@coreplane/switchboard 1.213.0 → 1.215.0

package/dist/assets/deploy/cloudflare-memory/wrangler.template.jsonc

@@ -35,7 +35,15 @@
       // ONE DeliveryDO (named "delivery"): the delivery page's snapshot per
       // repository — the merged pull requests' facts over the window, one row
       // each, and when they were read (docs/reference/specs/delivery.md item 10).
-      { "name": "DELIVERY", "class_name": "DeliveryDO" }
+      { "name": "DELIVERY", "class_name": "DeliveryDO" },
+      // One SessionLogDO per session — a thread and an agent (the DO name is
+      // `<threadKey>:<agent>`): the transcript rows of every run of the
+      // session, a full-text index over them, and the notepad
+      // (docs/reference/specs/session-log.md). Kept after a run finishes; the
+      // retention sweep drops it once its last kept run is gone and no run is
+      // live on the thread. Runs claimed before it existed still finish on
+      // RunTranscriptDO, which stays bound until no such row is live.
+      { "name": "SESSION_LOGS", "class_name": "SessionLogDO" }
     ]
   },
   // The bot shim's ship coordinator Workflow, bound across scripts by the bot's
@@ -65,6 +73,7 @@
     // run's diagnosis); the FrictionDO that once mirrored those diagnoses is
     // retired with its rows — docs/reference/specs/self-improvement.md item 1.
     { "tag": "v7", "deleted_classes": ["FrictionDO"] },
-    { "tag": "v8", "new_sqlite_classes": ["DeliveryDO"] }
+    { "tag": "v8", "new_sqlite_classes": ["DeliveryDO"] },
+    { "tag": "v9", "new_sqlite_classes": ["SessionLogDO"] }
   ]
 }

package/dist/assets/deploy/profile.example.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "The deployment profile: where THIS installation runs. Copy to deploy/profile.json and fill it in (or run `switchboard deploy init`). The account is your Cloudflare account id; every hostname must be under `zone`, a zone in that account, unless the Worker names its own `zone` (also in the account); `workers.bot` is the one required Worker — leave `memory`, `resident` or `sandbox` out and `deploy plan` has no step for them (a bot-only profile is a one-step plan; without `memory` the config is not pushed anywhere). The project's docs site is not a Worker of an installation: it is the project's website, deployed by the project's own CI from project.json, so there is no `docs` entry. `configSource` is where `deploy all` reads the bot's runtime config from before building the image — a path, `github://owner/repo/path@ref` (needs CONFIG_REPO_TOKEN), or `op://Vault/Item/field` (needs OP_SERVICE_ACCOUNT_TOKEN); `secretsSource` is where `secrets put` reads values from — a directory of <NAME> files (the default when absent) or `op://Vault/Item`. `images` is where the bot, resident and sandbox container images come from: `registry` — the release's published images, copied once per version into your account registry by `deploy all` itself (or `deploy images` ahead of it) over HTTPS and referenced from there — no Docker anywhere, a Cloudflare API token with Containers Edit in CLOUDFLARE_API_TOKEN for the copy (an installation deploying published images; what `init` writes from the published package); or `build` (the default when absent) — each Worker's Dockerfile, built by wrangler where `deploy all` runs (a checkout; the project's own production). `deploy plan` reads this example when no profile exists; `deploy all` refuses it.",
+  "$comment": "The deployment profile: where THIS installation runs. Copy to deploy/profile.json and fill it in (or run `switchboard deploy init`). The account is your Cloudflare account id; every hostname must be under `zone`, a zone in that account, unless the Worker names its own `zone` (also in the account); `workers.bot` is the one required Worker — leave `memory`, `resident` or `sandbox` out and `deploy plan` has no step for them (a bot-only profile is a one-step plan; without `memory` the config is not pushed anywhere). The project's docs site is not a Worker of an installation: it is the project's website, deployed by the project's own CI from project.json, so there is no `docs` entry. `configSource` is where `deploy all` reads the bot's runtime config from before building the image — a path, `github://owner/repo/path@ref` (needs CONFIG_REPO_TOKEN), or `op://Vault/Item/field` (needs OP_SERVICE_ACCOUNT_TOKEN); `secretsSource` is where `secrets put` reads values from — a directory of <NAME> files (the default when absent) or `op://Vault/Item`. `images` is where the bot, resident and sandbox container images come from: `registry` — the release's published images, copied once per version into your account registry by `deploy all` itself (or `deploy images` ahead of it) over HTTPS and referenced from there — no Docker anywhere, a Cloudflare API token with Containers Edit in CLOUDFLARE_API_TOKEN for the copy (an installation deploying published images; what `init` writes from the published package); or `build` (the default when absent) — each Worker's Dockerfile, built by wrangler where `deploy all` runs (a checkout; the project's own production). `artifacts` (optional) names the R2 bucket a run's files move through (docs/reference/specs/execution.md item 20): with it the bot Worker binds the bucket and `deploy` creates it before the upload (the credential then needs Workers R2 Storage: Edit); the bot's runtime config `artifacts.r2.bucket` must say the same name. `deploy plan` reads this example when no profile exists; `deploy all` refuses it.",
   "account": "00000000000000000000000000000000",
   "zone": "example.com",
   "workers": {

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.213.0",
+  "version": "1.215.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.213.0",
+      "version": "1.215.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -19000,7 +19000,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.213.0",
+      "version": "1.215.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.124.0",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.213.0",
+  "version": "1.215.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.213.0",
-  "commit": "e6d1e5ef45c220f43d4a956547c3f55458fbf3ab",
-  "builtAt": "2026-09-14T17:32:11.100Z"
+  "version": "1.215.0",
+  "commit": "801fa224f1f6af4bd152b8555337aa4c8c0b9ea2",
+  "builtAt": "2026-09-14T21:24:17.702Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -198,6 +198,8 @@ const RESIDENT_TOOLCHAIN = `The resident image carries ${IMAGE_TOOLCHAIN}; plus
 // the sandbox and resident variants cannot drift on it.
 const SHOW_FILES = `Files the person should SEE go through the attach_file tool: a screenshot from \`playwright screenshot\`, a rendered PDF, a recording — it posts the workspace file into this conversation, where an image renders inline. Use it whenever you produce an image worth showing (a visual change, a rendered page, a before/after); a link to a file on GitHub is not a picture.
 SCREENSHOTS GO TO BOTH PLACES, ALL OF THEM: when the request asks for screenshots, or the change is visual, every capture is attached here with attach_file AND published on the pull request — commit the images to an assets branch (never the PR's own diff) and reference them from the description's validation section or a PR comment so they render inline there too — unless the request names one destination. Never attach a subset and link the rest.
+Whole files: up to 1 GiB where the artifact store is configured (a recording, a large PDF), 10 MiB otherwise — the tool's result says which applies; over the limit, link to the file.
+Files the person dropped on the thread that were too large to show you inline are already in ./attachments/ in your workspace when the turn's text names them (a video for ffmpeg, a large PDF, a zip); read them from there — never ask for a re-upload.
 Text stays in your message; do not attach what you can say.`;
 
 const CODING_SYSTEM = `You are Switchboard's coding agent, operating from a Slack request.
@@ -426,28 +428,43 @@ Report outcomes faithfully: a check you could not run is "could not check", neve
 // preset. A child is a `dispatch()` run as the requesting user, in a thread of
 // its own, under their permissions (docs/decisions/0002-dispatcher-is-the-only-orchestrator.md,
 // docs/decisions/0007-authorization-policy-table.md): the prompt says exactly
-// that, so the model never expects a child to see this thread or to hold more
-// than its requester does. Machine `none`, identity `none`: it holds no
-// workspace, no shell and no credential of its own; its reach is the three run
-// tools, the GitHub reads and URL reading. The prompt names the limits the
-// spawn stage enforces — one level of depth, the fan-out cap, the parent's
-// remaining clock — so a refusal is never a surprise, and the presets a child
-// can run, so the model picks from the real list.
-const CONDUCTOR_SYSTEM = `You are Switchboard's conductor: you coordinate other runs instead of doing the work yourself, answering a request from Slack.
+// that, so the model never expects a child to hold more than its requester
+// does. A child is a reader of this conversation: it starts from the text so
+// far plus the prompt, and the prompt says so. Machine `none`, identity
+// `none`: it holds no workspace, no shell and no credential of its own; its
+// reach is the run tools, the GitHub reads and URL reading. The prompt names
+// the limits the spawn stage enforces — one level of depth, the fan-out cap,
+// the parent's remaining clock — so a refusal is never a surprise, and renders
+// the presets a child can run from the registry the way `help` renders its
+// rows: every sibling whose identity is not `write`, with its own description,
+// so the model picks from the real list and a preset that crosses the identity
+// line moves the day its def does; the write presets are named as what a child
+// never is, with the refusal's name.
+function conductorSystem(siblings: readonly AgentDef[]): string {
+  const readers = siblings.filter((a) => a.identity !== "write");
+  const writers = siblings.filter((a) => a.identity === "write");
+  const rows = readers.map(
+    (a) => `- \`${a.name}\`${machineNeedsRepo(a.machine) ? " (needs the repository)" : ""}: ${a.description}`,
+  );
+  return `You are Switchboard's conductor: you coordinate other runs instead of doing the work yourself, answering a request from Slack.
 
 You have no workspace and no shell. Your tools: \`spawn_run\` (start a child run), \`send_to_run\` (steer a live child: your text reaches it as a follow-up at its next step), \`await_runs\` (wait for your children to end and get each end — its status and final reply — back as data), \`list_runs\` (the runs you may see — your own children by default), \`get_run_status\` (one run: whether it is running, what it is doing, and its final reply once it finished), the GitHub reads — \`github_repos\`, \`github_tree\` / \`github_file\` (browse and read our repositories), \`github_search_code\`, \`github_issue_list\` / \`github_issue_get\` — \`web_fetch\` (read a public URL), and \`update_status\`.
 
 WHAT A CHILD IS. A child is an ordinary Switchboard run started as the person who asked you — exactly the run they could start by hand with \`agent:<preset>\` — in a thread of its own in this channel, visible to everyone there, with its own status card and run page, and under their permissions: a preset they may not run, a repository they may not use, or a profile a boundary caps is refused in the child's thread, and the refusal comes back to you as the tool result naming the gate. Children cannot spawn children. You may have a few live at once (the deployment's \`spawn.maxChildren\`, three by default); a spawn past the cap is refused until one finishes. A child's wall clock is capped by what is left of yours.
 
-THE PRESETS a child can run: \`research\` (a question the web or our repositories answer), \`coding\` (implement a change and open a pull request; needs the repository), \`review\` (review a pull request; needs its URL), \`explore\` (a long, read-only investigation with a shell; needs the repository), \`general\` (a quick answer with the GitHub tools), \`ship\` (coding, review and fixes until a pull request is merge-ready; needs the repository).
+THE PRESETS a child can run — a child reads, so only a preset whose identity is \`none\` or \`read\`:
+${rows.join("\n")}
+
+A preset that writes — ${writers.map((a) => `\`${a.name}\``).join(", ")} — is refused by name (\`spawn_identity\`): a spawned child never holds a write credential, so pushing a branch or opening a pull request is the requester's to start by hand with \`agent:<preset>\`; say so in your answer instead of spawning it.
 
 ROUTED COMPOUNDS. A request may arrive already split: the router found independent parts, and the message ends with the line "Routed as a compound request: N independent parts" followed by a numbered list, one part per line as \`<preset>\`: <text>. Spawn exactly those children — one \`spawn_run\` per line, the preset as listed, the line's text as the child's prompt (it already stands alone; add the repository where the preset needs one) — then \`await_runs\` them all and compile. Never merge, drop or add a part; a part whose spawn is refused is reported as refused, by the gate's name.
 
-HOW TO WORK. Fan out, await, compile. Read the request and split it into children only where the parts are independent; a request one preset answers is one child. Spawn each child with a self-contained prompt — everything it needs, since it sees none of this thread — and the repository where the preset needs one. Then call \`await_runs\` once with every child's id: it returns when all of them have ended, or earlier — at the edge of your own budget, at a stop, or when a follow-up lands in this thread — and \`ended\` says which; a child still running at the cut keeps running (name it in your answer, or await again after a follow-up). Steer a child with \`send_to_run\` when the request changes or a child is heading the wrong way. A child that ended — finished, failed, interrupted by a restart — is reported as it ended and never restarted; spawn a new child if the work still matters. Then compile: one answer from the write-ups \`await_runs\` returned. Never do a child's job yourself, and never claim a child finished or found something you did not read from \`await_runs\` or \`get_run_status\`.
+HOW TO WORK. Fan out, await, compile. Read the request and split it into children only where the parts are independent; a request one preset answers is one child. Spawn each child with a prompt that says what it should do, and the repository where the preset needs one: a child starts from this conversation's text so far — every user and assistant turn before your call, never your tool calls, their results or your thinking — and your prompt is its one new turn, so tell it what to do rather than repeat what was said. Then call \`await_runs\` once with every child's id: it returns when all of them have ended, or earlier — at the edge of your own budget, at a stop, or when a follow-up lands in this thread — and \`ended\` says which; a child still running at the cut keeps running (name it in your answer, or await again after a follow-up). Steer a child with \`send_to_run\` when the request changes or a child is heading the wrong way. A child that ended — finished, failed, interrupted by a restart — is reported as it ended and never restarted; spawn a new child if the work still matters. Then compile: one answer from the write-ups \`await_runs\` returned. Never do a child's job yourself, and never claim a child finished or found something you did not read from \`await_runs\` or \`get_run_status\`.
 
 Maintain the user-facing status card with the update_status tool: one item per child (○ pending, ✱ running, ✓ finished — only once await_runs or get_run_status said so).
 
 Use Slack-friendly formatting (no markdown headers; *bold*, bullets, code blocks). Your final message is posted to Slack: lead with the outcome, then one line per child — its preset, its thread, its status and its result in a sentence — and what is still running, if anything.`;
+}
 
 /** The compound answer's preset — the one preset absent from the router's
  *  table that a plain message still reaches: a message with two or more
@@ -469,11 +486,15 @@ export function presetDoor(def: AgentDef): PresetDoor {
   return def.name === COMPOUND_PRESET ? "compound" : "directive";
 }
 
-export const AGENTS: Record<string, AgentDef> = {
+/** Every preset that does the work: the ones a conductor's children are drawn
+ *  from (those that read) and the ones it names as refused (those that write).
+ *  The conductor is built from this list below, so its prompt renders its
+ *  siblings and never itself. */
+const WORK_PRESETS = {
   general: {
     name: "general",
     description:
-      "Default assistant on the configured model: answers directly, reads the org's repos and manages their issues over GitHub, reads URLs. No workspace or shell.",
+      "Default assistant: answers directly, reads URLs, manages issues; the preset for any question the org's GitHub answers. No workspace or shell.",
     system: GENERAL_SYSTEM,
     toolset: "assistant",
     // The GitHub tools are REST in the bot process, so a general ask never
@@ -547,7 +568,7 @@ export const AGENTS: Record<string, AgentDef> = {
   research: {
     name: "research",
     description:
-      "Answers questions with web search, URL reading, and read access to the org's repos and issues over GitHub. No workspace.",
+      "Answers questions that need the web (search, URL reading); GitHub for context, not for a question GitHub alone answers. No workspace.",
     system: RESEARCH_SYSTEM,
     toolset: "web",
     machine: "none", // web I/O only; no workspace is provisioned
@@ -573,11 +594,15 @@ export const AGENTS: Record<string, AgentDef> = {
     cacheTtl: "1h",
     // No built-in effort: the deployment decides, as for coding.
   },
+} satisfies Record<string, AgentDef>;
+
+export const AGENTS: Record<string, AgentDef> = {
+  ...WORK_PRESETS,
   conductor: {
     name: "conductor",
     description:
       "Coordinates other runs: spawns child runs as the requester — each in a thread of its own, under their permissions — follows them, and reports. No workspace or shell.",
-    system: CONDUCTOR_SYSTEM,
+    system: conductorSystem(Object.values(WORK_PRESETS)),
     toolset: "conductor",
     // Nothing is provisioned and no credential minted: the run tools call the
     // dispatcher, the GitHub reads are REST in the bot process.

package/dist/assets/src/config/profile.ts

@@ -2,9 +2,9 @@
 // the machine class its tools execute on, the identity it acts as, and the
 // minutes it may run. A preset declares one; the run's EFFECTIVE profile is
 // what the pipeline hands the factory, the ledger and the runner — never the
-// preset's fields read again downstream. Pure and leaf: type-only imports, so
-// the node-free record contract and the state Worker can name the shape.
-import type { AgentDef, Identity, MachineClass } from "../agents/registry.js";
+// preset's fields read again downstream. Pure and near-leaf: the only value
+// import is the registry's `runawayTurnCap`, itself pure.
+import { runawayTurnCap, type AgentDef, type Identity, type MachineClass } from "../agents/registry.js";
 
 export type { Identity, MachineClass };
 
@@ -63,9 +63,12 @@ export function declaredProfile(preset: Pick<AgentDef, "machine" | "identity" |
 /** The preset with its budget replaced by the effective profile's — the def
  *  the runner is handed, since its deadline, wrap-up warning and budget label
  *  read `maxMinutes` (the same clipped copy the ship pipeline hands its child
- *  rounds). Always a copy: the shared `AgentDef` is never mutated. */
+ *  rounds). `maxTurns` is re-derived from the clipped minutes with the
+ *  registry's own `runawayTurnCap`, so the six-per-minute runaway guard holds
+ *  for the budget the run actually has, not the preset's declared one.
+ *  Always a copy: the shared `AgentDef` is never mutated. */
 export function budgetedAgent(agent: AgentDef, profile: RunProfile): AgentDef {
-  return { ...agent, maxMinutes: profile.minutes };
+  return { ...agent, maxMinutes: profile.minutes, maxTurns: runawayTurnCap(profile.minutes) };
 }
 
 // ---- boundaries: a scope caps, never grants -----------------------------------

package/dist/assets/src/core/coordinator/contract.ts

@@ -142,6 +142,10 @@ export interface CoordinatorUnit {
   /** The unit's thread, once opened; a task's is the requesting thread from the start. */
   threadKey?: string;
   sourceUrl?: string;
+  /** The unit's review thread, opened once beside the unit's thread: every
+   *  review round runs there (record 0034), so the review child's worktree is
+   *  readonly and its own and no round wipes the coding thread's. */
+  reviewThread?: { threadKey: string; sourceUrl?: string };
   /** The unit's board issue in the repository, when one titled by the unit id exists — the handoff's destination. */
   issue?: number;
   pr?: { number: number; url: string };
@@ -173,6 +177,7 @@ const isResume = (v: unknown): boolean =>
   isFinite(v.pr) &&
   (v.headSha === undefined || isText(v.headSha)) &&
   (v.url === undefined || isText(v.url, 2048));
+const isThread = (v: unknown): boolean => isObject(v) && isText(v.threadKey) && isOptionalText(v.sourceUrl);
 
 /** Structural check on a record from outside the process (a Worker response, an HTTP body). */
 export function isCoordinatorInstance(v: unknown): v is CoordinatorInstance {
@@ -202,6 +207,7 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
   if (!isText(r.unit, 32) || !isText(r.slug) || !isText(r.branch) || !isOptionalText(r.title)) return false;
   if (!Array.isArray(r.dependsOn) || !r.dependsOn.every((d) => isText(d, 32))) return false;
   if (!isOptionalText(r.threadKey) || !isOptionalText(r.sourceUrl)) return false;
+  if (r.reviewThread !== undefined && !isThread(r.reviewThread)) return false;
   if (r.issue !== undefined && !isFinite(r.issue)) return false;
   if (r.pr !== undefined && !isPr(r.pr)) return false;
   if (r.resume !== undefined && !isResume(r.resume)) return false;

package/dist/assets/src/core/runEvents.ts

@@ -134,7 +134,11 @@ export type RunNoteKind =
   /** The harness's gate refused a tool call the model asked for (harness-pi.md
    *  item 7): the summary names the tool and the rule; the model read the same
    *  reason as the tool's result. Published by the bot's authorize route. */
-  | "tool_refused";
+  | "tool_refused"
+  /** The stuck-loop guard fired (docs/reference/specs/run-loop.md item 18):
+   *  the same tool call failed identically six times in a row, so the run is
+   *  forced into its write-up instead of looping to the wall clock. */
+  | "stuck_loop";
 
 /** Every `RunNoteKind`, as a value (a reader that filters notes by kind uses
  *  this; adding a kind to the union without adding it here is a type error). */
@@ -158,6 +162,7 @@ export const RUN_NOTE_KINDS = [
   "compacted",
   "harness_error",
   "tool_refused",
+  "stuck_loop",
 ] as const satisfies readonly RunNoteKind[];
 type _EveryKindListed = [RunNoteKind] extends [(typeof RUN_NOTE_KINDS)[number]] ? true : never;
 const _everyKindListed: _EveryKindListed = true;
@@ -531,20 +536,24 @@ export type RunEvent =
    *  the router gave (redacted, capped — the same text the card's `routed:`
    *  line carries) and the model that decided. A compound route is `preset:
    *  "conductor"` with `parts` — one per child the conductor was told to
-   *  spawn: its preset and its text, the child's whole prompt. A compound the
-   *  parse refused is recorded too, on the run that fell to the default:
-   *  `preset` is `defaults.agent` and `reason` reads `compound_rejected:
-   *  <why>` (the run's `run_meta.agentSource` stays `default`). Published by
-   *  the dispatcher straight to the registry right after `run_meta`, once per
-   *  run the router answered; absent on every run a directive, a sticky
-   *  preset or a scope chose. Head material, like `run_meta`. Additive:
-   *  unknown → ignored. */
+   *  spawn: its preset and its text, the child's whole prompt. A compound
+   *  answer that carried a write-identity part collapsed onto that preset
+   *  (record 0034: a write ask is never a part): `preset` is the write preset
+   *  the run is, `collapsed.presets` the preset each part named in answer
+   *  order, and no `parts`. A compound the parse refused is recorded too, on
+   *  the run that fell to the default: `preset` is `defaults.agent` and
+   *  `reason` reads `compound_rejected: <why>` (the run's
+   *  `run_meta.agentSource` stays `default`). Published by the dispatcher
+   *  straight to the registry right after `run_meta`, once per run the router
+   *  answered; absent on every run a directive, a sticky preset or a scope
+   *  chose. Head material, like `run_meta`. Additive: unknown → ignored. */
   | {
       type: "route";
       preset: string;
       reason: string;
       model: string;
       parts?: ReadonlyArray<{ preset: string; text: string }>;
+      collapsed?: { presets: ReadonlyArray<string> };
       seq?: number;
       at?: number;
     }

package/dist/assets/src/core/runFriction.ts

@@ -254,6 +254,13 @@ function unionMs(intervals: ReadonlyArray<{ start: number; end: number }>): numb
   return total;
 }
 
+/** One tool call's identity for retry/streak accounting: the tool name plus
+ *  the call's one-line summary (which carries the arguments — a bash command,
+ *  a path, a url). Shared with the runner's stuck-loop guard
+ *  (docs/reference/specs/run-loop.md item 18), so both count "the same call"
+ *  identically. */
+export const callSignature = (tool: string, summary: string): string => `${tool} ${summary}`;
+
 /** Analyze a run's event stream. Pure and deterministic; never mutates `events`. */
 export function analyzeRunFriction(events: readonly RunEvent[], opts: FrictionOptions = {}): FrictionDiagnosis {
   const slowToolMs = opts.slowToolMs ?? DEFAULT_SLOW_TOOL_MS;
@@ -405,7 +412,7 @@ export function analyzeRunFriction(events: readonly RunEvent[], opts: FrictionOp
 
     if (ev.type === "tool_call") {
       toolCalls++;
-      if (failedCalls.has(`${ev.tool} ${ev.summary}`)) {
+      if (failedCalls.has(callSignature(ev.tool, ev.summary))) {
         findings.push({
           category: "retry",
           severity: "low",
@@ -432,7 +439,7 @@ export function analyzeRunFriction(events: readonly RunEvent[], opts: FrictionOp
           ? { interval: { start: span.startedAt, end: span.startedAt + durationMs } }
           : {};
 
-      if (!ev.ok) failedCalls.add(`${ev.tool} ${callSummary}`);
+      if (!ev.ok) failedCalls.add(callSignature(ev.tool, callSummary));
 
       if (ev.infra) {
         // An infra-level failure is the sandbox, not the command: classify once,

package/dist/assets/src/core/runLedger/sessionLog.ts

@@ -0,0 +1,207 @@
+// The session log's pure rules (docs/decisions/0035-a-session-log-outlives-its-runs-compaction-is-a-pointer.md;
+// docs/reference/specs/session-log.md): one log per thread and agent holds the
+// transcript rows of every run of the session, each run a range of it. This
+// file is node-free — the bot and `deploy/cloudflare-memory/worker.ts` import
+// it alike — and holds what both sides must agree on: the object's name, the
+// text the full-text index sees for a row, the byte policy's choice of what to
+// drop, the tail cut a follow-up seeds from, and the sweep's drop decision.
+
+import type { ChatMessage, ContentPart } from "../../providers/types.js";
+import { DEFAULT_RETENTION_POLICY, utf8ByteLength } from "../runRecord.js";
+import type { StoredRow } from "./transcript.js";
+
+export { isRunSession, SESSION_KEY_PATTERN, type RunSession } from "../runRecord.js";
+
+/** The byte policy's default: `RetentionPolicy.sessionLogMaxBytes`. */
+export const DEFAULT_SESSION_LOG_MAX_BYTES = DEFAULT_RETENTION_POLICY.sessionLogMaxBytes;
+
+/** The object's name: the thread and the agent, the pair record 0034 calls a
+ *  session. A run without a resolved agent keys on a dash so the name still
+ *  has both halves. */
+export function sessionKey(threadKey: string, agent: string | undefined): string {
+  return `${threadKey}:${agent ?? "-"}`;
+}
+
+/** The request is the seed's last user turn (`splitSeed` reads the seed the
+ *  same way); a seed with no user turn — or no turns — puts its first row there. */
+export function requestIndex(seed: readonly ChatMessage[]): number {
+  for (let i = seed.length - 1; i >= 0; i--) if (seed[i].role === "user") return i;
+  return 0;
+}
+
+export type RowKind = "text" | "tool_result" | "tool_use" | "attachment" | "compaction" | "other";
+
+function parseStored(json: string): StoredRow | undefined {
+  try {
+    const v = JSON.parse(json) as unknown;
+    return typeof v === "object" && v !== null ? (v as StoredRow) : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** What a stored row holds, for the byte policy (only a `tool_result` is
+ *  replaceable) and the index (only text kinds carry text). */
+export function rowKind(json: string): RowKind {
+  const stored = parseStored(json);
+  if (!stored) return "other";
+  if ("compaction" in stored) return "compaction";
+  const type = (stored.part as { type?: unknown }).type;
+  switch (type) {
+    case "text":
+      return "text";
+    case "tool_result":
+      return "tool_result";
+    case "tool_use":
+      return "tool_use";
+    case "image":
+    case "document":
+      return "attachment";
+    default:
+      return "other";
+  }
+}
+
+const textOfResultContent = (content: unknown): string => {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  return content
+    .filter((c): c is { type: "text"; text: string } => typeof c === "object" && c !== null && c.type === "text")
+    .map((c) => c.text)
+    .join("\n");
+};
+
+/** The text the full-text index holds for a row: a text part's text, a tool
+ *  result's text (the failing test's name in a vitest report is findable), a
+ *  tool call's name and arguments (a command is findable), a compaction row's
+ *  summary; an attachment, a thinking block or an unreadable row index nothing. */
+export function textOfStoredRow(json: string): string {
+  const stored = parseStored(json);
+  if (!stored) return "";
+  if ("compaction" in stored) return typeof stored.compaction?.summary === "string" ? stored.compaction.summary : "";
+  const part = stored.part as ContentPart | undefined;
+  if (!part) return "";
+  switch (part.type) {
+    case "text":
+      return part.text;
+    case "tool_result":
+      return textOfResultContent(part.content);
+    case "tool_use":
+      return `${part.name} ${JSON.stringify(part.input ?? {})}`;
+    default:
+      return "";
+  }
+}
+
+/** The run record keeps this much of a tool's output; the marker says so. */
+const RECORD_TOOL_OUTPUT_CHARS = "8,000 characters";
+
+/** The row that replaces a tool result the byte policy drops: the same role
+ *  and call id (the model's `tool_use` keeps its result, so the conversation
+ *  stays valid), the error flag, and a text naming what went and where the
+ *  rest still is. Undefined for any row that is not a tool result — user and
+ *  assistant text are never dropped. */
+export function droppedToolResultRow(json: string): string | undefined {
+  const stored = parseStored(json);
+  if (!stored || "compaction" in stored) return undefined;
+  const part = stored.part as ContentPart | undefined;
+  if (!part || part.type !== "tool_result") return undefined;
+  const marker: ContentPart = {
+    type: "tool_result",
+    toolUseId: part.toolUseId,
+    content: `[session log: this tool result (${utf8ByteLength(json)} bytes) was dropped to keep the session under its byte policy; the run record keeps its first ${RECORD_TOOL_OUTPUT_CHARS}]`,
+    ...(part.isError === true ? { isError: true } : {}),
+  };
+  return JSON.stringify({ role: stored.role, part: marker });
+}
+
+export interface TrimCandidate {
+  id: number;
+  bytes: number;
+}
+
+/** Which tool-result rows the byte policy replaces once a log is `excess`
+ *  bytes over its budget: the oldest first (the caller passes them oldest
+ *  first), each freeing its bytes less the marker's, until the excess is
+ *  covered or the candidates run out — never a user or assistant text row,
+ *  which are not candidates. */
+export function planSessionTrim(candidates: readonly TrimCandidate[], excess: number, markerBytes: number): number[] {
+  const ids: number[] = [];
+  let freed = 0;
+  for (const c of candidates) {
+    if (freed >= excess) break;
+    const gain = c.bytes - markerBytes;
+    if (gain <= 0) continue;
+    ids.push(c.id);
+    freed += gain;
+  }
+  return ids;
+}
+
+export interface TailRow {
+  idx: number;
+  bytes: number;
+}
+
+/** The tail a follow-up seeds from: walking the rows newest first, the first
+ *  index of the oldest turn that still fits `maxBytes` with every newer turn
+ *  — whole turns only, so no tool call is parted from its result. Undefined
+ *  when even the newest turn is over the budget, or the log is empty. */
+export function tailCut(rowsNewestFirst: readonly TailRow[], maxBytes: number): number | undefined {
+  let total = 0;
+  let from: number | undefined;
+  let i = 0;
+  while (i < rowsNewestFirst.length) {
+    const idx = rowsNewestFirst[i].idx;
+    let turnBytes = 0;
+    let j = i;
+    while (j < rowsNewestFirst.length && rowsNewestFirst[j].idx === idx) turnBytes += rowsNewestFirst[j++].bytes;
+    if (total + turnBytes > maxBytes) break;
+    total += turnBytes;
+    from = idx;
+    i = j;
+  }
+  return from;
+}
+
+/** What the sweep re-reads about one candidate right before dropping it
+ *  (session-log item 7): whether a kept run record names the session, and
+ *  whether any run is live on its thread. */
+export interface DropCandidate {
+  key: string;
+  hasKeptRun: boolean;
+  threadLive: boolean;
+}
+
+export type DropDecision = "drop" | "kept-run" | "thread-live";
+
+/** The sweep's decision (session-log item 7), one per candidate on the facts
+ *  read at that moment: a session object is dropped only when no kept run
+ *  record names it and no live run holds its thread — any live run on the
+ *  thread blocks every session of that thread, since the live row is the
+ *  conservative signal the sweep has. A kept run outranks a live thread in
+ *  the answer, since it is the longer-lived reason. */
+export function sessionsToDrop(candidates: readonly DropCandidate[]): Array<{ key: string; decision: DropDecision }> {
+  return candidates.map((c) => ({
+    key: c.key,
+    decision: c.hasKeptRun ? "kept-run" : c.threadLive ? "thread-live" : "drop",
+  }));
+}
+
+/** The attachments a stored row references: a part's own `dataRef`, and the
+ *  `dataRef` of each of a tool result's nested parts — so a trimmed result
+ *  can take with it what nothing else references (session-log item 5). */
+export function attachmentRefsOf(json: string): string[] {
+  const stored = parseStored(json);
+  if (!stored || "compaction" in stored) return [];
+  const part = stored.part as (ContentPart & { dataRef?: unknown }) | undefined;
+  if (!part) return [];
+  const refs: string[] = [];
+  if (typeof part.dataRef === "string") refs.push(part.dataRef);
+  if (part.type === "tool_result" && Array.isArray(part.content)) {
+    for (const c of part.content as Array<{ dataRef?: unknown }>) {
+      if (typeof c?.dataRef === "string") refs.push(c.dataRef);
+    }
+  }
+  return refs;
+}