@coreplane/switchboard 1.244.0 → 1.246.0

package/dist/assets/src/core/reviewVerdict.ts

@@ -19,19 +19,83 @@
 // a fix round can reference each finding by its stable id and answer it with
 // a typed disposition (`parseDispositionsInput` below). Findings validate
 // fail-closed PER finding — a malformed finding drops with a note, a
-// malformed array drops the whole field — and an `approve` carrying a
-// self-declared `blocking` finding is downgraded to `request_changes`, so the
-// posted body can never begin with `LGTM:` over a defect the reviewer itself
-// called blocking.
+// malformed array drops the whole field.
+//
+// THE SEVERITY GATE (docs/reference/specs/agent-review.md item 5a): an
+// `approve` carrying a finding at or above the severity to address — the
+// level in force for the run, `minor` by default — is downgraded to
+// `request_changes` HERE, where the verdict is parsed, so the posted body can
+// never begin with `LGTM:` over a finding the loop would have to act on. The
+// gate is keyed on the RAW entries' declared severity, so a finding that
+// fails validation for another reason still poisons the approve. The same
+// ladder is what ship's coordinator holds a posted approve to (agent-ship.md
+// item 9) — that check is now defense in depth behind this one.
 
 import { normalizeHead } from "./reviewedHead.js";
 import { redactSecrets } from "./redact.js";
 
 export type ReviewVerdictKind = "approve" | "request_changes";
 
+/** The severity ladder, most to least severe. One list serves the findings a
+ *  reviewer submits and the level the loop addresses: a finding's severity is
+ *  compared to the level in force on this ladder, so nothing outside it can
+ *  reach a gate — the parser drops an entry with any other severity (`fyi`,
+ *  none) with a note. */
 export const FINDING_SEVERITIES = ["blocking", "major", "minor", "nit"] as const;
 export type FindingSeverity = (typeof FINDING_SEVERITIES)[number];
 
+/** The severity to address (the loop's gate on a round): an approve carrying a
+ *  finding at or above this level is not an approve. Resolved once per run —
+ *  the request's `severity:` directive over the user's scope over the
+ *  channel's over the org's `review.addressSeverity` — and handed to the
+ *  verdict parser and ship's coordinator alike. */
+export const ADDRESS_SEVERITIES = FINDING_SEVERITIES;
+export type AddressSeverity = FindingSeverity;
+/** Where the level in force came from, most specific wins: a `severity:`
+ *  directive on the request (`run`), the user's or the channel's config scope,
+ *  the org's `review.addressSeverity` (or its default). */
+export type AddressSeveritySource = "org" | "channel" | "user" | "run";
+export const DEFAULT_ADDRESS_SEVERITY: AddressSeverity = "minor";
+export const isAddressSeverity = (v: unknown): v is AddressSeverity =>
+  (ADDRESS_SEVERITIES as readonly unknown[]).includes(v);
+
+const severityRank = (s: AddressSeverity): number => ADDRESS_SEVERITIES.indexOf(s);
+/** Whether a declared severity sits at or above the level in force on the
+ *  ladder — the one comparison every gate makes. A value outside the ladder is
+ *  never at or above anything. */
+export function severityAtOrAbove(severity: unknown, level: AddressSeverity): severity is AddressSeverity {
+  return isAddressSeverity(severity) && severityRank(severity) <= severityRank(level);
+}
+/** The findings a gate acts on at `level`: at or above it. */
+export function findingsAtOrAbove(findings: readonly Finding[], level: AddressSeverity): Finding[] {
+  return findings.filter((f) => severityAtOrAbove(f.severity, level));
+}
+
+/** The level in force and the layer that set it: the request's
+ *  `severity:` directive wins, then the user's scope, the channel's, the org's
+ *  `review.addressSeverity` — the default counts as the org's. Resolved once
+ *  per run by the dispatcher (every review's verdict parser reads it) and once
+ *  per ship request by the hand-off, which writes it on the instance beside
+ *  `merge` and hands it to each review child as its `severity:` directive. */
+export function resolveAddressSeverity(layers: {
+  org?: AddressSeverity;
+  channel?: AddressSeverity;
+  user?: AddressSeverity;
+  run?: AddressSeverity;
+}): { level: AddressSeverity; source: AddressSeveritySource } {
+  if (layers.run !== undefined) return { level: layers.run, source: "run" };
+  if (layers.user !== undefined) return { level: layers.user, source: "user" };
+  if (layers.channel !== undefined) return { level: layers.channel, source: "channel" };
+  return { level: layers.org ?? DEFAULT_ADDRESS_SEVERITY, source: "org" };
+}
+
+/** The gate's one sentence — `finding(s) <id> (<severity>)[, …] at or above
+ *  <level>, the severity to address` — as the downgraded summary carries it into
+ *  the posted body and the tool's ack repeats it to the model. */
+export function downgradeNote(d: { findings: readonly string[]; level: AddressSeverity }): string {
+  return `finding${d.findings.length === 1 ? "" : "s"} ${d.findings.join(", ")} at or above ${d.level}, the severity to address`;
+}
+
 export interface Finding {
   /** Stable id the reviewer assigned in order ("F1", "F2", …) — dispositions
    *  reference findings by this id. */
@@ -63,50 +127,63 @@ export interface ReviewVerdict {
    *  reasons) — surfaced in the tool ack so the model can resubmit, never
    *  rendered into the posted body. */
   droppedFindings?: string[];
+  /** Parse note: the approve was downgraded by the severity gate — the gated
+   *  findings as `id (severity)` and the level in force. Surfaced in the tool
+   *  ack so the model knows its verdict changed; the summary carries the same
+   *  words into the posted body, so this never rides a record. */
+  downgraded?: { findings: string[]; level: AddressSeverity };
 }
 
 export const LGTM_TOKEN = "LGTM:";
 export const CHANGES_TOKEN = "Changes requested:";
 export const NO_VERDICT_LINE = "No verdict submitted — not approving.";
 
-/** Parse an arbitrary tool input into a verdict, or null when it is not one. */
-export function parseVerdictInput(input: Record<string, unknown>): ReviewVerdict | null {
+/** Parse an arbitrary tool input into a verdict, or null when it is not one.
+ *  `addressSeverity` is the level in force for the run (default `minor`): an
+ *  approve carrying a finding at or above it is parsed as `request_changes`. */
+export function parseVerdictInput(
+  input: Record<string, unknown>,
+  opts: { addressSeverity?: AddressSeverity } = {},
+): ReviewVerdict | null {
   const verdict = input.verdict;
   if (verdict !== "approve" && verdict !== "request_changes") return null;
+  const level = opts.addressSeverity ?? DEFAULT_ADDRESS_SEVERITY;
   const summary = typeof input.summary === "string" ? oneLine(input.summary) : "";
   const head = normalizeHead(input.head);
   const out: ReviewVerdict = { verdict, summary };
   if (head) out.head = head;
   if (input.findings !== undefined) {
-    const parsed = parseFindings(input.findings);
+    const parsed = parseFindings(input.findings, level);
     if (parsed.findings) out.findings = parsed.findings;
     if (parsed.dropped.length) out.droppedFindings = parsed.dropped;
-    // Verdict/severity consistency, fail-closed: an approve carrying a
-    // blocking finding downgrades so the posted body can never start with
-    // `LGTM:` over a self-declared blocking defect. Keyed on the RAW entries'
-    // declared severity, not the validated survivors — a blocking entry that
-    // itself failed validation and dropped still poisons the approve.
-    if (out.verdict === "approve" && parsed.blocking.length > 0) {
+    // The severity gate, fail-closed: an approve carrying a finding at or
+    // above the level in force downgrades, so the posted body can never start
+    // with `LGTM:` over a finding the loop has to address. Keyed on the RAW
+    // entries' declared severity, not the validated survivors — a gated entry
+    // that itself failed validation and dropped still poisons the approve.
+    if (out.verdict === "approve" && parsed.gated.length > 0) {
       out.verdict = "request_changes";
-      out.summary = oneLine(
-        `${out.summary} [downgraded from approve: blocking finding${parsed.blocking.length === 1 ? "" : "s"} ${parsed.blocking.join(", ")}]`,
-      );
+      out.downgraded = { findings: parsed.gated, level };
+      out.summary = oneLine(`${out.summary} [downgraded from approve: ${downgradeNote(out.downgraded)}]`);
     }
   }
   return out;
 }
 
 /** Fail-closed per finding: each malformed entry drops with a note naming its
- *  index (and id when readable); a non-array drops the whole field.
- *  `blocking` labels every raw entry that declared severity "blocking" —
- *  valid or not — for the approve downgrade above. */
-function parseFindings(value: unknown): { findings?: Finding[]; dropped: string[]; blocking: string[] } {
+ *  index (and id when readable); a non-array drops the whole field. `gated`
+ *  labels every raw entry whose declared severity sits at or above `level` —
+ *  valid or not — as `id (severity)`, for the approve downgrade above. */
+function parseFindings(
+  value: unknown,
+  level: AddressSeverity,
+): { findings?: Finding[]; dropped: string[]; gated: string[] } {
   if (!Array.isArray(value)) {
-    return { dropped: ["findings: dropped — not an array"], blocking: [] };
+    return { dropped: ["findings: dropped — not an array"], gated: [] };
   }
   const findings: Finding[] = [];
   const dropped: string[] = [];
-  const blocking: string[] = [];
+  const gated: string[] = [];
   value.forEach((raw, i) => {
     const parsed = parseFinding(raw);
     if (parsed.finding) {
@@ -116,9 +193,9 @@ function parseFindings(value: unknown): { findings?: Finding[]; dropped: string[
     }
     const label = parsed.finding?.id ?? parsed.id ?? `findings[${i}]`;
     const r = typeof raw === "object" && raw !== null ? (raw as Record<string, unknown>) : undefined;
-    if (r?.severity === "blocking") blocking.push(label);
+    if (severityAtOrAbove(r?.severity, level)) gated.push(`${label} (${r?.severity})`);
   });
-  return { findings, dropped, blocking };
+  return { findings, dropped, gated };
 }
 
 function parseFinding(
@@ -170,14 +247,146 @@ export function formatDisposition(d: FindingDisposition): string {
   return `${d.findingId}: ${d.disposition}${d.note ? ` — ${d.note}` : ""}`;
 }
 
+/** Where the posted body's file links point: the PR's repository and the
+ *  head the review is pinned to (the post-step's `commitId`). */
+export interface ReviewBodyTarget {
+  /** `owner/name` */
+  repo: string;
+  /** The pinned head, full sha. */
+  head: string;
+}
+
+/** The verdict word the callout carries, per verdict kind (or its absence). */
+function verdictWord(verdict: ReviewVerdict | undefined): string {
+  if (!verdict) return "No verdict";
+  return verdict.verdict === "approve" ? "Approved" : "Changes requested";
+}
+
+/** GitHub's alert callout kind per verdict: an approve is a note, changes
+ *  requested a warning, a missing verdict a caution. */
+function calloutKind(verdict: ReviewVerdict | undefined): "NOTE" | "WARNING" | "CAUTION" {
+  if (!verdict) return "CAUTION";
+  return verdict.verdict === "approve" ? "NOTE" : "WARNING";
+}
+
+/** `2 findings: 1 minor, 1 nit` — counted on the ladder, most severe first;
+ *  an empty array is `no findings`, no array `findings not itemized`. */
+function findingCounts(findings: readonly Finding[] | undefined): string {
+  if (findings === undefined) return "findings not itemized";
+  if (findings.length === 0) return "no findings";
+  const by = FINDING_SEVERITIES.map((sev) => [sev, findings.filter((f) => f.severity === sev).length] as const)
+    .filter(([, n]) => n > 0)
+    .map(([sev, n]) => `${n} ${sev}`)
+    .join(", ");
+  return `${findings.length} finding${findings.length === 1 ? "" : "s"}: ${by}`;
+}
+
+/** A table cell: pipes escaped so the row holds, already one line. */
+const cell = (text: string): string => oneLine(text).replace(/\|/g, "\\|");
+
+/** Whether a finding's `file` is a path a blob URL can point at: no
+ *  whitespace, no backtick, not a URL. */
+const isRepoPath = (file: string): boolean => /^[^\s`]+$/.test(file) && !/^[a-z][a-z0-9+.-]*:\/\//i.test(file);
+
+/** The `Where` cell: the location in code, linked at the pinned head when the
+ *  file is a path and a target is known. */
+function whereCell(f: Finding, target: ReviewBodyTarget | undefined): string {
+  const location = f.line !== undefined ? `${f.file}:${f.line}` : f.file;
+  const label = `\`${cell(location)}\``;
+  if (!target || !isRepoPath(f.file)) return label;
+  const path = encodeURI(f.file).replace(/#/g, "%23").replace(/\?/g, "%3F");
+  const url = `https://github.com/${target.repo}/blob/${target.head}/${path}${f.line !== undefined ? `#L${f.line}` : ""}`;
+  return `[${label}](${url})`;
+}
+
+/** The machine-readable marker the body ends with — the verdict, the head and
+ *  the findings index as JSON inside an HTML comment, for a scanner that would
+ *  otherwise parse the token line. `-->` can never occur inside it. */
+function verdictMarker(verdict: ReviewVerdict | undefined, target: ReviewBodyTarget | undefined): string {
+  const head = target?.head ?? verdict?.head;
+  const payload = {
+    verdict: verdict?.verdict ?? "none",
+    ...(head ? { head } : {}),
+    ...(verdict?.findings
+      ? {
+          findings: verdict.findings.map((f) => ({
+            id: f.id,
+            severity: f.severity,
+            file: f.file,
+            ...(f.line !== undefined ? { line: f.line } : {}),
+          })),
+        }
+      : {}),
+  };
+  return `<!-- switchboard:verdict ${JSON.stringify(payload).replace(/-->/g, "--\\u003e")} -->`;
+}
+
+/**
+ * Build the body posted to GitHub, rendered from the typed verdict
+ * (docs/reference/specs/agent-review.md item 5b): the deterministic verdict
+ * line first (the auto-approve contract — never `LGTM:` unless the verdict is
+ * `approve`), a GitHub alert callout with the verdict word, the pinned head
+ * and the finding counts, the findings as a table (severity, id + title, the
+ * file linked at the head), the model's text folded under `Full review`, and
+ * the machine-readable marker last. The prose decides nothing above the fold.
+ */
+export function buildReviewPostBody(
+  answer: string,
+  verdict: ReviewVerdict | undefined,
+  target?: ReviewBodyTarget,
+): string {
+  const facts = [
+    `**${verdictWord(verdict)}**`,
+    ...(target ? [`head \`${target.head.slice(0, 7)}\``] : []),
+    verdict ? findingCounts(verdict.findings) : "the run ended without a submit_verdict call",
+  ];
+  const parts: string[] = [verdictLine(verdict), `> [!${calloutKind(verdict)}]\n> ${facts.join(" · ")}`];
+  const findings = verdict?.findings ?? [];
+  if (findings.length > 0) {
+    parts.push(
+      [
+        "| Severity | Finding | Where |",
+        "| --- | --- | --- |",
+        ...findings.map((f) => `| ${f.severity} | **${cell(f.id)}** ${cell(f.title)} | ${whereCell(f, target)} |`),
+      ].join("\n"),
+    );
+  }
+  const prose = answer.trim();
+  if (prose) parts.push(`<details>\n<summary>Full review</summary>\n\n${prose}\n\n</details>`);
+  parts.push(verdictMarker(verdict, target));
+  return parts.join("\n\n");
+}
+
 /**
- * Build the body posted to GitHub: the deterministic verdict line, the
- * compact findings list (when present), a blank line, then the model's
- * review text. Never starts with "LGTM" unless the verdict is `approve`.
+ * The channel reply for a review run, rendered from the typed verdict
+ * (agent-review.md item 5b): the verdict line, one bullet per finding, then
+ * where the review was posted and the run link. The model's write-up rides
+ * along only when it landed nowhere else — no GitHub post (Slack-only, an
+ * opt-out, a guard refusal) or findings not itemized (a list that says
+ * nothing is no substitute) — so the review's text is always somewhere a
+ * person reads it. No verdict → the bare answer with the link, as before.
  */
-export function buildReviewPostBody(answer: string, verdict: ReviewVerdict | undefined): string {
-  const head = [verdictLine(verdict), ...(verdict?.findings ?? []).map((f) => `- ${formatFinding(f)}`)];
-  return `${head.join("\n")}\n\n${answer.trim()}`;
+export function buildReviewChannelReply(input: {
+  answer: string;
+  verdict: ReviewVerdict | undefined;
+  /** The PR the post landed on, or undefined when nothing was posted. */
+  posted: { repo: string; number: number } | undefined;
+  liveUrl: string | undefined;
+}): string {
+  const { answer, verdict, posted, liveUrl } = input;
+  const tail = [
+    ...(posted && verdict ? [`Posted to ${posted.repo}#${posted.number}`] : []),
+    ...(liveUrl ? [`[Live run](${liveUrl})`] : []),
+  ].join(" · ");
+  const blocks: string[] = [];
+  if (!verdict) blocks.push(answer);
+  else {
+    blocks.push([verdictLine(verdict), ...(verdict.findings ?? []).map((f) => `- ${formatFinding(f)}`)].join("\n"));
+    const compact = posted !== undefined && verdict.findings !== undefined;
+    if (!compact && answer.trim()) blocks.push(answer.trim());
+  }
+  if (tail) blocks.push(tail);
+  return blocks.join("\n\n");
 }
 
 // --- Dispositions (the coding side's answer to findings) -------------------

package/dist/assets/src/core/runEvents.ts

@@ -94,6 +94,10 @@ export type RunNoteKind =
   | "sandbox_restarted"
   | "stop_requested"
   | "stopped"
+  /** A stop the loop or turn had to ask pi for again reached it: the series a
+   *  failed abort's write opened (its `harness_error` line) closes here with
+   *  the count of re-asks (harness-pi item 16). Written by the pi harness. */
+  | "stop_landed"
   /** Setup spans the request's stream sink had to drop before this run was
    *  bound (docs/reference/specs/tracing.md): `summary` says how many, `from`/`to` the
    *  interval, which the partition reports as not recorded. */
@@ -142,6 +146,16 @@ export type RunNoteKind =
    *  after the attach, before the first turn, so the run page explains a
    *  sandbox run that shows resident steps. */
   | "cold_sandbox"
+  /** The run ledger would not track this run (docs/reference/specs/run-history.md
+   *  item 54): its reservation met the row of a run this process was closing
+   *  (a restart from its request, or the fresh turn for its follow-ups), waited
+   *  for that finish, and the row still stood — the finish failed or was
+   *  refused — so no handoff, resume or reclaim reaches this run, and its
+   *  record reaches the store when it finishes. The summary names that run and
+   *  how its finish ended; published by the dispatcher right after the
+   *  reservation, before the attach, and carried on the card's label — the bot
+   *  log's warning is not the only witness. */
+  | "ledger_untracked"
   /** The resident kept this thread's binding where it was instead of moving
    *  it onto the branch the thread's own run opened a pull request on
    *  (docs/reference/specs/resident-repos.md item 16): the summary names the
@@ -158,6 +172,13 @@ export type RunNoteKind =
    *  after the model's last turn — the release itself runs after the record
    *  is sealed — and set on the card's label too, so the loss is never silent. */
   | "work_left_behind"
+  /** The run's ending may have left a command running in its workspace — a
+   *  call cut by the ending's abort or interrupt, or open when the run failed —
+   *  so the release tears the workspace down rather than pair it for the
+   *  thread's next run (harness.md item 13). The summary names the calls.
+   *  Written by the run loop once the harness session has ended and before the
+   *  record is sealed; the release itself runs after. */
+  | "workspace_torn_down"
   /** A coding run submitted a PR description but the post-step opened no
    *  pull request because the branch it observed IS the base the pull
    *  request would target (docs/reference/specs/pr-description.md item 5) —
@@ -210,11 +231,20 @@ export type RunNoteKind =
    *  names the call and the step. Information, not a failure: the tool ran
    *  under the gate's decision either way. Published by the OpenCode bridge. */
   | "tool_unnamed"
+  /** An `external_directory` ask answered once its call's line was already on
+   *  the record (harness.md item 13): the line cannot be amended, so the
+   *  directory the call reached is said here, naming the call. Published by
+   *  the OpenCode bridge. */
+  | "directory_reached"
   /** A ship coding child's budget ended with work still in the tree: the run
    *  loop committed and pushed it to the unit's branch (or says plainly that
    *  there was nothing to push), so a re-issue starts from the partial work
    *  (docs/reference/specs/agent-ship.md item 8). */
   | "budget_salvage"
+  /** The loop's end found a tool call in flight and ended it, so the write-up
+   *  keeps its allowance (decision 0046, unit seven; harness-pi item 6). The
+   *  summary names the tools. Published by the harness beside the budget note. */
+  | "tool_cut"
   /** The native loop's stuck-loop guard: the same tool call failed identically
    *  six times in a row and the run was forced into its write-up. Written by
    *  no loop since that loop's deletion; a record from before it may carry it. */
@@ -225,12 +255,14 @@ export type RunNoteKind =
 export const RUN_NOTE_KINDS = [
   "wrap_up",
   "time_budget_exhausted",
+  "tool_cut",
   "turn_budget_exhausted",
   "sandbox_dead",
   "fleet_busy",
   "sandbox_restarted",
   "stop_requested",
   "stopped",
+  "stop_landed",
   "spans_dropped",
   "head_moved",
   "run_failed",
@@ -241,8 +273,10 @@ export const RUN_NOTE_KINDS = [
   "description_turn",
   "verdict_turn",
   "cold_sandbox",
+  "ledger_untracked",
   "rebind_refused",
   "work_left_behind",
+  "workspace_torn_down",
   "pr_not_opened",
   "review_not_posted",
   "compacted",
@@ -251,6 +285,7 @@ export const RUN_NOTE_KINDS = [
   "tool_refused",
   "settle_set_aside",
   "tool_unnamed",
+  "directory_reached",
   "budget_salvage",
   "stuck_loop",
 ] as const satisfies readonly RunNoteKind[];
@@ -354,6 +389,7 @@ export function isHeadMaterial(event: RunEvent): boolean {
         event.kind === "mcp_unavailable" ||
         event.kind === "spans_dropped" ||
         event.kind === "cold_sandbox" ||
+        event.kind === "ledger_untracked" ||
         event.kind === "rebind_refused"
       );
     case "span_start":
@@ -460,7 +496,12 @@ export type RunEvent =
    *  executors' shared `exit N:` prefix, 0 for a clean run; absent when the code
    *  was not numeric). `output` is the tool's text — control-stripped, redacted,
    *  capped at TOOL_OUTPUT_CAP — for the run page's expandable card; the status
-   *  card and the friction analyzer keep reading `summary`. */
+   *  card and the friction analyzer keep reading `summary`. `cut` marks the
+   *  result of a call the run's ending cut rather than settled — pi's abort (the
+   *  tool's own end after it), OpenCode's interrupt (a call still open when its
+   *  loop left), a session's end (`closeOpenSpans`): the command behind it may
+   *  still be running, and the workspace's release reads it so (`callsInFlight`,
+   *  harness.md item 13). */
   | {
       type: "tool_result";
       tool: string;
@@ -470,6 +511,7 @@ export type RunEvent =
       exitCode?: number;
       output?: string;
       infra?: true;
+      cut?: true;
       spanId?: string;
       logIndex?: number;
       seq?: number;
@@ -769,7 +811,18 @@ export type RunEvent =
    *  round and its fix round share an index. Published by the ship pipeline
    *  straight to the registry (like `pr_opened`), never through the runner.
    *  Additive: unknown → ignored. */
-  | { type: "ship_round"; index: number; agent: string; outcome: ShipRoundOutcome; seq?: number; at?: number }
+  | {
+      type: "ship_round";
+      index: number;
+      agent: string;
+      outcome: ShipRoundOutcome;
+      /** The severity gate fired on this approve (agent-ship item 9): the level
+       *  in force and the gated findings as `id (severity)` — a mismatch the
+       *  child's own parser should have made impossible, kept visible. */
+      gate?: { level: string; findings: string[] };
+      seq?: number;
+      at?: number;
+    }
   /** The request router's decision (docs/reference/specs/routing-and-config.md
    *  item 21): the preset a plain message was routed to, the one-line reason
    *  the router gave (redacted, capped — the same text the card's `routed:`

package/dist/assets/src/core/runRecord.ts

@@ -291,6 +291,62 @@ export function pushedBranchesOf(events: readonly RunEvent[]): PushedBranch[] {
   return [...byRef].map(([ref, pr]) => ({ ref, pr }));
 }
 
+/** A call a run's ending may have left running in its workspace (harness.md
+ *  item 13): the id the record pairs by, the tool, and the line the
+ *  `workspace_torn_down` note names it by — the `tool_call`'s own summary
+ *  while the record holds it, else the tool and the id. */
+export interface CallInFlight {
+  callId: string;
+  tool: string;
+  summary: string;
+}
+
+/** The tool calls a run's ending may have left running in its workspace, in
+ *  the record's order — what the workspace's release reads to tear the
+ *  workspace down rather than wait for an idle the command would refuse, and
+ *  what its note names (harness.md item 13). A call whose result is marked
+ *  `cut` — pi's abort, OpenCode's interrupt, a session's end — was ended, not
+ *  settled, whatever the run's status, and stays cut whatever lands for it
+ *  later — an unmarked result (a post-turn's bridge reads the earlier
+ *  execution's aborted settle as its own), or the call announced again under
+ *  the same id; a call with no result at all was left open by a run that
+ *  failed, was interrupted or hard-stopped, while on a run that completed or
+ *  stopped softly it is a relayed tool that ran in the bot or a result lost to
+ *  a transport gap, nothing running. Calls and results pair by id. The events
+ *  are the registry's bounded backlog (`runRegistry/backlog.ts` drops the
+ *  oldest past its count or byte bound), so on a long run the line of a
+ *  command that hung early may be gone while its cut result — the ending's,
+ *  landing last — survives: a cut result for a call the record no longer
+ *  holds is the harness's own word that the call was ended and not settled,
+ *  and counts by itself, named by its tool and id; an unmarked result for a
+ *  call never opened counts for nothing. */
+export function callsInFlight(events: readonly RunEvent[], status: RunStatus): CallInFlight[] {
+  const calls = new Map<string, { call: CallInFlight; state: "open" | "cut" | "settled" }>();
+  for (const e of events) {
+    if (e.type === "tool_call" && e.callId !== undefined) {
+      const seen = calls.get(e.callId);
+      if (seen?.state === "cut") {
+        // Announced again after its cut — or after an orphan cut, the line the
+        // backlog evicted now written again: the line is the record's, the
+        // state stays the cut's.
+        seen.call.tool = e.tool;
+        seen.call.summary = e.summary;
+      } else calls.set(e.callId, { call: { callId: e.callId, tool: e.tool, summary: e.summary }, state: "open" });
+    } else if (e.type === "tool_result" && e.callId !== undefined) {
+      const seen = calls.get(e.callId);
+      if (seen === undefined) {
+        if (e.cut === true)
+          calls.set(e.callId, {
+            call: { callId: e.callId, tool: e.tool, summary: `${e.tool} (call ${e.callId})` },
+            state: "cut",
+          });
+      } else if (seen.state !== "cut") seen.state = e.cut === true ? "cut" : "settled";
+    }
+  }
+  const orderly = status === "completed" || status === "stopped_soft";
+  return [...calls.values()].filter((c) => c.state === "cut" || (c.state === "open" && !orderly)).map((c) => c.call);
+}
+
 /** The router's decision as a record carries it — the same fields the
  *  `route` event and the ledger row's `meta.route` carry (routing-and-config
  *  item 21). */

package/dist/assets/src/core/ship/coordinator.ts

@@ -34,7 +34,18 @@ import type { Handoff } from "./handoff.js";
 import { progressOf, renderRenewal, renewalDecision, type PushedHeadFact, type RenewalDecision } from "./renewal.js";
 import type { RunStatus } from "../runRecord.js";
 import { normalizeHead, sameCommit } from "../reviewedHead.js";
-import { formatFinding, type Finding, type FindingDisposition, type ReviewVerdictKind } from "../reviewVerdict.js";
+import {
+  ADDRESS_SEVERITIES,
+  DEFAULT_ADDRESS_SEVERITY,
+  findingsAtOrAbove,
+  formatFinding,
+  isAddressSeverity,
+  type AddressSeverity,
+  type AddressSeveritySource,
+  type Finding,
+  type FindingDisposition,
+  type ReviewVerdictKind,
+} from "../reviewVerdict.js";
 import { parsePlanUnit, planUnitIds } from "./contract.js";
 import {
   carve,
@@ -589,8 +600,22 @@ export type UnitEnding =
 /** What a transition tells the driver beyond the next action: a round boundary
  *  the card draws (`shipRoundHeader`) and the run stream records, and the end. */
 export type CoordinatorNote =
-  | { type: "round"; index: number; agent: ChildPreset; outcome: ShipRoundOutcome }
+  | {
+      type: "round";
+      index: number;
+      agent: ChildPreset;
+      outcome: ShipRoundOutcome;
+      /** The severity gate fired on this approve (agent-ship item 9): the
+       *  findings at or above the level in force, as `id (severity)`. The
+       *  child's own verdict parser holds an approve to the same level
+       *  (agent-review item 5a), so this should never be set — when it is, the
+       *  verdict was parsed at another level (a lost directive, an older
+       *  record, a harness around `submit_verdict`) and the row, the card and
+       *  the log say so instead of routing silently into the findings step. */
+      gate?: { level: AddressSeverity; findings: string[] };
+    }
   | { type: "ended"; ending: UnitEnding };
+type RoundNote = Extract<CoordinatorNote, { type: "round" }>;
 
 /** How the pipeline's budget went, in ms: the coding rounds' (round 0 and the
  *  findings steps), the review rounds', and everything else (branching,
@@ -598,26 +623,19 @@ export type CoordinatorNote =
  *  person can see whether the cap or the child is the problem. */
 export type ShipBudgetSpent = Readonly<Record<"coding" | "review" | "waiting", number>>;
 
-/** The severity ship must address before an approve stands (agent-ship item
- *  9's gate): an approve carrying a finding at or above this level continues
- *  into the findings step exactly as a request_changes does. Ordered most to
- *  least severe. */
-export const ADDRESS_SEVERITIES = ["blocking", "major", "minor", "nit"] as const;
-export type AddressSeverity = (typeof ADDRESS_SEVERITIES)[number];
-/** Where the level in force came from, most specific wins: a `severity:` directive on the request (`run`), the user's or the channel's config scope, the org's `ship.addressSeverity` (or its default). */
-export type AddressSeveritySource = "org" | "channel" | "user" | "run";
-export const DEFAULT_ADDRESS_SEVERITY: AddressSeverity = "minor";
-export const isAddressSeverity = (v: unknown): v is AddressSeverity =>
-  (ADDRESS_SEVERITIES as readonly unknown[]).includes(v);
-
-const severityRank = (s: AddressSeverity): number => ADDRESS_SEVERITIES.indexOf(s);
-/** The findings the gate acts on at `level`: at or above it. Every parsed
- *  finding carries one of the ladder's four levels — the verdict parser
- *  (`parseVerdictInput`) drops an entry with any other severity, `fyi` or none,
- *  with a note — so nothing outside the ladder ever reaches the gate. */
-export function findingsAtOrAbove(findings: readonly Finding[], level: AddressSeverity): Finding[] {
-  return findings.filter((f) => severityRank(f.severity) <= severityRank(level));
-}
+// The severity to address (agent-ship item 9's gate) is the verdict parser's
+// ladder (src/core/reviewVerdict.ts): the same level the parser holds a
+// submitted approve to, so a posted approve can carry a gated finding only
+// when it was parsed at a different level — the check below is defense in
+// depth behind the parser's. Re-exported here for the runner's callers.
+export {
+  ADDRESS_SEVERITIES,
+  DEFAULT_ADDRESS_SEVERITY,
+  findingsAtOrAbove,
+  isAddressSeverity,
+  type AddressSeverity,
+  type AddressSeveritySource,
+};
 
 export interface UnitSession {
   segment: number;
@@ -935,7 +953,10 @@ function end(s: UnitPipelineState, ending: UnitEnding, notes: CoordinatorNote[]
   return { state: { ...s, phase: ENDED, ending }, notes: [...notes, { type: "ended", ending }] };
 }
 
-const roundNote = (round: RoundRef, outcome: ShipRoundOutcome): CoordinatorNote => ({
+/** A gated finding as the gate note names it: `F1 (minor)`. */
+const gateLabel = (f: Finding): string => `${f.id} (${f.severity})`;
+
+const roundNote = (round: RoundRef, outcome: ShipRoundOutcome): RoundNote => ({
   type: "round",
   index: round.index,
   agent: presetOf(round.kind),
@@ -1110,6 +1131,10 @@ function settleReview(
     const level = next.input.addressSeverity ?? DEFAULT_ADDRESS_SEVERITY;
     const gated = findingsAtOrAbove(verdict.findings, level);
     if (gated.length > 0) {
+      // The gate fired — which the child's parser should have made impossible
+      // (agent-review item 5a): the round note carries what it caught, so the
+      // mismatch is seen and not just routed around.
+      notes[0] = { ...roundNote(round, verdict.verdict), gate: { level, findings: gated.map(gateLabel) } };
       if (mode !== undefined)
         return end(
           next,