@coreplane/switchboard 1.259.0 → 1.260.1

package/dist/assets/config/config.example.yaml

@@ -97,7 +97,8 @@ defaults:
   # thinks per turn; lower = much faster turns). Same layering as models —
   # per-channel/user `effort` / `efforts.<agent>` and a per-request `effort:`
   # directive override these; unset → the agent's built-in effort, else the
-  # provider default. Skipped for models without effort support.
+  # provider default. Skipped for models without effort support. The `general`
+  # entry also controls the operator turn on `defaults.models.general`.
   # efforts:
   #   coding: medium
   # How much the bot says about its own doing (docs/reference/specs/routing-and-config.md
@@ -171,6 +172,7 @@ defaults:
 # "config set channel ..." are stored in data/overrides.json and win over these.
 # channels:
 #   slack:C012345:
+#     repo: acme/api                # default repository for repo-bound asks in this channel
 #     agent: review
 #     models:
 #       review: anthropic/claude-opus-5
@@ -368,7 +370,10 @@ workspaceDir: ./workspaces
 #                       # records (soft delete, status `evicted`) in the same write.
 #   model: anthropic/claude-haiku-4-5
 #                       # <provider>/<model> for the reflection pass — pick a
-#                       # cheap tier. Absent → the run's own resolved model.
+#                       # cheap level. Absent → the run's own resolved model.
+#   effort: low         # how hard the reflection model thinks per distillation —
+#                       # low | medium | high | xhigh | max, applied through the
+#                       # model card; unset → the model's own default.
 
 # Self-improvement proposals (docs/reference/specs/run-friction.md). Every finished run's friction
 # diagnosis (docs/reference/specs/run-friction.md) is stored with its run record, so the
@@ -479,26 +484,11 @@ workspaceDir: ./workspaces
 # spawn:
 #   maxChildren: 3
 
-# The request router (docs/reference/specs/routing-and-config.md item 21). ON BY
-# DEFAULT: a plain message — no `agent:` directive, no sticky preset, no channel
-# or user `agent` — asks the fast model which preset it means and runs as that
-# preset, the card saying why (`routed: <reason>`) and how to run it another way.
-# `ship` is never routed. The one way off, so every plain message runs
-# `defaults.agent` as before the router: `auto: false`. `model` is the router's
-# model; default `defaults.models.general`. `answer` is how that model answers:
-# `tool` (default) forces a call to the router's `route` tool, whose schema is
-# the answer, so prose cannot occur; `text` is the one-JSON-object text contract
-# alone — set it for a provider or model that cannot take a forced tool call.
-# `operator` is the one door's flag (routing-and-config item 29): `on`
-# (default) — the operator's decision is what runs; `shadow` — one operator
-# turn per admitted chat event, ahead of stage A, its decision written beside
-# the routed request in the run store and nothing run from it; `off` — the
-# rollback lever: it turns the operator back off after a bad day, not a choice
-# to make up front. `shadow` and `on` run even under `auto: false`.
+# The one door's mode (routing-and-config item 29): `on` (default) — the
+# operator's typed decision is what runs; `shadow` — one operator turn per
+# admitted chat event, its decision recorded and nothing run from it; `off` —
+# the rollback lever. The retired readers' router has no model or effort key.
 # routing:
-#   auto: false
-#   model: anthropic/claude-haiku-4-5
-#   answer: text
 #   operator: off
 
 # The thread-reply intake gate (docs/decisions/0058-a-thread-reply-is-read-before-it-is-answered-intake-decides-whether-the-bot-was-addressed.md;
@@ -512,14 +502,17 @@ workspaceDir: ./workspaces
 # model call) or `always` (today's answer-every-reply path, byte for byte).
 # Also settable per channel and per user: `intake: { threadReplies: <mode> }`
 # on a `channels.<id>` or `users.<id>` scope, user over channel over here.
-# `model` is the verdict's model; default `routing.model`, else
-# `defaults.models.general`. A mention, a DM and a top-level post never pass
-# through the gate in any mode. A model whose operator card (`providers.<p>.
+# `model` is the verdict's model; default `defaults.models.general`. `effort`
+# is how hard that model thinks per verdict — low | medium | high | xhigh |
+# max, applied through the model card; unset → the model's own default. A
+# mention, a DM and a top-level post never pass through the gate in any mode.
+# A model whose operator card (`providers.<p>.
 # models.<id>.answers`) declares it answers neither a forced tool call nor the
 # text contract is refused at load when the default mode is `classify`.
 # intake:
 #   threadReplies: classify
 #   model: anthropic/claude-haiku-4-5
+#   effort: low
 
 # The orchestration plane (docs/decisions/0064-the-plane-owns-every-runs-state-a-refusal-becomes-a-queue-position-an-ending-is-judged-by-the-ledger-that-saw-it-and-a-release-is-a-quiet-window-a-person-closes.md;
 # docs/reference/specs/routing-and-config.md item 31; orchestration-plane.md).

package/dist/assets/deploy/cloudflare/worker.ts

@@ -28,14 +28,10 @@ import {
 import {
   authenticateIngressBearer,
   authenticateRestart,
+  authorizeRestartDeployer,
   decideRestart,
-  parseRestartAuthorization,
   parseRestartRequest,
-  RESTART_AUTHORIZE_PATH,
-  RESTART_SUBJECT_HEADER,
   restartResponse,
-  stripRestartSubject,
-  type RestartAuth,
   type RestartOutcome,
 } from "../../src/deploy/restart.ts";
 import {
@@ -89,7 +85,8 @@ export interface Env {
   ACCESS_TEAM_DOMAIN?: string; // live-view SSO gate: Cloudflare Access team domain (JWKS + iss)
   ACCESS_AUD?: string; // live-view SSO gate: Cloudflare Access application AUD tag
   DASHBOARD_TOKEN?: string; // dashboard auth `token` strategy: the bearer (the default env name; config may name another)
-  SWITCHBOARD_INGRESS_TOKENS?: string; // enables HTTP /ingress + MCP /mcp (JSON token→identity map); the `cron` entry is what scheduled runs present; an entry whose `http:<subject>` actor holds `deploy:write` in the bot's config may POST /admin/restart
+  SWITCHBOARD_INGRESS_TOKENS?: string; // enables HTTP /ingress + MCP /mcp (JSON token→identity map); the `cron` entry is what scheduled runs present
+  SWITCHBOARD_RESTART_DEPLOYER?: string; // deployment-profile grant: the token-map subject allowed to POST /admin/restart; Worker-only, never runtime config
   BRAVE_SEARCH_API_KEY?: string; // web_search backend (Brave); web_fetch works without it
   GITHUB_WEBHOOK_SECRET?: string; // check-run intake: signs POST /webhooks/github; absent, the intake answers 503 disabled
   CF_ANALYTICS_TOKEN?: string; // costs dash: Cloudflare API token, Account Analytics:Read only
@@ -211,37 +208,6 @@ export class SwitchboardServer extends Container<Env> {
     return this.restartRunning(opts);
   }
 
-  /**
-   * `deploy restart`, authorized: the Worker knows WHO the bearer is (the token
-   * map); WHETHER that identity may restart is the bot's config (`grants` —
-   * authorization.md item 9), which only the container holds. So ask it —
-   * `POST /admin/restart/authorize` with the authenticated subject in
-   * `RESTART_SUBJECT_HEADER` (never the bearer: the container may still hold the
-   * token map from before a rotation) — and stop only on a 200. A container that
-   * is not running is started first (the bot must answer): if the bearer is
-   * allowed, that start already put the current env live, so nothing is
-   * stopped and the outcome is `not-running`, exactly as before; if not, the
-   * refusal is relayed and the started container simply keeps serving.
-   */
-  async restartAuthorized(
-    subject: string,
-    opts: { force: boolean },
-  ): Promise<{ auth: RestartAuth; outcome?: RestartOutcome }> {
-    const wasRunning = this.ctx.container?.running === true;
-    await this.startBot();
-    const answer = await this.containerFetch(
-      new Request(`${INTERNAL}${RESTART_AUTHORIZE_PATH}`, {
-        method: "POST",
-        headers: { [RESTART_SUBJECT_HEADER]: subject },
-      }),
-      this.defaultPort,
-    );
-    const auth = parseRestartAuthorization(answer.status, await answer.text().catch(() => ""));
-    if (!auth.ok) return { auth };
-    if (!wasRunning) return { auth, outcome: { kind: "not-running" } };
-    return { auth, outcome: await this.restartRunning(opts) };
-  }
-
   /** The stop itself, for a running container: the preflight's refusal rules over `/healthz`, then SIGTERM. */
   private async restartRunning(opts: { force: boolean }): Promise<RestartOutcome> {
     const health = await this.containerFetch(new Request(`${INTERNAL}/healthz`), this.defaultPort);
@@ -265,12 +231,12 @@ export class SwitchboardServer extends Container<Env> {
   }
 }
 
-/** `POST /admin/restart` — the operator surface behind `deploy restart`
- *  (src/deploy/restart.ts documents the authorization choice: a
- *  SWITCHBOARD_INGRESS_TOKENS bearer whose `http:<subject>` actor holds
- *  `deploy:write` in the bot's config). The Worker authenticates the bearer
- *  against the map it holds — an unknown bearer never touches the container —
- *  and the Container DO asks the bot for the grant before stopping anything.
+/** `POST /admin/restart` — the operator surface behind `deploy restart`.
+ *  The Worker authenticates the bearer against its token map, then authorizes
+ *  that subject against SWITCHBOARD_RESTART_DEPLOYER, rendered from the
+ *  deployment profile (or set directly as a Worker var). Runtime config is
+ *  never consulted: this route must remain usable when that document is what
+ *  the restart is repairing.
  *  Body `{ "force": true }` bypasses the fail-closed refusals (no JSON body,
  *  impossible `inFlight`); runs in flight or a drain warn and never refuse. */
 async function handleAdminRestart(request: Request, env: Env): Promise<Response> {
@@ -283,14 +249,16 @@ async function handleAdminRestart(request: Request, env: Env): Promise<Response>
     console.warn(`[restart] ${authn.status} — ${authn.reason}`);
     return json(authn.status, { ok: false, error: authn.reason });
   }
+  const auth = authorizeRestartDeployer(authn.identity.subject, env.SWITCHBOARD_RESTART_DEPLOYER);
+  if (!auth.ok) {
+    console.warn(`[restart] ${auth.status} — ${auth.reason}`);
+    return json(auth.status, { ok: false, error: auth.reason });
+  }
   const parsed = parseRestartRequest(await request.text().catch(() => ""));
   if (!parsed.ok) return json(400, { ok: false, error: parsed.reason });
-  let auth: RestartAuth;
-  let outcome: RestartOutcome | undefined;
+  let outcome: RestartOutcome;
   try {
-    ({ auth, outcome } = await getContainer(env.SWITCHBOARD, INSTANCE).restartAuthorized(authn.identity.subject, {
-      force: parsed.force,
-    }));
+    outcome = await getContainer(env.SWITCHBOARD, INSTANCE).restart({ force: parsed.force });
   } catch (err) {
     // The container's /healthz probe or the DO call threw (container mid-transition,
     // port not answering): fail closed in the route's own JSON shape so the CLI reads
@@ -299,11 +267,6 @@ async function handleAdminRestart(request: Request, env: Env): Promise<Response>
     console.error(`[restart] ${authn.identity.subject} → error before stop: ${reason}`);
     return json(500, { ok: false, error: `restart failed before stopping anything: ${reason}` });
   }
-  if (!auth.ok || outcome === undefined) {
-    const refusal = auth.ok ? { status: 503 as const, reason: "restart disabled: no outcome" } : auth;
-    console.warn(`[restart] ${refusal.status} — ${refusal.reason}`);
-    return json(refusal.status, { ok: false, error: refusal.reason });
-  }
   console.log(
     `[restart] ${auth.subject} → ${outcome.kind}${outcome.kind === "refused" ? `: ${outcome.problems.join("; ")}` : ""}`,
   );
@@ -494,9 +457,7 @@ export default {
     // caller sent is stripped, and what the container sees carries this
     // Worker's own root. A static asset or the live view's SSE stream gets no
     // root; a refusal's line is dropped by the sink's filter.
-    // The restart-subject header is the Worker's own word to the container (the
-    // authorize call below); a caller cannot be allowed to speak it.
-    const inbound = stripRestartSubject(stripTraceContext(request));
+    const inbound = stripTraceContext(request);
     const route = shimRoute(pathname);
     if (route === undefined) return withLength(await getContainer(env.SWITCHBOARD, INSTANCE).fetch(inbound));
     const root = tracer.start("bot-shim.fetch", { sinks: traceSinks, attrs: { route } });

package/dist/assets/deploy/cloudflare/wrangler.template.jsonc

@@ -31,6 +31,12 @@
     "ACCESS_TEAM_DOMAIN": "{{access.teamDomain}}",
     "ACCESS_AUD": "{{access.aud}}",
     // {{/if}}
+    // The restart route's deployment-side grant. The Worker authenticates a
+    // bearer through SWITCHBOARD_INGRESS_TOKENS and compares its subject here;
+    // it never asks the runtime config it may be restarting to repair.
+    // {{#if restart}}
+    "SWITCHBOARD_RESTART_DEPLOYER": "{{restart.deployer}}",
+    // {{/if}}
     // The state Worker (deploy/cloudflare-memory/): where worker.ts records each
     // scheduled firing for the /runs Scheduled panel, with MEMORY_TOKEN.
     // A profile without a memory Worker renders no var: firings go unrecorded.

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -109,13 +109,16 @@ import {
   isCoordinatorInstance,
   isCoordinatorUnit,
   isThreadEvent,
+  isUnitWakeAnswer,
   sendChildSignal,
   sendRunFinished,
+  STEP_NAME_PATTERN,
   UNIT_PATTERN,
   type CoordinatorInstance,
   type CoordinatorUnit,
   type RunFinishedSend,
   type ThreadEvent,
+  type UnitWakeAnswer,
 } from "../../src/core/coordinator/contract.ts";
 import {
   GEN_PATTERN,
@@ -1848,10 +1851,27 @@ export class RunHistoryDO extends DurableObject<Env> {
         queuedAt: r.queued_at,
         state: r.state as PlaneQueueRow["state"],
       }));
-    const liveThreads = this.sql
-      .exec<{ thread_key: string }>(`SELECT thread_key FROM live_runs WHERE run_id IS NOT ?`, excludeRunId ?? null)
-      .toArray()
-      .map((r) => r.thread_key);
+    const liveRows = this.sql
+      .exec<{ run_id: string; thread_key: string; meta_json: string }>(
+        `SELECT run_id, thread_key, meta_json FROM live_runs WHERE run_id IS NOT ?`,
+        excludeRunId ?? null,
+      )
+      .toArray();
+    const liveThreads = liveRows.map((r) => r.thread_key);
+    const liveRuns = Object.fromEntries(
+      liveRows.flatMap((r) => {
+        const meta = JSON.parse(r.meta_json) as Record<string, unknown>;
+        return typeof meta.channelId === "string"
+          ? [[r.run_id, { channelId: meta.channelId, threadKey: r.thread_key }] as const]
+          : [];
+      }),
+    );
+    const inboxSeqs = Object.fromEntries(
+      this.sql
+        .exec<{ run_id: string; seq: number }>(`SELECT run_id, MAX(seq) AS seq FROM run_inbox GROUP BY run_id`)
+        .toArray()
+        .map((r) => [r.run_id, r.seq]),
+    );
     const levels = this.sql
       .exec<{ resident: string; name: string; side: string; reported_at: number; generation: string }>(
         `SELECT * FROM plane_levels`,
@@ -1864,7 +1884,7 @@ export class RunHistoryDO extends DurableObject<Env> {
         reportedAt: r.reported_at,
         generation: r.generation,
       }));
-    return { queue, liveThreads, reservations, openWindows, levels };
+    return { queue, liveThreads, liveRuns, inboxSeqs, reservations, openWindows, levels };
   }
 
   /** The decider's writes, applied inside the same `transactionSync` that read
@@ -1971,21 +1991,19 @@ export class RunHistoryDO extends DurableObject<Env> {
           this.sql.exec<{ n: number }>(`SELECT COUNT(*) AS n FROM plane_effects WHERE acked_at IS NULL`).toArray()[0]
             ?.n ?? 0,
         );
+        const effectRunId = w.effect.kind === "admit" || w.effect.kind === "steer" ? w.effect.runId : undefined;
         const forRun =
-          w.effect.kind === "admit"
-            ? Number(
+          effectRunId === undefined
+            ? 0
+            : Number(
                 this.sql
-                  .exec<{
-                    n: number;
-                  }>(
-                    // Exact id matching (`admit:<runId>`): the seal runs with bot-minted
-                    // run ids, and a LIKE would read `%`/`_` in one as wildcards.
-                    `SELECT COUNT(*) AS n FROM plane_effects WHERE acked_at IS NULL AND id = 'admit:' || ?`,
-                    w.effect.runId,
+                  .exec<{ n: number }>(
+                    `SELECT COUNT(*) AS n FROM plane_effects
+                     WHERE acked_at IS NULL AND json_extract(body_json, '$.runId') = ?`,
+                    effectRunId,
                   )
                   .toArray()[0]?.n ?? 0,
-              )
-            : 0;
+              );
         const refusal = effectCapRefusal({ total, forRun }, w.effect);
         if (refusal !== undefined) throw new Error(refusal);
         // A re-offer lands after an ack for any kind — a probe re-probes after
@@ -2330,6 +2348,13 @@ export class RunHistoryDO extends DurableObject<Env> {
         // Exact id matching (`admit:<runId>`), never LIKE: a bot-minted run id
         // can carry `%` or `_`, which a pattern would read as wildcards.
         this.sql.exec(`DELETE FROM plane_effects WHERE acked_at IS NULL AND id = 'admit:' || ?`, runId);
+        this.sql.exec(
+          `DELETE FROM plane_effects
+           WHERE acked_at IS NULL
+             AND json_extract(body_json, '$.kind') = 'steer'
+             AND json_extract(body_json, '$.runId') = ?`,
+          runId,
+        );
         // The run's steer dedupe rows and any park go with it (record 0064):
         // a sealed run holds no turn and reads no steer.
         this.sql.exec(`DELETE FROM plane_reservations WHERE kind IN ('steer', 'park') AND run_id = ?`, runId);
@@ -2434,12 +2459,54 @@ export class RunHistoryDO extends DurableObject<Env> {
     this.sql.exec(`INSERT OR REPLACE INTO meta (key, value) VALUES ('plane_disagreements', ?)`, JSON.stringify(counts));
   }
 
+  /** Fence a pushed steer to the owning live generation before its local
+   *  registry is touched. The effect check, owner check and lease renewal are
+   *  one transaction: an expired owner may renew before reclaim, but reclaim
+   *  can never cross the synchronous local delivery that follows a success. */
+  async planeFenceSteer(
+    id: string,
+    runId: string,
+    gen: string,
+    leaseMs: number,
+    now: number,
+  ): Promise<{ accepted: boolean }> {
+    let accepted = false;
+    this.ctx.storage.transactionSync(() => {
+      const offered = this.sql
+        .exec<{ body_json: string }>(`SELECT body_json FROM plane_effects WHERE id = ? AND acked_at IS NULL`, id)
+        .toArray()[0];
+      if (!offered) return;
+      const effect = JSON.parse(offered.body_json) as PlaneEffect;
+      if (effect.kind !== "steer" || effect.runId !== runId) return;
+      const live = this.liveRow(runId);
+      if (!live || live.ownerGen !== gen || live.phase !== "live") return;
+      this.sql.exec(`UPDATE live_runs SET lease_until = ? WHERE run_id = ?`, now + leaseMs, runId);
+      accepted = true;
+    });
+    if (accepted) await this.ensurePlaneAlarm(now);
+    return { accepted };
+  }
+
   /** An effect's acknowledgement by id (orchestration-plane item 7): `done` and `skipped` close it,
-   *  `deferred` leaves it offered for the next answer. An unknown id is a
-   *  no-op — the bot may ack an effect an older table never held. */
-  planeAck(id: string, outcome: PlaneAckOutcome, now: number): { ok: true } {
-    if (outcome !== "deferred")
-      this.sql.exec(`UPDATE plane_effects SET acked_at = ? WHERE id = ? AND acked_at IS NULL`, now, id);
+   *  `deferred` leaves it offered for the next answer. A steer is special: the
+   *  acknowledging generation must still own its live row. A stale process
+   *  may retain registry state during reclaim overlap, but it cannot close the
+   *  durable offer. An unknown id is a no-op. */
+  planeAck(id: string, outcome: PlaneAckOutcome, now: number, owner?: { runId: string; gen: string }): { ok: true } {
+    if (outcome === "deferred") return { ok: true };
+    const offered = this.sql
+      .exec<{ body_json: string }>(`SELECT body_json FROM plane_effects WHERE id = ? AND acked_at IS NULL`, id)
+      .toArray()[0];
+    if (!offered) return { ok: true };
+    const effect = JSON.parse(offered.body_json) as PlaneEffect;
+    if (effect.kind === "steer") {
+      if (!owner || owner.runId !== effect.runId) return { ok: true };
+      const live = this.sql
+        .exec<{ owner_gen: string }>(`SELECT owner_gen FROM live_runs WHERE run_id = ?`, owner.runId)
+        .toArray()[0];
+      if (live?.owner_gen !== owner.gen) return { ok: true };
+    }
+    this.sql.exec(`UPDATE plane_effects SET acked_at = ? WHERE id = ? AND acked_at IS NULL`, now, id);
     return { ok: true };
   }
 
@@ -2543,7 +2610,8 @@ export class RunHistoryDO extends DurableObject<Env> {
   // ---- the thread events of a unit-owned thread (record 0051's reply-as-event rule) --------------
 
   /** The next sequence assigned in one transaction, the per-event cap applied
-   *  (attachments dropped whole, the row saying how many). */
+   *  (attachments dropped whole, the row saying how many). A stable event id
+   *  already on the unit returns its first sequence without another row. */
   async appendUnitEvent(
     instanceId: string,
     unit: string,
@@ -2551,6 +2619,20 @@ export class RunHistoryDO extends DurableObject<Env> {
   ): Promise<{ ok: true; seq: number }> {
     let seq = 1;
     this.ctx.storage.transactionSync(() => {
+      if (event.id !== undefined) {
+        const existing = this.sql
+          .exec<{ seq: number; json: string }>(
+            `SELECT seq, json FROM coordinator_unit_events WHERE instance_id = ? AND unit = ? ORDER BY seq`,
+            instanceId,
+            unit,
+          )
+          .toArray()
+          .find((row) => (JSON.parse(row.json) as ThreadEvent).id === event.id);
+        if (existing !== undefined) {
+          seq = existing.seq;
+          return;
+        }
+      }
       const max = this.sql
         .exec<{
           m: number | null;
@@ -2602,6 +2684,38 @@ export class RunHistoryDO extends DurableObject<Env> {
     return { ok: true };
   }
 
+  /** One transaction is the wake's decision: the indexed answer on the unit
+   * row and every event it consumed become visible together. */
+  async answerUnitWake(
+    unit: CoordinatorUnit,
+    waitId: string,
+    answer: UnitWakeAnswer,
+    seqs: number[],
+    by: string,
+    now: number,
+  ): Promise<{ ok: true }> {
+    this.ctx.storage.transactionSync(() => {
+      const updated = { ...unit, wakes: { ...(unit.wakes ?? {}), [waitId]: answer } };
+      this.sql.exec(
+        `INSERT INTO coordinator_units (instance_id, unit, json, updated_at) VALUES (?, ?, ?, ?)
+         ON CONFLICT(instance_id, unit) DO UPDATE SET json = excluded.json, updated_at = excluded.updated_at`,
+        unit.instanceId,
+        unit.unit,
+        JSON.stringify(updated),
+        now,
+      );
+      for (const seq of seqs)
+        this.sql.exec(
+          `UPDATE coordinator_unit_events SET consumed_by = ? WHERE instance_id = ? AND unit = ? AND seq = ? AND consumed_by IS NULL`,
+          by,
+          unit.instanceId,
+          unit.unit,
+          seq,
+        );
+    });
+    return { ok: true };
+  }
+
   // ---- the live-run ledger (run-history items 28–34) --------------------------
 
   private liveRow(runId: string): LiveRunRow | undefined {
@@ -4820,6 +4934,7 @@ const LEDGER_ROUTES = new Set([
   "/runs/coordinator/events/append",
   "/runs/coordinator/events/list",
   "/runs/coordinator/events/mark-consumed",
+  "/runs/coordinator/wake",
   "/runs/claim",
   "/runs/heartbeat",
   "/runs/append",
@@ -4854,12 +4969,13 @@ const LEDGER_ROUTES = new Set([
   "/runs/session/notepad/write",
 ]);
 
-/** The plane's routes (record 0064; orchestration-plane items 7 and 8): the shadow outcome post and the
- *  effect acknowledgement. Both land on the ledger object of the given store
- *  key, like every `/runs/*` route. */
+/** The plane's routes (record 0064; orchestration-plane items 7 and 8):
+ *  outcomes, effect delivery fencing and acknowledgements land on the ledger
+ *  object of the given store key, like every `/runs/*` route. */
 const PLANE_ROUTES = new Set([
   "/plane/outcome",
   "/plane/ack",
+  "/plane/steer/fence",
   "/plane/admit",
   "/plane/withdraw",
   "/plane/deploy",
@@ -4915,11 +5031,32 @@ async function handlePlane(pathname: string, body: unknown, env: Env): Promise<R
     );
     return json(r);
   }
+  if (pathname === "/plane/steer/fence") {
+    if (typeof b.id !== "string" || b.id.length === 0) return json({ error: "id must be a non-empty string" }, 400);
+    const runId = parseRunId(b.runId);
+    if (!runId.ok) return json({ error: runId.error }, 400);
+    const g = gen(b.gen);
+    if (!g.ok) return json({ error: g.error }, 400);
+    const lease = parseLeaseMs(b.leaseMs);
+    if (!lease.ok) return json({ error: lease.error }, 400);
+    return json(await stub.planeFenceSteer(b.id, runId.value, g.value, lease.value, now));
+  }
   if (pathname === "/plane/ack") {
     if (typeof b.id !== "string" || b.id.length === 0) return json({ error: "id must be a non-empty string" }, 400);
     if (typeof b.outcome !== "string" || !PLANE_ACK_OUTCOMES.has(b.outcome))
       return json({ error: "outcome must be done, skipped or deferred" }, 400);
-    return json(await stub.planeAck(b.id, b.outcome as PlaneAckOutcome, now));
+    let owner: { runId: string; gen: string } | undefined;
+    if (b.owner !== undefined) {
+      if (typeof b.owner !== "object" || b.owner === null || Array.isArray(b.owner))
+        return json({ error: "owner must name a runId and generation" }, 400);
+      const rawOwner = b.owner as Record<string, unknown>;
+      const runId = parseRunId(rawOwner.runId);
+      if (!runId.ok) return json({ error: runId.error }, 400);
+      if (typeof rawOwner.gen !== "string" || rawOwner.gen.length === 0)
+        return json({ error: "owner generation must be a non-empty string" }, 400);
+      owner = { runId: runId.value, gen: rawOwner.gen };
+    }
+    return json(await stub.planeAck(b.id, b.outcome as PlaneAckOutcome, now, owner));
   }
   if (pathname === "/plane/admit") {
     // The admission-stage ask (record 0064, "The queue"): the thread key, the
@@ -5457,8 +5594,22 @@ async function handleLedger(pathname: string, body: unknown, env: Env): Promise<
       return json({ error: "instanceId must be a Workflow instance id" }, 400);
     return json({ units: await stub.listUnits(b.instanceId) });
   }
+  if (pathname === "/runs/coordinator/wake") {
+    if (!isCoordinatorUnit(b.unit)) return json({ error: "unit must be a coordinator unit row" }, 400);
+    if (typeof b.waitId !== "string" || !STEP_NAME_PATTERN.test(b.waitId))
+      return json({ error: "waitId must be a step name" }, 400);
+    if (!isUnitWakeAnswer(b.answer)) return json({ error: "answer must be a unit wake answer" }, 400);
+    if (!Array.isArray(b.seqs) || !b.seqs.every((s) => typeof s === "number" && Number.isInteger(s) && s >= 1))
+      return json({ error: "seqs must be an array of sequence numbers" }, 400);
+    if (typeof b.by !== "string" || b.by.length === 0 || b.by.length > 200)
+      return json({ error: "by must name the consumer" }, 400);
+    const r = await stub.answerUnitWake(b.unit, b.waitId, b.answer, b.seqs as number[], b.by, now);
+    console.log(`[runs/coordinator/wake] ${key.value} ${b.unit.instanceId}:${b.unit.unit} ${b.waitId}`);
+    return json(r);
+  }
   // The thread events of a unit-owned thread (record 0051's reply-as-event rule): append assigns
-  // the sequence, list filters unconsumed, mark-consumed is idempotent.
+  // the sequence (or returns the row with the same stable id), list filters
+  // unconsumed, mark-consumed is idempotent.
   if (pathname.startsWith("/runs/coordinator/events/")) {
     if (typeof b.instanceId !== "string" || !INSTANCE_ID_PATTERN.test(b.instanceId))
       return json({ error: "instanceId must be a Workflow instance id" }, 400);