@coreplane/switchboard 1.254.0 → 1.255.0

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.254.0",
+  "version": "1.255.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.254.0",
+      "version": "1.255.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.254.0",
+      "version": "1.255.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.254.0",
+  "version": "1.255.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.254.0",
-  "commit": "c554204338614ad3882f8e59654806c2a5a61aa9",
-  "builtAt": "2026-09-19T19:46:00.046Z"
+  "version": "1.255.0",
+  "commit": "b19caf8a347aca9f78503cac8525f3b3206ba2ff",
+  "builtAt": "2026-09-20T02:32:25.817Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -47,6 +47,14 @@ export function machineNeedsRepo(machine: MachineClass): boolean {
 export const IDENTITIES = ["none", "read", "write"] as const;
 export type Identity = (typeof IDENTITIES)[number];
 
+/** The model tiers a preset may run on (the one-door plan's tiers rule): the
+ *  `fast` tier is the router's own model (`routing.model`), everything else is
+ *  `strong`. Each preset declares its allowed set below (`AgentDef.tiers`);
+ *  a parent choosing a child's model at spawn is held to the child preset's
+ *  set, and escalation is a new run — a run's tier is fixed at dispatch. */
+export const MODEL_TIERS = ["fast", "strong"] as const;
+export type ModelTier = (typeof MODEL_TIERS)[number];
+
 /** The wall clocks live in `src/core/budgets.ts` (docs/decisions/0046): a
  *  preset's ask, the turn cap derived from it and every allowance are rows
  *  there, and this registry reads them. Re-exported for the readers that
@@ -89,6 +97,12 @@ export interface AgentDef {
    *  worktree flag and the token the sandbox env and the `repo-cold` vet mint
    *  read this, through the run's effective profile. */
   identity: Identity;
+  /** The model tiers this preset may run on (`MODEL_TIERS`): what a parent's
+   *  spawn — and the operator's bind — may put in the child's request slot.
+   *  A preset that writes code (`coding`, `ship`, `review`) never includes
+   *  `fast`: a wrong approval or a wrong edit costs more than the tokens
+   *  saved; `explore` and `research` read, and may run fast. */
+  tiers: readonly ModelTier[];
   /** Whether the request router (docs/reference/specs/routing-and-config.md
    *  item 21) may pick this preset for a plain message. Absent means yes: the
    *  router's table is rendered from this registry. `false` keeps a preset
@@ -664,6 +678,7 @@ const WORK_PRESETS = {
     identity: "none",
     maxTokens: 16000,
     ...loopBudget("general"),
+    tiers: ["fast", "strong"],
   },
   coding: {
     name: "coding",
@@ -678,6 +693,7 @@ const WORK_PRESETS = {
     // `config set channel efforts.coding=…`, or `effort:` per request).
     machine: "repo-resident",
     identity: "write", // pushes branches and opens pull requests
+    tiers: ["strong"], // code-writing never runs fast (the one-door plan's tiers rule)
     // Never routed: a plain write ask deserves the coding → review loop, so
     // the router's table offers `ship` in coding's seat — a routed ship runs
     // a generated one-unit plan whose merge is a person's, never the runner's.
@@ -693,6 +709,7 @@ const WORK_PRESETS = {
     toolset: "readonly",
     machine: "repo-resident",
     identity: "read", // a read-scoped token and a read-only worktree: it cannot post or push from inside
+    tiers: ["strong"], // a wrong finding costs a merge decision: reviews never run fast
     maxTokens: 64000,
     ...loopBudget("review"), // a safety net — typical reviews land in ~5 minutes
     effort: "medium", // fast turns; one big-context pass does the deep work
@@ -717,6 +734,7 @@ const WORK_PRESETS = {
     toolset: "full",
     machine: "repo-resident",
     identity: "write",
+    tiers: ["strong"], // the pipeline's children write and review code: never fast
     // Routable: a routed ship runs a generated one-unit plan whose merge is a
     // person's (`merge: person`) and never a seeded plan (the hand-off refuses
     // a routed `plan <path>.md` naming `agent:ship`), so a wrong route costs a
@@ -733,6 +751,7 @@ const WORK_PRESETS = {
     toolset: "web",
     machine: "none", // web I/O only; no workspace is provisioned
     identity: "none",
+    tiers: ["fast", "strong"], // reads and reports: may run fast
     maxTokens: 24000,
     ...loopBudget("research"),
     effort: "medium",
@@ -747,6 +766,7 @@ const WORK_PRESETS = {
     // review depends on: a two-hour job shares no container with anyone.
     machine: "repo-cold",
     identity: "read", // a read-scoped token: it can clone and read, never push — whatever the caller holds
+    tiers: ["fast", "strong"], // reads and reports: may run fast
     maxTokens: 64000,
     ...loopBudget("explore"),
     // No built-in effort: the deployment decides, as for coding.
@@ -761,6 +781,7 @@ export const AGENTS: Record<string, AgentDef> = {
       "Coordinates other runs: spawns child runs as the requester — each in a thread of its own, under their permissions — follows them, and reports. No workspace or shell.",
     system: conductorSystem(Object.values(WORK_PRESETS)),
     toolset: "conductor",
+    tiers: ["fast", "strong"], // reads and coordinates: may run fast
     // Nothing is provisioned and no credential minted: the run tools call the
     // dispatcher, the GitHub reads are REST in the bot process.
     machine: "none",

package/dist/assets/src/core/budgets.ts

@@ -46,6 +46,20 @@ export const CONFIRMATION_TTL_MS = 10 * MINUTE_MS;
  *  and only loses answers. People answer a question in minutes to hours. */
 export const QUESTION_TTL_MS = DAY_MS;
 
+/** How long a resolved author binding is reused before the stored `{ login,
+ *  id }` pair is re-read from GitHub (docs/decisions/0062;
+ *  docs/reference/specs/authorization.md item 18). The commit identity pairs
+ *  are resolved per EXEC (`gitIdentityEnvs`), and the pi harness's log polls,
+ *  FIFO sends and file writes ride the same executor — without a cache a
+ *  write run costs one `GET /user/<id>` per command, drawing down the
+ *  installation's shared rate limit for a freshness nothing needs: the
+ *  identity rewrite re-reads the binding fresh before the PR opens, so a
+ *  rename is caught there whatever this window holds. Read by `bindingOf`
+ *  (`src/execution/authorBinding.ts`) for the resolved pair and the rename
+ *  refusal alike (one `[identity]` line per window, not one per exec); a read
+ *  that FAILED is never cached — the next read asks again. */
+export const AUTHOR_BINDING_TTL_MS = 15 * MINUTE_MS;
+
 /** How long a dispatch's FIRST attach to a resident — a fresh run's, or a
  *  resumed run's re-attach to its recorded worktree — waits for the resident
  *  to wake when the Worker typed its refusal as the platform's transient
@@ -172,6 +186,13 @@ export const FLOORS: Readonly<Record<RoundKind, number>> = {
  *  when the remainder allows it. */
 export const MERGE_WAIT_ASK_MINUTES = 60;
 
+/** The provider retry ladder (issue 1932): the backoff before each retry of a
+ *  transient model-call failure — a gateway 5xx, a stream cut before
+ *  `message_stop`, a gateway timeout. Three attempts with growing waits,
+ *  charged to the run's lease; the waits stay small next to the run's minutes
+ *  because the observed blips are edge transients of seconds. */
+export const PROVIDER_RETRY_BACKOFFS_MS = [5_000, 15_000, 45_000] as const;
+
 /** A hosted ship parent's deadline margin past the pipeline's wall clock
  *  (record 0060): the row's `state.hosting.until` is the hand-off time plus
  *  the instance's `caps.maxMinutes` plus this hour, absorbing the runner's own
@@ -183,8 +204,11 @@ export const HOSTED_DEADLINE_MARGIN_MINUTES = 60;
  *  and the pause before a busy spawn is asked again. */
 export const SHIP_WAIT = { marginMinutes: 5, chunkMinutes: 5, mergeChunkMinutes: 5, busyRetryMinutes: 2 } as const;
 
-/** The plane's table (docs/decisions/0064): how long a finished run stays on it. */
-export const PLANE = { recentMinutes: 60 } as const;
+/** The plane's table (docs/decisions/0064): how long a finished run stays on
+ *  it, a reservation's window, and the default re-ask cadence — how often a
+ *  silent resident something waits on is probed (`plane.reaskMinutes`
+ *  overrides it per deployment). */
+export const PLANE = { recentMinutes: 60, reservationMinutes: 2, reaskMinutes: 2 } as const;
 
 /** The named amounts a lease holds back, in minutes. Each stands for a step
  *  every run or round pays: `provision` is attach and restore before the
@@ -473,6 +497,15 @@ export const DEFAULT_GRANT: Grant = { renewals: 0 };
  *  in one message before a plan should carry it. */
 export const GRANT_RENEWALS_MAX = 12;
 
+// ---- the structured-answer seam (record 0067: a violation is re-asked) ----
+
+/** The most re-asks one structured ask may make (`askStructured`,
+ *  src/core/dispatch/structured.ts): a named violation is quoted back to the
+ *  same model at most this many times; the next violation is the caller's
+ *  declared floor. A count, not a duration — the caller's one timeout covers
+ *  the whole loop. */
+export const STRUCTURED_RETRIES_MAX = 2;
+
 // ---- the idle unit (record 0051: a pipeline idles instead of ending) ----
 
 /** `ship.idleDays`' default: zero — today's endings byte for byte. It moves to

package/dist/assets/src/core/coordinator/contract.ts

@@ -347,6 +347,11 @@ export interface CoordinatorInstance {
    *  attempt ended reruns the units not merged under `plan-<plan-id>-<attempt>`);
    *  absent for the first. */
   attempt?: number;
+  /** The hard stop's mark (record 0060; issue 1924): written when the hosted
+   *  parent is sealed, read by the runner before every unit start and before
+   *  every child spawn — it honours the mark by ending the remaining units
+   *  `stopped` and running nothing more. */
+  stop?: { at: number };
 }
 
 export interface UnitSegment {
@@ -491,6 +496,7 @@ export function isCoordinatorInstance(v: unknown): v is CoordinatorInstance {
   if (!isOptionalText(r.runId) || !isOptionalText(r.label)) return false;
   if (r.verbosity !== undefined && !isVerbosity(r.verbosity)) return false;
   if (r.attempt !== undefined && !(Number.isInteger(r.attempt) && (r.attempt as number) >= 2)) return false;
+  if (r.stop !== undefined && !(isObject(r.stop) && isFinite(r.stop.at))) return false;
   return true;
 }
 

package/dist/assets/src/core/coordinator/driver.ts

@@ -209,6 +209,9 @@ interface PlanFacts {
   generated: boolean;
   /** The runs page base the bot answered: the report links a child's write-up to its run page with it. */
   runPageBase?: string;
+  /** The hard stop's mark (record 0060; issue 1924): the hosted parent was
+   *  sealed, so the walk ends the remaining units stopped and runs nothing more. */
+  stopped: boolean;
   repo: string;
   base: string;
   caps: ShipCaps;
@@ -263,6 +266,7 @@ function readPlan(a: BotAnswer): PlanFacts {
     idleDays: readIdleDays(b.idleDays),
     generated: b.generated === true,
     ...(typeof b.runPageBase === "string" && b.runPageBase.length > 0 ? { runPageBase: b.runPageBase } : {}),
+    stopped: b.stopped === true,
     repo: b.repo,
     base: b.base,
     caps: { maxRounds: b.caps.maxRounds, maxMinutes: b.caps.maxMinutes },
@@ -288,6 +292,9 @@ function spawnReturn(step: string, a: BotAnswer): StepReturn {
     return { type: "spawn", step, outcome: alreadySpawned === true ? "alreadySpawned" : "spawned", runId, at };
   if (a.status === 409 && error === "busy")
     return { type: "spawn", step, outcome: "busy", ...(typeof runId === "string" ? { runId } : {}), at };
+  // The hosted parent's hard stop (record 0060; issue 1924): the spawn is
+  // refused over the instance row's stop mark, and the unit ends stopped.
+  if (a.status === 409 && error === "stopped") return { type: "spawn", step, outcome: "stopped", at };
   if (a.status === 403 && typeof error === "string")
     return {
       type: "spawn",
@@ -306,7 +313,10 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
   const run = a.body.run;
   if (a.body.ok !== true || !isRecord(run) || typeof run.finished !== "boolean")
     throw new UnreadableAnswer("read-record", a, "run");
-  if (!run.finished) return { type: "read-record", step, run: { finished: false }, at: a.body.at };
+  // The hard stop's mark, as the bot's answer carries it (record 0060; issue
+  // 1924): a finished child's unit ends stopped on it.
+  const stopped = a.body.stopped === true ? { stopped: true as const } : {};
+  if (!run.finished) return { type: "read-record", step, run: { finished: false }, ...stopped, at: a.body.at };
   if (typeof run.status !== "string") throw new UnreadableAnswer("read-record", a, "status");
   // The typed artifacts as the bot's record carries them — shape-checked where
   // they were written (the run record's validator), read here as they are.
@@ -326,10 +336,12 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
     leaseStartedAt,
     costUsd,
     handoffLists,
+    failure,
   } = facts;
   return {
     type: "read-record",
     step,
+    ...stopped,
     run: {
       finished: true,
       status: run.status as Extract<ChildFacts, { finished: true }>["status"],
@@ -348,6 +360,9 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
       ...(typeof leaseStartedAt === "number" ? { leaseStartedAt } : {}),
       ...(typeof costUsd === "number" || costUsd === null ? { costUsd } : {}),
       ...(handoffLists !== undefined ? { handoffLists } : {}),
+      // The failure by name (run-history item 57), shape-checked: a
+      // `provider_transient` drives the round-0 re-run (agent-ship item 9).
+      ...(isRecord(failure) && typeof failure.kind === "string" ? { failure: { kind: failure.kind } } : {}),
     },
     at: a.body.at,
   };
@@ -453,7 +468,11 @@ function mergeReturn(step: string, a: BotAnswer): StepReturn {
     return { type: "merge", step, outcome: "merged", by: "other", sha, mergedAt, at };
   if (ok === true && outcome === "merged" && typeof sha === "string")
     return { type: "merge", step, outcome: "merged", sha, at };
-  if (ok === true && (outcome === "pending" || outcome === "refused") && typeof reason === "string")
+  if (
+    ok === true &&
+    (outcome === "pending" || outcome === "refused" || outcome === "enqueued" || outcome === "removed") &&
+    typeof reason === "string"
+  )
     return { type: "merge", step, outcome, reason, at };
   throw new UnreadableAnswer("merge", a, "outcome");
 }
@@ -642,7 +661,12 @@ async function perform(
         answerOf(
           "merge",
           await step.do(action.step, STEP_CONFIG, () =>
-            call(bot, "merge", { ...tag, prNumber: action.prNumber, headSha: action.headSha }),
+            call(bot, "merge", {
+              ...tag,
+              prNumber: action.prNumber,
+              headSha: action.headSha,
+              ...(action.queued === true ? { queued: true } : {}),
+            }),
           ),
         ),
       );
@@ -807,6 +831,11 @@ async function runUnit(
   }
 }
 
+/** The report of a unit the hard stop ended before it ran (record 0060; issue 1924). */
+function stoppedReport(unit: string): string {
+  return `⏹ Stopped: the pipeline's hosted parent was hard-stopped, so ${unit} was ended without running. Re-issue the plan naming the remaining units to run them.`;
+}
+
 function blockedReport(unit: string, dep: string, depEnding: string): string {
   if (depEnding === "blocked")
     return `⛔ Blocked: ${unit} waits on ${dep}, which is blocked itself. Re-issue the plan naming the remaining units once it is resolved.`;
@@ -877,6 +906,18 @@ async function walk(step: StepRunner, bot: CoordinatorBot, instanceId: string):
   let cursor = openPlanCursor(graph);
   const endings: Record<string, string> = {};
   for (;;) {
+    // The hard stop's mark (record 0060; issue 1924), read before every unit
+    // start: the walk ends every unit not yet ended `stopped` — the rows say
+    // why they never ran — and starts nothing more. A stop that lands once
+    // every unit has ended changes nothing: there is nothing left to end.
+    if (plan.stopped) {
+      for (const id of cursor.order.filter((u) => endings[u] === undefined)) {
+        endings[id] = "stopped";
+        const body = { parentInstanceId: instanceId, unit: id, ending: { kind: "stopped", report: stoppedReport(id) } };
+        await step.do(`${id}/end`, STEP_CONFIG, () => call(bot, "unit-end", body));
+      }
+      break;
+    }
     const [next] = readyUnits(graph, cursor);
     if (next === undefined) break;
     cursor = startUnit(graph, cursor, next);
@@ -914,8 +955,9 @@ async function walk(step: StepRunner, bot: CoordinatorBot, instanceId: string):
   // Blocked units, in the plan's order: each told its own ending, so the rows
   // and the summary say why it never ran. Every blocked unit's ending is known
   // before any report is rendered — a plan may list a dependent before the
-  // dependency that blocks it.
-  const blocked = cursor.order.filter((id) => cursor.status[id] === "blocked");
+  // dependency that blocks it. A stopped walk skips this: every unended unit
+  // was already ended `stopped` above, and its cursor never finishes.
+  const blocked = plan.stopped ? [] : cursor.order.filter((id) => cursor.status[id] === "blocked");
   for (const id of blocked) endings[id] = "blocked";
   for (const id of blocked) {
     const node = graph.units.find((u) => u.id === id)!;
@@ -927,7 +969,8 @@ async function walk(step: StepRunner, bot: CoordinatorBot, instanceId: string):
     };
     await step.do(`${id}/end`, STEP_CONFIG, () => call(bot, "unit-end", body));
   }
-  if (!cursorFinished(cursor)) throw new Error(`the plan's cursor did not finish: ${JSON.stringify(cursor.status)}`);
+  if (!plan.stopped && !cursorFinished(cursor))
+    throw new Error(`the plan's cursor did not finish: ${JSON.stringify(cursor.status)}`);
   return {
     instance: instanceId,
     ...(plan.planId !== undefined ? { planId: plan.planId } : {}),

package/dist/assets/src/core/costs.ts

@@ -762,12 +762,19 @@ export interface BillerTieOutDay {
   invoiceUsd?: number;
   invoiceFeeUsd?: number;
   invoiceByokUsd?: number;
-  /** The summed `model.turn` dollars whose ref names this block. */
+  /** The summed `model.turn` dollars whose ref names this block — the meter's
+   *  charged figure from each turn's own `usd` (the provider's, the operator's
+   *  or the registry's price at the time), never the price table's repricing
+   *  the dimension views show (`buildCostsByReport`). */
   attributedUsd: number;
   /** The summed BYOK fees — the half an aggregator's `usage` ties against. */
   attributedFeeUsd?: number;
   /** `attributedUsd − attributedFeeUsd` — the half `byok_usage_inference` ties against. */
   attributedUpstreamUsd?: number;
+  /** The day's tokens whose turns carried no `usd` (null or absent) — spend the
+   *  attributed side could not count, so a gap against the invoice is explained
+   *  rather than silent. Absent when every turn was priced. */
+  unpricedTokens?: number;
 }
 
 /** One biller's daily tie-out over the range. */
@@ -784,15 +791,20 @@ const billerOfRef = (ref: string): string | undefined => (ref.includes("/") ? pa
 
 /**
  * Pure: each biller's invoice compared with the summed `model.turn` rows whose
- * ref names that block, per UTC day of the range. An aggregator's invoice
- * halves (`feeUsd`, `byokUsd`) sit beside the summed fees and the remainder. A
- * model whose `usd` is null or absent (unpriced, or from before the meter row)
- * contributes nothing to `attributedUsd` — an understated side is honest, an
- * invented one is not, so a day the source returned no row for keeps its
+ * ref names that block, per UTC day of the range. The attributed side is the
+ * meter's charged figure — each turn's own `usd`, never the price table's
+ * repricing. An aggregator's invoice halves (`feeUsd`, `byokUsd`) sit beside
+ * the summed fees and the remainder. A model whose `usd` is null or absent
+ * (unpriced, or from before the meter row) contributes nothing to
+ * `attributedUsd` — its tokens are counted as the day's `unpricedTokens`
+ * instead, so the understated side is visible: honest, never invented — and
+ * a day the source returned no row for keeps its
  * invoice side absent (the page renders —): the source holds closed days only,
  * and a trailing uninvoiced day beside real spend is not a $0 invoice. A day
- * with neither an invoice row nor a nonzero attributed figure is dropped; a
- * biller without a source (`invoice: false`) ties out against nothing.
+ * with no invoice row, no nonzero attributed figure and no unpriced tokens is
+ * dropped — but unpriced spend alone keeps its day, so the token count renders
+ * instead of vanishing; a biller without a source (`invoice: false`) ties out
+ * against nothing.
  */
 export function buildBillerTieOuts(
   billers: ReadonlyArray<{ name: string; invoice: boolean }>,
@@ -801,16 +813,22 @@ export function buildBillerTieOuts(
   range: DateRange,
 ): BillerTieOut[] {
   return billers.map(({ name, invoice }) => {
-    const attributed = new Map<string, { usd: number; fee: number; hasFee: boolean }>();
+    const attributed = new Map<string, { usd: number; fee: number; hasFee: boolean; unpricedTokens: number }>();
     for (const cell of cells) {
       if (cell.day < range.from || cell.day > range.to) continue;
       for (const [ref, m] of Object.entries(cell.usage.byModel)) {
         if (billerOfRef(ref) !== name) continue;
-        const day = attributed.get(cell.day) ?? { usd: 0, fee: 0, hasFee: false };
-        if (typeof m.usd === "number") day.usd += m.usd;
-        if (m.feeUsd !== undefined) {
-          day.fee += m.feeUsd;
-          day.hasFee = true;
+        const day = attributed.get(cell.day) ?? { usd: 0, fee: 0, hasFee: false, unpricedTokens: 0 };
+        // An unpriced model's feeUsd is skipped with its usd: adding the fee
+        // alone would drive attributedUpstreamUsd (usd − fee) negative.
+        if (typeof m.usd === "number") {
+          day.usd += m.usd;
+          if (m.feeUsd !== undefined) {
+            day.fee += m.feeUsd;
+            day.hasFee = true;
+          }
+        } else {
+          day.unpricedTokens += m.inputTokens + m.outputTokens + m.cacheReadTokens + m.cacheWriteTokens;
         }
         attributed.set(cell.day, day);
       }
@@ -820,7 +838,7 @@ export function buildBillerTieOuts(
       for (const d of invoices[name] ?? []) if (d.date >= range.from && d.date <= range.to) invoiced.set(d.date, d);
     const dates = [...new Set([...attributed.keys(), ...invoiced.keys()])].sort().filter((date) => {
       const a = attributed.get(date);
-      return invoiced.has(date) || (a !== undefined && (a.usd !== 0 || a.hasFee));
+      return invoiced.has(date) || (a !== undefined && (a.usd !== 0 || a.hasFee || a.unpricedTokens > 0));
     });
     const days: BillerTieOutDay[] = dates.map((date) => {
       const a = attributed.get(date);
@@ -832,6 +850,7 @@ export function buildBillerTieOuts(
         ...(inv?.byokUsd !== undefined ? { invoiceByokUsd: inv.byokUsd } : {}),
         attributedUsd: a?.usd ?? 0,
         ...(a?.hasFee ? { attributedFeeUsd: a.fee, attributedUpstreamUsd: a.usd - a.fee } : {}),
+        ...(a !== undefined && a.unpricedTokens > 0 ? { unpricedTokens: a.unpricedTokens } : {}),
       };
     });
     return {
@@ -922,7 +941,11 @@ export class OpenAICostsSource implements LlmInvoiceSource {
         next_page?: string | null;
       };
       for (const bucket of body.data ?? []) {
-        const date = new Date(num(bucket.start_time) * 1000).toISOString().slice(0, 10);
+        // A bucket without a finite start_time is skipped, never dated to epoch 0;
+        // out-of-range buckets are dropped like the OpenRouter source's rows.
+        if (typeof bucket.start_time !== "number" || !Number.isFinite(bucket.start_time)) continue;
+        const date = new Date(bucket.start_time * 1000).toISOString().slice(0, 10);
+        if (date < range.from || date > range.to) continue;
         for (const r of bucket.results ?? []) {
           const currency = str(r.amount?.currency).toLowerCase();
           if (currency !== "usd") throw new Error(`openai organization costs: unexpected currency ${currency || "?"}`);

package/dist/assets/src/core/pipelineStanding.ts

@@ -94,6 +94,9 @@ export const ROUND_STAGE = {
   request_changes: "fix",
   no_verdict: "hold",
   checks_failed: "fix",
+  transient: "hold",
+  enqueued: "approved",
+  dequeued: "fix",
   aborted: "hold",
   stopped: "hold",
   continued: "continue",
@@ -111,12 +114,14 @@ export const ENDING_STAGE = {
   merged: "merged",
   already_landed: "merged",
   merge_ready: "merge-ready",
+  held: "ended",
   merge_refused: "ended",
   round_cap: "ended",
   wall_clock_cap: "ended",
   review_pending: "ended",
   stopped: "ended",
   aborted: "ended",
+  transient: "ended",
   continued: "hold",
   no_verdict: "ended",
   interrupted: "ended",