@coreplane/switchboard 1.261.0 → 1.261.2

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -2963,7 +2963,7 @@ export class RunHistoryDO extends DurableObject<Env> {
             req.card ? JSON.stringify(req.card) : null,
             req.system,
             JSON.stringify(req.tools),
-            JSON.stringify(req.state ?? {}),
+            JSON.stringify({ ...existing!.state, ...(req.state ?? {}) }),
             req.runId,
           );
           this.registerSession(req);

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.261.0",
+  "version": "1.261.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.261.0",
+      "version": "1.261.2",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -21060,7 +21060,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.261.0",
+      "version": "1.261.2",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.261.0",
+  "version": "1.261.2",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.261.0",
-  "commit": "c60b26943f774d0ba0e71af0df8db7d1d90613c5",
-  "builtAt": "2026-09-23T08:28:35.014Z"
+  "version": "1.261.2",
+  "commit": "652eb70199d24be067ee91e1c9e14f48770a594c",
+  "builtAt": "2026-09-24T02:09:02.047Z"
 }

package/dist/assets/src/core/coordinator/contract.ts

@@ -293,6 +293,20 @@ export interface RunFinishedPayload {
   parentInstanceId: string;
 }
 
+/** Durable authority for publishing another commit to an existing pull
+ * request. Every identity field is repeated deliberately: publication is
+ * allowed only when the unit, checkout and a fresh remote read all agree with
+ * this exact record. */
+export interface ExistingPrPublicationBinding {
+  repo: string;
+  pr: number;
+  headRef: string;
+  baseRef: string;
+  expectedHeadSha: string;
+  publicationRef: string;
+  owner: { instanceId: string; unit: string };
+}
+
 /** What a coordinator's spawn stamps on the child's every row: the instance
  *  the child belongs to and the key the spawn carried — and, for the child's
  *  own post-step, the base its pull request targets. */
@@ -310,6 +324,10 @@ export interface CoordinatorTag {
    *  back off its ledger events; `coordinatorFields` still leaves it off the
    *  rows, so rows and records keep the shape written before it existed. */
   base?: string;
+  /** The existing-PR publication authority this child received from its
+   * durable unit row and current Workflow round. Published on the run's event
+   * stream so a rehost retains the same fence. */
+  publication?: ExistingPrPublicationBinding;
 }
 
 /** The tag as the two flat record fields, or nothing — so a row, a summary
@@ -489,6 +507,9 @@ export interface CoordinatorUnit {
    *  — no pre-check, no branch, no round 0. A task string's row only; written by
    *  the hand-off, read by the driver into the machine's input. */
   resume?: { pr: number; headSha?: string; url?: string };
+  /** Exact existing-PR publication authority. Absent for a fresh unit branch;
+   * an adopted or resumed PR may publish only through this binding. */
+  publication?: ExistingPrPublicationBinding;
   /** The decision-record number reserved at admission for this unit. A unit
    * that writes a record carries it through every attempt and briefs its child
    * as `record: NNNN`; the child never scans the directory for a number. */
@@ -549,6 +570,23 @@ const isResume = (v: unknown): boolean =>
   isFinite(v.pr) &&
   (v.headSha === undefined || isText(v.headSha)) &&
   (v.url === undefined || isText(v.url, 2048));
+const isFullSha = (v: unknown): v is string => typeof v === "string" && /^[0-9a-f]{40}$/i.test(v);
+const isPublication = (v: unknown): v is ExistingPrPublicationBinding =>
+  isObject(v) &&
+  typeof v.repo === "string" &&
+  REPO_SLUG.test(v.repo) &&
+  typeof v.pr === "number" &&
+  Number.isInteger(v.pr) &&
+  v.pr > 0 &&
+  isText(v.headRef) &&
+  isText(v.baseRef) &&
+  isFullSha(v.expectedHeadSha) &&
+  isText(v.publicationRef) &&
+  isObject(v.owner) &&
+  typeof v.owner.instanceId === "string" &&
+  INSTANCE_ID_PATTERN.test(v.owner.instanceId) &&
+  typeof v.owner.unit === "string" &&
+  UNIT_PATTERN.test(v.owner.unit);
 const isThread = (v: unknown): boolean => isObject(v) && isText(v.threadKey) && isOptionalText(v.sourceUrl);
 
 /** Structural check on a record from outside the process (a Worker response, an HTTP body). */
@@ -663,6 +701,7 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
   if (r.issue !== undefined && !isFinite(r.issue)) return false;
   if (r.pr !== undefined && !isPr(r.pr)) return false;
   if (r.resume !== undefined && !isResume(r.resume)) return false;
+  if (r.publication !== undefined && !isPublication(r.publication)) return false;
   if (r.record !== undefined && (typeof r.record !== "string" || !/^\d{4}$/.test(r.record))) return false;
   if (r.lastPush !== undefined && !isText(r.lastPush)) return false;
   if (r.segments !== undefined && (!Array.isArray(r.segments) || !r.segments.every(isSegment))) return false;

package/dist/assets/src/core/coordinator/driver.ts

@@ -510,8 +510,9 @@ function prCheckReturn(step: string, a: BotAnswer): Extract<StepReturn, { type:
       },
       at,
     };
-  // A merged pull request is read whole or not at all: the merge commit and
-  // the time are what the unit's ending and its report carry.
+  // A merged pull request is read whole or not at all: its source head is
+  // retained for findings reconciliation, while the merge commit and time
+  // are what the unit's ending and report carry.
   if (
     ok === true &&
     state === "merged" &&
@@ -527,6 +528,7 @@ function prCheckReturn(step: string, a: BotAnswer): Extract<StepReturn, { type:
         state: "merged",
         prNumber,
         url,
+        ...(typeof headSha === "string" ? { headSha } : {}),
         sha,
         mergedAt,
         ...(typeof mergedBy === "string" ? { mergedBy } : {}),
@@ -923,9 +925,19 @@ async function tellStepThrew(
       : at.round.kind === "review" && /\/review\/(read|checks)\b/.test(at.step)
         ? `after round ${at.round.index}'s review verdict (\`${at.step}\`)`
         : `in round ${at.round.index} (\`${at.step}\`)`;
-  const report =
-    `⚠️ The runner failed ${where}: ${line}\n\n` +
-    "The unit remains bound to this thread; the next reply continues it, and a pull request already approved with green checks resumes at the checks step, never at a fresh coding round.";
+  const findingsReconcile = at.round?.kind === "findings" && /\/findings(?:\/a\d+)?\/pr-check$/.test(at.step);
+  const report = findingsReconcile
+    ? [
+        `⚠️ Review did not restart because Switchboard could not read the pull request after the completed findings work: ${line}`,
+        pr !== undefined
+          ? `Saved-work fact: the existing pull request is ${pr.url}, but its current branch and exact head were not verified.`
+          : "Saved-work fact: no open pull request or exact remote head was verified.",
+        "No review was started. Next action: retry ship when the pull request is readable so Switchboard can verify the exact head first.",
+      ].join("\n\n")
+    : [
+        `⚠️ Switchboard failed ${where}: ${line}`,
+        "The unit remains resumable from its recorded branch and pull request facts. No continuation action was scheduled. Next action: start ship again after the failing operation is available.",
+      ].join("\n\n");
   const body = {
     ...tag,
     ending: {

package/dist/assets/src/core/reviewVerdict.ts

@@ -150,6 +150,10 @@ export interface ReviewVerdict {
 export const LGTM_TOKEN = "LGTM:";
 export const CHANGES_TOKEN = "Changes requested:";
 export const NO_VERDICT_LINE = "No verdict submitted — not approving.";
+/** Conservative ceiling below GitHub's 65,536-character review-body limit.
+ * Counted as Unicode code points so clipping never splits a surrogate pair. */
+export const MAX_REVIEW_POST_CODE_POINTS = 65_000;
+const REVIEW_TRUNCATION_NOTE = "_(review truncated to fit GitHub's review size limit)_";
 
 /** Parse an arbitrary tool input into a verdict, or null when it is not one.
  *  `addressSeverity` is the level in force for the run (default `minor`): an
@@ -383,7 +387,11 @@ function verdictMarker(verdict: ReviewVerdict | undefined, target: ReviewBodyTar
  * `approve`), a GitHub alert callout with the verdict word, the pinned head
  * and the finding counts, the findings as a table (severity, id + title, the
  * file linked at the head), the model's text folded under `Full review`, and
- * the machine-readable marker last. The prose decides nothing above the fold.
+ * the machine-readable marker last. Only the prose may be clipped to fit the
+ * platform: every fixed verdict section and the marker remain byte-for-byte.
+ * If those sections leave no room for a visible bounded review, the oversized
+ * body is returned so the publication boundary can refuse it instead of
+ * silently dropping the write-up. The prose decides nothing above the fold.
  */
 export function buildReviewPostBody(
   answer: string,
@@ -395,10 +403,10 @@ export function buildReviewPostBody(
     ...(target ? [`head \`${target.head.slice(0, 7)}\``] : []),
     verdict ? findingCounts(verdict.findings) : "the run ended without a submit_verdict call",
   ];
-  const parts: string[] = [verdictLine(verdict), `> [!${calloutKind(verdict)}]\n> ${facts.join(" · ")}`];
+  const fixedParts: string[] = [verdictLine(verdict), `> [!${calloutKind(verdict)}]\n> ${facts.join(" · ")}`];
   const findings = verdict?.findings ?? [];
   if (findings.length > 0) {
-    parts.push(
+    fixedParts.push(
       [
         "| Severity | Finding | Where |",
         "| --- | --- | --- |",
@@ -409,10 +417,29 @@ export function buildReviewPostBody(
       ].join("\n"),
     );
   }
+
+  const marker = verdictMarker(verdict, target);
+  const fixedBody = [...fixedParts, marker].join("\n\n");
   const prose = answer.trim();
-  if (prose) parts.push(`<details>\n<summary>Full review</summary>\n\n${prose}\n\n</details>`);
-  parts.push(verdictMarker(verdict, target));
-  return parts.join("\n\n");
+  if (!prose) return fixedBody;
+
+  const details = (text: string, truncated: boolean): string =>
+    `<details>\n<summary>Full review</summary>\n\n${text}${truncated ? `${text ? "\n\n" : ""}${REVIEW_TRUNCATION_NOTE}` : ""}\n\n</details>`;
+  const render = (text: string, truncated: boolean): string =>
+    [...fixedParts, details(text, truncated), marker].join("\n\n");
+  const full = render(prose, false);
+  if ([...full].length <= MAX_REVIEW_POST_CODE_POINTS) return full;
+
+  const clippedShell = render("", true);
+  const proseSeparatorCodePoints = 2; // the blank line before the note when clipped prose is present
+  const proseBudget = MAX_REVIEW_POST_CODE_POINTS - [...clippedShell].length - proseSeparatorCodePoints;
+  if (proseBudget > 0) return render([...prose].slice(0, proseBudget).join(""), true);
+  if ([...clippedShell].length <= MAX_REVIEW_POST_CODE_POINTS) return clippedShell;
+
+  // A successful post must retain a visible write-up. Return the full body
+  // oversized when even the bounded shell cannot fit, so postReviewComment
+  // rejects before fetch and the review remains on the Slack-only path.
+  return full;
 }
 
 /**

package/dist/assets/src/core/runEvents.ts

@@ -208,6 +208,11 @@ export type RunNoteKind =
    *  after the model's last turn — the release itself runs after the record
    *  is sealed — and set on the card's label too, so the loss is never silent. */
   | "work_left_behind"
+  /** An existing pull request's exact publication fence denied the push while
+   *  the workspace held a local checkpoint. The workspace stays attached
+   *  instead of being discarded or redirected; the summary names the head,
+   *  counts, denial and that retention beyond the run remains unverified. */
+  | "publication_blocked"
   /** The run's ending may have left a command running in its workspace — a
    *  call cut by the ending's abort or interrupt, or open when the run failed —
    *  so the release tears the workspace down rather than pair it for the
@@ -356,6 +361,7 @@ export const RUN_NOTE_KINDS = [
   "ledger_untracked",
   "rebind_refused",
   "work_left_behind",
+  "publication_blocked",
   "workspace_torn_down",
   "pr_not_opened",
   "pr_head_unverified",
@@ -953,7 +959,15 @@ export type RunEvent =
    *  instead of letting the binding ref — the unit branch itself — stand in.
    *  `base` is absent when the spawn knew none; the post-step then falls to
    *  the coordinator store's `instance.base`. Additive: unknown → ignored. */
-  | { type: "coordinator_tag"; parentInstanceId: string; unit?: string; base?: string; seq?: number; at?: number }
+  | {
+      type: "coordinator_tag";
+      parentInstanceId: string;
+      unit?: string;
+      base?: string;
+      publication?: import("./coordinator/contract.js").ExistingPrPublicationBinding;
+      seq?: number;
+      at?: number;
+    }
   /** The plan runner instance a ship run's hand-off created (record 0051 R2;
    *  docs/reference/specs/run-history.md item 2): published by the ship branch
    *  after `handOffToCoordinator` succeeds, straight to the registry like

package/dist/assets/src/core/runLedger/types.ts

@@ -5,6 +5,7 @@
 
 import type { ChatMessage } from "../chatMessage.js";
 import { PROVIDER_FAILURE_CAUSES, type ProviderFailureCause, type ToolDef } from "../provider.js";
+import type { Verbosity } from "../verbosity.js";
 import type { ChannelVisibility } from "../authz/types.js";
 import type { RunProfile } from "../../config/profile.js";
 import type { RunEvent } from "../runEvents.js";
@@ -60,6 +61,9 @@ export interface LiveRunMeta {
   /** The app that relayed the request for the person (authorization.md item 14): a resume or restart keeps app ∩ person at the gates. */
   postedBy?: string;
   effort?: string;
+  /** The request's resolved display level. Hosted parents have no model loop
+   *  to rebuild it from, and their input event deliberately omits directives. */
+  verbosity?: Verbosity;
   /** Decision-record reservation assigned before the attach, so a restart of
    * the admitted task keeps the same brief and process environment. */
   record?: string;