tumwater 0.4.2 → 0.4.4

package/dist/src/merge/merge-drain.js

@@ -1,7 +1,6 @@
 import { mergeApproved } from "./merge-batch.js";
 import { removeMergeChange, resolveWaitStage, setMergeChangeStatus } from "./merge-slot.js";
-import { seamConcurrencyKey } from "../config/config-views.js";
-import { withProviderLease } from "../concurrency/provider-lease.js";
+import { withRunPermit } from "../concurrency/run-permit.js";
 import { dropMerge, entryRevisionFields, queuedMergeFiles } from "./merge-queue.js";
 import { errorMessage } from "../text/text.js";
 import { warnEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
@@ -23,8 +22,9 @@ async function postReviewDue(config, root, commit) {
     return files === null || !isExemptDiff(files, config.review.exemptPaths);
 }
 /** One poll of the merge queue (the scheduler's WHEN: after the gates, never while a restart
- * or a disk hold is pending — a reviewer-provider hold does not stop the whole drain, it parks
- * only the entries a pre-merge review gates, per the role-scoped startHeld): start a
+ * or a disk hold is pending — a reviewer-provider hold does not stop the whole drain: it parks
+ * only the post-merge review drain, whose no-role startHeld reads it, never a merge entry, so
+ * no verify or landing waits on the reviewer): start a
  * verification for every queued change the pipeline does not already hold (drainVerify, in
  * merge-verify.ts), and start the merge when the slot is free and something is approved
  * (drainMerge). A queued merge is COMMITTED work awaiting completion, not a new run, so the
@@ -123,22 +123,20 @@ function startMerge(ctx, p, picks) {
             runPi: async (w, prompt, s, cfg) => {
                 // A parked resolver names its wait (resolve-wait, then resolving once granted) the way
                 // a parked check does (withCheckPermit): on 2026-10-12 one waited 2.5 min for a permit
-                // with the merge queue behind it, reading as "merging". The lease is keyed on the
-                // resolver config's provider (the `cfg` it is handed), so the conflict resolution
-                // counts against the strong tier's provider cap like any other strong-tier run
+                // with the merge queue behind it, reading as "merging". The resolution waits on the
+                // one team total (maxConcurrent) like any other MERGE_TIER run
                 // (plans/provider-concurrency.md §4). canLeaseAtOnce is acquireLease's own fast path
                 // decided synchronously, so a free permit shows no wait; MERGE_TIER ignores the
                 // maintenance reserve.
-                const key = cfg ? seamConcurrencyKey(cfg, ctx.piDefault) : undefined;
                 const hooks = resolveWaitStage(root, v.entry.role);
-                if (!semaphore.canLeaseAtOnce(MERGE_TIER, key))
+                if (!semaphore.canLeaseAtOnce(MERGE_TIER))
                     hooks.waiting();
-                const lease = await semaphore.acquireLease(MERGE_TIER, key);
+                const lease = await semaphore.acquireLease(MERGE_TIER);
                 hooks.granted();
                 try {
-                    // The resolver's lease rides in the provider-lease store for its run, so the run
-                    // re-keys it to the provider it actually uses (plans/provider-concurrency.md §5).
-                    return await withProviderLease(lease, semaphore, () => v.author.runMergePi(w, prompt, s, cfg), { piDefault: ctx.piDefault });
+                    // The resolver's lease rides in the run-permit store for its run, so an idle
+                    // pause inside it (a failed review's in-place retry) re-takes the same permit.
+                    return await withRunPermit(lease, () => v.author.runMergePi(w, prompt, s, cfg));
                 }
                 finally {
                     lease.release();

package/dist/src/merge/merge-pipeline.js

@@ -43,15 +43,14 @@ export function guardMergeTask(root, role, promise) {
         warnEventBestEffort(root, TUMWATER_SOURCE, `merge task for ${role} could not settle: ${errorMessage(err)}`);
     });
 }
-/** Take a permit at `tier` (on `key` when given) unless `signal` fires first: resolves to its
- * release, or to null when the signal won — a grant that arrives after that is handed straight
- * back (a hop, never a leak), so a parked verification that a shutdown settles holds nothing. When
- * `key` is set the permit is a keyed lease, so the verification also counts against its provider's
- * cap (plans/provider-concurrency.md §4). */
-export async function acquireUnlessAborted(semaphore, tier, signal, key) {
+/** Take a permit at `tier` unless `signal` fires first: resolves to its release, or to null
+ * when the signal won — a grant that arrives after that is handed straight back (a hop, never a
+ * leak), so a parked verification that a shutdown settles holds nothing. A verification's
+ * permit is the one team total (`maxConcurrent`). */
+export async function acquireUnlessAborted(semaphore, tier, signal) {
     if (signal.aborted)
         return null;
-    const granted = semaphore.acquireLease(tier, key);
+    const granted = semaphore.acquireLease(tier);
     const stopped = new Promise((resolve) => signal.addEventListener("abort", () => resolve(false), { once: true }));
     if (await Promise.race([granted, stopped])) {
         return granted;

package/dist/src/merge/merge-post-review-drain.js

@@ -1,5 +1,4 @@
-import { withProviderLease } from "../concurrency/provider-lease.js";
-import { reviewRunConfig, seamConcurrencyKey } from "../config/config-views.js";
+import { withRunPermit } from "../concurrency/run-permit.js";
 import { subscribeEvents, warnEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { deleteRef, headOf, subjectOfCommit } from "../git/git.js";
 import { ensureDetachedWorktree } from "../git/worktree.js";
@@ -14,7 +13,7 @@ import { abortOnShutdown, acquireUnlessAborted, guardMergeTask } from "./merge-p
 import { resolveWaitStage } from "./merge-slot.js";
 import { mergeToMain } from "./merge-to-main.js";
 import { MERGE_TIER, resolveAuthor, VERIFY_TIER } from "./merge-verify.js";
-/** One poll of the post-merge reviews (review.afterMerge): a rejected-and-not-fixed commit is
+/** One poll of the post-merge reviews: a rejected-and-not-fixed commit is
  * answered by the reviewer's own landed fix (Forward, never back 1/6) — never by a revert — and
  * the next unreviewed commit starts its review when a permit is free right now. One review at a
  * time; starts a task and returns. */
@@ -35,12 +34,11 @@ function startPostReview(ctx, p, entry) {
     const task = { promise: Promise.resolve(), controller: new AbortController(), roles: [], userAborted: false, parked: true };
     const detach = abortOnShutdown(ctx.signal, task.controller);
     const author = resolveAuthor(ctx, entry.role);
-    const key = seamConcurrencyKey(reviewRunConfig(ctx.liveConfig), ctx.piDefault);
     const run = (async () => {
         try {
-            if (!semaphore.canLeaseAtOnce(VERIFY_TIER, key))
+            if (!semaphore.canLeaseAtOnce(VERIFY_TIER))
                 return; // permits are busy; try again next poll
-            const lease = await acquireUnlessAborted(semaphore, VERIFY_TIER, task.controller.signal, key);
+            const lease = await acquireUnlessAborted(semaphore, VERIFY_TIER, task.controller.signal);
             task.parked = false;
             if (lease === null)
                 return;
@@ -125,19 +123,18 @@ async function fileDroppedReview(ctx, entry, failure) {
  * is never a throw. */
 async function mergeReviewerFix(ctx, entry, fix) {
     const author = resolveAuthor(ctx, entry.role);
-    // The fix merge's conflict resolver rides the same provider lease the merge slot's resolver
-    // does (merge-drain.ts startMerge): the MERGE_TIER lease is keyed on the resolver config's
-    // provider and rides in the provider-lease store, so a conflict resolution counts against the
-    // strong tier's cap like any other strong-tier run instead of acquiring a provider unchecked.
+    // The fix merge's conflict resolver rides the same team permit the merge slot's resolver
+    // does (merge-drain.ts startMerge): the MERGE_TIER lease is acquired on the one team total
+    // and rides in the run-permit store, so a conflict resolution counts against maxConcurrent
+    // like any other strong-tier run.
     const runPi = async (wt, prompt, sessionName, config) => {
-        const key = config ? seamConcurrencyKey(config, ctx.piDefault) : undefined;
         const hooks = resolveWaitStage(ctx.root, entry.role);
-        if (!ctx.semaphore.canLeaseAtOnce(MERGE_TIER, key))
+        if (!ctx.semaphore.canLeaseAtOnce(MERGE_TIER))
             hooks.waiting();
-        const lease = await ctx.semaphore.acquireLease(MERGE_TIER, key);
+        const lease = await ctx.semaphore.acquireLease(MERGE_TIER);
         hooks.granted();
         try {
-            return await withProviderLease(lease, ctx.semaphore, () => author.runMergePi(wt, prompt, sessionName, config), { piDefault: ctx.piDefault });
+            return await withRunPermit(lease, () => author.runMergePi(wt, prompt, sessionName, config));
         }
         finally {
             lease.release();

package/dist/src/merge/merge-queue-render.js

@@ -3,7 +3,7 @@
  * in execution order, plus the count of queue files the reader skipped. Pure function of the
  * collected view and a `now` instant — no I/O, no clock reads — so the age it prints can be
  * pinned by a test. */
-import { humanAgo, humanSeconds, secondsSince, secondsUntil } from "../text/datetime.js";
+import { humanAgo, humanSeconds, humanSince, secondsUntil } from "../text/datetime.js";
 import { roleLabel } from "../roles/role-labels.js";
 import { shortSha } from "../text/format.js";
 import { filterKeepPositions } from "../collections.js";
@@ -24,11 +24,11 @@ export function queueEntryMergeLabel(sha, inFlight, now) {
         return "approved, waiting to merge";
     let label = "merging";
     if (change.startedAt)
-        label += ` ${humanSeconds(secondsSince(change.startedAt, now))}`;
+        label += ` ${humanSince(change.startedAt, now)}`;
     if (change.stage)
         label += ` · ${MERGE_STAGE_LABELS[change.stage]}`;
     if (change.stageSince !== undefined)
-        label += ` ${humanSeconds(secondsSince(change.stageSince, now))}`;
+        label += ` ${humanSince(change.stageSince, now)}`;
     return label;
 }
 /** One re-submitted change's revision note (plans/revise-rejected.md): `revision <round>`,

package/dist/src/merge/merge-requeue.js

@@ -6,7 +6,7 @@
  * retriable result) or once main's head stops being red (a `main_red` pin). */
 import { enqueueMerge, queuedMerges } from "./merge-queue.js";
 import { RETRIABLE_MERGE_RESULTS } from "./merge-core.js";
-import { pinnedRetrySha } from "../runner/leftover.js";
+import { pinnedRetrySha } from "../runner/runner-leftover.js";
 import { branchHead } from "../git/git.js";
 import { cachedBaselineVerdict } from "../baseline/main-baseline.js";
 import { saveRunnerStateBestEffort } from "../runner/runner-state.js";

package/dist/src/merge/merge-slot.js

@@ -192,14 +192,6 @@ export function checkWaitStage(root, roles) {
 export function resolveWaitStage(root, role) {
     return waitStageHooks(root, [role], "resolve-wait", "resolving");
 }
-/** The verification's hooks around a re-key onto a full provider (plans/provider-concurrency.md §5,
- * "A re-key wait is visible"): `provider-wait` while the verification's lease parks on the target
- * provider's full cap, `reviewing` once the key frees and the review proceeds. resolveWaitStage's
- * shape for the re-key path — a verification that normally shares its review seam never
- * re-keys, so the stage fires only when a run actually moves to a different, full provider. */
-export function providerWaitStage(root, role) {
-    return waitStageHooks(root, [role], "provider-wait", "reviewing");
-}
 /** The marker's per-change records, whichever shape it has: `changes` as written, or — for a
  * marker an older generation wrote with one top-level change — that change, `merging` since the
  * marker's start at the marker's stage. Reads both shapes into records, so addMergeChange's

package/dist/src/merge/merge-stack.js

@@ -2,8 +2,8 @@
  * merge-batch.ts, whose header scopes that file to the verify and merge halves): assemble the
  * approved changes as a cherry-picked stack on main's current tip, run ONE scope-`batch` build
  * check over the combined tree, and fast-forward main through the captured shas — with the
- * re-stack loop for a main that moves mid-check, the doc-only exemption and its cross-checks,
- * and the per-attempt abort observation. The bisect over a red stack (mergeApproved, in
+ * re-stack loop for a main that moves mid-check, the doc-only exemption, and the per-attempt
+ * abort observation. The bisect over a red stack (mergeApproved, in
  * merge-batch.ts) drives this file's mergeStack one prefix at a time. */
 import { committerIdentArgs, gitTry } from "../git/git-run.js";
 import { branchHead, deleteRef, headOf } from "../git/git.js";
@@ -11,7 +11,6 @@ import { treeDiffFiles } from "../git/git-diff.js";
 import { mergeRefName, mergeLockDir } from "../paths.js";
 import { ensureDetachedWorktree } from "../git/worktree.js";
 import { useWorktree } from "../git/worktree-use.js";
-import { exemptSkipBlockReason } from "./merge-to-main.js";
 import { logNewQuestions } from "./merge-questions.js";
 import { openQuestions } from "../backlog/backlog.js";
 import { logEventBestEffort, warnEventBestEffort } from "../events/events.js";
@@ -81,11 +80,13 @@ async function assembleStack(root, mainBranch, wtPath, entries) {
  * the gate's own doc-only test (isExemptDiff over config.review.exemptPaths). A re-stack whose
  * new commits from main were doc-only rebuilds the checked tree with nothing but doc bytes
  * changed, and a doc-only delta cannot break the build: the reasoning verifyMerge
- * (src/merge/merge-to-main.ts) applies when it skips its in-lock re-check for a moved
- * doc-only merge. Its false-fix cross-check has no counterpart here — the delta is
- * commits main already merged through their own gate, not a claim this batch makes.
- * --no-renames so a rename out of a code path lists the deleted source, not only its exempt
- * destination. An unreadable diff is not exempt: the caller runs the check. */
+ * (src/merge/merge-to-main.ts) applies when it lets a moved doc-only merge through with no
+ * check. Since part 3m/3 that arm runs no cross-check, and neither does this delta — a false
+ * fix claim and a broken backlog structure are repairable by a later commit and reported by
+ * the main watch, and this delta is commits main already merged through their own gate, not a
+ * claim this batch makes. --no-renames so a rename out of a code path lists the deleted
+ * source, not only its exempt destination. An unreadable diff is not exempt: the caller runs
+ * the check. */
 async function exemptTreeDelta(root, from, to, exemptPaths) {
     const files = await treeDiffFiles(root, from, to);
     return files !== null && isExemptDiff(files, exemptPaths);
@@ -97,9 +98,10 @@ async function exemptTreeDelta(root, from, to, exemptPaths) {
  * won, up to BATCH_RESTACK_ATTEMPTS times, and a re-stack whose tree is the checked tree plus
  * doc-only commits skips its re-check (exemptTreeDelta). A stack whose whole delta ahead of
  * its assembly base is review-exempt skips the check too — a doc-only delta cannot break the
- * build (the reasoning verifyMerge's exempt arm applies) — and runs the same cross-checks
- * that arm runs, the backlog heading structure and the false-fix claim; one that fails either
- * returns `conflict`, so the per-change fallback applies the gate's own verdict per change.
+ * build (the reasoning verifyMerge's exempt arm applies). Since part 3m/3 that arm runs no
+ * cross-check and neither does this skip: a false fix claim and a broken backlog structure are
+ * repairable by a later commit and reported by the main watch, so the doc-only stack merges on
+ * the exemption for the watch to report on main's tip.
  * A primary checkout on main that holds uncommitted or untracked files the stack changes
  * returns `blocked` before any check runs, with no re-stack.
  * On `landed` every entry's ref is deleted and the red-main baseline is seeded with the tip
@@ -146,13 +148,10 @@ async function mergeStackIn(ctx, wtPath, entries) {
             // exemption instead of paying a suite run no code change asked for).
             const stackFiles = await treeDiffFiles(ctx.root, base, tip);
             if (stackFiles !== null && isExemptDiff(stackFiles, exemptPaths)) {
-                // The same cross-checks verifyMerge's exempt arm runs (merge-to-main.ts's
-                // exemptSkipBlockReason): the skip must not wave through an md-only edit the gate would
-                // have rejected. A failure here cannot name a red check (none ran), so it hands the
-                // stack to the one-at-a-time fallback, whose exempt arm blocks or rejects each change
-                // with the proper handling. No baseline seeds — nothing ran on this tip.
-                if (await exemptSkipBlockReason({ root: ctx.root, role: entries[0].role, mainBranch: ctx.mainBranch }, wtPath, stackFiles))
-                    return { kind: "conflict" };
+                // Since part 3m/3 an md-only stack's repairable findings (a false fix claim, a broken
+                // backlog structure) no longer refuse anything — the main watch reports them on main's
+                // tip after the merge — so the skip runs no cross-check and no check: doc-only cannot
+                // break the build. No baseline seeds — nothing ran on this tip.
             }
             else {
                 // The merge cell names the check while it runs, then the merge steps after it — the ff

package/dist/src/merge/merge-to-main.js

@@ -10,12 +10,10 @@ import { runScopedBuildCheck } from "../build/build-check-scoped.js";
 import { detectBuildCheck, gateCommandOf, mergeCommandOf } from "../build/build-check-detect.js";
 import { onlyKnownMainFailures } from "../baseline/main-watch.js";
 import { unverifiedTreeOutcome } from "../build/build-check-events.js";
-import { describeCheck, failureHeadline } from "../build/build-check-report.js";
+import { redCheckHeadline } from "../build/build-check-report.js";
 import { MERGE_FLAKY_WARNING_PREFIX, quarantineTests } from "../review/known-flakes.js";
 import { noteGreenBaseline, noteInheritedGreen } from "../baseline/main-baseline.js";
 import { isExemptDiff } from "../review/exemptions.js";
-import { falseFixReason } from "../verdict/fix-claim.js";
-import { backlogStructureReason } from "../backlog/backlog-structure.js";
 import { withLock } from "../concurrency/lock.js";
 import { buildConflictPrompt } from "../prompt/gate-prompts.js";
 import { mergeLockDir } from "../paths.js";
@@ -121,42 +119,13 @@ async function tryMerge(ctx, wt, summary, verifiedHead) {
         return "changed";
     }, ctx.lockTimeoutMs);
 }
-/** The backlog-structure cross-check both verifyMerge paths run (exempt and code diffs
- * alike): when the tree ahead of main duplicates or drops a `## ` section heading, warn on the
- * role's feed with the one "merge blocked:" phrasing and return the reason (null when the
- * headings are intact). Shared so the wording and the block action cannot drift between the
- * paths. */
-async function structureBlocked(ctx, wt, files) {
-    const structure = await backlogStructureReason(wt, ctx.mainBranch, files);
-    if (!structure)
-        return null;
-    warnEventBestEffort(ctx.root, ctx.role, `merge blocked: ${structure}`);
-    return structure;
-}
-/** The exempt arm's full cross-check — backlog structure, then fix-claim — shared by
- * verifyMerge and merge-batch.ts's stack skip: an md-only tree delta that skips the build
- * check must not wave through an edit the gate would have rejected. Returns the first blocking
- * reason (a structure reason already warned as "merge blocked: ..."), or null when the skip
- * may proceed. */
-export async function exemptSkipBlockReason(ctx, wt, files) {
-    const structure = await structureBlocked(ctx, wt, files);
-    if (structure)
-        return structure;
-    const fix = await falseFixReason(wt, ctx.mainBranch, files);
-    // Warn like structureBlocked does: a fix-claim block that used to be silent read as five
-    // unexplained merge_blocked retries on the feed (BUGS.md 2026-10-02). The batch stack-skip
-    // caller may warn twice for one change (here, then again when the fallback's exempt arm
-    // blocks it) — a duplicated line is harmless next to a silent block.
-    if (fix)
-        warnEventBestEffort(ctx.root, ctx.role, `merge blocked: ${fix}`);
-    return fix ?? null;
-}
 /** Verify the exact tree about to reach main — the post-rebase head (BUGS.md 2026-09-08: the
  * gate's pre-check ran outside this lock against a head the rebase may have rewritten, so the
- * bytes that become main were never run through a check). Returns false when the tree is
- * structurally unsound (backlogStructureReason: a duplicated or dropped `## ` section heading,
- * with a warning event so a broken conflict resolution shows on the dashboards) or when the
- * project's declared check FAILS on the rebased tree; every other outcome merges. Skips:
+ * bytes that become main were never run through a check). Returns false only when the project's
+ * declared check FAILS on the rebased tree; every other outcome merges. Since part 3m/3 no
+ * other finding refuses a diff here: a conflict resolution that duplicates or drops a `## `
+ * section heading, or a false fix claim, is repairable by a later commit, so it lands and the
+ * main watch reports it on main's tip after the merge. Skips:
  * - a no-op rebase whose exact tree the gate verified (`rebasedHead === verifiedHead`): main
  *   did not move under us, so the merge tree is byte-identical to what the gate's pre-check
  *   already ran green. Seed the red-main baseline with the SHA that becomes main: every role's
@@ -200,27 +169,13 @@ async function verifyMerge(ctx, wt, rebasedHead, verifiedHead) {
         return true;
     }
     const files = await aheadOfMainFiles(wt, ctx.mainBranch);
-    if (isExemptDiff(files, ctx.exemptPaths)) {
-        // Same cross-checks as the gate (fix-claim.ts, backlog-structure.ts): the in-lock re-check
-        // must not wave through an md-only edit the gate would have rejected — and this is the
-        // site that catches what the gate cannot see: a conflict resolution happens AFTER the
-        // gate, inside this lock, so a resolution that kept both sides of a `## Done` conflict and
-        // duplicated the heading merges here or not at all (PLANS.md 2026-09-25, 9eaae5ac).
-        const reason = await exemptSkipBlockReason(ctx, wt, files);
-        if (reason !== null) {
-            ctx.onMergeBlocked?.(reason);
-            return false;
-        }
+    // An exempt (md-only) diff cannot break the build and — since part 3m/3 — carries no finding
+    // this merge must refuse: a false fix claim and a broken backlog structure are repairable by
+    // a later commit, so they land for the main watch to report on main's tip. The old rationale —
+    // "must not wave through an md-only edit the gate would have rejected" — is gone with the
+    // gate's narrowing: the gate no longer rejects those findings.
+    if (isExemptDiff(files, ctx.exemptPaths))
         return true;
-    }
-    // The heading check for code diffs too, before the build check: a conflict resolution that
-    // broke backlog structure reads as an explained block on the dashboards, not as an
-    // unexplained red check run on a tree that could never merge.
-    const structure = await structureBlocked(ctx, wt, files);
-    if (structure) {
-        ctx.onMergeBlocked?.(structure);
-        return false;
-    }
     if (await onlyExemptDriftFromVerified(ctx, wt, rebasedHead, verifiedHead))
         return true;
     // The run itself (build_check event, environmental-skip warning) lives in
@@ -235,7 +190,7 @@ async function verifyMerge(ctx, wt, rebasedHead, verifiedHead) {
         const failed = check.outcome;
         const retry = await runMergeCheck();
         if (retry?.outcome.status === "passed") {
-            warnEventBestEffort(ctx.root, ctx.role, `${MERGE_FLAKY_WARNING_PREFIX}${failureHeadline(failed.outputTail) ?? describeCheck(check.check)}`);
+            warnEventBestEffort(ctx.root, ctx.role, `${MERGE_FLAKY_WARNING_PREFIX}${redCheckHeadline(check.check, failed.outputTail)}`);
             quarantineTests(ctx.root, failed.failingTests, failed.outputTail);
             check = retry;
         }

package/dist/src/merge/merge-verify.js

@@ -1,13 +1,11 @@
 import fs from "node:fs";
 import path from "node:path";
 import { gateRoleConfig } from "../gates/budget-gates.js";
-import { reviewRunConfig, seamConcurrencyKey } from "../config/config-views.js";
-import { providerWaitStage } from "./merge-slot.js";
-import { withProviderLease } from "../concurrency/provider-lease.js";
+import { withRunPermit } from "../concurrency/run-permit.js";
 import { RoleRunner } from "../runner/runner.js";
 import { branchHead, commitMessage, isMergedInto, refSha } from "../git/git.js";
 import { commitRunOf } from "../git/commit-message.js";
-import { recoveredMergeEntry, recoveredMetadata } from "../runner/leftover.js";
+import { recoveredMergeEntry, recoveredMetadata } from "../runner/runner-leftover.js";
 import { addMergeChange, mergeUsage, removeMergeChange, setMergeChangeStatus } from "./merge-slot.js";
 import { dropMerge, enqueueMerge, entryRevisionFields, queuedMergeFiles, staleHeadFile, tornHeadRole } from "./merge-queue.js";
 import { mergeRefName } from "../paths.js";
@@ -160,9 +158,10 @@ export async function drainVerify(ctx, p) {
         // (its role was busy when the queue was listed) or claimed its role. Start nothing for it.
         if (!fs.existsSync(file) || liveRoles(p).has(entry.role))
             continue;
-        // A pre-merge entry during a reviewer hold stays queued instead of starting a parked verify
-        // that fills the verify limit; a review.afterMerge role's entry keeps draining (its review
-        // runs after merging, so the hold is not for it) — ctx's role-scoped start gate decides.
+        // A reviewer hold parks no named entry — every entry keeps draining (no verify, start or
+        // landing waits on the reviewer); only a restart or disk hold (the start gate's other legs)
+        // parks it here, and a parked verification re-checks the gate when its permit comes. The
+        // start gate decides.
         if (ctx.startHeld(entry.role))
             continue;
         startVerify(ctx, p, entry, file);
@@ -186,13 +185,6 @@ export function startVerify(ctx, p, entry, file) {
     const { root, mainBranch, signal, semaphore } = ctx;
     const { role } = entry;
     const author = resolveAuthor(ctx, role);
-    // The verification's provider key: the review seam's key for the author's role, so its reviewer
-    // run counts toward the same provider cap as the roles that share it
-    // (plans/provider-concurrency.md §4). The gate off runs no model, so then there is no key — the
-    // verification is bounded by the team total alone.
-    const reviewKey = ctx.liveConfig.review.enabled
-        ? seamConcurrencyKey(reviewRunConfig(author.config), ctx.piDefault)
-        : undefined;
     const verify = {
         promise: Promise.resolve(), // Replaced below; the placeholder satisfies the type.
         controller: new AbortController(),
@@ -204,7 +196,7 @@ export function startVerify(ctx, p, entry, file) {
     p.verifying.set(role, verify);
     const task = (async () => {
         try {
-            const lease = await acquireUnlessAborted(semaphore, VERIFY_TIER, verify.controller.signal, reviewKey);
+            const lease = await acquireUnlessAborted(semaphore, VERIFY_TIER, verify.controller.signal);
             verify.parked = false;
             if (lease === null)
                 return; // a shutdown while parked
@@ -217,11 +209,10 @@ export function startVerify(ctx, p, entry, file) {
             const startedAt = Date.now();
             try {
                 addMergeChange(root, entry, liveRoles(p));
-                // The verification's lease rides in the provider-lease store for the verification's body,
-                // so a review run that lands on a different provider than the verification's review seam
-                // re-keys it there, and a re-key park is shown by providerWaitStage; its slot wait drops
-                // the key (pool-slot rule).
-                verdict = await withProviderLease(lease, semaphore, () => verifyRequest({ root, mainBranch, config: author.config, signal: () => verify.controller.signal, runGatePi: (opts) => author.runGatePi(opts), reviewHeld: () => ctx.startHeld() }, {
+                // The verification's lease rides in the run-permit store for the verification's body,
+                // so an idle pause inside it (a failed review's in-place retry) re-takes the same
+                // team permit; its slot wait hands the permit back too.
+                verdict = await withRunPermit(lease, () => verifyRequest({ root, mainBranch, config: author.config, signal: () => verify.controller.signal, runGatePi: (opts) => author.runGatePi(opts), reviewHeld: () => ctx.startHeld() }, {
                     role,
                     sha: entry.sha,
                     runNumber: entry.run,
@@ -229,7 +220,7 @@ export function startVerify(ctx, p, entry, file) {
                     body: entry.body,
                     highFriction: entry.highFriction,
                     ...entryRevisionFields(entry),
-                }, { state: author.state, foldUsage, runPi: (w, prompt, s, cfg) => author.runMergePi(w, prompt, s, cfg), runGatePi: (opts) => author.runGatePi(opts) }), { piDefault: ctx.piDefault, hooks: providerWaitStage(root, role) });
+                }, { state: author.state, foldUsage, runPi: (w, prompt, s, cfg) => author.runMergePi(w, prompt, s, cfg), runGatePi: (opts) => author.runGatePi(opts) }));
             }
             catch (err) {
                 verdict = { kind: "result", result: "error" };

package/dist/src/notes-cli.js

@@ -58,57 +58,67 @@ function writeNote(text) {
     process.stdout.write(`notes saved (${Buffer.byteLength(text, "utf8")} bytes)\n`);
     return 0;
 }
+function cmdWrite(args) {
+    const [, flag, flagArg] = args;
+    if (flag === undefined)
+        return writeNote(readStdin());
+    if (flag === "--file") {
+        if (flagArg === undefined || args.length > 3)
+            return refuse(USAGE);
+        let text;
+        try {
+            text = fs.readFileSync(flagArg, "utf8");
+        }
+        catch (err) {
+            return refuse(`cannot read ${JSON.stringify(flagArg)}: ${errorMessage(err)}`);
+        }
+        return writeNote(text);
+    }
+    return refuse(USAGE);
+}
+function cmdShow(flag) {
+    if (flag !== undefined)
+        return refuse(USAGE);
+    let note;
+    try {
+        note = readNote();
+    }
+    catch (err) {
+        return refuse(`could not read the note: ${errorMessage(err)}`);
+    }
+    // The note is model-authored text, so strip terminal controls at this display
+    // boundary — the same treatment say()/fail()/the TUI frame give every untrusted
+    // string, so a prompt-injected note with an ANSI escape (cursor move, title set,
+    // OSC 52 clipboard write, carriage-return overwrite) cannot drive the operator's
+    // terminal when they run `tumwater-notes show`.
+    process.stdout.write(stripTerminalControls(note));
+    return 0;
+}
+function cmdClear(flag) {
+    if (flag !== undefined)
+        return refuse(USAGE);
+    try {
+        writeRoleNote(NOTES_PATH, "");
+    }
+    catch (err) {
+        return refuse(`could not clear the note: ${errorMessage(err)}`);
+    }
+    process.stdout.write("notes cleared\n");
+    return 0;
+}
 function main() {
     if (NOTES_PATH === undefined || NOTES_PATH === "") {
         return refuse("this run keeps no notes");
     }
     const args = process.argv.slice(2);
-    const [command, flag, flagArg] = args;
+    const [command, flag] = args;
     switch (command) {
         case "write":
-            if (flag === undefined)
-                return writeNote(readStdin());
-            if (flag === "--file") {
-                if (flagArg === undefined || args.length > 3)
-                    return refuse(USAGE);
-                let text;
-                try {
-                    text = fs.readFileSync(flagArg, "utf8");
-                }
-                catch (err) {
-                    return refuse(`cannot read ${JSON.stringify(flagArg)}: ${errorMessage(err)}`);
-                }
-                return writeNote(text);
-            }
-            return refuse(USAGE);
+            return cmdWrite(args);
         case "show":
-            if (flag !== undefined)
-                return refuse(USAGE);
-            let note;
-            try {
-                note = readNote();
-            }
-            catch (err) {
-                return refuse(`could not read the note: ${errorMessage(err)}`);
-            }
-            // The note is model-authored text, so strip terminal controls at this display
-            // boundary — the same treatment say()/fail()/the TUI frame give every untrusted
-            // string, so a prompt-injected note with an ANSI escape (cursor move, title set,
-            // OSC 52 clipboard write, carriage-return overwrite) cannot drive the operator's
-            // terminal when they run `tumwater-notes show`.
-            process.stdout.write(stripTerminalControls(note));
-            return 0;
+            return cmdShow(flag);
         case "clear":
-            if (flag !== undefined)
-                return refuse(USAGE);
-            try {
-                writeRoleNote(NOTES_PATH, "");
-            }
-            catch (err) {
-                return refuse(`could not clear the note: ${errorMessage(err)}`);
-            }
-            process.stdout.write("notes cleared\n");
-            return 0;
+            return cmdClear(flag);
         default:
             process.stderr.write(`${USAGE}\n`);
             return 2;