@coreplane/switchboard 1.266.0 → 1.267.0

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.266.0",
+  "version": "1.267.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
@@ -102,6 +102,7 @@
     "@opencode/protocol": "2.0.3",
     "@opencode/schema": "2.0.3",
     "@types/node": "^24.0.0",
+    "@vue/compiler-sfc": "3.5.42",
     "effect": "4.0.0-rc.112",
     "eslint": "^10.10.0",
     "eslint-config-prettier": "^10.1.8",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.266.0",
-  "commit": "9b03a2a996929a0e6f8604a7ea830106b0f37e53",
-  "builtAt": "2026-09-26T17:09:46.306Z"
+  "version": "1.267.0",
+  "commit": "594f06834184ea4ff5559b00a8fc265f33e3db64",
+  "builtAt": "2026-09-28T22:36:17.080Z"
 }

package/dist/assets/src/channels/githubDoorPaths.ts

@@ -0,0 +1,36 @@
+/** The public Git door surface, shared by the bot and its Cloudflare edge. */
+export const GIT_DOOR_PATH =
+  /^\/(?:git\/)?([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\.git\/(info\/refs|git-upload-pack|git-receive-pack)$/;
+
+export function isGithubDoorPath(path: string): boolean {
+  return path === "/api/graphql" || path.startsWith("/api/v3/") || GIT_DOOR_PATH.test(path);
+}
+
+export function githubDoorMethodAllowed(url: URL, method: string): boolean {
+  const path = url.pathname;
+  if (path === "/api/graphql") return method === "POST";
+  if (path.startsWith("/api/v3/")) return method === "GET" || method === "HEAD";
+  const git = GIT_DOOR_PATH.exec(path);
+  if (!git) return false;
+  if (git[3] === "info/refs")
+    return method === "GET" && ["git-upload-pack", "git-receive-pack"].includes(url.searchParams.get("service") ?? "");
+  return method === "POST";
+}
+
+/** A configured git.* host exposes only the door. A door path on any other
+ * host, including workers.dev and the dashboard host, is never forwarded. */
+export function githubDoorEdgeRoute(url: URL, method: string, configuredBase?: string): "door" | "other" | "refuse" {
+  const doorPath = isGithubDoorPath(url.pathname);
+  if (!configuredBase) return doorPath ? "refuse" : "other";
+  let base: URL;
+  try {
+    base = new URL(configuredBase);
+  } catch {
+    return "refuse";
+  }
+  if (base.protocol !== "https:" || base.pathname !== "/" || base.search || base.hash) return "refuse";
+  if (url.host === base.host) {
+    return url.protocol === "https:" && doorPath && githubDoorMethodAllowed(url, method) ? "door" : "refuse";
+  }
+  return doorPath ? "refuse" : "other";
+}

package/dist/assets/src/core/coordinator/contract.ts

@@ -313,6 +313,8 @@ export interface ExistingPrPublicationBinding {
 export interface CoordinatorTag {
   parentInstanceId: string;
   idempotencyKey: string;
+  /** The unit's durable write branch, read from its row at child admission. */
+  branch?: string;
   /** Workflow transport for a recovered child. Identity and idempotency remain
    * on `parentInstanceId`; only lifecycle wake-ups use this checkpoint id. */
   transportWorkflowId?: string;
@@ -491,11 +493,20 @@ export interface RoundGate {
   findings: string[];
 }
 
+/** The original grant and historically priced children carried through a recovery checkpoint. */
+export interface RecoveryAccounting {
+  spendUsd: number;
+  children: { runId: string; key: string; usd: number }[];
+  grant: Grant;
+  renewalsSpent: number;
+}
+
 /** One admitted continuation of an ended original unit. The claim replaces
  * the terminal interpretation before a child starts; its step remains under
  * the original instance/unit idempotency namespace. */
 export interface OriginalUnitRecovery {
   kind: "findings" | "review";
+  accounting?: RecoveryAccounting;
   round: number;
   expectedHeadSha: string;
   remainingMs: number;
@@ -529,6 +540,7 @@ export interface OriginalUnitRecovery {
 }
 
 export interface OriginalUnitRecoveryReceipt {
+  accounting?: RecoveryAccounting;
   reviewRunId: string;
   workflowId: string;
   at: number;
@@ -695,7 +707,6 @@ const isRoundGate = (v: unknown): boolean =>
   isAddressSeverity(v.level) &&
   Array.isArray(v.findings) &&
   v.findings.every((f) => typeof f === "string");
-
 export const isHumanGatePending = (v: unknown): v is HumanGatePending =>
   isObject(v) &&
   isObject(v.pr) &&
@@ -756,6 +767,24 @@ export const isUnitWakeAnswer = (v: unknown): v is UnitWakeAnswer => {
   );
 };
 
+const isDollars = (v: unknown): v is number => isFinite(v) && v >= 0;
+const isRecoveryAccounting = (v: unknown): v is RecoveryAccounting =>
+  isObject(v) &&
+  isDollars(v.spendUsd) &&
+  Array.isArray(v.children) &&
+  v.children.length > 0 &&
+  v.children.every((c) => isObject(c) && isText(c.runId) && isText(c.key) && isDollars(c.usd)) &&
+  new Set(v.children.map((c) => c.runId)).size === v.children.length &&
+  new Set(v.children.map((c) => c.key)).size === v.children.length &&
+  v.children.reduce((sum, c) => sum + c.usd, 0) === v.spendUsd &&
+  isObject(v.grant) &&
+  isDollars(v.grant.renewals) &&
+  Number.isSafeInteger(v.grant.renewals) &&
+  (v.grant.costCapUsd === undefined || (isDollars(v.grant.costCapUsd) && v.grant.costCapUsd > v.spendUsd)) &&
+  isDollars(v.renewalsSpent) &&
+  Number.isSafeInteger(v.renewalsSpent) &&
+  v.renewalsSpent <= v.grant.renewals;
+
 export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
   if (!isObject(v)) return false;
   const r = v;
@@ -809,6 +838,7 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
       typeof r.recovery.step === "string" &&
       STEP_NAME_PATTERN.test(r.recovery.step) &&
       isText(r.recovery.reviewRunId) &&
+      (r.recovery.accounting === undefined || isRecoveryAccounting(r.recovery.accounting)) &&
       (r.recovery.findingsRunId === undefined || isText(r.recovery.findingsRunId)) &&
       (r.recovery.findingsKey === undefined || isText(r.recovery.findingsKey)) &&
       ((r.recovery.findingsRunId === undefined && r.recovery.findingsKey === undefined) ||
@@ -839,6 +869,7 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
     r.recoveryReceipt !== undefined &&
     (!isObject(r.recoveryReceipt) ||
       !isText(r.recoveryReceipt.reviewRunId) ||
+      (r.recoveryReceipt.accounting !== undefined && !isRecoveryAccounting(r.recoveryReceipt.accounting)) ||
       typeof r.recoveryReceipt.workflowId !== "string" ||
       !INSTANCE_ID_PATTERN.test(r.recoveryReceipt.workflowId) ||
       !isFinite(r.recoveryReceipt.at))

package/dist/assets/src/core/coordinator/driver.ts

@@ -423,7 +423,8 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
       ...(typeof costUsd === "number" || costUsd === null ? { costUsd } : {}),
       ...(handoffLists !== undefined ? { handoffLists } : {}),
       // The failure by name (run-history item 57), shape-checked: a
-      // `provider_transient` drives the round-0 re-run (agent-ship item 9).
+      // A provider transient or incomplete local model stream drives the
+      // round-0 re-run (agent-ship item 9).
       ...(isRecord(failure) && typeof failure.kind === "string" ? { failure: { kind: failure.kind } } : {}),
       // What ended an interrupted child (issue 1876): the ending's sentence
       // names the cause instead of claiming a bot restart for every one.
@@ -1043,7 +1044,15 @@ async function runUnit(
     addressSeveritySource: plan.addressSeveritySource,
     // Recovery spends only the lease already carried by the claim. It never
     // opens another segment or idles for a renewal in this checkpoint.
-    grant: row?.recovery !== undefined ? { renewals: 0 } : plan.grant,
+    grant:
+      row?.recovery === undefined
+        ? plan.grant
+        : (row.recovery.accounting?.grant ??
+          // A missing capped carry must still stop before dispatch, while an
+          // uncapped legacy checkpoint must not acquire plan renewals.
+          (plan.grant?.costCapUsd !== undefined
+            ? { renewals: 0, costCapUsd: plan.grant.costCapUsd }
+            : { renewals: 0 })),
     grantSource: plan.grantSource,
     verbosity: plan.verbosity,
     idleDays: row?.recovery !== undefined ? 0 : plan.idleDays,
@@ -1054,7 +1063,13 @@ async function runUnit(
     ...(lastPush !== undefined ? { lastPush } : {}),
     ...(session !== undefined ? { session } : {}),
     ...(row?.recovery !== undefined
-      ? { recovery: { remainingMs: row.recovery.remainingMs, unitKey: `${instanceId}:${unit}` } }
+      ? {
+          recovery: {
+            remainingMs: row.recovery.remainingMs,
+            unitKey: `${instanceId}:${unit}`,
+            ...(row.recovery.accounting !== undefined ? { renewalsSpent: row.recovery.accounting.renewalsSpent } : {}),
+          },
+        }
       : {}),
   };
   let state: UnitPipelineState =
@@ -1065,6 +1080,7 @@ async function runUnit(
           pr: row.pr!,
           expectedHeadSha: row.recovery.expectedHeadSha,
           reviewRunId: row.recovery.reviewRunId,
+          ...(row.recovery.accounting !== undefined ? { spendUsd: row.recovery.accounting.spendUsd } : {}),
           ...(row.recovery.findingsRunId !== undefined ? { findingsRunId: row.recovery.findingsRunId } : {}),
           ...(row.recovery.findings !== undefined ? { findings: row.recovery.findings } : {}),
         })

package/dist/assets/src/core/refusal.ts

@@ -64,6 +64,7 @@ const CAUSE_OF = {
   // one pipeline per thread (record 0060): the host key's claim answered thread-live
   ship_thread_live: "request",
   setup_failed: "system",
+  run_budget_exhausted: "system",
   publication_ownership_unknown: "system",
   // the click on a confirmation (confirm.ts)
   confirmation_used: "request",

package/dist/assets/src/core/runEvents.ts

@@ -974,6 +974,7 @@ export type RunEvent =
       type: "coordinator_tag";
       parentInstanceId: string;
       unit?: string;
+      branch?: string;
       transportWorkflowId?: string;
       recovery?: import("./coordinator/contract.js").CoordinatorTag["recovery"];
       base?: string;

package/dist/assets/src/core/runRecord.ts

@@ -572,12 +572,15 @@ function isRunPullRequestShape(v: unknown): v is RunPullRequest {
  *  explanation's words — so the session's next seed leaves the refused
  *  request out of its tail (docs/reference/specs/session-log.md item 9).
  *  `provider_transient`: the run's model call failed on a provider transient
- *  (a gateway 5xx, a cut stream, a gateway timeout) with the harness's retry
+ *  (a gateway 5xx or timeout) with the harness's retry
  *  ladder spent — the ship runner reads it off the child's record to re-run a
  *  round-0 child that pushed nothing instead of aborting the unit
- *  (docs/reference/specs/agent-ship.md item 9, issue 1932). A failure without
+ *  (docs/reference/specs/agent-ship.md item 9, issue 1932).
+ *  `model_stream_incomplete`: pi's answer stream ended incomplete after its
+ *  local retry lease, with no provider-down evidence; Ship grants the same
+ *  one re-run when nothing was pushed. A failure without
  *  a name here leaves the record without the field. */
-export const RUN_FAILURE_KINDS = ["policy_refusal", "provider_transient"] as const;
+export const RUN_FAILURE_KINDS = ["policy_refusal", "provider_transient", "model_stream_incomplete"] as const;
 export type RunFailureKind = (typeof RUN_FAILURE_KINDS)[number];
 export interface RunFailure {
   kind: RunFailureKind;
@@ -702,9 +705,50 @@ export function clampListLimit(limit: number | undefined): number {
   return Math.min(RUN_LIST_MAX_LIMIT, Math.max(1, Math.floor(limit)));
 }
 
+/** The recovery audit must see either identity claim, including contradictory
+ * parents, and any activity in the original threads. Never AND these claims. */
+export interface RecoveryEvidenceScope {
+  instanceId: string;
+  unit: string;
+  threadKeys: string[];
+}
+
+export function isRecoveryEvidenceScope(value: unknown): value is RecoveryEvidenceScope {
+  if (typeof value !== "object" || value === null) return false;
+  const scope = value as RecoveryEvidenceScope;
+  return (
+    typeof scope.instanceId === "string" &&
+    scope.instanceId.length > 0 &&
+    scope.instanceId.length <= 256 &&
+    typeof scope.unit === "string" &&
+    /^U[1-9][0-9]*$/.test(scope.unit) &&
+    scope.unit.length <= 64 &&
+    Array.isArray(scope.threadKeys) &&
+    scope.threadKeys.length > 0 &&
+    scope.threadKeys.length <= 2 &&
+    scope.threadKeys.every((key) => typeof key === "string" && key.length > 0 && key.length <= 256)
+  );
+}
+
+export function matchesRecoveryEvidence(
+  run: { parentInstanceId?: string; idempotencyKey?: string; threadKey?: string },
+  scope: RecoveryEvidenceScope,
+): boolean {
+  const unitKey = `${scope.instanceId}:${scope.unit}`;
+  return (
+    run.parentInstanceId === scope.instanceId ||
+    run.idempotencyKey === unitKey ||
+    run.idempotencyKey?.startsWith(`${unitKey}/`) === true ||
+    (run.threadKey !== undefined && scope.threadKeys.includes(run.threadKey))
+  );
+}
+
 /** The `list` query — the same fields on the wire (`/runs/list`) and in the
  *  `RunStore` interface. */
 export interface RunListOptions {
+  /** Internal admission audit: a complete bounded relevant set, never a UI page.
+   * A Worker must explicitly attest completeness; a full page is not evidence. */
+  recoveryEvidence?: RecoveryEvidenceScope;
   /** Rows to return: default `RUN_LIST_DEFAULT_LIMIT`, capped at `RUN_LIST_MAX_LIMIT`. */
   limit?: number;
   /** Cursor: only runs ordered after the last row seen — `finishedAt` strictly

package/dist/assets/src/core/ship/coordinator.ts

@@ -630,8 +630,8 @@ export type ChildFacts =
       costUsd?: number | null;
       handoffLists?: Handoff;
       /** The failure by name off a `failed` run's record (run-history item 57):
-       *  `provider_transient` marks a child a gateway 5xx, a cut stream or a
-       *  gateway timeout ended past the harness's retry ladder (issue 1932). */
+       *  provider transport failure or an incomplete local model stream may
+       *  earn one round-0 re-run when nothing was pushed (issue 1932). */
       failure?: { kind: string };
       /** What ended an `interrupted` child, off its record's own events (issue
        *  1876): the ending's sentence names it instead of claiming a bot
@@ -996,14 +996,14 @@ export type UnitEnding =
     }
   | { kind: "no_verdict"; round: RoundRef; reviewRounds: number; finalReply?: string }
   | { kind: "idle_expired"; reviewRounds: number }
-  /** Round 0's coding child died on a provider transient — a model-gateway
-   *  5xx, a cut stream, a gateway timeout, past the harness's retry ladder —
+  /** Round 0's coding child died on a retryable model-call failure — a
+   *  provider transient or an incomplete local stream past its retry ladder —
    *  with nothing pushed, TWICE: the first such death re-ran the round once
    *  (the ledger row and the branch untouched, a re-run costs only minutes),
    *  and the second is the ending (agent-ship item 9, issue 1932). Named
    *  `transient` so it reads as a condition beside `checks_failed` and `held`
    *  in the plane's table, never as the child failing on its task. */
-  | { kind: "transient"; round: RoundRef; runId: string; reviewRounds: number }
+  | { kind: "transient"; round: RoundRef; runId: string; reviewRounds: number; streamIncomplete?: true }
   | {
       kind: "interrupted";
       round: RoundRef;
@@ -1182,7 +1182,7 @@ export interface UnitPipelineInput {
   /** A terminal original unit re-entered at its unchanged reviewed head. The
    * exact remaining lease is carried in milliseconds; the step prefix keeps
    * every new durable step under `<original instance>:<unit>/recovery/...`. */
-  recovery?: { remainingMs: number; unitKey: string };
+  recovery?: { remainingMs: number; unitKey: string; renewalsSpent?: number };
 }
 
 type Phase =
@@ -1249,11 +1249,12 @@ type Phase =
       dead?: "failed" | "interrupted";
       /** What ended the dead child (issue 1876), for the `interrupted` ending's sentence. */
       cause?: InterruptionCause;
-      /** The dead child's record names a provider transient (`failure:
-       *  provider_transient`, issue 1932): with nothing pushed, round 0 is
-       *  re-run once instead of the unit aborting; a second transient in the
-       *  same round is the `transient` ending. */
+      /** The dead child's record names a retryable model-call failure
+       *  (run-history item 57): with nothing pushed, round 0 is re-run once;
+       *  a second such failure is the `transient` ending. */
       transient?: true;
+      /** The retry signal was a local incomplete stream, not provider-down. */
+      streamIncomplete?: true;
     }
   /** `queued`: the door enqueued the pull request — the base takes changes
    *  only through a merge queue (issue 2011) — so every later ask reads the
@@ -1417,6 +1418,7 @@ export function openRecoveredUnitPipeline(
     pr: PrRef;
     expectedHeadSha: string;
     reviewRunId: string;
+    spendUsd?: number;
     findingsRunId?: string;
     findings?: Finding[];
   },
@@ -1435,12 +1437,10 @@ export function openRecoveredUnitPipeline(
     reviewRestarts: 0,
     pr: recovery.pr,
     lastReviewHead: recovery.expectedHeadSha,
-    // Legacy terminal rows do not carry a complete lifetime category split or
-    // cumulative dollars. Recovery therefore measures only this checkpoint;
-    // admission refuses a cost-capped row rather than resetting an enforced
-    // total, and reports label this split as checkpoint-local.
+    // Elapsed categories remain checkpoint-local. Enforced cumulative dollars
+    // come only from the admission claim's complete persisted child evidence.
     spentMs: { coding: 0, review: 0, waiting: 0 },
-    spendUsd: 0,
+    spendUsd: recovery.spendUsd ?? (input.grant?.costCapUsd === undefined ? 0 : null),
     findingsByRound: recovery.kind === "findings" ? { [recovery.round]: recovery.findings ?? [] } : {},
     humanAnswersByRound: {},
     dispositionsByRound: {},
@@ -1747,7 +1747,10 @@ function idleEnding(s: UnitPipelineState, ending: UnitEnding): Extract<UnitEndin
   const grant = s.input.grant ?? DEFAULT_GRANT;
   // Unspent: an idle spends no renewal — the wake's segment does (this plan's
   // fifth unit) — so the row says what the grant still holds.
-  const renewalsLeft = Math.max(0, grant.renewals - (s.input.session?.renewalsSpent ?? 0));
+  const renewalsLeft = Math.max(
+    0,
+    grant.renewals - (s.input.recovery?.renewalsSpent ?? s.input.session?.renewalsSpent ?? 0),
+  );
   // The head to continue from: a segment's own; a review_pending's reviewed
   // head — the pull request's, known even when the coding record carried none,
   // so the re-issue's resume-at-review fact survives the idle; else the last
@@ -1832,7 +1835,10 @@ function parkHumanGate(
     kind: "idle",
     why: "held",
     idled: held,
-    renewalsLeft: Math.max(0, grant.renewals - (s.input.session?.renewalsSpent ?? 0)),
+    renewalsLeft: Math.max(
+      0,
+      grant.renewals - (s.input.recovery?.renewalsSpent ?? s.input.session?.renewalsSpent ?? 0),
+    ),
     ...(s.lastReviewHead !== undefined ? { from: s.lastReviewHead } : {}),
     ...(s.lastCodingRunId !== undefined ? { runId: s.lastCodingRunId } : {}),
     spendUsd: s.spendUsd,
@@ -1878,10 +1884,29 @@ function capEnding(s: UnitPipelineState, round?: RoundRef, refused?: Carve): Uni
   };
 }
 
+/** A recovered unit keeps its original dollar cap across the checkpoint. */
+function recoveryCostEnding(s: UnitPipelineState): UnitEnding | undefined {
+  const cap = s.input.grant?.costCapUsd;
+  if (s.input.recovery === undefined || cap === undefined) return undefined;
+  if (s.spendUsd !== null && Number.isFinite(s.spendUsd) && s.spendUsd >= 0 && s.spendUsd < cap) return undefined;
+  return {
+    kind: "aborted",
+    reason:
+      s.spendUsd === null
+        ? `The original $${cap} cost cap cannot be proven: cumulative child spend is unknown.`
+        : `The original $${cap} cost cap is exhausted; cumulative child spend is $${s.spendUsd}.`,
+    reviewRounds: s.reviewRounds,
+  };
+}
+
 /** Start a round if its carve holds (agent-ship item 8): a round the
  *  remainder cannot carve above its floor is not dispatched, and the unit ends
  *  at the cap naming the round, what it would have got and the floor. */
 function enterRound(s: UnitPipelineState, round: RoundRef, notes: CoordinatorNote[] = []): Transition {
+  if (s.input.recovery !== undefined && round.index > s.input.caps.maxRounds)
+    return end(s, { kind: "round_cap", maxRounds: s.input.caps.maxRounds, reviewRounds: s.reviewRounds }, notes);
+  const costEnding = recoveryCostEnding(s);
+  if (costEnding !== undefined) return end(s, costEnding, notes);
   const carved = roundCarve(s, round);
   if (carved.kind === "refused") return end(s, capEnding(s, round, carved), notes);
   const reviewRounds = round.kind === "review" ? round.index : s.reviewRounds;
@@ -1976,6 +2001,11 @@ function settleCoding(
         }
       : {}),
   };
+  // A completed findings child may have moved the head. Its verification
+  // read reconciles that head before the cap ends the unit.
+  const costEnding = recoveryCostEnding(next);
+  if (costEnding !== undefined && !(round.kind === "findings" && facts.status === "completed"))
+    return end(next, costEnding, [roundNote(round, "aborted")]);
   const readySalvage = round.kind === "coding" && completedSameHeadSalvage(next, facts.pushed, facts);
   const checkpoint = interruptedCheckpoint(next, facts.pushed, round.kind === "findings" ? undefined : facts);
   const mode = stopMode(facts.status);
@@ -2060,9 +2090,11 @@ function settleCoding(
     const cause =
       facts.failure?.kind === "provider_transient"
         ? "the model provider's transport retry budget was spent"
-        : facts.status === "failed"
-          ? "it failed before finishing"
-          : "it ended before its work was ready for review";
+        : facts.failure?.kind === "model_stream_incomplete"
+          ? "the model stream ended before a complete answer"
+          : facts.status === "failed"
+            ? "it failed before finishing"
+            : "it ended before its work was ready for review";
     return end(
       next,
       {
@@ -2088,7 +2120,10 @@ function settleCoding(
           round,
           runId,
           dead: "failed",
-          ...(facts.failure?.kind === "provider_transient" ? { transient: true as const } : {}),
+          ...(facts.failure?.kind === "provider_transient" || facts.failure?.kind === "model_stream_incomplete"
+            ? { transient: true as const }
+            : {}),
+          ...(facts.failure?.kind === "model_stream_incomplete" ? { streamIncomplete: true as const } : {}),
         },
       },
       notes: [],
@@ -2117,10 +2152,11 @@ function settleReview(
   facts: Extract<ChildFacts, { finished: true }>,
 ): Transition {
   const mode = stopMode(facts.status);
+  const charged = { ...s, spendUsd: addSpend(s.spendUsd, facts.costUsd) };
   if (!facts.verdict) {
     if (mode !== undefined)
       return end(
-        s,
+        charged,
         {
           kind: "stopped",
           mode,
@@ -2131,7 +2167,7 @@ function settleReview(
         [roundNote(round, "stopped")],
       );
     return end(
-      s,
+      charged,
       {
         kind: "no_verdict",
         round,
@@ -2143,13 +2179,14 @@ function settleReview(
   }
   const verdict = facts.verdict;
   const next: UnitPipelineState = {
-    ...s,
-    spendUsd: addSpend(s.spendUsd, facts.costUsd),
+    ...charged,
     findingsByRound: { ...s.findingsByRound, [round.index]: verdict.findings },
     ...(facts.reviewHead !== undefined ? { lastReviewHead: facts.reviewHead } : {}),
     ...(verdict.summary !== undefined ? { lastVerdictSummary: verdict.summary } : {}),
   };
   const notes = [roundNote(round, verdict.verdict)];
+  const costEnding = recoveryCostEnding(next);
+  if (costEnding !== undefined) return end(next, costEnding, notes);
   if (verdict.verdict === "approve") {
     // Merge-ready stands on the POSTED approval: an approve whose post did
     // not land left no approving review on the pull request. The reason is
@@ -2776,15 +2813,23 @@ function settlePrCheck(s: UnitPipelineState, phase: Extract<Phase, { at: "pr-che
         [roundNote(round, "aborted")],
       );
     if (phase.dead === "failed") {
-      // A provider transient with nothing pushed is not the child's failure
+      // A retryable model-call failure with nothing pushed is not the child's failure
       // (issue 1932): the ledger row and the branch are untouched, so round 0
       // is re-run once — a fresh attempt under fresh step names — and only a
       // second transient in the same round is the ending, named `transient`.
       if (phase.transient && round.kind === "coding" && pr.unrecovered === "no_commits") {
         if ((round.attempt ?? 1) < 2) return enterRound(s, { ...round, attempt: 2 }, [roundNote(round, "transient")]);
-        return end(s, { kind: "transient", round, runId: phase.runId, reviewRounds: s.reviewRounds }, [
-          roundNote(round, "transient"),
-        ]);
+        return end(
+          s,
+          {
+            kind: "transient",
+            round,
+            runId: phase.runId,
+            reviewRounds: s.reviewRounds,
+            ...(phase.streamIncomplete ? { streamIncomplete: true as const } : {}),
+          },
+          [roundNote(round, "transient")],
+        );
       }
       // The abort repeats the bot's reason for recovering nothing, and claims
       // no more than the answer carried.
@@ -3825,11 +3870,10 @@ function renderUnitReportWithWake(
   const level = s.input.addressSeverity ?? DEFAULT_ADDRESS_SEVERITY;
   const levelLine = `Severity addressed: ${level} and above (set by ${s.input.addressSeveritySource ?? "org"}).`;
   // The grant as the instance carries it (decision 0046): spent of granted,
-  // the cap when one is set, and who granted it — zero of zero until a scope
-  // or a directive says otherwise, and nothing spends it before the renewal
-  // decision exists.
+  // the cap when one is set, and who granted it. A capped recovery carries
+  // proven spent renewals; an uncapped legacy checkpoint has zero capacity.
   const grant = s.input.grant ?? DEFAULT_GRANT;
-  const grantLine = `Renewals: 0 of ${grant.renewals} spent${grant.costCapUsd !== undefined ? `, cost cap $${grant.costCapUsd}` : ""} (granted by ${s.input.grantSource ?? "org"}).`;
+  const grantLine = `Renewals: ${s.input.recovery?.renewalsSpent ?? 0} of ${grant.renewals} spent${grant.costCapUsd !== undefined ? `, cost cap $${grant.costCapUsd}` : ""} (granted by ${s.input.grantSource ?? "org"}).`;
   const lastFindings = s.findingsByRound[e.reviewRounds] ?? [];
   const skipped = lastFindings.filter((f) => !findingsAtOrAbove([f], level).length);
   const skippedLine =
@@ -4076,11 +4120,11 @@ function renderUnitReportWithWake(
       ]);
     case "transient":
       if (!shows(verbosity, "verbose"))
-        return `⚠️ Aborted after ${rounds}: this is a bug — the model provider failed twice and no automatic retry remains.${prLine}`;
+        return `⚠️ Aborted after ${rounds}: this is a bug — the model call failed twice and no automatic retry remains.${prLine}`;
       return join([
-        `⚠️ The coding child of round ${e.round.index} (run ${e.runId}) died on a provider transient — a model-gateway 5xx, a cut stream or a gateway timeout past the harness's retry ladder — with nothing pushed, after the round was already re-run once for the same reason. The task itself was never the problem.`,
+        `⚠️ The coding child of round ${e.round.index} (run ${e.runId}) ${e.streamIncomplete ? "ended because the model stream ended before a complete answer" : "died on a provider transient — a model-gateway 5xx or gateway timeout past the harness's retry ladder"} — with nothing pushed, after the round was already re-run once for a retryable model-call failure. The task itself was never the problem.`,
         writeUpPointer(s, e.round.kind, s.lastCodingRunId),
-        `⚠️ This is a bug: ship ended after ${rounds} because its automatic provider retry was spent.`,
+        `⚠️ This is a bug: ship ended after ${rounds} because its automatic model-call retry was spent.`,
         nextAction(),
       ]);
     case "no_verdict":

package/dist/assets/src/core/trace/attrs.ts

@@ -25,6 +25,8 @@ export interface AttrDomain {
   // slack.receive
   caughtUp: boolean;
   files: number;
+  /** Files found on the canonical source message after event metadata is normalized. */
+  resolvedFiles: number;
   dedupe: "fresh" | "duplicate";
   /** How the requester was found (slack-channel.md item 13): the sender, the configured relay app's footer, or the app itself. */
   requester: "message" | "relay-footer" | "bot";
@@ -193,6 +195,7 @@ const ATTR_TYPE: Record<SpanAttrKey, "string" | "number" | "boolean"> = {
   runId: "string",
   caughtUp: "boolean",
   files: "number",
+  resolvedFiles: "number",
   dedupe: "string",
   requester: "string",
   intake: "string",

package/dist/assets/src/execution/residentReadonly.ts

@@ -15,9 +15,9 @@
  *
  *  Mode is sticky per attach, not per thread: the binding records the mode
  *  the tree was last built for, and an attach in the OTHER mode recreates the
- *  tree (a credential-less, mirror-origin tree must never be handed to a
- *  writable run, and a writable tree's credential file must never survive
- *  into a read-only run). Recreating is the simple safe option — the only
+ *  tree (a mirror-origin tree must never be handed to a writable run, and a
+ *  writable tree's door origin must never survive into a read-only run).
+ *  Recreating is the simple safe option — the only
  *  state a tree carries between attaches is scratch files, and a mode switch
  *  on one thread is rare (a thread is normally one agent for its whole life). */
 
@@ -37,12 +37,13 @@ export interface ReadonlyAttachPlan {
   /** True when the existing tree was built for the other mode and must be wiped
    *  before reuse — evaluated before the ordinary dirty/stale checks. */
   modeSwitch: boolean;
-  /** Mint a repo-scoped token for the tree and write the credential file (writable only). A read-only attach never puts a token in the tree; the mirror's own recovery fetch (root, outside the tree) may still mint one. */
+  /** Legacy mode projection. The Worker uses the Git door for writable trees;
+   *  neither mode writes an App token into a thread tree. */
   credentialFile: boolean;
-  /** Remove any credential file / helper config from the tree (read-only, every
-   *  attach — a reused tree may predate this rule). */
+  /** Read-only mode requires cleanup; the Worker also scrubs writable trees
+   *  before attaching the Git door. */
   scrubCredentials: boolean;
-  /** What the worktree's `origin` points at after clone. */
+  /** Legacy origin fallback; the Worker overrides writable origin with the door. */
   originUrl: string;
 }
 
@@ -51,7 +52,7 @@ export function planReadonlyAttach(input: {
   /** The thread's existing binding, if any. `evicted` trees are gone from disk
    *  and are recreated anyway, so their recorded mode is irrelevant. */
   prior?: { readonly?: boolean; evicted?: boolean };
-  /** `owner/name` of the repo — the writable origin. */
+  /** `owner/name` of the repo — used by the legacy origin fallback. */
   slug: string;
   /** The resident's bare mirror path — the read-only origin. Thread users are
    *  denied traversal into it (root:worker1 750), so fetch/push fail while

package/dist/assets/src/execution/residentSteps.ts

@@ -51,6 +51,8 @@ export const RESIDENT_STEP_LABELS = {
   "worktree-chown": "setting the worktree owner",
   "op-chown": "setting the op tree's owner",
   "worktree-clean": "cleaning the worktree",
+  "thread-cred-file-scrub": "removing an old workspace credential",
+  "thread-cred-helper-scrub": "removing an old Git credential helper",
   "clean-workspace": "cleaning the workspace",
   "clean-before-restore": "cleaning before the restore",
   "break-mirror": "removing the mirror's config (fault injection)",
@@ -64,7 +66,6 @@ export const RESIDENT_STEP_LABELS = {
   "op-dir": "preparing a directory",
   "ops-dir": "preparing a directory",
   "stage-dir": "preparing a directory",
-  stat: "checking a file",
   "boot-id": "reading the container's identity",
   touch: "touching a marker",
   nproc: "counting CPUs",

package/dist/assets/src/execution/seedPlan.ts

@@ -153,8 +153,8 @@ export function parseSeed(v: unknown): { ok: true; seed: SandboxSeed } | { ok: f
  *   3. the deps view, when one was restored, replaces whatever `node_modules`
  *      the checkout carries (older snapshots still hold one);
  *   4. the thread's ref is fetched from origin (the credential is the exec
- *      env's `GH_TOKEN`, through the image's `gh` credential helper — never a
- *      token in this text) and checked out, at its resolved head when the
+ *      run bearer through the Git door and per-command env — never a token
+ *      in this text) and checked out, at its resolved head when the
  *      fetch holds it, else at the fetched tip; without a thread ref the
  *      checkout stays on the snapshot's branch;
  *   5. the head is printed last: the answer's `sha`. */