@coreplane/switchboard 1.261.4 → 1.262.1

package/dist/assets/src/core/coordinator/driver.ts

@@ -55,6 +55,7 @@ import {
   cursorFinished,
   nextAction,
   openPlanCursor,
+  openRecoveredUnitPipeline,
   openUnitPipeline,
   readyUnits,
   type PlanCursor,
@@ -76,6 +77,7 @@ import {
   type ShipCaps,
   type StepReturn,
   type UnitEnding,
+  type UnitPipelineInput,
   type UnitPipelineState,
   stepPrefixOf,
   type LeaseSegmentProgress,
@@ -114,6 +116,7 @@ export interface StepRunner {
 }
 
 export type CoordinatorStepRoute =
+  | "recover-unit"
   | "plan"
   | "unit-start"
   | "branch"
@@ -159,6 +162,12 @@ export interface PlanRunSummary {
   outcome: "completed" | "failed";
 }
 
+export interface OriginalUnitRecoveryParams {
+  kind: "recover-original-unit";
+  parentInstanceId: string;
+  unit: string;
+}
+
 // ---- reading the bot ---------------------------------------------------------------------------------
 
 const REASON_MAX = 200;
@@ -199,6 +208,7 @@ const TRANSIENT = new Set([
   "unit_not_started",
   "not_host",
   "queued",
+  "publication_ownership_unknown",
 ]);
 export function transientRefusal(answer: BotAnswer): string | undefined {
   const { ok, error, message } = answer.body;
@@ -917,6 +927,8 @@ async function tellStepThrew(
   pr: { number: number; url: string } | undefined,
   at: StepAt,
   err: unknown,
+  recoveryUnitKey?: string,
+  recoveryWorkflowId?: string,
 ): Promise<void> {
   const line = oneLineOf(err);
   const where =
@@ -932,14 +944,19 @@ async function tellStepThrew(
         pr !== undefined
           ? `Saved-work fact: the existing pull request is ${pr.url}, but its current branch and exact head were not verified.`
           : "Saved-work fact: no open pull request or exact remote head was verified.",
-        "No review was started. Next action: retry ship when the pull request is readable so Switchboard can verify the exact head first.",
+        recoveryUnitKey !== undefined
+          ? `No review was started. The recovery attempt for \`${recoveryUnitKey}\` is terminal; a replacement pipeline is not available.`
+          : "No review was started. Next action: retry ship when the pull request is readable so Switchboard can verify the exact head first.",
       ].join("\n\n")
     : [
         `⚠️ Switchboard failed ${where}: ${line}`,
-        "The unit remains resumable from its recorded branch and pull request facts. No continuation action was scheduled. Next action: start ship again after the failing operation is available.",
+        recoveryUnitKey !== undefined
+          ? `The recovery attempt for \`${recoveryUnitKey}\` is terminal. No continuation or replacement pipeline was scheduled.`
+          : "The unit remains resumable from its recorded branch and pull request facts. No continuation action was scheduled. Next action: start ship again after the failing operation is available.",
       ].join("\n\n");
   const body = {
     ...tag,
+    ...(recoveryWorkflowId !== undefined ? { recoveryWorkflowId } : {}),
     ending: {
       kind: "failed",
       cause: "step_threw",
@@ -974,7 +991,8 @@ async function runUnit(
   // A renewal's segment names its steps under the segment (`U10/s2/…`), so
   // the Workflow's durable step cache never answers segment two with segment
   // one's results (decision 0046).
-  const prefix = stepPrefixOf(unit, session);
+  const row = plan.units.find((u) => u.unit === unit);
+  const prefix = row?.recovery !== undefined ? `${unit}/recovery` : stepPrefixOf(unit, session);
   const tag = { parentInstanceId: instanceId, unit };
   // Where the machine is, tracked for the step-threw ending (issue 2100). The
   // start belongs in the same net as the rest of the unit even though no
@@ -982,54 +1000,106 @@ async function runUnit(
   let last: StepAt = { step: `${prefix}/start` };
   let start: ReturnType<typeof readUnitStart>;
   try {
-    const startStep = `${prefix}/start`;
-    last = { step: startStep };
-    start = readUnitStart(
-      answerOf("unit-start", await step.do(startStep, STEP_CONFIG, () => call(bot, "unit-start", tag))),
-    );
+    if (row?.recovery !== undefined) start = { at: row.recovery.claimedAt };
+    else {
+      const startStep = `${prefix}/start`;
+      last = { step: startStep };
+      start = readUnitStart(
+        answerOf("unit-start", await step.do(startStep, STEP_CONFIG, () => call(bot, "unit-start", tag))),
+      );
+    }
   } catch (err) {
-    await tellStepThrew(step, bot, prefix, tag, undefined, last, err);
+    await tellStepThrew(
+      step,
+      bot,
+      prefix,
+      tag,
+      undefined,
+      last,
+      err,
+      row?.recovery !== undefined ? `${instanceId}:${unit}` : undefined,
+      row?.recovery?.workflowId,
+    );
     throw err;
   }
   // A resume at review (agent-ship item 10) rides the unit's row: the pull
   // request of ship's own the requester named opens the pipeline at its first
   // review round, with no pre-check, no branch and no round 0.
-  const row = plan.units.find((u) => u.unit === unit);
   const resume = row?.resume;
   // A previous attempt's `review_pending` head: the machine's pre-check starts
   // at the review round when the open pull request still heads exactly there.
   const lastPush = row?.lastPush;
-  let state: UnitPipelineState = openUnitPipeline(
-    {
-      unit: { id: unit, branch: node.branch },
-      repo: plan.repo,
-      base: plan.base,
-      caps: plan.caps,
-      // The instance's field decides who merges (record 0031's merge grant),
-      // carried here by the plan route: the hand-off wrote `runner` on a
-      // seeded plan and `person` on a task, and the door re-checks it — the
-      // branch's name never decides.
-      merge: plan.merge,
-      addressSeverity: plan.addressSeverity,
-      addressSeveritySource: plan.addressSeveritySource,
-      grant: plan.grant,
-      grantSource: plan.grantSource,
-      verbosity: plan.verbosity,
-      idleDays: plan.idleDays,
-      generated: plan.generated,
-      ...(plan.runPageBase !== undefined ? { runPageBase: plan.runPageBase } : {}),
-      ...(resume !== undefined ? { resume } : {}),
-      ...(lastPush !== undefined ? { lastPush } : {}),
-      ...(session !== undefined ? { session } : {}),
-    },
-    start.at,
-  );
+  const input: UnitPipelineInput = {
+    unit: { id: unit, branch: node.branch },
+    repo: plan.repo,
+    base: plan.base,
+    caps: plan.caps,
+    // The instance's field decides who merges (record 0031's merge grant),
+    // carried here by the plan route: the hand-off wrote `runner` on a
+    // seeded plan and `person` on a task, and the door re-checks it — the
+    // branch's name never decides.
+    merge: plan.merge,
+    addressSeverity: plan.addressSeverity,
+    addressSeveritySource: plan.addressSeveritySource,
+    // Recovery spends only the lease already carried by the claim. It never
+    // opens another segment or idles for a renewal in this checkpoint.
+    grant: row?.recovery !== undefined ? { renewals: 0 } : plan.grant,
+    grantSource: plan.grantSource,
+    verbosity: plan.verbosity,
+    idleDays: row?.recovery !== undefined ? 0 : plan.idleDays,
+    generated: plan.generated,
+    ...(plan.runPageBase !== undefined ? { runPageBase: plan.runPageBase } : {}),
+    ...(resume !== undefined ? { resume } : {}),
+    ...(lastPush !== undefined ? { lastPush } : {}),
+    ...(session !== undefined ? { session } : {}),
+    ...(row?.recovery !== undefined
+      ? { recovery: { remainingMs: row.recovery.remainingMs, unitKey: `${instanceId}:${unit}` } }
+      : {}),
+  };
+  let state: UnitPipelineState =
+    row?.recovery !== undefined
+      ? openRecoveredUnitPipeline(input, start.at, {
+          kind: row.recovery.kind,
+          round: row.recovery.round,
+          pr: row.pr!,
+          expectedHeadSha: row.recovery.expectedHeadSha,
+          reviewRunId: row.recovery.reviewRunId,
+          ...(row.recovery.findingsRunId !== undefined ? { findingsRunId: row.recovery.findingsRunId } : {}),
+          ...(row.recovery.findings !== undefined ? { findings: row.recovery.findings } : {}),
+        })
+      : openUnitPipeline(input, start.at);
   let notes = 0;
   let endedAt: number | undefined;
   try {
     pipeline: for (;;) {
       const action = nextAction(state);
-      if (action.type === "end") return { ...action.ending, ...(endedAt !== undefined ? { endedAt } : {}) };
+      if (action.type === "end") {
+        if (row?.recovery !== undefined && endedAt === undefined) {
+          const endStep = `${prefix}/end`;
+          const ending = action.ending;
+          const body = {
+            ...tag,
+            recoveryWorkflowId: row.recovery.workflowId,
+            ending: {
+              kind: ending.kind === "idle" && ending.humanGate !== undefined ? "held" : ending.kind,
+              ...(ending.kind === "held" && ending.cause !== undefined ? { holdCause: ending.cause } : {}),
+              report: renderUnitReport(state),
+              threadReport: renderUnitReport(state, undefined, state.input.verbosity ?? DEFAULT_VERBOSITY),
+              ...(ending.kind === "idle" && ending.humanGate !== undefined ? { humanGate: ending.humanGate } : {}),
+            },
+            ...(state.pr !== undefined ? { pr: state.pr } : {}),
+          };
+          const reply = await step.do(endStep, STEP_CONFIG, async () => {
+            const candidate = await call(bot, "unit-end", body);
+            const answer = answerOf("unit-end", candidate);
+            if (answer.status !== 200 || answer.body.ok !== true)
+              throw new UnreadableAnswer("unit-end", answer, "successful settlement");
+            return candidate;
+          });
+          endedAt = answerOf("unit-end", reply).body.at;
+        }
+        return { ...action.ending, ...(endedAt !== undefined ? { endedAt } : {}) };
+      }
       // Keep the current round across its non-round phases (for example merge)
       // while replacing it whenever the pipeline names a new one.
       last = {
@@ -1046,6 +1116,7 @@ async function runUnit(
         if (note.type === "round") {
           const body = {
             ...tag,
+            ...(row?.recovery !== undefined ? { recoveryWorkflowId: row.recovery.workflowId } : {}),
             index: note.index,
             agent: note.agent,
             outcome: note.outcome,
@@ -1053,7 +1124,13 @@ async function runUnit(
           };
           const noteStep = `${prefix}/note/${++notes}`;
           last = { step: noteStep, round: { index: note.index, kind: note.agent } };
-          await step.do(noteStep, STEP_CONFIG, () => call(bot, "round", body));
+          await step.do(noteStep, STEP_CONFIG, async () => {
+            const reply = await call(bot, "round", body);
+            const answer = answerOf("round", reply);
+            if (answer.status !== 200 || answer.body.ok !== true)
+              throw new UnreadableAnswer("round", answer, "successful round persistence");
+            return reply;
+          });
         } else {
           // A merge_ready ending names the pull request as it is at the APPROVED
           // head (agent-ship item 9): one more pr-check reads the facts fresh —
@@ -1116,10 +1193,15 @@ async function runUnit(
           // ending (agent-ship item 14).
           const body = {
             ...tag,
+            ...(row?.recovery !== undefined ? { recoveryWorkflowId: row.recovery.workflowId } : {}),
             // Two copies (routing-and-config item 28): the full report for the
             // row and the board, and the thread's at the request's verbosity.
             ending: {
-              kind: ending.kind,
+              kind:
+                row?.recovery !== undefined && ending.kind === "idle" && ending.humanGate !== undefined
+                  ? "held"
+                  : ending.kind,
+              ...(ending.kind === "held" && ending.cause !== undefined ? { holdCause: ending.cause } : {}),
               report: renderUnitReport(state, endFacts),
               threadReport: renderUnitReport(state, endFacts, state.input.verbosity ?? DEFAULT_VERBOSITY),
               // An idle ending carries its continuation facts (record 0051): the
@@ -1135,6 +1217,9 @@ async function runUnit(
                     ...(ending.humanGate !== undefined ? { humanGate: ending.humanGate } : {}),
                   }
                 : {}),
+              ...(row?.recovery !== undefined && ending.kind === "idle" && ending.humanGate !== undefined
+                ? { humanGate: ending.humanGate }
+                : {}),
             },
             ...(state.pr !== undefined ? { pr: state.pr } : {}),
             // A merge_ready ending retains the exact head its final approval
@@ -1165,7 +1250,13 @@ async function runUnit(
           last = { step: endStep, ...(last.round !== undefined ? { round: last.round } : {}) };
           const endAnswer = answerOf(
             "unit-end",
-            await step.do(endStep, STEP_CONFIG, () => call(bot, "unit-end", body)),
+            await step.do(endStep, STEP_CONFIG, async () => {
+              const reply = await call(bot, "unit-end", body);
+              const answer = answerOf("unit-end", reply);
+              if (answer.status !== 200 || answer.body.ok !== true)
+                throw new UnreadableAnswer("unit-end", answer, "successful settlement");
+              return reply;
+            }),
           );
           endedAt = endAnswer.body.at;
         }
@@ -1174,7 +1265,17 @@ async function runUnit(
   } catch (err) {
     // The walk-dies-before-unit-end path (issue 2100): the throw becomes the
     // unit's ending before it fails the instance, never the bare seal.
-    await tellStepThrew(step, bot, prefix, tag, state.pr, last, err);
+    await tellStepThrew(
+      step,
+      bot,
+      prefix,
+      tag,
+      state.pr,
+      last,
+      err,
+      row?.recovery !== undefined ? `${instanceId}:${unit}` : undefined,
+      row?.recovery?.workflowId,
+    );
     throw err;
   }
 }
@@ -1496,3 +1597,54 @@ export async function runPlan(step: StepRunner, bot: CoordinatorBot, instanceId:
   await finish(summary.outcome);
   return summary;
 }
+
+/** A separate Workflow execution checkpoint that drives exactly one claimed
+ * original unit. Its platform instance id is transport only: every bot call,
+ * child tag and idempotency key continues to name `parentInstanceId + unit`. */
+export async function runOriginalUnitRecovery(
+  step: StepRunner,
+  bot: CoordinatorBot,
+  workflowId: string,
+  params: OriginalUnitRecoveryParams,
+): Promise<PlanRunSummary> {
+  const claim = answerOf(
+    "recover-unit",
+    await step.do("recovery-claim", STEP_CONFIG, async () => {
+      const reply = await call(bot, "recover-unit", {
+        parentInstanceId: params.parentInstanceId,
+        unit: params.unit,
+        workflowId,
+      });
+      const answer = answerOf("recover-unit", reply);
+      if (answer.status !== 200 || answer.body.ok !== true)
+        throw new UnreadableAnswer("recover-unit", answer, "successful recovery claim");
+      return reply;
+    }),
+  );
+  if (claim.body.ok !== true) throw new UnreadableAnswer("recover-unit", claim, "not ok");
+  const plan = readPlan(
+    answerOf(
+      "plan",
+      await step.do("recovery-plan", STEP_CONFIG, () =>
+        call(bot, "plan", { parentInstanceId: params.parentInstanceId }),
+      ),
+    ),
+  );
+  const row = plan.units.filter((candidate) => candidate.unit === params.unit);
+  if (row.length !== 1 || row[0]!.recovery?.workflowId !== workflowId)
+    throw new Error("the original unit's durable recovery claim no longer names this Workflow");
+  const unit = row[0]!;
+  const ending = await runUnit(
+    step,
+    bot,
+    params.parentInstanceId,
+    { id: unit.unit, title: unit.title ?? unit.unit, slug: unit.slug, branch: unit.branch, dependsOn: unit.dependsOn },
+    plan,
+  );
+  return {
+    instance: params.parentInstanceId,
+    ...(plan.planId !== undefined ? { planId: plan.planId } : {}),
+    units: { [params.unit]: ending.kind },
+    outcome: isSettledOutcome(ending.kind) ? "completed" : "failed",
+  };
+}

package/dist/assets/src/core/refusal.ts

@@ -62,6 +62,7 @@ const CAUSE_OF = {
   // one pipeline per thread (record 0060): the host key's claim answered thread-live
   ship_thread_live: "request",
   setup_failed: "system",
+  publication_ownership_unknown: "system",
   // the click on a confirmation (confirm.ts)
   confirmation_used: "request",
   confirmation_expired: "request",

package/dist/assets/src/core/runEvents.ts

@@ -963,6 +963,8 @@ export type RunEvent =
       type: "coordinator_tag";
       parentInstanceId: string;
       unit?: string;
+      transportWorkflowId?: string;
+      recovery?: import("./coordinator/contract.js").CoordinatorTag["recovery"];
       base?: string;
       publication?: import("./coordinator/contract.js").ExistingPrPublicationBinding;
       seq?: number;

package/dist/assets/src/core/ship/coordinator.ts

@@ -1176,6 +1176,10 @@ export interface UnitPipelineInput {
    *  the report's pointer at a child's write-up links its run page with it and
    *  names the run id without it — the machine never reads an environment. */
   runPageBase?: string;
+  /** A terminal original unit re-entered at its unchanged reviewed head. The
+   * exact remaining lease is carried in milliseconds; the step prefix keeps
+   * every new durable step under `<original instance>:<unit>/recovery/...`. */
+  recovery?: { remainingMs: number; unitKey: string };
 }
 
 type Phase =
@@ -1398,8 +1402,56 @@ export function openUnitPipeline(input: UnitPipelineInput, at: number): UnitPipe
   return resumed;
 }
 
+/** Open the narrow unchanged-head recovery directly at the one authorized
+ * child boundary. No branch, pre-check, fresh clock or round zero is invented;
+ * the caller has already CAS-claimed the durable row and verified GitHub. */
+export function openRecoveredUnitPipeline(
+  input: UnitPipelineInput,
+  at: number,
+  recovery: {
+    kind: "findings" | "review";
+    round: number;
+    pr: PrRef;
+    expectedHeadSha: string;
+    reviewRunId: string;
+    findingsRunId?: string;
+    findings?: Finding[];
+  },
+): UnitPipelineState {
+  const base: UnitPipelineState = {
+    input,
+    startedAt: at,
+    clock: at,
+    phase: { at: "ended" },
+    reviewRounds: recovery.round,
+    // These counters name actions inside this new recovery Workflow's distinct
+    // `/recovery/` step namespace; they are not lifetime-unit counters or
+    // budget inputs. The lifetime review-round count is the durable `round`
+    // above, while wall-clock and dollar enforcement come from the claim.
+    rebaseAttempts: 0,
+    reviewRestarts: 0,
+    pr: recovery.pr,
+    lastReviewHead: recovery.expectedHeadSha,
+    // Legacy terminal rows do not carry a complete lifetime category split or
+    // cumulative dollars. Recovery therefore measures only this checkpoint;
+    // admission refuses a cost-capped row rather than resetting an enforced
+    // total, and reports label this split as checkpoint-local.
+    spentMs: { coding: 0, review: 0, waiting: 0 },
+    spendUsd: 0,
+    findingsByRound: recovery.kind === "findings" ? { [recovery.round]: recovery.findings ?? [] } : {},
+    humanAnswersByRound: {},
+    dispositionsByRound: {},
+    reviewRunByRound:
+      recovery.findingsRunId !== undefined
+        ? { [recovery.round - 1]: recovery.reviewRunId }
+        : { [recovery.round]: recovery.reviewRunId },
+    findingsRunByRound: recovery.findingsRunId !== undefined ? { [recovery.round - 1]: recovery.findingsRunId } : {},
+  };
+  return enterRound(base, { index: recovery.round, kind: recovery.kind }).state;
+}
+
 const deadlineAt = (s: UnitPipelineState) =>
-  s.startedAt + (s.input.session?.resume?.leaseMs ?? s.input.caps.maxMinutes * MIN);
+  s.startedAt + (s.input.recovery?.remainingMs ?? s.input.session?.resume?.leaseMs ?? s.input.caps.maxMinutes * MIN);
 const remainingMs = (s: UnitPipelineState) => deadlineAt(s) - s.clock;
 
 /** The next slice of a wait: a chunk; the remainder when less is left before
@@ -1431,7 +1483,8 @@ export const stepPrefixOf = (unit: string, session: LeaseSegmentProgress | undef
   const segment = session !== undefined && session.segment > 1 ? `${unit}/s${session.segment}` : unit;
   return session?.resume !== undefined ? `${segment}/r${session.resume.attempt}` : segment;
 };
-const stepPrefix = (s: UnitPipelineState) => stepPrefixOf(s.input.unit.id, s.input.session);
+const stepPrefix = (s: UnitPipelineState) =>
+  s.input.recovery !== undefined ? `${s.input.unit.id}/recovery` : stepPrefixOf(s.input.unit.id, s.input.session);
 const roundStep = (s: UnitPipelineState, round: RoundRef) =>
   `${stepPrefix(s)}/${round.index}/${round.kind}${round.attempt !== undefined ? `/a${round.attempt}` : ""}`;
 
@@ -1592,7 +1645,9 @@ export function nextAction(s: UnitPipelineState): CoordinatorAction {
       return {
         type: "pr-check",
         step: `${roundStep(s, p.round)}/pr-check`,
-        ...(p.dead !== undefined || p.recover === true ? { recover: { runId: p.runId } } : {}),
+        ...(p.dead !== undefined || p.recover === true || p.findingsReady === true
+          ? { recover: { runId: p.runId } }
+          : {}),
         // The adopted pull request rides the check so the bot can follow it
         // when nothing heads the unit's branch (issue 1799).
         ...(s.pr !== undefined ? { pr: s.pr.number } : {}),
@@ -3610,9 +3665,14 @@ function writeUpPointer(s: UnitPipelineState, kind: RoundKind, runId: string | u
 }
 
 /** How the budget went, in the card's words: coding, review, waiting minutes. */
-function budgetSplitLine(spent: ShipBudgetSpent, maxMinutes: number): string {
+function budgetSplitLine(s: UnitPipelineState, spent: ShipBudgetSpent): string {
   const min = (ms: number) => Math.round(ms / MIN);
-  return `Budget split (${maxMinutes} min): coding ${min(spent.coding)} min, review ${min(spent.review)} min, waiting ${min(spent.waiting)} min.`;
+  const recoveryMinutes = s.input.recovery === undefined ? undefined : min(s.input.recovery.remainingMs);
+  const label =
+    recoveryMinutes === undefined
+      ? `Budget split (${s.input.caps.maxMinutes} min)`
+      : `Recovery checkpoint split (${recoveryMinutes} min carried time budget; earlier activity is not included)`;
+  return `${label}: coding ${min(spent.coding)} min, review ${min(spent.review)} min, waiting ${min(spent.waiting)} min.`;
 }
 
 /** The cap report's declined-vs-unaddressed split over the last review round's findings. */
@@ -3738,6 +3798,8 @@ function renderUnitReportWithWake(
     const restart = s.input.generated
       ? `then start ship again with ${prUrl ?? "the original task"}`
       : "then start this plan again";
+    if (s.input.recovery !== undefined)
+      return `The recovery checkpoint for \`${s.input.recovery.unitKey}\` is terminal and its evidence is consumed; no replacement pipeline is available.`;
     const blocked = s.input.generated ? "" : "The unit's dependents in this plan stay blocked. ";
     return `${blocked}Next action: ${reconcile}, ${restart}.`;
   };
@@ -3900,14 +3962,14 @@ function renderUnitReportWithWake(
       if (!shows(verbosity, "verbose")) return `🧢 Out of budget — no approval after ${rounds}.${prLine}`;
       return join([
         `🧢 Ship stopped at a cap: the remaining pipeline time (~${Math.max(0, Math.round(e.remainingMs / MIN))} min of the ${s.input.caps.maxMinutes}-minute budget) cannot hold another round${e.refused ? ` (the ${e.refused.round} round would get ${e.refused.minutes} min, under its floor of ${e.refused.floor})` : ""} — no approval after ${rounds}.${prLine}`,
-        budgetSplitLine(e.spent, s.input.caps.maxMinutes),
+        budgetSplitLine(s, e.spent),
         splitReport(s),
         nextAction(),
       ]);
     case "review_pending":
       return join([
         `⏳ Review pending: the coding child shipped ${e.pr.url}${e.headSha !== undefined ? ` (head \`${e.headSha.slice(0, 7)}\`)` : ""} but the remaining pipeline time cannot hold the review round — the work stands, only the review is missing. The next pipeline starts at the review round while the pull request still heads at the child's own last push.`,
-        aside(budgetSplitLine(e.spent, s.input.caps.maxMinutes)),
+        aside(budgetSplitLine(s, e.spent)),
         aside(nextAction()),
       ]);
     case "stopped":
@@ -3936,7 +3998,9 @@ function renderUnitReportWithWake(
             observed !== undefined
               ? `Saved-work fact: The run ended at \`${observed}\`, but remote state was not checked; Switchboard cannot claim that commit is on the branch or pull request.`
               : "Saved-work fact: The run did not record a final commit, and remote state was not checked.",
-            "Next action: a new findings run must record every disposition, the updated pull request description and its final commit before remote reconciliation.",
+            s.input.recovery !== undefined
+              ? nextAction()
+              : "Next action: a new findings run must record every disposition, the updated pull request description and its final commit before remote reconciliation.",
           ]);
         if (e.findingsStop === "unfinished")
           return join([
@@ -3944,24 +4008,32 @@ function renderUnitReportWithWake(
             observed !== undefined
               ? `Saved-work fact: the stopped run recorded \`${observed}\`, but Switchboard did not verify it on the remote branch or pull request.`
               : "Saved-work fact: no completed commit was recorded, and remote state was not checked.",
-            "Next action: start a new findings run; review can begin only after it completes every required result and Switchboard verifies its exact remote head.",
+            s.input.recovery !== undefined
+              ? nextAction()
+              : "Next action: start a new findings run; review can begin only after it completes every required result and Switchboard verifies its exact remote head.",
           ]);
         if (e.findingsStop === "missing_remote")
           return join([
             `⚠️ Review did not restart: The completed changes ended at \`${observed}\`, but no open pull request was found for \`${branch}\`.`,
             `Saved-work fact: The run recorded completed commit \`${observed}\`; Switchboard did not verify that commit on the remote branch or a pull request.`,
-            "Next action: reconcile the branch and open pull request, then start ship again so it can verify the exact head before review.",
+            s.input.recovery !== undefined
+              ? nextAction()
+              : "Next action: reconcile the branch and open pull request, then start ship again so it can verify the exact head before review.",
           ]);
         if (e.findingsStop === "head_mismatch")
           return join([
             `⚠️ Review did not restart: The completed changes ended at \`${observed}\`, but the pull request is at \`${e.remoteHead?.slice(0, 7)}\` (${s.pr?.url}).`,
             "Saved-work fact: the pull request's current commit is verified, but the completed changes are not verified there. No review ran on either commit.",
-            "Next action: reconcile the pull request to the completed commit, then start ship again so it can verify that exact head before review.",
+            s.input.recovery !== undefined
+              ? nextAction()
+              : "Next action: reconcile the pull request to the completed commit, then start ship again so it can verify that exact head before review.",
           ]);
         return join([
           `⚠️ Review did not restart: The pull request exists (${s.pr?.url}), but its exact head could not be verified.`,
           `Saved-work fact: the run recorded completed commit \`${observed}\`; Switchboard did not start review for \`${observed}\` and cannot claim the pull request contains it.`,
-          "Next action: retry ship when the pull request state is readable so it can verify the exact head before review.",
+          s.input.recovery !== undefined
+            ? nextAction()
+            : "Next action: retry ship when the pull request state is readable so it can verify the exact head before review.",
         ]);
       }
       if (!shows(verbosity, "verbose")) return `⚠️ Aborted after ${rounds}: ${e.reason}${prLine}`;
@@ -3987,7 +4059,7 @@ function renderUnitReportWithWake(
         durableWake
           ? `🔁 The unit's budget ran out with the unit unfinished — ${e.line}. A reply in this thread is recorded as its continuation action; ${e.renewalsLeft} renewal${e.renewalsLeft === 1 ? "" : "s"} remain${e.spendUsd !== null ? `, $${e.spendUsd.toFixed(2)} spent so far` : ""}.`
           : `🔁 The unit's budget ran out with the unit unfinished — ${e.line}. A fresh ${s.input.caps.maxMinutes}-minute budget opens in this thread${e.from !== undefined ? ` from \`${e.from.slice(0, 7)}\`` : ""}, with the last run's write-up as its request; ${e.renewalsLeft} renewal${e.renewalsLeft === 1 ? "" : "s"} remain${e.spendUsd !== null ? `, $${e.spendUsd.toFixed(2)} spent so far` : ""}.`,
-        aside(budgetSplitLine(e.spent, s.input.caps.maxMinutes)),
+        aside(budgetSplitLine(s, e.spent)),
       ]);
     case "transient":
       if (!shows(verbosity, "verbose"))
@@ -4008,7 +4080,11 @@ function renderUnitReportWithWake(
         nextAction(),
       ]);
     case "interrupted":
-      return join([shipInterruptedNote(prUrl, e.cause, durableWake), checkpointLine(e.checkpoint)]);
+      return join([
+        shipInterruptedNote(prUrl, e.cause, durableWake),
+        checkpointLine(e.checkpoint),
+        s.input.recovery !== undefined ? nextAction(e.checkpoint) : undefined,
+      ]);
     case "idle_expired":
       return "⌛ Idle expired: no reply continued this unit before its idle window closed.";
     case "refused":
@@ -4019,6 +4095,6 @@ function renderUnitReportWithWake(
     case "idle":
       // Keep the old kind's outcome at this copy's level, but render the
       // indexed wake's durable reply action instead of a terminal restart.
-      return renderUnitReportWithWake({ ...s, ending: e.idled }, facts, verbosity, true);
+      return renderUnitReportWithWake({ ...s, ending: e.idled }, facts, verbosity, s.input.recovery === undefined);
   }
 }