@coreplane/switchboard 1.266.1 → 1.267.1

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.266.1",
+  "version": "1.267.1",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
@@ -102,6 +102,7 @@
     "@opencode/protocol": "2.0.3",
     "@opencode/schema": "2.0.3",
     "@types/node": "^24.0.0",
+    "@vue/compiler-sfc": "3.5.42",
     "effect": "4.0.0-rc.112",
     "eslint": "^10.10.0",
     "eslint-config-prettier": "^10.1.8",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.266.1",
-  "commit": "2b840cc31a6aae35accff736dad1dc74a30c2db3",
-  "builtAt": "2026-09-26T22:15:46.755Z"
+  "version": "1.267.1",
+  "commit": "6382de7f03c465e18b040fd93103afb1dc44d543",
+  "builtAt": "2026-09-28T23:55:40.901Z"
 }

package/dist/assets/src/core/budgets.ts

@@ -64,6 +64,16 @@ export const QUESTION_TTL_MS = DAY_MS;
  *  that FAILED is never cached — the next read asks again. */
 export const AUTHOR_BINDING_TTL_MS = 15 * MINUTE_MS;
 
+/** Maximum local lifetime of any Git receive-pack forward. The bounded
+ *  request prevents a write connection outliving its run indefinitely after
+ *  revocation. An aborted remote write has an unknown outcome; existing-PR
+ *  writes retain their owned pending intent for authoritative reconciliation. */
+export const GIT_RECEIVE_PACK_FORWARD_TIMEOUT_MS = 5 * MINUTE_MS;
+/** The run's final record waits for that one forwarded report, plus a small
+ *  durable-receipt margin, before sealing. If it still has no answer, the
+ *  pending intent stays as an uncertain write and no retry is authorized. */
+export const GIT_PUBLICATION_SETTLE_TIMEOUT_MS = GIT_RECEIVE_PACK_FORWARD_TIMEOUT_MS + 10 * SECOND_MS;
+
 /** How long a dispatch's FIRST attach to a resident — a fresh run's, or a
  *  resumed run's re-attach to its recorded worktree — waits for the resident
  *  to wake when the Worker typed its refusal as the platform's transient

package/dist/assets/src/core/coordinator/contract.ts

@@ -493,11 +493,30 @@ export interface RoundGate {
   findings: string[];
 }
 
+/** A later human review is evidence to investigate, never typed findings. */
+export interface RecoveryReviewEvidence {
+  id: number;
+  reviewer: { login: string; id: number };
+  headSha: string;
+  submittedAt: number;
+  body: string;
+}
+
+/** The original grant and historically priced children carried through a recovery checkpoint. */
+export interface RecoveryAccounting {
+  spendUsd: number;
+  children: { runId: string; key: string; usd: number }[];
+  grant: Grant;
+  renewalsSpent: number;
+}
+
 /** One admitted continuation of an ended original unit. The claim replaces
  * the terminal interpretation before a child starts; its step remains under
  * the original instance/unit idempotency namespace. */
 export interface OriginalUnitRecovery {
   kind: "findings" | "review";
+  externalReview?: RecoveryReviewEvidence;
+  accounting?: RecoveryAccounting;
   round: number;
   expectedHeadSha: string;
   remainingMs: number;
@@ -531,6 +550,8 @@ export interface OriginalUnitRecovery {
 }
 
 export interface OriginalUnitRecoveryReceipt {
+  externalReview?: RecoveryReviewEvidence;
+  accounting?: RecoveryAccounting;
   reviewRunId: string;
   workflowId: string;
   at: number;
@@ -697,7 +718,6 @@ const isRoundGate = (v: unknown): boolean =>
   isAddressSeverity(v.level) &&
   Array.isArray(v.findings) &&
   v.findings.every((f) => typeof f === "string");
-
 export const isHumanGatePending = (v: unknown): v is HumanGatePending =>
   isObject(v) &&
   isObject(v.pr) &&
@@ -758,6 +778,35 @@ export const isUnitWakeAnswer = (v: unknown): v is UnitWakeAnswer => {
   );
 };
 
+const isPositiveId = (v: unknown): v is number => typeof v === "number" && Number.isSafeInteger(v) && v > 0;
+const isDollars = (v: unknown): v is number => isFinite(v) && v >= 0;
+const isRecoveryReview = (v: unknown): v is RecoveryReviewEvidence =>
+  isObject(v) &&
+  isPositiveId(v.id) &&
+  isObject(v.reviewer) &&
+  isText(v.reviewer.login) &&
+  isPositiveId(v.reviewer.id) &&
+  typeof v.headSha === "string" &&
+  /^[0-9a-f]{40}$/i.test(v.headSha) &&
+  isFinite(v.submittedAt) &&
+  typeof v.body === "string";
+const isRecoveryAccounting = (v: unknown): v is RecoveryAccounting =>
+  isObject(v) &&
+  isDollars(v.spendUsd) &&
+  Array.isArray(v.children) &&
+  v.children.length > 0 &&
+  v.children.every((c) => isObject(c) && isText(c.runId) && isText(c.key) && isDollars(c.usd)) &&
+  new Set(v.children.map((c) => c.runId)).size === v.children.length &&
+  new Set(v.children.map((c) => c.key)).size === v.children.length &&
+  v.children.reduce((sum, c) => sum + c.usd, 0) === v.spendUsd &&
+  isObject(v.grant) &&
+  isDollars(v.grant.renewals) &&
+  Number.isSafeInteger(v.grant.renewals) &&
+  (v.grant.costCapUsd === undefined || (isDollars(v.grant.costCapUsd) && v.grant.costCapUsd > v.spendUsd)) &&
+  isDollars(v.renewalsSpent) &&
+  Number.isSafeInteger(v.renewalsSpent) &&
+  v.renewalsSpent <= v.grant.renewals;
+
 export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
   if (!isObject(v)) return false;
   const r = v;
@@ -811,6 +860,13 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
       typeof r.recovery.step === "string" &&
       STEP_NAME_PATTERN.test(r.recovery.step) &&
       isText(r.recovery.reviewRunId) &&
+      (r.recovery.accounting === undefined || isRecoveryAccounting(r.recovery.accounting)) &&
+      (r.recovery.externalReview === undefined ||
+        (isRecoveryReview(r.recovery.externalReview) &&
+          r.recovery.kind === "review" &&
+          isRecoveryAccounting(r.recovery.accounting) &&
+          r.recovery.findings === undefined &&
+          r.recovery.findingsRunId === undefined)) &&
       (r.recovery.findingsRunId === undefined || isText(r.recovery.findingsRunId)) &&
       (r.recovery.findingsKey === undefined || isText(r.recovery.findingsKey)) &&
       ((r.recovery.findingsRunId === undefined && r.recovery.findingsKey === undefined) ||
@@ -841,6 +897,8 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
     r.recoveryReceipt !== undefined &&
     (!isObject(r.recoveryReceipt) ||
       !isText(r.recoveryReceipt.reviewRunId) ||
+      (r.recoveryReceipt.externalReview !== undefined && !isRecoveryReview(r.recoveryReceipt.externalReview)) ||
+      (r.recoveryReceipt.accounting !== undefined && !isRecoveryAccounting(r.recoveryReceipt.accounting)) ||
       typeof r.recoveryReceipt.workflowId !== "string" ||
       !INSTANCE_ID_PATTERN.test(r.recoveryReceipt.workflowId) ||
       !isFinite(r.recoveryReceipt.at))

package/dist/assets/src/core/coordinator/driver.ts

@@ -423,7 +423,8 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
       ...(typeof costUsd === "number" || costUsd === null ? { costUsd } : {}),
       ...(handoffLists !== undefined ? { handoffLists } : {}),
       // The failure by name (run-history item 57), shape-checked: a
-      // `provider_transient` drives the round-0 re-run (agent-ship item 9).
+      // A provider transient or incomplete local model stream drives the
+      // round-0 re-run (agent-ship item 9).
       ...(isRecord(failure) && typeof failure.kind === "string" ? { failure: { kind: failure.kind } } : {}),
       // What ended an interrupted child (issue 1876): the ending's sentence
       // names the cause instead of claiming a bot restart for every one.
@@ -686,6 +687,18 @@ function isOpaqueNotFound(reply: BotReply): boolean {
   }
 }
 
+/** A finished, addressed child whose final record is still being sealed.
+ * Unlike an opaque 404, this answer already establishes the child's identity. */
+function isRecordPending(reply: BotReply): boolean {
+  if (reply.status !== 409) return false;
+  try {
+    const body = JSON.parse(reply.text) as { ok?: unknown; error?: unknown };
+    return body?.ok === false && body.error === "record_pending";
+  } catch {
+    return false;
+  }
+}
+
 async function readRecordStep(
   step: StepRunner,
   bot: CoordinatorBot,
@@ -695,8 +708,9 @@ async function readRecordStep(
   for (let retry = 0; ; retry++) {
     const name = retry === 0 ? action.step : `${action.step}/record-read/${retry}`;
     const reply = await step.do(name, STEP_CONFIG, () => call(bot, "read-record", body, true));
-    if (!isOpaqueNotFound(reply) || action.finishedObserved !== true || retry >= SHIP_RECORD_VISIBILITY.retries)
-      return reply;
+    const pending = isRecordPending(reply);
+    const eventQualifiedMissing = action.finishedObserved === true && isOpaqueNotFound(reply);
+    if ((!pending && !eventQualifiedMissing) || retry >= SHIP_RECORD_VISIBILITY.retries) return reply;
     await step.sleep(`${action.step}/record-visible/${retry + 1}`, SHIP_RECORD_VISIBILITY.retryMs);
   }
 }
@@ -1043,7 +1057,15 @@ async function runUnit(
     addressSeveritySource: plan.addressSeveritySource,
     // Recovery spends only the lease already carried by the claim. It never
     // opens another segment or idles for a renewal in this checkpoint.
-    grant: row?.recovery !== undefined ? { renewals: 0 } : plan.grant,
+    grant:
+      row?.recovery === undefined
+        ? plan.grant
+        : (row.recovery.accounting?.grant ??
+          // A missing capped carry must still stop before dispatch, while an
+          // uncapped legacy checkpoint must not acquire plan renewals.
+          (plan.grant?.costCapUsd !== undefined
+            ? { renewals: 0, costCapUsd: plan.grant.costCapUsd }
+            : { renewals: 0 })),
     grantSource: plan.grantSource,
     verbosity: plan.verbosity,
     idleDays: row?.recovery !== undefined ? 0 : plan.idleDays,
@@ -1054,7 +1076,13 @@ async function runUnit(
     ...(lastPush !== undefined ? { lastPush } : {}),
     ...(session !== undefined ? { session } : {}),
     ...(row?.recovery !== undefined
-      ? { recovery: { remainingMs: row.recovery.remainingMs, unitKey: `${instanceId}:${unit}` } }
+      ? {
+          recovery: {
+            remainingMs: row.recovery.remainingMs,
+            unitKey: `${instanceId}:${unit}`,
+            ...(row.recovery.accounting !== undefined ? { renewalsSpent: row.recovery.accounting.renewalsSpent } : {}),
+          },
+        }
       : {}),
   };
   let state: UnitPipelineState =
@@ -1065,6 +1093,7 @@ async function runUnit(
           pr: row.pr!,
           expectedHeadSha: row.recovery.expectedHeadSha,
           reviewRunId: row.recovery.reviewRunId,
+          ...(row.recovery.accounting !== undefined ? { spendUsd: row.recovery.accounting.spendUsd } : {}),
           ...(row.recovery.findingsRunId !== undefined ? { findingsRunId: row.recovery.findingsRunId } : {}),
           ...(row.recovery.findings !== undefined ? { findings: row.recovery.findings } : {}),
         })

package/dist/assets/src/core/runRecord.ts

@@ -279,6 +279,17 @@ export interface RunRecord {
    *  last `pushed_head` event's sha winning — the fact a renewal reads to know
    *  the run made progress. Present only on a run that pushed. */
   pushed?: PushedHead[];
+  /** A Git-door write whose remote outcome was still uncertain at seal. The
+   * live ledger row is deleted at finish, so recovery retains this exact
+   * ref transition until head reconciliation. A PR number exists only for a
+   * verified existing-PR publication. */
+  doorPublicationPending?: {
+    id: string;
+    repo: string;
+    pr?: number;
+    owner?: { instanceId: string; unit: string };
+    update: { ref: string; old: string; next: string };
+  };
   /** What the run cost in tokens, per model, summed from its `model.turn`
    *  spans at finish (`usageOfEvents`; docs/reference/specs/costs.md, cost by user).
    *  Every record written since carries it (zero turns included); one written
@@ -572,12 +583,15 @@ function isRunPullRequestShape(v: unknown): v is RunPullRequest {
  *  explanation's words — so the session's next seed leaves the refused
  *  request out of its tail (docs/reference/specs/session-log.md item 9).
  *  `provider_transient`: the run's model call failed on a provider transient
- *  (a gateway 5xx, a cut stream, a gateway timeout) with the harness's retry
+ *  (a gateway 5xx or timeout) with the harness's retry
  *  ladder spent — the ship runner reads it off the child's record to re-run a
  *  round-0 child that pushed nothing instead of aborting the unit
- *  (docs/reference/specs/agent-ship.md item 9, issue 1932). A failure without
+ *  (docs/reference/specs/agent-ship.md item 9, issue 1932).
+ *  `model_stream_incomplete`: pi's answer stream ended incomplete after its
+ *  local retry lease, with no provider-down evidence; Ship grants the same
+ *  one re-run when nothing was pushed. A failure without
  *  a name here leaves the record without the field. */
-export const RUN_FAILURE_KINDS = ["policy_refusal", "provider_transient"] as const;
+export const RUN_FAILURE_KINDS = ["policy_refusal", "provider_transient", "model_stream_incomplete"] as const;
 export type RunFailureKind = (typeof RUN_FAILURE_KINDS)[number];
 export interface RunFailure {
   kind: RunFailureKind;
@@ -1121,6 +1135,27 @@ export function isRunRecord(v: unknown): v is RunRecord {
     )
   )
     return false;
+  if (r.doorPublicationPending !== undefined) {
+    const pending = r.doorPublicationPending;
+    if (typeof pending !== "object" || pending === null) return false;
+    const { id, repo, pr, owner, update } = pending as Record<string, unknown>;
+    if (
+      typeof id !== "string" ||
+      !id ||
+      typeof repo !== "string" ||
+      !repo ||
+      (pr !== undefined && (!Number.isInteger(pr) || (pr as number) < 1))
+    )
+      return false;
+    if (owner !== undefined && (typeof owner !== "object" || owner === null)) return false;
+    if (typeof update !== "object" || update === null) return false;
+    const o = owner as Record<string, unknown> | undefined;
+    const u = update as Record<string, unknown>;
+    if (o !== undefined && (typeof o.instanceId !== "string" || typeof o.unit !== "string")) return false;
+    if (typeof u.ref !== "string" || !u.ref.startsWith("refs/heads/")) return false;
+    if (typeof u.old !== "string" || !/^[0-9a-f]{40}$/.test(u.old)) return false;
+    if (typeof u.next !== "string" || !/^[0-9a-f]{40}$/.test(u.next)) return false;
+  }
   // A parent is named by a run id (item 46): the same shape as the record's own.
   if (r.parentRunId !== undefined && (typeof r.parentRunId !== "string" || !RUN_ID_PATTERN.test(r.parentRunId)))
     return false;

package/dist/assets/src/core/ship/coordinator.ts

@@ -630,8 +630,8 @@ export type ChildFacts =
       costUsd?: number | null;
       handoffLists?: Handoff;
       /** The failure by name off a `failed` run's record (run-history item 57):
-       *  `provider_transient` marks a child a gateway 5xx, a cut stream or a
-       *  gateway timeout ended past the harness's retry ladder (issue 1932). */
+       *  provider transport failure or an incomplete local model stream may
+       *  earn one round-0 re-run when nothing was pushed (issue 1932). */
       failure?: { kind: string };
       /** What ended an `interrupted` child, off its record's own events (issue
        *  1876): the ending's sentence names it instead of claiming a bot
@@ -996,14 +996,14 @@ export type UnitEnding =
     }
   | { kind: "no_verdict"; round: RoundRef; reviewRounds: number; finalReply?: string }
   | { kind: "idle_expired"; reviewRounds: number }
-  /** Round 0's coding child died on a provider transient — a model-gateway
-   *  5xx, a cut stream, a gateway timeout, past the harness's retry ladder —
+  /** Round 0's coding child died on a retryable model-call failure — a
+   *  provider transient or an incomplete local stream past its retry ladder —
    *  with nothing pushed, TWICE: the first such death re-ran the round once
    *  (the ledger row and the branch untouched, a re-run costs only minutes),
    *  and the second is the ending (agent-ship item 9, issue 1932). Named
    *  `transient` so it reads as a condition beside `checks_failed` and `held`
    *  in the plane's table, never as the child failing on its task. */
-  | { kind: "transient"; round: RoundRef; runId: string; reviewRounds: number }
+  | { kind: "transient"; round: RoundRef; runId: string; reviewRounds: number; streamIncomplete?: true }
   | {
       kind: "interrupted";
       round: RoundRef;
@@ -1182,7 +1182,7 @@ export interface UnitPipelineInput {
   /** A terminal original unit re-entered at its unchanged reviewed head. The
    * exact remaining lease is carried in milliseconds; the step prefix keeps
    * every new durable step under `<original instance>:<unit>/recovery/...`. */
-  recovery?: { remainingMs: number; unitKey: string };
+  recovery?: { remainingMs: number; unitKey: string; renewalsSpent?: number };
 }
 
 type Phase =
@@ -1243,17 +1243,21 @@ type Phase =
        *  must independently prove an open branch and pull request at exactly
        *  `childHead`; neither a push record nor this flag is remote evidence. */
       findingsReady?: true;
+      /** A capped recovery must verify this pushed head before ending, but
+       * missing findings outputs still forbid review or merge-ready success. */
+      findingsIncomplete?: string[];
       /** The coding child died (`failed` or `interrupted`) after it may have
        *  pushed: the pr-check recovers a pushed branch by opening its pull
        *  request; with nothing pushed the unit ends with the child's own reason. */
       dead?: "failed" | "interrupted";
       /** What ended the dead child (issue 1876), for the `interrupted` ending's sentence. */
       cause?: InterruptionCause;
-      /** The dead child's record names a provider transient (`failure:
-       *  provider_transient`, issue 1932): with nothing pushed, round 0 is
-       *  re-run once instead of the unit aborting; a second transient in the
-       *  same round is the `transient` ending. */
+      /** The dead child's record names a retryable model-call failure
+       *  (run-history item 57): with nothing pushed, round 0 is re-run once;
+       *  a second such failure is the `transient` ending. */
       transient?: true;
+      /** The retry signal was a local incomplete stream, not provider-down. */
+      streamIncomplete?: true;
     }
   /** `queued`: the door enqueued the pull request — the base takes changes
    *  only through a merge queue (issue 2011) — so every later ask reads the
@@ -1417,6 +1421,7 @@ export function openRecoveredUnitPipeline(
     pr: PrRef;
     expectedHeadSha: string;
     reviewRunId: string;
+    spendUsd?: number;
     findingsRunId?: string;
     findings?: Finding[];
   },
@@ -1435,12 +1440,10 @@ export function openRecoveredUnitPipeline(
     reviewRestarts: 0,
     pr: recovery.pr,
     lastReviewHead: recovery.expectedHeadSha,
-    // Legacy terminal rows do not carry a complete lifetime category split or
-    // cumulative dollars. Recovery therefore measures only this checkpoint;
-    // admission refuses a cost-capped row rather than resetting an enforced
-    // total, and reports label this split as checkpoint-local.
+    // Elapsed categories remain checkpoint-local. Enforced cumulative dollars
+    // come only from the admission claim's complete persisted child evidence.
     spentMs: { coding: 0, review: 0, waiting: 0 },
-    spendUsd: 0,
+    spendUsd: recovery.spendUsd ?? (input.grant?.costCapUsd === undefined ? 0 : null),
     findingsByRound: recovery.kind === "findings" ? { [recovery.round]: recovery.findings ?? [] } : {},
     humanAnswersByRound: {},
     dispositionsByRound: {},
@@ -1648,7 +1651,7 @@ export function nextAction(s: UnitPipelineState): CoordinatorAction {
       return {
         type: "pr-check",
         step: `${roundStep(s, p.round)}/pr-check`,
-        ...(p.dead !== undefined || p.recover === true || p.findingsReady === true
+        ...(p.dead !== undefined || p.recover === true || p.findingsReady === true || p.findingsIncomplete !== undefined
           ? { recover: { runId: p.runId } }
           : {}),
         // The adopted pull request rides the check so the bot can follow it
@@ -1747,7 +1750,10 @@ function idleEnding(s: UnitPipelineState, ending: UnitEnding): Extract<UnitEndin
   const grant = s.input.grant ?? DEFAULT_GRANT;
   // Unspent: an idle spends no renewal — the wake's segment does (this plan's
   // fifth unit) — so the row says what the grant still holds.
-  const renewalsLeft = Math.max(0, grant.renewals - (s.input.session?.renewalsSpent ?? 0));
+  const renewalsLeft = Math.max(
+    0,
+    grant.renewals - (s.input.recovery?.renewalsSpent ?? s.input.session?.renewalsSpent ?? 0),
+  );
   // The head to continue from: a segment's own; a review_pending's reviewed
   // head — the pull request's, known even when the coding record carried none,
   // so the re-issue's resume-at-review fact survives the idle; else the last
@@ -1832,7 +1838,10 @@ function parkHumanGate(
     kind: "idle",
     why: "held",
     idled: held,
-    renewalsLeft: Math.max(0, grant.renewals - (s.input.session?.renewalsSpent ?? 0)),
+    renewalsLeft: Math.max(
+      0,
+      grant.renewals - (s.input.recovery?.renewalsSpent ?? s.input.session?.renewalsSpent ?? 0),
+    ),
     ...(s.lastReviewHead !== undefined ? { from: s.lastReviewHead } : {}),
     ...(s.lastCodingRunId !== undefined ? { runId: s.lastCodingRunId } : {}),
     spendUsd: s.spendUsd,
@@ -1878,10 +1887,30 @@ function capEnding(s: UnitPipelineState, round?: RoundRef, refused?: Carve): Uni
   };
 }
 
+/** Recovery cannot buy another child (or claim readiness) after the original
+ * dollar cap is spent. Unknown cost is not zero and never resets that cap. */
+function recoveryCostEnding(s: UnitPipelineState): UnitEnding | undefined {
+  const cap = s.input.grant?.costCapUsd;
+  if (s.input.recovery === undefined || cap === undefined) return undefined;
+  if (s.spendUsd !== null && Number.isFinite(s.spendUsd) && s.spendUsd >= 0 && s.spendUsd < cap) return undefined;
+  return {
+    kind: "aborted",
+    reason:
+      s.spendUsd === null
+        ? `The original $${cap} cost cap cannot be proven: cumulative child spend is unknown.`
+        : `The original $${cap} cost cap is exhausted; cumulative child spend is $${s.spendUsd}.`,
+    reviewRounds: s.reviewRounds,
+  };
+}
+
 /** Start a round if its carve holds (agent-ship item 8): a round the
  *  remainder cannot carve above its floor is not dispatched, and the unit ends
  *  at the cap naming the round, what it would have got and the floor. */
 function enterRound(s: UnitPipelineState, round: RoundRef, notes: CoordinatorNote[] = []): Transition {
+  if (s.input.recovery !== undefined && round.index > s.input.caps.maxRounds)
+    return end(s, { kind: "round_cap", maxRounds: s.input.caps.maxRounds, reviewRounds: s.reviewRounds }, notes);
+  const costEnding = recoveryCostEnding(s);
+  if (costEnding !== undefined) return end(s, costEnding, notes);
   const carved = roundCarve(s, round);
   if (carved.kind === "refused") return end(s, capEnding(s, round, carved), notes);
   const reviewRounds = round.kind === "review" ? round.index : s.reviewRounds;
@@ -1976,6 +2005,11 @@ function settleCoding(
         }
       : {}),
   };
+  // A completed findings child may have moved the head. Its verification
+  // read reconciles that head before the cap ends the unit.
+  const costEnding = recoveryCostEnding(next);
+  if (costEnding !== undefined && !(round.kind === "findings" && facts.status === "completed"))
+    return end(next, costEnding, [roundNote(round, "aborted")]);
   const readySalvage = round.kind === "coding" && completedSameHeadSalvage(next, facts.pushed, facts);
   const checkpoint = interruptedCheckpoint(next, facts.pushed, round.kind === "findings" ? undefined : facts);
   const mode = stopMode(facts.status);
@@ -2007,6 +2041,21 @@ function settleCoding(
     if (facts.description !== true) missingOutputs.push("missing updated pull request description");
     const observedHead = fullHead(facts.headSha);
     if (observedHead === undefined) missingOutputs.push("missing final observed commit");
+    if (
+      missingOutputs.length > 0 &&
+      costEnding !== undefined &&
+      observedHead !== undefined &&
+      facts.pushed?.length === 1 &&
+      facts.pushed[0]?.ref === next.input.unit.branch &&
+      facts.pushed[0]?.sha === observedHead
+    )
+      return {
+        state: {
+          ...next,
+          phase: { at: "pr-check", round, runId, childHead: observedHead, findingsIncomplete: missingOutputs },
+        },
+        notes: [],
+      };
     if (missingOutputs.length > 0)
       return end(
         next,
@@ -2060,9 +2109,11 @@ function settleCoding(
     const cause =
       facts.failure?.kind === "provider_transient"
         ? "the model provider's transport retry budget was spent"
-        : facts.status === "failed"
-          ? "it failed before finishing"
-          : "it ended before its work was ready for review";
+        : facts.failure?.kind === "model_stream_incomplete"
+          ? "the model stream ended before a complete answer"
+          : facts.status === "failed"
+            ? "it failed before finishing"
+            : "it ended before its work was ready for review";
     return end(
       next,
       {
@@ -2088,7 +2139,10 @@ function settleCoding(
           round,
           runId,
           dead: "failed",
-          ...(facts.failure?.kind === "provider_transient" ? { transient: true as const } : {}),
+          ...(facts.failure?.kind === "provider_transient" || facts.failure?.kind === "model_stream_incomplete"
+            ? { transient: true as const }
+            : {}),
+          ...(facts.failure?.kind === "model_stream_incomplete" ? { streamIncomplete: true as const } : {}),
         },
       },
       notes: [],
@@ -2117,10 +2171,11 @@ function settleReview(
   facts: Extract<ChildFacts, { finished: true }>,
 ): Transition {
   const mode = stopMode(facts.status);
+  const charged = { ...s, spendUsd: addSpend(s.spendUsd, facts.costUsd) };
   if (!facts.verdict) {
     if (mode !== undefined)
       return end(
-        s,
+        charged,
         {
           kind: "stopped",
           mode,
@@ -2131,7 +2186,7 @@ function settleReview(
         [roundNote(round, "stopped")],
       );
     return end(
-      s,
+      charged,
       {
         kind: "no_verdict",
         round,
@@ -2143,13 +2198,14 @@ function settleReview(
   }
   const verdict = facts.verdict;
   const next: UnitPipelineState = {
-    ...s,
-    spendUsd: addSpend(s.spendUsd, facts.costUsd),
+    ...charged,
     findingsByRound: { ...s.findingsByRound, [round.index]: verdict.findings },
     ...(facts.reviewHead !== undefined ? { lastReviewHead: facts.reviewHead } : {}),
     ...(verdict.summary !== undefined ? { lastVerdictSummary: verdict.summary } : {}),
   };
   const notes = [roundNote(round, verdict.verdict)];
+  const costEnding = recoveryCostEnding(next);
+  if (costEnding !== undefined) return end(next, costEnding, notes);
   if (verdict.verdict === "approve") {
     // Merge-ready stands on the POSTED approval: an approve whose post did
     // not land left no approving review on the pull request. The reason is
@@ -2619,7 +2675,7 @@ function finishSupersededChild(
     if (phase.round.kind === "findings") {
       const settled = settleCoding(s, phase.round, phase.runId, facts);
       const ready = settled.state.phase;
-      if (ready.at === "pr-check" && ready.findingsReady === true)
+      if (ready.at === "pr-check" && (ready.findingsReady === true || ready.findingsIncomplete !== undefined))
         return settlePrCheck(settled.state, ready, supersession.pullRequest);
       return settled;
     }
@@ -2672,11 +2728,24 @@ export function reconcileTerminalPr(s: UnitPipelineState, pr: PrCheck): UnitPipe
 /** The pull request heading the branch after round 0 or a findings step. */
 function settlePrCheck(s: UnitPipelineState, phase: Extract<Phase, { at: "pr-check" }>, pr: PrCheck): Transition {
   const { round } = phase;
+  const endIncompleteFindings = (verified: UnitPipelineState): Transition => {
+    const cap = recoveryCostEnding(verified);
+    return end(
+      verified,
+      {
+        kind: "aborted",
+        reason: `${cap?.kind === "aborted" ? `${cap.reason} ` : ""}The completed findings work still lacks required results (${phase.findingsIncomplete?.join("; ")}); no review started.`,
+        round,
+        reviewRounds: verified.reviewRounds,
+      },
+      [roundNote(round, "aborted")],
+    );
+  };
   // A completed findings run is not ready because it says it pushed. It is
   // ready only when this independent read sees the adopted pull request at the
   // exact full observed source head (and, while open, its live branch). Every
   // other remote fact is a resumable stop with no review or merged success.
-  if (phase.findingsReady === true) {
+  if (phase.findingsReady === true || phase.findingsIncomplete !== undefined) {
     const observedHead = fullHead(phase.childHead)!;
     const withPr = pr.state !== "none" ? { ...s, pr: { number: pr.prNumber, url: pr.url } } : s;
     if (pr.state === "merged") {
@@ -2708,6 +2777,8 @@ function settlePrCheck(s: UnitPipelineState, phase: Extract<Phase, { at: "pr-che
           },
           [roundNote(round, "aborted")],
         );
+      if (phase.findingsIncomplete !== undefined)
+        return endIncompleteFindings({ ...withPr, lastReviewHead: remoteHead });
       return foundMerged(withPr, pr, [roundNote(round, "completed")]);
     }
     if (pr.state !== "open" || pr.headBranchExists === false)
@@ -2751,6 +2822,10 @@ function settlePrCheck(s: UnitPipelineState, phase: Extract<Phase, { at: "pr-che
         },
         [roundNote(round, "aborted")],
       );
+    const reconciled = { ...withPr, lastReviewHead: remoteHead };
+    if (phase.findingsIncomplete !== undefined) return endIncompleteFindings(reconciled);
+    const costEnding = recoveryCostEnding(reconciled);
+    if (costEnding !== undefined) return end(reconciled, costEnding, [roundNote(round, "aborted")]);
     return roundOnOpenPr(withPr, phase, pr);
   }
   // The merge landed during the round: the child found nothing left to ship
@@ -2776,15 +2851,23 @@ function settlePrCheck(s: UnitPipelineState, phase: Extract<Phase, { at: "pr-che
         [roundNote(round, "aborted")],
       );
     if (phase.dead === "failed") {
-      // A provider transient with nothing pushed is not the child's failure
+      // A retryable model-call failure with nothing pushed is not the child's failure
       // (issue 1932): the ledger row and the branch are untouched, so round 0
       // is re-run once — a fresh attempt under fresh step names — and only a
       // second transient in the same round is the ending, named `transient`.
       if (phase.transient && round.kind === "coding" && pr.unrecovered === "no_commits") {
         if ((round.attempt ?? 1) < 2) return enterRound(s, { ...round, attempt: 2 }, [roundNote(round, "transient")]);
-        return end(s, { kind: "transient", round, runId: phase.runId, reviewRounds: s.reviewRounds }, [
-          roundNote(round, "transient"),
-        ]);
+        return end(
+          s,
+          {
+            kind: "transient",
+            round,
+            runId: phase.runId,
+            reviewRounds: s.reviewRounds,
+            ...(phase.streamIncomplete ? { streamIncomplete: true as const } : {}),
+          },
+          [roundNote(round, "transient")],
+        );
       }
       // The abort repeats the bot's reason for recovering nothing, and claims
       // no more than the answer carried.
@@ -3825,11 +3908,10 @@ function renderUnitReportWithWake(
   const level = s.input.addressSeverity ?? DEFAULT_ADDRESS_SEVERITY;
   const levelLine = `Severity addressed: ${level} and above (set by ${s.input.addressSeveritySource ?? "org"}).`;
   // The grant as the instance carries it (decision 0046): spent of granted,
-  // the cap when one is set, and who granted it — zero of zero until a scope
-  // or a directive says otherwise, and nothing spends it before the renewal
-  // decision exists.
+  // the cap when one is set, and who granted it. A capped recovery carries
+  // proven spent renewals; an uncapped legacy checkpoint has zero capacity.
   const grant = s.input.grant ?? DEFAULT_GRANT;
-  const grantLine = `Renewals: 0 of ${grant.renewals} spent${grant.costCapUsd !== undefined ? `, cost cap $${grant.costCapUsd}` : ""} (granted by ${s.input.grantSource ?? "org"}).`;
+  const grantLine = `Renewals: ${s.input.recovery?.renewalsSpent ?? 0} of ${grant.renewals} spent${grant.costCapUsd !== undefined ? `, cost cap $${grant.costCapUsd}` : ""} (granted by ${s.input.grantSource ?? "org"}).`;
   const lastFindings = s.findingsByRound[e.reviewRounds] ?? [];
   const skipped = lastFindings.filter((f) => !findingsAtOrAbove([f], level).length);
   const skippedLine =
@@ -4076,11 +4158,11 @@ function renderUnitReportWithWake(
       ]);
     case "transient":
       if (!shows(verbosity, "verbose"))
-        return `⚠️ Aborted after ${rounds}: this is a bug — the model provider failed twice and no automatic retry remains.${prLine}`;
+        return `⚠️ Aborted after ${rounds}: this is a bug — the model call failed twice and no automatic retry remains.${prLine}`;
       return join([
-        `⚠️ The coding child of round ${e.round.index} (run ${e.runId}) died on a provider transient — a model-gateway 5xx, a cut stream or a gateway timeout past the harness's retry ladder — with nothing pushed, after the round was already re-run once for the same reason. The task itself was never the problem.`,
+        `⚠️ The coding child of round ${e.round.index} (run ${e.runId}) ${e.streamIncomplete ? "ended because the model stream ended before a complete answer" : "died on a provider transient — a model-gateway 5xx or gateway timeout past the harness's retry ladder"} — with nothing pushed, after the round was already re-run once for a retryable model-call failure. The task itself was never the problem.`,
         writeUpPointer(s, e.round.kind, s.lastCodingRunId),
-        `⚠️ This is a bug: ship ended after ${rounds} because its automatic provider retry was spent.`,
+        `⚠️ This is a bug: ship ended after ${rounds} because its automatic model-call retry was spent.`,
         nextAction(),
       ]);
     case "no_verdict":