@springbrand/agent-runtime 0.3.0-alpha.17 → 0.3.0-alpha.19

package/src/harness/session-harness.ts

@@ -13,10 +13,19 @@ import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import type { Api, Message, Model, Models, ModelThinkingLevel, UserMessage } from "@earendil-works/pi-ai";
 import { RuntimeConversation } from "../session";
 import { projectToolOutputForModel } from "../context/memory/budget/gate";
+import type { ArtifactRef } from "../lib/artifacts";
+import {
+  DEFAULT_MAX_WRAP_UP_MODEL_TURNS, TOOL_FAILURE_WRAP_UP_INSTRUCTION, ModelRecovery, ToolGovernance,
+  artifactManifestMessage, artifactRefFromMessage,
+} from "./governance";
+
+const DEFAULT_WRAP_UP_INSTRUCTION = "Finish this request now without using tools. Summarize the completed work and any remaining limitation.";
 
 export interface SessionHarnessLimits {
   modelTurnsPerSlice?: number;
   maxModelTurns?: number;
+  /** Text turns allowed after the working or Tool failure budget before the Submission is stopped. */
+  maxWrapUpModelTurns?: number;
   wrapUpInstruction?: string;
 }
 export interface SessionHarnessOptions {
@@ -35,6 +44,8 @@ export interface SessionHarnessOptions {
   retry?: Partial<ConversationRetryPolicy>;
   toolExecution?: "parallel" | "sequential";
   limits?: SessionHarnessLimits;
+  /** Per-Submission provider error classification and provider Session identity. */
+  recovery?: ModelRecovery;
   beforeTool?: ToolHooks["beforeTool"];
   afterResponse?: GenerationHooks["afterResponse"];
 }
@@ -63,6 +74,11 @@ export class SessionHarness {
   private requestId?: string;
   private release!: (reason: "approval" | "interaction" | "slice") => void;
   private turnsAtOpen = 0;
+  private governance = new ToolGovernance();
+  private readonly artifactRefs = new Map<string, ArtifactRef>();
+  private wrapUpStarted = false;
+  /** Completed model turns of the current Submission. */
+  private ownedTurns = 0;
   private readonly released = new Promise<"approval" | "interaction" | "slice">((resolve) => { this.release = resolve; });
   private constructor(
     readonly harness: NativeHarness,
@@ -85,26 +101,59 @@ export class SessionHarness {
       sections: [section("system", () => options.systemPrompt, { tag: false })],
       hooks: [
         hook(GenerationTask, {
-          beforeRequest: ({ messages }) => ({ messages: messages.map((message): Message => {
-            if (message.role !== "toolResult" || exemptions.has(message.toolName)) return message;
-            const next = projectToolOutputForModel({ content: message.content, details: message.details }) as Pick<typeof message, "content" | "details">;
-            return { ...message, ...next };
-          }) }),
-          afterResponse: options.afterResponse,
+          beforeRequest: ({ messages }) => {
+            const projected = messages.map((message): Message => {
+              if (message.role !== "toolResult" || exemptions.has(message.toolName)) return message;
+              const next = projectToolOutputForModel({ content: message.content, details: message.details }) as Pick<typeof message, "content" | "details">;
+              return { ...message, ...next };
+            });
+            const manifest = artifactManifestMessage(runtime.artifactRefs);
+            const instruction = runtime.governance.wrapUp
+              ? TOOL_FAILURE_WRAP_UP_INSTRUCTION
+              : runtime.wrapUpStarted ? options.limits?.wrapUpInstruction ?? DEFAULT_WRAP_UP_INSTRUCTION : undefined;
+            return { messages: [
+              ...projected,
+              ...(manifest ? [manifest] : []),
+              ...(instruction ? [{ role: "user" as const, content: instruction, timestamp: 1 }] : []),
+            ] };
+          },
+          afterResponse: async (message, api, hookContext) => {
+            options.recovery?.classify(message);
+            await options.afterResponse?.(message, api, hookContext);
+          },
           afterTools: async (_assistant, _results, _api, hookContext) => {
             const entries = await runtime.entries(hookContext);
-            const receipt = await runtime.submission?.status(hookContext);
-            const owned = receipt?.entry ? entries.filter((entry) => entry.id >= receipt.entry!) : entries;
-            const turns = owned.filter((entry) => entry.kind === "pi.assistant").length;
+            const turns = runtime.ownedTurns = (await runtime.ownedEntries(entries, hookContext)).filter((entry) => entry.kind === "pi.assistant").length;
             const total = entries.filter((entry) => entry.kind === "pi.assistant").length;
+            const maxTurns = options.limits?.maxModelTurns ?? 300;
+            const wrapUpAt = Math.min(maxTurns, runtime.governance.wrapUpAt ?? Infinity);
+            if (turns >= wrapUpAt + (options.limits?.maxWrapUpModelTurns ?? DEFAULT_MAX_WRAP_UP_MODEL_TURNS)) {
+              // The wrap-up is still calling Tools it no longer has; end the Submission instead of looping.
+              void runtime.conversation.abort(BACKGROUND_CONTEXT).catch(() => {});
+              return;
+            }
+            if (turns >= wrapUpAt && !runtime.wrapUpStarted) {
+              runtime.wrapUpStarted = true;
+              // Tools return on the next Submission's configure; the instruction is per request, never stored.
+              await runtime.conversation.configure({ tools: [] }, hookContext);
+            }
             if (total - runtime.turnsAtOpen >= (options.limits?.modelTurnsPerSlice ?? 30)) runtime.release("slice");
-            if (turns >= (options.limits?.maxModelTurns ?? 300)) await runtime.conversation.configure({ tools: [], instructions: options.limits?.wrapUpInstruction ?? "Finish this request now without using tools. Summarize the completed work and any remaining limitation." }, hookContext);
           },
         }),
         hook(ToolTask, {
-          beforeTool: options.beforeTool,
+          beforeTool: async (call, api, hookContext) => {
+            // Calls belong to the assistant turn after the last completed Tool round.
+            const block = runtime.governance.admit(call, runtime.ownedTurns + 1);
+            if (block !== undefined) return { block };
+            return options.beforeTool?.(call, api, hookContext);
+          },
           afterTool: async (call, result) => {
-            const names = options.toolsToActivate?.(call.name, { content: [...result.content ?? []], details: result.details }, result.isError === true) ?? [];
+            runtime.governance.record(call, result.isError === true, runtime.ownedTurns + 1);
+            const ref = artifactRefFromMessage({ role: "toolResult", details: result.details });
+            if (ref) runtime.artifactRefs.set(ref.artifactId, ref);
+            const compiled = new Set(options.tools?.map((tool) => tool.name) ?? []);
+            const names = (options.toolsToActivate?.(call.name, { content: [...result.content ?? []], details: result.details }, result.isError === true) ?? [])
+              .filter((name) => compiled.has(name));
             return names.length ? { ...result, control: { ...result.control, addTools: names } } : undefined;
           },
         }),
@@ -113,7 +162,14 @@ export class SessionHarness {
     registry.install(extension);
     const harness = await Harness.open(storage, {
       models: options.models, registry,
-      settings: { stream: options.streamOptions, compaction: options.compaction, toolExecution: options.toolExecution, retry: options.retry ?? { maxRetries: 4 } },
+      settings: {
+        stream: options.streamOptions, compaction: options.compaction, toolExecution: options.toolExecution,
+        // Read for every retry decision, after afterResponse has classified that response.
+        get retry() {
+          const retry = { maxRetries: 4, ...options.retry };
+          return options.recovery ? { ...retry, enabled: (retry.enabled ?? true) && options.recovery.retryAllowed } : retry;
+        },
+      },
     }, context);
     const pointer = await harness.snapshot(RuntimeConversation, context);
     const conversation = pointer?.id ? await harness.conversation(pointer.id, context) : await harness.root(context);
@@ -127,6 +183,7 @@ export class SessionHarness {
       runtime.submission = await harness.submission(unfinished[0].id, context);
       runtime.requestId = unfinished[0].requestId;
     }
+    await runtime.restoreGovernance(context);
     return runtime;
   }
 
@@ -142,6 +199,29 @@ export class SessionHarness {
     } while (cursor);
     return entries;
   }
+  /** Entries of the active Submission, from its input onward. */
+  async ownedEntries(entries: readonly EntryRecord[], context: Context): Promise<EntryRecord[]> {
+    const receipt = await this.submission?.status(context);
+    return receipt?.entry ? entries.filter((entry) => entry.id >= receipt.entry!) : [...entries];
+  }
+  private async restoreGovernance(context: Context): Promise<void> {
+    const entries = await this.entries(context);
+    this.artifactRefs.clear();
+    for (const entry of entries) {
+      const message = entry.model?.[0];
+      const ref = message ? artifactRefFromMessage(message) : undefined;
+      if (ref) this.artifactRefs.set(ref.artifactId, ref);
+    }
+    this.governance = new ToolGovernance();
+    this.wrapUpStarted = false;
+    this.ownedTurns = 0;
+    if (!this.submission) return;
+    const owned = await this.ownedEntries(entries, context);
+    this.governance.restore(owned);
+    this.ownedTurns = owned.filter((entry) => entry.kind === "pi.assistant").length;
+    const wrapUpAt = Math.min(this.options.limits?.maxModelTurns ?? 300, this.governance.wrapUpAt ?? Infinity);
+    this.wrapUpStarted = this.ownedTurns >= wrapUpAt;
+  }
   watch(context: Context): Promise<AgentEventStream> { return watchEvents(this.harness, this.conversation.id, context); }
   requestHumanRelease(reason: "approval" | "interaction"): void { this.release(reason); }
   async fork(at: EntryId | null, context: Context): Promise<void> {
@@ -167,10 +247,13 @@ export class SessionHarness {
       const names = new Set(this.options.activeToolNames ?? this.options.tools?.map((tool) => tool.name) ?? []);
       const previous = await this.harness.snapshot(AgentDoc, this.conversation.id, context);
       if (Array.isArray(previous?.tools)) for (const name of previous.tools) if (this.options.onDemandToolNames?.includes(name)) names.add(name);
-      await this.conversation.configure({ model: { provider: this.options.model.provider, modelId: this.options.model.id }, thinkingLevel: this.options.thinkingLevel ?? "off", tools: this.options.tools?.filter((tool) => names.has(tool.name)) ?? [] }, context);
+      await this.conversation.configure({ model: { provider: this.options.model.provider, modelId: this.options.model.id }, thinkingLevel: this.options.thinkingLevel ?? "off", tools: this.options.tools?.filter((tool) => names.has(tool.name)) ?? [],
+        // Earlier runtimes stored the wrap-up instruction in the agent; it applies to one Submission only.
+        instructions: null }, context);
       this.requestId = request.operationId;
       this.submission = await this.conversation.submit({ type: "input", requestId: request.operationId, content: typeof request.prompt === "string" ? request.prompt : request.prompt.content, whenBusy: "reject" }, context);
     }
+    await this.restoreGovernance(context);
   }
   async run(request: SessionRunRequest | undefined, context: Context): Promise<SessionHarnessRunResult> {
     if (request) await this.admit(request, context);

package/src/models/index.ts

@@ -537,14 +537,15 @@ export function modelRequestUrl(model: Model<Api>): string {
  */
 export function withProviderBoundary(
   streamFn: ProviderBoundStream,
-  defaultSessionId?: string,
+  /** Host-owned provider Session; it overrides the durable Harness's per-conversation identity. */
+  hostSessionId?: string | (() => string),
   onGeneration?: PiGenerationLifecycleObserver,
 ): ProviderBoundStream {
   return (model, context, options) =>
     lazyStream(model, async () => {
       const requestId = crypto.randomUUID();
       const startedAt = Date.now();
-      const sessionId = options?.sessionId ?? defaultSessionId;
+      const sessionId = (typeof hostSessionId === "function" ? hostSessionId() : hostSessionId) ?? options?.sessionId;
       const url = modelRequestUrl(model);
       const systemPrompt = "systemPrompt" in context && typeof context.systemPrompt === "string"
         ? context.systemPrompt
@@ -910,6 +911,11 @@ function configuredModel(
             ...(endpoint.protocol === "openrouter-messages"
               ? {
                   ...anthropicMessagesCompat,
+                  // The direct Anthropic catalog enables positional system and Tool updates, but
+                  // OpenRouter Messages rejects `tool_addition` definitions. Fold them into the
+                  // leading system and top-level tools so deferred Tool decoration still applies.
+                  supportsMidConvoSystemMessages: false,
+                  supportsMidConvoToolChanges: false,
                   supportsMidConvoEffort: false,
                   supportsEagerToolInputStreaming: false,
                   supportsStrictTools:
@@ -922,6 +928,9 @@ function configuredModel(
               : endpoint.protocol === "openrouter-chat"
                 ? {
                     ...catalogCompat,
+                    // OpenRouter Chat has no verified positional system or Tool update support.
+                    supportsMidConvoSystemMessages: false,
+                    supportsMidConvoToolChanges: false,
                     thinkingFormat: "openrouter" as const,
                     maxTokensField: "max_tokens" as const,
                     supportsStore: false,

package/src/session/cloudflare/migration.ts

@@ -92,6 +92,89 @@ function normalizeLegacyAskUserEntry(value: unknown): unknown {
   return value;
 }
 
+const TERMINAL_HOST_STATUSES = new Set(["completed", "failed", "aborted", "skipped", "error"]);
+/** Legacy run phases whose state maps onto a native generation checkpoint without guessing. */
+const RESUMABLE_PHASES = new Set(["starting", "checkpoint", "assistant.ready", "assistant.effect_pending", "assistant.retry_wait"]);
+const MESSAGE_ROLES = new Set(["user", "assistant", "toolResult", "custom", "bashExecution", "branchSummary", "compactionSummary"]);
+const UNKNOWN_EFFECT = "Tool execution was interrupted and its external outcome is unknown. Do not repeat the effect without reconciling it.";
+const INTERRUPTED = "This request was interrupted by a runtime upgrade and did not finish. Send it again to continue.";
+
+type LegacyResult = { status?: string; error?: { code?: string; message?: string } };
+type ToolBatch = { assistantEntryId: string; turnId: string; calls: Array<{ status: string; sourceIndex: number; resultEntryId: string; replay?: string }> };
+
+function warn(message: string): void {
+  console.warn("[pi-session-migration]", message);
+}
+
+/** Custom messages reach the model as user context, matching `ConversationHistory.append` (e.g. turn-aborted markers). */
+function customModel(message: Message, createdAt: number): { model?: Message[] } {
+  const content = (message as unknown as { content?: unknown }).content;
+  if (typeof content === "string") return { model: [{ role: "user", content, timestamp: createdAt }] };
+  if (!Array.isArray(content) || !content.length) return {};
+  return { model: [{ role: "user", content: [...content] as Extract<Message, { role: "user" }>["content"], timestamp: createdAt }] };
+}
+
+function unknownOutcome(call: { id: string; name: string }, text = UNKNOWN_EFFECT): Message {
+  return { role: "toolResult", toolCallId: call.id, toolName: call.name, content: [{ type: "text", text }], isError: true, timestamp: Date.now() };
+}
+
+/**
+ * Normalizes historical records onto the native shapes and drops records that can never be valid model context.
+ * Dropped and branch-pointer records resolve to their nearest kept ancestor, so descendants stay on their branch.
+ */
+function repairLegacyEntries(raw: LegacyEntry[]): { entries: LegacyEntry[]; resolve: (id: string | null) => string | null } {
+  const kept = new Map<string, LegacyEntry>();
+  const alias = new Map<string, string | null>();
+  const resolve = (id: string | null): string | null => {
+    for (let seen = 0; id !== null && !kept.has(id) && alias.has(id); seen++) {
+      if (seen > alias.size) throw new Error(`Cyclic historical Pi reference: ${id}`);
+      id = alias.get(id)!;
+    }
+    return id;
+  };
+  const entries: LegacyEntry[] = [];
+  for (const source of raw) {
+    const parentId = resolve(source.parentId);
+    const skip = (reason: string) => {
+      warn(`Skipped historical entry ${source.id}: ${reason}`);
+      alias.set(source.id, parentId);
+    };
+    if (source.type === "leaf") {
+      alias.set(source.id, resolve(typeof source.targetId === "string" ? source.targetId : source.targetId === null ? null : parentId));
+      continue;
+    }
+    let entry: LegacyEntry = { ...source, parentId };
+    if (source.type === "custom_message") {
+      if (typeof source.customType !== "string") { skip("custom message has no type"); continue; }
+      entry = {
+        id: source.id, parentId, type: "message", timestamp: source.timestamp,
+        message: { role: "custom", customType: source.customType, content: source.content, details: source.details, display: source.display, timestamp: timestamp(source) } as unknown as Message,
+      };
+    }
+    if (entry.type === "message") {
+      const message = entry.message as unknown as Record<string, unknown> | undefined;
+      if (!message || typeof message !== "object" || !MESSAGE_ROLES.has(message.role as string)) { skip("unknown message"); continue; }
+      if (message.role === "assistant" && message.stopReason === "pending") { skip("unsettled assistant"); continue; }
+      if (message.role === "toolResult") {
+        let call: { name: string } | undefined;
+        let duplicate = false;
+        for (let cursor = parentId; cursor && !call && !duplicate; cursor = kept.get(cursor)?.parentId ?? null) {
+          const ancestor = kept.get(cursor)?.message;
+          if (ancestor?.role === "toolResult" && ancestor.toolCallId === message.toolCallId) duplicate = true;
+          if (ancestor?.role === "assistant") {
+            call = ancestor.content.find((part) => part.type === "toolCall" && part.id === message.toolCallId) as { name: string } | undefined;
+          }
+        }
+        if (duplicate) { skip(`duplicate Tool result ${String(message.toolCallId)}`); continue; }
+        if (!call || call.name !== message.toolName) { skip(`orphan Tool result ${String(message.toolCallId)}`); continue; }
+      }
+    }
+    kept.set(entry.id, entry);
+    entries.push(entry);
+  }
+  return { entries, resolve };
+}
+
 /** Converts records once; historical tables are retained until the upgrade is accepted. */
 export async function migratePiSession(storage: DurableObjectStorage, session: Session): Promise<void> {
   if ((await session.snapshot(Migration, BACKGROUND_CONTEXT))?.completed) return;
@@ -105,9 +188,11 @@ export async function migratePiSession(storage: DurableObjectStorage, session: S
   const rows = current || older
     ? sql.exec<{ body: string }>(`SELECT body FROM ${current ? "pi_entries" : "pi_session_entries"} ORDER BY seq`).toArray()
     : [];
-  const entries = rows.map(({ body }) => normalizeLegacyAskUserEntry(JSON.parse(body)) as LegacyEntry);
+  const raw = rows.map(({ body }) => normalizeLegacyAskUserEntry(JSON.parse(body)) as LegacyEntry);
+  if (new Set(raw.map((entry) => entry.id)).size !== raw.length) throw new Error("Historical Pi entry IDs are not unique");
+  const repaired = repairLegacyEntries(raw);
+  const entries = repaired.entries;
   const byId = new Map(entries.map((entry) => [entry.id, entry]));
-  if (byId.size !== entries.length) throw new Error("Historical Pi entry IDs are not unique");
   const values = current && hasTable(sql, "pi_values")
     ? sql.exec<{ namespace: string; key: string; body: string }>("SELECT namespace,key,body FROM pi_values").toArray()
     : [];
@@ -116,18 +201,25 @@ export async function migratePiSession(storage: DurableObjectStorage, session: S
     return row ? JSON.parse(row.body) as T : undefined;
   };
   const tipValue = values.find((row) => row.namespace === "pi.branch.tip" && row.key === "main");
-  const last = entries.at(-1);
-  let oldTip: string | null = tipValue ? JSON.parse(tipValue.body) : last?.type === "leaf" ? last.targetId as string | null : last?.id ?? null;
+  let oldTip: string | null = repaired.resolve(tipValue ? JSON.parse(tipValue.body) as string | null : raw.at(-1)?.id ?? null);
+  const hostRows = hasTable(sql, "pi_submissions")
+    ? sql.exec<{ submission_id: string; status: string }>("SELECT submission_id,status FROM pi_submissions").toArray()
+    : [];
+  const hostStatus = new Map(hostRows.map((row) => [row.submission_id, row.status]));
   const lane = read<{ currentOperationId?: string | null }>("pi.lane.state", "main");
   const operationId = lane?.currentOperationId;
-  const result = operationId ? read<{ status?: string }>("pi.result", operationId) : undefined;
-  const legacyRunning = older && hasTable(sql, "pi_submissions") ? sql.exec<{ submission_id: string }>("SELECT submission_id FROM pi_submissions WHERE status='running'").toArray() : [];
+  const legacyRunning = older ? hostRows.filter((row) => row.status === "running") : [];
   if (legacyRunning.length > 1) throw new Error("Multiple legacy operations are active in one conversation");
-  const hostStatus = operationId && hasTable(sql, "pi_submissions")
-    ? sql.exec<{ status: string }>("SELECT status FROM pi_submissions WHERE submission_id=?", operationId).toArray()[0]?.status
-    : undefined;
-  const terminal = hostStatus && ["completed", "failed", "aborted", "skipped"].includes(hostStatus);
-  const active = operationId && result === undefined && !terminal ? operationId : legacyRunning[0]?.submission_id;
+  let active: string | undefined = operationId && read<LegacyResult>("pi.result", operationId) === undefined && !TERMINAL_HOST_STATUSES.has(hostStatus.get(operationId) ?? "")
+    ? operationId
+    : legacyRunning[0]?.submission_id;
+  // Navigation and standalone compaction never committed their target. The Host re-admits the owning
+  // Submission from its queued input, so the native runtime performs the whole step itself.
+  const intent = active ? read<{ intent?: { kind?: string } }>("pi.op.meta", active)?.intent?.kind ?? (active.endsWith(":regenerate") ? "navigation" : "run") : undefined;
+  if (active && intent !== "run") {
+    warn(`Dropped unfinished legacy ${intent} operation ${active}`);
+    active = undefined;
+  }
   const links = hasTable(sql, "pi_session_entry_submission")
     ? sql.exec<{ entry_id: string; submission_id: string }>("SELECT entry_id,submission_id FROM pi_session_entry_submission").toArray()
     : hasTable(sql, "pi_session_message_submission") ? sql.exec<{ entry_id: string; submission_id: string }>("SELECT message_id AS entry_id,submission_id FROM pi_session_message_submission").toArray() : [];
@@ -156,6 +248,10 @@ export async function migratePiSession(storage: DurableObjectStorage, session: S
       }
     }
   }
+  const commitResult = (id: string, outcome: Message) => {
+    const entry: LegacyEntry = { id, parentId: oldTip, type: "message", message: outcome, timestamp: outcome.timestamp };
+    entries.push(entry); byId.set(entry.id, entry); owners.set(entry.id, active!); oldTip = entry.id;
+  };
   if (older && active && hasTable(sql, "pi_recovery_milestones")) {
     const milestones = sql.exec<{ body: string }>("SELECT body FROM pi_recovery_milestones WHERE submission_id=? ORDER BY seq", active).toArray();
     const recovered = replayPiToolRecovery(milestones.map((row) => row.body));
@@ -163,36 +259,68 @@ export async function migratePiSession(storage: DurableObjectStorage, session: S
     for (const call of Object.values(recovered.toolCalls)) {
       if (existing.has(call.toolCallId)) continue;
       const pending = Object.values(recovered.approvals).some((row) => row.toolCallId === call.toolCallId && row.status === "pending") || Object.values(recovered.interactions).some((row) => row.toolCallId === call.toolCallId && row.status === "pending");
-      const outcome = call.result ?? (!pending && call.retry === "non-idempotent" ? { role: "toolResult" as const, toolCallId: call.toolCallId, toolName: call.toolName, content: [{ type: "text" as const, text: "Interrupted legacy effect; its outcome is unknown. Reconcile it before repeating it." }], isError: true, timestamp: Date.now() } : undefined);
-      if (!outcome) continue;
-      const entry: LegacyEntry = { id: `legacy-result:${active}:${call.toolCallId}`, parentId: oldTip, type: "message", message: outcome, timestamp: outcome.timestamp };
-      entries.push(entry); byId.set(entry.id, entry); owners.set(entry.id, active); oldTip = entry.id;
+      const outcome = call.result ?? (!pending && call.retry === "non-idempotent" ? unknownOutcome({ id: call.toolCallId, name: call.toolName }, "Interrupted legacy effect; its outcome is unknown. Reconcile it before repeating it.") : undefined);
+      if (outcome) commitResult(`legacy-result:${active}:${call.toolCallId}`, outcome);
     }
   }
-  const operation = active ? read<{ at: string; batch?: { assistantEntryId: string; turnId: string; calls: Array<{ status: string; sourceIndex: number; resultEntryId: string; replay?: string }> } }>("pi.op.state", active) : undefined;
+  // An operation that cannot be resumed is settled as interrupted. It never replays an uncertain effect.
+  let interrupted: string | undefined;
+  const operation = active ? read<{ at: string; batch?: ToolBatch }>("pi.op.state", active) : undefined;
   if (active && operation?.at === "tools") {
-    const assistant = byId.get(operation.batch!.assistantEntryId)?.message;
-    if (assistant?.role !== "assistant") throw new Error("Historical Tool batch has no canonical assistant");
-    for (const call of operation.batch!.calls) {
-      const tool = assistant.content[call.sourceIndex];
-      if (tool?.type !== "toolCall") throw new Error("Historical Tool batch index is invalid");
+    const message = operation.batch ? byId.get(operation.batch.assistantEntryId)?.message : undefined;
+    const assistant = message?.role === "assistant" ? message : undefined;
+    if (!assistant) interrupted = "Historical Tool batch has no canonical assistant";
+    for (const call of assistant ? operation.batch!.calls : []) {
+      const part = assistant!.content[call.sourceIndex];
+      if (typeof part !== "object" || part?.type !== "toolCall") { interrupted = "Historical Tool batch index is invalid"; continue; }
+      const tool = part;
       if (call.status === "completed") continue;
-      const staged = read<{ type?: string; payload?: Message }>("pi.pending.entry", call.resultEntryId);
-      let outcome = staged?.payload;
-      if (call.status === "outcome_ready" && outcome?.role !== "toolResult") throw new Error("Historical Tool outcome is missing");
-      if (call.status === "effect_pending" && call.replay !== "safe") {
-        outcome = { role: "toolResult", toolCallId: tool.id, toolName: tool.name, content: [{ type: "text", text: "Tool execution was interrupted and its external outcome is unknown. Do not repeat the effect without reconciling it." }], isError: true, timestamp: Date.now() };
+      let outcome = read<{ type?: string; payload?: Message }>("pi.pending.entry", call.resultEntryId)?.payload;
+      if (outcome && (outcome.role !== "toolResult" || outcome.toolCallId !== tool.id || outcome.toolName !== tool.name)) {
+        warn(`Historical Tool outcome ${call.resultEntryId} conflicts with its call`);
+        outcome = unknownOutcome(tool);
       }
-      if (outcome) {
-        if (outcome.role !== "toolResult" || outcome.toolCallId !== tool.id || outcome.toolName !== tool.name) throw new Error("Historical Tool outcome conflicts with its call");
-        const entry: LegacyEntry = { id: call.resultEntryId, parentId: oldTip, type: "message", message: outcome, timestamp: outcome.timestamp };
-        entries.push(entry); byId.set(entry.id, entry); owners.set(entry.id, active); oldTip = entry.id;
+      if (call.status === "outcome_ready" && outcome?.role !== "toolResult") {
+        warn(`Historical Tool outcome ${call.resultEntryId} is missing`);
+        outcome = unknownOutcome(tool);
       }
+      if (call.status === "effect_pending" && call.replay !== "safe") outcome = unknownOutcome(tool);
+      if (outcome) commitResult(call.resultEntryId, outcome);
+    }
+  } else if (active && operation && !RESUMABLE_PHASES.has(operation.at)) {
+    interrupted = `Historical operation ${operation.at} cannot resume natively`;
+  }
+  const branch = (tip: string | null): LegacyEntry[] => {
+    const chain: LegacyEntry[] = [];
+    for (let id = tip; id; id = byId.get(id)?.parentId ?? null) {
+      const entry = byId.get(id);
+      if (!entry) throw new Error("Historical branch is invalid");
+      chain.unshift(entry);
     }
-  } else if (active && operation && !["starting", "checkpoint", "assistant.ready", "assistant.effect_pending", "assistant.retry_wait"].includes(operation.at)) {
-    throw new Error(`Historical operation ${operation.at} needs an explicit migration before it can run`);
+    return chain;
+  };
+  let owned = active ? branch(oldTip).filter((entry) => owners.get(entry.id) === active) : [];
+  let prompt = owned.find((entry) => entry.message?.role === "user");
+  if (active && !prompt) interrupted ??= "Active historical operation has no canonical user input";
+  if (active && interrupted) {
+    warn(`Settled legacy operation ${active} as interrupted: ${interrupted}`);
+    const assistant = [...owned].reverse().find((entry) => entry.message?.role === "assistant")?.message;
+    const settled = new Set(owned.flatMap((entry) => entry.message?.role === "toolResult" ? [entry.message.toolCallId] : []));
+    for (const part of assistant?.role === "assistant" ? assistant.content : []) {
+      if (part.type === "toolCall" && !settled.has(part.id)) commitResult(`legacy-interrupted:${active}:${part.id}`, unknownOutcome(part));
+    }
+    owned = branch(oldTip).filter((entry) => owners.get(entry.id) === active);
+    prompt = owned.find((entry) => entry.message?.role === "user");
   }
+  // Pi finished these operations before the Host recorded their terminal; settle them instead of rerunning input.
+  const finished = hostRows.flatMap((row) => {
+    if (row.submission_id === active || !["pending", "running"].includes(row.status)) return [];
+    const result = read<LegacyResult>("pi.result", row.submission_id);
+    return result ? [{ id: row.submission_id, result }] : [];
+  });
   const converted = new Map<string, EntryRecord>();
+  // Where a child continues; a compaction's retained context belongs to every branch through it.
+  const anchors = new Map<string, EntryRecord>();
   const conversationByEntry = new Map<string, ConversationId>();
   const tips = new Map<ConversationId, string>();
   const copiedUi: Array<{ id: string; body: string }> = [];
@@ -206,7 +334,7 @@ export async function migratePiSession(storage: DurableObjectStorage, session: S
         if (!entry.id || (entry.parentId !== null && !byId.has(entry.parentId))) {
           throw new Error(`Historical Pi entry has a missing parent: ${entry.id}`);
         }
-        const parent = entry.parentId ? converted.get(entry.parentId) : undefined;
+        const parent = entry.parentId ? anchors.get(entry.parentId) : undefined;
         if (entry.parentId && !parent) throw new Error(`Historical Pi entry is out of order: ${entry.id}`);
         let conversationId = parent ? conversationByEntry.get(entry.parentId!)! : initial.id;
         if (parent && tips.get(conversationId) !== entry.parentId) {
@@ -214,15 +342,16 @@ export async function migratePiSession(storage: DurableObjectStorage, session: S
         }
         const message = entry.message;
         let record: EntryRecord;
+        let anchor: EntryRecord;
         if (entry.type === "message" && message) {
           const role = (message as { role: string }).role;
-          record = await tx.appendEntry(conversationId, {
+          record = anchor = await tx.appendEntry(conversationId, {
             kind: role === "toolResult" ? "pi.tool-result" : role === "custom" ? "springbrand.custom" : `pi.${role}`,
-            ...(role === "custom" ? {} : { model: [message] }),
-            data: { displayId: entry.id, createdAt: timestamp(entry), ...(role === "custom" ? { message: message as unknown as Record<string, never> } : {}), ...(role === "toolResult" ? { diagnostics: [] } : {}) },
+            ...(role === "custom" ? customModel(message, timestamp(entry)) : { model: [message] }),
+            data: JSON.parse(JSON.stringify({ displayId: entry.id, createdAt: timestamp(entry), ...(role === "custom" ? { message } : {}), ...(role === "toolResult" ? { diagnostics: [] } : {}) })),
           });
         } else if (entry.type === "compaction" || entry.type === "branch_summary") {
-          record = await tx.appendEntry(conversationId, {
+          record = anchor = await tx.appendEntry(conversationId, {
             kind: "pi.compaction", model: [{ role: "user", content: `<summary>\n${entry.summary ?? ""}\n</summary>`, timestamp: timestamp(entry) }],
             head: "self", data: { reason: "manual", displayId: entry.id, createdAt: timestamp(entry) },
           });
@@ -241,12 +370,13 @@ export async function migratePiSession(storage: DurableObjectStorage, session: S
             retainedTail = tail;
           }
           for (const retained of retainedTail ?? []) {
-            await tx.appendEntry(conversationId, { kind: "springbrand.retained-context", model: [retained] });
+            anchor = await tx.appendEntry(conversationId, { kind: "springbrand.retained-context", model: [retained] });
           }
         } else {
-          record = await tx.appendEntry(conversationId, { kind: "springbrand.history", data: { displayId: entry.id, createdAt: timestamp(entry), record: entry as unknown as Record<string, never> } });
+          record = anchor = await tx.appendEntry(conversationId, { kind: "springbrand.history", data: { displayId: entry.id, createdAt: timestamp(entry), record: entry as unknown as Record<string, never> } });
         }
         converted.set(entry.id, record);
+        anchors.set(entry.id, anchor);
         conversationByEntry.set(entry.id, conversationId);
         tips.set(conversationId, entry.id);
         if (entry.id === oldTip) selected = conversationId;
@@ -257,7 +387,7 @@ export async function migratePiSession(storage: DurableObjectStorage, session: S
     if (oldTip === null && entries.length) {
       selected = (await session.commit((tx) => tx.createConversation({ ownership: { kind: "ownerless" } }), BACKGROUND_CONTEXT)).id;
     } else if (oldTip && tips.get(selected) !== oldTip) {
-      const tip = converted.get(oldTip);
+      const tip = anchors.get(oldTip);
       if (!tip) throw new Error("Historical branch tip is missing");
       selected = (await session.commit((tx) => tx.forkConversation(tip.conversationId, tip.id, { ownership: { kind: "ownerless" } }), BACKGROUND_CONTEXT)).id;
     }
@@ -271,16 +401,29 @@ export async function migratePiSession(storage: DurableObjectStorage, session: S
         if (typeof config.thinkingLevel === "string") agent.thinkingLevel = config.thinkingLevel as typeof agent.thinkingLevel;
         if (Array.isArray(config.activeToolNames)) agent.tools = config.activeToolNames as string[];
       }
-      if (active) {
-        const chain: LegacyEntry[] = [];
-        for (let id = oldTip; id; id = byId.get(id)?.parentId ?? null) {
-          const entry = byId.get(id);
-          if (!entry) throw new Error("Active historical operation has an invalid branch");
-          chain.unshift(entry);
+      const selectedBranch = branch(oldTip);
+      for (const { id, result } of finished) {
+        const ownedBySubmission = selectedBranch.filter((entry) => owners.get(entry.id) === id);
+        const input = ownedBySubmission.find((entry) => entry.message?.role === "user");
+        const reply = [...ownedBySubmission].reverse().find((entry) => entry.message?.role === "assistant");
+        const entry = input ? converted.get(input.id)!.id : undefined;
+        if ((result.status === "completed" || result.status === "declined") && entry !== undefined && reply) {
+          await tx.createSubmission({ conversationId: selected, requestId: id, type: "input", status: "done", entry, answer: converted.get(reply.id)!.id });
+        } else {
+          await tx.createSubmission({
+            conversationId: selected, requestId: id, type: "input", status: "unanswered",
+            reason: result.status === "aborted" ? "aborted" : result.status ?? "failed",
+            detail: result.error?.message ?? (result.status === "aborted" ? "Cancelled" : "The legacy request ended without an answer."),
+            ...(entry !== undefined ? { entry } : {}),
+          });
         }
-        const owned = chain.filter((entry) => owners.get(entry.id) === active);
-        const prompt = owned.find((entry) => entry.message?.role === "user");
-        if (!prompt) throw new Error("Active historical operation has no canonical user input");
+      }
+      if (active && interrupted) {
+        await tx.createSubmission({
+          conversationId: selected, requestId: active, type: "input", status: "unanswered", reason: "interrupted", detail: INTERRUPTED,
+          ...(prompt ? { entry: converted.get(prompt.id)!.id } : {}),
+        });
+      } else if (active && prompt) {
         const promptEntry = converted.get(prompt.id)!;
         const submission = await tx.createSubmission({ conversationId: selected, requestId: active, type: "input", status: "placed", entry: promptEntry.id });
         const assistant = [...owned].reverse().find((entry) => entry.message?.role === "assistant");
@@ -302,13 +445,46 @@ export async function migratePiSession(storage: DurableObjectStorage, session: S
     sql.exec("CREATE TABLE IF NOT EXISTS pi_session_entry_submission (entry_id TEXT PRIMARY KEY, submission_id TEXT NOT NULL)");
     for (const link of copiedLinks) sql.exec("INSERT OR IGNORE INTO pi_session_entry_submission VALUES (?,?)", link.id, link.submissionId);
     for (const sidecar of copiedUi) sql.exec("INSERT OR IGNORE INTO pi_message_ui VALUES (?,?)", sidecar.id, sidecar.body);
+    if (hasTable(sql, "pi_pending_steers")) {
+      // Old Pi committed these Steers but the Host receipt survived; a native requeue would duplicate them.
+      const steers = sql.exec<{ message_id: string; harness_entry_id: string | null; ui_message_json: string | null }>("SELECT message_id,harness_entry_id,ui_message_json FROM pi_pending_steers").toArray();
+      for (const steer of steers) {
+        const record = converted.get(steer.harness_entry_id ?? "") ?? converted.get(steer.message_id);
+        if (!record) continue;
+        if (steer.ui_message_json) {
+          sql.exec("CREATE TABLE IF NOT EXISTS pi_message_ui (message_id TEXT PRIMARY KEY, body TEXT NOT NULL)");
+          sql.exec("INSERT OR IGNORE INTO pi_message_ui VALUES (?,?)", String(record.id), steer.ui_message_json);
+        }
+        sql.exec("DELETE FROM pi_pending_steers WHERE message_id=?", steer.message_id);
+      }
+    }
     for (const table of ["pi_approvals", "pi_tool_interactions"]) {
       if (!hasTable(sql, table)) continue;
       const rows = sql.exec<{ rowid: number; input_json: string }>(`SELECT rowid,input_json FROM ${table} WHERE tool_name='ask_user'`).toArray();
       for (const row of rows) sql.exec(`UPDATE ${table} SET input_json=? WHERE rowid=?`, JSON.stringify(normalizeLegacyAskUserInput(JSON.parse(row.input_json))), row.rowid);
+      // An interrupted operation can no longer continue its parked call, so its decision must not park Host recovery.
+      if (active && interrupted && hasColumns(sql, table, ["submission_id", "status"])) {
+        sql.exec(`UPDATE ${table} SET status=? WHERE submission_id=? AND status='pending'`, table === "pi_approvals" ? "rejected" : "cancelled", active);
+      }
     }
     if (hasTable(sql, "cf_agents_schedules")) {
       for (const callback of ["_cleanupStreamBuffers", "_piPlannedContinuation", "_piContinuationWatchdog", "_piApprovalContinuation", "_chatRecoveryRetry"]) sql.exec("DELETE FROM cf_agents_schedules WHERE callback=?", callback);
     }
   });
 }
+
+function hasColumns(sql: SqlStorage, table: string, names: string[]): boolean {
+  const columns = new Set(sql.exec<{ name: string }>(`PRAGMA table_info(${table})`).toArray().map((row) => row.name));
+  return names.every((name) => columns.has(name));
+}
+
+const LEGACY_TABLES = [
+  "pi_entries", "pi_values", "pi_lists", "pi_usage", "pi_storage_state", "pi_session_entries", "pi_session_metadata",
+  "pi_legacy_entries_backup", "pi_recovery_milestones", "pi_session_message_submission", "pi_tool_settlements",
+];
+
+/** Drops the inert pre-upgrade baseline once the migrated history it backs up is deleted. */
+export async function dropLegacyPiTables(storage: DurableObjectStorage, session: Session): Promise<void> {
+  if (!(await session.snapshot(Migration, BACKGROUND_CONTEXT))?.completed) throw new Error("Legacy Pi tables are still the migration source");
+  for (const table of LEGACY_TABLES) storage.sql.exec(`DROP TABLE IF EXISTS ${table}`);
+}