@coreplane/switchboard 1.267.2 → 1.268.0

package/dist/assets/deploy/cloudflare-sandbox/worker.ts

@@ -95,6 +95,7 @@ import {
   SEED_MARKER,
   SEED_RESTORE_MAX_MS,
   SEED_ABANDONED_RESTORE_WAIT_MS,
+  seedDoorRemote,
   seedFixupScript,
   seedMarkerText,
   type RestorePhases,
@@ -451,12 +452,25 @@ export class SwitchboardSandbox extends Sandbox<Env> {
         detail: `presigned R2 transfer needs ${transfer.missing.join(", ")}`,
       };
     }
+    let doorRemote: string;
+    try {
+      doorRemote = seedDoorRemote(envVars.GIT_DOOR_ORIGIN ?? "", seed.slug);
+    } catch {
+      return { seeded: false, reason: "seed-failed", detail: "Git door origin unavailable", step: "fixup" };
+    }
     // The marker names the seed this container carries — the handle and the
     // ref and head checked out: the same seed again is the run's second
     // request (a retry, a re-attach), and a restore over the live tree would
     // destroy the run's work; a seed naming another ref is a new seed.
     const marker = await this.runRoot(["cat", SEED_MARKER], 30_000);
     if (marker.exitCode === 0 && marker.stdout.trim() === seedMarkerText(seed)) {
+      const origin = await this.runRoot(
+        ["git", "-C", SEED_CHECKOUT_DIR, "remote", "set-url", "origin", doorRemote],
+        30_000,
+        envVars,
+      );
+      if (origin.exitCode !== 0)
+        return { seeded: false, reason: "seed-failed", detail: "seed origin refresh failed", step: "fixup" };
       const head = await this.runRoot(["git", "-C", SEED_CHECKOUT_DIR, "rev-parse", "HEAD"], 30_000);
       return {
         seeded: true,
@@ -490,14 +504,15 @@ export class SwitchboardSandbox extends Sandbox<Env> {
       t = systemClock();
       const script = seedFixupScript({
         slug: seed.slug,
+        doorOrigin: envVars.GIT_DOOR_ORIGIN ?? "",
         ref: seed.ref,
         ...(seed.fetchRef ? { fetchRef: seed.fetchRef } : {}),
         ...(seed.fetchSha ? { fetchSha: seed.fetchSha } : {}),
         checkoutDir: SEED_CHECKOUT_DIR,
         ...(seed.depsBackupId ? { depsDir: SEED_DEPS_STAGING_DIR } : {}),
       });
-      // The fix-up's fetch authenticates through the image's credential helper
-      // with the exec env's GH_TOKEN — the same channel every command uses.
+      // The fix-up's fetch authenticates through the door-scoped helper using
+      // the run bearer in the command environment.
       const fix = await this.runRoot(["bash", "-c", script], SEED_FIXUP_TIMEOUT_MS, envVars);
       if (fix.exitCode !== 0) throw new Error(`fix-up exited ${fix.exitCode}: ${tail(fix.stderr || fix.stdout)}`);
       steps.fixup = systemClock() - t;

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.267.2",
+  "version": "1.268.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.267.2",
+      "version": "1.268.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -21023,7 +21023,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.267.2",
+      "version": "1.268.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.267.2",
+  "version": "1.268.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.267.2",
-  "commit": "08956af1ac05f7f428a07f4e2190b68695623a62",
-  "builtAt": "2026-09-29T01:42:48.486Z"
+  "version": "1.268.0",
+  "commit": "f1bc76a31780740930006bd492101666268596da-dirty",
+  "builtAt": "2026-09-29T08:06:43.354Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -306,7 +306,7 @@ SCOPE FIRST — a hard rule, at most 5 tool calls: identify the target repositor
 - Use \`gh search code\` / \`gh api\` for cross-repo lookups; clone at most ONE repo per task.
 
 Workflow for shipping a PR:
-1. Clone the repo into the workspace if it's not already there (use gh or git; both are authenticated on this host). Orient with a few BATCHED commands (tree + the relevant files in one call), not file-by-file exploration.
+1. Clone the repo into the workspace if it is not already there: \`gh repo clone <owner/name>\` or \`git clone "$GIT_DOOR_REMOTE"\` for the bound repository. A private \`github.com\` clone URL cannot use the run bearer. Orient with a few BATCHED commands (tree + the relevant files in one call), not file-by-file exploration.
 2. Create a branch with a descriptive name.
 3. Implement the change. Match the surrounding code's style and conventions.
 4. Prove the change with the cheapest checks that can (CHECKS BY COST below): the linter and the tests nearest the files you touched, the documentation checks for a documentation change.
@@ -628,7 +628,7 @@ You cannot run commands, clone repositories, edit code, or review pull requests,
 // preset, not a directive.
 const EXPLORE_SYSTEM = `You are Switchboard's explore agent: a long, read-only investigation of a repository, answering a request from Slack.
 
-You work in a fresh sandbox with a shell (bash), read_file, and a read-scoped GitHub credential: git and gh are authenticated for reads, so clone the target repository into your workspace first (\`gh repo clone <owner/name>\` or \`git clone\`; check out the ref the request names), install what you need and run whatever the investigation calls for — builds, test suites, benchmarks, \`act\`. ${SANDBOX_TOOLCHAIN} You cannot push. Your other tools: \`web_search\` and \`web_fetch\` (sources and pages), the GitHub reads — \`github_repos\`, \`github_tree\` / \`github_file\` (browse and read our repos at any ref), \`github_search_code\`, \`github_issue_list\` / \`github_issue_get\` — and \`list_skills\` / \`use_skill\`.
+You work in a fresh sandbox with a shell (bash), read_file, and a read-scoped GitHub credential: clone the bound repository first with \`gh repo clone <owner/name>\` or \`git clone "$GIT_DOOR_REMOTE"\`, then check out the ref the request names. A private \`github.com\` clone URL cannot use the run bearer. Install what you need and run whatever the investigation calls for — builds, test suites, benchmarks, \`act\`. ${SANDBOX_TOOLCHAIN} You cannot push. Your other tools: \`web_search\` and \`web_fetch\` (sources and pages), the GitHub reads — \`github_repos\`, \`github_tree\` / \`github_file\` (browse and read our repos at any ref), \`github_search_code\`, \`github_issue_list\` / \`github_issue_get\` — and \`list_skills\` / \`use_skill\`.
 
 THE DELIVERABLE IS A CLAIM TABLE. Turn the request into the claims it makes or asks about — explicit ones ("the suite runs in 4 minutes") and the implicit ones a careful engineer would check — and verify each one by running it, not by reading about it. One row per claim: the claim, the exact command you ran to check it, the number or output it produced, and a verdict (holds / does not hold / could not check — and why). Numbers over adjectives: measure a duration, count the failures, quote the version. Say what you did not get to.
 

package/dist/assets/src/core/budgets.ts

@@ -21,6 +21,8 @@ export const SECOND_MS = 1_000;
 export const secondsToMs = (seconds: number): number => seconds * SECOND_MS;
 
 export const MINUTE_MS = 60_000;
+/** Allow the run's ending to release its resident workspace after its budget ends. */
+export const RUN_REGISTRATION_GRACE_MS = MINUTE_MS;
 
 /** Minutes → milliseconds, for a duration a request names in minutes (a drain's
  *  length): the multiplication lives here so no other file holds it. */
@@ -253,6 +255,10 @@ export const PROVIDER_RETRY_BACKOFFS_MS = [5_000, 15_000, 45_000] as const;
  *  model call itself remains bounded by the run's lease. */
 export const MODEL_STREAM_HEARTBEAT_MS = 15_000;
 
+/** A residents page re-reads the registry while open so a deploy's drain and
+ *  image reports advance even when no run can attach to trigger its feed. */
+export const RESIDENT_LISTING_POLL_MS = 30_000;
+
 /** A hosted ship parent's deadline margin past the pipeline's wall clock
  *  (record 0060): the row's `state.hosting.until` is the hand-off time plus
  *  the instance's `caps.maxMinutes` plus this hour, absorbing the runner's own

package/dist/assets/src/core/coordinator/contract.ts

@@ -307,12 +307,13 @@ export interface ExistingPrPublicationBinding {
   owner: { instanceId: string; unit: string };
 }
 
-/** What a coordinator's spawn stamps on the child's every row: the instance
- *  the child belongs to and the key the spawn carried — and, for the child's
- *  own post-step, the base its pull request targets. */
+/** What a coordinator's spawn stamps on the child's every row: its instance,
+ *  spawn key and admitted cost cap, plus the base for its PR post-step. */
 export interface CoordinatorTag {
   parentInstanceId: string;
   idempotencyKey: string;
+  /** The unit's original dollar limit, fixed at admission; absent means no cost cap. */
+  costCapUsd?: number;
   /** The unit's durable write branch, read from its row at child admission. */
   branch?: string;
   /** Workflow transport for a recovered child. Identity and idempotency remain
@@ -346,15 +347,20 @@ export interface CoordinatorTag {
   publication?: ExistingPrPublicationBinding;
 }
 
-/** The tag as the two flat record fields, or nothing — so a row, a summary
- *  and a record spread the same thing and a run with no coordinator carries no
- *  key. The base never rides here: rows and records keep the shape written
- *  before it existed. */
+/** The tag's identity and optional cap as flat record fields, or nothing — so
+ *  a row, summary and record agree. The base never rides here. */
 export function coordinatorFields(tag: CoordinatorTag | undefined): {
   parentInstanceId?: string;
   idempotencyKey?: string;
+  costCapUsd?: number;
 } {
-  return tag ? { parentInstanceId: tag.parentInstanceId, idempotencyKey: tag.idempotencyKey } : {};
+  return tag
+    ? {
+        parentInstanceId: tag.parentInstanceId,
+        idempotencyKey: tag.idempotencyKey,
+        ...(tag.costCapUsd !== undefined ? { costCapUsd: tag.costCapUsd } : {}),
+      }
+    : {};
 }
 
 /** The parent ship record: what the bot writes at an instance's creation and

package/dist/assets/src/core/costs.ts

@@ -516,6 +516,8 @@ export interface CostReport {
   /** Each biller's daily invoice tie-out (item 4d); absent when no provider block is known
    *  (a report built without the wiring) or run history is off. */
   billers?: BillerTieOut[];
+  /** Ship children across this bot's runs, independent of the Cloudflare group. */
+  shipSpend?: import("./shipSpend.js").ShipSpendReport;
 }
 
 /** What the report carries beyond the priced rows: the account behind the

package/dist/assets/src/core/runEvents.ts

@@ -974,6 +974,7 @@ export type RunEvent =
       type: "coordinator_tag";
       parentInstanceId: string;
       unit?: string;
+      costCapUsd?: number;
       branch?: string;
       transportWorkflowId?: string;
       recovery?: import("./coordinator/contract.js").CoordinatorTag["recovery"];
@@ -1142,7 +1143,15 @@ export type RunEvent =
        *  `model` is the ref the run uses, resolved from a model the person
        *  named in plain words (the plain-words model unit) — applied at
        *  directive precedence. Additive: unknown → no model. */
-      binds?: ReadonlyArray<{ line: string; reason: string; model?: string; repo?: string; confirmed?: true }>;
+      binds?: ReadonlyArray<{
+        line: string;
+        reason: string;
+        model?: string;
+        repo?: string;
+        /** The admissible fact behind the model's typed repo choice. */
+        repoSource?: "request" | "attachment" | "thread" | "channel";
+        confirmed?: true;
+      }>;
       question?: string;
       /** A question's proposed line, redacted and cut like the receipt — what
        *  the next turn's "yes" binds (`bindFromAnswer`). */
@@ -1160,6 +1169,14 @@ export type RunEvent =
        * boundary. Its refusal text is always the cause-owned renderer. */
       providerFailure?: ProviderFailureCause;
       attempts?: ReadonlyArray<{ outcome: "accepted" | "violation"; violation?: string }>;
+      /** Snapshot of the factual repository context the operator received. */
+      repoContext?: {
+        organization: string;
+        threadRepo?: string;
+        channelRepo?: string;
+        candidateStatus: "skipped" | "available" | "truncated" | "empty" | "unavailable";
+        candidateCount: number;
+      };
       intake?: { verdict: string; reason: string };
       latencyMs?: number;
       outputTokens?: number;

package/dist/assets/src/core/runLedger/types.ts

@@ -99,6 +99,8 @@ export interface LiveRunMeta {
    *  still sends the parent its event and a retried spawn finds its run. */
   parentInstanceId?: string;
   idempotencyKey?: string;
+  /** The original Ship unit cap carried by the claim, available before its tag event is retained. */
+  costCapUsd?: number;
   /** Where the run's conversation started (item 52), so a reclaimed run's
    *  record still says so: `parent` for a spawned child, `channel` otherwise. */
   seed?: RunSeed;

package/dist/assets/src/core/runRecord.ts

@@ -227,6 +227,8 @@ export interface RunRecord {
    *  item 48), stored at the claim so a retried spawn finds its run. Present
    *  exactly when `parentInstanceId` is — both or neither, never one alone. */
   idempotencyKey?: string;
+  /** The coordinator unit's original cost cap, carried by each child. */
+  costCapUsd?: number;
   /** The plan runner instance this run's hand-off created (record 0051 R2;
    *  item 2): the last `ship_handoff` event, folded at the assembly like the
    *  coordinator tag. Present only on a ship run whose hand-off succeeded;
@@ -484,7 +486,14 @@ export interface RunOperatorDecision {
   mode: "shadow" | "on";
   outcome: "binds" | "question" | "refusal" | "non_decision";
   reason: string;
-  binds?: { line: string; reason: string; model?: string; repo?: string; confirmed?: true }[];
+  binds?: {
+    line: string;
+    reason: string;
+    model?: string;
+    repo?: string;
+    repoSource?: "request" | "attachment" | "thread" | "channel";
+    confirmed?: true;
+  }[];
   question?: string;
   /** A question's proposed line — what the next turn's "yes" binds. */
   proposal?: string;
@@ -497,6 +506,13 @@ export interface RunOperatorDecision {
   /** The structured seam's attempts (record 0067): what each answer violated,
    *  or that it was accepted. */
   attempts?: { outcome: "accepted" | "violation"; violation?: string }[];
+  repoContext?: {
+    organization: string;
+    threadRepo?: string;
+    channelRepo?: string;
+    candidateStatus: "skipped" | "available" | "truncated" | "empty" | "unavailable";
+    candidateCount: number;
+  };
   intake?: { verdict: string; reason: string };
   latencyMs?: number;
   outputTokens?: number;
@@ -520,6 +536,7 @@ export function operatorOfEvents(events: readonly RunEvent[]): RunOperatorDecisi
             reason: b.reason,
             ...(b.model !== undefined ? { model: b.model } : {}),
             ...(b.repo !== undefined ? { repo: b.repo } : {}),
+            ...(b.repoSource !== undefined ? { repoSource: b.repoSource } : {}),
             ...(b.confirmed ? { confirmed: true as const } : {}),
           })),
         }
@@ -538,6 +555,7 @@ export function operatorOfEvents(events: readonly RunEvent[]): RunOperatorDecisi
           })),
         }
       : {}),
+    ...(e.repoContext ? { repoContext: { ...e.repoContext } } : {}),
     ...(e.intake ? { intake: { verdict: e.intake.verdict, reason: e.intake.reason } } : {}),
     ...(e.latencyMs !== undefined ? { latencyMs: e.latencyMs } : {}),
     ...(e.outputTokens !== undefined ? { outputTokens: e.outputTokens } : {}),
@@ -1179,6 +1197,14 @@ export function isRunRecord(v: unknown): v is RunRecord {
     (typeof r.idempotencyKey !== "string" || !IDEMPOTENCY_KEY_PATTERN.test(r.idempotencyKey))
   )
     return false;
+  if (
+    r.costCapUsd !== undefined &&
+    (r.parentInstanceId === undefined ||
+      typeof r.costCapUsd !== "number" ||
+      !Number.isFinite(r.costCapUsd) ||
+      r.costCapUsd <= 0)
+  )
+    return false;
   // The instance a ship run's hand-off created (record 0051 R2; item 2).
   if (r.instanceId !== undefined && (typeof r.instanceId !== "string" || !INSTANCE_ID_PATTERN.test(r.instanceId)))
     return false;

package/dist/assets/src/core/runUsage.ts

@@ -1,4 +1,5 @@
 import type { RunEvent } from "./runEvents.js";
+import { unitOfIdempotencyKey } from "./coordinator/contract.js";
 
 // What a run cost in tokens, and who it belongs to — the data behind the cost
 // dimensions of the costs page (docs/reference/specs/costs.md items 10–10a) and
@@ -200,6 +201,9 @@ export interface UsageRun {
   userName?: string;
   /** A child run is billed to whoever started its parent (run-history item 46). */
   parentRunId?: string;
+  parentInstanceId?: string;
+  idempotencyKey?: string;
+  costCapUsd?: number;
   /** The thread the run ran in and the channel it belongs to (platform-namespaced, invariant 4). */
   threadKey: string;
   channelId: string;
@@ -258,6 +262,8 @@ export interface UsageRow {
 
 export interface RunUsageReport {
   rows: UsageRow[];
+  /** Individual Ship children retained for the unit-spend trend; old snapshots omit this. */
+  shipRuns?: ShipRunUsage[];
   /** Runs in range whose usage is not known yet (written before the field; backfill outstanding). */
   pending: number;
   /** The oldest finish the store still holds, so a page can bound its range to the data. */
@@ -265,6 +271,33 @@ export interface RunUsageReport {
   retentionDays: number;
 }
 
+export interface ShipRunUsage {
+  id: string;
+  unitKey: string;
+  finishedAt: number;
+  costCapUsd?: number;
+  /** Missing while an older record is still being backfilled. */
+  usage?: RunUsage;
+}
+
+/** The unit identity comes from the coordinator's durable key, never a thread or branch guess. */
+export function shipRunsOf(runs: readonly UsageRun[]): ShipRunUsage[] {
+  return runs.flatMap((run) => {
+    if (!run.parentInstanceId || !run.idempotencyKey) return [];
+    const unit = unitOfIdempotencyKey(run.idempotencyKey);
+    if (!unit) return [];
+    return [
+      {
+        id: run.id,
+        unitKey: `${run.parentInstanceId}:${unit}`,
+        finishedAt: run.finishedAt,
+        ...(run.costCapUsd !== undefined ? { costCapUsd: run.costCapUsd } : {}),
+        ...(run.usage !== undefined ? { usage: run.usage } : {}),
+      },
+    ];
+  });
+}
+
 export const dayOf = (epochMs: number): string => new Date(epochMs).toISOString().slice(0, 10);
 
 const identityOf = (who: UsageIdentity): UsageIdentity => ({
@@ -334,6 +367,7 @@ export function reportOfUsageRows(rows: RunUsageRows): RunUsageReport {
   const { rows: cells, pending } = aggregateUsage(rows.runs, (id) => rows.parents[id]);
   return {
     rows: cells,
+    shipRuns: shipRunsOf(rows.runs),
     // The store counts what it could not price; the fold sees the same runs without `usage`.
     pending: Math.max(pending, rows.pending),
     ...(rows.earliestFinishedAt !== undefined ? { earliestFinishedAt: rows.earliestFinishedAt } : {}),
@@ -356,6 +390,10 @@ function isUsageRun(v: unknown): v is UsageRun {
     typeof r.channelId === "string" &&
     (r.agent === undefined || typeof r.agent === "string") &&
     (r.parentRunId === undefined || typeof r.parentRunId === "string") &&
+    (r.parentInstanceId === undefined || typeof r.parentInstanceId === "string") &&
+    (r.idempotencyKey === undefined || typeof r.idempotencyKey === "string") &&
+    (r.costCapUsd === undefined ||
+      (typeof r.costCapUsd === "number" && Number.isFinite(r.costCapUsd) && r.costCapUsd > 0)) &&
     typeof r.startedAt === "number" &&
     typeof r.finishedAt === "number" &&
     (r.usage === undefined || isRunUsage(r.usage))
@@ -382,6 +420,7 @@ export function isRunUsageReport(v: unknown): v is RunUsageReport {
   if (typeof v !== "object" || v === null) return false;
   const r = v as Record<string, unknown>;
   if (!Array.isArray(r.rows) || !hasReportTail(r)) return false;
+  if (r.shipRuns !== undefined && (!Array.isArray(r.shipRuns) || !r.shipRuns.every(isShipRunUsage))) return false;
   return r.rows.every(
     (row) =>
       isIdentity(row) &&
@@ -394,3 +433,17 @@ export function isRunUsageReport(v: unknown): v is RunUsageReport {
       isRunUsage((row as UsageRow).usage),
   );
 }
+
+function isShipRunUsage(v: unknown): v is ShipRunUsage {
+  if (typeof v !== "object" || v === null) return false;
+  const r = v as ShipRunUsage;
+  return (
+    typeof r.id === "string" &&
+    typeof r.unitKey === "string" &&
+    typeof r.finishedAt === "number" &&
+    Number.isFinite(r.finishedAt) &&
+    (r.costCapUsd === undefined ||
+      (typeof r.costCapUsd === "number" && Number.isFinite(r.costCapUsd) && r.costCapUsd > 0)) &&
+    (r.usage === undefined || isRunUsage(r.usage))
+  );
+}

package/dist/assets/src/core/ship/coordinator.ts

@@ -3886,7 +3886,10 @@ function renderUnitReportWithWake(
   const spentCapAction = (): string | undefined => {
     const cap = s.input.grant?.costCapUsd;
     if (cap === undefined || s.spendUsd === null || s.spendUsd < cap) return undefined;
-    return `Next action: $${s.spendUsd.toFixed(2)} spent against the original $${cap.toFixed(2)} cost cap; this unit cannot start another child. Continue ${prUrl ? `the existing pull request (${prUrl})` : "the saved branch"} only under separate authorization, then request review of its exact head.`;
+    const next = prUrl
+      ? `If the pull request (${prUrl}) is still open, continue it only under separate authorization, then request review of its exact head. If it has merged, no recovery is needed.`
+      : "If work remains on the saved branch, continue it only under separate authorization, then request review of its exact head.";
+    return `Next action: $${s.spendUsd.toFixed(2)} spent against the original $${cap.toFixed(2)} cost cap; this unit cannot start another child. ${next}`;
   };
   const nextAction = (checkpoint?: { branch: string; sha: string }): string => {
     if (durableWake)

package/dist/assets/src/core/shipSpend.ts

@@ -0,0 +1,52 @@
+import type { DateRange } from "./costs.js";
+import type { RunUsage, ShipRunUsage } from "./runUsage.js";
+
+/** Ship child costs within one snapshot, grouped by their durable unit key. */
+export interface ShipSpendReport {
+  range: DateRange;
+  units: Array<{
+    key: string;
+    /** The admitted unit cap; null on older runs or inconsistent records. */
+    capUsd: number | null;
+    /** Unknown after any child with unpriced usage. */
+    totalUsd: number | null;
+    runs: Array<{ id: string; finishedAt: number; usd: number | null; cumulativeUsd: number | null }>;
+  }>;
+}
+
+/** The cap gate sums recorded per-model dollars; missing dollars stay unknown, while no model turns cost zero. */
+function recordedUsd(usage: RunUsage | undefined): number | null {
+  const models = Object.values(usage?.byModel ?? {});
+  if (!usage || !Number.isSafeInteger(usage.turns) || usage.turns < 0) return null;
+  if (usage.turns === 0 && models.length === 0) return 0;
+  if (
+    models.length === 0 ||
+    models.reduce((sum, model) => sum + model.turns, 0) !== usage.turns ||
+    models.some((model) => typeof model.usd !== "number" || !Number.isFinite(model.usd) || model.usd < 0)
+  )
+    return null;
+  return models.reduce((sum, model) => sum + model.usd!, 0);
+}
+
+export function buildShipSpendReport(runs: readonly ShipRunUsage[], range: DateRange): ShipSpendReport {
+  const groups = new Map<string, ShipRunUsage[]>();
+  for (const run of runs) {
+    const day = new Date(run.finishedAt).toISOString().slice(0, 10);
+    if (day < range.from || day > range.to) continue;
+    groups.set(run.unitKey, [...(groups.get(run.unitKey) ?? []), run]);
+  }
+  const units = [...groups].map(([key, children]) => {
+    const ordered = children.sort((a, b) => a.finishedAt - b.finishedAt || a.id.localeCompare(b.id));
+    const caps = new Set(ordered.map((r) => r.costCapUsd));
+    const capUsd = caps.size === 1 ? (ordered[0]?.costCapUsd ?? null) : null;
+    let cumulative: number | null = 0;
+    const points = ordered.map((r) => {
+      const usd = recordedUsd(r.usage);
+      cumulative = cumulative === null || usd === null ? null : cumulative + usd;
+      return { id: r.id, finishedAt: r.finishedAt, usd, cumulativeUsd: cumulative };
+    });
+    return { key, capUsd, totalUsd: cumulative, runs: points };
+  });
+  units.sort((a, b) => (b.runs.at(-1)?.finishedAt ?? 0) - (a.runs.at(-1)?.finishedAt ?? 0));
+  return { range, units };
+}

package/dist/assets/src/core/trace/attrs.ts

@@ -45,6 +45,16 @@ export interface AttrDomain {
   refusal: string;
   /** The refusal's cause, from the one code→cause table in src/core/refusal.ts. */
   cause: "request" | "policy" | "system";
+  /** The operator's decision, separate from the request's final outcome. */
+  operatorOutcome: "binds" | "question" | "refusal" | "non_decision";
+  /** Provenance of an accepted typed repository; the slug stays on the run event. */
+  operatorRepoSource: "request" | "attachment" | "thread" | "channel";
+  operatorAttempts: number;
+  operatorRepoCatalog: "skipped" | "available" | "truncated" | "empty" | "unavailable";
+  operatorRepoCandidates: number;
+  /** Final target resolution, separate from the operator's proposed repo. */
+  repoResolution: "skipped" | "resolved" | "rejected" | "unverified" | "conflict" | "unresolved";
+  repoTargetRelation: "not_proposed" | "matched" | "overridden" | "unresolved";
   count: number;
   backend: Backend;
   // run.command
@@ -146,6 +156,11 @@ const IDENTIFIER_KEYS: ReadonlySet<SpanAttrKey> = new Set<SpanAttrKey>([
   "outcome",
   "refusal",
   "cause",
+  "operatorOutcome",
+  "operatorRepoSource",
+  "operatorRepoCatalog",
+  "repoResolution",
+  "repoTargetRelation",
   "command",
   "route",
   "host",
@@ -204,6 +219,13 @@ const ATTR_TYPE: Record<SpanAttrKey, "string" | "number" | "boolean"> = {
   outcome: "string",
   refusal: "string",
   cause: "string",
+  operatorOutcome: "string",
+  operatorRepoSource: "string",
+  operatorAttempts: "number",
+  operatorRepoCatalog: "string",
+  operatorRepoCandidates: "number",
+  repoResolution: "string",
+  repoTargetRelation: "string",
   count: "number",
   backend: "string",
   command: "string",

package/dist/assets/src/core/trace/tracer.ts

@@ -99,6 +99,7 @@ interface SpanInit {
   sinks: SpanSink[];
   startedAt: number | undefined;
   attrs: SpanAttrs | undefined;
+  rootIdentity?: { name: string; runId?: string };
 }
 
 class SpanImpl implements Span {
@@ -109,6 +110,8 @@ class SpanImpl implements Span {
   ended = false;
   private readonly sinks: SpanSink[];
   private readonly rec: SpanRecord;
+  private readonly rootIdentity: { name: string; runId?: string };
+  private readonly isLocalRoot: boolean;
 
   constructor(
     private readonly shared: Shared,
@@ -118,6 +121,8 @@ class SpanImpl implements Span {
     this.parentId = init.parentId;
     this.name = sanitizeSpanName(init.name);
     this.sinks = init.sinks;
+    this.isLocalRoot = init.rootIdentity === undefined;
+    this.rootIdentity = init.rootIdentity ?? { name: this.name, runId: init.attrs?.runId };
     this.rec = {
       traceId: this.traceId,
       spanId: this.id,
@@ -164,6 +169,7 @@ class SpanImpl implements Span {
       sinks: this.sinks,
       startedAt: opts?.startedAt,
       attrs: opts?.attrs,
+      rootIdentity: this.rootIdentity,
     });
     child.emitStart();
     return child;
@@ -177,6 +183,7 @@ class SpanImpl implements Span {
       sinks: this.sinks,
       startedAt: opts.startedAt,
       attrs: opts.attrs,
+      rootIdentity: this.rootIdentity,
     });
     child.emitStart();
     child.endAt(Math.max(opts.startedAt, opts.endedAt), opts.status ?? "ok", opts.errorKind, opts.errorCode);
@@ -196,7 +203,7 @@ class SpanImpl implements Span {
     }
     for (const s of this.sinks) {
       try {
-        s.onEnd(this.record());
+        s.onEnd(this.record(), this.rootIdentity);
       } catch (err) {
         this.shared.warn(
           `[trace] sink onEnd threw for ${this.name}: ${err instanceof Error ? err.message : String(err)}`,
@@ -215,7 +222,7 @@ class SpanImpl implements Span {
     this.rec.status = status ?? this.rec.status ?? "ok";
     for (const s of this.sinks) {
       try {
-        s.onEnd(this.record());
+        s.onEnd(this.record(), this.rootIdentity);
       } catch (err) {
         this.shared.warn(
           `[trace] sink onEnd threw for ${this.name}: ${err instanceof Error ? err.message : String(err)}`,
@@ -239,6 +246,7 @@ class SpanImpl implements Span {
 
   setAttrs(attrs: SpanAttrs): void {
     (this.rec as { attrs: SpanAttrs }).attrs = { ...this.rec.attrs, ...attrs };
+    if (this.isLocalRoot) this.rootIdentity.runId = this.rec.attrs.runId;
   }
 
   record(): SpanRecord {

package/dist/assets/src/core/trace/types.ts

@@ -40,12 +40,23 @@ export interface SpanRecord {
   attrs: SpanAttrs;
 }
 
+/** A live, read-only view of the local root's run identity. Shared by its
+ *  descendants, including late children; changing the root's runId updates
+ *  the view without changing any span record. No span, sink or payload is
+ *  retained here, so a bounded sink can keep it after the root ends. */
+export interface SpanRootIdentity {
+  readonly name: string;
+  readonly runId?: string;
+}
+
 /** Observer of span starts and ends (Observer). Sinks are attached to a root
  *  and inherited by its whole subtree; a throwing sink never reaches traced
  *  code. */
 export interface SpanSink {
   onStart?(span: SpanRecord): void;
-  onEnd(span: SpanRecord): void;
+  /** The tracer supplies root identity separately from the record snapshot;
+   *  synthetic records supplied directly by a caller may omit it. */
+  onEnd(span: SpanRecord, root?: SpanRootIdentity): void;
 }
 
 /** The seam the no-gaps test enters through (Strategy): production is the

package/dist/assets/src/core/trace/workerTrace.ts

@@ -82,9 +82,9 @@ export function refusalFilter(sink: SpanSink): SpanSink {
   const refused = (status: unknown) => status === 401 || status === 403;
   return {
     ...(sink.onStart ? { onStart: (rec) => sink.onStart!(rec) } : {}),
-    onEnd: (rec) => {
+    onEnd: (rec, root) => {
       if (refused(rec.attrs.httpStatus)) return;
-      sink.onEnd(rec);
+      sink.onEnd(rec, root);
     },
   };
 }

package/dist/assets/src/execution/residentPoolSpends.ts

@@ -5,6 +5,15 @@ export interface SpentPoolUser {
   owner: string;
 }
 
+/** An owner may reclaim its own UID; only a different owner needs a fresh one. */
+export function unavailablePoolUsers(spent: ReadonlyMap<string, string>, owner: string): Set<string> {
+  return new Set([...spent].filter(([, prior]) => prior !== owner).map(([user]) => user));
+}
+
+export function ownedPoolUsers(spent: ReadonlyMap<string, string>, owner: string): string[] {
+  return [...spent].filter(([, prior]) => prior === owner).map(([user]) => user);
+}
+
 export function parseSpentPoolUsers(value: unknown, pool: readonly string[]): ReadonlyMap<string, string> | null {
   if (
     !Array.isArray(value) ||