tumwater 0.4.2 → 0.4.4

package/dist/src/runner/runner-pi.js

@@ -3,7 +3,6 @@ import { backendSessionResumable } from "../agent/agent-backend.js";
 import { HOLD_BASE_MS } from "../team/team-hold.js";
 import { backendKindPhrase } from "../text/phrases.js";
 import { configForRole, resolvedBackendConfig, seamHoldKey, seamPairName } from "../config/config-views.js";
-import { ensureProviderLease } from "../concurrency/provider-lease.js";
 import { buildSummaryRequestPrompt } from "../prompt/prompt-followup.js";
 import { readClaudeAccount, subscriptionWindowRejected } from "../agent/claude/claude-account.js";
 import { observeOpencodeRun, opencodeModelKey } from "../agent/opencode/opencode-catalog.js";
@@ -11,7 +10,7 @@ import { dailyCost, teamDailyCost, pairDailyCost } from "../budget/budget.js";
 import { loadRunnerState } from "./runner-state-load.js";
 import { baseRoleOf, runnerIds } from "../roles/runner-ids.js";
 import { buildStageFixPrompt } from "../prompt/gate-prompts.js";
-import { logEventBestEffort } from "../events/events.js";
+import { logBlindRead } from "../events/events.js";
 import { nativeLogPath, piLogPath, roleNotesPath, sessionDir } from "../paths.js";
 import { piModelsPath } from "../pi/pi-models.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
@@ -116,9 +115,10 @@ export class RunnerPi {
             notesPath,
             // A tool call silent for the configured stall threshold names itself in the event feed
             // while the quiet watchdog still counts down (BUGS.md 2026-09-13 sibling): before this,
-            // a hung command was invisible until the kill. The dashboards derive their own flag from
-            // the raw log, so only the harness event needs wiring here.
-            onToolCallStalled: (message) => this.host.warn(message),
+            // a hung command was invisible until the kill. A model request unanswered that long does
+            // the same (BUGS.md 2026-10-29). The dashboards derive their own flags from the raw log,
+            // so only the harness event needs wiring here.
+            onStallWarning: (message) => this.host.warn(message),
             onLeftoversSwept: (message) => this.host.warn(message),
             // The translator's unmapped-native-type and cost_unknown warnings reach the event feed
             // as their own warning events, once per agent run.
@@ -127,14 +127,7 @@ export class RunnerPi {
             // blind read"): the runner killed the authoring run (action "fail") or a gate run
             // merely recorded it ("logged") — each logged here with this runner's identity so the
             // feed names who, on which run, read which file on which blind model.
-            onBlindRead: (path, action) => logEventBestEffort(this.host.root, {
-                source: this.host.role,
-                type: "image_blind",
-                run: this.host.runNumber(),
-                path,
-                model: resolved.model,
-                action,
-            }),
+            onBlindRead: (path, action) => logBlindRead(this.host.root, this.host.role, this.host.runNumber(), path, resolved.model, action),
         };
     }
     /** Run the orchestrator's merge slot's pi (merge queue 3/5): the shared per-runner wiring
@@ -223,12 +216,6 @@ export class RunnerPi {
         // Names the seam in per-run provider warnings; omitted when pi picks its own default model.
         const on = opts.config.model !== undefined ? ` on ${pair}` : "";
         const fold = (run) => authoring ? this.host.foldUsage(run, provider, pair) : this.host.foldMergeUsage(run, provider, pair);
-        // The agent run re-keys the calling run's provider lease to the provider THIS agent run uses,
-        // if it is not already there (plans/provider-concurrency.md §5): a budget handback or a
-        // model-failure switch that moved this agent run onto another seam moves the run's lease with
-        // it, so a claude-authored run whose gate agent run lands on omlx is counted there. No-op when
-        // the run carries no lease (a bare RunnerPi unit test, `tumwater history`).
-        await ensureProviderLease(opts.config);
         const pi = await runPi(opts);
         this.warnFallbackClone(pi);
         this.observeFreeModelCost(pi, opts.config);
@@ -358,7 +345,7 @@ export class RunnerPi {
     }
     /** Run pi for this runner's authoring run in worktree `wt`: the shared per-runner wiring and
      * the transient-failure retry, with usage folded into the run's counters. It is the ONE
-     * entry point that carries the role notes (PLANS.md "Role notebook": TUMWATER_NOTES_PATH,
+     * entry point that carries the role notes (TUMWATER_NOTES_PATH,
      * read by the `tumwater-notes` command): every other agent run (runRolePi's merge/conflict path,
      * runMergePi, runGatePi) leaves it unset, and the director is excluded because its work is
      * the operator's prompt, not a recurring search.
@@ -409,8 +396,8 @@ export class RunnerPi {
      * abort.
      *
      * The follow-up continues this run's own session, so it must run on the same pair that
-     * session ran on: the caller passes the run's effective config (the fallback pair while a
-     * model-fallback episode is active). A caller without one rides the role's own config. The
+     * session ran on: the caller passes the run's effective config (a budget cap's fallback
+     * pair while a cap episode is active). A caller without one rides the role's own config. The
      * shared per-runner wiring (runnerPiOpts) takes the follow-up's hard caps overriding the
      * authoring run's budget: one short reply on a warm session. The agent run takes the runner's
      * SHARED transient-failure retry (BUGS.md 2026-10-01): a 429 on the follow-up turn waits its

package/dist/src/runner/runner-recovery.js

@@ -48,7 +48,7 @@ export async function pinAndResetPhase(ctx, wt, sha) {
     await resetWorktreeToMain(wt, ctx.mainBranch);
     return true;
 }
-/** End a run whose leftover recovery found work to salvage (src/runner/leftover.ts) without an
+/** End a run whose leftover recovery found work to salvage (runner-leftover.ts) without an
  * authoring run — the leftover owns the role's one merge ref until its merge resolves. A
  * run's dequeued user prompt goes back to its queue, since nothing ran it. A pin put on
  * the merge queue ends the run `queued` exactly like a fresh changed run (the merge-queue
@@ -56,10 +56,10 @@ export async function pinAndResetPhase(ctx, wt, sha) {
  * holding the commit. When the pin is left over from a merge that failed non-terminally
  * (`priorMergeFailure`), re-queuing it is a retry of a PERSISTENT failure the `queued` result
  * cannot express, so it rides the outcome's recoveryFailure into the error streak and the
- * warning that names the stuck gate (BUGS.md 2026-09-21). A role whose merge is still queued
- * ends `queued` on that entry — nothing enqueued twice, nothing reset; a queued entry whose
- * branch also holds a relief commit ahead of main ends `skipped`, leaving both untouched. A
- * leftover that could
+ * warning that names the stuck gate (BUGS.md 2026-09-21); an already-queued pin never reaches
+ * this phase (runner-run routes that arm to the authoring run). A queued entry whose branch
+ * also holds a relief commit ahead of main ends `skipped`, leaving both untouched. A leftover
+ * that could
  * not be pinned stays on the branch and the run fails like a fresh run's failed pin. Every
  * arm is `recoveredLeftover`: no model ran, so the run is no evidence about the backend. */
 export async function finishRecoveryRunPhase(ctx, recovered, userPrompt, wt, priorMergeFailure) {
@@ -69,14 +69,6 @@ export async function finishRecoveryRunPhase(ctx, recovered, userPrompt, wt, pri
         ctx.state.lastError = `failed to pin leftover ${shortSha(recovered.sha)} by its merge ref; left for the next run's recovery`;
         return { result: "error", summary: ctx.state.lastError, recoveredLeftover: true };
     }
-    if (recovered.kind === "held") {
-        // A permanent reviewer configuration error holds the pin: do not re-queue (and pay
-        // another gate check) until the model config changes. Ending `error` schedules the error
-        // ladder, so the hold is re-checked at backoff pace rather than at suite speed
-        // (BUGS.md 2026-10-06).
-        ctx.state.lastError = recovered.message;
-        return { result: "error", summary: recovered.message, recoveredLeftover: true };
-    }
     if (recovered.kind === "main_red_wait") {
         // The pin waits for the orchestrator poll to re-queue it once main moves; `main_red` takes
         // the idle ladder, and the worktree stays as it is.

package/dist/src/runner/{revision.js → runner-revision.js}

@@ -38,8 +38,7 @@ export const REVISION_BACKSTOP = 6;
  * objections verbatim (they are already in `RunnerState.lastReview.reasons`), so the plan role
  * sees exactly what would not converge. PLANS.md plans only, by design: the convergence hold
  * parks a revised plan whose author hit the round cap, so only the plan role needs to clear it;
- * a role's own too-large Needs-review note on a BUGS.md entry is the bug path (the
- * stalledEntries/operatorHeldEntries comments in src/backlog/backlog-eligibility.ts), which the
+ * a role's own too-large Needs-review note on a BUGS.md entry is the bug path, which the
  * plan role resolves by splitting it. A bug that cannot converge stays with the existing re-pick
  * behaviour (reviewer-feedback delivery, part 4/4, addresses that churn).
  * Written through the primary worktree lock, as every other backlog write is, and then committed

package/dist/src/runner/runner-run.js

@@ -6,23 +6,25 @@ import { abortSync, ensureWorktree, resetWorktreeToMain } from "../git/worktree.
 import { leaseSlot } from "../git/worktree-pool.js";
 import { slotCount } from "../config/config.js";
 import { useWorktree } from "../git/worktree-use.js";
+import { readPiListedModels } from "../pi/pi-listed-models.js";
 import { branchName, worktreePath, mergeRefName, rejectedRefName } from "../paths.js";
 import { logEventBestEffort } from "../events/events.js";
 import { buildConflictHandbackNote, buildSalvageRestoreNote } from "../prompt/gate-prompts.js";
 import { buildConflictDiscardNote, buildMainKnownRedNote, buildRevisionNote, buildRejectedReviewNote, } from "../prompt/gate-notes.js";
-import { modelSelectorField, resolvedBackendConfig, reviewRunConfig, reviewedAfterMerge, scheduleConfigForRole, seamHoldKey, } from "../config/config-views.js";
-import { fallbackRoleConfig } from "../config/config-fallbacks.js";
+import { modelSelectorField, resolvedBackendConfig, scheduleConfigForRole, seamHoldKey, withModelOverrides, } from "../config/config-views.js";
+import { imageReroute, seamImageInput } from "../agent/image-input.js";
+import { piModelsPath, readPiProviders } from "../pi/pi-models.js";
+import { peekPrompt, peekRolePrompt } from "../inbox/inbox.js";
 import { planRunStart, planWithSalvagedWork, takesSalvagedWork } from "../run/run-resume.js";
 import { restoreSalvagedWork } from "../git/slot-salvage.js";
 import { DEFAULT_BACKEND } from "../agent/agent-backend.js";
 import { foldAgentCommitsSince } from "../run/run-stage.js";
 import { planBacklogFull } from "../scheduling/claims.js";
-import { modelFallbackActive, modelFallbackProbe } from "./model-fallback.js";
 import { finalizeRun } from "../run/run-finalize.js";
 import { errorMessage } from "../text/text.js";
 import { appendPromptNote, prependPromptNote } from "../text/format.js";
-import { hasUnmergedPin, recoverLeftover } from "./leftover.js";
-import { applyRevision, applyWithConflicts } from "./revision.js";
+import { hasUnmergedPin, recoverLeftover } from "./runner-leftover.js";
+import { applyRevision, applyWithConflicts } from "./runner-revision.js";
 import { conflictedFileHunks, hasConflictMarkers, mainCommitsTouching } from "../merge/merge-git.js";
 import { changedFiles } from "../git/git-diff.js";
 import { handlePiResultPhase } from "./runner-outcome.js";
@@ -57,10 +59,9 @@ async function markerBearingFiles(wt) {
     const files = await changedFiles(wt);
     return files.filter((f) => hasConflictMarkers(wt, [f]));
 }
-/** Run one full run of a role runner: resolve the config (including the model-fallback probe),
- * log the start, run the pipeline, then let finalizeRun schedule the next run. Never throws: a
- * failed run is an "error" result, saved and logged like any other so the runner stays
- * resumable and observable. */
+/** Run one full run of a role runner: resolve the config, log the start, run the pipeline, then
+ * let finalizeRun schedule the next run. Never throws: a failed run is an "error" result,
+ * saved and logged like any other so the runner stays resumable and observable. */
 export async function runPhase(ctx) {
     const s = ctx.state;
     // This role's view of the config (per-role provider/model/thinking + minRunIntervalSeconds
@@ -73,20 +74,67 @@ export async function runPhase(ctx) {
     // the one home of the rule, so the scheduler that admits plan and the nextRunAt this run
     // writes cannot disagree.
     const planBacklogOpen = !planBacklogFull(ctx.root, ctx.config);
+    // This run's effective config: the role's own resolved config (a run always resolves its
+    // role's own config — the model-fallback episode is gone, Subtract part 5o/6) unless an image
+    // reroute below moves it. The budget gate's fallback pair, when a cap episode is active, is
+    // installed into the live config itself, so the config here already names the pair the run
+    // uses.
     const primaryCfg = scheduleConfigForRole(ctx.config, ctx.role, planBacklogOpen);
-    // Model-fallback episode (src/runner/model-fallback.ts): while one is active the run runs
-    // on the role's tier fallback pair, and once the cooldown elapses it runs on the primary
-    // as the probe. Resolved at run start so the authoring run below and the end-of-run fold
-    // agree on which pair ran. Null fallback (the tier resolves to pause) keeps the feature off.
-    const now = Date.now();
-    const fallback = fallbackRoleConfig(ctx.config, ctx.role);
-    const probing = fallback !== null && modelFallbackProbe(s.modelFallback, now);
-    const onFallback = fallback !== null && modelFallbackActive(s.modelFallback, now);
-    // The fallback pair keeps primaryCfg's gap (they resolve the same one outside the plan
-    // schedule's zero-gap window), so a plan on its model fallback still schedules the same gap.
-    let cfg = onFallback && fallback !== null
-        ? { ...fallback, minRunIntervalSeconds: primaryCfg.minRunIntervalSeconds }
-        : primaryCfg;
+    let cfg = primaryCfg;
+    // Image-input reroute (plans/image-input.md part 4/5). A pending one-shot marker means
+    // THIS run is the blind-read reroute: start directly on the image-capable target the
+    // prior run recorded, over the kept worktree, in a fresh session. The marker is consumed
+    // (cleared) here so it does not route a later run; imageRerouteActive stays true for the
+    // whole run so the verdict's one-hop guard fails a second blind read instead of
+    // rerouting again. A preflight (below) sets the same active flag without a marker.
+    s.imageRerouteActive = false;
+    let preflightBlocked = false;
+    if (s.imageReroute) {
+        const r = s.imageReroute;
+        cfg = withModelOverrides(ctx.config, r.tier, {
+            backend: r.backend,
+            provider: r.provider,
+            model: r.model,
+            thinking: r.thinking,
+        });
+        // The marker is NOT cleared here: planRunStart reads its `from`/`path` when it builds
+        // the handoff note (and clears it then), so a run skipped before the plan (an empty
+        // inbox) leaves the reroute pending for the next eligible run.
+        s.imageRerouteActive = true;
+    }
+    else {
+        // Preflight (plans/image-input.md "Attachments"): a queued prompt carrying an
+        // `[image attached: …]` line needs a model that can read images BEFORE any run starts,
+        // so a text-only run hops straight to the target instead of spending a failed run
+        // learning it; with no target the run errors without spawning pi.
+        const nextPrompt = ctx.role === DIRECTOR_ROLE ? peekPrompt(ctx.root) : peekRolePrompt(ctx.root, ctx.role);
+        const carriesImages = nextPrompt !== null && /^\[image attached: .+\]$/m.test(nextPrompt);
+        if (carriesImages) {
+            const providers = readPiProviders(piModelsPath());
+            const listed = readPiListedModels(ctx.root);
+            if (seamImageInput(cfg, providers, listed) !== true) {
+                const target = imageReroute(ctx.config, ctx.role, ctx.rerouteRegime(), undefined, null, null, listed);
+                if (target !== null) {
+                    cfg = target.config;
+                    s.imageRerouteActive = true;
+                    logEventBestEffort(ctx.root, {
+                        source: ctx.role,
+                        type: "image_reroute",
+                        run: s.runs + 1,
+                        from: primaryCfg.model,
+                        to: target.config.model,
+                        tier: target.tier,
+                        preflight: true,
+                    });
+                }
+                else {
+                    preflightBlocked = true;
+                    s.lastError =
+                        `an inbox message for ${ctx.role} attaches an image, but no configured tier can read it`;
+                }
+            }
+        }
+    }
     // Capture what this run runs on (the orchestrator's budget handback matches it against
     // the fallback pair) and clear any stale handback flag: an abort request that lands while
     // the runner is idle must not name a later run's resume.
@@ -122,11 +170,17 @@ export async function runPhase(ctx) {
         source: ctx.role,
         type: "run_start",
         run: runNumber,
+        // A run routed onto the image-capable target — a blind-read handoff or an attachment
+        // preflight — is stamped so the feed shows the reroute and the model it landed on.
+        ...(s.imageRerouteActive ? { reroute: "image" } : {}),
         ...modelSelectorField(cfg),
     });
     let outcome;
     try {
-        outcome = await ctx.runOnce(cfg, { fallback, probe: probing, primary: primaryCfg });
+        // The preflight can end the run before any pi spawns: a text-only runner with an image
+        // attachment and no image-capable target has nothing to run, so it errors without
+        // spending a model call. Everything else runs the pipeline as usual.
+        outcome = preflightBlocked ? { result: "error" } : await ctx.runOnce(cfg);
     }
     catch (err) {
         outcome = { result: "error" };
@@ -170,7 +224,7 @@ export async function runPhase(ctx) {
 /** The run pipeline's start half: resume-or-fresh policy, then run in the director's own
  * worktree or on a leased pool slot. Returns the setup's outcome; a null plan means nothing to
  * run. */
-export async function runOncePhase(ctx, cfg, fallbackCtx) {
+export async function runOncePhase(ctx, cfg) {
     const s = ctx.state;
     // How this run starts — resume the interrupted session or run fresh, and which prompt —
     // is the resume policy, not runner mechanics: it lives in src/run/run-resume.ts, which also
@@ -192,14 +246,25 @@ export async function runOncePhase(ctx, cfg, fallbackCtx) {
     if (plan === null)
         return { result: "skipped" };
     if (ctx.role === DIRECTOR_ROLE) {
+        // The image-reroute one-shot marker routes exactly ONE run onto the image-capable
+        // target (plans/image-input.md part 4/5, INV-J2): for a role runner, planRunStart consumes
+        // it after reading its handoff-note facts. The director never resumes, so planRunStart's
+        // image-reroute branch never runs for it and the marker would otherwise linger and
+        // re-route every later director run off its own tier. It is cleared here — after this
+        // run is confirmed to run (an empty-inbox skip above returns before this, leaving the
+        // reroute pending for the next eligible run) — so the rerouted director prompt is
+        // delivered exactly once and the director is back on its own tier next.
+        // A promptless recovery run delivers no prompt, so it leaves a pending reroute for the next.
+        if (plan.prompt !== null)
+            s.imageReroute = undefined;
         // The director keeps its dedicated worktree (it runs outside the permit, consumes its
         // config-request file at that exact path, and never resumes). Hold it from before
         // ensureWorktree — creating or resetting it is part of the use — to the run's end
         // (plans/disk-floor.md, part 2/4), so a concurrent pressure reclaim never cleans a tree
         // this run is creating or working in.
-        return useWorktree(ctx.root, worktreePath(ctx.root, ctx.role), () => runWithWorktreePhase(ctx, plan, cfg, fallbackCtx));
+        return useWorktree(ctx.root, worktreePath(ctx.root, ctx.role), () => runWithWorktreePhase(ctx, plan, cfg));
     }
-    return runOnceInLeasePhase(ctx, plan, cfg, fallbackCtx);
+    return runOnceInLeasePhase(ctx, plan, cfg);
 }
 /** Whether a finished role run's leased slot must stay pinned for the next run's resume —
  * the resume flag a verdict armed inside the run (`resumePending`), an abort or quiet kill,
@@ -220,7 +285,7 @@ export function slotPinnedForResume(state, outcome) {
  * leases next. A run an exception ends releases its slot unsettled, so edits it leaves there
  * are saved for the role's next run, and a run on a fresh checkout first takes back any such
  * work an earlier run of the role left (restoreSalvagedPhase). */
-async function runOnceInLeasePhase(ctx, plan, cfg, fallbackCtx) {
+async function runOnceInLeasePhase(ctx, plan, cfg) {
     const lease = await leaseSlot(ctx.root, {
         role: ctx.role,
         purpose: "run",
@@ -238,7 +303,7 @@ async function runOnceInLeasePhase(ctx, plan, cfg, fallbackCtx) {
             await checkoutRoleBranchPhase(ctx, lease.dir);
             run = await restoreSalvagedPhase(ctx, plan, lease.dir);
         }
-        outcome = await runWithWorktreePhase(ctx, run, cfg, fallbackCtx, lease.dir);
+        outcome = await runWithWorktreePhase(ctx, run, cfg, lease.dir);
         return outcome;
     }
     finally {
@@ -288,7 +353,7 @@ async function checkoutRoleBranchPhase(ctx, dir) {
     }
     await git(dir, "clean", "-fd");
 }
-async function runWithWorktreePhase(ctx, plan, cfg, fallbackCtx, 
+async function runWithWorktreePhase(ctx, plan, cfg, 
 /** The leased slot the run runs in; omitted by the director, which ensures its own. */
 leasedDir) {
     const s = ctx.state;
@@ -309,19 +374,13 @@ leasedDir) {
         });
     }
     else {
-        // Salvage a commit a previous run left unmerged (src/runner/leftover.ts): recovery puts it
+        // Salvage a commit a previous run left unmerged (runner-leftover.ts): recovery puts it
         // back on the merge queue, so it merges through the orchestrator's merge pipeline — the
         // same gate as a fresh run's change, and main keeps exactly one writer (an in-run
         // recovery merge raced the slot's batches into `merge_blocked`). A salvaged leftover
         // ENDS the run: the role holds one merge ref, and the leftover owns it until its
         // merge resolves. With nothing to salvage the branch holds nothing either, so the reset
         // below leaves pristine main.
-        // A permanent reviewer config error — held from re-queueing — clears once the resolved
-        // reviewer selector changes, so fixing the model config recovers the pin automatically
-        // (BUGS.md 2026-10-06).
-        const reviewSelector = modelSelectorField(reviewRunConfig(ctx.config)).model;
-        if (s.mergeReviewError && s.mergeReviewError.selector !== reviewSelector)
-            s.mergeReviewError = undefined;
         const recovered = await recoverLeftover({
             root: ctx.root,
             role: ctx.role,
@@ -330,7 +389,6 @@ leasedDir) {
             wt,
             mergeConflicts: s.mergeConflicts,
             conflictHandback: s.conflictHandback,
-            mergeReviewError: s.mergeReviewError,
             mainRedRetry: s.mainRedRetry,
         });
         if (recovered?.kind === "handback" && plan.prompt === null) {
@@ -361,14 +419,12 @@ leasedDir) {
             s.conflictDiscard = { sha: recovered.sha, summary: recovered.summary, attempts: recovered.attempts, at: Date.now() };
             prompt = appendPromptNote(prompt, buildConflictDiscardNote(recovered.summary, recovered.attempts));
         }
-        else if (recovered &&
-            !(recovered.kind === "already_queued" &&
-                reviewedAfterMerge(ctx.config, ctx.role))) {
-            // Every recovery kind ends the run here — EXCEPT `already_queued` for a post-merge-review
-            // role, whose arm the scheduler admits (plans/interlock-relief.md part 3/4) and whose
-            // branch is at main: that one falls through to author below instead of ending. Every
-            // other kind, `relief_wait` (a held commit ahead of main beside a queued entry) included,
-            // ends the run.
+        else if (recovered && recovered.kind !== "already_queued") {
+            // Every recovery kind ends the run here — EXCEPT `already_queued`, whose arm the
+            // scheduler admits (the interlock relief applies team-wide) and whose branch is at main:
+            // that one falls through to author below instead of ending. Every other kind,
+            // `relief_wait` (a held commit ahead of main beside a queued entry) included, ends the
+            // run.
             return ctx.finishRecoveryRun(recovered, userPrompt, wt, priorMergeFailure);
         }
         await resetWorktreeToMain(wt, ctx.mainBranch);
@@ -526,17 +582,14 @@ leasedDir) {
     await foldAgentCommitsSince(ctx, wt, runBase);
     // A write that landed in the primary checkout never reaches the worktree's commit, so the run
     // can read as no_change with its work orphaned (BUGS.md, 2026-10-20). The before/after diff
-    // cannot attribute paths to this run when roles overlap, so only warn: the verdict, resume
-    // handling and model-fallback fold below stay as they were.
+    // cannot attribute paths to this run when roles overlap, so only warn: the verdict and
+    // resume handling below stay as they were.
     const primaryAfter = primaryBefore === null ? null : await changedFiles(ctx.root).catch(() => null);
     const strayed = primaryAfter === null ? [] : primaryAfter.filter((f) => !primaryBefore.includes(f));
     if (strayed.length > 0 && !pi.aborted) {
         const shown = strayed.slice(0, 10).join(", ") + (strayed.length > 10 ? `, … (${strayed.length} paths)` : "");
         ctx.warn(`wrote outside the worktree (possibly another writer's): ${shown}`);
     }
-    // Fold the authoring run's verdict into the role's model-fallback episode NOW, before the
-    // post-run handlers spend any more pi runs: only this run is evidence about the primary.
-    ctx.foldModelFallback(fallbackCtx, pi);
     // The `qa` observer's reply ends with a result-carrying `FLOW:` line (plans/observer-roles.md
     // 2/2). Extracted once here, recorded only at the success returns below — an interrupted or
     // failed run must not advance the rotation. The harness records it, never pi.

package/dist/src/runner/runner-state-load.js

@@ -1,4 +1,4 @@
-import { APPROVED_PATCH_IDS_MAX, freshRunnerState, SKIP_REASONS } from "./runner-state.js";
+import { freshRunnerState, SKIP_REASONS } from "./runner-state.js";
 import path from "node:path";
 import { dirEntryNames } from "../files/files.js";
 import { readJsonFile } from "../files/json-files.js";
@@ -58,13 +58,17 @@ const LEGACY_STATE_KEYS = {
     lastTickStartedAt: "lastRunStartedAt", // retired-name-ok: legacy name
     lastTickEndedAt: "lastRunEndedAt", // retired-name-ok: legacy name
     // retired-name-ok:start old state keys
-    landingReviewError: "mergeReviewError", // vocabulary-ok: legacy state key read from old files
     landingCheckFailures: "mergeCheckFailures", // vocabulary-ok: legacy state key read from old files
     lastLandedAt: "lastMergedAt", // vocabulary-ok: legacy state key read from old files
     // retired-name-ok:end
 };
 /** Apply LEGACY_STATE_KEYS to a parsed state object in place. */
 function migrateLegacyStateKeys(saved) {
+    // The pre-merge reviewer-config hold is gone (part 3j/3): a state file may still name it under
+    // either its old (landingReviewError) or its recent (mergeReviewError) key, and with no field
+    // to load it into — no reader consumes it — drop both here so a later save writes neither.
+    delete saved.landingReviewError; // retired-name-ok: legacy state key read from old files
+    delete saved.mergeReviewError;
     for (const [oldKey, newKey] of Object.entries(LEGACY_STATE_KEYS)) {
         if (!(oldKey in saved))
             continue;
@@ -121,26 +125,9 @@ export function loadRunnerState(root, role) {
     healOptionalNumber(s, "parkedSince");
     if (s.skipReason !== undefined && !SKIP_REASONS.includes(s.skipReason))
         delete s.skipReason;
-    // The one-id field an older state file carries folds into the list.
-    const legacy = saved?.lastApprovedPatchId;
-    delete s.lastApprovedPatchId;
-    if (s.approvedPatchIds !== undefined || typeof legacy === "string") {
-        const ids = [...(Array.isArray(s.approvedPatchIds) ? s.approvedPatchIds : []), ...(typeof legacy === "string" ? [legacy] : [])];
-        s.approvedPatchIds = ids.filter((id) => typeof id === "string").slice(-APPROVED_PATCH_IDS_MAX);
-    }
-    if (s.reviewResume !== undefined) {
-        const r = healRecord(s.reviewResume, (v) => {
-            v.attempts = healNumber(v.attempts, 0);
-            v.at = healNumber(v.at, 0);
-        });
-        // A marker without the two strings it keys on names no session to resume, so a malformed
-        // one is dropped here rather than left to throw in sessionResumable.
-        s.reviewResume =
-            r && typeof r.patchId === "string" && typeof r.sessionDir === "string" ? r : undefined;
-    }
     // The nested scheduling records carry the same numeric class — epoch-ms stamps, recovery
-    // counts, and the fallback episode's clock — and are read by comparison or arithmetic
-    // (`ctx.now - claim.at > CLAIM_IDLE_MAX_MS`, `prior.count + 1`, `cooldownMs * 2`), so a
+    // counts, and retry/review counts — and are read by comparison or arithmetic
+    // (`ctx.now - claim.at > CLAIM_IDLE_MAX_MS`, `prior.count + 1`, `attempts + 1`), so a
     // foreign value there is healed the same way the top-level fields are.
     if (s.lastReview !== undefined)
         s.lastReview = healRecord(s.lastReview, (v) => {
@@ -201,13 +188,16 @@ export function loadRunnerState(root, role) {
         });
     if (s.mergeFlakeExcused !== undefined && typeof s.mergeFlakeExcused !== "string")
         delete s.mergeFlakeExcused;
-    if (s.modelFallback !== undefined)
-        s.modelFallback = healRecord(s.modelFallback, (v) => {
-            v.failures = healNumber(v.failures, 0);
-            v.since = healNumber(v.since, 0);
-            v.probeAt = healNumber(v.probeAt, 0);
-            v.cooldownMs = healNumber(v.cooldownMs, 0);
-        });
+    // The image-reroute marker is a one-shot nested record consumed by the next run; a torn
+    // scalar is dropped (its consumers read/mutate fields), and the tier is repaired to a
+    // known tier name so a corrupt tier cannot route a rerouted run to a phantom seam.
+    if (s.imageReroute !== undefined) {
+        const healed = healRecord(s.imageReroute, () => { });
+        s.imageReroute =
+            healed && (healed.tier === "small" || healed.tier === "default" || healed.tier === "strong")
+                ? healed
+                : undefined;
+    }
     return s;
 }
 /** Per-role cache of the persisted live claim, keyed by the state file's stat — one stat per

package/dist/src/runner/runner-state.js

@@ -1,20 +1,6 @@
 import { writeJsonAtomic } from "../files/json-files.js";
 import { statePath } from "../paths.js";
 import { tryOrWarn } from "../events/events.js";
-/** The runner's persisted state file — one JSON object per role under .tumwater/ — and the
- * observation-window counter reset: fresh-state defaults, the atomic save, and zeroCounters
- * (the tolerant load and the live-claim scan are runner-state-load.ts). The scheduling POLICY
- * that mutates this state from run outcomes and operator wakes — the outcome application and
- * resume limits in run-apply.ts, the clock arithmetic (backoff ladders, wakes, yield ring) in
- * backoff.ts; the generic file helpers are src/files/files.ts and the JSON convention itself is
- * src/files/json-files.ts. */
-/** How many times a progressing-timeout review may be resumed before the next attempt
- * reviews the change from scratch (RunnerState.reviewResume). The budget bounds a reviewer that
- * keeps timing out mid-progress, so a wedged review converges to a fresh run instead of
- * resuming the same session forever. */
-export const REVIEW_RESUME_LIMIT = 2;
-/** Approved patch-ids a runner remembers (RunnerState.approvedPatchIds). */
-export const APPROVED_PATCH_IDS_MAX = 8;
 export const SKIP_REASONS = [
     "no-free-entry",
     "claim-hold",