@coreplane/switchboard 1.255.0 → 1.256.0

package/dist/assets/deploy/cloudflare-resident/drain.ts

@@ -23,6 +23,17 @@ export interface DrainRecord {
   by: string;
   /** Why, in the words the attach refusal repeats. */
   reason: string;
+  /** The residents whose containers still run the pre-deploy image (issue
+   *  1931): the deploy's reconcile marks the Durable Objects but the platform
+   *  replaces the container processes asynchronously, so "reconciled" is not
+   *  "swapped" — each hold stands until that resident reports its running
+   *  container on the deploy's image, and the fleet reopens on the LAST
+   *  report, a fact, never a wait. Absent or empty: no swap outstanding. */
+  holds?: string[];
+  /** Whether `POST /undrain` already asked for the lift while holds stood:
+   *  the record then clears itself on the last hold's report instead of
+   *  waiting for a second lift. */
+  liftAsked?: boolean;
 }
 
 /** The longest a drain may run, and the default, from the one clock table
@@ -88,7 +99,50 @@ export function liveDrain(stored: unknown, now: number): DrainRecord | null {
     return null;
   const until = Date.parse(r.until);
   if (!Number.isFinite(until) || until <= now) return null;
-  return { since: r.since, until: r.until, by: r.by, reason: r.reason };
+  const holds = Array.isArray(r.holds) ? r.holds.filter((h): h is string => typeof h === "string") : [];
+  return {
+    since: r.since,
+    until: r.until,
+    by: r.by,
+    reason: r.reason,
+    ...(holds.length > 0 ? { holds } : {}),
+    ...(r.liftAsked === true ? { liftAsked: true } : {}),
+  };
+}
+
+/** The record with the named residents held (issue 1931): the deploy's
+ *  reconcile could not verify their running containers on the new image, so
+ *  the fleet must not reopen onto them until each reports. Deduplicated;
+ *  an empty set changes nothing. */
+export function holdDrain(record: DrainRecord, resources: readonly string[]): DrainRecord {
+  const holds = [...new Set([...(record.holds ?? []), ...resources])];
+  if (holds.length === 0) return record;
+  return { ...record, holds };
+}
+
+/** `POST /undrain`'s decision over the stored record: with no holds the drain
+ *  clears; with holds outstanding the fleet STAYS closed — the record keeps
+ *  standing with `liftAsked`, so the last container's new-image report lifts
+ *  it (a fact, never a timer; `until` remains the backstop for a report that
+ *  never comes). */
+export function liftDrain(record: DrainRecord): { cleared: true } | { cleared: false; record: DrainRecord } {
+  const holds = record.holds ?? [];
+  if (holds.length === 0) return { cleared: true };
+  return { cleared: false, record: { ...record, liftAsked: true } };
+}
+
+/** One resident's word that its running container is on the deploy's image:
+ *  its hold drops; when it was the last hold and the lift was already asked,
+ *  the drain lifts here — the reopen fires on the last container's report. */
+export function reportImageCurrent(
+  record: DrainRecord,
+  resource: string,
+): { lifted: boolean; record: DrainRecord | null } {
+  const holds = (record.holds ?? []).filter((h) => h !== resource);
+  const next: DrainRecord = { ...record, ...(holds.length > 0 ? { holds } : {}) };
+  if (holds.length === 0) delete next.holds;
+  if (holds.length === 0 && record.liftAsked === true) return { lifted: true, record: null };
+  return { lifted: false, record: next };
 }
 
 /** The `/attach` answer while the fleet is drained: a 503 whose body carries

package/dist/assets/deploy/cloudflare-resident/worker.ts

@@ -343,7 +343,15 @@ import {
 } from "../../src/execution/residentDepsStore.js";
 import { buildId, injectedBuildStamp } from "../../src/deploy/buildStamp.js";
 import { createRefreshInstance, createRefreshInstanceNow, type RefreshInstanceParams } from "./refresh";
-import { drainRefusal, liveDrain, parseDrainRequest, type DrainRecord } from "./drain";
+import {
+  drainRefusal,
+  holdDrain,
+  liftDrain,
+  liveDrain,
+  parseDrainRequest,
+  reportImageCurrent,
+  type DrainRecord,
+} from "./drain";
 import {
   CGROUP_READ_ARGV,
   MEMORY_PRESSURE_REASON,
@@ -1434,6 +1442,10 @@ const TEST_OVERRIDES_KEY = "testOverrides";
  *  counts as a slot; it survives the isolate swap a deploy performs, which is
  *  why the record carries its own end. */
 const DRAIN_KEY = "drain";
+/** Resident-DO key (issue 1931): set when a deploy's reconcile could not
+ *  verify this resident's container on the new image; the next reconcile that
+ *  finds it current reports to the registry and clears it. */
+const IMAGE_REPORT_PENDING_KEY = "imageReportPending";
 
 type OnboardResult = { ok: true; record: ResidentRecord } | { ok: false; status: number; error: string };
 
@@ -1568,12 +1580,50 @@ export class ResidentRegistryDO extends DurableObject<Env> {
     return record;
   }
 
-  /** Admin-only by construction (POST /undrain): true when a record was there.
-   *  A cleared drain posts `below` — the plane's resident-drain window lifts. */
-  async clearDrain(): Promise<boolean> {
+  /** Admin-only by construction (POST /undrain): `cleared` when a record was
+   *  there and was lifted — a cleared drain posts `below`, the plane's
+   *  resident-drain window lifts. With holds outstanding (issue 1931: a
+   *  container still to report the deploy's image) the fleet STAYS closed:
+   *  the record stands with `liftAsked` and the last container's report lifts
+   *  it (`reportContainerImageCurrent`); `until` remains the backstop. */
+  async clearDrain(): Promise<{ cleared: boolean; held: string[] }> {
+    const record = liveDrain(await this.ctx.storage.get(DRAIN_KEY), systemClock());
+    if (record !== null) {
+      const lift = liftDrain(record);
+      if (!lift.cleared) {
+        await this.ctx.storage.put(DRAIN_KEY, lift.record);
+        return { cleared: false, held: lift.record.holds ?? [] };
+      }
+    }
     const had = await this.ctx.storage.delete(DRAIN_KEY);
     if (had) await this.pushDrainPost("below");
-    return had;
+    return { cleared: had, held: [] };
+  }
+
+  /** The deploy's reconcile could not verify these residents' containers on
+   *  the new image (issue 1931): hold the drain for each — the fleet must not
+   *  reopen onto them until they report. No live drain, nothing to hold. */
+  async holdDrainFor(resources: string[]): Promise<void> {
+    const record = liveDrain(await this.ctx.storage.get(DRAIN_KEY), systemClock());
+    if (record === null || resources.length === 0) return;
+    await this.ctx.storage.put(DRAIN_KEY, holdDrain(record, resources));
+  }
+
+  /** One resident's word that its running container is on the deploy's image:
+   *  its hold drops, and when it was the last hold of a lift already asked the
+   *  drain lifts here — the reopen fires on the last container's report. */
+  async reportContainerImageCurrent(resource: string): Promise<{ lifted: boolean }> {
+    const record = liveDrain(await this.ctx.storage.get(DRAIN_KEY), systemClock());
+    if (record === null) return { lifted: false };
+    const report = reportImageCurrent(record, resource);
+    if (report.record === null) {
+      await this.ctx.storage.delete(DRAIN_KEY);
+      await this.pushDrainPost("below");
+      console.log(`[drain] fleet reopened — ${resource} was the last container to report the deploy's image`);
+      return { lifted: true };
+    }
+    await this.ctx.storage.put(DRAIN_KEY, report.record);
+    return { lifted: false };
   }
 
   /** The one alarm, at the drain's `until` (record 0064): a drain past
@@ -4936,41 +4986,121 @@ export class ResidentDO extends Sandbox<Env> {
    *  registration whose release never came defers it only until the clean-idle
    *  sweep drains that registration. Answers `restarted` when a stop was
    *  issued, else why not. */
-  private async reconcileImage(where: string): Promise<ImageReconcileResult> {
-    if (!(await this.isRuntimeActive().catch(() => false))) return "inactive";
+  private async reconcileImage(where: string, force = false): Promise<ImageReconcileResult> {
+    if (!(await this.isRuntimeActive().catch(() => false))) {
+      // An inactive container's next start is on the deployed image by
+      // construction — and a held resident whose container idled out has no
+      // other reporter left: new attaches are refused by the very drain the
+      // hold keeps standing, so without this report the fleet stays closed
+      // until the drain's `until` backstop (issue 1931).
+      await this.reportPendingImageCurrent(where);
+      return "inactive";
+    }
     const last = THREAD_USERS[THREAD_USERS.length - 1];
-    const probe = await this.run(["id", "-u", last]);
-    if (probe.exitCode === 0) return "current";
+    // A pending report marker (issue 1931) means a deploy could not verify this
+    // container on its image: the probe shortcut below is a POOL-USER check the
+    // pre-deploy image passes when the pool did not change, so it can never
+    // satisfy the marker — the container is treated as stale until it is cycled
+    // post-deploy and the fresh start reported.
+    const pending = await this.ctx.storage.get<{ resource: string }>(IMAGE_REPORT_PENDING_KEY);
+    if (!force && pending === undefined) {
+      const probe = await this.run(["id", "-u", last]);
+      if (probe.exitCode === 0) return "current";
+    }
+    const stale = force
+      ? "the container predates the deploy"
+      : pending !== undefined
+        ? "a deploy's new-image report is pending, so the running container cannot be trusted current"
+        : `${last} missing in the running container`;
     const busy = this.inFlightCount();
     if (busy > 0) {
-      console.log(
-        `image-stale (${where}): ${last} missing but ${busy} operation(s)/attach(es) in flight — deferring restart`,
-      );
+      console.log(`image-stale (${where}): ${stale} but ${busy} operation(s)/attach(es) in flight — deferring restart`);
       return "deferred";
     }
     const registered = await this.registeredRunsBeyondOps();
     if (registered > 0) {
       console.log(
-        `image-stale (${where}): ${last} missing but ${registered} run registration(s) live — deferring restart until the resident is quiet`,
+        `image-stale (${where}): ${stale} but ${registered} run registration(s) live — deferring restart until the resident is quiet`,
       );
       return "deferred";
     }
-    console.log(
-      `image-stale (${where}): ${last} missing in the running container — stopping so it restarts on the current image`,
-    );
+    console.log(`image-stale (${where}): ${stale} — stopping so it restarts on the current image`);
     this.swapIncarnation(); // deliberate incarnation swap
     await this.stop().catch((err) => console.log(`image-stale: stop failed: ${errMsg(err)}`));
+    if (pending !== undefined) {
+      // The post-deploy cycle just happened: probe the FRESH container — the
+      // SDK boots it for this command on the image the deployed Worker pins,
+      // so a fresh start answering after the deploy is the verified fact
+      // (issue 1931), never the pool-user probe on the old process. A failed
+      // probe keeps the marker: the next reconcile tries the cycle again.
+      const fresh = await this.run(["id", "-u", last])
+        .then((p) => p.exitCode === 0)
+        .catch(() => false);
+      if (fresh) await this.reportPendingImageCurrent(where);
+      else
+        console.log(`image-stale (${where}): the fresh container's probe failed — the new-image report stays pending`);
+    }
     return "restarted";
   }
 
+  /** The report a held drain waits for (issue 1931): when the deploy's
+   *  reconcile could not verify this resident's fresh container on the new
+   *  image, a marker stays in storage and the registry holds the drain. The
+   *  fact the report stands on is a fresh container start AFTER the deploy —
+   *  the marker makes `reconcileImage` treat the container as stale until the
+   *  cycle happens, so this is called only behind that fresh start (or on an
+   *  inactive resident, whose next start is on the new image by construction).
+   *  The marker is deleted only after a successful report: a transient failure
+   *  keeps it for the next reconcile, and the drain's `until` is the backstop
+   *  for a report that never lands. */
+  private async reportPendingImageCurrent(where: string): Promise<boolean> {
+    const pending = await this.ctx.storage.get<{ resource: string }>(IMAGE_REPORT_PENDING_KEY);
+    if (pending === undefined) return true;
+    try {
+      const { lifted } = await registryStub(this.env).reportContainerImageCurrent(pending.resource);
+      await this.ctx.storage.delete(IMAGE_REPORT_PENDING_KEY);
+      console.log(
+        `[reconcile] ${pending.resource} reports the deploy's image (${where})${lifted ? " — drain lifted" : ""}`,
+      );
+      return true;
+    } catch (err) {
+      console.log(
+        `[reconcile] ${pending.resource}: the new-image report failed (${where}): ${errMsg(err)} — retried on the next reconcile`,
+      );
+      return false;
+    }
+  }
+
   /** The deploy's reconcile, inside the drain window (item 69's order: the
    *  runs in flight end, the swap lands, the containers reconcile, the fleet
    *  reopens): `POST /reconcile` calls this on every resident after the Worker
-   *  deploy landed and BEFORE the drain is lifted, so a container that
-   *  predates the new image restarts while nothing can be admitted onto it —
-   *  never under the first run the reopened fleet admits. */
-  async reconcileForDeploy(): Promise<{ result: ImageReconcileResult }> {
-    return { result: await this.reconcileImage("deploy") };
+   *  deploy landed and BEFORE the drain is lifted. The pool-user probe cannot
+   *  tell the pre-deploy image from the new one when the pool did not change,
+   *  and the platform replaces the container processes asynchronously after an
+   *  image-changing deploy (issue 1931) — so this path never trusts "current":
+   *  an active, quiet container is always cycled, and the fresh start —
+   *  necessarily on the deploy's image, which landed before this call — is
+   *  probed. `verified` true is the fact the reopen may stand on; anything
+   *  else (deferred, a failed fresh probe) leaves a hold on the drain, cleared
+   *  by this resident's later report (`reportPendingImageCurrent`), never by a
+   *  timer.
+   *
+   *  The hold lands BEFORE the marker: the marker is what lets any concurrent
+   *  attach/refresh reconcile report, and a report that reaches the registry
+   *  before the hold is a no-op — the marker would be consumed and the hold
+   *  added afterwards would wait for a report nothing sends (until the drain's
+   *  `until`). Held first, every report finds its hold. */
+  async reconcileForDeploy(resource: string): Promise<{ result: ImageReconcileResult; verified: boolean }> {
+    await registryStub(this.env).holdDrainFor([resource]);
+    await this.ctx.storage.put(IMAGE_REPORT_PENDING_KEY, { resource });
+    const result = await this.reconcileImage("deploy", true);
+    if (result === "deferred") return { result, verified: false };
+    // Inactive: the inactive early-return reported (the next start is on the
+    // new image by construction). Restarted: the cycle's fresh probe and
+    // report ran inside reconcileImage. Either way the marker gone is the
+    // verification.
+    const verified = (await this.ctx.storage.get(IMAGE_REPORT_PENDING_KEY)) === undefined;
+    return { result, verified };
   }
 
   // -- watchdog (the sparse cron; it re-arms nothing) --------------------------
@@ -9118,32 +9248,47 @@ async function handleDrain(env: Env, body: Record<string, unknown>): Promise<Res
   return json({ draining: record, planeOutbox: await registryStub(env).getDrainOutbox() });
 }
 
-/** POST /undrain (admin): reopen the fleet. Idempotent — `cleared` says whether
- *  a drain stood. */
+/** POST /undrain (admin): reopen the fleet. Idempotent — `cleared` says
+ *  whether a drain stood and was lifted. With containers still to report the
+ *  deploy's image (issue 1931) the fleet STAYS closed: `held` names them, the
+ *  record stands with the lift asked, and the last container's report reopens
+ *  the fleet — a fact, never a timer; the drain's `until` is the backstop. */
 async function handleUndrain(env: Env): Promise<Response> {
-  const cleared = await registryStub(env).clearDrain();
-  console.log(`[drain] fleet reopened (${cleared ? "a drain stood" : "no drain stood"})`);
-  return json({ draining: null, cleared, planeOutbox: await registryStub(env).getDrainOutbox() });
+  const lift = await registryStub(env).clearDrain();
+  if (!lift.cleared && lift.held.length > 0) {
+    console.log(`[drain] fleet stays closed — containers still to report the deploy's image: ${lift.held.join(", ")}`);
+    const draining = liveDrain(await registryStub(env).getDrain(), systemClock());
+    return json({ draining, cleared: false, held: lift.held, planeOutbox: await registryStub(env).getDrainOutbox() });
+  }
+  console.log(`[drain] fleet reopened (${lift.cleared ? "a drain stood" : "no drain stood"})`);
+  return json({ draining: null, cleared: lift.cleared, planeOutbox: await registryStub(env).getDrainOutbox() });
 }
 
 /** POST /reconcile (drain scope): reconcile every resident's container onto
  *  the current image — the deploy runner posts it after its Worker deploy
  *  landed and BEFORE its `/undrain`, so a stale container restarts inside the
  *  drain window (item 69's order) and never under a run the reopened fleet
- *  admits. Each resident answers what its reconcile decided; a failing one
- *  degrades to `error` without touching its neighbors, and a `deferred` or
- *  failed one restarts on its own next quiet attach or refresh cycle. */
+ *  admits. Each resident answers what its reconcile decided and whether its
+ *  fresh container was VERIFIED on the deploy's image (issue 1931); one not
+ *  verified — deferred, a failed fresh probe, an error — leaves a hold on the
+ *  drain, so the fleet reopens only on that container's later report. */
 async function handleReconcile(env: Env): Promise<Response> {
   const residents = await registryStub(env).list();
   const settled = await Promise.allSettled(
-    residents.map((record) => residentStub(env, record.resource).reconcileForDeploy()),
+    residents.map((record) => residentStub(env, record.resource).reconcileForDeploy(record.resource)),
   );
   const reconciled = residents.map((record, i) => {
     const s = settled[i];
     return s.status === "fulfilled"
-      ? { resource: record.resource, result: s.value.result }
-      : { resource: record.resource, result: "error" as const, error: errMsg(s.reason) };
+      ? { resource: record.resource, result: s.value.result, verified: s.value.verified }
+      : { resource: record.resource, result: "error" as const, verified: false, error: errMsg(s.reason) };
   });
+  // Each resident held ITSELF before its marker (reconcileForDeploy), so no
+  // report can outrun its hold; this pass is the backstop for a resident whose
+  // call rejected before it could — holdDrain deduplicates, so re-holding a
+  // deferred resident changes nothing.
+  const unverified = reconciled.filter((r) => !r.verified).map((r) => r.resource);
+  if (unverified.length > 0) await registryStub(env).holdDrainFor(unverified);
   console.log(`[reconcile] deploy image reconcile: ${JSON.stringify(reconciled)}`);
   return json({ reconciled });
 }

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.255.0",
+  "version": "1.256.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.255.0",
+      "version": "1.256.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.255.0",
+      "version": "1.256.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.255.0",
+  "version": "1.256.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.255.0",
-  "commit": "b19caf8a347aca9f78503cac8525f3b3206ba2ff",
-  "builtAt": "2026-09-20T02:32:25.817Z"
+  "version": "1.256.0",
+  "commit": "fd814ee9ad2421f38178b15103d49ff4d9c5eb7c",
+  "builtAt": "2026-09-20T04:37:22.536Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -254,6 +254,31 @@ Keep notes with the \`notes\` tool: one short document, replaced whole each time
 // classes are by duration, the project's own scripts and CI say which is which.
 export const CHECKS_BY_COST = `CHECKS BY COST — push before the expensive ones. Every check you might run has a cost class: seconds (a formatter or a linter on the files you touched, one test file, a docs, link or spec check, the typecheck of one package) or minutes (the whole test suite, a build, a dependency install, an end-to-end or full verification). Know a command's class before you run it — from the project's own scripts and CI configuration, from how long it took last time, or by the class above when you have nothing better. Prove each change with the cheapest check that can prove it, matched to the change's scope and scoped to the changed set — the tests nearest your change, the touched project's typecheck, the changed files' formatting, never the whole tree: a documentation change gets the documentation checks, one module gets its own tests, a shared type gets the typecheck. Every CI pipeline runs the tests, the types, the formatting and the full verification on your push, so you never run them again: you validate and fix your own change before pushing, at the changed-set scope. Passing the full test suite and the full typecheck is NOT part of your criteria: CI is that gate and the only place they run — on a shared machine they cost minutes that every other run pays for. As soon as the change exists and those checks pass, commit and push — the pushed branch is the deliverable, and an unpushed tree does not survive the run's end. Beyond the changed set, use judgement about what this change needs rather than a checklist, fixing forward with further commits and pushes. Never start an operation whose expected duration does not fit the time you have left minus what a commit, a push and the description need: push what there is and say plainly what is unverified instead. At the wind-down note, commit and push what compiles, say what does not, then answer. ${TIMEOUT_ON_LONG_COMMANDS} The description's validation names exactly what ran; what did not run is CI's to gate, and you say so.`;
 
+// Every coding prompt carries this verbatim, right after the checks-by-cost
+// rule (docs/reference/specs/agent-coding.md item 13; issue 1796): the fast
+// gates before every push, each the changed-set form with its command named,
+// and the full verification named as CI's gate. The paragraph lived in the
+// ship contract's first instruction alone, so every ask that was not a plan
+// unit had to repeat it by hand or watch the run spend most of its budget on
+// the whole suite or the full verification before its first push (issue 1909
+// measured three such command shapes at 85–95 % of a child's life). One
+// constant, one text: the three coding variants carry the same bytes, the
+// contract's first instruction points here instead of re-stating it
+// (src/core/ship/contract.ts), and no requester repeats it. Unlike the
+// checks-by-cost rule above, this paragraph names its commands on purpose —
+// children handed only the classes chose wrong in both directions — and a
+// repository on another stack maps each gate by its class.
+export const TOUCHED_TESTS_COMMAND = "`npx vitest run` on the test files you touched, by name,";
+
+export const FAST_GATES_BEFORE_PUSH =
+  "THE FAST GATES, before every push — each scoped to the changed set, never the whole project: " +
+  `${TOUCHED_TESTS_COMMAND} once (never \`--changed\`, never a directory: on a moving base that is most of the suite), ` +
+  "`tsc --noEmit -p` the touched tsconfig under `NODE_OPTIONS=--max-old-space-size=6144`, " +
+  "`npx prettier --check` on the changed files, `npm run hygiene:check` and `npm run specs:check` — " +
+  "then your judgement on what else this change needs, not a longer checklist. The full verification is " +
+  "CI's gate — `npm run verify` runs there on your push, never here: push a head early and let CI judge it, " +
+  "fixing forward with further commits and pushes.";
+
 const CODING_SYSTEM = `You are Switchboard's coding agent, operating from a Slack request.
 
 You work inside a dedicated workspace directory with bash, read_file, and write_file tools. ${SANDBOX_TOOLCHAIN}
@@ -276,6 +301,8 @@ Workflow for shipping a PR:
 
 ${CHECKS_BY_COST}
 
+${FAST_GATES_BEFORE_PUSH}
+
 ${NEVER_MERGE}
 
 ${UNIT_CONTRACT}
@@ -323,6 +350,8 @@ Workflow for shipping a change:
 
 ${CHECKS_BY_COST}
 
+${FAST_GATES_BEFORE_PUSH}
+
 ${NEVER_MERGE}
 
 ${UNIT_CONTRACT}
@@ -366,6 +395,8 @@ Workflow for shipping a change:
 
 ${CHECKS_BY_COST}
 
+${FAST_GATES_BEFORE_PUSH}
+
 ${NEVER_MERGE}
 
 ${UNIT_CONTRACT}

package/dist/assets/src/core/coordinator/driver.ts

@@ -316,7 +316,11 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
   // The hard stop's mark, as the bot's answer carries it (record 0060; issue
   // 1924): a finished child's unit ends stopped on it.
   const stopped = a.body.stopped === true ? { stopped: true as const } : {};
-  if (!run.finished) return { type: "read-record", step, run: { finished: false }, ...stopped, at: a.body.at };
+  // The interrupted child restarted from its request (issue 1903): the bot
+  // answers the live successor's id, and the machine keeps the wait on it.
+  const restarted = typeof a.body.restartedAs === "string" ? { restartedAs: a.body.restartedAs } : {};
+  if (!run.finished)
+    return { type: "read-record", step, run: { finished: false }, ...stopped, ...restarted, at: a.body.at };
   if (typeof run.status !== "string") throw new UnreadableAnswer("read-record", a, "status");
   // The typed artifacts as the bot's record carries them — shape-checked where
   // they were written (the run record's validator), read here as they are.
@@ -337,6 +341,7 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
     costUsd,
     handoffLists,
     failure,
+    interruption,
   } = facts;
   return {
     type: "read-record",
@@ -363,6 +368,11 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
       // The failure by name (run-history item 57), shape-checked: a
       // `provider_transient` drives the round-0 re-run (agent-ship item 9).
       ...(isRecord(failure) && typeof failure.kind === "string" ? { failure: { kind: failure.kind } } : {}),
+      // What ended an interrupted child (issue 1876): the ending's sentence
+      // names the cause instead of claiming a bot restart for every one.
+      ...(interruption === "bot_restart" || interruption === "container_replaced" || interruption === "sandbox_fault"
+        ? { interruption }
+        : {}),
     },
     at: a.body.at,
   };

package/dist/assets/src/core/pipelineStanding.ts

@@ -130,6 +130,63 @@ export const ENDING_STAGE = {
   blocked: "ended",
 } as const satisfies Record<UnitEnding["kind"] | "blocked", Stage | "hold">;
 
+/** The user's words for a unit's ending (record 0066): what a card, a plan
+ *  summary and the web unit page print instead of the internal token —
+ *  `merge_ready` reads `merge-ready`, `round_cap` reads `round cap reached`,
+ *  never the snake_case kind. Pinned to the union plus `blocked` (the driver's
+ *  never-started status), so a new ending kind fails the build here. */
+export const ENDING_WORDS = {
+  merged: "merged",
+  already_landed: "merged",
+  merge_ready: "merge-ready",
+  held: "held",
+  merge_refused: "not merged",
+  round_cap: "round cap reached",
+  wall_clock_cap: "out of budget",
+  review_pending: "review pending",
+  stopped: "stopped",
+  aborted: "aborted",
+  transient: "aborted",
+  continued: "continuing",
+  no_verdict: "no verdict",
+  interrupted: "interrupted",
+  refused: "refused",
+  idle: "idle",
+  blocked: "blocked",
+} as const satisfies Record<UnitEnding["kind"] | "blocked", string>;
+
+/** The user's words for a round outcome (record 0066): the card's unit line
+ *  prints these beside the round header, never `checks_failed` or another
+ *  internal token. Pinned to the union: a new outcome fails the build here. */
+export const ROUND_OUTCOME_WORDS = {
+  started: "started",
+  pr_opened: "pull request opened",
+  completed: "done",
+  approve: "approved",
+  request_changes: "changes requested",
+  no_verdict: "no verdict",
+  checks_failed: "checks failed",
+  transient: "retried",
+  enqueued: "queued to merge",
+  dequeued: "removed from the merge queue",
+  aborted: "aborted",
+  stopped: "stopped",
+  continued: "continuing",
+  idle: "idle",
+} as const satisfies Record<ShipRoundOutcome, string>;
+
+/** The user's word for any ending or unit-status token — total over strings
+ *  read off a stored row, so an unknown word prints as itself rather than
+ *  throwing on an older record. */
+export function endingWordOf(kind: string): string {
+  return (ENDING_WORDS as Record<string, string>)[kind] ?? kind;
+}
+
+/** The user's word for any round-outcome token, total like `endingWordOf`. */
+export function roundOutcomeWordOf(outcome: string): string {
+  return (ROUND_OUTCOME_WORDS as Record<string, string>)[outcome] ?? outcome;
+}
+
 type ShipEvent = Extract<RunEvent, { type: "ship_round" } | { type: "ship_unit" }>;
 
 function isShipEvent(e: RunEvent): e is ShipEvent {

package/dist/assets/src/core/reviewVerdict.ts

@@ -33,6 +33,7 @@
 
 import { normalizeHead } from "./reviewedHead.js";
 import { redactSecrets } from "./redact.js";
+import { shows, type Verbosity } from "./verbosity.js";
 
 export type ReviewVerdictKind = "approve" | "request_changes";
 
@@ -248,6 +249,37 @@ export function verdictLine(verdict: ReviewVerdict | undefined): string {
   return summary ? `${token} ${summary}` : token;
 }
 
+/** The counted plural for a severity: `blocker` and `nit` inflect, `major`
+ *  and `minor` read as adjectives and stay uninflected. */
+function severityCount(sev: FindingSeverity, n: number): string {
+  if (sev === "blocking") return `${n} blocker${n === 1 ? "" : "s"}`;
+  if (sev === "nit") return `${n} nit${n === 1 ? "" : "s"}`;
+  return `${n} ${sev}`;
+}
+
+/** The verdict as ONE line in the user's words (record 0066): `LGTM` for an
+ *  approve, `Changes requested: 2 blockers, 1 major, 2 minor, 3 nits` — only
+ *  the non-zero counts, most severe first — for a request for changes, the
+ *  bare token word when the findings were not itemized or none were filed.
+ *  The quiet thread reply prints this and nothing more; the full verdict line
+ *  and the finding bullets are `verbose` material and stay on the pull
+ *  request, where the post-step put them. */
+export function verdictCountsLine(verdict: ReviewVerdict): string {
+  if (verdict.verdict === "approve") return "LGTM";
+  const counts = severityCounts(verdict.findings ?? []);
+  return counts ? `Changes requested: ${counts}` : "Changes requested";
+}
+
+/** The non-zero severity counts of a finding list, most severe first —
+ *  `2 blockers, 1 major, 2 minor, 3 nits` — or the empty string for none.
+ *  Shared by the quiet verdict line and the quiet round-cap report. */
+export function severityCounts(findings: readonly Finding[]): string {
+  return FINDING_SEVERITIES.map((sev) => [sev, findings.filter((f) => f.severity === sev).length] as const)
+    .filter(([, n]) => n > 0)
+    .map(([sev, n]) => severityCount(sev, n))
+    .join(", ");
+}
+
 /** One compact finding line — `[severity] id file[:line] — title` — shared by
  *  the posted body's list (bulleted below) and ship's synthesized child turns. */
 export function formatFinding(f: Finding): string {
@@ -381,6 +413,13 @@ export function buildReviewPostBody(
  * opt-out, a guard refusal) or findings not itemized (a list that says
  * nothing is no substitute) — so the review's text is always somewhere a
  * person reads it. No verdict → the bare answer with the link, as before.
+ *
+ * The request's verbosity decides how much of the verdict the thread hears
+ * (routing-and-config item 28, record 0066): below `verbose`, a verdict whose
+ * findings are itemized and posted to GitHub is ONE line — `verdictCountsLine`
+ * with the pull request link — because the full verdict, the finding lines and
+ * the prose already stand on the pull request; at `verbose`, and whenever the
+ * text would otherwise land nowhere a person reads it, the full render above.
  */
 export function buildReviewChannelReply(input: {
   answer: string;
@@ -388,8 +427,18 @@ export function buildReviewChannelReply(input: {
   /** The PR the post landed on, or undefined when nothing was posted. */
   posted: { repo: string; number: number } | undefined;
   liveUrl: string | undefined;
+  /** The request's level (default `verbose`: the full render, the row's shape). */
+  verbosity?: Verbosity;
 }): string {
   const { answer, verdict, posted, liveUrl } = input;
+  if (
+    !shows(input.verbosity ?? "verbose", "verbose") &&
+    verdict !== undefined &&
+    verdict.findings !== undefined &&
+    posted !== undefined
+  ) {
+    return `${verdictCountsLine(verdict)} — https://github.com/${posted.repo}/pull/${posted.number}`;
+  }
   const tail = [
     ...(posted && verdict ? [`Posted to ${posted.repo}#${posted.number}`] : []),
     ...(liveUrl ? [`[Live run](${liveUrl})`] : []),