tumwater 0.4.2 → 0.4.4

package/dist/src/verdict/fix-claim.js

@@ -42,12 +42,19 @@
  *   heading.
  * - A `path:line` location (`status-roles.ts:66`) was checked as a symbol, and no file is named
  *   that. A location now claims its file, a bare line reference (`:368`) claims nothing, and a
- *   bare file name is backed by a file of that name anywhere in the walked source dirs. */
+ *   bare file name is backed by a file of that name anywhere in the walked source dirs.
+ *
+ * Another false positive (BUGS.md 2026-10-29): a commit id was checked as a symbol, and no code
+ * file ever spells one. A dropped post-merge review is filed as a bug whose whole fix is a review
+ * of the commit, so the Fix paragraph cites `17c0bbbc…` and nothing else — and six bugfix runners
+ * resubmitted that close 29 times in five hours, each rejected the same way. A commit id is now
+ * backed when it names a commit in the repository (withoutKnownCommits); a made-up one is still
+ * rejected. */
 import { existsSync, lstatSync, readFileSync, statSync } from "node:fs";
 import { extname, join } from "node:path";
 import { readTextOrNull, statOrNull, walkFiles } from "../files/files.js";
 import { fenceTracker, finishedArchiveOf, parseEntryDetails, sectionLines, trailingParenthetical, } from "../backlog/backlog-md.js";
-import { changeBaseRev, fileContentAt } from "../git/git.js";
+import { changeBaseRev, commitExists, fileContentAt } from "../git/git.js";
 import { collapseWhitespace, truncate } from "../text/text.js";
 /** How much of a one-line record a rejection quotes: the record is one line by construction but
  * can run to several hundred characters, and the reason rides in a one-line event. */
@@ -263,12 +270,13 @@ function sourceHaystackSignature(root) {
     sigs.sort();
     return sigs.join("|");
 }
-/** Every file under the source dirs the haystack reads (src/, test/, scripts/), node_modules and
- * dist trees skipped at any depth. */
+/** Every file under the tree the haystack reads — the whole root, so a project whose code lives
+ * outside src//test//scripts/ (tools/, tests/, lib/, …) backs its symbols like a src/ one — with
+ * build output, vendored code, VCS and harness state skipped at any depth: node_modules, dist,
+ * .git and .tumwater. */
 function walkSourceFiles(root, visit) {
-    const skipDirs = new Set(["node_modules", "dist"]);
-    for (const dir of ["src", "test", "scripts"])
-        walkFiles(join(root, dir), visit, skipDirs);
+    const skipDirs = new Set(["node_modules", "dist", ".git", ".tumwater"]);
+    walkFiles(root, visit, skipDirs);
 }
 /** A slash-free name with a file extension: `status-roles.ts`, not `src/a.ts` or `signalTree`. */
 const FILE_NAME_RE = /^[^/]+\.[A-Za-z][\w-]*$/;
@@ -292,28 +300,42 @@ export function unbackedSymbols(root, symbols, haystack) {
         return !fileNames.has(s);
     });
 }
+/** A commit id as a Fix paragraph cites one: 7 to 40 lowercase hex digits, optionally cut short
+ * with a trailing ellipsis (`3c1c1c6176...`). Group 1 is the id itself. */
+const COMMIT_REF_RE = /^([0-9a-f]{7,40})(?:\.\.\.|…)?$/;
+/** Whether a Fix-paragraph span is shaped like a commit id: a citation of history rather than a
+ * name code could hold. The doctor's synchronous scan cannot ask git, so it leaves these out of a
+ * record's names; the gate checks them with withoutKnownCommits. */
+export function isCommitRef(span) {
+    return COMMIT_REF_RE.test(span);
+}
+/** `missing` without the commit ids that name a commit in the repository at `wt`. No code file
+ * ever spells a commit id, so the haystack could never back one: a Fix paragraph citing the
+ * commit it reviewed or landed in read as a phantom fix. An id that names no commit stays
+ * missing, so an invented one is still rejected. */
+export async function withoutKnownCommits(wt, missing) {
+    const out = [];
+    for (const name of missing) {
+        const sha = COMMIT_REF_RE.exec(name)?.[1];
+        if (sha === undefined || !(await commitExists(wt, sha)))
+            out.push(name);
+    }
+    return out;
+}
 /** The unbacked names for a one-line message: all of them when 3 or fewer, otherwise the
  * first 3 and an ellipsis — a doctor check or gate message has room for one line. */
 export function missingSymbolNames(missing) {
     return missing.length <= 3 ? missing.join(", ") : `${missing.slice(0, 3).join(", ")}…`;
 }
-/** The first false-fix claim in an md-only diff that touches BUGS.md, or undefined when the
- * diff backs its Fixed transitions (or makes none). `files` is the ahead-of-main path list
- * of the diff merging on `mainBranch`; the worktree `wt` holds the tree being merged. */
-export async function falseFixReason(wt, mainBranch, files) {
-    // Fixed entries live in BUGS.md's own section and in its archive, BUGS-FIXED.md
-    // (plans/backlog-archive.md): tumwater moves a fixed bug there right before the commit, so a
-    // fix claim reaches the gate as an archive edit, and an archived entry whose body is intact
-    // is no claim at all. Both sides of the comparison read both files.
-    if (!files.includes("BUGS.md") && !files.includes(BUGS_ARCHIVE))
-        return undefined;
-    // A deleted, unreadable, or non-regular (symlinked) file reads as empty: there is no Fixed
-    // transition to verify, so this check passes and lets the gate's sibling structural check
-    // (backlog-structure.ts) report the dropped section. Reading a symlink raw would pull an
-    // outside host file's `## Fixed` heading into this gate's verdict (the same lstat policy the
-    // backlog-conflict resolver and backlogStructureReason pin under INV-G3), so a head is read
-    // only when lstat shows a regular file; ENOENT and symlinks both read as empty.
-    const heads = ["BUGS.md", BUGS_ARCHIVE].map((f) => {
+/** The `## Fixed` heads of BUGS.md and its archive as read under the lstat policy: a deleted,
+ * unreadable, or non-regular (symlinked) file reads as empty — there is no Fixed transition to
+ * verify, so the gate's sibling structural check (backlog-structure.ts) reports the dropped
+ * section instead. Reading a symlink raw would pull an outside host file's `## Fixed` heading
+ * into the gate's verdict (the same lstat policy the backlog-conflict resolver and
+ * backlogStructureReason pin under INV-G3), so a head is read only when lstat shows a regular
+ * file; ENOENT and symlinks both read as empty. */
+function readFixedHeads(wt) {
+    return ["BUGS.md", BUGS_ARCHIVE].map((f) => {
         const full = join(wt, f);
         try {
             if (!lstatSync(full).isFile())
@@ -324,40 +346,40 @@ export async function falseFixReason(wt, mainBranch, files) {
         }
         return readTextOrNull(full) ?? "";
     });
-    if (!heads.some((head) => head.includes("## Fixed")))
-        return undefined;
-    // The diff's own base, not main's tip: the gate diffs `mainBranch...HEAD` against the
-    // merge-base, and the entry's Open/Fixed state lives in the tree the change builds on —
-    // pre-batch main can still carry the record as (falsely) Fixed and make an Open→Fixed
-    // restoration in a stacked batch compare as already done (BUGS.md 2026-09-23).
+}
+/** The base Fixed section bodies the diff's own merge-base holds, keyed by normalized heading.
+ * The base is the diff's own merge-base, not main's tip: the gate diffs `mainBranch...HEAD`
+ * against the merge-base, and the entry's Open/Fixed state lives in the tree the change builds
+ * on — pre-batch main can still carry the record as (falsely) Fixed and make an Open→Fixed
+ * restoration in a stacked batch compare as already done (BUGS.md 2026-09-23). Every base body
+ * under a heading counts: two distinct entries can share one normalized heading, and keeping
+ * only the last made the other read as rewritten (BUGS.md 2026-10-23). */
+async function baseFixedBodies(wt, mainBranch) {
     const baseRev = await changeBaseRev(wt, mainBranch);
     const bases = [await fileContentAt(wt, baseRev, "BUGS.md"), await fileContentAt(wt, baseRev, BUGS_ARCHIVE)];
-    // An already-Fixed entry is skipped only when its body is unchanged: an md-only edit that
-    // rewrites an existing Fixed record's narrative must face the symbol check too (BUGS.md
-    // 2026-09-23 — the in-place narrative rewrite is how a second phantom merge evaded it).
-    // Every base body under a heading counts: two distinct entries can share one normalized
-    // heading, and keeping only the last made the other read as rewritten (BUGS.md 2026-10-23).
-    const baseBodies = new Map();
+    const bodies = new Map();
     for (const e of bases.flatMap((base) => fixedEntries(base))) {
         const key = normalizeFixedHeading(e.title);
-        const bodies = baseBodies.get(key) ?? new Set();
-        bodies.add(e.body);
-        baseBodies.set(key, bodies);
+        const known = bodies.get(key) ?? new Set();
+        known.add(e.body);
+        bodies.set(key, known);
     }
-    // Built lazily, only once a Fixed record's body actually changed: the haystack walks and
-    // reads the entire source tree (~5 MB here), and the common BUGS.md edit moves nothing to
-    // Fixed — an Open bug added, a narrative touched elsewhere — so the gate and the in-lock
-    // recheck each paid that walk for a check that never reached a symbol.
-    let haystack;
-    const sections = heads.map((head) => fixedSection(head));
-    const entries = sections.flatMap((section) => section.entries);
-    const records = sections.flatMap((section) => section.records);
+    return { bases, bodies };
+}
+/** A changed full Fixed entry's rejection, or undefined when every changed entry backs its
+ * symbols. An already-Fixed entry is skipped only when its body is unchanged: an md-only edit
+ * that rewrites an existing Fixed record's narrative must face the symbol check too (BUGS.md
+ * 2026-09-23 — the in-place narrative rewrite is how a second phantom merge evaded it). The
+ * haystack is built lazily — only once a Fixed record's body actually changed — because it
+ * walks and reads the entire source tree (~5 MB here), and the common BUGS.md edit moves
+ * nothing to Fixed: an Open bug added, a narrative touched elsewhere, so the gate and the
+ * in-lock recheck each paid that walk for a check that never reached a symbol. */
+async function movedEntryReason(wt, entries, bodies, getHaystack) {
     for (const { title: heading, body } of entries) {
-        const knownBodies = baseBodies.get(normalizeFixedHeading(heading));
+        const knownBodies = bodies.get(normalizeFixedHeading(heading));
         if (knownBodies?.has(body))
             continue;
-        haystack ??= sourceHaystack(wt);
-        const missing = unbackedSymbols(wt, fixSymbols(body), haystack);
+        const missing = await withoutKnownCommits(wt, unbackedSymbols(wt, fixSymbols(body), getHaystack()));
         if (missing.length === 0)
             continue;
         const names = missingSymbolNames(missing);
@@ -372,10 +394,15 @@ export async function falseFixReason(wt, mainBranch, files) {
                 `paragraph now names code that exists nowhere on this tree: ${names} — include that ` +
                 `code in the same commit, or leave the entry's text as it was`;
     }
-    // One-line records are compressions of entries the base already holds as Fixed, and history
-    // keeps a renamed symbol's old name, so a record the diff adds or edits may carry forward any
-    // name the base's Fixed section already records. A name it introduces must exist on the tree:
-    // a bug moved straight from Open into a one-line record faces the same check as a full entry.
+    return undefined;
+}
+/** An added or edited one-line Fixed record's rejection, or undefined when each record either
+ * reproduces a base line or carries only names the base already holds. One-line records are
+ * compressions of entries the base already holds as Fixed, and history keeps a renamed symbol's
+ * old name, so a record the diff adds or edits may carry forward any name the base's Fixed
+ * section already records. A name it introduces must exist on the tree: a bug moved straight
+ * from Open into a one-line record faces the same check as a full entry. */
+async function addedRecordReason(wt, records, bases, getHaystack) {
     const baseLines = bases.flatMap((base) => sectionLines(base, "Fixed")).map((line) => line.trim());
     const seen = new Set(baseLines);
     const baseText = baseLines.join("\n");
@@ -385,8 +412,7 @@ export async function falseFixReason(wt, mainBranch, files) {
         const introduced = fixSymbols(record).filter((symbol) => !baseText.includes(symbol));
         if (introduced.length === 0)
             continue;
-        haystack ??= sourceHaystack(wt);
-        const missing = unbackedSymbols(wt, introduced, haystack);
+        const missing = await withoutKnownCommits(wt, unbackedSymbols(wt, introduced, getHaystack()));
         if (missing.length === 0)
             continue;
         return (`md-only BUGS.md edit adds the one-line Fixed record "${truncate(record, RECORD_QUOTE_MAX)}", ` +
@@ -396,3 +422,28 @@ export async function falseFixReason(wt, mainBranch, files) {
     }
     return undefined;
 }
+/** The first false-fix claim in an md-only diff that touches BUGS.md, or undefined when the
+ * diff backs its Fixed transitions (or makes none). `files` is the ahead-of-main path list
+ * of the diff merging on `mainBranch`; the worktree `wt` holds the tree being merged. */
+export async function falseFixReason(wt, mainBranch, files) {
+    // Fixed entries live in BUGS.md's own section and in its archive, BUGS-FIXED.md
+    // (plans/backlog-archive.md): tumwater moves a fixed bug there right before the commit, so a
+    // fix claim reaches the gate as an archive edit, and an archived entry whose body is intact
+    // is no claim at all. Both sides of the comparison read both files.
+    if (!files.includes("BUGS.md") && !files.includes(BUGS_ARCHIVE))
+        return undefined;
+    const heads = readFixedHeads(wt);
+    if (!heads.some((head) => head.includes("## Fixed")))
+        return undefined;
+    const { bases, bodies } = await baseFixedBodies(wt, mainBranch);
+    const sections = heads.map((head) => fixedSection(head));
+    const entries = sections.flatMap((section) => section.entries);
+    const records = sections.flatMap((section) => section.records);
+    // Built lazily, shared by both checks, only once a Fixed record's body actually changed: the
+    // haystack walks and reads the entire source tree (~5 MB here), and the common BUGS.md edit
+    // moves nothing to Fixed — an Open bug added, a narrative touched elsewhere — so the gate and
+    // the in-lock recheck each paid that walk for a check that never reached a symbol.
+    let haystack;
+    const getHaystack = () => (haystack ??= sourceHaystack(wt));
+    return (await movedEntryReason(wt, entries, bodies, getHaystack)) ?? (await addedRecordReason(wt, records, bases, getHaystack));
+}

package/dist/src/verdict/refusal.js

@@ -106,7 +106,7 @@ async function stripBlockedPlanRefusalNotes(ctx, wt) {
             // and a plain writeFileSync that a kill interrupted would commit a truncated file,
             // permanently dropping the plan entries past the cut point. writeTextAtomic is the
             // harness's one write-to-temp-then-rename entry point — the same one backlog-write.ts
-            // and question-answer.ts use for the markdown backlog files.
+            // and backlog-question-answer.ts use for the markdown backlog files.
             try {
                 writeTextAtomic(plansFile, md);
                 for (const title of dropped) {

package/dist/src/verdict/reply-contract.js

@@ -74,10 +74,9 @@ export const REPLY_ENDINGS = `- End with exactly ONE of these three endings:
 ${SUMMARY_BLOCK.replace(/^ {2}/gm, "     ")}`;
 /** The review gate's closing rule as stated to pi: the two accepted verdict forms and the
  * numbered-reasons line that must follow them. buildReviewPrompt (gate-prompts.ts) ends its
- * rules list with this, and the gate's two same-session follow-ups (buildVerdictRequestPrompt,
- * buildNoRerunPrompt) re-state it — one home, so the advertised pair is edited in one place
- * instead of drifting between the three prompts. Indentation is the caller's: the review prompt
- * indents both lines, the two follow-ups indent only the VERDICT line. The machine detector for
+ * rules list with this — one home, so the advertised pair is edited in one place
+ * instead of drifting between the prompts. Indentation is the caller's: the review prompt
+ * indents both lines. The machine detector for
  * these forms lives beside it (VERDICT_LINE_SOURCE below); gate-prompts.test.ts pins the forms
  * buildReviewPrompt advertises against what parseVerdict accepts. */
 export const VERDICT_ENDING = `VERDICT: approve   or   VERDICT: reject

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tumwater",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Opinionated autonomous development harness built on pi. You write the initial prompt; role-driven loops build the project.",
   "type": "module",
   "license": "MIT",
@@ -37,10 +37,10 @@
     "build": "rm -rf dist && tsc && node scripts/stamp-build.mjs",
     "prepack": "npm run build",
     "lint": "eslint . --cache",
-    "test": "node scripts/live-checkout-guard.mjs && eslint . --cache && tsc --incremental && node scripts/stamp-build.mjs && node dist/test/test-runner.js",
-    "test:gate": "node scripts/live-checkout-guard.mjs && eslint . --cache && tsc --incremental && node scripts/stamp-build.mjs && node dist/test/test-runner.js --affected",
-    "test:e2e": "node scripts/live-checkout-guard.mjs && tsc --incremental && node scripts/stamp-build.mjs && node dist/test/test-runner.js e2e",
-    "test:coverage": "node scripts/live-checkout-guard.mjs && tsc --incremental && node scripts/stamp-build.mjs && node dist/test/test-runner.js --coverage",
+    "test": "node scripts/live-checkout-guard.mjs && eslint . --cache && tsc --incremental && node scripts/stamp-build.mjs && node scripts/check-permit.mjs node dist/test/test-runner.js",
+    "test:gate": "node scripts/live-checkout-guard.mjs && tsc --incremental && node scripts/stamp-build.mjs && node scripts/lint-changed.mjs && node scripts/check-permit.mjs node dist/test/test-runner.js --affected --budget=30",
+    "test:e2e": "node scripts/live-checkout-guard.mjs && tsc --incremental && node scripts/stamp-build.mjs && node scripts/check-permit.mjs node dist/test/test-runner.js e2e",
+    "test:coverage": "node scripts/live-checkout-guard.mjs && tsc --incremental && node scripts/stamp-build.mjs && node scripts/check-permit.mjs node dist/test/test-runner.js --coverage",
     "smoke:claude": "node scripts/smoke-claude.mjs",
     "smoke:opencode": "node scripts/smoke-opencode.mjs",
     "smoke:codex": "node scripts/smoke-codex.mjs",

package/dist/src/concurrency/provider-lease.js

@@ -1,105 +0,0 @@
-/** The AsyncLocalStorage store that lets a run's lease follow its runs across providers
- * (plans/provider-concurrency.md §5): a lease rides here for the length of a run, a verify task,
- * or a resolver run, and `RunnerPi.runWithTransientRetry` re-keys it to the provider each run
- * actually uses. The one choke point every run a role makes (authoring, gate, merge and resolver)
- * passes through, so a budget handback or a model-failure switch that moves a run in flight to
- * another provider moves the lease with it instead of leaving it parked on the key it was admitted
- * on. The check-permit.ts `holdingPermit` store is the pattern: nothing here is a separate permit,
- * only the single lease the run path already holds.
- *
- * The store carries the `piDefault` (the caller's cached readPiDefaultModel result) beside the
- * lease so `ensureProviderLease` can resolve a bare no-model pi seam's key exactly as the
- * admission/review seam did — a run whose key were computed without it would re-key a default
- * team's run off pi's own provider. It also carries the semaphore and, optionally, wait
- * hooks, so a re-key that has to park on a full target key reports its wait the way a parked
- * resolver does (merge-verify.ts's providerWaitStage). */
-import { AsyncLocalStorage } from "node:async_hooks";
-import { seamConcurrencyKey } from "../config/config-views.js";
-const providerLeaseStore = new AsyncLocalStorage();
-/** Run `run` with `lease` in the provider-lease store, so any run it makes re-keys that lease to
- * the provider it actually uses (ensureProviderLease). `opts.piDefault` is the caller's cached pi
- * default model, so a bare no-model seam resolves to the same key the admission or review seam
- * used; `opts.hooks` (the verify: providerWaitStage) hears a re-key wait, if there is one. The same
- * lease object is released by the caller after the store is unwrapped — a re-key mutates it in
- * place, so release() frees whatever key the run path ended on. */
-export function withProviderLease(lease, semaphore, run, opts = {}) {
-    return providerLeaseStore.run({ lease, semaphore, piDefault: opts.piDefault, hooks: opts.hooks }, run);
-}
-/** Re-key the calling lease to the provider `cfg` runs on, if it is not there yet. No-op when
- * the current async context carries no lease (a direct RunnerPi unit test, `tumwater history`) or
- * when the run is already on the lease's key. When it does re-key and `hooks` are present and
- * the target key is at its cap, the hooks hear `waiting` before the lease parks and `granted`
- * once the key frees — a re-key never waits on the team total (it already holds a team
- * permit), only on the target key's headroom. */
-export async function ensureProviderLease(cfg) {
-    const ctx = providerLeaseStore.getStore();
-    if (!ctx)
-        return;
-    const key = seamConcurrencyKey(cfg, ctx.piDefault);
-    if (ctx.lease.key === key)
-        return;
-    // The leased currently holds `old` (or nothing); the target key's in-use does not include it,
-    // so the key being at its cap is exactly whether rekey() will park.
-    const parks = ctx.hooks !== undefined && keyAtCap(ctx, key);
-    if (parks)
-        ctx.hooks.waiting();
-    await ctx.lease.rekey(key);
-    if (parks)
-        ctx.hooks.granted();
-}
-/** Whether `key` is at its configured cap right now (an absent or uncapped key is not) — the
- * same test semaphore.drive uses to withhold a re-key grant, decided from the live snapshot so
- * a re-key wait can be announced before the lease parks (providerWaitStage). */
-function keyAtCap(ctx, key) {
-    if (key === undefined)
-        return false;
-    const entry = ctx.semaphore.snapshot().byKey[key];
-    return entry?.limit !== undefined && entry.inUse >= entry.limit;
-}
-/** The pool-slot wait rule (plans/provider-concurrency.md §5 "No deadlock"): a lease never holds a
- * provider key while it waits for a worktree pool slot. Called by leaseSlot just before it parks on
- * a busy pool; it re-keys the calling lease to no key (which never waits), so a run or verify
- * waiting for a slot does not hold — and cannot deadlock — a provider slot whose in-use a re-key
- * waiter is waiting to drain. No-op without a lease in context. */
-export async function dropProviderLeaseKey() {
-    const ctx = providerLeaseStore.getStore();
-    if (!ctx)
-        return;
-    await ctx.lease.rekey(undefined);
-}
-/** Run `wait`, an idle stretch inside the calling lease's work, with the lease's team permit and
- * key slot handed back (SemaphoreLease.pause), so a parked run can use them meanwhile, then take
- * them back (resume) before returning. A failed review's in-place retry pause is the caller: with
- * one team permit, a reviewer that kept failing held it through two 30 s pauses and starved every
- * other role. Once `signal` has fired, nothing is taken back and the caller's release() settles a
- * still-paused lease. No-op without a lease in context. */
-export async function idleWithoutProviderLease(wait, signal) {
-    const ctx = providerLeaseStore.getStore();
-    if (!ctx)
-        return wait();
-    ctx.lease.pause();
-    try {
-        await wait();
-    }
-    finally {
-        if (!signal?.aborted)
-            await untilAborted(ctx.lease.resume(), signal);
-    }
-}
-/** `p`, or an earlier return once `signal` fires: a resume parked on a full team must not keep an
- * aborted verification waiting for a permit it no longer needs. */
-async function untilAborted(p, signal) {
-    if (!signal)
-        return p;
-    let onAbort = () => { };
-    const aborted = new Promise((resolve) => {
-        onAbort = resolve;
-        signal.addEventListener("abort", onAbort, { once: true });
-    });
-    try {
-        await Promise.race([p, aborted]);
-    }
-    finally {
-        signal.removeEventListener("abort", onAbort);
-    }
-}

package/dist/src/review/review-followup.js

@@ -1,87 +0,0 @@
-import { backendSessionResumable } from "../agent/agent-backend.js";
-import { reviewRunConfig, resolvedBackendConfig } from "../config/config-views.js";
-import { logEventBestEffort, warnEventBestEffort } from "../events/events.js";
-import { nativeLogPath, piLogPath } from "../paths.js";
-import { buildNoRerunPrompt, buildVerdictRequestPrompt } from "../prompt/gate-prompts.js";
-import { cappedRequestTimeouts } from "../request-timeouts.js";
-/** Hard caps on the VERDICT follow-up turn: it should take one short reply on a warm session,
- * so it never gets the review run's own budget (mirrors RunnerPi's SUMMARY-request caps). */
-const VERDICT_REQUEST_TIMEOUT_S = 900;
-const VERDICT_REQUEST_QUIET_S = 300;
-/** One bounded follow-up turn on the reviewer's just-finished session: the shared session
- * guard, capped budgets, and runGatePi wiring behind requestVerdict and requestNoRerun —
- * exactly two call sites, differing only in prompt, session name, label, and (the nudge only)
- * a started-tool-call collector. Null when there is no session to continue. */
-async function runFollowupTurn(ctx, opts) {
-    const dir = ctx.sessionDir;
-    const cfg = reviewRunConfig(ctx.config);
-    // The verdict/re-run follow-up continues the review session the gate just wrote. The
-    // backend's own resumable rule keeps a newer line of another kind from being the session a
-    // pi continue would actually reach; claude resumes its recorded id (looked up under the
-    // team's config dir, so a team that set one continues under it).
-    if (!backendSessionResumable(dir, { kind: "gate", agent: cfg.agent ?? "pi" }, resolvedBackendConfig(ctx.config, "claude").configDir)) {
-        return null;
-    }
-    return ctx.runGatePi({
-        cwd: ctx.wt,
-        kind: "gate",
-        prompt: opts.prompt,
-        config: {
-            ...cfg,
-            ...cappedRequestTimeouts(cfg, VERDICT_REQUEST_TIMEOUT_S, VERDICT_REQUEST_QUIET_S),
-        },
-        sessionDir: dir,
-        // The whole point: continue the just-finished review's session, which already holds
-        // everything the reviewer read and concluded.
-        continueSession: true,
-        sessionName: opts.sessionName,
-        rawLogFile: piLogPath(ctx.root, ctx.role),
-        nativeLogFile: nativeLogPath(ctx.root, ctx.role, cfg.agent ?? "pi"),
-        label: opts.label,
-        signal: ctx.signal,
-        onToolCallStalled: (message) => warnEventBestEffort(ctx.root, ctx.role, message),
-        // A gate run that read an image its model cannot see is logged, not killed (plans/
-        // image-input.md "Detecting a blind read") — same shape as the main review run in
-        // review.ts.
-        onBlindRead: (path, action) => logEventBestEffort(ctx.root, {
-            source: ctx.role,
-            type: "image_blind",
-            run: ctx.runNumber,
-            path,
-            model: cfg.model,
-            action,
-        }),
-        ...(opts.onToolCallStart ? { onToolCallStart: opts.onToolCallStart } : {}),
-    });
-}
-/** Ask the reviewer's own session (--continue) for the missing VERDICT line: one tightly
- * bounded turn on the just-finished review's session, mirroring RunnerPi.requestSummary on the
- * author side (BUGS.md 2026-09-29). Null when there is no session to continue — the caller
- * then counts the strike exactly as before. The run is returned even when it failed so the
- * caller can honor a shutdown abort and fold the spend. */
-export async function requestVerdict(ctx) {
-    return runFollowupTurn(ctx, {
-        prompt: buildVerdictRequestPrompt(),
-        sessionName: `tumwater-review-${ctx.role}-${ctx.runNumber}-verdict`,
-        label: "review-verdict",
-    });
-}
-/** The suite-rerun nudge (BUGS.md 2026-10-02): the reviewer broke the no-re-run rule, so one
- * tightly bounded turn on the just-finished review's session names the exact tool call and
- * asks it to finish without re-running. Mirrors requestVerdict (same caps); `calls` collects
- * the nudge turn's own started tool calls so the caller can detect a repeat. Null when there
- * is no session to continue — the caller then has no repeat evidence, only the warning. The
- * run is returned even when it failed so the caller can honor a shutdown abort and fold the
- * spend. */
-export async function requestNoRerun(ctx, rerun, calls) {
-    return runFollowupTurn(ctx, {
-        prompt: buildNoRerunPrompt(rerun),
-        sessionName: `tumwater-review-${ctx.role}-${ctx.runNumber}-rerun`,
-        label: "review-rerun",
-        // Collected unconditionally: a nudge only runs after a detected rerun, so the no-re-run
-        // rule stood and the repeat check below needs every call the nudge started.
-        onToolCallStart: (toolName, args) => {
-            calls.push({ toolName, args });
-        },
-    });
-}