@frockbot/kernel-do 0.3.5 → 0.3.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frockbot/kernel-do",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "private": false,
   "type": "module",
   "exports": {
@@ -12,8 +12,8 @@
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@frockbot/kernel-composition": "0.3.5",
-    "@frockbot/kernel-contracts": "0.3.5",
+    "@frockbot/kernel-composition": "0.3.7",
+    "@frockbot/kernel-contracts": "0.3.7",
     "cordis": "4.0.0-rc.8"
   },
   "devDependencies": {

package/src/authority.ts

@@ -34,7 +34,8 @@ import {
   eventsForFailedRun,
   latestModelRequestJournalState,
   planBotRunRecovery,
-  repairOrphanedOpenTurnV1,
+  type ProviderReconcilesV1,
+  repairedSessionLogV1,
   unresolvedModelRequestFailure,
 } from "./run-recovery.js";
 import {
@@ -42,8 +43,20 @@ import {
   BotTurnRecoveryRequiredError,
   BotTurnRefusedError,
 } from "./turn-errors.js";
+import {
+  botConversationBaseSessionIdV1,
+  conversationSessionIdV1,
+  decodeConversationRecordV1,
+  decodeStoredConversationV1,
+  firstConversationV1,
+  type ConversationRecordV1,
+  type StoredConversationV1,
+} from "./conversations.js";
 import {
   ACTIVE_RUN_KEY,
+  CONVERSATION_INDEX_KEY,
+  CONVERSATION_KEY,
+  MAX_LISTED_CONVERSATIONS,
   PENDING_RUN_KEY,
   IDENTITY_KEY,
   LATEST_EVENTS_KEY,
@@ -144,6 +157,16 @@ export interface BotDurableAuthorityHooks<Snapshot> {
     run: StoredRunV1<Snapshot>;
     read<T>(key: string): Promise<T | undefined>;
   }): Promise<Record<string, unknown>>;
+  /**
+   * Whether the named provider can be asked what happened to a model request
+   * it never answered (ADR 0028).
+   *
+   * Synchronous and pure, because it is consulted inside the recovery
+   * transaction: it answers from what the deployment knows about a provider
+   * Package, never by reaching one. Absent means every provider reconciles,
+   * which is the behaviour that predates the ADR.
+   */
+  providerReconciles?: ProviderReconcilesV1;
 }
 
 /** What a `turn/end` records when a later user message took a Turn's place. */
@@ -209,7 +232,8 @@ export class BotDurableAuthority<Snapshot> {
     });
   }
 
-  async run(command: OwnedBotTurnCommand): Promise<BotTurnCompletion> {
+  async run(input: OwnedBotTurnCommand): Promise<BotTurnCompletion> {
+    const command = await this.conversationScopedCommand(input);
     await this.assertMatchingRunCommand(command);
     // Recovering whatever this object was left holding must never decide the
     // fate of a new command. `recoverActiveRun` executes the *previous* Turn
@@ -357,9 +381,15 @@ export class BotDurableAuthority<Snapshot> {
       if (await transaction.get<string>(ACTIVE_RUN_KEY)) {
         return "blocked" as const;
       }
-      const latestEvents = (
+      const storedEvents = (
         (await transaction.get<SessionEvent[]>(LATEST_EVENTS_KEY)) ?? []
       ).map(decodeSessionEvent);
+      // A queued Turn was admitted while another was executing, so admission
+      // could not repair the log: something was still entitled to close that
+      // Turn. Here the active-run marker is gone and nothing is, so the same
+      // repair applies before this Turn starts on it.
+      const repaired = repairedSessionLogV1(run.sessionId, storedEvents);
+      const latestEvents = repaired ?? storedEvents;
       const promoted = this.codec.require({
         ...run,
         phase: "admitted",
@@ -368,6 +398,13 @@ export class BotDurableAuthority<Snapshot> {
       await transaction.put({
         [key]: structuredClone(promoted),
         [ACTIVE_RUN_KEY]: runId,
+        ...(repaired
+          ? {
+              [LATEST_EVENTS_KEY]: structuredClone(
+                repaired.map(decodeSessionEvent),
+              ),
+            }
+          : {}),
       });
       await transaction.delete(PENDING_RUN_KEY);
       await this.refreshRecoveryAlarm(transaction);
@@ -852,6 +889,158 @@ export class BotDurableAuthority<Snapshot> {
     return this.ctx.storage.get<string>(ACTIVE_RUN_KEY);
   }
 
+  /** The conversation this Bot's chat Session is on. */
+  async readConversation(): Promise<StoredConversationV1> {
+    return (
+      decodeStoredConversationV1(
+        await this.ctx.storage.get<unknown>(CONVERSATION_KEY),
+      ) ?? firstConversationV1(new Date().toISOString())
+    );
+  }
+
+  /**
+   * The conversations this Bot has had, newest first, the current one included.
+   *
+   * Ended conversations are listed from a bounded index rather than
+   * reconstructed from the run log: the run index is paged and a conversation
+   * with no surviving runs is still a conversation the User had.
+   */
+  async listConversations(
+    identity?: BotIdentity,
+  ): Promise<ConversationRecordV1[]> {
+    const known =
+      identity ?? (await this.ctx.storage.get<BotIdentity>(IDENTITY_KEY));
+    if (!known) return [];
+    const base = botConversationBaseSessionIdV1(known);
+    const current = await this.readConversation();
+    const ended = (
+      (await this.ctx.storage.get<unknown[]>(CONVERSATION_INDEX_KEY)) ?? []
+    ).flatMap((entry) => {
+      try {
+        return [decodeConversationRecordV1(entry)];
+      } catch {
+        // One unreadable record is skipped, never a list that throws: a
+        // conversation you cannot name must not hide the ones you can.
+        return [];
+      }
+    });
+    return [
+      {
+        schemaVersion: 1 as const,
+        sessionId: conversationSessionIdV1(base, current.ordinal),
+        ordinal: current.ordinal,
+        startedAt: current.startedAt,
+      },
+      ...ended,
+    ].sort((left, right) => right.ordinal - left.ordinal);
+  }
+
+  /**
+   * The Session id this Bot's chat Turns are recording right now, or
+   * `undefined` before the object has admitted anything and learned its
+   * identity. A reader that has to say which Turns are "this conversation"
+   * asks here rather than reconstructing the id.
+   */
+  async readConversationSessionId(): Promise<string | undefined> {
+    const identity = await this.ctx.storage.get<BotIdentity>(IDENTITY_KEY);
+    if (!identity) return undefined;
+    const conversation = await this.readConversation();
+    return conversationSessionIdV1(
+      botConversationBaseSessionIdV1(identity),
+      conversation.ordinal,
+    );
+  }
+
+  /**
+   * Ends the current conversation and starts the next one.
+   *
+   * The durable event log the next Turn derives its request from is emptied,
+   * so history stops growing without bound; the runs of the conversation just
+   * ended keep their events and their Session id and stay readable. Refused
+   * while a Turn is admitted: the log a running Turn is appending to is not
+   * something a click may pull out from under it.
+   */
+  async startConversation(
+    identity: BotIdentity,
+  ): Promise<ConversationRecordV1> {
+    await this.assertIdentity(identity);
+    await this.recoverActiveRun();
+    const base = botConversationBaseSessionIdV1(identity);
+    return this.ctx.storage.transaction(async (transaction) => {
+      const active = await transaction.get<string>(ACTIVE_RUN_KEY);
+      const pending = await transaction.get<string>(PENDING_RUN_KEY);
+      if (active || pending) {
+        throw new Error(
+          "This Bot is still working on a Turn. Wait for it to finish, then start a new conversation.",
+        );
+      }
+      const current =
+        decodeStoredConversationV1(
+          await transaction.get<unknown>(CONVERSATION_KEY),
+        ) ?? firstConversationV1(new Date().toISOString());
+      const endedAt = new Date().toISOString();
+      const ended = (
+        (await transaction.get<unknown[]>(CONVERSATION_INDEX_KEY)) ?? []
+      ).flatMap((entry) => {
+        try {
+          return [decodeConversationRecordV1(entry)];
+        } catch {
+          return [];
+        }
+      });
+      const next: StoredConversationV1 = {
+        schemaVersion: 1,
+        ordinal: current.ordinal + 1,
+        startedAt: endedAt,
+      };
+      await transaction.put({
+        [CONVERSATION_KEY]: next,
+        [CONVERSATION_INDEX_KEY]: [
+          {
+            schemaVersion: 1 as const,
+            sessionId: conversationSessionIdV1(base, current.ordinal),
+            ordinal: current.ordinal,
+            startedAt: current.startedAt,
+            endedAt,
+          },
+          ...ended,
+        ]
+          .sort((left, right) => right.ordinal - left.ordinal)
+          .slice(0, MAX_LISTED_CONVERSATIONS),
+        // The next Turn derives its messages from an empty log. Nothing is
+        // deleted: `run:<id>` still holds every event of every Turn.
+        [LATEST_EVENTS_KEY]: [],
+      });
+      return {
+        schemaVersion: 1 as const,
+        sessionId: conversationSessionIdV1(base, next.ordinal),
+        ordinal: next.ordinal,
+        startedAt: next.startedAt,
+      };
+    });
+  }
+
+  /**
+   * The command as this object's durable conversation state addresses it.
+   *
+   * A client names the Bot's conversational Session by its base id and knows
+   * nothing about conversations; which conversation that is, is durable state
+   * here. Every other Session id — a Routine's `routine:<id>`, a subagent's —
+   * is left exactly as its producer wrote it.
+   */
+  private async conversationScopedCommand(
+    command: OwnedBotTurnCommand,
+  ): Promise<OwnedBotTurnCommand> {
+    const base = botConversationBaseSessionIdV1(command);
+    if (command.sessionId !== base) return command;
+    const conversation = await this.readConversation();
+    if (conversation.ordinal <= 1) return command;
+    return {
+      ...command,
+      sessionId: conversationSessionIdV1(base, conversation.ordinal),
+    };
+  }
+
   /** Durable run record, unchecked against its lookup key. */
   async readStoredRun(
     runId: string,
@@ -1044,11 +1233,35 @@ export class BotDurableAuthority<Snapshot> {
       // N-1 is open". Nothing owned that repair, because the run that would
       // have closed it is already terminal, so admission does: with nothing
       // executing, an open Turn is one nobody is going to finish.
-      const repairs = activeRunId
-        ? []
-        : repairOrphanedOpenTurnV1(command.sessionId, storedEvents);
-      const latestEvents = [...storedEvents, ...repairs];
-      if (repairs.length > 0) {
+      //
+      // The pointer alone is not the test. A Bot can hold an `active-run` id
+      // whose record is already terminal — a settlement that landed while the
+      // pointer clear did not, a supersede whose Turn ended between the two
+      // writes — and gating the repair on the pointer left exactly those Bots
+      // wedged. What matters is whether anything is still entitled to write
+      // that Turn's end: a `running` record is, and so is a
+      // `reconciliation-required` one, whose Turn is held open on purpose
+      // until its outcome is retrieved. Nothing else is.
+      const activeRun = activeRunId
+        ? this.codec.optional(
+            await transaction.get<unknown>(`${RUN_PREFIX}${activeRunId}`),
+          )
+        : undefined;
+      const stillOwned =
+        activeRun?.status === "running" ||
+        activeRun?.status === "reconciliation-required";
+      //
+      // The repair rewrites the whole log rather than appending to it: by the
+      // time anyone notices, the abandoned Turn is usually no longer the last
+      // thing in the log. Each refused message journals its own `turn/start`
+      // before it assembles the request that discovers the breakage, and its
+      // `finally` writes the matching `turn/end`, so the log ends closed with
+      // the abandoned Turn still open behind it. Appending cannot close that.
+      const repaired = stillOwned
+        ? undefined
+        : repairedSessionLogV1(command.sessionId, storedEvents);
+      const latestEvents = repaired ?? storedEvents;
+      if (repaired) {
         await transaction.put(
           LATEST_EVENTS_KEY,
           structuredClone(latestEvents.map(decodeSessionEvent)),
@@ -1418,7 +1631,12 @@ export class BotDurableAuthority<Snapshot> {
       const latest = (
         (await transaction.get<SessionEvent[]>(LATEST_EVENTS_KEY)) ?? []
       ).map(decodeSessionEvent);
-      const plan = planBotRunRecovery(run, latest, this.codec);
+      const plan = planBotRunRecovery(
+        run,
+        latest,
+        this.codec,
+        this.hooks.providerReconciles ?? (() => true),
+      );
       if (plan.kind === "complete") {
         const result = {
           runId: run.runId,
@@ -1443,13 +1661,19 @@ export class BotDurableAuthority<Snapshot> {
         return undefined;
       }
       if (plan.kind === "fail") {
+        // The repairs matter when the failure is ADR 0028's: they close the
+        // tool occurrences the restart left open, so the settled run's journal
+        // is a complete account rather than one that stops mid-sentence twice.
+        const events = plan.repairs
+          ? [...run.events, ...plan.repairs]
+          : run.events;
         await failStoredRun(
           this.codec,
           transaction,
           this.terminalKeys(run.runId),
           run.runId,
           latest.slice(0, run.previousEventCount),
-          run.events,
+          events,
           plan.failure,
           this.supersededPackageRecords(),
         );

package/src/conversations.test.ts

@@ -0,0 +1,159 @@
+import { describe, expect, test } from "bun:test";
+import {
+  bootstrapGeneration,
+  type CompositionGenerationV1,
+} from "@frockbot/kernel-composition/generation";
+import type { SessionEvent } from "@frockbot/kernel-contracts";
+import {
+  BotDurableAuthority,
+  type BotDurableAuthorityHooks,
+} from "./authority.ts";
+import {
+  conversationSessionIdV1,
+  isConversationSessionIdV1,
+} from "./conversations.ts";
+import { MemoryStorage } from "./memory-storage.fixture.ts";
+import { createStoredRunCodecV1 } from "./run-records.ts";
+
+const codec = createStoredRunCodecV1<undefined>({
+  decodeRunId: (value) => value as string,
+  decodeConfigurationSnapshot: () => undefined,
+});
+
+const IDENTITY = { userId: "user-1", botId: "primary" };
+
+function bootstrap(): Promise<CompositionGenerationV1> {
+  return bootstrapGeneration(
+    [
+      {
+        packageId: "shell",
+        specifier: "@frockbot/plugin-shell",
+        version: "0.0.1",
+        manifest: { id: "shell", version: "0.0.1" },
+      },
+    ],
+    { createdAt: "2026-08-31T00:00:00.000Z" },
+  );
+}
+
+function createAuthority(storage: MemoryStorage) {
+  const sessions: string[] = [];
+  const hooks: BotDurableAuthorityHooks<undefined> = {
+    resolveAdmissionSnapshot: () => Promise.resolve(undefined),
+    bootstrapComposition: () => bootstrap(),
+    admittedSnapshot: () => Promise.resolve(undefined),
+    executeTurn: async (input) => {
+      sessions.push(input.command.sessionId);
+      const events: SessionEvent[] = [
+        {
+          type: "turn/admission",
+          seq: input.previousEvents.length,
+          timestamp: "2026-08-31T01:00:01.000Z",
+          turn: input.previousEvents.length + 1,
+          turnType: "chat",
+        },
+      ];
+      await input.persistSessionEvents(input.command.sessionId, events);
+      return { runId: input.command.runId, text: "ok", events };
+    },
+    notification: () => undefined,
+    scheduledDeadlines: () => Promise.resolve([]),
+    scheduledWorkInFlight: () => false,
+    deferScheduledWork: () => Promise.resolve(),
+    settleScheduledWork: () => Promise.resolve(),
+  };
+  return {
+    authority: new BotDurableAuthority<undefined>({
+      state: { storage } as unknown as DurableObjectState,
+      codec,
+      hooks,
+    }),
+    sessions,
+  };
+}
+
+function command(runId: string) {
+  return {
+    ...IDENTITY,
+    runId,
+    sessionId: "user-1:primary",
+    acceptedAt: `2026-08-31T01:00:0${runId.slice(-1)}.000Z`,
+    text: `message ${runId}`,
+  };
+}
+
+describe("a Bot's Session id names the conversation it is on", () => {
+  test("the first conversation is the bare Session id", () => {
+    expect(conversationSessionIdV1("user-1:primary", 1)).toBe("user-1:primary");
+    expect(conversationSessionIdV1("user-1:primary", 3)).toBe(
+      "user-1:primary#3",
+    );
+  });
+
+  test("only a Bot's own conversations match its base id", () => {
+    const base = "user-1:primary";
+    expect(isConversationSessionIdV1(base, base)).toBe(true);
+    expect(isConversationSessionIdV1(base, `${base}#2`)).toBe(true);
+    expect(isConversationSessionIdV1(base, "routine:morning")).toBe(false);
+    expect(isConversationSessionIdV1(base, `${base}#0`)).toBe(false);
+    expect(isConversationSessionIdV1(base, `${base}#x`)).toBe(false);
+  });
+});
+
+describe("starting a new conversation", () => {
+  test("empties the log the next Turn derives from and keeps the old Turns", async () => {
+    const storage = new MemoryStorage();
+    const probe = createAuthority(storage);
+
+    await probe.authority.run(command("run-1"));
+    expect((storage.values.get("latest-events") as SessionEvent[]).length).toBe(
+      1,
+    );
+
+    const started = await probe.authority.startConversation(IDENTITY);
+    expect(started.ordinal).toBe(2);
+    expect(started.sessionId).toBe("user-1:primary#2");
+    // The unbounded log is the bug: the next Turn starts from nothing.
+    expect(storage.values.get("latest-events")).toEqual([]);
+    // The conversation just ended is still on disk, Turn for Turn.
+    expect(
+      (storage.values.get("run:run-1") as { events: SessionEvent[] }).events
+        .length,
+    ).toBe(1);
+
+    await probe.authority.run(command("run-2"));
+    // The new Turn ran in the new Session, and saw none of the old history.
+    expect(probe.sessions).toEqual(["user-1:primary", "user-1:primary#2"]);
+    expect(
+      (storage.values.get("run:run-2") as { previousEventCount: number })
+        .previousEventCount,
+    ).toBe(0);
+  });
+
+  test("lists the conversations the Bot has had, newest first", async () => {
+    const storage = new MemoryStorage();
+    const probe = createAuthority(storage);
+
+    await probe.authority.run(command("run-1"));
+    await probe.authority.startConversation(IDENTITY);
+    await probe.authority.run(command("run-2"));
+
+    const conversations = await probe.authority.listConversations(IDENTITY);
+    expect(conversations.map((entry) => entry.sessionId)).toEqual([
+      "user-1:primary#2",
+      "user-1:primary",
+    ]);
+    expect(conversations[0]?.endedAt).toBeUndefined();
+    expect(conversations[1]?.endedAt).toBeString();
+  });
+
+  test("is refused while a Turn is still admitted", async () => {
+    const storage = new MemoryStorage();
+    const probe = createAuthority(storage);
+    storage.values.set("active-run", "run-9");
+
+    await expect(probe.authority.startConversation(IDENTITY)).rejects.toThrow(
+      /still working on a Turn/,
+    );
+  });
+});

package/src/conversations.ts

@@ -0,0 +1,126 @@
+/**
+ * Conversations: how one Bot has more than one chat Session over its life.
+ *
+ * A Bot's conversational Session id was `<userId>:<botId>` forever, so its
+ * durable event log only ever grew and there was no way to put a conversation
+ * down and start another. A conversation numbers that Session: the first is
+ * the bare id, so nothing already stored changes, and each one after it is the
+ * same id with `#<ordinal>` appended.
+ *
+ * Starting a new conversation is a durable boundary, not a deletion. The event
+ * log the next Turn derives its model request from is empty again; every Turn
+ * of every earlier conversation stays in the run index under the Session id it
+ * recorded, so the earlier conversation is still readable.
+ */
+
+/** The conversation a Bot's chat Session is currently on. */
+export interface StoredConversationV1 {
+  schemaVersion: 1;
+  /** 1 is the Session every Bot starts on and the one already on disk. */
+  ordinal: number;
+  startedAt: string;
+}
+
+/** One conversation a Bot has had, current or ended. */
+export interface ConversationRecordV1 {
+  schemaVersion: 1;
+  /** The Session id its Turns recorded. */
+  sessionId: string;
+  ordinal: number;
+  startedAt: string;
+  /** Absent while this is the conversation the Bot is on. */
+  endedAt?: string;
+}
+
+const MAX_CONVERSATION_ORDINAL = 1_000_000;
+
+/** The conversation a Bot with nothing stored is on. */
+export function firstConversationV1(startedAt: string): StoredConversationV1 {
+  return { schemaVersion: 1, ordinal: 1, startedAt };
+}
+
+export function decodeStoredConversationV1(
+  input: unknown,
+): StoredConversationV1 | undefined {
+  if (input === undefined || input === null) return undefined;
+  if (typeof input !== "object") {
+    throw new Error("stored conversation is invalid");
+  }
+  const value = input as Record<string, unknown>;
+  if (value.schemaVersion !== 1) {
+    throw new Error("stored conversation.schemaVersion is invalid");
+  }
+  if (
+    typeof value.ordinal !== "number" ||
+    !Number.isSafeInteger(value.ordinal) ||
+    value.ordinal < 1 ||
+    value.ordinal > MAX_CONVERSATION_ORDINAL
+  ) {
+    throw new Error("stored conversation.ordinal is invalid");
+  }
+  if (typeof value.startedAt !== "string" || value.startedAt.length === 0) {
+    throw new Error("stored conversation.startedAt is invalid");
+  }
+  return {
+    schemaVersion: 1,
+    ordinal: value.ordinal,
+    startedAt: value.startedAt,
+  };
+}
+
+export function decodeConversationRecordV1(
+  input: unknown,
+): ConversationRecordV1 {
+  if (typeof input !== "object" || input === null) {
+    throw new Error("conversation record is invalid");
+  }
+  const value = input as Record<string, unknown>;
+  const stored = decodeStoredConversationV1({
+    schemaVersion: value.schemaVersion,
+    ordinal: value.ordinal,
+    startedAt: value.startedAt,
+  })!;
+  if (typeof value.sessionId !== "string" || value.sessionId.length === 0) {
+    throw new Error("conversation record.sessionId is invalid");
+  }
+  if (value.endedAt !== undefined && typeof value.endedAt !== "string") {
+    throw new Error("conversation record.endedAt is invalid");
+  }
+  return {
+    ...stored,
+    sessionId: value.sessionId,
+    ...(value.endedAt ? { endedAt: value.endedAt as string } : {}),
+  };
+}
+
+/**
+ * The Session id a Bot's chat Turns record while it is on this conversation.
+ *
+ * The first conversation is the bare id on purpose: every Session already
+ * stored is conversation 1, so nothing has to be migrated for it to be one.
+ */
+export function conversationSessionIdV1(base: string, ordinal: number): string {
+  return ordinal <= 1 ? base : `${base}#${ordinal}`;
+}
+
+/** The Session id a Bot's conversational Turns are addressed to. */
+export function botConversationBaseSessionIdV1(identity: {
+  userId: string;
+  botId: string;
+}): string {
+  return `${identity.userId}:${identity.botId}`;
+}
+
+/**
+ * True when this Session id names a conversation of that Bot — the bare base
+ * id or the base id with an ordinal. A Routine firing's `routine:<id>` and a
+ * subagent's Session are deliberately not conversations and never match.
+ */
+export function isConversationSessionIdV1(
+  base: string,
+  sessionId: string,
+): boolean {
+  if (sessionId === base) return true;
+  if (!sessionId.startsWith(`${base}#`)) return false;
+  return /^[1-9][0-9]{0,6}$/.test(sessionId.slice(base.length + 1));
+}

package/src/index.ts

@@ -1,6 +1,7 @@
 export * from "./authority.js";
 export * from "./applets.js";
 export * from "./composition-failures.js";
+export * from "./conversations.js";
 export * from "./composition-store.js";
 export * from "./run-records.js";
 export * from "./run-recovery.js";

package/src/run-records.ts

@@ -758,7 +758,15 @@ export function botTurnCommandFingerprintV1(
       ...(lane === defaultRunLaneV1(turnType) ? {} : { lane }),
       ...(command.subagentRole ? { subagentRole: command.subagentRole } : {}),
       ...(command.origin ? { origin: command.origin } : {}),
-      ...(command.supersedes ? { supersedes: command.supersedes } : {}),
+      // The *intent* is part of the command's identity, exactly as ADR 0024
+      // requires: a replay of a command that carried no supersede can never
+      // become one that interrupts a second Turn. The provenance is not. A
+      // client retrying the same send — same commandId, same text — names
+      // whichever run it happened to have observed by then, and that is a fact
+      // about its polling, not about what the person asked for. Hashing it
+      // turned an ordinary retry into "this idempotency key was reused for a
+      // different command" and refused the send.
+      ...(command.supersedes ? { supersedes: true } : {}),
       ...(skills.length > 0 ? { skills: skills.map(formatSkillRefV1) } : {}),
       ...(command.directTool ? { directTool: command.directTool } : {}),
     })}`;