tumwater 0.4.3 → 0.4.4

package/dist/src/cli.js

@@ -13,16 +13,14 @@
  * ready-repo gate. An error escaping main() funnels through its catch to fail(errorMessage(err)),
  * the CLI's one error path. */
 import { parseCountFlag, parseGrepFlag, parseModelFlag, parseResultFlag } from "./cli/cli-args.js";
-import { grepFlagSpec, GUI_FLAG_SPECS, JSON_FLAG, LAST_FLAG, N_FLAG, rejectUnknownArgs, resultFlagSpec, modelFlagSpec, byFlagSpec, LOGS_TRANSCRIPT_FLAG, ROLE_FLAG, START_FLAG_SPECS, sinceFlagSpec, untilFlagSpec, STAT_FLAG, PATCH_FLAG, PROMPT_FLAG, TRANSCRIPT_FLAG, SUMMARY_FLAG, COUNT_FLAG, NOTABLE_FLAG, typeFlagSpec, DRY_RUN_FLAG, FORCE_FLAG, FOLLOW_FLAG, STOP_CANCEL_FLAG, STOP_IN_FLAG, PROBLEMS_FLAG, KILL_ORPHANS_FLAG, COMMIT_BACKLOG_FLAG, RESYNC_INSTALL_FLAG, DROP_BROKEN_PINS_FLAG, RETIRE_LEFTOVERS_FLAG, } from "./cli/cli-flag-specs.js";
-import { fail, say, sayJsonOrRender } from "./cli/cli-output.js";
-import { historyTrailForm, parseDoctorChecks, parsePromptArgs, peelPositionals } from "./cli/cli-command-args.js";
+import { grepFlagSpec, GUI_FLAG_SPECS, JSON_FLAG, LAST_FLAG, N_FLAG, rejectUnknownArgs, resultFlagSpec, modelFlagSpec, byFlagSpec, LOGS_TRANSCRIPT_FLAG, ROLE_FLAG, START_FLAG_SPECS, sinceFlagSpec, untilFlagSpec, STAT_FLAG, PATCH_FLAG, PROMPT_FLAG, TRANSCRIPT_FLAG, SUMMARY_FLAG, COUNT_FLAG, NOTABLE_FLAG, typeFlagSpec, DRY_RUN_FLAG, FORCE_FLAG, FOLLOW_FLAG, STOP_CANCEL_FLAG, STOP_IN_FLAG, } from "./cli/cli-flag-specs.js";
+import { fail, say } from "./cli/cli-output.js";
+import { historyTrailForm, parsePromptArgs, peelPositionals } from "./cli/cli-command-args.js";
 import { refuseTeamWorkspace, requireReadyRepo } from "./cli/cli-repo-gate.js";
-import { loadConfigSafe } from "./config/config.js";
 import { repoToplevel } from "./git/git.js";
 import { didYouMean } from "./text/suggest.js";
 import { errorMessage, gotSuffix, stripTerminalControls } from "./text/text.js";
 import { typoSuffix } from "./text/suggest.js";
-import { completionConfigKeys, completionModels, completionRoleIds, completionScript, configValueWords, SUPPORTED_SHELLS } from "./cli/completion.js";
 import { HELP, helpTopic, helpTopicForArgs, suggestCommand } from "./cli/help.js";
 import { PACKAGE_JSON, nodeFloorProblem, packageEnginesNode, packageVersion } from "./version.js";
 // The CLI's help text and its per-command topic parser live in help.ts — importing cli.ts
@@ -75,7 +73,7 @@ async function cmdGuiCase(root, args) {
     await (await import("./gui/gui-command.js")).cmdGui(root, args);
 }
 async function cmdConfigCase(root, args) {
-    const { cmdConfig, CONFIG_USAGE } = await import("./cli/config-commands.js");
+    const { cmdConfig, CONFIG_USAGE } = await import("./cli/cli-config-commands.js");
     // Subcommand arity before the ready-repo gate, so a malformed get/set fails with its
     // usage no matter the directory: bare config takes nothing, `get`/`unset` exactly one
     // key, `set` exactly a key and a value. cmdConfig dispatches on the (now well-shaped)
@@ -125,105 +123,16 @@ async function cmdReportCase(root, args) {
     // trailing window vs a series over whole days), not a modifier of either.
     await (await import("./report/report.js")).cmdReport(root, args);
 }
-/** Run one doctor side-effect (`--kill-orphans`, `--commit-backlog`, `--resync-install`,
- * `--drop-broken-pins`, `--retire-leftovers`) and return its report payload for the optional
- * `--json` run — the shape every doctor*Case side-effect wrapper follows: import the effect's
- * module and run it only when its flag is present, then (text form only) print the effect's
- * own lines before the report with a separating blank line when there is anything to print;
- * `--json` keeps stdout one document, carrying the result on the payload instead. The lazy
- * per-effect `load` keeps each module imported only when its flag is asked for. */
-async function doctorSideEffect(args, flag, load) {
-    if (!args.includes(flag))
-        return undefined;
-    const { run, lines } = await load();
-    const payload = await run();
-    // The text form prints the effect before the report; --json keeps stdout one document.
-    if (!args.includes("--json")) {
-        const out = lines(payload);
-        for (const line of out)
-            say(line);
-        if (out.length > 0)
-            say("");
-    }
-    return payload;
-}
-async function doctorKillOrphans(root, args) {
-    return doctorSideEffect(args, "--kill-orphans", async () => {
-        const { killOrphans, orphanKillLines } = await import("./doctor/doctor-orphans.js");
-        return { run: () => killOrphans(root), lines: orphanKillLines };
-    });
-}
-async function doctorCommitBacklog(root, args) {
-    return doctorSideEffect(args, "--commit-backlog", async () => {
-        const { commitUncommittedBacklog, backlogCommitLines } = await import("./doctor/doctor-backlog.js");
-        const { config } = loadConfigSafe(root); // the report's own config, so base resolution and the off-base skip match the `uncommitted backlog` row's
-        return { run: () => commitUncommittedBacklog(root, config), lines: backlogCommitLines };
-    });
-}
-async function doctorResyncInstall(root, args) {
-    return doctorSideEffect(args, "--resync-install", async () => {
-        const { resyncRootInstall, rootInstallResyncLines } = await import("./build/dep-install.js");
-        return { run: () => resyncRootInstall(root), lines: rootInstallResyncLines };
-    });
-}
-async function doctorDropBrokenPins(root, args) {
-    return doctorSideEffect(args, "--drop-broken-pins", async () => {
-        const { dropBrokenPins, brokenPinDropLines } = await import("./doctor/doctor-contention-checks.js");
-        return { run: () => dropBrokenPins(root), lines: brokenPinDropLines };
-    });
-}
-async function doctorRetireLeftovers(root, args) {
-    return doctorSideEffect(args, "--retire-leftovers", async () => {
-        const { retireLeftovers, leftoverRetireLines } = await import("./doctor/doctor-contention-checks.js");
-        const { config } = loadConfigSafe(root); // the row's own config, so the reap and the report agree on what is retirable
-        return { run: () => retireLeftovers(root, config), lines: leftoverRetireLines };
-    });
-}
-function doctorPayload(payload, parts) {
-    const out = { ...payload };
-    if (parts.leftoverRetire !== undefined)
-        out.leftoverRetire = parts.leftoverRetire;
-    if (parts.brokenPinDrop !== undefined)
-        out.brokenPinDrop = parts.brokenPinDrop;
-    if (parts.resyncInstall !== undefined)
-        out.resyncInstall = parts.resyncInstall;
-    if (parts.backlogCommit !== undefined)
-        out.backlogCommit = parts.backlogCommit;
-    if (parts.orphanKill !== undefined)
-        out.orphanKill = parts.orphanKill;
-    return out;
-}
 async function cmdDoctorCase(root, args) {
-    // No requireReadyRepo gate: doctor's job is to report WHY the environment isn't ready,
-    // so it must run outside a git repo and print fail lines rather than throwing.
-    const { positionals: checkNames, rest: doctorFlags } = peelPositionals(args);
-    rejectUnknownArgs("doctor", doctorFlags, [JSON_FLAG, PROBLEMS_FLAG, KILL_ORPHANS_FLAG, COMMIT_BACKLOG_FLAG, RESYNC_INSTALL_FLAG, DROP_BROKEN_PINS_FLAG, RETIRE_LEFTOVERS_FLAG]);
-    const only = parseDoctorChecks(checkNames);
-    const { runDoctor } = await import("./doctor/doctor.js");
-    const parts = {
-        orphanKill: await doctorKillOrphans(root, args),
-        backlogCommit: await doctorCommitBacklog(root, args),
-        resyncInstall: await doctorResyncInstall(root, args),
-        brokenPinDrop: await doctorDropBrokenPins(root, args),
-        leftoverRetire: await doctorRetireLeftovers(root, args),
-    };
-    const { renderDoctor, renderDoctorProblems, problemsOnly } = await import("./doctor/doctor-render.js");
-    const report = await runDoctor(root, undefined, undefined, only);
-    // --json prints the collector's own payload (the DoctorReport object), not a re-parse of
-    // the render — the `report --json` precedent. The exit-code contract below holds in both
-    // forms: 1 when any check fails, 0 otherwise; warnings never fail the exit.
-    // --problems keeps the full report for the render (it counts the hidden ok rows) and
-    // hands --json the filtered one; the exit code below reads the full report either way.
-    // --kill-orphans adds the kill result to the JSON object as `orphanKill`.
-    if (args.includes("--problems"))
-        sayJsonOrRender(args, args.includes("--json") ? doctorPayload(problemsOnly(report), parts) : report, renderDoctorProblems);
-    else
-        sayJsonOrRender(args, args.includes("--json") ? doctorPayload(report, parts) : report, renderDoctor);
-    if (report.checks.some((c) => c.level === "fail"))
-        process.exitCode = 1; // Warnings never fail the exit.
+    // cmdDoctor lives in cli-doctor-command.ts (the doctor command body, its side-effect
+    // wrappers and payload shaping) and holds no ready-repo gate: doctor's job is to report
+    // WHY the environment isn't ready, so it must run outside a git repo and print fail
+    // lines rather than throwing. Imported lazily like every command body, so the doctor
+    // subgraph is only compiled when `tumwater doctor` is asked for.
+    await (await import("./cli/cli-doctor-command.js")).cmdDoctor(root, args);
 }
 async function cmdLogsCase(root, args) {
-    const { cmdLogs, GREP_VALUE_ERROR, TYPE_VALUE_ERROR } = await import("./cli/log-commands.js");
+    const { cmdLogs, GREP_VALUE_ERROR, TYPE_VALUE_ERROR } = await import("./cli/cli-log-commands.js");
     rejectUnknownArgs("logs", args, [
         FOLLOW_FLAG,
         N_FLAG,
@@ -244,7 +153,7 @@ async function cmdLogsCase(root, args) {
 async function cmdNotifyCase(root, args) {
     rejectUnknownArgs("notify", args, [{ names: ["--test"] }]);
     await requireReadyRepo(root);
-    await (await import("./cli/notify-command.js")).cmdNotify(root, args);
+    await (await import("./cli/cli-notify-command.js")).cmdNotify(root, args);
 }
 async function cmdHistoryCase(root, args) {
     const { cmdHistory, HISTORY_GREP_VALUE_ERROR, HISTORY_RESULT_VALUE_ERROR, HISTORY_MODEL_VALUE_ERROR, HISTORY_BY_VALUE_ERROR } = await import("./history/history.js");
@@ -382,71 +291,6 @@ async function cmdStopCase(root, args) {
     await requireReadyRepo(root);
     await (await import("./operator/operator-commands.js")).cmdStop(root, args);
 }
-function printCompletionRoles(root) {
-    for (const id of completionRoleIds(root))
-        say(id);
-}
-function printCompletionConfigKeys(root) {
-    for (const key of completionConfigKeys(root))
-        say(key);
-}
-function printCompletionConfigValue(key) {
-    // The vocabulary `config set <key> <value>` completes for a discrete-valued key
-    // (boolean/backend/model/thinking); free-form keys print nothing, so a `set` on one
-    // completes nothing instead of offering a wrong vocabulary.
-    for (const word of configValueWords(key))
-        say(word);
-}
-function printCompletionModels(root) {
-    for (const m of completionModels(root))
-        say(m);
-}
-const COMPLETION_LISTING_SHAPES = {
-    "--roles": "roles",
-    "--config-keys": "config-keys",
-    "--models": "models",
-};
-function completionListShape(args) {
-    if (args.length === 1 && args[0] in COMPLETION_LISTING_SHAPES)
-        return COMPLETION_LISTING_SHAPES[args[0]];
-    if (args.length === 2 && args[0] === "--config-value")
-        return "config-value";
-    return null;
-}
-function completionShell(args) {
-    const shell = args[0];
-    // A wrong word count names the count, not a bad shell. A single near-miss shell word gets
-    // the same typoSuffix `logs --type`/`history --result` give, so `completion zs` reads
-    // "did you mean `zsh`?" while a far-off value (`tcsh`) stays hint-free.
-    if (args.length === 0)
-        fail("completion needs a shell: bash, zsh, or fish");
-    if (args.length > 1)
-        fail(`completion takes one shell: bash, zsh, or fish (got ${args.length} words: ${args.join(" ")})`);
-    if (!SUPPORTED_SHELLS.includes(shell))
-        fail(`completion takes one shell: bash, zsh, or fish${gotSuffix(shell)}${typoSuffix(shell ?? "", SUPPORTED_SHELLS)}`);
-    return shell;
-}
-async function cmdCompletionCase(root, args) {
-    // Works outside a repo: no requireReadyRepo.
-    const shape = completionListShape(args);
-    if (shape === "roles") {
-        printCompletionRoles(root);
-        return;
-    }
-    if (shape === "config-keys") {
-        printCompletionConfigKeys(root);
-        return;
-    }
-    if (shape === "config-value") {
-        printCompletionConfigValue(args[1]);
-        return;
-    }
-    if (shape === "models") {
-        printCompletionModels(root);
-        return;
-    }
-    say(completionScript(completionShell(args)));
-}
 async function cmdVersionCase(args) {
     // A stray flag fails like every other command's: `tumwater version --json` (a plausible
     // slip from `status --json`) must not print a version as if it had answered the query.
@@ -581,10 +425,10 @@ async function main() {
             break;
         }
         case "questions":
-            await (await import("./cli/question-commands.js")).cmdQuestions(root, args);
+            await (await import("./cli/cli-question-commands.js")).cmdQuestions(root, args);
             break;
         case "brief":
-            await (await import("./cli/brief-command.js")).cmdBrief(root, args);
+            await (await import("./cli/cli-brief-command.js")).cmdBrief(root, args);
             break;
         case "role":
             await (await import("./cli/cli-role-command.js")).cmdRole(root, args);
@@ -620,7 +464,11 @@ async function main() {
             break;
         }
         case "completion": {
-            await cmdCompletionCase(root, args);
+            // Works outside a repo (no requireReadyRepo): the body lives in
+            // cli-completion-command.ts, beside its data (src/cli/completion.ts), and is imported
+            // lazily like every command body so the dispatcher never compiles the completion
+            // subgraph until `tumwater completion` is asked for.
+            await (await import("./cli/cli-completion-command.js")).cmdCompletion(root, args);
             break;
         }
         case "version":

package/dist/src/collections.js

@@ -18,9 +18,14 @@ export function groupBy(items, key) {
 /** The distinct items of an iterable, in first-seen order — the single home of the
  * `seen.includes -> push` dedupe, shared by the pending pane's three scope lists
  * (mergeQueueRoles, postReviewRoles, overlapHolders in ui/tui/tui-pane-pending.ts), the
- * session pane's scope cycle (ui/tui/tui-pane-session.ts's scopeCycle), and the report
- * scope fold (report/report-fold.ts's scopeBases), so those sites cannot drift on how a
- * repeat is skipped. Returns a fresh array; the input is never mutated. (The dashboard's
+ * session pane's scope cycle (ui/tui/tui-pane-session.ts's scopeCycle), the report
+ * scope fold (report/report-fold.ts's scopeBases), and the rest of the harness's
+ * `[...new Set(...)]` dedupes (completion.ts's commands/config keys, operator-commands.ts's
+ * role lists, text.ts's splitCommaListUnique/pathTokens, startup-gates.ts's backendsInUse,
+ * failure-data.ts's delta roles, doctor-backlog.ts's watched set, doctor-orphans.ts's pid
+ * list, main-watch.ts's knownMainFailures, help.ts's suggestCommand candidates, and
+ * tui-pane-activity.ts's present types), so those sites cannot drift on how a repeat is
+ * skipped. Returns a fresh array; the input is never mutated. (The dashboard's
  * role-scope builder in ui/gui/gui-client-report.ts keeps its own copy by design: it runs
  * in the browser, where harness modules cannot be imported.) */
 export function distinctOrdered(items) {
@@ -67,7 +72,7 @@ export function filterKeepPositions(items, keep) {
  * `map.set(k, (map.get(k) ?? 0) + 1)` step, shared by the failure-spread kind tally
  * (src/team/team-failure-spread.ts), the diff multiset's line tally (merge/merge-diff.ts), the
  * section-title tally (backlog/backlog-structure.ts), the logs' per-type tally
- * (cli/log-commands.ts), the flaky-check tally
+ * (cli/cli-log-commands.ts), the flaky-check tally
  * (doctor/doctor-project-checks.ts), and the multi-runner base tally
  * (orchestrator/orchestrator-scheduling.ts) — the exit-summary round's outcome tally
  * (cli/cli-start-summary.ts) seeds its own copy of this step inline — so those sites cannot
@@ -174,17 +179,9 @@ export function lowerMedian(values) {
     const sorted = [...values].sort((a, b) => a - b);
     return sorted[Math.floor((sorted.length - 1) / 2)];
 }
-/** Most-days-waited-first comparator, ties in ascending index (file order) — `b.days - a.days ||
- * a.index - b.index`, the single home of that one-line ordering. Shared by the stale-questions
- * feed (src/ui/alert-feeds.ts's staleOpenQuestions), which builds `{index, days}`
- * rows off the same backlog scan, so its tie order cannot drift. The generic holds
- * any row type carrying both fields; a row without a natural index passes its first-seen order. */
-export function byDaysThenIndex(a, b) {
-    return b.days - a.days || a.index - b.index;
-}
 /** Ascending string comparator by UTF-16 code unit — the locale-independent order a bare `.sort()`
  * uses, unlike `localeCompare` (which `rankByCount` uses for its tiebreak). Used directly by
- * src/cli/cli-start-summary.ts, src/cli/completion.ts, src/cli/log-commands.ts,
+ * src/cli/cli-start-summary.ts, src/cli/completion.ts, src/cli/cli-log-commands.ts,
  * src/history/history-data.ts, src/review/post-merge-review.ts, src/review/quarantine-render.ts,
  * src/budget/budget.ts and src/change/change-data.ts, and by `sortByValueDesc` for its tiebreak. */
 export function compareCodeUnits(a, b) {
@@ -193,7 +190,7 @@ export function compareCodeUnits(a, b) {
 /** Rank `[key, value, …]` pairs by value descending, breaking ties in code-unit order
  * (compareCodeUnits — the locale-independent order, unlike rankByCount's localeCompare), so
  * equal values always order the same way. The single home of that comparator, which
- * src/cli/log-commands.ts's per-type event-count lines and src/report/report-render.ts's
+ * src/cli/cli-log-commands.ts's per-type event-count lines and src/report/report-render.ts's
  * mergeDone sort hand-rolled before; `…rest` lets a site carry extra trailing fields
  * (report-render's third column) through the sort untouched. Mutates and returns the input
  * array, matching the `.sort()` the call sites replaced. */

package/dist/src/concurrency/lock.js

@@ -7,7 +7,7 @@ import { errCode } from "../errno.js";
 import { primaryWorktreeLockPath } from "../paths.js";
 /** How old a lock dir must be before it is stale on age alone — regardless of whether its
  * recorded pid still looks alive, so a reused pid cannot latch a dead holder as live. */
-const STALE_MS = 10 * 60 * 1000;
+const STALE_MS = 10 * 60_000;
 /** A creator publishes its lock dir with the holder's pid already inside (atomic rename), so a
  * visible lock always carries a readable pid. This grace remains for a pid-less dir an older
  * build or an interrupted hand operation left behind: past it, the dir is an orphan and safe

package/dist/src/config/config-keys.js

@@ -82,24 +82,34 @@ export const DOTTED_SECTION_FIELDS = {
  * (`modle.small`, `maxDailyCostUsdPerRoll.feature`) gets the same did-you-mean the sibling
  * unknown-key errors attach. */
 const DOTTED_KEY_HEADS = [...DOTTED_MAP_KEYS, "roles", "model", "backends", ...Object.keys(DOTTED_SECTION_FIELDS)];
-/** Split a config key into its write/get shape: `foo` is top-level,
- * `maxDailyCostUsdPerRole.feature` / `quietHoursPerRole.qa` name one map entry,
- * `roles.qa.model` names one role-entry field, and anything else dotted is an error
- * naming the supported dotted forms. */
-export function parseConfigKey(key) {
-    if (!key.includes("."))
-        return { kind: "top", key };
-    const parts = key.split(".");
+/** The per-role map entry `maxDailyCostUsdPerRole.<role>` / `quietHoursPerRole.<role>` — a
+ * whole-value bare key with no deeper segment names one map entry. Returns undefined when
+ * the shape is not that of a two-segment per-role map entry. */
+function parseMapEntry(parts) {
     const first = parts[0] ?? "";
     const second = parts.length > 1 ? parts[1] ?? "" : undefined;
     const third = parts.length > 2 ? parts[2] ?? "" : undefined;
     if (third === undefined && second !== undefined && second !== "" && DOTTED_MAP_KEYS.includes(first))
         return { kind: "map", map: first, role: second };
+    return undefined;
+}
+/** One role-entry field `roles.<id>.<field>` (e.g. `roles.qa.model`), with both segments
+ * non-empty. Returns undefined when the shape is not a three-segment `roles.` key. */
+function parseRoleField(parts) {
+    const first = parts[0] ?? "";
+    const second = parts.length > 1 ? parts[1] ?? "" : undefined;
+    const third = parts.length > 2 ? parts[2] ?? "" : undefined;
     if (parts.length === 3 && first === "roles" && second !== undefined && second !== "" && third !== undefined && third !== "")
         return { kind: "role", id: second, field: third };
-    // `backends.<id>.<field>` names one field of one agent backend's entry (the way
-    // `roles.<id>.<field>` names one role field). The id is shape-checked only — routing owns
-    // which agent ids exist (part 4b); a typo'd field is refused here with the valid ones named.
+    return undefined;
+}
+/** `backends.<id>.<field>` names one field of one agent backend's entry (the way
+ * `roles.<id>.<field>` names one role field). The id is shape-checked only — routing owns
+ * which agent ids exist (part 4b); a typo'd field is refused here with the valid ones named. */
+function parseBackendField(parts) {
+    const first = parts[0] ?? "";
+    const second = parts.length > 1 ? parts[1] ?? "" : undefined;
+    const third = parts.length > 2 ? parts[2] ?? "" : undefined;
     if (parts.length === 3 && first === "backends" && second !== undefined && second !== "" && third !== undefined) {
         // configDir is claude/codex-only (CLAUDE_AGENT_KEYS / CODEX_BACKEND_KEYS):
         // a config set backends.pi.configDir would write a key nothing reads, so it is refused
@@ -112,10 +122,15 @@ export function parseConfigKey(key) {
             error: `unknown backend field "${third}" for backends.${second} (valid fields: ${validKeys.join(", ")})${typoSuffix(third, validKeys)}`,
         };
     }
-    // `model.<tier>` names one entry of the tier model map — the way `roles.<id>.model`
-    // names one role field, `maxDailyCostUsdPerRole.<role>` names one map entry. The tier
-    // must be a real tier: `config set model.turbo x` would otherwise write a dead map key
-    // the runtime (and doctor's checkKnownKeys) would silently never resolve.
+    return undefined;
+}
+/** `model.<tier>` names one entry of the tier model map — the way `roles.<id>.model`
+ * names one role field, `maxDailyCostUsdPerRole.<role>` names one map entry. The tier
+ * must be a real tier: `config set model.turbo x` would otherwise write a dead map key
+ * the runtime (and doctor's checkKnownKeys) would silently never resolve. */
+function parseModelTier(parts) {
+    const first = parts[0] ?? "";
+    const second = parts.length > 1 ? parts[1] ?? "" : undefined;
     if (parts.length === 2 && first === "model") {
         if ((TIER_MAP_KEYS).includes(second ?? ""))
             return { kind: "tier", map: "model", tier: second };
@@ -124,8 +139,13 @@ export function parseConfigKey(key) {
             error: `unknown model tier "${second ?? ""}" — a dotted \`model.<tier>\` names one of ${TIER_MAP_KEYS.join(", ")} (e.g. \`config set model.strong huggingface/zai-org/GLM-5.3-Flash:together:low\`)${typoSuffix(second ?? "", TIER_MAP_KEYS)}`,
         };
     }
-    // `<section>.<field>` names one field of a fixed-shape section (review, check, idleBackoff,
-    // bootstrap); the field must be one the schema lists, or the write would be a dead key.
+    return undefined;
+}
+/** `<section>.<field>` names one field of a fixed-shape section (review, check, idleBackoff,
+ * bootstrap); the field must be one the schema lists, or the write would be a dead key. */
+function parseSectionField(parts) {
+    const first = parts[0] ?? "";
+    const second = parts.length > 1 ? parts[1] ?? "" : undefined;
     if (parts.length === 2 && Object.hasOwn(DOTTED_SECTION_FIELDS, first)) {
         const section = first;
         const fields = DOTTED_SECTION_FIELDS[section];
@@ -136,9 +156,14 @@ export function parseConfigKey(key) {
             error: `unknown ${first} field "${second ?? ""}" (valid fields: ${fields.join(", ")})${typoSuffix(second ?? "", fields)}`,
         };
     }
-    // A typo'd first segment is the common miss (`maxDailyCostUsdPerRoll.feature`,
-    // `modle.small`); when the head is one of the valid ones the shape itself is wrong, so
-    // suggesting that head back would mislead — the generic wording is the whole story there.
+    return undefined;
+}
+/** The generic dotted-shape rejection: the head is not one of the accepted shapes in a way
+ * the earlier parsers would have claimed, so name the supported dotted forms wholesale. A
+ * typo'd first segment is the common miss (`maxDailyCostUsdPerRoll.feature`, `modle.small`);
+ * when the head is one of the valid ones the shape itself is wrong, so suggesting that head
+ * back would mislead — hence the hint only when the head is unknown. */
+function dottedShapeError(key, first) {
     const headHint = DOTTED_KEY_HEADS.includes(first)
         ? ""
         : typoSuffix(first, DOTTED_KEY_HEADS);
@@ -147,6 +172,22 @@ export function parseConfigKey(key) {
         error: `unknown config key "${key}" — dotted keys name one entry of a per-role map or one field of a role entry (e.g. \`maxDailyCostUsdPerRole.feature 1.5\`, \`roles.qa.model x\`, \`review.model x\`); a bare key names a whole top-level value${headHint}`,
     };
 }
+/** Split a config key into its write/get shape: `foo` is top-level,
+ * `maxDailyCostUsdPerRole.feature` / `quietHoursPerRole.qa` name one map entry,
+ * `roles.qa.model` names one role-entry field, and anything else dotted is an error
+ * naming the supported dotted forms. */
+export function parseConfigKey(key) {
+    if (!key.includes("."))
+        return { kind: "top", key };
+    const parts = key.split(".");
+    const first = parts[0] ?? "";
+    return (parseMapEntry(parts) ??
+        parseRoleField(parts) ??
+        parseBackendField(parts) ??
+        parseModelTier(parts) ??
+        parseSectionField(parts) ??
+        dottedShapeError(key, first));
+}
 /** The error `tumwater config get <key>` and `config set <key> <value>` both surface for a
  * key outside TOP_LEVEL_KEYS — the valid-keys list plus text.ts's did-you-mean suggestion —
  * or null when the key is known. One home for the phrasing so whichever verb misspells a

package/dist/src/config/config-request.js

@@ -131,7 +131,17 @@ function withRolesSection(candidate, rawRolesCandidate, roles) {
  * throw, the old-key normalization and the top-level disallowed-key scan into `ignored`; the
  * `check` value is returned untouched for checkCommandFrom. */
 function parseConfigRequest(raw, ignored) {
-    const unnormalized = JSON.parse(raw);
+    // A malformed request's JSON.parse SyntaxError is named as a config request so a role that
+    // staged garbage reads where it went wrong (the parser's position report is kept); the
+    // isJsonObject throw below owns the "not an object" wording, so only a true parse failure
+    // takes this path.
+    let unnormalized;
+    try {
+        unnormalized = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`config request is not valid JSON: ${errorMessage(err)}`);
+    }
     if (!isJsonObject(unnormalized))
         throw new Error(`config request must be a JSON object (got ${show(unnormalized)})`);
     // Old key spellings read as the new ones; a request setting both fails with the pair named.

package/dist/src/config/config-schema.js

@@ -113,7 +113,7 @@ export const ROLE_ENTRY_KEYS = [
     "minRunIntervalSeconds",
     "instances",
 ];
-export const REVIEW_KEYS = ["enabled", "exemptPaths", "afterMerge", "provider", "model", "backend", "thinking", "timeoutSeconds"];
+export const REVIEW_KEYS = ["enabled", "exemptPaths", "provider", "model", "backend", "thinking", "timeoutSeconds"];
 /** The `check` section's keys (plans/portability.md §6/7): the project's own verification
  * command, the optional cheaper gate-only command, their
  * working directory (relative to the worktree), and their timeout. */

package/dist/src/config/config-validation-roles.js

@@ -1,6 +1,6 @@
 /** The per-role and cross-field section rules of tumwater.json validation: the `customRoles`
- * collect-and-check block, the `roles.<id>` entry block, `review.afterMerge`'s name check,
- * the per-role daily cost caps and quiet hours, and the `idleBackoff`
+ * collect-and-check block, the `roles.<id>` entry block, the per-role daily cost caps and
+ * quiet hours, and the `idleBackoff`
  * cross-field pair. Extracted from the single validateConfig gate (config-validation.ts) so a
  * per-role or cross-field edit lands as a per-theme diff instead of a whole-gate one; this
  * module runs once, at the gate's end, after every other section has appended its problems,
@@ -8,10 +8,10 @@
  * in config-field-checks.ts; the helpers passed in are the closures the gate binds once (the
  * problems-bound checkers and the shared model-triple sequence), and the
  * cross-cutting `customNames` set — collected in the customRoles block, consumed by the
- * roles.<id>, afterMerge, cap and quiet-hour blocks — is owned here, so validateConfig
+ * roles.<id>, cap and quiet-hour blocks — is owned here, so validateConfig
  * passes no set across the boundary. */
 import { CUSTOM_ROLE_KEYS, CUSTOM_NAME_RE, CUSTOM_TASK_MAX_CHARS, ROLE_ENTRY_KEYS, ROLE_INSTRUCTIONS_MAX_CHARS, } from "./config-schema.js";
-import { DIRECTOR_ROLE, allRoleIds } from "../roles/roles.js";
+import { allRoleIds } from "../roles/roles.js";
 import { INSTANCE_ROLES, baseRoleOf } from "../roles/runner-ids.js";
 import { isJsonObject } from "../files/json-object.js";
 import { isNonBlankString } from "../text/text.js";
@@ -46,15 +46,14 @@ function checkPerRoleMap(r, key, expectation, customNames, problems, checkValue)
     }
 }
 /** Validate the per-role and cross-field sections that close the gate: `customRoles`, the
- * `roles.<id>` entries, `review.afterMerge`'s role names, the per-role caps and quiet hours,
- * and the `idleBackoff` cross-field pair,
+ * `roles.<id>` entries, the per-role caps and quiet hours, and the `idleBackoff`
+ * cross-field pair,
  * each appended to `problems` in the order the gate produced. The single call site in
  * validateConfig is the point where these problems were appended, so the order across the
  * whole pass is unchanged. */
 export function validateRolesAndCrossField(r, problems, helpers) {
     const customNames = validateCustomRoles(r, problems, helpers);
     validateRoleEntries(r, problems, helpers, customNames);
-    validateReviewAfterMerge(r, problems, customNames);
     validatePerRoleCostCaps(r, problems, customNames);
     validatePerRoleQuietHours(r, problems, customNames);
     validateIdleBackoff(r, problems);
@@ -161,21 +160,6 @@ function validateRoleEntries(r, problems, helpers, customNames) {
         }
     }
 }
-/** Validate `review.afterMerge`'s role names: a typo'd id would silently keep that role
- * reviewed before merging; the director is refused because its changes always merge on a
- * review first. */
-function validateReviewAfterMerge(r, problems, customNames) {
-    if (isJsonObject(r.review) && Array.isArray(r.review.afterMerge)) {
-        r.review.afterMerge.forEach((id, i) => {
-            if (typeof id !== "string" || id.trim() === "")
-                return; // Already reported by checkStringArray.
-            if (id === DIRECTOR_ROLE)
-                problems.push(`review.afterMerge[${i}] must not be "${DIRECTOR_ROLE}" — its changes are always reviewed before merging`);
-            else
-                checkKnownRoleId("review.afterMerge", id, customNames, problems);
-        });
-    }
-}
 /** Validate the per-role daily cost caps (src/gates/role-cap-gates.ts): each key must name a
  * known role — built-in or customRoles — because a typo'd id would silently no-op the cap,
  * the exact silent-ignore class the `roles.<id>` check exists to prevent (the customNames set

package/dist/src/config/config-validation.js

@@ -226,7 +226,6 @@ export function validateConfig(raw, label = "tumwater.json", rawFile = false) {
         checkKnownKeys(o, REVIEW_KEYS, "review", problems);
         checkBoolean(o, "review.", "enabled");
         checkStringArray(o, "review.", "exemptPaths");
-        checkStringArray(o, "review.", "afterMerge");
         // An exemption pattern is matched against a repo-relative path (exemptions.ts), so a
         // pattern shaped like something git never emits can never match: the diff it was meant
         // to exempt gets a model review anyway, and the operator never learns the pattern was

package/dist/src/config/config-views.js

@@ -12,6 +12,8 @@ import { modelPairName } from "../budget/budget.js";
 import { isJsonObject } from "../files/json-object.js";
 import { DIRECTOR_ROLE, roleById } from "../roles/roles.js";
 import { baseRoleOf } from "../roles/runner-ids.js";
+import { sampleHostLoad } from "../build/host-sleep.js";
+import { starvedDeadlineMs } from "../build/build-check-events.js";
 /** The effective `backends.<id>` entry as a run sees it (plans/agent-backends.md "Back-compat"):
  * the file's own entry, with the legacy top-level `agentBin`/`piArgs` read as the pi backend's
  * `bin`/`args` when the new form leaves a field absent. Pure — it never writes those legacy
@@ -165,14 +167,6 @@ export function roleSeamTier(config, role) {
         return "strong";
     return roleById(role)?.tier ?? "default";
 }
-/** Whether the review gate reviews this role's commits AFTER they merge (review.afterMerge
- * lists the role's base id). One home for the membership test the review gate (review.ts's
- * reviewAttempt), the runner's `already_queued` recovery arm (runner-run.ts) and the role
- * view (`tumwater role <id>` / the dashboard role drawer) all share, so an operator reading
- * one surface sees the same answer every consumer enforces. Pure, no I/O. */
-export function reviewedAfterMerge(config, role) {
-    return (config.review.afterMerge ?? []).includes(baseRoleOf(role));
-}
 /** The config as seen by one role: role-level provider/model/thinking overrides applied
  * over the top-level values, plus the per-role minRunIntervalSeconds (a slow clock for
  * roles that should act rarely) falling back to the global value when unset. The role's
@@ -231,7 +225,9 @@ export function resolverConfig(config) {
  * the merge slot the whole queue waits on, and its only other limits were the run's budget
  * and the quiet watchdog: reviews measured 2026-09-22/23 ran 2.3 min median, 9.2 min p90 and
  * 24.6 min max, while earlier days had 1.5–3.5 h reviews. 15 min clears the ordinary review and
- * kills a wedged one in minutes instead of the run's hours. */
+ * kills a wedged one in minutes instead of the run's hours. Under a starved host the budget
+ * stretches by the load-to-cores ratio (see reviewRunConfig), so a progressing review on a
+ * loaded box is not killed at the wall by load it does not control. */
 export const REVIEW_TIMEOUT_S = 900;
 /** The reviewer's wall-clock floor while the budget fallback carries the team. The free model
  * is typically local and far slower per turn than the budgeted one it replaces, but a review
@@ -244,14 +240,19 @@ export const REVIEW_TIMEOUT_S = 900;
 export const FALLBACK_REVIEW_TIMEOUT_S = 3600;
 /** The config as seen by the gate's reviewer run: the reviewer's model wiring (reviewConfig)
  * with its own time budget — `review.timeoutSeconds`, default REVIEW_TIMEOUT_S — overriding
- * the run's. A smaller runTimeoutSeconds still wins. A still-progressing gate run gets one
- * extension of the same length (src/pi/pi-watchdogs.ts), so the effective ceiling on a large
- * diff's review is twice this budget. */
-export function reviewRunConfig(config) {
+ * the run's. A smaller runTimeoutSeconds still wins. Under a starved host the budget stretches
+ * by `starvedDeadlineMs` (the merge-scope precedent in build-check-events.ts): the load-to-cores
+ * ratio caps it at double the base, so on an ordinary quiet host the value is exactly today's
+ * budget while a progressing review on a loaded box is not killed at the wall by load it does
+ * not control. A still-progressing gate run gets one extension of the same length
+ * (src/pi/pi-watchdogs.ts), so the effective ceiling on a large diff's review is twice this
+ * stretched budget. `load` defaults to `sampleHostLoad` and is injectable for offline tests. */
+export function reviewRunConfig(config, load = sampleHostLoad) {
     const cfg = reviewConfig(config);
+    const baseMs = (config.review.timeoutSeconds ?? REVIEW_TIMEOUT_S) * 1000;
     return {
         ...cfg,
-        runTimeoutSeconds: Math.min(cfg.runTimeoutSeconds, config.review.timeoutSeconds ?? REVIEW_TIMEOUT_S),
+        runTimeoutSeconds: Math.min(cfg.runTimeoutSeconds, starvedDeadlineMs(baseMs, load()) / 1000),
     };
 }
 /** The optional provider/model/thinking fields of a resolved model seam, with each unset
@@ -276,8 +277,8 @@ export function resolvedModelFields(provider, model, thinking) {
  * provider/model/thinking triple formatted as one selector string, or an empty object when
  * no model id is resolved (pi's own default) — the key stays absent rather than empty, the
  * same empty-means-unset rule resolvedModelFields applies to the raw halves. One home of
- * that assembly and guard, shared by the two run-start event writers (runner-run.ts's run_start,
- * review-run.ts's review_start) and the per-role status snapshot (status-data.ts) so the three
+ * that assembly and guard, shared by the run-start event writer (runner-run.ts's run_start)
+ * and the per-role status snapshot (status-data.ts) so the two
  * observability surfaces cannot disagree about which model a run starts on. A non-pi backend is
  * named as the selector's provider namespace (backendQualifiedSelector), so a claude run reads
  * `claude/claude-sonnet-5-5` in every surface instead of a bare model id. */