@earendil-works/pi-durable 1.4.0 → 1.5.1

package/dist/harness/scheduler.js

@@ -1,12 +1,15 @@
-import { copyJson } from "@earendil-works/chord";
-import { awaitWithContext, withAbortSignal, withoutAbortSignal, withTelemetry } from "@earendil-works/chord/context";
+import { awaitWithContext, withAbortSignal, withoutAbortSignal, withTelemetry, } from "@earendil-works/chord/context";
+import { ownedSlice } from "@earendil-works/chord/delta";
+import { copyJson } from "@earendil-works/chord/json";
 import { createTypedMetrics, createTypedSpanStarter, NOOP_TELEMETRY_CONTEXT, NOOP_TELEMETRY_METRICS, } from "@earendil-works/pi-telemetry";
-import { errorMessage } from "../errors.js";
+import { errorMessage, ReadOnlySession } from "../errors.js";
+import { ALL_KEYS, conversationKey, INTENT_KEY, ownedKey, ROOTS_KEY, taskKey } from "../session/keys.js";
 import { agentHooks, DEFAULT_RESTART_LIMIT } from "./agent.js";
-import { readContextFrom } from "./context.js";
+import { advanceRange, rangeEntry, readContextFrom } from "./context.js";
 import { DURABLE_TELEMETRY_SCHEMA } from "./telemetry.js";
-import { closedError, optionalExtension, scanAll, Waiters } from "./util.js";
+import { closedError, conversationEntries, optionalExtension, scanAll, Waiters } from "./util.js";
 const SCAN_PAGE_SIZE = 256;
+const NO_KEYS = [];
 const LIVE_STATUSES = ["pending", "running", "waiting", "sleeping", "completing"];
 /** The part of a record `blockedReason()` reads. */
 export function blockedSubject(record) {
@@ -16,10 +19,17 @@ export function blockedSubject(record) {
         version: record.version,
         abortRequested: record.abortRequested,
         ...(record.abortReason === undefined ? {} : { abortReason: record.abortReason }),
-        ...(record.restarts === undefined ? {} : { restarts: record.restarts }),
         status: record.state.status,
     };
 }
+/** Continue with the next phase, the first one. */
+const CONTINUE = { kind: "continue" };
+/** Rule 5: the phase made durable progress; `#progress()` decides once the decision stands. */
+const PROGRESS = { kind: "progress" };
+/** End the invocation without a write. */
+const END = { kind: "end" };
+/** End it: an owner's cancellation intent reaches it before its cascade did; schedule the cascade. */
+const CASCADE = { kind: "cascade" };
 function conversationNode(id) {
     return `c${id}`;
 }
@@ -48,9 +58,16 @@ function parentNode(node) {
  * later below a dropped node finds it unknown and loads its chain from storage again.
  *
  * Invariant: every task transition is decided and written by one callback serialized on the Session line. That covers
- * reservation, marks, runtime commits, finalization, and the synchronous step before each phase, which applies the
- * precedence rules and writes a fault or handover. Handlers and joins run off the line. An invocation ends inside the
- * step that decides its end, so a runtime commit it queued either lands before that decision or is rejected.
+ * reservation, marks, runtime commits, finalization, and the step before each phase, which applies the precedence rules
+ * and writes a fault or handover. Handlers and joins run off the line. An invocation ends inside the step that decides
+ * its end, so a runtime commit it queued either lands before that decision or is rejected.
+ *
+ * Decisions stay serialized; their storage overlaps (group commit). The Session stores the commits of several jobs in
+ * one call while the line runs on, and this memory changes only as each commit is published. So every decision reads
+ * it in a decision region (`#region()`): synchronous, recording the keys it reads (a task's record, the live work below
+ * a node, the cancellation intent set), staging nothing; when one of them has an unpublished writer, the region waits
+ * for its publication and runs again, and only a region that read nothing unpublished is applied. Every commit writes
+ * the memberships its task changes alter (`membershipKeys()`), so a walk that a pending commit would change waits.
  */
 export class TaskScheduler {
     #telemetry;
@@ -70,6 +87,7 @@ export class TaskScheduler {
     #writeAtClose;
     #report;
     #settleOutcome;
+    #limitsRestarts;
     #withdrawInputs;
     #conversation;
     #context;
@@ -80,6 +98,20 @@ export class TaskScheduler {
      * first idle check after `settings.contextRetentionMs` of idleness, and at close.
      */
     #contexts = new Map();
+    /**
+     * The idle kept contexts by `idleSince`, oldest first: the expiry order, so neither an expiry nor finding the next one
+     * scans `#contexts`. Kept sorted also when the Harness clock goes back (see `#markIdle`).
+     */
+    #idleOrder = new Map();
+    /** At least the newest `idleSince` in `#idleOrder` (drops do not lower it): an older one added means the clock went back. */
+    #idleNewest = Number.NEGATIVE_INFINITY;
+    /**
+     * A chain load resolved what `#idle()` treats as unknown for a live task whose chain is not loaded, which can make a
+     * scope idle without a task change below it; the next idle check then covers every scope.
+     */
+    #unknownsChanged = false;
+    /** Idle checks that covered every scope (`idleState`, a test diagnostic). */
+    #fullIdleChecks = 0;
     /** Background timer for the earliest expiry of an idle context, unless the host declined it (see `#scheduleExpiry`). */
     #expiry;
     #invocations = new Map();
@@ -107,9 +139,15 @@ export class TaskScheduler {
     #unloaded = new Set();
     /** Live tasks with cancellation intent, the sources of abort cascades (spec §5.4). */
     #intent = new Set();
-    /** Live tasks that are not `completing`, the candidates of a reservation pass; ones found waiting leave it. */
+    /**
+     * Live tasks that are not `completing`, the candidates of a reservation pass; ones found waiting leave it. A pass
+     * takes the set while it plans, so a task made a candidate meanwhile is not dropped by its stale decision.
+     */
     #runnable = new Set();
-    /** `completing` tasks the next finalize pass checks: those that started holding, and holders of ended work. */
+    /**
+     * `completing` tasks the next finalize pass checks: those that started holding, and holders of ended work. A pass
+     * takes them before it plans, so a check asked for meanwhile stays for the next pass.
+     */
     #finalizeChecks = new Set();
     /** Live waiting tasks by each task in their `on`. */
     #waiters = new Map();
@@ -133,15 +171,21 @@ export class TaskScheduler {
     #blockedListeners = new Set();
     /** A registry snapshot that threw for the task graph was reported; it is read per record, so only once. */
     #snapshotReported = false;
-    /** Tasks a pass left out as parked; each pass checks them again, as `settings.restartLimit` may have risen. */
-    #parkedTasks = new Set();
     #reconcileScheduled = false;
     /** Reconcile passes underway with work (they may overlap): their commits finalize held outcomes and mark cascades. */
     #reconcilingWork = 0;
     #sweepScheduled = false;
+    /**
+     * Nodes chain loads installed for jobs whose commits are not published yet, with how many such jobs: the sweep keeps
+     * them, as work a pending commit creates below them needs them.
+     */
+    #pins = new Map();
+    /** Keys the decision region underway reads (`#region()`); set only while one runs. */
+    #reading;
     #cascadePending = false;
     #unsubscribeRegistry = () => { };
     #enabled = false;
+    #readOnly;
     #closing = false;
     #dirty = false;
     #draining = false;
@@ -163,24 +207,26 @@ export class TaskScheduler {
         this.#writeAtClose = options.writeAtClose;
         this.#report = options.report;
         this.#settleOutcome = options.settleOutcome;
+        this.#limitsRestarts = options.limitsRestarts;
         this.#withdrawInputs = options.withdrawInputs;
         this.#conversation = options.conversation;
         this.#context = options.context;
+        this.#readOnly = options.readOnly === true;
     }
     /**
-     * Load live tasks and change surviving `running` tasks back to `pending`, counting the restart. Dispatches nothing. A
-     * task that reaches the restart limit this way is parked and reported.
+     * Load live tasks and change surviving `running` tasks back to `pending`, counting the restart. Dispatches nothing;
+     * a task cut off `settings.restartLimit` times ends when it is next reserved. Read-only, it only loads them: a
+     * `running` task stays as committed, running in another process.
      */
     async open(context) {
-        this.#session.observeCommits((publication) => this.#observe(publication));
+        this.#session.followCommits((publication) => this.#observe(publication));
         this.#session.subscribeClose(() => this.#seal());
         this.#unsubscribeRegistry = this.#registry.subscribe(() => {
             this.#notifyBlocked();
             this.#kick();
         });
-        const limit = this.#restartLimit();
-        const parked = [];
         await this.#session.commitWith(async (tx) => {
+            await this.#published();
             // Every table read before the first write.
             const scans = [];
             for (const status of LIVE_STATUSES) {
@@ -190,14 +236,14 @@ export class TaskScheduler {
                 for (const record of records) {
                     this.#track(undefined, record);
                     this.#resumed.add(record.id);
+                    if (this.#readOnly)
+                        continue;
                     if (record.abandonOnRestart === true)
                         this.#abandoned.add(record.id);
                     if (record.state.status === "running") {
                         const restarts = (record.restarts ?? 0) + 1;
                         const pending = withState(record, { status: "pending", checkpoint: record.state.checkpoint });
                         tx.setTask({ ...pending, restarts });
-                        if (restarts >= limit && !record.abortRequested)
-                            parked.push(record);
                     }
                     if (record.state.status === "waiting" && record.state.policy === "failFast") {
                         this.#failFastChecks.add(record.id);
@@ -205,11 +251,8 @@ export class TaskScheduler {
                 }
             }
         }, context);
-        for (const record of parked) {
-            const restarts = (record.restarts ?? 0) + 1;
-            const error = new Error(`Task ${record.id} (${record.kind}) was cut off ${restarts} times without progress; it is parked until retryTask()`);
-            this.#report(error, { type: "task_parked", ...this.#aboutTask(recordTask(record)) });
-        }
+        if (this.#readOnly)
+            return;
         // Derive abort marks a crash left unapplied below cancelled owners, and finalize held outcomes.
         this.#cascadePending = true;
         this.#scheduleReconcile();
@@ -220,29 +263,15 @@ export class TaskScheduler {
      * Idempotent; the kick does nothing once closing.
      */
     resume() {
+        if (this.#readOnly)
+            throw new ReadOnlySession("running tasks");
         this.#enabled = true;
         this.#wakeDue();
         this.#kick();
     }
     /**
-     * Run a task parked by the restart limit again: clears its restart count and enables scheduling. Does nothing for a
-     * task that is not parked; rejects for an unknown one.
-     */
-    async retry(id, context) {
-        await this.#session.commitWith(async (tx) => {
-            const current = await tx.task(id);
-            if (current === undefined)
-                throw new Error(`Task ${id} does not exist`);
-            const status = current.state.status;
-            if (status === "terminal" || status === "completing" || !this.#parked(current))
-                return;
-            tx.setTask(progressed(current));
-        }, context);
-        this.resume();
-    }
-    /**
-     * Why a live task cannot run here, if it cannot: its definition (missing, too old, failed migration) or the restart
-     * limit. A running task, an abort-marked one, and one holding its outcome are never blocked.
+     * Why a live task cannot run here, if it cannot: its definition is missing, too old, or failed to migrate. A running
+     * task, an abort-marked one, and one holding its outcome are never blocked.
      */
     blockedReason(record) {
         const status = record.status;
@@ -251,8 +280,6 @@ export class TaskScheduler {
         // An abort request runs its handler or orphans the task; a `restart` mark waits for the definition, blocked.
         if (record.abortRequested && record.abortReason === undefined)
             return undefined;
-        if (this.#parked(record))
-            return "restart_limit";
         let snapshot;
         try {
             snapshot = this.#registry.snapshot();
@@ -278,11 +305,26 @@ export class TaskScheduler {
      * sleep not yet due. Synchronous, from memory; a task whose chain is not loaded yet counts as it would alone.
      */
     wake() {
+        // A read-only Harness runs nothing, so it never needs a process.
+        if (this.#readOnly)
+            return { active: false };
         const now = this.#now();
         // A reconcile pass with work to do is work too: it finalizes held outcomes and marks cascades, at open as
         // recovery. A process that dies before it lands must be woken again. A pass with nothing to do is not.
-        let active = this.#invocations.size > 0 || this.#reconcilingWork > 0 || this.#reconcileWork();
+        const active = this.#invocations.size > 0 || this.#reconcilingWork > 0 || this.#reconcileWork() || this.#runsNow(now);
+        // The earliest sleep not yet due: only `#sleeping` holds sleeping tasks, so no pass visits every live task.
         let at;
+        for (const id of this.#sleeping) {
+            const record = this.#live.get(id);
+            const state = record?.state;
+            if (state?.status === "sleeping" && !record.abortRequested && state.until > now) {
+                at = at === undefined ? state.until : Math.min(at, state.until);
+            }
+        }
+        return at === undefined ? { active } : { active, at };
+    }
+    /** Whether a live task can run now: the scan `wake()` needs only while no invocation runs. */
+    #runsNow(now) {
         let snapshot;
         let snapshotFailed = false;
         for (const record of this.#live.values()) {
@@ -291,13 +333,7 @@ export class TaskScheduler {
                 continue;
             if (state.status === "waiting" && !record.abortRequested && state.on.some((id) => this.#live.has(id)))
                 continue;
-            if (state.status === "sleeping" && !record.abortRequested && state.until > now) {
-                at = at === undefined ? state.until : Math.min(at, state.until);
-                continue;
-            }
-            if (active)
-                continue;
-            if (this.#parked(record))
+            if (state.status === "sleeping" && !record.abortRequested && state.until > now)
                 continue;
             // An abort invocation waits for the live work below it, which counts itself.
             if (record.abortRequested && this.#waitingOn(record, true).length > 0)
@@ -316,9 +352,9 @@ export class TaskScheduler {
                 if (snapshot !== undefined && "reason" in this.#fit(record, snapshot.task(record.kind)))
                     continue;
             }
-            active = true;
+            return true;
         }
-        return at === undefined ? { active } : { active, at };
+        return false;
     }
     /**
      * Signal every invocation and wait for them, then write the tasks they ran back as `pending` (`writeAtClose`), as a
@@ -363,12 +399,14 @@ export class TaskScheduler {
                 return { result: "marked" };
             if (invocation === undefined && current.state.status !== "completing") {
                 await this.#loadScopes(false);
-                if (!this.#hasOwnedLive(id)) {
-                    const resolution = this.#resolve(current, this.#registry.snapshot());
-                    if (resolution.kind === "blocked") {
-                        await this.#terminate(tx, current, { status: "orphaned", reason: resolution.reason });
-                        return { result: "marked" };
-                    }
+                const owns = await this.#region(() => this.#hasOwnedLive(id), this.#reloadScopes);
+                // Resolved once that decision stands, as it may run `migrate`.
+                const resolution = owns
+                    ? undefined
+                    : this.#resolve(current, this.#registry.snapshot());
+                if (resolution?.kind === "blocked") {
+                    await this.#terminate(tx, current, { status: "orphaned", reason: resolution.reason });
+                    return { result: "marked" };
                 }
             }
             if (!current.abortRequested || current.abortReason !== undefined)
@@ -384,12 +422,13 @@ export class TaskScheduler {
     }
     async waitForTask(id, context) {
         // Check and register on the line so no terminal publication falls between them.
-        const found = await this.#session.readOnLine(async () => {
+        const found = await this.#session.readOnLine(async (storage) => {
             if (this.#closing)
                 throw closedError(this.#session);
-            if (this.#live.has(id))
+            if (await this.#region(() => this.#liveRecord(id) !== undefined)) {
                 return { promise: this.#taskWaiters.add(id, context) };
-            const record = await this.#storage.task(id, context);
+            }
+            const record = await storage.task(id, context);
             if (record === undefined)
                 throw new Error(`Task ${id} does not exist`);
             return { promise: Promise.resolve(record) };
@@ -415,6 +454,7 @@ export class TaskScheduler {
      */
     async abortConversation(conversationId, background, context) {
         const reached = await this.#session.commitWith(async (tx) => {
+            await this.#published();
             const queued = await this.#loadScopes(true);
             const scope = { conversation: conversationId };
             const reached = [];
@@ -437,11 +477,100 @@ export class TaskScheduler {
                 await this.waitForTask(id, context);
         await this.waitForIdle(conversationId, context);
     }
+    /**
+     * The ownership memberships a commit's task and conversation changes write (group commit §4.2), at its admission on
+     * the line: for each task created or made terminal, every node from its parent up to and including the nearest live
+     * task, or the root conversation, and then the roots too, conservatively, as a pending end may unlist the root a
+     * creation finds listed; for each conversation created under a task, that task; and the intent set when
+     * a change sets, upgrades, or clears a mark or a held or ended outcome other than `completed`. Loads the chains it
+     * walks; the nodes it installs stay until the commit is published.
+     */
+    membershipKeys(tx) {
+        const tasks = tx.stagedTasks();
+        const conversations = tx.stagedConversations();
+        if (tasks.length === 0 && conversations.every((record) => record.owner === undefined))
+            return NO_KEYS;
+        return this.#membershipKeys(tx, tasks, conversations);
+    }
+    async #membershipKeys(tx, tasks, conversations) {
+        const keys = new Set();
+        const overlay = overlayOf(tx);
+        const created = new Set(tx.createdTaskIds());
+        const reached = new Map();
+        for (const record of tasks) {
+            if (intentChanges(this.#live.get(record.id), record))
+                keys.add(INTENT_KEY);
+            if (!created.has(record.id) && record.state.status !== "terminal")
+                continue;
+            await this.#loadChain(parentOf(record), overlay);
+            if ((await this.#chainKeys(parentNode(record), overlay, keys, reached)) !== undefined)
+                keys.add(ROOTS_KEY);
+        }
+        for (const conversation of conversations) {
+            const owner = conversation.owner?.taskId;
+            if (owner === undefined)
+                continue;
+            await this.#loadChain({ task: owner }, overlay);
+            await this.#chainKeys(owner, overlay, keys, reached);
+        }
+        return [...keys];
+    }
+    /**
+     * Add the memberships from `start` up to and including the nearest live task, or the root conversation, which it
+     * returns. `reached` keeps, per node walked, where its walk ended, so a chain several tasks of a commit share is
+     * walked once. Whether an ancestor is live can change under a pending commit, so it is read after a touch of the
+     * ancestor's record: a pending end must not stop the chain early. Ownership fields are immutable, so not keyed.
+     */
+    async #chainKeys(start, overlay, keys, reached) {
+        const walked = [];
+        let root;
+        let node = start;
+        while (node !== undefined && node !== null) {
+            const key = ownedKey(node);
+            // Walked up from here already, for another task of the commit.
+            if (reached.has(key)) {
+                root = reached.get(key);
+                break;
+            }
+            keys.add(key);
+            walked.push(key);
+            if (typeof node === "string") {
+                const conversation = conversationOf(node);
+                node = this.#edge(conversation, overlay);
+                if (node === null)
+                    root = conversation;
+                continue;
+            }
+            let record = overlay.tasks.get(node);
+            if (record === undefined) {
+                const gate = this.#session.touch(taskKey(node));
+                if (gate !== undefined) {
+                    await gate;
+                    // It may have ended meanwhile, and its node been swept: load the chain above it again.
+                    await this.#loadChain({ task: node }, overlay);
+                }
+                record = this.#live.get(node);
+            }
+            if (record !== undefined && record.state.status !== "terminal")
+                break;
+            const above = record ?? this.#settled.get(node);
+            node = above === undefined ? undefined : parentNode(above);
+        }
+        for (const key of walked)
+            reached.set(key, root);
+        return root;
+    }
     // ─── Scheduling ────────────────────────────────────────────────────────
     #observe(publication) {
+        // A commit held in memory changes documents only.
+        if (publication.kind === "memory")
+            return;
+        this.#advanceContexts(publication);
         const updated = [];
         const failed = [];
         let changed = false;
+        // The conversations whose idleness the commit's task changes can change; undefined when a chain is not known.
+        let dirty = new Set();
         // Edges first, so the tasks a commit creates in a new conversation hang from it.
         for (const change of publication.changes) {
             if (change.type === "conversation" && !this.#edges.has(change.value.id)) {
@@ -457,6 +586,11 @@ export class TaskScheduler {
             if (failedOutcome(record) && (previous === undefined || !failedOutcome(previous)))
                 failed.push(record.id);
             this.#track(previous, record);
+            // Idleness counts live tasks, so only a task that became live or ended can change it. Collected before `#sweep()`,
+            // which may forget the chain of a task that ended.
+            const liveness = previous === undefined || record.state.status === "terminal";
+            if (liveness && dirty !== undefined && !this.#addScopesAbove(record, dirty))
+                dirty = undefined;
             if (record.state.status === "terminal") {
                 this.#failedMigrations.delete(record.id);
                 this.#failFastChecks.delete(record.id);
@@ -467,10 +601,11 @@ export class TaskScheduler {
             }
             if (record.abortRequested && previous?.abortRequested !== true) {
                 this.#cascadePending = true;
-                // Signal a run invocation of the newly marked task; its next step ends it.
+                // Signal a run invocation of the newly marked task; its next step ends it. Abort listeners are task code, which
+                // never runs inside a publication: the signal follows in a microtask, after host commit listeners.
                 const invocation = this.#invocations.get(record.id);
                 if (invocation?.mode === "run")
-                    invocation.controller.abort();
+                    queueMicrotask(() => invocation.controller.abort());
             }
             // A request replacing a `restart` mark upgrades the marks of the work below.
             if (previous?.abortReason !== undefined && record.abortReason === undefined)
@@ -524,9 +659,60 @@ export class TaskScheduler {
         this.#sweep();
         if (!changed)
             return;
-        this.#settleIdle();
+        this.#settleIdle(dirty);
         this.#kick();
     }
+    /**
+     * Add the conversations above `record` to `scopes`: those whose idleness a change of it can change. False when a node
+     * on the way up is not known. A conversation already in `scopes` has everything above it there too.
+     */
+    #addScopesAbove(record, scopes) {
+        for (const step of this.#above(parentOf(record))) {
+            if ("unknown" in step)
+                return false;
+            if (!("conversation" in step))
+                continue;
+            if (scopes.has(step.conversation))
+                return true;
+            scopes.add(step.conversation);
+        }
+        return true;
+    }
+    /**
+     * Extend each kept context range with the entries a stored commit appended to its conversation, so a later read
+     * needs no Storage scan. Entries are published in ID order.
+     */
+    #advanceContexts(publication) {
+        if (this.#contexts.size === 0)
+            return;
+        let appended;
+        for (const change of publication.changes) {
+            if (change.type !== "entry" || !this.#contexts.has(change.value.conversationId))
+                continue;
+            appended ??= new Map();
+            const entries = appended.get(change.value.conversationId);
+            if (entries === undefined)
+                appended.set(change.value.conversationId, [change.value]);
+            else
+                entries.push(change.value);
+        }
+        if (appended === undefined)
+            return;
+        for (const [conversationId, entries] of appended) {
+            const kept = this.#contexts.get(conversationId);
+            // An idle range past its retention is dropped here too: entry-only commits do not run `#settleIdle()`, and a
+            // host may decline the expiry timer. `expiresAt` was fixed when it went idle, so no settings are read here.
+            if (kept.idleSince !== undefined && kept.expiresAt !== undefined && kept.expiresAt <= this.#now()) {
+                this.#dropContext(conversationId);
+                continue;
+            }
+            const range = advanceRange(kept.range, entries);
+            if (range === undefined)
+                this.#dropContext(conversationId);
+            else
+                kept.range = range;
+        }
+    }
     /**
      * `settings.contextRetentionMs`, or 0 when the host's settings throw. Kept contexts are only a cache, so dropping them
      * is safe, while a throw here would escape commit listeners, reconciliation, and the expiry timer.
@@ -540,43 +726,94 @@ export class TaskScheduler {
             return 0;
         }
     }
-    /** Resolve idle waiters, and drop each kept context whose conversation has been idle for the retention period. */
-    #settleIdle() {
-        for (const conversationId of this.#idleWaiters.keys()) {
-            if (this.#idle(conversationId))
-                this.#idleWaiters.resolve(conversationId);
-        }
+    /**
+     * After task changes below the conversations in `scopes` (every conversation when undefined): resolve their idle
+     * waiters and the Harness-wide ones, drop the kept contexts whose idle period passed the retention, then start or end
+     * the idle periods of the kept contexts in `scopes`. A task change can change the idleness only of the conversations
+     * above it, so no check visits every conversation.
+     */
+    #settleIdle(scopes) {
+        const all = scopes === undefined || this.#unknownsChanged;
+        this.#unknownsChanged = false;
+        if (all)
+            this.#fullIdleChecks++;
+        this.#resolveIdleWaiters(all ? undefined : scopes);
         const now = this.#now();
         const retention = this.#contextRetentionMs();
-        for (const [conversationId, kept] of this.#contexts) {
-            if (kept.idleSince !== undefined && now - kept.idleSince >= retention) {
-                this.#contexts.delete(conversationId);
-            }
-            else if (!this.#idle(conversationId)) {
+        // Expired first: a context past its retention is dropped even when the same commit makes it busy again.
+        this.#expireContexts(now, retention);
+        for (const conversationId of all ? [...this.#contexts.keys()] : scopes) {
+            const kept = this.#contexts.get(conversationId);
+            if (kept === undefined)
+                continue;
+            if (!this.#idle(conversationId)) {
+                if (kept.idleSince === undefined)
+                    continue;
                 kept.idleSince = undefined;
+                this.#idleOrder.delete(conversationId);
             }
-            else if (retention > 0) {
-                kept.idleSince ??= now;
+            else if (retention <= 0) {
+                this.#dropContext(conversationId);
             }
-            else {
-                this.#contexts.delete(conversationId);
+            else if (kept.idleSince === undefined) {
+                kept.idleSince = now;
+                kept.expiresAt = now + retention;
+                this.#markIdle(conversationId, now);
             }
         }
         this.#scheduleExpiry();
     }
+    /** Resolve the idle waiters of the conversations in `scopes` (all when undefined) and the Harness-wide ones. */
+    #resolveIdleWaiters(scopes) {
+        for (const conversationId of this.#idleWaiters.keys()) {
+            if (conversationId !== undefined && scopes !== undefined && !scopes.has(conversationId))
+                continue;
+            if (this.#idle(conversationId))
+                this.#idleWaiters.resolve(conversationId);
+        }
+    }
     /**
-     * Run `#settleIdle()` when the earliest idle context expires, on a background timer, which never keeps the process
-     * alive. Where the host declines it, as the default does in Cloudflare Workers, none is kept: a pending timer could
-     * keep a Durable Object from being evicted, and eviction frees the contexts. There, task changes alone check expiry.
+     * Drop the kept contexts idle for at least `retention`, oldest first, with the retention setting of now; with no
+     * retention, every idle one, also those whose idle period a clock that went back makes start after now.
      */
-    #scheduleExpiry() {
-        const retention = this.#contextRetentionMs();
-        let at;
-        for (const kept of this.#contexts.values()) {
-            if (kept.idleSince !== undefined && (at === undefined || kept.idleSince + retention < at)) {
-                at = kept.idleSince + retention;
-            }
+    #expireContexts(now, retention) {
+        for (const [conversationId, idleSince] of this.#idleOrder) {
+            if (retention > 0 && now - idleSince < retention)
+                return;
+            this.#dropContext(conversationId);
+        }
+    }
+    /**
+     * Start the idle period of a kept context in the expiry order. An idle period older than the newest one kept, which
+     * a clock that went back starts, sorts the order again, and the newest is taken from what is kept then.
+     */
+    #markIdle(conversationId, idleSince) {
+        this.#idleOrder.delete(conversationId);
+        this.#idleOrder.set(conversationId, idleSince);
+        if (this.#idleOrder.size === 1 || idleSince >= this.#idleNewest) {
+            this.#idleNewest = idleSince;
+            return;
         }
+        const sorted = [...this.#idleOrder].sort((a, b) => a[1] - b[1]);
+        this.#idleOrder.clear();
+        for (const [id, since] of sorted)
+            this.#idleOrder.set(id, since);
+        this.#idleNewest = sorted.at(-1)[1];
+    }
+    /** Forget a kept context, idle or not, and its place in the expiry order. */
+    #dropContext(conversationId) {
+        this.#contexts.delete(conversationId);
+        this.#idleOrder.delete(conversationId);
+    }
+    /**
+     * Drop the expired contexts when the earliest idle context expires, on a background timer, which never keeps the
+     * process alive. Where the host declines it, as the default does in Cloudflare Workers, none is kept: a pending timer
+     * could keep a Durable Object from being evicted, and eviction frees the contexts. There, task changes alone check
+     * expiry.
+     */
+    #scheduleExpiry() {
+        const oldest = this.#idleOrder.values().next();
+        const at = oldest.done === true ? undefined : oldest.value + this.#contextRetentionMs();
         if (this.#expiry !== undefined && this.#expiry.at === at)
             return;
         this.#expiry?.disarm();
@@ -585,14 +822,16 @@ export class TaskScheduler {
             return;
         const disarm = this.#timers.background(() => {
             this.#expiry = undefined;
-            this.#settleIdle();
+            this.#expireContexts(this.#now(), this.#contextRetentionMs());
+            this.#scheduleExpiry();
         }, at - this.#now());
         if (disarm !== undefined)
             this.#expiry = { at, disarm };
     }
     // ─── Ownership ───────────────────────────────────────────────────────────
     #scheduleReconcile() {
-        if (this.#reconcileScheduled || this.#closing)
+        // A read-only reconcile could only fail: what it writes is refused, and its own commits fail the Session.
+        if (this.#reconcileScheduled || this.#closing || this.#readOnly)
             return;
         this.#reconcileScheduled = true;
         queueMicrotask(() => void this.#reconcile());
@@ -608,54 +847,22 @@ export class TaskScheduler {
         const work = this.#reconcileWork();
         if (work)
             this.#reconcilingWork++;
-        const cascade = this.#cascadePending;
-        this.#cascadePending = false;
-        const checks = [...this.#failFastChecks];
-        this.#failFastChecks.clear();
         try {
-            await this.#session.commitWith(async (tx) => {
+            await this.#session.commitInternal(async (tx) => {
                 if (this.#closing)
                     return;
+                // A cascade scans the queued inputs, which waits for every unpublished commit: a request made before the scan
+                // is covered by it, and none is published while the job holds the line after it.
+                const cascade = this.#cascadePending;
                 const queued = await this.#loadScopes(cascade);
-                // A cascade from an abandoned owner passes its `restart` reason on; any other intent marks, or upgrades a
-                // `restart` mark, as a request. Collected first, so a request wins over a `restart` mark of the same pass.
-                const marks = new Map();
-                const mark = (record, reason) => {
-                    const staged = marks.get(record.id);
-                    if (staged !== undefined && staged.reason === undefined)
-                        return;
-                    if (record.abortRequested && (record.abortReason === undefined || reason !== undefined))
-                        return;
-                    marks.set(record.id, { record, reason });
-                };
-                // Every live foreground task below a live owner with cancellation intent, which is its nearest one: a walk down
-                // from each owner with intent does not enter another, whose own walk covers what is below it. Derived again on
-                // every pass, as loading edges can reveal a cancelled owner.
-                for (const id of this.#intent) {
-                    const owner = this.#live.get(id);
-                    // Only an owner abandoned after a restart, and nothing else, passes its reason on.
-                    const restart = owner.abortReason === "restart" && !failedOutcome(owner);
-                    for (const { node, live } of this.#walkDown(id, { enter: (below) => !this.#intent.has(below) })) {
-                        if (live !== undefined && !node.background)
-                            mark(live, restart ? "restart" : undefined);
-                    }
-                }
-                for (const id of checks) {
-                    const waiter = this.#live.get(id);
-                    if (waiter?.state.status !== "waiting" || !(await this.#anyFailed(waiter.state.on)))
-                        continue;
-                    // Every other live task: the failed one keeps its own outcome.
-                    for (const member of waiter.state.on) {
-                        const record = this.#live.get(member);
-                        if (record !== undefined && !failedOutcome(record))
-                            mark(record, undefined);
-                    }
-                }
+                if (cascade)
+                    this.#cascadePending = false;
+                const marks = await this.#marks();
                 for (const { record, reason } of marks.values())
                     tx.setTask(withAbortMark(record, reason));
-                for (const id of queued)
-                    if (this.#belowCancelled({ conversation: id }))
-                        await this.#withdrawInputs(tx, id);
+                const withdrawn = await this.#region(() => queued.filter((id) => this.#belowCancelled({ conversation: id })), this.#reloadScopes);
+                for (const id of withdrawn)
+                    await this.#withdrawInputs(tx, id);
                 await this.#finalize(tx);
             }, this.#context);
         }
@@ -667,63 +874,168 @@ export class TaskScheduler {
         if (work)
             this.#reconcilingWork--;
         this.#scheduleWake();
-        this.#settleIdle();
+        // Its commit's task changes were settled at their publication; a waiter that asked for this pass checks again, and
+        // what its chain loads resolved can make any scope idle.
+        if (this.#unknownsChanged) {
+            this.#settleIdle(undefined);
+            return;
+        }
+        this.#resolveIdleWaiters(undefined);
+        // A pass checks expiry too, for hosts that decline the expiry timer.
+        this.#expireContexts(this.#now(), this.#contextRetentionMs());
+        this.#scheduleExpiry();
+    }
+    /**
+     * The abort marks committed records imply (spec §5.4, §5.5): every live foreground task below a live owner with
+     * cancellation intent, which is its nearest one (a walk down from each owner with intent does not enter another,
+     * whose own walk covers what is below it), and every other live task in the `on` of a `failFast` waiter one of whose
+     * tasks failed. A cascade from an abandoned owner passes its `restart` reason on; any other intent marks, or upgrades
+     * a `restart` mark, as a request. Collected first, so a request wins over a `restart` mark of the same pass. Derived
+     * again on every pass, as loading edges can reveal a cancelled owner. Takes the `failFast` checks once its decision
+     * stands.
+     */
+    async #marks() {
+        // Terminal tasks in a checked `on`, read from Storage: each one's outcome is final.
+        const ended = new Map();
+        for (;;) {
+            const plan = await this.#region(() => this.#planMarks(ended), this.#reloadScopes);
+            if ("missing" in plan) {
+                for (const id of plan.missing)
+                    ended.set(id, (await this.#session.lineStorage.task(id, this.#context)) ?? null);
+                continue;
+            }
+            for (const id of plan.checked)
+                this.#failFastChecks.delete(id);
+            return plan.marks;
+        }
+    }
+    /** `#marks()`' decision region; the `failFast` members it needs from Storage first, when `ended` lacks them. */
+    #planMarks(ended) {
+        const marks = new Map();
+        // A mark rewrites the whole record, so the record it copies is read as a task record, keyed: a commit of the task
+        // that is not published yet makes the region wait and run again, rather than stage a mark over a stale checkpoint.
+        const mark = (found, reason) => {
+            const record = this.#liveRecord(found.id);
+            const staged = marks.get(record.id);
+            if (staged !== undefined && staged.reason === undefined)
+                return;
+            if (record.abortRequested && (record.abortReason === undefined || reason !== undefined))
+                return;
+            marks.set(record.id, { record, reason });
+        };
+        this.#record(INTENT_KEY);
+        for (const id of this.#intent) {
+            const owner = this.#liveRecord(id);
+            // Only an owner abandoned after a restart, and nothing else, passes its reason on.
+            const restart = owner.abortReason === "restart" && !failedOutcome(owner);
+            for (const { node, live } of this.#walkDown(id, { enter: (below) => !this.#intent.has(below) })) {
+                if (live !== undefined && !node.background)
+                    mark(live, restart ? "restart" : undefined);
+            }
+        }
+        const checked = [...this.#failFastChecks];
+        const missing = [];
+        for (const id of checked) {
+            const waiter = this.#liveRecord(id);
+            if (waiter?.state.status !== "waiting")
+                continue;
+            let failed = false;
+            for (const member of waiter.state.on) {
+                const record = this.#liveRecord(member) ?? ended.get(member);
+                if (record === undefined)
+                    missing.push(member);
+                else if (record !== null && failedOutcome(record))
+                    failed = true;
+            }
+            if (!failed)
+                continue;
+            // Every other live task: the failed one keeps its own outcome.
+            for (const member of waiter.state.on) {
+                const record = this.#liveRecord(member);
+                if (record !== undefined && !failedOutcome(record))
+                    mark(record, undefined);
+            }
+        }
+        return missing.length > 0 ? { missing } : { marks, checked };
     }
     /** Whether a reconcile pass would have work: a cascade to derive, held outcomes to check, or `failFast` waits. */
     #reconcileWork() {
         return this.#cascadePending || this.#finalizeChecks.size > 0 || this.#failFastChecks.size > 0;
     }
-    /** Whether any of `ids` holds or ended with an outcome other than `completed`. */
-    async #anyFailed(ids) {
-        for (const id of ids) {
-            const record = this.#live.get(id) ?? (await this.#storage.task(id, this.#context));
-            if (record !== undefined && failedOutcome(record))
-                return true;
-        }
-        return false;
-    }
     /**
      * Write the terminal record of every `completing` task without live ordinary owned work. Finalizing one can free its
      * owner, so this repeats over the commit's candidates until nothing changes. A held scheduler outcome gets its
-     * Harness cleanup here.
+     * Harness cleanup here. In rounds, one decision region each: the holders the tasks of one round free are checked once,
+     * in the next, so a holder of many tasks that end together is walked once, not once per task. The first round takes
+     * the `completing` tasks to check once its decision stands.
      */
     async #finalize(tx) {
-        // A worklist: the tasks that started holding, and the holders of work that ended. Finalizing one can free the
-        // nearest live task above it, which goes on the list. Tasks finalized here have no live work below them, so walks
-        // down skip them.
-        // In rounds: the holders the tasks of one round free are checked once, in the next, so a holder of many tasks that
-        // end together is walked once, not once per task.
-        let round = [...this.#finalizeChecks];
-        this.#finalizeChecks.clear();
         const done = new Set();
+        // The commit's candidates, kept in step with the terminal records each round stages.
         const overlay = overlayOf(tx);
-        while (round.length > 0) {
-            const next = new Set();
-            for (const id of round) {
-                const record = overlay.tasks.get(id) ?? this.#live.get(id);
-                if (record?.state.status !== "completing" || done.has(id))
-                    continue;
-                if (this.#hasOwnedLive(id, overlay, done))
-                    continue;
-                const outcome = record.state.outcome;
-                const terminal = withState(record, { status: "terminal", outcome });
+        let round = [...this.#finalizeChecks];
+        this.#finalizeChecks.clear();
+        for (;;) {
+            const ids = round;
+            const plan = await this.#region(() => this.#planRound(ids, overlay, done), this.#reloadScopes);
+            for (const { record, terminal } of plan.finalized) {
                 tx.setTask(terminal);
-                overlay.tasks.set(id, terminal);
-                done.add(id);
+                overlay.tasks.set(record.id, terminal);
+                done.add(record.id);
+                const outcome = record.state.outcome;
                 // REMINDER: only the scheduler writes `faulted` and `orphaned` (spec §5.4); their cleanup waits for this commit.
                 if (outcome.status === "faulted" || outcome.status === "orphaned") {
                     await this.#settleOutcome(tx, record, outcome);
                 }
+            }
+            if (plan.next.length === 0)
+                return;
+            round = plan.next;
+        }
+    }
+    /**
+     * One finalize round's decision: which of `ids` are `completing` without live ordinary owned work below them, in the
+     * commit's candidates with the round's own finalizations applied in order, and the holders above them to check next.
+     * Tasks finalized have no live work below them, so walks down skip them. It applies the round's terminal records to
+     * `overlay` while it decides and takes them back before it returns, so a run again starts from the same candidates.
+     */
+    #planRound(ids, overlay, finalized) {
+        const tasks = overlay.tasks;
+        // The tasks finalized so far, earlier rounds' and this one's, without copying the former.
+        const round = new Set();
+        const done = { has: (id) => round.has(id) || finalized.has(id) };
+        const ended = [];
+        const next = new Set();
+        try {
+            for (const id of ids) {
+                const staged = tasks.get(id);
+                const record = staged ?? this.#liveRecord(id);
+                if (record?.state.status !== "completing" || done.has(id))
+                    continue;
+                if (this.#hasOwnedLive(id, overlay, done))
+                    continue;
+                const terminal = withState(record, { status: "terminal", outcome: record.state.outcome });
+                tasks.set(id, terminal);
+                round.add(id);
+                ended.push({ record, terminal, staged: staged !== undefined });
                 const above = this.#nearestLiveAbove(record, overlay);
                 if (above?.state.status === "completing")
                     next.add(above.id);
             }
-            round = [...next];
         }
+        finally {
+            for (const { record, staged } of ended) {
+                if (staged)
+                    tasks.set(record.id, record);
+                else
+                    tasks.delete(record.id);
+            }
+        }
+        return { finalized: ended, next: [...next] };
     }
     /**
      * Load the owner chains of the tasks in `#unloaded` and, with `queued`, of every conversation with queued inputs,
-     * on the Session line; returns the latter. Reads committed Storage directly, so it may run inside a commit callback.
+     * on the Session line; returns the latter. Reads through the line's Storage, so it may run inside a commit callback.
      */
     async #loadScopes(queued) {
         for (const id of [...this.#unloaded]) {
@@ -733,7 +1045,8 @@ export class TaskScheduler {
         }
         if (!queued)
             return [];
-        const submissions = await scanAll((cursor) => this.#storage.scanSubmissions({ status: "queued" }, SCAN_PAGE_SIZE, cursor, this.#context));
+        // A scan, which cannot be keyed: it waits for every unpublished commit.
+        const submissions = await scanAll((cursor) => this.#session.lineStorage.scanSubmissions({ status: "queued" }, SCAN_PAGE_SIZE, cursor, this.#context));
         const inputs = submissions.filter((submission) => submission.type === "input");
         const conversations = [...new Set(inputs.map((submission) => submission.conversationId))];
         for (const id of conversations)
@@ -743,48 +1056,76 @@ export class TaskScheduler {
     /**
      * Load the owner edges and task nodes from `start` up to its ownerless root. A known task outside `#unloaded` ends the
      * walk, as its chain is loaded; the `#unloaded` tasks passed have a loaded chain afterwards. Loading a node can reveal
-     * a cancelled owner, so it makes the next reconcile derive cascade marks.
+     * a cancelled owner, so it makes the next reconcile derive cascade marks. The nodes it installs stay until the job's
+     * commit is published (`#pin()`).
      */
     async #loadChain(start, overlay) {
         const passed = [];
+        let installed = false;
         let at = start;
-        while (at !== undefined) {
-            if ("task" in at) {
-                const id = at.task;
-                let node = this.#live.get(id) ?? this.#settled.get(id);
-                // Created in this commit: the load from its own record covers what is above it.
-                if (node === undefined && overlay?.tasks.has(id) === true)
-                    break;
-                if (node !== undefined && !this.#unloaded.has(id))
-                    break;
-                if (node === undefined) {
-                    const record = await this.#storage.task(id, this.#context);
-                    if (record === undefined)
-                        return;
-                    node = nodeOf(record);
-                    if (record.state.status === "terminal")
-                        this.#settle(id, node);
-                    // A loaded node can reveal a cancelling owner: the next reconcile derives marks again.
-                    this.#scheduleReconcile();
+        try {
+            while (at !== undefined) {
+                if ("task" in at) {
+                    const id = at.task;
+                    let node = this.#live.get(id) ?? this.#settled.get(id);
+                    // Created in this commit: the load from its own record covers what is above it.
+                    if (node === undefined && overlay?.tasks.has(id) === true)
+                        break;
+                    if (node !== undefined && !this.#unloaded.has(id))
+                        break;
+                    if (node === undefined) {
+                        // Through the line's Storage: a task whose creation or end is not published yet waits for it.
+                        const record = await this.#session.lineStorage.task(id, this.#context);
+                        if (record === undefined)
+                            return;
+                        node = nodeOf(record);
+                        if (record.state.status === "terminal") {
+                            this.#settle(id, node);
+                            this.#pin(id);
+                            installed = true;
+                        }
+                        // A loaded node can reveal a cancelling owner: the next reconcile derives marks again.
+                        this.#scheduleReconcile();
+                    }
+                    passed.push(id);
+                    at = parentOf(node);
                 }
-                passed.push(id);
-                at = parentOf(node);
-            }
-            else {
-                let edge = this.#edge(at.conversation, overlay);
-                if (edge === undefined) {
-                    const record = await this.#storage.conversation(at.conversation, this.#context);
-                    edge = record?.owner?.taskId ?? null;
-                    this.#setEdge(at.conversation, edge);
-                    // A loaded node can reveal a cancelling owner: the next reconcile derives marks again.
-                    this.#scheduleReconcile();
+                else {
+                    let edge = this.#edge(at.conversation, overlay);
+                    if (edge === undefined) {
+                        // Through the line's Storage: a conversation whose creation is not published yet waits for it, so a missing
+                        // record is never mistaken for an ownerless one.
+                        const record = await this.#session.lineStorage.conversation(at.conversation, this.#context);
+                        edge = record?.owner?.taskId ?? null;
+                        this.#setEdge(at.conversation, edge);
+                        this.#pin(conversationNode(at.conversation));
+                        installed = true;
+                        // A loaded node can reveal a cancelling owner: the next reconcile derives marks again.
+                        this.#scheduleReconcile();
+                    }
+                    at = edge === null ? undefined : { task: edge };
                 }
-                at = edge === null ? undefined : { task: edge };
+            }
+        }
+        finally {
+            // `#idle()` counts a live task whose chain is not loaded as inside every scope it may be in: what this load
+            // resolved, also when it stopped early, can make such a scope idle without a task change below it.
+            if (passed.some((id) => this.#live.has(id)) || (installed && this.#liveUnloaded())) {
+                this.#unknownsChanged = true;
+                // A waiter such a task held is checked again at the pass's end, also when this load was not a reconcile's.
+                this.#scheduleReconcile();
             }
         }
         for (const id of passed)
             this.#unloaded.delete(id);
     }
+    /** Whether a live task's chain is not loaded yet: one `#idle()` counts as inside every scope it may be in. */
+    #liveUnloaded() {
+        for (const id of this.#unloaded)
+            if (this.#live.has(id))
+                return true;
+        return false;
+    }
     #setEdge(conversationId, owner) {
         this.#edges.set(conversationId, owner);
         // The conversation now hangs from its owner, or is a root; with nothing below it, it waits for the sweep.
@@ -831,7 +1172,8 @@ export class TaskScheduler {
      */
     #sweep() {
         for (const node of this.#dropQueue) {
-            if (this.#below.has(node))
+            // Queued again once its pins go.
+            if (this.#below.has(node) || this.#pins.has(node))
                 continue;
             if (typeof node === "string") {
                 this.#edges.delete(conversationOf(node));
@@ -844,6 +1186,69 @@ export class TaskScheduler {
         }
         this.#dropQueue.clear();
     }
+    /**
+     * Run `decide`, a decision region (group commit §6): synchronous, reading scheduler memory and recording the keys it
+     * reads, staging nothing and changing no scheduler state. When a key it read has an unpublished writer, its result,
+     * or its error, is dropped: once that writer is published, `refresh` reloads what the region needs and it runs
+     * again. A waiting job holds the line, so unpublished writes only shrink, and the runs converge. What a region read
+     * that had no unpublished writer gets none for the rest of the job, so its result stands while the job applies it.
+     */
+    async #region(decide, refresh) {
+        for (;;) {
+            const keys = new Set();
+            this.#reading = keys;
+            let result;
+            try {
+                result = { value: decide() };
+            }
+            catch (error) {
+                result = { error };
+            }
+            finally {
+                this.#reading = undefined;
+            }
+            const gates = [];
+            for (const key of keys) {
+                const gate = this.#session.touch(key);
+                if (gate !== undefined)
+                    gates.push(gate);
+            }
+            if (gates.length === 0) {
+                if ("error" in result)
+                    throw result.error;
+                return result.value;
+            }
+            await Promise.all(gates);
+            await refresh?.();
+        }
+    }
+    /** Load the chains a region walks, again after it waited: what was published meanwhile may list new work. */
+    #reloadScopes = () => this.#loadScopes(false);
+    /** In a decision region, note that it reads `key`; anywhere else, nothing. */
+    #record(key) {
+        this.#reading?.add(key);
+    }
+    /** A live task's committed record, read by a decision region. */
+    #liveRecord(id) {
+        this.#record(taskKey(id));
+        return this.#live.get(id);
+    }
+    /**
+     * Keep `node`, which a chain load of the job on the line installed, until that job's commit is published or fails:
+     * work it creates below the node needs it, and the sweep would drop it as unneeded before then.
+     */
+    #pin(node) {
+        this.#pins.set(node, (this.#pins.get(node) ?? 0) + 1);
+        this.#session.onJobEnd(() => {
+            const count = this.#pins.get(node) - 1;
+            if (count > 0) {
+                this.#pins.set(node, count);
+                return;
+            }
+            this.#pins.delete(node);
+            this.#dropIfUnneeded(node);
+        });
+    }
     /**
      * Bring the scheduler's sets in line with a task's committed record. A task that ended may free the nearest live task
      * above it: one holding its outcome finalizes, an abort-marked one runs its abort handler; its waiters may run.
@@ -855,11 +1260,11 @@ export class TaskScheduler {
             invocation.record = record;
         if (record.state.status === "terminal") {
             if (previous !== undefined && !this.#closing)
-                this.#activeMetric.add(-1, { task: record.kind });
+                this.#countActive(-1, record.kind);
             this.#resumed.delete(id);
         }
         else if (previous === undefined && !this.#closing) {
-            this.#activeMetric.add(1, { task: record.kind });
+            this.#countActive(1, record.kind);
         }
         if (previous?.state.status === "waiting")
             for (const on of previous.state.on)
@@ -967,11 +1372,12 @@ export class TaskScheduler {
      * at or below a background task holds nothing above it.
      */
     #nearestLiveAbove(node, overlay) {
+        this.#record(INTENT_KEY);
         for (let current = node; !current.background;) {
             const owner = current.owner ?? this.#edge(current.conversationId, overlay);
             if (owner === undefined || owner === null)
                 return undefined;
-            const record = overlay?.tasks.get(owner) ?? this.#live.get(owner);
+            const record = overlay?.tasks.get(owner) ?? this.#liveRecord(owner);
             if (record !== undefined && record.state.status !== "terminal")
                 return record;
             const above = record ?? this.#settled.get(owner);
@@ -991,7 +1397,10 @@ export class TaskScheduler {
     }
     /** Owner task of a conversation, `null` when ownerless, `undefined` while not loaded. */
     #edge(id, overlay) {
-        return overlay?.edges.has(id) === true ? overlay.edges.get(id) : this.#edges.get(id);
+        if (overlay?.edges.has(id) === true)
+            return overlay.edges.get(id);
+        this.#record(conversationKey(id));
+        return this.#edges.get(id);
     }
     #node(id, overlay) {
         return overlay?.tasks.get(id) ?? this.#live.get(id) ?? this.#settled.get(id);
@@ -1030,6 +1439,7 @@ export class TaskScheduler {
         const links = overlay === undefined ? undefined : this.#links(overlay);
         const pending = [start];
         for (let at = pending.pop(); at !== undefined; at = pending.pop()) {
+            this.#record(ownedKey(at));
             for (const children of [this.#below.get(at), links?.get(at)]) {
                 for (const child of children ?? []) {
                     if (typeof child === "string") {
@@ -1117,6 +1527,7 @@ export class TaskScheduler {
      * edge is not loaded.
      */
     #inScope(start, scope, crossBackground = false) {
+        this.#record(INTENT_KEY);
         for (const step of this.#above(start)) {
             if ("unknown" in step)
                 return undefined;
@@ -1139,6 +1550,7 @@ export class TaskScheduler {
     }
     /** The nearest live owner above `start` whose cancellation intent reaches it, if any; see `#belowCancelled`. */
     #cancellingOwner(start) {
+        this.#record(INTENT_KEY);
         // Nothing cancels, the common case: no walk.
         if (this.#intent.size === 0)
             return undefined;
@@ -1155,6 +1567,18 @@ export class TaskScheduler {
         }
         return undefined;
     }
+    /**
+     * Count a task in or out of `pi.durable.tasks.active`. Commit observers count at a commit's publication, which must not
+     * throw, so a throwing adapter is reported.
+     */
+    #countActive(delta, kind) {
+        try {
+            this.#activeMetric.add(delta, { task: kind });
+        }
+        catch (error) {
+            this.#report(error, TELEMETRY);
+        }
+    }
     /** Fail the Session, which reports it, for a throw in one of the scheduler's own commits; ignored once closing. */
     #failSession(error, context) {
         if (!this.#closing)
@@ -1163,7 +1587,7 @@ export class TaskScheduler {
     /** Close listener: runs synchronously once admission is sealed, before `join()`, or when the Session fails. */
     #seal() {
         for (const record of this.#live.values())
-            this.#activeMetric.add(-1, { task: record.kind });
+            this.#countActive(-1, record.kind);
         this.#resumed.clear();
         this.#closing = true;
         try {
@@ -1176,14 +1600,18 @@ export class TaskScheduler {
         this.#taskWaiters.rejectAll(error);
         this.#idleWaiters.rejectAll(error);
         this.#contexts.clear();
+        this.#idleOrder.clear();
         this.#expiry?.disarm();
         this.#expiry = undefined;
         this.#timer?.disarm();
         this.#timer = undefined;
     }
-    /** Recompute the wake in a microtask, off the Session line: arm the built-in timer, or tell `onWake` of a change. */
+    /**
+     * Recompute the wake in a microtask the line never waits for, with no order relative to host commit listeners (one
+     * already queued serves later changes too): arm the built-in timer, or tell `onWake` of a change.
+     */
     #scheduleWake() {
-        if (this.#wakeScheduled || this.#closing)
+        if (this.#wakeScheduled || this.#closing || this.#readOnly)
             return;
         this.#wakeScheduled = true;
         queueMicrotask(() => {
@@ -1235,10 +1663,6 @@ export class TaskScheduler {
                 this.#runnable.add(id);
         }
     }
-    /** A task cut off `restartLimit` times in a row; an abort mark still runs its abort handler. */
-    #parked(record) {
-        return !record.abortRequested && record.restarts !== undefined && record.restarts >= this.#restartLimit();
-    }
     /**
      * The report info of a task's failure, with the extension that installed its definition: the code that failed is
      * that extension's. Built-in tasks have none.
@@ -1259,22 +1683,6 @@ export class TaskScheduler {
         }
         return { task: reportTask(task), ...optionalExtension(extension) };
     }
-    /** Make parked tasks that a raised `settings.restartLimit` no longer parks candidates again, and tell the graph. */
-    #unparkRaised() {
-        let unparked = false;
-        for (const id of this.#parkedTasks) {
-            const record = this.#live.get(id);
-            if (record !== undefined && this.#parked(record))
-                continue;
-            this.#parkedTasks.delete(id);
-            if (record === undefined)
-                continue;
-            this.#runnable.add(id);
-            unparked = true;
-        }
-        if (unparked)
-            queueMicrotask(() => this.#notifyBlocked());
-    }
     /** `settings.restartLimit`, or the default when the host's settings throw. */
     #restartLimit() {
         try {
@@ -1291,7 +1699,7 @@ export class TaskScheduler {
                 listener();
             }
             catch (error) {
-                this.#report(error, { type: "listener_error" });
+                this.#report(error, { kind: "listener_error" });
             }
         }
     }
@@ -1337,62 +1745,43 @@ export class TaskScheduler {
         const faulted = [];
         let abandoned = [];
         try {
-            await this.#session.commitWith(async (tx) => {
+            await this.#session.commitInternal(async (tx) => {
                 if (!this.#enabled || this.#closing)
                     return;
-                for (const id of this.#abandoned) {
-                    const record = this.#live.get(id);
-                    if (record !== undefined && !record.abortRequested)
-                        tx.setTask(withAbortMark(record, "restart"));
-                }
                 if (this.#abandoned.size > 0) {
-                    abandoned = [...this.#abandoned];
+                    const ids = [...this.#abandoned];
+                    const unmarked = await this.#region(() => ids
+                        .map((id) => this.#liveRecord(id))
+                        .filter((record) => record !== undefined && !record.abortRequested));
+                    for (const record of unmarked)
+                        tx.setTask(withAbortMark(record, "restart"));
+                    abandoned = ids;
                     return;
                 }
                 await this.#loadScopes(false);
                 // Every pass picks up sleeps whose time has come: a pass started by any change may be the first to run after
                 // a deadline, and the wake it schedules no longer keeps a timer for a due sleep.
                 this.#wakeDue();
-                this.#unparkRaised();
+                const plan = await this.#planCandidates();
+                // Work below an owner with cancellation intent waits for its cascade mark instead of running a phase; schedule
+                // the cascade, which may not have run yet.
+                if (plan.cascade) {
+                    this.#cascadePending = true;
+                    this.#scheduleReconcile();
+                }
                 // Taken once per pass, and only when some task is a candidate.
                 let snapshot;
-                for (const id of [...this.#runnable]) {
-                    const record = this.#live.get(id);
-                    if (record === undefined || record.state.status === "completing" || this.#invocations.has(id)) {
-                        this.#runnable.delete(id);
-                        continue;
-                    }
-                    // It returns once what it waits for ends, its record changes, or the work below it ends.
-                    if (this.#waitingOn(record, true).length > 0) {
-                        this.#runnable.delete(id);
-                        continue;
-                    }
-                    // It returns at the first pass after its time comes, which the timer, `resume()`, or any change starts.
-                    if (this.#notDue(record)) {
-                        this.#runnable.delete(id);
-                        continue;
-                    }
-                    // It returns when `retry()` clears its restart count, or at a pass after `settings.restartLimit` rose.
-                    if (this.#parked(record)) {
-                        this.#runnable.delete(id);
-                        // Newly parked without a commit, as after a lowered limit: the graph must hear it.
-                        if (!this.#parkedTasks.has(id))
-                            queueMicrotask(() => this.#notifyBlocked());
-                        this.#parkedTasks.add(id);
-                        continue;
-                    }
-                    const runnable = record;
+                for (const record of plan.ready) {
+                    const id = record.id;
                     const mode = record.abortRequested ? "abort" : "run";
-                    // Work below an owner with cancellation intent waits for its cascade mark instead of running a phase; schedule
-                    // the cascade, which may not have run yet.
-                    if (mode === "run" && !record.background && this.#belowCancelled(parentOf(record))) {
-                        this.#cascadePending = true;
-                        this.#scheduleReconcile();
-                        continue;
-                    }
-                    // An abort handler cut off `restartLimit` times in a row would run forever; nothing is left to park it for.
-                    if (mode === "abort" && (record.restarts ?? 0) >= this.#restartLimit()) {
-                        const message = `Abort handler of task ${id} (${record.kind}) was cut off ${record.restarts} times`;
+                    // Work cut off `restartLimit` times in a row would run forever: an abort handler, or a phase of a kind that
+                    // does not end itself at the limit, ends the task `faulted` instead.
+                    // The settings are read only for a task that was cut off at all.
+                    const cutOff = record.restarts !== undefined && record.restarts >= this.#restartLimit();
+                    if (cutOff && (mode === "abort" || !this.#limitsRestarts(record.kind))) {
+                        const message = mode === "abort"
+                            ? `Abort handler of task ${id} (${record.kind}) was cut off ${record.restarts} times`
+                            : `Task ${id} (${record.kind}) was cut off ${record.restarts} times without progress`;
                         await this.#terminate(tx, record, {
                             status: "faulted",
                             error: { message, detail: { reason: "restart_limit" } },
@@ -1401,7 +1790,7 @@ export class TaskScheduler {
                         continue;
                     }
                     snapshot ??= this.#registry.snapshot();
-                    const resolution = this.#resolve(runnable, snapshot);
+                    const resolution = this.#resolve(record, snapshot);
                     if (resolution.kind === "blocked") {
                         // An abandoned task waits for its definition, so its abort handler can clean up.
                         if (mode === "abort" && record.abortReason === undefined) {
@@ -1409,7 +1798,7 @@ export class TaskScheduler {
                         }
                         continue;
                     }
-                    if (resolution.record !== runnable || record.state.status !== "running") {
+                    if (resolution.record !== record || record.state.status !== "running") {
                         tx.setTask(withState(resolution.record, {
                             status: "running",
                             checkpoint: resolution.record.state.checkpoint,
@@ -1418,7 +1807,7 @@ export class TaskScheduler {
                     // Registered on the line, so marks and later reservations see it and close joins it; `#end` makes it a
                     // candidate again.
                     this.#runnable.delete(id);
-                    const invocation = this.#createInvocation(runnable, mode, installerOf(snapshot, resolution.task));
+                    const invocation = this.#createInvocation(record, mode, installerOf(snapshot, resolution.task));
                     reservations.push({ invocation, task: resolution.task, snapshot });
                 }
             }, this.#context);
@@ -1433,7 +1822,7 @@ export class TaskScheduler {
         }
         for (const { record, message } of faulted) {
             this.#report(new Error(message), {
-                type: "task_faulted",
+                kind: "task_faulted",
                 ...this.#aboutTask(recordTask(record)),
                 reason: "restart_limit",
             });
@@ -1445,6 +1834,65 @@ export class TaskScheduler {
             this.#dirty = true;
         return reservations;
     }
+    /**
+     * Plan a reservation pass over the candidates, taken out of `#runnable` while it plans: a task made a candidate
+     * meanwhile, such as a waiter whose last task ended, lands in the fresh set, so the pass's decision to drop it cannot
+     * erase that. The candidates not dropped go back in front of the fresh set, unless they ended or hold meanwhile.
+     */
+    async #planCandidates() {
+        const candidates = this.#runnable;
+        this.#runnable = new Set();
+        let dropped = new Set();
+        try {
+            const plan = await this.#region(() => this.#planReservation(candidates), this.#reloadScopes);
+            dropped = new Set(plan.dropped);
+            return plan;
+        }
+        finally {
+            const merged = new Set();
+            for (const id of candidates) {
+                const status = this.#live.get(id)?.state.status;
+                if (!dropped.has(id) && status !== undefined && status !== "completing")
+                    merged.add(id);
+            }
+            for (const id of this.#runnable)
+                merged.add(id);
+            this.#runnable = merged;
+        }
+    }
+    /**
+     * A reservation pass's decision region: the candidates it drops (gone, holding, waiting, asleep, or with an
+     * invocation), whether one waits for a cascade, and the runnable records to resolve. Iterating the candidates is not
+     * keyed: a pass that misses a task a pending commit makes runnable only delays it, as does skipping one with an
+     * invocation without reading its record, or a waiter's check whether what it waits on is still live.
+     */
+    #planReservation(candidates) {
+        const dropped = [];
+        const ready = [];
+        let cascade = false;
+        for (const id of candidates) {
+            if (this.#invocations.has(id)) {
+                dropped.push(id);
+                continue;
+            }
+            const record = this.#liveRecord(id);
+            // It returns once what it waits for ends, its record changes, or the work below it ends; a sleep at the first pass
+            // after its time comes, which the timer, `resume()`, or any change starts.
+            if (record === undefined ||
+                record.state.status === "completing" ||
+                this.#waitingOn(record, true).length > 0 ||
+                this.#notDue(record)) {
+                dropped.push(id);
+                continue;
+            }
+            if (!record.abortRequested && !record.background && this.#belowCancelled(parentOf(record))) {
+                cascade = true;
+                continue;
+            }
+            ready.push(record);
+        }
+        return { dropped, cascade, ready };
+    }
     /**
      * Live tasks a task waits for before its next invocation: its live ordinary owned work when abort-marked, since
      * abort runs bottom-up, otherwise the live part of the `on` of a wait.
@@ -1481,7 +1929,7 @@ export class TaskScheduler {
             queueMicrotask(() => this.#notifyBlocked());
             this.#scheduleWake();
             const extension = installerOf(snapshot, fit.task);
-            this.#report(error, { type: "migration_failed", ...this.#aboutTask({ ...recordTask(record), extension }) });
+            this.#report(error, { kind: "migration_failed", ...this.#aboutTask({ ...recordTask(record), extension }) });
             return { kind: "blocked", reason: "migration_failed" };
         }
     }
@@ -1511,6 +1959,36 @@ export class TaskScheduler {
             roots: this.#roots.size,
             unloaded: this.#unloaded.size,
             dropQueue: this.#dropQueue.size,
+            pins: this.#pins.size,
+        };
+    }
+    /**
+     * The kept contexts' idle state, for tests (a diagnostic, computed on demand): how many are kept and how many are
+     * idle, how many disagree with a full recompute (an idle period without `#idle()`, or `#idle()` without one; an
+     * expiry order that differs from the idle periods, or is not sorted), and how many idle checks covered every scope.
+     */
+    get idleState() {
+        let mismatches = 0;
+        let idle = 0;
+        for (const [conversationId, kept] of this.#contexts) {
+            if (kept.idleSince !== undefined)
+                idle++;
+            if ((kept.idleSince !== undefined) !== this.#idle(conversationId))
+                mismatches++;
+            if (this.#idleOrder.get(conversationId) !== kept.idleSince)
+                mismatches++;
+        }
+        let previous = Number.NEGATIVE_INFINITY;
+        for (const [conversationId, idleSince] of this.#idleOrder) {
+            if (idleSince < previous || this.#contexts.get(conversationId)?.idleSince !== idleSince)
+                mismatches++;
+            previous = idleSince;
+        }
+        return {
+            contexts: this.#contexts.size,
+            idleContexts: idle,
+            idleMismatches: mismatches,
+            fullIdleChecks: this.#fullIdleChecks,
         };
     }
     /**
@@ -1519,6 +1997,7 @@ export class TaskScheduler {
      * cannot exist, shows as failed.
      */
     async inspect(snapshot) {
+        await this.#published();
         await this.#loadScopes(false);
         const tasks = [];
         for (const record of this.#live.values())
@@ -1536,15 +2015,13 @@ export class TaskScheduler {
             return { kind: "waiting", on };
         if (this.#notDue(record))
             return { kind: "sleeping", until: record.state.until };
-        if (this.#parked(record))
-            return { kind: "blocked", reason: "restart_limit" };
         const fit = this.#fit(record, snapshot.task(record.kind));
         if ("reason" in fit)
             return { kind: "blocked", ...fit };
         if (fit.migrates && fit.task.definition.migrate === undefined) {
             return { kind: "blocked", reason: "migration_failed", error: missingMigration(record, erased(fit.task)) };
         }
-        return { kind: "ready", migrates: fit.migrates };
+        return { kind: "pending", migrates: fit.migrates };
     }
     #createInvocation(record, mode, extension) {
         const controller = new AbortController();
@@ -1578,7 +2055,7 @@ export class TaskScheduler {
                     await this.#runAbort(reservation);
             }
             catch (error) {
-                this.#report(error, { type: "task_error", ...this.#aboutTask(invocation) }, invocation.context);
+                this.#report(error, { kind: "task_error", ...this.#aboutTask(invocation) }, invocation.context);
             }
             finally {
                 this.#end(invocation);
@@ -1596,7 +2073,8 @@ export class TaskScheduler {
         const state = { task: reservation.task, snapshot: reservation.snapshot, reported: undefined };
         const phase = { snapshot: () => state.snapshot, task: () => state.task, agent: undefined };
         const runtime = this.#runtime(invocation, phase);
-        let current = await this.#step(invocation, (tx, next) => this.#decide(tx, next, undefined, state, invocation.extension, invocation.context));
+        const progress = (tx, current) => this.#progress(tx, current, state, invocation.extension, invocation.context);
+        let current = await this.#step(invocation, (task) => this.#rules(task, undefined), progress);
         while (current !== undefined && !this.#closing) {
             const task = current;
             current = await this.#phase(invocation, task, async () => {
@@ -1611,7 +2089,7 @@ export class TaskScheduler {
                 catch (error) {
                     previous = { checkpoint, failure: { error } };
                 }
-                return this.#step(invocation, (tx, next) => this.#decide(tx, next, previous, state, invocation.extension, invocation.context));
+                return this.#step(invocation, (next) => this.#rules(next, previous), progress);
             });
         }
     }
@@ -1662,7 +2140,7 @@ export class TaskScheduler {
                     const message = terminal.status === "orphaned" ? terminal.reason : terminal.error.message;
                     span.setStatus({
                         status: "error",
-                        error: { name: `task_${terminal.status}`, message: message.slice(0, 500) },
+                        error: { name: `task_${terminal.status}`, message: ownedSlice(message, 0, 500) },
                     });
                 }
                 else if (outcome === "aborted") {
@@ -1673,45 +2151,50 @@ export class TaskScheduler {
         });
     }
     /**
-     * Precedence rules for a run invocation, on the line. Rules 1 (terminal, `completing`, `waiting`, or `sleeping`) and 2
-     * (closing) are applied by `#step`. Returns whether the invocation continues with the next phase.
+     * Precedence rules for a run invocation, a decision region of its step. Rules 1 (terminal, `completing`, `waiting`, or
+     * `sleeping`) and 2 (closing) are applied by `#step`. Progress (rule 5) is decided by `#progress()` once the decision
+     * stands, as it takes a registry snapshot.
      */
-    #decide(tx, current, previous, state, extension, context) {
+    #rules(current, previous) {
         // 3. abort mark: end; a fresh abort invocation starts once the task's ordinary owned work is gone.
         if (current.abortRequested)
-            return false;
+            return END;
         // An owner's cancellation intent ends it too, before its cascade marks it; reservation then holds it back.
-        if (!current.background && this.#belowCancelled(parentOf(current))) {
-            this.#cascadePending = true;
-            this.#scheduleReconcile();
-            return false;
-        }
+        if (!current.background && this.#belowCancelled(parentOf(current)))
+            return CASCADE;
         if (previous === undefined)
-            return true;
+            return CONTINUE;
         // 4. uncaught error.
         if (previous.failure !== undefined)
-            return { fault: previous.failure.error };
+            return { kind: "fault", error: previous.failure.error };
         // 6. no durable progress.
         if (jsonEqual(current.state.checkpoint, previous.checkpoint)) {
             const message = `Task ${current.kind} phase ${previous.checkpoint.phase} returned without durable progress`;
-            return { fault: new Error(message) };
+            return { kind: "fault", error: new Error(message) };
         }
-        // 5. progress: refresh the snapshot; hand over to a replacement definition that can take the task.
+        return PROGRESS;
+    }
+    /**
+     * Rule 5, progress: refresh the snapshot; hand over to a replacement definition that can take the task, writing it
+     * back as `pending`, or keep running under the old one, reported once per resolved definition. Returns whether the
+     * invocation continues.
+     */
+    #progress(tx, current, state, extension, context) {
         state.snapshot = this.#registry.snapshot();
         const next = state.snapshot.task(current.kind);
-        if (next !== state.task) {
-            if (next !== undefined && canReserve(next, current)) {
-                tx.setTask(withState(current, { status: "pending", checkpoint: current.state.checkpoint }));
-                return false;
-            }
-            if (state.reported === undefined || state.reported.task !== next) {
-                state.reported = { task: next };
-                this.#report(new Error(`Task ${current.id} keeps running under its old ${current.kind} definition`), {
-                    type: "task_outdated",
-                    ...this.#aboutTask({ ...recordTask(current), extension }),
-                    reason: next === undefined ? "missing_task" : "incompatible_task",
-                }, context);
-            }
+        if (next === state.task)
+            return true;
+        if (next !== undefined && canReserve(next, current)) {
+            tx.setTask(withState(current, { status: "pending", checkpoint: current.state.checkpoint }));
+            return false;
+        }
+        if (state.reported === undefined || state.reported.task !== next) {
+            state.reported = { task: next };
+            this.#report(new Error(`Task ${current.id} keeps running under its old ${current.kind} definition`), {
+                kind: "task_outdated",
+                ...this.#aboutTask({ ...recordTask(current), extension }),
+                reason: outdatedReason(next, current),
+            }, context);
         }
         return true;
     }
@@ -1736,28 +2219,42 @@ export class TaskScheduler {
                 failure = { error };
             }
             const message = `Abort handler of task ${invocation.taskId} returned without a terminal outcome`;
-            await this.#step(invocation, () => ({ fault: failure?.error ?? new Error(message) }));
+            await this.#step(invocation, () => ({ kind: "fault", error: failure?.error ?? new Error(message) }));
         });
     }
     /**
-     * One synchronous decision on the Session line. A task that is no longer running (rule 1: terminal, `completing`,
-     * `waiting`, or `sleeping`) or a closing Harness (rule 2) ends the invocation without a write; otherwise `decide` may
-     * stage a write and returns whether the invocation continues. Ending happens inside the callback, before a fault's
-     * Harness cleanup. A rejected step, such as admission after close, also ends the invocation.
+     * One decision on the Session line, before a phase: a decision region (`#region()`) that reads the task's record. A
+     * task that is no longer running (rule 1: terminal, `completing`, `waiting`, or `sleeping`) or a closing Harness (rule
+     * 2) ends the invocation without a write; otherwise `plan` decides, and a decision that stands is applied: the
+     * invocation continues, with `progress` for rule 5, or ends, with a fault written. Ending happens inside the callback,
+     * before a fault's Harness cleanup. A rejected step, such as admission after close, also ends the invocation. Its
+     * outcome goes to the invocation only, so it is a scheduler commit (`commitInternal()`).
      */
-    async #step(invocation, decide) {
+    async #step(invocation, plan, progress) {
         let fault;
         try {
-            const continued = await this.#session.commitWith(async (tx) => {
-                const found = this.#live.get(invocation.taskId);
-                const current = found?.state.status === "running" ? found : undefined;
-                const decision = current !== undefined && !this.#closing ? decide(tx, current) : false;
-                if (decision === true)
+            const continued = await this.#session.commitInternal(async (tx) => {
+                const decided = await this.#region(() => {
+                    const found = this.#liveRecord(invocation.taskId);
+                    if (found?.state.status !== "running" || this.#closing)
+                        return { plan: END };
+                    const current = found;
+                    return { current, plan: plan(current) };
+                });
+                const { current } = decided;
+                const step = decided.plan;
+                if (step.kind === "continue")
+                    return current;
+                if (step.kind === "progress" && progress(tx, current))
                     return current;
                 this.#end(invocation);
-                if (decision !== false) {
-                    fault = { error: decision.fault };
-                    const message = errorMessage(decision.fault);
+                if (step.kind === "cascade") {
+                    this.#cascadePending = true;
+                    this.#scheduleReconcile();
+                }
+                if (step.kind === "fault") {
+                    fault = { error: step.error };
+                    const message = errorMessage(step.error);
                     invocation.fault = { status: "faulted", error: { message } };
                     await this.#terminate(tx, current, invocation.fault);
                 }
@@ -1765,7 +2262,7 @@ export class TaskScheduler {
             }, withoutAbortSignal(invocation.context));
             // Reported once the fault is durable: a host may count it, for example toward a breaker.
             if (fault !== undefined)
-                this.#report(fault.error, { type: "task_faulted", ...this.#aboutTask(invocation), reason: "threw" }, invocation.context);
+                this.#report(fault.error, { kind: "task_faulted", ...this.#aboutTask(invocation), reason: "threw" }, invocation.context);
             return continued;
         }
         catch (error) {
@@ -1782,7 +2279,7 @@ export class TaskScheduler {
      */
     async #terminate(tx, record, outcome) {
         await this.#loadScopes(false);
-        if (this.#hasOwnedLive(record.id, overlayOf(tx))) {
+        if (await this.#region(() => this.#hasOwnedLive(record.id, overlayOf(tx)), this.#reloadScopes)) {
             tx.setTask(withState(record, { status: "completing", outcome }));
             return;
         }
@@ -1804,7 +2301,7 @@ export class TaskScheduler {
             await this.#loadScopes(false);
             for (const record of overlay.tasks.values())
                 await this.#loadChain(parentOf(record), overlay);
-            if (this.#hasOwnedLive(current.id, overlay)) {
+            if (await this.#region(() => this.#hasOwnedLive(current.id, overlayOf(tx)), this.#reloadScopes)) {
                 tx.setTask(withState(progressed(current), { status: "completing", outcome: next.outcome }));
                 return;
             }
@@ -1825,37 +2322,64 @@ export class TaskScheduler {
     async #validateWait(tx, invocation, current, on, policy) {
         if (invocation.mode === "abort")
             throw new Error(`Abort handler of task ${current.id} cannot wait`);
-        const overlay = overlayOf(tx);
+        // Owned work is found by walks down, which need the chains of every live task loaded.
+        await this.#loadScopes(false);
+        // Tasks in `on` that are not live, read from Storage: terminal, or missing.
+        const ended = new Map();
+        for (;;) {
+            const checked = await this.#region(() => this.#checkWait(current, on, policy, overlayOf(tx), ended), this.#reloadScopes);
+            if (checked === undefined)
+                return;
+            if ("missing" in checked) {
+                for (const id of checked.missing)
+                    ended.set(id, (await this.#session.lineStorage.task(id, this.#context)) ?? null);
+                continue;
+            }
+            throw checked.error;
+        }
+    }
+    /**
+     * `#validateWait()`'s decision region: why the wait is refused, `undefined` when it may be stored, or the tasks in
+     * `on` it needs from Storage first, when `ended` lacks them.
+     */
+    #checkWait(current, on, policy, overlay, ended) {
         const targets = [];
+        const missing = [];
         for (const id of on) {
-            const member = overlay.tasks.get(id) ?? this.#live.get(id) ?? (await this.#storage.task(id, this.#context));
-            if (member === undefined)
-                throw new Error(`Task ${id} does not exist`);
+            const member = overlay.tasks.get(id) ?? this.#liveRecord(id) ?? ended.get(id);
+            if (member === undefined) {
+                missing.push(id);
+                continue;
+            }
+            if (member === null)
+                return { error: new Error(`Task ${id} does not exist`) };
             if (policy === "failFast" && member.owner !== current.id) {
-                throw new Error(`Task ${current.id} can wait failFast only on tasks it owns; ${id} is not one`);
+                return { error: new Error(`Task ${current.id} can wait failFast only on tasks it owns; ${id} is not one`) };
             }
             // A live child already holds the waiter (task-owned tasks are never background): waiting on it adds no edge. A
             // terminal task has no edges.
             if (member.state.status !== "terminal" && member.owner !== current.id)
                 targets.push(id);
         }
+        if (missing.length > 0)
+            return { missing };
         if (targets.length === 0)
-            return;
-        const cycle = await this.#waitCycle(current.id, targets, overlay);
-        if (cycle !== undefined) {
-            throw new Error(`Task ${current.id} cannot wait on ${cycle[0]}: ${[current.id, ...cycle].join(" -> ")} is a wait cycle`);
-        }
+            return undefined;
+        const cycle = this.#waitCycle(current.id, targets, overlay);
+        if (cycle === undefined)
+            return undefined;
+        return {
+            error: new Error(`Task ${current.id} cannot wait on ${cycle[0]}: ${[current.id, ...cycle].join(" -> ")} is a wait cycle`),
+        };
     }
     /**
      * The path from a member of `on` back to `task` in the wait-for graph, if the wait would close a cycle (spec §5.1).
      * An edge X -> Y means X cannot settle before Y: Y is in the `on` of waiting X that is not abort-marked, or Y is live
-     * ordinary owned work of X,
-     * which holds X as `completing`. Each task is visited once and each subtree walked once, so a check is bounded by the
-     * live work it reaches.
+     * ordinary owned work of X, which holds X as `completing`. Each task is visited once and each subtree walked once,
+     * so a check is bounded by the live work it reaches. Part of a decision region: it records every record it reads.
+     * Owned work is found by walks down, which need the chains of every live task loaded.
      */
-    async #waitCycle(task, on, overlay) {
-        // Owned work is found by walks down, which need the chains of every live task loaded.
-        await this.#loadScopes(false);
+    #waitCycle(task, on, overlay) {
         const from = new Map();
         const walked = new Set();
         const pending = [];
@@ -1876,7 +2400,7 @@ export class TaskScheduler {
         for (let id = pending.pop(); id !== undefined; id = pending.pop()) {
             if (id === task)
                 return path(id);
-            const record = overlay.tasks.get(id) ?? this.#live.get(id);
+            const record = overlay.tasks.get(id) ?? this.#liveRecord(id);
             if (record === undefined || record.state.status === "terminal")
                 continue;
             // An abort-marked task waits only for its owned work, as abort runs bottom-up (`#waitingOn`).
@@ -1922,6 +2446,9 @@ export class TaskScheduler {
     /** No live non-background task in the scope; a task whose owner edges are not loaded yet counts as inside. */
     #idle(conversationId) {
         const scope = conversationId === undefined ? { roots: true } : { conversation: conversationId };
+        // In a decision region, global idle reads the roots it starts from.
+        if (conversationId === undefined)
+            this.#record(ROOTS_KEY);
         // Tasks whose chain is not loaded are not listed below their scope yet; one counts as inside unless its walk up
         // decides otherwise.
         for (const id of this.#unloaded) {
@@ -1963,7 +2490,7 @@ export class TaskScheduler {
                     catch (error) {
                         if (invocation.controller.signal.aborted)
                             throw error;
-                        this.#report(error, { type: "extension_error", extension, task: reportTask(invocation) }, invocation.context);
+                        this.#report(error, { kind: "extension_error", extension, task: reportTask(invocation) }, invocation.context);
                     }
                 }
             },
@@ -1986,8 +2513,9 @@ export class TaskScheduler {
             get registry() {
                 return phase.snapshot();
             },
-            commit: async (change, context) => {
+            commit: async (change, context, options) => {
                 let checkpoint;
+                let interrupted;
                 await this.#gated(invocation, async (tx, current) => {
                     const next = await change(tx, current);
                     if (next !== undefined)
@@ -1995,7 +2523,30 @@ export class TaskScheduler {
                     if (next?.status === "running" && current.state.checkpoint.phase !== next.checkpoint.phase) {
                         checkpoint = next.checkpoint.phase;
                     }
-                }, context);
+                    // A task that ends for crashes says so (`task_interrupted`), so a host keeps a crash-loop signal.
+                    if (next?.status === "terminal") {
+                        const restarts = current.restarts ?? 0;
+                        const reason = next.outcome.status === "failed" ? interruptionOf(next.outcome.error) : undefined;
+                        if (reason !== undefined && next.outcome.status === "failed") {
+                            interrupted = { message: next.outcome.error.message, reason, restarts };
+                        }
+                        else {
+                            // A task that ended for crashes with another outcome says so itself, as a generation whose run
+                            // answered ends `completed` without its after-run tasks.
+                            const message = endedByCrashesStates.get(next);
+                            if (message !== undefined)
+                                interrupted = { message, reason: "restart_limit", restarts };
+                        }
+                    }
+                }, context, options);
+                if (interrupted !== undefined) {
+                    this.#report(new Error(interrupted.message), {
+                        kind: "task_interrupted",
+                        ...this.#aboutTask(invocation),
+                        reason: interrupted.reason,
+                        restarts: interrupted.restarts,
+                    }, invocation.context);
+                }
                 if (checkpoint !== undefined) {
                     invocation.context.telemetry.addEvent("pi.durable.checkpoint", {
                         phase: checkpoint,
@@ -2019,7 +2570,7 @@ export class TaskScheduler {
             watchDoc: ((...args) => this.#watchDoc(invocation, args)),
             snapshot: ((...args) => this.#read(invocation, () => sessionMethod(this.#session, "snapshot")(...args))),
             snapshotAsOf: ((...args) => this.#read(invocation, () => sessionMethod(this.#session, "snapshotAsOf")(...args))),
-            getTask: ((id, context) => this.#read(invocation, () => this.#session.readOnLine(() => this.#storage.task(id, context)))),
+            getTask: ((id, context) => this.#read(invocation, () => this.#session.readOnLine((storage) => storage.task(id, context)))),
             waitForTask: ((id, context) => this.#read(invocation, () => this.waitForTask(id, withAbortSignal(invocation.controller.signal, context)))),
             ownedTasks: (context) => this.#read(invocation, () => this.#session.readOnLine(async () => {
                 // The step that ends the invocation may have run on the line before this.
@@ -2027,12 +2578,16 @@ export class TaskScheduler {
                     throw endedError(invocation);
                 context.abortSignal?.throwIfAborted();
                 // Every live task is listed under its parent node, its owner task when it has one.
-                const owned = [];
-                for (const node of this.#below.get(invocation.taskId) ?? []) {
-                    const record = typeof node === "string" ? undefined : this.#live.get(node);
-                    if (record?.owner === invocation.taskId)
-                        owned.push(record);
-                }
+                const owned = await this.#region(() => {
+                    this.#record(ownedKey(invocation.taskId));
+                    const records = [];
+                    for (const node of this.#below.get(invocation.taskId) ?? []) {
+                        const record = typeof node === "string" ? undefined : this.#liveRecord(node);
+                        if (record?.owner === invocation.taskId)
+                            records.push(record);
+                    }
+                    return records;
+                });
                 // Copies, as from storage: the scheduler reads its own.
                 return owned
                     .sort((a, b) => a.id - b.id)
@@ -2040,7 +2595,7 @@ export class TaskScheduler {
             })),
             abortOwned: (id, context) => this.#read(invocation, async () => {
                 const bound = withAbortSignal(invocation.controller.signal, context);
-                const record = await this.#session.readOnLine(() => this.#storage.task(id, bound));
+                const record = await this.#session.readOnLine((storage) => storage.task(id, bound));
                 if (record?.owner !== invocation.taskId) {
                     throw new Error(`Task ${id} is not owned by task ${invocation.taskId}`);
                 }
@@ -2049,10 +2604,10 @@ export class TaskScheduler {
                 await this.abort(id, bound, true);
                 await this.waitForTask(id, bound);
             }),
-            outcomes: ((ids, context) => this.#read(invocation, () => this.#session.readOnLine(async () => {
+            outcomes: ((ids, context) => this.#read(invocation, () => this.#session.readOnLine(async (storage) => {
                 const outcomes = [];
                 for (const id of ids) {
-                    const state = (await this.#storage.task(id, context))?.state;
+                    const state = (await storage.task(id, context))?.state;
                     if (state?.status !== "terminal")
                         throw new Error(`Task ${id} is not terminal`);
                     outcomes.push(state.outcome);
@@ -2071,13 +2626,24 @@ export class TaskScheduler {
                     ? [undefined, args[0], args[1]]
                     : [args[0], args[1], args[2]];
                 return this.#read(invocation, async () => {
-                    const found = await this.#session.readOnLine(() => this.#storage.entry(invocation.conversationId, id, context));
-                    const entry = found?.entry;
+                    // An entry of the conversation's kept context range is committed and visible: no Storage read.
+                    const kept = this.#contexts.get(invocation.conversationId);
+                    const entry = (kept === undefined ? undefined : rangeEntry(kept.range, id)) ??
+                        (await this.#session.readOnLine((storage) => storage.entry(invocation.conversationId, id, context)))
+                            ?.entry;
                     return token === undefined || entry?.kind === token.kind ? entry : undefined;
                 });
             }),
+            entries: (query, limit, cursor, context) => this.#read(invocation, () => this.#session.readOnLine((storage) => storage.scanEntries(conversationEntries(invocation.conversationId, query), limit, cursor, context))),
             context: (conversationId, context, options) => this.#read(invocation, async () => {
-                const { view, range } = await readContextFrom(this.#session, this.#storage, conversationId, context, options?.at, this.#contexts.get(conversationId)?.range);
+                const read = await readContextFrom(this.#session, this.#storage, conversationId, context, options?.at, this.#contexts.get(conversationId)?.range);
+                const { view } = read;
+                // Checked again here, synchronously up to the install below: a commit published since the read returned
+                // was not seen by `#advanceContexts`, so a range that missed it must not be advanced.
+                const range = read.range?.current === true &&
+                    this.#session.knownLatestEntryId(conversationId) !== read.range.bounds.tail
+                    ? { ...read.range, current: false }
+                    : read.range;
                 // Keep it unless the invocation ended or a concurrent read already kept a newer range.
                 const kept = this.#contexts.get(conversationId);
                 if (range !== undefined &&
@@ -2087,9 +2653,17 @@ export class TaskScheduler {
                     // A read of another, idle conversation starts or continues its retention period.
                     if (!this.#idle(conversationId)) {
                         this.#contexts.set(conversationId, { range, idleSince: undefined });
+                        this.#idleOrder.delete(conversationId);
                     }
                     else if (this.#contextRetentionMs() > 0) {
-                        this.#contexts.set(conversationId, { range, idleSince: kept?.idleSince ?? this.#now() });
+                        // An idle period that already started keeps its expiry and its place; a new one starts now.
+                        const idleSince = kept?.idleSince ?? this.#now();
+                        const expiresAt = kept?.idleSince !== undefined && kept.expiresAt !== undefined
+                            ? kept.expiresAt
+                            : idleSince + this.#contextRetentionMs();
+                        this.#contexts.set(conversationId, { range, idleSince, expiresAt });
+                        if (kept?.idleSince === undefined)
+                            this.#markIdle(conversationId, idleSince);
                         this.#scheduleExpiry();
                     }
                 }
@@ -2121,13 +2695,22 @@ export class TaskScheduler {
                 // The task's own failure names the task's extension; any other names whose code failed, if anyone's.
                 const task = reportTask(invocation);
                 this.#report(error, from === undefined
-                    ? { type: "task_error", ...this.#aboutTask(invocation) }
-                    : from.type === "extension"
-                        ? { type: "extension_error", task, ...optionalExtension(from.extension) }
-                        : { type: "host_error", callback: from.callback, task }, invocation.context);
+                    ? { kind: "task_error", ...this.#aboutTask(invocation) }
+                    : from.kind === "extension"
+                        ? { kind: "extension_error", task, ...optionalExtension(from.extension) }
+                        : { kind: "host_error", callback: from.callback, task }, invocation.context);
             },
         };
     }
+    /**
+     * On the line: wait until every commit admitted before is published, for a decision that reads what cannot be keyed,
+     * every live task (open, inspection) or every task a conversation abort reaches.
+     */
+    async #published() {
+        const gate = this.#session.touch(ALL_KEYS);
+        if (gate !== undefined)
+            await gate;
+    }
     /** Run a committed-state read unless the invocation has ended. */
     async #read(invocation, read) {
         if (invocation.ended)
@@ -2135,7 +2718,7 @@ export class TaskScheduler {
         return read();
     }
     /** Commit after rereading the task on the line and gating the invocation. */
-    #gated(invocation, change, context) {
+    #gated(invocation, change, context, options) {
         if (invocation.ended)
             return Promise.reject(endedError(invocation));
         return this.#session.commitWith(async (tx) => {
@@ -2143,17 +2726,22 @@ export class TaskScheduler {
                 throw endedError(invocation);
             if (this.#closing)
                 throw closedError(this.#session);
-            const found = this.#live.get(invocation.taskId);
-            if (found === undefined)
-                throw new Error(`Task ${invocation.taskId} is terminal`);
-            if (found.state.status !== "running")
-                throw new Error(`Task ${invocation.taskId} is ${found.state.status}`);
-            const current = found;
-            if (invocation.mode === "run" && current.abortRequested) {
-                throw new Error(`Task ${invocation.taskId} has a durable abort mark`);
-            }
+            const current = await this.#region(() => {
+                const found = this.#liveRecord(invocation.taskId);
+                if (found === undefined)
+                    throw new Error(`Task ${invocation.taskId} is terminal`);
+                if (found.state.status !== "running")
+                    throw new Error(`Task ${invocation.taskId} is ${found.state.status}`);
+                if (invocation.mode === "run" && found.abortRequested) {
+                    throw new Error(`Task ${invocation.taskId} has a durable abort mark`);
+                }
+                return found;
+            });
+            // The step that ends it may have run while the region waited.
+            if (invocation.ended)
+                throw endedError(invocation);
             return change(tx, current);
-        }, context, { conversationId: invocation.conversationId, taskId: invocation.taskId });
+        }, context, { conversationId: invocation.conversationId, taskId: invocation.taskId }, options);
     }
     async #watchDoc(invocation, args) {
         if (invocation.ended)
@@ -2170,9 +2758,10 @@ export class TaskScheduler {
         return watch;
     }
 }
-const REGISTRY = { type: "host_error", callback: "registry" };
-const SETTINGS = { type: "host_error", callback: "settings" };
-const ON_WAKE = { type: "host_error", callback: "onWake" };
+const REGISTRY = { kind: "host_error", callback: "registry" };
+const SETTINGS = { kind: "host_error", callback: "settings" };
+const ON_WAKE = { kind: "host_error", callback: "onWake" };
+const TELEMETRY = { kind: "host_error", callback: "telemetry" };
 /** The extension that installed `task` in `snapshot`, the last one that lists it; none for a built-in task. */
 function installerOf(snapshot, task) {
     if (task === undefined)
@@ -2191,6 +2780,24 @@ function recordTask(record) {
  * The record with an abort mark: `restart` for an abandonment; without a reason, a request, which replaces `restart`.
  * The restart count starts over: it now counts cut-offs of the abort handler.
  */
+/** Why a failed outcome's error says crashes ended the task (`detail.reason`), if it does. */
+/**
+ * Terminal states a built-in task commits because it was cut off `settings.restartLimit` times, when their outcome does
+ * not say so (a failure with detail `{ reason: "restart_limit" }` does), with the message the scheduler reports them
+ * `task_interrupted` with. Keyed by the state object the task returns, so nothing is added to the stored state.
+ */
+const endedByCrashesStates = new WeakMap();
+/** `state`, marked as ending its task for crashes (`task_interrupted` with `message`), whatever its outcome. */
+export function endedByCrashes(state, message) {
+    endedByCrashesStates.set(state, message);
+    return state;
+}
+function interruptionOf(error) {
+    const detail = error.detail;
+    if (typeof detail !== "object" || detail === null || !("reason" in detail))
+        return undefined;
+    return detail.reason === "restart_limit" || detail.reason === "interrupted" ? detail.reason : undefined;
+}
 function withAbortMark(record, reason) {
     const { abortReason: _reason, restarts: _restarts, ...rest } = record;
     return { ...rest, abortRequested: true, ...(reason === undefined ? {} : { abortReason: reason }) };
@@ -2199,6 +2806,16 @@ function withAbortMark(record, reason) {
 function cancellationIntent(record) {
     return record.state.status !== "terminal" && (record.abortRequested || failedOutcome(record));
 }
+/**
+ * Whether replacing `previous` (absent: a new task) with `next` changes the cancellation intent set or what it means: a
+ * mark set, upgraded, or cleared, or a held or ended outcome other than `completed`.
+ */
+function intentChanges(previous, next) {
+    return ((previous?.abortRequested ?? false) !== next.abortRequested ||
+        previous?.abortReason !== next.abortReason ||
+        (previous !== undefined && failedOutcome(previous)) !== failedOutcome(next) ||
+        (previous !== undefined && cancellationIntent(previous)) !== cancellationIntent(next));
+}
 /** Whether the record holds or ends with an outcome other than `completed`. */
 function failedOutcome(record) {
     const state = record.state;
@@ -2267,6 +2884,15 @@ function withState(record, state) {
     return { ...rest, state };
 }
 /** Whether a definition can take the task at reservation: same version, or newer with a migration. */
+/**
+ * Why a replacement definition cannot take a running task, in `#fit()`'s words: none is registered, it is older than
+ * the task, or it is newer without a `migrate`.
+ */
+function outdatedReason(task, record) {
+    if (task === undefined)
+        return "missing_task";
+    return task.definition.version < record.version ? "task_too_old" : "migration_failed";
+}
 function canReserve(task, record) {
     const definition = task.definition;
     return (definition.version === record.version || (definition.version > record.version && definition.migrate !== undefined));