@coreplane/switchboard 1.252.0 → 1.254.0

package/dist/assets/deploy/cloudflare-memory/wrangler.template.jsonc

@@ -66,6 +66,18 @@
       "script_name": "{{bot.script}}"
     }
   ],
+  // {{#if metrics}}
+  // The run-metrics dataset (docs/reference/specs/run-metrics.md): where RunHistoryDO
+  // writes a turned-final run's point, bound only when the deployment profile names a
+  // dataset (`metrics.dataset`) — nothing is created ahead of the deploy; the platform
+  // creates the dataset on first write. Without it the Worker deploys without the
+  // binding and writes no points.
+  "analytics_engine_datasets": [{ "binding": "RUN_METRICS", "dataset": "{{metrics.dataset}}" }],
+  // The dataset's name beside its binding (rendered together): /healthz `features`
+  // says `runMetrics:<dataset>` from it, so the bot's boot probe can compare the
+  // name its own config carries with the one this deploy bound.
+  "vars": { "RUN_METRICS_DATASET": "{{metrics.dataset}}" },
+  // {{/if}}
   // SQLite-backed DOs (durable across restarts — AGENTS.md invariant 6).
   "migrations": [
     { "tag": "v1", "new_sqlite_classes": ["MemoryDO"] },

package/dist/assets/deploy/profile.example.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "The deployment profile: where THIS installation runs. Copy to deploy/profile.json and fill it in (or run `switchboard deploy init`). The account is your Cloudflare account id; every hostname must be under `zone`, a zone in that account, unless the Worker names its own `zone` (also in the account); `workers.bot` is the one required Worker — leave `memory`, `resident` or `sandbox` out and `deploy plan` has no step for them (a bot-only profile is a one-step plan; without `memory` the config is not pushed anywhere). The project's docs site is not a Worker of an installation: it is the project's website, deployed by the project's own CI from project.json, so there is no `docs` entry. `configSource` is where `deploy all` reads the bot's runtime config from before building the image — a path, `github://owner/repo/path@ref` (needs CONFIG_REPO_TOKEN), or `op://Vault/Item/field` (needs OP_SERVICE_ACCOUNT_TOKEN); `secretsSource` is where `secrets put` reads values from — a directory of <NAME> files (the default when absent) or `op://Vault/Item`. `images` is where the bot, resident and sandbox container images come from: `registry` — the release's published images, copied once per version into your account registry by `deploy all` itself (or `deploy images` ahead of it) over HTTPS and referenced from there — no Docker anywhere, a Cloudflare API token with Containers Edit in CLOUDFLARE_API_TOKEN for the copy (an installation deploying published images; what `init` writes from the published package); or `build` (the default when absent) — each Worker's Dockerfile, built by wrangler where `deploy all` runs (a checkout; the project's own production). `artifacts` (optional) names the R2 bucket a run's files move through (docs/reference/specs/execution.md item 20): with it the bot Worker binds the bucket and `deploy` creates it before the upload (the credential then needs Workers R2 Storage: Edit); the bot's runtime config `artifacts.r2.bucket` must say the same name. `deploy plan` reads this example when no profile exists; `deploy all` refuses it.",
+  "$comment": "The deployment profile: where THIS installation runs. Copy to deploy/profile.json and fill it in (or run `switchboard deploy init`). The account is your Cloudflare account id; every hostname must be under `zone`, a zone in that account, unless the Worker names its own `zone` (also in the account); `workers.bot` is the one required Worker — leave `memory`, `resident` or `sandbox` out and `deploy plan` has no step for them (a bot-only profile is a one-step plan; without `memory` the config is not pushed anywhere). The project's docs site is not a Worker of an installation: it is the project's website, deployed by the project's own CI from project.json, so there is no `docs` entry. `configSource` is where `deploy all` reads the bot's runtime config from before building the image — a path, `github://owner/repo/path@ref` (needs CONFIG_REPO_TOKEN), or `op://Vault/Item/field` (needs OP_SERVICE_ACCOUNT_TOKEN); `secretsSource` is where `secrets put` reads values from — a directory of <NAME> files (the default when absent) or `op://Vault/Item`. `images` is where the bot, resident and sandbox container images come from: `registry` — the release's published images, copied once per version into your account registry by `deploy all` itself (or `deploy images` ahead of it) over HTTPS and referenced from there — no Docker anywhere, a Cloudflare API token with Containers Edit in CLOUDFLARE_API_TOKEN for the copy (an installation deploying published images; what `init` writes from the published package); or `build` (the default when absent) — each Worker's Dockerfile, built by wrangler where `deploy all` runs (a checkout; the project's own production). `artifacts` (optional) names the R2 bucket a run's files move through (docs/reference/specs/execution.md item 20): with it the bot Worker binds the bucket and `deploy` creates it before the upload (the credential then needs Workers R2 Storage: Edit); the bot's runtime config `artifacts.r2.bucket` must say the same name. `metrics` (optional) names the Analytics Engine dataset every finished run's point is written to (docs/reference/specs/run-metrics.md): the state Worker's template then binds it as `RUN_METRICS` with the name beside it in `RUN_METRICS_DATASET` — nothing is created ahead of the deploy, the platform creates the dataset on first write — and the bot's runtime config `metrics.dataset` must say the same name (the bot warns at boot when the two differ). `deploy plan` reads this example when no profile exists; `deploy all` refuses it.",
   "account": "00000000000000000000000000000000",
   "zone": "example.com",
   "workers": {

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.252.0",
+  "version": "1.254.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.252.0",
+      "version": "1.254.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.252.0",
+      "version": "1.254.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.252.0",
+  "version": "1.254.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.252.0",
-  "commit": "0c2a0a9cdd4afd1a0def0d43ed7a14928c32101e",
-  "builtAt": "2026-09-19T03:40:43.236Z"
+  "version": "1.254.0",
+  "commit": "c554204338614ad3882f8e59654806c2a5a61aa9",
+  "builtAt": "2026-09-19T19:46:00.046Z"
 }

package/dist/assets/src/core/authz/grants.ts

@@ -60,6 +60,12 @@ export const CHAT_OPEN_ACTIONS: readonly string[] = [
   "schedule:read",
   "memory:write",
   "mcp:write",
+  // `steer.run` (chat-only): the door admits every chat user because the real
+  // fence is the steer OWNER rule at the wired sender — the named run's
+  // requester, an id their identity record links, or a `runs:write` grant
+  // (authorization item 16a) — which the command door cannot see. Never held
+  // by a token: the machine surfaces have `send_to_run` and the ingress.
+  "steer:write",
 ];
 
 /** The two writes a browser session holds beside its reads (record 0043): the

package/dist/assets/src/core/authz/policy.ts

@@ -58,6 +58,11 @@ export const POLICY: readonly Rule[] = [
   // List-shaped `runs.*`: the grant admits the command; the store predicate narrows the rows.
   { action: "runs:read", resource: "command", when: [grant("runs:read")] },
   { action: "runs:write", resource: "command", when: [grant("runs:write")] },
+  // `steer.run`: every chat user holds the grant (CHAT_OPEN_ACTIONS) because
+  // the fence is the steer owner rule at the wired sender, decided against the
+  // NAMED run (`authorizeSteerOwner`, authorization item 16a) — the requester,
+  // a linked id, or `runs:write` — which no command-door row can see.
+  { action: "steer:write", resource: "command", when: [grant("steer:write")] },
 
   // ── conversations ────────────────────────────────────────────────────────
   // Who may point the bot at another thread (record 0037). Asked for a
@@ -91,6 +96,12 @@ export const POLICY: readonly Rule[] = [
   // `all` and a named `grants` entry hold it).
   { action: "costs:write", resource: "command", when: [grant("costs:write")] },
 
+  // ── metrics ──────────────────────────────────────────────────────────────
+  // `metrics trend` reads the run-metrics dataset's report: the `costs:read`
+  // shape — a browser session's baseline, a grant for a Slack user or a token,
+  // never a chat baseline.
+  { action: "metrics:read", resource: "command", when: [grant("metrics:read")] },
+
   // ── providers ────────────────────────────────────────────────────────────
   // `providers check` reads the provider's own endpoints on request: a browser
   // session's read baseline, a grant everywhere else — an on-request provider
@@ -141,6 +152,14 @@ export const POLICY: readonly Rule[] = [
   { action: "config:write", resource: "config-scope", resourceKind: "thread", when: [grant("config:write")] },
   // A user edits only their own scope.
   { action: "config:write", resource: "config-scope", resourceKind: "user", when: [IS_SELF] },
+  // The author binding's one trusted write (record 0062, authorization.md item
+  // 18): `config set user --github` binds a person to a GitHub login, so it is
+  // its own action — `identity:write`, held by `all` and by a named grants
+  // entry, never a baseline — not the channel-config right: a `config:write`
+  // holder could otherwise author commits as any unbound person. The is-self
+  // row above does not carry it: a person never binds themself (`config set me
+  // --github` is refused at the registry door before this table is asked).
+  { action: "identity:write", resource: "config-scope", resourceKind: "user", when: [grant("identity:write")] },
 
   // ── agents ───────────────────────────────────────────────────────────────
   // `agent:run:*` covers every agent through wildcard coverage (grants.ts).

package/dist/assets/src/core/budgets.ts

@@ -38,6 +38,14 @@ export const WEEK_MS = 7 * DAY_MS;
  *  which stamps the expiry on its own clock. */
 export const CONFIRMATION_TTL_MS = 10 * MINUTE_MS;
 
+/** How long a question's Yes stays pending (docs/decisions/0054, as amended;
+ *  docs/reference/specs/routing-and-config.md item 25): one day. A Yes only
+ *  re-dispatches the corrected message, which is then routed, authorized and,
+ *  for a write, offered its own graded button — the write's ten-minute
+ *  freshness is enforced downstream, so a short window here protects nothing
+ *  and only loses answers. People answer a question in minutes to hours. */
+export const QUESTION_TTL_MS = DAY_MS;
+
 /** How long a dispatch's FIRST attach to a resident — a fresh run's, or a
  *  resumed run's re-attach to its recorded worktree — waits for the resident
  *  to wake when the Worker typed its refusal as the platform's transient
@@ -175,6 +183,9 @@ export const HOSTED_DEADLINE_MARGIN_MINUTES = 60;
  *  and the pause before a busy spawn is asked again. */
 export const SHIP_WAIT = { marginMinutes: 5, chunkMinutes: 5, mergeChunkMinutes: 5, busyRetryMinutes: 2 } as const;
 
+/** The plane's table (docs/decisions/0064): how long a finished run stays on it. */
+export const PLANE = { recentMinutes: 60 } as const;
+
 /** The named amounts a lease holds back, in minutes. Each stands for a step
  *  every run or round pays: `provision` is attach and restore before the
  *  harness's clock starts; `writeUp` is the final answer after the loop ends;
@@ -461,3 +472,17 @@ export const DEFAULT_GRANT: Grant = { renewals: 0 };
  *  hand-over is now `renewals: 5` — the longest problem a person hands over
  *  in one message before a plan should carry it. */
 export const GRANT_RENEWALS_MAX = 12;
+
+// ---- the idle unit (record 0051: a pipeline idles instead of ending) ----
+
+/** `ship.idleDays`' default: zero — today's endings byte for byte. It moves to
+ *  seven only in the unit that lands after the baseline and the billing answer
+ *  are recorded (record 0051's plan), never before. */
+export const IDLE_DAYS_DEFAULT = 0;
+/** The most days one idle may wait: the platform's own `waitForEvent` ceiling
+ *  (a year), which the wait must pass explicitly — its default is 24 hours. */
+export const IDLE_DAYS_MAX = 365;
+/** The most wakes one idle answers before it expires: a bound on how long a
+ *  busy thread can keep an instance parked (read by the wait, this plan's
+ *  fifth unit). */
+export const IDLE_WAKES_MAX = 100;

package/dist/assets/src/core/coordinator/contract.ts

@@ -8,9 +8,10 @@
 // parent record the spawn route reads the requester from, and the names the
 // routes decide on.
 //
-import type { Grant, GrantSource } from "../budgets.js";
+import { IDLE_DAYS_MAX, type Grant, type GrantSource } from "../budgets.js";
 import { isVerbosity, type Verbosity } from "../verbosity.js";
 import { isAddressSeverity, type AddressSeverity, type AddressSeveritySource } from "../ship/coordinator.js";
+import { isHandoffShape, type Handoff } from "../ship/handoff.js";
 
 // A coordinator is a Workflow instance in the shim Worker whose children are
 // ordinary `dispatch()` runs as the requesting user. It holds no credential of
@@ -329,6 +330,11 @@ export interface CoordinatorInstance {
    *  the unit threads it owns — the unit-ending report's asides and the
    *  segment lines are `verbose` material. Absent reads as `quiet`. */
   verbosity?: Verbosity;
+  /** The idle flag (record 0051; agent-ship item 8): `ship.idleDays` as the
+   *  ship fork resolved it (user > channel > org), written here beside the
+   *  grant and answered by the plan route — above zero, an idling ending
+   *  becomes `idle`; absent reads as zero, today's endings. */
+  idleDays?: number;
   /** The pipeline's caps as the profile gate clipped them: the rounds cap and the wall clock per unit. */
   caps?: { maxRounds: number; maxMinutes: number };
   /** The status card in the requesting thread, when the channel has one — what
@@ -350,6 +356,24 @@ export interface UnitSegment {
   at: number;
 }
 
+/** The longest `why` an idle carries: an ending kind's name, never prose —
+ *  the route refuses a longer one at the door, the row validator at the store. */
+export const IDLE_WHY_MAX = 64;
+
+/** The idle on a unit's row (record 0051): what a continuation needs, and the
+ *  wakes spent against `IDLE_WAKES_MAX`. */
+export interface UnitIdle {
+  /** The old ending kind the idle stands in for (`wall_clock_cap`, `stopped`, `continued`, …). */
+  why: string;
+  at: number;
+  renewalsLeft: number;
+  from?: string;
+  runId?: string;
+  spendUsd: number | null;
+  handoff?: Handoff;
+  wakes: number;
+}
+
 /** One unit of the plan an instance runs (a task string is a generated plan of
  *  one unit, `U1`): its branch, the units it waits on, and — as the runner
  *  reaches it — its thread, its pull request, the round boundaries the card
@@ -398,6 +422,15 @@ export interface CoordinatorUnit {
    *  renews the same segment twice. `from` is the sha the segment continues
    *  from, `runId` the coding run whose write-up briefs it. */
   segments?: UnitSegment[];
+  /** The unit idles (record 0051; run-history item 50): written by `unit-end`
+   *  on an `idle` ending in place of `ending`, so the unit stays unfinished
+   *  and keeps owning its thread. `why` is the old kind, `renewalsLeft` what
+   *  the grant still holds (the wake spends one — this plan's fifth unit),
+   *  `from` the head a continuation opens from, `runId` the last coding
+   *  child's run (absent when none ran), `spendUsd` the session's dollars
+   *  (null once any run's cost is unknown), `handoff` that child's lists, and
+   *  `wakes` how many wakes this idle has answered — zero at the write. */
+  idle?: UnitIdle;
   /** The round boundaries the coordinator reported, oldest first (the `ship_round`
    *  vocabulary). `gate` rides an approve the machine's severity check caught
    *  carrying a finding at or above the level in force ([agent-ship](../../../docs/reference/specs/agent-ship.md)
@@ -450,6 +483,11 @@ export function isCoordinatorInstance(v: unknown): v is CoordinatorInstance {
   if (r.caps !== undefined && !(isObject(r.caps) && isFinite(r.caps.maxRounds) && isFinite(r.caps.maxMinutes)))
     return false;
   if (r.card !== undefined && !(isObject(r.card) && isText(r.card.channel) && isText(r.card.ts))) return false;
+  if (
+    r.idleDays !== undefined &&
+    !(Number.isInteger(r.idleDays) && (r.idleDays as number) >= 0 && (r.idleDays as number) <= IDLE_DAYS_MAX)
+  )
+    return false;
   if (!isOptionalText(r.runId) || !isOptionalText(r.label)) return false;
   if (r.verbosity !== undefined && !isVerbosity(r.verbosity)) return false;
   if (r.attempt !== undefined && !(Number.isInteger(r.attempt) && (r.attempt as number) >= 2)) return false;
@@ -464,6 +502,17 @@ const isRoundGate = (v: unknown): boolean =>
   Array.isArray(v.findings) &&
   v.findings.every((f) => typeof f === "string");
 
+const isUnitIdle = (v: unknown): boolean =>
+  isObject(v) &&
+  isText(v.why, IDLE_WHY_MAX) &&
+  isFinite(v.at) &&
+  isCount(v.renewalsLeft) &&
+  (v.from === undefined || isText(v.from)) &&
+  (v.runId === undefined || isText(v.runId)) &&
+  (v.spendUsd === null || isFinite(v.spendUsd)) &&
+  (v.handoff === undefined || isHandoffShape(v.handoff)) &&
+  isCount(v.wakes);
+
 const isSegment = (v: unknown): boolean =>
   isObject(v) &&
   typeof v.index === "number" &&
@@ -486,6 +535,7 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
   if (r.resume !== undefined && !isResume(r.resume)) return false;
   if (r.lastPush !== undefined && !isText(r.lastPush)) return false;
   if (r.segments !== undefined && (!Array.isArray(r.segments) || !r.segments.every(isSegment))) return false;
+  if (r.idle !== undefined && !isUnitIdle(r.idle)) return false;
   if (
     !Array.isArray(r.rounds) ||
     r.rounds.length > MAX_ROUNDS ||

package/dist/assets/src/core/coordinator/driver.ts

@@ -33,7 +33,7 @@
 // plan's re-issue. A task string's ship branch waits for a person. Node-free:
 // the shim Worker imports this by relative path.
 
-import { DEFAULT_GRANT, GRANT_RENEWALS_MAX, type Grant, type GrantSource } from "../budgets.js";
+import { DEFAULT_GRANT, GRANT_RENEWALS_MAX, IDLE_DAYS_MAX, type Grant, type GrantSource } from "../budgets.js";
 import { DEFAULT_VERBOSITY, isVerbosity, type Verbosity } from "../verbosity.js";
 import {
   applyReturn,
@@ -42,6 +42,8 @@ import {
   openPlanCursor,
   openUnitPipeline,
   readyUnits,
+  type PlanCursor,
+  type UnitStatus,
   renderUnitReport,
   settleUnit,
   startUnit,
@@ -163,8 +165,18 @@ export function readBotAnswer(
 }
 
 /** The answers the bot itself calls a passing condition — the step is asked
- *  again, under the policy. Everything else, refusals included, is the machine's. */
-const TRANSIENT = new Set(["github_unavailable", "no_channel", "thread_failed", "unit_not_started", "not_host"]);
+ *  again, under the policy. Everything else, refusals included, is the machine's.
+ *  `queued` is the plane's hold on a spawn (record 0064, "The queue"): a `409`
+ *  saying the child's admission waits on an event — the step re-asks until the
+ *  child is admitted, and the instance is never failed over a full plane. */
+const TRANSIENT = new Set([
+  "github_unavailable",
+  "no_channel",
+  "thread_failed",
+  "unit_not_started",
+  "not_host",
+  "queued",
+]);
 export function transientRefusal(answer: BotAnswer): string | undefined {
   const { ok, error, message } = answer.body;
   if (ok !== false || typeof error !== "string" || !TRANSIENT.has(error)) return undefined;
@@ -191,6 +203,8 @@ interface PlanFacts {
   grantSource: GrantSource;
   /** The request's verbosity as the plan route answers it (routing-and-config item 28): what the unit threads hear. */
   verbosity: Verbosity;
+  /** The idle flag beside the grant (record 0051): above zero, an idling ending becomes `idle`. */
+  idleDays: number;
   /** The instance's mark as the plan route answers it: a generated one-unit plan (a `plan` with no `path`). */
   generated: boolean;
   /** The runs page base the bot answered: the report links a child's write-up to its run page with it. */
@@ -220,6 +234,12 @@ function readGrant(raw: unknown): Grant {
   return { renewals: raw.renewals, ...(typeof cap === "number" && cap > 0 ? { costCapUsd: cap } : {}) };
 }
 
+/** The idle flag as the plan route answers it (record 0051): an integer from 0
+ *  to the module's cap; anything unreadable is 0 — nothing idles on a guess. */
+function readIdleDays(raw: unknown): number {
+  return typeof raw === "number" && Number.isInteger(raw) && raw >= 0 && raw <= IDLE_DAYS_MAX ? raw : 0;
+}
+
 function readPlan(a: BotAnswer): PlanFacts {
   const b = a.body;
   if (b.ok !== true) throw new UnreadableAnswer("plan", a, "not ok");
@@ -240,6 +260,7 @@ function readPlan(a: BotAnswer): PlanFacts {
     grantSource:
       b.grantSource === "run" || b.grantSource === "user" || b.grantSource === "channel" ? b.grantSource : "org",
     verbosity: isVerbosity(b.verbosity) ? b.verbosity : DEFAULT_VERBOSITY,
+    idleDays: readIdleDays(b.idleDays),
     generated: b.generated === true,
     ...(typeof b.runPageBase === "string" && b.runPageBase.length > 0 ? { runPageBase: b.runPageBase } : {}),
     repo: b.repo,
@@ -369,6 +390,11 @@ function prCheckReturn(step: string, a: BotAnswer): StepReturn {
         prNumber,
         url,
         ...(typeof headSha === "string" ? { headSha } : {}),
+        // The entry facts (issue 1689): the branch's own tip and whether the
+        // bot's approval stands at the head, read at the unit-start's pre-check
+        // so a re-issued plan resumes at review or at the merge decision.
+        ...(typeof a.body.branchHead === "string" ? { branchHead: a.body.branchHead } : {}),
+        ...(typeof a.body.approved === "boolean" ? { approved: a.body.approved } : {}),
         ...(typeof a.body.autoMergeEnabled === "boolean" ? { autoMergeEnabled: a.body.autoMergeEnabled } : {}),
         ...(isCommitChecks(a.body.checks) ? { checks: a.body.checks } : {}),
         // The ready-state facts beside the checks (agent-ship item 9): the
@@ -563,6 +589,10 @@ async function perform(
           await step.do(action.step, STEP_CONFIG, () =>
             call(bot, "pr-check", {
               ...tag,
+              // `entry` is the unit-start's pre-check (issue 1689): the bot
+              // reads the branch's tip, the approval and the checks beside the
+              // listing, so a re-issued plan's unit resumes instead of recoding.
+              ...(action.entry === true ? { entry: true } : {}),
               ...(action.recover !== undefined ? { recover: action.recover } : {}),
               ...(action.pr !== undefined ? { pr: action.pr } : {}),
             }),
@@ -662,6 +692,7 @@ async function runUnit(
       grant: plan.grant,
       grantSource: plan.grantSource,
       verbosity: plan.verbosity,
+      idleDays: plan.idleDays,
       generated: plan.generated,
       ...(plan.runPageBase !== undefined ? { runPageBase: plan.runPageBase } : {}),
       ...(resume !== undefined ? { resume } : {}),
@@ -734,13 +765,28 @@ async function runUnit(
             kind: note.ending.kind,
             report: renderUnitReport(state, endFacts),
             threadReport: renderUnitReport(state, endFacts, state.input.verbosity ?? DEFAULT_VERBOSITY),
+            // An idle ending carries its continuation facts (record 0051): the
+            // bot writes them on the row's `idle` in place of an ending, with
+            // the coding run id it already receives below.
+            ...(note.ending.kind === "idle"
+              ? {
+                  why: note.ending.why,
+                  renewalsLeft: note.ending.renewalsLeft,
+                  ...(note.ending.from !== undefined ? { from: note.ending.from } : {}),
+                  spendUsd: note.ending.spendUsd,
+                  ...(note.ending.handoff !== undefined ? { handoff: note.ending.handoff } : {}),
+                }
+              : {}),
           },
           ...(state.pr !== undefined ? { pr: state.pr } : {}),
           // A review_pending ending names the child's own last push so the next
-          // attempt's pre-check can start at the review round (the row's lastPush).
+          // attempt's pre-check can start at the review round (the row's lastPush)
+          // — an idled one the same, off the idle's `from` (record 0051).
           ...(note.ending.kind === "review_pending" && note.ending.headSha !== undefined
             ? { headSha: note.ending.headSha }
-            : {}),
+            : note.ending.kind === "idle" && note.ending.why === "review_pending" && note.ending.from !== undefined
+              ? { headSha: note.ending.from }
+              : {}),
           ...(state.lastCodingRunId !== undefined ? { codingRunId: state.lastCodingRunId } : {}),
           // A continued ending is a segment's end, not the unit's: the bot
           // writes the renewal as a row keyed by the next segment's index
@@ -768,12 +814,9 @@ function blockedReport(unit: string, dep: string, depEnding: string): string {
   return `⛔ Blocked: ${unit} waits on ${dep}, which ended ${depEnding}${person ? " — a person's merge" : ""}. Re-issue the plan naming the remaining units once it is ${person ? "merged" : "resolved"}.`;
 }
 
-/** The plan: its units one at a time in dependency order, then the endings of the units it never reached. */
-async function walk(step: StepRunner, bot: CoordinatorBot, instanceId: string): Promise<PlanRunSummary> {
-  const plan = readPlan(
-    answerOf("plan", await step.do("plan", STEP_CONFIG, () => call(bot, "plan", { parentInstanceId: instanceId }))),
-  );
-  const graph: PlanGraph = {
+/** The graph as one plan answer carries it: the instance's unit rows, in the plan's order. */
+function graphOf(plan: PlanFacts, instanceId: string): PlanGraph {
+  return {
     planId: plan.planId ?? instanceId,
     units: plan.units.map((u) => ({
       id: u.unit,
@@ -783,6 +826,54 @@ async function walk(step: StepRunner, bot: CoordinatorBot, instanceId: string):
       dependsOn: u.dependsOn,
     })),
   };
+}
+
+/** The cursor over a freshly read selection (the orchestration-plane plan's
+ *  re-read requirement): a surviving unit keeps its standing, a row appended
+ *  mid-walk joins pending — walked after the current unit — and a row gone from the selection
+ *  was merged by hand: it is walked as merged with nothing run and nothing
+ *  told (`gone`), a dependency on it counted satisfied like any dependency
+ *  outside the selection. `blocked` is derived state, so it is recomputed over
+ *  the fresh graph rather than carried — a blocked unit whose failing
+ *  dependency left the selection is in play again. */
+function rereadCursor(cursor: PlanCursor, fresh: PlanGraph): { cursor: PlanCursor; gone: string[] } {
+  const gone = cursor.order.filter((id) => !fresh.units.some((u) => u.id === id));
+  const order = fresh.units.map((u) => u.id);
+  const status: Record<string, UnitStatus> = {};
+  for (const id of order) {
+    const prior = cursor.status[id];
+    status[id] = prior === undefined || prior === "blocked" ? "pending" : prior;
+  }
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const u of fresh.units) {
+      if (status[u.id] !== "pending") continue;
+      if (u.dependsOn.some((d) => d in status && (status[d] === "failed" || status[d] === "blocked"))) {
+        status[u.id] = "blocked";
+        changed = true;
+      }
+    }
+  }
+  return { cursor: { order, status }, gone };
+}
+
+/** The plan: its units one at a time in dependency order, then the endings of the units it never reached. */
+async function walk(step: StepRunner, bot: CoordinatorBot, instanceId: string): Promise<PlanRunSummary> {
+  // The selection is read at every unit boundary (the orchestration-plane plan): the first read opens
+  // the cursor, and each boundary's — its own durable step, `plan/<n>`, so a
+  // replay meets the same read — rebuilds it, so a later bot can append a unit
+  // to a live instance or drop one merged by hand without killing it.
+  let reads = 0;
+  const readSelection = async (): Promise<PlanFacts> => {
+    reads += 1;
+    const name = reads === 1 ? "plan" : `plan/${reads}`;
+    return readPlan(
+      answerOf("plan", await step.do(name, STEP_CONFIG, () => call(bot, "plan", { parentInstanceId: instanceId }))),
+    );
+  };
+  let plan = await readSelection();
+  let graph = graphOf(plan, instanceId);
   let cursor = openPlanCursor(graph);
   const endings: Record<string, string> = {};
   for (;;) {
@@ -809,7 +900,16 @@ async function walk(step: StepRunner, bot: CoordinatorBot, instanceId: string):
     endings[next] = ending.kind;
     // A unit is done for its dependents when the base carries its scope: the
     // runner's merge, or a scope that had already landed before the attempt.
+    // An `idle` ending settles the unit `failed` for now: nothing waits yet —
+    // the indexed wait and the wake land with the fifth unit of record 0051's
+    // plan — so the walk is unchanged until then and the flag ships at zero.
     cursor = settleUnit(graph, cursor, next, isSettledDone(ending.kind) ? "done" : "failed");
+    // The unit boundary's re-read (the orchestration-plane plan): the fresh rows are the selection now.
+    plan = await readSelection();
+    graph = graphOf(plan, instanceId);
+    const reread = rereadCursor(cursor, graph);
+    cursor = reread.cursor;
+    for (const id of reread.gone) endings[id] ??= "merged";
   }
   // Blocked units, in the plan's order: each told its own ending, so the rows
   // and the summary say why it never ran. Every blocked unit's ending is known