tumwater 0.4.5 → 0.4.6

package/dist/src/doctor/doctor-project-checks.js

@@ -31,8 +31,8 @@ import { KNOWN_FLAKE_WINDOW_MS, loadQuarantine, repeatedFlakeCounts } from "../r
 import { POST_MERGE_REJECT_WINDOW_MS, postMergeChurn } from "../review/post-merge-review.js";
 import { roleLabel } from "../roles/role-labels.js";
 import { quarantineWarning } from "../baseline/main-guardrails.js";
-import { readCiParity, currentCiParityState, parityIsCurrent, ciParityStalled, CI_PARITY_STALE_MS } from "../run/ci-parity.js";
-import { readQaCoverage, qaCoverageStalled, QA_COVERAGE_STALE_MS } from "../run/qa-coverage.js";
+import { readCiParity, currentCiParityState, parityIsCurrent, ciParityStalled, CI_PARITY_STALE_MS } from "../observer/ci-parity.js";
+import { readQaCoverage, qaCoverageStalled, QA_COVERAGE_STALE_MS } from "../observer/qa-coverage.js";
 import { failOutcome, okOutcome, warnOutcome } from "./doctor-outcome.js";
 /** .tumwater writable — absent is fine (created on first run); present, prove it by writing
  * and deleting a temp file inside. The probe leaves the dir's listing unchanged after the run.
@@ -352,9 +352,9 @@ function tipLockPhrase(tip, lockHash) {
     return `${shortSha(tip)} @ lock ${shortSha(lockHash)}`;
 }
 /** The doctor's `ci parity` row: does the full suite cover main's current tip? Reads the
- * CI-parity ledger (src/run/ci-parity.ts) — the operator surface answering "is main verified by
- * CI?" — and reports whether the last run covered the current main tip @ lock. Missing ledger
- * reads "no CI parity recorded yet" (ok); a failed record is a `warn` naming the covered
+ * CI-parity ledger (src/observer/ci-parity.ts) — the operator surface answering whether main
+ * is verified by CI — and reports whether the last run covered the current main tip @ lock.
+ * Missing ledger reads "no CI parity recorded yet" (ok); a failed record is a `warn` naming the
  * tip/lock (the ci role's contract is to fix or file what it finds, so a lingering failed record
  * is actionable until the next green run); the `current`/`stale` split is `parityIsCurrent`'s
  * one home, so the row and the ci prompt block cannot drift. Stale is normally `ok` — main moves
@@ -387,7 +387,7 @@ export function checkCiParity(root, config, now = Date.now()) {
 }
 /** The doctor's `qa coverage` row: has the `qa` observer — the team's only flow-level
  * observer — stopped exercising any of the product's own flows? Reads the flow-coverage ledger
- * (src/run/qa-coverage.ts), the operator surface answering "is qa still recording what it
+ * (src/observer/qa-coverage.ts), the operator surface answering "is qa still recording what it
  * exercises?". A missing ledger reads "no qa flow coverage recorded yet" (ok — no record yet
  * is not a stall); a fresh ledger reads ok naming the newest exercised flow and its age. A
  * ledger whose newest exercise is older than `QA_COVERAGE_STALE_MS` (qaCoverageStalled) is a

package/dist/src/events/event-format.js

@@ -258,19 +258,52 @@ function runEventMessage(e) {
         default: return textOr(e.type);
     }
 }
+function mergeQueuedMessage(e) {
+    // Merge queue 3/5: routine state change (the run committed and the merge slot is
+    // ahead) — no warning prefix. The merge's own events follow it. A retry-bearing event
+    // (a re-queued entry) appends its why-it-is-back suffix; a
+    // fresh enqueue's line stays byte-identical.
+    const base = `waiting to merge ${shortSha(e.commit)} — ${textOr(e.summary)}`;
+    return `${base}${typeof e.retry === "string" && e.retry ? ` (re-queued after ${textOr(e.retry)})` : ""}`;
+}
+function mergeFailedMessage(e) {
+    // The event names its reason itself (writeMergeOutcome); the review/check events still
+    // carry the full text. An old event without `reason` renders the bare outcome.
+    return `merge of ${shortSha(e.commit)} failed (${eventTypeLabel(outcomeText(e))}${isNonBlankString(e.reason) ? `: ${truncate(e.reason.trim(), 120)}` : ""})${elapsed(e.durationMs)}${isNonBlankString(e.summary) ? ` — ${truncate(e.summary, 80)}` : ""}`;
+}
+function conflictHandbackMessage(e) {
+    // A change whose merges kept conflicting was handed back to its author with the markers
+    // in place (PLANS.md "Robust conflict landing, part 2/2"): queued, applied, or failed.
+    const files = stringList(e.conflicted);
+    const where = files.length > 0 ? `: ${files.join(", ")}` : "";
+    const why = e.reason === "revision" ? " (revision)" : "";
+    return `conflict hand-back ${textOr(e.action)} ${shortSha(e.sha)}${why}${where}`;
+}
+function operatorRevertMessage(e) {
+    const undid = typeof e.runner === "string" && e.runner !== "" ? `, undid ${e.runner}` : "";
+    return `reverted ${shortSha(e.commit)} (by operator) as ${shortSha(e.revert)}${undid}`; // vocabulary-ok: the deliberate-revert writer is the operator role
+}
+function mainCheckMessage(e) {
+    const failing = Array.isArray(e.failingTests) ? e.failingTests.map(String) : [];
+    // The commit count renders only when it is a real number over 1 — the corrupt-field rule
+    // this file applies to every event number (a hand-edited line's quoted "3" or "0x10" reads
+    // as no covered count, not as a coerced parenthetical).
+    const coveredN = finiteNumber(e.covered, null);
+    const covered = coveredN !== null && coveredN > 1 ? ` (${coveredN} commits)` : "";
+    const verdict = e.status === "failed" ? "failed" : "passed";
+    const names = failing.length > 0 ? `: ${joinWithMore(failing, 3, "; ")}` : "";
+    return `main ${shortSha(e.sha)}${covered} full check ${verdict}${names}`;
+}
+function mainCulpritMessage(e) {
+    const by = typeof e.runner === "string" && e.runner !== "" ? ` (merged by ${e.runner})` : "";
+    return `main turned red at ${shortSha(e.commit)}${by}`;
+}
 function mergeEventMessage(e) {
     switch (e.type) {
         case "merged":
             return `merged ${shortSha(e.commit)} to main — ${textOr(e.summary)}`;
         case "merge_queued":
-            // Merge queue 3/5: routine state change (the run committed and the merge slot is
-            // ahead) — no warning prefix. The merge's own events follow it. A retry-bearing event
-            // (a re-queued entry) appends its why-it-is-back suffix; a
-            // fresh enqueue's line stays byte-identical.
-            {
-                const base = `waiting to merge ${shortSha(e.commit)} — ${textOr(e.summary)}`;
-                return `${base}${typeof e.retry === "string" && e.retry ? ` (re-queued after ${textOr(e.retry)})` : ""}`;
-            }
+            return mergeQueuedMessage(e);
         case "merge_cancelled":
             // Routine operation (the user removed a waiting merge), not a warning — like
             // prompt_cancelled. The merge_cancelled event name carries the payload (commit + summary).
@@ -285,36 +318,15 @@ function mergeEventMessage(e) {
             // render bare — the same phrase run_end carries for its run.
             return `merge of ${shortSha(e.commit)} done${elapsed(e.durationMs)}${usagePhrase(e)}`;
         case "merge_failed":
-            // The event names its reason itself (writeMergeOutcome); the review/check events still
-            // carry the full text. An old event without `reason` renders the bare outcome.
-            return `merge of ${shortSha(e.commit)} failed (${eventTypeLabel(outcomeText(e))}${isNonBlankString(e.reason) ? `: ${truncate(e.reason.trim(), 120)}` : ""})${elapsed(e.durationMs)}${isNonBlankString(e.summary) ? ` — ${truncate(e.summary, 80)}` : ""}`;
-        case "conflict_handback": {
-            // A change whose merges kept conflicting was handed back to its author with the markers
-            // in place (PLANS.md "Robust conflict landing, part 2/2"): queued, applied, or failed.
-            const files = stringList(e.conflicted);
-            const where = files.length > 0 ? `: ${files.join(", ")}` : "";
-            const why = e.reason === "revision" ? " (revision)" : "";
-            return `conflict hand-back ${textOr(e.action)} ${shortSha(e.sha)}${why}${where}`;
-        }
-        case "operator_revert": {
-            const undid = typeof e.runner === "string" && e.runner !== "" ? `, undid ${e.runner}` : "";
-            return `reverted ${shortSha(String(e.commit ?? ""))} (by operator) as ${shortSha(String(e.revert ?? ""))}${undid}`; // vocabulary-ok: the deliberate-revert writer is the operator role
-        }
-        case "main_check": {
-            const failing = Array.isArray(e.failingTests) ? e.failingTests.map(String) : [];
-            // The commit count renders only when it is a real number over 1 — the corrupt-field rule
-            // this file applies to every event number (a hand-edited line's quoted "3" or "0x10" reads
-            // as no covered count, not as a coerced parenthetical).
-            const coveredN = finiteNumber(e.covered, null);
-            const covered = coveredN !== null && coveredN > 1 ? ` (${coveredN} commits)` : "";
-            const verdict = e.status === "failed" ? "failed" : "passed";
-            const names = failing.length > 0 ? `: ${joinWithMore(failing, 3, "; ")}` : "";
-            return `main ${shortSha(String(e.sha ?? ""))}${covered} full check ${verdict}${names}`;
-        }
-        case "main_culprit": {
-            const by = typeof e.runner === "string" && e.runner !== "" ? ` (merged by ${e.runner})` : "";
-            return `main turned red at ${shortSha(String(e.commit ?? ""))}${by}`;
-        }
+            return mergeFailedMessage(e);
+        case "conflict_handback":
+            return conflictHandbackMessage(e);
+        case "operator_revert":
+            return operatorRevertMessage(e);
+        case "main_check":
+            return mainCheckMessage(e);
+        case "main_culprit":
+            return mainCulpritMessage(e);
         case "main_red_hold":
             // The message already names the SHA, script, and consequence; the problem tone comes
             // from PROBLEM_EVENTS.

package/dist/src/events/event-labels.js

@@ -106,6 +106,7 @@ export const RUN_RESULT_LABELS = {
     quiet_killed: "stalled, resumed",
     user_aborted: "stopped by you",
     main_red: "main's check is failing",
+    withdrawn: "entry withdrawn, dropped",
 };
 /** The words for an event type or run result code: its own-property label, else the code with
  * underscores as spaces. The two code families are disjoint, so one lookup serves both. */

package/dist/src/failure/failure-render.js

@@ -26,6 +26,7 @@ const RESULT_ORDER = {
     quiet_killed: 11,
     aborted: 12,
     user_aborted: 13,
+    withdrawn: 14,
 };
 /** The digest table's columns: every RunResult that at least one role logged in the window, ranked
  * by RESULT_ORDER (ties alphabetical), so the table's shape follows the window's evidence instead

package/dist/src/failure/failure-time-spend.js

@@ -24,6 +24,7 @@ export const OUTCOME_CLASS = {
     quiet_killed: "error",
     aborted: "error",
     user_aborted: "error",
+    withdrawn: "no_change",
 };
 /** A row's summed wall-clock span across its outcome classes — the sort key that puts the
  * burning role first, the way the usage report ranks its cost lines. */

package/dist/src/git/slot-salvage.js

@@ -131,6 +131,12 @@ function settlePatch(root, file) {
         return file;
     }
 }
+/** Settle every patch waiting for `role`'s next run under salvageDir for the operator instead
+ * of restoring it: the work it saved belongs to a withdrawn backlog entry (the runner's
+ * `withdrawn` marker). Returns the kept paths, newest first. */
+export function keepSalvagedWorkForOperator(root, role) {
+    return pendingPatches(root, role).map((file) => settlePatch(root, file));
+}
 /** Restore the newest patch of `role`'s unfinished work waiting under salvagePendingDir into `dir`,
  * the fresh checkout of the role's branch its run is about to work in, as uncommitted edits. The
  * patch applies exactly when the checkout is still at the patch's base. When the branch has moved,

package/dist/src/gui/gui-history-endpoints.js

@@ -2,7 +2,7 @@
  * The dashboard's GET run/event-log drill-down handlers (src/gui/gui-server.ts routes to them):
  * transcript, history, logs, run, and role. Each answers its request and touches no socket
  * beyond its own `res`; the domain work lives one layer down (ui/transcript.ts,
- * history/history-data.ts, run/run-detail-data.ts, events/event-read.ts), so this module only
+ * history/history-data.ts, history/run-detail-data.ts, events/event-read.ts), so this module only
  * adapts HTTP onto it. Barrelled into gui/gui-endpoints.ts beside the other per-family GET
  * endpoint modules.
  */
@@ -12,15 +12,15 @@ import { HISTORY_DEFAULT_RUNS, HISTORY_MAX_RUNS, HISTORY_RESULT_FLAG_NAMES, hist
 import { LOGS_SINCE_MAX_MS, SPARSE_WINDOW_NOTE, readEventsSince } from "../events/event-window.js";
 import { eventRole, readEvents } from "../events/event-read.js";
 import { eventFeedItem, eventMatchesGrep } from "../events/event-format.js";
-import { readRunDetail, runCommitSha, runMergedSha } from "../run/run-detail-data.js";
-import { renderRunDetail, runDetailPatch, runDetailStat, runTranscriptLines } from "../run/run-detail-render.js";
+import { readRunDetail, runCommitSha, runMergedSha } from "../history/run-detail-data.js";
+import { renderRunDetail, runDetailPatch, runDetailStat, runTranscriptLines } from "../history/run-detail-render.js";
 import { resolveRevertTarget } from "../operator/operator-revert.js";
 import { rolePayload } from "../roles/role-view.js";
 import { clampCount, intQuery, rejectBadRole, sinceMsQuery, untilMsQuery } from "./gui-args.js";
 import { badRequest, sendJson } from "./gui-http-body.js";
 import { oneOfMessage } from "../text/suggest.js";
 import { splitCommaList, splitCommaListUnique } from "../text/text.js";
-import { newestRunRow, runNotFoundLastMessage, runNotFoundMessage } from "../run/run-detail.js";
+import { newestRunRow, runNotFoundLastMessage, runNotFoundMessage } from "../history/run-detail.js";
 /** Handle GET /api/transcript?role=<id>&n=N[&grep=<text>]: rendered transcript lines for a role's
  * pi log (same rendering as `tumwater logs --transcript <id>`). A present `prompt` flag also
  * renders each agent run's prompt, the text `logs --transcript <id> --prompt` prints.

package/dist/src/history/history.js

@@ -1,5 +1,5 @@
 import { fail, say, sayJson, sayJsonLine } from "../cli/cli-output.js";
-import { betweenWindow, durationLabel, failRivalShapes, failUntilShorterThanSince, flagValue, parseCountFlag, parseGrepFlag, parseRoleListScope, parseSinceFlag, rejectFlagLookingValue } from "../cli/cli-args.js";
+import { betweenWindow, durationLabel, failFollowSinceRival, failRivalShapes, failUntilShorterThanSince, flagValue, parseCountFlag, parseGrepFlag, parseRoleListScope, parseSinceFlag, rejectFlagLookingValue } from "../cli/cli-args.js";
 import { HISTORY_DEFAULT_RUNS, HISTORY_MAX_RUNS, HISTORY_RESULT_FLAG_NAMES, HISTORY_SUMMARY_GROUPS, historyClass, parseHistoryResultClass, readRunRows, readRunRowsSince, runRows, summarizeRunRows, summarizeRunRowsByModel, runRowsMatchingGrep, runRowsOnModels } from "./history-data.js";
 import { renderModelSummary, renderRow, renderSummary, widenWidths, widestWidths } from "./history-render.js";
 import { LOGS_SINCE_MAX_MS, SPARSE_WINDOW_NOTE } from "../events/event-window.js";
@@ -93,7 +93,7 @@ function parseHistoryQuery(root, args) {
     const follow = hasFollowFlag(rest);
     if (follow) {
         if (rest.includes("--since"))
-            failRivalShapes("history --since", "-f/--follow", 'follow means "from now on"; --since shows a bounded past window');
+            failFollowSinceRival("history");
         if (rest.includes("--summary"))
             failRivalShapes("history --summary", "-f/--follow", "a summary tallies a bounded set; -f follows from now on");
     }

package/dist/src/{run → history}/run-detail-data.js

@@ -9,8 +9,8 @@
  * runMergedSha) live here beside the payload they describe; the rendering half — the summary
  * header, formatEvent, the stat/patch and transcript text — lives in run-detail-render.ts,
  * and the CLI command in run-detail.ts. */
-import { HISTORY_SCAN_MAX_EVENTS } from "../history/history-data.js";
-import { bucketMergeEvents, resolveQueuedResult } from "../history/history-queued.js";
+import { HISTORY_SCAN_MAX_EVENTS } from "./history-data.js";
+import { bucketMergeEvents, resolveQueuedResult } from "./history-queued.js";
 import { eventUsage, readEvents, runSpanMs, runStartMap } from "../events/event-read.js";
 import { outcomeText, usageText } from "../events/event-format.js";
 import { baseRoleOf } from "../roles/runner-ids.js";

package/dist/src/{run → history}/run-detail.js

@@ -7,8 +7,8 @@
 import { fail, say, sayJson } from "../cli/cli-output.js";
 import { parseCountFlag } from "../cli/cli-args.js";
 import { knownRoleIdsCached } from "../config/config.js";
-import { HISTORY_MAX_RUNS, HISTORY_RESULT_FLAG_NAMES, historyClass, readRunRows, runRowsOnModels } from "../history/history-data.js";
-import { parseHistoryModelList, parseHistoryResultList } from "../history/history.js";
+import { HISTORY_MAX_RUNS, HISTORY_RESULT_FLAG_NAMES, historyClass, readRunRows, runRowsOnModels } from "./history-data.js";
+import { parseHistoryModelList, parseHistoryResultList } from "./history.js";
 import { readRunDetail } from "./run-detail-data.js";
 import { runDetailPatch, runDetailStat, renderRunDetail, runTranscriptLines } from "./run-detail-render.js";
 import { unknownRoleMessage } from "../roles/roles.js";

package/dist/src/inbox/inbox-top.js

@@ -4,6 +4,7 @@ import { logEventBestEffort, warnEventBestEffort } from "../events/events.js";
 import { lowestStampName, queueFileStamp, removeQueueFile } from "../files/file-queue.js";
 import { readTextIfExists, writeTextAtomic } from "../files/files.js";
 import { roleInboxDir } from "../paths.js";
+import { roleLabel } from "../roles/role-labels.js";
 import { assertQueueFileName } from "./inbox-cancel.js";
 import { promptPreview, queuedFileAtPosition, queuedFiles } from "./inbox.js";
 import { movePromptImages, stripVanishedImageReferences } from "./inbox-attachments.js";
@@ -72,7 +73,7 @@ function moveFileToTop(root, role, file) {
 export function movePromptToTop(root, role, position) {
     const file = queuedFileAtPosition(root, role, position);
     if (position === 1)
-        throw new Error(`prompt ${position} is already first`);
+        throw new Error(`prompt ${position} for ${roleLabel(role)} is already first`);
     return moveFileToTop(root, role, file);
 }
 /** Move one queued prompt addressed by its queue-file basename to the head of its role's

package/dist/src/merge/merge-batch.js

@@ -9,6 +9,7 @@ import { leaseSlot } from "../git/worktree-pool.js";
 import { slotCount } from "../config/config.js";
 import { reviewPinnedChange, syncPinToMain, } from "./merge-core.js";
 import { errorMessage } from "../text/text.js";
+import { dropWithdrawnPin, withdrawnPinReason } from "./merge-withdrawn.js";
 /** Verify one request — the whole of a verify-stage task: lease a pooled slot for the role, check
  * its pin out detached there, rebase it onto main's current tip (syncPinToMain — so the head
  * approved here is the head its merge starts from, and a conflict leaves the pin for the gate
@@ -20,6 +21,14 @@ import { errorMessage } from "../text/text.js";
  * a commit. leaseSlot holds the slot through the disk-floor registry and resets it to the pin, so
  * two verifies rebasing at once — or one rebasing while a merge moves main — cannot interfere. */
 export async function verifyRequest(ctx, req, w) {
+    // A change whose backlog entry main no longer lists never merges (merge-withdrawn.ts). Asked
+    // before the slot lease and syncPinToMain's rebase, while the pin's merge-base with main still
+    // lists every entry the change moved: the rebase would carry its base past the removal.
+    const withdrawn = await withdrawnPinReason(ctx.root, ctx.mainBranch, req, req.sha);
+    if (withdrawn !== null) {
+        await dropWithdrawnPin(ctx.root, req.role, w.state, withdrawn);
+        return { kind: "result", result: "withdrawn" };
+    }
     let lease;
     try {
         lease = await leaseSlot(ctx.root, {

package/dist/src/merge/merge-core.js

@@ -14,6 +14,7 @@ import { priorObjectionNumber } from "../review/review-verdict.js";
 import { DIRECTOR_ROLE } from "../roles/roles.js";
 import { shortSha } from "../text/format.js";
 import { setMergeStage } from "./merge-slot.js";
+import { dropWithdrawnPin, withdrawnPinReason } from "./merge-withdrawn.js";
 /** Rebase a pinned change in its leased pool slot `wt` (checked out detached at `req.sha`) onto
  * main's CURRENT head before its review gate, and return the request that gate must judge.
  * The gate must review main's current tree, not the main the author started from: when main
@@ -277,6 +278,15 @@ async function mergeApprovedChangeIn(ctx, req) {
         mainBranch: ctx.mainBranch,
         config: ctx.config,
         runNumber: req.runNumber,
+        // Main may have dropped the change's backlog entry since its verify: checked again in the
+        // lock, where a withdrawn change deletes its pin and the merge settles `withdrawn`.
+        withdrawn: async (mergeWt) => {
+            const reason = await withdrawnPinReason(mergeWt, ctx.mainBranch, req, "HEAD");
+            if (reason === null)
+                return false;
+            await dropWithdrawnPin(ctx.root, req.role, ctx.state, reason);
+            return true;
+        },
         runPi: ctx.runPi,
         recheckResolved: async (resolvedWt) => {
             if (ctx.signal().aborted)
@@ -326,6 +336,9 @@ async function mergeApprovedChangeIn(ctx, req) {
         await deleteRef(ctx.root, mergeRefName(req.role)); // merged: the pin has done its job
         return result;
     }
+    // Withdrawn in the lock: the closure above already deleted the pin and wrote the lastError.
+    if (result === "withdrawn")
+        return result;
     // merge_conflict / merge_blocked: keep the ref — the next run's recovery re-merges it.
     // (The deterministic cross-check blocks — fix-claim and backlog structure — no longer come
     // through here: since part 3m/3 they are repairable and land for the main watch.)

package/dist/src/merge/merge-drain.js

@@ -59,8 +59,18 @@ export async function settleAbortedApproved(root, p) {
         }
         catch (err) {
             warnEventBestEffort(root, TUMWATER_SOURCE, `the stopped merge for ${role} could not be settled: ${errorMessage(err)}`);
-            dropMerge(v.file);
-            removeMergeChange(root, role);
+            // The abort is honored by hand — drop the queue file and marker. That cleanup can itself
+            // throw (a queue file that is a directory fails fs.rmSync's non-recursive delete, the
+            // shape an ENOSPC or immutable queue file takes): report it and still discard the pin,
+            // so this settle never throws out of the poll body and the next poll does not re-verify
+            // and merge the change the operator stopped.
+            try {
+                dropMerge(v.file);
+                removeMergeChange(root, role);
+            }
+            catch (cleanupErr) {
+                warnEventBestEffort(root, TUMWATER_SOURCE, `the stopped merge for ${role} could not be dropped: ${errorMessage(cleanupErr)}`);
+            }
         }
         await discardPinnedRefs(root, [role]);
     }
@@ -187,6 +197,7 @@ function startMerge(ctx, p, picks) {
                         sha: v.sha,
                         runNumber: v.entry.run,
                         summary: v.entry.summary,
+                        ...(v.entry.claim !== undefined ? { claim: v.entry.claim } : {}),
                         body: v.entry.body,
                         highFriction: v.entry.highFriction,
                         ...entryRevisionFields(v.entry),

package/dist/src/merge/merge-pipeline.js

@@ -91,10 +91,11 @@ awaitingWatch) {
     writeMergeOutcome(root, entry, state, result, durationMs, usage, file);
     // A revision that merges ends the rejected change's life: drop the rejected ref (plans/revise-
     // rejected.md). A rejection repoints or deletes it in merge-core.ts, so this is the only
-    // ref cleanup a merged revision needs here. Guarded on the entry's revisionRound, not just a
-    // `changed` result: a fresh change can merge while a different rejection's revision is still
-    // pending, and its merge must leave that pending revision's ref alone.
-    if (result === "changed" && entry.revisionRound !== undefined) {
+    // ref cleanup a merged revision needs here; a withdrawn revision ends it the same way.
+    // Guarded on the entry's revisionRound, not just a `changed` result: a fresh change can merge
+    // while a different rejection's revision is still pending, and its merge must leave that
+    // pending revision's ref alone.
+    if ((result === "changed" || result === "withdrawn") && entry.revisionRound !== undefined) {
         await deleteRef(root, rejectedRefName(entry.role));
     }
     removeMergeChange(root, entry.role);

package/dist/src/merge/merge-queue.js

@@ -120,7 +120,14 @@ function isMergeEntry(v) {
         (e.notBefore === undefined || nonNegativeNumber(e.notBefore, null) !== null) &&
         (e.retry === undefined || typeof e.retry === "string") &&
         (e.retryCount === undefined || nonNegativeNumber(e.retryCount, null) !== null) &&
-        (e.watchWait === undefined || e.watchWait === "covered" || e.watchWait === "timed_out"));
+        (e.watchWait === undefined || e.watchWait === "covered" || e.watchWait === "timed_out") &&
+        (e.claim === undefined || isMergeClaim(e.claim)));
+}
+function isMergeClaim(v) {
+    return (isJsonObject(v) &&
+        (v.file === "PLANS.md" || v.file === "BUGS.md") &&
+        typeof v.key === "string" &&
+        typeof v.title === "string");
 }
 /** Read one queue file through the stat-keyed cache: null when it vanishes mid-listing (a
  * concurrent drop — the inbox.ts race policy), is unreadable, or fails to parse or to carry

package/dist/src/merge/merge-requeue.js

@@ -72,6 +72,18 @@ export async function requeueKeptChange(root, mainBranch, entry, state, result,
  * watch check that timed out or a restart's cold cache. A pin its gate kept for the watch waits
  * at most this long from the moment it was kept. */
 export const MAIN_RED_VERDICT_WAIT_MS = 15 * 60_000;
+/** The wait-start/timeout gate shared by requeueMainRedPin and requeueAwaitingWatch: if the kept
+ * record has no wait start yet, record `now` as one (and save) and hold this poll; otherwise hold
+ * while MAIN_RED_VERDICT_WAIT_MS has not passed since the start. Returns true only when the pin may
+ * proceed to re-queue. */
+function mainRedWaitElapsed(kept, root, state, now) {
+    if (kept.waitingSince === undefined) {
+        state.mainRedRetry = { ...kept, waitingSince: now };
+        saveRunnerStateBestEffort(root, state);
+        return false;
+    }
+    return now - kept.waitingSince >= MAIN_RED_VERDICT_WAIT_MS;
+}
 /** Re-queue a `main_red` pin once main's head differs from the one recorded when its attempt
  * settled (the orchestrator poll calls this for every runner), by the head's cached verdict: a
  * verdict — green or red — re-queues at once; no verdict starts (and saves) a wait at `now`, and
@@ -92,15 +104,8 @@ export async function requeueMainRedPin(root, mainBranch, state, mainHead, now =
     }
     if (mainHead === kept.head)
         return;
-    if (cachedBaselineVerdict(mainHead) === undefined) {
-        if (kept.waitingSince === undefined) {
-            state.mainRedRetry = { ...kept, waitingSince: now };
-            saveRunnerStateBestEffort(root, state);
-            return;
-        }
-        if (now - kept.waitingSince < MAIN_RED_VERDICT_WAIT_MS)
-            return;
-    }
+    if (cachedBaselineVerdict(mainHead) === undefined && !mainRedWaitElapsed(kept, root, state, now))
+        return;
     await requeueKeptPin(root, mainBranch, state);
 }
 /** requeueMainRedPin for a change its gate kept for the main watch (`awaitingWatch`): re-queue
@@ -114,15 +119,8 @@ async function requeueAwaitingWatch(root, mainBranch, state, mainHead, now) {
     if (kept?.awaitingWatch === undefined)
         return;
     const { covers } = await watchVerdictCovering(root, mainHead, kept.awaitingWatch);
-    if (!covers) {
-        if (kept.waitingSince === undefined) {
-            state.mainRedRetry = { ...kept, waitingSince: now };
-            saveRunnerStateBestEffort(root, state);
-            return;
-        }
-        if (now - kept.waitingSince < MAIN_RED_VERDICT_WAIT_MS)
-            return;
-    }
+    if (!covers && !mainRedWaitElapsed(kept, root, state, now))
+        return;
     await requeueKeptPin(root, mainBranch, state, covers ? "covered" : "timed_out");
 }
 /** Clear the kept `main_red` record and put its pin back on the queue — unless the pin is gone,

package/dist/src/merge/merge-to-main.js

@@ -55,6 +55,10 @@ async function tryMerge(ctx, wt, summary) {
         // and compare, so the diff is exact; on the conflict path only the second tryMerge call ever
         // reaches the post-ff code, so nothing double-emits.
         const before = openQuestions(ctx.root);
+        // In the lock, so no withdrawal can land between this check and the fast-forward; before the
+        // rebase, so the change's merge-base still lists the entries it moved.
+        if (ctx.withdrawn && (await ctx.withdrawn(wt)))
+            return "withdrawn";
         if (!(await rebaseOntoMain(wt, ctx.mainBranch)))
             return "merge_conflict";
         // The worktree's POST-REBASE HEAD: a pinned bare sha does not move when git

package/dist/src/merge/merge-verify.js

@@ -60,7 +60,11 @@ export function resolveAuthor(ctx, role) {
  * dropped (the pin survives and leftover recovery re-queues the full shape on the role's next
  * run), and the drain's poll never aborts. A torn head with no recoverable role or no pin drops
  * with the warning alone; the crashed entry's commit, if any, still rides its merge ref into
- * next-run leftover recovery. Exported for test/merge-queue.test.ts's torn-head step. */
+ * next-run leftover recovery. The drop itself can throw (a queue file that is a directory fails
+ * fs.rmSync's non-recursive delete — the shape an ENOSPC or immutable queue file takes), and this
+ * runs in the poll body with nothing to guard it: report it and leave the head in place rather
+ * than end the team, exactly as settleAbortedApproved guards its own drop. Exported for
+ * test/merge-queue.test.ts's torn-head step. */
 export async function dropTornHead(root) {
     const stale = staleHeadFile(root);
     if (!stale)
@@ -89,7 +93,13 @@ export async function dropTornHead(root) {
             }
         }
     }
-    dropMerge(stale);
+    try {
+        dropMerge(stale);
+    }
+    catch (err) {
+        warnEventBestEffort(root, TUMWATER_SOURCE, `merge queue head ${path.basename(stale)} could not be dropped: ${errorMessage(err)}`);
+        return;
+    }
     const roleNote = !role
         ? ""
         : requeued
@@ -221,6 +231,7 @@ export function startVerify(ctx, p, entry, file) {
                     highFriction: entry.highFriction,
                     ...entryRevisionFields(entry),
                     ...(entry.watchWait !== undefined ? { watchWait: entry.watchWait } : {}),
+                    ...(entry.claim !== undefined ? { claim: entry.claim } : {}),
                 }, { state: author.state, foldUsage, runPi: (w, prompt, s, cfg) => author.runMergePi(w, prompt, s, cfg), runGatePi: (opts) => author.runGatePi(opts) }));
             }
             catch (err) {

package/dist/src/merge/merge-withdrawn.js

@@ -0,0 +1,71 @@
+/** Withdrawn work: a queued change whose backlog entry main no longer lists never merges.
+ * On 2026-11-01 the operator withdrew "Subtract, part 3b/7" by deleting its PLANS.md entry ten
+ * minutes after feature-2 had claimed it. The claim was released, but the interrupted run kept
+ * resuming with the plan in its session and its kept worktree, and on 2026-11-02 its change
+ * merged (8ed0d3eec), deleting the pre-merge build check the operator had chosen to keep.
+ *
+ * The scheduling poll drops a withdrawn claim's resume or revision (claims.ts's `withdrawn`
+ * release). This module is the backstop at the merge, where every path to main passes: the
+ * verify asks it before it rebases a pin onto main, and the merge asks it again inside the merge
+ * lock before its own rebase. An entry is withdrawn from a change when the change works on it —
+ * its run's recorded claim, or an entry its diff moved out of the role's actionable section
+ * since its merge-base with main — and main's tip no longer lists it in that section. Each check
+ * runs before the rebase that would move the change's base past the removal, so the base still
+ * lists what the change moved. Only the work roles (feature, bugfix) take backlog entries; every
+ * other role's changes are never judged here. */
+import { actionableEntryRanges } from "../backlog/backlog-index-data.js";
+import { entryKey } from "../backlog/backlog-parts.js";
+import { roleSection } from "../backlog/backlog-eligibility.js";
+import { stripEntryStamp } from "../backlog/backlog-structure.js";
+import { warnEventBestEffort } from "../events/events.js";
+import { changeBaseRev, deleteRef, fileContentAt } from "../git/git.js";
+import { gitTryStarted } from "../git/git-run.js";
+import { mergeRefName } from "../paths.js";
+import { INSTANCE_ROLES, baseRoleOf } from "../roles/runner-ids.js";
+import { movedOutEntries } from "../scheduling/claims.js";
+/** The entries of `role`'s backlog section that commit `rev` works on and `mainBranch`'s tip no
+ * longer lists there, read through git in `dir` (the repo or any of its worktrees). A change works
+ * on `claim` (when it names the role's own backlog file) and on every entry its diff moved out of
+ * the section since its merge-base with `mainBranch`. Empty for a role that takes no backlog
+ * entries, and when the section cannot be read on main or at `rev`: an unreadable file never
+ * drops work. Throws only when git cannot start. */
+export async function withdrawnEntries(dir, mainBranch, role, rev, claim) {
+    if (!INSTANCE_ROLES.has(baseRoleOf(role)))
+        return [];
+    const { file, section } = roleSection(role);
+    const mainMd = await gitTryStarted(dir, "show", `${mainBranch}:${file}`);
+    const headMd = await gitTryStarted(dir, "show", `${rev}:${file}`);
+    if (mainMd === null || headMd === null)
+        return [];
+    const listed = new Set(actionableEntryRanges(mainMd, section).map((e) => entryKey(e.title)));
+    const baseMd = await fileContentAt(dir, await changeBaseRev(dir, mainBranch, rev), file);
+    const worked = new Map();
+    if (claim?.file === file)
+        worked.set(claim.key, claim.title);
+    for (const m of movedOutEntries(baseMd, headMd, section))
+        worked.set(m.key, m.title);
+    return [...worked].filter(([key]) => !listed.has(key)).map(([key, title]) => ({ key, title }));
+}
+/** The one-line reason a withdrawn change was dropped, naming the first entry (stamp-free) and
+ * the section main no longer lists it under. It is the warning and, behind the `withdrawn — `
+ * prefix the merge_failed reason strips, the role's lastError, so both say the same thing. */
+function withdrawnReason(role, entries) {
+    const { file, section } = roleSection(role);
+    const more = entries.length > 1 ? ` (and ${entries.length - 1} more)` : "";
+    const title = stripEntryStamp(entries[0].title);
+    return `dropped the change for "${title}"${more} unmerged: ${file} on main no longer lists it under ## ${section}`;
+}
+/** The reason to drop the pinned change `req` names at commit `rev` as withdrawn, or null to let
+ * it go on: withdrawnEntries over its role and recorded claim, worded by withdrawnReason. */
+export async function withdrawnPinReason(dir, mainBranch, req, rev) {
+    const entries = await withdrawnEntries(dir, mainBranch, req.role, rev, req.claim);
+    return entries.length === 0 ? null : withdrawnReason(req.role, entries);
+}
+/** Drop a pinned change found withdrawn: delete its merge ref, so neither the pipeline's re-queue
+ * nor leftover recovery can bring it back, record the reason as the role's lastError (the
+ * merge_failed event's reason) and warn with it. The caller settles the change `withdrawn`. */
+export async function dropWithdrawnPin(root, role, state, reason) {
+    await deleteRef(root, mergeRefName(role));
+    state.lastError = `withdrawn — ${reason}`;
+    warnEventBestEffort(root, role, reason);
+}

package/dist/src/operator/operator-commands.js

@@ -6,8 +6,8 @@ import { PAUSE_FOR_OVERFLOW_HINT, REASON_VALUE_ERROR, ROLE_VALUE_ERROR } from ".
 import { artifactPhrase, hasRetirableLeftovers, previewRetire, retireRole } from "./operator-retire.js";
 import { previewRevert, revertFollowUp, revertMergedCommit, runRevertSha } from "./operator-revert.js";
 import { distinctOrdered } from "../collections.js";
-import { runNotFoundMessage } from "../run/run-detail.js";
-import { readRunDetail } from "../run/run-detail-data.js";
+import { runNotFoundMessage } from "../history/run-detail.js";
+import { readRunDetail } from "../history/run-detail-data.js";
 import { readRunRows } from "../history/history-data.js";
 import { canonicalRoleId } from "../roles/legacy-role-ids.js";
 import { agree, plural, teamResumePhrase, pauseReasonSuffix } from "../text/phrases.js";

package/dist/src/operator/operator-revert.js

@@ -5,7 +5,7 @@ import { GitError, commitAuthorArgs, committerIdentArgs, gitTry, runGit } from "
 import { stampedRole, stampedSubject } from "../git/commit-message.js";
 import { shortSha } from "../text/format.js";
 import { logEventBestEffort, TUMWATER_SOURCE } from "../events/events.js";
-import { runMergedSha } from "../run/run-detail-data.js";
+import { runMergedSha } from "../history/run-detail-data.js";
 /** `tumwater revert <sha>`: undo one merged change on main, committing the inverse as
  * `tumwater(operator): Revert <short sha>` on the primary checkout. Mirrors
  * `commitOperatorBacklogEdit`'s lock-and-branch discipline (src/backlog/backlog-commit.ts): the