@sigrun/sigrun 0.10.1 → 0.11.0

package/CHANGELOG.md

@@ -5,6 +5,42 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.11.0] - 2026-11-07
+
+### Changed
+
+- BREAKING: pi-durable 1.5.0. Conversation data written by this release cannot be read by 0.9.x;
+  the first boot under a NEWER pi-durable minor writes `<db>.pre-pi-durable-1.5.0-<stamp>.bak`
+  (when no schema-migration snapshot was already taken this boot — a store jumping several
+  schema versions snapshots at the schema guard instead); downgrade = restore that file.
+- BREAKING: Transcripts now show the full raw history: turns before a compaction stay above the
+  "context compacted" divider.
+- BREAKING: `POST /v1/admin/tasks/:id/retry` removed; a schedule that hits the restart limit
+  blocks its job; resume with `POST /v1/jobs/:id/resume`.
+- BREAKING: Durable report metric labels follow pi-durable 1.5.0 (`session_failed` →
+  `storage_failed`, `task_parked` removed, `task_interrupted` added); the live-task status label
+  `ready` is now `pending`.
+- BREAKING: Every conversation read (SSE connect, `GET /v1/conversations/:id`, extension
+  watches) now loads the full history; very long conversations cost more until windowed
+  streaming lands.
+- BREAKING: A host killed mid-answer no longer resends the request on restart; the run retries
+  per `settings.retry` or ends `interrupted`.
+- BREAKING: Extensions built for pi-durable 1.4 are quarantined with a peer-range message.
+
+## [0.10.2] - 2026-11-06
+
+### Fixed
+
+- The multi-select bulk action bar stays on screen: it rendered at the top
+  of the list, so ticking rows further down a scrolled list (the escalation
+  inbox sidebar) left "Dismiss selected" out of view. It is now sticky to
+  the collection's scroll container and shows "N selected".
+
+### Changed
+
+- The family bumps to 0.10.2; companion: `@sigrun/ext-gateway` 0.1.21
+  (shared peer gains 0.10.2).
+
 ## [0.10.1] - 2026-11-06
 
 ### Fixed

package/README.md

@@ -978,7 +978,8 @@ backup — are omitted rather than zeroed):
 | `sigrun_ready` | 1 when the readiness storage check (the root-conversation read `/readyz` gates on) succeeds; 0 when it fails — fires even while the process and the scrape stay up. |
 | `sigrun_live_runs` | Conversations with a placed-but-unsettled input submission. |
 | `sigrun_inflight_submission_oldest_seconds` | Age of the oldest in-flight submission's admission (0 when none; in-process clock — a pre-restart run is invisible until it settles). |
-| `sigrun_tasks_live{status}` | Live tasks by scheduler state (running/ready/waiting/completing/blocked, 0s included). |
+| `sigrun_tasks_live{status}` | Live tasks by scheduler state (running/pending/waiting/completing/blocked, 0s included). |
+| `sigrun_jobs_blocked{reason}` | Jobs whose record is blocked, by reason (`restart_limit` — the schedule hit pi-durable's restart limit; resume via `POST /v1/jobs/:id/resume`). |
 | `sigrun_provider_ready{provider,status}` | 1 per provider at its current auth-readiness status (`ready`, `degraded`, `invalid`, `not_ready`, `not_configured`). |
 | `sigrun_extensions{status}` | Configured extensions by load outcome (`ok` / `quarantined`). |
 | `sigrun_job_last_run_timestamp_seconds{job,outcome}` | Unix time of each job's last run, by outcome. |
@@ -995,6 +996,7 @@ backup — are omitted rather than zeroed):
 | `SigrunSubmissionWedged` | `sigrun_inflight_submission_oldest_seconds > 1800` for 5m — a live run is making no progress. |
 | `SigrunProviderNotReady` | A provider sits at a non-ready auth status for 15m. |
 | `SigrunJobFailed` | `increase(sigrun_job_runs_total{outcome="failed"}[1h]) > 0` — a scheduled job failed. |
+| `SigrunJobRestartLimited` | `sigrun_jobs_blocked{reason="restart_limit"} > 0` for 5m — a job hit the restart limit and is blocked until resumed (`POST /v1/jobs/:id/resume`; see Blocked jobs). |
 | `SigrunBackupStale` | The backup marker is older than 36h while backup is enabled (the rule is absent on an unbacked deploy). |
 
 ## Extensions
@@ -1420,32 +1422,30 @@ launcher) is not supervised either; there the callout says "Restart
 sigrun to apply" with no button. `GET /v1/meta` reports the posture
 (`supervised`).
 
-## Parked tasks
+## Blocked jobs
 
-A task cut off repeatedly without progress (a crash loop) is parked by
-pi-durable's restart limit: it shows `blocked` with reason
-`restart_limit` and does not run again until an administrator retries
-it. The `SigrunTaskParked` alert fires on this. Two admin-only
-endpoints inspect and recover parked tasks:
+A schedule cut off repeatedly without progress (a crash loop) hits
+pi-durable's restart limit: the run ENDS and the job's record is marked
+`blocked` with reason `restart_limit`; it does not fire again until
+someone with the job's write access resumes it. The `SigrunJobRestartLimited` alert fires on
+this (`sigrun_jobs_blocked{reason="restart_limit"} > 0`).
 
-- `GET /v1/admin/tasks?state=blocked` — lists blocked tasks with
-  `{id, kind, reason, conversationId, owner?, extension?}` per row
+- `POST /v1/jobs/:id/resume` — resumes a restart-blocked job: the
+  record returns to its normal scheduled state and the next fire
+  proceeds. (Admin-only; 409 for a job that isn't blocked.)
+- `GET /v1/admin/tasks?state=blocked` — lists blocked scheduler tasks
+  with `{id, kind, reason, conversationId, owner?, extension?}` per row
   (owner is the conversation's session owner when it has one; extension
   is the registered task definition's owner when known).
-- `POST /v1/admin/tasks/:id/retry` — re-runs a restart-parked task:
-  204 on success, 404 `unknown_task` for an unknown id, 409
-  `not_parked` for a task that isn't parked (including one blocked for
-  another reason, such as `missing_task`). A retried schedule job's
-  status returns to `waiting` as the task runs again.
 
 ```sh
 # List blocked tasks (admin token).
 curl -H "Authorization: Bearer $TOKEN" \
   "http://localhost:3000/v1/admin/tasks?state=blocked"
 
-# Retry a parked task.
+# Resume a restart-blocked job.
 curl -X POST -H "Authorization: Bearer $TOKEN" \
-  http://localhost:3000/v1/admin/tasks/7/retry
+  http://localhost:3000/v1/jobs/7/resume
 ```
 
 ## API sketch
@@ -1457,8 +1457,9 @@ curl -X POST -H "Authorization: Bearer $TOKEN" \
   differs from boot) and PATCH reports `{applied, pending}`.
 - `POST /v1/admin/restart` — graceful restart (admin, supervised
   deploys only; see Restarting).
-- `GET /v1/admin/tasks?state=blocked`, `POST /v1/admin/tasks/{id}/retry`
-  — parked-task inspection and recovery (admin; see Parked tasks).
+- `GET /v1/admin/tasks?state=blocked`, `POST /v1/jobs/{id}/resume`
+  — blocked-task inspection and blocked-job recovery (admin; see
+  Blocked jobs).
 - `GET /v1/jobs`, `POST /v1/jobs`, `PATCH`/`DELETE /v1/jobs/{id}` —
   the jobs surface (see [Jobs](#jobs)); `POST /v1/jobs/{id}/run` fires
   now; `GET /v1/jobs/{id}/runs` and `GET /v1/jobs/{id}/revisions` are

package/dist/curation/runs.js

@@ -285,7 +285,7 @@ export async function driveRun(deps, prepare, opts, parent) {
     // records; two watches run in ONE listener — (a) this run's tool
     // results (the maxToolCalls budget), and (b) the PARENT's drift.
     // Both are synchronous reads of the publication's own changes (the
-    // subscribeCommits listener contract: no blocking, no Session calls).
+    // observeCommits listener contract: no blocking, no Session calls).
     //
     // Parent drift, precisely: an ENTRY change on the parent beyond the
     // start-captured head (a reset/compaction marker or a newly admitted
@@ -310,61 +310,76 @@ export async function driveRun(deps, prepare, opts, parent) {
     let watcher;
     const watch = () => {
         watcher?.();
-        watcher = harness.subscribeCommits((publication) => {
-            for (const change of publication.changes) {
-                if (change.type === "entry") {
-                    if (runId !== undefined &&
-                        change.value.conversationId === runId &&
-                        change.value.kind === ToolResultEntry.kind) {
-                        toolResults += 1;
-                        if (toolResults >= opts.maxToolCalls) {
-                            stop({ kind: "maxToolCalls" });
+        const observation = harness.observeCommits({
+            advance: (publication) => {
+                try {
+                    for (const change of publication.changes) {
+                        if (change.type === "entry") {
+                            if (runId !== undefined &&
+                                change.value.conversationId === runId &&
+                                change.value.kind === ToolResultEntry.kind) {
+                                toolResults += 1;
+                                if (toolResults >= opts.maxToolCalls) {
+                                    stop({ kind: "maxToolCalls" });
+                                }
+                            }
+                            if (parent !== undefined && start !== undefined) {
+                                if (change.value.conversationId === parent &&
+                                    change.value.id !== start.head &&
+                                    isAfter(change.value.id, start.head)) {
+                                    stop({
+                                        kind: "parent",
+                                        what: change.value.kind === "pi.reset"
+                                            ? "the conversation was reset or compacted"
+                                            : "a new run was admitted",
+                                    });
+                                }
+                            }
+                            continue;
                         }
-                    }
-                    if (parent !== undefined && start !== undefined) {
-                        if (change.value.conversationId === parent &&
-                            change.value.id !== start.head &&
-                            isAfter(change.value.id, start.head)) {
-                            stop({
-                                kind: "parent",
-                                what: change.value.kind === "pi.reset"
-                                    ? "the conversation was reset or compacted"
-                                    : "a new run was admitted",
-                            });
+                        if (parent === undefined || start === undefined)
+                            continue;
+                        if (change.type === "submission") {
+                            if (change.value.conversationId === parent) {
+                                stop({ kind: "parent", what: "a new run was admitted" });
+                            }
+                            continue;
                         }
-                    }
-                    continue;
-                }
-                if (parent === undefined || start === undefined)
-                    continue;
-                if (change.type === "submission") {
-                    if (change.value.conversationId === parent) {
-                        stop({ kind: "parent", what: "a new run was admitted" });
-                    }
-                    continue;
-                }
-                if (change.type === "document") {
-                    if (change.conversationId === parent &&
-                        change.record.kind === "sigrun.session-meta" &&
-                        change.value !== null) {
-                        // Compare the COMMITTED VALUE's owner/sharing fields —
-                        // the activity stamper writes `lastActivityAt` on the
-                        // same doc after every settle (a benign change that
-                        // must never cancel a review). SAFETY: the value is
-                        // the adopted JSON revision; the structural read
-                        // touches two optional fields only.
-                        const value = change.value;
-                        if (value.owner !== start.owner ||
-                            sharingKey(value.sharing) !== sharingKey(start.sharing)) {
-                            stop({
-                                kind: "parent",
-                                what: "the parent's owner or sharing changed",
-                            });
+                        if (change.type === "document") {
+                            if (change.conversationId === parent &&
+                                change.record.kind === "sigrun.session-meta" &&
+                                change.kind === "change") {
+                                // Compare the COMMITTED VALUE's owner/sharing fields —
+                                // the activity stamper writes `lastActivityAt` on the
+                                // same doc after every settle (a benign change that
+                                // must never cancel a review). SAFETY: the value is
+                                // the adopted JSON revision; the structural read
+                                // touches two optional fields only.
+                                const value = change.value;
+                                if (value.owner !== start.owner ||
+                                    sharingKey(value.sharing) !== sharingKey(start.sharing)) {
+                                    stop({
+                                        kind: "parent",
+                                        what: "the parent's owner or sharing changed",
+                                    });
+                                }
+                            }
                         }
                     }
                 }
-            }
+                catch (error) {
+                    console.error("curation/runs: commit observer failed", error);
+                }
+            },
+            end: (end) => {
+                if (end.kind === "ended")
+                    return;
+                if (end.kind === "failed" && end.error instanceof Error && end.error.message === "session closed")
+                    return;
+                console.error("curation/runs: commit observation failed", end.kind === "failed" ? end.error : end);
+            },
         });
+        watcher = () => observation.detach();
     };
     watch();
     const cleanup = () => {

package/dist/curation/skill-tool.js

@@ -25,7 +25,7 @@
  * — the change id for the P8 undo surface and a one-line summary for
  * the UI.
  */
-import { Type } from "@earendil-works/pi-ai";
+import { Type } from "typebox";
 import { defineTool } from "@earendil-works/pi-durable";
 import { OVERLAY_HEADING, withOverlay, } from "./overlays.js";
 import { curationRun, markViewed } from "./run-doc.js";

package/dist/extension.d.ts

@@ -32,7 +32,8 @@
  *   validated candidate shape and a compile-time key assertion, so the
  *   implementation and this contract cannot drift silently.
  */
-import type { AssistantMessage, Provider, TSchema } from "@earendil-works/pi-ai";
+import type { AssistantMessage, Provider } from "@earendil-works/pi-ai";
+import type { TSchema } from "typebox";
 import type { ConversationDocToken, ConversationId, Cursor, EntryId, EntryQuery, EntryRecord, Extension, InputSubmissionDraft, JsonObject, ModelRef, Page, SubmissionId } from "@earendil-works/pi-durable";
 import type { Access, Sharing } from "@sigrun/shared/access";
 import type { DecisionAnswers, DecisionLimits, DecisionRequest, DecisionResult } from "@sigrun/shared/decisions";

package/dist/harness/blocks/tools.js

@@ -31,7 +31,7 @@
  * bind, the seam carries the events to in-process listeners only — the
  * default subscriber set is empty, so nothing is lost by not wiring it.
  */
-import { Type } from "@earendil-works/pi-ai";
+import { Type } from "typebox";
 import { defineExtension, defineTool, } from "@earendil-works/pi-durable";
 import { applyOps, DataOpError, toText } from "@sigrun/shared/blocks";
 import { validateData, validateTree } from "../../blocks/validate.js";

package/dist/harness/boot.js

@@ -14,11 +14,11 @@ import { openNodeSqliteStorage } from "@earendil-works/pi-durable/storage/sqlite
 import { DECISION_TIMEOUT_ENV, effectiveMethods } from "../config.js";
 import { requiresProxyVouch } from "../server/auth/proxy-only.js";
 import { wireActivity } from "./activity.js";
-import { snapshotBeforeMigration } from "./migration-snapshot.js";
+import { snapshotBeforeDurableUpgrade, snapshotBeforeMigration, writeDurableVersionMarker, } from "./migration-snapshot.js";
 import { createScheduleTask } from "../jobs/task.js";
 import { createJobsService, jobWireOf } from "../jobs/index.js";
 import { reconcileJobs } from "../jobs/reconcile.js";
-import { applyParkedJobs } from "../jobs/parked.js";
+import { markRestartLimitedJob } from "../jobs/restart-limit.js";
 import { createDurableReports } from "./reports.js";
 import { registerJobObservers } from "../jobs/observe.js";
 import { JobDoc, JobRunDoc, listRevisions } from "../jobs/docs.js";
@@ -372,12 +372,33 @@ export async function openHarness(config, options = {}) {
         // openNodeSqliteStorage applies its one-way durable migration. The
         // injected clock keeps snapshots deterministic in tests; a needed
         // snapshot failure aborts boot here, before any migration write.
-        await snapshotBeforeMigration(config.storagePath, {
+        const schemaSnapshot = await snapshotBeforeMigration(config.storagePath, {
             env,
             now: options.now ?? (() => new Date()),
             log: (line) => console.log(line),
         });
-        return await openNodeSqliteStorage(config.storagePath);
+        // D4 (1.5.0 upgrade): a store last written by an older pi-durable
+        // minor gets its own snapshot — skipped when the schema guard above
+        // already wrote one this boot. The version marker is written only
+        // AFTER a successful open, so it never claims a version the store
+        // has not actually been opened by.
+        if (schemaSnapshot === undefined) {
+            await snapshotBeforeDurableUpgrade(config.storagePath, {
+                env,
+                now: options.now ?? (() => new Date()),
+                log: (line) => console.log(line),
+            });
+        }
+        const opened = await openNodeSqliteStorage(config.storagePath);
+        try {
+            await writeDurableVersionMarker(config.storagePath);
+        }
+        catch (error) {
+            // A failed stamp must not leak the open storage handle.
+            await opened.close(BACKGROUND_CONTEXT).catch(() => { });
+            throw error;
+        }
+        return opened;
     })();
     const registry = createRegistry();
     // Late-filled by the loader: factories publish through the same registry
@@ -1192,7 +1213,7 @@ export async function openHarness(config, options = {}) {
     // the jobs tests' time-injection lever).
     const clockNow = options.now ?? (() => new Date());
     // D5: reports may arrive inside Harness.open. The collector logs/counts
-    // synchronously and queues parks; job patches drain after binding below.
+    // synchronously (no durable follow-up work from a report survives 1.5.0).
     const reports = createDurableReports({
         log: (line) => console.error(line),
         onReport: options.onReport,
@@ -1256,6 +1277,11 @@ export async function openHarness(config, options = {}) {
                     entry.name !== CURATION_GATE_EXTENSION);
             },
             toolExecution: callerSettings?.toolExecution,
+            // pi-durable 1.5.0: restart-limited tasks END instead of parking
+            // (no file backing — caller seam and default only, like
+            // toolExecution). The battery pins it to make crash outcomes
+            // deterministic.
+            restartLimit: callerSettings?.restartLimit,
             compaction: {
                 ...config.compaction,
                 ...(config.compaction.modelOverrides === undefined &&
@@ -1282,9 +1308,8 @@ export async function openHarness(config, options = {}) {
     jobRuntimeDeps.harness = harness;
     jobRuntimeDeps.storage = storage;
     jobRuntimeDeps.interactiveTools = new Set(loadedInteractiveTools);
-    // Drain the restart-limit parks reported during open before scheduling
-    // resumes. A failed status patch is logged and dropped by applyParkedJobs.
-    await applyParkedJobs(harness, reports.takeParked(), BACKGROUND_CONTEXT);
+    // pi-durable 1.5.0 removed task_parked/retryTask (the parked-job drain
+    // existed for that pair); Task 4 wires the replacement recovery surface.
     // The memory-seam event bus (Tasks 2-4): subscribe BEFORE `resume()` so
     // recovery settles (faulted/orphaned submissions the scheduler drains)
     // are observed like any other commit. Extension handlers register under
@@ -1437,14 +1462,28 @@ export async function openHarness(config, options = {}) {
     // open, and a no-op once the queue is found empty. Events enqueued
     // while a drain is already pumping are picked up by that same loop.
     let drainTimer;
-    harness.subscribeCommits(() => {
-        if (drainTimer !== undefined)
-            return;
-        drainTimer = setTimeout(() => {
-            drainTimer = undefined;
-            void eventBus.drain(hookDeadlineMs, BACKGROUND_CONTEXT);
-        });
-        drainTimer.unref?.();
+    harness.observeCommits({
+        advance: () => {
+            try {
+                if (drainTimer !== undefined)
+                    return;
+                drainTimer = setTimeout(() => {
+                    drainTimer = undefined;
+                    void eventBus.drain(hookDeadlineMs, BACKGROUND_CONTEXT);
+                });
+                drainTimer.unref?.();
+            }
+            catch (error) {
+                console.error("boot: commit observer failed", error);
+            }
+        },
+        end: (end) => {
+            if (end.kind === "ended")
+                return;
+            if (end.kind === "failed" && end.error instanceof Error && end.error.message === "session closed")
+                return;
+            console.error("boot: commit observation failed", end.kind === "failed" ? end.error : end);
+        },
     });
     // A failed Session closes itself (the upstream contract): the bus's
     // sweep + subscription must not outlive it. shutdownSequence (the
@@ -1528,19 +1567,35 @@ export async function openHarness(config, options = {}) {
     // the counter feeds `sigrun_job_runs_total{outcome}`). A creation
     // write of an already-settled run (the overlap skip, the catch-up
     // skip) counts once at creation; a `running` run counts at its settle;
-    // prune retirements (value null) never count.
+    // prune retirements (tagged `kind === "retire"`) never count.
     const jobRunTotals = new Map();
-    harness.subscribeCommits((publication) => {
-        for (const change of publication.changes) {
-            if (change.type !== "document")
-                continue;
-            if (change.record.kind !== JobRunDoc.definition.kind)
-                continue;
-            const outcome = change.value?.outcome;
-            if (typeof outcome !== "string" || outcome === "running")
-                continue;
-            jobRunTotals.set(outcome, (jobRunTotals.get(outcome) ?? 0) + 1);
-        }
+    harness.observeCommits({
+        advance: (publication) => {
+            try {
+                for (const change of publication.changes) {
+                    if (change.type !== "document")
+                        continue;
+                    if (change.kind !== "change")
+                        continue;
+                    if (change.record.kind !== JobRunDoc.definition.kind)
+                        continue;
+                    const outcome = change.value?.outcome;
+                    if (typeof outcome !== "string" || outcome === "running")
+                        continue;
+                    jobRunTotals.set(outcome, (jobRunTotals.get(outcome) ?? 0) + 1);
+                }
+            }
+            catch (error) {
+                console.error("boot: commit observer failed", error);
+            }
+        },
+        end: (end) => {
+            if (end.kind === "ended")
+                return;
+            if (end.kind === "failed" && end.error instanceof Error && end.error.message === "session closed")
+                return;
+            console.error("boot: commit observation failed", end.kind === "failed" ? end.error : end);
+        },
     });
     jobs = createJobsService({
         harness,
@@ -1585,6 +1640,17 @@ export async function openHarness(config, options = {}) {
             console.warn(`jobs: declared job "${spec.name}" names owner "${spec.owner}" who is not in the user directory — it runs ownerless until its source is edited`);
         }
     }
+    // D2 restart-limit recovery: reports that arrived DURING
+    // Harness.open sat queued in the collector. Register the live
+    // listener now (drains the backlog via setImmediate, then every
+    // later restart-limited report flows straight to it); the listener
+    // owns all Harness reads/commits — the collector never calls the
+    // Harness from inside onReport.
+    reports.onRestartLimited((task) => {
+        void markRestartLimitedJob(harness, task, BACKGROUND_CONTEXT).catch((error) => {
+            console.error("jobs: restart-limited listener failed:", error);
+        });
+    });
     harness.resume();
     return {
         harness,

package/dist/harness/decision-tool.js

@@ -18,7 +18,7 @@
  * `structuredOutput` under the declared schema (pi-durable rejects
  * structuredOutput without one).
  */
-import { Type } from "@earendil-works/pi-ai";
+import { Type } from "typebox";
 import { defineExtension, defineTool } from "@earendil-works/pi-durable";
 import { validateDecisionRequest } from "./decisions.js";
 /** The core extension's reserved slug (boot.ts keeps the core slugs). */

package/dist/harness/decisions.js

@@ -10,7 +10,7 @@
  * `ok:false` with one of the spec's codes. Error text never carries the
  * credential (scrubbed) nor the submitted request.
  */
-import { Type } from "@earendil-works/pi-ai";
+import { Type } from "typebox";
 import { Compile } from "typebox/compile";
 import { DECISION_MAX_BYTES, DECISION_MAX_QUESTIONS, } from "@sigrun/shared/decisions";
 // A strict-JSON value schema. `Type.Unknown()` leaves a node unchecked;

package/dist/harness/event-bus.js

@@ -3,7 +3,7 @@
  * side lane + idle detection + shutdown sequencing. See the memory-seam
  * spec §"Design".
  *
- * The bus subscribes to pi-durable's `Session.subscribeCommits` (sigrun's
+ * The bus subscribes to pi-durable's `Session.observeCommits` (sigrun's
  * harness IS a Session) and reduces each `CommitPublication` into the
  * memory seam's host events — settled-run groups and conversation
  * lifecycle — without touching run logic. The upstream listener contract
@@ -13,10 +13,10 @@
  * deadline-bounded (`Promise.race` against `hookDeadlineMs`), rejections
  * are caught + logged, and overflow drops the OLDEST queued event.
  *
- * Detection rules (verified against pi-durable 1.2.0's publication shapes
+ * Detection rules (verified against pi-durable 1.5.0's publication shapes
  * — table changes are the raw `StorageWrite` records; document changes are
  * `DocumentCommitChange`s whose `record.createdAt === publication.seq`
- * marks creation, `value === null` marks retirement):
+ * marks creation, the tagged `kind === "retire"` marks retirement):
  *
  * - **Settle**: a `submission` table write with `value.type === "input"`
  *   and a terminal status (`done`/`unanswered`). Write-type submissions
@@ -171,9 +171,19 @@ export class EventBus {
         if (options.onHostEvent !== undefined) {
             this.onHostEvent(options.onHostEvent);
         }
-        this.#unsubscribe = harness.subscribeCommits((publication) => {
-            this.observe(publication);
+        const observation = harness.observeCommits({
+            advance: (publication) => {
+                this.observe(publication);
+            },
+            end: (end) => {
+                if (end.kind === "ended")
+                    return;
+                if (end.kind === "failed" && end.error instanceof Error && end.error.message === "session closed")
+                    return;
+                console.error("event-bus: commit observation failed", end.kind === "failed" ? end.error : end);
+            },
         });
+        this.#unsubscribe = () => observation.detach();
         // The idle sweep is host-owned machinery (never an extension factory
         // concern — the twill lesson) and binds to THIS bus's lifetime: close
         // and shutdownSequence both clear it. Unref'd so a booted-but-idle
@@ -707,7 +717,7 @@ export class EventBus {
                     continue;
                 if (change.conversationId === undefined)
                     continue;
-                this.#internal.set(change.conversationId, change.value?.internal === true);
+                this.#internal.set(change.conversationId, change.kind === "change" && change.value.internal === true);
             }
             for (const change of publication.changes) {
                 if (change.type !== "conversation")
@@ -758,9 +768,9 @@ export class EventBus {
                     // their host events here (ordinary document changes only — a
                     // fork's document.copy carries no status transition).
                     if (change.type === "document" &&
+                        change.kind === "change" &&
                         kind === InteractionDoc.definition.kind &&
-                        change.conversationId !== undefined &&
-                        change.value !== null) {
+                        change.conversationId !== undefined) {
                         const record = change.value;
                         if (typeof record.callId === "string" &&
                             typeof record.kind === "string" &&
@@ -874,7 +884,7 @@ export class EventBus {
                     this.#metaBasis.set(conversationId, childBasis);
                     continue;
                 }
-                if (change.value === null) {
+                if (change.type === "document" && change.kind === "retire") {
                     this.#archivedBasis.delete(conversationId);
                     this.#metaBasis.delete(conversationId);
                     continue;

package/dist/harness/loader.js

@@ -1262,8 +1262,9 @@ const DECLARED_PEER_MODULES = [
     "@earendil-works/pi-ai",
 ];
 /**
- * The declared-peer guard (pi-durable 1.4.0 D7): after the resolved-version
- * guard, reject an Earendil peer range that excludes the running host.
+ * The declared-peer guard (pi-durable 1.4.0 D7; 1.5.0 D3 moved it
+ * PRE-import): reject an Earendil peer range that excludes the running
+ * host before the extension's module code executes.
  * Non-semver specifiers (file:, link:, git:, URLs, workspace:) and wildcards
  * pass; a missing or unreadable manifest also passes because the guard never
  * quarantines what it cannot read.
@@ -1843,6 +1844,17 @@ export async function loadExtensions(specifiers, registry, options = {}) {
             if (/\.ts$/.test(loaded)) {
                 throw new Error(`the resolved entry is a TypeScript source (${loaded}) — build the package and ship its built entry (dist/index.js); the built server loads JavaScript`);
             }
+            // Declared-peer preflight (1.5.0 upgrade, spec D3): the peer-range
+            // guard runs BEFORE the import so a previous-minor extension's
+            // module-level code (which may destructure host shapes the new
+            // version removed) never executes. A throw here rides the same
+            // per-extension try as every other quarantine.
+            const moduleDir = extensionModuleDir(loaded);
+            if (moduleDir !== undefined) {
+                const peerReason = checkDeclaredPeers(moduleDir);
+                if (peerReason !== undefined)
+                    throw new Error(peerReason);
+            }
             const module = (await import(loaded));
             // Host-module version guard (spec §6.4 R6): the module tree the
             // extension's bare imports resolve from must agree with the copy
@@ -1851,12 +1863,8 @@ export async function loadExtensions(specifiers, registry, options = {}) {
             // no trace (no seam host, no bindings, no registry entry). A throw
             // here rides the existing per-extension try (quarantine, boot
             // continues) exactly like the reserved-section check below.
-            const moduleDir = extensionModuleDir(loaded);
             if (moduleDir !== undefined) {
                 checkHostModules(moduleDir);
-                const peerReason = checkDeclaredPeers(moduleDir);
-                if (peerReason !== undefined)
-                    throw new Error(peerReason);
             }
             // Two-phase host: the factory receives the host at CALL time, but
             // the extension name and kinds it declares are only known from its