@coreplane/switchboard 1.242.0 → 1.244.0

package/dist/assets/src/core/budgets.ts

@@ -0,0 +1,349 @@
+// Every wall clock in Switchboard as one table (docs/decisions/0046; docs/reference/specs/harness-pi.md
+// item 15; docs/reference/specs/agent-ship.md item 8). A budget is a LEASE a
+// parent carves from its own remainder, never a constant a file holds on its
+// own: a preset ASKS for a lease and does useful work above a FLOOR; a parent
+// that runs a loop holds back a RESERVE, derived from the floors and the
+// provisioning of every round that must still follow, plus the merge wait's
+// floor; and the lease covers everything the run does, the loop, the write-up
+// and the post-step, each an ALLOWANCE named here. The registry reads its
+// `maxMinutes` and `maxTurns` from this module and `budgets.check.test.ts`
+// asserts the fits, so a number that breaks another's assumption is a red
+// build. `carve` is called by the ship coordinator for every round (agent-ship
+// item 8), `fit` by the config validator at load and by the fork over a clipped
+// request, and `carveChildOfParent` by the conductor's spawn.
+//
+// Deliberately free of node: imports and of the agent registry, so the
+// Workflow-driven coordinator and the deploy Workers can bundle it — the
+// dependency runs registry → budgets, never the reverse.
+
+export const MINUTE_MS = 60_000;
+
+/** One calendar day in milliseconds: the unit the daily cost and delivery ranges
+ *  step by (`dayOf`, the day count of a range). A day is not a lease, but it is
+ *  a duration, and every duration is read from this table rather than written
+ *  as a literal where it is used. */
+export const DAY_MS = 24 * 60 * MINUTE_MS;
+
+/** How long the confirmation a routed write is offered as stays pending
+ *  (docs/decisions/0044; docs/reference/specs/routing-and-config.md item 25):
+ *  the connect ticket's ten minutes. The bot passes it to the config object,
+ *  which stamps the expiry on its own clock. */
+export const CONFIRMATION_TTL_MS = 10 * MINUTE_MS;
+
+/** The presets that run the tool loop, and the one pipeline preset. */
+export const LOOP_PRESETS = ["general", "coding", "review", "research", "explore", "conductor"] as const;
+export type LoopPreset = (typeof LOOP_PRESETS)[number];
+export type Preset = LoopPreset | "ship";
+
+/** What each preset asks for when nothing above it is tighter, in minutes. The
+ *  pipeline's (`ship`) is the wall clock one segment of its loop runs under;
+ *  a deployment's `ship.maxMinutes` replaces it, held to `fit` below. */
+export const ASKS: Readonly<Record<Preset, number>> = {
+  general: 5,
+  coding: 45,
+  review: 25,
+  ship: 120,
+  research: 8,
+  explore: 120,
+  conductor: 120,
+};
+
+/** The rounds a ship loop is made of. `fix` is a coding child handed the
+ *  review's findings; `merge` is the runner's wait on the guards. */
+export type RoundKind = "coding" | "review" | "fix" | "merge";
+
+/** The least lease in which a round does useful work, in minutes. A carve that
+ *  falls under the floor is refused rather than dispatched: a two-minute
+ *  review or fix costs an attach and a model turn and finishes nothing.
+ *  Review's is the ledger's 90th percentile of completed reviews (5.1 min over
+ *  181); coding's and the merge wait's are guesses until the ledger says. */
+export const PRESET_FLOORS: Readonly<Record<LoopPreset, number>> = {
+  general: 2,
+  coding: 10,
+  review: 5,
+  research: 3,
+  explore: 15,
+  conductor: 15,
+};
+export const FLOORS: Readonly<Record<RoundKind, number>> = {
+  coding: PRESET_FLOORS.coding,
+  fix: PRESET_FLOORS.coding,
+  review: PRESET_FLOORS.review,
+  merge: 10,
+};
+
+/** The merge wait's own ask: how long the runner waits on the guards at most
+ *  when the remainder allows it. */
+export const MERGE_WAIT_ASK_MINUTES = 60;
+
+/** The ship runner's waits, in minutes: the margin a child's wait allows past
+ *  its budget, the slice a wait is asked in, the merge door's re-ask cadence,
+ *  and the pause before a busy spawn is asked again. */
+export const SHIP_WAIT = { marginMinutes: 5, chunkMinutes: 5, mergeChunkMinutes: 5, busyRetryMinutes: 2 } as const;
+
+/** The named amounts a lease holds back, in minutes. Each stands for a step
+ *  every run or round pays: `provision` is attach and restore before the
+ *  harness's clock starts; `writeUp` is the final answer after the loop ends;
+ *  `commandWriteUp` is what the last command leaves for that answer; `execCall`
+ *  is the exec client's wait past a command's own budget; `bearerGrace` is how
+ *  far past the lease the model bearer stays valid for the last call's tail. */
+export const ALLOWANCES = {
+  provision: 3,
+  writeUp: 3,
+  commandWriteUp: 1,
+  execCall: 0.5,
+  bearerGrace: 1,
+} as const;
+
+/** The post-step turn a preset runs after its loop, in minutes: the coding
+ *  run's description turn, the review's verdict turn, none for the rest. */
+export const POST_STEP_MINUTES: Readonly<Record<Preset, number>> = {
+  coding: 5,
+  review: 3,
+  general: 0,
+  research: 0,
+  explore: 0,
+  conductor: 0,
+  ship: 0,
+};
+
+/** The post-step allowance of a preset named by its def's `name`: a name
+ *  outside the table (a test's, a command run's) runs no post-step. */
+export function postStepMinutes(preset: string): number {
+  return (POST_STEP_MINUTES as Readonly<Record<string, number>>)[preset] ?? 0;
+}
+
+/** The post-step turn's lease, in minutes (fractional when the remainder is:
+ *  the harness turns it back into ms): the preset's allowance, or the lease's
+ *  remainder when that is less — never under a minute, so a turn the loop's
+ *  write-up crowded still gets its one chance. The bearer's grace covers that
+ *  floor for a turn that starts at or before the lease's end; a turn that
+ *  starts later runs on a bearer that may expire under it, and its refused
+ *  call fails soft — the run's answer already stands. Without a remainder
+ *  (no harness session says) the allowance stands. */
+export function postStepLease(preset: string, remainingMs: number | undefined): number {
+  const allowance = postStepMinutes(preset);
+  if (remainingMs === undefined) return allowance;
+  return Math.min(allowance, Math.max(1, remainingMs / MINUTE_MS));
+}
+
+/** A follow-up turn's lease, in ms: the lesser of what it asks and what the
+ *  run's lease still holds, never under a minute — the grace covers that floor
+ *  when the turn starts by the lease's end; later, the bearer may expire under
+ *  the turn and its call is refused, failing soft. */
+export function turnLeaseMs(askMinutes: number, remainingMs: number): number {
+  return Math.min(askMinutes * MINUTE_MS, Math.max(MINUTE_MS, remainingMs));
+}
+
+/** The wrap-up warning's place before the loop's end: three minutes, or a
+ *  quarter of the loop when the loop is shorter than twelve. */
+export const WRAP_UP_WARNING = { minutes: 3, fraction: 0.25 } as const;
+
+/** The clocks a harness keeps for one lease (docs/reference/specs/harness-pi.md
+ *  items 6 and 15). The lease ENDS at `deadline`; the LOOP ENDS at `loopEnd`,
+ *  the write-up allowance and the preset's post-step earlier, so both run
+ *  inside the lease; the WARNING is steered at `warnAt`; the write-up is
+ *  BOUNDED by `finaleMs`. A follow-up turn on the session (`kind: "turn"`)
+ *  holds nothing back — its deliverable is a tool call, not a write-up — and
+ *  its loop ends at its deadline. A lease shorter than its hold-back has no
+ *  loop time: the loop ends at its start, never before it. */
+export interface LoopClock {
+  startedAt: number;
+  deadline: number;
+  loopEnd: number;
+  warnAt: number;
+  finaleMs: number;
+}
+
+export function loopClock(
+  startedAt: number,
+  remainingMs: number,
+  preset: string,
+  kind: "loop" | "turn" = "loop",
+): LoopClock {
+  const deadline = startedAt + remainingMs;
+  const holdBackMs = kind === "loop" ? (ALLOWANCES.writeUp + postStepMinutes(preset)) * MINUTE_MS : 0;
+  const loopEnd = Math.max(startedAt, deadline - holdBackMs);
+  const warnAt =
+    loopEnd - Math.min(WRAP_UP_WARNING.minutes * MINUTE_MS, (loopEnd - startedAt) * WRAP_UP_WARNING.fraction);
+  return { startedAt, deadline, loopEnd, warnAt, finaleMs: ALLOWANCES.writeUp * MINUTE_MS };
+}
+
+/** When a run's model-proxy bearer expires: the lease's end plus the grace
+ *  (docs/reference/specs/model-proxy.md item 2). */
+export function bearerExpiresAt(leaseEndsAt: number): number {
+  return leaseEndsAt + ALLOWANCES.bearerGrace * MINUTE_MS;
+}
+
+/** The bearer's expiry as the mint at provisioning sets it, before the lease
+ *  has started: the provisioning allowance, the lease and the grace — replaced
+ *  by `bearerExpiresAt` the moment the harness starts the lease. */
+export function provisionalBearerExpiresAt(now: number, leaseMinutes: number): number {
+  return now + (ALLOWANCES.provision + leaseMinutes + ALLOWANCES.bearerGrace) * MINUTE_MS;
+}
+
+/** The per-command bash budget's rows: the default when a call names none, the
+ *  ceiling a call may raise it to, and the floor under which a number is a
+ *  typo (docs/reference/specs/execution.md item 11). */
+export const BASH_COMMAND = { defaultMinutes: 5, maxMinutes: 20, minMs: 1_000 } as const;
+
+/** The pace that marks a run as looping rather than working: a model turn
+ *  every ten seconds, sustained for the whole wall clock. A busy run takes
+ *  20–40 s a turn (a model think plus a tool call), so a run that averages six
+ *  a minute from start to end is re-issuing calls, not making progress — and
+ *  its turn cap ends it before the wall clock would, with a write-up that
+ *  says so (docs/reference/specs/harness-pi.md item 15). */
+export const RUNAWAY_TURNS_PER_MINUTE = 6;
+
+/** The turn cap a wall clock implies: `maxMinutes × RUNAWAY_TURNS_PER_MINUTE`.
+ *  Every preset that runs the loop derives its `maxTurns` from this, so the
+ *  cap is never a number a good run reaches — the minutes are the budget. */
+export function runawayTurnCap(maxMinutes: number): number {
+  return maxMinutes * RUNAWAY_TURNS_PER_MINUTE;
+}
+
+/** A pipeline's loop as the config allows it: `maxRounds` counts review rounds. */
+export interface Loop {
+  maxRounds: number;
+}
+
+/** A round's position in its loop: its kind and its index, so the reserve is
+ *  the rounds after that index, never a table keyed by kind alone. */
+export interface RoundPosition {
+  kind: RoundKind;
+  index: number;
+}
+
+/** The rounds of a loop in order: the coding round, then a review and, after
+ *  every review but the last, a fix, then the merge wait. */
+export function loopRounds(loop: Loop): RoundKind[] {
+  const rounds: RoundKind[] = ["coding"];
+  for (let i = 0; i < loop.maxRounds; i++) {
+    rounds.push("review");
+    if (i < loop.maxRounds - 1) rounds.push("fix");
+  }
+  rounds.push("merge");
+  return rounds;
+}
+
+/** Where a round sits in `loopRounds`: the coding round first; review round
+ *  `n` (counted from 1) and the fix that follows it at `2n − 1` and `2n`; the
+ *  merge wait last. The ship coordinator numbers its rounds this way, so the
+ *  reserve it carves with is the one the fit assumed. */
+export function loopPosition(loop: Loop, kind: RoundKind, n = 0): number {
+  switch (kind) {
+    case "coding":
+      return 0;
+    case "review":
+      return 2 * n - 1;
+    case "fix":
+      return 2 * n;
+    case "merge":
+      return 2 * loop.maxRounds;
+  }
+}
+
+/** A child spawned outside any loop (a conductor's): the parent's whole
+ *  remainder in whole minutes, refused under the child preset's floor — a
+ *  child under its floor costs a thread and a model turn and finishes nothing. */
+export function carveChildOfParent(
+  remainingMs: number,
+  preset: LoopPreset,
+): { kind: "carved"; minutes: number } | { kind: "refused"; reason: "under floor"; minutes: number; floor: number } {
+  const minutes = Math.max(0, Math.floor(remainingMs / MINUTE_MS));
+  const floor = PRESET_FLOORS[preset];
+  if (minutes < floor) return { kind: "refused", reason: "under floor", minutes, floor };
+  return { kind: "carved", minutes };
+}
+
+/** The minutes a round holds back for what must follow it in the loop: the
+ *  floor plus provisioning of every later review and fix, and the merge
+ *  wait's floor. A merge holds nothing back; a round with no loop (a
+ *  conductor's child) holds nothing back either. */
+export function reserveMinutes(
+  round: RoundPosition,
+  loop: Loop | undefined,
+  floors: Readonly<Record<RoundKind, number>> = FLOORS,
+): number {
+  if (!loop) return 0;
+  let reserve = 0;
+  for (const kind of loopRounds(loop).slice(round.index + 1)) {
+    reserve += kind === "merge" ? floors.merge : floors[kind] + ALLOWANCES.provision;
+  }
+  return reserve;
+}
+
+/** What a round asks for: the preset's ask for a coding or fix round, the
+ *  review's for a review, the merge wait's own for the merge. */
+export function roundAskMinutes(kind: RoundKind): number {
+  switch (kind) {
+    case "coding":
+    case "fix":
+      return ASKS.coding;
+    case "review":
+      return ASKS.review;
+    case "merge":
+      return MERGE_WAIT_ASK_MINUTES;
+  }
+}
+
+/** A carve's result: the minutes with what bounded them (`ask` when the round
+ *  got its whole ask, `parent` when the remainder minus the reserve was
+ *  tighter) and what the parent holds back, or a refusal when the minutes the
+ *  remainder leaves fall under the round's floor. */
+export type Carve =
+  | { kind: "carved"; minutes: number; boundedBy: "ask" | "parent"; holds: number }
+  | { kind: "refused"; reason: "under floor"; minutes: number; floor: number; holds: number };
+
+/** The only place a round's minutes are computed: the parent's remainder in
+ *  whole minutes minus the round's reserve, capped at the round's ask, refused
+ *  under the round's floor. `loop` is undefined for a child outside any loop. */
+export function carve(remainingMs: number, round: RoundPosition, loop: Loop | undefined): Carve {
+  const holds = reserveMinutes(round, loop);
+  const ask = roundAskMinutes(round.kind);
+  const headroom = Math.floor(remainingMs / MINUTE_MS) - holds;
+  const minutes = Math.min(ask, headroom);
+  const floor = FLOORS[round.kind];
+  // A refusal reports what the remainder left, never a negative number.
+  if (minutes < floor) return { kind: "refused", reason: "under floor", minutes: Math.max(0, minutes), floor, holds };
+  return { kind: "carved", minutes, boundedBy: minutes === ask ? "ask" : "parent", holds };
+}
+
+/** A pipeline's wall clock and its loop: what `fit` judges. */
+export interface Pipeline extends Loop {
+  maxMinutes: number;
+}
+
+/** The fit: a pipeline holds its first child at its ask and every later round
+ *  at its floor — `provision + ask(coding) + reserve(coding, loop) ≤
+ *  maxMinutes`. Asserted at verify over the registry, at config load over the
+ *  deployment's `ship` block (`validateShip`), and at the fork over a request a
+ *  boundary or a `budget:` directive clipped. `need` is the sum a refusal names. */
+export function fit(pipeline: Pipeline): { ok: boolean; need: number; have: number } {
+  const need = ALLOWANCES.provision + ASKS.coding + reserveMinutes({ kind: "coding", index: 0 }, pipeline);
+  return { ok: pipeline.maxMinutes >= need, need, have: pipeline.maxMinutes };
+}
+
+// ---- the grant (decision 0046, Renewal: the grant decides, the lease continues) ----
+
+/** What the request authorizes for the whole problem beyond one lease: a count
+ *  of renewals and a cost cap in dollars. A lease is sized by the infrastructure
+ *  that must outlive it; the grant is sized by the person — a scope's word or
+ *  the request's `renewals:` directive — and the runner spends it one segment at
+ *  a time. Zero renewals and no cap by default, so nothing renews until someone
+ *  says so; `costCapUsd` absent is no cap, never zero. */
+export interface Grant {
+  renewals: number;
+  costCapUsd?: number;
+}
+
+/** Which layer's word the grant is: the request's directive, the user's scope,
+ *  the channel's, or the org's `ship.grant` — the default counts as the org's. */
+export type GrantSource = "org" | "channel" | "user" | "run";
+
+export const DEFAULT_GRANT: Grant = { renewals: 0 };
+
+/** The most renewals one request may carry: thirteen segments of the ship
+ *  preset's ask are a day, the longest problem a person hands over in one
+ *  message before a plan should carry it. */
+export const GRANT_RENEWALS_MAX = 12;

package/dist/assets/src/core/coordinator/contract.ts

@@ -8,6 +8,7 @@
 // parent record the spawn route reads the requester from, and the names the
 // routes decide on.
 //
+import type { Grant, GrantSource } from "../budgets.js";
 import type { AddressSeverity, AddressSeveritySource } from "../ship/coordinator.js";
 
 // A coordinator is a Workflow instance in the shim Worker whose children are
@@ -181,6 +182,13 @@ export interface CoordinatorInstance {
    *  the machine reads one value; absent reads as the default (`minor`, org). */
   addressSeverity?: AddressSeverity;
   addressSeveritySource?: AddressSeveritySource;
+  /** The grant (decision 0046, the renewable lease): the renewals and cost cap
+   *  the request carries, resolved once by the ship fork (directive count >
+   *  user > channel > org) and written here beside `merge`; absent reads as
+   *  zero renewals and no cap, the org's. Nothing renews until the renewal
+   *  decision reads it. */
+  grant?: Grant;
+  grantSource?: GrantSource;
   /** The pipeline's caps as the profile gate clipped them: the rounds cap and the wall clock per unit. */
   caps?: { maxRounds: number; maxMinutes: number };
   /** The status card in the requesting thread, when the channel has one — what
@@ -195,6 +203,13 @@ export interface CoordinatorInstance {
   attempt?: number;
 }
 
+export interface UnitSegment {
+  index: number;
+  from?: string;
+  runId?: string;
+  at: number;
+}
+
 /** One unit of the plan an instance runs (a task string is a generated plan of
  *  one unit, `U1`): its branch, the units it waits on, and — as the runner
  *  reaches it — its thread, its pull request, the round boundaries the card
@@ -229,6 +244,13 @@ export interface CoordinatorUnit {
    *  opened or updated): the next attempt's pre-check starts at the review
    *  round when the open pull request still heads exactly here. */
   lastPush?: string;
+  /** The renewals the unit spent (decision 0046, Renewal): one row per segment
+   *  the grant opened after the first, keyed by the segment's index — written
+   *  by `unit-end` on a `continued` ending before the segment runs, so a runner
+   *  reclaimed between a segment's end and its renewal finds the row and never
+   *  renews the same segment twice. `from` is the sha the segment continues
+   *  from, `runId` the coding run whose write-up briefs it. */
+  segments?: UnitSegment[];
   /** The round boundaries the coordinator reported, oldest first (the `ship_round` vocabulary). */
   rounds: Array<{ index: number; agent: string; outcome: string; at: number }>;
   /** How the unit ended: the ending's kind and the thread's report, when it has. */
@@ -281,6 +303,15 @@ export function isCoordinatorInstance(v: unknown): v is CoordinatorInstance {
 }
 
 /** Structural check on a unit row from outside the process. */
+const isSegment = (v: unknown): boolean =>
+  isObject(v) &&
+  typeof v.index === "number" &&
+  Number.isInteger(v.index) &&
+  v.index >= 2 &&
+  (v.from === undefined || isText(v.from)) &&
+  (v.runId === undefined || isText(v.runId)) &&
+  typeof v.at === "number";
+
 export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
   if (!isObject(v)) return false;
   const r = v;
@@ -293,6 +324,7 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
   if (r.pr !== undefined && !isPr(r.pr)) return false;
   if (r.resume !== undefined && !isResume(r.resume)) return false;
   if (r.lastPush !== undefined && !isText(r.lastPush)) return false;
+  if (r.segments !== undefined && (!Array.isArray(r.segments) || !r.segments.every(isSegment))) return false;
   if (
     !Array.isArray(r.rounds) ||
     r.rounds.length > MAX_ROUNDS ||

package/dist/assets/src/core/coordinator/driver.ts

@@ -33,6 +33,7 @@
 // plan's re-issue. A task string's ship branch waits for a person. Node-free:
 // the shim Worker imports this by relative path.
 
+import { DEFAULT_GRANT, GRANT_RENEWALS_MAX, type Grant, type GrantSource } from "../budgets.js";
 import {
   applyReturn,
   cursorFinished,
@@ -54,8 +55,9 @@ import {
   type ShipCaps,
   type StepReturn,
   type UnitEnding,
-  type UnitPipelineInput,
   type UnitPipelineState,
+  stepPrefixOf,
+  type UnitSession,
 } from "../ship/coordinator.js";
 import { checksSettledEventType, isCoordinatorUnit, runFinishedEventType, type CoordinatorUnit } from "./contract.js";
 
@@ -165,12 +167,14 @@ interface PlanFacts {
   /** The severity to address, beside `merge`: the level an approve's findings are held to, and which layer set it. */
   addressSeverity: AddressSeverity;
   addressSeveritySource: AddressSeveritySource;
+  /** The grant beside them (decision 0046): what a renewal could spend, and which layer granted it. */
+  grant: Grant;
+  grantSource: GrantSource;
   /** The instance's mark as the plan route answers it: a generated one-unit plan (a `plan` with no `path`). */
   generated: boolean;
   repo: string;
   base: string;
   caps: ShipCaps;
-  childMinutes: UnitPipelineInput["childMinutes"];
   units: CoordinatorUnit[];
 }
 
@@ -178,18 +182,27 @@ const isRecord = (v: unknown): v is Record<string, unknown> => typeof v === "obj
 const isMinutes = (v: unknown): v is Record<string, number> =>
   isRecord(v) && Object.values(v).every((n) => typeof n === "number" && Number.isFinite(n));
 
+/** The grant as the plan route answers it; anything unreadable — a count
+ *  outside the module's ceiling included — is the default: nothing renews on a guess. */
+function readGrant(raw: unknown): Grant {
+  if (
+    !isRecord(raw) ||
+    typeof raw.renewals !== "number" ||
+    !Number.isInteger(raw.renewals) ||
+    raw.renewals < 0 ||
+    raw.renewals > GRANT_RENEWALS_MAX
+  )
+    return DEFAULT_GRANT;
+  const cap = raw.costCapUsd;
+  return { renewals: raw.renewals, ...(typeof cap === "number" && cap > 0 ? { costCapUsd: cap } : {}) };
+}
+
 function readPlan(a: BotAnswer): PlanFacts {
   const b = a.body;
   if (b.ok !== true) throw new UnreadableAnswer("plan", a, "not ok");
   if (typeof b.repo !== "string" || typeof b.base !== "string") throw new UnreadableAnswer("plan", a, "repo and base");
   if (!isMinutes(b.caps) || typeof b.caps.maxRounds !== "number" || typeof b.caps.maxMinutes !== "number")
     throw new UnreadableAnswer("plan", a, "caps");
-  if (
-    !isMinutes(b.childMinutes) ||
-    typeof b.childMinutes.coding !== "number" ||
-    typeof b.childMinutes.review !== "number"
-  )
-    throw new UnreadableAnswer("plan", a, "childMinutes");
   const units: unknown = b.units;
   if (!Array.isArray(units) || !units.every(isCoordinatorUnit)) throw new UnreadableAnswer("plan", a, "units");
   return {
@@ -200,11 +213,13 @@ function readPlan(a: BotAnswer): PlanFacts {
       b.addressSeveritySource === "run" || b.addressSeveritySource === "user" || b.addressSeveritySource === "channel"
         ? b.addressSeveritySource
         : "org",
+    grant: readGrant(b.grant),
+    grantSource:
+      b.grantSource === "run" || b.grantSource === "user" || b.grantSource === "channel" ? b.grantSource : "org",
     generated: b.generated === true,
     repo: b.repo,
     base: b.base,
     caps: { maxRounds: b.caps.maxRounds, maxMinutes: b.caps.maxMinutes },
-    childMinutes: { coding: b.childMinutes.coding, review: b.childMinutes.review },
     units,
   };
 }
@@ -261,6 +276,10 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
     reviewHead,
     dispositions,
     handoff,
+    pushed,
+    leaseStartedAt,
+    costUsd,
+    handoffLists,
   } = facts;
   return {
     type: "read-record",
@@ -278,6 +297,11 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
       ...(reviewHead !== undefined ? { reviewHead } : {}),
       ...(dispositions !== undefined ? { dispositions } : {}),
       ...(handoff !== undefined ? { handoff } : {}),
+      // The renewal's facts (decision 0046), as the record carries them.
+      ...(Array.isArray(pushed) ? { pushed } : {}),
+      ...(typeof leaseStartedAt === "number" ? { leaseStartedAt } : {}),
+      ...(typeof costUsd === "number" || costUsd === null ? { costUsd } : {}),
+      ...(handoffLists !== undefined ? { handoffLists } : {}),
     },
     at: a.body.at,
   };
@@ -466,11 +490,16 @@ async function runUnit(
   instanceId: string,
   node: PlanUnitNode,
   plan: PlanFacts,
+  session?: UnitSession,
 ): Promise<UnitEnding> {
   const unit = node.id;
+  // A renewal's segment names its steps under the segment (`U10/s2/…`), so
+  // the Workflow's durable step cache never answers segment two with segment
+  // one's results (decision 0046).
+  const prefix = stepPrefixOf(unit, session);
   const tag = { parentInstanceId: instanceId, unit };
   const start = readUnitStart(
-    answerOf("unit-start", await step.do(`${unit}/start`, STEP_CONFIG, () => call(bot, "unit-start", tag))),
+    answerOf("unit-start", await step.do(`${prefix}/start`, STEP_CONFIG, () => call(bot, "unit-start", tag))),
   );
   // A resume at review (agent-ship item 10) rides the unit's row: the pull
   // request of ship's own the requester named opens the pipeline at its first
@@ -486,7 +515,6 @@ async function runUnit(
       repo: plan.repo,
       base: plan.base,
       caps: plan.caps,
-      childMinutes: plan.childMinutes,
       // The instance's field decides who merges (record 0031's merge grant),
       // carried here by the plan route: the hand-off wrote `runner` on a
       // seeded plan and `person` on a task, and the door re-checks it — the
@@ -494,9 +522,12 @@ async function runUnit(
       merge: plan.merge,
       addressSeverity: plan.addressSeverity,
       addressSeveritySource: plan.addressSeveritySource,
+      grant: plan.grant,
+      grantSource: plan.grantSource,
       generated: plan.generated,
       ...(resume !== undefined ? { resume } : {}),
       ...(lastPush !== undefined ? { lastPush } : {}),
+      ...(session !== undefined ? { session } : {}),
     },
     start.at,
   );
@@ -509,7 +540,7 @@ async function runUnit(
     for (const note of transition.notes) {
       if (note.type === "round") {
         const body = { ...tag, index: note.index, agent: note.agent, outcome: note.outcome };
-        await step.do(`${unit}/note/${++notes}`, STEP_CONFIG, () => call(bot, "round", body));
+        await step.do(`${prefix}/note/${++notes}`, STEP_CONFIG, () => call(bot, "round", body));
       } else {
         // A merge_ready ending names the pull request as it is at the APPROVED
         // head (agent-ship item 9): one more pr-check reads the facts fresh —
@@ -521,10 +552,10 @@ async function runUnit(
         if (note.ending.kind === "merge_ready") {
           try {
             const check = prCheckReturn(
-              `${unit}/end/pr-facts`,
+              `${prefix}/end/pr-facts`,
               answerOf(
                 "pr-check",
-                await step.do(`${unit}/end/pr-facts`, STEP_CONFIG, () => call(bot, "pr-check", tag)),
+                await step.do(`${prefix}/end/pr-facts`, STEP_CONFIG, () => call(bot, "pr-check", tag)),
               ),
             );
             if (check.type === "pr-check" && check.pr.state === "merged")
@@ -548,8 +579,20 @@ async function runUnit(
             ? { headSha: note.ending.headSha }
             : {}),
           ...(state.lastCodingRunId !== undefined ? { codingRunId: state.lastCodingRunId } : {}),
+          // A continued ending is a segment's end, not the unit's: the bot
+          // writes the renewal as a row keyed by the next segment's index
+          // (decision 0046), so a runner reclaimed here never renews twice.
+          ...(note.ending.kind === "continued"
+            ? {
+                segment: {
+                  index: note.ending.segment,
+                  ...(note.ending.from !== undefined ? { from: note.ending.from } : {}),
+                  runId: note.ending.runId,
+                },
+              }
+            : {}),
         };
-        await step.do(`${unit}/end`, STEP_CONFIG, () => call(bot, "unit-end", body));
+        await step.do(`${prefix}/end`, STEP_CONFIG, () => call(bot, "unit-end", body));
       }
     }
   }
@@ -583,13 +626,23 @@ async function walk(step: StepRunner, bot: CoordinatorBot, instanceId: string):
     const [next] = readyUnits(graph, cursor);
     if (next === undefined) break;
     cursor = startUnit(graph, cursor, next);
-    const ending = await runUnit(
-      step,
-      bot,
-      instanceId,
-      graph.units.find((u) => u.id === next)!,
-      plan,
-    );
+    const node = graph.units.find((u) => u.id === next)!;
+    let ending = await runUnit(step, bot, instanceId, node, plan);
+    // The lease continues while the grant renews (decision 0046): each
+    // `continued` ending opens the next segment of the same unit — a fresh
+    // pipeline under a fresh lease, from the recorded sha, briefed with the
+    // previous segment's write-up — until the unit ends some other way.
+    while (ending.kind === "continued") {
+      const c = ending;
+      ending = await runUnit(step, bot, instanceId, node, plan, {
+        segment: c.segment,
+        renewalsSpent: c.segment - 1,
+        spendUsd: c.spendUsd,
+        ...(c.from !== undefined ? { continueFrom: c.from } : {}),
+        previousRunId: c.runId,
+        ...(c.handoff !== undefined ? { previousHandoff: c.handoff } : {}),
+      });
+    }
     endings[next] = ending.kind;
     cursor = settleUnit(graph, cursor, next, ending.kind === "merged" ? "done" : "failed");
   }