@fungi.computer/shiitake 0.3.1 → 0.4.0

package/dist/internal/coordinator.js

@@ -1,15 +1,16 @@
 import { nanoid } from "@fungi.computer/cairn";
 import { parseModelPreference } from "./model-preference.js";
+import { acceptedNotice } from "@fungi.computer/bird-dog/effect";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as Stream from "effect/Stream";
 import { ShiitakeError } from "../errors.js";
-import { decodeClientReadOptions, decodeClientSessionCommand, decodeClientSessionId, decodeClientSubscribeOptions, } from "./client-boundary.js";
+import { decodeClientReadOptions, decodeClientSettlementRequest, requireDecoded, decodeClientSessionCommand, decodeClientSessionId, decodeClientSubscribeOptions, } from "./client-boundary.js";
 import { mergeObservationSignals, openObservationKernel, publishOwnerObservation, } from "./observation-kernel.js";
 import { checkHostMeta } from "./host-meta.js";
 import { readSessionActivity } from "./session-status.js";
 import { readSessionContext } from "./session-context.js";
-import { abortSession, cancelSession, branchSession, recordOperatorLine, forkSession, readSession, readSessionModelPreference, readSessionReplayPage, readSessionInbox, readLatestPendingPrompt, createSession, deleteSession, deliverSessionGrants, readSessionGrants, setSessionModelPreference, setSessionTitle, readAdmissionIdentity, assertAdmissionIdentity, } from "./woodstock/index.js";
+import { abortSession, cancelSession, branchSession, recordOperatorLine, forkSession, readSession, readCommandSettlement, readSessionModelPreference, readSessionReplayPage, readSessionInbox, readLatestPendingPrompt, createSession, deleteSession, deliverSessionGrants, readSessionGrants, setSessionModelPreference, setSessionTitle, readAdmissionIdentity, assertAdmissionIdentity, } from "./woodstock/index.js";
 /** Generic Agent-scope extension controls over the runtime's one call door. */
 function agentExtensions(runtime) {
     return Object.freeze({
@@ -33,7 +34,7 @@ function withContext(snapshot, context) {
 }
 /** Read the baseline and its context use for one Session. */
 function readSessionWithContext(options, runtime, sessionId, input) {
-    return currentSessionActivity(options, runtime, sessionId).pipe(Effect.flatMap((activity) => readSession(options.store, sessionId, activity, input, () => runtime.extensions.project(sessionId))), Effect.flatMap((snapshot) => readSessionContext(options, sessionId).pipe(Effect.map((context) => withContext(snapshot, context)))));
+    return currentSessionActivity(options, runtime, sessionId).pipe(Effect.flatMap((activity) => readSession(options.store, sessionId, activity, input, () => runtime.extensions.project(sessionId))), Effect.flatMap((snapshot) => readSessionContext(options, sessionId, snapshot.cursor, input?.before === undefined).pipe(Effect.map((context) => withContext(snapshot, context)))));
 }
 function sessionOwnerOperation(runtime, sessionId, operation) {
     return runtime.assertOpen.pipe(Effect.andThen(Effect.try({
@@ -106,6 +107,12 @@ function subscriptionFrames(options, runtime, registration, sessionId, after, de
         if (signal === "reset")
             return resetFrame(options, runtime, sessionId, includeSandboxFailures).pipe(Effect.map(continueFromReset));
         return runtime.assertOpen.pipe(Effect.andThen(currentSessionActivity(options, runtime, sessionId)), Effect.flatMap((activity) => {
+            registration.setQueued(activity.facts.queue.state === "queued");
+            if (signal === "activity" && state.delivery === "live")
+                return Effect.succeed([
+                    [{ kind: "activity", activity: activity.facts }],
+                    Option.some({ ...state, awaitSignal: true }),
+                ]);
             if (signal === "progress" && state.delivery === "live") {
                 return Effect.succeed([
                     [
@@ -132,6 +139,7 @@ function subscriptionFrames(options, runtime, registration, sessionId, after, de
                     return resetFrame(options, runtime, sessionId, includeSandboxFailures).pipe(Effect.map(continueFromReset));
                 const latestCursor = page.frames
                     .flatMap((frame) => frame.kind === "progress" ||
+                    frame.kind === "activity" ||
                     frame.kind === "tool_output"
                     ? []
                     : [frame.cursor])
@@ -141,13 +149,18 @@ function subscriptionFrames(options, runtime, registration, sessionId, after, de
                     delivery: page.hasMore ? state.delivery : "live",
                     awaitSignal: !page.hasMore,
                 };
-                // Every update carries the context use it settles on.
-                return (page.frames.some((frame) => frame.kind === "update")
-                    ? readSessionContext(options, sessionId)
+                // Only a final update that moves the cursor gets a
+                // figure. A wake that moved nothing never re-reads the
+                // whole kept window.
+                const movedHistory = page.frames.some((frame) => frame.kind === "update" &&
+                    frame.cursor !== state.after);
+                return (movedHistory && !page.hasMore
+                    ? readSessionContext(options, sessionId, latestCursor ?? null)
                     : Effect.succeed(undefined)).pipe(Effect.map((context) => [
                     context === undefined
                         ? page.frames
-                        : page.frames.map((frame) => frame.kind === "update"
+                        : page.frames.map((frame) => frame.kind === "update" &&
+                            frame.cursor === latestCursor
                             ? Object.freeze({ ...frame, context })
                             : frame),
                     Option.some(next),
@@ -173,11 +186,14 @@ function decodeWatchInput(sessionId, input) {
 function watchSession(options, runtime, observation, sessionId, input) {
     return runtime.assertOpen.pipe(Effect.andThen(decodeWatchInput(sessionId, input)), Effect.flatMap((decoded) => Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
         const registration = yield* observation.register(decoded.sessionId);
-        return yield* restore(runtime.assertOpen.pipe(Effect.andThen(readSessionWithContext(options, runtime, decoded.sessionId, decoded.options)), Effect.map((snapshot) => Object.freeze({
-            snapshot,
-            changes: subscriptionFrames(options, runtime, registration, decoded.sessionId, snapshot.cursor ?? undefined, "live", decoded.options.includeSandboxFailures === true).pipe(Stream.ensuring(Effect.sync(registration.close))),
-            close: Effect.sync(registration.close),
-        })))).pipe(Effect.onError(() => Effect.sync(registration.close)));
+        return yield* restore(runtime.assertOpen.pipe(Effect.andThen(readSessionWithContext(options, runtime, decoded.sessionId, decoded.options)), Effect.map((snapshot) => {
+            registration.setQueued(snapshot.activity.queue.state === "queued");
+            return Object.freeze({
+                snapshot,
+                changes: subscriptionFrames(options, runtime, registration, decoded.sessionId, snapshot.cursor ?? undefined, "live", decoded.options.includeSandboxFailures === true).pipe(Stream.ensuring(Effect.sync(registration.close))),
+                close: Effect.sync(registration.close),
+            });
+        }))).pipe(Effect.onError(() => Effect.sync(registration.close)));
     }))));
 }
 /**
@@ -335,6 +351,35 @@ export function openCoordinator(options, runtime) {
                 call: (command, input) => runtime.assertOpen.pipe(Effect.andThen(runtime.extensions.call({ scope: "session", sessionId }, extensionId, command, input))),
             }),
             read: (input) => runtime.assertOpen.pipe(Effect.andThen(readSessionWithContext(options, runtime, sessionId, input))),
+            readSettlement: (commandId, timeoutMs = 0) => Effect.scoped(Effect.gen(function* () {
+                yield* runtime.assertOpen;
+                const decoded = yield* Effect.try({
+                    try: () => ({
+                        sessionId: decodeClientSessionId(sessionId),
+                        ...requireDecoded(decodeClientSettlementRequest({ commandId, timeoutMs }), "Settlement request is invalid"),
+                    }),
+                    catch: (cause) => cause instanceof ShiitakeError
+                        ? cause
+                        : new ShiitakeError("contract", "invalid", "Settlement request is invalid"),
+                });
+                // Subscribe before reading: a commit racing the first read cannot
+                // be missed. Only settlement hints reach this registration.
+                const registration = yield* Effect.acquireRelease(observation.register(decoded.sessionId, "settlement"), (value) => Effect.sync(value.close));
+                const read = readCommandSettlement(options.store, decoded.sessionId, decoded.commandId);
+                const initial = yield* read;
+                if (initial !== undefined || decoded.timeoutMs === 0)
+                    return initial;
+                return yield* Effect.gen(function* () {
+                    for (;;) {
+                        const hint = yield* registration.awaitSignal;
+                        if (hint === "closed")
+                            return yield* Effect.fail(new ShiitakeError("runtime", "closed", "Shiitake is closed"));
+                        const settled = yield* read;
+                        if (settled !== undefined)
+                            return settled;
+                    }
+                }).pipe(Effect.timeoutOption(decoded.timeoutMs), Effect.map(Option.getOrUndefined));
+            })),
             subscribe: (input) => subscribeSession(options, runtime, observation, sessionId, input),
             watch: (input) => watchSession(options, runtime, observation, sessionId, input),
         });
@@ -370,7 +415,47 @@ export function openCoordinator(options, runtime) {
  * is the host's authentication of a delegated Agent's reply; only then does
  * the model see the line inside the verified-reply tag.
  */
-export function acceptAddressedMail(runtime, mail, meta, reply) {
+export function acceptAddressedMail(runtime, mail, meta, reply, stageMail, sessionGrantDelivery) {
+    if (mail.to.sessionId === undefined) {
+        if (reply !== undefined || mail.replyTo.length === 0)
+            throw new Error("Only delegated work can create a recipient Session");
+        return runtime.door.transact((admit) => {
+            const sessionId = runtime.createSessionWithinTransaction(mail.key);
+            const grants = sessionGrantDelivery?.(sessionId);
+            if (grants !== undefined)
+                runtime.stageSessionGrantsWithinTransaction(sessionId, grants);
+            const addressed = {
+                ...mail,
+                to: { ...mail.to, sessionId },
+            };
+            const request = {
+                sessionId,
+                requireExistingSession: true,
+                command: {
+                    requestId: mail.key,
+                    delivery: "followUp",
+                    type: "prompt",
+                    text: mail.content,
+                },
+                when: "now",
+                origin: { kind: "user" },
+                mail: addressed,
+                onAccepted: (_acceptedSessionId, commandId) => {
+                    if (stageMail === undefined)
+                        throw new Error("Recipient Agent mail outbox is unavailable");
+                    stageMail(acceptedNotice(mail, sessionId, commandId, Date.now()));
+                },
+            };
+            const result = admit(meta === undefined ? request : { ...request, meta });
+            if (result.status !== "accepted")
+                throw new Error("Sessionless addressed mail was not admitted");
+            return {
+                status: "accepted",
+                commandId: result.commandId,
+                sessionId,
+            };
+        });
+    }
     return admitUserWork(runtime, mail.to.sessionId, {
         requestId: mail.key,
         delivery: reply === undefined ? "followUp" : "steer",

package/dist/internal/effect-client.d.ts

@@ -5,7 +5,9 @@ import type { ShiitakeOwnerAgent, ShiitakeOptions } from "./contracts.js";
 /** Adapt a Promise tool configuration for both initial open and reload. */
 export declare function liftTools(toolSource: NonNullable<ShiitakeOptions["tools"]>): NonNullable<ShiitakeEffectOptions["tools"]>;
 /** Run one Shiitake Effect through its sole Promise error adaptation. */
-export declare function runShiitakePromise<A, E>(effect: Effect.Effect<A, E>): Promise<A>;
+export declare function runShiitakePromise<A, E>(effect: Effect.Effect<A, E>, options?: Readonly<{
+    signal?: AbortSignal;
+}>): Promise<A>;
 /** Adapt one canonical Effect agent to Shiitake's ordinary web interface. */
 export declare function toPromiseAgent(agent: ShiitakeEffectAgent, suppliedAddress?: string): ShiitakeAgent;
 /**

package/dist/internal/effect-client.js

@@ -19,8 +19,8 @@ export function liftTools(toolSource) {
         : { ...tools, execution: toolSource.execution };
 }
 /** Run one Shiitake Effect through its sole Promise error adaptation. */
-export function runShiitakePromise(effect) {
-    return Effect.runPromiseExit(effect).then((exit) => {
+export function runShiitakePromise(effect, options) {
+    return Effect.runPromiseExit(effect, options).then((exit) => {
         if (Exit.isSuccess(exit))
             return exit.value;
         const failure = Option.getOrUndefined(Cause.findErrorOption(exit.cause));
@@ -76,6 +76,7 @@ function sessionFacade(address, session) {
             });
         },
         read: (input) => runShiitakePromise(session.read(input)),
+        readSettlement: (commandId, options) => runShiitakePromise(session.readSettlement(commandId, options?.timeoutMs), options),
         subscribe: (input) => observationAsyncIterable(session.subscribe(input)),
         watch: (input) => runShiitakePromise(session.watch(input)).then((watch) => Object.freeze({
             snapshot: watch.snapshot,

package/dist/internal/effect-contracts.d.ts

@@ -2,7 +2,7 @@ import type { HostMetaOptions } from "./host-meta.js";
 import type { ExtensionRosterV0 } from "../extensions.js";
 import type { Api, AssistantMessage, Model, MuleStreamFunction, RetryPolicy } from "@fungi.computer/mule/effect";
 import type { CapabilitySource, ExecutionOptions, ModuleRegistration } from "@fungi.computer/mycelium";
-import type { GrantsDelivery, GrantsDeliveryResult, ToolAccess } from "./contracts.js";
+import type { CommandSettlement, GrantsDelivery, GrantsDeliveryResult, ToolAccess } from "./contracts.js";
 import type { Sandbox } from "@fungi.computer/mycelium/effect";
 import * as Effect from "effect/Effect";
 import * as Stream from "effect/Stream";
@@ -26,6 +26,8 @@ export type ModelAcquisitionEffect = Readonly<{
     retryable: (message: AssistantMessage) => boolean;
     /** Owner-authored reason for this door's failure message, never SDK prose. */
     failureReason?: (message: AssistantMessage) => string | undefined;
+    /** Provider prose for this door's exact failed turn; never a diagnostic. */
+    providerError?: (message: AssistantMessage) => string | undefined;
     /** Effect finalizer for acquired model resources. */
     release: Effect.Effect<void, ShiitakeError>;
 }>;
@@ -128,7 +130,7 @@ export type ShiitakeEffectOptions = Readonly<{
     retry?: RetryPolicy;
     /**
      * Maximum silence between live provider stream events, in milliseconds.
-     * Omitted means `piHttpIdleTimeoutMs` (Pi coding-agent's own default).
+     * Omitted uses Mule's model stream limits.
      */
     modelStreamIdleTimeoutMs?: number;
 }>;
@@ -189,6 +191,8 @@ export type ShiitakeEffectSession = Readonly<{
     }>;
     /** Read a bounded durable baseline. */
     read: (input?: ReadOptions) => Effect.Effect<SessionSnapshot, ShiitakeError>;
+    /** Exact command facts; timeout releases observation without cancelling work. */
+    readSettlement: (commandId: string, timeoutMs?: number) => Effect.Effect<CommandSettlement | undefined, ShiitakeError>;
     /** Subscribe to strict-after replay and live frames. */
     subscribe: (input: SubscribeOptions) => Stream.Stream<SessionFrame, ShiitakeError>;
     /** Open a race-safe baseline plus live changes resource. */

package/dist/internal/model-acquisition.js

@@ -21,6 +21,8 @@ function asEffectAcquisition(acquisition) {
     };
     if (acquisition.failureReason !== undefined)
         shared = { ...shared, failureReason: acquisition.failureReason };
+    if (acquisition.providerError !== undefined)
+        shared = { ...shared, providerError: acquisition.providerError };
     if (acquisition.stream === undefined)
         return acquisition.retryAfterMs === undefined
             ? Object.freeze(shared)

package/dist/internal/observation-kernel.d.ts

@@ -2,8 +2,8 @@ import * as Effect from "effect/Effect";
 import { ShiitakeError } from "../errors.js";
 import type { SqliteOwner } from "./contracts.js";
 /** Finite process-local signal; durable owner state remains authoritative. */
-export type ObservationSignal = "closed" | "reset" | "durable" | "progress";
-export type ObservationReason = "durable" | "progress";
+export type ObservationSignal = "closed" | "reset" | "durable" | "activity" | "progress";
+export type ObservationReason = "durable" | "activity" | "progress" | "settlement";
 /** One scoped process-local observation registration. */
 export type ObservationRegistration = Readonly<{
     /** Inspect and consume one pending finite signal without waiting. */
@@ -12,17 +12,21 @@ export type ObservationRegistration = Readonly<{
     awaitSignal: Effect.Effect<ObservationSignal>;
     /** Release this registration without affecting durable work. */
     close: () => void;
+    /** Track whether this Session's current queue head is waiting on the Agent. */
+    setQueued: (queued: boolean) => void;
 }>;
 /** Process-local wake coordination; durable facts remain authoritative. */
 export type ObservationKernel = Readonly<{
     /** Register before the caller's first durable read. */
-    register: (sessionId: string) => Effect.Effect<ObservationRegistration, ShiitakeError>;
+    register: (sessionId: string, interest?: "settlement") => Effect.Effect<ObservationRegistration, ShiitakeError>;
     /** Close every registration and release this agent's owner publisher. */
     close: Effect.Effect<void>;
 }>;
 /** Combine coalesced reasons without allowing a progress hint to hide a commit. */
 export declare function mergeObservationSignals(first: ObservationSignal, second: ObservationSignal): ObservationSignal;
-/** Notify owner observers; null identifies an Agent-wide execution change. */
+/** Notify observers of one Session's durable or process-local change. */
 export declare function publishOwnerObservation(store: SqliteOwner, sessionId: string | null, reason?: ObservationReason): void;
+/** Wake queued Sessions when this Agent's execution slot changes. */
+export declare function publishAgentExecutionChange(store: SqliteOwner): void;
 /** Open one coalescing process-local observation kernel per agent. */
 export declare function openObservationKernel(store: SqliteOwner): ObservationKernel;

package/dist/internal/observation-kernel.js

@@ -12,6 +12,8 @@ export function mergeObservationSignals(first, second) {
         return "reset";
     if (first === "durable" || second === "durable")
         return "durable";
+    if (first === "activity" || second === "activity")
+        return "activity";
     return "progress";
 }
 function queueObservation(listener, reason) {
@@ -25,7 +27,9 @@ function queueObservation(listener, reason) {
     listener.pendingReason =
         listener.pendingReason === "durable" || reason === "durable"
             ? "durable"
-            : "progress";
+            : listener.pendingReason === "activity" || reason === "activity"
+                ? "activity"
+                : "progress";
 }
 function deliverObservation(listener, reason) {
     if (listener.closed || listener.reset)
@@ -46,14 +50,14 @@ function deliverObservation(listener, reason) {
         listener.reset = true;
     }
 }
-/** Notify owner observers; null identifies an Agent-wide execution change. */
+/** Notify observers of one Session's durable or process-local change. */
 export function publishOwnerObservation(store, sessionId, reason = "durable") {
     const publishers = ownerPublishers.get(store);
     if (publishers === undefined)
         return;
     for (const publish of publishers) {
         try {
-            publish(sessionId, reason);
+            publish({ kind: "session", sessionId, reason });
         }
         catch (cause) {
             reportCatchFailure("owner-observation-publish", cause);
@@ -61,6 +65,20 @@ export function publishOwnerObservation(store, sessionId, reason = "durable") {
         }
     }
 }
+/** Wake queued Sessions when this Agent's execution slot changes. */
+export function publishAgentExecutionChange(store) {
+    const publishers = ownerPublishers.get(store);
+    if (publishers === undefined)
+        return;
+    for (const publish of publishers) {
+        try {
+            publish({ kind: "agent-execution" });
+        }
+        catch (cause) {
+            reportCatchFailure("owner-execution-change-publish", cause);
+        }
+    }
+}
 /** Open one coalescing process-local observation kernel per agent. */
 export function openObservationKernel(store) {
     const sessions = new Map();
@@ -79,7 +97,7 @@ export function openObservationKernel(store) {
         listener.pendingCount = 0;
         const reason = listener.pendingReason;
         listener.pendingReason = undefined;
-        return reason === "durable" ? "durable" : "progress";
+        return reason ?? "progress";
     };
     const closeListener = (listener) => {
         if (listener.closed)
@@ -104,26 +122,39 @@ export function openObservationKernel(store) {
             }
         }
     };
-    const publish = (sessionId, reason) => {
-        const listeners = sessionId === null ? active : sessions.get(sessionId);
+    const publish = (publication) => {
+        if (publication.kind === "agent-execution") {
+            for (const listener of active)
+                if (listener.queued && !listener.settlementOnly)
+                    deliverObservation(listener, "activity");
+            return;
+        }
+        const listeners = publication.sessionId === null
+            ? active
+            : sessions.get(publication.sessionId);
         if (listeners === undefined)
             return;
-        for (const listener of listeners)
-            deliverObservation(listener, reason);
+        for (const listener of listeners) {
+            if (listener.settlementOnly && publication.reason !== "settlement")
+                continue;
+            deliverObservation(listener, publication.reason === "settlement" ? "durable" : publication.reason);
+        }
     };
     publishers.add(publish);
     ownerPublishers.set(store, publishers);
     return Object.freeze({
-        register: (sessionId) => Effect.suspend(() => {
+        register: (sessionId, interest) => Effect.suspend(() => {
             if (released)
                 return Effect.fail(new ShiitakeError("runtime", "closed", "Shiitake is closed"));
             if (active.size >= MAX_OBSERVATIONS)
                 return Effect.fail(new ShiitakeError("runtime", "rejected", "Observation capacity is exhausted"));
             const listener = {
                 sessionId,
+                settlementOnly: interest === "settlement",
                 closed: false,
                 pendingCount: 0,
                 pendingReason: undefined,
+                queued: true,
                 reset: false,
                 wake: undefined,
             };
@@ -153,6 +184,10 @@ export function openObservationKernel(store) {
                 close: () => {
                     closeListener(listener);
                 },
+                setQueued: (queued) => {
+                    if (!listener.closed)
+                        listener.queued = queued;
+                },
             }));
         }),
         close: Effect.sync(() => {

package/dist/internal/promise-facade.d.ts

@@ -14,5 +14,5 @@ export declare function openPromiseAgent(options: ShiitakeOptions, make: (option
 export declare function openPromiseHost(options: ShiitakeOptions, mailRoom: BirdDogEffect, openHost: (options: ShiitakeEffectOptions, mailRoom: BirdDogEffect) => Effect.Effect<ShiitakeEffectHost, ShiitakeError>): Promise<Readonly<{
     agent: ShiitakeOwnerAgent;
     readSettlement: (sessionId: string, commandId: string) => Promise<CommandSettlement | undefined>;
-    acceptMail: (mail: BirdDogMail, meta?: Json, reply?: VerifiedAgentReply) => Promise<Accepted>;
+    acceptMail: (mail: BirdDogMail, meta?: Json, reply?: VerifiedAgentReply, stageAcceptedNotice?: (mail: BirdDogMail) => void) => Promise<Accepted>;
 }>>;

package/dist/internal/promise-facade.js

@@ -155,6 +155,6 @@ export function openPromiseHost(options, mailRoom, openHost) {
     return runShiitakePromise(liftRuntime(options).pipe(Effect.flatMap((runtime) => openHost(liftOptions(options, runtime), mailRoom)))).then(({ agent, acceptMail, readSettlement }) => Object.freeze({
         agent: toPromiseOwner(agent),
         readSettlement: (sessionId, commandId) => runShiitakePromise(readSettlement(sessionId, commandId)),
-        acceptMail: (mail, meta, reply) => runShiitakePromise(acceptMail(mail, meta, reply)),
+        acceptMail: (mail, meta, reply, stageAcceptedNotice) => runShiitakePromise(acceptMail(mail, meta, reply, stageAcceptedNotice)),
     }));
 }

package/dist/internal/run-scope.js

@@ -1,4 +1,4 @@
-import { muleEffect, piCodingAgentRetryDefaults, piHttpIdleTimeoutMs, } from "@fungi.computer/mule/effect";
+import { muleEffect, piCodingAgentRetryDefaults, } from "@fungi.computer/mule/effect";
 import { make as makeMycelium } from "@fungi.computer/mycelium/effect";
 import * as Effect from "effect/Effect";
 import * as Cause from "effect/Cause";
@@ -33,13 +33,21 @@ export class ToolSetupError extends ShiitakeError {
  * Map Mule's retry transitions onto Woodstock's retained `live_retry` facts.
  * A started attempt ends the backoff countdown before streaming resumes.
  */
-function toLiveRetryEvent(event) {
+function toLiveRetryEvent(event, model) {
     if (event.type === "retry_attempt_started")
         return {
             type: "auto_retry_attempt",
             run: event.run,
             attempt: event.attempt,
         };
+    // Mule's retry text is Pi's private error body. Woodstock's retry journal
+    // feeds status and recovery, not the owner's failed-turn conversation.
+    const safeReason = ("Model request failed. Retry the request. " +
+        unavailableRunReason({
+            runId: event.run.value,
+            provider: model.provider,
+            model: model.id,
+        })).slice(0, 200);
     return event.type === "retry_scheduled"
         ? {
             type: "auto_retry_start",
@@ -47,7 +55,7 @@ function toLiveRetryEvent(event) {
             attempt: event.attempt,
             maxAttempts: event.maxAttempts,
             delayMs: event.delayMs,
-            errorMessage: event.errorMessage,
+            errorMessage: safeReason,
         }
         : event.finalError === undefined
             ? {
@@ -61,7 +69,7 @@ function toLiveRetryEvent(event) {
                 run: event.run,
                 attempt: event.attempt,
                 success: event.success,
-                finalError: event.finalError,
+                finalError: safeReason,
             };
 }
 /** Acquire the run's tools for exactly one Session, so hosts can project per Session. */
@@ -139,6 +147,7 @@ export function runAcceptedCommand(options, prepared, executionContract, extensi
         let resume = prepared.resume;
         const settings = openCompactionSettings(options.compaction)(acquired.model);
         let failureReason;
+        let failedModelAttempts = 0;
         const run = yield* runWithCompaction({
             store: options.store,
             sessionId: prepared.command.sessionId,
@@ -151,6 +160,7 @@ export function runAcceptedCommand(options, prepared, executionContract, extensi
             messages: prepared.messages,
             resuming: resume !== undefined,
             run: (workingMessages, betweenTurns) => {
+                failedModelAttempts = 0;
                 const continuation = resume;
                 resume = undefined;
                 // A failed lifecycle notification precedes Mule's returned outcome
@@ -162,11 +172,21 @@ export function runAcceptedCommand(options, prepared, executionContract, extensi
                         failedEnd = event;
                         return Effect.void;
                     }
+                    if (event.type === "message_end" &&
+                        event.value.role === "assistant" &&
+                        event.value.stopReason === "error") {
+                        const providerError = acquired.providerError?.(event.value);
+                        if (providerError !== undefined)
+                            return recorder({
+                                ...event,
+                                value: { ...event.value, providerError },
+                            });
+                    }
                     return recorder(event);
                 };
                 const input = {
                     model: acquired.model,
-                    modelStreamIdleTimeoutMs: options.modelStreamIdleTimeoutMs ?? piHttpIdleTimeoutMs,
+                    modelStreamIdleTimeoutMs: options.modelStreamIdleTimeoutMs,
                     retry: options.retry ?? piCodingAgentRetryDefaults,
                     retryAfterMs: acquired.retryAfterMs,
                     retryable: acquired.retryable,
@@ -191,7 +211,11 @@ export function runAcceptedCommand(options, prepared, executionContract, extensi
                         phase: "control",
                         message: error.message,
                     }))),
-                    onRetry: (event) => recordLiveRetryEvent(options.store, accepted, toLiveRetryEvent(event), event.turn),
+                    onRetry: (event) => {
+                        if (event.type === "retry_finished" && !event.success)
+                            failedModelAttempts = event.attempt + 1;
+                        return recordLiveRetryEvent(options.store, accepted, toLiveRetryEvent(event, acquired.model), event.turn);
+                    },
                 };
                 return muleEffect
                     .run(acquired.stream === undefined
@@ -201,8 +225,13 @@ export function runAcceptedCommand(options, prepared, executionContract, extensi
                     if (failedEnd === undefined)
                         return Effect.void;
                     if (Exit.isSuccess(exit)) {
-                        failureReason = (acquired.failureReason?.(exit.value.message) ??
-                            returnedFailureReason(exit.value)).slice(0, 200);
+                        const cause = exit.value.modelLimitReason ??
+                            acquired.failureReason?.(exit.value.message) ??
+                            returnedFailureReason(exit.value);
+                        failureReason = (failedModelAttempts > 1 &&
+                            exit.value.modelLimitReason === undefined
+                            ? `The model failed ${String(failedModelAttempts)} times on this conversation: ${cause}`
+                            : cause).slice(0, 200);
                         return recorder(failedEnd, failureReason);
                     }
                     const error = Cause.findErrorOption(exit.cause);

package/dist/internal/runtime-coordinator.d.ts

@@ -2,6 +2,7 @@ import { type BirdDogEffect } from "@fungi.computer/bird-dog/effect";
 import { type WatchdogQueueHead } from "@fungi.computer/watchdog/effect";
 import * as Effect from "effect/Effect";
 import type { AgentRunningWork } from "../client.js";
+import type { GrantsDelivery } from "./contracts.js";
 import { ShiitakeError } from "../errors.js";
 import { type AdmissionDoor } from "./admission-door.js";
 import type { ShiitakeEffectOptions } from "./effect-contracts.js";
@@ -19,6 +20,10 @@ export type RuntimeCoordinator = Readonly<{
     beginClose: Effect.Effect<void>;
     /** The one accepted-command door every prompt producer admits through. */
     door: AdmissionDoor;
+    /** Reserve a Session within the admission door's enclosing transaction. */
+    createSessionWithinTransaction: (requestId: string) => string;
+    /** Write new-Session grants through the enclosing admission transaction. */
+    stageSessionGrantsWithinTransaction: (sessionId: string, delivery: GrantsDelivery) => void;
     /** Storage-pressure check for new Sessions and new prompts. */
     storage: StorageAdmission;
     recordAcceptedCancellation: RecordAcceptedCancellation;

package/dist/internal/runtime-coordinator.js

@@ -3,7 +3,7 @@ import { WatchdogError } from "@fungi.computer/watchdog";
 import { makeRuntime as makeWatchdogRuntime, } from "@fungi.computer/watchdog/effect";
 import * as Effect from "effect/Effect";
 import * as Latch from "effect/Latch";
-import { publishOwnerObservation } from "./observation-kernel.js";
+import { publishAgentExecutionChange } from "./observation-kernel.js";
 import { ShiitakeError } from "../errors.js";
 import { agentTurnRecovery, executeAcceptedRun, } from "./accepted-run-executor.js";
 import { openAdmissionDoor } from "./admission-door.js";
@@ -11,7 +11,7 @@ import { openCompactionSettings } from "./compaction/settings.js";
 import { admitExtensionRosterV0, } from "./extension-roster.js";
 import { coreConsumer, openExtensionRuntime, } from "./extension-runtime.js";
 import { reconcileRuntime } from "./runtime-reconciliation.js";
-import { advanceCursor, prepareExtensionStore, projectSessionRun, openStorageAdmission, readCursor, } from "./woodstock/index.js";
+import { advanceCursor, createSessionWithinTransaction, deliverSessionGrants, prepareExtensionStore, projectSessionRun, openStorageAdmission, readCursor, } from "./woodstock/index.js";
 function runtimeFailure(message) {
     return new ShiitakeError("runtime", "rejected", message);
 }
@@ -64,7 +64,7 @@ export function openRuntimeCoordinator(options, coreDigest, admitted, mailRoom)
                     if (runningWork.kind === "session")
                         activeSessions.add(job.queue);
                     // A different Session's wait changes when this executor changes.
-                    publishOwnerObservation(options.store, null);
+                    publishAgentExecutionChange(options.store);
                 }), () => job.lane === options.hostJobs?.lane
                     ? (hostExecutor.current?.execute(job) ??
                         Effect.fail(new WatchdogError("execution_failed")))
@@ -82,7 +82,7 @@ export function openRuntimeCoordinator(options, coreDigest, admitted, mailRoom)
                     if (job.lane !== options.hostJobs?.lane)
                         activeSessions.delete(job.queue);
                     runningSlots.delete(job.lane === options.hostJobs?.lane ? "host" : "serial");
-                    publishOwnerObservation(options.store, null);
+                    publishAgentExecutionChange(options.store);
                 })),
             },
             wake: {
@@ -253,6 +253,10 @@ export function openRuntimeCoordinator(options, coreDigest, admitted, mailRoom)
                 : Effect.fail(new ShiitakeError("runtime", "closed", "Shiitake is closed"))),
             beginClose,
             door,
+            createSessionWithinTransaction: (requestId) => createSessionWithinTransaction(options.store, requestId, storage.admitNew),
+            stageSessionGrantsWithinTransaction: (sessionId, delivery) => {
+                deliverSessionGrants(options.store, sessionId, delivery);
+            },
             storage,
             recordAcceptedCancellation: ({ jobId, cancellationId, onlyIfPending }) => watchdog.transactional.recordCancellationIntent({
                 jobId,

package/dist/internal/runtime-core.d.ts

@@ -5,6 +5,7 @@ import type { VerifiedAgentReply } from "./woodstock/index.js";
 import type { BirdDogEffect } from "@fungi.computer/bird-dog/effect";
 import * as Effect from "effect/Effect";
 import type { Accepted } from "../client.js";
+import type { GrantsDelivery } from "./contracts.js";
 import { ShiitakeError } from "../errors.js";
 import type { ShiitakeEffectOptions, ShiitakeEffectOwner } from "./effect-contracts.js";
 /** Private host composition with the addressed-mail ingress kept off Session. */
@@ -13,7 +14,7 @@ export type RuntimeCore = Readonly<{
     readSettlement: (sessionId: string, commandId: string) => Effect.Effect<CommandSettlement | undefined, ShiitakeError>;
     /** Owner-local execution projection; never served by the remote client. */
     activeSessions: Effect.Effect<readonly string[]>;
-    acceptMail: (mail: BirdDogMail, meta?: Json, reply?: VerifiedAgentReply) => Effect.Effect<Accepted, ShiitakeError>;
+    acceptMail: (mail: BirdDogMail, meta?: Json, reply?: VerifiedAgentReply, stageAcceptedNotice?: (mail: BirdDogMail) => void, sessionGrantDelivery?: (sessionId: string) => GrantsDelivery) => Effect.Effect<Accepted, ShiitakeError>;
 }>;
 /** Open Runtime Core, optionally joining its owner-local BirdDog mail room. */
 export declare function openRuntimeCore(options: ShiitakeEffectOptions, mailRoom?: BirdDogEffect): Effect.Effect<RuntimeCore, ShiitakeError>;

package/dist/internal/runtime-core.js

@@ -34,7 +34,12 @@ export function openRuntimeCore(options, mailRoom) {
             agent: owner,
             readSettlement: (sessionId, commandId) => runtime.assertOpen.pipe(Effect.andThen(readCommandSettlement(options.store, sessionId, commandId))),
             activeSessions: runtime.activeSessions,
-            acceptMail: (mail, meta, reply) => acceptAddressedMail(runtime, mail, meta, reply),
+            acceptMail: (mail, meta, reply, stageAcceptedNotice, sessionGrantDelivery) => acceptAddressedMail(runtime, mail, meta, reply, stageAcceptedNotice ??
+                ((notice) => {
+                    if (mailRoom?.postMail === undefined)
+                        throw new Error("Recipient Agent mail outbox is unavailable");
+                    Effect.runSync(mailRoom.postMail(notice));
+                }), sessionGrantDelivery),
         });
     });
 }