@mono-agent/agent-runtime 0.4.0 → 0.4.1

package/src/ai/providers/pi-native.js

@@ -19,28 +19,19 @@
 // The result/event contract is the package's unified runtime-result shape, so
 // callers and the test suite see the same artifact the retired bridge produced.
 
-import {
-  AgentHarness,
-  InMemorySessionRepo,
-  JsonlSessionRepo,
-  calculateContextTokens,
-  estimateTokens,
-  getLastAssistantUsage,
-} from "@earendil-works/pi-agent-core";
-import { NodeExecutionEnv } from "@earendil-works/pi-agent-core/node";
+import { createModels, createProvider, envApiKeyAuth } from "@earendil-works/pi-ai";
+import { builtinModels } from "@earendil-works/pi-ai/providers/all";
+import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { randomUUID } from "node:crypto";
 import { estimateCost } from "../cost.js";
 import { retryableProviderFailureInfo } from "../failure.js";
 import { runtimeCapabilities } from "../runtime/capabilities.js";
-import { createSessionRegistry } from "../runtime/sessions.js";
-import { formatLiveInputGuidance } from "../live-input-prompt.js";
-import { isLikelyContextTermination, resolveAgentCompactionPolicy } from "../../agent/compaction.js";
 import {
-  closePiMcpClients,
-  createStructuredOutputTool,
-  getPiBuiltinTools,
-  initPiMcpTools,
-} from "../../agent/tools/pi-bridge.js";
+  deprecatedSettingsWarning,
+  resolveAgentCompactionPolicy,
+  resolveRuntimePolicyInputs,
+} from "../../agent/compaction.js";
+import { closePiMcpClients } from "../../agent/tools/pi-bridge.js";
 import { createApprovalManager } from "../../agent/approval.js";
 import { buildCapabilitiesUsed, toolCompactionAppliedFromWarnings } from "../runtime/capabilities-used.js";
 import { resolvePiRuntimeModel } from "./pi-models.js";
@@ -48,224 +39,43 @@ import {
   textFromContent,
   thinkingFromContent,
   toAgentMessages,
-  toolResultContent,
 } from "./pi-messages.js";
+import { emitCaptured } from "./pi-events.js";
+import { normalizePiErrorMessage } from "./pi-errors.js";
 import {
-  compactToolRawResult,
-  emitCaptured,
-  eventToolArgs,
-  jsonSerializable,
-  streamContentKey,
-} from "./pi-events.js";
+  runStructuredOutputFinalizationRetry,
+  shouldRetryStructuredOutputFinalization,
+} from "./pi-native/structured-output.js";
 import {
-  isContextLimitError,
-  normalizePiErrorMessage,
-  parseContextLimitFromError,
-} from "./pi-errors.js";
-
-function usageFromMessages(messages = []) {
-  const usage = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cost: 0 };
-  for (const message of messages) {
-    if (message?.role !== "assistant") continue;
-    const next = message.usage || {};
-    usage.input += Number(next.input) || 0;
-    usage.output += Number(next.output) || 0;
-    usage.cacheRead += Number(next.cacheRead) || 0;
-    usage.cacheWrite += Number(next.cacheWrite) || 0;
-    usage.cost += Number(next.cost?.total) || 0;
-  }
-  return usage;
-}
-
-function thinkingLevelForEffort(effort, capabilities) {
-  if (!capabilities?.reasoning || capabilities.reasoning_mode === "none") return "off";
-  if (effort === "none") return "off";
-  if (effort === "max") return "xhigh";
-  if (effort === "xhigh") return "xhigh";
-  if (effort === "high") return "high";
-  if (effort === "medium") return "medium";
-  return "low";
-}
-
-function appendStructuredOutputInstruction(systemPrompt, outputSchema) {
-  if (!outputSchema) return systemPrompt;
-  return [
-    systemPrompt,
-    "",
-    "Structured output is available through the `StructuredOutput` tool.",
-    "When the final result is ready, call `StructuredOutput` with the complete JSON object matching the requested schema.",
-    "Do not also print the same JSON as prose unless tool calling is unavailable.",
-  ].join("\n");
-}
-
-function toolStartProgressText(toolName) {
-  if (typeof toolName !== "string" || toolName.trim().length === 0) return null;
-  return `Running ${toolName}...`;
-}
-
-function structuredOutputFinalizationPrompt() {
-  return [
-    "The previous assistant turn ended without submitting the required structured result.",
-    "Do not run tools, inspect files, or redo work.",
-    "Call only `StructuredOutput` once with the final object matching the requested schema, based on the completed transcript above.",
-    "Do not print prose before or after the tool call.",
-  ].join("\n");
-}
-
-function shouldRetryStructuredOutputFinalization({
-  outputSchema,
-  structuredResult,
-  finalText,
-  stopReason,
-  externalAbort,
-  maxTurnsHit,
-}) {
-  if (!outputSchema) return false;
-  if (structuredResult !== null && structuredResult !== undefined) return false;
-  if (String(finalText || "").trim()) return false;
-  if (externalAbort || maxTurnsHit) return false;
-  return stopReason !== "error" && stopReason !== "aborted";
-}
-
-function structuredOutputRetryDiagnostics(attempts, reason, failed) {
-  if (!attempts) return {};
-  return {
-    structured_output_finalization_retry_attempts: attempts,
-    structured_output_finalization_retry_reason: reason,
-    structured_output_finalization_retry_failed: !!failed,
-  };
-}
-
-function failureKindForPiError(message, diagnostics, { maxTurnsHit = false } = {}) {
-  if (!message) return null;
-  if (maxTurnsHit || isContextLimitError(message) || isLikelyContextTermination(message, diagnostics)) {
-    return "usage_limit";
-  }
-  return "provider_unavailable";
-}
-
-// AUTO-COMPACTION. pi-agent-core performs NO automatic in-loop compaction
-// (shouldCompact/compact are exported helpers its loop never calls), so this
-// bridge drives it: proactively before a turn when the running model's context
-// is near the window, and reactively (compact + single re-prompt) if a turn
-// still overflows. The window auto-tracks the model actually serving the request
-// and self-corrects from any real ceiling stated in an overflow error.
-
-// Per-process cache of real context-window ceilings discovered from overflow
-// errors, keyed by model reference/id. The long-running host re-learns quickly
-// after a restart; this just spares repeated first-overflow round-trips.
-const discoveredContextWindows = new Map();
-
-function modelWindowKey(harness, runtime, resolved) {
-  const live = typeof harness?.getModel === "function" ? harness.getModel() : null;
-  return resolved?.reference || runtime?.model?.id || live?.id || "unknown";
-}
-
-// The window of the model that ACTUALLY serves this request: prefer the harness's
-// live model (authoritative for native pi models), fall back to the resolved
-// runtime model. Returns 0 when unknown so callers can skip the proactive trigger.
-function liveModelContextWindow(harness, runtime) {
-  const live = typeof harness?.getModel === "function" ? harness.getModel() : null;
-  const win = Number(live?.contextWindow) || Number(runtime?.model?.contextWindow) || 0;
-  return win > 0 ? win : 0;
-}
-
-function effectiveContextWindow(harness, runtime, resolved) {
-  const declared = liveModelContextWindow(harness, runtime);
-  const discovered = discoveredContextWindows.get(modelWindowKey(harness, runtime, resolved));
-  if (Number.isFinite(discovered) && discovered > 0) {
-    return declared > 0 ? Math.min(declared, discovered) : discovered;
-  }
-  return declared;
-}
-
-function recordDiscoveredContextWindow(harness, runtime, resolved, limit) {
-  const n = Number(limit);
-  if (!Number.isFinite(n) || n <= 0) return;
-  const key = modelWindowKey(harness, runtime, resolved);
-  const existing = discoveredContextWindows.get(key);
-  discoveredContextWindows.set(key, Number.isFinite(existing) && existing > 0 ? Math.min(existing, n) : n);
-}
-
-// Best-effort estimate of the current session's context size. The last assistant
-// usage is authoritative (it reflects what the provider actually counted,
-// including cache reads), but it can be stale/zero (e.g. seeded history), so we
-// take the MAX of the usage-based count and a raw per-message estimate. Either
-// being large is a reason to compact; overcounting only compacts slightly early.
-async function estimateCurrentContextTokens(session) {
-  let usageTokens = 0;
-  let rawTokens = 0;
-  try {
-    const usage = getLastAssistantUsage(await session.getEntries());
-    if (usage) usageTokens = Number(calculateContextTokens(usage)) || 0;
-  } catch { /* ignore — fall back to the raw estimate */ }
-  try {
-    const context = await session.buildContext();
-    for (const message of context?.messages || []) rawTokens += Number(estimateTokens(message)) || 0;
-  } catch { /* ignore — usage-based estimate stands */ }
-  if (usageTokens === 0 && rawTokens === 0) return { tokens: 0, source: "unavailable" };
-  return usageTokens >= rawTokens
-    ? { tokens: usageTokens, source: "usage" }
-    : { tokens: rawTokens, source: "estimate" };
-}
-
-// Run a single guarded compaction. Requires the harness idle (callers
-// waitForIdle first). Never throws — classifies AgentHarnessError into a warning
-// and reports back whether anything was compacted. Fires onCompactionRecorded on
-// success so a host can persist the compaction row.
-async function tryCompact(harness, { trigger, onEvent, runtimeWarnings, onCompactionRecorded, runId, model }) {
-  try {
-    const result = await harness.compact();
-    const tokensBefore = Number(result?.tokensBefore) || null;
-    onEvent?.({
-      type: "runtime_warning",
-      warning_kind: "context_compaction_applied",
-      source: "pi",
-      trigger,
-      tokens_before: tokensBefore,
-    });
-    if (typeof onCompactionRecorded === "function") {
-      try {
-        onCompactionRecorded({
-          task_run_id: runId || null,
-          trigger,
-          provider_kind: "pi",
-          model: model || null,
-          tokens_before: tokensBefore,
-          summary: result?.summary || "",
-          first_kept_entry_id: result?.firstKeptEntryId || null,
-          status: "succeeded",
-          created_at: Date.now(),
-        });
-      } catch (err) {
-        runtimeWarnings.push({
-          warning_kind: "context_compaction_record_failed",
-          source: "pi",
-          message: err?.message || String(err),
-        });
-      }
-    }
-    return { applied: true, tokensBefore, nothingToCompact: false };
-  } catch (err) {
-    const message = err?.message || String(err);
-    const code = err?.code;
-    const nothingToCompact = code === "compaction" && /nothing to compact/i.test(message);
-    const warningKind = nothingToCompact
-      ? "context_compaction_nothing_to_compact"
-      : code === "auth"
-        ? "context_compaction_auth_failed"
-        : code === "busy"
-          ? "context_compaction_busy"
-          : "context_compaction_failed";
-    runtimeWarnings.push({ warning_kind: warningKind, source: "pi", trigger, message });
-    return { applied: false, tokensBefore: null, nothingToCompact };
-  }
-}
-
-function isReactiveCompactionCandidate(errorMessage, diagnostics) {
-  if (!errorMessage) return false;
-  return isContextLimitError(errorMessage) || isLikelyContextTermination(errorMessage, diagnostics);
-}
+  abortedResult,
+  buildDiagnostics,
+  buildErrorDetails,
+  buildErrorResult,
+  buildSuccessResult,
+  emitCapabilitiesResolved,
+  emitUsageCostEvents,
+  usageFromMessages,
+} from "./pi-native/result-builder.js";
+import {
+  cleanupSessionOnThrow,
+  commitSession,
+  discardUncommittedSession,
+  resolveDurableNativeSessionRepo,
+  resolveSession,
+  rollbackAbortedTurn,
+} from "./pi-native/session-lifecycle.js";
+import {
+  resolveLiveCompactionPolicy,
+  runProactiveCompaction,
+  runReactiveCompaction,
+} from "./pi-native/compaction-driver.js";
+import {
+  buildTurnHarness,
+  buildTurnTools,
+  runHarnessPrompt,
+  startLiveInput,
+  thinkingLevelForEffort,
+} from "./pi-native/turn-runner.js";
 
 async function resolveApiKey(provider, { apiKeys, resolvePiApiKey, runtimeWarnings }) {
   if (apiKeys?.has(provider)) return apiKeys.get(provider);
@@ -282,6 +92,85 @@ async function resolveApiKey(provider, { apiKeys, resolvePiApiKey, runtimeWarnin
   }
 }
 
+async function readCredential(provider, { apiKeys, resolvePiApiKey, runtimeWarnings }) {
+  if (apiKeys?.has(provider)) {
+    const key = apiKeys.get(provider);
+    return typeof key === "string" && key.length > 0 ? { type: "api_key", key } : undefined;
+  }
+  if (typeof resolvePiApiKey?.readCredential === "function") {
+    const credential = await resolvePiApiKey.readCredential(provider);
+    return isCredential(credential) ? credential : undefined;
+  }
+  const key = await resolveApiKey(provider, { apiKeys, resolvePiApiKey, runtimeWarnings });
+  return typeof key === "string" && key.length > 0 ? { type: "api_key", key } : undefined;
+}
+
+function isCredential(credential) {
+  return credential
+    && typeof credential === "object"
+    && (credential.type === "api_key" || credential.type === "oauth");
+}
+
+// pi 0.80 removed the harness `getApiKeyAndHeaders` hook: request auth now
+// resolves through a `Models` collection's `CredentialStore`. This store keeps
+// the bridge's per-run key-resolution contract intact — an `apiKeys` map entry
+// wins, else an enhanced host resolver's credential-store methods are used, else
+// the legacy `resolvePiApiKey(provider)` callback is consulted. Legacy callback
+// failures remain soft (`pi_auth_failed` warning + keyless env fallback);
+// credential-store read/modify failures reject so Pi can surface them as auth
+// storage failures instead of silently treating a corrupt store as no credential.
+export function createDynamicCredentialStore(apiKeys, resolvePiApiKey, runtimeWarnings) {
+  const read = async (providerId) => readCredential(providerId, { apiKeys, resolvePiApiKey, runtimeWarnings });
+  return /** @type {any} */ ({
+    read,
+    async modify(providerId, fn) {
+      if (!apiKeys?.has(providerId) && typeof resolvePiApiKey?.modifyCredential === "function") {
+        return resolvePiApiKey.modifyCredential(providerId, fn);
+      }
+      const current = await read(providerId);
+      const next = await fn(current);
+      if (apiKeys?.has(providerId) && next?.type === "api_key" && typeof next.key === "string") {
+        apiKeys.set(providerId, next.key);
+      }
+      return next ?? current;
+    },
+    async delete(providerId) {
+      if (apiKeys?.has(providerId)) {
+        apiKeys.delete(providerId);
+        return;
+      }
+      if (typeof resolvePiApiKey?.deleteCredential === "function") {
+        await resolvePiApiKey.deleteCredential(providerId);
+      }
+    },
+  });
+}
+
+// Assemble the pi 0.80 `Models` collection serving this run. Builtin models
+// reuse pi's own provider factories (correct per-provider baseUrl/headers and
+// env-var fallback); a custom OpenAI-completions provider is registered from the
+// resolved model. `piResolvedModels` is an advanced/test seam mirroring
+// `piResolvedModel`: when supplied it is used verbatim (the model dispatched via
+// `piResolvedModel` may live outside pi's builtin catalog, e.g. a faux model).
+function buildRunModels(runtime, options, runtimeWarnings) {
+  if (options.piResolvedModels) return options.piResolvedModels;
+  const credentials = createDynamicCredentialStore(runtime.apiKeys, options.resolvePiApiKey, runtimeWarnings);
+  if (options.customProvider) {
+    const model = runtime.model;
+    const models = createModels({ credentials });
+    models.setProvider(createProvider({
+      id: model.provider,
+      name: model.name || model.provider,
+      baseUrl: model.baseUrl,
+      auth: { apiKey: envApiKeyAuth(model.name || model.provider, []) },
+      models: [model],
+      api: openAICompletionsApi(),
+    }));
+    return models;
+  }
+  return builtinModels({ credentials });
+}
+
 // Normalize the incoming runtime messages into AgentMessages the harness can
 // seed/prompt. Returns the prior messages (appended to the session before the
 // run) and the final user text used to drive `harness.prompt`.
@@ -327,149 +216,71 @@ function splitUserContent(content) {
   return { text: texts.join("\n"), images };
 }
 
-// Live pi-native sessions, keyed by provider session id. Entries are
-// { session, metadata, repo, durable, busy } — identical shape and lifecycle
-// policy to the (now-retired) pi-sdk bridge: in-memory transcripts are freed
-// when the registry evicts them; durable (jsonl) transcripts survive eviction
-// so a later resume can reopen them from disk. Registering here gives
-// runtime.disposeSession / disposeProviderSession + idle-TTL eviction the same
-// reach over native pi sessions that the legacy bridge had.
-const nativeSessionRepo = new InMemorySessionRepo();
-const nativeSessions = createSessionRegistry({
-  isBusy: (entry) => entry.busy === true,
-  onEvict: async (entry) => {
-    if (entry.durable) return;
-    try {
-      await entry.repo.delete(entry.metadata);
-    } catch { /* best-effort */ }
-  },
-});
-
-const durableNativeSessionRepos = new Map();
-
-function resolveDurableNativeSessionRepo(piSessionsRoot) {
-  if (typeof piSessionsRoot !== "string" || !piSessionsRoot.trim()) return null;
-  const root = piSessionsRoot.trim();
-  let repo = durableNativeSessionRepos.get(root);
-  if (!repo) {
-    repo = new JsonlSessionRepo({
-      fs: new NodeExecutionEnv({ cwd: process.cwd() }),
-      sessionsRoot: root,
-    });
-    durableNativeSessionRepos.set(root, repo);
-  }
-  return repo;
-}
-
-// Defense in depth (R4): create-on-miss passes the caller-controlled session id
-// straight to durableRepo.create({ id }), and JsonlSessionRepo writes
-// `${createdAt}_${id}.jsonl` — so an id like "../../../../tmp/pwn" would escape
-// piSessionsRoot and name a file anywhere on disk. The harness-derived id is a
-// sha256 hex (always safe), but the public runtime API is caller-controlled.
-// Only an id that is a single safe filename component may CREATE a session;
-// anything else falls through to the existing session_not_found fast-fail, so a
-// malicious id can never name a file. (A genuinely on-disk session reopened by
-// reopenDurableNativeSession is matched by `.id`, never used to build a path, so
-// this gate is confined to the create path.)
-const SAFE_SESSION_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-
-function isSafeSessionId(id) {
-  return typeof id === "string"
-    && SAFE_SESSION_ID.test(id)
-    && !id.includes("..")
-    && !id.includes("/")
-    && !id.includes("\\");
-}
-
-async function reopenDurableNativeSession(repo, sessionId) {
-  try {
-    const metadata = (await repo.list()).find((entry) => entry?.id === sessionId);
-    if (!metadata) return null;
-    const session = await repo.open(metadata);
-    return { session, metadata, repo, durable: true, busy: false };
-  } catch {
-    return null;
-  }
-}
-
-function sessionUnavailableResult({
-  resolved,
-  options,
-  events,
-  runtimeWarnings,
-  start,
-  sessionId,
-  errorMessage,
-  failureKind,
-  piErrorCode,
-}) {
-  return {
-    text: null,
-    events,
-    usage: {},
-    durationMs: Date.now() - start,
-    numTurns: 0,
-    model: resolved?.reference || resolved?.model || null,
-    effort: options.effort || null,
-    sdk: resolved?.sdk || "pi",
-    cancelled: false,
-    error: errorMessage,
-    failureKind,
-    providerSessionId: sessionId,
-    runtimeWarnings,
-    diagnostics: {
-      provider_session_id: sessionId,
-      pi_error_code: piErrorCode,
-      pi_engine: "native",
-    },
-  };
-}
-
-function abortedResult({ resolved, options, events, runtimeWarnings, start, providerSessionId }) {
-  return {
-    text: null,
-    thinking: "",
-    events,
-    usage: {},
-    durationMs: Date.now() - start,
-    numTurns: 0,
-    model: resolved?.reference || resolved?.model || null,
-    effort: options.effort || null,
-    sdk: resolved?.sdk || "pi",
-    cancelled: true,
-    error: null,
-    failureKind: null,
-    providerSessionId,
-    runtimeWarnings,
-    diagnostics: {
-      provider_session_id: providerSessionId,
-      pi_stop_reason: "aborted",
-      pi_engine: "native",
-      external_abort: true,
-    },
-  };
-}
-
 export async function generatePiNativeResponse(systemPrompt, options = {}) {
   const resolved = options.model;
   const start = Date.now();
   const events = [];
   const runtimeWarnings = [];
-  const assistantTexts = [];
-  const assistantThinking = [];
-  const textDeltaIndexes = new Set();
-  const thinkingDeltaIndexes = new Set();
-  let structuredResult = null;
   let mcpClients = [];
-  let externalAbort = false;
-  let maxTurnsHit = false;
-  let turnCount = 0;
-  let toolResultsSeen = 0;
-  let lastToolName = null;
-  // toolCallId -> start timestamp, so we can emit per-tool execution latency.
-  const toolStartTimes = new Map();
   let harness = null;
-  let removeAbortHandler = null;
+  // The ONE explicit runState the extracted modules (stream subscriber, session
+  // lifecycle, compaction driver, turn runner, result builder) read/write.
+  // Reassignable scalars/refs live here so a module can rebind them (an
+  // orchestrator local cannot be reassigned from a module). `events` /
+  // `runtimeWarnings` stay as consts shared by reference. `toolStartTimes` maps
+  // toolCallId -> start timestamp so per-tool execution latency can be emitted.
+  const runState = {
+    assistantTexts: [],
+    assistantThinking: [],
+    textDeltaIndexes: new Set(),
+    thinkingDeltaIndexes: new Set(),
+    toolStartTimes: new Map(),
+    turnCount: 0,
+    toolResultsSeen: 0,
+    lastToolName: null,
+    maxTurnsHit: false,
+    // Populated by the StructuredOutput tool callback (built in the turn runner);
+    // read by the finalization retry predicate and the result assembly.
+    structuredResult: null,
+    // Set by the turn-runner abort handler; the OUTER catch and lifecycle
+    // decisions re-check it (`externalAbort ||= aborted`). removeAbortHandler is
+    // installed by the turn runner and cleared in finally; harness is set there
+    // too.
+    externalAbort: false,
+    removeAbortHandler: null,
+    harness: null,
+    // Auto-compaction sub-state. The policy is (re)computed at the decision
+    // point against the model actually serving the request; these flags track
+    // whether a compaction fired so the run reports context_compaction_applied
+    // honestly and never double-compacts.
+    compaction: {
+      applied: false,
+      reactiveAttempted: false,
+      compactedThisRun: false,
+      policy: null,
+      diagnostics: {},
+    },
+    session: null,
+    sessionEntry: null,
+    // True when a requestedSessionId had no live entry AND no durable transcript,
+    // so a fresh durable session was created under that id (cross-restart resume,
+    // first turn for the conversation). Distinct from a true resume (sessionEntry
+    // set): the on-disk transcript is empty, so prior messages must still be
+    // seeded — unlike a resume, where the session already holds them.
+    createdOnMiss: false,
+    // The create-on-miss BUSY reservation handle (R8 concurrent-first-turn
+    // reservation) when the create path inserted its placeholder; null
+    // otherwise. Its release()/commit() clean the placeholder on the
+    // drop/error/abort/keep-alive paths, since createdOnMiss leaves sessionEntry
+    // null so the finally's busy-clear does not cover it.
+    reservation: null,
+    sessionBaselineCount: 0,
+    // Leaf captured before a resumed turn runs, so a failed resume can be rolled
+    // back to the last good transcript via moveTo. On runState so the OUTER catch
+    // (host/runtime-side throws after the session mutated) can roll back too, not
+    // just the success path.
+    baselineLeafId: null,
+  };
 
   const providerSessionId = options.sessionId
     || options.providerSessionId
@@ -509,142 +320,29 @@ export async function generatePiNativeResponse(systemPrompt, options = {}) {
   }
 
   const durableRepo = resolveDurableNativeSessionRepo(options.piSessionsRoot);
-  let session = null;
-  let sessionEntry = null;
-  // True when a requestedSessionId had no live entry AND no durable transcript,
-  // so a fresh durable session was created under that id (cross-restart resume,
-  // first turn for the conversation). Distinct from a true resume (sessionEntry
-  // set): the on-disk transcript is empty, so prior messages must still be
-  // seeded — unlike a resume, where the session already holds them.
-  let createdOnMiss = false;
-  // True once the create-on-miss path inserted its BUSY placeholder into the
-  // registry (R8 concurrent-first-turn reservation). Used to clean the
-  // placeholder up on the drop/error/abort paths, since createdOnMiss leaves
-  // sessionEntry null so the finally's busy-clear does not cover it.
-  let createdOnMissPlaceholder = false;
-  let sessionBaselineCount = 0;
-  // Leaf captured before a resumed turn runs, so a failed resume can be rolled
-  // back to the last good transcript via moveTo. Hoisted to function scope so
-  // the OUTER catch (host/runtime-side throws after the session mutated) can
-  // roll back too, not just the success path.
-  let baselineLeafId = null;
 
   try {
-    // Resume check first: a session miss must stay cheap (no tool/MCP/harness
-    // init). This mirrors the legacy bridge's fail-fast contract.
-    if (requestedSessionId) {
-      let entry = nativeSessions.get(requestedSessionId);
-      if (!entry && durableRepo) {
-        entry = await reopenDurableNativeSession(durableRepo, requestedSessionId);
-        if (entry) {
-          // TOCTOU guard: the reopen above is an AWAIT, so a second concurrent
-          // cold resume could have reopened+inserted its own entry in this
-          // window. Re-read the registry and adopt any entry already present so
-          // the busy-claim below collapses back to the warm path's synchronous
-          // semantics (the loser sees the winner's shared entry with busy===true
-          // and returns session_busy). The discarded reopen is just an in-memory
-          // jsonl handle (no subprocess/socket), so dropping it is safe.
-          const concurrent = nativeSessions.get(requestedSessionId);
-          if (concurrent) {
-            entry = concurrent;
-          } else {
-            nativeSessions.set(requestedSessionId, entry, { idleTimeoutMs: sessionTtlMs });
-          }
-        }
-      }
-      if (!entry) {
-        if (durableRepo && isSafeSessionId(providerSessionId)) {
-          // Create-on-miss (durable resume only): the requested id has no live
-          // registry entry AND no JSONL on disk under piSessionsRoot. This is
-          // the cross-restart resume case — the harness derives a stable id from
-          // the conversationId and passes it before any session exists on a
-          // fresh process. Rather than fail with session_not_found (which would
-          // make the harness re-send full history into yet another fresh,
-          // randomly-named session and orphan future resumes), create a durable
-          // session UNDER the requested id so this and every later turn for the
-          // conversation resolve to the same on-disk transcript. sessionEntry
-          // stays null so this proceeds exactly like a fresh run (prior messages
-          // are seeded, the keep-alive success path registers + persists it).
-          // The IN-MEMORY resume miss (no durableRepo) — and a create-on-miss
-          // with an UNSAFE id (R4) — keep fast-failing below, preserving the
-          // existing per-process session_not_found contract.
-          //
-          // Concurrent-first-turn race (R8): two concurrent first turns for the
-          // same durable id would BOTH miss here and BOTH create, producing two
-          // transcripts for one logical id (JsonlSessionRepo names files by
-          // `${createdAt}_${id}`, so there is no fs-level dedup). Mirror the
-          // cold-reopen-race defense: synchronously (NO await) re-check the
-          // registry, then reserve the id with a BUSY placeholder before the
-          // create await. The get→check→set span MUST stay await-free, so the
-          // loser observes the busy placeholder and returns session_busy via the
-          // same busy-claim path below — exactly one create per durable id.
-          const concurrent = nativeSessions.get(requestedSessionId);
-          if (concurrent) {
-            // A concurrent caller already reserved/created this id in the window
-            // since the miss above. Adopt its entry and fall into the busy-claim
-            // logic (session_busy if its turn is in flight, else resume).
-            entry = concurrent;
-          } else {
-            // Reserve the id with a busy placeholder BEFORE the create await so a
-            // second concurrent first turn observes busy and returns session_busy.
-            // The keep-alive success path (set(providerSessionId, ...) with
-            // busy:false) overwrites this placeholder on success; the drop/abort/
-            // catch paths delete it by requestedSessionId/providerSessionId (they
-            // are equal here). Keyed by requestedSessionId === providerSessionId.
-            nativeSessions.set(requestedSessionId, {
-              session: null,
-              metadata: null,
-              repo: durableRepo,
-              durable: true,
-              busy: true,
-            }, { idleTimeoutMs: sessionTtlMs });
-            createdOnMissPlaceholder = true;
-            session = await durableRepo.create({ id: providerSessionId, cwd: options.cwd || process.cwd() });
-            createdOnMiss = true;
-          }
-        } else {
-          return sessionUnavailableResult({
-            resolved,
-            options,
-            events,
-            runtimeWarnings,
-            start,
-            sessionId: requestedSessionId,
-            errorMessage: `Pi session ${requestedSessionId} is not live`,
-            failureKind: "session_not_found",
-            piErrorCode: "pi_session_not_found",
-          });
-        }
-      }
-      if (entry && !createdOnMiss) {
-        // The busy claim MUST stay await-free between the registry adoption
-        // above and `entry.busy = true` below: get/set + this check/claim are
-        // all synchronous, which is what makes the cold-resume race (F4) safe.
-        // Do not introduce any await in this span or the TOCTOU window reopens.
-        if (entry.busy) {
-          return sessionUnavailableResult({
-            resolved,
-            options,
-            events,
-            runtimeWarnings,
-            start,
-            sessionId: requestedSessionId,
-            errorMessage: `Pi session ${requestedSessionId} is busy with another turn`,
-            failureKind: "session_busy",
-            piErrorCode: "pi_session_busy",
-          });
-        }
-        entry.busy = true;
-        sessionEntry = entry;
-        session = entry.session;
-      }
-    } else {
-      // Fresh runs persist into the durable jsonl repo when piSessionsRoot is
-      // set, so a kept-alive session can be reopened from disk after the live
-      // entry is evicted; otherwise the in-memory repo is used.
-      session = await (durableRepo || nativeSessionRepo)
-        .create({ id: providerSessionId, cwd: options.cwd || process.cwd() });
-    }
+    // Resume the session (warm registry hit, durable cold reopen, or
+    // create-on-miss for a durable cross-restart first turn) or create a fresh
+    // one. resolveSession mutates runState.session / sessionEntry / createdOnMiss
+    // / reservation, and returns an early fast-fail result (session_not_found /
+    // session_busy) to return verbatim. Its liveness claims (I1 busy-claim, R8
+    // reservation, F4 cold-reopen re-read) are await-free by construction. A
+    // session miss stays cheap: no tool/MCP/harness init runs before this
+    // fast-fail.
+    const resolvedSession = await resolveSession(runState, {
+      requestedSessionId,
+      providerSessionId,
+      durableRepo,
+      sessionTtlMs,
+      cwd: options.cwd,
+      resolved,
+      options,
+      events,
+      runtimeWarnings,
+      start,
+    });
+    if (resolvedSession.done) return resolvedSession.result;
 
     // `piResolvedModel` is an advanced/test seam: when supplied it provides a
     // ready pi-ai Model (e.g. a registered faux provider model) plus optional
@@ -667,84 +365,45 @@ export async function generatePiNativeResponse(systemPrompt, options = {}) {
     const reference = resolved.reference
       || (resolved.sdk === "pi" ? `pi:${resolved.provider}:${resolved.model}` : `${resolved.sdk}:${resolved.model}`);
 
-    // Tool-output limits (settings-driven clamps for tool/MCP payloads). The
-    // legacy pi-sdk bridge wired these via the compaction manager's `.policy`;
-    // resolveAgentCompactionPolicy is pure (no manager/Agent), so we compute the
-    // same policy directly and pass it into the tool builders + display
-    // normalization. Restores configurable clamping (agent_tool_text_limit_chars,
-    // agent_search_result_limit, ...) on top of the 256KB hard ceiling.
-    const toolLimits = resolveAgentCompactionPolicy(options.settings || {}, runtime.model);
-
-    // Auto-compaction state. The compaction policy is (re)computed at the
-    // decision point (Hook B) against the model actually serving the request, so
-    // it is declared there; these flags track whether a compaction fired so the
-    // run reports context_compaction_applied honestly and never double-compacts.
-    let contextCompactionApplied = false;
-    let contextCompactionReactiveAttempted = false;
-    let contextCompactedThisRun = false;
-    let compactionPolicy = null;
-    const contextCompactionDiagnostics = {};
-
-    const onTruncate = (info) => {
-      try {
-        onEvent({
-          type: "runtime_warning",
-          warning_kind: "tool_payload_truncated",
-          source: "tool_bloat_guard",
-          ...info,
-        });
-      } catch { /* best-effort */ }
-    };
-    const persistArtifact = options.persistArtifact || null;
-    const qaOutputDir = options.qaOutputDir || options.runArtifactDir || null;
-
-    // REUSED custom pieces: built-in tool sandboxing + allowlist/bloat filter +
-    // approval gates. These are identical to the legacy bridge.
-    const builtIns = capabilities.tool_use === false
-      ? []
-      : getPiBuiltinTools(options.allowedTools, {
-        skillNames: (options.skills || []).map((skill) => skill.name),
-        dataDir: options.dataDir,
-        cwd: options.cwd,
-        onEvent,
-        persistArtifact,
-        onTruncate,
-        toolLimits,
-        toolPayloadMaxBytes: toolLimits.toolPayloadMaxBytes,
-        toolPolicy: options.toolPolicy,
-        sandboxPolicy: options.sandboxPolicy,
-        sandboxEngine: options.sandboxEngine,
-        approvalManager,
-        approvalModel: runtime.model?.id || runtime.model?.name || resolved.model,
-      });
-
-    const structuredTool = createStructuredOutputTool(options.outputSchema, (value) => {
-      structuredResult = value;
+    // Resolve the typed `toolLimits` / `compaction` policy objects against the
+    // deprecated `settings` fallback (per-group precedence: a present typed
+    // object wins and its group's legacy keys are ignored; an absent object
+    // falls back to `settings`). Consuming any legacy key emits exactly one
+    // deprecation warning per run. mono-agent never passes `settings`, so this
+    // is a no-op there; the shim exists for worklab's day-one port.
+    const { settingsLike, consumedSettingsKeys } = resolveRuntimePolicyInputs({
+      toolLimits: options.toolLimits,
+      compaction: options.compaction,
+      settings: options.settings,
     });
-    const reservedNames = new Set(builtIns.map((toolDef) => toolDef.name));
-    if (structuredTool) reservedNames.add(structuredTool.name);
-
-    // REUSED MCP tool bridge: same initPiMcpTools sandboxing path.
-    const mcpInit = capabilities.tool_use === false
-      ? { clients: [], tools: [], warnings: [] }
-      : await initPiMcpTools(options.mcpServers || {}, reservedNames, {
-        cwd: options.cwd,
-        persistArtifact,
-        qaOutputDir,
-        onTruncate,
-        limits: toolLimits,
-        toolPayloadMaxBytes: toolLimits.toolPayloadMaxBytes,
-        sandboxPolicy: options.sandboxPolicy,
-        sandboxEngine: options.sandboxEngine,
-      });
-    mcpClients = mcpInit.clients;
-    for (const warning of mcpInit.warnings || []) onEvent(warning);
+    if (consumedSettingsKeys.length > 0) {
+      const warning = deprecatedSettingsWarning(consumedSettingsKeys);
+      runtimeWarnings.push(warning);
+      onEvent({ type: "runtime_warning", ...warning });
+    }
 
-    const tools = [
-      ...builtIns,
-      ...mcpInit.tools,
-      ...(structuredTool ? [structuredTool] : []),
-    ];
+    // Tool-output limits (clamps for tool/MCP payloads). The legacy pi-sdk bridge
+    // wired these via the compaction manager's `.policy`; resolveAgentCompactionPolicy
+    // is pure (no manager/Agent), so we compute the same policy directly from the
+    // resolved settings-like inputs and pass it into the tool builders + display
+    // normalization. Restores configurable clamping (toolTextLimitChars,
+    // searchResultLimit, ...) on top of the 256KB hard ceiling.
+    const toolLimits = resolveAgentCompactionPolicy(settingsLike, runtime.model);
+
+    // Build the turn's tools (builtins + MCP bridge + StructuredOutput). The
+    // StructuredOutput callback writes runState.structuredResult; the MCP clients
+    // are closed in the finally.
+    const { tools, structuredTool, mcpClients: builtMcpClients } = await buildTurnTools(runState, {
+      options,
+      capabilities,
+      toolLimits,
+      approvalManager,
+      runtime,
+      resolved,
+      onEvent,
+      runtimeWarnings,
+    });
+    mcpClients = builtMcpClients;
 
     // Provider retry/backoff is delegated to pi-ai via streamOptions, replacing
     // the legacy hand-rolled stream-retry loop.
@@ -759,129 +418,39 @@ export async function generatePiNativeResponse(systemPrompt, options = {}) {
     // (QueueMode). Only enable when tools in a step are independent.
     const toolSteeringMode = options.piToolParallelismMode === "all" ? "all" : "one-at-a-time";
 
-    harness = new AgentHarness({
-      env: new NodeExecutionEnv({ cwd: options.cwd || process.cwd() }),
-      session,
+    const piModels = buildRunModels(runtime, options, runtimeWarnings);
+
+    // Construct the harness, subscribe the stream normalizer, and wire the
+    // external abort handler (which sets runState.externalAbort and aborts the
+    // harness). Sets runState.harness + runState.removeAbortHandler.
+    harness = buildTurnHarness(runState, {
+      cwd: options.cwd,
+      session: runState.session,
+      piModels,
       model: runtime.model,
       thinkingLevel: effectiveThinkingLevel,
-      systemPrompt: appendStructuredOutputInstruction(systemPrompt, options.outputSchema),
+      systemPrompt,
+      outputSchema: options.outputSchema,
       tools,
-      streamOptions: { maxRetries, maxRetryDelayMs },
-      getApiKeyAndHeaders: async (model) => {
-        const apiKey = await resolveApiKey(model.provider, {
-          apiKeys: runtime.apiKeys,
-          resolvePiApiKey: options.resolvePiApiKey,
-          runtimeWarnings,
-        });
-        return apiKey ? { apiKey } : undefined;
-      },
+      maxRetries,
+      maxRetryDelayMs,
       steeringMode: toolSteeringMode,
-      followUpMode: toolSteeringMode,
-    });
-
-    harness.subscribe((event) => {
-      if (event.type === "message_update") {
-        const streamEvent = event.assistantMessageEvent;
-        if (streamEvent?.type === "text_delta" && streamEvent.delta) {
-          textDeltaIndexes.add(streamContentKey(streamEvent, "text"));
-          assistantTexts.push(streamEvent.delta);
-          onEvent({ type: "assistant", message: { content: [{ type: "text", text: streamEvent.delta }] } });
-        } else if (streamEvent?.type === "text_end" && streamEvent.content) {
-          const key = streamContentKey(streamEvent, "text");
-          if (!textDeltaIndexes.has(key)) {
-            assistantTexts.push(streamEvent.content);
-            onEvent({ type: "assistant", message: { content: [{ type: "text", text: streamEvent.content }] } });
-          }
-        } else if (streamEvent?.type === "thinking_delta" && streamEvent.delta) {
-          thinkingDeltaIndexes.add(streamContentKey(streamEvent, "thinking"));
-          assistantThinking.push(streamEvent.delta);
-          onEvent({ type: "assistant", message: { content: [{ type: "thinking", text: streamEvent.delta }] } });
-        } else if (streamEvent?.type === "thinking_end" && streamEvent.content) {
-          const key = streamContentKey(streamEvent, "thinking");
-          if (!thinkingDeltaIndexes.has(key)) {
-            assistantThinking.push(streamEvent.content);
-            onEvent({ type: "assistant", message: { content: [{ type: "thinking", text: streamEvent.content }] } });
-          }
-        }
-      } else if (event.type === "tool_execution_start") {
-        if (event.toolName) lastToolName = event.toolName;
-        if (event.toolCallId) toolStartTimes.set(event.toolCallId, Date.now());
-        const input = eventToolArgs(event.toolName, event.args, { cwd: options.cwd, toolLimits });
-        const progressText = toolStartProgressText(event.toolName);
-        if (progressText) {
-          onEvent({ type: "assistant", message: { content: [{ type: "thinking", text: progressText }] } });
-        }
-        onEvent({
-          type: "assistant",
-          message: { content: [{ type: "tool_use", id: event.toolCallId, name: event.toolName, input }] },
-        });
-      } else if (event.type === "tool_execution_update") {
-        const input = eventToolArgs(event.toolName, event.args, { cwd: options.cwd, toolLimits });
-        onEvent({
-          type: "tool_update",
-          tool_use_id: event.toolCallId,
-          name: event.toolName,
-          input,
-          partial_result: jsonSerializable(event.partialResult, String(event.partialResult ?? "")),
-        });
-      } else if (event.type === "tool_execution_end") {
-        const resultContent = toolResultContent(event.result);
-        if (!event.isError) toolResultsSeen += 1;
-        const startedAt = toolStartTimes.get(event.toolCallId);
-        if (startedAt !== undefined) {
-          toolStartTimes.delete(event.toolCallId);
-          onEvent({
-            type: "tool_timing",
-            tool_use_id: event.toolCallId,
-            name: event.toolName,
-            execution_ms: Date.now() - startedAt,
-            is_error: !!event.isError,
-          });
-        }
-        onEvent({
-          type: "user",
-          message: {
-            content: [{
-              type: "tool_result",
-              tool_use_id: event.toolCallId,
-              content: resultContent,
-              raw_result: compactToolRawResult(jsonSerializable(event.result, resultContent), resultContent),
-              is_error: !!event.isError,
-            }],
-          },
-        });
-      } else if (event.type === "turn_end") {
-        turnCount += 1;
-        if (Number.isFinite(Number(options.maxTurns))
-          && Number(options.maxTurns) > 0
-          && turnCount >= Number(options.maxTurns)
-          && event.message?.stopReason === "toolUse") {
-          maxTurnsHit = true;
-          harness.abort();
-        }
-      }
+      onEvent,
+      options,
+      toolLimits,
     });
 
-    const abortHandler = () => {
-      externalAbort = true;
-      harness.abort();
-    };
-    if (options.abortSignal) {
-      options.abortSignal.addEventListener("abort", abortHandler, { once: true });
-      removeAbortHandler = () => options.abortSignal.removeEventListener?.("abort", abortHandler);
-    }
-
     // Seed prior transcript (everything before the trailing user turn) into the
     // harness-owned session. On a true resume the session already holds the
     // transcript, so prior messages are skipped; a fresh run AND a create-on-miss
     // (requestedSessionId set but the durable session was just created empty)
     // both seed, since their on-disk transcript is empty.
     const { priorMessages, promptText, promptImages } = splitPromptMessages(options.messages, runtime.model);
-    sessionBaselineCount = (await session.buildContext()).messages.length;
-    if (!requestedSessionId || createdOnMiss) {
+    runState.sessionBaselineCount = (await runState.session.buildContext()).messages.length;
+    if (!requestedSessionId || runState.createdOnMiss) {
       for (const message of priorMessages) {
         await harness.appendMessage(message);
-        sessionBaselineCount += 1;
+        runState.sessionBaselineCount += 1;
       }
     }
     // The harness persists each turn INLINE into the live session. To preserve
@@ -890,36 +459,14 @@ export async function generatePiNativeResponse(systemPrompt, options = {}) {
     // the last good transcript via the session tree's moveTo primitive. Only a
     // TRUE resume needs this: a create-on-miss session is fresh, so a failure
     // drops it entirely via the fresh-run path (no leaf to roll back to).
-    if (requestedSessionId && !createdOnMiss) {
-      try { baselineLeafId = await session.getLeafId(); } catch { /* best-effort */ }
+    if (requestedSessionId && !runState.createdOnMiss) {
+      try { runState.baselineLeafId = await runState.session.getLeafId(); } catch { /* best-effort */ }
     }
 
     // Live steering: consume follow-up messages and steer the harness mid-run.
-    // The consumer is tied to run completion (runComplete) so it stops steering
-    // once the run finishes and does not swallow messages meant for a later turn.
-    let liveInputIterator = null;
-    let liveInputTask = null;
-    let runComplete = false;
-    if (options.liveInput) {
-      liveInputIterator = typeof options.liveInput[Symbol.asyncIterator] === "function"
-        ? options.liveInput[Symbol.asyncIterator]()
-        : options.liveInput;
-      liveInputTask = (async () => {
-        try {
-          while (!runComplete && !options.abortSignal?.aborted) {
-            const next = await liveInputIterator.next();
-            if (next.done || runComplete || options.abortSignal?.aborted) break;
-            await harness.steer(formatLiveInputGuidance(next.value.body));
-          }
-        } catch (err) {
-          onEvent({
-            type: "runtime_warning",
-            warning_kind: "live_input_failed",
-            message: err?.message || String(err),
-          });
-        }
-      })();
-    }
+    // The consumer is tied to run completion so it stops steering once the run
+    // finishes and does not swallow messages meant for a later turn.
+    const liveInput = startLiveInput({ harness, options, onEvent });
 
     // Re-check abort right before issuing the provider request. The abort
     // handler is only installed at ~:639, AFTER a long stretch of awaited setup
@@ -929,65 +476,38 @@ export async function generatePiNativeResponse(systemPrompt, options = {}) {
     // target. Without this re-check a full provider/LLM request would be issued
     // for a run the caller already aborted (mirrors the entry pre-check at ~:356).
     if (options.abortSignal?.aborted) {
-      // Drop a freshly-created non-keep-alive session so an aborted-before-run
-      // turn does not leave an orphan jsonl on disk. Guarded `session &&
-      // !sessionEntry` so a resumed (user-owned) session is NEVER deleted —
-      // identical to the outer catch guard. The finally block clears
-      // sessionEntry.busy, removes the abort handler, and closes MCP clients.
-      // For a resume no transcript was appended yet (prompt never ran), so the
-      // live session is already at its pre-turn leaf and needs no rollback.
-      if (session && !sessionEntry) {
-        try { await (durableRepo || nativeSessionRepo).delete(await session.getMetadata()); } catch { /* best-effort */ }
-      }
-      // Drop the create-on-miss BUSY reservation too. The finally only clears
-      // sessionEntry.busy (null here), so without this the busy placeholder leaks
-      // and every future resume of this conversation's stable id returns
-      // session_busy forever (busy entries are never idle-evicted). Mirrors the
-      // lifecycle drop branch + outer catch cleanup.
-      if (createdOnMissPlaceholder) nativeSessions.delete(providerSessionId);
+      // Drop a freshly-created non-keep-alive session (and any create-on-miss
+      // reservation) so an aborted-before-run turn does not leave an orphan
+      // jsonl / leaked busy placeholder. discardUncommittedSession guards
+      // `session && !sessionEntry` so a resumed (user-owned) session is NEVER
+      // deleted; the finally clears sessionEntry.busy, removes the abort handler,
+      // and closes MCP clients. For a resume no transcript was appended yet
+      // (prompt never ran), so the live session needs no rollback.
+      await discardUncommittedSession(runState, { durableRepo });
       return abortedResult({ resolved, options, events, runtimeWarnings, start, providerSessionId });
     }
 
-    // Compaction policy against the LIVE model's context window (auto-recognized
-    // from the model actually serving the request, lowered by any ceiling learned
-    // from a prior overflow). Drives the proactive trigger + reactive recovery.
-    compactionPolicy = resolveAgentCompactionPolicy(
-      options.settings || {},
-      { contextWindow: effectiveContextWindow(harness, runtime, resolved) },
-    );
-
-    // Proactive compaction: if the session is already near the window, compact
-    // BEFORE issuing the request so a long-lived session never overflows.
-    if (compactionPolicy.enabled && compactionPolicy.contextWindow > 0 && !options.abortSignal?.aborted) {
-      const est = await estimateCurrentContextTokens(session);
-      if (est.tokens >= compactionPolicy.triggerTokens) {
-        await harness.waitForIdle();
-        if (!options.abortSignal?.aborted) {
-          const res = await tryCompact(harness, {
-            trigger: "proactive",
-            onEvent,
-            runtimeWarnings,
-            onCompactionRecorded: options.onCompactionRecorded,
-            runId: options.runId,
-            model: reference,
-          });
-          if (res.applied) {
-            contextCompactionApplied = true;
-            contextCompactedThisRun = true;
-            Object.assign(contextCompactionDiagnostics, {
-              context_compaction_proactive: true,
-              context_compaction_tokens_before: res.tokensBefore,
-              context_compaction_estimate_source: est.source,
-              context_window: compactionPolicy.contextWindow,
-            });
-            // Compaction collapses the transcript prefix, so the pre-run baseline
-            // no longer aligns. Re-anchor it to the compacted length so the run's
-            // own turns (issued next) slice out correctly in captureState.
-            sessionBaselineCount = (await session.buildContext()).messages.length;
-          }
-        }
-      }
-    }
+    // Compaction policy against the LIVE model's context window, then proactive
+    // compaction: if the session is already near the window, compact BEFORE
+    // issuing the request so a long-lived session never overflows.
+    runState.compaction.policy = resolveLiveCompactionPolicy({
+      harness,
+      runtime,
+      resolved,
+      settings: settingsLike,
+      contextWindowOverride: options.compaction?.contextWindowOverride,
+    });
+    await runProactiveCompaction(runState, {
+      harness,
+      systemPrompt,
+      options,
+      tools,
+      promptText,
+      promptImages,
+      reference,
+      onEvent,
+      runtimeWarnings,
+    });
 
     onEvent({
       type: "provider_request_started",
@@ -997,39 +517,18 @@ export async function generatePiNativeResponse(systemPrompt, options = {}) {
       timestamp: Date.now(),
     });
 
-    let runError = null;
-    try {
-      // Pass structured images (when present) so multimodal input reaches the
-      // model as image blocks rather than stringified text. AgentHarness.prompt
-      // takes them under an options object (`{ images }`); a bare array would be
-      // read as `options` and silently dropped (options?.images === undefined).
-      if (Array.isArray(promptImages) && promptImages.length > 0) {
-        await harness.prompt(promptText, { images: promptImages });
-      } else {
-        await harness.prompt(promptText);
-      }
-    } catch (err) {
-      runError = err;
-    }
-    await harness.waitForIdle();
+    let { runError } = await runHarnessPrompt(harness, promptText, promptImages);
 
     // The run is done: stop the live-steering consumer so it cannot steer a
-    // finished harness or swallow a follow-up meant for the next turn. We signal
-    // completion, then best-effort return() the iterator to unblock a pending
-    // next(). We do NOT await the task (it could block on next() if the source
-    // has no return()), but the runComplete guard prevents any further steering.
-    runComplete = true;
-    if (liveInputIterator && typeof liveInputIterator.return === "function") {
-      try { await liveInputIterator.return(); } catch { /* best-effort */ }
-    }
-    void liveInputTask;
+    // finished harness or swallow a follow-up meant for the next turn.
+    await liveInput.stop();
 
-    externalAbort ||= !!options.abortSignal?.aborted;
+    runState.externalAbort ||= !!options.abortSignal?.aborted;
 
     const captureState = async () => {
-      const context = await session.buildContext();
+      const context = await runState.session.buildContext();
       const transcript = context.messages || [];
-      const runTranscript = transcript.slice(sessionBaselineCount);
+      const runTranscript = transcript.slice(runState.sessionBaselineCount);
       const assistantMessages = runTranscript.filter((message) => message?.role === "assistant");
       const lastAssistant = assistantMessages[assistantMessages.length - 1] || null;
       return {
@@ -1038,8 +537,8 @@ export async function generatePiNativeResponse(systemPrompt, options = {}) {
         assistantMessages,
         lastAssistant,
         stopReason: lastAssistant?.stopReason || null,
-        finalText: textFromContent(lastAssistant?.content) || assistantTexts.join(""),
-        finalThinking: thinkingFromContent(lastAssistant?.content) || assistantThinking.join(""),
+        finalText: textFromContent(lastAssistant?.content) || runState.assistantTexts.join(""),
+        finalThinking: thinkingFromContent(lastAssistant?.content) || runState.assistantThinking.join(""),
       };
     };
 
@@ -1052,100 +551,36 @@ export async function generatePiNativeResponse(systemPrompt, options = {}) {
     // followUp + setActiveTools instead of the low-level agent.continue() loop.
     if (!runError && shouldRetryStructuredOutputFinalization({
       outputSchema: options.outputSchema,
-      structuredResult,
+      structuredResult: runState.structuredResult,
       finalText: state.finalText,
       stopReason: state.stopReason,
-      externalAbort,
-      maxTurnsHit,
+      externalAbort: runState.externalAbort,
+      maxTurnsHit: runState.maxTurnsHit,
     })) {
-      structuredOutputFinalizationRetryAttempts = 1;
-      structuredOutputFinalizationRetryReason = "empty_final_output";
-      runtimeWarnings.push({
-        warning_kind: "structured_output_finalization_retry",
-        source: "pi",
-        reason: structuredOutputFinalizationRetryReason,
-        message: "Pi stopped without text or structured output; retrying once in the same session with only StructuredOutput enabled.",
-      });
-      const previousActive = harness.getActiveTools().map((toolDef) => toolDef.name);
-      try {
-        // The harness is idle after waitForIdle(), so re-prompt (not followUp,
-        // which only queues onto an active run) with only StructuredOutput
-        // active. This re-prompts ONCE in the same session, matching the legacy
-        // single agent.continue() finalization re-prompt.
-        await harness.setActiveTools(structuredTool ? [structuredTool.name] : []);
-        await harness.prompt(structuredOutputFinalizationPrompt());
-        await harness.waitForIdle();
-      } catch (err) {
-        runtimeWarnings.push({
-          warning_kind: "structured_output_finalization_retry_failed",
-          source: "pi",
-          message: err?.message || String(err),
-        });
-      } finally {
-        try { await harness.setActiveTools(previousActive); } catch { /* best-effort */ }
-      }
-      structuredOutputFinalizationRetryFailed = structuredResult === null || structuredResult === undefined;
+      const retry = await runStructuredOutputFinalizationRetry({ harness, structuredTool, runtimeWarnings, prompts: options.prompts });
+      structuredOutputFinalizationRetryAttempts = retry.attempts;
+      structuredOutputFinalizationRetryReason = retry.reason;
+      structuredOutputFinalizationRetryFailed = runState.structuredResult === null || runState.structuredResult === undefined;
       state = await captureState();
     }
 
     // Reactive recovery: if the turn ended in a context overflow and we have not
-    // already compacted-and-retried this run, compact once and re-prompt once.
-    if (
-      compactionPolicy?.enabled
-      && !contextCompactionReactiveAttempted
-      && !externalAbort
-      && !maxTurnsHit
-      && !options.abortSignal?.aborted
-    ) {
-      const provisionalRaw = state.stopReason === "error" || state.stopReason === "aborted"
-        ? state.lastAssistant?.errorMessage || runError?.message || null
-        : (runError ? runError.message || String(runError) : null);
-      const provisionalError = normalizePiErrorMessage(provisionalRaw);
-      if (provisionalError && isReactiveCompactionCandidate(provisionalError, contextCompactionDiagnostics)) {
-        contextCompactionReactiveAttempted = true;
-        // Learn the real ceiling from the error so future runs trigger
-        // proactively at it even when the configured contextWindow was wrong.
-        recordDiscoveredContextWindow(harness, runtime, resolved, parseContextLimitFromError(provisionalError));
-        // A second compaction immediately after a fresh proactive one is almost
-        // always "nothing to compact"; skip it and surface the original error.
-        if (!contextCompactedThisRun) {
-          await harness.waitForIdle();
-          const res = await tryCompact(harness, {
-            trigger: "reactive_overflow",
-            onEvent,
-            runtimeWarnings,
-            onCompactionRecorded: options.onCompactionRecorded,
-            runId: options.runId,
-            model: reference,
-          });
-          if (res.applied) {
-            contextCompactionApplied = true;
-            contextCompactedThisRun = true;
-            Object.assign(contextCompactionDiagnostics, {
-              context_compaction_reactive: true,
-              context_compaction_tokens_before: res.tokensBefore,
-            });
-            // Re-anchor the transcript baseline to the compacted length so the
-            // re-prompt's turn (and its stopReason/usage) slices out correctly.
-            sessionBaselineCount = (await session.buildContext()).messages.length;
-            // Re-prompt ONCE in the now-compacted session. The trailing user turn
-            // is already persisted, so a fresh prompt continues against it.
-            runError = null;
-            try {
-              if (Array.isArray(promptImages) && promptImages.length > 0) {
-                await harness.prompt(promptText, { images: promptImages });
-              } else {
-                await harness.prompt(promptText);
-              }
-            } catch (err) {
-              runError = err;
-            }
-            await harness.waitForIdle();
-            state = await captureState();
-          }
-        }
-      }
-    }
+    // already compacted-and-retried this run, compact once and re-prompt once
+    // (and re-capture state). Learns the real window ceiling from the error.
+    ({ state, runError } = await runReactiveCompaction(runState, {
+      harness,
+      runtime,
+      resolved,
+      options,
+      promptText,
+      promptImages,
+      reference,
+      onEvent,
+      runtimeWarnings,
+      state,
+      runError,
+      captureState,
+    }));
 
     const { runTranscript, lastAssistant, stopReason, finalText, finalThinking } = state;
     const runAssistantCount = state.assistantMessages.length;
@@ -1159,75 +594,47 @@ export async function generatePiNativeResponse(systemPrompt, options = {}) {
       cachedTokens: usage.cacheRead,
       cacheWriteTokens: usage.cacheWrite,
     });
-    if (usage.cacheRead > 0) {
-      onEvent({ type: "cache_hit", sdk: resolved.sdk, model: reference, tokens: usage.cacheRead, source: "prompt_cache" });
-    }
-    if (usage.cacheWrite > 0) {
-      onEvent({ type: "cache_miss", sdk: resolved.sdk, model: reference, tokens: usage.cacheWrite, source: "prompt_cache" });
-    }
-    onEvent({
-      type: "cost_accumulated",
-      sdk: resolved.sdk,
-      model: reference,
-      cumulativeUsd: Number(usage.cost) || Number(estimatedCost) || 0,
-      tokens: {
-        input: Number(usage.input) || 0,
-        output: Number(usage.output) || 0,
-        cacheReadTokens: Number(usage.cacheRead) || 0,
-        cacheCreationTokens: Number(usage.cacheWrite) || 0,
-      },
-    });
-    onEvent({
-      type: "provider_request_completed",
-      sdk: resolved.sdk,
-      model: reference,
-      runtime: "pi",
-      timestamp: Date.now(),
-      durationMs: Date.now() - start,
-      cancelled: externalAbort,
-    });
+    emitUsageCostEvents({ onEvent, resolved, reference, usage, estimatedCost, start, externalAbort: runState.externalAbort });
 
-    const rawErrorMessage = externalAbort
+    const rawErrorMessage = runState.externalAbort
       ? null
-      : maxTurnsHit
+      : runState.maxTurnsHit
         ? "Pi agent stopped before final output: max turns reached"
         : (stopReason === "error" || stopReason === "aborted"
           ? lastAssistant?.errorMessage || runError?.message || "Pi agent aborted before final output"
           : (runError ? runError.message || String(runError) : null));
     const errorMessage = normalizePiErrorMessage(rawErrorMessage);
 
-    const diagnostics = {
-      provider_session_id: providerSessionId,
-      pi_stop_reason: stopReason,
-      pi_engine: "native",
-      max_turns_hit: maxTurnsHit,
-      max_turns: Number.isFinite(Number(options.maxTurns)) ? Number(options.maxTurns) : null,
-      turn_count: turnCount || runAssistantCount,
-      external_abort: externalAbort,
-      pi_max_retries: maxRetries,
-      ...(lastToolName ? { last_tool_name: lastToolName } : {}),
-      ...structuredOutputRetryDiagnostics(
-        structuredOutputFinalizationRetryAttempts,
-        structuredOutputFinalizationRetryReason,
-        structuredOutputFinalizationRetryFailed,
-      ),
-      ...contextCompactionDiagnostics,
+    const structuredRetry = {
+      attempts: structuredOutputFinalizationRetryAttempts,
+      reason: structuredOutputFinalizationRetryReason,
+      failed: structuredOutputFinalizationRetryFailed,
     };
-    const errorDetails = errorMessage ? {
-      pi_stop_reason: stopReason || "error",
-      last_tool_name: lastToolName,
-      tool_results_seen: toolResultsSeen,
-      turn_count: turnCount || runAssistantCount,
-      max_turns_hit: maxTurnsHit,
-      provider_session_id: providerSessionId,
-      pi_engine: "native",
-      ...structuredOutputRetryDiagnostics(
-        structuredOutputFinalizationRetryAttempts,
-        structuredOutputFinalizationRetryReason,
-        structuredOutputFinalizationRetryFailed,
-      ),
-      ...contextCompactionDiagnostics,
-    } : null;
+    const diagnostics = buildDiagnostics({
+      providerSessionId,
+      stopReason,
+      maxTurnsHit: runState.maxTurnsHit,
+      maxTurns: options.maxTurns,
+      turnCount: runState.turnCount,
+      runAssistantCount,
+      externalAbort: runState.externalAbort,
+      maxRetries,
+      lastToolName: runState.lastToolName,
+      structuredRetry,
+      contextCompactionDiagnostics: runState.compaction.diagnostics,
+    });
+    const errorDetails = buildErrorDetails({
+      errorMessage,
+      stopReason,
+      lastToolName: runState.lastToolName,
+      toolResultsSeen: runState.toolResultsSeen,
+      turnCount: runState.turnCount,
+      runAssistantCount,
+      maxTurnsHit: runState.maxTurnsHit,
+      providerSessionId,
+      structuredRetry,
+      contextCompactionDiagnostics: runState.compaction.diagnostics,
+    });
 
     const capabilitiesUsed = buildCapabilitiesUsed({
       promptCacheActive: usage.cacheRead > 0 || usage.cacheWrite > 0,
@@ -1239,199 +646,101 @@ export async function generatePiNativeResponse(systemPrompt, options = {}) {
       toolCompactionApplied: toolCompactionAppliedFromWarnings(runtimeWarnings),
       // Tristate: true = a compaction fired this run (proactive or reactive),
       // false = the path is enabled but did not need to fire, null = disabled via
-      // agent_compaction_enabled. See docs/feature-registry.md runtime.context-compaction.
-      contextCompactionApplied: compactionPolicy?.enabled ? contextCompactionApplied : null,
+      // agent_compaction_enabled. See docs/reference/feature-registry.md runtime.context-compaction.
+      contextCompactionApplied: runState.compaction.policy?.enabled ? runState.compaction.applied : null,
     });
-    onEvent({ type: "capabilities_resolved", sdk: resolved.sdk, model: reference, capabilitiesUsed });
+    emitCapabilitiesResolved(onEvent, { sdk: resolved.sdk, model: reference, capabilitiesUsed });
 
     // Re-check the abort signal: a cancel can land during the post-run work above
     // (live-input teardown, structured-output finalization retry) after the line
     // ~780 check. Pick it up here so the lifecycle decision below rolls back the
     // cancelled turn instead of committing it into a durable transcript a later
     // resume would replay.
-    externalAbort ||= !!options.abortSignal?.aborted;
+    runState.externalAbort ||= !!options.abortSignal?.aborted;
 
     // Session lifecycle parity with the legacy bridge. The harness already
     // durably persisted the transcript into its session object (in-memory for
-    // the default repo, jsonl on disk when piSessionsRoot is set); the registry
+    // the default repo, jsonl on disk when piSessionsRoot is set); commitSession
     // tracks LIVENESS so disposeProviderSession / idle-TTL eviction can reach
-    // native sessions, and a resume miss reports session_not_found.
-    if (options.sessionKeepAlive === true && !externalAbort && !errorMessage) {
-      try {
-        if (sessionEntry) {
-          // Resumed run: the harness appended this run's turns onto the live
-          // session; just re-arm the idle window.
-          nativeSessions.touch(requestedSessionId, { idleTimeoutMs: sessionTtlMs });
-          // Surface a write failure the harness swallowed: a session that can
-          // no longer persist must not pretend to be resumable.
-          await session.buildContext();
-        } else {
-          const metadata = await session.getMetadata();
-          nativeSessions.set(providerSessionId, {
-            session,
-            metadata,
-            repo: durableRepo || nativeSessionRepo,
-            durable: !!durableRepo,
-            busy: false,
-          }, { idleTimeoutMs: sessionTtlMs });
-        }
-      } catch (err) {
-        // Session persistence must never fail the run; drop the (now
-        // inconsistent) session instead of resuming from a broken transcript.
-        onEvent({
-          type: "runtime_warning",
-          warning_kind: "pi_session_persist_failed",
-          message: err?.message || String(err),
-        });
-        nativeSessions.delete(providerSessionId);
-        if (requestedSessionId) nativeSessions.delete(requestedSessionId);
-        const broken = sessionEntry;
-        if (broken) {
-          try { await broken.repo.delete(broken.metadata); } catch { /* best-effort */ }
-        }
-      }
-    } else if (sessionEntry) {
-      // Resumed run that errored (or was aborted): roll the live session back to
-      // the leaf captured before this turn so the failed turn never leaks into a
-      // later resume. The next resume then sees the last good transcript. The
-      // entry stays live (busy is cleared in finally) and its idle TTL re-arms.
-      if (baselineLeafId && (errorMessage || externalAbort)) {
-        try { await session.moveTo(baselineLeafId); } catch { /* best-effort */ }
-      }
-      nativeSessions.touch(requestedSessionId, { idleTimeoutMs: sessionTtlMs });
-    } else {
-      // Fresh, non-keep-alive (or failed first) run: never leave a live session
-      // behind. A durable jsonl transcript on disk is dropped too, matching the
-      // legacy default contract that a non-keep-alive run is not resumable.
-      // A create-on-miss BUSY placeholder (R8) is keyed under
-      // requestedSessionId === providerSessionId; drop it here too so a
-      // non-keep-alive / errored / aborted first turn never leaks a busy entry
-      // (the success keep-alive path overwrites it with the finalized entry, so
-      // it is only this drop branch that must clean it up).
-      if (createdOnMissPlaceholder) nativeSessions.delete(providerSessionId);
-      try {
-        await (durableRepo || nativeSessionRepo).delete(await session.getMetadata());
-      } catch { /* best-effort */ }
-    }
+    // native sessions, keep-alive registers the session, and a failed/aborted
+    // resumed turn rolls back to its pre-turn leaf.
+    await commitSession(runState, {
+      options,
+      requestedSessionId,
+      providerSessionId,
+      durableRepo,
+      sessionTtlMs,
+      externalAbort: runState.externalAbort,
+      errorMessage,
+      onEvent,
+    });
 
     // Final abort guard (durable cancel TOCTOU): if a cancel raced the lifecycle
     // commit above — landing AFTER the keep-alive/!externalAbort decision but
     // before this return — the cancelled turn is still in the durable transcript
     // and (for keep-alive) the live registry. Roll it back so the next resume sees
-    // the pre-turn state: a resumed session moves to its baseline leaf and drops
-    // its live entry; a fresh durable session deletes its jsonl. There is no await
-    // between here and the return, so an external cancel cannot newly fire past it.
-    if (!externalAbort && options.abortSignal?.aborted) {
-      externalAbort = true;
-      if (sessionEntry) {
-        if (baselineLeafId) {
-          try { await session.moveTo(baselineLeafId); } catch { /* best-effort */ }
-        }
-        nativeSessions.delete(requestedSessionId);
-      } else {
-        nativeSessions.delete(providerSessionId);
-        try { await (durableRepo || nativeSessionRepo).delete(await session.getMetadata()); } catch { /* best-effort */ }
-      }
+    // the pre-turn state (rollbackAbortedTurn: a resumed session moves to its
+    // baseline leaf and drops its live entry; a fresh durable session deletes its
+    // jsonl). The abort re-check + return stay inline with NO await between the
+    // false-branch check and the return, so an external cancel cannot newly fire
+    // past it (I10).
+    if (!runState.externalAbort && options.abortSignal?.aborted) {
+      runState.externalAbort = true;
+      await rollbackAbortedTurn(runState, { requestedSessionId, providerSessionId, durableRepo });
     }
 
-    return {
-      text: finalText,
-      thinking: finalThinking,
+    return buildSuccessResult({
+      finalText,
+      finalThinking,
       events,
-      usage: {
-        input_tokens: usage.input || null,
-        output_tokens: usage.output || null,
-        cache_read_tokens: usage.cacheRead || null,
-        cache_creation_tokens: usage.cacheWrite || null,
-        cache_write_tokens: usage.cacheWrite || null,
-        cost_usd: usage.cost || estimatedCost,
-      },
-      durationMs: Date.now() - start,
-      numTurns: turnCount || runAssistantCount,
-      model: resolved.reference || `pi:${resolved.provider}:${resolved.model}`,
-      effort: options.effort || null,
-      sdk: resolved.sdk,
-      cancelled: externalAbort,
-      error: errorMessage,
+      usage,
+      estimatedCost,
+      start,
+      turnCount: runState.turnCount,
+      runAssistantCount,
+      resolved,
+      options,
+      externalAbort: runState.externalAbort,
+      errorMessage,
       errorDetails,
-      failureKind: errorMessage
-        ? failureKindForPiError(errorMessage, diagnostics, { maxTurnsHit })
-        : null,
+      diagnostics,
+      maxTurnsHit: runState.maxTurnsHit,
       providerSessionId,
       runtimeWarnings,
-      diagnostics,
       capabilitiesUsed,
-      ...(structuredResult !== null && structuredResult !== undefined
-        ? { structuredResult, structuredResultSource: "StructuredOutput" }
-        : { structuredResult: undefined, structuredResultSource: null }),
-    };
+      structuredResult: runState.structuredResult,
+    });
   } catch (err) {
-    externalAbort ||= !!options.abortSignal?.aborted;
-    // Drop a just-created FRESH durable session so a setup/run failure does not
-    // leave a resumable orphan jsonl on disk (the success path drops it at ~905;
-    // the catch must mirror that). Guarded: `session && !sessionEntry` fires only
-    // for fresh runs that actually created a session — NEVER for resumes
-    // (sessionEntry is non-null only on resume; deleting a resumed user session
-    // here would be data loss) and never when the throw preceded session create.
-    if (session && !sessionEntry) {
-      try { await (durableRepo || nativeSessionRepo).delete(await session.getMetadata()); } catch { /* best-effort */ }
-    }
-    // Drop a create-on-miss BUSY placeholder (R8) left in the registry by a throw
-    // during/after the reservation — including a throw inside the create await
-    // itself, where `session` is still null so the jsonl-delete above is skipped.
-    // Keyed under requestedSessionId === providerSessionId; never set on a resume
-    // (sessionEntry would be non-null), so this never deletes a live user session.
-    if (createdOnMissPlaceholder && !sessionEntry) nativeSessions.delete(providerSessionId);
-    // Resumed-session rollback for host/runtime-side throws (e.g. a throwing
-    // custom pricing resolver / bridge event callback) that land here AFTER the
-    // harness already mutated the live session. Mirrors the success-path
-    // rollback at ~:925-932: move the live session back to the pre-turn leaf so
-    // the failed turn never leaks into a later resume. Gated on `sessionEntry &&
-    // baselineLeafId` so it only fires for resumes that captured a baseline.
-    if (sessionEntry && baselineLeafId) {
-      try { await session.moveTo(baselineLeafId); } catch { /* best-effort */ }
-    }
+    runState.externalAbort ||= !!options.abortSignal?.aborted;
+    // Drop a just-created fresh durable session, release a create-on-miss
+    // reservation placeholder, and roll a resumed session back to its pre-turn
+    // leaf for host/runtime-side throws that landed after the harness already
+    // mutated the live session (guards preserved in cleanupSessionOnThrow).
+    await cleanupSessionOnThrow(runState, { durableRepo });
     const errorMessage = normalizePiErrorMessage(err?.message || String(err));
     const isRetryable = retryableProviderFailureInfo({
       errorText: errorMessage,
       failureKind: "provider_unavailable",
     }).retryable;
-    return {
-      text: assistantTexts.join("") || null,
+    return buildErrorResult({
+      assistantTexts: runState.assistantTexts,
       events,
-      usage: {},
-      durationMs: Date.now() - start,
-      numTurns: turnCount,
-      model: resolved?.reference || resolved?.model || null,
-      effort: options.effort || null,
-      sdk: resolved?.sdk || "pi",
-      cancelled: externalAbort,
-      error: externalAbort ? null : errorMessage,
-      errorDetails: externalAbort ? null : {
-        pi_stop_reason: "error",
-        last_tool_name: lastToolName,
-        tool_results_seen: toolResultsSeen,
-        turn_count: turnCount,
-        max_turns_hit: maxTurnsHit,
-        provider_session_id: providerSessionId,
-        pi_engine: "native",
-        pi_error_retryable: isRetryable,
-      },
-      failureKind: externalAbort ? null : failureKindForPiError(errorMessage, {}, { maxTurnsHit }),
+      start,
+      turnCount: runState.turnCount,
+      resolved,
+      options,
+      externalAbort: runState.externalAbort,
+      errorMessage,
+      lastToolName: runState.lastToolName,
+      toolResultsSeen: runState.toolResultsSeen,
+      maxTurnsHit: runState.maxTurnsHit,
       providerSessionId,
       runtimeWarnings,
-      diagnostics: {
-        provider_session_id: providerSessionId,
-        pi_stop_reason: externalAbort ? "aborted" : "error",
-        pi_engine: "native",
-        max_turns_hit: maxTurnsHit,
-        turn_count: turnCount,
-        external_abort: externalAbort,
-      },
-    };
+      isRetryable,
+    });
   } finally {
-    if (sessionEntry) sessionEntry.busy = false;
-    removeAbortHandler?.();
+    if (runState.sessionEntry) runState.sessionEntry.busy = false;
+    runState.removeAbortHandler?.();
     await closePiMcpClients(mcpClients);
   }
 }