tumwater 0.4.2 → 0.4.4

package/dist/src/orchestrator/scheduling-scope.js

@@ -6,14 +6,14 @@
  * scope. */
 import { increment } from "../collections.js";
 import { DIRECTOR_ROLE, commitTier } from "../roles/roles.js";
+import { HOUR_MS } from "../text/datetime.js";
 import { baseRoleOf, runnerEnabled, runnerPaused } from "../roles/runner-ids.js";
 import { hasOutstandingWork, saveRunnerStateBestEffort } from "../runner/runner-state.js";
 import { queuedMergeRoles } from "../merge/merge-queue.js";
 import { readMergeMarker, mergeChanges } from "../merge/merge-slot.js";
-import { isAfterMergeRole } from "../review/post-merge-review.js";
 import { aheadOfMainBranch, branchExists } from "../git/git.js";
 import { branchName } from "../paths.js";
-import { hasUnmergedPin } from "../runner/leftover.js";
+import { hasUnmergedPin } from "../runner/runner-leftover.js";
 import { logEventBestEffort, warnEventBestEffort } from "../events/events.js";
 import { eligibleEntries } from "../backlog/backlog-eligibility.js";
 import { CLAIM_IDLE_MAX_MS, claimReleaseReason, heldKeys, listedKeys, } from "../scheduling/claims.js";
@@ -31,7 +31,7 @@ export function noteSkip(root, runner, reason) {
  * hasUnmergedPin director pin, the per-base claim-group build (with its claim-release loop,
  * which mutates runner state, persists and logs), and the writing count. */
 export async function buildSchedulingScope(ctx) {
-    const { root, runners, mainBranch, merges, once, now, mainHead, userPaused, quietNow, pausedRoles, capPaused, maintenanceQuota, bootstrapHeld, budgetPausedRoles, probeRoles, reviewStrongPaused, afterMergeRoles, roleQuietHeld, heldProviders, windowHeldProviders, reviewHeld, roleProviders, openBugsNow, workBacklogOpen, planBacklogFull, holdForRestart, diskHeld, deferredDue, workMergedSince, } = ctx;
+    const { root, runners, mainBranch, merges, once, now, mainHead, userPaused, quietNow, pausedRoles, capPaused, maintenanceQuota, bootstrapHeld, budgetPausedRoles, probeRoles, roleQuietHeld, heldProviders, windowHeldProviders, roleProviders, openBugsNow, workBacklogOpen, planBacklogFull, holdForRestart, diskHeld, deferredDue, workMergedSince, } = ctx;
     // Merge-queue interlock data, listed ONCE per poll (was once per runner per poll — each
     // queuedMergeFiles() re-lists the merge-queue directory and re-stats every queued entry): the
     // check below only asks whether the runner's role has a queued entry. The queue changes
@@ -43,23 +43,22 @@ export async function buildSchedulingScope(ctx) {
     // clock, since its only other run is an operator prompt. A queued or in-flight pin is the
     // merge-queue interlock's to hold, so the leftover reason is not offered then.
     const pinnedDirector = !queuedRoles.has(DIRECTOR_ROLE) && (await hasUnmergedPin(root, DIRECTOR_ROLE));
-    // Merge-queue interlock relief (parts 1-3/4): for a post-merge-review role — one whose own
-    // config `review.afterMerge` names it — the queued/in-flight interlock is scoped to the stages
-    // that actually race the author's branch. `interlockedHold` holds exactly the QUEUED post-merge
-    // roles in a non-admissible stage: pre-approval (`verifying`, or queued but not yet picked up —
-    // absent from the pipeline's approved/merge sets), conflict resolution (`resolve-wait`/
-    // `resolving`, read from the live marker), or a branch already ahead of main (a prior relief
-    // run's held commit). An approved-and-waiting or in-flight-merge queued change no longer parks
-    // the author. Pre-merge-review roles keep the full interlock (their rejection must reach the
-    // runner before it authors again), so they are never added here; scheduling-skip.ts skips a
-    // queued role unless it is BOTH post-merge AND absent from interlockedHold.
+    // Merge-queue interlock relief (parts 1-3/4): the queued/in-flight interlock is scoped to
+    // the stages that actually race the author's branch. `interlockedHold` holds exactly the
+    // QUEUED roles in a non-admissible stage: pre-approval (`verifying`, or queued but not yet
+    // picked up — absent from the pipeline's approved/merge sets), conflict resolution
+    // (`resolve-wait`/`resolving`, read from the live marker), or a branch already ahead of main
+    // (a prior relief run's held commit). An approved-and-waiting or in-flight-merge queued
+    // change no longer parks the author. The relief applies team-wide — no role waits on a
+    // reviewer — so every queued role is held only while it is in interlockedHold;
+    // scheduling-skip.ts skips a queued role unless it is absent from that set.
     const interlockedHold = new Set();
     if (queuedRoles.size > 0) {
         const marker = readMergeMarker(root);
         const markerChanges = marker ? mergeChanges(marker) : [];
         for (const runner of runners) {
             const role = runner.role;
-            if (!queuedRoles.has(role) || !isAfterMergeRole(runner.config, role))
+            if (!queuedRoles.has(role))
                 continue;
             const inApproved = merges.approved.has(role);
             const inMerge = (merges.merge?.roles ?? []).includes(role);
@@ -133,7 +132,7 @@ export async function buildSchedulingScope(ctx) {
             const reason = released;
             logEventBestEffort(root, { source: r.role, type: "claim", action: "released", title, reason });
             if (reason === "stale") {
-                warnEventBestEffort(root, r.role, `released "${title}", which a stopped instance was working on (idle ${Math.round(CLAIM_IDLE_MAX_MS / 3_600_000)}h)`);
+                warnEventBestEffort(root, r.role, `released "${title}", which a stopped instance was working on (idle ${Math.round(CLAIM_IDLE_MAX_MS / HOUR_MS)}h)`);
             }
         }
         claimGroups.set(base, {
@@ -151,15 +150,10 @@ export async function buildSchedulingScope(ctx) {
     // The per-role windows (quietHoursPerRole) fold in beside the team one as a fourth
     // disjunct — a role held by either window (or both, held once) starts no new runs;
     // the director stays exempt by the same role check that covers the other disjuncts.
-    // The budget hold, per role (part 5c/8): a tier that resolved to pause holds its own roles,
-    // and — with review on — an unresolvable strong tier holds every role a pre-merge review
-    // gates (nothing could merge) — except a role on `review.afterMerge`, whose review runs
-    // after merging, so it keeps authoring. The probe of a demoted pair pierces the hold for
-    // EXACTLY the probed pair's tier's roles: the earlier draft's pair-blind pierce lifted the
-    // pause team-wide on any due probe.
-    const budgetHolds = (role) => (budgetPausedRoles.has(role) ||
-        (reviewStrongPaused && !afterMergeRoles.has(baseRoleOf(role)))) &&
-        !probeRoles.has(role);
+    // The budget hold, per role (part 5c/8): a tier that resolved to pause holds its own
+    // roles. The probe of a demoted pair pierces the hold for EXACTLY the probed pair's tier's
+    // roles: the earlier draft's pair-blind pierce lifted the pause team-wide on any due probe.
+    const budgetHolds = (role) => budgetPausedRoles.has(role) && !probeRoles.has(role);
     const operatorPauseBlocks = (role) => (userPaused || quietNow || roleQuietHeld.has(role) || budgetHolds(role)) &&
         role !== DIRECTOR_ROLE;
     // Fresh operator demand: a queued prompt or a wake newer than the role's last run end. The
@@ -213,12 +207,9 @@ export async function buildSchedulingScope(ctx) {
         bootstrapHeld,
         budgetPausedRoles,
         probeRoles,
-        reviewStrongPaused,
-        afterMergeRoles,
         roleQuietHeld,
         heldProviders,
         windowHeldProviders,
-        reviewHeld,
         roleProviders,
         openBugsNow,
         workBacklogOpen,

package/dist/src/orchestrator/scheduling-skip.js

@@ -1,11 +1,10 @@
 import { logEventBestEffort } from "../events/events.js";
 import { baseRoleOf, configuredInstances, runnerPaused } from "../roles/runner-ids.js";
 import { BUGFIX_ROLE, DIRECTOR_ROLE, commitTier } from "../roles/roles.js";
-import { isAfterMergeRole } from "../review/post-merge-review.js";
 import { deferRunReason, isEligible } from "../scheduling/scheduling.js";
 import { inboxSize } from "../inbox/inbox.js";
 import { freshlyWoken } from "../runner/runner-state.js";
-import { MERGE_CONFLICT_LIMIT } from "../runner/leftover.js";
+import { MERGE_CONFLICT_LIMIT } from "../runner/runner-leftover.js";
 import { noteSkip } from "./scheduling-scope.js";
 /** Decide whether this runner is due this poll, running every skip gate and the once/deferral
  * bookkeeping against scheduling-scope.ts's scope. Returns skip:true when a gate declined the
@@ -14,7 +13,7 @@ import { noteSkip } from "./scheduling-scope.js";
  * deferredDue, quotaAdmitted, once-mode settlement — and writes skip reasons as its only
  * side effects. */
 export async function skipRunner(scope, runner) {
-    const { root, once, now, mainHead, pausedRoles, capPaused, holdForRestart, diskHeld, windowHeldProviders, roleProviders, reviewHeld, afterMergeRoles, heldProviders, openBugsNow, workBacklogOpen, planBacklogFull, deferredDue, workMergedSince, queuedRoles, interlockedHold, pinnedDirector, claimGroups, writing, maintenanceQuota, maintenanceQuotaOverLine, bootstrapHeldNow, operatorPauseBlocks, } = scope;
+    const { root, once, now, mainHead, pausedRoles, capPaused, holdForRestart, diskHeld, windowHeldProviders, roleProviders, heldProviders, openBugsNow, workBacklogOpen, planBacklogFull, deferredDue, workMergedSince, queuedRoles, interlockedHold, pinnedDirector, claimGroups, writing, maintenanceQuota, maintenanceQuotaOverLine, bootstrapHeldNow, operatorPauseBlocks, } = scope;
     // The role's inbox size and operator demand, computed once per runner per poll: every
     // consumer below (the holds, isEligible's inbox count, the maintenance admission) shares
     // this one directory listing + per-file stat read instead of each re-scanning the queue.
@@ -73,10 +72,8 @@ export async function skipRunner(scope, runner) {
     // re-queue every poll until the repeated-failure pause stops it.
     if (runner.role === DIRECTOR_ROLE && windowHeldProviders.has(roleProviders.get(runner.role)))
         return { skip: true };
-    if (runner.role !== DIRECTOR_ROLE &&
-        (heldProviders.has(roleProviders.get(runner.role)) ||
-            (reviewHeld && !afterMergeRoles.has(baseRoleOf(runner.role)))))
-        return { skip: true }; // nor while ITS provider's failure storm holds — or the reviewer's, which a pre-merge review gates (a review.afterMerge role is exempt)
+    if (runner.role !== DIRECTOR_ROLE && heldProviders.has(roleProviders.get(runner.role)))
+        return { skip: true }; // nor while ITS provider's failure storm holds — the reviewer's hold parks only the post-merge review queue, never a role start
     // The role's OWN queue decides inbox due-ness: the director counts its historical
     // inbox, every other role its per-role queue (tumwater prompt --role <id>) — so a
     // queued prompt makes its role due by itself, no wake marker needed (isEligible).
@@ -113,14 +110,13 @@ export async function skipRunner(scope, runner) {
     // results — but the merge's outcome replaces it before the interlock lets the role back into
     // this pass), and skipping here saves that branch's workMergedSince git-range query for the
     // skipped role.
-    // Interlock relief (parts 1-3/4): a post-merge-review role (its own config `review.afterMerge`
-    // names it) with a queued change is held only while it is in a non-admissible stage — the
-    // pre-approval/conflict/branch-ahead holds buildSchedulingScope put in `interlockedHold` — and
-    // otherwise falls through to author (the merge no longer parks it). A pre-merge-review role,
-    // and a post-merge role still in a held stage, keep the full interlock: their rejection must
-    // reach the runner before it authors again.
+    // Interlock relief (parts 1-3/4): a queued role is held only while it is in a non-admissible
+    // stage — the pre-approval/conflict/branch-ahead holds buildSchedulingScope put in
+    // `interlockedHold` — and otherwise falls through to author (the merge no longer parks it).
+    // A role still in a held stage keeps the full interlock: its rejection must reach the runner
+    // before it authors again. The relief now applies team-wide: no role waits on a reviewer.
     if (queuedRoles.has(runner.role)) {
-        if (!isAfterMergeRole(runner.config, runner.role) || interlockedHold.has(runner.role)) {
+        if (interlockedHold.has(runner.role)) {
             noteSkip(root, runner, undefined);
             return { skip: true };
         }

package/dist/src/orchestrator/startup-migrations.js

@@ -1,5 +1,5 @@
 import { logEvent, TUMWATER_SOURCE, warnEventBestEffort } from "../events/events.js";
-import { orchestratorAlive } from "../team/orchestrator-info.js";
+import { orchestratorAlive } from "../team/team-orchestrator-info.js";
 import { errorMessage } from "../text/text.js";
 const registry = [];
 /** Append one step to the registry; a duplicate name throws. */

package/dist/src/paths.js

@@ -36,7 +36,8 @@ export function configLockPath(root) {
 }
 /** The cross-process lock serializing writes to the primary checkout's tracked backlog files:
  * `tumwater bug`/`plan` (backlog-write.ts's appendEntry) and `tumwater questions answer`
- * (backlog/question-answer.ts's tryAnswerQuestion) each read a whole backlog file and rewrite
+ * (src/backlog/backlog-question-answer.ts's tryAnswerQuestion) each read a whole backlog file and
+ * rewrite
  * it, while a merge's working-tree fast-forward (merge-git.ts's ffMainTo) updates those
  * same files in
  * the same checkout by `git merge --ff-only`. Without a shared lock the CLI's stale read can
@@ -119,7 +120,7 @@ export function worktreeUseLockPath(root) {
     return path.join(tumwaterDir(root), "state", "worktree-use.lock");
 }
 /** The orchestrator's own info file (its pid, for liveness checks —
- * team/orchestrator-info.ts). */
+ * team/team-orchestrator-info.ts). */
 export function orchestratorStatePath(root) {
     return path.join(tumwaterDir(root), "state", "orchestrator.json");
 }
@@ -163,8 +164,8 @@ export function roleNotesPath(root, role) {
 export function mergeStatePath(root) {
     return path.join(tumwaterDir(root), "state", "merging.json");
 }
-/** Merged commits awaiting their review after merging (src/review/post-merge-review.ts), for roles
- * listed in `review.afterMerge`: `{ pending: PostReview[] }`. Runtime state, never committed. */
+/** Merged commits awaiting their review after merging (src/review/post-merge-review.ts):
+ * `{ pending: PostReview[] }`. Runtime state, never committed. */
 export function postReviewPath(root) {
     return path.join(tumwaterDir(root), "state", "post-review.json");
 }
@@ -286,7 +287,7 @@ export function piLogPath(root, role) {
 /** A role's backend-native stdout log (.tumwater/log/<role>.<backend>.native.jsonl), written
  * beside the canonical raw log and kept for debugging only: no reader folds it, and the backend
  * is in the name because one role's runs may switch backends and the two dialects must not
- * mix. Written and rotated like the raw log (src/agent/run-agent.ts). */
+ * mix. Written and rotated like the raw log (src/agent/agent-run.ts). */
 export function nativeLogPath(root, role, backend) {
     return path.join(tumwaterDir(root), "log", `${role}.${backend}.native.jsonl`);
 }
@@ -307,7 +308,7 @@ export function sessionDir(root, role) {
     return path.join(sessionsRootDir(root), role);
 }
 /** `sessionDir`'s real team root — the nearest ancestor holding a `.tumwater` directory — or
- * undefined when none does. run-spawn installs the notes shim from THIS (never from teamRootOf,
+ * undefined when none does. agent-spawn installs the notes shim from THIS (never from teamRootOf,
  * whose no-ancestor fallback can be a shared directory): writing `.tumwater` at the fallback
  * would mint a phantom harness root every other suite on the host then found — BUGS.md
  * 2026-10-18's `$TMPDIR/.tumwater/bin/tumwater-notes`. */
@@ -341,15 +342,15 @@ export function owningTeamRoot(dir) {
  * unreachable in a harness run and used only by OpenCode's harness-only read-back lookups
  * (opencodeDbPath, loadConfigSafe), which always see a real root. Never use this to decide
  * where to WRITE a `.tumwater`: the fallback can be a shared directory, and creating `.tumwater`
- * there mints a phantom root (BUGS.md 2026-10-18); run-spawn's shim install uses
+ * there mints a phantom root (BUGS.md 2026-10-18); agent-spawn's shim install uses
  * nearestTumwaterRoot instead. Moved here from the opencode adapter (plans/notes-command.md) so
- * run-spawn's shim install — which every backend's run needs — shares the one lookup instead of
+ * agent-spawn's shim install — which every backend's run needs — shares the one lookup instead of
  * the opencode adapter keeping it private. */
 export function teamRootOf(sessionDir) {
     return nearestTumwaterRoot(sessionDir) ?? path.dirname(path.dirname(sessionDir));
 }
 /** The directory the notes shim lands in, under a team root: `<root>/.tumwater/bin`.
- * run-spawn installs the `tumwater-notes` command there (src/agent/notes-shim.ts) and
+ * agent-spawn installs the `tumwater-notes` command there (src/agent/notes-shim.ts) and
  * run-marker's backendBaseEnv prepends it to every run's PATH, so a run on any backend finds
  * the command (plans/notes-command.md "Reaching it from a run"). */
 export function notesShimDir(root) {

package/dist/src/pi/pi-args.js

@@ -1,6 +1,6 @@
 /** Building the pi command line for one run — pure argv construction with no subprocess or
  * file I/O. Split out of pi.ts; the child-process integration (runPi) now lives in
- * src/agent/run-agent.ts and the run's result types in src/pi/pi-run-result.ts, while
+ * src/agent/agent-run.ts and the run's result types in src/pi/pi-run-result.ts, while
  * test/pi-args.test.ts pins how config and session choices shape the command line. */
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -10,7 +10,9 @@ import { fileURLToPath } from "node:url";
  * context-budget appends its context-usage note to the (already bounded) result that crosses a
  * threshold, strip-thinking drops the model's replayed thinking from each request on a
  * small-window chat-completions model, trim-system-prompt drops pi's docs section from the
- * system prompt, and write-guard refuses an edit or write outside the run's worktree. Notes ride
+ * system prompt, and write-guard refuses an edit or write outside the run's worktree, while
+ * kill-guard refuses a bash call that kills processes by pattern (pkill/killall and ps/pgrep fed
+ * into kill). Notes ride
  * the `tumwater-notes` command on
  * every backend from part 2/4 on, so the role-notes extension is no longer bundled. */
 export function bundledExtensionPaths() {
@@ -21,6 +23,7 @@ export function bundledExtensionPaths() {
         "strip-thinking.js",
         "trim-system-prompt.js",
         "write-guard.js",
+        "kill-guard.js",
     ].map((file) => fileURLToPath(new URL(`../pi-extension/${file}`, import.meta.url)));
 }
 /** pi 1.2.0's built-in extensions other than `mcp`, read from pi's own `dist/extensions/index.js`.

package/dist/src/pi/pi-backend.js

@@ -1,8 +1,8 @@
 /** The pi adapter for the agent seam (plans/agent-backends.md "The seam"). Every piece here
  * is today's pi-specific behavior moved behind the `AgentBackend` interface — argv via
  * pi-args, the identity translator (pi's event vocabulary IS the canonical stream), the
- * stderr exit rules, and the model-fallback-clone warning — so src/agent/run-agent.ts stays
- * backend-neutral. The claude adapter registers alongside it in src/agent/run-agent.ts. */
+ * stderr exit rules, and the model-fallback-clone warning — so src/agent/agent-run.ts stays
+ * backend-neutral. The claude adapter registers alongside it in src/agent/agent-run.ts. */
 import { piArgs } from "./pi-args.js";
 import { resolveBinForBackend } from "./pi-bin.js";
 import { backendRunEnv } from "../process/run-marker.js";

package/dist/src/pi/pi-bin.js

@@ -5,8 +5,8 @@ import { envPath, findOnPath, isExecutableFile } from "../files/files.js";
  * resolution `TUMWATER_<ID>_BIN` → `backends.<id>.bin` (pi's legacy `agentBin` alias) → the
  * backends' defaults (plans/agent-backends.md "Config"; plans/portability.md §5/7), the
  * executability rule the preflight askers share, and the missing-binary wording they quote.
- * The spawn (src/agent/run-spawn.ts) resolves through each backend's resolveBin; the startup
- * gate (gates/startup-gate.ts) walks every enabled seam's backend through the same resolution and
+ * The spawn (src/agent/agent-spawn.ts) resolves through each backend's resolveBin; the startup
+ * gate (gates/startup-gates.ts) walks every enabled seam's backend through the same resolution and
  * executability rule, and doctor (doctor/doctor-checks.ts) asks them for every backend in use
  * (backendsInUse, the startup gate's rule). Each surface quotes this module's wording, so the
  * executability verdict and the pi text cannot drift between them. Split out of
@@ -15,7 +15,7 @@ import { envPath, findOnPath, isExecutableFile } from "../files/files.js";
  * layer. */
 const PI_MISSING_MESSAGE = "pi not found on PATH — install it (https://github.com/badlogic/pi-mono) or add its bin directory to your PATH";
 /** The operator-facing name of each source, as it appears in failure text and doctor's
- * report. Exported so src/agent/run-settle.ts's spawn errors and doctor's checks quote the same
+ * report. Exported so src/agent/agent-settle.ts's spawn errors and doctor's checks quote the same
  * string. `binEnv` is the environment variable a backend reads (pi's TUMWATER_PI_BIN by
  * default; claude's adapter passes TUMWATER_CLAUDE_BIN), and `configKey` is the tumwater.json
  * key the "config" source names (pi's legacy `agentBin`, or `backends.<id>.bin`), so a claude

package/dist/src/pi/pi-event-line.js

@@ -1,6 +1,6 @@
 /** Parsing one line of pi's JSONL event stream — pure string functions with no subprocess or file
  * I/O. Split out of pi.ts, whose child-process integration (runPi) now lives in
- * src/agent/run-agent.ts and whose PiStreamParser in pi-stream.ts folds those lines into a run
+ * src/agent/agent-run.ts and whose PiStreamParser in pi-stream.ts folds those lines into a run
  * result — because these are shared
  * by every observer that folds raw pi log lines into per-type state (src/ui/progress-data.ts's live
  * tail, transcript.ts's renderer), and those display modules should not import from the subprocess
@@ -76,6 +76,33 @@ export function messageUpdateHasContent(event) {
         return false;
     return isNonBlankString(update.delta);
 }
+/** Fold one pi event into the pending-reply state and return the new state — the single
+ * definition both observers apply (see PendingReply). An assistant `message_start` opens a
+ * stretch stamped `now`, or counts one more attempt of an open one. A `message_update` whose
+ * delta carries content (`hasContent`: each observer decides for itself whether a delta is worth
+ * parsing) or an assistant `message_end` that did not fail closes it: the model answered. A failed
+ * or aborted end keeps it open, because pi's retry that follows is the same unanswered request. */
+export function foldPendingReply(pending, event, { hasContent = false, now = Date.now() } = {}) {
+    const msg = event.message;
+    switch (event.type) {
+        case "message_start": {
+            if (msg?.role !== "assistant")
+                return pending;
+            if (pending)
+                return { ...pending, attempts: pending.attempts + 1 };
+            const target = [msg.provider, msg.model].filter(isNonBlankString).join("/");
+            return { since: now, target, attempts: 1 };
+        }
+        case "message_update":
+            return hasContent ? undefined : pending;
+        case "message_end":
+            if (msg?.role !== "assistant")
+                return pending;
+            return msg.stopReason === "error" || msg.stopReason === "aborted" ? pending : undefined;
+        default:
+            return pending;
+    }
+}
 /** The call's full raw command text from a tool-execution event's args (bash-like tools name
  * it `command`, some `cmd`; other tools yield ""). The two open-call trackers
  * (src/pi/pi-watchdogs.ts's stall warning, src/ui/progress-data.ts's dashboard flag) store this

package/dist/src/pi/pi-listed-models.js

@@ -1,4 +1,5 @@
 import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
+import { cachedByStat } from "../files/stat-cache.js";
 import { piListedModelsPath } from "../paths.js";
 /** The whitespace-split rows of the table `pi --list-models` prints, header first. Null unless
  * the first non-blank line is the `provider model …` header, so other text (a "No models
@@ -33,8 +34,20 @@ export function parsePiModelImages(stdout) {
     }
     return images;
 }
+/** Per-poll cache of the parsed listing, keyed by file path: the status snapshot reads it once
+ * per poll through collectRoleRows (src/status/status-roles.ts) while the file changes only when
+ * doctor runs `pi --list-models` and rewrites it, so an unchanged file costs one stat per poll
+ * instead of a re-read plus JSON.parse. Any write invalidates via dev/ino/mtime/size
+ * (stat-cache.cachedByStat, same freshness check as the other polled files); a missing or
+ * malformed file yields null and is not cached, so a mid-edit broken file recovers on the next
+ * poll exactly like before. */
+const listedCache = new Map();
 /** The saved listing, or null when the file is missing, torn, or has no `images` object. */
 export function readPiListedModels(root) {
+    return cachedByStat(listedCache, piListedModelsPath(root), // Keyed by path so distinct roots and test files never collide.
+    piListedModelsPath(root), () => readPiListedModelsUncached(root), (listed) => ({ ...listed, images: { ...listed.images } }));
+}
+function readPiListedModelsUncached(root) {
     const saved = readJsonFile(piListedModelsPath(root));
     const images = saved?.images;
     if (typeof images !== "object" || images === null || Array.isArray(images))

package/dist/src/pi/pi-models.js

@@ -3,7 +3,7 @@ import path from "node:path";
 import { enabledRoleIds, loadConfigSafe } from "../config/config.js";
 import { configForRole, resolverConfig, resolvedBackendConfig, reviewConfig } from "../config/config-views.js";
 import { fallbackPair } from "../config/config-fallbacks.js";
-import { seamAgent } from "../config/model-selector.js";
+import { seamAgent } from "../config/config-model-selector.js";
 import { cachedByStat } from "../files/stat-cache.js";
 import { isJsonObject } from "../files/json-object.js";
 import { readJsonFile } from "../files/json-files.js";
@@ -107,40 +107,54 @@ export function seamContextWindow(seam, projectRoot, modelsPath = piModelsPath()
     const backend = seamAgent(seam);
     switch (backend) {
         case "pi":
-            let { provider, model } = seam;
-            if (!provider || !model) {
-                const piDefault = readPiDefaultModel(piSettingsPath(modelsPath), projectRoot);
-                provider = piDefault?.provider;
-                model = piDefault?.model;
-            }
-            return declaredWindow(resolveModelDef(readPiProviders(modelsPath), provider, model)?.contextWindow);
+            return piSeamContextWindow(seam, projectRoot, modelsPath);
         case "opencode":
-            // The models.dev cache (readOpencodeCache, an empty cache when the file is missing) holds
-            // the window part 6a/7 parsed from `limit.context`, keyed by the gateway-qualified id the
-            // run actually invokes (opencodeModelKey) — the same key and entry the free-ness check
-            // prices by, so a seam's window never disagrees with the model it runs.
-            if (seam.model === undefined)
-                return null;
-            return declaredWindow(readOpencodeCache(projectRoot).models[opencodeModelKey(seam.model)]?.context);
+            return opencodeSeamContextWindow(seam, projectRoot);
         case "codex":
-            // The model catalog (codex-catalog.ts) holds the window part 8/9 parsed from
-            // `context_window × effective_context_window_percent / 100`, read from the team's codex
-            // home (backends.codex.configDir) at this project root — the same home the runs use. An
-            // unknown model, an absent home or a missing catalog reads null (declaredWindow's safe
-            // answer for an unknown window).
-            if (seam.model === undefined)
-                return null;
-            {
-                const { config } = loadConfigSafe(projectRoot);
-                const home = codexHome(resolvedBackendConfig(config ?? {}, "codex"));
-                if (home === undefined)
-                    return null;
-                return declaredWindow(readCodexCatalog(home).get(seam.model)?.contextWindow);
-            }
+            return codexSeamContextWindow(seam, projectRoot);
         default:
             return null;
     }
 }
+/** The window a pi seam declares, or null when it cannot be known: reads the pair's
+ * `contextWindow` from pi's models.json, running on pi's saved default
+ * (readPiDefaultModel) when the seam names no provider/model — exactly the model pi will
+ * start on. An unresolvable pair or a missing/unusable window reads null. */
+function piSeamContextWindow(seam, projectRoot, modelsPath) {
+    let { provider, model } = seam;
+    if (!provider || !model) {
+        const piDefault = readPiDefaultModel(piSettingsPath(modelsPath), projectRoot);
+        provider = piDefault?.provider;
+        model = piDefault?.model;
+    }
+    return declaredWindow(resolveModelDef(readPiProviders(modelsPath), provider, model)?.contextWindow);
+}
+/** The window an opencode seam declares, or null when it cannot be known. The models.dev cache
+ * (readOpencodeCache, an empty cache when the file is missing) holds the window part 6a/7
+ * parsed from `limit.context`, keyed by the gateway-qualified id the run actually invokes
+ * (opencodeModelKey) — the same key and entry the free-ness check prices by, so a seam's
+ * window never disagrees with the model it runs. A missing cache, an unknown model or an
+ * unusable `context` reads null. */
+function opencodeSeamContextWindow(seam, projectRoot) {
+    if (seam.model === undefined)
+        return null;
+    return declaredWindow(readOpencodeCache(projectRoot).models[opencodeModelKey(seam.model)]?.context);
+}
+/** The window a codex seam declares, or null when it cannot be known. The model catalog
+ * (codex-catalog.ts) holds the window part 8/9 parsed from
+ * `context_window × effective_context_window_percent / 100`, read from the team's codex home
+ * (backends.codex.configDir) at this project root — the same home the runs use. An unknown
+ * model, an absent home or a missing catalog reads null (declaredWindow's safe answer for an
+ * unknown window). */
+function codexSeamContextWindow(seam, projectRoot) {
+    if (seam.model === undefined)
+        return null;
+    const { config } = loadConfigSafe(projectRoot);
+    const home = codexHome(resolvedBackendConfig(config ?? {}, "codex"));
+    if (home === undefined)
+        return null;
+    return declaredWindow(readCodexCatalog(home).get(seam.model)?.contextWindow);
+}
 /** The resolved primary seam's declared context window for a role — `configForRole` resolves
  * the role's seam (the view the role page, status table/drawer and run history all print), then
  * `seamContextWindow` names the window that seam declares, or null when it cannot be known. The

package/dist/src/pi/pi-settings.js

@@ -50,37 +50,60 @@ export function readPiDefaultModel(settingsPath, projectRoot) {
     return cachedByStat(settingsCache, settingsPath, // Keyed by path so distinct roots and test files never collide.
     settingsPath, () => readPiDefaultModelUncached(settingsPath, projectRoot), (defaultModel) => ({ ...defaultModel }));
 }
-function readPiDefaultModelUncached(settingsPath, projectRoot) {
-    // readJsonFile is the shared "missing or torn reads as no data" policy for a JSON object
-    // file; the nested shapes get the same isJsonObject guard.
-    const doc = readJsonFile(settingsPath);
-    if (!doc)
-        return null;
+/** The saved default pair, or null when either half is missing or empty — pi uses a saved
+ * default only as a pair. */
+function savedDefaultPair(doc) {
     const { defaultProvider, defaultModel } = doc;
     if (typeof defaultProvider !== "string" || defaultProvider === "")
         return null;
     if (typeof defaultModel !== "string" || defaultModel === "")
         return null;
-    if (Array.isArray(doc.enabledModels) && doc.enabledModels.length > 0)
-        return null;
+    return { provider: defaultProvider, model: defaultModel };
+}
+/** Whether pi starts on the first scoped model instead of the saved default — a pattern
+ * tumwater does not resolve, so the reader shows nothing. */
+function startsWithScopedModels(doc) {
+    return Array.isArray(doc.enabledModels) && doc.enabledModels.length > 0;
+}
+/** Whether the project's own `.pi/settings.json` names any default key, which makes pi's final
+ * choice depend on whether it trusts the project — unknowable to tumwater, so show nothing. */
+function projectOverridesSavedDefault(projectRoot) {
     // A project-local override that names any default key means pi's final choice depends on
     // whether it trusts the project — unknowable to tumwater, so show nothing.
     const proj = readJsonFile(path.join(projectRoot, ".pi", "settings.json"));
-    if (proj) {
-        for (const key of DEFAULT_KEYS) {
-            if (proj[key] !== undefined)
-                return null;
-        }
+    if (!proj)
+        return false;
+    for (const key of DEFAULT_KEYS) {
+        if (proj[key] !== undefined)
+            return true;
     }
-    const key = `${defaultProvider}/${defaultModel}`;
+    return false;
+}
+/** pi's thinking for the pair: `modelThinkingLevels[key]` first, else `defaultThinkingLevel`. */
+function savedThinkingLevel(doc, key) {
     const levels = doc.modelThinkingLevels;
     const level = isJsonObject(levels) ? levels[key] : undefined;
-    let thinking;
     if (typeof level === "string")
-        thinking = level;
-    else if (typeof doc.defaultThinkingLevel === "string")
-        thinking = doc.defaultThinkingLevel;
+        return level;
+    if (typeof doc.defaultThinkingLevel === "string")
+        return doc.defaultThinkingLevel;
+    return undefined;
+}
+function readPiDefaultModelUncached(settingsPath, projectRoot) {
+    // readJsonFile is the shared "missing or torn reads as no data" policy for a JSON object
+    // file; the nested shapes get the same isJsonObject guard.
+    const doc = readJsonFile(settingsPath);
+    if (!doc)
+        return null;
+    const pair = savedDefaultPair(doc);
+    if (!pair)
+        return null;
+    if (startsWithScopedModels(doc))
+        return null;
+    if (projectOverridesSavedDefault(projectRoot))
+        return null;
+    const thinking = savedThinkingLevel(doc, `${pair.provider}/${pair.model}`);
     return thinking !== undefined
-        ? { provider: defaultProvider, model: defaultModel, thinking }
-        : { provider: defaultProvider, model: defaultModel };
+        ? { provider: pair.provider, model: pair.model, thinking }
+        : { provider: pair.provider, model: pair.model };
 }