@coreplane/switchboard 1.260.4 → 1.260.5

package/dist/cli.js

@@ -597,7 +597,7 @@ function fit(pipeline) {
   const need = ALLOWANCES.provision + ASKS.coding + reserveMinutes({ kind: "coding", index: 0 }, pipeline);
   return { ok: pipeline.maxMinutes >= need, need, have: pipeline.maxMinutes };
 }
-var SECOND_MS, secondsToMs, MINUTE_MS, minutesToMs, DAY_MS, WEEK_MS, CONFIRMATION_TTL_MS, QUESTION_TTL_MS, AUTHOR_BINDING_TTL_MS, FIRST_ATTACH_WAIT_MS, ATTACH_REQUEST_MIN_MS, HARNESS_PROBE_WAIT_MS, DRAIN, INTAKE_WINDOW_MAX_MS, INTAKE_RECOVERY_WINDOW_MS, LOOP_PRESETS, ASKS, PRESET_FLOORS, FLOORS, PULL_SWEEP, PROVIDER_RETRY_BACKOFFS_MS, MODEL_STREAM_HEARTBEAT_MS, HOSTED_DEADLINE_MARGIN_MINUTES, SHIP_WAIT, RESTART_CLAIM_GRACE_MS, PLANE, PACE_WINDOW_MINUTES, ALLOWANCES, POST_STEP_MINUTES, WRAP_UP_WARNING, SANDBOX_CREDENTIAL_WRITE_TIMEOUT_MS, BASH_COMMAND, RUNAWAY_TURNS_PER_MINUTE, DEFAULT_GRANT, GRANT_RENEWALS_MAX, STRUCTURED_RETRIES_MAX, IDLE_DAYS_DEFAULT, IDLE_DAYS_MAX, IDLE_WAKES_MAX;
+var SECOND_MS, secondsToMs, MINUTE_MS, minutesToMs, DAY_MS, WEEK_MS, CONFIRMATION_TTL_MS, QUESTION_TTL_MS, AUTHOR_BINDING_TTL_MS, FIRST_ATTACH_WAIT_MS, ATTACH_REQUEST_MIN_MS, HARNESS_PROBE_WAIT_MS, DRAIN, INTAKE_WINDOW_MAX_MS, INTAKE_RECOVERY_WINDOW_MS, INTAKE_DELIVERY_CLAIM_MS, LOOP_PRESETS, ASKS, PRESET_FLOORS, FLOORS, PULL_SWEEP, PROVIDER_RETRY_BACKOFFS_MS, MODEL_STREAM_HEARTBEAT_MS, HOSTED_DEADLINE_MARGIN_MINUTES, SHIP_WAIT, RESTART_CLAIM_GRACE_MS, PLANE, PACE_WINDOW_MINUTES, ALLOWANCES, POST_STEP_MINUTES, WRAP_UP_WARNING, SANDBOX_CREDENTIAL_WRITE_TIMEOUT_MS, BASH_COMMAND, RUNAWAY_TURNS_PER_MINUTE, DEFAULT_GRANT, GRANT_RENEWALS_MAX, STRUCTURED_RETRIES_MAX, IDLE_DAYS_DEFAULT, IDLE_DAYS_MAX, IDLE_WAKES_MAX;
 var init_budgets = __esm({
   "../../src/core/budgets.ts"() {
     "use strict";
@@ -633,6 +633,7 @@ var init_budgets = __esm({
     };
     INTAKE_WINDOW_MAX_MS = 30 * DAY_MS;
     INTAKE_RECOVERY_WINDOW_MS = 10 * MINUTE_MS;
+    INTAKE_DELIVERY_CLAIM_MS = 5 * MINUTE_MS;
     LOOP_PRESETS = [
       "general",
       "coding",
@@ -1648,13 +1649,13 @@ var init_configDocument = __esm({
       describe() {
         return `state Worker ${this.baseUrl}`;
       }
-      async post(path, payload) {
+      async post(path, payload2) {
         let res;
         try {
           res = await this.fetchImpl(`${this.baseUrl}${path}`, {
             method: "POST",
             headers: { authorization: `Bearer ${this.opts.token}`, "content-type": "application/json" },
-            body: JSON.stringify(payload),
+            body: JSON.stringify(payload2),
             signal: AbortSignal.timeout(this.timeoutMs)
           });
         } catch (err2) {
@@ -2821,6 +2822,230 @@ var init_effort = __esm({
 });
 
 // ../../src/core/provider.ts
+function providerFailureDiagnostic(cause, details2) {
+  if (details2.provider !== void 0 && details2.keyVariable !== void 0) {
+    if (cause === "key-absent") return `Provider "${details2.provider}": ${details2.keyVariable} is not set`;
+    if (cause === "key-invalid") return `Provider "${details2.provider}": ${details2.keyVariable} was refused`;
+  }
+  return renderProviderFailure(cause);
+}
+function renderProviderFailure(cause, surface = "ended") {
+  switch (cause) {
+    case "transient":
+      return surface === "parked" ? "The model provider is temporarily unavailable; your work is kept and will continue when service recovers." : "The model provider is temporarily unavailable; this request did not start.";
+    case "rate-limited":
+      return surface === "parked" ? "The model provider is rate-limited; your work is kept and will continue when capacity returns." : "The model provider is rate-limited; this request did not start.";
+    case "credit-or-quota-exhausted":
+      return surface === "parked" ? "The model provider's credit or quota is exhausted; your work is kept and will continue when service recovers." : "The model provider's credit or quota is exhausted; this request did not start.";
+    case "key-absent":
+      return "The model provider key is not configured; this request cannot start until the service is restored.";
+    case "key-invalid":
+      return "The model provider key was refused; this request cannot start until the service is restored.";
+    case "model-unknown":
+      return "The configured model is unavailable from its provider; this request cannot start until the service is restored.";
+    case "request-rejected":
+      return "The model provider rejected the request shape; no work was started.";
+    case "permanent":
+      return "The model provider refused the call; the request ended without exposing the provider's response.";
+  }
+}
+function providerSchemaRejectionRecord(value) {
+  const row2 = providerFailureRecord(value);
+  return typeof row2?.tool === "string" && row2.tool.length > 0 && typeof row2.keyword === "string" && row2.keyword.length > 0 ? { tool: row2.tool, keyword: row2.keyword } : void 0;
+}
+function providerFailureBody(body) {
+  if (typeof body !== "string") return body;
+  const text = body.trim();
+  try {
+    return JSON.parse(text);
+  } catch {
+    const at = text.indexOf("{");
+    if (at < 0) return void 0;
+    try {
+      return JSON.parse(text.slice(at));
+    } catch {
+      return void 0;
+    }
+  }
+}
+function providerFailureSignals(value, into = []) {
+  if (Array.isArray(value)) {
+    for (const item of value) providerFailureSignals(item, into);
+    return into;
+  }
+  const row2 = providerFailureRecord(value);
+  if (!row2) return into;
+  for (const [key, item] of Object.entries(row2)) {
+    const normalizedKey = key.toLowerCase();
+    if (typeof item === "string" && ["code", "type", "error_type", "reason", "limit_source"].includes(normalizedKey))
+      into.push(item.toLowerCase());
+    else if (typeof item === "number" && normalizedKey === "code") into.push(String(item));
+    providerFailureSignals(item, into);
+  }
+  return into;
+}
+function providerFailureStatus(input, text) {
+  if (input.status !== void 0) return input.status;
+  const match = /(?:^|\b(?:http|status(?: code)?|error|api error)[^0-9]{0,8})([1-5]\d\d)\b/i.exec(text);
+  return match ? Number(match[1]) : void 0;
+}
+function providerFailureText(input) {
+  const error = input.error;
+  if (error instanceof Error) return error.message;
+  if (typeof error === "string") return error;
+  if (typeof input.body === "string") return input.body;
+  try {
+    return input.body === void 0 ? "" : JSON.stringify(input.body);
+  } catch {
+    return "";
+  }
+}
+function quotedWord(text, word) {
+  return [`'${word}'`, `"${word}"`, `\`${word}\``].some((candidate) => text.includes(candidate));
+}
+function toolSchemaKeywords(value, into = /* @__PURE__ */ new Set()) {
+  if (Array.isArray(value)) {
+    for (const item of value) toolSchemaKeywords(item, into);
+    return into;
+  }
+  const schema = providerFailureRecord(value);
+  if (!schema) return into;
+  for (const [keyword, item] of Object.entries(schema)) {
+    into.add(keyword);
+    if ((keyword === "properties" || keyword === "$defs" || keyword === "definitions") && providerFailureRecord(item)) {
+      for (const child of Object.values(providerFailureRecord(item))) toolSchemaKeywords(child, into);
+    } else {
+      toolSchemaKeywords(item, into);
+    }
+  }
+  return into;
+}
+function providerSchemaRejectionOf(error, tools) {
+  if (!tools || tools.length === 0) return void 0;
+  const text = providerFailureText({ error });
+  const parsed = providerFailureBody(providerFailureRecord(error) ?? text);
+  const prose2 = providerFailureProse(parsed ?? text);
+  if (!/(?:invalid|unsupported|refused|rejected)[^.!?]{0,80}(?:json )?schema|(?:json )?schema[^.!?]{0,80}(?:invalid|unsupported|not (?:permitted|supported))/i.test(
+    prose2
+  ))
+    return void 0;
+  const namedTools = tools.filter((tool2) => quotedWord(prose2, tool2.name));
+  if (namedTools.length !== 1) return void 0;
+  const [tool] = namedTools;
+  const namedKeywords = [...toolSchemaKeywords(tool.inputSchema)].filter((keyword) => quotedWord(prose2, keyword));
+  if (namedKeywords.length !== 1) return void 0;
+  return { tool: tool.name, keyword: namedKeywords[0] };
+}
+function providerFailureProse(value, into = []) {
+  if (typeof value === "string") {
+    into.push(value);
+    return into.join(" ");
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) providerFailureProse(item, into);
+    return into.join(" ");
+  }
+  const row2 = providerFailureRecord(value);
+  if (!row2) return into.join(" ");
+  for (const [key, item] of Object.entries(row2)) {
+    if (key.toLowerCase() !== "cause") providerFailureProse(item, into);
+  }
+  return into.join(" ");
+}
+function signalIncludes(signals, words) {
+  return signals.some((signal2) => words.some((word) => signal2 === word || signal2.includes(word)));
+}
+function isProviderFailureCause(value) {
+  return typeof value === "string" && PROVIDER_FAILURE_CAUSES.includes(value);
+}
+function trustedProviderFailureEnvelope(value) {
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      const envelope = trustedProviderFailureEnvelope(item);
+      if (envelope !== void 0) return envelope;
+    }
+    return void 0;
+  }
+  const row2 = providerFailureRecord(value);
+  if (!row2) return void 0;
+  if (row2.type === "provider_failure" && isProviderFailureCause(row2.cause)) {
+    const schemaRejection = providerSchemaRejectionRecord(row2.schemaRejection);
+    return { cause: row2.cause, ...schemaRejection !== void 0 ? { schemaRejection } : {} };
+  }
+  for (const item of Object.values(row2)) {
+    const envelope = trustedProviderFailureEnvelope(item);
+    if (envelope !== void 0) return envelope;
+  }
+  return void 0;
+}
+function classifyProviderFailure(input) {
+  if (input.error instanceof ProviderFailure) return input.error;
+  const text = providerFailureText(input);
+  const parsed = providerFailureBody(input.body ?? providerFailureRecord(input.error) ?? text);
+  const signals = providerFailureSignals(parsed);
+  const trusted = input.trustedEnvelope === true ? trustedProviderFailureEnvelope(parsed) : void 0;
+  const status3 = providerFailureStatus(input, text);
+  const unstructuredText = input.body !== void 0 && (providerFailureRecord(parsed) !== void 0 || Array.isArray(parsed)) ? providerFailureProse(parsed) : text;
+  const transientTransport = status3 === 408 || status3 === 425 || input.error instanceof Error && (input.error.name === "AbortError" || input.error.name === "TimeoutError") || status3 !== void 0 && status3 >= 500 || /stream ended before message_stop|stream ended without finish_reason|ended before completion/i.test(
+    unstructuredText
+  ) || /^(?:(?:AbortError:\s*)?(?:This|The) operation was aborted|Request aborted)\.?$/i.test(unstructuredText.trim()) || /ECONNRESET|ETIMEDOUT|EPIPE|socket hang up|fetch failed|other side closed|network (?:error|failure)|(?:connection|stream) (?:reset|closed|terminated)|timed? ?out/i.test(
+    unstructuredText
+  ) || /^terminated$/i.test(unstructuredText.trim()) || /\boverloaded\b/i.test(unstructuredText) || /<html[\s>][\s\S]{0,4000}\b(?:bad gateway|service unavailable|gateway timeout)\b/i.test(unstructuredText);
+  let cause;
+  if (trusted !== void 0) cause = trusted.cause;
+  else if (status3 === 402) cause = "credit-or-quota-exhausted";
+  else if (status3 === 429) cause = "rate-limited";
+  else if (transientTransport) cause = "transient";
+  else if (signalIncludes(signals, [
+    "limit_source",
+    "insufficient_quota",
+    "quota_exceeded",
+    "credit_limit",
+    "billing_hard_limit",
+    "payment_required"
+  ]) || providerFailureRecord(parsed)?.metadata !== void 0 && providerFailureRecord(providerFailureRecord(parsed)?.metadata)?.limit_source !== void 0)
+    cause = "credit-or-quota-exhausted";
+  else if (signalIncludes(signals, ["rate_limit", "too_many_requests"]) || /\brate[- ]limit(?:ed)?\b/i.test(unstructuredText))
+    cause = "rate-limited";
+  else if (signalIncludes(signals, ["provider_key_missing", "key_absent", "missing_api_key"])) cause = "key-absent";
+  else if (status3 === 401 || signalIncludes(signals, ["authentication_error", "invalid_api_key", "invalid_key", "unauthorized"]))
+    cause = "key-invalid";
+  else if (signalIncludes(signals, ["model_not_found", "unknown_model", "model_unknown"])) cause = "model-unknown";
+  else if (status3 === 400 || status3 === 422 || signalIncludes(signals, ["invalid_request_error", "invalid_json_schema", "bad_request", "unprocessable_entity"]))
+    cause = "request-rejected";
+  else cause = "permanent";
+  const operatorUrl = /https?:\/\/[^\s"'<>]+/.exec(text)?.[0];
+  return new ProviderFailure(cause, {
+    ...status3 !== void 0 ? { status: status3 } : {},
+    ...input.provider !== void 0 ? { provider: input.provider } : {},
+    ...input.model !== void 0 ? { model: input.model } : {},
+    ...operatorUrl !== void 0 ? { operatorUrl } : {},
+    ...trusted?.schemaRejection !== void 0 ? { schemaRejection: trusted.schemaRejection } : {}
+  });
+}
+function typedProviderFailureOf(error, seen = /* @__PURE__ */ new Set()) {
+  if (error instanceof ProviderFailure) return error;
+  const row2 = providerFailureRecord(error);
+  if (!row2 || seen.has(row2)) return void 0;
+  seen.add(row2);
+  if (row2.name === "ProviderFailure" && isProviderFailureCause(row2.cause)) {
+    return new ProviderFailure(row2.cause, {
+      ...typeof row2.status === "number" ? { status: row2.status } : {},
+      ...typeof row2.provider === "string" ? { provider: row2.provider } : {},
+      ...typeof row2.model === "string" ? { model: row2.model } : {},
+      ...typeof row2.operatorUrl === "string" ? { operatorUrl: row2.operatorUrl } : {},
+      ...typeof row2.keyVariable === "string" ? { keyVariable: row2.keyVariable } : {},
+      ...providerSchemaRejectionRecord(row2.schemaRejection) !== void 0 ? { schemaRejection: providerSchemaRejectionRecord(row2.schemaRejection) } : {}
+    });
+  }
+  return typedProviderFailureOf(row2.cause, seen);
+}
+function providerFailureOf(error) {
+  return typedProviderFailureOf(error) ?? classifyProviderFailure({ error });
+}
+function providerFailureParks(cause) {
+  return cause === "transient" || cause === "rate-limited" || cause === "credit-or-quota-exhausted";
+}
 function wireOf(block) {
   return block.wire ?? WIRE_ALIASES[block.type] ?? "openai-chat";
 }
@@ -2859,10 +3084,41 @@ function parseModelRef(ref) {
   }
   return { provider: ref.slice(0, i), model: ref.slice(i + 1) };
 }
-var WIRES, WIRE_ALIASES, INVOICE_APIS, BILLER_HARNESS_PROVIDERS, ANTHROPIC_API_KEY_ENV;
+var PROVIDER_FAILURE_CAUSES, ProviderFailure, providerFailureRecord, WIRES, WIRE_ALIASES, INVOICE_APIS, BILLER_HARNESS_PROVIDERS, ANTHROPIC_API_KEY_ENV;
 var init_provider = __esm({
   "../../src/core/provider.ts"() {
     "use strict";
+    PROVIDER_FAILURE_CAUSES = [
+      "transient",
+      "rate-limited",
+      "credit-or-quota-exhausted",
+      "key-absent",
+      "key-invalid",
+      "model-unknown",
+      "request-rejected",
+      "permanent"
+    ];
+    ProviderFailure = class extends Error {
+      name = "ProviderFailure";
+      cause;
+      status;
+      provider;
+      model;
+      operatorUrl;
+      keyVariable;
+      schemaRejection;
+      constructor(cause, details2 = {}) {
+        super(providerFailureDiagnostic(cause, details2));
+        this.cause = cause;
+        this.status = details2.status;
+        this.provider = details2.provider;
+        this.model = details2.model;
+        this.operatorUrl = details2.operatorUrl;
+        this.keyVariable = details2.keyVariable;
+        this.schemaRejection = details2.schemaRejection;
+      }
+    };
+    providerFailureRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
     WIRES = ["anthropic-messages", "openai-chat", "openai-responses"];
     WIRE_ALIASES = {
       anthropic: "anthropic-messages",
@@ -3285,7 +3541,7 @@ function whereCell(f, target) {
 }
 function verdictMarker(verdict, target) {
   const head = target?.head ?? verdict?.head;
-  const payload = {
+  const payload2 = {
     verdict: verdict?.verdict ?? "none",
     ...head ? { head } : {},
     ...verdict?.findings ? {
@@ -3299,7 +3555,7 @@ function verdictMarker(verdict, target) {
       }))
     } : {}
   };
-  return `<!-- switchboard:verdict ${JSON.stringify(payload).replace(/-->/g, "--\\u003e")} -->`;
+  return `<!-- switchboard:verdict ${JSON.stringify(payload2).replace(/-->/g, "--\\u003e")} -->`;
 }
 function buildReviewPostBody(answer, verdict, target) {
   const facts2 = [
@@ -4756,11 +5012,11 @@ function analyzeRunFriction(events, opts = {}) {
     if (promised) {
       const line4 = answer.text.slice(0, promised.index).split("\n").pop() + answer.text.slice(promised.index).split("\n")[0];
       const trimmed2 = line4.trim();
-      const quoted = trimmed2.length > 120 ? `\u2026${trimmed2.slice(trimmed2.length - 119)}` : trimmed2;
+      const quoted2 = trimmed2.length > 120 ? `\u2026${trimmed2.slice(trimmed2.length - 119)}` : trimmed2;
       findings.push({
         category: "unkept_promise",
         severity: "low",
-        summary: `unkept promise: the reply says a file is attached but the run produced none \u2014 "${quoted}"`,
+        summary: `unkept promise: the reply says a file is attached but the run produced none \u2014 "${quoted2}"`,
         eventIndex: answer.index
       });
     }
@@ -5507,6 +5763,7 @@ function isCoordinatorUnit(v) {
   if (r.issue !== void 0 && !isFinite(r.issue)) return false;
   if (r.pr !== void 0 && !isPr(r.pr)) return false;
   if (r.resume !== void 0 && !isResume(r.resume)) return false;
+  if (r.record !== void 0 && (typeof r.record !== "string" || !/^\d{4}$/.test(r.record))) return false;
   if (r.lastPush !== void 0 && !isText(r.lastPush)) return false;
   if (r.segments !== void 0 && (!Array.isArray(r.segments) || !r.segments.every(isSegment))) return false;
   if (r.idle !== void 0 && !isUnitIdle(r.idle)) return false;
@@ -5536,22 +5793,22 @@ async function sendUnitNudge(workflow, key) {
 async function sendChecksSettled(workflow, instance, headSha, settledAt) {
   if (!workflow) return { kind: "no-binding", instance };
   const type = checksSettledEventType(headSha);
-  const payload = { headSha, settledAt };
+  const payload2 = { headSha, settledAt };
   try {
     const handle2 = await workflow.get(instance);
-    await handle2.sendEvent({ type, payload });
+    await handle2.sendEvent({ type, payload: payload2 });
     return { kind: "sent", instance, type };
   } catch (err2) {
     return { kind: "failed", instance, type, reason: err2 instanceof Error ? err2.message : String(err2) };
   }
 }
-async function sendPullMerged(workflow, key, payload) {
+async function sendPullMerged(workflow, key, payload2) {
   const instance = key.instanceId;
   if (!workflow) return { kind: "no-binding", instance };
   const type = pullMergedEventType(key);
   try {
     const handle2 = await workflow.get(instance);
-    await handle2.sendEvent({ type, payload });
+    await handle2.sendEvent({ type, payload: payload2 });
     return { kind: "sent", instance, type };
   } catch (err2) {
     return { kind: "failed", instance, type, reason: err2 instanceof Error ? err2.message : String(err2) };
@@ -5785,6 +6042,7 @@ var init_pipelineStanding = __esm({
     };
     ENDING_STAGE = {
       merged: "merged",
+      closed: "ended",
       already_landed: "merged",
       merge_ready: "merge-ready",
       held: "ended",
@@ -5806,6 +6064,7 @@ var init_pipelineStanding = __esm({
     };
     ENDING_WORDS = {
       merged: "merged",
+      closed: "closed",
       already_landed: "merged",
       merge_ready: "merge-ready",
       held: "held",
@@ -5865,6 +6124,16 @@ function instanceIdOfEvents(events) {
   for (const e of events) if (e.type === "ship_handoff") id = e.instanceId;
   return id;
 }
+function decisionRecordOfEvents(events) {
+  let reservation;
+  for (const event of events)
+    if (event.type === "run_meta" && event.record !== void 0)
+      reservation = {
+        record: event.record,
+        ...event.recordTaskKey !== void 0 ? { recordTaskKey: event.recordTaskKey } : {}
+      };
+  return reservation;
+}
 function prOfEvents(events) {
   let pr;
   for (const e of events) {
@@ -5939,6 +6208,7 @@ function operatorOfEvents(events) {
     ...e.request !== void 0 ? { request: e.request } : {},
     ...e.refusalCause !== void 0 ? { refusalCause: e.refusalCause } : {},
     ...e.refusalText !== void 0 ? { refusalText: e.refusalText } : {},
+    ...e.providerFailure !== void 0 ? { providerFailure: e.providerFailure } : {},
     ...e.attempts ? {
       attempts: e.attempts.map((a) => ({
         outcome: a.outcome,
@@ -6150,6 +6420,10 @@ function isRunRecord(v) {
   if (!isOptionalString(r.label) || !isOptionalString(r.agent) || !isOptionalString(r.model) || !isOptionalString(r.repo))
     return false;
   if (!isOptionalString(r.activity) || !isOptionalString(r.sourceUrl) || !isOptionalString(r.userName)) return false;
+  if (r.record !== void 0 && (typeof r.record !== "string" || !/^\d{4}$/.test(r.record))) return false;
+  if (r.recordTaskKey !== void 0 && (typeof r.recordTaskKey !== "string" || !/^[0-9a-f]{16}$/.test(r.recordTaskKey)))
+    return false;
+  if (r.headSha !== void 0 && (typeof r.headSha !== "string" || !REVIEW_HEAD_PATTERN.test(r.headSha))) return false;
   if (r.handoff !== void 0 && !isHandoffShape(r.handoff)) return false;
   if (r.verdict !== void 0 && !isReviewVerdictShape(r.verdict)) return false;
   if (r.reviewHead !== void 0 && (typeof r.reviewHead !== "string" || !REVIEW_HEAD_PATTERN.test(r.reviewHead)))
@@ -8335,13 +8609,13 @@ var init_config2 = __esm({
       describe() {
         return `state Worker ${this.baseUrl} (ConfigDO)`;
       }
-      async post(path, payload) {
+      async post(path, payload2) {
         let res;
         try {
           res = await this.fetchImpl(`${this.baseUrl}${path}`, {
             method: "POST",
             headers: { authorization: `Bearer ${this.opts.token}`, "content-type": "application/json" },
-            body: JSON.stringify(payload),
+            body: JSON.stringify(payload2),
             signal: AbortSignal.timeout(CONFIG_WORKER_TIMEOUT_MS)
           });
         } catch (err2) {
@@ -10456,11 +10730,11 @@ function resolveImportCandidates(fromFile, specifier) {
   const dir = fromFile.includes("/") ? fromFile.slice(0, fromFile.lastIndexOf("/")) : "";
   const joined = normalizePath(`${dir}/${specifier}`);
   const ext = /\.[a-z]+$/i.exec(joined)?.[0] ?? "";
-  const candidates = [];
-  if (JS_TO_TS[ext]) candidates.push(joined.slice(0, -ext.length) + JS_TO_TS[ext]);
-  if (!ext) candidates.push(`${joined}.ts`);
-  candidates.push(joined, `${joined}/index.ts`);
-  return candidates;
+  const candidates2 = [];
+  if (JS_TO_TS[ext]) candidates2.push(joined.slice(0, -ext.length) + JS_TO_TS[ext]);
+  if (!ext) candidates2.push(`${joined}.ts`);
+  candidates2.push(joined, `${joined}/index.ts`);
+  return candidates2;
 }
 async function importClosure(entry, read) {
   const entrySource = await read(entry);
@@ -11556,8 +11830,8 @@ var init_runStoreWorker = __esm({
       }
       /** POST a JSON body and classify the outcome. The body is a STRING; the
        *  runtime sets its numeric Content-Length (never hand-set — see header). */
-      async post(path, payload, span) {
-        const body = JSON.stringify(payload);
+      async post(path, payload2, span) {
+        const body = JSON.stringify(payload2);
         let res;
         try {
           res = await tracedFetch(
@@ -11841,8 +12115,8 @@ function rolloutTargetFromDeployOutput(output) {
   const at = text.indexOf("Container application changes");
   if (at < 0) return null;
   const lines = text.slice(at).split("\n").map((l) => l.replace(SECTION_GUTTER, "").trimEnd());
-  const imageOn = (candidates) => {
-    for (const l of candidates) {
+  const imageOn = (candidates2) => {
+    for (const l of candidates2) {
       const m = /^\+?\s*"image":\s*"([^"]+)"/.exec(l);
       if (m) return m[1];
     }
@@ -12043,7 +12317,7 @@ async function loadProfileOnHost(env = process.env, sourceIO = hostConfigSourceI
       return profileFromJson(read.text, override, "profile");
     }
   }
-  const candidates = override ? [
+  const candidates2 = override ? [
     {
       path: override,
       origin: "profile",
@@ -12053,7 +12327,7 @@ async function loadProfileOnHost(env = process.env, sourceIO = hostConfigSourceI
     { path: PROFILE_PATH, origin: "profile", abs: installationPath(OPERATOR_ROOT, PROFILE_PATH) },
     { path: PROFILE_EXAMPLE_PATH, origin: "example", abs: assetPath(OPERATOR_ROOT, PROFILE_EXAMPLE_PATH) }
   ];
-  for (const c of candidates) {
+  for (const c of candidates2) {
     const abs = c.abs;
     if (!existsSync6(abs)) {
       if (c.origin === "profile" && override) throw new Error(`${PROFILE_ENV}=${override}: no such file`);
@@ -15182,6 +15456,7 @@ var init_refusal = __esm({
       plan_runner_state_unread: "system",
       plan_units_merged: "request",
       plan_history_unavailable: "system",
+      decision_record_store_unavailable: "system",
       plan_runner_conflict: "system",
       plan_instance_orphaned: "system",
       plan_start_failed: "system",
@@ -15998,10 +16273,11 @@ var init_resident = __esm({
       }
       /** Bind/reuse this thread's worktree. Legible errors for every named
        *  refusal the service can answer with. Answers the binding the resident
-       *  reported: the bound ref — the resident's word, not the hint's: a differing
-       *  refHint is ignored unless `ownPr` names it as the thread's own pull
-       *  request and the resident moves a default-bound thread onto it (item 16;
-       *  `rebound` / `rebindRefused` say which) — and the sha the worktree is at. A
+       *  reported: the bound ref — a named `refHint` must be that ref, while the
+       *  sticky binding may answer a different ref only when the caller named none
+       *  (`refByDefault` or an `ownPr`-derived hint). The Worker also persists a named ref as the new sticky
+       *  binding (item 16). `rebound` / `rebindRefused` report the legacy own-PR
+       *  movement, and the sha says which commit the worktree is at. A
        *  200 without both fields is a malformed resident (the attach contract
        *  always carries them) and is an error, never a half-bound executor. A
        *  refusal the Worker typed as the platform's transient (`isTransientRefusal`:
@@ -16142,10 +16418,15 @@ var init_resident = __esm({
         if (typeof data.ref !== "string" || typeof data.sha !== "string") {
           throw new Error(`resident attach: malformed answer for ${this.opts.resource} (missing ref/sha)`);
         }
+        const returned = returnedOf(data.returned);
+        if (this.opts.refHint !== void 0 && !this.opts.refByDefault && this.opts.ownPr === void 0 && data.ref !== this.opts.refHint) {
+          throw new Error(
+            `resident attach: named ref mismatch for ${this.opts.resource} (asked for ${JSON.stringify(this.opts.refHint)}, got ${JSON.stringify(data.ref)})`
+          );
+        }
         const trace = sanitizeGraftedSteps(data.trace);
         const rebound = reboundOf(data.rebound);
         const rebindRefused = rebindRefusedOf(data.rebindRefused);
-        const returned = returnedOf(data.returned);
         this.lastBinding = {
           ref: data.ref,
           sha: data.sha,
@@ -16616,11 +16897,11 @@ function matchOf(typed, candidate) {
   const edits = editDistance(typed, candidate);
   return edits <= editBudget(typed) ? { kind: "edit", edits } : void 0;
 }
-function nearMatch(typed, candidates) {
+function nearMatch(typed, candidates2) {
   const needle = typed.toLowerCase();
-  if (candidates.some((c) => c.toLowerCase() === needle)) return {};
+  if (candidates2.some((c) => c.toLowerCase() === needle)) return {};
   const within = [];
-  for (const candidate of candidates) {
+  for (const candidate of candidates2) {
     const match = matchOf(needle, candidate.toLowerCase());
     if (match)
       within.push(match.kind === "edit" ? { candidate, edits: match.edits } : { candidate, extended: match.extended });
@@ -16747,12 +17028,12 @@ async function mintCore(scope, span) {
 function appJwt(credentials) {
   const now = Math.floor(systemClock() / 1e3);
   const header4 = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
-  const payload = b64url(JSON.stringify({ iat: now - 60, exp: now + 540, iss: credentials.appId.reveal() }));
+  const payload2 = b64url(JSON.stringify({ iat: now - 60, exp: now + 540, iss: credentials.appId.reveal() }));
   const signer = createSign("RSA-SHA256");
-  signer.update(`${header4}.${payload}`);
+  signer.update(`${header4}.${payload2}`);
   const pem = credentials.privateKey.reveal().replace(/\\n/g, "\n");
-  const signature = signer.sign(pem).toString("base64url");
-  return `${header4}.${payload}.${signature}`;
+  const signature2 = signer.sign(pem).toString("base64url");
+  return `${header4}.${payload2}.${signature2}`;
 }
 function b64url(s) {
   return Buffer.from(s).toString("base64url");
@@ -16987,11 +17268,11 @@ async function createBranchRef(repo, branch2, fromRef) {
   if (res.status === 422 && /already exists/i.test(text)) return;
   throw new Error(`branch create failed for ${branch2}: HTTP ${res.status} ${redactAndCap(text, 300)}`);
 }
-function resolveBaseRef(candidates, defaultBranch) {
-  return candidates.find((c) => c !== void 0) ?? defaultBranch;
+function resolveBaseRef(candidates2, defaultBranch) {
+  return candidates2.find((c) => c !== void 0) ?? defaultBranch;
 }
-async function resolveBaseRefLazy(candidates, repo, fetchInfo) {
-  const explicit = candidates.find((c) => c !== void 0);
+async function resolveBaseRefLazy(candidates2, repo, fetchInfo) {
+  const explicit = candidates2.find((c) => c !== void 0);
   if (explicit) return explicit;
   const info = await fetchInfo(repo).catch(() => void 0);
   return info?.defaultBranch;
@@ -17113,7 +17394,22 @@ async function fetchPullRequestFacts(pr) {
   const prSha = typeof data.head?.sha === "string" && /^[0-9a-f]{40}$/.test(data.head.sha) ? data.head.sha : void 0;
   const sameRepoHead = headRepo === pr.repo.toLowerCase();
   const headRef = typeof data.head?.ref === "string" && data.head.ref ? data.head.ref : void 0;
-  const sha = sameRepoHead && headRef !== void 0 ? preferRefTip(`${pr.repo}#${pr.number}`, prSha, await headRefTipSha(pr.repo, headRef, headers), headRef) : prSha;
+  const headBranchExists = sameRepoHead && headRef !== void 0 ? await fetchRefExists(pr.repo, headRef) : void 0;
+  const sha = sameRepoHead && headRef !== void 0 && headBranchExists !== false ? preferRefTip(`${pr.repo}#${pr.number}`, prSha, await headRefTipSha(pr.repo, headRef, headers), headRef) : prSha;
+  let closedBy = typeof data.closed_by?.login === "string" ? data.closed_by.login : void 0;
+  if (data.state === "closed" && !(typeof data.merged_at === "string" && data.merged_at) && closedBy === void 0) {
+    try {
+      const issue = await fetch(`https://api.github.com/repos/${pr.repo}/issues/${pr.number}`, {
+        headers,
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+      });
+      if (issue.ok) {
+        const row2 = await issue.json().catch(() => null);
+        if (typeof row2?.closed_by?.login === "string") closedBy = row2.closed_by.login;
+      }
+    } catch {
+    }
+  }
   return {
     state: data.state,
     ...data.user && (typeof data.user.login === "string" || typeof data.user.id === "number") ? {
@@ -17124,6 +17420,7 @@ async function fetchPullRequestFacts(pr) {
     } : {},
     ...headRef !== void 0 ? { headRef } : {},
     ...sha ? { headSha: sha } : {},
+    ...headBranchExists !== void 0 ? { headBranchExists } : {},
     sameRepoHead,
     ...typeof data.base?.ref === "string" && data.base.ref ? { baseRef: data.base.ref } : {},
     ...typeof data.html_url === "string" ? { htmlUrl: data.html_url } : {},
@@ -17136,8 +17433,10 @@ async function fetchPullRequestFacts(pr) {
     // reports a test-merge sha under `merge_commit_sha`.
     ...typeof data.merged_at === "string" && data.merged_at ? {
       mergedAt: data.merged_at,
-      ...typeof data.merge_commit_sha === "string" && /^[0-9a-f]{40}$/.test(data.merge_commit_sha) ? { mergeCommitSha: data.merge_commit_sha } : {}
-    } : {}
+      ...typeof data.merge_commit_sha === "string" && /^[0-9a-f]{40}$/.test(data.merge_commit_sha) ? { mergeCommitSha: data.merge_commit_sha } : {},
+      ...typeof data.merged_by?.login === "string" ? { mergedBy: data.merged_by.login } : {}
+    } : {},
+    ...closedBy !== void 0 ? { closedBy } : {}
   };
 }
 async function mergePullRequest(pr, opts) {
@@ -17439,6 +17738,56 @@ async function rerunFailedJobs(repo, sha, names) {
   }
   return true;
 }
+async function fetchDecisionRecordClaims(repo) {
+  const token2 = await requireToken();
+  const get = async (url, what) => {
+    const res = await fetch(url, { headers: apiHeaders(token2), signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      throw new Error(`${what} could not be read: HTTP ${res.status} ${redactAndCap(text, 300)}`);
+    }
+    return res.json().catch(() => null);
+  };
+  const numbers = /* @__PURE__ */ new Set();
+  const claim = (path) => {
+    if (typeof path !== "string") return;
+    const number = /^docs\/decisions\/(\d{4})-[^/]+\.md$/.exec(path)?.[1];
+    if (number !== void 0) numbers.add(number);
+  };
+  const main2 = await get(
+    `https://api.github.com/repos/${repo}/contents/docs/decisions?ref=main&per_page=1000`,
+    `origin/main's decision records in ${repo}`
+  );
+  if (!Array.isArray(main2))
+    throw new Error(`origin/main's decision records in ${repo} could not be read: malformed answer`);
+  for (const row2 of main2) claim(row2.path);
+  const pulls = [];
+  for (let page2 = 1; ; page2 += 1) {
+    const rows = await get(
+      `https://api.github.com/repos/${repo}/pulls?state=open&per_page=100&page=${page2}`,
+      `the open pull requests of ${repo}`
+    );
+    if (!Array.isArray(rows)) throw new Error(`the open pull requests of ${repo} could not be read: malformed answer`);
+    for (const row2 of rows)
+      if (typeof row2.number === "number" && Number.isInteger(row2.number) && row2.number > 0) pulls.push(row2.number);
+    if (rows.length < 100) break;
+  }
+  await Promise.all(
+    pulls.map(async (number) => {
+      for (let page2 = 1; ; page2 += 1) {
+        const rows = await get(
+          `https://api.github.com/repos/${repo}/pulls/${number}/files?per_page=100&page=${page2}`,
+          `the changed files of ${repo}#${number}`
+        );
+        if (!Array.isArray(rows))
+          throw new Error(`the changed files of ${repo}#${number} could not be read: malformed answer`);
+        for (const row2 of rows) claim(row2.filename);
+        if (rows.length < 100) break;
+      }
+    })
+  );
+  return numbers;
+}
 async function listOpenPullRequests(repo) {
   const token2 = await requireToken();
   const res = await fetch(`https://api.github.com/repos/${repo}/pulls?state=open&per_page=100`, {
@@ -18368,9 +18717,9 @@ function residentSlugsLister(cfg, secrets = processSecrets) {
 }
 async function nearOnboarded(cfg, typed) {
   const list = residentSlugsLister(cfg);
-  const candidates = await list?.().catch(() => void 0);
-  if (!candidates || candidates.length === 0) return void 0;
-  return nearMatch(typed, candidates).guess;
+  const candidates2 = await list?.().catch(() => void 0);
+  if (!candidates2 || candidates2.length === 0) return void 0;
+  return nearMatch(typed, candidates2).guess;
 }
 async function probeResident(cfg, token2, resource, span, stop) {
   if (probeOutage && systemClock() < probeOutage.until) {
@@ -20474,10 +20823,10 @@ var init_costs = __esm({
 
 // ../../src/core/costsBy.ts
 function coverageFrom(range, usage, generatedAt) {
-  const candidates = [range.from];
-  if (usage.earliestFinishedAt !== void 0) candidates.push(dayOfMs(usage.earliestFinishedAt));
-  if (usage.retentionDays > 0) candidates.push(dayOfMs(generatedAt - usage.retentionDays * DAY_MS));
-  const from = candidates.reduce((m, d) => d > m ? d : m);
+  const candidates2 = [range.from];
+  if (usage.earliestFinishedAt !== void 0) candidates2.push(dayOfMs(usage.earliestFinishedAt));
+  if (usage.retentionDays > 0) candidates2.push(dayOfMs(generatedAt - usage.retentionDays * DAY_MS));
+  const from = candidates2.reduce((m, d) => d > m ? d : m);
   return from > range.to ? range.to : from;
 }
 function slicesOf(cells, dimension) {
@@ -24728,10 +25077,10 @@ function clusterFriction(records, opts = {}) {
   const minRuns = opts.minRuns ?? DEFAULT_MIN_RUNS;
   const ordered = [...records].sort((a, b) => a.finishedAt - b.finishedAt || a.runId.localeCompare(b.runId));
   const acc = /* @__PURE__ */ new Map();
-  const add = (key, kind, signature, rec2, example, durationMs) => {
+  const add = (key, kind, signature2, rec2, example, durationMs) => {
     let a = acc.get(key);
     if (!a) {
-      a = { kind, signature, runIds: /* @__PURE__ */ new Set(), occurrences: 0, durationMs: 0, severity: "low", examples: [] };
+      a = { kind, signature: signature2, runIds: /* @__PURE__ */ new Set(), occurrences: 0, durationMs: 0, severity: "low", examples: [] };
       acc.set(key, a);
     }
     a.runIds.add(rec2.runId);
@@ -25057,10 +25406,10 @@ function parseRunEventLines(text) {
   for (const raw of text.split("\n")) {
     const line4 = raw.trim();
     if (line4 === "" || line4.startsWith(":") || /^(retry|event|id):/.test(line4)) continue;
-    const payload = line4.startsWith("data:") ? line4.slice("data:".length).trim() : line4;
+    const payload2 = line4.startsWith("data:") ? line4.slice("data:".length).trim() : line4;
     let parsed;
     try {
-      parsed = JSON.parse(payload);
+      parsed = JSON.parse(payload2);
     } catch {
       skipped++;
       continue;
@@ -26295,9 +26644,9 @@ function wellKnownCandidates(base, suffix) {
 async function discover(fetchImpl, serverUrl2, hintedMetadataUrl) {
   const server = assertUrlAllowed(serverUrl2);
   const resource = `${server.origin}${server.pathname.replace(/\/+$/, "")}`;
-  const candidates = [...hintedMetadataUrl ? [hintedMetadataUrl] : [], ...wellKnownCandidates(server, PRM_SUFFIX)];
+  const candidates2 = [...hintedMetadataUrl ? [hintedMetadataUrl] : [], ...wellKnownCandidates(server, PRM_SUFFIX)];
   let prm;
-  for (const url of candidates) {
+  for (const url of candidates2) {
     prm = await getJson(fetchImpl, url, "resource metadata");
     if (prm) break;
   }
@@ -28813,24 +29162,24 @@ function parseReflection(raw, prov, knownIds) {
   const parsed = REFLECTION_ENVELOPE.parse(raw);
   if (!parsed.ok) return { ok: false, error: parsed.failure.observed };
   const obj2 = parsed.value;
-  const candidates = [];
+  const candidates2 = [];
   let rejected = 0;
   for (const f of obj2.facts) {
-    if (candidates.length >= MAX_REFLECTION_FACTS) break;
+    if (candidates2.length >= MAX_REFLECTION_FACTS) break;
     const fact = parseFact(f, prov, knownIds);
     if (!fact) continue;
     if (rejectionMarkers(fact.text).length > 0) {
       rejected += 1;
       continue;
     }
-    candidates.push(fact);
+    candidates2.push(fact);
   }
   const summary = cleanText(obj2.summary);
   if (summary) {
-    const audience = SUMMARY_INHERITANCE.find((a) => candidates.some((c) => c.audience === a)) ?? "org";
-    candidates.push({ kind: "summary", text: summary, audience, ...prov });
+    const audience = SUMMARY_INHERITANCE.find((a) => candidates2.some((c) => c.audience === a)) ?? "org";
+    candidates2.push({ kind: "summary", text: summary, audience, ...prov });
   }
-  return { ok: true, candidates, offered: obj2.facts.length, rejected };
+  return { ok: true, candidates: candidates2, offered: obj2.facts.length, rejected };
 }
 function parseFact(raw, prov, knownIds) {
   if (typeof raw !== "object" || raw === null) return void 0;
@@ -28939,14 +29288,21 @@ async function reflect(deps) {
     const seen = /* @__PURE__ */ new Set();
     const existing = [...await windowP, ...hits].filter((r) => !seen.has(r.id) && (seen.add(r.id), true));
     const text = buildReflectionInput({ history: deps.history, request: deps.request, answer: deps.answer, existing });
-    const result = await deps.provider.complete({
-      model: deps.model,
-      system: REFLECTION_SYSTEM,
-      messages: [{ role: "user", content: [{ type: "text", text }] }],
-      maxTokens: REFLECTION_MAX_TOKENS,
-      ...deps.effort !== void 0 ? { effort: deps.effort } : {},
-      ...deps.effortWord !== void 0 ? { effortWord: deps.effortWord } : {}
-    });
+    let result;
+    try {
+      result = await deps.provider.complete({
+        model: deps.model,
+        system: REFLECTION_SYSTEM,
+        messages: [{ role: "user", content: [{ type: "text", text }] }],
+        maxTokens: REFLECTION_MAX_TOKENS,
+        ...deps.effort !== void 0 ? { effort: deps.effort } : {},
+        ...deps.effortWord !== void 0 ? { effortWord: deps.effortWord } : {}
+      });
+    } catch (err2) {
+      const failure2 = providerFailureOf(err2);
+      warn(`reflection skipped: ${renderProviderFailure(failure2.cause)}`);
+      return;
+    }
     const reply = result.content.filter((p) => p.type === "text").map((p) => p.text).join("");
     const prov = { sourceThreadKey: deps.sourceThreadKey, sourceRunId: deps.sourceRunId };
     const parsed = parseReflection(reply, prov, new Set(existing.map((r) => r.id)));
@@ -29020,6 +29376,7 @@ var REFLECT_MIN_TURNS, MAX_REFLECTION_FACTS, MIN_REFLECTION_CONFIDENCE, MAX_KEYW
 var init_reflection = __esm({
   "../../src/core/memory/reflection.ts"() {
     "use strict";
+    init_provider();
     init_authz();
     init_runEvents();
     init_llmOutput();
@@ -31344,6 +31701,7 @@ function assembleRunRecord(input) {
   const route2 = input.route ?? routeOfEvents(events);
   const operator = operatorOfEvents(events);
   const instanceId = instanceIdOfEvents(events);
+  const decisionRecord = decisionRecordOfEvents(events);
   const pipeline = input.pipeline ?? pipelineOfEvents(events);
   const fitted = fitRecordToBudget({
     id: run2.id,
@@ -31380,6 +31738,7 @@ function assembleRunRecord(input) {
     ...referencesOfEvents(events).length > 0 ? { references: referencesOfEvents(events) } : {},
     ...msg.sourceUrl !== void 0 ? { sourceUrl: msg.sourceUrl } : {},
     ...msg.userName !== void 0 ? { userName: msg.userName } : {},
+    ...input.headSha !== void 0 ? { headSha: input.headSha } : {},
     ...input.handoff !== void 0 ? { handoff: redactHandoff(input.handoff) } : {},
     ...input.verdict !== void 0 ? { verdict: redactVerdict(input.verdict) } : {},
     ...input.reviewHead !== void 0 ? { reviewHead: input.reviewHead } : {},
@@ -31391,6 +31750,7 @@ function assembleRunRecord(input) {
     ...input.parentRunId !== void 0 ? { parentRunId: input.parentRunId } : {},
     ...coordinatorFields(input.coordinator),
     ...instanceId !== void 0 ? { instanceId } : {},
+    ...decisionRecord !== void 0 ? decisionRecord : {},
     ...pipeline !== void 0 ? { pipeline } : {},
     ...input.hosted ? { hosted: true } : {},
     ...input.seed !== void 0 ? { seed: input.seed } : {},
@@ -31475,6 +31835,7 @@ function registerFinishRecord(deps, ctx) {
     diagnosis,
     root,
     ledgerRun,
+    headSha,
     handoff,
     verdict,
     reviewHead,
@@ -31503,6 +31864,7 @@ function registerFinishRecord(deps, ctx) {
         status: failedAfterFinish && status3 === "completed" ? "failed" : status3,
         diagnosis,
         seal,
+        ...headSha !== void 0 ? { headSha } : {},
         ...handoff !== void 0 ? { handoff } : {},
         ...verdict !== void 0 ? { verdict } : {},
         ...reviewHead !== void 0 ? { reviewHead } : {},
@@ -31845,6 +32207,7 @@ function createRunsService(deps) {
     }
     if (!row2) return {};
     return {
+      ...row2.headSha !== void 0 ? { headSha: row2.headSha } : {},
       ...row2.verdict !== void 0 ? { verdict: row2.verdict } : {},
       ...row2.reviewHead !== void 0 ? { reviewHead: row2.reviewHead } : {},
       ...row2.reviewPost !== void 0 ? { reviewPost: row2.reviewPost } : {},
@@ -33509,6 +33872,9 @@ var init_instanceStore = __esm({
       async listUnits(_instanceId) {
         return [];
       }
+      async reserveDecisionRecord(_repo, _taskKey, _claimed, _existing) {
+        return { ok: false, reason: "unavailable" };
+      }
       async markStopped(_instanceId, _at) {
         return { ok: false, reason: "unavailable" };
       }
@@ -33584,6 +33950,17 @@ var init_instanceStore = __esm({
           throw new Error("coordinator store /runs/coordinator/units/list: the answer is not a list of unit rows");
         return d.units;
       }
+      async reserveDecisionRecord(repo, taskKey, claimed2, existing) {
+        const r = await this.post("/runs/decision-record/reserve", {
+          repo,
+          taskKey,
+          claimed: [...claimed2],
+          ...existing !== void 0 ? { existing } : {}
+        });
+        const d = r.data;
+        if (typeof d.number === "string" && /^\d{4}$/.test(d.number)) return { ok: true, number: d.number };
+        throw new Error(`coordinator store /runs/decision-record/reserve: unexpected answer (HTTP ${r.status})`);
+      }
       async markStopped(instanceId, at) {
         const r = await this.post("/runs/coordinator/stop", { instanceId, at });
         const d = r.data;
@@ -33625,12 +34002,13 @@ var init_instanceStore = __esm({
 function isIntakeReceipt(v) {
   if (typeof v !== "object" || v === null) return false;
   const r = v;
-  return (r.verdict === "addressed" || r.verdict === "silent") && typeof r.reason === "string" && (r.source === "model" || r.source === "mode" || r.source === "question" || r.source === "error" || r.source === "timeout") && (r.mode === "mention" || r.mode === "classify") && typeof r.model === "string" && typeof r.gen === "number" && Number.isFinite(r.gen) && typeof r.threadKey === "string" && r.threadKey.length > 0 && r.threadKey.length <= 256 && typeof r.decidedAt === "number" && Number.isFinite(r.decidedAt);
+  return (r.verdict === "addressed" || r.verdict === "silent") && typeof r.reason === "string" && (r.source === "model" || r.source === "mode" || r.source === "question" || r.source === "error" || r.source === "timeout") && (r.providerFailure === void 0 || typeof r.providerFailure === "string" && PROVIDER_FAILURE_CAUSES.includes(r.providerFailure)) && (r.mode === "mention" || r.mode === "classify") && typeof r.model === "string" && typeof r.gen === "number" && Number.isFinite(r.gen) && typeof r.threadKey === "string" && r.threadKey.length > 0 && r.threadKey.length <= 256 && typeof r.decidedAt === "number" && Number.isFinite(r.decidedAt);
 }
 var LEASE_MS, HEARTBEAT_MS, APPEND_FLUSH_MS, APPEND_FLUSH_EVENTS, TRANSCRIPT_REQUEST_BYTES, TRANSCRIPT_PART_BYTES, ATTACHMENT_REF_BYTES, GEN_PATTERN;
 var init_types4 = __esm({
   "../../src/core/runLedger/types.ts"() {
     "use strict";
+    init_provider();
     LEASE_MS = 3e4;
     HEARTBEAT_MS = 1e4;
     APPEND_FLUSH_MS = 500;
@@ -34125,6 +34503,23 @@ var init_runLedgerWorker = __esm({
         const r = await this.post("/runs/intake/read", { storeKey: this.opts.storeKey, key });
         return isIntakeReceipt(r.data.receipt) ? r.data.receipt : void 0;
       }
+      async claimIntakeDelivery(key, poster, claimedAt) {
+        const r = await this.post("/runs/intake/delivery/claim", {
+          storeKey: this.opts.storeKey,
+          key,
+          poster,
+          claimedAt
+        });
+        return r.data.claimed === true;
+      }
+      async finishIntakeDelivery(key, poster, delivered) {
+        await this.post("/runs/intake/delivery/finish", {
+          storeKey: this.opts.storeKey,
+          key,
+          poster,
+          delivered
+        });
+      }
       async listIntake(query) {
         const r = await this.post("/runs/intake/list", {
           storeKey: this.opts.storeKey,
@@ -34924,13 +35319,13 @@ var init_confirmations = __esm({
       describe() {
         return `state Worker ${this.baseUrl} (ConfigDO confirmations)`;
       }
-      async post(path, payload) {
+      async post(path, payload2) {
         let res;
         try {
           res = await this.fetchImpl(`${this.baseUrl}${path}`, {
             method: "POST",
             headers: { authorization: `Bearer ${this.opts.token}`, "content-type": "application/json" },
-            body: JSON.stringify(payload),
+            body: JSON.stringify(payload2),
             signal: AbortSignal.timeout(CONFIRMATION_WORKER_TIMEOUT_MS)
           });
         } catch (err2) {
@@ -35692,7 +36087,7 @@ async function openPrHeadSha(pr) {
 }
 async function currentPrHeadSha(pr) {
   const head = await prHead(pr).catch(() => void 0);
-  return head?.sha;
+  return head?.state === "open" ? head.sha : void 0;
 }
 async function prCommitsSince(input) {
   const sha = normalizeHead(input.sha);
@@ -36312,6 +36707,20 @@ async function runReviewPostStep(input) {
       postTarget = null;
     }
   }
+  if (input.guardTransition === true && postTarget && reviewHead) {
+    const where = `${postTarget.repo}#${postTarget.number}`;
+    const pinned = carried?.current ?? reviewHead;
+    const facts2 = await input.fetchPrFacts({ repo: postTarget.repo, number: postTarget.number }).catch(() => void 0);
+    const current = facts2?.state === "open" && facts2.headBranchExists === true ? normalizeHead(facts2.headSha) : void 0;
+    if (current === void 0 || !sameCommit(current, pinned)) {
+      const reason2 = current === void 0 ? "the pull request is no longer open at a readable head" : `the PR head moved to ${current.slice(0, 7)} after the review of ${pinned.slice(0, 7)}`;
+      console.log(`[review-post] ${logKey} skipped: ${reason2} (${where})`);
+      await input.reply(`\u2139\uFE0F Review not posted to ${where}: ${reason2} \u2014 this verdict is Slack-only.`).catch(() => {
+      });
+      skipReason = reason2;
+      postTarget = null;
+    }
+  }
   if (postTarget && reviewHead) {
     const pinned = carried?.current ?? reviewHead;
     const target = { ...postTarget, commitId: pinned };
@@ -36452,9 +36861,9 @@ function correctedMessage(msg, slug, match) {
 }
 async function onboardedGuess(deps, msg, slug) {
   const list = deps.residentSlugs ?? residentSlugsLister(deps.config.config.execution?.resident);
-  const candidates = await list?.().catch(() => void 0);
-  if (!candidates || candidates.length === 0) return void 0;
-  const near = nearMatch(slug, candidates);
+  const candidates2 = await list?.().catch(() => void 0);
+  if (!candidates2 || candidates2.length === 0) return void 0;
+  const near = nearMatch(slug, candidates2);
   if (!near.guess) return void 0;
   const proposal = correctedMessage(msg, slug, near.guess);
   if (!proposal) return void 0;
@@ -37766,6 +38175,12 @@ var init_statusCardFrame = __esm({
 });
 
 // ../../src/core/dispatch/route.ts
+function outputCapWithReasoning(visibleAnswerTokens, opts = {}) {
+  return opts.capField !== void 0 && REASONING_COUNTING_CAP_FIELDS.has(opts.capField) ? visibleAnswerTokens + REASONING_OUTPUT_TOKEN_ALLOWANCE : visibleAnswerTokens;
+}
+function outputCapRetry(current) {
+  return Math.max(current * 2, REASONING_OUTPUT_TOKEN_ALLOWANCE);
+}
 function routedRunsAtOnce(def, confirm, input) {
   const radius = input === void 0 ? blastRadius(def) : boundBlastRadius(def, input);
   return radius === "read" || CONFIRM_ORDER[radius] < CONFIRM_ORDER[confirm];
@@ -37827,7 +38242,7 @@ function providerStructuredModel(provider, model, opts = {}) {
       ...opts.effort ? { effort: opts.effort.effort, effortWord: opts.effort.effortWord } : {},
       ...forced ? { tools, toolChoice } : {}
     });
-    if (result.stopReason === "max_tokens") throw new Error(`answer cut at the output cap (${call2.maxTokens} tokens)`);
+    if (result.stopReason === "max_tokens") throw new OutputCapError(call2.maxTokens);
     const calls = result.content.filter(
       (p) => p.type === "tool_use"
     );
@@ -37873,13 +38288,13 @@ function redactedInput(input) {
     return v === void 0 ? null : text(JSON.stringify(v) ?? String(v));
   };
   const leafOrList = (v) => Array.isArray(v) ? v.map(leaf) : leaf(v);
-  const isRecord10 = (v) => typeof v === "object" && v !== null && (Object.getPrototypeOf(v) === Object.prototype || Object.getPrototypeOf(v) === null);
+  const isRecord11 = (v) => typeof v === "object" && v !== null && (Object.getPrototypeOf(v) === Object.prototype || Object.getPrototypeOf(v) === null);
   const entries = (v, of) => Object.fromEntries(
     Object.entries(v).filter(([, x]) => x !== void 0).map(([k, x]) => [k, of(x)])
   );
   const object1 = (v) => entries(v, leafOrList);
-  const object2 = (v) => entries(v, (x) => isRecord10(x) ? object1(x) : leafOrList(x));
-  const object3 = (v) => entries(v, (x) => isRecord10(x) ? object2(x) : leafOrList(x));
+  const object2 = (v) => entries(v, (x) => isRecord11(x) ? object1(x) : leafOrList(x));
+  const object3 = (v) => entries(v, (x) => isRecord11(x) ? object2(x) : leafOrList(x));
   return {
     ...input.args ? { args: input.args.map(leaf) } : {},
     ...input.options ? { options: object3(input.options) } : {}
@@ -37902,7 +38317,7 @@ function compoundBrief(text, parts) {
     ...parts.map((p, i) => `${i + 1}. \`${p.preset}\`: ${p.text}`)
   ].join("\n");
 }
-var ROUTE_REASON_CAP, ROUTE_MIN_OUTPUT_TOKENS, ROUTE_TIMEOUT_MS, ROUTE_PART_LINE_CAP, ROUTE_RECEIPT_CAP, ROUTED_RECEIPT_PREFIX, COMPOUND_BRIEF_HEADING, MultiToolCallError;
+var REASONING_COUNTING_CAP_FIELDS, REASONING_OUTPUT_TOKEN_ALLOWANCE, OutputCapError, ROUTE_REASON_CAP, ROUTE_MIN_OUTPUT_TOKENS, ROUTE_TIMEOUT_MS, ROUTE_PART_LINE_CAP, ROUTE_RECEIPT_CAP, ROUTED_RECEIPT_PREFIX, COMPOUND_BRIEF_HEADING, MultiToolCallError;
 var init_route = __esm({
   "../../src/core/dispatch/route.ts"() {
     "use strict";
@@ -37915,6 +38330,16 @@ var init_route = __esm({
     init_commandSurface();
     init_budgets();
     init_confirmations();
+    REASONING_COUNTING_CAP_FIELDS = /* @__PURE__ */ new Set(["max_tokens", "max_completion_tokens", "max_output_tokens"]);
+    REASONING_OUTPUT_TOKEN_ALLOWANCE = 4096;
+    OutputCapError = class extends Error {
+      constructor(maxTokens) {
+        super(`answer cut at the output cap (${maxTokens} tokens)`);
+        this.maxTokens = maxTokens;
+        this.name = "OutputCapError";
+      }
+      maxTokens;
+    };
     ROUTE_REASON_CAP = 120;
     ROUTE_MIN_OUTPUT_TOKENS = 200;
     ROUTE_TIMEOUT_MS = 8e3;
@@ -39421,11 +39846,12 @@ function resolveTarget2(deps, ctx) {
       )
     );
   }
-  if (modelCard.wire === "openai-responses" && (resolved.harness?.name ?? DEFAULT_HARNESS) === "opencode") {
+  const harnessName = resolved.harness?.name ?? DEFAULT_HARNESS;
+  if (modelCard.wire === "openai-responses" && harnessName === "opencode") {
     throw new RefusalError(
       refusalOf(
         "model_card_refused",
-        `Model "${resolved.modelRef}" speaks the openai-responses wire, which the "opencode" harness cannot speak yet; this request needs the pi harness or an openai-chat block.`
+        `The "${harnessName}" harness cannot start model "${resolved.modelRef}" from provider "${providerName}": it cannot speak the "${modelCard.wire}" wire; this request needs the pi harness or an openai-chat block.`
       )
     );
   }
@@ -40390,14 +40816,20 @@ function renderOperatorQuestion(decision) {
 ${OPERATOR_QUESTION_MARKER}
 \`${decision.proposal}\`` : decision.text;
 }
-function operatorMaxOutputTokens() {
+function operatorMaxOutputTokens(opts = {}) {
   const chars = 2 * (ROUTE_RECEIPT_CAP + ROUTE_REASON_CAP + 40) + ROUTE_REASON_CAP + 80;
-  return Math.ceil(chars / 3);
+  return outputCapWithReasoning(Math.ceil(chars / 3), opts);
+}
+function promptWithoutTool(prompt, omitted) {
+  const kept = [prompt.tool, ...prompt.tools ?? []].filter((candidate) => candidate.name !== omitted);
+  const [tool, ...tools] = kept;
+  if (tool === void 0) return void 0;
+  return { ...prompt, tool, tools: tools.length > 0 ? tools : void 0 };
 }
 async function runOperator(input, model, opts = {}) {
   const now = opts.now ?? Date.now;
   const started = now();
-  const prompt = buildOperatorPrompt(input);
+  let prompt = buildOperatorPrompt(input);
   const ctx = {
     requestText: input.text,
     presets: input.projection.presets.map((p) => p.name),
@@ -40412,31 +40844,66 @@ async function runOperator(input, model, opts = {}) {
   };
   let chars = 0;
   const attempts = [];
-  const answered = (decision) => ({
+  const answered = (decision, operatorDiagnostic) => ({
     decision,
     latencyMs: now() - started,
     outputTokens: Math.ceil(chars / 3),
+    ...operatorDiagnostic !== void 0 ? { operatorDiagnostic } : {},
     ...attempts.length > 0 ? { attempts } : {}
   });
   const turns = [];
   let reads = 0;
   let violations = 0;
+  let schemaReasks = 0;
   let noCallTurns = 0;
-  const generalFloor = () => {
-    const floor = parseOperatorTurn(
-      { tool: OPERATOR_BIND_TOOL, input: { preset: "general", reason: "no_decision" } },
-      ctx
-    );
-    return floor.kind === "decision" ? floor.decision : { kind: "non_decision", reason: "no_decision" };
+  let outputCapCuts = 0;
+  let maxOutputTokens = opts.maxOutputTokens ?? operatorMaxOutputTokens();
+  const generalFloor = (reason2 = "no_decision") => {
+    const floor = parseOperatorTurn({ tool: OPERATOR_BIND_TOOL, input: { preset: "general", reason: reason2 } }, ctx);
+    return floor.kind === "decision" ? floor.decision : { kind: "non_decision", reason: reason2 };
   };
   const signal2 = AbortSignal.timeout(opts.timeoutMs ?? OPERATOR_TIMEOUT_MS);
   try {
     for (; ; ) {
       let answer;
       try {
-        answer = await model({ ...prompt, retries: turns }, { maxTokens: operatorMaxOutputTokens(), signal: signal2 });
+        answer = await model({ ...prompt, retries: turns }, { maxTokens: maxOutputTokens, signal: signal2 });
       } catch (err2) {
-        if (!(err2 instanceof MultiToolCallError)) throw err2;
+        if (err2 instanceof OutputCapError) {
+          const violation2 = err2.message;
+          attempts.push({ outcome: "violation", violation: violation2 });
+          if (outputCapCuts++ === 0) {
+            turns.push({ answer: "", violation: `${violation2}; retry with the larger output allowance` });
+            maxOutputTokens = outputCapRetry(maxOutputTokens);
+            continue;
+          }
+          return answered(generalFloor("output_cap"));
+        }
+        if (!(err2 instanceof MultiToolCallError)) {
+          const carried = attemptsOfThrow(err2);
+          if (carried) attempts.push(...carried);
+          const failure2 = providerFailureOf(err2);
+          const rejected = failure2.cause === "request-rejected" && failure2.status === 400 ? failure2.schemaRejection : void 0;
+          const offered = rejected !== void 0 && [prompt.tool, ...prompt.tools ?? []].some((candidate) => candidate.name === rejected.tool);
+          const retry = offered && rejected !== void 0 && schemaReasks < OPERATOR_SCHEMA_REASKS_MAX ? promptWithoutTool(prompt, rejected.tool) : void 0;
+          if (rejected !== void 0 && retry !== void 0) {
+            const violation2 = `provider rejected tool "${rejected.tool}" schema keyword "${rejected.keyword}"; re-asked without that tool`;
+            attempts.push({ outcome: "violation", violation: violation2 });
+            schemaReasks++;
+            prompt = retry;
+            continue;
+          }
+          return answered(
+            {
+              kind: "refusal",
+              cause: "provider",
+              providerFailure: failure2.cause,
+              reason: failure2.cause,
+              text: renderProviderFailure(failure2.cause, "ended")
+            },
+            failure2.message
+          );
+        }
         const calls = JSON.stringify(err2.calls);
         chars += calls.length;
         const violation = `the answer carried ${err2.calls.length} tool calls; one tool call per turn`;
@@ -40517,6 +40984,7 @@ function operatorEventOf(mode, answer, intake) {
     ...d.kind === "question" ? { question: renderOperatorQuestion(d) } : {},
     ...d.kind === "question" && d.proposal !== void 0 ? { proposal: d.proposal } : {},
     ...d.kind === "refusal" ? { refusalCause: d.cause, refusalText: d.text } : {},
+    ...d.kind === "refusal" && d.cause === "provider" ? { providerFailure: d.providerFailure } : {},
     ...answer.attempts ? { attempts: answer.attempts } : {},
     ...intake ? { intake: { verdict: intake.verdict, reason: intake.reason } } : {},
     latencyMs: answer.latencyMs,
@@ -40558,6 +41026,7 @@ async function operatorStage(deps, ctx) {
   const { msg, mode } = ctx;
   const cfg = deps.config.config;
   let model = deps.operatorModel;
+  let maxOutputTokens;
   if (!model) {
     const modelRef3 = cfg.defaults.models["general"];
     if (!modelRef3 || !deps.completions) {
@@ -40568,6 +41037,8 @@ async function operatorStage(deps, ctx) {
       const ref = parseModelRef(modelRef3);
       const effort2 = turnEffort(modelRef3, cfg.defaults.efforts?.["general"], cfg.providers);
       if (effort2.note) console.log(`[operator] ${msg.threadKey} effort: ${effort2.note}`);
+      const card = resolveModelCard(modelRef3, cfg.providers, installedModelRegistry);
+      maxOutputTokens = operatorMaxOutputTokens({ capField: card.capField });
       model = providerStructuredModel(deps.completions.get(ref.provider), ref.model, {
         ...effort2.request ? { effort: effort2.request } : {}
       });
@@ -40605,8 +41076,11 @@ async function operatorStage(deps, ctx) {
       ...pending2 ? { pendingQuestion: pending2.proposal !== void 0 ? { proposal: pending2.proposal } : {} } : {},
       ...ctx.owner ? { owner: ctx.owner } : {}
     },
-    model
+    model,
+    maxOutputTokens !== void 0 ? { maxOutputTokens } : {}
   );
+  if (answer.operatorDiagnostic !== void 0)
+    console.log(`[operator] ${msg.threadKey} provider refusal: ${answer.operatorDiagnostic}`);
   const event = operatorEventOf(mode, answer, ctx.intake);
   return event.outcome === "question" ? { ...event, request: redactAndCap(oneLine(msg.text), OPERATOR_REQUEST_CAP) } : event;
 }
@@ -40637,6 +41111,12 @@ async function executeOperatorDecision(deps, ctx) {
     await recordOperatorDecision(deps, msg, event, ctx.ending, ctx.trace);
     return answered;
   }
+  if (event.providerFailure !== void 0) {
+    io.requestFailed?.();
+    await io.reply(event.refusalText ?? renderProviderFailure(event.providerFailure, "ended"));
+    await recordOperatorDecision(deps, msg, event, ctx.ending, ctx.trace);
+    return answered;
+  }
   if (ctx.owner !== void 0 && !ownedDecisionRuns(event, ctx.owner, deps.commands)) {
     const confirmed = (event.binds ?? []).find((b) => b.confirmed);
     const request2 = confirmed !== void 0 ? presetBindOf(
@@ -40735,7 +41215,7 @@ async function executeOperatorDecision(deps, ctx) {
   if (!carried) await recordOperatorDecision(deps, msg, event, ctx.ending, ctx.trace);
   return answered;
 }
-var OPERATOR_BIND_TOOL, OPERATOR_ASK_TOOL, OPERATOR_READ_TOOLS, OPERATOR_READS_MAX, OPERATOR_TIMEOUT_MS, OPERATOR_QUESTION_MARKER, OPERATOR_REQUEST_CAP;
+var OPERATOR_BIND_TOOL, OPERATOR_ASK_TOOL, OPERATOR_READ_TOOLS, OPERATOR_READS_MAX, OPERATOR_SCHEMA_REASKS_MAX, OPERATOR_TIMEOUT_MS, OPERATOR_QUESTION_MARKER, OPERATOR_REQUEST_CAP;
 var init_operator = __esm({
   "../../src/core/dispatch/operator.ts"() {
     "use strict";
@@ -40761,6 +41241,8 @@ var init_operator = __esm({
     init_seed();
     init_turnEffort();
     init_thread();
+    init_modelCard();
+    init_installedModelRegistry();
     init_route();
     OPERATOR_BIND_TOOL = "bind_preset";
     OPERATOR_ASK_TOOL = "ask";
@@ -40774,6 +41256,7 @@ var init_operator = __esm({
       providerModels: "provider_models"
     };
     OPERATOR_READS_MAX = 4;
+    OPERATOR_SCHEMA_REASKS_MAX = 4;
     OPERATOR_TIMEOUT_MS = 2e4;
     OPERATOR_QUESTION_MARKER = "Did you mean:";
     OPERATOR_REQUEST_CAP = 600;
@@ -41406,6 +41889,8 @@ async function registerRun(deps, ctx) {
     seed,
     seedTurns,
     agentSource,
+    decisionRecord,
+    decisionRecordTask,
     modelCard,
     cardDecisions,
     route: route2
@@ -41504,6 +41989,8 @@ async function registerRun(deps, ctx) {
     agent: agent.name,
     agentSource,
     model: resolved.modelRef,
+    ...decisionRecord !== void 0 ? { record: decisionRecord } : {},
+    ...decisionRecordTask !== void 0 ? { recordTaskKey: decisionRecordTask } : {},
     traceId: root.traceId,
     // The harness the run is driven by (harness.md items 8 and 10): the
     // object the scopes' word for the preset picks off the roster — the
@@ -41570,6 +42057,8 @@ async function reserveRun(deps, ctx) {
     parentRunId,
     coordinator,
     seed,
+    decisionRecord,
+    decisionRecordTask,
     route: route2
   } = ctx;
   if (!resume && !restart) {
@@ -41593,6 +42082,8 @@ async function reserveRun(deps, ctx) {
           ...msg.authenticatedAs !== void 0 ? { authenticatedAs: msg.authenticatedAs } : {},
           ...msg.postedBy !== void 0 ? { postedBy: msg.postedBy } : {},
           ...resolved.effort !== void 0 ? { effort: resolved.effort } : {},
+          ...decisionRecord !== void 0 ? { record: decisionRecord } : {},
+          ...decisionRecordTask !== void 0 ? { recordTaskKey: decisionRecordTask } : {},
           ...repoCtx.ref !== void 0 ? { ref: repoCtx.ref } : {},
           ...repoCtx.headSha !== void 0 ? { headSha: repoCtx.headSha } : {},
           ...repoCtx.pr !== void 0 ? { pr: repoCtx.pr } : {},
@@ -42149,13 +42640,13 @@ function unquotePath(raw) {
 }
 function riskReasons(entry, paths) {
   const reasons = [];
-  const candidates = [...new Set(paths.filter(Boolean))];
-  const any = (re) => candidates.some((p) => re.test(p));
+  const candidates2 = [...new Set(paths.filter(Boolean))];
+  const any = (re) => candidates2.some((p) => re.test(p));
   if (any(MIGRATION_RE)) reasons.push("migration/schema");
   if (any(AUTH_RE)) reasons.push("auth/permission-sensitive");
   if (any(INFRA_RE)) reasons.push("infra/deploy config");
   if (entry.status === "deleted") reasons.push("whole-file deletion");
-  if (candidates.some((p) => LOCKFILES.has(basename2(p).toLowerCase()))) reasons.push("lockfile");
+  if (candidates2.some((p) => LOCKFILES.has(basename2(p).toLowerCase()))) reasons.push("lockfile");
   const churn = entry.adds + entry.dels;
   if (churn >= LARGE_CHURN) reasons.push(`large change (${churn} lines)`);
   return reasons;
@@ -45202,6 +45693,103 @@ var init_run2 = __esm({
   }
 });
 
+// ../../src/core/decisionRecordReservation.ts
+function asksForDecisionRecord(text) {
+  const marker = RECORD_MARKER.exec(text)?.[1]?.toLowerCase();
+  if (marker !== void 0) return marker === "write" || marker === "yes" || marker === "true";
+  for (const instruction of text.matchAll(POSITIVE_RECORD_INSTRUCTION)) {
+    const sentenceStart = Math.max(
+      text.lastIndexOf("\n", instruction.index),
+      text.lastIndexOf(".", instruction.index),
+      text.lastIndexOf("!", instruction.index),
+      text.lastIndexOf("?", instruction.index),
+      text.lastIndexOf(";", instruction.index)
+    );
+    const beforeVerb = text.slice(sentenceStart + 1, instruction.index);
+    if (!NEGATED_INSTRUCTION.test(beforeVerb)) return true;
+  }
+  return false;
+}
+function decisionRecordTaskKey(...parts) {
+  let hash = 0xcbf29ce484222325n;
+  for (const byte of new TextEncoder().encode(parts.join("\n"))) {
+    hash ^= BigInt(byte);
+    hash = BigInt.asUintN(64, hash * 0x100000001b3n);
+  }
+  return hash.toString(16).padStart(16, "0");
+}
+var DECISION_RECORD_ENV, RECORD_MARKER, POSITIVE_RECORD_INSTRUCTION, NEGATED_INSTRUCTION, DECISION_RECORD_STORE_REFUSAL, DecisionRecordReservationUnavailableError, DecisionRecordAllocator;
+var init_decisionRecordReservation = __esm({
+  "../../src/core/decisionRecordReservation.ts"() {
+    "use strict";
+    DECISION_RECORD_ENV = "SWITCHBOARD_DECISION_RECORD";
+    RECORD_MARKER = /(?:^|\n)\s*(?:-\s*)?(?:\*\*)?(?:decision[- ]record|record)(?:\*\*)?\s*:\s*(write|yes|true|none|no|false)\b/im;
+    POSITIVE_RECORD_INSTRUCTION = /\b(?:write|draft|create|add|author|produce|document)\b[^\n.!?;]{0,160}\b(?:technical\s+|architectural\s+|architecture\s+)?decision[- ]record\b/gi;
+    NEGATED_INSTRUCTION = /(?:\b(?:do|does|did|must|should|will|can)\s+not(?:\s+\w+){0,3}|\b(?:don't|doesn't|didn't|mustn't|shouldn't|won't|can't)(?:\s+\w+){0,3}|\b(?:never|not|without)(?:\s+\w+){0,3})\s*$/i;
+    DECISION_RECORD_STORE_REFUSAL = "\u26A0\uFE0F A record-writing task needs the durable coordinator store on the state Worker (`runHistory.worker`), but that store is unavailable, so no number was issued and nothing ran.";
+    DecisionRecordReservationUnavailableError = class extends Error {
+      constructor() {
+        super("the durable coordinator store is unavailable");
+        this.name = "DecisionRecordReservationUnavailableError";
+      }
+    };
+    DecisionRecordAllocator = class {
+      constructor(claims, durable) {
+        this.claims = claims;
+        this.durable = durable;
+      }
+      claims;
+      durable;
+      byTask = /* @__PURE__ */ new Map();
+      claimed = /* @__PURE__ */ new Map();
+      tails = /* @__PURE__ */ new Map();
+      async reserve(repo, taskKey, existing) {
+        const cacheKey = `${repo}
+${taskKey}`;
+        const cached = this.byTask.get(cacheKey);
+        if (cached !== void 0) return cached;
+        const previous = this.tails.get(repo) ?? Promise.resolve();
+        let release;
+        const tail = new Promise((resolve13) => {
+          release = resolve13;
+        });
+        const queued = previous.then(() => tail);
+        this.tails.set(repo, queued);
+        await previous;
+        try {
+          const repeated = this.byTask.get(cacheKey);
+          if (repeated !== void 0) return repeated;
+          const used = new Set(await this.claims(repo));
+          for (const number2 of this.claimedFor(repo)) used.add(number2);
+          const prior = existing;
+          const durable = await this.durable?.(repo, taskKey, used, prior);
+          if (this.durable !== void 0 && durable === void 0) throw new DecisionRecordReservationUnavailableError();
+          if (durable !== void 0 && !/^\d{4}$/.test(durable))
+            throw new Error(`decision-record reservation store returned invalid number ${JSON.stringify(durable)}`);
+          if (prior !== void 0 && durable !== void 0 && durable !== prior)
+            throw new Error(`decision-record reservation store returned ${durable} for task already carrying ${prior}`);
+          const highest = [...used].reduce((max, value) => /^\d{4}$/.test(value) ? Math.max(max, Number(value)) : max, 0);
+          const number = durable ?? prior ?? String(highest + 1).padStart(4, "0");
+          this.byTask.set(cacheKey, number);
+          this.claimedFor(repo).add(number);
+          return number;
+        } finally {
+          release();
+          if (this.tails.get(repo) === queued) this.tails.delete(repo);
+        }
+      }
+      claimedFor(repo) {
+        let set = this.claimed.get(repo);
+        if (set === void 0) {
+          set = /* @__PURE__ */ new Set();
+          this.claimed.set(repo, set);
+        }
+        return set;
+      }
+    };
+  }
+});
+
 // ../../src/core/harness/contract.ts
 function harnessFactsOf(value) {
   if (!isRecord4(value)) return void 0;
@@ -45211,7 +45799,7 @@ function harnessFactsOf(value) {
   return void 0;
 }
 function piFactsOf(v) {
-  const { harness: _harness, pid, logOffset, sessionFile, root, bearerHash, container, relaunches, ...rest } = v;
+  const { harness: _harness, pid, logOffset, sessionFile, root, bearerHash, wire, container, relaunches, ...rest } = v;
   if (typeof pid !== "number" || typeof logOffset !== "number") return void 0;
   return {
     ...rest,
@@ -45222,6 +45810,7 @@ function piFactsOf(v) {
     ...typeof sessionFile === "string" ? { sessionFile } : {},
     ...typeof bearerHash === "string" ? { bearerHash } : {},
     ...typeof root === "string" ? { root } : {},
+    ...WIRES.includes(wire) ? { wire } : {},
     ...typeof container === "string" ? { container } : {}
   };
 }
@@ -45272,6 +45861,7 @@ var SAID_ONCE_SUFFIX, isRecord4, relaunchesOf, isPiFacts, HarnessInterruptedErro
 var init_contract4 = __esm({
   "../../src/core/harness/contract.ts"() {
     "use strict";
+    init_provider();
     SAID_ONCE_SUFFIX = " (said once: later events of this kind are not noted)";
     isRecord4 = (v) => typeof v === "object" && v !== null;
     relaunchesOf = (v) => typeof v === "number" && Number.isInteger(v) && v >= 0 ? v : 0;
@@ -46661,6 +47251,94 @@ var init_runBearers = __esm({
   }
 });
 
+// ../../src/core/modelProxy/providerFailureAuth.ts
+import { createHmac, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+function payload(envelope, nonce) {
+  return JSON.stringify([
+    AUTH_VERSION,
+    nonce,
+    envelope.type,
+    envelope.cause,
+    envelope.message,
+    envelope.schemaRejection ?? null
+  ]);
+}
+function signature(envelope, nonce) {
+  return createHmac("sha256", AUTH_KEY).update(payload(envelope, nonce)).digest();
+}
+function authenticateProxyProviderFailure(envelope) {
+  const nonce = randomBytes5(NONCE_BYTES).toString("base64url");
+  const mac = signature(envelope, nonce).toString("base64url");
+  return { ...envelope, [PROXY_PROVIDER_FAILURE_AUTH_FIELD]: `${AUTH_VERSION}.${nonce}.${mac}` };
+}
+function parseBody2(value) {
+  if (typeof value !== "string") return value;
+  const text = value.trim();
+  for (let at = text.indexOf("{"); at >= 0; at = text.indexOf("{", at + 1)) {
+    try {
+      return JSON.parse(text.slice(at));
+    } catch {
+    }
+  }
+  return void 0;
+}
+function candidates(value, into = []) {
+  if (Array.isArray(value)) {
+    for (const item of value) candidates(item, into);
+    return into;
+  }
+  const row2 = isRecord5(value) ? value : void 0;
+  if (!row2) return into;
+  if (row2.type === "provider_failure") into.push(row2);
+  for (const item of Object.values(row2)) candidates(item, into);
+  return into;
+}
+function proxyProviderFailureIsAuthenticated(value) {
+  const found = candidates(parseBody2(value));
+  if (found.length !== 1) return false;
+  const row2 = found[0];
+  if (row2.type !== "provider_failure" || !isCause(row2.cause) || typeof row2.message !== "string") return false;
+  const rejection = isRecord5(row2.schemaRejection) ? row2.schemaRejection : void 0;
+  if (row2.schemaRejection !== void 0 && (typeof rejection?.tool !== "string" || rejection.tool.length === 0 || typeof rejection.keyword !== "string" || rejection.keyword.length === 0))
+    return false;
+  const schemaRejection = rejection !== void 0 ? { tool: rejection.tool, keyword: rejection.keyword } : void 0;
+  const marker = row2[PROXY_PROVIDER_FAILURE_AUTH_FIELD];
+  if (typeof marker !== "string") return false;
+  const parts = marker.split(".");
+  if (parts.length !== 3 || parts[0] !== AUTH_VERSION) return false;
+  const [, nonce, encodedMac] = parts;
+  if (!/^[A-Za-z0-9_-]{22}$/.test(nonce) || !/^[A-Za-z0-9_-]{43}$/.test(encodedMac)) return false;
+  let offered;
+  try {
+    offered = Buffer.from(encodedMac, "base64url");
+  } catch {
+    return false;
+  }
+  const expected = signature(
+    {
+      type: "provider_failure",
+      cause: row2.cause,
+      message: row2.message,
+      ...schemaRejection !== void 0 ? { schemaRejection } : {}
+    },
+    nonce
+  );
+  return offered.length === expected.length && timingSafeEqual3(offered, expected);
+}
+var PROXY_PROVIDER_FAILURE_AUTH_FIELD, AUTH_VERSION, AUTH_KEY, NONCE_BYTES, isRecord5, isCause;
+var init_providerFailureAuth = __esm({
+  "../../src/core/modelProxy/providerFailureAuth.ts"() {
+    "use strict";
+    init_provider();
+    PROXY_PROVIDER_FAILURE_AUTH_FIELD = "_switchboard_proxy_auth";
+    AUTH_VERSION = "v1";
+    AUTH_KEY = randomBytes5(32);
+    NONCE_BYTES = 16;
+    isRecord5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+    isCause = (value) => typeof value === "string" && PROVIDER_FAILURE_CAUSES.includes(value);
+  }
+});
+
 // ../../src/core/harness/pi/compactionFallback.ts
 function compactionAskOf(body) {
   if (typeof body !== "object" || body === null) return void 0;
@@ -46928,7 +47606,7 @@ export default async function switchboardHarness(pi) {
 
 // ../../src/core/harness/pi/bridge.ts
 function describePiToolCall(tool, args) {
-  const input = isRecord5(args) ? args : void 0;
+  const input = isRecord6(args) ? args : void 0;
   if (tool === "bash" && typeof input?.command === "string") return `$ ${input.command}`;
   for (const key of ["path", "name", "url", "query"]) {
     const v = input?.[key];
@@ -46937,8 +47615,8 @@ function describePiToolCall(tool, args) {
   return tool;
 }
 function piResultText(result) {
-  const content = isRecord5(result) && Array.isArray(result.content) ? result.content : [];
-  return content.filter((p) => isRecord5(p) && p.type === "text" && typeof p.text === "string").map((p) => String(p.text)).join("\n");
+  const content = isRecord6(result) && Array.isArray(result.content) ? result.content : [];
+  return content.filter((p) => isRecord6(p) && p.type === "text" && typeof p.text === "string").map((p) => String(p.text)).join("\n");
 }
 function piBashExit(text, isError) {
   const trailer = /Command exited with code (\d+)\s*$/.exec(text);
@@ -46947,12 +47625,14 @@ function piBashExit(text, isError) {
   if (prefixed.failed) return prefixed;
   return isError ? { failed: true } : { failed: false, exitCode: 0 };
 }
-var PI_EVENT_DISPOSITION, DIALOG_METHODS, BOOKKEEPING_TOOL, POLICY_REFUSAL_STOP_REASONS, isRecord5, str6, PiBridge;
+var PI_EVENT_DISPOSITION, DIALOG_METHODS, BOOKKEEPING_TOOL, POLICY_REFUSAL_STOP_REASONS, isRecord6, str6, PiBridge;
 var init_bridge2 = __esm({
   "../../src/core/harness/pi/bridge.ts"() {
     "use strict";
     init_formatDuration();
     init_runEvents();
+    init_providerFailureAuth();
+    init_provider();
     init_contract4();
     init_windDown();
     init_compactionFallback();
@@ -46986,7 +47666,7 @@ var init_bridge2 = __esm({
     DIALOG_METHODS = /* @__PURE__ */ new Set(["select", "confirm", "input", "editor"]);
     BOOKKEEPING_TOOL = "update_status";
     POLICY_REFUSAL_STOP_REASONS = /* @__PURE__ */ new Set(["refusal", "sensitive", "content_filter"]);
-    isRecord5 = (v) => typeof v === "object" && v !== null;
+    isRecord6 = (v) => typeof v === "object" && v !== null;
     str6 = (v) => typeof v === "string" ? v : String(v ?? "");
     PiBridge = class {
       constructor(deps) {
@@ -47080,10 +47760,10 @@ var init_bridge2 = __esm({
             this.modelCallOpen = true;
             break;
           case "message_start":
-            if (isRecord5(event.message) && event.message.role === "assistant") this.assistantStartedAt = this.deps.clock();
+            if (isRecord6(event.message) && event.message.role === "assistant") this.assistantStartedAt = this.deps.clock();
             break;
           case "message_end":
-            if (isRecord5(event.message)) {
+            if (isRecord6(event.message)) {
               if (event.message.role === "assistant") {
                 const assistant = event.message;
                 this.onAssistant(assistant, out);
@@ -47146,14 +47826,19 @@ var init_bridge2 = __esm({
           this.assistantStartedAt = void 0;
         }
         if (message4.stopReason === "error") {
-          out.providerError = redactAndCap(message4.errorMessage ?? "the model call failed", 400);
+          const raw = message4.errorMessage ?? "the model call failed";
+          out.providerFailure = classifyProviderFailure({
+            error: raw,
+            trustedEnvelope: proxyProviderFailureIsAuthenticated(raw)
+          });
+          out.providerError = redactAndCap(raw, 400);
           if (typeof message4.rawStopReason === "string" && POLICY_REFUSAL_STOP_REASONS.has(message4.rawStopReason))
             out.policyRefusal = true;
           return;
         }
         const content = Array.isArray(message4.content) ? message4.content : [];
-        const toolCalls = content.filter((b) => isRecord5(b) && b.type === "toolCall");
-        const text = content.filter((b) => isRecord5(b) && b.type === "text" && typeof b.text === "string").map((b) => String(b.text)).join("\n").trim();
+        const toolCalls = content.filter((b) => isRecord6(b) && b.type === "toolCall");
+        const text = content.filter((b) => isRecord6(b) && b.type === "text" && typeof b.text === "string").map((b) => String(b.text)).join("\n").trim();
         if (toolCalls.length === 0) {
           if (text) this.narrateHeld();
           this.answerText = text || this.heldAnswer || "";
@@ -47173,7 +47858,7 @@ var init_bridge2 = __esm({
         const span = this.agentSpan?.start(`tool.${tool}`);
         this.openTools.set(callId, { span, tool, judged: this.judgeGate });
         this.toolCalls++;
-        const input = isRecord5(event.args) ? event.args : void 0;
+        const input = isRecord6(event.args) ? event.args : void 0;
         const command2 = tool === "bash" && typeof input?.command === "string" ? { command: redactAndCap(input.command, COMMAND_CAP) } : {};
         const bound = tool === "bash" && typeof input?.timeout === "number" && Number.isFinite(input.timeout) && input.timeout > 0 ? { boundMs: Math.round(input.timeout * 1e3) } : {};
         this.emit({
@@ -47231,7 +47916,7 @@ var init_bridge2 = __esm({
         }
       }
       onCompactionEnd(event, out) {
-        const result = isRecord5(event.result) ? event.result : void 0;
+        const result = isRecord6(event.result) ? event.result : void 0;
         if (event.aborted === true || !result) {
           const why = typeof event.errorMessage === "string" ? event.errorMessage : void 0;
           this.note(
@@ -47750,7 +48435,7 @@ var init_reattach = __esm({
 // ../../src/core/harness/pi/mirror.ts
 import { isDeepStrictEqual } from "node:util";
 function boundOf(input) {
-  if (!isRecord6(input)) return {};
+  if (!isRecord7(input)) return {};
   const t = input.timeout;
   return typeof t === "number" && Number.isFinite(t) && t > 0 ? { boundMs: secondsToMs(t) } : {};
 }
@@ -47759,7 +48444,7 @@ function partsOf2(content) {
   if (!Array.isArray(content)) return [];
   const parts = [];
   for (const block of content) {
-    if (!isRecord6(block)) continue;
+    if (!isRecord7(block)) continue;
     if (block.type === "text" && typeof block.text === "string") parts.push({ type: "text", text: block.text });
     else if (block.type === "image" && typeof block.data === "string")
       parts.push({ type: "image", mediaType: String(block.mimeType ?? "image/png"), data: block.data });
@@ -47838,7 +48523,7 @@ function piSessionFile(messages, opts, compactions = []) {
         if (p.type === "text") content.push({ type: "text", text: p.text });
         else if (p.type === "tool_use") {
           toolNames.set(p.id, p.name);
-          content.push({ type: "toolCall", id: p.id, name: p.name, arguments: isRecord6(p.input) ? p.input : {} });
+          content.push({ type: "toolCall", id: p.id, name: p.name, arguments: isRecord7(p.input) ? p.input : {} });
         }
       }
       const hasTool = content.some((b) => b.type === "toolCall");
@@ -47894,12 +48579,12 @@ function sessionIdOf(at) {
   const hex = at.toString(16).padStart(12, "0").slice(-12);
   return `00000000-0000-4000-8000-${hex}`;
 }
-var isRecord6, PiMirror;
+var isRecord7, PiMirror;
 var init_mirror = __esm({
   "../../src/core/harness/pi/mirror.ts"() {
     "use strict";
     init_budgets();
-    isRecord6 = (v) => typeof v === "object" && v !== null;
+    isRecord7 = (v) => typeof v === "object" && v !== null;
     PiMirror = class {
       constructor(deps) {
         this.deps = deps;
@@ -48108,6 +48793,7 @@ function piLaunchArgs(spec) {
 }
 function piLaunchEnv(spec, bearer) {
   return {
+    ...spec.environment,
     [RUN_BEARER_ENV]: bearer,
     [HARNESS_URL_ENV]: spec.harnessUrl,
     SWITCHBOARD_RUN_ID: spec.runId,
@@ -48277,15 +48963,15 @@ function piStreamOptions(api, req, key) {
   if (api === "openai-responses") return { ...shared, toolChoice: { type: "function", name: req.toolChoice.name } };
   return { ...shared, toolChoice: { type: "function", function: { name: req.toolChoice.name } } };
 }
-function anthropicParallelOff(payload) {
-  const p = payload;
+function anthropicParallelOff(payload2) {
+  const p = payload2;
   return {
-    ...payload,
+    ...payload2,
     tool_choice: { ...p.tool_choice, disable_parallel_tool_use: true }
   };
 }
-function openAiParallelOff(payload) {
-  return { ...payload, parallel_tool_calls: false };
+function openAiParallelOff(payload2) {
+  return { ...payload2, parallel_tool_calls: false };
 }
 function toPiContext(req, model, clock4) {
   const callNames = /* @__PURE__ */ new Map();
@@ -48378,9 +49064,18 @@ function visiblePart(part) {
       return void 0;
   }
 }
-function fromPiMessage(message4, provider) {
+function fromPiMessage(message4, provider, tools) {
   if (message4.stopReason === "error" || message4.stopReason === "aborted") {
-    throw new Error(`Provider "${provider}" (${message4.model}): ${message4.errorMessage ?? "the model call failed"}`);
+    const raw = message4.errorMessage ?? "the model call failed";
+    const failure2 = classifyProviderFailure({ error: raw, provider, model: message4.model });
+    const schemaRejection = failure2.cause === "request-rejected" && failure2.status === 400 ? providerSchemaRejectionOf(raw, tools) : void 0;
+    throw new ProviderFailure(failure2.cause, {
+      ...failure2.status !== void 0 ? { status: failure2.status } : {},
+      ...failure2.provider !== void 0 ? { provider: failure2.provider } : {},
+      ...failure2.model !== void 0 ? { model: failure2.model } : {},
+      ...failure2.operatorUrl !== void 0 ? { operatorUrl: failure2.operatorUrl } : {},
+      ...schemaRejection !== void 0 ? { schemaRejection } : {}
+    });
   }
   const content = [];
   for (const part of message4.content) {
@@ -48481,7 +49176,12 @@ var init_piAi = __esm({
         let key;
         if (this.keyEnv !== void 0) {
           const secret2 = this.secrets.named(this.keyEnv);
-          if (!secret2) throw new Error(`Provider "${this.name}": ${this.keyEnv} is not set`);
+          if (!secret2)
+            throw new ProviderFailure("key-absent", {
+              provider: this.name,
+              model: req.model,
+              keyVariable: this.keyEnv
+            });
           key = secret2.reveal();
         }
         const model = this.model(req.model, req.maxTokens, req.effort !== void 0);
@@ -48489,8 +49189,21 @@ var init_piAi = __esm({
           ...piStreamOptions(this.api, req, key),
           ...this.fetchImpl ? { fetch: this.fetchImpl } : {}
         };
-        const message4 = await this.api$().stream(model, toPiContext(req, model, this.clock), options).result();
-        return fromPiMessage(message4, this.name);
+        try {
+          const message4 = await this.api$().stream(model, toPiContext(req, model, this.clock), options).result();
+          return fromPiMessage(message4, this.name, req.tools);
+        } catch (err2) {
+          const failure2 = providerFailureOf(err2);
+          const schemaRejection = failure2.schemaRejection ?? (failure2.cause === "request-rejected" && failure2.status === 400 ? providerSchemaRejectionOf(err2, req.tools) : void 0);
+          throw new ProviderFailure(failure2.cause, {
+            ...failure2.status !== void 0 ? { status: failure2.status } : {},
+            provider: this.name,
+            model: req.model,
+            ...failure2.operatorUrl !== void 0 ? { operatorUrl: failure2.operatorUrl } : {},
+            ...schemaRejection !== void 0 ? { schemaRejection } : {},
+            ...failure2.keyVariable !== void 0 ? { keyVariable: failure2.keyVariable } : failure2.cause === "key-invalid" && this.keyEnv !== void 0 ? { keyVariable: this.keyEnv } : {}
+          });
+        }
       }
       /** pi's implementation of this provider's API, loaded on the first call and
        *  kept; a scripted one stands in for it in tests. */
@@ -48593,7 +49306,7 @@ function judgeToolCall(tool, input, ctx) {
       ctx.identity === "none" ? `${tool} is the \`${bundle}\` bundle: a run without a workspace (identity none) has none of pi's own tools` : `${tool} is the \`${bundle}\` bundle, outside the ${ctx.identity} identity's reach`
     );
   }
-  const args = isRecord7(input) ? input : {};
+  const args = isRecord8(input) ? input : {};
   if (tool === "bash") return judgeBash(args.command, args.timeout, ctx);
   if (bundle === "files" || bundle === "write-files") return judgePath(args.path, ctx);
   return allowed;
@@ -48671,7 +49384,7 @@ function judgePath(path, ctx) {
   if (rel.startsWith("..") || isAbsolute5(rel)) return refused4(`path \u2014 \`${path}\` resolves outside the checkout`);
   return allowed;
 }
-var PI_TOOL_BUNDLES, CODING_REACH, READ_REACH, NONE_REACH, allowed, refused4, outside, isRecord7, CREDENTIAL_FILE, ENV_DUMP, CREDENTIAL_VAR, MERGE_OR_APPROVE, GIT_THEN_PUSH, GIT_PUSH, ANY_PUSH, GH_WRITE_VERB, WRITE_METHOD, GH_API_WRITE, CURL_GITHUB_WRITE, OPENCODE_ACTION_TO_TOOL_WORD, REDIRECTION;
+var PI_TOOL_BUNDLES, CODING_REACH, READ_REACH, NONE_REACH, allowed, refused4, outside, isRecord8, CREDENTIAL_FILE, ENV_DUMP, CREDENTIAL_VAR, MERGE_OR_APPROVE, GIT_THEN_PUSH, GIT_PUSH, ANY_PUSH, GH_WRITE_VERB, WRITE_METHOD, GH_API_WRITE, CURL_GITHUB_WRITE, OPENCODE_ACTION_TO_TOOL_WORD, REDIRECTION;
 var init_toolRules = __esm({
   "../../src/core/harness/pi/toolRules.ts"() {
     "use strict";
@@ -48701,7 +49414,7 @@ var init_toolRules = __esm({
     allowed = { verdict: "allowed" };
     refused4 = (reason2) => ({ verdict: "refused", reason: reason2 });
     outside = (reason2) => ({ verdict: "outside-profile", reason: reason2 });
-    isRecord7 = (v) => typeof v === "object" && v !== null;
+    isRecord8 = (v) => typeof v === "object" && v !== null;
     CREDENTIAL_FILE = /(^|[\s/'"`])(\.git\/)?(github-credentials|\.git-credentials)($|[\s'"`|;&])/;
     ENV_DUMP = /(^|[;&|(]\s*)((printenv|env)(\s+-[A-Za-z0-9-]+)*|export\s+-p|declare\s+-[a-zA-Z]*[px][a-zA-Z]*|set)\s*($|[|;&>)])|\/proc\/(self|\d+)\/environ|process\.env(?![.[\w])/;
     CREDENTIAL_VAR = /\$\{?[A-Z][A-Z0-9_]*(_API_KEY|_TOKEN|_SECRET|_BEARER|_PASSWORD)\b|printenv\s+[A-Z][A-Z0-9_]*(_API_KEY|_TOKEN|_SECRET|_BEARER|_PASSWORD)\b/;
@@ -48987,13 +49700,6 @@ async function locatePi(facts2, container, here) {
 function isAbortedProviderError(message4) {
   return /\baborted\b/i.test(message4);
 }
-function isTransientProviderError(message4) {
-  return /stream ended before message_stop|stream ended without finish_reason|ended before completion/i.test(message4) || /^(?:AbortError:\s*)?(?:This|The) operation was aborted\.?$/i.test(message4.trim()) || /ECONNRESET|ETIMEDOUT|EPIPE|socket hang up|fetch failed|other side closed|network (error|failure)|(connection|stream) (reset|closed|terminated)|timed? ?out/i.test(
-    message4
-  ) || /^terminated$/i.test(message4.trim()) || /overloaded/i.test(message4) || /^\s*(408|425|429|5\d\d)\b/.test(message4) || /<html[\s>][\s\S]{0,4000}\b(?:bad gateway|service unavailable|gateway timeout)\b/i.test(message4) || /(?:\bhttp\b[^a-z0-9]{0,8}|\bstatus(?: code)?\b[^0-9]{0,5}|\berror\b[^0-9]{0,5}|\bapi error\b[^0-9]{0,5})(408|425|429|5\d\d)\b/i.test(
-    message4
-  );
-}
 function piStartFailureOf(err2) {
   if (!(err2 instanceof HarnessContainerError) || err2.operation !== "send") return void 0;
   const timeout = err2.message.match(/exit 124:.*?(\d+)s command timeout/i);
@@ -49075,6 +49781,7 @@ async function runPiHarnessOpen(deps, run2) {
   const { container, clock: clock4 } = deps;
   const now = () => clock4();
   const recorded = run2.resume?.facts;
+  const runWire = piRunWire({ model: { providerType: run2.model.providerType }, card: run2.card });
   if (recorded !== void 0 && !isPiFacts(recorded)) {
     const mismatch = new HarnessMismatchError("pi", recorded.harness);
     run2.onProgress?.(mismatch.message);
@@ -49092,13 +49799,9 @@ async function runPiHarnessOpen(deps, run2) {
     run2.onProgress?.(summary);
     emit({ type: "run_note", kind, summary, ...mode ? { mode } : {} });
   };
-  const policyRefused = (explanation) => {
-    emit({
-      type: "run_note",
-      kind: "policy_refusal",
-      summary: `the model refused the call under the provider's usage policy: ${explanation}`
-    });
-    return new ModelPolicyRefusedError(explanation);
+  const policyRefused = (failure2) => {
+    emit({ type: "run_note", kind: "policy_refusal", summary: renderProviderFailure(failure2.cause, "parked") });
+    return new ModelPolicyRefusedError(failure2);
   };
   const bridge = new PiBridge({
     emit,
@@ -49298,11 +50001,12 @@ async function runPiHarnessOpen(deps, run2) {
       if (located2 === "another-container") {
         elsewhere = `pi is elsewhere: the row's pi (pid ${recorded.pid}) ran in container ${recorded.container}, not the one this run was handed (${here}), so it was neither probed nor ended here`;
       } else if (located2 === "alive-here") {
-        if (recorded.root !== void 0 && honoured(recorded.bearerHash)) {
+        const wireMismatch = recorded.wire !== void 0 && recorded.wire !== runWire ? `was configured for ${recorded.wire} while provider ${run2.model.provider} now declares ${runWire}` : void 0;
+        if (recorded.root !== void 0 && wireMismatch === void 0 && honoured(recorded.bearerHash)) {
           reattached = true;
           paths = piRunPathsAt(recorded.root);
         } else {
-          ended = recorded.root === void 0 ? "named no directory for its pi" : "carried no bearer this generation could honour for its pi";
+          ended = recorded.root === void 0 ? "named no directory for its pi" : wireMismatch ?? "carried no bearer this generation could honour for its pi";
           await container.kill(recorded.pid).catch(() => {
           });
         }
@@ -49310,7 +50014,11 @@ async function runPiHarnessOpen(deps, run2) {
     }
     if (reattached && recorded && paths !== void 0) {
       pid = recorded.pid;
-      facts2 = { ...recorded, ...recorded.container === void 0 && here !== void 0 ? { container: here } : {} };
+      facts2 = {
+        ...recorded,
+        wire: runWire,
+        ...recorded.container === void 0 && here !== void 0 ? { container: here } : {}
+      };
       mirrored = recorded.logOffset;
       transport = new PiRpcTransport({
         container,
@@ -49341,6 +50049,7 @@ async function runPiHarnessOpen(deps, run2) {
         ...run2.effort ? { effort: run2.effort } : {},
         identity: run2.agent.identity,
         system: run2.system,
+        ...run2.environment !== void 0 ? { environment: run2.environment } : {},
         relayTools: run2.tools.map((t) => t.name),
         ...deps.compaction ? { compaction: deps.compaction } : {}
       };
@@ -49389,7 +50098,7 @@ async function runPiHarnessOpen(deps, run2) {
               model: {
                 provider: run2.model.provider,
                 id: run2.model.id,
-                api: piApiFor(piRunWire({ model: { providerType: run2.model.providerType }, card: run2.card }))
+                api: piApiFor(runWire)
               },
               at: now()
             },
@@ -49434,6 +50143,7 @@ async function runPiHarnessOpen(deps, run2) {
         logOffset: 0,
         root: paths.dir,
         ...bearerHash !== void 0 ? { bearerHash } : {},
+        wire: runWire,
         ...here !== void 0 ? { container: here } : {},
         relaunches: recorded?.relaunches ?? 0
       };
@@ -49760,7 +50470,7 @@ ${stagedLine}` : prompt;
       for (const command2 of unsent) sends.send(command2);
       return outcome;
     };
-    let providerError;
+    let providerFailure;
     let providerRefusal = false;
     let providerRetries = 0;
     let containerSaid;
@@ -49866,7 +50576,7 @@ ${stagedLine}` : prompt;
       }
       if (obs.message?.role === "user") steerEchoed(obs.message);
       if (obs.message && await mirror.onMessage(obs.message, bridge.turns)) held2();
-      if (obs.compactionFailed !== void 0 && !isTransientProviderError(obs.compactionFailed)) {
+      if (obs.compactionFailed !== void 0 && !providerFailureParks(classifyProviderFailure({ error: obs.compactionFailed }).cause)) {
         compactionFailure = obs.compactionFailed;
         if (!catchingUp && run2.onCompactionFailed) {
           try {
@@ -49898,27 +50608,31 @@ ${stagedLine}` : prompt;
         }
       }
       if (obs.providerError !== void 0) {
+        const failure2 = obs.providerFailure ?? providerFailureOf(obs.providerError);
         if (catchingUp)
-          note("harness_error", `a model call failed while the bot was away (${obs.providerError}); continuing`);
+          note(
+            "harness_error",
+            `a model call failed while the bot was away (${renderProviderFailure(failure2.cause, "parked")}); continuing`
+          );
         else if (cutAborted && !finaleAborted && isAbortedProviderError(obs.providerError)) {
           cutAborted = false;
-        } else if (obs.policyRefusal !== true && !writeUp && !finaleAborted && isTransientProviderError(obs.providerError)) {
-          heldTurn = obs.providerError;
+        } else if (obs.policyRefusal !== true && !writeUp && !finaleAborted && providerFailureParks(failure2.cause)) {
+          heldTurn = failure2;
           parkSettled = false;
           const backoff = PROVIDER_RETRY_BACKOFFS_MS[Math.min(providerRetries, PROVIDER_RETRY_BACKOFFS_MS.length - 1)];
           run2.onProgress?.(
             `the model provider did not complete the call; the turn is held and retry ${providerRetries + 1} waits ${backoff / 1e3}s inside this run's lease`
           );
         } else if (writeUp || finaleAborted) {
-          writeUpFailed = obs.providerError;
-          note("harness_error", windDownFailureNote(obs.providerError));
+          writeUpFailed = renderProviderFailure(failure2.cause, "parked");
+          note("harness_error", windDownFailureNote(writeUpFailed));
         } else {
-          providerError = obs.providerError;
+          providerFailure = failure2;
           providerRefusal = obs.policyRefusal === true;
         }
       }
       if (obs.settled && !catchingUp) {
-        if (heldTurn !== void 0 && providerError === void 0 && !hardStopped && !writeUp && !finaleAborted) {
+        if (heldTurn !== void 0 && providerFailure === void 0 && !hardStopped && !writeUp && !finaleAborted) {
           parkSettled = true;
           if (providerRetryWait === void 0) {
             const backoff = PROVIDER_RETRY_BACKOFFS_MS[Math.min(providerRetries, PROVIDER_RETRY_BACKOFFS_MS.length - 1)];
@@ -50010,12 +50724,10 @@ ${stagedLine}` : prompt;
       answer = HARD_STOP_MESSAGE;
     } else {
       if (bypass) throw bypass;
-      if (providerError !== void 0) {
-        if (providerRefusal) throw policyRefused(providerError);
-        if (isTransientProviderError(providerError)) throw new ModelTransientFailureError(PROVIDER_RETRY_EXHAUSTED);
-        throw new Error(
-          providerRetries > 0 ? `the model call failed after ${providerRetries} ${providerRetries === 1 ? "retry" : "retries"}: ${providerError}` : `the model call failed: ${providerError}`
-        );
+      if (providerFailure !== void 0) {
+        if (providerRefusal) throw policyRefused(providerFailure);
+        if (providerFailureParks(providerFailure.cause)) throw new ModelTransientFailureError(PROVIDER_RETRY_EXHAUSTED);
+        throw providerFailure;
       }
       const text = bridge.answer() ?? "";
       ending = windDownEndingOf(writeUp ?? (stopMode === "soft" ? { kind: "soft" } : void 0), text, writeUpFailed);
@@ -50050,7 +50762,57 @@ ${stagedLine}` : prompt;
       writeUpFailed = void 0;
       const id = `${ids.prompt}:follow-up:${++followUps}`;
       let turnSettled = false;
-      let turnError;
+      let turnFailure;
+      let turnHeld;
+      let turnParkSettled = false;
+      let turnRetryReady = false;
+      let turnRetryWait;
+      let turnRetryGeneration = 0;
+      let turnRetries = 0;
+      let turnRetryInFlight;
+      let turnReissueInFlight;
+      let turnReissues = 0;
+      let turnReissueRows = [];
+      let turnReissueInFlightRows = [];
+      const clearTurnProviderHold = () => {
+        turnHeld = void 0;
+        turnParkSettled = false;
+        turnRetryReady = false;
+        turnRetryWait = void 0;
+        turnRetryGeneration += 1;
+        turnReissueRows = [];
+        turnReissueInFlightRows = [];
+      };
+      const maybeReissueTurn = () => {
+        if (turnHeld === void 0 || !turnParkSettled || turnReissueInFlight !== void 0 || turnRetryInFlight !== void 0 || turnReissueRows.length === 0 || hardStopped || writeUp !== void 0 || finaleAborted)
+          return;
+        turnReissues += 1;
+        turnReissueInFlight = turnReissues === 1 ? `${id}:reissue` : `${id}:reissue:${turnReissues}`;
+        turnReissueInFlightRows = turnReissueRows.splice(0);
+        turnParkSettled = false;
+        turnSettled = false;
+        sends.send({ id: turnReissueInFlight, type: "prompt", message: REISSUE_PROMPT });
+      };
+      const drainTurnReissues = () => {
+        const inputs = run2.inbox?.drain() ?? [];
+        if (inputs.length === 0) {
+          maybeReissueTurn();
+          return;
+        }
+        const reissued = inputs.filter((item) => item.userId === PLANE_ACTOR_ID && isReissueSteerText(item.text));
+        const waiting2 = reissued.length === 0 ? inputs : inputs.filter((item) => !reissued.includes(item));
+        if (waiting2.length > 0) run2.inbox?.requeue(waiting2);
+        for (const item of reissued) {
+          emit({
+            type: "input",
+            text: redactSecrets(item.text),
+            messageId: followUpMessageId(item),
+            ...item.userName ? { source: { user: item.userName } } : {}
+          });
+        }
+        turnReissueRows.push(...reissued);
+        maybeReissueTurn();
+      };
       let turnRefusal = false;
       let turnFailed = false;
       const turnCheck = () => {
@@ -50068,6 +50830,19 @@ ${stagedLine}` : prompt;
           }
           return;
         }
+        drainTurnReissues();
+        if (turnHeld !== void 0) {
+          if (now() >= turnDeadline) throw new ModelTransientFailureError(PROVIDER_RETRY_EXHAUSTED);
+          if (turnParkSettled && turnRetryReady && turnRetryInFlight === void 0 && turnReissueInFlight === void 0) {
+            turnRetryReady = false;
+            turnRetryWait = void 0;
+            turnRetries += 1;
+            turnRetryInFlight = turnRetries === 1 ? `${id}:retry` : `${id}:retry:${turnRetries}`;
+            turnParkSettled = false;
+            turnSettled = false;
+            sends.send({ id: turnRetryInFlight, type: "prompt", message: PROVIDER_RETRY_PROMPT });
+          }
+        }
         if (run2.control?.requested === "soft") {
           note("stopped", softStopNote(), "soft");
           startWriteUp({ kind: "soft" }, SOFT_STOP_INSTRUCTION);
@@ -50135,19 +50910,69 @@ ${stagedLine}` : prompt;
             abortPi();
             break;
           }
-          if (obs.response) noteEcho(obs.response);
+          if (obs.response) {
+            noteEcho(obs.response);
+            if (turnReissueInFlight !== void 0 && obs.response.id === turnReissueInFlight) {
+              turnReissueInFlight = void 0;
+              if (obs.response.success === false) {
+                turnReissueRows.unshift(...turnReissueInFlightRows);
+                turnReissueInFlightRows = [];
+                turnParkSettled = false;
+                note(
+                  "harness_error",
+                  `the follow-up turn's reissue prompt was refused (${String(obs.response.error ?? "no reason")}); the turn stays held for the next settle`
+                );
+              } else {
+                mirror.inboxConsumedSeq = Math.max(
+                  mirror.inboxConsumedSeq,
+                  ...turnReissueInFlightRows.map((item) => item.ledgerSeq ?? 0)
+                );
+                clearTurnProviderHold();
+              }
+            }
+            if (turnRetryInFlight !== void 0 && obs.response.id === turnRetryInFlight) {
+              turnRetryInFlight = void 0;
+              if (obs.response.success === false) {
+                turnParkSettled = false;
+                note("harness_error", "the follow-up turn's model retry prompt was refused; the failure remains held");
+              } else clearTurnProviderHold();
+            }
+          }
           if (obs.response?.id === id && obs.response.success === false)
             throw new PromptRefused(String(obs.response.error ?? "no reason"));
           if (obs.providerError !== void 0) {
+            const failure2 = obs.providerFailure ?? providerFailureOf(obs.providerError);
             if (writeUp || finaleAborted) {
-              writeUpFailed = obs.providerError;
-              note("harness_error", windDownFailureNote(obs.providerError, "turn"));
+              writeUpFailed = renderProviderFailure(failure2.cause, "parked");
+              note("harness_error", windDownFailureNote(writeUpFailed, "turn"));
+            } else if (obs.policyRefusal !== true && providerFailureParks(failure2.cause)) {
+              turnHeld = failure2;
+              turnFailure = void 0;
+              turnRefusal = false;
+              turnParkSettled = false;
+              const backoff = PROVIDER_RETRY_BACKOFFS_MS[Math.min(turnRetries, PROVIDER_RETRY_BACKOFFS_MS.length - 1)];
+              run2.onProgress?.(
+                `the model provider did not complete the follow-up call; the turn is held and retry ${turnRetries + 1} waits ${backoff / 1e3}s inside this run's lease`
+              );
             } else {
-              turnError = obs.providerError;
+              turnFailure = failure2;
               turnRefusal = obs.policyRefusal === true;
             }
           }
           if (obs.settled) {
+            if (turnHeld !== void 0 && turnFailure === void 0 && !hardStopped && !writeUp && !finaleAborted) {
+              turnParkSettled = true;
+              if (turnRetryWait === void 0) {
+                const backoff = PROVIDER_RETRY_BACKOFFS_MS[Math.min(turnRetries, PROVIDER_RETRY_BACKOFFS_MS.length - 1)];
+                const generation = ++turnRetryGeneration;
+                turnRetryWait = deps.sleep(backoff).then(() => {
+                  if (turnRetryGeneration === generation) turnRetryReady = true;
+                });
+              }
+              turnCheck();
+              if (hardStopped) break;
+              continue;
+            }
             turnSettled = true;
             break;
           }
@@ -50205,9 +51030,9 @@ ${stagedLine}` : prompt;
             `pi exited before the turn settled${tail2.trim() ? `: ${redactAndCap(tail2.trim(), 400)}` : ""}`
           );
         }
-        if (turnError !== void 0) {
-          if (turnRefusal) throw policyRefused(turnError);
-          throw new Error(`the model call failed: ${turnError}`);
+        if (turnFailure !== void 0) {
+          if (turnRefusal) throw policyRefused(turnFailure);
+          throw turnFailure;
         }
         const text = bridge.answer() ?? "";
         const turnEnding = windDownEndingOf(writeUp, text, writeUpFailed);
@@ -50217,6 +51042,7 @@ ${stagedLine}` : prompt;
         if (err2 instanceof HarnessControlFileLostError) note("harness_error", err2.message);
         throw err2;
       } finally {
+        turnRetryGeneration += 1;
         deps.bearers?.clearTurn(run2.runId);
         live.toolContext = runContext;
         live.rules = rules;
@@ -50239,6 +51065,7 @@ var CALL_SEEN_WAIT_MS, CALL_SEEN_TICK_MS, PROVIDER_RETRY_PROMPT, REISSUE_PROMPT,
 var init_harness = __esm({
   "../../src/core/harness/pi/harness.ts"() {
     "use strict";
+    init_provider();
     init_contract4();
     init_windDown();
     init_runBearers();
@@ -50286,14 +51113,14 @@ var init_harness = __esm({
         this.name = "PiContainerReplacedError";
       }
     };
-    POLICY_REFUSAL_REPLY = "the model refused this request under its usage policy \u2014 rephrase it and the thread continues";
+    POLICY_REFUSAL_REPLY = renderProviderFailure("permanent");
     ModelPolicyRefusedError = class extends Error {
-      constructor(providerMessage) {
+      constructor(providerFailure) {
         super(POLICY_REFUSAL_REPLY);
-        this.providerMessage = providerMessage;
+        this.providerFailure = providerFailure;
         this.name = "ModelPolicyRefusedError";
       }
-      providerMessage;
+      providerFailure;
     };
     ModelTransientFailureError = class extends Error {
       constructor(message4) {
@@ -50498,8 +51325,8 @@ async function postReviewComment(target, body) {
   const clipped = body.length > MAX_COMMENT_CHARS ? `${body.slice(0, MAX_COMMENT_CHARS)}
 
 _(review truncated to fit GitHub's comment size limit)_` : body;
-  const payload = { event: "COMMENT", body: clipped };
-  if (target.commitId) payload.commit_id = target.commitId;
+  const payload2 = { event: "COMMENT", body: clipped };
+  if (target.commitId) payload2.commit_id = target.commitId;
   const res = await fetch(`https://api.github.com/repos/${target.repo}/pulls/${target.number}/reviews`, {
     method: "POST",
     headers: {
@@ -50508,7 +51335,7 @@ _(review truncated to fit GitHub's comment size limit)_` : body;
       "content-type": "application/json",
       "user-agent": "switchboard"
     },
-    body: JSON.stringify(payload),
+    body: JSON.stringify(payload2),
     signal: AbortSignal.timeout(15e3)
   });
   if (!res.ok) {
@@ -50828,8 +51655,8 @@ async function runCodingPrPostStep(input) {
     }
     return void 0;
   }
-  const candidates = [target.baseRef, target.bindingRef, target.resolvedRef];
-  const base = prDescription ? await resolveBaseRefLazy(candidates, repo, input.fetchRepoInfo) : resolveBaseRef(candidates, void 0);
+  const candidates2 = [target.baseRef, target.bindingRef, target.resolvedRef];
+  const base = prDescription ? await resolveBaseRefLazy(candidates2, repo, input.fetchRepoInfo) : resolveBaseRef(candidates2, void 0);
   const pushedBranch = branch2 !== void 0 && branch2 !== base && pushed;
   if (pushedBranch && branch2 !== void 0 && headSha !== void 0) {
     const clean = observed.uncommittedChanges !== void 0 && observed.unpushedCommits !== void 0 ? observed.uncommittedChanges === 0 && observed.unpushedCommits === 0 : void 0;
@@ -51933,6 +52760,7 @@ async function runLoop(deps, ctx) {
           messages,
           tools: mergeTools(TOOLSETS[agent.toolset] ?? [], mcpForRun?.tools),
           toolContext,
+          ...ctx.decisionRecord !== void 0 ? { environment: { [DECISION_RECORD_ENV]: ctx.decisionRecord } } : {},
           ...session ? { notepad: () => session.readNotepad(), conversation: () => session.readConversation() } : {},
           // A failed compaction is a checkpoint signal (harness-pi.md item
           // 7): the provider can refuse the process's summary for good, and
@@ -52275,6 +53103,10 @@ async function runLoop(deps, ctx) {
           answer,
           carried,
           hardStopped: false,
+          ...coordinator !== void 0 ? {
+            guardTransition: true,
+            fetchPrFacts: deps.fetchPrFacts ?? fetchPullRequestFacts
+          } : { guardTransition: false },
           post: deps.postReviewComment ?? postReviewComment,
           fetchPrHead: deps.fetchPrHead ?? currentPrHeadSha,
           reply: (text) => io.reply(text),
@@ -52358,6 +53190,7 @@ async function runLoop(deps, ctx) {
       diagnosis,
       root,
       ledgerRun,
+      ...observedHead !== void 0 ? { headSha: observedHead } : {},
       ...handoff !== void 0 ? { handoff } : {},
       ...verdict !== void 0 ? { verdict } : {},
       ...reviewHead !== void 0 ? { reviewHead } : {},
@@ -52438,6 +53271,7 @@ var init_runLoop = __esm({
     "use strict";
     init_actor();
     init_predicate();
+    init_decisionRecordReservation();
     init_profile();
     init_provider();
     init_toolsets();
@@ -52521,11 +53355,11 @@ function shipUnitText(requestText, repo) {
   return t.replace(/\s+/g, " ").trim();
 }
 function noRepoGuess(input) {
-  const candidates = input.repoCandidates ?? [];
-  if (candidates.length === 0) return void 0;
+  const candidates2 = input.repoCandidates ?? [];
+  if (candidates2.length === 0) return void 0;
   const typed = REPO_TOKEN.exec(input.requestText)?.[1];
   if (typed) {
-    const near = nearMatch(typed, candidates);
+    const near = nearMatch(typed, candidates2);
     if (near.guess)
       return {
         line: `agent:ship ${input.requestText.replace(typed, near.guess)}`,
@@ -52533,8 +53367,8 @@ function noRepoGuess(input) {
         source: "near"
       };
   }
-  if (candidates.length !== 1) return void 0;
-  const repo = candidates[0];
+  if (candidates2.length !== 1) return void 0;
+  const repo = candidates2[0];
   return {
     line: `agent:ship in ${repo}: ${input.requestText}`,
     evidence: `\`${repo}\` is the one available repository`,
@@ -52759,7 +53593,8 @@ async function plan(deps, input) {
         ...entry.adopt !== void 0 ? { adopt: entry.adopt } : {},
         ...entry.branch !== void 0 ? { entryBranch: entry.branch } : {},
         ...entry.autoMergeEnabled !== void 0 ? { autoMergeEnabled: entry.autoMergeEnabled } : {},
-        ...entry.baseFallback !== void 0 ? { baseFallback: entry.baseFallback } : {}
+        ...entry.baseFallback !== void 0 ? { baseFallback: entry.baseFallback } : {},
+        ...asksForDecisionRecord(text2) ? { recordTasks: { [graph2.units[0].id]: decisionRecordTaskKey(entry.repo, msg.threadKey, text2.trim()) } } : {}
       }
     };
   }
@@ -52815,22 +53650,37 @@ async function plan(deps, input) {
       selected,
       identity: identity2,
       merge: "runner",
-      ...entry.baseFallback !== void 0 ? { baseFallback: entry.baseFallback } : {}
+      ...entry.baseFallback !== void 0 ? { baseFallback: entry.baseFallback } : {},
+      recordTasks: Object.fromEntries(
+        graph.units.flatMap((unit) => {
+          const section = parsePlanUnit(text, unit.id)?.section ?? "";
+          return asksForDecisionRecord(section) ? [[unit.id, decisionRecordTaskKey(entry.repo, msg.threadKey, section.trim())]] : [];
+        })
+      )
     }
   };
 }
-function rowsFor(p, selected, instanceId, lastPushOf) {
-  return p.graph.units.filter((u) => selected.includes(u.id)).map((u) => ({
-    instanceId,
-    unit: u.id,
-    slug: u.slug,
-    title: u.title,
-    branch: p.entryBranch ?? u.branch,
-    dependsOn: u.dependsOn,
-    rounds: [],
-    ...p.resume !== void 0 ? { resume: p.resume } : {},
-    ...lastPushOf?.has(u.id) ? { lastPush: lastPushOf.get(u.id) } : {}
-  }));
+async function rowsFor(deps, p, selected, instanceId, carried) {
+  const reserve = deps.reserveDecisionRecord ?? (() => Promise.reject(new DecisionRecordReservationUnavailableError()));
+  return Promise.all(
+    p.graph.units.filter((u) => selected.includes(u.id)).map(async (u) => {
+      const previous = carried?.get(u.id);
+      const taskKey = p.recordTasks?.[u.id];
+      const record2 = taskKey !== void 0 ? await reserve(p.identity.repo, taskKey, previous?.record) : previous?.record;
+      return {
+        instanceId,
+        unit: u.id,
+        slug: u.slug,
+        title: u.title,
+        branch: p.entryBranch ?? u.branch,
+        dependsOn: u.dependsOn,
+        rounds: [],
+        ...p.resume !== void 0 ? { resume: p.resume } : {},
+        ...previous?.lastPush !== void 0 ? { lastPush: previous.lastPush } : {},
+        ...record2 !== void 0 ? { record: record2 } : {}
+      };
+    })
+  );
 }
 function planWhere(p, units, mergedBefore, attempt) {
   const at = p.path !== void 0 ? ` (\`${p.path}\` at \`${p.base}\`)` : "";
@@ -52854,6 +53704,15 @@ function planWhere(p, units, mergedBefore, attempt) {
   return lines;
 }
 async function handOffToCoordinator(deps, input) {
+  try {
+    return await handOffToCoordinatorUnchecked(deps, input);
+  } catch (error) {
+    if (error instanceof DecisionRecordReservationUnavailableError)
+      return refused5("decision_record_store_unavailable", DECISION_RECORD_STORE_REFUSAL);
+    throw error;
+  }
+}
+async function handOffToCoordinatorUnchecked(deps, input) {
   const log = deps.log ?? console.log;
   const planned = await plan(deps, input);
   if (!planned.ok) return refused5(planned.code, planned.reply);
@@ -52865,7 +53724,7 @@ async function handOffToCoordinator(deps, input) {
   const firstId = planInstanceId(p.planId);
   const first = await deps.instances.get(firstId);
   if (first === null) {
-    const units2 = rowsFor(p, p.selected, firstId);
+    const units2 = await rowsFor(deps, p, p.selected, firstId);
     const instance2 = {
       id: firstId,
       ...p.identity,
@@ -52901,11 +53760,16 @@ async function handOffToCoordinator(deps, input) {
       `\u{1F6AB} A runner for ${where} (\`${latest.id}\`) is in a state the bot does not read as ended (${status3.status}) \u2014 a person decides.`
     );
   const merged = /* @__PURE__ */ new Set();
-  const lastPushOf = /* @__PURE__ */ new Map();
+  const carried = /* @__PURE__ */ new Map();
   for (let n2 = 1; n2 <= attempt; n2++)
     for (const row2 of await deps.instances.listUnits(planInstanceId(p.planId, n2))) {
       if (row2.ending?.kind === "merged") merged.add(row2.unit);
-      if (row2.lastPush !== void 0) lastPushOf.set(row2.unit, row2.lastPush);
+      const prior = carried.get(row2.unit) ?? {};
+      carried.set(row2.unit, {
+        ...prior,
+        ...row2.lastPush !== void 0 ? { lastPush: row2.lastPush } : {},
+        ...row2.record !== void 0 ? { record: row2.record } : {}
+      });
     }
   const remaining = p.selected.filter((u) => !merged.has(u));
   if (remaining.length === 0)
@@ -52915,7 +53779,7 @@ async function handOffToCoordinator(deps, input) {
     );
   const mergedBefore = p.selected.filter((u) => merged.has(u));
   if (status3.kind === "absent") {
-    const units2 = rowsFor(p, remaining, latest.id, lastPushOf);
+    const units2 = await rowsFor(deps, p, remaining, latest.id, carried);
     const instance2 = {
       id: latest.id,
       ...p.identity,
@@ -52935,7 +53799,7 @@ async function handOffToCoordinator(deps, input) {
     );
   }
   const nextId = planInstanceId(p.planId, attempt + 1);
-  const units = rowsFor(p, remaining, nextId, lastPushOf);
+  const units = await rowsFor(deps, p, remaining, nextId, carried);
   const instance = {
     id: nextId,
     ...p.identity,
@@ -53030,6 +53894,7 @@ var init_handOff = __esm({
     init_budgets();
     init_verbosity();
     init_contract();
+    init_decisionRecordReservation();
     init_preflight();
     init_coordinator();
     refused5 = (code, reply) => ({
@@ -53428,6 +54293,7 @@ async function runShipBranch(deps, msg, io, ctx) {
         {
           readFile: (repo, path, ref, opts) => githubCapabilityFor(deps, chatActorOf(deps.config, msg)).api.readFile(repo, path, ref, opts),
           instances: deps.coordinatorInstances ?? new NullCoordinatorInstanceStore(),
+          ...deps.reserveDecisionRecord !== void 0 ? { reserveDecisionRecord: deps.reserveDecisionRecord } : {},
           create: deps.createCoordinatorInstance ?? ((id) => createInstanceViaShim(shim(), id)),
           status: deps.fetchCoordinatorInstanceStatus ?? ((id) => fetchInstanceStatusViaShim(shim(), id))
         },
@@ -53960,11 +54826,11 @@ function threadArtifactsBlock(records, opts) {
   return { text: parts.join("\n\n"), runs: kept.map((k) => k.id), cut, total: rendered.length };
 }
 async function threadArtifactsFor(input) {
-  const candidates = runsSince(input.thread, input.agent).filter(carriesArtifacts);
-  if (candidates.length === 0) return { notes: [] };
+  const candidates2 = runsSince(input.thread, input.agent).filter(carriesArtifacts);
+  if (candidates2.length === 0) return { notes: [] };
   const notes = [];
   const reads = await Promise.all(
-    candidates.map(async (view) => {
+    candidates2.map(async (view) => {
       try {
         const res = await input.runs.getRun(view.id, { include: "messages" });
         if (res.ok) return res.value;
@@ -54093,6 +54959,25 @@ __export(dispatcher_exports, {
   dispatch: () => dispatch,
   dispatchClick: () => dispatchClick
 });
+async function priorDecisionRecord(store, threadKey, repo, taskKey) {
+  let before;
+  let beforeId;
+  for (; ; ) {
+    const rows = await store.list({
+      threadKey,
+      agent: "coding",
+      limit: RUN_LIST_MAX_LIMIT,
+      ...before !== void 0 ? { before, beforeId } : {}
+    });
+    const match = rows.find((row2) => row2.repo === repo && row2.recordTaskKey === taskKey && row2.record !== void 0);
+    if (match?.record !== void 0) return match.record;
+    if (rows.length < RUN_LIST_MAX_LIMIT) return void 0;
+    const last = rows.at(-1);
+    if (last.finishedAt === before && last.id === beforeId) return void 0;
+    before = last.finishedAt;
+    beforeId = last.id;
+  }
+}
 async function answerUnitOwnedThread(deps, ctx) {
   const { msg, io, owner } = ctx;
   const store = deps.coordinatorInstances;
@@ -54235,6 +55120,8 @@ async function dispatch(deps, msg, io, opts = {}) {
   });
   let setupCard;
   let setupShell;
+  let decisionRecord;
+  let decisionRecordTask;
   let setupHeartbeat;
   const admission = deps.admission ?? defaultAdmission;
   const registry = deps.runRegistry ?? defaultRunRegistry;
@@ -54586,6 +55473,36 @@ async function dispatch(deps, msg, io, opts = {}) {
     if (repoGate.kind === "refused") return ended;
     const clip3 = budgetClipLabel(agent, profile, directives.budget, { coordinator: opts.coordinator !== void 0 });
     if (clip3) shell.note("debug", clip3);
+    decisionRecord = opts.contract?.record ?? carriedRow?.meta.record;
+    decisionRecordTask = carriedRow?.meta.recordTaskKey;
+    if (decisionRecord === void 0 && agent.name === "coding" && agentSource === "directive" && repoCtx.repo !== void 0 && asksForDecisionRecord(directives.text)) {
+      decisionRecordTask = decisionRecordTaskKey(
+        repoCtx.repo,
+        msg.threadKey,
+        shipUnitText(directives.text, repoCtx.repo).trim()
+      );
+      const prior = await priorDecisionRecord(deps.runStore, msg.threadKey, repoCtx.repo, decisionRecordTask);
+      const reserve = deps.reserveDecisionRecord ?? (async () => {
+        throw new DecisionRecordReservationUnavailableError();
+      });
+      try {
+        decisionRecord = await reserve(repoCtx.repo, decisionRecordTask, prior);
+      } catch (error) {
+        if (!(error instanceof DecisionRecordReservationUnavailableError)) throw error;
+        await refuse3(
+          refusalOf("decision_record_store_unavailable", DECISION_RECORD_STORE_REFUSAL),
+          () => card.done(
+            shell.close({
+              kind: "not_started",
+              icon: "\u26A0\uFE0F",
+              reason: "durable coordinator store unavailable",
+              ...closeLines(clock4(), false)
+            })
+          )
+        );
+        return ended;
+      }
+    }
     if (agent.name === "ship") {
       setupCard = void 0;
       clearInterval(setupHeartbeat);
@@ -54645,7 +55562,8 @@ async function dispatch(deps, msg, io, opts = {}) {
     const channelBuilt = session ? void 0 : buildConversation(opts.seed ?? history, requestText, msg.images, msg.documents, references.blocks, msg.userId);
     const built = session ? session.messages : channelBuilt.messages;
     const seedActors = session ? session.actors : channelBuilt?.actors;
-    const messages = resume ? resume.plan.messages : contractBlock !== void 0 && agent.name !== "review" ? withContractInFirstUserTurn(built, contractBlock) : built;
+    const withRecord = !resume && decisionRecord !== void 0 && agent.name === "coding" ? withContractInFirstUserTurn(built, `record: ${decisionRecord}`) : built;
+    const messages = resume ? resume.plan.messages : contractBlock !== void 0 && agent.name !== "review" ? withContractInFirstUserTurn(withRecord, contractBlock) : withRecord;
     const headPreflight = await authorizePrHead({
       msg,
       io,
@@ -54686,6 +55604,8 @@ async function dispatch(deps, msg, io, opts = {}) {
       ...opts.restartCarried !== void 0 ? { restartCarried: opts.restartCarried } : {},
       ...seedTurns ? { seedTurns } : {},
       agentSource,
+      ...decisionRecord !== void 0 ? { decisionRecord } : {},
+      ...decisionRecordTask !== void 0 ? { decisionRecordTask } : {},
       modelCard,
       cardDecisions,
       ...operatorEvent ? { operator: operatorEvent } : {},
@@ -54746,6 +55666,8 @@ async function dispatch(deps, msg, io, opts = {}) {
       parentRunId,
       coordinator,
       seed,
+      ...decisionRecord !== void 0 ? { decisionRecord } : {},
+      ...decisionRecordTask !== void 0 ? { decisionRecordTask } : {},
       ...opts.restartOf !== void 0 ? { restartOf: opts.restartOf } : {}
     });
     if (reservation) {
@@ -55068,6 +55990,7 @@ async function dispatch(deps, msg, io, opts = {}) {
       isCodingPrRun,
       reviewHead,
       requestText: directives.text,
+      ...decisionRecord !== void 0 ? { decisionRecord } : {},
       card,
       shell,
       doneLines,
@@ -55409,6 +56332,7 @@ var init_dispatcher = __esm({
     init_authorize2();
     init_messages();
     init_staging();
+    init_runRecord();
     init_provision();
     init_run2();
     init_runLoop();
@@ -55436,7 +56360,9 @@ var init_dispatcher = __esm({
     init_contract2();
     init_runRegistry();
     init_runEnding();
+    init_preflight();
     init_types5();
+    init_decisionRecordReservation();
     activeRuns = 0;
   }
 });
@@ -56139,15 +57065,15 @@ function createLedgerWriteThrough(opts) {
     readNotepad: (key) => ledger.readNotepad(key),
     writeNotepad: (key, text) => ledger.writeNotepad(key, gen, text),
     async handoff() {
-      const candidates = [...live].filter((r) => r.resumable && r.tracked() && !r.handedOff);
-      if (candidates.length === 0) return { marked: [] };
+      const candidates2 = [...live].filter((r) => r.resumable && r.tracked() && !r.handedOff);
+      if (candidates2.length === 0) return { marked: [] };
       try {
         const { marked } = await ledger.handoff(
           gen,
-          candidates.map((r) => r.runId)
+          candidates2.map((r) => r.runId)
         );
         const markedSet = new Set(marked);
-        for (const r of candidates) if (markedSet.has(r.runId)) r.markHandedOff();
+        for (const r of candidates2) if (markedSet.has(r.runId)) r.markHandedOff();
         return { marked };
       } catch (err2) {
         return { marked: [], failed: describe9(err2) };
@@ -56830,7 +57756,7 @@ function openCodeToolError(outcome, text) {
   return outcome === "failed" ? { type: "tool.execution", message: text || "The tool call failed" } : { type: "aborted", message: text || "Tool execution interrupted" };
 }
 function openCodeToolContent(toolUse, resultText, at, outcome = "completed") {
-  const input = isRecord8(toolUse.input) ? toolUse.input : {};
+  const input = isRecord9(toolUse.input) ? toolUse.input : {};
   const content = [{ type: "text", text: resultText || "(no output)" }];
   return {
     type: "tool",
@@ -56935,11 +57861,11 @@ function openCodeSeedAndRequest(messages) {
   }
   return { seed: messages.slice(), request: "" };
 }
-var isRecord8, SESSION_TOOL_NAME;
+var isRecord9, SESSION_TOOL_NAME;
 var init_session2 = __esm({
   "../../src/core/harness/opencode/session.ts"() {
     "use strict";
-    isRecord8 = (v) => typeof v === "object" && v !== null;
+    isRecord9 = (v) => typeof v === "object" && v !== null;
     SESSION_TOOL_NAME = { bash: "shell", find: "glob" };
   }
 });
@@ -57391,7 +58317,7 @@ main().then(
 });
 
 // ../../src/core/harness/opencode/process.ts
-import { randomBytes as randomBytes5 } from "node:crypto";
+import { randomBytes as randomBytes6 } from "node:crypto";
 function openCodeRunPaths(runId3) {
   return openCodeRunPathsAt(`${OPENCODE_RUN_ROOT_PREFIX}${runId3}`);
 }
@@ -57574,11 +58500,12 @@ function openCodeLaunchArgs() {
   return ["serve", "--hostname", "127.0.0.1", "--port", PORT_ARG];
 }
 function openCodePassword(bearer) {
-  return bearerHashOf(bearer) ?? randomBytes5(24).toString("base64url");
+  return bearerHashOf(bearer) ?? randomBytes6(24).toString("base64url");
 }
 function openCodeLaunchEnv(spec, bearer, password) {
   const { paths } = spec;
   return {
+    ...spec.environment,
     [RUN_BEARER_ENV]: bearer,
     [HARNESS_URL_ENV]: spec.harnessUrl,
     SWITCHBOARD_RUN_ID: spec.runId,
@@ -57797,7 +58724,7 @@ function openCodeToolNameWord(name) {
 function contentText(content) {
   if (typeof content === "string") return content;
   if (!Array.isArray(content)) return "";
-  return content.filter((p) => isRecord9(p) && p.type === "text" && typeof p.text === "string").map((p) => String(p.text)).join("\n");
+  return content.filter((p) => isRecord10(p) && p.type === "text" && typeof p.text === "string").map((p) => String(p.text)).join("\n");
 }
 function isBudgetRefusal(error) {
   if (error.status !== void 0 && error.status !== 403) return false;
@@ -57867,8 +58794,8 @@ function toolPartsOf(message4) {
   const content = message4.content;
   const parts = [];
   for (const part of Array.isArray(content) ? content : []) {
-    if (!isRecord9(part) || part.type !== "tool") continue;
-    const input = isRecord9(part.state) && isRecord9(part.state.input) ? part.state.input : void 0;
+    if (!isRecord10(part) || part.type !== "tool") continue;
+    const input = isRecord10(part.state) && isRecord10(part.state.input) ? part.state.input : void 0;
     parts.push({ id: str7(part.id), name: str7(part.name), ...input ? { input } : {} });
   }
   return parts;
@@ -57889,7 +58816,7 @@ function assistantMessage2(turn) {
   return {
     role: "assistant",
     content: turn.content.map(
-      (p) => p.type === "text" ? { type: "text", text: p.text } : p.type === "tool_use" ? { type: "toolCall", id: p.id, name: p.name, arguments: isRecord9(p.input) ? p.input : {} } : {}
+      (p) => p.type === "text" ? { type: "text", text: p.text } : p.type === "tool_use" ? { type: "toolCall", id: p.id, name: p.name, arguments: isRecord10(p.input) ? p.input : {} } : {}
     )
   };
 }
@@ -57918,13 +58845,13 @@ function projectStore(messages, seedLength) {
       const content = [];
       const results = [];
       for (const part of Array.isArray(assistant.content) ? assistant.content : []) {
-        if (!isRecord9(part)) continue;
+        if (!isRecord10(part)) continue;
         if (part.type === "text" && typeof part.text === "string") content.push({ type: "text", text: part.text });
         else if (part.type === "tool") {
           const id = str7(part.id);
           const name = openCodeToolNameWord(str7(part.name));
-          const state = isRecord9(part.state) ? part.state : {};
-          content.push({ type: "tool_use", id, name, input: isRecord9(state.input) ? state.input : {} });
+          const state = isRecord10(part.state) ? part.state : {};
+          content.push({ type: "tool_use", id, name, input: isRecord10(state.input) ? state.input : {} });
           if (state.status === "completed" || state.status === "error")
             results.push({
               type: "tool_result",
@@ -57944,13 +58871,13 @@ function projectStore(messages, seedLength) {
   return turns;
 }
 function errorMessage(error) {
-  return isRecord9(error) && typeof error.message === "string" ? error.message : "";
+  return isRecord10(error) && typeof error.message === "string" ? error.message : "";
 }
 function statusOf(error) {
-  return isRecord9(error) && typeof error.status === "number" ? error.status : void 0;
+  return isRecord10(error) && typeof error.status === "number" ? error.status : void 0;
 }
 function errorTypeOf(error) {
-  return isRecord9(error) && typeof error.type === "string" ? error.type : void 0;
+  return isRecord10(error) && typeof error.type === "string" ? error.type : void 0;
 }
 function owedEndNote(how) {
   return `the interrupted execution ended (${how}) while the loop read in its own mode \u2014 before the interrupt's answer, or after the write-up's own start; set aside \u2014 the end the loop-end cut owed, not the write-up's settle`;
@@ -58626,7 +59553,7 @@ async function driveOpenCode(deps, run2, conn, kind = "loop") {
   const answer = ending ? windDownAnswer(ending, run2.agent.maxMinutes) : unlabelledAnswer(text, void 0);
   return { answer, ...ending ? { ending } : {}, remainingMs: remaining, hardStopped: false, ...handOver() };
 }
-var OpenCodeGateBypassedError, OpenCodeReplyFailedError, OpenCodeRequestRefusedError, OpenCodeWriteUnresolvedError, FIRST_EVENT_BOUND_MS, SILENCE_TAIL_BYTES, OpenCodeSilentError, OpenCodeContainerReplacedError, TOOL_NAME_WORD, RESOURCE_PERMISSIONS, isRecord9, str7, TURN_BUDGET_CODE, TURN_BUDGET_REFUSAL, OpenCodeBridge, StepBoundaries, InboxFate;
+var OpenCodeGateBypassedError, OpenCodeReplyFailedError, OpenCodeRequestRefusedError, OpenCodeWriteUnresolvedError, FIRST_EVENT_BOUND_MS, SILENCE_TAIL_BYTES, OpenCodeSilentError, OpenCodeContainerReplacedError, TOOL_NAME_WORD, RESOURCE_PERMISSIONS, isRecord10, str7, TURN_BUDGET_CODE, TURN_BUDGET_REFUSAL, OpenCodeBridge, StepBoundaries, InboxFate;
 var init_bridge3 = __esm({
   "../../src/core/harness/opencode/bridge.ts"() {
     "use strict";
@@ -58719,7 +59646,7 @@ var init_bridge3 = __esm({
     };
     TOOL_NAME_WORD = { shell: "bash", glob: "find" };
     RESOURCE_PERMISSIONS = /* @__PURE__ */ new Set(["external_directory", "doom_loop"]);
-    isRecord9 = (v) => typeof v === "object" && v !== null;
+    isRecord10 = (v) => typeof v === "object" && v !== null;
     str7 = (v) => typeof v === "string" ? v : String(v ?? "");
     TURN_BUDGET_CODE = "turn_budget_exhausted";
     TURN_BUDGET_REFUSAL = new RegExp(`\\b${TURN_BUDGET_CODE}\\b`);
@@ -59199,7 +60126,7 @@ var init_bridge3 = __esm({
           this.noteKindOnce(event.type, `OpenCode emitted ${event.type}, which this run's configuration turns off`);
           return out;
         }
-        const data = isRecord9(event.data) ? event.data : {};
+        const data = isRecord10(event.data) ? event.data : {};
         const earlier2 = this.observing === "earlier";
         if (!earlier2 && event.type !== "session.tool.success" && event.type !== "session.tool.failed" && typeof data.assistantMessageID === "string")
           this.ownSteps.add(data.assistantMessageID);
@@ -59311,7 +60238,7 @@ ${data.text}` : data.text;
         this.openCall(
           callId,
           this.toolNames.get(callId) ?? "tool",
-          foldInputs(this.takeHeldAsks(callId), isRecord9(data.input) ? data.input : void 0)
+          foldInputs(this.takeHeldAsks(callId), isRecord10(data.input) ? data.input : void 0)
         );
       }
       /** The call opened on the record — its span, its `tool_call` with the
@@ -59736,6 +60663,7 @@ async function openOpenCodeRun(deps, run2, settings) {
     ...run2.card ? { card: run2.card } : {},
     identity: identity2,
     system: run2.system,
+    ...run2.environment !== void 0 ? { environment: run2.environment } : {},
     relayTools: run2.tools.map((t) => t.name),
     ...settings.compaction ? { compaction: settings.compaction } : {}
   };
@@ -60463,12 +61391,12 @@ var init_requester = __esm({
 });
 
 // ../../src/channels/http.ts
-import { timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+import { timingSafeEqual as timingSafeEqual4 } from "node:crypto";
 function safeEqual2(a, b) {
   const ab = Buffer.from(a, "utf8");
   const bb = Buffer.from(b, "utf8");
   if (ab.length !== bb.length) return false;
-  return timingSafeEqual3(ab, bb);
+  return timingSafeEqual4(ab, bb);
 }
 function authenticate(headers, config) {
   const header4 = headers.authorization;
@@ -60493,7 +61421,7 @@ async function toIncomingMessage(identity2, body, personByEmail) {
     text: body.text
   };
 }
-function parseBody2(raw) {
+function parseBody3(raw) {
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -60560,7 +61488,7 @@ function requireDispatch(identity2, grantsFor) {
   return { status: 403, body: { error: "forbidden", code: "unauthorized" } };
 }
 async function handleAuthorized(identity2, body, deps, options) {
-  const parsed = parseBody2(body);
+  const parsed = parseBody3(body);
   if ("error" in parsed) {
     return { status: 400, body: { error: parsed.error } };
   }
@@ -60605,9 +61533,9 @@ async function readBody(req, maxBytes) {
 function createIngressHandler(deps, options) {
   const maxBytes = options.maxBodyBytes ?? MAX_BODY_BYTES2;
   const write = (res, status3, body) => {
-    const payload = JSON.stringify(body);
+    const payload2 = JSON.stringify(body);
     res.writeHead(status3, { "content-type": "application/json" });
-    res.end(payload);
+    res.end(payload2);
   };
   return (req, res) => {
     void (async () => {
@@ -60721,6 +61649,16 @@ function refusalResponse(shape, status3, code, message4) {
   const body = shape === "anthropic-messages" ? { type: "error", error } : { error };
   return { status: status3, headers: { "content-type": "application/json" }, body: JSON.stringify(body) };
 }
+function providerFailureResponse(shape, status3, failure2) {
+  const error = authenticateProxyProviderFailure({
+    type: "provider_failure",
+    cause: failure2.cause,
+    message: renderProviderFailure(failure2.cause, providerFailureParks(failure2.cause) ? "parked" : "ended"),
+    ...failure2.schemaRejection !== void 0 ? { schemaRejection: failure2.schemaRejection } : {}
+  });
+  const body = shape === "anthropic-messages" ? { type: "error", error } : { error };
+  return { status: status3, headers: { "content-type": "application/json" }, body: JSON.stringify(body) };
+}
 function header(headers, name) {
   const raw = headers[name];
   return Array.isArray(raw) ? raw[0] : raw;
@@ -60903,10 +61841,140 @@ function shapeTools(shape, body, marks) {
   const shaped = { ...rest, tools: kept };
   return { body: shaped, toolChoice: toolChoiceWord(shape, void 0, kept.length) };
 }
+function responsesRejectsPattern(pattern) {
+  return /\(\?(?:[=!]|<[=!])/.test(pattern);
+}
+function shapeResponsesSchema(value, tool, degradations) {
+  const schema = record(value);
+  if (!schema) {
+    if (!Array.isArray(value)) return { value, changed: false };
+    let changed2 = false;
+    const items = value.map((item) => {
+      const shaped = shapeResponsesSchema(item, tool, degradations);
+      changed2 ||= shaped.changed;
+      return shaped.value;
+    });
+    return { value: changed2 ? items : value, changed: changed2 };
+  }
+  let changed = false;
+  const out = {};
+  for (const [keyword, item] of Object.entries(schema)) {
+    if (keyword === "pattern" && typeof item === "string" && responsesRejectsPattern(item)) {
+      degradations.push({
+        tool,
+        keyword,
+        why: "the Responses wire does not accept regular-expression lookaround"
+      });
+      changed = true;
+      continue;
+    }
+    if ((keyword === "properties" || keyword === "$defs" || keyword === "definitions") && record(item)) {
+      let mapChanged = false;
+      const mapped = {};
+      for (const [name, child] of Object.entries(record(item))) {
+        const shaped = shapeResponsesSchema(child, tool, degradations);
+        mapChanged ||= shaped.changed;
+        mapped[name] = shaped.value;
+      }
+      out[keyword] = mapChanged ? mapped : item;
+      changed ||= mapChanged;
+      continue;
+    }
+    if (["additionalProperties", "allOf", "anyOf", "if", "items", "not", "oneOf", "then", "else"].includes(keyword) && typeof item === "object" && item !== null) {
+      const shaped = shapeResponsesSchema(item, tool, degradations);
+      out[keyword] = shaped.value;
+      changed ||= shaped.changed;
+      continue;
+    }
+    out[keyword] = item;
+  }
+  return { value: changed ? out : value, changed };
+}
+function shapeToolSchemasForWire(shape, body) {
+  if (shape !== "openai-responses" || !Array.isArray(body.tools)) return { body, degradations: [] };
+  const degradations = [];
+  let changed = false;
+  const tools = body.tools.map((item) => {
+    const tool = record(item);
+    if (!tool) return item;
+    const name = typeof tool.name === "string" ? tool.name : "unnamed";
+    const shaped = shapeResponsesSchema(tool.parameters, name, degradations);
+    if (!shaped.changed) return item;
+    changed = true;
+    return { ...tool, parameters: shaped.value };
+  });
+  const unique = degradations.filter(
+    (candidate, index, all) => all.findIndex((other) => other.tool === candidate.tool && other.keyword === candidate.keyword) === index
+  );
+  return { body: changed ? { ...body, tools } : body, degradations: unique };
+}
 function toolNameOf(shape, tool) {
   if (tool === void 0) return void 0;
   return shape === "openai-chat" ? record(tool.function)?.name : tool.name;
 }
+function toolSchemaOf(shape, tool) {
+  if (shape === "anthropic-messages") return tool.input_schema;
+  if (shape === "openai-chat") return record(tool.function)?.parameters;
+  return tool.parameters;
+}
+function schemaKeywords(value, into = /* @__PURE__ */ new Set()) {
+  if (Array.isArray(value)) {
+    for (const item of value) schemaKeywords(item, into);
+    return into;
+  }
+  const schema = record(value);
+  if (!schema) return into;
+  for (const [keyword, item] of Object.entries(schema)) {
+    into.add(keyword);
+    if ((keyword === "properties" || keyword === "$defs" || keyword === "definitions") && record(item)) {
+      for (const child of Object.values(record(item))) schemaKeywords(child, into);
+    } else {
+      schemaKeywords(item, into);
+    }
+  }
+  return into;
+}
+function providerErrorProse(body) {
+  const strings2 = (value, into = []) => {
+    if (typeof value === "string") into.push(value);
+    else if (Array.isArray(value)) for (const item of value) strings2(item, into);
+    else if (record(value)) for (const item of Object.values(record(value))) strings2(item, into);
+    return into;
+  };
+  try {
+    return strings2(JSON.parse(body)).join(" ");
+  } catch {
+    return body;
+  }
+}
+function quoted(text, word) {
+  return [`'${word}'`, `"${word}"`, `\`${word}\``].some((candidate) => text.includes(candidate));
+}
+function providerSchemaRejectionOf2(shape, body, errorBody) {
+  const prose2 = providerErrorProse(errorBody);
+  if (!/(?:invalid|unsupported|refused|rejected)[^.!?]{0,80}(?:json )?schema|(?:json )?schema[^.!?]{0,80}(?:invalid|unsupported|not (?:permitted|supported))/i.test(
+    prose2
+  ))
+    return void 0;
+  const candidates2 = (Array.isArray(body.tools) ? body.tools : []).map((item) => record(item)).filter((item) => item !== void 0).map((tool) => ({ name: toolNameOf(shape, tool), schema: toolSchemaOf(shape, tool) })).filter(
+    (tool) => typeof tool.name === "string" && quoted(prose2, tool.name)
+  );
+  if (candidates2.length !== 1) return void 0;
+  const [candidate] = candidates2;
+  const keywords = [...schemaKeywords(candidate.schema)].filter((keyword) => quoted(prose2, keyword));
+  if (keywords.length !== 1) return void 0;
+  return { tool: candidate.name, keyword: keywords[0] };
+}
+function withSchemaRejection(failure2, schemaRejection) {
+  return new ProviderFailure(failure2.cause, {
+    ...failure2.status !== void 0 ? { status: failure2.status } : {},
+    ...failure2.provider !== void 0 ? { provider: failure2.provider } : {},
+    ...failure2.model !== void 0 ? { model: failure2.model } : {},
+    ...failure2.operatorUrl !== void 0 ? { operatorUrl: failure2.operatorUrl } : {},
+    ...failure2.keyVariable !== void 0 ? { keyVariable: failure2.keyVariable } : {},
+    schemaRejection
+  });
+}
 function toolsOffered(shape, body) {
   const table = Array.isArray(body.tools) ? body.tools : [];
   const names = [];
@@ -61051,8 +62119,15 @@ async function handleAdmitted(door, req, deps) {
     req.headers
   );
   if (!upstream.ok) {
-    log(`[model-proxy] 503 ${upstream.code} run=${grant2.runId}`);
-    return refusalResponse(shape, 503, upstream.code, upstream.message);
+    const provider = deps.providers()[grant2.providerName];
+    const keyVariable = provider?.apiKeyEnv ?? (shape === "anthropic-messages" ? ANTHROPIC_API_KEY_ENV : void 0);
+    const failure2 = new ProviderFailure(upstream.code === "provider_key_missing" ? "key-absent" : "permanent", {
+      provider: grant2.providerName,
+      model: grant2.model,
+      ...upstream.code === "provider_key_missing" && keyVariable !== void 0 ? { keyVariable } : {}
+    });
+    log(`[model-proxy] 503 ${upstream.code} run=${grant2.runId} \u2014 ${failure2.message}`);
+    return providerFailureResponse(shape, 503, failure2);
   }
   const turn = deps.bearers.consumeTurn(grant2.runId);
   if (!turn.ok && turn.reason === "ended") {
@@ -61076,7 +62151,21 @@ async function handleAdmitted(door, req, deps) {
     );
   }
   const shaped = shapeTools(shape, body, deps.bearers.marksOf(grant2.runId));
-  const payload = JSON.stringify(pinRequest(shape, shaped.body, grant2));
+  const schemaShaped = shapeToolSchemasForWire(shape, shaped.body);
+  for (const degradation of schemaShaped.degradations) {
+    grant2.publish({
+      type: "run_note",
+      kind: "control_degraded",
+      control: "tool_schema",
+      asked: `${degradation.tool}.${degradation.keyword}`,
+      applied: "removed",
+      vouched: true,
+      why: degradation.why,
+      summary: `tool "${degradation.tool}" schema keyword "${degradation.keyword}" removed for ${shape}: ${degradation.why}`,
+      at: deps.clock()
+    });
+  }
+  const payload2 = JSON.stringify(pinRequest(shape, schemaShaped.body, grant2));
   const offered = { ...toolsOffered(shape, body), toolChoice: shaped.toolChoice };
   const startedAt = deps.clock();
   const span = grant2.span.start("model.turn", {
@@ -61098,47 +62187,72 @@ async function handleAdmitted(door, req, deps) {
     meter2.usage,
     deps.prices?.() ?? NO_PRICES
   );
-  const outcome = (status3, outBytes) => `[model-proxy] run=${grant2.runId} turn=${turn.turn}/${grant2.maxTurns} ${shape} \u2192 ${status3} in=${Buffer.byteLength(payload)} out=${outBytes} ${Math.max(0, deps.clock() - startedAt)}ms`;
+  const outcome = (status3, outBytes) => `[model-proxy] run=${grant2.runId} turn=${turn.turn}/${grant2.maxTurns} ${shape} \u2192 ${status3} in=${Buffer.byteLength(payload2)} out=${outBytes} ${Math.max(0, deps.clock() - startedAt)}ms`;
   const call2 = () => (deps.fetch ?? fetch)(upstream.url, {
     method: "POST",
     headers: upstream.headers,
-    body: payload,
+    body: payload2,
     ...req.signal ? { signal: req.signal } : {}
   });
-  const providerDown = () => {
-    deps.plane?.level(grant2.providerName, "down");
+  const providerDown = (failure2) => {
+    deps.plane?.level(grant2.providerName, "down", failure2.cause);
     deps.plane?.park(grant2.runId, grant2.providerName);
   };
   const aborted = () => req.signal?.aborted === true;
-  const retryable = (answer) => {
-    if (answer === void 0) return true;
-    if (answer.status === 408 || answer.status === 425 || answer.status === 429 || answer.status >= 500) return true;
-    return (answer.headers.get("content-type") ?? "").toLowerCase().includes("text/html");
+  const failureOf2 = async (answer, thrown2) => {
+    if (answer === void 0)
+      return classifyProviderFailure({ error: thrown2 ?? new Error("fetch failed"), provider: grant2.providerName });
+    const contentType2 = (answer.headers.get("content-type") ?? "").toLowerCase();
+    if (answer.ok && !contentType2.includes("text/html")) return void 0;
+    const failureBody = await answer.clone().text().catch(() => "");
+    const failure2 = classifyProviderFailure({
+      status: answer.status,
+      body: failureBody,
+      provider: grant2.providerName,
+      model: grant2.model
+    });
+    const schemaRejection = answer.status === 400 && failure2.cause === "request-rejected" ? providerSchemaRejectionOf2(shape, schemaShaped.body, failureBody) : void 0;
+    return schemaRejection !== void 0 ? withSchemaRejection(failure2, schemaRejection) : failure2;
   };
   let res;
-  let failure2;
+  let thrown;
   try {
     res = await call2();
   } catch (err2) {
-    failure2 = err2;
+    thrown = err2;
   }
-  if (retryable(res) && !aborted()) {
-    const retried = await call2().catch(() => void 0);
+  let providerFailure = await failureOf2(res, thrown);
+  if (providerFailure !== void 0 && providerFailureParks(providerFailure.cause) && !aborted()) {
+    let retried;
+    let retryThrown;
+    try {
+      retried = await call2();
+    } catch (err2) {
+      retryThrown = err2;
+    }
     if (retried !== void 0) res = retried;
-  }
-  if (retryable(res) && !aborted()) providerDown();
-  if (res === void 0 || (res.headers.get("content-type") ?? "").toLowerCase().includes("text/html")) {
-    span.fail(failure2 ?? new Error("upstream unreachable"));
+    providerFailure = await failureOf2(retried ?? res, retryThrown ?? thrown);
+  }
+  if (providerFailure !== void 0 && providerFailureParks(providerFailure.cause) && !aborted())
+    providerDown(providerFailure);
+  const html = (res?.headers.get("content-type") ?? "").toLowerCase().includes("text/html");
+  if (res === void 0 || html) {
+    const failure2 = providerFailure ?? classifyProviderFailure({ error: thrown, provider: grant2.providerName });
+    span.fail(failure2);
     span.end("error");
     log(`[model-proxy] run=${grant2.runId} turn=${turn.turn}/${grant2.maxTurns} ${shape} \u2192 upstream unreachable`);
-    return refusalResponse(shape, 502, "upstream_unreachable", "the model provider did not answer");
+    return providerFailureResponse(shape, 502, failure2);
   }
   const headers = pickResponseHeaders(res.headers);
   if (!res.ok) {
     const text2 = await res.text().catch(() => "");
+    const failure2 = providerFailure ?? classifyProviderFailure({ status: res.status, body: text2, provider: grant2.providerName, model: grant2.model });
     span.end("error", { httpStatus: res.status });
     log(outcome(res.status, text2.length));
-    return { status: res.status, headers, body: text2 };
+    return {
+      ...providerFailureResponse(shape, res.status, failure2),
+      headers: { ...headers, "content-type": "application/json" }
+    };
   }
   deps.plane?.level(grant2.providerName, "up");
   const contentType = res.headers.get("content-type") ?? "";
@@ -61161,7 +62275,9 @@ async function handleAdmitted(door, req, deps) {
         log(outcome(res.status, outBytes));
       },
       onError: (err2) => {
-        providerDown();
+        providerDown(
+          classifyProviderFailure({ status: 503, error: err2, provider: grant2.providerName, model: grant2.model })
+        );
         const result = meter2.result();
         span.setAttrs(
           turnAttrs(grant2, result, firstAt !== void 0 ? firstAt - startedAt : void 0, offered, priceOf2(result))
@@ -61200,10 +62316,12 @@ function createModelProxyHandler(deps) {
     ...deps,
     plane: {
       ...deps.plane,
-      level: (provider, side) => {
-        if (lastSide.get(provider) === side) return;
-        lastSide.set(provider, side);
-        deps.plane?.level(provider, side);
+      level: (provider, side, cause) => {
+        const report2 = side === "down" ? `${side}:${cause ?? "permanent"}` : side;
+        if (lastSide.get(provider) === report2) return;
+        lastSide.set(provider, report2);
+        if (side === "down") deps.plane?.level(provider, side, cause ?? "permanent");
+        else deps.plane?.level(provider, side);
       }
     }
   } : deps;
@@ -61267,6 +62385,7 @@ var init_modelProxy = __esm({
   "../../src/channels/modelProxy.ts"() {
     "use strict";
     init_budgets();
+    init_providerFailureAuth();
     init_usage();
     init_modelPricing();
     init_provider();
@@ -61636,13 +62755,13 @@ var init_secretStore = __esm({
       describe() {
         return `state Worker ${this.baseUrl} (ConfigDO secrets)`;
       }
-      async post(path, payload) {
+      async post(path, payload2) {
         let res;
         try {
           res = await this.fetchImpl(`${this.baseUrl}${path}`, {
             method: "POST",
             headers: { authorization: `Bearer ${this.opts.token}`, "content-type": "application/json" },
-            body: JSON.stringify(payload),
+            body: JSON.stringify(payload2),
             signal: AbortSignal.timeout(MCP_SECRET_WORKER_TIMEOUT_MS)
           });
         } catch (err2) {
@@ -61880,7 +62999,7 @@ function configRefusalReason(error) {
   return raw.replace(/^SWITCHBOARD_CONFIG=state:\/\/[^:]+:\s*/, "").slice(0, 1e3);
 }
 function createConfigRefusalServer(opts) {
-  const payload = {
+  const payload2 = {
     ok: false,
     config: opts.problem,
     inFlight: 0,
@@ -61890,7 +63009,7 @@ function createConfigRefusalServer(opts) {
   return createServer2((req, res) => {
     if (new URL(req.url ?? "/", "http://switchboard.invalid").pathname === "/healthz") {
       res.writeHead(503, { "content-type": "application/json" });
-      res.end(JSON.stringify(payload));
+      res.end(JSON.stringify(payload2));
       return;
     }
     res.writeHead(503, { "content-type": "text/plain" });
@@ -61989,7 +63108,14 @@ async function decideIntake(input, deps) {
     } catch (err2) {
       console.warn(`[intake] ${input.key}: receipt read failed \u2014 ${messageOf(err2)}; deciding as if none`);
     }
-    if (row3) return { verdict: row3.verdict, reason: row3.reason, source: row3.source, receipt: "existing" };
+    if (row3)
+      return {
+        verdict: row3.verdict,
+        reason: row3.reason,
+        source: row3.source,
+        receipt: "existing",
+        ...row3.providerFailure !== void 0 ? { providerFailure: row3.providerFailure } : {}
+      };
   }
   const decided = input.facts.pendingQuestion === true ? {
     verdict: "addressed",
@@ -62012,7 +63138,13 @@ async function decideIntake(input, deps) {
   try {
     const { inserted, stored } = await deps.ledger.recordIntake(input.key, row2);
     if (inserted) return { ...decided, receipt: "inserted" };
-    return { verdict: stored.verdict, reason: stored.reason, source: stored.source, receipt: "existing" };
+    return {
+      verdict: stored.verdict,
+      reason: stored.reason,
+      source: stored.source,
+      receipt: "existing",
+      ...stored.providerFailure !== void 0 ? { providerFailure: stored.providerFailure } : {}
+    };
   } catch (err2) {
     console.warn(`[intake] ${input.key}: receipt write failed \u2014 ${messageOf(err2)}; acting on the verdict anyway`);
     return { ...decided, receipt: "failed" };
@@ -62038,10 +63170,20 @@ async function askModel(input, deps) {
   } catch (err2) {
     const timedOut = err2 instanceof Error && (err2.name === "TimeoutError" || err2.name === "AbortError");
     const attempts = attemptsOfThrow(err2);
+    if (timedOut) {
+      return {
+        verdict: "silent",
+        reason: tidyReason("the intake call timed out"),
+        source: "timeout",
+        ...attempts ? { attempts } : {}
+      };
+    }
+    const failure2 = providerFailureOf(err2);
     return {
       verdict: "silent",
-      reason: tidyReason(timedOut ? "the intake call timed out" : `intake model failed: ${messageOf(err2)}`),
-      source: timedOut ? "timeout" : "error",
+      reason: renderProviderFailure(failure2.cause, "ended"),
+      source: "error",
+      providerFailure: failure2.cause,
       ...attempts ? { attempts } : {}
     };
   }
@@ -62132,6 +63274,7 @@ var INTAKE_TOOL_NAME, INTAKE_ANSWERS;
 var init_intake = __esm({
   "../../src/core/intake.ts"() {
     "use strict";
+    init_provider();
     init_redact();
     init_structured();
     init_untrusted();
@@ -62367,23 +63510,23 @@ async function fetchImages(files, maxImages, maxTotalBytes = Infinity) {
   const skipped = [];
   const skippedFiles = [];
   let bytes = 0;
-  const candidates = [];
+  const candidates2 = [];
   for (const f of files ?? []) {
     const label = fileLabel(f);
     const url = f.url_private_download ?? f.url_private;
-    if (!url || !f.mimetype || !IMAGE_TYPES2.has(f.mimetype) || (f.size ?? 0) > MAX_IMAGE_BYTES || candidates.length >= maxImages) {
+    if (!url || !f.mimetype || !IMAGE_TYPES2.has(f.mimetype) || (f.size ?? 0) > MAX_IMAGE_BYTES || candidates2.length >= maxImages) {
       skipped.push(label);
       skippedFiles.push(f);
       continue;
     }
-    candidates.push({ f, label, url, mediaType: f.mimetype });
+    candidates2.push({ f, label, url, mediaType: f.mimetype });
   }
   const downloads = await Promise.all(
-    candidates.map(
+    candidates2.map(
       ({ url, label }) => downloadSlackFile(url, label, (contentType) => contentType.includes("text/html"))
     )
   );
-  candidates.forEach(({ f, label, mediaType }, i) => {
+  candidates2.forEach(({ f, label, mediaType }, i) => {
     const buf2 = downloads[i];
     if (!buf2 || buf2.byteLength > MAX_IMAGE_BYTES || bytes + buf2.byteLength > maxTotalBytes) {
       skipped.push(label);
@@ -62429,24 +63572,24 @@ async function fetchDocuments(files, maxDocs, maxTotalBytes = Infinity) {
   const skipped = [];
   const skippedFiles = [];
   let bytes = 0;
-  const candidates = [];
+  const candidates2 = [];
   for (const f of files ?? []) {
     const label = fileLabel(f);
     const url = f.url_private_download ?? f.url_private;
     const kind = classifyDocument(f.mimetype, f.name);
-    if (!url || !kind || (f.size ?? 0) > MAX_DOCUMENT_BYTES || candidates.length >= maxDocs) {
+    if (!url || !kind || (f.size ?? 0) > MAX_DOCUMENT_BYTES || candidates2.length >= maxDocs) {
       skipped.push(label);
       skippedFiles.push(f);
       continue;
     }
-    candidates.push({ f, label, url, kind });
+    candidates2.push({ f, label, url, kind });
   }
   const downloads = await Promise.all(
-    candidates.map(
+    candidates2.map(
       ({ url, label, f }) => downloadSlackFile(url, label, (contentType) => contentType.includes("text/html") && f.mimetype !== "text/html")
     )
   );
-  candidates.forEach(({ f, label, kind }, i) => {
+  candidates2.forEach(({ f, label, kind }, i) => {
     const buf2 = downloads[i];
     if (!buf2 || buf2.byteLength > MAX_DOCUMENT_BYTES || bytes + buf2.byteLength > maxTotalBytes) {
       skipped.push(label);
@@ -63133,6 +64276,7 @@ var init_slackSocketStatus = __esm({
 });
 
 // ../../src/channels/slack.ts
+import { randomUUID as randomUUID5 } from "node:crypto";
 import {
   App,
   SocketModeReceiver,
@@ -63210,6 +64354,17 @@ function createSlackApp(deps, intake) {
               const act = await actOnMissedMessage(m, {
                 botUserId: id,
                 ...intake ? { intake } : {},
+                reply: async (text) => {
+                  await new SlackIO(app.client, {
+                    channel: m.channel,
+                    user: m.user,
+                    text: m.text,
+                    ts: m.ts,
+                    threadTs: m.threadTs,
+                    botUserId: id,
+                    trigger: "thread-follow-up"
+                  }).reply(text);
+                },
                 dispatch: (extra) => {
                   void handle(
                     deps,
@@ -63318,6 +64473,59 @@ function catchUpDelayNote(messageTs, nowMs) {
   const late = mins < 1 ? "under a minute" : `${mins} min`;
   return `\u23F1 Picked up ${late} after it was posted: the bot was restarting (a deploy or platform move) and Slack does not queue events while it is down. Handling it now \u2014 no need to re-send.`;
 }
+async function deliverIntakeFailure(opts) {
+  if (opts.reply === void 0 || opts.receipt === "existing" && !opts.allowExisting) return;
+  const postWithoutReceipt = async () => {
+    try {
+      await opts.reply(opts.reason);
+    } catch (err2) {
+      opts.failed(err2);
+    }
+  };
+  if (opts.receipt === "failed" || opts.receipt === "absent") {
+    await postWithoutReceipt();
+    return;
+  }
+  const ledger = opts.ledger;
+  if (ledger?.claimIntakeDelivery === void 0 || ledger.finishIntakeDelivery === void 0) {
+    if (opts.receipt === "existing") return;
+    await postWithoutReceipt();
+    return;
+  }
+  let claimed2;
+  try {
+    claimed2 = await ledger.claimIntakeDelivery(opts.key, opts.poster, opts.claimedAt);
+  } catch (err2) {
+    opts.failed(err2);
+    return;
+  }
+  if (!claimed2) return;
+  const alreadyPosted = opts.botUserId !== void 0 && opts.thread.some((message4) => message4.user === opts.botUserId && message4.text === opts.reason);
+  if (alreadyPosted) {
+    try {
+      await ledger.finishIntakeDelivery(opts.key, opts.poster, true);
+    } catch (err2) {
+      opts.failed(err2);
+    }
+    return;
+  }
+  try {
+    await opts.reply(opts.reason);
+  } catch (err2) {
+    try {
+      await ledger.finishIntakeDelivery(opts.key, opts.poster, false);
+    } catch (finishErr) {
+      opts.failed(finishErr);
+    }
+    opts.failed(err2);
+    return;
+  }
+  try {
+    await ledger.finishIntakeDelivery(opts.key, opts.poster, true);
+  } catch (err2) {
+    opts.failed(err2);
+  }
+}
 async function actOnMissedMessage(m, opts) {
   const log = opts.log ?? ((line4) => console.log(line4));
   const seen = opts.seen ?? { was: wasHandledHere, mark: markHandledHere };
@@ -63343,6 +64551,20 @@ async function actOnMissedMessage(m, opts) {
       if (row2) {
         decided = true;
         silent = row2.verdict === "silent";
+        if (row2.providerFailure !== void 0)
+          await deliverIntakeFailure({
+            key,
+            receipt: "existing",
+            allowExisting: true,
+            ledger: intake.deps.ledger,
+            claimedAt: intake.deps.now(),
+            poster: `${PLATFORM3}:${opts.botUserId}:${intake.gen}:${randomUUID5()}`,
+            reason: row2.reason,
+            thread: m.thread,
+            botUserId: opts.botUserId,
+            ...opts.reply ? { reply: opts.reply } : {},
+            failed: (err2) => log(`[catch-up] ${key}: provider failure could not be rendered \u2014 ${describeError3(err2)}`)
+          });
         if (silent) log(`[catch-up] ${key}: silenced by its stored receipt (${row2.source}): ${row2.reason}`);
       } else {
         const page2 = m.thread;
@@ -63368,6 +64590,20 @@ async function actOnMissedMessage(m, opts) {
         log(
           `[intake] ${key} ${decision.verdict} (${decision.source}, receipt ${decision.receipt}): ${decision.reason} \u2014 decided at catch-up`
         );
+        if (decision.providerFailure !== void 0)
+          await deliverIntakeFailure({
+            key,
+            receipt: decision.receipt,
+            allowExisting: true,
+            ledger: intake.deps.ledger,
+            claimedAt: intake.deps.now(),
+            poster: `${PLATFORM3}:${opts.botUserId}:${intake.gen}:${randomUUID5()}`,
+            reason: decision.reason,
+            thread: m.thread,
+            botUserId: opts.botUserId,
+            ...opts.reply ? { reply: opts.reply } : {},
+            failed: (err2) => log(`[catch-up] ${key}: provider failure could not be rendered \u2014 ${describeError3(err2)}`)
+          });
         decided = true;
         silent = decision.verdict !== "addressed";
       }
@@ -63585,6 +64821,28 @@ async function gateThreadReply(client, ev, span, intake, mode, threadKey) {
     intake.deps
   );
   span.setAttrs({ intake: decision.verdict, intakeSource: decision.source, intakeReceipt: decision.receipt });
+  if (decision.providerFailure !== void 0) {
+    const key = `${ev.channel}:${ev.ts}`;
+    await deliverIntakeFailure({
+      key,
+      receipt: decision.receipt,
+      allowExisting: false,
+      ledger: intake.deps.ledger,
+      claimedAt: intake.deps.now(),
+      poster: `${PLATFORM3}:${ev.botUserId ?? "unknown"}:${intake.gen}:${randomUUID5()}`,
+      reason: decision.reason,
+      thread: page2,
+      botUserId: ev.botUserId,
+      reply: (text) => new SlackIO(client, ev).reply(text),
+      failed: (err2) => console.error(
+        `[intake] ${key} provider failure could not be rendered \u2014 ${err2 instanceof Error ? err2.message : String(err2)}`
+      )
+    });
+    console.log(
+      `[intake] ${ev.channel}:${ev.ts} ${decision.verdict} (${decision.source}, receipt ${decision.receipt}): ${decision.reason}`
+    );
+    return { proceed: false };
+  }
   if (decision.verdict !== "addressed" || decision.receipt === "existing") {
     console.log(
       `[intake] ${ev.channel}:${ev.ts} ${decision.verdict} (${decision.source}, receipt ${decision.receipt}): ${decision.reason}`
@@ -64616,9 +65874,9 @@ function createMcpHandler(deps, options) {
       res.end();
       return;
     }
-    const payload = JSON.stringify(body);
+    const payload2 = JSON.stringify(body);
     res.writeHead(status3, { "content-type": "application/json" });
-    res.end(payload);
+    res.end(payload2);
   };
   return (req, res) => {
     void (async () => {
@@ -64835,29 +66093,29 @@ async function verifyAccessJwt(token2, config, deps) {
   if (parts.length !== 3) return null;
   const [rawHeader, rawPayload, rawSignature] = parts;
   const header4 = decodeJsonSegment(rawHeader);
-  const payload = decodeJsonSegment(rawPayload);
-  if (!header4 || !payload) return null;
+  const payload2 = decodeJsonSegment(rawPayload);
+  if (!header4 || !payload2) return null;
   if (header4.alg !== "RS256") return null;
   if (typeof header4.kid !== "string" || header4.kid === "") return null;
-  const signature = decodeBase64Url(rawSignature);
-  if (!signature) return null;
+  const signature2 = decodeBase64Url(rawSignature);
+  if (!signature2) return null;
   const jwk = await resolveKey(header4.kid, config, deps);
   if (!jwk) return null;
   let signatureOk;
   try {
     const key = createPublicKey({ format: "jwk", key: jwk });
-    signatureOk = cryptoVerify("RSA-SHA256", Buffer.from(`${rawHeader}.${rawPayload}`), key, signature);
+    signatureOk = cryptoVerify("RSA-SHA256", Buffer.from(`${rawHeader}.${rawPayload}`), key, signature2);
   } catch {
     return null;
   }
   if (!signatureOk) return null;
-  if (!claimsValid(payload, config, deps.now())) return null;
-  if (typeof payload.sub !== "string" || payload.sub === "") {
-    return { sub: "", commonName: payload.common_name };
+  if (!claimsValid(payload2, config, deps.now())) return null;
+  if (typeof payload2.sub !== "string" || payload2.sub === "") {
+    return { sub: "", commonName: payload2.common_name };
   }
   return {
-    sub: payload.sub,
-    email: typeof payload.email === "string" ? payload.email : void 0
+    sub: payload2.sub,
+    email: typeof payload2.email === "string" ? payload2.email : void 0
   };
 }
 function normalizeTeamDomain(raw) {
@@ -66524,7 +67782,7 @@ var init_residentsView = __esm({
 });
 
 // ../../src/channels/web.ts
-import { randomBytes as randomBytes6 } from "node:crypto";
+import { randomBytes as randomBytes7 } from "node:crypto";
 function parseThreadsRoute(pathname) {
   if (pathname === "/threads" || pathname === "/threads/") return { kind: "new" };
   const m = /^\/threads\/([^/]+)(\/send)?\/?$/.exec(pathname);
@@ -66539,7 +67797,7 @@ function parseThreadsRoute(pathname) {
   return m[2] ? { kind: "send", id } : { kind: "thread", id };
 }
 function mintConversationId() {
-  return randomBytes6(CONVERSATION_ID_BYTES).toString("hex");
+  return randomBytes7(CONVERSATION_ID_BYTES).toString("hex");
 }
 function threadKeyFor(sub, id) {
   return id.includes(":") ? id : `${PLATFORM5}:${sub}:${id}`;
@@ -67911,7 +69169,7 @@ var init_installationSettings = __esm({
 });
 
 // ../../src/channels/dashboardAuth.ts
-import { createHash as createHash5, timingSafeEqual as timingSafeEqual4 } from "node:crypto";
+import { createHash as createHash5, timingSafeEqual as timingSafeEqual5 } from "node:crypto";
 function header3(headers, name) {
   const raw = headers[name];
   return Array.isArray(raw) ? raw[0] : raw;
@@ -67931,7 +69189,7 @@ function accessVerifier(config, deps) {
 function secretsEqual(a, b) {
   const ha = createHash5("sha256").update(a).digest();
   const hb = createHash5("sha256").update(b).digest();
-  return timingSafeEqual4(ha, hb);
+  return timingSafeEqual5(ha, hb);
 }
 function tokenVerifier(opts) {
   return {
@@ -68311,41 +69569,41 @@ function readBuildInfo(path, read = (p) => readFileSync19(p, "utf8")) {
   }
 }
 function healthPayload(state) {
-  const payload = {
+  const payload2 = {
     ok: true,
     inFlight: state.inFlight,
     draining: state.draining,
     drainDeadlineMs: DRAIN_DEADLINE_MS
   };
   if (state.draining && state.drainStartedAt !== void 0) {
-    payload.drainStartedAt = new Date(state.drainStartedAt).toISOString();
+    payload2.drainStartedAt = new Date(state.drainStartedAt).toISOString();
   }
   if (state.draining && state.held && state.held.length > 0) {
-    payload.held = state.held.map((r) => ({ id: r.id, why: r.why }));
+    payload2.held = state.held.map((r) => ({ id: r.id, why: r.why }));
   }
   if (state.catchUp) {
     const catchUp = {};
     for (const [k, v] of Object.entries(state.catchUp)) if (v !== void 0) catchUp[k] = v;
-    payload.catchUp = catchUp;
+    payload2.catchUp = catchUp;
   }
   if (state.slack) {
-    payload.slack = {
+    payload2.slack = {
       connected: state.slack.connected,
       ...state.slack.since !== void 0 ? { since: state.slack.since } : {},
       ...state.slack.connects !== void 0 ? { connects: state.slack.connects } : {}
     };
   }
   if (state.build)
-    payload.build = {
+    payload2.build = {
       commit: state.build.commit,
       ...state.build.builtAt !== void 0 ? { builtAt: state.build.builtAt } : {}
     };
-  if (state.generation !== void 0) payload.generation = state.generation;
-  if (state.startedAt !== void 0) payload.startedAt = new Date(state.startedAt).toISOString();
-  if (state.httpListeningAt !== void 0) payload.httpListeningAt = new Date(state.httpListeningAt).toISOString();
-  if (state.process) payload.process = { ...state.process };
-  if (state.artifacts) payload.artifacts = { bucket: state.artifacts.bucket };
-  return payload;
+  if (state.generation !== void 0) payload2.generation = state.generation;
+  if (state.startedAt !== void 0) payload2.startedAt = new Date(state.startedAt).toISOString();
+  if (state.httpListeningAt !== void 0) payload2.httpListeningAt = new Date(state.httpListeningAt).toISOString();
+  if (state.process) payload2.process = { ...state.process };
+  if (state.artifacts) payload2.artifacts = { bucket: state.artifacts.bucket };
+  return payload2;
 }
 var UNKNOWN_BUILD;
 var init_health = __esm({
@@ -69434,13 +70692,14 @@ async function contractFor(instance, unit, readers) {
       break;
     }
   }
-  return contractFromPlan({
+  const contract = contractFromPlan({
     ...source2,
     readSpec: (spec) => specs.get(spec),
     ...agentRules ? { agentRules } : {},
     rebase,
     ...issue ? { issue } : {}
   });
+  return unit.record !== void 0 ? { ...contract, record: unit.record } : contract;
 }
 async function continuationPreface(cont, unit, readers) {
   const previous = cont.previousRunId !== void 0 ? await readers.readRunFacts(cont.previousRunId) : void 0;
@@ -69486,9 +70745,12 @@ async function composeChild(brief, instance, unit, readers) {
     case "contract": {
       const contract = await contractFor(instance, unit, readers);
       const task = isGenerated(instance) ? contract.unit.section.split("\n").slice(1).join("\n").trim() : `Implement unit ${contract.unit.id} \u2014 ${contract.unit.title} \u2014 of ${instance.plan?.path ?? "the plan"}: the contract below is the unit. Do its first instruction first, then add every test scenario it lists, update every spec row it names and weaken no guard.`;
-      const prompt = brief.continue !== void 0 ? `${await continuationPreface(brief.continue, unit, readers)}
+      const work = unit.record !== void 0 ? `record: ${unit.record}
 
 ${task}` : task;
+      const prompt = brief.continue !== void 0 ? `${await continuationPreface(brief.continue, unit, readers)}
+
+${work}` : work;
       return { preset: "coding", prompt, ref: unit.branch, contract };
     }
     case "review": {
@@ -69834,6 +71096,7 @@ function watched(io, on) {
   if (io.attachFile) out.attachFile = (file) => io.attachFile(file);
   if (io.uploadTicket) out.uploadTicket = (file) => io.uploadTicket(file);
   if (io.runFinished) out.runFinished = (receipt) => io.runFinished(receipt);
+  if (io.requestFailed) out.requestFailed = () => io.requestFailed();
   if (io.openThread) out.openThread = (lead) => io.openThread(lead);
   return out;
 }
@@ -70014,12 +71277,18 @@ function coordinatorRunView(view, parentInstanceId, finalReply) {
     parentInstanceId,
     ...view.idempotencyKey !== void 0 ? { idempotencyKey: view.idempotencyKey } : {},
     ...view.ownerGen !== void 0 ? { ownerGen: view.ownerGen } : {},
-    ...finalReply !== void 0 ? { finalReply } : {}
+    ...finalReply !== void 0 ? { finalReply } : {},
+    ...view.headSha !== void 0 ? { headSha: view.headSha } : {}
   };
 }
 function prOpenedOf(events) {
   const last = [...events ?? []].reverse().find((e) => e.type === "pr_opened");
-  return last && last.type === "pr_opened" ? { number: last.number, url: last.url, created: last.created } : void 0;
+  return last && last.type === "pr_opened" ? {
+    number: last.number,
+    url: last.url,
+    created: last.created,
+    ...last.head !== void 0 ? { head: last.head } : {}
+  } : void 0;
 }
 async function reviewPostedAt(deps, pr, verdict, head) {
   const [reviews, self] = await Promise.all([
@@ -70065,25 +71334,25 @@ async function postedHumanGateAnswer(deps, pr, requester, addressSeverity) {
   if (own === void 0) return void 0;
   const marker = /<!-- switchboard:verdict (\{[^\n]*\}) -->/.exec(own.body);
   if (marker === null) return void 0;
-  let payload;
+  let payload2;
   try {
-    payload = JSON.parse(marker[1]);
+    payload2 = JSON.parse(marker[1]);
   } catch {
     return void 0;
   }
-  if (typeof payload !== "object" || payload === null) return void 0;
-  const row2 = payload;
+  if (typeof payload2 !== "object" || payload2 === null) return void 0;
+  const row2 = payload2;
   if (row2.verdict !== "approve" && row2.verdict !== "request_changes") return void 0;
   if (!Array.isArray(row2.findings)) return void 0;
   const postedFindings = row2.findings.map((finding) => legacyPostedFinding(finding, own.body));
   if (!postedFindings.every((finding) => finding !== void 0)) return void 0;
   const findings = row2.verdict === "approve" ? findingsAtOrAbove(postedFindings, addressSeverity) : postedFindings;
   if (findings.length === 0 || !findings.every((finding) => finding.humanGated === true)) return void 0;
-  const candidates = comments.filter(
+  const candidates2 = comments.filter(
     (comment) => comment.author.type === "User" && comment.body.trim() !== "" && Number.isFinite(Date.parse(comment.createdAt)) && Date.parse(comment.createdAt) >= githubSecondStart(Date.parse(own.submittedAt))
   ).sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt));
   let answer;
-  for (const candidate of candidates) {
+  for (const candidate of candidates2) {
     const authorized = await deps.commenterAuthorized(requester, candidate.author).catch(() => false);
     if (authorized) {
       answer = candidate;
@@ -70117,6 +71386,44 @@ function reviewPostedByRecord(record2, pr) {
   const same = post.target.repo === pr.repo && post.target.number === pr.number && sameCommit(post.head.toLowerCase(), record2.reviewHead) && post.verdict === record2.verdict.verdict;
   return same ? { reviewPosted: true } : void 0;
 }
+function headBranchStateUnknown(facts2) {
+  return facts2.state === "open" && facts2.headBranchExists === void 0;
+}
+function headBranchStateError(repo, number) {
+  return `could not verify whether ${repo}#${number}'s head branch exists`;
+}
+function pullRequestState(number, fallbackUrl, facts2) {
+  if (headBranchStateUnknown(facts2)) return void 0;
+  const url = facts2.htmlUrl ?? fallbackUrl;
+  if (facts2.mergedAt !== void 0 && facts2.mergeCommitSha !== void 0)
+    return {
+      state: "merged",
+      prNumber: number,
+      url,
+      sha: facts2.mergeCommitSha,
+      mergedAt: facts2.mergedAt,
+      ...facts2.mergedBy !== void 0 ? { mergedBy: facts2.mergedBy } : {}
+    };
+  if (facts2.state === "closed")
+    return { state: "closed", prNumber: number, url, closedBy: facts2.closedBy ?? "unknown GitHub user" };
+  return {
+    state: "open",
+    prNumber: number,
+    url,
+    ...facts2.headSha !== void 0 ? { headSha: facts2.headSha } : {},
+    ...facts2.headBranchExists !== void 0 ? { headBranchExists: facts2.headBranchExists } : {}
+  };
+}
+async function childPullRequestState(deps, instance, unit) {
+  if (instance == null || unit === void 0) return void 0;
+  const row2 = (await deps.instances.listUnits(instance.id)).find((candidate) => candidate.unit === unit);
+  if (row2?.pr === void 0) return void 0;
+  const facts2 = await deps.fetchPrFacts({ repo: instance.repo, number: row2.pr.number });
+  if (facts2 === void 0) throw new Error(`could not read ${instance.repo}#${row2.pr.number}`);
+  const state = pullRequestState(row2.pr.number, row2.pr.url, facts2);
+  if (state === void 0) throw new Error(headBranchStateError(instance.repo, row2.pr.number));
+  return state;
+}
 async function readRecord(body, deps) {
   const id = parseInstanceId(body.parentInstanceId);
   if (!id.ok) return json3(400, { ok: false, error: id.error });
@@ -70128,13 +71435,35 @@ async function readRecord(body, deps) {
   const res = await deps.runs.getRun(body.runId);
   if (!res.ok || res.value.parentInstanceId !== id.value) return json3(404, { ok: false, error: "not_found" });
   const view = res.value;
-  if (!view.finished) return json3(200, { ok: true, run: coordinatorRunView(view, id.value, void 0), at });
+  const instanceRow = await deps.instances.get(id.value);
+  let pullRequest;
+  try {
+    pullRequest = await childPullRequestState(deps, instanceRow, typeof body.unit === "string" ? body.unit : void 0);
+  } catch (err2) {
+    return json3(502, { ok: false, error: "github_unavailable", message: describe11(err2), at });
+  }
+  if (!view.finished)
+    return json3(200, {
+      ok: true,
+      run: coordinatorRunView(view, id.value, void 0),
+      ...pullRequest !== void 0 ? { pullRequest } : {},
+      at
+    });
   const full = await deps.runs.getRun(body.runId, { include: "messages" });
   const record2 = full.ok ? full.value : view;
   const finalReply = finalReplyOf2(record2.events);
   const reviewAskedAt = reviewAskedAtOf(record2.events);
-  const pr = prOpenedOf(record2.events);
-  const instanceRow = await deps.instances.get(id.value);
+  const opened = prOpenedOf(record2.events);
+  const pr = opened !== void 0 ? { number: opened.number, url: opened.url, created: opened.created } : void 0;
+  let coordinatorUnit;
+  if (instanceRow !== null && typeof body.unit === "string") {
+    coordinatorUnit = (await deps.instances.listUnits(instanceRow.id)).find((u) => u.unit === body.unit);
+    const pushedPrRef = opened?.head !== void 0 && record2.pushed?.some((pushed) => pushed.ref === opened.head) ? opened.head : void 0;
+    if (coordinatorUnit !== void 0 && pushedPrRef !== void 0 && coordinatorUnit.branch !== pushedPrRef) {
+      coordinatorUnit = { ...coordinatorUnit, branch: pushedPrRef };
+      await deps.instances.putUnits([coordinatorUnit]);
+    }
+  }
   if (view.status === "interrupted") {
     const successor = await restartedChildOf(deps, id.value, view).catch(() => void 0);
     if (successor !== void 0)
@@ -70142,6 +71471,7 @@ async function readRecord(body, deps) {
         ok: true,
         ...instanceRow?.stop !== void 0 ? { stopped: true } : {},
         run: { id: successor, finished: false },
+        ...pullRequest !== void 0 ? { pullRequest } : {},
         restartedAs: successor,
         at
       });
@@ -70150,15 +71480,15 @@ async function readRecord(body, deps) {
         ok: true,
         ...instanceRow?.stop !== void 0 ? { stopped: true } : {},
         run: { id: view.id, finished: false },
+        ...pullRequest !== void 0 ? { pullRequest } : {},
         at
       });
   }
   let posted;
   if (record2.verdict !== void 0 && record2.reviewHead !== void 0 && typeof body.unit === "string") {
     const instance = instanceRow;
-    const row2 = instance ? (await deps.instances.listUnits(instance.id)).find((u) => u.unit === body.unit) : void 0;
-    if (instance && row2?.pr !== void 0) {
-      const unitPr = { repo: instance.repo, number: row2.pr.number };
+    if (instance && coordinatorUnit?.pr !== void 0) {
+      const unitPr = { repo: instance.repo, number: coordinatorUnit.pr.number };
       posted = reviewPostedByRecord(record2, unitPr);
       if (posted === void 0) {
         const seen = await reviewPostedAtPatiently(deps, unitPr, record2.verdict.verdict, record2.reviewHead);
@@ -70169,6 +71499,7 @@ async function readRecord(body, deps) {
   return json3(200, {
     ok: true,
     ...instanceRow?.stop !== void 0 ? { stopped: true } : {},
+    ...pullRequest !== void 0 ? { pullRequest } : {},
     run: {
       ...coordinatorRunView(view, id.value, finalReply),
       ...pr !== void 0 ? { pr } : {},
@@ -70296,6 +71627,24 @@ async function recoverPushedBranch(deps, instance, row2, branch2, runId3) {
     throw err2;
   }
 }
+async function steerChild(body, deps) {
+  const id = parseInstanceId(body.parentInstanceId);
+  if (!id.ok) return json3(400, { ok: false, error: id.error });
+  if (typeof body.runId !== "string" || !RUN_ID_PATTERN.test(body.runId))
+    return json3(400, { ok: false, error: "runId must be a run id" });
+  if (typeof body.reason !== "string" || !CHILD_SUPERSESSION_REASONS.has(body.reason))
+    return json3(400, { ok: false, error: "reason must name a pull request transition" });
+  const at = (deps.clock ?? systemClock)();
+  const instance = await deps.instances.get(id.value);
+  if (instance === null) return json3(404, { ok: false, error: "unknown_instance", at });
+  const child = await deps.runs.getRun(body.runId);
+  if (!child.ok || child.value.parentInstanceId !== instance.id)
+    return json3(404, { ok: false, error: "not_found", at });
+  const reason2 = body.reason === "merged" ? "The pull request merged while this run was live." : body.reason === "closed" ? "The pull request closed while this run was live." : body.reason === "head_moved" ? "The pull request moved to another head while this review was live." : "The pull request's head branch was deleted while this run was live.";
+  const text = `${reason2} End now without a push or a review post. Record what already happened in the run's final reply.`;
+  const steered = await deps.steerChild?.(body.runId, text, instance) ?? false;
+  return json3(200, { ok: true, outcome: steered ? "steered" : "not_live", at });
+}
 async function prCheck(body, deps) {
   const id = parseInstanceId(body.parentInstanceId);
   if (!id.ok) return json3(400, { ok: false, error: id.error });
@@ -70317,6 +71666,42 @@ async function prCheck(body, deps) {
       await deps.instances.putUnits([{ ...unit.row, pr }]);
   };
   try {
+    if (follow !== void 0) {
+      const facts2 = await deps.fetchPrFacts({ repo: instance.repo, number: follow });
+      if (facts2 === void 0) throw new Error(`could not read ${instance.repo}#${follow}`);
+      const fallbackUrl = unit.row?.pr?.url ?? `https://github.com/${instance.repo}/pull/${follow}`;
+      const state2 = pullRequestState(follow, fallbackUrl, facts2);
+      if (state2 === void 0) throw new Error(headBranchStateError(instance.repo, follow));
+      await remember({ number: follow, url: String(state2.url) });
+      if (state2.state !== "open") return json3(200, { ok: true, ...state2, at });
+      const prRef = { repo: instance.repo, number: follow };
+      const headSha = facts2.headSha;
+      const approved = entry && headSha !== void 0 ? await reviewPostedAt(deps, prRef, "approve", headSha) : void 0;
+      const humanGate = entry ? await postedHumanGateAnswer(
+        deps,
+        prRef,
+        instance.userId,
+        instance.addressSeverity ?? DEFAULT_ADDRESS_SEVERITY
+      ) : void 0;
+      const entryChecks = entry && headSha !== void 0 ? await deps.fetchCommitChecks(instance.repo, headSha).catch(() => void 0) : void 0;
+      const checks = body.checks === true && headSha !== void 0 ? await deps.fetchCommitChecks(instance.repo, headSha).catch(() => void 0) : entryChecks;
+      const fixups = body.checks === true ? await deps.fixupCommitSubjects(prRef).catch(() => void 0) : void 0;
+      const queueBase = facts2.baseRef ?? instance.base;
+      const baseHasMergeQueue = body.checks === true && deps.branchHasMergeQueue !== void 0 && queueBase !== void 0 ? await deps.branchHasMergeQueue(instance.repo, queueBase).catch(() => void 0) : void 0;
+      return json3(200, {
+        ok: true,
+        ...state2,
+        ...entry && headSha !== void 0 ? { branchHead: headSha } : {},
+        ...approved !== void 0 ? { approved } : {},
+        ...humanGate !== void 0 ? { humanGate } : {},
+        ...facts2.autoMergeEnabled !== void 0 ? { autoMergeEnabled: facts2.autoMergeEnabled } : {},
+        ...checks !== void 0 ? { checks } : {},
+        ...body.checks === true && facts2.mergeableState !== void 0 ? { mergeableState: facts2.mergeableState } : {},
+        ...fixups !== void 0 ? { fixupCommits: fixups } : {},
+        ...typeof baseHasMergeQueue === "boolean" ? { baseHasMergeQueue } : {},
+        at
+      });
+    }
     const open2 = await deps.findOpenPrByHead(instance.repo, branch2);
     if (open2) {
       await remember({ number: open2.number, url: open2.htmlUrl });
@@ -70324,7 +71709,12 @@ async function prCheck(body, deps) {
         instanceId: instance.id,
         unit: unit.row?.unit ?? body.unit
       });
-      const entryFacts = entry ? await deps.fetchPrFacts({ repo: instance.repo, number: open2.number }).catch(() => void 0) : void 0;
+      const liveFacts = await deps.fetchPrFacts({ repo: instance.repo, number: open2.number });
+      if (liveFacts === void 0) throw new Error(`could not read ${instance.repo}#${open2.number}`);
+      const current = pullRequestState(open2.number, open2.htmlUrl, liveFacts);
+      if (current === void 0) throw new Error(headBranchStateError(instance.repo, open2.number));
+      if (current.state !== "open") return json3(200, { ok: true, ...current, at });
+      const entryFacts = entry ? liveFacts : void 0;
       const branchHead = entryFacts?.headSha;
       const entryHead = branchHead ?? open2.headSha;
       const approved = entry && entryHead !== void 0 ? await reviewPostedAt(deps, { repo: instance.repo, number: open2.number }, "approve", entryHead) : void 0;
@@ -70337,7 +71727,7 @@ async function prCheck(body, deps) {
       const entryChecks = entry && entryHead !== void 0 ? await deps.fetchCommitChecks(instance.repo, entryHead).catch(() => void 0) : void 0;
       const checks = body.checks === true && open2.headSha !== void 0 ? await deps.fetchCommitChecks(instance.repo, open2.headSha).catch(() => void 0) : entryChecks;
       const prRef = { repo: instance.repo, number: open2.number };
-      const facts2 = body.checks === true ? await deps.fetchPrFacts(prRef).catch(() => void 0) : void 0;
+      const facts2 = body.checks === true ? liveFacts : void 0;
       const fixups = body.checks === true ? await deps.fixupCommitSubjects(prRef).catch(() => void 0) : void 0;
       const queueBase = facts2?.baseRef ?? instance.base;
       const baseHasMergeQueue = body.checks === true && deps.branchHasMergeQueue !== void 0 && queueBase !== void 0 ? await deps.branchHasMergeQueue(instance.repo, queueBase).catch(() => void 0) : void 0;
@@ -70346,7 +71736,8 @@ async function prCheck(body, deps) {
         state: "open",
         prNumber: open2.number,
         url: open2.htmlUrl,
-        ...open2.headSha !== void 0 ? { headSha: open2.headSha } : {},
+        ...liveFacts.headSha !== void 0 ? { headSha: liveFacts.headSha } : {},
+        ...liveFacts.headBranchExists !== void 0 ? { headBranchExists: liveFacts.headBranchExists } : {},
         ...branchHead !== void 0 ? { branchHead } : {},
         ...approved !== void 0 ? { approved } : {},
         ...humanGate !== void 0 ? { humanGate } : {},
@@ -70362,39 +71753,6 @@ async function prCheck(body, deps) {
     }
     const merged = await deps.findMergedPrByHead(instance.repo, branch2);
     if (!merged) {
-      if (follow !== void 0 && recover === void 0) {
-        const facts2 = await deps.fetchPrFacts({ repo: instance.repo, number: follow });
-        if (facts2 !== void 0) {
-          const url = facts2.htmlUrl ?? `https://github.com/${instance.repo}/pull/${follow}`;
-          if (facts2.mergedAt !== void 0 && facts2.mergeCommitSha !== void 0) {
-            await remember({ number: follow, url });
-            return json3(200, {
-              ok: true,
-              state: "merged",
-              prNumber: follow,
-              url,
-              sha: facts2.mergeCommitSha,
-              mergedAt: facts2.mergedAt,
-              at
-            });
-          }
-          if (facts2.state === "open") {
-            await remember({ number: follow, url });
-            const checks = body.checks === true && facts2.headSha !== void 0 ? await deps.fetchCommitChecks(instance.repo, facts2.headSha).catch(() => void 0) : void 0;
-            return json3(200, {
-              ok: true,
-              state: "open",
-              prNumber: follow,
-              url,
-              ...facts2.headSha !== void 0 ? { headSha: facts2.headSha } : {},
-              ...facts2.autoMergeEnabled !== void 0 ? { autoMergeEnabled: facts2.autoMergeEnabled } : {},
-              ...checks !== void 0 ? { checks } : {},
-              at
-            });
-          }
-          return json3(200, { ok: true, state: "none", prClosed: true, at });
-        }
-      }
       if (recover === void 0) {
         const ahead = instance.base === void 0 ? void 0 : await deps.commitsOverBase(instance.repo, instance.base, branch2).catch((err2) => {
           (deps.log ?? console.log)(
@@ -70407,20 +71765,20 @@ async function prCheck(body, deps) {
       const recovered = await recoverPushedBranch(deps, instance, unit.row, branch2, recover.runId);
       if (recovered.kind === "opened") {
         await remember({ number: recovered.pr.number, url: recovered.pr.htmlUrl });
-        return json3(200, { ok: true, state: "open", prNumber: recovered.pr.number, url: recovered.pr.htmlUrl, at });
+        const recoveredFacts = await deps.fetchPrFacts({ repo: instance.repo, number: recovered.pr.number });
+        if (recoveredFacts === void 0) throw new Error(`could not read ${instance.repo}#${recovered.pr.number}`);
+        const recoveredState = pullRequestState(recovered.pr.number, recovered.pr.htmlUrl, recoveredFacts);
+        if (recoveredState === void 0) throw new Error(headBranchStateError(instance.repo, recovered.pr.number));
+        return json3(200, { ok: true, ...recoveredState, at });
       }
       return json3(200, { ok: true, state: "none", unrecovered: recovered.why, at });
     }
     await remember({ number: merged.number, url: merged.htmlUrl });
-    return json3(200, {
-      ok: true,
-      state: "merged",
-      prNumber: merged.number,
-      url: merged.htmlUrl,
-      sha: merged.sha,
-      mergedAt: merged.mergedAt,
-      at
-    });
+    const mergedFacts = await deps.fetchPrFacts({ repo: instance.repo, number: merged.number });
+    if (mergedFacts === void 0) throw new Error(`could not read ${instance.repo}#${merged.number}`);
+    const state = pullRequestState(merged.number, merged.htmlUrl, mergedFacts);
+    if (state?.state !== "merged") throw new Error(`${instance.repo}#${merged.number} no longer reads merged`);
+    return json3(200, { ok: true, ...state, at });
   } catch (err2) {
     return json3(502, { ok: false, error: "github_unavailable", message: describe11(err2), at });
   }
@@ -71124,6 +72482,13 @@ async function merge(body, deps, subject2) {
   }
   if (facts2 === void 0)
     return json3(502, { ok: false, error: "github_unavailable", message: `${where} could not be read`, at });
+  if (headBranchStateUnknown(facts2))
+    return json3(502, {
+      ok: false,
+      error: "github_unavailable",
+      message: headBranchStateError(instance.repo, pr.number),
+      at
+    });
   if (isReleasePullRequest(facts2))
     return refused7(`${where} is the release pull request \u2014 always a person's merge, never the runner's`);
   if (facts2.state !== "open") {
@@ -71134,9 +72499,23 @@ async function merge(body, deps, subject2) {
         by: "other",
         sha: facts2.mergeCommitSha,
         mergedAt: facts2.mergedAt,
+        ...facts2.mergedBy !== void 0 ? { mergedBy: facts2.mergedBy } : {},
         at
       });
-    return refused7(`${where} is ${facts2.state}`);
+    const pullRequest = pullRequestState(
+      body.prNumber,
+      row2.pr?.url ?? `https://github.com/${instance.repo}/pull/${body.prNumber}`,
+      facts2
+    );
+    return pullRequest === void 0 ? refused7(`${where} is ${facts2.state}`) : json3(200, { ok: true, outcome: "recheck", pullRequest, at });
+  }
+  if (facts2.headBranchExists === false) {
+    const pullRequest = pullRequestState(
+      body.prNumber,
+      row2.pr?.url ?? `https://github.com/${instance.repo}/pull/${body.prNumber}`,
+      facts2
+    );
+    if (pullRequest !== void 0) return json3(200, { ok: true, outcome: "recheck", pullRequest, at });
   }
   if (body.queued === true) {
     const queue = deps.fetchMergeQueueState !== void 0 ? await deps.fetchMergeQueueState(pr).catch(() => void 0) : void 0;
@@ -71163,10 +72542,14 @@ async function merge(body, deps, subject2) {
   }
   if (facts2.headRef !== row2.branch)
     return refused7(`${where} heads \`${facts2.headRef ?? "?"}\`, not the unit's branch \`${row2.branch}\``);
-  if (facts2.headSha === void 0 || !sameCommit(facts2.headSha, headSha))
-    return refused7(
-      `the head of ${where} moved: \`${facts2.headSha?.slice(0, 7) ?? "?"}\` is not the approved \`${headSha.slice(0, 7)}\``
+  if (facts2.headSha === void 0 || !sameCommit(facts2.headSha, headSha)) {
+    const pullRequest = pullRequestState(
+      body.prNumber,
+      row2.pr?.url ?? `https://github.com/${instance.repo}/pull/${body.prNumber}`,
+      facts2
     );
+    return pullRequest === void 0 ? refused7(`the head of ${where} could not be read`) : json3(200, { ok: true, outcome: "recheck", pullRequest, at });
+  }
   if (facts2.mergeableState === "dirty") {
     const base = facts2.baseRef ?? "its base";
     return json3(200, {
@@ -71267,6 +72650,22 @@ async function checksStep(body, deps) {
   const unit = await unitRowOf(deps, instance, body.unit);
   if (!unit.ok) return unit.response;
   const log = deps.log ?? console.log;
+  const facts2 = await deps.fetchPrFacts({ repo: instance.repo, number: body.prNumber }).catch(() => void 0);
+  if (facts2 === void 0) return json3(502, { ok: false, error: "github_unavailable", at });
+  if (headBranchStateUnknown(facts2))
+    return json3(502, {
+      ok: false,
+      error: "github_unavailable",
+      message: headBranchStateError(instance.repo, body.prNumber),
+      at
+    });
+  const pullRequest = pullRequestState(
+    body.prNumber,
+    unit.row?.pr?.url ?? `https://github.com/${instance.repo}/pull/${body.prNumber}`,
+    facts2
+  );
+  if (pullRequest !== void 0 && (pullRequest.state !== "open" || pullRequest.headBranchExists === false || typeof pullRequest.headSha === "string" && !sameCommit(pullRequest.headSha, headSha)))
+    return json3(200, { ok: true, pullRequest, at });
   if (body.retry !== void 0 && body.refire !== void 0)
     return json3(400, { ok: false, error: "checks recovery must be retry or refire, not both" });
   if (body.retry !== void 0) {
@@ -71286,7 +72685,6 @@ async function checksStep(body, deps) {
     );
     return json3(200, { ok: true, refired, at });
   }
-  const facts2 = await deps.fetchPrFacts({ repo: instance.repo, number: body.prNumber }).catch(() => void 0);
   let checks;
   if (deps.fetchRoundChecks !== void 0) {
     checks = await deps.fetchRoundChecks(instance.repo, headSha, body.prNumber, facts2?.baseRef).catch(() => void 0);
@@ -71307,7 +72705,8 @@ async function checksStep(body, deps) {
   return json3(200, {
     ok: true,
     ...checks !== void 0 ? { checks } : {},
-    ...facts2?.draft === true ? { draft: true } : {},
+    ...pullRequest !== void 0 ? { pullRequest } : {},
+    ...facts2.draft === true ? { draft: true } : {},
     at
   });
 }
@@ -71458,6 +72857,8 @@ async function answerCoordinatorStep(door, body, deps) {
       return spawn6(parsed.value, deps);
     case "read-record":
       return readRecord(parsed.value, deps);
+    case "steer":
+      return steerChild(parsed.value, deps);
     case "pr-check":
       return prCheck(parsed.value, deps);
     case "round":
@@ -71505,7 +72906,7 @@ function createAdminCoordinatorHandler(deps) {
     })();
   };
 }
-var COORDINATOR_ADMIN_PREFIX, MAX_SPAWN_PROMPT_CHARS, FINISHED_LOOKBACK_PAGES, MAX_ADMIN_BODY_BYTES, UNIT_ID, PRESETS_OF_KIND, invalid, json3, describe11, isGenerated2, EVERY_RUN, REVIEW_POSTED_CHECKS, REVIEW_POSTED_RECHECK_MS, githubSecondStart, ROUND_OUTCOMES, ENDING_ICON, STEPS;
+var COORDINATOR_ADMIN_PREFIX, MAX_SPAWN_PROMPT_CHARS, FINISHED_LOOKBACK_PAGES, MAX_ADMIN_BODY_BYTES, UNIT_ID, PRESETS_OF_KIND, invalid, json3, describe11, isGenerated2, EVERY_RUN, REVIEW_POSTED_CHECKS, REVIEW_POSTED_RECHECK_MS, githubSecondStart, CHILD_SUPERSESSION_REASONS, ROUND_OUTCOMES, ENDING_ICON, STEPS;
 var init_adminCoordinator = __esm({
   "../../src/channels/adminCoordinator.ts"() {
     "use strict";
@@ -71558,6 +72959,7 @@ var init_adminCoordinator = __esm({
     REVIEW_POSTED_CHECKS = 3;
     REVIEW_POSTED_RECHECK_MS = 2e3;
     githubSecondStart = (at) => Math.floor(at / SECOND_MS) * SECOND_MS;
+    CHILD_SUPERSESSION_REASONS = /* @__PURE__ */ new Set(["merged", "closed", "head_moved", "branch_deleted"]);
     ROUND_OUTCOMES = [
       "started",
       "pr_opened",
@@ -71589,6 +72991,7 @@ var init_adminCoordinator = __esm({
       "branch",
       "spawn",
       "read-record",
+      "steer",
       "pr-check",
       "round",
       "unit-end",
@@ -71602,15 +73005,15 @@ var init_adminCoordinator = __esm({
 });
 
 // ../../src/core/coordinator/checksIntake.ts
-async function verifyWebhookSignature(secret2, rawBody, signature) {
+async function verifyWebhookSignature(secret2, rawBody, signature2) {
   const key = await crypto.subtle.importKey("raw", encoder2.encode(secret2), { name: "HMAC", hash: "SHA-256" }, false, [
     "sign"
   ]);
   const digest = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder2.encode(rawBody)));
   const expected = `sha256=${toHex(digest)}`;
-  if (signature.length !== expected.length) return false;
+  if (signature2.length !== expected.length) return false;
   let diff = 0;
-  for (let i = 0; i < expected.length; i++) diff |= expected.charCodeAt(i) ^ signature.charCodeAt(i);
+  for (let i = 0; i < expected.length; i++) diff |= expected.charCodeAt(i) ^ signature2.charCodeAt(i);
   return diff === 0;
 }
 function createMergeWaitRegistry(ttlMs = MERGE_WAIT_TTL_MS) {
@@ -71639,14 +73042,14 @@ async function handleCheckRunIntake(headers, rawBody, deps) {
   if (headers.signature === void 0 || !await verifyWebhookSignature(deps.secret, rawBody, headers.signature))
     return { status: 401, body: { error: "unauthorized" } };
   if (headers.event !== "check_run") return { status: 200, body: { ok: true, ignored: "event" } };
-  let payload;
+  let payload2;
   try {
-    payload = JSON.parse(rawBody);
+    payload2 = JSON.parse(rawBody);
   } catch {
     return { status: 400, body: { error: "invalid_json" } };
   }
-  if (typeof payload !== "object" || payload === null) return { status: 400, body: { error: "invalid_body" } };
-  const p = payload;
+  if (typeof payload2 !== "object" || payload2 === null) return { status: 400, body: { error: "invalid_body" } };
+  const p = payload2;
   if (p.action !== "completed") return { status: 200, body: { ok: true, ignored: "action" } };
   const headSha = p.check_run?.head_sha;
   const repo = p.repository?.full_name;
@@ -71666,14 +73069,14 @@ async function handleIssueCommentIntake(headers, rawBody, deps) {
   if (headers.signature === void 0 || !await verifyWebhookSignature(deps.secret, rawBody, headers.signature))
     return { status: 401, body: { error: "unauthorized" } };
   if (headers.event !== "issue_comment") return { status: 200, body: { ok: true, ignored: "event" } };
-  let payload;
+  let payload2;
   try {
-    payload = JSON.parse(rawBody);
+    payload2 = JSON.parse(rawBody);
   } catch {
     return { status: 400, body: { error: "invalid_json" } };
   }
-  if (typeof payload !== "object" || payload === null) return { status: 400, body: { error: "invalid_body" } };
-  const p = payload;
+  if (typeof payload2 !== "object" || payload2 === null) return { status: 400, body: { error: "invalid_body" } };
+  const p = payload2;
   if (p.action !== "created") return { status: 200, body: { ok: true, ignored: "action" } };
   if (p.issue?.pull_request === void 0) return { status: 200, body: { ok: true, ignored: "issue" } };
   const repo = p.repository?.full_name;
@@ -71716,14 +73119,14 @@ async function handlePushIntake(headers, rawBody, deps) {
   if (headers.signature === void 0 || !await verifyWebhookSignature(deps.secret, rawBody, headers.signature))
     return { status: 401, body: { error: "unauthorized" } };
   if (headers.event !== "push") return { status: 200, body: { ok: true, ignored: "event" } };
-  let payload;
+  let payload2;
   try {
-    payload = JSON.parse(rawBody);
+    payload2 = JSON.parse(rawBody);
   } catch {
     return { status: 400, body: { error: "invalid_json" } };
   }
-  if (typeof payload !== "object" || payload === null) return { status: 400, body: { error: "invalid_body" } };
-  const p = payload;
+  if (typeof payload2 !== "object" || payload2 === null) return { status: 400, body: { error: "invalid_body" } };
+  const p = payload2;
   const repo = p.repository?.full_name;
   if (typeof p.ref !== "string" || typeof repo !== "string" || repo === "")
     return { status: 400, body: { error: "invalid_body" } };
@@ -72419,6 +73822,14 @@ async function runBot() {
     ...costsCfg?.prices ? { prices: costsCfg.prices } : {}
   }) : null;
   const coordinatorInstances = buildCoordinatorInstanceStore(runHistoryCfg, processSecrets);
+  const decisionRecordAllocator = new DecisionRecordAllocator(
+    fetchDecisionRecordClaims,
+    async (repo, taskKey, claimed2, existing) => {
+      const reserved = await coordinatorInstances.reserveDecisionRecord(repo, taskKey, claimed2, existing);
+      if (!reserved.ok) throw new DecisionRecordReservationUnavailableError();
+      return reserved.number;
+    }
+  );
   let planeAdmitPass;
   const planeEffectExecutor = {
     draining: () => draining,
@@ -72520,6 +73931,7 @@ async function runBot() {
     runHistoryWriter,
     // The coordinator's instance records and unit rows (run-history items 49 and 50): what the ship branch writes when it hands an `agent:ship` request to the plan runner.
     coordinatorInstances,
+    reserveDecisionRecord: decisionRecordAllocator.reserve.bind(decisionRecordAllocator),
     workflow: workflowSender,
     runStore,
     threadsElsewhere,
@@ -72681,7 +74093,9 @@ async function runBot() {
           const out = await runLedger.recordIntake(key, receipt);
           if (out === void 0) throw new Error("the receipt write degraded (the ledger warning names why)");
           return out;
-        }
+        },
+        claimIntakeDelivery: (key, poster, claimedAt) => ledgerClient.claimIntakeDelivery(key, poster, claimedAt),
+        finishIntakeDelivery: (key, poster, delivered) => ledgerClient.finishIntakeDelivery(key, poster, delivered)
       } : null;
       slackIntake = wireIntakeGate({
         intakeModeFor: (threadKey, userId, channelId) => config.intakeModeFor(threadKey, userId, channelId),
@@ -72792,7 +74206,12 @@ async function runBot() {
       // and a park land on the write-through's plane routes, fire and forget —
       // the null write-through swallows both where no ledger is configured.
       plane: {
-        level: (provider, side) => void runLedger.planeLevel({ provider, name: "provider", side }),
+        level: (provider, side, cause) => void runLedger.planeLevel({
+          provider,
+          name: "provider",
+          side,
+          ...side === "down" && cause !== void 0 ? { cause } : {}
+        }),
         park: (runId3, provider) => void runLedger.planePark(runId3, provider)
       }
     });
@@ -72890,6 +74309,34 @@ async function runBot() {
       registry: defaultRunRegistry,
       ledgerRuns: () => runLedger.liveRuns(),
       dispatch: (msg, io, opts) => dispatch(deps, msg, io, opts),
+      steerChild: async (runId3, text, instance) => {
+        const run2 = defaultRunRegistry.getById(runId3);
+        if (!run2 || run2.finished || run2.threadKey === void 0 || run2.agent === void 0) return false;
+        const outcome = await steerRun2(
+          {
+            // The coordinator already owns this admitted child; revoking its
+            // stale PR authority is not a new request to run the agent.
+            config: { canRunAgent: () => true, grantsFor: (id) => config.grantsFor(id) },
+            runLedger,
+            admission: defaultAdmission
+          },
+          {
+            userId: instance.userId,
+            channelId: instance.channelId,
+            ...instance.userName !== void 0 ? { userName: instance.userName } : {}
+          },
+          {
+            runId: runId3,
+            threadKey: run2.threadKey,
+            agent: run2.agent,
+            ...run2.userId !== void 0 ? { requesterId: run2.userId } : {},
+            ...run2.parentRunId !== void 0 ? { parentRunId: run2.parentRunId } : {},
+            ...run2.parentInstanceId !== void 0 ? { parentInstanceId: run2.parentInstanceId } : {}
+          },
+          text
+        );
+        return outcome.kind === "steered";
+      },
       ioFor: (thread) => threadIoFor(thread),
       findOpenPrByHead,
       findMergedPrByHead,
@@ -73542,6 +74989,7 @@ var init_index = __esm({
     init_authorBinding();
     init_identityRewrite();
     init_run2();
+    init_decisionRecordReservation();
     init_record();
     init_admission();
     init_scheduleStore();
@@ -73785,6 +75233,9 @@ var ConsoleIO = class _ConsoleIO {
    *  before that, and forever when no run was started (a config reply such as
    *  `help`, a refusal before a run existed). */
   finished;
+  /** A typed request failure that ended before a run existed, such as the
+   * operator model refusing the one-shot ask. */
+  failed = false;
   /** How many child threads this one has opened; the next child's number. */
   children = 0;
   async reply(text) {
@@ -73802,6 +75253,9 @@ var ConsoleIO = class _ConsoleIO {
   runFinished(receipt) {
     this.finished = receipt;
   }
+  requestFailed() {
+    this.failed = true;
+  }
   async status(initial) {
     console.error(this.prefix + initial.title);
     return {
@@ -73827,8 +75281,8 @@ var ConsoleIO = class _ConsoleIO {
     };
   }
 };
-function askExitCode(finished) {
-  return finished === void 0 || finished.status === "completed" ? 0 : 1;
+function askExitCode(finished, requestFailed = false) {
+  return requestFailed || finished !== void 0 && finished.status !== "completed" ? 1 : 0;
 }
 function missingBotConfig(configPath) {
   return new CommandError(
@@ -74001,7 +75455,7 @@ async function main() {
   );
   await runHistoryWriter.settled();
   loopback.close();
-  process.exitCode = askExitCode(io.finished);
+  process.exitCode = askExitCode(io.finished, io.failed);
 }
 async function askLoopbackServer(input) {
   const modelProxy = createModelProxyHandler({