tumwater 0.4.2 → 0.4.4

package/dist/src/runner/runner.js

@@ -6,15 +6,12 @@ import { logEventBestEffort, warnEventBestEffort } from "../events/events.js";
 import { promptPreview } from "../inbox/inbox.js";
 import { assembleRunPrompt } from "../run/run-prompt.js";
 import { RunnerPi } from "./runner-pi.js";
-import { configForRole, seamHoldKey, } from "../config/config-views.js";
-import { fallbackRoleConfig } from "../config/config-fallbacks.js";
+import { configForRole, seamHoldKey, withModelOverrides, } from "../config/config-views.js";
 import { PendingPrompt } from "../inbox/pending-prompt.js";
-import { modelFallbackActive } from "./model-fallback.js";
 import { clearBackoff } from "../scheduling/backoff.js";
 import { RunUsage } from "../run/run-usage.js";
 import { runOncePhase, runPhase, } from "./runner-run.js";
 import { finishAbortedRunPhase, finishRecoveryRunPhase, pinAndResetPhase, } from "./runner-recovery.js";
-import { foldModelFallbackPhase } from "./runner-fallback.js";
 /** One role runner: owns a persistent worktree + branch and runs one run at a time. */
 export class RoleRunner {
     root;
@@ -73,6 +70,13 @@ export class RoleRunner {
      * resolve to, since different roles may run on different pairs.
      * Transient — never persisted — and captured fresh at every run start. */
     runPair;
+    /** Whether the budget gate currently has the team on its free fallback pairs (src/gates/
+     * budget-gates.ts onFallback, set alongside `config` by the orchestrator's poll): an
+     * image reroute may then look only among the free fallback pairs, never a priced primary
+     * (plans/image-input.md "Reroute target" "Regime"). Pure scheduler input, never whether
+     * the runner itself is mid-fallback; defaults false, so standalone-runner tests stay on the
+     * primary regime unless they set it. */
+    budgetFallbackActive = false;
     /** The merge failure this run's leftover recovery is retrying, if any (a retriable merger
      * outcome that kept the pin, which recovery re-queued): set in finishRecoveryRun and
      * attached to the returned RunOutcome so applyRunOutcome can feed it into the error streak
@@ -117,7 +121,6 @@ export class RoleRunner {
             this.state.resumePending = true;
         this.state.running = false;
         this.state.parkedSince = undefined;
-        this.state.parkedOn = undefined;
     }
     save() {
         saveRunnerState(this.root, this.state);
@@ -174,22 +177,39 @@ export class RoleRunner {
     runModelPair() {
         return this.state.running ? (this.runPair ?? null) : null;
     }
-    /** The config this role's NEXT run will run on: the tier fallback pair while the episode is
-     * active (a due probe runs the primary), else the role's own resolved config. The hold and
-     * start passes read this so a role mid-episode is keyed by the provider it will actually use.
-     * Pure read of config + state + the caller's clock. */
-    runConfig(now) {
-        const fallback = fallbackRoleConfig(this.config, this.role);
-        if (fallback !== null && modelFallbackActive(this.state.modelFallback, now))
-            return fallback;
+    /** Which pair set an image reroute may look among (plans/image-input.md "Reroute target"
+     * "Regime"): the free fallback pairs while the budget gate is on fallback; otherwise the
+     * primary tiers. One home for the rule, shared by the target-resolution sites (the verdict's
+     * reroute arm, the attachment preflight). */
+    rerouteRegime() {
+        return this.budgetFallbackActive ? "fallback" : "primary";
+    }
+    /** The config this role's NEXT run will run on: a pending image reroute's target, else the
+     * role's own resolved config (configForRole). The hold and start passes read this so a role
+     * is keyed by the provider it will use. The budget gate's fallback pair, when a cap episode
+     * is active, is installed into the live config itself, so this read already names the pair
+     * the run uses. */
+    runConfig() {
+        // A pending image-input reroute (plans/image-input.md part 4/5) outranks the role's own
+        // tier: the next run starts on the image-capable target the blind-read run recorded,
+        // rebuilt from the stored seam over the live config.
+        if (this.state.imageReroute) {
+            const r = this.state.imageReroute;
+            return withModelOverrides(this.config, r.tier, {
+                backend: r.backend,
+                provider: r.provider,
+                model: r.model,
+                thinking: r.thinking,
+            });
+        }
         return configForRole(this.config, this.role);
     }
-    /** The seam key `runConfig(now)` resolves to (config-views.ts seamHoldKey): the agent id
+    /** The seam key `runConfig()` resolves to (config-views.ts seamHoldKey): the agent id
      * for a non-pi backend (claude seams carry no pi provider), else the pi provider. The hold
      * and start passes read only this, so a claude seam is gated by a `claude` hold and pi's
      * default seams (undefined) are not. */
-    runProvider(now) {
-        return seamHoldKey(this.runConfig(now));
+    runProvider() {
+        return seamHoldKey(this.runConfig());
     }
     /** The signal every pi run of the current run watches: harness shutdown OR a per-run user
      * abort (Node ≥ 20's AbortSignal.any). */
@@ -258,19 +278,15 @@ export class RoleRunner {
         this.usage.fold(this.state, run, false, provider, pair);
     }
     /** Run one full run of this role runner (the pipeline lives in src/runner/runner-run.ts):
-     * `runPhase` resolves the config and fallback episode, logs run_start, runs the pipeline,
+     * `runPhase` resolves the role's own config, logs run_start, runs the pipeline,
      * and finalizes. Never throws: a failed run is an "error" result, saved and logged. */
     async run() {
         return runPhase(this.runContext());
     }
-    /** Thin delegate to foldModelFallbackPhase (src/runner/runner-fallback.ts). */
-    foldModelFallback(fallbackCtx, pi) {
-        foldModelFallbackPhase(this.runContext(), fallbackCtx, pi);
-    }
     /** The run pipeline's entry (src/runner/runner-run.ts): a thin delegate so `run` assembles
      * phase context once and tests can still override `runOnce` to bypass the pipeline. */
-    async runOnce(cfg, fallbackCtx) {
-        return runOncePhase(this.runContext(), cfg, fallbackCtx);
+    async runOnce(cfg) {
+        return runOncePhase(this.runContext(), cfg);
     }
     /** Assemble the run pipeline's host context (src/runner/runner-run.ts) from this runner's
      * fields. `config` and `recoveryFailure` are live getters, so a mid-run change is seen as
@@ -293,13 +309,14 @@ export class RoleRunner {
             warn: (message) => this.warn(message),
             runSignal: () => this.runSignal(),
             runPrompt: (backend) => this.runPrompt(backend),
+            rerouteRegime: () => this.rerouteRegime(),
             get recoveryFailure() {
                 return self.recoveryFailure;
             },
             setRecoveryFailure: (message) => {
                 self.recoveryFailure = message;
             },
-            runOnce: (cfg, fallbackCtx) => this.runOnce(cfg, fallbackCtx),
+            runOnce: (cfg) => this.runOnce(cfg),
             setRunPair: (pair) => {
                 self.runPair = pair;
             },
@@ -312,7 +329,6 @@ export class RoleRunner {
             },
             finishAbortedRun: (userPrompt, wt) => this.finishAbortedRun(userPrompt, wt),
             pinAndReset: (wt, sha) => this.pinAndReset(wt, sha),
-            foldModelFallback: (fallbackCtx, pi) => this.foldModelFallback(fallbackCtx, pi),
             finishRecoveryRun: (recovered, userPrompt, wt, priorMergeFailure) => this.finishRecoveryRun(recovered, userPrompt, wt, priorMergeFailure),
         };
     }

package/dist/src/scheduling/backoff.js

@@ -68,6 +68,11 @@ export function pushYieldOutcome(s, result) {
     s.recentOutcomes = ((s.recentOutcomes ?? "") + ch).slice(-YIELD_RING);
 }
 const YIELD_MAX = 8;
+/** How many recent counted runs the reset window spans — a merge anywhere in the last 10
+ * keeps the multiplier at 1, and the same 10 empties are what start the doubling. */
+const YIELD_RESET_RECENT = 10;
+/** How many further empty runs double the multiplier again (10→×2, 15→×4, 20→×8). */
+const YIELD_DOUBLE_STEP = 5;
 /** The multiplier on a scalable role's minRunIntervalSeconds gap its recent yield earns:
  * 1 while any of the last 10 counted runs merged, otherwise doubling per 5 further empty
  * runs — 10 empties ×2, 15 ×4, 20 ×8 — capped at 8. `recent` is the ring's chars, oldest
@@ -76,12 +81,12 @@ const YIELD_MAX = 8;
  * the ring: one merge is the evidence the role's clock should trust, and the ring's older
  * half only matters once the merge has aged out of the recent window. */
 export function yieldMultiplier(recent) {
-    if (recent.slice(-10).includes(YIELD_MERGE))
+    if (recent.slice(-YIELD_RESET_RECENT).includes(YIELD_MERGE))
         return 1;
     const empty = recent.filter((c) => c !== YIELD_MERGE).length;
-    if (empty < 10)
+    if (empty < YIELD_RESET_RECENT)
         return 1;
-    return Math.min(YIELD_MAX, 2 ** (Math.floor((empty - 10) / 5) + 1));
+    return Math.min(YIELD_MAX, 2 ** (Math.floor((empty - YIELD_RESET_RECENT) / YIELD_DOUBLE_STEP) + 1));
 }
 /** The yield multiplier a runner's state earns: the role's recent-yield multiplier when
  * yieldScaledRole(role) holds, else 1 (a role outside the scalable set keeps its plain gap

package/dist/src/scheduling/claim-entries.js

@@ -8,6 +8,7 @@
  * backlog through `loadRunnerState` / `listedKeys`, never mutates. */
 import { loadRunnerState } from "../runner/runner-state-load.js";
 import { CLAIM_IDLE_MAX_MS, listedKeys } from "./claims.js";
+import { HOUR_MS } from "../text/datetime.js";
 /** The claim states among `ids` that an operator should act on, in the given order: a claim
  * whose key is absent from its role's backlog section is `gone` (0 hours, and gone wins over
  * idle for the same claim); otherwise a claim older than `CLAIM_IDLE_MAX_MS` is `idle` with
@@ -29,7 +30,7 @@ export function staleClaimEntries(root, ids, now = Date.now()) {
                 file: claim.file,
                 title: claim.title,
                 kind: "idle",
-                hours: Math.round((now - claim.at) / 3_600_000),
+                hours: Math.round((now - claim.at) / HOUR_MS),
             });
         }
     }

package/dist/src/scheduling/claims.js

@@ -152,10 +152,6 @@ export function workReserveCount(root, runners, opts) {
             continue;
         if (r.state.running || opts.queuedMergeRoles.has(r.role))
             continue;
-        // A work role whose provider is full (capped and at its cap) cannot use a reserved permit
-        // anyway, so it must not withhold one from another provider's maintenance run (§6).
-        if (opts.providerHasHeadroom !== undefined && !opts.providerHasHeadroom(r))
-            continue;
         const eligible = eligibleFor(base);
         const holdsClaim = r.state.claim !== undefined && eligible.has(r.state.claim.key);
         const hasFreeEntry = [...eligible].some((k) => !(heldByBase.get(base)?.has(k) ?? false));

package/dist/src/scheduling/scheduling.js

@@ -13,91 +13,78 @@ import { BUGFIX_ROLE, DEFERRABLE_ROLES, DIRECTOR_ROLE, roleTier, } from "../role
 import { baseRoleOf, runnerEnabled } from "../roles/runner-ids.js";
 import { HOUR_MS } from "../text/datetime.js";
 import { yieldMultiplierFor } from "./backoff.js";
-/** Should this role run now? `inboxCount` is the calling role's own queued-prompt count
- * (the director's queue for the director, the per-role queue for everyone else) — see the
- * inbox check below. Exported for tests. */
-export function isEligible(runner, now, mainHead, inboxCount, opts = {}) {
-    const s = runner.state;
-    // A role disabled in tumwater.json stops running immediately (live-reload); re-enabling
-    // resumes within one poll cycle because the runner and its persisted state survive.
-    if (!runnerEnabled(runner.config, runner.role))
-        return { run: false };
-    if (s.running)
-        return { run: false };
-    // The director carries the user's own requests: no min-gap, no backoff — a queued
-    // prompt runs as soon as the previous one finishes.
-    if (runner.role === DIRECTOR_ROLE) {
-        if (inboxCount > 0)
-            return { run: true, reason: "inbox" };
-        if (opts.leftoverPending)
-            return now >= s.nextRunAt ? { run: true, reason: "leftover" } : { run: false };
-        return { run: false };
-    }
-    // An interrupted run (graceful abort or crash) leaves half-finished work in its pi
-    // session and worktree: resume it promptly on restart instead of holding it for a full
-    // interval — the min gap below throttles scheduled runs, not recovery. nextRunAt still
-    // gates cut-off resumes, which deliberately wait one interval from their compacted context.
-    // A queued prompt never preempts this gate: a resuming run assembles buildResumePrompt
-    // and does not dequeue the per-role queue, so an early run would only resume sooner than
-    // its deliberate wait — the prompt is consumed by the fresh run the inbox check below
-    // makes due the moment the resume finishes.
+/** Can the runner start at all right now? A role disabled in tumwater.json stops running
+ * immediately (live-reload; re-enabling resumes within one poll cycle because the runner and
+ * its persisted state survive), and an already-running role is never eligible. Either way the
+ * runner holds this poll — the single gate behind isEligible's two early returns. */
+function blockedFromRunning(runner, s) {
+    return !runnerEnabled(runner.config, runner.role) || s.running === true;
+}
+/** The director carries the user's own requests: no min-gap, no backoff — a queued prompt
+ * runs as soon as the previous one finishes. Reaches either arm and always resolves. */
+function directorGate(s, now, inboxCount, opts) {
+    if (inboxCount > 0)
+        return { run: true, reason: "inbox" };
+    if (opts.leftoverPending)
+        return now >= s.nextRunAt ? { run: true, reason: "leftover" } : { run: false };
+    return { run: false };
+}
+/** An interrupted run (graceful abort or crash) resumes promptly on restart; nextRunAt still
+ * gates cut-off resumes, which deliberately wait one interval. A queued prompt never preempts
+ * this gate. Resolves only when a resume is pending, else undefined. */
+function resumeGate(s, now) {
     if (s.resumePending) {
         return now >= s.nextRunAt ? { run: true, reason: "resume" } : { run: false };
     }
-    // A queued per-role prompt is due on its own existence, exactly like the director's inbox:
-    // no min-gap, no backoff, no scheduled clock. The queue is the durable record of the
-    // demand, so it survives every race a wake marker cannot — a wake consumed while a run
-    // is in flight is overwritten by that run's end-save (runner.ts's wake() contract), but the
-    // prompt file it enqueued is not, and this check picks the demand up on the first poll
-    // after the run ends.
+    return undefined;
+}
+/** A queued per-role prompt is due on its own existence, exactly like the director's inbox: no
+ * min-gap, no backoff, no scheduled clock. The queue is the durable record of the demand. */
+function inboxGate(inboxCount) {
     if (inboxCount > 0)
         return { run: true, reason: "inbox" };
-    // The per-role interval (a slow clock, e.g. the steward's ~6 h) gates scheduled runs and
-    // "main moved" early wakes — resolved here so a live-reloaded config applies. An operator
-    // wake overrides it (the woken check below): it is an explicit demand, the same class of
-    // request the director's inbox runs without any gap.
-    //
-    // Yield scaling: for a scalable role the gap is
-    // multiplied by the multiplier its recent results earned — a search role that keeps
-    // finding nothing slows down, and the multiplication gates the "main moved" wake below
-    // too, which is where the cost actually comes from (the gap check above runs first, so a
-    // scaled role inside its stretched gap neither runs on schedule nor on a main move).
-    // One merge in the last ten counted runs restores the plain gap; error-class results
-    // never enter the ring (backoff.ts), so a failing backend does not stretch anything;
-    // `--once`, an operator wake, and a queued prompt all bypass the gap check entirely.
+    return undefined;
+}
+/** The per-role interval (a slow clock) gates scheduled runs and "main moved" early wakes.
+ * Yield scaling multiplies the gap; an operator wake overrides it. Resolves with the hold when
+ * the runner is inside the (possibly stretched) gap, else undefined. */
+function gapGate(runner, s, now, opts) {
     const mult = yieldMultiplierFor(runner.state);
-    // The same planBacklogOpen rule (scheduleConfigForRole) runner-run.ts schedules nextRunAt
-    // from: while PLANS.md has planning room, plan runs on a zero gap; once the target is met it
-    // drops to its 3600 s default (the plans-full deferral then holds the run). Yield scaling
-    // still applies to whatever gap is chosen.
     const minGapSeconds = scheduleConfigForRole(runner.config, runner.role, opts.planBacklogOpen === true).minRunIntervalSeconds;
     const minGap = opts.once ? 0 : minGapSeconds * 1000 * mult;
     const sinceLast = now - (s.lastRunEndedAt ?? 0);
-    // An operator wake newer than the gap window's opening run overrides the interval
-    // (RunnerState.wokenAt): an explicit "try again now" with an empty queue must not silently
-    // wait out the remaining slow clock it ran inside — a queued prompt carries its own
-    // due-ness in the inbox check above, so it never depends on this stamp surviving.
     const woken = freshlyWoken(s);
     if (sinceLast < minGap && !woken) {
-        // Held inside the stretched gap: the runner is not due this poll (a schedule clock with
-        // the plain gap, or a main move under the multiplier, would otherwise admit it). Report
-        // the yield-scaled hold so the phase cell reads "waiting out its gap" instead of the
-        // bare "due — starts on the next poll" of the no-reason fallback (RunnerState.skipReason).
         return mult > 1 ? { run: false, skip: "yield-gap" } : { run: false };
     }
-    // Once mode's clock override, second half: a raised backoffSeconds means nextRunAt is a
-    // backoff deadline, not the scheduled clock, and is honored; at zero it is the clock a
-    // productive run scheduled, and the explicit round demand overrides it.
+    return undefined;
+}
+/** The scheduled clock, then the "main moved" wake. Once mode overrides the clock when
+ * backoffSeconds is 0 (a productive run scheduled it); a raised backoff honors the deadline.
+ * Resolves only once a scheduled reason applies, else undefined. */
+function scheduledGate(s, now, mainHead, opts) {
     if (now >= s.nextRunAt || (opts.once && s.backoffSeconds === 0)) {
         return { run: true, reason: s.runs === 0 ? "startup" : "scheduled" };
     }
-    // The world changed under a sleeping role: main moved since its last run. The stretched
-    // gap above gates this wake too (the gap check runs first), so a role whose recent runs
-    // merged nothing does not re-check on every merge — the multiplier's whole point.
     if (s.lastMainHead && mainHead && mainHead !== s.lastMainHead) {
         return { run: true, reason: "main moved" };
     }
-    return { run: false };
+    return undefined;
+}
+/** Should this role run now? `inboxCount` is the calling role's own queued-prompt count
+ * (the director's queue for the director, the per-role queue for everyone else) — see the
+ * inbox check below. Exported for tests. */
+export function isEligible(runner, now, mainHead, inboxCount, opts = {}) {
+    const s = runner.state;
+    if (blockedFromRunning(runner, s))
+        return { run: false };
+    if (runner.role === DIRECTOR_ROLE)
+        return directorGate(s, now, inboxCount, opts);
+    return (resumeGate(s, now) ??
+        inboxGate(inboxCount) ??
+        gapGate(runner, s, now, opts) ??
+        scheduledGate(s, now, mainHead, opts) ??
+        { run: false });
 }
 /** Fair scheduling order for one poll's eligible roles: the director always leads (it runs
  * the user's prompts), then the work tier (feature/bugfix/plan) before maintenance — a long-idle

package/dist/src/status/status-budget.js

@@ -1,46 +1,11 @@
 import { budgetReached, teamDailyCost, modelPairName, projectCapHit } from "../budget/budget.js";
 import { roleCapVerdicts } from "../gates/role-cap-gates.js";
-import { configForRole, resolverConfig, reviewConfig, roleSeamTier, } from "../config/config-views.js";
+import { roleSeamTier } from "../config/config-views.js";
 import { resolveTierFallbacks, tierFallbackLabels, tiersResolveDistinctPairs } from "../config/config-fallbacks.js";
-import { enabledRoleIds } from "../config/config.js";
-import { fallbackModelFree, piPairFree, readPiProviders, seamFree, teamModelsFree } from "../pi/pi-models.js";
+import { fallbackModelFree, piPairFree, readPiProviders, teamModelsFree } from "../pi/pi-models.js";
 import { readOpencodeCache } from "../agent/opencode/opencode-catalog.js";
-import { backendDisplayName } from "../agent/backend-traits.js";
-import { compareWindowEntries, readAccount, windowEntries, } from "../agent/subscription-account.js";
+import { readAccount } from "../agent/subscription-account.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
-/** The subscription-window blocks and the team-global free-ness answer for a poll (see
- * StatusSnapshot.subscriptionWindows / subscriptionOnly): one `SubscriptionWindowBlock` per
- * distinct non-`pi` subscription backend the enabled seams (roles, review, resolver) route to
- * whose `accounts(backend)` reads subscription billing with at least one window. `only` is true
- * exactly when every paying seam is free (judged by its own backend's account or pi pair
- * price), so the display knows whether the windows replace or merely join the daily spend. The
- * blocks sort most-constrained-first by the same comparator windowEntries uses for one
- * account's windows (then backend), so a team's tightest window always leads. For a claude-only
- * team this is one claude block whose fields match the old claudeWindow block's, aside from the
- * added backend/label. The reviewer and the strong-tier resolver are included, like
- * teamModelsFree, since they can spend. */
-function windowBlocks(cfg, providers, accounts, catalog) {
-    const seams = enabledRoleIds(cfg).map((role) => configForRole(cfg, role));
-    if (cfg.review.enabled)
-        seams.push(reviewConfig(cfg));
-    if (seams.length > 0)
-        seams.push(resolverConfig(cfg));
-    const blocks = [];
-    for (const backend of new Set(seams.map((s) => s.agent).filter((b) => b !== undefined && b !== "pi"))) {
-        const account = accounts(backend);
-        if (account?.billing !== "subscription")
-            continue;
-        const windows = windowEntries(account);
-        if (windows.length === 0)
-            continue;
-        const heldUntil = windows
-            .filter((w) => w.status === "rejected" && w.isUsingOverage !== true && typeof w.resetsAt === "number")
-            .reduce((max, w) => Math.max(max, w.resetsAt), 0) || null;
-        blocks.push({ backend, label: backendDisplayName(backend), windows, primary: windows[0], heldUntil });
-    }
-    blocks.sort((a, b) => compareWindowEntries(a.primary, b.primary) || a.backend.localeCompare(b.backend));
-    return { blocks, only: !seams.some((s) => !seamFree(providers, s, accounts, catalog)) };
-}
 /** The spend/billing block for a poll: the one materialized `spentUsd` (the scheduler's own
  * published figure while running — BUGS.md 2026-09-30 — the persisted states' sum otherwise)
  * that the budget object, the burn-rate projection and `free`/`fallback`/`tiers` all read;
@@ -49,7 +14,7 @@ function windowBlocks(cfg, providers, accounts, catalog) {
  * (piPairFree, fallbackModelFree, teamModelsFree, resolveTierFallbacks) so it has one home:
  * models.json is read once (readPiProviders) and each subscription backend's account once
  * (readAccount, on the snapshot's own pinned `now`, via the per-poll memo), and every free-ness
- * verdict and the window blocks judge those same readings. The director is exempt from both
+ * verdict judges those same readings. The director is exempt from both
  * pause sets, exactly as the gates exempt it. */
 export function collectBudget(root, cfg, rows, roles, running, info, modelsPath, now) {
     // The running orchestrator's published gate figures (read once above, with the pid and the
@@ -80,8 +45,6 @@ export function collectBudget(root, cfg, rows, roles, running, info, modelsPath,
     const publishedDemotions = info?.fallbackDemotions ?? {};
     const usable = (p) => piPairFree(providers, p, accounts, catalog) && !(modelPairName(p) in publishedDemotions);
     const servingResolved = resolveTierFallbacks(cfg, usable);
-    // The subscription usage windows (part 3a/9): one block per subscription backend in use.
-    const { blocks: subscriptionWindows, only: subscriptionOnly } = windowBlocks(cfg, providers, accounts, catalog);
     // The per-tier budget pause set (part 5c/8): the same resolution the scheduler's gate folds,
     // over the SAME usable predicate an observer can re-derive — the price check, and the pair
     // not among the running orchestrator's published per-pair demotions. Computed only while the
@@ -115,8 +78,6 @@ export function collectBudget(root, cfg, rows, roles, running, info, modelsPath,
                 ? tierFallbackLabels(servingResolved)
                 : null,
         },
-        subscriptionWindows,
-        subscriptionOnly,
         budgetPausedRoles,
         capPaused,
     };

package/dist/src/status/status-data.js

@@ -5,8 +5,8 @@ import { piModelsPath } from "../pi/pi-models.js";
 import { configForStatus, queueInFlight, mainCheckForPoll, maintenanceQuotaForPoll, ciParityForPoll } from "./status-polls.js";
 import { quietHoursStatus, roleQuietHold } from "../scheduling/quiet-hours.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
-import { pausedRoles, pausedRolesUntil, scheduledStopAt, scheduledWakes, standingTeamPause } from "../team/team-state.js";
-import { orchestratorAlive, readOrchestratorInfo, } from "../team/orchestrator-info.js";
+import { scheduledStopAt, scheduledWakes, standingRolePause, standingTeamPause } from "../team/team-state.js";
+import { orchestratorAlive, readOrchestratorInfo, } from "../team/team-orchestrator-info.js";
 import { bootstrapHoldsRole, bootstrapStatus } from "../gates/bootstrap-gates.js";
 import { readMergeQueue } from "../merge/merge-queue.js";
 import { collectRoleRows } from "./status-roles.js";
@@ -15,7 +15,7 @@ import { collectRoleNotesOverCap } from "./status-role-notes.js";
 import { collectBudget } from "./status-budget.js";
 import { collectRootInstallDrift } from "./status-install.js";
 import { detectBuildCheck } from "../build/build-check-detect.js";
-import { briefBlockMissing, briefBlockOverCap } from "../brief/brief.js";
+import { briefStatus } from "../brief/brief.js";
 import { principlesBlockOverCap } from "../prompt/principles.js";
 /** The earlier of the two optional stop deadlines (`run --for`'s and a scheduled stop's). */
 function earliestStop(a, b) {
@@ -49,28 +49,14 @@ function snapshotInboxFields(root, inboxes) {
         questions: openQuestions(root).length,
     };
 }
-/** The spend/billing fields of the snapshot: the budget, the per-backend subscription windows
- * (and their claude-window spelling) and the running-only chain/provider holds. */
-function snapshotBudgetFields(budget, subscriptionWindows, subscriptionOnly, claudeBlock, running, info) {
+/** The spend/billing fields of the snapshot: the budget and the running-only chain/provider
+ * holds. */
+function snapshotBudgetFields(budget, running, info) {
     return {
         // Unconditional (never null): a disabled team still shows its spend and the badge is
         // the affordance for SETTING a cap. models.json itself is stat-cached inside pi-models.ts,
         // so an unchanged catalog costs one stat per poll, not a re-read plus parse.
         budget,
-        // One window block per subscription backend in use, raw for `status --json` and the
-        // parts 3b/9–3e/9 displays; omitted when no subscription backend reported a window.
-        ...(subscriptionWindows.length > 0 ? { subscriptionWindows } : {}),
-        subscriptionOnly,
-        ...(claudeBlock
-            ? {
-                claudeWindow: {
-                    windows: claudeBlock.windows,
-                    primary: claudeBlock.primary,
-                    only: subscriptionOnly,
-                    heldUntil: claudeBlock.heldUntil,
-                },
-            }
-            : {}),
         ...(running && info?.chain && Object.keys(info.chain).length > 0 ? { chain: info.chain } : {}),
         // Only while running: a stale info file beside a dead pid must not speak for a stopped
         // team, and only while a hold stands (an empty list is the same as none).
@@ -79,7 +65,7 @@ function snapshotBudgetFields(budget, subscriptionWindows, subscriptionOnly, cla
 }
 /** The pause/quiet-hours fields of the snapshot: the paused flags and their deadlines, the
  * maintenance quota and bootstrap holds, and the per-role quiet windows. */
-function snapshotPauseFields(teamPause, markerRoles, roles, markerSet, capPaused, maintenanceQuota, bootstrapNow, roleRows, budgetPausedRoles, cfg, root, wakes, quiet) {
+function snapshotPauseFields(teamPause, markerRoles, markerRolesUntil, roles, markerSet, capPaused, maintenanceQuota, bootstrapNow, roleRows, budgetPausedRoles, cfg, root, wakes, quiet) {
     return {
         paused: teamPause !== null,
         pausedRoles: markerRoles,
@@ -105,7 +91,7 @@ function snapshotPauseFields(teamPause, markerRoles, roles, markerSet, capPaused
             .filter((l) => l.role !== DIRECTOR_ROLE && roleQuietHold(cfg.quietHoursPerRole, baseRoleOf(l.role), new Date()))
             .map((l) => [l.role, cfg.quietHoursPerRole?.[baseRoleOf(l.role)] ?? ""])),
         pausedUntil: teamPause?.until,
-        pausedRolesUntil: pausedRolesUntil(root),
+        pausedRolesUntil: markerRolesUntil,
         scheduledWake: wakes[0],
         scheduledWakes: wakes.length > 0 ? wakes : undefined,
         pauseReason: teamPause?.reason,
@@ -116,13 +102,17 @@ function snapshotPauseFields(teamPause, markerRoles, roles, markerSet, capPaused
 /** The merge-queue and doctor health fields of the snapshot (main-check, ci-parity and the
  * build-check/brief/principles flags, plus the role notes over cap). */
 function snapshotHealthFields(root, cfg, mergeQueue, roleNotesOverCap) {
+    // The brief's two degraded flags from ONE scan/read (brief.briefStatus): the always-on
+    // `no-brief` and `brief-truncated` amber alerts, read once per poll rather than twice
+    // re-reading the whole brief file.
+    const brief = briefStatus(root);
     return {
         mergeQueue,
         mainCheck: mainCheckForPoll(root, cfg),
         ciParity: ciParityForPoll(root, cfg),
         noDeclaredCheck: detectBuildCheck(root, cfg) === null ? true : undefined,
-        noBrief: briefBlockMissing(root) ? true : undefined,
-        briefTruncated: briefBlockOverCap(root) ? true : undefined,
+        noBrief: brief.missing ? true : undefined,
+        briefTruncated: brief.overCap ? true : undefined,
         ...(roleNotesOverCap.length > 0 ? { roleNotesOverCap } : {}),
         principlesTruncated: principlesBlockOverCap(root) ? true : undefined,
     };
@@ -166,7 +156,10 @@ export function snapshot(root, modelsPath = piModelsPath(), now = Date.now()) {
     const bootstrapNow = bootstrapStatus(root, cfg);
     // One row per role id (part 5b/7): an instance role shows `feature` and `feature-2`.
     const roles = runnerIds(cfg);
-    const markerRoles = pausedRoles(root);
+    // One read of the paused-roles marker per poll serves both the set and its shared deadline
+    // (`pause --role --for` wrote it): standingRolePause returns both from the same parse, so a
+    // snapshot never reads the same marker file twice (pausedRoles + pausedRolesUntil each did).
+    const { roles: markerRoles, until: markerRolesUntil } = standingRolePause(root);
     const markerSet = new Set(markerRoles);
     // One read of the orchestrator info file per poll: it serves both the displayed pid and the
     // liveness check (passing it to orchestratorAlive skips its own re-read).
@@ -175,7 +168,15 @@ export function snapshot(root, modelsPath = piModelsPath(), now = Date.now()) {
     // run or verification) or is pinned to — threaded into the roles collector so `running`,
     // `disk` and the rows agree.
     const slots = readSlotsState(root).slots;
-    const roleRows = collectRoleRows(root, cfg, now, slots, modelsPath, markerSet);
+    // One merge-queue pass per poll (merge-queue.ts's stat cache keeps an unchanged queue at one
+    // stat per file) serves three consumers — the `mergeQueue` field below, the busy runner rows'
+    // surplus-eligibility check (collectRoleRows' `queued`), and the in-maintenance in-flight
+    // count (maintenanceQuotaForPoll) — so a snapshot never lists or re-reads the same queue
+    // twice, and the rows, the depth and the quota cannot straddle a concurrent enqueue/drop.
+    const queue = readMergeQueue(root);
+    const merges = queue.entries;
+    const queuedRoles = new Set(merges.map((e) => e.role));
+    const roleRows = collectRoleRows(root, cfg, slots, modelsPath, markerSet, queuedRoles);
     // Every role whose notes file runs past the read bound (status-role-notes.ts): the standing
     // twin of the doctor `role notes` row, raised as the amber role-notes-truncated alert.
     const roleNotesOverCap = collectRoleNotesOverCap(root);
@@ -189,13 +190,11 @@ export function snapshot(root, modelsPath = piModelsPath(), now = Date.now()) {
     // One read of the pending scheduled wakes feeds both the earliest and the full list, so they
     // cannot disagree.
     const wakes = scheduledWakes(root, now);
-    // One merge queue pass per poll (merge-queue.ts's stat cache keeps an unchanged queue at one
-    // stat per file) serves the depth; inFlight is the 4/5 marker only when a live orchestrator
-    // still has a queue entry for what the marker names (per change, for a batch) — the
-    // cross-check makes every crash ordering self-healing (a stale marker alone never displays,
+    // The merge queue read is hoisted above the rows collector (one pass serves the depth, the
+    // rows' surplus check, and the quota below); inFlight is the 4/5 marker only when a live
+    // orchestrator still has a queue entry for what the marker names (per change, for a batch) —
+    // the cross-check makes every crash ordering self-healing (a stale marker alone never displays,
     // and needs no cleanup pass).
-    const queue = readMergeQueue(root);
-    const merges = queue.entries;
     const mergeQueue = {
         depth: merges.length + queue.unreadable,
     };
@@ -225,21 +224,18 @@ export function snapshot(root, modelsPath = piModelsPath(), now = Date.now()) {
     // The spend/billing block (status-budget.ts): the budget object, the per-backend
     // subscription windows and the team-global free-ness answer, and the two per-role pause
     // verdicts, all from one readPiProviders and one readAccount per backend in use per poll.
-    const { budget, subscriptionWindows, subscriptionOnly, budgetPausedRoles, capPaused } = collectBudget(root, cfg, roleRows, roles, running, info, modelsPath, now);
-    // The one-release claude spelling (see StatusSnapshot.claudeWindow), derived from the claude
-    // block so `subscriptionWindows` stays the single source of the window data.
-    const claudeBlock = subscriptionWindows.find((b) => b.backend === "claude");
+    const { budget, budgetPausedRoles, capPaused } = collectBudget(root, cfg, roleRows, roles, running, info, modelsPath, now);
     // The maintenance allowance (plans/work-ratio.md, part 1b/4): the same pure verdict the
     // gate folds, over the same event log, so the dashboards show the hold the scheduler
     // enforces. `merges` is the one merge queue snapshot read above, so in-flight maintenance
     // merges count once here and in mergeQueue.
-    const maintenanceQuota = maintenanceQuotaForPoll(root, cfg.maintenancePerWorkMerge, roleRows, new Set(merges.map((e) => e.role)), now);
+    const maintenanceQuota = maintenanceQuotaForPoll(root, cfg.maintenancePerWorkMerge, roleRows, queuedRoles, now);
     return {
         ...snapshotRunFields(running, info),
         ...snapshotInboxFields(root, { inbox, inboxPrompts, inboxFiles, inboxQueuedAt, inboxNotBefore, roleInbox, roleInboxPrompts }),
         roles: roleRows,
-        ...snapshotBudgetFields(budget, subscriptionWindows, subscriptionOnly, claudeBlock, running, info),
-        ...snapshotPauseFields(teamPause, markerRoles, roles, markerSet, capPaused, maintenanceQuota, bootstrapNow, roleRows, budgetPausedRoles, cfg, root, wakes, quiet),
+        ...snapshotBudgetFields(budget, running, info),
+        ...snapshotPauseFields(teamPause, markerRoles, markerRolesUntil, roles, markerSet, capPaused, maintenanceQuota, bootstrapNow, roleRows, budgetPausedRoles, cfg, root, wakes, quiet),
         ...snapshotHealthFields(root, cfg, mergeQueue, roleNotesOverCap),
         ...snapshotResourceFields(root, running, info, rootDrift),
     };

package/dist/src/status/status-role-notes.js

@@ -1,6 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
-import { readTextOrNull } from "../files/files.js";
+import { readRegularTextOrNull } from "../files/files.js";
 import { cachedByStat } from "../files/stat-cache.js";
 import { roleNotesPath } from "../paths.js";
 import { ROLE_NOTES_MAX_BYTES } from "../agent/role-notes-write.js";
@@ -34,7 +34,7 @@ export function readRoleNotesOverCap(root) {
             continue;
         const file = path.join(notesDir, name);
         const chars = cachedByStat(noteLengthCache, file, file, () => {
-            const text = readTextOrNull(file);
+            const text = readRegularTextOrNull(file);
             return text === null ? null : text.length;
         }, (n) => n);
         if (chars === null)