@sigrun/sigrun 0.10.2 → 0.11.0

package/dist/harness/migration-snapshot.js

@@ -14,9 +14,25 @@
  * migration and therefore does not pass through this helper.
  */
 import { existsSync } from "node:fs";
+import { readFile, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
 import { DatabaseSync } from "node:sqlite";
 import { CURRENT_SQLITE_SCHEMA_VERSION } from "@earendil-works/pi-durable/storage/sqlite";
 export const SKIP_MIGRATION_SNAPSHOT_ENV = "SIGRUN_SKIP_MIGRATION_SNAPSHOT";
+/**
+ * The sidecar recording which pi-durable version last opened a store
+ * (spec D4, 1.5.0 upgrade): `<storagePath>.durable-version`. A missing
+ * marker means the store predates the marker convention and counts as
+ * older than any running version.
+ */
+export const DURABLE_VERSION_MARKER_SUFFIX = ".durable-version";
+/**
+ * The running pi-durable package version, read from the installed
+ * package's manifest through `createRequire` (the same bundler-stable
+ * shape `schema-fixture.ts` uses for HARNESS_VERSION), so a dependency
+ * bump moves the upgrade guard without a source edit.
+ */
+const DURABLE_PACKAGE_VERSION = createRequire(import.meta.url)("@earendil-works/pi-durable/package.json").version;
 /** A required pre-migration snapshot could not be written. */
 export class MigrationSnapshotError extends Error {
     constructor(message, options) {
@@ -95,3 +111,91 @@ export async function snapshotBeforeMigration(storagePath, opts) {
         db.close();
     }
 }
+/** Compare two `major.minor[.patch]` versions by their minor. */
+const MARKER_VERSION = /^(\d+)\.(\d+)(?:\.(\d+))?/;
+function minorIsOlder(version, running) {
+    const parse = (v) => {
+        const match = /^(\d+)\.(\d+)(?:\.(\d+))?/.exec(v.trim());
+        if (match === null)
+            return undefined;
+        return [Number(match[1]), Number(match[2])];
+    };
+    const marked = parse(version);
+    const current = parse(running);
+    if (marked === undefined || current === undefined)
+        return false;
+    return (marked[0] < current[0] ||
+        (marked[0] === current[0] && marked[1] < current[1]));
+}
+/**
+ * Pre-upgrade snapshot (spec D4, pi-durable 1.5.0): before pi-durable opens
+ * a store last written by an OLDER minor, preserve a copy the previous
+ * release can read. The version signal is the `<storagePath>.durable-version`
+ * sidecar — a missing marker (a pre-1.5 store, or one written before the
+ * convention) counts as older, so an unmarked existing store snapshots once
+ * and then never again once {@link writeDurableVersionMarker} has run.
+ *
+ * No-op when the skip env is set or the store file is absent (fresh
+ * installs have nothing to preserve). A failure to write a NEEDED snapshot
+ * throws `MigrationSnapshotError` with the same skip-env hint as the
+ * schema-migration guard. Returns the snapshot path, or `undefined`.
+ */
+export async function snapshotBeforeDurableUpgrade(storagePath, opts) {
+    if (opts.env[SKIP_MIGRATION_SNAPSHOT_ENV] === "1") {
+        opts.log(`sigrun: durable upgrade snapshot skipped (${SKIP_MIGRATION_SNAPSHOT_ENV}=1): ${storagePath}`);
+        return undefined;
+    }
+    if (!existsSync(storagePath))
+        return undefined;
+    const markerPath = `${storagePath}${DURABLE_VERSION_MARKER_SUFFIX}`;
+    let marked;
+    try {
+        marked = (await readFile(markerPath, "utf8")).trim();
+    }
+    catch {
+        marked = undefined;
+    }
+    if (marked !== undefined &&
+        MARKER_VERSION.test(marked) &&
+        !minorIsOlder(marked, DURABLE_PACKAGE_VERSION)) {
+        return undefined;
+    }
+    const snapshotPath = `${storagePath}.pre-pi-durable-${DURABLE_PACKAGE_VERSION}-${compactUtcStamp(opts.now())}.bak`;
+    let db;
+    try {
+        db = new DatabaseSync(storagePath);
+    }
+    catch (error) {
+        opts.log(`sigrun: durable upgrade snapshot skipped; probe could not open ${storagePath}: ${messageOf(error)}`);
+        return undefined;
+    }
+    try {
+        try {
+            db.exec(`VACUUM INTO ${sqlString(snapshotPath)}`);
+        }
+        catch (error) {
+            // A non-database file defers to the real storage opener, whose
+            // error reports the underlying problem better than a snapshot
+            // guard's skip-env hint (the same deferral snapshotBeforeMigration
+            // makes for its schema probe).
+            if (messageOf(error).includes("file is not a database")) {
+                opts.log(`sigrun: durable upgrade snapshot skipped; ${storagePath} is not a database: ${messageOf(error)}`);
+                return undefined;
+            }
+            throw new MigrationSnapshotError(`could not snapshot ${storagePath} to ${snapshotPath} before the pi-durable ${marked ?? "unmarked"} → ${DURABLE_PACKAGE_VERSION} upgrade: ${messageOf(error)}; set ${SKIP_MIGRATION_SNAPSHOT_ENV}=1 only when you have an independent backup`, { cause: error });
+        }
+    }
+    finally {
+        db.close();
+    }
+    opts.log(`sigrun: durable upgrade snapshot ${snapshotPath} (${marked ?? "unmarked"} → ${DURABLE_PACKAGE_VERSION})`);
+    return snapshotPath;
+}
+/**
+ * Stamp the running pi-durable version beside the store. Boot calls this
+ * only after `openNodeSqliteStorage` succeeds, so the marker never claims a
+ * version the store has not actually been opened by.
+ */
+export async function writeDurableVersionMarker(storagePath) {
+    await writeFile(`${storagePath}${DURABLE_VERSION_MARKER_SUFFIX}`, DURABLE_PACKAGE_VERSION, "utf8");
+}

package/dist/harness/packages.js

@@ -63,7 +63,8 @@ export const NPM_TIMEOUT_MS = 120_000;
  * Runtime modules the HOST ships that extension packages may import bare.
  * Extension packages declare these devDependencies-only (the
  * provider-plugins dependency posture: pi-ai/pi-durable ship with sigrun,
- * typebox ships as pi-ai's own dependency — structural typing at runtime,
+ * and typebox ships as sigrun's OWN direct dependency (pi-durable 1.5.0:
+ * pi-ai no longer carries or re-exports it) — structural typing at runtime,
  * never identity), and npm never installs a dependency's devDependencies,
  * so a package installed into the packages dir cannot resolve them on its
  * own. {@link ensureHostModuleLinks} links sigrun's own copies into the

package/dist/harness/reports.js

@@ -1,16 +1,21 @@
 /**
- * pi-durable 1.4.0 `HarnessOptions.onReport` visibility (D5).
+ * pi-durable 1.5.0 `HarnessOptions.onReport` visibility (D5).
  *
  * Reports can arrive DURING `Harness.open`, before a Harness exists for
  * follow-up work. This collector is therefore synchronous and small: count
- * and log immediately; retain task_parked identities for boot's post-open
- * drain. It never reads transcripts, and no failure in logging or an
- * observer can escape into pi-durable.
+ * and log immediately. It never reads transcripts, and no failure in
+ * logging or an observer can escape into pi-durable.
+ *
+ * Its second responsibility (D2) is the restart-limit queue: it never
+ * calls the Harness from inside `onReport` (which runs inside Session
+ * machinery) — restart-limited tasks queue, and once boot registers the
+ * listener the queue drains via `setImmediate` (and each later report
+ * the same way).
  */
-export const REPORT_TYPES = [
-    "session_failed",
+export const REPORT_KINDS = [
+    "storage_failed",
     "task_faulted",
-    "task_parked",
+    "task_interrupted",
     "migration_failed",
     "task_outdated",
     "task_error",
@@ -40,49 +45,89 @@ function field(name, value) {
     return `${name}=${JSON.stringify(value)}`;
 }
 /** Format one report without exposing transcript content or ordinary stacks. */
-function formatReport(error, info) {
+function formatReport(report) {
     const fields = [];
-    if ("task" in info && info.task !== undefined) {
-        fields.push(["task", info.task.id], ["kind", info.task.kind], ["conversation", info.task.conversationId]);
+    if ("task" in report && report.task !== undefined) {
+        fields.push(["task", report.task.id], ["kind", report.task.kind], ["conversation", report.task.conversationId]);
     }
-    if ("extension" in info && info.extension !== undefined) {
-        fields.push(["extension", info.extension]);
+    if ("extension" in report && report.extension !== undefined) {
+        fields.push(["extension", report.extension]);
     }
-    if ("conversationId" in info && info.conversationId !== undefined) {
-        fields.push(["conversation", info.conversationId]);
+    if ("conversationId" in report && report.conversationId !== undefined) {
+        fields.push(["conversation", report.conversationId]);
     }
-    if ("callback" in info)
-        fields.push(["callback", info.callback]);
-    if ("reason" in info)
-        fields.push(["reason", info.reason]);
-    fields.push(["message", errorMessage(error).slice(0, MESSAGE_LIMIT)]);
-    if (info.type === "session_failed" && error instanceof Error && error.stack !== undefined) {
-        fields.push(["stack", error.stack]);
+    if ("callback" in report)
+        fields.push(["callback", report.callback]);
+    if ("reason" in report)
+        fields.push(["reason", report.reason]);
+    fields.push(["message", errorMessage(report.error).slice(0, MESSAGE_LIMIT)]);
+    if (report.kind === "storage_failed" && report.error instanceof Error && report.error.stack !== undefined) {
+        fields.push(["stack", report.error.stack]);
     }
     return [
-        `sigrun: durable ${info.type}`,
+        `sigrun: durable ${report.kind}`,
         ...fields.map(([name, value]) => field(String(name), value)),
     ].join(" ");
 }
+/**
+ * The restart-limit predicate (D2). Schedules are an extension task
+ * kind, so a restart-limited schedule arrives as `task_faulted` (reason
+ * `restart_limit`); `task_interrupted` is the built-in tasks' spelling.
+ * Checked FIRST, before anything else.
+ */
+function isRestartLimited(report) {
+    return ((report.kind === "task_faulted" || report.kind === "task_interrupted") &&
+        report.reason === "restart_limit");
+}
 /** Create the one process-local report collector passed to Harness.open. */
 export function createDurableReports(opts) {
-    const totals = Object.fromEntries(REPORT_TYPES.map((type) => [type, 0]));
-    let parked = [];
+    const totals = Object.fromEntries(REPORT_KINDS.map((kind) => [kind, 0]));
+    let queued = [];
+    let listener;
+    let drainScheduled = false;
+    const scheduleDrain = () => {
+        if (drainScheduled)
+            return;
+        drainScheduled = true;
+        setImmediate(() => {
+            drainScheduled = false;
+            const sink = listener;
+            if (sink === undefined)
+                return;
+            const batch = queued;
+            queued = [];
+            for (const task of batch) {
+                try {
+                    sink(task);
+                }
+                catch (error) {
+                    console.error("reports: restart-limited listener failed:", error);
+                }
+            }
+        });
+    };
     return {
-        onReport(error, info) {
-            // Count and queue before logging: a throwing sink cannot lose the
+        onReport(report) {
+            // Count and log before observing: a throwing sink cannot lose the
             // report, and pi-durable never receives a callback exception.
-            totals[info.type] += 1;
-            if (info.type === "task_parked")
-                parked.push(info.task);
+            totals[report.kind] += 1;
             try {
-                opts.log(formatReport(error, info));
+                opts.log(formatReport(report));
             }
             catch {
                 // A host log sink is not allowed to fail durable scheduling.
             }
+            // The restart-limit queue: the predicate is checked FIRST. Only
+            // the ReportTask is queued — the collector never touches the
+            // Harness; the listener (registered by boot after open) owns all
+            // follow-up reads/commits.
+            if (isRestartLimited(report)) {
+                queued.push(report.task);
+                if (listener !== undefined)
+                    scheduleDrain();
+            }
             try {
-                opts.onReport?.(error, info);
+                opts.onReport?.(report);
             }
             catch {
                 // Test/observer seams have the same containment rule.
@@ -91,10 +136,13 @@ export function createDurableReports(opts) {
         counts() {
             return { ...totals };
         },
-        takeParked() {
-            const drained = parked;
-            parked = [];
-            return drained;
+        queuedRestartLimited() {
+            return [...queued];
+        },
+        onRestartLimited(sink) {
+            listener = sink;
+            if (queued.length > 0)
+                scheduleDrain();
         },
     };
 }

package/dist/harness/tools.js

@@ -26,7 +26,7 @@
  * harness builds — so paths are conversation-relative exactly like the
  * upstream coding tools.
  */
-import { Type } from "@earendil-works/pi-ai";
+import { Type } from "typebox";
 import { createBashTool, createEditTool, createReadTool, createWriteTool, } from "@earendil-works/pi-durable/tools";
 import { defineExtension, defineTool } from "@earendil-works/pi-durable";
 import { SessionMetaDoc } from "../server/session-meta.js";

package/dist/jobs/docs.js

@@ -206,8 +206,22 @@ export async function patchJob(harness, id, change, ctx) {
     const prior = await harness.snapshot(JobDoc, id, ctx);
     if (prior === undefined)
         return;
+    // pi-durable 1.5.0 address semantics: a `tx.doc` acquire whose address
+    // was RETIRED between the pre-read and this commit CREATES a fresh
+    // incarnation from the seed — patchJob would resurrect a deleted job
+    // (the retire from deleteApi is hidden, reconcile's abort pass sees a
+    // live record). Discriminate with a sentinel the live record can never
+    // carry: the seed alone has it, so a created draft shows it; a live
+    // record never does. A detected creation is retired in the same commit,
+    // leaving the address absent — never resurrected.
+    const PROBE = "__patchJobSentinel";
     await harness.commit(async (tx) => {
-        const draft = await tx.doc(JobDoc, id, { ...prior });
+        const seed = { ...prior, [PROBE]: true };
+        const draft = (await tx.doc(JobDoc, id, seed));
+        if (draft[PROBE] === true) {
+            await tx.retireDoc(JobDoc, id);
+            return;
+        }
         change(draft);
     }, ctx);
 }
@@ -250,11 +264,17 @@ export async function pruneHistory(storage, harness, jobId, limits, ctx) {
 /**
  * The fire key a stored run was written under, re-derived for retiring:
  * scheduled runs key on `<jobId>:<fireAt epoch ms>`; manual runs on
- * `<jobId>:manual:<startedAt epoch ms>` (the manual fire stamps it).
+ * `<jobId>:manual:<fireAt epoch ms>` — the SAME clock reading `runNow`
+ * passes as both the key tail and the fire's fireAt. (Deriving the
+ * manual key from `startedAt` instead wedges the settle whenever the
+ * fire's clock reading rolls over one ms before the run's `startedAt`
+ * stamp: the observer commits the settled record under a key that
+ * differs by 1ms from the key the fire stored, and the run stays
+ * `running` forever.)
  */
 function runKeyOf(run) {
     if (run.manual) {
-        return `${run.jobId}:manual:${Date.parse(run.startedAt)}`;
+        return `${run.jobId}:manual:${Date.parse(run.fireAt)}`;
     }
     return `${run.jobId}:${Date.parse(run.fireAt)}`;
 }

package/dist/jobs/index.js

@@ -25,9 +25,9 @@
  * per principal (§5.9 `accessOf`); the service serves raw rows.
  */
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
-import { JobDoc, listRevisions, listRuns, pruneHistory, readJob, scanJobs, writeJobChange, } from "./docs.js";
+import { JobDoc, listRevisions, listRuns, patchJob, pruneHistory, readJob, scanJobs, writeJobChange, } from "./docs.js";
 import { fireJob } from "./fire.js";
-import { reconcileJobs, } from "./reconcile.js";
+import { reconcileJobs, createExecutor, liveScheduleTasksByJob, } from "./reconcile.js";
 import { removeJobState, warnJobStateRemoval } from "./state-dir.js";
 import { specHash } from "./spec.js";
 /** Thrown when an API write targets a `file:`/`ext:` job id (409 `job_declared`). */
@@ -44,6 +44,13 @@ export class JobNotFoundError extends Error {
         this.name = "JobNotFoundError";
     }
 }
+/** Thrown when `resume` targets a job that is not restart-limited (409 `not_blocked`). */
+export class JobNotBlockedError extends Error {
+    constructor(id) {
+        super(`job ${id} is not blocked by the restart limit`);
+        this.name = "JobNotBlockedError";
+    }
+}
 /** The live `jobHistory` limits (spec §8.1, ruling 14 — read per call). */
 function historyLimits(settings) {
     const jobHistory = settings().jobHistory;
@@ -108,19 +115,33 @@ export function createJobsService(deps) {
     // the subscription is the only publish trigger.
     if (deps.onChange !== undefined) {
         const onChange = deps.onChange;
-        deps.harness.subscribeCommits((publication) => {
-            const seen = new Set();
-            for (const change of publication.changes) {
-                if (change.type !== "document")
-                    continue;
-                if (change.record.kind !== JobDoc.definition.kind)
-                    continue;
-                const jobId = change.record.key;
-                if (jobId === undefined || seen.has(jobId))
-                    continue;
-                seen.add(jobId);
-                onChange(jobId);
-            }
+        deps.harness.observeCommits({
+            advance: (publication) => {
+                try {
+                    const seen = new Set();
+                    for (const change of publication.changes) {
+                        if (change.type !== "document")
+                            continue;
+                        if (change.record.kind !== JobDoc.definition.kind)
+                            continue;
+                        const jobId = change.record.key;
+                        if (jobId === undefined || seen.has(jobId))
+                            continue;
+                        seen.add(jobId);
+                        onChange(jobId);
+                    }
+                }
+                catch (error) {
+                    console.error("jobs/index: commit observer failed", error);
+                }
+            },
+            end: (end) => {
+                if (end.kind === "ended")
+                    return;
+                if (end.kind === "failed" && end.error instanceof Error && end.error.message === "session closed")
+                    return;
+                console.error("jobs/index: commit observation failed", end.kind === "failed" ? end.error : end);
+            },
         });
     }
     /** Reconcile that one job's executor after a write. */
@@ -254,6 +275,44 @@ export function createJobsService(deps) {
             const fireKey = `${id}:manual:${now}`;
             return await fireJob(deps.runtime, id, fireKey, now, ctx);
         },
+        async resume(id) {
+            const prior = await readJob(deps.harness, id, ctx);
+            if (prior === undefined)
+                throw new JobNotFoundError(id);
+            if (prior.state !== "blocked" || prior.reason !== "restart_limit") {
+                throw new JobNotBlockedError(id);
+            }
+            // Re-arm: waiting + no reason, then the executor through the
+            // SAME creation path reconcile uses.
+            await patchJob(deps.harness, id, (draft) => {
+                draft.state = "waiting";
+                delete draft.reason;
+            }, ctx);
+            const rearmed = await readJob(deps.harness, id, ctx);
+            if (rearmed === undefined)
+                throw new JobNotFoundError(id);
+            // Double-executor guard: if a live executor with the record's
+            // hash already exists (a raced reconcile created one between the
+            // block and the resume), reuse it instead of creating a second.
+            const live = await liveScheduleTasksByJob(deps.storage, ctx);
+            const existing = (live.get(id) ?? []).find((task) => task.input.hash === rearmed.hash);
+            if (existing === undefined) {
+                await createExecutor({
+                    harness: deps.harness,
+                    storage: deps.storage,
+                    runtime: deps.runtime,
+                    rootId: deps.rootId,
+                    sources: deps.sources,
+                    ...(deps.jobsRoot === undefined
+                        ? {}
+                        : { jobsRoot: deps.jobsRoot }),
+                }, id, rearmed, ctx);
+            }
+            const record = await readJob(deps.harness, id, ctx);
+            if (record === undefined)
+                throw new JobNotFoundError(id);
+            return wireOf(id, record);
+        },
         reconcile: reconcileOne,
     };
 }

package/dist/jobs/observe.js

@@ -24,8 +24,10 @@ import { SessionMetaDoc } from "../server/session-meta.js";
 import { JobDoc, JobRunDoc, listRuns, patchJob, pruneHistory, scanJobs } from "./docs.js";
 /** The `sigrun.job.run` key a run record was written under. */
 function runKeyOf(run) {
+    // Manual runs key on FIREAT (the same clock reading `runNow` used for
+    // the fire-key tail), never startedAt — see docs.ts's runKeyOf note.
     if (run.manual) {
-        return `${run.jobId}:manual:${Date.parse(run.startedAt)}`;
+        return `${run.jobId}:manual:${Date.parse(run.fireAt)}`;
     }
     return `${run.jobId}:${Date.parse(run.fireAt)}`;
 }
@@ -136,16 +138,31 @@ export function registerJobObservers(deps) {
     // this process). A no-jobs harness pays ONE boolean check per terminal
     // task, never a scan.
     let jobsMayExist = false;
-    const offJobWrites = deps.harness.subscribeCommits((publication) => {
-        for (const change of publication.changes) {
-            if (change.type !== "document")
-                continue;
-            if (change.record.kind === JobDoc.definition.kind) {
-                jobsMayExist = true;
-                return;
+    const offJobWritesObservation = deps.harness.observeCommits({
+        advance: (publication) => {
+            try {
+                for (const change of publication.changes) {
+                    if (change.type !== "document")
+                        continue;
+                    if (change.record.kind === JobDoc.definition.kind) {
+                        jobsMayExist = true;
+                        return;
+                    }
+                }
             }
-        }
+            catch (error) {
+                console.error("jobs/observe: commit observer failed", error);
+            }
+        },
+        end: (end) => {
+            if (end.kind === "ended")
+                return;
+            if (end.kind === "failed" && end.error instanceof Error && end.error.message === "session closed")
+                return;
+            console.error("jobs/observe: commit observation failed", end.kind === "failed" ? end.error : end);
+        },
     });
+    const offJobWrites = () => offJobWritesObservation.detach();
     const offTaskSettled = deps.eventBus.onHostEvent((event) => {
         if (event.type !== "taskSettled")
             return;

package/dist/jobs/reconcile.js

@@ -186,7 +186,14 @@ export async function reconcileJobs(deps, ctx = BACKGROUND_CONTEXT) {
                 for (const task of live) {
                     await deps.harness.abortTask(task.id, ctx);
                 }
-                await createExecutor(deps, id, record, ctx);
+                // D2: a restart-limited record (state blocked, reason
+                // restart_limit) gets NO new executor — its executor ended
+                // faulted and only an explicit resume re-arms it. The guard
+                // wraps ONLY the creation: stale-task pruning above (and the
+                // hash-mismatch aborts below) still runs.
+                if (!(record.state === "blocked" && record.reason === "restart_limit")) {
+                    await createExecutor(deps, id, record, ctx);
+                }
             }
             // A matching live task exists: leave it (the same task id
             // survives an unchanged reboot). Extra stale live tasks for
@@ -236,8 +243,10 @@ async function retireRecord(harness, id, record, nowIso, ctx) {
 async function patchRecord(harness, id, change, ctx) {
     await patchJob(harness, id, change, ctx);
 }
-/** Create the schedule task for one enabled record (ONE commit). */
-async function createExecutor(deps, id, record, ctx) {
+/** Create the schedule task for one enabled record (ONE commit).
+ *  Exported for `JobsService.resume` (D2): a restart-limited job's
+ *  re-arm rides the same creation path. */
+export async function createExecutor(deps, id, record, ctx) {
     const firstAt = nextFireAt(record.spec.schedule, deps.runtime.now(), deps.runtime.defaultTz);
     await deps.harness.commit(async (tx) => {
         await tx.createTask(createScheduleTask(deps.runtime), {

package/dist/jobs/restart-limit.js

@@ -0,0 +1,39 @@
+/**
+ * Jobs restart-limit recovery (D2): the restart-limited listener.
+ *
+ * pi-durable 1.5.0 removed `task_parked`/`retryTask`: a schedule task
+ * cut off `settings.restartLimit` times in a row ends FAULTED (reason
+ * `restart_limit`), reported through `HarnessOptions.onReport`. The
+ * reports collector queues those tasks; boot registers this listener
+ * after open, and it marks the owning job record
+ * `state: "blocked"`, `reason: "restart_limit"` — the signal reconcile
+ * respects (a blocked job gets NO new executor) and `POST
+ * /v1/jobs/:id/resume` clears.
+ *
+ * The listener is async and owns all Harness reads/commits; a
+ * rejection is logged by the boot wrapper, never thrown into the
+ * collector's delivery lane.
+ */
+import { patchJob } from "./docs.js";
+import { SCHEDULE_TASK_KIND } from "./task.js";
+/**
+ * Mark the job owning a restart-limited schedule task blocked. Anything
+ * that is not a schedule task (built-in kinds, unknown ids, malformed
+ * inputs) is ignored — the restart-limit recovery surface is jobs-only.
+ * A failure REJECTS: boot's registration wrapper owns the logging (one
+ * log per failure, never a double-log).
+ */
+export async function markRestartLimitedJob(harness, task, context) {
+    if (task.kind !== SCHEDULE_TASK_KIND)
+        return;
+    const record = await harness.getTask(task.id, context);
+    if (record === undefined)
+        return;
+    const jobId = record.input.jobId;
+    if (typeof jobId !== "string")
+        return;
+    await patchJob(harness, jobId, (draft) => {
+        draft.state = "blocked";
+        draft.reason = "restart_limit";
+    }, context);
+}

package/dist/sandbox/protocol.js

@@ -153,15 +153,16 @@ export function decodeWatchChange(value) {
             throw new TypeError("invalid watcher error");
         }
         return {
+            kind: "failed",
             error: new FileError(code, message, path),
         };
     }
     if ("overflow" in value && value.overflow === true)
-        return { overflow: true };
+        return { kind: "overflow" };
     if ("paths" in value &&
         Array.isArray(value.paths) &&
         value.paths.every((path) => typeof path === "string")) {
-        return { paths: value.paths };
+        return { kind: "paths", paths: value.paths };
     }
     throw new TypeError("invalid watcher change");
 }

package/dist/sandbox/sandboxed-env.js

@@ -81,6 +81,10 @@ class BaseRemoteHandle {
             this.client.releaseHandle(this.id);
         }
     }
+    /** pi-durable 1.5.0 renamed `FileWatcher.close` to `stop`; the wire verb stays "close". */
+    async stop(context) {
+        await this.close(context);
+    }
     async call(method, args, context) {
         if (this.closed)
             throw new FileError("invalid", "sandbox handle is closed");

package/dist/sandbox/worker.js

@@ -68,7 +68,14 @@ async function handleCall(request, args) {
     const method = request.op.slice("handle.".length);
     if (method === "close") {
         handles.delete(id);
-        await handle.value.close(BACKGROUND_CONTEXT);
+        // pi-durable 1.5.0: readers close, watchers stop — the wire verb is
+        // "close" for both (a rename only).
+        if (handle.kind === "watch") {
+            await handle.value.stop(BACKGROUND_CONTEXT);
+        }
+        else {
+            await handle.value.close(BACKGROUND_CONTEXT);
+        }
         return null;
     }
     if (handle.kind === "text" && method === "readLine") {
@@ -135,7 +142,11 @@ async function dispatch(request) {
             return result.ok ? { ok: true, value: openHandle({ kind: "dir", value: result.value }) } : result;
         }
         case "watch": {
-            const result = await env.watch(args[0], (change) => write({ id: request.id, event: "watch", change: encodeValue("error" in change ? { error: wireError(change.error) } : change) }), BACKGROUND_CONTEXT);
+            const result = await env.watch(args[0], (change) => write({
+                id: request.id,
+                event: "watch",
+                change: encodeValue(change.kind === "failed" ? { error: wireError(change.error) } : change.kind === "overflow" ? { overflow: true } : change),
+            }), BACKGROUND_CONTEXT);
             return result.ok
                 ? { ok: true, value: { handle: openHandle({ kind: "watch", value: result.value }), mode: result.value.mode } }
                 : result;
@@ -255,7 +266,13 @@ process.stdin.on("end", () => {
         controller.abort();
     for (const env of environments.values())
         void env.cleanup(BACKGROUND_CONTEXT);
-    for (const handle of handles.values())
-        void handle.value.close(BACKGROUND_CONTEXT);
+    for (const handle of handles.values()) {
+        if (handle.kind === "watch") {
+            void handle.value.stop(BACKGROUND_CONTEXT);
+        }
+        else {
+            void handle.value.close(BACKGROUND_CONTEXT);
+        }
+    }
     process.exit(0);
 });