@coreplane/switchboard 1.240.0 → 1.242.0

package/dist/assets/config/config.example.yaml

@@ -100,10 +100,16 @@ defaults:
 #       maxMinutes: 45
 #       maxIdentity: read
 
-# Static per-user defaults (user ID -> scope).
+# Static per-user defaults (user ID -> scope). A user's `harness` puts that
+# person's runs of a preset on another harness (docs/reference/specs/harness.md
+# item 8) — every run of it they request, in any channel, and nobody else's; the
+# same words as the top-level `harness` block, which they override (a channel's
+# `harness` sits between). From chat: `config set me --harness.coding opencode`.
 # users:
 #   slack:U012345:
 #     model: openai/gpt-5
+#     harness:
+#       coding: opencode
 
 # Authorization (docs/reference/specs/authorization.md item 9, docs/reference/authorization.md):
 # two blocks. `restrict` names what is CLOSED unless granted — an agent listed
@@ -327,13 +333,25 @@ workspaceDir: ./workspaces
 #                     # a finding at or above it sends the round into a fix step instead of merge-ready.
 #                     # Per channel/user: config set … --ship.addressSeverity; per run: severity:<level>.
 
-# `harness` is a retired key (docs/reference/specs/harness-pi.md item 1). It
-# moved the presets onto pi one at a time; every preset runs on pi now — the pi
-# coding agent started inside the run's own execution container (or as a child
-# of the bot for a preset without a workspace) with the run's model-proxy
-# bearer as its only key — and there is no other loop. A block written during
-# the series still loads when every value is `pi`; `native` names the deleted
-# loop and fails the load by name, as does an unknown preset. Remove the block.
+# Which harness each preset's runs are driven by, deployment-wide
+# (docs/reference/specs/harness.md item 8): a mapping of preset to a harness's
+# name. Two exist — `pi` (the pi coding agent, the default for every preset)
+# and `opencode` (OpenCode's server, `opencode serve`) — each started inside
+# the run's own execution container (or as a child of the bot for a preset
+# without a workspace) with the run's model-proxy bearer as its only key, every
+# tool call decided in the bot, every event on the run's record. This block is
+# the defaults layer of the per-scope `harness` setting: a channel's or a
+# user's `harness` (above, or `config set channel|me --harness.<preset> …`)
+# overrides it for the runs in that scope, user over channel over here. A
+# preset no layer names runs on pi; nothing defaults to OpenCode. A run keeps
+# the harness it started on, so changing a word moves the next run, never one
+# in flight. Any other word (`native`, the deleted loop; `codex`) fails the
+# load naming the two, as does an unknown preset, in every layer; a
+# `defaults.harness` key is refused pointing here. How-to:
+# docs/how-to/put-a-preset-on-opencode.md.
+# harness:
+#   coding: opencode   # coding runs on OpenCode
+#   review: pi         # the default, written out
 
 # What the harness writes into pi's per-run settings for every run on pi
 # (docs/reference/specs/harness-pi.md item 4): pi's compaction thresholds, in
@@ -349,6 +367,18 @@ workspaceDir: ./workspaces
 #     reserveTokens: 150000
 #     keepRecentTokens: 8000
 
+# What the harness writes into OpenCode's per-run configuration for every run
+# on OpenCode (docs/reference/specs/harness.md item 8): OpenCode's compaction
+# thresholds, in tokens, under OpenCode's own names — `buffer`, the tokens kept
+# free of the model's window before a compaction runs; `keepTokens`, how much
+# of the newest turns it keeps. Unset, OpenCode's defaults stand and the file
+# names no compaction. The OpenCode twin of the `pi` block above; positive
+# integers only, any other shape or key fails the load by name.
+# opencode:
+#   compaction:
+#     buffer: 20000
+#     keepTokens: 8000
+
 # The fan-out cap a spawning run meets (docs/reference/specs/agent-conductor.md).
 # `agent:conductor` starts child runs as the person who asked — each an
 # ordinary run in a thread of its own, under that person's permissions — and
@@ -392,6 +422,8 @@ workspaceDir: ./workspaces
 #   snapshot:                                  # the page serves a snapshot of both billing sources, never a live read;
 #     everyHours: 24                           #   how often the bot reads them (1–168, default 24). `costs snapshot`
 #                                              #   takes one now. Kept on the state Worker any `*.worker` block names
+#     alertChannel: slack:C0123ABCD            #   optional: a line there after three failed takes in a row, and one
+#                                              #   when a take lands again; otherwise only the page's status line says
 #   groups:
 #     myapp:
 #       label: My App

package/dist/assets/deploy/cloudflare/worker.ts

@@ -17,8 +17,11 @@ import {
   createInstanceResponse,
   instanceStatusResponse,
   isInstanceNotFound,
+  parseInstanceEventPath,
   parseInstanceStatusPath,
   parseCreateInstanceRequest,
+  parseSendEventRequest,
+  sendEventResponse,
   parseSubjectAuthorization,
   type CreateInstanceOutcome,
 } from "../../src/core/coordinator/instancesRoute.ts";
@@ -87,6 +90,7 @@ export interface Env {
   DASHBOARD_TOKEN?: string; // dashboard auth `token` strategy: the bearer (the default env name; config may name another)
   SWITCHBOARD_INGRESS_TOKENS?: string; // enables HTTP /ingress + MCP /mcp (JSON token→identity map); the `cron` entry is what scheduled runs present; an entry whose `http:<subject>` actor holds `deploy:write` in the bot's config may POST /admin/restart
   BRAVE_SEARCH_API_KEY?: string; // web_search backend (Brave); web_fetch works without it
+  GITHUB_WEBHOOK_SECRET?: string; // check-run intake: signs POST /webhooks/github; absent, the intake answers 503 disabled
   CF_ANALYTICS_TOKEN?: string; // costs dash: Cloudflare API token, Account Analytics:Read only
   ANTHROPIC_ADMIN_KEY?: string; // costs dash (optional): Anthropic Admin API key for the LLM cost report
   MEMORY_TOKEN?: string; // durable memory + friction ledger + schedule firings + MCP registry: bearer for the state Worker
@@ -125,6 +129,7 @@ const FORWARDED_OPTIONAL = [
   "ANTHROPIC_ADMIN_KEY",
   "SWITCHBOARD_INGRESS_TOKENS",
   "BRAVE_SEARCH_API_KEY",
+  "GITHUB_WEBHOOK_SECRET",
   "MEMORY_TOKEN",
   "MCP_CREDENTIAL_KEY",
   "MCP_ACCESS_CLIENT_ID",
@@ -407,6 +412,57 @@ async function handleCoordinatorInstanceStatus(request: Request, env: Env, id: s
   return json(res.status, res.body);
 }
 
+/** `POST /admin/coordinator/instances/<id>/events` — the shim's event relay
+ *  (docs/reference/specs/http-ingress.md item 12): the bot's check-run intake
+ *  holds no Workflow binding, so its `checks-settled-<head>` send crosses here
+ *  and this Worker's own `SHIP_COORDINATOR` binding delivers it. The same door
+ *  as the create and the status: the bearer in the map, the bot's `authorize`
+ *  answer. The engine's `instance.not_found` is 404; any other refusal (an
+ *  instance that already ended) is 502 by reason — the sender treats both as a
+ *  failed send and the driver's bounded wait is the fallback. */
+async function handleCoordinatorInstanceEvent(request: Request, env: Env, id: string): Promise<Response> {
+  const json = (status: number, body: Record<string, unknown>) =>
+    new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+  if (request.method !== "POST")
+    return json(405, {
+      ok: false,
+      error: `method not allowed: ${request.method} — ${COORDINATOR_INSTANCES_PATH}/<id>/events answers POST only`,
+    });
+  const authorization = request.headers.get("authorization") ?? undefined;
+  const authn = authenticateIngressBearer(authorization, env.SWITCHBOARD_INGRESS_TOKENS, "coordinator");
+  if (!authn.ok) {
+    console.warn(`[coordinator] instance event ${authn.status} — ${authn.reason}`);
+    return json(authn.status, { ok: false, error: authn.reason });
+  }
+  let answer: Response;
+  try {
+    answer = await getContainer(env.SWITCHBOARD, INSTANCE).fetch(
+      new Request(`${INTERNAL}${COORDINATOR_AUTHORIZE_PATH}`, {
+        method: "POST",
+        headers: { authorization: authorization ?? "" },
+      }),
+    );
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    return json(503, { ok: false, error: `coordinator disabled: the bot could not be asked (${reason})` });
+  }
+  const auth = parseSubjectAuthorization(answer.status, await answer.text().catch(() => ""));
+  if (!auth.ok) return json(auth.status, { ok: false, error: auth.reason });
+  const parsed = parseSendEventRequest(await request.text().catch(() => ""));
+  if (!parsed.ok) return json(400, { ok: false, error: parsed.reason });
+  let outcome: Parameters<typeof sendEventResponse>[0];
+  try {
+    await (await env.SHIP_COORDINATOR.get(id)).sendEvent({ type: parsed.type, payload: parsed.payload });
+    outcome = { kind: "sent", id };
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    outcome = isInstanceNotFound(reason) ? { kind: "absent", id } : { kind: "failed", id, reason };
+  }
+  const res = sendEventResponse(outcome);
+  console.log(`[coordinator] ${auth.subject} → instance ${id} event ${parsed.type}: ${outcome.kind}`);
+  return json(res.status, res.body);
+}
+
 /** Record a firing on the state Worker's ScheduleDO (the /runs Scheduled panel
  *  reads it). Best-effort: a failure here is a log line — the run itself (if
  *  any) already happened and is its own record. */
@@ -440,29 +496,32 @@ export default {
       // The routes the Worker answers itself — the restart, the coordinator's
       // instance creation and an instance's status, all over bindings only this
       // Worker holds; everything else is the container's.
-      const statusId = parseInstanceStatusPath(pathname);
+      const eventsId = parseInstanceEventPath(pathname);
+      const statusId = eventsId === undefined ? parseInstanceStatusPath(pathname) : undefined;
       const res =
         pathname === "/admin/restart"
           ? await handleAdminRestart(forwarded, env)
           : pathname === COORDINATOR_INSTANCES_PATH
             ? await handleCoordinatorInstances(forwarded, env)
-            : statusId !== undefined
-              ? await handleCoordinatorInstanceStatus(forwarded, env, statusId)
-              : pathname === COPY_PATH
-                ? // The artifact copy (artifactsCopy.ts): the R2 binding and the Slack
-                  // token are this Worker's; the bot only asks, with its copy bearer.
-                  // `forwarded`, never `inbound`: `withTraceContext` rebuilt the request
-                  // with `new Request(inbound, …)`, which takes the body stream with it —
-                  // `inbound.text()` is empty afterwards and the route read "not JSON" live.
-                  await handleArtifactsCopy(forwarded, {
-                    bucket: env.ARTIFACTS,
-                    bucketName: env.ARTIFACTS_BUCKET_NAME,
-                    copyToken: env.ARTIFACTS_COPY_TOKEN,
-                    slackToken: env.SLACK_BOT_TOKEN,
-                    fetch: (input, init) => fetch(input, init),
-                    lengthPipe: (size) => new FixedLengthStream(size),
-                  })
-                : withLength(await getContainer(env.SWITCHBOARD, INSTANCE).fetch(forwarded));
+            : eventsId !== undefined
+              ? await handleCoordinatorInstanceEvent(forwarded, env, eventsId)
+              : statusId !== undefined
+                ? await handleCoordinatorInstanceStatus(forwarded, env, statusId)
+                : pathname === COPY_PATH
+                  ? // The artifact copy (artifactsCopy.ts): the R2 binding and the Slack
+                    // token are this Worker's; the bot only asks, with its copy bearer.
+                    // `forwarded`, never `inbound`: `withTraceContext` rebuilt the request
+                    // with `new Request(inbound, …)`, which takes the body stream with it —
+                    // `inbound.text()` is empty afterwards and the route read "not JSON" live.
+                    await handleArtifactsCopy(forwarded, {
+                      bucket: env.ARTIFACTS,
+                      bucketName: env.ARTIFACTS_BUCKET_NAME,
+                      copyToken: env.ARTIFACTS_COPY_TOKEN,
+                      slackToken: env.SLACK_BOT_TOKEN,
+                      fetch: (input, init) => fetch(input, init),
+                      lengthPipe: (size) => new FixedLengthStream(size),
+                    })
+                  : withLength(await getContainer(env.SWITCHBOARD, INSTANCE).fetch(forwarded));
       root.end(res.status >= 500 ? "error" : "ok", { httpStatus: res.status });
       return res;
     } catch (err) {

package/dist/assets/deploy/cloudflare-resident/worker.ts

@@ -197,6 +197,14 @@ import {
   type RefreshFailure,
 } from "../../src/execution/residentRefresh.js";
 import { autoRebuildDecision, isAutoRebuildEligible } from "../../src/execution/residentAutoRebuild.js";
+import {
+  INFRA_STREAK_DOWN_AT,
+  infraStreakReason,
+  infraStreakRung,
+  type InfraStreakRow,
+  isRepoCommandStep,
+  parksOnRepeat,
+} from "../../src/execution/residentInfraStreak.js";
 import {
   lifecycleOf,
   parseLifecycle,
@@ -544,6 +552,8 @@ const GITHUB_API_TIMEOUT_MS = 10_000;
  *  idle-park like a warm one; the next attach still refreshes first. */
 const DEGRADED_PARK_AFTER_CYCLES = 3;
 const DEGRADED_STREAK_KEY = "resident:degradedStreak";
+/** Consecutive cycles failed in the resident's OWN steps (item 67): the ladder's count, `InfraStreakRow`. */
+const INFRA_STREAK_KEY = "resident:infraStreak";
 /** Degraded reasons that are not evidence about the repository — both always
  *  carry a `: detail` suffix: the watchdog's `stale-mid-flight: …` (a marker
  *  a dead cycle left behind; a cycle must run) and the wake path's
@@ -561,7 +571,7 @@ const DEGRADED_STREAK_KEY = "resident:degradedStreak";
  *  re-enters the step. A control port that did not answer
  *  (`runtime-unreachable: …`, item 64) is the third: no command ran, the
  *  ladder over its own persisted count owns the recovery. */
-const NON_EVIDENCE_REASON = /^(?:stale-mid-flight|restore-interrupted|runtime-unreachable):/;
+const NON_EVIDENCE_REASON = /^(?:stale-mid-flight|restore-interrupted|runtime-unreachable|infra-streak):/;
 /** When the disk-full recovery last stopped the container (docs/reference/specs/resident-repos.md item 54):
  *  feeds `planDiskFullRecovery`'s cooldown so a working set that refills the
  *  disk is named, not recycled in a loop. */
@@ -1479,6 +1489,17 @@ const threadBindingKey = (threadKey: string) => `${THREAD_KEY_PREFIX}${threadKey
 
 const parentDir = (p: string): string => p.slice(0, p.lastIndexOf("/"));
 
+/** A run's registration, held from its attach to its release (item 44): a
+ *  harness run's process lives in the container BETWEEN the bot's operator
+ *  calls, so the in-memory op counters read 0 while it runs. Durable rows —
+ *  a fresh isolate still counts the process that survived in the container. */
+const RUN_REG_KEY_PREFIX = "runReg:";
+const runRegKey = (threadKey: string) => `${RUN_REG_KEY_PREFIX}${threadKey}`;
+interface RunRegistration {
+  threadKey: string;
+  registeredAt: string;
+}
+
 /** Deterministic per-thread+ref worktree path. Slugs replace anything outside
  *  [A-Za-z0-9._-]; a threadKey-derived hash suffix keeps two keys that slug
  *  identically (e.g. "a:b" vs "a-b") from colliding on disk. */
@@ -3099,10 +3120,12 @@ export class ResidentDO extends Sandbox<Env> {
       }
     }
     let settled = entry.state === "warm";
-    if (entry.state === "degraded" && !isNonEvidenceReason(entry.reason)) {
+    if (entry.state === "degraded" && !isNonEvidenceReason(entry.reason) && parksOnRepeat(entry.reason)) {
       // Count consecutive cycles that found the same REFRESH-PRODUCED degraded
-      // reason (github-unreachable, <step>-failed); a stable streak means
-      // retrying is not going to help and parking is the right cost behavior.
+      // reason that is evidence about the repo or GitHub (github-unreachable,
+      // a repo-command step's <step>-failed); a stable streak means retrying
+      // is not going to help and parking is the right cost behavior. A
+      // resident-step failure never parks: item 67's ladder is its escalation.
       // Any other state resets the streak (below).
       const prev = await this.ctx.storage.get<{ reason: string; count: number }>(DEGRADED_STREAK_KEY);
       const streak =
@@ -3317,6 +3340,8 @@ export class ResidentDO extends Sandbox<Env> {
     // "idle since" and every attach would take the wake-fetch path).
     delete updatedFacts.idleSince;
     await this.ctx.storage.put(FACTS_KEY, updatedFacts);
+    // A completed cycle ends any resident-step streak (item 67).
+    await this.ctx.storage.delete(INFRA_STREAK_KEY);
     await this.setResidentState("warm");
     // Event-triggered reclamation: the prune above already told the
     // mirror which branches died; finished refs give their worktree and
@@ -3370,8 +3395,57 @@ export class ResidentDO extends Sandbox<Env> {
   private async refreshFailed(failure: RefreshFailure, selfInFlight: number): Promise<void> {
     console.log(`refresh: cycle failed — ${failure.reason.slice(0, 400)}`);
     await this.recordRefreshError(failure.reason);
-    await this.setResidentState("degraded", failure.reason); // last snapshot keeps serving
-    if (failure.diskFull) await this.recoverFromDiskFull(failure.reason, selfInFlight);
+    if (failure.diskFull) {
+      await this.setResidentState("degraded", failure.reason);
+      await this.recoverFromDiskFull(failure.reason, selfInFlight);
+      return;
+    }
+    // Item 67: a failure in the repository's own command is evidence about the
+    // repo — degraded, and the gate's park streak decides; it also ends any
+    // resident-step streak, since our machinery got that far. A failure in
+    // the resident's own steps climbs the ladder over the persisted count.
+    if (isRepoCommandStep(failure.step)) {
+      await this.ctx.storage.delete(INFRA_STREAK_KEY);
+      await this.setResidentState("degraded", failure.reason);
+      return;
+    }
+    const row = await this.noteInfraStreak(failure.step);
+    switch (infraStreakRung(row.count)) {
+      case "count":
+        await this.setResidentState("degraded", failure.reason);
+        return;
+      case "recreate":
+        // The disk, not the repo: destroy the container, snapshots kept; the
+        // next cycle's wake restores mirror, checkout and deps from R2.
+        await this.recreateContainer(infraStreakReason(row, "recreate"));
+        return;
+      case "down": {
+        // A recreated container failed the same way: the snapshot or the
+        // resident is what is wrong, and a rebuild from GitHub is the exit —
+        // item 36's transition, the VM destroyed first so provisioning starts
+        // on a fresh one.
+        const reason = infraStreakReason(row, "down");
+        this.swapIncarnation(); // deliberate incarnation swap
+        await this.forgetRuntimeIdentity();
+        await this.destroy().catch((err) => console.log(`infra-streak: destroy failed: ${errMsg(err)}`));
+        await this.ctx.storage.delete(INFRA_STREAK_KEY);
+        await this.goDown(reason);
+        return;
+      }
+    }
+  }
+
+  /** One more cycle failed in the resident's own steps: the count up by one,
+   *  `firstAt` kept, the step and `lastAt` now. */
+  private async noteInfraStreak(step: string): Promise<InfraStreakRow> {
+    const prev = await this.ctx.storage.get<InfraStreakRow>(INFRA_STREAK_KEY);
+    const now = new Date(systemClock()).toISOString();
+    const row: InfraStreakRow = { step, count: (prev?.count ?? 0) + 1, firstAt: prev?.firstAt ?? now, lastAt: now };
+    await this.ctx.storage.put(INFRA_STREAK_KEY, row);
+    console.log(
+      `infra-streak: cycle ${row.count} of ${INFRA_STREAK_DOWN_AT} failed in the resident's own step ${step} (first at ${row.firstAt})`,
+    );
+    return row;
   }
 
   // -- the runtime that never answers (docs/reference/specs/resident-repos.md item 64) ------
@@ -3494,7 +3568,7 @@ export class ResidentDO extends Sandbox<Env> {
    *  restore, for the reason `escalateRuntimeUnreachable` gives. */
   private async recreateContainer(reason: string): Promise<void> {
     console.log(
-      `runtime-unreachable: destroying the container — snapshots kept; the next exec restores from R2 (${reason.slice(0, 200)})`,
+      `recreate: destroying the container — snapshots kept; the next exec restores from R2 (${reason.slice(0, 200)})`,
     );
     this.swapIncarnation(); // deliberate incarnation swap
     await this.forgetRuntimeIdentity();
@@ -4687,7 +4761,7 @@ export class ResidentDO extends Sandbox<Env> {
       // container under it (and isIdle never parks the cycle mid-attach).
       this.attachesInFlight++;
       try {
-        return await this.attachThreadBody(
+        const res = await this.attachThreadBody(
           threadKey,
           refHint,
           readonly,
@@ -4698,6 +4772,10 @@ export class ResidentDO extends Sandbox<Env> {
           record,
           reason,
         );
+        // The run this attach opens is now in flight until its release —
+        // whatever its op counters read between the bot's calls (item 44).
+        if (!("error" in res)) await this.registerRun(threadKey);
+        return res;
       } finally {
         this.attachesInFlight--;
       }
@@ -5135,10 +5213,16 @@ export class ResidentDO extends Sandbox<Env> {
         // second movement is decided on. (Under the mirror mutex — the mirror
         // cannot change in between.)
         const refExists = why === null || (await this.refExists(binding.ref));
+        // The tip is read here, once, and is what the target is judged on and
+        // what the worktree is provisioned at: a caller that named a commit
+        // gets that commit or a `stale-tip` refusal, never whatever the tip
+        // happens to be (item 51).
+        let tipSha = refExists ? await this.readMirrorSha(binding.ref).catch(() => null) : null;
         let target = attachTarget({
           refExists,
           wantSha: want,
           commitInMirror: !refExists && want !== null && (await this.commitInMirror(want)),
+          tipSha,
         });
         if (target.kind === "unknown-ref" && returnable) {
           // The thread's branch — one a rebind moved it onto, or one its own
@@ -5151,10 +5235,13 @@ export class ResidentDO extends Sandbox<Env> {
           binding = back.binding;
           returned = back.returned;
           want = wantShaForBinding({ boundRef: binding.ref, refHint, wantSha });
+          const defaultExists = await this.refExists(binding.ref);
+          tipSha = defaultExists ? await this.readMirrorSha(binding.ref).catch(() => null) : null;
           target = attachTarget({
-            refExists: await this.refExists(binding.ref),
+            refExists: defaultExists,
             wantSha: want,
             commitInMirror: false,
+            tipSha,
           });
         }
         if (target.kind === "unknown-ref") {
@@ -5164,7 +5251,19 @@ export class ResidentDO extends Sandbox<Env> {
               (want !== null ? `, and the mirror does not hold the expected commit ${want.slice(0, 7)} either` : ""),
           );
         }
-        const sha = target.kind === "sha" ? target.sha : await this.readMirrorSha(binding.ref);
+        if (target.kind === "stale-tip") {
+          throw new StepError(
+            "stale-tip",
+            `ref ${JSON.stringify(binding.ref)} is at ${target.tip ? target.tip.slice(0, 7) : "an unreadable tip"} in the mirror${why === null ? " (no fetch was due)" : " even after the fetch"}; the caller expects ${target.want.slice(0, 7)} — the run executes at the commit it asked for, or not on this resident`,
+          );
+        }
+        // A tip the read could not answer is never provisioned at: with no
+        // commit named the target is `ref` without looking at the tip, so the
+        // failed read is named here instead of becoming a null sha.
+        const sha = target.kind === "sha" ? target.sha : tipSha;
+        if (sha === null) {
+          throw new StepError("rev-parse", `the mirror's tip of ${JSON.stringify(binding.ref)} could not be read`);
+        }
         const threadLockKey = await this.lockfileKey(sha);
         const recreated = await this.ensureThreadWorktree(binding, sha, mode.originUrl, mode.modeSwitch, {
           detached: target.kind === "sha",
@@ -5186,6 +5285,13 @@ export class ResidentDO extends Sandbox<Env> {
       if (err instanceof StepError && err.step === "unknown-ref") {
         return { error: `unknown-ref: ${err.message}`, status: 400 };
       }
+      if (err instanceof StepError && err.step === "stale-tip") {
+        // Item 51: not a resident fault and not a caller fault — a fact about
+        // the mirror at this instant. 409 with the state, so the bot's named
+        // fallback runs cold at the commit it asked for.
+        const s = await this.getStatus();
+        return { error: `stale-tip: ${err.message}`, status: 409, state: s.state, reason: "stale-tip" };
+      }
       return this.attachFailed(err);
     }
 
@@ -6361,6 +6467,9 @@ export class ResidentDO extends Sandbox<Env> {
       evictedLeftBehind: tree && "leftBehind" in tree ? tree.leftBehind : undefined,
       evictedUnmeasured: tree && "unmeasured" in tree ? tree.unmeasured : undefined,
     } satisfies ThreadBinding);
+    // The run's registration goes with its binding (item 44): released here,
+    // never on a give-way above — a re-attach has re-registered it anyway.
+    await this.ctx.storage.delete(runRegKey(binding.threadKey));
     if (tree) console.log(`${logCtx}: ${binding.threadKey} evicted (${why}) — ${evictedTreeSentence(tree)}`);
     return true;
   }
@@ -6522,10 +6631,33 @@ export class ResidentDO extends Sandbox<Env> {
     return threadOps + this.opUsersInUse.size + this.attachesInFlight;
   }
   /** In-flight activity for the deploy preflight (GET /status, GET /residents).
-   *  In-memory by nature: a fresh isolate answers 0, which is correct — nothing
-   *  survived to be interrupted. */
+   *  The in-memory counters (a fresh isolate answers 0 for them — nothing of
+   *  THEIRS survived to be interrupted) plus the durable run registrations:
+   *  a harness run's process DOES survive an isolate swap in the container,
+   *  so its registration must too. */
   async getInFlightCount(): Promise<number> {
-    return this.inFlightCount();
+    return this.inFlightCount() + (await this.registeredRunsBeyondOps());
+  }
+  /** A run holds its worktree from `/attach` to its release (`/detach`, the
+   *  sweep, disk pressure — every path ends in `evictBinding`, which clears
+   *  the row). Written by the attach; idempotent, a re-attach refreshes it. */
+  private async registerRun(threadKey: string): Promise<void> {
+    await this.ctx.storage.put(runRegKey(threadKey), {
+      threadKey,
+      registeredAt: new Date(systemClock()).toISOString(),
+    } satisfies RunRegistration);
+  }
+  /** The registrations the op counters do not already see: a thread with an
+   *  op in flight is counted by `runsInFlightCount`, so its registration is
+   *  not counted again. Deliberately NOT part of `inFlightCount()`: the
+   *  container-lifecycle predicates (isIdle, reconcileImage) must not let a
+   *  stale registration pin a container awake — the clean-idle sweep is what
+   *  drains a registration whose release never came. */
+  private async registeredRunsBeyondOps(): Promise<number> {
+    const regs = await this.ctx.storage.list<RunRegistration>({ prefix: RUN_REG_KEY_PREFIX });
+    let n = 0;
+    for (const r of regs.values()) if ((this.threadOpsInFlight.get(r.threadKey) ?? 0) === 0) n++;
+    return n;
   }
   private attachesInFlight = 0;
   /** A refresh cycle past its idle/reconcile gates (fetching, rebuilding, snapshotting). */
@@ -7067,6 +7199,8 @@ export class ResidentDO extends Sandbox<Env> {
       LIFECYCLE_KEY,
       REFRESH_INSTANCE_KEY,
       RUNTIME_UNREACHABLE_KEY,
+      AUTO_REBUILDS_KEY,
+      INFRA_STREAK_KEY,
     ]);
     const facts = map.get(FACTS_KEY) as RepoFacts | undefined;
     const snap = map.get(SNAPSHOT_KEY) as SnapshotRecord | undefined;
@@ -7119,6 +7253,9 @@ export class ResidentDO extends Sandbox<Env> {
           recycledUnmeasured: recycledUnmeasured ?? null,
         }),
       );
+    // The runs whose process lives in the container between operator calls
+    // (item 44): what the deploy preflight must see, added to both counts.
+    const registeredRuns = await this.registeredRunsBeyondOps();
     return {
       resource: map.get(RESOURCE_KEY) ?? null,
       state: map.get(STATE_KEY) ?? "down",
@@ -7138,9 +7275,9 @@ export class ResidentDO extends Sandbox<Env> {
         provisionRun: provisionRun.length,
         provisionDeadline: provisionDeadline.length,
       },
-      inFlight: this.inFlightCount(),
+      inFlight: this.inFlightCount() + registeredRuns,
       // The runs alone (no refresh cycle): what the deploy preflight refuses on.
-      runsInFlight: this.runsInFlightCount(),
+      runsInFlight: this.runsInFlightCount() + registeredRuns,
       // Item 22: who holds what, as the rows say — the mirror mutex and the
       // cycle/hydration leases, each judged against this incarnation.
       incarnation: this.incarnation,
@@ -7172,6 +7309,12 @@ export class ResidentDO extends Sandbox<Env> {
       // Item 36: the auto-rebuilds this resident has had (ISO instants; the
       // budget's window is judged over them). Empty after a person's rebuild.
       autoRebuilds: (map.get(AUTO_REBUILDS_KEY) as string[] | undefined) ?? [],
+      // Item 67: consecutive cycles failed in the resident's own steps, with
+      // the rung that count is on; null while cycles complete.
+      infraStreak: (() => {
+        const row = map.get(INFRA_STREAK_KEY) as InfraStreakRow | undefined;
+        return row ? { ...row, rung: infraStreakRung(row.count) } : null;
+      })(),
     };
   }
 
@@ -7254,6 +7397,33 @@ export class ResidentDO extends Sandbox<Env> {
     return { recreated: true, restoreStartedAt };
   }
 
+  /** Fault injection for item 67: write the resident-step streak row at `count`
+   *  (0 deletes it), so the next real failure lands on the rung under test.
+   *  Test-only semantics; admin scope. */
+  async debugSetInfraStreak(count: number): Promise<{ infraStreak: (InfraStreakRow & { rung: string }) | null }> {
+    if (count === 0) {
+      await this.ctx.storage.delete(INFRA_STREAK_KEY);
+      return { infraStreak: null };
+    }
+    const now = new Date(systemClock()).toISOString();
+    const row: InfraStreakRow = { step: "injected", count, firstAt: now, lastAt: now };
+    await this.ctx.storage.put(INFRA_STREAK_KEY, row);
+    return { infraStreak: { ...row, rung: infraStreakRung(count) } };
+  }
+
+  /** Fault injection for item 67: corrupt the mirror on disk (its objects
+   *  removed), so the next cycle's `fetch` fails in a resident step. The
+   *  snapshots in R2 are untouched — the ladder's recreate restores them.
+   *  Test-only semantics; admin scope. */
+  async debugBreakMirror(): Promise<{ broken: boolean; error?: string }> {
+    try {
+      await this.runOk(["rm", "-rf", `${MIRROR_DIR}/objects`], "break-mirror");
+      return { broken: true };
+    } catch (err) {
+      return { broken: false, error: errMsg(err) };
+    }
+  }
+
   /** Fault injection for item 36 without corrupting real R2 objects. Bare: persist
    *  `down` with a rehydration-flavored reason and nothing else, so the next
    *  watchdog pass is the backstop under test. `transition`: go through
@@ -8643,6 +8813,19 @@ async function handleDebug(env: Env, body: Record<string, unknown>): Promise<Res
     }
     case "force-onboarding":
       return json(await stub.debugForceOnboarding());
+    case "infra-streak": {
+      // Fault injection for item 67: set the resident-step streak's count, so
+      // one real failure lands on the rung under test (recreate at 3, down at 5).
+      const count =
+        typeof body.count === "number" && Number.isInteger(body.count) && body.count >= 0 ? body.count : null;
+      if (count === null) return json({ error: "count must be a non-negative integer" }, 400);
+      return json(await stub.debugSetInfraStreak(count));
+    }
+    case "break-mirror":
+      // Fault injection for item 67: remove the mirror's objects, so the next
+      // cycle's fetch fails in a resident step — a corrupt disk, which the
+      // ladder's recreate restores from the snapshot. Test residents only.
+      return json(await stub.debugBreakMirror());
     case "force-down": {
       // Fault injection for item 36; a rehydration-flavored default reason
       // makes it eligible. `transition: true` fires the down through goDown