@coreplane/switchboard 1.243.0 → 1.245.0

package/dist/assets/deploy/cloudflare-sandbox/worker.ts

@@ -49,7 +49,11 @@ import {
 import { envFromRequest } from "../../src/execution/sandboxEnv.js";
 import { IdleGuard, type IdleGuardHost } from "../../src/execution/sandboxIdle.js";
 import { StartGate, type StartGateHost, type StartingCause } from "../../src/execution/sandboxStart.js";
-import { RUNTIME_REPLACEMENT_WORDING, isRuntimeUnreachableSignal } from "../../src/execution/residentRefresh.js";
+import {
+  RUNTIME_REPLACEMENT_WORDING,
+  isRuntimeUnreachableSignal,
+  selfAndCauses,
+} from "../../src/execution/residentRefresh.js";
 import {
   fleetBusyAnswer,
   fleetBusyExecAnswer,
@@ -149,15 +153,6 @@ const RUNTIME_REPLACED_REASONS = new Set([
  *  closed (a runtime crash or stop), the socket failed, the upgrade failed. */
 const RPC_TRANSPORT_LOSS_KINDS = new Set(["peer_closed", "connection_failed", "upgrade_failed", "session_disposed"]);
 
-/** `err` and its `cause` chain, bounded like the SDK's own walk. */
-function* selfAndCauses(err: unknown): Generator<unknown> {
-  let link: unknown = err;
-  for (let depth = 0; link !== null && link !== undefined && depth < 8; depth++) {
-    yield link;
-    link = typeof link === "object" ? (link as { cause?: unknown }).cause : undefined;
-  }
-}
-
 /** Did the container's runtime change under the command? Typed first (the
  *  Durable Object sees the SDK's own classes, so `instanceof` holds here), the
  *  SDK's replacement wording second — the same list the resident Worker
@@ -588,9 +583,20 @@ export class SwitchboardSandbox extends Sandbox<Env> {
     await Promise.race([settled, new Promise<void>((r) => setTimeout(r, maxMs))]);
   }
 
-  /** `du -sk` over the paths, summed, in KiB; null when nothing could be measured. */
+  /** `du -sk` over the paths, summed, in KiB; null when nothing could be
+   *  measured — including a `du` that did not answer inside its own limit
+   *  (a mount mid-restore under load): the judge treats a sample the
+   *  container could not take as no evidence either way, never as the
+   *  restore's failure. The restore's own promise still reports a runtime
+   *  that went away. */
   private async duKiB(paths: string[]): Promise<number | null> {
-    const r = await this.runRoot(["du", "-sk", ...paths], 30_000);
+    let r: { stdout: string; exitCode: number };
+    try {
+      r = await this.runRoot(["du", "-sk", ...paths], 30_000);
+    } catch {
+      return null;
+    }
+    if (r.exitCode === 124) return null;
     let total = 0;
     let seen = false;
     for (const line of r.stdout.split("\n")) {

package/dist/assets/deploy/secrets.manifest.json

@@ -16,6 +16,18 @@
       "workers": ["bot"],
       "note": "Anthropic Console key the bot runs on. Third-party."
     },
+    {
+      "name": "OPENAI_API_KEY",
+      "workers": ["bot"],
+      "optional": true,
+      "note": "OpenAI key for the example config's `openai` provider block (`apiKeyEnv: OPENAI_API_KEY`). Third-party. Optional: read at the first model call on that block, never at load; without it every other block runs and only a run whose model names `openai/…` fails, by this name."
+    },
+    {
+      "name": "OPENROUTER_API_KEY",
+      "workers": ["bot"],
+      "optional": true,
+      "note": "OpenRouter key for the example config's `openrouter` provider block (`apiKeyEnv: OPENROUTER_API_KEY`). Third-party. Optional: read at the first model call on that block, never at load; without it every other block runs and only a run whose model names `openrouter/…` fails, by this name."
+    },
     {
       "name": "ANTHROPIC_ADMIN_KEY",
       "workers": ["bot"],

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.243.0",
+  "version": "1.245.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.243.0",
+      "version": "1.245.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.243.0",
+      "version": "1.245.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.243.0",
+  "version": "1.245.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.243.0",
-  "commit": "abfb780fe3a276f303d13d597ad7c549ba8f49c0",
-  "builtAt": "2026-09-17T07:58:14.271Z"
+  "version": "1.245.0",
+  "commit": "5cc6e0f8a25dfb2406f9248a2245c7412e381da6",
+  "builtAt": "2026-09-17T19:32:54.666Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -145,7 +145,7 @@ export function statusCardRule(examples = '"Implement the fix", "Run the test su
 
 const PR_DESCRIPTION_TEMPLATE = `PR description — submit it with the submit_pr_description tool for EVERY PR (this is the default, not something to wait to be asked for). Switchboard renders the GitHub body from the object you submit, so never author PR-body markdown yourself. Before submitting, judge your title with the ${PR_TITLE_GUARD} gate — \`npm run check:pr-title -- "<title>"\` — and submit only a title it accepts; the same gate refuses the PR in CI. The body is a fixed-size MAP for the reader with everything for agents collapsed under it; every field is capped in visible characters (a link's URL is not counted) and the tool refuses an object over a cap naming the field and the count — cut and resubmit. Prose is unwrapped — no hard line breaks inside a paragraph. Always hyperlink the triggering issue/request. Never fabricate validation — state exactly what you ran and the real result. BEFORE authoring the pointers, load the \`pr-description\` skill with use_skill — it defines how to choose at most seven pointers, the mechanical anchor rules and what goes below the fold; follow it for every PR.
 EVERY PR includes one that already exists when you push — opened by a person, by dependabot, or by an earlier run. After EVERY push to such a PR: read its current title and body (\`github_issue_get\` with the PR number works for pull requests; \`gh pr view\` where gh exists), judge them against the change as it now stands at the pushed head, and submit the object that describes the PR as it is NOW — carry forward what the existing body says that is still true (a dependency bump's release notes belong in why), add what you changed, and anchor the pointers at the new head. Switchboard replaces the PR's title and body with your rendering. A description that describes an earlier state of its branch is a bug; "it is someone else's PR" is never a reason to leave it.
-- **title**: the PR title — one line naming the change, specific enough to pick out of a PR list.
+- **title** (≤72 characters in all): the changelog line — \`type(scope): what a reader can now do or expect\`, one change, one clause, present tense. The type and the scope spend the same budget as the description, so the description is short; the body carries the rest. The tool refuses a longer title naming the count, and so does the gate in CI.
 - **TL;DR** (\`tldr\`, rendered first, ≤300): two sentences for a reader with zero context — what this PR does and why it matters.
 - **Why** (\`why\`, ≤400): the problem and the motivation, with the triggering issue/request, the record and the stack position hyperlinked. Why, never what: the diff shows what.
 - **Where to look** (\`pointers\`, 1 to 7): the files a reviewer would open first, in reading order, each { label ≤60, text ≤160, optional risk ≤100, anchor } with the anchor a { path, from, to } line range at your pushed head, rendered as a link (never embedded code). One pointer per idea, never per file; when the change has more ideas than seven, keep the seven whose mistake would cost most.
@@ -225,7 +225,7 @@ Keep notes with the \`notes\` tool: one short document, replaced whole each time
 // project's most expensive checks first; the rule is the runner's to hold, not
 // a line every requester remembers to paste. Stack-agnostic on purpose — the
 // classes are by duration, the project's own scripts and CI say which is which.
-export const CHECKS_BY_COST = `CHECKS BY COST — push before the expensive ones. Every check you might run has a cost class: seconds (a formatter or a linter on the files you touched, one test file, a docs, link or spec check, the typecheck of one package) or minutes (the whole test suite, a build, a dependency install, an end-to-end or full verification). Know a command's class before you run it — from the project's own scripts and CI configuration, from how long it took last time, or by the class above when you have nothing better. Prove each change with the cheapest check that can prove it, matched to the change's scope: a documentation change gets the documentation checks, one module gets its own tests, a shared type gets the typecheck. As soon as the change exists and those checks pass, commit and push — the pushed branch is the deliverable, and an unpushed tree does not survive the run's end. Only then run the expensive checks, once, and fix forward with further commits and pushes. Never start an operation whose expected duration does not fit the time you have left minus what a commit, a push and the description need: push what there is and say plainly what is unverified instead. The description's validation names exactly what ran; what did not run is CI's to gate, and you say so.`;
+export const CHECKS_BY_COST = `CHECKS BY COST — push before the expensive ones. Every check you might run has a cost class: seconds (a formatter or a linter on the files you touched, one test file, a docs, link or spec check, the typecheck of one package) or minutes (the whole test suite, a build, a dependency install, an end-to-end or full verification). Know a command's class before you run it — from the project's own scripts and CI configuration, from how long it took last time, or by the class above when you have nothing better. Prove each change with the cheapest check that can prove it, matched to the change's scope: a documentation change gets the documentation checks, one module gets its own tests, a shared type gets the typecheck. As soon as the change exists and those checks pass, commit and push — the pushed branch is the deliverable, and an unpushed tree does not survive the run's end. Only then run the expensive checks, once, and fix forward with further commits and pushes. Never start an operation whose expected duration does not fit the time you have left minus what a commit, a push and the description need: push what there is and say plainly what is unverified instead. At the wind-down note, commit and push what compiles, say what does not, then answer. The description's validation names exactly what ran; what did not run is CI's to gate, and you say so.`;
 
 const CODING_SYSTEM = `You are Switchboard's coding agent, operating from a Slack request.
 
@@ -357,9 +357,9 @@ Your final message is posted to Slack — keep it readable, lead with the outcom
 
 // Both review prompts carry this verbatim. The findings contract
 // (docs/reference/specs/agent-ship.md item 6) lives here once — stable ids, the severity
-// vocabulary, the approve-over-blocking downgrade — so the sandbox and
-// resident variants can never drift apart on it.
-const REVIEW_VERDICT_INSTRUCTION = `VERDICT: before your final message, call the submit_verdict tool exactly once with \`approve\` (no blocking issues — nits alone are not blocking) or \`request_changes\`, a one-line summary, \`head\` = the output of \`git rev-parse HEAD\` in the checkout you reviewed, and \`findings\` — every issue you report as a structured entry with a stable id you assign in order (F1, F2, …), a severity of exactly blocking|major|minor|nit, the file (plus line when it points at one), and a one-line title. The findings array is the index of your review: the full explanation of each finding stays in your prose, keyed by the same ids. Switchboard writes the verdict as the first line of the GitHub comment itself and lists the findings under it; a review with no submitted verdict is posted as not approving, so never skip it. An \`approve\` carrying a blocking finding is downgraded to \`request_changes\` — approve only when nothing blocking remains. Do not write "LGTM" in your own text — the verdict line carries it.`;
+// vocabulary, the severity gate's downgrade (agent-review.md item 5a) — so the
+// sandbox and resident variants can never drift apart on it.
+const REVIEW_VERDICT_INSTRUCTION = `VERDICT: before your final message, call the submit_verdict tool exactly once with \`approve\` (no finding at or above the severity to address remains — the level in force for this run, \`minor\` by default: a major or a minor finding means \`request_changes\`; nits alone never block) or \`request_changes\`, a one-line summary, \`head\` = the output of \`git rev-parse HEAD\` in the checkout you reviewed, and \`findings\` — every issue you report as a structured entry with a stable id you assign in order (F1, F2, …), a severity of exactly blocking|major|minor|nit, the file (plus line when it points at one), and a one-line title. The findings array is the index of your review: the full explanation of each finding stays in your prose, keyed by the same ids. Switchboard writes the verdict as the first line of the GitHub comment itself and lists the findings under it; a review with no submitted verdict is posted as not approving, so never skip it. An \`approve\` carrying a finding at or above the severity to address is downgraded to \`request_changes\` and the tool's ack says so — approve only when every finding sits below the level. Do not write "LGTM" in your own text — the verdict line carries it.`;
 
 // The diff-gated spec review (docs/reference/specs/agent-review.md item 14) and
 // the test guard under it (item 16; specs-coverage.md item 6), one text for

package/dist/assets/src/config/profile.ts

@@ -231,7 +231,11 @@ export function boundedByParent(
  *  reply names. */
 export type ProfileRefusal =
   | { axis: "identity"; needs: Identity; cap: Identity; scope: BoundaryScope }
-  | { axis: "machine"; needs: MachineClass; allowed: MachineClass[]; scopes: BoundaryScope[] };
+  | { axis: "machine"; needs: MachineClass; allowed: MachineClass[]; scopes: BoundaryScope[] }
+  /** The minutes axis refuses only under a minimum the caller names (the
+   *  preset's lease minimum, `leaseMinimum` in `src/core/budgets.ts`): a lease
+   *  clipped below it would leave the loop no time at all. */
+  | { axis: "minutes"; needs: number; have: number; scope: BoundaryScope };
 
 /** The effective profile, or the refusal the authorize stage turns into a
  *  named reply. Resolution is pure; the gate judges. */
@@ -252,6 +256,8 @@ export function effectiveProfile(
   preset: Pick<AgentDef, "machine" | "identity" | "maxMinutes">,
   directives: { budget?: number },
   boundary: EffectiveBoundary | undefined,
+  /** The least lease the preset does anything under; absent, the minutes only clip. */
+  minimum?: number,
 ): ProfileResolution {
   if (boundary?.maxIdentity && !identityWithin(preset.identity, boundary.maxIdentity.value)) {
     return {
@@ -285,6 +291,16 @@ export function effectiveProfile(
     minutes = boundary.maxMinutes.value;
     boundedBy = boundary.maxMinutes.scope;
   }
+  // Under the minimum the clip is a refusal, not a run: the write-up and the
+  // post-step take the whole lease and the loop never turns. Attributed to
+  // whatever clipped; a declared ask under its own minimum is the module's
+  // invariant to catch, named as the defaults' here so the switch is total.
+  if (minimum !== undefined && minutes < minimum) {
+    return {
+      kind: "refused",
+      refusal: { axis: "minutes", needs: minimum, have: minutes, scope: boundedBy ?? "defaults" },
+    };
+  }
   return {
     kind: "profile",
     profile: {

package/dist/assets/src/core/authz/types.ts

@@ -66,6 +66,14 @@ export interface Actor {
    * → nothing: fail-closed, exactly today's behaviour.
    */
   readonly memberOf?: ReadonlySet<string>;
+  /**
+   * The person an admin's dashboard session is viewing as (record 0053): set
+   * beside `onBehalfOf` = that person's actor, so the effective grants are the
+   * intersection (the person's) and `self`/`memberOf` are the person's, while
+   * `id` stays the admin's. Identity for the audit line and the banner; the
+   * registry door refuses every non-read effect while it is set. No rule reads it.
+   */
+  readonly viewingAs?: { readonly id: string; readonly name?: string };
 }
 
 /** `<group>:<read|write|exec>` plus the non-command actions. A plain
@@ -196,4 +204,14 @@ export interface ChannelDirectory {
   /** Every channel the actor is in, platform-namespaced — what the resolver puts on
    *  `Actor.memberOf`; `unknown` when the adapter cannot say (fail-closed). */
   channelsOf(actorId: string): Promise<ReadonlySet<string> | "unknown">;
+  /** Every channel the bot itself is in, with its visibility — the channels a person can
+   *  pick a scope or an MCP tier for (settings-page.md item 7); `unknown` when the adapter
+   *  cannot list them, and the surfaces fall back to the channels that already carry a scope. */
+  channels(): Promise<readonly ListedChannel[] | "unknown">;
+}
+
+/** One channel the bot is in, as the directory lists it. */
+export interface ListedChannel {
+  id: string;
+  visibility: ChannelVisibility;
 }

package/dist/assets/src/core/budgets.ts

@@ -18,6 +18,31 @@
 
 export const MINUTE_MS = 60_000;
 
+/** One calendar day in milliseconds: the unit the daily cost and delivery ranges
+ *  step by (`dayOf`, the day count of a range). A day is not a lease, but it is
+ *  a duration, and every duration is read from this table rather than written
+ *  as a literal where it is used. */
+export const DAY_MS = 24 * 60 * MINUTE_MS;
+
+/** How long the confirmation a routed write is offered as stays pending
+ *  (docs/decisions/0044; docs/reference/specs/routing-and-config.md item 25):
+ *  the connect ticket's ten minutes. The bot passes it to the config object,
+ *  which stamps the expiry on its own clock. */
+export const CONFIRMATION_TTL_MS = 10 * MINUTE_MS;
+
+/** How long a dispatch's FIRST attach to a resident — a fresh run's, or a
+ *  resumed run's re-attach to its recorded worktree — waits for the resident
+ *  to wake when the Worker typed its refusal as the platform's transient
+ *  (docs/reference/specs/execution.md item 9): a Durable Object reset or lost
+ *  under the attach clears in seconds, so a minute is generous, and far under
+ *  the wake ceiling a mid-run re-attach may take — the card is silent while
+ *  this wait runs, then names it. It bounds the PROBING: past it no further
+ *  probe is made and, with nothing bound, a fresh run falls cold and a resumed
+ *  run is refused, the wait named either way; a re-attach already opened
+ *  inside it runs to the attach's own timeout. The run's own stop ends any of
+ *  it at once. Read by the executor factory. */
+export const FIRST_ATTACH_WAIT_MS = MINUTE_MS;
+
 /** The presets that run the tool loop, and the one pipeline preset. */
 export const LOOP_PRESETS = ["general", "coding", "review", "research", "explore", "conductor"] as const;
 export type LoopPreset = (typeof LOOP_PRESETS)[number];
@@ -115,6 +140,18 @@ export function postStepLease(preset: string, remainingMs: number | undefined):
   return Math.min(allowance, Math.max(1, remainingMs / MINUTE_MS));
 }
 
+/** The least lease under which a loop-running preset does anything: the
+ *  write-up and the preset's post-step are held back from every lease
+ *  (`loopClock`), so a lease of that sum leaves the loop nothing — the run
+ *  goes straight to its write-up and reports a budget it never had. One minute
+ *  above the sum is the least that runs a turn. A profile clipped under this by
+ *  a directive, a boundary or a parent's remainder is refused at the gate
+ *  naming it, the way a ship round is refused under its floor; the floors are
+ *  the larger numbers a round needs to be worth dispatching. */
+export function leaseMinimum(preset: string): number {
+  return ALLOWANCES.writeUp + postStepMinutes(preset) + 1;
+}
+
 /** A follow-up turn's lease, in ms: the lesser of what it asks and what the
  *  run's lease still holds, never under a minute — the grace covers that floor
  *  when the turn starts by the lease's end; later, the bearer may expire under
@@ -311,3 +348,27 @@ export function fit(pipeline: Pipeline): { ok: boolean; need: number; have: numb
   const need = ALLOWANCES.provision + ASKS.coding + reserveMinutes({ kind: "coding", index: 0 }, pipeline);
   return { ok: pipeline.maxMinutes >= need, need, have: pipeline.maxMinutes };
 }
+
+// ---- the grant (decision 0046, Renewal: the grant decides, the lease continues) ----
+
+/** What the request authorizes for the whole problem beyond one lease: a count
+ *  of renewals and a cost cap in dollars. A lease is sized by the infrastructure
+ *  that must outlive it; the grant is sized by the person — a scope's word or
+ *  the request's `renewals:` directive — and the runner spends it one segment at
+ *  a time. Zero renewals and no cap by default, so nothing renews until someone
+ *  says so; `costCapUsd` absent is no cap, never zero. */
+export interface Grant {
+  renewals: number;
+  costCapUsd?: number;
+}
+
+/** Which layer's word the grant is: the request's directive, the user's scope,
+ *  the channel's, or the org's `ship.grant` — the default counts as the org's. */
+export type GrantSource = "org" | "channel" | "user" | "run";
+
+export const DEFAULT_GRANT: Grant = { renewals: 0 };
+
+/** The most renewals one request may carry: thirteen segments of the ship
+ *  preset's ask are a day, the longest problem a person hands over in one
+ *  message before a plan should carry it. */
+export const GRANT_RENEWALS_MAX = 12;

package/dist/assets/src/core/coordinator/contract.ts

@@ -8,6 +8,7 @@
 // parent record the spawn route reads the requester from, and the names the
 // routes decide on.
 //
+import type { Grant, GrantSource } from "../budgets.js";
 import type { AddressSeverity, AddressSeveritySource } from "../ship/coordinator.js";
 
 // A coordinator is a Workflow instance in the shim Worker whose children are
@@ -181,6 +182,13 @@ export interface CoordinatorInstance {
    *  the machine reads one value; absent reads as the default (`minor`, org). */
   addressSeverity?: AddressSeverity;
   addressSeveritySource?: AddressSeveritySource;
+  /** The grant (decision 0046, the renewable lease): the renewals and cost cap
+   *  the request carries, resolved once by the ship fork (directive count >
+   *  user > channel > org) and written here beside `merge`; absent reads as
+   *  zero renewals and no cap, the org's. Nothing renews until the renewal
+   *  decision reads it. */
+  grant?: Grant;
+  grantSource?: GrantSource;
   /** The pipeline's caps as the profile gate clipped them: the rounds cap and the wall clock per unit. */
   caps?: { maxRounds: number; maxMinutes: number };
   /** The status card in the requesting thread, when the channel has one — what
@@ -195,6 +203,13 @@ export interface CoordinatorInstance {
   attempt?: number;
 }
 
+export interface UnitSegment {
+  index: number;
+  from?: string;
+  runId?: string;
+  at: number;
+}
+
 /** One unit of the plan an instance runs (a task string is a generated plan of
  *  one unit, `U1`): its branch, the units it waits on, and — as the runner
  *  reaches it — its thread, its pull request, the round boundaries the card
@@ -229,6 +244,13 @@ export interface CoordinatorUnit {
    *  opened or updated): the next attempt's pre-check starts at the review
    *  round when the open pull request still heads exactly here. */
   lastPush?: string;
+  /** The renewals the unit spent (decision 0046, Renewal): one row per segment
+   *  the grant opened after the first, keyed by the segment's index — written
+   *  by `unit-end` on a `continued` ending before the segment runs, so a runner
+   *  reclaimed between a segment's end and its renewal finds the row and never
+   *  renews the same segment twice. `from` is the sha the segment continues
+   *  from, `runId` the coding run whose write-up briefs it. */
+  segments?: UnitSegment[];
   /** The round boundaries the coordinator reported, oldest first (the `ship_round` vocabulary). */
   rounds: Array<{ index: number; agent: string; outcome: string; at: number }>;
   /** How the unit ended: the ending's kind and the thread's report, when it has. */
@@ -281,6 +303,15 @@ export function isCoordinatorInstance(v: unknown): v is CoordinatorInstance {
 }
 
 /** Structural check on a unit row from outside the process. */
+const isSegment = (v: unknown): boolean =>
+  isObject(v) &&
+  typeof v.index === "number" &&
+  Number.isInteger(v.index) &&
+  v.index >= 2 &&
+  (v.from === undefined || isText(v.from)) &&
+  (v.runId === undefined || isText(v.runId)) &&
+  typeof v.at === "number";
+
 export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
   if (!isObject(v)) return false;
   const r = v;
@@ -293,6 +324,7 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
   if (r.pr !== undefined && !isPr(r.pr)) return false;
   if (r.resume !== undefined && !isResume(r.resume)) return false;
   if (r.lastPush !== undefined && !isText(r.lastPush)) return false;
+  if (r.segments !== undefined && (!Array.isArray(r.segments) || !r.segments.every(isSegment))) return false;
   if (
     !Array.isArray(r.rounds) ||
     r.rounds.length > MAX_ROUNDS ||

package/dist/assets/src/core/coordinator/driver.ts

@@ -33,6 +33,7 @@
 // plan's re-issue. A task string's ship branch waits for a person. Node-free:
 // the shim Worker imports this by relative path.
 
+import { DEFAULT_GRANT, GRANT_RENEWALS_MAX, type Grant, type GrantSource } from "../budgets.js";
 import {
   applyReturn,
   cursorFinished,
@@ -55,6 +56,8 @@ import {
   type StepReturn,
   type UnitEnding,
   type UnitPipelineState,
+  stepPrefixOf,
+  type UnitSession,
 } from "../ship/coordinator.js";
 import { checksSettledEventType, isCoordinatorUnit, runFinishedEventType, type CoordinatorUnit } from "./contract.js";
 
@@ -164,6 +167,9 @@ interface PlanFacts {
   /** The severity to address, beside `merge`: the level an approve's findings are held to, and which layer set it. */
   addressSeverity: AddressSeverity;
   addressSeveritySource: AddressSeveritySource;
+  /** The grant beside them (decision 0046): what a renewal could spend, and which layer granted it. */
+  grant: Grant;
+  grantSource: GrantSource;
   /** The instance's mark as the plan route answers it: a generated one-unit plan (a `plan` with no `path`). */
   generated: boolean;
   repo: string;
@@ -176,6 +182,21 @@ const isRecord = (v: unknown): v is Record<string, unknown> => typeof v === "obj
 const isMinutes = (v: unknown): v is Record<string, number> =>
   isRecord(v) && Object.values(v).every((n) => typeof n === "number" && Number.isFinite(n));
 
+/** The grant as the plan route answers it; anything unreadable — a count
+ *  outside the module's ceiling included — is the default: nothing renews on a guess. */
+function readGrant(raw: unknown): Grant {
+  if (
+    !isRecord(raw) ||
+    typeof raw.renewals !== "number" ||
+    !Number.isInteger(raw.renewals) ||
+    raw.renewals < 0 ||
+    raw.renewals > GRANT_RENEWALS_MAX
+  )
+    return DEFAULT_GRANT;
+  const cap = raw.costCapUsd;
+  return { renewals: raw.renewals, ...(typeof cap === "number" && cap > 0 ? { costCapUsd: cap } : {}) };
+}
+
 function readPlan(a: BotAnswer): PlanFacts {
   const b = a.body;
   if (b.ok !== true) throw new UnreadableAnswer("plan", a, "not ok");
@@ -192,6 +213,9 @@ function readPlan(a: BotAnswer): PlanFacts {
       b.addressSeveritySource === "run" || b.addressSeveritySource === "user" || b.addressSeveritySource === "channel"
         ? b.addressSeveritySource
         : "org",
+    grant: readGrant(b.grant),
+    grantSource:
+      b.grantSource === "run" || b.grantSource === "user" || b.grantSource === "channel" ? b.grantSource : "org",
     generated: b.generated === true,
     repo: b.repo,
     base: b.base,
@@ -252,6 +276,10 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
     reviewHead,
     dispositions,
     handoff,
+    pushed,
+    leaseStartedAt,
+    costUsd,
+    handoffLists,
   } = facts;
   return {
     type: "read-record",
@@ -269,6 +297,11 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
       ...(reviewHead !== undefined ? { reviewHead } : {}),
       ...(dispositions !== undefined ? { dispositions } : {}),
       ...(handoff !== undefined ? { handoff } : {}),
+      // The renewal's facts (decision 0046), as the record carries them.
+      ...(Array.isArray(pushed) ? { pushed } : {}),
+      ...(typeof leaseStartedAt === "number" ? { leaseStartedAt } : {}),
+      ...(typeof costUsd === "number" || costUsd === null ? { costUsd } : {}),
+      ...(handoffLists !== undefined ? { handoffLists } : {}),
     },
     at: a.body.at,
   };
@@ -457,11 +490,16 @@ async function runUnit(
   instanceId: string,
   node: PlanUnitNode,
   plan: PlanFacts,
+  session?: UnitSession,
 ): Promise<UnitEnding> {
   const unit = node.id;
+  // A renewal's segment names its steps under the segment (`U10/s2/…`), so
+  // the Workflow's durable step cache never answers segment two with segment
+  // one's results (decision 0046).
+  const prefix = stepPrefixOf(unit, session);
   const tag = { parentInstanceId: instanceId, unit };
   const start = readUnitStart(
-    answerOf("unit-start", await step.do(`${unit}/start`, STEP_CONFIG, () => call(bot, "unit-start", tag))),
+    answerOf("unit-start", await step.do(`${prefix}/start`, STEP_CONFIG, () => call(bot, "unit-start", tag))),
   );
   // A resume at review (agent-ship item 10) rides the unit's row: the pull
   // request of ship's own the requester named opens the pipeline at its first
@@ -484,9 +522,12 @@ async function runUnit(
       merge: plan.merge,
       addressSeverity: plan.addressSeverity,
       addressSeveritySource: plan.addressSeveritySource,
+      grant: plan.grant,
+      grantSource: plan.grantSource,
       generated: plan.generated,
       ...(resume !== undefined ? { resume } : {}),
       ...(lastPush !== undefined ? { lastPush } : {}),
+      ...(session !== undefined ? { session } : {}),
     },
     start.at,
   );
@@ -499,7 +540,7 @@ async function runUnit(
     for (const note of transition.notes) {
       if (note.type === "round") {
         const body = { ...tag, index: note.index, agent: note.agent, outcome: note.outcome };
-        await step.do(`${unit}/note/${++notes}`, STEP_CONFIG, () => call(bot, "round", body));
+        await step.do(`${prefix}/note/${++notes}`, STEP_CONFIG, () => call(bot, "round", body));
       } else {
         // A merge_ready ending names the pull request as it is at the APPROVED
         // head (agent-ship item 9): one more pr-check reads the facts fresh —
@@ -511,10 +552,10 @@ async function runUnit(
         if (note.ending.kind === "merge_ready") {
           try {
             const check = prCheckReturn(
-              `${unit}/end/pr-facts`,
+              `${prefix}/end/pr-facts`,
               answerOf(
                 "pr-check",
-                await step.do(`${unit}/end/pr-facts`, STEP_CONFIG, () => call(bot, "pr-check", tag)),
+                await step.do(`${prefix}/end/pr-facts`, STEP_CONFIG, () => call(bot, "pr-check", tag)),
               ),
             );
             if (check.type === "pr-check" && check.pr.state === "merged")
@@ -538,8 +579,20 @@ async function runUnit(
             ? { headSha: note.ending.headSha }
             : {}),
           ...(state.lastCodingRunId !== undefined ? { codingRunId: state.lastCodingRunId } : {}),
+          // A continued ending is a segment's end, not the unit's: the bot
+          // writes the renewal as a row keyed by the next segment's index
+          // (decision 0046), so a runner reclaimed here never renews twice.
+          ...(note.ending.kind === "continued"
+            ? {
+                segment: {
+                  index: note.ending.segment,
+                  ...(note.ending.from !== undefined ? { from: note.ending.from } : {}),
+                  runId: note.ending.runId,
+                },
+              }
+            : {}),
         };
-        await step.do(`${unit}/end`, STEP_CONFIG, () => call(bot, "unit-end", body));
+        await step.do(`${prefix}/end`, STEP_CONFIG, () => call(bot, "unit-end", body));
       }
     }
   }
@@ -573,13 +626,23 @@ async function walk(step: StepRunner, bot: CoordinatorBot, instanceId: string):
     const [next] = readyUnits(graph, cursor);
     if (next === undefined) break;
     cursor = startUnit(graph, cursor, next);
-    const ending = await runUnit(
-      step,
-      bot,
-      instanceId,
-      graph.units.find((u) => u.id === next)!,
-      plan,
-    );
+    const node = graph.units.find((u) => u.id === next)!;
+    let ending = await runUnit(step, bot, instanceId, node, plan);
+    // The lease continues while the grant renews (decision 0046): each
+    // `continued` ending opens the next segment of the same unit — a fresh
+    // pipeline under a fresh lease, from the recorded sha, briefed with the
+    // previous segment's write-up — until the unit ends some other way.
+    while (ending.kind === "continued") {
+      const c = ending;
+      ending = await runUnit(step, bot, instanceId, node, plan, {
+        segment: c.segment,
+        renewalsSpent: c.segment - 1,
+        spendUsd: c.spendUsd,
+        ...(c.from !== undefined ? { continueFrom: c.from } : {}),
+        previousRunId: c.runId,
+        ...(c.handoff !== undefined ? { previousHandoff: c.handoff } : {}),
+      });
+    }
     endings[next] = ending.kind;
     cursor = settleUnit(graph, cursor, next, ending.kind === "merged" ? "done" : "failed");
   }

package/dist/assets/src/core/delivery.ts

@@ -1,4 +1,5 @@
 import { snapshotAgeText } from "./snapshotAge.js";
+import { DAY_MS } from "./budgets.js";
 import { systemClock } from "./trace/clock.js";
 
 // Delivery indicators: what the run history and the pull requests' own facts
@@ -225,7 +226,6 @@ export function weekIncomplete(report: Pick<DeliveryReport, "truncated" | "compl
 
 // ---- the arithmetic ---------------------------------------------------------------------
 
-const DAY_MS = 86_400_000;
 const HOUR_MS = 3_600_000;
 
 /** Add `n` calendar days to a UTC date (`YYYY-MM-DD`). */