@frockbot/kernel-do 0.3.6 → 0.3.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frockbot/kernel-do",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "private": false,
   "type": "module",
   "exports": {
@@ -12,8 +12,8 @@
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@frockbot/kernel-composition": "0.3.6",
-    "@frockbot/kernel-contracts": "0.3.6",
+    "@frockbot/kernel-composition": "0.3.8",
+    "@frockbot/kernel-contracts": "0.3.8",
     "cordis": "4.0.0-rc.8"
   },
   "devDependencies": {

package/src/authority.ts

@@ -12,6 +12,7 @@ import type { CompositionGenerationV1 } from "@frockbot/kernel-composition/gener
 import { DurableCompositionStore } from "./composition-store.js";
 import { DurableCompositionFailureLog } from "./composition-failures.js";
 import {
+  boundedRunFailureV1,
   botTurnCommandFingerprintV1,
   defaultRunLaneV1,
   storedRunAdmissionV1,
@@ -35,7 +36,7 @@ import {
   latestModelRequestJournalState,
   planBotRunRecovery,
   type ProviderReconcilesV1,
-  repairOrphanedOpenTurnV1,
+  repairedSessionLogV1,
   unresolvedModelRequestFailure,
 } from "./run-recovery.js";
 import {
@@ -43,8 +44,20 @@ import {
   BotTurnRecoveryRequiredError,
   BotTurnRefusedError,
 } from "./turn-errors.js";
+import {
+  botConversationBaseSessionIdV1,
+  conversationSessionIdV1,
+  decodeConversationRecordV1,
+  decodeStoredConversationV1,
+  firstConversationV1,
+  type ConversationRecordV1,
+  type StoredConversationV1,
+} from "./conversations.js";
 import {
   ACTIVE_RUN_KEY,
+  CONVERSATION_INDEX_KEY,
+  CONVERSATION_KEY,
+  MAX_LISTED_CONVERSATIONS,
   PENDING_RUN_KEY,
   IDENTITY_KEY,
   LATEST_EVENTS_KEY,
@@ -163,6 +176,16 @@ export const SUPERSEDED_TURN_REASON_V1 = "superseded by a new user message";
 /** How many times a queued Turn retries the object before giving up. */
 const MAX_QUEUED_RUN_START_ATTEMPTS = 8;
 
+/**
+ * The failure a discarded Turn is settled with when recovery finds it.
+ *
+ * It is never read by anybody: `failStoredRun` routes a run carrying a Stop or
+ * supersede intent to `cancelStoredRun`/`supersedeStoredRun`, and both drop the
+ * failure — the User's own intent is the outcome, not an error.
+ */
+const DISCARDED_RUN_RECOVERY_FAILURE_V1 =
+  "Turn was discarded before recovery could resume it";
+
 /**
  * True when this object has already durably decided to throw the Turn away.
  *
@@ -220,7 +243,8 @@ export class BotDurableAuthority<Snapshot> {
     });
   }
 
-  async run(command: OwnedBotTurnCommand): Promise<BotTurnCompletion> {
+  async run(input: OwnedBotTurnCommand): Promise<BotTurnCompletion> {
+    const command = await this.conversationScopedCommand(input);
     await this.assertMatchingRunCommand(command);
     // Recovering whatever this object was left holding must never decide the
     // fate of a new command. `recoverActiveRun` executes the *previous* Turn
@@ -368,9 +392,15 @@ export class BotDurableAuthority<Snapshot> {
       if (await transaction.get<string>(ACTIVE_RUN_KEY)) {
         return "blocked" as const;
       }
-      const latestEvents = (
+      const storedEvents = (
         (await transaction.get<SessionEvent[]>(LATEST_EVENTS_KEY)) ?? []
       ).map(decodeSessionEvent);
+      // A queued Turn was admitted while another was executing, so admission
+      // could not repair the log: something was still entitled to close that
+      // Turn. Here the active-run marker is gone and nothing is, so the same
+      // repair applies before this Turn starts on it.
+      const repaired = repairedSessionLogV1(run.sessionId, storedEvents);
+      const latestEvents = repaired ?? storedEvents;
       const promoted = this.codec.require({
         ...run,
         phase: "admitted",
@@ -379,6 +409,13 @@ export class BotDurableAuthority<Snapshot> {
       await transaction.put({
         [key]: structuredClone(promoted),
         [ACTIVE_RUN_KEY]: runId,
+        ...(repaired
+          ? {
+              [LATEST_EVENTS_KEY]: structuredClone(
+                repaired.map(decodeSessionEvent),
+              ),
+            }
+          : {}),
       });
       await transaction.delete(PENDING_RUN_KEY);
       await this.refreshRecoveryAlarm(transaction);
@@ -451,10 +488,43 @@ export class BotDurableAuthority<Snapshot> {
           `Reconciliation was explicitly abandoned: ${failure}`,
         );
       }
+      // "Try again" that ends in a settled run is a *successful* abandon, not a
+      // failed request. Rethrowing here made the button answer 409 and left the
+      // browser reading a run it thought had not moved — and the read that
+      // followed 500'd on the half-repaired record. The run is durable and
+      // terminal by this point, and its own record says why it ended, so the
+      // caller is handed that record and reads the reason from the transcript.
+      const settled = await this.settledReconciliationResult(runId);
+      if (settled) return settled;
       throw error;
     }
   }
 
+  /**
+   * The completion an abandoned reconciliation reports once the run it was
+   * resolving has reached a terminal state — whatever that state turned out to
+   * be. Anything still open is not this method's to answer for.
+   */
+  private async settledReconciliationResult(
+    runId: string,
+  ): Promise<BotTurnCompletion | undefined> {
+    const run = this.codec.optional(
+      await this.ctx.storage.get<unknown>(`${RUN_PREFIX}${runId}`),
+    );
+    if (
+      run?.status !== "failed" &&
+      run?.status !== "cancelled" &&
+      run?.status !== "superseded"
+    ) {
+      return undefined;
+    }
+    return {
+      runId,
+      text: run.responseText ?? "",
+      events: structuredClone(run.events),
+    };
+  }
+
   private withNotification(
     snapshot: Snapshot,
     result: BotTurnCompletion,
@@ -546,7 +616,7 @@ export class BotDurableAuthority<Snapshot> {
         throw new Error(message);
       }
       await this.failRun(command.runId, previous, events, message);
-      const settled = await this.supersededRunResult(command.runId);
+      const settled = await this.discardedRunResult(command.runId);
       if (settled) return settled;
       throw new Error(message);
     } finally {
@@ -557,17 +627,25 @@ export class BotDurableAuthority<Snapshot> {
   }
 
   /**
-   * The completion a Turn another user message replaced reports. It is not a
-   * failure: the Turn settled durably, keeping everything it had already sent,
-   * and its caller reads the rest of the conversation from durable state.
+   * The completion a discarded Turn reports — one the User stopped, or one a
+   * later message replaced. Neither is a failure: the Turn settled durably,
+   * keeping everything it had already sent, and its caller reads the rest of
+   * the conversation from durable state.
+   *
+   * Stop used to be missing from here, so the long-lived `POST /turns` the
+   * composer was still holding open answered 500 the instant Stop was pressed:
+   * the UI said "You stopped this." and the console said the send had failed.
+   * A Turn the person stopped on purpose is the most ordinary outcome there is.
    */
-  private async supersededRunResult(
+  private async discardedRunResult(
     runId: string,
   ): Promise<BotTurnCompletion | undefined> {
     const run = this.codec.optional(
       await this.ctx.storage.get<unknown>(`${RUN_PREFIX}${runId}`),
     );
-    if (run?.status !== "superseded") return undefined;
+    if (run?.status !== "superseded" && run?.status !== "cancelled") {
+      return undefined;
+    }
     return { runId, text: "", events: structuredClone(run.events) };
   }
 
@@ -582,7 +660,7 @@ export class BotDurableAuthority<Snapshot> {
     const run = this.codec.optional(
       await this.ctx.storage.get<unknown>(`${RUN_PREFIX}${runId}`),
     );
-    if (run?.status === "superseded") {
+    if (run?.status === "superseded" || run?.status === "cancelled") {
       return { runId, text: "", events: structuredClone(run.events) };
     }
     if (run?.status !== "completed") return undefined;
@@ -679,7 +757,7 @@ export class BotDurableAuthority<Snapshot> {
         throw new Error(message);
       }
       await this.failRun(run.runId, previous, events, message);
-      const settled = await this.supersededRunResult(run.runId);
+      const settled = await this.discardedRunResult(run.runId);
       if (settled) return settled;
       throw new Error(message);
     } finally {
@@ -717,10 +795,11 @@ export class BotDurableAuthority<Snapshot> {
         `Turn idempotency key "${runId}" was reused for a different command`,
       );
     }
-    // A Turn another user message took the place of is an ordinary outcome,
-    // not a failure: it settled durably, said whatever it had already said,
-    // and the caller reads the rest from durable state.
-    if (run.status === "superseded") {
+    // A Turn the User stopped, or one another user message took the place of,
+    // is an ordinary outcome and not a failure: it settled durably, said
+    // whatever it had already said, and the caller reads the rest from durable
+    // state. A retry of either replays that settlement rather than refusing.
+    if (run.status === "superseded" || run.status === "cancelled") {
       return {
         runId,
         text: "",
@@ -855,7 +934,30 @@ export class BotDurableAuthority<Snapshot> {
         return;
       }
     }
-    await this.recoverActiveRun();
+    // An alarm has no caller. A rejection here is an uncaught exception in the
+    // object, and in the dev Worker it took the whole process down: a Stop left
+    // a run whose model outcome was uncertain, recovery re-entered it,
+    // `executeAdmittedRun` rethrew after recording the failure durably, and
+    // wrangler exited mid-run for every agent sharing the stack.
+    //
+    // Nothing about that throw is actionable here. Recovery has already written
+    // whatever it decided to durable storage before it rethrew, so the only
+    // thing left to do is record the reason and make sure the object still has
+    // a deadline — the re-arm is deliberately in a `finally`, because a failed
+    // recovery is exactly the case where the *next* firing matters most.
+    try {
+      await this.recoverActiveRun();
+    } catch (error) {
+      console.error(
+        `Bot run recovery alarm failed: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+    } finally {
+      await this.ctx.storage
+        .transaction((transaction) => this.refreshRecoveryAlarm(transaction))
+        .catch(() => undefined);
+    }
   }
 
   /** Active run id, for Package projections of durable run state. */
@@ -863,6 +965,158 @@ export class BotDurableAuthority<Snapshot> {
     return this.ctx.storage.get<string>(ACTIVE_RUN_KEY);
   }
 
+  /** The conversation this Bot's chat Session is on. */
+  async readConversation(): Promise<StoredConversationV1> {
+    return (
+      decodeStoredConversationV1(
+        await this.ctx.storage.get<unknown>(CONVERSATION_KEY),
+      ) ?? firstConversationV1(new Date().toISOString())
+    );
+  }
+
+  /**
+   * The conversations this Bot has had, newest first, the current one included.
+   *
+   * Ended conversations are listed from a bounded index rather than
+   * reconstructed from the run log: the run index is paged and a conversation
+   * with no surviving runs is still a conversation the User had.
+   */
+  async listConversations(
+    identity?: BotIdentity,
+  ): Promise<ConversationRecordV1[]> {
+    const known =
+      identity ?? (await this.ctx.storage.get<BotIdentity>(IDENTITY_KEY));
+    if (!known) return [];
+    const base = botConversationBaseSessionIdV1(known);
+    const current = await this.readConversation();
+    const ended = (
+      (await this.ctx.storage.get<unknown[]>(CONVERSATION_INDEX_KEY)) ?? []
+    ).flatMap((entry) => {
+      try {
+        return [decodeConversationRecordV1(entry)];
+      } catch {
+        // One unreadable record is skipped, never a list that throws: a
+        // conversation you cannot name must not hide the ones you can.
+        return [];
+      }
+    });
+    return [
+      {
+        schemaVersion: 1 as const,
+        sessionId: conversationSessionIdV1(base, current.ordinal),
+        ordinal: current.ordinal,
+        startedAt: current.startedAt,
+      },
+      ...ended,
+    ].sort((left, right) => right.ordinal - left.ordinal);
+  }
+
+  /**
+   * The Session id this Bot's chat Turns are recording right now, or
+   * `undefined` before the object has admitted anything and learned its
+   * identity. A reader that has to say which Turns are "this conversation"
+   * asks here rather than reconstructing the id.
+   */
+  async readConversationSessionId(): Promise<string | undefined> {
+    const identity = await this.ctx.storage.get<BotIdentity>(IDENTITY_KEY);
+    if (!identity) return undefined;
+    const conversation = await this.readConversation();
+    return conversationSessionIdV1(
+      botConversationBaseSessionIdV1(identity),
+      conversation.ordinal,
+    );
+  }
+
+  /**
+   * Ends the current conversation and starts the next one.
+   *
+   * The durable event log the next Turn derives its request from is emptied,
+   * so history stops growing without bound; the runs of the conversation just
+   * ended keep their events and their Session id and stay readable. Refused
+   * while a Turn is admitted: the log a running Turn is appending to is not
+   * something a click may pull out from under it.
+   */
+  async startConversation(
+    identity: BotIdentity,
+  ): Promise<ConversationRecordV1> {
+    await this.assertIdentity(identity);
+    await this.recoverActiveRun();
+    const base = botConversationBaseSessionIdV1(identity);
+    return this.ctx.storage.transaction(async (transaction) => {
+      const active = await transaction.get<string>(ACTIVE_RUN_KEY);
+      const pending = await transaction.get<string>(PENDING_RUN_KEY);
+      if (active || pending) {
+        throw new Error(
+          "This Bot is still working on a Turn. Wait for it to finish, then start a new conversation.",
+        );
+      }
+      const current =
+        decodeStoredConversationV1(
+          await transaction.get<unknown>(CONVERSATION_KEY),
+        ) ?? firstConversationV1(new Date().toISOString());
+      const endedAt = new Date().toISOString();
+      const ended = (
+        (await transaction.get<unknown[]>(CONVERSATION_INDEX_KEY)) ?? []
+      ).flatMap((entry) => {
+        try {
+          return [decodeConversationRecordV1(entry)];
+        } catch {
+          return [];
+        }
+      });
+      const next: StoredConversationV1 = {
+        schemaVersion: 1,
+        ordinal: current.ordinal + 1,
+        startedAt: endedAt,
+      };
+      await transaction.put({
+        [CONVERSATION_KEY]: next,
+        [CONVERSATION_INDEX_KEY]: [
+          {
+            schemaVersion: 1 as const,
+            sessionId: conversationSessionIdV1(base, current.ordinal),
+            ordinal: current.ordinal,
+            startedAt: current.startedAt,
+            endedAt,
+          },
+          ...ended,
+        ]
+          .sort((left, right) => right.ordinal - left.ordinal)
+          .slice(0, MAX_LISTED_CONVERSATIONS),
+        // The next Turn derives its messages from an empty log. Nothing is
+        // deleted: `run:<id>` still holds every event of every Turn.
+        [LATEST_EVENTS_KEY]: [],
+      });
+      return {
+        schemaVersion: 1 as const,
+        sessionId: conversationSessionIdV1(base, next.ordinal),
+        ordinal: next.ordinal,
+        startedAt: next.startedAt,
+      };
+    });
+  }
+
+  /**
+   * The command as this object's durable conversation state addresses it.
+   *
+   * A client names the Bot's conversational Session by its base id and knows
+   * nothing about conversations; which conversation that is, is durable state
+   * here. Every other Session id — a Routine's `routine:<id>`, a subagent's —
+   * is left exactly as its producer wrote it.
+   */
+  private async conversationScopedCommand(
+    command: OwnedBotTurnCommand,
+  ): Promise<OwnedBotTurnCommand> {
+    const base = botConversationBaseSessionIdV1(command);
+    if (command.sessionId !== base) return command;
+    const conversation = await this.readConversation();
+    if (conversation.ordinal <= 1) return command;
+    return {
+      ...command,
+      sessionId: conversationSessionIdV1(base, conversation.ordinal),
+    };
+  }
+
   /** Durable run record, unchecked against its lookup key. */
   async readStoredRun(
     runId: string,
@@ -1072,11 +1326,18 @@ export class BotDurableAuthority<Snapshot> {
       const stillOwned =
         activeRun?.status === "running" ||
         activeRun?.status === "reconciliation-required";
-      const repairs = stillOwned
-        ? []
-        : repairOrphanedOpenTurnV1(command.sessionId, storedEvents);
-      const latestEvents = [...storedEvents, ...repairs];
-      if (repairs.length > 0) {
+      //
+      // The repair rewrites the whole log rather than appending to it: by the
+      // time anyone notices, the abandoned Turn is usually no longer the last
+      // thing in the log. Each refused message journals its own `turn/start`
+      // before it assembles the request that discovers the breakage, and its
+      // `finally` writes the matching `turn/end`, so the log ends closed with
+      // the abandoned Turn still open behind it. Appending cannot close that.
+      const repaired = stillOwned
+        ? undefined
+        : repairedSessionLogV1(command.sessionId, storedEvents);
+      const latestEvents = repaired ?? storedEvents;
+      if (repaired) {
         await transaction.put(
           LATEST_EVENTS_KEY,
           structuredClone(latestEvents.map(decodeSessionEvent)),
@@ -1333,6 +1594,20 @@ export class BotDurableAuthority<Snapshot> {
     });
   }
 
+  /**
+   * Settles a run `failed` on a reason the authority composed from an error.
+   *
+   * The reason is bounded on the way in because nothing upstream bounds an
+   * error's `message`: a provider that echoes the request back produced one far
+   * past what the record allows, the settlement wrote it anyway, and every
+   * later read of that run threw — so a Turn that failed once went on to 500
+   * the transcript endpoint for ever. A reason a person reads loses nothing by
+   * being cut; a transcript nobody can read loses everything.
+   *
+   * Recovery's own `failStoredRun` is deliberately not routed through here: a
+   * failure derived from a malformed durable history is the one case where
+   * refusing to settle, and keeping the work active, is the right answer.
+   */
   private async failRun(
     runId: string,
     previous: SessionEvent[],
@@ -1347,13 +1622,14 @@ export class BotDurableAuthority<Snapshot> {
         runId,
         previous,
         events,
-        failure,
+        boundedRunFailureV1(failure),
         this.supersededPackageRecords(),
       );
       await this.refreshRecoveryAlarm(transaction);
     });
   }
 
+  /** Parks a run on a reason the authority composed, bounded as `failRun`'s is. */
   private async requireRunReconciliation(
     runId: string,
     previous: SessionEvent[],
@@ -1368,7 +1644,7 @@ export class BotDurableAuthority<Snapshot> {
         runId,
         previous,
         events,
-        failure,
+        boundedRunFailureV1(failure),
       );
       await this.refreshRecoveryAlarm(transaction);
     });
@@ -1446,6 +1722,30 @@ export class BotDurableAuthority<Snapshot> {
       const latest = (
         (await transaction.get<SessionEvent[]>(LATEST_EVENTS_KEY)) ?? []
       ).map(decodeSessionEvent);
+      // A Turn the User stopped, or one a later message replaced, is terminal
+      // in intent before recovery ever looks at it. There is nothing to
+      // recover: no answer is owed, and the provider outcome cannot change what
+      // it settles as. Re-entering it is how the Worker died — the run resumed,
+      // reached "Model response outcome is uncertain after cancellation", and
+      // the alarm had nothing to hand the rejection to.
+      //
+      // `failStoredRun` routes a discarded run to `cancelStoredRun` or
+      // `supersedeStoredRun` on the intent that is already durable, and closes
+      // the open turn on the way, so the settled log is a complete account.
+      if (runWasDiscardedV1(run)) {
+        await failStoredRun(
+          this.codec,
+          transaction,
+          this.terminalKeys(run.runId),
+          run.runId,
+          latest.slice(0, run.previousEventCount),
+          run.events,
+          DISCARDED_RUN_RECOVERY_FAILURE_V1,
+          this.supersededPackageRecords(),
+        );
+        await this.refreshRecoveryAlarm(transaction);
+        return undefined;
+      }
       const plan = planBotRunRecovery(
         run,
         latest,
@@ -1522,22 +1822,6 @@ export class BotDurableAuthority<Snapshot> {
         await this.refreshRecoveryAlarm(transaction);
         return { kind: "resume" as const, run, latest, settings };
       }
-      if (runWasDiscardedV1(run)) {
-        // Recovery of a Turn Stop or supersede already discarded settles it on
-        // that intent rather than parking it: nothing is owed the answer.
-        await failStoredRun(
-          this.codec,
-          transaction,
-          this.terminalKeys(run.runId),
-          run.runId,
-          latest.slice(0, run.previousEventCount),
-          [...run.events, ...plan.repairs],
-          "Execution outcome requires reconciliation before it can resume",
-          this.supersededPackageRecords(),
-        );
-        await this.refreshRecoveryAlarm(transaction);
-        return undefined;
-      }
       await transaction.put({
         [key]: {
           ...run,

package/src/conversations.test.ts

@@ -0,0 +1,159 @@
+import { describe, expect, test } from "bun:test";
+import {
+  bootstrapGeneration,
+  type CompositionGenerationV1,
+} from "@frockbot/kernel-composition/generation";
+import type { SessionEvent } from "@frockbot/kernel-contracts";
+import {
+  BotDurableAuthority,
+  type BotDurableAuthorityHooks,
+} from "./authority.ts";
+import {
+  conversationSessionIdV1,
+  isConversationSessionIdV1,
+} from "./conversations.ts";
+import { MemoryStorage } from "./memory-storage.fixture.ts";
+import { createStoredRunCodecV1 } from "./run-records.ts";
+
+const codec = createStoredRunCodecV1<undefined>({
+  decodeRunId: (value) => value as string,
+  decodeConfigurationSnapshot: () => undefined,
+});
+
+const IDENTITY = { userId: "user-1", botId: "primary" };
+
+function bootstrap(): Promise<CompositionGenerationV1> {
+  return bootstrapGeneration(
+    [
+      {
+        packageId: "shell",
+        specifier: "@frockbot/plugin-shell",
+        version: "0.0.1",
+        manifest: { id: "shell", version: "0.0.1" },
+      },
+    ],
+    { createdAt: "2026-08-31T00:00:00.000Z" },
+  );
+}
+
+function createAuthority(storage: MemoryStorage) {
+  const sessions: string[] = [];
+  const hooks: BotDurableAuthorityHooks<undefined> = {
+    resolveAdmissionSnapshot: () => Promise.resolve(undefined),
+    bootstrapComposition: () => bootstrap(),
+    admittedSnapshot: () => Promise.resolve(undefined),
+    executeTurn: async (input) => {
+      sessions.push(input.command.sessionId);
+      const events: SessionEvent[] = [
+        {
+          type: "turn/admission",
+          seq: input.previousEvents.length,
+          timestamp: "2026-08-31T01:00:01.000Z",
+          turn: input.previousEvents.length + 1,
+          turnType: "chat",
+        },
+      ];
+      await input.persistSessionEvents(input.command.sessionId, events);
+      return { runId: input.command.runId, text: "ok", events };
+    },
+    notification: () => undefined,
+    scheduledDeadlines: () => Promise.resolve([]),
+    scheduledWorkInFlight: () => false,
+    deferScheduledWork: () => Promise.resolve(),
+    settleScheduledWork: () => Promise.resolve(),
+  };
+  return {
+    authority: new BotDurableAuthority<undefined>({
+      state: { storage } as unknown as DurableObjectState,
+      codec,
+      hooks,
+    }),
+    sessions,
+  };
+}
+
+function command(runId: string) {
+  return {
+    ...IDENTITY,
+    runId,
+    sessionId: "user-1:primary",
+    acceptedAt: `2026-08-31T01:00:0${runId.slice(-1)}.000Z`,
+    text: `message ${runId}`,
+  };
+}
+
+describe("a Bot's Session id names the conversation it is on", () => {
+  test("the first conversation is the bare Session id", () => {
+    expect(conversationSessionIdV1("user-1:primary", 1)).toBe("user-1:primary");
+    expect(conversationSessionIdV1("user-1:primary", 3)).toBe(
+      "user-1:primary#3",
+    );
+  });
+
+  test("only a Bot's own conversations match its base id", () => {
+    const base = "user-1:primary";
+    expect(isConversationSessionIdV1(base, base)).toBe(true);
+    expect(isConversationSessionIdV1(base, `${base}#2`)).toBe(true);
+    expect(isConversationSessionIdV1(base, "routine:morning")).toBe(false);
+    expect(isConversationSessionIdV1(base, `${base}#0`)).toBe(false);
+    expect(isConversationSessionIdV1(base, `${base}#x`)).toBe(false);
+  });
+});
+
+describe("starting a new conversation", () => {
+  test("empties the log the next Turn derives from and keeps the old Turns", async () => {
+    const storage = new MemoryStorage();
+    const probe = createAuthority(storage);
+
+    await probe.authority.run(command("run-1"));
+    expect((storage.values.get("latest-events") as SessionEvent[]).length).toBe(
+      1,
+    );
+
+    const started = await probe.authority.startConversation(IDENTITY);
+    expect(started.ordinal).toBe(2);
+    expect(started.sessionId).toBe("user-1:primary#2");
+    // The unbounded log is the bug: the next Turn starts from nothing.
+    expect(storage.values.get("latest-events")).toEqual([]);
+    // The conversation just ended is still on disk, Turn for Turn.
+    expect(
+      (storage.values.get("run:run-1") as { events: SessionEvent[] }).events
+        .length,
+    ).toBe(1);
+
+    await probe.authority.run(command("run-2"));
+    // The new Turn ran in the new Session, and saw none of the old history.
+    expect(probe.sessions).toEqual(["user-1:primary", "user-1:primary#2"]);
+    expect(
+      (storage.values.get("run:run-2") as { previousEventCount: number })
+        .previousEventCount,
+    ).toBe(0);
+  });
+
+  test("lists the conversations the Bot has had, newest first", async () => {
+    const storage = new MemoryStorage();
+    const probe = createAuthority(storage);
+
+    await probe.authority.run(command("run-1"));
+    await probe.authority.startConversation(IDENTITY);
+    await probe.authority.run(command("run-2"));
+
+    const conversations = await probe.authority.listConversations(IDENTITY);
+    expect(conversations.map((entry) => entry.sessionId)).toEqual([
+      "user-1:primary#2",
+      "user-1:primary",
+    ]);
+    expect(conversations[0]?.endedAt).toBeUndefined();
+    expect(conversations[1]?.endedAt).toBeString();
+  });
+
+  test("is refused while a Turn is still admitted", async () => {
+    const storage = new MemoryStorage();
+    const probe = createAuthority(storage);
+    storage.values.set("active-run", "run-9");
+
+    await expect(probe.authority.startConversation(IDENTITY)).rejects.toThrow(
+      /still working on a Turn/,
+    );
+  });
+});

package/src/conversations.ts

@@ -0,0 +1,126 @@
+/**
+ * Conversations: how one Bot has more than one chat Session over its life.
+ *
+ * A Bot's conversational Session id was `<userId>:<botId>` forever, so its
+ * durable event log only ever grew and there was no way to put a conversation
+ * down and start another. A conversation numbers that Session: the first is
+ * the bare id, so nothing already stored changes, and each one after it is the
+ * same id with `#<ordinal>` appended.
+ *
+ * Starting a new conversation is a durable boundary, not a deletion. The event
+ * log the next Turn derives its model request from is empty again; every Turn
+ * of every earlier conversation stays in the run index under the Session id it
+ * recorded, so the earlier conversation is still readable.
+ */
+
+/** The conversation a Bot's chat Session is currently on. */
+export interface StoredConversationV1 {
+  schemaVersion: 1;
+  /** 1 is the Session every Bot starts on and the one already on disk. */
+  ordinal: number;
+  startedAt: string;
+}
+
+/** One conversation a Bot has had, current or ended. */
+export interface ConversationRecordV1 {
+  schemaVersion: 1;
+  /** The Session id its Turns recorded. */
+  sessionId: string;
+  ordinal: number;
+  startedAt: string;
+  /** Absent while this is the conversation the Bot is on. */
+  endedAt?: string;
+}
+
+const MAX_CONVERSATION_ORDINAL = 1_000_000;
+
+/** The conversation a Bot with nothing stored is on. */
+export function firstConversationV1(startedAt: string): StoredConversationV1 {
+  return { schemaVersion: 1, ordinal: 1, startedAt };
+}
+
+export function decodeStoredConversationV1(
+  input: unknown,
+): StoredConversationV1 | undefined {
+  if (input === undefined || input === null) return undefined;
+  if (typeof input !== "object") {
+    throw new Error("stored conversation is invalid");
+  }
+  const value = input as Record<string, unknown>;
+  if (value.schemaVersion !== 1) {
+    throw new Error("stored conversation.schemaVersion is invalid");
+  }
+  if (
+    typeof value.ordinal !== "number" ||
+    !Number.isSafeInteger(value.ordinal) ||
+    value.ordinal < 1 ||
+    value.ordinal > MAX_CONVERSATION_ORDINAL
+  ) {
+    throw new Error("stored conversation.ordinal is invalid");
+  }
+  if (typeof value.startedAt !== "string" || value.startedAt.length === 0) {
+    throw new Error("stored conversation.startedAt is invalid");
+  }
+  return {
+    schemaVersion: 1,
+    ordinal: value.ordinal,
+    startedAt: value.startedAt,
+  };
+}
+
+export function decodeConversationRecordV1(
+  input: unknown,
+): ConversationRecordV1 {
+  if (typeof input !== "object" || input === null) {
+    throw new Error("conversation record is invalid");
+  }
+  const value = input as Record<string, unknown>;
+  const stored = decodeStoredConversationV1({
+    schemaVersion: value.schemaVersion,
+    ordinal: value.ordinal,
+    startedAt: value.startedAt,
+  })!;
+  if (typeof value.sessionId !== "string" || value.sessionId.length === 0) {
+    throw new Error("conversation record.sessionId is invalid");
+  }
+  if (value.endedAt !== undefined && typeof value.endedAt !== "string") {
+    throw new Error("conversation record.endedAt is invalid");
+  }
+  return {
+    ...stored,
+    sessionId: value.sessionId,
+    ...(value.endedAt ? { endedAt: value.endedAt as string } : {}),
+  };
+}
+
+/**
+ * The Session id a Bot's chat Turns record while it is on this conversation.
+ *
+ * The first conversation is the bare id on purpose: every Session already
+ * stored is conversation 1, so nothing has to be migrated for it to be one.
+ */
+export function conversationSessionIdV1(base: string, ordinal: number): string {
+  return ordinal <= 1 ? base : `${base}#${ordinal}`;
+}
+
+/** The Session id a Bot's conversational Turns are addressed to. */
+export function botConversationBaseSessionIdV1(identity: {
+  userId: string;
+  botId: string;
+}): string {
+  return `${identity.userId}:${identity.botId}`;
+}
+
+/**
+ * True when this Session id names a conversation of that Bot — the bare base
+ * id or the base id with an ordinal. A Routine firing's `routine:<id>` and a
+ * subagent's Session are deliberately not conversations and never match.
+ */
+export function isConversationSessionIdV1(
+  base: string,
+  sessionId: string,
+): boolean {
+  if (sessionId === base) return true;
+  if (!sessionId.startsWith(`${base}#`)) return false;
+  return /^[1-9][0-9]{0,6}$/.test(sessionId.slice(base.length + 1));
+}

package/src/index.ts

@@ -1,6 +1,7 @@
 export * from "./authority.js";
 export * from "./applets.js";
 export * from "./composition-failures.js";
+export * from "./conversations.js";
 export * from "./composition-store.js";
 export * from "./run-records.js";
 export * from "./run-recovery.js";

package/src/run-failure-bounds.test.ts

@@ -0,0 +1,46 @@
+// A failure the record could not hold, and the transcript it took with it.
+//
+// A run's `failure` is whatever an error's `message` happened to be, and
+// nothing upstream bounds it. A provider that echoed the request back produced
+// one past the record's own limit, the settlement wrote it anyway, and every
+// later read of that run threw `has invalid failure` — so a Turn that failed
+// once went on to 500 the transcript endpoint for ever, and "Try again" could
+// not get the person out of it either.
+import { describe, expect, test } from "bun:test";
+import {
+  boundedRunFailureV1,
+  MAX_RUN_FAILURE_BYTES_V1,
+} from "./run-records.ts";
+
+const bytes = (value: string) => new TextEncoder().encode(value).byteLength;
+
+describe("the failure a settlement may durably write", () => {
+  test("leaves a reason that already fits exactly as it was written", () => {
+    const reason = "Reconciliation was explicitly abandoned: response lost";
+    expect(boundedRunFailureV1(reason)).toBe(reason);
+  });
+
+  test("cuts one the record could not hold, and says it was cut", () => {
+    const bounded = boundedRunFailureV1(
+      "x".repeat(MAX_RUN_FAILURE_BYTES_V1 * 2),
+    );
+    expect(bytes(bounded)).toBeLessThanOrEqual(MAX_RUN_FAILURE_BYTES_V1);
+    expect(bounded.endsWith("…")).toBe(true);
+  });
+
+  test("keeps the opening words, which are the ones a person reads", () => {
+    const bounded = boundedRunFailureV1(
+      `Model request failed: ${"detail ".repeat(MAX_RUN_FAILURE_BYTES_V1)}`,
+    );
+    expect(bounded.startsWith("Model request failed: detail")).toBe(true);
+  });
+
+  test("never cuts inside a character", () => {
+    // Multi-byte throughout: a byte-wise slice would leave a lone surrogate
+    // and the decoder would refuse the record for a different reason.
+    const bounded = boundedRunFailureV1("🐑".repeat(MAX_RUN_FAILURE_BYTES_V1));
+    expect(bytes(bounded)).toBeLessThanOrEqual(MAX_RUN_FAILURE_BYTES_V1);
+    expect(bounded).not.toContain("�");
+    expect([...bounded].every((character) => character.length <= 2)).toBe(true);
+  });
+});

package/src/run-records.ts

@@ -277,6 +277,36 @@ function boundedString(
   );
 }
 
+/** The largest failure a run record may carry, in UTF-8 bytes. */
+export const MAX_RUN_FAILURE_BYTES_V1 = 8_000;
+
+/**
+ * The failure a settlement may durably write, cut to what the record allows.
+ *
+ * A failure string is whatever an error's `message` happened to be, and nothing
+ * upstream bounds it — a provider that echoes a request back, or a message
+ * built by concatenating one, easily runs past the limit. Writing it anyway
+ * produced a record the codec refused on every later read, so a Turn that
+ * failed once went on to 500 the transcript endpoint for ever. The message is
+ * for a person to read: cutting it costs nothing the record does not already
+ * hold, and losing the whole transcript costs everything.
+ */
+export function boundedRunFailureV1(failure: string): string {
+  if (UTF8_ENCODER.encode(failure).byteLength <= MAX_RUN_FAILURE_BYTES_V1) {
+    return failure;
+  }
+  const ellipsis = "…";
+  const budget =
+    MAX_RUN_FAILURE_BYTES_V1 - UTF8_ENCODER.encode(ellipsis).byteLength;
+  let kept = failure;
+  // Cutting by characters and re-measuring keeps the result valid UTF-8; a
+  // byte-wise slice can land inside a multi-byte sequence.
+  while (UTF8_ENCODER.encode(kept).byteLength > budget) {
+    kept = kept.slice(0, Math.max(0, Math.floor(kept.length * 0.9) - 1));
+  }
+  return `${kept}${ellipsis}`;
+}
+
 function decodeDirectToolCommandV1(value: unknown): DirectToolCommandV1 {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new Error("stored run has invalid direct tool command");

package/src/run-recovery.ts

@@ -266,6 +266,76 @@ export function repairOrphanedOpenTurnV1(
   }
 }
 
+/**
+ * True when *any* Turn in the log was never closed — including one buried
+ * behind later Turns that are themselves well formed.
+ *
+ * `hasOrphanedOpenTurnV1` only sees a log that *ends* inside a Turn, and that
+ * is the shape a wedged Bot stops having after its very first retry. The Agent
+ * loop journals `turn/start` durably and only then assembles the request, so
+ * the Turn that discovers the invariant is broken has already written its own
+ * `turn/start`, and its `finally` writes a matching `turn/end` carrying the
+ * validation message. The log that comes out of that ends closed — with the
+ * abandoned Turn still open several events back — so the trailing-open test
+ * says there is nothing to repair, and every later message fails the same way.
+ */
+export function hasUnclosedTurnV1(events: readonly SessionEvent[]): boolean {
+  let openTurn: number | undefined;
+  for (const event of events) {
+    if (event.type === "turn/start") {
+      if (openTurn !== undefined) return true;
+      openTurn = event.turn;
+    }
+    if (event.type === "turn/end" && event.turn === openTurn) {
+      openTurn = undefined;
+    }
+  }
+  return openTurn !== undefined;
+}
+
+/**
+ * The whole durable log with every abandoned Turn closed, or `undefined` when
+ * there is nothing to repair or the log cannot be repaired without inventing
+ * history.
+ *
+ * A Turn left open in the middle of the log cannot be closed by appending:
+ * `turn/end` for it would land after the Turns that followed, and the log
+ * would still read as "turn N started while turn N-1 is open". So the repair
+ * *rewrites* the log, inserting the closing events at the point the Turn was
+ * abandoned and resequencing what follows. The inserted events are the ones
+ * the interrupted-run repair already writes — every unresolved tool occurrence
+ * closed as `interrupted`, then `step/end`, then `turn/end` with outcome
+ * `interrupted` — so a Turn nobody finished reads as one nobody finished.
+ *
+ * Only called where nothing is entitled to write those ends: at admission and
+ * promotion with no run executing, and at settlement, where the run that owned
+ * the Turn has just stopped.
+ */
+export function repairedSessionLogV1(
+  sessionId: string,
+  latest: readonly SessionEvent[],
+): SessionEvent[] | undefined {
+  if (!hasUnclosedTurnV1(latest)) return undefined;
+  let repaired: SessionEvent[] = [];
+  const closeOpenTurn = (): boolean => {
+    if (repaired.length === 0 || !hasOrphanedOpenTurnV1(repaired)) return true;
+    try {
+      const session = new Session(sessionId, () => {}, repaired);
+      session.reconcileInterrupted();
+      repaired = [...session.events];
+    } catch {
+      return false;
+    }
+    return !hasOrphanedOpenTurnV1(repaired);
+  };
+  for (const event of latest) {
+    if (event.type === "turn/start" && !closeOpenTurn()) return undefined;
+    repaired.push({ ...event, seq: repaired.length });
+  }
+  if (!closeOpenTurn()) return undefined;
+  return repaired;
+}
+
 export function eventsForFailedRun(
   durableRun: { events: SessionEvent[] } | undefined,
   error: unknown,

package/src/run-terminal.ts

@@ -8,6 +8,7 @@ import type {
   StoredRunCodecV1,
   StoredRunV1,
 } from "./run-records.js";
+import { repairedSessionLogV1 } from "./run-recovery.js";
 
 /**
  * The events a terminal settlement commits, with any Turn they were left
@@ -44,9 +45,15 @@ function settledEventsV1(
   } catch {
     repairs = [];
   }
+  const settled = [...latest, ...repairs];
+  // A Turn abandoned earlier in the log cannot be closed by appending, and a
+  // settlement that only appends leaves it open forever. The run's own events
+  // are committed as they stand — that record is this run's account, not the
+  // conversation's — while the forward log is repaired in place so the next
+  // Turn starts on a log that reads as a complete history.
   return {
     events: [...decoded, ...repairs],
-    latestEvents: [...latest, ...repairs],
+    latestEvents: repairedSessionLogV1(sessionId, settled) ?? settled,
   };
 }
 

package/src/storage-keys.ts

@@ -135,3 +135,18 @@ export function storedRunAdmissionFences(input: unknown): string[] {
 export function workspaceSyncEffectKey(effectId: string): string {
   return `${WORKSPACE_SYNC_EFFECT_PREFIX}${effectId}`;
 }
+
+/**
+ * The conversation the Bot's chat Session is currently on.
+ *
+ * One Bot has one conversational Session at a time. Starting a new
+ * conversation ends the current one and begins the next: the durable event log
+ * the next Turn derives its request from is empty again, while every Turn the
+ * earlier conversations recorded stays durable and readable under its own
+ * Session id.
+ */
+export const CONVERSATION_KEY = "conversation";
+/** The conversations this Bot has already ended, newest last. */
+export const CONVERSATION_INDEX_KEY = "conversation-index";
+/** How many ended conversations stay listable. Older ones drop off the list. */
+export const MAX_LISTED_CONVERSATIONS = 64;

package/src/turn-supersede.test.ts

@@ -3,7 +3,10 @@ import {
   bootstrapGeneration,
   type CompositionGenerationV1,
 } from "@frockbot/kernel-composition/generation";
-import type { SessionEvent } from "@frockbot/kernel-contracts";
+import {
+  type SessionEvent,
+  validateToolOccurrenceJournal,
+} from "@frockbot/kernel-contracts";
 import {
   BotDurableAuthority,
   SUPERSEDED_TURN_REASON_V1,
@@ -690,6 +693,87 @@ describe("a durable log left inside a Turn", () => {
     });
     expect(storedRun(storage, "run-1").status).toBe("completed");
   });
+
+  test("is repaired even once refused Turns have been logged behind it", async () => {
+    const storage = new MemoryStorage();
+    // What production actually holds on a Bot wedged before the repair
+    // existed. The Agent loop journals `turn/start` durably and only then
+    // assembles the request that discovers turn 1 is still open, so every
+    // refused message left a *complete* Turn of its own behind the abandoned
+    // one — and the log stopped ending inside a Turn. The trailing-open test
+    // then said there was nothing to repair, so admission repaired nothing and
+    // the next message failed exactly the same way, forever.
+    storage.values.set("latest-events", [
+      {
+        type: "session/created",
+        createdAt: "2026-09-03T00:00:00.000Z",
+        seq: 0,
+        timestamp: "2026-09-03T00:00:00.000Z",
+      },
+      {
+        type: "turn/start",
+        turn: 1,
+        seq: 1,
+        timestamp: "2026-09-03T00:00:01.000Z",
+      },
+      {
+        type: "turn/start",
+        turn: 2,
+        seq: 2,
+        timestamp: "2026-09-03T00:00:02.000Z",
+      },
+      {
+        type: "turn/end",
+        turn: 2,
+        outcome: "model-error",
+        reason: "turn 2 started while turn 1 is open",
+        seq: 3,
+        timestamp: "2026-09-03T00:00:03.000Z",
+      },
+    ]);
+    const probe = createAuthority(storage);
+
+    const run = probe.authority.run(command("run-1", "hello"));
+    await probe.handle("run-1").started;
+    probe.handle("run-1").finish();
+    await run;
+
+    const events = storage.values.get("latest-events") as SessionEvent[];
+    // Turn 1 is closed where it was abandoned, not after the Turns that
+    // followed it, and the log is resequenced around the insertion.
+    expect(
+      events
+        .slice(0, 5)
+        .map((event) =>
+          event.type === "turn/start" || event.type === "turn/end"
+            ? `${event.type}:${event.turn}`
+            : event.type,
+        ),
+    ).toEqual([
+      "session/created",
+      "turn/start:1",
+      "turn/end:1",
+      "turn/start:2",
+      "turn/end:2",
+    ]);
+    expect(events[2]).toMatchObject({
+      type: "turn/end",
+      turn: 1,
+      outcome: "interrupted",
+    });
+    expect(events.map((event) => event.seq)).toEqual(
+      events.map((_event, index) => index),
+    );
+    // The repaired history is one the invariant accepts, which is what the
+    // refused Turns were failing on. (The stub Agent below numbers its own
+    // Turn rather than reading `nextTurn`, so only the repaired prefix is the
+    // subject here.)
+    expect(() =>
+      validateToolOccurrenceJournal(events.slice(0, 5)),
+    ).not.toThrow();
+    expect(storedRun(storage, "run-1").status).toBe("completed");
+    expect(storedRun(storage, "run-1").previousEventCount).toBe(5);
+  });
 });
 
 describe("a failing recovery of an older Turn", () => {
@@ -827,3 +911,125 @@ describe("an interrupt while the model is streaming", () => {
     expect((await next).text).toBe("done: second");
   });
 });
+
+describe("a discarded Turn never crashes the object", () => {
+  test("the long-lived caller is answered with the cancelled run, not a throw", async () => {
+    const storage = new MemoryStorage();
+    const probe = createAuthority(storage, { uncertain: () => true });
+
+    const first = probe.authority.run(command("run-1", "first"));
+    await probe.handle("run-1").started;
+    const stopped = storedRun(storage, "run-1");
+    storage.values.set("run:run-1", {
+      ...stopped,
+      stopRequestedAt: "2026-09-03T00:00:05.000Z",
+    });
+    probe.handle("run-1").interrupt("agent cancelled by user");
+
+    // The composer is still holding this request open when Stop is pressed. It
+    // used to be answered with a 500 and a red console error while the UI
+    // beside it said "You stopped this." A Turn the person stopped on purpose
+    // is an ordinary outcome and settles as one.
+    const settled = await first;
+    expect(settled.runId).toBe("run-1");
+    expect(settled.text).toBe("");
+    expect(storedRun(storage, "run-1").status).toBe("cancelled");
+    expect(storage.values.get("active-run")).toBeUndefined();
+  });
+
+  test("recovery settles a stopped Turn instead of re-entering it", async () => {
+    const storage = new MemoryStorage();
+    const probe = createAuthority(storage, { uncertain: () => true });
+
+    const first = probe.authority.run(command("run-1", "first"));
+    await probe.handle("run-1").started;
+    const running = storedRun(storage, "run-1");
+    storage.values.set("run:run-1", {
+      ...running,
+      stopRequestedAt: "2026-09-03T00:00:05.000Z",
+    });
+    // The object is evicted with the Stop durable and the Turn still active:
+    // exactly the state the recovery alarm wakes up to.
+    first.catch(() => undefined);
+
+    const evicted = createAuthority(storage, { uncertain: () => true });
+    await expect(evicted.authority.alarm()).resolves.toBeUndefined();
+
+    // Re-entering it is what took the dev Worker down: the run resumed, reached
+    // "Model response outcome is uncertain after cancellation", and the alarm
+    // had nobody to hand the rejection to. There is nothing to recover — the
+    // User already said to throw it away.
+    expect(evicted.observed).toEqual([]);
+    expect(storedRun(storage, "run-1").status).toBe("cancelled");
+    expect(storage.values.get("active-run")).toBeUndefined();
+  });
+
+  test("recovery settles a superseded Turn instead of re-entering it", async () => {
+    const storage = new MemoryStorage();
+    const probe = createAuthority(storage, { uncertain: () => true });
+
+    const first = probe.authority.run(command("run-1", "first"));
+    await probe.handle("run-1").started;
+    const running = storedRun(storage, "run-1");
+    storage.values.set("run:run-1", {
+      ...running,
+      supersededAt: "2026-09-03T00:00:05.000Z",
+      supersededBy: "run-2",
+    });
+    first.catch(() => undefined);
+
+    const evicted = createAuthority(storage, { uncertain: () => true });
+    await expect(evicted.authority.alarm()).resolves.toBeUndefined();
+
+    expect(evicted.observed).toEqual([]);
+    expect(storedRun(storage, "run-1").status).toBe("superseded");
+    expect(storage.values.get("active-run")).toBeUndefined();
+  });
+
+  test("an alarm records a recovery failure instead of rejecting", async () => {
+    const storage = new MemoryStorage();
+    const probe = createAuthority(storage, { failRecovery: () => true });
+
+    const first = probe.authority.run(command("run-1", "first"));
+    await probe.handle("run-1").started;
+    first.catch(() => undefined);
+
+    // A recovery that cannot run the Turn is a durable fact, not a fault of the
+    // alarm: an alarm has no caller, so anything it lets escape is an uncaught
+    // exception in the object — one of the ways the dev Worker died.
+    const evicted = createAuthority(storage, { failRecovery: () => true });
+    await expect(evicted.authority.alarm()).resolves.toBeUndefined();
+    // And the object still has a deadline, so the next firing tries again.
+    expect(storage.alarmAt).toBeGreaterThan(0);
+  });
+});
+
+describe("Try again on a parked Turn", () => {
+  test("answers with the run it settled rather than throwing", async () => {
+    const storage = new MemoryStorage();
+    // The Turn parks on a provider outcome only a User can retrieve, which is
+    // the state the Resolve Turn button exists for.
+    const probe = createAuthority(storage, {
+      dispatch: () => false,
+      parkOnRelease: () => true,
+    });
+
+    const first = probe.authority.run(command("run-1", "first"));
+    await probe.handle("run-1").started;
+    probe.handle("run-1").finish();
+    await first.catch(() => undefined);
+    expect(storedRun(storage, "run-1").status).toBe("reconciliation-required");
+
+    // "Try again": the retry fails again, the run is abandoned, and that is a
+    // successful abandon — not a failed request. Rethrowing here made the
+    // button answer 409, and the transcript read the browser makes straight
+    // afterwards 500 on the half-repaired record.
+    const abandoned = await probe.authority.reconcileRun(identity, "run-1");
+    expect(abandoned.runId).toBe("run-1");
+
+    const settled = storedRun(storage, "run-1");
+    expect(settled.status).toBe("failed");
+    expect(settled.failure).toContain("explicitly abandoned");
+    expect(storage.values.get("active-run")).toBeUndefined();
+  });
+});