@coreplane/switchboard 1.259.0 → 1.260.0

package/dist/assets/src/core/pipelineStanding.ts

@@ -110,7 +110,9 @@ export const ROUND_STAGE = {
  *  and holds the stage, and every other kind closes the unit as `ended` with
  *  the kind as detail. `blocked` — a unit status the driver posts to
  *  `unit-end` for a unit that never started — ends the same way. Pinned to
- *  the union: a new ending kind fails the build here. */
+ *  the union: a new ending kind fails the build here. `failed` — the ending
+ *  the driver posts when a step threw inside the walk (cause `step_threw`,
+ *  issue 2100) — closes the unit the same way. */
 export const ENDING_STAGE = {
   merged: "merged",
   already_landed: "merged",
@@ -128,14 +130,17 @@ export const ENDING_STAGE = {
   interrupted: "ended",
   refused: "ended",
   idle: "idle",
+  idle_expired: "ended",
   blocked: "ended",
-} as const satisfies Record<UnitEnding["kind"] | "blocked", Stage | "hold">;
+  failed: "ended",
+} as const satisfies Record<UnitEnding["kind"] | "blocked" | "failed", Stage | "hold">;
 
 /** The user's words for a unit's ending (record 0066): what a card, a plan
  *  summary and the web unit page print instead of the internal token —
  *  `merge_ready` reads `merge-ready`, `round_cap` reads `round cap reached`,
  *  never the snake_case kind. Pinned to the union plus `blocked` (the driver's
- *  never-started status), so a new ending kind fails the build here. */
+ *  never-started status) and `failed` (the driver's step-threw ending, issue
+ *  2100), so a new ending kind fails the build here. */
 export const ENDING_WORDS = {
   merged: "merged",
   already_landed: "merged",
@@ -153,8 +158,10 @@ export const ENDING_WORDS = {
   interrupted: "interrupted",
   refused: "refused",
   idle: "idle",
+  idle_expired: "idle expired",
   blocked: "blocked",
-} as const satisfies Record<UnitEnding["kind"] | "blocked", string>;
+  failed: "failed",
+} as const satisfies Record<UnitEnding["kind"] | "blocked" | "failed", string>;
 
 /** The user's words for a round outcome (record 0066): the card's unit line
  *  prints these beside the round header, never `checks_failed` or another

package/dist/assets/src/core/plane/decide.ts

@@ -193,6 +193,11 @@ export interface PlaneQueueRow {
 export interface PlaneState {
   queue: PlaneQueueRow[];
   liveThreads: string[];
+  /** The live runs and their message route: provider recovery only steers a
+   *  run whose durable row still exists, and its row remains readable after a reclaim. */
+  liveRuns: Record<string, { channelId: string; threadKey: string }>;
+  /** The greatest durable inbox sequence per live run, read in the decision's transaction. */
+  inboxSeqs: Record<string, number>;
   /** Threads an admitted ask holds before its claim lands (or after, until the seal). */
   reservations: PlaneReservation[];
   /** Open window kinds; `deploy` is the pending-deploy window (`deploy_settled` is its absence). */
@@ -202,7 +207,7 @@ export interface PlaneState {
 }
 
 export function emptyPlaneState(): PlaneState {
-  return { queue: [], liveThreads: [], reservations: [], openWindows: [], levels: [] };
+  return { queue: [], liveThreads: [], liveRuns: {}, inboxSeqs: {}, reservations: [], openWindows: [], levels: [] };
 }
 
 /** The window kind behind `deploy_settled`: opened while a deploy is pending,
@@ -374,6 +379,10 @@ export type PlaneEffect =
    *  (record 0064): the id is `probe:<resident>`, so the object holds at most one
    *  open probe per resident and a duplicate offer is the same effect. */
   | { id: string; kind: "probe"; resident: string }
+  /** Deliver an already-durable provider-recovery steer to the owning live
+   *  run. The inbox sequence is the idempotency key across push, heartbeat and
+   *  reclaim; execution never writes the durable row again. */
+  | { id: string; kind: "steer"; runId: string; seq: number; message: PlaneSteerMessage }
   /** The `unit_title` move (record 0064): retitle the pull request under the
    *  title rule — the bot re-reads the title before acting, so a person's own
    *  retitle first makes this a `skipped`. Id `retitle:<repo>#<number>`. */
@@ -599,12 +608,40 @@ function onRunnerStatus(
   return { state, effects: [effect], writes: [{ table: "plane_effects", op: "offer", effect, at: event.at }] };
 }
 
+/** The typed provider-recovery row carried by both the durable inbox and its
+ *  live-delivery effect. */
+export interface PlaneSteerMessage {
+  [key: string]: unknown;
+  channelId: string;
+  threadKey: string;
+  text: string;
+  at: number;
+  userId: "plane";
+  userName: "plane";
+  plane: { steer: "reissue"; provider: string };
+}
+
 /** The inbox row a plane steer writes: sender `plane` (record 0064), the sentence as
  *  the text, and the cause under `plane` so the run page can say why. */
 function planeInboxMessage(text: string, at: number, plane: Record<string, unknown>): Record<string, unknown> {
   return { text, at, userId: "plane", userName: "plane", plane };
 }
 
+function reissueInboxMessage(
+  provider: string,
+  at: number,
+  route: { channelId: string; threadKey: string },
+): PlaneSteerMessage {
+  return {
+    ...route,
+    text: reissueSteerSentence(provider),
+    at,
+    userId: "plane",
+    userName: "plane",
+    plane: { steer: "reissue", provider },
+  };
+}
+
 /** The checkpoint steer (record 0064, "The backpressure contract"): a stalled
  *  or push-less coding run reads one fixed sentence at its next boundary. At
  *  most one reservation per run per round per cause, and — the sentence being
@@ -669,21 +706,25 @@ function onProviderLevel(
   let next = { ...state, levels };
   if (event.level === "down") return { state: next, effects: [], writes };
   const parked = next.reservations.filter((r) => r.kind === "park" && r.key.startsWith(`${event.provider}#`));
+  const steers: PlaneEffect[] = [];
+  const inboxSeqs = { ...next.inboxSeqs };
   for (const p of parked) {
-    writes.push({
-      table: "run_inbox",
-      op: "push",
-      runId: p.runId,
-      message: planeInboxMessage(reissueSteerSentence(event.provider), event.at, {
-        steer: "reissue",
-        provider: event.provider,
-      }),
-    });
+    const route = next.liveRuns[p.runId];
+    if (route) {
+      const seq = (inboxSeqs[p.runId] ?? 0) + 1;
+      inboxSeqs[p.runId] = seq;
+      const message = reissueInboxMessage(event.provider, event.at, route);
+      const effect: PlaneEffect = { id: `steer:${p.runId}:${seq}`, kind: "steer", runId: p.runId, seq, message };
+      steers.push(effect);
+      writes.push({ table: "run_inbox", op: "push", runId: p.runId, message });
+      writes.push({ table: "plane_effects", op: "offer", effect, at: event.at });
+    }
     writes.push({ table: "plane_reservations", op: "del", key: p.key, kind: "park" });
   }
-  if (parked.length > 0) next = { ...next, reservations: next.reservations.filter((r) => !parked.includes(r)) };
+  if (parked.length > 0)
+    next = { ...next, inboxSeqs, reservations: next.reservations.filter((r) => !parked.includes(r)) };
   const walked = walk(next, event.at);
-  return { ...walked, writes: [...writes, ...walked.writes] };
+  return { ...walked, effects: [...steers, ...walked.effects], writes: [...writes, ...walked.writes] };
 }
 
 /** A run parked on its provider: one park row — a second park of the same run

package/dist/assets/src/core/provider.ts

@@ -50,6 +50,11 @@ export interface CompletionRequest {
   maxTokens: number;
   /** model effort hint; providers apply it only where the model supports it */
   effort?: Effort;
+  /** The wire word the model card decided for `effort` (`turnEffort`,
+   *  routing-and-config item 2) — vouched or degraded by the card's levels
+   *  map. Rides only beside `effort`; absent, a provider that applies effort
+   *  sends the tier's own word. */
+  effortWord?: string;
   /** Cancellation for a hard run stop: providers pass it to their HTTP
    *  call so an aborted run stops billing/streaming now. Absent → never aborts. */
   signal?: AbortSignal;

package/dist/assets/src/core/runEvents.ts

@@ -1070,15 +1070,13 @@ export type RunEvent =
       seq?: number;
       at?: number;
     }
-  /** The operator's decision beside the routed request ([record 0057](../../docs/decisions/0057-the-operator-is-the-one-door-a-model-binds-every-chat-input-and-deterministic-code-authorizes-fences-and-executes.md);
-   *  the one-door plan's operator unit; run-history item 60): one per admitted chat
-   *  event under `routing.operator: shadow` or `on`, published beside the
-   *  `route` event. The decision is binds, a question, a refusal or — the
-   *  structured seam's floor ([record 0067](../../docs/decisions/0067-one-seam-for-a-structured-answer-a-violation-is-re-asked-with-the-violation-named-and-the-callers-declared-floor-holds-never-a-refusal-shown-to-the-person.md)),
-   *  never the model's decision — `non_decision`: under `on` the dispatcher
-   *  falls back to the readers' route for that event, this event recorded on
-   *  the run that then runs; `attempts` lists what each answer violated or
-   *  that it was accepted. A bind's `line` is redacted and cut like the
+  /** The operator's decision ([record 0057](../../docs/decisions/0057-the-operator-is-the-one-door-a-model-binds-every-chat-input-and-deterministic-code-authorizes-fences-and-executes.md);
+   *  run-history item 60): one per admitted chat event under
+   *  `routing.operator: shadow` or `on`. A no-call turn is repaired once and a
+   *  second becomes a typed general bind with reason `no_decision`; another
+   *  exhausted violation may remain `non_decision` and resolves on the
+   *  configured default with no second model. `attempts` lists what each
+   *  answer violated or that it was accepted. A bind's `line` is redacted and cut like the
    *  receipt (`ROUTE_RECEIPT_CAP`), never the message text; `intake` carries
    *  the intake gate's verdict when the gate is present; `latencyMs` and
    *  `outputTokens` feed the replay's median rows. Under `shadow` nothing
@@ -1088,16 +1086,17 @@ export type RunEvent =
       mode: "shadow" | "on";
       outcome: "binds" | "question" | "refusal" | "non_decision";
       reason: string;
-      /** The decision was the loop's floor (record 0069, as amended): a turn
-       *  that ended with no tool call, or the bounded re-asks ran out — the
-       *  readers' route ran the person's own request, and the event never
-       *  re-enters the loop. Additive: unknown → ignored. */
+      /** Historical marker from records written before the readers' router
+       *  retired. New events never emit it. Additive: unknown → ignored. */
       floored?: true;
       /** A bind marked `confirmed` is a pending question's confirmed proposal
        *  (`bindFromAnswer`): the line itself carries the task — the person's
        *  message was the word "yes" — so a confirmed preset line routes its
-       *  own tail as the request. Additive: unknown → a fresh bind. */
-      binds?: ReadonlyArray<{ line: string; reason: string; confirmed?: true }>;
+       *  own tail as the request. Additive: unknown → a fresh bind. A bind's
+       *  `model` is the ref the run uses, resolved from a model the person
+       *  named in plain words (the plain-words model unit) — applied at
+       *  directive precedence. Additive: unknown → no model. */
+      binds?: ReadonlyArray<{ line: string; reason: string; model?: string; confirmed?: true }>;
       question?: string;
       /** A question's proposed line, redacted and cut like the receipt — what
        *  the next turn's "yes" binds (`bindFromAnswer`). */

package/dist/assets/src/core/runRecord.ts

@@ -15,6 +15,7 @@ import {
 } from "./reviewVerdict.js";
 import { IDEMPOTENCY_KEY_PATTERN, INSTANCE_ID_PATTERN } from "./coordinator/contract.js";
 import { isPipelineSummaryShape, type PipelineSummary } from "./pipelineStanding.js";
+import { RESTART_CLAIM_GRACE_MS } from "./budgets.js";
 import {
   FRICTION_CATEGORIES,
   type CategoryTotals,
@@ -231,6 +232,11 @@ export interface RunRecord {
    *  waiting for `child_resumed` instead of ending its unit on this record.
    *  Absent on every ending that is final. */
   restarting?: true;
+  /** Epoch ms through which a `restarting` close with no visible successor is
+   *  projected as running. Current writers stamp one central grace from the
+   *  close; absent on legacy restarting records, which retain the old
+   *  unbounded compatibility behavior, and on every final ending. */
+  restartUntil?: number;
   /** Where the run's conversation started (item 52): `channel` — its own
    *  thread's history, as for every run a person, a schedule or a coordinator
    *  started — or `parent` — a spawned child seeded from its parent's text
@@ -944,11 +950,34 @@ export function normalizeDiagnosis(d: FrictionDiagnosis): FrictionDiagnosis {
 /** `normalizeDiagnosis` applied to anything carrying a `diagnosis` — a record or
  *  a listing row — on its way out of a store, and the `channelVisibility` stamp
  *  filled with `unknown` for a row written before it existed (fail-closed:
- *  `unknown` is never public). */
+ *  `unknown` is never public). A restart deadline is trusted only inside the
+ *  central grace after its persisted close stamp; malformed or overlong
+ *  values drop the restarting projection, while a legacy row with no deadline
+ *  keeps its compatibility behavior. */
 export function normalizeStored<T extends { diagnosis: FrictionDiagnosis; channelVisibility?: ChannelVisibility }>(
   v: T,
 ): T & { channelVisibility: ChannelVisibility } {
-  return { ...v, diagnosis: normalizeDiagnosis(v.diagnosis), channelVisibility: v.channelVisibility ?? "unknown" };
+  const normalized = {
+    ...v,
+    diagnosis: normalizeDiagnosis(v.diagnosis),
+    channelVisibility: v.channelVisibility ?? "unknown",
+  } as T & { channelVisibility: ChannelVisibility };
+  const restart = normalized as T & { restarting?: unknown; restartUntil?: unknown; finishedAt?: unknown };
+  if (restart.restartUntil !== undefined) {
+    const bounded =
+      restart.restarting === true &&
+      typeof restart.restartUntil === "number" &&
+      Number.isFinite(restart.restartUntil) &&
+      typeof restart.finishedAt === "number" &&
+      Number.isFinite(restart.finishedAt) &&
+      restart.restartUntil >= restart.finishedAt &&
+      restart.restartUntil <= restart.finishedAt + RESTART_CLAIM_GRACE_MS;
+    if (!bounded) {
+      delete restart.restarting;
+      delete restart.restartUntil;
+    }
+  }
+  return normalized;
 }
 
 /** Structural check on a record from outside the process (a Worker response, a
@@ -1027,8 +1056,12 @@ export function isRunRecord(v: unknown): v is RunRecord {
   // marker, like `provisional`, is the literal `true` or absent.
   if (r.pipeline !== undefined && !isPipelineSummaryShape(r.pipeline)) return false;
   if (r.hosted !== undefined && r.hosted !== true) return false;
-  // A restarting close carries the literal `true` or nothing (record 0064).
+  // A restarting close carries the literal `true` and, on current writers,
+  // one finite deadline; legacy closes carry no deadline. The persisted close
+  // stamp bounds a future value in `normalizeStored`, where it can fail closed
+  // without making the whole record unreadable.
   if (r.restarting !== undefined && r.restarting !== true) return false;
+  if (r.restartUntil !== undefined && (!isFiniteNumber(r.restartUntil) || r.restarting !== true)) return false;
   if (typeof r.channelId !== "string" || typeof r.userId !== "string" || typeof r.threadKey !== "string") return false;
   if (r.relayedBy !== undefined && typeof r.relayedBy !== "string") return false;
   if (r.authenticatedAs !== undefined && typeof r.authenticatedAs !== "string") return false;

package/dist/assets/src/core/ship/coordinator.ts

@@ -32,7 +32,14 @@
 import type { ShipRoundOutcome } from "../runEvents.js";
 import { shows, type Verbosity } from "../verbosity.js";
 import type { Handoff, HandoffLanded } from "./handoff.js";
-import { progressOf, renderRenewal, renewalDecision, type PushedHeadFact, type RenewalDecision } from "./renewal.js";
+import {
+  progressOf,
+  renderRenewal,
+  renewalDecision,
+  type PushedHeadFact,
+  type RenewalDecision,
+  type RenewalWhy,
+} from "./renewal.js";
 import type { RunStatus } from "../runRecord.js";
 import { normalizeHead, sameCommit } from "../reviewedHead.js";
 import {
@@ -125,13 +132,15 @@ export function interruptionCauseOfWords(words: string): InterruptionCause | und
   return undefined;
 }
 
-export function shipInterruptedNote(prUrl?: string, cause?: InterruptionCause): string {
+export function shipInterruptedNote(prUrl?: string, cause?: InterruptionCause, idle = false): string {
   const stands = prUrl
     ? `Its work stands on GitHub: ${prUrl}.`
     : "Whatever it pushed stands on its pipeline branch; no PR was opened yet.";
-  const reissue = prUrl
-    ? `To continue the review loop, re-issue \`agent:ship\` in this thread with only the PR URL (${prUrl}).`
-    : "To continue, re-issue `agent:ship` in this thread with the task — round 0 runs again on the same branch.";
+  const reissue = idle
+    ? "To continue, reply in this thread to continue."
+    : prUrl
+      ? `To continue the review loop, re-issue \`agent:ship\` in this thread with only the PR URL (${prUrl}).`
+      : "To continue, re-issue `agent:ship` in this thread with the task — round 0 runs again on the same branch.";
   const opening =
     cause === "container_replaced"
       ? "⚠️ The resident container running this pipeline's child was replaced (a deploy's image swap) and the child could not resume, so the pipeline stopped."
@@ -477,7 +486,7 @@ export type Brief =
       rebase: { branch: string; onto: string };
       /** A renewal's segment (decision 0046): the child continues the previous
        *  segment's work from `from`, briefed with that run's write-up and handoff. */
-      continue?: { segment: number; from?: string; previousRunId?: string };
+      continue?: { segment: number; from?: string; previousRunId?: string; texts?: string[] };
     }
   | {
       kind: "review";
@@ -636,6 +645,10 @@ export type PrCheck =
       /** The head's self-declared fix-up commit subjects (`fixup!`/`squash!`/`amend!`),
        *  when the read asked for the facts — a head carrying one is not in the ready state. */
       fixupCommits?: string[];
+      /** The base branch takes changes only through a merge queue (issue 2011):
+       *  read beside the checks on the ending's facts read, so a `merge_ready`
+       *  report tells the person their merge is queued, never a direct one. */
+      baseHasMergeQueue?: boolean;
     }
   | { state: "merged"; prNumber: number; url: string; sha: string; mergedAt: string };
 
@@ -852,6 +865,7 @@ export type UnitEnding =
       spent: ShipBudgetSpent;
     }
   | { kind: "no_verdict"; round: RoundRef; reviewRounds: number; finalReply?: string }
+  | { kind: "idle_expired"; reviewRounds: number }
   /** Round 0's coding child died on a provider transient — a model-gateway
    *  5xx, a cut stream, a gateway timeout, past the harness's retry ladder —
    *  with nothing pushed, TWICE: the first such death re-ran the round once
@@ -896,7 +910,8 @@ export type UnitEnding =
  *  the pull request, which no thread reply can produce — but a blocked hold
  *  (issue 2086) waits for exactly the person's word the idle's wake carries,
  *  so it alone idles; `idleEnding` draws that line by cause. */
-export type IdleWhy = Exclude<UnitEnding["kind"], "idle" | "merged" | "already_landed" | "merge_ready" | "refused">;
+export type IdleWhy =
+  Exclude<UnitEnding["kind"], "idle" | "merged" | "already_landed" | "merge_ready" | "refused"> | RenewalWhy;
 
 const NEVER_IDLES: ReadonlySet<UnitEnding["kind"]> = new Set([
   "idle",
@@ -904,6 +919,7 @@ const NEVER_IDLES: ReadonlySet<UnitEnding["kind"]> = new Set([
   "already_landed",
   "merge_ready",
   "refused",
+  "idle_expired",
 ]);
 
 /** What a transition tells the driver beyond the next action: a round boundary
@@ -957,6 +973,12 @@ export interface LeaseSegmentProgress {
   /** The previous segment's coding run: its write-up and handoff brief the continuation. */
   previousRunId?: string;
   previousHandoff?: Handoff;
+  /** Words that woke an idle segment, already attributed in arrival order. */
+  texts?: string[];
+  /** A stopped segment reopens under the remainder of its cut lease. Each
+   *  reopen gets a fresh attempt so its Workflow steps cannot replay the
+   *  stopped attempt's cached answers. */
+  resume?: { leaseMs: number; attempt: number };
 }
 
 export interface UnitPipelineInput {
@@ -1162,7 +1184,8 @@ export function openUnitPipeline(input: UnitPipelineInput, at: number): UnitPipe
   return nextReview(resumed).state;
 }
 
-const deadlineAt = (s: UnitPipelineState) => s.startedAt + s.input.caps.maxMinutes * MIN;
+const deadlineAt = (s: UnitPipelineState) =>
+  s.startedAt + (s.input.session?.resume?.leaseMs ?? s.input.caps.maxMinutes * MIN);
 const remainingMs = (s: UnitPipelineState) => deadlineAt(s) - s.clock;
 
 /** The next slice of a wait: a chunk; the remainder when less is left before
@@ -1189,11 +1212,14 @@ function roundCarve(s: UnitPipelineState, round: RoundRef): Carve {
   );
 }
 
-/** The prefix every step of this pipeline is named under: the unit id, and for
- *  a renewal's segment the segment too (`U10/s2/…`), so the Workflow's durable
- *  step cache never hands segment two the answers of segment one. */
-export const stepPrefixOf = (unit: string, session: LeaseSegmentProgress | undefined): string =>
-  session !== undefined && session.segment > 1 ? `${unit}/s${session.segment}` : unit;
+/** The prefix every step of this pipeline is named under: the unit id, a
+ *  renewal's segment (`U10/s2/…`), and a stopped segment's resumed attempt
+ *  (`U10/s2/r1/…`). Both transitions need fresh Workflow identities so the
+ *  durable step cache cannot answer a new attempt with an older one's result. */
+export const stepPrefixOf = (unit: string, session: LeaseSegmentProgress | undefined): string => {
+  const segment = session !== undefined && session.segment > 1 ? `${unit}/s${session.segment}` : unit;
+  return session?.resume !== undefined ? `${segment}/r${session.resume.attempt}` : segment;
+};
 const stepPrefix = (s: UnitPipelineState) => stepPrefixOf(s.input.unit.id, s.input.session);
 const roundStep = (s: UnitPipelineState, round: RoundRef) =>
   `${stepPrefix(s)}/${round.index}/${round.kind}${round.attempt !== undefined ? `/a${round.attempt}` : ""}`;
@@ -1212,6 +1238,7 @@ function briefFor(s: UnitPipelineState, round: RoundRef): Brief {
               segment: session.segment,
               ...(session.continueFrom !== undefined ? { from: session.continueFrom } : {}),
               ...(session.previousRunId !== undefined ? { previousRunId: session.previousRunId } : {}),
+              ...(session.texts !== undefined ? { texts: session.texts } : {}),
             },
           }
         : {}),
@@ -1400,7 +1427,7 @@ function idleEnding(s: UnitPipelineState, ending: UnitEnding): Extract<UnitEndin
   const round = "round" in old ? old.round : undefined;
   return {
     kind: "idle",
-    why: old.kind,
+    why: old.kind === "aborted" && old.renewal !== undefined ? old.renewal.decision.why : old.kind,
     idled: old,
     renewalsLeft,
     ...(from !== undefined ? { from } : {}),
@@ -2612,6 +2639,10 @@ export interface MergeReadyFacts {
    *  (git's autosquash prefixes `fixup!`, `squash!`, `amend!`): a head
    *  carrying one is by its own words not in the ready state. */
   fixupCommits?: string[];
+  /** The base branch takes changes only through a merge queue (issue 2011):
+   *  the merge:person path names "queued" in its line — the person's merge
+   *  enqueues the pull request and the queue merges it on its own. */
+  baseHasMergeQueue?: boolean;
 }
 
 /** The check runs at one commit: how many, which still run, which failed. */
@@ -2733,7 +2764,12 @@ export function renderUnitReport(
             ? `Already merged: ${e.pr.url} (merge commit \`${facts.merged.sha.slice(0, 7)}\`, merged ${facts.merged.mergedAt}) — auto-merge or a person merged it after the approval; the pipeline merged nothing.`
             : facts?.autoMergeEnabled
               ? "Auto-merge is on for this pull request: the approval merges it once checks pass."
-              : "Remaining gate: a person's merge — the pipeline merges only when the plan's `merge` setting says so, and ship never approves.",
+              : facts?.baseHasMergeQueue === true
+                ? // The merge:person path names "queued" in its line (issue 2011):
+                  // the base takes changes only through a merge queue, so the
+                  // person's merge enqueues — never a direct merge.
+                  `Remaining gate: a person's merge, queued — \`${s.input.base}\` takes changes only through a merge queue, so the merge enqueues the pull request (\`gh pr merge --auto\`) and the queue merges it on its own; the pipeline merges only when the plan's \`merge\` setting says so, and ship never approves.`
+                : "Remaining gate: a person's merge — the pipeline merges only when the plan's `merge` setting says so, and ship never approves.",
         ),
       ]
         .filter(Boolean)
@@ -2848,7 +2884,7 @@ export function renderUnitReport(
         e.postedReview
           ? "ℹ️ A changes-requested review was posted this round before the stop — its findings stand on the PR."
           : undefined,
-        reissue,
+        s.input.idleDays && s.input.idleDays > 0 ? "Next step: reply in this thread to continue." : reissue,
       ]);
     case "aborted":
       if (!shows(verbosity, "verbose")) return `⚠️ Aborted after ${rounds}: ${e.reason}${prLine}`;
@@ -2870,7 +2906,9 @@ export function renderUnitReport(
       if (!shows(verbosity, "verbose")) return "";
       return join([
         writeUpPointer(s, e.round.kind, e.runId),
-        `🔁 The unit's budget ran out with the unit unfinished — ${e.line}. A fresh ${s.input.caps.maxMinutes}-minute budget opens in this thread${e.from !== undefined ? ` from \`${e.from.slice(0, 7)}\`` : ""}, with the last run's write-up as its request; ${e.renewalsLeft} renewal${e.renewalsLeft === 1 ? "" : "s"} remain${e.spendUsd !== null ? `, $${e.spendUsd.toFixed(2)} spent so far` : ""}.`,
+        s.input.idleDays && s.input.idleDays > 0
+          ? `🔁 The unit's budget ran out with the unit unfinished — ${e.line}. Next step: reply in this thread to continue; ${e.renewalsLeft} renewal${e.renewalsLeft === 1 ? "" : "s"} remain${e.spendUsd !== null ? `, $${e.spendUsd.toFixed(2)} spent so far` : ""}.`
+          : `🔁 The unit's budget ran out with the unit unfinished — ${e.line}. A fresh ${s.input.caps.maxMinutes}-minute budget opens in this thread${e.from !== undefined ? ` from \`${e.from.slice(0, 7)}\`` : ""}, with the last run's write-up as its request; ${e.renewalsLeft} renewal${e.renewalsLeft === 1 ? "" : "s"} remain${e.spendUsd !== null ? `, $${e.spendUsd.toFixed(2)} spent so far` : ""}.`,
         aside(budgetSplitLine(e.spent, s.input.caps.maxMinutes)),
       ]);
     case "transient":
@@ -2892,7 +2930,9 @@ export function renderUnitReport(
         reissue,
       ]);
     case "interrupted":
-      return shipInterruptedNote(prUrl, e.cause);
+      return shipInterruptedNote(prUrl, e.cause, (s.input.idleDays ?? 0) > 0);
+    case "idle_expired":
+      return "⌛ Idle expired: no reply continued this unit before its idle window closed.";
     case "refused":
       return join([
         `🚫 The ${presetOf(e.round.kind)} child of round ${e.round.index} was refused by the authorize stage (${e.refusal})${e.message ? `: ${e.message}` : ""} — every child is authorized as the requesting user, so the pipeline ends here.`,

package/dist/assets/src/core/ship/renewal.ts

@@ -82,7 +82,10 @@ export interface RenewalInput {
   /** Dollars spent under this request so far; null when a run's model had no
    *  price, since a total that left a model's tokens out would understate it. */
   spendUsd: number | null;
-  progress: Progress;
+  /** Progress normally comes from the segment's row. An idle wake sets it
+   * aside because the person's reply is the new work to run; the count, cap
+   * and fit still decide whether another lease may open. */
+  progress: Progress | "set_aside";
   /** The pipeline the next segment would run: its fit is re-asserted before every segment. */
   pipeline: Pipeline;
 }
@@ -101,7 +104,8 @@ const usd = (n: number): string => `$${n.toFixed(2)}`;
  *  the progress. */
 export function renewalDecision(input: RenewalInput): RenewalDecision {
   const renewalsLeft = Math.max(0, input.grant.renewals - input.renewalsSpent);
-  if (!input.progress.progressed) return { renew: false, why: "no_progress", detail: input.progress.why, renewalsLeft };
+  if (input.progress !== "set_aside" && !input.progress.progressed)
+    return { renew: false, why: "no_progress", detail: input.progress.why, renewalsLeft };
   if (renewalsLeft === 0) {
     const detail =
       input.grant.renewals === 0
@@ -139,7 +143,7 @@ export function renewalDecision(input: RenewalInput): RenewalDecision {
   return {
     renew: true,
     segment: input.renewalsSpent + 2,
-    ...(input.progress.by === "push" ? { from: input.progress.sha } : {}),
+    ...(input.progress !== "set_aside" && input.progress.by === "push" ? { from: input.progress.sha } : {}),
     renewalsLeft: renewalsLeft - 1,
   };
 }
@@ -149,22 +153,31 @@ export function renewalDecision(input: RenewalInput): RenewalDecision {
  *  names the clause and, when renewals remain, what actually spends one — a
  *  budget that made progress — and the honest recourse (re-issue the request).
  *  It teaches no keyword: the router has none (routing-and-config item 3). */
-export function renderRenewal(decision: RenewalDecision, grant: Grant): string {
+export function renderRenewal(
+  decision: RenewalDecision,
+  grant: Grant,
+  options: { idle?: boolean; senders?: readonly string[] } = {},
+): string {
+  const recourse = options.idle ? "reply in this thread to continue" : "re-issue the request to try again";
+  const senders = options.senders?.length
+    ? `, with ${options.senders.length} message${options.senders.length === 1 ? "" : "s"} from ${options.senders.join(", ")}`
+    : "";
   if (decision.renew)
-    return `budget renewed, ${decision.segment - 1} of ${grant.renewals}, continues ${decision.from !== undefined ? decision.from.slice(0, 7) : "the branch's head"}`;
+    return `budget renewed, ${decision.segment - 1} of ${grant.renewals}, continues ${decision.from !== undefined ? decision.from.slice(0, 7) : "the branch's head"}${senders}`;
   const holds =
     decision.renewalsLeft > 0
       ? `${decision.renewalsLeft} renewal${decision.renewalsLeft === 1 ? "" : "s"} left`
       : "no renewals left";
+  const idleRecourse = (line: string): string => (options.idle ? `${line}; ${recourse}` : line);
   switch (decision.why) {
     case "no_progress":
       return decision.renewalsLeft > 0
-        ? `no progress on the last budget; ${holds} unspent — a renewal is spent only by a budget that pushed to the unit's branch or moved its write-up; re-issue the request to try again`
+        ? `no progress on the last budget; ${holds} unspent — a renewal is spent only by a budget that pushed to the unit's branch or moved its write-up; ${recourse}`
         : `no progress on the last budget; ${holds}`;
     case "cost_cap":
-      return decision.renewalsLeft > 0 ? `${decision.detail}; ${holds} unspent` : decision.detail;
+      return idleRecourse(decision.renewalsLeft > 0 ? `${decision.detail}; ${holds} unspent` : decision.detail);
     case "grant_exhausted":
     case "unfit":
-      return decision.detail;
+      return idleRecourse(decision.detail);
   }
 }

package/dist/assets/src/core/types.ts

@@ -11,6 +11,11 @@ export interface ImageAttachment {
   /** base64 payload, no data: URI prefix */
   data: string;
   name?: string;
+  /** A channel-native source the coordinator may preserve so a later child
+   *  stages the same accepted file through the artifact path. The current
+   *  turn still reads `data` inline; only a folded durable event promotes this
+   *  reference to `IncomingMessage.staged`. */
+  staged?: StagedFile;
 }
 
 /**
@@ -25,6 +30,8 @@ export interface DocumentAttachment {
   mediaType: string;
   data: string;
   name?: string;
+  /** The same optional by-reference source as an accepted image. */
+  staged?: StagedFile;
 }
 
 /** A file left on the platform by reference (record 0033): what the store's
@@ -38,6 +45,10 @@ export interface StagedFile {
   url: string;
   /** The platform's id of the message that carried the file — the per-message segment of its key. */
   messageId: string;
+  /** A channel file's message-local zero-based slot when accepted inline
+   *  media is carried to a later child. Ordinary by-reference files omit it
+   *  and take the run's one-based staging counter. */
+  workspaceIndex?: number;
 }
 
 export interface IncomingMessage {