@coreplane/switchboard 1.245.0 → 1.246.0

package/dist/assets/src/core/runRecord.ts

@@ -291,6 +291,16 @@ export function pushedBranchesOf(events: readonly RunEvent[]): PushedBranch[] {
   return [...byRef].map(([ref, pr]) => ({ ref, pr }));
 }
 
+/** A call a run's ending may have left running in its workspace (harness.md
+ *  item 13): the id the record pairs by, the tool, and the line the
+ *  `workspace_torn_down` note names it by — the `tool_call`'s own summary
+ *  while the record holds it, else the tool and the id. */
+export interface CallInFlight {
+  callId: string;
+  tool: string;
+  summary: string;
+}
+
 /** The tool calls a run's ending may have left running in its workspace, in
  *  the record's order — what the workspace's release reads to tear the
  *  workspace down rather than wait for an idle the command would refuse, and
@@ -299,26 +309,38 @@ export function pushedBranchesOf(events: readonly RunEvent[]): PushedBranch[] {
  *  settled, whatever the run's status, and stays cut whatever lands for it
  *  later — an unmarked result (a post-turn's bridge reads the earlier
  *  execution's aborted settle as its own), or the call announced again under
- *  the same id; a call with no result at
- *  all was left open by a run that failed, was interrupted or hard-stopped,
- *  while on a run that completed or stopped softly it is a relayed tool that
- *  ran in the bot or a result lost to a transport gap, nothing running. Calls
- *  and results pair by id; a result for a call the record never opened counts
- *  for nothing. */
-export function callsInFlight(
-  events: readonly RunEvent[],
-  status: RunStatus,
-): Extract<RunEvent, { type: "tool_call" }>[] {
-  const calls = new Map<
-    string,
-    { call: Extract<RunEvent, { type: "tool_call" }>; state: "open" | "cut" | "settled" }
-  >();
+ *  the same id; a call with no result at all was left open by a run that
+ *  failed, was interrupted or hard-stopped, while on a run that completed or
+ *  stopped softly it is a relayed tool that ran in the bot or a result lost to
+ *  a transport gap, nothing running. Calls and results pair by id. The events
+ *  are the registry's bounded backlog (`runRegistry/backlog.ts` drops the
+ *  oldest past its count or byte bound), so on a long run the line of a
+ *  command that hung early may be gone while its cut result — the ending's,
+ *  landing last — survives: a cut result for a call the record no longer
+ *  holds is the harness's own word that the call was ended and not settled,
+ *  and counts by itself, named by its tool and id; an unmarked result for a
+ *  call never opened counts for nothing. */
+export function callsInFlight(events: readonly RunEvent[], status: RunStatus): CallInFlight[] {
+  const calls = new Map<string, { call: CallInFlight; state: "open" | "cut" | "settled" }>();
   for (const e of events) {
     if (e.type === "tool_call" && e.callId !== undefined) {
-      if (calls.get(e.callId)?.state !== "cut") calls.set(e.callId, { call: e, state: "open" });
+      const seen = calls.get(e.callId);
+      if (seen?.state === "cut") {
+        // Announced again after its cut — or after an orphan cut, the line the
+        // backlog evicted now written again: the line is the record's, the
+        // state stays the cut's.
+        seen.call.tool = e.tool;
+        seen.call.summary = e.summary;
+      } else calls.set(e.callId, { call: { callId: e.callId, tool: e.tool, summary: e.summary }, state: "open" });
     } else if (e.type === "tool_result" && e.callId !== undefined) {
       const seen = calls.get(e.callId);
-      if (seen !== undefined && seen.state !== "cut") seen.state = e.cut === true ? "cut" : "settled";
+      if (seen === undefined) {
+        if (e.cut === true)
+          calls.set(e.callId, {
+            call: { callId: e.callId, tool: e.tool, summary: `${e.tool} (call ${e.callId})` },
+            state: "cut",
+          });
+      } else if (seen.state !== "cut") seen.state = e.cut === true ? "cut" : "settled";
     }
   }
   const orderly = status === "completed" || status === "stopped_soft";

package/dist/assets/src/core/ship/coordinator.ts

@@ -600,8 +600,22 @@ export type UnitEnding =
 /** What a transition tells the driver beyond the next action: a round boundary
  *  the card draws (`shipRoundHeader`) and the run stream records, and the end. */
 export type CoordinatorNote =
-  | { type: "round"; index: number; agent: ChildPreset; outcome: ShipRoundOutcome }
+  | {
+      type: "round";
+      index: number;
+      agent: ChildPreset;
+      outcome: ShipRoundOutcome;
+      /** The severity gate fired on this approve (agent-ship item 9): the
+       *  findings at or above the level in force, as `id (severity)`. The
+       *  child's own verdict parser holds an approve to the same level
+       *  (agent-review item 5a), so this should never be set — when it is, the
+       *  verdict was parsed at another level (a lost directive, an older
+       *  record, a harness around `submit_verdict`) and the row, the card and
+       *  the log say so instead of routing silently into the findings step. */
+      gate?: { level: AddressSeverity; findings: string[] };
+    }
   | { type: "ended"; ending: UnitEnding };
+type RoundNote = Extract<CoordinatorNote, { type: "round" }>;
 
 /** How the pipeline's budget went, in ms: the coding rounds' (round 0 and the
  *  findings steps), the review rounds', and everything else (branching,
@@ -939,7 +953,10 @@ function end(s: UnitPipelineState, ending: UnitEnding, notes: CoordinatorNote[]
   return { state: { ...s, phase: ENDED, ending }, notes: [...notes, { type: "ended", ending }] };
 }
 
-const roundNote = (round: RoundRef, outcome: ShipRoundOutcome): CoordinatorNote => ({
+/** A gated finding as the gate note names it: `F1 (minor)`. */
+const gateLabel = (f: Finding): string => `${f.id} (${f.severity})`;
+
+const roundNote = (round: RoundRef, outcome: ShipRoundOutcome): RoundNote => ({
   type: "round",
   index: round.index,
   agent: presetOf(round.kind),
@@ -1114,6 +1131,10 @@ function settleReview(
     const level = next.input.addressSeverity ?? DEFAULT_ADDRESS_SEVERITY;
     const gated = findingsAtOrAbove(verdict.findings, level);
     if (gated.length > 0) {
+      // The gate fired — which the child's parser should have made impossible
+      // (agent-review item 5a): the round note carries what it caught, so the
+      // mismatch is seen and not just routed around.
+      notes[0] = { ...roundNote(round, verdict.verdict), gate: { level, findings: gated.map(gateLabel) } };
       if (mode !== undefined)
         return end(
           next,

package/dist/assets/src/core/ship/renewal.ts

@@ -24,8 +24,12 @@ export interface ProgressInput {
   /** The heads the segment's coding run pushed (`RunRecord.pushed`). */
   pushed: readonly PushedHeadFact[];
   /** The head the segment started from — the previous segment's recorded sha.
-   *  Absent on a fresh branch, where any push is progress. */
+   *  Absent on a fresh branch, where the base head stands in for it. */
   startHead?: string;
+  /** The base branch's head the unit's branch was created at. On a fresh
+   *  branch (no `startHead`) a push of this head is the branch's creation,
+   *  not the unit's progress; with neither known, any push is progress. */
+  baseHead?: string;
   /** When the segment's lease began; a push stamped before it is not this segment's. */
   leaseStartedAt?: number;
   /** The previous segment's handoff and this one's, when both exist. */
@@ -53,7 +57,10 @@ export function progressOf(input: ProgressInput): Progress {
   if (last !== undefined) {
     const newerThanLease =
       input.leaseStartedAt === undefined || last.at === undefined || last.at >= input.leaseStartedAt;
-    const moved = input.startHead === undefined || !sameSha(last.sha, input.startHead);
+    // A fresh branch starts at the base head, so that head is the bar a push
+    // must move past when no segment recorded a start.
+    const startHead = input.startHead ?? input.baseHead;
+    const moved = startHead === undefined || !sameSha(last.sha, startHead);
     if (newerThanLease && moved) return { progressed: true, by: "push", sha: last.sha };
   }
   const pushWhy = `no head newer than the lease's start was pushed to \`${input.branch}\``;
@@ -95,7 +102,7 @@ export function renewalDecision(input: RenewalInput): RenewalDecision {
     const detail =
       input.grant.renewals === 0
         ? "the grant holds no renewals"
-        : `the grant's ${input.grant.renewals} renewal${input.grant.renewals === 1 ? "" : "s"} are spent`;
+        : `the grant's ${input.grant.renewals} renewal${input.grant.renewals === 1 ? " is" : "s are"} spent`;
     return { renew: false, why: "grant_exhausted", detail, renewalsLeft };
   }
   const cap = input.grant.costCapUsd;

package/dist/assets/src/execution/bashTimeout.ts

@@ -4,7 +4,7 @@
 // Deliberately free of node: imports so wrangler can bundle it into Workers.
 // The numbers are rows of src/core/budgets.ts (docs/decisions/0046); this file
 // keeps their names for the readers that learned them here.
-import { ALLOWANCES, BASH_COMMAND, MINUTE_MS } from "../core/budgets.js";
+import { ALLOWANCES, ATTACH_REQUEST_MIN_MS, BASH_COMMAND, MINUTE_MS } from "../core/budgets.js";
 
 /** Default per-command budget when the caller passes no timeoutMs. */
 export const BASH_TIMEOUT_MS = BASH_COMMAND.defaultMinutes * MINUTE_MS;
@@ -50,8 +50,10 @@ export function clampBashTimeout(requested: unknown): number {
 export type RunBudget =
   { kind: "unchanged" } | { kind: "clipped"; timeoutMs: number; note: string } | { kind: "exhausted"; note: string };
 
+/** Whole seconds for the notes below, never negative: the two clip notes phrase the reserve alike. */
+const secs = (ms: number): number => Math.max(0, Math.round(ms / 1000));
+
 export function bashBudgetWithinRun(wantedMs: number, remainingMs: number): RunBudget {
-  const secs = (ms: number) => Math.max(0, Math.round(ms / 1000));
   const cap = Math.trunc(remainingMs - RUN_DEADLINE_RESERVE_MS);
   if (cap < BASH_TIMEOUT_MIN_MS) {
     return {
@@ -69,6 +71,48 @@ export function bashBudgetWithinRun(wantedMs: number, remainingMs: number): RunB
   };
 }
 
+/** The bound on an attach request an executor opens while its run has
+ *  `remainingMs` of wall clock left (`ResidentExecutorOptions.remainingMs`):
+ *  `bounded` by the attach's own default, `BASH_TIMEOUT_MS` — an attach may
+ *  clone and install deps — clipped to what the run has left less the same
+ *  write-up reserve a command keeps back, so an attach never holds a run past
+ *  its lease and the model keeps its write-up; never raised above the default.
+ *  Inside the reserve, or with less than an attach's floor past it
+ *  (`ATTACH_REQUEST_MIN_MS`: a bound too short to clone would be cut and
+ *  struck as a rollout), `exhausted`: the request is not opened at all — the
+ *  resident would run the attach to its end server-side for a run that is
+ *  ending, and the caller would get a deadline it could read as waitable — and
+ *  the note names the run's clock and the bound that refused (the reserve, or
+ *  the floor past it): it is the one sentence every reader carries, the
+ *  executor's refusal and the relaunch's note alike. The command's own budget
+ *  never bounds an attach: the attach is not the command, and the command's
+ *  one-second floor is the model's to choose. */
+export type AttachBound = { kind: "bounded"; timeoutMs: number } | { kind: "exhausted"; note: string };
+
+export function attachBoundWithinRun(remainingMs: number): AttachBound {
+  const left = Math.trunc(remainingMs - RUN_DEADLINE_RESERVE_MS);
+  // The one sentence every reader of an exhausted bound carries — the
+  // executor's refusal, the relaunch's note — worded by the bound that refused.
+  if (left <= 0) {
+    return {
+      kind: "exhausted",
+      note:
+        `the run has ${secs(remainingMs)}s of wall clock left, inside the ${secs(RUN_DEADLINE_RESERVE_MS)}s ` +
+        "write-up reserve, so no attach was opened",
+    };
+  }
+  if (left < ATTACH_REQUEST_MIN_MS) {
+    return {
+      kind: "exhausted",
+      note:
+        `the run has ${secs(remainingMs)}s of wall clock left, only ${secs(left)}s past the ` +
+        `${secs(RUN_DEADLINE_RESERVE_MS)}s write-up reserve — under the ${secs(ATTACH_REQUEST_MIN_MS)}s an attach needs — ` +
+        "so no attach was opened",
+    };
+  }
+  return { kind: "bounded", timeoutMs: Math.min(BASH_TIMEOUT_MS, left) };
+}
+
 /** The line a timed-out command shows the model: names the limit that fired
  *  and the knob that raises it, so the model can self-correct (re-run with a
  *  larger timeoutMs, split the command, or background it) instead of guessing

package/dist/assets/src/execution/residentRefresh.ts

@@ -180,11 +180,15 @@ export function killStaleBuildProcessesCommand(user: string, dir: string): strin
 }
 
 /** Signature of a step killed from OUTSIDE its own budget: the exit status of
- *  SIGTERM (128 + 15), bash's "Session terminated" on a killed login shell, or
- *  a tool naming the signal. A bare "killed" is NOT enough — compilers and
- *  OOM messages say it too — and a step the cycle itself timed out is a real
- *  failure however it died. */
-const INTERRUPTION_SIGNATURE = /\bexit 143\b|Session terminated|SIGTERM|^restore-interrupted:/;
+ *  SIGTERM (128 + 15) — as a shell reports it (`exit 143`) or as the platform
+ *  words a container that died under a short exec ("Container exited with
+ *  unexpected exit code: 143"; seen live on the wake path's ready-stamp probe
+ *  when a stop landed on it) — bash's "Session terminated" on a killed login
+ *  shell, or a tool naming the signal. Only 143: the platform's same wording
+ *  with any other code (1, 137, 139) is a genuine crash and stays a failure.
+ *  A bare "killed" is NOT enough — compilers and OOM messages say it too —
+ *  and a step the cycle itself timed out is a real failure however it died. */
+const INTERRUPTION_SIGNATURE = /\bexit 143\b|exit code: 143\b|Session terminated|SIGTERM|^restore-interrupted:/;
 
 /** The wordings git gives when the MIRROR itself is broken: its `origin`
  *  remote gone from `config`, the repository not a repository, an object store

package/dist/assets/src/execution/sandboxErrors.ts

@@ -154,10 +154,15 @@ export const SANDBOX_STARTING_EXPLANATION =
   "the thread's sandbox container is starting (image pull, boot, runtime) — nothing ran yet; the request is re-sent once it is up";
 
 /** The executor waits at most this long for a container to start, whatever
- *  the command's own budget: the platform's own start allowances (30 s for an
- *  instance, 90 s for the port) plus a slow image pull fit inside it, and a
- *  60 s command is never killed by a two-minute start it did not cause. */
-export const SANDBOX_START_WAIT_MAX_MS = 5 * 60_000;
+ *  the command's own budget: the platform's own start allowances (the
+ *  instance grant, 90 s for the port) plus a slow image pull fit inside it,
+ *  and a 60 s command is never killed by a two-minute start it did not cause.
+ *  Ten minutes, not five: under a midday burst the platform admitted about
+ *  seven starts at once and granted the rest 2.5 to 5 minutes later — two
+ *  threads of twenty-four died at the five-minute mark with their container
+ *  a minute away. A run that waits ten minutes for its container starts; one
+ *  that dies at five does not, and nothing else in the run was in progress. */
+export const SANDBOX_START_WAIT_MAX_MS = 10 * 60_000;
 
 /** Backoff between re-sends while a container starts: 5 s, 10 s, then 15 s.
  *  A start takes tens of seconds, not minutes, so the poll is denser than the