@hypercarrier/pi-team-durable 0.1.0-rc.1 → 0.1.0-rc.3

package/README.md

@@ -19,10 +19,16 @@ notices.
   Later versions publish from CI with npm provenance.
 - **Protocol value.** The persisted notice value `sender: 'durable-team'` is a
   protocol value from the package's former name. It stays unchanged.
-- **Tests here.** CI runs the unit suites.
+- **Tests here.** CI runs the unit suites and a 100-seed differential oracle run.
+  Run 500 or more seeds by hand before a release.
   The SIGKILL crash suite and `bench/e2e.ts` stay in HyperCarrier (private).
-- **Store format.** This version stores version-1 documents. The next version
-  migrates them to version 2, and a downgrade cannot read a migrated store.
+- **Before deploy.** The first open migrates the store to the indexed format. The
+  migration is one-way: rollback means restoring a backup. Back up the store, and
+  stop every older node process first. 0.1.0-rc.1 stores version-1 documents.
+  This version migrates them to version 2, and a downgrade cannot read a migrated
+  store. 0.1.0-rc.3 also upgrades stored `ptb.deliver` tasks to task version 2.
+  Older versions then park those deliveries as `task_too_old`. This upgrade is
+  one-way too.
 
 Known issues:
 
@@ -30,8 +36,11 @@ Known issues:
    Team Bright retries it; this package does not.
 2. `team_sync` can replay pages that an earlier call released. Act only on
    `task_read`, and never call `team_sync` from a nested tool call.
-3. Interrupt: a Worker can interrupt the lead, the run to stop is chosen when the
-   Alert is accepted, and the abort has no settle bound.
+3. Interrupt fallback can leave an Alert queued. When a provider ignores the abort
+   for the full 10-second wait, the Alert is admitted while the run is busy. When
+   that run then ends by abort, the Alert waits until the next input starts a run.
+   An ordinary Alert queued before a run-only abort behaves the same. The cause is
+   pi-durable 1.4.0: an aborted run does not drain its inbox.
 4. An Alert can be admitted after its recipient is closed or fenced. After an owner
    Close, a busy Worker can still run one tool call.
 
@@ -44,17 +53,31 @@ npm install @hypercarrier/pi-team-durable@next
 The package ships compiled JavaScript and type declarations under `dist`.
 Node 22.19 or newer. Install the three pinned peers beside it.
 
+`./testing` exports named internals for a host's own tests. It is unstable test support:
+its names can change in any release. Production code imports `./authority` only.
+
 ## API
 
 `./authority` exports the runtime factory, authority documents, observation
 observer, and structural stop ports. A host adapter registers this runtime.
 
-- `ptb.team`, `ptb.graph`, `ptb.journal`, `ptb.outbox`, and `ptb.receipts` store
-  authority, graph history, recent events, delivery obligations, and replay results.
-  Each accepted command and its mechanics commit together.
+- `ptb.team` owns membership and lifecycle. `ptb.head` holds current graph
+  coordinates, readiness, occupancy, attention, and bounded recent references.
+  Task family members hold current facts, retained Attempts, cards, and operator
+  projections. Immutable graph indexes hold topology. Worker indexes hold
+  nonterminal Task IDs. Each changed document is stored as a base.
+- A controller-only conversation holds graph revision diffs and controller
+  events. Commands restore the incremental engine from current Task records.
+  They commit changed facts, indexes, receipts, obligations, and history together.
+- Operation receipts retain exact result strings per epoch. Native tool-call
+  receipts use task scope and retire with the tool. Direct callers use permanent
+  family members. Obligations retain their identity after settlement; bounded
+  hash partitions index pending and unscheduled keys.
 - Nine lead tools and three Worker tools use the rc.7 contract. Exact conversation
   and generation bindings guard authority. A fork does not acquire an existing
-  Team's lead authority.
+  Team's lead authority. Each role acts only on its schema's declared fields,
+  including nested fields. Undeclared fields do not enter replay identity.
+  Only the lead can request an Alert interrupt.
 - `ptb.worker-anchor` owns a Worker conversation and renews a durable sleep.
   Lead Esc does not end it. Stops use stored target IDs through the node's single
   mark-before-resume fence. Failed confirmation retains the intent.
@@ -62,22 +85,77 @@ observer, and structural stop ports. A host adapter registers this runtime.
   admission, and waits for settlement. Notices use `team.notice` entries whose
   data (`TeamNoticeData`) names the delivery kind and its sender: an Alert's
   author, or `team-lead` for Tasks and stops. An interrupt Alert's data also
-  has `interrupt: true`. A reader names a notice from this data, never from its
-  text.
-  Interrupt Alerts persist the recipient run ID at acceptance. A separate phase
-  asks the host `abortRun` port to stop that exact run, then checkpoints before
-  normal admission. Queue identities stay native; no input is re-queued.
-  A failed interruption appears as unproved in the notice. Retry never selects
-  a replacement run. The node supplies a cancellable wait outside its admission lock.
+  has `interrupt: true`. A confirmed interruption adds `interruptedRun` to the
+  obligation and entry data. This field identifies the aborted native run.
+  A reader names a notice from this data, never from its text.
+  New interrupt obligations and delivery inputs carry `interruptAt: 'delivery'`.
+  The interrupt phase selects `LiveDoc.run` and commits its run ID and absolute
+  settlement deadline before asking the host `abortRun` port to stop that run.
+  The settlement wait has a 10-second budget. Retry keeps the selection and deadline.
+  An idle recipient gets a plain steer. An unproved interruption gets normal
+  admission with an unproved outcome. A newer run gets no second abort.
+  Unmarked inputs keep their acceptance-time choice and model-facing wording;
+  an absent run ID remains an idle-at-send choice.
+  Task version 2 migrates version-1 inputs and checkpoints without changing them.
+  After the first open and resume, older nodes park these deliveries with
+  `task_too_old`. Restore a backup to roll back.
+  Queue identities and inbox order stay native. No input is re-queued.
+  The node supplies a cancellable wait outside its admission lock.
+  Native run-only abort does not drain an input admitted before abort settlement.
+  That input can stay queued until another admission starts the next run. Two
+  bounded expected-failure cases in `test/authority/interrupt-parity.test.ts`
+  record it.
 - `ptb.notify` reserves an automatic page before admission. A failed lead input
   pauses notification. Explicit sync or a new owner input resumes it.
 - `team_sync` reserves successive bounded pages. It never waits for consumption.
   The final request hook records exact page visibility. A later observer requires
   a matching persisted native assistant entry and successful input settlement
   before it advances the cursor. Compaction and failed runs release unseen pages.
-- The journal keeps 100 recent events in its document and immutable `ptb.event`
-  entries in native storage. This bound does not cover graph history, receipts,
-  outbox, observation proofs, or storage history.
+- The head keeps references to 100 recent journal events. Their immutable
+  `ptb.event` entries stay in the lead conversation, so sync page boundaries stay
+  unchanged.
+- Observation indexes, page metadata, immutable page bodies, and open proofs
+  use separate base-checkpointed documents. Requests check active pages from
+  the newest message backward. They do not hash transcript history.
+- The observer retires a proof after its run settles and it processes the
+  evidence. It retires a page body only when the page is acknowledged or
+  replaced and the contiguous cursor covers it. Unsettled proofs and notifier
+  submit/settle checkpoints keep referenced bodies. Unknown notifier ownership
+  keeps the body. Page metadata and the exact replay receipts remain.
+- `observations(tx)` and `observationStats(tx)` are diagnostic readers. The
+  latter reports current-record counts and UTF-8 JSON bytes. Production hooks
+  and the observer read current indexes.
+- `/ptb` reads one acknowledged scan anchor for the current epoch. This anchor
+  differs from the runtime reservation anchor in `scanByEpoch`. Cursor advance
+  folds eligible waiting-page anchors before removing their waiting entries.
+  Body retirement retains the anchor; epoch change removes it.
+- `readTeamPanel` reads current Task projections and recent records.
+  `readTeamSummary` reads head indexes. `state.open()` is a full-history diagnostic
+  adapter; runtime paths do not use it.
+
+The first authority open migrates rc.7 documents in one transaction. It checks
+current facts against the reference controller and writes the new records and
+log. The same transaction raises all six shared PTB document kinds to version 2:
+`ptb.team`, `ptb.graph`, `ptb.journal`, `ptb.outbox`, `ptb.receipts`, and
+`ptb.observation`. `ptb.team` keeps its data. The other five retain only
+`{fence:"ptb-authority-v2"}`. Current commands use the new authority records.
+These occupied addresses prevent old code from creating fresh version-1
+documents. pi-durable rejects old typed reads before mutation. Fresh stores
+receive the same fence. Native pi-durable documents keep their own versions.
+
+A migrated operation receipt receives its original projection check on its
+first replay. Downgrade is not supported.
+
+The fence covers stopped and reopened stores, not an old process that is still
+running. Before the first open with this build, stop every node process that
+runs older code, and back up the whole store directory. To roll back, restore
+that backup and run the older build on it. A rollback discards all Team work
+accepted after the migration.
+
+Known hazard until the next contract change: `team_sync` can replay a stale
+page. This occurred with a direct snapshot call as well as nested calls. Leads
+use `task_read` for any Task state they act on. A direct `team_sync` call does
+not establish current Task state.
 
 The host injects model roles: a static `modelRoles` list, or a `catalog(tx,
 lead)` resolver that gives each lead its own roles and default. The AmPi
@@ -93,11 +171,44 @@ contract pin: it ships the same source files, and a test compares their SHA-256
 values with the recorded ones. The tests regenerate the contract from the
 installed devDependency `@hypercarrier/pi-team-bright@0.25.1`.
 
+Each role's tool labels and descriptions come from Pi Team Bright's own
+registration. `scripts/pi-registration.mjs` captures it per role through an
+inert host. The parity test compares every durable tool with the installed
+`@hypercarrier/pi-team-bright`. Pi registers the Worker tools outside its
+catalog, so their parameter schemas also come from that registration.
+
 ```sh
 npm ci
 npm test
 ```
 
+The hardening oracle freezes `src/authority` at
+certified P, the 0.1.0-rc.1 port, in `test/oracle/authority`.
+Do not update that copy when optimizing the runtime. The seeded differential
+harness compares exact tool results or error messages, all public Task cards,
+and created `ptb.deliver` inputs after every command. Each runtime has its own
+MemoryStorage Harness. Both schedulers stay paused. The stop port returns fake
+settlement. A synthetic persisted lead run permits snapshot and update reads.
+Delivery execution and observation acknowledgement have separate tests.
+
+```sh
+# From the repository root: N seeds over K processes (defaults: 500 and 4).
+npm run test:oracle -- --seeds 500 --shards 4
+# Replay one failing seed. Failures print its full command trace.
+npm run test:oracle -- --seed 42 --seeds 1 --shards 1
+# Run only the deterministic boundary cases.
+npm run test:oracle -- --targeted-only
+```
+
+Each seed runs about 70 commands over at most seven Tasks. It combines a fixed
+lifecycle and transition prefix with 30 random commands, then starts a new Team
+epoch. Use `--steps` to change the random command count. A separate deterministic
+sequence covers prerequisite repair, superseded dependents, removed and
+reintroduced keys, stale lineage, blocked Worker capacity, reorder-only
+restatement, and stop notices after Worker reconnection. The normal Vitest suite
+runs these cases and three smoke seeds. This oracle detects behavior drift from the frozen
+runtime; it does not prove that the frozen behavior is correct.
+
 Fast tests use MemoryStorage, a fixed clock, inert timers, and faux responses.
 The SIGKILL crash-recovery suite and `bench/e2e.ts` stay in HyperCarrier (private).
 They use the AmPi node's subprocess carrier. This repository's tests do not

package/dist/authority/contracts.d.ts

@@ -3,10 +3,17 @@ import type { Result } from './state.ts';
 export declare const TOOL_NAMES: readonly ["team_create", "team_sync", "ensure_worker", "task_graph_apply", "task_read", "task_update", "worker_stop", "team_shutdown", "alert_send"];
 export type ToolName = typeof TOOL_NAMES[number];
 export type Role = 'lead' | 'worker';
+/** The label and description Pi Team Bright registers for one role's tool. */
+export interface ToolPresentation {
+    label: string;
+    description: string;
+}
 export interface Contract {
     lead: Record<ToolName, TSchema>;
     worker: Partial<Record<ToolName, TSchema>>;
     results: Record<ToolName, TSchema>;
+    presentation: Record<Role, Partial<Record<ToolName, ToolPresentation>>>;
 }
+export declare function checkSchema(schema: TSchema, value: unknown): boolean;
 export declare function contracts(goalMaxLength?: number): Contract;
 export declare function checkResult(contract: Contract, name: ToolName, value: Result): Result;

package/dist/authority/contracts.js

@@ -1,12 +1,27 @@
 import { readFileSync } from 'node:fs';
-import { Check } from 'typebox/value';
+import { Compile } from 'typebox/compile';
 export const TOOL_NAMES = ['team_create', 'team_sync', 'ensure_worker', 'task_graph_apply', 'task_read', 'task_update', 'worker_stop', 'team_shutdown', 'alert_send'];
 // Generated from the pinned executable rc.7 contract, not the stale agent surface.
-const source = JSON.parse(readFileSync(new URL('./rc7-contract.json', import.meta.url), 'utf8'));
+const source = readFileSync(new URL('./rc7-contract.json', import.meta.url), 'utf8');
+const patchedContracts = new Map();
+const validators = new Map();
+export function checkSchema(schema, value) {
+    const key = JSON.stringify(schema, (_key, value) => value && typeof value === 'object' && !Array.isArray(value)
+        ? Object.fromEntries(Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) : value);
+    let validator = validators.get(key);
+    if (!validator) {
+        validator = Compile(JSON.parse(key));
+        validators.set(key, validator);
+    }
+    return validator.Check(value);
+}
 export function contracts(goalMaxLength = 1600) {
     if (!Number.isSafeInteger(goalMaxLength) || goalMaxLength < 1)
         throw new Error('goalMaxLength must be a positive safe integer');
-    const copy = structuredClone(source);
+    const cached = patchedContracts.get(goalMaxLength);
+    if (cached !== undefined)
+        return JSON.parse(cached);
+    const copy = JSON.parse(source);
     function patch(value) {
         if (!value || typeof value !== 'object')
             return;
@@ -20,10 +35,11 @@ export function contracts(goalMaxLength = 1600) {
             patch(child);
     }
     patch(copy);
+    patchedContracts.set(goalMaxLength, JSON.stringify(copy));
     return copy;
 }
 export function checkResult(contract, name, value) {
-    if (!Check(contract.results[name], value))
+    if (!checkSchema(contract.results[name], value))
         throw new Error(`PTB ${name} produced a result outside the rc.7 contract: ${JSON.stringify(value)}`);
     return value;
 }

package/dist/authority/delivery.d.ts

@@ -1,9 +1,11 @@
 import type { AbortRun, InterruptTarget } from './interrupt.ts';
-import { type SubmissionId, type Tx } from '@earendil-works/pi-durable';
-import { type State, type Obligation } from './state.ts';
+import { type TaskId, type SubmissionId, type Tx } from '@earendil-works/pi-durable';
+import { type Obligation } from './state.ts';
+import { type Authority as State } from './store.ts';
 /** `kind` and `sender` name the delivery in its queue entry; inputs persisted before they existed lack them. */
 export interface DeliveryInput extends InterruptTarget {
     interrupt?: true;
+    interruptAt?: 'delivery';
     epoch: string;
     content: string;
     whenBusy: 'steer' | 'followUp';
@@ -13,7 +15,8 @@ export interface DeliveryInput extends InterruptTarget {
 /**
  * The structured data of a Team input's `team.notice` entry. A reader names the input from these fields, never from
  * its text: `delivery` is the kind (`update` for a notifier page), `sender` the author, at most SENDER_LIMIT characters.
- * `interrupt` marks an Alert sent to interrupt the recipient's run; the interruption outcome stays in the model-facing content.
+ * `interrupt` marks an Alert sent to interrupt the recipient's run. `interruptedRun` identifies a confirmed aborted run.
+ * The interruption outcome stays in the model-facing content.
  * Entries written before `delivery` existed carry only `source` and `deliveryId` or `pageId`.
  */
 export type TeamNoticeData = {
@@ -24,12 +27,13 @@ export type TeamNoticeData = {
     delivery?: Obligation['kind'] | 'update';
     sender?: string;
     interrupt?: true;
+    interruptedRun?: TaskId;
 };
 export declare const SENDER_LIMIT = 64;
-export declare function eligible(s: State, o: Obligation): boolean;
-export declare function deliveryInput(s: State, o: Obligation): DeliveryInput;
+export declare function eligible(s: State, o: Obligation): Promise<boolean>;
+export declare function deliveryInput(s: State, o: Obligation): Promise<DeliveryInput>;
 /** The input a delivery submits. The request ID names the Obligation, so a retry reacquires the same admission. */
-export declare function deliveryDraft(input: DeliveryInput, interruption?: Obligation['interruption']): {
+export declare function deliveryDraft(input: DeliveryInput, interruption?: Obligation['interruption'], interruptedRun?: TaskId): {
     type: "input";
     content: string;
     whenBusy: "steer" | "followUp";
@@ -39,21 +43,22 @@ export declare function deliveryDraft(input: DeliveryInput, interruption?: Oblig
         data: TeamNoticeData;
     };
 };
-export declare const Deliver: import("@earendil-works/pi-durable").Task<DeliveryInput, {
-    phase: "interrupt";
-} | {
-    phase: "submit";
+export declare const INTERRUPT_SETTLE_TIMEOUT_MS = 10000;
+type InterruptCheckpoint = {
+    phase: 'interrupt';
+    selection?: {
+        run?: TaskId;
+        deadline: number;
+    };
+};
+type DeliveryCheckpoint = InterruptCheckpoint | {
+    phase: 'submit';
 } | {
-    phase: "settle";
+    phase: 'settle';
     submissionId: SubmissionId;
-}, null, object>;
+};
+export declare const Deliver: import("@earendil-works/pi-durable").Task<DeliveryInput, DeliveryCheckpoint, null, object>;
 /** Keep the shared submit/settle mechanics; only the host-owned interruption needs a port. */
-export declare function createDeliver(abortRun: AbortRun): import("@earendil-works/pi-durable").Task<DeliveryInput, {
-    phase: "interrupt";
-} | {
-    phase: "submit";
-} | {
-    phase: "settle";
-    submissionId: SubmissionId;
-}, null, object>;
+export declare function createDeliver(abortRun: AbortRun): import("@earendil-works/pi-durable").Task<DeliveryInput, DeliveryCheckpoint, null, object>;
 export declare function scheduleDeliveries(tx: Tx, s: State, delivery: typeof Deliver): Promise<void>;
+export {};

package/dist/authority/delivery.js

@@ -1,10 +1,9 @@
-import { withAbortSignal } from '@earendil-works/chord/context';
-import { defineTask } from '@earendil-works/pi-durable';
-import { GraphTaskController } from "./graph-control.js";
-import { projectGraphTaskCards } from "./graph-card.js";
-import { open, plain, event } from "./state.js";
+import { withAbortSignal, withCancel, awaitWithContext } from '@earendil-works/chord/context';
+import { defineTask, LiveDoc } from '@earendil-works/pi-durable';
+import { plain, event } from "./state.js";
+import { openAuthority as open, flushAuthority, markScheduled, unscheduledObligations, taskRecord, alertRecord, obligation, setObligationState } from "./store.js";
 export const SENDER_LIMIT = 64;
-export function eligible(s, o) {
+export async function eligible(s, o) {
     const team = s.team.current;
     if (!team || team.epoch !== o.epoch || team.lifecycle !== 'active' || team.shutdownPending || o.state !== 'pending')
         return false;
@@ -15,45 +14,52 @@ export function eligible(s, o) {
         return false;
     if (o.kind !== 'task')
         return true;
-    if (!s.graph.snapshot || s.graph.epoch !== team.epoch)
+    if (!s.head.graph || s.head.epoch !== team.epoch)
         return false;
-    const task = GraphTaskController.recover(plain(s.graph.snapshot)).readTasks().find(t => t.id === o.taskId);
-    return !!task && task.version === o.version && task.assignee === o.recipient && task.state.kind === 'ready';
+    const task = (await taskRecord(s, o.taskId))?.card;
+    return !!task && task.version === o.version && task.assignee === o.recipient && task.status === 'ready';
 }
-export function deliveryInput(s, o) {
+export async function deliveryInput(s, o) {
     let payload;
     if (o.kind === 'alert')
-        payload = { kind: 'alert', alert: plain(s.outbox.alerts[o.alertId]) };
+        payload = { kind: 'alert', alert: plain(await alertRecord(s, o.alertId)) };
     else if (o.kind === 'stop')
         payload = { kind: 'task_changed', task_id: o.taskId, message: 'The previous Attempt was superseded or cancelled. Read current Task authority before continuing.' };
     else {
-        const graph = GraphTaskController.recover(plain(s.graph.snapshot));
-        payload = { kind: 'task', task: projectGraphTaskCards(graph).find(t => t.id === o.taskId) };
+        payload = { kind: 'task', task: plain((await taskRecord(s, o.taskId))?.card) };
     }
     // An Alert names its author; durable-team sends Tasks and stops on the Team authority's behalf, as team-lead.
-    const sender = (o.kind === 'alert' ? s.outbox.alerts[o.alertId]?.from : 'team-lead')?.slice(0, SENDER_LIMIT);
-    return { key: o.key, epoch: o.epoch, conversationId: o.conversationId, ...(o.interrupt ? { interrupt: true, ...(o.interruptRun !== undefined ? { expectedRunTaskId: o.interruptRun } : {}) } : {}), content: JSON.stringify(payload), whenBusy: o.kind === 'task' ? 'followUp' : 'steer', kind: o.kind, ...(sender ? { sender } : {}) };
+    const sender = (o.kind === 'alert' ? (await alertRecord(s, o.alertId))?.from : 'team-lead')?.slice(0, SENDER_LIMIT);
+    return { key: o.key, epoch: o.epoch, conversationId: o.conversationId, ...(o.interrupt ? { interrupt: true, ...(o.interruptAt ? { interruptAt: o.interruptAt } : {}), ...(o.interruptRun !== undefined ? { expectedRunTaskId: o.interruptRun } : {}) } : {}), content: JSON.stringify(payload), whenBusy: o.kind === 'task' ? 'followUp' : 'steer', kind: o.kind, ...(sender ? { sender } : {}) };
 }
 /** The input a delivery submits. The request ID names the Obligation, so a retry reacquires the same admission. */
-export function deliveryDraft(input, interruption) {
-    const data = { source: 'team', deliveryId: input.key, epoch: input.epoch, ...(input.kind ? { delivery: input.kind } : {}), ...(input.sender ? { sender: input.sender } : {}), ...(input.interrupt && input.kind === 'alert' ? { interrupt: true } : {}) };
-    const content = interruption ? JSON.stringify({ ...JSON.parse(input.content), interruption: { outcome: interruption, message: interruption === 'interrupted' ? 'The captured run was interrupted.' : interruption === 'ended' ? 'The captured run already ended or changed.' : 'Interruption was not proved; this Alert uses normal delivery.' } }) : input.content;
+export function deliveryDraft(input, interruption, interruptedRun) {
+    const data = { source: 'team', deliveryId: input.key, epoch: input.epoch, ...(input.kind ? { delivery: input.kind } : {}), ...(input.sender ? { sender: input.sender } : {}), ...(input.interrupt && input.kind === 'alert' ? { interrupt: true } : {}), ...(interruptedRun !== undefined ? { interruptedRun } : {}) };
+    const content = interruption ? JSON.stringify({ ...JSON.parse(input.content), interruption: { outcome: interruption, message: interruption === 'interrupted' ? (input.interruptAt === 'delivery' ? 'A run in progress was interrupted to deliver this Alert. Its last input may be unanswered; read it before continuing.' : 'The captured run was interrupted.') : interruption === 'ended' ? (input.interruptAt === 'delivery' ? 'The run selected for this Alert already ended or changed.' : 'The captured run already ended or changed.') : 'Interruption was not proved; this Alert uses normal delivery.' } }) : input.content;
     return { type: 'input', content, whenBusy: input.whenBusy, requestId: `ptb:${input.key}`, entry: { kind: 'team.notice', data } };
 }
 const draft = deliveryDraft;
+export const INTERRUPT_SETTLE_TIMEOUT_MS = 10_000;
 export const Deliver = defineTask({
-    name: 'ptb.deliver', version: 1, initial: input => ({ phase: input.interrupt ? 'interrupt' : 'submit' }),
+    name: 'ptb.deliver', version: 2, initial: input => ({ phase: input.interrupt ? 'interrupt' : 'submit' }),
+    migrate: (input, checkpoint, fromVersion) => {
+        if (fromVersion !== 1)
+            throw new Error('PTB delivery migration supports only version 1');
+        return { input: input, checkpoint: checkpoint };
+    },
     phases: {
         interrupt: async () => { throw new Error('The host must supply the run-only interrupt port'); },
         submit: async (task, runtime, context) => {
-            let valid = false, interruption;
+            let valid = false, interruption, interruptedRun;
             await runtime.commit(async (tx) => {
-                const s = await open(tx), o = s.outbox.obligations[task.input.key];
-                valid = !!o && eligible(s, o);
+                const s = await open(tx), o = await obligation(s, task.input.key);
+                valid = !!o && await eligible(s, o);
                 interruption = o?.interruption;
+                interruptedRun = o?.interruptedRun;
                 if (!valid) {
                     if (o)
-                        o.state = 'retired';
+                        await setObligationState(s, o, 'retired');
+                    flushAuthority(s);
                     return { status: 'terminal', outcome: { status: 'completed', result: null } };
                 }
                 return undefined;
@@ -63,9 +69,9 @@ export const Deliver = defineTask({
             const target = await runtime.conversation(task.input.conversationId, context);
             if (!target)
                 throw new Error('PTB delivery recipient is missing');
-            const submission = await target.submit(draft(task.input, interruption), context);
+            const submission = await target.submit(draft(task.input, interruption, interruptedRun), context);
             await runtime.commit(async (tx) => {
-                const s = await open(tx), o = s.outbox.obligations[task.input.key];
+                const s = await open(tx), o = await obligation(s, task.input.key);
                 if (!o)
                     throw new Error('PTB delivery obligation is missing');
                 o.submissionId = submission.id;
@@ -79,23 +85,23 @@ export const Deliver = defineTask({
             if (!target)
                 throw new Error('PTB admitted recipient is missing');
             // Same request ID reacquires the durable admission after a process interruption.
-            let interruption;
-            await runtime.commit(async (tx) => { interruption = (await open(tx)).outbox.obligations[task.input.key]?.interruption; return undefined; }, context);
-            const submission = await target.submit(draft(task.input, interruption), context);
+            let interruption, interruptedRun;
+            await runtime.commit(async (tx) => { const o = await obligation(await open(tx), task.input.key); interruption = o?.interruption; interruptedRun = o?.interruptedRun; return undefined; }, context);
+            const submission = await target.submit(draft(task.input, interruption, interruptedRun), context);
             if (submission.id !== task.state.checkpoint.submissionId)
                 throw new Error('PTB admission identity changed');
             let obsolete = false;
-            await runtime.commit(async (tx) => { const s = await open(tx), o = s.outbox.obligations[task.input.key]; obsolete = !o || !eligible(s, o); return undefined; }, context);
+            await runtime.commit(async (tx) => { const s = await open(tx), o = await obligation(s, task.input.key); obsolete = !o || !await eligible(s, o); return undefined; }, context);
             if (obsolete)
                 await submission.abort(context);
             const settled = await submission.wait(context);
             await runtime.commit(async (tx) => {
-                const s = await open(tx), o = s.outbox.obligations[task.input.key];
+                const s = await open(tx), o = await obligation(s, task.input.key);
                 if (o) {
                     o.settledAt = runtime.now();
                     o.outcome = settled.status === 'done' ? 'answered' : `unanswered:${settled.reason}`;
                     if (o.state === 'pending')
-                        o.state = 'settled';
+                        await setObligationState(s, o, 'settled');
                 }
                 if (s.team.current?.epoch === task.input.epoch)
                     await event(tx, s, 'authority', 'delivery_settled', { at: new Date(runtime.now()).toISOString() });
@@ -104,10 +110,10 @@ export const Deliver = defineTask({
         },
     },
     abort: async (task, runtime, context) => {
-        await runtime.commit(async (tx) => { const o = (await open(tx)).outbox.obligations[task.input.key]; if (o) {
-            o.state = 'retired';
+        await runtime.commit(async (tx) => { const s = await open(tx), o = await obligation(s, task.input.key); if (o) {
+            await setObligationState(s, o, 'retired');
             o.outcome = 'stopped';
-        } return { status: 'terminal', outcome: { status: 'aborted' } }; }, context);
+        } flushAuthority(s); return { status: 'terminal', outcome: { status: 'aborted' } }; }, context);
     },
 });
 /** Keep the shared submit/settle mechanics; only the host-owned interruption needs a port. */
@@ -117,24 +123,60 @@ export function createDeliver(abortRun) {
             submit: (task, runtime, context) => Deliver.definition.phases.submit(task, runtime, context),
             interrupt: async (task, runtime, context) => {
                 const bound = withAbortSignal(runtime.signal, context);
+                const selection = task.state.checkpoint.selection;
+                if (!selection)
+                    return runtime.commit(async (tx) => {
+                        const s = await open(tx), o = await obligation(s, task.input.key);
+                        if (!o || !await eligible(s, o)) {
+                            if (o)
+                                await setObligationState(s, o, 'retired');
+                            flushAuthority(s);
+                            return { status: 'terminal', outcome: { status: 'completed', result: null } };
+                        }
+                        // Absence of the marker is a recorded P choice, including an idle recipient. Never reinterpret it.
+                        const run = task.input.interruptAt === 'delivery' ? (await tx.doc(LiveDoc, task.input.conversationId)).run?.taskId : task.input.expectedRunTaskId;
+                        if (task.input.interruptAt === 'delivery') {
+                            if (run === undefined)
+                                delete o.interruptRun;
+                            else
+                                o.interruptRun = run;
+                        }
+                        return { status: 'running', checkpoint: { phase: 'interrupt', selection: { ...(run !== undefined ? { run } : {}), deadline: runtime.now() + INTERRUPT_SETTLE_TIMEOUT_MS } } };
+                    }, bound);
                 let outcome;
-                try {
-                    outcome = await abortRun(runtime, task.input, bound);
-                }
-                catch (error) {
-                    if (runtime.signal.aborted)
-                        throw error;
-                    runtime.report(error);
-                    outcome = 'failed';
+                const remaining = selection.deadline - runtime.now();
+                if (remaining <= 0)
+                    outcome = selection.run === undefined ? 'ended' : 'failed';
+                else {
+                    const wait = withCancel(bound), stop = runtime.setTimer(() => wait.cancel(new Error('Interrupt settlement deadline reached')), remaining);
+                    try {
+                        outcome = await awaitWithContext(abortRun(runtime, { ...task.input, expectedRunTaskId: selection.run }, wait.context), wait.context);
+                    }
+                    catch (error) {
+                        if (runtime.signal.aborted)
+                            throw error;
+                        runtime.report(error);
+                        outcome = 'failed';
+                    }
+                    finally {
+                        stop();
+                        wait.cancel();
+                    }
                 }
                 await runtime.commit(async (tx) => {
-                    const s = await open(tx), o = s.outbox.obligations[task.input.key];
-                    if (!o || !eligible(s, o) || outcome === 'retired') {
+                    const s = await open(tx), o = await obligation(s, task.input.key);
+                    if (!o || !await eligible(s, o) || outcome === 'retired') {
                         if (o)
-                            o.state = 'retired';
+                            await setObligationState(s, o, 'retired');
+                        flushAuthority(s);
                         return { status: 'terminal', outcome: { status: 'completed', result: null } };
                     }
-                    o.interruption = outcome;
+                    if (task.input.interruptAt === 'delivery' && selection.run === undefined && outcome === 'ended')
+                        delete o.interruption;
+                    else
+                        o.interruption = outcome;
+                    if (task.input.interruptAt === 'delivery' && selection.run !== undefined && outcome === 'interrupted')
+                        o.interruptedRun = selection.run;
                     return { status: 'running', checkpoint: { phase: 'submit' } };
                 }, bound);
             },
@@ -144,9 +186,15 @@ export async function scheduleDeliveries(tx, s, delivery) {
     const team = s.team.current;
     if (!team || team.lifecycle !== 'active')
         return;
-    for (const o of Object.values(s.outbox.obligations)) {
-        if (o.deliveryTaskId || !eligible(s, o))
+    for (const o of await unscheduledObligations(s)) {
+        const key = o.key;
+        if (o.deliveryTaskId) {
+            await markScheduled(s, key);
+            continue;
+        }
+        if (!await eligible(s, o))
             continue;
-        o.deliveryTaskId = await tx.createTask(delivery, deliveryInput(s, o), { conversationId: team.lead, ownership: { kind: 'conversation' }, background: true, abandonOnRestart: false });
+        o.deliveryTaskId = await tx.createTask(delivery, await deliveryInput(s, o), { conversationId: team.lead, ownership: { kind: 'conversation' }, background: true, abandonOnRestart: false });
+        await markScheduled(s, key);
     }
 }

package/dist/authority/graph-control.d.ts

@@ -220,7 +220,7 @@ export type GraphControlResult = GraphApplyResult | GraphTransitionResult;
 export type GraphControlReceipt = GraphControlResult & {
     replayed: boolean;
 };
-interface StoredReceipt {
+export interface StoredReceipt {
     operationId: string;
     fingerprint: string;
     result: GraphControlResult;