@coreplane/switchboard 1.260.1 → 1.260.2

package/bin/switchboard.js

@@ -1,25 +1,29 @@
 #!/usr/bin/env node
-// The `switchboard` bin: this file hands the process to dist/cli.js, the bundle
-// the build writes (build.mts; docs/reference/specs/packaging.md item 1). A
-// committed entry rather than the bundle itself, because npm links a bin only
-// when its target exists at install time, and the gitignored dist/ does not
-// until the build runs: with dist/cli.js as the bin, `npx <the package>` inside
-// the checkout — where npx prefers the workspace over the registry — found no
-// link and died with `sh: switchboard: command not found`. The published package
-// always carries the bundle, so there this is one extra module load; a checkout
-// that has not built the package is told what to run.
+// The published `switchboard` bin hands the process to the bundle beside it.
+// In a repository checkout npm resolves the package name to this workspace too,
+// but an ignored dist/ may be older than source. The checkout therefore never
+// trusts dist: operators run the root source script, while a tarball runs only
+// the bundle that its build packed.
 import { existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
 const bundle = new URL("../dist/cli.js", import.meta.url);
+const checkoutRoot = new URL("../../../", import.meta.url);
+const runsFromCheckout =
+  existsSync(new URL("project.json", checkoutRoot)) && existsSync(new URL("src/cli.ts", checkoutRoot));
 
-if (!existsSync(bundle)) {
+if (runsFromCheckout) {
   console.error(
-    `switchboard: ${fileURLToPath(bundle)} is missing — the package is not built. Inside the checkout, npx runs this workspace, not the published package: run \`npm run build -w packages/switchboard\` first, or use the checkout's CLI, \`npm run cli -- <group> <verb> …\`.`,
+    "switchboard: npx resolved the package name to this checkout; its ignored dist/ is not authoritative. Run `npm run --silent cli -- <group> <verb> …` from the checkout root instead.",
   );
   process.exit(1);
 }
 
+if (!existsSync(bundle)) {
+  console.error(`switchboard: ${fileURLToPath(bundle)} is missing — the published package is incomplete.`);
+  process.exit(1);
+}
+
 // From here the bundle is the script: its entry claim (src/invokedAsScript.ts)
 // and its usage spelling (`programName`, src/cli.ts) read argv[1].
 process.argv[1] = fileURLToPath(bundle);

package/dist/assets/deploy/cloudflare-memory/backgroundTasks.ts

@@ -0,0 +1,25 @@
+type WaitUntilContext = Pick<DurableObjectState, "waitUntil">;
+
+const TASKS = Symbol.for("switchboard.memory-worker.pending-background-tasks");
+type PendingTasks = Map<Promise<unknown>, string>;
+
+const pendingTasks = (): PendingTasks => {
+  const root = globalThis as typeof globalThis & { [TASKS]?: PendingTasks };
+  return (root[TASKS] ??= new Map());
+};
+
+/** Keep deliberately detached Worker work in the runtime's request lifetime.
+ * The process-wide label set is also the test seam: a case cannot finish while
+ * work it started is still able to contend with the next case. */
+export function holdBackgroundTask(context: WaitUntilContext, label: string, task: Promise<unknown>): void {
+  const pending = pendingTasks();
+  const held = task.finally(() => pending.delete(held));
+  pending.set(held, label);
+  context.waitUntil(held);
+}
+
+export function assertNoPendingBackgroundTasks(): void {
+  const labels = [...pendingTasks().values()];
+  if (labels.length === 0) return;
+  throw new Error(`test ended with ${labels.length} pending background task(s): ${labels.join(", ")}`);
+}

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -78,6 +78,7 @@ import {
   selectReclaim,
 } from "../../src/core/runLedger/decisions.ts";
 import { intakeReceiptRetentionMs, minutesToMs, PLANE } from "../../src/core/budgets.ts";
+import { holdBackgroundTask } from "./backgroundTasks.ts";
 import {
   causeOfClose,
   causeOfReclaim,
@@ -2058,7 +2059,7 @@ export class RunHistoryDO extends DurableObject<Env> {
   /** The admission ask (`POST /plane/admit`, record 0064 "The queue"): one
    *  transaction decides and writes — `admitted` reserves the thread,
    *  `queued` stores the request under the minted id. */
-  planeAdmit(
+  async planeAdmit(
     post: {
       runId: string;
       requester: string;
@@ -2070,7 +2071,7 @@ export class RunHistoryDO extends DurableObject<Env> {
       reaskMs?: number;
     },
     now: number,
-  ): PlaneAskAnswer {
+  ): Promise<PlaneAskAnswer> {
     let answer!: PlaneAskAnswer;
     this.ctx.storage.transactionSync(() => {
       if (post.reaskMs !== undefined)
@@ -2089,7 +2090,7 @@ export class RunHistoryDO extends DurableObject<Env> {
       this.applyPlaneWrites(decision.writes);
       answer = planeAskAnswerOf(decision, post.runId);
     });
-    if (answer.kind === "queued") void this.ensurePlaneReaskAlarm(now);
+    if (answer.kind === "queued") await this.settlePlaneReaskAlarmAfterCommit(now);
     console.log(
       `[plane/admit] ${post.threadKey} → ${answer.kind}${answer.kind === "queued" ? ` position ${answer.position}` : ""} (run ${post.runId})`,
     );
@@ -2152,7 +2153,10 @@ export class RunHistoryDO extends DurableObject<Env> {
 
   /** A refusal-by-name the bot met at attach or exec (`POST /plane/observe`,
    *  record 0064): an admitted run re-enters the queue at its old position. */
-  planeObserve(post: { runId: string; resident: string; refusal: string }, now: number): { reentered: boolean } {
+  async planeObserve(
+    post: { runId: string; resident: string; refusal: string },
+    now: number,
+  ): Promise<{ reentered: boolean }> {
     let reentered = false;
     this.ctx.storage.transactionSync(() => {
       const decision = decide(this.planeState(), {
@@ -2165,7 +2169,7 @@ export class RunHistoryDO extends DurableObject<Env> {
       this.applyPlaneWrites(decision.writes);
       reentered = decision.writes.length > 0;
     });
-    if (reentered) void this.ensurePlaneReaskAlarm(now);
+    if (reentered) await this.settlePlaneReaskAlarmAfterCommit(now);
     console.log(
       `[plane/observe] run ${post.runId} on ${post.resident}: ${post.refusal.slice(0, 60)} — ${reentered ? "re-entered" : "no-op"}`,
     );
@@ -2194,6 +2198,18 @@ export class RunHistoryDO extends DurableObject<Env> {
     if (set === null || set > due) await this.ctx.storage.setAlarm(due);
   }
 
+  /** Settle alarm I/O without contradicting the plane transaction that already
+   *  committed. A scheduling failure may delay a re-ask until another wake,
+   *  but returning an error would make the caller proceed or retry while the
+   *  durable queued row remains eligible for admission. */
+  private async settlePlaneReaskAlarmAfterCommit(now: number): Promise<void> {
+    try {
+      await this.ensurePlaneReaskAlarm(now);
+    } catch (err) {
+      console.error("[plane/alarm] re-ask scheduling failed after the plane state committed", err);
+    }
+  }
+
   /** The earliest instant the plane must wake at (record 0064): the
    *  earliest hosting deadline, lease end or re-ask across its rows. A due
    *  already past re-offers at the re-ask cadence, never in a hot loop, and
@@ -2372,21 +2388,24 @@ export class RunHistoryDO extends DurableObject<Env> {
 
   /** The transport's push (record 0064, "Where it lives"): committed effects
    *  are pushed to the bot Worker over the service binding, which forwards to
-   *  the container. Fire and forget — a push that fails is not retried by a
-   *  timer; the effect rides the next heartbeat or reclaim-sweep answer. */
+   *  the container. The response does not wait for this best-effort push, but
+   *  the actor does: waitUntil keeps its I/O inside this request's lifetime so
+   *  it cannot contend with an unrelated request after the caller moves on. */
   private pushPlaneEffects(effects: PlaneEffect[]): void {
     if (effects.length === 0) return;
     const bot = this.env.BOT;
     if (!bot) return;
-    void bot
-      .fetch("https://bot/plane/effects", {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          authorization: `Bearer ${this.env.MEMORY_TOKEN ?? ""}`,
-        },
-        body: JSON.stringify({ effects }),
-      })
+    const delivery = Promise.resolve()
+      .then(() =>
+        bot.fetch("https://bot/plane/effects", {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${this.env.MEMORY_TOKEN ?? ""}`,
+          },
+          body: JSON.stringify({ effects }),
+        }),
+      )
       .then((r) => {
         if (!r.ok)
           console.warn(
@@ -2398,6 +2417,7 @@ export class RunHistoryDO extends DurableObject<Env> {
           `[plane/push] ${effects.length} effect(s) not delivered: ${err instanceof Error ? err.message : String(err)} — they ride the next heartbeat`,
         );
       });
+    holdBackgroundTask(this.ctx, `plane effect push (${effects.map((effect) => effect.id).join(", ")})`, delivery);
   }
 
   /** The unacknowledged effects, oldest first, at most `PLANE_EFFECTS_PER_ANSWER`

package/dist/assets/deploy/cloudflare-resident/worker.ts

@@ -5027,11 +5027,32 @@ export class ResidentDO extends Sandbox<Env> {
    *  deploy's alone. Answers `restarted` when a stop was issued, else why
    *  not. */
   private async reconcileImage(where: "attach" | "refresh" | "deploy", force = false): Promise<ImageReconcileResult> {
-    if (!(await this.isRuntimeActive().catch(() => false))) {
-      // Inactivity proves only that the old process is gone, not that its
-      // replacement started successfully. Keep the marker: the next refresh's
-      // hydration starts the deployed image and reports only after it reaches
-      // `warm` (issue 2101).
+    const active = await this.isRuntimeActive().catch((err) => {
+      console.log(`image-reconcile (${where}): activity probe failed — preserving the pending report: ${errMsg(err)}`);
+      return null;
+    });
+    // A failed probe proves neither state. Preserve the marker and its drain
+    // hold until a later reconcile confirms inactivity or hydrates a fresh
+    // active container. An attach with that marker must fail closed even after
+    // the drain backstop reopens: admitting it could wake a pre-deploy image.
+    if (active === null) {
+      if (
+        where === "attach" &&
+        (await this.ctx.storage.get<{ resource: string }>(IMAGE_REPORT_PENDING_KEY)) !== undefined
+      ) {
+        console.log(
+          "image-stale (attach): activity could not be verified while a new-image report is pending — the attach is refused",
+        );
+        return "stale";
+      }
+      return "deferred";
+    }
+    if (!active) {
+      // An inactive container's next start is on the deployed image by
+      // construction. Report on every reconcile: the deploy may have marked
+      // it pending after an earlier idle cycle, and the drain itself refuses
+      // the attach that would otherwise wake it and provide another reporter.
+      await this.reportPendingImageCurrent(where);
       return "inactive";
     }
     const last = THREAD_USERS[THREAD_USERS.length - 1];
@@ -5091,12 +5112,13 @@ export class ResidentDO extends Sandbox<Env> {
   /** The report a held drain waits for (issue 1931): when the deploy's
    *  reconcile could not verify this resident's fresh container on the new
    *  image, a marker stays in storage and the registry holds the drain. The
-   *  fact the report stands on is the replacement's own completed hydration:
-   *  the fresh container has restored its snapshot and reached `warm`. A stop
-   *  or inactive runtime does not report; each keeps the marker for that next
-   *  start (issue 2101). The marker is deleted only after a successful report:
-   *  a transient failure keeps it for the next reconcile, and the drain's
-   *  `until` is the backstop for a report that never lands. */
+   *  fact the report stands on is either an inactive runtime, whose next start
+   *  uses the deployed image by construction, or the active replacement's own
+   *  completed hydration: the fresh container has restored its snapshot and
+   *  reached `warm`. A stop alone does not report (issue 2101). The marker is
+   *  deleted only after a successful report: a transient failure keeps it for
+   *  the next reconcile, and the drain's `until` is the backstop for a report
+   *  that never lands. */
   private async reportPendingImageCurrent(where: string): Promise<boolean> {
     const pending = await this.ctx.storage.get<{ resource: string }>(IMAGE_REPORT_PENDING_KEY);
     if (pending === undefined) return true;
@@ -5125,9 +5147,9 @@ export class ResidentDO extends Sandbox<Env> {
    *  an active, quiet container is always cycled, but that stop is not a report.
    *  The marker survives until the replacement hydrates and reaches `warm` on
    *  the deploy's image (issue 2101: the old probe raced that restore and lost).
-   *  `verified` true is the fact the reopen may stand on; a cycle or inactive
-   *  result leaves a hold on the drain, cleared by this resident's later
-   *  `reportPendingImageCurrent`, never by a timer.
+   *  `verified` true is the fact the reopen may stand on: inactivity reports
+   *  at once, while an active container's cycle leaves a hold until its fresh
+   *  hydration calls `reportPendingImageCurrent`, never until a timer.
    *
    *  The hold lands BEFORE the marker: the marker is what lets any concurrent
    *  attach/refresh reconcile report, and a report that reaches the registry
@@ -5139,10 +5161,9 @@ export class ResidentDO extends Sandbox<Env> {
     await this.ctx.storage.put(IMAGE_REPORT_PENDING_KEY, { resource });
     const result = await this.reconcileImage("deploy", true);
     if (result === "deferred") return { result, verified: false };
-    // Neither inactivity nor a successful stop is verification: only the
-    // replacement's completed hydration clears the marker. A concurrent fresh
-    // start may have done so while this reconcile yielded, hence the storage
-    // read rather than an unconditional false.
+    // Inactivity reports synchronously; a successful stop does not. A
+    // concurrent fresh start may also have hydrated while this reconcile
+    // yielded, hence the storage read rather than a verdict from `result`.
     const verified = (await this.ctx.storage.get(IMAGE_REPORT_PENDING_KEY)) === undefined;
     return { result, verified };
   }

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.260.1",
+  "version": "1.260.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.260.1",
+      "version": "1.260.2",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.260.1",
+      "version": "1.260.2",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.260.1",
+  "version": "1.260.2",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.260.1",
-  "commit": "c57cb7b614e8916b3fd0ab86c848a8398d8dc781",
-  "builtAt": "2026-09-21T18:18:08.788Z"
+  "version": "1.260.2",
+  "commit": "95c0153dc141f2e586238634e66970fea994bf7b",
+  "builtAt": "2026-09-21T20:25:49.397Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -447,7 +447,7 @@ Your final message is posted to Slack — keep it readable, lead with the outcom
 // whole reply — so the prose never repeats them and never pads around them.
 const REVIEW_FINAL_MESSAGE = `YOUR FINAL MESSAGE IS THE REVIEW'S TEXT, NOTHING ELSE. Switchboard renders the verdict line and the findings list from your submit_verdict call — on GitHub as the head of the comment, in Slack as the whole reply — and folds your final message under them on GitHub as the full review. So write only what the list cannot carry: one short paragraph per finding, keyed by its id (what is wrong, the concrete failure, the fix). Do not restate the verdict or the findings, do not summarize what you read, do not list what you verified clean, do not describe your method — what you checked belongs in your notes, which the run page shows. A change with no findings needs one sentence, not a tour.`;
 
-const REVIEW_VERDICT_INSTRUCTION = `VERDICT: before your final message, call the submit_verdict tool exactly once with \`approve\` (no finding at or above the severity to address remains — the level in force for this run, \`minor\` by default: a major or a minor finding means \`request_changes\`; nits alone never block) or \`request_changes\`, a one-line summary, \`head\` = the output of \`git rev-parse HEAD\` in the checkout you reviewed, and \`findings\` — every issue you report as a structured entry with a stable id you assign in order (F1, F2, …), a severity of exactly blocking|major|minor|nit, the file (plus line when it points at one), and a one-line title. The findings array is the index of your review: the full explanation of each finding stays in your prose, keyed by the same ids. Switchboard writes the verdict as the first line of the GitHub comment itself, lists the findings under it and folds your text below them as the full review; a review with no submitted verdict is posted as not approving, so never skip it. An \`approve\` carrying a finding at or above the severity to address is downgraded to \`request_changes\` and the tool's ack says so — approve only when every finding sits below the level. Do not write "LGTM" in your own text — the verdict line carries it.`;
+const REVIEW_VERDICT_INSTRUCTION = `VERDICT: before your final message, call the submit_verdict tool exactly once with \`approve\` (no finding at or above the severity to address remains — the level in force for this run, \`minor\` by default: a major or a minor finding means \`request_changes\`; nits alone never block) or \`request_changes\`, a one-line summary, \`head\` = the output of \`git rev-parse HEAD\` in the checkout you reviewed, and \`findings\` — every issue you report as a structured entry with a stable id you assign in order (F1, F2, …), a severity of exactly blocking|major|minor|nit, the file (plus line when it points at one), and a one-line title. The findings array is the index of your review: the full explanation of each finding stays in your prose, keyed by the same ids. Switchboard writes the verdict as the first line of the GitHub comment itself, lists the findings under it and folds your text below them as the full review; a review with no submitted verdict is posted as not approving, so never skip it. The only exception is a preflight infrastructure failure from the REVIEW TARGET block's first-command HEAD check: stop, submit no finding or verdict, and let Switchboard report it without a GitHub post. An \`approve\` carrying a finding at or above the severity to address is downgraded to \`request_changes\` and the tool's ack says so — approve only when every finding sits below the level. Do not write "LGTM" in your own text — the verdict line carries it.`;
 
 // The diff-gated spec review (docs/reference/specs/agent-review.md item 14) and
 // the test guard under it (item 16; specs-coverage.md item 6), one text for
@@ -485,7 +485,7 @@ Strategy — GATHER ONCE, THEN ANALYZE ONCE. Do not explore file-by-file; your c
 
 1. GATHER, in 2-4 batched tool calls total:
    - \`gh pr view <ref> --json title,body,url,baseRefName\` and \`gh pr diff <ref>\` (the complete diff) in one command
-   - clone the repo and check out the PR branch, then call the \`diff_digest\` tool to orient: per-file churn, totals, and risky-file flags (migrations/schema, auth/permission, whole-file deletions, lockfiles, very large files) so you know where to look hardest before you read a line
+   - for a PR review, use the checkout Switchboard provisioned at the head named in the REVIEW TARGET block — do not clone or check out another ref — then call the \`diff_digest\` tool to orient: per-file churn, totals, and risky-file flags (migrations/schema, auth/permission, whole-file deletions, lockfiles, very large files) so you know where to look hardest before you read a line
 ${REVIEW_WHOLE_CHANGE}
    - in ONE command, print the full current contents of every changed source file, e.g.: \`gh pr diff <ref> --name-only | grep -v -E "lock|generated|snap" | while read f; do echo "=== $f ==="; cat "$f"; done\`
    - if the PR is enormous (>~6k changed lines), print the riskiest files in full (state mutation, auth, concurrency, data deletion, public APIs) and only the diff hunks for the rest — and say which files you skimmed

package/dist/assets/src/core/budgets.ts

@@ -231,6 +231,13 @@ export const PULL_SWEEP = { leaseMinutes: 15, spendCapUsd: 5 } as const;
  *  budget. */
 export const PROVIDER_RETRY_BACKOFFS_MS = [5_000, 15_000, 45_000] as const;
 
+/** How often the model proxy writes an SSE comment while the provider is
+ *  reasoning silently. The public container hop has cut an otherwise healthy
+ *  stream at about thirty seconds of silence; a comment inside half that
+ *  window keeps the transport alive without becoming a model event. The
+ *  model call itself remains bounded by the run's lease. */
+export const MODEL_STREAM_HEARTBEAT_MS = 15_000;
+
 /** A hosted ship parent's deadline margin past the pipeline's wall clock
  *  (record 0060): the row's `state.hosting.until` is the hand-off time plus
  *  the instance's `caps.maxMinutes` plus this hour, absorbing the runner's own

package/dist/assets/src/core/coordinator/driver.ts

@@ -51,6 +51,7 @@ import {
   type PlanCursor,
   type UnitStatus,
   renderUnitReport,
+  reenterApprovedRebase,
   settleUnit,
   startUnit,
   type ChildFacts,
@@ -114,6 +115,7 @@ export type CoordinatorStepRoute =
   | "unit-wake"
   | "checks"
   | "merge"
+  | "rebase"
   | "finish";
 
 /** What a step stores: the bot's reply as the wire carried it — its status and
@@ -505,13 +507,26 @@ function mergeReturn(step: string, a: BotAnswer): StepReturn {
     return { type: "merge", step, outcome: "merged", sha, at };
   if (
     ok === true &&
-    (outcome === "pending" || outcome === "refused" || outcome === "enqueued" || outcome === "removed") &&
+    (outcome === "pending" ||
+      outcome === "refused" ||
+      outcome === "conflict" ||
+      outcome === "enqueued" ||
+      outcome === "removed") &&
     typeof reason === "string"
   )
     return { type: "merge", step, outcome, reason, at };
   throw new UnreadableAnswer("merge", a, "outcome");
 }
 
+function rebaseReturn(step: string, a: BotAnswer): StepReturn {
+  const { ok, outcome, headSha, reason, at } = a.body;
+  if (ok === true && (outcome === "carried" || outcome === "changed") && typeof headSha === "string")
+    return { type: "rebase", step, outcome, headSha, at };
+  if (ok === true && (outcome === "conflict" || outcome === "refused") && typeof reason === "string")
+    return { type: "rebase", step, outcome, reason, at };
+  throw new UnreadableAnswer("rebase", a, "outcome");
+}
+
 // ---- the steps ----------------------------------------------------------------------------------------
 
 /** One bot call inside a step: a reply that is not the bot's answer and a
@@ -706,6 +721,16 @@ async function perform(
           ),
         ),
       );
+    case "rebase":
+      return rebaseReturn(
+        action.step,
+        answerOf(
+          "rebase",
+          await step.do(action.step, STEP_CONFIG, () =>
+            call(bot, "rebase", { ...tag, prNumber: action.prNumber, headSha: action.headSha }),
+          ),
+        ),
+      );
   }
 }
 
@@ -838,7 +863,7 @@ async function runUnit(
   let notes = 0;
   let endedAt: number | undefined;
   try {
-    for (;;) {
+    pipeline: for (;;) {
       const action = nextAction(state);
       if (action.type === "end") return { ...action.ending, ...(endedAt !== undefined ? { endedAt } : {}) };
       // Keep the current round across its non-round phases (for example merge)
@@ -892,9 +917,9 @@ async function runUnit(
                   // The checks at the approved head (record 0055): the report's
                   // headline is a claim about them, never "merge-ready" over a red one.
                   ...(check.pr.checks !== undefined ? { checks: check.pr.checks } : {}),
-                  // The ready state beside them (agent-ship item 9): a conflicting
-                  // head, or one carrying an unsquashed fix-up commit, is reported
-                  // approved-but-not-merge-ready, never "merge-ready".
+                  // The ready state beside them (agent-ship item 9): a conflict
+                  // feeds the runner re-entry below, while an unsquashed fix-up
+                  // commit remains an approved-but-not-merge-ready report.
                   ...(check.pr.mergeableState !== undefined ? { mergeableState: check.pr.mergeableState } : {}),
                   ...(check.pr.fixupCommits !== undefined ? { fixupCommits: check.pr.fixupCommits } : {}),
                   // The base's merge-queue rule (issue 2011): the merge:person
@@ -907,6 +932,14 @@ async function runUnit(
               // the report simply omits the fact
             }
           }
+          // A person-merge pipeline used to publish this dirty state as its
+          // ending and hand the pull request to the sweep. It remains the
+          // owner instead: rung one runs now, and only a conflict buys a coding
+          // child under this run's remaining lease.
+          if (note.ending.kind === "merge_ready" && endFacts?.mergeableState === "dirty") {
+            state = reenterApprovedRebase(state);
+            continue pipeline;
+          }
           // The last coding child's run is named so the bot can put its handoff
           // — the deviations it recorded — on the unit's board issue beside the
           // ending (agent-ship item 14).

package/dist/assets/src/core/reviewedHead.ts

@@ -51,6 +51,20 @@ export function sameCommit(a: string, b: string): boolean {
   return n >= 7 && a.slice(0, n) === b.slice(0, n);
 }
 
+/** A mismatch sentence that cannot print two identical accepted-looking
+ * prefixes: it names the authoritative source, both values and their first
+ * differing hex position. */
+function mismatchReason(source: "workspace-observed" | "model-reported", reviewed: string, expected: string): string {
+  const compared = Math.min(reviewed.length, expected.length);
+  let at = 0;
+  while (at < compared && reviewed[at] === expected[at]) at += 1;
+  const divergence =
+    at < compared
+      ? `they first differ at hex ${at + 1} (${reviewed[at]} ≠ ${expected[at]})`
+      : `the ${reviewed.length}-hex reviewed value ends before the ${expected.length}-hex PR head`;
+  return `${source} reviewed head ${reviewed} is not the PR head ${expected}; ${divergence}`;
+}
+
 /**
  * Decide whether the reviewed head is the PR head. `expected` is the PR head
  * from repo resolution; `observed` the dispatcher's own `git rev-parse HEAD`
@@ -63,7 +77,7 @@ export function checkReviewedHead(input: { expected?: string; observed?: string;
   if (observed) {
     return sameCommit(observed, expected)
       ? { ok: true, head: observed, source: "observed" }
-      : { ok: false, reason: `reviewed head ${observed.slice(0, 7)} is not the PR head ${expected.slice(0, 7)}` };
+      : { ok: false, reason: mismatchReason("workspace-observed", observed, expected) };
   }
   const reported = normalizeHead(input.reported);
   if (!reported)
@@ -73,5 +87,5 @@ export function checkReviewedHead(input: { expected?: string; observed?: string;
     };
   return sameCommit(reported, expected)
     ? { ok: true, head: reported, source: "reported" }
-    : { ok: false, reason: `reviewed head ${reported.slice(0, 7)} is not the PR head ${expected.slice(0, 7)}` };
+    : { ok: false, reason: mismatchReason("model-reported", reported, expected) };
 }