@coreplane/switchboard 1.260.0 → 1.260.1

package/dist/assets/config/config.example.yaml

@@ -172,6 +172,7 @@ defaults:
 # "config set channel ..." are stored in data/overrides.json and win over these.
 # channels:
 #   slack:C012345:
+#     repo: acme/api                # default repository for repo-bound asks in this channel
 #     agent: review
 #     models:
 #       review: anthropic/claude-opus-5

package/dist/assets/deploy/cloudflare/worker.ts

@@ -28,14 +28,10 @@ import {
 import {
   authenticateIngressBearer,
   authenticateRestart,
+  authorizeRestartDeployer,
   decideRestart,
-  parseRestartAuthorization,
   parseRestartRequest,
-  RESTART_AUTHORIZE_PATH,
-  RESTART_SUBJECT_HEADER,
   restartResponse,
-  stripRestartSubject,
-  type RestartAuth,
   type RestartOutcome,
 } from "../../src/deploy/restart.ts";
 import {
@@ -89,7 +85,8 @@ export interface Env {
   ACCESS_TEAM_DOMAIN?: string; // live-view SSO gate: Cloudflare Access team domain (JWKS + iss)
   ACCESS_AUD?: string; // live-view SSO gate: Cloudflare Access application AUD tag
   DASHBOARD_TOKEN?: string; // dashboard auth `token` strategy: the bearer (the default env name; config may name another)
-  SWITCHBOARD_INGRESS_TOKENS?: string; // enables HTTP /ingress + MCP /mcp (JSON token→identity map); the `cron` entry is what scheduled runs present; an entry whose `http:<subject>` actor holds `deploy:write` in the bot's config may POST /admin/restart
+  SWITCHBOARD_INGRESS_TOKENS?: string; // enables HTTP /ingress + MCP /mcp (JSON token→identity map); the `cron` entry is what scheduled runs present
+  SWITCHBOARD_RESTART_DEPLOYER?: string; // deployment-profile grant: the token-map subject allowed to POST /admin/restart; Worker-only, never runtime config
   BRAVE_SEARCH_API_KEY?: string; // web_search backend (Brave); web_fetch works without it
   GITHUB_WEBHOOK_SECRET?: string; // check-run intake: signs POST /webhooks/github; absent, the intake answers 503 disabled
   CF_ANALYTICS_TOKEN?: string; // costs dash: Cloudflare API token, Account Analytics:Read only
@@ -211,37 +208,6 @@ export class SwitchboardServer extends Container<Env> {
     return this.restartRunning(opts);
   }
 
-  /**
-   * `deploy restart`, authorized: the Worker knows WHO the bearer is (the token
-   * map); WHETHER that identity may restart is the bot's config (`grants` —
-   * authorization.md item 9), which only the container holds. So ask it —
-   * `POST /admin/restart/authorize` with the authenticated subject in
-   * `RESTART_SUBJECT_HEADER` (never the bearer: the container may still hold the
-   * token map from before a rotation) — and stop only on a 200. A container that
-   * is not running is started first (the bot must answer): if the bearer is
-   * allowed, that start already put the current env live, so nothing is
-   * stopped and the outcome is `not-running`, exactly as before; if not, the
-   * refusal is relayed and the started container simply keeps serving.
-   */
-  async restartAuthorized(
-    subject: string,
-    opts: { force: boolean },
-  ): Promise<{ auth: RestartAuth; outcome?: RestartOutcome }> {
-    const wasRunning = this.ctx.container?.running === true;
-    await this.startBot();
-    const answer = await this.containerFetch(
-      new Request(`${INTERNAL}${RESTART_AUTHORIZE_PATH}`, {
-        method: "POST",
-        headers: { [RESTART_SUBJECT_HEADER]: subject },
-      }),
-      this.defaultPort,
-    );
-    const auth = parseRestartAuthorization(answer.status, await answer.text().catch(() => ""));
-    if (!auth.ok) return { auth };
-    if (!wasRunning) return { auth, outcome: { kind: "not-running" } };
-    return { auth, outcome: await this.restartRunning(opts) };
-  }
-
   /** The stop itself, for a running container: the preflight's refusal rules over `/healthz`, then SIGTERM. */
   private async restartRunning(opts: { force: boolean }): Promise<RestartOutcome> {
     const health = await this.containerFetch(new Request(`${INTERNAL}/healthz`), this.defaultPort);
@@ -265,12 +231,12 @@ export class SwitchboardServer extends Container<Env> {
   }
 }
 
-/** `POST /admin/restart` — the operator surface behind `deploy restart`
- *  (src/deploy/restart.ts documents the authorization choice: a
- *  SWITCHBOARD_INGRESS_TOKENS bearer whose `http:<subject>` actor holds
- *  `deploy:write` in the bot's config). The Worker authenticates the bearer
- *  against the map it holds — an unknown bearer never touches the container —
- *  and the Container DO asks the bot for the grant before stopping anything.
+/** `POST /admin/restart` — the operator surface behind `deploy restart`.
+ *  The Worker authenticates the bearer against its token map, then authorizes
+ *  that subject against SWITCHBOARD_RESTART_DEPLOYER, rendered from the
+ *  deployment profile (or set directly as a Worker var). Runtime config is
+ *  never consulted: this route must remain usable when that document is what
+ *  the restart is repairing.
  *  Body `{ "force": true }` bypasses the fail-closed refusals (no JSON body,
  *  impossible `inFlight`); runs in flight or a drain warn and never refuse. */
 async function handleAdminRestart(request: Request, env: Env): Promise<Response> {
@@ -283,14 +249,16 @@ async function handleAdminRestart(request: Request, env: Env): Promise<Response>
     console.warn(`[restart] ${authn.status} — ${authn.reason}`);
     return json(authn.status, { ok: false, error: authn.reason });
   }
+  const auth = authorizeRestartDeployer(authn.identity.subject, env.SWITCHBOARD_RESTART_DEPLOYER);
+  if (!auth.ok) {
+    console.warn(`[restart] ${auth.status} — ${auth.reason}`);
+    return json(auth.status, { ok: false, error: auth.reason });
+  }
   const parsed = parseRestartRequest(await request.text().catch(() => ""));
   if (!parsed.ok) return json(400, { ok: false, error: parsed.reason });
-  let auth: RestartAuth;
-  let outcome: RestartOutcome | undefined;
+  let outcome: RestartOutcome;
   try {
-    ({ auth, outcome } = await getContainer(env.SWITCHBOARD, INSTANCE).restartAuthorized(authn.identity.subject, {
-      force: parsed.force,
-    }));
+    outcome = await getContainer(env.SWITCHBOARD, INSTANCE).restart({ force: parsed.force });
   } catch (err) {
     // The container's /healthz probe or the DO call threw (container mid-transition,
     // port not answering): fail closed in the route's own JSON shape so the CLI reads
@@ -299,11 +267,6 @@ async function handleAdminRestart(request: Request, env: Env): Promise<Response>
     console.error(`[restart] ${authn.identity.subject} → error before stop: ${reason}`);
     return json(500, { ok: false, error: `restart failed before stopping anything: ${reason}` });
   }
-  if (!auth.ok || outcome === undefined) {
-    const refusal = auth.ok ? { status: 503 as const, reason: "restart disabled: no outcome" } : auth;
-    console.warn(`[restart] ${refusal.status} — ${refusal.reason}`);
-    return json(refusal.status, { ok: false, error: refusal.reason });
-  }
   console.log(
     `[restart] ${auth.subject} → ${outcome.kind}${outcome.kind === "refused" ? `: ${outcome.problems.join("; ")}` : ""}`,
   );
@@ -494,9 +457,7 @@ export default {
     // caller sent is stripped, and what the container sees carries this
     // Worker's own root. A static asset or the live view's SSE stream gets no
     // root; a refusal's line is dropped by the sink's filter.
-    // The restart-subject header is the Worker's own word to the container (the
-    // authorize call below); a caller cannot be allowed to speak it.
-    const inbound = stripRestartSubject(stripTraceContext(request));
+    const inbound = stripTraceContext(request);
     const route = shimRoute(pathname);
     if (route === undefined) return withLength(await getContainer(env.SWITCHBOARD, INSTANCE).fetch(inbound));
     const root = tracer.start("bot-shim.fetch", { sinks: traceSinks, attrs: { route } });

package/dist/assets/deploy/cloudflare/wrangler.template.jsonc

@@ -31,6 +31,12 @@
     "ACCESS_TEAM_DOMAIN": "{{access.teamDomain}}",
     "ACCESS_AUD": "{{access.aud}}",
     // {{/if}}
+    // The restart route's deployment-side grant. The Worker authenticates a
+    // bearer through SWITCHBOARD_INGRESS_TOKENS and compares its subject here;
+    // it never asks the runtime config it may be restarting to repair.
+    // {{#if restart}}
+    "SWITCHBOARD_RESTART_DEPLOYER": "{{restart.deployer}}",
+    // {{/if}}
     // The state Worker (deploy/cloudflare-memory/): where worker.ts records each
     // scheduled firing for the /runs Scheduled panel, with MEMORY_TOKEN.
     // A profile without a memory Worker renders no var: firings go unrecorded.

package/dist/assets/deploy/profile.example.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "The deployment profile: where THIS installation runs. Copy to deploy/profile.json and fill it in (or run `switchboard deploy init`). The account is your Cloudflare account id; every hostname must be under `zone`, a zone in that account, unless the Worker names its own `zone` (also in the account); `workers.bot` is the one required Worker — leave `memory`, `resident` or `sandbox` out and `deploy plan` has no step for them (a bot-only profile is a one-step plan; without `memory` the config is not pushed anywhere). The project's docs site is not a Worker of an installation: it is the project's website, deployed by the project's own CI from project.json, so there is no `docs` entry. `configSource` is where `deploy all` reads the bot's runtime config from before building the image — a path, `github://owner/repo/path@ref` (needs CONFIG_REPO_TOKEN), or `op://Vault/Item/field` (needs OP_SERVICE_ACCOUNT_TOKEN); `secretsSource` is where `secrets put` reads values from — a directory of <NAME> files (the default when absent) or `op://Vault/Item`. `images` is where the bot, resident and sandbox container images come from: `registry` — the release's published images, copied once per version into your account registry by `deploy all` itself (or `deploy images` ahead of it) over HTTPS and referenced from there — no Docker anywhere, a Cloudflare API token with Containers Edit in CLOUDFLARE_API_TOKEN for the copy (an installation deploying published images; what `init` writes from the published package); or `build` (the default when absent) — each Worker's Dockerfile, built by wrangler where `deploy all` runs (a checkout; the project's own production). `artifacts` (optional) names the R2 bucket a run's files move through (docs/reference/specs/execution.md item 20): with it the bot Worker binds the bucket and `deploy` creates it before the upload (the credential then needs Workers R2 Storage: Edit); the bot's runtime config `artifacts.r2.bucket` must say the same name. `metrics` (optional) names the Analytics Engine dataset every finished run's point is written to (docs/reference/specs/run-metrics.md): the state Worker's template then binds it as `RUN_METRICS` with the name beside it in `RUN_METRICS_DATASET` — nothing is created ahead of the deploy, the platform creates the dataset on first write — and the bot's runtime config `metrics.dataset` must say the same name (the bot warns at boot when the two differ). `deploy plan` reads this example when no profile exists; `deploy all` refuses it.",
+  "$comment": "The deployment profile: where THIS installation runs. Copy to deploy/profile.json and fill it in (or run `switchboard deploy init`). The account is your Cloudflare account id; every hostname must be under `zone`, a zone in that account, unless the Worker names its own `zone` (also in the account); `workers.bot` is the one required Worker — leave `memory`, `resident` or `sandbox` out and `deploy plan` has no step for them (a bot-only profile is a one-step plan; without `memory` the config is not pushed anywhere). The project's docs site is not a Worker of an installation: it is the project's website, deployed by the project's own CI from project.json, so there is no `docs` entry. `configSource` is where `deploy all` reads the bot's runtime config from before building the image — a path, `github://owner/repo/path@ref` (needs CONFIG_REPO_TOKEN), or `op://Vault/Item/field` (needs OP_SERVICE_ACCOUNT_TOKEN); `restart.deployer` is the SWITCHBOARD_INGRESS_TOKENS subject the Worker itself allows to restart the bot, independent of runtime config so config recovery cannot lock itself out; `secretsSource` is where `secrets put` reads values from — a directory of <NAME> files (the default when absent) or `op://Vault/Item`. `images` is where the bot, resident and sandbox container images come from: `registry` — the release's published images, copied once per version into your account registry by `deploy all` itself (or `deploy images` ahead of it) over HTTPS and referenced from there — no Docker anywhere, a Cloudflare API token with Containers Edit in CLOUDFLARE_API_TOKEN for the copy (an installation deploying published images; what `init` writes from the published package); or `build` (the default when absent) — each Worker's Dockerfile, built by wrangler where `deploy all` runs (a checkout; the project's own production). `artifacts` (optional) names the R2 bucket a run's files move through (docs/reference/specs/execution.md item 20): with it the bot Worker binds the bucket and `deploy` creates it before the upload (the credential then needs Workers R2 Storage: Edit); the bot's runtime config `artifacts.r2.bucket` must say the same name. `metrics` (optional) names the Analytics Engine dataset every finished run's point is written to (docs/reference/specs/run-metrics.md): the state Worker's template then binds it as `RUN_METRICS` with the name beside it in `RUN_METRICS_DATASET` — nothing is created ahead of the deploy, the platform creates the dataset on first write — and the bot's runtime config `metrics.dataset` must say the same name (the bot warns at boot when the two differ). `deploy plan` reads this example when no profile exists; `deploy all` refuses it.",
   "account": "00000000000000000000000000000000",
   "zone": "example.com",
   "workers": {
@@ -9,5 +9,6 @@
     "sandbox": { "script": "switchboard-sandbox", "hostname": "switchboard-sandbox.example.com" }
   },
   "configSource": "config/config.yaml",
+  "restart": { "deployer": "deployer" },
   "images": "registry"
 }

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.260.0",
+  "version": "1.260.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.260.0",
+      "version": "1.260.1",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.260.0",
+      "version": "1.260.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.260.0",
+  "version": "1.260.1",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.260.0",
-  "commit": "33c6cd103ce9d8a49be5249f98306fe46160f81c",
-  "builtAt": "2026-09-21T15:19:23.063Z"
+  "version": "1.260.1",
+  "commit": "c57cb7b614e8916b3fd0ab86c848a8398d8dc781",
+  "builtAt": "2026-09-21T18:18:08.788Z"
 }

package/dist/assets/src/core/budgets.ts

@@ -104,11 +104,18 @@ export const HARNESS_PROBE_WAIT_MS = 5 * MINUTE_MS;
  *  `maxMinutes` so one nobody lifted is an hour and a half, not a day. A run
  *  asked during a drain waits at its attach one `pollMs` at a time under its
  *  own lease less `leaseReserveMs` (what the attach and the work after it
- *  need), `waitMaxMs` with no lease to clip it. */
+ *  need), `waitMaxMs` with no lease to clip it — unless a fallback stands
+ *  behind the attach: `fallbackWaitMs` bounds the wait by the FALLBACK's own
+ *  cost, never the deploy's (issue 2101: a run refused by the drain waited
+ *  18 minutes for the whole deploy, then did the job in a seeded sandbox that
+ *  stands up in about two), so a drain refusal on a first attach falls to the
+ *  seeded sandbox after at most a few minutes; a re-attach with no fallback —
+ *  a resumed run, a mid-run recovery — keeps the lease's bound. */
 export const DRAIN = {
   pollMs: 30_000,
   waitMaxMs: 60 * MINUTE_MS,
   leaseReserveMs: 10 * MINUTE_MS,
+  fallbackWaitMs: 3 * MINUTE_MS,
   deployWaitMaxMs: 60 * MINUTE_MS,
   marginMinutes: 5,
   maxMinutes: 90,
@@ -218,11 +225,10 @@ export const MERGE_WAIT_ASK_MINUTES = 60;
  *  request's line with the conflict named, never a retry loop. */
 export const PULL_SWEEP = { leaseMinutes: 15, spendCapUsd: 5 } as const;
 
-/** The provider retry ladder (issue 1932): the backoff before each retry of a
- *  transient model-call failure — a gateway 5xx, a stream cut before
- *  `message_stop`, a gateway timeout. Three attempts with growing waits,
- *  charged to the run's lease; the waits stay small next to the run's minutes
- *  because the observed blips are edge transients of seconds. */
+/** The provider retry ladder: the first backoffs for a transport-class
+ *  model-call failure. The final rung repeats while the run's loop lease has
+ *  time, so these are pacing intervals rather than a three-attempt terminal
+ *  budget. */
 export const PROVIDER_RETRY_BACKOFFS_MS = [5_000, 15_000, 45_000] as const;
 
 /** A hosted ship parent's deadline margin past the pipeline's wall clock

package/dist/assets/src/core/coordinator/driver.ts

@@ -469,7 +469,7 @@ function prCheckReturn(step: string, a: BotAnswer): StepReturn {
  *  ask's answer carries `retried` instead: whether the re-run was dispatched,
  *  so the machine never waits on a head an undispatched re-run left unchanged. */
 function checksReturn(step: string, a: BotAnswer): StepReturn {
-  const { ok, checks, draft, retried, at } = a.body;
+  const { ok, checks, draft, retried, refired, at } = a.body;
   if (ok !== true) throw new UnreadableAnswer("checks", a, "ok");
   return {
     type: "checks",
@@ -479,6 +479,7 @@ function checksReturn(step: string, a: BotAnswer): StepReturn {
     // unit for the ready event instead of merging or ending without a cause.
     ...(draft === true ? { draft: true } : {}),
     ...(typeof retried === "boolean" ? { retried } : {}),
+    ...(typeof refired === "boolean" ? { refired } : {}),
     at,
   };
 }
@@ -489,7 +490,10 @@ const isRoundChecks = (v: unknown): v is RoundChecks =>
   Array.isArray(v.pending) &&
   v.pending.every((n: unknown) => typeof n === "string") &&
   Array.isArray(v.failed) &&
-  v.failed.every((f: unknown) => isRecord(f) && typeof f.name === "string" && typeof f.conclusion === "string");
+  v.failed.every((f: unknown) => isRecord(f) && typeof f.name === "string" && typeof f.conclusion === "string") &&
+  (v.required === undefined ||
+    (Array.isArray(v.required) && v.required.every((n: unknown) => typeof n === "string"))) &&
+  (v.expected === undefined || (Array.isArray(v.expected) && v.expected.every((n: unknown) => typeof n === "string")));
 
 function mergeReturn(step: string, a: BotAnswer): StepReturn {
   const { ok, outcome, by, sha, mergedAt, reason, at } = a.body;
@@ -670,8 +674,8 @@ async function perform(
     }
     case "checks":
       // The round's checks step (record 0055): the bot reads the check runs at
-      // the reviewed head with the merge door's own reading — or, on a retry
-      // ask, re-runs the named failed checks' jobs first.
+      // the reviewed head with the merge door's own reading — or performs one
+      // of the step's bounded recovery effects first.
       return checksReturn(
         action.step,
         answerOf(
@@ -682,6 +686,7 @@ async function perform(
               prNumber: action.prNumber,
               headSha: action.headSha,
               ...(action.retry !== undefined ? { retry: action.retry } : {}),
+              ...(action.refire === true ? { refire: true } : {}),
             }),
           ),
         ),

package/dist/assets/src/core/pipelineStanding.ts

@@ -94,6 +94,7 @@ export const ROUND_STAGE = {
   request_changes: "fix",
   no_verdict: "hold",
   checks_failed: "fix",
+  checks_restarted: "approved",
   transient: "hold",
   enqueued: "approved",
   dequeued: "fix",
@@ -174,6 +175,7 @@ export const ROUND_OUTCOME_WORDS = {
   request_changes: "changes requested",
   no_verdict: "no verdict",
   checks_failed: "checks failed",
+  checks_restarted: "checks restarted",
   transient: "retried",
   enqueued: "queued to merge",
   dequeued: "removed from the merge queue",

package/dist/assets/src/core/runEvents.ts

@@ -294,6 +294,10 @@ export type RunNoteKind =
    *  there was nothing to push), so a re-issue starts from the partial work
    *  (docs/reference/specs/agent-ship.md item 8). */
   | "budget_salvage"
+  /** A coordinator's coding child ended failed, stopped or interrupted with
+   *  work in its tree: before teardown the run loop made a WIP commit and
+   *  pushed the unit branch, or recorded why no push was possible. */
+  | "work_salvage"
   /** A pi run's compaction failed for good — the provider refused the summary
    *  (harness-pi.md item 7) — and the run loop treated it as a checkpoint
    *  signal: the tracked changes were committed and pushed to the run's own
@@ -363,6 +367,7 @@ export const RUN_NOTE_KINDS = [
   "tool_unnamed",
   "directory_reached",
   "budget_salvage",
+  "work_salvage",
   "compaction_salvage",
   "stuck_loop",
   "decline_cascade",
@@ -432,6 +437,9 @@ export type ShipRoundOutcome =
    *  0055): the failures become check findings and the findings step runs as
    *  for any changes-requested round. */
   | "checks_failed"
+  /** No required check appeared during the checks step's grace chunk, so the
+   *  runner re-fired the pull_request event once by closing and reopening it. */
+  | "checks_restarted"
   /** The round's coding child died on a provider transient with nothing
    *  pushed (issue 1932): the first such boundary marks the round's one
    *  re-run, a second the `transient` ending. */
@@ -1096,7 +1104,7 @@ export type RunEvent =
        *  `model` is the ref the run uses, resolved from a model the person
        *  named in plain words (the plain-words model unit) — applied at
        *  directive precedence. Additive: unknown → no model. */
-      binds?: ReadonlyArray<{ line: string; reason: string; model?: string; confirmed?: true }>;
+      binds?: ReadonlyArray<{ line: string; reason: string; model?: string; repo?: string; confirmed?: true }>;
       question?: string;
       /** A question's proposed line, redacted and cut like the receipt — what
        *  the next turn's "yes" binds (`bindFromAnswer`). */

package/dist/assets/src/core/runLedger/types.ts

@@ -128,9 +128,9 @@ export interface LiveRunMeta {
 export type RunState = Record<string, unknown>;
 
 /** A hosted ship parent's hosting fact on the row's state (record 0060): the
- *  runner instance the run hosts and the deadline past which a reclaim closes
- *  the row `interrupted` instead of re-hosting it. Set by the ship branch once
- *  the instance exists; read by the boot reclaim. */
+ *  runner instance the run hosts and its original wall-clock estimate. Reclaim
+ *  may outlive that estimate while the Workflow or one of its child rows is
+ *  live; only no durable owner beyond it closes the row. */
 export interface HostingState {
   instanceId: string;
   /** Epoch ms: the hand-off time plus the instance's `caps.maxMinutes` plus

package/dist/assets/src/core/runRecord.ts

@@ -289,19 +289,23 @@ export interface RunLease {
   loopEndsAt: number;
 }
 
-/** A head a run pushed, as the record names it (item 2): the branch and the sha. */
+/** A head a run pushed, as the record names it (item 2): the branch, sha,
+ *  and whether the agent pushed it or the run's mechanical WIP salvage did.
+ *  `by` is optional for records written before that distinction survived the
+ *  event fold. */
 export interface PushedHead {
   ref: string;
   sha: string;
+  by?: "push" | "salvage";
 }
 
 /** The heads a run's events say it pushed — one per branch, the last event's
  *  sha winning, in first-seen order — or nothing when it pushed none. */
 export function pushedHeadsOf(events: readonly RunEvent[]): PushedHead[] | undefined {
-  const byRef = new Map<string, string>();
-  for (const e of events) if (e.type === "pushed_head") byRef.set(e.ref, e.sha);
+  const byRef = new Map<string, { sha: string; by: "push" | "salvage" }>();
+  for (const e of events) if (e.type === "pushed_head") byRef.set(e.ref, { sha: e.sha, by: e.by });
   if (byRef.size === 0) return undefined;
-  return [...byRef].map(([ref, sha]) => ({ ref, sha }));
+  return [...byRef].map(([ref, pushed]) => ({ ref, ...pushed }));
 }
 
 /** The lease a run's events say its harness started — the first `lease`
@@ -440,7 +444,7 @@ export interface RunOperatorDecision {
   mode: "shadow" | "on";
   outcome: "binds" | "question" | "refusal" | "non_decision";
   reason: string;
-  binds?: { line: string; reason: string }[];
+  binds?: { line: string; reason: string; model?: string; repo?: string; confirmed?: true }[];
   question?: string;
   /** A question's proposed line — what the next turn's "yes" binds. */
   proposal?: string;
@@ -468,7 +472,17 @@ export function operatorOfEvents(events: readonly RunEvent[]): RunOperatorDecisi
     mode: e.mode,
     outcome: e.outcome,
     reason: e.reason,
-    ...(e.binds ? { binds: e.binds.map((b) => ({ line: b.line, reason: b.reason })) } : {}),
+    ...(e.binds
+      ? {
+          binds: e.binds.map((b) => ({
+            line: b.line,
+            reason: b.reason,
+            ...(b.model !== undefined ? { model: b.model } : {}),
+            ...(b.repo !== undefined ? { repo: b.repo } : {}),
+            ...(b.confirmed ? { confirmed: true as const } : {}),
+          })),
+        }
+      : {}),
     ...(e.question !== undefined ? { question: e.question } : {}),
     ...(e.proposal !== undefined ? { proposal: e.proposal } : {}),
     ...(e.request !== undefined ? { request: e.request } : {}),
@@ -1019,8 +1033,14 @@ export function isRunRecord(v: unknown): v is RunRecord {
       Array.isArray(r.pushed) &&
       r.pushed.every((h) => {
         if (typeof h !== "object" || h === null) return false;
-        const { ref, sha } = h as Record<string, unknown>;
-        return typeof ref === "string" && ref.length > 0 && typeof sha === "string" && /^[0-9a-f]{7,40}$/.test(sha);
+        const { ref, sha, by } = h as Record<string, unknown>;
+        return (
+          typeof ref === "string" &&
+          ref.length > 0 &&
+          typeof sha === "string" &&
+          /^[0-9a-f]{7,40}$/.test(sha) &&
+          (by === undefined || by === "push" || by === "salvage")
+        );
       })
     )
   )