@coreplane/switchboard 1.262.0 → 1.262.2

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.262.0",
+  "version": "1.262.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.262.0",
+      "version": "1.262.2",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -21060,7 +21060,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.262.0",
+      "version": "1.262.2",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.262.0",
+  "version": "1.262.2",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.262.0",
-  "commit": "90124c1dfe74e65a447d2ef33eebd01e998486e0",
-  "builtAt": "2026-09-24T21:21:11.789Z"
+  "version": "1.262.2",
+  "commit": "6e30af1fca5413c37ae12556c8863f4fa0126476",
+  "builtAt": "2026-09-25T17:00:14.499Z"
 }

package/dist/assets/src/core/coordinator/contract.ts

@@ -514,6 +514,10 @@ export interface OriginalUnitRecovery {
   /** The exact terminal value replaced by the claim, for fail-closed rollback
    * if the Workflow cannot be admitted. */
   previousEnding: NonNullable<CoordinatorUnit["ending"]>;
+  /** Original binding fields before an evidence-backed repair. The empty object
+   * means both were absent; retained across restart for admission rollback,
+   * then retired when the recovery records progress. */
+  previousBinding?: { publication?: ExistingPrPublicationBinding; lastPush?: string };
   /** The separate Workflow execution checkpoint. This is transport identity,
    * not a replacement coordinator/unit identity. */
   workflowId: string;
@@ -813,6 +817,13 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
           r.recovery.findingsKey !== undefined)) &&
       (r.recovery.findings === undefined ||
         (Array.isArray(r.recovery.findings) && r.recovery.findings.every(isFindingShape))) &&
+      (r.recovery.previousBinding === undefined ||
+        (isObject(r.recovery.previousBinding) &&
+          (r.recovery.previousBinding.publication === undefined ||
+            isPublication(r.recovery.previousBinding.publication)) &&
+          (r.recovery.previousBinding.lastPush === undefined ||
+            (typeof r.recovery.previousBinding.lastPush === "string" &&
+              /^[0-9a-f]{40}$/i.test(r.recovery.previousBinding.lastPush))))) &&
       isObject(r.recovery.previousEnding) &&
       isText(r.recovery.previousEnding.kind) &&
       typeof r.recovery.previousEnding.report === "string" &&

package/dist/cli.js

@@ -5808,7 +5808,7 @@ function isCoordinatorUnit(v) {
     (x) => isObject(x) && isFinite(x.index) && isText(x.agent) && isText(x.outcome) && isFinite(x.at) && (x.gate === void 0 || isRoundGate(x.gate))
   ))
     return false;
-  if (r.recovery !== void 0 && !(isObject(r.recovery) && (r.recovery.kind === "findings" || r.recovery.kind === "review") && typeof r.recovery.round === "number" && Number.isInteger(r.recovery.round) && r.recovery.round >= 1 && typeof r.recovery.expectedHeadSha === "string" && /^[0-9a-f]{40}$/i.test(r.recovery.expectedHeadSha) && isFinite(r.recovery.remainingMs) && r.recovery.remainingMs > 0 && isFinite(r.recovery.claimedAt) && typeof r.recovery.step === "string" && STEP_NAME_PATTERN.test(r.recovery.step) && isText(r.recovery.reviewRunId) && (r.recovery.findingsRunId === void 0 || isText(r.recovery.findingsRunId)) && (r.recovery.findingsKey === void 0 || isText(r.recovery.findingsKey)) && (r.recovery.findingsRunId === void 0 && r.recovery.findingsKey === void 0 || r.recovery.kind === "review" && r.recovery.findingsRunId !== void 0 && r.recovery.findingsKey !== void 0) && (r.recovery.findings === void 0 || Array.isArray(r.recovery.findings) && r.recovery.findings.every(isFindingShape)) && isObject(r.recovery.previousEnding) && isText(r.recovery.previousEnding.kind) && typeof r.recovery.previousEnding.report === "string" && isFinite(r.recovery.previousEnding.at) && typeof r.recovery.workflowId === "string" && INSTANCE_ID_PATTERN.test(r.recovery.workflowId) && isFinite(r.recovery.deadlineAt) && isText(r.recovery.reviewKey)))
+  if (r.recovery !== void 0 && !(isObject(r.recovery) && (r.recovery.kind === "findings" || r.recovery.kind === "review") && typeof r.recovery.round === "number" && Number.isInteger(r.recovery.round) && r.recovery.round >= 1 && typeof r.recovery.expectedHeadSha === "string" && /^[0-9a-f]{40}$/i.test(r.recovery.expectedHeadSha) && isFinite(r.recovery.remainingMs) && r.recovery.remainingMs > 0 && isFinite(r.recovery.claimedAt) && typeof r.recovery.step === "string" && STEP_NAME_PATTERN.test(r.recovery.step) && isText(r.recovery.reviewRunId) && (r.recovery.findingsRunId === void 0 || isText(r.recovery.findingsRunId)) && (r.recovery.findingsKey === void 0 || isText(r.recovery.findingsKey)) && (r.recovery.findingsRunId === void 0 && r.recovery.findingsKey === void 0 || r.recovery.kind === "review" && r.recovery.findingsRunId !== void 0 && r.recovery.findingsKey !== void 0) && (r.recovery.findings === void 0 || Array.isArray(r.recovery.findings) && r.recovery.findings.every(isFindingShape)) && (r.recovery.previousBinding === void 0 || isObject(r.recovery.previousBinding) && (r.recovery.previousBinding.publication === void 0 || isPublication(r.recovery.previousBinding.publication)) && (r.recovery.previousBinding.lastPush === void 0 || typeof r.recovery.previousBinding.lastPush === "string" && /^[0-9a-f]{40}$/i.test(r.recovery.previousBinding.lastPush))) && isObject(r.recovery.previousEnding) && isText(r.recovery.previousEnding.kind) && typeof r.recovery.previousEnding.report === "string" && isFinite(r.recovery.previousEnding.at) && typeof r.recovery.workflowId === "string" && INSTANCE_ID_PATTERN.test(r.recovery.workflowId) && isFinite(r.recovery.deadlineAt) && isText(r.recovery.reviewKey)))
     return false;
   if (r.recoveryReceipt !== void 0 && (!isObject(r.recoveryReceipt) || !isText(r.recoveryReceipt.reviewRunId) || typeof r.recoveryReceipt.workflowId !== "string" || !INSTANCE_ID_PATTERN.test(r.recoveryReceipt.workflowId) || !isFinite(r.recoveryReceipt.at)))
     return false;
@@ -55102,7 +55102,8 @@ async function runShipBranch(deps, msg, io, ctx) {
       () => deps.recoverOriginalUnit === void 0 ? Promise.resolve({ status: 503, body: { error: "original-unit recovery is unavailable" } }) : deps.recoverOriginalUnit(recovery, { userId: msg.userId, threadKey: msg.threadKey })
     );
     if (answer.status !== 200) {
-      const reason2 = typeof answer.body.error === "string" ? answer.body.error : "original-unit recovery was refused";
+      const error = typeof answer.body.error === "string" ? answer.body.error : "original-unit recovery was refused";
+      const reason2 = error === "recovery_budget_unknown" && typeof answer.body.reason === "string" ? `${error}: ${answer.body.reason}` : error;
       await refuse3(
         refusalOf("setup_failed", reason2),
         () => card.done(shell.close({ kind: "refused", icon: "\u{1F6AB}", reason: reason2, ...closeLines(clock4(), false) }))
@@ -73649,16 +73650,36 @@ async function steerChild(body, deps) {
   const steered = await deps.steerChild?.(body.runId, text, instance) ?? false;
   return json3(200, { ok: true, outcome: steered ? "steered" : "not_live", at });
 }
-async function advanceRecoveryPublication(deps, instance, row2, facts2, runId3) {
-  if (row2.recovery === void 0 || row2.publication === void 0 || facts2.headSha === row2.publication.expectedHeadSha)
-    return row2;
-  const child = await deps.runs.getRun(runId3);
-  const expectedPrefix = `${instance.id}:${row2.unit}/recovery/`;
+async function advanceFindingsPublication(deps, instance, row2, facts2, runId3) {
+  if (row2.publication === void 0 || facts2.headSha === row2.publication.expectedHeadSha) return row2;
+  const child = await deps.runs.getRun(runId3, { include: "messages" });
   const owner = { instanceId: instance.id, unit: row2.unit };
-  if (!child.ok || child.value.finished !== true || child.value.status !== "completed" || child.value.agent !== "coding" || child.value.parentInstanceId !== instance.id || child.value.userId !== instance.userId || child.value.repo?.toLowerCase() !== instance.repo.toLowerCase() || child.value.threadKey !== (row2.threadKey ?? instance.threadKey) || child.value.idempotencyKey?.startsWith(expectedPrefix) !== true || !/\/findings(?:\/a[1-9][0-9]*)?$/.test(child.value.idempotencyKey) || !fullHead(facts2.headSha) || child.value.headSha !== facts2.headSha || child.value.pushed?.some((push) => push.ref === row2.branch && push.sha === facts2.headSha) !== true || facts2.state !== "open" || facts2.sameRepoHead !== true || facts2.headBranchExists !== true || facts2.headRef !== row2.publication.headRef || facts2.baseRef !== row2.publication.baseRef || facts2.verifiedHead?.repo.toLowerCase() !== instance.repo.toLowerCase() || facts2.verifiedHead.ref !== row2.publication.publicationRef || facts2.verifiedHead.sha !== facts2.headSha || !samePublicationOwner(row2.publication.owner, owner))
+  const latestReview = [...row2.rounds].reverse().find((round2) => round2.agent === "review");
+  const segment = row2.segments?.reduce((latest, entry) => Math.max(latest, entry.index), 1) ?? 1;
+  const prefix = row2.recovery !== void 0 ? `${row2.unit}/recovery` : stepPrefixOf(row2.unit, segment > 1 ? { segment, renewalsSpent: 0, spendUsd: null } : void 0);
+  const findingsPrefix = `${instance.id}:${prefix}/${latestReview?.index}/findings`;
+  if (row2.recovery === void 0) {
+    const tags = child.ok ? child.value.events?.filter((event) => event.type === "coordinator_tag") ?? [] : [];
+    const tag = tags.length === 1 ? tags[0] : void 0;
+    if (row2.ending !== void 0 || row2.idle !== void 0 || latestReview?.outcome !== "request_changes" || !child.ok || child.value.startedAt < latestReview.at || tag?.parentInstanceId !== instance.id || tag.unit !== row2.unit || tag.base !== instance.base || JSON.stringify(tag.publication) !== JSON.stringify(row2.publication))
+      throw new PublicationBindingRefusal("publication_facts_mismatch");
+    const listing = await deps.runs.listRuns({
+      status: "finished",
+      visibleTo: EVERY_RUN,
+      threadKey: row2.threadKey ?? instance.threadKey,
+      limit: RUN_LIST_MAX_LIMIT
+    });
+    if (listing.storeUnavailable || listing.nextBefore !== void 0 || listing.runs.filter(
+      (run2) => run2.parentInstanceId === instance.id && isStepAttempt(run2.idempotencyKey, findingsPrefix)
+    ).length !== 1)
+      throw new PublicationBindingRefusal("publication_facts_mismatch");
+  }
+  if (!child.ok || child.value.finished !== true || child.value.status !== "completed" || child.value.agent !== "coding" || child.value.parentInstanceId !== instance.id || child.value.userId !== instance.userId || child.value.repo?.toLowerCase() !== instance.repo.toLowerCase() || child.value.threadKey !== (row2.threadKey ?? instance.threadKey) || (row2.recovery !== void 0 ? child.value.idempotencyKey?.startsWith(`${instance.id}:${row2.unit}/recovery/`) !== true || !/\/findings(?:\/a[1-9][0-9]*)?$/.test(child.value.idempotencyKey ?? "") : !isStepAttempt(child.value.idempotencyKey, findingsPrefix)) || !fullHead(facts2.headSha) || child.value.headSha !== facts2.headSha || child.value.pushed?.some((push) => push.ref === row2.branch && push.sha === facts2.headSha) !== true || facts2.state !== "open" || facts2.sameRepoHead !== true || facts2.headBranchExists !== true || facts2.headRef !== row2.publication.headRef || facts2.baseRef !== row2.publication.baseRef || facts2.verifiedHead?.repo.toLowerCase() !== instance.repo.toLowerCase() || facts2.verifiedHead.ref !== row2.publication.publicationRef || facts2.verifiedHead.sha !== facts2.headSha || row2.publication.repo.toLowerCase() !== instance.repo.toLowerCase() || row2.publication.pr !== row2.pr?.number || row2.publication.baseRef !== instance.base || row2.publication.headRef !== row2.branch || row2.publication.publicationRef !== row2.branch || !samePublicationOwner(row2.publication.owner, owner))
     throw new PublicationBindingRefusal("publication_facts_mismatch");
   try {
-    if (deps.runnerOwnership?.claim(instance.repo, row2.publication.pr, owner) !== true)
+    if (row2.recovery !== void 0 && deps.runnerOwnership?.claim(instance.repo, row2.publication.pr, owner) !== true)
+      throw new PublicationBindingRefusal("publication_ownership_changed");
+    if (!samePublicationOwner(deps.runnerOwnership?.owner(instance.repo, row2.publication.pr), owner))
       throw new PublicationBindingRefusal("publication_ownership_changed");
   } catch (err2) {
     if (err2 instanceof PublicationBindingRefusal) throw err2;
@@ -73668,7 +73689,7 @@ async function advanceRecoveryPublication(deps, instance, row2, facts2, runId3)
     ...row2,
     lastPush: facts2.headSha,
     publication: { ...row2.publication, expectedHeadSha: facts2.headSha },
-    recovery: { ...row2.recovery, expectedHeadSha: facts2.headSha }
+    ...row2.recovery !== void 0 ? { recovery: { ...row2.recovery, previousBinding: void 0, expectedHeadSha: facts2.headSha } } : {}
   };
   let replaced;
   try {
@@ -73682,6 +73703,16 @@ async function advanceRecoveryPublication(deps, instance, row2, facts2, runId3)
     throw new PublicationBindingRefusal(
       replaced?.reason === "stale" ? "publication_binding_stale" : "publication_store_unavailable"
     );
+  let stillOwned = false;
+  try {
+    stillOwned = samePublicationOwner(deps.runnerOwnership?.owner(instance.repo, row2.publication.pr), owner);
+  } catch {
+  }
+  if (!stillOwned) {
+    const restored = await deps.instances.compareAndReplaceUnit(updated, row2).catch(() => void 0);
+    if (restored?.ok !== true) throw new PublicationBindingRefusal("publication_rollback_failed");
+    throw new PublicationBindingRefusal("publication_ownership_changed");
+  }
   return updated;
 }
 async function bindOpenPullRequest(deps, instance, row2, pr, facts2) {
@@ -73773,11 +73804,11 @@ async function recoverOriginalUnit(body, deps, caller) {
   if (row2.idle !== void 0 && row2.ending !== void 0)
     return json3(409, { ok: false, error: "unit_lifecycle_ambiguous", at });
   const originalOwner = { instanceId: instance.id, unit: row2.unit };
-  const publication = row2.publication;
+  let publication = row2.publication;
   const pr = row2.pr;
   const base = instance.base;
-  let expectedHead = row2.lastPush;
-  if (pr === void 0 || base === void 0 || !fullHead(expectedHead) || publication === void 0 || publication.repo.toLowerCase() !== instance.repo.toLowerCase() || publication.pr !== pr.number || publication.headRef !== row2.branch || publication.baseRef !== base || publication.publicationRef !== row2.branch || !fullHead(publication.expectedHeadSha) || !samePublicationOwner(publication.owner, originalOwner))
+  let expectedHead = row2.lastPush ?? publication?.expectedHeadSha;
+  if (pr === void 0 || base === void 0 || expectedHead !== void 0 && !fullHead(expectedHead) || publication !== void 0 && (publication.repo.toLowerCase() !== instance.repo.toLowerCase() || publication.pr !== pr.number || publication.headRef !== row2.branch || publication.baseRef !== base || publication.publicationRef !== row2.branch || !fullHead(publication.expectedHeadSha) || !samePublicationOwner(publication.owner, originalOwner)))
     return json3(409, { ok: false, error: "recovery_binding_mismatch", at });
   const existingClaim = row2.recovery;
   let kind;
@@ -73808,10 +73839,14 @@ async function recoverOriginalUnit(body, deps, caller) {
       findingsRunId,
       findingsKey
     } = existingClaim);
-    if (existingClaim.expectedHeadSha !== expectedHead || publication.expectedHeadSha !== expectedHead)
+    if (publication === void 0 || existingClaim.expectedHeadSha !== expectedHead || publication.expectedHeadSha !== expectedHead)
       return json3(409, { ok: false, error: "recovery_binding_mismatch", at });
     const { recovery: _recovery, ...withoutRecovery } = row2;
     originalRow = { ...withoutRecovery, ending: existingClaim.previousEnding };
+    if (existingClaim.previousBinding !== void 0) {
+      const { publication: _publication, lastPush: _lastPush, ...prior } = originalRow;
+      originalRow = { ...prior, ...existingClaim.previousBinding };
+    }
   } else {
     if (row2.idle !== void 0 || row2.ending === void 0)
       return json3(409, { ok: false, error: "unit_not_terminal", at });
@@ -73831,30 +73866,35 @@ async function recoverOriginalUnit(body, deps, caller) {
       return json3(409, { ok: false, error: "recovery_ending_mismatch", at });
     round2 = boundary.index;
     const caps = instance.caps;
-    if (caps === void 0 || row2.startedAt === void 0 || !Number.isFinite(row2.ending.at))
-      return json3(409, { ok: false, error: "recovery_budget_unknown", at });
-    if (instance.grant?.costCapUsd !== void 0) return json3(409, { ok: false, error: "recovery_budget_unknown", at });
+    const unknownBudget = (reason2) => json3(409, { ok: false, error: "recovery_budget_unknown", reason: reason2, at });
+    if (caps === void 0) return unknownBudget("caps_missing");
+    if (!Number.isSafeInteger(caps.maxRounds) || caps.maxRounds < 1 || !Number.isFinite(caps.maxMinutes) || caps.maxMinutes <= 0)
+      return unknownBudget("caps_invalid");
+    if (row2.startedAt === void 0) return unknownBudget("started_at_missing");
+    if (!Number.isFinite(row2.startedAt)) return unknownBudget("started_at_invalid");
+    if (!Number.isFinite(row2.ending.at)) return unknownBudget("ending_at_invalid");
+    if (instance.grant?.costCapUsd !== void 0) return unknownBudget("cost_cap_spend_unknown");
     if (round2 >= caps.maxRounds) return json3(409, { ok: false, error: "recovery_rounds_exhausted", at });
     const latestSegmentIndex = row2.segments?.reduce((latest, candidate) => Math.max(latest, candidate.index), 1) ?? 1;
     const latestSegments = row2.segments?.filter((candidate) => candidate.index === latestSegmentIndex) ?? [];
-    if (latestSegments.length > 1) return json3(409, { ok: false, error: "recovery_budget_unknown", at });
+    if (latestSegments.length > 1) return unknownBudget("latest_segment_ambiguous");
     const segment = latestSegments[0];
     const leaseStartedAt = segment?.at ?? row2.startedAt;
     const resumedLeases = Object.values(row2.wakes ?? {}).filter(
       (answer) => answer.kind === "segment" && answer.index === latestSegmentIndex && answer.leaseMs !== void 0
     );
-    if (resumedLeases.length > 0) return json3(409, { ok: false, error: "recovery_budget_unknown", at });
+    if (resumedLeases.length > 0) return unknownBudget("resume_time_missing");
     remainingMs = minutesToMs(caps.maxMinutes) - (at - leaseStartedAt);
     const reviewThreadKey = row2.reviewThread?.threadKey ?? row2.threadKey ?? instance.threadKey;
     const unitThreadKey = row2.threadKey ?? instance.threadKey;
     const listing = await deps.runs.listRuns({
-      status: "finished",
+      status: publication === void 0 ? "all" : "finished",
       visibleTo: EVERY_RUN,
       threadKey: reviewThreadKey,
       limit: RUN_LIST_MAX_LIMIT
     });
     const unitListing = unitThreadKey === reviewThreadKey ? listing : await deps.runs.listRuns({
-      status: "finished",
+      status: publication === void 0 ? "all" : "finished",
       visibleTo: EVERY_RUN,
       threadKey: unitThreadKey,
       limit: RUN_LIST_MAX_LIMIT
@@ -73863,18 +73903,51 @@ async function recoverOriginalUnit(body, deps, caller) {
       row2.unit,
       latestSegmentIndex > 1 ? { segment: latestSegmentIndex, renewalsSpent: 0, spendUsd: null } : void 0
     );
-    const reviewedHead = publication.expectedHeadSha;
+    if (listing.storeUnavailable || unitListing.storeUnavailable || listing.nextBefore !== void 0 || unitListing.nextBefore !== void 0)
+      return json3(409, { ok: false, error: "recovery_evidence_incomplete", at });
     const reviewKeyPrefix = `${instance.id}:${segmentPrefix}/${round2}/review`;
     const candidates2 = listing.runs.filter((run2) => {
-      if (!run2.finished || run2.agent !== "review" || run2.parentInstanceId !== instance.id || run2.idempotencyKey !== reviewKeyPrefix && run2.idempotencyKey?.startsWith(`${reviewKeyPrefix}/a`) !== true || run2.userId !== instance.userId || run2.repo?.toLowerCase() !== instance.repo.toLowerCase() || run2.threadKey !== reviewThreadKey)
+      if (!run2.finished || run2.agent !== "review" || run2.parentInstanceId !== instance.id || !isStepAttempt(run2.idempotencyKey, reviewKeyPrefix) || run2.userId !== instance.userId || run2.repo?.toLowerCase() !== instance.repo.toLowerCase() || run2.threadKey !== reviewThreadKey)
         return false;
-      if (run2.reviewHead !== reviewedHead) return false;
+      if (!fullHead(run2.reviewHead) || publication !== void 0 && run2.reviewHead !== publication.expectedHeadSha)
+        return false;
+      const reviewedHead2 = run2.reviewHead;
       if (kind === "review") return run2.verdict === void 0 && run2.reviewPost === void 0;
-      return run2.verdict?.verdict === "request_changes" && run2.reviewHead === reviewedHead && run2.reviewPost?.posted === true && run2.reviewPost.head === reviewedHead && run2.reviewPost.verdict === "request_changes" && run2.reviewPost.target.repo.toLowerCase() === instance.repo.toLowerCase() && run2.reviewPost.target.number === pr.number;
+      return run2.verdict?.verdict === "request_changes" && run2.reviewHead === reviewedHead2 && run2.reviewPost?.posted === true && run2.reviewPost.head === reviewedHead2 && run2.reviewPost.verdict === "request_changes" && run2.reviewPost.target.repo.toLowerCase() === instance.repo.toLowerCase() && run2.reviewPost.target.number === pr.number;
     });
     if (candidates2.length !== 1) return json3(409, { ok: false, error: "recovery_review_evidence_ambiguous", at });
-    reviewRunId = candidates2[0].id;
-    reviewKey = candidates2[0].idempotencyKey;
+    const review = candidates2[0];
+    const reviewedHead = review.reviewHead;
+    if (publication === void 0) {
+      if (listing.runs.filter(
+        (run2) => run2.parentInstanceId === instance.id && isStepAttempt(run2.idempotencyKey, reviewKeyPrefix)
+      ).length !== 1)
+        return json3(409, { ok: false, error: "recovery_review_evidence_ambiguous", at });
+      if ([...listing.runs, ...unitListing.runs].some(
+        (run2) => !run2.finished && (run2.agent === "coding" || run2.agent === "review")
+      ))
+        return json3(409, { ok: false, error: "recovery_child_active", at });
+      const codingKey = `${instance.id}:${segmentPrefix}/${round2 === 1 ? "0/coding" : `${round2 - 1}/findings`}`;
+      const coding = unitListing.runs.filter(
+        (run2) => run2.parentInstanceId === instance.id && isStepAttempt(run2.idempotencyKey, codingKey)
+      );
+      const child = coding.length === 1 ? coding[0] : void 0;
+      if (child?.finished !== true || child.status !== "completed" || child.agent !== "coding" || child.userId !== instance.userId || child.repo?.toLowerCase() !== instance.repo.toLowerCase() || child.threadKey !== unitThreadKey || child.headSha !== reviewedHead || child.pushed?.some((push) => push.ref === row2.branch && push.sha === reviewedHead) !== true || child.pr !== void 0 && (child.pr.number !== pr.number || child.pr.head !== void 0 && child.pr.head !== row2.branch) || child.finishedAt === void 0 || child.startedAt < leaseStartedAt || child.finishedAt > review.startedAt || review.finishedAt === void 0 || review.finishedAt > row2.ending.at || expectedHead !== void 0 && expectedHead !== reviewedHead)
+        return json3(409, { ok: false, error: "recovery_binding_evidence_ambiguous", at });
+      publication = {
+        repo: instance.repo,
+        pr: pr.number,
+        headRef: row2.branch,
+        baseRef: base,
+        expectedHeadSha: reviewedHead,
+        publicationRef: row2.branch,
+        owner: originalOwner
+      };
+      expectedHead = reviewedHead;
+      claimRow = { ...row2, lastPush: reviewedHead, publication };
+    }
+    reviewRunId = review.id;
+    reviewKey = review.idempotencyKey;
     try {
       facts2 = await deps.fetchPrFacts({ repo: instance.repo, number: pr.number });
     } catch (err2) {
@@ -73888,7 +73961,7 @@ async function recoverOriginalUnit(body, deps, caller) {
     const findingsPrefix = `${instance.id}:${segmentPrefix}/${boundary.index}/findings`;
     const headMoved = facts2.headSha !== reviewedHead || expectedHead !== reviewedHead;
     const completedFindings = unitListing.runs.filter(
-      (run2) => boundary.outcome === "request_changes" && row2.ending?.cause === "step_threw" && row2.ending.step === findingsStep && row2.ending.round === boundary.index && (expectedHead === reviewedHead || expectedHead === facts2.headSha) && run2.finished && run2.status === "completed" && run2.agent === "coding" && run2.parentInstanceId === instance.id && run2.userId === instance.userId && run2.repo?.toLowerCase() === instance.repo.toLowerCase() && run2.threadKey === unitThreadKey && (run2.idempotencyKey === findingsPrefix || run2.idempotencyKey?.startsWith(`${findingsPrefix}/a`) === true) && run2.headSha === facts2.headSha && (!headMoved || run2.pushed?.some((push) => push.ref === row2.branch && push.sha === facts2.headSha) === true) && run2.startedAt >= (candidates2[0].finishedAt ?? candidates2[0].startedAt) && (run2.finishedAt === void 0 || run2.finishedAt <= row2.ending.at)
+      (run2) => boundary.outcome === "request_changes" && row2.ending?.cause === "step_threw" && row2.ending.step === findingsStep && row2.ending.round === boundary.index && (expectedHead === reviewedHead || expectedHead === facts2.headSha) && run2.finished && run2.status === "completed" && run2.agent === "coding" && run2.parentInstanceId === instance.id && run2.userId === instance.userId && run2.repo?.toLowerCase() === instance.repo.toLowerCase() && run2.threadKey === unitThreadKey && isStepAttempt(run2.idempotencyKey, findingsPrefix) && run2.headSha === facts2.headSha && (!headMoved || run2.pushed?.some((push) => push.ref === row2.branch && push.sha === facts2.headSha) === true) && run2.startedAt >= (candidates2[0].finishedAt ?? candidates2[0].startedAt) && (run2.finishedAt === void 0 || run2.finishedAt <= row2.ending.at)
     );
     if (completedFindings.length > 1 || headMoved && completedFindings.length !== 1)
       return json3(409, { ok: false, error: "recovery_head_moved", at });
@@ -73899,7 +73972,7 @@ async function recoverOriginalUnit(body, deps, caller) {
       kind = "review";
       round2 = boundary.index + 1;
       claimRow = {
-        ...row2,
+        ...claimRow,
         lastPush: expectedHead,
         publication: { ...publication, expectedHeadSha: expectedHead }
       };
@@ -74006,6 +74079,12 @@ async function recoverOriginalUnit(body, deps, caller) {
         ...findingsKey !== void 0 ? { findingsKey } : {},
         ...findings !== void 0 ? { findings } : {},
         previousEnding: row2.ending,
+        ...claimRow !== row2 ? {
+          previousBinding: {
+            ...row2.publication !== void 0 ? { publication: row2.publication } : {},
+            ...row2.lastPush !== void 0 ? { lastPush: row2.lastPush } : {}
+          }
+        } : {},
         workflowId,
         deadlineAt,
         reviewKey
@@ -74090,6 +74169,8 @@ async function prCheck(body, deps) {
   };
   try {
     if (follow !== void 0) {
+      if (unit.row?.pr !== void 0 && unit.row.pr.number !== follow)
+        throw new PublicationBindingRefusal("publication_facts_mismatch");
       const facts2 = await deps.fetchPrFacts({ repo: instance.repo, number: follow });
       if (facts2 === void 0) throw new Error(`could not read ${instance.repo}#${follow}`);
       const fallbackUrl = unit.row?.pr?.url ?? `https://github.com/${instance.repo}/pull/${follow}`;
@@ -74100,7 +74181,7 @@ async function prCheck(body, deps) {
         await rememberTerminal(followedPr);
         return json3(200, { ok: true, ...state2, at });
       }
-      const bindingRow = unit.row !== void 0 && unit.row.recovery !== void 0 && recover !== void 0 ? await advanceRecoveryPublication(deps, instance, unit.row, facts2, recover.runId) : unit.row;
+      const bindingRow = unit.row !== void 0 && recover !== void 0 ? await advanceFindingsPublication(deps, instance, unit.row, facts2, recover.runId) : unit.row;
       await bindOpenPullRequest(deps, instance, bindingRow, followedPr, facts2);
       const prRef = { repo: instance.repo, number: follow };
       const headSha = facts2.headSha;
@@ -74505,7 +74586,10 @@ async function round(body, deps) {
     return json3(200, { ok: true, at: previous.at });
   const updated = {
     ...row2,
-    rounds: [...row2.rounds, note]
+    rounds: [...row2.rounds, note],
+    // The transport has started doing work. Admission rollback must no longer
+    // remove publication authority already used by this recovery.
+    ...row2.recovery?.previousBinding !== void 0 ? { recovery: { ...row2.recovery, previousBinding: void 0 } } : {}
   };
   if (row2.recovery !== void 0) {
     let replaced;
@@ -75531,7 +75615,7 @@ function createAdminCoordinatorHandler(deps) {
     })();
   };
 }
-var COORDINATOR_ADMIN_PREFIX, MAX_SPAWN_PROMPT_CHARS, FINISHED_LOOKBACK_PAGES, MAX_ADMIN_BODY_BYTES, UNIT_ID, PRESETS_OF_KIND, invalid, json3, describe12, isGenerated2, EVERY_RUN, REVIEW_POSTED_CHECKS, REVIEW_POSTED_RECHECK_MS, githubSecondStart, CHILD_SUPERSESSION_REASONS, PublicationBindingRefusal, samePublicationOwner, fullHead, ROUND_OUTCOMES, ENDING_ICON, STEPS;
+var COORDINATOR_ADMIN_PREFIX, MAX_SPAWN_PROMPT_CHARS, FINISHED_LOOKBACK_PAGES, MAX_ADMIN_BODY_BYTES, UNIT_ID, PRESETS_OF_KIND, invalid, json3, describe12, isGenerated2, EVERY_RUN, REVIEW_POSTED_CHECKS, REVIEW_POSTED_RECHECK_MS, githubSecondStart, CHILD_SUPERSESSION_REASONS, PublicationBindingRefusal, samePublicationOwner, fullHead, isStepAttempt, ROUND_OUTCOMES, ENDING_ICON, STEPS;
 var init_adminCoordinator = __esm({
   "../../src/channels/adminCoordinator.ts"() {
     "use strict";
@@ -75596,6 +75680,7 @@ var init_adminCoordinator = __esm({
     };
     samePublicationOwner = (left, right) => left?.instanceId === right.instanceId && left.unit === right.unit;
     fullHead = (value) => typeof value === "string" && /^[0-9a-f]{40}$/i.test(value);
+    isStepAttempt = (key, step) => key === step || key?.startsWith(`${step}/a`) === true && /^[1-9][0-9]*$/.test(key.slice(step.length + 2));
     ROUND_OUTCOMES = [
       "started",
       "pr_opened",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreplane/switchboard",
-  "version": "1.262.0",
+  "version": "1.262.2",
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
   "homepage": "https://openswitchboard.dev",