@coreplane/switchboard 1.252.0 → 1.253.0

package/dist/assets/config/config.example.yaml

@@ -167,6 +167,12 @@ defaults:
 #     verbosity: verbose          # hear every acknowledgement of what the bot does for you
 #     harness:
 #       coding: opencode
+#     # The person's GitHub author binding (record 0062; authorization.md item 18):
+#     # the login their commits are authored as. A bare login here is resolved to
+#     # { login, id } once at first use; `config set user --user <id> --github
+#     # <login>` (identity:write holders) stores the pair. Never set by the person
+#     # themselves; `config clear me` keeps it. One login/id binds one person.
+#     github: octocat
 
 # Authorization (docs/reference/specs/authorization.md item 9, docs/reference/authorization.md):
 # two blocks. `restrict` names what is CLOSED unless granted — an agent listed
@@ -388,6 +394,8 @@ workspaceDir: ./workspaces
 # ship:
 #   maxRounds: 3      # review rounds per unit
 #   maxMinutes: 240   # the ship preset's wall-clock budget in minutes (the registry's default)
+#   idleDays: 0       # days a ship unit idles instead of ending (record 0051): 0–365, 0 = today's
+#                     # endings; also per channel/user (`channels.<id>.ship.idleDays`), user > channel > org
 
 # Which harness each preset's runs are driven by, deployment-wide
 # (docs/reference/specs/harness.md item 8): a mapping of preset to a harness's
@@ -454,10 +462,16 @@ workspaceDir: ./workspaces
 # `tool` (default) forces a call to the router's `route` tool, whose schema is
 # the answer, so prose cannot occur; `text` is the one-JSON-object text contract
 # alone — set it for a provider or model that cannot take a forced tool call.
+# `operator` is the one door's flag (routing-and-config item 29): `off`
+# (default) — the operator never runs; `shadow` — one operator turn per
+# admitted chat event, ahead of stage A, its decision written beside the
+# routed request in the run store and nothing run from it; `on` — the
+# operator's decision is what runs. `shadow` runs even under `auto: false`.
 # routing:
 #   auto: false
 #   model: anthropic/claude-haiku-4-5
 #   answer: text
+#   operator: shadow
 
 # The thread-reply intake gate (docs/decisions/0058-a-thread-reply-is-read-before-it-is-answered-intake-decides-whether-the-bot-was-addressed.md;
 # docs/reference/specs/routing-and-config.md item 27). How an unmentioned reply
@@ -519,6 +533,16 @@ workspaceDir: ./workspaces
 #       cacheRead: 0.125                       #   never $0, on the costs page and on a run's own page
 #       cacheWrite: 0
 
+# Run metrics (docs/reference/specs/run-metrics.md). Optional. The Analytics Engine
+# dataset every finished run's point lands in — the SAME name the deployment
+# profile's `metrics.dataset` binds on the state Worker as RUN_METRICS (the bot
+# warns at boot when the two differ; neither side refuses to start). The reader
+# over the dataset — `metrics trend` and the /metrics page, behind the `metrics`
+# capability — is later work of the same decision; until it lands, only `dataset`
+# is read, for that boot comparison.
+# metrics:
+#   dataset: switchboard_runs
+
 # Delivery indicators: GET /delivery and `delivery report` (docs/reference/specs/delivery.md).
 # Optional. Needs a GitHub credential (the App triple or GH_TOKEN); read-only on GitHub.
 # delivery:

package/dist/assets/deploy/cloudflare-memory/runMetricsSink.ts

@@ -0,0 +1,31 @@
+import type { RunMetricsPoint } from "../../src/core/runMetrics.ts";
+
+// The run-metrics sink (docs/reference/specs/run-metrics.md): where the
+// RunHistoryDO writes the one point of a run whose row turned final, after the
+// record's commit. Two implementations behind one seam (AGENTS.md invariant 2):
+// the Workers Analytics Engine dataset when the Worker is deployed with the
+// optional `RUN_METRICS` binding, the null sink otherwise — so a Worker without
+// the binding behaves byte-identically, the same shape as `SHIP_COORDINATOR?`.
+// The write is advisory on the caller's side too: one try, one console.warn,
+// never a failed put or finish.
+
+export interface RunMetricsSink {
+  write(point: RunMetricsPoint): void;
+}
+
+/** The dataset the deploy bound: `writeDataPoint` is synchronous and does not
+ *  throw on a platform-side drop; the caller's try covers a missing or
+ *  misconfigured binding. */
+export class AnalyticsEngineSink implements RunMetricsSink {
+  constructor(private readonly dataset: AnalyticsEngineDataset) {}
+  write(point: RunMetricsPoint): void {
+    this.dataset.writeDataPoint({ indexes: point.indexes, blobs: point.blobs, doubles: point.doubles });
+  }
+}
+
+/** No binding: points are dropped — the off state. */
+export class NullSink implements RunMetricsSink {
+  write(): void {
+    // nothing is written without the binding
+  }
+}

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -119,6 +119,8 @@ import {
   type McpTicketState,
   type SealedCredential,
 } from "../../src/mcp/registry.ts";
+import { isRunMetricsPoint, pointTurnsFinal, type RunMetricsPoint } from "../../src/core/runMetrics.ts";
+import { AnalyticsEngineSink, NullSink, type RunMetricsSink } from "./runMetricsSink.ts";
 import { injectedBuildStamp } from "../../src/deploy/buildStamp.ts";
 import { systemClock } from "../../src/core/trace/clock.ts";
 import { createTracer } from "../../src/core/trace/tracer.ts";
@@ -148,7 +150,7 @@ const traceSinks = [workerLogSink((line) => console.log(line))];
 //
 // Route surface (JSON in/out; bearer MEMORY_TOKEN on everything but /healthz):
 //   POST /retrieve {scopeKey, query, limit} → {records: MemoryRecord[]}
-//   POST /write    {scopeKey, records: MemoryCandidate[]} → {ok, inserted, deduped, superseded}
+//   POST /write    {scopeKey, records: MemoryCandidate[]} → {ok, inserted, deduped, restated, superseded, evicted}
 //   POST /sweep    {scopeKey, dryRun?} → {ok, swept} (+ ids under dryRun — the marked rows, flipped to `swept`)
 //   GET  /healthz  → {ok:true}  (deploy wake ping; touches no DO)
 // Scheduled-firing routes (the record behind the /runs Scheduled panel;
@@ -161,7 +163,7 @@ const traceSinks = [workerLogSink((line) => console.log(line))];
 // store key, owning the retention policy. Same bearer; /runs/put has its own 2 MiB
 // body fence (a record is budgeted to 1.5 MiB upstream), every other route
 // keeps the 512 KB one.
-//   POST /runs/put    {storeKey, record, policy?, policyUpdatedAt?} → {ok, retained, stored, rewritten}
+//   POST /runs/put    {storeKey, record, policy?, policyUpdatedAt?, point?} → {ok, retained, stored, rewritten}
 //   POST /runs/get    {storeKey, id} → {record: RunRecord | null}      (unknown/expired: null, 200)
 //   POST /runs/list   {storeKey, limit?, before?, beforeId?, sinceMs?, agent?, channel?, threadKey?, parentRunId?}
 //                       → {items: RunListItem[], nextBefore?: {finishedAt, id}}   (cursor = the last row's list key)
@@ -198,6 +200,14 @@ export interface Env {
    *  binding is a cross-script one, and the class must exist on the bot before
    *  the state Worker may name it), and a finish then commits with no event. */
   SHIP_COORDINATOR?: Workflow;
+  /** The run-metrics dataset (docs/reference/specs/run-metrics.md): where the
+   *  RunHistoryDO writes one point per run whose row turned final. Optional
+   *  like SHIP_COORDINATOR: this Worker deploys without it and every answer is
+   *  byte-identical — the NullSink swallows the points. */
+  RUN_METRICS?: AnalyticsEngineDataset;
+  /** The dataset's name, rendered beside the binding, so `/healthz` can answer
+   *  `runMetrics:<dataset>` and the bot's boot probe can compare names. */
+  RUN_METRICS_DATASET?: string;
   MEMORY_TOKEN?: string;
 }
 
@@ -381,8 +391,8 @@ export class MemoryDO extends DurableObject<Env> {
     scopeKey: string,
     candidates: MemoryCandidate[],
     cap: number = DEFAULT_SCOPE_CAP,
-  ): Promise<{ inserted: number; deduped: number; superseded: number; evicted: number }> {
-    const counts = { inserted: 0, deduped: 0, superseded: 0, evicted: 0 };
+  ): Promise<{ inserted: number; deduped: number; restated: number; superseded: number; evicted: number }> {
+    const counts = { inserted: 0, deduped: 0, restated: 0, superseded: 0, evicted: 0 };
     if (candidates.length === 0) return counts;
     this.ctx.storage.transactionSync(() => {
       let seq = this.sql.exec<{ next: number }>(`SELECT COALESCE(MAX(seq), -1) + 1 AS next FROM records`).one().next;
@@ -400,18 +410,41 @@ export class MemoryDO extends DurableObject<Env> {
         // own TRUTHINESS test: `supersedes: ""` passes validation but means NO
         // supersede to the engine, so it must dedup against the norm pool —
         // an `!== undefined` branch here would hand it an empty pool and
-        // insert a duplicate active row.
-        const relevant = (
-          cand.supersedes
-            ? this.sql.exec<Row>(`SELECT * FROM records WHERE id = ? AND status = 'active'`, cand.supersedes)
-            : this.sql.exec<Row>(
-                `SELECT * FROM records WHERE status = 'active' AND norm = ? ORDER BY seq`,
-                normalizeText(cand.text),
+        // insert a duplicate active row. A `restates` id is looked up first
+        // (the restate target); when it misses — not active, or another
+        // scope's id, which this DO simply doesn't hold — the candidate takes
+        // today's pool, so planWrite falls through to dedup-or-insert.
+        const restatePool = cand.restates
+          ? this.sql
+              .exec<Row>(`SELECT * FROM records WHERE id = ? AND status = 'active'`, cand.restates)
+              .toArray()
+              .map(toRecord)
+          : [];
+        const relevant =
+          restatePool.length > 0
+            ? restatePool
+            : (cand.supersedes
+                ? this.sql.exec<Row>(`SELECT * FROM records WHERE id = ? AND status = 'active'`, cand.supersedes)
+                : this.sql.exec<Row>(
+                    `SELECT * FROM records WHERE status = 'active' AND norm = ? ORDER BY seq`,
+                    normalizeText(cand.text),
+                  )
               )
-        )
-          .toArray()
-          .map(toRecord);
+                .toArray()
+                .map(toRecord);
         const plan = planWrite(relevant, cand, (c) => mintRecord(scopeKey, seq++, now, c));
+        if (plan.action === "restate") {
+          // The shown record is refreshed in place; COALESCE keeps the stored
+          // confidence when the plan carries none (neither side had a value).
+          this.sql.exec(
+            `UPDATE records SET use_count = use_count + 1, last_used_at = ?, confidence = COALESCE(?, confidence) WHERE id = ?`,
+            now,
+            plan.confidence ?? null,
+            plan.target.id,
+          );
+          counts.restated++;
+          continue;
+        }
         if (plan.action === "dedup") {
           this.sql.exec(`UPDATE records SET use_count = use_count + 1 WHERE id = ?`, plan.target.id);
           counts.deduped++;
@@ -1485,10 +1518,15 @@ type HeartbeatAnswer = FenceResult & { stop?: StopMode | null; phase?: LivePhase
 
 export class RunHistoryDO extends DurableObject<Env> {
   private readonly sql: SqlStorage;
+  /** Where a turned-final run's point goes (run-metrics.md): the Analytics
+   *  Engine dataset when the deploy bound one, the NullSink otherwise —
+   *  selected once at construction, the `SHIP_COORDINATOR?` shape. */
+  private readonly metrics: RunMetricsSink;
 
   constructor(ctx: DurableObjectState, env: Env) {
     super(ctx, env);
     this.sql = ctx.storage.sql;
+    this.metrics = env.RUN_METRICS !== undefined ? new AnalyticsEngineSink(env.RUN_METRICS) : new NullSink();
     // Idempotent schema. `runs` carries the listing columns plus the record
     // minus its events as JSON (`summary_json`, what `list` returns); events
     // live one per row keyed (run_id, seq) so a 5000-event run is paged, never
@@ -2063,8 +2101,10 @@ export class RunHistoryDO extends DurableObject<Env> {
     gen: string,
     record: RunRecord,
     proposal?: RunPolicyProposal,
+    point?: RunMetricsPoint,
   ): Promise<FenceResult & { stored?: boolean; event?: RunFinishedSend["kind"] }> {
     let out: FenceResult & { stored?: boolean } = { ok: true };
+    let turnedFinal = false;
     this.ctx.storage.transactionSync(() => {
       const fence = checkFence(this.liveRow(runId), gen);
       if (!fence.ok) {
@@ -2073,9 +2113,14 @@ export class RunHistoryDO extends DurableObject<Env> {
       }
       const put = this.upsertInTransaction(record, proposal);
       this.deleteLiveRows([runId]);
+      turnedFinal = put.turnedFinal;
       out = { ok: true, stored: put.stored };
     });
     if (!out.ok) return out;
+    // The point after the commit, never inside it (`sendRunFinished`'s placement):
+    // the finish usually replaces the start tombstone, so this is where most
+    // runs are counted (run-metrics.md item 2).
+    this.writeMetricsPoint(runId, point, turnedFinal && out.stored === true);
     if ((await this.ctx.storage.getAlarm()) === null)
       await this.ctx.storage.setAlarm(systemClock() + RUN_SWEEP_INTERVAL_MS);
     await this.refreshSessionBytes(record.session?.key);
@@ -2338,15 +2383,21 @@ export class RunHistoryDO extends DurableObject<Env> {
    *  when the stored version changed (`event_count`, `finished_at`, `bytes`) —
    *  an identical retry is a no-op on `run_events`. `stored: false` when the
    *  record itself fell outside the (possibly just-updated) policy: it was
-   *  written and deleted in the same transaction, so nothing of it remains. */
+   *  written and deleted in the same transaction, so nothing of it remains.
+   *  `point` is the record's metrics point, computed by the client
+   *  (run-metrics.md): written to the sink AFTER the commit, only when the row
+   *  turned final and the record was stored — `turnedFinal` stays internal (the
+   *  route strips it), so the wire answer is exactly the shape it always was. */
   async put(
     record: RunRecord,
     proposal?: RunPolicyProposal,
-  ): Promise<{ ok: true; retained: number; stored: boolean; rewritten: boolean }> {
-    let result = { ok: true as const, retained: 0, stored: false, rewritten: false };
+    point?: RunMetricsPoint,
+  ): Promise<{ ok: true; retained: number; stored: boolean; rewritten: boolean; turnedFinal: boolean }> {
+    let result = { ok: true as const, retained: 0, stored: false, rewritten: false, turnedFinal: false };
     this.ctx.storage.transactionSync(() => {
       result = this.upsertInTransaction(record, proposal);
     });
+    this.writeMetricsPoint(record.id, point, result.turnedFinal && result.stored);
     // A coordinator child closed OUTSIDE the ledger's finish — the run loop or
     // a reclaim writing an `interrupted` record, the pi harness's typed restart,
     // a resume abandoning a lost workspace — still wakes its parent's wait at
@@ -2370,7 +2421,7 @@ export class RunHistoryDO extends DurableObject<Env> {
   private upsertInTransaction(
     record: RunRecord,
     proposal?: RunPolicyProposal,
-  ): { ok: true; retained: number; stored: boolean; rewritten: boolean } {
+  ): { ok: true; retained: number; stored: boolean; rewritten: boolean; turnedFinal: boolean } {
     {
       const now = systemClock();
       const policy = proposal ? this.applyProposal(proposal, now).policy : this.policyState().policy;
@@ -2387,11 +2438,29 @@ export class RunHistoryDO extends DurableObject<Env> {
       const { events, ...summary } = stored;
       const bytes = utf8ByteLength(JSON.stringify(stored));
       const existing = this.sql
-        .exec<{ event_count: number; finished_at: number; bytes: number }>(
-          `SELECT event_count, finished_at, bytes FROM runs WHERE run_id = ?`,
+        .exec<{ event_count: number; finished_at: number; bytes: number; summary_json: string }>(
+          `SELECT event_count, finished_at, bytes, summary_json FROM runs WHERE run_id = ?`,
           record.id,
         )
         .toArray()[0];
+      // The one field of the stored summary the emission rule reads (run-metrics.md
+      // item 2): the row's `provisional`, parsed alone — never deserialized whole.
+      const existingProvisional = existing !== undefined && summaryIsProvisional(existing.summary_json);
+      const turnedFinal = pointTurnsFinal(
+        existing !== undefined ? { provisional: existingProvisional } : undefined,
+        stored,
+      );
+      // A provisional record never overwrites a final row (run-history.md item 27;
+      // run-metrics.md item 3): a start tombstone sitting in retry backoff or a
+      // drain upgrade racing a fast finish would otherwise land after the finish
+      // record, overwrite it with `interrupted` — and let the run's point be
+      // written twice when a later final write turned the row "final" again.
+      // Answered as stored, with nothing written: the row, its events and the
+      // sessions table stay exactly as the final write left them.
+      if (stored.provisional === true && existing !== undefined && !existingProvisional) {
+        const retained = this.sql.exec<{ n: number }>(`SELECT COUNT(*) AS n FROM runs`).one().n;
+        return { ok: true as const, retained, stored: true, rewritten: false, turnedFinal: false };
+      }
       const unchanged =
         existing !== undefined &&
         sameStoredVersion(
@@ -2471,10 +2540,25 @@ export class RunHistoryDO extends DurableObject<Env> {
         retained: kept.size,
         stored: kept.has(record.id),
         rewritten: existing !== undefined && !unchanged,
+        turnedFinal,
       };
     }
   }
 
+  /** One point per run whose row turned final, AFTER the commit (run-metrics.md
+   *  item 2) — advisory: a throwing sink leaves the answer exactly as a
+   *  recording one would, and says so in one warn line with the run id and the
+   *  error's constructor name, never the point's contents. */
+  private writeMetricsPoint(runId: string, point: RunMetricsPoint | undefined, turnedFinal: boolean): void {
+    if (point === undefined || !turnedFinal) return;
+    try {
+      this.metrics.write(point);
+    } catch (err) {
+      const kind = err instanceof Error ? err.constructor.name : "Error";
+      console.warn(`[runs/metrics] ${runId} point not written: ${kind}`);
+    }
+  }
+
   /** Remove a run and its events. Returns whether a run row existed. */
   async delete(id: string): Promise<boolean> {
     let deleted = false;
@@ -2924,6 +3008,17 @@ function parseSummary(row: RunRow): Omit<RunRecord, "events"> | null {
   }
 }
 
+/** The one field of a stored row's summary the emission rule reads: whether the
+ *  row is a provisional tombstone. Deliberately not a full `RunRecord` parse
+ *  (run-metrics.md item 2) — this runs inside every upsert's transaction. */
+function summaryIsProvisional(summaryJson: string): boolean {
+  try {
+    return (JSON.parse(summaryJson) as { provisional?: unknown }).provisional === true;
+  } catch {
+    return false;
+  }
+}
+
 function parseRunId(v: unknown): Validated<string> {
   if (typeof v !== "string" || !RUN_ID_PATTERN.test(v)) return invalid("id must match ^[A-Za-z0-9_-]{1,64}$");
   return { ok: true, value: v };
@@ -2939,16 +3034,24 @@ function parsePositiveInt(v: unknown, name: string, max: number): Validated<numb
   return { ok: true, value: v };
 }
 
-function parseRunPut(body: unknown): Validated<{ storeKey: string; record: RunRecord; proposal?: RunPolicyProposal }> {
+function parseRunPut(
+  body: unknown,
+): Validated<{ storeKey: string; record: RunRecord; proposal?: RunPolicyProposal; point?: RunMetricsPoint }> {
   if (typeof body !== "object" || body === null) return invalid("body must be a JSON object");
   const b = body as Record<string, unknown>;
   const key = parseStoreKey(b);
   if (!key.ok) return key;
   if (!isRunRecord(b.record)) return invalid("record must be a RunRecord");
-  const out: { storeKey: string; record: RunRecord; proposal?: RunPolicyProposal } = {
+  const out: { storeKey: string; record: RunRecord; proposal?: RunPolicyProposal; point?: RunMetricsPoint } = {
     storeKey: key.value,
     record: b.record,
   };
+  // The record's metrics point (run-metrics.md item 1), validated at the door
+  // like everything else that reaches storage.
+  if (b.point !== undefined) {
+    if (!isRunMetricsPoint(b.point)) return invalid("point must be a RunMetricsPoint");
+    out.point = b.point;
+  }
   if (b.policy !== undefined) {
     if (typeof b.policy !== "object" || b.policy === null) return invalid("policy must be an object");
     const p = b.policy as Record<string, unknown>;
@@ -3259,6 +3362,11 @@ function parseCandidate(v: unknown, i: number): Validated<MemoryCandidate> {
       return invalid(`${at}.supersedes must be a string`);
     out.supersedes = c.supersedes;
   }
+  if (c.restates !== undefined) {
+    if (typeof c.restates !== "string" || c.restates.length > MAX_KEY_CHARS)
+      return invalid(`${at}.restates must be a string`);
+    out.restates = c.restates;
+  }
   return { ok: true, value: out };
 }
 
@@ -4302,7 +4410,7 @@ async function handleLedger(pathname: string, body: unknown, env: Env): Promise<
     const parsed = parseRunPut({ ...b, storeKey: key.value });
     if (!parsed.ok) return json({ error: parsed.error }, 400);
     if (parsed.value.record.id !== runId.value) return json({ error: "record.id must equal runId" }, 400);
-    const r = await stub.finish(runId.value, g.value, parsed.value.record, parsed.value.proposal);
+    const r = await stub.finish(runId.value, g.value, parsed.value.record, parsed.value.proposal, parsed.value.point);
     console.log(
       `[runs/finish] ${key.value} ${runId.value} ok=${r.ok}${r.ok ? ` stored=${r.stored} event=${r.event}` : ` ${r.reason}`}`,
     );
@@ -4319,8 +4427,10 @@ async function handleRuns(pathname: string, body: unknown, env: Env): Promise<Re
   if (pathname === "/runs/put") {
     const parsed = parseRunPut(body);
     if (!parsed.ok) return json({ error: parsed.error }, 400);
-    const { storeKey, record, proposal } = parsed.value;
-    const result = await stub(storeKey).put(record, proposal);
+    const { storeKey, record, proposal, point } = parsed.value;
+    // `turnedFinal` stays internal: the wire answer is exactly the shape it
+    // always was, binding or no binding (run-metrics.md item 4).
+    const { turnedFinal: _turnedFinal, ...result } = await stub(storeKey).put(record, proposal, point);
     console.log(
       `[runs/put] ${storeKey} <- ${record.id} (${record.storedEventCount} events, stored=${result.stored}, ${result.retained} retained)`,
     );
@@ -4404,11 +4514,21 @@ interface Admission {
   authorized: boolean;
 }
 
+/** What this deploy carries, for the bot's boot probe: the fixed route set,
+ *  plus `runMetrics:<dataset>` when the deploy bound the Analytics Engine
+ *  dataset (run-metrics.md item 5) — the name from the `RUN_METRICS_DATASET`
+ *  var rendered beside the binding, so the probe can compare it to the bot's. */
+export function featuresOf(env: Pick<Env, "RUN_METRICS" | "RUN_METRICS_DATASET">): string[] {
+  const features = ["memory", "schedules", "runs", "config", "delivery", "costs"];
+  if (env.RUN_METRICS !== undefined) features.push(`runMetrics:${env.RUN_METRICS_DATASET ?? "unknown"}`);
+  return features;
+}
+
 /** Every request, once `fetch` has decided whether it gets a root. */
 async function handleRequest(request: Request, env: Env, admission: Admission): Promise<Response> {
   const url = new URL(request.url);
   if (url.pathname === "/healthz" && request.method === "GET")
-    return json({ ok: true, build: BUILD, features: ["memory", "schedules", "runs", "config", "delivery", "costs"] });
+    return json({ ok: true, build: BUILD, features: featuresOf(env) });
   if (!admission.known) return json({ error: "not found" }, 404);
   if (request.method !== "POST") return json({ error: "method not allowed" }, 405);
   if (!admission.authorized) return json({ error: "unauthorized" }, 401);

package/dist/assets/deploy/cloudflare-memory/wrangler.template.jsonc

@@ -66,6 +66,18 @@
       "script_name": "{{bot.script}}"
     }
   ],
+  // {{#if metrics}}
+  // The run-metrics dataset (docs/reference/specs/run-metrics.md): where RunHistoryDO
+  // writes a turned-final run's point, bound only when the deployment profile names a
+  // dataset (`metrics.dataset`) — nothing is created ahead of the deploy; the platform
+  // creates the dataset on first write. Without it the Worker deploys without the
+  // binding and writes no points.
+  "analytics_engine_datasets": [{ "binding": "RUN_METRICS", "dataset": "{{metrics.dataset}}" }],
+  // The dataset's name beside its binding (rendered together): /healthz `features`
+  // says `runMetrics:<dataset>` from it, so the bot's boot probe can compare the
+  // name its own config carries with the one this deploy bound.
+  "vars": { "RUN_METRICS_DATASET": "{{metrics.dataset}}" },
+  // {{/if}}
   // SQLite-backed DOs (durable across restarts — AGENTS.md invariant 6).
   "migrations": [
     { "tag": "v1", "new_sqlite_classes": ["MemoryDO"] },

package/dist/assets/deploy/profile.example.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "The deployment profile: where THIS installation runs. Copy to deploy/profile.json and fill it in (or run `switchboard deploy init`). The account is your Cloudflare account id; every hostname must be under `zone`, a zone in that account, unless the Worker names its own `zone` (also in the account); `workers.bot` is the one required Worker — leave `memory`, `resident` or `sandbox` out and `deploy plan` has no step for them (a bot-only profile is a one-step plan; without `memory` the config is not pushed anywhere). The project's docs site is not a Worker of an installation: it is the project's website, deployed by the project's own CI from project.json, so there is no `docs` entry. `configSource` is where `deploy all` reads the bot's runtime config from before building the image — a path, `github://owner/repo/path@ref` (needs CONFIG_REPO_TOKEN), or `op://Vault/Item/field` (needs OP_SERVICE_ACCOUNT_TOKEN); `secretsSource` is where `secrets put` reads values from — a directory of <NAME> files (the default when absent) or `op://Vault/Item`. `images` is where the bot, resident and sandbox container images come from: `registry` — the release's published images, copied once per version into your account registry by `deploy all` itself (or `deploy images` ahead of it) over HTTPS and referenced from there — no Docker anywhere, a Cloudflare API token with Containers Edit in CLOUDFLARE_API_TOKEN for the copy (an installation deploying published images; what `init` writes from the published package); or `build` (the default when absent) — each Worker's Dockerfile, built by wrangler where `deploy all` runs (a checkout; the project's own production). `artifacts` (optional) names the R2 bucket a run's files move through (docs/reference/specs/execution.md item 20): with it the bot Worker binds the bucket and `deploy` creates it before the upload (the credential then needs Workers R2 Storage: Edit); the bot's runtime config `artifacts.r2.bucket` must say the same name. `deploy plan` reads this example when no profile exists; `deploy all` refuses it.",
+  "$comment": "The deployment profile: where THIS installation runs. Copy to deploy/profile.json and fill it in (or run `switchboard deploy init`). The account is your Cloudflare account id; every hostname must be under `zone`, a zone in that account, unless the Worker names its own `zone` (also in the account); `workers.bot` is the one required Worker — leave `memory`, `resident` or `sandbox` out and `deploy plan` has no step for them (a bot-only profile is a one-step plan; without `memory` the config is not pushed anywhere). The project's docs site is not a Worker of an installation: it is the project's website, deployed by the project's own CI from project.json, so there is no `docs` entry. `configSource` is where `deploy all` reads the bot's runtime config from before building the image — a path, `github://owner/repo/path@ref` (needs CONFIG_REPO_TOKEN), or `op://Vault/Item/field` (needs OP_SERVICE_ACCOUNT_TOKEN); `secretsSource` is where `secrets put` reads values from — a directory of <NAME> files (the default when absent) or `op://Vault/Item`. `images` is where the bot, resident and sandbox container images come from: `registry` — the release's published images, copied once per version into your account registry by `deploy all` itself (or `deploy images` ahead of it) over HTTPS and referenced from there — no Docker anywhere, a Cloudflare API token with Containers Edit in CLOUDFLARE_API_TOKEN for the copy (an installation deploying published images; what `init` writes from the published package); or `build` (the default when absent) — each Worker's Dockerfile, built by wrangler where `deploy all` runs (a checkout; the project's own production). `artifacts` (optional) names the R2 bucket a run's files move through (docs/reference/specs/execution.md item 20): with it the bot Worker binds the bucket and `deploy` creates it before the upload (the credential then needs Workers R2 Storage: Edit); the bot's runtime config `artifacts.r2.bucket` must say the same name. `metrics` (optional) names the Analytics Engine dataset every finished run's point is written to (docs/reference/specs/run-metrics.md): the state Worker's template then binds it as `RUN_METRICS` with the name beside it in `RUN_METRICS_DATASET` — nothing is created ahead of the deploy, the platform creates the dataset on first write — and the bot's runtime config `metrics.dataset` must say the same name (the bot warns at boot when the two differ). `deploy plan` reads this example when no profile exists; `deploy all` refuses it.",
   "account": "00000000000000000000000000000000",
   "zone": "example.com",
   "workers": {

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.252.0",
+  "version": "1.253.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.252.0",
+      "version": "1.253.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.252.0",
+      "version": "1.253.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.252.0",
+  "version": "1.253.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.252.0",
-  "commit": "0c2a0a9cdd4afd1a0def0d43ed7a14928c32101e",
-  "builtAt": "2026-09-19T03:40:43.236Z"
+  "version": "1.253.0",
+  "commit": "c96eda5a0bced3e6e6347180846163cc19b28c49",
+  "builtAt": "2026-09-19T15:36:27.120Z"
 }

package/dist/assets/src/core/authz/policy.ts

@@ -141,6 +141,14 @@ export const POLICY: readonly Rule[] = [
   { action: "config:write", resource: "config-scope", resourceKind: "thread", when: [grant("config:write")] },
   // A user edits only their own scope.
   { action: "config:write", resource: "config-scope", resourceKind: "user", when: [IS_SELF] },
+  // The author binding's one trusted write (record 0062, authorization.md item
+  // 18): `config set user --github` binds a person to a GitHub login, so it is
+  // its own action — `identity:write`, held by `all` and by a named grants
+  // entry, never a baseline — not the channel-config right: a `config:write`
+  // holder could otherwise author commits as any unbound person. The is-self
+  // row above does not carry it: a person never binds themself (`config set me
+  // --github` is refused at the registry door before this table is asked).
+  { action: "identity:write", resource: "config-scope", resourceKind: "user", when: [grant("identity:write")] },
 
   // ── agents ───────────────────────────────────────────────────────────────
   // `agent:run:*` covers every agent through wildcard coverage (grants.ts).

package/dist/assets/src/core/budgets.ts

@@ -175,6 +175,9 @@ export const HOSTED_DEADLINE_MARGIN_MINUTES = 60;
  *  and the pause before a busy spawn is asked again. */
 export const SHIP_WAIT = { marginMinutes: 5, chunkMinutes: 5, mergeChunkMinutes: 5, busyRetryMinutes: 2 } as const;
 
+/** The plane's table (docs/decisions/0064): how long a finished run stays on it. */
+export const PLANE = { recentMinutes: 60 } as const;
+
 /** The named amounts a lease holds back, in minutes. Each stands for a step
  *  every run or round pays: `provision` is attach and restore before the
  *  harness's clock starts; `writeUp` is the final answer after the loop ends;
@@ -461,3 +464,17 @@ export const DEFAULT_GRANT: Grant = { renewals: 0 };
  *  hand-over is now `renewals: 5` — the longest problem a person hands over
  *  in one message before a plan should carry it. */
 export const GRANT_RENEWALS_MAX = 12;
+
+// ---- the idle unit (record 0051: a pipeline idles instead of ending) ----
+
+/** `ship.idleDays`' default: zero — today's endings byte for byte. It moves to
+ *  seven only in the unit that lands after the baseline and the billing answer
+ *  are recorded (record 0051's plan), never before. */
+export const IDLE_DAYS_DEFAULT = 0;
+/** The most days one idle may wait: the platform's own `waitForEvent` ceiling
+ *  (a year), which the wait must pass explicitly — its default is 24 hours. */
+export const IDLE_DAYS_MAX = 365;
+/** The most wakes one idle answers before it expires: a bound on how long a
+ *  busy thread can keep an instance parked (read by the wait, this plan's
+ *  fifth unit). */
+export const IDLE_WAKES_MAX = 100;