@coreplane/switchboard 1.243.0 → 1.244.0

package/dist/assets/deploy/cloudflare-sandbox/worker.ts

@@ -588,9 +588,20 @@ export class SwitchboardSandbox extends Sandbox<Env> {
     await Promise.race([settled, new Promise<void>((r) => setTimeout(r, maxMs))]);
   }
 
-  /** `du -sk` over the paths, summed, in KiB; null when nothing could be measured. */
+  /** `du -sk` over the paths, summed, in KiB; null when nothing could be
+   *  measured — including a `du` that did not answer inside its own limit
+   *  (a mount mid-restore under load): the judge treats a sample the
+   *  container could not take as no evidence either way, never as the
+   *  restore's failure. The restore's own promise still reports a runtime
+   *  that went away. */
   private async duKiB(paths: string[]): Promise<number | null> {
-    const r = await this.runRoot(["du", "-sk", ...paths], 30_000);
+    let r: { stdout: string; exitCode: number };
+    try {
+      r = await this.runRoot(["du", "-sk", ...paths], 30_000);
+    } catch {
+      return null;
+    }
+    if (r.exitCode === 124) return null;
     let total = 0;
     let seen = false;
     for (const line of r.stdout.split("\n")) {

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.243.0",
+  "version": "1.244.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.243.0",
+      "version": "1.244.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.243.0",
+      "version": "1.244.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.243.0",
+  "version": "1.244.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.243.0",
-  "commit": "abfb780fe3a276f303d13d597ad7c549ba8f49c0",
-  "builtAt": "2026-09-17T07:58:14.271Z"
+  "version": "1.244.0",
+  "commit": "de7fddf53659568639ad877e935a8b9c0177debd",
+  "builtAt": "2026-09-17T15:03:14.350Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -225,7 +225,7 @@ Keep notes with the \`notes\` tool: one short document, replaced whole each time
 // project's most expensive checks first; the rule is the runner's to hold, not
 // a line every requester remembers to paste. Stack-agnostic on purpose — the
 // classes are by duration, the project's own scripts and CI say which is which.
-export const CHECKS_BY_COST = `CHECKS BY COST — push before the expensive ones. Every check you might run has a cost class: seconds (a formatter or a linter on the files you touched, one test file, a docs, link or spec check, the typecheck of one package) or minutes (the whole test suite, a build, a dependency install, an end-to-end or full verification). Know a command's class before you run it — from the project's own scripts and CI configuration, from how long it took last time, or by the class above when you have nothing better. Prove each change with the cheapest check that can prove it, matched to the change's scope: a documentation change gets the documentation checks, one module gets its own tests, a shared type gets the typecheck. As soon as the change exists and those checks pass, commit and push — the pushed branch is the deliverable, and an unpushed tree does not survive the run's end. Only then run the expensive checks, once, and fix forward with further commits and pushes. Never start an operation whose expected duration does not fit the time you have left minus what a commit, a push and the description need: push what there is and say plainly what is unverified instead. The description's validation names exactly what ran; what did not run is CI's to gate, and you say so.`;
+export const CHECKS_BY_COST = `CHECKS BY COST — push before the expensive ones. Every check you might run has a cost class: seconds (a formatter or a linter on the files you touched, one test file, a docs, link or spec check, the typecheck of one package) or minutes (the whole test suite, a build, a dependency install, an end-to-end or full verification). Know a command's class before you run it — from the project's own scripts and CI configuration, from how long it took last time, or by the class above when you have nothing better. Prove each change with the cheapest check that can prove it, matched to the change's scope: a documentation change gets the documentation checks, one module gets its own tests, a shared type gets the typecheck. As soon as the change exists and those checks pass, commit and push — the pushed branch is the deliverable, and an unpushed tree does not survive the run's end. Only then run the expensive checks, once, and fix forward with further commits and pushes. Never start an operation whose expected duration does not fit the time you have left minus what a commit, a push and the description need: push what there is and say plainly what is unverified instead. At the wind-down note, commit and push what compiles, say what does not, then answer. The description's validation names exactly what ran; what did not run is CI's to gate, and you say so.`;
 
 const CODING_SYSTEM = `You are Switchboard's coding agent, operating from a Slack request.
 

package/dist/assets/src/core/authz/types.ts

@@ -196,4 +196,14 @@ export interface ChannelDirectory {
   /** Every channel the actor is in, platform-namespaced — what the resolver puts on
    *  `Actor.memberOf`; `unknown` when the adapter cannot say (fail-closed). */
   channelsOf(actorId: string): Promise<ReadonlySet<string> | "unknown">;
+  /** Every channel the bot itself is in, with its visibility — the channels a person can
+   *  pick a scope or an MCP tier for (settings-page.md item 7); `unknown` when the adapter
+   *  cannot list them, and the surfaces fall back to the channels that already carry a scope. */
+  channels(): Promise<readonly ListedChannel[] | "unknown">;
+}
+
+/** One channel the bot is in, as the directory lists it. */
+export interface ListedChannel {
+  id: string;
+  visibility: ChannelVisibility;
 }

package/dist/assets/src/core/budgets.ts

@@ -18,6 +18,18 @@
 
 export const MINUTE_MS = 60_000;
 
+/** One calendar day in milliseconds: the unit the daily cost and delivery ranges
+ *  step by (`dayOf`, the day count of a range). A day is not a lease, but it is
+ *  a duration, and every duration is read from this table rather than written
+ *  as a literal where it is used. */
+export const DAY_MS = 24 * 60 * MINUTE_MS;
+
+/** How long the confirmation a routed write is offered as stays pending
+ *  (docs/decisions/0044; docs/reference/specs/routing-and-config.md item 25):
+ *  the connect ticket's ten minutes. The bot passes it to the config object,
+ *  which stamps the expiry on its own clock. */
+export const CONFIRMATION_TTL_MS = 10 * MINUTE_MS;
+
 /** The presets that run the tool loop, and the one pipeline preset. */
 export const LOOP_PRESETS = ["general", "coding", "review", "research", "explore", "conductor"] as const;
 export type LoopPreset = (typeof LOOP_PRESETS)[number];
@@ -311,3 +323,27 @@ export function fit(pipeline: Pipeline): { ok: boolean; need: number; have: numb
   const need = ALLOWANCES.provision + ASKS.coding + reserveMinutes({ kind: "coding", index: 0 }, pipeline);
   return { ok: pipeline.maxMinutes >= need, need, have: pipeline.maxMinutes };
 }
+
+// ---- the grant (decision 0046, Renewal: the grant decides, the lease continues) ----
+
+/** What the request authorizes for the whole problem beyond one lease: a count
+ *  of renewals and a cost cap in dollars. A lease is sized by the infrastructure
+ *  that must outlive it; the grant is sized by the person — a scope's word or
+ *  the request's `renewals:` directive — and the runner spends it one segment at
+ *  a time. Zero renewals and no cap by default, so nothing renews until someone
+ *  says so; `costCapUsd` absent is no cap, never zero. */
+export interface Grant {
+  renewals: number;
+  costCapUsd?: number;
+}
+
+/** Which layer's word the grant is: the request's directive, the user's scope,
+ *  the channel's, or the org's `ship.grant` — the default counts as the org's. */
+export type GrantSource = "org" | "channel" | "user" | "run";
+
+export const DEFAULT_GRANT: Grant = { renewals: 0 };
+
+/** The most renewals one request may carry: thirteen segments of the ship
+ *  preset's ask are a day, the longest problem a person hands over in one
+ *  message before a plan should carry it. */
+export const GRANT_RENEWALS_MAX = 12;

package/dist/assets/src/core/coordinator/contract.ts

@@ -8,6 +8,7 @@
 // parent record the spawn route reads the requester from, and the names the
 // routes decide on.
 //
+import type { Grant, GrantSource } from "../budgets.js";
 import type { AddressSeverity, AddressSeveritySource } from "../ship/coordinator.js";
 
 // A coordinator is a Workflow instance in the shim Worker whose children are
@@ -181,6 +182,13 @@ export interface CoordinatorInstance {
    *  the machine reads one value; absent reads as the default (`minor`, org). */
   addressSeverity?: AddressSeverity;
   addressSeveritySource?: AddressSeveritySource;
+  /** The grant (decision 0046, the renewable lease): the renewals and cost cap
+   *  the request carries, resolved once by the ship fork (directive count >
+   *  user > channel > org) and written here beside `merge`; absent reads as
+   *  zero renewals and no cap, the org's. Nothing renews until the renewal
+   *  decision reads it. */
+  grant?: Grant;
+  grantSource?: GrantSource;
   /** The pipeline's caps as the profile gate clipped them: the rounds cap and the wall clock per unit. */
   caps?: { maxRounds: number; maxMinutes: number };
   /** The status card in the requesting thread, when the channel has one — what
@@ -195,6 +203,13 @@ export interface CoordinatorInstance {
   attempt?: number;
 }
 
+export interface UnitSegment {
+  index: number;
+  from?: string;
+  runId?: string;
+  at: number;
+}
+
 /** One unit of the plan an instance runs (a task string is a generated plan of
  *  one unit, `U1`): its branch, the units it waits on, and — as the runner
  *  reaches it — its thread, its pull request, the round boundaries the card
@@ -229,6 +244,13 @@ export interface CoordinatorUnit {
    *  opened or updated): the next attempt's pre-check starts at the review
    *  round when the open pull request still heads exactly here. */
   lastPush?: string;
+  /** The renewals the unit spent (decision 0046, Renewal): one row per segment
+   *  the grant opened after the first, keyed by the segment's index — written
+   *  by `unit-end` on a `continued` ending before the segment runs, so a runner
+   *  reclaimed between a segment's end and its renewal finds the row and never
+   *  renews the same segment twice. `from` is the sha the segment continues
+   *  from, `runId` the coding run whose write-up briefs it. */
+  segments?: UnitSegment[];
   /** The round boundaries the coordinator reported, oldest first (the `ship_round` vocabulary). */
   rounds: Array<{ index: number; agent: string; outcome: string; at: number }>;
   /** How the unit ended: the ending's kind and the thread's report, when it has. */
@@ -281,6 +303,15 @@ export function isCoordinatorInstance(v: unknown): v is CoordinatorInstance {
 }
 
 /** Structural check on a unit row from outside the process. */
+const isSegment = (v: unknown): boolean =>
+  isObject(v) &&
+  typeof v.index === "number" &&
+  Number.isInteger(v.index) &&
+  v.index >= 2 &&
+  (v.from === undefined || isText(v.from)) &&
+  (v.runId === undefined || isText(v.runId)) &&
+  typeof v.at === "number";
+
 export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
   if (!isObject(v)) return false;
   const r = v;
@@ -293,6 +324,7 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
   if (r.pr !== undefined && !isPr(r.pr)) return false;
   if (r.resume !== undefined && !isResume(r.resume)) return false;
   if (r.lastPush !== undefined && !isText(r.lastPush)) return false;
+  if (r.segments !== undefined && (!Array.isArray(r.segments) || !r.segments.every(isSegment))) return false;
   if (
     !Array.isArray(r.rounds) ||
     r.rounds.length > MAX_ROUNDS ||

package/dist/assets/src/core/coordinator/driver.ts

@@ -33,6 +33,7 @@
 // plan's re-issue. A task string's ship branch waits for a person. Node-free:
 // the shim Worker imports this by relative path.
 
+import { DEFAULT_GRANT, GRANT_RENEWALS_MAX, type Grant, type GrantSource } from "../budgets.js";
 import {
   applyReturn,
   cursorFinished,
@@ -55,6 +56,8 @@ import {
   type StepReturn,
   type UnitEnding,
   type UnitPipelineState,
+  stepPrefixOf,
+  type UnitSession,
 } from "../ship/coordinator.js";
 import { checksSettledEventType, isCoordinatorUnit, runFinishedEventType, type CoordinatorUnit } from "./contract.js";
 
@@ -164,6 +167,9 @@ interface PlanFacts {
   /** The severity to address, beside `merge`: the level an approve's findings are held to, and which layer set it. */
   addressSeverity: AddressSeverity;
   addressSeveritySource: AddressSeveritySource;
+  /** The grant beside them (decision 0046): what a renewal could spend, and which layer granted it. */
+  grant: Grant;
+  grantSource: GrantSource;
   /** The instance's mark as the plan route answers it: a generated one-unit plan (a `plan` with no `path`). */
   generated: boolean;
   repo: string;
@@ -176,6 +182,21 @@ const isRecord = (v: unknown): v is Record<string, unknown> => typeof v === "obj
 const isMinutes = (v: unknown): v is Record<string, number> =>
   isRecord(v) && Object.values(v).every((n) => typeof n === "number" && Number.isFinite(n));
 
+/** The grant as the plan route answers it; anything unreadable — a count
+ *  outside the module's ceiling included — is the default: nothing renews on a guess. */
+function readGrant(raw: unknown): Grant {
+  if (
+    !isRecord(raw) ||
+    typeof raw.renewals !== "number" ||
+    !Number.isInteger(raw.renewals) ||
+    raw.renewals < 0 ||
+    raw.renewals > GRANT_RENEWALS_MAX
+  )
+    return DEFAULT_GRANT;
+  const cap = raw.costCapUsd;
+  return { renewals: raw.renewals, ...(typeof cap === "number" && cap > 0 ? { costCapUsd: cap } : {}) };
+}
+
 function readPlan(a: BotAnswer): PlanFacts {
   const b = a.body;
   if (b.ok !== true) throw new UnreadableAnswer("plan", a, "not ok");
@@ -192,6 +213,9 @@ function readPlan(a: BotAnswer): PlanFacts {
       b.addressSeveritySource === "run" || b.addressSeveritySource === "user" || b.addressSeveritySource === "channel"
         ? b.addressSeveritySource
         : "org",
+    grant: readGrant(b.grant),
+    grantSource:
+      b.grantSource === "run" || b.grantSource === "user" || b.grantSource === "channel" ? b.grantSource : "org",
     generated: b.generated === true,
     repo: b.repo,
     base: b.base,
@@ -252,6 +276,10 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
     reviewHead,
     dispositions,
     handoff,
+    pushed,
+    leaseStartedAt,
+    costUsd,
+    handoffLists,
   } = facts;
   return {
     type: "read-record",
@@ -269,6 +297,11 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
       ...(reviewHead !== undefined ? { reviewHead } : {}),
       ...(dispositions !== undefined ? { dispositions } : {}),
       ...(handoff !== undefined ? { handoff } : {}),
+      // The renewal's facts (decision 0046), as the record carries them.
+      ...(Array.isArray(pushed) ? { pushed } : {}),
+      ...(typeof leaseStartedAt === "number" ? { leaseStartedAt } : {}),
+      ...(typeof costUsd === "number" || costUsd === null ? { costUsd } : {}),
+      ...(handoffLists !== undefined ? { handoffLists } : {}),
     },
     at: a.body.at,
   };
@@ -457,11 +490,16 @@ async function runUnit(
   instanceId: string,
   node: PlanUnitNode,
   plan: PlanFacts,
+  session?: UnitSession,
 ): Promise<UnitEnding> {
   const unit = node.id;
+  // A renewal's segment names its steps under the segment (`U10/s2/…`), so
+  // the Workflow's durable step cache never answers segment two with segment
+  // one's results (decision 0046).
+  const prefix = stepPrefixOf(unit, session);
   const tag = { parentInstanceId: instanceId, unit };
   const start = readUnitStart(
-    answerOf("unit-start", await step.do(`${unit}/start`, STEP_CONFIG, () => call(bot, "unit-start", tag))),
+    answerOf("unit-start", await step.do(`${prefix}/start`, STEP_CONFIG, () => call(bot, "unit-start", tag))),
   );
   // A resume at review (agent-ship item 10) rides the unit's row: the pull
   // request of ship's own the requester named opens the pipeline at its first
@@ -484,9 +522,12 @@ async function runUnit(
       merge: plan.merge,
       addressSeverity: plan.addressSeverity,
       addressSeveritySource: plan.addressSeveritySource,
+      grant: plan.grant,
+      grantSource: plan.grantSource,
       generated: plan.generated,
       ...(resume !== undefined ? { resume } : {}),
       ...(lastPush !== undefined ? { lastPush } : {}),
+      ...(session !== undefined ? { session } : {}),
     },
     start.at,
   );
@@ -499,7 +540,7 @@ async function runUnit(
     for (const note of transition.notes) {
       if (note.type === "round") {
         const body = { ...tag, index: note.index, agent: note.agent, outcome: note.outcome };
-        await step.do(`${unit}/note/${++notes}`, STEP_CONFIG, () => call(bot, "round", body));
+        await step.do(`${prefix}/note/${++notes}`, STEP_CONFIG, () => call(bot, "round", body));
       } else {
         // A merge_ready ending names the pull request as it is at the APPROVED
         // head (agent-ship item 9): one more pr-check reads the facts fresh —
@@ -511,10 +552,10 @@ async function runUnit(
         if (note.ending.kind === "merge_ready") {
           try {
             const check = prCheckReturn(
-              `${unit}/end/pr-facts`,
+              `${prefix}/end/pr-facts`,
               answerOf(
                 "pr-check",
-                await step.do(`${unit}/end/pr-facts`, STEP_CONFIG, () => call(bot, "pr-check", tag)),
+                await step.do(`${prefix}/end/pr-facts`, STEP_CONFIG, () => call(bot, "pr-check", tag)),
               ),
             );
             if (check.type === "pr-check" && check.pr.state === "merged")
@@ -538,8 +579,20 @@ async function runUnit(
             ? { headSha: note.ending.headSha }
             : {}),
           ...(state.lastCodingRunId !== undefined ? { codingRunId: state.lastCodingRunId } : {}),
+          // A continued ending is a segment's end, not the unit's: the bot
+          // writes the renewal as a row keyed by the next segment's index
+          // (decision 0046), so a runner reclaimed here never renews twice.
+          ...(note.ending.kind === "continued"
+            ? {
+                segment: {
+                  index: note.ending.segment,
+                  ...(note.ending.from !== undefined ? { from: note.ending.from } : {}),
+                  runId: note.ending.runId,
+                },
+              }
+            : {}),
         };
-        await step.do(`${unit}/end`, STEP_CONFIG, () => call(bot, "unit-end", body));
+        await step.do(`${prefix}/end`, STEP_CONFIG, () => call(bot, "unit-end", body));
       }
     }
   }
@@ -573,13 +626,23 @@ async function walk(step: StepRunner, bot: CoordinatorBot, instanceId: string):
     const [next] = readyUnits(graph, cursor);
     if (next === undefined) break;
     cursor = startUnit(graph, cursor, next);
-    const ending = await runUnit(
-      step,
-      bot,
-      instanceId,
-      graph.units.find((u) => u.id === next)!,
-      plan,
-    );
+    const node = graph.units.find((u) => u.id === next)!;
+    let ending = await runUnit(step, bot, instanceId, node, plan);
+    // The lease continues while the grant renews (decision 0046): each
+    // `continued` ending opens the next segment of the same unit — a fresh
+    // pipeline under a fresh lease, from the recorded sha, briefed with the
+    // previous segment's write-up — until the unit ends some other way.
+    while (ending.kind === "continued") {
+      const c = ending;
+      ending = await runUnit(step, bot, instanceId, node, plan, {
+        segment: c.segment,
+        renewalsSpent: c.segment - 1,
+        spendUsd: c.spendUsd,
+        ...(c.from !== undefined ? { continueFrom: c.from } : {}),
+        previousRunId: c.runId,
+        ...(c.handoff !== undefined ? { previousHandoff: c.handoff } : {}),
+      });
+    }
     endings[next] = ending.kind;
     cursor = settleUnit(graph, cursor, next, ending.kind === "merged" ? "done" : "failed");
   }

package/dist/assets/src/core/delivery.ts

@@ -1,4 +1,5 @@
 import { snapshotAgeText } from "./snapshotAge.js";
+import { DAY_MS } from "./budgets.js";
 import { systemClock } from "./trace/clock.js";
 
 // Delivery indicators: what the run history and the pull requests' own facts
@@ -225,7 +226,6 @@ export function weekIncomplete(report: Pick<DeliveryReport, "truncated" | "compl
 
 // ---- the arithmetic ---------------------------------------------------------------------
 
-const DAY_MS = 86_400_000;
 const HOUR_MS = 3_600_000;
 
 /** Add `n` calendar days to a UTC date (`YYYY-MM-DD`). */

package/dist/assets/src/core/runEvents.ts

@@ -196,6 +196,20 @@ export type RunNoteKind =
    *  item 7): the summary names the tool and the rule; the model read the same
    *  reason as the tool's result. Published by the bot's authorize route. */
   | "tool_refused"
+  /** An OpenCode tool settled under a step this loop never saw start and the
+   *  settle was set aside (harness.md item 13): an earlier execution's late
+   *  result — the pinned binary's ordinary shape after a hung call's interrupt
+   *  — or a step lost with the tailer's stream. The summary names the call and
+   *  the step. Information, not a failure of the harness: nothing ran that the
+   *  gate did not decide. Published by the OpenCode bridge in its own mode. */
+  | "settle_set_aside"
+  /** OpenCode's store refill carried a permission over something other than a
+   *  tool (a directory outside the project, a repeating session) for a call
+   *  the record never saw, and the store held no part yet to name the call's
+   *  tool by: the call was opened under the permission's own name. The summary
+   *  names the call and the step. Information, not a failure: the tool ran
+   *  under the gate's decision either way. Published by the OpenCode bridge. */
+  | "tool_unnamed"
   /** A ship coding child's budget ended with work still in the tree: the run
    *  loop committed and pushed it to the unit's branch (or says plainly that
    *  there was nothing to push), so a re-issue starts from the partial work
@@ -235,6 +249,8 @@ export const RUN_NOTE_KINDS = [
   "harness_error",
   "policy_refusal",
   "tool_refused",
+  "settle_set_aside",
+  "tool_unnamed",
   "budget_salvage",
   "stuck_loop",
 ] as const satisfies readonly RunNoteKind[];
@@ -293,7 +309,17 @@ export function sanitizeActor(actor: RunActor): RunActor {
  *  settles a round: caps end the pipeline BETWEEN rounds, visible as the
  *  absence of a next `started` boundary plus the answer's cap report. */
 export type ShipRoundOutcome =
-  "started" | "pr_opened" | "completed" | "approve" | "request_changes" | "no_verdict" | "aborted" | "stopped";
+  | "started"
+  | "pr_opened"
+  | "completed"
+  | "approve"
+  | "request_changes"
+  | "no_verdict"
+  | "aborted"
+  | "stopped"
+  /** The coding round ended at its lease with the unit unfinished and the row
+   *  showing progress, and the grant renewed: the next segment opens (decision 0046). */
+  | "continued";
 
 /**
  * One event in a run's stream. `seq` is stamped by `RunRegistry.publish` — a
@@ -393,10 +419,14 @@ export type RouteInputValue = RouteInputLeafOrList | RouteInputObject3;
 
 /** How a door decision about a state change ended (docs/decisions/0044-a-routed-write-is-confirmed-in-proportion-to-its-blast-radius.md):
  *  `hand_back` — the router bound a state-changing command and the door answered
- *  the line to paste, nothing invoked; `pasted` — the typed line that followed
- *  a hand-back in its thread, with the same receipt, ran. A routed read
- *  carries no outcome: it is not a decision about a state change. */
-export type RouteOutcome = "hand_back" | "pasted";
+ *  the line to paste, nothing invoked; `offered` — the same decision on a
+ *  channel that can show a confirmation: the line, its risk and a button, a
+ *  row stored in the config object, nothing invoked; `confirmed` — the stored
+ *  input ran at the click, as the requester, through the typed line's path;
+ *  `pasted` — the typed line that followed a hand-back in its thread, with the
+ *  same receipt, ran. A routed read carries no outcome: it is not a decision
+ *  about a state change. */
+export type RouteOutcome = "hand_back" | "offered" | "confirmed" | "pasted";
 
 export type RunEvent =
   /** `callId` is the provider's tool_use id — the explicit pair key between a
@@ -561,6 +591,10 @@ export type RunEvent =
        *  the instance's units. A child's instance rides the record's
        *  `parentInstanceId`, never here. */
       instanceId?: string;
+      /** The grant the ship request carried (decision 0046, the renewable
+       *  lease): renewals and a cost cap — what a renewal could spend. Written
+       *  on the pipeline's own record beside `instanceId`; absent elsewhere. */
+      grant?: { renewals: number; costCapUsd?: number };
       seq?: number;
       at?: number;
     }
@@ -691,6 +725,12 @@ export type RunEvent =
    *  start of the loop; a resumed run carries the original. Head material,
    *  like `run_meta`. Additive: unknown → ignored. */
   | { type: "lease"; startedAt: number; endsAt: number; loopEndsAt: number; seq?: number; at?: number }
+  /** A head the run pushed (docs/reference/specs/run-history.md item 2; decision
+   *  0046): the branch and the sha the coding post-step observed on the remote
+   *  (`by: "push"`), or the budget-end salvage pushed (`by: "salvage"`),
+   *  whether or not a pull request follows — the fact renewal reads. Published
+   *  straight to the registry like `pr_opened`. Additive: unknown → ignored. */
+  | { type: "pushed_head"; ref: string; sha: string; by: "push" | "salvage"; seq?: number; at?: number }
   /** The coordinator tag as a fact of the run (docs/reference/specs/run-history.md
    *  item 48a): the instance the run is a child of, the unit its idempotency
    *  key named, and the base branch its pull request targets — published by
@@ -755,8 +795,11 @@ export type RunEvent =
    *  how the invoke ended is the run's own status and `answer`. A door
    *  decision about a state change (record 0044) is a command run too, with
    *  `outcome` saying which: a hand-back invoked nothing and its `answer` is
-   *  the line to paste; a paste is the typed line that followed, whatever its
-   *  command, `handBackRunId` naming the hand-back's record. */
+   *  the line to paste; an offer invoked nothing and its `answer` is the offer
+   *  as the channel shows it; a confirmation is the stored input run at the
+   *  click, its `answer` the command's own text as a routed read's is; a paste is
+   *  the typed line that followed a hand-back, whatever its command,
+   *  `handBackRunId` naming the hand-back's record. */
   | {
       type: "route";
       preset: string;

package/dist/assets/src/core/runFriction.ts

@@ -426,7 +426,8 @@ export function analyzeRunFriction(events: readonly RunEvent[], opts: FrictionOp
       ev.type === "ship_round" ||
       ev.type === "route" ||
       ev.type === "reference" ||
-      ev.type === "lease"
+      ev.type === "lease" ||
+      ev.type === "pushed_head"
     ) {
       sideFactEvents++;
       return;

package/dist/assets/src/core/runRecord.ts

@@ -213,6 +213,10 @@ export interface RunRecord {
    *  `lease` event, folded at the assembly. Present only on a run whose
    *  harness started a loop; a record written before the event lacks it. */
   lease?: RunLease;
+  /** The heads the run pushed (item 2; decision 0046): one per branch, the
+   *  last `pushed_head` event's sha winning — the fact a renewal reads to know
+   *  the run made progress. Present only on a run that pushed. */
+  pushed?: PushedHead[];
   /** What the run cost in tokens, per model, summed from its `model.turn`
    *  spans at finish (`usageOfEvents`; docs/reference/specs/costs.md, cost by user).
    *  Every record written since carries it (zero turns included); one written
@@ -238,6 +242,21 @@ export interface RunLease {
   loopEndsAt: number;
 }
 
+/** A head a run pushed, as the record names it (item 2): the branch and the sha. */
+export interface PushedHead {
+  ref: string;
+  sha: string;
+}
+
+/** The heads a run's events say it pushed — one per branch, the last event's
+ *  sha winning, in first-seen order — or nothing when it pushed none. */
+export function pushedHeadsOf(events: readonly RunEvent[]): PushedHead[] | undefined {
+  const byRef = new Map<string, string>();
+  for (const e of events) if (e.type === "pushed_head") byRef.set(e.ref, e.sha);
+  if (byRef.size === 0) return undefined;
+  return [...byRef].map(([ref, sha]) => ({ ref, sha }));
+}
+
 /** The lease a run's events say its harness started — the first `lease`
  *  event; a resumed run's later generations publish none — or nothing. */
 export function leaseOfEvents(events: readonly RunEvent[]): RunLease | undefined {
@@ -798,6 +817,18 @@ export function isRunRecord(v: unknown): v is RunRecord {
   if (r.profile !== undefined && !isRunProfileRecord(r.profile)) return false;
   // The pull request the run reached (item 2): a positive integer and a URL, or absent.
   if (r.pr !== undefined && !isRunPullRequestShape(r.pr)) return false;
+  if (
+    r.pushed !== undefined &&
+    !(
+      Array.isArray(r.pushed) &&
+      r.pushed.every((h) => {
+        if (typeof h !== "object" || h === null) return false;
+        const { ref, sha } = h as Record<string, unknown>;
+        return typeof ref === "string" && ref.length > 0 && typeof sha === "string" && /^[0-9a-f]{7,40}$/.test(sha);
+      })
+    )
+  )
+    return false;
   // A parent is named by a run id (item 46): the same shape as the record's own.
   if (r.parentRunId !== undefined && (typeof r.parentRunId !== "string" || !RUN_ID_PATTERN.test(r.parentRunId)))
     return false;

package/dist/assets/src/core/ship/contract.ts

@@ -431,7 +431,8 @@ function renderFirstInstruction(rebase: ChildContract["rebase"]): string {
     `Push the branch as soon as the change exists and its cheapest proving checks pass — before the project's ` +
     `full verification, which runs after that push with any fix as a further commit; an unpushed tree does not ` +
     `survive the run's end. Right before each push, fetch ${onto} again and rebase once more if it moved while ` +
-    `you worked, so the pull request is not born conflicting.`
+    `you worked, so the pull request is not born conflicting. At the wind-down note, commit and push what compiles, ` +
+    `say what does not, then answer.`
   );
 }