@coreplane/switchboard 1.249.0 → 1.250.0

package/dist/assets/config/config.example.yaml

@@ -14,10 +14,9 @@ providers:
   # OpenAI itself runs on its Responses API (record 0052): every first-party
   # OpenAI card in pi's registry is `openai-responses`, OpenAI recommends the
   # wire for new projects, and its chat route loses tool calling with any
-  # effort above `none` from GPT-5.4. The wire is a declaration here; the proxy
-  # serves the Responses route in a later unit, and until then a run on this
-  # block meets the provider's own answer. `type: openai-compatible` keeps
-  # loading as `wire: openai-chat` for one release.
+  # effort above `none` from GPT-5.4. The proxy serves the wire at
+  # `/v1/responses` — a run on this block is pinned and metered like any other.
+  # `type: openai-compatible` keeps loading as `wire: openai-chat` for one release.
   openai:
     wire: openai-responses
     baseUrl: https://api.openai.com/v1
@@ -57,6 +56,10 @@ providers:
     #     inputs:
     #       image: true
     #     cache: automatic
+    #     # The answer shapes the card takes — a forced tool call, the one-JSON-
+    #     # object text contract, or both (absent assumes both). The intake gate
+    #     # refuses at load a card declaring neither under its classify default.
+    #     answers: ["tool", "text"]
     # A passthrough is merged into the request body on the wires whose adapter
     # takes one — a vendor-only feature such as OpenRouter's routing, never a
     # control: it is not decided, not noted and not in the matrix, and a wrong
@@ -262,7 +265,7 @@ execution:
   #   baseUrl: https://switchboard-resident.<account>.workers.dev
   #   tokenEnv: RESIDENT_OPERATOR_TOKEN  # operator bearer secret (default)
   #   adminTokenEnv: RESIDENT_ADMIN_TOKEN # admin bearer for `repo ...` commands (default)
-  #   probeTimeoutMs: 2000               # /status probe budget; timeout = not warm
+  #   probeTimeoutMs: 8000               # /status probe deadline; a miss = not warm for that dispatch, never an outage
 
 # Where per-conversation agent workspaces are created (local execution only).
 # Under docker compose this directory is a named volume, so checkouts survive a restart.
@@ -445,6 +448,26 @@ workspaceDir: ./workspaces
 #   model: anthropic/claude-haiku-4-5
 #   answer: text
 
+# The thread-reply intake gate (docs/decisions/0058-a-thread-reply-is-read-before-it-is-answered-intake-decides-whether-the-bot-was-addressed.md;
+# docs/reference/specs/routing-and-config.md item 27). How an unmentioned reply
+# in a channel thread the bot is part of is treated — NOTHING CALLS THE GATE
+# YET; the Slack wiring lands in a later release, and until then behavior is
+# unchanged whatever this block says. `threadReplies`: `classify` (the code's
+# default — one cheap model turn decides whether the bot was addressed; a
+# silent reply then gets no reaction, no card and no run), `mention` (only a
+# mention is answered; an unmentioned reply is silent with a receipt and no
+# model call) or `always` (today's answer-every-reply path, byte for byte).
+# Also settable per channel and per user: `intake: { threadReplies: <mode> }`
+# on a `channels.<id>` or `users.<id>` scope, user over channel over here.
+# `model` is the verdict's model; default `routing.model`, else
+# `defaults.models.general`. A mention, a DM and a top-level post never pass
+# through the gate in any mode. A model whose operator card (`providers.<p>.
+# models.<id>.answers`) declares it answers neither a forced tool call nor the
+# text contract is refused at load when the default mode is `classify`.
+# intake:
+#   threadReplies: classify
+#   model: anthropic/claude-haiku-4-5
+
 # Linked threads (docs/decisions/0037-a-linked-thread-is-quoted-not-joined.md;
 # docs/reference/specs/routing-and-config.md item 22). Off by default. On, a
 # permalink in a request to a thread in another PUBLIC channel the bot is a
@@ -535,6 +558,16 @@ workspaceDir: ./workspaces
 #   catchUp:
 #     enabled: true
 #     windowMinutes: 30
+#   # The apps whose relay footer — `Sent by Claude in <#C…> on behalf of <@U…> ·
+#   # <permalink>`, appended by the Claude Slack app to a post it makes from a
+#   # Claude Code session — names the person the run is for and billed to
+#   # (docs/reference/specs/slack-channel.md item 13). By Slack bot id: the
+#   # `bot_id` on the app's messages, the `B…` a run record's `postedBy:
+#   # slack:bot:B…` carries. The footer is message text any app can write, so
+#   # it is read only from an app listed here; from any other app the app itself
+#   # is the requester, footer or not. Absent or empty: no footer is honoured.
+#   relayApps:
+#     - B0123ABCDE
 
 # Where chat-set runtime overrides (`config set`, `config instructions`, `config clear`)
 # persist (docs/reference/specs/routing-and-config.md item 12). Without this block they go to

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -71,25 +71,35 @@ import {
   checkFence,
   decideClaim,
   decideClaimWrite,
+  decideIntakeInsert,
   phaseTransition,
   reclaimPhase,
   selectReclaim,
 } from "../../src/core/runLedger/decisions.ts";
+import { intakeReceiptRetentionMs } from "../../src/core/budgets.ts";
 import {
   IDEMPOTENCY_KEY_PATTERN,
+  capThreadEvent,
   INSTANCE_ID_PATTERN,
   isCoordinatorInstance,
   isCoordinatorUnit,
+  isThreadEvent,
   sendRunFinished,
+  UNIT_PATTERN,
   type CoordinatorInstance,
   type CoordinatorUnit,
   type RunFinishedSend,
+  type ThreadEvent,
 } from "../../src/core/coordinator/contract.ts";
 import {
   GEN_PATTERN,
+  isIntakeReceipt,
   type ClaimRequest,
   type ClaimResult,
   type FenceResult,
+  type IntakeQuery,
+  type IntakeReceipt,
+  type IntakeWriteResult,
   type LivePhase,
   type LiveRunRow,
   type ReclaimedRun,
@@ -1515,6 +1525,22 @@ export class RunHistoryDO extends DurableObject<Env> {
         PRIMARY KEY (run_id, kind)
       );
     `);
+    // The intake receipts (run-history item 59): one verdict per message key,
+    // first writer wins, beside the live rows because the reconnect catch-up
+    // reads them through the same store key. `prune_after` is stamped at the
+    // insert (the bound is the writer's window through
+    // `intakeReceiptRetentionMs`) and the alarm sweeps by it.
+    this.sql.exec(`
+      CREATE TABLE IF NOT EXISTS intake_receipts (
+        key TEXT PRIMARY KEY,
+        thread_key TEXT NOT NULL,
+        decided_at INTEGER NOT NULL,
+        prune_after INTEGER NOT NULL,
+        json TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS intake_thread ON intake_receipts(thread_key, decided_at);
+      CREATE INDEX IF NOT EXISTS intake_prune ON intake_receipts(prune_after);
+    `);
     // The coordinator's parent records (run-history item 49): one row per
     // instance, written by the bot at the instance's creation and read by the
     // spawn route for the requester, channel and thread every child acts as.
@@ -1537,6 +1563,20 @@ export class RunHistoryDO extends DurableObject<Env> {
         PRIMARY KEY (instance_id, unit)
       );
     `);
+    // The thread events of a unit-owned thread (record 0051's reply-as-event rule): a
+    // sibling table of the unit rows, never a field on them — `putUnits`
+    // replaces a row whole, so an append landing between a route's read and
+    // its put would be lost. Consumption is a column of its own, set once.
+    this.sql.exec(`
+      CREATE TABLE IF NOT EXISTS coordinator_unit_events (
+        instance_id TEXT NOT NULL,
+        unit TEXT NOT NULL,
+        seq INTEGER NOT NULL,
+        json TEXT NOT NULL,
+        consumed_by TEXT,
+        PRIMARY KEY (instance_id, unit, seq)
+      );
+    `);
   }
 
   // ---- the coordinator's parent records (run-history item 49) -----------------
@@ -1613,6 +1653,68 @@ export class RunHistoryDO extends DurableObject<Env> {
       .map((r) => JSON.parse(r.json) as CoordinatorUnit);
   }
 
+  // ---- the thread events of a unit-owned thread (record 0051's reply-as-event rule) --------------
+
+  /** The next sequence assigned in one transaction, the per-event cap applied
+   *  (attachments dropped whole, the row saying how many). */
+  async appendUnitEvent(
+    instanceId: string,
+    unit: string,
+    event: Omit<ThreadEvent, "seq">,
+  ): Promise<{ ok: true; seq: number }> {
+    let seq = 1;
+    this.ctx.storage.transactionSync(() => {
+      const max = this.sql
+        .exec<{
+          m: number | null;
+        }>(`SELECT MAX(seq) AS m FROM coordinator_unit_events WHERE instance_id = ? AND unit = ?`, instanceId, unit)
+        .toArray()[0];
+      seq = (max?.m ?? 0) + 1;
+      const capped = capThreadEvent({ ...event, seq });
+      this.sql.exec(
+        `INSERT INTO coordinator_unit_events (instance_id, unit, seq, json) VALUES (?, ?, ?, ?)`,
+        instanceId,
+        unit,
+        seq,
+        JSON.stringify(capped),
+      );
+    });
+    return { ok: true, seq };
+  }
+
+  /** The unit's events in sequence order; `unconsumedOnly` filters to the rows nothing has consumed. */
+  async listUnitEvents(instanceId: string, unit: string, unconsumedOnly: boolean): Promise<ThreadEvent[]> {
+    return this.sql
+      .exec<{ json: string; consumed_by: string | null }>(
+        `SELECT json, consumed_by FROM coordinator_unit_events WHERE instance_id = ? AND unit = ?${
+          unconsumedOnly ? " AND consumed_by IS NULL" : ""
+        } ORDER BY seq ASC`,
+        instanceId,
+        unit,
+      )
+      .toArray()
+      .map((r) => {
+        const e = JSON.parse(r.json) as ThreadEvent;
+        return r.consumed_by !== null ? { ...e, consumedBy: r.consumed_by } : e;
+      });
+  }
+
+  /** Consumption set once — idempotent: a row already consumed keeps its first consumer. */
+  async markUnitEventsConsumed(instanceId: string, unit: string, seqs: number[], by: string): Promise<{ ok: true }> {
+    this.ctx.storage.transactionSync(() => {
+      for (const seq of seqs) {
+        this.sql.exec(
+          `UPDATE coordinator_unit_events SET consumed_by = ? WHERE instance_id = ? AND unit = ? AND seq = ? AND consumed_by IS NULL`,
+          by,
+          instanceId,
+          unit,
+          seq,
+        );
+      }
+    });
+    return { ok: true };
+  }
+
   // ---- the live-run ledger (run-history items 28–34) --------------------------
 
   private liveRow(runId: string): LiveRunRow | undefined {
@@ -1993,6 +2095,59 @@ export class RunHistoryDO extends DurableObject<Env> {
     return parseEventRows(this.eventRows(runId, 0, Number.MAX_SAFE_INTEGER));
   }
 
+  // ---- the intake receipts (run-history item 59) -------------------------------
+
+  private intakeRow(key: string): IntakeReceipt | undefined {
+    const r = this.sql.exec<{ json: string }>(`SELECT json FROM intake_receipts WHERE key = ?`, key).toArray()[0];
+    return r ? (JSON.parse(r.json) as IntakeReceipt) : undefined;
+  }
+
+  /** Insert-if-absent inside one transaction: the first writer's row stands
+   *  and every caller acts on `stored` (`decideIntakeInsert`). `windowMs` is
+   *  the writer's reconnect catch-up window; the retention bound is stamped on
+   *  the row so the alarm's sweep is one indexed delete. */
+  async recordIntake(key: string, receipt: IntakeReceipt, windowMs: number): Promise<IntakeWriteResult> {
+    let out: IntakeWriteResult = { inserted: false, stored: receipt };
+    this.ctx.storage.transactionSync(() => {
+      out = decideIntakeInsert(this.intakeRow(key), receipt);
+      if (!out.inserted) return;
+      this.sql.exec(
+        `INSERT INTO intake_receipts (key, thread_key, decided_at, prune_after, json) VALUES (?, ?, ?, ?, ?)`,
+        key,
+        receipt.threadKey,
+        receipt.decidedAt,
+        receipt.decidedAt + intakeReceiptRetentionMs(windowMs),
+        JSON.stringify(receipt),
+      );
+    });
+    if ((await this.ctx.storage.getAlarm()) === null)
+      await this.ctx.storage.setAlarm(systemClock() + RUN_SWEEP_INTERVAL_MS);
+    return out;
+  }
+
+  async readIntake(key: string): Promise<IntakeReceipt | null> {
+    return this.intakeRow(key) ?? null;
+  }
+
+  /** A thread's receipts, or the receipts since an instant, oldest first. */
+  async listIntake(query: IntakeQuery): Promise<IntakeReceipt[]> {
+    const clauses: string[] = [];
+    const params: (string | number)[] = [];
+    if (query.threadKey !== undefined) {
+      clauses.push("thread_key = ?");
+      params.push(query.threadKey);
+    }
+    if (query.since !== undefined) {
+      clauses.push("decided_at >= ?");
+      params.push(query.since);
+    }
+    const where = clauses.length ? ` WHERE ${clauses.join(" AND ")}` : "";
+    return this.sql
+      .exec<{ json: string }>(`SELECT json FROM intake_receipts${where} ORDER BY decided_at ASC`, ...params)
+      .toArray()
+      .map((r) => JSON.parse(r.json) as IntakeReceipt);
+  }
+
   // ---- policy ---------------------------------------------------------------
 
   /** The persisted policy (defaults until the first proposal lands). */
@@ -2274,12 +2429,19 @@ export class RunHistoryDO extends DurableObject<Env> {
       const now = systemClock();
       const { policy } = this.policyState();
       let deleted = 0;
+      let receipts = 0;
       let candidates: { key: string; threadKey: string }[] = [];
       this.ctx.storage.transactionSync(() => {
         deleted = this.trim(policy, now, undefined).deleted;
         // Orphan sweep: events whose run is gone (defensive — `deleteRuns` pairs
         // the two deletes, so this is a periodic check, not a per-put cost).
         this.sql.exec(`DELETE FROM run_events WHERE run_id NOT IN (SELECT run_id FROM runs)`);
+        // Intake receipts past their bound (item 59): each row carries its own
+        // `prune_after`, stamped at the insert from the writer's window.
+        receipts = this.sql
+          .exec<{ n: number }>(`SELECT COUNT(*) AS n FROM intake_receipts WHERE prune_after <= ?`, now)
+          .one().n;
+        this.sql.exec(`DELETE FROM intake_receipts WHERE prune_after <= ?`, now);
         // The sessions no kept run names any more (session-log item 7): decided
         // here, on the rows this transaction leaves; dropped after it.
         candidates = this.sql
@@ -2291,7 +2453,9 @@ export class RunHistoryDO extends DurableObject<Env> {
           .map((r) => ({ key: r.key, threadKey: r.thread_key }));
       });
       const dropped = await this.sweepSessions(candidates);
-      console.log(`[runs/alarm] swept ${deleted} rows outside policy, dropped ${dropped} session log(s)`);
+      console.log(
+        `[runs/alarm] swept ${deleted} rows outside policy, pruned ${receipts} intake receipt(s), dropped ${dropped} session log(s)`,
+      );
       await this.ctx.storage.setAlarm(now + RUN_SWEEP_INTERVAL_MS);
       root.end("ok", { swept: deleted });
     } catch (err) {
@@ -3538,6 +3702,9 @@ const LEDGER_ROUTES = new Set([
   "/runs/coordinator/get",
   "/runs/coordinator/units/put",
   "/runs/coordinator/units/list",
+  "/runs/coordinator/events/append",
+  "/runs/coordinator/events/list",
+  "/runs/coordinator/events/mark-consumed",
   "/runs/claim",
   "/runs/heartbeat",
   "/runs/append",
@@ -3553,6 +3720,9 @@ const LEDGER_ROUTES = new Set([
   "/runs/reclaim",
   "/runs/live",
   "/runs/live-events",
+  "/runs/intake",
+  "/runs/intake/read",
+  "/runs/intake/list",
   "/runs/transcript/owner",
   "/runs/transcript/write",
   "/runs/transcript/read",
@@ -3926,6 +4096,64 @@ async function handleLedger(pathname: string, body: unknown, env: Env): Promise<
       return json({ error: "instanceId must be a Workflow instance id" }, 400);
     return json({ units: await stub.listUnits(b.instanceId) });
   }
+  // The thread events of a unit-owned thread (record 0051's reply-as-event rule): append assigns
+  // the sequence, list filters unconsumed, mark-consumed is idempotent.
+  if (pathname.startsWith("/runs/coordinator/events/")) {
+    if (typeof b.instanceId !== "string" || !INSTANCE_ID_PATTERN.test(b.instanceId))
+      return json({ error: "instanceId must be a Workflow instance id" }, 400);
+    if (typeof b.unit !== "string" || !UNIT_PATTERN.test(b.unit)) return json({ error: "unit must be a unit id" }, 400);
+    if (pathname === "/runs/coordinator/events/append") {
+      if (!isThreadEvent({ ...(b.event as Record<string, unknown>), seq: 1 }))
+        return json({ error: "event must be a thread event (without its seq)" }, 400);
+      // The store assigns the sequence and the consumer: a caller's `seq` or
+      // `consumedBy` is dropped, so no row is born consumed in its JSON while
+      // its column still lists it unconsumed.
+      const { seq: _ignored, consumedBy: _fresh, ...event } = b.event as ThreadEvent;
+      const r = await stub.appendUnitEvent(b.instanceId, b.unit, event as Omit<ThreadEvent, "seq" | "consumedBy">);
+      console.log(`[runs/coordinator/events/append] ${key.value} ${b.instanceId}:${b.unit} seq ${r.seq}`);
+      return json(r);
+    }
+    if (pathname === "/runs/coordinator/events/list") {
+      return json({ events: await stub.listUnitEvents(b.instanceId, b.unit, b.unconsumedOnly === true) });
+    }
+    if (pathname === "/runs/coordinator/events/mark-consumed") {
+      if (!Array.isArray(b.seqs) || !b.seqs.every((s) => typeof s === "number" && Number.isInteger(s) && s >= 1))
+        return json({ error: "seqs must be an array of sequence numbers" }, 400);
+      if (typeof b.by !== "string" || b.by.length === 0 || b.by.length > 200)
+        return json({ error: "by must name the consumer" }, 400);
+      const r = await stub.markUnitEventsConsumed(b.instanceId, b.unit, b.seqs as number[], b.by);
+      console.log(
+        `[runs/coordinator/events/mark-consumed] ${key.value} ${b.instanceId}:${b.unit} ${b.seqs.length} row(s) by ${b.by}`,
+      );
+      return json(r);
+    }
+  }
+
+  // The intake receipts (run-history item 59): keyed by the message, not a run.
+  if (pathname === "/runs/intake" || pathname === "/runs/intake/read") {
+    const receiptKey = b.key;
+    if (typeof receiptKey !== "string" || receiptKey.length === 0 || receiptKey.length > 256)
+      return json({ error: "key must be a non-empty string of at most 256 characters" }, 400);
+    if (pathname === "/runs/intake/read") return json({ receipt: await stub.readIntake(receiptKey) });
+    if (!isIntakeReceipt(b.receipt)) return json({ error: "receipt must be an intake receipt" }, 400);
+    if (b.windowMs !== undefined && (typeof b.windowMs !== "number" || !Number.isFinite(b.windowMs) || b.windowMs < 0))
+      return json({ error: "windowMs must be a non-negative number" }, 400);
+    const r = await stub.recordIntake(receiptKey, b.receipt, typeof b.windowMs === "number" ? b.windowMs : 0);
+    console.log(`[runs/intake] ${key.value} ${receiptKey} → ${r.inserted ? "inserted" : "existing"}`);
+    return json(r);
+  }
+  if (pathname === "/runs/intake/list") {
+    if (b.threadKey !== undefined && (typeof b.threadKey !== "string" || b.threadKey.length === 0))
+      return json({ error: "threadKey must be a non-empty string" }, 400);
+    if (b.since !== undefined && (typeof b.since !== "number" || !Number.isFinite(b.since)))
+      return json({ error: "since must be a number" }, 400);
+    return json({
+      receipts: await stub.listIntake({
+        ...(b.threadKey !== undefined ? { threadKey: b.threadKey } : {}),
+        ...(b.since !== undefined ? { since: b.since } : {}),
+      }),
+    });
+  }
 
   const runId = parseRunId(b.runId);
   if (!runId.ok) return json({ error: runId.error }, 400);

package/dist/assets/deploy/cloudflare-resident/Dockerfile

@@ -36,12 +36,21 @@ RUN git config --system user.name "switchboard-resident" \
 # cores once several threads run). These defaults inherit into every thread's
 # `su … -c` shell (su without `-` keeps the environment). CI=1 makes runners
 # non-interactive (no watch mode, no TTY progress spinners in captured
-# output). The heap cap keeps one runaway process to an eighth of the 12 GiB
-# so its neighbours keep theirs.
+# output). NODE_OPTIONS lets one Node process take 8 GiB of the 12 for its
+# heap. V8's own default is a quarter of physical memory (~3 GiB here), and
+# this image once pinned it lower still, at 1,536 MB — an eighth, meant as a
+# fair share among the 16 seats — under which this repository's own two `tsc`
+# passes die with "heap out of memory" (they pass at 3,072 MB with ~2 GB of
+# RSS each; measured), and which is a quarter of the large-monorepo typecheck
+# the instance size exists for (docs/reference/specs/execution.md item 16). A
+# per-process heap limit never shared memory between processes (16 × 1,536 MB
+# already exceeded the instance); the cgroup does that. So the cap is a
+# runaway guard, sized for the largest legitimate command with room, and the
+# same as the sandbox image's; src/deploy/imageNode.test.ts holds the two equal.
 ENV CI=1 \
     VITEST_MAX_WORKERS=1 VITEST_MAX_THREADS=1 VITEST_MAX_FORKS=1 VITEST_MIN_THREADS=1 VITEST_MIN_FORKS=1 \
     UV_THREADPOOL_SIZE=4 \
-    NODE_OPTIONS=--max-old-space-size=1536
+    NODE_OPTIONS=--max-old-space-size=8192
 
 # Node 24, not the base's. The 0.13.0-next base ships Node 22.23.2 like the
 # 0.12.9 one (copied from node:22-slim: the binary at /usr/local/bin/node, npm

package/dist/assets/deploy/cloudflare-resident/refresh.ts

@@ -21,6 +21,7 @@ import {
 } from "../../src/execution/residentInstanceId.js";
 import { RESTORE_MAX_MS, type RefreshPlan } from "../../src/execution/residentRefresh.js";
 import { residentText } from "../../src/execution/residentText.js";
+import { RUNTIME_BUSY_REASON } from "../../src/execution/sandboxErrors.js";
 import { graftResidentSteps } from "../../src/execution/residentTrace.js";
 import {
   DEFAULT_EXEC_TIMEOUT_MS,
@@ -288,9 +289,10 @@ export class ResidentRefresh extends WorkflowEntrypoint<Env, RefreshInstancePara
       }
       // Housekeeping rides on every instance whatever the cycle's verdict — a
       // parked resident still releases its idle bindings and re-measures, and
-      // neither step wakes a slept container — except an offboarded one:
-      // nothing is left to keep.
-      if (cycle.outcome !== "offboarded") {
+      // neither step wakes a slept container — except an offboarded one
+      // (nothing is left to keep) and one whose container turned the cycle
+      // away (item 68: the sweep and the measure exec on that same container).
+      if (cycle.outcome !== "offboarded" && cycle.outcome !== RUNTIME_BUSY_REASON) {
         const swept = await step.do("sweep", { retries, timeout: stepTimeoutMs(REFRESH_SWEEP_STEP_BUDGET_MS) }, () =>
           stub.refreshInstanceSweep({ resource, instance }),
         );

package/dist/assets/deploy/cloudflare-resident/worker.ts

@@ -159,7 +159,11 @@ import {
 } from "../../src/core/schedules.js";
 import type { ResidentLifecycleState } from "../../src/execution/residentState.js";
 import { RestoreWaiters } from "../../src/execution/restoreWaiters.js";
-import { isRuntimeBusySignal, SandboxRuntimeBusyError } from "../../src/execution/sandboxErrors.js";
+import {
+  isRuntimeBusySignal,
+  RUNTIME_BUSY_REASON,
+  SandboxRuntimeBusyError,
+} from "../../src/execution/sandboxErrors.js";
 import {
   decisivePull,
   effectiveLimits,
@@ -613,6 +617,12 @@ const LIFECYCLE_KEY = "resident:lifecycle";
  *  resident, with the step it last reported and the cycle lease it holds, and
  *  the last bucket the cron skipped (a live cycle, a duplicate id). */
 const REFRESH_INSTANCE_KEY = "resident:refreshInstance";
+/** The settled state a cycle found before it wrote `refreshing` (item 68):
+ *  what a cycle that yields to a busy container puts back. Rewritten by every
+ *  cycle right before its `refreshing` write, so it always names the state
+ *  under the current marker and nothing older. */
+const REFRESHING_FROM_KEY = "resident:refreshingFrom";
+type RefreshingFrom = ResidentStatus;
 /** A `du` over a multi-GB checkout plus every live tree is seconds warm, tens
  *  of seconds on a cold page cache — the same class as a git network step. */
 const DU_TIMEOUT_MS = GIT_NETWORK_TIMEOUT_MS;
@@ -3358,6 +3368,9 @@ export class ResidentDO extends Sandbox<Env> {
       }
     }
 
+    // Item 68: remember what `refreshing` covers, so a cycle the busy container
+    // turns away can put it back — the last snapshot never stopped serving.
+    await this.ctx.storage.put(REFRESHING_FROM_KEY, (await this.getStatus()) satisfies RefreshingFrom);
     await this.setResidentState("refreshing");
     let sha: string;
     try {
@@ -3380,6 +3393,9 @@ export class ResidentDO extends Sandbox<Env> {
       // and die at git-setup). Name the disk instead: not
       // serviceable, and the recovery below can free it.
       const failure = await this.classifyFailure("fetch", message);
+      // Item 68: the container did not accept the connect — a run's command
+      // has its cores. Not GitHub, not the mirror: the instance step yields.
+      if (failure.busy) throw err;
       if (failure.diskFull) {
         await this.setResidentState("degraded", failure.reason);
         await this.recoverFromDiskFull(failure.reason, selfInFlight);
@@ -3533,7 +3549,9 @@ export class ResidentDO extends Sandbox<Env> {
    *  error can surface between steps — with the generic "refresh" step, whose
    *  failure reason is the `refresh-failed: …` shape. A full disk is a third
    *  class: `disk-full: …`, never serviceable, and the one failure the
-   *  resident can act on itself (recoverFromDiskFull). */
+   *  resident can act on itself (recoverFromDiskFull). A container that did
+   *  not accept the connect (`runtime-busy`, item 68) is a fourth: `busy`,
+   *  and the cycle yields to the run that holds it. */
   private async classifyCycleError(err: unknown): Promise<RefreshFailure> {
     // The control port never answered (item 64): the count decides, and a disk
     // probe would only cost another 30 s abort against the same silent port.
@@ -3911,7 +3929,10 @@ export class ResidentDO extends Sandbox<Env> {
    *  on purpose (`CycleRestartError`), is thrown to the engine, whose retry
    *  re-enters the same idempotent method — the row stays `refreshing`, never
    *  `degraded`, and a `refreshing` younger than the stale bound keeps the
-   *  cron from creating a second instance meanwhile. A failure of the repo's
+   *  cron from creating a second instance meanwhile. A container that turned
+   *  the step's connect away (`runtime-busy`, item 68) ends the cycle as
+   *  `stopped` with nothing recorded — `yieldCycle` puts back the state the
+   *  cycle found. A failure of the repo's
    *  own is recorded — `degraded` with the reason, the last snapshot still
    *  serving — and answered `failed`, which ends the cycle; the next cron
    *  firing starts the next one from that state. */
@@ -3963,6 +3984,21 @@ export class ResidentDO extends Sandbox<Env> {
         return { ...result, startedAt, trace: trace.steps() };
       }
       const failure = await this.classifyCycleError(err);
+      if (failure.busy) {
+        // Item 68: the container did not accept the cycle's connect — a run's
+        // command has its cores. Nothing ran and nothing about the repository
+        // is known: the cycle yields, the state it found goes back, and no
+        // failure is recorded — not `degraded`, not a rung of item 67's ladder
+        // (three cycles of it used to destroy the container under the run).
+        // The next cron firing tries again; the engine is not asked to retry
+        // into the same busy container.
+        outcome = `yielded (${failure.reason})`;
+        console.log(
+          `refresh instance ${instance}: ${step} yielded — ${failure.reason.slice(0, 400)}; the next cycle retries`,
+        );
+        await this.yieldCycle(instance);
+        return { status: "stopped", why: RUNTIME_BUSY_REASON, startedAt, trace: trace.steps() };
+      }
       if (failure.interrupted) {
         outcome = `interrupted (${failure.reason}) — the engine retries`;
         console.log(`refresh instance ${instance}: ${step} interrupted — ${failure.reason.slice(0, 400)}; retrying`);
@@ -3984,6 +4020,27 @@ export class ResidentDO extends Sandbox<Env> {
     }
   }
 
+  /** A cycle that met the busy container ends here (item 68): the lease it
+   *  holds goes back, and the `refreshing` it wrote is undone to the settled
+   *  state it found, so the row says what the last snapshot still is — warm,
+   *  or the degraded an earlier cycle earned — never a `degraded` of this
+   *  cycle's own. A `refreshing` this cycle did not write (a step past the
+   *  fetch found the marker of a cycle that died mid-flight) is left to the
+   *  watchdog, which normalizes it. */
+  private async yieldCycle(instance: string): Promise<void> {
+    await this.clearInstanceLease(instance);
+    const status = await this.getStatus();
+    if (status.state !== "refreshing") return;
+    const from = await this.ctx.storage.get<RefreshingFrom>(REFRESHING_FROM_KEY);
+    if (!from || (from.state !== "warm" && from.state !== "degraded")) {
+      console.log(
+        `refresh instance ${instance}: yielded from \`refreshing\` over ${from?.state ?? "no recorded state"}; left for the watchdog`,
+      );
+      return;
+    }
+    await this.setResidentState(from.state, from.reason);
+  }
+
   /** Step `fetch`: the gates, the cycle lease, the fetch and the plan. The
    *  instance id is the cycle `fetchMirror` records, so a retry of this step
    *  finds its fetch done. A rebuild's markers come off here, once per cycle,
@@ -4227,7 +4284,8 @@ export class ResidentDO extends Sandbox<Env> {
    *  errno, so a full-disk attach reads like a lock bug without the probe. */
   private async classifyFailure(step: string, message: string): Promise<RefreshFailure> {
     const direct = classifyRefreshFailure({ step, message });
-    if (direct.diskFull || direct.interrupted) return direct;
+    // A busy container (item 68) would only refuse the disk probe's exec too.
+    if (direct.diskFull || direct.interrupted || direct.busy) return direct;
     return classifyRefreshFailure({ step, message, freeKiB: await this.freeKiB() });
   }
 

package/dist/assets/deploy/cloudflare-sandbox/Dockerfile

@@ -31,6 +31,13 @@ USER root
 # (src/execution/bashTimeout.ts); changing it requires a container rebuild +
 # redeploy.
 ENV COMMAND_TIMEOUT_MS=1240000
+# One Node process may take 8 GiB of the 12 for its heap. V8's own default is
+# a quarter of physical memory (~3 GiB on this instance), which would refuse
+# the very command the instance size was chosen for — a large monorepo's
+# typecheck near 8 GB (docs/reference/specs/execution.md item 16) — while the
+# box sat three-quarters empty. The same cap as the resident image's;
+# src/deploy/imageNode.test.ts holds the two equal.
+ENV NODE_OPTIONS=--max-old-space-size=8192
 # docker.io + iptables: a Docker engine for runs whose tests need containers
 # (act's default job mode, testcontainers, compose, image builds). Nothing
 # starts the daemon at boot — the wrapper below does, on the first `docker`

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.249.0",
+  "version": "1.250.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.249.0",
+      "version": "1.250.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.249.0",
+      "version": "1.250.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.249.0",
+  "version": "1.250.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
@@ -39,7 +39,7 @@
     "cli": "tsx src/cli.ts",
     "verify": "npm run verify:root && npm run verify --workspaces --if-present && npm run check:site",
     "verify:root": "npm run check:consistency && npm run typecheck && npm run lint && npm run format:check && npm test && npm run check:dist",
-    "check:consistency": "npm run check:lockfile && npm run check:sandbox-pair && npm run skills:check && npm run licenses:check && npm run docs:check && npm run pr-title:check && npm run specs:check && npm run decisions:check && npm run hygiene:check && npm run check:project-facts && npm run agents:check && npm run clock:check && npm run screenshots:check",
+    "check:consistency": "npm run check:lockfile && npm run check:sandbox-pair && npm run skills:check && npm run licenses:check && npm run docs:check && npm run pr-title:check && npm run specs:check && npm run decisions:check && npm run hygiene:check && npm run check:project-facts && npm run check:registry-drift && npm run agents:check && npm run clock:check && npm run screenshots:check",
     "ci:gate": "node scripts/ci-gate.mjs",
     "fix": "npm run docs:gen && npm run pr-title:gen && npm run agents:gen && npm run clock:gen && npm run hygiene:gen && npm run deploy:gen && npm run skills:sync && npm run lint:fix && npm run format",
     "deploy:gen": "npm run --silent cli -- deploy init",
@@ -50,6 +50,7 @@
     "pr-title:gen": "node scripts/pr-title-vocabulary.mjs --write",
     "pr-title:check": "node scripts/pr-title-vocabulary.mjs",
     "check:project-facts": "node scripts/check-project-facts.mjs",
+    "check:registry-drift": "tsx scripts/registry-drift.ts",
     "agents:gen": "tsx scripts/agents-gen.ts",
     "clock:gen": "tsx scripts/clock-allowlist.mts --write",
     "clock:check": "tsx scripts/clock-allowlist.mts",

package/dist/assets/project.json

@@ -127,6 +127,10 @@
       "does": "Every copy of the project's names, repository, docs URL and contact address equals `project.json`; its description, topics and npm package fit their rules.",
       "when": "After editing `project.json` or a community file; part of `check:consistency`."
     },
+    "check:registry-drift": {
+      "does": "Every example-config model ref still resolves against the pinned pi registry.",
+      "when": "After a pi bump; part of `check:consistency`."
+    },
     "skills:sync": {
       "does": "Vendors the skills listed in `skills/manifest.yaml`.",
       "when": "After changing the manifest; part of `fix`."