@coreplane/switchboard 1.259.0 → 1.260.1

package/dist/assets/src/core/memory/types.ts

@@ -9,6 +9,7 @@
  *  live in thread history; duplicating them defeats the token win. Every record
  *  keeps provenance (`sourceThreadKey`/`sourceRunId`) so a distilled fact can be
  *  re-grounded in the run that produced it. */
+import type { Effort } from "../../effort.js";
 import type { TraceOptions } from "../trace/types.js";
 
 export interface MemoryRecord {
@@ -170,6 +171,10 @@ export interface MemoryConfig {
   /** `<provider>/<model>` ref for the post-run reflection (write path) — a cheap
    *  tier. Absent → the run's own resolved model. Never hardcoded (invariant 7). */
   model?: string;
+  /** How hard the extractor's model thinks, one of the five tiers; unset → the
+   *  model's own default. Applied through the model card like a preset's
+   *  effort (`turnEffort`, memory.md item 11). */
+  effort?: Effort;
   /** The durable store: the Memory Worker (deploy/cloudflare-memory/). Absent →
    *  an in-process store that a restart loses (dev only; startup warns). */
   worker?: {

package/dist/assets/src/core/pipelineStanding.ts

@@ -94,6 +94,7 @@ export const ROUND_STAGE = {
   request_changes: "fix",
   no_verdict: "hold",
   checks_failed: "fix",
+  checks_restarted: "approved",
   transient: "hold",
   enqueued: "approved",
   dequeued: "fix",
@@ -110,7 +111,9 @@ export const ROUND_STAGE = {
  *  and holds the stage, and every other kind closes the unit as `ended` with
  *  the kind as detail. `blocked` — a unit status the driver posts to
  *  `unit-end` for a unit that never started — ends the same way. Pinned to
- *  the union: a new ending kind fails the build here. */
+ *  the union: a new ending kind fails the build here. `failed` — the ending
+ *  the driver posts when a step threw inside the walk (cause `step_threw`,
+ *  issue 2100) — closes the unit the same way. */
 export const ENDING_STAGE = {
   merged: "merged",
   already_landed: "merged",
@@ -128,14 +131,17 @@ export const ENDING_STAGE = {
   interrupted: "ended",
   refused: "ended",
   idle: "idle",
+  idle_expired: "ended",
   blocked: "ended",
-} as const satisfies Record<UnitEnding["kind"] | "blocked", Stage | "hold">;
+  failed: "ended",
+} as const satisfies Record<UnitEnding["kind"] | "blocked" | "failed", Stage | "hold">;
 
 /** The user's words for a unit's ending (record 0066): what a card, a plan
  *  summary and the web unit page print instead of the internal token —
  *  `merge_ready` reads `merge-ready`, `round_cap` reads `round cap reached`,
  *  never the snake_case kind. Pinned to the union plus `blocked` (the driver's
- *  never-started status), so a new ending kind fails the build here. */
+ *  never-started status) and `failed` (the driver's step-threw ending, issue
+ *  2100), so a new ending kind fails the build here. */
 export const ENDING_WORDS = {
   merged: "merged",
   already_landed: "merged",
@@ -153,8 +159,10 @@ export const ENDING_WORDS = {
   interrupted: "interrupted",
   refused: "refused",
   idle: "idle",
+  idle_expired: "idle expired",
   blocked: "blocked",
-} as const satisfies Record<UnitEnding["kind"] | "blocked", string>;
+  failed: "failed",
+} as const satisfies Record<UnitEnding["kind"] | "blocked" | "failed", string>;
 
 /** The user's words for a round outcome (record 0066): the card's unit line
  *  prints these beside the round header, never `checks_failed` or another
@@ -167,6 +175,7 @@ export const ROUND_OUTCOME_WORDS = {
   request_changes: "changes requested",
   no_verdict: "no verdict",
   checks_failed: "checks failed",
+  checks_restarted: "checks restarted",
   transient: "retried",
   enqueued: "queued to merge",
   dequeued: "removed from the merge queue",

package/dist/assets/src/core/plane/decide.ts

@@ -193,6 +193,11 @@ export interface PlaneQueueRow {
 export interface PlaneState {
   queue: PlaneQueueRow[];
   liveThreads: string[];
+  /** The live runs and their message route: provider recovery only steers a
+   *  run whose durable row still exists, and its row remains readable after a reclaim. */
+  liveRuns: Record<string, { channelId: string; threadKey: string }>;
+  /** The greatest durable inbox sequence per live run, read in the decision's transaction. */
+  inboxSeqs: Record<string, number>;
   /** Threads an admitted ask holds before its claim lands (or after, until the seal). */
   reservations: PlaneReservation[];
   /** Open window kinds; `deploy` is the pending-deploy window (`deploy_settled` is its absence). */
@@ -202,7 +207,7 @@ export interface PlaneState {
 }
 
 export function emptyPlaneState(): PlaneState {
-  return { queue: [], liveThreads: [], reservations: [], openWindows: [], levels: [] };
+  return { queue: [], liveThreads: [], liveRuns: {}, inboxSeqs: {}, reservations: [], openWindows: [], levels: [] };
 }
 
 /** The window kind behind `deploy_settled`: opened while a deploy is pending,
@@ -374,6 +379,10 @@ export type PlaneEffect =
    *  (record 0064): the id is `probe:<resident>`, so the object holds at most one
    *  open probe per resident and a duplicate offer is the same effect. */
   | { id: string; kind: "probe"; resident: string }
+  /** Deliver an already-durable provider-recovery steer to the owning live
+   *  run. The inbox sequence is the idempotency key across push, heartbeat and
+   *  reclaim; execution never writes the durable row again. */
+  | { id: string; kind: "steer"; runId: string; seq: number; message: PlaneSteerMessage }
   /** The `unit_title` move (record 0064): retitle the pull request under the
    *  title rule — the bot re-reads the title before acting, so a person's own
    *  retitle first makes this a `skipped`. Id `retitle:<repo>#<number>`. */
@@ -599,12 +608,40 @@ function onRunnerStatus(
   return { state, effects: [effect], writes: [{ table: "plane_effects", op: "offer", effect, at: event.at }] };
 }
 
+/** The typed provider-recovery row carried by both the durable inbox and its
+ *  live-delivery effect. */
+export interface PlaneSteerMessage {
+  [key: string]: unknown;
+  channelId: string;
+  threadKey: string;
+  text: string;
+  at: number;
+  userId: "plane";
+  userName: "plane";
+  plane: { steer: "reissue"; provider: string };
+}
+
 /** The inbox row a plane steer writes: sender `plane` (record 0064), the sentence as
  *  the text, and the cause under `plane` so the run page can say why. */
 function planeInboxMessage(text: string, at: number, plane: Record<string, unknown>): Record<string, unknown> {
   return { text, at, userId: "plane", userName: "plane", plane };
 }
 
+function reissueInboxMessage(
+  provider: string,
+  at: number,
+  route: { channelId: string; threadKey: string },
+): PlaneSteerMessage {
+  return {
+    ...route,
+    text: reissueSteerSentence(provider),
+    at,
+    userId: "plane",
+    userName: "plane",
+    plane: { steer: "reissue", provider },
+  };
+}
+
 /** The checkpoint steer (record 0064, "The backpressure contract"): a stalled
  *  or push-less coding run reads one fixed sentence at its next boundary. At
  *  most one reservation per run per round per cause, and — the sentence being
@@ -669,21 +706,25 @@ function onProviderLevel(
   let next = { ...state, levels };
   if (event.level === "down") return { state: next, effects: [], writes };
   const parked = next.reservations.filter((r) => r.kind === "park" && r.key.startsWith(`${event.provider}#`));
+  const steers: PlaneEffect[] = [];
+  const inboxSeqs = { ...next.inboxSeqs };
   for (const p of parked) {
-    writes.push({
-      table: "run_inbox",
-      op: "push",
-      runId: p.runId,
-      message: planeInboxMessage(reissueSteerSentence(event.provider), event.at, {
-        steer: "reissue",
-        provider: event.provider,
-      }),
-    });
+    const route = next.liveRuns[p.runId];
+    if (route) {
+      const seq = (inboxSeqs[p.runId] ?? 0) + 1;
+      inboxSeqs[p.runId] = seq;
+      const message = reissueInboxMessage(event.provider, event.at, route);
+      const effect: PlaneEffect = { id: `steer:${p.runId}:${seq}`, kind: "steer", runId: p.runId, seq, message };
+      steers.push(effect);
+      writes.push({ table: "run_inbox", op: "push", runId: p.runId, message });
+      writes.push({ table: "plane_effects", op: "offer", effect, at: event.at });
+    }
     writes.push({ table: "plane_reservations", op: "del", key: p.key, kind: "park" });
   }
-  if (parked.length > 0) next = { ...next, reservations: next.reservations.filter((r) => !parked.includes(r)) };
+  if (parked.length > 0)
+    next = { ...next, inboxSeqs, reservations: next.reservations.filter((r) => !parked.includes(r)) };
   const walked = walk(next, event.at);
-  return { ...walked, writes: [...writes, ...walked.writes] };
+  return { ...walked, effects: [...steers, ...walked.effects], writes: [...writes, ...walked.writes] };
 }
 
 /** A run parked on its provider: one park row — a second park of the same run

package/dist/assets/src/core/provider.ts

@@ -50,6 +50,11 @@ export interface CompletionRequest {
   maxTokens: number;
   /** model effort hint; providers apply it only where the model supports it */
   effort?: Effort;
+  /** The wire word the model card decided for `effort` (`turnEffort`,
+   *  routing-and-config item 2) — vouched or degraded by the card's levels
+   *  map. Rides only beside `effort`; absent, a provider that applies effort
+   *  sends the tier's own word. */
+  effortWord?: string;
   /** Cancellation for a hard run stop: providers pass it to their HTTP
    *  call so an aborted run stops billing/streaming now. Absent → never aborts. */
   signal?: AbortSignal;

package/dist/assets/src/core/runEvents.ts

@@ -294,6 +294,10 @@ export type RunNoteKind =
    *  there was nothing to push), so a re-issue starts from the partial work
    *  (docs/reference/specs/agent-ship.md item 8). */
   | "budget_salvage"
+  /** A coordinator's coding child ended failed, stopped or interrupted with
+   *  work in its tree: before teardown the run loop made a WIP commit and
+   *  pushed the unit branch, or recorded why no push was possible. */
+  | "work_salvage"
   /** A pi run's compaction failed for good — the provider refused the summary
    *  (harness-pi.md item 7) — and the run loop treated it as a checkpoint
    *  signal: the tracked changes were committed and pushed to the run's own
@@ -363,6 +367,7 @@ export const RUN_NOTE_KINDS = [
   "tool_unnamed",
   "directory_reached",
   "budget_salvage",
+  "work_salvage",
   "compaction_salvage",
   "stuck_loop",
   "decline_cascade",
@@ -432,6 +437,9 @@ export type ShipRoundOutcome =
    *  0055): the failures become check findings and the findings step runs as
    *  for any changes-requested round. */
   | "checks_failed"
+  /** No required check appeared during the checks step's grace chunk, so the
+   *  runner re-fired the pull_request event once by closing and reopening it. */
+  | "checks_restarted"
   /** The round's coding child died on a provider transient with nothing
    *  pushed (issue 1932): the first such boundary marks the round's one
    *  re-run, a second the `transient` ending. */
@@ -1070,15 +1078,13 @@ export type RunEvent =
       seq?: number;
       at?: number;
     }
-  /** The operator's decision beside the routed request ([record 0057](../../docs/decisions/0057-the-operator-is-the-one-door-a-model-binds-every-chat-input-and-deterministic-code-authorizes-fences-and-executes.md);
-   *  the one-door plan's operator unit; run-history item 60): one per admitted chat
-   *  event under `routing.operator: shadow` or `on`, published beside the
-   *  `route` event. The decision is binds, a question, a refusal or — the
-   *  structured seam's floor ([record 0067](../../docs/decisions/0067-one-seam-for-a-structured-answer-a-violation-is-re-asked-with-the-violation-named-and-the-callers-declared-floor-holds-never-a-refusal-shown-to-the-person.md)),
-   *  never the model's decision — `non_decision`: under `on` the dispatcher
-   *  falls back to the readers' route for that event, this event recorded on
-   *  the run that then runs; `attempts` lists what each answer violated or
-   *  that it was accepted. A bind's `line` is redacted and cut like the
+  /** The operator's decision ([record 0057](../../docs/decisions/0057-the-operator-is-the-one-door-a-model-binds-every-chat-input-and-deterministic-code-authorizes-fences-and-executes.md);
+   *  run-history item 60): one per admitted chat event under
+   *  `routing.operator: shadow` or `on`. A no-call turn is repaired once and a
+   *  second becomes a typed general bind with reason `no_decision`; another
+   *  exhausted violation may remain `non_decision` and resolves on the
+   *  configured default with no second model. `attempts` lists what each
+   *  answer violated or that it was accepted. A bind's `line` is redacted and cut like the
    *  receipt (`ROUTE_RECEIPT_CAP`), never the message text; `intake` carries
    *  the intake gate's verdict when the gate is present; `latencyMs` and
    *  `outputTokens` feed the replay's median rows. Under `shadow` nothing
@@ -1088,16 +1094,17 @@ export type RunEvent =
       mode: "shadow" | "on";
       outcome: "binds" | "question" | "refusal" | "non_decision";
       reason: string;
-      /** The decision was the loop's floor (record 0069, as amended): a turn
-       *  that ended with no tool call, or the bounded re-asks ran out — the
-       *  readers' route ran the person's own request, and the event never
-       *  re-enters the loop. Additive: unknown → ignored. */
+      /** Historical marker from records written before the readers' router
+       *  retired. New events never emit it. Additive: unknown → ignored. */
       floored?: true;
       /** A bind marked `confirmed` is a pending question's confirmed proposal
        *  (`bindFromAnswer`): the line itself carries the task — the person's
        *  message was the word "yes" — so a confirmed preset line routes its
-       *  own tail as the request. Additive: unknown → a fresh bind. */
-      binds?: ReadonlyArray<{ line: string; reason: string; confirmed?: true }>;
+       *  own tail as the request. Additive: unknown → a fresh bind. A bind's
+       *  `model` is the ref the run uses, resolved from a model the person
+       *  named in plain words (the plain-words model unit) — applied at
+       *  directive precedence. Additive: unknown → no model. */
+      binds?: ReadonlyArray<{ line: string; reason: string; model?: string; repo?: string; confirmed?: true }>;
       question?: string;
       /** A question's proposed line, redacted and cut like the receipt — what
        *  the next turn's "yes" binds (`bindFromAnswer`). */

package/dist/assets/src/core/runLedger/types.ts

@@ -128,9 +128,9 @@ export interface LiveRunMeta {
 export type RunState = Record<string, unknown>;
 
 /** A hosted ship parent's hosting fact on the row's state (record 0060): the
- *  runner instance the run hosts and the deadline past which a reclaim closes
- *  the row `interrupted` instead of re-hosting it. Set by the ship branch once
- *  the instance exists; read by the boot reclaim. */
+ *  runner instance the run hosts and its original wall-clock estimate. Reclaim
+ *  may outlive that estimate while the Workflow or one of its child rows is
+ *  live; only no durable owner beyond it closes the row. */
 export interface HostingState {
   instanceId: string;
   /** Epoch ms: the hand-off time plus the instance's `caps.maxMinutes` plus

package/dist/assets/src/core/runRecord.ts

@@ -15,6 +15,7 @@ import {
 } from "./reviewVerdict.js";
 import { IDEMPOTENCY_KEY_PATTERN, INSTANCE_ID_PATTERN } from "./coordinator/contract.js";
 import { isPipelineSummaryShape, type PipelineSummary } from "./pipelineStanding.js";
+import { RESTART_CLAIM_GRACE_MS } from "./budgets.js";
 import {
   FRICTION_CATEGORIES,
   type CategoryTotals,
@@ -231,6 +232,11 @@ export interface RunRecord {
    *  waiting for `child_resumed` instead of ending its unit on this record.
    *  Absent on every ending that is final. */
   restarting?: true;
+  /** Epoch ms through which a `restarting` close with no visible successor is
+   *  projected as running. Current writers stamp one central grace from the
+   *  close; absent on legacy restarting records, which retain the old
+   *  unbounded compatibility behavior, and on every final ending. */
+  restartUntil?: number;
   /** Where the run's conversation started (item 52): `channel` — its own
    *  thread's history, as for every run a person, a schedule or a coordinator
    *  started — or `parent` — a spawned child seeded from its parent's text
@@ -283,19 +289,23 @@ export interface RunLease {
   loopEndsAt: number;
 }
 
-/** A head a run pushed, as the record names it (item 2): the branch and the sha. */
+/** A head a run pushed, as the record names it (item 2): the branch, sha,
+ *  and whether the agent pushed it or the run's mechanical WIP salvage did.
+ *  `by` is optional for records written before that distinction survived the
+ *  event fold. */
 export interface PushedHead {
   ref: string;
   sha: string;
+  by?: "push" | "salvage";
 }
 
 /** The heads a run's events say it pushed — one per branch, the last event's
  *  sha winning, in first-seen order — or nothing when it pushed none. */
 export function pushedHeadsOf(events: readonly RunEvent[]): PushedHead[] | undefined {
-  const byRef = new Map<string, string>();
-  for (const e of events) if (e.type === "pushed_head") byRef.set(e.ref, e.sha);
+  const byRef = new Map<string, { sha: string; by: "push" | "salvage" }>();
+  for (const e of events) if (e.type === "pushed_head") byRef.set(e.ref, { sha: e.sha, by: e.by });
   if (byRef.size === 0) return undefined;
-  return [...byRef].map(([ref, sha]) => ({ ref, sha }));
+  return [...byRef].map(([ref, pushed]) => ({ ref, ...pushed }));
 }
 
 /** The lease a run's events say its harness started — the first `lease`
@@ -434,7 +444,7 @@ export interface RunOperatorDecision {
   mode: "shadow" | "on";
   outcome: "binds" | "question" | "refusal" | "non_decision";
   reason: string;
-  binds?: { line: string; reason: string }[];
+  binds?: { line: string; reason: string; model?: string; repo?: string; confirmed?: true }[];
   question?: string;
   /** A question's proposed line — what the next turn's "yes" binds. */
   proposal?: string;
@@ -462,7 +472,17 @@ export function operatorOfEvents(events: readonly RunEvent[]): RunOperatorDecisi
     mode: e.mode,
     outcome: e.outcome,
     reason: e.reason,
-    ...(e.binds ? { binds: e.binds.map((b) => ({ line: b.line, reason: b.reason })) } : {}),
+    ...(e.binds
+      ? {
+          binds: e.binds.map((b) => ({
+            line: b.line,
+            reason: b.reason,
+            ...(b.model !== undefined ? { model: b.model } : {}),
+            ...(b.repo !== undefined ? { repo: b.repo } : {}),
+            ...(b.confirmed ? { confirmed: true as const } : {}),
+          })),
+        }
+      : {}),
     ...(e.question !== undefined ? { question: e.question } : {}),
     ...(e.proposal !== undefined ? { proposal: e.proposal } : {}),
     ...(e.request !== undefined ? { request: e.request } : {}),
@@ -944,11 +964,34 @@ export function normalizeDiagnosis(d: FrictionDiagnosis): FrictionDiagnosis {
 /** `normalizeDiagnosis` applied to anything carrying a `diagnosis` — a record or
  *  a listing row — on its way out of a store, and the `channelVisibility` stamp
  *  filled with `unknown` for a row written before it existed (fail-closed:
- *  `unknown` is never public). */
+ *  `unknown` is never public). A restart deadline is trusted only inside the
+ *  central grace after its persisted close stamp; malformed or overlong
+ *  values drop the restarting projection, while a legacy row with no deadline
+ *  keeps its compatibility behavior. */
 export function normalizeStored<T extends { diagnosis: FrictionDiagnosis; channelVisibility?: ChannelVisibility }>(
   v: T,
 ): T & { channelVisibility: ChannelVisibility } {
-  return { ...v, diagnosis: normalizeDiagnosis(v.diagnosis), channelVisibility: v.channelVisibility ?? "unknown" };
+  const normalized = {
+    ...v,
+    diagnosis: normalizeDiagnosis(v.diagnosis),
+    channelVisibility: v.channelVisibility ?? "unknown",
+  } as T & { channelVisibility: ChannelVisibility };
+  const restart = normalized as T & { restarting?: unknown; restartUntil?: unknown; finishedAt?: unknown };
+  if (restart.restartUntil !== undefined) {
+    const bounded =
+      restart.restarting === true &&
+      typeof restart.restartUntil === "number" &&
+      Number.isFinite(restart.restartUntil) &&
+      typeof restart.finishedAt === "number" &&
+      Number.isFinite(restart.finishedAt) &&
+      restart.restartUntil >= restart.finishedAt &&
+      restart.restartUntil <= restart.finishedAt + RESTART_CLAIM_GRACE_MS;
+    if (!bounded) {
+      delete restart.restarting;
+      delete restart.restartUntil;
+    }
+  }
+  return normalized;
 }
 
 /** Structural check on a record from outside the process (a Worker response, a
@@ -990,8 +1033,14 @@ export function isRunRecord(v: unknown): v is RunRecord {
       Array.isArray(r.pushed) &&
       r.pushed.every((h) => {
         if (typeof h !== "object" || h === null) return false;
-        const { ref, sha } = h as Record<string, unknown>;
-        return typeof ref === "string" && ref.length > 0 && typeof sha === "string" && /^[0-9a-f]{7,40}$/.test(sha);
+        const { ref, sha, by } = h as Record<string, unknown>;
+        return (
+          typeof ref === "string" &&
+          ref.length > 0 &&
+          typeof sha === "string" &&
+          /^[0-9a-f]{7,40}$/.test(sha) &&
+          (by === undefined || by === "push" || by === "salvage")
+        );
       })
     )
   )
@@ -1027,8 +1076,12 @@ export function isRunRecord(v: unknown): v is RunRecord {
   // marker, like `provisional`, is the literal `true` or absent.
   if (r.pipeline !== undefined && !isPipelineSummaryShape(r.pipeline)) return false;
   if (r.hosted !== undefined && r.hosted !== true) return false;
-  // A restarting close carries the literal `true` or nothing (record 0064).
+  // A restarting close carries the literal `true` and, on current writers,
+  // one finite deadline; legacy closes carry no deadline. The persisted close
+  // stamp bounds a future value in `normalizeStored`, where it can fail closed
+  // without making the whole record unreadable.
   if (r.restarting !== undefined && r.restarting !== true) return false;
+  if (r.restartUntil !== undefined && (!isFiniteNumber(r.restartUntil) || r.restarting !== true)) return false;
   if (typeof r.channelId !== "string" || typeof r.userId !== "string" || typeof r.threadKey !== "string") return false;
   if (r.relayedBy !== undefined && typeof r.relayedBy !== "string") return false;
   if (r.authenticatedAs !== undefined && typeof r.authenticatedAs !== "string") return false;