@coreplane/switchboard 1.260.5 → 1.260.6

package/dist/cli.js

@@ -597,7 +597,7 @@ function fit(pipeline) {
   const need = ALLOWANCES.provision + ASKS.coding + reserveMinutes({ kind: "coding", index: 0 }, pipeline);
   return { ok: pipeline.maxMinutes >= need, need, have: pipeline.maxMinutes };
 }
-var SECOND_MS, secondsToMs, MINUTE_MS, minutesToMs, DAY_MS, WEEK_MS, CONFIRMATION_TTL_MS, QUESTION_TTL_MS, AUTHOR_BINDING_TTL_MS, FIRST_ATTACH_WAIT_MS, ATTACH_REQUEST_MIN_MS, HARNESS_PROBE_WAIT_MS, DRAIN, INTAKE_WINDOW_MAX_MS, INTAKE_RECOVERY_WINDOW_MS, INTAKE_DELIVERY_CLAIM_MS, LOOP_PRESETS, ASKS, PRESET_FLOORS, FLOORS, PULL_SWEEP, PROVIDER_RETRY_BACKOFFS_MS, MODEL_STREAM_HEARTBEAT_MS, HOSTED_DEADLINE_MARGIN_MINUTES, SHIP_WAIT, RESTART_CLAIM_GRACE_MS, PLANE, PACE_WINDOW_MINUTES, ALLOWANCES, POST_STEP_MINUTES, WRAP_UP_WARNING, SANDBOX_CREDENTIAL_WRITE_TIMEOUT_MS, BASH_COMMAND, RUNAWAY_TURNS_PER_MINUTE, DEFAULT_GRANT, GRANT_RENEWALS_MAX, STRUCTURED_RETRIES_MAX, IDLE_DAYS_DEFAULT, IDLE_DAYS_MAX, IDLE_WAKES_MAX;
+var SECOND_MS, secondsToMs, MINUTE_MS, minutesToMs, DAY_MS, WEEK_MS, CONFIRMATION_TTL_MS, QUESTION_TTL_MS, AUTHOR_BINDING_TTL_MS, FIRST_ATTACH_WAIT_MS, ATTACH_REQUEST_MIN_MS, HARNESS_PROBE_WAIT_MS, DRAIN, INTAKE_WINDOW_MAX_MS, INTAKE_RECOVERY_WINDOW_MS, INTAKE_DELIVERY_CLAIM_MS, LOOP_PRESETS, ASKS, PRESET_FLOORS, FLOORS, PULL_SWEEP, PROVIDER_RETRY_BACKOFFS_MS, MODEL_STREAM_HEARTBEAT_MS, HOSTED_DEADLINE_MARGIN_MINUTES, SHIP_WAIT, SHIP_RECORD_VISIBILITY, RESTART_CLAIM_GRACE_MS, PLANE, PACE_WINDOW_MINUTES, ALLOWANCES, POST_STEP_MINUTES, WRAP_UP_WARNING, SANDBOX_CREDENTIAL_WRITE_TIMEOUT_MS, BASH_COMMAND, RUNAWAY_TURNS_PER_MINUTE, DEFAULT_GRANT, GRANT_RENEWALS_MAX, STRUCTURED_RETRIES_MAX, IDLE_DAYS_DEFAULT, IDLE_DAYS_MAX, IDLE_WAKES_MAX;
 var init_budgets = __esm({
   "../../src/core/budgets.ts"() {
     "use strict";
@@ -676,6 +676,7 @@ var init_budgets = __esm({
     MODEL_STREAM_HEARTBEAT_MS = 15e3;
     HOSTED_DEADLINE_MARGIN_MINUTES = 60;
     SHIP_WAIT = { marginMinutes: 5, chunkMinutes: 5, mergeChunkMinutes: 5, busyRetryMinutes: 2 };
+    SHIP_RECORD_VISIBILITY = { retries: 3, retryMs: secondsToMs(1) };
     RESTART_CLAIM_GRACE_MS = minutesToMs(SHIP_WAIT.chunkMinutes);
     PLANE = {
       recentMinutes: 60,
@@ -15400,7 +15401,7 @@ var init_refusal = __esm({
       repo_not_onboarded: "request",
       repo_access: "policy",
       pr_head_unknown: "system",
-      branch_moved: "system",
+      workspace_head_mismatch: "system",
       coordinator_thread_live: "system",
       live_agent_allowlist: "policy",
       follow_up_refused: "request",
@@ -29134,6 +29135,505 @@ var init_llmOutput = __esm({
   }
 });
 
+// ../../src/core/dispatch/handBack.ts
+function renderHandBackLine(line4) {
+  return `${HAND_BACK_PREFIX}
+\`${line4}\``;
+}
+var HAND_BACK_PREFIX;
+var init_handBack = __esm({
+  "../../src/core/dispatch/handBack.ts"() {
+    "use strict";
+    HAND_BACK_PREFIX = "To run this:";
+  }
+});
+
+// ../../src/core/statusCardFrame.ts
+function activityText(activity) {
+  if (!activity) return void 0;
+  if (activity.kind === "line") return activity.text;
+  return `\u2192 $ ${activity.command.replace(/\s+/g, " ").trim()}`;
+}
+function createCardShell(opts) {
+  const verbosity2 = opts.verbosity ?? DEFAULT_VERBOSITY;
+  const notes = [];
+  let link = opts.link;
+  let frame2 = 0;
+  let finishedAt;
+  let setupLabel;
+  const lead = opts.lead ?? [];
+  const base = () => opts.model !== void 0 && shows(verbosity2, "verbose") ? `${opts.label} on \`${opts.model}\`` : opts.label;
+  const label = () => [base(), ...notes.filter((n2) => shows(verbosity2, n2.level)).map((n2) => n2.text)].join(" \xB7 ");
+  const elapsed2 = () => formatDuration((finishedAt ?? opts.now()) - opts.startedAt, "clock");
+  const headline = (icon) => `${icon} ${label()} \xB7 ${elapsed2()}`;
+  const closeDetail = (close, own) => [...shows(verbosity2, "debug") ? [close.shape, close.queued] : [], own].filter(Boolean).join("\n") || void 0;
+  return {
+    get label() {
+      return label();
+    },
+    note(level, text) {
+      notes.push({ level, text });
+    },
+    setLink(next) {
+      link = next;
+    },
+    freeze(at) {
+      finishedAt = at;
+    },
+    setSetupLabel(next) {
+      setupLabel = next;
+    },
+    ack() {
+      const detail = lead.join("\n");
+      return { title: `\u{1F440} ${label()} \xB7 preparing workspace\u2026`, ...detail ? { detail } : {} };
+    },
+    live(parts = {}) {
+      const glyph = SPINNER_GLYPHS[frame2++ % SPINNER_GLYPHS.length];
+      const detail = [...lead, ...parts.detail ?? []].filter(Boolean).join("\n");
+      return {
+        title: headline(glyph) + (setupLabel ? ` \u2014 ${setupLabel}` : "") + (parts.suffix ?? "") + (parts.notice ? ` \xB7 ${parts.notice}` : ""),
+        detail: detail || void 0,
+        ...parts.activity ? { activity: parts.activity } : {},
+        link
+      };
+    },
+    close(close) {
+      const detail = closeDetail(close, close.kind === "done" ? close.detail : void 0);
+      switch (close.kind) {
+        case "done":
+          return { title: headline(close.icon), detail, link };
+        case "not_started":
+          return { title: `${close.icon} ${label()} \xB7 not started (${close.reason}) \xB7 ${elapsed2()}`, detail };
+        case "refused":
+          return { title: `${close.icon} ${label()} \xB7 ${close.reason} \xB7 ${elapsed2()}`, detail };
+        case "setup_failed":
+          return { title: `\u274C setup failed \xB7 ${close.reason} \xB7 ${elapsed2()}`, detail };
+      }
+    }
+  };
+}
+var SPINNER_GLYPHS, LIVE_CARD_PREFIXES, ROUTE_REASON_PREFIX;
+var init_statusCardFrame = __esm({
+  "../../src/core/statusCardFrame.ts"() {
+    "use strict";
+    init_formatDuration();
+    init_verbosity();
+    SPINNER_GLYPHS = ["\u25D0", "\u25D3", "\u25D1", "\u25D2"];
+    LIVE_CARD_PREFIXES = [...SPINNER_GLYPHS, "\u{1F440}"];
+    ROUTE_REASON_PREFIX = "route reason:";
+  }
+});
+
+// ../../src/core/confirmations.ts
+import { randomUUID } from "node:crypto";
+import { existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname10, resolve as resolve9 } from "node:path";
+function newConfirmationId() {
+  return randomUUID();
+}
+function renderOffer(offer) {
+  if (offer.question) return `${offer.question.text}
+Did you mean:
+\`${offer.line}\`
+
+${offer.question.evidence}`;
+  return [offer.line, ...offer.risk ? [offer.risk] : []].join("\n");
+}
+function confirmationMessageOf(msg) {
+  const { images: _images, documents: _documents, staged: _staged, ...kept } = msg;
+  return kept;
+}
+function isRecord3(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isMessage(v) {
+  return isRecord3(v) && typeof v.channelId === "string" && typeof v.userId === "string" && typeof v.threadKey === "string" && typeof v.text === "string";
+}
+function isRunShape(v) {
+  return typeof v.id === "string" && isMessage(v.message) && typeof v.command === "string" && isRecord3(v.input) && typeof v.receipt === "string" && typeof v.risk === "string" && typeof v.model === "string";
+}
+function isRedispatchShape(v) {
+  return typeof v.id === "string" && isMessage(v.message) && typeof v.line === "string" && typeof v.evidence === "string" && typeof v.code === "string";
+}
+function parsePendingConfirmation(v) {
+  if (!isRecord3(v)) return void 0;
+  if (v.kind === "redispatch")
+    return isRedispatchShape(v) ? v : void 0;
+  if (v.kind !== void 0 && v.kind !== "run") return void 0;
+  return isRunShape(v) ? { ...v, kind: "run" } : void 0;
+}
+function parseConfirmation(v) {
+  if (!isRecord3(v) || typeof v.expiresAt !== "number") return void 0;
+  const pending2 = parsePendingConfirmation(v);
+  return pending2 ? { ...pending2, expiresAt: v.expiresAt } : void 0;
+}
+function isRefusal(v) {
+  return typeof v === "string" && CONFIRMATION_REFUSALS.includes(v);
+}
+function judge2(rows, id, actorIds, now, kind) {
+  const row2 = rows.get(id);
+  if (!row2) return { ok: false, refused: "used" };
+  if (kind === "consume" && row2.expiresAt <= now) {
+    rows.delete(id);
+    return { ok: false, refused: "expired", row: row2 };
+  }
+  if (!actorIds.includes(row2.message.userId))
+    return kind === "consume" ? { ok: false, refused: "foreign", row: row2 } : { ok: false, refused: "foreign" };
+  rows.delete(id);
+  return kind === "consume" ? { ok: true, row: row2 } : { ok: true };
+}
+function replaceThreadRow(rows, row2) {
+  for (const [id, r] of rows) if (r.message.threadKey === row2.message.threadKey) rows.delete(id);
+  rows.set(row2.id, row2);
+}
+function threadRowId(rows, threadKey) {
+  for (const [id, r] of rows) if (r.message.threadKey === threadKey) return id;
+  return void 0;
+}
+function buildConfirmationStore(config, secrets, opts) {
+  const worker = config.config.runtimeOverrides?.worker;
+  if (!worker) return new FileConfirmationStore(opts.path);
+  const tokenEnv = worker.tokenEnv ?? "MEMORY_TOKEN";
+  const token2 = secrets.named(tokenEnv);
+  if (!token2) throw new Error(`runtimeOverrides.worker is configured but ${tokenEnv} is not set`);
+  return new WorkerConfirmationStore({
+    baseUrl: worker.baseUrl,
+    token: token2.reveal(),
+    ...opts.fetch ? { fetch: opts.fetch } : {}
+  });
+}
+var CONFIRMATION_REFUSALS, UNSHOWABLE_LINE, STORE_UNREACHABLE_LINE, FileConfirmationStore, CONFIRMATION_WORKER_TIMEOUT_MS, WorkerConfirmationStore;
+var init_confirmations = __esm({
+  "../../src/core/confirmations.ts"() {
+    "use strict";
+    init_clock();
+    CONFIRMATION_REFUSALS = ["used", "expired", "foreign"];
+    UNSHOWABLE_LINE = "this command carries a value that cannot be shown, so no confirmation can be offered; nothing ran";
+    STORE_UNREACHABLE_LINE = "this command needs a confirmation click, and the confirmation store could not be reached; nothing ran \u2014 ask again for the button";
+    FileConfirmationStore = class {
+      path;
+      clock;
+      constructor(path, opts = {}) {
+        this.path = resolve9(path);
+        this.clock = opts.clock ?? systemClock;
+      }
+      read() {
+        const rows = /* @__PURE__ */ new Map();
+        if (!existsSync12(this.path)) return rows;
+        const raw = JSON.parse(readFileSync14(this.path, "utf8"));
+        for (const v of Array.isArray(raw.confirmations) ? raw.confirmations : []) {
+          const row2 = parseConfirmation(v);
+          if (row2) rows.set(row2.id, row2);
+        }
+        return rows;
+      }
+      write(rows) {
+        mkdirSync9(dirname10(this.path), { recursive: true });
+        writeFileSync8(this.path, JSON.stringify({ confirmations: [...rows.values()] }, null, 2));
+      }
+      async put(row2, ttlMs) {
+        const rows = this.read();
+        const stored = { ...row2, expiresAt: this.clock() + ttlMs };
+        replaceThreadRow(rows, stored);
+        this.write(rows);
+        return stored;
+      }
+      async consume(id, actorIds) {
+        const rows = this.read();
+        const out = judge2(rows, id, actorIds, this.clock(), "consume");
+        this.write(rows);
+        return out;
+      }
+      async cancel(id, actorIds) {
+        const rows = this.read();
+        const out = judge2(rows, id, actorIds, this.clock(), "cancel");
+        this.write(rows);
+        return out;
+      }
+      async cancelByThread(threadKey, actorIds) {
+        const rows = this.read();
+        const id = threadRowId(rows, threadKey);
+        if (id === void 0) return { ok: false, refused: "used" };
+        const out = judge2(rows, id, actorIds, this.clock(), "cancel");
+        this.write(rows);
+        return out;
+      }
+      async pendingByThread(threadKey) {
+        const rows = this.read();
+        const id = threadRowId(rows, threadKey);
+        const row2 = id === void 0 ? void 0 : rows.get(id);
+        if (!row2 || row2.expiresAt <= this.clock()) return void 0;
+        return row2;
+      }
+      describe() {
+        return `file ${this.path}`;
+      }
+    };
+    CONFIRMATION_WORKER_TIMEOUT_MS = 8e3;
+    WorkerConfirmationStore = class {
+      constructor(opts) {
+        this.opts = opts;
+        this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+        this.fetchImpl = opts.fetch ?? fetch;
+      }
+      opts;
+      baseUrl;
+      fetchImpl;
+      async put(row2, ttlMs) {
+        const body = await this.post("/config/confirmations/put", {
+          id: row2.id,
+          threadKey: row2.message.threadKey,
+          requester: row2.message.userId,
+          body: row2,
+          ttlMs
+        });
+        if (typeof body.expiresAt !== "number")
+          throw new Error("confirmation store answered a put without the expiry it stamped");
+        return { ...row2, expiresAt: body.expiresAt };
+      }
+      async consume(id, actorIds) {
+        const body = await this.post("/config/confirmations/consume", { id, actorIds });
+        const stored = isRecord3(body.row) ? body.row : void 0;
+        const row2 = parseConfirmation(
+          stored && isRecord3(stored.body) ? { ...stored.body, expiresAt: stored.expiresAt } : void 0
+        );
+        if (isRefusal(body.refused))
+          return { ok: false, refused: body.refused, ...row2 ? { row: row2 } : {} };
+        if (!row2) throw new Error("confirmation store answered a consume outside its contract");
+        return { ok: true, row: row2 };
+      }
+      async cancel(id, actorIds) {
+        const body = await this.post("/config/confirmations/cancel", { id, actorIds });
+        if (body.ok === true) return { ok: true };
+        if (body.refused === "used" || body.refused === "foreign") return { ok: false, refused: body.refused };
+        throw new Error("confirmation store answered a cancel outside its contract");
+      }
+      async cancelByThread(threadKey, actorIds) {
+        const body = await this.post("/config/confirmations/cancel-by-thread", { threadKey, actorIds });
+        if (body.ok === true) return { ok: true };
+        if (body.refused === "used" || body.refused === "foreign") return { ok: false, refused: body.refused };
+        throw new Error("confirmation store answered a cancel-by-thread outside its contract");
+      }
+      async pendingByThread(threadKey) {
+        const body = await this.post("/config/confirmations/pending-by-thread", { threadKey });
+        if (body.row === null) return void 0;
+        const stored = isRecord3(body.row) ? body.row : void 0;
+        const row2 = parseConfirmation(
+          stored && isRecord3(stored.body) ? { ...stored.body, expiresAt: stored.expiresAt } : void 0
+        );
+        if (!row2) throw new Error("confirmation store answered a pending-by-thread outside its contract");
+        return row2;
+      }
+      describe() {
+        return `state Worker ${this.baseUrl} (ConfigDO confirmations)`;
+      }
+      async post(path, payload2) {
+        let res;
+        try {
+          res = await this.fetchImpl(`${this.baseUrl}${path}`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${this.opts.token}`, "content-type": "application/json" },
+            body: JSON.stringify(payload2),
+            signal: AbortSignal.timeout(CONFIRMATION_WORKER_TIMEOUT_MS)
+          });
+        } catch (err2) {
+          throw new Error(`confirmation store unreachable: ${err2 instanceof Error ? err2.message : String(err2)}`, {
+            cause: err2
+          });
+        }
+        if (!res.ok) throw new Error(`confirmation store answered HTTP ${res.status} on ${path}`);
+        const body = await res.json().catch(() => void 0);
+        if (!isRecord3(body)) throw new Error(`confirmation store returned a non-JSON body on ${path}`);
+        return body;
+      }
+    };
+  }
+});
+
+// ../../src/core/dispatch/route.ts
+function outputCapWithReasoning(visibleAnswerTokens, opts = {}) {
+  return opts.capField !== void 0 && REASONING_COUNTING_CAP_FIELDS.has(opts.capField) ? visibleAnswerTokens + REASONING_OUTPUT_TOKEN_ALLOWANCE : visibleAnswerTokens;
+}
+function outputCapRetry(current) {
+  return Math.max(current * 2, REASONING_OUTPUT_TOKEN_ALLOWANCE);
+}
+function routedRunsAtOnce(def, confirm, input) {
+  const radius = input === void 0 ? blastRadius(def) : boundBlastRadius(def, input);
+  return radius === "read" || CONFIRM_ORDER[radius] < CONFIRM_ORDER[confirm];
+}
+function routeReceipt(def, input) {
+  return redactAndCap(chatInvocation(def, input), ROUTE_RECEIPT_CAP);
+}
+function routablePresets() {
+  return Object.values(AGENTS).filter((a) => a.routable !== false).map(({ name, description, machine, identity: identity2, maxMinutes }) => ({
+    name,
+    description,
+    machine,
+    identity: identity2,
+    maxMinutes
+  }));
+}
+function routableCommands(commands) {
+  return commands.list().filter((cmd) => CommandRegistry.exposedTo(cmd, "chat")).map((cmd) => ({
+    id: cmd.id,
+    effect: cmd.effect,
+    def: cmd,
+    tool: { name: mcpToolName(cmd.id), description: cmd.describe, inputSchema: jsonSchemaFor(cmd) }
+  }));
+}
+function renderPresetTable(presets) {
+  const rows = presets.map(
+    (p) => `| \`${p.name}\` | ${oneLine(p.description)} | ${p.machine} | ${p.identity} | ${p.maxMinutes} min |`
+  );
+  return ["| name | what it does | machine | credential | budget |", "|---|---|---|---|---|", ...rows].join("\n");
+}
+function quoteRequest(text) {
+  const cap = 2e3;
+  const bent = text.replace(/<(\/?)request>/gi, "\u2039$1request\u203A");
+  if (bent.length <= cap) return bent;
+  return `${bent.slice(0, cap)}
+\u2026[truncated: ${bent.length - cap} more characters]`;
+}
+function providerStructuredModel(provider, model, opts = {}) {
+  const forced = (opts.answer ?? "tool") === "tool";
+  return async (prompt, call2) => {
+    const tools = [prompt.tool, ...prompt.tools ?? []];
+    const toolChoice = prompt.open ? void 0 : tools.length > 1 ? { type: "any" } : { type: "tool", name: prompt.tool.name };
+    const messages = [
+      { role: "user", content: [{ type: "text", text: prompt.user }] },
+      ...(prompt.retries ?? []).flatMap((r) => [
+        { role: "assistant", content: [{ type: "text", text: r.answer }] },
+        { role: "user", content: [{ type: "text", text: r.violation }] }
+      ])
+    ];
+    const result = await provider.complete({
+      model,
+      system: prompt.system,
+      messages,
+      maxTokens: call2.maxTokens,
+      signal: call2.signal,
+      // The caller's configured effort, card-decided (`turnEffort`): intake's
+      // `intake.effort` or the operator's `defaults.efforts.general`. Absent →
+      // the model's own default.
+      ...opts.effort ? { effort: opts.effort.effort, effortWord: opts.effort.effortWord } : {},
+      ...forced ? { tools, toolChoice } : {}
+    });
+    if (result.stopReason === "max_tokens") throw new OutputCapError(call2.maxTokens);
+    const calls = result.content.filter(
+      (p) => p.type === "tool_use"
+    );
+    if (calls.length > 1) throw new MultiToolCallError(calls.map((c) => ({ tool: c.name, input: c.input })));
+    if (calls.length === 1) return { tool: calls[0].name, input: calls[0].input };
+    return result.content.filter((p) => p.type === "text").map((p) => p.text).join("");
+  };
+}
+async function mintConfirmationOffer(args) {
+  const { io, store, msg, origin, def, input, receipt, model } = args;
+  if (!io.offer || !store) return { kind: "no_click" };
+  const line4 = chatInvocation(def, input);
+  if (redactSecrets(line4) !== line4) return { kind: "unshowable" };
+  const risk = def.annotations?.risk?.(input, origin) ?? "";
+  let row2;
+  try {
+    row2 = await store.put(
+      {
+        kind: "run",
+        id: newConfirmationId(),
+        message: confirmationMessageOf(msg),
+        command: def.id,
+        input,
+        receipt,
+        risk,
+        model
+      },
+      CONFIRMATION_TTL_MS
+    );
+  } catch (err2) {
+    console.warn(
+      `[route] ${msg.threadKey} confirmation store unreachable at mint, handing back: ${err2 instanceof Error ? err2.message : String(err2)}`
+    );
+    return { kind: "store_unreachable" };
+  }
+  return { kind: "offered", shown: { id: row2.id, line: line4, risk, expiresAt: row2.expiresAt } };
+}
+function redactedInput(input) {
+  const text = (s) => redactAndCap(redactSecrets(s), 200);
+  const leaf = (v) => {
+    if (typeof v === "string") return text(v);
+    if (typeof v === "number" || typeof v === "boolean" || v === null) return v;
+    return v === void 0 ? null : text(JSON.stringify(v) ?? String(v));
+  };
+  const leafOrList = (v) => Array.isArray(v) ? v.map(leaf) : leaf(v);
+  const isRecord11 = (v) => typeof v === "object" && v !== null && (Object.getPrototypeOf(v) === Object.prototype || Object.getPrototypeOf(v) === null);
+  const entries = (v, of) => Object.fromEntries(
+    Object.entries(v).filter(([, x]) => x !== void 0).map(([k, x]) => [k, of(x)])
+  );
+  const object1 = (v) => entries(v, leafOrList);
+  const object2 = (v) => entries(v, (x) => isRecord11(x) ? object1(x) : leafOrList(x));
+  const object3 = (v) => entries(v, (x) => isRecord11(x) ? object2(x) : leafOrList(x));
+  return {
+    ...input.args ? { args: input.args.map(leaf) } : {},
+    ...input.options ? { options: object3(input.options) } : {}
+  };
+}
+function routeReasonLabel(reason2, collapsed) {
+  return `${ROUTE_REASON_PREFIX} ${reason2}${collapsed ? ` (compound collapsed: ${collapsed.presets.join("+")})` : ""}`;
+}
+function routedPartLines(parts) {
+  return parts.map((p) => {
+    const line4 = p.text.replace(/\s+/g, " ").trim();
+    return `${p.preset}: ${line4.length > ROUTE_PART_LINE_CAP ? `${line4.slice(0, ROUTE_PART_LINE_CAP - 1)}\u2026` : line4}`;
+  });
+}
+function compoundBrief(text, parts) {
+  return [
+    text,
+    "",
+    `${COMPOUND_BRIEF_HEADING}: ${parts.length} independent parts. Spawn exactly these children \u2014 one \`spawn_run\` per part, on the preset named, with the part's text as the child's whole prompt (add the repository where the preset needs one) \u2014 then \`await_runs\` them all and compile one answer. Do not merge, drop or add a part.`,
+    ...parts.map((p, i) => `${i + 1}. \`${p.preset}\`: ${p.text}`)
+  ].join("\n");
+}
+var REASONING_COUNTING_CAP_FIELDS, REASONING_OUTPUT_TOKEN_ALLOWANCE, OutputCapError, ROUTE_REASON_CAP, ROUTE_MIN_OUTPUT_TOKENS, ROUTE_TIMEOUT_MS, ROUTE_PART_LINE_CAP, ROUTE_RECEIPT_CAP, ROUTED_RECEIPT_PREFIX, COMPOUND_BRIEF_HEADING, MultiToolCallError;
+var init_route = __esm({
+  "../../src/core/dispatch/route.ts"() {
+    "use strict";
+    init_registry();
+    init_handBack();
+    init_profile();
+    init_redact();
+    init_statusCardFrame();
+    init_commandRegistry();
+    init_commandSurface();
+    init_budgets();
+    init_confirmations();
+    REASONING_COUNTING_CAP_FIELDS = /* @__PURE__ */ new Set(["max_tokens", "max_completion_tokens", "max_output_tokens"]);
+    REASONING_OUTPUT_TOKEN_ALLOWANCE = 4096;
+    OutputCapError = class extends Error {
+      constructor(maxTokens) {
+        super(`answer cut at the output cap (${maxTokens} tokens)`);
+        this.maxTokens = maxTokens;
+        this.name = "OutputCapError";
+      }
+      maxTokens;
+    };
+    ROUTE_REASON_CAP = 120;
+    ROUTE_MIN_OUTPUT_TOKENS = 200;
+    ROUTE_TIMEOUT_MS = 8e3;
+    ROUTE_PART_LINE_CAP = 100;
+    ROUTE_RECEIPT_CAP = 300;
+    ROUTED_RECEIPT_PREFIX = "routed:";
+    COMPOUND_BRIEF_HEADING = "Routed as a compound request";
+    MultiToolCallError = class extends Error {
+      constructor(calls) {
+        super(`answer carried ${calls.length} tool calls; the route is one call`);
+        this.calls = calls;
+        this.name = "MultiToolCallError";
+      }
+      calls;
+    };
+  }
+});
+
 // ../../src/core/memory/reflection.ts
 import { z as z15 } from "zod";
 function shouldReflect(input) {
@@ -29288,13 +29788,14 @@ async function reflect(deps) {
     const seen = /* @__PURE__ */ new Set();
     const existing = [...await windowP, ...hits].filter((r) => !seen.has(r.id) && (seen.add(r.id), true));
     const text = buildReflectionInput({ history: deps.history, request: deps.request, answer: deps.answer, existing });
+    const maxTokens = outputCapWithReasoning(REFLECTION_MAX_TOKENS, { capField: deps.capField });
     let result;
     try {
       result = await deps.provider.complete({
         model: deps.model,
         system: REFLECTION_SYSTEM,
         messages: [{ role: "user", content: [{ type: "text", text }] }],
-        maxTokens: REFLECTION_MAX_TOKENS,
+        maxTokens,
         ...deps.effort !== void 0 ? { effort: deps.effort } : {},
         ...deps.effortWord !== void 0 ? { effortWord: deps.effortWord } : {}
       });
@@ -29303,13 +29804,17 @@ async function reflect(deps) {
       warn(`reflection skipped: ${renderProviderFailure(failure2.cause)}`);
       return;
     }
+    const truncated = result.stopReason === "max_tokens" ? `truncated at ${maxTokens} max tokens` : void 0;
+    if (truncated) {
+      warn(`reflection output rejected (${truncated}); nothing written`);
+      return;
+    }
     const reply = result.content.filter((p) => p.type === "text").map((p) => p.text).join("");
     const prov = { sourceThreadKey: deps.sourceThreadKey, sourceRunId: deps.sourceRunId };
     const parsed = parseReflection(reply, prov, new Set(existing.map((r) => r.id)));
-    const truncated = result.stopReason === "max_tokens" ? `truncated at ${REFLECTION_MAX_TOKENS} max tokens` : void 0;
-    const stopNote = truncated ?? (result.stopReason === "end_turn" ? void 0 : `stop: ${result.stopReason}`);
+    const stopNote = result.stopReason === "end_turn" ? void 0 : `stop: ${result.stopReason}`;
     if (!parsed.ok) {
-      const why = truncated ?? (stopNote ? `${parsed.error}; ${stopNote}` : parsed.error);
+      const why = stopNote ? `${parsed.error}; ${stopNote}` : parsed.error;
       warn(`reflection output rejected (${why}); nothing written`);
       return;
     }
@@ -29380,6 +29885,7 @@ var init_reflection = __esm({
     init_authz();
     init_runEvents();
     init_llmOutput();
+    init_route();
     init_engine();
     init_scorer();
     init_scope2();
@@ -29622,10 +30128,13 @@ function scheduleReflection(input) {
   const info = (m) => console.log(`[memory] ${input.threadKey} ${m}`);
   let provider;
   let model;
+  let capField;
   try {
-    const ref = parseModelRef(input.cfg.model ?? input.runModelRef);
+    const modelRef3 = input.cfg.model ?? input.runModelRef;
+    const ref = parseModelRef(modelRef3);
     provider = input.providers.get(ref.provider);
     model = ref.model;
+    capField = resolveModelCard(modelRef3, input.providerBlocks ?? {}, installedModelRegistry).capField;
   } catch (err2) {
     warn(`reflection skipped: ${err2 instanceof Error ? err2.message : String(err2)}`);
     return;
@@ -29637,6 +30146,7 @@ function scheduleReflection(input) {
       provider,
       model,
       ...effort2.request ? { effort: effort2.request.effort, effortWord: effort2.request.effortWord } : {},
+      ...capField !== void 0 ? { capField } : {},
       store: selectMemoryStore(input.cfg, input.store),
       scopeKeys: requestScopeKeys(input.organization, input.userId, { channelId: input.channelId, repo: input.repo }),
       actor: reflectionActor(input.actor, { channelId: input.channelId, repo: input.repo }),
@@ -29693,6 +30203,8 @@ var init_memory = __esm({
     "use strict";
     init_provider();
     init_turnEffort();
+    init_installedModelRegistry();
+    init_modelCard();
     init_scorer();
     init_scope2();
     init_stores();
@@ -31208,7 +31720,7 @@ ${line4}` : ""}`
 });
 
 // ../../src/core/reviewAbridge.ts
-import { resolve as resolve9 } from "node:path";
+import { resolve as resolve10 } from "node:path";
 function meatArtifactOf(record2) {
   return record2.events.find((e) => isReadingDiff(e) && e.poweredBy === "meat");
 }
@@ -31253,7 +31765,7 @@ function reviewAbridgerFromConfig(config, store, secrets, env, dataDir, warn) {
     github: () => github,
     meat: meatOnHost({
       apiKey: () => anthropicApiKey(config().providers, secrets),
-      cacheDir: resolve9(dataDir, "meat-cache"),
+      cacheDir: resolve10(dataDir, "meat-cache"),
       hostEnv: { PATH: env.PATH, HOME: env.HOME }
     }),
     defaultModel: () => {
@@ -34611,7 +35123,7 @@ var init_githubRepoInspect = __esm({
 });
 
 // ../../src/core/commandCatalogue.ts
-import { existsSync as existsSync12, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync15 } from "node:fs";
 import { readFile as readFile2 } from "node:fs/promises";
 function unstampedStatus() {
   let version2 = "unknown";
@@ -34636,10 +35148,10 @@ function defaultOperations(config, secrets, caller) {
   return null;
 }
 function readSource(source2) {
-  return Promise.resolve(readFileSync14(source2 === "-" ? 0 : source2, "utf8"));
+  return Promise.resolve(readFileSync15(source2 === "-" ? 0 : source2, "utf8"));
 }
 async function readOptionalFile(path) {
-  return existsSync12(path) ? readFile2(path, "utf8") : void 0;
+  return existsSync13(path) ? readFile2(path, "utf8") : void 0;
 }
 function once(provided) {
   if (typeof provided !== "function") {
@@ -35116,232 +35628,6 @@ var init_trace = __esm({
   }
 });
 
-// ../../src/core/confirmations.ts
-import { randomUUID } from "node:crypto";
-import { existsSync as existsSync13, mkdirSync as mkdirSync9, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname10, resolve as resolve10 } from "node:path";
-function newConfirmationId() {
-  return randomUUID();
-}
-function renderOffer(offer) {
-  if (offer.question) return `${offer.question.text}
-Did you mean:
-\`${offer.line}\`
-
-${offer.question.evidence}`;
-  return [offer.line, ...offer.risk ? [offer.risk] : []].join("\n");
-}
-function confirmationMessageOf(msg) {
-  const { images: _images, documents: _documents, staged: _staged, ...kept } = msg;
-  return kept;
-}
-function isRecord3(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function isMessage(v) {
-  return isRecord3(v) && typeof v.channelId === "string" && typeof v.userId === "string" && typeof v.threadKey === "string" && typeof v.text === "string";
-}
-function isRunShape(v) {
-  return typeof v.id === "string" && isMessage(v.message) && typeof v.command === "string" && isRecord3(v.input) && typeof v.receipt === "string" && typeof v.risk === "string" && typeof v.model === "string";
-}
-function isRedispatchShape(v) {
-  return typeof v.id === "string" && isMessage(v.message) && typeof v.line === "string" && typeof v.evidence === "string" && typeof v.code === "string";
-}
-function parsePendingConfirmation(v) {
-  if (!isRecord3(v)) return void 0;
-  if (v.kind === "redispatch")
-    return isRedispatchShape(v) ? v : void 0;
-  if (v.kind !== void 0 && v.kind !== "run") return void 0;
-  return isRunShape(v) ? { ...v, kind: "run" } : void 0;
-}
-function parseConfirmation(v) {
-  if (!isRecord3(v) || typeof v.expiresAt !== "number") return void 0;
-  const pending2 = parsePendingConfirmation(v);
-  return pending2 ? { ...pending2, expiresAt: v.expiresAt } : void 0;
-}
-function isRefusal(v) {
-  return typeof v === "string" && CONFIRMATION_REFUSALS.includes(v);
-}
-function judge2(rows, id, actorIds, now, kind) {
-  const row2 = rows.get(id);
-  if (!row2) return { ok: false, refused: "used" };
-  if (kind === "consume" && row2.expiresAt <= now) {
-    rows.delete(id);
-    return { ok: false, refused: "expired", row: row2 };
-  }
-  if (!actorIds.includes(row2.message.userId))
-    return kind === "consume" ? { ok: false, refused: "foreign", row: row2 } : { ok: false, refused: "foreign" };
-  rows.delete(id);
-  return kind === "consume" ? { ok: true, row: row2 } : { ok: true };
-}
-function replaceThreadRow(rows, row2) {
-  for (const [id, r] of rows) if (r.message.threadKey === row2.message.threadKey) rows.delete(id);
-  rows.set(row2.id, row2);
-}
-function threadRowId(rows, threadKey) {
-  for (const [id, r] of rows) if (r.message.threadKey === threadKey) return id;
-  return void 0;
-}
-function buildConfirmationStore(config, secrets, opts) {
-  const worker = config.config.runtimeOverrides?.worker;
-  if (!worker) return new FileConfirmationStore(opts.path);
-  const tokenEnv = worker.tokenEnv ?? "MEMORY_TOKEN";
-  const token2 = secrets.named(tokenEnv);
-  if (!token2) throw new Error(`runtimeOverrides.worker is configured but ${tokenEnv} is not set`);
-  return new WorkerConfirmationStore({
-    baseUrl: worker.baseUrl,
-    token: token2.reveal(),
-    ...opts.fetch ? { fetch: opts.fetch } : {}
-  });
-}
-var CONFIRMATION_REFUSALS, UNSHOWABLE_LINE, STORE_UNREACHABLE_LINE, FileConfirmationStore, CONFIRMATION_WORKER_TIMEOUT_MS, WorkerConfirmationStore;
-var init_confirmations = __esm({
-  "../../src/core/confirmations.ts"() {
-    "use strict";
-    init_clock();
-    CONFIRMATION_REFUSALS = ["used", "expired", "foreign"];
-    UNSHOWABLE_LINE = "this command carries a value that cannot be shown, so no confirmation can be offered; nothing ran";
-    STORE_UNREACHABLE_LINE = "this command needs a confirmation click, and the confirmation store could not be reached; nothing ran \u2014 ask again for the button";
-    FileConfirmationStore = class {
-      path;
-      clock;
-      constructor(path, opts = {}) {
-        this.path = resolve10(path);
-        this.clock = opts.clock ?? systemClock;
-      }
-      read() {
-        const rows = /* @__PURE__ */ new Map();
-        if (!existsSync13(this.path)) return rows;
-        const raw = JSON.parse(readFileSync15(this.path, "utf8"));
-        for (const v of Array.isArray(raw.confirmations) ? raw.confirmations : []) {
-          const row2 = parseConfirmation(v);
-          if (row2) rows.set(row2.id, row2);
-        }
-        return rows;
-      }
-      write(rows) {
-        mkdirSync9(dirname10(this.path), { recursive: true });
-        writeFileSync8(this.path, JSON.stringify({ confirmations: [...rows.values()] }, null, 2));
-      }
-      async put(row2, ttlMs) {
-        const rows = this.read();
-        const stored = { ...row2, expiresAt: this.clock() + ttlMs };
-        replaceThreadRow(rows, stored);
-        this.write(rows);
-        return stored;
-      }
-      async consume(id, actorIds) {
-        const rows = this.read();
-        const out = judge2(rows, id, actorIds, this.clock(), "consume");
-        this.write(rows);
-        return out;
-      }
-      async cancel(id, actorIds) {
-        const rows = this.read();
-        const out = judge2(rows, id, actorIds, this.clock(), "cancel");
-        this.write(rows);
-        return out;
-      }
-      async cancelByThread(threadKey, actorIds) {
-        const rows = this.read();
-        const id = threadRowId(rows, threadKey);
-        if (id === void 0) return { ok: false, refused: "used" };
-        const out = judge2(rows, id, actorIds, this.clock(), "cancel");
-        this.write(rows);
-        return out;
-      }
-      async pendingByThread(threadKey) {
-        const rows = this.read();
-        const id = threadRowId(rows, threadKey);
-        const row2 = id === void 0 ? void 0 : rows.get(id);
-        if (!row2 || row2.expiresAt <= this.clock()) return void 0;
-        return row2;
-      }
-      describe() {
-        return `file ${this.path}`;
-      }
-    };
-    CONFIRMATION_WORKER_TIMEOUT_MS = 8e3;
-    WorkerConfirmationStore = class {
-      constructor(opts) {
-        this.opts = opts;
-        this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
-        this.fetchImpl = opts.fetch ?? fetch;
-      }
-      opts;
-      baseUrl;
-      fetchImpl;
-      async put(row2, ttlMs) {
-        const body = await this.post("/config/confirmations/put", {
-          id: row2.id,
-          threadKey: row2.message.threadKey,
-          requester: row2.message.userId,
-          body: row2,
-          ttlMs
-        });
-        if (typeof body.expiresAt !== "number")
-          throw new Error("confirmation store answered a put without the expiry it stamped");
-        return { ...row2, expiresAt: body.expiresAt };
-      }
-      async consume(id, actorIds) {
-        const body = await this.post("/config/confirmations/consume", { id, actorIds });
-        const stored = isRecord3(body.row) ? body.row : void 0;
-        const row2 = parseConfirmation(
-          stored && isRecord3(stored.body) ? { ...stored.body, expiresAt: stored.expiresAt } : void 0
-        );
-        if (isRefusal(body.refused))
-          return { ok: false, refused: body.refused, ...row2 ? { row: row2 } : {} };
-        if (!row2) throw new Error("confirmation store answered a consume outside its contract");
-        return { ok: true, row: row2 };
-      }
-      async cancel(id, actorIds) {
-        const body = await this.post("/config/confirmations/cancel", { id, actorIds });
-        if (body.ok === true) return { ok: true };
-        if (body.refused === "used" || body.refused === "foreign") return { ok: false, refused: body.refused };
-        throw new Error("confirmation store answered a cancel outside its contract");
-      }
-      async cancelByThread(threadKey, actorIds) {
-        const body = await this.post("/config/confirmations/cancel-by-thread", { threadKey, actorIds });
-        if (body.ok === true) return { ok: true };
-        if (body.refused === "used" || body.refused === "foreign") return { ok: false, refused: body.refused };
-        throw new Error("confirmation store answered a cancel-by-thread outside its contract");
-      }
-      async pendingByThread(threadKey) {
-        const body = await this.post("/config/confirmations/pending-by-thread", { threadKey });
-        if (body.row === null) return void 0;
-        const stored = isRecord3(body.row) ? body.row : void 0;
-        const row2 = parseConfirmation(
-          stored && isRecord3(stored.body) ? { ...stored.body, expiresAt: stored.expiresAt } : void 0
-        );
-        if (!row2) throw new Error("confirmation store answered a pending-by-thread outside its contract");
-        return row2;
-      }
-      describe() {
-        return `state Worker ${this.baseUrl} (ConfigDO confirmations)`;
-      }
-      async post(path, payload2) {
-        let res;
-        try {
-          res = await this.fetchImpl(`${this.baseUrl}${path}`, {
-            method: "POST",
-            headers: { authorization: `Bearer ${this.opts.token}`, "content-type": "application/json" },
-            body: JSON.stringify(payload2),
-            signal: AbortSignal.timeout(CONFIRMATION_WORKER_TIMEOUT_MS)
-          });
-        } catch (err2) {
-          throw new Error(`confirmation store unreachable: ${err2 instanceof Error ? err2.message : String(err2)}`, {
-            cause: err2
-          });
-        }
-        if (!res.ok) throw new Error(`confirmation store answered HTTP ${res.status} on ${path}`);
-        const body = await res.json().catch(() => void 0);
-        if (!isRecord3(body)) throw new Error(`confirmation store returned a non-JSON body on ${path}`);
-        return body;
-      }
-    };
-  }
-});
-
 // ../../src/core/markdownDocument.ts
 function toMarkdownDocument(text) {
   return text.replace(/[\uE000\uE001]/g, "").split(/(```[\s\S]*?```)/g).map((seg, i) => i % 2 === 1 ? seg : hardBreaks(convertProse(seg))).join("");
@@ -36463,30 +36749,62 @@ function checkPrHeadPreflight(input) {
 async function guardAttachedHead(input) {
   const expected = normalizeHead(input.expectedHeadSha);
   if (!expected) return { outcome: "unverified" };
-  const attached = normalizeHead(input.attached.sha);
-  const source2 = input.attached.source ?? "workspace-observed";
   const where = `${input.pr.repo}#${input.pr.number}`;
-  const branch2 = input.attached.ref ?? input.fallbackRef;
-  const namedSource = source2 === "resident binding" ? branch2 ? `${source2} for ${branch2}` : source2 : branch2 ? `${source2} HEAD for ${branch2}` : `${source2} HEAD`;
-  if (!attached) {
-    console.log(`[review] ${input.logKey} not started: ${namedSource} unreadable, PR head ${expected} (${where})`);
+  const namedSource = (observed) => {
+    const source3 = observed.source ?? "workspace-observed";
+    const branch2 = observed.ref ?? input.fallbackRef;
+    return source3 === "resident binding" ? branch2 ? `${source3} for ${branch2}` : source3 : branch2 ? `${source3} HEAD for ${branch2}` : `${source3} HEAD`;
+  };
+  const first = normalizeHead(input.attached.sha);
+  if (first && sameCommit(expected, first)) return { outcome: "verified" };
+  if (first) {
+    const current = normalizeHead(await input.fetchPrHead(input.pr).catch(() => void 0));
+    if (current && sameCommit(first, current)) {
+      console.log(
+        `[review] ${input.logKey} PR head moved since resolution: ${expected} \u2192 ${current}; the ${namedSource(input.attached)} is at the current head \u2014 reviewing it (${where})`
+      );
+      return { outcome: "adopted", headSha: current };
+    }
+  }
+  let retried;
+  let reprovisionFailed = false;
+  try {
+    retried = await input.reprovision(expected);
+  } catch {
+    reprovisionFailed = true;
+    retried = { sha: void 0 };
+  }
+  const checked = normalizeHead(retried.sha);
+  if (checked && sameCommit(expected, checked)) {
+    console.log(`[review] ${input.logKey} workspace reprovisioned at reviewed head ${expected} (${where})`);
+    return { outcome: "verified" };
+  }
+  const initial = first ? `the initial ${namedSource(input.attached)} was at ${first}` : `the initial ${namedSource(input.attached)} could not be read`;
+  if (reprovisionFailed) {
+    console.log(
+      `[review] ${input.logKey} not started: ${initial}; reprovision failed before retry HEAD observation, expected reviewed head ${expected} (${where})`
+    );
     return {
       outcome: "refused",
-      reply: `\u{1F500} Review of ${where} not started: ${namedSource} could not be read, so the workspace cannot be verified against PR head ${expected}. This is a bug: the infrastructure failure was not retried automatically. It is not a finding, and nothing was posted to GitHub.`
+      reply: `\u{1F500} Review of ${where} not started: ${initial}, and the automatic reprovision failed before a retry HEAD could be observed; the expected reviewed head is ${expected}. It is not a finding, and nothing was posted to GitHub.`
     };
   }
-  if (sameCommit(expected, attached)) return { outcome: "verified" };
-  const current = normalizeHead(await input.fetchPrHead(input.pr).catch(() => void 0));
-  if (current && sameCommit(attached, current)) {
+  const source2 = namedSource(retried);
+  if (!checked) {
     console.log(
-      `[review] ${input.logKey} PR head moved since resolution: ${expected} \u2192 ${current}; the ${namedSource} is at the current head \u2014 reviewing it (${where})`
+      `[review] ${input.logKey} not started: ${initial}; ${source2} unreadable after reprovision, expected reviewed head ${expected} (${where})`
     );
-    return { outcome: "adopted", headSha: current };
+    return {
+      outcome: "refused",
+      reply: `\u{1F500} Review of ${where} not started: ${initial}, and the ${source2} could not be read after one automatic reprovision, so it could not be verified; the expected reviewed head is ${expected}. It is not a finding, and nothing was posted to GitHub.`
+    };
   }
-  console.log(`[review] ${input.logKey} not started: ${namedSource} ${attached}, PR head ${expected} (${where})`);
+  console.log(
+    `[review] ${input.logKey} not started: ${source2} ${checked} after reprovision, expected reviewed head ${expected} (${where})`
+  );
   return {
     outcome: "refused",
-    reply: `\u{1F500} Review of ${where} not started: the ${namedSource} is at ${attached}, but the PR head is ${expected} \u2014 the branch moved while the workspace was being prepared (a push or force-push). This is a bug: the workspace was not reprovisioned automatically at the new head. It is not a finding, and nothing was posted to GitHub.`
+    reply: `\u{1F500} Review of ${where} not started: after one automatic reprovision, the ${source2} is at ${checked}, but the expected reviewed head is ${expected}. It is not a finding, and nothing was posted to GitHub.`
   };
 }
 function makeSystemComposer(input) {
@@ -36964,14 +37282,19 @@ async function authorizePrHead(ctx) {
   }
   return { kind: "allowed" };
 }
+function reviewCheckoutFacts(repoCtx) {
+  return {
+    remote: `https://github.com/${repoCtx.repo}.git`,
+    helper: `!f() { test -n "$GH_TOKEN" || exit 1; printf '%s\\n' 'username=x-access-token' "password=$GH_TOKEN"; }; f`,
+    refspecs: [
+      "+HEAD:refs/remotes/origin/HEAD",
+      `+refs/pull/${repoCtx.pr}/head:refs/remotes/origin/pull/${repoCtx.pr}/head`,
+      ...repoCtx.baseRef ? [`+refs/heads/${repoCtx.baseRef}:refs/remotes/origin/${repoCtx.baseRef}`] : []
+    ]
+  };
+}
 function coldReviewCheckoutCommand(repoCtx) {
-  const remote = `https://github.com/${repoCtx.repo}.git`;
-  const helper = `!f() { test -n "$GH_TOKEN" || exit 1; printf '%s\\n' 'username=x-access-token' "password=$GH_TOKEN"; }; f`;
-  const refspecs = [
-    "+HEAD:refs/remotes/origin/HEAD",
-    `+refs/pull/${repoCtx.pr}/head:refs/remotes/origin/pull/${repoCtx.pr}/head`,
-    ...repoCtx.baseRef ? [`+refs/heads/${repoCtx.baseRef}:refs/remotes/origin/${repoCtx.baseRef}`] : []
-  ];
+  const { remote, helper, refspecs } = reviewCheckoutFacts(repoCtx);
   return [
     "set -eu",
     "find . -mindepth 1 -maxdepth 1 ! -name attachments -exec rm -rf -- {} +",
@@ -36981,6 +37304,15 @@ function coldReviewCheckoutCommand(repoCtx) {
     `git checkout --detach --force ${shellQuote(repoCtx.headSha)}`
   ].join("\n");
 }
+function seededReviewCheckoutCommand(repoCtx, workspace) {
+  const { helper, refspecs } = reviewCheckoutFacts(repoCtx);
+  const git2 = `git -C ${shellQuote(workspace)}`;
+  return [
+    "set -eu",
+    `${git2} -c credential.helper= -c credential.helper=${shellQuote(helper)} fetch --force --no-tags origin ${refspecs.map(shellQuote).join(" ")}`,
+    `${git2} checkout --detach --force ${shellQuote(repoCtx.headSha)}`
+  ].join("\n");
+}
 async function authorizeAttachedHead(deps, ctx) {
   const { msg, refuse: refuse3, card, shell, closeLines, clock: clock4, agent, resume, selection, root } = ctx;
   const { executor, resident, binding } = selection;
@@ -36991,7 +37323,6 @@ async function authorizeAttachedHead(deps, ctx) {
     const pr = { repo: repoCtx.repo, number: repoCtx.pr };
     const expectedHeadSha = repoCtx.headSha;
     const guard = await root.span("dispatch.gate.attached_head", async (span) => {
-      const source2 = resident && binding?.sha !== void 0 ? "resident binding" : "workspace-observed";
       const command2 = selection.seeded?.workspace ? `git -C ${shellQuote(selection.seeded.workspace)} rev-parse HEAD` : "git rev-parse HEAD";
       if (!resident && selection.seeded === void 0 && expectedHeadSha !== void 0) {
         await executor.exec(
@@ -36999,13 +37330,48 @@ async function authorizeAttachedHead(deps, ctx) {
           { timeoutMs: BASH_TIMEOUT_MAX_MS }
         );
       }
-      const sha = source2 === "resident binding" ? binding?.sha : await executor.exec(command2, { timeoutMs: 3e4 }).then(parseRevParseOutput).catch(() => void 0);
+      const observeHead = () => executor.exec(command2, { timeoutMs: 3e4, span }).then(parseRevParseOutput).catch(() => void 0);
+      const sha = await observeHead();
       const g = await guardAttachedHead({
         pr,
         expectedHeadSha,
-        attached: { sha, ref: binding?.ref ?? repoCtx.ref, source: source2 },
+        attached: { sha, ref: binding?.ref ?? repoCtx.ref, source: "workspace-observed" },
         fallbackRef: repoCtx.ref,
         fetchPrHead: deps.fetchPrHead ?? currentPrHeadSha,
+        reprovision: async (headSha) => {
+          if (executor.moveTo) {
+            await executor.moveTo(headSha, { span });
+            const observedSha = await observeHead();
+            if (selection.binding && observedSha !== void 0) {
+              selection.binding = {
+                ...selection.binding,
+                ref: repoCtx.ref ?? selection.binding.ref,
+                sha: observedSha
+              };
+            }
+            return {
+              sha: observedSha,
+              ref: repoCtx.ref,
+              source: "workspace-observed"
+            };
+          }
+          if (selection.seeded?.workspace) {
+            await executor.exec(
+              seededReviewCheckoutCommand(
+                { ...repoCtx, repo: pr.repo, pr: pr.number, headSha },
+                selection.seeded.workspace
+              ),
+              { timeoutMs: BASH_TIMEOUT_MAX_MS, span }
+            );
+          } else {
+            await executor.exec(coldReviewCheckoutCommand({ ...repoCtx, repo: pr.repo, pr: pr.number, headSha }), {
+              timeoutMs: BASH_TIMEOUT_MAX_MS,
+              span
+            });
+          }
+          const retried = await observeHead();
+          return { sha: retried, ref: repoCtx.ref, source: "workspace-observed" };
+        },
         logKey: msg.threadKey
       });
       span.setAttrs({ outcome: g.outcome });
@@ -37018,14 +37384,19 @@ async function authorizeAttachedHead(deps, ctx) {
       verifiedAtAttach = true;
       headAdopted = true;
     } else if (guard.outcome === "refused") {
-      await refuse3(refusalOf("branch_moved", guard.reply), async () => {
+      await refuse3(refusalOf("workspace_head_mismatch", guard.reply), async () => {
         if (executor.release) await executor.release("always").catch(() => {
         });
         await card.done(
-          shell.close({ kind: "not_started", icon: "\u{1F500}", reason: "branch moved", ...closeLines(clock4(), false) })
+          shell.close({
+            kind: "not_started",
+            icon: "\u{1F500}",
+            reason: "workspace head mismatch",
+            ...closeLines(clock4(), false)
+          })
         );
       });
-      return { kind: "refused", reason: "branch_moved" };
+      return { kind: "refused", reason: "workspace_head_mismatch" };
     }
   }
   return { kind: "allowed", repoCtx, verifiedAtAttach, headAdopted };
@@ -37418,6 +37789,10 @@ var init_threadAdmission = __esm({
       get size() {
         return this.pending.length;
       }
+      /** The ledger seqs of the follow-ups still pending, oldest first. */
+      get pendingSeqs() {
+        return this.pending.flatMap((input) => input.ledgerSeq !== void 0 ? [input.ledgerSeq] : []);
+      }
     };
     ThreadAdmission = class {
       live = /* @__PURE__ */ new Map();
@@ -38085,279 +38460,6 @@ var init_commandChat = __esm({
   }
 });
 
-// ../../src/core/dispatch/handBack.ts
-function renderHandBackLine(line4) {
-  return `${HAND_BACK_PREFIX}
-\`${line4}\``;
-}
-var HAND_BACK_PREFIX;
-var init_handBack = __esm({
-  "../../src/core/dispatch/handBack.ts"() {
-    "use strict";
-    HAND_BACK_PREFIX = "To run this:";
-  }
-});
-
-// ../../src/core/statusCardFrame.ts
-function activityText(activity) {
-  if (!activity) return void 0;
-  if (activity.kind === "line") return activity.text;
-  return `\u2192 $ ${activity.command.replace(/\s+/g, " ").trim()}`;
-}
-function createCardShell(opts) {
-  const verbosity2 = opts.verbosity ?? DEFAULT_VERBOSITY;
-  const notes = [];
-  let link = opts.link;
-  let frame2 = 0;
-  let finishedAt;
-  let setupLabel;
-  const lead = opts.lead ?? [];
-  const base = () => opts.model !== void 0 && shows(verbosity2, "verbose") ? `${opts.label} on \`${opts.model}\`` : opts.label;
-  const label = () => [base(), ...notes.filter((n2) => shows(verbosity2, n2.level)).map((n2) => n2.text)].join(" \xB7 ");
-  const elapsed2 = () => formatDuration((finishedAt ?? opts.now()) - opts.startedAt, "clock");
-  const headline = (icon) => `${icon} ${label()} \xB7 ${elapsed2()}`;
-  const closeDetail = (close, own) => [...shows(verbosity2, "debug") ? [close.shape, close.queued] : [], own].filter(Boolean).join("\n") || void 0;
-  return {
-    get label() {
-      return label();
-    },
-    note(level, text) {
-      notes.push({ level, text });
-    },
-    setLink(next) {
-      link = next;
-    },
-    freeze(at) {
-      finishedAt = at;
-    },
-    setSetupLabel(next) {
-      setupLabel = next;
-    },
-    ack() {
-      const detail = lead.join("\n");
-      return { title: `\u{1F440} ${label()} \xB7 preparing workspace\u2026`, ...detail ? { detail } : {} };
-    },
-    live(parts = {}) {
-      const glyph = SPINNER_GLYPHS[frame2++ % SPINNER_GLYPHS.length];
-      const detail = [...lead, ...parts.detail ?? []].filter(Boolean).join("\n");
-      return {
-        title: headline(glyph) + (setupLabel ? ` \u2014 ${setupLabel}` : "") + (parts.suffix ?? "") + (parts.notice ? ` \xB7 ${parts.notice}` : ""),
-        detail: detail || void 0,
-        ...parts.activity ? { activity: parts.activity } : {},
-        link
-      };
-    },
-    close(close) {
-      const detail = closeDetail(close, close.kind === "done" ? close.detail : void 0);
-      switch (close.kind) {
-        case "done":
-          return { title: headline(close.icon), detail, link };
-        case "not_started":
-          return { title: `${close.icon} ${label()} \xB7 not started (${close.reason}) \xB7 ${elapsed2()}`, detail };
-        case "refused":
-          return { title: `${close.icon} ${label()} \xB7 ${close.reason} \xB7 ${elapsed2()}`, detail };
-        case "setup_failed":
-          return { title: `\u274C setup failed \xB7 ${close.reason} \xB7 ${elapsed2()}`, detail };
-      }
-    }
-  };
-}
-var SPINNER_GLYPHS, LIVE_CARD_PREFIXES, ROUTE_REASON_PREFIX;
-var init_statusCardFrame = __esm({
-  "../../src/core/statusCardFrame.ts"() {
-    "use strict";
-    init_formatDuration();
-    init_verbosity();
-    SPINNER_GLYPHS = ["\u25D0", "\u25D3", "\u25D1", "\u25D2"];
-    LIVE_CARD_PREFIXES = [...SPINNER_GLYPHS, "\u{1F440}"];
-    ROUTE_REASON_PREFIX = "route reason:";
-  }
-});
-
-// ../../src/core/dispatch/route.ts
-function outputCapWithReasoning(visibleAnswerTokens, opts = {}) {
-  return opts.capField !== void 0 && REASONING_COUNTING_CAP_FIELDS.has(opts.capField) ? visibleAnswerTokens + REASONING_OUTPUT_TOKEN_ALLOWANCE : visibleAnswerTokens;
-}
-function outputCapRetry(current) {
-  return Math.max(current * 2, REASONING_OUTPUT_TOKEN_ALLOWANCE);
-}
-function routedRunsAtOnce(def, confirm, input) {
-  const radius = input === void 0 ? blastRadius(def) : boundBlastRadius(def, input);
-  return radius === "read" || CONFIRM_ORDER[radius] < CONFIRM_ORDER[confirm];
-}
-function routeReceipt(def, input) {
-  return redactAndCap(chatInvocation(def, input), ROUTE_RECEIPT_CAP);
-}
-function routablePresets() {
-  return Object.values(AGENTS).filter((a) => a.routable !== false).map(({ name, description, machine, identity: identity2, maxMinutes }) => ({
-    name,
-    description,
-    machine,
-    identity: identity2,
-    maxMinutes
-  }));
-}
-function routableCommands(commands) {
-  return commands.list().filter((cmd) => CommandRegistry.exposedTo(cmd, "chat")).map((cmd) => ({
-    id: cmd.id,
-    effect: cmd.effect,
-    def: cmd,
-    tool: { name: mcpToolName(cmd.id), description: cmd.describe, inputSchema: jsonSchemaFor(cmd) }
-  }));
-}
-function renderPresetTable(presets) {
-  const rows = presets.map(
-    (p) => `| \`${p.name}\` | ${oneLine(p.description)} | ${p.machine} | ${p.identity} | ${p.maxMinutes} min |`
-  );
-  return ["| name | what it does | machine | credential | budget |", "|---|---|---|---|---|", ...rows].join("\n");
-}
-function quoteRequest(text) {
-  const cap = 2e3;
-  const bent = text.replace(/<(\/?)request>/gi, "\u2039$1request\u203A");
-  if (bent.length <= cap) return bent;
-  return `${bent.slice(0, cap)}
-\u2026[truncated: ${bent.length - cap} more characters]`;
-}
-function providerStructuredModel(provider, model, opts = {}) {
-  const forced = (opts.answer ?? "tool") === "tool";
-  return async (prompt, call2) => {
-    const tools = [prompt.tool, ...prompt.tools ?? []];
-    const toolChoice = prompt.open ? void 0 : tools.length > 1 ? { type: "any" } : { type: "tool", name: prompt.tool.name };
-    const messages = [
-      { role: "user", content: [{ type: "text", text: prompt.user }] },
-      ...(prompt.retries ?? []).flatMap((r) => [
-        { role: "assistant", content: [{ type: "text", text: r.answer }] },
-        { role: "user", content: [{ type: "text", text: r.violation }] }
-      ])
-    ];
-    const result = await provider.complete({
-      model,
-      system: prompt.system,
-      messages,
-      maxTokens: call2.maxTokens,
-      signal: call2.signal,
-      // The caller's configured effort, card-decided (`turnEffort`): intake's
-      // `intake.effort` or the operator's `defaults.efforts.general`. Absent →
-      // the model's own default.
-      ...opts.effort ? { effort: opts.effort.effort, effortWord: opts.effort.effortWord } : {},
-      ...forced ? { tools, toolChoice } : {}
-    });
-    if (result.stopReason === "max_tokens") throw new OutputCapError(call2.maxTokens);
-    const calls = result.content.filter(
-      (p) => p.type === "tool_use"
-    );
-    if (calls.length > 1) throw new MultiToolCallError(calls.map((c) => ({ tool: c.name, input: c.input })));
-    if (calls.length === 1) return { tool: calls[0].name, input: calls[0].input };
-    return result.content.filter((p) => p.type === "text").map((p) => p.text).join("");
-  };
-}
-async function mintConfirmationOffer(args) {
-  const { io, store, msg, origin, def, input, receipt, model } = args;
-  if (!io.offer || !store) return { kind: "no_click" };
-  const line4 = chatInvocation(def, input);
-  if (redactSecrets(line4) !== line4) return { kind: "unshowable" };
-  const risk = def.annotations?.risk?.(input, origin) ?? "";
-  let row2;
-  try {
-    row2 = await store.put(
-      {
-        kind: "run",
-        id: newConfirmationId(),
-        message: confirmationMessageOf(msg),
-        command: def.id,
-        input,
-        receipt,
-        risk,
-        model
-      },
-      CONFIRMATION_TTL_MS
-    );
-  } catch (err2) {
-    console.warn(
-      `[route] ${msg.threadKey} confirmation store unreachable at mint, handing back: ${err2 instanceof Error ? err2.message : String(err2)}`
-    );
-    return { kind: "store_unreachable" };
-  }
-  return { kind: "offered", shown: { id: row2.id, line: line4, risk, expiresAt: row2.expiresAt } };
-}
-function redactedInput(input) {
-  const text = (s) => redactAndCap(redactSecrets(s), 200);
-  const leaf = (v) => {
-    if (typeof v === "string") return text(v);
-    if (typeof v === "number" || typeof v === "boolean" || v === null) return v;
-    return v === void 0 ? null : text(JSON.stringify(v) ?? String(v));
-  };
-  const leafOrList = (v) => Array.isArray(v) ? v.map(leaf) : leaf(v);
-  const isRecord11 = (v) => typeof v === "object" && v !== null && (Object.getPrototypeOf(v) === Object.prototype || Object.getPrototypeOf(v) === null);
-  const entries = (v, of) => Object.fromEntries(
-    Object.entries(v).filter(([, x]) => x !== void 0).map(([k, x]) => [k, of(x)])
-  );
-  const object1 = (v) => entries(v, leafOrList);
-  const object2 = (v) => entries(v, (x) => isRecord11(x) ? object1(x) : leafOrList(x));
-  const object3 = (v) => entries(v, (x) => isRecord11(x) ? object2(x) : leafOrList(x));
-  return {
-    ...input.args ? { args: input.args.map(leaf) } : {},
-    ...input.options ? { options: object3(input.options) } : {}
-  };
-}
-function routeReasonLabel(reason2, collapsed) {
-  return `${ROUTE_REASON_PREFIX} ${reason2}${collapsed ? ` (compound collapsed: ${collapsed.presets.join("+")})` : ""}`;
-}
-function routedPartLines(parts) {
-  return parts.map((p) => {
-    const line4 = p.text.replace(/\s+/g, " ").trim();
-    return `${p.preset}: ${line4.length > ROUTE_PART_LINE_CAP ? `${line4.slice(0, ROUTE_PART_LINE_CAP - 1)}\u2026` : line4}`;
-  });
-}
-function compoundBrief(text, parts) {
-  return [
-    text,
-    "",
-    `${COMPOUND_BRIEF_HEADING}: ${parts.length} independent parts. Spawn exactly these children \u2014 one \`spawn_run\` per part, on the preset named, with the part's text as the child's whole prompt (add the repository where the preset needs one) \u2014 then \`await_runs\` them all and compile one answer. Do not merge, drop or add a part.`,
-    ...parts.map((p, i) => `${i + 1}. \`${p.preset}\`: ${p.text}`)
-  ].join("\n");
-}
-var REASONING_COUNTING_CAP_FIELDS, REASONING_OUTPUT_TOKEN_ALLOWANCE, OutputCapError, ROUTE_REASON_CAP, ROUTE_MIN_OUTPUT_TOKENS, ROUTE_TIMEOUT_MS, ROUTE_PART_LINE_CAP, ROUTE_RECEIPT_CAP, ROUTED_RECEIPT_PREFIX, COMPOUND_BRIEF_HEADING, MultiToolCallError;
-var init_route = __esm({
-  "../../src/core/dispatch/route.ts"() {
-    "use strict";
-    init_registry();
-    init_handBack();
-    init_profile();
-    init_redact();
-    init_statusCardFrame();
-    init_commandRegistry();
-    init_commandSurface();
-    init_budgets();
-    init_confirmations();
-    REASONING_COUNTING_CAP_FIELDS = /* @__PURE__ */ new Set(["max_tokens", "max_completion_tokens", "max_output_tokens"]);
-    REASONING_OUTPUT_TOKEN_ALLOWANCE = 4096;
-    OutputCapError = class extends Error {
-      constructor(maxTokens) {
-        super(`answer cut at the output cap (${maxTokens} tokens)`);
-        this.maxTokens = maxTokens;
-        this.name = "OutputCapError";
-      }
-      maxTokens;
-    };
-    ROUTE_REASON_CAP = 120;
-    ROUTE_MIN_OUTPUT_TOKENS = 200;
-    ROUTE_TIMEOUT_MS = 8e3;
-    ROUTE_PART_LINE_CAP = 100;
-    ROUTE_RECEIPT_CAP = 300;
-    ROUTED_RECEIPT_PREFIX = "routed:";
-    COMPOUND_BRIEF_HEADING = "Routed as a compound request";
-    MultiToolCallError = class extends Error {
-      constructor(calls) {
-        super(`answer carried ${calls.length} tool calls; the route is one call`);
-        this.calls = calls;
-        this.name = "MultiToolCallError";
-      }
-      calls;
-    };
-  }
-});
-
 // ../../src/core/runRegistry/runControl.ts
 var RunControl;
 var init_runControl = __esm({
@@ -42112,7 +42214,7 @@ async function reserveRun(deps, ctx) {
 async function attachRound(deps, ctx) {
   const { threadKey, agent, profile, repoCtx, root, clock: clock4, reattach, stopSignal, remainingMs, requester } = ctx;
   const { onSetupNote } = ctx;
-  const ownPr = ownPrOf(repoCtx);
+  const ownPr = agent.name === "review" ? void 0 : ownPrOf(repoCtx);
   return root.span("dispatch.workspace.attach", async (span) => {
     const graft = (steps, residentTotalMs) => graftResidentSteps(steps, {
       parent: span,
@@ -45718,6 +45820,18 @@ function decisionRecordTaskKey(...parts) {
   }
   return hash.toString(16).padStart(16, "0");
 }
+function durableDecisionRecordReservation(store) {
+  return async (repo, taskKey, claimed2, existing) => {
+    try {
+      const reserved = await store.reserveDecisionRecord(repo, taskKey, claimed2, existing);
+      if (!reserved.ok) throw new DecisionRecordReservationUnavailableError();
+      return reserved.number;
+    } catch (error) {
+      if (error instanceof DecisionRecordReservationUnavailableError) throw error;
+      throw new DecisionRecordReservationUnavailableError();
+    }
+  };
+}
 var DECISION_RECORD_ENV, RECORD_MARKER, POSITIVE_RECORD_INSTRUCTION, NEGATED_INSTRUCTION, DECISION_RECORD_STORE_REFUSAL, DecisionRecordReservationUnavailableError, DecisionRecordAllocator;
 var init_decisionRecordReservation = __esm({
   "../../src/core/decisionRecordReservation.ts"() {
@@ -48614,6 +48728,11 @@ var init_mirror = __esm({
       compactionRows = [];
       /** The highest ledger inbox seq folded in so far (run-history item 40). */
       inboxConsumedSeq = 0;
+      /** The owed seqs the cursor has already passed, ascending; absent when none. */
+      inboxDeferred() {
+        const deferred = [...new Set(this.deps.owedInboxSeqs?.() ?? [])].filter((seq) => seq <= this.inboxConsumedSeq).sort((a, b) => a - b);
+        return deferred.length > 0 ? { inboxDeferredSeqs: deferred } : {};
+      }
       /** Whether a report is owed: the mirror is wired and something happened. */
       get wired() {
         return this.deps.onStep !== void 0;
@@ -48702,7 +48821,8 @@ var init_mirror = __esm({
           turn,
           iteration: this.iteration++,
           remainingMs: Math.max(0, this.deps.remainingMs()),
-          inboxConsumedSeq: this.inboxConsumedSeq
+          inboxConsumedSeq: this.inboxConsumedSeq,
+          ...this.inboxDeferred()
         };
         this.idx += turns.length;
         this.lastAssistantIdx = this.idx - 1;
@@ -48729,7 +48849,8 @@ var init_mirror = __esm({
           turn,
           iteration: this.iteration,
           remainingMs: Math.max(0, this.deps.remainingMs()),
-          inboxConsumedSeq: this.inboxConsumedSeq
+          inboxConsumedSeq: this.inboxConsumedSeq,
+          ...this.inboxDeferred()
         };
         this.idx += turns.length + 1;
         this.rows.push(...turns);
@@ -49813,6 +49934,7 @@ async function runPiHarnessOpen(deps, run2) {
   let paths;
   let requeueUnechoed = () => {
   };
+  let unechoedSeqs = () => [];
   let dropHeld = () => {
   };
   let loopEnded = false;
@@ -49847,7 +49969,10 @@ async function runPiHarnessOpen(deps, run2) {
     onStep: run2.onStep,
     seedLength: run2.resume ? run2.resume.messages.length + (run2.resume.compactions?.length ?? 0) : run2.messages.length,
     remainingMs: () => deadline - now(),
-    ...tail ? { mirroredTail: tail } : {}
+    ...tail ? { mirroredTail: tail } : {},
+    // The rows pi has not read yet: the cursor can pass one when a later row
+    // is consumed first (the plane's provider-up beside an ordinary steer).
+    owedInboxSeqs: () => [...run2.inbox?.pendingSeqs ?? [], ...unechoedSeqs()]
   });
   mirror.inboxConsumedSeq = run2.resume?.inboxConsumedSeq ?? 0;
   placed = (event) => {
@@ -50254,6 +50379,7 @@ async function runPiHarnessOpen(deps, run2) {
       const [echoed] = unechoed.splice(at, 1);
       if (echoed.seq > mirror.inboxConsumedSeq) mirror.inboxConsumedSeq = echoed.seq;
     };
+    unechoedSeqs = () => unechoed.flatMap((u) => u.inputs.flatMap((i) => i.ledgerSeq !== void 0 ? [i.ledgerSeq] : []));
     requeueUnechoed = () => {
       pendingReissue = [];
       run2.inbox?.requeue(unechoed.splice(0).flatMap((u) => u.inputs));
@@ -50935,7 +51061,14 @@ ${stagedLine}` : prompt;
               if (obs.response.success === false) {
                 turnParkSettled = false;
                 note("harness_error", "the follow-up turn's model retry prompt was refused; the failure remains held");
-              } else clearTurnProviderHold();
+              } else {
+                drainTurnReissues();
+                mirror.inboxConsumedSeq = Math.max(
+                  mirror.inboxConsumedSeq,
+                  ...turnReissueRows.map((item) => item.ledgerSeq ?? 0)
+                );
+                clearTurnProviderHold();
+              }
             }
           }
           if (obs.response?.id === id && obs.response.success === false)
@@ -56806,6 +56939,7 @@ function createLedgerWriteThrough(opts) {
         turnIndex: report2.firstIdx + turns.length,
         inFlight: report2.inFlight,
         inboxConsumedSeq: report2.inboxConsumedSeq,
+        ...report2.inboxDeferredSeqs?.length ? { inboxDeferredSeqs: report2.inboxDeferredSeqs } : {},
         remainingMs: report2.remainingMs,
         turn: report2.turn,
         iteration: report2.iteration
@@ -63023,14 +63157,23 @@ var init_configBoot = __esm({
 });
 
 // ../../src/intakeModel.ts
+function intakeDecisionDeps(completion, deps) {
+  return {
+    model: completion.model,
+    ...completion.capField !== void 0 ? { capField: completion.capField } : {},
+    ...deps
+  };
+}
 function intakeCompletion(config, completions, log = console.log) {
   const modelRef3 = intakeModelRef(config);
   if (!modelRef3) return void 0;
   const ref = parseModelRef(modelRef3);
+  const card = resolveModelCard(modelRef3, config.providers, installedModelRegistry);
   const effort2 = turnEffort(modelRef3, config.intake?.effort, config.providers);
   if (effort2.note) log(`[intake] effort: ${effort2.note}`);
   return {
     modelRef: modelRef3,
+    capField: card.capField,
     model: providerStructuredModel(completions.get(ref.provider), ref.model, {
       ...effort2.request ? { effort: effort2.request } : {}
     })
@@ -63042,6 +63185,8 @@ var init_intakeModel = __esm({
     init_config2();
     init_route();
     init_turnEffort();
+    init_installedModelRegistry();
+    init_modelCard();
     init_provider();
   }
 });
@@ -63164,7 +63309,10 @@ async function askModel(input, deps) {
         floor: (violation) => ({ verdict: "silent", reason: violation, source: "error" })
       },
       deps.model,
-      { maxTokens: ROUTE_MIN_OUTPUT_TOKENS, signal: AbortSignal.timeout(deps.timeoutMs ?? ROUTE_TIMEOUT_MS) }
+      {
+        maxTokens: outputCapWithReasoning(ROUTE_MIN_OUTPUT_TOKENS, { capField: deps.capField }),
+        signal: AbortSignal.timeout(deps.timeoutMs ?? ROUTE_TIMEOUT_MS)
+      }
     );
     return { ...seam.value, attempts: seam.attempts };
   } catch (err2) {
@@ -63173,8 +63321,18 @@ async function askModel(input, deps) {
     if (timedOut) {
       return {
         verdict: "silent",
-        reason: tidyReason("the intake call timed out"),
+        reason: renderProviderFailure("transient", "ended"),
         source: "timeout",
+        providerFailure: "transient",
+        ...attempts ? { attempts } : {}
+      };
+    }
+    const outputCapError = err2 instanceof OutputCapError ? err2 : err2 instanceof StructuredAskError && err2.cause instanceof OutputCapError ? err2.cause : void 0;
+    if (outputCapError) {
+      return {
+        verdict: "silent",
+        reason: tidyReason(outputCapError.message),
+        source: "error",
         ...attempts ? { attempts } : {}
       };
     }
@@ -71424,6 +71582,25 @@ async function childPullRequestState(deps, instance, unit) {
   if (state === void 0) throw new Error(headBranchStateError(instance.repo, row2.pr.number));
   return state;
 }
+async function isEarlierAttemptRun(deps, current, view, unit) {
+  if (current?.plan === void 0 || view.parentInstanceId === void 0 || unit === void 0) return false;
+  if (unitOfIdempotencyKey(view.idempotencyKey ?? "") !== unit) return false;
+  const prior = await deps.instances.get(view.parentInstanceId);
+  if (prior?.plan === void 0) return false;
+  const currentAttempt = current.attempt ?? 1;
+  const priorAttempt = prior.attempt ?? 1;
+  if (currentAttempt <= priorAttempt || current.plan.id !== prior.plan.id || current.plan.path !== prior.plan.path || current.repo !== prior.repo)
+    return false;
+  const [nextAttempt, currentUnits, priorUnits] = await Promise.all([
+    deps.instances.get(planInstanceId(current.plan.id, currentAttempt + 1)),
+    deps.instances.listUnits(current.id),
+    deps.instances.listUnits(prior.id)
+  ]);
+  if (nextAttempt !== null) return false;
+  const currentUnit = currentUnits.find((row2) => row2.unit === unit);
+  const priorUnit = priorUnits.find((row2) => row2.unit === unit);
+  return currentUnit !== void 0 && priorUnit !== void 0 && currentUnit.branch === priorUnit.branch;
+}
 async function readRecord(body, deps) {
   const id = parseInstanceId(body.parentInstanceId);
   if (!id.ok) return json3(400, { ok: false, error: id.error });
@@ -71432,10 +71609,11 @@ async function readRecord(body, deps) {
   if (body.unit !== void 0 && (typeof body.unit !== "string" || !UNIT_ID.test(body.unit)))
     return json3(400, { ok: false, error: "unit must be a unit id" });
   const at = (deps.clock ?? systemClock)();
-  const res = await deps.runs.getRun(body.runId);
-  if (!res.ok || res.value.parentInstanceId !== id.value) return json3(404, { ok: false, error: "not_found" });
+  const [res, instanceRow] = await Promise.all([deps.runs.getRun(body.runId), deps.instances.get(id.value)]);
+  if (!res.ok) return json3(404, { ok: false, error: "not_found" });
   const view = res.value;
-  const instanceRow = await deps.instances.get(id.value);
+  if (view.parentInstanceId !== id.value && !await isEarlierAttemptRun(deps, instanceRow, view, typeof body.unit === "string" ? body.unit : void 0))
+    return json3(404, { ok: false, error: "not_found" });
   let pullRequest;
   try {
     pullRequest = await childPullRequestState(deps, instanceRow, typeof body.unit === "string" ? body.unit : void 0);
@@ -73824,11 +74002,7 @@ async function runBot() {
   const coordinatorInstances = buildCoordinatorInstanceStore(runHistoryCfg, processSecrets);
   const decisionRecordAllocator = new DecisionRecordAllocator(
     fetchDecisionRecordClaims,
-    async (repo, taskKey, claimed2, existing) => {
-      const reserved = await coordinatorInstances.reserveDecisionRecord(repo, taskKey, claimed2, existing);
-      if (!reserved.ok) throw new DecisionRecordReservationUnavailableError();
-      return reserved.number;
-    }
+    durableDecisionRecordReservation(coordinatorInstances)
   );
   let planeAdmitPass;
   const planeEffectExecutor = {
@@ -74100,9 +74274,7 @@ async function runBot() {
       slackIntake = wireIntakeGate({
         intakeModeFor: (threadKey, userId, channelId) => config.intakeModeFor(threadKey, userId, channelId),
         deps: {
-          model: intake.model,
-          ledger: intakeLedger,
-          now: systemClock
+          ...intakeDecisionDeps(intake, { ledger: intakeLedger, now: systemClock })
         },
         modelRef: intake.modelRef,
         gen: PROCESS_STARTED_AT,