@frockbot/kernel-do 0.3.15 → 0.3.17

package/src/authority.ts

@@ -16,6 +16,9 @@ import {
   botTurnCommandFingerprintV1,
   defaultRunLaneV1,
   storedRunAdmissionV1,
+  storedRunLaneV1,
+  storedRunEventFieldsV2,
+  storedRunRecordV2,
   storedRunSubagentRoleV1,
   storedRunTurnTypeV1,
   type BotNotificationIntent,
@@ -41,6 +44,10 @@ import {
   unresolvedModelRequestFailure,
 } from "./run-recovery.js";
 import { runLivenessV1, STALE_RUNNING_RUN_FAILURE_V1 } from "./run-liveness.js";
+import {
+  SessionEventLog,
+  type SessionEventLogStorage,
+} from "./session-event-log.js";
 import {
   BotTurnReconciliationRequiredError,
   BotTurnRecoveryRequiredError,
@@ -61,6 +68,8 @@ import {
   CONVERSATION_INDEX_KEY,
   CONVERSATION_KEY,
   MAX_LISTED_CONVERSATIONS,
+  MAX_PENDING_AGENT_RUNS_V1,
+  PENDING_AGENT_RUN_PREFIX,
   PENDING_RUN_KEY,
   IDENTITY_KEY,
   LATEST_EVENTS_KEY,
@@ -71,6 +80,7 @@ import {
   RUN_ADMISSION_FENCE_PREFIX,
   RUN_INDEX_PREFIX,
   RUN_PREFIX,
+  pendingAgentRunKey,
   runIndexKey,
   storedRunAdmissionFences,
 } from "./storage-keys.js";
@@ -384,20 +394,35 @@ export class BotDurableAuthority<Snapshot> {
     return this.ctx.storage.transaction(async (transaction) => {
       const pendingRunId = await transaction.get<string>(PENDING_RUN_KEY);
       const run = this.codec.optional(await transaction.get<unknown>(key));
-      if (
-        pendingRunId !== runId ||
-        !run ||
-        run.status !== "running" ||
-        run.phase !== "queued"
-      ) {
+      const lane = run ? storedRunLaneV1(run) : undefined;
+      const firstPendingAgent = await transaction.list<string>({
+        prefix: PENDING_AGENT_RUN_PREFIX,
+        limit: 1,
+      });
+      const firstPendingAgentEntry = firstPendingAgent.entries().next()
+        .value as [string, string] | undefined;
+      if (!run || run.status !== "running" || run.phase !== "queued") {
+        return "not-queued" as const;
+      }
+      if (lane === "agent") {
+        // A User Turn always has first claim on an idle Bot, and agent Turns
+        // retain FIFO order behind it. The run is still queued in either case;
+        // reporting `not-queued` here would strand its blocking caller even
+        // though the durable queue entry remains.
+        if (pendingRunId !== undefined) return "blocked" as const;
+        if (firstPendingAgentEntry?.[1] !== runId) {
+          return firstPendingAgentEntry
+            ? ("blocked" as const)
+            : ("not-queued" as const);
+        }
+      } else if (pendingRunId !== runId) {
         return "not-queued" as const;
       }
       if (await transaction.get<string>(ACTIVE_RUN_KEY)) {
         return "blocked" as const;
       }
-      const storedEvents = (
-        (await transaction.get<SessionEvent[]>(LATEST_EVENTS_KEY)) ?? []
-      ).map(decodeSessionEvent);
+      const eventLog = new SessionEventLog(transaction);
+      const storedEvents = await eventLog.migrate(run.sessionId);
       // A queued Turn was admitted while another was executing, so admission
       // could not repair the log: something was still entitled to close that
       // Turn. Here the active-run marker is gone and nothing is, so the same
@@ -408,19 +433,18 @@ export class BotDurableAuthority<Snapshot> {
         ...run,
         phase: "admitted",
         previousEventCount: latestEvents.length,
+        ...storedRunEventFieldsV2(latestEvents.length, []),
       } satisfies StoredRunV1<Snapshot>);
+      if (repaired) await eventLog.rewrite(run.sessionId, latestEvents);
       await transaction.put({
-        [key]: structuredClone(promoted),
+        [key]: structuredClone(storedRunRecordV2(promoted)),
         [ACTIVE_RUN_KEY]: runId,
-        ...(repaired
-          ? {
-              [LATEST_EVENTS_KEY]: structuredClone(
-                repaired.map(decodeSessionEvent),
-              ),
-            }
-          : {}),
       });
-      await transaction.delete(PENDING_RUN_KEY);
+      if (lane === "agent" && firstPendingAgentEntry) {
+        await transaction.delete(firstPendingAgentEntry[0]);
+      } else {
+        await transaction.delete(PENDING_RUN_KEY);
+      }
       await this.refreshRecoveryAlarm(transaction);
       return {
         previous: latestEvents,
@@ -437,7 +461,7 @@ export class BotDurableAuthority<Snapshot> {
     await this.assertIdentity(identity);
     const key = `${RUN_PREFIX}${runId}`;
     const recovery = await this.ctx.storage.transaction(async (transaction) => {
-      const run = this.codec.optional(await transaction.get<unknown>(key));
+      const run = await this.readRunFrom(transaction, runId);
       const activeRunId = await transaction.get<string>(ACTIVE_RUN_KEY);
       if (
         !run ||
@@ -446,9 +470,7 @@ export class BotDurableAuthority<Snapshot> {
       ) {
         throw new Error(`run "${runId}" does not require reconciliation`);
       }
-      const latest = (
-        (await transaction.get<SessionEvent[]>(LATEST_EVENTS_KEY)) ?? []
-      ).map(decodeSessionEvent);
+      const latest = await new SessionEventLog(transaction).read(run.sessionId);
       const settings = run.configurationSnapshot;
       // The failure is *removed*, not set to `undefined`: a running run that
       // carries a `failure` key is a shape the run record does not allow, and
@@ -456,15 +478,14 @@ export class BotDurableAuthority<Snapshot> {
       // read afterwards. `require` checks it here, where the write is, rather
       // than leaving the projector to fail on every later read.
       const { failure: _failure, ...resumed } = run;
+      const resumedRun = this.codec.require({
+        ...resumed,
+        status: "running",
+        phase: "executing",
+      } satisfies StoredRunV1<Snapshot>);
       await transaction.put(
         key,
-        structuredClone(
-          this.codec.require({
-            ...resumed,
-            status: "running",
-            phase: "executing",
-          } satisfies StoredRunV1<Snapshot>),
-        ),
+        structuredClone(storedRunRecordV2(resumedRun)),
       );
       await this.refreshRecoveryAlarm(transaction);
       return { run, latest, settings };
@@ -477,9 +498,7 @@ export class BotDurableAuthority<Snapshot> {
         recovery.settings,
       );
     } catch (error) {
-      const current = this.codec.optional(
-        await this.ctx.storage.get<unknown>(key),
-      );
+      const current = await this.readRun(runId);
       if (current?.status === "reconciliation-required") {
         const previous = recovery.latest.slice(0, current.previousEventCount);
         const failure =
@@ -511,9 +530,7 @@ export class BotDurableAuthority<Snapshot> {
   private async settledTerminalRunResult(
     runId: string,
   ): Promise<BotTurnCompletion | undefined> {
-    const run = this.codec.optional(
-      await this.ctx.storage.get<unknown>(`${RUN_PREFIX}${runId}`),
-    );
+    const run = await this.readRun(runId);
     if (
       run?.status !== "failed" &&
       run?.status !== "cancelled" &&
@@ -572,10 +589,13 @@ export class BotDurableAuthority<Snapshot> {
         if (!run || run.status !== "running") {
           throw new Error(`run "${command.runId}" is not resumable`);
         }
-        await transaction.put(key, {
-          ...run,
-          phase: "executing",
-        } satisfies StoredRunV1<Snapshot>);
+        await transaction.put(
+          key,
+          storedRunRecordV2({
+            ...run,
+            phase: "executing",
+          } satisfies StoredRunV1<Snapshot>),
+        );
         await this.refreshRecoveryAlarm(transaction);
       });
       const result = await this.hooks.executeTurn({
@@ -592,9 +612,7 @@ export class BotDurableAuthority<Snapshot> {
       await this.completeRun(command.runId, previous, completed, settings);
       return completed;
     } catch (error) {
-      const durableRun = this.codec.optional(
-        await this.ctx.storage.get<unknown>(`${RUN_PREFIX}${command.runId}`),
-      );
+      const durableRun = await this.readRun(command.runId);
       const events = eventsForFailedRun(durableRun, error);
       const message =
         error instanceof Error ? error.message : "Bot turn failed";
@@ -652,9 +670,7 @@ export class BotDurableAuthority<Snapshot> {
   private async discardedRunResult(
     runId: string,
   ): Promise<BotTurnCompletion | undefined> {
-    const run = this.codec.optional(
-      await this.ctx.storage.get<unknown>(`${RUN_PREFIX}${runId}`),
-    );
+    const run = await this.readRun(runId);
     if (run?.status !== "superseded" && run?.status !== "cancelled") {
       return undefined;
     }
@@ -669,9 +685,7 @@ export class BotDurableAuthority<Snapshot> {
   private async terminalRunResult(
     runId: string,
   ): Promise<BotTurnCompletion | undefined> {
-    const run = this.codec.optional(
-      await this.ctx.storage.get<unknown>(`${RUN_PREFIX}${runId}`),
-    );
+    const run = await this.readRun(runId);
     if (run?.status === "superseded" || run?.status === "cancelled") {
       return { runId, text: "", events: structuredClone(run.events) };
     }
@@ -714,6 +728,7 @@ export class BotDurableAuthority<Snapshot> {
           // Recovery re-mounts on the recorded turn type, so the resumed Turn
           // sees the same trimmed catalog the evicted one did.
           turnType: storedRunTurnTypeV1(run),
+          lane: storedRunLaneV1(run),
           ...(storedRunSubagentRoleV1(run)
             ? { subagentRole: storedRunSubagentRoleV1(run) }
             : {}),
@@ -730,9 +745,7 @@ export class BotDurableAuthority<Snapshot> {
           ? { admittedRequest: modelState.request.request }
           : {}),
       });
-      const durableRun = this.codec.optional(
-        await this.ctx.storage.get<unknown>(`${RUN_PREFIX}${run.runId}`),
-      );
+      const durableRun = await this.readRun(run.runId);
       if (!durableRun) throw new Error(`run "${run.runId}" was not accepted`);
       const fullResult = {
         ...result,
@@ -742,9 +755,7 @@ export class BotDurableAuthority<Snapshot> {
       await this.completeRun(run.runId, previous, completed, settings);
       return completed;
     } catch (error) {
-      const durableRun = this.codec.optional(
-        await this.ctx.storage.get<unknown>(`${RUN_PREFIX}${run.runId}`),
-      );
+      const durableRun = await this.readRun(run.runId);
       const events = durableRun?.events ?? run.events;
       const message =
         error instanceof Error ? error.message : "Bot turn failed";
@@ -780,16 +791,17 @@ export class BotDurableAuthority<Snapshot> {
 
   private async deferRunRecovery(runId: string): Promise<void> {
     await this.ctx.storage.transaction(async (transaction) => {
-      const run = this.codec.optional(
-        await transaction.get<unknown>(`${RUN_PREFIX}${runId}`),
-      );
+      const run = await this.readRunFrom(transaction, runId);
       if (!run || run.status !== "running") {
         throw new Error(`run "${runId}" is not resumable`);
       }
-      await transaction.put(`${RUN_PREFIX}${runId}`, {
-        ...run,
-        phase: "executing",
-      } satisfies StoredRunV1<Snapshot>);
+      await transaction.put(
+        `${RUN_PREFIX}${runId}`,
+        storedRunRecordV2({
+          ...run,
+          phase: "executing",
+        } satisfies StoredRunV1<Snapshot>),
+      );
       await this.refreshRecoveryAlarm(transaction);
     });
   }
@@ -798,9 +810,7 @@ export class BotDurableAuthority<Snapshot> {
     command: OwnedBotTurnCommand,
   ): Promise<BotTurnCompletion | undefined> {
     const { runId } = command;
-    const run = this.codec.optional(
-      await this.ctx.storage.get<unknown>(`${RUN_PREFIX}${runId}`),
-    );
+    const run = await this.readRun(runId);
     if (!run) return undefined;
     if (run.commandFingerprint !== botTurnCommandFingerprintV1(command)) {
       throw new BotTurnRefusedError(
@@ -900,10 +910,13 @@ export class BotDurableAuthority<Snapshot> {
         throw new Error(`run "${runId}" is not resumable`);
       }
       if (run.compositionGenerationId === compositionGenerationId) return;
-      await transaction.put(key, {
-        ...run,
-        compositionGenerationId,
-      } satisfies StoredRunV1<Snapshot>);
+      await transaction.put(
+        key,
+        storedRunRecordV2({
+          ...run,
+          compositionGenerationId,
+        } satisfies StoredRunV1<Snapshot>),
+      );
     });
   }
 
@@ -928,6 +941,26 @@ export class BotDurableAuthority<Snapshot> {
       });
       return;
     }
+    const [activeBeforeAlarm, pendingUser, pendingAgents] = await Promise.all([
+      this.ctx.storage.get<string>(ACTIVE_RUN_KEY),
+      this.ctx.storage.get<string>(PENDING_RUN_KEY),
+      this.ctx.storage.list<string>({
+        prefix: PENDING_AGENT_RUN_PREFIX,
+        limit: 1,
+      }),
+    ]);
+    // An admitted Turn is work already owed. It runs before a due Routine;
+    // otherwise a busy schedule can starve a Bot-to-Bot question indefinitely.
+    if (!activeBeforeAlarm && (pendingUser || pendingAgents.size > 0)) {
+      try {
+        await this.recoverQueuedRun();
+      } finally {
+        await this.ctx.storage.transaction((transaction) =>
+          this.refreshRecoveryAlarm(transaction),
+        );
+      }
+      return;
+    }
     await this.hooks.settleScheduledWork();
     const activeRunId = await this.ctx.storage.get<string>(ACTIVE_RUN_KEY);
     if (activeRunId) {
@@ -1058,7 +1091,11 @@ export class BotDurableAuthority<Snapshot> {
     return this.ctx.storage.transaction(async (transaction) => {
       const active = await transaction.get<string>(ACTIVE_RUN_KEY);
       const pending = await transaction.get<string>(PENDING_RUN_KEY);
-      if (active || pending) {
+      const pendingAgent = await transaction.list<string>({
+        prefix: PENDING_AGENT_RUN_PREFIX,
+        limit: 1,
+      });
+      if (active || pending || pendingAgent.size > 0) {
         // A typed refusal, not a bare Error: the Durable Object boundary turns
         // this one case into a 409 value rather than letting it escape the
         // object's entry frame as an uncaught exception.
@@ -1083,12 +1120,17 @@ export class BotDurableAuthority<Snapshot> {
         ordinal: current.ordinal + 1,
         startedAt: endedAt,
       };
+      const currentSessionId = conversationSessionIdV1(base, current.ordinal);
+      const nextSessionId = conversationSessionIdV1(base, next.ordinal);
+      const eventLog = new SessionEventLog(transaction);
+      await eventLog.migrate(currentSessionId);
+      await eventLog.clearCurrent(nextSessionId);
       await transaction.put({
         [CONVERSATION_KEY]: next,
         [CONVERSATION_INDEX_KEY]: [
           {
             schemaVersion: 1 as const,
-            sessionId: conversationSessionIdV1(base, current.ordinal),
+            sessionId: currentSessionId,
             ordinal: current.ordinal,
             startedAt: current.startedAt,
             endedAt,
@@ -1097,13 +1139,10 @@ export class BotDurableAuthority<Snapshot> {
         ]
           .sort((left, right) => right.ordinal - left.ordinal)
           .slice(0, MAX_LISTED_CONVERSATIONS),
-        // The next Turn derives its messages from an empty log. Nothing is
-        // deleted: `run:<id>` still holds every event of every Turn.
-        [LATEST_EVENTS_KEY]: [],
       });
       return {
         schemaVersion: 1 as const,
-        sessionId: conversationSessionIdV1(base, next.ordinal),
+        sessionId: nextSessionId,
         ordinal: next.ordinal,
         startedAt: next.startedAt,
       };
@@ -1135,9 +1174,64 @@ export class BotDurableAuthority<Snapshot> {
   async readStoredRun(
     runId: string,
   ): Promise<StoredRunV1<Snapshot> | undefined> {
-    return this.codec.optional(
+    return this.readRunFrom(this.ctx.storage, runId);
+  }
+
+  private async readRunFrom(
+    storage: SessionEventLogStorage,
+    runId: string,
+  ): Promise<StoredRunV1<Snapshot> | undefined> {
+    const run = this.codec.optional(
+      await storage.get<unknown>(`${RUN_PREFIX}${runId}`),
+    );
+    if (!run?.eventRange) return run;
+    const events = await new SessionEventLog(storage).readRange(
+      run.sessionId,
+      run.eventRange.startSeq,
+      run.eventRange.endSeq,
+    );
+    if (events.length !== run.eventRange.endSeq - run.eventRange.startSeq) {
+      throw new Error(`run "${run.runId}" has an incomplete event range`);
+    }
+    return this.codec.require({ ...run, events });
+  }
+
+  /** Exact Session history, reconstructed through the paged durable log. */
+  async readSessionEvents(sessionId: string): Promise<SessionEvent[]> {
+    return new SessionEventLog(this.ctx.storage).read(sessionId);
+  }
+
+  /**
+   * The bounded durable event projections for a run. This is the inspection
+   * path: recovery and client transcript projection use `readStoredRun` and
+   * therefore receive exact events, while a debug snapshot never hydrates a
+   * multi-megabyte prompt merely to cut it again.
+   */
+  async readRunEventProjections(runId: string): Promise<
+    | {
+        run: StoredRunV1<Snapshot>;
+        events: unknown[];
+        eventCount: number;
+      }
+    | undefined
+  > {
+    const run = this.codec.optional(
       await this.ctx.storage.get<unknown>(`${RUN_PREFIX}${runId}`),
     );
+    if (!run) return undefined;
+    if (!run.eventRange) {
+      return { run, events: run.events, eventCount: run.events.length };
+    }
+    const events = await new SessionEventLog(this.ctx.storage).readProjections(
+      run.sessionId,
+      run.eventRange.startSeq,
+      run.eventRange.endSeq,
+    );
+    const eventCount = run.eventRange.endSeq - run.eventRange.startSeq;
+    if (events.length !== eventCount) {
+      throw new Error(`run "${run.runId}" has an incomplete event range`);
+    }
+    return { run, events, eventCount };
   }
 
   /** Durable run record, checked against the key it was looked up by. */
@@ -1183,9 +1277,9 @@ export class BotDurableAuthority<Snapshot> {
     if (runId === this.executingRunId) return true;
     const run = await this.readRun(runId);
     if (!run || run.status !== "running") return false;
-    const sessionEvents = (
-      (await this.ctx.storage.get<SessionEvent[]>(LATEST_EVENTS_KEY)) ?? []
-    ).map(decodeSessionEvent);
+    const sessionEvents = await new SessionEventLog(this.ctx.storage).read(
+      run.sessionId,
+    );
     if (runLivenessV1({ run, sessionEvents }).working) return true;
     await this.settleStaleRun(runId);
     return false;
@@ -1202,13 +1296,9 @@ export class BotDurableAuthority<Snapshot> {
   private async settleStaleRun(runId: string): Promise<void> {
     await this.ctx.storage.transaction(async (transaction) => {
       if (runId === this.executingRunId) return;
-      const run = this.codec.optional(
-        await transaction.get<unknown>(`${RUN_PREFIX}${runId}`),
-      );
+      const run = await this.readRunFrom(transaction, runId);
       if (!run || run.runId !== runId || run.status !== "running") return;
-      const latest = (
-        (await transaction.get<SessionEvent[]>(LATEST_EVENTS_KEY)) ?? []
-      ).map(decodeSessionEvent);
+      const latest = await new SessionEventLog(transaction).read(run.sessionId);
       if (runLivenessV1({ run, sessionEvents: latest }).working) return;
       await failStoredRun(
         this.codec,
@@ -1283,9 +1373,13 @@ export class BotDurableAuthority<Snapshot> {
   async refreshRecoveryAlarm(
     transaction: DurableObjectTransaction,
   ): Promise<void> {
-    const [activeRunId, scheduled] = await Promise.all([
+    const [activeRunId, scheduled, pendingAgents] = await Promise.all([
       transaction.get<string>(ACTIVE_RUN_KEY),
       this.hooks.scheduledDeadlines(transaction),
+      transaction.list<string>({
+        prefix: PENDING_AGENT_RUN_PREFIX,
+        limit: 1,
+      }),
     ]);
     const activeRun = activeRunId
       ? this.codec.optional(
@@ -1300,7 +1394,8 @@ export class BotDurableAuthority<Snapshot> {
       deadlines.push(Date.now() + RECOVERY_ALARM_DELAY_MS);
     } else if (
       !activeRunId &&
-      (await transaction.get<string>(PENDING_RUN_KEY))
+      ((await transaction.get<string>(PENDING_RUN_KEY)) ||
+        pendingAgents.size > 0)
     ) {
       // A Turn admitted and waiting is work this object owes, so it keeps the
       // recovery alarm even with nothing running.
@@ -1386,12 +1481,64 @@ export class BotDurableAuthority<Snapshot> {
         throw new Error("Bot authority does not match its durable identity");
       }
       const activeRunId = await transaction.get<string>(ACTIVE_RUN_KEY);
-      const supersede = activeRunId
-        ? await this.planSupersede(transaction, command, activeRunId)
+      const pendingUserRunId = await transaction.get<string>(PENDING_RUN_KEY);
+      const lane = command.lane ?? defaultRunLaneV1(command.turnType ?? "chat");
+      const activeRun = activeRunId
+        ? this.codec.optional(
+            await transaction.get<unknown>(`${RUN_PREFIX}${activeRunId}`),
+          )
         : undefined;
-      const storedEvents = (
-        (await transaction.get<SessionEvent[]>(LATEST_EVENTS_KEY)) ?? []
-      ).map(decodeSessionEvent);
+      const pendingAgents = await transaction.list<string>({
+        prefix: PENDING_AGENT_RUN_PREFIX,
+      });
+      const hasPendingAgent = pendingAgents.size > 0;
+      let supersede: ((supersededBy: string) => Promise<boolean>) | undefined;
+      if (activeRunId) {
+        if (
+          lane === "agent" &&
+          activeRun?.status === "reconciliation-required"
+        ) {
+          throw new BotTurnRefusedError(
+            "reconciliation-required",
+            "bot cannot admit agent work while its active run requires reconciliation",
+          );
+        }
+        if (lane === "user") {
+          supersede = await this.planSupersede(
+            transaction,
+            command,
+            activeRunId,
+          );
+        } else if (lane === "background") {
+          throw new BotTurnRefusedError(
+            "busy",
+            "bot already has an active run",
+          );
+        }
+      } else if (
+        lane === "background" &&
+        (pendingUserRunId || hasPendingAgent)
+      ) {
+        throw new BotTurnRefusedError(
+          "busy",
+          "bot has queued conversational work",
+        );
+      }
+      const queued =
+        Boolean(activeRunId) ||
+        (lane === "agent" && (Boolean(pendingUserRunId) || hasPendingAgent));
+      if (
+        lane === "agent" &&
+        queued &&
+        pendingAgents.size >= MAX_PENDING_AGENT_RUNS_V1
+      ) {
+        throw new BotTurnRefusedError(
+          "busy",
+          `bot agent queue is full (${MAX_PENDING_AGENT_RUNS_V1} Turns)`,
+        );
+      }
+      const eventLog = new SessionEventLog(transaction);
+      const storedEvents = await eventLog.migrate(command.sessionId);
       // A Turn that died between `turn/start` and `turn/end` — an event the
       // encoder refused, a durable write that failed — left the log open, and
       // every later Turn failed validation with "turn N started while turn
@@ -1407,11 +1554,6 @@ export class BotDurableAuthority<Snapshot> {
       // that Turn's end: a `running` record is, and so is a
       // `reconciliation-required` one, whose Turn is held open on purpose
       // until its outcome is retrieved. Nothing else is.
-      const activeRun = activeRunId
-        ? this.codec.optional(
-            await transaction.get<unknown>(`${RUN_PREFIX}${activeRunId}`),
-          )
-        : undefined;
       const stillOwned =
         activeRun?.status === "running" ||
         activeRun?.status === "reconciliation-required";
@@ -1426,12 +1568,7 @@ export class BotDurableAuthority<Snapshot> {
         ? undefined
         : repairedSessionLogV1(command.sessionId, storedEvents);
       const latestEvents = repaired ?? storedEvents;
-      if (repaired) {
-        await transaction.put(
-          LATEST_EVENTS_KEY,
-          structuredClone(latestEvents.map(decodeSessionEvent)),
-        );
-      }
+      if (repaired) await eventLog.rewrite(command.sessionId, latestEvents);
       const admittedSettings = await this.hooks.admittedSnapshot(
         transaction,
         settings,
@@ -1449,7 +1586,7 @@ export class BotDurableAuthority<Snapshot> {
         // A queued Turn is admitted — durable, ordered, and owed a terminal
         // state — but has not started. Its `previousEventCount` is recomputed
         // when it is promoted, because the Turn ahead of it is still writing.
-        phase: activeRunId ? "queued" : "admitted",
+        phase: queued ? "queued" : "admitted",
         compositionGenerationId: pin.generationId,
         configurationSnapshot: structuredClone(admittedSettings),
         previousEventCount: latestEvents.length,
@@ -1464,10 +1601,15 @@ export class BotDurableAuthority<Snapshot> {
           : {}),
       } satisfies StoredRunV1<Snapshot>);
       await transaction.put({
-        [key]: admittedRun,
+        [key]: storedRunRecordV2(admittedRun),
         [runIndexKey(command.acceptedAt, command.runId)]: command.runId,
-        ...(activeRunId
-          ? { [PENDING_RUN_KEY]: command.runId }
+        ...(queued
+          ? lane === "agent"
+            ? {
+                [pendingAgentRunKey(command.acceptedAt, command.runId)]:
+                  command.runId,
+              }
+            : { [PENDING_RUN_KEY]: command.runId }
           : { [ACTIVE_RUN_KEY]: command.runId }),
         [IDENTITY_KEY]: identity ?? {
           userId: command.userId,
@@ -1476,13 +1618,15 @@ export class BotDurableAuthority<Snapshot> {
       });
       const interrupted = supersede ? await supersede(command.runId) : false;
       await this.refreshRecoveryAlarm(transaction);
-      if (activeRunId) {
+      if (queued) {
         return {
           kind: "queued" as const,
           // Only a Turn whose supersede intent was actually recorded is
           // interrupted. One that had not dispatched a model request is left
           // to finish, and the new message simply waits behind it.
-          ...(interrupted ? { interrupt: { runId: activeRunId } } : {}),
+          ...(interrupted && activeRunId
+            ? { interrupt: { runId: activeRunId } }
+            : {}),
         };
       }
       return {
@@ -1521,9 +1665,7 @@ export class BotDurableAuthority<Snapshot> {
     if (lane !== "user" || !command.supersedes) {
       throw new BotTurnRefusedError("busy", "bot already has an active run");
     }
-    const active = this.codec.optional(
-      await transaction.get<unknown>(`${RUN_PREFIX}${activeRunId}`),
-    );
+    const active = await this.readRunFrom(transaction, activeRunId);
     if (!active)
       throw new BotTurnRefusedError("busy", "bot already has an active run");
     if (active.status === "reconciliation-required") {
@@ -1551,15 +1693,14 @@ export class BotDurableAuthority<Snapshot> {
       }
       if (!dispatched) return false;
       if (active.supersededAt) return true;
+      const superseded = this.codec.require({
+        ...active,
+        supersededAt: new Date().toISOString(),
+        supersededBy,
+      } satisfies StoredRunV1<Snapshot>);
       await transaction.put(
         `${RUN_PREFIX}${activeRunId}`,
-        structuredClone(
-          this.codec.require({
-            ...active,
-            supersededAt: new Date().toISOString(),
-            supersededBy,
-          } satisfies StoredRunV1<Snapshot>),
-        ),
+        structuredClone(storedRunRecordV2(superseded)),
       );
       return true;
     };
@@ -1580,18 +1721,14 @@ export class BotDurableAuthority<Snapshot> {
       return;
     }
     const { responseText: _text, failure: _failure, ...settled } = queued;
-    await transaction.put(
-      key,
-      structuredClone(
-        this.codec.require({
-          ...settled,
-          status: "superseded",
-          phase: "admitted",
-          supersededAt: new Date().toISOString(),
-          supersededBy,
-        } satisfies StoredRunV1<Snapshot>),
-      ),
-    );
+    const superseded = this.codec.require({
+      ...settled,
+      status: "superseded",
+      phase: "admitted",
+      supersededAt: new Date().toISOString(),
+      supersededBy,
+    } satisfies StoredRunV1<Snapshot>);
+    await transaction.put(key, structuredClone(storedRunRecordV2(superseded)));
   }
 
   private async persistRunEvents(
@@ -1604,11 +1741,10 @@ export class BotDurableAuthority<Snapshot> {
     if (durableEvents.length === 0) return;
     const key = `${RUN_PREFIX}${runId}`;
     await this.ctx.storage.transaction(async (transaction) => {
-      const run = this.codec.optional(await transaction.get<unknown>(key));
+      const run = await this.readRunFrom(transaction, runId);
       if (!run) throw new Error(`run "${runId}" was not accepted`);
-      const latest = (
-        (await transaction.get<SessionEvent[]>(LATEST_EVENTS_KEY)) ?? []
-      ).map(decodeSessionEvent);
+      const eventLog = new SessionEventLog(transaction);
+      const latest = await eventLog.read(run.sessionId);
       for (const [index, event] of durableEvents.entries()) {
         if (event.seq !== latest.length + index) {
           throw new Error(
@@ -1618,12 +1754,13 @@ export class BotDurableAuthority<Snapshot> {
       }
       const next = this.codec.require({
         ...run,
-        events: [...run.events, ...durableEvents],
+        ...storedRunEventFieldsV2(run.previousEventCount, [
+          ...run.events,
+          ...durableEvents,
+        ]),
       } satisfies StoredRunV1<Snapshot>);
-      await transaction.put({
-        [key]: structuredClone(next),
-        [LATEST_EVENTS_KEY]: structuredClone([...latest, ...durableEvents]),
-      });
+      await eventLog.append(run.sessionId, durableEvents);
+      await transaction.put(key, structuredClone(storedRunRecordV2(next)));
     });
   }
 
@@ -1792,7 +1929,16 @@ export class BotDurableAuthority<Snapshot> {
    * do the promoting itself.
    */
   private async recoverQueuedRun(): Promise<void> {
-    const pendingRunId = await this.ctx.storage.get<string>(PENDING_RUN_KEY);
+    const pendingUserRunId =
+      await this.ctx.storage.get<string>(PENDING_RUN_KEY);
+    const pendingAgents = pendingUserRunId
+      ? new Map<string, string>()
+      : await this.ctx.storage.list<string>({
+          prefix: PENDING_AGENT_RUN_PREFIX,
+          limit: 1,
+        });
+    const pendingRunId =
+      pendingUserRunId ?? pendingAgents.values().next().value;
     if (!pendingRunId || this.queuedWaiters.has(pendingRunId)) return;
     if (pendingRunId === this.executingRunId) return;
     const durableIdentity =
@@ -1823,6 +1969,7 @@ export class BotDurableAuthority<Snapshot> {
       acceptedAt: run.acceptedAt,
       text: run.input,
       turnType: storedRunTurnTypeV1(run),
+      lane: storedRunLaneV1(run),
       ...(storedRunSubagentRoleV1(run)
         ? { subagentRole: storedRunSubagentRoleV1(run) }
         : {}),
@@ -1841,7 +1988,7 @@ export class BotDurableAuthority<Snapshot> {
     const recovery = await this.ctx.storage.transaction(async (transaction) => {
       const current = await transaction.get<string>(ACTIVE_RUN_KEY);
       if (!current || current === this.executingRunId) return undefined;
-      const run = this.codec.optional(await transaction.get<unknown>(key));
+      const run = await this.readRunFrom(transaction, activeRunId);
       if (run?.status === "reconciliation-required") {
         await this.refreshRecoveryAlarm(transaction);
         return undefined;
@@ -1850,9 +1997,8 @@ export class BotDurableAuthority<Snapshot> {
         await this.refreshRecoveryAlarm(transaction);
         return undefined;
       }
-      const latest = (
-        (await transaction.get<SessionEvent[]>(LATEST_EVENTS_KEY)) ?? []
-      ).map(decodeSessionEvent);
+      const eventLog = new SessionEventLog(transaction);
+      const latest = await eventLog.read(run.sessionId);
       // A Turn the User stopped, or one a later message replaced, is terminal
       // in intent before recovery ever looks at it. There is nothing to
       // recover: no answer is owed, and the provider outcome cannot change what
@@ -1928,14 +2074,20 @@ export class BotDurableAuthority<Snapshot> {
       }
       if (plan.kind === "restart") {
         const settings = run.configurationSnapshot;
-        await transaction.put({
-          [key]: {
+        await eventLog.rewrite(run.sessionId, plan.previous);
+        await transaction.put(
+          key,
+          storedRunRecordV2({
             ...run,
             events: [],
+            eventRange: {
+              startSeq: plan.previous.length,
+              endSeq: plan.previous.length,
+            },
+            previousEventCount: plan.previous.length,
             phase: "admitted",
-          } satisfies StoredRunV1<Snapshot>,
-          [LATEST_EVENTS_KEY]: plan.previous,
-        });
+          } satisfies StoredRunV1<Snapshot>),
+        );
         await this.refreshRecoveryAlarm(transaction);
         return {
           kind: "restart" as const,
@@ -1946,24 +2098,31 @@ export class BotDurableAuthority<Snapshot> {
       }
       if (plan.kind === "resume") {
         const settings = run.configurationSnapshot;
-        await transaction.put(key, {
-          ...run,
-          phase: "executing",
-        } satisfies StoredRunV1<Snapshot>);
+        await transaction.put(
+          key,
+          storedRunRecordV2({
+            ...run,
+            phase: "executing",
+          } satisfies StoredRunV1<Snapshot>),
+        );
         await this.refreshRecoveryAlarm(transaction);
         return { kind: "resume" as const, run, latest, settings };
       }
-      await transaction.put({
-        [key]: {
+      await eventLog.append(run.sessionId, plan.repairs);
+      await transaction.put(
+        key,
+        storedRunRecordV2({
           ...run,
-          events: [...run.events, ...plan.repairs],
+          ...storedRunEventFieldsV2(run.previousEventCount, [
+            ...run.events,
+            ...plan.repairs,
+          ]),
           status: "reconciliation-required",
           phase: "reconciliation-required",
           failure:
             "Execution outcome requires reconciliation before it can resume",
-        } satisfies StoredRunV1<Snapshot>,
-        [LATEST_EVENTS_KEY]: [...latest, ...plan.repairs],
-      });
+        } satisfies StoredRunV1<Snapshot>),
+      );
       await this.refreshRecoveryAlarm(transaction);
       return undefined;
     });
@@ -1987,6 +2146,7 @@ export class BotDurableAuthority<Snapshot> {
         acceptedAt: recovery.run.acceptedAt,
         text: recovery.run.input,
         turnType: storedRunTurnTypeV1(recovery.run),
+        lane: storedRunLaneV1(recovery.run),
         ...(storedRunSubagentRoleV1(recovery.run)
           ? { subagentRole: storedRunSubagentRoleV1(recovery.run) }
           : {}),