@namzu/sdk 42.0.0 → 42.0.2

package/CHANGELOG.md

@@ -1,5 +1,227 @@
 # Changelog
 
+## 42.0.2
+
+### Patch Changes
+
+- 175dab2: Nothing a consumer installs changes. These are devDependencies and toolchain
+  pins: no runtime dependency, export, type or default moved, and the published
+  surface is identical.
+
+  Four advisories, all dev-time, closed by moving the package that carried them
+  rather than by patching around them:
+
+  - `knip` `^6.4.1` → `^6.37.0`, which carries `smol-toml` ≥ 1.8.0 — the version
+    that fixes `GHSA-7w5x-hrqm-74c2` (a malformed-TOML denial of service).
+  - `tsx` `^4.19.0` → `^4.23.13`, which depends on `esbuild ~0.28.0`, fixing
+    `GHSA-g7r4-m6w7-qqqr` (arbitrary file read from the development server, and
+    only on Windows) — and collapsing two `esbuild` copies in the tree into one.
+  - `js-yaml`, twice, fixed by a workspace override rather than a parent upgrade,
+    because both copies arrive deep inside the Changesets CLI's own tree:
+    `^3.15.2` for the 3.x line and `^4.3.2` for the 4.x line, closing
+    `GHSA-2883-xcg3-v3hh` (a merge-key CPU exhaustion). Neither override widens
+    beyond what the parent already declared — `3.15.2` satisfies `^3.13.1` and
+    `4.3.2` satisfies `^4.1.0` — so no package is forced outside its range.
+
+- 8d5223b: Nothing a consumer installs or calls changes, and that is the whole of this
+  release. `vitest` moves from `^3.2.6` to `^4.1.11` in the `devDependencies` of
+  all nineteen packages that declared it, and `@vitest/coverage-v8` moves with it
+  in `@namzu/sdk`. Every occurrence is a devDependency — checked, not assumed —
+  so `dependencies`, `peerDependencies`, exports, types, defaults and the wire
+  shape are untouched, and the published tarballs differ from the previous
+  release only in `package.json#devDependencies`.
+
+  The reason is a security fix with no 3.x backport. `GHSA-82fw-gwwq-j7x9`
+  ("Path Traversal / Arbitrary File Read via `@vitest/mocker` Redirect Mock")
+  covers `vitest` and `@vitest/mocker` from `2.1.0` up to `4.1.11`, so `^3.2.6`
+  can only be resolved by leaving the 3.x line. `4.1.11` is the first patched
+  release and is what the lockfile now resolves for both.
+
+  What this costs anyone who works on the repository rather than with it: the
+  upgrade was not a version bump. Vitest 4 changed test discovery, coverage
+  configuration, mock construction and reporter output, and each of those broke
+  something here that had to be migrated rather than worked around. Those fixes
+  are all under `__tests__/`, `vitest.config.ts` files and `scripts/`, none of
+  which is published, which is why this is a patch and not a major.
+
+  You do not need to do anything. If you pin `vitest` yourself to run this
+  project's own suites, note that the config files it ships are now written for
+  `>= 4.1.11` and will not run under 3.x.
+
+## 42.0.1
+
+### Patch Changes
+
+- 325cc6a: Internal module layout only. `query()`'s prelude, its pre-start cancellation
+  path, its post-loop settlement and its cleanup, the iteration loop's
+  outstanding-work and step-shaping helpers, and the executor's tool-call
+  admission family now live in their own modules —
+  `runtime/query/prepare-run.ts`, `runtime/query/cancelled-before-start.ts`,
+  `runtime/query/finalize-run.ts`, `runtime/query/release-run.ts`,
+  `runtime/query/iteration/outstanding-work.ts`,
+  `runtime/query/iteration/step-shaping.ts` and
+  `runtime/query/executor/tool-call-admission.ts` — instead of inside
+  `index.ts`, `iteration/index.ts` and `executor.ts`.
+
+  Nothing a consumer observes changes, so taking the upgrade requires no code
+  change: no export is added, removed or renamed; the `RunEvent` stream carries
+  the same events in the same order; and budget, checkpoint, HITL and run
+  lifecycle semantics are untouched. The one shared module surface that moved
+  is the settle-grace policy (`settleGraceMs` / `awaitedJobGraceMs`'s home —
+  re-exported from `iteration/index.ts`, so its importers are unaffected).
+
+- d77fbc2: Four defects in query orchestration, all `patch`. Two change observable
+  behaviour; two do not, and none of the four adds an export, removes one,
+  narrows a union or changes a default.
+
+  **A Stop now takes effect while a run is parked on plan approval.** The plan
+  gate awaited the host's `resumeHandler` directly, where the tool-review and
+  iteration-checkpoint parks race it against the run's abort signal, so a run
+  parked on plan approval ignored a Stop until the host answered — and the plan
+  gate runs in the iteration loop rather than inside a tool call, so nothing
+  bounded the wait. A Stop now resolves that park as an `abort` decision, which
+  settles the run as `cancelled` with `stopReason: 'cancelled'`, the same
+  resolution the other two parks have produced since the abort race was added to
+  them.
+
+  This is `patch` and not `minor` deliberately, so the reasoning is on the
+  record rather than implied: a host that was relying on the old behaviour was
+  relying on a hang, which is exactly the defect the abort race was introduced
+  to remove from the other two parks, and nothing about the parked state
+  changes shape — same `HITLDecisionRequest`, same `CheckpointId`, same
+  `HITLResumeDecision` union, and a `stopReason` that already existed. A parked
+  plan is still recorded durably before the await, and the Stop RESOLVES that
+  row as `{action: 'abort'}` — so `findPendingCheckpoint` stops serving the
+  plan, the run reads `cancelled`, and the park survives only as a resolved row
+  in `listCheckpoints`, carrying the request and the `abort` that ended it. A
+  host that needs the question to stay open must therefore park the decision
+  itself before calling `query()` and answer from its own queue, which is the
+  same posture this asks of a host on the other two parks.
+
+  **An abandoned run's record is terminal — unless a human is still being
+  asked.** A host that leaves the stream early — `for await (… ) break`, or
+  `gen.return()` — ran the run's teardown and stopped short of `finalize()`.
+  Since `finalize()` is the only caller of `RunPersistence.persist()`, the
+  durable record was whatever `init()` wrote, which is not a terminal state:
+  `deriveRunStatus` read it back as `queued`, work waiting to start, for a run
+  whose jobs were killed and whose sandbox was destroyed. Such a run is now
+  recorded `cancelled`. There is no new `RunExecutionStatus`, no new
+  `StopReason` and no new event — there is no consumer left to emit one to, and
+  the run did not fail, so `failed` would name an error that never happened.
+
+  A run whose consumer left while a park was OUTSTANDING is the exception, and
+  deliberately so: a park is a promise to a human, that run is resumable, and
+  `deriveRunStatus` reads a terminal status before it reads the park — so
+  writing `cancelled` there would have turned `awaiting_hitl` into `cancelled`
+  for a run somebody still owes an answer. The durable state decides, not the
+  in-memory state, because `handleHITLDecision` emits `run_paused` and drains it
+  BEFORE it sets its stop reason: a consumer that leaves on that event leaves a
+  run whose status is `running` and whose stop reason is unset at the instant
+  its park is already durable. Such a run is left exactly as it stands — no
+  verdict and no write, since the park row is its durable state — and a host
+  clears it by answering the park or by `expire`-ing an expired one.
+
+  What is durable here is the STATUS: measured against a real `RunDiskStore`,
+  `run.json` goes from `status: 'idle'` to `status: 'cancelled'` with an
+  `endedAt` for the mid-flight case, and stays non-terminal for the parked one.
+  `run.json` carries neither `stopReason` nor `result` for any run today, so the
+  `stopReason: 'cancelled'` that `markCancelled()` sets in memory is not written
+  there either: that is a separate defect, fixed separately, and nothing in this
+  change depends on it.
+
+  **A park answered by a resumed run is resolved, for the plan arm too.** The
+  resume path resolves the park its decision answers; the set of park/decision
+  pairs it covered named one park per condition, and the `plan_approval` arm was
+  missing — a run resumed with `{action: 'approve_plan'}` COMPLETED with its
+  park still outstanding, so a host was told a human still owed it an answer, a
+  second resume of the finished run was refused `awaiting-decision`, and with no
+  `hitlParkTtlMs` no `deadlineAt` existed either, leaving the row beyond
+  `expire` and beyond prune. Both plan verdicts now answer the park, through one
+  map from park type to answering decision so an arm cannot go missing by being
+  absent from a condition again. Resolving it does not depend on the resumed
+  process being able to act on it: nothing restores a plan on the resume path,
+  which is its own defect, and gating this on it would leave the row outstanding
+  for exactly the runs that need it cleared.
+
+  **Pruning no longer deletes a checkpoint a host is still waiting on.** With
+  `runConfig.pruneKeepLast` set, `CheckpointManager.prune` deleted the oldest
+  checkpoints by `createdAt` with no test for an unresolved park, while
+  `findPendingCheckpoint` and `listExpiredParks` in the same file treat one as
+  the thing a host is waiting on. A checkpoint carrying an unanswered question
+  is the row an approval queue serves, and collecting it deleted the question.
+  Prune still keeps the newest `keepLast` — the run's resume point is never at
+  risk — and now skips any candidate whose park is unresolved, so pruning
+  briefly holds a few more rows while a park is outstanding. A host that never
+  sets `pruneKeepLast` is unaffected entirely: that gate still means "never
+  prune". Expired parks are skipped too; the sweep for those is `expire`, which
+  resolves the park and keeps the record.
+
+  **The `executeBatch` docblock no longer claims a guarantee the throwing path
+  does not provide.** It said every `tool_use` is answered "by construction".
+  That holds for every path that returns — denials, approvals, a rejected
+  batch, a partial failure the fill-the-holes loop closes — and not for a call
+  that throws: `serial = serial.then(run)` means one rejection skips every
+  later serial call, so `Promise.all` rejects, the fill-the-holes loop never
+  runs, the batch produces no messages at all and the assistant turn keeps its
+  `tool_use` blocks unanswered for a resume to repair. The comment now says so.
+  No behaviour changed here; the guarantee was never provided on that path and
+  the run-level outcome is unchanged.
+
+  **One test that measured the machine instead of the code is de-flaked, with
+  no behaviour change at all.** `the-window-is-asked-once.test.ts`'s "falls
+  back and runs when metadata stays pending" drove a run with `timeoutMs: 20`
+  — which is simultaneously the run's budget and the context-window resolver's
+  private deadline — and then asserted that the run settled inside a 1000 ms
+  poll. The two 20 ms deadlines raced on a real clock: the run's own seam
+  checks could see the budget already spent by the very wait the deadline
+  exists to end, so the case failed in BOTH directions — no model request at
+  all, and a second one after the stream was cut — in three of five full-suite
+  runs, while passing every time on its own. It now runs under a fake clock
+  advanced exactly once, by exactly the deadline, and reads the resolver's
+  aborted signal before it waits on anything. The assertions are the same
+  ones, and none of them rests on a wall clock.
+
+  **Two more park defects, fixed on the same branch the same day, so this
+  changeset covers SIX fixes and all six are `patch` for the same reasons.**
+  The four above are the ones the branch opened with; these are the two the
+  tests that pinned them reported.
+
+  **An answered park is now resolved when the answer arrives across a
+  restart.** A run that paused at an iteration checkpoint, was resumed with
+  `{action: 'continue'}` and then COMPLETED kept the park outstanding on the
+  record forever: `planPendingResume` applies a decision only to a
+  `tool_review` or `user_question` park — an `iteration_checkpoint` park leaves
+  no unanswered tool call for a decision to reach — so the unpark never ran for
+  it. That was observable through two exports. `findPendingCheckpoint` (and
+  `CheckpointManager.findPending()`) kept returning a question nobody was
+  waiting on, and a second `resumeRun` of the finished run was refused with
+  `reason: 'awaiting-decision'` for a decision already taken. With
+  `runConfig.pruneKeepLast` set there was a third consequence, and it was the
+  worst one: `prune` skips an unresolved park, so the row could no longer be
+  collected by anything. Such a park is now resolved the way every other arm
+  resolves one — the record stays, the request stays on it, and only its
+  `pending` state ends. A `pause` is still not an answer: it holds the park, so
+  a resume that answers `pause` leaves it standing, exactly as the live path
+  does.
+
+  **A park whose batch crash recovery answered no longer records the human's
+  decision as its answer.** When the parked call's outcome could not be
+  established, recovery answered the batch with explicitly unknown outcomes and
+  the park was still written down as decided by whatever the human had said —
+  `{action: 'continue'}` on a park whose calls were never executed and never
+  approved. It is resolved either way, because leaving it outstanding would let
+  `findPendingCheckpoint` serve it as the newest park and a resume would then
+  rewind the run to the checkpoint the crash happened on. What changed is what
+  the record SAYS: it now carries `{action: 'pause'}` with a reason naming what
+  ended it, which is the shape `CheckpointManager.expire` already uses for "this
+  park ended and no decision was carried out" — `abort` was rejected there for
+  reading as somebody having refused it, and the same holds here. A consumer
+  that reads `pending.decision` as the audit of who approved what sees the
+  difference, so it is stated: a `pause` with a reason about crash recovery
+  means the answer you gave was recorded on the park but not applied by it. The
+  action the human took is still named in that reason. No export was added or
+  removed, no union widened or narrowed, no default changed.
+
 ## 42.0.0
 
 ### Major Changes

package/dist/manager/resident/outbox.d.ts

@@ -42,10 +42,10 @@ export declare const residentOutboxMessageSchema: z.ZodEffects<z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     id: string;
     phase: "pending" | "cancelled" | "sending" | "acknowledged";
-    revision: number;
-    attempts: number;
     tenantId: string;
     body: string;
+    revision: number;
+    attempts: number;
     agentKey: string;
     pursuitId: string;
     claimId: string | null;
@@ -59,10 +59,10 @@ export declare const residentOutboxMessageSchema: z.ZodEffects<z.ZodObject<{
 }, {
     id: string;
     phase: "pending" | "cancelled" | "sending" | "acknowledged";
-    revision: number;
-    attempts: number;
     tenantId: string;
     body: string;
+    revision: number;
+    attempts: number;
     agentKey: string;
     pursuitId: string;
     claimId: string | null;
@@ -76,10 +76,10 @@ export declare const residentOutboxMessageSchema: z.ZodEffects<z.ZodObject<{
 }>, {
     id: string;
     phase: "pending" | "cancelled" | "sending" | "acknowledged";
-    revision: number;
-    attempts: number;
     tenantId: string;
     body: string;
+    revision: number;
+    attempts: number;
     agentKey: string;
     pursuitId: string;
     claimId: string | null;
@@ -93,10 +93,10 @@ export declare const residentOutboxMessageSchema: z.ZodEffects<z.ZodObject<{
 }, {
     id: string;
     phase: "pending" | "cancelled" | "sending" | "acknowledged";
-    revision: number;
-    attempts: number;
     tenantId: string;
     body: string;
+    revision: number;
+    attempts: number;
     agentKey: string;
     pursuitId: string;
     claimId: string | null;

package/dist/manager/resident/store.d.ts

@@ -68,8 +68,8 @@ export declare const residentStateSchema: z.ZodEffects<z.ZodObject<{
     phase: "running" | "complete" | "blocked" | "waiting";
     identity: string;
     reason: string;
-    revision: number;
     tenantId: string;
+    revision: number;
     objective: string;
     wakeAt: number | null;
     agentKey: string;
@@ -85,8 +85,8 @@ export declare const residentStateSchema: z.ZodEffects<z.ZodObject<{
     phase: "running" | "complete" | "blocked" | "waiting";
     identity: string;
     reason: string;
-    revision: number;
     tenantId: string;
+    revision: number;
     objective: string;
     wakeAt: number | null;
     agentKey: string;
@@ -102,8 +102,8 @@ export declare const residentStateSchema: z.ZodEffects<z.ZodObject<{
     phase: "running" | "complete" | "blocked" | "waiting";
     identity: string;
     reason: string;
-    revision: number;
     tenantId: string;
+    revision: number;
     objective: string;
     wakeAt: number | null;
     agentKey: string;
@@ -119,8 +119,8 @@ export declare const residentStateSchema: z.ZodEffects<z.ZodObject<{
     phase: "running" | "complete" | "blocked" | "waiting";
     identity: string;
     reason: string;
-    revision: number;
     tenantId: string;
+    revision: number;
     objective: string;
     wakeAt: number | null;
     agentKey: string;

package/dist/runtime/query/cancelled-before-start.d.ts

@@ -0,0 +1,34 @@
+import type { RunPersistence } from '../../manager/run/persistence.js';
+import type { FencingToken } from '../../types/run/checkpoint-store.js';
+import type { RunEventCursor, RunEventReplay } from '../../types/run/event-cursor.js';
+import type { Run, RunEvent } from '../../types/run/index.js';
+import type { QueryParams } from './index.js';
+import type { PreparedRun } from './prepare-run.js';
+/**
+ * The run that was cancelled before it started.
+ *
+ * Attachment materialization happens before `RunContext` exists, and a
+ * cancellation observed there still belongs to a run: it must be recorded,
+ * classified and reported like any other, without any of the authority-bearing
+ * work — prompt contributions, host callbacks, tools, plugins, sandbox,
+ * guardrails, advisors, providers — that a run which is allowed to proceed
+ * would do next.
+ *
+ * An `async function*` rather than a plain async function, and reached with
+ * `yield*`, because this path still emits and drains: the events it produces
+ * must occupy exactly the positions in the stream they occupied when the code
+ * lived inline, and only delegation preserves every yield point.
+ */
+export declare function settlePreStartCancellation(params: QueryParams, prepared: PreparedRun): AsyncGenerator<RunEvent, Run>;
+/**
+ * Hand a returning consumer what it missed, or tell it why it cannot have it.
+ *
+ * Yields NOTHING on a refusal. A partial catch-up is the failure this exists to
+ * prevent: a consumer that receives some of the gap folds it into its state and
+ * cannot tell the state is wrong, where one that receives an explicit
+ * `unavailable` re-derives from the transcript and is right. The run continues
+ * either way — a stale cursor belongs to the client, and must not be able to
+ * stop the work.
+ */
+export declare function catchUpFromCursor(runMgr: RunPersistence, cursor: RunEventCursor, onEventReplay: ((replay: RunEventReplay) => void) | undefined, generation: FencingToken | undefined, onReplayObserverError: (error: unknown) => void): AsyncGenerator<RunEvent, void>;
+//# sourceMappingURL=cancelled-before-start.d.ts.map

package/dist/runtime/query/cancelled-before-start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancelled-before-start.d.ts","sourceRoot":"","sources":["../../../src/runtime/query/cancelled-before-start.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AAItE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAA;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AAErF,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AAE7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAGnD;;;;;;;;;;;;;;GAcG;AACH,wBAAuB,0BAA0B,CAChD,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,WAAW,GACnB,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAiH/B;AAED;;;;;;;;;GASG;AACH,wBAAuB,iBAAiB,CACvC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,cAAc,EACtB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC,GAAG,SAAS,EAC7D,UAAU,EAAE,YAAY,GAAG,SAAS,EACpC,qBAAqB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAC7C,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CA0BhC"}

package/dist/runtime/query/cancelled-before-start.js

@@ -0,0 +1,152 @@
+import { GENAI, NAMZU, agentRunSpanName, parentContext } from '../../telemetry/attributes.js';
+import { getTracer } from '../../telemetry/runtime-accessors.js';
+import { createSystemMessage } from '../../types/message/index.js';
+import { resolveRunEventReplay } from '../../types/run/event-cursor.js';
+import { toErrorMessage } from '../../utils/error.js';
+import { ResultAssembler } from './result.js';
+/**
+ * The run that was cancelled before it started.
+ *
+ * Attachment materialization happens before `RunContext` exists, and a
+ * cancellation observed there still belongs to a run: it must be recorded,
+ * classified and reported like any other, without any of the authority-bearing
+ * work — prompt contributions, host callbacks, tools, plugins, sandbox,
+ * guardrails, advisors, providers — that a run which is allowed to proceed
+ * would do next.
+ *
+ * An `async function*` rather than a plain async function, and reached with
+ * `yield*`, because this path still emits and drains: the events it produces
+ * must occupy exactly the positions in the stream they occupied when the code
+ * lived inline, and only delegation preserves every yield point.
+ */
+export async function* settlePreStartCancellation(params, prepared) {
+    const { ctx, runConfig, eventTranslator, executeUserInterruptHooks, selectedResumeState, queuedForThisRun, initialMessages, } = prepared;
+    // Attachment materialization happens before RunContext exists. Once it
+    // observes cancellation, do only the work required to leave an honest
+    // durable run: initialize the record, retain the unresolved references,
+    // and settle through the ordinary cancellation classifier. Prompt
+    // contributions/cache, host callbacks, tools, plugins, sandbox, guardrails,
+    // advisors, and providers are all authority-bearing work and stay out.
+    // The dedicated root interrupt notification is the sole plugin exception:
+    // it runs after cancellation under its own deadline and cannot regain model
+    // or tool authority.
+    if (params.resumeFromCheckpoint && !selectedResumeState) {
+        // The canonical resume surface hands query the checkpoint state it
+        // already selected. A raw resume query has no such snapshot; after
+        // cancellation, reading the store again could hang without a signal,
+        // while persisting without it would erase the existing transcript.
+        // Refuse before binding/persisting rather than choose either failure.
+        ctx.abortController.signal.throwIfAborted();
+    }
+    const cancelledPrompt = params.systemPrompt ?? '';
+    const cancelledAssembler = new ResultAssembler({
+        runMgr: ctx.runMgr,
+        planManager: ctx.planManager,
+        activityStore: ctx.activityStore,
+        log: ctx.log,
+        emitEvent: eventTranslator.emitEvent,
+        drainPending: () => eventTranslator.drainPending(),
+        signal: ctx.abortController.signal,
+    });
+    const rootSpan = getTracer().startSpan(agentRunSpanName(params.agentName), {}, parentContext(params.parentSpan ?? selectedResumeState?.traceContext));
+    rootSpan.setAttributes({
+        [NAMZU.RUN_ID]: ctx.runMgr.id,
+        [GENAI.AGENT_NAME]: params.agentName,
+        [GENAI.AGENT_ID]: params.agentId,
+        [GENAI.REQUEST_MODEL]: runConfig.model,
+        [GENAI.SYSTEM]: params.provider.id,
+    });
+    try {
+        await ctx.runMgr.init();
+        if (selectedResumeState) {
+            ctx.runMgr.restoreUsage(selectedResumeState.tokenUsage, selectedResumeState.costInfo, selectedResumeState.currentIteration);
+            for (const message of selectedResumeState.messages)
+                ctx.runMgr.pushMessage(message);
+            for (const queued of queuedForThisRun)
+                ctx.runMgr.pushMessage(queued);
+        }
+        else if (params.continuationMode) {
+            for (const message of initialMessages)
+                ctx.runMgr.pushMessage(message);
+        }
+        else {
+            ctx.runMgr.pushMessage(createSystemMessage(cancelledPrompt, 'cache'));
+            for (const message of initialMessages)
+                ctx.runMgr.pushMessage(message);
+        }
+        if (params.eventCursor) {
+            yield* catchUpFromCursor(ctx.runMgr, params.eventCursor, params.onEventReplay, params.claimFence, (error) => {
+                ctx.log.warn('Replay observer failed after attachment cancellation', {
+                    'exception.message': toErrorMessage(error),
+                });
+            });
+        }
+        if (selectedResumeState) {
+            await eventTranslator.emitEvent({
+                type: 'run_resuming',
+                runId: ctx.runId,
+                fromCheckpointId: selectedResumeState.checkpointId,
+            });
+            yield* eventTranslator.drainPending();
+        }
+        ctx.runMgr.markRunning();
+        await eventTranslator.emitEvent({
+            type: 'run_started',
+            runId: ctx.runId,
+            systemPrompt: cancelledPrompt,
+        });
+        yield* eventTranslator.drainPending();
+        ctx.abortController.signal.throwIfAborted();
+    }
+    catch (error) {
+        // Attachment resolution has already observed the caller's abort. A
+        // reconnect callback can still throw while replay is being reported,
+        // but it cannot replace that terminal cause or turn a cancelled run
+        // into an unpersisted rejection.
+        const terminalError = ctx.abortController.signal.aborted
+            ? ctx.abortController.signal.reason
+            : error;
+        await executeUserInterruptHooks(terminalError);
+        yield* eventTranslator.drainPending();
+        yield* cancelledAssembler.handleError(terminalError, rootSpan);
+    }
+    finally {
+        rootSpan.end();
+    }
+    return await cancelledAssembler.finalize();
+}
+/**
+ * Hand a returning consumer what it missed, or tell it why it cannot have it.
+ *
+ * Yields NOTHING on a refusal. A partial catch-up is the failure this exists to
+ * prevent: a consumer that receives some of the gap folds it into its state and
+ * cannot tell the state is wrong, where one that receives an explicit
+ * `unavailable` re-derives from the transcript and is right. The run continues
+ * either way — a stale cursor belongs to the client, and must not be able to
+ * stop the work.
+ */
+export async function* catchUpFromCursor(runMgr, cursor, onEventReplay, generation, onReplayObserverError) {
+    const missed = await runMgr.getRunStore().readEvents({ sinceSeq: cursor.sinceSeq });
+    const replay = resolveRunEventReplay(cursor, {
+        lastSeq: runMgr.lastEventSeq,
+        ...(generation !== undefined ? { generation } : {}),
+    }, missed);
+    if (onEventReplay) {
+        try {
+            // A callback typed `void` may still be implemented with `async` in
+            // TypeScript. Observe that runtime Promise so a late rejection cannot
+            // become process-wide, but never await host code here: replay delivery
+            // and an already-cancelled run must not inherit observer liveness.
+            const settlement = onEventReplay(replay);
+            void Promise.resolve(settlement).catch(onReplayObserverError);
+        }
+        catch (error) {
+            onReplayObserverError(error);
+        }
+    }
+    if (replay.status !== 'replayed')
+        return;
+    for (const event of replay.events)
+        yield event;
+}
+//# sourceMappingURL=cancelled-before-start.js.map

package/dist/runtime/query/cancelled-before-start.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancelled-before-start.js","sourceRoot":"","sources":["../../../src/runtime/query/cancelled-before-start.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAA;AAGlE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAGrD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,0BAA0B,CAChD,MAAmB,EACnB,QAAqB;IAErB,MAAM,EACL,GAAG,EACH,SAAS,EACT,eAAe,EACf,yBAAyB,EACzB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,GACf,GAAG,QAAQ,CAAA;IAEZ,uEAAuE;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,kEAAkE;IAClE,4EAA4E;IAC5E,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,qBAAqB;IACrB,IAAI,MAAM,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzD,mEAAmE;QACnE,mEAAmE;QACnE,qEAAqE;QACrE,mEAAmE;QACnE,sEAAsE;QACtE,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;IAC5C,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAA;IACjD,MAAM,kBAAkB,GAAG,IAAI,eAAe,CAAC;QAC9C,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,SAAS,EAAE,eAAe,CAAC,SAAS;QACpC,YAAY,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE;QAClD,MAAM,EAAE,GAAG,CAAC,eAAe,CAAC,MAAM;KAClC,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC,SAAS,CACrC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,EAClC,EAAE,EACF,aAAa,CAAC,MAAM,CAAC,UAAU,IAAI,mBAAmB,EAAE,YAAY,CAAC,CACrE,CAAA;IACD,QAAQ,CAAC,aAAa,CAAC;QACtB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;QAC7B,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,SAAS;QACpC,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,OAAO;QAChC,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,SAAS,CAAC,KAAK;QACtC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;KAClC,CAAC,CAAA;IAEF,IAAI,CAAC;QACJ,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,mBAAmB,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,YAAY,CACtB,mBAAmB,CAAC,UAAU,EAC9B,mBAAmB,CAAC,QAAQ,EAC5B,mBAAmB,CAAC,gBAAgB,CACpC,CAAA;YACD,KAAK,MAAM,OAAO,IAAI,mBAAmB,CAAC,QAAQ;gBAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YACnF,KAAK,MAAM,MAAM,IAAI,gBAAgB;gBAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACtE,CAAC;aAAM,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACpC,KAAK,MAAM,OAAO,IAAI,eAAe;gBAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QACvE,CAAC;aAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAA;YACrE,KAAK,MAAM,OAAO,IAAI,eAAe;gBAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QACvE,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,KAAK,CAAC,CAAC,iBAAiB,CACvB,GAAG,CAAC,MAAM,EACV,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,UAAU,EACjB,CAAC,KAAK,EAAE,EAAE;gBACT,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,sDAAsD,EAAE;oBACpE,mBAAmB,EAAE,cAAc,CAAC,KAAK,CAAC;iBAC1C,CAAC,CAAA;YACH,CAAC,CACD,CAAA;QACF,CAAC;QACD,IAAI,mBAAmB,EAAE,CAAC;YACzB,MAAM,eAAe,CAAC,SAAS,CAAC;gBAC/B,IAAI,EAAE,cAAc;gBACpB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,gBAAgB,EAAE,mBAAmB,CAAC,YAAY;aAClD,CAAC,CAAA;YACF,KAAK,CAAC,CAAC,eAAe,CAAC,YAAY,EAAE,CAAA;QACtC,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAA;QACxB,MAAM,eAAe,CAAC,SAAS,CAAC;YAC/B,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,YAAY,EAAE,eAAe;SAC7B,CAAC,CAAA;QACF,KAAK,CAAC,CAAC,eAAe,CAAC,YAAY,EAAE,CAAA;QACrC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,mEAAmE;QACnE,qEAAqE;QACrE,oEAAoE;QACpE,iCAAiC;QACjC,MAAM,aAAa,GAAG,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO;YACvD,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM;YACnC,CAAC,CAAC,KAAK,CAAA;QACR,MAAM,yBAAyB,CAAC,aAAa,CAAC,CAAA;QAC9C,KAAK,CAAC,CAAC,eAAe,CAAC,YAAY,EAAE,CAAA;QACrC,KAAK,CAAC,CAAC,kBAAkB,CAAC,WAAW,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;IAC/D,CAAC;YAAS,CAAC;QACV,QAAQ,CAAC,GAAG,EAAE,CAAA;IACf,CAAC;IAED,OAAO,MAAM,kBAAkB,CAAC,QAAQ,EAAE,CAAA;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,iBAAiB,CACvC,MAAsB,EACtB,MAAsB,EACtB,aAA6D,EAC7D,UAAoC,EACpC,qBAA+C;IAE/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;IACnF,MAAM,MAAM,GAAG,qBAAqB,CACnC,MAAM,EACN;QACC,OAAO,EAAE,MAAM,CAAC,YAAY;QAC5B,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,EACD,MAAM,CACN,CAAA;IAED,IAAI,aAAa,EAAE,CAAC;QACnB,IAAI,CAAC;YACJ,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,mEAAmE;YACnE,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;YACxC,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAA;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,qBAAqB,CAAC,KAAK,CAAC,CAAA;QAC7B,CAAC;IACF,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;QAAE,OAAM;IACxC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,KAAK,CAAA;AAC/C,CAAC"}

package/dist/runtime/query/checkpoint.d.ts

@@ -256,6 +256,27 @@ export declare class CheckpointManager {
      * full checkpoint payload. See ses_005-deterministic-replay design §3.1.
      */
     listEntries(): Promise<CheckpointListEntry[]>;
+    /**
+     * Collect old checkpoints until `keepLast` newer ones remain.
+     *
+     * Growth control, and growth control stops at a park. A checkpoint with
+     * an unresolved `pending` is the durable fact that a human was asked
+     * something: it is what `findPendingCheckpoint` serves to an approval
+     * queue and what `listExpiredParks` enumerates for a sweep. Collecting
+     * one deletes the only record of a question somebody may be in the middle
+     * of answering, and their answer then lands nowhere — the store refuses
+     * the unpark and the run it belonged to resumes without it.
+     *
+     * So the candidates are still the oldest `all.length - keepLast`, which
+     * is what keeps the newest `keepLast` — the run's resume point — out of
+     * reach, and a park among them is skipped rather than counted. Pruning
+     * therefore holds a few more rows while a park is outstanding. That is
+     * the right side to err on: parks resolve, and the next prune collects
+     * them. Expired ones are skipped too — the host's sweep is
+     * {@link expire}, which resolves the park by running out of time rather
+     * than by deleting the evidence, and `prune` racing it would take the
+     * question away before it was read.
+     */
     prune(keepLast: number): Promise<void>;
     static buildSummary(runMgr: RunPersistence, iteration: number): CheckpointSummary;
 }

package/dist/runtime/query/checkpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkpoint.d.ts","sourceRoot":"","sources":["../../../src/runtime/query/checkpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAE1E,OAAO,KAAK,EACX,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAoB,WAAW,EAAE,MAAM,8BAA8B,CAAA;AACjF,OAAO,KAAK,EACX,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,MAAM,qCAAqC,CAAA;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AACrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAmDpE;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,mBAAmB,GAAG,mBAAmB,CAQlF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,iBAAiB,GAAG,mBAAmB,CAyBzF;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAC1C,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAgBrC;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,SAAa,GAAG,OAAO,CAEjF;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACrC,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAMhC;AAED,qBAAa,iBAAiB;IAC7B,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,KAAK,CAAoB;IACjC;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB,CAAC,CAAwC;IACnE,OAAO,CAAC,uBAAuB,CAAC,CAA+B;IAC/D,OAAO,CAAC,mBAAmB,CAAC,CAAa;IACzC,OAAO,CAAC,0BAA0B,CAAC,CAAc;IACjD,OAAO,CAAC,sBAAsB,CAAI;IAClC,OAAO,CAAC,8BAA8B,CAAC,CAAc;IACrD,OAAO,CAAC,sBAAsB,CAAI;IAClC,OAAO,CAAC,8BAA8B,CAAC,CAAc;IACrD,OAAO,CAAC,sBAAsB,CAAI;IAElC;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa,CAAC,CAAc;IAEpC,kCAAkC;IAClC,OAAO,CAAC,WAAW,CAAC,CAAyC;IAE7D,8BAA8B;IAC9B,OAAO,CAAC,SAAS,CAAC,CAAQ;IAE1B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,UAAU,CAAC,CAAc;IAEjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,YAAY,CAAC,CAAQ;IAE7B;;;;;;OAMG;gBACS,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,kBAAkB;IAK7D,0EAA0E;IAC1E,qBAAqB,CAAC,MAAM,EAAE,MAAM,oBAAoB,GAAG,SAAS,GAAG,IAAI;IAI3E,qFAAqF;IACrF,0BAA0B,CAAC,MAAM,EAAE,MAAM,WAAW,GAAG,SAAS,GAAG,IAAI;IAIvE,IAAI,yBAAyB,IAAI,WAAW,GAAG,SAAS,CAEvD;IAED,6BAA6B,CAAC,MAAM,EAAE,MAAM,MAAM,GAAG,IAAI;IAGzD,IAAI,4BAA4B,IAAI,MAAM,CAEzC;IAED,iCAAiC,CAAC,MAAM,EAAE,MAAM,MAAM,GAAG,IAAI;IAG7D,IAAI,gCAAgC,IAAI,MAAM,CAE7C;IAED,iCAAiC,CAAC,MAAM,EAAE,MAAM,MAAM,GAAG,IAAI;IAI7D,IAAI,gCAAgC,IAAI,MAAM,CAE7C;IAED;;;;OAIG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,qBAAqB,GAAG,SAAS,GAAG,IAAI;IAI/D,MAAM,CACX,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;QACP,WAAW,CAAC,EAAE,KAAK,CAAC;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,OAAO,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QAC7F,YAAY,CAAC,EAAE,oBAAoB,CAAA;KACnC,GACC,OAAO,CAAC,mBAAmB,CAAC;IAyC/B,iCAAiC;IACjC,IAAI,gBAAgB,IAAI,YAAY,GAAG,SAAS,CAE/C;IAED;;;;;;;;;;;OAWG;IACG,gBAAgB,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC;IAS9F;;;;;;;;;;;;;;OAcG;IACG,IAAI,CACT,UAAU,EAAE,mBAAmB,EAC/B,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACnC,OAAO,CAAC,mBAAmB,CAAC;IAkB/B;;;;;;;OAOG;IACH,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI;IAIpD,uDAAuD;IACvD,IAAI,cAAc,IAAI,YAAY,GAAG,SAAS,CAE7C;IAED,uEAAuE;IACvE,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAI3C;;;;;;;OAOG;IACG,MAAM,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAkB7E;;;;;;;OAOG;IACG,MAAM,CACX,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,kBAAkB,GAC1B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAYtC;;;;;;;OAOG;IACG,WAAW,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAIlD,OAAO,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA4CjE,IAAI,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAI5C;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAK7C,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5C,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,iBAAiB;CAajF"}
+{"version":3,"file":"checkpoint.d.ts","sourceRoot":"","sources":["../../../src/runtime/query/checkpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAE1E,OAAO,KAAK,EACX,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAoB,WAAW,EAAE,MAAM,8BAA8B,CAAA;AACjF,OAAO,KAAK,EACX,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,MAAM,qCAAqC,CAAA;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AACrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAmDpE;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,mBAAmB,GAAG,mBAAmB,CAQlF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,iBAAiB,GAAG,mBAAmB,CAyBzF;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAC1C,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAgBrC;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,SAAa,GAAG,OAAO,CAEjF;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACrC,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAMhC;AAED,qBAAa,iBAAiB;IAC7B,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,KAAK,CAAoB;IACjC;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB,CAAC,CAAwC;IACnE,OAAO,CAAC,uBAAuB,CAAC,CAA+B;IAC/D,OAAO,CAAC,mBAAmB,CAAC,CAAa;IACzC,OAAO,CAAC,0BAA0B,CAAC,CAAc;IACjD,OAAO,CAAC,sBAAsB,CAAI;IAClC,OAAO,CAAC,8BAA8B,CAAC,CAAc;IACrD,OAAO,CAAC,sBAAsB,CAAI;IAClC,OAAO,CAAC,8BAA8B,CAAC,CAAc;IACrD,OAAO,CAAC,sBAAsB,CAAI;IAElC;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa,CAAC,CAAc;IAEpC,kCAAkC;IAClC,OAAO,CAAC,WAAW,CAAC,CAAyC;IAE7D,8BAA8B;IAC9B,OAAO,CAAC,SAAS,CAAC,CAAQ;IAE1B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,UAAU,CAAC,CAAc;IAEjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,YAAY,CAAC,CAAQ;IAE7B;;;;;;OAMG;gBACS,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,kBAAkB;IAK7D,0EAA0E;IAC1E,qBAAqB,CAAC,MAAM,EAAE,MAAM,oBAAoB,GAAG,SAAS,GAAG,IAAI;IAI3E,qFAAqF;IACrF,0BAA0B,CAAC,MAAM,EAAE,MAAM,WAAW,GAAG,SAAS,GAAG,IAAI;IAIvE,IAAI,yBAAyB,IAAI,WAAW,GAAG,SAAS,CAEvD;IAED,6BAA6B,CAAC,MAAM,EAAE,MAAM,MAAM,GAAG,IAAI;IAGzD,IAAI,4BAA4B,IAAI,MAAM,CAEzC;IAED,iCAAiC,CAAC,MAAM,EAAE,MAAM,MAAM,GAAG,IAAI;IAG7D,IAAI,gCAAgC,IAAI,MAAM,CAE7C;IAED,iCAAiC,CAAC,MAAM,EAAE,MAAM,MAAM,GAAG,IAAI;IAI7D,IAAI,gCAAgC,IAAI,MAAM,CAE7C;IAED;;;;OAIG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,qBAAqB,GAAG,SAAS,GAAG,IAAI;IAI/D,MAAM,CACX,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;QACP,WAAW,CAAC,EAAE,KAAK,CAAC;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,OAAO,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QAC7F,YAAY,CAAC,EAAE,oBAAoB,CAAA;KACnC,GACC,OAAO,CAAC,mBAAmB,CAAC;IAyC/B,iCAAiC;IACjC,IAAI,gBAAgB,IAAI,YAAY,GAAG,SAAS,CAE/C;IAED;;;;;;;;;;;OAWG;IACG,gBAAgB,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC;IAS9F;;;;;;;;;;;;;;OAcG;IACG,IAAI,CACT,UAAU,EAAE,mBAAmB,EAC/B,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACnC,OAAO,CAAC,mBAAmB,CAAC;IAkB/B;;;;;;;OAOG;IACH,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI;IAIpD,uDAAuD;IACvD,IAAI,cAAc,IAAI,YAAY,GAAG,SAAS,CAE7C;IAED,uEAAuE;IACvE,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAI3C;;;;;;;OAOG;IACG,MAAM,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAkB7E;;;;;;;OAOG;IACG,MAAM,CACX,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,kBAAkB,GAC1B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAYtC;;;;;;;OAOG;IACG,WAAW,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAIlD,OAAO,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA4CjE,IAAI,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAI5C;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAKnD;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY5C,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,iBAAiB;CAajF"}

package/dist/runtime/query/checkpoint.js

@@ -498,12 +498,35 @@ export class CheckpointManager {
         const checkpoints = await this.store.listCheckpoints(this.scope);
         return checkpoints.map(toCheckpointListEntry);
     }
+    /**
+     * Collect old checkpoints until `keepLast` newer ones remain.
+     *
+     * Growth control, and growth control stops at a park. A checkpoint with
+     * an unresolved `pending` is the durable fact that a human was asked
+     * something: it is what `findPendingCheckpoint` serves to an approval
+     * queue and what `listExpiredParks` enumerates for a sweep. Collecting
+     * one deletes the only record of a question somebody may be in the middle
+     * of answering, and their answer then lands nowhere — the store refuses
+     * the unpark and the run it belonged to resumes without it.
+     *
+     * So the candidates are still the oldest `all.length - keepLast`, which
+     * is what keeps the newest `keepLast` — the run's resume point — out of
+     * reach, and a park among them is skipped rather than counted. Pruning
+     * therefore holds a few more rows while a park is outstanding. That is
+     * the right side to err on: parks resolve, and the next prune collects
+     * them. Expired ones are skipped too — the host's sweep is
+     * {@link expire}, which resolves the park by running out of time rather
+     * than by deleting the evidence, and `prune` racing it would take the
+     * question away before it was read.
+     */
     async prune(keepLast) {
         const all = await this.list();
         if (all.length <= keepLast)
             return;
         const toDelete = all.sort((a, b) => a.createdAt - b.createdAt).slice(0, all.length - keepLast);
         for (const cp of toDelete) {
+            if (cp.pending && cp.pending.resolvedAt === undefined)
+                continue;
             await this.store.deleteCheckpoint(this.scope, cp.id);
         }
     }