@coreplane/switchboard 1.256.0 → 1.257.0

package/dist/assets/deploy/cloudflare-resident/worker.ts

@@ -350,6 +350,7 @@ import {
   liveDrain,
   parseDrainRequest,
   reportImageCurrent,
+  staleHolds,
   type DrainRecord,
 } from "./drain";
 import {
@@ -1604,9 +1605,15 @@ export class ResidentRegistryDO extends DurableObject<Env> {
    *  the new image (issue 1931): hold the drain for each — the fleet must not
    *  reopen onto them until they report. No live drain, nothing to hold. */
   async holdDrainFor(resources: string[]): Promise<void> {
-    const record = liveDrain(await this.ctx.storage.get(DRAIN_KEY), systemClock());
+    const now = systemClock();
+    const record = liveDrain(await this.ctx.storage.get(DRAIN_KEY), now);
     if (record === null || resources.length === 0) return;
-    await this.ctx.storage.put(DRAIN_KEY, holdDrain(record, resources));
+    const held = holdDrain(record, resources, now);
+    await this.ctx.storage.put(DRAIN_KEY, held);
+    // The hold's liveness alarm (issue 2044): the cycle bound is the earlier
+    // end, so the alarm fires there — reopening the fleet with the stale
+    // containers named — instead of at `until`, the last resort.
+    if (held.holdsUntil !== undefined) await this.ctx.storage.setAlarm(Date.parse(held.holdsUntil));
   }
 
   /** One resident's word that its running container is on the deploy's image:
@@ -1635,11 +1642,25 @@ export class ResidentRegistryDO extends DurableObject<Env> {
     const stored = await this.ctx.storage.get(DRAIN_KEY);
     if (stored === undefined) return;
     if (liveDrain(stored, now) === null) {
+      // The hold's liveness (issue 2044): a reopen past the cycle bound names
+      // the containers whose post-deploy cycle never landed — a warning, never
+      // a silence; each restarts on its own next quiet attach or refresh.
+      const stale = staleHolds(stored, now);
+      if (stale !== null)
+        console.log(
+          `[drain] fleet reopened with ${stale.join(", ")} still on the pre-deploy image — the post-deploy cycle did not land within its bound; a stale container restarts on its next quiet attach or refresh`,
+        );
       await this.ctx.storage.delete(DRAIN_KEY);
       await this.pushDrainPost("below");
     } else {
-      // Replaced with a later end under an already-armed alarm: re-arm at it.
-      await this.ctx.storage.setAlarm(Date.parse((stored as DrainRecord).until));
+      // Replaced with a later end under an already-armed alarm: re-arm at the
+      // record's own earlier end — the hold's cycle bound when one stands.
+      const record = stored as DrainRecord;
+      const ends = [
+        Date.parse(record.until),
+        ...(record.holdsUntil !== undefined ? [Date.parse(record.holdsUntil)] : []),
+      ];
+      await this.ctx.storage.setAlarm(Math.min(...ends.filter(Number.isFinite)));
     }
   }
 
@@ -3261,6 +3282,14 @@ export class ResidentDO extends Sandbox<Env> {
       await this.writeDiskMarkers({ ready: sha, depsKey: lockfileHash, builtSha: sha });
       this.deleteSchedules(PROVISIONING_CALLBACK);
       await this.setResidentState("warm");
+      // A fresh provision runs on the image the deployed Worker pins, so it IS
+      // the cycle a held drain waits for (issue 2044): report it — a rebuild
+      // mid-drain reopens the fleet instead of leaving the hold standing on a
+      // report `reconcileImage` would never send for a container it never saw
+      // as stale. The marker is cleared with the report; a failure keeps both
+      // for the next reconcile, and the hold's cycle bound is the backstop.
+      await this.ctx.storage.put(IMAGE_REPORT_PENDING_KEY, { resource });
+      await this.reportPendingImageCurrent("provision");
       // The first refresh instance is the cron's: the row now reads `warm`
       // with no instance recorded, so the next firing creates it (item 9).
     } catch (err) {
@@ -7597,6 +7626,19 @@ export class ResidentDO extends Sandbox<Env> {
   }
 
   private async runOpTraced(op: "test" | "build", refArg: string | null, t0: number): Promise<OpRunOk | ThreadErr> {
+    // The fleet drain (item 69; issue 2044): a typed op is a new piece of work
+    // like a new run's attach, and during the incident one waited silently at
+    // the drain — so it is answered with the drain's own record at once, a
+    // deterministic refusal the command surfaces as its reason, never a wait.
+    const drain = await this.fleetDrain();
+    if (drain !== null) {
+      return {
+        error: `op-refused: the resident fleet is drained for ${drain.reason} (asked by ${drain.by}, ends by ${drain.until}) — re-run the command when the fleet reopens`,
+        status: 503,
+        reason: "draining",
+        cause: "system",
+      };
+    }
     try {
       await this.ensureHydrated();
     } catch (err) {
@@ -8070,6 +8112,7 @@ export class ResidentDO extends Sandbox<Env> {
       AUTO_REBUILDS_KEY,
       INFRA_STREAK_KEY,
       MEMORY_KEY,
+      IMAGE_REPORT_PENDING_KEY,
     ]);
     const facts = map.get(FACTS_KEY) as RepoFacts | undefined;
     const snap = map.get(SNAPSHOT_KEY) as SnapshotRecord | undefined;
@@ -8147,6 +8190,11 @@ export class ResidentDO extends Sandbox<Env> {
       inFlight: this.inFlightCount() + registeredRuns,
       // The runs alone (no refresh cycle): what the deploy preflight refuses on.
       runsInFlight: this.runsInFlightCount() + registeredRuns,
+      // Issue 2044: whether this container's new-image report is still owed —
+      // `pending` names a resident a held drain waits on, so `repo list` and
+      // the deploy's readers never print a bare "warm" for a repository whose
+      // running container the last deploy could not verify.
+      imageReport: map.get(IMAGE_REPORT_PENDING_KEY) !== undefined ? "pending" : "current",
       // Item 22: who holds what, as the rows say — the mirror mutex and the
       // cycle/hydration leases, each judged against this incarnation.
       incarnation: this.incarnation,

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.256.0",
+  "version": "1.257.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.256.0",
+      "version": "1.257.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.256.0",
+      "version": "1.257.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.256.0",
+  "version": "1.257.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
@@ -39,9 +39,9 @@
     "cli": "tsx src/cli.ts",
     "verify": "npm run verify:root && npm run verify --workspaces --if-present && npm run check:site",
     "verify:root": "npm run check:consistency && npm run typecheck && npm run lint && npm run format:check && npm test && npm run check:dist",
-    "check:consistency": "npm run check:lockfile && npm run check:sandbox-pair && npm run skills:check && npm run check:deps-drift && npm run licenses:check && npm run docs:check && npm run pr-title:check && npm run specs:check && npm run decisions:check && npm run hygiene:check && npm run check:project-facts && npm run check:registry-drift && npm run agents:check && npm run clock:check && npm run screenshots:check",
+    "check:consistency": "npm run check:lockfile && npm run check:sandbox-pair && npm run skills:check && npm run check:deps-drift && npm run licenses:check && npm run docs:check && npm run pr-title:check && npm run specs:check && npm run decisions:check && npm run hygiene:check && npm run vocabulary:check && npm run check:project-facts && npm run check:registry-drift && npm run agents:check && npm run clock:check && npm run screenshots:check",
     "ci:gate": "node scripts/ci-gate.mjs",
-    "fix": "npm run docs:gen && npm run pr-title:gen && npm run agents:gen && npm run clock:gen && npm run hygiene:gen && npm run deploy:gen && npm run skills:sync && npm run lint:fix && npm run format",
+    "fix": "npm run docs:gen && npm run pr-title:gen && npm run agents:gen && npm run clock:gen && npm run hygiene:gen && npm run vocabulary:gen && npm run deploy:gen && npm run skills:sync && npm run lint:fix && npm run format",
     "deploy:gen": "npm run --silent cli -- deploy init",
     "deploy:check": "npm run --silent cli -- deploy init --check",
     "check:lockfile": "node scripts/check-lockfile.mjs",
@@ -73,6 +73,8 @@
     "decisions:check": "tsx scripts/decisions-check.ts",
     "hygiene:check": "node scripts/public-hygiene.mjs",
     "hygiene:gen": "node scripts/public-hygiene.mjs --write",
+    "vocabulary:check": "node scripts/vocabulary-check.mjs",
+    "vocabulary:gen": "node scripts/vocabulary-check.mjs --write",
     "docs:changed": "node scripts/docs-changed.mjs",
     "deploy:targets": "node scripts/deploy-targets.mjs",
     "docs:dev": "npm run dev -w docs --",

package/dist/assets/project.json

@@ -32,7 +32,7 @@
   "commands": {
     "$comment": "What each root npm script does and when to run it — the source of the Commands table in AGENTS.md (npm run agents:gen). A script without an entry fails agents:check, so a new script cannot ship undocumented.",
     "verify": {
-      "does": "The whole gate: every root check, every workspace's verify, the site check — exactly what CI runs.",
+      "does": "The whole gate: every check, every workspace — exactly what CI runs.",
       "when": "Local sessions, before requesting review. ~4 min. A pipeline agent leaves it to CI."
     },
     "verify:root": {
@@ -40,11 +40,11 @@
       "when": "When only the bot changed."
     },
     "check:consistency": {
-      "does": "The sub-second checks that generated and declared things equal the code (lockfile, sandbox pairs, skills, licenses, docs tables, specs, project facts, this table).",
+      "does": "The sub-second checks that generated and declared things equal the code, this table included.",
       "when": "After touching a generated or declared artifact; one CI leg."
     },
     "test": {
-      "does": "The whole vitest suite (bot, web, the plain-Node Worker tests) from one entry, after `deploy:gen`.",
+      "does": "The whole vitest suite from one entry, after `deploy:gen`.",
       "when": "Local sessions, before pushing; a pipeline agent runs the changed set — the full suite is CI's."
     },
     "typecheck": {
@@ -160,21 +160,29 @@
       "when": "After renaming a test or editing a spec; `-- --fix` makes truncated titles explicit."
     },
     "specs:coverage": {
-      "does": "Maps a change's paths to the specs whose `Code`/`Tests` headers cover them, then lists changed source paths no spec covers.",
+      "does": "Maps a change's paths to the specs whose headers cover them, then lists paths no spec covers.",
       "when": "`-- --changed origin/main...HEAD [--test-guard]` before review; `-- --require` fails on an uncovered path; `-- --json` for machines."
     },
     "decisions:check": {
-      "does": "Every record under `docs/decisions/` and `docs/plans/` has a valid `status`, a superseded one names its successor, an accepted body only gains an appended `## Amended`.",
-      "when": "Part of `check:consistency`; a failing record is superseded or amended by appending, never edited."
+      "does": "Every record under `docs/decisions/` and `docs/plans/` has a valid `status`, a superseded one names its successor, an accepted body only gains `## Amended`.",
+      "when": "Part of `check:consistency`; a failing record is superseded or amended, never edited."
     },
     "hygiene:check": {
       "does": "The public tree's imprint (company, people, trackers, plan ids, ids, dates) equals the recorded list, which only shrinks.",
-      "when": "Part of `check:consistency`. New hit: rewrite the line or allow it in `scripts/public-hygiene.allow`."
+      "when": "Part of `check:consistency`. New hit: rewrite the line or allow it by name."
     },
     "hygiene:gen": {
       "does": "Records the tree's remaining imprint after a scrub; refuses growth unless `-- --force`.",
       "when": "Part of `fix`; new imprint fails it like `hygiene:check`."
     },
+    "vocabulary:check": {
+      "does": "No internal word prints on a user surface; the baseline only shrinks.",
+      "when": "Part of `check:consistency`; a hit is rewritten in the user's nouns."
+    },
+    "vocabulary:gen": {
+      "does": "Records the remaining internal words; refuses growth unless `-- --force`.",
+      "when": "Part of `fix`."
+    },
     "agents:gen": {
       "does": "Writes the Commands table in AGENTS.md from `package.json` and this file.",
       "when": "After adding or changing a script; part of `fix`."
@@ -220,8 +228,8 @@
       "when": "After a `web/` change."
     },
     "screenshots:gen": {
-      "does": "Renders the dashboard screenshots whose inputs changed, both themes, recording each surface's input hashes in `docs/public/screenshots/manifest/` (`--force`: all).",
-      "when": "After a `web/` or fixture change, once `screenshots:check` names it; needs `npx playwright-core install chromium`, so not in `fix`."
+      "does": "Renders the dashboard screenshots whose inputs changed, both themes, recording input hashes in the manifest (`--force`: all).",
+      "when": "After a `web/` or fixture change; needs `npx playwright-core install chromium`, so not in `fix`."
     },
     "screenshots:check": {
       "does": "Each surface's inputs still hash to what its screenshots were rendered from — no browser.",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.256.0",
-  "commit": "fd814ee9ad2421f38178b15103d49ff4d9c5eb7c",
-  "builtAt": "2026-09-20T04:37:22.536Z"
+  "version": "1.257.0",
+  "commit": "222646c5fe1a6686c238020f6571c69c3ab87e43",
+  "builtAt": "2026-09-20T15:27:11.679Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -279,6 +279,23 @@ export const FAST_GATES_BEFORE_PUSH =
   "CI's gate — `npm run verify` runs there on your push, never here: push a head early and let CI judge it, " +
   "fixing forward with further commits and pushes.";
 
+// Every coding prompt carries this verbatim, right after the fast gates
+// (agent-coding item 13; record 0071 mechanism one, issue 1747): the rebase
+// before every push, always and never configurable. Approved pull requests
+// went stale behind sibling merges and each needed a hand-posted rebase; a
+// rebase against a base the run just fetched, with the change's context still
+// in its window, is the cheapest rebase the system will ever run, so it is
+// unconditional. One constant, one text: the three coding variants carry the
+// same bytes — a ship fix round's child runs these same prompts — and the ship
+// contract's first instruction points here instead of re-stating it
+// (src/core/ship/contract.ts).
+export const REBASE_BEFORE_PUSH =
+  "REBASE BEFORE EVERY PUSH — always, not configurable. Immediately before each push: fetch your base branch, " +
+  "rebase your branch onto it, resolve any conflict with the context you already have (the repository's " +
+  "AGENTS.md says how a generated file is regenerated — regenerate it, never hand-merge it), re-run THE FAST " +
+  "GATES on the rebased tree, and only then push. Every head that reaches review is then current with its " +
+  "base when it lands, and no unit ends merge-ready behind a sibling that merged first.";
+
 const CODING_SYSTEM = `You are Switchboard's coding agent, operating from a Slack request.
 
 You work inside a dedicated workspace directory with bash, read_file, and write_file tools. ${SANDBOX_TOOLCHAIN}
@@ -303,6 +320,8 @@ ${CHECKS_BY_COST}
 
 ${FAST_GATES_BEFORE_PUSH}
 
+${REBASE_BEFORE_PUSH}
+
 ${NEVER_MERGE}
 
 ${UNIT_CONTRACT}
@@ -352,6 +371,8 @@ ${CHECKS_BY_COST}
 
 ${FAST_GATES_BEFORE_PUSH}
 
+${REBASE_BEFORE_PUSH}
+
 ${NEVER_MERGE}
 
 ${UNIT_CONTRACT}
@@ -397,6 +418,8 @@ ${CHECKS_BY_COST}
 
 ${FAST_GATES_BEFORE_PUSH}
 
+${REBASE_BEFORE_PUSH}
+
 ${NEVER_MERGE}
 
 ${UNIT_CONTRACT}
@@ -589,7 +612,7 @@ Your tools work without a workspace: the GitHub tools — \`github_repos\` (the
 
 ${statusCardRule('"Read the issue and its thread", "Post the comment"')} A one-step answer needs no checklist; post one when the request has steps the person would wait on.
 
-You cannot run commands, clone repositories, edit code, or review pull requests, and you cannot search the web — and you cannot hand off, route, forward or start another run: never say you will hand off, route, forward or start anything, because you cannot start another agent's run. Other Switchboard agents can do those things, and a plain message reaches them by itself — but only a new top-level message in the channel reaches the router; a reply in this thread comes back to you. For a code change or a pull request, say what you found and that the change is not yours to make, and that asking for it in plain words in a new top-level message in the channel — not a reply in this thread — like "in acme/api: fix the failing login test" starts the agent that makes the change, opens the PR and loops review; the same for a PR review ("review <PR URL>") and a web-research question ("compare X and Y on the web"). Never hand back a command or an \`agent:…\` line for the person to type: describe the ask in their words. Delete an issue only when the user explicitly asked to delete it (closing is an update).`;
+You cannot run commands, clone repositories, edit code, or review pull requests, and you cannot search the web — and you cannot hand off, route, forward or start another run: never say you will hand off, route, forward or start anything, because you cannot start another agent's run. Other Switchboard agents can do those things, and a plain message reaches them by itself: Switchboard's door reads every message — a reply in this thread included — and starts the right agent from the person's own words. For a code change or a pull request, say what you found and that the change is not yours to make, and that asking for it in plain words — right here in the thread or anywhere in the channel, like "in acme/api: fix the failing login test" — starts the agent that makes the change, opens the PR and loops review; the same for a PR review ("review <PR URL>") and a web-research question ("compare X and Y on the web"). NEVER tell the person to post a new top-level message, re-post, re-ask elsewhere or retype their request — their words have already been said and the door reads thread replies; and never hand back a command or an \`agent:…\` line to type: describe the ask in their words. Delete an issue only when the user explicitly asked to delete it (closing is an update).`;
 
 // The explore agent (docs/reference/specs/agent-explore.md): a long, read-only
 // investigation — "run our CI locally and validate the claims", "how long does

package/dist/assets/src/core/authz/grants.ts

@@ -13,6 +13,18 @@ import { NO_GRANTS, type Grants, type GrantSet } from "./types.js";
 /** Every grant, on every axis. What admins and the local CLI hold. */
 export const ALL_GRANTS: Grants = Object.freeze({ actions: "all", channels: "all", repos: "all" });
 
+/** The plane's system actor (record 0064; record 0057 as amended): the run
+ *  ledger object steers write-preset runs itself — the checkpoint steer and the
+ *  held turn's reissue land as `run_inbox` rows with sender `plane` — under
+ *  this one standing grant. Recorded here so the table stays the whole story:
+ *  the write happens on the object, which holds no other authority. */
+export const PLANE_ACTOR_ID = "plane";
+export const PLANE_GRANTS: Grants = Object.freeze({
+  actions: new Set(["steer:write"]),
+  channels: "all",
+  repos: "all",
+});
+
 /** The namespaces a native `grants` key may use (invariant 4). `cli:` is not
  *  configurable (the local CLI always holds everything) and `agent:` actors
  *  derive their grants from their principal, so neither is listed. */

package/dist/assets/src/core/authz/policy.ts

@@ -63,6 +63,12 @@ export const POLICY: readonly Rule[] = [
   // NAMED run (`authorizeSteerOwner`, authorization item 16a) — the requester,
   // a linked id, or `runs:write` — which no command-door row can see.
   { action: "steer:write", resource: "command", when: [grant("steer:write")] },
+  // The plane's checkpoint steer (record 0064): the system actor `plane`
+  // (`PLANE_ACTOR_ID`, a `service` actor holding `PLANE_GRANTS`' one standing
+  // `steer:write`) writes the steer into a write-preset run's inbox on the
+  // ledger object itself, sender `plane`; this row records that authority in
+  // the one table even though the object, not the bot, executes the write.
+  { action: "steer:write", resource: "run", actorKinds: ["service"], when: [grant("steer:write")] },
 
   // ── conversations ────────────────────────────────────────────────────────
   // Who may point the bot at another thread (record 0037). Asked for a
@@ -108,6 +114,11 @@ export const POLICY: readonly Rule[] = [
   // read is never a chat baseline, like the costs reads.
   { action: "providers:read", resource: "command", when: [grant("providers:read")] },
 
+  // ── pull requests ──────────────────────────────────────────────────
+  // `pulls rebase` force-pushes the pipeline's branches and can start a paid
+  // fix round (record 0071): a grant, never a chat baseline.
+  { action: "pulls:write", resource: "command", when: [grant("pulls:write")] },
+
   // ── repos ────────────────────────────────────────────────────────────────
   { action: "repo:read", resource: "command", when: [grant("repo:read")] },
   { action: "repo:write", resource: "repo", when: [grant("repo:write")] },
@@ -150,6 +161,10 @@ export const POLICY: readonly Rule[] = [
   // channel-config right — whoever may set the channel may set a thread in it;
   // never a baseline, so membership alone admits nobody.
   { action: "config:write", resource: "config-scope", resourceKind: "thread", when: [grant("config:write")] },
+  // The ORG scope (`config set org --pulls.…`, record 0071) — and a repository
+  // scope, the org setting's per-repository slice — affects every requester:
+  // the same `config:write` grant, never a baseline.
+  { action: "config:write", resource: "config-scope", resourceKind: "org", when: [grant("config:write")] },
   // A user edits only their own scope.
   { action: "config:write", resource: "config-scope", resourceKind: "user", when: [IS_SELF] },
   // The author binding's one trusted write (record 0062, authorization.md item

package/dist/assets/src/core/budgets.ts

@@ -16,6 +16,10 @@
 // Workflow-driven coordinator and the deploy Workers can bundle it — the
 // dependency runs registry → budgets, never the reverse.
 
+export const SECOND_MS = 1_000;
+
+export const secondsToMs = (seconds: number): number => seconds * SECOND_MS;
+
 export const MINUTE_MS = 60_000;
 
 /** Minutes → milliseconds, for a duration a request names in minutes (a drain's
@@ -109,6 +113,14 @@ export const DRAIN = {
   marginMinutes: 5,
   maxMinutes: 90,
   defaultMinutes: 60,
+  /** How long a held drain waits for a container's post-deploy cycle before
+   *  reopening the fleet anyway with the stale container named (issue 2044):
+   *  the platform replaces container processes three to ten minutes after a
+   *  deploy (docs/reference/specs/resident-repos.md item 65), so a cycle that
+   *  has not landed within this bound is not coming on its own — the gate
+   *  asked for the cycle, so it owns the outcome and never holds the fleet
+   *  closed to the drain's whole `until` on a report nothing will send. */
+  cycleBoundMinutes: 10,
 } as const;
 
 /** How long an intake receipt row is kept on the run history object
@@ -143,7 +155,7 @@ export type Preset = LoopPreset | "ship";
  *  that pushes at minute 29 and then runs the repo's whole gate (seven to ten
  *  minutes on a resident) was cut at 45 one run in twelve, so the ask is
  *  double the 90th percentile (31.5) with the gate inside it. Ship's holds
- *  its own loop at the default rounds with a fix round at that ask, not at
+ *  its own loop at the default rounds with a findings round at that ask, not at
  *  its floor (`fit` proves the floor case; the ask leaves room above it). */
 export const ASKS: Readonly<Record<Preset, number>> = {
   general: 5,
@@ -155,17 +167,18 @@ export const ASKS: Readonly<Record<Preset, number>> = {
   conductor: 120,
 };
 
-/** The rounds a ship loop is made of. `fix` is a coding child handed the
+/** The rounds a ship loop is made of. `findings` is a coding child handed the
  *  review's findings; `merge` is the runner's wait on the guards. */
-export type RoundKind = "coding" | "review" | "fix" | "merge";
+export type RoundKind = "coding" | "review" | "findings" | "merge";
 
 /** The least lease in which a round does useful work, in minutes. A carve that
  *  falls under the floor is refused rather than dispatched: a two-minute
- *  review or fix costs an attach and a model turn and finishes nothing.
- *  Review's is the ledger's 90th percentile of completed reviews (5.1 min over
- *  181); coding's is the least a fix round can run the repo's gate in — the
- *  gate alone takes seven to ten minutes on a resident, and a fix that cannot
- *  run it finishes nothing its contract asks; the merge wait's is a guess
+ *  review or findings round costs an attach and a model turn and finishes
+ *  nothing. Review's is the ledger's 90th percentile of completed reviews (5.1
+ *  min over 181); coding's is the least a findings round can run the repo's
+ *  gate in — the gate alone takes seven to ten minutes on a resident, and a
+ *  round that cannot run it finishes nothing its contract asks; the merge
+ *  wait's is a guess
  *  until the ledger says. */
 export const PRESET_FLOORS: Readonly<Record<LoopPreset, number>> = {
   general: 2,
@@ -177,7 +190,7 @@ export const PRESET_FLOORS: Readonly<Record<LoopPreset, number>> = {
 };
 export const FLOORS: Readonly<Record<RoundKind, number>> = {
   coding: PRESET_FLOORS.coding,
-  fix: PRESET_FLOORS.coding,
+  findings: PRESET_FLOORS.coding,
   review: PRESET_FLOORS.review,
   merge: 10,
 };
@@ -186,6 +199,12 @@ export const FLOORS: Readonly<Record<RoundKind, number>> = {
  *  when the remainder allows it. */
 export const MERGE_WAIT_ASK_MINUTES = 60;
 
+/** The sweep's bounds (record 0071, mechanism two): the short lease of the one
+ *  model round a conflicting pull request may buy, and the spend that round is
+ *  capped at per pull request — a round refused at either bound ends the pull
+ *  request's line with the conflict named, never a retry loop. */
+export const PULL_SWEEP = { leaseMinutes: 15, spendCapUsd: 5 } as const;
+
 /** The provider retry ladder (issue 1932): the backoff before each retry of a
  *  transient model-call failure — a gateway 5xx, a stream cut before
  *  `message_stop`, a gateway timeout. Three attempts with growing waits,
@@ -208,7 +227,15 @@ export const SHIP_WAIT = { marginMinutes: 5, chunkMinutes: 5, mergeChunkMinutes:
  *  it, a reservation's window, and the default re-ask cadence — how often a
  *  silent resident something waits on is probed (`plane.reaskMinutes`
  *  overrides it per deployment). */
-export const PLANE = { recentMinutes: 60, reservationMinutes: 2, reaskMinutes: 2 } as const;
+export const PLANE = {
+  recentMinutes: 60,
+  reservationMinutes: 2,
+  reaskMinutes: 2,
+  /** A coding round with no pushed head past this is steered once (record 0064, "The backpressure contract"). */
+  noPushMinutes: 15,
+  /** The line an in-flight call with NO declared bound is judged against for the same steer. */
+  noBoundMinutes: 20,
+} as const;
 
 /** The named amounts a lease holds back, in minutes. Each stands for a step
  *  every run or round pays: `provision` is attach and restore before the
@@ -328,6 +355,12 @@ export function provisionalBearerExpiresAt(now: number, leaseMinutes: number): n
   return now + (ALLOWANCES.provision + leaseMinutes + ALLOWANCES.bearerGrace) * MINUTE_MS;
 }
 
+/** The e2b credential-write exec's own timeout: the store-file write is one
+ *  `printf` plus a `git config` reset, so a minute is generous headroom while
+ *  still failing fast when the micro-VM is wedged
+ *  (docs/reference/specs/execution.md item 5). */
+export const SANDBOX_CREDENTIAL_WRITE_TIMEOUT_MS = MINUTE_MS;
+
 /** The per-command bash budget's rows: the default when a call names none, the
  *  ceiling a call may raise it to, and the floor under which a number is a
  *  typo (docs/reference/specs/execution.md item 11). */
@@ -361,19 +394,20 @@ export interface RoundPosition {
 }
 
 /** The rounds of a loop in order: the coding round, then a review and, after
- *  every review but the last, a fix, then the merge wait. */
+ *  every review but the last, a findings round, then the merge wait. */
 export function loopRounds(loop: Loop): RoundKind[] {
   const rounds: RoundKind[] = ["coding"];
   for (let i = 0; i < loop.maxRounds; i++) {
     rounds.push("review");
-    if (i < loop.maxRounds - 1) rounds.push("fix");
+    if (i < loop.maxRounds - 1) rounds.push("findings");
   }
   rounds.push("merge");
   return rounds;
 }
 
 /** Where a round sits in `loopRounds`: the coding round first; review round
- *  `n` (counted from 1) and the fix that follows it at `2n − 1` and `2n`; the
+ *  `n` (counted from 1) and the findings round that follows it at `2n − 1`
+ *  and `2n`; the
  *  merge wait last. The ship coordinator numbers its rounds this way, so the
  *  reserve it carves with is the one the fit assumed. */
 export function loopPosition(loop: Loop, kind: RoundKind, n = 0): number {
@@ -382,7 +416,7 @@ export function loopPosition(loop: Loop, kind: RoundKind, n = 0): number {
       return 0;
     case "review":
       return 2 * n - 1;
-    case "fix":
+    case "findings":
       return 2 * n;
     case "merge":
       return 2 * loop.maxRounds;
@@ -403,7 +437,7 @@ export function carveChildOfParent(
 }
 
 /** The minutes a round holds back for what must follow it in the loop: the
- *  floor plus provisioning of every later review and fix, and the merge
+ *  floor plus provisioning of every later review and findings round, and the merge
  *  wait's floor. A merge holds nothing back; a round with no loop (a
  *  conductor's child) holds nothing back either. */
 export function reserveMinutes(
@@ -419,12 +453,12 @@ export function reserveMinutes(
   return reserve;
 }
 
-/** What a round asks for: the preset's ask for a coding or fix round, the
+/** What a round asks for: the preset's ask for a coding or findings round, the
  *  review's for a review, the merge wait's own for the merge. */
 export function roundAskMinutes(kind: RoundKind): number {
   switch (kind) {
     case "coding":
-    case "fix":
+    case "findings":
       return ASKS.coding;
     case "review":
       return ASKS.review;

package/dist/assets/src/core/coordinator/contract.ts

@@ -233,6 +233,26 @@ export interface ChecksSettledPayload {
   settledAt: number;
 }
 
+/** The event the merge watch sends a waiting unit when its pull request
+ *  merged, whoever merged (record 0071, mechanism three): the unit ends
+ *  `merged` by other. The type names the unit within the instance, the
+ *  nudge's alphabet and clip rule. */
+export const PULL_MERGED_EVENT_PREFIX = "pr-merged-";
+export function pullMergedEventType(key: { instanceId: string; unit: string }): string {
+  const suffix = `-${key.unit}`;
+  const room = 100 - PULL_MERGED_EVENT_PREFIX.length - suffix.length;
+  return `${PULL_MERGED_EVENT_PREFIX}${key.instanceId.slice(0, room)}${suffix}`;
+}
+
+/** What the merged event carries — the pull request and the merge's facts;
+ *  the waiting unit confirms through its own pr-check before it acts. */
+export interface PullMergedPayload {
+  repo: string;
+  number: number;
+  sha: string;
+  mergedAt: string;
+}
+
 /** What the event carries — ids, a status and a clock; the parent confirms
  *  through `read-record` before it acts, so nothing more rides here. */
 export interface RunFinishedPayload {
@@ -379,17 +399,17 @@ export interface UnitIdle {
   wakes: number;
 }
 
-/** One unit of the plan an instance runs (a task string is a generated plan of
- *  one unit, `U1`): its branch, the units it waits on, and — as the runner
- *  reaches it — its thread, its pull request, the round boundaries the card
- *  drew and how it ended. One row a person can read for "what happened to this
- *  unit". */
 /** What the severity gate caught on a round: the level in force and the gated findings as `id (severity)`. */
 export interface RoundGate {
   level: AddressSeverity;
   findings: string[];
 }
 
+/** One unit of the plan an instance runs (a task string is a generated plan of
+ *  one unit, `U1`): its branch, the units it waits on, and — as the runner
+ *  reaches it — its thread, its pull request, the round boundaries the card
+ *  drew and how it ended. One row a person can read for "what happened to this
+ *  unit". */
 export interface CoordinatorUnit {
   instanceId: string;
   /** `U<n>` as the plan spells it. */
@@ -606,6 +626,26 @@ export async function sendChecksSettled(
   }
 }
 
+/** The one send per merged fact the watch observed (record 0071): best effort
+ *  like `sendRunFinished` — a refusal is answered, never thrown; the waiting
+ *  unit's bounded wait re-asks its own pr-check on its next chunk. */
+export async function sendPullMerged(
+  workflow: WorkflowSender | undefined,
+  key: { instanceId: string; unit: string },
+  payload: PullMergedPayload,
+): Promise<RunFinishedSend> {
+  const instance = key.instanceId;
+  if (!workflow) return { kind: "no-binding", instance };
+  const type = pullMergedEventType(key);
+  try {
+    const handle = await workflow.get(instance);
+    await handle.sendEvent({ type, payload });
+    return { kind: "sent", instance, type };
+  } catch (err) {
+    return { kind: "failed", instance, type, reason: err instanceof Error ? err.message : String(err) };
+  }
+}
+
 /** One deploy-roll signal to the child's parent (run-history item 47a): best
  *  effort like `sendRunFinished` — a refusal is answered, never thrown; a lost
  *  send costs the wait a chunk, never the round. */

package/dist/assets/src/core/coordinator/driver.ts

@@ -61,7 +61,7 @@ import {
   type UnitEnding,
   type UnitPipelineState,
   stepPrefixOf,
-  type UnitSession,
+  type LeaseSegmentProgress,
 } from "../ship/coordinator.js";
 import {
   checksSettledEventType,
@@ -451,12 +451,15 @@ function prCheckReturn(step: string, a: BotAnswer): StepReturn {
  *  ask's answer carries `retried` instead: whether the re-run was dispatched,
  *  so the machine never waits on a head an undispatched re-run left unchanged. */
 function checksReturn(step: string, a: BotAnswer): StepReturn {
-  const { ok, checks, retried, at } = a.body;
+  const { ok, checks, draft, retried, at } = a.body;
   if (ok !== true) throw new UnreadableAnswer("checks", a, "ok");
   return {
     type: "checks",
     step,
     ...(isRoundChecks(checks) ? { checks } : {}),
+    // The pull request is a draft (issue 2063): the machine's table holds the
+    // unit for the ready event instead of merging or ending without a cause.
+    ...(draft === true ? { draft: true } : {}),
     ...(typeof retried === "boolean" ? { retried } : {}),
     at,
   };
@@ -691,7 +694,7 @@ async function runUnit(
   instanceId: string,
   node: PlanUnitNode,
   plan: PlanFacts,
-  session?: UnitSession,
+  session?: LeaseSegmentProgress,
 ): Promise<UnitEnding> {
   const unit = node.id;
   // A renewal's segment names its steps under the segment (`U10/s2/…`), so