@coreplane/switchboard 1.261.3 → 1.262.0

package/dist/cli.js

@@ -3967,7 +3967,7 @@ function matchDispositions(findings, dispositions) {
   const dropped = [...new Set(dispositions.filter((d) => !issued.has(d.findingId)).map((d) => d.findingId))];
   return { matched, dropped };
 }
-var MIN, PLAN_ID_PATTERN, PLAN_BRANCH, UNIT_REF, SLUG_MAX, INSTANCE_ID_MAX, WAIT_MARGIN_MS, WAIT_CHUNK_MS, MERGE_WAIT_CHUNK_MS, BUSY_RETRY_MS;
+var MIN, PLAN_ID_PATTERN, PLAN_BRANCH, UNIT_REF, SLUG_MAX, INSTANCE_ID_MAX, WAIT_MARGIN_MS, WAIT_CHUNK_MS, MERGE_WAIT_CHUNK_MS, BUSY_RETRY_MS, stepPrefixOf;
 var init_coordinator = __esm({
   "../../src/core/ship/coordinator.ts"() {
     "use strict";
@@ -3987,6 +3987,10 @@ var init_coordinator = __esm({
     WAIT_CHUNK_MS = SHIP_WAIT.chunkMinutes * MIN;
     MERGE_WAIT_CHUNK_MS = SHIP_WAIT.mergeChunkMinutes * MIN;
     BUSY_RETRY_MS = SHIP_WAIT.busyRetryMinutes * MIN;
+    stepPrefixOf = (unit, session) => {
+      const segment = session !== void 0 && session.segment > 1 ? `${unit}/s${session.segment}` : unit;
+      return session?.resume !== void 0 ? `${segment}/r${session.resume.attempt}` : segment;
+    };
   }
 });
 
@@ -5804,6 +5808,13 @@ function isCoordinatorUnit(v) {
     (x) => isObject(x) && isFinite(x.index) && isText(x.agent) && isText(x.outcome) && isFinite(x.at) && (x.gate === void 0 || isRoundGate(x.gate))
   ))
     return false;
+  if (r.recovery !== void 0 && !(isObject(r.recovery) && (r.recovery.kind === "findings" || r.recovery.kind === "review") && typeof r.recovery.round === "number" && Number.isInteger(r.recovery.round) && r.recovery.round >= 1 && typeof r.recovery.expectedHeadSha === "string" && /^[0-9a-f]{40}$/i.test(r.recovery.expectedHeadSha) && isFinite(r.recovery.remainingMs) && r.recovery.remainingMs > 0 && isFinite(r.recovery.claimedAt) && typeof r.recovery.step === "string" && STEP_NAME_PATTERN.test(r.recovery.step) && isText(r.recovery.reviewRunId) && (r.recovery.findingsRunId === void 0 || isText(r.recovery.findingsRunId)) && (r.recovery.findingsKey === void 0 || isText(r.recovery.findingsKey)) && (r.recovery.findingsRunId === void 0 && r.recovery.findingsKey === void 0 || r.recovery.kind === "review" && r.recovery.findingsRunId !== void 0 && r.recovery.findingsKey !== void 0) && (r.recovery.findings === void 0 || Array.isArray(r.recovery.findings) && r.recovery.findings.every(isFindingShape)) && isObject(r.recovery.previousEnding) && isText(r.recovery.previousEnding.kind) && typeof r.recovery.previousEnding.report === "string" && isFinite(r.recovery.previousEnding.at) && typeof r.recovery.workflowId === "string" && INSTANCE_ID_PATTERN.test(r.recovery.workflowId) && isFinite(r.recovery.deadlineAt) && isText(r.recovery.reviewKey)))
+    return false;
+  if (r.recoveryReceipt !== void 0 && (!isObject(r.recoveryReceipt) || !isText(r.recoveryReceipt.reviewRunId) || typeof r.recoveryReceipt.workflowId !== "string" || !INSTANCE_ID_PATTERN.test(r.recoveryReceipt.workflowId) || !isFinite(r.recoveryReceipt.at)))
+    return false;
+  if (r.recoveryHold !== void 0 && (!isObject(r.recoveryHold) || !(r.recoveryHold.cause === "human" && isHumanGatePending(r.recoveryHold.gate) || r.recoveryHold.cause === "draft" && isObject(r.recoveryHold.pr) && Number.isInteger(r.recoveryHold.pr.number) && r.recoveryHold.pr.number > 0 && isText(r.recoveryHold.pr.url))))
+    return false;
+  if (r.recovery !== void 0 && (r.idle !== void 0 || r.ending !== void 0)) return false;
   if (r.ending !== void 0 && !(isObject(r.ending) && isText(r.ending.kind) && isText(r.ending.report, MAX_REPORT) && isFinite(r.ending.at) && (r.ending.cause === void 0 || isText(r.ending.cause, 64)) && (r.ending.step === void 0 || typeof r.ending.step === "string" && STEP_NAME_PATTERN.test(r.ending.step)) && (r.ending.round === void 0 || typeof r.ending.round === "number" && Number.isInteger(r.ending.round) && r.ending.round >= 0)))
     return false;
   if (r.startedAt !== void 0 && !isFinite(r.startedAt)) return false;
@@ -5850,7 +5861,7 @@ async function sendChildSignal(workflow, signal2) {
   if (!workflow) return { kind: "no-binding", instance };
   const type = kind === "interrupted" ? childInterruptedEventType(runId3) : childResumedEventType(runId3);
   try {
-    const handle2 = await workflow.get(instance);
+    const handle2 = await workflow.get(signal2.transportWorkflowId ?? instance);
     await handle2.sendEvent({ type, payload: { runId: runId3, kind, reason: reason2, at, parentInstanceId: instance } });
     return { kind: "sent", instance, type };
   } catch (err2) {
@@ -15534,6 +15545,7 @@ var init_refusal = __esm({
       // one pipeline per thread (record 0060): the host key's claim answered thread-live
       ship_thread_live: "request",
       setup_failed: "system",
+      publication_ownership_unknown: "system",
       // the click on a confirmation (confirm.ts)
       confirmation_used: "request",
       confirmation_expired: "request",
@@ -34687,12 +34699,15 @@ var init_instanceStore = __esm({
       async putUnits(_units) {
         return { ok: false, reason: "unavailable" };
       }
-      async claimLegacyContinuation(_expected, _recovered) {
+      async compareAndReplaceUnit(_expected, _replacement) {
         return { ok: false, reason: "unavailable" };
       }
       async listUnits(_instanceId) {
         return [];
       }
+      async listActiveRecoveries() {
+        return [];
+      }
       async reserveDecisionRecord(_repo, _taskKey, _claimed, _existing) {
         return { ok: false, reason: "unavailable" };
       }
@@ -34764,8 +34779,11 @@ var init_instanceStore = __esm({
         if (d.ok === true) return { ok: true };
         throw new Error(`coordinator store /runs/coordinator/units/put: unexpected answer (HTTP ${r.status})`);
       }
-      async claimLegacyContinuation(expected, recovered) {
-        const r = await this.post("/runs/coordinator/units/claim-legacy-continuation", { expected, recovered });
+      async compareAndReplaceUnit(expected, replacement) {
+        const r = await this.post("/runs/coordinator/units/claim-legacy-continuation", {
+          expected,
+          recovered: replacement
+        });
         const d = r.data;
         if (r.status === 409 && d.reason === "stale") return { ok: false, reason: "stale" };
         if (d.ok === true) return { ok: true };
@@ -34780,6 +34798,15 @@ var init_instanceStore = __esm({
           throw new Error("coordinator store /runs/coordinator/units/list: the answer is not a list of unit rows");
         return d.units;
       }
+      async listActiveRecoveries() {
+        const r = await this.post("/runs/coordinator/units/list-active-recoveries", {});
+        const d = r.data;
+        if (!Array.isArray(d.units) || !d.units.every(isCoordinatorUnit) || d.units.some((unit) => unit.recovery === void 0))
+          throw new Error(
+            "coordinator store /runs/coordinator/units/list-active-recoveries: the answer is not a recovery list"
+          );
+        return d.units;
+      }
       async reserveDecisionRecord(repo, taskKey, claimed2, existing) {
         const r = await this.post("/runs/decision-record/reserve", {
           repo,
@@ -46181,6 +46208,8 @@ async function claimRun(deps, ctx) {
       type: "coordinator_tag",
       parentInstanceId: coordinator.parentInstanceId,
       ...unit !== void 0 ? { unit } : {},
+      ...coordinator.transportWorkflowId !== void 0 ? { transportWorkflowId: coordinator.transportWorkflowId } : {},
+      ...coordinator.recovery !== void 0 ? { recovery: coordinator.recovery } : {},
       ...coordinator.base !== void 0 ? { base: coordinator.base } : {},
       ...coordinator.publication !== void 0 ? { publication: coordinator.publication } : {},
       at: clock4()
@@ -54981,7 +55010,7 @@ function shimAddress(opts) {
     };
   return { base, bearer };
 }
-async function createInstanceViaShim(opts, id) {
+async function createInstanceViaShim(opts, id, params = {}) {
   const at = shimAddress(opts);
   if ("reason" in at) return { kind: "unanswered", reason: at.reason };
   const fetchImpl = opts.fetch ?? fetch;
@@ -54989,7 +55018,7 @@ async function createInstanceViaShim(opts, id) {
     const res = await fetchImpl(`${at.base}${COORDINATOR_INSTANCES_PATH}`, {
       method: "POST",
       headers: { authorization: `Bearer ${at.bearer}`, "content-type": "application/json" },
-      body: JSON.stringify({ id, params: {} }),
+      body: JSON.stringify({ id, params }),
       signal: AbortSignal.timeout(opts.timeoutMs ?? DEFAULT_TIMEOUT_MS)
     });
     return readCreateInstanceAnswer(res.status, await res.text().catch(() => ""));
@@ -55049,11 +55078,51 @@ var init_instancesClient = __esm({
 });
 
 // ../../src/core/dispatch/ship.ts
+function parseOriginalUnitRecoveryRequest(text) {
+  const match = /^recover\s+unit\s+(\S+)\s*$/i.exec(text.trim());
+  return match ? parseUnitKey(match[1]) : void 0;
+}
 async function runShipBranch(deps, msg, io, ctx) {
   const { agent, profile, card, directives, history, repoCtx, label, ending, trace, closeLines, refuse: refuse3, doneLines } = ctx;
   const root = trace.root;
   const clock4 = deps.clock ?? systemClock;
   const shell = createCardShell({ label, startedAt: ctx.startedAt, now: clock4 });
+  const recovery = parseOriginalUnitRecoveryRequest(directives.text);
+  if (recovery === void 0 && namesOriginalUnitRecovery(directives.text)) {
+    const reason2 = "original-unit recovery must be `recover unit <instanceId>:<unit>`";
+    await refuse3(
+      refusalOf("setup_failed", reason2),
+      () => card.done(shell.close({ kind: "refused", icon: "\u{1F6AB}", reason: reason2, ...closeLines(clock4(), false) }))
+    );
+    return { hostedLive: false };
+  }
+  if (recovery !== void 0) {
+    const answer = await root.span(
+      "dispatch.ship_recover_original_unit",
+      () => deps.recoverOriginalUnit === void 0 ? Promise.resolve({ status: 503, body: { error: "original-unit recovery is unavailable" } }) : deps.recoverOriginalUnit(recovery, { userId: msg.userId, threadKey: msg.threadKey })
+    );
+    if (answer.status !== 200) {
+      const reason2 = typeof answer.body.error === "string" ? answer.body.error : "original-unit recovery was refused";
+      await refuse3(
+        refusalOf("setup_failed", reason2),
+        () => card.done(shell.close({ kind: "refused", icon: "\u{1F6AB}", reason: reason2, ...closeLines(clock4(), false) }))
+      );
+      return { hostedLive: false };
+    }
+    const workflowId = typeof answer.body.workflowId === "string" ? answer.body.workflowId : "unknown";
+    const outcome2 = answer.body.outcome === "already_started" ? "already running" : answer.body.outcome === "indeterminate" ? "has an indeterminate start; its claim remains held for same-checkpoint replay" : "started";
+    const text = `Original unit \`${recovery.instanceId}:${recovery.unit}\` recovery ${outcome2} as durable checkpoint \`${workflowId}\`.`;
+    await replyAck(io, ctx.verbosity, text);
+    await card.done(
+      shell.close({
+        kind: "done",
+        icon: answer.body.outcome === "indeterminate" ? "\u26A0\uFE0F" : "\u2705",
+        detail: text,
+        ...closeLines(clock4(), true)
+      })
+    );
+    return { hostedLive: false };
+  }
   const listSlugs = deps.residentSlugs ?? residentSlugsLister(deps.config.config.execution?.resident);
   const repoCandidates = repoCtx.repo ? void 0 : await listSlugs?.().catch(() => void 0);
   const pre = await root.span(
@@ -55462,6 +55531,7 @@ function handOffAck(outcome, verbosity2) {
   return outcome.instanceId !== void 0 && shows(verbosity2, "debug") ? `${outcome.reply}
 \u2022 runner instance \`${outcome.instanceId}\`` : outcome.reply;
 }
+var namesOriginalUnitRecovery;
 var init_ship = __esm({
   "../../src/core/dispatch/ship.ts"() {
     "use strict";
@@ -55474,6 +55544,7 @@ var init_ship = __esm({
     init_budgets();
     init_instancesClient();
     init_instanceStore();
+    init_contract2();
     init_shipPipeline();
     init_preflight();
     init_runEvents();
@@ -55492,6 +55563,7 @@ var init_ship = __esm({
     init_reply();
     init_verbosity();
     init_reply();
+    namesOriginalUnitRecovery = (text) => /^recover\s+unit(?:\s|$)/i.test(text.trim());
   }
 });
 
@@ -55589,9 +55661,13 @@ function carriedCoordinatorTag(row2, events) {
   const tag = events.find((e) => e.type === "coordinator_tag");
   const base = tag?.type === "coordinator_tag" ? tag.base : void 0;
   const publication = tag?.type === "coordinator_tag" ? tag.publication : void 0;
+  const transportWorkflowId = tag?.type === "coordinator_tag" ? tag.transportWorkflowId : void 0;
+  const recovery = tag?.type === "coordinator_tag" ? tag.recovery : void 0;
   return {
     parentInstanceId,
     idempotencyKey,
+    ...transportWorkflowId !== void 0 ? { transportWorkflowId } : {},
+    ...recovery !== void 0 ? { recovery } : {},
     ...base !== void 0 ? { base } : {},
     ...publication !== void 0 ? { publication } : {}
   };
@@ -55614,6 +55690,7 @@ async function announceChildRoll(ctx) {
   const sent = await sendChildSignal(workflow, {
     runId: runId3,
     parentInstanceId: coordinator.parentInstanceId,
+    ...coordinator.transportWorkflowId !== void 0 ? { transportWorkflowId: coordinator.transportWorkflowId } : {},
     kind,
     reason: reason2,
     at
@@ -55686,6 +55763,7 @@ async function recordRestartDeath(ctx) {
     const sent = await sendChildSignal(workflow, {
       runId: closed.id,
       parentInstanceId: coordinator.parentInstanceId,
+      ...coordinator.transportWorkflowId !== void 0 ? { transportWorkflowId: coordinator.transportWorkflowId } : {},
       kind: "interrupted",
       reason: summary,
       at
@@ -56067,14 +56145,49 @@ async function answerUnitOwnedThread(deps, ctx) {
   if (!appended.ok) return "route-fresh";
   try {
     if (deps.workflow === void 0) throw new Error("no workflow sender in this process");
-    const handle2 = await deps.workflow.get(owner.instanceId);
+    const workflowId = owner.unit.recovery?.workflowId ?? owner.instanceId;
+    const handle2 = await deps.workflow.get(workflowId);
     await handle2.sendEvent({ type: unitNudgeEventType(key), payload: {} });
   } catch (err2) {
     const readStatus = deps.fetchCoordinatorInstanceStatus ?? ((id) => fetchInstanceStatusViaShim(processShimOptions(), id));
-    const status3 = await readStatus(owner.instanceId);
+    const workflowId = owner.unit.recovery?.workflowId ?? owner.instanceId;
+    const status3 = await readStatus(workflowId);
     const gone = status3.kind === "absent" || status3.kind === "status" && ["complete", "errored", "terminated"].includes(status3.status);
     if (gone) {
       const why = status3.kind === "absent" ? "no such instance" : status3.status;
+      if (owner.unit.recovery !== void 0) {
+        const recovery = owner.unit.recovery;
+        const recoveryInstance = await store.get(owner.instanceId).catch(() => null);
+        const { recovery: _recovery, ...withoutRecovery } = owner.unit;
+        const closed = {
+          ...withoutRecovery,
+          recoveryReceipt: { reviewRunId: recovery.reviewRunId, workflowId: recovery.workflowId, at },
+          ending: {
+            kind: "terminated",
+            report: `the original-unit recovery checkpoint is gone (${why}); no replacement pipeline was started`,
+            at
+          }
+        };
+        const replaced = await store.compareAndReplaceUnit(owner.unit, closed).catch(() => void 0);
+        if (replaced?.ok !== true) {
+          await replyAck(
+            io,
+            ctx.verbosity,
+            `\u{1F4CC} Noted for unit ${owner.unit.unit} (\`${unitKey}\`): its recovery checkpoint is gone, but the durable claim could not be closed safely \u2014 your message remains queued and no replacement ran.`
+          );
+          return "acked";
+        }
+        if (recoveryInstance !== null && owner.unit.pr !== void 0)
+          deps.runnerOwnership?.release(recoveryInstance.repo, owner.unit.pr.number, {
+            instanceId: owner.instanceId,
+            unit: owner.unit.unit
+          });
+        await store.markConsumed(key, [appended.seq], `recovery-terminal:${recovery.workflowId}`).catch(() => void 0);
+        await io.reply(
+          `\u26A0\uFE0F Unit ${owner.unit.unit}'s original-unit recovery checkpoint \`${recovery.workflowId}\` is gone (${why}). The claim is closed; this message did not start replacement work.`
+        );
+        return "acked";
+      }
       await store.putUnits([
         {
           ...owner.unit,
@@ -56132,16 +56245,22 @@ function continuationBudgetOf(instance, unit) {
 }
 async function legacyReviewedHeadOf(runs, instance, unit, prNumber) {
   const listed = await runs.listUnitRuns(unitKeyOf({ instanceId: instance.id, unit: unit.unit }), { kind: "all" }).catch(() => void 0);
-  if (listed === void 0 || !listed.ok || listed.value.unit !== unitKeyOf({ instanceId: instance.id, unit: unit.unit }) || listed.value.instanceId !== instance.id || listed.value.id !== unit.unit || listed.value.instance.id !== instance.id || listed.value.instance.repo.toLowerCase() !== instance.repo.toLowerCase())
+  if (listed === void 0 || !listed.ok || listed.value.unit !== unitKeyOf({ instanceId: instance.id, unit: unit.unit }) || listed.value.instanceId !== instance.id || listed.value.id !== unit.unit || listed.value.branch !== unit.branch || listed.value.pr?.number !== prNumber || listed.value.instance.id !== instance.id || listed.value.instance.repo.toLowerCase() !== instance.repo.toLowerCase())
     return void 0;
   const prefix = `${instance.id}:${unit.unit}/`;
   const owned = listed.value.runs.filter(
     (run2) => run2.finished && run2.status === "completed" && run2.parentInstanceId === instance.id && run2.idempotencyKey?.startsWith(prefix) === true && run2.userId === instance.userId && run2.repo?.toLowerCase() === instance.repo.toLowerCase()
   );
   const coding = new Set(
-    owned.flatMap(
-      (run2) => run2.agent === "coding" && run2.pr?.number === prNumber && typeof run2.headSha === "string" && FULL_SHA2.test(run2.headSha) ? [run2.headSha.toLowerCase()] : []
-    )
+    owned.flatMap((run2) => {
+      if (run2.agent !== "coding" || run2.pr?.number !== prNumber) return [];
+      return [
+        ...typeof run2.headSha === "string" && FULL_SHA2.test(run2.headSha) ? [run2.headSha.toLowerCase()] : [],
+        ...(run2.pushed ?? []).flatMap(
+          (pushed) => pushed.ref === unit.branch && FULL_SHA2.test(pushed.sha) ? [pushed.sha.toLowerCase()] : []
+        )
+      ];
+    })
   );
   const approved = new Set(
     owned.flatMap((run2) => {
@@ -56157,6 +56276,8 @@ async function dispatch(deps, msg, io, opts = {}) {
   const ended = { status: "completed" };
   const resume = opts.resume;
   const restart = opts.restart;
+  const coordinator = opts.coordinator ?? (resume ? carriedCoordinatorTag(resume.row, resume.events) : void 0);
+  const recovery = opts.recovery ?? coordinator?.recovery;
   const clock4 = deps.clock ?? systemClock;
   const trace = opts.trace ?? startRequestRoot(deps, {
     channel: channelOf(msg.channelId),
@@ -56413,6 +56534,13 @@ async function dispatch(deps, msg, io, opts = {}) {
         return ended;
       }
       if (owner.kind === "pipeline" && directives.agent === void 0) {
+        if (owner.unit.recoveryReceipt !== void 0 || owner.unit.recoveryHold !== void 0) {
+          await io.reply(
+            `The original-unit recovery for \`${owner.instanceId}:${owner.unit.unit}\` is terminal and its evidence is consumed. This reply was not turned into replacement work.`
+          );
+          await recordPendingOperator();
+          return ended;
+        }
         const instance = await deps.coordinatorInstances.get(owner.instanceId).catch(() => null);
         if (instance === null) {
           await io.reply(
@@ -56594,7 +56722,14 @@ async function dispatch(deps, msg, io, opts = {}) {
             return true;
           };
           reserveLegacyOwnership = () => {
-            token2 = runnerOwnership.reserve(instance.repo, recordedPr.number, reservationOwner);
+            try {
+              token2 = runnerOwnership.reserve(instance.repo, recordedPr.number, reservationOwner);
+            } catch {
+              return refusalOf(
+                "publication_ownership_unknown",
+                `Runner ownership for ${instance.repo}#${recordedPr.number} is being rebuilt, so continuation did not start. Nothing else ran.`
+              );
+            }
             if (token2 !== void 0) return void 0;
             const competing = runnerOwnership.owner(instance.repo, recordedPr.number);
             const sameContinuation = competing?.instanceId === reservationOwner.instanceId && competing.unit === reservationOwner.unit;
@@ -56613,7 +56748,7 @@ async function dispatch(deps, msg, io, opts = {}) {
                   `Unit ${legacyUnit.unit}'s ownership reservation was lost, so continuation did not start. Nothing else ran.`
                 )
               };
-            const persisted = await coordinatorInstances.claimLegacyContinuation(legacyUnit, recoveredUnit).catch(() => void 0);
+            const persisted = await coordinatorInstances.compareAndReplaceUnit(legacyUnit, recoveredUnit).catch(() => void 0);
             if (persisted?.ok !== true) {
               const released = releaseLegacyOwnership?.() ?? true;
               const reason2 = persisted?.reason === "stale" ? `Unit ${legacyUnit.unit} changed while its legacy continuation was being reserved, so continuation did not start.` : `Unit ${legacyUnit.unit}'s recovered continuation binding could not be stored, so continuation did not start.`;
@@ -56622,7 +56757,7 @@ async function dispatch(deps, msg, io, opts = {}) {
             }
             const reservedOwner = runnerOwnership.owner(instance.repo, recordedPr.number);
             if (reservedOwner?.instanceId !== reservationOwner.instanceId || reservedOwner.unit !== reservationOwner.unit) {
-              const restored = await coordinatorInstances.claimLegacyContinuation(recoveredUnit, legacyUnit).catch(() => void 0);
+              const restored = await coordinatorInstances.compareAndReplaceUnit(recoveredUnit, legacyUnit).catch(() => void 0);
               const released = releaseLegacyOwnership?.() ?? true;
               const rollbackFailure = restored?.ok === true ? void 0 : restored?.reason ?? "unavailable";
               const cleanupFailure = released ? "" : " and its ownership reservation could not be released";
@@ -56648,7 +56783,7 @@ async function dispatch(deps, msg, io, opts = {}) {
                 transferredOwner = void 0;
               },
               abort: async () => {
-                const restored = await coordinatorInstances.claimLegacyContinuation(recoveredUnit, legacyUnit).catch(() => void 0);
+                const restored = await coordinatorInstances.compareAndReplaceUnit(recoveredUnit, legacyUnit).catch(() => void 0);
                 const released = releaseLegacyOwnership?.() ?? true;
                 owner.unit = legacyUnit;
                 const failures = [
@@ -56697,6 +56832,8 @@ async function dispatch(deps, msg, io, opts = {}) {
     if ((await authorizeAgent(deps, { msg, io, refuse: refuse3, agentName: resolved.agentName })).kind === "refused")
       return ended;
     const agent = resolved.agentName === "ship" ? shipPresetFor(deps.config.config.ship) : getAgent(resolved.agentName);
+    const recoveryRemainingMs = recovery === void 0 ? void 0 : Math.max(0, recovery.deadlineAt - clock4());
+    const inheritedRemainingMs = parent?.remainingMs === void 0 ? recoveryRemainingMs : recoveryRemainingMs === void 0 ? parent.remainingMs : Math.min(parent.remainingMs, recoveryRemainingMs);
     const profileGate = await authorizeProfile(deps, {
       msg,
       io,
@@ -56707,14 +56844,14 @@ async function dispatch(deps, msg, io, opts = {}) {
         resolved,
         resume,
         budget: directives.budget,
-        ...parent?.remainingMs !== void 0 ? { parentRemainingMs: parent.remainingMs } : {}
+        ...inheritedRemainingMs !== void 0 ? { parentRemainingMs: inheritedRemainingMs } : {}
       })
     });
     if (profileGate.kind === "refused") return ended;
-    const { profile } = profileGate;
+    let { profile } = profileGate;
     const legacyOwnershipRefusal = reserveLegacyOwnership?.();
     if (legacyOwnershipRefusal !== void 0) {
-      await io.reply(legacyOwnershipRefusal.text);
+      await refuse3(legacyOwnershipRefusal);
       await recordPendingOperator();
       return ended;
     }
@@ -56827,6 +56964,26 @@ async function dispatch(deps, msg, io, opts = {}) {
     if (references.refused.length > 0)
       await renderRefusal(refusalOf(referenceRefusalCode(references.refused[0]), REFERENCE_REFUSAL), io);
     let repoCtx = await repoCtxP;
+    if (recovery !== void 0 && (agent.name === "review" || agent.name === "coding") && (repoCtx.repo?.toLowerCase() !== recovery.repo.toLowerCase() || repoCtx.pr !== recovery.pr || repoCtx.ref !== recovery.headRef || repoCtx.baseRef !== recovery.baseRef || repoCtx.headSha !== recovery.expectedHeadSha)) {
+      const reason2 = "the recovered pull request moved or no longer matches its durable target";
+      await refuse3(
+        refusalOf("setup_failed", reason2),
+        () => card.done(shell.close({ kind: "refused", icon: "\u{1F6AB}", reason: reason2, ...closeLines(clock4(), false) }))
+      );
+      return ended;
+    }
+    if (recovery !== void 0) {
+      const remainingMinutes = Math.floor((recovery.deadlineAt - clock4()) / 6e4);
+      if (remainingMinutes <= 0) {
+        const reason2 = "the original unit's absolute recovery deadline expired during setup";
+        await refuse3(
+          refusalOf("setup_failed", reason2),
+          () => card.done(shell.close({ kind: "refused", icon: "\u{1F6AB}", reason: reason2, ...closeLines(clock4(), false) }))
+        );
+        return ended;
+      }
+      profile = { ...profile, minutes: Math.min(profile.minutes, remainingMinutes) };
+    }
     const contractBranch = opts.contract?.rebase.branch;
     if (opts.coordinator !== void 0 && contractBranch !== void 0 && agent.name !== "review" && repoCtx.refFromPr === true && repoCtx.ref !== contractBranch) {
       const { refFromPr: _refFromPr, headSha: _headSha, ...kept2 } = repoCtx;
@@ -56959,7 +57116,6 @@ async function dispatch(deps, msg, io, opts = {}) {
     });
     if (headPreflight.kind === "refused") return ended;
     const parentRunId = parent?.runId;
-    const coordinator = opts.coordinator ?? (resume ? carriedCoordinatorTag(resume.row, resume.events) : void 0);
     const registration = await registerRun(deps, {
       msg,
       io,
@@ -57323,6 +57479,14 @@ async function dispatch(deps, msg, io, opts = {}) {
     });
     if (headGate.kind === "refused") return ended;
     repoCtx = headGate.repoCtx;
+    if (recovery !== void 0 && (agent.name === "review" || agent.name === "coding") && (repoCtx.repo?.toLowerCase() !== recovery.repo.toLowerCase() || repoCtx.pr !== recovery.pr || repoCtx.ref !== recovery.headRef || repoCtx.baseRef !== recovery.baseRef || repoCtx.headSha !== recovery.expectedHeadSha)) {
+      const reason2 = "the recovered pull request moved during setup and no longer matches its durable target";
+      await refuse3(
+        refusalOf("setup_failed", reason2),
+        () => card.done(shell.close({ kind: "refused", icon: "\u{1F6AB}", reason: reason2, ...closeLines(clock4(), false) }))
+      );
+      return ended;
+    }
     const verifiedAtAttach = headGate.verifiedAtAttach;
     if (headGate.headAdopted) publishMeta(repoCtx);
     const bound = round2.selection.binding;
@@ -57669,6 +57833,51 @@ async function dispatch(deps, msg, io, opts = {}) {
           ...restartRequest.coordinator !== void 0 ? { coordinator: restartRequest.coordinator } : {},
           ...deps.workflow !== void 0 ? { workflow: deps.workflow } : {}
         });
+    } else if (settled.kind === "handed-on" && recovery !== void 0 && coordinator !== void 0 && deps.coordinatorInstances !== void 0) {
+      const unit = unitOfIdempotencyKey(coordinator.idempotencyKey);
+      if (unit === void 0) {
+        console.error(
+          `[dispatch] ${msg.threadKey} could not retain ${settled.pending.length} recovery follow-up(s): the coordinator key names no unit`
+        );
+      } else {
+        const key = { instanceId: coordinator.parentInstanceId, unit };
+        let retained = 0;
+        for (const pending2 of settled.pending) {
+          const attachments = [...pending2.msg.images ?? [], ...pending2.msg.documents ?? []].map((asset) => ({
+            mediaType: asset.mediaType,
+            data: asset.data,
+            ...asset.name !== void 0 ? { name: asset.name } : {}
+          }));
+          try {
+            const appended = await deps.coordinatorInstances.appendEvent(key, {
+              ...pending2.msg.messageId !== void 0 ? { id: pending2.msg.messageId } : {},
+              sender: pending2.msg.userId,
+              ...pending2.msg.userName !== void 0 ? { senderName: pending2.msg.userName } : {},
+              text: pending2.msg.text,
+              ...attachments.length > 0 ? { attachments } : {},
+              mode: "steer",
+              at: pending2.at
+            });
+            if (appended.ok) retained++;
+            else {
+              console.error(`[dispatch] ${msg.threadKey} could not retain a recovery follow-up: ${appended.reason}`);
+              await pending2.io.reply(
+                "Your reply could not be saved on the recovered unit. No replacement work was started; please retry the reply."
+              ).catch(() => void 0);
+            }
+          } catch (err2) {
+            console.error(
+              `[dispatch] ${msg.threadKey} could not retain a recovery follow-up: ${err2 instanceof Error ? err2.message : String(err2)}`
+            );
+            await pending2.io.reply(
+              "Your reply could not be saved on the recovered unit. No replacement work was started; please retry the reply."
+            ).catch(() => void 0);
+          }
+        }
+        console.log(
+          `[dispatch] ${msg.threadKey} retained ${retained}/${settled.pending.length} recovery follow-up(s) on ${key.instanceId}:${key.unit}; no fresh turn ran`
+        );
+      }
     } else if (settled.kind === "handed-on") {
       const fresh = prepareFreshTurn(deps, { agent: settled.agent, pending: settled.pending, clock: clock4 });
       await dispatch(deps, fresh.msg, fresh.io, fresh.opts).catch(
@@ -71732,6 +71941,12 @@ async function recoverRunnerOwnedPullOwners(instanceIds, instances) {
         owned.set(runnerOwnedPullKey(instance.repo, unit.pr.number), { instanceId, unit: unit.unit });
     }
   }
+  for (const unit of await instances.listActiveRecoveries()) {
+    if (unit.pr === void 0) continue;
+    const instance = await instances.get(unit.instanceId);
+    if (instance !== null)
+      owned.set(runnerOwnedPullKey(instance.repo, unit.pr.number), { instanceId: unit.instanceId, unit: unit.unit });
+  }
   return owned;
 }
 var runnerOwnedPullKey, RunnerOwnershipFence;
@@ -71754,6 +71969,7 @@ var init_runnerOwnership = __esm({
        * synchronous, so a caller owns the process-local fence before its next
        * awaited durable transition. Repeating the same owner's claim is idempotent. */
       claim(repo, prNumber, owner) {
+        if (!this.recoveryComplete) throw new Error("runner ownership recovery is still in progress");
         const key = runnerOwnedPullKey(repo, prNumber);
         const current = this.claimedOwners.get(key) ?? this.recoveredOwners.get(key);
         const alreadyOwned = this.claimed.has(key) || this.recovered.has(key);
@@ -71768,6 +71984,7 @@ var init_runnerOwnership = __esm({
        * transition. Even the same runner identity cannot reserve it twice: the
        * returned token, not the owner fields, identifies the one caller. */
       reserve(repo, prNumber, owner) {
+        if (!this.recoveryComplete) throw new Error("runner ownership recovery is still in progress");
         const key = runnerOwnedPullKey(repo, prNumber);
         if (this.claimed.has(key) || this.recovered.has(key) || this.reservations.has(key)) return void 0;
         const token2 = Symbol(key);
@@ -72564,6 +72781,8 @@ function parseBrief(v) {
       if (!review.ok) return review;
       const checks = checkRows();
       if (!checks.ok) return checks;
+      if (b.headSha !== void 0 && (typeof b.headSha !== "string" || !/^[0-9a-f]{40}$/i.test(b.headSha)))
+        return invalid("brief.headSha must be a full commit sha");
       return {
         ok: true,
         value: {
@@ -72571,6 +72790,7 @@ function parseBrief(v) {
           unit: b.unit,
           pr: n2.value,
           reviewRunId: review.value,
+          ...b.headSha !== void 0 ? { headSha: b.headSha } : {},
           ...checks.value !== void 0 ? { checks: checks.value } : {}
         }
       };
@@ -72786,6 +73006,32 @@ async function spawn6(body, deps) {
   if (live) return answerForLive(live, key, threadKey, at);
   const done = await finishedWithKey(deps.runs, instance, threadKey, key);
   if (done) return json3(200, { ok: true, runId: done.id, threadKey, alreadySpawned: true, at });
+  if (row2?.recovery !== void 0) {
+    const expectedKind = req.preset === "coding" ? "findings" : "review";
+    const stepMatch = new RegExp(`^${row2.unit}/recovery/[1-9][0-9]*/${expectedKind}(?:/a[1-9][0-9]*)?$`).test(req.step);
+    const briefHead = req.brief !== void 0 && "headSha" in req.brief && typeof req.brief.headSha === "string" ? req.brief.headSha : void 0;
+    if (!stepMatch || row2.publication === void 0 || briefHead !== row2.publication.expectedHeadSha || typeof req.budget !== "number" || req.budget > Math.floor((row2.recovery.deadlineAt - at) / minutesToMs(1)))
+      return json3(409, { ok: false, error: "recovery_claim_mismatch", at });
+    let facts2;
+    try {
+      facts2 = await deps.fetchPrFacts({ repo: instance.repo, number: row2.publication.pr });
+    } catch (err2) {
+      return json3(502, { ok: false, error: "github_unavailable", message: describe12(err2), at });
+    }
+    const verified = facts2?.verifiedHead;
+    if (facts2?.state !== "open" || facts2.sameRepoHead !== true || facts2.headBranchExists !== true || facts2.headRef !== row2.publication.headRef || facts2.baseRef !== row2.publication.baseRef || facts2.headSha !== row2.publication.expectedHeadSha || verified?.repo.toLowerCase() !== instance.repo.toLowerCase() || verified.ref !== row2.publication.publicationRef || verified.sha !== row2.publication.expectedHeadSha)
+      return json3(409, {
+        ok: false,
+        error: fullHead(facts2?.headSha) && facts2.headSha !== row2.publication.expectedHeadSha ? "recovery_head_moved" : "recovery_facts_mismatch",
+        at
+      });
+    try {
+      if (deps.runnerOwnership?.claim(instance.repo, row2.publication.pr, row2.publication.owner) !== true)
+        return json3(409, { ok: false, error: "publication_ownership_changed", at });
+    } catch (err2) {
+      return json3(409, { ok: false, error: "publication_ownership_unknown", message: describe12(err2), at });
+    }
+  }
   const io = deps.ioFor({ threadKey, userId: instance.userId });
   if (!io) return json3(503, { ok: false, error: "no_channel", at });
   let turn;
@@ -72821,6 +73067,13 @@ ${foldThreadEvents(folded)}` };
         at
       });
     try {
+      if (row2.recovery !== void 0 && deps.runnerOwnership?.claim(instance.repo, row2.publication.pr, row2.publication.owner) !== true)
+        return json3(409, {
+          ok: false,
+          error: "publication_ownership_changed",
+          message: "the durable recovery claim no longer owns the pull request",
+          at
+        });
       const owner = deps.runnerOwnership?.owner(instance.repo, row2.publication.pr);
       if (owner === void 0 || owner.instanceId !== row2.publication.owner.instanceId || owner.unit !== row2.publication.owner.unit)
         return json3(409, {
@@ -72864,6 +73117,7 @@ ${foldThreadEvents(folded)}` };
   const releaseAdmission = leaveAdmission ?? (() => {
   });
   let startedId;
+  let deadlineTimer;
   let lastReply;
   let resolveStarted;
   const started = new Promise((resolve13) => {
@@ -72872,6 +73126,14 @@ ${foldThreadEvents(folded)}` };
   const child = watched(io, {
     started: (id) => {
       startedId = id;
+      if (row2?.recovery !== void 0) {
+        const stopAtDeadline = () => {
+          void deps.runs.stopRun(id, "hard", { kind: "access", id: "original-unit-recovery-deadline" });
+        };
+        const left = row2.recovery.deadlineAt - (deps.clock ?? systemClock)();
+        if (left <= 0) stopAtDeadline();
+        else deadlineTimer = setTimeout(stopAtDeadline, left);
+      }
       releaseAdmission();
       resolveStarted(id);
     },
@@ -72887,6 +73149,17 @@ ${foldThreadEvents(folded)}` };
   const tag = {
     parentInstanceId: instance.id,
     idempotencyKey: key,
+    ...row2?.recovery !== void 0 ? { transportWorkflowId: row2.recovery.workflowId } : {},
+    ...row2?.recovery !== void 0 && row2.publication !== void 0 ? {
+      recovery: {
+        repo: row2.publication.repo,
+        pr: row2.publication.pr,
+        headRef: row2.publication.headRef,
+        baseRef: row2.publication.baseRef,
+        expectedHeadSha: row2.recovery.expectedHeadSha,
+        deadlineAt: row2.recovery.deadlineAt
+      }
+    } : {},
     ...instance.base !== void 0 ? { base: instance.base } : {},
     ...publication !== void 0 ? { publication } : {}
   };
@@ -72894,6 +73167,16 @@ ${foldThreadEvents(folded)}` };
   try {
     dispatching = deps.dispatch(msg, child, {
       coordinator: tag,
+      ...row2?.recovery !== void 0 && row2.publication !== void 0 ? {
+        recovery: {
+          repo: row2.publication.repo,
+          pr: row2.publication.pr,
+          headRef: row2.publication.headRef,
+          baseRef: row2.publication.baseRef,
+          expectedHeadSha: row2.publication.expectedHeadSha,
+          deadlineAt: row2.recovery.deadlineAt
+        }
+      } : {},
       ...turn.contract !== void 0 ? { contract: turn.contract } : {}
     });
   } catch (err2) {
@@ -72904,6 +73187,9 @@ ${foldThreadEvents(folded)}` };
     (outcome) => ({ kind: "ended", outcome }),
     (err2) => ({ kind: "threw", err: err2 })
   );
+  void settled.finally(() => {
+    if (deadlineTimer !== void 0) clearTimeout(deadlineTimer);
+  });
   void settled.then((end) => {
     releaseAdmission();
     if (end.kind === "threw")
@@ -73363,6 +73649,425 @@ async function steerChild(body, deps) {
   const steered = await deps.steerChild?.(body.runId, text, instance) ?? false;
   return json3(200, { ok: true, outcome: steered ? "steered" : "not_live", at });
 }
+async function advanceRecoveryPublication(deps, instance, row2, facts2, runId3) {
+  if (row2.recovery === void 0 || row2.publication === void 0 || facts2.headSha === row2.publication.expectedHeadSha)
+    return row2;
+  const child = await deps.runs.getRun(runId3);
+  const expectedPrefix = `${instance.id}:${row2.unit}/recovery/`;
+  const owner = { instanceId: instance.id, unit: row2.unit };
+  if (!child.ok || child.value.finished !== true || child.value.status !== "completed" || child.value.agent !== "coding" || child.value.parentInstanceId !== instance.id || child.value.userId !== instance.userId || child.value.repo?.toLowerCase() !== instance.repo.toLowerCase() || child.value.threadKey !== (row2.threadKey ?? instance.threadKey) || child.value.idempotencyKey?.startsWith(expectedPrefix) !== true || !/\/findings(?:\/a[1-9][0-9]*)?$/.test(child.value.idempotencyKey) || !fullHead(facts2.headSha) || child.value.headSha !== facts2.headSha || child.value.pushed?.some((push) => push.ref === row2.branch && push.sha === facts2.headSha) !== true || facts2.state !== "open" || facts2.sameRepoHead !== true || facts2.headBranchExists !== true || facts2.headRef !== row2.publication.headRef || facts2.baseRef !== row2.publication.baseRef || facts2.verifiedHead?.repo.toLowerCase() !== instance.repo.toLowerCase() || facts2.verifiedHead.ref !== row2.publication.publicationRef || facts2.verifiedHead.sha !== facts2.headSha || !samePublicationOwner(row2.publication.owner, owner))
+    throw new PublicationBindingRefusal("publication_facts_mismatch");
+  try {
+    if (deps.runnerOwnership?.claim(instance.repo, row2.publication.pr, owner) !== true)
+      throw new PublicationBindingRefusal("publication_ownership_changed");
+  } catch (err2) {
+    if (err2 instanceof PublicationBindingRefusal) throw err2;
+    throw new PublicationBindingRefusal("publication_ownership_unknown");
+  }
+  const updated = {
+    ...row2,
+    lastPush: facts2.headSha,
+    publication: { ...row2.publication, expectedHeadSha: facts2.headSha },
+    recovery: { ...row2.recovery, expectedHeadSha: facts2.headSha }
+  };
+  let replaced;
+  try {
+    replaced = await deps.instances.compareAndReplaceUnit(row2, updated);
+  } catch {
+    const reread = await deps.instances.listUnits(instance.id).catch(() => void 0);
+    const current = reread?.filter((candidate) => candidate.unit === row2.unit);
+    if (current?.length === 1 && JSON.stringify(current[0]) === JSON.stringify(updated)) replaced = { ok: true };
+  }
+  if (replaced?.ok !== true)
+    throw new PublicationBindingRefusal(
+      replaced?.reason === "stale" ? "publication_binding_stale" : "publication_store_unavailable"
+    );
+  return updated;
+}
+async function bindOpenPullRequest(deps, instance, row2, pr, facts2) {
+  if (row2 === void 0) return;
+  const verified = facts2.verifiedHead;
+  if (instance.base === void 0 || facts2.state !== "open" || facts2.sameRepoHead !== true || facts2.headBranchExists !== true || facts2.headRef !== row2.branch || facts2.baseRef !== instance.base || verified === void 0 || verified.repo.toLowerCase() !== instance.repo.toLowerCase() || verified.ref !== row2.branch || !/^[0-9a-f]{40}$/i.test(verified.sha) || facts2.headSha !== verified.sha || row2.pr !== void 0 && row2.pr.number !== pr.number)
+    throw new PublicationBindingRefusal("publication_facts_mismatch");
+  const owner = { instanceId: instance.id, unit: row2.unit };
+  const publication = {
+    repo: instance.repo,
+    pr: pr.number,
+    headRef: row2.branch,
+    baseRef: instance.base,
+    expectedHeadSha: verified.sha,
+    publicationRef: row2.branch,
+    owner
+  };
+  const existing = row2.publication;
+  if (existing !== void 0 && (existing.repo !== publication.repo || existing.pr !== publication.pr || existing.headRef !== publication.headRef || existing.baseRef !== publication.baseRef || existing.expectedHeadSha !== publication.expectedHeadSha || existing.publicationRef !== publication.publicationRef || !samePublicationOwner(existing.owner, owner)))
+    throw new PublicationBindingRefusal("publication_facts_mismatch");
+  const fence = deps.runnerOwnership;
+  if (fence === void 0) throw new PublicationBindingRefusal("publication_ownership_unknown");
+  let priorOwner;
+  try {
+    priorOwner = fence.owner(instance.repo, pr.number);
+  } catch {
+    throw new PublicationBindingRefusal("publication_ownership_unknown");
+  }
+  if (priorOwner !== void 0 && !samePublicationOwner(priorOwner, owner))
+    throw new PublicationBindingRefusal("publication_ownership_changed");
+  try {
+    if (!fence.claim(instance.repo, pr.number, owner))
+      throw new PublicationBindingRefusal("publication_ownership_changed");
+  } catch (err2) {
+    if (err2 instanceof PublicationBindingRefusal) throw err2;
+    throw new PublicationBindingRefusal("publication_ownership_unknown");
+  }
+  let claimedHere = priorOwner === void 0;
+  const releaseClaim = () => {
+    if (!claimedHere) return;
+    fence.release(instance.repo, pr.number, owner);
+    claimedHere = false;
+  };
+  try {
+    if (!samePublicationOwner(fence.owner(instance.repo, pr.number), owner)) {
+      releaseClaim();
+      throw new PublicationBindingRefusal("publication_ownership_unknown");
+    }
+  } catch (err2) {
+    releaseClaim();
+    if (err2 instanceof PublicationBindingRefusal) throw err2;
+    throw new PublicationBindingRefusal("publication_ownership_unknown");
+  }
+  const replacement = { ...row2, pr, publication };
+  if (JSON.stringify(replacement) === JSON.stringify(row2)) return;
+  let replaced;
+  try {
+    replaced = await deps.instances.compareAndReplaceUnit(row2, replacement);
+  } catch {
+    releaseClaim();
+    throw new PublicationBindingRefusal("publication_store_unavailable");
+  }
+  if (!replaced.ok) {
+    releaseClaim();
+    throw new PublicationBindingRefusal(
+      replaced.reason === "stale" ? "publication_binding_stale" : "publication_store_unavailable"
+    );
+  }
+}
+async function recoverOriginalUnit(body, deps, caller) {
+  const id = parseInstanceId(body.parentInstanceId);
+  if (!id.ok) return json3(400, { ok: false, error: id.error });
+  if (typeof body.unit !== "string" || !UNIT_ID.test(body.unit))
+    return json3(400, { ok: false, error: "unit must be a unit id" });
+  const at = (deps.clock ?? systemClock)();
+  const instance = await deps.instances.get(id.value);
+  if (instance === null) return json3(404, { ok: false, error: "unknown_instance", at });
+  const requestedWorkflowId = typeof body.workflowId === "string" ? body.workflowId : void 0;
+  if (caller === void 0 && requestedWorkflowId === void 0)
+    return json3(403, { ok: false, error: "recovery_caller_required", at });
+  if (caller !== void 0 && caller.userId !== instance.userId)
+    return json3(403, { ok: false, error: "recovery_requester_mismatch", at });
+  const rows = await deps.instances.listUnits(instance.id);
+  const matches = rows.filter((candidate) => candidate.unit === body.unit);
+  if (matches.length !== 1) return json3(409, { ok: false, error: "unit_evidence_ambiguous", at });
+  const row2 = matches[0];
+  if (caller !== void 0 && caller.threadKey !== (row2.threadKey ?? instance.threadKey))
+    return json3(403, { ok: false, error: "recovery_requester_mismatch", at });
+  if (row2.idle !== void 0 && row2.ending !== void 0)
+    return json3(409, { ok: false, error: "unit_lifecycle_ambiguous", at });
+  const originalOwner = { instanceId: instance.id, unit: row2.unit };
+  const publication = row2.publication;
+  const pr = row2.pr;
+  const base = instance.base;
+  let expectedHead = row2.lastPush;
+  if (pr === void 0 || base === void 0 || !fullHead(expectedHead) || publication === void 0 || publication.repo.toLowerCase() !== instance.repo.toLowerCase() || publication.pr !== pr.number || publication.headRef !== row2.branch || publication.baseRef !== base || publication.publicationRef !== row2.branch || !fullHead(publication.expectedHeadSha) || !samePublicationOwner(publication.owner, originalOwner))
+    return json3(409, { ok: false, error: "recovery_binding_mismatch", at });
+  const existingClaim = row2.recovery;
+  let kind;
+  let round2;
+  let remainingMs;
+  let reviewRunId;
+  let stepName;
+  let workflowId;
+  let reviewKey;
+  let deadlineAt;
+  let findings;
+  let findingsRunId;
+  let findingsKey;
+  let claimRow = row2;
+  let facts2;
+  let originalRow;
+  if (existingClaim !== void 0) {
+    ({
+      kind,
+      round: round2,
+      remainingMs,
+      reviewRunId,
+      step: stepName,
+      workflowId,
+      reviewKey,
+      deadlineAt,
+      findings,
+      findingsRunId,
+      findingsKey
+    } = existingClaim);
+    if (existingClaim.expectedHeadSha !== expectedHead || publication.expectedHeadSha !== expectedHead)
+      return json3(409, { ok: false, error: "recovery_binding_mismatch", at });
+    const { recovery: _recovery, ...withoutRecovery } = row2;
+    originalRow = { ...withoutRecovery, ending: existingClaim.previousEnding };
+  } else {
+    if (row2.idle !== void 0 || row2.ending === void 0)
+      return json3(409, { ok: false, error: "unit_not_terminal", at });
+    let boundaryPosition = -1;
+    for (let index = row2.rounds.length - 1; index >= 0; index -= 1)
+      if (row2.rounds[index].agent === "review" && row2.rounds[index].outcome !== "started") {
+        boundaryPosition = index;
+        break;
+      }
+    const boundary = boundaryPosition >= 0 ? row2.rounds[boundaryPosition] : void 0;
+    if (boundary === void 0 || boundary.outcome !== "request_changes" && boundary.outcome !== "no_verdict")
+      return json3(409, { ok: false, error: "recovery_ending_unsupported", at });
+    if (row2.rounds.slice(boundaryPosition + 1).some((candidate) => candidate.agent === "review"))
+      return json3(409, { ok: false, error: "recovery_stage_ambiguous", at });
+    kind = boundary.outcome === "request_changes" ? "findings" : "review";
+    if (kind === "review" && row2.ending.kind !== "no_verdict")
+      return json3(409, { ok: false, error: "recovery_ending_mismatch", at });
+    round2 = boundary.index;
+    const caps = instance.caps;
+    if (caps === void 0 || row2.startedAt === void 0 || !Number.isFinite(row2.ending.at))
+      return json3(409, { ok: false, error: "recovery_budget_unknown", at });
+    if (instance.grant?.costCapUsd !== void 0) return json3(409, { ok: false, error: "recovery_budget_unknown", at });
+    if (round2 >= caps.maxRounds) return json3(409, { ok: false, error: "recovery_rounds_exhausted", at });
+    const latestSegmentIndex = row2.segments?.reduce((latest, candidate) => Math.max(latest, candidate.index), 1) ?? 1;
+    const latestSegments = row2.segments?.filter((candidate) => candidate.index === latestSegmentIndex) ?? [];
+    if (latestSegments.length > 1) return json3(409, { ok: false, error: "recovery_budget_unknown", at });
+    const segment = latestSegments[0];
+    const leaseStartedAt = segment?.at ?? row2.startedAt;
+    const resumedLeases = Object.values(row2.wakes ?? {}).filter(
+      (answer) => answer.kind === "segment" && answer.index === latestSegmentIndex && answer.leaseMs !== void 0
+    );
+    if (resumedLeases.length > 0) return json3(409, { ok: false, error: "recovery_budget_unknown", at });
+    remainingMs = minutesToMs(caps.maxMinutes) - (at - leaseStartedAt);
+    const reviewThreadKey = row2.reviewThread?.threadKey ?? row2.threadKey ?? instance.threadKey;
+    const unitThreadKey = row2.threadKey ?? instance.threadKey;
+    const listing = await deps.runs.listRuns({
+      status: "finished",
+      visibleTo: EVERY_RUN,
+      threadKey: reviewThreadKey,
+      limit: RUN_LIST_MAX_LIMIT
+    });
+    const unitListing = unitThreadKey === reviewThreadKey ? listing : await deps.runs.listRuns({
+      status: "finished",
+      visibleTo: EVERY_RUN,
+      threadKey: unitThreadKey,
+      limit: RUN_LIST_MAX_LIMIT
+    });
+    const segmentPrefix = stepPrefixOf(
+      row2.unit,
+      latestSegmentIndex > 1 ? { segment: latestSegmentIndex, renewalsSpent: 0, spendUsd: null } : void 0
+    );
+    const reviewedHead = publication.expectedHeadSha;
+    const reviewKeyPrefix = `${instance.id}:${segmentPrefix}/${round2}/review`;
+    const candidates2 = listing.runs.filter((run2) => {
+      if (!run2.finished || run2.agent !== "review" || run2.parentInstanceId !== instance.id || run2.idempotencyKey !== reviewKeyPrefix && run2.idempotencyKey?.startsWith(`${reviewKeyPrefix}/a`) !== true || run2.userId !== instance.userId || run2.repo?.toLowerCase() !== instance.repo.toLowerCase() || run2.threadKey !== reviewThreadKey)
+        return false;
+      if (run2.reviewHead !== reviewedHead) return false;
+      if (kind === "review") return run2.verdict === void 0 && run2.reviewPost === void 0;
+      return run2.verdict?.verdict === "request_changes" && run2.reviewHead === reviewedHead && run2.reviewPost?.posted === true && run2.reviewPost.head === reviewedHead && run2.reviewPost.verdict === "request_changes" && run2.reviewPost.target.repo.toLowerCase() === instance.repo.toLowerCase() && run2.reviewPost.target.number === pr.number;
+    });
+    if (candidates2.length !== 1) return json3(409, { ok: false, error: "recovery_review_evidence_ambiguous", at });
+    reviewRunId = candidates2[0].id;
+    reviewKey = candidates2[0].idempotencyKey;
+    try {
+      facts2 = await deps.fetchPrFacts({ repo: instance.repo, number: pr.number });
+    } catch (err2) {
+      return json3(502, { ok: false, error: "github_unavailable", message: describe12(err2), at });
+    }
+    if (facts2 === void 0) return json3(502, { ok: false, error: "github_unavailable", at });
+    const verified2 = facts2.verifiedHead;
+    if (facts2.state !== "open" || facts2.sameRepoHead !== true || facts2.headBranchExists !== true || facts2.headRef !== row2.branch || facts2.baseRef !== base || !fullHead(facts2.headSha) || verified2 === void 0 || verified2.repo.toLowerCase() !== instance.repo.toLowerCase() || verified2.ref !== row2.branch || verified2.sha !== facts2.headSha)
+      return json3(409, { ok: false, error: "recovery_facts_mismatch", at });
+    const findingsStep = `${segmentPrefix}/${boundary.index}/findings/pr-check`;
+    const findingsPrefix = `${instance.id}:${segmentPrefix}/${boundary.index}/findings`;
+    const headMoved = facts2.headSha !== reviewedHead || expectedHead !== reviewedHead;
+    const completedFindings = unitListing.runs.filter(
+      (run2) => boundary.outcome === "request_changes" && row2.ending?.cause === "step_threw" && row2.ending.step === findingsStep && row2.ending.round === boundary.index && (expectedHead === reviewedHead || expectedHead === facts2.headSha) && run2.finished && run2.status === "completed" && run2.agent === "coding" && run2.parentInstanceId === instance.id && run2.userId === instance.userId && run2.repo?.toLowerCase() === instance.repo.toLowerCase() && run2.threadKey === unitThreadKey && (run2.idempotencyKey === findingsPrefix || run2.idempotencyKey?.startsWith(`${findingsPrefix}/a`) === true) && run2.headSha === facts2.headSha && (!headMoved || run2.pushed?.some((push) => push.ref === row2.branch && push.sha === facts2.headSha) === true) && run2.startedAt >= (candidates2[0].finishedAt ?? candidates2[0].startedAt) && (run2.finishedAt === void 0 || run2.finishedAt <= row2.ending.at)
+    );
+    if (completedFindings.length > 1 || headMoved && completedFindings.length !== 1)
+      return json3(409, { ok: false, error: "recovery_head_moved", at });
+    if (completedFindings.length === 1) {
+      findingsRunId = completedFindings[0].id;
+      findingsKey = completedFindings[0].idempotencyKey;
+      expectedHead = facts2.headSha;
+      kind = "review";
+      round2 = boundary.index + 1;
+      claimRow = {
+        ...row2,
+        lastPush: expectedHead,
+        publication: { ...publication, expectedHeadSha: expectedHead }
+      };
+    } else expectedHead = reviewedHead;
+    const floor = minutesToMs(leaseMinimum(kind === "findings" ? "fix" : "review"));
+    if (!Number.isFinite(remainingMs) || remainingMs < floor)
+      return json3(409, { ok: false, error: "recovery_wall_clock_exhausted", at });
+    stepName = `${row2.unit}/recovery/${round2}/${kind}`;
+    workflowId = `recovery-${findingsRunId ?? reviewRunId}`;
+    deadlineAt = at + remainingMs;
+    findings = kind === "findings" ? candidates2[0].verdict?.findings : void 0;
+    if (row2.recoveryReceipt?.reviewRunId === reviewRunId)
+      return json3(409, { ok: false, error: "recovery_already_completed", at });
+    originalRow = row2;
+  }
+  const expiredExistingClaim = existingClaim !== void 0 && at >= deadlineAt;
+  if (requestedWorkflowId !== void 0) {
+    if (existingClaim === void 0 || requestedWorkflowId !== workflowId)
+      return json3(409, { ok: false, error: "recovery_claim_mismatch", at });
+  }
+  const fence = deps.runnerOwnership;
+  if (fence === void 0 || fence.reserve === void 0 || fence.transferReservation === void 0 || fence.releaseReservation === void 0)
+    return json3(503, { ok: false, error: "publication_ownership_unknown", at });
+  const releaseReservation = fence.releaseReservation.bind(fence);
+  if (existingClaim !== void 0) {
+    try {
+      if (!fence.claim(instance.repo, pr.number, originalOwner))
+        return json3(409, { ok: false, error: "publication_ownership_changed", at });
+    } catch (err2) {
+      return json3(503, { ok: false, error: "publication_ownership_unknown", message: describe12(err2), at });
+    }
+  }
+  let claimedRow = row2;
+  let token2;
+  let transferred = existingClaim !== void 0;
+  const rollback = async (error, consumed = false) => {
+    if (originalRow !== void 0) {
+      const replacement = consumed ? {
+        ...originalRow,
+        recoveryReceipt: { reviewRunId, workflowId, at }
+      } : originalRow;
+      const restored = await deps.instances.compareAndReplaceUnit(claimedRow, replacement).catch(() => void 0);
+      if (restored?.ok !== true)
+        return json3(500, {
+          ok: false,
+          error: "recovery_rollback_failed",
+          cause: error,
+          reason: restored?.reason ?? "unavailable",
+          at
+        });
+    }
+    const released = transferred ? fence.release(instance.repo, pr.number, originalOwner) : token2 !== void 0 ? releaseReservation(instance.repo, pr.number, token2) : true;
+    if (!released) return json3(500, { ok: false, error: "recovery_cleanup_failed", cause: error, at });
+    return json3(409, { ok: false, error, at });
+  };
+  if (requestedWorkflowId === void 0 && expiredExistingClaim) {
+    const status3 = await deps.recoveryStatus?.(workflowId).catch((err2) => ({
+      kind: "unanswered",
+      reason: describe12(err2)
+    }));
+    if (status3 === void 0 || status3.kind === "unanswered")
+      return json3(503, {
+        ok: false,
+        error: "recovery_status_unanswered",
+        ...status3?.kind === "unanswered" ? { message: status3.reason } : {},
+        workflowId,
+        at
+      });
+    if (status3.kind === "status" && !["complete", "errored", "terminated"].includes(status3.status))
+      return json3(409, { ok: false, error: "recovery_wall_clock_exhausted", workflowId, at });
+    return rollback("recovery_wall_clock_exhausted", status3.kind !== "absent");
+  }
+  if (facts2 === void 0)
+    try {
+      facts2 = await deps.fetchPrFacts({ repo: instance.repo, number: pr.number });
+    } catch (err2) {
+      return json3(502, { ok: false, error: "github_unavailable", message: describe12(err2), at });
+    }
+  if (facts2 === void 0) return json3(502, { ok: false, error: "github_unavailable", at });
+  const verified = facts2.verifiedHead;
+  if (facts2.state !== "open" || facts2.sameRepoHead !== true || facts2.headBranchExists !== true || facts2.headRef !== row2.branch || facts2.baseRef !== base || !fullHead(facts2.headSha) || facts2.headSha !== expectedHead || verified === void 0 || verified.repo.toLowerCase() !== instance.repo.toLowerCase() || verified.ref !== row2.branch || verified.sha !== expectedHead) {
+    const error = fullHead(facts2.headSha) && facts2.headSha !== expectedHead ? "recovery_head_moved" : "recovery_facts_mismatch";
+    return requestedWorkflowId === void 0 ? json3(409, { ok: false, error, at }) : rollback(error);
+  }
+  if (existingClaim === void 0) {
+    try {
+      token2 = fence.reserve(instance.repo, pr.number, originalOwner);
+    } catch (err2) {
+      return json3(503, { ok: false, error: "publication_ownership_unknown", message: describe12(err2), at });
+    }
+    if (token2 === void 0) return json3(409, { ok: false, error: "publication_ownership_changed", at });
+    const { ending: _ending, ...withoutEnding } = claimRow;
+    claimedRow = {
+      ...withoutEnding,
+      recovery: {
+        kind,
+        round: round2,
+        expectedHeadSha: expectedHead,
+        remainingMs,
+        claimedAt: at,
+        step: stepName,
+        reviewRunId,
+        ...findingsRunId !== void 0 ? { findingsRunId } : {},
+        ...findingsKey !== void 0 ? { findingsKey } : {},
+        ...findings !== void 0 ? { findings } : {},
+        previousEnding: row2.ending,
+        workflowId,
+        deadlineAt,
+        reviewKey
+      }
+    };
+    let replaced;
+    try {
+      replaced = await deps.instances.compareAndReplaceUnit(row2, claimedRow);
+    } catch (err2) {
+      const reread = await deps.instances.listUnits(instance.id).catch(() => void 0);
+      const current = reread?.filter((candidate) => candidate.unit === row2.unit);
+      if (current?.length === 1 && JSON.stringify(current[0]) === JSON.stringify(claimedRow)) replaced = { ok: true };
+      else if (current?.length === 1 && JSON.stringify(current[0]) === JSON.stringify(row2)) {
+        const released = releaseReservation(instance.repo, pr.number, token2);
+        if (!released)
+          return json3(500, { ok: false, error: "recovery_cleanup_failed", cause: "recovery_store_unavailable", at });
+        return json3(503, { ok: false, error: "recovery_store_unavailable", message: describe12(err2), at });
+      } else return json3(503, { ok: false, error: "recovery_claim_unanswered", message: describe12(err2), at });
+    }
+    if (replaced.ok !== true) {
+      const error = replaced.reason === "stale" ? "recovery_claim_stale" : "recovery_store_unavailable";
+      const released = releaseReservation(instance.repo, pr.number, token2);
+      if (!released) return json3(500, { ok: false, error: "recovery_cleanup_failed", cause: error, at });
+      return json3(409, { ok: false, error, at });
+    }
+    if (!fence.transferReservation(instance.repo, pr.number, token2, originalOwner, originalOwner))
+      return rollback("publication_ownership_changed");
+    token2 = void 0;
+    transferred = true;
+  }
+  if (requestedWorkflowId !== void 0)
+    return json3(200, { ok: true, parentInstanceId: instance.id, unit: row2.unit, workflowId, at });
+  const startRecovery = deps.startRecovery;
+  if (startRecovery === void 0) return rollback("recovery_workflow_unavailable");
+  const started = await startRecovery(workflowId, {
+    kind: "recover-original-unit",
+    parentInstanceId: instance.id,
+    unit: row2.unit
+  }).catch((err2) => ({ kind: "unanswered", reason: describe12(err2) }));
+  if (started.kind !== "created" && started.kind !== "duplicate") {
+    if (started.kind === "failed") return rollback("recovery_workflow_failed");
+    return json3(200, {
+      ok: true,
+      outcome: "indeterminate",
+      workflowId,
+      parentInstanceId: instance.id,
+      unit: row2.unit,
+      message: started.reason,
+      at
+    });
+  }
+  if (started.kind === "duplicate" && started.status !== void 0 && ["complete", "errored", "terminated"].includes(started.status))
+    return rollback("recovery_workflow_terminal", true);
+  return json3(200, {
+    ok: true,
+    outcome: started.kind === "duplicate" ? "already_started" : "started",
+    workflowId,
+    parentInstanceId: instance.id,
+    unit: row2.unit,
+    at
+  });
+}
 async function prCheck(body, deps) {
   const id = parseInstanceId(body.parentInstanceId);
   if (!id.ok) return json3(400, { ok: false, error: id.error });
@@ -73379,19 +74084,9 @@ async function prCheck(body, deps) {
   const unit = await unitRowOf(deps, instance, body.unit);
   if (!unit.ok) return unit.response;
   const branch2 = unit.row?.branch ?? instance.branch;
-  const remember = async (pr, facts2) => {
-    if (!unit.row) return;
-    const publication = unit.row.publication ?? (facts2?.state === "open" && facts2.sameRepoHead === true && facts2.headBranchExists === true && typeof facts2.headRef === "string" && typeof facts2.baseRef === "string" && typeof facts2.headSha === "string" && /^[0-9a-f]{40}$/i.test(facts2.headSha) ? {
-      repo: instance.repo,
-      pr: pr.number,
-      headRef: facts2.headRef,
-      baseRef: facts2.baseRef,
-      expectedHeadSha: facts2.headSha,
-      publicationRef: facts2.headRef,
-      owner: { instanceId: instance.id, unit: unit.row.unit }
-    } : void 0);
-    if (unit.row.pr?.number !== pr.number || unit.row.pr.url !== pr.url || unit.row.publication === void 0 && publication !== void 0)
-      await deps.instances.putUnits([{ ...unit.row, pr, ...publication !== void 0 ? { publication } : {} }]);
+  const rememberTerminal = async (pr) => {
+    if (!unit.row || unit.row.pr?.number === pr.number && unit.row.pr.url === pr.url) return;
+    await deps.instances.putUnits([{ ...unit.row, pr }]);
   };
   try {
     if (follow !== void 0) {
@@ -73400,12 +74095,13 @@ async function prCheck(body, deps) {
       const fallbackUrl = unit.row?.pr?.url ?? `https://github.com/${instance.repo}/pull/${follow}`;
       const state2 = pullRequestState(follow, fallbackUrl, facts2);
       if (state2 === void 0) throw new Error(headBranchStateError(instance.repo, follow));
-      await remember({ number: follow, url: String(state2.url) }, facts2);
-      if (state2.state !== "open") return json3(200, { ok: true, ...state2, at });
-      deps.runnerOwnership?.claim(instance.repo, follow, {
-        instanceId: instance.id,
-        unit: unit.row?.unit ?? body.unit
-      });
+      const followedPr = { number: follow, url: String(state2.url) };
+      if (state2.state !== "open") {
+        await rememberTerminal(followedPr);
+        return json3(200, { ok: true, ...state2, at });
+      }
+      const bindingRow = unit.row !== void 0 && unit.row.recovery !== void 0 && recover !== void 0 ? await advanceRecoveryPublication(deps, instance, unit.row, facts2, recover.runId) : unit.row;
+      await bindOpenPullRequest(deps, instance, bindingRow, followedPr, facts2);
       const prRef = { repo: instance.repo, number: follow };
       const headSha = facts2.headSha;
       const approved = entry && headSha !== void 0 ? await reviewPostedAt(deps, prRef, "approve", headSha) : void 0;
@@ -73436,16 +74132,16 @@ async function prCheck(body, deps) {
     }
     const open2 = await deps.findOpenPrByHead(instance.repo, branch2);
     if (open2) {
-      deps.runnerOwnership?.claim(instance.repo, open2.number, {
-        instanceId: instance.id,
-        unit: unit.row?.unit ?? body.unit
-      });
       const liveFacts = await deps.fetchPrFacts({ repo: instance.repo, number: open2.number });
       if (liveFacts === void 0) throw new Error(`could not read ${instance.repo}#${open2.number}`);
-      await remember({ number: open2.number, url: open2.htmlUrl }, liveFacts);
       const current = pullRequestState(open2.number, open2.htmlUrl, liveFacts);
       if (current === void 0) throw new Error(headBranchStateError(instance.repo, open2.number));
-      if (current.state !== "open") return json3(200, { ok: true, ...current, at });
+      const discoveredPr = { number: open2.number, url: open2.htmlUrl };
+      if (current.state !== "open") {
+        await rememberTerminal(discoveredPr);
+        return json3(200, { ok: true, ...current, at });
+      }
+      await bindOpenPullRequest(deps, instance, unit.row, discoveredPr, liveFacts);
       const entryFacts = entry ? liveFacts : void 0;
       const branchHead = entryFacts?.headSha;
       const entryHead = branchHead ?? open2.headSha;
@@ -73496,22 +74192,27 @@ async function prCheck(body, deps) {
       }
       const recovered = await recoverPushedBranch(deps, instance, unit.row, branch2, recover.runId);
       if (recovered.kind === "opened") {
-        await remember({ number: recovered.pr.number, url: recovered.pr.htmlUrl });
         const recoveredFacts = await deps.fetchPrFacts({ repo: instance.repo, number: recovered.pr.number });
         if (recoveredFacts === void 0) throw new Error(`could not read ${instance.repo}#${recovered.pr.number}`);
         const recoveredState = pullRequestState(recovered.pr.number, recovered.pr.htmlUrl, recoveredFacts);
         if (recoveredState === void 0) throw new Error(headBranchStateError(instance.repo, recovered.pr.number));
+        const recoveredPr = { number: recovered.pr.number, url: recovered.pr.htmlUrl };
+        if (recoveredState.state === "open")
+          await bindOpenPullRequest(deps, instance, unit.row, recoveredPr, recoveredFacts);
+        else await rememberTerminal(recoveredPr);
         return json3(200, { ok: true, ...recoveredState, at });
       }
       return json3(200, { ok: true, state: "none", unrecovered: recovered.why, at });
     }
-    await remember({ number: merged.number, url: merged.htmlUrl });
     const mergedFacts = await deps.fetchPrFacts({ repo: instance.repo, number: merged.number });
     if (mergedFacts === void 0) throw new Error(`could not read ${instance.repo}#${merged.number}`);
     const state = pullRequestState(merged.number, merged.htmlUrl, mergedFacts);
     if (state?.state !== "merged") throw new Error(`${instance.repo}#${merged.number} no longer reads merged`);
+    await rememberTerminal({ number: merged.number, url: merged.htmlUrl });
     return json3(200, { ok: true, ...state, at });
   } catch (err2) {
+    if (err2 instanceof PublicationBindingRefusal)
+      return json3(409, { ok: false, error: err2.reason, message: "the open pull request was not durably bound", at });
     return json3(502, { ok: false, error: "github_unavailable", message: describe12(err2), at });
   }
 }
@@ -73788,19 +74489,43 @@ async function round(body, deps) {
   const instance = await deps.instances.get(id.value);
   if (!instance) return json3(404, { ok: false, error: "unknown_instance" });
   if (namesForeignRun(instance, body)) return json3(404, { ok: false, error: "not_found" });
-  const host = await hostRunOf(deps, instance);
-  if (host.kind === "not_host") return json3(409, { ok: false, error: "not_host", at });
   const units = await deps.instances.listUnits(instance.id);
   const row2 = units.find((u) => u.unit === body.unit);
   if (!row2) return json3(404, { ok: false, error: "unit_not_found", unit: body.unit });
+  const recoveryWorkflowId = typeof body.recoveryWorkflowId === "string" && INSTANCE_ID_PATTERN.test(body.recoveryWorkflowId) ? body.recoveryWorkflowId : void 0;
+  if (body.recoveryWorkflowId !== void 0 && recoveryWorkflowId === void 0)
+    return json3(400, { ok: false, error: "recoveryWorkflowId must be a Workflow instance id", at });
+  if (row2.recovery !== void 0 && recoveryWorkflowId !== row2.recovery.workflowId)
+    return json3(409, { ok: false, error: "recovery_claim_mismatch", at });
+  const host = row2.recovery !== void 0 ? { kind: "not_host" } : await hostRunOf(deps, instance);
+  if (host.kind === "not_host" && row2.recovery === void 0) return json3(409, { ok: false, error: "not_host", at });
+  const note = { index: body.index, agent: body.agent, outcome: body.outcome, at, ...gate ? { gate } : {} };
+  const previous = row2.rounds.at(-1);
+  if (row2.recovery !== void 0 && previous?.index === note.index && previous.agent === note.agent && previous.outcome === note.outcome && JSON.stringify(previous.gate) === JSON.stringify(note.gate))
+    return json3(200, { ok: true, at: previous.at });
   const updated = {
     ...row2,
-    rounds: [
-      ...row2.rounds,
-      { index: body.index, agent: body.agent, outcome: body.outcome, at, ...gate ? { gate } : {} }
-    ]
+    rounds: [...row2.rounds, note]
   };
-  await deps.instances.putUnits([updated]);
+  if (row2.recovery !== void 0) {
+    let replaced;
+    try {
+      replaced = await deps.instances.compareAndReplaceUnit(row2, updated);
+    } catch {
+      const reread = await deps.instances.listUnits(instance.id).catch(() => void 0);
+      const current = reread?.filter((candidate) => candidate.unit === row2.unit);
+      if (current?.length === 1 && JSON.stringify(current[0]) === JSON.stringify(updated)) replaced = { ok: true };
+      else if (current?.length === 1 && JSON.stringify(current[0]) === JSON.stringify(row2))
+        return json3(503, { ok: false, error: "recovery_store_unavailable", at });
+      else return json3(409, { ok: false, error: "recovery_claim_stale", at });
+    }
+    if (replaced?.ok !== true)
+      return json3(409, {
+        ok: false,
+        error: replaced?.reason === "stale" ? "recovery_claim_stale" : "recovery_store_unavailable",
+        at
+      });
+  } else await deps.instances.putUnits([updated]);
   if (host.kind === "host") {
     const thread = unitThread(instance, updated, units.length);
     await hostPublish(
@@ -73880,11 +74605,11 @@ async function unitWake(body, deps) {
   const instance = await deps.instances.get(id.value);
   if (!instance) return json3(404, { ok: false, error: "unknown_instance" });
   if (namesForeignRun(instance, body)) return json3(404, { ok: false, error: "not_found" });
-  const host = await hostRunOf(deps, instance);
-  if (host.kind === "not_host") return json3(409, { ok: false, error: "not_host", at });
   const units = await deps.instances.listUnits(instance.id);
   const row2 = units.find((u) => u.unit === body.unit);
   if (!row2) return json3(404, { ok: false, error: "unit_not_found", unit: body.unit });
+  const host = await hostRunOf(deps, instance);
+  if (host.kind === "not_host") return json3(409, { ok: false, error: "not_host", at });
   const stored = row2.wakes?.[body.waitId];
   if (stored !== void 0) return json3(200, { ok: true, answer: stored, at });
   if (!row2.idle) {
@@ -74037,11 +74762,25 @@ async function unitEnd(body, deps) {
   const instance = await deps.instances.get(id.value);
   if (!instance) return json3(404, { ok: false, error: "unknown_instance" });
   if (namesForeignRun(instance, body)) return json3(404, { ok: false, error: "not_found" });
-  const host = await hostRunOf(deps, instance);
-  if (host.kind === "not_host") return json3(409, { ok: false, error: "not_host", at });
   const units = await deps.instances.listUnits(instance.id);
   const row2 = units.find((u) => u.unit === body.unit);
   if (!row2) return json3(404, { ok: false, error: "unit_not_found", unit: body.unit });
+  const recoveryWorkflowId = typeof body.recoveryWorkflowId === "string" && INSTANCE_ID_PATTERN.test(body.recoveryWorkflowId) ? body.recoveryWorkflowId : void 0;
+  if (body.recoveryWorkflowId !== void 0 && recoveryWorkflowId === void 0)
+    return json3(400, { ok: false, error: "recoveryWorkflowId must be a Workflow instance id", at });
+  if (recoveryWorkflowId !== void 0 && row2.recoveryReceipt?.workflowId === recoveryWorkflowId) {
+    if (row2.pr !== void 0) {
+      const owner = { instanceId: instance.id, unit: row2.unit };
+      const current = deps.runnerOwnership?.owner(instance.repo, row2.pr.number);
+      if (current?.instanceId === owner.instanceId && current.unit === owner.unit)
+        deps.runnerOwnership?.release(instance.repo, row2.pr.number, owner);
+    }
+    return json3(200, { ok: true, alreadySettled: true, at: row2.recoveryReceipt.at });
+  }
+  if (row2.recovery !== void 0 && recoveryWorkflowId !== row2.recovery.workflowId)
+    return json3(409, { ok: false, error: "recovery_claim_mismatch", at });
+  const host = row2.recovery !== void 0 ? { kind: "not_host" } : await hostRunOf(deps, instance);
+  if (host.kind === "not_host" && row2.recovery === void 0) return json3(409, { ok: false, error: "not_host", at });
   const pr = body.pr;
   const lastPush = normalizeHead(body.headSha);
   const segment = ending.kind === "continued" ? parseSegment(body.segment) : void 0;
@@ -74051,9 +74790,30 @@ async function unitEnd(body, deps) {
   if (ending.kind === "idle" && idle === void 0)
     return json3(400, { ok: false, error: "an idle ending must carry its why and the renewals left" });
   const segments2 = row2.segments ?? [];
-  const { idle: _idle, ...rowWithoutIdle } = row2;
+  const recoveryHold = row2.recovery !== void 0 && ending.kind === "held" && isHumanGatePending(ending.humanGate) ? { cause: "human", gate: ending.humanGate } : row2.recovery !== void 0 && ending.kind === "held" && ending.holdCause === "draft" && pr !== void 0 && typeof pr.number === "number" && typeof pr.url === "string" ? { cause: "draft", pr: { number: pr.number, url: pr.url } } : void 0;
+  if (row2.recovery !== void 0 && ending.kind === "held" && recoveryHold === void 0)
+    return json3(400, { ok: false, error: "a recovered held ending must carry a typed hold cause", at });
+  if (row2.recovery !== void 0 && (idle !== void 0 || segment !== void 0))
+    return json3(409, { ok: false, error: "recovery_continuation_unsupported", at });
+  if (row2.recovery !== void 0 && row2.pr !== void 0) {
+    try {
+      if (deps.runnerOwnership?.claim(instance.repo, row2.pr.number, { instanceId: instance.id, unit: row2.unit }) !== true)
+        return json3(409, { ok: false, error: "publication_ownership_changed", at });
+    } catch (err2) {
+      return json3(409, { ok: false, error: "publication_ownership_unknown", message: describe12(err2), at });
+    }
+  }
+  const { idle: _idle, recovery: _recovery, ...rowWithoutLifecycle } = row2;
   const updated = {
-    ...idle !== void 0 || segment !== void 0 ? row2 : rowWithoutIdle,
+    ...idle !== void 0 || segment !== void 0 ? row2 : rowWithoutLifecycle,
+    ...row2.recovery !== void 0 ? {
+      recoveryReceipt: {
+        reviewRunId: row2.recovery.reviewRunId,
+        workflowId: row2.recovery.workflowId,
+        at
+      }
+    } : {},
+    ...recoveryHold !== void 0 ? { recoveryHold } : {},
     ...pr && typeof pr.number === "number" && typeof pr.url === "string" ? { pr: { number: pr.number, url: pr.url } } : {},
     ...lastPush !== void 0 ? { lastPush } : {},
     ...idle !== void 0 ? { idle } : segment !== void 0 ? { segments: segments2.some((s) => s.index === segment.index) ? segments2 : [...segments2, { ...segment, at }] } : {
@@ -74069,9 +74829,32 @@ async function unitEnd(body, deps) {
       }
     }
   };
-  await deps.instances.putUnits([updated]);
+  if (row2.recovery !== void 0) {
+    let replaced;
+    try {
+      replaced = await deps.instances.compareAndReplaceUnit(row2, updated);
+    } catch {
+      const reread = await deps.instances.listUnits(instance.id).catch(() => void 0);
+      const current = reread?.filter((candidate) => candidate.unit === row2.unit);
+      if (current?.length === 1 && (JSON.stringify(current[0]) === JSON.stringify(updated) || current[0].recovery === void 0 && current[0].recoveryReceipt?.workflowId === row2.recovery.workflowId && current[0].recoveryReceipt?.reviewRunId === row2.recovery.reviewRunId))
+        replaced = { ok: true };
+      else if (current?.length === 1 && JSON.stringify(current[0]) === JSON.stringify(row2))
+        return json3(503, { ok: false, error: "recovery_store_unavailable", at });
+      else return json3(409, { ok: false, error: "recovery_claim_stale", at });
+    }
+    if (replaced?.ok !== true)
+      return json3(409, {
+        ok: false,
+        error: replaced?.reason === "stale" ? "recovery_claim_stale" : "recovery_store_unavailable",
+        at
+      });
+  } else await deps.instances.putUnits([updated]);
   if (segment === void 0 && idle === void 0 && updated.pr !== void 0)
-    deps.runnerOwnership?.release(instance.repo, updated.pr.number);
+    deps.runnerOwnership?.release(
+      instance.repo,
+      updated.pr.number,
+      row2.recovery !== void 0 ? { instanceId: instance.id, unit: row2.unit } : void 0
+    );
   const thread = unitThread(instance, updated, units.length);
   if (host.kind === "host")
     await hostPublish(
@@ -74092,7 +74875,7 @@ async function unitEnd(body, deps) {
       at
     );
   const io = thread.threadKey !== void 0 ? deps.ioFor({ threadKey: thread.threadKey, userId: instance.userId }) : void 0;
-  if (segment === void 0 && idle === void 0) {
+  if (segment === void 0 && idle === void 0 && row2.recovery === void 0) {
     const leftovers = await deps.instances.listEvents({ instanceId: instance.id, unit: row2.unit }, true).catch(() => []);
     if (leftovers.length > 0 && io === void 0) {
       (deps.log ?? console.warn)(
@@ -74131,6 +74914,13 @@ async function unitEnd(body, deps) {
       );
     }
   }
+  if (segment === void 0 && idle === void 0 && row2.recovery !== void 0) {
+    const leftovers = await deps.instances.listEvents({ instanceId: instance.id, unit: row2.unit }, true).catch(() => []);
+    if (leftovers.length > 0)
+      (deps.log ?? console.warn)(
+        `[coordinator] ${instance.id} ${row2.unit}: ${leftovers.length} recovery event(s) stay unconsumed \u2014 terminal recovery never redispatches a replacement pipeline`
+      );
+  }
   let told = false;
   if (io && threadReport.length === 0)
     told = true;
@@ -74200,10 +74990,15 @@ async function rebaseStep(body, deps) {
   if (!row2) return json3(404, { ok: false, error: "unknown_unit", at });
   if (row2.pr?.number !== void 0 && row2.pr.number !== body.prNumber)
     return json3(409, { ok: false, error: "pull_request_moved", at });
-  deps.runnerOwnership?.claim(instance.repo, body.prNumber, {
-    instanceId: instance.id,
-    unit: row2.unit
-  });
+  try {
+    if (deps.runnerOwnership?.claim(instance.repo, body.prNumber, {
+      instanceId: instance.id,
+      unit: row2.unit
+    }) !== true)
+      return json3(409, { ok: false, error: "publication_ownership_changed", at });
+  } catch (err2) {
+    return json3(503, { ok: false, error: "publication_ownership_unknown", message: describe12(err2), at });
+  }
   if (deps.runnerRebase === void 0)
     return json3(200, { ok: true, outcome: "refused", reason: "the runner's rebase resolver is unavailable", at });
   try {
@@ -74365,7 +75160,7 @@ async function merge(body, deps, subject2) {
     });
   if (checks.failed.length > 0) return refused7(`CI is red at \`${headSha.slice(0, 7)}\`: ${checks.failed.join(", ")}`);
   if (checks.total === 0) {
-    deps.noteMergeWait?.(headSha, id.value, at);
+    deps.noteMergeWait?.(headSha, unit.row?.recovery?.workflowId ?? id.value, at);
     return json3(200, {
       ok: true,
       outcome: "pending",
@@ -74374,7 +75169,7 @@ async function merge(body, deps, subject2) {
     });
   }
   if (checks.pending.length > 0) {
-    deps.noteMergeWait?.(headSha, id.value, at);
+    deps.noteMergeWait?.(headSha, row2.recovery?.workflowId ?? id.value, at);
     return json3(200, {
       ok: true,
       outcome: "pending",
@@ -74484,7 +75279,7 @@ async function checksStep(body, deps) {
     };
   }
   if (checks === void 0 || checks.pending.length > 0 || (checks.expected?.length ?? 0) > 0 || checks.total === 0 || facts2?.draft === true)
-    deps.noteMergeWait?.(headSha, id.value, at);
+    deps.noteMergeWait?.(headSha, unit.row?.recovery?.workflowId ?? id.value, at);
   if (checks !== void 0 && checks.failed.length > 0)
     log(
       `[coordinator] ${instance.id} ${body.unit}: CI red at ${headSha.slice(0, 7)} \u2014 ${checks.failed.map((f) => `${f.name} (${f.conclusion}${f.flakeSuspect === true ? ", suspected flake" : ""})`).join(", ")}`
@@ -74689,6 +75484,8 @@ async function answerCoordinatorStep(door, body, deps) {
       return steerChild(parsed.value, deps);
     case "pr-check":
       return prCheck(parsed.value, deps);
+    case "recover-unit":
+      return recoverOriginalUnit(parsed.value, deps);
     case "round":
       return round(parsed.value, deps);
     case "unit-end":
@@ -74734,7 +75531,7 @@ function createAdminCoordinatorHandler(deps) {
     })();
   };
 }
-var COORDINATOR_ADMIN_PREFIX, MAX_SPAWN_PROMPT_CHARS, FINISHED_LOOKBACK_PAGES, MAX_ADMIN_BODY_BYTES, UNIT_ID, PRESETS_OF_KIND, invalid, json3, describe12, isGenerated2, EVERY_RUN, REVIEW_POSTED_CHECKS, REVIEW_POSTED_RECHECK_MS, githubSecondStart, CHILD_SUPERSESSION_REASONS, ROUND_OUTCOMES, ENDING_ICON, STEPS;
+var COORDINATOR_ADMIN_PREFIX, MAX_SPAWN_PROMPT_CHARS, FINISHED_LOOKBACK_PAGES, MAX_ADMIN_BODY_BYTES, UNIT_ID, PRESETS_OF_KIND, invalid, json3, describe12, isGenerated2, EVERY_RUN, REVIEW_POSTED_CHECKS, REVIEW_POSTED_RECHECK_MS, githubSecondStart, CHILD_SUPERSESSION_REASONS, PublicationBindingRefusal, samePublicationOwner, fullHead, ROUND_OUTCOMES, ENDING_ICON, STEPS;
 var init_adminCoordinator = __esm({
   "../../src/channels/adminCoordinator.ts"() {
     "use strict";
@@ -74790,6 +75587,15 @@ var init_adminCoordinator = __esm({
     REVIEW_POSTED_RECHECK_MS = 2e3;
     githubSecondStart = (at) => Math.floor(at / SECOND_MS) * SECOND_MS;
     CHILD_SUPERSESSION_REASONS = /* @__PURE__ */ new Set(["merged", "closed", "head_moved", "branch_deleted"]);
+    PublicationBindingRefusal = class extends Error {
+      constructor(reason2) {
+        super(reason2);
+        this.reason = reason2;
+      }
+      reason;
+    };
+    samePublicationOwner = (left, right) => left?.instanceId === right.instanceId && left.unit === right.unit;
+    fullHead = (value) => typeof value === "string" && /^[0-9a-f]{40}$/i.test(value);
     ROUND_OUTCOMES = [
       "started",
       "pr_opened",
@@ -74823,6 +75629,7 @@ var init_adminCoordinator = __esm({
       "read-record",
       "steer",
       "pr-check",
+      "recover-unit",
       "round",
       "unit-end",
       "unit-wake",
@@ -76103,7 +76910,7 @@ async function runBot() {
       workflow: checksWorkflow,
       now: systemClock
     });
-    const coordinatorAdmin = createAdminCoordinatorHandler({
+    const coordinatorDeps = {
       tokens: processSecrets.get("SWITCHBOARD_INGRESS_TOKENS"),
       childAdmission: coordinatorChildAdmission,
       grantsFor: (id) => config.grantsFor(id),
@@ -76213,8 +77020,20 @@ async function runBot() {
         return classifyRoundChecks(runs, changed, required);
       },
       rerunFailedChecks: rerunFailedJobs,
-      refirePullRequest: refirePullRequestEvent
-    });
+      refirePullRequest: refirePullRequestEvent,
+      startRecovery: (id, params) => createInstanceViaShim(processShimOptions(), id, params),
+      recoveryStatus: (id) => fetchInstanceStatusViaShim(processShimOptions(), id)
+    };
+    const coordinatorAdmin = createAdminCoordinatorHandler(coordinatorDeps);
+    deps.recoverOriginalUnit = async (key, caller) => {
+      const answer = await recoverOriginalUnit(
+        { parentInstanceId: key.instanceId, unit: key.unit },
+        coordinatorDeps,
+        caller
+      );
+      const body = typeof answer.body === "object" && answer.body !== null && !Array.isArray(answer.body) ? answer.body : { error: "original-unit recovery returned an unreadable answer" };
+      return { status: answer.status, body };
+    };
     const cronArmed = Object.values(auth.tokens).some((id) => id.subject === "cron");
     const schedulesState = `${SCHEDULES.length} schedule(s) on /runs (${capabilities.schedules ? `firings from ${config.config.schedules?.worker?.baseUrl}` : "no firing store"}; cron identity ${cronArmed ? "armed" : "NOT in SWITCHBOARD_INGRESS_TOKENS \u2014 scheduled runs fail closed"})`;
     const webAssets = loadWebAssets(webDistDir(publicEnv(), PACKAGE_ROOT));