@frockbot/kernel-do 0.3.6 → 0.3.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frockbot/kernel-do",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "private": false,
   "type": "module",
   "exports": {
@@ -12,8 +12,8 @@
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@frockbot/kernel-composition": "0.3.6",
-    "@frockbot/kernel-contracts": "0.3.6",
+    "@frockbot/kernel-composition": "0.3.7",
+    "@frockbot/kernel-contracts": "0.3.7",
     "cordis": "4.0.0-rc.8"
   },
   "devDependencies": {

package/src/authority.ts

@@ -35,7 +35,7 @@ import {
   latestModelRequestJournalState,
   planBotRunRecovery,
   type ProviderReconcilesV1,
-  repairOrphanedOpenTurnV1,
+  repairedSessionLogV1,
   unresolvedModelRequestFailure,
 } from "./run-recovery.js";
 import {
@@ -43,8 +43,20 @@ import {
   BotTurnRecoveryRequiredError,
   BotTurnRefusedError,
 } from "./turn-errors.js";
+import {
+  botConversationBaseSessionIdV1,
+  conversationSessionIdV1,
+  decodeConversationRecordV1,
+  decodeStoredConversationV1,
+  firstConversationV1,
+  type ConversationRecordV1,
+  type StoredConversationV1,
+} from "./conversations.js";
 import {
   ACTIVE_RUN_KEY,
+  CONVERSATION_INDEX_KEY,
+  CONVERSATION_KEY,
+  MAX_LISTED_CONVERSATIONS,
   PENDING_RUN_KEY,
   IDENTITY_KEY,
   LATEST_EVENTS_KEY,
@@ -220,7 +232,8 @@ export class BotDurableAuthority<Snapshot> {
     });
   }
 
-  async run(command: OwnedBotTurnCommand): Promise<BotTurnCompletion> {
+  async run(input: OwnedBotTurnCommand): Promise<BotTurnCompletion> {
+    const command = await this.conversationScopedCommand(input);
     await this.assertMatchingRunCommand(command);
     // Recovering whatever this object was left holding must never decide the
     // fate of a new command. `recoverActiveRun` executes the *previous* Turn
@@ -368,9 +381,15 @@ export class BotDurableAuthority<Snapshot> {
       if (await transaction.get<string>(ACTIVE_RUN_KEY)) {
         return "blocked" as const;
       }
-      const latestEvents = (
+      const storedEvents = (
         (await transaction.get<SessionEvent[]>(LATEST_EVENTS_KEY)) ?? []
       ).map(decodeSessionEvent);
+      // A queued Turn was admitted while another was executing, so admission
+      // could not repair the log: something was still entitled to close that
+      // Turn. Here the active-run marker is gone and nothing is, so the same
+      // repair applies before this Turn starts on it.
+      const repaired = repairedSessionLogV1(run.sessionId, storedEvents);
+      const latestEvents = repaired ?? storedEvents;
       const promoted = this.codec.require({
         ...run,
         phase: "admitted",
@@ -379,6 +398,13 @@ export class BotDurableAuthority<Snapshot> {
       await transaction.put({
         [key]: structuredClone(promoted),
         [ACTIVE_RUN_KEY]: runId,
+        ...(repaired
+          ? {
+              [LATEST_EVENTS_KEY]: structuredClone(
+                repaired.map(decodeSessionEvent),
+              ),
+            }
+          : {}),
       });
       await transaction.delete(PENDING_RUN_KEY);
       await this.refreshRecoveryAlarm(transaction);
@@ -863,6 +889,158 @@ export class BotDurableAuthority<Snapshot> {
     return this.ctx.storage.get<string>(ACTIVE_RUN_KEY);
   }
 
+  /** The conversation this Bot's chat Session is on. */
+  async readConversation(): Promise<StoredConversationV1> {
+    return (
+      decodeStoredConversationV1(
+        await this.ctx.storage.get<unknown>(CONVERSATION_KEY),
+      ) ?? firstConversationV1(new Date().toISOString())
+    );
+  }
+
+  /**
+   * The conversations this Bot has had, newest first, the current one included.
+   *
+   * Ended conversations are listed from a bounded index rather than
+   * reconstructed from the run log: the run index is paged and a conversation
+   * with no surviving runs is still a conversation the User had.
+   */
+  async listConversations(
+    identity?: BotIdentity,
+  ): Promise<ConversationRecordV1[]> {
+    const known =
+      identity ?? (await this.ctx.storage.get<BotIdentity>(IDENTITY_KEY));
+    if (!known) return [];
+    const base = botConversationBaseSessionIdV1(known);
+    const current = await this.readConversation();
+    const ended = (
+      (await this.ctx.storage.get<unknown[]>(CONVERSATION_INDEX_KEY)) ?? []
+    ).flatMap((entry) => {
+      try {
+        return [decodeConversationRecordV1(entry)];
+      } catch {
+        // One unreadable record is skipped, never a list that throws: a
+        // conversation you cannot name must not hide the ones you can.
+        return [];
+      }
+    });
+    return [
+      {
+        schemaVersion: 1 as const,
+        sessionId: conversationSessionIdV1(base, current.ordinal),
+        ordinal: current.ordinal,
+        startedAt: current.startedAt,
+      },
+      ...ended,
+    ].sort((left, right) => right.ordinal - left.ordinal);
+  }
+
+  /**
+   * The Session id this Bot's chat Turns are recording right now, or
+   * `undefined` before the object has admitted anything and learned its
+   * identity. A reader that has to say which Turns are "this conversation"
+   * asks here rather than reconstructing the id.
+   */
+  async readConversationSessionId(): Promise<string | undefined> {
+    const identity = await this.ctx.storage.get<BotIdentity>(IDENTITY_KEY);
+    if (!identity) return undefined;
+    const conversation = await this.readConversation();
+    return conversationSessionIdV1(
+      botConversationBaseSessionIdV1(identity),
+      conversation.ordinal,
+    );
+  }
+
+  /**
+   * Ends the current conversation and starts the next one.
+   *
+   * The durable event log the next Turn derives its request from is emptied,
+   * so history stops growing without bound; the runs of the conversation just
+   * ended keep their events and their Session id and stay readable. Refused
+   * while a Turn is admitted: the log a running Turn is appending to is not
+   * something a click may pull out from under it.
+   */
+  async startConversation(
+    identity: BotIdentity,
+  ): Promise<ConversationRecordV1> {
+    await this.assertIdentity(identity);
+    await this.recoverActiveRun();
+    const base = botConversationBaseSessionIdV1(identity);
+    return this.ctx.storage.transaction(async (transaction) => {
+      const active = await transaction.get<string>(ACTIVE_RUN_KEY);
+      const pending = await transaction.get<string>(PENDING_RUN_KEY);
+      if (active || pending) {
+        throw new Error(
+          "This Bot is still working on a Turn. Wait for it to finish, then start a new conversation.",
+        );
+      }
+      const current =
+        decodeStoredConversationV1(
+          await transaction.get<unknown>(CONVERSATION_KEY),
+        ) ?? firstConversationV1(new Date().toISOString());
+      const endedAt = new Date().toISOString();
+      const ended = (
+        (await transaction.get<unknown[]>(CONVERSATION_INDEX_KEY)) ?? []
+      ).flatMap((entry) => {
+        try {
+          return [decodeConversationRecordV1(entry)];
+        } catch {
+          return [];
+        }
+      });
+      const next: StoredConversationV1 = {
+        schemaVersion: 1,
+        ordinal: current.ordinal + 1,
+        startedAt: endedAt,
+      };
+      await transaction.put({
+        [CONVERSATION_KEY]: next,
+        [CONVERSATION_INDEX_KEY]: [
+          {
+            schemaVersion: 1 as const,
+            sessionId: conversationSessionIdV1(base, current.ordinal),
+            ordinal: current.ordinal,
+            startedAt: current.startedAt,
+            endedAt,
+          },
+          ...ended,
+        ]
+          .sort((left, right) => right.ordinal - left.ordinal)
+          .slice(0, MAX_LISTED_CONVERSATIONS),
+        // The next Turn derives its messages from an empty log. Nothing is
+        // deleted: `run:<id>` still holds every event of every Turn.
+        [LATEST_EVENTS_KEY]: [],
+      });
+      return {
+        schemaVersion: 1 as const,
+        sessionId: conversationSessionIdV1(base, next.ordinal),
+        ordinal: next.ordinal,
+        startedAt: next.startedAt,
+      };
+    });
+  }
+
+  /**
+   * The command as this object's durable conversation state addresses it.
+   *
+   * A client names the Bot's conversational Session by its base id and knows
+   * nothing about conversations; which conversation that is, is durable state
+   * here. Every other Session id — a Routine's `routine:<id>`, a subagent's —
+   * is left exactly as its producer wrote it.
+   */
+  private async conversationScopedCommand(
+    command: OwnedBotTurnCommand,
+  ): Promise<OwnedBotTurnCommand> {
+    const base = botConversationBaseSessionIdV1(command);
+    if (command.sessionId !== base) return command;
+    const conversation = await this.readConversation();
+    if (conversation.ordinal <= 1) return command;
+    return {
+      ...command,
+      sessionId: conversationSessionIdV1(base, conversation.ordinal),
+    };
+  }
+
   /** Durable run record, unchecked against its lookup key. */
   async readStoredRun(
     runId: string,
@@ -1072,11 +1250,18 @@ export class BotDurableAuthority<Snapshot> {
       const stillOwned =
         activeRun?.status === "running" ||
         activeRun?.status === "reconciliation-required";
-      const repairs = stillOwned
-        ? []
-        : repairOrphanedOpenTurnV1(command.sessionId, storedEvents);
-      const latestEvents = [...storedEvents, ...repairs];
-      if (repairs.length > 0) {
+      //
+      // The repair rewrites the whole log rather than appending to it: by the
+      // time anyone notices, the abandoned Turn is usually no longer the last
+      // thing in the log. Each refused message journals its own `turn/start`
+      // before it assembles the request that discovers the breakage, and its
+      // `finally` writes the matching `turn/end`, so the log ends closed with
+      // the abandoned Turn still open behind it. Appending cannot close that.
+      const repaired = stillOwned
+        ? undefined
+        : repairedSessionLogV1(command.sessionId, storedEvents);
+      const latestEvents = repaired ?? storedEvents;
+      if (repaired) {
         await transaction.put(
           LATEST_EVENTS_KEY,
           structuredClone(latestEvents.map(decodeSessionEvent)),

package/src/conversations.test.ts

@@ -0,0 +1,159 @@
+import { describe, expect, test } from "bun:test";
+import {
+  bootstrapGeneration,
+  type CompositionGenerationV1,
+} from "@frockbot/kernel-composition/generation";
+import type { SessionEvent } from "@frockbot/kernel-contracts";
+import {
+  BotDurableAuthority,
+  type BotDurableAuthorityHooks,
+} from "./authority.ts";
+import {
+  conversationSessionIdV1,
+  isConversationSessionIdV1,
+} from "./conversations.ts";
+import { MemoryStorage } from "./memory-storage.fixture.ts";
+import { createStoredRunCodecV1 } from "./run-records.ts";
+
+const codec = createStoredRunCodecV1<undefined>({
+  decodeRunId: (value) => value as string,
+  decodeConfigurationSnapshot: () => undefined,
+});
+
+const IDENTITY = { userId: "user-1", botId: "primary" };
+
+function bootstrap(): Promise<CompositionGenerationV1> {
+  return bootstrapGeneration(
+    [
+      {
+        packageId: "shell",
+        specifier: "@frockbot/plugin-shell",
+        version: "0.0.1",
+        manifest: { id: "shell", version: "0.0.1" },
+      },
+    ],
+    { createdAt: "2026-08-31T00:00:00.000Z" },
+  );
+}
+
+function createAuthority(storage: MemoryStorage) {
+  const sessions: string[] = [];
+  const hooks: BotDurableAuthorityHooks<undefined> = {
+    resolveAdmissionSnapshot: () => Promise.resolve(undefined),
+    bootstrapComposition: () => bootstrap(),
+    admittedSnapshot: () => Promise.resolve(undefined),
+    executeTurn: async (input) => {
+      sessions.push(input.command.sessionId);
+      const events: SessionEvent[] = [
+        {
+          type: "turn/admission",
+          seq: input.previousEvents.length,
+          timestamp: "2026-08-31T01:00:01.000Z",
+          turn: input.previousEvents.length + 1,
+          turnType: "chat",
+        },
+      ];
+      await input.persistSessionEvents(input.command.sessionId, events);
+      return { runId: input.command.runId, text: "ok", events };
+    },
+    notification: () => undefined,
+    scheduledDeadlines: () => Promise.resolve([]),
+    scheduledWorkInFlight: () => false,
+    deferScheduledWork: () => Promise.resolve(),
+    settleScheduledWork: () => Promise.resolve(),
+  };
+  return {
+    authority: new BotDurableAuthority<undefined>({
+      state: { storage } as unknown as DurableObjectState,
+      codec,
+      hooks,
+    }),
+    sessions,
+  };
+}
+
+function command(runId: string) {
+  return {
+    ...IDENTITY,
+    runId,
+    sessionId: "user-1:primary",
+    acceptedAt: `2026-08-31T01:00:0${runId.slice(-1)}.000Z`,
+    text: `message ${runId}`,
+  };
+}
+
+describe("a Bot's Session id names the conversation it is on", () => {
+  test("the first conversation is the bare Session id", () => {
+    expect(conversationSessionIdV1("user-1:primary", 1)).toBe("user-1:primary");
+    expect(conversationSessionIdV1("user-1:primary", 3)).toBe(
+      "user-1:primary#3",
+    );
+  });
+
+  test("only a Bot's own conversations match its base id", () => {
+    const base = "user-1:primary";
+    expect(isConversationSessionIdV1(base, base)).toBe(true);
+    expect(isConversationSessionIdV1(base, `${base}#2`)).toBe(true);
+    expect(isConversationSessionIdV1(base, "routine:morning")).toBe(false);
+    expect(isConversationSessionIdV1(base, `${base}#0`)).toBe(false);
+    expect(isConversationSessionIdV1(base, `${base}#x`)).toBe(false);
+  });
+});
+
+describe("starting a new conversation", () => {
+  test("empties the log the next Turn derives from and keeps the old Turns", async () => {
+    const storage = new MemoryStorage();
+    const probe = createAuthority(storage);
+
+    await probe.authority.run(command("run-1"));
+    expect((storage.values.get("latest-events") as SessionEvent[]).length).toBe(
+      1,
+    );
+
+    const started = await probe.authority.startConversation(IDENTITY);
+    expect(started.ordinal).toBe(2);
+    expect(started.sessionId).toBe("user-1:primary#2");
+    // The unbounded log is the bug: the next Turn starts from nothing.
+    expect(storage.values.get("latest-events")).toEqual([]);
+    // The conversation just ended is still on disk, Turn for Turn.
+    expect(
+      (storage.values.get("run:run-1") as { events: SessionEvent[] }).events
+        .length,
+    ).toBe(1);
+
+    await probe.authority.run(command("run-2"));
+    // The new Turn ran in the new Session, and saw none of the old history.
+    expect(probe.sessions).toEqual(["user-1:primary", "user-1:primary#2"]);
+    expect(
+      (storage.values.get("run:run-2") as { previousEventCount: number })
+        .previousEventCount,
+    ).toBe(0);
+  });
+
+  test("lists the conversations the Bot has had, newest first", async () => {
+    const storage = new MemoryStorage();
+    const probe = createAuthority(storage);
+
+    await probe.authority.run(command("run-1"));
+    await probe.authority.startConversation(IDENTITY);
+    await probe.authority.run(command("run-2"));
+
+    const conversations = await probe.authority.listConversations(IDENTITY);
+    expect(conversations.map((entry) => entry.sessionId)).toEqual([
+      "user-1:primary#2",
+      "user-1:primary",
+    ]);
+    expect(conversations[0]?.endedAt).toBeUndefined();
+    expect(conversations[1]?.endedAt).toBeString();
+  });
+
+  test("is refused while a Turn is still admitted", async () => {
+    const storage = new MemoryStorage();
+    const probe = createAuthority(storage);
+    storage.values.set("active-run", "run-9");
+
+    await expect(probe.authority.startConversation(IDENTITY)).rejects.toThrow(
+      /still working on a Turn/,
+    );
+  });
+});

package/src/conversations.ts

@@ -0,0 +1,126 @@
+/**
+ * Conversations: how one Bot has more than one chat Session over its life.
+ *
+ * A Bot's conversational Session id was `<userId>:<botId>` forever, so its
+ * durable event log only ever grew and there was no way to put a conversation
+ * down and start another. A conversation numbers that Session: the first is
+ * the bare id, so nothing already stored changes, and each one after it is the
+ * same id with `#<ordinal>` appended.
+ *
+ * Starting a new conversation is a durable boundary, not a deletion. The event
+ * log the next Turn derives its model request from is empty again; every Turn
+ * of every earlier conversation stays in the run index under the Session id it
+ * recorded, so the earlier conversation is still readable.
+ */
+
+/** The conversation a Bot's chat Session is currently on. */
+export interface StoredConversationV1 {
+  schemaVersion: 1;
+  /** 1 is the Session every Bot starts on and the one already on disk. */
+  ordinal: number;
+  startedAt: string;
+}
+
+/** One conversation a Bot has had, current or ended. */
+export interface ConversationRecordV1 {
+  schemaVersion: 1;
+  /** The Session id its Turns recorded. */
+  sessionId: string;
+  ordinal: number;
+  startedAt: string;
+  /** Absent while this is the conversation the Bot is on. */
+  endedAt?: string;
+}
+
+const MAX_CONVERSATION_ORDINAL = 1_000_000;
+
+/** The conversation a Bot with nothing stored is on. */
+export function firstConversationV1(startedAt: string): StoredConversationV1 {
+  return { schemaVersion: 1, ordinal: 1, startedAt };
+}
+
+export function decodeStoredConversationV1(
+  input: unknown,
+): StoredConversationV1 | undefined {
+  if (input === undefined || input === null) return undefined;
+  if (typeof input !== "object") {
+    throw new Error("stored conversation is invalid");
+  }
+  const value = input as Record<string, unknown>;
+  if (value.schemaVersion !== 1) {
+    throw new Error("stored conversation.schemaVersion is invalid");
+  }
+  if (
+    typeof value.ordinal !== "number" ||
+    !Number.isSafeInteger(value.ordinal) ||
+    value.ordinal < 1 ||
+    value.ordinal > MAX_CONVERSATION_ORDINAL
+  ) {
+    throw new Error("stored conversation.ordinal is invalid");
+  }
+  if (typeof value.startedAt !== "string" || value.startedAt.length === 0) {
+    throw new Error("stored conversation.startedAt is invalid");
+  }
+  return {
+    schemaVersion: 1,
+    ordinal: value.ordinal,
+    startedAt: value.startedAt,
+  };
+}
+
+export function decodeConversationRecordV1(
+  input: unknown,
+): ConversationRecordV1 {
+  if (typeof input !== "object" || input === null) {
+    throw new Error("conversation record is invalid");
+  }
+  const value = input as Record<string, unknown>;
+  const stored = decodeStoredConversationV1({
+    schemaVersion: value.schemaVersion,
+    ordinal: value.ordinal,
+    startedAt: value.startedAt,
+  })!;
+  if (typeof value.sessionId !== "string" || value.sessionId.length === 0) {
+    throw new Error("conversation record.sessionId is invalid");
+  }
+  if (value.endedAt !== undefined && typeof value.endedAt !== "string") {
+    throw new Error("conversation record.endedAt is invalid");
+  }
+  return {
+    ...stored,
+    sessionId: value.sessionId,
+    ...(value.endedAt ? { endedAt: value.endedAt as string } : {}),
+  };
+}
+
+/**
+ * The Session id a Bot's chat Turns record while it is on this conversation.
+ *
+ * The first conversation is the bare id on purpose: every Session already
+ * stored is conversation 1, so nothing has to be migrated for it to be one.
+ */
+export function conversationSessionIdV1(base: string, ordinal: number): string {
+  return ordinal <= 1 ? base : `${base}#${ordinal}`;
+}
+
+/** The Session id a Bot's conversational Turns are addressed to. */
+export function botConversationBaseSessionIdV1(identity: {
+  userId: string;
+  botId: string;
+}): string {
+  return `${identity.userId}:${identity.botId}`;
+}
+
+/**
+ * True when this Session id names a conversation of that Bot — the bare base
+ * id or the base id with an ordinal. A Routine firing's `routine:<id>` and a
+ * subagent's Session are deliberately not conversations and never match.
+ */
+export function isConversationSessionIdV1(
+  base: string,
+  sessionId: string,
+): boolean {
+  if (sessionId === base) return true;
+  if (!sessionId.startsWith(`${base}#`)) return false;
+  return /^[1-9][0-9]{0,6}$/.test(sessionId.slice(base.length + 1));
+}

package/src/index.ts

@@ -1,6 +1,7 @@
 export * from "./authority.js";
 export * from "./applets.js";
 export * from "./composition-failures.js";
+export * from "./conversations.js";
 export * from "./composition-store.js";
 export * from "./run-records.js";
 export * from "./run-recovery.js";

package/src/run-recovery.ts

@@ -266,6 +266,76 @@ export function repairOrphanedOpenTurnV1(
   }
 }
 
+/**
+ * True when *any* Turn in the log was never closed — including one buried
+ * behind later Turns that are themselves well formed.
+ *
+ * `hasOrphanedOpenTurnV1` only sees a log that *ends* inside a Turn, and that
+ * is the shape a wedged Bot stops having after its very first retry. The Agent
+ * loop journals `turn/start` durably and only then assembles the request, so
+ * the Turn that discovers the invariant is broken has already written its own
+ * `turn/start`, and its `finally` writes a matching `turn/end` carrying the
+ * validation message. The log that comes out of that ends closed — with the
+ * abandoned Turn still open several events back — so the trailing-open test
+ * says there is nothing to repair, and every later message fails the same way.
+ */
+export function hasUnclosedTurnV1(events: readonly SessionEvent[]): boolean {
+  let openTurn: number | undefined;
+  for (const event of events) {
+    if (event.type === "turn/start") {
+      if (openTurn !== undefined) return true;
+      openTurn = event.turn;
+    }
+    if (event.type === "turn/end" && event.turn === openTurn) {
+      openTurn = undefined;
+    }
+  }
+  return openTurn !== undefined;
+}
+
+/**
+ * The whole durable log with every abandoned Turn closed, or `undefined` when
+ * there is nothing to repair or the log cannot be repaired without inventing
+ * history.
+ *
+ * A Turn left open in the middle of the log cannot be closed by appending:
+ * `turn/end` for it would land after the Turns that followed, and the log
+ * would still read as "turn N started while turn N-1 is open". So the repair
+ * *rewrites* the log, inserting the closing events at the point the Turn was
+ * abandoned and resequencing what follows. The inserted events are the ones
+ * the interrupted-run repair already writes — every unresolved tool occurrence
+ * closed as `interrupted`, then `step/end`, then `turn/end` with outcome
+ * `interrupted` — so a Turn nobody finished reads as one nobody finished.
+ *
+ * Only called where nothing is entitled to write those ends: at admission and
+ * promotion with no run executing, and at settlement, where the run that owned
+ * the Turn has just stopped.
+ */
+export function repairedSessionLogV1(
+  sessionId: string,
+  latest: readonly SessionEvent[],
+): SessionEvent[] | undefined {
+  if (!hasUnclosedTurnV1(latest)) return undefined;
+  let repaired: SessionEvent[] = [];
+  const closeOpenTurn = (): boolean => {
+    if (repaired.length === 0 || !hasOrphanedOpenTurnV1(repaired)) return true;
+    try {
+      const session = new Session(sessionId, () => {}, repaired);
+      session.reconcileInterrupted();
+      repaired = [...session.events];
+    } catch {
+      return false;
+    }
+    return !hasOrphanedOpenTurnV1(repaired);
+  };
+  for (const event of latest) {
+    if (event.type === "turn/start" && !closeOpenTurn()) return undefined;
+    repaired.push({ ...event, seq: repaired.length });
+  }
+  if (!closeOpenTurn()) return undefined;
+  return repaired;
+}
+
 export function eventsForFailedRun(
   durableRun: { events: SessionEvent[] } | undefined,
   error: unknown,

package/src/run-terminal.ts

@@ -8,6 +8,7 @@ import type {
   StoredRunCodecV1,
   StoredRunV1,
 } from "./run-records.js";
+import { repairedSessionLogV1 } from "./run-recovery.js";
 
 /**
  * The events a terminal settlement commits, with any Turn they were left
@@ -44,9 +45,15 @@ function settledEventsV1(
   } catch {
     repairs = [];
   }
+  const settled = [...latest, ...repairs];
+  // A Turn abandoned earlier in the log cannot be closed by appending, and a
+  // settlement that only appends leaves it open forever. The run's own events
+  // are committed as they stand — that record is this run's account, not the
+  // conversation's — while the forward log is repaired in place so the next
+  // Turn starts on a log that reads as a complete history.
   return {
     events: [...decoded, ...repairs],
-    latestEvents: [...latest, ...repairs],
+    latestEvents: repairedSessionLogV1(sessionId, settled) ?? settled,
   };
 }
 

package/src/storage-keys.ts

@@ -135,3 +135,18 @@ export function storedRunAdmissionFences(input: unknown): string[] {
 export function workspaceSyncEffectKey(effectId: string): string {
   return `${WORKSPACE_SYNC_EFFECT_PREFIX}${effectId}`;
 }
+
+/**
+ * The conversation the Bot's chat Session is currently on.
+ *
+ * One Bot has one conversational Session at a time. Starting a new
+ * conversation ends the current one and begins the next: the durable event log
+ * the next Turn derives its request from is empty again, while every Turn the
+ * earlier conversations recorded stays durable and readable under its own
+ * Session id.
+ */
+export const CONVERSATION_KEY = "conversation";
+/** The conversations this Bot has already ended, newest last. */
+export const CONVERSATION_INDEX_KEY = "conversation-index";
+/** How many ended conversations stay listable. Older ones drop off the list. */
+export const MAX_LISTED_CONVERSATIONS = 64;

package/src/turn-supersede.test.ts

@@ -3,7 +3,10 @@ import {
   bootstrapGeneration,
   type CompositionGenerationV1,
 } from "@frockbot/kernel-composition/generation";
-import type { SessionEvent } from "@frockbot/kernel-contracts";
+import {
+  type SessionEvent,
+  validateToolOccurrenceJournal,
+} from "@frockbot/kernel-contracts";
 import {
   BotDurableAuthority,
   SUPERSEDED_TURN_REASON_V1,
@@ -690,6 +693,87 @@ describe("a durable log left inside a Turn", () => {
     });
     expect(storedRun(storage, "run-1").status).toBe("completed");
   });
+
+  test("is repaired even once refused Turns have been logged behind it", async () => {
+    const storage = new MemoryStorage();
+    // What production actually holds on a Bot wedged before the repair
+    // existed. The Agent loop journals `turn/start` durably and only then
+    // assembles the request that discovers turn 1 is still open, so every
+    // refused message left a *complete* Turn of its own behind the abandoned
+    // one — and the log stopped ending inside a Turn. The trailing-open test
+    // then said there was nothing to repair, so admission repaired nothing and
+    // the next message failed exactly the same way, forever.
+    storage.values.set("latest-events", [
+      {
+        type: "session/created",
+        createdAt: "2026-09-03T00:00:00.000Z",
+        seq: 0,
+        timestamp: "2026-09-03T00:00:00.000Z",
+      },
+      {
+        type: "turn/start",
+        turn: 1,
+        seq: 1,
+        timestamp: "2026-09-03T00:00:01.000Z",
+      },
+      {
+        type: "turn/start",
+        turn: 2,
+        seq: 2,
+        timestamp: "2026-09-03T00:00:02.000Z",
+      },
+      {
+        type: "turn/end",
+        turn: 2,
+        outcome: "model-error",
+        reason: "turn 2 started while turn 1 is open",
+        seq: 3,
+        timestamp: "2026-09-03T00:00:03.000Z",
+      },
+    ]);
+    const probe = createAuthority(storage);
+
+    const run = probe.authority.run(command("run-1", "hello"));
+    await probe.handle("run-1").started;
+    probe.handle("run-1").finish();
+    await run;
+
+    const events = storage.values.get("latest-events") as SessionEvent[];
+    // Turn 1 is closed where it was abandoned, not after the Turns that
+    // followed it, and the log is resequenced around the insertion.
+    expect(
+      events
+        .slice(0, 5)
+        .map((event) =>
+          event.type === "turn/start" || event.type === "turn/end"
+            ? `${event.type}:${event.turn}`
+            : event.type,
+        ),
+    ).toEqual([
+      "session/created",
+      "turn/start:1",
+      "turn/end:1",
+      "turn/start:2",
+      "turn/end:2",
+    ]);
+    expect(events[2]).toMatchObject({
+      type: "turn/end",
+      turn: 1,
+      outcome: "interrupted",
+    });
+    expect(events.map((event) => event.seq)).toEqual(
+      events.map((_event, index) => index),
+    );
+    // The repaired history is one the invariant accepts, which is what the
+    // refused Turns were failing on. (The stub Agent below numbers its own
+    // Turn rather than reading `nextTurn`, so only the repaired prefix is the
+    // subject here.)
+    expect(() =>
+      validateToolOccurrenceJournal(events.slice(0, 5)),
+    ).not.toThrow();
+    expect(storedRun(storage, "run-1").status).toBe("completed");
+    expect(storedRun(storage, "run-1").previousEventCount).toBe(5);
+  });
 });
 
 describe("a failing recovery of an older Turn", () => {