@coreplane/switchboard 1.261.4 → 1.262.0

package/dist/assets/deploy/cloudflare/coordinator.ts

@@ -22,7 +22,9 @@ import { NonRetryableError } from "cloudflare:workflows";
 import { COORDINATOR_IDENTITY, COORDINATOR_STEP_PATH_PREFIX } from "../../src/core/coordinator/contract.ts";
 import {
   readBotAnswer,
+  runOriginalUnitRecovery,
   runPlan,
+  type OriginalUnitRecoveryParams,
   type CoordinatorBot,
   type PlanRunSummary,
   type StepRunner,
@@ -38,7 +40,17 @@ export type CoordinatorEnv = Pick<Env, "SWITCHBOARD" | "SWITCHBOARD_INGRESS_TOKE
 /** What an instance is created with: nothing the driver reads — the instance
  *  id names the plan, and the bot's rows are the input (the coordinator's
  *  contract: ids only, never a task's text or a thread's contents). */
-export type ShipCoordinatorParams = Record<string, unknown>;
+export type ShipCoordinatorParams = Record<string, unknown> | OriginalUnitRecoveryParams;
+
+function originalUnitRecoveryParams(value: ShipCoordinatorParams): OriginalUnitRecoveryParams | undefined {
+  if (
+    value.kind !== "recover-original-unit" ||
+    typeof value.parentInstanceId !== "string" ||
+    typeof value.unit !== "string"
+  )
+    return undefined;
+  return { kind: value.kind, parentInstanceId: value.parentInstanceId, unit: value.unit };
+}
 
 /** The bot behind the container binding: the reply as the wire carried it.
  *  The transport's failures throw for the step's retry; the door's own refusal
@@ -81,6 +93,11 @@ function workflowSteps(step: WorkflowStep): StepRunner {
 
 export class ShipCoordinator extends WorkflowEntrypoint<CoordinatorEnv, ShipCoordinatorParams> {
   async run(event: Readonly<WorkflowEvent<ShipCoordinatorParams>>, step: WorkflowStep): Promise<PlanRunSummary> {
+    if (event.payload.kind === "recover-original-unit") {
+      const params = originalUnitRecoveryParams(event.payload);
+      if (params === undefined) throw new NonRetryableError("the original-unit recovery params are malformed");
+      return runOriginalUnitRecovery(workflowSteps(step), containerBot(this.env), event.instanceId, params);
+    }
     return runPlan(workflowSteps(step), containerBot(this.env), event.instanceId);
   }
 }

package/dist/assets/deploy/cloudflare/worker.ts

@@ -325,7 +325,10 @@ async function handleCoordinatorInstances(request: Request, env: Env): Promise<R
       const existing = await (await env.SHIP_COORDINATOR.get(parsed.id)).status();
       outcome = { kind: "duplicate", id: parsed.id, status: existing.status };
     } catch {
-      outcome = { kind: "failed", id: parsed.id, reason };
+      // Creation may have committed before its response was lost. When the
+      // status read is also unavailable, do not call that a definite failure:
+      // the bot must retain its same-id claim for a later duplicate replay.
+      return json(503, { ok: false, error: "create_unanswered", message: reason });
     }
   }
   console.log(`[coordinator] ${auth.subject} → instance ${parsed.id}: ${outcome.kind}`);

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -117,6 +117,7 @@ import {
   sendRunFinished,
   STEP_NAME_PATTERN,
   UNIT_PATTERN,
+  unitOfIdempotencyKey,
   type CoordinatorInstance,
   type CoordinatorUnit,
   type RunFinishedSend,
@@ -2771,6 +2772,37 @@ export class RunHistoryDO extends DurableObject<Env> {
       .map((r) => JSON.parse(r.json) as CoordinatorUnit);
   }
 
+  async listActiveRecoveries(): Promise<CoordinatorUnit[]> {
+    return this.sql
+      .exec<{ json: string }>(
+        `SELECT json FROM coordinator_units
+         WHERE json_valid(json) = 0 OR json_type(json, '$.recovery') IS NOT NULL
+         ORDER BY rowid`,
+      )
+      .toArray()
+      .map((r) => {
+        const unit: unknown = JSON.parse(r.json);
+        if (!isCoordinatorUnit(unit) || unit.recovery === undefined)
+          throw new Error("active recovery index contains a malformed coordinator unit");
+        return unit;
+      });
+  }
+
+  private recoveryTransport(parentInstanceId: string, idempotencyKey: string | undefined): string | undefined {
+    const unit = idempotencyKey === undefined ? undefined : unitOfIdempotencyKey(idempotencyKey);
+    if (unit === undefined) return undefined;
+    const row = this.sql
+      .exec<{ json: string }>(
+        `SELECT json FROM coordinator_units WHERE instance_id = ? AND unit = ?`,
+        parentInstanceId,
+        unit,
+      )
+      .toArray()[0];
+    if (row === undefined) return undefined;
+    const parsed = JSON.parse(row.json) as CoordinatorUnit;
+    return parsed.recovery?.workflowId;
+  }
+
   // ---- the thread events of a unit-owned thread (record 0051's reply-as-event rule) --------------
 
   /** The next sequence assigned in one transaction, the per-event cap applied
@@ -3025,9 +3057,11 @@ export class RunHistoryDO extends DurableObject<Env> {
       // tells the waiting parent the child resumed — best effort, beside the
       // bot's own announcement; a duplicate is consumed and re-armed, harmless.
       if (req.meta.restartOf !== undefined && req.meta.parentInstanceId !== undefined) {
+        const recoveryTransport = this.recoveryTransport(req.meta.parentInstanceId, req.meta.idempotencyKey);
         const sent = await sendChildSignal(this.env.SHIP_COORDINATOR, {
           runId: req.runId,
           parentInstanceId: req.meta.parentInstanceId,
+          ...(recoveryTransport !== undefined ? { transportWorkflowId: recoveryTransport } : {}),
           kind: "resumed",
           reason: `restarted from run ${req.meta.restartOf}`,
           at: now,
@@ -3318,7 +3352,14 @@ export class RunHistoryDO extends DurableObject<Env> {
     if ((await this.ctx.storage.getAlarm()) === null)
       await this.ctx.storage.setAlarm(systemClock() + RUN_SWEEP_INTERVAL_MS);
     await this.refreshSessionBytes(record.session?.key);
-    const event = await sendRunFinished(this.env.SHIP_COORDINATOR, record);
+    const transportWorkflowId =
+      record.parentInstanceId === undefined
+        ? undefined
+        : this.recoveryTransport(record.parentInstanceId, record.idempotencyKey);
+    const event = await sendRunFinished(this.env.SHIP_COORDINATOR, {
+      ...record,
+      ...(transportWorkflowId !== undefined ? { transportWorkflowId } : {}),
+    });
     if (event.kind === "failed")
       console.warn(`[runs/finish] ${runId} → ${event.type} not delivered to ${event.instance}: ${event.reason}`);
     return { ...out, event: event.kind };
@@ -3654,7 +3695,11 @@ export class RunHistoryDO extends DurableObject<Env> {
     // `finishedAt` equals `startedAt`); the parent confirms by `read-record`
     // before it acts, so a duplicate send is harmless.
     if (result.stored && record.parentInstanceId !== undefined && record.finishedAt > record.startedAt) {
-      const event = await sendRunFinished(this.env.SHIP_COORDINATOR, record);
+      const transportWorkflowId = record.events.find((event) => event.type === "coordinator_tag")?.transportWorkflowId;
+      const event = await sendRunFinished(this.env.SHIP_COORDINATOR, {
+        ...record,
+        ...(transportWorkflowId !== undefined ? { transportWorkflowId } : {}),
+      });
       if (event.kind === "failed")
         console.warn(`[runs/put] ${record.id} → ${event.type} not delivered to ${event.instance}: ${event.reason}`);
     }
@@ -5220,6 +5265,7 @@ const LEDGER_ROUTES = new Set([
   "/runs/coordinator/stop",
   "/runs/coordinator/units/put",
   "/runs/coordinator/units/claim-legacy-continuation",
+  "/runs/coordinator/units/list-active-recoveries",
   "/runs/coordinator/units/list",
   "/runs/coordinator/events/append",
   "/runs/coordinator/events/list",
@@ -5935,6 +5981,8 @@ async function handleLedger(pathname: string, body: unknown, env: Env): Promise<
       return json({ error: "instanceId must be a Workflow instance id" }, 400);
     return json({ units: await stub.listUnits(b.instanceId) });
   }
+  if (pathname === "/runs/coordinator/units/list-active-recoveries")
+    return json({ units: await stub.listActiveRecoveries() });
   if (pathname === "/runs/coordinator/wake") {
     if (!isCoordinatorUnit(b.unit)) return json({ error: "unit must be a coordinator unit row" }, 400);
     if (typeof b.waitId !== "string" || !STEP_NAME_PATTERN.test(b.waitId))

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.261.4",
+  "version": "1.262.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.261.4",
+      "version": "1.262.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -21060,7 +21060,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.261.4",
+      "version": "1.262.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.261.4",
+  "version": "1.262.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.261.4",
-  "commit": "9f4d0f4c9645ea67ecab3ede2455e658f38a7d4c",
-  "builtAt": "2026-09-24T16:28:36.099Z"
+  "version": "1.262.0",
+  "commit": "90124c1dfe74e65a447d2ef33eebd01e998486e0",
+  "builtAt": "2026-09-24T21:21:11.789Z"
 }

package/dist/assets/src/core/coordinator/contract.ts

@@ -313,6 +313,20 @@ export interface ExistingPrPublicationBinding {
 export interface CoordinatorTag {
   parentInstanceId: string;
   idempotencyKey: string;
+  /** Workflow transport for a recovered child. Identity and idempotency remain
+   * on `parentInstanceId`; only lifecycle wake-ups use this checkpoint id. */
+  transportWorkflowId?: string;
+  /** The immutable target and absolute lease of an original-unit recovery.
+   * Stored on the coordinator event so a resume or request-restart cannot turn
+   * the remaining lease into a fresh relative budget or adopt another head. */
+  recovery?: {
+    repo: string;
+    pr: number;
+    headRef: string;
+    baseRef: string;
+    expectedHeadSha: string;
+    deadlineAt: number;
+  };
   /** The branch the child's pull request targets: the plan's base
    *  (`CoordinatorInstance.base`), set by the spawn when the instance knows it.
    *  A coordinator's child is dispatched AT its unit branch so the resident
@@ -477,6 +491,45 @@ export interface RoundGate {
   findings: string[];
 }
 
+/** One admitted continuation of an ended original unit. The claim replaces
+ * the terminal interpretation before a child starts; its step remains under
+ * the original instance/unit idempotency namespace. */
+export interface OriginalUnitRecovery {
+  kind: "findings" | "review";
+  round: number;
+  expectedHeadSha: string;
+  remainingMs: number;
+  claimedAt: number;
+  step: string;
+  /** The original review record that authorizes this transition. */
+  reviewRunId: string;
+  /** A completed findings child that already advanced the original unit before
+   * recovery was claimed. Present only when recovery starts at re-review. */
+  findingsRunId?: string;
+  /** Exact durable key of that completed original findings child. */
+  findingsKey?: string;
+  /** The posted request-changes findings, retained so a Workflow restart can
+   * rebuild the exact findings state without trusting a later listing. */
+  findings?: import("../reviewVerdict.js").Finding[];
+  /** The exact terminal value replaced by the claim, for fail-closed rollback
+   * if the Workflow cannot be admitted. */
+  previousEnding: NonNullable<CoordinatorUnit["ending"]>;
+  /** The separate Workflow execution checkpoint. This is transport identity,
+   * not a replacement coordinator/unit identity. */
+  workflowId: string;
+  /** Absolute end of the original active lease. Delayed Workflow admission or
+   * replay cannot turn the claim's snapshot into fresh time. */
+  deadlineAt: number;
+  /** Exact durable child key of the review outcome that authorized recovery. */
+  reviewKey: string;
+}
+
+export interface OriginalUnitRecoveryReceipt {
+  reviewRunId: string;
+  workflowId: string;
+  at: number;
+}
+
 /** One unit of the plan an instance runs (a task string is a generated plan of
  *  one unit, `U1`): its branch, the units it waits on, and — as the runner
  *  reaches it — its thread, its pull request, the round boundaries the card
@@ -543,6 +596,15 @@ export interface CoordinatorUnit {
    *  item 9) — a mismatch to be seen, since the child's parser holds an approve
    *  to the same level. */
   rounds: Array<{ index: number; agent: string; outcome: string; at: number; gate?: RoundGate }>;
+  /** An explicit recovery claim for this same durable unit. It is mutually
+   * exclusive with both `idle` and `ending`; legacy readers otherwise keep
+   * their existing decoding rules. */
+  recovery?: OriginalUnitRecovery;
+  /** The authorizing review already consumed by a completed recovery. */
+  recoveryReceipt?: OriginalUnitRecoveryReceipt;
+  /** A recovered review that reached a person-only question. Recovery settles
+   * truthfully instead of opening an idle renewal or replacement pipeline. */
+  recoveryHold?: { cause: "human"; gate: HumanGatePending } | { cause: "draft"; pr: { number: number; url: string } };
   /** How the unit ended: the ending's kind and the thread's report, when it
    *  has. `cause` names the machine's reason behind a driver-posted kind;
    *  `step` and `round` locate that reason without parsing the report. For a
@@ -727,6 +789,64 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
     )
   )
     return false;
+  if (
+    r.recovery !== undefined &&
+    !(
+      isObject(r.recovery) &&
+      (r.recovery.kind === "findings" || r.recovery.kind === "review") &&
+      typeof r.recovery.round === "number" &&
+      Number.isInteger(r.recovery.round) &&
+      r.recovery.round >= 1 &&
+      typeof r.recovery.expectedHeadSha === "string" &&
+      /^[0-9a-f]{40}$/i.test(r.recovery.expectedHeadSha) &&
+      isFinite(r.recovery.remainingMs) &&
+      r.recovery.remainingMs > 0 &&
+      isFinite(r.recovery.claimedAt) &&
+      typeof r.recovery.step === "string" &&
+      STEP_NAME_PATTERN.test(r.recovery.step) &&
+      isText(r.recovery.reviewRunId) &&
+      (r.recovery.findingsRunId === undefined || isText(r.recovery.findingsRunId)) &&
+      (r.recovery.findingsKey === undefined || isText(r.recovery.findingsKey)) &&
+      ((r.recovery.findingsRunId === undefined && r.recovery.findingsKey === undefined) ||
+        (r.recovery.kind === "review" &&
+          r.recovery.findingsRunId !== undefined &&
+          r.recovery.findingsKey !== undefined)) &&
+      (r.recovery.findings === undefined ||
+        (Array.isArray(r.recovery.findings) && r.recovery.findings.every(isFindingShape))) &&
+      isObject(r.recovery.previousEnding) &&
+      isText(r.recovery.previousEnding.kind) &&
+      typeof r.recovery.previousEnding.report === "string" &&
+      isFinite(r.recovery.previousEnding.at) &&
+      typeof r.recovery.workflowId === "string" &&
+      INSTANCE_ID_PATTERN.test(r.recovery.workflowId) &&
+      isFinite(r.recovery.deadlineAt) &&
+      isText(r.recovery.reviewKey)
+    )
+  )
+    return false;
+  if (
+    r.recoveryReceipt !== undefined &&
+    (!isObject(r.recoveryReceipt) ||
+      !isText(r.recoveryReceipt.reviewRunId) ||
+      typeof r.recoveryReceipt.workflowId !== "string" ||
+      !INSTANCE_ID_PATTERN.test(r.recoveryReceipt.workflowId) ||
+      !isFinite(r.recoveryReceipt.at))
+  )
+    return false;
+  if (
+    r.recoveryHold !== undefined &&
+    (!isObject(r.recoveryHold) ||
+      !(
+        (r.recoveryHold.cause === "human" && isHumanGatePending(r.recoveryHold.gate)) ||
+        (r.recoveryHold.cause === "draft" &&
+          isObject(r.recoveryHold.pr) &&
+          Number.isInteger(r.recoveryHold.pr.number) &&
+          (r.recoveryHold.pr.number as number) > 0 &&
+          isText(r.recoveryHold.pr.url))
+      ))
+  )
+    return false;
+  if (r.recovery !== undefined && (r.idle !== undefined || r.ending !== undefined)) return false;
   if (
     r.ending !== undefined &&
     !(
@@ -829,13 +949,20 @@ export async function sendPullMerged(
  *  send costs the wait a chunk, never the round. */
 export async function sendChildSignal(
   workflow: WorkflowSender | undefined,
-  signal: { runId: string; parentInstanceId: string; kind: "interrupted" | "resumed"; reason: string; at: number },
+  signal: {
+    runId: string;
+    parentInstanceId: string;
+    transportWorkflowId?: string;
+    kind: "interrupted" | "resumed";
+    reason: string;
+    at: number;
+  },
 ): Promise<RunFinishedSend> {
   const { runId, parentInstanceId: instance, kind, reason, at } = signal;
   if (!workflow) return { kind: "no-binding", instance };
   const type = kind === "interrupted" ? childInterruptedEventType(runId) : childResumedEventType(runId);
   try {
-    const handle = await workflow.get(instance);
+    const handle = await workflow.get(signal.transportWorkflowId ?? instance);
     await handle.sendEvent({ type, payload: { runId, kind, reason, at, parentInstanceId: instance } });
     return { kind: "sent", instance, type };
   } catch (err) {
@@ -846,7 +973,13 @@ export async function sendChildSignal(
 /** The one send per committed terminal record (run-history item 47). */
 export async function sendRunFinished(
   workflow: WorkflowSender | undefined,
-  record: { id: string; status: string; finishedAt: number; parentInstanceId?: string },
+  record: {
+    id: string;
+    status: string;
+    finishedAt: number;
+    parentInstanceId?: string;
+    transportWorkflowId?: string;
+  },
 ): Promise<RunFinishedSend> {
   const instance = record.parentInstanceId;
   if (instance === undefined) return { kind: "none" };
@@ -859,7 +992,7 @@ export async function sendRunFinished(
     parentInstanceId: instance,
   };
   try {
-    const handle = await workflow.get(instance);
+    const handle = await workflow.get(record.transportWorkflowId ?? instance);
     await handle.sendEvent({ type, payload });
     return { kind: "sent", instance, type };
   } catch (err) {