tumwater 0.4.2 → 0.4.4

package/dist/src/budget/budget-fallback-view.js

@@ -2,23 +2,20 @@
  * event-and-verdict half (src/gates/budget-gates.ts) so the two halves each have a plain
  * function boundary and their own tests (the same split stage-path-checks.ts made of
  * stage-check.ts). This module owns everything pollBudgetGate does from its `onFallback` seam
- * through the end of the function: the seam/backends walk and used-up window moves
- * (`windowOut`, `movedBackends`, `windowMove`, `windowTiers`, `windowResumedBackends`,
- * `windowResumed`), the motion keys (`resolvedKey`, `movedKey`, `fromKey`), the two view
- * derivations (`fallbackConfig`/`directorConfig`), the `movedTiers`/`applyFallbackModel`
- * application, `chainInfo`, and the `pairs` handback list. Its one entry reads the inputs
- * pollBudgetGate's first half already resolved and returns the view fields `BudgetGatePoll`
- * carries, so pollBudgetGate keeps its call signature and src/gates/gate-polls.ts's
- * destructure of it is unchanged. The plan references the moved comments carry (part 5b/8,
- * part 5c/8, 6a/7) hold here. */
+ * through the end of the function: the seam/backends walk, the motion key (`resolvedKey`,
+ * `fromKey`), the fallback view derivation (`fallbackConfig`), `chainInfo`, and the `pairs`
+ * handback list. It no longer moves any tier for a used-up subscription window (part 5d/6): only
+ * a spent `maxDailyCostUsd` triggers a move, so the view's one job is the cap's free-seam
+ * install. Its one entry reads the inputs pollBudgetGate's first half already resolved and
+ * returns the view fields `BudgetGatePoll` carries, so pollBudgetGate keeps its call signature
+ * and src/gates/gate-polls.ts's destructure of it is unchanged. The plan references the moved
+ * comments carry (part 5b/8, part 5c/8, 6a/7) hold here. */
 import { MODEL_TIERS, } from "../config/config-schema.js";
 import { modelPairName, pairDailyCost } from "../budget/budget.js";
 import { fallbackServingPair, } from "../budget/fallback-breaker.js";
-import { applyFallbackModel, seamsInUse, tierChainSteps, tierFallbackLabels, } from "../config/config-fallbacks.js";
-import { DIRECTOR_ROLE } from "../roles/roles.js";
-import { enabledRoleIds } from "../config/config.js";
-import { formatModelSelector, seamAgent } from "../config/model-selector.js";
-import { configForRole, isTierName, reviewConfig, roleSeamTier, withModelOverrides, } from "../config/config-views.js";
+import { applyFallbackModel, tierChainSteps, } from "../config/config-fallbacks.js";
+import { seamAgent } from "../config/config-model-selector.js";
+import { withModelOverrides } from "../config/config-views.js";
 import { piPairFree, seamFree } from "../pi/pi-models.js";
 import { dayAt } from "../text/datetime.js";
 /** Can the account not take extra usage: some window is rejected, or the newest non-reset
@@ -47,225 +44,76 @@ export function subscriptionBackendOf(x, accounts) {
     const account = accounts(id);
     return account?.billing === "subscription" ? id : null;
 }
-/** Resolve the window move: whether the fallback holds, which subscription backends' used-up
- * windows move, and the motion keys the view re-derives on. Read by every phase that needs
- * the move to decide what to install. Returns the move's facts; `movedKey` stays local. */
-function resolveWindowMove(a) {
-    const { config: liveConfig, accounts, windowOutFor, priceResolved, pairNames, reached, } = a;
-    // While the fallback holds, roles run under the derived view — the free pair installed
-    // top-level and every per-role/reviewer model override dropped, so no seam can reach a priced
-    // model. A breaker-demoted fallback keeps the view too: its gate is `paused`, but a run parked
-    // in the semaphore when it tripped, the half-open probe, and the merges must still run on the
-    // free pair — a demotion must never promote them to the priced model the cap already spent.
-    const onFallback = reached && pairNames.length > 0;
-    // A used-up window moves the subscription jobs of the backend whose window stands to their
-    // tier's fallback below the cap too; with no fallback to move to, nothing changes and that
-    // backend's hold applies. Every backend with a subscription seam in the config counts
-    // (seamsInUse enumerates them: every enabled role, the reviewer, the resolver, the director,
-    // and every tier fallback step), so a used-up window with no seam on that backend (or no
-    // fallback) moves nothing.
-    const seamBackends = new Set();
-    for (const seam of seamsInUse(liveConfig)) {
-        if (seam.agent === undefined)
-            continue;
-        const acc = accounts(seam.agent);
-        if (acc?.billing === "subscription")
-            seamBackends.add(seam.agent);
-    }
-    // The used-up windows behind this poll's move, keyed by backend: a backend counts only when
-    // a subscription seam of it is in the config, its own window is used up, and there is a
-    // fallback pair to move to. `windowOut` names only those backends; a healthy or absent
-    // backend's window is untouched.
-    const windowOut = {};
-    const movedBackends = new Set();
-    for (const backend of seamBackends) {
-        const win = windowOutFor(backend);
-        if (win !== null && pairNames.length > 0) {
-            windowOut[backend] = win;
-            movedBackends.add(backend);
-        }
-    }
-    const windowMove = movedBackends.size > 0;
-    // The resolved pairs are part of the key: a priced step crossing its own daily cap changes
-    // the resolution without a config or window change, and the view must follow it.
-    const resolvedKey = MODEL_TIERS.map((t) => {
-        const rp = priceResolved[t].pair;
-        return rp ? modelPairName(rp) : "-";
-    }).join(",");
-    // The set of window-moved backends is part of the key too (not just the `w` flag): a second
-    // backend's window can come or go while the move still stands, and the view must re-derive
-    // for the roles it newly blocks or frees.
-    const movedKey = [...movedBackends].sort().join("+");
-    const fromKey = `${windowMove ? "w" : ""}${reached ? "c" : ""}|${movedKey}|${resolvedKey}`;
-    return { onFallback, windowOut, movedBackends, windowMove, resolvedKey, fromKey };
-}
-/** Install `state.fallbackConfig` when the fallback or a window move changed the view key,
- * including the pinned-role and pinned-reviewer escapes. Read by the pinned loops. */
-function installFallbackConfig(a, o) {
-    const { state, config: liveConfig, accounts, providers, catalog, priceResolved, reached } = a;
-    const { onFallback, windowMove, windowOut, movedBackends, fromKey } = o;
-    if ((onFallback || windowMove) && (state.from !== liveConfig || state.fromKey !== fromKey)) {
+/** Install `state.fallbackConfig` when the fallback changed the view key: at the cap, the free
+ * pair installed top-level and every per-role/reviewer model override dropped, so no seam can
+ * reach a priced model. A breaker-demoted fallback keeps the view too: its gate is `paused`,
+ * but a run parked in the semaphore when it tripped, the half-open probe, and the merges must
+ * still run on the free pair — a demotion must never promote them to the priced model the cap
+ * already spent. */
+function installFallbackConfig(a, fromKey) {
+    const { state, config: liveConfig, providers, catalog, accounts, priceResolved, reached } = a;
+    if (reached && (state.from !== liveConfig || state.fromKey !== fromKey)) {
         state.from = liveConfig;
         state.fromKey = fromKey;
-        // A job keeps its own model while that model is available: below the cap every seam but a
-        // subscription one whose own backend's window is used up; at the cap it must also be free.
-        const seamBlocked = (seam) => {
-            const b = subscriptionBackendOf(seam, accounts);
-            return b !== null && windowOut[b] !== undefined;
-        };
-        const available = (seam) => !seamBlocked(seam) && (!reached || seamFree(providers, seam, accounts, catalog));
-        const view = applyFallbackModel(liveConfig, priceResolved, available);
-        // A role pinned to a subscription backend under a tier of another backend has no tier pair
-        // to fall onto — dropping its override would put it on the tier's priced primary — so it
-        // keeps its pin and that backend's hold stops it, as before the window move.
-        if (movedBackends.size > 0) {
-            for (const role of enabledRoleIds(liveConfig)) {
-                const tier = roleSeamTier(liveConfig, role);
-                const pin = liveConfig.roles[role];
-                const roleBackend = subscriptionBackendOf(configForRole(liveConfig, role), accounts);
-                const tierBackend = subscriptionBackendOf(withModelOverrides(liveConfig, tier, {}), accounts);
-                if (pin && roleBackend !== null && roleBackend !== tierBackend)
-                    view.roles[role] = pin;
-            }
-            // A reviewer pinned to a subscription backend under such a tier would likewise end up on
-            // the tier's priced primary; it goes to the tier's fallback pair instead (a held reviewer
-            // would park the roles a pre-merge review gates).
-            const rm = liveConfig.review.model;
-            const reviewTier = isTierName(rm) ? rm : "strong";
-            const reviewPair = priceResolved[reviewTier].pair;
-            const reviewBackend = subscriptionBackendOf(reviewConfig(liveConfig), accounts);
-            const reviewTierBackend = subscriptionBackendOf(withModelOverrides(liveConfig, reviewTier, {}), accounts);
-            // Only the reviewer's own backend's window counts: a reviewer on a healthy backend must
-            // stay put even while another backend's window moves its tier.
-            if (reviewPair &&
-                reviewBackend !== null &&
-                windowOut[reviewBackend] !== undefined &&
-                reviewBackend !== reviewTierBackend)
-                view.review = {
-                    ...view.review,
-                    backend: reviewPair.backend ?? "pi",
-                    provider: undefined,
-                    model: formatModelSelector({
-                        provider: reviewPair.backend === undefined ? reviewPair.provider : undefined,
-                        model: reviewPair.model ?? "",
-                        thinking: reviewPair.thinking,
-                    }),
-                    thinking: undefined,
-                };
-        }
-        state.fallbackConfig = view;
-    }
-}
-/** The tiers the window move put on a fallback pair: those whose own seam is a subscription
- * backend whose window stands. */
-function deriveWindowTiers(a, windowOut, windowMove) {
-    const { config: liveConfig, accounts, priceResolved } = a;
-    // The tiers the window move put on a fallback pair: those whose own seam is a subscription
-    // backend whose window stands.
-    const windowTiers = {};
-    if (windowMove) {
-        const moved = new Set();
-        for (const tier of MODEL_TIERS) {
-            const b = subscriptionBackendOf(withModelOverrides(liveConfig, tier, {}), accounts);
-            if (b !== null && windowOut[b] !== undefined)
-                moved.add(tier);
-        }
-        const labels = tierFallbackLabels(priceResolved);
-        for (const tier of MODEL_TIERS)
-            if (moved.has(tier) && labels[tier] !== undefined)
-                windowTiers[tier] = labels[tier];
-    }
-    return windowTiers;
-}
-/** Install the director's `state.directorFrom`/`directorKey`/`directorView` and return whether
- * the director moved. */
-function installDirectorFallback(a, resolvedKey, windowOut) {
-    const { state, config: liveConfig, accounts, pairNames, directorWindowOutFor, priceResolved } = a;
-    // The director follows availability, not the cap: while the window move stands and its own
-    // model job is a subscription backend, its tier's resolved pair replaces the live config (only
-    // subscription jobs of a used-up window are unavailable, so a priced director primary keeps
-    // its model over the cap). With no fallback (windowMove false) it stays on the live config and
-    // the scheduler holds it on that backend's hold.
-    const directorBackend = subscriptionBackendOf(configForRole(liveConfig, DIRECTOR_ROLE), accounts);
-    const directorMoved = directorBackend !== null && pairNames.length > 0 && directorWindowOutFor(directorBackend) !== null;
-    if (!directorMoved)
-        state.directorFrom = null;
-    else if (state.directorFrom !== liveConfig || state.directorKey !== resolvedKey) {
-        state.directorFrom = liveConfig;
-        state.directorKey = resolvedKey;
-        state.directorView = applyFallbackModel(liveConfig, priceResolved, (seam) => {
-            const b = subscriptionBackendOf(seam, accounts);
-            return b === null || windowOut[b] === undefined;
-        });
+        // At the cap only free seams are available (a subscription claude seam is free money), so
+        // every role/reviewer override that resolves to a priced seam drops to the fallback pair.
+        const available = (seam) => seamFree(providers, seam, accounts, catalog);
+        state.fallbackConfig = applyFallbackModel(liveConfig, priceResolved, available);
     }
-    return directorMoved;
 }
-/** Fold `state.prevWindowMoved` into the resumed-backends signal and record the new move. */
-function deriveWindowResumed(a, movedBackends) {
-    const { state } = a;
-    const windowResumedBackends = [...state.prevWindowMoved].filter((b) => !movedBackends.has(b));
-    const windowResumed = windowResumedBackends.length > 0;
-    state.prevWindowMoved = movedBackends;
-    return { windowResumed, windowResumedBackends };
-}
-/** The tiers `applyFallbackModel` moved: those whose own seam fails the `available` test above.
- * Feeds the `chain` block's `moved` set. */
-function deriveMovedTiers(a, windowOut, windowMove) {
-    const { config: liveConfig, accounts, providers, catalog, reached } = a;
+/** The tiers `applyFallbackModel` moved at the cap: those whose own seam fails the `available`
+ * test above (a priced seam under a spent cap). Feeds the `chain` block's `moved` set. */
+function deriveMovedTiers(a) {
+    const { config: liveConfig, providers, accounts, catalog, reached } = a;
     const movedTiers = new Set();
-    // The tiers `applyFallbackModel` moved: those whose own seam fails the `available` test above.
     for (const tier of MODEL_TIERS) {
         const seam = withModelOverrides(liveConfig, tier, {});
-        const b = subscriptionBackendOf(seam, accounts);
-        const out = (windowMove && b !== null && windowOut[b] !== undefined) || (reached && !seamFree(providers, seam, accounts, catalog));
-        if (out)
+        if (reached && !seamFree(providers, seam, accounts, catalog))
             movedTiers.add(tier);
     }
     return movedTiers;
 }
 /** Derive the fallback view for one poll from the verdict half's already-resolved inputs
- * (`priceResolved`, `servingResolved`, `chainPairs`, `pairNames`) and the `reached` flag
- * and the shared reads (`state`, `config`, `accounts`, `windowOutFor`/`directorWindowOutFor`,
- * `providers`, `catalog`), writing the cross-poll view state (`from`/`fromKey`/`fallbackConfig`,
- * `directorFrom`/`directorKey`/`directorView`, `prevWindowMoved`) and returning the view fields
- * pollBudgetGate hands back. */
+ * (`priceResolved`, `servingResolved`, `chainPairs`, `pairNames`) and the `reached` flag and
+ * the shared reads (`state`, `config`, `accounts`, `providers`, `catalog`), writing the
+ * cross-poll view state (`from`/`fromKey`/`fallbackConfig`) and returning the view fields
+ * pollBudgetGate hands back. The director always keeps the live config (part 5d/6): with the
+ * window move gone no input moves it, so `directorConfig` is the live config by construction. */
 export function budgetFallbackView(a) {
-    const { state, config: liveConfig, now, states, providers, catalog, accounts, windowOutFor, priceResolved, servingResolved, chainPairs, } = a;
-    const { onFallback, windowOut, movedBackends, windowMove, resolvedKey, fromKey } = resolveWindowMove(a);
-    installFallbackConfig(a, { onFallback, windowMove, windowOut, movedBackends, fromKey });
-    const windowTiers = deriveWindowTiers(a, windowOut, windowMove);
-    const directorMoved = installDirectorFallback(a, resolvedKey, windowOut);
-    const { windowResumed, windowResumedBackends } = deriveWindowResumed(a, movedBackends);
-    const movedTiers = deriveMovedTiers(a, windowOut, windowMove);
+    const { state, config: liveConfig, reached, priceResolved } = a;
+    const onFallback = reached && a.pairNames.length > 0;
+    // The resolved pairs are part of the key: a priced step crossing its own daily cap changes
+    // the resolution without a config or window change, and the view must follow it.
+    const resolvedKey = MODEL_TIERS.map((t) => {
+        const rp = priceResolved[t].pair;
+        return rp ? modelPairName(rp) : "-";
+    }).join(",");
+    const fromKey = `${reached ? "c" : ""}|${resolvedKey}`;
+    installFallbackConfig(a, fromKey);
+    const movedTiers = deriveMovedTiers(a);
     const chain = chainInfo({
         config: liveConfig,
-        resolved: servingResolved,
+        resolved: a.servingResolved,
         moved: movedTiers,
         breakers: state.breakers,
-        states,
-        now,
-        windowOutFor,
-        accounts,
-        isPriced: (p) => !piPairFree(providers, p, accounts, catalog),
+        states: a.states,
+        now: a.now,
+        accounts: a.accounts,
+        isPriced: (p) => !piPairFree(a.providers, p, a.accounts, a.catalog),
     });
     return {
         onFallback,
         chain,
-        roleConfig: onFallback || windowMove ? state.fallbackConfig : liveConfig,
-        pairs: distinctPairs(priceResolved, chainPairs),
-        windowOut,
-        windowTiers,
-        windowResumed,
-        windowResumedBackends,
-        directorConfig: directorMoved ? state.directorView : liveConfig,
+        roleConfig: onFallback ? state.fallbackConfig : liveConfig,
+        pairs: distinctPairs(priceResolved, a.chainPairs),
+        directorConfig: liveConfig,
     };
 }
 /** The `chain` block: for each tier this poll moved off its primary, the step it runs on and
  * why the position before it cannot run (plans/fallback-chain.md "Events and surfaces").
  * `moved` names the tiers the poll moved; a tier the gate pauses (`pair: null`) gets no entry.
  * The reason is read from the position just before the active step — the previous chain step,
- * or the tier's primary at step 0 — in the order demoted, step-cap, window/reserve, overage,
- * cap. */
+ * or the tier's primary at step 0 — in the order demoted, step-cap, overage, cap. */
 export function chainInfo(a) {
     const out = {};
     const steps = tierChainSteps(a.config);
@@ -274,47 +122,56 @@ export function chainInfo(a) {
         const r = a.resolved[tier];
         if (!a.moved.has(tier) || r.pair === null)
             continue;
-        const own = steps.filter((s) => s.tier === (r.from ?? tier)).map((s) => s.pair);
-        const idx = r.step ?? 0;
-        const prior = idx > 0 ? own[idx - 1] : null;
-        // The backend whose used-up window this tier's chain reads for the window/reserve reason:
-        // the prior step's own backend when a prior step is subscription, else the primary's.
-        const priorSub = prior ? subscriptionBackendOf(prior, a.accounts) : null;
-        const primarySub = subscriptionBackendOf(withModelOverrides(a.config, tier, {}), a.accounts);
-        const windowBackend = (prior !== null ? priorSub : null) ?? primarySub;
-        const info = { pair: modelPairName(r.pair), step: idx + 1, of: own.length, reason: "cap" };
-        const priorName = prior ? modelPairName(prior) : "";
-        if (prior && a.breakers[priorName] !== undefined && !fallbackServingPair(a.breakers, priorName)) {
-            info.reason = "demoted";
-        }
-        else if (prior?.maxDailyCostUsd !== undefined &&
-            pairDailyCost(a.states, priorName, a.now) >= prior.maxDailyCostUsd) {
-            info.reason = "step-cap";
-            info.returnsAt = midnight;
-        }
-        else if (windowBackend !== null && a.windowOutFor(windowBackend) !== null) {
-            const win = a.windowOutFor(windowBackend);
-            info.reason = win.reserve ? "reserve" : "window";
-            info.returnsAt = win.resetsAt;
-        }
-        else if (prior &&
-            subscriptionBackendOf(prior, a.accounts) !== null &&
-            prior.extraUsage &&
-            a.accounts("claude") &&
-            claudeOverageRefused(a.accounts("claude"))) {
-            info.reason = "overage";
-        }
-        else {
-            info.returnsAt = midnight;
-        }
-        if (r.pair.maxDailyCostUsd !== undefined && a.isPriced(r.pair)) {
-            info.spentUsd = pairDailyCost(a.states, modelPairName(r.pair), a.now);
-            info.capUsd = r.pair.maxDailyCostUsd;
-        }
+        const position = movedTierPosition(steps, tier, r);
+        const info = {
+            pair: modelPairName(r.pair),
+            step: position.step,
+            of: position.of,
+            ...movedTierReason(a, position.prior, position.priorName, midnight),
+        };
+        Object.assign(info, movedTierSpend(a, r.pair));
         out[tier] = info;
     }
     return out;
 }
+/** The step a moved tier runs on and the pair just before it: the tier's own chain steps
+ * (`steps.filter((s) => s.tier === (r.from ?? tier))`) resolved to their pairs, positioned at
+ * `r.step ?? 0`, with the previous step's pair (or null at step 0). Answers "which step does
+ * this moved tier run on, and which pair precedes it?" (plans/fallback-chain.md "Events and
+ * surfaces"). */
+function movedTierPosition(steps, tier, r) {
+    const own = steps.filter((s) => s.tier === (r.from ?? tier)).map((s) => s.pair);
+    const idx = r.step ?? 0;
+    const prior = idx > 0 ? own[idx - 1] : null;
+    return { step: idx + 1, of: own.length, prior, priorName: prior ? modelPairName(prior) : "" };
+}
+/** Why the position before the active step cannot run, in INV-BN1's fixed order (demoted,
+ * step-cap, overage, cap). A demoted or overage result carries no `returnsAt`; a step-cap or
+ * cap result pins it to `midnight` (INV-BN2: local midnight only for step-cap and cap).
+ * Answers "why can't the position before the active step run, and when does it come back?". */
+function movedTierReason(a, prior, priorName, midnight) {
+    if (prior && a.breakers[priorName] !== undefined && !fallbackServingPair(a.breakers, priorName)) {
+        return { reason: "demoted" };
+    }
+    if (prior?.maxDailyCostUsd !== undefined && pairDailyCost(a.states, priorName, a.now) >= prior.maxDailyCostUsd) {
+        return { reason: "step-cap", returnsAt: midnight };
+    }
+    if (prior &&
+        subscriptionBackendOf(prior, a.accounts) !== null &&
+        prior.extraUsage &&
+        a.accounts("claude") &&
+        claudeOverageRefused(a.accounts("claude"))) {
+        return { reason: "overage" };
+    }
+    return { reason: "cap", returnsAt: midnight };
+}
+/** What the active step has spent against its own cap: both keys absent unless the step is a
+ * priced capped one (INV-BN2). Answers "what has the active step spent against its cap?". */
+function movedTierSpend(a, pair) {
+    if (pair.maxDailyCostUsd === undefined || !a.isPriced(pair))
+        return {};
+    return { spentUsd: pairDailyCost(a.states, modelPairName(pair), a.now), capUsd: pair.maxDailyCostUsd };
+}
 /** The distinct non-null fallback pairs a resolution hands out (tier order, first occurrence
  * first) — the handback match list: a reopen hands back every in-flight run on any of
  * them (part 5c/8's per-tier handback). */

package/dist/src/budget/budget-wiring.js

@@ -1,10 +1,10 @@
 import { MODEL_TIERS } from "../config/config-schema.js";
-import { publishInfoFields } from "../team/orchestrator-info.js";
+import { publishInfoFields } from "../team/team-orchestrator-info.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { fallbackDemotion } from "./fallback-breaker.js";
-import { gateRoleConfig, runOnPair, subscriptionBackendOf, } from "../gates/budget-gates.js";
-import { configForRole, roleSeamTier, withModelOverrides } from "../config/config-views.js";
+import { gateRoleConfig, runOnPair, } from "../gates/budget-gates.js";
+import { roleSeamTier } from "../config/config-views.js";
 function publishBudgetWiring(root, info, budget, view) {
     // Publish what observers cannot derive themselves: every pair's demotion — a per-tier
     // fallback can demote a pair the legacy single `fallback` never names, and a dashboard that
@@ -54,51 +54,31 @@ function publishBudgetWiring(root, info, budget, view) {
 }
 function assignRunnerBudgetConfig(runners, liveConfig, view) {
     // The director keeps the live config — an explicit human prompt outranks the
-    // autonomous-spend cap (gateRoleConfig). Assigned every poll (not only on transitions)
+    // (gateRoleConfig). Assigned every poll (not only on transitions)
     // so a runner created mid-gate, or one left behind by a broken-file poll that skipped
     // the reload, can never run on the wrong model.
     for (const r of runners) {
-        r.config = gateRoleConfig(r.role, liveConfig, view.roleConfig, view.directorConfig);
+        r.config = gateRoleConfig(r.role, liveConfig, view.roleConfig);
+        // An image reroute must never spend past the daily cap: while the gate has the team on
+        // its free fallback pairs, a reroute looks only among those pairs (plans/image-input.md
+        // "Reroute target" "Regime"). Set beside the config assignment so the scheduler's regime
+        // and the roles' never disagree.
+        r.budgetFallbackActive = view.onFallback;
     }
 }
-function handBackFallbackRuns(root, runners, liveConfig, accounts, view) {
+function handBackFallbackRuns(root, runners, view) {
     // The budget reopened: a run that started on a fallback pair keeps it until it ends, so hand
     // those runs back — abort them resumably (session and worktree edits kept) and let their next
     // run continue the same session on the primary, whose config the assignment above already
     // installed (PLANS.md 2026-09-30). Per-tier fallbacks put different roles on different pairs
-    // (part 5c/8), so the match runs over EVERY pair the price-based resolution hands out, not only
-    // one. A run started on the primary keeps running, the director is exempt, and the merges (the
-    // slot's own runs) are untouched. One event per pair names who was handed back, so the resulting
-    // aborted runs read as the budget reopening, not as unexplained failures. The subscription
-    // window reset (below the cap): the same hand-back for the pairs the window move used. A window
-    // that resets while the cap still holds hands back nothing.
-    const handBack = view.resumed || (view.windowResumedBackends.length > 0 && !view.budgetActive);
-    // The window handback names the backend whose window resumed (the entry's goal) — not the
-    // handed-back pair's own backend: for claude-only the fallback pair carries no backend (it would
-    // read undefined), and with two subscription backends it would name the opposite one. A pair
-    // belongs to those resumed backends whose tiers' price-resolved pair it is.
-    const resumedBackendSet = new Set(view.windowResumedBackends);
-    const resumedBackendForPair = (leftPair) => {
-        for (const tier of MODEL_TIERS) {
-            const p = view.priceResolved[tier]?.pair;
-            if (p && p.provider === leftPair.provider && p.model === leftPair.model) {
-                const b = subscriptionBackendOf(withModelOverrides(liveConfig, tier, {}), accounts);
-                if (b !== null && resumedBackendSet.has(b))
-                    return b;
-            }
-        }
-        return undefined;
-    };
-    if (handBack && view.pairs.length > 0) {
-        // A cap reopen while the window is still used up leaves the window's tiers on their
-        // fallback pairs: handing those runs back would abort them to restart on the same pair.
-        const stillMoved = Object.keys(view.windowTiers).flatMap((t) => {
-            const p = view.priceResolved[t].pair;
-            return p ? [p] : [];
-        });
+    // (part 5c/8), so the match runs over EVERY pair the price-based resolution hands out, not
+    // only one. A run started on the primary keeps running, the director is exempt, and the merges
+    // (the slot's own runs) are untouched. One event per pair names who was handed back, so the
+    // resulting aborted runs read as the budget reopening, not as unexplained failures. The
+    // subscription-window reset below the cap handed back too, but that move is gone (part 5d/6):
+    // only the cap reopen hands back now.
+    if (view.resumed && view.pairs.length > 0) {
         for (const leftPair of view.pairs) {
-            if (stillMoved.some((p) => p.provider === leftPair.provider && p.model === leftPair.model))
-                continue;
             const matching = runners.filter((r) => r.role !== DIRECTOR_ROLE && runOnPair(r.runModelPair(), leftPair));
             if (matching.length > 0) {
                 logEventBestEffort(root, {
@@ -107,9 +87,6 @@ function handBackFallbackRuns(root, runners, liveConfig, accounts, view) {
                     roles: matching.map((r) => r.role),
                     provider: leftPair.provider,
                     model: leftPair.model,
-                    ...(view.resumed
-                        ? {}
-                        : { reason: "window", backend: resumedBackendForPair(leftPair) }),
                 });
                 for (const r of matching)
                     r.handBackRun();
@@ -120,43 +97,30 @@ function handBackFallbackRuns(root, runners, liveConfig, accounts, view) {
 /** Perform the budget gate's wiring for one poll, exactly as `pollTeamGates` did inline:
  * publish the demotions and the switch/serve info fields, log the one `fallback_switched`
  * transition event per tier change, assign every runner's config and cap flag, and hand
- * in-flight fallback runs back on a cap reopen or window reset. */
+ * in-flight fallback runs back on a cap reopen. */
 export function applyBudgetGateWiring(input) {
-    const { root, runners, liveConfig, info, accounts, budget, view } = input;
+    const { root, runners, liveConfig, info, budget, view } = input;
     publishBudgetWiring(root, info, budget, view);
     assignRunnerBudgetConfig(runners, liveConfig, view);
-    handBackFallbackRuns(root, runners, liveConfig, accounts, view);
+    handBackFallbackRuns(root, runners, view);
 }
-/** The per-tier budget pause subject sets (part 5c/8), computed exactly as `pollTeamGates` did
+/** The per-tier budget pause subject set (part 5c/8), computed exactly as `pollTeamGates` did
  * inline: `budgetPausedRoles` holds every role whose model tier resolved to no usable free pair
- * while the cap is reached, and `windowMovedRoles` the role whose own subscription backend owns
- * a used-up window's moved tier. The director is exempt (as under every autonomous gate), a role
- * below the cap is held only when it was window-moved, and the demoted pair's probe pierces the
- * set for its own tier's roles only — probeRoles in the orchestrator's scheduling pass. */
+ * while the cap is reached. The window-moved set is gone (part 5d/6): below the cap nothing
+ * pauses on a usage window anymore. The director is exempt (as under every autonomous gate),
+ * and the demoted pair's probe pierces the set for its own tier's roles only — probeRoles in
+ * the orchestrator's scheduling pass. */
 export function budgetPausedSubjects(input) {
-    const { runners, liveConfig, accounts, budgetActive, servingResolved, windowTiers } = input;
+    const { runners, liveConfig, budgetActive, servingResolved } = input;
     const budgetPausedRoles = new Set();
-    const windowMovedRoles = new Set();
-    const movedTiers = Object.keys(windowTiers);
-    // The backend whose used-up window moved a given tier: the tier's own seam's backend — the same
-    // read budget-gates made to put it in `windowTiers`. A role on a moved tier whose own backend is
-    // DIFFERENT (a healthy backend riding the same tier) keeps its pair: only the role whose own
-    // backend owns the out window is moved.
-    const tierMovedBackend = (tier) => subscriptionBackendOf(withModelOverrides(liveConfig, tier, {}), accounts);
     for (const r of runners) {
         if (r.role === DIRECTOR_ROLE)
             continue;
         const tier = roleSeamTier(liveConfig, r.role);
-        // A role pinned to the moved tier's own subscription backend keeps it through the window move
-        // (it is not on a pair); a role on the same tier pinning a healthy backend does not.
-        if (movedTiers.includes(tier) &&
-            subscriptionBackendOf(configForRole(liveConfig, r.role), accounts) === tierMovedBackend(tier))
-            windowMovedRoles.add(r.role);
-        // Below the cap only a window-moved role can sit on a demoted fallback.
-        if (!budgetActive && !windowMovedRoles.has(r.role))
+        if (!budgetActive)
             continue;
         if (servingResolved[tier].pair === null)
             budgetPausedRoles.add(r.role);
     }
-    return { budgetPausedRoles, windowMovedRoles };
+    return { budgetPausedRoles };
 }

package/dist/src/budget/budget.js

@@ -152,11 +152,10 @@ export function modelPairName(p) {
  * `strong` tiers resolved to a usable free pair (resolveTierFallbacks over the full usable
  * predicate — price AND breaker serving) — plus whether the review gate is on. The gate is
  * `paused` when `default` resolves to pause (nothing for the team's bulk to run on), or when
- * review is on and `strong` does (nothing could merge for the roles a pre-merge review gates, so
- * their authoring runs are wasted work — a `review.afterMerge` role's is not);
- * `fallback` otherwise, with the tiers that did resolve running their pairs and the rest held
- * per role. The single definition of the gate: the orchestrator enforces it and both dashboards
- * display it, so what an operator sees is what the scheduler is doing. */
+ * review is on and `strong` does; `fallback` otherwise, with the tiers that did resolve running
+ * their pairs and the rest held per role. This is the value the dashboards display; the
+ * orchestrator's role holds come from the per-tier set `budgetPausedRoles` (a tier whose own
+ * pair did not resolve), not from a reviewer-derived team-wide pause. */
 export function budgetGate(reached, tiers, reviewOn) {
     if (!reached)
         return "open";

package/dist/src/budget/fallback-breaker.js

@@ -114,8 +114,8 @@ export function recordFallbackRun(b, ranOn, result, probe, now, policy = FALLBAC
     return { ...b, failures, probeAt: now + policy.cooldownMs, cooldownMs: policy.cooldownMs, probing: false };
 }
 /** What orchestrator.json publishes while the breaker holds the fallback demoted
- * (team/orchestrator-info.ts's OrchestratorInfo.fallbackDemoted). Observers need it because the
- * price check alone would advertise the demoted pair as a working fallback —
+ * (team/team-orchestrator-info.ts's OrchestratorInfo.fallbackDemoted). Observers need
+ * it because the price check alone would advertise the demoted pair as a working fallback —
  * status/status-data.ts nulls the snapshot's `fallback` from it and `tumwater doctor` names it.
  * Undefined while the fallback is trusted or not engaged. */
 export function fallbackDemotion(b) {