@coreplane/switchboard 1.250.0 → 1.251.0

package/dist/assets/config/config.example.yaml

@@ -87,6 +87,14 @@ defaults:
   # provider default. Skipped for models without effort support.
   # efforts:
   #   coding: medium
+  # How much the bot says about its own doing (docs/reference/specs/routing-and-config.md
+  # item 28): quiet (default) — only what needs the person: answers, verdicts,
+  # refusals, questions, results, the card's progress; verbose — plus every
+  # acknowledgement (a follow-up folded into a live run, a plan handed to the
+  # runner, the workspace and budget on the card); debug — plus the router's
+  # reason and the ledger's word. Same layering as effort: per-channel/user
+  # `verbosity` and a per-request `verbosity:<level>` directive override it.
+  # verbosity: quiet
   # A boundary caps what ANY run in a scope may have — never grants — on the
   # three axes of a run's profile (docs/reference/specs/routing-and-config.md item 2):
   # maxMinutes (the wall-clock budget; at least 2), maxIdentity (the credential
@@ -156,6 +164,7 @@ defaults:
 # users:
 #   slack:U012345:
 #     model: openai/gpt-5
+#     verbosity: verbose          # hear every acknowledgement of what the bot does for you
 #     harness:
 #       coding: opencode
 

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -779,6 +779,27 @@ export class ConfigDO extends DurableObject<Env> {
     });
   }
 
+  /** The thread's pending row when one exists and is inside its ttl, else
+   *  null. A pure read: expiry is checked here on this object's clock and
+   *  nothing is deleted — nothing sweeps, and a consume still finds the
+   *  expired row to name `expired`. */
+  async pendingConfirmationByThread(threadKey: string, now: number): Promise<ConfirmationRow | null> {
+    const row = this.sql
+      .exec<{ id: string; requester: string; expires_at: number; body: string }>(
+        `SELECT id, requester, expires_at, body FROM confirmations WHERE thread_key = ?`,
+        threadKey,
+      )
+      .toArray()[0];
+    if (!row || row.expires_at <= now) return null;
+    return {
+      id: row.id,
+      threadKey,
+      requester: row.requester,
+      expiresAt: row.expires_at,
+      body: parseStored(row.body, isJsonObject) ?? {},
+    };
+  }
+
   private readConfirmation(id: string): ConfirmationRow | undefined {
     const row = this.sql
       .exec<{ thread_key: string; requester: string; expires_at: number; body: string }>(
@@ -1199,6 +1220,7 @@ const CONFIG_ROUTES = new Set([
   "/config/confirmations/consume",
   "/config/confirmations/cancel",
   "/config/confirmations/cancel-by-thread",
+  "/config/confirmations/pending-by-thread",
 ]);
 const TICKET_STATES: ReadonlySet<string> = new Set<McpTicketState>(MCP_TICKET_STATES);
 /** A confirmation id as the bot mints it (a UUID) — one token, no whitespace, bounded. */
@@ -1284,6 +1306,15 @@ async function handleConfig(pathname: string, body: unknown, env: Env): Promise<
       console.log(`[config/confirmations/cancel] ${click.id} ${"ok" in outcome ? "cancelled" : outcome.refused}`);
       return json(outcome);
     }
+    case "/config/confirmations/pending-by-thread": {
+      if (typeof b.threadKey !== "string" || !b.threadKey) return json({ error: "threadKey required" }, 400);
+      // The stub types this result `never`: workers-types' Serializable rejects
+      // the row's opaque `Record<string, unknown>` body. What arrives is the
+      // object's declared result, so the boundary restates it.
+      const row = (await dO.pendingConfirmationByThread(b.threadKey, systemClock())) as ConfirmationRow | null;
+      console.log(`[config/confirmations/pending-by-thread] ${b.threadKey} ${row === null ? "none" : row.id}`);
+      return json({ row });
+    }
     case "/config/confirmations/cancel-by-thread": {
       if (typeof b.threadKey !== "string" || !b.threadKey) return json({ error: "threadKey required" }, 400);
       if (!Array.isArray(b.actorIds) || !b.actorIds.every((a): a is string => typeof a === "string"))

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.250.0",
+  "version": "1.251.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.250.0",
+      "version": "1.251.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.250.0",
+      "version": "1.251.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.250.0",
+  "version": "1.251.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.250.0",
-  "commit": "4ac4b778bce59eddec48e214def56ad7aa7c62d2",
-  "builtAt": "2026-09-18T19:28:39.901Z"
+  "version": "1.251.0",
+  "commit": "95a98b3da9996ee6194236ec9c6b453c18aa6bcf",
+  "builtAt": "2026-09-18T22:15:18.238Z"
 }

package/dist/assets/src/core/authz/policy.ts

@@ -135,6 +135,10 @@ export const POLICY: readonly Rule[] = [
   // scope from anywhere, a private one only from inside it, `unknown` never.
   { action: "config:read", resource: "config-scope", resourceKind: "channel", when: [grant("config:write")] },
   { action: "config:read", resource: "config-scope", resourceKind: "channel", when: [MEMBER_OF] },
+  // A THREAD's scope (`config set thread`, routing-and-config item 27): the
+  // channel-config right — whoever may set the channel may set a thread in it;
+  // never a baseline, so membership alone admits nobody.
+  { action: "config:write", resource: "config-scope", resourceKind: "thread", when: [grant("config:write")] },
   // A user edits only their own scope.
   { action: "config:write", resource: "config-scope", resourceKind: "user", when: [IS_SELF] },
 

package/dist/assets/src/core/authz/resource.ts

@@ -31,14 +31,14 @@ export type AttributeName = Exclude<keyof ResourceAttributes, "visibility">;
 /** The kinds each kinded resource type takes. Types absent here are not kinded. */
 export const RESOURCE_KINDS: { readonly [T in ResourceType]?: readonly KindOf<T>[] } = {
   "memory-scope": ["org", "user", "repo", "channel"],
-  "config-scope": ["channel", "user", "org"],
+  "config-scope": ["channel", "user", "thread", "org"],
 };
 
 /** A resource type, or `type/kind` for the kinded ones — the unit a rule row targets. */
 export type Target =
   | Exclude<ResourceType, "memory-scope" | "config-scope">
   | `memory-scope/${"org" | "user" | "repo" | "channel"}`
-  | `config-scope/${"channel" | "user" | "org"}`;
+  | `config-scope/${"channel" | "user" | "thread" | "org"}`;
 
 export const TARGET_ATTRIBUTES: Readonly<Record<Target, readonly AttributeName[]>> = {
   run: ["channelId", "userId", "repo"],
@@ -50,6 +50,9 @@ export const TARGET_ATTRIBUTES: Readonly<Record<Target, readonly AttributeName[]
   repo: ["repo"],
   "config-scope/channel": ["channelId"],
   "config-scope/user": ["userId"],
+  // A thread key carries no attribute a condition reads: the one row on it is
+  // a bare grant check (the channel-config right, `config set thread`).
+  "config-scope/thread": [],
   "config-scope/org": [],
   agent: ["name"],
   command: [],
@@ -136,6 +139,7 @@ export function attributesOf(resource: Resource): ResourceAttributes {
           return { channelId: resource.id, visibility: "unknown", channelVisibility: resource.visibility ?? "unknown" };
         case "user":
           return { userId: resource.id, visibility: "unknown" };
+        case "thread":
         case "org":
           return { visibility: "unknown" };
       }

package/dist/assets/src/core/authz/types.ts

@@ -114,6 +114,8 @@ export type Resource =
       readonly visibility?: ChannelVisibility;
     }
   | { readonly type: "config-scope"; readonly kind: "user"; readonly id: string }
+  /** A thread's runtime scope (`config set thread`, routing-and-config item 27); `id` is the thread key. */
+  | { readonly type: "config-scope"; readonly kind: "thread"; readonly id: string }
   | { readonly type: "config-scope"; readonly kind: "org" }
   | { readonly type: "agent"; readonly name: string }
   /** List-shaped actions with no single resource (`runs.list`, `friction.report`). */

package/dist/assets/src/core/coordinator/driver.ts

@@ -172,6 +172,8 @@ interface PlanFacts {
   grantSource: GrantSource;
   /** The instance's mark as the plan route answers it: a generated one-unit plan (a `plan` with no `path`). */
   generated: boolean;
+  /** The runs page base the bot answered: the report links a child's write-up to its run page with it. */
+  runPageBase?: string;
   repo: string;
   base: string;
   caps: ShipCaps;
@@ -217,6 +219,7 @@ function readPlan(a: BotAnswer): PlanFacts {
     grantSource:
       b.grantSource === "run" || b.grantSource === "user" || b.grantSource === "channel" ? b.grantSource : "org",
     generated: b.generated === true,
+    ...(typeof b.runPageBase === "string" && b.runPageBase.length > 0 ? { runPageBase: b.runPageBase } : {}),
     repo: b.repo,
     base: b.base,
     caps: { maxRounds: b.caps.maxRounds, maxMinutes: b.caps.maxMinutes },
@@ -318,7 +321,7 @@ function isCommitChecks(v: unknown): v is { total: number; pending: string[]; fa
 function prCheckReturn(step: string, a: BotAnswer): StepReturn {
   const { ok, state, prNumber, url, headSha, sha, mergedAt, at } = a.body;
   if (ok === true && state === "none") {
-    const { unrecovered, aheadOfBase } = a.body;
+    const { unrecovered, aheadOfBase, prClosed } = a.body;
     return {
       type: "pr-check",
       step,
@@ -328,6 +331,9 @@ function prCheckReturn(step: string, a: BotAnswer): StepReturn {
         // The branch's commits over the base, when the bot could read them
         // (agent-ship item 12): zero is the `already_landed` ending's fact.
         ...(typeof aheadOfBase === "number" ? { aheadOfBase } : {}),
+        // The followed pull request verified closed unmerged (issue 1799):
+        // the machine must not brief a review round on it.
+        ...(prClosed === true ? { prClosed: true } : {}),
       },
       at,
     };
@@ -453,12 +459,19 @@ async function perform(
     case "pr-check":
       // `recover` rides only after a dead coding child: the bot opens the pull
       // request from the pushed branch itself instead of answering `none`.
+      // `pr` is the machine's adopted pull request (issue 1799): the bot
+      // follows it when nothing heads the unit's branch and answers its live
+      // state instead of `none` over a minutes-old record fact.
       return prCheckReturn(
         action.step,
         answerOf(
           "pr-check",
           await step.do(action.step, STEP_CONFIG, () =>
-            call(bot, "pr-check", { ...tag, ...(action.recover !== undefined ? { recover: action.recover } : {}) }),
+            call(bot, "pr-check", {
+              ...tag,
+              ...(action.recover !== undefined ? { recover: action.recover } : {}),
+              ...(action.pr !== undefined ? { pr: action.pr } : {}),
+            }),
           ),
         ),
       );
@@ -537,6 +550,7 @@ async function runUnit(
       grant: plan.grant,
       grantSource: plan.grantSource,
       generated: plan.generated,
+      ...(plan.runPageBase !== undefined ? { runPageBase: plan.runPageBase } : {}),
       ...(resume !== undefined ? { resume } : {}),
       ...(lastPush !== undefined ? { lastPush } : {}),
       ...(session !== undefined ? { session } : {}),

package/dist/assets/src/core/modelCard.ts

@@ -10,7 +10,7 @@
 // catalog lives in ./modelRegistry.ts.
 
 import { EFFORT_LEVELS, type Effort } from "../effort.js";
-import { vendorOf, wireOf, type ProviderConfig, type Wire } from "./provider.js";
+import { billerHarnessProvider, vendorOf, wireOf, type ProviderConfig, type Wire } from "./provider.js";
 import type { RegistryCard } from "./modelRegistry.js";
 
 /** Which layer named a field: the operator's block, the registry card, or the
@@ -335,13 +335,29 @@ export function decideControls(card: ModelCard, asked: AskedControls): ControlDe
     why: windowVouched ? "" : `no layer names the window; compacting at ${card.window}`,
   });
 
-  const cacheNative = card.cache !== "unknown";
+  // A `markers` rule needs a harness-side write that places the markers
+  // (record 0052's amendment: the harness write names the biller's own
+  // provider). The Anthropic wire's own packages place per-block breakpoints;
+  // on the chat wire a biller the table names caches the aggregator's own way
+  // — the pinned OpenCode binary exempts the openrouter route from per-block
+  // placement, so the write carries OpenRouter's top-level
+  // `cache_control: { type: "ephemeral" }` via `settings.extraBody` (measured
+  // in `opencode/testing/realDriver.test.ts`), and pi's compat sends the
+  // per-block markers. A biller served generically degrades, never a silent
+  // `native`.
+  const markersUnplaced =
+    card.cache === "markers" && card.wire === "openai-chat" && billerHarnessProvider(card.block) === undefined;
+  const cacheNative = card.cache !== "unknown" && !markersUnplaced;
   decisions.push({
     control: "cache",
     outcome: cacheNative ? "native" : "degraded",
     applied: card.cache,
     vouched: cacheNative,
-    why: cacheNative ? "" : `no layer names ${card.model}'s cache rule`,
+    why: cacheNative
+      ? ""
+      : markersUnplaced
+        ? `no harness-side provider vouches for the "${card.block}" biller's cache markers; the rule goes out unvouched`
+        : `no layer names ${card.model}'s cache rule`,
   });
 
   return decisions;

package/dist/assets/src/core/provider.ts

@@ -209,6 +209,55 @@ export function vendorOf(
   return { block, model, vendor: block, vendorId: model, vendorSource: "block" };
 }
 
+/** The harness-side provider a block's biller implies (record 0052's
+ *  amendment: the harness write names the biller's own provider, never a
+ *  generic alias). Keyed by the biller — the block's name — for the billers
+ *  whose protocol a harness bundles a provider for. The wires with a package
+ *  of their own (`anthropic-messages` → `@ai-sdk/anthropic`,
+ *  `openai-responses` → `@ai-sdk/openai`) need no entry: the wire names the
+ *  package. A chat-wire biller not here is served generically
+ *  (`@ai-sdk/openai-compatible`), under which a `markers` cache rule cannot be
+ *  vouched for (`decideControls`): the generic provider places no cache
+ *  breakpoints. */
+export interface BillerHarnessProvider {
+  /** The AI SDK package OpenCode's configuration names for the biller
+   *  (`openCodeProviderPackage` adds the `aisdk:` prefix). */
+  openCodePackage: string;
+  /** The compat words pi keys on the biller's identity, copied once from pi's
+   *  own completions detection of that biller and never inferred from a URL at
+   *  run time: through the proxy pi sees the bot's URL, so `piModelsJson` must
+   *  say the words the biller's own base URL would have made pi detect. */
+  piCompat: {
+    /** How the wire spells reasoning: `reasoning: { effort }` under
+     *  `"openrouter"`, never the completions shape's flat `reasoning_effort`. */
+    thinkingFormat: string;
+    /** How a session id would ride the headers, were affinity ever turned on. */
+    sessionAffinityFormat: string;
+    /** The vendor-qualified id prefixes the biller grants the developer role:
+     *  any other id is told `supportsDeveloperRole: false`, as pi's own
+     *  detection would say against the biller directly. */
+    developerRoleIdPrefixes: readonly string[];
+  };
+}
+
+/** The biller-to-provider table: one row per biller a harness speaks natively
+ *  — OpenCode's package (U44) and pi's compat words (U45) side by side. */
+export const BILLER_HARNESS_PROVIDERS: Readonly<Record<string, BillerHarnessProvider>> = {
+  openrouter: {
+    openCodePackage: "@openrouter/ai-sdk-provider",
+    piCompat: {
+      thinkingFormat: "openrouter",
+      sessionAffinityFormat: "openrouter",
+      developerRoleIdPrefixes: ["anthropic/", "openai/"],
+    },
+  },
+};
+
+/** The biller's harness-side provider, or undefined when it is served generically. */
+export function billerHarnessProvider(biller: string | undefined): BillerHarnessProvider | undefined {
+  return biller === undefined ? undefined : BILLER_HARNESS_PROVIDERS[biller];
+}
+
 /** The env var Anthropic's own SDK reads when an `anthropic` provider block names none. */
 export const ANTHROPIC_API_KEY_ENV = "ANTHROPIC_API_KEY";
 

package/dist/assets/src/core/refusal.ts

@@ -56,6 +56,8 @@ const CAUSE_OF = {
   which_branch: "request",
   workspace_lost: "system",
   ship_budget: "request",
+  // one pipeline per thread (record 0060): the host key's claim answered thread-live
+  ship_thread_live: "request",
   setup_failed: "system",
   // the click on a confirmation (confirm.ts)
   confirmation_used: "request",
@@ -106,6 +108,7 @@ const CAUSE_OF = {
   directive_budget: "request",
   directive_severity: "request",
   directive_renewals: "request",
+  directive_verbosity: "request",
   provider_unknown: "request",
   // the model card's refusal (record 0052, model-proxy item 11): a control the
   // resolved card does not take, named before any card or model call

package/dist/assets/src/core/runLedger/types.ts

@@ -59,6 +59,14 @@ export interface LiveRunMeta {
   /** The app that relayed the request for the person (authorization.md item 14): a resume or restart keeps app ∩ person at the gates. */
   postedBy?: string;
   effort?: string;
+  /** A ship pipeline's parent (record 0060): claimed under the host key
+   *  (`hostKey.ts`) while `threadKey` here names the thread itself, so every
+   *  record, notice and rebuilt handle files by the metadata's thread and the
+   *  occupancy readers that key on the ledger's key column never see it. */
+  hosted?: true;
+  /** The run's index label (the registry sets it at create): on the row so a
+   *  hosted run listed from the ledger reads as its registry view does. */
+  label?: string;
   ref?: string;
   headSha?: string;
   pr?: number;
@@ -96,10 +104,10 @@ export interface LiveRunMeta {
   request?: Record<string, unknown>;
   /** The router's decision when it chose the run's preset (routing-and-config
    *  item 21) — the same fields the record's `route` event carries. On the row
-   *  so a resume repaints the card as it was (` · routed: <reason>`, the
-   *  parts, the override footer on the close) and a reclaim closing the run
-   *  knows it was routed without reading the events. Absent for a preset a
-   *  person, a scope or the default chose. */
+   *  so a resume repaints the card as it was (the `route reason:` note at
+   *  debug, the parts) and a record built from the row knows it was routed
+   *  without reading the events. Absent for a preset a person, a scope or the
+   *  default chose. */
   route?: {
     preset: string;
     reason: string;

package/dist/assets/src/core/runRecord.ts

@@ -39,6 +39,12 @@ import {
 // reached `finish`.
 export type RunStatus = "completed" | "stopped_soft" | "stopped_hard" | "failed" | "interrupted";
 
+/** How every store-only reader renders a record still in its provisional
+ *  window (run-history.md item 27's third state): not `interrupted` (a real
+ *  terminal state) and not `running` (the store cannot know). One string for
+ *  the CLI's `runs list`/`runs get` and the web's index row and run page. */
+export const PROVISIONAL_LABEL = "unfinished — no finish recorded";
+
 const RUN_STATUSES: readonly RunStatus[] = ["completed", "stopped_soft", "stopped_hard", "failed", "interrupted"];
 
 /** Every `runs.*` id: checked before any store call. */
@@ -115,6 +121,13 @@ export interface RunRecord {
   stepCount?: number;
   schema?: number;
   status: RunStatus;
+  /** Present on a tombstone record still in its provisional window — the
+   *  start-of-run `interrupted` or the drain-deadline upgrade — before the
+   *  run's final write lands. Absent on every final (finished) record. A
+   *  store-only reader must render a provisional record as "unfinished — no
+   *  finish recorded" rather than as `interrupted`, because the run may still
+   *  be live in a registry the reader cannot see (run-history.md item 27). */
+  provisional?: true;
   /** The failure by name, when a `failed` run has one (item 57):
    *  `policy_refusal`, the provider refused the run's model call under its
    *  usage policy. Absent on a run that did not fail, on one that failed for
@@ -944,6 +957,9 @@ export function isRunRecord(v: unknown): v is RunRecord {
       return false;
   }
   if (!RUN_STATUSES.includes(r.status as RunStatus)) return false;
+  // A provisional tombstone carries `provisional: true`; any other value (false,
+  // a string, etc.) is a malformed record — only the presence of the flag matters.
+  if (r.provisional !== undefined && r.provisional !== true) return false;
   if (!isFiniteNumber(r.eventCount) || !isFiniteNumber(r.storedEventCount)) return false;
   if (typeof r.truncated !== "boolean") return false;
   if (!Array.isArray(r.events)) return false;

package/dist/assets/src/core/ship/contract.ts

@@ -439,17 +439,30 @@ export const TIMEOUT_ON_LONG_COMMANDS =
   "State a timeout on any command you expect to run longer than a minute: a timeout that reaches past the loop's " +
   "end is refused before the command runs, never cut midway.";
 
+/** The fast gates a plan child runs before every push, named one by one
+ *  (agent-ship item 13; agent-coding item 9). "Its cheapest proving checks"
+ *  left the choice to the child, and children chose wrong: prettier was
+ *  reported clean while `format:check` was red, and hygiene imprints reached
+ *  CI that `hygiene:check` would have caught locally. Naming the commands
+ *  makes each gate a receipt — the exit line goes into the handoff's verified
+ *  list, and a gate the child could not run is unproven, never claimed clean. */
+export const FAST_GATES_BEFORE_PUSH =
+  "The fast gates, before every push: `npx prettier --check` on the changed files, `npm run hygiene:check`, " +
+  "`npm run specs:check`, and `tsc --noEmit` on the touched project under `NODE_OPTIONS=--max-old-space-size=6144`. " +
+  "Paste each command's exit line into the handoff's verified list; a gate you could not run goes under unproven " +
+  "and is never claimed clean.";
+
 function renderFirstInstruction(rebase: ChildContract["rebase"]): string {
   const branch = rebase.branch ? `\`${rebase.branch}\`` : "the unit's branch";
   const onto = rebase.onto ? `\`${rebase.onto}\`` : "the merged parent";
   return (
     `Rebase ${branch} onto ${onto} before any other work — the parent unit has merged and the base has moved; ` +
     `the only writes are your own on that branch. A conflict ends the unit: report it as the handoff and stop. ` +
-    `Push the branch as soon as the change exists and its cheapest proving checks pass — before the project's ` +
+    `Push the branch as soon as the change exists and the fast gates pass — before the project's ` +
     `full verification, which runs after that push with any fix as a further commit; an unpushed tree does not ` +
-    `survive the run's end. Right before each push, fetch ${onto} again and rebase once more if it moved while ` +
-    `you worked, so the pull request is not born conflicting. At the wind-down note, commit and push what compiles, ` +
-    `say what does not, then answer. ${TIMEOUT_ON_LONG_COMMANDS}`
+    `survive the run's end. ${FAST_GATES_BEFORE_PUSH} Right before each push, fetch ${onto} again and rebase ` +
+    `once more if it moved while you worked, so the pull request is not born conflicting. At the wind-down note, ` +
+    `commit and push what compiles, say what does not, then answer. ${TIMEOUT_ON_LONG_COMMANDS}`
   );
 }
 

package/dist/assets/src/core/ship/coordinator.ts

@@ -453,6 +453,13 @@ export type CoordinatorAction =
        *  submitted description when the record holds one) instead of answering
        *  `none` over stranded work. */
       recover?: { runId: string };
+      /** The pull request the machine has adopted (`state.pr`), when it holds
+       *  one: the child may have worked that pull request's own head branch,
+       *  not the unit's (issue 1799), so when nothing heads the unit's branch
+       *  the bot follows this number and answers the pull request's LIVE state
+       *  — open at a fresh head, merged, or closed (`prClosed`) — never `none`
+       *  over a record fact written minutes earlier. */
+      pr?: number;
     }
   | { type: "merge"; step: string; prNumber: number; headSha: string }
   /** Wait for the intake's checks-settled event at the approved head, bounded as the fallback. */
@@ -509,6 +516,10 @@ export type PrCheck =
        *  naming where the scope landed is the `already_landed` ending
        *  (agent-ship item 12); absent, the fact is unknown and never claimed. */
       aheadOfBase?: number;
+      /** The action's followed pull request (`pr`) was verified CLOSED
+       *  unmerged: the machine must not brief a review round on it. Absent when
+       *  nothing was followed or the follow could not read the pull request. */
+      prClosed?: boolean;
     }
   | {
       state: "open";
@@ -704,6 +715,10 @@ export interface UnitPipelineInput {
    *  pre-check finds the open pull request still at exactly this head, there is
    *  nothing to code and the attempt starts at the review round. */
   lastPush?: string;
+  /** The runs page base (`<PUBLIC_BASE_URL>/runs`), the plan route's answer:
+   *  the report's pointer at a child's write-up links its run page with it and
+   *  names the run id without it — the machine never reads an environment. */
+  runPageBase?: string;
 }
 
 type Phase =
@@ -935,6 +950,9 @@ export function nextAction(s: UnitPipelineState): CoordinatorAction {
         type: "pr-check",
         step: `${roundStep(s, p.round)}/pr-check`,
         ...(p.dead !== undefined ? { recover: { runId: p.runId } } : {}),
+        // The adopted pull request rides the check so the bot can follow it
+        // when nothing heads the unit's branch (issue 1799).
+        ...(s.pr !== undefined ? { pr: s.pr.number } : {}),
       };
     case "merge":
       return { type: "merge", step: `${unit}/merge/${p.n}`, prNumber: p.pr.number, headSha: p.headSha };
@@ -1286,6 +1304,22 @@ function settlePrCheck(s: UnitPipelineState, phase: Extract<Phase, { at: "pr-che
         [roundNote(round, "aborted")],
       );
     }
+    // Nothing heads the unit's branch, but the machine holds the round's pull
+    // request (`pr_opened` off the child's record, or an earlier round's
+    // adoption): the child worked on that pull request's own head branch, not
+    // the unit's — a re-issued task in the thread of an existing pull request
+    // (issue 1799). The round HAS its pull request — at round 0 and after a
+    // findings step alike, since the same child keeps repushing that branch
+    // through every later round — so it carries on to the (re-)review at the
+    // head the child pushed through the shared open settle (a findings step
+    // that repushed nothing keeps its abort, item 7), instead of the unit
+    // ending "no pull request" or "closed out from under" over work that
+    // stands. Never over a followed answer that VERIFIED the pull request
+    // closed (`prClosed`): a review briefed on a closed pull request reviews
+    // nothing, so the endings below stand — and are then truthful. Dead
+    // children never reach here: their endings are above.
+    if (s.pr !== undefined && pr.prClosed !== true)
+      return roundOnOpenPr(s, phase, { prNumber: s.pr.number, url: s.pr.url });
     if (round.index === 0) {
       // The scope already landed (agent-ship item 12): the child's handoff
       // names where, and the branch carries no commits over the base — two
@@ -1370,6 +1404,18 @@ function settlePrCheck(s: UnitPipelineState, phase: Extract<Phase, { at: "pr-che
       [roundNote(round, "aborted")],
     );
   }
+  return roundOnOpenPr(s, phase, pr);
+}
+
+/** The round carried on its open pull request: the pr-check's `open` answer,
+ *  or — when nothing heads the unit's branch — the pull request the machine
+ *  already holds (issue 1799), at the head the child pushed. */
+function roundOnOpenPr(
+  s: UnitPipelineState,
+  phase: Extract<Phase, { at: "pr-check" }>,
+  pr: { prNumber: number; url: string; headSha?: string },
+): Transition {
+  const { round } = phase;
   const head = pr.headSha ?? phase.childHead;
   const next: UnitPipelineState = { ...s, pr: { number: pr.prNumber, url: pr.url } };
   if (round.kind === "findings") {
@@ -1647,6 +1693,18 @@ function dispositionFor(s: UnitPipelineState, finding: Finding, round: number):
   return undefined;
 }
 
+/** Where a child's write-up lives, for the report's pointer (agent-ship item
+ *  12): the child's own message in the thread is the single copy of the detail
+ *  — posted moments before the unit-end — so the report points at it instead
+ *  of repeating it: the run page when the plan named the base, the run id
+ *  otherwise. Undefined when no run is known to point at. */
+function writeUpPointer(s: UnitPipelineState, kind: RoundKind, runId: string | undefined): string | undefined {
+  if (runId === undefined) return undefined;
+  const base = s.input.runPageBase;
+  const at = base !== undefined ? `${base.replace(/\/+$/, "")}/${encodeURIComponent(runId)}` : `run ${runId}`;
+  return `The ${presetOf(kind)} child's write-up is its own message above in this thread — the single copy of the detail (${at}).`;
+}
+
 /** How the budget went, in the card's words: coding, review, waiting minutes. */
 function budgetSplitLine(spent: ShipBudgetSpent, maxMinutes: number): string {
   const min = (ms: number) => Math.round(ms / MIN);
@@ -1815,7 +1873,11 @@ export function renderUnitReport(s: UnitPipelineState, facts?: MergeReadyFacts):
     case "stopped":
       return join([
         `${e.mode === "hard" ? "⛔" : "⏹"} Ship stopped by operator (${e.mode} stop) after ${rounds}.${prLine}`,
-        e.finalReply,
+        writeUpPointer(
+          s,
+          e.round.kind,
+          e.round.kind === "review" ? s.reviewRunByRound[e.round.index] : s.lastCodingRunId,
+        ),
         e.postedReview
           ? "ℹ️ A changes-requested review was posted this round before the stop — its findings stand on the PR."
           : undefined,
@@ -1823,22 +1885,26 @@ export function renderUnitReport(s: UnitPipelineState, facts?: MergeReadyFacts):
       ]);
     case "aborted":
       return join([
-        e.finalReply,
         e.reason,
+        writeUpPointer(
+          s,
+          e.round?.kind ?? "coding",
+          e.round?.kind === "review" ? s.reviewRunByRound[e.round.index] : s.lastCodingRunId,
+        ),
         e.renewal !== undefined ? `🔁 Not renewed: ${e.renewal.line}.` : undefined,
         `⚠️ Ship aborted after ${rounds}.`,
         reissue,
       ]);
     case "continued":
       return join([
-        e.finalReply,
+        writeUpPointer(s, e.round.kind, e.runId),
         `🔁 Segment ${e.segment - 1} ended at its lease with the unit unfinished — ${e.line}. Segment ${e.segment} opens in this thread${e.from !== undefined ? ` from \`${e.from.slice(0, 7)}\`` : ""} under a fresh ${s.input.caps.maxMinutes}-minute lease, with this segment's write-up as its request; ${e.renewalsLeft} renewal${e.renewalsLeft === 1 ? "" : "s"} remain${e.spendUsd !== null ? `, $${e.spendUsd.toFixed(2)} spent so far` : ""}.`,
         budgetSplitLine(e.spent, s.input.caps.maxMinutes),
       ]);
     case "no_verdict":
       return join([
         `⚠️ Review round ${e.round.index} ended without a submitted verdict (budget, refusal, or stop) — ship never converts that into a request for changes, so no findings step ran.`,
-        e.finalReply ? `Review round's final message:\n\n${e.finalReply}` : undefined,
+        writeUpPointer(s, e.round.kind, s.reviewRunByRound[e.round.index]),
         `⚠️ Ship aborted after ${rounds}.`,
         reissue,
       ]);