tumwater 0.4.2 → 0.4.4

package/dist/src/roles/role-view.js

@@ -19,24 +19,24 @@ import { projectCapHit } from "../budget/budget.js";
 import { yieldMultiplierFor } from "../scheduling/backoff.js";
 import { quietHoursStatus } from "../scheduling/quiet-hours.js";
 import { assembleRunPrompt } from "../run/run-prompt.js";
-import { configForRole, resolvedModelFields, reviewedAfterMerge, reviewRunConfig, roleSeamTier, seamConcurrencyKey } from "../config/config-views.js";
-import { fallbackPair, modelFallbackView } from "../config/config-fallbacks.js";
+import { configForRole, resolvedModelFields, reviewRunConfig, roleSeamTier } from "../config/config-views.js";
+import { fallbackPair } from "../config/config-fallbacks.js";
 import { fallbackModelPair, piModelsPath, seamContextWindowForRole } from "../pi/pi-models.js";
 import { readOpencodeCache } from "../agent/opencode/opencode-catalog.js";
-import { formatModelSelector } from "../config/model-selector.js";
+import { formatModelSelector } from "../config/config-model-selector.js";
 import { roleImageInfo } from "../agent/image-input.js";
 import { readPiListedModels } from "../pi/pi-listed-models.js";
 import { piSettingsPath, readPiDefaultModel } from "../pi/pi-settings.js";
 import { readClaudeAccount } from "../agent/claude/claude-account.js";
-import { readAccount, windowEntries } from "../agent/subscription-account.js";
+import { readAccount } from "../agent/subscription-account.js";
 import { CONFIG_BASENAME, configPath, roleNotesPath } from "../paths.js";
 import { coverageRows, readQaCoverage } from "../run/qa-coverage.js";
 import { filingRows, readFeedbackFilings } from "../run/feedback-filings.js";
-import { readTextOrNull, statOrNull } from "../files/files.js";
+import { readRegularTextOrNull, statOrNull } from "../files/files.js";
 import { eventRole, eventUsage, readEvents } from "../events/event-read.js";
 import { finiteNumber, objectOrEmpty } from "../files/json-object.js";
 import { canonicalRoleId } from "./legacy-role-ids.js";
-import { orchestratorAlive, readOrchestratorInfo } from "../team/orchestrator-info.js";
+import { orchestratorAlive, readOrchestratorInfo } from "../team/team-orchestrator-info.js";
 /** The roles.<base>.<field> value the FILE actually holds, or undefined when the file never
  * set that field. Needed only for the seeded per-role fields: overlayDefaults fills every
  * built-in role's minRunIntervalSeconds from config.ts's catalog, so the merged config cannot
@@ -94,7 +94,6 @@ export function rolePayload(root, typedRole, modelsPath = piModelsPath(), now =
     const account = billingBackend !== undefined ? readAccount(root, billingBackend) : null;
     const info = readOrchestratorInfo(root);
     const chainStep = (orchestratorAlive(root, info) && info?.chain?.[roleSeamTier(cfg, role)]) || null;
-    const billingWindow = account?.billing === "subscription" ? windowEntries(account)[0]?.type : undefined;
     // pi's own saved default for a pi seam that resolves no model, read once beside the models
     // catalog this collector already takes as a seam (piSettingsPath). The config's `thinking`
     // wins over the default's because tumwater passes it to pi as `--thinking`, mirroring the
@@ -103,14 +102,6 @@ export function rolePayload(root, typedRole, modelsPath = piModelsPath(), now =
         effective.provider === undefined &&
         effective.model === undefined;
     const piDefault = runsPiWithoutAModel ? readPiDefaultModel(piSettingsPath(modelsPath), root) : null;
-    // The role's provider key and its cap (plans/provider-concurrency.md §8): the same pure
-    // key the orchestrator's admission resolves for this role, answered from the same
-    // piDefault seam the orchestrator carries, so `tumwater role <id>` names the exact key
-    // whose cap bounds the role. The cap is the map's entry for that key, absent when no
-    // `maxConcurrentPerProvider` map is set or the key has no entry (then the role is bounded
-    // only by the team total, and the cap is omitted).
-    const providerKey = seamConcurrencyKey(effective, piDefault);
-    const providerCap = providerKey !== undefined ? cfg.maxConcurrentPerProvider?.[providerKey] : undefined;
     // The fallback story the operator sees: the declared pair, but the price-resolved pair when
     // one exists (a map with no `default` entry borrows another tier's free pair) and the
     // freeness verdict from the same read. `fallbackFree` false keeps the declared pair visible
@@ -135,9 +126,8 @@ export function rolePayload(root, typedRole, modelsPath = piModelsPath(), now =
     const accounts = (b) => (b === "claude" ? claudeFallbackAccount : null);
     const freeFallback = declaredFallback ? fallbackModelPair(cfg, modelsPath, accounts, opencodeCatalog) : null;
     const fallback = freeFallback ?? declaredFallback;
-    // One state read serves both the model-fallback episode and the next-run preview below.
+    // One state read serves the next-run preview below.
     const state = loadRunnerState(root, role);
-    const episode = state.modelFallback;
     // The role's recent run outcomes, read from the event log (readEvents) so the command
     // answers with the team stopped and never touches live state. readEvents returns the log's
     // newest events in file (chronological) order, so filtering to this role's run_end events
@@ -233,7 +223,7 @@ export function rolePayload(root, typedRole, modelsPath = piModelsPath(), now =
     let noteSavedAt = null;
     if (role !== DIRECTOR_ROLE) {
         const notesPath = roleNotesPath(root, role);
-        const text = readTextOrNull(notesPath);
+        const text = readRegularTextOrNull(notesPath);
         note = text !== null && text.trim() !== "" ? text : null;
         if (note !== null)
             noteSavedAt = statOrNull(notesPath)?.mtimeMs ?? null;
@@ -270,13 +260,9 @@ export function rolePayload(root, typedRole, modelsPath = piModelsPath(), now =
             }
             : {}),
         backend: effective.agent ?? "pi",
-        ...(providerKey !== undefined ? { providerKey } : {}),
-        ...(providerCap !== undefined ? { providerCap } : {}),
         fallback,
         fallbackFree: freeFallback !== null,
-        modelFallback: modelFallbackView(episode, cfg, role),
         ...(account !== null ? { billing: account.billing, billingBackend } : {}),
-        ...(billingWindow !== undefined ? { billingWindow } : {}),
         chainStep,
         ...roleImageInfo(cfg, role, modelsPath, readPiListedModels(root)),
         minRunIntervalSeconds: effective.minRunIntervalSeconds,
@@ -290,15 +276,6 @@ export function rolePayload(root, typedRole, modelsPath = piModelsPath(), now =
         // so the merged cfg tells presence exactly. Resolved through the base role like the
         // instructions and min-run-interval override.
         ...(cfg.roles[base]?.instances !== undefined ? { instances: cfg.roles[base].instances } : {}),
-        // Whether the review gate reviews this role's commits after they merge — the role page's
-        // `- Review: after merge` line. Present only while review is enabled and review.afterMerge
-        // lists the role's base id, so a pre-merge-reviewed role or a gate-off config leaves the
-        // payload (and its render) unchanged.
-        ...(cfg.review.enabled && reviewedAfterMerge(cfg, role) ? { reviewedAfterMerge: true } : {}),
-        // Whether the review gate is on at all (review.enabled !== false) — the gate toggle's
-        // presence, distinct from reviewedAfterMerge's membership, so a before-merge-reviewed role
-        // still gets the drawer's Review control while the gate runs.
-        ...(cfg.review.enabled ? { reviewEnabled: true } : {}),
         // The roles.<base>.instructions override verbatim — resolved through the base role like
         // the cap and quiet hours, so an instance id shows (and can edit) the override its runs
         // carry (run-prompt reads config.roles[base]); null when unset.
@@ -334,8 +311,8 @@ export function rolePayload(root, typedRole, modelsPath = piModelsPath(), now =
             preview: true,
         })?.prompt ?? null,
         // The role's schedule — surfaced read-only from the same persisted state rolePayload
-        // already loaded for the model-fallback episode and the next-run preview, so no new
-        // read path exists and the collector stays one loadRunnerState per role. `lastRunEndedAt`
+        // already loaded for the next-run preview, so no new read path exists and the collector
+        // stays one loadRunnerState per role. `lastRunEndedAt`
         // is omitted (JSON unchanged) until the role has actually run.
         nextRunAt: state.nextRunAt,
         backoffSeconds: state.backoffSeconds,

package/dist/src/run/acceptance-greps.js

@@ -39,56 +39,99 @@ export function emptyGrepCriteria(body) {
  * shell syntax (an unquoted `|;&<>$()` or backtick) or leaves a quote open. Nothing runs through
  * a shell, so `*` stays literal. */
 export function grepArgv(cmd) {
-    const words = [];
-    let cur = "";
-    let inWord = false;
-    let quote = null;
-    for (let i = 0; i < cmd.length; i++) {
-        const c = cmd[i];
-        if (quote === "'") {
-            if (c === "'")
-                quote = null;
-            else
-                cur += c;
-        }
-        else if (quote === '"') {
-            const next = cmd[i + 1];
-            if (c === "\\" && (next === '"' || next === "\\")) {
-                cur += next;
-                i++;
-            }
-            else if (c === '"')
-                quote = null;
-            else
-                cur += c;
-        }
-        else if (c === "'" || c === '"') {
-            quote = c;
-            inWord = true;
-        }
-        else if (c === "\\") {
-            if (i + 1 < cmd.length)
-                cur += cmd[++i];
-            inWord = true;
-        }
-        else if (/[|;&<>$()`]/.test(c)) {
-            return undefined;
-        }
-        else if (/\s/.test(c)) {
-            if (inWord)
-                words.push(cur);
-            cur = "";
-            inWord = false;
+    const words = splitShellWords(cmd);
+    return words === undefined ? undefined : grepInvocation(words);
+}
+/** Take one character at `i` inside a single-quoted run (`s.quote === "'"`): a `'` closes the
+ * quote, anything else stays literal. Returns the index after the character. Inside single
+ * quotes everything is literal. */
+function takeSingleQuoted(cmd, i, s) {
+    const c = cmd[i];
+    if (c === "'")
+        s.quote = null;
+    else
+        s.cur += c;
+    return i + 1;
+}
+/** Take one character at `i` inside a double-quoted run (`s.quote === '"'`): a `\\`-escaped
+ * `"` or `\\` appends the escaped character and consumes two characters, a `"` closes the
+ * quote, anything else stays literal. Returns the index after the consumed character(s). Double
+ * quotes honour only `\"` and `\\`. */
+function takeDoubleQuoted(cmd, i, s) {
+    const c = cmd[i];
+    const next = cmd[i + 1];
+    if (c === "\\" && (next === '"' || next === "\\")) {
+        s.cur += next;
+        return i + 2;
+    }
+    if (c === '"')
+        s.quote = null;
+    else
+        s.cur += c;
+    return i + 1;
+}
+/** Take one character at `i` outside any quote, or return `undefined` when it is refused shell
+ * syntax: an unquoted `'`/`"` opens the quote and marks a word, an unquoted `\\` appends the
+ * next character (if any) and marks a word, an unquoted `|;&<>$()` or backtick refuses the
+ * command, whitespace ends a word (pushing `cur` when one is open) and resets the buffer, and
+ * anything else appends and marks a word. Returns the index after the consumed character(s), or
+ * `undefined` for the shell refusal. */
+function takeUnquoted(cmd, i, s) {
+    const c = cmd[i];
+    if (c === "'" || c === '"') {
+        s.quote = c;
+        s.inWord = true;
+        return i + 1;
+    }
+    if (c === "\\") {
+        if (i + 1 < cmd.length) {
+            s.cur += cmd[i + 1];
+            s.inWord = true;
+            return i + 2;
         }
+        s.inWord = true;
+        return i + 1;
+    }
+    if (/[|;&<>$()`]/.test(c))
+        return undefined;
+    if (/\s/.test(c)) {
+        if (s.inWord)
+            s.words.push(s.cur);
+        s.cur = "";
+        s.inWord = false;
+        return i + 1;
+    }
+    s.cur += c;
+    s.inWord = true;
+    return i + 1;
+}
+/** Walk the whole command, dispatching each character to the quote-aware helper, and reject an
+ * unterminated quote. Returns the word list. */
+function splitShellWords(cmd) {
+    const s = { words: [], cur: "", inWord: false, quote: null };
+    let i = 0;
+    while (i < cmd.length) {
+        if (s.quote === "'")
+            i = takeSingleQuoted(cmd, i, s);
+        else if (s.quote === '"')
+            i = takeDoubleQuoted(cmd, i, s);
         else {
-            cur += c;
-            inWord = true;
+            const next = takeUnquoted(cmd, i, s);
+            if (next === undefined)
+                return undefined;
+            i = next;
         }
     }
-    if (quote !== null)
+    if (s.quote !== null)
         return undefined;
-    if (inWord)
-        words.push(cur);
+    if (s.inWord)
+        s.words.push(s.cur);
+    return s.words;
+}
+/** The shape pick: what invocation does this word list name? `git grep …` gives file `git` and
+ * the args after `git`; `grep …` gives file `grep` and the args after `grep`; anything else is
+ * not a grep we run. */
+function grepInvocation(words) {
     if (words[0] === "git" && words[1] === "grep")
         return { file: "git", args: words.slice(1) };
     if (words[0] === "grep")

package/dist/src/run/ci-parity.js

@@ -13,6 +13,7 @@
 import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
 import { ciParityPath } from "../paths.js";
 import { isJsonObject } from "../files/json-object.js";
+import { cachedByStat } from "../files/stat-cache.js";
 import { currentBranchFromHeadFile, readBranchHead, targetBranch } from "../git/git.js";
 import { DAY_MS } from "../text/datetime.js";
 import * as crypto from "node:crypto";
@@ -54,18 +55,28 @@ export function readCiParity(root) {
 export function recordParity(root, sha, result, now = Date.now()) {
     writeJsonAtomic(ciParityPath(root), { parity: { tip: sha, lockHash: lockHashOf(root), result, lastRunAt: now } });
 }
+// Stat-keyed cache (stat-cache.cachedByStat) for the lock hash: the status snapshot and
+// doctor poll it, and package-lock.json is a multi-ten-KB file that changes only on a
+// dependency edit, so an unchanged lock serves the hash from one stat instead of re-reading
+// and re-hashing the whole file every poll — the same stat-keyed contract every other
+// per-poll snapshot reader uses. Any write invalidates via dev/ino/mtime/size (the standard
+// freshness check); bounded inside cachedByStat.
+const lockHashCache = new Map();
 /** The hash of `package-lock.json` at `root` itself — what the current tree carries. An
  * empty string when the file is missing (or unreadable) reads as an unmatched hash, so a
  * swing to "no lock file" renders stale rather than pretending nothing moved. */
 export function lockHashOf(root) {
-    let file;
-    try {
-        file = fs.readFileSync(path.join(root, "package-lock.json"), "utf8");
-    }
-    catch {
-        return "";
-    }
-    return crypto.createHash("sha256").update(file).digest("hex");
+    const file = path.join(root, "package-lock.json");
+    return (cachedByStat(lockHashCache, file, file, () => {
+        let text;
+        try {
+            text = fs.readFileSync(file, "utf8");
+        }
+        catch {
+            return null; // Missing or unreadable reads as an unmatched hash (a cache miss).
+        }
+        return crypto.createHash("sha256").update(text).digest("hex");
+    }, (hash) => hash) ?? "");
 }
 /** The current main tip and lock hash, resolved synchronously from the ref files and the
  * working tree (mirroring status-polls.ts's per-poll read: readBranchHead + targetBranch, no

package/dist/src/run/run-apply.js

@@ -46,7 +46,7 @@ export const ERROR_STREAK_WARN = 3;
 export function errorStreakAtWarn(s) {
     return (s.consecutiveErrors ?? 0) >= ERROR_STREAK_WARN;
 }
-/** Consecutive failed runs after which the error-streak circuit breaker (src/gates/streak-gate.ts)
+/** Consecutive failed runs after which the error-streak circuit breaker (src/gates/streak-gates.ts)
  * auto-pauses the role through the per-role pause marker — the same act-on-it escalation the
  * budget gate and the pause gates perform, applied to a role failing on its own cause. Ten,
  * not the warn bar: at 3 the failure is diagnosed but possibly transient, and by run 4 the
@@ -68,6 +68,13 @@ export const CUT_OFF_RESUME_LIMIT = 3;
  * consumed 44% of the team over two days). Mirrors CUT_OFF_RESUME_LIMIT; the streak itself
  * keeps counting (RunnerState.quietKillStreak) so one warning per episode can be raised. */
 export const QUIET_KILL_RESUME_LIMIT = 3;
+/** Bump a streak counter to `current + 1` when `hit`, and reset it to 0 otherwise — the one
+ * home of the cut-off, quiet-kill and no-change streaks' shared shape in applyRunOutcome, so
+ * the three count identically. (The consecutive-error streak does NOT share it: it resumes
+ * from a `queued`-ended run rather than resetting, so it keeps its own longer arm.) */
+function bumpOrResetStreak(current, hit) {
+    return hit ? (current ?? 0) + 1 : 0;
+}
 /** Record a finished run on the role's state and schedule its next run from the outcome.
  * Split out of RoleRunner.run() (runner.ts) so the scheduling policy — which outcomes retry
  * promptly, which back off and on which ladder, how cut-off resumes are bounded — sits with
@@ -78,11 +85,10 @@ export const QUIET_KILL_RESUME_LIMIT = 3;
 export function applyRunOutcome(s, cfg, role, outcome) {
     s.running = false;
     s.parkedSince = undefined;
-    s.parkedOn = undefined;
     // The cut-off streak counts EVERY consecutive run truncated at the context ceiling, past the
     // resume limit too: the next fresh run's prompt names how many attempts the window has eaten
     // (buildCutOffNote), so the count must not freeze at the limit. Any other outcome resets it.
-    s.cutOffStreak = outcome.cutOff ? (s.cutOffStreak ?? 0) + 1 : 0;
+    s.cutOffStreak = bumpOrResetStreak(s.cutOffStreak, outcome.cutOff);
     // The error streak counts consecutive failed runs; any other result resets it
     // (BUGS.md 2026-09-15: 44 identical failures raised no alarm). A run whose leftover
     // recovery re-queued a pin its last merge failed counts too, even though the run
@@ -106,7 +112,7 @@ export function applyRunOutcome(s, cfg, role, outcome) {
     // The quiet-kill streak counts consecutive watchdog kills; any other result resets it.
     // run-finalize.ts warns once when it crosses QUIET_KILL_RESUME_LIMIT, and the branch below uses
     // it to bound how many times a starved session is resumed (BUGS.md 2026-09-18).
-    s.quietKillStreak = outcome.result === "quiet_killed" ? (s.quietKillStreak ?? 0) + 1 : 0;
+    s.quietKillStreak = bumpOrResetStreak(s.quietKillStreak, outcome.result === "quiet_killed");
     // The no-change streak counts consecutive completed runs that ended `no_change` (the
     // resting state cell's ` · no change ×N` suffix — status-model.ts rolePhase). Any other
     // completed result resets it, so a role that merges between no-ops never shows a stale
@@ -115,7 +121,7 @@ export function applyRunOutcome(s, cfg, role, outcome) {
     // `quiet_killed`/`user_aborted` all reset it and only a `no_change` run grows it.
     // Observational only — never warns, unlike the error/quiet-kill streaks: a legitimately
     // idle maintenance role with an empty backlog can hold a long streak and that is expected.
-    s.noChangeStreak = outcome.result === "no_change" ? (s.noChangeStreak ?? 0) + 1 : 0;
+    s.noChangeStreak = bumpOrResetStreak(s.noChangeStreak, outcome.result === "no_change");
     // The yield ring records the result beside the streaks: a merge or a counted empty
     // stretches the role's min-run gap (yieldMultiplier, read by isEligible), an error-class
     // result is skipped entirely — no evidence either way (yield-scaled clocks, PLANS.md).
@@ -156,10 +162,6 @@ export function applyRunOutcome(s, cfg, role, outcome) {
         // (`result !== "aborted"`) covers both.
         if (outcome.result === "changed")
             s.commits += 1;
-        // A merged change's patch-id approval has done its job: the same patch authored again
-        // later (after a revert, say) is a new change and gets its own review.
-        if (outcome.result === "changed")
-            s.approvedPatchIds = undefined;
         // The role committed new work, so the note about its discarded change has been delivered.
         s.conflictDiscard = undefined;
         s.backoffSeconds = 0;
@@ -304,7 +306,6 @@ export function applyMergeOutcome(s, result, change) {
         // merge, like a no_change run, leaves the prior value standing (PLANS.md "Each loop's
         // last-landed age").
         s.lastMergedAt = Date.now();
-        s.approvedPatchIds = undefined; // see applyRunOutcome
         // A merge supersedes a stale rejection: a model-reviewed merge has already overwritten
         // lastReview with its approve, but a review-exempt (or review-disabled) merge records no
         // verdict, so a stale reject would otherwise ride every later run prompt (BUGS.md
@@ -329,11 +330,10 @@ export function applyMergeOutcome(s, result, change) {
         // leave the streak unchanged and keep the fast minimum-interval retry the queued run
         // scheduled. This merge outcome is the accumulation point (the authoring run ends
         // `queued`, which no longer resets the streak, see applyRunOutcome) — the same field the
-        // warn, the breaker (src/gates/streak-gate.ts), and the error-storm observation
+        // warn, the breaker (src/gates/streak-gates.ts), and the error-storm observation
         // (src/team/team-polls.ts) already read. No new machinery, no new constants: the warn
         // bar and the breaker bar are ERROR_STREAK_WARN and ERROR_STREAK_BREAKER themselves.
         if (s.revision === undefined) {
-            s.approvedPatchIds = undefined; // the chain ended: nothing queued is still approved
             s.consecutiveErrors = (s.consecutiveErrors ?? 0) + 1;
             const lastReasons = s.lastReview?.verdict === "reject" || s.lastReview?.verdict === "reverted" ? s.lastReview.reasons : undefined;
             s.lastError = `review rejected: ${firstReason(lastReasons).slice(0, 200)}`;
@@ -369,9 +369,6 @@ export function applyMergeOutcome(s, result, change) {
         s.mergeCheckFailures = undefined;
         s.mergeFlakeExcused = undefined;
     }
-    // A permanent-reviewer-config hold ends with its pin's life: merged, or rejected away.
-    if (changeGone)
-        s.mergeReviewError = undefined;
     // A hand-back ends with its change's life too: once the resolved change merges or is rejected,
     // a later change gets its own one-hand-back budget (PLANS.md "Robust conflict landing, part
     // 2/2"). A merge_conflict keeps it, so the resolved change's own cap discard fires.

package/dist/src/run/run-detail-data.js

@@ -46,45 +46,59 @@ export function readRunDetail(root, role, runNumber) {
     // same bound.
     const all = readEvents(root, HISTORY_SCAN_MAX_EVENTS);
     const events = all.filter((e) => e.source === role);
-    // Newest run_start for this role+run: the block's lower bound.
-    let startIdx = -1;
-    for (let i = events.length - 1; i >= 0; i--) {
-        const e = events[i];
-        if (e.type === "run_start" && e.run === runNumber) {
-            startIdx = i;
-            break;
-        }
-    }
+    const startIdx = newestRunStartIndex(events, runNumber);
     if (startIdx < 0) {
         // The start is gone (rotation) or the run never ran. A surviving run_end for the same
         // number still answers — unpaired, undated at the front — else there is no such run here.
-        for (let i = events.length - 1; i >= 0; i--) {
-            const e = events[i];
-            if (e.type === "run_end" && e.run === runNumber)
-                return detailFrom(root, role, runNumber, all, events, [e], e, null);
-        }
+        const loneEnd = newestRunEnd(events, runNumber);
+        if (loneEnd !== null)
+            return detailFrom(root, role, runNumber, all, events, [loneEnd], loneEnd, null);
         return null;
     }
     const start = events[startIdx];
-    // The block's upper bound: the first run_end for this run after the start ends it; a
-    // later run_start (this run's end lost to rotation) closes the block exclusive — the
-    // events after it belong to the next run, not this one. No end and no next start reads as
-    // in flight: everything since the start belongs to the open run.
-    let end = null;
-    let nextStart = null;
+    const { end, nextStart } = runBlockBounds(events, startIdx, runNumber);
+    const block = collectRunBlock(events, startIdx, end, nextStart);
+    return detailFrom(root, role, runNumber, all, events, block, end, start);
+}
+/** The newest run_start for this role+run — the block's lower bound — or -1 when none (the
+ * start rotated out or the run never ran). A backward scan: a counter reset can repeat a run
+ * number, and the operator asking by number means the most recent one. */
+function newestRunStartIndex(events, runNumber) {
+    for (let i = events.length - 1; i >= 0; i--) {
+        const e = events[i];
+        if (e.type === "run_start" && e.run === runNumber)
+            return i;
+    }
+    return -1;
+}
+/** The newest surviving run_end for this role+run, or null. Read only on the no-start path:
+ * the start is gone (rotation) or the run never ran, but a surviving run_end still answers —
+ * unpaired, undated at the front — else there is no such run here. */
+function newestRunEnd(events, runNumber) {
+    for (let i = events.length - 1; i >= 0; i--) {
+        const e = events[i];
+        if (e.type === "run_end" && e.run === runNumber)
+            return e;
+    }
+    return null;
+}
+/** The block's upper bound for the run opened by `startIdx`: the first run_end for this run
+ * after it ends the block; else a later run_start (this run's end lost to rotation) closes it
+ * exclusive — the events after belong to the next run, not this one. Neither afterwards reads
+ * as in flight: everything since the start belongs to the open run. */
+function runBlockBounds(events, startIdx, runNumber) {
     for (let i = startIdx + 1; i < events.length; i++) {
         const e = events[i];
-        if (e.type === "run_end" && e.run === runNumber) {
-            end = e;
-            break;
-        }
-        if (e.type === "run_start") {
-            nextStart = e;
-            break;
-        }
+        if (e.type === "run_end" && e.run === runNumber)
+            return { end: e, nextStart: null };
+        if (e.type === "run_start")
+            return { end: null, nextStart: e };
     }
-    // The block itself: the start event plus everything this role logged up to the bound —
-    // inclusive at a paired end, exclusive at a next run's start.
+    return { end: null, nextStart: null };
+}
+/** The block itself: the start event plus everything this role logged up to the bound —
+ * inclusive at a paired end, exclusive at a next run's start. */
+function collectRunBlock(events, startIdx, end, nextStart) {
     const block = [];
     for (let i = startIdx; i < events.length; i++) {
         const e = events[i];
@@ -92,19 +106,12 @@ export function readRunDetail(root, role, runNumber) {
             break;
         block.push(e);
     }
-    return detailFrom(root, role, runNumber, all, events, block, end, start);
+    return block;
 }
-/** Fill the payload around a collected block: usage from the run_end via eventUsage/usageText,
- * duration via runSpanMs against the role's own start map (the shared pairing helper, so this
- * view and the history rows cannot drift on what a span is), events oldest-first. */
-function detailFrom(root, role, runNumber, all, scoped, block, end, start) {
-    const usageNums = end === null ? { tokens: 0, costUsd: 0 } : eventUsage(end);
-    // The run_end's prompt-token total and its cache-read subset, corrupt-field-guarded reads
-    // (nonNegativeNumber, the same guard peakContextTokens applies) with the cache subset
-    // clamped to the total so the rendered share never exceeds 100%; 0 on an in-flight run.
-    const promptTokens = end === null ? 0 : nonNegativeNumber(end.promptTokens, 0);
-    const cacheReadTokens = end === null ? 0 : Math.min(nonNegativeNumber(end.cacheReadTokens, 0), promptTokens);
-    const preEditPromptTokens = end === null ? 0 : Math.min(nonNegativeNumber(end.preEditPromptTokens, 0), promptTokens);
+/** The verdict a run reports: the `run_end`'s outcome text, resolved through its merge for a
+ * run that ended `queued` (its result becomes the merge's result and `merge` the merge_done/
+ * merge_failed event carrying it) — the same fresh claim cursor walk the history rows use. */
+function runResultOf(end, scoped) {
     let result = end === null ? null : outcomeText(end);
     let merge = null;
     if (end !== null && result === "queued") {
@@ -117,42 +124,88 @@ function detailFrom(root, role, runNumber, all, scoped, block, end, start) {
             merge = resolved.outcome;
         }
     }
-    const mergedEvent = mergedEventOf(result, merge, scoped, block);
-    const detail = {
-        role,
-        run: runNumber,
+    return { result, merge };
+}
+/** The token and cost totals from the run_end; both zero on an in-flight run. */
+function runUsageOf(end) {
+    if (end === null)
+        return { tokens: 0, costUsd: 0 };
+    const { tokens, costUsd } = eventUsage(end);
+    return { tokens, costUsd };
+}
+/** The run's start/end timestamps and its span: `startTs`/`endTs` null when rotation cut that
+ * side, `durationMs` null whenever the pair is incomplete (no fabricated span). */
+function runTimesOf(start, end, scoped) {
+    return {
         startTs: start === null ? null : start.ts,
-        model: typeof start?.model === "string" && start.model.length > 0 ? start.model : null,
         endTs: end === null ? null : end.ts,
         durationMs: end === null ? null : runSpanMs(end, runStartMap(scoped)),
-        result,
-        tokens: usageNums.tokens,
-        costUsd: usageNums.costUsd,
-        usage: end === null ? "" : usageText(end),
-        // The peak is a corrupt-field-guarded read of the run_end (nonNegativeNumber, the same
-        // guard promptStatsFor applies); the window comes from the shared seamContextWindowForRole —
-        // same seam the role view and status table print — with loadConfigSafe falling back to
-        // defaults, so a broken tumwater.json yields a null window rather than failing this read-only
-        // view.
-        peakContextTokens: end === null ? 0 : nonNegativeNumber(end.peakContextTokens, 0),
-        // The run's prompt-token total and its cache-read subset, spread so a prompt-free or
-        // in-flight run keeps today's exact payload (no prompt/cache keys) and a cache subset > 0.
+    };
+}
+/** The model the run's `run_start` named, or null when it carried none or sits outside the scan. */
+function runModelOf(start) {
+    return typeof start?.model === "string" && start.model.length > 0 ? start.model : null;
+}
+/** The run's usage as its header line; empty when the run carries neither total. */
+function runUsageTextOf(end) {
+    return end === null ? "" : usageText(end);
+}
+/** The run_end's prompt-token total and its cache-read and pre-edit subsets, corrupt-field-
+ * guarded reads (nonNegativeNumber) with the subsets clamped to the total so the rendered share
+ * never exceeds 100%; all three keys absent on a prompt-free or in-flight run. */
+function runPromptFields(end) {
+    const promptTokens = end === null ? 0 : nonNegativeNumber(end.promptTokens, 0);
+    const cacheReadTokens = end === null ? 0 : Math.min(nonNegativeNumber(end.cacheReadTokens, 0), promptTokens);
+    const preEditPromptTokens = end === null ? 0 : Math.min(nonNegativeNumber(end.preEditPromptTokens, 0), promptTokens);
+    return {
         ...(promptTokens > 0 ? { promptTokens } : {}),
         ...(cacheReadTokens > 0 ? { cacheReadTokens } : {}),
         ...(preEditPromptTokens > 0 ? { preEditPromptTokens } : {}),
-        // The run_end's ceiling-truncation flag, spread so an in-flight, older, or normal run
-        // keeps today's exact payload (no cutOff key).
-        ...(end !== null && end.cutOff === true ? { cutOff: true } : {}),
+    };
+}
+/** The run_end's ceiling-truncation flag, absent when the run did not cut off. */
+function runCutOffField(end) {
+    return end !== null && end.cutOff === true ? { cutOff: true } : {};
+}
+/** The run's peak context, a corrupt-field-guarded read of the run_end; 0 when in flight. */
+function runPeakContextOf(end) {
+    return end === null ? 0 : nonNegativeNumber(end.peakContextTokens, 0);
+}
+/** The end-of-run → on-main landing latency (the landing `merged` event's ts minus the run
+ * end's), absent without both an end and a landing event — or a landing before the end, or a
+ * negative difference. */
+function runMergeLatencyField(end, mergedEvent) {
+    return end !== null && mergedEvent !== null && mergedEvent.ts - end.ts >= 0
+        ? { mergeAfterRunMs: mergedEvent.ts - end.ts }
+        : {};
+}
+/** Fill the payload around a collected block: each concern resolves in its own named helper
+ * (runResultOf, runUsageOf, runTimesOf, runModelOf, runUsageTextOf, runPromptFields,
+ * runCutOffField, runPeakContextOf, runMergeLatencyField), and this assembles their results.
+ * Events stay oldest-first; usage/duration pair through the shared event-read helpers so this
+ * view and the history rows cannot drift on what a span is. */
+function detailFrom(root, role, runNumber, all, scoped, block, end, start) {
+    const { result, merge } = runResultOf(end, scoped);
+    const mergedEvent = mergedEventOf(result, merge, scoped, block);
+    const detail = {
+        role,
+        run: runNumber,
+        ...runTimesOf(start, end, scoped),
+        model: runModelOf(start),
+        ...runUsageOf(end),
+        usage: runUsageTextOf(end),
+        result,
+        // The window comes from the shared seamContextWindowForRole — same seam the role view and
+        // status table print — with loadConfigSafe falling back to defaults, so a broken
+        // tumwater.json yields a null window rather than failing this read-only view.
+        peakContextTokens: runPeakContextOf(end),
+        ...runPromptFields(end),
+        ...runCutOffField(end),
         contextWindow: seamContextWindowForRole(loadConfigSafe(root).config ?? defaultConfig(), role, root),
         events: block,
         merge,
         mergedSha: mergedShaOf(result, merge, scoped, block),
-        // The end-of-run → on-main landing latency (the landing `merged` event's ts minus the run
-        // end's), spread so a run without both an end and a landing event — or a landing before its
-        // end, or a negative difference — keeps today's exact payload (no key).
-        ...(end !== null && mergedEvent !== null && mergedEvent.ts - end.ts >= 0
-            ? { mergeAfterRunMs: mergedEvent.ts - end.ts }
-            : {}),
+        ...runMergeLatencyField(end, mergedEvent),
         reverted: null,
     };
     detail.reverted = revertedOf(detail, all);