@coreplane/switchboard 1.246.0 → 1.247.0

package/dist/cli.js

@@ -1204,6 +1204,22 @@ var init_grants = __esm({
   }
 });
 
+// ../../src/core/authz/viewAs.ts
+function holdsAll(actor) {
+  return actor.grants.actions === "all" && actor.grants.channels === "all" && actor.grants.repos === "all";
+}
+function isViewablePerson(id) {
+  return /^slack:U[A-Z0-9]+$/.test(id);
+}
+function viewingRefusal(person) {
+  return `You are viewing as ${person.name ?? person.id}; writes are your own to make \u2014 exit view-as to write.`;
+}
+var init_viewAs = __esm({
+  "../../src/core/authz/viewAs.ts"() {
+    "use strict";
+  }
+});
+
 // ../../src/configDocument.ts
 import { createHash } from "node:crypto";
 function parseConfigLocation(value) {
@@ -1563,16 +1579,16 @@ var init_budgets = __esm({
     LOOP_PRESETS = ["general", "coding", "review", "research", "explore", "conductor"];
     ASKS = {
       general: 5,
-      coding: 45,
+      coding: 90,
       review: 25,
-      ship: 120,
+      ship: 240,
       research: 8,
       explore: 120,
       conductor: 120
     };
     PRESET_FLOORS = {
       general: 2,
-      coding: 10,
+      coding: 15,
       review: 5,
       research: 3,
       explore: 15,
@@ -1923,7 +1939,7 @@ ${renderGuards(contract.guards)}`
   }
   return { text, chars: text.length, dropped, overBudget: text.length > maxChars };
 }
-var PR_TITLE_GUARD, GUARDS, CONTRACT_HEADING, CONTRACT_SECTION_HEADINGS, DEFAULT_CONTRACT_MAX_CHARS, UNIT_HEADING, ANY_HEADING, BULLET, SPEC_MENTION, ITEM_LIST, NAMED_REF, ANY_MD_MENTION, SPEC_ITEM, TITLE_MAX, APPROACH_DROPPED, DROP_NOTE;
+var PR_TITLE_GUARD, GUARDS, CONTRACT_HEADING, CONTRACT_SECTION_HEADINGS, DEFAULT_CONTRACT_MAX_CHARS, PLAN_MAX_CHARS, UNIT_HEADING, ANY_HEADING, BULLET, SPEC_MENTION, ITEM_LIST, NAMED_REF, ANY_MD_MENTION, SPEC_ITEM, TITLE_MAX, APPROACH_DROPPED, DROP_NOTE;
 var init_contract = __esm({
   "../../src/core/ship/contract.ts"() {
     "use strict";
@@ -1959,6 +1975,7 @@ var init_contract = __esm({
       guards: "### Guards"
     };
     DEFAULT_CONTRACT_MAX_CHARS = 48e3;
+    PLAN_MAX_CHARS = 2e6;
     UNIT_HEADING = /^### (U\d+)\. (.+?)\s*$/;
     ANY_HEADING = /^#{2,3} /;
     BULLET = /^- \*\*([^*]+)\*\*:(?:\s?(.*))?$/;
@@ -2038,7 +2055,7 @@ var init_registry = __esm({
     init_contract();
     MACHINE_CLASSES = ["none", "blank", "repo-cold", "repo-resident"];
     IDENTITIES = ["none", "read", "write"];
-    PR_DESCRIPTION_TEMPLATE = `PR description \u2014 submit it with the submit_pr_description tool for EVERY PR (this is the default, not something to wait to be asked for). Switchboard renders the GitHub body from the object you submit, so never author PR-body markdown yourself. Before submitting, judge your title with the ${PR_TITLE_GUARD} gate \u2014 \`npm run check:pr-title -- "<title>"\` \u2014 and submit only a title it accepts; the same gate refuses the PR in CI. The body is a fixed-size MAP for the reader with everything for agents collapsed under it; every field is capped in visible characters (a link's URL is not counted) and the tool refuses an object over a cap naming the field and the count \u2014 cut and resubmit. Prose is unwrapped \u2014 no hard line breaks inside a paragraph. Always hyperlink the triggering issue/request. Never fabricate validation \u2014 state exactly what you ran and the real result. BEFORE authoring the pointers, load the \`pr-description\` skill with use_skill \u2014 it defines how to choose at most seven pointers, the mechanical anchor rules and what goes below the fold; follow it for every PR.
+    PR_DESCRIPTION_TEMPLATE = `PR description \u2014 submit it with the submit_pr_description tool for EVERY PR (this is the default, not something to wait to be asked for). Switchboard renders the GitHub body from the object you submit, so never author PR-body markdown yourself. Before submitting, judge your title with the ${PR_TITLE_GUARD} gate \u2014 \`npm run check:pr-title -- "<title>"\` \u2014 and submit only a title it accepts; the same gate refuses the PR in CI, and on Switchboard's own repository the tool refuses the same titles with the gate's own sentence, so fix the title and resubmit rather than pushing on. The body is a fixed-size MAP for the reader with everything for agents collapsed under it; every field is capped in visible characters (a link's URL is not counted) and the tool refuses an object over a cap naming the field and the count \u2014 cut and resubmit. Prose is unwrapped \u2014 no hard line breaks inside a paragraph. Always hyperlink the triggering issue/request. Never fabricate validation \u2014 state exactly what you ran and the real result. BEFORE authoring the pointers, load the \`pr-description\` skill with use_skill \u2014 it defines how to choose at most seven pointers, the mechanical anchor rules and what goes below the fold; follow it for every PR.
 EVERY PR includes one that already exists when you push \u2014 opened by a person, by dependabot, or by an earlier run. After EVERY push to such a PR: read its current title and body (\`github_issue_get\` with the PR number works for pull requests; \`gh pr view\` where gh exists), judge them against the change as it now stands at the pushed head, and submit the object that describes the PR as it is NOW \u2014 carry forward what the existing body says that is still true (a dependency bump's release notes belong in why), add what you changed, and anchor the pointers at the new head. Switchboard replaces the PR's title and body with your rendering. A description that describes an earlier state of its branch is a bug; "it is someone else's PR" is never a reason to leave it.
 - **title** (\u226472 characters in all): the changelog line \u2014 \`type(scope): what a reader can now do or expect\`, one change, one clause, present tense. The type and the scope spend the same budget as the description, so the description is short; the body carries the rest. The tool refuses a longer title naming the count, and so does the gate in CI.
 - **TL;DR** (\`tldr\`, rendered first, \u2264300): two sentences for a reader with zero context \u2014 what this PR does and why it matters.
@@ -4451,6 +4468,7 @@ var init_config2 = __esm({
     "use strict";
     init_authorize();
     init_grants();
+    init_viewAs();
     init_configDocument();
     init_schedules();
     init_registry();
@@ -4829,6 +4847,11 @@ var init_config2 = __esm({
       grantsFor(actorId) {
         return grantsIn(this.grants, actorId);
       }
+      /** The Slack people the grants table names, in its order — whoever holds anything by name (the
+       *  people an admin may want to view the dashboard as, record 0053). Never a credential or a surface. */
+      grantedPeople() {
+        return [...this.grants.grants.keys()].filter(isViewablePerson);
+      }
       /** Who to ask when denied — for actionable error messages: the Slack users
        *  who hold everything, in the table's order. Slack only because
        *  the hint is a `<@…>` mention in a chat reply; a credential granted
@@ -14525,14 +14548,14 @@ function partition(spans, input) {
     }
     if (backgroundIntervals.some(([s, e]) => s <= a && e >= b)) backgroundOnly += len;
   }
-  const counted = buckets.getting_ready + buckets.thinking + buckets.tools + buckets.finishing_up;
+  const counted2 = buckets.getting_ready + buckets.thinking + buckets.tools + buckets.finishing_up;
   return {
     windowMs,
     gettingReadyMs: buckets.getting_ready,
     thinkingMs: buckets.thinking,
     toolsMs: buckets.tools,
     finishingUpMs: buckets.finishing_up,
-    overheadMs: Math.max(0, windowMs - counted - notRecorded - notLoaded),
+    overheadMs: Math.max(0, windowMs - counted2 - notRecorded - notLoaded),
     notRecordedMs: notRecorded,
     notLoadedMs: notLoaded,
     backgroundOnlyMs: backgroundOnly
@@ -16805,22 +16828,6 @@ var init_runDuration = __esm({
   }
 });
 
-// ../../src/core/authz/viewAs.ts
-function holdsAll(actor) {
-  return actor.grants.actions === "all" && actor.grants.channels === "all" && actor.grants.repos === "all";
-}
-function isViewablePerson(id) {
-  return /^slack:U[A-Z0-9]+$/.test(id);
-}
-function viewingRefusal(person) {
-  return `You are viewing as ${person.name ?? person.id}; writes are your own to make \u2014 exit view-as to write.`;
-}
-var init_viewAs = __esm({
-  "../../src/core/authz/viewAs.ts"() {
-    "use strict";
-  }
-});
-
 // ../../src/mcp/config.ts
 function parseMcpSettings(raw) {
   if (raw === void 0 || raw === null) return void 0;
@@ -23961,7 +23968,8 @@ _(clipped by Switchboard: body exceeded ${MAX_BODY_CHARS2} chars)_` : body;
         }
         return out;
       }
-      async readFile(repo, path, ref) {
+      async readFile(repo, path, ref, opts) {
+        const maxChars = opts?.maxChars ?? MAX_FILE_CHARS;
         const q = ref ? `?ref=${encodeURIComponent(ref)}` : "";
         const res = await this.request("read", "GET", "contents", `/repos/${repo}/contents/${encodePath(path)}${q}`);
         const body = await res.json();
@@ -23981,13 +23989,13 @@ _(clipped by Switchboard: body exceeded ${MAX_BODY_CHARS2} chars)_` : body;
             void 0,
             "application/vnd.github.raw+json"
           );
-          content = await readTextCapped(raw, MAX_FILE_CHARS + 1);
+          content = await readTextCapped(raw, maxChars + 1);
         } else content = String(body.content ?? "");
         if (content.includes("\0")) content = `(binary file, ${size} bytes \u2014 not shown)`;
-        const truncated = content.length > MAX_FILE_CHARS;
+        const truncated = content.length > maxChars;
         return {
           path,
-          content: truncated ? content.slice(0, MAX_FILE_CHARS) : content,
+          content: truncated ? content.slice(0, maxChars) : content,
           size,
           truncated,
           sha: String(body.sha ?? ""),
@@ -27535,6 +27543,8 @@ var init_attrs = __esm({
       dedupe: "string",
       requester: "string",
       outcome: "string",
+      refusal: "string",
+      cause: "string",
       count: "number",
       backend: "string",
       command: "string",
@@ -27612,6 +27622,189 @@ var init_trace = __esm({
   }
 });
 
+// ../../src/core/confirmations.ts
+import { randomUUID } from "node:crypto";
+import { existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname9, resolve as resolve10 } from "node:path";
+function newConfirmationId() {
+  return randomUUID();
+}
+function confirmationFooter(scope) {
+  switch (scope) {
+    case "channel":
+      return "confirmation required by this channel's boundary";
+    case "user":
+      return "confirmation required by your boundary";
+    case "defaults":
+      return "confirmation required by the defaults' boundary";
+    case "built-in":
+      return "confirmation required by the built-in default";
+    default:
+      return `confirmation required by the ${scope} boundary`;
+  }
+}
+function renderOffer(offer) {
+  return [offer.line, ...offer.risk ? [offer.risk] : [], offer.footer].join("\n");
+}
+function confirmationMessageOf(msg) {
+  const { images: _images, documents: _documents, staged: _staged, ...kept } = msg;
+  return kept;
+}
+function isRecord3(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isMessage(v) {
+  return isRecord3(v) && typeof v.channelId === "string" && typeof v.userId === "string" && typeof v.threadKey === "string" && typeof v.text === "string";
+}
+function isPendingConfirmation(v) {
+  return isRecord3(v) && typeof v.id === "string" && isMessage(v.message) && typeof v.command === "string" && isRecord3(v.input) && typeof v.receipt === "string" && typeof v.risk === "string" && typeof v.footer === "string" && typeof v.model === "string";
+}
+function isConfirmation(v) {
+  return isPendingConfirmation(v) && typeof v.expiresAt === "number";
+}
+function isRefusal(v) {
+  return typeof v === "string" && CONFIRMATION_REFUSALS.includes(v);
+}
+function judge2(rows, id, actorIds, now, kind) {
+  const row2 = rows.get(id);
+  if (!row2) return { ok: false, refused: "used" };
+  if (kind === "consume" && row2.expiresAt <= now) {
+    rows.delete(id);
+    return { ok: false, refused: "expired", row: row2 };
+  }
+  if (!actorIds.includes(row2.message.userId))
+    return kind === "consume" ? { ok: false, refused: "foreign", row: row2 } : { ok: false, refused: "foreign" };
+  rows.delete(id);
+  return kind === "consume" ? { ok: true, row: row2 } : { ok: true };
+}
+function replaceThreadRow(rows, row2) {
+  for (const [id, r] of rows) if (r.message.threadKey === row2.message.threadKey) rows.delete(id);
+  rows.set(row2.id, row2);
+}
+function buildConfirmationStore(config, secrets, opts) {
+  const worker = config.config.runtimeOverrides?.worker;
+  if (!worker) return new FileConfirmationStore(opts.path);
+  const tokenEnv = worker.tokenEnv ?? "MEMORY_TOKEN";
+  const token2 = secrets.named(tokenEnv);
+  if (!token2) throw new Error(`runtimeOverrides.worker is configured but ${tokenEnv} is not set`);
+  return new WorkerConfirmationStore({
+    baseUrl: worker.baseUrl,
+    token: token2.reveal(),
+    ...opts.fetch ? { fetch: opts.fetch } : {}
+  });
+}
+var CONFIRMATION_REFUSALS, UNSHOWABLE_LINE, STORE_UNREACHABLE_NOTE, FileConfirmationStore, CONFIRMATION_WORKER_TIMEOUT_MS, WorkerConfirmationStore;
+var init_confirmations = __esm({
+  "../../src/core/confirmations.ts"() {
+    "use strict";
+    init_clock();
+    CONFIRMATION_REFUSALS = ["used", "expired", "foreign"];
+    UNSHOWABLE_LINE = "this command carries a value that cannot be shown; type the line yourself";
+    STORE_UNREACHABLE_NOTE = "(the confirmation store could not be reached, so there is no button to press)";
+    FileConfirmationStore = class {
+      path;
+      clock;
+      constructor(path, opts = {}) {
+        this.path = resolve10(path);
+        this.clock = opts.clock ?? systemClock;
+      }
+      read() {
+        const rows = /* @__PURE__ */ new Map();
+        if (!existsSync12(this.path)) return rows;
+        const raw = JSON.parse(readFileSync14(this.path, "utf8"));
+        for (const v of Array.isArray(raw.confirmations) ? raw.confirmations : []) if (isConfirmation(v)) rows.set(v.id, v);
+        return rows;
+      }
+      write(rows) {
+        mkdirSync9(dirname9(this.path), { recursive: true });
+        writeFileSync8(this.path, JSON.stringify({ confirmations: [...rows.values()] }, null, 2));
+      }
+      async put(row2, ttlMs) {
+        const rows = this.read();
+        const stored = { ...row2, expiresAt: this.clock() + ttlMs };
+        replaceThreadRow(rows, stored);
+        this.write(rows);
+        return stored;
+      }
+      async consume(id, actorIds) {
+        const rows = this.read();
+        const out = judge2(rows, id, actorIds, this.clock(), "consume");
+        this.write(rows);
+        return out;
+      }
+      async cancel(id, actorIds) {
+        const rows = this.read();
+        const out = judge2(rows, id, actorIds, this.clock(), "cancel");
+        this.write(rows);
+        return out;
+      }
+      describe() {
+        return `file ${this.path}`;
+      }
+    };
+    CONFIRMATION_WORKER_TIMEOUT_MS = 8e3;
+    WorkerConfirmationStore = class {
+      constructor(opts) {
+        this.opts = opts;
+        this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+        this.fetchImpl = opts.fetch ?? fetch;
+      }
+      opts;
+      baseUrl;
+      fetchImpl;
+      async put(row2, ttlMs) {
+        const body = await this.post("/config/confirmations/put", {
+          id: row2.id,
+          threadKey: row2.message.threadKey,
+          requester: row2.message.userId,
+          body: row2,
+          ttlMs
+        });
+        if (typeof body.expiresAt !== "number")
+          throw new Error("confirmation store answered a put without the expiry it stamped");
+        return { ...row2, expiresAt: body.expiresAt };
+      }
+      async consume(id, actorIds) {
+        const body = await this.post("/config/confirmations/consume", { id, actorIds });
+        const stored = isRecord3(body.row) ? body.row : void 0;
+        const row2 = stored && isRecord3(stored.body) ? { ...stored.body, expiresAt: stored.expiresAt } : void 0;
+        if (isRefusal(body.refused))
+          return { ok: false, refused: body.refused, ...isConfirmation(row2) ? { row: row2 } : {} };
+        if (!isConfirmation(row2)) throw new Error("confirmation store answered a consume outside its contract");
+        return { ok: true, row: row2 };
+      }
+      async cancel(id, actorIds) {
+        const body = await this.post("/config/confirmations/cancel", { id, actorIds });
+        if (body.ok === true) return { ok: true };
+        if (body.refused === "used" || body.refused === "foreign") return { ok: false, refused: body.refused };
+        throw new Error("confirmation store answered a cancel outside its contract");
+      }
+      describe() {
+        return `state Worker ${this.baseUrl} (ConfigDO confirmations)`;
+      }
+      async post(path, payload) {
+        let res;
+        try {
+          res = await this.fetchImpl(`${this.baseUrl}${path}`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${this.opts.token}`, "content-type": "application/json" },
+            body: JSON.stringify(payload),
+            signal: AbortSignal.timeout(CONFIRMATION_WORKER_TIMEOUT_MS)
+          });
+        } catch (err2) {
+          throw new Error(`confirmation store unreachable: ${err2 instanceof Error ? err2.message : String(err2)}`, {
+            cause: err2
+          });
+        }
+        if (!res.ok) throw new Error(`confirmation store answered HTTP ${res.status} on ${path}`);
+        const body = await res.json().catch(() => void 0);
+        if (!isRecord3(body)) throw new Error(`confirmation store returned a non-JSON body on ${path}`);
+        return body;
+      }
+    };
+  }
+});
+
 // ../../src/core/markdownDocument.ts
 function toMarkdownDocument(text) {
   return text.replace(/[\uE000\uE001]/g, "").split(/(```[\s\S]*?```)/g).map((seg, i) => i % 2 === 1 ? seg : hardBreaks(convertProse(seg))).join("");
@@ -27802,6 +27995,17 @@ function channelSegment(channelId, channelName) {
 function errorReply(err2) {
   return `\u26A0\uFE0F ${err2 instanceof Error ? err2.message : String(err2)}`;
 }
+async function renderRefusal(refusal, io) {
+  if (refusal.cause === "policy" && refusal.wayForward) return io.reply(`${refusal.text} ${refusal.wayForward}`);
+  return io.reply(refusal.text);
+}
+async function renderConfirmationOffer(io, offer) {
+  if (io.offer) return io.offer(offer);
+  return io.reply(renderOffer(offer));
+}
+function aRun(agentName) {
+  return `${/^[aeiou]/i.test(agentName) ? "an" : "a"} *${agentName}* run`;
+}
 function cardLines(trace, opts) {
   const shape = cardShapeLine(trace.spansSoFar(), {
     window: { start: trace.receivedAt, end: opts.end },
@@ -27910,12 +28114,13 @@ function afterReply(deps, ctx) {
       answer
     });
 }
-var SNIPPET_MAX, RUN_LABEL_MAX, ASSISTANT_TRACE_CAP, STATUS_PREFIXES, LONG_COMMAND_REPLY_CHARS;
+var SNIPPET_MAX, RUN_LABEL_MAX, ASSISTANT_TRACE_CAP, STATUS_PREFIXES, REFUSAL_SENTENCES, LONG_COMMAND_REPLY_CHARS;
 var init_reply = __esm({
   "../../src/core/dispatch/reply.ts"() {
     "use strict";
     init_reviewVerdict();
     init_channelDirectory();
+    init_confirmations();
     init_commandSurface();
     init_markdownDocument();
     init_runShape();
@@ -27926,10 +28131,73 @@ var init_reply = __esm({
     RUN_LABEL_MAX = 160;
     ASSISTANT_TRACE_CAP = 80;
     STATUS_PREFIXES = ["\u23F3", "\u2705", "\u25D0", "\u25D3", "\u25D1", "\u25D2"];
+    REFUSAL_SENTENCES = {
+      agent_allowlist: (p) => `\u{1F6AB} You're not on the allowlist for the \`${p.agent}\` agent. Ask ${p.adminsHint} for access.`,
+      live_agent_allowlist: (p) => `\u{1F6AB} You're not on the allowlist for the \`${p.agent}\` agent, whose run is in flight in this thread. Ask ${p.adminsHint} for access.`,
+      elsewhere_agent_allowlist: (p) => `\u{1F6AB} You're not on the allowlist for the \`${p.agent}\` agent, whose run is in flight in this thread. Ask ${p.adminsHint} for access.`,
+      repo_not_visible: (p) => `\u{1F4E6} \`${p.slug}\` is not a repository this installation can see \u2014 GitHub answered 404 \u2014 so I did not start ${aRun(p.agent)} for it. The repository is outside the Switchboard GitHub App installation (\`github_repos\` lists the reachable ones), or the name is wrong.`,
+      repo_unverified: (p) => p.via === "github" ? `\u26A0\uFE0F I couldn't verify \`${p.slug}\` against GitHub \u2014 it didn't answer \u2014 so I did not start ${aRun(p.agent)} rather than guess which repository you meant. Try again in a minute.` : `\u26A0\uFE0F I couldn't verify that \`${p.slug}\` is an onboarded repo \u2014 the resident registry didn't answer \u2014 so I did not start a *${p.agent}* run rather than guess which repo you meant. Try again in a minute, or name the repository by URL (https://github.com/${p.slug}) to run in a cold per-thread sandbox.`,
+      repo_not_onboarded: (p) => `\u{1F4E6} \`${p.slug}\` is not onboarded as a resident, so I did not start a *${p.agent}* run for it. ${p.onboardHint} for a warm, deps-ready environment, or name the repository by URL (https://github.com/${p.slug}) to run in a cold per-thread sandbox.`,
+      repo_access: (p) => `\u{1F6AB} You're not on the allowlist for the \`${p.repo}\` repo environment. Ask ${p.adminsHint} for access.`,
+      which_branch: (p) => `\u{1F33F} Which branch of \`${p.repo}\` should this thread work on? No branch is bound yet \u2014 reply naming one (e.g. "on main" or "on branch fix/login") and I'll pick it up from there.`,
+      ship_budget: (p) => `\u{1F6AB} Ship cannot start under a ${p.maxMinutes}-minute budget: the loop it allows (${p.maxRounds} review rounds) needs ${p.need} minutes \u2014 ${p.provision} to provision, the coding child's ${p.coding}, and the reserve for the rounds after it at their floors. Widen the budget or the boundary that clipped it, or run \`agent:coding\` for a single pass without the review loop.`
+    };
     LONG_COMMAND_REPLY_CHARS = 3e3;
   }
 });
 
+// ../../src/core/refusal.ts
+function causeOf(code) {
+  return CAUSE_OF[code];
+}
+function refusalOf(code, text, extra) {
+  return { cause: causeOf(code), code, text, ...extra ?? {} };
+}
+var CAUSE_OF, REFUSAL_CODES;
+var init_refusal = __esm({
+  "../../src/core/refusal.ts"() {
+    "use strict";
+    CAUSE_OF = {
+      // the dispatch gates (dispatcher.ts `refuse(code)`)
+      agent_allowlist: "policy",
+      profile_bounded: "policy",
+      repo_not_visible: "policy",
+      repo_unverified: "system",
+      repo_not_onboarded: "request",
+      repo_access: "policy",
+      pr_head_unknown: "system",
+      branch_moved: "system",
+      coordinator_thread_live: "system",
+      live_agent_allowlist: "policy",
+      follow_up_refused: "request",
+      elsewhere_agent_allowlist: "policy",
+      elsewhere_follow_up_refused: "request",
+      which_branch: "request",
+      workspace_lost: "system",
+      ship_preflight: "system",
+      ship_budget: "request",
+      setup_failed: "system",
+      // the click on a confirmation (confirm.ts)
+      confirmation_used: "request",
+      confirmation_expired: "request",
+      confirmation_foreign: "policy",
+      confirmation_unreadable: "system",
+      // the references step's eight reasons (record 0037: one sentence, eight codes)
+      reference_over_cap: "request",
+      reference_rate_limited: "request",
+      reference_guest: "policy",
+      reference_not_a_member: "policy",
+      reference_denied: "policy",
+      reference_timed_out: "system",
+      reference_never: "system",
+      reference_fetch_failed: "system",
+      // the catch-all: an uncaught throw in dispatch()
+      uncaught: "system"
+    };
+    REFUSAL_CODES = Object.keys(CAUSE_OF);
+  }
+});
+
 // ../../src/core/runHistoryWriter.ts
 async function putOnce(sink, record2) {
   try {
@@ -28344,7 +28612,20 @@ async function closeResumedRow(adopted, resume, why, status3 = "interrupted") {
   }
 }
 async function admit(deps, ctx) {
-  const { msg, io, directives, agentName, resume, restart, carriedRow, clock: clock4, root, refuse: refuse3, admission } = ctx;
+  const {
+    msg,
+    io,
+    directives,
+    agentName,
+    resume,
+    restart,
+    carriedRow,
+    clock: clock4,
+    root,
+    refuse: refuse3,
+    refuseSilently,
+    admission
+  } = ctx;
   let claim = admission.claim(msg.threadKey, {
     agent: agentName,
     ...carriedRow ? { now: carriedRow.startedAt } : {}
@@ -28391,16 +28672,16 @@ async function admit(deps, ctx) {
     console.log(
       `[dispatch] ${msg.threadKey} coordinator spawn (${ctx.coordinator.idempotencyKey}) refused: the ${claim.live.agent} run ${claim.live.runId ?? "(unnamed)"} is in flight`
     );
-    await refuse3("coordinator_thread_live", async () => {
+    await refuseSilently("coordinator_thread_live", async () => {
     });
     return { kind: "refused", reason: "coordinator_thread_live" };
   }
   if (claim.kind === "live") {
     if (!deps.config.canRunAgent(chatActorOf(deps.config, msg), claim.live.agent)) {
       await refuse3(
-        "live_agent_allowlist",
-        () => io.reply(
-          `\u{1F6AB} You're not on the allowlist for the \`${claim.live.agent}\` agent, whose run is in flight in this thread. Ask ${deps.config.adminsHint()} for access.`
+        refusalOf(
+          "live_agent_allowlist",
+          REFUSAL_SENTENCES.live_agent_allowlist({ agent: claim.live.agent, adminsHint: deps.config.adminsHint() })
         )
       );
       return { kind: "refused", reason: "live_agent_allowlist" };
@@ -28410,7 +28691,7 @@ async function admit(deps, ctx) {
       console.log(
         `[dispatch] ${msg.threadKey} follow-up refused (${decision.reason}): ${claim.live.agent} run in flight`
       );
-      await refuse3("follow_up_refused", () => io.reply(refusalReply(claim.live, decision, clock4())));
+      await refuse3(refusalOf("follow_up_refused", refusalReply(claim.live, decision, clock4())));
       return { kind: "refused", reason: "follow_up_refused" };
     }
     const at = clock4();
@@ -28442,7 +28723,7 @@ async function admit(deps, ctx) {
     console.log(
       `[dispatch] ${msg.threadKey} coordinator spawn (${ctx.coordinator.idempotencyKey}) refused: run ${elsewhere.runId} is in flight on another generation`
     );
-    await refuse3("coordinator_thread_live", async () => {
+    await refuseSilently("coordinator_thread_live", async () => {
     });
     return { kind: "refused", reason: "coordinator_thread_live" };
   }
@@ -28457,8 +28738,11 @@ async function admit(deps, ctx) {
       runId: elsewhere.runId
     };
     if (!deps.config.canRunAgent(chatActorOf(deps.config, msg), far.agent)) {
-      await io.reply(
-        `\u{1F6AB} You're not on the allowlist for the \`${far.agent}\` agent, whose run is in flight in this thread. Ask ${deps.config.adminsHint()} for access.`
+      await refuse3(
+        refusalOf(
+          "elsewhere_agent_allowlist",
+          REFUSAL_SENTENCES.elsewhere_agent_allowlist({ agent: far.agent, adminsHint: deps.config.adminsHint() })
+        )
       );
       return { kind: "refused", reason: "elsewhere_agent_allowlist" };
     }
@@ -28468,7 +28752,7 @@ async function admit(deps, ctx) {
       console.log(
         `[dispatch] ${msg.threadKey} follow-up refused (${decision.reason}): ${far.agent} run ${far.runId} live on another generation`
       );
-      await io.reply(refusalReply(far, decision, now));
+      await refuse3(refusalOf("elsewhere_follow_up_refused", refusalReply(far, decision, now)));
       return { kind: "refused", reason: "elsewhere_follow_up_refused" };
     }
     const seq = await deps.runLedger.pushInbox(elsewhere.runId, durableInboxMessage(msg, directives.text, now));
@@ -28595,6 +28879,8 @@ var init_admission = __esm({
     init_trace();
     init_threadAdmission();
     init_record();
+    init_refusal();
+    init_reply();
     init_inboxMessage();
     defaultAdmission = new ThreadAdmission();
   }
@@ -29105,10 +29391,12 @@ function extractSignals(rawText) {
     if (!t || t.includes("://") || t.toLowerCase().startsWith("github.com/")) continue;
     const prev = i > 0 ? stripPunct(tokens[i - 1]).toLowerCase() : "";
     if (prev === "branch") continue;
-    if (prev === "in" && !inCode[i] && !out.addressed) {
+    const prev2 = i > 1 ? stripPunct(tokens[i - 2]).toLowerCase() : "";
+    const inAt = prev === "in" ? i - 1 : DETERMINERS.has(prev) && prev2 === "in" ? i - 2 : -1;
+    if (inAt >= 0 && !inCode[i] && !out.addressed && !DETERMINERS.has(t.toLowerCase())) {
       const slug = slugOf(t);
       if (slug) out.addressed = { slug };
-      else if (!t.includes("/") && NAME_RE.test(t) && tokens.slice(0, i - 1).every(isDirectiveOrMention))
+      else if (!t.includes("/") && NAME_RE.test(t) && tokens.slice(0, inAt).every(isDirectiveOrMention))
         out.addressed = { name: t.toLowerCase() };
     }
     if (prev === "on") {
@@ -29420,7 +29708,7 @@ function prFacts(title, body) {
   if (last >= 55296 && last <= 56319) end--;
   return { title, body: body.slice(0, end), truncated: true };
 }
-var PR_BODY_CAP, OWNER_RE, NAME_RE, WELL_KNOWN_REFS, CODE_SPAN, threadSignalsCache, COMPARE_FILES_CAP;
+var PR_BODY_CAP, OWNER_RE, NAME_RE, WELL_KNOWN_REFS, DETERMINERS, CODE_SPAN, threadSignalsCache, COMPARE_FILES_CAP;
 var init_repoContext = __esm({
   "../../src/core/repoContext.ts"() {
     "use strict";
@@ -29432,6 +29720,7 @@ var init_repoContext = __esm({
     OWNER_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;
     NAME_RE = /^[A-Za-z0-9._-]{1,100}$/;
     WELL_KNOWN_REFS = /* @__PURE__ */ new Set(["main", "master", "develop", "trunk"]);
+    DETERMINERS = /* @__PURE__ */ new Set(["the", "a", "an", "our", "my", "this"]);
     CODE_SPAN = /```[\s\S]*?```|`[^`\n]*`/g;
     threadSignalsCache = /* @__PURE__ */ new WeakMap();
     COMPARE_FILES_CAP = 300;
@@ -29646,7 +29935,7 @@ var init_indexFeed = __esm({
 });
 
 // ../../src/core/runRegistry.ts
-import { randomBytes as randomBytes3, randomUUID, timingSafeEqual } from "node:crypto";
+import { randomBytes as randomBytes3, randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
 function safeEqual(a, b) {
   const ab = Buffer.from(a, "utf8");
   const bb = Buffer.from(b, "utf8");
@@ -29685,7 +29974,7 @@ var init_runRegistry = __esm({
           bytes: opts.backlogBytes ?? DEFAULT_BACKLOG_BYTES
         };
         this.ttlMs = opts.ttlMs ?? 6e4;
-        this.genId = opts.genId ?? (() => randomUUID());
+        this.genId = opts.genId ?? (() => randomUUID2());
         this.genToken = opts.genToken ?? (() => randomBytes3(32).toString("hex"));
         this.now = opts.now ?? Date.now;
       }
@@ -32485,6 +32774,162 @@ var init_status2 = __esm({
   }
 });
 
+// ../../src/core/prTitle.mjs
+function checkPrTitle(rawTitle, vocabulary) {
+  const { types, scopes } = vocabulary;
+  const title = (rawTitle ?? "").trim();
+  if (title === "") return { ok: false, problems: ["the title is empty"] };
+  const m = TITLE_GRAMMAR.exec(title);
+  if (!m || !m.groups) return { ok: false, problems: [diagnose(title, types)] };
+  const { type, scope, breaking, description } = m.groups;
+  const problems = [];
+  if (!types.includes(type)) problems.push(`unknown type "${type}" \u2014 use one of: ${types.join(", ")}`);
+  if (scope !== void 0 && !scopes.includes(scope)) {
+    problems.push(
+      `unknown scope "${scope}" \u2014 use one of: ${scopes.join(", ")} (the Areas in ${CODE_MAP_PATH}), or no scope for a tree-wide change`
+    );
+  }
+  if (/\.$/.test(description)) problems.push("the description ends with a period; drop it (it is a commit subject)");
+  const exemptFromCap = type === "revert" || scope !== void 0 && BOT_SCOPES.includes(scope);
+  if (!exemptFromCap && title.length > TITLE_MAX_LENGTH) {
+    problems.push(
+      `the title is ${title.length} characters; at most ${TITLE_MAX_LENGTH} \u2014 one change, one clause, present tense; the PR body carries the rest`
+    );
+  }
+  if (problems.length > 0) return { ok: false, problems };
+  return { ok: true, type, scope: scope ?? null, breaking: breaking === "!", description };
+}
+function diagnose(title, types) {
+  const list = types.join(", ");
+  if (/^\[?(wip|draft)\b/i.test(title))
+    return `drop the "${title.split(/[\s\]:]/)[0]}" marker; mark the PR as a draft instead`;
+  if (/^Revert "/.test(title))
+    return 'a revert is titled `revert: <the original title>` (GitHub\'s Revert button writes `Revert "\u2026"`)';
+  if (!/^[a-z]/.test(title)) return `the type must be lowercase, one of: ${list}`;
+  if (!/^[a-z]+(\([^)]*\))?!?:/.test(title))
+    return `start with a type and a colon \u2014 \`type: description\` or \`type(scope): description\` \u2014 where type is one of: ${list}`;
+  if (/^[a-z]+\([^)]*[^a-z0-9._/)-][^)]*\)/.test(title) || /^[a-z]+\([^a-z0-9]/.test(title)) {
+    return "the scope is lowercase letters, digits and . _ / - inside the parentheses, like `feat(slack): \u2026`";
+  }
+  if (/^[a-z]+(\([^)]*\))?!?:\s*$/.test(title)) return "add a description after the colon";
+  if (/^[a-z]+(\([^)]*\))?!?:\S/.test(title)) return "put exactly one space after the colon, then the description";
+  return `the title does not match \`type(scope)!: description\` with type one of: ${list}`;
+}
+var TITLE_GRAMMAR, CODE_MAP_PATH, RELEASE_CONFIG_PATH, TITLE_MAX_LENGTH, BOT_SCOPES, VOCABULARY_NOTE;
+var init_prTitle = __esm({
+  "../../src/core/prTitle.mjs"() {
+    "use strict";
+    TITLE_GRAMMAR = /^(?<type>[a-z]+)(?:\((?<scope>[a-z0-9][a-z0-9._/-]*)\))?(?<breaking>!)?: (?<description>\S.*)$/;
+    CODE_MAP_PATH = "docs/reference/code-map.md";
+    RELEASE_CONFIG_PATH = "release-please-config.json";
+    TITLE_MAX_LENGTH = 72;
+    BOT_SCOPES = ["deps", "main"];
+    VOCABULARY_NOTE = `generated by \`npm run pr-title:gen\` from ${RELEASE_CONFIG_PATH} (types) and the Areas table in ${CODE_MAP_PATH} (scopes) \u2014 do not edit by hand`;
+  }
+});
+
+// ../../src/core/prTitleVocabulary.json
+var prTitleVocabulary_default;
+var init_prTitleVocabulary = __esm({
+  "../../src/core/prTitleVocabulary.json"() {
+    prTitleVocabulary_default = {
+      $generated: "generated by `npm run pr-title:gen` from release-please-config.json (types) and the Areas table in docs/reference/code-map.md (scopes) \u2014 do not edit by hand",
+      types: [
+        "feat",
+        "fix",
+        "perf",
+        "revert",
+        "docs",
+        "style",
+        "refactor",
+        "test",
+        "build",
+        "ci",
+        "chore"
+      ],
+      scopes: [
+        "dispatcher",
+        "core",
+        "config",
+        "commands",
+        "cli",
+        "init",
+        "setup",
+        "authz",
+        "runs",
+        "tracing",
+        "costs",
+        "delivery",
+        "slack",
+        "http",
+        "mcp",
+        "agents",
+        "review",
+        "coding",
+        "ship",
+        "research",
+        "explore",
+        "conductor",
+        "general",
+        "providers",
+        "resident",
+        "sandbox",
+        "harness",
+        "memory",
+        "skills",
+        "tools",
+        "web",
+        "workers",
+        "deploy",
+        "docs",
+        "load",
+        "process",
+        "release",
+        "deps",
+        "main"
+      ]
+    };
+  }
+});
+
+// ../../src/core/selfDescription.ts
+function residentCapNote(cap) {
+  return cap === void 0 ? RESIDENT_CAP_UNKNOWN_NOTE : `capped at ${cap} residents`;
+}
+function buildClause(build) {
+  if (!build) return "";
+  const commit = build.commit === "unknown" ? "an unstamped build" : `build ${build.commit.slice(0, 8)}`;
+  return ` (version ${build.version}, ${commit} \u2014 \`status show\` reports it live)`;
+}
+function selfDescriptionBlock(agents, organization, caps, residentCap, build) {
+  const agentLines = Object.values(agents).map((a) => `\`${a.name}\` \u2014 ${a.description}`).join("; ");
+  const surfaces = caps.ingress ? "plus a CLI, an HTTP /api and an MCP surface" : "plus a CLI and an HTTP /api surface";
+  const repos = caps.residents ? `Repos: the coding and review agents work in a "resident" \u2014 an always-warm per-repo environment (a mirror clone, installed deps, a built checkout, refreshed on a schedule and snapshotted) on the resident Worker; each run attaches a worktree on its branch in seconds. An admin onboards a repo with \`repo onboard <owner/name>\` (install/build/test commands are detected from the repo root, \`--install/--build/--test\` override), sees the fleet with \`repo list\`, changes it with \`repo reconfigure\` / \`repo rebuild\` / \`repo offboard\`; the fleet is ${residentCapNote(residentCap)} (\`--evict-coldest\` frees a slot). There is no separate "priority repos" setting: onboarded = warm. Repos that are not onboarded run in a cold per-thread workspace.` : `Repos: this installation has no resident (always-warm) repo environments \u2014 the coding and review agents clone the repository a request names (an https://github.com/owner/name URL or a PR link) into a per-thread workspace ${WORKSPACE_WHERE[caps.execution]} for the run. Nothing is kept warm between runs, and there is nothing to onboard.`;
+  const history = caps.runHistory ? ", kept as run history" : " while it runs (this installation keeps no run history: a finished run's page goes away about a minute later)";
+  const memory = caps.memory ? " Cross-session memory is per org/repo/channel/user (`memory list` / `memory forget`)." : " This installation has no cross-session memory: a run knows only its own thread.";
+  return [
+    `${SELF_DESCRIPTION_HEADER} you are Switchboard${buildClause(build)}, the agent gateway of the ${organization} organization. A message arrives on a channel (Slack \u2014 an @-mention, thread follow-ups stay on the same agent \u2014 ${surfaces}), is routed to an agent, runs on a configured provider/model, and executes tools through an executor.`,
+    `Agents: ${agentLines}. Users pick one with an inline \`agent:<name>\` directive (default: general); \`model:\` / \`effort:\` ride the same way (see the runtime-config block).`,
+    repos,
+    `Runs${caps.memory ? " and memory" : ""}: every run (agent or operator command) has a live page under /runs with its events${history}; runs can be stopped from there.${memory} \`help\` lists every chat command.`,
+    `Source of truth: the code lives in the GitHub repo ${SWITCHBOARD_REPO} \u2014 README.md (architecture + agents), AGENTS.md (invariants + map), and one behavioral spec per feature under docs/reference/specs/*.md (e.g. docs/reference/specs/resident-repos.md, docs/reference/specs/routing-and-config.md, docs/reference/specs/github-tools.md). For a question about how Switchboard works beyond this block, read those files with the GitHub tools when you have them (github_tree / github_file on ${SWITCHBOARD_REPO}) \u2014 they are private, so a public-web fetch 404s; if you have no GitHub tools, answer from this block and point at that path. Never describe yourself as stateless, tool-less by design, or unable to know your own workings.`
+  ].join("\n");
+}
+var SELF_DESCRIPTION_HEADER, SWITCHBOARD_REPO, RESIDENT_CAP_UNKNOWN_NOTE, WORKSPACE_WHERE;
+var init_selfDescription = __esm({
+  "../../src/core/selfDescription.ts"() {
+    "use strict";
+    SELF_DESCRIPTION_HEADER = "About Switchboard (yourself):";
+    SWITCHBOARD_REPO = "coreplanelabs/switchboard";
+    RESIDENT_CAP_UNKNOWN_NOTE = "capped (`repo list` shows the cap)";
+    WORKSPACE_WHERE = {
+      local: "on the bot host",
+      e2b: "in an E2B micro-VM",
+      cloudflare: "in a Cloudflare sandbox"
+    };
+  }
+});
+
 // ../../src/core/prDescription.ts
 import { z as z21 } from "zod";
 function visibleLength(s) {
@@ -32502,6 +32947,9 @@ function cappedRaw(base, max) {
     if (n2 > max) ctx.addIssue({ code: z21.ZodIssueCode.custom, message: `at most ${max} characters (got ${n2})` });
   });
 }
+function titleGateApplies(repo) {
+  return repo !== void 0 && repo.toLowerCase() === TITLE_GATE_REPOSITORY;
+}
 function boundedArray(item, min, max, what) {
   return z21.array(item).superRefine((arr, ctx) => {
     if (arr.length < min)
@@ -32510,8 +32958,11 @@ function boundedArray(item, min, max, what) {
       ctx.addIssue({ code: z21.ZodIssueCode.custom, message: `at most ${max} ${what} (got ${arr.length})` });
   });
 }
-function parsePrDescription(input) {
-  return PrDescriptionSchema.parse(input);
+function prDescriptionSchemaFor(repo) {
+  return titleGateApplies(repo) ? PrDescriptionSchema.extend({ title: gatedTitle }) : PrDescriptionSchema;
+}
+function parsePrDescription(input, target = {}) {
+  return prDescriptionSchemaFor(target.repo).parse(input);
 }
 function redactPrDescription(d) {
   return mapStringLeaves(d, redactSecrets);
@@ -32902,16 +33353,19 @@ function parseLegacySteps(lines, problems) {
   }
   return out;
 }
-var PR_DESCRIPTION_CAPS, line2, prose, RISK_SEPARATOR, PrAnchorSchema, PointerSchema, PrDescriptionSchema, REPO_RE2, SHA_RE2, GENERATED_FOOTER, MAP_LABELS, FOLD_SUMMARIES, PERMALINK_SRC, PERMALINK_RE, POINTER_ROW_RE, HEADING_RE, LABEL_RE, SUMMARY_RE, DECISION_RE, TABLE_HEADER_RE, TABLE_RULE_RE, STEP_RE, LOOK_FOR_RE, LABEL_KEYS, WHERE_TO_LOOK, LEGACY_SECTIONS;
+var PR_DESCRIPTION_CAPS, line2, prose, TITLE_GATE_REPOSITORY, gatedTitle, RISK_SEPARATOR, PrAnchorSchema, PointerSchema, PrDescriptionSchema, REPO_RE2, SHA_RE2, GENERATED_FOOTER, MAP_LABELS, FOLD_SUMMARIES, PERMALINK_SRC, PERMALINK_RE, POINTER_ROW_RE, HEADING_RE, LABEL_RE, SUMMARY_RE, DECISION_RE, TABLE_HEADER_RE, TABLE_RULE_RE, STEP_RE, LOOK_FOR_RE, LABEL_KEYS, WHERE_TO_LOOK, LEGACY_SECTIONS;
 var init_prDescription = __esm({
   "../../src/core/prDescription.ts"() {
     "use strict";
+    init_prTitle();
+    init_prTitleVocabulary();
     init_redact();
+    init_selfDescription();
     PR_DESCRIPTION_CAPS = {
       /** The squash subject and the changelog line, the whole line counted: the
-       *  number the title gate (`scripts/check-pr-title.mjs`, `TITLE_MAX_LENGTH`)
-       *  holds it to; a test keeps the two equal. */
-      title: 72,
+       *  title gate's own number (`src/core/prTitle.mjs`), read from it so the
+       *  two cannot drift. */
+      title: TITLE_MAX_LENGTH,
       tldr: 300,
       why: 400,
       pointers: 7,
@@ -32930,6 +33384,13 @@ var init_prDescription = __esm({
     };
     line2 = z21.string().trim().min(1).refine((s) => !/[\r\n]/.test(s), "must be a single line (no embedded newlines)");
     prose = z21.string().trim().min(1);
+    TITLE_GATE_REPOSITORY = SWITCHBOARD_REPO;
+    gatedTitle = line2.superRefine((s, ctx) => {
+      if (s === "") return;
+      const verdict = checkPrTitle(s, prTitleVocabulary_default);
+      if (verdict.ok) return;
+      for (const message4 of verdict.problems) ctx.addIssue({ code: z21.ZodIssueCode.custom, message: message4 });
+    });
     RISK_SEPARATOR = " \u26A0 ";
     PrAnchorSchema = z21.object({
       // Repo-relative: no leading `/`, no `..` SEGMENT (a filename like `a..b.ts` is fine).
@@ -32951,7 +33412,9 @@ var init_prDescription = __esm({
     PrDescriptionSchema = z21.object({
       /** The PR title's single source. Metadata for the PR's own title field —
        *  never rendered into the body (GitHub shows the title itself) — and the
-       *  squash subject, so it is capped like every other field. */
+       *  squash subject, so it is capped like every other field; on the
+       *  repository that carries the title gate, `prDescriptionSchemaFor` judges
+       *  it as the gate does. */
       title: cappedRaw(line2, PR_DESCRIPTION_CAPS.title),
       tldr: capped2(prose, PR_DESCRIPTION_CAPS.tldr),
       why: capped2(prose, PR_DESCRIPTION_CAPS.why),
@@ -33120,13 +33583,13 @@ var init_submit = __esm({
     submitPrDescriptionTool = {
       name: "submit_pr_description",
       failsInText: true,
-      description: "Submit the PR description as a typed object. REQUIRED after pushing your branch: Switchboard renders the GitHub PR body from this object at the pushed head and opens (or updates) the pull request itself \u2014 never open a PR yourself. The body is a fixed-size MAP for the reader (tldr, why, at most 7 pointers, feedbackWanted, risk, verified) with decisions, validation and agentNotes collapsed under it; every field is capped in visible characters (a link's URL is not counted) and the tool refuses an object over a cap naming the field and the count, so cut and resubmit. `title` becomes the PR's title; pointer anchors are (path, from, to) line ranges at your pushed head, rendered as links. Call it after your last push; if you push again afterwards, call it again \u2014 the last valid call wins.",
+      description: "Submit the PR description as a typed object. REQUIRED after pushing your branch: Switchboard renders the GitHub PR body from this object at the pushed head and opens (or updates) the pull request itself \u2014 never open a PR yourself. The body is a fixed-size MAP for the reader (tldr, why, at most 7 pointers, feedbackWanted, risk, verified) with decisions, validation and agentNotes collapsed under it; every field is capped in visible characters (a link's URL is not counted) and the tool refuses an object over a cap naming the field and the count, so cut and resubmit. `title` becomes the PR's title (at most 72 characters); on Switchboard's own repository it is also judged as that repository's CI `title` check judges it \u2014 `type(scope): description`, type from its release config, scope one of its code map's Areas or none \u2014 and refused with that check's own sentence, so fix the title and resubmit; pointer anchors are (path, from, to) line ranges at your pushed head, rendered as links. Call it after your last push; if you push again afterwards, call it again \u2014 the last valid call wins.",
       inputSchema: {
         type: "object",
         properties: {
           title: {
             type: "string",
-            description: "The PR title \u2014 one line naming the change, `type(scope): what a reader can now do or expect`, at most 72 characters in all"
+            description: "The PR title \u2014 one line naming the change, `type(scope): what a reader can now do or expect`, at most 72 characters in all; on Switchboard's own repository a title its CI title check would refuse (type, scope, grammar) is refused here with the same sentence"
           },
           tldr: {
             type: "string",
@@ -33205,7 +33668,7 @@ var init_submit = __esm({
       async run(input, ctx) {
         let desc;
         try {
-          desc = parsePrDescription(input);
+          desc = parsePrDescription(input, ctx.repo === void 0 ? {} : { repo: ctx.repo });
         } catch (err2) {
           const detail = err2 instanceof z22.ZodError ? err2.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ") : String(err2);
           return `error: invalid PR description \u2014 ${detail}`;
@@ -33416,187 +33879,6 @@ var init_statusCardFrame = __esm({
   }
 });
 
-// ../../src/core/confirmations.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import { existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname9, resolve as resolve10 } from "node:path";
-function newConfirmationId() {
-  return randomUUID2();
-}
-function confirmationFooter(scope) {
-  switch (scope) {
-    case "channel":
-      return "confirmation required by this channel's boundary";
-    case "user":
-      return "confirmation required by your boundary";
-    case "defaults":
-      return "confirmation required by the defaults' boundary";
-    case "built-in":
-      return "confirmation required by the built-in default";
-    default:
-      return `confirmation required by the ${scope} boundary`;
-  }
-}
-function renderOffer(offer) {
-  return [offer.line, ...offer.risk ? [offer.risk] : [], offer.footer].join("\n");
-}
-function confirmationMessageOf(msg) {
-  const { images: _images, documents: _documents, staged: _staged, ...kept } = msg;
-  return kept;
-}
-function isRecord3(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function isMessage(v) {
-  return isRecord3(v) && typeof v.channelId === "string" && typeof v.userId === "string" && typeof v.threadKey === "string" && typeof v.text === "string";
-}
-function isPendingConfirmation(v) {
-  return isRecord3(v) && typeof v.id === "string" && isMessage(v.message) && typeof v.command === "string" && isRecord3(v.input) && typeof v.receipt === "string" && typeof v.risk === "string" && typeof v.footer === "string" && typeof v.model === "string";
-}
-function isConfirmation(v) {
-  return isPendingConfirmation(v) && typeof v.expiresAt === "number";
-}
-function isRefusal(v) {
-  return typeof v === "string" && CONFIRMATION_REFUSALS.includes(v);
-}
-function judge2(rows, id, actorIds, now, kind) {
-  const row2 = rows.get(id);
-  if (!row2) return { ok: false, refused: "used" };
-  if (kind === "consume" && row2.expiresAt <= now) {
-    rows.delete(id);
-    return { ok: false, refused: "expired" };
-  }
-  if (!actorIds.includes(row2.message.userId)) return { ok: false, refused: "foreign" };
-  rows.delete(id);
-  return kind === "consume" ? { ok: true, row: row2 } : { ok: true };
-}
-function replaceThreadRow(rows, row2) {
-  for (const [id, r] of rows) if (r.message.threadKey === row2.message.threadKey) rows.delete(id);
-  rows.set(row2.id, row2);
-}
-function buildConfirmationStore(config, secrets, opts) {
-  const worker = config.config.runtimeOverrides?.worker;
-  if (!worker) return new FileConfirmationStore(opts.path);
-  const tokenEnv = worker.tokenEnv ?? "MEMORY_TOKEN";
-  const token2 = secrets.named(tokenEnv);
-  if (!token2) throw new Error(`runtimeOverrides.worker is configured but ${tokenEnv} is not set`);
-  return new WorkerConfirmationStore({
-    baseUrl: worker.baseUrl,
-    token: token2.reveal(),
-    ...opts.fetch ? { fetch: opts.fetch } : {}
-  });
-}
-var CONFIRMATION_REFUSALS, UNSHOWABLE_LINE, STORE_UNREACHABLE_NOTE, FileConfirmationStore, CONFIRMATION_WORKER_TIMEOUT_MS, WorkerConfirmationStore;
-var init_confirmations = __esm({
-  "../../src/core/confirmations.ts"() {
-    "use strict";
-    init_clock();
-    CONFIRMATION_REFUSALS = ["used", "expired", "foreign"];
-    UNSHOWABLE_LINE = "this command carries a value that cannot be shown; type the line yourself";
-    STORE_UNREACHABLE_NOTE = "(the confirmation store could not be reached, so there is no button to press)";
-    FileConfirmationStore = class {
-      path;
-      clock;
-      constructor(path, opts = {}) {
-        this.path = resolve10(path);
-        this.clock = opts.clock ?? systemClock;
-      }
-      read() {
-        const rows = /* @__PURE__ */ new Map();
-        if (!existsSync12(this.path)) return rows;
-        const raw = JSON.parse(readFileSync14(this.path, "utf8"));
-        for (const v of Array.isArray(raw.confirmations) ? raw.confirmations : []) if (isConfirmation(v)) rows.set(v.id, v);
-        return rows;
-      }
-      write(rows) {
-        mkdirSync9(dirname9(this.path), { recursive: true });
-        writeFileSync8(this.path, JSON.stringify({ confirmations: [...rows.values()] }, null, 2));
-      }
-      async put(row2, ttlMs) {
-        const rows = this.read();
-        const stored = { ...row2, expiresAt: this.clock() + ttlMs };
-        replaceThreadRow(rows, stored);
-        this.write(rows);
-        return stored;
-      }
-      async consume(id, actorIds) {
-        const rows = this.read();
-        const out = judge2(rows, id, actorIds, this.clock(), "consume");
-        this.write(rows);
-        return out;
-      }
-      async cancel(id, actorIds) {
-        const rows = this.read();
-        const out = judge2(rows, id, actorIds, this.clock(), "cancel");
-        this.write(rows);
-        return out;
-      }
-      describe() {
-        return `file ${this.path}`;
-      }
-    };
-    CONFIRMATION_WORKER_TIMEOUT_MS = 8e3;
-    WorkerConfirmationStore = class {
-      constructor(opts) {
-        this.opts = opts;
-        this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
-        this.fetchImpl = opts.fetch ?? fetch;
-      }
-      opts;
-      baseUrl;
-      fetchImpl;
-      async put(row2, ttlMs) {
-        const body = await this.post("/config/confirmations/put", {
-          id: row2.id,
-          threadKey: row2.message.threadKey,
-          requester: row2.message.userId,
-          body: row2,
-          ttlMs
-        });
-        if (typeof body.expiresAt !== "number")
-          throw new Error("confirmation store answered a put without the expiry it stamped");
-        return { ...row2, expiresAt: body.expiresAt };
-      }
-      async consume(id, actorIds) {
-        const body = await this.post("/config/confirmations/consume", { id, actorIds });
-        if (isRefusal(body.refused)) return { ok: false, refused: body.refused };
-        const stored = isRecord3(body.row) ? body.row : void 0;
-        const row2 = stored && isRecord3(stored.body) ? { ...stored.body, expiresAt: stored.expiresAt } : void 0;
-        if (!isConfirmation(row2)) throw new Error("confirmation store answered a consume outside its contract");
-        return { ok: true, row: row2 };
-      }
-      async cancel(id, actorIds) {
-        const body = await this.post("/config/confirmations/cancel", { id, actorIds });
-        if (body.ok === true) return { ok: true };
-        if (body.refused === "used" || body.refused === "foreign") return { ok: false, refused: body.refused };
-        throw new Error("confirmation store answered a cancel outside its contract");
-      }
-      describe() {
-        return `state Worker ${this.baseUrl} (ConfigDO confirmations)`;
-      }
-      async post(path, payload) {
-        let res;
-        try {
-          res = await this.fetchImpl(`${this.baseUrl}${path}`, {
-            method: "POST",
-            headers: { authorization: `Bearer ${this.opts.token}`, "content-type": "application/json" },
-            body: JSON.stringify(payload),
-            signal: AbortSignal.timeout(CONFIRMATION_WORKER_TIMEOUT_MS)
-          });
-        } catch (err2) {
-          throw new Error(`confirmation store unreachable: ${err2 instanceof Error ? err2.message : String(err2)}`, {
-            cause: err2
-          });
-        }
-        if (!res.ok) throw new Error(`confirmation store answered HTTP ${res.status} on ${path}`);
-        const body = await res.json().catch(() => void 0);
-        if (!isRecord3(body)) throw new Error(`confirmation store returned a non-JSON body on ${path}`);
-        return body;
-      }
-    };
-  }
-});
-
 // ../../src/core/dispatch/route.ts
 function routedRunsAtOnce(def, confirm) {
   const radius = blastRadius(def);
@@ -34080,9 +34362,8 @@ async function answerHandBack(branch2, msg, def, input, route3, receipt, confirm
     return { kind: "command", command: def.id, outcome };
   };
   const handBack = `${HAND_BACK_PREFIX} ${receipt}`;
-  const offer = io.offer?.bind(io);
   const store = deps.confirmations;
-  if (!offer || !store) return answer(handBack, "hand_back", () => io.reply(handBack));
+  if (!io.offer || !store) return answer(handBack, "hand_back", () => io.reply(handBack));
   const line3 = chatInvocation(def, input);
   if (redactSecrets(line3) !== line3) return answer(UNSHOWABLE_LINE, "hand_back", () => io.reply(UNSHOWABLE_LINE));
   const risk = def.annotations?.risk?.(input) ?? "";
@@ -34112,7 +34393,7 @@ ${STORE_UNREACHABLE_NOTE}`;
   }
   const shown = { id: row2.id, line: line3, risk, footer, expiresAt: row2.expiresAt };
   console.log(`[route] ${msg.threadKey} offered ${def.id} as confirmation ${row2.id} (${footer})`);
-  return answer(renderOffer(shown), "offered", () => offer(shown));
+  return answer(renderOffer(shown), "offered", () => renderConfirmationOffer(io, shown));
 }
 function redactedInput(input) {
   const text = (s) => redactAndCap(redactSecrets(s), ROUTE_COMMAND_VALUE_CAP);
@@ -34172,6 +34453,7 @@ var init_route = __esm({
     init_confirmations();
     init_repoContext();
     init_commandRun();
+    init_reply();
     init_spawn();
     init_statusCardFrame();
     ROUTE_TEXT_CAP = 2e3;
@@ -34282,8 +34564,8 @@ function refusalLine(refused7) {
 function actorIdsOf(actor) {
   return [.../* @__PURE__ */ new Set([actor.id, ...actor.self ?? []])];
 }
-function refused3(r) {
-  return { kind: "refused", refusal: `confirmation_${r}`, text: refusalLine(r) };
+function refused3(r, row2) {
+  return { kind: "refused", refusal: `confirmation_${r}`, text: refusalLine(r), ...row2 ? { row: row2 } : {} };
 }
 async function consumeAndRun(deps, click, io, ending, trace) {
   const store = deps.confirmations;
@@ -34297,7 +34579,7 @@ async function consumeAndRun(deps, click, io, ending, trace) {
     );
     return UNREADABLE;
   }
-  if (!consumed.ok) return refused3(consumed.refused);
+  if (!consumed.ok) return refused3(consumed.refused, consumed.row);
   const row2 = consumed.row;
   const result = await runChatCommand(
     deps,
@@ -34337,7 +34619,7 @@ async function cancelPending(deps, click) {
   if (!cancelled.ok) return refused3(cancelled.refused);
   return { kind: "cancelled", text: OFFER_CANCELLED_LINE };
 }
-var OFFER_EXPIRED_LINE, OFFER_FOREIGN_LINE, OFFER_USED_LINE, OFFER_UNREADABLE_LINE, OFFER_CANCELLED_LINE, CONFIRMED_REASON, UNREADABLE;
+var OFFER_EXPIRED_LINE, OFFER_FOREIGN_LINE, OFFER_USED_LINE, OFFER_UNREADABLE_LINE, OFFER_CANCELLED_LINE, CONFIRMED_REASON, REFUSED_REASON, UNREADABLE;
 var init_confirm = __esm({
   "../../src/core/dispatch/confirm.ts"() {
     "use strict";
@@ -34350,6 +34632,7 @@ var init_confirm = __esm({
     OFFER_UNREADABLE_LINE = "the confirmation could not be read; type the line to run it";
     OFFER_CANCELLED_LINE = "Cancelled; nothing ran";
     CONFIRMED_REASON = "confirmed after offer";
+    REFUSED_REASON = "refused after offer";
     UNREADABLE = { kind: "refused", refusal: "confirmation_unreadable", text: OFFER_UNREADABLE_LINE };
   }
 });
@@ -35288,12 +35571,12 @@ var init_reviewRound = __esm({
 
 // ../../src/core/dispatch/authorize.ts
 async function authorizeAgent(deps, ctx) {
-  const { msg, io, refuse: refuse3, agentName } = ctx;
+  const { msg, refuse: refuse3, agentName } = ctx;
   if (!deps.config.canRunAgent(chatActorOf(deps.config, msg), agentName)) {
     await refuse3(
-      "agent_allowlist",
-      () => io.reply(
-        `\u{1F6AB} You're not on the allowlist for the \`${agentName}\` agent. Ask ${deps.config.adminsHint()} for access.`
+      refusalOf(
+        "agent_allowlist",
+        REFUSAL_SENTENCES.agent_allowlist({ agent: agentName, adminsHint: deps.config.adminsHint() })
       )
     );
     return { kind: "refused", reason: "agent_allowlist" };
@@ -35301,11 +35584,11 @@ async function authorizeAgent(deps, ctx) {
   return { kind: "allowed" };
 }
 async function authorizeProfile(deps, ctx) {
-  const { msg, io, refuse: refuse3, agent, resolution } = ctx;
+  const { msg, refuse: refuse3, agent, resolution } = ctx;
   if (resolution.kind === "profile") return { kind: "allowed", profile: resolution.profile };
   const { refusal } = resolution;
   console.log(`[dispatch] ${msg.threadKey} not started: profile bounded (${agent.name}: ${refusalSummary(refusal)})`);
-  await refuse3("profile_bounded", () => io.reply(profileRefusalReply(agent.name, refusal, deps.config.adminsHint())));
+  await refuse3(refusalOf("profile_bounded", profileRefusalReply(agent.name, refusal, deps.config.adminsHint())));
   return { kind: "refused", reason: "profile_bounded" };
 }
 function refusalSummary(refusal) {
@@ -35384,19 +35667,17 @@ function profileRefusalReply(agentName, refusal, adminsHint) {
   return `\u{1F6AB} \`${agentName}\` runs on a \`${refusal.needs}\` machine; ${who2} only ${allowed2}. ${capitalize(how)}.`;
 }
 async function authorizeRepo(deps, ctx) {
-  const { msg, io, refuse: refuse3, card, shell, closeLines, clock: clock4, agent, profile, needsRepo, repoCtx } = ctx;
+  const { msg, refuse: refuse3, card, shell, closeLines, clock: clock4, agent, profile, needsRepo, repoCtx } = ctx;
   if (profile.machine === "repo-cold" && needsRepo && !repoCtx.repo) {
     if (repoCtx.rejectedRepo) {
       const slug = repoCtx.rejectedRepo;
       console.log(`[dispatch] ${msg.threadKey} not started: repo not visible (${slug}: GitHub answered 404)`);
-      await refuse3("repo_not_visible", async () => {
-        await card.done(
+      await refuse3(
+        refusalOf("repo_not_visible", REFUSAL_SENTENCES.repo_not_visible({ slug, agent: agent.name })),
+        () => card.done(
           shell.close({ kind: "not_started", icon: "\u{1F4E6}", reason: "repo not visible", ...closeLines(clock4(), false) })
-        );
-        await io.reply(
-          `\u{1F4E6} \`${slug}\` is not a repository this installation can see \u2014 GitHub answered 404 \u2014 so I did not start ${aRun(agent.name)} for it. The repository is outside the Switchboard GitHub App installation (\`github_repos\` lists the reachable ones), or the name is wrong.`
-        );
-      });
+        )
+      );
       return { kind: "refused", reason: "repo_not_visible" };
     }
     if (repoCtx.unverifiedRepo) {
@@ -35404,19 +35685,17 @@ async function authorizeRepo(deps, ctx) {
       console.log(
         `[dispatch] ${msg.threadKey} not started: repo could not be verified (${slug}: GitHub did not answer)`
       );
-      await refuse3("repo_unverified", async () => {
-        await card.done(
+      await refuse3(
+        refusalOf("repo_unverified", REFUSAL_SENTENCES.repo_unverified({ slug, agent: agent.name, via: "github" })),
+        () => card.done(
           shell.close({
             kind: "not_started",
             icon: "\u{1F4E6}",
             reason: "repo could not be verified",
             ...closeLines(clock4(), false)
           })
-        );
-        await io.reply(
-          `\u26A0\uFE0F I couldn't verify \`${slug}\` against GitHub \u2014 it didn't answer \u2014 so I did not start ${aRun(agent.name)} rather than guess which repository you meant. Try again in a minute.`
-        );
-      });
+        )
+      );
       return { kind: "refused", reason: "repo_unverified" };
     }
   }
@@ -35424,14 +35703,12 @@ async function authorizeRepo(deps, ctx) {
     const slug = repoCtx.rejectedRepo;
     console.log(`[dispatch] ${msg.threadKey} not started: repo not onboarded (${slug})`);
     const onboardHint = deps.config.canManageRepos(chatActorOf(deps.config, msg)) ? `Onboard it (\`repo onboard ${slug}\`)` : `Ask ${deps.config.adminsHint()} to onboard it (\`repo onboard ${slug}\`)`;
-    await refuse3("repo_not_onboarded", async () => {
-      await card.done(
+    await refuse3(
+      refusalOf("repo_not_onboarded", REFUSAL_SENTENCES.repo_not_onboarded({ slug, agent: agent.name, onboardHint })),
+      () => card.done(
         shell.close({ kind: "not_started", icon: "\u{1F4E6}", reason: "repo not onboarded", ...closeLines(clock4(), false) })
-      );
-      await io.reply(
-        `\u{1F4E6} \`${slug}\` is not onboarded as a resident, so I did not start a *${agent.name}* run for it. ${onboardHint} for a warm, deps-ready environment, or name the repository by URL (https://github.com/${slug}) to run in a cold per-thread sandbox.`
-      );
-    });
+      )
+    );
     return { kind: "refused", reason: "repo_not_onboarded" };
   }
   if (needsRepo && !repoCtx.repo && repoCtx.unverifiedRepo) {
@@ -35439,55 +35716,48 @@ async function authorizeRepo(deps, ctx) {
     console.log(
       `[dispatch] ${msg.threadKey} not started: repo could not be verified (${slug}: resident registry unreachable)`
     );
-    await refuse3("repo_unverified", async () => {
-      await card.done(
+    await refuse3(
+      refusalOf("repo_unverified", REFUSAL_SENTENCES.repo_unverified({ slug, agent: agent.name, via: "registry" })),
+      () => card.done(
         shell.close({
           kind: "not_started",
           icon: "\u{1F4E6}",
           reason: "repo could not be verified",
           ...closeLines(clock4(), false)
         })
-      );
-      await io.reply(
-        `\u26A0\uFE0F I couldn't verify that \`${slug}\` is an onboarded repo \u2014 the resident registry didn't answer \u2014 so I did not start a *${agent.name}* run rather than guess which repo you meant. Try again in a minute, or name the repository by URL (https://github.com/${slug}) to run in a cold per-thread sandbox.`
-      );
-    });
+      )
+    );
     return { kind: "refused", reason: "repo_unverified" };
   }
   if (needsRepo && repoCtx.repo && !deps.config.canUseRepo(chatActorOf(deps.config, msg), repoCtx.repo)) {
     const repo = repoCtx.repo;
-    await refuse3("repo_access", async () => {
-      await card.done(
+    await refuse3(
+      refusalOf("repo_access", REFUSAL_SENTENCES.repo_access({ repo, adminsHint: deps.config.adminsHint() })),
+      () => card.done(
         shell.close({ kind: "not_started", icon: "\u{1F6AB}", reason: "repo access", ...closeLines(clock4(), false) })
-      );
-      await io.reply(
-        `\u{1F6AB} You're not on the allowlist for the \`${repo}\` repo environment. Ask ${deps.config.adminsHint()} for access.`
-      );
-    });
+      )
+    );
     return { kind: "refused", reason: "repo_access" };
   }
   return { kind: "allowed" };
 }
-function aRun(agentName) {
-  return `${/^[aeiou]/i.test(agentName) ? "an" : "a"} *${agentName}* run`;
-}
 async function authorizePrHead(ctx) {
-  const { msg, io, refuse: refuse3, card, shell, closeLines, clock: clock4, agent, directives, repoCtx } = ctx;
+  const { msg, refuse: refuse3, card, shell, closeLines, clock: clock4, agent, directives, repoCtx } = ctx;
   const preflight = checkPrHeadPreflight({ agent, requestText: directives.text, repoCtx });
   if (!preflight.ok) {
     console.log(`[review] ${msg.threadKey} not started: PR head unknown (${preflight.where})`);
-    await refuse3("pr_head_unknown", async () => {
-      await card.done(
+    await refuse3(
+      refusalOf("pr_head_unknown", preflight.reply),
+      () => card.done(
         shell.close({ kind: "not_started", icon: "\u{1F500}", reason: "PR head unknown", ...closeLines(clock4(), false) })
-      );
-      await io.reply(preflight.reply);
-    });
+      )
+    );
     return { kind: "refused", reason: "pr_head_unknown" };
   }
   return { kind: "allowed" };
 }
 async function authorizeAttachedHead(deps, ctx) {
-  const { msg, io, refuse: refuse3, card, shell, closeLines, clock: clock4, agent, resume, selection, root } = ctx;
+  const { msg, refuse: refuse3, card, shell, closeLines, clock: clock4, agent, resume, selection, root } = ctx;
   const { executor, resident, binding } = selection;
   let repoCtx = ctx.repoCtx;
   let verifiedAtAttach = false;
@@ -35513,14 +35783,12 @@ async function authorizeAttachedHead(deps, ctx) {
       verifiedAtAttach = true;
       headAdopted = true;
     } else if (guard.outcome === "refused") {
-      const reply = guard.reply;
-      await refuse3("branch_moved", async () => {
+      await refuse3(refusalOf("branch_moved", guard.reply), async () => {
         if (executor.release) await executor.release("always").catch(() => {
         });
         await card.done(
           shell.close({ kind: "not_started", icon: "\u{1F500}", reason: "branch moved", ...closeLines(clock4(), false) })
         );
-        await io.reply(reply);
       });
       return { kind: "refused", reason: "branch_moved" };
     }
@@ -35533,6 +35801,8 @@ var init_authorize2 = __esm({
     init_actor();
     init_repoContext();
     init_reviewRound();
+    init_refusal();
+    init_reply();
   }
 });
 
@@ -35887,44 +36157,6 @@ var init_configAwareness = __esm({
   }
 });
 
-// ../../src/core/selfDescription.ts
-function residentCapNote(cap) {
-  return cap === void 0 ? RESIDENT_CAP_UNKNOWN_NOTE : `capped at ${cap} residents`;
-}
-function buildClause(build) {
-  if (!build) return "";
-  const commit = build.commit === "unknown" ? "an unstamped build" : `build ${build.commit.slice(0, 8)}`;
-  return ` (version ${build.version}, ${commit} \u2014 \`status show\` reports it live)`;
-}
-function selfDescriptionBlock(agents, organization, caps, residentCap, build) {
-  const agentLines = Object.values(agents).map((a) => `\`${a.name}\` \u2014 ${a.description}`).join("; ");
-  const surfaces = caps.ingress ? "plus a CLI, an HTTP /api and an MCP surface" : "plus a CLI and an HTTP /api surface";
-  const repos = caps.residents ? `Repos: the coding and review agents work in a "resident" \u2014 an always-warm per-repo environment (a mirror clone, installed deps, a built checkout, refreshed on a schedule and snapshotted) on the resident Worker; each run attaches a worktree on its branch in seconds. An admin onboards a repo with \`repo onboard <owner/name>\` (install/build/test commands are detected from the repo root, \`--install/--build/--test\` override), sees the fleet with \`repo list\`, changes it with \`repo reconfigure\` / \`repo rebuild\` / \`repo offboard\`; the fleet is ${residentCapNote(residentCap)} (\`--evict-coldest\` frees a slot). There is no separate "priority repos" setting: onboarded = warm. Repos that are not onboarded run in a cold per-thread workspace.` : `Repos: this installation has no resident (always-warm) repo environments \u2014 the coding and review agents clone the repository a request names (an https://github.com/owner/name URL or a PR link) into a per-thread workspace ${WORKSPACE_WHERE[caps.execution]} for the run. Nothing is kept warm between runs, and there is nothing to onboard.`;
-  const history = caps.runHistory ? ", kept as run history" : " while it runs (this installation keeps no run history: a finished run's page goes away about a minute later)";
-  const memory = caps.memory ? " Cross-session memory is per org/repo/channel/user (`memory list` / `memory forget`)." : " This installation has no cross-session memory: a run knows only its own thread.";
-  return [
-    `${SELF_DESCRIPTION_HEADER} you are Switchboard${buildClause(build)}, the agent gateway of the ${organization} organization. A message arrives on a channel (Slack \u2014 an @-mention, thread follow-ups stay on the same agent \u2014 ${surfaces}), is routed to an agent, runs on a configured provider/model, and executes tools through an executor.`,
-    `Agents: ${agentLines}. Users pick one with an inline \`agent:<name>\` directive (default: general); \`model:\` / \`effort:\` ride the same way (see the runtime-config block).`,
-    repos,
-    `Runs${caps.memory ? " and memory" : ""}: every run (agent or operator command) has a live page under /runs with its events${history}; runs can be stopped from there.${memory} \`help\` lists every chat command.`,
-    `Source of truth: the code lives in the GitHub repo ${SWITCHBOARD_REPO} \u2014 README.md (architecture + agents), AGENTS.md (invariants + map), and one behavioral spec per feature under docs/reference/specs/*.md (e.g. docs/reference/specs/resident-repos.md, docs/reference/specs/routing-and-config.md, docs/reference/specs/github-tools.md). For a question about how Switchboard works beyond this block, read those files with the GitHub tools when you have them (github_tree / github_file on ${SWITCHBOARD_REPO}) \u2014 they are private, so a public-web fetch 404s; if you have no GitHub tools, answer from this block and point at that path. Never describe yourself as stateless, tool-less by design, or unable to know your own workings.`
-  ].join("\n");
-}
-var SELF_DESCRIPTION_HEADER, SWITCHBOARD_REPO, RESIDENT_CAP_UNKNOWN_NOTE, WORKSPACE_WHERE;
-var init_selfDescription = __esm({
-  "../../src/core/selfDescription.ts"() {
-    "use strict";
-    SELF_DESCRIPTION_HEADER = "About Switchboard (yourself):";
-    SWITCHBOARD_REPO = "coreplanelabs/switchboard";
-    RESIDENT_CAP_UNKNOWN_NOTE = "capped (`repo list` shows the cap)";
-    WORKSPACE_WHERE = {
-      local: "on the bot host",
-      e2b: "in an E2B micro-VM",
-      cloudflare: "in a Cloudflare sandbox"
-    };
-  }
-});
-
 // ../../src/core/customInstructions.ts
 function customInstructionsBlock(scopes) {
   const channel = scopes.channel.instructions?.trim();
@@ -36307,7 +36539,7 @@ async function reattachWorkspace2(deps, ctx) {
   }
 }
 async function attachWorkspace(deps, ctx) {
-  const { msg, io, refuse: refuse3, card, shell, closeLines, clock: clock4, agent, profile, repoCtx, root, reattach, stopSignal } = ctx;
+  const { msg, refuse: refuse3, card, shell, closeLines, clock: clock4, agent, profile, repoCtx, root, reattach, stopSignal } = ctx;
   const { remainingMs } = ctx;
   let round2;
   try {
@@ -36325,14 +36557,12 @@ async function attachWorkspace(deps, ctx) {
   } catch (err2) {
     if (err2 instanceof ResidentNeedsRefError) {
       const repo = repoCtx.repo;
-      await refuse3("which_branch", async () => {
-        await card.done(
+      await refuse3(
+        refusalOf("which_branch", REFUSAL_SENTENCES.which_branch({ repo })),
+        () => card.done(
           shell.close({ kind: "not_started", icon: "\u{1F33F}", reason: "which branch?", ...closeLines(clock4(), false) })
-        );
-        await io.reply(
-          `\u{1F33F} Which branch of \`${repo}\` should this thread work on? No branch is bound yet \u2014 reply naming one (e.g. "on main" or "on branch fix/login") and I'll pick it up from there.`
-        );
-      });
+        )
+      );
       return { kind: "refused", reason: "which_branch" };
     }
     if (err2 instanceof WorkspaceReattachRefusedError) return { kind: "reattach_refused", why: err2.why };
@@ -36504,6 +36734,7 @@ var init_provision = __esm({
     init_types5();
     init_record();
     init_reply();
+    init_refusal();
     init_messages();
     init_route();
     init_roster();
@@ -36827,12 +37058,12 @@ async function prepareRelaunch(deps, ctx) {
       );
     round2 = reattached.round;
   }
-  const counted = { ...facts2, relaunches: relaunches + 1 };
-  let written = counted;
+  const counted2 = { ...facts2, relaunches: relaunches + 1 };
+  let written = counted2;
   let bearer;
   if (deps.runBearers) {
     const rotated = deps.runBearers.rotate(ctx.runId, (secretHash) => {
-      written = { ...counted, bearerHash: secretHash };
+      written = { ...counted2, bearerHash: secretHash };
       ctx.saveFacts(written);
     });
     if (!rotated.ok)
@@ -37746,12 +37977,56 @@ var init_botHostContainer = __esm({
 });
 
 // ../../src/core/harness/windDown.ts
+function windDownEndingOf(writeUp, text, writeUpFailed, ended = "failed") {
+  const failed = writeUpFailed !== void 0 ? { writeUpFailed } : {};
+  if (writeUp?.kind === "time") return { kind: "time", text, ...failed };
+  if (writeUp?.kind === "turns") return { kind: "turns", pace: writeUp.pace, text, ...failed };
+  if (writeUp?.kind === "soft") return { kind: "soft", text, ...failed };
+  if (writeUpFailed !== void 0) return { kind: "unlabelled", text, writeUpFailed, ended };
+  return void 0;
+}
+function windDownAnswer(ending, maxMinutes, facts2) {
+  switch (ending.kind) {
+    case "time":
+      return timeBudgetAnswer(ending.text, maxMinutes, ending.writeUpFailed, facts2);
+    case "turns":
+      return turnGuardAnswer(ending.text, ending.pace, ending.writeUpFailed, facts2);
+    case "soft":
+      return softStopAnswer(ending.text, ending.writeUpFailed, facts2);
+    case "unlabelled":
+      return unlabelledAnswer(ending.text, ending.writeUpFailed, ending.ended, facts2);
+  }
+}
+function established(facts2, advice) {
+  const then = advice ? ` \u2014 ${advice}` : "";
+  const w = facts2?.workspace;
+  let tree = "";
+  if (w?.kind === "unmeasured") tree = `The workspace could not be measured, so work may sit unpushed there${then}.`;
+  else if (w?.kind === "clean")
+    tree = `The tree was clean${w.branch ? ` and \`${w.branch}\` held no unpushed commits` : " with no unpushed commits"}${w.head ? ` \u2014 its head \`${shortSha(w.head)}\` is on the remote` : ""}.`;
+  else if (w?.kind === "salvaged")
+    tree = `What the tree held was pushed to \`${w.branch}\`${w.head ? ` at \`${shortSha(w.head)}\`` : ""} by the budget salvage, unreviewed \u2014 a follow-up starts from it.`;
+  else if (w?.kind === "left")
+    tree = w.fate === "kept" ? `${counted(w)} sit in the workspace, kept for this thread until it idles out \u2014 a follow-up here reuses them.` : w.fate === "discarded" ? `${counted(w)} were left in the tree and discarded at the run's end${then}.` : `${counted(w)} were left in the tree, which is torn down since a command may still be running in it${then}.`;
+  const description = facts2?.description === "submitted" ? "The PR description was submitted." : facts2?.description === "not_submitted" ? "No PR description was submitted." : "";
+  return [tree, description].filter((s) => s !== "").join(" ");
+}
+function nothingWritten(facts2, advice) {
+  const known = established(facts2, advice);
+  if (known) return ` ${known}`;
+  if (facts2?.workspace?.kind === "none") return advice ? ` ${advice.charAt(0).toUpperCase()}${advice.slice(1)}.` : "";
+  return ` Partial work may exist in the workspace${advice ? ` \u2014 ${advice}` : ""}.`;
+}
+function beforeFindings(facts2) {
+  const known = established(facts2, void 0);
+  return known ? `. ${known} Findings so far:` : " \u2014 findings so far:";
+}
 function elapsedMinutes(ms) {
   const minutes = Math.round(ms / 6e4);
   if (minutes < 1) return "under a minute";
   return `${minutes} minute${minutes === 1 ? "" : "s"}`;
 }
-var HARD_STOP_MESSAGE, CONTINUE_PROMPT, wrapUpNote, wrapUpInstruction, WRITE_UP_REQUEST, timeBudgetInstruction, turnGuardInstruction, SOFT_STOP_INSTRUCTION, turnGuardPace, MODEL_CALL_IN_FLIGHT, timeBudgetNote, toolCutNote, turnGuardNote, softStopNote, hardStopNote, windDownFailureNote, finaleTimedOutNote, wrapUpUndeliveredNote, wrapUpNeverPostedNote, wrapUpWriteFailedNote, ABORT_DROPPED_NOTE, abortWriteFailedNote, abortReaskedNote, abortFailedAfterEndNote, abortUnheardAtEndNote, timesWord, wrapUpName, finaleAbortReason, noWriteUp, timeBudgetAnswer, turnGuardAnswer, unlabelledAnswer, softStopAnswer;
+var HARD_STOP_MESSAGE, CONTINUE_PROMPT, wrapUpNote, wrapUpInstruction, WRITE_UP_REQUEST, timeBudgetInstruction, turnGuardInstruction, SOFT_STOP_INSTRUCTION, turnGuardPace, MODEL_CALL_IN_FLIGHT, timeBudgetNote, toolCutNote, turnGuardNote, softStopNote, hardStopNote, windDownFailureNote, finaleWaitNote, finaleTimedOutNote, wrapUpUndeliveredNote, wrapUpNeverPostedNote, wrapUpWriteFailedNote, ABORT_DROPPED_NOTE, abortWriteFailedNote, abortReaskedNote, abortFailedAfterEndNote, abortUnheardAtEndNote, timesWord, wrapUpName, finaleAbortReason, noWriteUp, TIME_ADVICE, TURN_ADVICE, shortSha, counted, timeBudgetAnswer, turnGuardAnswer, unlabelledAnswer, softStopAnswer;
 var init_windDown = __esm({
   "../../src/core/harness/windDown.ts"() {
     "use strict";
@@ -37771,6 +38046,7 @@ var init_windDown = __esm({
     softStopNote = () => "soft stop \u2014 no further steps, writing up findings so far";
     hardStopNote = () => "hard stop \u2014 run aborted, no summary written";
     windDownFailureNote = (error, closes = "run") => `the model call failed during the wind-down (${error}); the ${closes} closes with its findings so far`;
+    finaleWaitNote = (reason2, doing, interruptUnanswered, closes = "run") => `the finale bound ended the wait${doing ? ` while ${doing}` : ""}${interruptUnanswered ? ", the loop-end interrupt unanswered" : ""} (${reason2}); the ${closes} closes with its findings so far`;
     finaleTimedOutNote = (closes = "run") => `finale timed out \u2014 closing the ${closes} without a write-up`;
     wrapUpUndeliveredNote = (kind, closes = "run") => `the ${wrapUpName(kind)} wrap-up instruction never reached pi \u2014 held behind a prompt in doubt when pi settled \u2014 so the ${closes} closes on pi's own answer, unlabelled`;
     wrapUpNeverPostedNote = (kind, closes = "run", ended = "finished") => `the ${wrapUpName(kind)} wrap-up instruction was never posted \u2014 ${ended === "finale" ? "the loop-end interrupt was never answered, the finale bound ending the wait" : `the loop-end interrupt found the session idle, the execution having ${ended === "failed" ? "failed on the provider" : "finished on its own"}`} \u2014 so the ${closes} closes on OpenCode's own answer, unlabelled`;
@@ -37792,25 +38068,29 @@ var init_windDown = __esm({
     wrapUpName = (kind) => kind === "time" ? "time-budget" : kind === "turns" ? "turn-guard" : "soft-stop";
     finaleAbortReason = (boundMs) => `aborted at the finale bound (${elapsedMinutes(boundMs)})`;
     noWriteUp = (failed) => failed ? `; the model call failed during the wind-down (${failed}), so no write-up came` : "";
-    timeBudgetAnswer = (text, maxMinutes, writeUpFailed) => text ? `\u26A0\uFE0F _Hit the ${maxMinutes}-minute budget before finishing \u2014 findings so far:_
+    TIME_ADVICE = "narrow the task and try again";
+    TURN_ADVICE = "look for a retry loop in the run's events before trying again";
+    shortSha = (sha) => sha.slice(0, 7);
+    counted = (w) => `${w.uncommitted} uncommitted change(s) and ${w.unpushed} unpushed commit(s)`;
+    timeBudgetAnswer = (text, maxMinutes, writeUpFailed, facts2) => text ? `\u26A0\uFE0F _Hit the ${maxMinutes}-minute budget before finishing${beforeFindings(facts2)}_
 
-${text}` : `Stopped at the ${maxMinutes}-minute budget without finishing${noWriteUp(writeUpFailed)}. Partial work may exist in the workspace \u2014 narrow the task and try again.`;
-    turnGuardAnswer = (text, pace, writeUpFailed) => text ? `\u26A0\uFE0F _Stopped after ${pace} \u2014 that pace looks like a loop; findings so far:_
+${text}` : `Stopped at the ${maxMinutes}-minute budget without finishing${noWriteUp(writeUpFailed)}.${nothingWritten(facts2, TIME_ADVICE)}`;
+    turnGuardAnswer = (text, pace, writeUpFailed, facts2) => text ? `\u26A0\uFE0F _Stopped after ${pace} \u2014 that pace looks like a loop${established(facts2, void 0) ? beforeFindings(facts2) : "; findings so far:"}_
 
-${text}` : `Stopped after ${pace} \u2014 that pace looks like a loop \u2014 without finishing${noWriteUp(writeUpFailed)}. Partial work may exist in the workspace \u2014 look for a retry loop in the run's events before trying again.`;
-    unlabelledAnswer = (text, writeUpFailed, ended = "failed") => {
+${text}` : `Stopped after ${pace} \u2014 that pace looks like a loop \u2014 without finishing${noWriteUp(writeUpFailed)}.${nothingWritten(facts2, TURN_ADVICE)}`;
+    unlabelledAnswer = (text, writeUpFailed, ended = "failed", facts2) => {
       if (!writeUpFailed) return text || "_(no response)_";
       if (ended === "finale")
         return text ? `${text}
 
-\u26A0\uFE0F _The write-up never started: the loop-end interrupt went unanswered and the finale bound ended the wait (${writeUpFailed}); this is the last answer before it._` : `\u26A0\uFE0F The write-up never started: the loop-end interrupt went unanswered and the finale bound ended the wait (${writeUpFailed}). Partial work may exist in the workspace.`;
+\u26A0\uFE0F _The write-up never started: the loop-end interrupt went unanswered and the finale bound ended the wait (${writeUpFailed}); this is the last answer before it._` : `\u26A0\uFE0F The write-up never started: the loop-end interrupt went unanswered and the finale bound ended the wait (${writeUpFailed}).${nothingWritten(facts2, void 0)}`;
       return text ? `${text}
 
-\u26A0\uFE0F _The model call that followed failed (${writeUpFailed}); this is the last answer before it._` : `\u26A0\uFE0F The model call failed (${writeUpFailed}) and no answer came. Partial work may exist in the workspace.`;
+\u26A0\uFE0F _The model call that followed failed (${writeUpFailed}); this is the last answer before it._` : `\u26A0\uFE0F The model call failed (${writeUpFailed}) and no answer came.${nothingWritten(facts2, void 0)}`;
     };
-    softStopAnswer = (text, writeUpFailed) => text ? `\u23F9 _Stopped early by an operator (soft stop) \u2014 findings so far:_
+    softStopAnswer = (text, writeUpFailed, facts2) => text ? `\u23F9 _Stopped early by an operator (soft stop)${beforeFindings(facts2)}_
 
-${text}` : `\u23F9 Stopped early by an operator (soft stop) before any findings were written${noWriteUp(writeUpFailed)}. Partial work may exist in the workspace.`;
+${text}` : `\u23F9 Stopped early by an operator (soft stop) before any findings were written${noWriteUp(writeUpFailed)}.${nothingWritten(facts2, void 0)}`;
   }
 });
 
@@ -40777,6 +41057,7 @@ ${stagedLine}` : prompt;
       throw new Error(`pi exited before the run settled${tail2.trim() ? `: ${redactAndCap(tail2.trim(), 400)}` : ""}`);
     };
     let answer;
+    let ending;
     if (finaleAborted && !settled && (containerSaid ?? transportLost) !== void 0) {
       const met = containerSaid ?? transportLost;
       note(
@@ -40800,7 +41081,8 @@ ${stagedLine}` : prompt;
         );
       }
       const text = bridge.answer() ?? "";
-      answer = writeUp?.kind === "time" ? timeBudgetAnswer(text, run2.agent.maxMinutes, writeUpFailed) : writeUp?.kind === "turns" ? turnGuardAnswer(text, writeUp.pace, writeUpFailed) : writeUp?.kind === "soft" || stopMode === "soft" ? softStopAnswer(text, writeUpFailed) : text || "_(no response)_";
+      ending = windDownEndingOf(writeUp ?? (stopMode === "soft" ? { kind: "soft" } : void 0), text, writeUpFailed);
+      answer = ending ? windDownAnswer(ending, run2.agent.maxMinutes) : unlabelledAnswer(text, void 0);
     }
     agentSpan?.end(hardStopped ? "error" : "ok");
     const root = paths;
@@ -40977,10 +41259,8 @@ ${stagedLine}` : prompt;
           throw new Error(`the model call failed: ${turnError}`);
         }
         const text = bridge.answer() ?? "";
-        if (writeUp?.kind === "time") return timeBudgetAnswer(text, input.maxMinutes, writeUpFailed);
-        if (writeUp?.kind === "turns") return turnGuardAnswer(text, writeUp.pace, writeUpFailed);
-        if (writeUp?.kind === "soft") return softStopAnswer(text, writeUpFailed);
-        return text || "_(no response)_";
+        const turnEnding = windDownEndingOf(writeUp, text, writeUpFailed);
+        return turnEnding ? windDownAnswer(turnEnding, input.maxMinutes) : unlabelledAnswer(text, void 0);
       } catch (err2) {
         turnFailed = true;
         if (err2 instanceof HarnessControlFileLostError) note("harness_error", err2.message);
@@ -40993,7 +41273,7 @@ ${stagedLine}` : prompt;
         turnSpan?.end(hardStopped || bypass || turnFailed ? "error" : "ok");
       }
     };
-    return { answer, followUp, remainingMs: () => deadline - now(), end };
+    return { answer, ...ending ? { ending } : {}, followUp, remainingMs: () => deadline - now(), end };
   } catch (err2) {
     loopEnded = true;
     requeueUnechoed();
@@ -42088,6 +42368,10 @@ async function runLoop(deps, ctx) {
   };
   const restoredDescription = PrDescriptionSchema.safeParse(restored.prDescription);
   let prDescription = restoredDescription.success ? restoredDescription.data : void 0;
+  if (!restoredDescription.success && restored.prDescription !== void 0) {
+    const why = restoredDescription.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+    console.log(`[resume] ${msg.threadKey} the restored PR description no longer parses and is dropped \u2014 ${why}`);
+  }
   const onPrDescription = (d) => {
     prDescription = d;
     ledgerRun?.setState({ prDescription: d });
@@ -42151,6 +42435,8 @@ async function runLoop(deps, ctx) {
   let runDiagnosis;
   let harnessSession;
   let leaseSpentDuringRelaunch;
+  let windDownEnding;
+  let salvagedTo;
   let relaunchEndedRun = false;
   const tailSkipped = () => run2.control.requested === "hard" || relaunchEndedRun;
   const releaseWorkspace = (span) => {
@@ -42199,6 +42485,7 @@ async function runLoop(deps, ctx) {
     skills: deps.skills,
     github: githubCapabilityFor(deps, chatActorOf(deps.config, msg)),
     agentName: agent.name,
+    ...repoCtx.repo ? { repo: repoCtx.repo } : {},
     ...spawn7 ? { spawn: spawn7 } : {},
     ...runs ? { runs } : {},
     ...steer ? { steer } : {},
@@ -42280,6 +42567,7 @@ async function runLoop(deps, ctx) {
             await judge4.end(facts2, container);
         }
       } else noteUnknownWord("the run finished on the answer it already had");
+      windDownEnding = windDownEndingUnder(finish2.answer, loopEnding);
       answer = answerUnderEnding(finish2.answer, loopEnding, agent.maxMinutes);
     } else {
       if (!deps.harness)
@@ -42410,7 +42698,8 @@ async function runLoop(deps, ctx) {
             harnessDeps.registry.forget(run2.id);
             relaunchEndedRun = true;
             onEvent({ type: "run_note", kind: "time_budget_exhausted", summary: decision.why });
-            leaseSpentDuringRelaunch = timeBudgetAnswer("", agent.maxMinutes);
+            windDownEnding = { kind: "time", text: "" };
+            leaseSpentDuringRelaunch = windDownAnswer(windDownEnding, agent.maxMinutes);
             break;
           }
           if (decision.round !== void 0) {
@@ -42427,6 +42716,7 @@ async function runLoop(deps, ctx) {
         }
       }
       answer = harnessSession?.answer ?? leaseSpentDuringRelaunch ?? HARD_STOP_MESSAGE;
+      if (harnessSession?.ending !== void 0) windDownEnding = harnessSession.ending;
     }
     if (isPrReview && repoCtx.repo && repoCtx.pr !== void 0 && !tailSkipped() && postedBefore === void 0) {
       const settled = await settleReviewedHead({
@@ -42531,6 +42821,11 @@ async function runLoop(deps, ctx) {
       onEvent({ type: "run_note", kind: "budget_salvage", summary: salvaged.summary });
       if (salvaged.pushed && "head" in salvaged && salvaged.head !== void 0 && !("skipped" in target))
         onEvent({ type: "pushed_head", ref: target.branch, sha: salvaged.head, by: "salvage" });
+      if (salvaged.pushed && !("skipped" in target))
+        salvagedTo = {
+          branch: target.branch,
+          ..."head" in salvaged && salvaged.head !== void 0 ? { head: salvaged.head } : {}
+        };
       if (salvaged.pushed) await observeWorkspaceNow();
     }
     let descriptionTurnRan = false;
@@ -42570,6 +42865,28 @@ async function runLoop(deps, ctx) {
     }
     await endHarness();
     const leftBehind = isCodingPrRun && !tailSkipped() ? workLeftBehindOf({ uncommittedChanges: observedUncommitted, unpushedCommits: observedUnpushed }) : void 0;
+    const endingFacts = () => {
+      if (profile.machine === "none") return { workspace: { kind: "none" } };
+      if (!isCodingPrRun || tailSkipped()) return { workspace: { kind: "unread" } };
+      const branch2 = observedBranch ?? observedCheckedOut;
+      let workspace;
+      if (salvagedTo !== void 0) workspace = { kind: "salvaged", ...salvagedTo };
+      else if (observedUncommitted === void 0 || observedUnpushed === void 0) workspace = { kind: "unmeasured" };
+      else if (observedUncommitted === 0 && observedUnpushed === 0)
+        workspace = {
+          kind: "clean",
+          ...branch2 !== void 0 ? { branch: branch2 } : {},
+          ...observedHead !== void 0 ? { head: observedHead } : {}
+        };
+      else
+        workspace = {
+          kind: "left",
+          uncommitted: observedUncommitted,
+          unpushed: observedUnpushed,
+          fate: commandInFlight ? "torn_down" : profile.machine === "repo-resident" ? "discarded" : "kept"
+        };
+      return { workspace, description: prDescription !== void 0 ? "submitted" : "not_submitted" };
+    };
     if (leftBehind) {
       registry.publish(run2.id, {
         type: "run_note",
@@ -42613,6 +42930,8 @@ async function runLoop(deps, ctx) {
     if (baseline) await root.span("run.reading_diff_join", () => baseline);
     const description = descriptionArtifact;
     if (description) await root.span("run.pr_description_join", () => description);
+    if (windDownEnding !== void 0 && answer === windDownAnswer(windDownEnding, agent.maxMinutes))
+      answer = windDownAnswer(windDownEnding, agent.maxMinutes, endingFacts());
     const acceptedAnswer = markdownOutput.parse(answer);
     const rawAnswer = acceptedAnswer.ok && acceptedAnswer.changed ? answer : void 0;
     if (acceptedAnswer.ok) answer = acceptedAnswer.value;
@@ -42750,17 +43069,18 @@ function describeEnding(ending) {
       return `a write-up: ${ending.summary}`;
   }
 }
+function windDownEndingUnder(text, ending) {
+  if (ending.kind === "soft_stop") return { kind: "soft", text };
+  if (ending.kind === "written_up" && ending.note === "time_budget_exhausted") return { kind: "time", text };
+  return void 0;
+}
 function answerUnderEnding(text, ending, maxMinutes) {
-  if (ending.kind === "answered") return text || "_(no response)_";
-  if (ending.kind === "soft_stop") return softStopAnswer(text);
-  switch (ending.note) {
-    case "time_budget_exhausted":
-      return timeBudgetAnswer(text, maxMinutes);
-    default:
-      return text ? `\u26A0\uFE0F _${ending.summary}_
+  const windDown = windDownEndingUnder(text, ending);
+  if (windDown !== void 0) return windDownAnswer(windDown, maxMinutes);
+  if (ending.kind !== "written_up") return text || "_(no response)_";
+  return text ? `\u26A0\uFE0F _${ending.summary}_
 
 ${text}` : `\u26A0\uFE0F ${ending.summary}`;
-  }
 }
 function unknownHarnessWordOf(state) {
   if (typeof state !== "object" || state === null) return void 0;
@@ -43034,7 +43354,13 @@ async function plan(deps, input) {
   }
   let text;
   try {
-    text = (await deps.readFile(entry.repo, request2.planPath, base)).content;
+    const file = await deps.readFile(entry.repo, request2.planPath, base, { maxChars: PLAN_MAX_CHARS });
+    if (file.truncated === true)
+      return {
+        ok: false,
+        reply: `\u{1F6AB} The plan \`${request2.planPath}\` is longer than ${PLAN_MAX_CHARS.toLocaleString("en-US")} characters at \`${base}\` in ${entry.repo}; its later units would be lost, so nothing was run \u2014 split the plan.`
+      };
+    text = file.content;
   } catch (err2) {
     return {
       ok: false,
@@ -43384,10 +43710,10 @@ async function runShipBranch(deps, msg, io, ctx) {
   );
   if (!pre.ok) {
     console.log(`[ship] ${msg.threadKey} not started: ${pre.where}`);
-    await refuse3("ship_preflight", async () => {
-      await card.done(shell.close({ kind: "refused", icon: "\u{1F6AB}", reason: pre.card, ...closeLines(clock4(), false) }));
-      await io.reply(pre.reply);
-    });
+    await refuse3(
+      refusalOf("ship_preflight", pre.reply),
+      () => card.done(shell.close({ kind: "refused", icon: "\u{1F6AB}", reason: pre.card, ...closeLines(clock4(), false) }))
+    );
     return;
   }
   const entry = pre.entry;
@@ -43530,12 +43856,19 @@ async function runShipBranch(deps, msg, io, ctx) {
   if (!held2.ok) {
     const reason2 = `budget ${caps.maxMinutes} min cannot hold the ship loop (${caps.maxRounds} review rounds need ${held2.need} min)`;
     console.log(`[ship] ${msg.threadKey} not started: ${reason2}`);
-    await refuse3("ship_budget", async () => {
-      await card.done(shell.close({ kind: "refused", icon: "\u{1F6AB}", reason: reason2, ...closeLines(clock4(), false) }));
-      await io.reply(
-        `\u{1F6AB} Ship cannot start under a ${caps.maxMinutes}-minute budget: the loop it allows (${caps.maxRounds} review rounds) needs ${held2.need} minutes \u2014 ${ALLOWANCES.provision} to provision, the coding child's ${ASKS.coding}, and the reserve for the rounds after it at their floors. Widen the budget or the boundary that clipped it, or run \`agent:coding\` for a single pass without the review loop.`
-      );
-    });
+    await refuse3(
+      refusalOf(
+        "ship_budget",
+        REFUSAL_SENTENCES.ship_budget({
+          maxMinutes: caps.maxMinutes,
+          maxRounds: caps.maxRounds,
+          need: held2.need,
+          provision: ALLOWANCES.provision,
+          coding: ASKS.coding
+        })
+      ),
+      () => card.done(shell.close({ kind: "refused", icon: "\u{1F6AB}", reason: reason2, ...closeLines(clock4(), false) }))
+    );
     return;
   }
   const scopes = deps.config.scopes(msg.channelId, msg.userId);
@@ -43560,7 +43893,7 @@ async function runShipBranch(deps, msg, io, ctx) {
       "dispatch.ship_hand_off",
       () => handOffToCoordinator(
         {
-          readFile: (repo, path, ref) => githubCapabilityFor(deps, chatActorOf(deps.config, msg)).api.readFile(repo, path, ref),
+          readFile: (repo, path, ref, opts) => githubCapabilityFor(deps, chatActorOf(deps.config, msg)).api.readFile(repo, path, ref, opts),
           instances: deps.coordinatorInstances ?? new NullCoordinatorInstanceStore(),
           create: deps.createCoordinatorInstance ?? ((id) => createInstanceViaShim(shim(), id)),
           status: deps.fetchCoordinatorInstanceStatus ?? ((id) => fetchInstanceStatusViaShim(shim(), id))
@@ -43657,6 +43990,8 @@ var init_ship = __esm({
     init_runRegistry();
     init_statusCardFrame();
     init_types5();
+    init_refusal();
+    init_reply();
   }
 });
 
@@ -44312,10 +44647,28 @@ async function dispatch(deps, msg, io, opts = {}) {
   const queuedBeforeMs = msg.originAt !== void 0 ? Math.max(0, receivedAt - msg.originAt) : void 0;
   const queued = queuedCaption("behind", opts.queuedBehindMs) ?? queuedCaption("before", queuedBeforeMs);
   let refused7 = false;
-  const refuse3 = (outcome, fn) => {
+  const stampRefusal = (outcome) => {
     refused7 = true;
+    const cause = causeOf(outcome);
     ended.refusal ??= outcome;
-    return root.span("dispatch.refuse", fn, { attrs: { outcome } });
+    ended.cause ??= cause;
+    root.setAttrs({ refusal: outcome, cause });
+    return cause;
+  };
+  const refuse3 = async (refusal, side) => {
+    const cause = stampRefusal(refusal.code);
+    await root.span(
+      "dispatch.refuse",
+      async () => {
+        await side?.();
+        await renderRefusal(refusal, io);
+      },
+      { attrs: { outcome: refusal.code, refusal: refusal.code, cause } }
+    );
+  };
+  const refuseSilently = (outcome, side) => {
+    const cause = stampRefusal(outcome);
+    return root.span("dispatch.refuse", side, { attrs: { outcome, refusal: outcome, cause } });
   };
   const closeLines = (end, finished, owner = "agent") => cardLines(trace, { end, finished, owner, queued });
   const doneLines = (diagnosis) => {
@@ -44436,6 +44789,7 @@ async function dispatch(deps, msg, io, opts = {}) {
       clock: clock4,
       root,
       refuse: refuse3,
+      refuseSilently,
       admission,
       hooks: {
         reservation: reservationHooks,
@@ -44701,7 +45055,7 @@ async function dispatch(deps, msg, io, opts = {}) {
         const request2 = await abandonLostWorkspace({
           msg,
           io,
-          refuse: refuse3,
+          refuse: refuseSilently,
           card,
           shell,
           closeLines,
@@ -44992,10 +45346,13 @@ async function dispatch(deps, msg, io, opts = {}) {
     return ended;
   } catch (err2) {
     caught = true;
+    ended.refusal ??= "uncaught";
+    ended.cause ??= "system";
+    if (!refused7) root.setAttrs({ refusal: "uncaught", cause: "system" });
     const errMsg2 = err2 instanceof Error ? err2.message : String(err2);
     if (setupCard && setupShell) {
       const [failedCard, failedShell] = [setupCard, setupShell];
-      await refuse3(
+      await refuseSilently(
         "setup_failed",
         () => failedCard.done(
           failedShell.close({
@@ -45008,16 +45365,21 @@ async function dispatch(deps, msg, io, opts = {}) {
       });
     }
     const replyName = root.record().attrs.runId !== void 0 ? "post.reply" : "dispatch.refuse";
+    const replyAttrs = replyName === "dispatch.refuse" ? { attrs: { outcome: "uncaught", refusal: "uncaught", cause: "system" } } : void 0;
     await ending.sealAfterReply(
       async () => {
       },
-      () => root.span(replyName, () => {
-        const line3 = redactSecrets(stripAnsi(errorReply(err2)));
-        const link = admitted?.runLink;
-        return io.reply(link ? `${line3}
+      () => root.span(
+        replyName,
+        () => {
+          const line3 = redactSecrets(stripAnsi(errorReply(err2)));
+          const link = admitted?.runLink;
+          return io.reply(link ? `${line3}
 
 [Live run](${link})` : line3);
-      })
+        },
+        replyAttrs
+      )
     ).catch(() => {
     });
   } finally {
@@ -45089,10 +45451,14 @@ async function dispatchClick(deps, click) {
     registry: deps.runRegistry ?? defaultRunRegistry,
     onFinished: (id) => void deps.runBearers?.revoke(id)
   });
-  const refuse3 = (outcome, text) => {
+  const refuse3 = (refusal) => {
     refused7 = true;
-    ended.refusal = outcome;
-    return root.span("dispatch.refuse", () => io.reply(text), { attrs: { outcome } });
+    ended.refusal = refusal.code;
+    ended.cause = refusal.cause;
+    root.setAttrs({ refusal: refusal.code, cause: refusal.cause });
+    return root.span("dispatch.refuse", () => renderRefusal(refusal, io), {
+      attrs: { outcome: refusal.code, refusal: refusal.code, cause: refusal.cause }
+    });
   };
   try {
     if (click.kind === "cancel") {
@@ -45101,7 +45467,7 @@ async function dispatchClick(deps, click) {
         await ending.sealAfterReply(
           async () => {
           },
-          () => refuse3(res2.refusal, res2.text)
+          () => refuse3(refusalOf(res2.refusal, res2.text))
         );
       else
         await ending.sealAfterReply(
@@ -45113,10 +45479,33 @@ async function dispatchClick(deps, click) {
     }
     const res = await consumeAndRun(deps, { id: click.id, actorIds }, io, ending, trace);
     if (res.kind === "refused") {
+      const refusal = refusalOf(res.refusal, res.text);
+      if (res.row) {
+        const row2 = res.row;
+        await recordRoutedDecision(
+          deps,
+          row2.message,
+          io,
+          { id: row2.command },
+          {
+            preset: COMMAND_RUN_AGENT,
+            reason: REFUSED_REASON,
+            model: row2.model,
+            command: row2.command,
+            input: redactedInput(row2.input),
+            receipt: row2.receipt,
+            outcome: "refused",
+            refusalCode: refusal.code
+          },
+          res.text,
+          ending,
+          trace
+        );
+      }
       await ending.sealAfterReply(
         async () => {
         },
-        () => refuse3(res.refusal, res.text)
+        () => refuse3(refusal)
       );
       return ended;
     }
@@ -45154,10 +45543,13 @@ var init_dispatcher = __esm({
     init_runEvents();
     init_redact();
     init_reply();
+    init_refusal();
     init_admission();
     init_fastPath();
     init_confirm();
     init_commandRun();
+    init_runOwner();
+    init_route();
     init_references();
     init_actor();
     init_config2();
@@ -47929,7 +48321,12 @@ async function driveOpenCode(deps, run2, conn, kind = "loop") {
         const reason2 = finaleAbortReason(lease.finaleMs);
         writeUpFailed ??= reason2;
         run2.onProgress?.(finaleTimedOutNote());
-        note("harness_error", windDownFailureNote(reason2));
+        const doing = bridge.doingNow();
+        const onTool = doing !== void 0 && doing !== "model";
+        note(
+          "harness_error",
+          cutInFlight || onTool ? finaleWaitNote(reason2, doingWords(doing), cutInFlight) : windDownFailureNote(reason2)
+        );
         void interrupt({ ending: "the write-up's finale" });
       }
       return;
@@ -48212,9 +48609,9 @@ async function driveOpenCode(deps, run2, conn, kind = "loop") {
     throw replaced;
   }
   if (interrupts.cut || interrupts.ending !== void 0) {
-    const { cut, ending } = interrupts;
+    const { cut, ending: ending2 } = interrupts;
     bridge.closeOpenSpans(
-      (open2) => cut && ending !== void 0 ? `${open2.tool} was cut at the loop's end; the loop then left on its interrupt (${ending}) before the call's outcome reached the record` : ending !== void 0 ? `${open2.tool} was still running when the loop left on its interrupt (${ending}); its outcome never reached the record` : `${open2.tool} was cut at the loop's end and its outcome never reached the record before the write-up settled`,
+      (open2) => cut && ending2 !== void 0 ? `${open2.tool} was cut at the loop's end; the loop then left on its interrupt (${ending2}) before the call's outcome reached the record` : ending2 !== void 0 ? `${open2.tool} was still running when the loop left on its interrupt (${ending2}); its outcome never reached the record` : `${open2.tool} was cut at the loop's end and its outcome never reached the record before the write-up settled`,
       { cut: true }
     );
   }
@@ -48258,14 +48655,9 @@ async function driveOpenCode(deps, run2, conn, kind = "loop") {
     note("wrap_up", wrapUpNeverPostedNote(writeUp.kind, "run", neverPostedEnd));
     writeUp = void 0;
   }
-  const answer = writeUpAnswer(writeUp, text, run2.agent.maxMinutes, writeUpFailed, neverPostedEnd);
-  return { answer, remainingMs: remaining, hardStopped: false, ...handOver() };
-}
-function writeUpAnswer(writeUp, text, maxMinutes, writeUpFailed, neverPostedEnd) {
-  if (writeUp?.kind === "time") return timeBudgetAnswer(text, maxMinutes, writeUpFailed);
-  if (writeUp?.kind === "turns") return turnGuardAnswer(text, writeUp.pace, writeUpFailed);
-  if (writeUp?.kind === "soft") return softStopAnswer(text, writeUpFailed);
-  return unlabelledAnswer(text, writeUpFailed, neverPostedEnd === "finale" ? "finale" : "failed");
+  const ending = windDownEndingOf(writeUp, text, writeUpFailed, neverPostedEnd === "finale" ? "finale" : "failed");
+  const answer = ending ? windDownAnswer(ending, run2.agent.maxMinutes) : unlabelledAnswer(text, void 0);
+  return { answer, ...ending ? { ending } : {}, remainingMs: remaining, hardStopped: false, ...handOver() };
 }
 var OpenCodeGateBypassedError, OpenCodeReplyFailedError, OpenCodeRequestRefusedError, OpenCodeWriteUnresolvedError, FIRST_EVENT_BOUND_MS, SILENCE_TAIL_BYTES, OpenCodeSilentError, OpenCodeContainerReplacedError, TOOL_NAME_WORD, RESOURCE_PERMISSIONS, isRecord9, str7, TURN_BUDGET_CODE, TURN_BUDGET_REFUSAL, OpenCodeBridge, StepBoundaries;
 var init_bridge3 = __esm({
@@ -49395,12 +49787,13 @@ async function openOpenCodeRun(deps, run2, settings) {
       (err2) => err2
     );
     let answer;
+    let ending;
     let remainingMs;
     let hardStopped;
     let drained;
     try {
       let storeIds;
-      ({ answer, remainingMs, storeIds, hardStopped } = await driveOpenCode(deps, run2, conn));
+      ({ answer, ending, remainingMs, storeIds, hardStopped } = await driveOpenCode(deps, run2, conn));
       for (const id of storeIds) known.add(id);
     } finally {
       draining = false;
@@ -49409,6 +49802,7 @@ async function openOpenCodeRun(deps, run2, settings) {
     if (drained instanceof OpenCodeWriteUnresolvedError && !hardStopped) throw drained;
     return {
       answer,
+      ...ending ? { ending } : {},
       followUp: async (input) => {
         const turnEnd = await feedEndFrom(deps.container, conn.paths.feed, conn.feedOffset);
         const previous = live.toolContext;
@@ -53884,14 +54278,54 @@ function viewAsFromCookie(header4) {
 function isViewAsPath(pathname) {
   return pathname === VIEW_AS_PATH || pathname === VIEW_AS_EXIT_PATH;
 }
-function requestersOf(rows) {
+function peopleOf(rows, known) {
   const seen = /* @__PURE__ */ new Map();
-  for (const r of rows) {
-    if (!r.userId || !isViewablePerson(r.userId) || seen.has(r.userId)) continue;
-    seen.set(r.userId, { id: r.userId, ...r.userName ? { name: r.userName } : {} });
-  }
+  const add = (id, name) => {
+    if (!isViewablePerson(id)) return;
+    const had = seen.get(id);
+    if (!had) seen.set(id, { id, ...name ? { name } : {} });
+    else if (!had.name && name) seen.set(id, { id, name });
+  };
+  for (const r of rows) if (r.userId) add(r.userId, r.userName);
+  for (const p of known) add(p.id, p.name);
   return [...seen.values()].sort((a, b) => (a.name ?? a.id).localeCompare(b.name ?? b.id));
 }
+async function knownPeople(deps) {
+  const rows = await deps.requesters().catch(() => []);
+  const fromRuns = peopleOf(rows, []);
+  const namedIds = new Set(fromRuns.filter((p) => p.name).map((p) => p.id));
+  const granted = await Promise.all(
+    deps.granted().map(async (id) => {
+      if (namedIds.has(id)) return { id };
+      const name = await deps.name(id).catch(() => void 0);
+      return { id, ...name ? { name } : {} };
+    })
+  );
+  return peopleOf(rows, granted);
+}
+function peopleSource(deps, opts = {}) {
+  const ttlMs = opts.ttlMs ?? KNOWN_PEOPLE_TTL_MS;
+  const now = opts.now ?? Date.now;
+  let people = [];
+  let refreshedAt = Number.NEGATIVE_INFINITY;
+  let inFlight;
+  const refresh = () => {
+    inFlight ??= knownPeople(deps).then((next) => {
+      people = next;
+      refreshedAt = now();
+    }).catch(() => void 0).finally(() => {
+      inFlight = void 0;
+    });
+    return inFlight;
+  };
+  return {
+    current() {
+      if (now() - refreshedAt >= ttlMs) void refresh();
+      return people;
+    },
+    refresh
+  };
+}
 function refuseWhileViewing(res, person) {
   res.writeHead(403, JSON_NO_STORE);
   res.end(JSON.stringify({ error: "unauthorized", message: viewingRefusal(person) }));
@@ -53955,10 +54389,11 @@ function createViewAsHandler(deps) {
     return true;
   };
 }
-var VIEW_AS_COOKIE, VIEW_AS_PATH, VIEW_AS_EXIT_PATH, MAX_BODY_BYTES3, JSON_NO_STORE;
+var VIEW_AS_COOKIE, VIEW_AS_PATH, VIEW_AS_EXIT_PATH, MAX_BODY_BYTES3, KNOWN_PEOPLE_TTL_MS, JSON_NO_STORE;
 var init_viewAs2 = __esm({
   "../../src/channels/viewAs.ts"() {
     "use strict";
+    init_budgets();
     init_viewAs();
     init_commandHttp();
     init_http();
@@ -53966,20 +54401,11 @@ var init_viewAs2 = __esm({
     VIEW_AS_PATH = "/runs/view-as";
     VIEW_AS_EXIT_PATH = "/runs/view-as/exit";
     MAX_BODY_BYTES3 = 1024;
+    KNOWN_PEOPLE_TTL_MS = MINUTE_MS;
     JSON_NO_STORE = { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" };
   }
 });
 
-// ../../src/channels/liveView/html.ts
-function escapeHtml(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-var init_html = __esm({
-  "../../src/channels/liveView/html.ts"() {
-    "use strict";
-  }
-});
-
 // ../../src/channels/favicon.ts
 function faviconSvg(fill) {
   return `<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16'><circle cx='8' cy='8' r='6' fill='${fill}'/></svg>`;
@@ -54005,121 +54431,6 @@ var init_favicon = __esm({
   }
 });
 
-// ../../src/channels/residentsModel.ts
-function residentStateTone(state) {
-  switch (state) {
-    case "warm":
-      return "green";
-    case "onboarding":
-    case "refreshing":
-    case "restoring":
-      return "amber";
-    case "degraded":
-    case "down":
-      return "red";
-    default:
-      return "grey";
-  }
-}
-function residentsFleetTone(records) {
-  if (records.length === 0) return "grey";
-  const tones = new Set(records.map((record2) => residentStateTone(residentLive(rec(record2)).state)));
-  if (tones.has("red")) return "red";
-  if (tones.has("amber")) return "amber";
-  return tones.size === 1 && tones.has("green") ? "green" : "grey";
-}
-function residentSlug(record2) {
-  return str8(record2.resource).replace(/^repo:/, "");
-}
-function residentLive(record2) {
-  const live = rec(record2.live);
-  if (typeof live.error === "string") return { ...live, state: "unreachable", reason: live.error };
-  return { ...live, state: str8(live.state) || "unknown", reason: str8(live.reason) };
-}
-var RESIDENT_SLUG_RE, str8, rec;
-var init_residentsModel = __esm({
-  "../../src/channels/residentsModel.ts"() {
-    "use strict";
-    init_residentDiskBudget();
-    RESIDENT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,37}[a-z0-9])?\/[a-z0-9](?:[a-z0-9._-]{0,98}[a-z0-9])?$/;
-    str8 = (v) => typeof v === "string" ? v : typeof v === "number" ? String(v) : "";
-    rec = (v) => v && typeof v === "object" ? v : {};
-  }
-});
-
-// ../../src/channels/webSeed.ts
-function serializeSeed(seed) {
-  return JSON.stringify(seed).replace(
-    /[<>&\u2028\u2029]/g,
-    (ch) => `\\u${ch.charCodeAt(0).toString(16).padStart(4, "0")}`
-  );
-}
-var SEED_ELEMENT_ID;
-var init_webSeed = __esm({
-  "../../src/channels/webSeed.ts"() {
-    "use strict";
-    SEED_ELEMENT_ID = "sb-seed";
-  }
-});
-
-// ../../src/channels/webShell.ts
-function renderShell(title, seed, assets) {
-  const css = assets.css.map((href) => `<link rel="stylesheet" href="${escapeHtml(href)}">`).join("\n");
-  const favicon = pageFavicon(seed);
-  return `<!doctype html>
-<html lang="en" class="dark">
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<meta name="robots" content="noindex" />
-<title>${escapeHtml(title)}</title>
-<link rel="icon" id="favicon" href="${favicon}" />
-${css}
-</head>
-<body>
-<div id="app"></div>
-<script type="application/json" id="${SEED_ELEMENT_ID}">${serializeSeed(seed)}</script>
-<script type="module" src="${escapeHtml(assets.js)}"></script>
-</body>
-</html>`;
-}
-function pageFavicon(seed) {
-  switch (seed.page) {
-    case "runs":
-    case "run":
-      return FAVICON_IDLE;
-    case "residents":
-      return FAVICON_BY_TONE[residentsFleetTone(seed.residents)];
-    default:
-      return FAVICON_DEFAULT;
-  }
-}
-function makeShellRenderer(assets, capabilities) {
-  return (viewer, title, seed) => renderShell(
-    title,
-    { ...seed, capabilities, ...viewer?.viewingAs ? { viewingAs: viewer.viewingAs } : {} },
-    assets
-  );
-}
-var PAGE_CSP, FORM_PAGE_CSP, WEB_HTML_HEADERS;
-var init_webShell = __esm({
-  "../../src/channels/webShell.ts"() {
-    "use strict";
-    init_html();
-    init_favicon();
-    init_residentsModel();
-    init_webSeed();
-    PAGE_CSP = "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; media-src 'self'; font-src 'self'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";
-    FORM_PAGE_CSP = PAGE_CSP.replace("form-action 'none'", "form-action 'self'");
-    WEB_HTML_HEADERS = {
-      "content-type": "text/html; charset=utf-8",
-      "content-security-policy": PAGE_CSP,
-      "x-frame-options": "DENY",
-      "cache-control": "no-store"
-    };
-  }
-});
-
 // ../../src/channels/liveView/sse.ts
 function sseData(event, seq) {
   return `id: ${seq}
@@ -54233,8 +54544,8 @@ function serveIndexEvents(subscribeIndex, sink, onLive) {
   onLive?.();
 }
 function withOmittedMarkers(events, eventCount) {
-  const counted = events.filter((e) => !(isSpanRecord(e) && e.seq === void 0)).length;
-  const omitted = eventCount - counted;
+  const counted2 = events.filter((e) => !(isSpanRecord(e) && e.seq === void 0)).length;
+  const omitted = eventCount - counted2;
   if (omitted <= 0) return [...events];
   const marker = (n2) => ({
     type: "replay_note",
@@ -54290,6 +54601,31 @@ var init_sse = __esm({
   }
 });
 
+// ../../src/channels/liveView/html.ts
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+var init_html = __esm({
+  "../../src/channels/liveView/html.ts"() {
+    "use strict";
+  }
+});
+
+// ../../src/channels/webSeed.ts
+function serializeSeed(seed) {
+  return JSON.stringify(seed).replace(
+    /[<>&\u2028\u2029]/g,
+    (ch) => `\\u${ch.charCodeAt(0).toString(16).padStart(4, "0")}`
+  );
+}
+var SEED_ELEMENT_ID;
+var init_webSeed = __esm({
+  "../../src/channels/webSeed.ts"() {
+    "use strict";
+    SEED_ELEMENT_ID = "sb-seed";
+  }
+});
+
 // ../../src/channels/liveView.ts
 function parseRunRoute(pathname) {
   if (pathname === "/runs" || pathname === "/runs/") return { kind: "index" };
@@ -54457,14 +54793,11 @@ function createLiveViewHandler(deps) {
     return token2 === void 0 ? v : { ...v, token: token2 };
   };
   const liveTokens = () => new Map(index.listActive().map((s) => [s.id, s.token]));
-  const notFoundPage = (res, viewer) => {
-    res.writeHead(404, WEB_HTML_HEADERS);
-    res.end(
-      deps.shell(viewer, "Run not found", {
-        page: "runNotFound",
-        retentionDays: deps.retention ? deps.retention.retentionDays : null
-      })
-    );
+  const notFoundPage = (req, res, viewer) => {
+    deps.page(req, res, 404, viewer, "Run not found", {
+      page: "runNotFound",
+      retentionDays: deps.retention ? deps.retention.retentionDays : null
+    });
   };
   const mergedRows = async (live, visibleTo, cursor, view = {}) => {
     const tokens = new Map(live.map((s) => [s.id, s.token]));
@@ -54508,6 +54841,7 @@ function createLiveViewHandler(deps) {
       }
       const live = index.listActive().filter((s) => matchesPredicate(visibleTo, s));
       const render3 = (page2) => {
+        const people = holdsAll(ctx.actor) ? peopleOf(page2.rows, deps.people?.() ?? []) : void 0;
         const liveCount = page2.rows.filter((r) => !r.finished).length;
         const title = `${liveCount > 0 ? `(${liveCount}) ` : ""}${all ? "All runs" : "Live runs"}`;
         const seed = {
@@ -54515,9 +54849,7 @@ function createLiveViewHandler(deps) {
           all,
           mine,
           ...ctx.actor.asUser ? { asUser: ctx.actor.asUser } : {},
-          // A session holding `all` may view the dashboard as a person (record 0053): the
-          // picker offers the requesters this page names; the seed says nothing to anyone else.
-          ...holdsAll(ctx.actor) ? { viewAs: { people: requestersOf(page2.rows) } } : {},
+          ...people ? { viewAs: { people } } : {},
           retentionDays: deps.retention ? deps.retention.retentionDays : null,
           now: now(),
           rows: [...page2.rows],
@@ -54525,8 +54857,7 @@ function createLiveViewHandler(deps) {
           ...page2.olderHref ? { olderHref: page2.olderHref } : {},
           ...page2.olderThan !== void 0 ? { olderThan: page2.olderThan } : {}
         };
-        res.writeHead(200, WEB_HTML_HEADERS);
-        res.end(deps.shell(ctx.actor, title, seed));
+        deps.page(req, res, 200, ctx.actor, title, seed);
       };
       if (!all) {
         run2(
@@ -54541,8 +54872,7 @@ function createLiveViewHandler(deps) {
     if (route3.kind === "scheduled") {
       const scheduled = deps.scheduled;
       if (!scheduled) {
-        res.writeHead(200, WEB_HTML_HEADERS);
-        res.end(deps.shell(ctx.actor, "Scheduled runs", { page: "scheduled", now: now(), rows: null }));
+        deps.page(req, res, 200, ctx.actor, "Scheduled runs", { page: "scheduled", now: now(), rows: null });
         return true;
       }
       const visibleTo = readableRuns(ctx.actor);
@@ -54555,8 +54885,7 @@ function createLiveViewHandler(deps) {
           rows: buildScheduledRows(scheduled.schedules, firings, live, t),
           ...firings.ok ? {} : { firingsUnavailable: firings.reason }
         };
-        res.writeHead(200, WEB_HTML_HEADERS);
-        res.end(deps.shell(ctx.actor, "Scheduled runs", seed));
+        deps.page(req, res, 200, ctx.actor, "Scheduled runs", seed);
       };
       if (!scheduled.store) {
         render3({ ok: false, reason: NO_STORE_REASON });
@@ -54570,7 +54899,7 @@ function createLiveViewHandler(deps) {
       run2(res, async () => {
         const found = await service.listUnitRuns(route3.key, visibleTo);
         if (!found.ok) {
-          notFoundPage(res, ctx.actor);
+          notFoundPage(req, res, ctx.actor);
           return;
         }
         const findings = found.value.pr ? await service.listFindings({ repo: found.value.instance.repo, number: found.value.pr.number }, visibleTo) : void 0;
@@ -54585,8 +54914,7 @@ function createLiveViewHandler(deps) {
           now: now(),
           retentionDays: deps.retention ? deps.retention.retentionDays : null
         };
-        res.writeHead(200, WEB_HTML_HEADERS);
-        res.end(deps.shell(ctx.actor, `Unit ${found.value.id}`, seed));
+        deps.page(req, res, 200, ctx.actor, `Unit ${found.value.id}`, seed);
       });
       return true;
     }
@@ -54599,29 +54927,26 @@ function createLiveViewHandler(deps) {
           const { token: own, ...row2 } = s;
           return s.finished ? row2 : { ...row2, token: own };
         });
-        res.writeHead(200, WEB_HTML_HEADERS);
-        res.end(
-          deps.shell(ctx.actor, "Live run", {
-            page: "run",
-            mode: "live",
-            id: route3.id,
-            ...(() => {
-              const key = index.listActive().find((s) => s.id === route3.id)?.threadKey;
-              return key !== void 0 ? { threadKey: key } : {};
-            })(),
-            ...children.length > 0 ? { children } : {},
-            // Stop control: same token, POST-only; `&mode=` is appended client-side.
-            eventsUrl: `/runs/${encodeURIComponent(route3.id)}/events?t=${encodeURIComponent(token2)}`,
-            stopUrl: `/runs/${encodeURIComponent(route3.id)}/stop?t=${encodeURIComponent(token2)}`,
-            // The files' URL base with the same token (item 26): the page appends each key.
-            ...artifactsSeed(route3.id, token2),
-            // The stamps the header's one duration reads (docs/reference/specs/tracing.md).
-            serverNow: now(),
-            startedAt: snap?.startedAt ?? now(),
-            ...snap?.receivedAt !== void 0 ? { receivedAt: snap.receivedAt } : {},
-            ...snap?.finishedAt !== void 0 ? { finishedAt: snap.finishedAt } : {}
-          })
-        );
+        deps.page(req, res, 200, ctx.actor, "Live run", {
+          page: "run",
+          mode: "live",
+          id: route3.id,
+          ...(() => {
+            const key = index.listActive().find((s) => s.id === route3.id)?.threadKey;
+            return key !== void 0 ? { threadKey: key } : {};
+          })(),
+          ...children.length > 0 ? { children } : {},
+          // Stop control: same token, POST-only; `&mode=` is appended client-side.
+          eventsUrl: `/runs/${encodeURIComponent(route3.id)}/events?t=${encodeURIComponent(token2)}`,
+          stopUrl: `/runs/${encodeURIComponent(route3.id)}/stop?t=${encodeURIComponent(token2)}`,
+          // The files' URL base with the same token (item 26): the page appends each key.
+          ...artifactsSeed(route3.id, token2),
+          // The stamps the header's one duration reads (docs/reference/specs/tracing.md).
+          serverNow: now(),
+          startedAt: snap?.startedAt ?? now(),
+          ...snap?.receivedAt !== void 0 ? { receivedAt: snap.receivedAt } : {},
+          ...snap?.finishedAt !== void 0 ? { finishedAt: snap.finishedAt } : {}
+        });
         return true;
       }
       if (route3.kind === "artifact") {
@@ -54724,7 +55049,7 @@ function createLiveViewHandler(deps) {
           sink.write(NOT_FOUND2);
           sink.end();
         } else if (route3.kind === "page") {
-          notFoundPage(res, ctx.actor);
+          notFoundPage(req, res, ctx.actor);
         } else text(res, 404, NOT_FOUND2);
         return;
       }
@@ -54750,37 +55075,34 @@ function createLiveViewHandler(deps) {
         ]);
         const findingsLedger = ledger?.ok && ledger.value.unit !== void 0 ? { unit: ledger.value.unit, rows: ledger.value.findings.length } : void 0;
         const tokens = liveTokens();
-        res.writeHead(200, WEB_HTML_HEADERS);
-        res.end(
-          deps.shell(ctx.actor, "Run", {
-            page: "run",
-            mode: "history",
-            id: route3.id,
-            ...view.threadKey !== void 0 ? { threadKey: view.threadKey } : {},
-            ...children.length > 0 ? { children: children.map((c) => withLiveToken(c, tokens)) } : {},
-            ...units.length > 0 ? { units } : {},
-            ...findingsLedger !== void 0 ? { findingsLedger } : {},
-            // The stored stream with the truncation made visible (AE11): the
-            // seed IS the stream on a history page — normalized first on a
-            // span-schema record, so a pair whose twin the budget dropped gets
-            // it back.
-            events: withOmittedMarkers(timed ? normalizeSpans(events) : events, view.eventCount),
-            ...timed ? {} : { untimed: true },
-            ...view.status ? { status: view.status } : {},
-            eventCount: view.eventCount,
-            startedAt: view.startedAt,
-            ...view.receivedAt !== void 0 ? { receivedAt: view.receivedAt } : {},
-            ...view.finishedAt !== void 0 ? { finishedAt: view.finishedAt } : {},
-            ...view.sealedAt !== void 0 ? { sealedAt: view.sealedAt } : {},
-            ...view.replyOk !== void 0 ? { replyOk: view.replyOk } : {},
-            ...runDurationMs(view) !== void 0 ? { durationMs: runDurationMs(view) } : {},
-            // The run's dollars beside its duration (costs.md item 4c); a record without usage has none.
-            ...view.cost !== void 0 ? { cost: view.cost } : {},
-            ...view.truncated !== void 0 ? { truncated: view.truncated } : {},
-            // Tokenless: the files are read under the same decision as this page (item 26).
-            ...artifactsSeed(route3.id)
-          })
-        );
+        deps.page(req, res, 200, ctx.actor, "Run", {
+          page: "run",
+          mode: "history",
+          id: route3.id,
+          ...view.threadKey !== void 0 ? { threadKey: view.threadKey } : {},
+          ...children.length > 0 ? { children: children.map((c) => withLiveToken(c, tokens)) } : {},
+          ...units.length > 0 ? { units } : {},
+          ...findingsLedger !== void 0 ? { findingsLedger } : {},
+          // The stored stream with the truncation made visible (AE11): the
+          // seed IS the stream on a history page — normalized first on a
+          // span-schema record, so a pair whose twin the budget dropped gets
+          // it back.
+          events: withOmittedMarkers(timed ? normalizeSpans(events) : events, view.eventCount),
+          ...timed ? {} : { untimed: true },
+          ...view.status ? { status: view.status } : {},
+          eventCount: view.eventCount,
+          startedAt: view.startedAt,
+          ...view.receivedAt !== void 0 ? { receivedAt: view.receivedAt } : {},
+          ...view.finishedAt !== void 0 ? { finishedAt: view.finishedAt } : {},
+          ...view.sealedAt !== void 0 ? { sealedAt: view.sealedAt } : {},
+          ...view.replyOk !== void 0 ? { replyOk: view.replyOk } : {},
+          ...runDurationMs(view) !== void 0 ? { durationMs: runDurationMs(view) } : {},
+          // The run's dollars beside its duration (costs.md item 4c); a record without usage has none.
+          ...view.cost !== void 0 ? { cost: view.cost } : {},
+          ...view.truncated !== void 0 ? { truncated: view.truncated } : {},
+          // Tokenless: the files are read under the same decision as this page (item 26).
+          ...artifactsSeed(route3.id)
+        });
         return;
       }
       serveHistoryEvents(view.events ?? [], view.eventCount, nodeSseSink(req, res));
@@ -54806,7 +55128,6 @@ var init_liveView = __esm({
     init_scheduledPanel();
     init_viewAs();
     init_viewAs2();
-    init_webShell();
     init_favicon();
     init_sse();
     init_html();
@@ -54898,6 +55219,138 @@ var init_webAssets = __esm({
   }
 });
 
+// ../../src/channels/residentsModel.ts
+function residentStateTone(state) {
+  switch (state) {
+    case "warm":
+      return "green";
+    case "onboarding":
+    case "refreshing":
+    case "restoring":
+      return "amber";
+    case "degraded":
+    case "down":
+      return "red";
+    default:
+      return "grey";
+  }
+}
+function residentsFleetTone(records) {
+  if (records.length === 0) return "grey";
+  const tones = new Set(records.map((record2) => residentStateTone(residentLive(rec(record2)).state)));
+  if (tones.has("red")) return "red";
+  if (tones.has("amber")) return "amber";
+  return tones.size === 1 && tones.has("green") ? "green" : "grey";
+}
+function residentSlug(record2) {
+  return str8(record2.resource).replace(/^repo:/, "");
+}
+function residentLive(record2) {
+  const live = rec(record2.live);
+  if (typeof live.error === "string") return { ...live, state: "unreachable", reason: live.error };
+  return { ...live, state: str8(live.state) || "unknown", reason: str8(live.reason) };
+}
+var RESIDENT_SLUG_RE, str8, rec;
+var init_residentsModel = __esm({
+  "../../src/channels/residentsModel.ts"() {
+    "use strict";
+    init_residentDiskBudget();
+    RESIDENT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,37}[a-z0-9])?\/[a-z0-9](?:[a-z0-9._-]{0,98}[a-z0-9])?$/;
+    str8 = (v) => typeof v === "string" ? v : typeof v === "number" ? String(v) : "";
+    rec = (v) => v && typeof v === "object" ? v : {};
+  }
+});
+
+// ../../src/channels/pageFavicon.ts
+function pageFavicon(seed) {
+  switch (seed.page) {
+    case "runs":
+    case "run":
+      return FAVICON_IDLE;
+    case "residents":
+      return FAVICON_BY_TONE[residentsFleetTone(seed.residents)];
+    default:
+      return FAVICON_DEFAULT;
+  }
+}
+var init_pageFavicon = __esm({
+  "../../src/channels/pageFavicon.ts"() {
+    "use strict";
+    init_favicon();
+    init_residentsModel();
+  }
+});
+
+// ../../src/channels/webShell.ts
+function renderShell(seed, assets) {
+  const css = assets.css.map((href) => `<link rel="stylesheet" href="${escapeHtml(href)}">`).join("\n");
+  const favicon = pageFavicon(seed);
+  return `<!doctype html>
+<html lang="en" class="dark">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<meta name="robots" content="noindex" />
+<title>${escapeHtml(seed.title)}</title>
+<link rel="icon" id="favicon" href="${favicon}" />
+${css}
+</head>
+<body>
+<div id="app"></div>
+<script type="application/json" id="${SEED_ELEMENT_ID}">${serializeSeed(seed)}</script>
+<script type="module" src="${escapeHtml(assets.js)}"></script>
+</body>
+</html>`;
+}
+function wantsSeed(req) {
+  const accept = req.headers.accept;
+  if (typeof accept !== "string") return false;
+  const types = accept.split(",").map((t) => t.split(";")[0].trim().toLowerCase());
+  return types.includes("application/json") && !types.includes("text/html");
+}
+function makePageSender(assets, capabilities) {
+  return (req, res, status3, viewer, title, seed) => {
+    const island = {
+      ...seed,
+      title,
+      capabilities,
+      ...viewer?.viewingAs ? { viewingAs: viewer.viewingAs } : {}
+    };
+    if (wantsSeed(req)) {
+      const body = JSON.stringify(island);
+      res.writeHead(status3, WEB_SEED_HEADERS);
+      res.end(body);
+      return;
+    }
+    const html = renderShell(island, assets);
+    res.writeHead(status3, WEB_HTML_HEADERS);
+    res.end(html);
+  };
+}
+var PAGE_CSP, FORM_PAGE_CSP, WEB_HTML_HEADERS, WEB_SEED_HEADERS;
+var init_webShell = __esm({
+  "../../src/channels/webShell.ts"() {
+    "use strict";
+    init_html();
+    init_pageFavicon();
+    init_webSeed();
+    PAGE_CSP = "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; media-src 'self'; font-src 'self'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";
+    FORM_PAGE_CSP = PAGE_CSP.replace("form-action 'none'", "form-action 'self'");
+    WEB_HTML_HEADERS = {
+      "content-type": "text/html; charset=utf-8",
+      "content-security-policy": PAGE_CSP,
+      "x-frame-options": "DENY",
+      "cache-control": "no-store",
+      vary: "accept"
+    };
+    WEB_SEED_HEADERS = {
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "no-store",
+      vary: "accept"
+    };
+  }
+});
+
 // ../../src/channels/residentsFeed.ts
 function frame(f) {
   return `data: ${JSON.stringify(f)}
@@ -55028,7 +55481,7 @@ async function readListing(client) {
   return { listing: { cap: r.data.cap, count: r.data.count, residents } };
 }
 function createResidentsViewHandler(deps) {
-  const { client, shell, runs } = deps;
+  const { client, page: page2, runs } = deps;
   const now = deps.now ?? Date.now;
   return (req, res, ctx) => {
     const url = new URL(req.url ?? "/", "http://localhost");
@@ -55089,8 +55542,7 @@ function createResidentsViewHandler(deps) {
           now: now(),
           runs: live
         };
-        res.writeHead(200, WEB_HTML_HEADERS);
-        res.end(shell(ctx.actor, "Resident repos", seed));
+        page2(req, res, 200, ctx.actor, "Resident repos", seed);
         finish2(200);
         return;
       }
@@ -55099,8 +55551,7 @@ function createResidentsViewHandler(deps) {
         plainEnd(404, `${route3.slug} is not onboarded as a resident`);
         return;
       }
-      res.writeHead(200, WEB_HTML_HEADERS);
-      res.end(shell(ctx.actor, route3.slug, { page: "resident", slug: route3.slug, record: record2 }));
+      page2(req, res, 200, ctx.actor, route3.slug, { page: "resident", slug: route3.slug, record: record2 });
       finish2(200);
     });
     return true;
@@ -55119,7 +55570,6 @@ var init_residentsView = __esm({
     init_viewer();
     init_residentsFeed();
     init_residentsModel();
-    init_webShell();
     init_residentsModel();
     UPSTREAM_REASON_MAX = 500;
   }
@@ -55451,10 +55901,7 @@ function createWebChatHandler(deps) {
       plain5(405, "method not allowed", { allow: "GET" });
       return true;
     }
-    const render3 = (title, seed) => {
-      res.writeHead(200, WEB_HTML_HEADERS);
-      res.end(deps.shell(ctx.actor, title, seed));
-    };
+    const render3 = (title, seed) => deps.page(req, res, 200, ctx.actor, title, seed);
     const sub = subOf(ctx.actor);
     if (route3.kind === "new") {
       const conversation = mintId();
@@ -55464,8 +55911,7 @@ function createWebChatHandler(deps) {
     const threadKey = threadKeyFor(sub, route3.id);
     turnsOf(threadKey, ctx.actor).then(async (open2) => {
       if (open2.runs.length === 0 && !ownLane(sub, threadKey)) {
-        res.writeHead(404, WEB_HTML_HEADERS);
-        res.end(deps.shell(ctx.actor, "Run not found", { page: "runNotFound", retentionDays }));
+        deps.page(req, res, 404, ctx.actor, "Run not found", { page: "runNotFound", retentionDays });
         return;
       }
       const seed = await seedFor(ctx, route3.id, threadKey, open2);
@@ -55489,7 +55935,6 @@ var init_web2 = __esm({
     init_commandHttp();
     init_http();
     init_viewer();
-    init_webShell();
     init_viewAs();
     PLATFORM5 = "web";
     CONVERSATION_ID_BYTES = 10;
@@ -55572,7 +56017,7 @@ function json(res, body) {
   res.writeHead(200, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
   res.end(JSON.stringify(body));
 }
-function createCostsViewHandler(service, shell, opts = {}) {
+function createCostsViewHandler(service, page2, opts = {}) {
   const names = opts.names ?? NO_NAMES;
   return (req, res, ctx = {}) => {
     const url = new URL(req.url ?? "/", "http://localhost");
@@ -55621,19 +56066,16 @@ function createCostsViewHandler(service, shell, opts = {}) {
     }
     const by = route3.view === "daily" ? Promise.resolve(null) : orNone(byReport(route3.view));
     Promise.all([orNone(service.report(group, days)), by]).then(([report2, byReport2]) => {
-      res.writeHead(200, WEB_HTML_HEADERS);
-      res.end(
-        shell(ctx.actor, `${report2?.label ?? group} spend`, {
-          page: "costs",
-          group,
-          report: report2,
-          groups,
-          view: route3.view,
-          ...byReport2 ? { by: byReport2 } : {},
-          snapshot: service.status(),
-          canSnapshot: canSnapshot(ctx.actor)
-        })
-      );
+      page2(req, res, 200, ctx.actor, `${report2?.label ?? group} spend`, {
+        page: "costs",
+        group,
+        report: report2,
+        groups,
+        view: route3.view,
+        ...byReport2 ? { by: byReport2 } : {},
+        snapshot: service.status(),
+        canSnapshot: canSnapshot(ctx.actor)
+      });
     }).catch(failed);
     return true;
   };
@@ -55646,7 +56088,6 @@ var init_costsView = __esm({
     init_names();
     init_costsService();
     init_sse();
-    init_webShell();
     DIMENSION_OF_VIEW = Object.freeze({
       users: "user",
       threads: "thread",
@@ -55679,7 +56120,7 @@ function plain3(res, status3, body, extra = {}) {
   res.writeHead(status3, { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store", ...extra });
   res.end(body);
 }
-function createDeliveryViewHandler(deps, shell) {
+function createDeliveryViewHandler(deps, page2) {
   return (req, res, ctx) => {
     const url = new URL(req.url ?? "/", "http://localhost");
     const route3 = parseDeliveryRoute(url.pathname);
@@ -55708,13 +56149,13 @@ function createDeliveryViewHandler(deps, shell) {
     const fresh = url.searchParams.get("fresh") === "1";
     const runs = async (range) => {
       if (!deps.runs) return [];
-      const page2 = await deps.runs.listRuns({
+      const page3 = await deps.runs.listRuns({
         status: "finished",
         visibleTo: predicateFor(ctx.actor, "runs:read", "run"),
         sinceMs: Date.parse(`${range.since}T00:00:00Z`),
         limit: RUN_LIST_MAX_LIMIT
       });
-      return runFactsOf(page2.runs, repo);
+      return runFactsOf(page3.runs, repo);
     };
     deps.service.report(repo, {
       ...weeksParam !== null ? { weeks: Number(weeksParam) } : {},
@@ -55728,9 +56169,7 @@ function createDeliveryViewHandler(deps, shell) {
         res.end(body);
         return;
       }
-      const html = shell(ctx.actor, `${report2.repo} delivery`, { page: "delivery", report: report2, repos });
-      res.writeHead(200, WEB_HTML_HEADERS);
-      res.end(html);
+      page2(req, res, 200, ctx.actor, `${report2.repo} delivery`, { page: "delivery", report: report2, repos });
     }).catch((err2) => {
       const reason2 = (err2 instanceof Error ? err2.message : String(err2)).slice(0, UPSTREAM_REASON_MAX4);
       plain3(res, 502, `delivery sources unavailable: ${reason2}`);
@@ -55745,7 +56184,6 @@ var init_deliveryView = __esm({
     init_predicate();
     init_delivery();
     init_runRecord();
-    init_webShell();
     SEGMENT = /^(?!\.+$)[\w.-]{1,100}$/;
     DELIVERY_NO_REPOS_MESSAGE = "No repository to report on \u2014 name one or more `owner/name` under delivery.repos in config to enable this view (the `delivery report --repo` command needs no config).";
     UPSTREAM_REASON_MAX4 = 400;
@@ -55810,7 +56248,7 @@ function channelScopeView(description) {
 function homeTab(caps) {
   return caps.mcp ? "mcps" : "channels";
 }
-function createSettingsViewHandler(deps, shell) {
+function createSettingsViewHandler(deps, page2) {
   const canWrite = (caller, action, kind, id) => authorize(
     caller.actor,
     action,
@@ -55905,10 +56343,7 @@ function createSettingsViewHandler(deps, shell) {
       }
       plain4(res, 502, `settings unavailable: ${reason2}`);
     };
-    const render3 = (viewer, seed) => {
-      res.writeHead(200, WEB_HTML_HEADERS);
-      res.end(shell(viewer, "Settings", seed));
-    };
+    const render3 = (viewer, seed) => page2(req, res, 200, viewer, "Settings", seed);
     const channel = "channel" in route3 ? route3.channel : void 0;
     deps.callerFor(ctx.identity).then(async (caller) => {
       const base = {
@@ -55941,7 +56376,6 @@ var init_settingsView = __esm({
     "use strict";
     init_authorize();
     init_names();
-    init_webShell();
     CHANNEL_ID_RE = /^[a-z]+:[A-Za-z0-9_.:-]{1,80}$/;
     UPSTREAM_REASON_MAX5 = 400;
     failureText = (r) => r.message;
@@ -57335,18 +57769,22 @@ async function contractFor(instance, unit, readers) {
   if (isGenerated(instance)) {
     source2 = { unit: await generatedUnitOf(instance, unit, readers) };
   } else {
-    const planMarkdown = await readers.readRepoFile(instance.plan.path);
-    if (planMarkdown === void 0)
+    const plan3 = await readers.readRepoFile(instance.plan.path, { maxChars: PLAN_MAX_CHARS });
+    if (plan3 === void 0)
       throw new Error(`the plan ${instance.plan.path} is not readable at ${rebase.onto} in ${instance.repo}`);
-    source2 = { planMarkdown, unitId: unit.unit };
+    if (plan3.truncated)
+      throw new Error(
+        `the plan ${instance.plan.path} is longer than ${PLAN_MAX_CHARS.toLocaleString("en-US")} characters at ${rebase.onto} in ${instance.repo}; a unit read from a cut plan could be briefed short, so none is`
+      );
+    source2 = { planMarkdown: plan3.content, unitId: unit.unit };
   }
   const section = ("unit" in source2 ? source2.unit : parsePlanUnit(source2.planMarkdown, unit.unit))?.section ?? "";
   const specs = /* @__PURE__ */ new Map();
   for (const spec of new Set(specItemRefs(section).map((r) => r.spec)))
-    specs.set(spec, await readers.readRepoFile(`${SPECS_DIR2}/${spec}`));
+    specs.set(spec, (await readers.readRepoFile(`${SPECS_DIR2}/${spec}`))?.content);
   let agentRules;
   for (const file of RULES_FILES2) {
-    const text = await readers.readRepoFile(file);
+    const text = (await readers.readRepoFile(file))?.content;
     if (text !== void 0) {
       agentRules = { file, text };
       break;
@@ -58474,9 +58912,10 @@ ${planSummary(units)}`).catch(() => {
 function briefReaders(deps, instance) {
   const ref = instance.base ?? "main";
   return {
-    readRepoFile: async (path) => {
+    readRepoFile: async (path, opts) => {
       try {
-        return (await deps.github.readFile(instance.repo, path, ref)).content;
+        const file = await deps.github.readFile(instance.repo, path, ref, opts);
+        return { content: file.content, truncated: file.truncated };
       } catch {
         return void 0;
       }
@@ -59180,17 +59619,17 @@ async function runBot() {
     const cronArmed = Object.values(auth.tokens).some((id) => id.subject === "cron");
     const schedulesState = `${SCHEDULES.length} schedule(s) on /runs (${capabilities.schedules ? `firings from ${config.config.schedules?.worker?.baseUrl}` : "no firing store"}; cron identity ${cronArmed ? "armed" : "NOT in SWITCHBOARD_INGRESS_TOKENS \u2014 scheduled runs fail closed"})`;
     const webAssets = loadWebAssets(webDistDir(publicEnv(), PACKAGE_ROOT));
-    const shell = makeShellRenderer(webAssets.entry, capabilities);
+    const page2 = makePageSender(webAssets.entry, capabilities);
     const residentsView = createResidentsViewHandler({
       client: residentAdminClient,
-      shell,
+      page: page2,
       runs: defaultRunRegistry,
       trace: { config, spanLog }
     });
     const residentsState = residentAdminClient instanceof NullResidentAdminClient ? `GET /residents (503 \u2014 ${residentAdminClient.reason})` : `GET /residents (dash \u2192 ${config.config.execution?.resident?.baseUrl})`;
-    const costsView = createCostsViewHandler(costsService, shell, { names });
+    const costsView = createCostsViewHandler(costsService, page2, { names });
     const costsState = costs ? `GET /costs (${costsService.groups().join(",")}; LLM ${costs.llmOn ? "on" : "off"}; snapshot every ${costsCfg?.snapshot.everyHours ?? "?"} h)` : costsCfg ? `GET /costs (503 \u2014 ${costsCfg.cloudflareTokenEnv} not set)` : "GET /costs (503 \u2014 no costs config)";
-    const deliveryView = createDeliveryViewHandler({ service: deliveryService, runs: runsService }, shell);
+    const deliveryView = createDeliveryViewHandler({ service: deliveryService, runs: runsService }, page2);
     const settingsView = createSettingsViewHandler(
       {
         commands,
@@ -59205,14 +59644,14 @@ async function runBot() {
         },
         capabilities
       },
-      shell
+      page2
     );
     const webChat = createWebChatHandler({
       core: deps,
       service: runsService,
       registry: defaultRunRegistry,
       commands,
-      shell,
+      page: page2,
       capabilities,
       names,
       retention: capabilities.runHistory && runHistoryCfg ? { retentionDays: retentionPolicyOf(runHistoryCfg).retentionDays } : null,
@@ -59223,10 +59662,18 @@ async function runBot() {
     const liveViewState = process.env.PUBLIC_BASE_URL ? "GET /runs (index) + /runs/:id (live view)" : "GET /runs (index) + live view (no PUBLIC_BASE_URL \u2014 per-run links omitted)";
     const accessConfig = parseAccessConfig(publicEnv());
     const publicBaseUrl = process.env.PUBLIC_BASE_URL;
+    const viewAsPeople = peopleSource({
+      granted: () => config.grantedPeople(),
+      requesters: async () => (await runsService.listRuns({ status: "all", visibleTo: { kind: "all" }, limit: RUN_LIST_MAX_LIMIT })).runs,
+      name: personName
+    });
+    void viewAsPeople.refresh();
     const liveView2 = createLiveViewHandler({
-      shell,
+      page: page2,
       service: runsService,
       index: defaultRunRegistry,
+      // The view-as picker's people (record 0053): the cache `viewAsPeople` keeps.
+      people: () => viewAsPeople.current(),
       retention: capabilities.runHistory && runHistoryCfg ? { retentionDays: retentionPolicyOf(runHistoryCfg).retentionDays } : null,
       // The panel's own off-state wording (live-view item 14: "firing history
       // unavailable", never "never fired") stands until the dashboard paints the
@@ -59603,6 +60050,7 @@ var init_index = __esm({
     init_confirmations();
     init_mcpConnectView();
     init_viewAs2();
+    init_runRecord();
     init_lookups();
     init_slackNames();
     init_names();