@coreplane/switchboard 1.267.0 → 1.267.1

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.267.0",
+  "version": "1.267.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.267.0",
+      "version": "1.267.1",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -21023,7 +21023,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.267.0",
+      "version": "1.267.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.267.0",
+  "version": "1.267.1",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.267.0",
-  "commit": "594f06834184ea4ff5559b00a8fc265f33e3db64",
-  "builtAt": "2026-09-28T22:36:17.080Z"
+  "version": "1.267.1",
+  "commit": "6382de7f03c465e18b040fd93103afb1dc44d543",
+  "builtAt": "2026-09-28T23:55:40.901Z"
 }

package/dist/assets/src/core/budgets.ts

@@ -64,6 +64,16 @@ export const QUESTION_TTL_MS = DAY_MS;
  *  that FAILED is never cached — the next read asks again. */
 export const AUTHOR_BINDING_TTL_MS = 15 * MINUTE_MS;
 
+/** Maximum local lifetime of any Git receive-pack forward. The bounded
+ *  request prevents a write connection outliving its run indefinitely after
+ *  revocation. An aborted remote write has an unknown outcome; existing-PR
+ *  writes retain their owned pending intent for authoritative reconciliation. */
+export const GIT_RECEIVE_PACK_FORWARD_TIMEOUT_MS = 5 * MINUTE_MS;
+/** The run's final record waits for that one forwarded report, plus a small
+ *  durable-receipt margin, before sealing. If it still has no answer, the
+ *  pending intent stays as an uncertain write and no retry is authorized. */
+export const GIT_PUBLICATION_SETTLE_TIMEOUT_MS = GIT_RECEIVE_PACK_FORWARD_TIMEOUT_MS + 10 * SECOND_MS;
+
 /** How long a dispatch's FIRST attach to a resident — a fresh run's, or a
  *  resumed run's re-attach to its recorded worktree — waits for the resident
  *  to wake when the Worker typed its refusal as the platform's transient

package/dist/assets/src/core/coordinator/contract.ts

@@ -493,6 +493,15 @@ export interface RoundGate {
   findings: string[];
 }
 
+/** A later human review is evidence to investigate, never typed findings. */
+export interface RecoveryReviewEvidence {
+  id: number;
+  reviewer: { login: string; id: number };
+  headSha: string;
+  submittedAt: number;
+  body: string;
+}
+
 /** The original grant and historically priced children carried through a recovery checkpoint. */
 export interface RecoveryAccounting {
   spendUsd: number;
@@ -506,6 +515,7 @@ export interface RecoveryAccounting {
  * the original instance/unit idempotency namespace. */
 export interface OriginalUnitRecovery {
   kind: "findings" | "review";
+  externalReview?: RecoveryReviewEvidence;
   accounting?: RecoveryAccounting;
   round: number;
   expectedHeadSha: string;
@@ -540,6 +550,7 @@ export interface OriginalUnitRecovery {
 }
 
 export interface OriginalUnitRecoveryReceipt {
+  externalReview?: RecoveryReviewEvidence;
   accounting?: RecoveryAccounting;
   reviewRunId: string;
   workflowId: string;
@@ -767,7 +778,18 @@ export const isUnitWakeAnswer = (v: unknown): v is UnitWakeAnswer => {
   );
 };
 
+const isPositiveId = (v: unknown): v is number => typeof v === "number" && Number.isSafeInteger(v) && v > 0;
 const isDollars = (v: unknown): v is number => isFinite(v) && v >= 0;
+const isRecoveryReview = (v: unknown): v is RecoveryReviewEvidence =>
+  isObject(v) &&
+  isPositiveId(v.id) &&
+  isObject(v.reviewer) &&
+  isText(v.reviewer.login) &&
+  isPositiveId(v.reviewer.id) &&
+  typeof v.headSha === "string" &&
+  /^[0-9a-f]{40}$/i.test(v.headSha) &&
+  isFinite(v.submittedAt) &&
+  typeof v.body === "string";
 const isRecoveryAccounting = (v: unknown): v is RecoveryAccounting =>
   isObject(v) &&
   isDollars(v.spendUsd) &&
@@ -839,6 +861,12 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
       STEP_NAME_PATTERN.test(r.recovery.step) &&
       isText(r.recovery.reviewRunId) &&
       (r.recovery.accounting === undefined || isRecoveryAccounting(r.recovery.accounting)) &&
+      (r.recovery.externalReview === undefined ||
+        (isRecoveryReview(r.recovery.externalReview) &&
+          r.recovery.kind === "review" &&
+          isRecoveryAccounting(r.recovery.accounting) &&
+          r.recovery.findings === undefined &&
+          r.recovery.findingsRunId === undefined)) &&
       (r.recovery.findingsRunId === undefined || isText(r.recovery.findingsRunId)) &&
       (r.recovery.findingsKey === undefined || isText(r.recovery.findingsKey)) &&
       ((r.recovery.findingsRunId === undefined && r.recovery.findingsKey === undefined) ||
@@ -869,6 +897,7 @@ export function isCoordinatorUnit(v: unknown): v is CoordinatorUnit {
     r.recoveryReceipt !== undefined &&
     (!isObject(r.recoveryReceipt) ||
       !isText(r.recoveryReceipt.reviewRunId) ||
+      (r.recoveryReceipt.externalReview !== undefined && !isRecoveryReview(r.recoveryReceipt.externalReview)) ||
       (r.recoveryReceipt.accounting !== undefined && !isRecoveryAccounting(r.recoveryReceipt.accounting)) ||
       typeof r.recoveryReceipt.workflowId !== "string" ||
       !INSTANCE_ID_PATTERN.test(r.recoveryReceipt.workflowId) ||

package/dist/assets/src/core/coordinator/driver.ts

@@ -687,6 +687,18 @@ function isOpaqueNotFound(reply: BotReply): boolean {
   }
 }
 
+/** A finished, addressed child whose final record is still being sealed.
+ * Unlike an opaque 404, this answer already establishes the child's identity. */
+function isRecordPending(reply: BotReply): boolean {
+  if (reply.status !== 409) return false;
+  try {
+    const body = JSON.parse(reply.text) as { ok?: unknown; error?: unknown };
+    return body?.ok === false && body.error === "record_pending";
+  } catch {
+    return false;
+  }
+}
+
 async function readRecordStep(
   step: StepRunner,
   bot: CoordinatorBot,
@@ -696,8 +708,9 @@ async function readRecordStep(
   for (let retry = 0; ; retry++) {
     const name = retry === 0 ? action.step : `${action.step}/record-read/${retry}`;
     const reply = await step.do(name, STEP_CONFIG, () => call(bot, "read-record", body, true));
-    if (!isOpaqueNotFound(reply) || action.finishedObserved !== true || retry >= SHIP_RECORD_VISIBILITY.retries)
-      return reply;
+    const pending = isRecordPending(reply);
+    const eventQualifiedMissing = action.finishedObserved === true && isOpaqueNotFound(reply);
+    if ((!pending && !eventQualifiedMissing) || retry >= SHIP_RECORD_VISIBILITY.retries) return reply;
     await step.sleep(`${action.step}/record-visible/${retry + 1}`, SHIP_RECORD_VISIBILITY.retryMs);
   }
 }

package/dist/assets/src/core/runRecord.ts

@@ -279,6 +279,17 @@ export interface RunRecord {
    *  last `pushed_head` event's sha winning — the fact a renewal reads to know
    *  the run made progress. Present only on a run that pushed. */
   pushed?: PushedHead[];
+  /** A Git-door write whose remote outcome was still uncertain at seal. The
+   * live ledger row is deleted at finish, so recovery retains this exact
+   * ref transition until head reconciliation. A PR number exists only for a
+   * verified existing-PR publication. */
+  doorPublicationPending?: {
+    id: string;
+    repo: string;
+    pr?: number;
+    owner?: { instanceId: string; unit: string };
+    update: { ref: string; old: string; next: string };
+  };
   /** What the run cost in tokens, per model, summed from its `model.turn`
    *  spans at finish (`usageOfEvents`; docs/reference/specs/costs.md, cost by user).
    *  Every record written since carries it (zero turns included); one written
@@ -1124,6 +1135,27 @@ export function isRunRecord(v: unknown): v is RunRecord {
     )
   )
     return false;
+  if (r.doorPublicationPending !== undefined) {
+    const pending = r.doorPublicationPending;
+    if (typeof pending !== "object" || pending === null) return false;
+    const { id, repo, pr, owner, update } = pending as Record<string, unknown>;
+    if (
+      typeof id !== "string" ||
+      !id ||
+      typeof repo !== "string" ||
+      !repo ||
+      (pr !== undefined && (!Number.isInteger(pr) || (pr as number) < 1))
+    )
+      return false;
+    if (owner !== undefined && (typeof owner !== "object" || owner === null)) return false;
+    if (typeof update !== "object" || update === null) return false;
+    const o = owner as Record<string, unknown> | undefined;
+    const u = update as Record<string, unknown>;
+    if (o !== undefined && (typeof o.instanceId !== "string" || typeof o.unit !== "string")) return false;
+    if (typeof u.ref !== "string" || !u.ref.startsWith("refs/heads/")) return false;
+    if (typeof u.old !== "string" || !/^[0-9a-f]{40}$/.test(u.old)) return false;
+    if (typeof u.next !== "string" || !/^[0-9a-f]{40}$/.test(u.next)) return false;
+  }
   // A parent is named by a run id (item 46): the same shape as the record's own.
   if (r.parentRunId !== undefined && (typeof r.parentRunId !== "string" || !RUN_ID_PATTERN.test(r.parentRunId)))
     return false;

package/dist/assets/src/core/ship/coordinator.ts

@@ -1243,6 +1243,9 @@ type Phase =
        *  must independently prove an open branch and pull request at exactly
        *  `childHead`; neither a push record nor this flag is remote evidence. */
       findingsReady?: true;
+      /** A capped recovery must verify this pushed head before ending, but
+       * missing findings outputs still forbid review or merge-ready success. */
+      findingsIncomplete?: string[];
       /** The coding child died (`failed` or `interrupted`) after it may have
        *  pushed: the pr-check recovers a pushed branch by opening its pull
        *  request; with nothing pushed the unit ends with the child's own reason. */
@@ -1648,7 +1651,7 @@ export function nextAction(s: UnitPipelineState): CoordinatorAction {
       return {
         type: "pr-check",
         step: `${roundStep(s, p.round)}/pr-check`,
-        ...(p.dead !== undefined || p.recover === true || p.findingsReady === true
+        ...(p.dead !== undefined || p.recover === true || p.findingsReady === true || p.findingsIncomplete !== undefined
           ? { recover: { runId: p.runId } }
           : {}),
         // The adopted pull request rides the check so the bot can follow it
@@ -1884,7 +1887,8 @@ function capEnding(s: UnitPipelineState, round?: RoundRef, refused?: Carve): Uni
   };
 }
 
-/** A recovered unit keeps its original dollar cap across the checkpoint. */
+/** Recovery cannot buy another child (or claim readiness) after the original
+ * dollar cap is spent. Unknown cost is not zero and never resets that cap. */
 function recoveryCostEnding(s: UnitPipelineState): UnitEnding | undefined {
   const cap = s.input.grant?.costCapUsd;
   if (s.input.recovery === undefined || cap === undefined) return undefined;
@@ -2037,6 +2041,21 @@ function settleCoding(
     if (facts.description !== true) missingOutputs.push("missing updated pull request description");
     const observedHead = fullHead(facts.headSha);
     if (observedHead === undefined) missingOutputs.push("missing final observed commit");
+    if (
+      missingOutputs.length > 0 &&
+      costEnding !== undefined &&
+      observedHead !== undefined &&
+      facts.pushed?.length === 1 &&
+      facts.pushed[0]?.ref === next.input.unit.branch &&
+      facts.pushed[0]?.sha === observedHead
+    )
+      return {
+        state: {
+          ...next,
+          phase: { at: "pr-check", round, runId, childHead: observedHead, findingsIncomplete: missingOutputs },
+        },
+        notes: [],
+      };
     if (missingOutputs.length > 0)
       return end(
         next,
@@ -2656,7 +2675,7 @@ function finishSupersededChild(
     if (phase.round.kind === "findings") {
       const settled = settleCoding(s, phase.round, phase.runId, facts);
       const ready = settled.state.phase;
-      if (ready.at === "pr-check" && ready.findingsReady === true)
+      if (ready.at === "pr-check" && (ready.findingsReady === true || ready.findingsIncomplete !== undefined))
         return settlePrCheck(settled.state, ready, supersession.pullRequest);
       return settled;
     }
@@ -2709,11 +2728,24 @@ export function reconcileTerminalPr(s: UnitPipelineState, pr: PrCheck): UnitPipe
 /** The pull request heading the branch after round 0 or a findings step. */
 function settlePrCheck(s: UnitPipelineState, phase: Extract<Phase, { at: "pr-check" }>, pr: PrCheck): Transition {
   const { round } = phase;
+  const endIncompleteFindings = (verified: UnitPipelineState): Transition => {
+    const cap = recoveryCostEnding(verified);
+    return end(
+      verified,
+      {
+        kind: "aborted",
+        reason: `${cap?.kind === "aborted" ? `${cap.reason} ` : ""}The completed findings work still lacks required results (${phase.findingsIncomplete?.join("; ")}); no review started.`,
+        round,
+        reviewRounds: verified.reviewRounds,
+      },
+      [roundNote(round, "aborted")],
+    );
+  };
   // A completed findings run is not ready because it says it pushed. It is
   // ready only when this independent read sees the adopted pull request at the
   // exact full observed source head (and, while open, its live branch). Every
   // other remote fact is a resumable stop with no review or merged success.
-  if (phase.findingsReady === true) {
+  if (phase.findingsReady === true || phase.findingsIncomplete !== undefined) {
     const observedHead = fullHead(phase.childHead)!;
     const withPr = pr.state !== "none" ? { ...s, pr: { number: pr.prNumber, url: pr.url } } : s;
     if (pr.state === "merged") {
@@ -2745,6 +2777,8 @@ function settlePrCheck(s: UnitPipelineState, phase: Extract<Phase, { at: "pr-che
           },
           [roundNote(round, "aborted")],
         );
+      if (phase.findingsIncomplete !== undefined)
+        return endIncompleteFindings({ ...withPr, lastReviewHead: remoteHead });
       return foundMerged(withPr, pr, [roundNote(round, "completed")]);
     }
     if (pr.state !== "open" || pr.headBranchExists === false)
@@ -2788,6 +2822,10 @@ function settlePrCheck(s: UnitPipelineState, phase: Extract<Phase, { at: "pr-che
         },
         [roundNote(round, "aborted")],
       );
+    const reconciled = { ...withPr, lastReviewHead: remoteHead };
+    if (phase.findingsIncomplete !== undefined) return endIncompleteFindings(reconciled);
+    const costEnding = recoveryCostEnding(reconciled);
+    if (costEnding !== undefined) return end(reconciled, costEnding, [roundNote(round, "aborted")]);
     return roundOnOpenPr(withPr, phase, pr);
   }
   // The merge landed during the round: the child found nothing left to ship

package/dist/assets/src/execution/githubMintScope.ts

@@ -0,0 +1,49 @@
+/** Permissions for the trusted Git door's receive-pack operation. GitHub
+ * also requires Workflows when a pushed commit edits .github/workflows. */
+export const DOOR_PUSH_PERMISSIONS = {
+  contents: "write",
+  workflows: "write",
+  metadata: "read",
+} as const;
+
+/** The resident's root-owned token only clones/fetches its mirror and reads
+ * pull request state for worktree reclamation. */
+export const RESIDENT_MIRROR_PERMISSIONS = {
+  contents: "read",
+  pull_requests: "read",
+  metadata: "read",
+} as const;
+
+type Permission = "read" | "write";
+
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+/** Check GitHub's effective scope before a token enters either cache. GitHub
+ * may omit its implicit Metadata read grant from the response. Errors contain
+ * only a fixed reason; they never serialize a response or bearer. */
+export function verifyGithubMintScope(
+  response: unknown,
+  repo: string,
+  requested: Readonly<Record<string, Permission>>,
+): void {
+  if (!record(response) || !record(response.permissions)) throw new Error("GitHub token scope mismatch");
+  const actual = response.permissions;
+  if (
+    Object.entries(actual).some(([name, value]) => requested[name] !== value) ||
+    Object.keys(requested).some((name) => !(name in actual) && !(name === "metadata" && requested[name] === "read"))
+  ) {
+    throw new Error("GitHub token scope mismatch");
+  }
+  if (
+    response.repository_selection !== "selected" ||
+    !Array.isArray(response.repositories) ||
+    response.repositories.length !== 1 ||
+    !record(response.repositories[0]) ||
+    typeof response.repositories[0].full_name !== "string" ||
+    response.repositories[0].full_name.toLowerCase() !== repo.toLowerCase()
+  ) {
+    throw new Error("GitHub token scope mismatch");
+  }
+}

package/dist/assets/src/execution/residentCredentials.ts

@@ -1,45 +1,17 @@
-/** The per-exec credential-refresh decision of the execution layer, kept pure
- *  and dependency-free so it is unit-testable from src/ and imported across
- *  packages by the Worker (like residentDetach/shellQuote) — the tested code
- *  IS the shipped code. Two callers share it — the ONE credential refresher:
- *  the resident Worker before every writable `/exec`
- *  (deploy/cloudflare-resident/worker.ts `execThreadImpl`), and the sandbox
- *  executor before every `/exec` it sends
- *  (src/execution/sandboxCredentials.ts, issue 1915).
- *
- *  Background: attach writes a 1-hour GitHub App installation token
- *  into `<worktree>/.git/github-credentials` and points git's `store` helper
- *  at it. Nothing used to refresh it during a run, so a push more than ~60
- *  minutes after attach got 401 — and git's `store` helper ERASES a rejected
- *  credential from its file, leaving the agent staring at an empty file. The
- *  Worker now asks this function before every writable `/exec` and re-mints
- *  (cached per slug) + rewrites the file when it says so.
- *
- *  The refresh is driven by the TOKEN'S OWN EXPIRY, not the file's age.
- *  `mintRepoScopedToken` caches per repository slug, so a token minted for an
- *  earlier thread — with only a few minutes of life left — could be written
- *  for a brand-new attach and, keyed on file age alone, read "fresh" for ~45
- *  minutes while every writable exec in between ran on a dead token (the first
- *  git write 401s, `store` blanks the file, and only the NEXT exec refreshed).
- *  Now the binding records the token's `expiresAtMs`, and this predicate
- *  refreshes once the token is within `CREDENTIAL_EXPIRY_MARGIN_MS` of expiry
- *  — so a writable exec never starts on a token that cannot outlive it. */
+/** The pure expiry decision retained for the optional legacy sandbox
+ *  credential refresher. The production executor factory does not supply
+ *  that credential source: model workspaces use a revocable Git-door run
+ *  bearer, and the resident never refreshes a model-visible App token.
+ *  The resident imports only the expiry margin for its root-owned mirror
+ *  credential cache. */
 
 import { BASH_TIMEOUT_MAX_MS } from "./bashTimeout.js";
 
-/** Backstop for bindings that predate `tokenExpiresAtMs`: re-mint
- *  this long after the file was written when the token's real expiry is
- *  unknown — comfortably before the 60-minute token expiry. New bindings carry
- *  the expiry and take the margin path below instead. */
+/** Legacy refresher backstop when the stored token's expiry is unknown. */
 export const CREDENTIAL_REFRESH_AFTER_MS = 45 * 60_000;
 
-/** Refresh once the token is within this much of expiry, so a writable exec
- *  never starts on a token that cannot outlive the command it is about to run.
- *  Sized like the sandbox's per-command credential margin: the longest
- *  single exec is `BASH_TIMEOUT_MAX_MS` (20 min), plus slack for the mint +
- *  file write and clock skew ⇒ 25 min. This is also `mintRepoScopedToken`'s
- *  cache serve threshold, so the cache and this predicate agree: a token the
- *  cache would still hand out is a token this predicate would not refresh. */
+/** Legacy refresh and root-mirror cache margin: the longest exec is
+ *  `BASH_TIMEOUT_MAX_MS` (20 min), plus five minutes for mint and clock skew. */
 export const CREDENTIAL_EXPIRY_MARGIN_MS = BASH_TIMEOUT_MAX_MS + 5 * 60_000;
 
 export type CredentialRefreshReason =

package/dist/assets/src/execution/residentDestroyGate.ts

@@ -0,0 +1,12 @@
+/** Persist uncertainty before asking the platform to destroy a resident VM.
+ * A rejected or interrupted destroy leaves the fence in storage: callers may
+ * retry destruction, but may not provision or assign a pool user on the old
+ * disk. A failed clear is conservative too, even if the VM was destroyed. */
+export async function destroyWithPersistentFence(
+  fence: { mark(): Promise<void>; clear(): Promise<void> },
+  destroy: () => Promise<void>,
+): Promise<void> {
+  await fence.mark();
+  await destroy();
+  await fence.clear();
+}

package/dist/assets/src/execution/residentPoolSpends.ts

@@ -0,0 +1,96 @@
+/** Durable UID ownership within one VM generation. Missing or malformed
+ * records are unknown generations, never an empty pool. */
+export interface SpentPoolUser {
+  user: string;
+  owner: string;
+}
+
+export function parseSpentPoolUsers(value: unknown, pool: readonly string[]): ReadonlyMap<string, string> | null {
+  if (
+    !Array.isArray(value) ||
+    !value.every(
+      (row): row is SpentPoolUser =>
+        row !== null &&
+        typeof row === "object" &&
+        "user" in row &&
+        "owner" in row &&
+        typeof row.user === "string" &&
+        typeof row.owner === "string" &&
+        /^(thread|op):\S+$/.test(row.owner),
+    )
+  )
+    return null;
+  const spent = new Map(value.map(({ user, owner }) => [user, owner]));
+  if (spent.size !== value.length || [...spent.keys()].some((user) => !pool.includes(user))) return null;
+  return spent;
+}
+
+/** A new owner must get an unused UID; only the exact recorded owner may
+ * reclaim its UID. Both paths record ownership before untrusted work. */
+export function spendPoolUser(
+  value: unknown,
+  pool: readonly string[],
+  user: string,
+  owner: string,
+): SpentPoolUser[] | null {
+  const spent = parseSpentPoolUsers(value, pool);
+  if (!spent || !pool.includes(user) || !/^(thread|op):\S+$/.test(owner)) return null;
+  const prior = spent.get(user);
+  if (prior && prior !== owner) return null;
+  const rows = [...spent].map(([user, owner]) => ({ user, owner }));
+  return prior ? rows : [...rows, { user, owner }];
+}
+
+/** A UID-scoped command must have exactly one live owner. An old duplicate
+ * binding never gains authority merely because its UID is spent. */
+export function mayRunAsPoolUser(
+  value: unknown,
+  pool: readonly string[],
+  user: string,
+  liveThreadKeys: readonly string[],
+  activeOpOwner: string | undefined,
+  expectedOwner?: string,
+): boolean {
+  const recorded = parseSpentPoolUsers(value, pool)?.get(user);
+  if (!recorded || (expectedOwner !== undefined && recorded !== expectedOwner)) return false;
+  if (activeOpOwner !== undefined) return liveThreadKeys.length === 0 && recorded === activeOpOwner;
+  return liveThreadKeys.length === 1 && recorded === `thread:${liveThreadKeys[0]}`;
+}
+
+/** One row per UID is rebuilt from primary bindings when a DO starts. A
+ * malformed or missing row cannot authorize a shell, even if the spend ledger
+ * names the caller. Keep every live claimant so duplicates remain visible. */
+export function parsePoolBindings(value: unknown): string[] | null {
+  if (!Array.isArray(value) || !value.every((key): key is string => typeof key === "string" && key.length > 0))
+    return null;
+  if (new Set(value).size !== value.length) return null;
+  return value;
+}
+
+export function claimPoolBinding(value: unknown, threadKey: string): string[] | null {
+  const current = parsePoolBindings(value);
+  if (!current || !threadKey || current.includes(threadKey)) return null;
+  return [...current, threadKey];
+}
+
+export function releasePoolBinding(value: unknown, threadKey: string): string[] | null {
+  const current = parsePoolBindings(value);
+  if (!current || !threadKey || !current.includes(threadKey)) return null;
+  return current.filter((key) => key !== threadKey);
+}
+
+export function rebuildPoolBindingIndex(
+  bindings: Iterable<{ threadKey: string; user: string; evicted?: boolean }>,
+  pool: readonly string[],
+): Map<string, string[]> | null {
+  const byUser = new Map(pool.map((user) => [user, [] as string[]]));
+  for (const binding of bindings) {
+    if (binding?.evicted === true) continue;
+    if (!binding || typeof binding.threadKey !== "string" || !binding.threadKey) return null;
+    if (!binding.user) continue;
+    const keys = byUser.get(binding.user);
+    if (!keys || keys.includes(binding.threadKey)) return null;
+    keys.push(binding.threadKey);
+  }
+  return byUser;
+}

package/dist/assets/src/execution/residentRecreateAdmission.ts

@@ -0,0 +1,41 @@
+/** An operator recreate closes new admission before its idle read and keeps a
+ * durable refusal across the container destroy. A new DO isolate may reclaim
+ * the mark only by re-running the operator's checked recreate. */
+export class ResidentRecreateAdmission {
+  private claiming = false;
+
+  constructor(
+    private readonly store: {
+      mark(): Promise<void>;
+      clear(): Promise<void>;
+      held(): Promise<boolean>;
+    },
+  ) {}
+
+  get pending(): boolean {
+    return this.claiming;
+  }
+
+  async blocked(): Promise<boolean> {
+    return this.claiming || (await this.store.held());
+  }
+
+  async run<T>(action: () => Promise<T>): Promise<{ busy: true } | { busy: false; value: T }> {
+    if (this.claiming) return { busy: true };
+    this.claiming = true; // no await before a concurrent admission sees this
+    let marked = false;
+    try {
+      await this.store.mark();
+      marked = true;
+      return { busy: false, value: await action() };
+    } finally {
+      try {
+        // A failed mark may already have persisted. Leave it fail-closed for
+        // an explicit checked retry rather than guessing that it did not.
+        if (marked) await this.store.clear();
+      } finally {
+        this.claiming = false;
+      }
+    }
+  }
+}

package/dist/assets/src/execution/residentSteps.ts

@@ -29,6 +29,7 @@ export const RESIDENT_STEP_LABELS = {
   git: "a git command",
   "git-setup": "configuring git",
   "stage-perms": "securing the credential stage",
+  "stage-write-cleanup": "removing a failed staged write",
   install: "installing dependencies",
   build: "building",
   test: "running the tests",