@coreplane/switchboard 1.260.3 → 1.260.5

package/dist/assets/deploy/cloudflare/package.json

@@ -21,9 +21,9 @@
     "@cloudflare/containers": "^0.3.7"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "^5.20260904.1",
+    "@cloudflare/workers-types": "^5.20260914.1",
     "typescript": "^5.9.3",
     "vitest": "^5.0.0",
-    "wrangler": "^4.129.1"
+    "wrangler": "^4.131.2"
   }
 }

package/dist/assets/deploy/cloudflare-docs/package.json

@@ -13,6 +13,6 @@
     "tail": "wrangler tail"
   },
   "devDependencies": {
-    "wrangler": "^4.129.1"
+    "wrangler": "^4.131.2"
   }
 }

package/dist/assets/deploy/cloudflare-memory/package.json

@@ -17,9 +17,9 @@
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.22.0",
-    "@cloudflare/workers-types": "^5.20260904.1",
+    "@cloudflare/workers-types": "^5.20260914.1",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11",
-    "wrangler": "^4.129.1"
+    "wrangler": "^4.131.2"
   }
 }

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -77,7 +77,8 @@ import {
   reclaimPhase,
   selectReclaim,
 } from "../../src/core/runLedger/decisions.ts";
-import { intakeReceiptRetentionMs, minutesToMs, PLANE } from "../../src/core/budgets.ts";
+import { INTAKE_DELIVERY_CLAIM_MS, intakeReceiptRetentionMs, minutesToMs, PLANE } from "../../src/core/budgets.ts";
+import { PROVIDER_FAILURE_CAUSES, type ProviderFailureCause } from "../../src/core/provider.ts";
 import { holdBackgroundTask } from "./backgroundTasks.ts";
 import {
   causeOfClose,
@@ -1696,6 +1697,12 @@ export class RunHistoryDO extends DurableObject<Env> {
       );
       CREATE INDEX IF NOT EXISTS intake_thread ON intake_receipts(thread_key, decided_at);
       CREATE INDEX IF NOT EXISTS intake_prune ON intake_receipts(prune_after);
+      CREATE TABLE IF NOT EXISTS intake_deliveries (
+        receipt_key TEXT PRIMARY KEY,
+        poster TEXT NOT NULL,
+        claim_until INTEGER NOT NULL,
+        delivered INTEGER NOT NULL
+      );
     `);
     // The coordinator's parent records (run-history item 49): one row per
     // instance, written by the bot at the instance's creation and read by the
@@ -1718,6 +1725,14 @@ export class RunHistoryDO extends DurableObject<Env> {
         updated_at INTEGER NOT NULL,
         PRIMARY KEY (instance_id, unit)
       );
+      CREATE TABLE IF NOT EXISTS decision_record_reservations (
+        repo TEXT NOT NULL,
+        task_key TEXT NOT NULL,
+        number TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        PRIMARY KEY (repo, task_key),
+        UNIQUE (repo, number)
+      );
     `);
     // The thread events of a unit-owned thread (record 0051's reply-as-event rule): a
     // sibling table of the unit rows, never a field on them — `putUnits`
@@ -1786,6 +1801,7 @@ export class RunHistoryDO extends DurableObject<Env> {
         side TEXT NOT NULL,
         reported_at INTEGER NOT NULL,
         generation TEXT NOT NULL,
+        cause TEXT,
         PRIMARY KEY (resident, name)
       );
       CREATE TABLE IF NOT EXISTS plane_endings (
@@ -1795,6 +1811,13 @@ export class RunHistoryDO extends DurableObject<Env> {
         at INTEGER NOT NULL
       );
     `);
+    const planeLevelColumns = new Set(
+      this.sql
+        .exec<{ name: string }>(`PRAGMA table_info(plane_levels)`)
+        .toArray()
+        .map((column) => column.name),
+    );
+    if (!planeLevelColumns.has("cause")) this.sql.exec(`ALTER TABLE plane_levels ADD COLUMN cause TEXT`);
   }
 
   // ---- the orchestration plane (record 0064; orchestration-plane.md) ----------
@@ -1874,9 +1897,14 @@ export class RunHistoryDO extends DurableObject<Env> {
         .map((r) => [r.run_id, r.seq]),
     );
     const levels = this.sql
-      .exec<{ resident: string; name: string; side: string; reported_at: number; generation: string }>(
-        `SELECT * FROM plane_levels`,
-      )
+      .exec<{
+        resident: string;
+        name: string;
+        side: string;
+        reported_at: number;
+        generation: string;
+        cause: string | null;
+      }>(`SELECT * FROM plane_levels`)
       .toArray()
       .map((r): PlaneLevelRow => ({
         resident: r.resident,
@@ -1884,6 +1912,9 @@ export class RunHistoryDO extends DurableObject<Env> {
         side: r.side as PlaneLevelRow["side"],
         reportedAt: r.reported_at,
         generation: r.generation,
+        ...(r.cause !== null && (PROVIDER_FAILURE_CAUSES as readonly string[]).includes(r.cause)
+          ? { cause: r.cause as ProviderFailureCause }
+          : {}),
       }));
     return { queue, liveThreads, liveRuns, inboxSeqs, reservations, openWindows, levels };
   }
@@ -1945,12 +1976,13 @@ export class RunHistoryDO extends DurableObject<Env> {
         this.sql.exec(`DELETE FROM plane_windows WHERE kind = ?`, w.window);
       } else if (w.table === "plane_levels") {
         this.sql.exec(
-          `INSERT OR REPLACE INTO plane_levels (resident, name, side, reported_at, generation) VALUES (?, ?, ?, ?, ?)`,
+          `INSERT OR REPLACE INTO plane_levels (resident, name, side, reported_at, generation, cause) VALUES (?, ?, ?, ?, ?, ?)`,
           w.row.resident,
           w.row.name,
           w.row.side,
           w.row.reportedAt,
           w.row.generation,
+          w.row.cause ?? null,
         );
       } else if (w.table === "plane_findings") {
         // A finding (record 0064, "Endings and the watches"): keyed by watch
@@ -2104,14 +2136,20 @@ export class RunHistoryDO extends DurableObject<Env> {
   planeLevel(
     post:
       | { resident: string; name: "seat" | "memory" | "drain"; side: "below" | "above"; generation: string }
-      | { provider: string; name: "provider"; side: "up" | "down" },
+      | { provider: string; name: "provider"; side: "up" | "down"; cause?: ProviderFailureCause },
     now: number,
   ): { admitted: number } {
     // The model proxy's provider level (record 0064): `up` re-issues every
     // held turn parked on the provider — the steers land as inbox writes in the
     // decider's transaction — and walks anything queued on `provider_up`.
     if (post.name === "provider") {
-      const r = this.planeApply({ kind: "provider_level", at: now, provider: post.provider, level: post.side });
+      const r = this.planeApply({
+        kind: "provider_level",
+        at: now,
+        provider: post.provider,
+        level: post.side,
+        ...(post.side === "down" && post.cause !== undefined ? { cause: post.cause } : {}),
+      });
       const admitted = r.effects.filter((e) => e.kind === "admit").length;
       console.log(`[plane/level] provider ${post.provider} ${post.side} — ${admitted} admission(s)`);
       return { admitted };
@@ -2601,6 +2639,71 @@ export class RunHistoryDO extends DurableObject<Env> {
     return out;
   }
 
+  // ---- decision-record reservations (agent-ship item 16) ---------------------
+
+  /** One atomic durable allocation across bot processes. Existing unit and run
+   * rows seed the claim set for reservations written before this ledger existed. */
+  async reserveDecisionRecord(
+    repo: string,
+    taskKey: string,
+    claimed: string[],
+    existing: string | undefined,
+    now: number,
+  ): Promise<{ number: string }> {
+    let number = "";
+    this.ctx.storage.transactionSync(() => {
+      const prior = this.sql
+        .exec<{ number: string }>(
+          `SELECT number FROM decision_record_reservations WHERE repo = ? AND task_key = ?`,
+          repo,
+          taskKey,
+        )
+        .toArray()[0];
+      if (prior !== undefined) {
+        number = prior.number;
+        return;
+      }
+
+      const used = new Set(claimed);
+      for (const row of this.sql
+        .exec<{ number: string }>(`SELECT number FROM decision_record_reservations WHERE repo = ?`, repo)
+        .toArray())
+        used.add(row.number);
+      for (const row of this.sql
+        .exec<{ instance_json: string; unit_json: string }>(
+          `SELECT i.json AS instance_json, u.json AS unit_json
+             FROM coordinator_units u JOIN coordinator_instances i ON i.instance_id = u.instance_id`,
+        )
+        .toArray()) {
+        const instance = JSON.parse(row.instance_json) as CoordinatorInstance;
+        const unit = JSON.parse(row.unit_json) as CoordinatorUnit;
+        if (instance.repo === repo && unit.record !== undefined) used.add(unit.record);
+      }
+      for (const row of this.sql
+        .exec<{ summary_json: string }>(`SELECT summary_json FROM runs WHERE repo = ?`, repo)
+        .toArray()) {
+        const record = JSON.parse(row.summary_json) as { record?: unknown };
+        if (typeof record.record === "string" && /^\d{4}$/.test(record.record)) used.add(record.record);
+      }
+      for (const row of this.sql.exec<{ meta_json: string }>(`SELECT meta_json FROM live_runs`).toArray()) {
+        const meta = JSON.parse(row.meta_json) as { repo?: unknown; record?: unknown };
+        if (meta.repo === repo && typeof meta.record === "string" && /^\d{4}$/.test(meta.record)) used.add(meta.record);
+      }
+
+      const highest = [...used].reduce((max, value) => (/^\d{4}$/.test(value) ? Math.max(max, Number(value)) : max), 0);
+      number = existing ?? String(highest + 1).padStart(4, "0");
+      if (!/^\d{4}$/.test(number)) throw new Error(`decision-record numbers exhausted for ${repo}`);
+      this.sql.exec(
+        `INSERT INTO decision_record_reservations (repo, task_key, number, created_at) VALUES (?, ?, ?, ?)`,
+        repo,
+        taskKey,
+        number,
+        now,
+      );
+    });
+    return { number };
+  }
+
   // ---- the units of the plan an instance runs (run-history item 50) -----------
 
   /** Each row replaced whole under its (instance, unit); a replace keeps the row's place. */
@@ -3223,6 +3326,48 @@ export class RunHistoryDO extends DurableObject<Env> {
     return this.intakeRow(key) ?? null;
   }
 
+  /** The receipt key and poster become one durable, atomic right to publish.
+   * A dead claimant can be replaced only after its bounded claim expires. */
+  async claimIntakeDelivery(key: string, poster: string, claimedAt: number): Promise<boolean> {
+    let claimed = false;
+    this.ctx.storage.transactionSync(() => {
+      if (this.intakeRow(key)?.providerFailure === undefined) return;
+      const existing = this.sql
+        .exec<{ claim_until: number; delivered: number }>(
+          `SELECT claim_until, delivered FROM intake_deliveries WHERE receipt_key = ?`,
+          key,
+        )
+        .toArray()[0];
+      if (existing?.delivered === 1 || (existing !== undefined && existing.claim_until > claimedAt)) return;
+      this.sql.exec(
+        `INSERT INTO intake_deliveries (receipt_key, poster, claim_until, delivered) VALUES (?, ?, ?, 0)
+         ON CONFLICT(receipt_key) DO UPDATE SET poster = excluded.poster, claim_until = excluded.claim_until, delivered = 0`,
+        key,
+        poster,
+        claimedAt + INTAKE_DELIVERY_CLAIM_MS,
+      );
+      claimed = true;
+    });
+    return claimed;
+  }
+
+  async finishIntakeDelivery(key: string, poster: string, delivered: boolean): Promise<void> {
+    this.ctx.storage.transactionSync(() => {
+      if (delivered)
+        this.sql.exec(
+          `UPDATE intake_deliveries SET delivered = 1 WHERE receipt_key = ? AND poster = ? AND delivered = 0`,
+          key,
+          poster,
+        );
+      else
+        this.sql.exec(
+          `DELETE FROM intake_deliveries WHERE receipt_key = ? AND poster = ? AND delivered = 0`,
+          key,
+          poster,
+        );
+    });
+  }
+
   /** A thread's receipts, or the receipts since an instant, oldest first. */
   async listIntake(query: IntakeQuery): Promise<IntakeReceipt[]> {
     const clauses: string[] = [];
@@ -3574,6 +3719,10 @@ export class RunHistoryDO extends DurableObject<Env> {
         receipts = this.sql
           .exec<{ n: number }>(`SELECT COUNT(*) AS n FROM intake_receipts WHERE prune_after <= ?`, now)
           .one().n;
+        this.sql.exec(
+          `DELETE FROM intake_deliveries WHERE receipt_key IN (SELECT key FROM intake_receipts WHERE prune_after <= ?)`,
+          now,
+        );
         this.sql.exec(`DELETE FROM intake_receipts WHERE prune_after <= ?`, now);
         // The sessions no kept run names any more (session-log item 7): decided
         // here, on the rows this transaction leaves; dropped after it.
@@ -4955,6 +5104,7 @@ const LEDGER_ROUTES = new Set([
   "/runs/coordinator/events/list",
   "/runs/coordinator/events/mark-consumed",
   "/runs/coordinator/wake",
+  "/runs/decision-record/reserve",
   "/runs/claim",
   "/runs/heartbeat",
   "/runs/append",
@@ -4972,6 +5122,8 @@ const LEDGER_ROUTES = new Set([
   "/runs/live-events",
   "/runs/intake",
   "/runs/intake/read",
+  "/runs/intake/delivery/claim",
+  "/runs/intake/delivery/finish",
   "/runs/intake/list",
   "/runs/transcript/owner",
   "/runs/transcript/write",
@@ -5125,7 +5277,22 @@ async function handlePlane(pathname: string, body: unknown, env: Env): Promise<R
       if (typeof b.provider !== "string" || b.provider.length === 0)
         return json({ error: "provider must be a non-empty string" }, 400);
       if (b.side !== "up" && b.side !== "down") return json({ error: "side must be up or down" }, 400);
-      return json(await stub.planeLevel({ provider: b.provider, name: "provider", side: b.side }, now));
+      if (
+        b.cause !== undefined &&
+        (typeof b.cause !== "string" || !(PROVIDER_FAILURE_CAUSES as readonly string[]).includes(b.cause))
+      )
+        return json({ error: `cause must be one of ${PROVIDER_FAILURE_CAUSES.join(", ")}` }, 400);
+      return json(
+        await stub.planeLevel(
+          {
+            provider: b.provider,
+            name: "provider",
+            side: b.side,
+            ...(b.side === "down" && typeof b.cause === "string" ? { cause: b.cause as ProviderFailureCause } : {}),
+          },
+          now,
+        ),
+      );
     }
     // A resident's level report (record 0064): forwarded by the bot from the levels a
     // resident answer carried, or from the registry's drain outbox.
@@ -5567,6 +5734,21 @@ async function handleLedger(pathname: string, body: unknown, env: Env): Promise<
     return json(r);
   }
 
+  // Decision-record allocation is one atomic write on the same durable object
+  // that holds unit and run rows, so a bot restart cannot forget a claim.
+  if (pathname === "/runs/decision-record/reserve") {
+    if (typeof b.repo !== "string" || !REPO_SLUG.test(b.repo)) return json({ error: "repo must be owner/name" }, 400);
+    if (typeof b.taskKey !== "string" || !/^[0-9a-f]{16}$/.test(b.taskKey))
+      return json({ error: "taskKey must be a decision-record task key" }, 400);
+    if (!Array.isArray(b.claimed) || !b.claimed.every((number) => typeof number === "string" && /^\d{4}$/.test(number)))
+      return json({ error: "claimed must be an array of decision-record numbers" }, 400);
+    if (b.existing !== undefined && (typeof b.existing !== "string" || !/^\d{4}$/.test(b.existing)))
+      return json({ error: "existing must be a decision-record number" }, 400);
+    return json(
+      await stub.reserveDecisionRecord(b.repo, b.taskKey, b.claimed as string[], b.existing as string | undefined, now),
+    );
+  }
+
   // The coordinator's parent records (run-history item 49): the record whole,
   // validated by the shared contract; a read by instance id.
   if (pathname === "/runs/coordinator/put") {
@@ -5662,6 +5844,21 @@ async function handleLedger(pathname: string, body: unknown, env: Env): Promise<
   }
 
   // The intake receipts (run-history item 59): keyed by the message, not a run.
+  if (pathname === "/runs/intake/delivery/claim" || pathname === "/runs/intake/delivery/finish") {
+    const receiptKey = b.key;
+    if (typeof receiptKey !== "string" || receiptKey.length === 0 || receiptKey.length > 256)
+      return json({ error: "key must be a non-empty string of at most 256 characters" }, 400);
+    if (typeof b.poster !== "string" || b.poster.length === 0 || b.poster.length > 256)
+      return json({ error: "poster must be a non-empty string of at most 256 characters" }, 400);
+    if (pathname === "/runs/intake/delivery/claim") {
+      if (typeof b.claimedAt !== "number" || !Number.isFinite(b.claimedAt))
+        return json({ error: "claimedAt must be a number" }, 400);
+      return json({ claimed: await stub.claimIntakeDelivery(receiptKey, b.poster, b.claimedAt) });
+    }
+    if (typeof b.delivered !== "boolean") return json({ error: "delivered must be a boolean" }, 400);
+    await stub.finishIntakeDelivery(receiptKey, b.poster, b.delivered);
+    return json({ ok: true });
+  }
   if (pathname === "/runs/intake" || pathname === "/runs/intake/read") {
     const receiptKey = b.key;
     if (typeof receiptKey !== "string" || receiptKey.length === 0 || receiptKey.length > 256)

package/dist/assets/deploy/cloudflare-resident/Dockerfile

@@ -152,10 +152,19 @@ RUN rm -f /usr/local/bin/bun \
 # The build asserts the binary with the probe the extract script uses at run
 # time (`command -v`): `unsquashfs -version` exits 1 on squashfs-tools 4.5 (this
 # base) when no filesystem is named, and failed the 1.2.0 image build that way.
+#
+# ripgrep (`rg`) + fd: the grep/find tools call these binaries directly. Ubuntu
+# packages fd as `fd-find` with the binary named `fdfind`, so the image exposes
+# the conventional `fd` name from /usr/local/bin (ahead of /usr/bin on PATH).
+# Both are image tools, never downloaded by a run; their PATH probes make a
+# missing package or link fail the image build instead of every resident run.
 RUN apt-get update \
-  && apt-get install -y --no-install-recommends squashfs-tools \
+  && apt-get install -y --no-install-recommends squashfs-tools ripgrep fd-find \
+  && ln -s /usr/bin/fdfind /usr/local/bin/fd \
   && rm -rf /var/lib/apt/lists/* \
-  && command -v unsquashfs >/dev/null
+  && command -v unsquashfs >/dev/null \
+  && command -v rg >/dev/null \
+  && command -v fd >/dev/null
 
 # The toolchain for what a run BUILDS and LOOKS AT — the same layer as the
 # sandbox image's (deploy/cloudflare-sandbox/Dockerfile);

package/dist/assets/deploy/cloudflare-resident/package.json

@@ -21,9 +21,9 @@
     "@cloudflare/sandbox": "0.13.0-next.751.1"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "^5.20260904.1",
+    "@cloudflare/workers-types": "^5.20260914.1",
     "typescript": "^5.9.3",
     "vitest": "^5.0.0",
-    "wrangler": "^4.129.1"
+    "wrangler": "^4.131.2"
   }
 }