@coreplane/switchboard 1.261.1 → 1.261.3

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -2732,6 +2732,38 @@ export class RunHistoryDO extends DurableObject<Env> {
     return { ok: true };
   }
 
+  /** One compare-and-replace transaction reserves a legacy continuation for
+   * exactly one caller. The whole expected JSON is the fence: any intervening
+   * unit write, including another recovery, makes this caller stale. */
+  async claimLegacyContinuation(
+    expected: CoordinatorUnit,
+    recovered: CoordinatorUnit,
+    now: number,
+  ): Promise<{ ok: true } | { ok: false; reason: "stale" }> {
+    let out: { ok: true } | { ok: false; reason: "stale" } = { ok: true };
+    this.ctx.storage.transactionSync(() => {
+      const row = this.sql
+        .exec<{ json: string }>(
+          `SELECT json FROM coordinator_units WHERE instance_id = ? AND unit = ?`,
+          expected.instanceId,
+          expected.unit,
+        )
+        .toArray()[0];
+      if (row?.json !== JSON.stringify(expected)) {
+        out = { ok: false, reason: "stale" };
+        return;
+      }
+      this.sql.exec(
+        `UPDATE coordinator_units SET json = ?, updated_at = ? WHERE instance_id = ? AND unit = ?`,
+        JSON.stringify(recovered),
+        now,
+        expected.instanceId,
+        expected.unit,
+      );
+    });
+    return out;
+  }
+
   async listUnits(instanceId: string): Promise<CoordinatorUnit[]> {
     return this.sql
       .exec<{ json: string }>(`SELECT json FROM coordinator_units WHERE instance_id = ? ORDER BY rowid`, instanceId)
@@ -5187,6 +5219,7 @@ const LEDGER_ROUTES = new Set([
   "/runs/coordinator/get",
   "/runs/coordinator/stop",
   "/runs/coordinator/units/put",
+  "/runs/coordinator/units/claim-legacy-continuation",
   "/runs/coordinator/units/list",
   "/runs/coordinator/events/append",
   "/runs/coordinator/events/list",
@@ -5886,6 +5919,17 @@ async function handleLedger(pathname: string, body: unknown, env: Env): Promise<
     console.log(`[runs/coordinator/units/put] ${key.value} ${units[0]!.instanceId} ${units.length} row(s)`);
     return json(r);
   }
+  if (pathname === "/runs/coordinator/units/claim-legacy-continuation") {
+    if (!isCoordinatorUnit(b.expected) || !isCoordinatorUnit(b.recovered))
+      return json({ error: "expected and recovered must be coordinator unit rows" }, 400);
+    if (b.expected.instanceId !== b.recovered.instanceId || b.expected.unit !== b.recovered.unit)
+      return json({ error: "expected and recovered must name the same unit" }, 400);
+    const r = await stub.claimLegacyContinuation(b.expected, b.recovered, now);
+    console.log(
+      `[runs/coordinator/units/claim-legacy-continuation] ${key.value} ${b.expected.instanceId}:${b.expected.unit} → ${r.ok ? "claimed" : r.reason}`,
+    );
+    return r.ok ? json(r) : json(r, 409);
+  }
   if (pathname === "/runs/coordinator/units/list") {
     if (typeof b.instanceId !== "string" || !INSTANCE_ID_PATTERN.test(b.instanceId))
       return json({ error: "instanceId must be a Workflow instance id" }, 400);

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.261.1",
+  "version": "1.261.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.261.1",
+      "version": "1.261.3",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -21060,7 +21060,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.261.1",
+      "version": "1.261.3",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.261.1",
+  "version": "1.261.3",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.261.1",
-  "commit": "3746a1c5fa2d30bebd66baec1fb3534a1f927e3a",
-  "builtAt": "2026-09-23T21:48:10.555Z"
+  "version": "1.261.3",
+  "commit": "b727e58725e3d234e0d34b43e04ca0dc9af17075",
+  "builtAt": "2026-09-24T14:03:08.080Z"
 }

package/dist/assets/src/core/coordinator/contract.ts

@@ -293,6 +293,20 @@ export interface RunFinishedPayload {
   parentInstanceId: string;
 }
 
+/** Durable authority for publishing another commit to an existing pull
+ * request. Every identity field is repeated deliberately: publication is
+ * allowed only when the unit, checkout and a fresh remote read all agree with
+ * this exact record. */
+export interface ExistingPrPublicationBinding {
+  repo: string;
+  pr: number;
+  headRef: string;
+  baseRef: string;
+  expectedHeadSha: string;
+  publicationRef: string;
+  owner: { instanceId: string; unit: string };
+}
+
 /** What a coordinator's spawn stamps on the child's every row: the instance
  *  the child belongs to and the key the spawn carried — and, for the child's
  *  own post-step, the base its pull request targets. */
@@ -310,6 +324,10 @@ export interface CoordinatorTag {
    *  back off its ledger events; `coordinatorFields` still leaves it off the
    *  rows, so rows and records keep the shape written before it existed. */
   base?: string;
+  /** The existing-PR publication authority this child received from its
+   * durable unit row and current Workflow round. Published on the run's event
+   * stream so a rehost retains the same fence. */
+  publication?: ExistingPrPublicationBinding;
 }
 
 /** The tag as the two flat record fields, or nothing — so a row, a summary
@@ -489,6 +507,9 @@ export interface CoordinatorUnit {
    *  — no pre-check, no branch, no round 0. A task string's row only; written by
    *  the hand-off, read by the driver into the machine's input. */
   resume?: { pr: number; headSha?: string; url?: string };
+  /** Exact existing-PR publication authority. Absent for a fresh unit branch;
+   * an adopted or resumed PR may publish only through this binding. */
+  publication?: ExistingPrPublicationBinding;
   /** The decision-record number reserved at admission for this unit. A unit
    * that writes a record carries it through every attempt and briefs its child
    * as `record: NNNN`; the child never scans the directory for a number. */
@@ -549,6 +570,23 @@ const isResume = (v: unknown): boolean =>
   isFinite(v.pr) &&
   (v.headSha === undefined || isText(v.headSha)) &&
   (v.url === undefined || isText(v.url, 2048));
+const isFullSha = (v: unknown): v is string => typeof v === "string" && /^[0-9a-f]{40}$/i.test(v);
+const isPublication = (v: unknown): v is ExistingPrPublicationBinding =>
+  isObject(v) &&
+  typeof v.repo === "string" &&
+  REPO_SLUG.test(v.repo) &&
+  typeof v.pr === "number" &&
+  Number.isInteger(v.pr) &&
+  v.pr > 0 &&
+  isText(v.headRef) &&
+  isText(v.baseRef) &&
+  isFullSha(v.expectedHeadSha) &&
+  isText(v.publicationRef) &&
+  isObject(v.owner) &&
+  typeof v.owner.instanceId === "string" &&
+  INSTANCE_ID_PATTERN.test(v.owner.instanceId) &&
+  typeof v.owner.unit === "string" &&
+  UNIT_PATTERN.test(v.owner.unit);
 const isThread = (v: unknown): boolean => isObject(v) && isText(v.threadKey) && isOptionalText(v.sourceUrl);
 
 /** Structural check on a record from outside the process (a Worker response, an HTTP body). */
@@ -663,6 +701,7 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
   if (r.issue !== undefined && !isFinite(r.issue)) return false;
   if (r.pr !== undefined && !isPr(r.pr)) return false;
   if (r.resume !== undefined && !isResume(r.resume)) return false;
+  if (r.publication !== undefined && !isPublication(r.publication)) return false;
   if (r.record !== undefined && (typeof r.record !== "string" || !/^\d{4}$/.test(r.record))) return false;
   if (r.lastPush !== undefined && !isText(r.lastPush)) return false;
   if (r.segments !== undefined && (!Array.isArray(r.segments) || !r.segments.every(isSegment))) return false;

package/dist/assets/src/core/coordinator/driver.ts

@@ -1137,14 +1137,16 @@ async function runUnit(
                 : {}),
             },
             ...(state.pr !== undefined ? { pr: state.pr } : {}),
-            // A review_pending ending names the child's own last push so the next
-            // attempt's pre-check can start at the review round (the row's lastPush)
-            // — an idled one the same, off the idle's `from` (record 0051).
-            ...(ending.kind === "review_pending" && ending.headSha !== undefined
-              ? { headSha: ending.headSha }
-              : ending.kind === "idle" && ending.why === "review_pending" && ending.from !== undefined
-                ? { headSha: ending.from }
-                : {}),
+            // A merge_ready ending retains the exact head its final approval
+            // reviewed. Review-pending endings retain the coding child's push;
+            // both become the row's durable lastPush for a later attempt.
+            ...(ending.kind === "merge_ready" && state.lastReviewHead !== undefined
+              ? { headSha: state.lastReviewHead }
+              : ending.kind === "review_pending" && ending.headSha !== undefined
+                ? { headSha: ending.headSha }
+                : ending.kind === "idle" && ending.why === "review_pending" && ending.from !== undefined
+                  ? { headSha: ending.from }
+                  : {}),
             ...(state.lastCodingRunId !== undefined ? { codingRunId: state.lastCodingRunId } : {}),
             // A continued ending is a segment's end, not the unit's: the bot
             // writes the renewal as a row keyed by the next segment's index

package/dist/assets/src/core/runEvents.ts

@@ -208,6 +208,11 @@ export type RunNoteKind =
    *  after the model's last turn — the release itself runs after the record
    *  is sealed — and set on the card's label too, so the loss is never silent. */
   | "work_left_behind"
+  /** An existing pull request's exact publication fence denied the push while
+   *  the workspace held a local checkpoint. The workspace stays attached
+   *  instead of being discarded or redirected; the summary names the head,
+   *  counts, denial and that retention beyond the run remains unverified. */
+  | "publication_blocked"
   /** The run's ending may have left a command running in its workspace — a
    *  call cut by the ending's abort or interrupt, or open when the run failed —
    *  so the release tears the workspace down rather than pair it for the
@@ -356,6 +361,7 @@ export const RUN_NOTE_KINDS = [
   "ledger_untracked",
   "rebind_refused",
   "work_left_behind",
+  "publication_blocked",
   "workspace_torn_down",
   "pr_not_opened",
   "pr_head_unverified",
@@ -953,7 +959,15 @@ export type RunEvent =
    *  instead of letting the binding ref — the unit branch itself — stand in.
    *  `base` is absent when the spawn knew none; the post-step then falls to
    *  the coordinator store's `instance.base`. Additive: unknown → ignored. */
-  | { type: "coordinator_tag"; parentInstanceId: string; unit?: string; base?: string; seq?: number; at?: number }
+  | {
+      type: "coordinator_tag";
+      parentInstanceId: string;
+      unit?: string;
+      base?: string;
+      publication?: import("./coordinator/contract.js").ExistingPrPublicationBinding;
+      seq?: number;
+      at?: number;
+    }
   /** The plan runner instance a ship run's hand-off created (record 0051 R2;
    *  docs/reference/specs/run-history.md item 2): published by the ship branch
    *  after `handOffToCoordinator` succeeds, straight to the registry like

package/dist/assets/src/core/runLedger/types.ts

@@ -5,6 +5,7 @@
 
 import type { ChatMessage } from "../chatMessage.js";
 import { PROVIDER_FAILURE_CAUSES, type ProviderFailureCause, type ToolDef } from "../provider.js";
+import type { Verbosity } from "../verbosity.js";
 import type { ChannelVisibility } from "../authz/types.js";
 import type { RunProfile } from "../../config/profile.js";
 import type { RunEvent } from "../runEvents.js";
@@ -60,6 +61,9 @@ export interface LiveRunMeta {
   /** The app that relayed the request for the person (authorization.md item 14): a resume or restart keeps app ∩ person at the gates. */
   postedBy?: string;
   effort?: string;
+  /** The request's resolved display level. Hosted parents have no model loop
+   *  to rebuild it from, and their input event deliberately omits directives. */
+  verbosity?: Verbosity;
   /** Decision-record reservation assigned before the attach, so a restart of
    * the admitted task keeps the same brief and process environment. */
   record?: string;

package/dist/assets/src/core/ship/coordinator.ts

@@ -502,6 +502,8 @@ export type Brief =
       kind: "findings";
       unit: string;
       pr: number;
+      /** The exact reviewed head the fix round may replace. */
+      headSha?: string;
       /** The review run normally supplies the findings. An adopted attempt
        *  can recover them from the last posted verdict marker instead. */
       reviewRunId?: string;
@@ -1466,6 +1468,7 @@ function briefFor(s: UnitPipelineState, round: RoundRef): Brief {
       kind: "findings",
       unit,
       pr,
+      ...(s.lastReviewHead !== undefined ? { headSha: s.lastReviewHead } : {}),
       ...(reviewRunId !== undefined ? { reviewRunId } : {}),
       ...(reviewRunId === undefined || (answers !== undefined && answers.length > 0) ? { findings: issued } : {}),
       ...(answers !== undefined && answers.length > 0 ? { answers } : {}),

package/dist/assets/src/core/types.ts

@@ -1,3 +1,5 @@
+import type { Verbosity } from "./verbosity.js";
+
 // Channel abstraction. A channel (Slack, CLI, Discord, HTTP, ...) is only a
 // transport: it receives text from a user somewhere, hands it to the core
 // dispatcher as an IncomingMessage, and provides a ChannelIO for the core to
@@ -306,8 +308,10 @@ export interface ChannelIO {
    * the row lives in the config object until the click or the expiry.
    */
   offer?(offer: ConfirmationOffer): Promise<void>;
-  /** Create a progress indicator. Adapters may return a no-op handle. */
-  status(initial: StatusUpdate): Promise<StatusHandle>;
+  /** Create a progress indicator. Adapters may return a no-op handle. The
+   *  resolved verbosity reaches the transport so native lifecycle chrome can
+   *  follow the same display contract as replies and cards. */
+  status(initial: StatusUpdate, display?: { verbosity?: Verbosity }): Promise<StatusHandle>;
   /**
    * Prior turns of this conversation, oldest first, excluding the triggering
    * message and any bot status noise. Adapters without history return [].