@coreplane/switchboard 1.262.3 → 1.263.0

package/dist/assets/config/config.example.yaml

@@ -73,6 +73,20 @@ providers:
     #     # object text contract, or both (absent assumes both). The intake gate
     #     # refuses at load a card declaring neither under its classify default.
     #     answers: ["tool", "text"]
+    #     # When published prices change above an input-token threshold, give
+    #     # all four base and tier rates in USD per million tokens. The whole
+    #     # request uses the tier above the threshold, including cached input.
+    #     price:
+    #       input: 2
+    #       output: 10
+    #       cacheRead: 0.2
+    #       cacheWrite: 2.5
+    #       tiers:
+    #         - inputTokensAbove: 272000
+    #           input: 4
+    #           output: 15
+    #           cacheRead: 0.4
+    #           cacheWrite: 5
     # A passthrough is merged into the request body on the wires whose adapter
     # takes one — a vendor-only feature such as OpenRouter's routing, never a
     # control: it is not decided, not noted and not in the matrix, and a wrong

package/dist/assets/deploy/cloudflare/prImages.ts

@@ -0,0 +1,113 @@
+import { MAX_PR_IMAGE_BYTES, prImageKey, readPrImage, validPrImageSource } from "../../src/artifacts/prImages.ts";
+import { DAY_MS } from "../../src/core/budgets.ts";
+import { systemClock } from "../../src/core/trace/clock.ts";
+import { sameToken } from "./artifactsCopy.ts";
+
+/** The small part of R2 needed for deliberate publication. No list or public
+ *  bucket capability: reads can address only copies this handler marked. */
+export interface PrImageBucket {
+  get(key: string): Promise<{
+    size: number;
+    body: ReadableStream<Uint8Array>;
+    httpMetadata?: { contentType?: string };
+    customMetadata?: Record<string, string>;
+  } | null>;
+  put(
+    key: string,
+    bytes: Uint8Array,
+    options: {
+      httpMetadata: { contentType: string };
+      customMetadata: Record<string, string>;
+    },
+  ): Promise<unknown>;
+}
+
+const json = (status: number, body: Record<string, unknown>) =>
+  new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json", "cache-control": "no-store" },
+  });
+
+export async function publishPrImage(
+  request: Request,
+  deps: { bucket?: PrImageBucket; token?: string; clock?: () => number },
+): Promise<Response> {
+  const bearer = /^Bearer\s+(\S+)$/.exec(request.headers.get("authorization") ?? "")?.[1];
+  if (!deps.token || !bearer || !sameToken(bearer, deps.token))
+    return json(401, { error: "publication bearer refused" });
+  if (request.method !== "POST") return json(405, { error: "publication requires POST" });
+  if (!deps.bucket) return json(503, { error: "artifact store unavailable" });
+  let key: unknown;
+  let retentionDays: unknown;
+  try {
+    const input = (await request.json()) as { key?: unknown; retentionDays?: unknown } | null;
+    key = input?.key;
+    retentionDays = input?.retentionDays;
+  } catch {
+    /* Refuse below, before reading storage. */
+  }
+  if (typeof key !== "string" || !validPrImageSource(key))
+    return json(400, { error: "publication requires an outbound artifact key" });
+  if (typeof retentionDays !== "number" || !Number.isSafeInteger(retentionDays) || retentionDays < 1)
+    return json(400, { error: "publication requires retentionDays as a positive integer" });
+  const expiresAt = (deps.clock ?? systemClock)() + retentionDays * DAY_MS;
+  if (!Number.isSafeInteger(expiresAt) || expiresAt < 1)
+    return json(400, { error: "publication expiry is out of range" });
+  const object = await deps.bucket.get(key);
+  if (!object) return json(404, { error: "artifact not found" });
+  let bytes: Uint8Array;
+  try {
+    bytes = await readPrImage({ ...object, contentType: object.httpMetadata?.contentType ?? "" });
+  } catch {
+    // A storage stream can fail with internal paths or stack details; the caller
+    // needs only the stable validation result.
+    return json(400, { error: "invalid PR image" });
+  }
+  const path = `/pr-images/${crypto.randomUUID()}.png`;
+  await deps.bucket.put(prImageKey(path)!, bytes, {
+    httpMetadata: { contentType: "image/png" },
+    customMetadata: { publishedForPr: "true", sourceKey: key, expiresAt: String(expiresAt) },
+  });
+  return json(200, { path });
+}
+
+/** Public only by deliberate copy. The URL is an address, not a run-reader
+ *  capability; there is no way to substitute a private key into this route. */
+export async function handlePrImage(
+  request: Request,
+  bucket?: PrImageBucket,
+  clock: () => number = systemClock,
+): Promise<Response> {
+  if (request.method !== "GET" && request.method !== "HEAD") return json(405, { error: "GET or HEAD only" });
+  const url = new URL(request.url);
+  const key = prImageKey(url.pathname);
+  if (!key || url.search || !bucket) return json(404, { error: "not found" });
+  const object = await bucket.get(key);
+  // Lifecycle deletion is asynchronous; it must not extend public availability.
+  // Older or malformed copies without a valid deadline also fail closed.
+  const expiresAt = Number(object?.customMetadata?.expiresAt);
+  if (
+    !object ||
+    object.customMetadata?.publishedForPr !== "true" ||
+    !Number.isSafeInteger(expiresAt) ||
+    expiresAt < 1 ||
+    clock() >= expiresAt ||
+    object.httpMetadata?.contentType !== "image/png" ||
+    object.size < 1 ||
+    object.size > MAX_PR_IMAGE_BYTES
+  ) {
+    await object?.body.cancel();
+    return json(404, { error: "not found" });
+  }
+  if (request.method === "HEAD") await object.body.cancel();
+  return new Response(request.method === "HEAD" ? null : object.body, {
+    headers: {
+      "content-type": "image/png",
+      "content-length": String(object.size),
+      "content-disposition": 'inline; filename="screenshot.png"',
+      "cache-control": "no-store",
+      "x-content-type-options": "nosniff",
+      "content-security-policy": "default-src 'none'; sandbox",
+    },
+  });
+}

package/dist/assets/deploy/cloudflare/worker.ts

@@ -46,6 +46,8 @@ import { systemClock } from "../../src/core/trace/clock.ts";
 import { createTracer } from "../../src/core/trace/tracer.ts";
 import { shimRoute, stripTraceContext, withTraceContext, workerLogSink } from "../../src/core/trace/workerTrace.ts";
 import { COPY_PATH, handleArtifactsCopy } from "./artifactsCopy.ts";
+import { handlePrImage, publishPrImage } from "./prImages.ts";
+import { PR_IMAGE_PUBLISH_PATH } from "../../src/artifacts/prImages.ts";
 import { withKnownLength } from "./knownLength.ts";
 import type { ShipCoordinatorParams } from "./coordinator";
 import { INSTANCE, INTERNAL } from "./shared";
@@ -456,6 +458,11 @@ const withLength = (res: Response): Response => withKnownLength(res, (size) => n
 export default {
   async fetch(request: Request, env: Env): Promise<Response> {
     const pathname = new URL(request.url).pathname;
+    // Only deliberately published copies are public. The existing run reader
+    // and the bucket stay private; the write endpoint checks its own bearer.
+    if (pathname.startsWith("/pr-images/")) return withLength(await handlePrImage(request, env.ARTIFACTS));
+    if (pathname === PR_IMAGE_PUBLISH_PATH)
+      return publishPrImage(request, { bucket: env.ARTIFACTS, token: env.ARTIFACTS_COPY_TOKEN });
     // The public edge (docs/reference/specs/tracing.md item 22): whatever trace context the
     // caller sent is stripped, and what the container sees carries this
     // Worker's own root. A static asset or the live view's SSE stream gets no

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.262.3",
+  "version": "1.263.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.262.3",
+      "version": "1.263.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -21060,7 +21060,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.262.3",
+      "version": "1.263.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.262.3",
+  "version": "1.263.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.262.3",
-  "commit": "a06bf8a434165e30c6ff2bd0575cc5d92021e87a",
-  "builtAt": "2026-09-25T20:34:57.866Z"
+  "version": "1.263.0",
+  "commit": "45ff7fda11fb77898cd9677f0c6e42efd4f9ffbf",
+  "builtAt": "2026-09-26T01:33:01.056Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -216,7 +216,7 @@ const RESIDENT_TOOLCHAIN = `The resident image carries ${IMAGE_TOOLCHAIN}; plus
 // item 10): the one way a run's screenshot reaches the person. Said once so
 // the sandbox and resident variants cannot drift on it.
 const SHOW_FILES = `Files the person should SEE go through the attach_file tool: a screenshot from \`playwright screenshot\`, a rendered PDF, a recording — it posts the workspace file into this conversation, where an image renders inline. Use it whenever you produce an image worth showing (a visual change, a rendered page, a before/after); a link to a file on GitHub is not a picture.
-SCREENSHOTS GO TO BOTH PLACES, ALL OF THEM: when the request asks for screenshots, or the change is visual, every capture is attached here with attach_file AND published on the pull request — commit the images to an assets branch (never the PR's own diff) and reference them from the description's validation section or a PR comment so they render inline there too — unless the request names one destination. Never attach a subset and link the rest.
+SCREENSHOTS GO TO BOTH PLACES, ALL OF THEM: when the request asks for screenshots, or the change is visual, every capture is attached here with attach_file AND published on the pull request — use PNG captures, inspect/redact sensitive content, and call attach_file with publishForPr: true to deliberately make a public copy after thread delivery. Embed the returned public URL with Markdown image syntax in the description's validation section or a PR comment, never as a bare link. This applies unless the request names one destination; for thread-only delivery omit publishForPr. Never attach a subset and link the rest. Only deliberately published PNGs (at most 10 MiB) are public, for the artifact retention window (default 30 days), not forever. Never push an assets branch, put captures in the PR's diff, or expose a tokened run-artifact URL as a workaround. If publication is unavailable or refused, report that limit; if attachment was refused too, still attach privately with publishForPr omitted. Do not claim the PR renders an image.
 Whole files: up to 1 GiB where the artifact store is configured (a recording, a large PDF), 10 MiB otherwise — the tool's result says which applies; over the limit, link to the file.
 Files the person dropped on the thread that were too large to show you inline are already in ./attachments/ in your workspace when the turn's text names them (a video for ffmpeg, a large PDF, a zip); read them from there — never ask for a re-upload.
 Text stays in your message; do not attach what you can say.`;

package/dist/assets/src/artifacts/prImages.ts

@@ -0,0 +1,51 @@
+// Deliberate public copies, not a public bucket or an exception to the run reader.
+export const PR_IMAGE_PUBLISH_PATH = "/artifacts/publish-pr-image";
+export const MAX_PR_IMAGE_BYTES = 10 * 1024 * 1024;
+const UUID = "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}";
+const PUBLIC_PATH = new RegExp(`^/pr-images/(${UUID})\\.png$`);
+
+export function validPrImagePath(path: string): boolean {
+  return PUBLIC_PATH.test(path);
+}
+
+export function prImageKey(path: string): string | undefined {
+  const match = PUBLIC_PATH.exec(path);
+  return match ? `published-pr/${match[1]}.png` : undefined;
+}
+
+export function validPrImageSource(key: string): boolean {
+  return /^runs\/[A-Za-z0-9_-]+\/out\/\d+-[A-Za-z0-9._-]+$/.test(key);
+}
+
+/** Bounded to one small screenshot in the Worker, never in the bot process.
+ *  Count the stream as well as its metadata: a dishonest length must not
+ *  turn the public endpoint into an unbounded read or an active-content host. */
+export async function readPrImage(object: {
+  size: number;
+  contentType: string;
+  body: ReadableStream<Uint8Array>;
+}): Promise<Uint8Array> {
+  const reader = object.body.getReader();
+  try {
+    if (object.contentType !== "image/png") throw new Error("PR images require PNG content type");
+    if (!Number.isInteger(object.size) || object.size < 1 || object.size > MAX_PR_IMAGE_BYTES) {
+      throw new Error(`PR image size must be 1..${MAX_PR_IMAGE_BYTES} bytes`);
+    }
+    const bytes = new Uint8Array(object.size);
+    let used = 0;
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (used + value.length > bytes.length) throw new Error("PR image length exceeds its declared size");
+      bytes.set(value, used);
+      used += value.length;
+    }
+    if (used !== bytes.length) throw new Error("PR image length differs from its declared size");
+    const signature = [137, 80, 78, 71, 13, 10, 26, 10];
+    if (!signature.every((byte, index) => bytes[index] === byte)) throw new Error("PR images require a PNG signature");
+    return bytes;
+  } finally {
+    await reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+}

package/dist/assets/src/core/provider.ts

@@ -446,7 +446,7 @@ export function classifyProviderFailure(input: ProviderFailureAnswer): ProviderF
   });
 }
 
-function typedProviderFailureOf(error: unknown, seen = new Set<object>()): ProviderFailure | undefined {
+export function typedProviderFailureOf(error: unknown, seen = new Set<object>()): ProviderFailure | undefined {
   if (error instanceof ProviderFailure) return error;
   const row = providerFailureRecord(error);
   if (!row || seen.has(row)) return undefined;
@@ -505,8 +505,20 @@ export interface ProviderModelOverride {
   inputs?: { image?: boolean; document?: boolean };
   /** The model's cache rule. */
   cache?: "automatic" | "markers" | "none" | "unknown";
-  /** USD per million tokens, by kind. */
-  price?: { input?: number; output?: number; cacheRead?: number; cacheWrite?: number };
+  /** USD per million tokens, by kind, with whole-request long-context rates. */
+  price?: {
+    input?: number;
+    output?: number;
+    cacheRead?: number;
+    cacheWrite?: number;
+    tiers?: Array<{
+      inputTokensAbove: number;
+      input: number;
+      output: number;
+      cacheRead: number;
+      cacheWrite: number;
+    }>;
+  };
   /** The answer shapes the model can produce for a forced one-call turn (the
    *  router's, intake's): `tool` — a forced tool call — and `text` — the
    *  one-JSON-object text contract. Absent, both are assumed; an empty list

package/dist/cli.js

@@ -362,6 +362,24 @@ var init_clock = __esm({
   }
 });
 
+// ../../src/artifacts/prImages.ts
+function validPrImagePath(path) {
+  return PUBLIC_PATH.test(path);
+}
+function validPrImageSource(key) {
+  return /^runs\/[A-Za-z0-9_-]+\/out\/\d+-[A-Za-z0-9._-]+$/.test(key);
+}
+var PR_IMAGE_PUBLISH_PATH, MAX_PR_IMAGE_BYTES, UUID, PUBLIC_PATH;
+var init_prImages = __esm({
+  "../../src/artifacts/prImages.ts"() {
+    "use strict";
+    PR_IMAGE_PUBLISH_PATH = "/artifacts/publish-pr-image";
+    MAX_PR_IMAGE_BYTES = 10 * 1024 * 1024;
+    UUID = "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}";
+    PUBLIC_PATH = new RegExp(`^/pr-images/(${UUID})\\.png$`);
+  }
+});
+
 // ../../src/artifacts/store.ts
 import { AwsClient } from "aws4fetch";
 function parseByteRange(header4) {
@@ -392,6 +410,7 @@ var init_store = __esm({
     "use strict";
     init_clock();
     init_config();
+    init_prImages();
     PRESIGN_TTL_SECONDS = ARTIFACT_DEFAULTS.presignTtlSeconds;
     IDENTITY = { "accept-encoding": "identity" };
     R2ArtifactStore = class {
@@ -400,6 +419,7 @@ var init_store = __esm({
       endpoint;
       fetchImpl;
       clock;
+      retentionDays;
       copy;
       constructor(opts) {
         this.bucket = opts.bucket;
@@ -413,6 +433,7 @@ var init_store = __esm({
         });
         this.fetchImpl = opts.fetch ?? fetch;
         this.clock = opts.clock ?? systemClock;
+        this.retentionDays = opts.retentionDays ?? ARTIFACT_DEFAULTS.retentionDays;
         this.copy = { ...opts.copy, timeoutMs: opts.copy.timeoutMs ?? ARTIFACT_DEFAULTS.copyTimeoutMs };
       }
       objectUrl(key) {
@@ -472,6 +493,26 @@ var init_store = __esm({
         if (!Number.isFinite(size) || size < 0) throw new Error(`artifact store: GET ${key} answered without a length`);
         return { size, contentType, body: res.body };
       }
+      async publishPrImage(key) {
+        if (!validPrImageSource(key)) throw new Error("PR publication requires an outbound artifact key");
+        const base = new URL(this.copy.baseUrl);
+        if (base.protocol !== "https:" || base.username || base.password || base.search || base.hash || base.pathname !== "/") {
+          throw new Error("PR publication requires a credential-free HTTPS origin");
+        }
+        const res = await this.fetchImpl(`${base.origin}${PR_IMAGE_PUBLISH_PATH}`, {
+          method: "POST",
+          headers: { authorization: `Bearer ${this.copy.token.reveal()}`, "content-type": "application/json" },
+          body: JSON.stringify({ key, retentionDays: this.retentionDays }),
+          redirect: "error",
+          signal: AbortSignal.timeout(this.copy.timeoutMs)
+        });
+        if (!res.ok) throw new Error(`PR publication answered HTTP ${res.status}`);
+        const answer = await res.json();
+        if (typeof answer.path !== "string" || !validPrImagePath(answer.path)) {
+          throw new Error("PR publication returned an invalid public path");
+        }
+        return `${base.origin}${answer.path}`;
+      }
       async copyFromUrl(input) {
         const res = await this.fetchImpl(`${this.copy.baseUrl.replace(/\/$/, "")}/artifacts/copy`, {
           method: "POST",
@@ -509,6 +550,7 @@ function buildArtifactStore(cfg, secrets, opts) {
   return new R2ArtifactStore({
     accountId: cfg.r2.accountId,
     bucket: cfg.r2.bucket,
+    retentionDays: cfg.retentionDays,
     accessKeyId: secrets.get("ARTIFACTS_R2_ACCESS_KEY_ID"),
     secretAccessKey: secrets.get("ARTIFACTS_R2_SECRET_ACCESS_KEY"),
     copy: {
@@ -2335,7 +2377,7 @@ EVERY PR includes one that already exists when you push \u2014 opened by a perso
     SANDBOX_TOOLCHAIN = `The sandbox image carries ${IMAGE_TOOLCHAIN}; and Docker (the engine starts on the first \`docker\` call).`;
     RESIDENT_TOOLCHAIN = `The resident image carries ${IMAGE_TOOLCHAIN}; plus yarn and bun \u2014 and no Docker.`;
     SHOW_FILES = `Files the person should SEE go through the attach_file tool: a screenshot from \`playwright screenshot\`, a rendered PDF, a recording \u2014 it posts the workspace file into this conversation, where an image renders inline. Use it whenever you produce an image worth showing (a visual change, a rendered page, a before/after); a link to a file on GitHub is not a picture.
-SCREENSHOTS GO TO BOTH PLACES, ALL OF THEM: when the request asks for screenshots, or the change is visual, every capture is attached here with attach_file AND published on the pull request \u2014 commit the images to an assets branch (never the PR's own diff) and reference them from the description's validation section or a PR comment so they render inline there too \u2014 unless the request names one destination. Never attach a subset and link the rest.
+SCREENSHOTS GO TO BOTH PLACES, ALL OF THEM: when the request asks for screenshots, or the change is visual, every capture is attached here with attach_file AND published on the pull request \u2014 use PNG captures, inspect/redact sensitive content, and call attach_file with publishForPr: true to deliberately make a public copy after thread delivery. Embed the returned public URL with Markdown image syntax in the description's validation section or a PR comment, never as a bare link. This applies unless the request names one destination; for thread-only delivery omit publishForPr. Never attach a subset and link the rest. Only deliberately published PNGs (at most 10 MiB) are public, for the artifact retention window (default 30 days), not forever. Never push an assets branch, put captures in the PR's diff, or expose a tokened run-artifact URL as a workaround. If publication is unavailable or refused, report that limit; if attachment was refused too, still attach privately with publishForPr omitted. Do not claim the PR renders an image.
 Whole files: up to 1 GiB where the artifact store is configured (a recording, a large PDF), 10 MiB otherwise \u2014 the tool's result says which applies; over the limit, link to the file.
 Files the person dropped on the thread that were too large to show you inline are already in ./attachments/ in your workspace when the turn's text names them (a video for ffmpeg, a large PDF, a zip); read them from there \u2014 never ask for a re-upload.
 Text stays in your message; do not attach what you can say.`;
@@ -7908,12 +7950,42 @@ function validateModelOverride(path, raw) {
   if (m.price !== void 0) {
     if (typeof m.price !== "object" || m.price === null || Array.isArray(m.price))
       throw new Error(`${path}.price must be a mapping of kind \u2192 USD per million tokens`);
-    for (const [kind, v] of Object.entries(m.price)) {
+    const price = m.price;
+    for (const [kind, v] of Object.entries(price)) {
+      if (kind === "tiers") continue;
       if (!Object.hasOwn(PRICE_KINDS2, kind))
         throw new Error(`${path}.price.${kind} is not a known kind (input, output, cacheRead, cacheWrite)`);
       if (typeof v !== "number" || !Number.isFinite(v) || v < 0)
         throw new Error(`${path}.price.${kind} must be a finite number of USD per million tokens, 0 or more`);
     }
+    if (price.tiers !== void 0) {
+      if (!Array.isArray(price.tiers) || price.tiers.length === 0)
+        throw new Error(`${path}.price.tiers must be a nonempty list of long-context rates`);
+      for (const kind of Object.keys(PRICE_KINDS2)) {
+        if (price[kind] === void 0) throw new Error(`${path}.price.${kind} is required with tiers`);
+      }
+      const thresholds = /* @__PURE__ */ new Set();
+      for (const [index, rawTier] of price.tiers.entries()) {
+        const tierPath = `${path}.price.tiers[${index}]`;
+        if (typeof rawTier !== "object" || rawTier === null || Array.isArray(rawTier))
+          throw new Error(`${tierPath} must be a mapping of threshold and rates`);
+        const tier = rawTier;
+        for (const key of Object.keys(tier)) {
+          if (key !== "inputTokensAbove" && !Object.hasOwn(PRICE_KINDS2, key))
+            throw new Error(`${tierPath}.${key} is not a known tier field`);
+        }
+        if (!Number.isInteger(tier.inputTokensAbove) || tier.inputTokensAbove <= 0)
+          throw new Error(`${tierPath}.inputTokensAbove must be a positive integer of tokens`);
+        const threshold = tier.inputTokensAbove;
+        if (thresholds.has(threshold)) throw new Error(`${tierPath}.inputTokensAbove duplicates a previous threshold`);
+        thresholds.add(threshold);
+        for (const kind of Object.keys(PRICE_KINDS2)) {
+          const rate = tier[kind];
+          if (typeof rate !== "number" || !Number.isFinite(rate) || rate < 0)
+            throw new Error(`${tierPath}.${kind} must be a finite number of USD per million tokens, 0 or more`);
+        }
+      }
+    }
   }
 }
 function validateProviders(cfg, source2) {
@@ -40932,6 +41004,39 @@ function operatorPresets() {
     }
   ];
 }
+function requestedModelWord(request2, modelWord, ref) {
+  const word = modelWord.trim().toLowerCase();
+  if (!word) return false;
+  const words = [];
+  let current = "";
+  for (const char of request2.toLowerCase()) {
+    const code = char.charCodeAt(0);
+    if (code >= 97 && code <= 122 || code >= 48 && code <= 57 || char === "-" || char === ".") {
+      current += char;
+    } else if (current) {
+      words.push(current);
+      current = "";
+    }
+  }
+  if (current) words.push(current);
+  const cues = /* @__PURE__ */ new Set(["with", "using", "use", "on", "via", "model"]);
+  let selected = false;
+  for (let i = 0; i < words.length; i++) {
+    if (words[i] !== word) continue;
+    const previous = words[i - 1];
+    if (previous !== void 0 && cues.has(previous)) selected = true;
+    if ((previous === "the" || previous === "a") && i >= 2 && cues.has(words[i - 2])) selected = true;
+  }
+  if (!selected) return false;
+  let modelId;
+  try {
+    modelId = parseModelRef(ref).model.toLowerCase();
+  } catch {
+    return true;
+  }
+  const modelName = modelId.split("/").pop();
+  return modelName === word || modelName?.endsWith(`-${word}`) === true;
+}
 function compareCapability(a, b) {
   const machine = Number(a.machine !== "none") - Number(b.machine !== "none");
   if (machine !== 0) return machine;
@@ -40968,6 +41073,8 @@ function ownerNote(owner) {
   const steer = owner.kind === "live" && owner.runId !== void 0 ? ` bind \`steer run ${owner.runId} <words>\` to deliver it,` : "";
   if (owner.kind === "pipeline")
     return `This thread is owned by ${who2}: the request below is a continuation of that durable task. Read tools may ground the decision, but every action folds into the owner so the current pull request is re-read and the pipeline resumes; an informational command or question is not fulfillment.`;
+  if (owner.kind === "unit")
+    return `This thread is owned by ${who2}: the request below is a follow-up for that unit. An inferred read command cannot answer it; fold the whole message into the unit unchanged. Ask a question only when a required detail is missing.`;
   return `This thread is owned by ${who2}: the request below is a follow-up for that owner. To act on it,${steer} bind a read command, or ask a question. Any other decision \u2014 a refusal, a preset, a write \u2014 folds the whole message into the owner unchanged and posts no answer.`;
 }
 function operatorProjection(input) {
@@ -40989,8 +41096,8 @@ function buildOperatorPrompt(input) {
     ] : [],
     "A write ask in a named or inherited repository binds the write preset even when a detail inside it is unresolved \u2014 the run it starts resolves the detail with the repository in front of it. Ask a question only for a fork the run itself could not resolve, and a question's proposal must be a line that would do the asked work: a write line for a write ask, never a read (an exploration, a listing, a summary) standing in for the work.",
     "A read command answers only a read intent: an ask to change, set, switch or update something is a write, and a listing or a show never answers it. Every command call declares its `intent`. When a write ask misses a required detail, or names a model provider this deployment does not have, read `provider_models` for the refs this deployment can run, then call `ask` with a proposal that would do the write built from them \u2014 the person's yes runs it, and their next words refine it.",
-    "When the request names a model in plain words \u2014 'with astra, \u2026', 'use sol for this', 'on gpt-6' \u2014 read `provider_models` to resolve the word to exactly ONE ref this deployment can run and pass that ref as `bind_preset`'s `model`: the run then uses it, exactly as a typed `model:` directive would. The request still rides verbatim \u2014 never strip the model word from it. A word that matches several refs, or none, is one `ask` naming the catalogue's candidate refs \u2014 never a guess and never a silent default; a request naming no model passes no `model`.",
-    "`bind_preset` runs the preset on the request as the author asked it \u2014 the author's own words ride by reference, so the call names only the preset, the optional model, and the reason: never re-type the request, never a flag form and never a paraphrase.",
+    "When the request names a model in plain words \u2014 'with astra, \u2026', 'use sol for this', 'on gpt-6' \u2014 read `provider_models` to resolve the word to exactly ONE ref this deployment can run. Pass that ref as `bind_preset`'s `model` and one exact model-name word from the person's request as `modelWord` (such as 'astra', 'o3', or 'gpt-6'): the run then uses it, exactly as a typed `model:` directive would. The request still rides verbatim \u2014 never strip the model word from it. A word that matches several refs, or none, is one `ask` naming the catalogue's candidate refs \u2014 never a guess and never a silent default; a request naming no model omits both `model` and `modelWord`.",
+    "`bind_preset` runs the preset on the request as the author asked it \u2014 the author's own words ride by reference, so the call names only the preset, optional model and modelWord, and the reason: never re-type the request, never a flag form and never a paraphrase.",
     "",
     // 2. Projection: the presets and commands THIS author may run.
     "Presets this author may run:",
@@ -41052,6 +41159,10 @@ function operatorTools(input) {
             type: "string",
             description: "the model ref the run uses, ONLY when the request names a model in plain words: a `<provider>/<model>` ref `provider_models` lists, resolved from the person's word \u2014 omit when no model is named, and ask instead of guessing when the word matches several refs or none"
           },
+          modelWord: {
+            type: "string",
+            description: "one exact model-name word in the person's request that `model` resolves, such as astra, o3, or gpt-6; omit with `model` when no model is named"
+          },
           repo: {
             type: "string",
             pattern: "^[\\w.-]+/[\\w.-]+$",
@@ -41253,15 +41364,15 @@ function parseOperatorTurn(answer, ctx) {
       ...typeof input.filter === "string" && input.filter.trim().length > 0 ? { filter: input.filter } : {}
     };
   if (answer.tool === OPERATOR_BIND_TOOL) {
-    const { preset, reason: reason2, model, repo } = input;
+    const { preset, reason: reason2, model, modelWord, repo } = input;
     if (typeof preset !== "string" || !ctx.presets.includes(preset))
       return {
         kind: "violation",
         violation: `bind_preset named "${String(preset)}", not a preset the projection offers`
       };
     let ref;
-    if (model !== void 0) {
-      const trimmed2 = typeof model === "string" ? model.trim() : "";
+    if (typeof model === "string" && model.trim() !== "" && typeof modelWord === "string" && requestedModelWord(ctx.requestText, modelWord, model)) {
+      const trimmed2 = model.trim();
       const parsed = /^([A-Za-z0-9_.-]+)\/\S+$/.exec(trimmed2);
       if (parsed === null)
         return {
@@ -41373,7 +41484,7 @@ function ownedDecisionRuns(event, owner, commands) {
     const def = commands.list().find((c) => c.id === parsed.id);
     if (!def) return false;
     if (def.id === "steer.run") return !(owner.kind === "live" && owner.runId === void 0);
-    return boundBlastRadius(def, parsed.input) === "read";
+    return owner.kind !== "unit" && boundBlastRadius(def, parsed.input) === "read";
   });
 }
 function isYesAnswer(text) {
@@ -41472,6 +41583,16 @@ async function runOperator(input, model, opts = {}) {
           const carried = attemptsOfThrow(err2);
           if (carried) attempts.push(...carried);
           const failure2 = providerFailureOf(err2);
+          const typedFailure = typedProviderFailureOf(err2);
+          const localAbort = err2 instanceof Error && err2.name === "AbortError";
+          if (signal2.aborted && typedFailure === void 0 && (localAbort || failure2.cause === "permanent" && failure2.status === void 0)) {
+            return answered({
+              kind: "refusal",
+              cause: "timeout",
+              reason: "operator_timeout",
+              text: "The routing request timed out; nothing started."
+            });
+          }
           const rejected = failure2.cause === "request-rejected" && failure2.status === 400 ? failure2.schemaRejection : void 0;
           const offered = rejected !== void 0 && [prompt.tool, ...prompt.tools ?? []].some((candidate) => candidate.name === rejected.tool);
           const retry = offered && rejected !== void 0 && schemaReasks < OPERATOR_SCHEMA_REASKS_MAX ? promptWithoutTool(prompt, rejected.tool) : void 0;
@@ -41712,9 +41833,11 @@ async function executeOperatorDecision(deps, ctx) {
     await recordOperatorDecision(deps, msg, event, ctx.ending, ctx.trace);
     return answered;
   }
-  if (event.providerFailure !== void 0) {
+  if (event.providerFailure !== void 0 || event.refusalCause === "timeout") {
     io.requestFailed?.();
-    await io.reply(event.refusalText ?? renderProviderFailure(event.providerFailure, "ended"));
+    await io.reply(
+      event.refusalText ?? (event.providerFailure !== void 0 ? renderProviderFailure(event.providerFailure, "ended") : "The routing request timed out; nothing started.")
+    );
     await recordOperatorDecision(deps, msg, event, ctx.ending, ctx.trace);
     return answered;
   }
@@ -41858,7 +41981,7 @@ var init_operator = __esm({
     };
     OPERATOR_READS_MAX = 4;
     OPERATOR_SCHEMA_REASKS_MAX = 4;
-    OPERATOR_TIMEOUT_MS = 2e4;
+    OPERATOR_TIMEOUT_MS = MINUTE_MS;
     OPERATOR_QUESTION_MARKER = "Did you mean:";
     OPERATOR_REQUEST_CAP = 600;
     OPERATOR_SOURCES_MAX = 12;
@@ -43117,7 +43240,7 @@ function parsePutReport(output) {
 function postCommandFor(path, url) {
   return `curl -fsS --upload-file ${shellQuote(path)} -X POST ${shellQuote(url)}`;
 }
-async function attachThroughStore(path, name, lead, artifacts, ctx) {
+async function attachThroughStore(path, name, lead, artifacts, ctx, publishForPr) {
   const exec = (command2, timeoutMs2) => {
     const opts = { timeoutMs: timeoutMs2, ...ctx.signal ? { signal: ctx.signal } : {} };
     return ctx.executor.exec(command2, opts);
@@ -43129,6 +43252,7 @@ async function attachThroughStore(path, name, lead, artifacts, ctx) {
   const size = parseByteSize(statOut);
   if (size === null) return `error: could not measure ${path}: ${statOut.trim()}`;
   if (size === 0) return `error: ${path} is empty \u2014 nothing to attach`;
+  if (publishForPr && size > MAX_PR_IMAGE_BYTES) return `error: PR images take at most ${MAX_PR_IMAGE_BYTES} bytes`;
   if (size > MAX_ARTIFACT_BYTES) {
     return `error: ${path} is ${size} bytes; attach_file takes files up to ${MAX_ARTIFACT_BYTES} bytes (1 GiB) \u2014 link to the file instead`;
   }
@@ -43159,12 +43283,22 @@ async function attachThroughStore(path, name, lead, artifacts, ctx) {
     return `error: the artifact store holds ${head.size} bytes for ${name}, not the ${size} measured${curlSaid} \u2014 nothing was posted`;
   }
   ctx.publish?.({ type: "artifact", direction: "out", key, name, size, contentType, callId });
+  const finish2 = async (attached) => {
+    if (!publishForPr) return attached;
+    try {
+      const url = await artifacts.store.publishPrImage(key);
+      return `${attached}; public PR image (retained by the artifact lifecycle): ![${safeBasename(name)}](${url})`;
+    } catch (err2) {
+      return `error: ${attached}; PR publication failed: ${describe4(err2)} \u2014 no public PR image was returned`;
+    }
+  };
   if (!ctx.uploadTicket) {
     const link = artifacts.artifactUrl?.(key);
     const where = link ? ` \u2014 ${link}` : ` is on the run page as ${key}`;
     await artifacts.reply(`${lead}
 \u{1F4CE} ${name} (${size} bytes)${where}`);
-    return `attached ${name} (${size} bytes) to the run page as ${key}; this conversation's channel takes no file uploads, so the lead and the file's link were posted instead`;
+    const linked = `attached ${name} (${size} bytes) to the run page as ${key}; this conversation's channel takes no file uploads, so the lead and the file's link were posted instead`;
+    return publishForPr ? `error: ${linked}; PR publication requires a completed channel upload \u2014 no public PR image was published` : linked;
   }
   const kept = "the file is kept on the run page";
   let ticket;
@@ -43182,7 +43316,7 @@ async function attachThroughStore(path, name, lead, artifacts, ctx) {
   } catch (err2) {
     return `error: the channel refused to complete the upload of ${name}: ${describe4(err2)}; ${kept}`;
   }
-  return `attached ${name} (${size} bytes) to the conversation and the run page`;
+  return finish2(`attached ${name} (${size} bytes) to the conversation and the run page`);
 }
 var MAX_ARTIFACT_BYTES, TRANSFER_FLOOR_BYTES_PER_MS, TRANSFER_SETUP_MS, STAT_TIMEOUT_MS, describe4, secs2, PUT_REPORT_FORMAT, attachFileTool;
 var init_attach = __esm({
@@ -43190,6 +43324,7 @@ var init_attach = __esm({
     "use strict";
     init_contentType();
     init_keys();
+    init_prImages();
     init_runEvents();
     init_bashTimeout();
     init_binaryRead();
@@ -43204,11 +43339,15 @@ var init_attach = __esm({
     attachFileTool = {
       name: "attach_file",
       failsInText: true,
-      description: `Post a file from the workspace into the conversation so the person sees it inline \u2014 a screenshot (e.g. from \`playwright screenshot\`), a rendered PDF, a recording, a log. Use it whenever you produce an image worth showing: a link to a file is not a picture. Whole files only: up to ${MAX_ARTIFACT_BYTES} bytes (1 GiB) where the artifact store is configured, ${MAX_READ_BYTES} bytes otherwise \u2014 the result says which.`,
+      description: `Post a file from the workspace into the conversation so the person sees it inline \u2014 a screenshot (e.g. from \`playwright screenshot\`), a rendered PDF, a recording, a log. Use it whenever you produce an image worth showing: a link to a file is not a picture. Whole files only: up to ${MAX_ARTIFACT_BYTES} bytes (1 GiB) where the artifact store is configured, ${MAX_READ_BYTES} bytes otherwise \u2014 the result says which. For an inspected, non-sensitive PNG screenshot, publishForPr: true also deliberately publishes a public PR image URL after thread delivery (10 MiB max, artifact retention applies). Omit it to keep the file private.`,
       inputSchema: {
         type: "object",
         properties: {
           path: { type: "string", description: "Relative path of the file in the workspace" },
+          publishForPr: {
+            type: "boolean",
+            description: "Explicitly make this PNG public for embedding in a PR, after attaching it here. Default false; inspect/redact first. Requires a bound permitted repository and artifact store. The copy expires under the artifact lifecycle."
+          },
           comment: {
             type: "string",
             description: "One line posted with the file saying what it shows (default: the file name)"
@@ -43221,7 +43360,16 @@ var init_attach = __esm({
         if (!path) return "error: path is required";
         const name = fileNameOf2(path);
         const lead = typeof input.comment === "string" && input.comment.trim() ? input.comment.trim() : name;
-        if (ctx.artifacts) return attachThroughStore(path, name, lead, ctx.artifacts, ctx);
+        if (input.publishForPr !== void 0 && typeof input.publishForPr !== "boolean")
+          return "error: publishForPr must be a boolean";
+        const publishForPr = input.publishForPr === true;
+        if (publishForPr) {
+          if (!ctx.repo) return "error: PR publication requires a bound repository";
+          if (!ctx.github?.canWrite(ctx.repo)) return "error: PR publication requires permission to use this repository";
+          if (!ctx.artifacts) return "error: PR publication requires the artifact store; no public image was published";
+          if (contentTypeFor(name) !== "image/png") return "error: PR publication supports only PNG screenshots";
+        }
+        if (ctx.artifacts) return attachThroughStore(path, name, lead, ctx.artifacts, ctx, publishForPr);
         if (!ctx.attach) {
           return "attach_file is not available here: this conversation's channel takes no file uploads \u2014 link to the file instead";
         }
@@ -49861,6 +50009,7 @@ function visiblePart(part) {
 }
 function fromPiMessage(message4, provider, tools) {
   if (message4.stopReason === "error" || message4.stopReason === "aborted") {
+    if (message4.stopReason === "aborted") throw new DOMException("The model call was aborted", "AbortError");
     const raw = message4.errorMessage ?? "the model call failed";
     const failure2 = classifyProviderFailure({ error: raw, provider, model: message4.model });
     const schemaRejection = failure2.cause === "request-rejected" && failure2.status === 400 ? providerSchemaRejectionOf(raw, tools) : void 0;
@@ -49992,6 +50141,7 @@ var init_piAi = __esm({
           const message4 = await this.api$().stream(model, shaped.body, options).result();
           return fromPiMessage(message4, this.name, req.tools);
         } catch (err2) {
+          if (err2 instanceof Error && err2.name === "AbortError") throw err2;
           const failure2 = providerFailureOf(err2);
           const schemaRejection = failure2.schemaRejection ?? (failure2.cause === "request-rejected" && failure2.status === 400 ? providerSchemaRejectionOf(err2, req.tools) : void 0);
           throw new ProviderFailure(failure2.cause, {
@@ -50154,10 +50304,12 @@ function judgePush(tail, ctx) {
       return refused4("repo:use \u2014 existing-PR publication requires the explicit owned destination");
     if (additionalRefspecs.length > 0)
       return refused4("repo:use \u2014 existing-PR publication allows exactly one owned destination");
-    const destination2 = refspec.replace(/^\+/, "").split(":").pop() ?? refspec;
-    const branch3 = destination2 === "HEAD" ? ctx.branch : destination2.replace(/^refs\/heads\//, "");
+    const [source3, destination2 = source3] = refspec.replace(/^\+/, "").split(":");
+    const branch3 = destination2.replace(/^refs\/heads\//, "");
     if (branch3 !== publication.ref)
       return refused4(`repo:use \u2014 push to \`${branch3}\`, not the owned publication ref ${publication.ref}`);
+    if (source3.replace(/^refs\/heads\//, "") !== publication.ref)
+      return refused4(`repo:use \u2014 push from the owned publication ref ${publication.ref}; the checkout may have moved`);
     const lease = `--force-with-lease=refs/heads/${publication.ref}:${publication.expectedHeadSha}`;
     if (!tail.split(/\s+/).includes(lease))
       return refused4(
@@ -50165,11 +50317,19 @@ function judgePush(tail, ctx) {
       );
     return allowed;
   }
+  if (ctx.branch !== void 0 && refspec === void 0)
+    return refused4(
+      `repo:use \u2014 name the run's branch ${ctx.branch} as the push source and destination; the checkout may have moved`
+    );
+  if (ctx.branch !== void 0 && additionalRefspecs.length > 0)
+    return refused4("repo:use \u2014 a bound run may push exactly one branch");
   if (refspec === void 0) return allowed;
-  const destination = refspec.replace(/^\+/, "").split(":").pop() ?? refspec;
+  const [source2, destination = source2] = refspec.replace(/^\+/, "").split(":");
   if (ctx.branch !== void 0) {
-    const branch3 = destination === "HEAD" ? ctx.branch : destination.replace(/^refs\/heads\//, "");
+    const branch3 = destination.replace(/^refs\/heads\//, "");
     if (branch3 !== ctx.branch) return refused4(`repo:use \u2014 push to \`${branch3}\`, not the run's branch ${ctx.branch}`);
+    if (source2.replace(/^refs\/heads\//, "") !== ctx.branch)
+      return refused4(`repo:use \u2014 push from the run's branch ${ctx.branch}; the checkout may have moved`);
     return allowed;
   }
   const branch2 = destination.replace(/^refs\/heads\//, "");
@@ -52391,7 +52551,7 @@ async function observeCodingWorkspace(executor, opts, span) {
     }
     return {
       observation: {
-        head: pushed === void 0 ? headSha : parseRevParseOutput(tipOut),
+        head: pushed === void 0 ? headSha : parseRevParseOutput(tipOut) ?? (checkedOut === pushed ? headSha : void 0),
         branch: branch2,
         checkedOut,
         remoteHead,
@@ -52408,7 +52568,11 @@ async function observeCodingWorkspace(executor, opts, span) {
   return (await probesAt(`git -C ${shellQuote(dir)}`)).observation;
 }
 function salvageTargetOf(opts) {
-  const branch2 = opts.pushedBranch ?? opts.checkedOut;
+  if (opts.ownedBranch !== void 0 && opts.checkedOut !== opts.ownedBranch)
+    return {
+      skipped: `the ending checkpoint kept work on \`${opts.checkedOut ?? "an unreadable checkout"}\`: the owned branch is \`${opts.ownedBranch}\``
+    };
+  const branch2 = opts.ownedBranch ?? opts.pushedBranch ?? opts.checkedOut;
   if (branch2 === void 0)
     return {
       skipped: "the budget-end salvage was skipped: the workspace's branch could not be read, so there is nowhere to push"
@@ -53457,8 +53621,9 @@ async function runLoop(deps, ctx) {
   let workspaceObserved = false;
   let workSalvageAttempted = false;
   let endingSalvageAttempted = false;
+  const coordinatorBranch = coordinator?.publication?.publicationRef ?? (coordinator !== void 0 ? binding?.ref ?? repoCtx.ref : void 0);
   const observeWorkspaceNow = async () => {
-    const pushedBranch = pushes.branch();
+    const pushedBranch = coordinator !== void 0 ? coordinatorBranch : pushes.branch();
     const observed = await root.span(
       "run.observe_workspace",
       (span) => observeCodingWorkspace(
@@ -53482,9 +53647,10 @@ async function runLoop(deps, ctx) {
   const preserveCodingChildWork = async (cue) => {
     if (workSalvageAttempted || !isCodingPrRun || coordinator === void 0) return;
     if (!workspaceObserved) await observeWorkspaceNow();
-    const target = salvageTargetOf({
+    const target = coordinatorBranch === void 0 ? { skipped: "the ending checkpoint was skipped: the unit's branch is unavailable" } : salvageTargetOf({
       pushedBranch: pushes.branch(),
       checkedOut: observedCheckedOut,
+      ownedBranch: coordinatorBranch,
       base: repoCtx.baseRef ?? await coordinatorBase
     });
     const salvaged = "skipped" in target ? { pushed: false, summary: target.skipped } : await root.span(
@@ -53504,7 +53670,7 @@ async function runLoop(deps, ctx) {
     const cleanCompletion = cue === "completion" && !salvaged.pushed && (/ended with nothing to preserve/i.test(salvaged.summary) || "skipped" in target && (observedUncommitted ?? 0) === 0 && (observedUnpushed ?? 0) === 0);
     if (cleanCompletion) return;
     workSalvageAttempted = true;
-    if (cue === "ending" || cue === "completion") endingSalvageAttempted = true;
+    if (cue === "ending" || cue === "completion" && !("skipped" in target)) endingSalvageAttempted = true;
     onEvent({
       type: "run_note",
       kind: cue === "budget" ? "budget_salvage" : "work_salvage",
@@ -65043,14 +65209,13 @@ async function askModel(input, deps) {
     );
     return { ...seam.value, attempts: seam.attempts };
   } catch (err2) {
-    const timedOut = err2 instanceof Error && (err2.name === "TimeoutError" || err2.name === "AbortError");
+    const timedOut = typedProviderFailureOf(err2) === void 0 && err2 instanceof Error && (err2.name === "TimeoutError" || err2.name === "AbortError");
     const attempts = attemptsOfThrow(err2);
     if (timedOut) {
       return {
         verdict: "silent",
-        reason: renderProviderFailure("transient", "ended"),
+        reason: "The request timed out before it could start.",
         source: "timeout",
-        providerFailure: "transient",
         ...attempts ? { attempts } : {}
       };
     }
@@ -73822,28 +73987,49 @@ async function steerChild(body, deps) {
   const steered = await deps.steerChild?.(body.runId, text, instance) ?? false;
   return json3(200, { ok: true, outcome: steered ? "steered" : "not_live", at });
 }
+function publicationStepPrefix(row2) {
+  const segment = row2.segments?.reduce((latest, entry) => Math.max(latest, entry.index), 1) ?? 1;
+  if ((row2.segments?.filter((entry) => entry.index === segment).length ?? 0) > 1)
+    throw new PublicationBindingRefusal("publication_facts_mismatch");
+  const base = stepPrefixOf(row2.unit, segment > 1 ? { segment, renewalsSpent: 0, spendUsd: null } : void 0);
+  const resumes = Object.entries(row2.wakes ?? {}).filter(
+    ([, answer]) => answer.kind === "segment" && answer.index === segment && answer.leaseMs !== void 0
+  );
+  let prefix = base;
+  for (let attempt = 1; attempt <= resumes.length; attempt += 1) {
+    const idlePrefix = `${prefix}/idle/`;
+    const answers = resumes.filter(
+      ([key]) => key.startsWith(idlePrefix) && /^[1-9][0-9]*$/.test(key.slice(idlePrefix.length))
+    );
+    if (answers.length !== 1) throw new PublicationBindingRefusal("publication_facts_mismatch");
+    prefix = `${base}/r${attempt}`;
+  }
+  return prefix;
+}
 async function advanceFindingsPublication(deps, instance, row2, facts2, runId3) {
   if (row2.publication === void 0 || facts2.headSha === row2.publication.expectedHeadSha) return row2;
   const child = await deps.runs.getRun(runId3, { include: "messages" });
   const owner = { instanceId: instance.id, unit: row2.unit };
   const latestReview = [...row2.rounds].reverse().find((round2) => round2.agent === "review");
-  const segment = row2.segments?.reduce((latest, entry) => Math.max(latest, entry.index), 1) ?? 1;
-  const prefix = row2.recovery !== void 0 ? `${row2.unit}/recovery` : stepPrefixOf(row2.unit, segment > 1 ? { segment, renewalsSpent: 0, spendUsd: null } : void 0);
+  const prefix = row2.recovery !== void 0 ? `${row2.unit}/recovery` : publicationStepPrefix(row2);
   const findingsPrefix = `${instance.id}:${prefix}/${latestReview?.index}/findings`;
   if (row2.recovery === void 0) {
     const tags = child.ok ? child.value.events?.filter((event) => event.type === "coordinator_tag") ?? [] : [];
     const tag = tags.length === 1 ? tags[0] : void 0;
-    if (row2.ending !== void 0 || row2.idle !== void 0 || latestReview?.outcome !== "request_changes" || !child.ok || child.value.startedAt < latestReview.at || tag?.parentInstanceId !== instance.id || tag.unit !== row2.unit || tag.base !== instance.base || JSON.stringify(tag.publication) !== JSON.stringify(row2.publication))
+    if (row2.ending !== void 0 || row2.idle !== void 0 || latestReview?.outcome !== "request_changes" || !child.ok || child.value.startedAt < latestReview.at || tag?.parentInstanceId !== instance.id || tag.unit !== row2.unit || tag.base !== instance.base || !samePublicationBinding(tag.publication, row2.publication))
       throw new PublicationBindingRefusal("publication_facts_mismatch");
     const listing = await deps.runs.listRuns({
-      status: "finished",
+      status: "all",
       visibleTo: EVERY_RUN,
       threadKey: row2.threadKey ?? instance.threadKey,
       limit: RUN_LIST_MAX_LIMIT
     });
-    if (listing.storeUnavailable || listing.nextBefore !== void 0 || listing.runs.filter(
+    const attempts = listing.runs.filter(
       (run2) => run2.parentInstanceId === instance.id && isStepAttempt(run2.idempotencyKey, findingsPrefix)
-    ).length !== 1)
+    );
+    if (listing.storeUnavailable || listing.nextBefore !== void 0 || attempts.filter((run2) => run2.id === runId3).length !== 1 || attempts.some(
+      (run2) => run2.id !== runId3 && !(run2.finished && (run2.status === "failed" || run2.status === "interrupted") && run2.agent === "coding" && run2.userId === instance.userId && run2.repo?.toLowerCase() === instance.repo.toLowerCase() && run2.threadKey === (row2.threadKey ?? instance.threadKey) && run2.startedAt >= latestReview.at && run2.finishedAt !== void 0 && run2.finishedAt >= run2.startedAt && run2.finishedAt <= child.value.startedAt && (run2.pushed?.length ?? 0) === 0)
+    ))
       throw new PublicationBindingRefusal("publication_facts_mismatch");
   }
   if (!child.ok || child.value.finished !== true || child.value.status !== "completed" || child.value.agent !== "coding" || child.value.parentInstanceId !== instance.id || child.value.userId !== instance.userId || child.value.repo?.toLowerCase() !== instance.repo.toLowerCase() || child.value.threadKey !== (row2.threadKey ?? instance.threadKey) || (row2.recovery !== void 0 ? child.value.idempotencyKey?.startsWith(`${instance.id}:${row2.unit}/recovery/`) !== true || !/\/findings(?:\/a[1-9][0-9]*)?$/.test(child.value.idempotencyKey ?? "") : !isStepAttempt(child.value.idempotencyKey, findingsPrefix)) || !fullHead(facts2.headSha) || child.value.headSha !== facts2.headSha || child.value.pushed?.some((push) => push.ref === row2.branch && push.sha === facts2.headSha) !== true || facts2.state !== "open" || facts2.sameRepoHead !== true || facts2.headBranchExists !== true || facts2.headRef !== row2.publication.headRef || facts2.baseRef !== row2.publication.baseRef || facts2.verifiedHead?.repo.toLowerCase() !== instance.repo.toLowerCase() || facts2.verifiedHead.ref !== row2.publication.publicationRef || facts2.verifiedHead.sha !== facts2.headSha || row2.publication.repo.toLowerCase() !== instance.repo.toLowerCase() || row2.publication.pr !== row2.pr?.number || row2.publication.baseRef !== instance.base || row2.publication.headRef !== row2.branch || row2.publication.publicationRef !== row2.branch || !samePublicationOwner(row2.publication.owner, owner))
@@ -74060,13 +74246,13 @@ async function recoverOriginalUnit(body, deps, caller) {
     const reviewThreadKey = row2.reviewThread?.threadKey ?? row2.threadKey ?? instance.threadKey;
     const unitThreadKey = row2.threadKey ?? instance.threadKey;
     const listing = await deps.runs.listRuns({
-      status: publication === void 0 ? "all" : "finished",
+      status: "all",
       visibleTo: EVERY_RUN,
       threadKey: reviewThreadKey,
       limit: RUN_LIST_MAX_LIMIT
     });
     const unitListing = unitThreadKey === reviewThreadKey ? listing : await deps.runs.listRuns({
-      status: publication === void 0 ? "all" : "finished",
+      status: "all",
       visibleTo: EVERY_RUN,
       threadKey: unitThreadKey,
       limit: RUN_LIST_MAX_LIMIT
@@ -74129,17 +74315,28 @@ async function recoverOriginalUnit(body, deps, caller) {
     const verified2 = facts2.verifiedHead;
     if (facts2.state !== "open" || facts2.sameRepoHead !== true || facts2.headBranchExists !== true || facts2.headRef !== row2.branch || facts2.baseRef !== base || !fullHead(facts2.headSha) || verified2 === void 0 || verified2.repo.toLowerCase() !== instance.repo.toLowerCase() || verified2.ref !== row2.branch || verified2.sha !== facts2.headSha)
       return json3(409, { ok: false, error: "recovery_facts_mismatch", at });
-    const findingsStep = `${segmentPrefix}/${boundary.index}/findings/pr-check`;
-    const findingsPrefix = `${instance.id}:${segmentPrefix}/${boundary.index}/findings`;
+    const findingsStep = `${segmentPrefix}/${boundary.index}/findings`;
+    const findingsPrefix = `${instance.id}:${findingsStep}`;
     const headMoved = facts2.headSha !== reviewedHead || expectedHead !== reviewedHead;
-    const completedFindings = unitListing.runs.filter(
-      (run2) => boundary.outcome === "request_changes" && row2.ending?.cause === "step_threw" && row2.ending.step === findingsStep && row2.ending.round === boundary.index && (expectedHead === reviewedHead || expectedHead === facts2.headSha) && run2.finished && run2.status === "completed" && run2.agent === "coding" && run2.parentInstanceId === instance.id && run2.userId === instance.userId && run2.repo?.toLowerCase() === instance.repo.toLowerCase() && run2.threadKey === unitThreadKey && isStepAttempt(run2.idempotencyKey, findingsPrefix) && run2.headSha === facts2.headSha && (!headMoved || run2.pushed?.some((push) => push.ref === row2.branch && push.sha === facts2.headSha) === true) && run2.startedAt >= (candidates2[0].finishedAt ?? candidates2[0].startedAt) && (run2.finishedAt === void 0 || run2.finishedAt <= row2.ending.at)
-    );
-    if (completedFindings.length > 1 || headMoved && completedFindings.length !== 1)
-      return json3(409, { ok: false, error: "recovery_head_moved", at });
-    if (completedFindings.length === 1) {
-      findingsRunId = completedFindings[0].id;
-      findingsKey = completedFindings[0].idempotencyKey;
+    const failedStep = row2.ending.step;
+    if (row2.ending.cause === "step_threw" && failedStep?.includes("/pr-check") === true) {
+      const checkedStep = failedStep.slice(0, -"/pr-check".length);
+      if (!failedStep.endsWith("/pr-check") || boundary.outcome !== "request_changes" || !isStepAttempt(checkedStep, findingsStep) || row2.ending.round !== boundary.index)
+        return json3(409, { ok: false, error: "recovery_head_moved", at });
+      const attempts = unitListing.runs.filter(
+        (run2) => run2.parentInstanceId === instance.id && isStepAttempt(run2.idempotencyKey, findingsPrefix)
+      );
+      const checkedAttempts = attempts.filter((run2) => run2.idempotencyKey === `${instance.id}:${checkedStep}`);
+      const completed = checkedAttempts.length === 1 ? checkedAttempts[0] : void 0;
+      const reviewFinishedAt = review.finishedAt;
+      if (reviewFinishedAt === void 0 || completed === void 0 || !completed.finished || completed.status !== "completed" || completed.agent !== "coding" || completed.userId !== instance.userId || completed.repo?.toLowerCase() !== instance.repo.toLowerCase() || completed.threadKey !== unitThreadKey || completed.pr !== void 0 && (completed.pr.number !== pr.number || completed.pr.head !== void 0 && completed.pr.head !== row2.branch) || completed.headSha !== facts2.headSha || expectedHead !== reviewedHead && expectedHead !== facts2.headSha || completed.pushed?.some((push) => push.ref !== row2.branch) === true || headMoved && completed.pushed?.some((push) => push.ref === row2.branch && push.sha === facts2.headSha) !== true || completed.startedAt < reviewFinishedAt || completed.finishedAt === void 0 || completed.finishedAt < completed.startedAt || completed.finishedAt > row2.ending.at || // Inspect every attempt, not just runs matching the current PR head:
+      // any competing success or push remains ambiguous after a later push.
+      attempts.some(
+        (run2) => run2.id !== completed.id && !(run2.finished && (run2.status === "failed" || run2.status === "interrupted") && run2.agent === "coding" && run2.userId === instance.userId && run2.repo?.toLowerCase() === instance.repo.toLowerCase() && run2.threadKey === unitThreadKey && run2.startedAt >= reviewFinishedAt && run2.finishedAt !== void 0 && run2.finishedAt >= run2.startedAt && run2.finishedAt <= completed.startedAt && (run2.pushed?.length ?? 0) === 0)
+      ))
+        return json3(409, { ok: false, error: "recovery_head_moved", at });
+      findingsRunId = completed.id;
+      findingsKey = completed.idempotencyKey;
       expectedHead = facts2.headSha;
       kind = "review";
       round2 = boundary.index + 1;
@@ -74148,7 +74345,10 @@ async function recoverOriginalUnit(body, deps, caller) {
         lastPush: expectedHead,
         publication: { ...publication, expectedHeadSha: expectedHead }
       };
-    } else expectedHead = reviewedHead;
+    } else {
+      if (headMoved) return json3(409, { ok: false, error: "recovery_head_moved", at });
+      expectedHead = reviewedHead;
+    }
     const floor = minutesToMs(leaseMinimum(kind === "findings" ? "fix" : "review"));
     if (!Number.isFinite(remainingMs) || remainingMs < floor)
       return json3(409, { ok: false, error: "recovery_wall_clock_exhausted", at });
@@ -75787,7 +75987,7 @@ function createAdminCoordinatorHandler(deps) {
     })();
   };
 }
-var COORDINATOR_ADMIN_PREFIX, MAX_SPAWN_PROMPT_CHARS, FINISHED_LOOKBACK_PAGES, MAX_ADMIN_BODY_BYTES, UNIT_ID, PRESETS_OF_KIND, invalid, json3, describe12, isGenerated2, EVERY_RUN, REVIEW_POSTED_CHECKS, REVIEW_POSTED_RECHECK_MS, githubSecondStart, CHILD_SUPERSESSION_REASONS, PublicationBindingRefusal, samePublicationOwner, fullHead, isStepAttempt, ROUND_OUTCOMES, ENDING_ICON, STEPS;
+var COORDINATOR_ADMIN_PREFIX, MAX_SPAWN_PROMPT_CHARS, FINISHED_LOOKBACK_PAGES, MAX_ADMIN_BODY_BYTES, UNIT_ID, PRESETS_OF_KIND, invalid, json3, describe12, isGenerated2, EVERY_RUN, REVIEW_POSTED_CHECKS, REVIEW_POSTED_RECHECK_MS, githubSecondStart, CHILD_SUPERSESSION_REASONS, PublicationBindingRefusal, samePublicationOwner, samePublicationBinding, fullHead, isStepAttempt, ROUND_OUTCOMES, ENDING_ICON, STEPS;
 var init_adminCoordinator = __esm({
   "../../src/channels/adminCoordinator.ts"() {
     "use strict";
@@ -75851,6 +76051,7 @@ var init_adminCoordinator = __esm({
       reason;
     };
     samePublicationOwner = (left, right) => left?.instanceId === right.instanceId && left.unit === right.unit;
+    samePublicationBinding = (left, right) => left !== void 0 && left.repo === right.repo && left.pr === right.pr && left.headRef === right.headRef && left.baseRef === right.baseRef && left.expectedHeadSha === right.expectedHeadSha && left.publicationRef === right.publicationRef && samePublicationOwner(left.owner, right.owner);
     fullHead = (value) => typeof value === "string" && /^[0-9a-f]{40}$/i.test(value);
     isStepAttempt = (key, step) => key === step || key?.startsWith(`${step}/a`) === true && /^[1-9][0-9]*$/.test(key.slice(step.length + 2));
     ROUND_OUTCOMES = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreplane/switchboard",
-  "version": "1.262.3",
+  "version": "1.263.0",
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
   "homepage": "https://openswitchboard.dev",