tumwater 0.4.2 → 0.4.4

package/dist/src/team/team-polls.js

@@ -1,12 +1,9 @@
-import { errorStorm, errorStormKnob } from "./error-storm.js";
+import { errorStorm, errorStormKnob } from "./team-error-storm.js";
 import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { teamHold, TEAM_OPEN } from "./team-hold.js";
-import { claudeWindowUsedUp, windowReserved } from "../agent/claude/claude-account.js";
 import { sortedRoles } from "../failure/failure-cluster.js";
-import { FAILURE_SPREAD_WINDOW_MS, failureSpread } from "./failure-spread.js";
+import { FAILURE_SPREAD_WINDOW_MS, failureSpread } from "./team-failure-spread.js";
 import { groupBy } from "../collections.js";
-import { eventsSince } from "../events/event-window.js";
-import { DAY_MS } from "../text/datetime.js";
 /** The HoldObservation list both team-wide failure polls step their reducer with, gathered
  * from each runner's two episodic fields: lastRateLimit (stamped "rate-limit", carrying the
  * server's retry-after when present) and lastBackendFailure. One copy of that flatMap so the
@@ -37,15 +34,14 @@ function holdObservations(runners) {
  * heldProviders() (until non-null), never bare key presence: a lifted hold must never
  * keep blocking. Events carry the provider when one is configured (an undefined provider
  * — pi's default — omits it, so an unconfigured team's events render exactly as before).
- * `windowTiers` is the budget poll's window move (tier → the pair its work went to), stamped on
- * the subscription window's limited event. `observations` is the per-subscription-backend hold
- * observations (one per backend in use; part 2e passes them), each stamped by the caller from
- * its account via windowObservation — the account's own `claudeWindowReserve`: crossings held
- * like a rejected window (but never the director) log pollClaudeWindowReserve's event instead
- * of the limited one. Returns the new map for the caller to keep. Exported as a unit-test
- * seam, like its sibling polls below. */
-export function pollTeamHold(root, prev, runners, now, observations = [], windowTiers = {}) {
-    const steps = [...holdObservations(runners), ...observations];
+ * Each provider's hold observations come only from its runners (holdObservations): the
+ * per-backend subscription-account observations and their subscription-window crossing
+ * events were removed with their last reader (Subtract parts 5u/6, 5w/6 and 5x/6), so the
+ * hold poll logs only the rate-limit/backend-failure hold events. Returns the new map for
+ * the caller to keep.
+ * Exported as a unit-test seam, like its sibling polls below. */
+export function pollTeamHold(root, prev, runners, now) {
+    const steps = holdObservations(runners);
     const byProvider = groupBy(steps, (o) => o.provider);
     const next = new Map();
     // Every provider the map already knows, plus every provider this poll observed: a hold
@@ -55,195 +51,51 @@ export function pollTeamHold(root, prev, runners, now, observations = [], window
         const pPrev = prev.get(provider) ?? { ...TEAM_OPEN, provider };
         const pNext = teamHold(pPrev, byProvider.get(provider) ?? [], now);
         next.set(provider, pNext);
-        const providerFields = provider === undefined ? {} : { provider };
-        // The subscription-window observation (if any) for THIS provider: the window that opened
-        // (or would open) its hold, whose window type the limited event names. The events' backend
-        // is the provider itself (a subscription-window hold always carries a string provider — a
-        // rejected window or reserve crossing never keys the undefined-pi default) — the reset, in
-        // particular, fires after the window's observation has already gone (the account flipped to
-        // reset), so it cannot read its backend back from a still-present observation.
-        const subObs = byProvider.get(provider)?.find((o) => o.kind === "subscription-window");
-        const limitedEvent = () => {
-            // The subscription window's own crossing event, once per rejected window rather than
-            // once per failure storm. It names the window type and the deadline the hold lifts at.
-            logEventBestEffort(root, {
-                source: TUMWATER_SOURCE,
-                type: "subscription_window_limited",
-                backend: provider,
-                ...providerFields,
-                windowType: subObs?.windowType,
-                resetsAt: pNext.until,
-                // Where each moved tier's work went (the budget poll's window move); absent when
-                // nothing moved, so a no-fallback team's event is today's.
-                ...(Object.keys(windowTiers).length > 0 ? { tiers: windowTiers } : {}),
-            });
-        };
-        if (pPrev.until !== null && pPrev.kind === "subscription-window" && pPrev.reserve === true &&
-            pNext.until !== null && pNext.kind === "subscription-window" && pNext.reserve !== true) {
-            // A reserve hold hardened into a rejected window: the operator hears the limit now.
-            limitedEvent();
-        }
-        else if (pPrev.until === null && pNext.until !== null) {
-            if (pNext.kind === "subscription-window" && pNext.reserve === true) {
-                // A reserve crossing logs subscription_window_reserved (pollClaudeWindowReserve), not this.
-            }
-            else if (pNext.kind === "subscription-window") {
-                limitedEvent();
-            }
-            else {
-                logEventBestEffort(root, {
-                    source: TUMWATER_SOURCE,
-                    type: "rate_limit_hold",
-                    ...providerFields,
-                    kind: pNext.kind,
-                    roles: pNext.roles,
-                    holdMs: pNext.until - now,
-                    escalation: pNext.escalation,
-                });
-            }
+        if (pPrev.until === null && pNext.until !== null) {
+            logHoldStart(root, provider, pNext, now);
         }
         else if (pPrev.until !== null && pNext.until === null) {
-            if (pNext.kind === "subscription-window") {
-                logEventBestEffort(root, { source: TUMWATER_SOURCE, type: "subscription_window_reset", backend: provider, ...providerFields });
-            }
-            else {
-                // The ended hold's kind rides the resumed event: the hold's own event names its kind, so
-                // the lift must be able to name what actually ended too — "429 hold lifted" after a
-                // connection-error hold is the same lie the hold line's kind split removed
-                // (BUGS.md 2026-09-29).
-                logEventBestEffort(root, {
-                    source: TUMWATER_SOURCE,
-                    type: "rate_limit_resumed",
-                    ...providerFields,
-                    kind: pNext.kind,
-                });
-            }
+            logHoldEnd(root, provider, pNext);
         }
     }
     return next;
 }
-/** The hold observation one subscription account's usage windows imply, or null: a window
- * reading `rejected` with no overage and a future `resetsAt` holds every seam on provider
- * `backend` until the last such deadline — the account-level throttle of plans/agent-backends.md
- * §8. Only subscription billing produces one: an API-billed run's windows never hold (the plan's
- * "API claude seams run"), and a missing account file reads exactly as today's behavior. The
- * reader has already flipped a past-`resetsAt` window to `reset`, and the `resetsAt > now` guard
- * here lets the hold lift on its own even from a stale file. */
-export function windowObservation(backend, account, now, reserve) {
-    const furthest = claudeWindowUsedUp(account, now, false, reserve);
-    if (furthest === null)
-        return null;
-    return {
-        role: backend,
-        provider: backend,
-        kind: "subscription-window",
-        at: now,
-        windowType: furthest.type,
-        resetsAt: furthest.resetsAt,
-        ...(furthest.reserve === true ? { reserve: true } : {}),
-    };
-}
-/** A claude usage window is open for at most `seven_day`, so any window still open was logged
- * within this span of the event log. */
-const CLAUDE_WINDOW_LOOKBACK_MS = 7 * DAY_MS;
-/** The `backend:windowType:resetsAt` keys of the still-open windows whose `type` event is already
- * in the event log, so a restart does not re-announce a window that is still open. Keyed by the
- * event's own `backend` (falling back to `"claude"` for an event written before the window
- * events carried one), so two backends' windows of the same type and reset instant keep their
- * own keys. Events without a numeric `resetsAt` cannot name their window and are skipped. */
-export function loggedWindowKeys(root, type, now) {
-    const keys = new Set();
-    for (const e of eventsSince(root, CLAUDE_WINDOW_LOOKBACK_MS, now, (ev) => ev.type === type)) {
-        if (typeof e.windowType === "string" && typeof e.resetsAt === "number" && e.resetsAt > now) {
-            keys.add(`${typeof e.backend === "string" ? e.backend : "claude"}:${e.windowType}:${e.resetsAt}`);
-        }
-    }
-    return keys;
-}
-/** Log each subscription-window event once per window key. The reserve and the warning polls
- * (below) both walk every window of the account and log one event for each that crosses its mark
- * this poll, deduplicated by the `backend:type:resetsAt` key so many polls across one window log
- * once (a later window's crossing is its own key). They differ only in WHICH window marks (the
- * reserve fraction vs the `allowed_warning` status) and the event's payload, so the traversal, the
- * "reset instant already past" skip, the key build, the key dedup, and the returned-set contract
- * live here and each caller supplies the mark-and-payload predicate (`eventFor` returns the event
- * to log, or null to skip that window). The returned set drops keys whose reset instant has passed,
- * and is `logged` itself when nothing was added or dropped. */
-function logWindowEventOnce(root, logged, account, now, backend, eventFor) {
-    if (account?.billing !== "subscription")
-        return logged;
-    let next = null;
-    for (const key of logged) {
-        const suffix = key.slice(key.lastIndexOf(":") + 1);
-        if (suffix !== "" && Number(suffix) <= now)
-            (next ??= new Set(logged)).delete(key);
-    }
-    for (const [type, w] of Object.entries(account.windows)) {
-        const ev = eventFor(type, w);
-        if (ev === null)
-            continue;
-        // A window whose reset instant is in the past (or unreadable) no longer marks a crossing.
-        if (typeof w.resetsAt === "number" && w.resetsAt <= now)
-            continue;
-        // Keyed by this poll's backend (the `backend:windowType:resetsAt` shape loggedWindowKeys
-        // seeds), so a different backend's identical window keeps its own key. The backend rides
-        // the event, stamped here so each caller's event needs no backend of its own.
-        const key = `${backend}:${type}:${w.resetsAt ?? ""}`;
-        if ((next ?? logged).has(key))
-            continue;
-        logEventBestEffort(root, { ...ev, backend });
-        (next ??= new Set(logged)).add(key);
-    }
-    return next ?? logged;
-}
-/** One poll of the reserve crossing: each window at or past its windowReserve fraction (read
- * through `windowReserveFor(config, "claude")`) logs `subscription_window_reserved` once per
- * window key (`backend:type:resetsAt`, kept in `logged`), so several windows crossing in one
- * poll each log their own event. Returns the keys to keep. */
-export function pollClaudeWindowReserve(root, logged, account, now, backend, reserve) {
-    if (reserve === undefined)
-        return logged;
-    return logWindowEventOnce(root, logged, account, now, backend, (type, w) => {
-        const fraction = reserve[type];
-        if (!windowReserved(w, fraction) || typeof w.resetsAt !== "number")
-            return null;
-        return {
-            source: TUMWATER_SOURCE,
-            type: "subscription_window_reserved",
-            windowType: type,
-            utilization: w.utilization,
-            reserve: fraction,
-            resetsAt: w.resetsAt,
-        };
+/** The quiet→held crossing event: a provider whose hold just opened logs one `rate_limit_hold`
+ * naming the kind, the roles, how long it holds (until the re-open), and the escalation depth.
+ * The provider is carried only when one is configured (an undefined provider — pi's default —
+ * omits it, so an unconfigured team's events render exactly as before). */
+function logHoldStart(root, provider, pNext, now) {
+    logEventBestEffort(root, {
+        source: TUMWATER_SOURCE,
+        type: "rate_limit_hold",
+        ...(provider === undefined ? {} : { provider }),
+        kind: pNext.kind,
+        roles: pNext.roles,
+        holdMs: pNext.until - now,
+        escalation: pNext.escalation,
     });
 }
-/** One poll of the subscription-window warning: each `allowed_warning` window logs
- * `subscription_window_warning` once per window key (`backend:type:resetsAt`, kept in `logged`;
- * carrying the window's utilization when the account reported one), so many polls across one
- * window warn once and several windows warning in one poll each log their own event. Returns
- * the keys to keep. */
-export function pollClaudeWindowWarning(root, logged, account, now, backend) {
-    return logWindowEventOnce(root, logged, account, now, backend, (type, w) => {
-        if (w.status !== "allowed_warning")
-            return null;
-        return {
-            source: TUMWATER_SOURCE,
-            type: "subscription_window_warning",
-            windowType: type,
-            ...(typeof w.utilization === "number" ? { utilization: w.utilization } : {}),
-            ...(typeof w.resetsAt === "number" ? { resetsAt: w.resetsAt } : {}),
-        };
+/** The held→quiet lift event: a provider whose hold just re-opened logs one `rate_limit_resumed`.
+ * The ended hold's kind rides the resumed event: the hold's own event names its kind, so the
+ * lift must be able to name what actually ended too — "429 hold lifted" after a
+ * connection-error hold is the same lie the hold line's kind split removed (BUGS.md 2026-09-29). */
+function logHoldEnd(root, provider, pNext) {
+    logEventBestEffort(root, {
+        source: TUMWATER_SOURCE,
+        type: "rate_limit_resumed",
+        ...(provider === undefined ? {} : { provider }),
+        kind: pNext.kind,
     });
 }
-/** One poll of the team-wide error-storm warning (src/team/error-storm.ts): gather each runner's
- * current error streak (RunnerState.consecutiveErrors/lastError — the same fields the per-role
- * "consecutive run failures" warning reads, the director's included, since its failures are
- * the team's evidence too), step the pure reducer, and log exactly one warning per episode,
+/** One poll of the team-wide error-storm warning (src/team/team-error-storm.ts): gather each
+ * runner's current error streak (RunnerState.consecutiveErrors/lastError — the same fields the
+ * per-role "consecutive run failures" warning reads, the director's included, since its failures
+ * are the team's evidence too), step the pure reducer, and log exactly one warning per episode,
  * like the per-role warning's once-per-streak-crossing shape: on the quiet→storm crossing,
- * naming the roles, the shared normalized cause, and the config knob when the cause has one
- * (a team timing out together means runTimeoutSeconds does not fit the serving model).
- * Storms clear silently — the members' own recoveries already tell that story — and the
- * reducer's `prev` pass-through keeps a held storm event-free. Returns the new storm for the
+ * naming the roles, the shared normalized cause, and the config knob when the cause has one (a
+ * team timing out together means runTimeoutSeconds does not fit the serving model). Storms clear
+ * silently — the members' own recoveries already tell that story — and the reducer's `prev`
+ * pass-through keeps a held storm event-free. Returns the new storm for the
  * caller to keep. Exported as a unit-test seam, like pollTeamHold above. */
 export function pollErrorStorm(root, prev, runners) {
     const observations = runners.map((r) => ({
@@ -267,15 +119,15 @@ export function pollErrorStorm(root, prev, runners) {
     }
     return next;
 }
-/** One poll of the team-wide wide-shallow storm alarm (src/team/failure-spread.ts): gather each
- * runner's latest provider-failure observations — the same two the team hold reads, the
- * director's included, since its failures are the team's evidence too — step the pure
- * reducer, and log exactly one warning per episode: on the quiet→active crossing (and again
- * when a DIFFERENT kind becomes the episode while one is sounding, the reducer's new-episode
- * rule), naming the failure count, the kind, the window, and the roles behind it. The wiring
- * keys its log off active/kind, not object identity — `recent` moves almost every poll, so
- * unlike the hold's poll there is no prev pass-through to compare. Exported as a unit-test
- * seam, like pollTeamHold above. */
+/** One poll of the team-wide wide-shallow storm alarm (src/team/team-failure-spread.ts): gather
+ * each runner's latest provider-failure observations — the same two the team hold reads, the
+ * director's included, since its failures are the team's evidence too — step the pure reducer,
+ * and log exactly one warning per episode: on the quiet→active crossing (and again when a
+ * DIFFERENT kind becomes the episode while one is sounding, the reducer's new-episode rule),
+ * naming the failure count, the kind, the window, and the roles behind it. The wiring keys its
+ * log off active/kind, not object identity — `recent` moves almost every poll, so unlike the
+ * hold's poll there is no prev pass-through to compare. Exported as a unit-test seam, like
+ * pollTeamHold above. */
 export function pollFailureSpread(root, prev, runners, now) {
     const observations = holdObservations(runners);
     const next = failureSpread(prev, observations, now);

package/dist/src/team/{reclaim.js → team-reclaim.js}

@@ -6,14 +6,14 @@
  * an interrupted run's uncommitted edits survive.
  *
  * The candidate list and the guard that keeps a clean off the primary checkout live here; the
- * in-use half lives in src/git/worktree-use.ts and the hold half in src/gates/disk-gate.ts. */
+ * in-use half lives in src/git/worktree-use.ts and the hold half in src/gates/disk-gates.ts. */
 import path from "node:path";
 import { HOUR_MS } from "../text/datetime.js";
 import { worktreesDir } from "../paths.js";
 import { git, gitTry } from "../git/git-run.js";
 import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { loadRunnerState } from "../runner/runner-state-load.js";
-import { BYTES_PER_GB, sampleFreeBytes } from "../gates/disk-gate.js";
+import { BYTES_PER_GB, sampleFreeBytes } from "../gates/disk-gates.js";
 import { subdirectoryNames } from "../files/files.js";
 import { claimForReclaim, isReclaimInProgress, isWorktreeInUse, readWorktreeUse, releaseReclaim, updateWorktreeUse, } from "../git/worktree-use.js";
 /** Worktree basenames that pressure reclaim never touches: the self-hosting mirrors the
@@ -126,55 +126,85 @@ async function cleanIgnored(dir) {
     const out = await git(dir, "clean", "-fdX");
     return out.split("\n").some((line) => line.startsWith("Removing "));
 }
-/** Clean pressure candidates until free space reaches `reclaimGB`, re-sampling after each, and
- * log exactly one `disk_reclaim` when anything was cleaned. `idle` mode ignores the threshold
- * and walks every candidate once (part 3/4). Returns null when nothing was reclaimed. */
-export async function reclaimPass(root, mode, opts) {
-    const sample = opts.sample ?? sampleFreeBytes;
-    const candidates = opts.candidates ?? reclaimCandidates(root);
-    const startedAt = Date.now();
-    const before = sample(root);
+/** True when a pressure or manual pass should stop: the sampler reports free space at or
+ * above `reclaimGB`. A null sample (sampling failed) is not the floor, so it keeps reclaiming. */
+function pressureFloorReached(free, reclaimGB) {
+    return free !== null && reclaimGB > 0 && free >= reclaimGB * BYTES_PER_GB;
+}
+/** Clean one candidate, treating a guard failure as a skip, not a reason to abort the pass. */
+async function reclaimOneCandidate(root, candidate) {
+    try {
+        return await reclaimWorktree(root, candidate.dir);
+    }
+    catch {
+        // A guard failure (a directory that stopped being a linked worktree) is not a reason to
+        // abort the pass; the remaining candidates are still safe to clean.
+        return false;
+    }
+}
+/** Walk the candidates once, collecting the ones actually cleaned. Idle mode keeps only the
+ * `isIdleExpired` candidates and never re-samples; pressure and manual modes re-sample before
+ * each and stop once the pressure floor is reached. */
+async function collectReclaimed(root, candidates, mode, idleHours, reclaimGB, sample, startedAt) {
     const cleaned = [];
     for (const candidate of candidates) {
         if (mode === "idle") {
-            if (!isIdleExpired(candidate, opts.idleHours ?? 0, startedAt))
+            if (!isIdleExpired(candidate, idleHours, startedAt))
                 continue;
         }
-        else {
-            const free = sample(root);
-            if (free !== null && opts.reclaimGB > 0 && free >= opts.reclaimGB * BYTES_PER_GB)
-                break;
-        }
-        try {
-            if (await reclaimWorktree(root, candidate.dir))
-                cleaned.push(candidate.name);
-        }
-        catch {
-            // A guard failure (a directory that stopped being a linked worktree) is not a reason to
-            // abort the pass; the remaining candidates are still safe to clean.
+        else if (pressureFloorReached(sample(root), reclaimGB)) {
+            break;
         }
+        if (await reclaimOneCandidate(root, candidate))
+            cleaned.push(candidate.name);
     }
-    if (cleaned.length === 0)
-        return null;
-    const after = sample(root);
+    return cleaned;
+}
+/** Freed space as the before/after free-space difference, clamped at zero: another writer can
+ * consume space during the pass, and a negative "freed" would render as nonsense in the event
+ * and the digest. A null sample keeps the zero fallback. */
+function reclaimFreedGB(before, after) {
+    return before !== null && after !== null ? Math.max(0, (after - before) / BYTES_PER_GB) : 0;
+}
+/** The pass result: the cleaned worktrees, the clamped freed and current free figures, and the
+ * pass duration. `freeGB` falls back to whichever sample we have when the other is null. */
+function buildReclaimResult(cleaned, before, after, startedAt) {
     const freeBytes = after ?? before ?? 0;
-    const result = {
+    return {
         worktrees: cleaned,
-        // Clamped: another writer can consume space during the pass, and a negative "freed"
-        // would render as nonsense in the event and the digest.
-        freedGB: before !== null && after !== null ? Math.max(0, (after - before) / BYTES_PER_GB) : 0,
+        freedGB: reclaimFreedGB(before, after),
         freeGB: freeBytes / BYTES_PER_GB,
         durationMs: Date.now() - startedAt,
     };
+}
+/** Log exactly one `disk_reclaim` event with the result's figures. */
+function logReclaim(root, mode, result) {
     logEventBestEffort(root, {
         source: TUMWATER_SOURCE,
         type: "disk_reclaim",
         mode,
-        worktrees: cleaned,
+        worktrees: result.worktrees,
         freedGB: result.freedGB,
         freeGB: result.freeGB,
         durationMs: result.durationMs,
     });
+}
+/** Clean pressure candidates until free space reaches `reclaimGB`, re-sampling after each, and
+ * log exactly one `disk_reclaim` when anything was cleaned. `idle` mode ignores the threshold
+ * and walks every candidate once (part 3/4). Returns null when nothing was reclaimed. */
+export async function reclaimPass(root, mode, opts) {
+    const sample = opts.sample ?? sampleFreeBytes;
+    const candidates = opts.candidates ?? reclaimCandidates(root);
+    const startedAt = Date.now();
+    const before = sample(root);
+    // With no candidates the pass resolves synchronously (no re-sampling or cleaning to await),
+    // so a no-live-team Ctrl+E flashes "nothing to reclaim" within the caller's same turn.
+    const cleaned = candidates.length === 0 ? [] : await collectReclaimed(root, candidates, mode, opts.idleHours ?? 0, opts.reclaimGB, sample, startedAt);
+    if (cleaned.length === 0)
+        return null;
+    const after = sample(root);
+    const result = buildReclaimResult(cleaned, before, after, startedAt);
+    logReclaim(root, mode, result);
     return result;
 }
 /** Dry run: every reclaim candidate with its idle age and what `git clean -ndX` would remove,

package/dist/src/team/team-state.js

@@ -1,7 +1,6 @@
-import fs from "node:fs";
 import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
 import { finiteNumber, stringList } from "../files/json-object.js";
-import { removeQuiet } from "../files/files.js";
+import { removeIfPresent, removeQuiet } from "../files/files.js";
 import { withStateLock } from "../concurrency/lock.js";
 import { collapseWhitespace, truncate } from "../text/text.js";
 import { pausedPath, pausedRolesLockPath, pausedRolesPath, scheduledStopPath } from "../paths.js";
@@ -128,15 +127,11 @@ export function pauseTeam(root, untilMs, reason) {
     return true;
 }
 /** Resume the team by removing its marker (a no-op if absent); returns whether a marker was
- * there to lift, mirroring pauseTeam's changed-state contract. Uses removeQuiet's
+ * there to lift, mirroring pauseTeam's changed-state contract. Uses removeIfPresent's
  * never-throws delete: a marker vanishing between the check and the unlink is success, not a
  * failure worth surfacing from a toggle. */
 export function resumeTeam(root) {
-    const marker = pausedPath(root);
-    if (!fs.existsSync(marker))
-        return false;
-    removeQuiet(marker);
-    return true;
+    return removeIfPresent(pausedPath(root));
 }
 /** Schedule a graceful team stop at `untilMs` (epoch ms): `tumwater stop --in`. Overwrites the
  * marker, so the last write wins. */
@@ -156,11 +151,7 @@ export function scheduledStopAt(root) {
 }
 /** Drop the scheduled stop; returns whether a marker was there (resumeTeam's contract). */
 export function cancelScheduledStop(root) {
-    const marker = scheduledStopPath(root);
-    if (!fs.existsSync(marker))
-        return false;
-    removeQuiet(marker);
-    return true;
+    return removeIfPresent(scheduledStopPath(root));
 }
 /** The roles the operator has individually paused (`tumwater pause --role <id>`): a role in
  * this set starts no new runs — in-flight ones finish, every other role keeps running, the

package/dist/src/text/datetime.js

@@ -98,7 +98,7 @@ export function daysBetween(fromKey, toKey) {
         const [y = 0, m = 1, d = 1] = key.split("-").map(Number);
         return Date.UTC(y, m - 1, d);
     };
-    return Math.round((utc(toKey) - utc(fromKey)) / 86_400_000);
+    return Math.round((utc(toKey) - utc(fromKey)) / DAY_MS);
 }
 /** The `MM-DD` half of a `YYYY-MM-DD` day key (dayKey/formatDate): the redundant year
  * dropped for a line whose date lies inside the current window. Shared by the failure
@@ -168,15 +168,24 @@ export function humanSeconds(s) {
 export function humanUntil(atMs, now) {
     return humanSeconds(secondsUntil(atMs, now));
 }
-/** `humanUntil`'s past-direction twin: how long since an epoch-ms instant, as `NS ago` —
- * the past-direction phrase five renderers each built as `{humanSeconds(secondsSince(...))} ago`
- * (status-render.ts's ago against the real clock, role-render.ts's last-run and
- * merge-queue-render.ts's enqueue ages, inbox.ts's queued-age suffix, and doctor-notify.ts's
- * latest-failed-page age, which had inlined the clamp itself), so the clamp, the rounding,
+/** Human duration since a past epoch-ms instant, as a bare span — "how long ago" without
+ * the ` ago` wording: the `humanUntil` past-direction twin, collapsing the four sites that
+ * spelled the two-step `humanSeconds(secondsSince(...))` composition out (merge-queue-render.ts's
+ * merge and stage elapseds and doctor-backlog.ts's stale-queue and inbox-prompt waits), so the
+ * s/m/h/d bucketing cannot drift per consumer. Lives here beside the other time phrasing. */
+export function humanSince(sinceMs, now) {
+    return humanSeconds(secondsSince(sinceMs, now));
+}
+/** `humanSince`'s past-direction phrase with the ` ago` suffix: how long since an epoch-ms
+ * instant, as `NS ago` — the phrase five renderers each built as
+ * `{humanSeconds(secondsSince(...))} ago` (status-render.ts's ago against the real clock,
+ * role-render.ts's last-run and merge-queue-render.ts's enqueue ages, inbox.ts's queued-age
+ * suffix, and doctor-notify.ts's latest-failed-page age, which had inlined the clamp itself),
+ * so the clamp, the rounding,
  * and the " ago" wording cannot drift per consumer. Lives here beside the other time
  * phrasing so core modules (which may not import src/ui) share the same form. */
 export function humanAgo(sinceMs, now) {
-    return `${humanSeconds(secondsSince(sinceMs, now))} ago`;
+    return `${humanSince(sinceMs, now)} ago`;
 }
 /** A compact age clamped at zero and floored to whole units — `12m`, `4h`, `6d` — the bare
  * (no `ago`) parenthetical the `qa` coverage block and the `feedback` "previously filed" block

package/dist/src/text/markdown.js

@@ -22,7 +22,7 @@ export function markdownTable(header, rows, align = []) {
  * the `map((item, i) => `${i + 1}. ${item}`).join("\n")` step, shared by the review prompt's
  * prior objections, its stage-fix findings, and the rejected/revision notes
  * (prompt/gate-notes.ts), `tumwater questions`' open-question list
- * (backlog/question-answer.ts) and `tumwater wake --list`'s wake lines
+ * (backlog/backlog-question-answer.ts) and `tumwater wake --list`'s wake lines
  * (operator/operator-intent.ts `renderWakeList`), so the numbering shape cannot drift between
  * those surfaces (the TUI queued-prompt rows and the merge queue rows number their own
  * lines). `empty` is returned verbatim when `items` is empty

package/dist/src/text/phrases.js

@@ -25,8 +25,9 @@ export const PREFILL_REASON = "it rides into every run's prefill";
  * drift across the four surfaces that show just that first reason: the review gate's returned
  * detail (review.ts), the event feed's one-line reject (event-format.ts), the failure digest's
  * rejection clusters (failure-data.ts), and the error a role's next run records (run-apply.ts).
- * Sites that render the whole reason list, or intentionally omit the fallback (time-spend.ts's
- * first-reason example, review.ts's rejection event `reason`), keep their own handling. */
+ * Sites that render the whole reason list, or intentionally omit the fallback
+ * (failure-time-spend.ts's first-reason example, review.ts's rejection event `reason`), keep
+ * their own handling. */
 export function firstReason(reasons) {
     const first = reasons?.[0];
     return typeof first === "string" ? first : NO_REASONS_GIVEN;
@@ -169,6 +170,15 @@ export function rolesPhrase(roles, fallback, max, format = String) {
         list.length = Math.min(list.length, max);
     return list.length > 0 ? list.join(", ") : fallback;
 }
+/** The trailing-day median-and-extreme clause every doctor timing row renders — `… median, …
+ * slowest|longest (N unit)` — the one home of that bucketing, shared by the `check` row's
+ * checkDurationPhrase ("passing merge checks … took … slowest") and the `merge queue` row's
+ * mergeWaitPhrase ("merges … waited … longest"), so the `shortSpanPhrase` median/extreme shape
+ * cannot drift between them. Each caller supplies its own verbed prefix ("took"/"waited", the
+ * one differing word) and the extreme's label and unit. */
+export function trailingDayMedianPhrase(medianMs, extremeMs, extreme, n, unit) {
+    return `${shortSpanPhrase(medianMs)} median, ${shortSpanPhrase(extremeMs)} ${extreme} (${plural(n, unit)})`;
+}
 /** The `$<spent> of $<cap>` fragment every budget-transition event renders — the one home of that
  * phrasing, shared by the event feed (event-format.ts) and the failure digest's Team state changes
  * lines (src/failure/failure-state-change.ts), so a budget transition reads the same on both
@@ -241,6 +251,21 @@ function withoutLeadingCd(command) {
         rest = rest.replace(LEADING_CD, "");
     return rest.trim() ? rest : command;
 }
+/** The first present candidate string in a tool call's args, or "" when none is a string.
+ * The read order — path, file_path, command, cmd, pattern, url — is the order INV-AE4 pins. */
+function toolCallCandidate(args) {
+    const candidate = args.path ?? args.file_path ?? args.command ?? args.cmd ?? args.pattern ?? args.url;
+    return typeof candidate === "string" ? candidate : "";
+}
+/** How one candidate reads as a detail: a path-like key reduces to its file name, a
+ * command-like key drops a leading `cd`, and any other key shows verbatim. */
+function toolCallDetail(candidate, args) {
+    if (candidate === args.path || candidate === args.file_path)
+        return path.basename(candidate);
+    if (candidate === args.command || candidate === args.cmd)
+        return withoutLeadingCd(candidate);
+    return candidate;
+}
 /** One-line description of a tool call from its name and args — shared by live progress data
  * collection (LiveProgress.lastTool), transcript rendering, and the harness's stalled-tool-call
  * warning (src/pi/pi-stream.ts builds the label src/pi/pi-watchdogs.ts renders). Path-like keys
@@ -248,19 +273,8 @@ function withoutLeadingCd(command) {
  * is dropped from a command, because the run's cwd is implied and the path would use up the
  * 32-character budget. */
 export function describeToolCall(toolName, args) {
-    let detail = "";
-    if (isJsonObject(args)) {
-        const candidate = args.path ?? args.file_path ?? args.command ?? args.cmd ?? args.pattern ?? args.url;
-        if (typeof candidate === "string") {
-            detail =
-                candidate === args.path || candidate === args.file_path
-                    ? path.basename(candidate)
-                    : candidate === args.command || candidate === args.cmd
-                        ? withoutLeadingCd(candidate)
-                        : candidate;
-        }
-    }
-    detail = squash(detail, 32);
+    const raw = isJsonObject(args) ? toolCallDetail(toolCallCandidate(args), args) : "";
+    const detail = squash(raw, 32);
     // An empty name (pi omits toolName on some start events) yields the bare detail — no
     // leading space in front of it.
     return detail ? (toolName ? `${toolName} ${detail}` : detail) : toolName;

package/dist/src/text/suggest.js

@@ -21,7 +21,7 @@ function editDistance(a, b) {
 }
 /** The candidate closest to a mistyped `input` by case-insensitive edit distance, or null
  * when nothing is close enough to suggest: the "did you mean" behind typo'd command names
- * (help.ts) and config keys (config-write.ts, config-commands.ts, config-validation's
+ * (help.ts) and config keys (config-write.ts, cli-config-commands.ts, config-validation's
  * checkKnownKeys/checkKnownRoleId). Capped at `maxDistance`
  * (two edits by default — a typo's distance, not a different word's), so only a near miss
  * gets a hint and the suggestion can never fire as an auto-correction; the caller still