@earendil-works/pi-durable 1.0.4 → 1.2.0

package/dist/harness/scheduler.js

@@ -1,12 +1,23 @@
 import { copyJson } from "@earendil-works/chord";
 import { awaitWithContext, withAbortSignal } from "@earendil-works/chord/context";
+import { errorMessage } from "../errors.js";
 import { agentHooks } from "./agent.js";
-import { readContext } from "./context.js";
+import { readContextFrom } from "./context.js";
 import { closedError, scanAll, Waiters } from "./util.js";
 const SCAN_PAGE_SIZE = 256;
 /** Longest delay `setTimeout` supports; longer sleeps wait in several steps. */
 const MAX_TIMER_DELAY = 2_147_483_647;
 const LIVE_STATUSES = ["pending", "running", "waiting", "completing"];
+function conversationNode(id) {
+    return `c${id}`;
+}
+function conversationOf(node) {
+    return Number(node.slice(1));
+}
+/** The node a task hangs from: its owner task, or its conversation. */
+function parentNode(node) {
+    return node.owner ?? conversationNode(node.conversationId);
+}
 /**
  * Durable task scheduler of one Harness.
  *
@@ -14,8 +25,14 @@ const LIVE_STATUSES = ["pending", "running", "waiting", "completing"];
  * commit listener updates it on the Session line, so code running on the line reads exactly the committed state from it.
  *
  * Tasks and conversations form one ownership tree (spec §5.5): a task's parent is its owner task, or its conversation;
- * a conversation's parent is its owner task, if any. Walks up that tree decide cascades, idle scopes, and whether a
- * task's ordinary owned work is live, which holds its outcome as `completing` and delays its abort handler.
+ * a conversation's parent is its owner task, if any. Walks up that tree decide what reaches one task: a cancelling
+ * owner, a scope. `#below` lists the tree downward around live work, so what lies below one node is a walk down from
+ * it: a task's live ordinary owned work, which holds its outcome as `completing` and delays its abort handler, a
+ * scope's tasks, a cascade's reach. No pass visits every live task; the sets below hold each pass's candidates.
+ *
+ * The ownership indexes are bounded by live work: an owner edge and an ended task's ownership fields are kept only while
+ * something is listed below them in `#below`, so only the chains above live tasks are known, whole. Work that appears
+ * later below a dropped node finds it unknown and loads its chain from storage again.
  *
  * Invariant: every task transition is decided and written by one callback serialized on the Session line. That covers
  * reservation, marks, runtime commits, finalization, and the synchronous step before each phase, which applies the
@@ -37,24 +54,57 @@ export class TaskScheduler {
     #conversation;
     #context;
     #live = new Map();
+    /**
+     * Context range last read through a task runtime, per conversation: a later read, by any of its tasks, scans only
+     * newer entries. `idleSince` is the Harness time it was first seen idle. Derived and never persisted; dropped at the
+     * first idle check after `settings.contextRetentionMs` of idleness, and at close.
+     */
+    #contexts = new Map();
+    /** Timer for the earliest expiry of an idle context, only where timers can be unreferenced (see `#scheduleExpiry`). */
+    #expiry;
     #invocations = new Map();
     #taskWaiters = new Waiters();
     /** Idle waiters by conversation; `undefined` waits for the whole Harness. */
     #idleWaiters = new Waiters();
     /** Definition whose migration failed per task; retried only once the registry resolves another definition. */
     #failedMigrations = new Map();
-    /** Owner task of each loaded conversation, `null` when ownerless. */
+    /** Owner task of each known conversation, `null` when ownerless. */
     #edges = new Map();
-    /** Tasks that own a loaded conversation; their nodes stay in `#settled` once terminal. */
-    #conversationOwners = new Set();
-    /** Ownership fields of terminal tasks that walks pass through. */
+    /** Ownership fields of the known terminal tasks, which walks pass through. */
     #settled = new Map();
+    /**
+     * Ended tasks and conversations found unneeded, dropped by `#sweep()` at the end of the commit's publication unless
+     * needed again by then: a chain load installs nodes before the work below them is listed.
+     */
+    #dropQueue = new Set();
+    /**
+     * The tree downward around live work: each node's child nodes that are live tasks or have nodes listed below them.
+     * A conversation's parent is its owner task; ownerless ones with work are in `#roots`.
+     */
+    #below = new Map();
+    #roots = new Set();
+    /** Known tasks whose chain may not be loaded; every other known task's chain is, and stays, loaded. */
+    #unloaded = new Set();
+    /** Live tasks with cancellation intent, the sources of abort cascades (spec §5.4). */
+    #intent = new Set();
+    /** Live tasks that are not `completing`, the candidates of a reservation pass; ones found waiting leave it. */
+    #runnable = new Set();
+    /** `completing` tasks the next finalize pass checks: those that started holding, and holders of ended work. */
+    #finalizeChecks = new Set();
+    /** Live waiting tasks by each task in their `on`. */
+    #waiters = new Map();
     /**
      * `failFast` waiters the next reconcile checks for a failed task in `on`: at open, when they start waiting, and when
      * one of their tasks fails.
      */
     #failFastChecks = new Set();
+    /**
+     * Live tasks with `abandonOnRestart` found at open, from an earlier Harness. The first reservation pass abort-marks
+     * them with reason `restart`, so nothing of them or below them runs a phase again.
+     */
+    #abandoned = new Set();
     #reconcileScheduled = false;
+    #sweepScheduled = false;
     #cascadePending = false;
     #unsubscribeRegistry = () => { };
     #enabled = false;
@@ -78,7 +128,7 @@ export class TaskScheduler {
     }
     /** Load live tasks and change surviving `running` tasks back to `pending`. Dispatches nothing. */
     async open(context) {
-        this.#session.subscribeCommits((publication) => this.#observe(publication));
+        this.#session.observeCommits((publication) => this.#observe(publication));
         this.#session.subscribeClose(() => this.#seal());
         this.#unsubscribeRegistry = this.#registry.subscribe(() => this.#kick());
         await this.#session.commitWith(async (tx) => {
@@ -89,7 +139,9 @@ export class TaskScheduler {
             }
             for (const records of scans) {
                 for (const record of records) {
-                    this.#live.set(record.id, record);
+                    this.#track(undefined, record);
+                    if (record.abandonOnRestart === true)
+                        this.#abandoned.add(record.id);
                     if (record.state.status === "running") {
                         tx.setTask(withState(record, { status: "pending", checkpoint: record.state.checkpoint }));
                     }
@@ -108,16 +160,23 @@ export class TaskScheduler {
         this.#enabled = true;
         this.#kick();
     }
-    /** Wait for every invocation signalled by `#seal()`. Writes nothing. */
+    /**
+     * Signal every invocation and wait for them; writes nothing. Close calls this after every close listener has run, so
+     * waits, watches, and streams a task holds end with the Session's reason, not as cancelled by its signal.
+     */
     async join() {
+        for (const invocation of this.#invocations.values())
+            invocation.controller.abort();
         await Promise.allSettled([...this.#invocations.values()].map((invocation) => invocation.done));
     }
     /**
      * Commit the abort mark, or settle a task that no registered definition can take as `orphaned` when nothing it owns
      * is live, then join the run invocation seen on the line; the commit listener signalled it. The abort invocation
-     * starts once the task's ordinary owned work is gone. A `completing` task is only marked.
+     * starts once the task's ordinary owned work is gone. A `completing` task is only marked. A request replaces a
+     * `restart` mark, so a task abandoned after a restart that waits for its definition is orphaned; with `keepRestart`,
+     * as for an owner's own cleanup, such a task keeps its mark and waits on.
      */
-    async abort(id, context) {
+    async abort(id, context, keepRestart = false) {
         const marked = await this.#session.commitWith(async (tx) => {
             const current = await tx.task(id);
             if (current === undefined)
@@ -125,9 +184,12 @@ export class TaskScheduler {
             if (current.state.status === "terminal")
                 return { result: "terminal" };
             const invocation = this.#invocations.get(id);
+            // A restart-marked task has no run invocation; it only waits for its abort.
+            if (keepRestart && current.abortReason === "restart")
+                return { result: "marked" };
             if (invocation === undefined && current.state.status !== "completing") {
                 await this.#loadScopes(false);
-                if (!this.#ownedLive().has(id)) {
+                if (!this.#hasOwnedLive(id)) {
                     const resolution = this.#resolve(current, this.#registry.snapshot());
                     if (resolution.kind === "blocked") {
                         await this.#terminate(tx, current, { status: "orphaned", reason: resolution.reason });
@@ -135,20 +197,22 @@ export class TaskScheduler {
                     }
                 }
             }
-            if (!current.abortRequested)
-                tx.setTask({ ...current, abortRequested: true });
+            if (!current.abortRequested || current.abortReason !== undefined)
+                tx.setTask(withAbortMark(current));
             return { result: "marked", run: invocation?.mode === "run" ? invocation : undefined };
         }, context);
-        // The commit listener signalled the run; join it.
-        if (marked.run !== undefined)
-            await awaitWithContext(marked.run.done, context);
+        // The commit listener signalled the run; join it. A run that ignores its signal can outlive a failed Session,
+        // which ends the wait instead.
+        if (marked.run !== undefined) {
+            await awaitWithContext(Promise.race([marked.run.done, this.#session.failed]), context);
+        }
         return marked.result;
     }
     async waitForTask(id, context) {
         // Check and register on the line so no terminal publication falls between them.
         const found = await this.#session.readOnLine(async () => {
             if (this.#closing)
-                throw closedError();
+                throw closedError(this.#session);
             if (this.#live.has(id))
                 return { promise: this.#taskWaiters.add(id, context) };
             const record = await this.#storage.task(id, context);
@@ -164,7 +228,7 @@ export class TaskScheduler {
      */
     waitForIdle(conversationId, context) {
         if (this.#closing)
-            return Promise.reject(closedError());
+            return Promise.reject(closedError(this.#session));
         if (this.#idle(conversationId))
             return Promise.resolve();
         this.#scheduleReconcile();
@@ -180,14 +244,13 @@ export class TaskScheduler {
             const queued = await this.#loadScopes(true);
             const scope = { conversation: conversationId };
             const reached = [];
-            for (const record of this.#live.values()) {
-                if (record.background && !background)
-                    continue;
-                if (this.#inScope(parentOf(record), scope, background) !== true)
+            const walk = this.#walkDown(conversationNode(conversationId), { crossBackground: background });
+            for (const { node, live } of walk) {
+                if (live === undefined || (node.background && !background))
                     continue;
-                reached.push(record.id);
-                if (!record.abortRequested)
-                    tx.setTask({ ...record, abortRequested: true });
+                reached.push(live.id);
+                if (!live.abortRequested || live.abortReason !== undefined)
+                    tx.setTask(withAbortMark(live));
             }
             for (const id of queued) {
                 if (this.#inScope({ conversation: id }, scope, background) === true)
@@ -205,6 +268,12 @@ export class TaskScheduler {
         const updated = [];
         const failed = [];
         let changed = false;
+        // Edges first, so the tasks a commit creates in a new conversation hang from it.
+        for (const change of publication.changes) {
+            if (change.type === "conversation" && !this.#edges.has(change.value.id)) {
+                this.#setEdge(change.value.id, change.value.owner?.taskId ?? null);
+            }
+        }
         for (const change of publication.changes) {
             if (change.type !== "task")
                 continue;
@@ -213,12 +282,10 @@ export class TaskScheduler {
             const previous = this.#live.get(record.id);
             if (failedOutcome(record) && (previous === undefined || !failedOutcome(previous)))
                 failed.push(record.id);
+            this.#track(previous, record);
             if (record.state.status === "terminal") {
-                this.#live.delete(record.id);
                 this.#failedMigrations.delete(record.id);
                 this.#failFastChecks.delete(record.id);
-                if (this.#conversationOwners.has(record.id))
-                    this.#settled.set(record.id, nodeOf(record));
                 this.#taskWaiters.resolve(record.id, record);
                 // Its owner may finalize now.
                 this.#scheduleReconcile();
@@ -231,6 +298,9 @@ export class TaskScheduler {
                 if (invocation?.mode === "run")
                     invocation.controller.abort();
             }
+            // A request replacing a `restart` mark upgrades the marks of the work below.
+            if (previous?.abortReason !== undefined && record.abortReason === undefined)
+                this.#cascadePending = true;
             const status = record.state.status;
             if (status === "completing" && previous?.state.status !== "completing") {
                 if (cancellationIntent(record))
@@ -241,52 +311,116 @@ export class TaskScheduler {
                 this.#failFastChecks.add(record.id);
                 this.#scheduleReconcile();
             }
-            this.#live.set(record.id, record);
-            updated.push(record);
+            // Its owners and place never change: what is above it is checked once, when it becomes live.
+            if (previous === undefined)
+                updated.push(record);
         }
         for (const id of failed) {
-            for (const record of this.#live.values()) {
-                const state = record.state;
-                if (state.status === "waiting" && state.policy === "failFast" && state.on.includes(id)) {
-                    this.#failFastChecks.add(record.id);
+            for (const waiter of this.#waiters.get(id) ?? []) {
+                const state = this.#live.get(waiter)?.state;
+                if (state?.status === "waiting" && state.policy === "failFast") {
+                    this.#failFastChecks.add(waiter);
                     this.#scheduleReconcile();
                 }
             }
         }
-        for (const change of publication.changes) {
-            if (change.type === "conversation" && !this.#edges.has(change.value.id)) {
-                this.#setEdge(change.value.id, change.value.owner?.taskId ?? null);
-            }
-        }
         for (const change of publication.changes) {
             // A queued input below a cancelled owner is withdrawn, even after its cascade.
             if (change.type !== "submission" || change.value.status !== "queued" || change.value.type !== "input")
                 continue;
-            const up = { conversation: change.value.conversationId };
-            if (!this.#chainKnown(up) || this.#belowCancelled(up))
+            // Only an owner with cancellation intent withdraws it; a later intent's mark runs the cascade then.
+            if (this.#intent.size === 0)
+                continue;
+            const conversation = change.value.conversationId;
+            if (!this.#known(conversationNode(conversation)) || this.#belowCancelled({ conversation })) {
                 this.#cascadePending = true;
+            }
         }
         for (const record of updated) {
             // Work created below a cancelled owner, even after its cascade, is aborted too.
-            if (!this.#chainKnown(parentOf(record)))
+            if (this.#unloaded.has(record.id))
                 this.#scheduleReconcile();
             else if (!record.background && !record.abortRequested && this.#belowCancelled(parentOf(record))) {
                 this.#cascadePending = true;
             }
         }
-        // Also retries, with the next commit of any kind, a cascade whose commit failed.
+        // A cascade that a reservation or step found pending runs with the next commit of any kind.
         if (this.#cascadePending)
             this.#scheduleReconcile();
+        this.#sweep();
         if (!changed)
             return;
-        this.#resolveIdleWaiters();
+        this.#settleIdle();
         this.#kick();
     }
-    #resolveIdleWaiters() {
+    /**
+     * `settings.contextRetentionMs`, or 0 when the host's settings throw. Kept contexts are only a cache, so dropping them
+     * is safe, while a throw here would escape commit listeners, reconciliation, and the expiry timer.
+     */
+    #contextRetentionMs() {
+        try {
+            return this.#settings().contextRetentionMs;
+        }
+        catch (error) {
+            this.#report(error);
+            return 0;
+        }
+    }
+    /** Resolve idle waiters, and drop each kept context whose conversation has been idle for the retention period. */
+    #settleIdle() {
         for (const conversationId of this.#idleWaiters.keys()) {
             if (this.#idle(conversationId))
                 this.#idleWaiters.resolve(conversationId);
         }
+        const now = this.#now();
+        const retention = this.#contextRetentionMs();
+        for (const [conversationId, kept] of this.#contexts) {
+            if (kept.idleSince !== undefined && now - kept.idleSince >= retention) {
+                this.#contexts.delete(conversationId);
+            }
+            else if (!this.#idle(conversationId)) {
+                kept.idleSince = undefined;
+            }
+            else if (retention > 0) {
+                kept.idleSince ??= now;
+            }
+            else {
+                this.#contexts.delete(conversationId);
+            }
+        }
+        this.#scheduleExpiry();
+    }
+    /**
+     * Run `#settleIdle()` when the earliest idle context expires. The timer is unreferenced, so it never keeps the process
+     * alive. Where timers cannot be unreferenced, as in Cloudflare Workers, none is kept: a pending timer could keep a
+     * Durable Object from being evicted, and eviction frees the contexts. There, task changes alone check expiry.
+     */
+    #scheduleExpiry() {
+        const retention = this.#contextRetentionMs();
+        let at;
+        for (const kept of this.#contexts.values()) {
+            if (kept.idleSince !== undefined && (at === undefined || kept.idleSince + retention < at)) {
+                at = kept.idleSince + retention;
+            }
+        }
+        if (this.#expiry !== undefined && this.#expiry.at === at)
+            return;
+        if (this.#expiry !== undefined)
+            clearTimeout(this.#expiry.timer);
+        this.#expiry = undefined;
+        if (at === undefined || this.#closing)
+            return;
+        const timer = setTimeout(() => {
+            this.#expiry = undefined;
+            this.#settleIdle();
+        }, Math.min(Math.max(0, at - this.#now()), MAX_TIMER_DELAY));
+        const unref = timer.unref;
+        if (typeof unref !== "function") {
+            clearTimeout(timer);
+            return;
+        }
+        unref.call(timer);
+        this.#expiry = { at, timer };
     }
     // ─── Ownership ───────────────────────────────────────────────────────────
     #scheduleReconcile() {
@@ -312,17 +446,28 @@ export class TaskScheduler {
                 if (this.#closing)
                     return;
                 const queued = await this.#loadScopes(cascade);
-                const marked = new Set();
-                const mark = (record) => {
-                    if (record.abortRequested || marked.has(record.id))
+                // A cascade from an abandoned owner passes its `restart` reason on; any other intent marks, or upgrades a
+                // `restart` mark, as a request. Collected first, so a request wins over a `restart` mark of the same pass.
+                const marks = new Map();
+                const mark = (record, reason) => {
+                    const staged = marks.get(record.id);
+                    if (staged !== undefined && staged.reason === undefined)
+                        return;
+                    if (record.abortRequested && (record.abortReason === undefined || reason !== undefined))
                         return;
-                    marked.add(record.id);
-                    tx.setTask({ ...record, abortRequested: true });
+                    marks.set(record.id, { record, reason });
                 };
-                // Loading edges can reveal a cancelled owner, so marks are derived on every pass.
-                for (const record of this.#live.values()) {
-                    if (!record.background && this.#belowCancelled(parentOf(record)))
-                        mark(record);
+                // Every live foreground task below a live owner with cancellation intent, which is its nearest one: a walk down
+                // from each owner with intent does not enter another, whose own walk covers what is below it. Derived again on
+                // every pass, as loading edges can reveal a cancelled owner.
+                for (const id of this.#intent) {
+                    const owner = this.#live.get(id);
+                    // Only an owner abandoned after a restart, and nothing else, passes its reason on.
+                    const restart = owner.abortReason === "restart" && !failedOutcome(owner);
+                    for (const { node, live } of this.#walkDown(id, { enter: (below) => !this.#intent.has(below) })) {
+                        if (live !== undefined && !node.background)
+                            mark(live, restart ? "restart" : undefined);
+                    }
                 }
                 for (const id of checks) {
                     const waiter = this.#live.get(id);
@@ -332,9 +477,11 @@ export class TaskScheduler {
                     for (const member of waiter.state.on) {
                         const record = this.#live.get(member);
                         if (record !== undefined && !failedOutcome(record))
-                            mark(record);
+                            mark(record, undefined);
                     }
                 }
+                for (const { record, reason } of marks.values())
+                    tx.setTask(withAbortMark(record, reason));
                 for (const id of queued)
                     if (this.#belowCancelled({ conversation: id }))
                         await this.#withdrawInputs(tx, id);
@@ -342,14 +489,11 @@ export class TaskScheduler {
             }, this.#context);
         }
         catch (error) {
-            // Any pass may have staged marks, so a failed one is retried with the next commit.
-            this.#cascadePending = true;
-            for (const id of checks)
-                this.#failFastChecks.add(id);
-            if (!this.#closing)
-                this.#report(error);
+            // No extension code runs in this commit: a throw is a storage failure, a host callback, or a bug. None is fixed by
+            // running the pass again, so it fails the Session, which reports it.
+            this.#failSession(error);
         }
-        this.#resolveIdleWaiters();
+        this.#settleIdle();
     }
     /** Whether any of `ids` holds or ended with an outcome other than `completed`. */
     async #anyFailed(ids) {
@@ -366,53 +510,86 @@ export class TaskScheduler {
      * Harness cleanup here.
      */
     async #finalize(tx) {
-        for (;;) {
-            const overlay = overlayOf(tx);
-            const owned = this.#ownedLive(overlay);
-            const done = [...this.#liveRecords(overlay)].filter((record) => record.state.status === "completing" && !owned.has(record.id));
-            if (done.length === 0)
-                return;
-            for (const record of done) {
+        // A worklist: the tasks that started holding, and the holders of work that ended. Finalizing one can free the
+        // nearest live task above it, which goes on the list. Tasks finalized here have no live work below them, so walks
+        // down skip them.
+        // In rounds: the holders the tasks of one round free are checked once, in the next, so a holder of many tasks that
+        // end together is walked once, not once per task.
+        let round = [...this.#finalizeChecks];
+        this.#finalizeChecks.clear();
+        const done = new Set();
+        const overlay = overlayOf(tx);
+        while (round.length > 0) {
+            const next = new Set();
+            for (const id of round) {
+                const record = overlay.tasks.get(id) ?? this.#live.get(id);
+                if (record?.state.status !== "completing" || done.has(id))
+                    continue;
+                if (this.#hasOwnedLive(id, overlay, done))
+                    continue;
                 const outcome = record.state.outcome;
-                tx.setTask(withState(record, { status: "terminal", outcome }));
+                const terminal = withState(record, { status: "terminal", outcome });
+                tx.setTask(terminal);
+                overlay.tasks.set(id, terminal);
+                done.add(id);
                 // REMINDER: only the scheduler writes `faulted` and `orphaned` (spec §5.4); their cleanup waits for this commit.
                 if (outcome.status === "faulted" || outcome.status === "orphaned") {
                     await this.#settleOutcome(tx, record, outcome);
                 }
+                const above = this.#nearestLiveAbove(record, overlay);
+                if (above?.state.status === "completing")
+                    next.add(above.id);
             }
+            round = [...next];
         }
     }
     /**
-     * Load the owner chains of every live task and, with `queued`, of every conversation with queued submissions, on the
-     * Session line; returns the latter. Reads committed Storage directly, so it may run inside a commit callback.
+     * Load the owner chains of the tasks in `#unloaded` and, with `queued`, of every conversation with queued inputs,
+     * on the Session line; returns the latter. Reads committed Storage directly, so it may run inside a commit callback.
      */
     async #loadScopes(queued) {
-        for (const record of [...this.#live.values()]) {
-            if (!this.#chainKnown(parentOf(record)))
-                await this.#loadChain(parentOf(record));
+        for (const id of [...this.#unloaded]) {
+            // An earlier load in this loop may have passed it.
+            if (this.#unloaded.has(id))
+                await this.#loadChain({ task: id });
         }
         if (!queued)
             return [];
         const submissions = await scanAll((cursor) => this.#storage.scanSubmissions({ status: "queued" }, SCAN_PAGE_SIZE, cursor, this.#context));
-        const conversations = [...new Set(submissions.map((submission) => submission.conversationId))];
+        const inputs = submissions.filter((submission) => submission.type === "input");
+        const conversations = [...new Set(inputs.map((submission) => submission.conversationId))];
         for (const id of conversations)
             await this.#loadChain({ conversation: id });
         return conversations;
     }
-    /** Load the owner edges and task nodes from `start` up to its ownerless root. */
+    /**
+     * Load the owner edges and task nodes from `start` up to its ownerless root. A known task outside `#unloaded` ends the
+     * walk, as its chain is loaded; the `#unloaded` tasks passed have a loaded chain afterwards. Loading a node can reveal
+     * a cancelled owner, so it makes the next reconcile derive cascade marks.
+     */
     async #loadChain(start, overlay) {
+        const passed = [];
         let at = start;
         while (at !== undefined) {
             if ("task" in at) {
-                let node = this.#node(at.task, overlay);
+                const id = at.task;
+                let node = this.#live.get(id) ?? this.#settled.get(id);
+                // Created in this commit: the load from its own record covers what is above it.
+                if (node === undefined && overlay?.tasks.has(id) === true)
+                    break;
+                if (node !== undefined && !this.#unloaded.has(id))
+                    break;
                 if (node === undefined) {
-                    const record = await this.#storage.task(at.task, this.#context);
+                    const record = await this.#storage.task(id, this.#context);
                     if (record === undefined)
                         return;
                     node = nodeOf(record);
                     if (record.state.status === "terminal")
-                        this.#settled.set(record.id, node);
+                        this.#settle(id, node);
+                    // A loaded node can reveal a cancelling owner: the next reconcile derives marks again.
+                    this.#scheduleReconcile();
                 }
+                passed.push(id);
                 at = parentOf(node);
             }
             else {
@@ -421,15 +598,202 @@ export class TaskScheduler {
                     const record = await this.#storage.conversation(at.conversation, this.#context);
                     edge = record?.owner?.taskId ?? null;
                     this.#setEdge(at.conversation, edge);
+                    // A loaded node can reveal a cancelling owner: the next reconcile derives marks again.
+                    this.#scheduleReconcile();
                 }
                 at = edge === null ? undefined : { task: edge };
             }
         }
+        for (const id of passed)
+            this.#unloaded.delete(id);
     }
     #setEdge(conversationId, owner) {
         this.#edges.set(conversationId, owner);
-        if (owner !== null)
-            this.#conversationOwners.add(owner);
+        // The conversation now hangs from its owner, or is a root; with nothing below it, it waits for the sweep.
+        this.#relist(conversationNode(conversationId));
+        this.#dropIfUnneeded(conversationNode(conversationId));
+    }
+    /** Know a terminal task a chain load read, so walks pass through it; its own chain is not loaded yet. */
+    #settle(id, node) {
+        this.#settled.set(id, node);
+        this.#unloaded.add(id);
+        this.#relist(id);
+        this.#dropIfUnneeded(id);
+    }
+    /** Queue an ended task or a conversation for the sweep when nothing is listed below it. */
+    #dropIfUnneeded(node) {
+        if (typeof node !== "string" && this.#live.has(node))
+            return;
+        if (this.#below.has(node))
+            return;
+        this.#dropQueue.add(node);
+        this.#scheduleSweep();
+    }
+    /**
+     * Sweep in a job of its own on the Session line, after the operation underway: a rejected commit, one with nothing to
+     * write, and a read publish nothing, so the sweep at the end of `#observe` would not run for what they loaded.
+     */
+    #scheduleSweep() {
+        if (this.#sweepScheduled || this.#closing)
+            return;
+        this.#sweepScheduled = true;
+        this.#session
+            .readOnLine(async () => {
+            this.#sweepScheduled = false;
+            this.#sweep();
+        })
+            // Rejected only once the Session is closing or failed, when nothing is kept anyway.
+            .catch(() => { });
+    }
+    /**
+     * Drop the queued nodes that are still unneeded: not live, nothing listed below. Runs once a publication is fully
+     * tracked, and as a job of its own on the line, never inside an operation: work a commit creates below a chain its
+     * own callback loaded keeps that chain. A flat loop: unlisting already queued every node on the way up that lost its
+     * last listed node.
+     */
+    #sweep() {
+        for (const node of this.#dropQueue) {
+            if (this.#below.has(node))
+                continue;
+            if (typeof node === "string") {
+                this.#edges.delete(conversationOf(node));
+                this.#roots.delete(conversationOf(node));
+            }
+            else if (!this.#live.has(node)) {
+                this.#settled.delete(node);
+                this.#unloaded.delete(node);
+            }
+        }
+        this.#dropQueue.clear();
+    }
+    /**
+     * Bring the scheduler's sets in line with a task's committed record. A task that ended may free the nearest live task
+     * above it: one holding its outcome finalizes, an abort-marked one runs its abort handler; its waiters may run.
+     */
+    #track(previous, record) {
+        const id = record.id;
+        if (previous?.state.status === "waiting")
+            for (const on of previous.state.on)
+                deleteFrom(this.#waiters, on, id);
+        if (record.state.status === "terminal") {
+            const node = nodeOf(record);
+            this.#live.delete(id);
+            this.#intent.delete(id);
+            this.#runnable.delete(id);
+            this.#finalizeChecks.delete(id);
+            this.#settled.set(id, node);
+            // Before anything is forgotten: the walk up to the task it held passes the ended tasks between them. Its chain is
+            // loaded, as every commit that ends a task loads the chains of `#unloaded` first.
+            this.#release(node);
+            for (const waiter of this.#waiters.get(id) ?? [])
+                this.#runnable.add(waiter);
+            this.#relist(id);
+            this.#dropIfUnneeded(id);
+            return;
+        }
+        this.#live.set(id, record);
+        if (previous === undefined) {
+            if (!this.#known(parentNode(record)))
+                this.#unloaded.add(id);
+            this.#relist(id);
+        }
+        if (cancellationIntent(record))
+            this.#intent.add(id);
+        else
+            this.#intent.delete(id);
+        if (record.state.status === "completing") {
+            this.#runnable.delete(id);
+            this.#finalizeChecks.add(id);
+        }
+        else {
+            this.#runnable.add(id);
+        }
+        if (record.state.status === "waiting")
+            for (const on of record.state.on)
+                addTo(this.#waiters, on, id);
+    }
+    /** The nearest live task above ended ordinary work may be free now: one holding its outcome, or an aborting one. */
+    #release(node, overlay) {
+        const above = this.#nearestLiveAbove(node, overlay);
+        if (above?.state.status === "completing")
+            this.#finalizeChecks.add(above.id);
+        else if (above?.abortRequested === true)
+            this.#runnable.add(above.id);
+        return above;
+    }
+    /**
+     * List `start` under its parent node in `#below` while it is a live task or has nodes listed below it, and unlist it
+     * otherwise; then its parent, as far up as that changes. So `#below` holds exactly the tree around live work; a
+     * parent that loses its last listed node is queued for the sweep. A loop, as ownership chains can be deeper than the
+     * call stack.
+     */
+    #relist(start) {
+        let node = start;
+        for (;;) {
+            const needed = (typeof node !== "string" && this.#live.has(node)) || this.#below.has(node);
+            let parent;
+            if (typeof node === "string") {
+                parent = this.#edges.get(conversationOf(node));
+            }
+            else {
+                const known = this.#live.get(node) ?? this.#settled.get(node);
+                if (known === undefined)
+                    return;
+                parent = parentNode(known);
+            }
+            if (parent === undefined)
+                return;
+            if (parent === null) {
+                const root = conversationOf(node);
+                if (needed)
+                    this.#roots.add(root);
+                else
+                    this.#roots.delete(root);
+                return;
+            }
+            if ((this.#below.get(parent)?.has(node) === true) === needed)
+                return;
+            if (needed) {
+                const first = !this.#below.has(parent);
+                addTo(this.#below, parent, node);
+                if (!first)
+                    return;
+            }
+            else {
+                deleteFrom(this.#below, parent, node);
+                if (this.#below.has(parent))
+                    return;
+                this.#dropIfUnneeded(parent);
+            }
+            node = parent;
+        }
+    }
+    /**
+     * The nearest live task above ended ordinary work `node`, in the overlay's view: the one that work held, if any. Work
+     * at or below a background task holds nothing above it.
+     */
+    #nearestLiveAbove(node, overlay) {
+        for (let current = node; !current.background;) {
+            const owner = current.owner ?? this.#edge(current.conversationId, overlay);
+            if (owner === undefined || owner === null)
+                return undefined;
+            const record = overlay?.tasks.get(owner) ?? this.#live.get(owner);
+            if (record !== undefined && record.state.status !== "terminal")
+                return record;
+            const above = record ?? this.#settled.get(owner);
+            if (above === undefined)
+                return undefined;
+            current = above;
+        }
+        return undefined;
+    }
+    /** Whether the chain above `node` is loaded, without walking: known tasks outside `#unloaded` have a loaded chain. */
+    #known(node) {
+        if (typeof node !== "string") {
+            return (this.#live.has(node) || this.#settled.has(node)) && !this.#unloaded.has(node);
+        }
+        const owner = this.#edges.get(conversationOf(node));
+        return owner === null || (owner !== undefined && this.#known(owner));
     }
     /** Owner task of a conversation, `null` when ownerless, `undefined` while not loaded. */
     #edge(id, overlay) {
@@ -462,51 +826,96 @@ export class TaskScheduler {
             }
         }
     }
-    /** Whether every owner above `start` is loaded. */
-    #chainKnown(start, overlay) {
-        for (const step of this.#above(start, overlay))
-            if ("unknown" in step)
-                return false;
-        return true;
-    }
-    /** Live records, with the overlay's candidates replacing committed ones; terminal candidates are gone. */
-    *#liveRecords(overlay) {
-        for (const record of this.#live.values()) {
-            const candidate = overlay?.tasks.get(record.id) ?? record;
-            if (candidate.state.status !== "terminal")
-                yield candidate;
-        }
-        if (overlay === undefined)
-            return;
-        for (const record of overlay.tasks.values()) {
-            if (!this.#live.has(record.id) && record.state.status !== "terminal")
-                yield record;
+    /**
+     * The tasks below `start` that a walk down reaches: those `#below` lists and, under an overlay, the commit's new tasks,
+     * with its candidates in place of committed records. Background tasks are reached but not entered, unless
+     * `crossBackground`, and neither are the tasks `enter` rejects. A loop, as chains can be deeper than the call stack.
+     */
+    *#walkDown(start, options = {}) {
+        const { overlay, crossBackground = false, enter } = options;
+        const links = overlay === undefined ? undefined : this.#links(overlay);
+        const pending = [start];
+        for (let at = pending.pop(); at !== undefined; at = pending.pop()) {
+            for (const children of [this.#below.get(at), links?.get(at)]) {
+                for (const child of children ?? []) {
+                    if (typeof child === "string") {
+                        pending.push(child);
+                        continue;
+                    }
+                    const record = overlay?.tasks.get(child) ?? this.#live.get(child);
+                    const node = record ?? this.#settled.get(child);
+                    if (node === undefined)
+                        continue;
+                    const live = record !== undefined && record.state.status !== "terminal" ? record : undefined;
+                    yield { id: child, node, live };
+                    if ((crossBackground || !node.background) && (enter === undefined || enter(child)))
+                        pending.push(child);
+                }
+            }
         }
     }
     /**
-     * Every task with live ordinary owned work (spec §5.5), mapped to that work: each live non-background task counts for
-     * every owner task above it up to and including the first background one. Owner chains must be loaded.
+     * The links walks down need for the commit's new tasks: each one under its parent node, then each node above it that
+     * `#below` does not list yet, until one it lists, a live task (always listed), or the chain's end.
      */
-    #ownedLive(overlay) {
-        const owned = new Map();
-        for (const record of this.#liveRecords(overlay)) {
-            if (record.background)
+    #links(overlay) {
+        if (overlay.links !== undefined)
+            return overlay.links;
+        const links = new Map();
+        for (const record of overlay.tasks.values()) {
+            if (this.#live.has(record.id) || this.#settled.has(record.id))
                 continue;
-            for (const step of this.#above(parentOf(record), overlay)) {
-                if ("unknown" in step)
+            let child = record.id;
+            let parent = parentNode(record);
+            while (parent !== undefined && parent !== null && links.get(parent)?.has(child) !== true) {
+                addTo(links, parent, child);
+                if (typeof parent !== "string" && (this.#live.has(parent) || overlay.tasks.has(parent)))
                     break;
-                if (!("task" in step))
-                    continue;
-                const below = owned.get(step.task);
-                if (below === undefined)
-                    owned.set(step.task, [record.id]);
-                else
-                    below.push(record.id);
-                if (step.node.background)
+                let above;
+                if (typeof parent === "string") {
+                    above = this.#edge(conversationOf(parent), overlay);
+                }
+                else {
+                    const fields = this.#settled.get(parent);
+                    above = fields === undefined ? undefined : parentNode(fields);
+                }
+                if (above !== undefined && above !== null && this.#below.get(above)?.has(parent) === true)
                     break;
+                child = parent;
+                parent = above;
             }
         }
-        return owned;
+        overlay.links = links;
+        return links;
+    }
+    /**
+     * The live ordinary owned work of `owner` (spec §5.5): the live non-background tasks below it that a walk down reaches
+     * without entering a background task; with `first`, only the first. Candidates in `overlay` replace committed records;
+     * the walk does not enter tasks in `done`, which have none. Owner chains must be loaded.
+     */
+    #ownedLive(owner, options = {}) {
+        const { overlay, first = false, done } = options;
+        const found = [];
+        const walk = this.#walkDown(owner, {
+            ...(overlay === undefined ? {} : { overlay }),
+            ...(done === undefined ? {} : { enter: (id) => !done.has(id) }),
+        });
+        for (const { id, node, live } of walk) {
+            if (live === undefined || node.background)
+                continue;
+            found.push(id);
+            if (first)
+                break;
+        }
+        return found;
+    }
+    #hasOwnedLive(owner, overlay, done) {
+        const options = {
+            first: true,
+            ...(overlay === undefined ? {} : { overlay }),
+            ...(done === undefined ? {} : { done }),
+        };
+        return this.#ownedLive(owner, options).length > 0;
     }
     /**
      * Whether ordinary traversal from `scope` reaches `start`: walking up reaches the scope's conversation, or an
@@ -532,28 +941,47 @@ export class TaskScheduler {
      * background owner without it. Terminal owners never cascade (spec §5.4).
      */
     #belowCancelled(start) {
+        return this.#cancellingOwner(start) !== undefined;
+    }
+    /** The nearest live owner above `start` whose cancellation intent reaches it, if any; see `#belowCancelled`. */
+    #cancellingOwner(start) {
+        // Nothing cancels, the common case: no walk.
+        if (this.#intent.size === 0)
+            return undefined;
         for (const step of this.#above(start)) {
             if ("unknown" in step)
-                return false;
+                return undefined;
             if (!("task" in step))
                 continue;
             const live = this.#live.get(step.task);
             if (live !== undefined && cancellationIntent(live))
-                return true;
+                return live;
             if (step.node.background)
-                return false;
+                return undefined;
         }
-        return false;
+        return undefined;
+    }
+    /** Fail the Session, which reports it, for a throw in one of the scheduler's own commits; ignored once closing. */
+    #failSession(error) {
+        if (!this.#closing)
+            this.#session.fail(error);
     }
-    /** Close listener: runs synchronously once admission is sealed, before `join()`. */
+    /** Close listener: runs synchronously once admission is sealed, before `join()`, or when the Session fails. */
     #seal() {
         this.#closing = true;
-        this.#unsubscribeRegistry();
-        const error = closedError();
+        try {
+            this.#unsubscribeRegistry();
+        }
+        catch (error) {
+            this.#report(error);
+        }
+        const error = closedError(this.#session);
         this.#taskWaiters.rejectAll(error);
         this.#idleWaiters.rejectAll(error);
-        for (const invocation of this.#invocations.values())
-            invocation.controller.abort();
+        this.#contexts.clear();
+        if (this.#expiry !== undefined)
+            clearTimeout(this.#expiry.timer);
+        this.#expiry = undefined;
     }
     #kick() {
         this.#dirty = true;
@@ -572,38 +1000,64 @@ export class TaskScheduler {
             }
         }
         catch (error) {
-            if (!this.#closing)
-                this.#report(error);
+            // As in `#reconcile()`: the reservation commit runs no extension code.
+            this.#failSession(error);
         }
         finally {
             this.#draining = false;
-            // A wakeup that arrived during a failed pass still needs its pass.
+            // A wakeup that arrived after the loop's last check still needs its pass.
             if (this.#dirty)
                 this.#kick();
         }
     }
-    /** Reserve every eligible task in one commit; orphan abort-marked tasks no definition can take. */
+    /**
+     * Reserve every eligible task in one commit; orphan abort-marked tasks no definition can take, unless abandoned after
+     * a restart. The first pass after open only abort-marks the abandoned tasks, so later passes see the marks.
+     */
     async #reserve() {
         const reservations = [];
+        let abandoned = [];
         try {
             await this.#session.commitWith(async (tx) => {
                 if (!this.#enabled || this.#closing)
                     return;
+                for (const id of this.#abandoned) {
+                    const record = this.#live.get(id);
+                    if (record !== undefined && !record.abortRequested)
+                        tx.setTask(withAbortMark(record, "restart"));
+                }
+                if (this.#abandoned.size > 0) {
+                    abandoned = [...this.#abandoned];
+                    return;
+                }
                 await this.#loadScopes(false);
-                const owned = this.#ownedLive();
                 // Taken once per pass, and only when some task is a candidate.
                 let snapshot;
-                for (const record of [...this.#live.values()]) {
-                    if (this.#invocations.has(record.id) || this.#waitingOn(record, owned).length > 0)
+                for (const id of [...this.#runnable]) {
+                    const record = this.#live.get(id);
+                    if (record === undefined || record.state.status === "completing" || this.#invocations.has(id)) {
+                        this.#runnable.delete(id);
                         continue;
-                    if (record.state.status === "completing")
+                    }
+                    // It returns once what it waits for ends, its record changes, or the work below it ends.
+                    if (this.#waitingOn(record, true).length > 0) {
+                        this.#runnable.delete(id);
                         continue;
+                    }
                     const runnable = record;
                     const mode = record.abortRequested ? "abort" : "run";
+                    // Work below an owner with cancellation intent waits for its cascade mark instead of running a phase; schedule
+                    // the cascade, which may not have run yet.
+                    if (mode === "run" && !record.background && this.#belowCancelled(parentOf(record))) {
+                        this.#cascadePending = true;
+                        this.#scheduleReconcile();
+                        continue;
+                    }
                     snapshot ??= this.#registry.snapshot();
                     const resolution = this.#resolve(runnable, snapshot);
                     if (resolution.kind === "blocked") {
-                        if (mode === "abort") {
+                        // An abandoned task waits for its definition, so its abort handler can clean up.
+                        if (mode === "abort" && record.abortReason === undefined) {
                             await this.#terminate(tx, record, { status: "orphaned", reason: resolution.reason });
                         }
                         continue;
@@ -614,7 +1068,9 @@ export class TaskScheduler {
                             checkpoint: resolution.record.state.checkpoint,
                         }));
                     }
-                    // Registered on the line, so marks and later reservations see it and close joins it.
+                    // Registered on the line, so marks and later reservations see it and close joins it; `#end` makes it a
+                    // candidate again.
+                    this.#runnable.delete(id);
                     const invocation = this.#createInvocation(record, mode);
                     reservations.push({ invocation, task: resolution.task, snapshot });
                 }
@@ -623,22 +1079,31 @@ export class TaskScheduler {
         catch (error) {
             for (const { invocation } of reservations) {
                 this.#invocations.delete(invocation.taskId);
+                this.#runnable.add(invocation.taskId);
                 invocation.finish();
             }
             throw error;
         }
+        // Marked, or already marked or gone: done with them. Reserve again, now seeing the marks.
+        for (const id of abandoned)
+            this.#abandoned.delete(id);
+        if (abandoned.length > 0)
+            this.#dirty = true;
         return reservations;
     }
     /**
      * Live tasks a task waits for before its next invocation: its live ordinary owned work when abort-marked, since
      * abort runs bottom-up, otherwise the live part of the `on` of a wait.
      */
-    #waitingOn(record, owned) {
+    #waitingOn(record, first = false) {
         if (record.abortRequested)
-            return owned.get(record.id) ?? [];
+            return this.#ownedLive(record.id, { first });
         if (record.state.status !== "waiting")
             return [];
-        return record.state.on.filter((id) => this.#live.has(id));
+        if (!first)
+            return record.state.on.filter((id) => this.#live.has(id));
+        const live = record.state.on.find((id) => this.#live.has(id));
+        return live === undefined ? [] : [live];
     }
     /** Resolve the record's definition by kind, migrating an older stored version. */
     #resolve(record, snapshot) {
@@ -675,6 +1140,21 @@ export class TaskScheduler {
             return { reason: "migration_failed", error: failed.error };
         return { task, migrates: true };
     }
+    /** Sizes of the ownership indexes, for tests that bound the scheduler's memory. */
+    get indexSizes() {
+        let below = 0;
+        for (const children of this.#below.values())
+            below += children.size;
+        return {
+            live: this.#live.size,
+            settled: this.#settled.size,
+            edges: this.#edges.size,
+            below,
+            roots: this.#roots.size,
+            unloaded: this.#unloaded.size,
+            dropQueue: this.#dropQueue.size,
+        };
+    }
     /**
      * Scheduling state and every live task with its derived state, read on the Session line. Runs no task code: a
      * pending migration shows as `ready` with `migrates`, and only a migration the scheduler already tried, or one that
@@ -682,20 +1162,18 @@ export class TaskScheduler {
      */
     async inspect(snapshot) {
         await this.#loadScopes(false);
-        const owned = this.#ownedLive();
         const tasks = [];
-        for (const record of this.#live.values()) {
-            tasks.push({ record, state: this.#inspectTask(record, snapshot, owned) });
-        }
+        for (const record of this.#live.values())
+            tasks.push({ record, state: this.#inspectTask(record, snapshot) });
         const scheduling = this.#closing ? "closing" : this.#enabled ? "running" : "paused";
         return { scheduling, tasks };
     }
-    #inspectTask(record, snapshot, owned) {
+    #inspectTask(record, snapshot) {
         if (this.#invocations.has(record.id))
             return { kind: "running" };
         if (record.state.status === "completing")
             return { kind: "completing" };
-        const on = this.#waitingOn(record, owned);
+        const on = this.#waitingOn(record);
         if (on.length > 0)
             return { kind: "waiting", on };
         const fit = this.#fit(record, snapshot.task(record.kind));
@@ -774,6 +1252,12 @@ export class TaskScheduler {
         // 3. abort mark: end; a fresh abort invocation starts once the task's ordinary owned work is gone.
         if (current.abortRequested)
             return false;
+        // An owner's cancellation intent ends it too, before its cascade marks it; reservation then holds it back.
+        if (!current.background && this.#belowCancelled(parentOf(current))) {
+            this.#cascadePending = true;
+            this.#scheduleReconcile();
+            return false;
+        }
         if (previous === undefined)
             return true;
         // 4. uncaught error.
@@ -834,16 +1318,17 @@ export class TaskScheduler {
                     return current;
                 this.#end(invocation);
                 if (decision !== false) {
-                    const message = decision.fault instanceof Error ? decision.fault.message : String(decision.fault);
+                    const message = errorMessage(decision.fault);
                     await this.#terminate(tx, current, { status: "faulted", error: { message } });
                 }
                 return undefined;
             }, this.#context);
         }
         catch (error) {
+            // The step writes the scheduler's own decision, a fault or a terminal record; a throw there would otherwise
+            // leave the task running, to be reserved and run again.
             this.#end(invocation);
-            if (!this.#closing)
-                this.#report(error);
+            this.#failSession(error);
             return undefined;
         }
     }
@@ -853,7 +1338,7 @@ export class TaskScheduler {
      */
     async #terminate(tx, record, outcome) {
         await this.#loadScopes(false);
-        if (this.#ownedLive(overlayOf(tx)).has(record.id)) {
+        if (this.#hasOwnedLive(record.id, overlayOf(tx))) {
             tx.setTask(withState(record, { status: "completing", outcome }));
             return;
         }
@@ -873,7 +1358,7 @@ export class TaskScheduler {
             await this.#loadScopes(false);
             for (const record of overlay.tasks.values())
                 await this.#loadChain(parentOf(record), overlay);
-            if (this.#ownedLive(overlay).has(current.id)) {
+            if (this.#hasOwnedLive(current.id, overlay)) {
                 tx.setTask(withState(current, { status: "completing", outcome: next.outcome }));
                 return;
             }
@@ -881,37 +1366,102 @@ export class TaskScheduler {
         tx.setTask(withState(current, next));
     }
     /**
-     * A wait names existing tasks other than the waiter and its owners, which could never finish first; `failFast` only
-     * tasks the waiter owns. An abort handler cannot wait.
+     * A wait names existing tasks, and `failFast` only tasks the waiter owns. It may not close a cycle in the wait-for
+     * graph, whose edges run from each task to what it waits on and to its live ordinary owned work (spec §5.5); waiting
+     * on itself or on an owner holding it are the shortest such cycles. An abort handler cannot wait.
+     *
+     * Invariant: the wait-for graph is acyclic. Only a wait adds an edge between existing tasks, as a new task has only
+     * incoming edges, so checking each wait maintains it.
      */
     async #validateWait(tx, invocation, current, on, policy) {
         if (invocation.mode === "abort")
             throw new Error(`Abort handler of task ${current.id} cannot wait`);
         const overlay = overlayOf(tx);
-        await this.#loadChain(parentOf(current));
-        const owners = new Set();
-        for (const step of this.#above(parentOf(current)))
-            if ("task" in step)
-                owners.add(step.task);
+        const targets = [];
         for (const id of on) {
-            if (id === current.id || owners.has(id)) {
-                throw new Error(`Task ${current.id} cannot wait on itself or its owner ${id}`);
-            }
             const member = overlay.tasks.get(id) ?? this.#live.get(id) ?? (await this.#storage.task(id, this.#context));
             if (member === undefined)
                 throw new Error(`Task ${id} does not exist`);
             if (policy === "failFast" && member.owner !== current.id) {
                 throw new Error(`Task ${current.id} can wait failFast only on tasks it owns; ${id} is not one`);
             }
+            // A live child already holds the waiter (task-owned tasks are never background): waiting on it adds no edge. A
+            // terminal task has no edges.
+            if (member.state.status !== "terminal" && member.owner !== current.id)
+                targets.push(id);
+        }
+        if (targets.length === 0)
+            return;
+        const cycle = await this.#waitCycle(current.id, targets, overlay);
+        if (cycle !== undefined) {
+            throw new Error(`Task ${current.id} cannot wait on ${cycle[0]}: ${[current.id, ...cycle].join(" -> ")} is a wait cycle`);
+        }
+    }
+    /**
+     * The path from a member of `on` back to `task` in the wait-for graph, if the wait would close a cycle (spec §5.1).
+     * An edge X -> Y means X cannot settle before Y: Y is in the `on` of waiting X that is not abort-marked, or Y is live
+     * ordinary owned work of X,
+     * which holds X as `completing`. Each task is visited once and each subtree walked once, so a check is bounded by the
+     * live work it reaches.
+     */
+    async #waitCycle(task, on, overlay) {
+        // Owned work is found by walks down, which need the chains of every live task loaded.
+        await this.#loadScopes(false);
+        const from = new Map();
+        const walked = new Set();
+        const pending = [];
+        const reach = (id, via) => {
+            if (from.has(id))
+                return;
+            from.set(id, via);
+            pending.push(id);
+        };
+        const path = (end) => {
+            const steps = [];
+            for (let at = end; at !== undefined; at = from.get(at))
+                steps.unshift(at);
+            return steps;
+        };
+        for (const id of on)
+            reach(id, undefined);
+        for (let id = pending.pop(); id !== undefined; id = pending.pop()) {
+            if (id === task)
+                return path(id);
+            const record = overlay.tasks.get(id) ?? this.#live.get(id);
+            if (record === undefined || record.state.status === "terminal")
+                continue;
+            // An abort-marked task waits only for its owned work, as abort runs bottom-up (`#waitingOn`).
+            if (record.state.status === "waiting" && !record.abortRequested) {
+                for (const member of record.state.on)
+                    reach(member, id);
+            }
+            if (walked.has(id))
+                continue;
+            walked.add(id);
+            // Below a walked task the walk does not go again: its own walk covered what lies below.
+            const found = [];
+            const walk = this.#walkDown(id, { overlay, enter: (below) => !walked.has(below) });
+            for (const { id: below, node, live } of walk) {
+                if (live === undefined || node.background)
+                    continue;
+                found.push(below);
+                reach(below, id);
+            }
+            for (const below of found)
+                walked.add(below);
         }
+        return undefined;
     }
     /** End an invocation: its runtime operations reject from now on, its signal aborts, its watches stop, and its task is free. */
     #end(invocation) {
         if (invocation.ended)
             return;
         invocation.ended = true;
-        if (this.#invocations.get(invocation.taskId) === invocation)
+        if (this.#invocations.get(invocation.taskId) === invocation) {
             this.#invocations.delete(invocation.taskId);
+            if (this.#live.has(invocation.taskId))
+                this.#runnable.add(invocation.taskId);
+        }
         for (const watch of invocation.watches)
             void watch.stop();
         // Pending waits bound to the invocation, such as a tool's waitForTask(), reject with it.
@@ -920,10 +1470,20 @@ export class TaskScheduler {
     /** No live non-background task in the scope; a task whose owner edges are not loaded yet counts as inside. */
     #idle(conversationId) {
         const scope = conversationId === undefined ? { roots: true } : { conversation: conversationId };
-        for (const record of this.#live.values()) {
-            if (!record.background && this.#inScope(parentOf(record), scope) !== false)
+        // Tasks whose chain is not loaded are not listed below their scope yet; one counts as inside unless its walk up
+        // decides otherwise.
+        for (const id of this.#unloaded) {
+            const record = this.#live.get(id);
+            if (record !== undefined && !record.background && this.#inScope(parentOf(record), scope) !== false)
                 return false;
         }
+        const starts = conversationId === undefined ? this.#roots : [conversationId];
+        for (const start of starts) {
+            for (const { node, live } of this.#walkDown(conversationNode(start))) {
+                if (live !== undefined && !node.background)
+                    return false;
+            }
+        }
         return true;
     }
     // ─── Invocation runtime ──────────────────────────────────────────────────
@@ -995,6 +1555,34 @@ export class TaskScheduler {
             snapshotAsOf: ((...args) => this.#read(invocation, () => sessionMethod(this.#session, "snapshotAsOf")(...args))),
             getTask: ((id, context) => this.#read(invocation, () => this.#session.readOnLine(() => this.#storage.task(id, context)))),
             waitForTask: ((id, context) => this.#read(invocation, () => this.waitForTask(id, withAbortSignal(invocation.controller.signal, context)))),
+            ownedTasks: (context) => this.#read(invocation, () => this.#session.readOnLine(async () => {
+                // The step that ends the invocation may have run on the line before this.
+                if (invocation.ended)
+                    throw endedError(invocation);
+                context.abortSignal?.throwIfAborted();
+                // Every live task is listed under its parent node, its owner task when it has one.
+                const owned = [];
+                for (const node of this.#below.get(invocation.taskId) ?? []) {
+                    const record = typeof node === "string" ? undefined : this.#live.get(node);
+                    if (record?.owner === invocation.taskId)
+                        owned.push(record);
+                }
+                // Copies, as from storage: the scheduler reads its own.
+                return owned
+                    .sort((a, b) => a.id - b.id)
+                    .map((record) => copyJson(record));
+            })),
+            abortOwned: (id, context) => this.#read(invocation, async () => {
+                const bound = withAbortSignal(invocation.controller.signal, context);
+                const record = await this.#session.readOnLine(() => this.#storage.task(id, bound));
+                if (record?.owner !== invocation.taskId) {
+                    throw new Error(`Task ${id} is not owned by task ${invocation.taskId}`);
+                }
+                if (record.state.status === "terminal")
+                    return;
+                await this.abort(id, bound, true);
+                await this.waitForTask(id, bound);
+            }),
             outcomes: ((ids, context) => this.#read(invocation, () => this.#session.readOnLine(async () => {
                 const outcomes = [];
                 for (const id of ids) {
@@ -1022,7 +1610,25 @@ export class TaskScheduler {
                     return token === undefined || entry?.kind === token.kind ? entry : undefined;
                 });
             }),
-            context: (conversationId, context, at) => this.#read(invocation, () => readContext(this.#session, this.#storage, conversationId, context, at)),
+            context: (conversationId, context, options) => this.#read(invocation, async () => {
+                const { view, range } = await readContextFrom(this.#session, this.#storage, conversationId, context, options?.at, this.#contexts.get(conversationId)?.range);
+                // Keep it unless the invocation ended or a concurrent read already kept a newer range.
+                const kept = this.#contexts.get(conversationId);
+                if (range !== undefined &&
+                    !this.#closing &&
+                    !invocation.ended &&
+                    (kept === undefined || kept.range.bounds.tail <= range.bounds.tail)) {
+                    // A read of another, idle conversation starts or continues its retention period.
+                    if (!this.#idle(conversationId)) {
+                        this.#contexts.set(conversationId, { range, idleSince: undefined });
+                    }
+                    else if (this.#contextRetentionMs() > 0) {
+                        this.#contexts.set(conversationId, { range, idleSince: kept?.idleSince ?? this.#now() });
+                        this.#scheduleExpiry();
+                    }
+                }
+                return view;
+            }),
             now: () => {
                 if (invocation.ended)
                     throw endedError(invocation);
@@ -1049,7 +1655,7 @@ export class TaskScheduler {
             if (invocation.ended)
                 throw endedError(invocation);
             if (this.#closing)
-                throw closedError();
+                throw closedError(this.#session);
             const found = this.#live.get(invocation.taskId);
             if (found === undefined)
                 throw new Error(`Task ${invocation.taskId} is terminal`);
@@ -1093,6 +1699,11 @@ export class TaskScheduler {
         return watch;
     }
 }
+/** The record with an abort mark: `restart` for an abandonment; without a reason, a request, which replaces `restart`. */
+function withAbortMark(record, reason) {
+    const { abortReason: _reason, ...rest } = record;
+    return { ...rest, abortRequested: true, ...(reason === undefined ? {} : { abortReason: reason }) };
+}
 /** A live owner's durable cancellation intent: its abort mark, or a held outcome other than `completed`. */
 function cancellationIntent(record) {
     return record.state.status !== "terminal" && (record.abortRequested || failedOutcome(record));
@@ -1117,6 +1728,21 @@ function overlayOf(tx) {
     const edges = new Map(tx.stagedConversations().map((record) => [record.id, record.owner?.taskId ?? null]));
     return { tasks, edges };
 }
+function addTo(map, key, value) {
+    const values = map.get(key);
+    if (values === undefined)
+        map.set(key, new Set([value]));
+    else
+        values.add(value);
+}
+function deleteFrom(map, key, value) {
+    const values = map.get(key);
+    if (values === undefined)
+        return;
+    values.delete(value);
+    if (values.size === 0)
+        map.delete(key);
+}
 /** Own memo entry only; memo names such as `toString` must not resolve to inherited properties. */
 function memoOf(record, name) {
     const memos = record?.memos;