@coreplane/switchboard 1.261.2 → 1.261.4

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -2732,6 +2732,38 @@ export class RunHistoryDO extends DurableObject<Env> {
     return { ok: true };
   }
 
+  /** One compare-and-replace transaction updates a unit for exactly one
+   * caller. The whole expected JSON is the fence: any intervening unit write
+   * makes this caller stale. */
+  async compareAndReplaceUnit(
+    expected: CoordinatorUnit,
+    replacement: CoordinatorUnit,
+    now: number,
+  ): Promise<{ ok: true } | { ok: false; reason: "stale" }> {
+    let out: { ok: true } | { ok: false; reason: "stale" } = { ok: true };
+    this.ctx.storage.transactionSync(() => {
+      const row = this.sql
+        .exec<{ json: string }>(
+          `SELECT json FROM coordinator_units WHERE instance_id = ? AND unit = ?`,
+          expected.instanceId,
+          expected.unit,
+        )
+        .toArray()[0];
+      if (row?.json !== JSON.stringify(expected)) {
+        out = { ok: false, reason: "stale" };
+        return;
+      }
+      this.sql.exec(
+        `UPDATE coordinator_units SET json = ?, updated_at = ? WHERE instance_id = ? AND unit = ?`,
+        JSON.stringify(replacement),
+        now,
+        expected.instanceId,
+        expected.unit,
+      );
+    });
+    return out;
+  }
+
   async listUnits(instanceId: string): Promise<CoordinatorUnit[]> {
     return this.sql
       .exec<{ json: string }>(`SELECT json FROM coordinator_units WHERE instance_id = ? ORDER BY rowid`, instanceId)
@@ -5187,6 +5219,7 @@ const LEDGER_ROUTES = new Set([
   "/runs/coordinator/get",
   "/runs/coordinator/stop",
   "/runs/coordinator/units/put",
+  "/runs/coordinator/units/claim-legacy-continuation",
   "/runs/coordinator/units/list",
   "/runs/coordinator/events/append",
   "/runs/coordinator/events/list",
@@ -5886,6 +5919,17 @@ async function handleLedger(pathname: string, body: unknown, env: Env): Promise<
     console.log(`[runs/coordinator/units/put] ${key.value} ${units[0]!.instanceId} ${units.length} row(s)`);
     return json(r);
   }
+  if (pathname === "/runs/coordinator/units/claim-legacy-continuation") {
+    if (!isCoordinatorUnit(b.expected) || !isCoordinatorUnit(b.recovered))
+      return json({ error: "expected and recovered must be coordinator unit rows" }, 400);
+    if (b.expected.instanceId !== b.recovered.instanceId || b.expected.unit !== b.recovered.unit)
+      return json({ error: "expected and recovered must name the same unit" }, 400);
+    const r = await stub.compareAndReplaceUnit(b.expected, b.recovered, now);
+    console.log(
+      `[runs/coordinator/units/claim-legacy-continuation] ${key.value} ${b.expected.instanceId}:${b.expected.unit} → ${r.ok ? "replaced" : r.reason}`,
+    );
+    return r.ok ? json(r) : json(r, 409);
+  }
   if (pathname === "/runs/coordinator/units/list") {
     if (typeof b.instanceId !== "string" || !INSTANCE_ID_PATTERN.test(b.instanceId))
       return json({ error: "instanceId must be a Workflow instance id" }, 400);

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.261.2",
+  "version": "1.261.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.261.2",
+      "version": "1.261.4",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -21060,7 +21060,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.261.2",
+      "version": "1.261.4",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.261.2",
+  "version": "1.261.4",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.261.2",
-  "commit": "652eb70199d24be067ee91e1c9e14f48770a594c",
-  "builtAt": "2026-09-24T02:09:02.047Z"
+  "version": "1.261.4",
+  "commit": "9f4d0f4c9645ea67ecab3ede2455e658f38a7d4c",
+  "builtAt": "2026-09-24T16:28:36.099Z"
 }

package/dist/assets/src/core/coordinator/driver.ts

@@ -1137,14 +1137,16 @@ async function runUnit(
                 : {}),
             },
             ...(state.pr !== undefined ? { pr: state.pr } : {}),
-            // A review_pending ending names the child's own last push so the next
-            // attempt's pre-check can start at the review round (the row's lastPush)
-            // — an idled one the same, off the idle's `from` (record 0051).
-            ...(ending.kind === "review_pending" && ending.headSha !== undefined
-              ? { headSha: ending.headSha }
-              : ending.kind === "idle" && ending.why === "review_pending" && ending.from !== undefined
-                ? { headSha: ending.from }
-                : {}),
+            // A merge_ready ending retains the exact head its final approval
+            // reviewed. Review-pending endings retain the coding child's push;
+            // both become the row's durable lastPush for a later attempt.
+            ...(ending.kind === "merge_ready" && state.lastReviewHead !== undefined
+              ? { headSha: state.lastReviewHead }
+              : ending.kind === "review_pending" && ending.headSha !== undefined
+                ? { headSha: ending.headSha }
+                : ending.kind === "idle" && ending.why === "review_pending" && ending.from !== undefined
+                  ? { headSha: ending.from }
+                  : {}),
             ...(state.lastCodingRunId !== undefined ? { codingRunId: state.lastCodingRunId } : {}),
             // A continued ending is a segment's end, not the unit's: the bot
             // writes the renewal as a row keyed by the next segment's index

package/dist/cli.js

@@ -34687,6 +34687,9 @@ var init_instanceStore = __esm({
       async putUnits(_units) {
         return { ok: false, reason: "unavailable" };
       }
+      async compareAndReplaceUnit(_expected, _replacement) {
+        return { ok: false, reason: "unavailable" };
+      }
       async listUnits(_instanceId) {
         return [];
       }
@@ -34761,6 +34764,18 @@ var init_instanceStore = __esm({
         if (d.ok === true) return { ok: true };
         throw new Error(`coordinator store /runs/coordinator/units/put: unexpected answer (HTTP ${r.status})`);
       }
+      async compareAndReplaceUnit(expected, replacement) {
+        const r = await this.post("/runs/coordinator/units/claim-legacy-continuation", {
+          expected,
+          recovered: replacement
+        });
+        const d = r.data;
+        if (r.status === 409 && d.reason === "stale") return { ok: false, reason: "stale" };
+        if (d.ok === true) return { ok: true };
+        throw new Error(
+          `coordinator store /runs/coordinator/units/claim-legacy-continuation: unexpected answer (HTTP ${r.status})`
+        );
+      }
       async listUnits(instanceId) {
         const r = await this.post("/runs/coordinator/units/list", { instanceId });
         const d = r.data;
@@ -54774,75 +54789,103 @@ async function handOffToCoordinatorUnchecked(deps, input) {
 }
 async function start(deps, input, instance, units, where, write) {
   const log = deps.log ?? console.log;
-  const put = write === "replace" ? await deps.instances.replace(instance) : await deps.instances.put(instance);
-  if (!put.ok) {
-    if (put.reason === "unavailable")
+  const reservation = await input.beforeStart?.();
+  if (reservation?.ok === false)
+    return { status: "aborted", reply: reservation.refusal.text, refusal: reservation.refusal };
+  let started = false;
+  try {
+    const put = write === "replace" ? await deps.instances.replace(instance) : await deps.instances.put(instance);
+    if (!put.ok) {
+      if (put.reason === "unavailable")
+        return refused5(
+          "plan_history_unavailable",
+          "\u26A0\uFE0F The plan runner needs run history on the state Worker (`runHistory.worker`): the instance record could not be written, so nothing ran."
+        );
       return refused5(
-        "plan_history_unavailable",
-        "\u26A0\uFE0F The plan runner needs run history on the state Worker (`runHistory.worker`): the instance record could not be written, so nothing ran."
+        "plan_runner_conflict",
+        `\u{1F6AB} A runner for \`${instance.id}\` was just recorded by another request, so this request started nothing; the recorded runner owns the pipeline.`
       );
-    return refused5(
-      "plan_runner_conflict",
-      `\u{1F6AB} A runner for \`${instance.id}\` was just recorded by another request, so this request started nothing; the recorded runner owns the pipeline.`
-    );
-  }
-  const rows = await deps.instances.putUnits(units);
-  if (!rows.ok)
-    return refused5(
-      "plan_history_unavailable",
-      "\u26A0\uFE0F The plan runner needs run history on the state Worker: the unit rows could not be written, so nothing ran."
-    );
-  const accepted = [...input.msg.images ?? [], ...input.msg.documents ?? []];
-  if (instance.plan?.path === void 0 && accepted.length > 0) {
-    const unit = units[0];
-    const seeded = await deps.instances.appendEvent(
-      { instanceId: instance.id, unit: unit.unit },
-      {
-        id: `${instance.id}:${unit.unit}:ship-request`,
-        sender: input.msg.userId,
-        ...input.msg.userName !== void 0 ? { senderName: input.msg.userName } : {},
-        text: "Attachments from the ship request.",
-        attachments: accepted,
-        mode: "steer",
-        at: input.now
-      }
-    );
-    if (!seeded.ok)
+    }
+    const rows = await deps.instances.putUnits(units);
+    if (!rows.ok)
       return refused5(
         "plan_history_unavailable",
-        "\u26A0\uFE0F The plan runner needs run history on the state Worker: the ship request's attachments could not be written, so nothing ran."
+        "\u26A0\uFE0F The plan runner needs run history on the state Worker: the unit rows could not be written, so nothing ran."
       );
-  }
-  let answer;
-  try {
-    answer = await deps.create(instance.id);
-  } catch (err2) {
-    answer = { kind: "unanswered", reason: describe7(err2) };
-  }
-  switch (answer.kind) {
-    case "created": {
-      log(`[ship] ${input.msg.threadKey}: handed to the plan runner ${instance.id} (${units.length} unit(s))`);
-      const replaced = write === "replace" ? ["the records of an earlier attempt that never started were replaced"] : [];
-      return {
-        status: "completed",
-        reply: handedOff([...where, ...replaced]),
-        instanceId: instance.id
-      };
-    }
-    case "duplicate": {
-      const status3 = answer.status !== void 0 ? `, status: ${answer.status}` : "";
-      return refused5(
-        "plan_instance_orphaned",
-        `\u{1F6AB} A Workflow instance \`${instance.id}\` already exists on the platform${status3} but the state Worker knew nothing of it \u2014 a person decides; re-issuing will not resume it.`
+    const accepted = [...input.msg.images ?? [], ...input.msg.documents ?? []];
+    if (instance.plan?.path === void 0 && accepted.length > 0) {
+      const unit = units[0];
+      const seeded = await deps.instances.appendEvent(
+        { instanceId: instance.id, unit: unit.unit },
+        {
+          id: `${instance.id}:${unit.unit}:ship-request`,
+          sender: input.msg.userId,
+          ...input.msg.userName !== void 0 ? { senderName: input.msg.userName } : {},
+          text: "Attachments from the ship request.",
+          attachments: accepted,
+          mode: "steer",
+          at: input.now
+        }
       );
+      if (!seeded.ok)
+        return refused5(
+          "plan_history_unavailable",
+          "\u26A0\uFE0F The plan runner needs run history on the state Worker: the ship request's attachments could not be written, so nothing ran."
+        );
     }
-    case "failed":
-    case "unanswered":
-      log(`[ship] ${input.msg.threadKey}: the plan runner ${instance.id} could not be started \u2014 ${answer.reason}`);
-      return refused5(
-        "plan_start_failed",
-        `\u26A0\uFE0F This is a bug: the plan runner could not be started (${answer.reason}), nothing ran, and no automatic start retry was scheduled.`
-      );
+    if (reservation?.ok === true) {
+      const unit = units[0];
+      if (unit === void 0)
+        return refused5(
+          "setup_failed",
+          "\u26A0\uFE0F The plan runner had no durable unit to own at its final start gate, so nothing ran."
+        );
+      try {
+        await reservation.commit({ instanceId: instance.id, unit: unit.unit });
+      } catch (err2) {
+        return refused5(
+          "setup_failed",
+          `\u26A0\uFE0F The plan runner could not transfer existing-pull-request ownership to its new attempt (${describe7(err2)}), so nothing ran.`
+        );
+      }
+    }
+    let answer;
+    try {
+      answer = await deps.create(instance.id);
+    } catch (err2) {
+      answer = { kind: "unanswered", reason: describe7(err2) };
+    }
+    switch (answer.kind) {
+      case "created": {
+        if (reservation?.ok === true) reservation.complete();
+        started = true;
+        log(`[ship] ${input.msg.threadKey}: handed to the plan runner ${instance.id} (${units.length} unit(s))`);
+        const replaced = write === "replace" ? ["the records of an earlier attempt that never started were replaced"] : [];
+        return {
+          status: "completed",
+          reply: handedOff([...where, ...replaced]),
+          instanceId: instance.id
+        };
+      }
+      case "duplicate": {
+        const status3 = answer.status !== void 0 ? `, status: ${answer.status}` : "";
+        return refused5(
+          "plan_instance_orphaned",
+          `\u{1F6AB} A Workflow instance \`${instance.id}\` already exists on the platform${status3} but the state Worker knew nothing of it \u2014 a person decides; re-issuing will not resume it.`
+        );
+      }
+      case "failed":
+      case "unanswered":
+        log(`[ship] ${input.msg.threadKey}: the plan runner ${instance.id} could not be started \u2014 ${answer.reason}`);
+        return refused5(
+          "plan_start_failed",
+          `\u26A0\uFE0F This is a bug: the plan runner could not be started (${answer.reason}), nothing ran, and no automatic start retry was scheduled.`
+        );
+    }
+    const unreachable3 = answer;
+    return unreachable3;
+  } finally {
+    if (!started && reservation?.ok === true) await reservation.abort();
   }
 }
 function handedOff(facts2) {
@@ -55296,6 +55339,7 @@ async function runShipBranch(deps, msg, io, ctx) {
           entry,
           requestText: directives.text,
           ...ctx.reissuePlanId !== void 0 ? { reissuePlanId: ctx.reissuePlanId } : {},
+          ...ctx.beforeCoordinatorStart !== void 0 ? { beforeStart: ctx.beforeCoordinatorStart } : {},
           msg,
           agentSource: ctx.agentSource,
           runId: run2.id,
@@ -56089,6 +56133,35 @@ function continuationBudgetOf(instance, unit) {
   if (remainingRounds <= 0) return { kind: "exhausted", budget: "review-round" };
   return { kind: "remaining", caps: { maxRounds: remainingRounds, maxMinutes: remainingMinutes } };
 }
+async function legacyReviewedHeadOf(runs, instance, unit, prNumber) {
+  const listed = await runs.listUnitRuns(unitKeyOf({ instanceId: instance.id, unit: unit.unit }), { kind: "all" }).catch(() => void 0);
+  if (listed === void 0 || !listed.ok || listed.value.unit !== unitKeyOf({ instanceId: instance.id, unit: unit.unit }) || listed.value.instanceId !== instance.id || listed.value.id !== unit.unit || listed.value.branch !== unit.branch || listed.value.pr?.number !== prNumber || listed.value.instance.id !== instance.id || listed.value.instance.repo.toLowerCase() !== instance.repo.toLowerCase())
+    return void 0;
+  const prefix = `${instance.id}:${unit.unit}/`;
+  const owned = listed.value.runs.filter(
+    (run2) => run2.finished && run2.status === "completed" && run2.parentInstanceId === instance.id && run2.idempotencyKey?.startsWith(prefix) === true && run2.userId === instance.userId && run2.repo?.toLowerCase() === instance.repo.toLowerCase()
+  );
+  const coding = new Set(
+    owned.flatMap((run2) => {
+      if (run2.agent !== "coding" || run2.pr?.number !== prNumber) return [];
+      return [
+        ...typeof run2.headSha === "string" && FULL_SHA2.test(run2.headSha) ? [run2.headSha.toLowerCase()] : [],
+        ...(run2.pushed ?? []).flatMap(
+          (pushed) => pushed.ref === unit.branch && FULL_SHA2.test(pushed.sha) ? [pushed.sha.toLowerCase()] : []
+        )
+      ];
+    })
+  );
+  const approved = new Set(
+    owned.flatMap((run2) => {
+      const head = run2.reviewHead;
+      const post = run2.reviewPost;
+      return run2.agent === "review" && typeof head === "string" && FULL_SHA2.test(head) && run2.verdict?.verdict === "approve" && run2.verdict.head?.toLowerCase() === head.toLowerCase() && post?.posted === true && post.target.repo.toLowerCase() === instance.repo.toLowerCase() && post.target.number === prNumber && post.head.toLowerCase() === head.toLowerCase() && post.verdict === "approve" ? [head.toLowerCase()] : [];
+    })
+  );
+  const exact = [...approved].filter((head) => coding.has(head));
+  return exact.length === 1 ? exact[0] : void 0;
+}
 async function dispatch(deps, msg, io, opts = {}) {
   const ended = { status: "completed" };
   const resume = opts.resume;
@@ -56173,6 +56246,7 @@ async function dispatch(deps, msg, io, opts = {}) {
   let stoppedWhileAttaching;
   let resumeRowClosed = false;
   let restartRequest;
+  let releaseLegacyOwnership;
   const reservationHooks = {
     onStop: (mode) => void registered?.control.requestStop(mode),
     onFenced: () => {
@@ -56191,6 +56265,8 @@ async function dispatch(deps, msg, io, opts = {}) {
     let operatorRepo;
     let reissuePlanId;
     let reissueCaps;
+    let beforeCoordinatorStart;
+    let reserveLegacyOwnership;
     let operatorThread;
     let pageOwner;
     if (operatorMode !== "off") {
@@ -56408,7 +56484,19 @@ async function dispatch(deps, msg, io, opts = {}) {
           await recordPendingOperator();
           return ended;
         }
-        const expectedHead = owner.unit.lastPush;
+        let expectedHead = owner.unit.lastPush;
+        const recoverLegacyBinding = owner.unit.ending?.kind === "merge_ready" && (expectedHead === void 0 || owner.unit.publication === void 0);
+        if (recoverLegacyBinding) {
+          const recovered = await legacyReviewedHeadOf(runsService, instance, owner.unit, recordedPr.number);
+          if (recovered === void 0 || expectedHead !== void 0 && expectedHead.toLowerCase() !== recovered) {
+            await io.reply(
+              `Unit ${owner.unit.unit} has no single exact reviewed head in its durable child records, so continuation did not start. Nothing else ran.`
+            );
+            await recordPendingOperator();
+            return ended;
+          }
+          expectedHead = recovered;
+        }
         if (expectedHead === void 0) {
           await io.reply(
             `Unit ${owner.unit.unit} does not retain the pull request's durable expected head, so continuation did not start. Nothing else ran.`
@@ -56447,6 +56535,140 @@ async function dispatch(deps, msg, io, opts = {}) {
           await recordPendingOperator();
           return ended;
         }
+        if (recoverLegacyBinding) {
+          const baseRef = instance.base;
+          if (baseRef === void 0 || facts2.baseRef !== baseRef) {
+            await io.reply(
+              `${instance.repo}#${recordedPr.number} no longer has the pipeline's verifiable base ref, so continuation did not start. Nothing else ran.`
+            );
+            await recordPendingOperator();
+            return ended;
+          }
+          const existingBinding = owner.unit.publication;
+          if (existingBinding !== void 0 && (existingBinding.repo.toLowerCase() !== instance.repo.toLowerCase() || existingBinding.pr !== recordedPr.number || existingBinding.headRef !== owner.unit.branch || existingBinding.baseRef !== baseRef || existingBinding.expectedHeadSha.toLowerCase() !== expectedHead || existingBinding.publicationRef !== owner.unit.branch || existingBinding.owner.instanceId !== owner.instanceId || existingBinding.owner.unit !== owner.unit.unit)) {
+            await io.reply(
+              `Unit ${owner.unit.unit}'s durable publication binding no longer matches this pipeline, so continuation did not start. Nothing else ran.`
+            );
+            await recordPendingOperator();
+            return ended;
+          }
+          let currentOwner;
+          const runnerOwnership = deps.runnerOwnership;
+          try {
+            if (runnerOwnership === void 0) throw new Error("runner ownership is unavailable");
+            currentOwner = runnerOwnership.owner(instance.repo, recordedPr.number);
+          } catch {
+            await io.reply(
+              `Runner ownership for ${instance.repo}#${recordedPr.number} could not be verified, so continuation did not start. Nothing else ran.`
+            );
+            await recordPendingOperator();
+            return ended;
+          }
+          if (currentOwner !== void 0 && (currentOwner.instanceId !== owner.instanceId || currentOwner.unit !== owner.unit.unit)) {
+            await io.reply(
+              `${instance.repo}#${recordedPr.number} is owned by another runner, so continuation of ${owner.instanceId}:${owner.unit.unit} did not start. Nothing else ran.`
+            );
+            await recordPendingOperator();
+            return ended;
+          }
+          const legacyUnit = owner.unit;
+          const coordinatorInstances = deps.coordinatorInstances;
+          const reservationOwner = { instanceId: owner.instanceId, unit: owner.unit.unit };
+          const recoveredUnit = {
+            ...legacyUnit,
+            lastPush: expectedHead,
+            publication: {
+              repo: instance.repo,
+              pr: recordedPr.number,
+              headRef: legacyUnit.branch,
+              baseRef,
+              expectedHeadSha: expectedHead,
+              publicationRef: legacyUnit.branch,
+              owner: reservationOwner
+            }
+          };
+          let token2;
+          let transferredOwner;
+          releaseLegacyOwnership = () => {
+            if (token2 !== void 0) {
+              const released = runnerOwnership.releaseReservation(instance.repo, recordedPr.number, token2);
+              if (released) token2 = void 0;
+              return released;
+            }
+            if (transferredOwner !== void 0) {
+              const released = runnerOwnership.release(instance.repo, recordedPr.number, transferredOwner);
+              if (released) transferredOwner = void 0;
+              return released;
+            }
+            return true;
+          };
+          reserveLegacyOwnership = () => {
+            token2 = runnerOwnership.reserve(instance.repo, recordedPr.number, reservationOwner);
+            if (token2 !== void 0) return void 0;
+            const competing = runnerOwnership.owner(instance.repo, recordedPr.number);
+            const sameContinuation = competing?.instanceId === reservationOwner.instanceId && competing.unit === reservationOwner.unit;
+            return refusalOf(
+              "setup_failed",
+              sameContinuation ? `Unit ${legacyUnit.unit} changed while its legacy continuation was being reserved, so continuation did not start. Nothing else ran.` : `${instance.repo}#${recordedPr.number} is owned by another runner, so continuation of ${owner.instanceId}:${legacyUnit.unit} did not start. Nothing else ran.`
+            );
+          };
+          beforeCoordinatorStart = async () => {
+            const activeToken = token2;
+            if (activeToken === void 0)
+              return {
+                ok: false,
+                refusal: refusalOf(
+                  "setup_failed",
+                  `Unit ${legacyUnit.unit}'s ownership reservation was lost, so continuation did not start. Nothing else ran.`
+                )
+              };
+            const persisted = await coordinatorInstances.compareAndReplaceUnit(legacyUnit, recoveredUnit).catch(() => void 0);
+            if (persisted?.ok !== true) {
+              const released = releaseLegacyOwnership?.() ?? true;
+              const reason2 = persisted?.reason === "stale" ? `Unit ${legacyUnit.unit} changed while its legacy continuation was being reserved, so continuation did not start.` : `Unit ${legacyUnit.unit}'s recovered continuation binding could not be stored, so continuation did not start.`;
+              const text = released ? `${reason2} Nothing else ran.` : `${reason2} Its ownership reservation could not be released. Nothing else ran.`;
+              return { ok: false, refusal: refusalOf("setup_failed", text) };
+            }
+            const reservedOwner = runnerOwnership.owner(instance.repo, recordedPr.number);
+            if (reservedOwner?.instanceId !== reservationOwner.instanceId || reservedOwner.unit !== reservationOwner.unit) {
+              const restored = await coordinatorInstances.compareAndReplaceUnit(recoveredUnit, legacyUnit).catch(() => void 0);
+              const released = releaseLegacyOwnership?.() ?? true;
+              const rollbackFailure = restored?.ok === true ? void 0 : restored?.reason ?? "unavailable";
+              const cleanupFailure = released ? "" : " and its ownership reservation could not be released";
+              const text = rollbackFailure === void 0 ? `${instance.repo}#${recordedPr.number} changed runner ownership while its legacy continuation was being reserved${cleanupFailure}, so continuation did not start. Nothing else ran.` : `${instance.repo}#${recordedPr.number} changed runner ownership while its legacy continuation was being reserved, and the exact legacy row could not be restored (${rollbackFailure})${cleanupFailure}; continuation did not start. Nothing else ran.`;
+              return { ok: false, refusal: refusalOf("setup_failed", text) };
+            }
+            owner.unit = recoveredUnit;
+            return {
+              ok: true,
+              commit: async (nextOwner) => {
+                if (!runnerOwnership.transferReservation(
+                  instance.repo,
+                  recordedPr.number,
+                  activeToken,
+                  reservationOwner,
+                  nextOwner
+                ))
+                  throw new Error("legacy continuation ownership reservation or current owner changed");
+                token2 = void 0;
+                transferredOwner = nextOwner;
+              },
+              complete: () => {
+                transferredOwner = void 0;
+              },
+              abort: async () => {
+                const restored = await coordinatorInstances.compareAndReplaceUnit(recoveredUnit, legacyUnit).catch(() => void 0);
+                const released = releaseLegacyOwnership?.() ?? true;
+                owner.unit = legacyUnit;
+                const failures = [
+                  ...restored?.ok === true ? [] : [`legacy continuation rollback failed (${restored?.reason ?? "unavailable"})`],
+                  ...released ? [] : ["legacy continuation ownership cleanup failed"]
+                ];
+                if (failures.length > 0) throw new Error(failures.join("; "));
+              }
+            };
+          };
+        }
         reissuePlanId = instance.plan.id;
         reissueCaps = continuationBudget.caps;
         const durableRequest = parseDirectives(original);
@@ -56499,6 +56721,12 @@ async function dispatch(deps, msg, io, opts = {}) {
     });
     if (profileGate.kind === "refused") return ended;
     const { profile } = profileGate;
+    const legacyOwnershipRefusal = reserveLegacyOwnership?.();
+    if (legacyOwnershipRefusal !== void 0) {
+      await io.reply(legacyOwnershipRefusal.text);
+      await recordPendingOperator();
+      return ended;
+    }
     const earlyRepoTarget = agent.name === "review" ? resolveRepoTarget(deps, {
       msg,
       history,
@@ -56677,6 +56905,7 @@ async function dispatch(deps, msg, io, opts = {}) {
         card,
         directives,
         ...reissuePlanId !== void 0 ? { reissuePlanId } : {},
+        ...beforeCoordinatorStart !== void 0 ? { beforeCoordinatorStart } : {},
         ...reissueCaps !== void 0 ? { reissueCaps: { ...reissueCaps, maxMinutes: Math.min(reissueCaps.maxMinutes, profile.minutes) } } : {},
         sticky,
         history,
@@ -57389,6 +57618,7 @@ async function dispatch(deps, msg, io, opts = {}) {
     });
   } finally {
     clearInterval(setupHeartbeat);
+    releaseLegacyOwnership?.();
     ending.drain(void 0);
     if (registered) deps.runBearers?.revoke(registered.id);
     if (resume && ledgerRun && !runLoopStarted && !resumeRowClosed) {
@@ -57576,7 +57806,7 @@ async function dispatchClick(deps, click) {
     activeRuns--;
   }
 }
-var activeRuns;
+var activeRuns, FULL_SHA2;
 var init_dispatcher = __esm({
   "../../src/core/dispatcher.ts"() {
     "use strict";
@@ -57642,6 +57872,7 @@ var init_dispatcher = __esm({
     init_types5();
     init_decisionRecordReservation();
     activeRuns = 0;
+    FULL_SHA2 = /^[0-9a-f]{40}$/i;
   }
 });
 
@@ -71522,22 +71753,73 @@ var init_runnerOwnership = __esm({
       recovered = /* @__PURE__ */ new Set();
       claimedOwners = /* @__PURE__ */ new Map();
       recoveredOwners = /* @__PURE__ */ new Map();
+      reservations = /* @__PURE__ */ new Map();
       localRecoveredInstances = /* @__PURE__ */ new Set();
       recoveryComplete;
       constructor(requiresRecovery) {
         this.recoveryComplete = !requiresRecovery;
       }
+      /** Claim without displacing a different live runner. The read and write are
+       * synchronous, so a caller owns the process-local fence before its next
+       * awaited durable transition. Repeating the same owner's claim is idempotent. */
       claim(repo, prNumber, owner) {
         const key = runnerOwnedPullKey(repo, prNumber);
+        const current = this.claimedOwners.get(key) ?? this.recoveredOwners.get(key);
+        const alreadyOwned = this.claimed.has(key) || this.recovered.has(key);
+        if (this.reservations.has(key)) return false;
+        if (alreadyOwned && (owner === void 0 || current === void 0 || current.instanceId !== owner.instanceId || current.unit !== owner.unit))
+          return false;
         this.claimed.add(key);
         if (owner !== void 0) this.claimedOwners.set(key, owner);
+        return true;
+      }
+      /** Exclusively reserve an unowned pull request across an awaited durable
+       * transition. Even the same runner identity cannot reserve it twice: the
+       * returned token, not the owner fields, identifies the one caller. */
+      reserve(repo, prNumber, owner) {
+        const key = runnerOwnedPullKey(repo, prNumber);
+        if (this.claimed.has(key) || this.recovered.has(key) || this.reservations.has(key)) return void 0;
+        const token2 = Symbol(key);
+        this.reservations.set(key, token2);
+        this.claimed.add(key);
+        this.claimedOwners.set(key, owner);
+        return token2;
+      }
+      /** Move an exclusive recovery reservation to the durable attempt that is
+       * about to start. Both the unforgeable token and the currently recorded
+       * owner must still match; a stale caller can neither displace nor adopt a
+       * successor. The transfer consumes the reservation but retains ownership. */
+      transferReservation(repo, prNumber, token2, currentOwner, nextOwner) {
+        const key = runnerOwnedPullKey(repo, prNumber);
+        const current = this.claimedOwners.get(key);
+        if (this.reservations.get(key) !== token2 || !this.claimed.has(key) || current?.instanceId !== currentOwner.instanceId || current.unit !== currentOwner.unit)
+          return false;
+        this.reservations.delete(key);
+        this.claimedOwners.set(key, nextOwner);
+        return true;
       }
-      release(repo, prNumber) {
+      releaseReservation(repo, prNumber, token2) {
         const key = runnerOwnedPullKey(repo, prNumber);
+        if (this.reservations.get(key) !== token2) return false;
+        this.reservations.delete(key);
+        this.claimed.delete(key);
+        this.claimedOwners.delete(key);
+        return true;
+      }
+      /** Release unconditionally for the runner's ordinary end, or conditionally
+       * for a provisional claim whose cleanup must not erase a successor. */
+      release(repo, prNumber, owner) {
+        const key = runnerOwnedPullKey(repo, prNumber);
+        if (owner !== void 0) {
+          const current = this.claimedOwners.get(key) ?? this.recoveredOwners.get(key);
+          if (current?.instanceId !== owner.instanceId || current.unit !== owner.unit) return false;
+        }
+        this.reservations.delete(key);
         this.claimed.delete(key);
         this.recovered.delete(key);
         this.claimedOwners.delete(key);
         this.recoveredOwners.delete(key);
+        return true;
       }
       owns(repo, prNumber) {
         if (!this.recoveryComplete) throw new Error("runner ownership recovery is still in progress");
@@ -73090,6 +73372,68 @@ async function steerChild(body, deps) {
   const steered = await deps.steerChild?.(body.runId, text, instance) ?? false;
   return json3(200, { ok: true, outcome: steered ? "steered" : "not_live", at });
 }
+async function bindOpenPullRequest(deps, instance, row2, pr, facts2) {
+  if (row2 === void 0) return;
+  const verified = facts2.verifiedHead;
+  if (instance.base === void 0 || facts2.state !== "open" || facts2.sameRepoHead !== true || facts2.headBranchExists !== true || facts2.headRef !== row2.branch || facts2.baseRef !== instance.base || verified === void 0 || verified.repo.toLowerCase() !== instance.repo.toLowerCase() || verified.ref !== row2.branch || !/^[0-9a-f]{40}$/i.test(verified.sha) || facts2.headSha !== verified.sha || row2.pr !== void 0 && row2.pr.number !== pr.number)
+    throw new PublicationBindingRefusal("publication_facts_mismatch");
+  const owner = { instanceId: instance.id, unit: row2.unit };
+  const publication = {
+    repo: instance.repo,
+    pr: pr.number,
+    headRef: row2.branch,
+    baseRef: instance.base,
+    expectedHeadSha: verified.sha,
+    publicationRef: row2.branch,
+    owner
+  };
+  const existing = row2.publication;
+  if (existing !== void 0 && (existing.repo !== publication.repo || existing.pr !== publication.pr || existing.headRef !== publication.headRef || existing.baseRef !== publication.baseRef || existing.expectedHeadSha !== publication.expectedHeadSha || existing.publicationRef !== publication.publicationRef || !samePublicationOwner(existing.owner, owner)))
+    throw new PublicationBindingRefusal("publication_facts_mismatch");
+  const fence = deps.runnerOwnership;
+  if (fence === void 0) throw new PublicationBindingRefusal("publication_ownership_unknown");
+  let priorOwner;
+  try {
+    priorOwner = fence.owner(instance.repo, pr.number);
+  } catch {
+    throw new PublicationBindingRefusal("publication_ownership_unknown");
+  }
+  if (priorOwner !== void 0 && !samePublicationOwner(priorOwner, owner))
+    throw new PublicationBindingRefusal("publication_ownership_changed");
+  if (!fence.claim(instance.repo, pr.number, owner))
+    throw new PublicationBindingRefusal("publication_ownership_changed");
+  let claimedHere = priorOwner === void 0;
+  const releaseClaim = () => {
+    if (!claimedHere) return;
+    fence.release(instance.repo, pr.number, owner);
+    claimedHere = false;
+  };
+  try {
+    if (!samePublicationOwner(fence.owner(instance.repo, pr.number), owner)) {
+      releaseClaim();
+      throw new PublicationBindingRefusal("publication_ownership_unknown");
+    }
+  } catch (err2) {
+    releaseClaim();
+    if (err2 instanceof PublicationBindingRefusal) throw err2;
+    throw new PublicationBindingRefusal("publication_ownership_unknown");
+  }
+  const replacement = { ...row2, pr, publication };
+  if (JSON.stringify(replacement) === JSON.stringify(row2)) return;
+  let replaced;
+  try {
+    replaced = await deps.instances.compareAndReplaceUnit(row2, replacement);
+  } catch {
+    releaseClaim();
+    throw new PublicationBindingRefusal("publication_store_unavailable");
+  }
+  if (!replaced.ok) {
+    releaseClaim();
+    throw new PublicationBindingRefusal(
+      replaced.reason === "stale" ? "publication_binding_stale" : "publication_store_unavailable"
+    );
+  }
+}
 async function prCheck(body, deps) {
   const id = parseInstanceId(body.parentInstanceId);
   if (!id.ok) return json3(400, { ok: false, error: id.error });
@@ -73106,19 +73450,9 @@ async function prCheck(body, deps) {
   const unit = await unitRowOf(deps, instance, body.unit);
   if (!unit.ok) return unit.response;
   const branch2 = unit.row?.branch ?? instance.branch;
-  const remember = async (pr, facts2) => {
-    if (!unit.row) return;
-    const publication = unit.row.publication ?? (facts2?.state === "open" && facts2.sameRepoHead === true && facts2.headBranchExists === true && typeof facts2.headRef === "string" && typeof facts2.baseRef === "string" && typeof facts2.headSha === "string" && /^[0-9a-f]{40}$/i.test(facts2.headSha) ? {
-      repo: instance.repo,
-      pr: pr.number,
-      headRef: facts2.headRef,
-      baseRef: facts2.baseRef,
-      expectedHeadSha: facts2.headSha,
-      publicationRef: facts2.headRef,
-      owner: { instanceId: instance.id, unit: unit.row.unit }
-    } : void 0);
-    if (unit.row.pr?.number !== pr.number || unit.row.pr.url !== pr.url || unit.row.publication === void 0 && publication !== void 0)
-      await deps.instances.putUnits([{ ...unit.row, pr, ...publication !== void 0 ? { publication } : {} }]);
+  const rememberTerminal = async (pr) => {
+    if (!unit.row || unit.row.pr?.number === pr.number && unit.row.pr.url === pr.url) return;
+    await deps.instances.putUnits([{ ...unit.row, pr }]);
   };
   try {
     if (follow !== void 0) {
@@ -73127,12 +73461,12 @@ async function prCheck(body, deps) {
       const fallbackUrl = unit.row?.pr?.url ?? `https://github.com/${instance.repo}/pull/${follow}`;
       const state2 = pullRequestState(follow, fallbackUrl, facts2);
       if (state2 === void 0) throw new Error(headBranchStateError(instance.repo, follow));
-      await remember({ number: follow, url: String(state2.url) }, facts2);
-      if (state2.state !== "open") return json3(200, { ok: true, ...state2, at });
-      deps.runnerOwnership?.claim(instance.repo, follow, {
-        instanceId: instance.id,
-        unit: unit.row?.unit ?? body.unit
-      });
+      const followedPr = { number: follow, url: String(state2.url) };
+      if (state2.state !== "open") {
+        await rememberTerminal(followedPr);
+        return json3(200, { ok: true, ...state2, at });
+      }
+      await bindOpenPullRequest(deps, instance, unit.row, followedPr, facts2);
       const prRef = { repo: instance.repo, number: follow };
       const headSha = facts2.headSha;
       const approved = entry && headSha !== void 0 ? await reviewPostedAt(deps, prRef, "approve", headSha) : void 0;
@@ -73163,16 +73497,16 @@ async function prCheck(body, deps) {
     }
     const open2 = await deps.findOpenPrByHead(instance.repo, branch2);
     if (open2) {
-      deps.runnerOwnership?.claim(instance.repo, open2.number, {
-        instanceId: instance.id,
-        unit: unit.row?.unit ?? body.unit
-      });
       const liveFacts = await deps.fetchPrFacts({ repo: instance.repo, number: open2.number });
       if (liveFacts === void 0) throw new Error(`could not read ${instance.repo}#${open2.number}`);
-      await remember({ number: open2.number, url: open2.htmlUrl }, liveFacts);
       const current = pullRequestState(open2.number, open2.htmlUrl, liveFacts);
       if (current === void 0) throw new Error(headBranchStateError(instance.repo, open2.number));
-      if (current.state !== "open") return json3(200, { ok: true, ...current, at });
+      const discoveredPr = { number: open2.number, url: open2.htmlUrl };
+      if (current.state !== "open") {
+        await rememberTerminal(discoveredPr);
+        return json3(200, { ok: true, ...current, at });
+      }
+      await bindOpenPullRequest(deps, instance, unit.row, discoveredPr, liveFacts);
       const entryFacts = entry ? liveFacts : void 0;
       const branchHead = entryFacts?.headSha;
       const entryHead = branchHead ?? open2.headSha;
@@ -73223,22 +73557,27 @@ async function prCheck(body, deps) {
       }
       const recovered = await recoverPushedBranch(deps, instance, unit.row, branch2, recover.runId);
       if (recovered.kind === "opened") {
-        await remember({ number: recovered.pr.number, url: recovered.pr.htmlUrl });
         const recoveredFacts = await deps.fetchPrFacts({ repo: instance.repo, number: recovered.pr.number });
         if (recoveredFacts === void 0) throw new Error(`could not read ${instance.repo}#${recovered.pr.number}`);
         const recoveredState = pullRequestState(recovered.pr.number, recovered.pr.htmlUrl, recoveredFacts);
         if (recoveredState === void 0) throw new Error(headBranchStateError(instance.repo, recovered.pr.number));
+        const recoveredPr = { number: recovered.pr.number, url: recovered.pr.htmlUrl };
+        if (recoveredState.state === "open")
+          await bindOpenPullRequest(deps, instance, unit.row, recoveredPr, recoveredFacts);
+        else await rememberTerminal(recoveredPr);
         return json3(200, { ok: true, ...recoveredState, at });
       }
       return json3(200, { ok: true, state: "none", unrecovered: recovered.why, at });
     }
-    await remember({ number: merged.number, url: merged.htmlUrl });
     const mergedFacts = await deps.fetchPrFacts({ repo: instance.repo, number: merged.number });
     if (mergedFacts === void 0) throw new Error(`could not read ${instance.repo}#${merged.number}`);
     const state = pullRequestState(merged.number, merged.htmlUrl, mergedFacts);
     if (state?.state !== "merged") throw new Error(`${instance.repo}#${merged.number} no longer reads merged`);
+    await rememberTerminal({ number: merged.number, url: merged.htmlUrl });
     return json3(200, { ok: true, ...state, at });
   } catch (err2) {
+    if (err2 instanceof PublicationBindingRefusal)
+      return json3(409, { ok: false, error: err2.reason, message: "the open pull request was not durably bound", at });
     return json3(502, { ok: false, error: "github_unavailable", message: describe12(err2), at });
   }
 }
@@ -74461,7 +74800,7 @@ function createAdminCoordinatorHandler(deps) {
     })();
   };
 }
-var COORDINATOR_ADMIN_PREFIX, MAX_SPAWN_PROMPT_CHARS, FINISHED_LOOKBACK_PAGES, MAX_ADMIN_BODY_BYTES, UNIT_ID, PRESETS_OF_KIND, invalid, json3, describe12, isGenerated2, EVERY_RUN, REVIEW_POSTED_CHECKS, REVIEW_POSTED_RECHECK_MS, githubSecondStart, CHILD_SUPERSESSION_REASONS, ROUND_OUTCOMES, ENDING_ICON, STEPS;
+var COORDINATOR_ADMIN_PREFIX, MAX_SPAWN_PROMPT_CHARS, FINISHED_LOOKBACK_PAGES, MAX_ADMIN_BODY_BYTES, UNIT_ID, PRESETS_OF_KIND, invalid, json3, describe12, isGenerated2, EVERY_RUN, REVIEW_POSTED_CHECKS, REVIEW_POSTED_RECHECK_MS, githubSecondStart, CHILD_SUPERSESSION_REASONS, PublicationBindingRefusal, samePublicationOwner, ROUND_OUTCOMES, ENDING_ICON, STEPS;
 var init_adminCoordinator = __esm({
   "../../src/channels/adminCoordinator.ts"() {
     "use strict";
@@ -74517,6 +74856,14 @@ var init_adminCoordinator = __esm({
     REVIEW_POSTED_RECHECK_MS = 2e3;
     githubSecondStart = (at) => Math.floor(at / SECOND_MS) * SECOND_MS;
     CHILD_SUPERSESSION_REASONS = /* @__PURE__ */ new Set(["merged", "closed", "head_moved", "branch_deleted"]);
+    PublicationBindingRefusal = class extends Error {
+      constructor(reason2) {
+        super(reason2);
+        this.reason = reason2;
+      }
+      reason;
+    };
+    samePublicationOwner = (left, right) => left?.instanceId === right.instanceId && left.unit === right.unit;
     ROUND_OUTCOMES = [
       "started",
       "pr_opened",
@@ -75544,6 +75891,7 @@ async function runBot() {
   ) : new NullMetricsService();
   const sweepState = { roundSpent: /* @__PURE__ */ new Set() };
   const runnerOwnership = new RunnerOwnershipFence(capabilities.runLedger);
+  deps.runnerOwnership = runnerOwnership;
   const pullsWiring = /* @__PURE__ */ (() => {
     const state = sweepState;
     const chains = /* @__PURE__ */ new Map();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreplane/switchboard",
-  "version": "1.261.2",
+  "version": "1.261.4",
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
   "homepage": "https://openswitchboard.dev",