@coreplane/switchboard 1.249.0 → 1.249.1

package/dist/assets/config/config.example.yaml

@@ -262,7 +262,7 @@ execution:
   #   baseUrl: https://switchboard-resident.<account>.workers.dev
   #   tokenEnv: RESIDENT_OPERATOR_TOKEN  # operator bearer secret (default)
   #   adminTokenEnv: RESIDENT_ADMIN_TOKEN # admin bearer for `repo ...` commands (default)
-  #   probeTimeoutMs: 2000               # /status probe budget; timeout = not warm
+  #   probeTimeoutMs: 8000               # /status probe deadline; a miss = not warm for that dispatch, never an outage
 
 # Where per-conversation agent workspaces are created (local execution only).
 # Under docker compose this directory is a named volume, so checkouts survive a restart.

package/dist/assets/deploy/cloudflare-resident/refresh.ts

@@ -21,6 +21,7 @@ import {
 } from "../../src/execution/residentInstanceId.js";
 import { RESTORE_MAX_MS, type RefreshPlan } from "../../src/execution/residentRefresh.js";
 import { residentText } from "../../src/execution/residentText.js";
+import { RUNTIME_BUSY_REASON } from "../../src/execution/sandboxErrors.js";
 import { graftResidentSteps } from "../../src/execution/residentTrace.js";
 import {
   DEFAULT_EXEC_TIMEOUT_MS,
@@ -288,9 +289,10 @@ export class ResidentRefresh extends WorkflowEntrypoint<Env, RefreshInstancePara
       }
       // Housekeeping rides on every instance whatever the cycle's verdict — a
       // parked resident still releases its idle bindings and re-measures, and
-      // neither step wakes a slept container — except an offboarded one:
-      // nothing is left to keep.
-      if (cycle.outcome !== "offboarded") {
+      // neither step wakes a slept container — except an offboarded one
+      // (nothing is left to keep) and one whose container turned the cycle
+      // away (item 68: the sweep and the measure exec on that same container).
+      if (cycle.outcome !== "offboarded" && cycle.outcome !== RUNTIME_BUSY_REASON) {
         const swept = await step.do("sweep", { retries, timeout: stepTimeoutMs(REFRESH_SWEEP_STEP_BUDGET_MS) }, () =>
           stub.refreshInstanceSweep({ resource, instance }),
         );

package/dist/assets/deploy/cloudflare-resident/worker.ts

@@ -159,7 +159,11 @@ import {
 } from "../../src/core/schedules.js";
 import type { ResidentLifecycleState } from "../../src/execution/residentState.js";
 import { RestoreWaiters } from "../../src/execution/restoreWaiters.js";
-import { isRuntimeBusySignal, SandboxRuntimeBusyError } from "../../src/execution/sandboxErrors.js";
+import {
+  isRuntimeBusySignal,
+  RUNTIME_BUSY_REASON,
+  SandboxRuntimeBusyError,
+} from "../../src/execution/sandboxErrors.js";
 import {
   decisivePull,
   effectiveLimits,
@@ -613,6 +617,12 @@ const LIFECYCLE_KEY = "resident:lifecycle";
  *  resident, with the step it last reported and the cycle lease it holds, and
  *  the last bucket the cron skipped (a live cycle, a duplicate id). */
 const REFRESH_INSTANCE_KEY = "resident:refreshInstance";
+/** The settled state a cycle found before it wrote `refreshing` (item 68):
+ *  what a cycle that yields to a busy container puts back. Rewritten by every
+ *  cycle right before its `refreshing` write, so it always names the state
+ *  under the current marker and nothing older. */
+const REFRESHING_FROM_KEY = "resident:refreshingFrom";
+type RefreshingFrom = ResidentStatus;
 /** A `du` over a multi-GB checkout plus every live tree is seconds warm, tens
  *  of seconds on a cold page cache — the same class as a git network step. */
 const DU_TIMEOUT_MS = GIT_NETWORK_TIMEOUT_MS;
@@ -3358,6 +3368,9 @@ export class ResidentDO extends Sandbox<Env> {
       }
     }
 
+    // Item 68: remember what `refreshing` covers, so a cycle the busy container
+    // turns away can put it back — the last snapshot never stopped serving.
+    await this.ctx.storage.put(REFRESHING_FROM_KEY, (await this.getStatus()) satisfies RefreshingFrom);
     await this.setResidentState("refreshing");
     let sha: string;
     try {
@@ -3380,6 +3393,9 @@ export class ResidentDO extends Sandbox<Env> {
       // and die at git-setup). Name the disk instead: not
       // serviceable, and the recovery below can free it.
       const failure = await this.classifyFailure("fetch", message);
+      // Item 68: the container did not accept the connect — a run's command
+      // has its cores. Not GitHub, not the mirror: the instance step yields.
+      if (failure.busy) throw err;
       if (failure.diskFull) {
         await this.setResidentState("degraded", failure.reason);
         await this.recoverFromDiskFull(failure.reason, selfInFlight);
@@ -3533,7 +3549,9 @@ export class ResidentDO extends Sandbox<Env> {
    *  error can surface between steps — with the generic "refresh" step, whose
    *  failure reason is the `refresh-failed: …` shape. A full disk is a third
    *  class: `disk-full: …`, never serviceable, and the one failure the
-   *  resident can act on itself (recoverFromDiskFull). */
+   *  resident can act on itself (recoverFromDiskFull). A container that did
+   *  not accept the connect (`runtime-busy`, item 68) is a fourth: `busy`,
+   *  and the cycle yields to the run that holds it. */
   private async classifyCycleError(err: unknown): Promise<RefreshFailure> {
     // The control port never answered (item 64): the count decides, and a disk
     // probe would only cost another 30 s abort against the same silent port.
@@ -3911,7 +3929,10 @@ export class ResidentDO extends Sandbox<Env> {
    *  on purpose (`CycleRestartError`), is thrown to the engine, whose retry
    *  re-enters the same idempotent method — the row stays `refreshing`, never
    *  `degraded`, and a `refreshing` younger than the stale bound keeps the
-   *  cron from creating a second instance meanwhile. A failure of the repo's
+   *  cron from creating a second instance meanwhile. A container that turned
+   *  the step's connect away (`runtime-busy`, item 68) ends the cycle as
+   *  `stopped` with nothing recorded — `yieldCycle` puts back the state the
+   *  cycle found. A failure of the repo's
    *  own is recorded — `degraded` with the reason, the last snapshot still
    *  serving — and answered `failed`, which ends the cycle; the next cron
    *  firing starts the next one from that state. */
@@ -3963,6 +3984,21 @@ export class ResidentDO extends Sandbox<Env> {
         return { ...result, startedAt, trace: trace.steps() };
       }
       const failure = await this.classifyCycleError(err);
+      if (failure.busy) {
+        // Item 68: the container did not accept the cycle's connect — a run's
+        // command has its cores. Nothing ran and nothing about the repository
+        // is known: the cycle yields, the state it found goes back, and no
+        // failure is recorded — not `degraded`, not a rung of item 67's ladder
+        // (three cycles of it used to destroy the container under the run).
+        // The next cron firing tries again; the engine is not asked to retry
+        // into the same busy container.
+        outcome = `yielded (${failure.reason})`;
+        console.log(
+          `refresh instance ${instance}: ${step} yielded — ${failure.reason.slice(0, 400)}; the next cycle retries`,
+        );
+        await this.yieldCycle(instance);
+        return { status: "stopped", why: RUNTIME_BUSY_REASON, startedAt, trace: trace.steps() };
+      }
       if (failure.interrupted) {
         outcome = `interrupted (${failure.reason}) — the engine retries`;
         console.log(`refresh instance ${instance}: ${step} interrupted — ${failure.reason.slice(0, 400)}; retrying`);
@@ -3984,6 +4020,27 @@ export class ResidentDO extends Sandbox<Env> {
     }
   }
 
+  /** A cycle that met the busy container ends here (item 68): the lease it
+   *  holds goes back, and the `refreshing` it wrote is undone to the settled
+   *  state it found, so the row says what the last snapshot still is — warm,
+   *  or the degraded an earlier cycle earned — never a `degraded` of this
+   *  cycle's own. A `refreshing` this cycle did not write (a step past the
+   *  fetch found the marker of a cycle that died mid-flight) is left to the
+   *  watchdog, which normalizes it. */
+  private async yieldCycle(instance: string): Promise<void> {
+    await this.clearInstanceLease(instance);
+    const status = await this.getStatus();
+    if (status.state !== "refreshing") return;
+    const from = await this.ctx.storage.get<RefreshingFrom>(REFRESHING_FROM_KEY);
+    if (!from || (from.state !== "warm" && from.state !== "degraded")) {
+      console.log(
+        `refresh instance ${instance}: yielded from \`refreshing\` over ${from?.state ?? "no recorded state"}; left for the watchdog`,
+      );
+      return;
+    }
+    await this.setResidentState(from.state, from.reason);
+  }
+
   /** Step `fetch`: the gates, the cycle lease, the fetch and the plan. The
    *  instance id is the cycle `fetchMirror` records, so a retry of this step
    *  finds its fetch done. A rebuild's markers come off here, once per cycle,
@@ -4227,7 +4284,8 @@ export class ResidentDO extends Sandbox<Env> {
    *  errno, so a full-disk attach reads like a lock bug without the probe. */
   private async classifyFailure(step: string, message: string): Promise<RefreshFailure> {
     const direct = classifyRefreshFailure({ step, message });
-    if (direct.diskFull || direct.interrupted) return direct;
+    // A busy container (item 68) would only refuse the disk probe's exec too.
+    if (direct.diskFull || direct.interrupted || direct.busy) return direct;
     return classifyRefreshFailure({ step, message, freeKiB: await this.freeKiB() });
   }
 

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.249.0",
+  "version": "1.249.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.249.0",
+      "version": "1.249.1",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.249.0",
+      "version": "1.249.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.249.0",
+  "version": "1.249.1",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.249.0",
-  "commit": "1145eea8ffdd6a2bd1ae8f1b26a4919db2caf47d",
-  "builtAt": "2026-09-18T07:16:19.891Z"
+  "version": "1.249.1",
+  "commit": "7fa16da36339e9c0b04e3f9c037002efcf5975f4",
+  "builtAt": "2026-09-18T08:08:43.148Z"
 }

package/dist/assets/src/core/ship/coordinator.ts

@@ -1781,9 +1781,17 @@ export function renderUnitReport(s: UnitPipelineState, facts?: MergeReadyFacts):
             : "Remaining gate: a person's merge — the runner merges only when the instance's `merge` field says runner, and ship never approves.",
       ].join("\n");
     case "merge_refused":
+      // The approved work is on the branch, so the remedy is a person's hand
+      // merge, never a re-run: a seeded plan re-issued afterwards finds the
+      // merged pull request (the pre-check's `merged` by other, or
+      // `already_landed`) and moves on to the dependents. The generated
+      // plan's line already says to re-issue with the PR URL, which takes the
+      // same recognition path.
       return join([
         `⚠️ The review approved ${e.pr.url} but the runner did not merge it: ${e.reason}. A person decides what becomes of the pull request.`,
-        reissue,
+        s.input.generated
+          ? reissue
+          : `The approved work is on the branch: rebase or fix it, push, and merge it by hand. Then re-issue the plan naming the remaining units — a unit whose pull request has merged is recognized and not run again, and its dependents start from there.`,
       ]);
     case "round_cap":
       return join([

package/dist/assets/src/execution/residentRefresh.ts

@@ -22,6 +22,7 @@
  *  interrupted one stopped instead of redoing the whole rebuild. */
 
 import { DISK_FULL_FREE_KIB, diskFullReason, isDiskFullMessage } from "./residentDisk.js";
+import { carriesRuntimeBusyToken } from "./sandboxErrors.js";
 
 export interface RefreshDisk {
   /** `git rev-parse HEAD` of the warm checkout; null when unreadable. */
@@ -121,6 +122,9 @@ export function checkoutUpdateCommand(sha: string, clean: CleanScope): string {
  *  repository: the container's control port never answered the SDK's connect
  *  (`runtimeUnreachableReason`), so no command ran at all — the resident
  *  escalates on its persisted count instead of recording a command failure.
+ *  `busy` is the third: the container did not accept the cycle's connect
+ *  inside the platform's allowance (`runtime-busy`, resident-repos item 68) —
+ *  a run's command has its cores; nothing ran, and the cycle yields to it.
  *  Everything else is the repo's own build failing. */
 export interface RefreshFailure {
   /** The reason. An interruption's is prefixed `refresh-interrupted:` and is
@@ -130,7 +134,8 @@ export interface RefreshFailure {
    *  `disk-full:` (`residentDisk.ts` — the cycle's entry gate and the recycle
    *  decision key on it); an unanswered control port is `runtime-unreachable:`
    *  with the attempt count (the ladder below decides what the resident does
-   *  about it); real failures keep `<step>-failed:`. */
+   *  about it); a busy container's is `refresh-yielded:` (the cycle ends
+   *  `stopped`, the state it found put back); real failures keep `<step>-failed:`. */
   reason: string;
   /** The step that failed, as the caller named it (`refresh` for a failure
    *  between steps): item 67 reads whether it ran the repository's own command
@@ -139,6 +144,7 @@ export interface RefreshFailure {
   interrupted: boolean;
   diskFull: boolean;
   runtimeUnreachable: boolean;
+  busy: boolean;
 }
 
 /** Root argv that kills every process the build user still owns and waits
@@ -290,15 +296,31 @@ export function classifyRefreshFailure(input: {
       interrupted: false,
       diskFull: false,
       runtimeUnreachable: true,
+      busy: false,
       reason: runtimeUnreachableReason(input.runtimeUnreachable.count),
     };
   }
+  // Item 68: the token the Worker's `run()` named the refused connect with,
+  // anywhere in the text — a wrapper (a StepError, the fetch's mint prefix)
+  // keeps it. Decided before the disk inference: no command ran, so a low
+  // free-disk reading says nothing about this failure.
+  if (carriesRuntimeBusyToken(message)) {
+    return {
+      step,
+      interrupted: false,
+      diskFull: false,
+      runtimeUnreachable: false,
+      busy: true,
+      reason: `refresh-yielded: ${step} ${message}`,
+    };
+  }
   if (isDiskFullMessage(message)) {
     return {
       step,
       interrupted: false,
       diskFull: true,
       runtimeUnreachable: false,
+      busy: false,
       reason: diskFullReason({ step, message, freeKiB: input.freeKiB ?? null }),
     };
   }
@@ -309,6 +331,7 @@ export function classifyRefreshFailure(input: {
       interrupted: true,
       diskFull: false,
       runtimeUnreachable: false,
+      busy: false,
       reason: `refresh-interrupted: ${step} ${message}`,
     };
   }
@@ -318,6 +341,7 @@ export function classifyRefreshFailure(input: {
       interrupted: false,
       diskFull: true,
       runtimeUnreachable: false,
+      busy: false,
       reason: diskFullReason({ step, message, freeKiB: input.freeKiB }),
     };
   }
@@ -326,6 +350,7 @@ export function classifyRefreshFailure(input: {
     interrupted: false,
     diskFull: false,
     runtimeUnreachable: false,
+    busy: false,
     reason: `${step}-failed: ${message}`,
   };
 }

package/dist/assets/src/execution/sandboxErrors.ts

@@ -403,6 +403,14 @@ export function isRuntimeBusyError(err: unknown): boolean {
   return s.name === RUNTIME_BUSY_ERROR_NAME || !!s.message?.startsWith(`${RUNTIME_BUSY_REASON}:`);
 }
 
+/** Does a failure's text carry the token anywhere — the typed error's own
+ *  message, or that message behind a wrapper's prefix (a `StepError` built
+ *  from it, the fetch step's mint prefix)? The refresh cycle's classifier
+ *  reads this: the token decides, never the platform's words. */
+export function carriesRuntimeBusyToken(message: string): boolean {
+  return new RegExp(`(?:^|[\\s;(])${RUNTIME_BUSY_REASON}: `).test(message);
+}
+
 /** The `/read` and `/write` answer (sent as HTTP 503): the token and the text. */
 export function runtimeBusyAnswer(message: string): { error: string; reason: typeof RUNTIME_BUSY_REASON } {
   return { error: message, reason: RUNTIME_BUSY_REASON };

package/dist/cli.js

@@ -10136,6 +10136,9 @@ function execDeadline(timeoutMs, signal2) {
   signal2.addEventListener("abort", onStop, { once: true });
   return AbortSignal.any([deadline.signal, signal2]);
 }
+function isDeadlineMiss(err2) {
+  return err2 instanceof Error && err2.name === "TimeoutError";
+}
 function isRunStopError(err2) {
   return err2 instanceof ExecInfraError && err2.reason === "aborted";
 }
@@ -11121,6 +11124,7 @@ var init_residentRefresh = __esm({
   "../../src/execution/residentRefresh.ts"() {
     "use strict";
     init_residentDisk();
+    init_sandboxErrors();
     RUNTIME_MOVED_WORDING = /previous runtime incarnation|interrupted because the runtime changed|runtime identity is no longer active|sandbox lifetime is no longer current|platform was updating the sandbox runtime|no longer identifies pid/i;
     STOPPED_CONTAINER_WORDING = /process supervisor is closed|container is not running, consider calling start|the container just exited/i;
     RUNTIME_REPLACEMENT_WORDING = new RegExp(
@@ -11498,6 +11502,7 @@ var init_resident = __esm({
     init_residentDiskBudget();
     init_sandboxErrors();
     init_executor();
+    init_executor();
     DETACH_TIMEOUT_MS = 1e4;
     DRAIN_POLL_MS = DRAIN.pollMs;
     DRAIN_WAIT_MAX_MS = DRAIN.waitMaxMs;
@@ -11685,7 +11690,9 @@ var init_resident = __esm({
         await ex.attach();
         return ex;
       }
-      /** One operator-scope GET /status, bounded by timeoutMs. Never throws. */
+      /** One operator-scope GET /status, bounded by timeoutMs. Never throws. A
+       *  deadline miss is flagged `timedOut` beside `transport`, so the factory
+       *  falls cold for the one dispatch without arming its breaker. */
       static async probeStatus(baseUrl, token2, resource, timeoutMs, span, signal2) {
         const url = `${baseUrl.replace(/\/$/, "")}/status?resource=${encodeURIComponent(resource)}`;
         let res;
@@ -11697,7 +11704,12 @@ var init_resident = __esm({
             { route: "/status" }
           );
         } catch (err2) {
-          return { kind: "unreachable", error: err2 instanceof Error ? err2.message : String(err2), transport: true };
+          return {
+            kind: "unreachable",
+            error: err2 instanceof Error ? err2.message : String(err2),
+            transport: true,
+            ...isDeadlineMiss(err2) ? { timedOut: true } : {}
+          };
         }
         if (res.status === 404) {
           return { kind: "status", state: "not-onboarded", reason: "" };
@@ -12825,13 +12837,10 @@ function residentSlugsLister(cfg, secrets = processSecrets) {
     try {
       res = await fetch(`${cfg.baseUrl.replace(/\/$/, "")}/residents`, {
         headers: { authorization: `Bearer ${token2.reveal()}` },
-        signal: AbortSignal.timeout(cfg.probeTimeoutMs ?? 2e3)
+        signal: execDeadline(cfg.probeTimeoutMs ?? PROBE_TIMEOUT_MS2)
       });
     } catch (err2) {
-      probeOutage = {
-        until: systemClock() + PROBE_OUTAGE_WINDOW_MS,
-        error: err2 instanceof Error ? err2.message : String(err2)
-      };
+      if (!isDeadlineMiss(err2)) armOutage(err2 instanceof Error ? err2.message : String(err2));
       return void 0;
     }
     if (!res.ok) return void 0;
@@ -12856,11 +12865,11 @@ async function probeResident(cfg, token2, resource, span, stop) {
     cfg.baseUrl,
     token2.reveal(),
     resource,
-    cfg.probeTimeoutMs ?? 2e3,
+    cfg.probeTimeoutMs ?? PROBE_TIMEOUT_MS2,
     span,
     stop
   );
-  if (probe.kind === "unreachable" && probe.transport && !stop?.aborted) armOutage(probe.error);
+  if (probe.kind === "unreachable" && probe.transport && !probe.timedOut && !stop?.aborted) armOutage(probe.error);
   return probe;
 }
 function armOutage(error) {
@@ -12968,7 +12977,7 @@ function perThreadBackend(opts) {
   const type = opts.execution?.type ?? "local";
   return type === "e2b" ? "e2b" : type === "cloudflare" ? "sandbox" : "local";
 }
-var BACKENDS, WorkspaceReattachRefusedError, WorkspaceReattachLeaseSpentError, PROBE_OUTAGE_WINDOW_MS, AWAIT_RESTORE_TIMEOUT_MS, probeOutage, NullExecutor;
+var BACKENDS, WorkspaceReattachRefusedError, WorkspaceReattachLeaseSpentError, PROBE_OUTAGE_WINDOW_MS, PROBE_TIMEOUT_MS2, AWAIT_RESTORE_TIMEOUT_MS, probeOutage, NullExecutor;
 var init_factory = __esm({
   "../../src/execution/factory.ts"() {
     "use strict";
@@ -13011,6 +13020,7 @@ var init_factory = __esm({
       note;
     };
     PROBE_OUTAGE_WINDOW_MS = 3e4;
+    PROBE_TIMEOUT_MS2 = 8e3;
     AWAIT_RESTORE_TIMEOUT_MS = 10 * 6e4;
     NullExecutor = class {
       constructor(agentName) {
@@ -60469,10 +60479,12 @@ async function merge(body, deps, subject2) {
     return refused7(
       `the head of ${where} moved: \`${facts2.headSha?.slice(0, 7) ?? "?"}\` is not the approved \`${headSha.slice(0, 7)}\``
     );
-  if (facts2.mergeableState === "dirty")
+  if (facts2.mergeableState === "dirty") {
+    const base = facts2.baseRef ?? "its base";
     return refused7(
-      `${where} conflicts with \`${facts2.baseRef ?? "its base"}\` at \`${headSha.slice(0, 7)}\`, rebase and re-issue`
+      `${where} conflicts with \`${base}\` at \`${headSha.slice(0, 7)}\` \u2014 rebase onto \`${base}\`, push, and merge it by hand once the checks are green; the approved work stands`
     );
+  }
   const approved = await reviewPostedAt(deps, pr, "approve", headSha);
   if (approved === void 0)
     return json2(502, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreplane/switchboard",
-  "version": "1.249.0",
+  "version": "1.249.1",
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
   "homepage": "https://openswitchboard.dev",