tumwater 0.4.3 → 0.4.4

package/dist/src/failure/failure-state-change.js

@@ -24,44 +24,55 @@ import { deferredReasonText, untilClockSuffix, gigabytes, windowSuffix, windowRe
  * selfcheck role's load-bearing rule asks it to
  * judge — whether the harness's RESPONSE to a failure was wrong (plans/telemetry-role.md) —
  * so they sit beside the outcomes rather than being dropped. */
-export const STATE_CHANGE_TYPES = new Set([
-    "budget_paused",
-    "budget_fallback",
-    "budget_resumed",
-    "team_paused",
-    "team_resumed",
-    "role_paused",
-    "role_resumed",
-    "role_streak_paused",
-    "role_cap_paused",
-    "role_cap_resumed",
-    "rate_limit_hold",
-    "rate_limit_resumed",
-    "max_concurrent_changed",
-    "retention_changed",
-    "config_changed",
-    "build_stale",
-    "restart_pending",
-    "restart",
-    "restart_refused",
-    "restart_blocked",
-    "run_deferred",
-    "orchestrator_start",
-    "orchestrator_stop",
-    "supervisor_exit",
-    "disk_low",
-    "disk_ok",
-    "quiet_hours_started",
-    "quiet_hours_ended",
-    "maintenance_quota_hold",
-    "maintenance_quota_resumed",
-    "subscription_window_limited",
-    "subscription_window_reset",
-    "model_changed",
-    "bootstrap_complete",
-    "fallback_switched",
-    "budget_handback",
-]);
+const STATE_CHANGE_FAMILY = {
+    // Budget and window reopening.
+    budget_paused: budgetStateChange,
+    budget_fallback: budgetStateChange,
+    budget_resumed: budgetStateChange,
+    // Pauses and resumes of teams, roles and caps.
+    team_paused: pauseStateChange,
+    team_resumed: pauseStateChange,
+    role_paused: pauseStateChange,
+    role_resumed: pauseStateChange,
+    role_streak_paused: pauseStateChange,
+    role_cap_paused: pauseStateChange,
+    role_cap_resumed: pauseStateChange,
+    // Model and fallback wiring.
+    model_changed: modelStateChange,
+    fallback_switched: modelStateChange,
+    budget_handback: modelStateChange,
+    // Provider hold and resume.
+    rate_limit_hold: providerHoldStateChange,
+    rate_limit_resumed: providerHoldStateChange,
+    // Live-config edits.
+    max_concurrent_changed: liveConfigStateChange,
+    retention_changed: liveConfigStateChange,
+    config_changed: liveConfigStateChange,
+    // Self-hosted redeploys.
+    build_stale: updateStateChange,
+    restart_pending: updateStateChange,
+    restart: updateStateChange,
+    restart_refused: updateStateChange,
+    restart_blocked: updateStateChange,
+    // Need-based deferrals and gate holds/lifts.
+    run_deferred: waitStateChange,
+    disk_low: waitStateChange,
+    disk_ok: waitStateChange,
+    quiet_hours_started: waitStateChange,
+    quiet_hours_ended: waitStateChange,
+    maintenance_quota_hold: waitStateChange,
+    maintenance_quota_resumed: waitStateChange,
+    subscription_window_limited: waitStateChange,
+    subscription_window_reset: waitStateChange,
+    // Orchestrator lifecycle.
+    orchestrator_start: lifecycleStateChange,
+    orchestrator_stop: lifecycleStateChange,
+    supervisor_exit: lifecycleStateChange,
+    bootstrap_complete: lifecycleStateChange,
+};
+/** The event types the digest replays, derived from STATE_CHANGE_FAMILY's keys so the filter
+ * set can never drift from the dispatch. */
+export const STATE_CHANGE_TYPES = new Set(Object.keys(STATE_CHANGE_FAMILY));
 /** The event types the digest deliberately does not replay, one per EVENT_TYPE_LABELS key that
  * is not a STATE_CHANGE_TYPES member. Together with STATE_CHANGE_TYPES it partitions
  * EVENT_TYPE_LABELS' keys, so a new event type must be classified in one set or the other — the
@@ -416,52 +427,5 @@ function lifecycleStateChange(ev) {
  * read as complete or stand mid-word where a key or value should be; the render adds the
  * timestamp and a roleCell-sliced role, so no unbounded field reaches the page. */
 export function describeStateChange(ev) {
-    switch (ev.type) {
-        case "budget_paused":
-        case "budget_fallback":
-        case "budget_resumed":
-            return truncateExample(budgetStateChange(ev), STATE_CHANGE_MAX);
-        case "team_paused":
-        case "team_resumed":
-        case "role_paused":
-        case "role_resumed":
-        case "role_streak_paused":
-        case "role_cap_paused":
-        case "role_cap_resumed":
-            return truncateExample(pauseStateChange(ev), STATE_CHANGE_MAX);
-        case "model_changed":
-        case "fallback_switched":
-        case "budget_handback":
-            return truncateExample(modelStateChange(ev), STATE_CHANGE_MAX);
-        case "rate_limit_hold":
-        case "rate_limit_resumed":
-            return truncateExample(providerHoldStateChange(ev), STATE_CHANGE_MAX);
-        case "max_concurrent_changed":
-        case "retention_changed":
-        case "config_changed":
-            return truncateExample(liveConfigStateChange(ev), STATE_CHANGE_MAX);
-        case "build_stale":
-        case "restart_pending":
-        case "restart":
-        case "restart_refused":
-        case "restart_blocked":
-            return truncateExample(updateStateChange(ev), STATE_CHANGE_MAX);
-        case "run_deferred":
-        case "disk_low":
-        case "disk_ok":
-        case "quiet_hours_started":
-        case "quiet_hours_ended":
-        case "maintenance_quota_hold":
-        case "maintenance_quota_resumed":
-        case "subscription_window_limited":
-        case "subscription_window_reset":
-            return truncateExample(waitStateChange(ev), STATE_CHANGE_MAX);
-        case "orchestrator_start":
-        case "orchestrator_stop":
-        case "supervisor_exit":
-        case "bootstrap_complete":
-            return truncateExample(lifecycleStateChange(ev), STATE_CHANGE_MAX);
-        default:
-            return truncateExample(ev.type, STATE_CHANGE_MAX);
-    }
+    return truncateExample(STATE_CHANGE_FAMILY[ev.type]?.(ev) ?? ev.type, STATE_CHANGE_MAX);
 }

package/dist/src/gates/gate-polls.js

@@ -236,13 +236,12 @@ function pollTeamFailureAlarms(states, ctx) {
     // Team-wide failure hold, per provider (src/team/team-hold.ts, PLANS.md 2026-10-05): once two
     // roles' runs have ended on the SAME provider AND failure kind within a short window — 429s, or a
     // connection, timeout, 5xx, or model-load backend failure — roles on THAT provider start no
-    // new runs, and the merge queue starts no new verify, whose reviewer run has no retry and would
-    // spend a review strike on the storm — until the hold re-opens at its own deadline (Retry-After
+    // new runs until the hold re-opens at its own deadline (Retry-After
     // honored on the rate-limit kind, doubling on a relapse, capped). Roles on a healthy provider
-    // keep running; a hold on the reviewer's provider (with the review gate on) still blocks every
-    // role a pre-merge review gates — a `review.afterMerge` role's changes merge without a reviewer,
-    // so it stays running; the orchestrator's scheduling and start passes derive that verdict from
-    // this map. The director's runs are exempt, as under the budget gate and the
+    // keep running; a hold on the reviewer's provider parks only the no-role post-merge review
+    // drain — it holds no role start, verify or landing (no role waits on a reviewer), so the
+    // scheduling and start passes read no reviewer verdict from this map. The director's runs are
+    // exempt, as under the budget gate and the
     // operator pause: an explicit human prompt outranks an autonomous gate, one director run is not
     // the concurrency that sustains a storm, its 429 runs keep the per-run transient retry
     // (backend-failure kinds ride this hold alone), and a prompt its run fails to fulfill goes back

package/dist/src/gates/startup-gates.js

@@ -10,6 +10,7 @@ import { owningTeamRoot } from "../paths.js";
 import { backendMissingMessage, findBackendBinary, resolveBackendBin } from "../pi/pi-bin.js";
 import { seedClaudeAccount } from "../agent/claude/claude-account.js";
 import { codexApiKeyRefusalMessage, seedCodexAccount } from "../agent/codex/codex-account.js";
+import { distinctOrdered } from "../collections.js";
 import { opencodeCatalogStale, readOpencodeCache, refreshOpencodeCatalog, } from "../agent/opencode/opencode-catalog.js";
 import { warnEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
 import { HOUR_MS } from "../text/datetime.js";
@@ -194,7 +195,7 @@ export function opencodeProviders(config) {
  * One list the startup gate and doctor's binary check share, so a route the harness would
  * spawn is checked on both surfaces. */
 export function backendsInUse(config) {
-    return [...new Set(seamsInUse(config).map((s) => s.agent ?? "pi"))];
+    return distinctOrdered(seamsInUse(config).map((s) => s.agent ?? "pi"));
 }
 /** The first backend an enabled seam routes to that this build has no registered adapter for,
  * or undefined when every seam's backend is registered. The built-in pi and claude adapters

package/dist/src/git/git-diff.js

@@ -5,6 +5,10 @@
 import { changeBaseRev, gitLines } from "./git.js";
 import { git, gitTry } from "./git-run.js";
 import { cutSplitsSurrogatePair } from "../text/text.js";
+/** The one cap on a fetched change diff, shared by the repo-relative patch (aheadOfMainDiff,
+ * revisionInterdiff) and the view half's uncommitted patch (change-data.ts) so neither side
+ * of a reviewed change can print unbounded text and one bound is all they agree on. */
+export const DIFF_MAX_BYTES = 200_000;
 /** Git's C-quoting short escapes (its `sq_lookup` table) and the byte each decodes to. The
  * mapping was a nine-case switch that repeated `bytes += …; break;` per entry; keeping it as
  * data lets the decoder below handle the octal and literal fallbacks in one place. */
@@ -153,7 +157,7 @@ function splitDiffByFile(diff) {
  * see, and a binary file's short "Binary files differ" stub naturally ranks below any real text
  * change. A failed `git diff` throws: the reviewer handed an empty diff judged no change at
  * all. A view catches it itself. */
-export async function aheadOfMainDiff(wt, mainBranch, maxBytes = 200_000, pathspec = []) {
+export async function aheadOfMainDiff(wt, mainBranch, maxBytes = DIFF_MAX_BYTES, pathspec = []) {
     const range = `${mainBranch}...HEAD`;
     const full = await git(wt, "diff", range, ...pathspec);
     if (full.length <= maxBytes)
@@ -181,7 +185,7 @@ export async function aheadOfMainDiff(wt, mainBranch, maxBytes = 200_000, pathsp
  * the two versions even when the change is tiny: at the default 60% a two-line addition can
  * fail to pair and render as two unrelated commits (`<`/`>`), which is exactly the case a
  * small revision is. */
-export async function revisionInterdiff(wt, mainBranch, priorSha, head, maxBytes = 200_000) {
+export async function revisionInterdiff(wt, mainBranch, priorSha, head, maxBytes = DIFF_MAX_BYTES) {
     try {
         const priorBase = await changeBaseRev(wt, mainBranch, priorSha);
         const headBase = await changeBaseRev(wt, mainBranch, head);

package/dist/src/gui/gui-args.js

@@ -80,6 +80,18 @@ export function rejectBadQueueFileName(res, name) {
     badRequest(res, problem);
     return true;
 }
+/** Pull a required `sha` commit id out of a POST body by the rule the History revert, the
+ * merge-queue cancel/top, and the post-review accept endpoints share: a value that is not a
+ * 4-64 hex-digit commit id (so never a flag or a ref name) is refused as a 400 naming the
+ * value. Returns the validated commit id, or null once the 400 is sent — the body-sha twin of
+ * requireStringField / requirePausedFlag, so the four operators' validation and 400 wording
+ * cannot drift. */
+export function requireSha(res, sha) {
+    if (typeof sha === "string" && /^[0-9a-f]{4,64}$/i.test(sha))
+        return sha;
+    badRequest(res, `"sha" must be a hex commit id of 4-64 digits${gotSuffix(sha)}`);
+    return null;
+}
 /** Read an integer query parameter with the GUI's established discipline for an explicit
  * count: absent → `fallback` (or, when no fallback is given, the parameter is required and
  * its absence is its own 400 — "<name> required"); present but not a plain decimal integer

package/dist/src/gui/gui-config-commands.js

@@ -1,7 +1,7 @@
 /**
  * The dashboard's POST config/budget command handlers (barrelled into
  * gui/gui-endpoint-commands.ts, which routes to them from src/gui/gui-server.ts):
- * config-set, config-unset, budget, role-cap, role-review-after-merge, role-enable,
+ * config-set, config-unset, budget, role-cap, role-enable,
  * role-disable, and
  * notify-test — the
  * post-handler layer onto
@@ -9,9 +9,8 @@
  * own `res`.
  */
 import { setConfigKey, setDailyBudgetUsd, setRoleModelFields, unsetConfigKey } from "../config/config-write.js";
-import { loadConfigSafe } from "../config/config.js";
 import { checkDailyBudgetUsd, checkMinRunInterval } from "../config/config-keys.js";
-import { testNotifyHook } from "../cli/notify-command.js";
+import { testNotifyHook } from "../cli/cli-notify-command.js";
 import { rejectBadRole, requireConfigKey, requireRoleField, requireStringField } from "./gui-args.js";
 import { baseRoleOf } from "../roles/runner-ids.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
@@ -88,67 +87,6 @@ export async function handleRoleCap(req, res, root) {
         return configKeyError(res, "maxDailyCostUsdPerRole." + baseRole, result);
     sendJson(res, 200, { ok: true, role: baseRole, maxDailyCostUsd: value, ...unchangedFlag(result) });
 }
-/** Handle POST /api/role-review-after-merge: the role drawer's Review row button moves one role
- * in or out of review.afterMerge — the browser twin of `tumwater role <id>
- * --review-after-merge`/`--clear-review-after-merge` (the CLI's just-landed write, the amber
- * role-cap alert's remedy on the surface the alert appears on). Same body discipline as
- * /api/role-cap (readPostBody → 400 malformed/non-object, 413 oversized); the body carries the
- * desired membership `afterMerge: true|false` (400 `afterMerge must be true or false`
- * otherwise), and the role id maps to its base role's membership (baseRoleOf) exactly as the
- * CLI's `--review-after-merge` branch does. An unknown id is refused up front (rejectBadRole
- * on the base id, the mirror of the CLI's requireKnownRole) because a no-op or clear write
- * skips validateConfig's known-role refusal — setConfigKey's section branch returns unchanged
- * and writes nothing when the candidate equals the resolved list, so without it a bogus id
- * would answer 200 on a clear. The whole-list value rides the same setConfigKey core `config
- * set review.afterMerge <json>` uses, so validateConfig owns the string-array shape and the
- * `review.afterMerge must not be "director"` refusal — no explicit director branch, matching
- * the CLI. A no-op write (already in the asked-for state) answers unchanged and leaves
- * tumwater.json byte-identical. */
-export async function handleRoleReviewAfterMerge(req, res, root) {
-    const body = await readPostBody(req, res, '{"role": "feature", "afterMerge": true}');
-    if (!body)
-        return;
-    const role = requireRoleField(res, body);
-    if (role === null)
-        return;
-    const want = body.afterMerge;
-    if (typeof want !== "boolean") {
-        badRequest(res, "afterMerge must be true or false");
-        return;
-    }
-    const base = baseRoleOf(role);
-    // An unknown base id is refused up front — the mirror of the CLI's requireKnownRole. A
-    // no-op or clear write returns the list unchanged and setConfigKey skips validateConfig
-    // (the known-role check a real write gets for free), so without this guard a bogus id
-    // would answer 200 on the clear path (same reason handleRoleQuietHours's clear arm carries
-    // rejectBadRole). The stored list holds base ids, so the base id is screened — as
-    // validateConfig's checkKnownRoleId screens the written list — letting an instance id
-    // like feature-2 map to its known base and pass.
-    if (rejectBadRole(root, res, base))
-        return;
-    // The CLI's own computation, list-for-list: the whole value lands through the same
-    // setConfigKey core so validateConfig owns the string-array shape and the director
-    // refusal, and the write is atomic.
-    const list = loadConfigSafe(root).config?.review.afterMerge ?? [];
-    const has = list.includes(base);
-    const next = has === want ? list : want ? [...list, base] : list.filter((r) => r !== base);
-    const result = setConfigKey(root, "review.afterMerge", JSON.stringify(next));
-    if (!result.ok)
-        return configKeyError(res, "review.afterMerge", result);
-    sendJson(res, 200, {
-        ok: true,
-        role: base,
-        afterMerge: want,
-        message: result.unchanged
-            ? want
-                ? `${base}: already in review.afterMerge, so tumwater.json was not written`
-                : `${base}: not in review.afterMerge, so nothing was cleared`
-            : want
-                ? `${base}: added to review.afterMerge`
-                : `${base}: removed from review.afterMerge`,
-        ...unchangedFlag(result),
-    });
-}
 /** Handle POST /api/role-interval: the role drawer's min run interval editor sets or clears
  * one role's override of the team-wide minRunIntervalSeconds — the knob that makes one role
  * act rarely, distinct from the team-wide value. Same body discipline as /api/role-cap

package/dist/src/gui/gui-endpoint-commands.js

@@ -15,7 +15,7 @@
  */
 export { handlePrompt, handlePromptRole, handlePromptCancel, handlePromptEdit, handlePromptTop } from "./gui-prompt-commands.js";
 export { handleQuestionAnswer, handleBacklogFile, handleBacklogCancel, handleBacklogRelease, handleBacklogTop, handleBacklogEdit } from "./gui-backlog-commands.js";
-export { handleConfigSet, handleConfigUnset, handleBudget, handleRoleCap, handleRoleReviewAfterMerge, handleRoleEnable, handleRoleDisable, handleRoleInstances, handleRoleInterval, handleRoleInstructions, handleRoleModel, handleRoleQuietHours, handleNotifyTest } from "./gui-config-commands.js";
+export { handleConfigSet, handleConfigUnset, handleBudget, handleRoleCap, handleRoleEnable, handleRoleDisable, handleRoleInstances, handleRoleInterval, handleRoleInstructions, handleRoleModel, handleRoleQuietHours, handleNotifyTest } from "./gui-config-commands.js";
 export { handlePause, handlePauseRole, handleWake, handleWakeCancel } from "./gui-team-commands.js";
 export { handleResetCounters, handleRestart, handleReclaim, handleKillOrphans, handleDropBrokenPins, handleCommitBacklog, handleResyncInstall, handleRetireLeftovers, handleArchiveBacklog, handleAbort, handleAbortAll, handleStopSchedule, handleRoleNotes, handleRetire, handleRevert, handleQueueCancel, handleQueueTop, handlePostReviewAccept, handleBriefEdit } from "./gui-operator-commands.js";
 export { handleQuarantineRelease } from "./gui-quarantine-commands.js";

package/dist/src/gui/gui-endpoint-common.js

@@ -7,7 +7,7 @@
  * inputs with — and sendRequestResult, the shared boolean-claiming marker reply. The
  * per-domain `checked*` validators live with their domain's module, not here.
  */
-import { rejectBadRole } from "./gui-args.js";
+import { rejectBadRole, requireSha } from "./gui-args.js";
 import { readJsonObject, sendJson } from "./gui-http-body.js";
 /** Every POST handler's shared opening: readJsonObject reads the body and — when it is
  * oversized, malformed, or not a JSON object — has already written the 413/400 itself. Its
@@ -38,6 +38,24 @@ export async function readRoleBody(req, res, example, root, allowMissing = false
         return null; // 400 already sent
     return body;
 }
+/** The sha-addressed POST handlers' shared prologue: readPostBody (400/413 sent on a null
+ * return) plus requireSha's hex-commit-id validation (400 sent on a null return), so the
+ * queue-cancel/queue-top/post-review-accept/revert family states the body-discipline-and-sha
+ * check pair once instead of two guard lines per handler. Its null return means the response
+ * is already written and the handler must stop; callers keep their own `if (!read) return`
+ * bail. Exactly four call sites — handleRevert, handleQueueCancel, handleQueueTop, and
+ * handlePostReviewAccept — returning the body too so handleRevert can read its optional
+ * dryRun; the other three callers use only the sha. A caller that needs neither the body nor
+ * the example can read just `{ sha }` from the result. */
+export async function readShaBody(req, res) {
+    const body = await readPostBody(req, res, '{"sha": "1a2b3c4"}');
+    if (body === null)
+        return null; // 4xx already sent — oversized, malformed, or not an object
+    const sha = requireSha(res, body.sha);
+    if (sha === null)
+        return null; // 400 already sent
+    return { body, sha };
+}
 /** Reply for a boolean-claiming marker request (RequestResult): success maps to 200 with its
  * message, refusal to 409 — the request is valid but nothing can act on it, the same conflict
  * reading requestAbort's not-live error uses. /api/restart and /api/abort share it. */

package/dist/src/gui/gui-operator-commands.js

@@ -32,7 +32,7 @@ import { editBriefText } from "../brief/brief-edit.js";
 import { requireStringField, validRoleIds } from "./gui-args.js";
 import { badRequest, sendJson } from "./gui-http-body.js";
 import { errorMessage, gotSuffix } from "../text/text.js";
-import { readPostBody, readRoleBody, sendRequestResult } from "./gui-endpoint-common.js";
+import { readPostBody, readRoleBody, readShaBody, sendRequestResult } from "./gui-endpoint-common.js";
 import { wakeInSecondsMs } from "./gui-team-commands.js";
 /** The shared body of the dashboard's Health/Action buttons that run a domain function and
  * answer its text lines joined with "; ": readPostBody (400/413 sent on a null return) plus the
@@ -249,20 +249,19 @@ export async function handleRetire(req, res, root) {
  * answers `{ ok, preview }` (previewRevert, writing nothing); otherwise the revert commits and
  * answers `{ ok, headSha, beforeSha, message }`. A core's refusal is a 409 with its wording. */
 export async function handleRevert(req, res, root) {
-    const body = await readPostBody(req, res, '{"sha": "1a2b3c4"}');
-    if (!body)
+    const parsed = await readShaBody(req, res);
+    if (parsed === null)
         return;
-    if (typeof body.sha !== "string" || !/^[0-9a-f]{4,64}$/i.test(body.sha))
-        return badRequest(res, `"sha" must be a hex commit id of 4-64 digits${gotSuffix(body.sha)}`);
+    const { body, sha } = parsed;
     if (body.dryRun !== undefined && typeof body.dryRun !== "boolean")
         return badRequest(res, `"dryRun" must be true or false${gotSuffix(body.dryRun)}`);
     if (body.dryRun === true) {
-        const preview = await previewRevert(root, body.sha);
+        const preview = await previewRevert(root, sha);
         if (!preview.ok)
             return sendJson(res, 409, { error: preview.error });
         return sendJson(res, 200, { ok: true, preview });
     }
-    const result = await revertMergedCommit(root, body.sha);
+    const result = await revertMergedCommit(root, sha);
     if (!result.ok)
         return sendJson(res, 409, { error: result.error });
     const followUp = revertFollowUp(result.subject);
@@ -292,14 +291,13 @@ function rejectInFlightMerge(res, root, sha) {
  * raced the click) is a 200 `{ status: "gone" }` data, not an error. Otherwise it answers the
  * cancelled entry's role/commit/summary and removes the queue file and pin. */
 export async function handleQueueCancel(req, res, root) {
-    const body = await readPostBody(req, res, '{"sha": "1a2b3c4"}');
-    if (!body)
+    const parsed = await readShaBody(req, res);
+    if (parsed === null)
         return;
-    if (typeof body.sha !== "string" || !/^[0-9a-f]{4,64}$/i.test(body.sha))
-        return badRequest(res, `"sha" must be a hex commit id of 4-64 digits${gotSuffix(body.sha)}`);
-    if (rejectInFlightMerge(res, root, body.sha))
+    const { sha } = parsed;
+    if (rejectInFlightMerge(res, root, sha))
         return;
-    const outcome = await cancelQueuedMergeBySha(root, body.sha);
+    const outcome = await cancelQueuedMergeBySha(root, sha);
     if (outcome.status === "gone")
         return sendJson(res, 200, { ok: true, status: "gone" });
     if (outcome.status !== "cancelled")
@@ -322,12 +320,11 @@ export async function handleQueueCancel(req, res, root) {
  * accepted like any pending one. Otherwise it answers the
  * accepted entry's role/commit/summary and removes the entry. */
 export async function handlePostReviewAccept(req, res, root) {
-    const body = await readPostBody(req, res, '{"sha": "1a2b3c4"}');
-    if (!body)
+    const parsed = await readShaBody(req, res);
+    if (parsed === null)
         return;
-    if (typeof body.sha !== "string" || !/^[0-9a-f]{4,64}$/i.test(body.sha))
-        return badRequest(res, `"sha" must be a hex commit id of 4-64 digits${gotSuffix(body.sha)}`);
-    const outcome = acceptPostReviewBySha(root, body.sha);
+    const { sha } = parsed;
+    const outcome = acceptPostReviewBySha(root, sha);
     if (outcome.status === "gone")
         return sendJson(res, 200, { ok: true, status: "gone" });
     if (outcome.status === "settled")
@@ -352,18 +349,17 @@ export async function handlePostReviewAccept(req, res, root) {
  * Otherwise it answers the topped entry's role/commit/summary and moves its queue file to
  * the front. */
 export async function handleQueueTop(req, res, root) {
-    const body = await readPostBody(req, res, '{"sha": "1a2b3c4"}');
-    if (!body)
+    const parsed = await readShaBody(req, res);
+    if (parsed === null)
         return;
-    if (typeof body.sha !== "string" || !/^[0-9a-f]{4,64}$/i.test(body.sha))
-        return badRequest(res, `"sha" must be a hex commit id of 4-64 digits${gotSuffix(body.sha)}`);
-    if (rejectInFlightMerge(res, root, body.sha))
+    const { sha } = parsed;
+    if (rejectInFlightMerge(res, root, sha))
         return;
-    const outcome = moveQueuedMergeToTopBySha(root, body.sha);
+    const outcome = moveQueuedMergeToTopBySha(root, sha);
     if (outcome.status === "gone")
         return sendJson(res, 200, { ok: true, status: "gone" });
     if (outcome.status === "already-first")
-        return sendJson(res, 200, { ok: true, status: "already-first", role: outcome.role, commit: outcome.sha, summary: outcome.summary, message: `${shortSha(body.sha)} is already at the front` });
+        return sendJson(res, 200, { ok: true, status: "already-first", role: outcome.role, commit: outcome.sha, summary: outcome.summary, message: `${shortSha(sha)} is already at the front` });
     if (outcome.status !== "topped")
         return;
     sendJson(res, 200, {

package/dist/src/gui/gui-prompt-commands.js

@@ -13,7 +13,7 @@ import { promptPreview } from "../inbox/inbox.js";
 import { cancelQueuedFile } from "../inbox/inbox-cancel.js";
 import { editQueuedFile } from "../inbox/inbox-edit.js";
 import { topQueuedFile } from "../inbox/inbox-top.js";
-import { parseDurationMs } from "../cli/cli-args.js";
+import { durationLabel, parseDurationMs } from "../cli/cli-args.js";
 import { PAUSE_FOR_MAX_MS, submitRolePromptAndWake } from "../operator/operator-intent.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { rejectBadQueueFileName, rejectBadRole, requirePromptText } from "./gui-args.js";
@@ -70,7 +70,7 @@ function checkedPromptDefer(res, body) {
         return null;
     }
     if (ms > PAUSE_FOR_MAX_MS) {
-        badRequest(res, `defer is capped at 90d${gotSuffix(body.defer)}`);
+        badRequest(res, `defer is capped at ${durationLabel(PAUSE_FOR_MAX_MS)}${gotSuffix(body.defer)}`);
         return null;
     }
     return Date.now() + ms;

package/dist/src/gui/gui-server.js

@@ -13,7 +13,7 @@ import { captureStartupBuild, createReloadWatch, reexecSelf, watchReloadSupervis
 import { warnEvent, TUMWATER_SOURCE } from "../events/events.js";
 import { errorMessage } from "../text/text.js";
 import { handleBacklog, handleBacklogMatch, handleBrief, handleConfig, handleDiff, handleFailures, handleReport, handleHistory, handleLogs, handlePromptText, handleRun, handleRole, handleTranscript, handleDoctor, handleRetireList, } from "./gui-endpoints.js";
-import { handleAbort, handleAbortAll, handleBriefEdit, handleBudget, handleConfigSet, handleConfigUnset, handleRoleCap, handleRoleReviewAfterMerge, handleRoleEnable, handleRoleDisable, handleRoleInstances, handleRoleInterval, handleRoleInstructions, handleRoleModel, handleRoleQuietHours, handleNotifyTest, handlePause, handlePauseRole, handlePrompt, handleBacklogFile, handleBacklogCancel, handleBacklogRelease, handleBacklogTop, handleBacklogEdit, handlePromptCancel, handlePromptEdit, handlePromptRole, handlePromptTop, handleQuestionAnswer, handleReclaim, handleKillOrphans, handleDropBrokenPins, handleCommitBacklog, handleResyncInstall, handleRetireLeftovers, handleArchiveBacklog, handleRestart, handleStopSchedule, handleResetCounters, handleRoleNotes, handleRetire, handleRevert, handleQueueCancel, handleQueueTop, handlePostReviewAccept, handleQuarantineRelease, handleWake, handleWakeCancel, } from "./gui-endpoint-commands.js";
+import { handleAbort, handleAbortAll, handleBriefEdit, handleBudget, handleConfigSet, handleConfigUnset, handleRoleCap, handleRoleEnable, handleRoleDisable, handleRoleInstances, handleRoleInterval, handleRoleInstructions, handleRoleModel, handleRoleQuietHours, handleNotifyTest, handlePause, handlePauseRole, handlePrompt, handleBacklogFile, handleBacklogCancel, handleBacklogRelease, handleBacklogTop, handleBacklogEdit, handlePromptCancel, handlePromptEdit, handlePromptRole, handlePromptTop, handleQuestionAnswer, handleReclaim, handleKillOrphans, handleDropBrokenPins, handleCommitBacklog, handleResyncInstall, handleRetireLeftovers, handleArchiveBacklog, handleRestart, handleStopSchedule, handleResetCounters, handleRoleNotes, handleRetire, handleRevert, handleQueueCancel, handleQueueTop, handlePostReviewAccept, handleQuarantineRelease, handleWake, handleWakeCancel, } from "./gui-endpoint-commands.js";
 import { sendJson } from "./gui-http-body.js";
 /** Constant-time credential comparison for the shared-token gate: `timingSafeEqual` throws
  * on unequal lengths, so the length equality is the guard. A naive `===` string compare
@@ -176,7 +176,6 @@ export function startGui(root, port, allInterfaces = false, token = "", watch =
         "POST /api/question-answer": (req, res) => handleQuestionAnswer(req, res, root),
         "POST /api/budget": (req, res) => handleBudget(req, res, root),
         "POST /api/role-cap": (req, res) => handleRoleCap(req, res, root),
-        "POST /api/role-review-after-merge": (req, res) => handleRoleReviewAfterMerge(req, res, root),
         "POST /api/role-enable": (req, res) => handleRoleEnable(req, res, root),
         "POST /api/role-disable": (req, res) => handleRoleDisable(req, res, root),
         "POST /api/role-interval": (req, res) => handleRoleInterval(req, res, root),

package/dist/src/gui/gui-team-commands.js

@@ -11,6 +11,7 @@ import { cancelWakes, PAUSE_FOR_MAX_MS, requestWake } from "../operator/operator
 import { requirePausedFlag, validRoleIds } from "./gui-args.js";
 import { badRequest, sendJson } from "./gui-http-body.js";
 import { gotSuffix } from "../text/text.js";
+import { durationLabel } from "../cli/cli-args.js";
 import { readPostBody, readRoleBody } from "./gui-endpoint-common.js";
 /** The shared optional-seconds rule behind the timed pause's `forSeconds` and the scheduled
  * wake/stop's `inSeconds`: the field is absent (undefined) or a positive finite number of
@@ -30,7 +31,7 @@ function boundedSecondsMs(res, body, field, capHint = "") {
         return null;
     }
     if (seconds * 1000 > PAUSE_FOR_MAX_MS) {
-        badRequest(res, `${field} is capped at ${PAUSE_FOR_MAX_MS / 1000} seconds (90 days)${gotSuffix(seconds)}${capHint}`);
+        badRequest(res, `${field} is capped at ${durationLabel(PAUSE_FOR_MAX_MS)}${gotSuffix(seconds)}${capHint}`);
         return null;
     }
     return Math.round(seconds * 1000);

package/dist/src/history/history.js

@@ -3,7 +3,7 @@ import { betweenWindow, durationLabel, failRivalShapes, failUntilShorterThanSinc
 import { HISTORY_DEFAULT_RUNS, HISTORY_MAX_RUNS, HISTORY_RESULT_FLAG_NAMES, HISTORY_SUMMARY_GROUPS, historyClass, parseHistoryResultClass, readRunRows, readRunRowsSince, runRows, summarizeRunRows, summarizeRunRowsByModel, runRowsMatchingGrep, runRowsOnModels } from "./history-data.js";
 import { renderModelSummary, renderRow, renderSummary, widenWidths, widestWidths } from "./history-render.js";
 import { LOGS_SINCE_MAX_MS, SPARSE_WINDOW_NOTE } from "../events/event-window.js";
-import { followUntilParentGone } from "../cli/log-commands.js";
+import { followUntilParentGone } from "../cli/cli-log-commands.js";
 import { hasFollowFlag } from "../cli/cli-flag-specs.js";
 import { parseEventLine, readEventsTailWithEnd } from "../events/event-read.js";
 import { eventsLogPath } from "../paths.js";
@@ -23,7 +23,7 @@ export function parseHistoryModelList(raw) {
     return pieces;
 }
 /** `tumwater history [--role <id>[,<id>...]] [-n N]`: one row per completed run, newest first. The
- * observing half beside cmdLogs (log-commands.ts): read-only over the event log, stdout only —
+ * observing half beside cmdLogs (cli-log-commands.ts): read-only over the event log, stdout only —
  * every datum rides the `run_end` events src/run/run-finalize.ts already writes, so this
  * is a rendering of the existing record, not a new one. The rows themselves are collected
  * by history-data.ts (beside src/report/report-data.ts and src/failure/failure-data.ts), and
@@ -31,7 +31,7 @@ export function parseHistoryModelList(raw) {
  * src/report/report-render.ts); this module parses the args, drives the CLI, and prints. */
 /** The missing-pattern error cmdHistory prints for a valueless or empty `--grep`, exported so
  * cli.ts's rejectUnknownArgs spec for --grep can fail a trailing `history --grep` with the same
- * wording. Kept local to this module — log-commands.ts holds its own GREP_VALUE_ERROR — so the
+ * wording. Kept local to this module — cli-log-commands.ts holds its own GREP_VALUE_ERROR — so the
  * two observing views' wordings each name the command that printed them. */
 export const HISTORY_GREP_VALUE_ERROR = "history --grep needs a pattern";
 /** The missing-value error cmdHistory prints for a valueless or empty `--result`, exported so
@@ -192,7 +192,7 @@ function sayHistoryEmpty(q, filtered) {
     // `no runs in 2h` are statements about the LOG and the WINDOW, and both are false when
     // rows were scanned and filtered out — the operator would read a quiet team where the
     // truth is `the runs are there, none match`. The logs --grep rule (its `no events
-    // matching "<pattern>"`, src/cli/log-commands.ts) names the pattern instead; --json stays
+    // matching "<pattern>"`, src/cli/cli-log-commands.ts) names the pattern instead; --json stays
     // a bare {"rows":[]} document above, never prose in either form.
     //
     // The result class is named only when it emptied a non-empty set (`afterGrep > 0`): an

package/dist/src/merge/merge-check-failures.js

@@ -3,7 +3,7 @@ import { mergeRefName } from "../paths.js";
 import { recordReview } from "../run/run-apply.js";
 import { saveRunnerStateBestEffort } from "../runner/runner-state.js";
 import { unverifiedTreeOutcome } from "../build/build-check-events.js";
-import { checkFailureReasons, describeCheck, failureHeadline } from "../build/build-check-report.js";
+import { checkFailureReasons, redCheckHeadline } from "../build/build-check-report.js";
 import { onlyKnownMainFailures } from "../baseline/main-watch.js";
 import { mainTipVerdict } from "../baseline/main-red.js";
 import { logEventBestEffort, warnEventBestEffort } from "../events/events.js";
@@ -126,7 +126,7 @@ export async function mergeCheckRed(ctx, role, wt, red) {
     if (result === "merge_blocked" && !attributed) {
         warnEventBestEffort(ctx.root, role, `merge check failed (kept for one retry): ${reason}`);
         if (ctx.state.mergeCheckFailures) {
-            ctx.state.mergeCheckFailures.headline = failureHeadline(red.outcome.outputTail) ?? describeCheck(red.check);
+            ctx.state.mergeCheckFailures.headline = redCheckHeadline(red.check, red.outcome.outputTail);
         }
     }
     return result;
@@ -143,15 +143,18 @@ export function noteMergeRetryPassed(ctx, role, pinPatch) {
     if (headline)
         warnEventBestEffort(ctx.root, role, MERGE_FLAKY_WARNING_PREFIX + headline);
 }
-/** A merge blocked by a deterministic cross-check (onMergeBlocked's fix-claim or
- * backlog-structure reason — a property of the tree ahead of main, not a flaky run). The
- * block is counted like a red merge check, keyed by the same patch-id: under
- * MERGE_CHECK_FAILURE_LIMIT the pin is kept for one recovery re-merge — main may have moved
- * under the rebase, and a differently-rebased tree can pass the cross-check — but at the
+/** A merge blocked by a deterministic cross-check — a property of the tree ahead of main,
+ * not a flaky run. The block is counted like a red merge check, keyed by the same patch-id:
+ * under MERGE_CHECK_FAILURE_LIMIT the pin is kept for one recovery re-merge — main may have
+ * moved under the rebase, and a differently-rebased tree can pass the cross-check — but at the
  * limit the block is attributed to the change: rejected deterministically with the block
  * reason, the pin deleted, no model run. Without this a resolution that trips the same
  * cross-check on every re-resolve pays a fresh conflict-resolver run each run, forever
- * (BUGS.md 2026-10-02: five resolver sessions for one fix-claim-blocked pin). */
+ * (BUGS.md 2026-10-02: five resolver sessions for one fix-claim-blocked pin). Since part 3m/3
+ * the merge path no longer produces cross-check blocks (a fix claim and a broken backlog
+ * structure are repairable and land for the main watch), so nothing in the in-lock path calls
+ * this today; it stays as the strike-counting sink, still pinned by INV-BF2 and retired with
+ * the queue by 3f/3. */
 export async function mergeBlocked(ctx, role, wt, blocked) {
     return keepPinOrAttribute(ctx, wt, blocked, (head) => rejectChange(ctx, role, head, [`merge blocked: ${blocked}`], ctx.state));
 }
@@ -185,7 +188,7 @@ export async function attributeRedCheck(ctx, role, head, label, red, state) {
     const kept = keepForKnownFailures(ctx, role, label, red, state);
     if (kept)
         return kept;
-    const headline = failureHeadline(red.outcome.outputTail) ?? describeCheck(red.check);
+    const headline = redCheckHeadline(red.check, red.outcome.outputTail);
     const key = normalizeClusterKey(headline);
     if (isKnownFlake(ctx.root, headline) && state.mergeFlakeExcused !== key) {
         state.mergeFlakeExcused = key;