@springbrand/agent-runtime 0.3.0-alpha.2 → 0.3.0-alpha.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@springbrand/agent-runtime",
-  "version": "0.3.0-alpha.2",
+  "version": "0.3.0-alpha.20",
   "type": "module",
   "files": [
     "src",
@@ -13,28 +13,30 @@
     ".": "./src/index.ts",
     "./adapter/cloudflare": "./src/adapter/cloudflare/index.ts",
     "./contracts": "./src/config/public-contracts.ts",
-    "./declared-tool": "./src/tools/declared.ts",
+    "./declared-tool": "./src/tools/adapters/declared.ts",
     "./models": "./src/lib/model-catalog.ts"
   },
   "dependencies": {
-    "@cloudflare/codemode": "0.5.1",
+    "@cloudflare/codemode": "0.5.2",
     "@cloudflare/sandbox": "0.12.4",
     "@cloudflare/shell": "0.4.3",
-    "@cloudflare/think": "0.17.0",
-    "@earendil-works/pi-agent-core": "0.85.1",
-    "@earendil-works/pi-ai": "0.85.1",
+    "@cloudflare/think": "0.18.0",
+    "@earendil-works/pi-agent-core": "1.1.0",
+    "@earendil-works/pi-ai": "1.1.0",
     "@types/lodash-es": "^4.17.12",
     "cron-schedule": "6.0.0",
     "isomorphic-git": "1.38.6",
     "lodash-es": "^4.18.1",
-    "zod": "^4.4.3"
+    "zod": "^4.4.3",
+    "@earendil-works/pi-durable": "1.1.0",
+    "@earendil-works/chord": "1.1.0"
   },
   "peerDependencies": {
-    "agents": "^0.22.0",
+    "agents": "^0.23.0",
     "ai": "^7.0.0"
   },
   "devDependencies": {
-    "agents": "0.22.0",
+    "agents": "0.23.0",
     "ai": "7.0.56"
   }
 }

package/src/adapter/cloudflare/agent.ts

@@ -33,6 +33,7 @@ import {
   type SubmissionReceipt,
   type SubmissionExecutionMode,
   type SubmissionHandle,
+  type RuntimeUnattendedExecutionGrant,
 } from "../../submission";
 import type { ExecutionLevel } from "../../lib/execution-level";
 import {
@@ -66,13 +67,15 @@ import {
 import type { UIMessage, UIMessageChunk } from "ai";
 import type {
   AssistantMessage,
+  JsonObject,
 } from "@earendil-works/pi-ai";
-import { BACKGROUND_CONTEXT } from "@earendil-works/pi-agent-core/harness/context";
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { openCloudflareSession } from "../../session";
-import { openSessionHarness, prepareSubmissionOperation } from "../../harness";
+import { ModelRecovery, openSessionHarness, prepareSubmissionOperation } from "../../harness";
 import type { SessionHarness } from "../../harness";
 import {
   compileHarnessTools,
+  harnessToolActivation,
   decodeSubagentCompletion,
   HarnessDecisionGate,
   HarnessHumanDecisions,
@@ -98,6 +101,10 @@ import { RuntimeDatabase } from "./database";
 // #region Runtime 内部数据与基础工具
 
 const SCHEDULED_STABLE_TIMEOUT_MS = 30_000;
+/** 定时 Run 未结束时拒绝普通输入的统一原因,服务端与客户端状态共用同一事实。 */
+const SCHEDULED_INPUT_LOCKED_MESSAGE =
+  "This scheduled run is still in progress. Wait for it to finish before sending a message.";
+
 interface ActiveTurn {
   submissionId: string;
   requestId: string;
@@ -149,11 +156,16 @@ export abstract class AgentRuntimeKernel<
   };
 
   protected abstract ensureRuntimeReady(): Promise<void>;
-  /** Runs only before the first pin of a newly activated Submission. */
+  /** Prepare per-Submission Host state before the first assembly pin. */
   protected prepareRuntimeForSubmission(_submissionId: string): Promise<void> {
     return this.ensureRuntimeReady();
   }
 
+  /** Runs before a new Submission records its Runtime key. */
+  protected prepareRuntimeForAdmission(): Promise<void> {
+    return this.ensureRuntimeReady();
+  }
+
   protected ensureRuntimeVersion(_runtimeKey: string): Promise<void> {
     return this.ensureRuntimeReady();
   }
@@ -173,7 +185,7 @@ export abstract class AgentRuntimeKernel<
 
   private activeRuntime?: ActiveRuntime;
   private telemetryCoordinator?: RuntimeTelemetryCoordinator;
-  private activeHarness?: SessionHarness<object | undefined>;
+  private activeHarness?: SessionHarness;
   private piAdapter?: HarnessRuntimeConfig;
   private readonly transcript: ConversationHistory;
   private conversationBridge?: HarnessConversationBridge;
@@ -358,14 +370,14 @@ export abstract class AgentRuntimeKernel<
     runtime: Awaited<ReturnType<typeof openSessionHarness>>,
     submissionId: string,
   ): Promise<void> {
-    const watch = await runtime.lane.watch(BACKGROUND_CONTEXT);
-    try {
-      this.db.transaction(() =>
-        this.db.submissions.associateSessionEntries(submissionId, watch.snapshot)
-      );
-    } finally {
-      watch.unsubscribe();
-    }
+    const native = await runtime.submissionFor(submissionId, BACKGROUND_CONTEXT);
+    if (!native || native.entry === undefined) return;
+    const entries = await runtime.entries();
+    const start = entries.findIndex((entry) => entry.id === native.entry);
+    if (start < 0) throw new Error("Native Submission entry is missing from its conversation");
+    this.db.transaction(() => {
+      for (const entry of entries.slice(start)) this.db.submissions.linkSessionEntry(String(entry.id), submissionId);
+    });
   }
 
   /**
@@ -390,7 +402,7 @@ export abstract class AgentRuntimeKernel<
     }
     await this.broadcastApprovals();
     const running = this.db.submissions.findRunning() as StoredSubmission | null;
-    if (running) {
+    if (running && !running.unattendedFailure) {
       if (
         this.db.approvals.listPendingForSubmission(running.submissionId).length > 0 ||
         this.db.interactions.listPendingForSubmission(running.submissionId).length > 0
@@ -506,18 +518,21 @@ export abstract class AgentRuntimeKernel<
 
   // #region Submission 准入与配置固定
 
-  /** Pin dynamic Context and execution policy before admission. */
+  /** Pin dynamic Context and execution policy before the first assembly is used. */
   private async admissionPin(fresh: boolean, submissionId: string): Promise<{
     revision: string;
     descriptor: string;
   }> {
     if (fresh) await this.prepareRuntimeForSubmission(submissionId);
-    else await this.ensureRuntimeReady();
-    return this.currentAssemblyPin();
+    const submission = this.db.submissions.find(submissionId);
+    if (!submission) {
+      throw new Error(`Unknown SpringBrand submission: ${submissionId}`);
+    }
+    return this.currentAssemblyPin(submission.origin !== "scheduled");
   }
 
   // initConfig can call this inside its serialized load; re-entering ensureRuntimeReady would deadlock.
-  private async currentAssemblyPin(): Promise<{
+  private async currentAssemblyPin(includeMemory = true): Promise<{
     revision: string;
     descriptor: string;
   }> {
@@ -526,16 +541,18 @@ export abstract class AgentRuntimeKernel<
     if (!runtime) {
       throw new Error("Runtime revision is not initialized");
     }
-    return this.pinAssembly(runtime.pi, runtime.revision);
+    return this.pinAssembly(runtime.pi, runtime.revision, includeMemory);
   }
 
   private async pinAssembly(
     prepared: PreparedPiRuntime,
     baseRevision: string,
+    includeMemory: boolean,
   ): Promise<{ revision: string; descriptor: string }> {
     const pinned = await this.pi.pin({
       prepared,
       baseRevision,
+      includeMemory,
       readExtensionContext: ({ label }) =>
         this._hostGetContext(label),
     });
@@ -558,7 +575,7 @@ export abstract class AgentRuntimeKernel<
       submissions: this.db.submissions,
       transaction: (run) => this.db.transaction(run),
       prepareRuntime: async () => {
-        await this.ensureRuntimeReady();
+        await this.prepareRuntimeForAdmission();
         return { runtimeKey: this.activeRuntime!.runtimeKey, admission: this.activeRuntime?.admission };
       },
       findUserMessage: (id) => this.transcript.findUserMessage(id),
@@ -615,11 +632,16 @@ export abstract class AgentRuntimeKernel<
       releaseAbortedHarness: async () => {
         const runtime = this.activeHarness;
         if (!runtime) return;
-        await runtime.lane.waitForIdle(BACKGROUND_CONTEXT);
-        if (this.activeHarness === runtime) this.activeHarness = undefined;
-        await runtime.close(BACKGROUND_CONTEXT);
+        await runtime.conversation.waitForIdle(BACKGROUND_CONTEXT);
+        // The execution owner closes after transport projections settle.
+
+      },
+      cancelQueued: async (id) => {
+        const runtime = this.activeHarness;
+        if (!runtime) return undefined;
+        const result = await runtime.harness.abortSubmission(Number(id) as import("@earendil-works/pi-durable").SubmissionId, BACKGROUND_CONTEXT, runtime.conversation.id);
+        return { kind: result === "already_placed" || result === "settled" ? "already_consumed" as const : "cancelled" as const };
       },
-      cancelQueued: async (id) => this.activeHarness?.lane.cancelQueued(id, BACKGROUND_CONTEXT),
       submit: (message, options) => this.submitMessage(message, options),
       waitUntil: (promise) => this.ctx.waitUntil(promise),
     });
@@ -764,17 +786,35 @@ export abstract class AgentRuntimeKernel<
     submission = await this.admission.pin(
       submission,
       () => this.admissionPin(mode === "fresh", submissionId),
-      mode === "fresh" ? undefined : (key) => this.ensureRuntimeVersion(key),
+      (key) => this.ensureRuntimeVersion(key),
     );
     const activeRuntime = this.requireRuntime();
+    // A fresh provider Session per Submission keeps one failing upstream route from pinning later turns.
+    const recovery = new ModelRecovery(submissionId);
     const harnessInput = this.pi.harnessInputs(
       activeRuntime.pi,
       submission.assemblyDescriptor,
       {
-        modelSessionId: submissionId,
-        onGeneration: (event) => this.telemetry.generation(submissionId, event),
+          modelSessionId: () => recovery.sessionId(),
+          assertRequestAllowed: () => {
+            const current = this.db.submissions.find(submissionId);
+            if (current?.abortReason || current?.unattendedFailure) throw new Error(current.abortReason ?? current.unattendedFailure!);
+          },
+          onGeneration: (event) => this.telemetry.generation(submissionId, event),
+          onCompactionGeneration: (event) => this.runtimeTurnEvents.compactionGeneration(submissionId, event),
       },
     );
+    const prepareToolInput = (toolName: string, input: unknown): unknown => {
+      const prepare = harnessInput.candidates.find(({ tool }) =>
+        tool.name === toolName
+      )?.tool.prepareArguments;
+      if (!prepare) return input;
+      try {
+        return prepare(input);
+      } catch {
+        return input;
+      }
+    };
     let runtime!: Awaited<ReturnType<typeof openSessionHarness>>;
     let publishApprovalRequest = async (
       _toolCallId: string,
@@ -785,6 +825,8 @@ export abstract class AgentRuntimeKernel<
         submissionId,
         requestId: submission.requestId,
         executionLevel: activeRuntime.snapshot.profile.executionLevel,
+        origin: submission.origin,
+        scheduledMaxExecutionLevel: submission.scheduledMaxExecutionLevel ?? undefined,
       },
       candidates: harnessInput.candidates,
       telemetry: this.telemetry,
@@ -812,11 +854,14 @@ export abstract class AgentRuntimeKernel<
         }
       },
       gateTool: harnessInput.platform.gateTool,
+      onUnattendedFailure: (reason) => {
+        this.db.submissions.recordUnattendedFailure(submissionId, reason);
+      },
+      unattendedFailure: () => this.db.submissions.find(submissionId)?.unattendedFailure,
     });
     runtime = await openSessionHarness({
-      session: openCloudflareSession(this.ctx.storage),
+      storage: openCloudflareSession(this.ctx.storage),
       models: harnessInput.models,
-      modelSessionId: submissionId,
       model: harnessInput.model,
       thinkingLevel: harnessInput.thinkingLevel,
       systemPrompt: harnessInput.systemPrompt,
@@ -824,30 +869,29 @@ export abstract class AgentRuntimeKernel<
         workspace: harnessInput.workspace,
         authorize: gate.authorize.bind(gate),
         resolveReplay: gate.resolveReplay.bind(gate),
+        resolveConfirmation: gate.resolveConfirmation.bind(gate),
       }),
+      ...harnessToolActivation(harnessInput.candidates),
       modelToolResultExemptions: harnessInput.candidates
         .filter(({ outputBudget }) => outputBudget?.kind === "structure")
         .map(({ tool }) => tool.name),
       streamOptions: { maxRetries: 0 },
       compaction: harnessInput.compaction,
       toolExecution: "parallel",
+      recovery,
+      beforeTool: (call, _api, context) => gate.beforeTool({ toolName: call.name, toolCallId: call.id, args: call.arguments }, context),
+      afterResponse: (message) => {
+        for (const part of message.content) if (part.type === "toolCall") part.arguments = prepareToolInput(part.name, part.arguments) as JsonObject;
+      },
     }, BACKGROUND_CONTEXT);
     this.activeHarness = runtime;
-    let stream: ReturnType<typeof bindHarnessStream> | undefined;
+    let stream: Awaited<ReturnType<typeof bindHarnessStream>> | undefined;
     let deactivate = () => {};
+    let released = false;
     try {
-      runtime.harness.hooks.on("before_tool", gate.beforeTool);
-      runtime.harness.hooks.on("before_drive", async (event, context) => {
-        if (this.db.submissions.find(submissionId)?.abortReason) {
-          await runtime.requestAbort(event.runId, context);
-        }
-      });
 
-      if (submission.abortReason && runtime.openOperation) {
-        await runtime.requestAbort(
-          runtime.openOperation.operationId,
-          BACKGROUND_CONTEXT,
-        );
+      if ((submission.abortReason || submission.unattendedFailure) && runtime.openOperation) {
+        await runtime.abort(BACKGROUND_CONTEXT);
       }
 
       await this.associateHarnessEntries(runtime, submissionId);
@@ -858,21 +902,6 @@ export abstract class AgentRuntimeKernel<
         (id) => this.transcript.regenerationTarget(id),
         BACKGROUND_CONTEXT,
       );
-      if (preparation.kind === "settled") {
-        const record = preparation.outcome;
-        const terminal = await this.submissions.finish(
-          submission,
-          record.status === "completed" || record.status === "declined"
-            ? "succeeded" : record.status === "aborted" ? "aborted" : "failed",
-          record.error?.message,
-        );
-        this.broadcast(json({
-          type: MessageType.CF_AGENT_CHAT_MESSAGES,
-          messages: await this.getMessages(),
-        }));
-        return terminal;
-      }
-
       if (submission.status === "pending") {
         this.db.submissions.transition(submissionId, "running", ["pending"]);
         this.telemetry.capture("turnStarted", {
@@ -886,70 +915,58 @@ export abstract class AgentRuntimeKernel<
         steers: this.db.steers,
         messageUi: this.db.messageUi,
         transaction: (run) => this.db.transaction(run),
-        enqueue: async (message) => {
-          const queued = await runtime.lane.steer(message, undefined, BACKGROUND_CONTEXT);
-          if (!queued.ok) throw queued.error;
-          return queued.value.entryId;
+        enqueue: async (steer) => {
+          const message = JSON.parse(steer.canonicalJson) as PiCanonicalUserInput;
+          const queued = await runtime.conversation.submit({ type: "input", content: message.content, requestId: `steer:${steer.messageId}`, whenBusy: "steer" }, BACKGROUND_CONTEXT);
+          return queued.status(BACKGROUND_CONTEXT);
         },
+        find: (messageId) => runtime.submissionFor(`steer:${messageId}`, BACKGROUND_CONTEXT),
       });
       const uiMessageBody = submission.queuedUiMessageJson;
       let initialUserSidecarPersisted = (await this.transcript.storedMessages())
         .some((entry) =>
           entry.submissionId === submissionId && entry.message.role === "user"
         );
-      runtime.harness.events.on("entry_added", (event) => {
-        const entry = event.entry;
+      const unsubscribeEntries = runtime.harness.subscribeCommits((publication) => {
         this.db.transaction(() => {
-          this.db.submissions.linkSessionEntry(entry.id, submissionId);
-          if (entry.type === "message" && entry.message.role === "user") {
-            if (!steerDelivery.settle(entry.id) && !initialUserSidecarPersisted && uiMessageBody) {
-              this.db.messageUi.upsert(entry.id, uiMessageBody);
+          for (const change of publication.changes) {
+            if (change.type === "submission") steerDelivery.settleRecord(change.value);
+            if (change.type !== "entry" || change.value.conversationId !== runtime.conversation.id) continue;
+            const entry = change.value;
+            this.db.submissions.linkSessionEntry(String(entry.id), submissionId);
+            if (entry.kind === "pi.user" && !initialUserSidecarPersisted && uiMessageBody) {
+              this.db.messageUi.upsert(String(entry.id), uiMessageBody);
               initialUserSidecarPersisted = true;
             }
           }
         });
-
       });
-      const pendingWatch = await runtime.lane.watch(BACKGROUND_CONTEXT);
-      try {
-        await steerDelivery.reconcile(submissionId, pendingWatch.snapshot);
-      } finally {
-        pendingWatch.unsubscribe();
-      }
-
-      this.runtimeTurnEvents.observe(runtime.harness, submissionId, harnessInput.model);
-      stream = bindHarnessStream(runtime.harness.events, {
+      await this.runtimeTurnEvents.observe(runtime, submissionId, harnessInput.model);
+      stream = await bindHarnessStream(runtime, {
         messageId: submission.assistantMessageId,
         userMessageId: submission.userMessageId ?? undefined,
         startedAt: submission.createdAt,
         turnId: submissionId,
+        prepareToolInput,
         publish: async (chunks) => {
-          for (const chunk of chunks) {
-            this.conversation.broadcastResponse({
-              id: submission.requestId,
-              body: json(chunk),
-              done: false,
-              continuation,
-            });
-          }
+          for (const chunk of chunks) this.conversation.broadcastResponse({ id: submission.requestId, body: json(chunk), done: false, continuation });
         },
       });
+      deactivate = unsubscribeEntries;
+
       publishApprovalRequest = stream.publishApprovalRequest;
-      this.conversation.activate(runtime.lane, submission);
+      this.conversation.activate(runtime, submission);
 
       const control = {
         abort: async () => {
           if (runtime.openOperation) {
-            await runtime.requestAbort(
-              runtime.openOperation.operationId,
-              BACKGROUND_CONTEXT,
-            );
+            await runtime.abort(BACKGROUND_CONTEXT);
           }
         },
         interrupt: () => void runtime.close(BACKGROUND_CONTEXT),
         steer: async (_message: PiCanonicalUserInput, messageId: string) => {
           const steer = this.db.steers.findByMessageId(messageId);
-          if (steer) await steerDelivery.queue(steer);
+          if (steer && runtime.openOperation) await steerDelivery.queue(steer);
         },
       };
       const turn: ActiveTurn = {
@@ -960,36 +977,28 @@ export abstract class AgentRuntimeKernel<
         continuation,
         agent: control,
       };
-      deactivate = this.submissions.activate(submission, turn);
-      const outcome = await runtime.run(preparation.request, BACKGROUND_CONTEXT, {
-        pollDeferred: !preparation.request,
-      });
+      const deactivateTurn = this.submissions.activate(submission, turn);
+      const unsubscribeEntriesAndTurn = deactivate;
+      deactivate = () => { unsubscribeEntriesAndTurn(); deactivateTurn(); };
+      await runtime.admit(preparation, BACKGROUND_CONTEXT);
+      await steerDelivery.reconcile(submissionId);
+      const outcome = await runtime.run(undefined, BACKGROUND_CONTEXT);
       this.db.submissions.clearQueuedPayload(submissionId);
       if (outcome.kind === "released") {
-        if (
-          outcome.reason === "slice" ||
-          outcome.reason === "budget" ||
-          outcome.reason === "tool-failure"
-        ) {
+        if (outcome.reason === "slice") {
           await this.schedule(0, "_piHarnessContinuation", { submissionId }, {
             idempotent: true,
           });
         }
-        return this.db.submissions.find(submissionId)!;
-      }
-      if (outcome.kind === "waiting") {
-        await this.schedule(
-          outcome.reason === "retry"
-            ? Math.max(0, Math.ceil((outcome.notBefore - Date.now()) / 1000))
-            : Math.max(0, Math.ceil((outcome.deferred.pollAfterMs ?? 1_000) / 1000)),
-          "_piHarnessContinuation",
-          { submissionId },
-          { idempotent: true },
-        );
+        released = true;
         return this.db.submissions.find(submissionId)!;
       }
       const record = outcome.outcome;
-      const status = record.status === "completed" || record.status === "declined"
+      const unattendedFailure = this.db.submissions.find(submissionId)
+        ?.unattendedFailure;
+      const status = unattendedFailure
+        ? "failed"
+        : record.status === "completed" || record.status === "declined"
         ? "succeeded"
         : record.status === "aborted"
           ? "aborted"
@@ -998,7 +1007,7 @@ export abstract class AgentRuntimeKernel<
       const terminal = await this.submissions.finish(
         submission,
         status,
-        record.error?.message,
+        unattendedFailure ?? record.error?.message,
       );
       const projectedOutcome = projectSubmissionOutcome(record, terminal);
       await stream.flushTerminal(projectedOutcome);
@@ -1015,13 +1024,21 @@ export abstract class AgentRuntimeKernel<
       }));
       throw error;
     } finally {
-      await this.conversation.release(runtime.lane).catch((error) => {
+      await this.conversation.release(runtime).catch((error) => {
         console.warn("[runtime-stream:degraded]", errorText(error));
       });
-      stream?.unsubscribe();
+      await stream?.unsubscribe();
       deactivate();
       if (this.activeHarness === runtime) this.activeHarness = undefined;
       await runtime.close(BACKGROUND_CONTEXT).catch(() => undefined);
+      if (released) {
+        // Pi closes the Harness on release and drops undelivered stream frames; the
+        // canonical transcript gives a paused question or approval its complete input.
+        this.broadcast(json({
+          type: MessageType.CF_AGENT_CHAT_MESSAGES,
+          messages: await this.getMessages(),
+        }));
+      }
     }
   }
 
@@ -1055,7 +1072,7 @@ export abstract class AgentRuntimeKernel<
   /** Start the native resume handshake from Pi's current lane snapshot. */
   async onConnect(connection: Connection): Promise<void> {
     this.conversation.disconnect(connection);
-    await this.conversation.resume(connection);
+    await this.conversation.connect(connection);
   }
 
   async onClose(connection: Connection, code: number, reason: string, wasClean: boolean): Promise<void> {
@@ -1152,10 +1169,8 @@ export abstract class AgentRuntimeKernel<
 
     if (event.type === "clear") {
       if (this.submissions.isBusy()) return;
-      this.db.transaction(() => {
-        this.transcript.clear();
-        this.db.clearAll();
-      });
+      await this.transcript.clear();
+      this.db.transaction(() => this.db.clearAll());
       await this.broadcastApprovals();
       this.broadcast(json({ type: MessageType.CF_AGENT_CHAT_CLEAR }));
       return;
@@ -1297,7 +1312,7 @@ export abstract class AgentRuntimeKernel<
       await this.broadcastApprovals();
       return;
     }
-    this.transcript.append(crypto.randomUUID(), message);
+    await this.transcript.append(crypto.randomUUID(), message);
   }
 
   async _hostGetSessionInfo(): Promise<{ messageCount: number }> {
@@ -1320,7 +1335,36 @@ export abstract class AgentRuntimeKernel<
   async addCanonicalSnapshot(
     snapshot: PiCanonicalTranscriptSnapshot,
   ): Promise<void> {
-    this.transcript.importSnapshot(snapshot);
+    await this.transcript.importSnapshot(snapshot);
+  }
+
+  /**
+   * 本 Session 是否有一条未结束的定时 Submission。
+   *
+   * 定时 Run 未结束时独占输入:普通消息在准入前被拒绝,不排队等它结束。
+   * 定时注入本身走 `submitScheduledPrompt`,不经过这道闸。
+   */
+  private get scheduledInputLocked(): boolean {
+    return this.db.submissions.hasUnfinishedScheduled();
+  }
+
+  private rejectedOrdinaryInputReceipt(): SubmissionReceipt {
+    return {
+      submissionId: crypto.randomUUID(),
+      status: "skipped",
+      accepted: false,
+      error: SCHEDULED_INPUT_LOCKED_MESSAGE,
+      retryable: false,
+      createdAt: Date.now(),
+    };
+  }
+
+  private rejectInputLocked(): MessageDispatchReceipt {
+    return {
+      kind: "rejected",
+      code: "input_locked",
+      message: SCHEDULED_INPUT_LOCKED_MESSAGE,
+    };
   }
 
   /** Admit text and return immediately; completion continues in the Durable Object. */
@@ -1328,6 +1372,7 @@ export abstract class AgentRuntimeKernel<
     text: string,
     options?: { idempotencyKey?: string },
   ): Promise<SubmissionReceipt> {
+    if (this.scheduledInputLocked) return this.rejectedOrdinaryInputReceipt();
     const submitted = await this.submitMessage({
       role: "user",
       content: [{ type: "text", text }],
@@ -1357,17 +1402,24 @@ export abstract class AgentRuntimeKernel<
   }
 
   async dispatchMessage(message: UIMessage, delivery: MessageDelivery): Promise<MessageDispatchReceipt> {
+    if (this.scheduledInputLocked) return this.rejectInputLocked();
     return this.delivery.dispatch(message, delivery);
   }
 
   async steerQueuedSubmission(submissionId: string): Promise<MessageDispatchReceipt> {
+    if (this.scheduledInputLocked) return this.rejectInputLocked();
     return this.delivery.steerQueued(submissionId);
   }
 
   /** Admit scheduled work after a bounded stable wait, otherwise return skipped. */
   async submitScheduledPrompt(
     prompt: string,
-    options?: { idempotencyKey?: string },
+    options?: {
+      idempotencyKey?: string;
+      scheduledMaxExecutionLevel?: ExecutionLevel;
+      /** @deprecated Retained for rolling upgrades; ignored by Runtime. */
+      unattendedExecutionGrant?: RuntimeUnattendedExecutionGrant;
+    },
   ): Promise<SubmissionReceipt> {
     const requestId = crypto.randomUUID();
     const submitted = await this.submitMessageWhenStable(
@@ -1379,6 +1431,8 @@ export abstract class AgentRuntimeKernel<
       {
         requestId,
         idempotencyKey: options?.idempotencyKey,
+        origin: "scheduled",
+        scheduledMaxExecutionLevel: options?.scheduledMaxExecutionLevel,
       },
       SCHEDULED_STABLE_TIMEOUT_MS,
     );
@@ -1463,7 +1517,7 @@ export abstract class AgentRuntimeKernel<
       summary: approval.summary,
       executionLevel: approval.executionLevel,
       requiredExecutionLevel: approval.requiredExecutionLevel,
-      inputJson: approval.inputJson,
+      inputJson: approval.confirmationJson ?? approval.inputJson,
       requestId: approval.requestId,
     };
   }
@@ -1573,6 +1627,7 @@ export abstract class AgentRuntimeKernel<
         hasPendingInteraction: (id) => this.humanDecisions.isWaitingForInteraction(id),
         hasPendingSteer: (id) => this.db.steers.listForSubmission(id).length > 0,
         hasRunningAgentTools: this.db.agentTools.hasRunning(),
+        hasUnfinishedScheduled: this.db.submissions.hasUnfinishedScheduled(),
         previousState: this.state,
       });
       if (changed) this.setState(state);