@alphacoder-v0/pi-loops 0.22.7 → 0.24.0

package/src/scheduler.ts

@@ -1,36 +1,34 @@
 /**
- * The heartbeat. One pi process on the machine owns the timer at a time
- * (leadership lives in scheduler.json with a heartbeat); every other process
- * with this extension stands by and takes over when the owner exits or dies.
- * Loop jobs are therefore host-agnostic: close the pi that created a loop and
- * any other open pi keeps it ticking; restart pi and missed ticks are caught up
- * (once, collapsed) unless the job opted out.
- *
- * Inject-mode jobs are session-bound: they only fire from the process whose
- * current session is the one that created them.
+ * The clock. The same scheduler runs in two roles, and only what it owns differs: the always-on
+ * host runs every loop, and a pi window runs the plain jobs of the conversation whose lease it
+ * holds (src/lease.ts). Nobody is elected. A missed tick is caught up once, collapsed, unless the
+ * job opted out.
  */
 import * as fs from "node:fs";
 import * as os from "node:os";
 import { PresenceRegistry, type PresenceEntry, type PresenceKind, type PresenceSelf } from "./presence.ts";
 import * as path from "node:path";
 import { Inbox } from "./inbox.ts";
-import { pidAlive, withFileLock, writeFileAtomic } from "./lock.ts";
+import { pidAlive, writeFileAtomic } from "./lock.ts";
 import { composeCheckerPrompt, composeLoopPrompt, findingKind, parseCheckerOutput, parseRunOutput, stripProtocolTags } from "./protocol.ts";
 import { type RunnerResult, type SubagentRunner, failedRun } from "./runner.ts";
 import { previewRedacted, redact } from "./redact.ts";
 import { type SubagentSlot, SubagentSlots } from "./slots.ts";
 import { backoffWaitMs, computeDue, computeNext, formatLocal, formatLocalZoned, formatSchedule, isValidSchedule, stamp } from "./schedule.ts";
-import { type CheckerRecord, JobStore, type LoopJob, type RunRecord, newId } from "./store.ts";
-import { ownerSession, runsIn } from "./job-owner.ts";
+import { type CheckerRecord, JobStore, type LoopJob, type RunRecord, type RunRequester, newId } from "./store.ts";
+import { openWhere, ownerSession, runsHere, whereRuns, type OwnerView } from "./job-owner.ts";
+import { shortSessionId } from "./session-head.ts";
+import { DEAD_AFTER_ATTEMPTS, backoffFor, plainCollapseKey, plainJobRow, plainRunId, sessionFileHas } from "./engine.ts";
+import { RequestStore, type SessionRequest } from "./requests.ts";
+import { PI_LOOPS_VERSION } from "./version.ts";
 
 export const DEFAULT_TICK_MS = 30_000;
-export const LEADER_STALE_MS = 90_000;
+/** Interrupted runs in a row (a process that died mid-run) after which a job is parked. */
+export const INTERRUPTIONS_BEFORE_PARKING = 3;
 /** Consecutive failures before a job is retried on a widening gap rather than every due tick. */
 export const FAILURE_BACKOFF_AFTER = 3;
 export const FAILURE_BACKOFF_BASE_MS = 5 * 60_000;
 export const FAILURE_BACKOFF_MAX_MS = 6 * 60 * 60_000;
-/** A run claimed by another machine (shared $HOME) is only assumed dead after this long. */
-export const FOREIGN_RUN_STALE_MS = 24 * 60 * 60 * 1000;
 export const DEFAULT_RUN_TIMEOUT_MS = 15 * 60_000;
 export const MAX_CONCURRENT_RUNS = 3;
 /**
@@ -47,6 +45,8 @@ export interface SessionSnapshot {
 	thinking?: string;
 	/** The interactive pi trusted this project (`pi --approve` / trust prompt); children in the same cwd inherit it. */
 	trusted?: boolean;
+	/** The built-in tools active in this chat (`--tools`, `--exclude-tools`); a loop made here keeps them. */
+	builtinTools?: string[];
 }
 
 export interface SchedulerSettings {
@@ -57,7 +57,7 @@ export interface SchedulerSettings {
 	maxConcurrentRuns: number;
 	/** Stop dispatching once today's automation has cost this much. 0 or absent = no cap. */
 	dailyBudgetUsd?: number;
-	/** Global switch for firing ticks missed while no pi was open (`[cron] catch_up`); per-job `catchUp` still applies. */
+	/** Global switch for firing ticks missed while this scheduler was not running (`[cron] catch_up`); per-job `catchUp` still applies. */
 	catchUp: boolean;
 }
 
@@ -69,21 +69,28 @@ export interface RunOutcome {
 }
 
 export interface SchedulerHooks {
-	/** Inject-mode job is due: deliver `prompt` to the current session. `runId` is the id in its `[Trigger …]` prefix. */
-	onInject?: (job: LoopJob, prompt: string, runId: string) => void | Promise<void>;
+	/**
+	 * The host: run `prompt` as a turn in the closed conversation it now holds. Resolves when the turn
+	 * is over with the run's result; `preempted` when a window took the conversation back before the
+	 * turn completed (a turn that completed is done, whoever holds the lease now). `landed` says
+	 * whether the prompt's `[Trigger <id>]` entry is in the conversation; absent, a completed turn is
+	 * taken to have landed it.
+	 */
+	onHeldTurn?: (job: LoopJob, prompt: string, runId: string, held: HeldSession, signal: AbortSignal) => Promise<{ preempted: boolean; result: RunnerResult; landed?: boolean }>;
 	onRunStart?: (job: LoopJob, runId: string) => void;
-	/** A run is being fired for a tick that was missed while no pi was open. */
+	/** A run is being fired for a tick that was missed while this scheduler was not running. */
 	onCatchUp?: (job: LoopJob, dueAt: number) => void;
 	onRunFinished?: (outcome: RunOutcome) => void;
 	/** A one-shot removed itself: the control plane records it the way a person's removal is recorded. */
 	onJobRetired?: (job: LoopJob, reason: string) => void;
+	/** A plain job's row this process wrote into its conversation's queue (the clock's, or `/cron run`'s): the window records it as its own, and says so when it waits. */
+	onRowWritten?: (row: SessionRequest, job: LoopJob) => void;
 	onInboxChanged?: () => void;
-	/** Every tick, after leadership is settled. Other subsystems (dynamic triggers) piggyback on it. */
-	onTick?: (now: number, leader: boolean) => void | Promise<void>;
-	/** Leadership gained or lost. */
-	onLeadership?: (leader: boolean) => void | Promise<void>;
+	/** Every tick, before dispatch. Other subsystems (leases, dynamic triggers) piggyback on it. */
+	onTick?: (now: number) => void | Promise<void>;
 	/** A whole tick failed: nothing ran. A failure that needs a person, where `log` is a diagnostic at either level. */
-	onSchedulerError?: (message: string) => void;
+	/** `job` is the one the message is about, when there is one (its cwd decides which windows hear it). */
+	onSchedulerError?: (message: string, job?: Pick<LoopJob, "cwd">) => void;
 	/** Today's spend passed the configured cap; nothing more will be dispatched today. */
 	onBudgetExceeded?: (spent: number, cap: number) => void;
 	/**
@@ -92,7 +99,46 @@ export interface SchedulerHooks {
 	 * a regex over these strings. Absent `level` means `"warning"`: a line that does not say it is
 	 * routine is not.
 	 */
-	log?: (message: string, level?: "info" | "warning") => void;
+	/** `job` is the one the line is about, so a window of its project can say it (src/host-control-channel.ts Notice). */
+	log?: (message: string, level?: "info" | "warning", job?: Pick<LoopJob, "cwd">) => void;
+}
+
+/**
+ * The lease side of plain-job ownership (src/lease.ts): a plain job fires only in the instance that
+ * holds its session's lease, and its claim re-checks that the lease has not moved since.
+ */
+export interface PlainJobLeases {
+	/** The epoch of this instance's lease on `sessionId`, when it holds it. */
+	heldEpoch(sessionId: string): number | undefined;
+	/** The pid of the live holder of `sessionId`'s lease, when there is one. */
+	holderOf(sessionId: string): number | undefined;
+	/** The kind of the live holder, when there is one. */
+	holderKind?(sessionId: string): "terminal" | "page" | "host" | undefined;
+	/** Windows: whether this one holds its conversation's lease but stands aside (OwnerView.standsAside). */
+	standsAside?(): boolean;
+	/** Windows: whether the host fires this closed conversation's plain jobs (it runs, and knows the file). */
+	hostRuns?(sessionId: string): boolean;
+	/** Why no host runs anything right now, when that is so (see OwnerView.hostPaused). */
+	hostPaused?(): string | undefined;
+	/** The host: take a closed conversation for one turn (src/lease.ts acquireForHost), or undefined. */
+	acquireForWork?(sessionId: string, runId: string, jobId: string): HeldSession | undefined;
+	/** The host: give the conversation back after the turn. A window that took it meanwhile keeps it. */
+	releaseWork?(sessionId: string, epoch: number): void;
+}
+
+/**
+ * The `AbortSignal.reason` of a run a person stopped: `/triggers abort`, `pi-loops
+ * abort`, a stop row. A held turn stopped so is done, not handed back: no successor row, no owed slot.
+ * A quit, an upgrade, a preemption or the budget aborts with no reason and hands the turn back.
+ */
+export const STOPPED_BY_PERSON = "stopped by a person";
+
+/** A closed conversation the host holds for one turn. */
+export interface HeldSession {
+	sessionId: string;
+	epoch: number;
+	sessionFile: string;
+	cwd?: string;
 }
 
 export interface SchedulerOptions {
@@ -107,16 +153,27 @@ export interface SchedulerOptions {
 	hop?: number;
 	/** Live settings (re-read on every use so a config reload takes effect). */
 	getSettings?: () => SchedulerSettings;
+	/** A window: whether it should write next-runs.json this tick (no host is running to do it). */
+	writesNextRuns?: () => boolean;
 	/** Does pi still have this session? Plain jobs of deleted sessions are disabled (and `gc()` removes them). */
 	sessionExists?: (sessionId: string) => boolean;
-	/** "host" = the headless keeper of the clock; any interactive pi preempts it. Default "interactive". */
+	/** "host" = the always-on process: it also writes next-runs.json and sweeps dead sessions. Default "interactive". */
 	kind?: PresenceKind;
+	/**
+	 * Which jobs this scheduler dispatches. The host passes "loops only", a window "the plain jobs of
+	 * the conversation it holds". Omitted (tests), it owns every loop and the plain jobs `view` says run here.
+	 */
+	owns?: (job: LoopJob, view: OwnerView) => boolean;
 	/**
 	 * The process-wide sub-agent admission counter, shared with the trigger runtime and the /goal
 	 * evaluator (src/slots.ts). Omitted, the scheduler bounds only itself against
 	 * `maxConcurrentRuns` — which is the bug this exists to close, so production always passes one.
 	 */
 	slots?: SubagentSlots;
+	/** Omitted, the session of `getSession()` counts as held by this instance (tests, the host, which has none). */
+	leases?: PlainJobLeases;
+	/** The extension instance this scheduler runs for: the same id its session lease names. */
+	instance?: string;
 }
 
 export const DEAD_SESSION_MARKER = "no longer exists (/cron gc removes it)";
@@ -130,23 +187,12 @@ const DEAD_SESSION_SCAN_MS = 10 * 60_000;
  */
 const CWD_GRACE_MS = 30 * 60_000;
 
-interface LeaderRecord {
-	pid: number;
-	host: string;
-	/** Distinguishes scheduler instances inside one process (reload, tests). */
-	instance: string;
-	sessionId?: string;
-	kind?: PresenceKind;
-	startedAt: string;
-	heartbeatAt: string;
-}
-
 export class LoopScheduler {
 	readonly store: JobStore;
 	readonly inbox: Inbox;
+	/** The conversations' request queues: a plain job's prompt is a row here before its slot is spent. */
+	readonly requests: RequestStore;
 	private readonly dir: string;
-	private readonly leaderFile: string;
-	private readonly leaderLock: string;
 	private readonly getSession: () => SessionSnapshot;
 	private readonly hooks: SchedulerHooks;
 	private readonly tickMs: number;
@@ -154,6 +200,7 @@ export class LoopScheduler {
 	private readonly now: () => number;
 	private readonly hop: number;
 	private readonly getSettings: () => SchedulerSettings;
+	private readonly writesNextRuns?: () => boolean;
 	/** Every sub-agent this process starts takes a slot from here, loop runs and trigger checks alike. */
 	readonly slots: SubagentSlots;
 	private readonly sessionExists?: (sessionId: string) => boolean;
@@ -164,14 +211,15 @@ export class LoopScheduler {
 	private readonly nextRunsFile: string;
 	private timer: NodeJS.Timeout | undefined;
 	private ticking = false;
-	private leader = false;
 	private startedAt = 0;
-	private readonly inflight = new Map<string, { ctrl: AbortController; label: string; jobId: string; startedAt: string; promptPreview: string; sessionFile?: string }>();
+	private readonly inflight = new Map<string, { ctrl: AbortController; label: string; jobId: string; startedAt: string; promptPreview: string; sessionFile?: string; stoppedFrom?: "page" | "cli" }>();
 	/** Promises of runs in flight, so stop() can wait for their records to land. */
 	private readonly runs = new Set<Promise<void>>();
 	private stopped = false;
 	private tickPromise?: Promise<void>;
-	private readonly instance = newId("sched");
+	readonly instance: string;
+	private readonly leases?: PlainJobLeases;
+	private readonly owns: (job: LoopJob, view: OwnerView) => boolean;
 	/** This process in the machine-wide presence registry (which pi is open where). */
 	readonly presence: PresenceRegistry;
 	readonly self: PresenceSelf;
@@ -180,16 +228,11 @@ export class LoopScheduler {
 		this.dir = opts.dir;
 		this.store = new JobStore(opts.dir);
 		this.inbox = new Inbox(opts.dir);
-		// One leader at a time, for the machine: every process here elects through this one file. Two
-		// machines sharing a $HOME contend for it and both end up running every job, which is not
-		// supported (docs/design.md §19).
-		this.leaderFile = path.join(opts.dir, "scheduler.json");
-		// One plain file beside the leader record. A cron expression is matched against local time, so
-		// if two machines sharing a `$HOME` both ran, they would write different answers over one
-		// another and the panel would show whichever wrote last — which is why that arrangement is
-		// unsupported rather than handled (docs/design.md §19).
+		this.requests = new RequestStore(opts.dir);
+		// Written by the host alone. A cron expression is matched against local time, so if two
+		// machines sharing a `$HOME` both ran, they would write different answers over one another —
+		// which is why that arrangement is unsupported rather than handled (docs/design.md §19).
 		this.nextRunsFile = path.join(opts.dir, "next-runs.json");
-		this.leaderLock = path.join(opts.dir, "scheduler.lock");
 		this.getSession = opts.getSession;
 		this.hooks = opts.hooks ?? {};
 		this.tickMs = opts.tickMs ?? DEFAULT_TICK_MS;
@@ -197,23 +240,31 @@ export class LoopScheduler {
 		this.now = opts.now ?? Date.now;
 		this.hop = opts.hop ?? 0;
 		this.getSettings = opts.getSettings ?? (() => ({ maxConcurrentRuns: MAX_CONCURRENT_RUNS, catchUp: true }));
+		this.writesNextRuns = opts.writesNextRuns;
 		this.slots = opts.slots ?? new SubagentSlots(() => this.getSettings().maxConcurrentRuns);
+		this.instance = opts.instance ?? newId("sched");
+		this.leases = opts.leases;
+		this.owns = opts.owns ?? ((job, view) => runsHere(job, view));
 		this.sessionExists = opts.sessionExists;
 		this.kind = opts.kind ?? "interactive";
 		const session = opts.getSession();
-		this.self = { pid: process.pid, host: os.hostname(), instance: this.instance, sessionId: session.sessionId, cwd: session.cwd, kind: this.kind };
+		this.self = { pid: process.pid, host: os.hostname(), instance: this.instance, sessionId: session.sessionId, cwd: session.cwd, kind: this.kind, leases: true };
 		this.presence = new PresenceRegistry(opts.dir, this.self);
 	}
 
+	/** What this instance knows about who holds which session: the lists and dispatch ask it the same way. */
+	ownerView(session: SessionSnapshot = this.getSession()): OwnerView {
+		const sessionId = session.sessionId;
+		const leases = this.leases;
+		if (!leases) return { sessionId, holdsOwn: !!sessionId };
+		return { sessionId, holdsOwn: !!sessionId && leases.heldEpoch(sessionId) !== undefined, holderOf: (id) => leases.holderOf(id), standsAside: leases.standsAside?.(), holderKind: leases.holderKind ? (id) => leases.holderKind!(id) : undefined, hostRuns: leases.hostRuns ? (id) => leases.hostRuns!(id) : undefined, hostPaused: leases.hostPaused?.() };
+	}
+
 	/** Live pi processes on every host (stale entries pruned). */
 	presenceList(now = this.now()): PresenceEntry[] {
 		return this.presence.list(now);
 	}
 
-	get isLeader(): boolean {
-		return this.leader;
-	}
-
 	get runningCount(): number {
 		return this.inflight.size;
 	}
@@ -228,14 +279,26 @@ export class LoopScheduler {
 		return [...this.inflight.entries()].map(([runId, r]) => ({ runId, label: r.label, jobId: r.jobId, startedAt: r.startedAt, promptPreview: r.promptPreview, sessionFile: r.sessionFile }));
 	}
 
-	/** Abort one in-flight run (kills the sub-agent). */
-	abortRun(runId: string): boolean {
+	/** Abort one in-flight run (kills the sub-agent), as a person asked (STOPPED_BY_PERSON), from `from`. */
+	abortRun(runId: string, from: "page" | "cli" = "cli"): boolean {
 		const r = this.inflight.get(runId);
 		if (!r) return false;
-		r.ctrl.abort();
+		r.stoppedFrom ??= from;
+		r.ctrl.abort(STOPPED_BY_PERSON);
 		return true;
 	}
 
+	/** Where a person's stop of `runId` came from, while the run is still in flight. */
+	stopFrom(runId: string): "page" | "cli" | undefined {
+		return this.inflight.get(runId)?.stoppedFrom;
+	}
+
+	/** Where the stop on its way to `runId` came from, for a stop that arrives through a request row. */
+	noteStopFrom(runId: string, from: "page" | "cli"): void {
+		const r = this.inflight.get(runId);
+		if (r) r.stoppedFrom = from;
+	}
+
 	/**
 	 * Remove a job. A run of it that is in flight is aborted first and given up to
 	 * REMOVE_DRAIN_MS to write its record, so the removal does not race the run's end.
@@ -256,7 +319,7 @@ export class LoopScheduler {
 		return { job, aborted: runIds.length };
 	}
 
-	/** Idempotent. Starts the tick timer and takes leadership if free. */
+	/** Idempotent. Starts the tick timer. */
 	start(): void {
 		if (this.timer) return;
 		this.stopped = false;
@@ -270,93 +333,23 @@ export class LoopScheduler {
 		safeTick();
 	}
 
-	/** Idempotent. Stops the timer, releases leadership, aborts in-flight runs. */
+	/** Idempotent. Stops the timer and aborts in-flight runs. */
 	async stop(): Promise<void> {
 		this.stopped = true;
 		if (this.timer) {
 			clearInterval(this.timer);
 			this.timer = undefined;
 		}
-		await this.tickPromise; // a tick past its leadership claim must not launch after we leave
+		await this.tickPromise; // a tick already dispatching must not launch after we leave
 		for (const { ctrl } of this.inflight.values()) ctrl.abort();
 		// What is lost past this is the record, not the run: the sub-agent is already aborted, and
 		// waiting longer only delays the quit that asked for it.
 		const DRAIN_TIMEOUT_MS = 5_000;
 		await this.drain(DRAIN_TIMEOUT_MS);
-		await this.releaseLeadership();
-		this.presence.remove();
 	}
 
-	readLeader(): LeaderRecord | undefined {
-		try {
-			return JSON.parse(fs.readFileSync(this.leaderFile, "utf8")) as LeaderRecord;
-		} catch {
-			return undefined;
-		}
-	}
-
-	private isMine(rec: LeaderRecord | undefined): boolean {
-		return !!rec && rec.pid === process.pid && rec.host === os.hostname() && rec.instance === this.instance;
-	}
-
-	private leaderIsStale(rec: LeaderRecord | undefined, now: number): boolean {
-		if (!rec) return true;
-		if (this.isMine(rec)) return false;
-		// The headless host only keeps the clock while nobody is around: an interactive pi takes it
-		// back the moment it opens, and the host exits when it sees that (see host.ts).
-		if (this.kind === "interactive" && rec.kind === "host") return true;
-		const age = now - Date.parse(rec.heartbeatAt);
-		if (Number.isNaN(age) || age > LEADER_STALE_MS) return true;
-		// One machine: a pid that is not alive here is not alive. (A record from a renamed or rebuilt
-		// box used to be untouchable until its heartbeat aged out; now it is taken over like any other.)
-		if (!pidAlive(rec.pid)) return true;
-		return false;
-	}
-
-	private async claimOrRenewLeadership(now: number): Promise<boolean> {
-		return withFileLock(this.leaderLock, () => {
-			const rec = this.readLeader();
-			const mine = this.isMine(rec);
-			if (!mine && !this.leaderIsStale(rec, now)) {
-				this.leader = false;
-				return false;
-			}
-			const next: LeaderRecord = {
-				pid: process.pid,
-				host: os.hostname(),
-				instance: this.instance,
-				sessionId: this.getSession().sessionId,
-				kind: this.kind,
-				startedAt: mine && rec ? rec.startedAt : stamp(now),
-				heartbeatAt: stamp(now),
-			};
-			writeFileAtomic(this.leaderFile, `${JSON.stringify(next, null, 2)}\n`);
-			// Routine: which process holds the timer is bookkeeping, not something gone wrong.
-			if (!this.leader) this.log(`took over the loop scheduler (pid ${process.pid})`, "info");
-			this.leader = true;
-			return true;
-		});
-	}
-
-	private async releaseLeadership(): Promise<void> {
-		if (!this.leader) return;
-		this.leader = false;
-		try {
-			await this.hooks.onLeadership?.(false);
-		} catch (err: any) {
-			this.log(`leadership hook failed: ${err?.message ?? err}`);
-		}
-		try {
-			await withFileLock(this.leaderLock, () => {
-				if (this.isMine(this.readLeader())) fs.rmSync(this.leaderFile, { force: true });
-			});
-		} catch {
-			/* best effort */
-		}
-	}
-
-	private log(message: string, level?: "info" | "warning"): void {
-		this.hooks.log?.(message, level);
+	private log(message: string, level?: "info" | "warning", job?: Pick<LoopJob, "cwd">): void {
+		this.hooks.log?.(message, level, job);
 	}
 
 	/**
@@ -395,30 +388,12 @@ export class LoopScheduler {
 		this.tickPromise = new Promise<void>((r) => (finish = r));
 		try {
 			const now = this.now();
-			let leader = false;
-			const wasLeader = this.leader;
-			try {
-				leader = await this.claimOrRenewLeadership(now);
-			} catch (err: any) {
-				this.log(`leadership check failed: ${err?.message ?? err}`);
-			}
-			// A UI hook that throws must not escape the tick: `start()` runs it as `void this.tick()`
-			// and pi installs no unhandledRejection handler, so an unguarded throw here kills pi.
-			if (leader !== wasLeader) {
-				try {
-					await this.hooks.onLeadership?.(leader);
-				} catch (err: any) {
-					this.log(`leadership hook failed: ${err?.message ?? err}`);
-				}
-			}
+			const host = this.kind === "host";
 			const session = this.getSession();
 			try {
-				this.presence.heartbeat(now, { cwd: session.cwd, sessionId: session.sessionId });
-			} catch (err: any) {
-				this.log(`presence heartbeat failed: ${err?.message ?? err}`);
-			}
-			try {
-				await this.hooks.onTick?.(now, leader);
+				// A hook that throws must not escape the tick: `start()` runs it as `void this.tick()` and
+				// pi installs no unhandledRejection handler, so an unguarded throw here kills pi.
+				await this.hooks.onTick?.(now);
 			} catch (err: any) {
 				this.log(`tick hook failed: ${err?.message ?? err}`);
 			}
@@ -426,21 +401,40 @@ export class LoopScheduler {
 			try {
 				// `mutate` writes only when the list really changed, so a tick with nothing to clear
 				// costs one read and no write (store.ts).
+				let retired: LoopJob[] = [];
 				jobs = await this.store.mutate((all) => {
-					this.clearStaleRunning(all);
+					retired = this.clearStaleRunning(all);
 					return { jobs: all, result: all };
 				});
+				for (const job of retired) {
+					try {
+						this.hooks.onJobRetired?.(job, "one-shot finished before its process ended");
+					} catch (err: any) {
+						this.log(`onJobRetired hook failed: ${err?.message ?? err}`);
+					}
+				}
 			} catch (err: any) {
 				this.log(`cannot read jobs: ${err?.message ?? err}`);
 				return;
 			}
+			// A job removed in another process (a window, the CLI) takes its run here with it, as
+			// `removeJob` does in this one: the run used to go on to its deadline, spending as it went.
+			const present = new Set(jobs.map((j) => j.id));
+			for (const [runId, r] of this.inflight) {
+				if (present.has(r.jobId) || r.ctrl.signal.aborted) continue;
+				r.ctrl.abort();
+				this.log(`cron ${r.label}: removed while it ran; stopped run ${runId}`);
+			}
 			// What the store cannot say and every reader wants: when each job runs next. It is a pure
 			// function of the job, but computing it needs the cron evaluator — which the browser
-			// front end does not have and should not grow a second copy of. The leader writes the
+			// front end does not have and should not grow a second copy of. The host writes the
 			// answers where that front end already reads pi-loops' own files, and only when one of
 			// them changes, which for a nightly job is once a day.
-			if (leader) this.writeNextRuns(jobs, now);
-			if (leader && this.sessionExists && now - this.lastDeadSessionScan >= DEAD_SESSION_SCAN_MS) {
+			// The host writes it; with no host running a window does, or the browser front end of a person
+			// with only plain jobs (who never starts a host) showed no next run at all. Every writer
+			// computes the same function of the same store, so two windows writing it agree.
+			if (host || this.writesNextRuns?.()) this.writeNextRuns(jobs, now);
+			if (host && this.sessionExists && now - this.lastDeadSessionScan >= DEAD_SESSION_SCAN_MS) {
 				this.lastDeadSessionScan = now;
 				try {
 					await this.disableDeadSessionJobs(jobs);
@@ -448,10 +442,23 @@ export class LoopScheduler {
 					this.log(`dead-session check failed: ${err?.message ?? err}`);
 				}
 			}
+			const view = this.ownerView(session);
 			for (const job of jobs) {
+				if (!this.owns(job, view)) continue;
+				// A fired one-shot stays until its row is done (its prompt is in the conversation, or the row
+				// died): removed at fire, a quit before the hand-over deleted it unfired.
+				if (this.plainOneShotDone(job)) {
+					await this.store.remove(job.id);
+					try {
+						this.hooks.onJobRetired?.(job, "one-shot fired");
+					} catch (err: any) {
+						this.log(`onJobRetired hook failed: ${err?.message ?? err}`);
+					}
+					continue;
+				}
+				// A disabled job's queued rows wait: its prompt runs when the job is enabled again, which
+				// is what a person who disabled it expects. A removed job's rows the engine removes.
 				if (!job.enabled) continue;
-				const owned = job.stateful ? leader : runsIn(job, session.sessionId);
-				if (!owned) continue;
 				// One unusable job must never stop the clock for the others: a schedule that cannot be
 				// evaluated disables that job and says why, instead of throwing out of the tick (pi
 				// installs no unhandledRejection handler, so that would take the whole session down).
@@ -466,11 +473,12 @@ export class LoopScheduler {
 						},
 						now,
 					);
-					if (due === undefined) continue;
+					// Nothing due, but a row a window left behind when it quit is the host's to run (launchHeld).
+					if (due === undefined && !(host && !job.stateful && this.heldTurnRow(job))) continue;
 					await this.dispatch(job, due, now, session);
 				} catch (err: any) {
 					const message = `disabled: ${err?.message ?? err} (${formatSchedule(job.schedule)})`;
-					this.log(`loop ${job.id}: ${message}`);
+					this.log(`loop ${job.id}: ${message}`, undefined, job);
 					await this.store.update(job.id, (j) => {
 						j.enabled = false;
 						j.lastError = message;
@@ -496,9 +504,9 @@ export class LoopScheduler {
 		for (const job of dead) {
 			await this.store.update(job.id, (j) => {
 				j.enabled = false;
-				j.lastError = `disabled: session ${job.sessionId!.slice(0, 8)} ${DEAD_SESSION_MARKER}`;
+				j.lastError = `disabled: session ${shortSessionId(job.sessionId!)} ${DEAD_SESSION_MARKER}`;
 			});
-			this.log(`cron ${job.name ?? job.id}: disabled, its session ${job.sessionId!.slice(0, 8)} no longer exists`);
+			this.log(`cron ${job.name ?? job.id}: disabled, its session ${shortSessionId(job.sessionId!)} no longer exists`, undefined, job);
 		}
 	}
 
@@ -539,39 +547,86 @@ export class LoopScheduler {
 		return this.store.removeWhere((j) => inScope(j) && !j.enabled && !!j.lastError?.endsWith(DEAD_SESSION_MARKER), { purge: true });
 	}
 
-	/** Clear running markers left behind by processes that are gone. Mutates `jobs` in place. */
-	private clearStaleRunning(jobs: LoopJob[]): void {
+	/**
+	 * Clear running markers left behind by processes that are gone. Mutates `jobs` in place and
+	 * returns the one-shots it retired, for the caller to report once the store is written.
+	 *
+	 * A dead marker is looked up in the run log first. A run whose record is there finished, and only
+	 * its last write to the store was lost (the process died between `appendRun` and the update after
+	 * it): its slot is spent, so the bookkeeping is finished from the record instead of rolling back
+	 * and running it a second time. Only a run with no record is owed again.
+	 */
+	private clearStaleRunning(jobs: LoopJob[]): LoopJob[] {
 		// The wall clock, not `this.now()`: `os.uptime()` is measured against it, so the boot instant
-		// is only meaningful in the same terms — and so is the `recycled` comparison against it below,
-		// which is why a test cannot move that one. The foreign-host age check does go through
-		// `this.now()`: it compares a stamp against our own notion of now, with no machine fact in it.
+		// is only meaningful in the same terms — which is why a test cannot move this comparison.
 		const booted = Date.now() - os.uptime() * 1000;
+		let records: Map<string, RunRecord> | undefined;
+		const recordOf = (runId: string): RunRecord | undefined => {
+			records ??= new Map(this.store.allRuns().map((r) => [r.runId, r]));
+			return records.get(runId);
+		};
+		const retired: LoopJob[] = [];
+		const dead = (job: LoopJob): boolean => {
+			const { pid, runId, startedAt } = job.running!;
+			// A pid is only evidence while it can still be the same process: after a reboot the
+			// numbers are handed out again, and a recycled pid would park the job forever.
+			const recycled = Number.isFinite(booted) && Date.parse(startedAt) < booted - 60_000;
+			return !(pid === process.pid ? this.inflight.has(runId) : !recycled && pidAlive(pid));
+		};
+		// How many runs each dead process took with it. One that died with a single run in flight
+		// points at that run; one that died with several says nothing about any of them, and counting
+		// each would park every loop that happened to run beside the one that took it down.
+		const diedWith = new Map<number, number>();
+		for (const job of jobs) if (job.running && dead(job) && !recordOf(job.running.runId)) diedWith.set(job.running.pid, (diedWith.get(job.running.pid) ?? 0) + 1);
 		for (const job of jobs) {
 			if (!job.running) continue;
 			const { pid, runId, startedAt } = job.running;
-			// Another machine's pid table says nothing about this run (shared $HOME); leave it to the
-			// host that owns it, and fall back to a generous age check so it cannot stick forever.
-			if (job.running.host && job.running.host !== this.self.host) {
-				if (Date.parse(startedAt) > this.now() - FOREIGN_RUN_STALE_MS) continue;
-			} else {
-				const isMine = pid === process.pid;
-				// A pid is only evidence while it can still be the same process: after a reboot the
-				// numbers are handed out again, and a recycled pid would park the job forever.
-				const recycled = Number.isFinite(booted) && Date.parse(startedAt) < booted - 60_000;
-				const alive = isMine ? this.inflight.has(runId) : !recycled && pidAlive(pid);
-				if (alive) continue;
+			if (!dead(job)) continue;
+			job.running = undefined;
+			const record = recordOf(runId);
+			if (record) {
+				job.lastCompletedAt = record.finishedAt;
+				job.lastError = record.ok ? undefined : record.error;
+				job.runCount++;
+				job.consecutiveFailures = record.ok ? undefined : (job.consecutiveFailures ?? 0) + 1;
+				job.interruptions = undefined;
+				if (job.schedule.kind === "once" && (record.ok || job.runCount >= 2)) retired.push(job);
+				continue;
 			}
 			// The run that died is owed again: roll the bookkeeping back so the next tick re-fires it
-			// (collapsed like any other missed tick) instead of silently skipping to the next slot.
-			job.running = undefined;
-			job.lastDueAt = undefined;
-			job.lastFiredAt = undefined;
+			// (collapsed like any other missed tick) instead of silently skipping to the next slot. It
+			// was tried, so a process that starts after its due time must not call it missed. A run of a
+			// row that is still queued (a held turn of what a window left, launchHeld) rolls nothing
+			// back: the row is what runs again, and the stamps the window moved stand.
+			if (!(job.sessionId && this.requests.list(job.sessionId).some((row) => row.id === runId))) {
+				job.owedSlot = job.lastDueAt ?? startedAt;
+				job.lastDueAt = undefined;
+				job.lastFiredAt = undefined;
+			}
+			if ((diedWith.get(pid) ?? 0) > 1) {
+				job.lastError = "cleared stale running state (the process ended mid-run, with other runs beside this one); the run will be retried";
+				continue;
+			}
+			job.interruptions = (job.interruptions ?? 0) + 1;
+			if (job.interruptions >= INTERRUPTIONS_BEFORE_PARKING) {
+				// Parked rather than retried on every start: each time, it was the only loop run in flight
+				// when the process stopped (a rule check may have been running beside it). Still not proof (a reboot mid-run counts too), so the reason says what
+				// is known, and enabling it again tries once more.
+				job.enabled = false;
+				job.owedSlot = undefined;
+				job.lastError = `parked: its last ${job.interruptions} runs were interrupted before they finished (the process running them stopped each time, with no other loop running; see host.log) — /cron enable ${job.id} to try again`;
+				this.log(`cron ${job.name ?? job.id}: parked after ${job.interruptions} interrupted runs`, undefined, job);
+				continue;
+			}
 			job.lastError = "cleared stale running state (previous pi process ended mid-run); the run will be retried";
 		}
+		for (const job of retired) jobs.splice(jobs.indexOf(job), 1);
+		return retired;
 	}
 
-	private async dispatch(job: LoopJob, due: number, now: number, session: SessionSnapshot): Promise<void> {
-		const dueIso = stamp(due);
+	/** `due` is the slot the schedule owes; absent, the host runs a queued row of the job and spends no slot. */
+	private async dispatch(job: LoopJob, due: number | undefined, now: number, session: SessionSnapshot): Promise<void> {
+		const dueIso = due === undefined ? undefined : stamp(due);
 		if (job.stateful && !fs.existsSync(job.cwd)) {
 			/**
 			 * The checkout is not there. That is usually a deleted worktree or a moved project — but
@@ -592,13 +647,13 @@ export class LoopScheduler {
 				j.cwdMissingSince = stamp(since);
 				if (gone) {
 					j.enabled = false;
-					j.lastDueAt = dueIso;
+					if (dueIso) j.lastDueAt = dueIso;
 					j.lastError = `disabled: cwd ${job.cwd} has been missing since ${formatLocal(since)} (re-enable after /cron add --cwd or restoring it)`;
 				} else {
 					j.lastError = `waiting: cwd ${job.cwd} is not there yet (since ${formatLocal(since)}; disabled if it stays missing)`;
 				}
 			});
-			if (gone) this.log(`cron ${job.name ?? job.id}: disabled, cwd ${job.cwd} missing since ${formatLocal(since)}`);
+			if (gone) this.log(`cron ${job.name ?? job.id}: disabled, cwd ${job.cwd} missing since ${formatLocal(since)}`, undefined, job);
 			return;
 		}
 		// Back, and the run that was owed is about to happen: the marker must not outlive the outage.
@@ -609,21 +664,27 @@ export class LoopScheduler {
 			});
 		}
 		if (job.running) {
+			// A plain job's marker is the host's turn in its conversation: that turn either completes the
+			// slot or hands it back owed, so there is nothing to skip — wait for it.
+			if (!job.stateful) return;
 			await this.store.update(job.id, (j) => {
 				j.skippedOverlap++;
-				j.lastDueAt = dueIso;
+				if (dueIso) j.lastDueAt = dueIso;
 				j.lastError = "skipped: previous run still active";
 			});
 			return;
 		}
-		const missedWhileDown = due < this.startedAt - this.tickMs;
-		if (missedWhileDown && !(job.catchUp && this.getSettings().catchUp)) {
+		// A slot handed back unrun was tried, not missed: it runs now whatever the catch-up setting says.
+		const owed = due !== undefined && !!job.owedSlot && Date.parse(job.owedSlot) <= due;
+		const missedDue = due !== undefined && !owed && due < this.startedAt - this.tickMs ? due : undefined;
+		if (missedDue !== undefined && !(job.catchUp && this.getSettings().catchUp)) {
 			await this.store.update(job.id, (j) => {
-				j.lastDueAt = dueIso;
-				j.lastError = `missed ${formatLocal(due)} while no pi was running (catch-up disabled)`;
+				if (dueIso) j.lastDueAt = dueIso;
+				j.lastError = `missed ${formatLocal(missedDue)} while ${this.kind === "host" ? "pi-loops was not running" : "no pi was running"} (catch-up disabled)`;
 			});
 			return;
 		}
+		const note = missedDue !== undefined ? `\n(catching up a run due ${formatLocal(missedDue)})` : "";
 		const budget = this.budgetState(now);
 		if (budget.over) {
 			// Plain jobs are gated too: injecting one makes the parent agent take a turn, which is
@@ -638,8 +699,8 @@ export class LoopScheduler {
 			}
 			return;
 		}
-		if (!job.stateful) {
-			await this.injectPlainJob(job, dueIso, now, missedWhileDown ? `\n(catching up a run due ${formatLocal(due)})` : "");
+		if (!job.stateful && this.kind !== "host") {
+			await this.injectPlainJob(job, dueIso, now, note);
 			return;
 		}
 		// A failing job is retried with a widening gap instead of at every due tick: a loop whose
@@ -666,51 +727,310 @@ export class LoopScheduler {
 			slot.release();
 			return;
 		}
-		if (missedWhileDown) this.hooks.onCatchUp?.(job, due);
-		// Never await a run inside a tick: heartbeats, leadership, presence and trigger checks keep
+		if (missedDue !== undefined) this.hooks.onCatchUp?.(job, missedDue);
+		// Never await a run inside a tick: leases, presence and trigger checks keep
 		// going while sub-agents work, and several loops really do run at once.
-		this.track(this.launch(job, dueIso, now, session, missedWhileDown), slot);
+		if (!job.stateful) {
+			this.track(this.launchHeld(job, dueIso, now, note), slot);
+			return;
+		}
+		this.track(this.launch(job, dueIso, now, session, missedDue !== undefined), slot);
+	}
+
+	/** Who wrote a row: this process, as `created_by` names it. */
+	private createdBy(): SessionRequest["created_by"] {
+		return { pid: process.pid, instance: this.instance, version: PI_LOOPS_VERSION };
+	}
+
+	/** The job's queued `turn` row, when one is: the prompt waiting to run in its conversation. */
+	private queuedTurnRow(job: LoopJob): SessionRequest | undefined {
+		if (!job.sessionId) return undefined;
+		const key = plainCollapseKey(job.id);
+		return this.requests.list(job.sessionId).find((row) => row.kind === "input" && row.wake === "turn" && row.collapse_key === key);
+	}
+
+	/**
+	 * The job's queued row the background may run as a held turn: not an attended one (`/cron run`,
+	 * typed in the conversation), which waits for a window and is no reason for the clock's slots to.
+	 */
+	private heldTurnRow(job: LoopJob): SessionRequest | undefined {
+		const row = this.queuedTurnRow(job);
+		return row?.mode === "attended" ? undefined : row;
+	}
+
+	/**
+	 * A fired plain one-shot whose row is done: its prompt is in the conversation, or the row died.
+	 * A failed held turn is not done; it keeps the retry `launchHeld` gives a one-shot.
+	 */
+	private plainOneShotDone(job: LoopJob): boolean {
+		if (job.stateful || job.schedule.kind !== "once" || job.running || job.runCount < 1 || job.consecutiveFailures) return false;
+		return this.queuedTurnRow(job) === undefined;
 	}
 
 	/**
-	 * A plain job firing: the bookkeeping, the injection, and the retirement of a one-shot. Both the
-	 * timer (`dispatch`) and `/cron run` come through here — they were two copies, and the second one
-	 * had drifted: no `once` retirement, no `lastDueAt` / `lastCompletedAt`, `lastError` never cleared.
+	 * A plain job firing in a window: its prompt is a row in the conversation's requests first, then
+	 * the slot is spent. Both the timer (`dispatch`) and `/cron run` come through here. The engine
+	 * hands the row to pi once pi is idle (src/engine.ts, src/window-executor.ts); a one-shot is
+	 * retired when the row is done (plainOneShotDone), not here.
+	 *
+	 * The row's id is derived from the slot (plainRunId), so a crash between the row and the stamps
+	 * leaves a queued row and an unspent slot: the next tick decides the same slot, its append is a
+	 * no-op, and the swap commits. While an earlier row of the job is still queued the slot is spent
+	 * without a new row and counted in `skippedOverlap`: collapse, never replay.
 	 *
 	 * `dueIso` is the slot being spent, absent when the run was asked for rather than scheduled;
-	 * `note` is appended to the injected text (the catch-up line). Returns whether the job was
-	 * actually injected, so `/cron run` does not report a run that never happened.
+	 * `note` is appended to the prompt (the catch-up line). Returns what became of the slot, so
+	 * `/cron run` does not report a run that never happened.
 	 */
-	private async injectPlainJob(job: LoopJob, dueIso: string | undefined, now: number, note = ""): Promise<boolean> {
-		// A plain job's whole point is to land in a chat, and the headless host has none. The
-		// ownership test in `dispatch` already excludes these (the host's snapshot has no sessionId), so
-		// this is belt and braces: the bookkeeping below commits before `onInject` runs, and a
-		// host that ever gained a session id would otherwise record an undelivered job as a
-		// completed run and delete a one-shot unfired.
-		if (this.kind === "host") return false;
+	private async injectPlainJob(job: LoopJob, dueIso: string | undefined, now: number, note = "", source: "cron" | "cron-run" = "cron"): Promise<"fired" | "collapsed" | "lost"> {
+		// A plain job's whole point is to land in a chat, and the headless host has none: a closed
+		// conversation's plain job is a held turn (launchHeld).
+		if (this.kind === "host") return "lost";
+		const sessionId = job.sessionId;
+		if (!sessionId) return "lost";
+		// The epoch the lease had when this instance decided the job was its own. Read again inside
+		// the claim: a lease that moved since (this window closed its session, another took it) means
+		// the slot is no longer ours to fire.
+		const epoch = this.leases?.heldEpoch(sessionId);
+		if (this.leases && epoch === undefined) return "lost";
+		const runId = plainRunId(job.id, dueIso ?? stamp(now));
+		const queued = this.queuedTurnRow(job);
+		// A row pi did not take (`attempts` counts its refusals) is not what a new slot collapses onto:
+		// that slot is lost, as 0.22.8 lost a slot pi refused, and the new one asks in its place.
+		// A `/cron run` row is the person's: a slot collapses onto it, refused or not, so it keeps running as theirs.
+		const refused = queued !== undefined && queued.id !== runId && queued.attempts > 0 && queued.source.startsWith("cron:");
+		const collapsed = !!queued && !refused && queued.id !== runId;
+		// `/cron run` while the prompt is already queued asks for nothing new: no slot, no stamp.
+		if (collapsed && source === "cron-run") return "collapsed";
+		// The row before the stamps: a crash between the two costs nothing, where the reverse order
+		// spent the slot with nothing to show for it.
+		const row = plainJobRow(job, runId, `${source}:${job.id}`, note, this.createdBy(), now);
+		let wrote = false;
+		if (!collapsed) {
+			if (refused) this.requests.remove(sessionId, [queued.id]);
+			wrote = this.requests.appendIfAbsent(row);
+			// Said before anything awaits: a drain that hands the row over meanwhile must already know
+			// this window wrote it, or a person's `/cron run` would start as a scheduled turn.
+			if (wrote) this.hooks.onRowWritten?.(row, job);
+		}
+		let claimed = false;
 		await this.store.update(job.id, (j) => {
+			// The slot was decided from a snapshot, as in `launch`: if another instance fired or skipped
+			// this job since, its stamps moved, and firing again would put the message in the chat twice.
+			if (j.lastDueAt !== job.lastDueAt || j.lastFiredAt !== job.lastFiredAt) return;
+			if (this.leases && (!j.sessionId || this.leases.heldEpoch(j.sessionId) !== epoch)) return;
+			claimed = true;
 			if (dueIso) j.lastDueAt = dueIso;
 			j.lastFiredAt = stamp(now);
+			// The count is the record of a collapse; an error here outlived the prompt it was about.
+			if (collapsed) {
+				j.skippedOverlap++;
+				return;
+			}
 			j.lastCompletedAt = j.lastFiredAt;
+			j.owedSlot = undefined;
 			// Only an enabled job's error is stale news. A disabled one's is why it is disabled — and
 			// for a job the dead-session sweep parked it is the marker `gc()` matches on.
 			if (j.enabled) j.lastError = undefined;
 			j.runCount++;
 		});
-		// Inject-and-run: the job's action lands in the parent chat as a user message with
-		// the engine-enforced `[Trigger <run id>] ` prefix. The id is handed over as well: it is minted
-		// here, and the caller used to read it back out of the string this just formatted.
-		const runId = newId("run");
-		await this.hooks.onInject?.(job, `[Trigger ${runId}] ${job.prompt}${note}`, runId);
-		if (job.schedule.kind === "once") {
-			await this.store.remove(job.id);
+		if (!claimed) {
+			// Another process fired this slot first (a pi-loops 0.22 window on the same conversation during
+			// an upgrade): the row this call wrote would run the slot a second time. Only that row goes.
+			if (wrote) this.requests.remove(sessionId, [runId]);
+			return "lost";
+		}
+		// Its next run moved: written now, so the browser panel does not show a blank one until the
+		// next tick of whichever process writes it. Every writer computes the same answer.
+		try {
+			this.writeNextRuns(this.store.load(), now);
+		} catch {
+			/* a derived file is a courtesy (see writeNextRuns); the tick writes it too */
+		}
+		return collapsed ? "collapsed" : "fired";
+	}
+
+	/**
+	 * The host firing a plain job of a closed conversation: take the conversation, claim the slot
+	 * against the stamps and the lease's epoch, run the turn in it, give the conversation back. A
+	 * window that opens the conversation meanwhile takes it at once; the turn stops at its next event
+	 * and the slot is handed back, so the window fires it instead — a slot runs to completion once.
+	 *
+	 * A row a window wrote and never handed over (it quit first) runs before any slot of the host's
+	 * own, with the row's id as the run id, and leaves the queue once its prompt is in the file. A slot
+	 * due meanwhile is spent onto that row (collapse, as the window does), never run after it. A turn
+	 * handed back unrun whose prompt did land is not owed: a successor row asks again, once, in
+	 * whichever process holds the conversation next. An attended row (`/cron run`) is a window's to
+	 * run and is left where it is; the clock's slots run as if it were not there. A row in backoff
+	 * waits, and so does the slot behind it.
+	 */
+	private async launchHeld(job: LoopJob, dueIso: string | undefined, now: number, note: string): Promise<void> {
+		const leases = this.leases;
+		const sessionId = job.sessionId;
+		if (!sessionId || !leases?.acquireForWork || !this.hooks.onHeldTurn) return;
+		const row = this.heldTurnRow(job);
+		if (!row && dueIso === undefined) return;
+		if (row && (row.attempts >= DEAD_AFTER_ATTEMPTS || (row.not_before !== undefined && Date.parse(row.not_before) > now))) return;
+		const runId = row?.id ?? newId("run");
+		const spendsSlot = dueIso !== undefined;
+		// The slot due is not the row's own: spent onto it, and counted as the overlap it is.
+		const collapsedSlot = spendsSlot && !!row && row.id !== plainRunId(job.id, dueIso);
+		const held = leases.acquireForWork(sessionId, runId, job.id);
+		if (!held) return; // the slot stays owed: the conversation is busy, open or recently written
+		try {
+			// A process before this one ran the row and died before removing it: the prompt is in the
+			// conversation, so the row is done, and running it again would answer it twice.
+			if (row && sessionFileHas(held.sessionFile, row.id)) {
+				this.requests.remove(sessionId, [row.id]);
+				await this.store.update(job.id, (j) => {
+					if (j.running?.runId === row.id) j.running = undefined;
+				});
+				return;
+			}
+			const startedAt = stamp(now);
+			let claimed = false;
+			await this.store.update(job.id, (j) => {
+				if (j.running) return;
+				if (j.lastDueAt !== job.lastDueAt || j.lastFiredAt !== job.lastFiredAt) return;
+				if (leases.heldEpoch(sessionId) !== held.epoch) return;
+				claimed = true;
+				// Written before the turn starts, as a loop's marker is: a host that dies mid-turn leaves
+				// it behind, and the next host finds an unfinished run instead of a slot spent in silence.
+				j.running = { runId, pid: process.pid, host: this.self.host, startedAt };
+				if (!spendsSlot) return;
+				j.lastDueAt = dueIso;
+				j.lastFiredAt = startedAt;
+				j.owedSlot = undefined;
+				if (collapsedSlot) j.skippedOverlap++;
+			});
+			if (!claimed) return;
+			const ctrl = new AbortController();
+			this.inflight.set(runId, { ctrl, label: job.name ?? job.id, jobId: job.id, startedAt, promptPreview: previewRedacted(job.prompt, 120) });
+			let outcome: { preempted: boolean; result: RunnerResult; landed?: boolean };
 			try {
-				this.hooks.onJobRetired?.(job, "one-shot fired");
+				outcome = await this.hooks.onHeldTurn(job, row?.payload?.text ?? `[Trigger ${runId}] ${job.prompt}${note}`, runId, held, ctrl.signal);
+			} catch (err: any) {
+				outcome = { preempted: false, result: failedRun(err?.message ?? String(err)) };
+			}
+			const { result } = outcome;
+			const landed = outcome.landed ?? result.ok;
+			// Handed back unrun: a window took the conversation (and runs it now), or this host stopped
+			// the turn itself — a quit, an upgrade, a preemption, the daily budget (a person's stop is done, above). The slot is owed
+			// only when the prompt never landed; landed, the successor row below is the owed slot.
+			const budgetStopped = !result.ok && (result.errorMessage ?? "").startsWith("stopped by today's");
+			// A person stopped this turn: it is done, whatever landed. Asking the prompt again would run
+			// what they just stopped.
+			const stopped = !result.ok && ctrl.signal.aborted && ctrl.signal.reason === STOPPED_BY_PERSON;
+			const handedBack = !result.ok && !stopped && (outcome.preempted || ctrl.signal.aborted || budgetStopped);
+			const record: RunRecord = {
+				runId,
+				jobId: job.id,
+				jobName: job.name,
+				stateful: false,
+				cwd: held.cwd ?? job.cwd,
+				pid: process.pid,
+				startedAt,
+				finishedAt: stamp(this.now()),
+				ok: result.ok,
+				exitCode: result.exitCode,
+				error: result.ok ? undefined : stopped ? STOPPED_BY_PERSON : redact(result.errorMessage ?? "unknown error"),
+				findings: 0,
+				droppedFindings: 0,
+				stateUpdated: false,
+				model: result.model ?? job.model,
+				usage: result.usage,
+				warning: result.warning,
+				retries: result.retries,
+				compactions: result.compactions,
+				summary: previewRedacted(result.text, 400) || undefined,
+				sessionId,
+				sessionFile: held.sessionFile,
+				forSession: job.createdBy?.sessionId ?? sessionId,
+				...(stopped || handedBack ? { aborted: true as const } : {}),
+				...(stopped ? { stoppedBy: "person" as const, stoppedFrom: this.inflight.get(runId)?.stoppedFrom ?? "cli" } : {}),
+			};
+			// Every turn is recorded, a stopped one too: it was billed, and the daily budget, `/cron runs`
+			// and the status page all read the run log.
+			try {
+				this.store.appendRun(record);
+			} catch (err: any) {
+				this.log(`run log append failed: ${err?.message ?? err}`);
+			}
+			let updated: LoopJob | undefined;
+			try {
+				updated = await this.store.update(job.id, (j) => {
+					if (j.running?.runId === runId) j.running = undefined;
+					if (handedBack) {
+						// Given back with a compare: only while the stamps are still the ones this claim wrote.
+						if (!spendsSlot || j.lastFiredAt !== startedAt) return;
+						// Landed, the slot is spent (the successor row asks for its answer); unlanded, it is owed.
+						if (landed) {
+							if (!collapsedSlot) j.runCount++;
+							return;
+						}
+						j.lastDueAt = job.lastDueAt;
+						j.lastFiredAt = job.lastFiredAt;
+						j.owedSlot = dueIso;
+						return;
+					}
+					j.lastCompletedAt = record.finishedAt;
+					// A window's row counted its slot when the row was written; a slot collapsed onto it is an overlap.
+					// A person's stop is not a run and not a failure, as for a loop's run: the count and the
+					// last error stay what they were.
+					if (spendsSlot && !collapsedSlot && !stopped) j.runCount++;
+					// Only an enabled job's error is stale news: a disabled one's says why it is disabled.
+					if (!stopped && (j.enabled || !result.ok)) j.lastError = record.error;
+					// A stop is not a failure of the job's: the streak stays what it was.
+					if (!stopped) j.consecutiveFailures = result.ok ? undefined : (j.consecutiveFailures ?? 0) + 1;
+					j.interruptions = undefined;
+					// A one-shot that failed gets one retry, as a one-shot loop does: its stamps go back so
+					// it is due again, and the second failure retires it (below). A stopped one does not.
+					if (job.schedule.kind === "once" && !result.ok && !stopped && (j.consecutiveFailures ?? 0) < 2) {
+						j.lastDueAt = undefined;
+						j.lastFiredAt = undefined;
+						j.lastError = `${record.error ?? "run failed"} (one-shot: retrying once)`;
+					}
+				});
+			} catch (err: any) {
+				this.log(`cron ${job.id}: could not write the store after its turn (${err?.message ?? err})`, undefined, job);
+			}
+			this.inflight.delete(runId);
+			try {
+				if (landed || stopped) {
+					// The prompt is in the conversation, or a person stopped the turn: the row is done.
+					// Handed back with the prompt there, the answer was cut off, so a successor row asks
+					// again, once.
+					if (row) this.requests.remove(sessionId, [row.id]);
+					if (handedBack) this.requests.append(plainJobRow(job, newId("run"), `cron:${job.id}`, "", this.createdBy(), this.now()));
+				} else if (row && !handedBack) {
+					// The row's turn failed before its prompt was written: an attempt, as a failed hand-over
+					// in a window is, with the engine's backoff; at the third the engine's drain buries it.
+					const attempts = row.attempts + 1;
+					this.requests.update(sessionId, row.id, { attempts, last_error: record.error, not_before: stamp(this.now() + backoffFor(attempts)) });
+				}
 			} catch (err: any) {
-				this.log(`onJobRetired hook failed: ${err?.message ?? err}`);
+				this.log(`cron ${job.id}: could not update its requests after its turn (${err?.message ?? err})`, undefined, job);
 			}
+			if (handedBack) {
+				this.log(`cron ${job.name ?? job.id}: ${outcome.preempted ? `a window opened session ${shortSessionId(sessionId)} during its turn; that window runs it` : `turn stopped (${record.error}); ${landed ? "a fresh prompt is queued for it" : "the slot is owed"}`}`, "info");
+				return;
+			}
+			if (stopped) this.log(`cron ${job.name ?? job.id}: turn stopped; it is done`, "info");
+			if (updated && !result.ok && !stopped && (updated.consecutiveFailures ?? 0) >= FAILURE_BACKOFF_AFTER) {
+				this.hooks.onSchedulerError?.(`${updated.name ?? updated.id} has failed ${updated.consecutiveFailures} times in a row; backing off (last: ${record.error ?? "unknown"})`, updated);
+			}
+			// A one-shot is retired once it ran, was stopped, or failed twice (the retry above was its second chance).
+			if (updated && job.schedule.kind === "once" && (result.ok || stopped || (updated.consecutiveFailures ?? 0) >= 2)) {
+				await this.store.remove(job.id);
+				try {
+					this.hooks.onJobRetired?.(job, result.ok ? "one-shot fired" : stopped ? "one-shot stopped" : `one-shot failed twice (${record.error})`);
+				} catch (err: any) {
+					this.log(`onJobRetired hook failed: ${err?.message ?? err}`);
+				}
+			}
+		} finally {
+			leases.releaseWork?.(sessionId, held.epoch);
 		}
-		return true;
 	}
 
 	private track(run: Promise<void>, slot: SubagentSlot): void {
@@ -741,9 +1061,10 @@ export class LoopScheduler {
 	/**
 	 * Fire a job now, ignoring its schedule. Returns `true`, or the reason it did not run — phrased
 	 * to follow the job's name, which is the shape `/cron run` has always reported a refusal in
-	 * ("nightly is already running").
+	 * ("nightly is already running"). `requestedBy` is the conversation a person asked from; a loop's
+	 * record carries it, so the run's card goes there (src/run-card.ts).
 	 */
-	async runNow(jobId: string): Promise<true | string> {
+	async runNow(jobId: string, requestedBy?: RunRequester): Promise<true | string> {
 		const job = this.store.load().find((j) => j.id === jobId);
 		if (!job) return "is no longer in the store";
 		if (job.running) return "is already running";
@@ -757,18 +1078,24 @@ export class LoopScheduler {
 			if (!job.enabled) return "is disabled (/cron enable it first)";
 			// The same reasoning for a job that is enabled but belongs to another session: its prompt is
 			// written for that conversation, and running it here would land it in this one.
-			if (!runsIn(job, this.getSession().sessionId)) return `belongs to session ${ownerSession(job)}, which is not open here — resume it, or /cron add the job again in this chat`;
+			const where = whereRuns(job, this.ownerView());
+			if (where.kind === "aside") return `belongs to this conversation, but this window shows an older copy of it — /resume this session to run it`;
+			if (where.kind === "terminal") return `belongs to session ${ownerSession(job)}, which is ${openWhere(where.page ? "page" : "terminal")} — run it there`;
+			if (where.kind === "host") return `belongs to session ${ownerSession(job)}, which is closed: it runs in the background when due — resume that session to run it now`;
+			if (where.kind !== "here") return `belongs to session ${ownerSession(job)}, which is not open here — resume it, or /cron add the job again in this chat`;
 			// No `dueIso`: this run was asked for, so whatever slot the schedule owes is still owed.
-			if (!(await this.injectPlainJob(job, undefined, now))) return "has no chat to run in (the background host has no session)";
+			const fired = await this.injectPlainJob(job, undefined, now, "", "cron-run");
+			if (fired === "collapsed") return "already has its prompt queued in this conversation";
+			if (fired === "lost") return this.kind === "host" ? "has no chat to run in (pi-loops in the background has no session)" : "was fired by another window at the same moment";
 			return true;
 		}
 		// `/cron run` is a direct instruction, so a busy machine does not get to refuse it — but it
 		// still occupies a slot, so the shared count stays honest even when that overruns the limit.
-		this.track(this.launch(job, undefined, now, this.getSession(), false), this.slots.occupy());
+		this.track(this.launch(job, undefined, now, this.getSession(), false, requestedBy), this.slots.occupy());
 		return true;
 	}
 
-	private async launch(job: LoopJob, dueIso: string | undefined, now: number, session: SessionSnapshot, catchingUp: boolean): Promise<void> {
+	private async launch(job: LoopJob, dueIso: string | undefined, now: number, session: SessionSnapshot, catchingUp: boolean, requestedBy?: RunRequester): Promise<void> {
 		const runId = newId("run");
 		const startedAt = stamp(now);
 		// Kept so an aborted run can hand its slot back rather than skipping to the next one.
@@ -776,10 +1103,14 @@ export class LoopScheduler {
 		const priorFiredAt = job.lastFiredAt;
 		const claimed = await this.store.update(job.id, (j) => {
 			if (j.running) return;
+			// The slot was decided from a snapshot. If another process ran or skipped this job since,
+			// its stamps moved: that slot is spent, and running it again would run it twice.
+			if (j.lastDueAt !== priorDueAt || j.lastFiredAt !== priorFiredAt) return;
 			j.running = { runId, pid: process.pid, host: this.self.host, startedAt };
 			if (dueIso) j.lastDueAt = dueIso;
 			j.lastFiredAt = startedAt;
 			j.lastError = undefined;
+			j.owedSlot = undefined;
 		});
 		if (!claimed || claimed.running?.runId !== runId) return;
 
@@ -791,7 +1122,7 @@ export class LoopScheduler {
 			this.hooks.log?.(`onRunStart hook failed: ${err?.message ?? err}`);
 		}
 		try {
-			await this.runOnce(job, claimed, runId, startedAt, ctrl, session, now, catchingUp, { dueAt: priorDueAt, firedAt: priorFiredAt });
+			await this.runOnce(job, claimed, runId, startedAt, ctrl, session, now, catchingUp, { dueAt: priorDueAt, firedAt: priorFiredAt }, requestedBy);
 		} finally {
 			// Whatever failed (a state file that cannot be read, a hook that threw), the run id is
 			// released — otherwise `clearStaleRunning` would call the job alive forever.
@@ -806,7 +1137,7 @@ export class LoopScheduler {
 	}
 
 	/** The body of one run: everything between claiming the job and writing its record. */
-	private async runOnce(job: LoopJob, claimed: LoopJob, runId: string, startedAt: string, ctrl: AbortController, session: SessionSnapshot, now: number, catchingUp: boolean, prior: { dueAt?: string; firedAt?: string }): Promise<void> {
+	private async runOnce(job: LoopJob, claimed: LoopJob, runId: string, startedAt: string, ctrl: AbortController, session: SessionSnapshot, now: number, catchingUp: boolean, prior: { dueAt?: string; firedAt?: string }, requestedBy?: RunRequester): Promise<void> {
 		const previousState = this.store.readState(job.id);
 		// `job` is the pre-claim snapshot, so its `lastFiredAt` is when the previous run started —
 		// a reason given before that was already in front of that run.
@@ -831,6 +1162,7 @@ export class LoopScheduler {
 				model,
 				thinking,
 				tools: job.tools,
+				builtinTools: job.builtinTools,
 				timeoutMs: job.timeoutMs ?? DEFAULT_RUN_TIMEOUT_MS,
 				signal: ctrl.signal,
 				sessionDir: this.store.sessionDirFor(job.id),
@@ -862,9 +1194,9 @@ export class LoopScheduler {
 		try {
 			stillThere = this.store.load().some((j) => j.id === job.id);
 		} catch (err: any) {
-			this.log(`loop ${job.id}: could not read the store after the run (${err?.message ?? err}); keeping its state and findings`);
+			this.log(`loop ${job.id}: could not read the store after the run (${err?.message ?? err}); keeping its state and findings`, undefined, job);
 		}
-		if (!stillThere) this.log(`loop ${job.id}: removed during the run; its state and findings are discarded`);
+		if (!stillThere) this.log(`loop ${job.id}: removed during the run; its state and findings are discarded`, undefined, job);
 
 		// Tag extraction never fails a run: malformed/missing tags leave the state untouched.
 		const parsed = parseRunOutput(result.text);
@@ -874,7 +1206,7 @@ export class LoopScheduler {
 				this.store.writeState(job.id, parsed.state);
 				stateUpdated = true;
 			} catch (err: any) {
-				this.log(`loop ${job.id}: state write failed: ${err?.message ?? err}`);
+				this.log(`loop ${job.id}: state write failed: ${err?.message ?? err}`, undefined, job);
 			}
 		}
 		// Maker/checker: with verify=true a second, adversarial sub-agent reviews the
@@ -893,15 +1225,23 @@ export class LoopScheduler {
 			const source = `cron:${job.name ?? job.id.slice(0, "cron-".length + 8)}`;
 			for (const f of reviewed) {
 				try {
-					await this.inbox.append({ source, text: f.text, run_id: runId, job_id: job.id, cwd: job.cwd, kind: findingKind(f.text), verified: f.verified, verified_reason: f.reason });
+					await this.inbox.append({ source, text: f.text, run_id: runId, job_id: job.id, cwd: job.cwd, kind: findingKind(f.text), verified: f.verified, verified_reason: f.reason, session_id: job.createdBy?.sessionId, transcript: result.sessionFile });
 					findings.push(f.text);
 				} catch (err: any) {
-					this.log(`loop ${job.id}: inbox append failed: ${err?.message ?? err}`);
+					this.log(`loop ${job.id}: inbox append failed: ${err?.message ?? err}`, undefined, job);
 				}
 			}
 		}
 
 		const finishedAt = stamp(this.now());
+		// An abort is not a run: quitting, a session swap, a preemption or the budget interrupted it,
+		// so the slot it claimed is given back and the next tick re-fires it (a tick is never lost this
+		// way because its runs die with the session that owned them).
+		const aborted = !result.ok && (result.stopReason === "aborted" || ctrl.signal.aborted);
+		// A person's stop is the exception: they stopped this slot, so it is spent and the next run is
+		// on schedule. Giving it back would run what they just stopped again on the next tick. A run
+		// that finished before the stop reached it is `ok`, and its record says so.
+		const byPerson = aborted && ctrl.signal.aborted && ctrl.signal.reason === STOPPED_BY_PERSON;
 		const record: RunRecord = {
 			runId,
 			jobId: job.id,
@@ -913,7 +1253,7 @@ export class LoopScheduler {
 			finishedAt,
 			ok: result.ok,
 			exitCode: result.exitCode,
-			error: result.ok ? undefined : redact(result.errorMessage ?? "unknown error"),
+			error: result.ok ? undefined : byPerson ? STOPPED_BY_PERSON : redact(result.errorMessage ?? "unknown error"),
 			findings: findings.length,
 			droppedFindings: parsed.droppedFindings,
 			stateUpdated,
@@ -926,17 +1266,18 @@ export class LoopScheduler {
 			sessionId: result.sessionId,
 			sessionFile: result.sessionFile,
 			checker,
+			forSession: job.createdBy?.sessionId,
+			ordinal: claimed.runCount + 1,
+			...(requestedBy ? { requestedBy } : {}),
+			...(aborted ? { aborted: true as const } : {}),
+			...(byPerson ? { stoppedBy: "person" as const, stoppedFrom: this.inflight.get(runId)?.stoppedFrom ?? "cli" } : {}),
 		};
-		this.store.pruneSessions(job.id);
+		this.store.pruneSessions(job.id, undefined, this.inbox.pinnedTranscripts(job.id));
 		try {
 			this.store.appendRun(record);
 		} catch (err: any) {
 			this.log(`run log append failed: ${err?.message ?? err}`);
 		}
-		// An abort is not a run: quitting, a session swap or `/cron abort` interrupted it, so the
-		// slot it claimed is given back and the next tick re-fires it (a tick is never lost this
-		// way because its runs die with the session that owned them).
-		const aborted = !result.ok && (result.stopReason === "aborted" || ctrl.signal.aborted);
 		// The same unreadable store that was tolerated above must not cost the run its `onRunFinished`
 		// either: the record is already written, and the job's own bookkeeping is the one part that
 		// can be skipped when the file cannot be read.
@@ -945,6 +1286,16 @@ export class LoopScheduler {
 			updated = await this.store.update(job.id, (j) => {
 				if (j.running?.runId === runId) j.running = undefined;
 				j.lastCompletedAt = finishedAt;
+				if (byPerson) {
+					// The slot is spent; `runCount` stays (the `ordinal` comment on RunRecord), and a stop is
+					// not a failure, so the streak and the last error stay what they were. A one-shot has no
+					// next slot: it is turned off, not deleted, so its notes are kept.
+					if (job.schedule.kind === "once") {
+						j.enabled = false;
+						j.lastError = `${STOPPED_BY_PERSON}; /cron run ${job.name ?? job.id} runs it now`;
+					}
+					return;
+				}
 				j.lastError = result.ok ? undefined : record.error;
 				if (aborted) {
 					j.lastDueAt = prior.dueAt;
@@ -954,13 +1305,14 @@ export class LoopScheduler {
 					// A job that fails every time costs money every time. Count the streak so `dispatch`
 					// can back off, and clear it the moment one run works.
 					j.consecutiveFailures = result.ok ? undefined : (j.consecutiveFailures ?? 0) + 1;
+					j.interruptions = undefined;
 				}
 			});
 		} catch (err: any) {
-			this.log(`loop ${job.id}: could not write the store after the run (${err?.message ?? err})`);
+			this.log(`loop ${job.id}: could not write the store after the run (${err?.message ?? err})`, undefined, job);
 		}
-		if (updated && !result.ok && (updated.consecutiveFailures ?? 0) >= FAILURE_BACKOFF_AFTER) {
-			this.hooks.onSchedulerError?.(`${updated.name ?? updated.id} has failed ${updated.consecutiveFailures} times in a row; backing off (last: ${record.error ?? "unknown"})`);
+		if (updated && !result.ok && !byPerson && (updated.consecutiveFailures ?? 0) >= FAILURE_BACKOFF_AFTER) {
+			this.hooks.onSchedulerError?.(`${updated.name ?? updated.id} has failed ${updated.consecutiveFailures} times in a row; backing off (last: ${record.error ?? "unknown"})`, updated);
 		}
 		// Only now: while the run id is in `inflight`, `clearStaleRunning` treats the job as alive,
 		// which is exactly right until its `running` marker is gone from the store.
@@ -1013,6 +1365,7 @@ export class LoopScheduler {
 				model,
 				thinking,
 				tools: job.tools,
+				builtinTools: job.builtinTools,
 				timeoutMs: job.timeoutMs ?? DEFAULT_RUN_TIMEOUT_MS,
 				signal,
 				sessionDir: this.store.sessionDirFor(job.id),
@@ -1049,7 +1402,7 @@ export class LoopScheduler {
 			model: result.model ?? model,
 			sessionFile: result.sessionFile,
 		};
-		if (!result.ok) this.log(`loop ${job.name ?? job.id}: checker failed (${record.error}); findings enter the inbox unverified`);
+		if (!result.ok) this.log(`loop ${job.name ?? job.id}: checker failed (${record.error}); findings enter the inbox unverified`, undefined, job);
 		return { record, reviewed };
 	}
 }