tumwater 0.4.2 → 0.4.4

package/dist/src/operator/operator-commands.js

@@ -3,8 +3,9 @@ import { fail, say, sayJson } from "../cli/cli-output.js";
 import { failOverDurationCap, flagValue, parseCountFlag, parseDurationFlag, parseRoleFlag } from "../cli/cli-args.js";
 import { errorMessage, splitCommaList } from "../text/text.js";
 import { PAUSE_FOR_OVERFLOW_HINT, REASON_VALUE_ERROR, ROLE_VALUE_ERROR } from "../cli/cli-flag-specs.js";
-import { artifactPhrase, hasRetirableLeftovers, previewRetire, retireRole } from "./retire.js";
-import { previewRevert, revertFollowUp, revertMergedCommit, runRevertSha } from "./revert.js";
+import { artifactPhrase, hasRetirableLeftovers, previewRetire, retireRole } from "./operator-retire.js";
+import { previewRevert, revertFollowUp, revertMergedCommit, runRevertSha } from "./operator-revert.js";
+import { distinctOrdered } from "../collections.js";
 import { runNotFoundMessage } from "../run/run-detail.js";
 import { readRunDetail } from "../run/run-detail-data.js";
 import { readRunRows } from "../history/history-data.js";
@@ -15,9 +16,9 @@ import { shortSha } from "../text/format.js";
 import { INSTANCE_ROLES } from "../roles/runner-ids.js";
 import { allRoleIds, unknownRoleMessage } from "../roles/roles.js";
 import { normalizePauseReason, pauseTeam, pauseRole, pausedRoles, resumeTeam, resumeRole, } from "../team/team-state.js";
-import { readOrchestratorInfo } from "../team/orchestrator-info.js";
+import { readOrchestratorInfo } from "../team/team-orchestrator-info.js";
 import { pidAlive } from "../process/process.js";
-import { inspectReclaimCandidates } from "../team/reclaim.js";
+import { inspectReclaimCandidates } from "../team/team-reclaim.js";
 import { markerApplyNote, NO_HARNESS_ERROR, PAUSE_FOR_MAX_MS, cancelScheduledStopMessage, cancelWakes, listWakes, renderWakeList, requestAbort, requestAbortAll, requestResetCounters, requestRestart, requestScheduledStop, requestWake, rolePauseMessage, roleResumeMessage, runManualReclaim, timedPauseBits, } from "./operator-intent.js";
 /** The CLI layer of the operator commands: the `reset-counters`, `wake`, `reclaim`, `abort`,
  * `pause`, `resume`, `stop`, and `retire` commands, split out of cli.ts so the command bodies
@@ -27,7 +28,7 @@ import { markerApplyNote, NO_HARNESS_ERROR, PAUSE_FOR_MAX_MS, cancelScheduledSto
  * the `prompt` command, which drives the durable per-role queues rather than the marker
  * protocol, lives beside them in src/inbox/prompt-commands.ts, and the `config` command,
  * which reads and writes tumwater.json directly rather than touching team state, in
- * src/cli/config-commands.ts. Every command here is deliberately usable without a live
+ * src/cli/cli-config-commands.ts. Every command here is deliberately usable without a live
  * harness except `abort` and `stop`, which have nothing to reach when no team is up. */
 /** The `--role <id>` value when given, resolved WITHOUT tumwater.json when it names a
  * built-in catalog role: the team itself tolerates a broken config (the live reload keeps
@@ -67,7 +68,7 @@ function namedRoleList(root, args) {
     const pieces = rolePieces(args);
     if (pieces === null)
         return null;
-    return [...new Set(pieces.map((piece) => namedRole(root, ["--role", piece])))];
+    return distinctOrdered(pieces.map((piece) => namedRole(root, ["--role", piece])));
 }
 /** namedRole for the commands that write or lift the per-role pause marker, over a comma list
  * (`--role clean,dedupe`, like `history --role`): `feature-1` (`bugfix-1`) is the pause key of
@@ -80,7 +81,7 @@ function pauseTargetRoles(root, args) {
     if (pieces === null)
         return null;
     const roles = pieces.map((piece) => [...INSTANCE_ROLES].some((base) => piece === `${base}-1`) ? piece : namedRole(root, ["--role", piece]));
-    return [...new Set(roles)];
+    return distinctOrdered(roles);
 }
 /** The `--role <id>` value a marker command requires: namedRole's resolution plus the
  * command-specific "requires --role" failure. retire needs a target (unlike
@@ -222,17 +223,9 @@ export async function cmdRestart(root, _args) {
         fail(result.error);
     say(result.message);
 }
-/** `tumwater pause [--role <id>[,<id>...]] [--for <duration>]`: with roles (a comma list pauses
- * each), stop THAT role from
- * starting new runs — in-flight ones finish, every other role (the director included)
- * keeps running; without one, stop every role from starting NEW runs while in-flight
- * ones finish and the director keeps running (its prompts outrank operator gates, like
- * under the budget cap). The markers
- * are persistent state, not one-shot requests: presence means paused until `resume` removes
- * it — so pausing before startup starts an already-paused team. Unlike abort, no live
- * harness is required; when none runs, say where the pause takes effect instead of failing.
- * Idempotent: a second pause reports the existing marker as-is. */
-export async function cmdPause(root, args = [], now = Date.now()) {
+/** Parse and validate the `--for`/`--reason` flags, failing fast on a bad value before any
+ * marker is written: "how is `--reason` validated?" is answered here. */
+function pauseFlags(args) {
     // `--for <duration>` (the timed pause): the ms-epoch deadline pauseTeam/pauseRole write
     // into the marker and every consumer honors — the command's own gate (runMarkerCommand's
     // rejectUnknownArgs) has already restricted the flag to this command and validated its
@@ -255,28 +248,45 @@ export async function cmdPause(root, args = [], now = Date.now()) {
     // capped-flag idiom the --since windows in cli.ts use).
     if (forMs !== undefined)
         failOverDurationCap("pause --for", forMs, PAUSE_FOR_MAX_MS, PAUSE_FOR_OVERFLOW_HINT);
+    return { forMs, reason };
+}
+/** The timed-pause deadline shape from `--for` and the single `now` instant the deadline and
+ * the confirmation both read, injected by tests so the wording they pin cannot drift with
+ * the wall clock — the same single-clock discipline timedPauseBits's own `now` parameter
+ * follows: "what deadline does `--for` resolve to?" is answered here. */
+function pauseTiming(forMs, now) {
     // `now` is the one instant the deadline and the confirmation both read, injected by tests
     // so the wording they pin cannot drift with the wall clock — the same single-clock
     // discipline timedPauseBits's own `now` parameter follows.
     const timed = forMs === undefined ? undefined : { ms: forMs, untilMs: now + forMs };
-    const untilMs = timed?.untilMs;
-    const roles = pauseTargetRoles(root, args);
-    if (roles) {
-        // The plan keeps per-role pauses anonymous (a per-role reason would need a per-role map
-        // for no observed need), so a reason aimed at a role pause fails fast here — accepting
-        // the flag and silently dropping the note would tell the operator the reason stands
-        // when no marker carries it. Before any marker is written, beside the other fail-fasts.
-        if (reason !== undefined)
-            fail("pause --reason states why the whole team is paused — a per-role pause carries no reason (drop --role, or run bare `tumwater pause --reason <text>`)");
-        // Per-role branch: pauseRole in src/team/team-state.ts is the single writer of the role
-        // marker (the TUI's Ctrl+P and the dashboard's /api/pause-role toggle call it too), so
-        // the CLI, TUI, and GUI cannot drift on format or idempotence; a false return means the
-        // role was already in the set, which rolePauseMessage words — unless a `--for` stands,
-        // which overwrites the deadline and reports the fresh confirmation.
-        for (const role of roles)
-            say(rolePauseMessage(root, role, pauseRole(root, role, untilMs), timed, now));
-        return;
-    }
+    return { timed, untilMs: timed?.untilMs };
+}
+/** The per-role pause branch: rejects a reason aimed at a role pause (a per-role reason would
+ * need a per-role map for no observed need), then pauses each named role through
+ * `rolePauseMessage`/`pauseRole`. */
+function pauseRoleGroup(root, roles, forMs, now, reason) {
+    const { timed, untilMs } = pauseTiming(forMs, now);
+    // The plan keeps per-role pauses anonymous (a per-role reason would need a per-role map
+    // for no observed need), so a reason aimed at a role pause fails fast here — accepting
+    // the flag and silently dropping the note would tell the operator the reason stands
+    // when no marker carries it. Before any marker is written, beside the other fail-fasts.
+    if (reason !== undefined)
+        fail("pause --reason states why the whole team is paused — a per-role pause carries no reason (drop --role, or run bare `tumwater pause --reason <text>`)");
+    // Per-role branch: pauseRole in src/team/team-state.ts is the single writer of the role
+    // marker (the TUI's Ctrl+P and the dashboard's /api/pause-role toggle call it too), so
+    // the CLI, TUI, and GUI cannot drift on format or idempotence; a false return means the
+    // role was already in the set, which rolePauseMessage words — unless a `--for` stands,
+    // which overwrites the deadline and reports the fresh confirmation.
+    for (const role of roles)
+        say(rolePauseMessage(root, role, pauseRole(root, role, untilMs), timed, now));
+}
+/** The team pause branch: writes the pause marker through pauseTeam (the single writer, the
+ * GUI's /api/pause toggle calls it too), reports "already paused" on a false return, and
+ * prints the confirmation template. The reason rides the fresh pause write (or a `--for`
+ * overwrite): the same last-write-wins rule as the deadline, so an "already paused" no-op
+ * keeps the standing note as-is. */
+function pauseTeamGroup(root, forMs, now, reason) {
+    const { timed, untilMs } = pauseTiming(forMs, now);
     // pauseTeam in src/team/team-state.ts is the single writer of the pause marker — the GUI's
     // /api/pause toggle calls it too, so the CLI and the dashboard cannot drift on format
     // or idempotence; a false return means the marker was already there (a `--for` never
@@ -292,6 +302,24 @@ export async function cmdPause(root, args = [], now = Date.now()) {
     const why = pauseReasonSuffix(reason);
     say(`team paused${forPhrase}${why} — roles start no new runs${when} (current runs finish; the director keeps running your messages)${note}${tail}`);
 }
+/** `tumwater pause [--role <id>[,<id>...]] [--for <duration>]`: with roles (a comma list pauses
+ * each), stop THAT role from
+ * starting new runs — in-flight ones finish, every other role (the director included)
+ * keeps running; without one, stop every role from starting NEW runs while in-flight
+ * ones finish and the director keeps running (its prompts outrank operator gates, like
+ * under the budget cap). The markers
+ * are persistent state, not one-shot requests: presence means paused until `resume` removes
+ * it — so pausing before startup starts an already-paused team. Unlike abort, no live
+ * harness is required; when none runs, say where the pause takes effect instead of failing.
+ * Idempotent: a second pause reports the existing marker as-is. */
+export async function cmdPause(root, args = [], now = Date.now()) {
+    const { forMs, reason } = pauseFlags(args);
+    const roles = pauseTargetRoles(root, args);
+    if (roles)
+        pauseRoleGroup(root, roles, forMs, now, reason);
+    else
+        pauseTeamGroup(root, forMs, now, reason);
+}
 /** Deliver the stop signal to the recorded orchestrator pid: "signalled" when SIGTERM was
  * delivered, "gone" when the process died between the caller's liveness check and the
  * signal (ESRCH) — stop's goal is already met in that case, so the caller reports it as
@@ -404,10 +432,21 @@ async function retireTargetRole(root, args) {
         return role;
     fail(unknownRoleMessage(role, ids));
 }
+/** Render one line per artifact an inventory holds and one per skipped artifact — the same
+ * wording both the `--dry-run` preview and the committed run go through, so the two cannot
+ * drift on the removed / `nothing to remove` phrasing. `verb` distinguishes the preview's
+ * `would remove` from the committed `removed`. The `nothing to remove for role` no-ops line
+ * stays in the caller (only the committed run carries it). */
+function sayRemoveInventory(removed, skipped, verb, role) {
+    for (const name of removed)
+        say(`${verb} ${artifactPhrase(name, role)}`);
+    for (const name of skipped)
+        say(`nothing to remove: ${artifactPhrase(name, role)}`);
+}
 /** `tumwater retire --role <id> [--force] [--json]`: remove a disabled role's leftover worktree,
  * branch, merge ref, and paused-state marker. The collection, safety rails, and removal live in
- * src/operator/retire.ts; this is the render layer — one line per removed artifact, the skip lines
- * that make a second run idempotent, or the `--json` payload. */
+ * src/operator/operator-retire.ts; this is the render layer — one line per removed
+ * artifact, the skip lines that make a second run idempotent, or the `--json` payload. */
 export async function cmdRetire(root, args) {
     // The config exists only to validate the id against built-ins plus user-defined roles, with
     // the leftover-branch gate for ids no config names; a missing --role fails before it is needed.
@@ -425,10 +464,7 @@ export async function cmdRetire(root, args) {
             });
             return;
         }
-        for (const name of preview.wouldRemove)
-            say(`would remove ${artifactPhrase(name, role)}`);
-        for (const name of preview.skipped)
-            say(`nothing to remove: ${artifactPhrase(name, role)}`);
+        sayRemoveInventory(preview.wouldRemove, preview.skipped, "would remove", role);
         for (const reason of preview.objections)
             say(force ? `--force overrides: ${reason}` : `would refuse: ${reason}`);
         say("dry run — nothing removed");
@@ -439,10 +475,7 @@ export async function cmdRetire(root, args) {
         sayJson({ role, removed: result.removed, skipped: result.skipped });
         return;
     }
-    for (const name of result.removed)
-        say(`removed ${artifactPhrase(name, role)}`);
-    for (const name of result.skipped)
-        say(`nothing to remove: ${artifactPhrase(name, role)}`);
+    sayRemoveInventory(result.removed, result.skipped, "removed", role);
     if (result.removed.length === 0 && result.skipped.length === 0)
         say(`nothing to remove for role ${role}`);
 }
@@ -540,7 +573,7 @@ function revertRunSha(root, positionals, last) {
 /** `tumwater revert <sha>|<role> <n>|<role> --last`: undo one merged change on main,
  * committing the inverse as `tumwater(operator): Revert <short sha>` under the primary-worktree
  * lock. The lock, branch guard, and fail-closed ref/conflict handling live in
- * src/operator/revert.ts; this renderer names the new main head and names the role
+ * src/operator/operator-revert.ts; this renderer names the new main head and names the role
  * that made the reverted commit, when one did, as the one that may redo the work.
  * `--json` prints the preview or the revert as one JSON object instead (refusals still fail on
  * stderr). */

package/dist/src/operator/operator-intent.js

@@ -1,11 +1,11 @@
 import crypto from "node:crypto";
 import path from "node:path";
 import { cancelScheduledStop, isTeamPaused, scheduleStop } from "../team/team-state.js";
-import { orchestratorAlive, readOrchestratorInfo } from "../team/orchestrator-info.js";
+import { orchestratorAlive, readOrchestratorInfo } from "../team/team-orchestrator-info.js";
 import { durationLabel } from "../cli/cli-args.js";
 import { formatDate, formatTime, humanUntil, DAY_MS } from "../text/datetime.js";
 import { submitRolePrompt } from "../inbox/inbox-submit.js";
-import { questionAsker } from "../backlog/question-answer.js";
+import { questionAsker } from "../backlog/backlog-question-answer.js";
 import { knownRoleIdsCached, loadConfigCached } from "../config/config.js";
 import { baseRoleOf, runnerIds } from "../roles/runner-ids.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
@@ -14,7 +14,7 @@ import { loadRunnerState } from "../runner/runner-state-load.js";
 import { clearBackoff } from "../scheduling/backoff.js";
 import { writeJsonAtomic } from "../files/json-files.js";
 import { ensureDir } from "../files/files.js";
-import { reclaimPass } from "../team/reclaim.js";
+import { reclaimPass } from "../team/team-reclaim.js";
 import { formatGB } from "../text/format.js";
 import { plural } from "../text/phrases.js";
 import { numberedList } from "../text/markdown.js";

package/dist/src/orchestrator/orchestrator-launch.js

@@ -17,8 +17,7 @@ import { logEventBestEffort, warnEventBestEffort, TUMWATER_SOURCE } from "../eve
 import { errorMessage } from "../text/text.js";
 import { fairOrder } from "../scheduling/scheduling.js";
 import { modelPairName } from "../budget/budget.js";
-import { withProviderLease } from "../concurrency/provider-lease.js";
-import { seamConcurrencyKey } from "../config/config-views.js";
+import { withRunPermit } from "../concurrency/run-permit.js";
 import { DIRECTOR_ROLE, roleTier } from "../roles/roles.js";
 import { runTimedRoleRun } from "../run/run-timing.js";
 /** How many recent work-bearing run durations the p75 sample keeps (drainInFlightWork's
@@ -27,13 +26,13 @@ import { runTimedRoleRun } from "../run/run-timing.js";
 export const ROLE_RUN_DURATION_SAMPLES = 50;
 /** The admission wait threshold below which a role run's semaphore wait logs no event — a
  * run that starts at once stays silent. Mirrors SLOT_WAIT_EVENT_MS in src/git/worktree-pool.ts:
- * the wait that signals maxConcurrentPerProvider (or maxConcurrent) caps the team. */
+ * the wait that signals maxConcurrent caps the team. */
 export const PROVIDER_WAIT_EVENT_MS = 30_000;
 /** Launch one due runner's run: reserve it, park it in the semaphore, and start it under
  * runTimedRoleRun with the breaker-evidence wiring. Returns the task promise already added
  * to its in-flight bucket (its `finally` self-removes and folds the duration sample). */
 export function launchDueRuns(ctx) {
-    const { root, reasons, signal, gateStates, breakerPolicy, breakerNow, probePair, probeRoles, budgetActive, windowMovedRoles, semaphore, piDefault, rolePermitHolders, roleInFlight, directorInFlight, roleRunDurationsMs, startHeld, } = ctx;
+    const { root, reasons, signal, gateStates, breakerPolicy, breakerNow, probePair, probeRoles, budgetActive, semaphore, rolePermitHolders, roleInFlight, directorInFlight, roleRunDurationsMs, startHeld, } = ctx;
     let admittedProbe = false;
     for (const runner of fairOrder([...reasons.keys()])) {
         if (signal.aborted)
@@ -65,13 +64,8 @@ export function launchDueRuns(ctx) {
         // Mark the parked waiter while it waits: it holds no permit yet, so the dashboards
         // render `awaiting slot` (an inactive state) and the active rows keep tracking
         // maxConcurrent (BUGS.md 2026-09-24). Cleared the moment the permit is granted. The
-        // director never queues, so it is never a parked waiter. Its provider key rides beside
-        // `parkedSince` (provider-concurrency part 5/5): the key the admission lease will
-        // acquire, computed from the same runConfig admission uses, so a waiter named by a
-        // full key renders `awaiting <key> slot` on the dashboards.
-        const parkKey = runner.role === DIRECTOR_ROLE ? null : runner.runConfig(Date.now());
+        // director never queues, so it is never a parked waiter.
         runner.state.parkedSince = usesSlot ? Date.now() : undefined;
-        runner.state.parkedOn = usesSlot && parkKey ? seamConcurrencyKey(parkKey, piDefault) : undefined;
         // The run's own duration (null when it never started, was cut off, or ended without
         // work): the drain-window sample is taken only for a work-bearing run that finished
         // on its own (runTimedRoleRun; BUGS.md 2026-09-30).
@@ -79,36 +73,21 @@ export function launchDueRuns(ctx) {
         // Whether runner.run() was ever called — false when the start gate (or a shutdown)
         // turned the run away at its permit.
         let started = false;
-        // The run's keyed semaphore lease (plans/provider-concurrency.md §4): acquired on the
-        // authoring seam's provider key and released in place of the bare team release, so the
-        // cap is real for role runs from part 2/5 on. The director never queues, so its lease is
-        // never created here.
+        // The run's team semaphore lease, acquired at admission and released in place of the bare
+        // team release. The director never queues, so its lease is never created here.
         let lease = null;
-        // The director's forced provider lease (plans/provider-concurrency.md §4): never queues and
-        // never counts toward maxConcurrent, but DOES count toward its provider key while its run
-        // runs — so a full provider admits no further grants until the director releases.
-        let directorLease = null;
         const task = (async () => {
             durationMs = await runTimedRoleRun(signal, usesSlot
                 ? async () => {
-                    // The key is the authoring seam's concurrency key, computed here at admission
-                    // (runConfig applies any budget or model-failure fallback already in force).
-                    const cfg = runner.role === DIRECTOR_ROLE ? null : runner.runConfig(Date.now());
-                    const key = cfg ? seamConcurrencyKey(cfg, piDefault) : undefined;
+                    // The run is admitted by the one team total (maxConcurrent) alone — there is no
+                    // per-provider key or cap any more. Which cap holds the run is always the team
+                    // total.
                     const admittedAt = Date.now();
-                    // Which cap would hold the run, read once at park time (not revised if the caps
-                    // change mid-wait): the run's own provider cap when full, else the team total.
-                    const pool = semaphore.snapshot();
-                    const keyed = key !== undefined ? pool.byKey[key] : undefined;
-                    const providerFull = keyed?.limit !== undefined && keyed.inUse >= keyed.limit;
-                    const heldBy = providerFull
-                        ? { cap: "provider", limit: keyed.limit }
-                        : { cap: "team", limit: pool.limit };
-                    lease = await semaphore.acquireLease(roleTier(runner.role), key);
-                    // A wait of PROVIDER_WAIT_EVENT_MS or more for the provider/team slot is
-                    // provider contention worth surfacing: name it so `tumwater doctor`'s provider
-                    // contention row can sum it and the operator can size maxConcurrentPerProvider
-                    // (or maxConcurrent) from real waits. Best-effort like the launch pass's other
+                    lease = await semaphore.acquireLease(roleTier(runner.role));
+                    // A wait of PROVIDER_WAIT_EVENT_MS or more for the team slot is
+                    // contention worth surfacing: name it so `tumwater doctor`'s provider
+                    // contention row can sum it and the operator can size maxConcurrent from real
+                    // waits. Best-effort like the launch pass's other
                     // events, so an unwritable log never blocks a start; a run admitted at once
                     // stays silent.
                     if (Date.now() - admittedAt >= (ctx.providerWaitMs ?? PROVIDER_WAIT_EVENT_MS)) {
@@ -117,56 +96,45 @@ export function launchDueRuns(ctx) {
                             type: "provider_wait",
                             role: runner.role,
                             waitedMs: Date.now() - admittedAt,
-                            ...(key !== undefined ? { key } : {}),
-                            ...heldBy,
                         });
                     }
                     // Permit granted: the run is now an active, permit-holding state until the
                     // release below. A run the start gate turns away releases within the same
                     // microtask chain, so no poll ever counts it as a permit holder.
                     runner.state.parkedSince = undefined;
-                    runner.state.parkedOn = undefined;
                     rolePermitHolders.add(runner);
                 }
                 : async () => {
-                    // The director wraps its run in a forced lease on its provider key, never
-                    // queuing behind roles: a user prompt starts at once even on a full provider,
-                    // and the key's in-use rises by one — overshooting by one — so no further grant on
-                    // that key happens until its release drains it back under the cap.
-                    const cfg = runner.runConfig(Date.now());
-                    directorLease = semaphore.forceLease(cfg ? seamConcurrencyKey(cfg, piDefault) : undefined);
+                    // The director never queues behind roles: a user prompt starts at once, taking
+                    // no semaphore permit (never counting toward maxConcurrent).
                 }, usesSlot
                 ? () => {
                     rolePermitHolders.delete(runner);
                     lease.release();
                 }
-                : () => {
-                    directorLease.release();
-                }, async () => {
+                : () => { }, async () => {
                 started = true;
                 // A role run that starts while the budget holds uses the fallback pair its tier
-                // resolved to (the gate's per-tier view was installed in its config), or — when a
-                // model-fallback episode is active — on the tier's model-fallback pair, which can
-                // differ from the budget pair. Its outcome is the evidence for the pair it ACTUALLY
-                // ran on, so read it from runConfig (config + episode), never from configForRole
-                // alone: a per-pair breaker fed a fallback run under the primary's name would
-                // misprice a healthy pair and miss a dead one (PLANS.md "Model failure fallback,
-                // part 1/2").
-                const now = Date.now();
-                const cfg = runner.role === DIRECTOR_ROLE ? null : runner.runConfig(now);
+                // resolved to (the gate's per-tier view was installed in its config). Its outcome
+                // is the evidence for the pair it ACTUALLY ran on, so read it from the runner's
+                // resolved config (runConfig), which names the budget-fallback pair when a cap
+                // episode is active: a per-pair breaker fed a fallback run under the primary's
+                // name would misprice a healthy pair and miss a dead one (PLANS.md "Mixed claude +
+                // pi fleets, part 2/4").
+                const cfg = runner.role === DIRECTOR_ROLE ? null : runner.runConfig();
                 // The breaker is keyed by the seam that ran (seamHoldKey), like the run pair and
                 // the team-hold stamps (PLANS.md "Mixed claude + pi fleets, part 2/4"): a claude
                 // fallback run demotes the `claude/<model>` breaker entry, never `?/…`.
-                const ranPair = (budgetActive || windowMovedRoles.has(runner.role)) && cfg?.model !== undefined
+                const ranPair = budgetActive && cfg?.model !== undefined
                     ? modelPairName({ provider: seamHoldKey(cfg), model: cfg.model })
                     : null;
                 const ranOn = ranPair !== null ? gateStates.budget.breakers[ranPair] : undefined;
-                // The run's lease rides in the provider-lease store for the length of the run, so
-                // every agent run it makes re-keys it to the provider that agent run actually uses
-                // (plans/provider-concurrency.md §5) — a budget or model-failure switch that moves an
-                // agent run to another provider mid-run moves the lease with it. The director's forced
-                // lease re-keys the same way, and its rekey never waits.
-                const outcome = await withProviderLease(runner.role === DIRECTOR_ROLE ? directorLease : lease, semaphore, () => runner.run(), { piDefault });
+                // The run's lease rides in the run-permit store for the length of the run, so an
+                // idle wait inside it (a failed review's in-place retry pause) can hand the team
+                // permit back and re-take it before the next attempt. The director holds no lease.
+                const outcome = usesSlot
+                    ? await withRunPermit(lease, () => runner.run())
+                    : await runner.run();
                 if (ranPair !== null && ranOn !== undefined) {
                     const at = breakerNow();
                     const evidence = outcome.recoveredLeftover ? "skipped" : outcome.result;