@coreplane/switchboard 1.261.2 → 1.261.3

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -2732,6 +2732,38 @@ export class RunHistoryDO extends DurableObject<Env> {
     return { ok: true };
   }
 
+  /** One compare-and-replace transaction reserves a legacy continuation for
+   * exactly one caller. The whole expected JSON is the fence: any intervening
+   * unit write, including another recovery, makes this caller stale. */
+  async claimLegacyContinuation(
+    expected: CoordinatorUnit,
+    recovered: CoordinatorUnit,
+    now: number,
+  ): Promise<{ ok: true } | { ok: false; reason: "stale" }> {
+    let out: { ok: true } | { ok: false; reason: "stale" } = { ok: true };
+    this.ctx.storage.transactionSync(() => {
+      const row = this.sql
+        .exec<{ json: string }>(
+          `SELECT json FROM coordinator_units WHERE instance_id = ? AND unit = ?`,
+          expected.instanceId,
+          expected.unit,
+        )
+        .toArray()[0];
+      if (row?.json !== JSON.stringify(expected)) {
+        out = { ok: false, reason: "stale" };
+        return;
+      }
+      this.sql.exec(
+        `UPDATE coordinator_units SET json = ?, updated_at = ? WHERE instance_id = ? AND unit = ?`,
+        JSON.stringify(recovered),
+        now,
+        expected.instanceId,
+        expected.unit,
+      );
+    });
+    return out;
+  }
+
   async listUnits(instanceId: string): Promise<CoordinatorUnit[]> {
     return this.sql
       .exec<{ json: string }>(`SELECT json FROM coordinator_units WHERE instance_id = ? ORDER BY rowid`, instanceId)
@@ -5187,6 +5219,7 @@ const LEDGER_ROUTES = new Set([
   "/runs/coordinator/get",
   "/runs/coordinator/stop",
   "/runs/coordinator/units/put",
+  "/runs/coordinator/units/claim-legacy-continuation",
   "/runs/coordinator/units/list",
   "/runs/coordinator/events/append",
   "/runs/coordinator/events/list",
@@ -5886,6 +5919,17 @@ async function handleLedger(pathname: string, body: unknown, env: Env): Promise<
     console.log(`[runs/coordinator/units/put] ${key.value} ${units[0]!.instanceId} ${units.length} row(s)`);
     return json(r);
   }
+  if (pathname === "/runs/coordinator/units/claim-legacy-continuation") {
+    if (!isCoordinatorUnit(b.expected) || !isCoordinatorUnit(b.recovered))
+      return json({ error: "expected and recovered must be coordinator unit rows" }, 400);
+    if (b.expected.instanceId !== b.recovered.instanceId || b.expected.unit !== b.recovered.unit)
+      return json({ error: "expected and recovered must name the same unit" }, 400);
+    const r = await stub.claimLegacyContinuation(b.expected, b.recovered, now);
+    console.log(
+      `[runs/coordinator/units/claim-legacy-continuation] ${key.value} ${b.expected.instanceId}:${b.expected.unit} → ${r.ok ? "claimed" : r.reason}`,
+    );
+    return r.ok ? json(r) : json(r, 409);
+  }
   if (pathname === "/runs/coordinator/units/list") {
     if (typeof b.instanceId !== "string" || !INSTANCE_ID_PATTERN.test(b.instanceId))
       return json({ error: "instanceId must be a Workflow instance id" }, 400);

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.261.2",
+  "version": "1.261.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.261.2",
+      "version": "1.261.3",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -21060,7 +21060,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.261.2",
+      "version": "1.261.3",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.261.2",
+  "version": "1.261.3",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.261.2",
-  "commit": "652eb70199d24be067ee91e1c9e14f48770a594c",
-  "builtAt": "2026-09-24T02:09:02.047Z"
+  "version": "1.261.3",
+  "commit": "b727e58725e3d234e0d34b43e04ca0dc9af17075",
+  "builtAt": "2026-09-24T14:03:08.080Z"
 }

package/dist/assets/src/core/coordinator/driver.ts

@@ -1137,14 +1137,16 @@ async function runUnit(
                 : {}),
             },
             ...(state.pr !== undefined ? { pr: state.pr } : {}),
-            // A review_pending ending names the child's own last push so the next
-            // attempt's pre-check can start at the review round (the row's lastPush)
-            // — an idled one the same, off the idle's `from` (record 0051).
-            ...(ending.kind === "review_pending" && ending.headSha !== undefined
-              ? { headSha: ending.headSha }
-              : ending.kind === "idle" && ending.why === "review_pending" && ending.from !== undefined
-                ? { headSha: ending.from }
-                : {}),
+            // A merge_ready ending retains the exact head its final approval
+            // reviewed. Review-pending endings retain the coding child's push;
+            // both become the row's durable lastPush for a later attempt.
+            ...(ending.kind === "merge_ready" && state.lastReviewHead !== undefined
+              ? { headSha: state.lastReviewHead }
+              : ending.kind === "review_pending" && ending.headSha !== undefined
+                ? { headSha: ending.headSha }
+                : ending.kind === "idle" && ending.why === "review_pending" && ending.from !== undefined
+                  ? { headSha: ending.from }
+                  : {}),
             ...(state.lastCodingRunId !== undefined ? { codingRunId: state.lastCodingRunId } : {}),
             // A continued ending is a segment's end, not the unit's: the bot
             // writes the renewal as a row keyed by the next segment's index

package/dist/cli.js

@@ -34687,6 +34687,9 @@ var init_instanceStore = __esm({
       async putUnits(_units) {
         return { ok: false, reason: "unavailable" };
       }
+      async claimLegacyContinuation(_expected, _recovered) {
+        return { ok: false, reason: "unavailable" };
+      }
       async listUnits(_instanceId) {
         return [];
       }
@@ -34761,6 +34764,15 @@ var init_instanceStore = __esm({
         if (d.ok === true) return { ok: true };
         throw new Error(`coordinator store /runs/coordinator/units/put: unexpected answer (HTTP ${r.status})`);
       }
+      async claimLegacyContinuation(expected, recovered) {
+        const r = await this.post("/runs/coordinator/units/claim-legacy-continuation", { expected, recovered });
+        const d = r.data;
+        if (r.status === 409 && d.reason === "stale") return { ok: false, reason: "stale" };
+        if (d.ok === true) return { ok: true };
+        throw new Error(
+          `coordinator store /runs/coordinator/units/claim-legacy-continuation: unexpected answer (HTTP ${r.status})`
+        );
+      }
       async listUnits(instanceId) {
         const r = await this.post("/runs/coordinator/units/list", { instanceId });
         const d = r.data;
@@ -54774,75 +54786,103 @@ async function handOffToCoordinatorUnchecked(deps, input) {
 }
 async function start(deps, input, instance, units, where, write) {
   const log = deps.log ?? console.log;
-  const put = write === "replace" ? await deps.instances.replace(instance) : await deps.instances.put(instance);
-  if (!put.ok) {
-    if (put.reason === "unavailable")
+  const reservation = await input.beforeStart?.();
+  if (reservation?.ok === false)
+    return { status: "aborted", reply: reservation.refusal.text, refusal: reservation.refusal };
+  let started = false;
+  try {
+    const put = write === "replace" ? await deps.instances.replace(instance) : await deps.instances.put(instance);
+    if (!put.ok) {
+      if (put.reason === "unavailable")
+        return refused5(
+          "plan_history_unavailable",
+          "\u26A0\uFE0F The plan runner needs run history on the state Worker (`runHistory.worker`): the instance record could not be written, so nothing ran."
+        );
       return refused5(
-        "plan_history_unavailable",
-        "\u26A0\uFE0F The plan runner needs run history on the state Worker (`runHistory.worker`): the instance record could not be written, so nothing ran."
+        "plan_runner_conflict",
+        `\u{1F6AB} A runner for \`${instance.id}\` was just recorded by another request, so this request started nothing; the recorded runner owns the pipeline.`
       );
-    return refused5(
-      "plan_runner_conflict",
-      `\u{1F6AB} A runner for \`${instance.id}\` was just recorded by another request, so this request started nothing; the recorded runner owns the pipeline.`
-    );
-  }
-  const rows = await deps.instances.putUnits(units);
-  if (!rows.ok)
-    return refused5(
-      "plan_history_unavailable",
-      "\u26A0\uFE0F The plan runner needs run history on the state Worker: the unit rows could not be written, so nothing ran."
-    );
-  const accepted = [...input.msg.images ?? [], ...input.msg.documents ?? []];
-  if (instance.plan?.path === void 0 && accepted.length > 0) {
-    const unit = units[0];
-    const seeded = await deps.instances.appendEvent(
-      { instanceId: instance.id, unit: unit.unit },
-      {
-        id: `${instance.id}:${unit.unit}:ship-request`,
-        sender: input.msg.userId,
-        ...input.msg.userName !== void 0 ? { senderName: input.msg.userName } : {},
-        text: "Attachments from the ship request.",
-        attachments: accepted,
-        mode: "steer",
-        at: input.now
-      }
-    );
-    if (!seeded.ok)
+    }
+    const rows = await deps.instances.putUnits(units);
+    if (!rows.ok)
       return refused5(
         "plan_history_unavailable",
-        "\u26A0\uFE0F The plan runner needs run history on the state Worker: the ship request's attachments could not be written, so nothing ran."
+        "\u26A0\uFE0F The plan runner needs run history on the state Worker: the unit rows could not be written, so nothing ran."
       );
-  }
-  let answer;
-  try {
-    answer = await deps.create(instance.id);
-  } catch (err2) {
-    answer = { kind: "unanswered", reason: describe7(err2) };
-  }
-  switch (answer.kind) {
-    case "created": {
-      log(`[ship] ${input.msg.threadKey}: handed to the plan runner ${instance.id} (${units.length} unit(s))`);
-      const replaced = write === "replace" ? ["the records of an earlier attempt that never started were replaced"] : [];
-      return {
-        status: "completed",
-        reply: handedOff([...where, ...replaced]),
-        instanceId: instance.id
-      };
-    }
-    case "duplicate": {
-      const status3 = answer.status !== void 0 ? `, status: ${answer.status}` : "";
-      return refused5(
-        "plan_instance_orphaned",
-        `\u{1F6AB} A Workflow instance \`${instance.id}\` already exists on the platform${status3} but the state Worker knew nothing of it \u2014 a person decides; re-issuing will not resume it.`
+    const accepted = [...input.msg.images ?? [], ...input.msg.documents ?? []];
+    if (instance.plan?.path === void 0 && accepted.length > 0) {
+      const unit = units[0];
+      const seeded = await deps.instances.appendEvent(
+        { instanceId: instance.id, unit: unit.unit },
+        {
+          id: `${instance.id}:${unit.unit}:ship-request`,
+          sender: input.msg.userId,
+          ...input.msg.userName !== void 0 ? { senderName: input.msg.userName } : {},
+          text: "Attachments from the ship request.",
+          attachments: accepted,
+          mode: "steer",
+          at: input.now
+        }
       );
+      if (!seeded.ok)
+        return refused5(
+          "plan_history_unavailable",
+          "\u26A0\uFE0F The plan runner needs run history on the state Worker: the ship request's attachments could not be written, so nothing ran."
+        );
     }
-    case "failed":
-    case "unanswered":
-      log(`[ship] ${input.msg.threadKey}: the plan runner ${instance.id} could not be started \u2014 ${answer.reason}`);
-      return refused5(
-        "plan_start_failed",
-        `\u26A0\uFE0F This is a bug: the plan runner could not be started (${answer.reason}), nothing ran, and no automatic start retry was scheduled.`
-      );
+    if (reservation?.ok === true) {
+      const unit = units[0];
+      if (unit === void 0)
+        return refused5(
+          "setup_failed",
+          "\u26A0\uFE0F The plan runner had no durable unit to own at its final start gate, so nothing ran."
+        );
+      try {
+        await reservation.commit({ instanceId: instance.id, unit: unit.unit });
+      } catch (err2) {
+        return refused5(
+          "setup_failed",
+          `\u26A0\uFE0F The plan runner could not transfer existing-pull-request ownership to its new attempt (${describe7(err2)}), so nothing ran.`
+        );
+      }
+    }
+    let answer;
+    try {
+      answer = await deps.create(instance.id);
+    } catch (err2) {
+      answer = { kind: "unanswered", reason: describe7(err2) };
+    }
+    switch (answer.kind) {
+      case "created": {
+        if (reservation?.ok === true) reservation.complete();
+        started = true;
+        log(`[ship] ${input.msg.threadKey}: handed to the plan runner ${instance.id} (${units.length} unit(s))`);
+        const replaced = write === "replace" ? ["the records of an earlier attempt that never started were replaced"] : [];
+        return {
+          status: "completed",
+          reply: handedOff([...where, ...replaced]),
+          instanceId: instance.id
+        };
+      }
+      case "duplicate": {
+        const status3 = answer.status !== void 0 ? `, status: ${answer.status}` : "";
+        return refused5(
+          "plan_instance_orphaned",
+          `\u{1F6AB} A Workflow instance \`${instance.id}\` already exists on the platform${status3} but the state Worker knew nothing of it \u2014 a person decides; re-issuing will not resume it.`
+        );
+      }
+      case "failed":
+      case "unanswered":
+        log(`[ship] ${input.msg.threadKey}: the plan runner ${instance.id} could not be started \u2014 ${answer.reason}`);
+        return refused5(
+          "plan_start_failed",
+          `\u26A0\uFE0F This is a bug: the plan runner could not be started (${answer.reason}), nothing ran, and no automatic start retry was scheduled.`
+        );
+    }
+    const unreachable3 = answer;
+    return unreachable3;
+  } finally {
+    if (!started && reservation?.ok === true) await reservation.abort();
   }
 }
 function handedOff(facts2) {
@@ -55296,6 +55336,7 @@ async function runShipBranch(deps, msg, io, ctx) {
           entry,
           requestText: directives.text,
           ...ctx.reissuePlanId !== void 0 ? { reissuePlanId: ctx.reissuePlanId } : {},
+          ...ctx.beforeCoordinatorStart !== void 0 ? { beforeStart: ctx.beforeCoordinatorStart } : {},
           msg,
           agentSource: ctx.agentSource,
           runId: run2.id,
@@ -56089,6 +56130,29 @@ function continuationBudgetOf(instance, unit) {
   if (remainingRounds <= 0) return { kind: "exhausted", budget: "review-round" };
   return { kind: "remaining", caps: { maxRounds: remainingRounds, maxMinutes: remainingMinutes } };
 }
+async function legacyReviewedHeadOf(runs, instance, unit, prNumber) {
+  const listed = await runs.listUnitRuns(unitKeyOf({ instanceId: instance.id, unit: unit.unit }), { kind: "all" }).catch(() => void 0);
+  if (listed === void 0 || !listed.ok || listed.value.unit !== unitKeyOf({ instanceId: instance.id, unit: unit.unit }) || listed.value.instanceId !== instance.id || listed.value.id !== unit.unit || listed.value.instance.id !== instance.id || listed.value.instance.repo.toLowerCase() !== instance.repo.toLowerCase())
+    return void 0;
+  const prefix = `${instance.id}:${unit.unit}/`;
+  const owned = listed.value.runs.filter(
+    (run2) => run2.finished && run2.status === "completed" && run2.parentInstanceId === instance.id && run2.idempotencyKey?.startsWith(prefix) === true && run2.userId === instance.userId && run2.repo?.toLowerCase() === instance.repo.toLowerCase()
+  );
+  const coding = new Set(
+    owned.flatMap(
+      (run2) => run2.agent === "coding" && run2.pr?.number === prNumber && typeof run2.headSha === "string" && FULL_SHA2.test(run2.headSha) ? [run2.headSha.toLowerCase()] : []
+    )
+  );
+  const approved = new Set(
+    owned.flatMap((run2) => {
+      const head = run2.reviewHead;
+      const post = run2.reviewPost;
+      return run2.agent === "review" && typeof head === "string" && FULL_SHA2.test(head) && run2.verdict?.verdict === "approve" && run2.verdict.head?.toLowerCase() === head.toLowerCase() && post?.posted === true && post.target.repo.toLowerCase() === instance.repo.toLowerCase() && post.target.number === prNumber && post.head.toLowerCase() === head.toLowerCase() && post.verdict === "approve" ? [head.toLowerCase()] : [];
+    })
+  );
+  const exact = [...approved].filter((head) => coding.has(head));
+  return exact.length === 1 ? exact[0] : void 0;
+}
 async function dispatch(deps, msg, io, opts = {}) {
   const ended = { status: "completed" };
   const resume = opts.resume;
@@ -56173,6 +56237,7 @@ async function dispatch(deps, msg, io, opts = {}) {
   let stoppedWhileAttaching;
   let resumeRowClosed = false;
   let restartRequest;
+  let releaseLegacyOwnership;
   const reservationHooks = {
     onStop: (mode) => void registered?.control.requestStop(mode),
     onFenced: () => {
@@ -56191,6 +56256,8 @@ async function dispatch(deps, msg, io, opts = {}) {
     let operatorRepo;
     let reissuePlanId;
     let reissueCaps;
+    let beforeCoordinatorStart;
+    let reserveLegacyOwnership;
     let operatorThread;
     let pageOwner;
     if (operatorMode !== "off") {
@@ -56408,7 +56475,19 @@ async function dispatch(deps, msg, io, opts = {}) {
           await recordPendingOperator();
           return ended;
         }
-        const expectedHead = owner.unit.lastPush;
+        let expectedHead = owner.unit.lastPush;
+        const recoverLegacyBinding = owner.unit.ending?.kind === "merge_ready" && (expectedHead === void 0 || owner.unit.publication === void 0);
+        if (recoverLegacyBinding) {
+          const recovered = await legacyReviewedHeadOf(runsService, instance, owner.unit, recordedPr.number);
+          if (recovered === void 0 || expectedHead !== void 0 && expectedHead.toLowerCase() !== recovered) {
+            await io.reply(
+              `Unit ${owner.unit.unit} has no single exact reviewed head in its durable child records, so continuation did not start. Nothing else ran.`
+            );
+            await recordPendingOperator();
+            return ended;
+          }
+          expectedHead = recovered;
+        }
         if (expectedHead === void 0) {
           await io.reply(
             `Unit ${owner.unit.unit} does not retain the pull request's durable expected head, so continuation did not start. Nothing else ran.`
@@ -56447,6 +56526,140 @@ async function dispatch(deps, msg, io, opts = {}) {
           await recordPendingOperator();
           return ended;
         }
+        if (recoverLegacyBinding) {
+          const baseRef = instance.base;
+          if (baseRef === void 0 || facts2.baseRef !== baseRef) {
+            await io.reply(
+              `${instance.repo}#${recordedPr.number} no longer has the pipeline's verifiable base ref, so continuation did not start. Nothing else ran.`
+            );
+            await recordPendingOperator();
+            return ended;
+          }
+          const existingBinding = owner.unit.publication;
+          if (existingBinding !== void 0 && (existingBinding.repo.toLowerCase() !== instance.repo.toLowerCase() || existingBinding.pr !== recordedPr.number || existingBinding.headRef !== owner.unit.branch || existingBinding.baseRef !== baseRef || existingBinding.expectedHeadSha.toLowerCase() !== expectedHead || existingBinding.publicationRef !== owner.unit.branch || existingBinding.owner.instanceId !== owner.instanceId || existingBinding.owner.unit !== owner.unit.unit)) {
+            await io.reply(
+              `Unit ${owner.unit.unit}'s durable publication binding no longer matches this pipeline, so continuation did not start. Nothing else ran.`
+            );
+            await recordPendingOperator();
+            return ended;
+          }
+          let currentOwner;
+          const runnerOwnership = deps.runnerOwnership;
+          try {
+            if (runnerOwnership === void 0) throw new Error("runner ownership is unavailable");
+            currentOwner = runnerOwnership.owner(instance.repo, recordedPr.number);
+          } catch {
+            await io.reply(
+              `Runner ownership for ${instance.repo}#${recordedPr.number} could not be verified, so continuation did not start. Nothing else ran.`
+            );
+            await recordPendingOperator();
+            return ended;
+          }
+          if (currentOwner !== void 0 && (currentOwner.instanceId !== owner.instanceId || currentOwner.unit !== owner.unit.unit)) {
+            await io.reply(
+              `${instance.repo}#${recordedPr.number} is owned by another runner, so continuation of ${owner.instanceId}:${owner.unit.unit} did not start. Nothing else ran.`
+            );
+            await recordPendingOperator();
+            return ended;
+          }
+          const legacyUnit = owner.unit;
+          const coordinatorInstances = deps.coordinatorInstances;
+          const reservationOwner = { instanceId: owner.instanceId, unit: owner.unit.unit };
+          const recoveredUnit = {
+            ...legacyUnit,
+            lastPush: expectedHead,
+            publication: {
+              repo: instance.repo,
+              pr: recordedPr.number,
+              headRef: legacyUnit.branch,
+              baseRef,
+              expectedHeadSha: expectedHead,
+              publicationRef: legacyUnit.branch,
+              owner: reservationOwner
+            }
+          };
+          let token2;
+          let transferredOwner;
+          releaseLegacyOwnership = () => {
+            if (token2 !== void 0) {
+              const released = runnerOwnership.releaseReservation(instance.repo, recordedPr.number, token2);
+              if (released) token2 = void 0;
+              return released;
+            }
+            if (transferredOwner !== void 0) {
+              const released = runnerOwnership.release(instance.repo, recordedPr.number, transferredOwner);
+              if (released) transferredOwner = void 0;
+              return released;
+            }
+            return true;
+          };
+          reserveLegacyOwnership = () => {
+            token2 = runnerOwnership.reserve(instance.repo, recordedPr.number, reservationOwner);
+            if (token2 !== void 0) return void 0;
+            const competing = runnerOwnership.owner(instance.repo, recordedPr.number);
+            const sameContinuation = competing?.instanceId === reservationOwner.instanceId && competing.unit === reservationOwner.unit;
+            return refusalOf(
+              "setup_failed",
+              sameContinuation ? `Unit ${legacyUnit.unit} changed while its legacy continuation was being reserved, so continuation did not start. Nothing else ran.` : `${instance.repo}#${recordedPr.number} is owned by another runner, so continuation of ${owner.instanceId}:${legacyUnit.unit} did not start. Nothing else ran.`
+            );
+          };
+          beforeCoordinatorStart = async () => {
+            const activeToken = token2;
+            if (activeToken === void 0)
+              return {
+                ok: false,
+                refusal: refusalOf(
+                  "setup_failed",
+                  `Unit ${legacyUnit.unit}'s ownership reservation was lost, so continuation did not start. Nothing else ran.`
+                )
+              };
+            const persisted = await coordinatorInstances.claimLegacyContinuation(legacyUnit, recoveredUnit).catch(() => void 0);
+            if (persisted?.ok !== true) {
+              const released = releaseLegacyOwnership?.() ?? true;
+              const reason2 = persisted?.reason === "stale" ? `Unit ${legacyUnit.unit} changed while its legacy continuation was being reserved, so continuation did not start.` : `Unit ${legacyUnit.unit}'s recovered continuation binding could not be stored, so continuation did not start.`;
+              const text = released ? `${reason2} Nothing else ran.` : `${reason2} Its ownership reservation could not be released. Nothing else ran.`;
+              return { ok: false, refusal: refusalOf("setup_failed", text) };
+            }
+            const reservedOwner = runnerOwnership.owner(instance.repo, recordedPr.number);
+            if (reservedOwner?.instanceId !== reservationOwner.instanceId || reservedOwner.unit !== reservationOwner.unit) {
+              const restored = await coordinatorInstances.claimLegacyContinuation(recoveredUnit, legacyUnit).catch(() => void 0);
+              const released = releaseLegacyOwnership?.() ?? true;
+              const rollbackFailure = restored?.ok === true ? void 0 : restored?.reason ?? "unavailable";
+              const cleanupFailure = released ? "" : " and its ownership reservation could not be released";
+              const text = rollbackFailure === void 0 ? `${instance.repo}#${recordedPr.number} changed runner ownership while its legacy continuation was being reserved${cleanupFailure}, so continuation did not start. Nothing else ran.` : `${instance.repo}#${recordedPr.number} changed runner ownership while its legacy continuation was being reserved, and the exact legacy row could not be restored (${rollbackFailure})${cleanupFailure}; continuation did not start. Nothing else ran.`;
+              return { ok: false, refusal: refusalOf("setup_failed", text) };
+            }
+            owner.unit = recoveredUnit;
+            return {
+              ok: true,
+              commit: async (nextOwner) => {
+                if (!runnerOwnership.transferReservation(
+                  instance.repo,
+                  recordedPr.number,
+                  activeToken,
+                  reservationOwner,
+                  nextOwner
+                ))
+                  throw new Error("legacy continuation ownership reservation or current owner changed");
+                token2 = void 0;
+                transferredOwner = nextOwner;
+              },
+              complete: () => {
+                transferredOwner = void 0;
+              },
+              abort: async () => {
+                const restored = await coordinatorInstances.claimLegacyContinuation(recoveredUnit, legacyUnit).catch(() => void 0);
+                const released = releaseLegacyOwnership?.() ?? true;
+                owner.unit = legacyUnit;
+                const failures = [
+                  ...restored?.ok === true ? [] : [`legacy continuation rollback failed (${restored?.reason ?? "unavailable"})`],
+                  ...released ? [] : ["legacy continuation ownership cleanup failed"]
+                ];
+                if (failures.length > 0) throw new Error(failures.join("; "));
+              }
+            };
+          };
+        }
         reissuePlanId = instance.plan.id;
         reissueCaps = continuationBudget.caps;
         const durableRequest = parseDirectives(original);
@@ -56499,6 +56712,12 @@ async function dispatch(deps, msg, io, opts = {}) {
     });
     if (profileGate.kind === "refused") return ended;
     const { profile } = profileGate;
+    const legacyOwnershipRefusal = reserveLegacyOwnership?.();
+    if (legacyOwnershipRefusal !== void 0) {
+      await io.reply(legacyOwnershipRefusal.text);
+      await recordPendingOperator();
+      return ended;
+    }
     const earlyRepoTarget = agent.name === "review" ? resolveRepoTarget(deps, {
       msg,
       history,
@@ -56677,6 +56896,7 @@ async function dispatch(deps, msg, io, opts = {}) {
         card,
         directives,
         ...reissuePlanId !== void 0 ? { reissuePlanId } : {},
+        ...beforeCoordinatorStart !== void 0 ? { beforeCoordinatorStart } : {},
         ...reissueCaps !== void 0 ? { reissueCaps: { ...reissueCaps, maxMinutes: Math.min(reissueCaps.maxMinutes, profile.minutes) } } : {},
         sticky,
         history,
@@ -57389,6 +57609,7 @@ async function dispatch(deps, msg, io, opts = {}) {
     });
   } finally {
     clearInterval(setupHeartbeat);
+    releaseLegacyOwnership?.();
     ending.drain(void 0);
     if (registered) deps.runBearers?.revoke(registered.id);
     if (resume && ledgerRun && !runLoopStarted && !resumeRowClosed) {
@@ -57576,7 +57797,7 @@ async function dispatchClick(deps, click) {
     activeRuns--;
   }
 }
-var activeRuns;
+var activeRuns, FULL_SHA2;
 var init_dispatcher = __esm({
   "../../src/core/dispatcher.ts"() {
     "use strict";
@@ -57642,6 +57863,7 @@ var init_dispatcher = __esm({
     init_types5();
     init_decisionRecordReservation();
     activeRuns = 0;
+    FULL_SHA2 = /^[0-9a-f]{40}$/i;
   }
 });
 
@@ -71522,22 +71744,73 @@ var init_runnerOwnership = __esm({
       recovered = /* @__PURE__ */ new Set();
       claimedOwners = /* @__PURE__ */ new Map();
       recoveredOwners = /* @__PURE__ */ new Map();
+      reservations = /* @__PURE__ */ new Map();
       localRecoveredInstances = /* @__PURE__ */ new Set();
       recoveryComplete;
       constructor(requiresRecovery) {
         this.recoveryComplete = !requiresRecovery;
       }
+      /** Claim without displacing a different live runner. The read and write are
+       * synchronous, so a caller owns the process-local fence before its next
+       * awaited durable transition. Repeating the same owner's claim is idempotent. */
       claim(repo, prNumber, owner) {
         const key = runnerOwnedPullKey(repo, prNumber);
+        const current = this.claimedOwners.get(key) ?? this.recoveredOwners.get(key);
+        const alreadyOwned = this.claimed.has(key) || this.recovered.has(key);
+        if (this.reservations.has(key)) return false;
+        if (alreadyOwned && (owner === void 0 || current === void 0 || current.instanceId !== owner.instanceId || current.unit !== owner.unit))
+          return false;
         this.claimed.add(key);
         if (owner !== void 0) this.claimedOwners.set(key, owner);
+        return true;
       }
-      release(repo, prNumber) {
+      /** Exclusively reserve an unowned pull request across an awaited durable
+       * transition. Even the same runner identity cannot reserve it twice: the
+       * returned token, not the owner fields, identifies the one caller. */
+      reserve(repo, prNumber, owner) {
         const key = runnerOwnedPullKey(repo, prNumber);
+        if (this.claimed.has(key) || this.recovered.has(key) || this.reservations.has(key)) return void 0;
+        const token2 = Symbol(key);
+        this.reservations.set(key, token2);
+        this.claimed.add(key);
+        this.claimedOwners.set(key, owner);
+        return token2;
+      }
+      /** Move an exclusive recovery reservation to the durable attempt that is
+       * about to start. Both the unforgeable token and the currently recorded
+       * owner must still match; a stale caller can neither displace nor adopt a
+       * successor. The transfer consumes the reservation but retains ownership. */
+      transferReservation(repo, prNumber, token2, currentOwner, nextOwner) {
+        const key = runnerOwnedPullKey(repo, prNumber);
+        const current = this.claimedOwners.get(key);
+        if (this.reservations.get(key) !== token2 || !this.claimed.has(key) || current?.instanceId !== currentOwner.instanceId || current.unit !== currentOwner.unit)
+          return false;
+        this.reservations.delete(key);
+        this.claimedOwners.set(key, nextOwner);
+        return true;
+      }
+      releaseReservation(repo, prNumber, token2) {
+        const key = runnerOwnedPullKey(repo, prNumber);
+        if (this.reservations.get(key) !== token2) return false;
+        this.reservations.delete(key);
+        this.claimed.delete(key);
+        this.claimedOwners.delete(key);
+        return true;
+      }
+      /** Release unconditionally for the runner's ordinary end, or conditionally
+       * for a provisional claim whose cleanup must not erase a successor. */
+      release(repo, prNumber, owner) {
+        const key = runnerOwnedPullKey(repo, prNumber);
+        if (owner !== void 0) {
+          const current = this.claimedOwners.get(key) ?? this.recoveredOwners.get(key);
+          if (current?.instanceId !== owner.instanceId || current.unit !== owner.unit) return false;
+        }
+        this.reservations.delete(key);
         this.claimed.delete(key);
         this.recovered.delete(key);
         this.claimedOwners.delete(key);
         this.recoveredOwners.delete(key);
+        return true;
       }
       owns(repo, prNumber) {
         if (!this.recoveryComplete) throw new Error("runner ownership recovery is still in progress");
@@ -75544,6 +75817,7 @@ async function runBot() {
   ) : new NullMetricsService();
   const sweepState = { roundSpent: /* @__PURE__ */ new Set() };
   const runnerOwnership = new RunnerOwnershipFence(capabilities.runLedger);
+  deps.runnerOwnership = runnerOwnership;
   const pullsWiring = /* @__PURE__ */ (() => {
     const state = sweepState;
     const chains = /* @__PURE__ */ new Map();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreplane/switchboard",
-  "version": "1.261.2",
+  "version": "1.261.3",
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
   "homepage": "https://openswitchboard.dev",