@coreplane/switchboard 1.233.0 → 1.235.0

package/dist/assets/deploy/cloudflare-resident/worker.ts

@@ -87,6 +87,7 @@ import { parseReadonly, planReadonlyAttach } from "../../src/execution/residentR
 import { decideWorktree, parseReuse, type WorktreeFacts } from "../../src/execution/residentReuse.js";
 import {
   boundByFor,
+  canReturnToDefault,
   parseOwnPr,
   parsePushed,
   parseRefByDefault,
@@ -94,10 +95,12 @@ import {
   rebindRefused,
   rebindVerdict,
   rememberOwnBranches,
+  returnToDefault,
   type BoundBy,
   type OwnBranch,
   type OwnPr,
   type PushedBranch,
+  type Returned,
   type Rebound,
   type RebindRefused,
   type RebindTreeFacts,
@@ -112,7 +115,15 @@ import {
   type DepCacheMaterialization,
   type ThreadDepsMechanism,
 } from "../../src/execution/residentDepCache.js";
-import { parseWorktreeCleanliness, worktreeCleanlinessScript } from "../../src/execution/residentCleanliness.js";
+import {
+  evictedTreeOf,
+  evictedTreeSentence,
+  parseWorktreeCleanliness,
+  worktreeCleanlinessScript,
+  type EvictedTree,
+  type LeftBehind,
+  type WorktreeCleanliness,
+} from "../../src/execution/residentCleanliness.js";
 import {
   base64LengthOf,
   chunkPlan,
@@ -994,15 +1005,17 @@ interface ThreadBinding {
    *  binding made before the field: read as `default` iff `ref` is the default
    *  branch. Only a `default` binding may ever move. */
   boundBy?: BoundBy;
-  /** The one move a binding may make (item 16): from the default it was bound
-   *  to, onto the branch the thread's own run opened a pull request on. Set,
-   *  the binding never moves again. */
+  /** The move a binding may make (item 16): from the default it was bound to,
+   *  onto the branch the thread's own run opened a pull request on. Set, the
+   *  binding moves again only after the move is returned (`returnedAt`: the
+   *  branch was gone from the mirror and the binding went back to the
+   *  default), and then for the next own pull request. */
   rebound?: Rebound;
   /** The branches the thread's own runs pushed and the pull requests they
    *  head, as each run's release handed them over (`/detach` `pushed`, item
    *  16a) — written before any eviction decision, so the fact outlives the
-   *  tree: a clean tree is released the moment a run ends, and this is what
-   *  lets the follow-up's attach move onto the branch and recreate the tree
+   *  tree: the tree is released the moment its run ends, and this is what
+   *  lets the follow-up's attach move onto the branch and provision the tree
    *  there. Newest last; the oldest fall off past `OWN_BRANCHES_MAX`. */
   ownBranches?: OwnBranch[];
   /** Allocated OS user (worker2..worker17); "" once evicted (pool released). */
@@ -1013,8 +1026,17 @@ interface ThreadBinding {
   evicted?: boolean;
   evictedAt?: string;
   /** Why the last eviction happened (the audit trail): `ttl`, `clean-idle`,
-   *  `detach`, or a reclamation fate — `merged #N` / `closed #N` / `gone`. */
+   *  `detach`, `disk-pressure`, or a reclamation fate — `merged #N` /
+   *  `closed #N` / `gone`. */
   evictedWhy?: string;
+  /** What the tree held when that eviction removed it (item 17: never a
+   *  reason to keep the tree, never discarded silently): the tracked changes
+   *  and unpushed commits measured as the thread user. Absent when the tree
+   *  was clean, already gone with the disk, or not measured (a force detach). */
+  evictedLeftBehind?: LeftBehind;
+  /** Why the tree could not be measured before that eviction (git could not
+   *  read it) — so an unreadable tree is never recorded as clean. */
+  evictedUnmeasured?: string;
   /** How deps were last materialized (evidence that the per-branch reconciliation ran). */
   deps?: ThreadDepsMechanism;
   /** Commit the worktree was last attached at (the ref's tip in the mirror
@@ -1088,6 +1110,20 @@ interface AttachOk {
   /** The caller asked for that move and the binding stood: the branch, the PR
    *  and why — so the bot can say where the follow-up runs and why. */
   rebindRefused?: RebindRefused;
+  /** This attach moved the binding BACK to the default branch (item 16's
+   *  second movement): the branch a rebind had moved it onto is gone from the
+   *  mirror, so the tree was provisioned on the default instead of the attach
+   *  failing `unknown-ref`. From where, to where, which PR's branch it was. */
+  returned?: Returned;
+}
+
+/** What `POST /detach` answers: whether the pool user went back, why not, and
+ *  — on a release — what the tree still held (item 16a), now gone with it. */
+interface DetachAnswer {
+  released: boolean;
+  reason?: string;
+  user?: string;
+  leftBehind?: LeftBehind;
 }
 
 /** Why the caller's `refHint` is what it is (item 16), beside the hint itself:
@@ -1105,17 +1141,11 @@ const NO_REF_HINT_REASON: RefHintReason = { ownPr: null, refByDefault: false };
 
 /** What the rebind decided under the mutex (item 16): nothing to move (the
  *  row is already on the branch), a named refusal, or the move — written on
- *  the row, whether a checkout in the live tree or a ref the attach will
- *  recreate the tree at. */
+ *  the row; the attach that follows provisions the tree at the moved ref. */
 type RebindOutcome =
   | { kind: "none"; binding: ThreadBinding }
   | { kind: "refuse"; refused: RebindRefused }
-  | { kind: "rebound"; moved: ThreadBinding; rebound: Rebound; keepTree: false }
-  /** The move was the record alone — a dirty tree already on the branch, no
-   *  checkout run — with the verdict's `note` for the log line. The attach
-   *  that follows must keep that tree (`keepTree`, the worktree step's word
-   *  for it): the promise the note makes is the attach's to keep. */
-  | { kind: "rebound"; moved: ThreadBinding; rebound: Rebound; keepTree: true; note: string };
+  | { kind: "rebound"; moved: ThreadBinding; rebound: Rebound };
 
 /** Result of one /op test/build execution. `ok` is the command's
  *  verdict — a failing test run is a RESULT with ok:false, never an error. */
@@ -3768,15 +3798,16 @@ export class ResidentDO extends Sandbox<Env> {
     });
   }
 
-  /** Idle = no live binding attached within IDLE_AFTER_S AND (when the
-   *  runtime is up) no live tree is dirty. Bindings are storage; dirtiness
-   *  needs the container — if it is already asleep there is nothing to lose. */
+  /** Idle = no live binding attached within IDLE_AFTER_S and nothing in
+   *  flight. What a live tree holds is not asked (item 17): a dirty tree no
+   *  run is using protects nothing — the next attach wipes it — so it is
+   *  never a reason to keep the container awake; the sweep's release records
+   *  what it held. Bindings are storage, so this needs no container. */
   private async isIdle(): Promise<boolean> {
     const live = await this.liveBindings();
     const recent = systemClock() - IDLE_AFTER_S * 1000;
     if (live.some((b) => Date.parse(b.lastAttachAt) >= recent)) return false;
-    if (this.inFlightCount() > 0) return false;
-    return this.liveTreesClean(live);
+    return this.inFlightCount() === 0;
   }
 
   /** Bindings that hold a pool user and a tree on disk (not evicted). */
@@ -3785,14 +3816,13 @@ export class ResidentDO extends Sandbox<Env> {
     return [...all.values()].filter((b) => !b.evicted && b.user);
   }
 
-  /** True when no live tree holds work a lost disk would destroy: every one
-   *  is clean (as its thread user), or the runtime is already down — a sleep
-   *  has destroyed the disk, so there is nothing left to lose. */
+  /** The disk-full recycle's tree guard (item 54), its one reader: true when
+   *  every live tree is clean as its thread user, or the runtime is already
+   *  down — a sleep has destroyed the disk, so there is nothing left to lose. */
   private async liveTreesClean(live: ThreadBinding[]): Promise<boolean> {
     if (!(await this.isRuntimeActive().catch(() => false))) return true;
     // Concurrent: each check touches only its own (disjoint) tree, and one
-    // spawn each — the idle gate does not pay a serial
-    // 3-probe round-trip per live binding.
+    // spawn each — no serial 3-probe round-trip per live binding.
     const checks = await Promise.all(live.map((b) => this.worktreeCleanliness(b)));
     return checks.every((c) => c.clean); // any dirty or unknown → not clean
   }
@@ -3930,10 +3960,11 @@ export class ResidentDO extends Sandbox<Env> {
    *  already on disk is `reuse` (0 — a dirty/stale recreate frees the old one
    *  first). A ref not yet in the mirror (fetched under the lock, moments later)
    *  is projected as `hardlink`, the common case. When it does not fit, the
-   *  coldest clean idle trees go first (`orderEvictionCandidates`: never the
+   *  coldest idle trees go first (`orderEvictionCandidates`: never the
    *  requesting thread, a busy tree, the default branch, or one attached within
-   *  DISK_EVICT_MIN_IDLE_MS; cleanliness checked as the thread user, dirty or
-   *  unreadable kept — the sweep's rules), `df` re-probed after each; still
+   *  DISK_EVICT_MIN_IDLE_MS), whatever they hold — item 17: dirt never keeps a
+   *  tree; each is measured as its thread user for the eviction's record —
+   *  `df` re-probed after each; still
    *  short → `503 {reason:"disk-pressure"}` with the whole math in `error`, the
    *  same shape as `mirror-busy`, so the bot falls back cold legibly. Never a
    *  lifecycle flip: the checkout is intact and every existing tree keeps
@@ -4003,12 +4034,10 @@ export class ResidentDO extends Sandbox<Env> {
         if (verdict.fits) break;
         const binding = live.find((b) => b.threadKey === c.threadKey);
         if (!binding) continue;
-        const clean = await this.worktreeCleanliness(binding);
-        if (!clean.clean) {
-          kept.push({ threadKey: c.threadKey, why: "dirty" });
-          continue;
-        }
-        // Same re-read guards as the sweep: the clean check awaited.
+        // What the tree holds goes on the eviction's record (item 17), never
+        // into a keep; the runtime is up — this attach is running on it.
+        const tree = await this.measureTreeBeforeEviction(binding);
+        // Same re-read guards as the sweep: the measurement awaited.
         const current = await this.ctx.storage.get<ThreadBinding>(threadBindingKey(c.threadKey));
         if (
           !current ||
@@ -4019,7 +4048,7 @@ export class ResidentDO extends Sandbox<Env> {
           kept.push({ threadKey: c.threadKey, why: "busy" });
           continue;
         }
-        if (!(await this.evictBinding(current, true, "disk-pressure", DISK_PRESSURE_REASON))) {
+        if (!(await this.evictBinding(current, true, "disk-pressure", DISK_PRESSURE_REASON, tree))) {
           kept.push({ threadKey: c.threadKey, why: "other" });
           continue;
         }
@@ -4514,10 +4543,12 @@ export class ResidentDO extends Sandbox<Env> {
 
     // The binding's ref wins for the thread's whole life, with one exception
     // (item 16): a thread bound to the repo default for want of a named branch
-    // moves, once and in place, onto the branch its own run opened a pull
-    // request on — when that branch is a local branch of this thread's tree and
-    // the tree is clean. Decided here, before the ref is chosen, so the rest of
-    // the attach (fetch, stale check, deps, credentials) runs on the moved ref.
+    // moves, once per pull request, onto the branch its own run opened a pull
+    // request on — when that branch is the thread's own and the mirror holds
+    // it. A decision about the binding alone, made here, before the ref is
+    // chosen, so the rest of the attach (fetch, the worktree step that
+    // provisions the tree clean at the moved ref, deps, credentials) runs on
+    // the moved ref.
     const rebind = await this.rebindToOwnPr(
       stored.get(threadBindingKey(threadKey)) as ThreadBinding | undefined,
       reason.ownPr,
@@ -4573,7 +4604,6 @@ export class ResidentDO extends Sandbox<Env> {
         refHint,
         wantSha,
         reuse,
-        keepTree: rebind.keepTree === true,
         slug,
         t0,
         facts,
@@ -4591,54 +4621,36 @@ export class ResidentDO extends Sandbox<Env> {
 
   /** Item 16's one exception to the sticky binding: a thread bound to the repo
    *  default for want of a named branch moves onto the branch its own run
-   *  opened a pull request on (`ownPr`), once, in place. The decision is the
-   *  pure `rebindPlan` / `rebindVerdict` of src/execution/residentRebind.ts;
-   *  this method measures the tree as the thread user and runs the verdict: a
-   *  `git checkout` inside the existing worktree — same path, same pool user,
-   *  no clone, no `rm -rf`, deps and snapshot lineage untouched — under the
-   *  mirror mutex so no other attach of the thread touches the tree meanwhile.
-   *  The rest of the attach then runs on the moved ref: the mirror fetch for
-   *  the PR head (item 51) and item 17's stale check, which keeps a tree whose
-   *  HEAD is the ref's tip or a descendant of it. When the verdict moved the
-   *  record alone — a dirty tree with the branch already checked out — the
-   *  answer says so (`keepTree`) and the worktree step keeps that tree, dirt
-   *  included, instead of item 17's dirty wipe: the promise not to touch it is
-   *  the whole attach's. The binding records the move (`rebound`); the answer
-   *  carries it, or the named refusal, so the bot can say where the follow-up
-   *  runs and why. A refusal never fails the attach. */
+   *  opened a pull request on (`ownPr`), once per pull request. A decision
+   *  about the BINDING alone — the pure `rebindPlan` / `rebindVerdict` of
+   *  src/execution/residentRebind.ts: the branch must be the thread's own,
+   *  remembered from a release (`ownBranches`) or, when nothing was
+   *  remembered, a local branch of the thread's surviving tree, measured as
+   *  the thread user — and the mirror must hold it (`moveOntoOwnBranch`), since
+   *  the attach that follows provisions the tree at the moved ref from the
+   *  mirror as it provisions any tree (item 17: clean at the ref's tip, a tree
+   *  left dirty or on the old branch recreated, the binding's path kept). Under
+   *  the mirror mutex, on the row as it stands there. The binding records the
+   *  move (`rebound`); the answer carries it, or the named refusal, so the bot
+   *  can say where the follow-up runs and why. A refusal never fails the attach. */
   private async rebindToOwnPr(
     prior: ThreadBinding | undefined,
     ownPr: OwnPr | null,
     reuse: boolean,
     defaultRef: string,
     slug: string,
-  ): Promise<
-    | {
-        binding: ThreadBinding | undefined;
-        rebound?: Rebound;
-        rebindRefused?: RebindRefused;
-        /** The move was the record alone — the tree is dirty with the branch
-         *  already checked out — and the attach must keep that tree as it
-         *  stands: the worktree step's item 17 wipe of a dirty tree would
-         *  destroy the very work the rebind declined to touch. */
-        keepTree?: true;
-      }
-    | ThreadErr
-  > {
+  ): Promise<{ binding: ThreadBinding | undefined; rebound?: Rebound; rebindRefused?: RebindRefused } | ThreadErr> {
     const plan = rebindPlan({ ownPr, reuse, binding: prior, defaultRef });
     if (plan.kind === "none" || prior === undefined) return { binding: prior };
     if (plan.kind === "refuse") return { binding: prior, rebindRefused: plan.refused };
     const key = threadBindingKey(prior.threadKey);
-    // A tree that is gone is recreated at the branch by the attach (item 16):
-    // the mirror must hold the branch first, and a branch pushed since the
-    // last refresh cycle is fetched for — with a token minted here, before
-    // the mutex, like the attach's own recovery fetch. Only when the binding
-    // allows a recreate at all: an evicted tree, or a live one whose runs
-    // pushed the branch (the tree may turn out missing).
-    const fetchToken =
-      (plan.kind === "recreate" || plan.own) && githubAppConfigured(this.env)
-        ? ((await mintRepoScopedToken(this.env, slug).catch(() => null))?.token ?? null)
-        : null;
+    // The tree is provisioned at the branch from the mirror, so the mirror
+    // must hold it first: a branch pushed since the last refresh cycle is
+    // fetched for — with a token minted here, before the mutex, like the
+    // attach's own recovery fetch.
+    const fetchToken = githubAppConfigured(this.env)
+      ? ((await mintRepoScopedToken(this.env, slug).catch(() => null))?.token ?? null)
+      : null;
     let outcome: RebindOutcome;
     try {
       outcome = (
@@ -4653,79 +4665,25 @@ export class ResidentDO extends Sandbox<Env> {
           const again = rebindPlan({ ownPr, reuse, binding: current, defaultRef });
           if (again.kind === "none") return { kind: "none", binding: current };
           if (again.kind === "refuse") return again;
-          if (again.kind === "recreate") return this.recreateAtOwnBranch(current, again, fetchToken);
-          const wt = current.worktreePath;
-          // The facts, as the thread user in the thread's own tree: is the
-          // branch a local branch here (the physical trace of this thread's
-          // run having made it), and are the tracked files clean — judged
-          // only off a status git could read.
-          const tree: RebindTreeFacts = { exists: (await this.run(["test", "-d", `${wt}/.git`])).exitCode === 0 };
-          if (tree.exists) {
-            const branch = await this.threadRun(
-              current.user,
-              wt,
-              `git rev-parse --verify --quiet ${shellQuote(`refs/heads/${again.to}`)}`,
-              DEFAULT_EXEC_TIMEOUT_MS,
-            );
-            tree.branchExists = branch.exitCode === 0;
-            const status = await this.threadRun(
-              current.user,
-              wt,
-              "git status --porcelain -uno",
-              DEFAULT_EXEC_TIMEOUT_MS,
-            );
-            tree.readable = status.exitCode === 0;
-            if (tree.readable) tree.dirty = status.stdout.trim() !== "";
-            if (tree.dirty) {
-              // A dirty tree is refused unless its HEAD is already the branch
-              // (the run made it here and left an edit after pushing): the
-              // one fact that tells the two apart, measured only when it
-              // decides anything.
-              const head = await this.threadRun(
+          if (again.kind === "measure" && !again.own) {
+            // Nothing remembered from a release: the branch must be a local
+            // branch of the thread's surviving tree — the physical trace of
+            // this thread's run having made it — measured as the thread user.
+            const wt = current.worktreePath;
+            const tree: RebindTreeFacts = { exists: (await this.run(["test", "-d", `${wt}/.git`])).exitCode === 0 };
+            if (tree.exists) {
+              const branch = await this.threadRun(
                 current.user,
                 wt,
-                "git rev-parse --abbrev-ref HEAD",
+                `git rev-parse --verify --quiet ${shellQuote(`refs/heads/${again.to}`)}`,
                 DEFAULT_EXEC_TIMEOUT_MS,
               );
-              if (head.exitCode === 0) tree.head = head.stdout.trim();
-            }
-          }
-          // Judged on the re-read plan: it carries whether the branch is the
-          // thread's own, which the pre-lock plan lacks when it was a recreate.
-          const verdict = rebindVerdict(again, tree);
-          if (verdict.kind === "recreate") return this.recreateAtOwnBranch(current, again, fetchToken);
-          if (verdict.kind !== "rebind") return verdict;
-          if (verdict.checkout) {
-            const startedAt = systemClock();
-            const checkout = await this.threadRun(
-              current.user,
-              wt,
-              `git checkout --quiet ${shellQuote(again.to)}`,
-              DEFAULT_EXEC_TIMEOUT_MS,
-            );
-            this.stepTrace.getStore()?.record("rebind-checkout", {
-              startedAt,
-              endedAt: systemClock(),
-              exitCode: checkout.exitCode,
-              timedOut: checkout.timedOut,
-            });
-            if (checkout.exitCode !== 0) {
-              const detail =
-                checkout.stderr.trim().split("\n")[0]?.slice(0, 200) || `git checkout exited ${checkout.exitCode}`;
-              return { kind: "refuse", refused: rebindRefused(again, "checkout-failed", detail) };
+              tree.branchExists = branch.exitCode === 0;
             }
+            const verdict = rebindVerdict(again, tree);
+            if (verdict.kind === "refuse") return verdict;
           }
-          const rebound: Rebound = {
-            from: current.ref,
-            to: again.to,
-            pr: again.pr,
-            at: new Date(systemClock()).toISOString(),
-          };
-          const moved: ThreadBinding = { ...current, ref: again.to, rebound };
-          await this.ctx.storage.put(key, moved);
-          return verdict.checkout
-            ? { kind: "rebound", moved, rebound, keepTree: false }
-            : { kind: "rebound", moved, rebound, keepTree: true, note: verdict.note };
+          return this.moveOntoOwnBranch(current, again, fetchToken);
         }, ATTACH_MUTEX_WAIT_MS)
       ).value;
     } catch (err) {
@@ -4743,28 +4701,22 @@ export class ResidentDO extends Sandbox<Env> {
       return { binding: prior, rebindRefused: outcome.refused };
     }
     const { moved, rebound } = outcome;
-    if (!outcome.keepTree) {
-      console.log(
-        `attach ${prior.threadKey}: rebound ${rebound.from} → ${rebound.to} (the thread's own pull request #${rebound.pr})`,
-      );
-      return { binding: moved, rebound };
-    }
     console.log(
-      `attach ${prior.threadKey}: rebound ${rebound.from} → ${rebound.to} (the thread's own pull request #${rebound.pr}) — ${outcome.note}`,
+      `attach ${prior.threadKey}: rebound ${rebound.from} → ${rebound.to} (the thread's own pull request #${rebound.pr}); the tree is provisioned at it`,
     );
-    return { binding: moved, rebound, keepTree: true };
-  }
-
-  /** The move when the thread's tree is gone (item 16): the binding's ref
-   *  becomes the branch its own run pushed, and the attach that follows
-   *  recreates the tree at it — `ensureThreadWorktree` finds no tree and
-   *  clones the branch from the mirror. So the mirror must hold the branch:
-   *  one pushed since the last refresh cycle is fetched for here, under the
-   *  mutex; a branch still missing after the fetch (deleted after a merge, or
-   *  never pushed) is a `branch-absent` refusal and the binding stands — the
-   *  attach then goes on at the ref it had, never `unknown-ref`. Nothing on
-   *  disk is touched: no checkout (there is no tree), no clone (the attach's). */
-  private async recreateAtOwnBranch(
+    return { binding: moved, rebound };
+  }
+
+  /** The move itself (item 16): the binding's ref becomes the branch, and the
+   *  attach that follows provisions the tree at it — `ensureThreadWorktree`
+   *  clones the branch from the mirror when the tree is gone, dirty or on the
+   *  old ref. So the mirror must hold the branch: one pushed since the last
+   *  refresh cycle is fetched for here, under the mutex; a branch still
+   *  missing after the fetch (deleted after a merge, or never pushed) is a
+   *  `branch-absent` refusal and the binding stands — the attach then goes on
+   *  at the ref it had, never `unknown-ref`. Nothing on disk is touched here:
+   *  the row is written, the tree is the attach's. */
+  private async moveOntoOwnBranch(
     current: ThreadBinding,
     plan: { to: string; pr: number },
     fetchToken: string | null,
@@ -4795,7 +4747,7 @@ export class ResidentDO extends Sandbox<Env> {
         refused: rebindRefused(
           plan,
           "branch-absent",
-          `the thread's worktree is gone and the mirror does not hold ${JSON.stringify(plan.to)} (deleted after a merge, or never pushed); the tree cannot be recreated at it`,
+          `the mirror does not hold ${JSON.stringify(plan.to)} even after a fetch (deleted after a merge, or never pushed); the tree cannot be provisioned at it`,
         ),
       };
     }
@@ -4807,13 +4759,43 @@ export class ResidentDO extends Sandbox<Env> {
     };
     const moved: ThreadBinding = { ...current, ref: plan.to, rebound };
     await this.ctx.storage.put(threadBindingKey(current.threadKey), moved);
-    return { kind: "rebound", moved, rebound, keepTree: false };
+    return { kind: "rebound", moved, rebound };
+  }
+
+  /** Item 16's second movement, decided where the fact is established — under
+   *  the mirror mutex, after the attach's fetch found the bound ref gone: a
+   *  binding a rebind moved onto its own pull request's branch, that branch
+   *  now deleted (its pull request merged), goes back to the default it was
+   *  bound to, so the run starts clean there (item 17) instead of the thread
+   *  failing `unknown-ref` for the rest of its life. The row as it stands is
+   *  re-read and re-judged (`canReturnToDefault`: a ref a person named never
+   *  returns — that branch is theirs to sort out), the move stamped returned
+   *  so the thread may follow its next pull request, and the answer carries
+   *  the move back for the card. A row that no longer qualifies — another
+   *  attach moved it meanwhile — is answered as it stands, nothing written. */
+  private async returnBindingToDefault(
+    binding: ThreadBinding,
+    defaultRef: string,
+  ): Promise<{ binding: ThreadBinding; returned?: Returned }> {
+    const key = threadBindingKey(binding.threadKey);
+    const current = (await this.ctx.storage.get<ThreadBinding>(key)) ?? binding;
+    if (current.rebound === undefined || !canReturnToDefault(current, defaultRef)) return { binding: current };
+    const back = returnToDefault(
+      { ...current, rebound: current.rebound },
+      defaultRef,
+      new Date(systemClock()).toISOString(),
+    );
+    await this.ctx.storage.put(key, back.binding);
+    console.log(
+      `attach ${binding.threadKey}: ${back.returned.from} is gone from the mirror (the thread's own pull request #${back.returned.pr}) — returned to ${back.returned.to}; the tree is provisioned there`,
+    );
+    return back;
   }
 
   /** The release's word on what the run pushed (`/detach` `pushed`, item
-   *  16a), remembered on the binding BEFORE the detach decides anything: a
-   *  clean tree is evicted at once, a dirty one kept, an already-evicted
-   *  binding answered as such — and in every case the fact must outlive the
+   *  16a), remembered on the binding BEFORE the detach decides anything: the
+   *  tree evicted, a busy one kept, an already-evicted binding answered as
+   *  such — and in every case the fact must outlive the
    *  tree, since it is what a follow-up's rebind onto the thread's own pull
    *  request branch reads once the tree is gone. No binding → nothing to
    *  remember on (the detach answers its 404 next). */
@@ -4835,10 +4817,6 @@ export class ResidentDO extends Sandbox<Env> {
     refHint: string | null;
     wantSha: string | null;
     reuse: boolean;
-    /** The rebind moved the record alone over a dirty tree already on the
-     *  branch (item 16) and promised not to touch it: the worktree step keeps
-     *  the tree as it stands instead of item 17's dirty wipe. */
-    keepTree: boolean;
     slug: string;
     t0: number;
     facts: RepoFacts;
@@ -4850,8 +4828,14 @@ export class ResidentDO extends Sandbox<Env> {
     rebound?: Rebound;
     rebindRefused?: RebindRefused;
   }): Promise<AttachOk | ThreadErr> {
-    const { threadKey, refHint, wantSha, reuse, keepTree, slug, t0, facts, record, binding, mode, rollback } = input;
+    const { threadKey, refHint, wantSha, reuse, slug, t0, facts, record, mode, rollback } = input;
     const { rebound, rebindRefused } = input;
+    // Reassigned once, under the lock, when the bound ref turns out gone from
+    // the mirror and the binding goes back to the default (item 16's second
+    // movement): everything after the lock — deps, credentials, the row's
+    // final write, the answer — then speaks of the returned binding.
+    let binding = input.binding;
+    let returned: Returned | undefined;
 
     // Command-level token mint — before the lock so mint latency
     // never holds the mutex, and failure never blocks the attach.
@@ -4882,7 +4866,7 @@ export class ResidentDO extends Sandbox<Env> {
     // The expected head applies to the ref it was resolved for; a sticky
     // binding on another branch drops it (item 51) rather than fetching on
     // every attach of a thread that can never be at that commit.
-    const want = wantShaForBinding({ boundRef: binding.ref, refHint, wantSha });
+    let want = wantShaForBinding({ boundRef: binding.ref, refHint, wantSha });
     let fetchToken: string | null = token;
     if (!fetchToken && githubAppConfigured(this.env) && (await this.mirrorNeedsFetchFor(binding.ref, want))) {
       fetchToken = (await mintRepoScopedToken(this.env, slug).catch(() => null))?.token ?? null;
@@ -4912,11 +4896,27 @@ export class ResidentDO extends Sandbox<Env> {
         // for every missing ref, so only a fetched mirror needs the re-read.
         // (Under the mirror mutex — the mirror cannot change in between.)
         const refExists = !fetched || (await this.refExists(binding.ref));
-        const target = attachTarget({
+        let target = attachTarget({
           refExists,
           wantSha: want,
           commitInMirror: !refExists && want !== null && (await this.commitInMirror(want)),
         });
+        if (target.kind === "unknown-ref" && canReturnToDefault(binding, facts.defaultRef)) {
+          // The branch a rebind moved this thread onto is gone even after the
+          // fetch — deleted once its pull request merged. The binding goes
+          // back to the default (item 16's second movement) and the attach
+          // goes on there: the default is always in the mirror, and the
+          // worktree step below provisions the tree at its tip.
+          const back = await this.returnBindingToDefault(binding, facts.defaultRef);
+          binding = back.binding;
+          returned = back.returned;
+          want = wantShaForBinding({ boundRef: binding.ref, refHint, wantSha });
+          target = attachTarget({
+            refExists: await this.refExists(binding.ref),
+            wantSha: want,
+            commitInMirror: false,
+          });
+        }
         if (target.kind === "unknown-ref") {
           throw new StepError(
             "unknown-ref",
@@ -4929,7 +4929,6 @@ export class ResidentDO extends Sandbox<Env> {
         const recreated = await this.ensureThreadWorktree(binding, sha, mode.originUrl, mode.modeSwitch, {
           detached: target.kind === "sha",
           reuse,
-          keepTree,
         });
         return { sha, threadLockKey, recreated };
       }, ATTACH_MUTEX_WAIT_MS);
@@ -5027,20 +5026,20 @@ export class ResidentDO extends Sandbox<Env> {
       trace: this.currentSteps(),
       ...(rebound !== undefined ? { rebound } : {}),
       ...(rebindRefused !== undefined ? { rebindRefused } : {}),
+      ...(returned !== undefined ? { returned } : {}),
     };
   }
 
   /** Ensure the worktree exists. A provisioning attach wipes dirty/stale
-   *  trees; a reusing attach (`opts.reuse`, item 66) keeps a readable tree
-   *  exactly as it stands (the dirt and the HEAD are the resumed run's own
-   *  work) and throws `ReuseRefusedError` for one it cannot keep, touching
-   *  nothing; a provisioning attach whose own rebind moved the record alone
-   *  over a dirty tree already on the branch (`opts.keepTree`, item 16) keeps
-   *  that tree as it stands too — the dirt is why the rebind declined to touch
-   *  it — and provisions one that turns out not to be there. The decision is
-   *  the pure `decideWorktree`; this method measures the facts and runs the
-   *  verdict. Returns true when the tree was (re)created. MUST be called
-   *  holding the mirror mutex: the clone reads the mirror.
+   *  trees — a run starts from a clean tree at the bound ref's tip (item 17),
+   *  and a rebind that moved the binding leaves a tree on the old branch that
+   *  this discipline recreates like any stale one; a reusing attach
+   *  (`opts.reuse`, item 66) keeps a readable tree exactly as it stands (the
+   *  dirt and the HEAD are the resumed run's own work) and throws
+   *  `ReuseRefusedError` for one it cannot keep, touching nothing. The
+   *  decision is the pure `decideWorktree`; this method measures the facts
+   *  and runs the verdict. Returns true when the tree was (re)created. MUST be
+   *  called holding the mirror mutex: the clone reads the mirror.
    *
    *  "Dirty" is tracked-file dirt (`status --porcelain -uno`): untracked
    *  scratch files are the thread's own state and survive re-attach.
@@ -5063,11 +5062,8 @@ export class ResidentDO extends Sandbox<Env> {
     /** `detached`: the bound ref is gone from the mirror and `sha` is the
      *  expected commit it still holds (item 51) — the tree is checked out at
      *  that commit, detached, instead of at a branch. `reuse`: a resumed
-     *  run's attach (item 66): keep the tree as it stands, or refuse.
-     *  `keepTree`: this attach's rebind moved the record alone over a dirty
-     *  tree already on the branch (item 16): keep a readable tree as it
-     *  stands, provision one that is not there. */
-    opts: { detached: boolean; reuse: boolean; keepTree: boolean } = { detached: false, reuse: false, keepTree: false },
+     *  run's attach (item 66): keep the tree as it stands, or refuse. */
+    opts: { detached: boolean; reuse: boolean } = { detached: false, reuse: false },
   ): Promise<boolean> {
     const wt = binding.worktreePath;
     const threadDir = parentDir(wt);
@@ -5104,14 +5100,7 @@ export class ResidentDO extends Sandbox<Env> {
         }
       }
     }
-    const decision = decideWorktree({
-      reuse: opts.reuse,
-      keepTree: opts.keepTree,
-      modeSwitch,
-      sha,
-      worktreePath: wt,
-      facts,
-    });
+    const decision = decideWorktree({ reuse: opts.reuse, modeSwitch, sha, worktreePath: wt, facts });
     if (decision.kind === "refuse") throw new ReuseRefusedError(decision.why);
     if (decision.kind === "reuse") return false;
 
@@ -6044,13 +6033,21 @@ export class ResidentDO extends Sandbox<Env> {
 
   /** Remove a thread's worktree (when the runtime is up — a slept container
    *  already lost it) and release its pool user; the binding is KEPT, marked
-   *  evicted, so the ref stays sticky and the next attach recreates the tree
-   *  with it. Shared by the inactivity sweep and /detach. */
+   *  evicted with the cause (`evictedWhy`) and with what the tree held
+   *  (`evictedLeftBehind`, or `evictedUnmeasured` when git could not read it
+   *  — item 17: never a reason to keep the tree, never discarded silently), so
+   *  the ref stays sticky and the next attach recreates the tree with it.
+   *  Shared by the inactivity sweep, the reclamation pass, the disk-pressure
+   *  path and /detach. */
   private async evictBinding(
     binding: ThreadBinding,
     runtimeActive: boolean,
     logCtx: string,
     why: string,
+    /** What the caller measured in the tree first (`measureTreeBeforeEviction`,
+     *  as the thread user with the runtime up); absent when the tree was clean,
+     *  already gone with the disk, or not measured (a force detach). */
+    tree?: EvictedTree,
   ): Promise<boolean> {
     const threadDir = parentDir(binding.worktreePath);
     if (runtimeActive && threadDir.startsWith(`${THREADS_DIR}/`)) {
@@ -6086,25 +6083,30 @@ export class ResidentDO extends Sandbox<Env> {
       evicted: true,
       evictedAt: new Date(systemClock()).toISOString(),
       evictedWhy: why,
+      evictedLeftBehind: tree && "leftBehind" in tree ? tree.leftBehind : undefined,
+      evictedUnmeasured: tree && "unmeasured" in tree ? tree.unmeasured : undefined,
     } satisfies ThreadBinding);
+    if (tree) console.log(`${logCtx}: ${binding.threadKey} evicted (${why}) — ${evictedTreeSentence(tree)}`);
     return true;
   }
 
   /** POST /detach: a run has ended — give the thread's pool user back now
    *  instead of holding it until the TTL sweep (the pool is sized for
-   *  simultaneous runs). `force` releases unconditionally (read-only agents,
-   *  hard stops): an op still in flight is KILLED first (the bot has
-   *  already dropped its fetch, the command would otherwise run on and hold
-   *  the user until the sweep); otherwise a busy thread, or a worktree with
-   *  uncommitted or unpushed work, is KEPT and the caller learns why. No
-   *  binding → 404-shaped error; already evicted → a no-op success. Never
-   *  flips lifecycle state. */
+   *  simultaneous runs). A run starts from a clean tree (item 17), so the tree
+   *  goes whatever it holds: what it held — uncommitted changes, unpushed
+   *  commits — is measured once, as the thread user, and named in the answer
+   *  (`leftBehind`) so the loss is never silent. The one thing that keeps a
+   *  tree is an op still in flight in it (`busy`) — `force` (read-only agents,
+   *  hard stops) KILLS that op first (the bot has already dropped its fetch,
+   *  the command would otherwise run on and hold the user until the sweep)
+   *  and measures nothing. No binding → 404-shaped error; already evicted → a
+   *  no-op success. Never flips lifecycle state. */
   async detachThread(
     threadKey: string,
     force: boolean,
     /** What the ending run pushed (item 16a): remembered on the binding first, whatever the detach then decides. */
     pushed: readonly PushedBranch[] = [],
-  ): Promise<{ released: boolean; reason?: string; user?: string } | ThreadErr> {
+  ): Promise<DetachAnswer | ThreadErr> {
     if (pushed.length > 0) await this.rememberOwnBranches(threadKey, pushed);
     const binding = await this.ctx.storage.get<ThreadBinding>(threadBindingKey(threadKey));
     if (!binding) return { error: `no-binding: ${threadKey} has never attached to this resident`, status: 404 };
@@ -6125,11 +6127,14 @@ export class ResidentDO extends Sandbox<Env> {
       if (left > 0) return { released: false, reason: busyAfterKillReason(left), user: binding.user };
     }
     const active = await this.isRuntimeActive().catch(() => false);
-    if (!force && active) {
-      const c = await this.worktreeCleanliness(binding);
-      if (!c.clean) return { released: false, reason: `${c.reason} — kept`, user: binding.user };
-    }
-    // Re-check right before removal: the clean check above awaited (the DO
+    // What the tree still holds, for the answer and the eviction's record —
+    // never a reason to keep it. Not measured on a force release: a read-only
+    // tree holds nothing, and a hard stop's tree is whatever the killed
+    // command left. A probe that fails names nothing in the answer (never a
+    // guess); the record and the log say it could not be measured.
+    let tree: EvictedTree | undefined;
+    if (!force && active) tree = await this.measureTreeBeforeEviction(binding);
+    // Re-check right before removal: the measurement above awaited (the DO
     // yields at each await), so an exec that arrived mid-detach would otherwise
     // have its tree removed under it.
     const busyNow = this.threadOpsInFlight.get(threadKey) ?? 0;
@@ -6139,22 +6144,23 @@ export class ResidentDO extends Sandbox<Env> {
         reason: `busy: ${busyNow} operation(s) started during detach — kept`,
         user: binding.user,
       };
-    // Same re-read as the sweep: a re-attach during the clean check means a
+    // Same re-read as the sweep: a re-attach during the measurement means a
     // fresh tree we must not remove from a stale snapshot.
     const current = await this.ctx.storage.get<ThreadBinding>(threadBindingKey(threadKey));
     if (!current || current.evicted) return { released: false, reason: "already-evicted" };
     if (current.lastAttachAt !== binding.lastAttachAt)
-      return { released: false, reason: "re-attached during the clean check — kept", user: current.user };
+      return { released: false, reason: "re-attached during the detach — kept", user: current.user };
     const user = current.user;
-    // Same as the sweep: `active` was read before the clean check's awaits; a
+    // Same as the sweep: `active` was read before the measurement's awaits; a
     // container that woke meanwhile must get the rm, not an orphaned tree.
     const activeNow = await this.isRuntimeActive().catch(() => false);
-    if (!(await this.evictBinding(current, activeNow, `detach`, "detach"))) {
+    if (!(await this.evictBinding(current, activeNow, `detach`, "detach", tree))) {
       return { released: false, reason: "re-attached during eviction — kept", user };
     }
     // Item 55: the tree is gone; the gauge catches up at the next refresh
     // instance's `measure` step, and the admission's `df` sees the space now.
-    return { released: true, user };
+    const leftBehind = tree && "leftBehind" in tree ? tree.leftBehind : undefined;
+    return { released: true, user, ...(leftBehind !== undefined ? { leftBehind } : {}) };
   }
 
   /** Force-detach's kill: end every process owned by the pool user —
@@ -6191,20 +6197,22 @@ export class ResidentDO extends Sandbox<Env> {
     }
   }
 
-  /** Is this thread's tree safe to destroy? The git probes run AS THE THREAD
-   *  USER (su), never as root: the worktree is thread-owned, so root git in
-   *  it would be refused by safe.directory and would be the exact repo-local-
-   *  config execution vector safe.directory exists to block. Unknown (git
-   *  failed) counts as NOT clean — never destroy work on a guess. A tree
-   *  that no longer exists (disk recycled by a sleep/wake) has nothing to
-   *  preserve: releasable, so a post-wake binding does not hold a pool user
-   *  for 7 days on behalf of files that are already gone.
+  /** What this thread's tree holds: the tracked changes and unpushed commits,
+   *  or that git could not read it. The git probes run AS THE THREAD USER
+   *  (su), never as root: the worktree is thread-owned, so root git in it
+   *  would be refused by safe.directory and would be the exact repo-local-
+   *  config execution vector safe.directory exists to block. Read by
+   *  `measureTreeBeforeEviction` for the eviction's record — never a reason
+   *  to keep a tree (item 17) — and by the disk-full recycle's guard (item
+   *  54), where unknown (git failed) counts as NOT clean. A tree that no
+   *  longer exists (disk recycled by a sleep/wake) is clean with nothing
+   *  measured: there was nothing to discard.
    *
    *  ONE spawn: the presence test and both git probes fold
    *  into the pure `worktreeCleanlinessScript` (test -d as root, both git
    *  commands inside a single privilege-dropped `su`, tagged lines out);
    *  `parseWorktreeCleanliness` encodes the exact decision table above. */
-  private async worktreeCleanliness(binding: ThreadBinding): Promise<{ clean: boolean; reason?: string }> {
+  private async worktreeCleanliness(binding: ThreadBinding): Promise<WorktreeCleanliness> {
     const injected = { GIT_TERMINAL_PROMPT: "0" }; // same injection as threadRun — fail fast, never prompt
     validateEnvNames(injected);
     const r = await this.run(["sh", "-c", worktreeCleanlinessScript(binding.worktreePath, binding.user)], {
@@ -6214,6 +6222,14 @@ export class ResidentDO extends Sandbox<Env> {
     return parseWorktreeCleanliness(r);
   }
 
+  /** What a tree holds right before its eviction, for the record and the log
+   *  (item 17): the one-spawn probe as the thread user, read once into
+   *  `evictedTreeOf` — never into a keep decision. Callers skip it when the
+   *  runtime is down: the disk, and the tree with it, is already gone. */
+  private async measureTreeBeforeEviction(binding: ThreadBinding): Promise<EvictedTree | undefined> {
+    return evictedTreeOf(await this.worktreeCleanliness(binding));
+  }
+
   /** Anything that must not be interrupted by a container stop or counted
    *  as idle: thread exec/read/write, disposable /op runs, and attaches past
    *  their own image check (mid clone/install under the mirror lock). */
@@ -6254,35 +6270,29 @@ export class ResidentDO extends Sandbox<Env> {
     const ttlDays = record?.worktreeTtlDays ?? WORKTREE_TTL_DAYS_DEFAULT;
     const cutoff = systemClock() - ttlDays * 86_400_000;
     const all = await this.ctx.storage.list<ThreadBinding>({ prefix: THREAD_KEY_PREFIX });
-    const active = await this.isRuntimeActive().catch(() => false);
     const idleCutoff = systemClock() - CLEAN_IDLE_RELEASE_S * 1000;
     for (const binding of all.values()) {
       if (binding.evicted || !binding.user) continue;
       const last = Date.parse(binding.lastAttachAt);
       if (last >= cutoff) {
-        // Not past the TTL. Still release it if it has been idle for an hour,
-        // nothing is running on it, and the tree is provably clean — the run
-        // that used it is over and there is nothing to preserve. A slept
-        // container has NO tree any more (sleep destroys the disk), so an
-        // idle binding on an inactive runtime is releasable outright: there is
-        // nothing left to protect, only a pool user to give back. (Keeping
-        // them would leave idle bindings on a sleeping resident until the
-        // 7-day TTL.)
+        // Not past the TTL. Still release it if it has been idle for an hour
+        // and nothing is running on it: the run that used it is over, and
+        // whatever its tree holds has no future — the next attach provisions
+        // a clean tree (item 17) — so there is nothing to keep it for. This is
+        // what drains the bindings of runs whose release never came (a
+        // resident that was sick at the run's end, a run older than
+        // `/detach`). A live run is protected by its op in flight, not by its
+        // dirt. A slept container has no tree any more anyway (sleep destroys
+        // the disk).
         const busy = this.threadOpsInFlight.get(binding.threadKey) ?? 0;
-        const cleanIdle =
-          last < idleCutoff && busy === 0 && (!active || (await this.worktreeCleanliness(binding)).clean);
-        // Re-read right before removal: the clean check awaited (the DO
-        // yields), so an exec that arrived meanwhile would otherwise have
-        // its tree removed under it — same guard as detachThread.
-        const busyNow = this.threadOpsInFlight.get(binding.threadKey) ?? 0;
-        if (!cleanIdle || busyNow > 0) {
+        if (last >= idleCutoff || busy > 0) {
           kept++;
           continue;
         }
       }
-      // Re-read the binding too: a re-attach that completed inside the
-      // clean-check await bumped lastAttachAt and rebuilt the tree — evicting
-      // from this loop's stale snapshot would rm the fresh tree.
+      // Re-read the binding: earlier iterations awaited (the DO yields), so a
+      // re-attach that completed meanwhile bumped lastAttachAt and rebuilt the
+      // tree — evicting from this loop's stale snapshot would rm the fresh tree.
       const current = await this.ctx.storage.get<ThreadBinding>(threadBindingKey(binding.threadKey));
       if (!current || current.evicted || current.lastAttachAt !== binding.lastAttachAt) {
         kept++;
@@ -6292,8 +6302,17 @@ export class ResidentDO extends Sandbox<Env> {
       // attach), and an eviction decided on a stale "inactive" would skip the
       // rm and orphan a real tree.
       const activeNow = await this.isRuntimeActive().catch(() => false);
+      // What the tree holds goes on the eviction's record (item 17), measured
+      // while the runtime is up; a slept container has no tree to measure.
+      const tree = activeNow ? await this.measureTreeBeforeEviction(current) : undefined;
       if (
-        await this.evictBinding(current, activeNow, `worktree-sweep ${resource}`, last >= cutoff ? "clean-idle" : "ttl")
+        await this.evictBinding(
+          current,
+          activeNow,
+          `worktree-sweep ${resource}`,
+          last >= cutoff ? "clean-idle" : "ttl",
+          tree,
+        )
       )
         evicted.push(binding.threadKey);
       else kept++;
@@ -6551,9 +6570,11 @@ export class ResidentDO extends Sandbox<Env> {
    *  mirror (the refresh cycle's `fetch --prune` just ran) or its PR was
    *  merged/closed. Runs inside the refresh cycle — a poll on the existing
    *  cadence, since the GitHub App has webhooks off — and via /debug
-   *  reclaim-now. Never touches the default branch, a busy thread, or a dirty
-   *  tree (reclaimDecision); every keep is named. The eviction itself is the
-   *  sweep's `evictBinding` with the same re-read guards. */
+   *  reclaim-now. Never touches the default branch or a busy thread
+   *  (reclaimDecision); every keep is named. What the tree holds is never a
+   *  reason to keep it (item 17) — it is measured once as the thread user and
+   *  recorded by the eviction, the sweep's `evictBinding` with the same
+   *  re-read guards. */
   async reclaimFinishedRefs(
     resource: string,
     defaultRef: string,
@@ -6613,21 +6634,16 @@ export class ResidentDO extends Sandbox<Env> {
       // by name), so its fate is never looked up.
       const { fate, detail } = (!isDefaultRef && fates.get(binding.ref)) || { fate: "unknown" as RefFate, detail: "" };
       const busy = this.threadOpsInFlight.get(binding.threadKey) ?? 0;
-      // The clean check runs as the thread user and only when it can decide
-      // anything: a finished ref, nothing running, runtime up (down → the tree
-      // is already gone with the disk → null).
-      const finished = fate === "gone" || fate === "merged" || fate === "closed";
-      const clean = !active
-        ? null
-        : finished && !isDefaultRef && busy === 0
-          ? (await this.worktreeCleanliness(binding)).clean
-          : null;
-      const decision = reclaimDecision({ fate, isDefaultRef, busy, clean });
+      const decision = reclaimDecision({ fate, isDefaultRef, busy });
       if (!decision.reclaim) {
         kept.push({ threadKey: binding.threadKey, ref: binding.ref, why: decision.why });
         continue;
       }
-      // Same guards as the sweep: the clean check awaited, so re-read the
+      // What the tree holds goes on the eviction's record (item 17), never
+      // into the decision: measured as the thread user while the runtime is
+      // up; down → the tree is already gone with the disk.
+      const tree = active ? await this.measureTreeBeforeEviction(binding) : undefined;
+      // Same guards as the sweep: the measurement awaited, so re-read the
       // binding (a re-attach means a fresh tree) and the op counter.
       const busyNow = this.threadOpsInFlight.get(binding.threadKey) ?? 0;
       const current = await this.ctx.storage.get<ThreadBinding>(threadBindingKey(binding.threadKey));
@@ -6641,7 +6657,7 @@ export class ResidentDO extends Sandbox<Env> {
       }
       const activeNow = await this.isRuntimeActive().catch(() => false);
       const why = `${decision.why}${detail}`;
-      if (await this.evictBinding(current, activeNow, `reclaim ${resource}`, why)) {
+      if (await this.evictBinding(current, activeNow, `reclaim ${resource}`, why, tree)) {
         reclaimed.push({ threadKey: binding.threadKey, ref: binding.ref, why });
         console.log(`reclaim ${resource}: evicted ${binding.threadKey} on ${binding.ref} — ${why}`);
       } else kept.push({ threadKey: binding.threadKey, ref: binding.ref, why: "re-attached" });
@@ -6752,18 +6768,35 @@ export class ResidentDO extends Sandbox<Env> {
     // left out; nothing here is secret (credential files are never persisted).
     const threads = [...bindings.values()]
       .sort((a, b) => b.lastAttachAt.localeCompare(a.lastAttachAt))
-      .map(({ threadKey, ref, sha, user, deps, boundAt, lastAttachAt, evicted, evictedAt, evictedWhy }) => ({
-        threadKey,
-        ref,
-        sha: sha ?? null,
-        user,
-        deps: deps ?? null,
-        boundAt,
-        lastAttachAt,
-        evicted: evicted ?? false,
-        evictedAt: evictedAt ?? null,
-        evictedWhy: evictedWhy ?? null,
-      }));
+      .map(
+        ({
+          threadKey,
+          ref,
+          sha,
+          user,
+          deps,
+          boundAt,
+          lastAttachAt,
+          evicted,
+          evictedAt,
+          evictedWhy,
+          evictedLeftBehind,
+          evictedUnmeasured,
+        }) => ({
+          threadKey,
+          ref,
+          sha: sha ?? null,
+          user,
+          deps: deps ?? null,
+          boundAt,
+          lastAttachAt,
+          evicted: evicted ?? false,
+          evictedAt: evictedAt ?? null,
+          evictedWhy: evictedWhy ?? null,
+          evictedLeftBehind: evictedLeftBehind ?? null,
+          evictedUnmeasured: evictedUnmeasured ?? null,
+        }),
+      );
     return {
       resource: map.get(RESOURCE_KEY) ?? null,
       state: map.get(STATE_KEY) ?? "down",