tumwater 0.4.2 → 0.4.4

package/dist/src/status/status-roles.js

@@ -1,12 +1,11 @@
 import path from "node:path";
 import { configForRole, modelSelectorField, roleSeamTier, } from "../config/config-views.js";
-import { modelFallbackView } from "../config/config-fallbacks.js";
 import { isCustomRole } from "../config/config.js";
 import { baseRoleOf, configuredInstances, instanceIndex, runnerIds, runnerPaused } from "../roles/runner-ids.js";
 import { errorStreakAtWarn, QUIET_KILL_RESUME_LIMIT } from "../run/run-apply.js";
 import { queuedMergeRoles } from "../merge/merge-queue.js";
 import { hasOutstandingWork } from "../runner/runner-state.js";
-import { formatModelSelector } from "../config/model-selector.js";
+import { formatModelSelector } from "../config/config-model-selector.js";
 import { piSettingsPath, readPiDefaultModel } from "../pi/pi-settings.js";
 import { isJsonObject } from "../files/json-object.js";
 import { runnerStateForPoll } from "./status-polls.js";
@@ -14,14 +13,14 @@ import { roleImageInfo } from "../agent/image-input.js";
 import { backendDefaultLabel } from "../agent/backend-traits.js";
 import { readPiListedModels } from "../pi/pi-listed-models.js";
 import { seamContextWindowForRole } from "../pi/pi-models.js";
-/** One row per enabled role id (part 5b/7). `configForRole`, `modelFallbackView`, the leased /
+/** One row per enabled role id (part 5b/7). `configForRole`, the leased /
  * pinned slot and the pi-default seam all resolve against the values `snapshot()` already
  * read once for the poll — the info and slots pins (threaded as `slots`) keep rows, `running`
- * and `disk` on the same shared reads, and `now` is the snapshot's pinned clock so every row
- * agrees on what "active" means. One read of pi's own saved default per poll (docs/backends.md)
- * serves the rows whose seam runs pi and resolves no model — its settings.json sits beside the
- * models catalog this snapshot reads (piSettingsPath), so one seam serves both. */
-export function collectRoleRows(root, cfg, now, slots, modelsPath, paused) {
+ * and `disk` on the same shared reads. One read of pi's own saved default per poll
+ * (docs/backends.md) serves the rows whose seam runs pi and resolves no model — its
+ * settings.json sits beside the models catalog this snapshot reads (piSettingsPath), so one
+ * seam serves both. */
+export function collectRoleRows(root, cfg, slots, modelsPath, paused, queued = queuedMergeRoles(root)) {
     // A surplus runner (index above `instances`, from the runner pool of plans/fast-merge.md
     // "Lever 1") with nothing to show gets no row, so the table does not list idle extras.
     // The exceptions are exactly the surplus runners an operator most needs to see and resume
@@ -31,7 +30,6 @@ export function collectRoleRows(root, cfg, now, slots, modelsPath, paused) {
     // run after run" alert keys on, so a surplus runner the alert would report is never
     // hidden. Without these rows the role is invisible and unresumable (BUGS.md 2026-10-23),
     // and the alerts — which read the rows — cannot name it.
-    const queued = queuedMergeRoles(root);
     const roles = runnerIds(cfg).filter((r) => {
         if (instanceIndex(r) <= configuredInstances(cfg, r))
             return true;
@@ -59,19 +57,13 @@ export function collectRoleRows(root, cfg, now, slots, modelsPath, paused) {
         // only with a tier map declared, where it names the tier a role rides.
         const eff = configForRole(cfg, r);
         // The image-input surface (plans/image-input.md "Surfaces", part 5/5): the role's own
-        // capability and its reroute target, one shared resolver so the status rows, the role
-        // page, and the submit gate cannot disagree about who reads images or where a blind
-        // prompt would run.
+        // capability, one shared resolver so the status rows, the role page, and the submit gate
+        // cannot disagree about who reads images.
         const image = roleImageInfo(cfg, r, modelsPath, listed);
         // The peak-ctx share denominator (the role's context window, part 3c): resolved once per
         // poll here, beside `eff` (the same seam the role page resolves and names) — the same seam
         // `seamContextWindow` run against, so row, page and drawer cannot disagree.
         const contextWindow = seamContextWindowForRole(cfg, r, root, modelsPath);
-        // Model failure fallback, part 2/2: while the role's episode is active its agent runs use
-        // the tier-resolved fallback pair, so the row names that pair, the episode's start, and
-        // the failure that tripped it. `now` is the poll's own clock (the snapshot seam), so
-        // every row agrees on what "active" means.
-        const episode = modelFallbackView(base.modelFallback, cfg, r, now);
         // A seam that runs pi and resolves neither a provider nor a model starts on pi's own
         // saved default — name it in the row (modelFromPi) so the operator sees which model the
         // role runs. The config's `thinking` wins over the default's because tumwater passes it
@@ -106,7 +98,6 @@ export function collectRoleRows(root, cfg, now, slots, modelsPath, paused) {
                 ? {}
                 : { model: backendDefaultLabel(eff.agent) }),
             ...(isJsonObject(cfg.model) ? { modelTier: roleSeamTier(cfg, r) } : {}),
-            ...(episode !== null ? { fallback: episode } : {}),
             ...(contextWindow !== null ? { contextWindow } : {}),
             ...(slot ? { slot: path.basename(slot.dir), slotPinned: pinned !== undefined } : {}),
             ...(baseRoleOf(r) === r ? {} : { instanceOf: baseRoleOf(r) }),

package/dist/src/team/{error-storm.js → team-error-storm.js}

@@ -22,7 +22,7 @@ export const ERROR_STORM_ROLES = 3;
 export const ERROR_STORM_QUIET = { key: null, roles: [] };
 /** The config knob a shared cause points at, when one is known. Only the timeout cause is
  * mapped: `timed out after <dur>` is the reducer's pooled rendering of the run-timeout errors
- * (src/agent/run-agent.ts's two `timed out after ${runTimeoutSeconds}s` shapes, pooled into one
+ * (src/agent/agent-run.ts's two `timed out after ${runTimeoutSeconds}s` shapes, pooled into one
  * key by poolTimeoutKey — src/failure/failure-cluster.ts owns the two shapes and their
  * pooling), and a team-wide
  * run of it means the run budget does not fit the serving model — the one cause with a knob

package/dist/src/team/{failure-spread.js → team-failure-spread.js}

@@ -2,12 +2,12 @@
  * 2026-09-29 connection-storm entry): when many roles each fail a few times on one provider
  * failure kind, no existing bar trips — the per-role streak alarm needs one role DEEP
  * (ERROR_STREAK_WARN consecutive, src/run/run-apply.ts), the error-storm warning needs several
- * roles deep at once (src/team/error-storm.ts), and the team hold needs failures COALESCED within
- * a two-minute window (src/team/team-hold.ts). A degraded backend that fails the team widely and
- * shallowly — six runs across as many roles, each failure minutes apart — rides all three
- * gaps in silence. This alarm counts raw failures of one kind across roles in a rolling
+ * roles deep at once (src/team/team-error-storm.ts), and the team hold needs failures COALESCED
+ * within a two-minute window (src/team/team-hold.ts). A degraded backend that fails the team
+ * widely and shallowly — six runs across as many roles, each failure minutes apart — rides all
+ * three gaps in silence. This alarm counts raw failures of one kind across roles in a rolling
  * window, independent of any role's streak depth: the fourth bar, shaped for the spread the
- * other three cannot see. POLICY, on the shape of its siblings (src/team/error-storm.ts,
+ * other three cannot see. POLICY, on the shape of its siblings (src/team/team-error-storm.ts,
  * src/team/team-hold.ts): a pure reducer over the observations the orchestrator collects each
  * poll and the previous state, so the rule is unit-testable without a team and the
  * orchestrator owns only the wiring (the warning event). Like both siblings it has memory —

package/dist/src/team/team-hold.js

@@ -78,15 +78,17 @@ export function heldProviders(holds) {
 /** The holds that STAND, as a structured list for observers (the dashboards and `tumwater
  * status` name them; the event feed and failure digest already do): iterate the map, skip an
  * entry whose `until` is null (a lifted hold kept only for relapse memory) and one whose kind
- * is `"subscription-window"` (that hold already has the snapshot's `claudeWindow` block and
- * its header badge), and emit one `StandingHold` each, sorted by provider name so two reads of
- * one map agree. An `undefined` provider means pi's default backend, the same meaning
- * `heldProviders` gives it, so it is omitted rather than written as null. */
+ * is `"subscription-window"` (the account-level window throttle, not a failure-storm hold the
+ * standing list names; its display and crossing events are gone — parts 5u/6–5x/6), then
+ * emit one `StandingHold` each, sorted by provider name so two reads of one map agree. An
+ * `undefined` provider means pi's default backend, the same meaning `heldProviders` gives it,
+ * so it is omitted rather than written as null. */
 export function standingHolds(holds) {
     const out = [];
     for (const [provider, hold] of holds) {
         // A lifted hold (until null) and a null kind (never standing) never publish; a
-        // subscription-window hold already has the snapshot's claudeWindow block and its badge.
+        // subscription-window hold is an account-level throttle, not a storm hold for this list,
+        // and its display and crossing events are gone (parts 5u/6–5x/6).
         if (hold.until === null || hold.kind === null || hold.kind === "subscription-window")
             continue;
         out.push({ ...(provider !== undefined ? { provider } : {}), until: hold.until, kind: hold.kind });
@@ -94,88 +96,121 @@ export function standingHolds(holds) {
     out.sort((a, b) => (a.provider ?? "").localeCompare(b.provider ?? ""));
     return out;
 }
-/** Step the hold by one orchestrator poll: from `prev` and every role's latest failure
- * observations, decide what holds at `now`. A held team stays held until `until` and then
- * re-opens by itself — nothing can get stuck, the same guarantee the budget gate's stateless
- * re-evaluation gives. An open team trips when HOLD_STORM_ROLES distinct roles each
- * ended a run on the same failure kind within the storm window (and after the last re-open) —
- * the first qualifying kind in observation order wins, since one poll can hold about only one
- * kind — for the longest of the escalated base hold and, for a rate-limit storm, the furthest
- * Retry-After deadline among those observations (each measured from its own 429, since that is
- * when the provider said it), capped at HOLD_CAP_MS. Returns `prev` itself when
- * nothing changed, so a caller can compare `until` across the step to find transitions. */
-export function teamHold(prev, observations, now) {
-    if (prev.until !== null) {
-        // A reserve hold is re-evaluated every poll: the window may since have been rejected (the
-        // director keeps running) or the reserve removed from the config, and either must show now.
-        if (now < prev.until && prev.reserve !== true)
-            return prev;
-        // The deadline passed: re-open, keeping provider/kind/escalation as the next storm's
-        // relapse memory, then fall through so a still-rejected subscription window (or a storm
-        // whose observations survived) holds again on this very poll rather than leaving one poll
-        // open. kind and provider stay because the next storm's relapse test compares against the
-        // hold that just ended.
-        prev = {
-            provider: prev.provider,
-            until: null,
-            kind: prev.kind,
-            roles: [],
-            escalation: prev.escalation,
-            reopenedAt: prev.reserve === true ? prev.reopenedAt : now,
-        };
-    }
-    // A rejected subscription usage window is the account-level throttle: it holds every seam on
-    // its provider until `resetsAt`, whatever the role count — the one observation kind the
-    // per-role storm rule below does not gate. Overage is real money and never holds (the run
-    // continues into paid overflow); a window with no future `resetsAt` holds nothing.
+/** Decide whether the current hold still stands or the deadline re-opens it: return `prev`
+ * itself while open or still held (and not a re-evaluated reserve), else the re-opened
+ * skeleton. A reserve hold is re-evaluated every poll: the window may since have been
+ * rejected (the director keeps running) or the reserve removed from the config, and either
+ * must show now. The deadline passed: re-open, keeping provider/kind/escalation as the next
+ * storm's relapse memory, then fall through so a still-rejected subscription window (or a
+ * storm whose observations survived) holds again on this very poll rather than leaving one
+ * poll open. kind and provider stay because the next storm's relapse test compares against
+ * the hold that just ended. */
+function reopenTeamHold(prev, now) {
+    if (prev.until === null)
+        return prev;
+    if (now < prev.until && prev.reserve !== true)
+        return prev;
+    return {
+        provider: prev.provider,
+        until: null,
+        kind: prev.kind,
+        roles: [],
+        escalation: prev.escalation,
+        reopenedAt: prev.reserve === true ? prev.reopenedAt : now,
+    };
+}
+/** The account-level subscription window hold, or undefined when none is rejected. A rejected
+ * subscription usage window is the account-level throttle: it holds every seam on its
+ * provider until `resetsAt`, whatever the role count — the one observation kind the
+ * per-role storm rule below does not gate. Overage is real money and never holds (the run
+ * continues into paid overflow); a window with no future `resetsAt` holds nothing. */
+function subscriptionWindowHold(observations, now, reopenedAt) {
     const window = observations.find((o) => o.kind === "subscription-window" && (o.resetsAt ?? 0) > now);
-    if (window !== undefined) {
-        return {
-            provider: window.provider,
-            until: window.resetsAt,
-            kind: "subscription-window",
-            roles: [],
-            escalation: 0,
-            reopenedAt: prev.reopenedAt,
-            ...(window.reserve === true ? { reserve: true } : {}),
-        };
-    }
-    const recent = observations.filter((o) => (prev.reopenedAt === null || o.at > prev.reopenedAt) && now - o.at <= HOLD_STORM_WINDOW_MS);
-    // Group the recent failures by provider+kind (in first-seen order, so the pick is
-    // deterministic) and hold about the first pair that has enough distinct roles behind it.
-    // undefined providers share one key: an unconfigured team is one backend by construction.
+    if (window === undefined)
+        return undefined;
+    return {
+        provider: window.provider,
+        until: window.resetsAt,
+        kind: "subscription-window",
+        roles: [],
+        escalation: 0,
+        reopenedAt,
+        ...(window.reserve === true ? { reserve: true } : {}),
+    };
+}
+/** The observations that can still count toward the next storm: failures after the last
+ * re-open (the storm that hold already answered, and any an in-flight run hit while it
+ * held — that run's own retry is already waiting it out) and inside the storm window. */
+function recentStormObservations(prev, observations, now) {
+    return observations.filter((o) => (prev.reopenedAt === null || o.at > prev.reopenedAt) && now - o.at <= HOLD_STORM_WINDOW_MS);
+}
+/** The first provider+kind group (in first-seen order, so the pick is deterministic) with
+ * HOLD_STORM_ROLES distinct roles behind it, or undefined when none qualifies — the answer
+ * to "which storm wins one poll?", since one poll can hold about only one kind. Undefined
+ * providers share one key: an unconfigured team is one backend by construction. */
+function firstStormGroup(recent) {
     const byProviderKind = new Map();
     for (const o of recent) {
         const key = `${o.provider ?? ""}\n${o.kind}`;
         getOrCreate(byProviderKind, key, () => ({ provider: o.provider, kind: o.kind, group: [] })).group.push(o);
     }
-    let storm = [];
-    let kind = null;
-    let provider;
     for (const entry of byProviderKind.values()) {
         const roles = new Set(entry.group.map((o) => o.role));
         if (roles.size >= HOLD_STORM_ROLES) {
-            storm = entry.group;
-            kind = entry.kind;
-            provider = entry.provider;
-            break;
+            return { provider: entry.provider, kind: entry.kind, storm: entry.group };
         }
     }
-    if (kind === null)
-        return prev;
-    const roles = sortedRoles(new Set(storm.map((o) => o.role)));
-    // A relapse is per provider AND kind: the same storm re-tripping inside the window
-    // escalates, while a different kind — or the same kind at a DIFFERENT provider — after a
-    // re-open is a new incident at the base.
+    return undefined;
+}
+/** The hold severity this storm earns: +1 on the previous escalation when it is a relapse of
+ * the just-ended hold, else 0. A relapse is per provider AND kind: the same storm re-tripping
+ * inside the window escalates, while a different kind — or the same kind at a DIFFERENT
+ * provider — after a re-open is a new incident at the base. */
+function holdEscalation(prev, provider, kind, now) {
     const relapse = prev.kind !== null &&
         prev.kind === kind &&
         prev.provider === provider &&
         prev.reopenedAt !== null &&
         now - prev.reopenedAt <= HOLD_RELAPSE_MS;
-    const escalation = relapse ? prev.escalation + 1 : 0;
+    return relapse ? prev.escalation + 1 : 0;
+}
+/** How long this storm's hold lasts: the longest of the escalated base hold and, for a
+ * rate-limit storm, the furthest Retry-After deadline among its observations (each measured
+ * from its own 429, since that is when the provider said it), capped at HOLD_CAP_MS. */
+function holdDurationMs(escalation, storm, now) {
     const retryAfterMs = Math.max(0, ...storm.map((o) => o.at + (o.retryAfterSeconds ?? 0) * 1000 - now));
-    const holdMs = Math.min(HOLD_CAP_MS, Math.max(HOLD_BASE_MS * 2 ** escalation, retryAfterMs));
-    return { provider, until: now + holdMs, kind, roles, escalation, reopenedAt: prev.reopenedAt };
+    return Math.min(HOLD_CAP_MS, Math.max(HOLD_BASE_MS * 2 ** escalation, retryAfterMs));
+}
+/** Step the hold by one orchestrator poll: from `prev` and every role's latest failure
+ * observations, decide what holds at `now`. A held team stays held until `until` and then
+ * re-opens by itself — nothing can get stuck, the same guarantee the budget gate's stateless
+ * re-evaluation gives. An open team trips when HOLD_STORM_ROLES distinct roles each
+ * ended a run on the same failure kind within the storm window (and after the last re-open) —
+ * the first qualifying kind in observation order wins, since one poll can hold about only one
+ * kind — for the longest of the escalated base hold and, for a rate-limit storm, the furthest
+ * Retry-After deadline among those observations (each measured from its own 429, since that is
+ * when the provider said it), capped at HOLD_CAP_MS. Returns `prev` itself when
+ * nothing changed, so a caller can compare `until` across the step to find transitions. */
+export function teamHold(prev, observations, now) {
+    const reopened = reopenTeamHold(prev, now);
+    if (reopened.until !== null)
+        return reopened;
+    const window = subscriptionWindowHold(observations, now, reopened.reopenedAt);
+    if (window !== undefined)
+        return window;
+    const group = firstStormGroup(recentStormObservations(reopened, observations, now));
+    if (group === undefined)
+        return reopened;
+    const escalation = holdEscalation(reopened, group.provider, group.kind, now);
+    const roles = sortedRoles(new Set(group.storm.map((o) => o.role)));
+    return {
+        provider: group.provider,
+        until: now + holdDurationMs(escalation, group.storm, now),
+        kind: group.kind,
+        roles,
+        escalation,
+        reopenedAt: reopened.reopenedAt,
+    };
 }
 /** The providers whose standing hold is the account's rejected subscription window (kind
  * "subscription-window", not a reserve crossing — the director is exempt from the reserve): the

package/dist/src/team/{orchestrator-info.js → team-orchestrator-info.js}

@@ -1,4 +1,5 @@
 import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
+import { cachedByStat } from "../files/stat-cache.js";
 import { finiteNumber, isJsonObject } from "../files/json-object.js";
 import { pidAlive } from "../process/process.js";
 import { orchestratorStatePath } from "../paths.js";
@@ -41,13 +42,28 @@ export function publishInfoFields(root, info, fields) {
  * trusted because the `OrchestratorInfo` annotation says so: a foreign shape (a scalar
  * `fallbackDemotions`, a `disk` missing its numbers) would otherwise throw out of a render —
  * `modelPairName(p) in publishedDemotions` or `formatGB(undefined)` — on every second's
- * poll. An unreadable field is dropped, so observers read it as absent. */
+ * poll. An unreadable field is dropped, so observers read it as absent. The value is served
+ * from a stat-keyed cache (infoCache): the TUI, GUI and `tumwater status` poll snapshot every
+ * second, but the orchestrator writes the info file only at start and whenever a published
+ * field (build, budget, disk, permits) changes — between writes it sits unchanged for minutes.
+ * An unchanged file costs one stat syscall per poll instead of re-reading, re-parsing, and
+ * re-normalizing JSON; any write invalidates via dev/ino/mtime/size (writeJsonAtomic's
+ * tmp+rename is the same freshness contract the other cachedByStat consumers rely on). */
+// Per-root info cache (stat-cache.cachedByStat), keyed by state-file path so distinct roots
+// never collide; capped inside cachedByStat so many short-lived roots in tests cannot grow it
+// unbounded. readOrchestratorInfo serves an unchanged file from this cache on a poll, and the
+// orchestrator's own writes (tmp+rename) invalidate it exactly like every other cachedByStat
+// consumer.
+const infoCache = new Map();
 export function readOrchestratorInfo(root) {
-    const info = readJsonFile(orchestratorStatePath(root));
-    if (info === null)
-        return null;
-    normalizeInfoFields(info);
-    return info;
+    const file = orchestratorStatePath(root);
+    return (cachedByStat(infoCache, file, file, () => {
+        const info = readJsonFile(file);
+        if (info === null)
+            return null;
+        normalizeInfoFields(info);
+        return info;
+    }, (info) => ({ ...info })) ?? null);
 }
 /** Number type-guard over the shared `finiteNumber` read (json-object.ts): that helper is the
  * one home of the "the field is the number or it is nothing" rule, narrowed here so callers
@@ -82,11 +98,12 @@ function parseBuild(v) {
         build.restartPending = v.restartPending;
     if (typeof v.restartBlocked === "string")
         build.restartBlocked = v.restartBlocked;
+    const waiting = v.waitingForCheck;
+    if (isJsonObject(waiting) && typeof waiting.head === "string" && isFiniteNumber(waiting.aheadCommits))
+        build.waitingForCheck = { head: waiting.head, aheadCommits: waiting.aheadCommits };
     return build;
 }
-/** The published permit snapshot, or undefined for any foreign shape. Each `byKey` entry must
- * carry its two numbers; `limit` is kept only when it is a number, so a malformed provider
- * map is dropped to `undefined` rather than reaching a render that reads it as a valid cap. */
+/** The published permit snapshot, or undefined for any foreign shape. */
 /** One entry of the published provider-holds list, or undefined for any foreign shape: a
  * well-formed entry is an object with a finite `until` and a string `kind`; a `provider` that
  * is present but not a string drops the entry, so a guarded list keeps its well-formed
@@ -106,18 +123,7 @@ function parseCheckPermits(v) {
 function parsePermits(v) {
     if (!isJsonObject(v) || !isFiniteNumber(v.inUse) || !isFiniteNumber(v.limit) || !isFiniteNumber(v.reserve))
         return undefined;
-    if (!isJsonObject(v.byKey))
-        return undefined;
-    const byKey = {};
-    for (const [key, value] of Object.entries(v.byKey)) {
-        if (!isJsonObject(value) || !isFiniteNumber(value.inUse) || !isFiniteNumber(value.waiting))
-            continue;
-        const entry = { inUse: value.inUse, waiting: value.waiting };
-        if (isFiniteNumber(value.limit))
-            entry.limit = value.limit;
-        byKey[key] = entry;
-    }
-    return { inUse: v.inUse, limit: v.limit, reserve: v.reserve, byKey };
+    return { inUse: v.inUse, limit: v.limit, reserve: v.reserve };
 }
 function parseSlotPool(v) {
     if (!isJsonObject(v) || !isFiniteNumber(v.leased) || !isFiniteNumber(v.limit) || !isFiniteNumber(v.waiting))
@@ -143,14 +149,9 @@ function parseOrDelete(rec, key, parse) {
     else
         rec[key] = parsed;
 }
-/** Degrade each known nested field to a usable shape or drop it, mutating the freshly parsed
- * object in place so a well-formed file keeps its values unchanged. */
-function normalizeInfoFields(rec) {
-    parseOrDelete(rec, "build", parseBuild);
-    parseOrDelete(rec, "fallbackDemoted", parseDemotion);
-    parseOrDelete(rec, "permits", parsePermits);
-    parseOrDelete(rec, "checkPermits", parseCheckPermits);
-    parseOrDelete(rec, "slotPool", parseSlotPool);
+/** Drop a non-object `fallbackDemotions` or each entry that does not parse, keeping
+ * well-formed entries unchanged. */
+function normalizeFallbackDemotions(rec) {
     const demotions = rec.fallbackDemotions;
     if (!isJsonObject(demotions))
         delete rec.fallbackDemotions;
@@ -163,13 +164,9 @@ function normalizeInfoFields(rec) {
                 demotions[key] = parsed;
         }
     }
-    const budget = rec.budget;
-    if (!isJsonObject(budget) || !isFiniteNumber(budget.spentUsd))
-        delete rec.budget;
-    if (rec.chain !== undefined && !isJsonObject(rec.chain))
-        delete rec.chain;
-    if (rec.stopsAt !== undefined && !isFiniteNumber(rec.stopsAt))
-        delete rec.stopsAt;
+}
+/** Drop a non-array `providerHolds` or keep each well-formed entry, dropping foreign ones. */
+function normalizeProviderHolds(rec) {
     const providerHolds = rec.providerHolds;
     if (!Array.isArray(providerHolds))
         delete rec.providerHolds;
@@ -182,6 +179,9 @@ function normalizeInfoFields(rec) {
         }
         rec.providerHolds = kept;
     }
+}
+/** Drop a `disk` that lacks finite numbers or a boolean `held`, or an invalid `lastReclaim`. */
+function normalizeDisk(rec) {
     const disk = rec.disk;
     if (!isJsonObject(disk) ||
         !isFiniteNumber(disk.freeGB) ||
@@ -194,6 +194,25 @@ function normalizeInfoFields(rec) {
         delete disk.lastReclaim;
     }
 }
+/** Degrade each known nested field to a usable shape or drop it, mutating the freshly parsed
+ * object in place so a well-formed file keeps its values unchanged. */
+function normalizeInfoFields(rec) {
+    parseOrDelete(rec, "build", parseBuild);
+    parseOrDelete(rec, "fallbackDemoted", parseDemotion);
+    parseOrDelete(rec, "permits", parsePermits);
+    parseOrDelete(rec, "checkPermits", parseCheckPermits);
+    parseOrDelete(rec, "slotPool", parseSlotPool);
+    normalizeFallbackDemotions(rec);
+    const budget = rec.budget;
+    if (!isJsonObject(budget) || !isFiniteNumber(budget.spentUsd))
+        delete rec.budget;
+    if (rec.chain !== undefined && !isJsonObject(rec.chain))
+        delete rec.chain;
+    if (rec.stopsAt !== undefined && !isFiniteNumber(rec.stopsAt))
+        delete rec.stopsAt;
+    normalizeProviderHolds(rec);
+    normalizeDisk(rec);
+}
 /** Publish the running orchestrator's info file atomically (writeJsonAtomic's tmp + rename).
  * The only writer of that path, so a process killed mid-write — the orchestrator's own poll
  * publishes budget/disk/build changes while `tumwater start` in another terminal reads it to