) {
+        // No exact entry: pi clones the provider's default model for the id, inheriting that
+        // default's price and context window (BUGS.md 2026-10-06) — name that consequence
+        // instead of only the failed lookup.
+        return `${provider}/${model} does not resolve in pi's definitions (${modelsPath}) — pi would price it at the provider default's rates and context window`;
+    }
+    return `${provider}/${model} is neither in pi's definitions (${modelsPath}) nor listed by \`pi --list-models\``;
+}
+/** One job: the warn string for a priced model whose cache reads declare $0, or undefined. */
+function cacheReadWarning(providers, provider, model, def) {
+    if (def && cacheReadUnpriced(providers, provider, model)) {
+        return `${provider}/${model} prices cache reads at $0 — the daily budget will undercount its spend`;
+    }
+    return undefined;
+}
+/** One job: probe one provider's auth once, reporting ready or the warn when it is not. */
+async function probeTierProvider(provider, auth, checkedProviders) {
+    if (checkedProviders.has(provider))
+        return {};
+    checkedProviders.add(provider);
+    const verdict = await auth(provider);
+    if (verdict === "ready")
+        return { ready: true };
+    if (verdict === "not-ready")
+        return { warn: `provider ${provider} reports not ready — check its credentials` };
+    return { warn: `could not verify provider ${provider} — the auth check did not run or its output was unreadable` };
+}
+/** One job: resolve one pi pair — the per-token claude warn, the definitions lookup and its
+ * unresolved fail, the free-cache-reads warn, and the once-per-provider auth probe. */
+async function resolveTierPair(provider, model, providers, listed, auth, checkedProviders, modelsPath) {
     const warns = [];
-    if (pairs.size > 0 && !providers)
-        return warnOutcome(`${PHRASE_CANNOT_READ_MODELS}${modelsPath}${ompNote}`);
-    const readyProviders = new Set();
-    const checkedProviders = new Set();
-    for (const { provider, model } of pairs.values()) {
-        if (provider === undefined) {
-            warns.push(`${model} names no provider — pi resolves it with its own default, tumwater cannot verify it`);
-            continue;
-        }
-        // A Claude model routed to pi (plans/provider-concurrency.md "Routing a bare Claude model id
-        // to claude"): a named provider keeps it on pi, but since Anthropic's 2026-04-04
-        // third-party-harness change a Claude plan's limits cover only first-party tools, so it is
-        // billed per token even under a Claude subscription login — the bare `claude-…` form on the
-        // claude CLI uses the plan's included usage instead.
-        if (model?.startsWith("claude-")) {
-            warns.push(`${provider}/${model} runs on pi and is billed per token, not the Claude plan's included usage — use a bare claude-… id to route it to the claude CLI`);
-        }
-        const defs = providers?.get(provider);
-        const def = defs?.find((d) => d.id === model);
-        if (!def) {
-            const listedModels = await listed();
-            if (!listedModels?.has(`${provider}/${model}`)) {
-                const providerListed = listedModels != null && [...listedModels].some((k) => k.startsWith(`${provider}/`));
-                if (!defs && !providerListed) {
-                    fails.push(listedModels === null
-                        ? `provider ${provider} is not in pi's definitions (${modelsPath})`
-                        : `provider ${provider} is not in pi's definitions (${modelsPath}) and \`pi --list-models\` lists none of its models — pi lists only providers it has credentials for`);
-                }
-                else if (listedModels === null) {
-                    // No exact entry: pi clones the provider's default model for the id, inheriting that
-                    // default's price and context window (BUGS.md 2026-10-06) — name that consequence
-                    // instead of only the failed lookup.
-                    fails.push(`${provider}/${model} does not resolve in pi's definitions (${modelsPath}) — pi would price it at the provider default's rates and context window`);
-                }
-                else {
-                    fails.push(`${provider}/${model} is neither in pi's definitions (${modelsPath}) nor listed by \`pi --list-models\``);
-                }
-                continue;
-            }
-        }
-        if (def && providers && cacheReadUnpriced(providers, provider, model)) {
-            // A priced model whose cache reads declare $0: pi bills cache-read tokens at zero and
-            // the daily budget undercounts the real spend (BUGS.md 2026-10-06).
-            warns.push(`${provider}/${model} prices cache reads at $0 — the daily budget will undercount its spend`);
-        }
-        if (!checkedProviders.has(provider)) {
-            checkedProviders.add(provider);
-            const verdict = await auth(provider);
-            if (verdict === "ready")
-                readyProviders.add(provider);
-            else if (verdict === "not-ready")
-                warns.push(`provider ${provider} reports not ready — check its credentials`);
-            else
-                warns.push(`could not verify provider ${provider} — the auth check did not run or its output was unreadable`);
-        }
+    if (provider === undefined) {
+        warns.push(`${model} names no provider — pi resolves it with its own default, tumwater cannot verify it`);
+        return { warns };
     }
-    const found = [...fails, ...warns].join("; ");
-    const resolvedPi = `${pairs.size} declared ${agree(pairs.size, "model", "models")} resolve${readyProviders.size > 0 ? ` and ${agree(readyProviders.size, "provider", "all providers")} ${[...readyProviders].sort().join(", ")} report ready` : ""}`;
+    // A Claude model routed to pi (plans/provider-concurrency.md "Routing a bare Claude model id
+    // to claude"): a named provider keeps it on pi, but since Anthropic's 2026-04-04
+    // third-party-harness change a Claude plan's limits cover only first-party tools, so it is
+    // billed per token even under a Claude subscription login — the bare `claude-…` form on the
+    // claude CLI uses the plan's included usage instead.
+    if (model?.startsWith("claude-")) {
+        warns.push(`${provider}/${model} runs on pi and is billed per token, not the Claude plan's included usage — use a bare claude-… id to route it to the claude CLI`);
+    }
+    const defs = providers?.get(provider);
+    const def = defs?.find((d) => d.id === model);
+    if (!def) {
+        const listedModels = await listed();
+        const fail = unresolvedModelFail(provider, model, defs, listedModels, modelsPath);
+        if (fail !== undefined)
+            return { warns, fail };
+    }
+    if (providers) {
+        const warning = cacheReadWarning(providers, provider, model, def);
+        if (warning !== undefined)
+            warns.push(warning);
+    }
+    const probe = await probeTierProvider(provider, auth, checkedProviders);
+    if (probe.warn !== undefined)
+        warns.push(probe.warn);
+    return { warns, ready: probe.ready };
+}
+/** One job: one routing note per non-pi backend in use, joined. */
+function routedTierNotes(routedModels) {
     // One routing note per non-pi backend in use, so an opencode-routed model is never labeled
     // as claude's. The opencode note also carries the design §2 caveat that a bare `opencode/…`
     // id always means the OpenCode CLI, never pi's built-in `opencode` gateway. Every note opens
@@ -260,13 +267,67 @@ export async function checkTierModels(root, modelsPath = piModelsPath(), auth =
                 ? routedNote(agent, n, "resolved by the codex backend, not pi's definitions")
                 : routedNote(agent, n, "resolved by the claude backend, not pi's definitions"));
     }
-    const routedText = routedNotes.length > 0 ? routedNotes.join("; ") : "";
+    return routedNotes.length > 0 ? routedNotes.join("; ") : "";
+}
+/** One job: assemble the final fail/warn/ok outcome from the collected verdicts. */
+function tierOutcome(fails, warns, pairsCount, readyProviders, routedText, ompNote, ompSet) {
+    const found = [...fails, ...warns].join("; ");
+    const resolvedPi = `${pairsCount} declared ${agree(pairsCount, "model", "models")} resolve${readyProviders.size > 0 ? ` and ${agree(readyProviders.size, "provider", "all providers")} ${[...readyProviders].sort().join(", ")} report ready` : ""}`;
     const base = fails.length === 0 && warns.length === 0
-        ? joinParts([pairs.size > 0 ? resolvedPi : "", routedText])
+        ? joinParts([pairsCount > 0 ? resolvedPi : "", routedText])
         : found;
     if (fails.length > 0)
         return failOutcome(`${base}${ompNote}`);
-    return (warns.length > 0 || ompVars.length > 0 ? warnOutcome : okOutcome)(`${base}${ompNote}`);
+    return (warns.length > 0 || ompSet ? warnOutcome : okOutcome)(`${base}${ompNote}`);
+}
+/** Declared model readiness — plans/model-tiers.md "Doctor" (part 7c/8): every model the config can
+ * put on a seam must resolve in pi's definitions, and its provider must report `ready` from the
+ * agent binary's own auth check. A strong tier pi cannot resolve would fail every review, and so
+ * every merge — the check exists so the operator finds out before the team does, mid-review. Pairs
+ * collected in the same sweep teamModelsFree prices: each tier's top-level selector (a string is
+ * default's), every enabled role's resolved pair (per-role overrides included; tier-name overrides
+ * resolve through configForRole), and the reviewer's while review is on. A pair with no model is
+ * pi's own default and out of scope; fallback pairs are the sibling check's (checkFallbackModel
+ * prices the cap pair). Levels: an unresolvable pair fails, a provider that is not ready warns
+ * (credentials are fixable without a config edit), a probe that cannot run warns rather than
+ * guesses, and a priced model whose cache reads declare $0 warns — the daily budget would
+ * undercount it (BUGS.md 2026-10-06). When one of PI_SMOL_MODEL / PI_SLOW_MODEL / PI_PLAN_MODEL is
+ * set the check also reports that tumwater does not read it — the variables are oh-my-pi's, pi
+ * ignores them, and with omp as `agentBin` they still reach omp through the inherited environment
+ * (src/pi/pi-backend.ts, built on src/process/run-marker.ts's backendBaseEnv) — pointing at the
+ * tier keys that do the same job (`model.small` / `model.strong`). `auth` is injectable so tests
+ * need no pi on PATH; `env` so the PI_* branches stay hermetic. The inline jobs are split into
+ * the module-private helpers `collectTierPairs`, `ompTierNote`, `readTierProviders`,
+ * `resolveTierPair`, `unresolvedModelFail`, `cacheReadWarning`, `probeTierProvider`,
+ * `routedTierNotes` and `tierOutcome` so each is found by name. */
+export async function checkTierModels(root, modelsPath = piModelsPath(), auth = (provider) => piProviderAuth(loadConfigSafe(root).config ?? defaultConfig(), provider), env = process.env, listModels = () => piListedModels(loadConfigSafe(root).config ?? defaultConfig(), envPath(), AUTH_CHECK_TIMEOUT_MS, root)) {
+    const config = loadConfigForCheck(root);
+    if ("level" in config)
+        return config;
+    // Asked lazily and at most once: only a pair models.json does not declare needs the listing.
+    let listing;
+    const listed = () => (listing ??= listModels());
+    const { pairs, routedModels } = collectTierPairs(config);
+    const { set: ompSet, note: ompNote } = ompTierNote(env);
+    if (pairs.size === 0 && routedModels.size === 0)
+        return (ompSet ? warnOutcome : okOutcome)(`${PHRASE_NO_MODELS_DECLARED}${ompNote}`);
+    const providers = await readTierProviders(modelsPath, pairs, listed);
+    const fails = [];
+    const warns = [];
+    if (pairs.size > 0 && !providers)
+        return warnOutcome(`${PHRASE_CANNOT_READ_MODELS}${modelsPath}${ompNote}`);
+    const readyProviders = new Set();
+    const checkedProviders = new Set();
+    for (const { provider, model } of pairs.values()) {
+        const result = await resolveTierPair(provider, model, providers, listed, auth, checkedProviders, modelsPath);
+        warns.push(...result.warns);
+        if (result.fail !== undefined)
+            fails.push(result.fail);
+        if (result.ready === true)
+            readyProviders.add(provider);
+    }
+    const routedText = routedTierNotes(routedModels);
+    return tierOutcome(fails, warns, pairs.size, readyProviders, routedText, ompNote, ompSet);
 }
 /** `gh` readiness for the opt-in `feedback` observer (plans/feedback-role.md "Shape" → "Part 1"):
  * the role files issues as the operator's GitHub login through `gh`, so doctor confirms `gh`
@@ -289,3 +350,26 @@ export async function checkFeedbackFiling(root, pathEnv = envPath(), probe = (ar
         return failOutcome("gh is not authenticated — run `gh auth login` — the feedback role files issues as your GitHub login");
     return okOutcome("gh present and authenticated — the feedback role can file issues on znation/tumwater");
 }
+/** The `image input` row (plans/image-input.md "Surfaces", part 5/5): which enabled roles run
+ * on a model that cannot read images, and where each reroutes an image prompt — or that no
+ * usable reroute exists. Re-added probe-free by Subtract part 1d/6 after part 5f/6 deleted the
+ * probe-backed row: it reads roleImageInfo (the same resolver the status rows, role page, and
+ * submit gate share) rather than spawning a backend, so doctor and the surfaces cannot drift on
+ * who is text-only. No alert when none is (imageInput true or null — an unknown pair is not
+ * counted as text-only, mirroring the submit gate and the `models for each tier` stance). */
+export function checkImageInput(root, modelsPath = piModelsPath(), listed = readPiListedModels(root)) {
+    const config = loadConfigForCheck(root);
+    if ("level" in config)
+        return config;
+    const textOnly = runnerIds(config).filter((role) => roleImageInfo(config, role, modelsPath, listed).imageInput === false);
+    if (textOnly.length === 0)
+        return okOutcome("every enabled role reads images");
+    const noTarget = textOnly.filter((role) => {
+        const rr = roleImageInfo(config, role, modelsPath, listed).imageReroute;
+        return rr === null || rr === "";
+    });
+    if (noTarget.length > 0)
+        return warnOutcome(`${noTarget.join(", ")} ${agree(noTarget.length, "runs", "run")} on models that can't read images and ${agree(noTarget.length, "has", "have")} no reroute target — a run that reads an image fails, and image attachments to these roles are refused. Declare image input on a vision model in pi's models.json, or point a tier at one.`);
+    const targets = new Set(textOnly.map((role) => roleImageInfo(config, role, modelsPath, listed).imageReroute ?? ""));
+    return okOutcome(`${textOnly.join(", ")} ${agree(textOnly.length, "runs", "run")} on models that can't read images — image prompts rerun on ${[...targets].join(", ")}.`);
+}

package/dist/src/doctor/doctor-notify.js

@@ -1,9 +1,9 @@
 import { eventsSince } from "../events/event-window.js";
-import { isNotifyFailure } from "../events/notify.js";
+import { isNotifyFailure } from "../events/event-notify.js";
 import { DAY_MS, humanAgo } from "../text/datetime.js";
 import { plural } from "../text/phrases.js";
 import { errorMessage, squash } from "../text/text.js";
-import { okOutcome, warnOutcome } from "./outcome.js";
+import { okOutcome, warnOutcome } from "./doctor-outcome.js";
 /** How far back the `notify` check looks for failed pages: a day, fixed. An opinionated
  * default with no knob, like STALE_BUG_DAYS: long enough that a transient hook failure shows
  * up, short enough that a page that did not go through is still the operator's business. */

package/dist/src/doctor/doctor-opencode-checks.js

@@ -1,7 +1,7 @@
 import os from "node:os";
 import path from "node:path";
 import { childEnv } from "../process/process.js";
-import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./probe.js";
+import { AUTH_CHECK_MAX_OUTPUT_BYTES, AUTH_CHECK_TIMEOUT_MS, boundedProbe } from "./doctor-probe.js";
 import { opencodeBackend, opencodeSpillDir } from "../agent/opencode/opencode-backend.js";
 import { opencodeModelFree, opencodeModelKey, readOpencodeCache } from "../agent/opencode/opencode-catalog.js";
 import { formatDate } from "../text/datetime.js";
@@ -9,7 +9,7 @@ import { opencodeDbPath } from "../paths.js";
 import { envPath, isDirectory, readTextOrNull, statOrNull, treeBytes } from "../files/files.js";
 import { formatBytes, tokenWindowLabel } from "../text/format.js";
 import { escapeRegExp } from "../text/text.js";
-import { failOutcome, okOutcome, warnOutcome } from "./outcome.js";
+import { failOutcome, okOutcome, warnOutcome } from "./doctor-outcome.js";
 import { loadConfigForCheck, opencodeSeamsInUse, seamedModels, } from "./doctor-model-checks.js";
 /** The doctor's opencode credential and leak readiness check, split out of doctor-model-checks.ts
  * (whose shared seam/model framework and the pi and tier-models checks stay there):
@@ -19,8 +19,9 @@ import { loadConfigForCheck, opencodeSeamsInUse, seamedModels, } from "./doctor-
  * filesystem/git checks beside it, kept together so a change to how doctor reads opencode does
  * not touch the other model checks. The shared report contract (CheckOutcome) and the
  * seam/model framework (loadConfigForCheck, opencodeSeamsInUse, seamPairs) come from
- * doctor-model-checks.ts, the AUTH_CHECK_* probe budgets from probe.ts, and the shared report
- * contract (CheckOutcome) from outcome.ts, as the other doctor-* modules do. */
+ * doctor-model-checks.ts, the AUTH_CHECK_* probe budgets from doctor-probe.ts, and the
+ * shared report contract (CheckOutcome) from doctor-outcome.ts, as the other doctor-*
+ * modules do. */
 /** The provider of a non-gateway opencode model id (`opencode/<provider>/<model>`), or
  * undefined for a gateway id (a bare `opencode/<model>` or `<model>`, served by OpenCode's
  * own gateway with no credential). A model id with more than the `opencode/` namespace prefix