@coreplane/switchboard 1.260.0 → 1.260.2

package/dist/assets/src/core/ship/coordinator.ts

@@ -458,7 +458,7 @@ export function cursorFinished(cursor: PlanCursor): boolean {
  *  findings dispatched into the unit thread as `agent:coding`, so the coding
  *  session there continues with them (record 0034). Never a `fix` child briefed
  *  from the review. */
-export type RoundKind = "coding" | "review" | "findings";
+export type RoundKind = "coding" | "review" | "findings" | "rebase";
 export interface RoundRef {
   /** Round 0 is the coding round; review round n and its findings step share n. */
   index: number;
@@ -508,6 +508,13 @@ export type Brief =
       /** The round's check findings (record 0055), carried by value — the
        *  review run's record holds only the reviewer's own findings. */
       checks?: Finding[];
+    }
+  | {
+      kind: "rebase";
+      unit: string;
+      pr: number;
+      headSha: string;
+      base: string;
     };
 
 export interface PrRef {
@@ -549,12 +556,15 @@ export type CoordinatorAction =
    *  the queue's outcome (merged, still queued, or removed with the reason)
    *  instead of attempting the squash. */
   | { type: "merge"; step: string; prNumber: number; headSha: string; queued?: true }
+  /** Rung one of an approved head's rebase: git first. A conflict alone buys
+   *  the runner's coding round; a clean changed patch returns to review. */
+  | { type: "rebase"; step: string; prNumber: number; headSha: string }
   /** Read the check runs at the reviewed head (record 0055, the round verdict):
    *  the merge door's own reading, folded into the round. `retry` names the
-   *  failed checks whose one flake re-run the machine is spending: the bot
-   *  re-runs their failed jobs (the CI retry the deploy already uses) instead
-   *  of reading. */
-  | { type: "checks"; step: string; prNumber: number; headSha: string; retry?: string[] }
+   *  failed checks whose one flake re-run the machine is spending; `refire`
+   *  asks for the one close/reopen recovery when no required check launched.
+   *  Either effect runs instead of a read. */
+  | { type: "checks"; step: string; prNumber: number; headSha: string; retry?: string[]; refire?: true }
   /** Wait for the intake's checks-settled event at the approved head, bounded as the fallback. */
   | { type: "wait-checks"; step: string; headSha: string; timeoutMs: number }
   | { type: "sleep"; step: string; ms: number }
@@ -678,12 +688,28 @@ export type StepReturn =
   | { type: "merge"; step: string; outcome: "merged"; by: "other"; sha: string; mergedAt: string; at: number }
   /** The door enqueued the pull request (or found it still queued), or the
    *  queue removed it — the reason is the queue's own (issue 2011). */
-  | { type: "merge"; step: string; outcome: "pending" | "refused" | "enqueued" | "removed"; reason: string; at: number }
+  | {
+      type: "merge";
+      step: string;
+      outcome: "pending" | "refused" | "conflict" | "enqueued" | "removed";
+      reason: string;
+      at: number;
+    }
+  | { type: "rebase"; step: string; outcome: "carried" | "changed"; headSha: string; at: number }
+  | { type: "rebase"; step: string; outcome: "conflict" | "refused"; reason: string; at: number }
   /** The checks read at the reviewed head; `checks` absent means GitHub could
-   *  not be read, which the machine treats as pending (record 0055). A retry
-   *  ask answers `retried` instead: whether the bot dispatched the re-run —
-   *  false means there is nothing to wait for at the unchanged head. */
-  | { type: "checks"; step: string; checks?: RoundChecks; draft?: boolean; retried?: boolean; at: number }
+   *  not be read, which the machine treats as pending (record 0055). Effect
+   *  asks answer `retried` or `refired` instead; false still spends that one
+   *  recovery so an unchanged head cannot loop on the write. */
+  | {
+      type: "checks";
+      step: string;
+      checks?: RoundChecks;
+      draft?: boolean;
+      retried?: boolean;
+      refired?: boolean;
+      at: number;
+    }
   | { type: "wait-checks"; step: string; outcome: "event" | "timeout" }
   | { type: "sleep"; step: string };
 
@@ -699,14 +725,18 @@ export interface CheckFailure {
 }
 
 /** The check runs at the reviewed head as the round's checks step reads them.
- *  `expected` names checks the head must still gain — a required check, or the
- *  repository's approve workflow whose run does not exist yet (issue 2063):
- *  the base's required contexts not among the reported runs. The table reads
- *  an expected-but-unreported check exactly as a pending one. */
+ *  `required` carries the base's whole required-context set and `expected`
+ *  its unreported subset. The whole set lets the table distinguish no required
+ *  check launching from an unrelated run that did report; an ordinary missing
+ *  subset reads exactly as pending (issue 2063). */
 export interface RoundChecks {
   total: number;
   pending: string[];
   failed: CheckFailure[];
+  /** Every check context required by the base. Together with `expected`, this
+   *  distinguishes an empty required-check launch from an unrelated check
+   *  that did report (for example the title workflow). */
+  required?: string[];
   expected?: string[];
 }
 
@@ -831,6 +861,8 @@ export type UnitEnding =
       finalReply?: string;
       /** A changes-requested review posted this round before the stop. */
       postedReview?: boolean;
+      /** The mechanical WIP checkpoint a stopped coding child pushed before teardown. */
+      checkpoint?: { branch: string; sha: string };
     }
   | {
       kind: "aborted";
@@ -874,7 +906,14 @@ export type UnitEnding =
    *  `transient` so it reads as a condition beside `checks_failed` and `held`
    *  in the plane's table, never as the child failing on its task. */
   | { kind: "transient"; round: RoundRef; runId: string; reviewRounds: number }
-  | { kind: "interrupted"; round: RoundRef; runId: string; reviewRounds: number; cause?: InterruptionCause }
+  | {
+      kind: "interrupted";
+      round: RoundRef;
+      runId: string;
+      reviewRounds: number;
+      cause?: InterruptionCause;
+      checkpoint?: { branch: string; sha: string };
+    }
   | { kind: "refused"; refusal: string; message?: string; round: RoundRef; reviewRounds: number }
   /** The unit idles instead of ending (record 0051): with the resolved
    *  `ship.idleDays` above zero, `end()` wraps an idling kind — every kind but
@@ -1069,12 +1108,14 @@ type Phase =
    *  only through a merge queue (issue 2011) — so every later ask reads the
    *  queue's outcome instead of attempting the squash again. */
   | { at: "merge"; pr: PrRef; headSha: string; n: number; since: number; waitMs: number; queued?: true }
+  | { at: "rebase"; pr: PrRef; headSha: string; n: number }
   | { at: "merge-wait"; pr: PrRef; headSha: string; n: number; since: number; waitMs: number; queued?: true }
   /** The round's checks step (record 0055): the check runs at the reviewed head
    *  are read after an approve settles, before merge_ready or the merge door.
-   *  `graced`: a head with no check reported has had its one-chunk grace;
-   *  `retried`: the one flake re-run is spent; `retry` names the failed checks
-   *  the next ask re-runs instead of reading. */
+   *  `graced`: a head with no required check reported has had its one-chunk
+   *  grace; `refired`: the one pull_request close/reopen recovery is spent;
+   *  `retried`: the one flake re-run is spent. `retry` and `refire` make the
+   *  next ask perform that effect instead of reading. */
   | {
       at: "checks";
       round: RoundRef;
@@ -1085,7 +1126,9 @@ type Phase =
       waitMs: number;
       graced: boolean;
       retried: boolean;
+      refired: boolean;
       retry?: string[];
+      refire?: true;
     }
   /** Waiting on `checks-settled-<head>` between two checks reads, in the merge
    *  wait's own chunks — the intake wakes the machine when the head settles. */
@@ -1099,6 +1142,7 @@ type Phase =
       waitMs: number;
       graced: boolean;
       retried: boolean;
+      refired: boolean;
     }
   | { at: "ended" };
 
@@ -1110,6 +1154,9 @@ export interface UnitPipelineState {
   readonly phase: Phase;
   /** Review rounds started so far. */
   readonly reviewRounds: number;
+  /** Approved-head rebases attempted in this run. Each fresh conflict may buy
+   *  one fix round; the run's remaining lease, not pull-request lifetime, is the bound. */
+  readonly rebaseAttempts: number;
   readonly pr?: PrRef;
   readonly lastReviewHead?: string;
   readonly lastVerdictSummary?: string;
@@ -1167,6 +1214,7 @@ export function openUnitPipeline(input: UnitPipelineInput, at: number): UnitPipe
     clock: at,
     phase: { at: "pre-check" },
     reviewRounds: 0,
+    rebaseAttempts: 0,
     spentMs: { coding: 0, review: 0, waiting: 0 },
     spendUsd: input.session?.spendUsd ?? 0,
     findingsByRound: {},
@@ -1205,11 +1253,8 @@ const loopOf = (s: UnitPipelineState): Loop => ({ maxRounds: s.input.caps.maxRou
  *  A review round `n` and the findings step that follows it share `n`; the
  *  module's positions are the loop's own. */
 function roundCarve(s: UnitPipelineState, round: RoundRef): Carve {
-  return carve(
-    remainingMs(s),
-    { kind: round.kind, index: loopPosition(loopOf(s), round.kind, round.index) },
-    loopOf(s),
-  );
+  const kind = round.kind === "rebase" ? "findings" : round.kind;
+  return carve(remainingMs(s), { kind, index: loopPosition(loopOf(s), kind, round.index) }, loopOf(s));
 }
 
 /** The prefix every step of this pipeline is named under: the unit id, a
@@ -1245,6 +1290,9 @@ function briefFor(s: UnitPipelineState, round: RoundRef): Brief {
     };
   }
   const pr = s.pr!.number;
+  if (round.kind === "rebase") {
+    return { kind: "rebase", unit, pr, headSha: s.lastReviewHead!, base: s.input.base };
+  }
   if (round.kind === "findings") {
     const checks = checkFindingsOf(s.findingsByRound[round.index]);
     return {
@@ -1338,6 +1386,7 @@ export function nextAction(s: UnitPipelineState): CoordinatorAction {
         prNumber: p.prNumber,
         headSha: p.headSha,
         ...(p.retry !== undefined ? { retry: p.retry } : {}),
+        ...(p.refire === true ? { refire: true as const } : {}),
       };
     case "checks-wait":
       return {
@@ -1354,6 +1403,13 @@ export function nextAction(s: UnitPipelineState): CoordinatorAction {
         headSha: p.headSha,
         ...(p.queued === true ? { queued: true as const } : {}),
       };
+    case "rebase":
+      return {
+        type: "rebase",
+        step: `${unit}/rebase/${p.n}`,
+        prNumber: p.pr.number,
+        headSha: p.headSha,
+      };
     case "merge-wait":
       return {
         type: "wait-checks",
@@ -1508,6 +1564,13 @@ function enterRound(s: UnitPipelineState, round: RoundRef, notes: CoordinatorNot
   };
 }
 
+/** A rebase changed the approved patch, so review is mandatory even when
+ *  the ordinary findings-round count is spent. The run's remaining lease is
+ *  the bound: `enterRound` refuses when another review no longer fits. */
+function reviewAfterRebase(s: UnitPipelineState, notes: CoordinatorNote[] = []): Transition {
+  return enterRound(s, { index: s.reviewRounds + 1, kind: "review" }, notes);
+}
+
 /** The next review round, or the round cap. */
 function nextReview(s: UnitPipelineState, notes: CoordinatorNote[] = []): Transition {
   if (s.reviewRounds >= s.input.caps.maxRounds)
@@ -1518,6 +1581,16 @@ function nextReview(s: UnitPipelineState, notes: CoordinatorNote[] = []): Transi
 const stopMode = (status: RunStatus): "soft" | "hard" | undefined =>
   status === "stopped_soft" ? "soft" : status === "stopped_hard" ? "hard" : undefined;
 
+/** The last mechanical WIP push to this unit branch. Unlike an ordinary push,
+ *  it says the child ended before its work was ready for review. */
+function interruptedCheckpoint(
+  s: UnitPipelineState,
+  pushed: readonly PushedHeadFact[] | undefined,
+): { branch: string; sha: string } | undefined {
+  const found = pushed?.filter((p) => p.ref === s.input.unit.branch && p.by === "salvage").at(-1);
+  return found ? { branch: found.ref, sha: found.sha } : undefined;
+}
+
 /** A coding run's confirmed end: round 0's child, or the run a findings step dispatched. */
 function settleCoding(
   s: UnitPipelineState,
@@ -1545,6 +1618,7 @@ function settleCoding(
         }
       : {}),
   };
+  const checkpoint = interruptedCheckpoint(next, facts.pushed);
   const mode = stopMode(facts.status);
   if (mode !== undefined)
     return end(
@@ -1555,13 +1629,33 @@ function settleCoding(
         round,
         reviewRounds: next.reviewRounds,
         ...(facts.finalReply !== undefined ? { finalReply: facts.finalReply } : {}),
+        ...(checkpoint !== undefined ? { checkpoint } : {}),
       },
       [roundNote(round, "stopped")],
     );
+  // A mechanical WIP push means the child did not declare the work ready for
+  // review. Keep the unit branch as the resumption point and abort this
+  // attempt; an ordinary push still takes the established recover-PR path.
+  if (facts.status === "failed" && checkpoint !== undefined) {
+    const cause =
+      facts.failure?.kind === "provider_transient"
+        ? "the model provider's transport retry budget was spent"
+        : "it failed before finishing";
+    return end(
+      next,
+      {
+        kind: "aborted",
+        reason: `⚠️ The coding child ended because ${cause}; the branch carries the interrupted work at \`${checkpoint.sha.slice(0, 7)}\` on \`${checkpoint.branch}\`. Re-issue the request to resume from it instead of starting over.`,
+        round,
+        reviewRounds: next.reviewRounds,
+      },
+      [roundNote(round, "aborted")],
+    );
+  }
   // A failed coding child no longer aborts outright: the pr-check looks at the
-  // branch first — a push before the death is recovered as the round's pull
-  // request (agent-ship items 10 and 15), and only a branch with
-  // nothing on it ends the unit with the child's own reason.
+  // branch first — an ordinary push before the death is recovered as the
+  // round's pull request, and only a branch with nothing on it ends the unit
+  // with the child's own reason.
   if (facts.status === "failed")
     return {
       state: {
@@ -1745,6 +1839,7 @@ function enterChecks(s: UnitPipelineState, round: RoundRef, notes: CoordinatorNo
         waitMs,
         graced: false,
         retried: false,
+        refired: false,
       },
     },
     notes,
@@ -1764,14 +1859,16 @@ function enterChecks(s: UnitPipelineState, round: RoundRef, notes: CoordinatorNo
  *      (`expected`: a required check, or the repository's approve workflow
  *      whose run does not exist yet), or GitHub unreadable: the head waits on
  *      the settled event and is read again;
- *  (—) no check reported at all: one chunk of grace, never more;
+ *  (—) no required check reported: one chunk of grace, then the pull_request
+ *      event is re-fired once by closing and reopening the pull request;
  *  (c) every expected check reported green: the round proceeds with no wait. */
 function checksVerdict(
   checks: RoundChecks | undefined,
-  p: { retried: boolean; graced: boolean },
+  p: { retried: boolean; graced: boolean; refired: boolean },
   draft?: boolean,
 ):
   | { kind: "retry"; names: string[] }
+  | { kind: "refire" }
   | { kind: "failed"; failed: CheckFailure[] }
   | { kind: "draft" }
   | { kind: "pending" }
@@ -1791,14 +1888,18 @@ function checksVerdict(
   // person's "ready" changes anything — a red check above still gets its fix
   // round, since that work stands whether or not the pull request is a draft.
   if (draft === true) return { kind: "draft" };
+  const required = checks?.required ?? [];
+  const missing = checks?.expected ?? [];
+  const noRequiredReported = required.length > 0 && missing.length === required.length;
+  // A check launcher may report an unrelated workflow while every required
+  // context is still absent. Give it one normal chunk; if it remains empty,
+  // re-fire pull_request once. This is the same recovery a person performs for
+  // a CI run that exists but started no workflows.
+  if ((checks?.total === 0 || noRequiredReported) && !p.graced) return { kind: "grace" };
+  if (noRequiredReported && !p.refired) return { kind: "refire" };
   // GitHub unreadable answers as pending and is re-read at the chunk's end;
   // an expected check not yet reported (issue 2063) is pending the same way.
-  if (checks === undefined || checks.pending.length > 0 || (checks.expected?.length ?? 0) > 0)
-    return { kind: "pending" };
-  // No check reported at the head: one chunk of grace — the first check starts
-  // within minutes where CI exists — then the round proceeds, so a repository
-  // without CI costs one chunk per round and never idles (record 0055).
-  if (checks.total === 0 && !p.graced) return { kind: "grace" };
+  if (checks === undefined || checks.pending.length > 0 || missing.length > 0) return { kind: "pending" };
   return { kind: "green" };
 }
 
@@ -1810,14 +1911,15 @@ function checksVerdict(
  *  is still pending (issue 1991); only a head with no failed check waits a
  *  chunk inside the step's ask on what is unreadable or pending and then
  *  proceeds — the ending's facts read names what is still pending; a head with
- *  no check reported waits one chunk of grace and never more; a green head
- *  proceeds with no wait added. */
+ *  no required check reported gets one grace chunk and one event re-fire; a
+ *  green head proceeds with no wait added. */
 function settleChecks(
   s: UnitPipelineState,
   p: Extract<Phase, { at: "checks" }>,
   checks: RoundChecks | undefined,
   retried?: boolean,
   draft?: boolean,
+  refired?: boolean,
 ): Transition {
   const { round } = p;
   const wait = (over: Partial<Extract<Phase, { at: "checks-wait" }>>): Transition => ({
@@ -1833,11 +1935,23 @@ function settleChecks(
         waitMs: p.waitMs,
         graced: p.graced,
         retried: p.retried,
+        refired: p.refired,
         ...over,
       },
     },
     notes: [],
   });
+  // The pull_request re-fire is an effect ask after a whole grace chunk with
+  // no required check. Whether GitHub accepted it or not, spend the one attempt
+  // and read immediately: that read registers the ordinary bounded wait. A
+  // successful effect adds the round boundary the card renders.
+  if (p.refire === true) {
+    const { refire: _refire, ...read } = p;
+    return {
+      state: { ...s, phase: { ...read, n: p.n + 1, refired: true } },
+      notes: refired === true ? [roundNote(p.round, "checks_restarted")] : [],
+    };
+  }
   // The retry ask. Dispatched: wait for the head to settle, then read again;
   // a second failure is the finding. NOT dispatched (`retried: false` — no
   // re-runnable run behind the checks, or GitHub refused): the one re-run is
@@ -1858,6 +1972,11 @@ function settleChecks(
         state: { ...s, phase: { ...p, n: p.n + 1, retry: verdict.names } },
         notes: [],
       };
+    case "refire":
+      return {
+        state: { ...s, phase: { ...p, n: p.n + 1, refire: true } },
+        notes: [],
+      };
     case "failed": {
       const findings = [...(s.findingsByRound[round.index] ?? []), ...verdict.failed.map(checkFinding)];
       const next: UnitPipelineState = {
@@ -1905,6 +2024,21 @@ function settleChecks(
   }
 }
 
+/** Re-enter the approved head's rebase step. The attempt count belongs to
+ *  this run, not to the pull request: every later base move is a fresh
+ *  conflict, while the one pipeline lease remains the hard bound. */
+export function reenterApprovedRebase(s: UnitPipelineState): UnitPipelineState {
+  if (s.pr === undefined || s.lastReviewHead === undefined)
+    throw new Error("an approved rebase needs the pull request and reviewed head");
+  const { ending: _ending, ...open } = s;
+  const n = s.rebaseAttempts + 1;
+  return {
+    ...open,
+    rebaseAttempts: n,
+    phase: { at: "rebase", pr: s.pr, headSha: s.lastReviewHead, n },
+  };
+}
+
 /** An approve past the checks read: merge_ready for a person, the merge door
  *  under `merge: runner` — the tail the round verdict guards (record 0055). */
 function approveOutcome(next: UnitPipelineState, notes: CoordinatorNote[]): Transition {
@@ -2155,6 +2289,22 @@ function roundOnOpenPr(
   const { round } = phase;
   const head = pr.headSha ?? phase.childHead;
   const next: UnitPipelineState = { ...s, pr: { number: pr.prNumber, url: pr.url } };
+  if (round.kind === "rebase") {
+    const pushed = normalizeHead(head);
+    const approved = normalizeHead(s.lastReviewHead);
+    if (pushed === undefined || (approved !== undefined && sameCommit(pushed, approved)))
+      return end(
+        next,
+        {
+          kind: "aborted",
+          reason: `⚠️ Rebase round ${round.attempt ?? 1} left the approved head unchanged, so the conflict still has no resolution to review.`,
+          round,
+          reviewRounds: next.reviewRounds,
+        },
+        [roundNote(round, "aborted")],
+      );
+    return reviewAfterRebase({ ...next, lastReviewHead: pushed }, [roundNote(round, "pr_opened")]);
+  }
   if (round.kind === "findings") {
     // Nothing repushed → nothing to re-review, unless every finding of the
     // last review was declined on the record: that re-review verifies the
@@ -2387,7 +2537,8 @@ export function applyReturn(s: UnitPipelineState, ret: StepReturn): Transition {
       // The hosted parent's hard stop landed while this child ran (record 0060;
       // issue 1924): the unit ends stopped as the child ends, whatever the
       // child's own status — the runner runs nothing more of it.
-      if (r.stopped === true)
+      if (r.stopped === true) {
+        const checkpoint = p.round.kind === "review" ? undefined : interruptedCheckpoint(clocked, r.run.pushed);
         return end(
           clocked,
           {
@@ -2396,14 +2547,33 @@ export function applyReturn(s: UnitPipelineState, ret: StepReturn): Transition {
             round: p.round,
             reviewRounds: s.reviewRounds,
             ...(r.run.finalReply !== undefined ? { finalReply: r.run.finalReply } : {}),
+            ...(checkpoint !== undefined ? { checkpoint } : {}),
           },
           [roundNote(p.round, "stopped")],
         );
+      }
       if (r.run.status === "interrupted") {
         const cause = r.run.interruption;
-        // A dead CODING child may have pushed before the ledger closed it: the
-        // pr-check recovers the branch. A review child has nothing on the
-        // branch to recover, so its interruption still ends the unit at once.
+        const checkpoint = interruptedCheckpoint(clocked, r.run.pushed);
+        // A mechanical WIP checkpoint is deliberately not opened for review:
+        // the interrupted child never declared it finished. The next attempt
+        // starts from the unit branch at that head.
+        if (p.round.kind !== "review" && checkpoint !== undefined)
+          return end(
+            clocked,
+            {
+              kind: "interrupted",
+              round: p.round,
+              runId: p.runId,
+              reviewRounds: s.reviewRounds,
+              ...(cause !== undefined ? { cause } : {}),
+              checkpoint,
+            },
+            [roundNote(p.round, "aborted")],
+          );
+        // A dead CODING child may have pushed normally before the ledger closed
+        // it: the pr-check recovers that branch. A review child has nothing on
+        // the branch to recover, so its interruption still ends the unit at once.
         if (p.round.kind !== "review")
           return {
             state: {
@@ -2438,7 +2608,7 @@ export function applyReturn(s: UnitPipelineState, ret: StepReturn): Transition {
       return settlePrCheck(clocked, p, (ret as Extract<StepReturn, { type: "pr-check" }>).pr);
     case "checks": {
       const r = ret as Extract<StepReturn, { type: "checks" }>;
-      return settleChecks(clocked, p, r.checks, r.retried, r.draft);
+      return settleChecks(clocked, p, r.checks, r.retried, r.draft, r.refired);
     }
     case "checks-wait":
       // The event fired or the chunk elapsed either way the head is read again.
@@ -2455,6 +2625,7 @@ export function applyReturn(s: UnitPipelineState, ret: StepReturn): Transition {
             waitMs: p.waitMs,
             graced: p.graced,
             retried: p.retried,
+            refired: p.refired,
           },
         },
         notes: [],
@@ -2474,6 +2645,7 @@ export function applyReturn(s: UnitPipelineState, ret: StepReturn): Transition {
               reviewRounds: s.reviewRounds,
             })
           : end(clocked, { kind: "merged", by: "runner", pr: p.pr, sha: r.sha, reviewRounds: s.reviewRounds });
+      if (r.outcome === "conflict") return { state: reenterApprovedRebase(clocked), notes: [] };
       if (r.outcome === "refused")
         return end(clocked, { kind: "merge_refused", pr: p.pr, reason: r.reason, reviewRounds: s.reviewRounds });
       if (r.outcome === "removed") {
@@ -2538,6 +2710,32 @@ export function applyReturn(s: UnitPipelineState, ret: StepReturn): Transition {
             : [],
       };
     }
+    case "rebase": {
+      const r = ret as Extract<StepReturn, { type: "rebase" }>;
+      if (r.outcome === "refused")
+        return end(clocked, {
+          kind: "merge_refused",
+          pr: p.pr,
+          reason: r.reason,
+          reviewRounds: s.reviewRounds,
+        });
+      if (r.outcome === "conflict")
+        return enterRound(clocked, {
+          index: s.reviewRounds,
+          kind: "rebase",
+          attempt: p.n,
+        });
+      if (!("headSha" in r))
+        return end(clocked, {
+          kind: "merge_refused",
+          pr: p.pr,
+          reason: "the rebase resolver returned no head",
+          reviewRounds: s.reviewRounds,
+        });
+      const rebased: UnitPipelineState = { ...clocked, lastReviewHead: r.headSha };
+      if (r.outcome === "changed") return reviewAfterRebase(rebased);
+      return enterChecks(rebased, { index: s.reviewRounds, kind: "review" }, []);
+    }
     case "merge-wait":
       return {
         state: {
@@ -2661,7 +2859,7 @@ export interface CommitChecksFacts {
  *  the line is unchanged. */
 function mergeReadyHeadline(rounds: string, url: string, base: string, facts: MergeReadyFacts | undefined): string {
   if (facts?.mergeableState === "dirty")
-    return `⚠️ Approved but not merge-ready after ${rounds}: ${url} — the head conflicts with \`${base}\`: \`pulls rebase ${url}\` rebases it onto \`${base}\` (an unchanged patch carries the approval). The approved work stands.`;
+    return `⚠️ Approved but not merge-ready after ${rounds}: ${url} — the head conflicts with \`${base}\`; the pipeline runner owns the rebase (an unchanged patch carries the approval). The approved work stands.`;
   const fixups = facts?.fixupCommits ?? [];
   if (fixups.length > 0)
     return `⚠️ Approved but not merge-ready after ${rounds}: ${url} — ${fixups.length} unsquashed fix-up commit${fixups.length === 1 ? "" : "s"} on the head (${fixups.join("; ")}): squash into the unit's commit, push, and re-review.`;
@@ -2725,6 +2923,10 @@ export function renderUnitReport(
       ? `Findings below ${level}, left as-is: ${skipped.map((f) => `${f.id} (${f.severity}) — ${f.title}`).join("; ")}`
       : undefined;
   const join = (parts: Array<string | undefined>) => parts.filter(Boolean).join("\n\n");
+  const checkpointLine = (checkpoint: { branch: string; sha: string } | undefined) =>
+    checkpoint === undefined
+      ? undefined
+      : `The branch carries the interrupted work at \`${checkpoint.sha.slice(0, 7)}\` on \`${checkpoint.branch}\`; re-issue to resume from it instead of starting over.`;
   switch (e.kind) {
     case "merged":
       if (e.by === "other")
@@ -2873,9 +3075,11 @@ export function renderUnitReport(
         aside(reissue),
       ]);
     case "stopped":
-      if (!shows(verbosity, "verbose")) return `${e.mode === "hard" ? "⛔" : "⏹"} Stopped.${prLine}`;
+      if (!shows(verbosity, "verbose"))
+        return join([`${e.mode === "hard" ? "⛔" : "⏹"} Stopped.${prLine}`, checkpointLine(e.checkpoint)]);
       return join([
         `${e.mode === "hard" ? "⛔" : "⏹"} Ship stopped by operator (${e.mode} stop) after ${rounds}.${prLine}`,
+        checkpointLine(e.checkpoint),
         writeUpPointer(
           s,
           e.round.kind,
@@ -2930,7 +3134,7 @@ export function renderUnitReport(
         reissue,
       ]);
     case "interrupted":
-      return shipInterruptedNote(prUrl, e.cause, (s.input.idleDays ?? 0) > 0);
+      return join([shipInterruptedNote(prUrl, e.cause, (s.input.idleDays ?? 0) > 0), checkpointLine(e.checkpoint)]);
     case "idle_expired":
       return "⌛ Idle expired: no reply continued this unit before its idle window closed.";
     case "refused":

package/dist/assets/src/core/ship/renewal.ts

@@ -18,6 +18,8 @@ import type { Handoff } from "./handoff.js";
 export interface PushedHeadFact {
   ref: string;
   sha: string;
+  /** Mechanical WIP checkpoints are preserved work, not a completed agent push. */
+  by?: "push" | "salvage";
   at?: number;
 }
 

package/dist/assets/src/deploy/liveGate.ts

@@ -22,6 +22,9 @@ export interface HealthzBody {
   build?: { commit?: unknown; builtAt?: unknown } | unknown;
   /** ISO process start — `deploy restart`'s identity (the image, hence `build.commit`, is unchanged). */
   startedAt?: unknown;
+  /** A refusal-only production boot's public reason. Such a generation owns a
+   *  port so the operator can diagnose it, but is never live. */
+  config?: unknown;
 }
 
 /** Parse a `/healthz` response body; undefined when it is not a JSON object
@@ -83,6 +86,11 @@ function decideReady<Identity>(
   let reason: string;
   if (!body) {
     reason = "/healthz not answering with JSON (container restarting, or unreachable)";
+  } else if (body.ok !== true) {
+    reason =
+      typeof body.config === "string" && body.config !== ""
+        ? `config: ${body.config}`
+        : "/healthz reports this container is not ready";
   } else {
     const verdict = identify(body);
     if (verdict.live) return { kind: "live", ...verdict.identity };

package/dist/assets/src/deploy/profile.ts

@@ -79,6 +79,14 @@ export const profileSchema = z.object({
   /** Where the bot's runtime config comes from at deploy time; `deploy all`
    *  materializes it into the image's build context. */
   configSource: source,
+  /** The ingress-token subject allowed to stop the bot container. Rendered as
+   *  a Worker var, so config recovery never depends on the runtime document it
+   *  may be repairing. Absent disables the restart route. */
+  restart: z
+    .object({
+      deployer: z.string().regex(/^[A-Za-z0-9_.:@/-]+$/, "an ingress identity subject, without whitespace"),
+    })
+    .optional(),
   /** Where `secrets put` reads values from: a directory of `<NAME>` files, or
    *  `op://Vault/Item` with the secret's name as the field. Optional: the
    *  secrets tooling has its own default directory. */