@coreplane/switchboard 1.242.0 → 1.243.0

package/dist/assets/config/config.example.yaml

@@ -11,7 +11,11 @@ providers:
   anthropic:
     type: anthropic
     apiKeyEnv: ANTHROPIC_API_KEY
-  # Any OpenAI-compatible endpoint works with the same adapter:
+  # OpenAI itself runs on the same compatible adapter: any preset's model may
+  # be openai/<model-id> anywhere a model is accepted. The adapter speaks Chat
+  # Completions, not the Responses API, sends no reasoning control (our effort
+  # tiers do not reach these models), and meters tokens without pricing them.
+  # A first-class OpenAI block is a plan's business, not this file's.
   openai:
     type: openai-compatible
     baseUrl: https://api.openai.com/v1
@@ -65,10 +69,19 @@ defaults:
   # clipped (the card and the run record say so); a preset whose identity or
   # class is above a cap is refused by name before any executor exists. Absent →
   # nothing is capped and every preset runs exactly its declared profile.
+  # A fourth field, `confirm`, is the front door's and caps no run: the first
+  # blast-radius class a command the router bound from prose is handed back at
+  # (`To run this: …`) instead of run — `write` (every write is handed back; a
+  # read or a repository's own test or build runs) or `destructive` (a write
+  # runs at once; only a destructive one is handed back). It intersects toward
+  # caution like the run axes — a channel or a user can only ask MORE than what
+  # is set here — and unset everywhere it is the built-in `write`. `exec` and
+  # `never` are refused by name.
   # boundary:
   #   maxMinutes: 120
   #   maxIdentity: write
   #   machines: [none, blank, repo-cold, repo-resident]
+  #   confirm: write
 
 # PR reviews and the reading diff (docs/reference/specs/reading-diff.md). Every
 # review records its full `git diff`; the ABRIDGED version (meat.dev, run on
@@ -436,6 +449,12 @@ workspaceDir: ./workspaces
 #       r2Buckets:                                # optional: bucket name → label for buckets not named <worker>-cache
 #         some-other-bucket: uploads
 #       anthropicWorkspaceId: wrkspc_...          # this app's Anthropic workspace
+#   prices:                                    # optional: USD per million tokens by <provider>/<model>, the ref a run's
+#     openai/gpt-5:                            #   spans name — for a model the Anthropic list does not know, or to
+#       input: 1.25                            #   override the list; all four kinds named (a provider with no
+#       output: 10                             #   cache-write charge says 0). A model neither knows is "unpriced",
+#       cacheRead: 0.125                       #   never $0, on the costs page and on a run's own page
+#       cacheWrite: 0
 
 # Delivery indicators: GET /delivery and `delivery report` (docs/reference/specs/delivery.md).
 # Optional. Needs a GitHub credential (the App triple or GH_TOKEN); read-only on GitHub.

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -25,6 +25,7 @@ import {
   isRunSession,
   isRunVisibilityFilter,
   normalizeStored,
+  pullRequestNumberOf,
   RETENTION_BOUNDS,
   RUN_EVENTS_DEFAULT_PAGE,
   RUN_EVENTS_MAX_PAGE,
@@ -59,11 +60,11 @@ import {
 } from "../../src/core/runLedger/sessionLog.ts";
 import type { RunEvent } from "../../src/core/runEvents.ts";
 import {
-  aggregateUsageByUser,
   isRunUsage,
   usageOfEvents,
   type RunUsage,
-  type RunUsageReport,
+  type RunUsageRows,
+  type UsageIdentity,
   type UsageRun,
 } from "../../src/core/runUsage.ts";
 import {
@@ -1265,13 +1266,15 @@ export class RunHistoryDO extends DurableObject<Env> {
     this.migrateRunsTable();
     // The indexes the visibility predicate's leaves walk (`channel_id IN`,
     // `channel_visibility IN`, `user_id =`), each ordered like the page; the
-    // session the sweep asks about; the parent a children listing filters on.
+    // session the sweep asks about; the parent a children listing filters on;
+    // the pull request a findings listing filters on.
     this.sql.exec(`
       CREATE INDEX IF NOT EXISTS runs_channel_finished ON runs(channel_id, finished_at DESC, run_id DESC);
       CREATE INDEX IF NOT EXISTS runs_visibility_finished ON runs(channel_visibility, finished_at DESC, run_id DESC);
       CREATE INDEX IF NOT EXISTS runs_user_finished ON runs(user_id, finished_at DESC, run_id DESC);
       CREATE INDEX IF NOT EXISTS runs_session ON runs(session_key);
       CREATE INDEX IF NOT EXISTS runs_parent ON runs(parent_run_id, finished_at DESC, run_id DESC);
+      CREATE INDEX IF NOT EXISTS runs_pr ON runs(repo, pr_number, finished_at DESC, run_id DESC);
     `);
     // The sessions registry (session-log item 7): every session log a run of
     // this store claimed, with its thread — the sweep cannot enumerate the
@@ -1438,7 +1441,11 @@ export class RunHistoryDO extends DurableObject<Env> {
    *  aggregate fills it from the run's stored events. The parent a child names
    *  (run-history item 46), the column a children listing filters on: the
    *  record already carries it in `summary_json`, so existing rows are filled
-   *  from there once, and every later `put` writes it beside the row. */
+   *  from there once, and every later `put` writes it beside the row. The pull
+   *  request a run names (run-history item 58; `pullRequestNumberOf`), the
+   *  column a findings listing filters on: the same one-time fill from
+   *  `summary_json` — the coding post-step's `pr`, else a posted review's
+   *  target — and every later `put` writes it beside the row. */
   migrateRunsTable(): void {
     const columns = new Set(
       this.sql
@@ -1457,6 +1464,19 @@ export class RunHistoryDO extends DurableObject<Env> {
          WHERE json_type(summary_json, '$.parentRunId') = 'text'`,
       );
     }
+    if (!columns.has("pr_number")) {
+      this.sql.exec(`ALTER TABLE runs ADD COLUMN pr_number INTEGER`);
+      // `pullRequestNumberOf` in SQL: the coding post-step's pull request, else
+      // the one a posted review targeted (a skipped post has no target).
+      this.sql.exec(
+        `UPDATE runs SET pr_number = COALESCE(
+           CASE WHEN json_type(summary_json, '$.pr.number') = 'integer' THEN json_extract(summary_json, '$.pr.number') END,
+           CASE WHEN json_extract(summary_json, '$.reviewPost.posted') = 1
+                 AND json_type(summary_json, '$.reviewPost.target.number') = 'integer'
+                THEN json_extract(summary_json, '$.reviewPost.target.number') END
+         )`,
+      );
+    }
   }
 
   private liveByThread(threadKey: string): LiveRunRow | undefined {
@@ -1970,8 +1990,8 @@ export class RunHistoryDO extends DurableObject<Env> {
         );
       this.sql.exec(
         `INSERT INTO runs (run_id, label, agent, model, channel_id, user_id, thread_key, channel_visibility, repo, started_at, finished_at, stored_at, status,
-                           event_count, stored_event_count, truncated, bytes, diagnosis_json, summary_json, session_key, usage_json, parent_run_id)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                           event_count, stored_event_count, truncated, bytes, diagnosis_json, summary_json, session_key, usage_json, parent_run_id, pr_number)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT(run_id) DO UPDATE SET
            label = excluded.label, agent = excluded.agent, model = excluded.model, channel_id = excluded.channel_id,
            user_id = excluded.user_id, thread_key = excluded.thread_key, channel_visibility = excluded.channel_visibility,
@@ -1981,7 +2001,8 @@ export class RunHistoryDO extends DurableObject<Env> {
            bytes = excluded.bytes, diagnosis_json = excluded.diagnosis_json, summary_json = excluded.summary_json,
            session_key = excluded.session_key,
            usage_json = COALESCE(excluded.usage_json, runs.usage_json),
-           parent_run_id = excluded.parent_run_id`,
+           parent_run_id = excluded.parent_run_id,
+           pr_number = excluded.pr_number`,
         stored.id,
         stored.label ?? null,
         stored.agent ?? null,
@@ -2004,6 +2025,7 @@ export class RunHistoryDO extends DurableObject<Env> {
         stored.session?.key ?? null,
         stored.usage ? JSON.stringify(stored.usage) : null,
         stored.parentRunId ?? null,
+        pullRequestNumberOf(stored) ?? null,
       );
       // The session's registry row learns its newest finish (session-log item
       // 7); a record that reaches the store without a claim (the plain put
@@ -2208,28 +2230,32 @@ export class RunHistoryDO extends DurableObject<Env> {
   }
 
   /**
-   * Who spent what, per UTC day (costs.md, cost by user), over the runs that
-   * finished in [sinceMs, untilMs) and are inside the retention window. A row
-   * written before `usage_json` existed is filled in here from its stored
-   * `model.turn` events — up to USAGE_BACKFILL_PER_CALL a call, the rest
-   * reported as `pending` — so the history heals as it is read, with no
+   * What the runs that finished in [sinceMs, untilMs) and are inside the
+   * retention window cost (costs.md items 10–10a; run-history item 56): one row
+   * per run — its requester, thread, channel, agent and usage — plus the
+   * identity of every parent a child names that is outside the batch, so the
+   * bot bills the child without a second read. The arithmetic is the bot's; the
+   * Worker only reads its rows. A row written before `usage_json` existed is
+   * filled in here from its stored `model.turn` events — up to
+   * USAGE_BACKFILL_PER_CALL a call, the rest answered without `usage` and
+   * counted in `pending` — so the history heals as it is read, with no
    * operator step; a run without turns is written back as the zero usage so it
-   * is not re-read. A child is billed to its parent's requester; a parent
-   * outside the range is looked up by id.
+   * is not re-read.
    */
-  usageByUser(sinceMs: number, untilMs: number): RunUsageReport {
+  usage(sinceMs: number, untilMs: number): RunUsageRows {
     const now = systemClock();
     const { policy } = this.policyState();
     const cutoff = now - policy.retentionDays * 86_400_000;
     const rows = this.sql
       .exec<UsageRow>(
-        `SELECT run_id, user_id, started_at, finished_at, usage_json, summary_json FROM runs
+        `SELECT run_id, user_id, agent, channel_id, thread_key, started_at, finished_at, usage_json, summary_json FROM runs
           WHERE finished_at >= ? AND finished_at < ? ORDER BY finished_at ASC, run_id ASC`,
         Math.max(sinceMs, cutoff),
         untilMs,
       )
       .toArray();
     let backfilled = 0;
+    let pending = 0;
     const runs: UsageRun[] = rows.map((row) => {
       let usage = parseUsageJson(row.usage_json);
       if (usage === undefined && backfilled < USAGE_BACKFILL_PER_CALL) {
@@ -2237,31 +2263,38 @@ export class RunHistoryDO extends DurableObject<Env> {
         this.sql.exec(`UPDATE runs SET usage_json = ? WHERE run_id = ?`, JSON.stringify(usage), row.run_id);
         backfilled += 1;
       }
+      if (usage === undefined) pending += 1;
       const who = identityOfSummary(row.summary_json);
       return {
         id: row.run_id,
         userId: row.user_id,
         ...(who.userName ? { userName: who.userName } : {}),
         ...(who.parentRunId ? { parentRunId: who.parentRunId } : {}),
+        threadKey: row.thread_key,
+        channelId: row.channel_id,
+        ...(row.agent ? { agent: row.agent } : {}),
         startedAt: row.started_at,
         finishedAt: row.finished_at,
         ...(usage ? { usage } : {}),
       };
     });
-    const lookupParent = (id: string) => {
+    // The parents a child names that are not in the batch: looked up once each, known or not.
+    const inBatch = new Set(runs.map((r) => r.id));
+    const parents: Record<string, UsageIdentity> = {};
+    for (const id of new Set(runs.map((r) => r.parentRunId).filter((p): p is string => !!p && !inBatch.has(p)))) {
       const p = this.sql
         .exec<{ user_id: string; summary_json: string }>(`SELECT user_id, summary_json FROM runs WHERE run_id = ?`, id)
         .toArray()[0];
-      if (!p) return undefined;
+      if (!p) continue;
       const who = identityOfSummary(p.summary_json);
-      return { userId: p.user_id, ...(who.userName ? { userName: who.userName } : {}) };
-    };
-    const { rows: out, pending } = aggregateUsageByUser(runs, lookupParent);
+      parents[id] = { userId: p.user_id, ...(who.userName ? { userName: who.userName } : {}) };
+    }
     const earliest = this.sql
       .exec<{ m: number | null }>(`SELECT MIN(finished_at) AS m FROM runs WHERE finished_at >= ?`, cutoff)
       .one().m;
     return {
-      rows: out,
+      runs,
+      parents,
       pending,
       ...(earliest !== null ? { earliestFinishedAt: earliest } : {}),
       retentionDays: policy.retentionDays,
@@ -2343,6 +2376,11 @@ export class RunHistoryDO extends DurableObject<Env> {
       where.push(`parent_run_id = ?`);
       params.push(q.parentRunId);
     }
+    if (q.pr !== undefined) {
+      // `namesPullRequest` in SQL: the row's repository and the number it names.
+      where.push(`repo = ?`, `pr_number = ?`);
+      params.push(q.pr.repo, q.pr.number);
+    }
     if (q.visibleTo !== undefined && q.visibleTo.kind !== "all") where.push(visibilitySql(q.visibleTo, params));
     const select = `SELECT run_id, agent, channel_id, finished_at, bytes, event_count, summary_json FROM runs WHERE ${where.join(" AND ")} ORDER BY finished_at DESC, run_id DESC`;
     // `LIMIT` holds on the over-bound path too: the kept set is the newest
@@ -2423,6 +2461,9 @@ const USAGE_BACKFILL_PER_CALL = 200;
 type UsageRow = {
   run_id: string;
   user_id: string;
+  agent: string | null;
+  channel_id: string;
+  thread_key: string;
   started_at: number;
   finished_at: number;
   usage_json: string | null;
@@ -2590,12 +2631,26 @@ function parseRunList(body: unknown): Validated<{ storeKey: string; query: RunLi
     if (!id.ok) return invalid("parentRunId must match ^[A-Za-z0-9_-]{1,64}$");
     query.parentRunId = id.value;
   }
+  if (b.pr !== undefined) {
+    const pr = b.pr as Record<string, unknown> | null;
+    if (
+      typeof pr !== "object" ||
+      pr === null ||
+      typeof pr.repo !== "string" ||
+      !REPO_SLUG.test(pr.repo) ||
+      typeof pr.number !== "number" ||
+      !Number.isInteger(pr.number) ||
+      pr.number < 1
+    )
+      return invalid("pr must be { repo: owner/name, number: a positive integer }");
+    query.pr = { repo: pr.repo, number: pr.number };
+  }
   if (b.visibleTo !== undefined) {
     // A malformed filter is a 400, never "all": the bot degrades to live rows
     // rather than the DO widening what an actor may see.
     if (!isRunVisibilityFilter(b.visibleTo)) return invalid("visibleTo must be a run visibility filter");
-    if (boundParameters(b.visibleTo) > DO_MAX_BOUND_PARAMETERS - RUN_LIST_BASE_PARAMETERS)
-      return invalid(`visibleTo names more than ${DO_MAX_BOUND_PARAMETERS - RUN_LIST_BASE_PARAMETERS} ids`);
+    const headroom = DO_MAX_BOUND_PARAMETERS - RUN_LIST_BASE_PARAMETERS - (query.pr ? RUN_LIST_PR_PARAMETERS : 0);
+    if (boundParameters(b.visibleTo) > headroom) return invalid(`visibleTo names more than ${headroom} ids`);
     query.visibleTo = b.visibleTo;
   }
   return { ok: true, value: { storeKey: key.value, query } };
@@ -2604,6 +2659,8 @@ function parseRunList(body: unknown): Validated<{ storeKey: string; query: RunLi
 /** Parameters the page query binds before any filter: the cursor pair (3) and the age floor (1),
  *  plus `agent`, `channel`, `threadKey`, `parentRunId`, and the LIMIT at most — the headroom `visibleTo` must fit under. */
 const RUN_LIST_BASE_PARAMETERS = 9;
+/** The two more a `pr` filter binds (`repo`, `pr_number`), taken from the same headroom only when asked. */
+const RUN_LIST_PR_PARAMETERS = 2;
 
 /** How many `?` a filter binds (one per id, one per user). */
 function boundParameters(f: RunVisibilityFilter): number {
@@ -3800,13 +3857,13 @@ async function handleRuns(pathname: string, body: unknown, env: Env): Promise<Re
     );
     return json(result ?? { events: null });
   }
-  if (pathname === "/runs/usage-by-user") {
+  if (pathname === "/runs/usage") {
     const parsed = parseRunUsageQuery(body);
     if (!parsed.ok) return json({ error: parsed.error }, 400);
     const { storeKey, sinceMs, untilMs } = parsed.value;
-    const report = await stub(storeKey).usageByUser(sinceMs, untilMs);
-    console.log(`[runs/usage-by-user] ${storeKey} -> ${report.rows.length} rows, ${report.pending} pending`);
-    return json(report);
+    const rows = await stub(storeKey).usage(sinceMs, untilMs);
+    console.log(`[runs/usage] ${storeKey} -> ${rows.runs.length} runs, ${rows.pending} pending`);
+    return json(rows);
   }
   // /runs/delete
   const parsed = parseRunTarget(body);
@@ -3831,7 +3888,7 @@ const ROUTES = new Set([
   "/runs/summary",
   "/runs/list",
   "/runs/events",
-  "/runs/usage-by-user",
+  "/runs/usage",
   "/runs/delete",
   ...LEDGER_ROUTES,
 ]);

package/dist/assets/deploy/cloudflare-resident/worker.ts

@@ -179,6 +179,7 @@ import {
   isRuntimeUnreachableSignal,
   killStaleBuildProcessesCommand,
   planRefresh,
+  RUNTIME_MOVED_WORDING,
   RUNTIME_REPLACEMENT_WORDING,
   RUNTIME_UNREACHABLE_DOWN_AT,
   runtimeUnreachableReason,
@@ -766,9 +767,34 @@ function isRuntimeReplacement(err: unknown): boolean {
   return false;
 }
 
+/** Whether the SDK's failure vouches that the runtime under the command MOVED
+ *  — a new incarnation serves the thread, so the container the command was
+ *  aimed at is gone whatever else the resident knows: the typed classes for
+ *  a stale process handle and an inactive runtime identity, an interruption
+ *  whose reason is a replaced runtime, the platform's superseded-isolate
+ *  reset, and the SDK's wordings for the same (`RUNTIME_MOVED_WORDING`, on the
+ *  error and its cause chain). NOT the words for a container that is merely
+ *  down (`STOPPED_CONTAINER_WORDING`: "The container is not running", "Process
+ *  supervisor is closed") and NOT a transport lost under the call
+ *  (`RPCTransportError`): an asleep or starting container and a network blip
+ *  answer those too, so on `/exec` they are the word only when the resident
+ *  itself knows the container it held is gone (`replacedExecAnswer`). The
+ *  resident's own steps keep the union (`isRuntimeReplacement`): a step
+ *  interrupted either way is retried onto the container that comes back. */
+function sdkVouchesRuntimeMoved(err: unknown): boolean {
+  if (err instanceof StaleProcessHandleError) return true;
+  if (err instanceof RuntimeIdentityInactiveError) return true;
+  if (err instanceof OperationInterruptedError && RUNTIME_REPLACED_REASONS.has(err.reason)) return true;
+  if (isDurableObjectCodeUpdateReset(err)) return true;
+  for (const link of selfAndCauses(err)) if (RUNTIME_MOVED_WORDING.test(errMsg(link))) return true;
+  return false;
+}
+
 /** The named ThreadErr every thread route (exec/read/write) answers for a
  *  runtime replacement, so the client can classify it (409 like the other
- *  recoverable thread states; `reason` is the discriminator). */
+ *  recoverable thread states; `reason` is the discriminator). On `/exec` the
+ *  answer goes through `replacedExecAnswer` first: the word only when the SDK
+ *  vouched the runtime moved or the resident knows the container is gone. */
 function runtimeReplacedErr(err: RuntimeReplacedError): ThreadErr {
   return { error: err.message, status: 409, reason: "runtime-replaced" };
 }
@@ -1592,6 +1618,52 @@ export class ResidentDO extends Sandbox<Env> {
    *  survives, so hydration state is always probed from disk. */
   private hydration: Promise<void> | null = null;
 
+  /** The container stop the platform delivered to `onStop` and no command has
+   *  answered since: the resident's own knowledge that the container it held
+   *  is gone (docs/reference/specs/resident-repos.md item 43). In memory on
+   *  purpose — a Durable Object that restarts learns the same fact from the
+   *  restore its next command's wake path starts (`restoring`), and a stop
+   *  recorded in storage would outlive the container that answers now. */
+  private containerStop: { at: number; exitCode: number; reason: string } | undefined;
+
+  /** The platform's signal that the container stopped — the rollout's
+   *  `runtime_signal`, or an exit of its own — recorded before the SDK's
+   *  reconciliation runs, so an `/exec` that meets the stopped container from
+   *  here on answers `runtime-replaced` (`replacedExecAnswer`) rather than the
+   *  binding's bare "The container is not running". The Sandbox base declares
+   *  the hook without parameters; the Container base beneath it passes them. */
+  async onStop(params?: { exitCode: number; reason: string }): Promise<void> {
+    this.containerStop = { at: systemClock(), exitCode: params?.exitCode ?? 0, reason: params?.reason ?? "unknown" };
+    console.log(
+      `container: stopped (exit ${this.containerStop.exitCode}, ${this.containerStop.reason}) — the container this resident held is gone; /exec answers runtime-replaced until a command answers again`,
+    );
+    await super.onStop();
+  }
+
+  /** Whether this resident knows the container it held is gone: it saw the
+   *  container stop and no command has answered since, or a restore is under
+   *  way (`restoring`, persisted before any restore work). Never the
+   *  platform's `running` flag — an asleep or starting container answers
+   *  false to it too, and an `/exec` that meets one must say what the SDK
+   *  said so the harness probes rather than relaunch into a container that
+   *  was never replaced. */
+  private async knowsContainerGone(): Promise<boolean> {
+    if (this.containerStop !== undefined) return true;
+    return (await this.getStatus()).state === "restoring";
+  }
+
+  /** The `/exec` answer for a command the SDK failed with a runtime
+   *  replacement (item 43; harness.md item 6): the word — `reason:
+   *  "runtime-replaced"`, the resident's sentence — when the SDK vouched the
+   *  runtime moved or the resident knows the container it held is gone;
+   *  otherwise what the SDK said, with no word and no `reason`, so the
+   *  harness's one more command decides. The command is never re-issued
+   *  either way: it may have started. */
+  private async replacedExecAnswer(err: RuntimeReplacedError): Promise<ThreadErr> {
+    if (sdkVouchesRuntimeMoved(err.cause) || (await this.knowsContainerGone())) return runtimeReplacedErr(err);
+    return { error: errMsg(err.cause), status: 409 };
+  }
+
   /** The step trace of the request in flight (docs/reference/specs/tracing.md item 19):
    *  `attachThread` and `runOp` each run inside their own collector, so the
    *  commands `runOk` runs and the mirror-lock waits land on the answer that
@@ -1978,7 +2050,9 @@ export class ResidentDO extends Sandbox<Env> {
       proc = await createExtensionProcessSandbox(this).exec(argv as unknown as SandboxCommand, launch);
     }
     // The spawn is the proof the control port answers: a persisted count of
-    // unanswered connects ends here, whatever the command goes on to do.
+    // unanswered connects ends here, whatever the command goes on to do — and
+    // a container stop seen before it is history (`knowsContainerGone`).
+    this.containerStop = undefined;
     await this.clearRuntimeUnreachable();
     try {
       const out = await proc.output({ encoding: "utf8", timeout: timeout + 30_000 });
@@ -6233,11 +6307,30 @@ export class ResidentDO extends Sandbox<Env> {
     return res;
   }
 
+  /** The exec route's one gate for a runtime replacement (item 43): every
+   *  `RuntimeReplacedError` the route meets — the preflight's own probe of the
+   *  worktree, the command itself — is judged by `replacedExecAnswer`, so the
+   *  word reaches the harness only when the SDK vouched the runtime moved or
+   *  the resident knows the container it held is gone. */
   private async execThreadImpl(
     threadKey: string,
     command: string,
     timeoutMs: number,
     env?: Record<string, string>,
+  ): Promise<{ stdout: string; stderr: string; exitCode: number; truncated: boolean } | ThreadErr> {
+    try {
+      return await this.execThreadBody(threadKey, command, timeoutMs, env);
+    } catch (err) {
+      if (err instanceof RuntimeReplacedError) return this.replacedExecAnswer(err);
+      throw err;
+    }
+  }
+
+  private async execThreadBody(
+    threadKey: string,
+    command: string,
+    timeoutMs: number,
+    env?: Record<string, string>,
   ): Promise<{ stdout: string; stderr: string; exitCode: number; truncated: boolean } | ThreadErr> {
     const pre = await this.threadPreflight(threadKey);
     if ("error" in pre) return pre;
@@ -6253,13 +6346,8 @@ export class ResidentDO extends Sandbox<Env> {
         : {}),
     } satisfies ThreadBinding);
 
-    let r: Awaited<ReturnType<ResidentDO["threadRun"]>>;
-    try {
-      r = await this.threadRunCapped(binding.user, binding.worktreePath, command, timeoutMs, EXEC_OUTPUT_CAP, env);
-    } catch (err) {
-      if (err instanceof RuntimeReplacedError) return runtimeReplacedErr(err);
-      throw err;
-    }
+    // A runtime replacement under the command propagates to `execThreadImpl`'s gate.
+    const r = await this.threadRunCapped(binding.user, binding.worktreePath, command, timeoutMs, EXEC_OUTPUT_CAP, env);
     const truncated = r.stdout.length > EXEC_OUTPUT_CAP || r.stderr.length > EXEC_OUTPUT_CAP || r.truncated === true;
     const notes: string[] = [];
     if (r.timedOut)
@@ -7411,13 +7499,17 @@ export class ResidentDO extends Sandbox<Env> {
     return { infraStreak: { ...row, rung: infraStreakRung(count) } };
   }
 
-  /** Fault injection for item 67: corrupt the mirror on disk (its objects
-   *  removed), so the next cycle's `fetch` fails in a resident step. The
-   *  snapshots in R2 are untouched — the ladder's recreate restores them.
+  /** Fault injection for item 67: corrupt the mirror on disk so the next
+   *  cycle's `fetch` fails in a resident step. The mirror's `config` goes (its
+   *  `origin` remote with it: `'origin' does not appear to be a git
+   *  repository`, exit 128) — NOT its objects: the wake check (`readyStamp`)
+   *  tests `objects/`, and a missing directory is a disk to restore, which the
+   *  wake did before any step could fail the first time this was tried live.
+   *  The snapshots in R2 are untouched — the ladder's recreate restores them.
    *  Test-only semantics; admin scope. */
   async debugBreakMirror(): Promise<{ broken: boolean; error?: string }> {
     try {
-      await this.runOk(["rm", "-rf", `${MIRROR_DIR}/objects`], "break-mirror");
+      await this.runOk(["rm", "-f", `${MIRROR_DIR}/config`], "break-mirror");
       return { broken: true };
     } catch (err) {
       return { broken: false, error: errMsg(err) };

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.242.0",
+  "version": "1.243.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.242.0",
+      "version": "1.243.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.242.0",
+      "version": "1.243.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.242.0",
+  "version": "1.243.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/project.json

@@ -168,11 +168,11 @@
       "when": "Part of `check:consistency`."
     },
     "clock:gen": {
-      "does": "Regenerates the clock-read allowlist (`src/core/trace/clockAllowlist.json`) from the tree — empty since the ratchet reached zero; a result that is not `{}` names a new direct read.",
+      "does": "Regenerates both clock allowlists from the tree: wall-clock reads (empty) and duration literals outside `src/core/budgets.ts`.",
       "when": "Part of `fix`."
     },
     "clock:check": {
-      "does": "No production file reads the wall clock directly: the allowlist is empty and the tree agrees.",
+      "does": "No production file reads the wall clock directly or gained a duration literal outside `src/core/budgets.ts`; both allowlists match the tree.",
       "when": "Part of `check:consistency`."
     },
     "docs:changed": {
@@ -212,7 +212,7 @@
       "when": "Part of `check:consistency`."
     },
     "load": {
-      "does": "Load harness: `-- history|resident|sandbox|e2e|cards|provider|pi|route`.",
+      "does": "Load harness: `-- history|resident|sandbox|e2e|cards|provider|pi|route|door`.",
       "when": "Capacity receipts (docs/reference/specs/load-harness.md)."
     }
   }

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.242.0",
-  "commit": "c0dc26a1590c854d944c451829e9b21f6ce7d721",
-  "builtAt": "2026-09-17T05:42:17.412Z"
+  "version": "1.243.0",
+  "commit": "abfb780fe3a276f303d13d597ad7c549ba8f49c0",
+  "builtAt": "2026-09-17T07:58:14.271Z"
 }