@coreplane/switchboard 1.256.0 → 1.258.0

package/dist/assets/config/config.example.yaml

@@ -132,6 +132,20 @@ defaults:
   #   maxIdentity: write
   #   machines: [none, blank, repo-cold, repo-resident]
   #   confirm: write
+  # Watch until merge (docs/reference/specs/routing-and-config.md item 32;
+  # agent-ship.md item 21): keep a merge-ready pipeline unit on its pull
+  # request until the pull request merges — each push to its base that leaves
+  # it conflicting buys one rebase of the sweep's resolver. OFF by default.
+  # `rebaseInFlight` caps the watch's rebases per repository (default 1);
+  # `spendLimitUsd` caps one pull request's model rounds — read in whole
+  # rounds today, so the default buys one rebase round per pull request and
+  # a finer value has no extra effect yet. This block is the
+  # org tier; `config set org --pulls.…` layers over it at run time, and
+  # `config set repo --repo <owner/name> --pulls.…` overrides per repository.
+  # pulls:
+  #   watch: false
+  #   rebaseInFlight: 1
+  #   spendLimitUsd: 5
 
 # PR reviews and the reading diff (docs/reference/specs/reading-diff.md). Every
 # review records its full `git diff`; the ABRIDGED version (meat.dev, run on

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -79,11 +79,16 @@ import {
 } from "../../src/core/runLedger/decisions.ts";
 import { intakeReceiptRetentionMs, minutesToMs, PLANE } from "../../src/core/budgets.ts";
 import {
+  causeOfClose,
+  causeOfReclaim,
   decide,
   effectCapRefusal,
   planeAskAnswerOf,
   planeAskWordOf,
   RESIDENT_DRAIN_WINDOW,
+  type PlaneEndingCause,
+  type PlaneReclaimWord,
+  type HeartbeatFacts,
   type PlaneAskAnswer,
   type PlaneLevelRow,
   type PlaneAckOutcome,
@@ -96,6 +101,7 @@ import {
   type PlaneState,
   type PlaneWrite,
 } from "../../src/core/plane/decide.ts";
+import { mergePlaneFindings, planeFindingKey, type PlaneFinding } from "../../src/core/plane/findings.ts";
 import {
   IDEMPOTENCY_KEY_PATTERN,
   capThreadEvent,
@@ -103,6 +109,7 @@ import {
   isCoordinatorInstance,
   isCoordinatorUnit,
   isThreadEvent,
+  sendChildSignal,
   sendRunFinished,
   UNIT_PATTERN,
   type CoordinatorInstance,
@@ -1777,6 +1784,12 @@ export class RunHistoryDO extends DurableObject<Env> {
         generation TEXT NOT NULL,
         PRIMARY KEY (resident, name)
       );
+      CREATE TABLE IF NOT EXISTS plane_endings (
+        run_id TEXT PRIMARY KEY,
+        kind TEXT NOT NULL,
+        cause TEXT NOT NULL,
+        at INTEGER NOT NULL
+      );
     `);
   }
 
@@ -1793,13 +1806,20 @@ export class RunHistoryDO extends DurableObject<Env> {
     // a dispatch that died between the admission answer and its claim must not
     // hold the thread forever. Promotion deletes the row (the live row holds
     // the thread from there), so age alone is the test.
+    // `steer` and `park` rows (record 0064) have no expiry window: a steer's
+    // dedupe row and a parked run's wait live until the run's seal deletes them.
     const reservations = this.sql
       .exec<{ kind: string; key: string; run_id: string; at: number }>(
-        `SELECT * FROM plane_reservations WHERE kind = 'thread' AND at > ?`,
+        `SELECT * FROM plane_reservations WHERE kind != 'thread' OR at > ?`,
         now - minutesToMs(PLANE.reservationMinutes),
       )
       .toArray()
-      .map((r): PlaneReservation => ({ kind: "thread", key: r.key, runId: r.run_id, at: r.at }));
+      .map((r): PlaneReservation => ({
+        kind: r.kind as PlaneReservation["kind"],
+        key: r.key,
+        runId: r.run_id,
+        at: r.at,
+      }));
     const openWindows = this.sql
       .exec<{ kind: string }>(`SELECT kind FROM plane_windows WHERE phase = 'open'`)
       .toArray()
@@ -1877,7 +1897,22 @@ export class RunHistoryDO extends DurableObject<Env> {
           w.row.at,
         );
       } else if (w.table === "plane_reservations" && w.op === "del") {
-        this.sql.exec(`DELETE FROM plane_reservations WHERE kind = 'thread' AND key = ?`, w.key);
+        this.sql.exec(`DELETE FROM plane_reservations WHERE kind = ? AND key = ?`, w.kind ?? "thread", w.key);
+      } else if (w.table === "run_inbox" && w.op === "push") {
+        // The plane's steer into a live run's durable inbox (record 0064;
+        // run-history item 40), in the decider's own transaction: the run reads
+        // it at its next boundary like any follow-up; a run with no live row
+        // reads nothing and the row would be an orphan, so it is skipped.
+        if (!this.liveRow(w.runId)) continue;
+        const last = this.sql
+          .exec<{ m: number | null }>(`SELECT MAX(seq) AS m FROM run_inbox WHERE run_id = ?`, w.runId)
+          .one().m;
+        this.sql.exec(
+          `INSERT INTO run_inbox (run_id, seq, json) VALUES (?, ?, ?)`,
+          w.runId,
+          (last ?? 0) + 1,
+          JSON.stringify(w.message),
+        );
       } else if (w.table === "plane_windows" && w.op === "put") {
         this.sql.exec(
           `INSERT OR REPLACE INTO plane_windows (kind, key, phase, opened_at, reason_json) VALUES (?, ?, 'open', ?, '{}')`,
@@ -1896,6 +1931,38 @@ export class RunHistoryDO extends DurableObject<Env> {
           w.row.reportedAt,
           w.row.generation,
         );
+      } else if (w.table === "plane_findings") {
+        // A finding (record 0064, "Endings and the watches"): keyed by watch
+        // and subject, so two findings on one subject are ONE row — an
+        // existing row absorbs the timeline through the same merge the
+        // decider's module defines, its first-seen stamp kept.
+        const key = planeFindingKey(w.finding);
+        const prior = this.sql
+          .exec<{ timeline_json: string; filed_at: number }>(
+            `SELECT timeline_json, filed_at FROM plane_findings WHERE id = ?`,
+            key,
+          )
+          .toArray()[0];
+        const existing = prior
+          ? [
+              {
+                watch: w.finding.watch,
+                subject: w.finding.subject,
+                timeline: JSON.parse(prior.timeline_json) as PlaneFinding["timeline"],
+                firstAt: Number(prior.filed_at),
+                lastAt: w.finding.lastAt,
+              },
+            ]
+          : [];
+        const merged = mergePlaneFindings(existing, w.finding)[0]!;
+        this.sql.exec(
+          `INSERT OR REPLACE INTO plane_findings (id, watch, subject, timeline_json, filed_at) VALUES (?, ?, ?, ?, ?)`,
+          key,
+          merged.watch,
+          merged.subject,
+          JSON.stringify(merged.timeline),
+          merged.firstAt,
+        );
       } else {
         // The effect bounds (record 0064): an offer past the per-run or total
         // cap is refused by the cap's name — the throw aborts the transaction,
@@ -2016,9 +2083,20 @@ export class RunHistoryDO extends DurableObject<Env> {
    *  drain posts land as the resident-drain window's open (`above`) and lift
    *  (`below` — a `cleared` or the alarm's `expired`). */
   planeLevel(
-    post: { resident: string; name: "seat" | "memory" | "drain"; side: "below" | "above"; generation: string },
+    post:
+      | { resident: string; name: "seat" | "memory" | "drain"; side: "below" | "above"; generation: string }
+      | { provider: string; name: "provider"; side: "up" | "down" },
     now: number,
   ): { admitted: number } {
+    // The model proxy's provider level (record 0064): `up` re-issues every
+    // held turn parked on the provider — the steers land as inbox writes in the
+    // decider's transaction — and walks anything queued on `provider_up`.
+    if (post.name === "provider") {
+      const r = this.planeApply({ kind: "provider_level", at: now, provider: post.provider, level: post.side });
+      const admitted = r.effects.filter((e) => e.kind === "admit").length;
+      console.log(`[plane/level] provider ${post.provider} ${post.side} — ${admitted} admission(s)`);
+      return { admitted };
+    }
     const r =
       post.name === "drain"
         ? this.planeApply({
@@ -2040,6 +2118,20 @@ export class RunHistoryDO extends DurableObject<Env> {
     return { admitted };
   }
 
+  /** A run parked on its provider (`POST /plane/park`, record 0064): the
+   *  proxy could not complete the turn after its retry; the harness holds the
+   *  turn and the provider's next `up` steers the run to re-issue it. */
+  planePark(runId: string, provider: string, now: number): { parked: boolean } {
+    let parked = false;
+    this.ctx.storage.transactionSync(() => {
+      const decision = decide(this.planeState(), { kind: "park", at: now, runId, provider });
+      this.applyPlaneWrites(decision.writes);
+      parked = decision.writes.length > 0;
+    });
+    console.log(`[plane/park] run ${runId} on ${provider} — ${parked ? "parked" : "already parked"}`);
+    return { parked };
+  }
+
   /** A refusal-by-name the bot met at attach or exec (`POST /plane/observe`,
    *  record 0064): an admitted run re-enters the queue at its old position. */
   planeObserve(post: { runId: string; resident: string; refusal: string }, now: number): { reentered: boolean } {
@@ -2084,6 +2176,54 @@ export class RunHistoryDO extends DurableObject<Env> {
     if (set === null || set > due) await this.ctx.storage.setAlarm(due);
   }
 
+  /** The earliest instant the plane must wake at (record 0064): the
+   *  earliest hosting deadline, lease end or re-ask across its rows. A due
+   *  already past re-offers at the re-ask cadence, never in a hot loop, and
+   *  contributes nothing to end a run — the alarm only offers. */
+  private planeEarliestDue(now: number): number | undefined {
+    const dues: number[] = [];
+    const reoffer = now + this.planeReaskMs();
+    for (const r of this.sql
+      .exec<{ lease_until: number; state_json: string }>(`SELECT lease_until, state_json FROM live_runs`)
+      .toArray()) {
+      dues.push(r.lease_until > now ? r.lease_until : reoffer);
+      try {
+        const hosting = (JSON.parse(r.state_json) as Record<string, unknown>).hosting as { until?: unknown };
+        if (typeof hosting?.until === "number") dues.push(hosting.until > now ? hosting.until : reoffer);
+      } catch {
+        // A malformed state contributes no deadline.
+      }
+    }
+    if (this.planeWaitsOnResident()) dues.push(reoffer);
+    return dues.length === 0 ? undefined : Math.min(...dues);
+  }
+
+  /** The plane's one alarm (record 0064): set to the earliest due across
+   *  its rows — the owner's heartbeat, moving the lease end, moves an alarm
+   *  the plane armed; an alarm someone else armed earlier is left to fire
+   *  first (the handler re-arms). The armed slot is judged directly, never
+   *  the meta row alone: the slot is shared with the re-ask and the sweep and
+   *  a fired alarm is consumed, so a meta row equal to a static due (a
+   *  hosting deadline) can claim a wake that no longer exists. The due is
+   *  capped to the sweep interval so the retention sweep never starves behind
+   *  a distant hosting deadline. */
+  private async ensurePlaneAlarm(now: number): Promise<void> {
+    const raw = this.planeEarliestDue(now);
+    const prior = this.sql.exec<{ value: string }>(`SELECT value FROM meta WHERE key = 'plane_alarm_at'`).toArray()[0];
+    const priorAt = prior ? Number(prior.value) : undefined;
+    if (raw === undefined) {
+      if (prior) this.sql.exec(`DELETE FROM meta WHERE key = 'plane_alarm_at'`);
+      return; // nothing waits: the sweep's own arming stands
+    }
+    const due = Math.min(raw, now + RUN_SWEEP_INTERVAL_MS);
+    const set = await this.ctx.storage.getAlarm();
+    // Re-arm when the slot is empty, later than the due, or holds an alarm
+    // this plane armed itself; an earlier foreign alarm fires first.
+    if (set !== due && (set === null || set > due || set === priorAt)) await this.ctx.storage.setAlarm(due);
+    if (due !== priorAt)
+      this.sql.exec(`INSERT OR REPLACE INTO meta (key, value) VALUES ('plane_alarm_at', ?)`, String(due));
+  }
+
   /** A window's open or lift over the RPC seam (`/plane/deploy`; a later
    *  unit's `plane window lift`): kind `deploy` is the pending deploy. */
   planeWindow(window: string, phase: "opened" | "lifted", now: number): { admitted: number } {
@@ -2108,6 +2248,78 @@ export class RunHistoryDO extends DurableObject<Env> {
     return this.planeState().queue.find((r) => r.runId === runId) ?? null;
   }
 
+  /** The ending's cause (record 0064, "Endings and the watches"): one
+   *  `ended { kind, cause }` per closed row, recorded only when a live row
+   *  closes and first-writer-wins — a roll that resumes every row assigns
+   *  nothing. One keyed exception, taken only by the finish (`supersedes`): a
+   *  standing `resident_replaced` was a `restarting` close — the run carried
+   *  on under its own id (run-history item 42's restart) — so that run's own
+   *  later finish replaces it and the ending agrees with the record. The bot
+   *  renders the word; the object never renders. */
+  private recordPlaneEnding(
+    runId: string,
+    kind: string,
+    cause: PlaneEndingCause,
+    at: number,
+    supersedes = false,
+  ): PlaneEndingCause {
+    this.sql.exec(
+      `INSERT OR IGNORE INTO plane_endings (run_id, kind, cause, at) VALUES (?, ?, ?, ?)`,
+      runId,
+      kind,
+      cause,
+      at,
+    );
+    const standing = this.sql
+      .exec<{ cause: string }>(`SELECT cause FROM plane_endings WHERE run_id = ?`, runId)
+      .toArray()[0];
+    if (
+      supersedes &&
+      standing !== undefined &&
+      standing.cause === "resident_replaced" &&
+      cause !== "resident_replaced"
+    ) {
+      this.sql.exec(`UPDATE plane_endings SET kind = ?, cause = ?, at = ? WHERE run_id = ?`, kind, cause, at, runId);
+      return cause;
+    }
+    return (standing?.cause as PlaneEndingCause | undefined) ?? cause;
+  }
+
+  /** The reclaim's outcome per row (record 0064; run-history item 36): only a
+   *  `closed` row records an ending — `lease_lapsed`, which is true and blames
+   *  nobody — and the standing cause is answered back so the bot's interrupted
+   *  note renders the plane's word. `resume`, `restart` and `rehost` record
+   *  nothing: the run carries on. */
+  planeReclaimed(
+    outcomes: readonly { runId: string; outcome: PlaneReclaimWord }[],
+    now: number,
+  ): { recorded: { runId: string; cause: PlaneEndingCause }[] } {
+    const recorded: { runId: string; cause: PlaneEndingCause }[] = [];
+    this.ctx.storage.transactionSync(() => {
+      for (const o of outcomes) {
+        const cause = causeOfReclaim(o.outcome);
+        if (cause === undefined) continue;
+        recorded.push({ runId: o.runId, cause: this.recordPlaneEnding(o.runId, "interrupted", cause, now) });
+      }
+    });
+    if (outcomes.length > 0)
+      console.log(
+        `[plane/reclaimed] ${outcomes.map((o) => `${o.runId}=${o.outcome}`).join(", ")} — ${recorded.length} ending(s) recorded`,
+      );
+    return { recorded };
+  }
+
+  /** One recorded ending (record 0064), or none: what a reader renders. */
+  planeEndingOf(runId: string): { kind: string; cause: PlaneEndingCause; at: number } | null {
+    const row = this.sql
+      .exec<{ kind: string; cause: string; at: number }>(
+        `SELECT kind, cause, at FROM plane_endings WHERE run_id = ?`,
+        runId,
+      )
+      .toArray()[0];
+    return row ? { kind: row.kind, cause: row.cause as PlaneEndingCause, at: row.at } : null;
+  }
+
   /** The seal (record 0064, "The queue"): the run's own open effects are
    *  dropped — an admit for a run that just ended is stale — then the sealed
    *  event frees the thread and walks the queue, all in one transaction. */
@@ -2118,6 +2330,9 @@ export class RunHistoryDO extends DurableObject<Env> {
         // Exact id matching (`admit:<runId>`), never LIKE: a bot-minted run id
         // can carry `%` or `_`, which a pattern would read as wildcards.
         this.sql.exec(`DELETE FROM plane_effects WHERE acked_at IS NULL AND id = 'admit:' || ?`, runId);
+        // The run's steer dedupe rows and any park go with it (record 0064):
+        // a sealed run holds no turn and reads no steer.
+        this.sql.exec(`DELETE FROM plane_reservations WHERE kind IN ('steer', 'park') AND run_id = ?`, runId);
         const decision = decide(this.planeState(), { kind: "sealed", at: now, threadKey });
         this.applyPlaneWrites(decision.writes);
         effects = decision.effects;
@@ -2527,11 +2742,35 @@ export class RunHistoryDO extends DurableObject<Env> {
         JSON.stringify(req.state ?? {}),
       );
     });
+    if (out.ok) {
+      // A `restartOf` claim under a coordinator (record 0064): the plane
+      // tells the waiting parent the child resumed — best effort, beside the
+      // bot's own announcement; a duplicate is consumed and re-armed, harmless.
+      if (req.meta.restartOf !== undefined && req.meta.parentInstanceId !== undefined) {
+        const sent = await sendChildSignal(this.env.SHIP_COORDINATOR, {
+          runId: req.runId,
+          parentInstanceId: req.meta.parentInstanceId,
+          kind: "resumed",
+          reason: `restarted from run ${req.meta.restartOf}`,
+          at: now,
+        });
+        if (sent.kind === "failed")
+          console.warn(`[runs/claim] ${req.runId} → ${sent.type} not delivered to ${sent.instance}: ${sent.reason}`);
+      }
+      // The lease end joins the plane's alarm (record 0064): armed at the earliest due.
+      await this.ensurePlaneAlarm(now);
+    }
     return out;
   }
 
   /** Extends the lease iff the caller owns the run; answers what another generation asked for. */
-  async heartbeat(runId: string, gen: string, leaseMs: number, now: number): Promise<HeartbeatAnswer> {
+  async heartbeat(
+    runId: string,
+    gen: string,
+    leaseMs: number,
+    now: number,
+    facts?: HeartbeatFacts,
+  ): Promise<HeartbeatAnswer> {
     let out: HeartbeatAnswer = { ok: false, reason: "unknown-run" };
     this.ctx.storage.transactionSync(() => {
       const row = this.liveRow(runId);
@@ -2541,11 +2780,28 @@ export class RunHistoryDO extends DurableObject<Env> {
         return;
       }
       this.sql.exec(`UPDATE live_runs SET lease_until = ? WHERE run_id = ?`, now + leaseMs, runId);
+      // The heartbeat body (record 0064): the facts are judged for the
+      // checkpoint steer in this same transaction, so the inbox row and its
+      // dedupe row land with the lease or not at all. A cap throw here must
+      // not undo the lease of a healthy run, so the decision guards itself.
+      if (facts !== undefined) {
+        try {
+          const decision = decide(this.planeState(), { kind: "heartbeat", at: now, runId, facts });
+          this.applyPlaneWrites(decision.writes);
+          if (decision.writes.some((w) => w.table === "run_inbox"))
+            console.log(`[plane/steer] run ${runId} round ${facts.round} — checkpoint steer written`);
+        } catch (err) {
+          console.warn(`[plane/steer] run ${runId}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
       // The plane's open effects ride every owner's heartbeat answer (record
       // 0064; orchestration-plane item 7) — empty until a unit writes them, but always present, so the
       // client's ack loop needs no version probe.
       out = { ok: true, stop: row.stop, phase: row.phase, effects: this.openPlaneEffects() };
     });
+    // The owner's heartbeat refreshes the lease, so the plane's alarm moves
+    // with it (record 0064): re-armed only when the earliest due changed.
+    if (out.ok) await this.ensurePlaneAlarm(now);
     return out;
   }
 
@@ -2688,6 +2944,16 @@ export class RunHistoryDO extends DurableObject<Env> {
       }
       const put = this.upsertInTransaction(record, proposal);
       this.deleteLiveRows([runId]);
+      // The ending's cause (record 0064), recorded exactly when the live
+      // row closes: the record's own status word, `restarting` reading as the
+      // resident replacement the reattach path observed.
+      this.recordPlaneEnding(
+        runId,
+        record.status,
+        causeOfClose(record.status, record.restarting === true),
+        record.finishedAt,
+        true,
+      );
       turnedFinal = put.turnedFinal;
       out = { ok: true, stored: put.stored };
     });
@@ -3199,8 +3465,25 @@ export class RunHistoryDO extends DurableObject<Env> {
         const probes = this.planeApply({ kind: "reask", at: now, cadenceMs: this.planeReaskMs() }).effects;
         if (probes.length > 0) console.log(`[plane/reask] ${probes.map((e) => e.id).join(", ")}`);
       }
+      // A lease end offers the row to a generation other than its owner and
+      // never ends a run (record 0064): the row stays exactly as it is —
+      // any reclaim can take it now — and the open effects are re-pushed so a
+      // listening bot sweeps sooner. The owner's next heartbeat refreshes an
+      // unreclaimed row and moves the alarm on.
+      const lapsed = this.sql
+        .exec<{ run_id: string; owner_gen: string }>(
+          `SELECT run_id, owner_gen FROM live_runs WHERE lease_until <= ?`,
+          now,
+        )
+        .toArray();
+      if (lapsed.length > 0) {
+        console.log(
+          `[plane/alarm] ${lapsed.length} lease(s) lapsed (${lapsed.map((l) => l.run_id).join(", ")}) — offered to any generation but the owner; nothing closed`,
+        );
+        this.pushPlaneEffects(this.openPlaneEffects());
+      }
       await this.ctx.storage.setAlarm(now + RUN_SWEEP_INTERVAL_MS);
-      await this.ensurePlaneReaskAlarm(now);
+      await this.ensurePlaneAlarm(now);
       root.end("ok", { swept: deleted });
     } catch (err) {
       root.fail(err);
@@ -4583,8 +4866,12 @@ const PLANE_ROUTES = new Set([
   "/plane/queued",
   "/plane/level",
   "/plane/observe",
+  "/plane/park",
+  "/plane/reclaimed",
 ]);
 
+const PLANE_RECLAIM_WORDS = new Set(["resume", "restart", "rehost", "closed"]);
+
 const PLANE_LEVEL_NAMES = new Set(["seat", "memory", "drain"]);
 const PLANE_LEVEL_SIDES = new Set(["below", "above"]);
 
@@ -4675,6 +4962,14 @@ async function handlePlane(pathname: string, body: unknown, env: Env): Promise<R
     }
   }
   if (pathname === "/plane/level") {
+    // The model proxy's provider level (record 0064): `up` on a relayed
+    // success, `down` on a failure past its one retry.
+    if (b.name === "provider") {
+      if (typeof b.provider !== "string" || b.provider.length === 0)
+        return json({ error: "provider must be a non-empty string" }, 400);
+      if (b.side !== "up" && b.side !== "down") return json({ error: "side must be up or down" }, 400);
+      return json(await stub.planeLevel({ provider: b.provider, name: "provider", side: b.side }, now));
+    }
     // A resident's level report (record 0064): forwarded by the bot from the levels a
     // resident answer carried, or from the registry's drain outbox.
     if (typeof b.resident !== "string" || b.resident.length === 0)
@@ -4706,11 +5001,34 @@ async function handlePlane(pathname: string, body: unknown, env: Env): Promise<R
       return json({ error: "refusal must be a non-empty string" }, 400);
     return json(await stub.planeObserve({ runId: parsed.value, resident: b.resident, refusal: b.refusal }, now));
   }
+  if (pathname === "/plane/park") {
+    // A run parked on its provider (record 0064).
+    const parsed = parseRunId(b.runId);
+    if (!parsed.ok) return json({ error: parsed.error }, 400);
+    if (typeof b.provider !== "string" || b.provider.length === 0)
+      return json({ error: "provider must be a non-empty string" }, 400);
+    return json(await stub.planePark(parsed.value, b.provider, now));
+  }
   if (pathname === "/plane/withdraw") {
     const parsed = parseRunId(b.runId);
     if (!parsed.ok) return json({ error: parsed.error }, 400);
     return json(await stub.planeWithdraw(parsed.value, now));
   }
+  if (pathname === "/plane/reclaimed") {
+    // The reclaim's outcome per row (record 0064; run-history item 36): only
+    // `closed` records an ending; the standing causes are answered back.
+    if (!Array.isArray(b.outcomes)) return json({ error: "outcomes must be an array" }, 400);
+    const outcomes: { runId: string; outcome: PlaneReclaimWord }[] = [];
+    for (const o of b.outcomes as unknown[]) {
+      const row = o as Record<string, unknown>;
+      const parsed = parseRunId(row?.runId);
+      if (!parsed.ok) return json({ error: parsed.error }, 400);
+      if (typeof row.outcome !== "string" || !PLANE_RECLAIM_WORDS.has(row.outcome))
+        return json({ error: "outcome must be resume, restart, rehost or closed" }, 400);
+      outcomes.push({ runId: parsed.value, outcome: row.outcome as PlaneReclaimWord });
+    }
+    return json(await stub.planeReclaimed(outcomes, now));
+  }
   if (pathname === "/plane/queued") {
     const parsed = parseRunId(b.runId);
     if (!parsed.ok) return json({ error: parsed.error }, 400);
@@ -4801,6 +5119,11 @@ function parseClaim(b: Record<string, unknown>): Validated<ClaimRequest> {
     if (typeof meta.idempotencyKey !== "string" || !IDEMPOTENCY_KEY_PATTERN.test(meta.idempotencyKey))
       return invalid("run.meta.idempotencyKey must be <parentInstanceId>:<step>");
   }
+  // The restart tag (record 0064) names the predecessor run whose windows the
+  // claim reuses and rides the `child-resumed` event's reason: a run id or
+  // absent, never another shape.
+  if (meta.restartOf !== undefined && (typeof meta.restartOf !== "string" || !RUN_ID_PATTERN.test(meta.restartOf)))
+    return invalid("run.meta.restartOf must be a run id");
   if (typeof r.system !== "string") return invalid("run.system must be a string");
   if (!Array.isArray(r.tools)) return invalid("run.tools must be an array");
   if (r.card !== undefined && r.card !== null) {
@@ -5220,7 +5543,17 @@ async function handleLedger(pathname: string, body: unknown, env: Env): Promise<
     // The RPC type mapping reads the effects' open-ended `request` JSON as
     // unserializable; the values are plain JSON, so the cast only restores the
     // declared shape (as the reclaim route's does).
-    const r = (await stub.heartbeat(runId.value, g.value, lease.value, now)) as unknown as HeartbeatAnswer;
+    // The heartbeat body (record 0064): plain JSON facts, validated by
+    // shape — a malformed body beats without facts rather than dropping the lease.
+    const facts =
+      typeof b.facts === "object" &&
+      b.facts !== null &&
+      typeof (b.facts as Record<string, unknown>).round === "number" &&
+      typeof (b.facts as Record<string, unknown>).coding === "boolean" &&
+      typeof (b.facts as Record<string, unknown>).startedAt === "number"
+        ? (b.facts as unknown as HeartbeatFacts)
+        : undefined;
+    const r = (await stub.heartbeat(runId.value, g.value, lease.value, now, facts)) as unknown as HeartbeatAnswer;
     return r.ok ? json(r) : json(r, 409);
   }
   if (pathname === "/runs/append") {

package/dist/assets/deploy/cloudflare-resident/drain.ts

@@ -30,6 +30,14 @@ export interface DrainRecord {
    *  container on the deploy's image, and the fleet reopens on the LAST
    *  report, a fact, never a wait. Absent or empty: no swap outstanding. */
   holds?: string[];
+  /** The hold's own liveness bound (issue 2044): stamped when the first hold
+   *  lands, the cycle's measured bound out (`DRAIN.cycleBoundMinutes`, clamped
+   *  to `until`). The gate asked the containers to cycle, so it owns the
+   *  outcome: past this time a cycle that never happened reopens the fleet
+   *  anyway — `liveDrain` reads the record as no drain — with the stale
+   *  containers named in the registry's warning, never a silence to `until`.
+   *  A record without it (an older build's) keeps `until` as its only end. */
+  holdsUntil?: string;
   /** Whether `POST /undrain` already asked for the lift while holds stood:
    *  the record then clears itself on the last hold's report instead of
    *  waiting for a second lift. */
@@ -42,6 +50,9 @@ export interface DrainRecord {
  *  and a half, not a day. */
 export const DRAIN_MAX_MINUTES: number = DRAIN.maxMinutes;
 export const DRAIN_DEFAULT_MINUTES: number = DRAIN.defaultMinutes;
+/** The post-deploy container cycle's measured bound (issue 2044): a hold that
+ *  outlives it reopens the fleet with the container named stale. */
+export const HOLD_CYCLE_BOUND_MINUTES: number = DRAIN.cycleBoundMinutes;
 const REASON_MAX = 200;
 const BY_MAX = 80;
 
@@ -100,24 +111,55 @@ export function liveDrain(stored: unknown, now: number): DrainRecord | null {
   const until = Date.parse(r.until);
   if (!Number.isFinite(until) || until <= now) return null;
   const holds = Array.isArray(r.holds) ? r.holds.filter((h): h is string => typeof h === "string") : [];
+  const holdsUntil = typeof r.holdsUntil === "string" ? r.holdsUntil : undefined;
+  // The hold's liveness (issue 2044): holds whose cycle bound has passed are a
+  // cycle that never happened — the fleet reopens by construction, whoever
+  // died between the reconcile and the lift; `staleHolds` names the containers.
+  if (holds.length > 0 && holdsUntil !== undefined) {
+    const bound = Date.parse(holdsUntil);
+    if (Number.isFinite(bound) && bound <= now) return null;
+  }
   return {
     since: r.since,
     until: r.until,
     by: r.by,
     reason: r.reason,
     ...(holds.length > 0 ? { holds } : {}),
+    ...(holds.length > 0 && holdsUntil !== undefined ? { holdsUntil } : {}),
     ...(r.liftAsked === true ? { liftAsked: true } : {}),
   };
 }
 
+/** The stale containers of a stored record whose hold bound has passed while
+ *  its `until` had not (issue 2044): what `liveDrain` just reopened past, for
+ *  the registry's warning — the reopen is never silent about who never cycled.
+ *  Null when the record is not that case (no holds, bound still ahead, or the
+ *  record expired on `until` itself). */
+export function staleHolds(stored: unknown, now: number): string[] | null {
+  if (typeof stored !== "object" || stored === null) return null;
+  const r = stored as Record<string, unknown>;
+  const until = Date.parse(typeof r.until === "string" ? r.until : "");
+  if (!Number.isFinite(until) || until <= now) return null;
+  const holds = Array.isArray(r.holds) ? r.holds.filter((h): h is string => typeof h === "string") : [];
+  const bound = Date.parse(typeof r.holdsUntil === "string" ? r.holdsUntil : "");
+  if (holds.length === 0 || !Number.isFinite(bound) || bound > now) return null;
+  return holds;
+}
+
 /** The record with the named residents held (issue 1931): the deploy's
  *  reconcile could not verify their running containers on the new image, so
  *  the fleet must not reopen onto them until each reports. Deduplicated;
- *  an empty set changes nothing. */
-export function holdDrain(record: DrainRecord, resources: readonly string[]): DrainRecord {
+ *  an empty set changes nothing. The first hold stamps the record's cycle
+ *  bound (issue 2044): the reconcile just asked each container to cycle, so
+ *  the cycle either lands within its measured bound or is not coming — past
+ *  `holdsUntil` the fleet reopens with the holdouts named, `until` staying
+ *  the last resort for a record from before the bound. */
+export function holdDrain(record: DrainRecord, resources: readonly string[], now: number): DrainRecord {
   const holds = [...new Set([...(record.holds ?? []), ...resources])];
   if (holds.length === 0) return record;
-  return { ...record, holds };
+  const bound = Math.min(Date.parse(record.until), now + minutesToMs(HOLD_CYCLE_BOUND_MINUTES));
+  const holdsUntil = record.holdsUntil ?? new Date(bound).toISOString();
+  return { ...record, holds, holdsUntil };
 }
 
 /** `POST /undrain`'s decision over the stored record: with no holds the drain
@@ -140,7 +182,10 @@ export function reportImageCurrent(
 ): { lifted: boolean; record: DrainRecord | null } {
   const holds = (record.holds ?? []).filter((h) => h !== resource);
   const next: DrainRecord = { ...record, ...(holds.length > 0 ? { holds } : {}) };
-  if (holds.length === 0) delete next.holds;
+  if (holds.length === 0) {
+    delete next.holds;
+    delete next.holdsUntil;
+  }
   if (holds.length === 0 && record.liftAsked === true) return { lifted: true, record: null };
   return { lifted: false, record: next };
 }