@timqi/pier 0.0.17 → 0.0.20

package/dist/config-sync.js

@@ -0,0 +1,179 @@
+// One serialized configuration subscriber, shared by Settings and the hourly
+// task. Only a successfully applied response advances its persistent ETag.
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { configSourceUrl, CONFIG_SYNC_BYTES, downloadConfig } from "./config-sync-fetch.js";
+import { transact } from "./db.js";
+import { logger } from "./log.js";
+import { normalizeModelMenu } from "./settings.js";
+const log = logger("config-sync");
+const KEY = "configSync";
+// Object order is not a change; array order (model menu priority) is.
+export function configJson(value) {
+    return JSON.stringify(value, (_key, entry) => entry && typeof entry === "object" && !Array.isArray(entry)
+        ? Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b, "en"))) : entry);
+}
+const hash = (value) => createHash("sha256").update(configJson(value)).digest("hex");
+export class ConfigSync {
+    deps;
+    #state;
+    #queue = Promise.resolve();
+    constructor(deps) {
+        this.deps = deps;
+        const row = deps.db.prepare("SELECT value FROM settings WHERE key = ?").get(KEY);
+        this.#state = row ? JSON.parse(row.value) : {
+            instanceId: randomUUID(), token: null, url: "", enabled: false, etag: null,
+            appliedHash: null, lastChecked: null, lastApplied: null, error: null, needsReload: false,
+        };
+        if (!row)
+            this.#save();
+    }
+    #save(patch = {}) {
+        const next = { ...this.#state, ...patch };
+        this.deps.db.prepare("INSERT INTO settings(key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value")
+            .run(KEY, JSON.stringify(next));
+        this.#state = next;
+    }
+    #exclusive(work) {
+        const result = this.#queue.then(work);
+        this.#queue = result.then(() => undefined, () => undefined);
+        return result;
+    }
+    status() {
+        const state = this.#state;
+        return {
+            publishedPath: state.token ? `/config-sync/${state.token}` : null,
+            sourceUrl: state.url, enabled: state.enabled,
+            lastChecked: state.lastChecked, lastApplied: state.lastApplied,
+            error: state.error, needsReload: state.needsReload,
+        };
+    }
+    async #local() {
+        return { agent: await this.deps.config.exportSnapshot(), modelMenu: this.deps.settings.get().modelMenu };
+    }
+    publish() {
+        return this.#exclusive(async () => {
+            if (this.#state.enabled)
+                throw new Error("Pause the configuration subscription before publishing a link");
+            await this.#local();
+            this.#save({ token: randomBytes(32).toString("hex") });
+            return this.status();
+        });
+    }
+    revoke() {
+        return this.#exclusive(async () => {
+            this.#save({ token: null });
+            return this.status();
+        });
+    }
+    async published(token) {
+        const expected = this.#state.token;
+        if (!expected || !/^[a-f0-9]{64}$/.test(token) || !timingSafeEqual(Buffer.from(token), Buffer.from(expected)))
+            return null;
+        const local = await this.#local();
+        if (this.#state.token !== expected)
+            return null;
+        const document = { schemaVersion: 1, instanceId: this.#state.instanceId, ...local };
+        const body = configJson(document);
+        if (Buffer.byteLength(body) > CONFIG_SYNC_BYTES)
+            throw new Error("Configuration exceeds 1 MiB");
+        return { body, etag: `"${hash(document)}"` };
+    }
+    #parse(raw) {
+        if (Buffer.byteLength(raw) > CONFIG_SYNC_BYTES)
+            throw new Error("Configuration exceeds 1 MiB");
+        let value;
+        try {
+            value = JSON.parse(raw);
+        }
+        catch {
+            throw new Error("Source returned malformed JSON");
+        }
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new Error("Invalid configuration document");
+        const object = value;
+        if (object.schemaVersion !== 1)
+            throw new Error("Unsupported configuration schema version");
+        if (Object.keys(object).some((key) => !["schemaVersion", "instanceId", "agent", "modelMenu"].includes(key))) {
+            throw new Error("Unexpected configuration fields");
+        }
+        if (typeof object.instanceId !== "string" || !object.instanceId || object.instanceId.length > 100)
+            throw new Error("Invalid source instance ID");
+        if (object.instanceId === this.#state.instanceId)
+            throw new Error("An instance cannot subscribe to itself");
+        const modelMenu = normalizeModelMenu(object.modelMenu);
+        if (!modelMenu)
+            throw new Error("Invalid model menu");
+        return { agent: this.deps.normalizeAgent(object.agent), modelMenu };
+    }
+    subscribe(url) {
+        return this.#exclusive(async () => {
+            if (this.#state.token)
+                throw new Error("Revoke the sharing link before enabling a configuration subscription");
+            return this.#sync(url);
+        });
+    }
+    pause() {
+        return this.#exclusive(async () => {
+            this.#save({ enabled: false });
+            return this.status();
+        });
+    }
+    sync(signal) {
+        return this.#exclusive(() => this.#state.enabled
+            ? this.#sync(this.#state.url, signal)
+            : Promise.resolve("Configuration subscription is paused"));
+    }
+    async #sync(rawUrl, signal) {
+        try {
+            const url = configSourceUrl(rawUrl).href;
+            const local = await this.#local();
+            const etag = url === this.#state.url && hash(local) === this.#state.appliedHash ? this.#state.etag : null;
+            const timeout = AbortSignal.timeout(15_000);
+            const response = await (this.deps.download ?? downloadConfig)(url, etag, signal ? AbortSignal.any([signal, timeout]) : timeout);
+            signal?.throwIfAborted();
+            if (response.status === 304 && !etag)
+                throw new Error("Source returned 304 without a matching local configuration");
+            const next = response.status === 304 ? local : this.#parse(response.body);
+            let changed = false;
+            const previous = structuredClone(this.#state);
+            const commit = (filesChanged) => transact(this.deps.db, () => {
+                signal?.throwIfAborted();
+                const menuChanged = configJson(next.modelMenu) !== configJson(this.deps.settings.get().modelMenu);
+                changed = filesChanged || menuChanged;
+                if (menuChanged)
+                    this.deps.settings.setModelMenu(next.modelMenu);
+                this.#save({
+                    url, enabled: true, etag: response.status === 304 ? etag : response.etag,
+                    appliedHash: hash(next), lastChecked: Date.now(),
+                    lastApplied: changed ? Date.now() : previous.lastApplied,
+                    needsReload: changed || previous.needsReload, error: null,
+                });
+            });
+            try {
+                // Reconcile under the file lock even on 304: local edits may have
+                // completed while the conditional download was in flight.
+                await this.deps.config.applySnapshot(next.agent, commit);
+            }
+            catch (err) {
+                this.#state = previous;
+                throw err;
+            }
+            if (this.#state.needsReload) {
+                try {
+                    await this.deps.reload();
+                }
+                catch {
+                    throw new Error("Configuration saved, but reload failed; retry synchronization");
+                }
+                this.#save({ needsReload: false });
+            }
+            return changed ? "Configuration applied; reload completed" : `Configuration unchanged (${response.status})`;
+        }
+        catch (err) {
+            const error = err instanceof Error ? err.message : "Configuration sync failed";
+            log.error(error);
+            this.#save({ lastChecked: Date.now(), error });
+            throw new Error(error);
+        }
+    }
+}

package/dist/core/hub.js

@@ -23,7 +23,7 @@ export class EventHub {
     bus(sessionId) {
         let b = this.buses.get(sessionId);
         if (!b) {
-            b = { seq: 0, buffer: [], subscribers: new Set() };
+            b = { seq: 0, replayFloor: 0, buffer: [], subscribers: new Set() };
             this.buses.set(sessionId, b);
         }
         return b;
@@ -36,9 +36,18 @@ export class EventHub {
             sessionId,
             ...payload,
         };
-        b.buffer.push(event);
-        if (b.buffer.length > RING_SIZE)
-            b.buffer.shift();
+        // Text deltas fan out live but never enter the ring: one long reply emits
+        // thousands of them, so a ring that held them would hold *only* them and
+        // would have evicted the turn-start, tool and turn-end events a
+        // reconnecting client replays for. The text is not lost — `turn-end`
+        // carries the full reply (web/ui/chat.ts treats it as authoritative).
+        // Thinking stays replayable because a native EventSource reconnect does
+        // not reload the transcript snapshot that would otherwise restore it.
+        if (payload.type !== "text-delta") {
+            b.buffer.push(event);
+            if (b.buffer.length > RING_SIZE)
+                b.replayFloor = b.buffer.shift().seq;
+        }
         fanOut(b.subscribers, event);
     }
     subscribe(sessionId, fn) {
@@ -46,10 +55,16 @@ export class EventHub {
         b.subscribers.add(fn);
         return () => b.subscribers.delete(fn);
     }
-    /** Events with seq > afterSeq still held in the ring buffer. */
+    /** Events with seq > afterSeq still held in the ring buffer — oldest first,
+     *  and without text deltas, which are live-only. */
     replay(sessionId, afterSeq) {
         return this.bus(sessionId).buffer.filter((e) => e.seq > afterSeq);
     }
+    /** Whether replay covers this cursor; live-only text gaps are intentional. */
+    covers(sessionId, afterSeq) {
+        const b = this.bus(sessionId);
+        return Number.isSafeInteger(afterSeq) && afterSeq >= b.replayFloor && afterSeq <= b.seq;
+    }
     emitWorkspace(event) {
         fanOut(this.workspace, event);
     }
@@ -78,7 +93,9 @@ export class EventHub {
         if (this.hasSubscribers(sessionId))
             return;
         const b = this.buses.get(sessionId);
-        if (b)
+        if (b) {
+            b.replayFloor = b.buffer.at(-1)?.seq ?? b.replayFloor;
             b.buffer = [];
+        }
     }
 }

package/dist/core/inbox.js

@@ -11,7 +11,7 @@ import { randomBytes } from "node:crypto";
 import { basename, join } from "node:path";
 import { pierPath } from "../paths.js";
 import { fileMarker, lostMarker, MAX_INBOUND_BYTES, safeName } from "./inbound-file.js";
-/** Where every inbound file lives; web/files.ts allowlists this root. */
+/** Where every inbound file lives; the attachment route allowlists this root. */
 export const INBOX_DIR = pierPath("inbox");
 /**
  * Write one inbound file and return its absolute path. The timestamp-random

package/dist/core/reply.js

@@ -40,14 +40,20 @@ new day — so the last one still applies; a gap alone shows as time only, like
 \`[14:23]\`. Use that \`id\` to mention someone; never ask for their own.
 `;
 /**
- * The contract above plus the two facts about *this* deployment that an agent
+ * The contract above plus the facts about *this* deployment that an agent
  * cannot work out for itself.
  *
- * Told, not discovered. Pier knows both — the home is its own startup argument
+ * Told, not discovered. Pier knows them — the home is its own startup argument
  * and the address is a file it wrote — while an agent can only guess at a
  * path and shell out to look. The guess is wrong on every instance that moves
  * `PIER_HOME`, and it fails as "nothing is configured": indistinguishable from
  * the truth, and reported to the user as such. Which is what happened.
+ *
+ * The editing line is the same shape of fact, learned the same way: GPT models
+ * carry `apply_patch` from their own post-training, and not finding it in the
+ * tool list they go looking in the shell — one failed call, then a filesystem
+ * hunt, and in one session a stale Codex binary that worked, which put every
+ * later edit outside Pi's tooling.
  */
 export function surfacePrompt(instance) {
     const reach = instance.publicUrl
@@ -60,6 +66,10 @@ export function surfacePrompt(instance) {
 ## This Pier instance
 
 Boards: \`${instance.boardsDir}/<slug>/\` — this path, not \`~/.pier\`. ${reach}
+
+Editing: files change through the \`edit\` tool (exact text replacement) or
+\`write\`. There is no \`apply_patch\` here — not as a tool, not as a command —
+so do not call one or go looking for one in the shell.
 `;
 }
 /**
@@ -216,3 +226,67 @@ export function splitReply(rawMarkdown, meta) {
         return { text: markdown, suggestions: [], meta, silence };
     return { text: markdown.slice(0, m.index).trimEnd(), suggestions, meta, silence };
 }
+/**
+ * The body of a block that is still being written, for a surface rendering it
+ * before the turn ends: everything `splitReply` repairs, minus the next-step
+ * block. That block is only a next-step block at the very *end* of a turn, so
+ * text a later paragraph has already closed behind keeps it as body — which is
+ * what the final render will do with it too.
+ */
+export const streamBody = (markdown) => cjkFriendly(markdown.replace(SILENT, "").trim());
+/** Lines a blank line does not necessarily separate: a list item, a quote and
+ *  an indented continuation all survive one — a loose list is still one list.
+ *  Deliberately over-matching (`*` and `-` also catch emphasis and a rule):
+ *  claiming one boundary too few costs nothing but a repaint. */
+const CONTINUES = /^(?:\s|[-*+>]|\d+[.)])/;
+/**
+ * How much of `markdown` after `from` can no longer change as more text
+ * arrives: the offset just past the last blank line that closes a block, or
+ * `from` if there is none.
+ *
+ * Streaming markdown is the caller. Re-parsing the whole reply on every
+ * repaint costs O(N²) over a turn, so the web chat renders each closed prefix
+ * once and keeps its DOM. A boundary is therefore only claimed where parsing
+ * the two sides separately renders the same as parsing them together: never
+ * inside a backtick or tilde fence, inside a block stripped on completion, or
+ * between two lines a blank line leaves in the same list or quote. Fence runs
+ * keep their length as in `channels/chunk.ts`: a ```` fence is not closed by
+ * the ``` it quotes.
+ */
+export function stableBlockEnd(markdown, from = 0) {
+    // The last line is still growing, so it decides nothing — not the fence
+    // state, and not whether the blank line above it ended a block.
+    const end = markdown.lastIndexOf("\n") + 1;
+    /** Marker run of the fence currently open; empty = closed. */
+    let open = "";
+    let silent = false;
+    let cut = from;
+    /** Start of the block after a blank line, waiting for its first line. */
+    let pending = -1;
+    let prev = "";
+    for (let at = from; at < end;) {
+        const nl = markdown.indexOf("\n", at);
+        const line = markdown.slice(at, nl);
+        at = nl + 1;
+        const fence = /^\s*(`{3,}|~{3,})(.*)$/.exec(line);
+        if (!open && !silent && !line.trim()) {
+            if (pending < 0 && prev)
+                pending = at;
+            continue;
+        }
+        if (!open && !silent && pending >= 0 && !(CONTINUES.test(prev) && CONTINUES.test(line)))
+            cut = pending;
+        const run = fence?.[1] ?? "";
+        if (!open && run && !silent)
+            open = run;
+        else if (open && run[0] === open[0] && run.length >= open.length && !fence?.[2]?.trim())
+            open = "";
+        if (!open && (!run || silent)) {
+            for (const tag of line.matchAll(/<(\/?)silent>/gi))
+                silent = !tag[1];
+        }
+        pending = -1;
+        prev = line;
+    }
+    return cut;
+}

package/dist/core/router.js

@@ -1,5 +1,6 @@
 // Conversation → session routing plus event wiring. In-memory on purpose:
 // the durable chat → session map lives in channels/conversations.ts.
+import { randomUUID } from "node:crypto";
 import { logger } from "../log.js";
 import { EventHub } from "./hub.js";
 import { SenderPrefix, withPrefix } from "./identity.js";
@@ -22,6 +23,13 @@ function keyOf(key) {
  *  `ensure`, and which of the two a session records costs nothing but the
  *  answer to "what is it answering". */
 const isAlias = (key) => key.channelId === "web" || key.channelId === "task";
+export class QueueOperationError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+    }
+}
 export class Router {
     hub;
     resolve;
@@ -112,6 +120,8 @@ export class Router {
         for (const [id, attached] of [...this.bySession]) {
             if (attached.session.state === "streaming")
                 continue;
+            if (this.queueOperations.has(id) || this.recoveries.get(id)?.some((b) => b.status === "submitting"))
+                continue;
             if (!includeWatched && this.hub.hasSubscribers(id))
                 continue;
             if (now - attached.activeAt < ttlMs)
@@ -231,7 +241,7 @@ export class Router {
             // its own queues up to the agent_end handler, so a non-empty queue on an
             // idle session is exactly the message that missed that window.
             if (payload.type === "queue-state" && (payload.steering.length || payload.followUp.length)) {
-                this.promoteQueued(session, key);
+                this.promoteQueued(session);
             }
             // Every turn-end reaches the channel, empty text included: an adapter's
             // per-turn UI (Telegram's 👀 receipts) is retired here, and a turn that
@@ -254,10 +264,124 @@ export class Router {
             unsubscribe,
         });
     }
-    /** Sessions whose queue is being promoted right now. `clearQueue` and the
-     *  prompt that follows it both emit queue-state of their own, so without
-     *  this the handler would re-enter on its own effects. */
-    promoting = new Set();
+    queueOperations = new Set();
+    promotionRequested = new Set();
+    recoveries = new Map();
+    // Keep the latest failed batch ID so a clear cannot erase a newer rejection
+    // that arrived while it awaited the backend. ACK affects only the copy.
+    uncertaintyHeld = new Map();
+    queueUncertain(sessionId) {
+        return this.uncertaintyHeld.has(sessionId);
+    }
+    recoveryOf(sessionId) {
+        return structuredClone(this.recoveries.get(sessionId) ?? []);
+    }
+    recoveryChanged(sessionId) {
+        if (!this.recoveries.get(sessionId)?.length)
+            this.recoveries.delete(sessionId);
+        this.hub.emit(sessionId, {
+            type: "queue-recovery", batches: this.recoveryOf(sessionId), uncertain: this.queueUncertain(sessionId),
+        });
+    }
+    acknowledgeRecovery(sessionId, batchId) {
+        const batches = this.recoveries.get(sessionId);
+        const batch = batches?.find((b) => b.id === batchId);
+        if (!batch)
+            throw new QueueOperationError("missing", "No such recovery batch");
+        if (batch.status === "submitting")
+            throw new QueueOperationError("busy", "Submission has not settled");
+        this.recoveries.set(sessionId, batches.filter((b) => b !== batch));
+        this.promotionRequested.delete(sessionId);
+        this.recoveryChanged(sessionId);
+    }
+    /** Only queue mutation owns this lock. A model turn owns its batch, not the
+     *  next queue: manual controls remain available while that turn runs. */
+    async useQueue(sessionId, action, key = { channelId: "web", conversationId: sessionId }) {
+        if (this.queueOperations.has(sessionId))
+            throw new QueueOperationError("busy", "Queue operation in progress");
+        this.queueOperations.add(sessionId);
+        try {
+            return await action(await this.ensure(key));
+        }
+        finally {
+            this.queueOperations.delete(sessionId);
+            this.resumePromotion(sessionId);
+        }
+    }
+    async recallQueue(sessionId) {
+        return this.useQueue(sessionId, async (session) => {
+            const held = this.uncertaintyHeld.get(sessionId);
+            const queue = await session.clearQueue();
+            if (this.uncertaintyHeld.get(sessionId) === held && this.uncertaintyHeld.delete(sessionId))
+                this.recoveryChanged(sessionId);
+            if (queue.steering.length || queue.followUp.length)
+                this.forgetSender(sessionId);
+            return queue;
+        });
+    }
+    checkQueueDrain() {
+        if (this.draining)
+            throw new QueueOperationError("draining", "Pier is restarting; queued messages were not submitted");
+    }
+    async deliverQueue(sessionId, mode) {
+        let retained = false;
+        try {
+            this.checkQueueDrain();
+            return await this.useQueue(sessionId, async (session) => {
+                this.checkQueueDrain();
+                if (mode === "auto" && (session.state !== "idle" || this.queueUncertain(sessionId) || this.recoveries.get(sessionId)?.length))
+                    return "";
+                const held = this.uncertaintyHeld.get(sessionId);
+                const queue = await session.clearQueue();
+                if (mode !== "auto" && this.uncertaintyHeld.get(sessionId) === held && this.uncertaintyHeld.delete(sessionId))
+                    this.recoveryChanged(sessionId);
+                if (!queue.steering.length && !queue.followUp.length)
+                    throw new QueueOperationError("empty", "Queue is empty");
+                const batch = { id: randomUUID(), ...queue, status: "submitting" };
+                this.recoveries.set(sessionId, [...(this.recoveries.get(sessionId) ?? []), batch]);
+                retained = true;
+                this.recoveryChanged(sessionId);
+                const text = [...batch.steering, ...batch.followUp].join("\n");
+                let invoked = false;
+                const failed = (err) => {
+                    this.forgetSender(sessionId);
+                    this.promotionRequested.delete(sessionId);
+                    batch.status = invoked ? "uncertain" : "not-submitted";
+                    if (invoked)
+                        this.uncertaintyHeld.set(sessionId, batch.id);
+                    batch.error = String(err);
+                    this.recoveryChanged(sessionId);
+                    this.reportTo(sessionId, `Queue promotion failed (${batch.status}); automatic queue paused, originals remain available in queue recovery: ${String(err)}`);
+                };
+                try {
+                    this.checkQueueDrain();
+                    if (mode === "restart")
+                        await this.abort(sessionId);
+                    this.checkQueueDrain();
+                    // Already headed at original dispatch. Calling dispatch again would
+                    // discard rejection and could attribute these words to the operator.
+                    invoked = true;
+                    const submitted = mode === "steer" && session.state === "streaming"
+                        ? session.steer(text) : session.prompt(text);
+                    void submitted.then(() => {
+                        this.recoveries.set(sessionId, (this.recoveries.get(sessionId) ?? []).filter((b) => b !== batch));
+                        this.recoveryChanged(sessionId);
+                    }, failed).finally(() => this.resumePromotion(sessionId));
+                    return text;
+                }
+                catch (err) {
+                    failed(err);
+                    throw err;
+                }
+            }, mode === "auto" ? this.conversationOf(sessionId) : undefined);
+        }
+        catch (err) {
+            if (!retained && !(err instanceof QueueOperationError && (err.reason === "busy" || err.reason === "empty"))) {
+                this.reportTo(sessionId, `Could not promote queued messages: ${String(err)}`);
+            }
+            throw err;
+        }
+    }
     /**
      * Turn a stranded queue into the turn it was waiting for. Not routed through
      * `dispatch`: the text was prefixed when it was first dispatched
@@ -268,40 +392,39 @@ export class Router {
      * start the very turn it was asked to stop. Recovering *those* messages stays
      * the web's recall route, which hands them back to the composer.
      */
-    promoteQueued(session, key) {
-        if (session.state !== "idle" || this.promoting.has(session.id))
+    promoteQueued(session) {
+        if (session.state !== "idle")
             return;
-        this.promoting.add(session.id);
-        void (async () => {
-            try {
-                // Re-read: a turn may have started since the event, and it will drain
-                // the queue itself — clearing it here would take the messages out of it.
-                if (session.state !== "idle")
-                    return;
-                const { steering, followUp } = await session.clearQueue();
-                const text = [...steering, ...followUp].join("\n").trim();
-                if (!text)
-                    return;
-                // A drain is "no new turns", and this would be one. Told to the
-                // conversation rather than dropped, because the message is now out of
-                // the queue and nothing else would ever mention it (§5b).
-                if (this.draining) {
-                    this.report(session.id, key, `queued message not taken — Pier is restarting; send it again: ${truncate(text)}`);
-                    return;
-                }
-                log.info(`promoting ${String(steering.length + followUp.length)} queued message(s) → session ${session.id}`);
-                await session.prompt(text);
-            }
-            catch (err) {
-                this.report(session.id, key, `delivering the queued messages failed: ${String(err)}`);
-            }
-            finally {
-                this.promoting.delete(session.id);
-            }
-        })();
+        this.promotionRequested.add(session.id);
+        this.resumePromotion(session.id);
+    }
+    resumePromotion(sessionId) {
+        // queue_update precedes the backend's enqueue. Never clear it reentrantly.
+        queueMicrotask(() => {
+            if (!this.promotionRequested.has(sessionId) || this.queueOperations.has(sessionId))
+                return;
+            // A queue event followed by rejection might describe the same input.
+            // Retained failures require a human decision, not an automatic resend.
+            if (this.queueUncertain(sessionId) || this.recoveries.get(sessionId)?.length)
+                return;
+            this.promotionRequested.delete(sessionId);
+            const attached = this.bySession.get(sessionId);
+            if (!attached || attached.session.state !== "idle")
+                return;
+            void this.deliverQueue(sessionId, "auto").catch((err) => {
+                // deliverQueue reports failures; empty/busy simply lost the race.
+                log.debug(`automatic promotion of ${sessionId} stopped: ${String(err)}`);
+            });
+        });
     }
     async abort(sessionId) {
-        await this.bySession.get(sessionId)?.session.abort();
+        this.promotionRequested.delete(sessionId);
+        try {
+            await this.bySession.get(sessionId)?.session.abort();
+        }
+        finally {
+            this.promotionRequested.delete(sessionId);
+        }
     }
     /**
      * Drop what this session was told about who is speaking, so the next message
@@ -358,7 +481,9 @@ export class Router {
         return this.byKey.get(keyOf(key));
     }
     async abortConversation(key) {
-        await this.sessionOf(key)?.abort();
+        const session = this.sessionOf(key);
+        if (session)
+            await this.abort(session.id);
     }
     /** Session owning a conversation, resolving and attaching it on first use. */
     async ensure(key) {

package/dist/db.js

@@ -289,6 +289,33 @@ const MIGRATIONS = [
     session_id TEXT NOT NULL REFERENCES web_sessions(id) ON DELETE CASCADE
   );
   `,
+    // 15 — the scheduler's tick stops reading the rows it cannot deliver.
+    `
+  -- Once a second, tasks/ asks for the runs whose callback is still owed and
+  -- the messages whose injection has not landed. Both are a handful of rows
+  -- filtered on one low-cardinality column, and without an index both are a
+  -- full scan of a table that only grows — the sweep got slower with every
+  -- run that finished cleanly and can never match again.
+  CREATE INDEX task_runs_callback_state ON task_runs(callback_state);
+  CREATE INDEX task_messages_state ON task_messages(state);
+  `,
+    // 16 — the same tick stops parsing every task document to find none due.
+    `
+  -- When a task is next due is the one field the scheduler asks about once a
+  -- second, and it lived only inside the JSON: answering meant reading and
+  -- parsing every definition, due or not. A generated column keeps the JSON
+  -- as the only record while giving the query planner a value it can index; a
+  -- disabled or archived task has no next run, so NULLs stay out of the index.
+  ALTER TABLE tasks ADD COLUMN next_run_at INTEGER
+    GENERATED ALWAYS AS (json_extract(json, '$.nextRunAt')) VIRTUAL;
+  CREATE INDEX tasks_due ON tasks(next_run_at) WHERE next_run_at IS NOT NULL;
+  `,
+    // 17 — stable global pages, including sparse lists with unmatched probes hidden.
+    `
+  CREATE INDEX task_runs_time_id ON task_runs(queued_at DESC, id DESC);
+  CREATE INDEX task_runs_visible_time ON task_runs(queued_at DESC, id DESC)
+    WHERE NOT (state = 'succeeded' AND json_extract(json, '$.matched') IS 0);
+  `,
 ];
 /**
  * Several writes as one, or none. `BEGIN IMMEDIATE` because every writer here
@@ -310,6 +337,24 @@ export function transact(db, work) {
         throw err;
     }
 }
+/**
+ * Prepared statements, memoized by their SQL. `prepare()` compiles, and the
+ * callers here hand it the same handful of strings forever — twice per
+ * authenticated request, once a second per scheduler sweep. A `StatementSync`
+ * is reusable with different bound parameters, so one per SQL string per
+ * connection is the whole cache. Bound to the connection because a statement
+ * belongs to the database that compiled it; SQL built per call does not
+ * belong in here, since the cache would then grow without a bound.
+ */
+export function statements(db) {
+    const cache = new Map();
+    return (sql) => {
+        let stmt = cache.get(sql);
+        if (!stmt)
+            cache.set(sql, (stmt = db.prepare(sql)));
+        return stmt;
+    };
+}
 let shared;
 /**
  * The process's one connection, opened and migrated on first use. Every store
@@ -350,6 +395,11 @@ export function openDb(path, migrations = MIGRATIONS) {
     // file, and SQLite refuses to change it inside one.
     db.exec(`PRAGMA busy_timeout = ${BUSY_TIMEOUT_MS}`);
     db.exec("PRAGMA journal_mode = WAL");
+    // WAL's default leaves every commit waiting on an fsync, and DatabaseSync is
+    // synchronous — that wait is the event loop's. NORMAL still survives a
+    // process crash; only a power loss can cost the last transactions, which for
+    // routing state and task bookkeeping is a fair trade for not blocking.
+    db.exec("PRAGMA synchronous = NORMAL");
     // Off by default in SQLite, and a declared relationship nothing enforces is
     // a comment. Set before migrate(): it is a per-connection switch and a no-op
     // inside a transaction. Nothing older declares a key, so this changes the