tumwater 0.4.3 → 0.4.4

package/README.md

@@ -42,7 +42,7 @@ and is also outside `npm test`.
 ## Status
 
 <!-- tumwater:status:start -->
-**v0.4.3**: working tumwater. The director and 15 of the 17 roles are enabled by default; `selfcheck`,
+**v0.4.4**: working tumwater. The director and 15 of the 17 roles are enabled by default; `selfcheck`,
 which files tumwater bugs from tumwater's own event log, and `feedback`, which files them as GitHub
 issues on znation/tumwater, are opt-in (`roles.selfcheck.enabled`, `roles.feedback.enabled`).
 

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "sha": "45348f61e3e060de873bbd10ce8cdea30e4102d6",
-  "builtAt": 1793264084617,
+  "sha": "1f6978ed5d8061b12afc907b017f0164426f49ee",
+  "builtAt": 1793345933702,
   "root": "/home/runner/work/tumwater/tumwater"
 }

package/dist/src/agent/agent-run.js

@@ -107,6 +107,7 @@ export function runAgent(opts) {
             const wd = startPiWatchdogs({
                 progressCount: () => parser.progressCount,
                 openToolCalls: () => parser.openToolCalls,
+                pendingReply: () => parser.pendingReply,
                 runTimeoutMs: opts.config.runTimeoutSeconds * 1000,
                 quietMs: opts.config.quietTimeoutSeconds * 1000,
                 stallMs: Math.max(0, opts.config.toolCallStallSeconds) * 1000,
@@ -120,7 +121,7 @@ export function runAgent(opts) {
                 // deadline stays right for them.
                 extendOnProgress: opts.kind === "gate",
                 kill: () => terminateChild(child),
-                onToolCallStalled: opts.onToolCallStalled,
+                onStallWarning: opts.onStallWarning,
             });
             let aborted = false;
             // A blind image read on an authoring run deliberately kills it, like the watchdogs do.

package/dist/src/agent/claude/claude-account.js

@@ -2,8 +2,8 @@
  * subscription-account.ts) — which billing pays for claude runs, and the newest subscription
  * usage-window reading each run reported (plans/agent-backends.md §7 "Billing" and §8 "The
  * subscription usage window"). Persisted at `.tumwater/state/claude-account.json`, written only
- * by the orchestrator process, so the sibling parts that throttle or display the subscription
- * window (6b/7–6e/7) read one answer instead of re-deriving it per surface.
+ * by the orchestrator process, so the sibling parts read one answer instead of re-deriving it
+ * per surface.
  *
  * Everything here is a thin wrapper over the generic per-backend store (found
  * grounds/codex-backend.md "Groundwork: the subscription account is per backend", item 1),
@@ -17,7 +17,7 @@ import { spawnSync } from "node:child_process";
 import os from "node:os";
 import { resolvedBackendConfig } from "../../config/config-views.js";
 import { parseJsonObject } from "../../files/json-object.js";
-import { observeAccount, readAccount, subscriptionWindowRejected, windowEntries, windowLabel, windowReserved, windowUsedUp, writeAccount, } from "../subscription-account.js";
+import { observeAccount, readAccount, subscriptionWindowRejected, writeAccount, } from "../subscription-account.js";
 import { claudeBackend, claudeConfigDir } from "./claude-backend.js";
 import { claudeEnv, claudeThirdPartyProvider } from "./claude-env.js";
 /** Read the persisted claude account state, or null when it is absent or unreadable. A file
@@ -43,23 +43,9 @@ export function writeClaudeAccount(root, account) {
 export function observeClaudeAccount(root, run, now = Date.now()) {
     return observeAccount(root, "claude", run, now);
 }
-/** The subscription account's used-up usage window, or null — see subscription-account.ts's
- * windowUsedUp for the rule. */
-export function claudeWindowUsedUp(account, now, includeOverage = true, reserve) {
-    return windowUsedUp(account, now, includeOverage, reserve);
-}
-/** Re-export of the per-backend helpers under their historical claude names for callers that
- * predate the per-backend store (budget gates, team holds, the doctor, the role view, the
- * status poll). */
-export { subscriptionWindowRejected, windowReserved };
-/** The window type as a compact label — subscription-account.ts's windowLabel, under its
- * historical claude name. */
-export function claudeWindowLabel(type) {
-    return windowLabel(type);
-}
-export function claudeWindowEntries(account) {
-    return windowEntries(account);
-}
+/** Re-export of the per-backend rejection signal under its historical claude name for callers
+ * that predate the per-backend store (the runner's run-verdict and hold wiring). */
+export { subscriptionWindowRejected };
 /** Seed the claude account file before the first run (plans/agent-backends.md §7):
  * `ANTHROPIC_API_KEY` set means claude prefers the key, so billing is API; otherwise
  * `claude auth status` decides — a claude.ai OAuth login is a subscription, any other login is

package/dist/src/agent/codex/codex-account.js

@@ -84,12 +84,11 @@ export function parseCodexLoginStatus(stdout) {
         return "api";
     return null;
 }
-/** The refusal message when a codex seam is API-key logged in (decision 5): Codex reports no
- * cost, so per-token billing would spend money the budget cap cannot see. The one home of the
- * remedy text the startup gate, the live config editor, and the doctor all print, so the remedy
- * command and its wording cannot drift between them. `home` is the codex home named in the
- * remedy: the literal `<home>` placeholder where the call site does not resolve the home, else
- * the resolved `CODEX_HOME` path. */
+/** The refusal message for a codex logged in with an API key, shared by the startup gate, the
+ * live-config warn and the doctor's codex auth check (decision 5): Codex reports no cost, so
+ * per-token billing would spend money the budget cap cannot see. `home` names the codex home
+ * the operator should re-login under; the gate and the live warn pass the literal "<home>"
+ * placeholder because they do not resolve one, while the doctor passes the resolved home. */
 export function codexApiKeyRefusalMessage(home) {
     return `Codex is logged in with an API key; tumwater runs Codex on a ChatGPT subscription only — run \`CODEX_HOME=${home} codex login --device-auth\``;
 }

package/dist/src/agent/codex/codex-args.js

@@ -106,11 +106,11 @@ export const EFFORT_BY_THINKING = {
  * spawn on a model that lists it. */
 const KNOWN_EFFORTS = new Set(Object.values(EFFORT_BY_THINKING));
 /** Map a thinking level to the Codex `model_reasoning_effort` it means, gated by the model's own
- * catalog. `levels` is the model's `supported_reasoning_levels` (design finding 14), which a
- * stream-minted catalog (part 8/9) supplies; until then the caller passes `undefined`, and the
- * result is returned unclamped. An unknown thinking level returns `undefined` (no effort flag) —
- * the level simply has no Codex effort, unlike a thinking level that maps but the model does not
- * support, which is also `undefined`. */
+ * catalog. `levels` is the model's `supported_reasoning_levels` (design finding 14), which the
+ * codex catalog (part 8/9) supplies; when the caller has no catalog it passes `undefined`, and
+ * the result is returned unclamped. An unknown thinking level returns `undefined` (no effort
+ * flag) — the level simply has no Codex effort, unlike a thinking level that maps but the model
+ * does not support, which is also `undefined`. */
 export function codexEffort(thinking, levels) {
     if (!Object.hasOwn(EFFORT_BY_THINKING, thinking))
         return undefined;

package/dist/src/agent/codex/codex-rollout.js

@@ -163,7 +163,7 @@ function rateLimitLines(lastRateLimits) {
 /** The model this turn switched to when its `turn_context.model` differs from what the run
  * requested (finding 24): the model itself, else undefined for no switch. */
 function switchedToModel(model, requestedModel) {
-    return model !== undefined && requestedModel !== undefined && model !== requestedModel ? model : undefined;
+    return model !== undefined && model !== requestedModel ? model : undefined;
 }
 /** Assemble the reading's canonical `run_usage`, `billing` and up-to-two `rate_limit` lines
  * (in that order), plus the `switchedTo` model comparison, from scanned records. */

package/dist/src/agent/opencode/opencode-backend.js

@@ -79,42 +79,44 @@ export function opencodeSpillDir(root) {
 function catalogModelKey(model) {
     return opencodeModelKey(model);
 }
-/** Run `opencode session export <id> --standalone` (the same database the run used, bounded at
- * 10 s) and return whether it reported success — the existence check that decides a resume.
- * Nonzero exit, a timeout, or a spawn failure all read as "no such session", which is the safe
- * direction: `--session` would otherwise silently create a missing session. */
-function opencodeSessionExists(id, env, bin, cwd) {
+/** Run the bounded `opencode session export <id> --standalone` spawn that both the resume
+ * existence check and the reconciling export issue, under the same env/cwd and the shared
+ * 10 s bound. `capture` is false for the existence check, which reads only the exit status:
+ * `stdio: "ignore"` keeps the export — which carries every message of the session — out of
+ * memory and below the default 1 MiB `maxBuffer`, whose `ENOBUFS` kill would otherwise make a
+ * large but real session read as absent and mint a fresh one. Returns the spawn result, or null
+ * when the spawn itself threw — a missing binary or an invalid option, resolved the same way
+ * both callers treated a throw. The command line, env, cwd and timeout live here once, so the
+ * existence check and the reconciling export cannot drift on what they run. */
+function runSessionExport(id, env, bin, cwd, capture = true) {
     try {
-        const res = spawnSync(bin, ["session", "export", id, "--standalone"], {
+        return spawnSync(bin, ["session", "export", id, "--standalone"], {
             env,
             cwd,
             timeout: EXPORT_TIMEOUT_MS,
-            stdio: "ignore",
+            encoding: "utf8",
+            stdio: capture ? "pipe" : "ignore",
         });
-        return res.status === 0;
     }
     catch {
-        return false;
+        return null;
     }
 }
+/** Run `opencode session export <id> --standalone` (the same database the run used, bounded at
+ * 10 s) and return whether it reported success — the existence check that decides a resume.
+ * Nonzero exit, a timeout, or a spawn failure all read as "no such session", which is the safe
+ * direction: `--session` would otherwise silently create a missing session. */
+function opencodeSessionExists(id, env, bin, cwd) {
+    const res = runSessionExport(id, env, bin, cwd, false);
+    return res?.status === 0;
+}
 /** Run the reconciling export after a successful run and return its two canonical lines
  * (`run_cost`, `run_usage`) from the session's `info`. Anything that goes wrong — a spawn or
  * timeout, a nonzero exit, unparseable or malformed output — returns `[]`, and the caller
  * (afterRun) reports `opencode_usage_partial` so the run keeps its streamed numbers. */
 function opencodeExport(result) {
-    let res;
-    try {
-        res = spawnSync(result.bin, ["session", "export", result.id, "--standalone"], {
-            env: result.env,
-            cwd: result.cwd,
-            timeout: EXPORT_TIMEOUT_MS,
-            encoding: "utf8",
-        });
-    }
-    catch {
-        return [];
-    }
-    if (res.status !== 0 || !res.stdout)
+    const res = runSessionExport(result.id, result.env, result.bin, result.cwd);
+    if (res?.status !== 0 || !res.stdout)
         return [];
     let parsed;
     try {

package/dist/src/agent/opencode/opencode-catalog.js

@@ -9,6 +9,7 @@
 import { spawnSync } from "node:child_process";
 import { isJsonObject, validEntries } from "../../files/json-object.js";
 import { readJsonFile, writeJsonAtomic } from "../../files/json-files.js";
+import { cachedByStat } from "../../files/stat-cache.js";
 import { errorMessage } from "../../text/text.js";
 import { DAY_MS } from "../../text/datetime.js";
 import { opencodeModelsPath } from "../../paths.js";
@@ -21,6 +22,25 @@ const CATALOG_URL = "https://models.dev/api.json";
 const CATALOG_FETCH_TIMEOUT_MS = 30_000;
 /** How long a fetched cache is trusted before it is refreshed. */
 const CATALOG_CACHE_TTL_MS = DAY_MS;
+/** Per-catalog cache of the parsed catalog, keyed by the models.json path: the status
+ * snapshot and the budget gate both poll it every second while the file changes only when a
+ * refresh re-fetches models.dev — and it grows with the models.dev catalog — so an
+ * unchanged file costs one stat per poll instead of a re-read plus a JSON.parse and a
+ * validation of the whole file (the same stat-keyed contract readOpencodeCache's siblings
+ * readCodexCatalog, readPiProviders and readMergeQueue already use). Any write invalidates
+ * via dev/ino/mtime/size (stat-cache.cachedByStat's freshness check). */
+const catalogCache = new Map();
+/** A structural copy of a parsed catalog, so a caller that mutates its own result (e.g.
+ * observeOpencodeRun sets `billedAt` on an entry) never reaches the shared cache entry; the
+ * next poll re-derives from the file. The entries are plain data (`efforts` arrays included)
+ * so a shallow model-object spread suffices. */
+function cloneCache(cache) {
+    const models = {};
+    for (const [key, entry] of Object.entries(cache.models)) {
+        models[key] = entry.efforts !== undefined ? { ...entry, efforts: [...entry.efforts] } : { ...entry };
+    }
+    return { fetchedAt: cache.fetchedAt, cliVersion: cache.cliVersion, models };
+}
 const defaultFetch = async (url, timeoutMs) => {
     const res = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
     if (!res.ok)
@@ -160,15 +180,21 @@ function isOpencodeCatalogModel(value) {
  * fills the file in. Entries that are not well-formed catalog models are dropped, so a foreign
  * entry reads as a model missing from the cache — not free. */
 export function readOpencodeCache(root) {
-    const existing = readJsonFile(opencodeModelsPath(root));
-    if (existing !== null && typeof existing.fetchedAt === "number" && isJsonObject(existing.models)) {
-        return {
-            fetchedAt: existing.fetchedAt,
-            cliVersion: typeof existing.cliVersion === "string" ? existing.cliVersion : undefined,
-            models: validEntries(existing.models, isOpencodeCatalogModel),
-        };
-    }
-    return { fetchedAt: 0, models: {} };
+    const file = opencodeModelsPath(root);
+    const cached = cachedByStat(catalogCache, file, file, () => {
+        // readJsonFile is the shared "missing or torn reads as no data" policy; a torn write
+        // or a malformed file reads as an empty cache (fetchedAt 0), exactly as before.
+        const existing = readJsonFile(file);
+        if (existing !== null && typeof existing.fetchedAt === "number" && isJsonObject(existing.models)) {
+            return {
+                fetchedAt: existing.fetchedAt,
+                cliVersion: typeof existing.cliVersion === "string" ? existing.cliVersion : undefined,
+                models: validEntries(existing.models, isOpencodeCatalogModel),
+            };
+        }
+        return { fetchedAt: 0, models: {} };
+    }, cloneCache);
+    return cached ?? { fetchedAt: 0, models: {} };
 }
 /** Persist the catalog cache atomically under `.tumwater/state/`. */
 export function writeOpencodeCache(root, cache) {

package/dist/src/agent/session-ledger.js

@@ -191,6 +191,24 @@ export function pruneSessionLedgers(sessionsRoot, days) {
 /** How long one `opencode session delete <id> --standalone` may take before it gives up: the
  * session export measured 0.18 s live, so 10 s is a generous bound on a slow or wedged CLI. */
 const SESSION_DELETE_TIMEOUT_MS = 10_000;
+/** Run one bounded headless CLI session delete (`bin args…`) under `env`, best-effort: a
+ * spawn that throws (a missing binary, an unwritable env) returns false without throwing, so
+ * a failed delete never fails the prune. Shared by the OpenCode and Codex session purges below
+ * so neither drift on the 10 s bound, the status-0 success rule, or the swallow policy. */
+function sessionDeleteSucceeds(bin, args, env) {
+    try {
+        const res = spawnSync(bin, args, {
+            env,
+            timeout: SESSION_DELETE_TIMEOUT_MS,
+            stdio: "ignore",
+        });
+        return res.status === 0;
+    }
+    catch {
+        // Best effort: an unwritable env or a missing binary must not fail the prune.
+        return false;
+    }
+}
 /** Delete each OpenCode session the ledger records as expired, with one
  * `opencode session delete <id> --standalone` each (bounded), plus the spill files older than
  * the window in the team's shell spill dir. The session's spill files and server state live
@@ -209,18 +227,8 @@ export function pruneOpencodeSessions(sessionsRoot, days, opts) {
             for (const record of readSessions(path.dirname(file))) {
                 if (record.agent !== "opencode" || record.at >= cutoff)
                     continue;
-                try {
-                    const res = spawnSync(opts.bin, ["session", "delete", record.id, "--standalone"], {
-                        env: opts.env,
-                        timeout: SESSION_DELETE_TIMEOUT_MS,
-                        stdio: "ignore",
-                    });
-                    if (res.status === 0)
-                        deleted += 1;
-                }
-                catch {
-                    // Best effort: an unwritable env or a missing binary must not fail the prune.
-                }
+                if (sessionDeleteSucceeds(opts.bin, ["session", "delete", record.id, "--standalone"], opts.env))
+                    deleted += 1;
             }
         });
     }
@@ -276,20 +284,8 @@ export function pruneCodexSessions(sessionsRoot, days, opts) {
     for (const id of expired) {
         if (live.has(id))
             continue;
-        if (opts.bin !== undefined) {
-            try {
-                const res = spawnSync(opts.bin, ["delete", "--force", id], {
-                    env: opts.env,
-                    timeout: SESSION_DELETE_TIMEOUT_MS,
-                    stdio: "ignore",
-                });
-                if (res.status === 0)
-                    deleted += 1;
-            }
-            catch {
-                // Best effort: an unwritable env or a missing binary must not fail the prune.
-            }
-        }
+        if (opts.bin !== undefined && sessionDeleteSucceeds(opts.bin, ["delete", "--force", id], opts.env))
+            deleted += 1;
         // Fallback: unlink the home's rollout for this session so neither the ledger line nor
         // its file outlives the window. A real `codex delete` removes the rollout itself, so a
         // successful delete has nothing left to unlink; a failed or skipped delete does, and

package/dist/src/agent/subscription-account.js

@@ -3,8 +3,7 @@
  * "Billing" and §8 "The subscription usage window"). Persisted at
  * `.tumwater/state/<backend>-account.json` (plan design grounds/codex-backend.md "Groundwork:
  * the subscription account is per backend", item 1), written only by the orchestrator process,
- * so the sibling parts that throttle or display the subscription window read one answer instead
- * of re-deriving it per surface.
+ * so the sibling parts read one answer instead of re-deriving it per surface.
  *
  * The file is a cache, never a source of truth: a run that reports billing overwrites it, and a
  * missing or unreadable file reads as "no subscription". `resetsAt` is stored as epoch
@@ -28,85 +27,6 @@ export function subscriptionWindowRejected(run) {
         run.billing === "subscription" &&
         (run.rateWindows ?? []).some((w) => w.status === "rejected" && w.isUsingOverage !== true));
 }
-/** The subscription account's used-up usage window, or null: a window reading `rejected` with
- * no overage, or (with `includeOverage`, the default) a window whose current reading shows
- * `isUsingOverage`, and a `resetsAt` still ahead of `now`; among several, the one that resets
- * last. With a `reserve` (the subscription-window reserve), a window whose utilization has
- * reached its type's fraction counts too and comes back with `reserve: true`; a rejected or
- * overage window outranks a reserve one, so the flag is set only when no window is used up
- * for real. The budget gate's window move (pollBudgetGate) reads the default; the team hold
- * (windowObservation) passes `includeOverage: false`, because overage never holds a
- * seam. Only subscription billing produces one; a missing account reads null. */
-export function windowUsedUp(account, now, includeOverage = true, reserve) {
-    if (account?.billing !== "subscription")
-        return null;
-    let furthest = null;
-    let reserved = null;
-    for (const [type, w] of Object.entries(account.windows)) {
-        if (typeof w.resetsAt !== "number" || w.resetsAt <= now)
-            continue;
-        const used = w.isUsingOverage === true ? includeOverage : w.status === "rejected";
-        if (used) {
-            if (furthest === null || w.resetsAt > furthest.resetsAt)
-                furthest = { type, resetsAt: w.resetsAt };
-            continue;
-        }
-        if (windowReserved(w, reserve?.[type]) && (reserved === null || w.resetsAt > reserved.resetsAt))
-            reserved = { type, resetsAt: w.resetsAt, reserve: true };
-    }
-    return furthest ?? reserved;
-}
-/** Has this window's utilization reached its reserve fraction? False without a fraction or a
- * reading. */
-export function windowReserved(w, fraction) {
-    return fraction !== undefined && typeof w.utilization === "number" && w.utilization >= fraction;
-}
-/** Status severity for ordering: a rejected window limits, an allowed_warning nears its limit,
- * every other reading (allowed/ok) rides at the bottom, and a reset one no longer limits. */
-const WINDOW_RANK = { rejected: 3, allowed_warning: 2, reset: 0 };
-/** The window type as a compact label: `five_hour` → `5h`, `seven_day` → `7d`; an unknown
- * type falls back to its words with underscores as spaces. The one home of the window spelling
- * the status badge and the role view share. */
-export function windowLabel(type) {
-    const m = /^(\w+)_(hour|day|week)$/.exec(type);
-    if (!m)
-        return type.replace(/_/g, " ");
-    const words = { one: "1", two: "2", three: "3", four: "4", five: "5", six: "6", seven: "7", eight: "8", nine: "9", ten: "10" };
-    const unit = m[2] === "hour" ? "h" : m[2] === "day" ? "d" : "w";
-    const word = m[1] ?? "";
-    return `${words[word] ?? word}${unit}`;
-}
-/** The fraction of a subscription usage window consumed (0–1) as a whole-number percent: a
- * `0.64` utilization reads `64`. The one home of the fraction→percent conversion, shared by
- * the status badge, the doctor's hold reason and the event formatter so they render a window's
- * fill identically (the browser dashboard's own window line is embedded client-side and keeps
- * its inline copy). */
-export function utilizationPct(utilization) {
-    return Math.round(utilization * 100);
-}
-/** Order two window entries by the windowEntries rule: status severity, then the reported
- * utilization (a missing reading sorts below any number), then the earlier reset, then the
- * type name. Exported so a list of per-backend blocks can be ordered by their primary entry
- * the same way windowEntries orders one account's windows (part 3a/9). */
-export function compareWindowEntries(a, b) {
-    const rank = (WINDOW_RANK[b.status] ?? 1) - (WINDOW_RANK[a.status] ?? 1);
-    if (rank !== 0)
-        return rank;
-    const util = (b.utilization ?? -1) - (a.utilization ?? -1);
-    if (util !== 0)
-        return util;
-    const reset = (a.resetsAt ?? Number.POSITIVE_INFINITY) - (b.resetsAt ?? Number.POSITIVE_INFINITY);
-    if (reset !== 0)
-        return reset;
-    return a.type.localeCompare(b.type);
-}
-/** The account's windows as a list, most constrained first (by compareWindowEntries). Empty
- * when the account reported none. */
-export function windowEntries(account) {
-    return Object.entries(account.windows)
-        .map(([type, w]) => ({ type, ...w }))
-        .sort((a, b) => compareWindowEntries(a, b));
-}
 /** Read the persisted account state for a backend, or null when it is absent or unreadable. A
  * file without a usable top-level `observedAt` reads as absent (the plan's torn-file rule),
  * and a window whose `resetsAt` is at or before `now` reads back with `status: "reset"` — the
@@ -144,8 +64,7 @@ function readWindow(value, fileObservedAt, now) {
     const resetsAt = finiteNumber(value.resetsAt, Number.NaN);
     const resets = Number.isFinite(resetsAt);
     // utilization heals like the two stamps above: JSON's `1e999` parses to Infinity, and a
-    // non-finite fraction would render as `Infinity%` in the badges and poison the
-    // windowEntries comparator (Infinity - Infinity is NaN).
+    // non-finite fraction would poison any consumer's utilization read.
     const utilization = finiteNumber(value.utilization, undefined);
     const reset = resets && resetsAt <= now;
     const window = {

package/dist/src/backlog/backlog-archive.js

@@ -319,10 +319,9 @@ function archiveCommitWhat(plan) {
 }
 /** One live backlog file's finished-history rows as liveFinishedHistory reports them, phrased
  * and joined: `file ## <section> holds N finished entries (X KB)` rows separated by "; " — the
- * shared detail head the doctor's `backlog archive` check (checkLiveFinished) and the always-on
- * `backlog-archive` alert (src/ui/team-alert-backlog.ts) both render, so the row shape, the
- * plural, and the KB rounding cannot drift between the two. Each caller appends its own trailing
- * explanation, so the two texts stay byte-identical up to that suffix. */
+ * detail head the doctor's `backlog archive` check (checkLiveFinished) renders, so the row
+ * shape, the plural, and the KB rounding stay stable. Each caller appends its own trailing
+ * explanation. */
 export function liveFinishedRowList(rows) {
     return rows.map((l) => `${l.file} ## ${l.section} holds ${plural(l.entries, "finished entry", "finished entries")} (${Math.round(l.bytes / 1024)} KB)`).join("; ");
 }

package/dist/src/backlog/backlog-eligibility.js

@@ -54,11 +54,10 @@ export function needsReviewNote(body) {
  * for the bugfix role's wait-for-the-next-failure note ("by bugfix: …"), which parks the
  * entry for selfcheck to lift when the cluster fails again (selfcheck step 4) and which no
  * role can act on until then. entryHold returns "needs-review" for every such note (all of
- * them park the entry), so the stalled-with-the-plan-role surfaces — the stalled-entries team
- * alert (team-alert-backlog.ts) and the doctor's `stalled entries` row
- * (checkStalledEntries) — classify by this agreed subset, keeping the bugfix parks out of the
- * plan-role blame. Reads the note's text after the NEEDS_REVIEW_PREFIX once, so the alert and
- * the doctor row cannot disagree on which notes the plan role clears; the eligibility mark
+ * them park the entry), so the doctor's `stalled entries` row (checkStalledEntries) — the
+ * stalled-with-the-plan-role surface — classifies by this agreed subset, keeping the bugfix
+ * parks out of the plan-role blame. Reads the note's text after the NEEDS_REVIEW_PREFIX once,
+ * so the row cannot disagree on which notes the plan role clears; the eligibility mark
  * (holdMark) continues to hold every needs-review note, a by-bugfix park included. */
 export function isPlanStalled(entry) {
     const note = needsReviewNote(entry.body);
@@ -279,49 +278,28 @@ export function backlogHolds(root) {
  * `tumwater backlog` prints. A surface derives its marks from the one hold decision and the
  * one claim lookup rather than re-walking the entries. An eligible entry nobody is working on
  * renders as the empty string, so a client can append the mark without a separate check.
- * Questions carry no holds. backlogHolds alone still drives the allocator. */
-export function backlogMarks(root) {
+ * Questions carry no holds. backlogHolds alone still drives the allocator. A caller that
+ * already resolved the claim lookup (for the same poll's marks AND its own parallel checks,
+ * e.g. statusPayload's `working` or the TUI's `runners`) passes it as `working` so the claims
+ * walk is done once, not re-run inside both calls — the same shared single read the module's
+ * other single-home polls observe. */
+export function backlogMarks(root, working) {
     const holds = backlogHolds(root);
-    const working = backlogInProgress(root);
+    const inProgress = working ?? backlogInProgress(root);
     const mark = (hold, runner) => holdMark(hold) + inProgressMark(runner ?? null);
     return {
-        plans: holds.plans.map((h, i) => mark(h, working.plans[i])),
-        bugs: holds.bugs.map((h, i) => mark(h, working.bugs[i])),
+        plans: holds.plans.map((h, i) => mark(h, inProgress.plans[i])),
+        bugs: holds.bugs.map((h, i) => mark(h, inProgress.bugs[i])),
     };
 }
 /** The display noun for a backlog-file discriminator — the `"plans" | "bugs"` `file` on
- * RefusedEntry and StalledEntry (and the same discriminator the prompt's named-hold wording
+ * RefusedEntry (and the same discriminator the prompt's named-hold wording
  * and the doctor's Stalled row take): BUGS.md is a "Bug" and PLANS.md a "Plan", and the
  * lowercase form is the `Refused plan|bug:` label and the `tumwater plan|bug --release`
  * command noun. */
 export function entryKindLabel(file) {
     return file === "bugs" ? "Bug" : "Plan";
 }
-/** The planned plans and open bugs parked with the plan role — whose Needs-review hold the plan
- * role clears by splitting or replanning (the feature role's too-large note, the convergence hold,
- * a final-round rejection), in file order: the `stalled-entries` team alert's input, each
- * carrying its backlog file, 0-based index and the hold. Same `backlogHolds(root)` + the
- * planned/`openBugEntries` readers `refusedEntries` uses, so the alert and the doctor's
- * `stalled entries` row classify through the same `entryHold` + `isPlanStalled` and cannot
- * disagree on which holds are role-resolvable. The bugfix role's wait-for-the-next-failure
- * parks ("by bugfix:") are excluded: selfcheck lifts them, not the plan role. A missing
- * file yields `[]`. */
-export function stalledEntries(root) {
-    const holds = backlogHolds(root);
-    const out = [];
-    const entriesOf = (entries, held, file) => {
-        entries.forEach((e, i) => {
-            const hold = held[i];
-            // Only holds the plan role can clear surface as stalled: the bugfix role's
-            // wait-for-the-next-failure parks stay out of the plan-role blame.
-            if (hold === "needs-review" && isPlanStalled(e))
-                out.push({ file, index: i, title: e.title, hold });
-        });
-    };
-    entriesOf(plannedPlanEntries(root), holds.plans, "plans");
-    entriesOf(openBugEntries(root), holds.bugs, "bugs");
-    return out;
-}
 /** The planned plans, then the open bugs, whose hold is `"refused"`, in file order: the
  * entries that wait on an operator decision (the `refused` team alert's input), each carrying
  * the backlog file and its 0-based position so a surface opening the row can land on it.

package/dist/src/backlog/backlog-question-answer.js

@@ -7,7 +7,7 @@
  * output helpers, so every surface can drive it without ending the process.
  *
  * Shared by every read/answer surface: the CLI's `tumwater questions` command body wraps it in
- * src/cli/question-commands.ts (the say/fail/editor layer), while the TUI's answer box
+ * src/cli/cli-question-commands.ts (the say/fail/editor layer), while the TUI's answer box
  * (src/ui/tui/tui-keys.ts) and the dashboard's POST route (src/gui/gui-endpoint-commands.ts)
  * import the non-exiting answer core directly. It lives with the rest of the BUGS/PLANS/QUESTIONS
  * markdown (src/backlog/), not under src/cli/, so the non-command surfaces never depend on the

package/dist/src/backlog/backlog.js

@@ -1,5 +1,6 @@
 import path from "node:path";
 import { cachedTextByStat } from "../files/stat-cache.js";
+import { DAY_MS } from "../text/datetime.js";
 import { entryDates, entryLags, finishedArchiveOf, firstDate, lastDate, parseEntryDetails } from "./backlog-md.js";
 import { CHECK_DECLARATION_MARKER } from "../roles/role-guidance.js";
 /** The stat-cached file readers of the project backlog data shown on both dashboards: planned
@@ -104,7 +105,7 @@ export function completionDate(title, dateRe) {
 /** Whole days between a filing stamp and `now`, floored at 0 so a future-dated entry reads as
  * fresh (0d) rather than negative. Shared by the suffix and the `--list --json` `ageDays` field. */
 export function ageInDays(since, now = Date.now()) {
-    return Math.max(0, Math.floor((now - Date.parse(since)) / 86400000));
+    return Math.max(0, Math.floor((now - Date.parse(since)) / DAY_MS));
 }
 /** The ` · since YYYY-MM-DD (Nd)`/`(today)` tail a listing line gains for its entry's filing
  * stamp — the one place the wording and the today/`Nd` choice live, so the plans/bugs list

package/dist/src/baseline/main-guardrails.js

@@ -13,7 +13,7 @@
  * Both take an injected `now` so tests never read the clock. */
 import { readEventsSince } from "../events/event-window.js";
 import { loadQuarantine } from "../review/known-flakes.js";
-import { DAY_MS, clockHm, humanAgo } from "../text/datetime.js";
+import { DAY_MS, HOUR_MS, clockHm, humanAgo } from "../text/datetime.js";
 import { shortSha } from "../text/format.js";
 import { roleLabel } from "../roles/role-labels.js";
 import { plural } from "../text/phrases.js";
@@ -193,5 +193,5 @@ function redDurationPhrase(ms) {
     const minutes = Math.round(ms / 60_000);
     if (minutes < 24 * 60)
         return `${minutes} min`;
-    return `${Math.round(ms / 3_600_000)} h`;
+    return `${Math.round(ms / HOUR_MS)} h`;
 }