@earendil-works/pi-durable 1.3.0 → 1.5.0

package/dist/harness/scheduler.js

@@ -1,13 +1,35 @@
 import { copyJson } from "@earendil-works/chord";
-import { awaitWithContext, withAbortSignal } from "@earendil-works/chord/context";
-import { errorMessage } from "../errors.js";
-import { agentHooks } from "./agent.js";
-import { readContextFrom } from "./context.js";
-import { closedError, scanAll, Waiters } from "./util.js";
+import { awaitWithContext, withAbortSignal, withoutAbortSignal, withTelemetry } from "@earendil-works/chord/context";
+import { ownedSlice } from "@earendil-works/chord/delta";
+import { createTypedMetrics, createTypedSpanStarter, NOOP_TELEMETRY_CONTEXT, NOOP_TELEMETRY_METRICS, } from "@earendil-works/pi-telemetry";
+import { errorMessage, ReadOnlySession } from "../errors.js";
+import { ALL_KEYS, conversationKey, INTENT_KEY, ownedKey, ROOTS_KEY, taskKey } from "../session/keys.js";
+import { agentHooks, DEFAULT_RESTART_LIMIT } from "./agent.js";
+import { advanceRange, rangeEntry, readContextFrom } from "./context.js";
+import { DURABLE_TELEMETRY_SCHEMA } from "./telemetry.js";
+import { closedError, conversationEntries, optionalExtension, scanAll, Waiters } from "./util.js";
 const SCAN_PAGE_SIZE = 256;
-/** Longest delay `setTimeout` supports; longer sleeps wait in several steps. */
-const MAX_TIMER_DELAY = 2_147_483_647;
-const LIVE_STATUSES = ["pending", "running", "waiting", "completing"];
+const NO_KEYS = [];
+const LIVE_STATUSES = ["pending", "running", "waiting", "sleeping", "completing"];
+/** The part of a record `blockedReason()` reads. */
+export function blockedSubject(record) {
+    return {
+        id: record.id,
+        kind: record.kind,
+        version: record.version,
+        abortRequested: record.abortRequested,
+        ...(record.abortReason === undefined ? {} : { abortReason: record.abortReason }),
+        status: record.state.status,
+    };
+}
+/** Continue with the next phase, the first one. */
+const CONTINUE = { kind: "continue" };
+/** Rule 5: the phase made durable progress; `#progress()` decides once the decision stands. */
+const PROGRESS = { kind: "progress" };
+/** End the invocation without a write. */
+const END = { kind: "end" };
+/** End it: an owner's cancellation intent reaches it before its cascade did; schedule the cascade. */
+const CASCADE = { kind: "cascade" };
 function conversationNode(id) {
     return `c${id}`;
 }
@@ -21,8 +43,9 @@ function parentNode(node) {
 /**
  * Durable task scheduler of one Harness.
  *
- * `#live` mirrors every committed non-terminal task record: pending, running, waiting, and completing. The synchronous
- * commit listener updates it on the Session line, so code running on the line reads exactly the committed state from it.
+ * `#live` mirrors every committed non-terminal task record: pending, running, waiting, sleeping, and completing. The
+ * synchronous commit listener updates it on the Session line, so code running on the line reads exactly the committed
+ * state from it.
  *
  * Tasks and conversations form one ownership tree (spec §5.5): a task's parent is its owner task, or its conversation;
  * a conversation's parent is its owner task, if any. Walks up that tree decide what reaches one task: a cancelling
@@ -35,11 +58,22 @@ function parentNode(node) {
  * later below a dropped node finds it unknown and loads its chain from storage again.
  *
  * Invariant: every task transition is decided and written by one callback serialized on the Session line. That covers
- * reservation, marks, runtime commits, finalization, and the synchronous step before each phase, which applies the
- * precedence rules and writes a fault or handover. Handlers and joins run off the line. An invocation ends inside the
- * step that decides its end, so a runtime commit it queued either lands before that decision or is rejected.
+ * reservation, marks, runtime commits, finalization, and the step before each phase, which applies the precedence rules
+ * and writes a fault or handover. Handlers and joins run off the line. An invocation ends inside the step that decides
+ * its end, so a runtime commit it queued either lands before that decision or is rejected.
+ *
+ * Decisions stay serialized; their storage overlaps (group commit). The Session stores the commits of several jobs in
+ * one call while the line runs on, and this memory changes only as each commit is published. So every decision reads
+ * it in a decision region (`#region()`): synchronous, recording the keys it reads (a task's record, the live work below
+ * a node, the cancellation intent set), staging nothing; when one of them has an unpublished writer, the region waits
+ * for its publication and runs again, and only a region that read nothing unpublished is applied. Every commit writes
+ * the memberships its task changes alter (`membershipKeys()`), so a walk that a pending commit would change waits.
  */
 export class TaskScheduler {
+    #telemetry;
+    #activeMetric;
+    #durationMetric;
+    #resumed = new Set();
     #session;
     #storage;
     #registry;
@@ -48,8 +82,12 @@ export class TaskScheduler {
     #settings;
     #env;
     #now;
+    #onWake;
+    #timers;
+    #writeAtClose;
     #report;
     #settleOutcome;
+    #limitsRestarts;
     #withdrawInputs;
     #conversation;
     #context;
@@ -60,7 +98,21 @@ export class TaskScheduler {
      * first idle check after `settings.contextRetentionMs` of idleness, and at close.
      */
     #contexts = new Map();
-    /** Timer for the earliest expiry of an idle context, only where timers can be unreferenced (see `#scheduleExpiry`). */
+    /**
+     * The idle kept contexts by `idleSince`, oldest first: the expiry order, so neither an expiry nor finding the next one
+     * scans `#contexts`. Kept sorted also when the Harness clock goes back (see `#markIdle`).
+     */
+    #idleOrder = new Map();
+    /** At least the newest `idleSince` in `#idleOrder` (drops do not lower it): an older one added means the clock went back. */
+    #idleNewest = Number.NEGATIVE_INFINITY;
+    /**
+     * A chain load resolved what `#idle()` treats as unknown for a live task whose chain is not loaded, which can make a
+     * scope idle without a task change below it; the next idle check then covers every scope.
+     */
+    #unknownsChanged = false;
+    /** Idle checks that covered every scope (`idleState`, a test diagnostic). */
+    #fullIdleChecks = 0;
+    /** Background timer for the earliest expiry of an idle context, unless the host declined it (see `#scheduleExpiry`). */
     #expiry;
     #invocations = new Map();
     #taskWaiters = new Waiters();
@@ -103,15 +155,39 @@ export class TaskScheduler {
      * them with reason `restart`, so nothing of them or below them runs a phase again.
      */
     #abandoned = new Set();
+    /** Sleeping live tasks, due or not: the candidates of `#wakeDue()`. */
+    #sleeping = new Set();
+    /** Timer for the earliest sleep, without `onWake` while scheduling runs. */
+    #timer;
+    /** Last value given to `onWake`, so an unchanged one is not repeated. */
+    #lastWake;
+    #wakeScheduled = false;
+    #blockedListeners = new Set();
+    /** A registry snapshot that threw for the task graph was reported; it is read per record, so only once. */
+    #snapshotReported = false;
     #reconcileScheduled = false;
+    /** Reconcile passes underway with work (they may overlap): their commits finalize held outcomes and mark cascades. */
+    #reconcilingWork = 0;
     #sweepScheduled = false;
+    /**
+     * Nodes chain loads installed for jobs whose commits are not published yet, with how many such jobs: the sweep keeps
+     * them, as work a pending commit creates below them needs them.
+     */
+    #pins = new Map();
+    /** Keys the decision region underway reads (`#region()`); set only while one runs. */
+    #reading;
     #cascadePending = false;
     #unsubscribeRegistry = () => { };
     #enabled = false;
+    #readOnly;
     #closing = false;
     #dirty = false;
     #draining = false;
     constructor(options) {
+        this.#telemetry = options.telemetry ?? NOOP_TELEMETRY_CONTEXT;
+        const metrics = createTypedMetrics(this.#telemetry.metrics ?? NOOP_TELEMETRY_METRICS, [DURABLE_TELEMETRY_SCHEMA]);
+        this.#activeMetric = metrics.upDownCounter("pi.durable.tasks.active");
+        this.#durationMetric = metrics.histogram("pi.durable.phase.duration");
         this.#session = options.session;
         this.#storage = options.storage;
         this.#registry = options.registry;
@@ -120,18 +196,31 @@ export class TaskScheduler {
         this.#settings = options.settings;
         this.#env = options.env;
         this.#now = options.now;
+        this.#onWake = options.onWake;
+        this.#timers = options.timers;
+        this.#writeAtClose = options.writeAtClose;
         this.#report = options.report;
         this.#settleOutcome = options.settleOutcome;
+        this.#limitsRestarts = options.limitsRestarts;
         this.#withdrawInputs = options.withdrawInputs;
         this.#conversation = options.conversation;
         this.#context = options.context;
+        this.#readOnly = options.readOnly === true;
     }
-    /** Load live tasks and change surviving `running` tasks back to `pending`. Dispatches nothing. */
+    /**
+     * Load live tasks and change surviving `running` tasks back to `pending`, counting the restart. Dispatches nothing;
+     * a task cut off `settings.restartLimit` times ends when it is next reserved. Read-only, it only loads them: a
+     * `running` task stays as committed, running in another process.
+     */
     async open(context) {
-        this.#session.observeCommits((publication) => this.#observe(publication));
+        this.#session.followCommits((publication) => this.#observe(publication));
         this.#session.subscribeClose(() => this.#seal());
-        this.#unsubscribeRegistry = this.#registry.subscribe(() => this.#kick());
+        this.#unsubscribeRegistry = this.#registry.subscribe(() => {
+            this.#notifyBlocked();
+            this.#kick();
+        });
         await this.#session.commitWith(async (tx) => {
+            await this.#published();
             // Every table read before the first write.
             const scans = [];
             for (const status of LIVE_STATUSES) {
@@ -140,10 +229,15 @@ export class TaskScheduler {
             for (const records of scans) {
                 for (const record of records) {
                     this.#track(undefined, record);
+                    this.#resumed.add(record.id);
+                    if (this.#readOnly)
+                        continue;
                     if (record.abandonOnRestart === true)
                         this.#abandoned.add(record.id);
                     if (record.state.status === "running") {
-                        tx.setTask(withState(record, { status: "pending", checkpoint: record.state.checkpoint }));
+                        const restarts = (record.restarts ?? 0) + 1;
+                        const pending = withState(record, { status: "pending", checkpoint: record.state.checkpoint });
+                        tx.setTask({ ...pending, restarts });
                     }
                     if (record.state.status === "waiting" && record.state.policy === "failFast") {
                         this.#failFastChecks.add(record.id);
@@ -151,23 +245,133 @@ export class TaskScheduler {
                 }
             }
         }, context);
+        if (this.#readOnly)
+            return;
         // Derive abort marks a crash left unapplied below cancelled owners, and finalize held outcomes.
         this.#cascadePending = true;
         this.#scheduleReconcile();
+        this.#scheduleWake();
     }
-    /** Enable scheduling. Idempotent; the kick does nothing once closing. */
+    /**
+     * Enable scheduling, and make sleeping tasks that are due runnable: a host wakeup, such as an alarm, calls this.
+     * Idempotent; the kick does nothing once closing.
+     */
     resume() {
+        if (this.#readOnly)
+            throw new ReadOnlySession("running tasks");
         this.#enabled = true;
+        this.#wakeDue();
         this.#kick();
     }
     /**
-     * Signal every invocation and wait for them; writes nothing. Close calls this after every close listener has run, so
-     * waits, watches, and streams a task holds end with the Session's reason, not as cancelled by its signal.
+     * Why a live task cannot run here, if it cannot: its definition is missing, too old, or failed to migrate. A running
+     * task, an abort-marked one, and one holding its outcome are never blocked.
+     */
+    blockedReason(record) {
+        const status = record.status;
+        if (status === "running" || status === "completing" || status === "terminal")
+            return undefined;
+        // An abort request runs its handler or orphans the task; a `restart` mark waits for the definition, blocked.
+        if (record.abortRequested && record.abortReason === undefined)
+            return undefined;
+        let snapshot;
+        try {
+            snapshot = this.#registry.snapshot();
+        }
+        catch (error) {
+            if (!this.#snapshotReported)
+                this.#report(error, REGISTRY);
+            this.#snapshotReported = true;
+            return undefined;
+        }
+        const fit = this.#fit(record, snapshot.task(record.kind));
+        if ("reason" in fit)
+            return fit.reason;
+        return fit.migrates && fit.task.definition.migrate === undefined ? "migration_failed" : undefined;
+    }
+    /** Call `listener` when blocked reasons may have changed without a commit: a registry change or a failed migration. */
+    subscribeBlocked(listener) {
+        this.#blockedListeners.add(listener);
+        return () => this.#blockedListeners.delete(listener);
+    }
+    /**
+     * When the Session next needs a process: `active` while some task can run now or is running, `at` for the earliest
+     * sleep not yet due. Synchronous, from memory; a task whose chain is not loaded yet counts as it would alone.
+     */
+    wake() {
+        // A read-only Harness runs nothing, so it never needs a process.
+        if (this.#readOnly)
+            return { active: false };
+        const now = this.#now();
+        // A reconcile pass with work to do is work too: it finalizes held outcomes and marks cascades, at open as
+        // recovery. A process that dies before it lands must be woken again. A pass with nothing to do is not.
+        const active = this.#invocations.size > 0 || this.#reconcilingWork > 0 || this.#reconcileWork() || this.#runsNow(now);
+        // The earliest sleep not yet due: only `#sleeping` holds sleeping tasks, so no pass visits every live task.
+        let at;
+        for (const id of this.#sleeping) {
+            const record = this.#live.get(id);
+            const state = record?.state;
+            if (state?.status === "sleeping" && !record.abortRequested && state.until > now) {
+                at = at === undefined ? state.until : Math.min(at, state.until);
+            }
+        }
+        return at === undefined ? { active } : { active, at };
+    }
+    /** Whether a live task can run now: the scan `wake()` needs only while no invocation runs. */
+    #runsNow(now) {
+        let snapshot;
+        let snapshotFailed = false;
+        for (const record of this.#live.values()) {
+            const state = record.state;
+            if (state.status === "completing")
+                continue;
+            if (state.status === "waiting" && !record.abortRequested && state.on.some((id) => this.#live.has(id)))
+                continue;
+            if (state.status === "sleeping" && !record.abortRequested && state.until > now)
+                continue;
+            // An abort invocation waits for the live work below it, which counts itself.
+            if (record.abortRequested && this.#waitingOn(record, true).length > 0)
+                continue;
+            // A task no definition can take waits for a registry change, except an abort-marked one, which is orphaned.
+            if (!record.abortRequested || record.abortReason !== undefined) {
+                if (snapshot === undefined && !snapshotFailed) {
+                    try {
+                        snapshot = this.#registry.snapshot();
+                    }
+                    catch (error) {
+                        snapshotFailed = true;
+                        this.#report(error, REGISTRY);
+                    }
+                }
+                if (snapshot !== undefined && "reason" in this.#fit(record, snapshot.task(record.kind)))
+                    continue;
+            }
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Signal every invocation and wait for them, then write the tasks they ran back as `pending` (`writeAtClose`), as a
+     * close is not a crash. Close calls this after every close listener has run, so waits, watches, and streams a task
+     * holds end with the Session's reason, not as cancelled by its signal.
      */
     async join() {
-        for (const invocation of this.#invocations.values())
+        const stopped = [...this.#invocations.values()];
+        for (const invocation of stopped)
             invocation.controller.abort();
-        await Promise.allSettled([...this.#invocations.values()].map((invocation) => invocation.done));
+        await Promise.allSettled(stopped.map((invocation) => invocation.done));
+        if (stopped.length === 0)
+            return;
+        // A close is not a crash: a task it stopped is `pending` again, so the next open counts no restart for it. Read
+        // on the line after commits admitted before the seal, such as an abort mark, so the write keeps them. A failure
+        // leaves them `running`, counted as if cut off; the Storage guard fails the Session and reports it.
+        await this.#writeAtClose(() => stopped.flatMap((invocation) => {
+            const record = this.#live.get(invocation.taskId);
+            if (record?.state.status !== "running")
+                return [];
+            const value = withState(record, { status: "pending", checkpoint: record.state.checkpoint });
+            return [{ type: "task", value }];
+        })).catch(() => { });
     }
     /**
      * Commit the abort mark, or settle a task that no registered definition can take as `orphaned` when nothing it owns
@@ -189,12 +393,14 @@ export class TaskScheduler {
                 return { result: "marked" };
             if (invocation === undefined && current.state.status !== "completing") {
                 await this.#loadScopes(false);
-                if (!this.#hasOwnedLive(id)) {
-                    const resolution = this.#resolve(current, this.#registry.snapshot());
-                    if (resolution.kind === "blocked") {
-                        await this.#terminate(tx, current, { status: "orphaned", reason: resolution.reason });
-                        return { result: "marked" };
-                    }
+                const owns = await this.#region(() => this.#hasOwnedLive(id), this.#reloadScopes);
+                // Resolved once that decision stands, as it may run `migrate`.
+                const resolution = owns
+                    ? undefined
+                    : this.#resolve(current, this.#registry.snapshot());
+                if (resolution?.kind === "blocked") {
+                    await this.#terminate(tx, current, { status: "orphaned", reason: resolution.reason });
+                    return { result: "marked" };
                 }
             }
             if (!current.abortRequested || current.abortReason !== undefined)
@@ -210,12 +416,13 @@ export class TaskScheduler {
     }
     async waitForTask(id, context) {
         // Check and register on the line so no terminal publication falls between them.
-        const found = await this.#session.readOnLine(async () => {
+        const found = await this.#session.readOnLine(async (storage) => {
             if (this.#closing)
                 throw closedError(this.#session);
-            if (this.#live.has(id))
+            if (await this.#region(() => this.#liveRecord(id) !== undefined)) {
                 return { promise: this.#taskWaiters.add(id, context) };
-            const record = await this.#storage.task(id, context);
+            }
+            const record = await storage.task(id, context);
             if (record === undefined)
                 throw new Error(`Task ${id} does not exist`);
             return { promise: Promise.resolve(record) };
@@ -241,6 +448,7 @@ export class TaskScheduler {
      */
     async abortConversation(conversationId, background, context) {
         const reached = await this.#session.commitWith(async (tx) => {
+            await this.#published();
             const queued = await this.#loadScopes(true);
             const scope = { conversation: conversationId };
             const reached = [];
@@ -263,11 +471,100 @@ export class TaskScheduler {
                 await this.waitForTask(id, context);
         await this.waitForIdle(conversationId, context);
     }
+    /**
+     * The ownership memberships a commit's task and conversation changes write (group commit §4.2), at its admission on
+     * the line: for each task created or made terminal, every node from its parent up to and including the nearest live
+     * task, or the root conversation, and then the roots too, conservatively, as a pending end may unlist the root a
+     * creation finds listed; for each conversation created under a task, that task; and the intent set when
+     * a change sets, upgrades, or clears a mark or a held or ended outcome other than `completed`. Loads the chains it
+     * walks; the nodes it installs stay until the commit is published.
+     */
+    membershipKeys(tx) {
+        const tasks = tx.stagedTasks();
+        const conversations = tx.stagedConversations();
+        if (tasks.length === 0 && conversations.every((record) => record.owner === undefined))
+            return NO_KEYS;
+        return this.#membershipKeys(tx, tasks, conversations);
+    }
+    async #membershipKeys(tx, tasks, conversations) {
+        const keys = new Set();
+        const overlay = overlayOf(tx);
+        const created = new Set(tx.createdTaskIds());
+        const reached = new Map();
+        for (const record of tasks) {
+            if (intentChanges(this.#live.get(record.id), record))
+                keys.add(INTENT_KEY);
+            if (!created.has(record.id) && record.state.status !== "terminal")
+                continue;
+            await this.#loadChain(parentOf(record), overlay);
+            if ((await this.#chainKeys(parentNode(record), overlay, keys, reached)) !== undefined)
+                keys.add(ROOTS_KEY);
+        }
+        for (const conversation of conversations) {
+            const owner = conversation.owner?.taskId;
+            if (owner === undefined)
+                continue;
+            await this.#loadChain({ task: owner }, overlay);
+            await this.#chainKeys(owner, overlay, keys, reached);
+        }
+        return [...keys];
+    }
+    /**
+     * Add the memberships from `start` up to and including the nearest live task, or the root conversation, which it
+     * returns. `reached` keeps, per node walked, where its walk ended, so a chain several tasks of a commit share is
+     * walked once. Whether an ancestor is live can change under a pending commit, so it is read after a touch of the
+     * ancestor's record: a pending end must not stop the chain early. Ownership fields are immutable, so not keyed.
+     */
+    async #chainKeys(start, overlay, keys, reached) {
+        const walked = [];
+        let root;
+        let node = start;
+        while (node !== undefined && node !== null) {
+            const key = ownedKey(node);
+            // Walked up from here already, for another task of the commit.
+            if (reached.has(key)) {
+                root = reached.get(key);
+                break;
+            }
+            keys.add(key);
+            walked.push(key);
+            if (typeof node === "string") {
+                const conversation = conversationOf(node);
+                node = this.#edge(conversation, overlay);
+                if (node === null)
+                    root = conversation;
+                continue;
+            }
+            let record = overlay.tasks.get(node);
+            if (record === undefined) {
+                const gate = this.#session.touch(taskKey(node));
+                if (gate !== undefined) {
+                    await gate;
+                    // It may have ended meanwhile, and its node been swept: load the chain above it again.
+                    await this.#loadChain({ task: node }, overlay);
+                }
+                record = this.#live.get(node);
+            }
+            if (record !== undefined && record.state.status !== "terminal")
+                break;
+            const above = record ?? this.#settled.get(node);
+            node = above === undefined ? undefined : parentNode(above);
+        }
+        for (const key of walked)
+            reached.set(key, root);
+        return root;
+    }
     // ─── Scheduling ────────────────────────────────────────────────────────
     #observe(publication) {
+        // A commit held in memory changes documents only.
+        if (publication.kind === "memory")
+            return;
+        this.#advanceContexts(publication);
         const updated = [];
         const failed = [];
         let changed = false;
+        // The conversations whose idleness the commit's task changes can change; undefined when a chain is not known.
+        let dirty = new Set();
         // Edges first, so the tasks a commit creates in a new conversation hang from it.
         for (const change of publication.changes) {
             if (change.type === "conversation" && !this.#edges.has(change.value.id)) {
@@ -283,6 +580,11 @@ export class TaskScheduler {
             if (failedOutcome(record) && (previous === undefined || !failedOutcome(previous)))
                 failed.push(record.id);
             this.#track(previous, record);
+            // Idleness counts live tasks, so only a task that became live or ended can change it. Collected before `#sweep()`,
+            // which may forget the chain of a task that ended.
+            const liveness = previous === undefined || record.state.status === "terminal";
+            if (liveness && dirty !== undefined && !this.#addScopesAbove(record, dirty))
+                dirty = undefined;
             if (record.state.status === "terminal") {
                 this.#failedMigrations.delete(record.id);
                 this.#failFastChecks.delete(record.id);
@@ -293,10 +595,11 @@ export class TaskScheduler {
             }
             if (record.abortRequested && previous?.abortRequested !== true) {
                 this.#cascadePending = true;
-                // Signal a run invocation of the newly marked task; its next step ends it.
+                // Signal a run invocation of the newly marked task; its next step ends it. Abort listeners are task code, which
+                // never runs inside a publication: the signal follows in a microtask, after host commit listeners.
                 const invocation = this.#invocations.get(record.id);
                 if (invocation?.mode === "run")
-                    invocation.controller.abort();
+                    queueMicrotask(() => invocation.controller.abort());
             }
             // A request replacing a `restart` mark upgrades the marks of the work below.
             if (previous?.abortReason !== undefined && record.abortReason === undefined)
@@ -350,9 +653,60 @@ export class TaskScheduler {
         this.#sweep();
         if (!changed)
             return;
-        this.#settleIdle();
+        this.#settleIdle(dirty);
         this.#kick();
     }
+    /**
+     * Add the conversations above `record` to `scopes`: those whose idleness a change of it can change. False when a node
+     * on the way up is not known. A conversation already in `scopes` has everything above it there too.
+     */
+    #addScopesAbove(record, scopes) {
+        for (const step of this.#above(parentOf(record))) {
+            if ("unknown" in step)
+                return false;
+            if (!("conversation" in step))
+                continue;
+            if (scopes.has(step.conversation))
+                return true;
+            scopes.add(step.conversation);
+        }
+        return true;
+    }
+    /**
+     * Extend each kept context range with the entries a stored commit appended to its conversation, so a later read
+     * needs no Storage scan. Entries are published in ID order.
+     */
+    #advanceContexts(publication) {
+        if (this.#contexts.size === 0)
+            return;
+        let appended;
+        for (const change of publication.changes) {
+            if (change.type !== "entry" || !this.#contexts.has(change.value.conversationId))
+                continue;
+            appended ??= new Map();
+            const entries = appended.get(change.value.conversationId);
+            if (entries === undefined)
+                appended.set(change.value.conversationId, [change.value]);
+            else
+                entries.push(change.value);
+        }
+        if (appended === undefined)
+            return;
+        for (const [conversationId, entries] of appended) {
+            const kept = this.#contexts.get(conversationId);
+            // An idle range past its retention is dropped here too: entry-only commits do not run `#settleIdle()`, and a
+            // host may decline the expiry timer. `expiresAt` was fixed when it went idle, so no settings are read here.
+            if (kept.idleSince !== undefined && kept.expiresAt !== undefined && kept.expiresAt <= this.#now()) {
+                this.#dropContext(conversationId);
+                continue;
+            }
+            const range = advanceRange(kept.range, entries);
+            if (range === undefined)
+                this.#dropContext(conversationId);
+            else
+                kept.range = range;
+        }
+    }
     /**
      * `settings.contextRetentionMs`, or 0 when the host's settings throw. Kept contexts are only a cache, so dropping them
      * is safe, while a throw here would escape commit listeners, reconciliation, and the expiry timer.
@@ -362,69 +716,116 @@ export class TaskScheduler {
             return this.#settings().contextRetentionMs;
         }
         catch (error) {
-            this.#report(error);
+            this.#report(error, SETTINGS);
             return 0;
         }
     }
-    /** Resolve idle waiters, and drop each kept context whose conversation has been idle for the retention period. */
-    #settleIdle() {
-        for (const conversationId of this.#idleWaiters.keys()) {
-            if (this.#idle(conversationId))
-                this.#idleWaiters.resolve(conversationId);
-        }
+    /**
+     * After task changes below the conversations in `scopes` (every conversation when undefined): resolve their idle
+     * waiters and the Harness-wide ones, drop the kept contexts whose idle period passed the retention, then start or end
+     * the idle periods of the kept contexts in `scopes`. A task change can change the idleness only of the conversations
+     * above it, so no check visits every conversation.
+     */
+    #settleIdle(scopes) {
+        const all = scopes === undefined || this.#unknownsChanged;
+        this.#unknownsChanged = false;
+        if (all)
+            this.#fullIdleChecks++;
+        this.#resolveIdleWaiters(all ? undefined : scopes);
         const now = this.#now();
         const retention = this.#contextRetentionMs();
-        for (const [conversationId, kept] of this.#contexts) {
-            if (kept.idleSince !== undefined && now - kept.idleSince >= retention) {
-                this.#contexts.delete(conversationId);
-            }
-            else if (!this.#idle(conversationId)) {
+        // Expired first: a context past its retention is dropped even when the same commit makes it busy again.
+        this.#expireContexts(now, retention);
+        for (const conversationId of all ? [...this.#contexts.keys()] : scopes) {
+            const kept = this.#contexts.get(conversationId);
+            if (kept === undefined)
+                continue;
+            if (!this.#idle(conversationId)) {
+                if (kept.idleSince === undefined)
+                    continue;
                 kept.idleSince = undefined;
+                this.#idleOrder.delete(conversationId);
             }
-            else if (retention > 0) {
-                kept.idleSince ??= now;
+            else if (retention <= 0) {
+                this.#dropContext(conversationId);
             }
-            else {
-                this.#contexts.delete(conversationId);
+            else if (kept.idleSince === undefined) {
+                kept.idleSince = now;
+                kept.expiresAt = now + retention;
+                this.#markIdle(conversationId, now);
             }
         }
         this.#scheduleExpiry();
     }
+    /** Resolve the idle waiters of the conversations in `scopes` (all when undefined) and the Harness-wide ones. */
+    #resolveIdleWaiters(scopes) {
+        for (const conversationId of this.#idleWaiters.keys()) {
+            if (conversationId !== undefined && scopes !== undefined && !scopes.has(conversationId))
+                continue;
+            if (this.#idle(conversationId))
+                this.#idleWaiters.resolve(conversationId);
+        }
+    }
     /**
-     * Run `#settleIdle()` when the earliest idle context expires. The timer is unreferenced, so it never keeps the process
-     * alive. Where timers cannot be unreferenced, as in Cloudflare Workers, none is kept: a pending timer could keep a
-     * Durable Object from being evicted, and eviction frees the contexts. There, task changes alone check expiry.
+     * Drop the kept contexts idle for at least `retention`, oldest first, with the retention setting of now; with no
+     * retention, every idle one, also those whose idle period a clock that went back makes start after now.
      */
-    #scheduleExpiry() {
-        const retention = this.#contextRetentionMs();
-        let at;
-        for (const kept of this.#contexts.values()) {
-            if (kept.idleSince !== undefined && (at === undefined || kept.idleSince + retention < at)) {
-                at = kept.idleSince + retention;
-            }
+    #expireContexts(now, retention) {
+        for (const [conversationId, idleSince] of this.#idleOrder) {
+            if (retention > 0 && now - idleSince < retention)
+                return;
+            this.#dropContext(conversationId);
         }
+    }
+    /**
+     * Start the idle period of a kept context in the expiry order. An idle period older than the newest one kept, which
+     * a clock that went back starts, sorts the order again, and the newest is taken from what is kept then.
+     */
+    #markIdle(conversationId, idleSince) {
+        this.#idleOrder.delete(conversationId);
+        this.#idleOrder.set(conversationId, idleSince);
+        if (this.#idleOrder.size === 1 || idleSince >= this.#idleNewest) {
+            this.#idleNewest = idleSince;
+            return;
+        }
+        const sorted = [...this.#idleOrder].sort((a, b) => a[1] - b[1]);
+        this.#idleOrder.clear();
+        for (const [id, since] of sorted)
+            this.#idleOrder.set(id, since);
+        this.#idleNewest = sorted.at(-1)[1];
+    }
+    /** Forget a kept context, idle or not, and its place in the expiry order. */
+    #dropContext(conversationId) {
+        this.#contexts.delete(conversationId);
+        this.#idleOrder.delete(conversationId);
+    }
+    /**
+     * Drop the expired contexts when the earliest idle context expires, on a background timer, which never keeps the
+     * process alive. Where the host declines it, as the default does in Cloudflare Workers, none is kept: a pending timer
+     * could keep a Durable Object from being evicted, and eviction frees the contexts. There, task changes alone check
+     * expiry.
+     */
+    #scheduleExpiry() {
+        const oldest = this.#idleOrder.values().next();
+        const at = oldest.done === true ? undefined : oldest.value + this.#contextRetentionMs();
         if (this.#expiry !== undefined && this.#expiry.at === at)
             return;
-        if (this.#expiry !== undefined)
-            clearTimeout(this.#expiry.timer);
+        this.#expiry?.disarm();
         this.#expiry = undefined;
         if (at === undefined || this.#closing)
             return;
-        const timer = setTimeout(() => {
+        const disarm = this.#timers.background(() => {
             this.#expiry = undefined;
-            this.#settleIdle();
-        }, Math.min(Math.max(0, at - this.#now()), MAX_TIMER_DELAY));
-        const unref = timer.unref;
-        if (typeof unref !== "function") {
-            clearTimeout(timer);
-            return;
-        }
-        unref.call(timer);
-        this.#expiry = { at, timer };
+            this.#expireContexts(this.#now(), this.#contextRetentionMs());
+            this.#scheduleExpiry();
+        }, at - this.#now());
+        if (disarm !== undefined)
+            this.#expiry = { at, disarm };
     }
     // ─── Ownership ───────────────────────────────────────────────────────────
     #scheduleReconcile() {
-        if (this.#reconcileScheduled || this.#closing)
+        // A read-only reconcile could only fail: what it writes is refused, and its own commits fail the Session.
+        if (this.#reconcileScheduled || this.#closing || this.#readOnly)
             return;
         this.#reconcileScheduled = true;
         queueMicrotask(() => void this.#reconcile());
@@ -437,54 +838,25 @@ export class TaskScheduler {
      */
     async #reconcile() {
         this.#reconcileScheduled = false;
-        const cascade = this.#cascadePending;
-        this.#cascadePending = false;
-        const checks = [...this.#failFastChecks];
-        this.#failFastChecks.clear();
+        const work = this.#reconcileWork();
+        if (work)
+            this.#reconcilingWork++;
         try {
-            await this.#session.commitWith(async (tx) => {
+            await this.#session.commitInternal(async (tx) => {
                 if (this.#closing)
                     return;
+                // A cascade scans the queued inputs, which waits for every unpublished commit: a request made before the scan
+                // is covered by it, and none is published while the job holds the line after it.
+                const cascade = this.#cascadePending;
                 const queued = await this.#loadScopes(cascade);
-                // A cascade from an abandoned owner passes its `restart` reason on; any other intent marks, or upgrades a
-                // `restart` mark, as a request. Collected first, so a request wins over a `restart` mark of the same pass.
-                const marks = new Map();
-                const mark = (record, reason) => {
-                    const staged = marks.get(record.id);
-                    if (staged !== undefined && staged.reason === undefined)
-                        return;
-                    if (record.abortRequested && (record.abortReason === undefined || reason !== undefined))
-                        return;
-                    marks.set(record.id, { record, reason });
-                };
-                // Every live foreground task below a live owner with cancellation intent, which is its nearest one: a walk down
-                // from each owner with intent does not enter another, whose own walk covers what is below it. Derived again on
-                // every pass, as loading edges can reveal a cancelled owner.
-                for (const id of this.#intent) {
-                    const owner = this.#live.get(id);
-                    // Only an owner abandoned after a restart, and nothing else, passes its reason on.
-                    const restart = owner.abortReason === "restart" && !failedOutcome(owner);
-                    for (const { node, live } of this.#walkDown(id, { enter: (below) => !this.#intent.has(below) })) {
-                        if (live !== undefined && !node.background)
-                            mark(live, restart ? "restart" : undefined);
-                    }
-                }
-                for (const id of checks) {
-                    const waiter = this.#live.get(id);
-                    if (waiter?.state.status !== "waiting" || !(await this.#anyFailed(waiter.state.on)))
-                        continue;
-                    // Every other live task: the failed one keeps its own outcome.
-                    for (const member of waiter.state.on) {
-                        const record = this.#live.get(member);
-                        if (record !== undefined && !failedOutcome(record))
-                            mark(record, undefined);
-                    }
-                }
+                if (cascade)
+                    this.#cascadePending = false;
+                const marks = await this.#marks();
                 for (const { record, reason } of marks.values())
                     tx.setTask(withAbortMark(record, reason));
-                for (const id of queued)
-                    if (this.#belowCancelled({ conversation: id }))
-                        await this.#withdrawInputs(tx, id);
+                const withdrawn = await this.#region(() => queued.filter((id) => this.#belowCancelled({ conversation: id })), this.#reloadScopes);
+                for (const id of withdrawn)
+                    await this.#withdrawInputs(tx, id);
                 await this.#finalize(tx);
             }, this.#context);
         }
@@ -493,59 +865,172 @@ export class TaskScheduler {
             // running the pass again, so it fails the Session, which reports it.
             this.#failSession(error);
         }
-        this.#settleIdle();
+        if (work)
+            this.#reconcilingWork--;
+        this.#scheduleWake();
+        // Its commit's task changes were settled at their publication; a waiter that asked for this pass checks again, and
+        // what its chain loads resolved can make any scope idle.
+        if (this.#unknownsChanged) {
+            this.#settleIdle(undefined);
+            return;
+        }
+        this.#resolveIdleWaiters(undefined);
+        // A pass checks expiry too, for hosts that decline the expiry timer.
+        this.#expireContexts(this.#now(), this.#contextRetentionMs());
+        this.#scheduleExpiry();
     }
-    /** Whether any of `ids` holds or ended with an outcome other than `completed`. */
-    async #anyFailed(ids) {
-        for (const id of ids) {
-            const record = this.#live.get(id) ?? (await this.#storage.task(id, this.#context));
-            if (record !== undefined && failedOutcome(record))
-                return true;
+    /**
+     * The abort marks committed records imply (spec §5.4, §5.5): every live foreground task below a live owner with
+     * cancellation intent, which is its nearest one (a walk down from each owner with intent does not enter another,
+     * whose own walk covers what is below it), and every other live task in the `on` of a `failFast` waiter one of whose
+     * tasks failed. A cascade from an abandoned owner passes its `restart` reason on; any other intent marks, or upgrades
+     * a `restart` mark, as a request. Collected first, so a request wins over a `restart` mark of the same pass. Derived
+     * again on every pass, as loading edges can reveal a cancelled owner. Takes the `failFast` checks once its decision
+     * stands.
+     */
+    async #marks() {
+        // Terminal tasks in a checked `on`, read from Storage: each one's outcome is final.
+        const ended = new Map();
+        for (;;) {
+            const plan = await this.#region(() => this.#planMarks(ended), this.#reloadScopes);
+            if ("missing" in plan) {
+                for (const id of plan.missing)
+                    ended.set(id, (await this.#session.lineStorage.task(id, this.#context)) ?? null);
+                continue;
+            }
+            for (const id of plan.checked)
+                this.#failFastChecks.delete(id);
+            return plan.marks;
         }
-        return false;
+    }
+    /** `#marks()`' decision region; the `failFast` members it needs from Storage first, when `ended` lacks them. */
+    #planMarks(ended) {
+        const marks = new Map();
+        // A mark rewrites the whole record, so the record it copies is read as a task record, keyed: a commit of the task
+        // that is not published yet makes the region wait and run again, rather than stage a mark over a stale checkpoint.
+        const mark = (found, reason) => {
+            const record = this.#liveRecord(found.id);
+            const staged = marks.get(record.id);
+            if (staged !== undefined && staged.reason === undefined)
+                return;
+            if (record.abortRequested && (record.abortReason === undefined || reason !== undefined))
+                return;
+            marks.set(record.id, { record, reason });
+        };
+        this.#record(INTENT_KEY);
+        for (const id of this.#intent) {
+            const owner = this.#liveRecord(id);
+            // Only an owner abandoned after a restart, and nothing else, passes its reason on.
+            const restart = owner.abortReason === "restart" && !failedOutcome(owner);
+            for (const { node, live } of this.#walkDown(id, { enter: (below) => !this.#intent.has(below) })) {
+                if (live !== undefined && !node.background)
+                    mark(live, restart ? "restart" : undefined);
+            }
+        }
+        const checked = [...this.#failFastChecks];
+        const missing = [];
+        for (const id of checked) {
+            const waiter = this.#liveRecord(id);
+            if (waiter?.state.status !== "waiting")
+                continue;
+            let failed = false;
+            for (const member of waiter.state.on) {
+                const record = this.#liveRecord(member) ?? ended.get(member);
+                if (record === undefined)
+                    missing.push(member);
+                else if (record !== null && failedOutcome(record))
+                    failed = true;
+            }
+            if (!failed)
+                continue;
+            // Every other live task: the failed one keeps its own outcome.
+            for (const member of waiter.state.on) {
+                const record = this.#liveRecord(member);
+                if (record !== undefined && !failedOutcome(record))
+                    mark(record, undefined);
+            }
+        }
+        return missing.length > 0 ? { missing } : { marks, checked };
+    }
+    /** Whether a reconcile pass would have work: a cascade to derive, held outcomes to check, or `failFast` waits. */
+    #reconcileWork() {
+        return this.#cascadePending || this.#finalizeChecks.size > 0 || this.#failFastChecks.size > 0;
     }
     /**
      * Write the terminal record of every `completing` task without live ordinary owned work. Finalizing one can free its
      * owner, so this repeats over the commit's candidates until nothing changes. A held scheduler outcome gets its
-     * Harness cleanup here.
+     * Harness cleanup here. In rounds, one decision region each: the holders the tasks of one round free are checked once,
+     * in the next, so a holder of many tasks that end together is walked once, not once per task. The first round takes
+     * the `completing` tasks to check once its decision stands.
      */
     async #finalize(tx) {
-        // A worklist: the tasks that started holding, and the holders of work that ended. Finalizing one can free the
-        // nearest live task above it, which goes on the list. Tasks finalized here have no live work below them, so walks
-        // down skip them.
-        // In rounds: the holders the tasks of one round free are checked once, in the next, so a holder of many tasks that
-        // end together is walked once, not once per task.
-        let round = [...this.#finalizeChecks];
-        this.#finalizeChecks.clear();
         const done = new Set();
+        // The commit's candidates, kept in step with the terminal records each round stages.
         const overlay = overlayOf(tx);
-        while (round.length > 0) {
-            const next = new Set();
-            for (const id of round) {
-                const record = overlay.tasks.get(id) ?? this.#live.get(id);
-                if (record?.state.status !== "completing" || done.has(id))
-                    continue;
-                if (this.#hasOwnedLive(id, overlay, done))
-                    continue;
-                const outcome = record.state.outcome;
-                const terminal = withState(record, { status: "terminal", outcome });
+        let round;
+        for (;;) {
+            const ids = round;
+            const plan = await this.#region(() => this.#planRound(ids ?? [...this.#finalizeChecks], overlay, done), this.#reloadScopes);
+            if (ids === undefined)
+                this.#finalizeChecks.clear();
+            for (const { record, terminal } of plan.finalized) {
                 tx.setTask(terminal);
-                overlay.tasks.set(id, terminal);
-                done.add(id);
+                overlay.tasks.set(record.id, terminal);
+                done.add(record.id);
+                const outcome = record.state.outcome;
                 // REMINDER: only the scheduler writes `faulted` and `orphaned` (spec §5.4); their cleanup waits for this commit.
                 if (outcome.status === "faulted" || outcome.status === "orphaned") {
                     await this.#settleOutcome(tx, record, outcome);
                 }
+            }
+            if (plan.next.length === 0)
+                return;
+            round = plan.next;
+        }
+    }
+    /**
+     * One finalize round's decision: which of `ids` are `completing` without live ordinary owned work below them, in the
+     * commit's candidates with the round's own finalizations applied in order, and the holders above them to check next.
+     * Tasks finalized have no live work below them, so walks down skip them. It applies the round's terminal records to
+     * `overlay` while it decides and takes them back before it returns, so a run again starts from the same candidates.
+     */
+    #planRound(ids, overlay, finalized) {
+        const tasks = overlay.tasks;
+        // The tasks finalized so far, earlier rounds' and this one's, without copying the former.
+        const round = new Set();
+        const done = { has: (id) => round.has(id) || finalized.has(id) };
+        const ended = [];
+        const next = new Set();
+        try {
+            for (const id of ids) {
+                const staged = tasks.get(id);
+                const record = staged ?? this.#liveRecord(id);
+                if (record?.state.status !== "completing" || done.has(id))
+                    continue;
+                if (this.#hasOwnedLive(id, overlay, done))
+                    continue;
+                const terminal = withState(record, { status: "terminal", outcome: record.state.outcome });
+                tasks.set(id, terminal);
+                round.add(id);
+                ended.push({ record, terminal, staged: staged !== undefined });
                 const above = this.#nearestLiveAbove(record, overlay);
                 if (above?.state.status === "completing")
                     next.add(above.id);
             }
-            round = [...next];
         }
+        finally {
+            for (const { record, staged } of ended) {
+                if (staged)
+                    tasks.set(record.id, record);
+                else
+                    tasks.delete(record.id);
+            }
+        }
+        return { finalized: ended, next: [...next] };
     }
     /**
      * Load the owner chains of the tasks in `#unloaded` and, with `queued`, of every conversation with queued inputs,
-     * on the Session line; returns the latter. Reads committed Storage directly, so it may run inside a commit callback.
+     * on the Session line; returns the latter. Reads through the line's Storage, so it may run inside a commit callback.
      */
     async #loadScopes(queued) {
         for (const id of [...this.#unloaded]) {
@@ -555,7 +1040,8 @@ export class TaskScheduler {
         }
         if (!queued)
             return [];
-        const submissions = await scanAll((cursor) => this.#storage.scanSubmissions({ status: "queued" }, SCAN_PAGE_SIZE, cursor, this.#context));
+        // A scan, which cannot be keyed: it waits for every unpublished commit.
+        const submissions = await scanAll((cursor) => this.#session.lineStorage.scanSubmissions({ status: "queued" }, SCAN_PAGE_SIZE, cursor, this.#context));
         const inputs = submissions.filter((submission) => submission.type === "input");
         const conversations = [...new Set(inputs.map((submission) => submission.conversationId))];
         for (const id of conversations)
@@ -565,48 +1051,76 @@ export class TaskScheduler {
     /**
      * Load the owner edges and task nodes from `start` up to its ownerless root. A known task outside `#unloaded` ends the
      * walk, as its chain is loaded; the `#unloaded` tasks passed have a loaded chain afterwards. Loading a node can reveal
-     * a cancelled owner, so it makes the next reconcile derive cascade marks.
+     * a cancelled owner, so it makes the next reconcile derive cascade marks. The nodes it installs stay until the job's
+     * commit is published (`#pin()`).
      */
     async #loadChain(start, overlay) {
         const passed = [];
+        let installed = false;
         let at = start;
-        while (at !== undefined) {
-            if ("task" in at) {
-                const id = at.task;
-                let node = this.#live.get(id) ?? this.#settled.get(id);
-                // Created in this commit: the load from its own record covers what is above it.
-                if (node === undefined && overlay?.tasks.has(id) === true)
-                    break;
-                if (node !== undefined && !this.#unloaded.has(id))
-                    break;
-                if (node === undefined) {
-                    const record = await this.#storage.task(id, this.#context);
-                    if (record === undefined)
-                        return;
-                    node = nodeOf(record);
-                    if (record.state.status === "terminal")
-                        this.#settle(id, node);
-                    // A loaded node can reveal a cancelling owner: the next reconcile derives marks again.
-                    this.#scheduleReconcile();
+        try {
+            while (at !== undefined) {
+                if ("task" in at) {
+                    const id = at.task;
+                    let node = this.#live.get(id) ?? this.#settled.get(id);
+                    // Created in this commit: the load from its own record covers what is above it.
+                    if (node === undefined && overlay?.tasks.has(id) === true)
+                        break;
+                    if (node !== undefined && !this.#unloaded.has(id))
+                        break;
+                    if (node === undefined) {
+                        // Through the line's Storage: a task whose creation or end is not published yet waits for it.
+                        const record = await this.#session.lineStorage.task(id, this.#context);
+                        if (record === undefined)
+                            return;
+                        node = nodeOf(record);
+                        if (record.state.status === "terminal") {
+                            this.#settle(id, node);
+                            this.#pin(id);
+                            installed = true;
+                        }
+                        // A loaded node can reveal a cancelling owner: the next reconcile derives marks again.
+                        this.#scheduleReconcile();
+                    }
+                    passed.push(id);
+                    at = parentOf(node);
                 }
-                passed.push(id);
-                at = parentOf(node);
-            }
-            else {
-                let edge = this.#edge(at.conversation, overlay);
-                if (edge === undefined) {
-                    const record = await this.#storage.conversation(at.conversation, this.#context);
-                    edge = record?.owner?.taskId ?? null;
-                    this.#setEdge(at.conversation, edge);
-                    // A loaded node can reveal a cancelling owner: the next reconcile derives marks again.
-                    this.#scheduleReconcile();
+                else {
+                    let edge = this.#edge(at.conversation, overlay);
+                    if (edge === undefined) {
+                        // Through the line's Storage: a conversation whose creation is not published yet waits for it, so a missing
+                        // record is never mistaken for an ownerless one.
+                        const record = await this.#session.lineStorage.conversation(at.conversation, this.#context);
+                        edge = record?.owner?.taskId ?? null;
+                        this.#setEdge(at.conversation, edge);
+                        this.#pin(conversationNode(at.conversation));
+                        installed = true;
+                        // A loaded node can reveal a cancelling owner: the next reconcile derives marks again.
+                        this.#scheduleReconcile();
+                    }
+                    at = edge === null ? undefined : { task: edge };
                 }
-                at = edge === null ? undefined : { task: edge };
+            }
+        }
+        finally {
+            // `#idle()` counts a live task whose chain is not loaded as inside every scope it may be in: what this load
+            // resolved, also when it stopped early, can make such a scope idle without a task change below it.
+            if (passed.some((id) => this.#live.has(id)) || (installed && this.#liveUnloaded())) {
+                this.#unknownsChanged = true;
+                // A waiter such a task held is checked again at the pass's end, also when this load was not a reconcile's.
+                this.#scheduleReconcile();
             }
         }
         for (const id of passed)
             this.#unloaded.delete(id);
     }
+    /** Whether a live task's chain is not loaded yet: one `#idle()` counts as inside every scope it may be in. */
+    #liveUnloaded() {
+        for (const id of this.#unloaded)
+            if (this.#live.has(id))
+                return true;
+        return false;
+    }
     #setEdge(conversationId, owner) {
         this.#edges.set(conversationId, owner);
         // The conversation now hangs from its owner, or is a root; with nothing below it, it waits for the sweep.
@@ -653,7 +1167,8 @@ export class TaskScheduler {
      */
     #sweep() {
         for (const node of this.#dropQueue) {
-            if (this.#below.has(node))
+            // Queued again once its pins go.
+            if (this.#below.has(node) || this.#pins.has(node))
                 continue;
             if (typeof node === "string") {
                 this.#edges.delete(conversationOf(node));
@@ -666,18 +1181,93 @@ export class TaskScheduler {
         }
         this.#dropQueue.clear();
     }
+    /**
+     * Run `decide`, a decision region (group commit §6): synchronous, reading scheduler memory and recording the keys it
+     * reads, staging nothing and changing no scheduler state. When a key it read has an unpublished writer, its result,
+     * or its error, is dropped: once that writer is published, `refresh` reloads what the region needs and it runs
+     * again. A waiting job holds the line, so unpublished writes only shrink, and the runs converge. What a region read
+     * that had no unpublished writer gets none for the rest of the job, so its result stands while the job applies it.
+     */
+    async #region(decide, refresh) {
+        for (;;) {
+            const keys = new Set();
+            this.#reading = keys;
+            let result;
+            try {
+                result = { value: decide() };
+            }
+            catch (error) {
+                result = { error };
+            }
+            finally {
+                this.#reading = undefined;
+            }
+            const gates = [];
+            for (const key of keys) {
+                const gate = this.#session.touch(key);
+                if (gate !== undefined)
+                    gates.push(gate);
+            }
+            if (gates.length === 0) {
+                if ("error" in result)
+                    throw result.error;
+                return result.value;
+            }
+            await Promise.all(gates);
+            await refresh?.();
+        }
+    }
+    /** Load the chains a region walks, again after it waited: what was published meanwhile may list new work. */
+    #reloadScopes = () => this.#loadScopes(false);
+    /** In a decision region, note that it reads `key`; anywhere else, nothing. */
+    #record(key) {
+        this.#reading?.add(key);
+    }
+    /** A live task's committed record, read by a decision region. */
+    #liveRecord(id) {
+        this.#record(taskKey(id));
+        return this.#live.get(id);
+    }
+    /**
+     * Keep `node`, which a chain load of the job on the line installed, until that job's commit is published or fails:
+     * work it creates below the node needs it, and the sweep would drop it as unneeded before then.
+     */
+    #pin(node) {
+        this.#pins.set(node, (this.#pins.get(node) ?? 0) + 1);
+        this.#session.onJobEnd(() => {
+            const count = this.#pins.get(node) - 1;
+            if (count > 0) {
+                this.#pins.set(node, count);
+                return;
+            }
+            this.#pins.delete(node);
+            this.#dropIfUnneeded(node);
+        });
+    }
     /**
      * Bring the scheduler's sets in line with a task's committed record. A task that ended may free the nearest live task
      * above it: one holding its outcome finalizes, an abort-marked one runs its abort handler; its waiters may run.
      */
     #track(previous, record) {
         const id = record.id;
+        const invocation = this.#invocations.get(id);
+        if (invocation !== undefined)
+            invocation.record = record;
+        if (record.state.status === "terminal") {
+            if (previous !== undefined && !this.#closing)
+                this.#countActive(-1, record.kind);
+            this.#resumed.delete(id);
+        }
+        else if (previous === undefined && !this.#closing) {
+            this.#countActive(1, record.kind);
+        }
         if (previous?.state.status === "waiting")
             for (const on of previous.state.on)
                 deleteFrom(this.#waiters, on, id);
         if (record.state.status === "terminal") {
             const node = nodeOf(record);
             this.#live.delete(id);
+            this.#sleeping.delete(id);
             this.#intent.delete(id);
             this.#runnable.delete(id);
             this.#finalizeChecks.delete(id);
@@ -711,6 +1301,10 @@ export class TaskScheduler {
         if (record.state.status === "waiting")
             for (const on of record.state.on)
                 addTo(this.#waiters, on, id);
+        if (record.state.status === "sleeping")
+            this.#sleeping.add(id);
+        else
+            this.#sleeping.delete(id);
     }
     /** The nearest live task above ended ordinary work may be free now: one holding its outcome, or an aborting one. */
     #release(node, overlay) {
@@ -773,11 +1367,12 @@ export class TaskScheduler {
      * at or below a background task holds nothing above it.
      */
     #nearestLiveAbove(node, overlay) {
+        this.#record(INTENT_KEY);
         for (let current = node; !current.background;) {
             const owner = current.owner ?? this.#edge(current.conversationId, overlay);
             if (owner === undefined || owner === null)
                 return undefined;
-            const record = overlay?.tasks.get(owner) ?? this.#live.get(owner);
+            const record = overlay?.tasks.get(owner) ?? this.#liveRecord(owner);
             if (record !== undefined && record.state.status !== "terminal")
                 return record;
             const above = record ?? this.#settled.get(owner);
@@ -797,7 +1392,10 @@ export class TaskScheduler {
     }
     /** Owner task of a conversation, `null` when ownerless, `undefined` while not loaded. */
     #edge(id, overlay) {
-        return overlay?.edges.has(id) === true ? overlay.edges.get(id) : this.#edges.get(id);
+        if (overlay?.edges.has(id) === true)
+            return overlay.edges.get(id);
+        this.#record(conversationKey(id));
+        return this.#edges.get(id);
     }
     #node(id, overlay) {
         return overlay?.tasks.get(id) ?? this.#live.get(id) ?? this.#settled.get(id);
@@ -836,6 +1434,7 @@ export class TaskScheduler {
         const links = overlay === undefined ? undefined : this.#links(overlay);
         const pending = [start];
         for (let at = pending.pop(); at !== undefined; at = pending.pop()) {
+            this.#record(ownedKey(at));
             for (const children of [this.#below.get(at), links?.get(at)]) {
                 for (const child of children ?? []) {
                     if (typeof child === "string") {
@@ -923,6 +1522,7 @@ export class TaskScheduler {
      * edge is not loaded.
      */
     #inScope(start, scope, crossBackground = false) {
+        this.#record(INTENT_KEY);
         for (const step of this.#above(start)) {
             if ("unknown" in step)
                 return undefined;
@@ -945,6 +1545,7 @@ export class TaskScheduler {
     }
     /** The nearest live owner above `start` whose cancellation intent reaches it, if any; see `#belowCancelled`. */
     #cancellingOwner(start) {
+        this.#record(INTENT_KEY);
         // Nothing cancels, the common case: no walk.
         if (this.#intent.size === 0)
             return undefined;
@@ -961,29 +1562,149 @@ export class TaskScheduler {
         }
         return undefined;
     }
+    /**
+     * Count a task in or out of `pi.durable.tasks.active`. Commit observers count at a commit's publication, which must not
+     * throw, so a throwing adapter is reported.
+     */
+    #countActive(delta, kind) {
+        try {
+            this.#activeMetric.add(delta, { task: kind });
+        }
+        catch (error) {
+            this.#report(error, TELEMETRY);
+        }
+    }
     /** Fail the Session, which reports it, for a throw in one of the scheduler's own commits; ignored once closing. */
-    #failSession(error) {
+    #failSession(error, context) {
         if (!this.#closing)
-            this.#session.fail(error);
+            this.#session.fail(error, context);
     }
     /** Close listener: runs synchronously once admission is sealed, before `join()`, or when the Session fails. */
     #seal() {
+        for (const record of this.#live.values())
+            this.#countActive(-1, record.kind);
+        this.#resumed.clear();
         this.#closing = true;
         try {
             this.#unsubscribeRegistry();
         }
         catch (error) {
-            this.#report(error);
+            this.#report(error, REGISTRY);
         }
         const error = closedError(this.#session);
         this.#taskWaiters.rejectAll(error);
         this.#idleWaiters.rejectAll(error);
         this.#contexts.clear();
-        if (this.#expiry !== undefined)
-            clearTimeout(this.#expiry.timer);
+        this.#idleOrder.clear();
+        this.#expiry?.disarm();
         this.#expiry = undefined;
+        this.#timer?.disarm();
+        this.#timer = undefined;
+    }
+    /**
+     * Recompute the wake in a microtask the line never waits for, with no order relative to host commit listeners (one
+     * already queued serves later changes too): arm the built-in timer, or tell `onWake` of a change.
+     */
+    #scheduleWake() {
+        if (this.#wakeScheduled || this.#closing || this.#readOnly)
+            return;
+        this.#wakeScheduled = true;
+        queueMicrotask(() => {
+            this.#wakeScheduled = false;
+            if (this.#closing)
+                return;
+            const wake = this.wake();
+            if (this.#onWake === undefined) {
+                this.#armTimer(this.#enabled ? wake.at : undefined);
+                return;
+            }
+            const last = this.#lastWake;
+            if (last !== undefined && last.active === wake.active && last.at === wake.at)
+                return;
+            try {
+                this.#onWake(wake);
+                // Only a delivered wake counts: after a throw, the next change or kick offers it again.
+                this.#lastWake = wake;
+            }
+            catch (error) {
+                this.#report(error, ON_WAKE);
+            }
+        });
+    }
+    /**
+     * Keep the timer for the earliest sleep. It keeps the process alive, unlike the context expiry timer: a process with a
+     * sleeping task has work left, such as a retry backoff. Rechecks the clock when it fires, so a wake before `until`
+     * only arms it again.
+     */
+    #armTimer(at) {
+        if (this.#timer !== undefined && this.#timer.at === at)
+            return;
+        this.#timer?.disarm();
+        this.#timer = undefined;
+        if (at === undefined || this.#closing)
+            return;
+        const disarm = this.#timers.foreground(() => {
+            this.#timer = undefined;
+            this.#wakeDue();
+            this.#kick();
+        }, at - this.#now());
+        this.#timer = { at, disarm };
+    }
+    /** Make every sleeping task whose time has come a reservation candidate. */
+    #wakeDue() {
+        for (const id of this.#sleeping) {
+            const record = this.#live.get(id);
+            if (record !== undefined && !this.#notDue(record))
+                this.#runnable.add(id);
+        }
+    }
+    /**
+     * The report info of a task's failure, with the extension that installed its definition: the code that failed is
+     * that extension's. Built-in tasks have none.
+     */
+    /** What a report about `task`'s own code says of it: the task, and the extension that installed its definition. */
+    #aboutTask(task) {
+        let extension;
+        if ("extension" in task)
+            extension = task.extension;
+        else {
+            try {
+                const snapshot = this.#registry.snapshot();
+                extension = installerOf(snapshot, snapshot.task(task.kind));
+            }
+            catch {
+                // A registry that throws is reported where it is read for scheduling; a report goes out without the name.
+            }
+        }
+        return { task: reportTask(task), ...optionalExtension(extension) };
+    }
+    /** `settings.restartLimit`, or the default when the host's settings throw. */
+    #restartLimit() {
+        try {
+            return this.#settings().restartLimit;
+        }
+        catch (error) {
+            this.#report(error, SETTINGS);
+            return DEFAULT_RESTART_LIMIT;
+        }
+    }
+    #notifyBlocked() {
+        for (const listener of [...this.#blockedListeners]) {
+            try {
+                listener();
+            }
+            catch (error) {
+                this.#report(error, { kind: "listener_error" });
+            }
+        }
+    }
+    /** A sleep whose `until` the clock has not reached; an abort mark ends a sleep. */
+    #notDue(record) {
+        const state = record.state;
+        return state.status === "sleeping" && !record.abortRequested && state.until > this.#now();
     }
     #kick() {
+        this.#scheduleWake();
         this.#dirty = true;
         if (this.#draining || !this.#enabled || this.#closing)
             return;
@@ -1016,45 +1737,57 @@ export class TaskScheduler {
      */
     async #reserve() {
         const reservations = [];
+        const faulted = [];
         let abandoned = [];
         try {
-            await this.#session.commitWith(async (tx) => {
+            await this.#session.commitInternal(async (tx) => {
                 if (!this.#enabled || this.#closing)
                     return;
-                for (const id of this.#abandoned) {
-                    const record = this.#live.get(id);
-                    if (record !== undefined && !record.abortRequested)
-                        tx.setTask(withAbortMark(record, "restart"));
-                }
                 if (this.#abandoned.size > 0) {
-                    abandoned = [...this.#abandoned];
+                    const ids = [...this.#abandoned];
+                    const unmarked = await this.#region(() => ids
+                        .map((id) => this.#liveRecord(id))
+                        .filter((record) => record !== undefined && !record.abortRequested));
+                    for (const record of unmarked)
+                        tx.setTask(withAbortMark(record, "restart"));
+                    abandoned = ids;
                     return;
                 }
                 await this.#loadScopes(false);
+                // Every pass picks up sleeps whose time has come: a pass started by any change may be the first to run after
+                // a deadline, and the wake it schedules no longer keeps a timer for a due sleep.
+                this.#wakeDue();
+                const plan = await this.#region(() => this.#planReservation(), this.#reloadScopes);
+                for (const id of plan.dropped)
+                    this.#runnable.delete(id);
+                // Work below an owner with cancellation intent waits for its cascade mark instead of running a phase; schedule
+                // the cascade, which may not have run yet.
+                if (plan.cascade) {
+                    this.#cascadePending = true;
+                    this.#scheduleReconcile();
+                }
                 // Taken once per pass, and only when some task is a candidate.
                 let snapshot;
-                for (const id of [...this.#runnable]) {
-                    const record = this.#live.get(id);
-                    if (record === undefined || record.state.status === "completing" || this.#invocations.has(id)) {
-                        this.#runnable.delete(id);
-                        continue;
-                    }
-                    // It returns once what it waits for ends, its record changes, or the work below it ends.
-                    if (this.#waitingOn(record, true).length > 0) {
-                        this.#runnable.delete(id);
-                        continue;
-                    }
-                    const runnable = record;
+                for (const record of plan.ready) {
+                    const id = record.id;
                     const mode = record.abortRequested ? "abort" : "run";
-                    // Work below an owner with cancellation intent waits for its cascade mark instead of running a phase; schedule
-                    // the cascade, which may not have run yet.
-                    if (mode === "run" && !record.background && this.#belowCancelled(parentOf(record))) {
-                        this.#cascadePending = true;
-                        this.#scheduleReconcile();
+                    // Work cut off `restartLimit` times in a row would run forever: an abort handler, or a phase of a kind that
+                    // does not end itself at the limit, ends the task `faulted` instead.
+                    // The settings are read only for a task that was cut off at all.
+                    const cutOff = record.restarts !== undefined && record.restarts >= this.#restartLimit();
+                    if (cutOff && (mode === "abort" || !this.#limitsRestarts(record.kind))) {
+                        const message = mode === "abort"
+                            ? `Abort handler of task ${id} (${record.kind}) was cut off ${record.restarts} times`
+                            : `Task ${id} (${record.kind}) was cut off ${record.restarts} times without progress`;
+                        await this.#terminate(tx, record, {
+                            status: "faulted",
+                            error: { message, detail: { reason: "restart_limit" } },
+                        });
+                        faulted.push({ record, message });
                         continue;
                     }
                     snapshot ??= this.#registry.snapshot();
-                    const resolution = this.#resolve(runnable, snapshot);
+                    const resolution = this.#resolve(record, snapshot);
                     if (resolution.kind === "blocked") {
                         // An abandoned task waits for its definition, so its abort handler can clean up.
                         if (mode === "abort" && record.abortReason === undefined) {
@@ -1062,7 +1795,7 @@ export class TaskScheduler {
                         }
                         continue;
                     }
-                    if (resolution.record !== runnable || record.state.status !== "running") {
+                    if (resolution.record !== record || record.state.status !== "running") {
                         tx.setTask(withState(resolution.record, {
                             status: "running",
                             checkpoint: resolution.record.state.checkpoint,
@@ -1071,7 +1804,7 @@ export class TaskScheduler {
                     // Registered on the line, so marks and later reservations see it and close joins it; `#end` makes it a
                     // candidate again.
                     this.#runnable.delete(id);
-                    const invocation = this.#createInvocation(record, mode);
+                    const invocation = this.#createInvocation(record, mode, installerOf(snapshot, resolution.task));
                     reservations.push({ invocation, task: resolution.task, snapshot });
                 }
             }, this.#context);
@@ -1084,6 +1817,13 @@ export class TaskScheduler {
             }
             throw error;
         }
+        for (const { record, message } of faulted) {
+            this.#report(new Error(message), {
+                kind: "task_faulted",
+                ...this.#aboutTask(recordTask(record)),
+                reason: "restart_limit",
+            });
+        }
         // Marked, or already marked or gone: done with them. Reserve again, now seeing the marks.
         for (const id of abandoned)
             this.#abandoned.delete(id);
@@ -1091,6 +1831,39 @@ export class TaskScheduler {
             this.#dirty = true;
         return reservations;
     }
+    /**
+     * A reservation pass's decision region: the candidates it drops (gone, holding, waiting, asleep, or with an
+     * invocation), whether one waits for a cascade, and the runnable records to resolve. Iterating the candidates is not
+     * keyed: a pass that misses a task a pending commit makes runnable only delays it, as does skipping one with an
+     * invocation without reading its record, or a waiter's check whether what it waits on is still live.
+     */
+    #planReservation() {
+        const dropped = [];
+        const ready = [];
+        let cascade = false;
+        for (const id of this.#runnable) {
+            if (this.#invocations.has(id)) {
+                dropped.push(id);
+                continue;
+            }
+            const record = this.#liveRecord(id);
+            // It returns once what it waits for ends, its record changes, or the work below it ends; a sleep at the first pass
+            // after its time comes, which the timer, `resume()`, or any change starts.
+            if (record === undefined ||
+                record.state.status === "completing" ||
+                this.#waitingOn(record, true).length > 0 ||
+                this.#notDue(record)) {
+                dropped.push(id);
+                continue;
+            }
+            if (!record.abortRequested && !record.background && this.#belowCancelled(parentOf(record))) {
+                cascade = true;
+                continue;
+            }
+            ready.push(record);
+        }
+        return { dropped, cascade, ready };
+    }
     /**
      * Live tasks a task waits for before its next invocation: its live ordinary owned work when abort-marked, since
      * abort runs bottom-up, otherwise the live part of the `on` of a wait.
@@ -1123,7 +1896,11 @@ export class TaskScheduler {
         }
         catch (error) {
             this.#failedMigrations.set(record.id, { task: fit.task, error });
-            this.#report(error);
+            // Blocked now without a commit: the graph and the host's wake must hear it.
+            queueMicrotask(() => this.#notifyBlocked());
+            this.#scheduleWake();
+            const extension = installerOf(snapshot, fit.task);
+            this.#report(error, { kind: "migration_failed", ...this.#aboutTask({ ...recordTask(record), extension }) });
             return { kind: "blocked", reason: "migration_failed" };
         }
     }
@@ -1153,6 +1930,36 @@ export class TaskScheduler {
             roots: this.#roots.size,
             unloaded: this.#unloaded.size,
             dropQueue: this.#dropQueue.size,
+            pins: this.#pins.size,
+        };
+    }
+    /**
+     * The kept contexts' idle state, for tests (a diagnostic, computed on demand): how many are kept and how many are
+     * idle, how many disagree with a full recompute (an idle period without `#idle()`, or `#idle()` without one; an
+     * expiry order that differs from the idle periods, or is not sorted), and how many idle checks covered every scope.
+     */
+    get idleState() {
+        let mismatches = 0;
+        let idle = 0;
+        for (const [conversationId, kept] of this.#contexts) {
+            if (kept.idleSince !== undefined)
+                idle++;
+            if ((kept.idleSince !== undefined) !== this.#idle(conversationId))
+                mismatches++;
+            if (this.#idleOrder.get(conversationId) !== kept.idleSince)
+                mismatches++;
+        }
+        let previous = Number.NEGATIVE_INFINITY;
+        for (const [conversationId, idleSince] of this.#idleOrder) {
+            if (idleSince < previous || this.#contexts.get(conversationId)?.idleSince !== idleSince)
+                mismatches++;
+            previous = idleSince;
+        }
+        return {
+            contexts: this.#contexts.size,
+            idleContexts: idle,
+            idleMismatches: mismatches,
+            fullIdleChecks: this.#fullIdleChecks,
         };
     }
     /**
@@ -1161,6 +1968,7 @@ export class TaskScheduler {
      * cannot exist, shows as failed.
      */
     async inspect(snapshot) {
+        await this.#published();
         await this.#loadScopes(false);
         const tasks = [];
         for (const record of this.#live.values())
@@ -1176,24 +1984,31 @@ export class TaskScheduler {
         const on = this.#waitingOn(record);
         if (on.length > 0)
             return { kind: "waiting", on };
+        if (this.#notDue(record))
+            return { kind: "sleeping", until: record.state.until };
         const fit = this.#fit(record, snapshot.task(record.kind));
         if ("reason" in fit)
             return { kind: "blocked", ...fit };
         if (fit.migrates && fit.task.definition.migrate === undefined) {
             return { kind: "blocked", reason: "migration_failed", error: missingMigration(record, erased(fit.task)) };
         }
-        return { kind: "ready", migrates: fit.migrates };
+        return { kind: "pending", migrates: fit.migrates };
     }
-    #createInvocation(record, mode) {
+    #createInvocation(record, mode, extension) {
         const controller = new AbortController();
         const { promise: done, resolve: finish } = Promise.withResolvers();
         const invocation = {
             taskId: record.id,
+            kind: record.kind,
+            extension,
             conversationId: record.conversationId,
             mode,
             controller,
+            links: record.startedAt === undefined ? record.links : undefined,
             context: withAbortSignal(controller.signal, this.#context),
+            record: record,
             watches: new Set(),
+            timers: new Set(),
             ended: false,
             done,
             finish: () => finish(),
@@ -1211,10 +2026,13 @@ export class TaskScheduler {
                     await this.#runAbort(reservation);
             }
             catch (error) {
-                this.#report(error);
+                this.#report(error, { kind: "task_error", ...this.#aboutTask(invocation) }, invocation.context);
             }
             finally {
                 this.#end(invocation);
+                invocation.record = undefined;
+                invocation.links = undefined;
+                invocation.fault = undefined;
                 invocation.finish();
                 this.#kick();
             }
@@ -1226,61 +2044,128 @@ export class TaskScheduler {
         const state = { task: reservation.task, snapshot: reservation.snapshot, reported: undefined };
         const phase = { snapshot: () => state.snapshot, task: () => state.task, agent: undefined };
         const runtime = this.#runtime(invocation, phase);
-        let previous;
-        for (;;) {
-            const current = await this.#step(invocation, (tx, current) => this.#decide(tx, current, previous, state));
-            // Close may seal between the decision and dispatch.
-            if (current === undefined || this.#closing)
-                return;
-            const checkpoint = current.state.checkpoint;
-            // Each phase handler resolves its agent afresh, at first use.
-            phase.agent = undefined;
+        const progress = (tx, current) => this.#progress(tx, current, state, invocation.extension, invocation.context);
+        let current = await this.#step(invocation, (task) => this.#rules(task, undefined), progress);
+        while (current !== undefined && !this.#closing) {
+            const task = current;
+            current = await this.#phase(invocation, task, async () => {
+                const checkpoint = task.state.checkpoint;
+                // Each phase handler resolves its agent afresh, at first use.
+                phase.agent = undefined;
+                let previous;
+                try {
+                    await erased(state.task).phases[checkpoint.phase](task, runtime, invocation.context);
+                    previous = { checkpoint };
+                }
+                catch (error) {
+                    previous = { checkpoint, failure: { error } };
+                }
+                return this.#step(invocation, (next) => this.#rules(next, previous), progress);
+            });
+        }
+    }
+    /** A phase owns its decision commit, not the next handler, a durable wait, or recovery. */
+    #phase(invocation, task, run) {
+        const parent = task.trace === undefined
+            ? this.#telemetry
+            : (this.#telemetry.propagation?.extract(task.trace) ?? this.#telemetry);
+        const checkpoint = task.state.checkpoint;
+        const attempt = checkpoint.attempt;
+        const resumed = this.#resumed.delete(task.id);
+        return createTypedSpanStarter(parent, [DURABLE_TELEMETRY_SCHEMA])("pi.durable.phase", {
+            "task.id": task.id,
+            "task.name": task.kind,
+            phase: checkpoint.phase,
+            kind: invocation.mode,
+            resumed,
+            ...(attempt === undefined ? {} : { attempt }),
+        }, async (span) => {
+            if (span.propagation !== undefined && invocation.links !== undefined) {
+                for (const carrier of invocation.links)
+                    span.addLink({ context: span.propagation.extract(carrier) });
+            }
+            const previous = invocation.context;
+            invocation.context = withTelemetry(span, previous);
+            const started = performance.now();
             try {
-                await erased(state.task).phases[checkpoint.phase](current, runtime, invocation.context);
-                previous = { checkpoint };
+                return await run();
             }
-            catch (error) {
-                previous = { checkpoint, failure: { error } };
+            finally {
+                invocation.context = previous;
+                const state = invocation.record.state;
+                const terminal = invocation.fault ??
+                    (state.status === "terminal" || state.status === "completing" ? state.outcome : undefined);
+                const outcome = terminal !== undefined
+                    ? terminal.status === "completed"
+                        ? "done"
+                        : terminal.status === "aborted"
+                            ? "aborted"
+                            : "faulted"
+                    : state.status === "waiting" || state.status === "sleeping"
+                        ? state.status
+                        : invocation.ended || this.#closing
+                            ? "aborted"
+                            : `next=${state.checkpoint.phase}`;
+                span.setAttributes({ outcome });
+                if (terminal?.status === "faulted" || terminal?.status === "failed" || terminal?.status === "orphaned") {
+                    const message = terminal.status === "orphaned" ? terminal.reason : terminal.error.message;
+                    span.setStatus({
+                        status: "error",
+                        error: { name: `task_${terminal.status}`, message: ownedSlice(message, 0, 500) },
+                    });
+                }
+                else if (outcome === "aborted") {
+                    span.setStatus({ status: "ok" });
+                }
+                this.#durationMetric.record(performance.now() - started, { task: task.kind, phase: checkpoint.phase, outcome }, span);
             }
-        }
+        });
     }
     /**
-     * Precedence rules for a run invocation, on the line. Rules 1 (terminal, `completing`, or `waiting`) and 2 (closing)
-     * are applied by `#step`. Returns whether the invocation continues with the next phase.
+     * Precedence rules for a run invocation, a decision region of its step. Rules 1 (terminal, `completing`, `waiting`, or
+     * `sleeping`) and 2 (closing) are applied by `#step`. Progress (rule 5) is decided by `#progress()` once the decision
+     * stands, as it takes a registry snapshot.
      */
-    #decide(tx, current, previous, state) {
+    #rules(current, previous) {
         // 3. abort mark: end; a fresh abort invocation starts once the task's ordinary owned work is gone.
         if (current.abortRequested)
-            return false;
+            return END;
         // An owner's cancellation intent ends it too, before its cascade marks it; reservation then holds it back.
-        if (!current.background && this.#belowCancelled(parentOf(current))) {
-            this.#cascadePending = true;
-            this.#scheduleReconcile();
-            return false;
-        }
+        if (!current.background && this.#belowCancelled(parentOf(current)))
+            return CASCADE;
         if (previous === undefined)
-            return true;
+            return CONTINUE;
         // 4. uncaught error.
         if (previous.failure !== undefined)
-            return { fault: previous.failure.error };
+            return { kind: "fault", error: previous.failure.error };
         // 6. no durable progress.
         if (jsonEqual(current.state.checkpoint, previous.checkpoint)) {
             const message = `Task ${current.kind} phase ${previous.checkpoint.phase} returned without durable progress`;
-            return { fault: new Error(message) };
+            return { kind: "fault", error: new Error(message) };
         }
-        // 5. progress: refresh the snapshot; hand over to a replacement definition that can take the task.
+        return PROGRESS;
+    }
+    /**
+     * Rule 5, progress: refresh the snapshot; hand over to a replacement definition that can take the task, writing it
+     * back as `pending`, or keep running under the old one, reported once per resolved definition. Returns whether the
+     * invocation continues.
+     */
+    #progress(tx, current, state, extension, context) {
         state.snapshot = this.#registry.snapshot();
         const next = state.snapshot.task(current.kind);
-        if (next !== state.task) {
-            if (next !== undefined && canReserve(next, current)) {
-                tx.setTask(withState(current, { status: "pending", checkpoint: current.state.checkpoint }));
-                return false;
-            }
-            if (state.reported === undefined || state.reported.task !== next) {
-                state.reported = { task: next };
-                const cause = next === undefined ? "missing_task" : "incompatible_task";
-                this.#report(new Error(`Task ${current.id} keeps running under its old ${current.kind} definition`, { cause }));
-            }
+        if (next === state.task)
+            return true;
+        if (next !== undefined && canReserve(next, current)) {
+            tx.setTask(withState(current, { status: "pending", checkpoint: current.state.checkpoint }));
+            return false;
+        }
+        if (state.reported === undefined || state.reported.task !== next) {
+            state.reported = { task: next };
+            this.#report(new Error(`Task ${current.id} keeps running under its old ${current.kind} definition`), {
+                kind: "task_outdated",
+                ...this.#aboutTask({ ...recordTask(current), extension }),
+                reason: outdatedReason(next, current),
+            }, context);
         }
         return true;
     }
@@ -1290,45 +2175,72 @@ export class TaskScheduler {
         const current = this.#live.get(invocation.taskId);
         if (current === undefined || this.#closing)
             return;
-        let failure;
-        try {
-            const phase = { snapshot: () => reservation.snapshot, task: () => reservation.task, agent: undefined };
-            const runtime = this.#runtime(invocation, phase);
-            await erased(reservation.task).abort(current, runtime, invocation.context);
-        }
-        catch (error) {
-            failure = { error };
-        }
-        const message = `Abort handler of task ${invocation.taskId} returned without a terminal outcome`;
-        await this.#step(invocation, () => ({ fault: failure?.error ?? new Error(message) }));
+        await this.#phase(invocation, current, async () => {
+            let failure;
+            try {
+                const phase = {
+                    snapshot: () => reservation.snapshot,
+                    task: () => reservation.task,
+                    agent: undefined,
+                };
+                const runtime = this.#runtime(invocation, phase);
+                await erased(reservation.task).abort(current, runtime, invocation.context);
+            }
+            catch (error) {
+                failure = { error };
+            }
+            const message = `Abort handler of task ${invocation.taskId} returned without a terminal outcome`;
+            await this.#step(invocation, () => ({ kind: "fault", error: failure?.error ?? new Error(message) }));
+        });
     }
     /**
-     * One synchronous decision on the Session line. A task that is no longer running (rule 1: terminal, `completing`, or
-     * `waiting`) or a closing Harness (rule 2) ends the invocation without a write; otherwise `decide` may stage a write
-     * and returns whether the invocation continues. Ending happens inside the callback, before a fault's Harness
-     * cleanup. A rejected step, such as admission after close, also ends the invocation.
+     * One decision on the Session line, before a phase: a decision region (`#region()`) that reads the task's record. A
+     * task that is no longer running (rule 1: terminal, `completing`, `waiting`, or `sleeping`) or a closing Harness (rule
+     * 2) ends the invocation without a write; otherwise `plan` decides, and a decision that stands is applied: the
+     * invocation continues, with `progress` for rule 5, or ends, with a fault written. Ending happens inside the callback,
+     * before a fault's Harness cleanup. A rejected step, such as admission after close, also ends the invocation. Its
+     * outcome goes to the invocation only, so it is a scheduler commit (`commitInternal()`).
      */
-    async #step(invocation, decide) {
+    async #step(invocation, plan, progress) {
+        let fault;
         try {
-            return await this.#session.commitWith(async (tx) => {
-                const found = this.#live.get(invocation.taskId);
-                const current = found?.state.status === "running" ? found : undefined;
-                const decision = current !== undefined && !this.#closing ? decide(tx, current) : false;
-                if (decision === true)
+            const continued = await this.#session.commitInternal(async (tx) => {
+                const decided = await this.#region(() => {
+                    const found = this.#liveRecord(invocation.taskId);
+                    if (found?.state.status !== "running" || this.#closing)
+                        return { plan: END };
+                    const current = found;
+                    return { current, plan: plan(current) };
+                });
+                const { current } = decided;
+                const step = decided.plan;
+                if (step.kind === "continue")
+                    return current;
+                if (step.kind === "progress" && progress(tx, current))
                     return current;
                 this.#end(invocation);
-                if (decision !== false) {
-                    const message = errorMessage(decision.fault);
-                    await this.#terminate(tx, current, { status: "faulted", error: { message } });
+                if (step.kind === "cascade") {
+                    this.#cascadePending = true;
+                    this.#scheduleReconcile();
+                }
+                if (step.kind === "fault") {
+                    fault = { error: step.error };
+                    const message = errorMessage(step.error);
+                    invocation.fault = { status: "faulted", error: { message } };
+                    await this.#terminate(tx, current, invocation.fault);
                 }
                 return undefined;
-            }, this.#context);
+            }, withoutAbortSignal(invocation.context));
+            // Reported once the fault is durable: a host may count it, for example toward a breaker.
+            if (fault !== undefined)
+                this.#report(fault.error, { kind: "task_faulted", ...this.#aboutTask(invocation), reason: "threw" }, invocation.context);
+            return continued;
         }
         catch (error) {
             // The step writes the scheduler's own decision, a fault or a terminal record; a throw there would otherwise
             // leave the task running, to be reserved and run again.
             this.#end(invocation);
-            this.#failSession(error);
+            this.#failSession(error, invocation.context);
             return undefined;
         }
     }
@@ -1338,7 +2250,7 @@ export class TaskScheduler {
      */
     async #terminate(tx, record, outcome) {
         await this.#loadScopes(false);
-        if (this.#hasOwnedLive(record.id, overlayOf(tx))) {
+        if (await this.#region(() => this.#hasOwnedLive(record.id, overlayOf(tx)), this.#reloadScopes)) {
             tx.setTask(withState(record, { status: "completing", outcome }));
             return;
         }
@@ -1353,17 +2265,22 @@ export class TaskScheduler {
     async #commitState(tx, invocation, current, next) {
         if (next.status === "waiting")
             await this.#validateWait(tx, invocation, current, next.on, next.policy);
+        if (next.status === "sleeping")
+            validateSleep(invocation, current.id, next.until);
         if (next.status === "terminal") {
             const overlay = overlayOf(tx);
             await this.#loadScopes(false);
             for (const record of overlay.tasks.values())
                 await this.#loadChain(parentOf(record), overlay);
-            if (this.#hasOwnedLive(current.id, overlay)) {
-                tx.setTask(withState(current, { status: "completing", outcome: next.outcome }));
+            if (await this.#region(() => this.#hasOwnedLive(current.id, overlayOf(tx)), this.#reloadScopes)) {
+                tx.setTask(withState(progressed(current), { status: "completing", outcome: next.outcome }));
                 return;
             }
         }
-        tx.setTask(withState(current, next));
+        // A state the task committed that differs from its current one is progress: its restart count starts over. The
+        // same checkpoint committed again, for example as intent before an effect, is not.
+        const same = jsonEqual(current.state, next);
+        tx.setTask(withState(same ? current : progressed(current), next));
     }
     /**
      * A wait names existing tasks, and `failFast` only tasks the waiter owns. It may not close a cycle in the wait-for
@@ -1376,37 +2293,64 @@ export class TaskScheduler {
     async #validateWait(tx, invocation, current, on, policy) {
         if (invocation.mode === "abort")
             throw new Error(`Abort handler of task ${current.id} cannot wait`);
-        const overlay = overlayOf(tx);
+        // Owned work is found by walks down, which need the chains of every live task loaded.
+        await this.#loadScopes(false);
+        // Tasks in `on` that are not live, read from Storage: terminal, or missing.
+        const ended = new Map();
+        for (;;) {
+            const checked = await this.#region(() => this.#checkWait(current, on, policy, overlayOf(tx), ended), this.#reloadScopes);
+            if (checked === undefined)
+                return;
+            if ("missing" in checked) {
+                for (const id of checked.missing)
+                    ended.set(id, (await this.#session.lineStorage.task(id, this.#context)) ?? null);
+                continue;
+            }
+            throw checked.error;
+        }
+    }
+    /**
+     * `#validateWait()`'s decision region: why the wait is refused, `undefined` when it may be stored, or the tasks in
+     * `on` it needs from Storage first, when `ended` lacks them.
+     */
+    #checkWait(current, on, policy, overlay, ended) {
         const targets = [];
+        const missing = [];
         for (const id of on) {
-            const member = overlay.tasks.get(id) ?? this.#live.get(id) ?? (await this.#storage.task(id, this.#context));
-            if (member === undefined)
-                throw new Error(`Task ${id} does not exist`);
+            const member = overlay.tasks.get(id) ?? this.#liveRecord(id) ?? ended.get(id);
+            if (member === undefined) {
+                missing.push(id);
+                continue;
+            }
+            if (member === null)
+                return { error: new Error(`Task ${id} does not exist`) };
             if (policy === "failFast" && member.owner !== current.id) {
-                throw new Error(`Task ${current.id} can wait failFast only on tasks it owns; ${id} is not one`);
+                return { error: new Error(`Task ${current.id} can wait failFast only on tasks it owns; ${id} is not one`) };
             }
             // A live child already holds the waiter (task-owned tasks are never background): waiting on it adds no edge. A
             // terminal task has no edges.
             if (member.state.status !== "terminal" && member.owner !== current.id)
                 targets.push(id);
         }
+        if (missing.length > 0)
+            return { missing };
         if (targets.length === 0)
-            return;
-        const cycle = await this.#waitCycle(current.id, targets, overlay);
-        if (cycle !== undefined) {
-            throw new Error(`Task ${current.id} cannot wait on ${cycle[0]}: ${[current.id, ...cycle].join(" -> ")} is a wait cycle`);
-        }
+            return undefined;
+        const cycle = this.#waitCycle(current.id, targets, overlay);
+        if (cycle === undefined)
+            return undefined;
+        return {
+            error: new Error(`Task ${current.id} cannot wait on ${cycle[0]}: ${[current.id, ...cycle].join(" -> ")} is a wait cycle`),
+        };
     }
     /**
      * The path from a member of `on` back to `task` in the wait-for graph, if the wait would close a cycle (spec §5.1).
      * An edge X -> Y means X cannot settle before Y: Y is in the `on` of waiting X that is not abort-marked, or Y is live
-     * ordinary owned work of X,
-     * which holds X as `completing`. Each task is visited once and each subtree walked once, so a check is bounded by the
-     * live work it reaches.
+     * ordinary owned work of X, which holds X as `completing`. Each task is visited once and each subtree walked once,
+     * so a check is bounded by the live work it reaches. Part of a decision region: it records every record it reads.
+     * Owned work is found by walks down, which need the chains of every live task loaded.
      */
-    async #waitCycle(task, on, overlay) {
-        // Owned work is found by walks down, which need the chains of every live task loaded.
-        await this.#loadScopes(false);
+    #waitCycle(task, on, overlay) {
         const from = new Map();
         const walked = new Set();
         const pending = [];
@@ -1427,7 +2371,7 @@ export class TaskScheduler {
         for (let id = pending.pop(); id !== undefined; id = pending.pop()) {
             if (id === task)
                 return path(id);
-            const record = overlay.tasks.get(id) ?? this.#live.get(id);
+            const record = overlay.tasks.get(id) ?? this.#liveRecord(id);
             if (record === undefined || record.state.status === "terminal")
                 continue;
             // An abort-marked task waits only for its owned work, as abort runs bottom-up (`#waitingOn`).
@@ -1464,12 +2408,18 @@ export class TaskScheduler {
         }
         for (const watch of invocation.watches)
             void watch.stop();
+        for (const disarm of invocation.timers)
+            disarm();
+        invocation.timers.clear();
         // Pending waits bound to the invocation, such as a tool's waitForTask(), reject with it.
         invocation.controller.abort(endedError(invocation));
     }
     /** No live non-background task in the scope; a task whose owner edges are not loaded yet counts as inside. */
     #idle(conversationId) {
         const scope = conversationId === undefined ? { roots: true } : { conversation: conversationId };
+        // In a decision region, global idle reads the roots it starts from.
+        if (conversationId === undefined)
+            this.#record(ROOTS_KEY);
         // Tasks whose chain is not loaded are not listed below their scope yet; one counts as inside unless its walk up
         // decides otherwise.
         for (const id of this.#unloaded) {
@@ -1501,7 +2451,7 @@ export class TaskScheduler {
         };
         const hooks = {
             each: async (name, invoke) => {
-                for (const handlers of agentHooks(await agent(), phase.task().definition.name)) {
+                for (const { extension, handlers } of agentHooks(await agent(), phase.task().definition.name)) {
                     const handler = handlers[name];
                     if (typeof handler !== "function")
                         continue;
@@ -1511,17 +2461,20 @@ export class TaskScheduler {
                     catch (error) {
                         if (invocation.controller.signal.aborted)
                             throw error;
-                        this.#report(error);
+                        this.#report(error, { kind: "extension_error", extension, task: reportTask(invocation) }, invocation.context);
                     }
                 }
             },
         };
         const settings = this.#settings;
+        const models = this.#models;
         return {
             taskId: invocation.taskId,
             conversationId: invocation.conversationId,
             signal: invocation.controller.signal,
-            models: this.#models,
+            get models() {
+                return models();
+            },
             agent: (context) => invocation.ended ? Promise.reject(endedError(invocation)) : awaitWithContext(agent(), context),
             get settings() {
                 return settings();
@@ -1531,11 +2484,46 @@ export class TaskScheduler {
             get registry() {
                 return phase.snapshot();
             },
-            commit: (change, context) => this.#gated(invocation, async (tx, current) => {
-                const next = await change(tx, current);
-                if (next !== undefined)
-                    await this.#commitState(tx, invocation, current, next);
-            }, context),
+            commit: async (change, context, options) => {
+                let checkpoint;
+                let interrupted;
+                await this.#gated(invocation, async (tx, current) => {
+                    const next = await change(tx, current);
+                    if (next !== undefined)
+                        await this.#commitState(tx, invocation, current, next);
+                    if (next?.status === "running" && current.state.checkpoint.phase !== next.checkpoint.phase) {
+                        checkpoint = next.checkpoint.phase;
+                    }
+                    // A task that ends for crashes says so (`task_interrupted`), so a host keeps a crash-loop signal.
+                    if (next?.status === "terminal") {
+                        const restarts = current.restarts ?? 0;
+                        const reason = next.outcome.status === "failed" ? interruptionOf(next.outcome.error) : undefined;
+                        if (reason !== undefined && next.outcome.status === "failed") {
+                            interrupted = { message: next.outcome.error.message, reason, restarts };
+                        }
+                        else {
+                            // A task that ended for crashes with another outcome says so itself, as a generation whose run
+                            // answered ends `completed` without its after-run tasks.
+                            const message = endedByCrashesStates.get(next);
+                            if (message !== undefined)
+                                interrupted = { message, reason: "restart_limit", restarts };
+                        }
+                    }
+                }, context, options);
+                if (interrupted !== undefined) {
+                    this.#report(new Error(interrupted.message), {
+                        kind: "task_interrupted",
+                        ...this.#aboutTask(invocation),
+                        reason: interrupted.reason,
+                        restarts: interrupted.restarts,
+                    }, invocation.context);
+                }
+                if (checkpoint !== undefined) {
+                    invocation.context.telemetry.addEvent("pi.durable.checkpoint", {
+                        phase: checkpoint,
+                    });
+                }
+            },
             memo: ((name, ...rest) => {
                 if (rest.length === 1) {
                     return this.#read(invocation, async () => memoOf(this.#live.get(invocation.taskId), name));
@@ -1549,11 +2537,11 @@ export class TaskScheduler {
                     return candidate;
                 }, rest[1]);
             }),
-            sleep: (until, context) => this.#sleep(invocation, until, context),
+            sleepUntil: (until, checkpoint, context) => this.#gated(invocation, (tx, current) => this.#commitState(tx, invocation, current, { status: "sleeping", checkpoint, until }), context),
             watchDoc: ((...args) => this.#watchDoc(invocation, args)),
             snapshot: ((...args) => this.#read(invocation, () => sessionMethod(this.#session, "snapshot")(...args))),
             snapshotAsOf: ((...args) => this.#read(invocation, () => sessionMethod(this.#session, "snapshotAsOf")(...args))),
-            getTask: ((id, context) => this.#read(invocation, () => this.#session.readOnLine(() => this.#storage.task(id, context)))),
+            getTask: ((id, context) => this.#read(invocation, () => this.#session.readOnLine((storage) => storage.task(id, context)))),
             waitForTask: ((id, context) => this.#read(invocation, () => this.waitForTask(id, withAbortSignal(invocation.controller.signal, context)))),
             ownedTasks: (context) => this.#read(invocation, () => this.#session.readOnLine(async () => {
                 // The step that ends the invocation may have run on the line before this.
@@ -1561,12 +2549,16 @@ export class TaskScheduler {
                     throw endedError(invocation);
                 context.abortSignal?.throwIfAborted();
                 // Every live task is listed under its parent node, its owner task when it has one.
-                const owned = [];
-                for (const node of this.#below.get(invocation.taskId) ?? []) {
-                    const record = typeof node === "string" ? undefined : this.#live.get(node);
-                    if (record?.owner === invocation.taskId)
-                        owned.push(record);
-                }
+                const owned = await this.#region(() => {
+                    this.#record(ownedKey(invocation.taskId));
+                    const records = [];
+                    for (const node of this.#below.get(invocation.taskId) ?? []) {
+                        const record = typeof node === "string" ? undefined : this.#liveRecord(node);
+                        if (record?.owner === invocation.taskId)
+                            records.push(record);
+                    }
+                    return records;
+                });
                 // Copies, as from storage: the scheduler reads its own.
                 return owned
                     .sort((a, b) => a.id - b.id)
@@ -1574,7 +2566,7 @@ export class TaskScheduler {
             })),
             abortOwned: (id, context) => this.#read(invocation, async () => {
                 const bound = withAbortSignal(invocation.controller.signal, context);
-                const record = await this.#session.readOnLine(() => this.#storage.task(id, bound));
+                const record = await this.#session.readOnLine((storage) => storage.task(id, bound));
                 if (record?.owner !== invocation.taskId) {
                     throw new Error(`Task ${id} is not owned by task ${invocation.taskId}`);
                 }
@@ -1583,10 +2575,10 @@ export class TaskScheduler {
                 await this.abort(id, bound, true);
                 await this.waitForTask(id, bound);
             }),
-            outcomes: ((ids, context) => this.#read(invocation, () => this.#session.readOnLine(async () => {
+            outcomes: ((ids, context) => this.#read(invocation, () => this.#session.readOnLine(async (storage) => {
                 const outcomes = [];
                 for (const id of ids) {
-                    const state = (await this.#storage.task(id, context))?.state;
+                    const state = (await storage.task(id, context))?.state;
                     if (state?.status !== "terminal")
                         throw new Error(`Task ${id} is not terminal`);
                     outcomes.push(state.outcome);
@@ -1605,13 +2597,24 @@ export class TaskScheduler {
                     ? [undefined, args[0], args[1]]
                     : [args[0], args[1], args[2]];
                 return this.#read(invocation, async () => {
-                    const found = await this.#session.readOnLine(() => this.#storage.entry(invocation.conversationId, id, context));
-                    const entry = found?.entry;
+                    // An entry of the conversation's kept context range is committed and visible: no Storage read.
+                    const kept = this.#contexts.get(invocation.conversationId);
+                    const entry = (kept === undefined ? undefined : rangeEntry(kept.range, id)) ??
+                        (await this.#session.readOnLine((storage) => storage.entry(invocation.conversationId, id, context)))
+                            ?.entry;
                     return token === undefined || entry?.kind === token.kind ? entry : undefined;
                 });
             }),
+            entries: (query, limit, cursor, context) => this.#read(invocation, () => this.#session.readOnLine((storage) => storage.scanEntries(conversationEntries(invocation.conversationId, query), limit, cursor, context))),
             context: (conversationId, context, options) => this.#read(invocation, async () => {
-                const { view, range } = await readContextFrom(this.#session, this.#storage, conversationId, context, options?.at, this.#contexts.get(conversationId)?.range);
+                const read = await readContextFrom(this.#session, this.#storage, conversationId, context, options?.at, this.#contexts.get(conversationId)?.range);
+                const { view } = read;
+                // Checked again here, synchronously up to the install below: a commit published since the read returned
+                // was not seen by `#advanceContexts`, so a range that missed it must not be advanced.
+                const range = read.range?.current === true &&
+                    this.#session.knownLatestEntryId(conversationId) !== read.range.bounds.tail
+                    ? { ...read.range, current: false }
+                    : read.range;
                 // Keep it unless the invocation ended or a concurrent read already kept a newer range.
                 const kept = this.#contexts.get(conversationId);
                 if (range !== undefined &&
@@ -1621,9 +2624,17 @@ export class TaskScheduler {
                     // A read of another, idle conversation starts or continues its retention period.
                     if (!this.#idle(conversationId)) {
                         this.#contexts.set(conversationId, { range, idleSince: undefined });
+                        this.#idleOrder.delete(conversationId);
                     }
                     else if (this.#contextRetentionMs() > 0) {
-                        this.#contexts.set(conversationId, { range, idleSince: kept?.idleSince ?? this.#now() });
+                        // An idle period that already started keeps its expiry and its place; a new one starts now.
+                        const idleSince = kept?.idleSince ?? this.#now();
+                        const expiresAt = kept?.idleSince !== undefined && kept.expiresAt !== undefined
+                            ? kept.expiresAt
+                            : idleSince + this.#contextRetentionMs();
+                        this.#contexts.set(conversationId, { range, idleSince, expiresAt });
+                        if (kept?.idleSince === undefined)
+                            this.#markIdle(conversationId, idleSince);
                         this.#scheduleExpiry();
                     }
                 }
@@ -1634,13 +2645,43 @@ export class TaskScheduler {
                     throw endedError(invocation);
                 return this.#now();
             },
-            report: (error) => {
+            setTimer: (callback, delayMs) => {
+                // An ended invocation's timers never fire.
+                if (invocation.ended)
+                    return () => { };
+                const disarm = this.#timers.foreground(() => {
+                    invocation.timers.delete(disarm);
+                    if (!invocation.ended)
+                        callback();
+                }, delayMs);
+                invocation.timers.add(disarm);
+                return () => {
+                    invocation.timers.delete(disarm);
+                    disarm();
+                };
+            },
+            report: (error, from) => {
                 if (invocation.ended)
                     throw endedError(invocation);
-                this.#report(error);
+                // The task's own failure names the task's extension; any other names whose code failed, if anyone's.
+                const task = reportTask(invocation);
+                this.#report(error, from === undefined
+                    ? { kind: "task_error", ...this.#aboutTask(invocation) }
+                    : from.kind === "extension"
+                        ? { kind: "extension_error", task, ...optionalExtension(from.extension) }
+                        : { kind: "host_error", callback: from.callback, task }, invocation.context);
             },
         };
     }
+    /**
+     * On the line: wait until every commit admitted before is published, for a decision that reads what cannot be keyed,
+     * every live task (open, inspection) or every task a conversation abort reaches.
+     */
+    async #published() {
+        const gate = this.#session.touch(ALL_KEYS);
+        if (gate !== undefined)
+            await gate;
+    }
     /** Run a committed-state read unless the invocation has ended. */
     async #read(invocation, read) {
         if (invocation.ended)
@@ -1648,7 +2689,7 @@ export class TaskScheduler {
         return read();
     }
     /** Commit after rereading the task on the line and gating the invocation. */
-    #gated(invocation, change, context) {
+    #gated(invocation, change, context, options) {
         if (invocation.ended)
             return Promise.reject(endedError(invocation));
         return this.#session.commitWith(async (tx) => {
@@ -1656,33 +2697,22 @@ export class TaskScheduler {
                 throw endedError(invocation);
             if (this.#closing)
                 throw closedError(this.#session);
-            const found = this.#live.get(invocation.taskId);
-            if (found === undefined)
-                throw new Error(`Task ${invocation.taskId} is terminal`);
-            if (found.state.status !== "running")
-                throw new Error(`Task ${invocation.taskId} is ${found.state.status}`);
-            const current = found;
-            if (invocation.mode === "run" && current.abortRequested) {
-                throw new Error(`Task ${invocation.taskId} has a durable abort mark`);
-            }
+            const current = await this.#region(() => {
+                const found = this.#liveRecord(invocation.taskId);
+                if (found === undefined)
+                    throw new Error(`Task ${invocation.taskId} is terminal`);
+                if (found.state.status !== "running")
+                    throw new Error(`Task ${invocation.taskId} is ${found.state.status}`);
+                if (invocation.mode === "run" && found.abortRequested) {
+                    throw new Error(`Task ${invocation.taskId} has a durable abort mark`);
+                }
+                return found;
+            });
+            // The step that ends it may have run while the region waited.
+            if (invocation.ended)
+                throw endedError(invocation);
             return change(tx, current);
-        }, context, { conversationId: invocation.conversationId, taskId: invocation.taskId });
-    }
-    /** Wait until the Harness clock reaches `until`, rechecking it after every timer. */
-    async #sleep(invocation, until, context) {
-        if (invocation.ended)
-            throw endedError(invocation);
-        const signals = [invocation.controller.signal];
-        if (context.abortSignal !== undefined)
-            signals.push(context.abortSignal);
-        const signal = AbortSignal.any(signals);
-        for (;;) {
-            signal.throwIfAborted();
-            const remaining = until - this.#now();
-            if (remaining <= 0)
-                return;
-            await delay(Math.min(remaining, MAX_TIMER_DELAY), signal);
-        }
+        }, context, { conversationId: invocation.conversationId, taskId: invocation.taskId }, options);
     }
     async #watchDoc(invocation, args) {
         if (invocation.ended)
@@ -1699,15 +2729,64 @@ export class TaskScheduler {
         return watch;
     }
 }
-/** The record with an abort mark: `restart` for an abandonment; without a reason, a request, which replaces `restart`. */
+const REGISTRY = { kind: "host_error", callback: "registry" };
+const SETTINGS = { kind: "host_error", callback: "settings" };
+const ON_WAKE = { kind: "host_error", callback: "onWake" };
+const TELEMETRY = { kind: "host_error", callback: "telemetry" };
+/** The extension that installed `task` in `snapshot`, the last one that lists it; none for a built-in task. */
+function installerOf(snapshot, task) {
+    if (task === undefined)
+        return undefined;
+    return snapshot.installed().findLast((installed) => installed.tasks?.includes(task) === true)?.name;
+}
+/** The report info of a failure of a task. */
+function reportTask(task) {
+    return { id: task.taskId, kind: task.kind, conversationId: task.conversationId };
+}
+/** A stored task's identity, as an invocation names it. */
+function recordTask(record) {
+    return { taskId: record.id, kind: record.kind, conversationId: record.conversationId };
+}
+/**
+ * The record with an abort mark: `restart` for an abandonment; without a reason, a request, which replaces `restart`.
+ * The restart count starts over: it now counts cut-offs of the abort handler.
+ */
+/** Why a failed outcome's error says crashes ended the task (`detail.reason`), if it does. */
+/**
+ * Terminal states a built-in task commits because it was cut off `settings.restartLimit` times, when their outcome does
+ * not say so (a failure with detail `{ reason: "restart_limit" }` does), with the message the scheduler reports them
+ * `task_interrupted` with. Keyed by the state object the task returns, so nothing is added to the stored state.
+ */
+const endedByCrashesStates = new WeakMap();
+/** `state`, marked as ending its task for crashes (`task_interrupted` with `message`), whatever its outcome. */
+export function endedByCrashes(state, message) {
+    endedByCrashesStates.set(state, message);
+    return state;
+}
+function interruptionOf(error) {
+    const detail = error.detail;
+    if (typeof detail !== "object" || detail === null || !("reason" in detail))
+        return undefined;
+    return detail.reason === "restart_limit" || detail.reason === "interrupted" ? detail.reason : undefined;
+}
 function withAbortMark(record, reason) {
-    const { abortReason: _reason, ...rest } = record;
+    const { abortReason: _reason, restarts: _restarts, ...rest } = record;
     return { ...rest, abortRequested: true, ...(reason === undefined ? {} : { abortReason: reason }) };
 }
 /** A live owner's durable cancellation intent: its abort mark, or a held outcome other than `completed`. */
 function cancellationIntent(record) {
     return record.state.status !== "terminal" && (record.abortRequested || failedOutcome(record));
 }
+/**
+ * Whether replacing `previous` (absent: a new task) with `next` changes the cancellation intent set or what it means: a
+ * mark set, upgraded, or cleared, or a held or ended outcome other than `completed`.
+ */
+function intentChanges(previous, next) {
+    return ((previous?.abortRequested ?? false) !== next.abortRequested ||
+        previous?.abortReason !== next.abortReason ||
+        (previous !== undefined && failedOutcome(previous)) !== failedOutcome(next) ||
+        (previous !== undefined && cancellationIntent(previous)) !== cancellationIntent(next));
+}
 /** Whether the record holds or ends with an outcome other than `completed`. */
 function failedOutcome(record) {
     const state = record.state;
@@ -1761,30 +2840,41 @@ function erased(task) {
 function endedError(invocation) {
     return new Error(`Task ${invocation.taskId} invocation has ended`);
 }
-/** Replace a live record's state; memos disappear once an outcome is decided. */
+/** The record without its restart count, as after a state the task committed. */
+function progressed(record) {
+    if (record.restarts === undefined)
+        return record;
+    const { restarts: _restarts, ...rest } = record;
+    return rest;
+}
+/** Replace a live record's state; memos and the restart count disappear once an outcome is decided. */
 function withState(record, state) {
     if (state.status !== "terminal" && state.status !== "completing")
         return { ...record, state };
-    const { memos: _memos, ...rest } = record;
+    const { memos: _memos, restarts: _restarts, ...rest } = record;
     return { ...rest, state };
 }
 /** Whether a definition can take the task at reservation: same version, or newer with a migration. */
+/**
+ * Why a replacement definition cannot take a running task, in `#fit()`'s words: none is registered, it is older than
+ * the task, or it is newer without a `migrate`.
+ */
+function outdatedReason(task, record) {
+    if (task === undefined)
+        return "missing_task";
+    return task.definition.version < record.version ? "task_too_old" : "migration_failed";
+}
 function canReserve(task, record) {
     const definition = task.definition;
     return (definition.version === record.version || (definition.version > record.version && definition.migrate !== undefined));
 }
-function delay(ms, signal) {
-    return new Promise((resolve, reject) => {
-        const onAbort = () => {
-            clearTimeout(timer);
-            reject(signal.reason);
-        };
-        const timer = setTimeout(() => {
-            signal.removeEventListener("abort", onAbort);
-            resolve();
-        }, ms);
-        signal.addEventListener("abort", onAbort, { once: true });
-    });
+/** A sleep's `until` is a time on the Harness clock; an abort handler cannot sleep. */
+function validateSleep(invocation, task, until) {
+    if (invocation.mode === "abort")
+        throw new Error(`Abort handler of task ${task} cannot sleep`);
+    if (typeof until !== "number" || !Number.isFinite(until) || until < 0) {
+        throw new Error(`Task ${task} cannot sleep until ${until}: not a time in milliseconds`);
+    }
 }
 /** Structural equality of two JSON values; object key order is ignored. */
 function jsonEqual(left, right) {