@hypercarrier/pi-team-durable 0.1.0-rc.2 → 0.1.0-rc.3

package/README.md

@@ -26,7 +26,9 @@ notices.
   migration is one-way: rollback means restoring a backup. Back up the store, and
   stop every older node process first. 0.1.0-rc.1 stores version-1 documents.
   This version migrates them to version 2, and a downgrade cannot read a migrated
-  store.
+  store. 0.1.0-rc.3 also upgrades stored `ptb.deliver` tasks to task version 2.
+  Older versions then park those deliveries as `task_too_old`. This upgrade is
+  one-way too.
 
 Known issues:
 
@@ -34,8 +36,11 @@ Known issues:
    Team Bright retries it; this package does not.
 2. `team_sync` can replay pages that an earlier call released. Act only on
    `task_read`, and never call `team_sync` from a nested tool call.
-3. Interrupt: a Worker can interrupt the lead, the run to stop is chosen when the
-   Alert is accepted, and the abort has no settle bound.
+3. Interrupt fallback can leave an Alert queued. When a provider ignores the abort
+   for the full 10-second wait, the Alert is admitted while the run is busy. When
+   that run then ends by abort, the Alert waits until the next input starts a run.
+   An ordinary Alert queued before a run-only abort behaves the same. The cause is
+   pi-durable 1.4.0: an aborted run does not drain its inbox.
 4. An Alert can be admitted after its recipient is closed or fenced. After an owner
    Close, a busy Worker can still run one tool call.
 
@@ -70,7 +75,9 @@ observer, and structural stop ports. A host adapter registers this runtime.
   hash partitions index pending and unscheduled keys.
 - Nine lead tools and three Worker tools use the rc.7 contract. Exact conversation
   and generation bindings guard authority. A fork does not acquire an existing
-  Team's lead authority.
+  Team's lead authority. Each role acts only on its schema's declared fields,
+  including nested fields. Undeclared fields do not enter replay identity.
+  Only the lead can request an Alert interrupt.
 - `ptb.worker-anchor` owns a Worker conversation and renews a durable sleep.
   Lead Esc does not end it. Stops use stored target IDs through the node's single
   mark-before-resume fence. Failed confirmation retains the intent.
@@ -78,13 +85,26 @@ observer, and structural stop ports. A host adapter registers this runtime.
   admission, and waits for settlement. Notices use `team.notice` entries whose
   data (`TeamNoticeData`) names the delivery kind and its sender: an Alert's
   author, or `team-lead` for Tasks and stops. An interrupt Alert's data also
-  has `interrupt: true`. A reader names a notice from this data, never from its
-  text.
-  Interrupt Alerts persist the recipient run ID at acceptance. A separate phase
-  asks the host `abortRun` port to stop that exact run, then checkpoints before
-  normal admission. Queue identities stay native; no input is re-queued.
-  A failed interruption appears as unproved in the notice. Retry never selects
-  a replacement run. The node supplies a cancellable wait outside its admission lock.
+  has `interrupt: true`. A confirmed interruption adds `interruptedRun` to the
+  obligation and entry data. This field identifies the aborted native run.
+  A reader names a notice from this data, never from its text.
+  New interrupt obligations and delivery inputs carry `interruptAt: 'delivery'`.
+  The interrupt phase selects `LiveDoc.run` and commits its run ID and absolute
+  settlement deadline before asking the host `abortRun` port to stop that run.
+  The settlement wait has a 10-second budget. Retry keeps the selection and deadline.
+  An idle recipient gets a plain steer. An unproved interruption gets normal
+  admission with an unproved outcome. A newer run gets no second abort.
+  Unmarked inputs keep their acceptance-time choice and model-facing wording;
+  an absent run ID remains an idle-at-send choice.
+  Task version 2 migrates version-1 inputs and checkpoints without changing them.
+  After the first open and resume, older nodes park these deliveries with
+  `task_too_old`. Restore a backup to roll back.
+  Queue identities and inbox order stay native. No input is re-queued.
+  The node supplies a cancellable wait outside its admission lock.
+  Native run-only abort does not drain an input admitted before abort settlement.
+  That input can stay queued until another admission starts the next run. Two
+  bounded expected-failure cases in `test/authority/interrupt-parity.test.ts`
+  record it.
 - `ptb.notify` reserves an automatic page before admission. A failed lead input
   pauses notification. Explicit sync or a new owner input resumes it.
 - `team_sync` reserves successive bounded pages. It never waits for consumption.
@@ -154,8 +174,8 @@ installed devDependency `@hypercarrier/pi-team-bright@0.25.1`.
 Each role's tool labels and descriptions come from Pi Team Bright's own
 registration. `scripts/pi-registration.mjs` captures it per role through an
 inert host. The parity test compares every durable tool with the installed
-`@hypercarrier/pi-team-bright`. Known gap: Pi's Worker `alert_send` requires
-non-empty `text` and `task_id`; the durable schema does not yet.
+`@hypercarrier/pi-team-bright`. Pi registers the Worker tools outside its
+catalog, so their parameter schemas also come from that registration.
 
 ```sh
 npm ci

package/dist/authority/delivery.d.ts

@@ -1,10 +1,11 @@
 import type { AbortRun, InterruptTarget } from './interrupt.ts';
-import { type SubmissionId, type Tx } from '@earendil-works/pi-durable';
+import { type TaskId, type SubmissionId, type Tx } from '@earendil-works/pi-durable';
 import { type Obligation } from './state.ts';
 import { type Authority as State } from './store.ts';
 /** `kind` and `sender` name the delivery in its queue entry; inputs persisted before they existed lack them. */
 export interface DeliveryInput extends InterruptTarget {
     interrupt?: true;
+    interruptAt?: 'delivery';
     epoch: string;
     content: string;
     whenBusy: 'steer' | 'followUp';
@@ -14,7 +15,8 @@ export interface DeliveryInput extends InterruptTarget {
 /**
  * The structured data of a Team input's `team.notice` entry. A reader names the input from these fields, never from
  * its text: `delivery` is the kind (`update` for a notifier page), `sender` the author, at most SENDER_LIMIT characters.
- * `interrupt` marks an Alert sent to interrupt the recipient's run; the interruption outcome stays in the model-facing content.
+ * `interrupt` marks an Alert sent to interrupt the recipient's run. `interruptedRun` identifies a confirmed aborted run.
+ * The interruption outcome stays in the model-facing content.
  * Entries written before `delivery` existed carry only `source` and `deliveryId` or `pageId`.
  */
 export type TeamNoticeData = {
@@ -25,12 +27,13 @@ export type TeamNoticeData = {
     delivery?: Obligation['kind'] | 'update';
     sender?: string;
     interrupt?: true;
+    interruptedRun?: TaskId;
 };
 export declare const SENDER_LIMIT = 64;
 export declare function eligible(s: State, o: Obligation): Promise<boolean>;
 export declare function deliveryInput(s: State, o: Obligation): Promise<DeliveryInput>;
 /** The input a delivery submits. The request ID names the Obligation, so a retry reacquires the same admission. */
-export declare function deliveryDraft(input: DeliveryInput, interruption?: Obligation['interruption']): {
+export declare function deliveryDraft(input: DeliveryInput, interruption?: Obligation['interruption'], interruptedRun?: TaskId): {
     type: "input";
     content: string;
     whenBusy: "steer" | "followUp";
@@ -40,21 +43,22 @@ export declare function deliveryDraft(input: DeliveryInput, interruption?: Oblig
         data: TeamNoticeData;
     };
 };
-export declare const Deliver: import("@earendil-works/pi-durable").Task<DeliveryInput, {
-    phase: "interrupt";
-} | {
-    phase: "submit";
+export declare const INTERRUPT_SETTLE_TIMEOUT_MS = 10000;
+type InterruptCheckpoint = {
+    phase: 'interrupt';
+    selection?: {
+        run?: TaskId;
+        deadline: number;
+    };
+};
+type DeliveryCheckpoint = InterruptCheckpoint | {
+    phase: 'submit';
 } | {
-    phase: "settle";
+    phase: 'settle';
     submissionId: SubmissionId;
-}, null, object>;
+};
+export declare const Deliver: import("@earendil-works/pi-durable").Task<DeliveryInput, DeliveryCheckpoint, null, object>;
 /** Keep the shared submit/settle mechanics; only the host-owned interruption needs a port. */
-export declare function createDeliver(abortRun: AbortRun): import("@earendil-works/pi-durable").Task<DeliveryInput, {
-    phase: "interrupt";
-} | {
-    phase: "submit";
-} | {
-    phase: "settle";
-    submissionId: SubmissionId;
-}, null, object>;
+export declare function createDeliver(abortRun: AbortRun): import("@earendil-works/pi-durable").Task<DeliveryInput, DeliveryCheckpoint, null, object>;
 export declare function scheduleDeliveries(tx: Tx, s: State, delivery: typeof Deliver): Promise<void>;
+export {};

package/dist/authority/delivery.js

@@ -1,5 +1,5 @@
-import { withAbortSignal } from '@earendil-works/chord/context';
-import { defineTask } from '@earendil-works/pi-durable';
+import { withAbortSignal, withCancel, awaitWithContext } from '@earendil-works/chord/context';
+import { defineTask, LiveDoc } from '@earendil-works/pi-durable';
 import { plain, event } from "./state.js";
 import { openAuthority as open, flushAuthority, markScheduled, unscheduledObligations, taskRecord, alertRecord, obligation, setObligationState } from "./store.js";
 export const SENDER_LIMIT = 64;
@@ -30,25 +30,32 @@ export async function deliveryInput(s, o) {
     }
     // An Alert names its author; durable-team sends Tasks and stops on the Team authority's behalf, as team-lead.
     const sender = (o.kind === 'alert' ? (await alertRecord(s, o.alertId))?.from : 'team-lead')?.slice(0, SENDER_LIMIT);
-    return { key: o.key, epoch: o.epoch, conversationId: o.conversationId, ...(o.interrupt ? { interrupt: true, ...(o.interruptRun !== undefined ? { expectedRunTaskId: o.interruptRun } : {}) } : {}), content: JSON.stringify(payload), whenBusy: o.kind === 'task' ? 'followUp' : 'steer', kind: o.kind, ...(sender ? { sender } : {}) };
+    return { key: o.key, epoch: o.epoch, conversationId: o.conversationId, ...(o.interrupt ? { interrupt: true, ...(o.interruptAt ? { interruptAt: o.interruptAt } : {}), ...(o.interruptRun !== undefined ? { expectedRunTaskId: o.interruptRun } : {}) } : {}), content: JSON.stringify(payload), whenBusy: o.kind === 'task' ? 'followUp' : 'steer', kind: o.kind, ...(sender ? { sender } : {}) };
 }
 /** The input a delivery submits. The request ID names the Obligation, so a retry reacquires the same admission. */
-export function deliveryDraft(input, interruption) {
-    const data = { source: 'team', deliveryId: input.key, epoch: input.epoch, ...(input.kind ? { delivery: input.kind } : {}), ...(input.sender ? { sender: input.sender } : {}), ...(input.interrupt && input.kind === 'alert' ? { interrupt: true } : {}) };
-    const content = interruption ? JSON.stringify({ ...JSON.parse(input.content), interruption: { outcome: interruption, message: interruption === 'interrupted' ? 'The captured run was interrupted.' : interruption === 'ended' ? 'The captured run already ended or changed.' : 'Interruption was not proved; this Alert uses normal delivery.' } }) : input.content;
+export function deliveryDraft(input, interruption, interruptedRun) {
+    const data = { source: 'team', deliveryId: input.key, epoch: input.epoch, ...(input.kind ? { delivery: input.kind } : {}), ...(input.sender ? { sender: input.sender } : {}), ...(input.interrupt && input.kind === 'alert' ? { interrupt: true } : {}), ...(interruptedRun !== undefined ? { interruptedRun } : {}) };
+    const content = interruption ? JSON.stringify({ ...JSON.parse(input.content), interruption: { outcome: interruption, message: interruption === 'interrupted' ? (input.interruptAt === 'delivery' ? 'A run in progress was interrupted to deliver this Alert. Its last input may be unanswered; read it before continuing.' : 'The captured run was interrupted.') : interruption === 'ended' ? (input.interruptAt === 'delivery' ? 'The run selected for this Alert already ended or changed.' : 'The captured run already ended or changed.') : 'Interruption was not proved; this Alert uses normal delivery.' } }) : input.content;
     return { type: 'input', content, whenBusy: input.whenBusy, requestId: `ptb:${input.key}`, entry: { kind: 'team.notice', data } };
 }
 const draft = deliveryDraft;
+export const INTERRUPT_SETTLE_TIMEOUT_MS = 10_000;
 export const Deliver = defineTask({
-    name: 'ptb.deliver', version: 1, initial: input => ({ phase: input.interrupt ? 'interrupt' : 'submit' }),
+    name: 'ptb.deliver', version: 2, initial: input => ({ phase: input.interrupt ? 'interrupt' : 'submit' }),
+    migrate: (input, checkpoint, fromVersion) => {
+        if (fromVersion !== 1)
+            throw new Error('PTB delivery migration supports only version 1');
+        return { input: input, checkpoint: checkpoint };
+    },
     phases: {
         interrupt: async () => { throw new Error('The host must supply the run-only interrupt port'); },
         submit: async (task, runtime, context) => {
-            let valid = false, interruption;
+            let valid = false, interruption, interruptedRun;
             await runtime.commit(async (tx) => {
                 const s = await open(tx), o = await obligation(s, task.input.key);
                 valid = !!o && await eligible(s, o);
                 interruption = o?.interruption;
+                interruptedRun = o?.interruptedRun;
                 if (!valid) {
                     if (o)
                         await setObligationState(s, o, 'retired');
@@ -62,7 +69,7 @@ export const Deliver = defineTask({
             const target = await runtime.conversation(task.input.conversationId, context);
             if (!target)
                 throw new Error('PTB delivery recipient is missing');
-            const submission = await target.submit(draft(task.input, interruption), context);
+            const submission = await target.submit(draft(task.input, interruption, interruptedRun), context);
             await runtime.commit(async (tx) => {
                 const s = await open(tx), o = await obligation(s, task.input.key);
                 if (!o)
@@ -78,9 +85,9 @@ export const Deliver = defineTask({
             if (!target)
                 throw new Error('PTB admitted recipient is missing');
             // Same request ID reacquires the durable admission after a process interruption.
-            let interruption;
-            await runtime.commit(async (tx) => { interruption = (await obligation(await open(tx), task.input.key))?.interruption; return undefined; }, context);
-            const submission = await target.submit(draft(task.input, interruption), context);
+            let interruption, interruptedRun;
+            await runtime.commit(async (tx) => { const o = await obligation(await open(tx), task.input.key); interruption = o?.interruption; interruptedRun = o?.interruptedRun; return undefined; }, context);
+            const submission = await target.submit(draft(task.input, interruption, interruptedRun), context);
             if (submission.id !== task.state.checkpoint.submissionId)
                 throw new Error('PTB admission identity changed');
             let obsolete = false;
@@ -116,15 +123,45 @@ export function createDeliver(abortRun) {
             submit: (task, runtime, context) => Deliver.definition.phases.submit(task, runtime, context),
             interrupt: async (task, runtime, context) => {
                 const bound = withAbortSignal(runtime.signal, context);
+                const selection = task.state.checkpoint.selection;
+                if (!selection)
+                    return runtime.commit(async (tx) => {
+                        const s = await open(tx), o = await obligation(s, task.input.key);
+                        if (!o || !await eligible(s, o)) {
+                            if (o)
+                                await setObligationState(s, o, 'retired');
+                            flushAuthority(s);
+                            return { status: 'terminal', outcome: { status: 'completed', result: null } };
+                        }
+                        // Absence of the marker is a recorded P choice, including an idle recipient. Never reinterpret it.
+                        const run = task.input.interruptAt === 'delivery' ? (await tx.doc(LiveDoc, task.input.conversationId)).run?.taskId : task.input.expectedRunTaskId;
+                        if (task.input.interruptAt === 'delivery') {
+                            if (run === undefined)
+                                delete o.interruptRun;
+                            else
+                                o.interruptRun = run;
+                        }
+                        return { status: 'running', checkpoint: { phase: 'interrupt', selection: { ...(run !== undefined ? { run } : {}), deadline: runtime.now() + INTERRUPT_SETTLE_TIMEOUT_MS } } };
+                    }, bound);
                 let outcome;
-                try {
-                    outcome = await abortRun(runtime, task.input, bound);
-                }
-                catch (error) {
-                    if (runtime.signal.aborted)
-                        throw error;
-                    runtime.report(error);
-                    outcome = 'failed';
+                const remaining = selection.deadline - runtime.now();
+                if (remaining <= 0)
+                    outcome = selection.run === undefined ? 'ended' : 'failed';
+                else {
+                    const wait = withCancel(bound), stop = runtime.setTimer(() => wait.cancel(new Error('Interrupt settlement deadline reached')), remaining);
+                    try {
+                        outcome = await awaitWithContext(abortRun(runtime, { ...task.input, expectedRunTaskId: selection.run }, wait.context), wait.context);
+                    }
+                    catch (error) {
+                        if (runtime.signal.aborted)
+                            throw error;
+                        runtime.report(error);
+                        outcome = 'failed';
+                    }
+                    finally {
+                        stop();
+                        wait.cancel();
+                    }
                 }
                 await runtime.commit(async (tx) => {
                     const s = await open(tx), o = await obligation(s, task.input.key);
@@ -134,7 +171,12 @@ export function createDeliver(abortRun) {
                         flushAuthority(s);
                         return { status: 'terminal', outcome: { status: 'completed', result: null } };
                     }
-                    o.interruption = outcome;
+                    if (task.input.interruptAt === 'delivery' && selection.run === undefined && outcome === 'ended')
+                        delete o.interruption;
+                    else
+                        o.interruption = outcome;
+                    if (task.input.interruptAt === 'delivery' && selection.run !== undefined && outcome === 'interrupted')
+                        o.interruptedRun = selection.run;
                     return { status: 'running', checkpoint: { phase: 'submit' } };
                 }, bound);
             },

package/dist/authority/interrupt.js

@@ -16,11 +16,12 @@ export async function abortExpectedRun(harness, target, context) {
             return task.state.outcome.status === 'aborted' ? 'interrupted' : 'ended';
         if (live.run?.taskId !== target.expectedRunTaskId)
             return 'ended';
-        return 'abort';
+        return task.abortRequested ? 'wait' : 'abort';
     }, context);
-    if (check !== 'abort')
+    if (check !== 'abort' && check !== 'wait')
         return check;
-    await harness.abortTask(target.expectedRunTaskId, context);
+    if (check === 'abort')
+        await harness.abortTask(target.expectedRunTaskId, context);
     const task = await harness.waitForTask(target.expectedRunTaskId, context);
     return task.state.outcome.status === 'aborted' ? 'interrupted' : 'failed';
 }

package/dist/authority/rc7-contract.json

@@ -402,10 +402,12 @@
           ]
         },
         "text": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "task_id": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "task_version": {
           "type": "string",

package/dist/authority/runtime.d.ts

@@ -81,6 +81,10 @@ export declare function createTeamRuntime(options: RuntimeOptions): {
         }, null, object>;
         Deliver: import("@earendil-works/pi-durable").Task<import("./delivery.ts").DeliveryInput, {
             phase: "interrupt";
+            selection?: {
+                run?: import("@earendil-works/pi-durable").TaskId;
+                deadline: number;
+            };
         } | {
             phase: "submit";
         } | {

package/dist/authority/state.d.ts

@@ -74,7 +74,9 @@ export interface Alert {
 }
 export interface Obligation {
     interrupt?: true;
+    interruptAt?: 'delivery';
     interruptRun?: TaskId;
+    interruptedRun?: TaskId;
     interruption?: 'interrupted' | 'ended' | 'failed';
     acceptedAt?: number;
     submittedAt?: number;

package/dist/authority/tools.d.ts

@@ -1,3 +1,4 @@
+import type { TSchema } from 'typebox';
 import type { Context } from '@earendil-works/chord/context';
 import { type ToolExecutionApi, type Tx } from '@earendil-works/pi-durable';
 import { type Role, type ToolName } from './contracts.ts';
@@ -57,6 +58,12 @@ interface Args {
     task_version?: string;
     interrupt?: boolean;
 }
+interface ParameterSchema extends TSchema {
+    properties?: Record<string, ParameterSchema>;
+    items?: ParameterSchema;
+}
+/** The input a role tool acts on. Pi's role adapters forward declared fields, including nested Task definitions. */
+export declare function declaredParameters(schema: ParameterSchema, value: unknown): unknown;
 /** The catalog resolver that options select: the host's per-lead port, else the static list. */
 export declare function catalogOf(options: Pick<CoreOptions, 'modelRoles' | 'defaultModelRole' | 'catalog'>): (tx: Tx, lead: ConversationId) => Promise<ModelRoleCatalog>;
 /** Authority commands commit intent and replay receipts; injected ports own effects. */
@@ -65,12 +72,12 @@ export declare function createAuthorityTools(options: CoreOptions): {
         label: string;
         name: string;
         description: string;
-        parameters: import("typebox").TSchema;
+        parameters: TSchema;
         constrainedSampling?: false | import("@earendil-works/pi-ai").ConstrainedSamplingConfig;
         replay?: "safe" | "unsafe";
         executionMode?: import("@earendil-works/pi-durable").ToolExecutionMode;
         prepareArguments?(args: unknown): unknown;
-        structuredOutputSchema?: import("typebox").TSchema;
+        structuredOutputSchema?: TSchema;
         callers?: readonly ("model" | "tools")[];
         deferred?: true;
         outputLimits?: {
@@ -84,12 +91,12 @@ export declare function createAuthorityTools(options: CoreOptions): {
         label: string;
         name: string;
         description: string;
-        parameters: import("typebox").TSchema;
+        parameters: TSchema;
         constrainedSampling?: false | import("@earendil-works/pi-ai").ConstrainedSamplingConfig;
         replay?: "safe" | "unsafe";
         executionMode?: import("@earendil-works/pi-durable").ToolExecutionMode;
         prepareArguments?(args: unknown): unknown;
-        structuredOutputSchema?: import("typebox").TSchema;
+        structuredOutputSchema?: TSchema;
         callers?: readonly ("model" | "tools")[];
         deferred?: true;
         outputLimits?: {

package/dist/authority/tools.js

@@ -1,4 +1,4 @@
-import { defineTool, LiveDoc } from '@earendil-works/pi-durable';
+import { defineTool } from '@earendil-works/pi-durable';
 import { contracts, checkSchema, checkResult, TOOL_NAMES } from "./contracts.js";
 import { GraphControlRefusal } from "./graph-control.js";
 import { projectGraphTaskCards } from "./graph-card.js";
@@ -6,6 +6,15 @@ import { snapshotResult } from "./projection.js";
 import { plain, event } from "./state.js";
 import { openAuthority as open, startEpoch, taskCards, unfinished, graphCommand, hasOperation, addAlert, addObligation, callReceipt, saveCall, allObligations, setObligationState } from "./store.js";
 const LEAD = 'team-lead';
+/** The input a role tool acts on. Pi's role adapters forward declared fields, including nested Task definitions. */
+export function declaredParameters(schema, value) {
+    const { items, properties } = schema;
+    if (Array.isArray(value) && items)
+        return value.map(item => declaredParameters(items, item));
+    if (value !== null && typeof value === 'object' && !Array.isArray(value) && properties)
+        return Object.fromEntries(Object.entries(value).filter(([key]) => Object.hasOwn(properties, key)).map(([key, item]) => [key, declaredParameters(properties[key], item)]));
+    return value;
+}
 class Declined extends Error {
     result;
     constructor(result) { super(String(result.message ?? result.reason)); this.result = result; }
@@ -136,18 +145,17 @@ export function createAuthorityTools(options) {
             return { kind: 'updated', operation_id: r.operationId, replayed: r.replayed, transition: r.transition, task: { id: r.task.id, status: r.task.state.kind, assignee: r.task.assignee, version: r.task.version }, ready_task_ids: r.readyTaskIds, ...(r.failureTraversal ? { failure_traversal: { source_task_id: r.failureTraversal.sourceTaskId, target_task_id: r.failureTraversal.targetTaskId, traversal: r.failureTraversal.traversal } } : {}) };
         }
         if (name === 'alert_send') {
-            const to = role === 'worker' ? LEAD : a.to;
+            const to = role === 'worker' ? LEAD : a.to, interrupt = role === 'lead' && a.interrupt === true;
             if (!a.text?.trim() || a.task_version && !a.task_id || (to === '*') !== (a.kind === 'announcement'))
                 return decline({ kind: 'refused', reason: 'invalid_fanout', message: 'Invalid Alert text, Task reference or announcement target.' });
             const recipients = to === LEAD ? [{ name: LEAD, conversationId: team.lead, generation: 0 }] : Object.values(team.workers).filter(w => w.state === 'active' && (to === '*' || w.name === to)).map(w => ({ name: w.name, conversationId: w.conversationId, generation: w.generation }));
             if (!recipients.length)
                 return decline({ kind: 'refused', reason: to === '*' ? 'no_eligible_recipients' : 'recipient_not_current', message: 'No current recipient.' });
             const id = `${team.epoch}:alert:${api.taskId}`;
-            await addAlert(s, plain({ id, from: actor, kind: a.kind, text: a.text.trim(), ...(a.interrupt ? { interrupt: true } : {}), task_id: a.task_id, task_version: a.task_version, receivedAt: new Date(api.now()).toISOString(), recipients }));
+            await addAlert(s, plain({ id, from: actor, kind: a.kind, text: a.text.trim(), ...(interrupt ? { interrupt: true } : {}), task_id: a.task_id, task_version: a.task_version, receivedAt: new Date(api.now()).toISOString(), recipients }));
             for (const recipient of recipients) {
                 const key = `${id}:${recipient.name}:g${recipient.generation}`;
-                const run = a.interrupt ? (await tx.doc(LiveDoc, recipient.conversationId)).run?.taskId : undefined;
-                await addObligation(s, { key, epoch: team.epoch, kind: 'alert', recipient: recipient.name, conversationId: recipient.conversationId, generation: recipient.generation, alertId: id, state: 'pending', acceptedAt: api.now(), ...(a.interrupt ? { interrupt: true, ...(run !== undefined ? { interruptRun: run } : {}) } : {}) });
+                await addObligation(s, { key, epoch: team.epoch, kind: 'alert', recipient: recipient.name, conversationId: recipient.conversationId, generation: recipient.generation, alertId: id, state: 'pending', acceptedAt: api.now(), ...(interrupt ? { interrupt: true, interruptAt: 'delivery' } : {}) });
             }
             await event(tx, s, actor, 'alert_accepted', { at: new Date(api.now()).toISOString() });
             return { kind: 'alert_sent', accepted_recipients: recipients.map(r => r.name), failed_recipients: [], ...(a.task_id ? { task_id: a.task_id } : {}), ...(a.task_version ? { task_version: a.task_version } : {}) };
@@ -190,6 +198,10 @@ export function createAuthorityTools(options) {
     }
     async function execute(name, role, input, api, context) {
         const schema = contract[role][name];
+        // Earlier receipts hashed raw arguments. Their exact input must still replay without executing again.
+        const rawFingerprint = JSON.stringify({ name, role, input, conversation: api.conversationId });
+        if (schema)
+            input = declaredParameters(schema, input);
         if (!schema || !checkSchema(schema, input))
             throw new Error(`Invalid ${role} ${name} parameters`);
         const a = input;
@@ -200,7 +212,7 @@ export function createAuthorityTools(options) {
                 const s = await open(tx), receipt = await callReceipt(s, api.taskId, native), saved = receipt.fingerprint ? receipt : undefined;
                 s.deferFlush = true;
                 if (saved) {
-                    if (saved.fingerprint !== fingerprint)
+                    if (saved.fingerprint !== fingerprint && saved.fingerprint !== rawFingerprint)
                         throw new Error('Durable tool identity reused with changed input');
                     return saved.result ? JSON.parse(saved.result) : plain({ stops: saved.stops, epoch: saved.epoch });
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hypercarrier/pi-team-durable",
-  "version": "0.1.0-rc.2",
+  "version": "0.1.0-rc.3",
   "description": "Pi Team Bright semantics on pi-durable: one Task authority per Team, Workers as durable subthreads, accepted-then-delivered notices.",
   "repository": {
     "type": "git",