@timqi/pier 0.1.14 → 0.2.0

package/dist/channels/runtime.js

@@ -1,8 +1,10 @@
 // Channel lifecycle: which adapters are running; one call for the Console to
 // apply a config change.
+import { Refused } from "../core/router.js";
 import { logger } from "../log.js";
 import { LarkChannel } from "./lark.js";
 import { SlackChannel } from "./slack.js";
+import { chatOf } from "./types.js";
 const ADAPTERS = [
     { platform: "slack", build: (deps) => new SlackChannel(deps) },
     // Lark's "token" is the App ID and "appToken" the App Secret.
@@ -15,19 +17,17 @@ const warn = (m) => log.warn(m);
 export class ChannelRuntime {
     store;
     router;
+    chain;
     control;
-    handoff;
     log;
-    live = new Map();
+    running = new Map();
     reloading = Promise.resolve();
     stopped = false;
-    constructor(store, router, control, 
-    /** The pull half only; the push half needs this runtime, so main.ts closes the loop. */
-    handoff, log = warn) {
+    constructor(store, router, chain, control, log = warn) {
         this.store = store;
         this.router = router;
+        this.chain = chain;
         this.control = control;
-        this.handoff = handoff;
         this.log = log;
     }
     /** Serialized: two concurrent Console saves would race into duplicate live
@@ -48,9 +48,10 @@ export class ChannelRuntime {
     }
     async restart(adapter) {
         const { platform, build } = adapter;
-        const existing = this.live.get(platform);
+        const existing = this.running.get(platform);
         if (existing) {
-            this.live.delete(platform);
+            this.running.delete(platform);
+            this.router.unregisterChannel(platform);
             // Never fatal: the config still has to be applied.
             await existing.stop().catch((err) => this.log(`${platform} did not stop cleanly: ${String(err)}`));
         }
@@ -66,10 +67,11 @@ export class ChannelRuntime {
             store: this.store,
             log: (m) => this.log(`${platform}: ${m}`),
             control: this.control,
-            handoff: this.handoff,
         });
         try {
             await channel.start((msg) => {
+                if (this.control.isHome(msg.key))
+                    return this.toHead(channel, msg);
                 void this.router.dispatch(msg).catch((err) => this.log(`dispatch failed: ${String(err)}`));
             });
         }
@@ -77,38 +79,45 @@ export class ChannelRuntime {
             this.log(`${platform} failed to start: ${String(err)}`);
             return;
         }
+        // Running before registered: the router asks main.ts's chatKeyOf, which asks `live`.
+        this.running.set(platform, channel);
         this.router.registerChannel(channel);
-        this.live.set(platform, channel);
         log.info(`${platform} started`);
     }
+    /** The home chat's every message, threaded or not, is the head's under the
+     *  chat's key. A refusal is the chat's to see (§5): the adapter only logs. */
+    toHead(channel, msg) {
+        const conversationId = chatOf(msg.key.conversationId);
+        this.chain.send(msg, { channelId: msg.key.channelId, conversationId }).catch((err) => {
+            this.log(`the conversation did not take a message: ${String(err)}`);
+            if (err instanceof Refused)
+                return;
+            const text = err instanceof Error ? err.message : String(err);
+            void channel.notify(conversationId, { text, origin: { kind: "error" } })
+                .catch((e) => this.log(`could not report it to ${channel.id}: ${String(e)}`));
+        });
+    }
+    live(platform) {
+        return this.running.has(platform);
+    }
     /** For restart-note delivery (src/drain.ts), which has no session to report
      *  through; false means the platform is not running. */
     async notify(platform, conversationId, text) {
-        const channel = this.live.get(platform);
+        const channel = this.running.get(platform);
         if (!channel)
             return false;
         await channel.notify(conversationId, { text, origin: { kind: "error" } });
         return true;
     }
-    running() {
-        return [...this.live.keys()];
-    }
-    /** Throws by name when the platform is not running: the caller's answer is
-     *  "enable it in Settings", not a silent no-op. */
-    async openThread(platform, chatId, note) {
-        const channel = this.live.get(platform);
-        if (!channel)
-            throw new Error(`${platform} is not running`);
-        return channel.openThread(chatId, note);
-    }
     async stop() {
-        // An in-flight restart could otherwise register an adapter after `live`
+        // An in-flight restart could otherwise register an adapter after `running`
         // was cleared — running, unstoppable.
         this.stopped = true;
         await this.reloading.catch(() => { });
-        for (const channel of this.live.values()) {
+        for (const channel of this.running.values()) {
+            this.router.unregisterChannel(channel.id);
             await channel.stop().catch((err) => this.log(`${channel.id} did not stop cleanly: ${String(err)}`));
         }
-        this.live.clear();
+        this.running.clear();
     }
 }

package/dist/channels/slack-outbound.js

@@ -1,7 +1,8 @@
-// How a turn becomes messages in a Slack thread: which renderer, how to chunk
-// against its limit, and what an empty turn still has to say.
-import { formatTurnMeta, isSilentReply, originLabel, quietLabel } from "../core/reply.js";
+// How a turn becomes messages in a Slack thread, or the home DM's main flow:
+// which renderer, how to chunk against its limit, and what an empty turn still has to say.
+import { formatTurnMeta, isSilentReply, quietLabel } from "../core/reply.js";
 import { sendAttachments, splitAttachments } from "./attach.js";
+import { noteBody } from "./lines.js";
 import { isBlockRejection } from "./slack-api.js";
 import { actions, chunk, context, escapeMrkdwn, markdown, MARKDOWN_MAX, MRKDWN_MAX, sections, toMrkdwn, } from "./slack-render.js";
 const footerText = (meta) => escapeMrkdwn(formatTurnMeta(meta));
@@ -14,6 +15,7 @@ export class SlackOutbound {
         this.api = api;
         this.log = log;
     }
+    /** No `threadTs` is the home DM's main flow (slack.ts target). */
     async reply(channel, threadTs, reply) {
         // A local file link is dead in Slack: the bytes are uploaded instead.
         const { text: spoken, paths } = splitAttachments(reply.text);
@@ -43,23 +45,12 @@ export class SlackOutbound {
     /** No footer: the turn this input triggers has not ended. Answers with the
      *  `ts` of the last message posted, where the caller puts the 👀. */
     async note(channel, threadTs, note) {
-        const body = note.text.split("\n").map((line) => `> ${line}`).join("\n");
         let ts;
-        for (const part of chunk(`_${originLabel(note.origin)}_\n${body}`, this.budget())) {
+        for (const part of chunk(noteBody(note, "_"), this.budget())) {
             ts = await this.post(channel, threadTs, part, []);
         }
         return ts;
     }
-    /** The one root Pier posts (no `thread_ts`): the thread a web session is
-     *  continued in has no user message to hang from. Answers the root's `ts`. */
-    async open(channel, note) {
-        const link = note.url || "_(no public URL set — Settings → Instance)_";
-        const sent = await this.api.postMessage({
-            channel,
-            text: `Continued from web: *${escapeMrkdwn(note.title)}*\n${link}\n_Reply in this thread to continue._`,
-        });
-        return sent.ts;
-    }
     budget() {
         return this.markdownBlocks ? MARKDOWN_MAX : MRKDWN_MAX;
     }

package/dist/channels/slack-panel.js

@@ -18,7 +18,7 @@ const row = (buttons, value) => ({
     type: "actions",
     elements: buttons.map((b) => button(b, value)),
 });
-const fresh = (channel, ts, draft) => ({ chatId: channel, ts, draft, dirs: [], sessions: [] });
+const fresh = (channel, ts, draft) => ({ chatId: channel, ts, draft, dirs: [] });
 export class SlackPanel extends ChatPanel {
     deps;
     fence = ["`", "`"];

package/dist/channels/slack-render.js

@@ -97,7 +97,7 @@ export const context = (text) => ({
 // --- next-step buttons -------------------------------------------------------
 /** `action_id` carries an index: the label is read back off the message Slack
  *  echoes with the click, so a button survives a reload. */
-export const OFFER_PREFIX = "sg:";
+const OFFER_PREFIX = "sg:";
 /** Slack refuses a button label over BUTTON_MAX: every button, the panel's too. */
 export const truncate = (label) => cut(label, BUTTON_MAX);
 /** Slack wraps buttons on its own, so there is no row packing to budget. */

package/dist/channels/slack.js

@@ -1,11 +1,14 @@
 // Slack adapter: normalize inbound Socket Mode envelopes, render outbound turns.
-// Pier never posts into a channel's main flow: a conversation is
-// `<channel>/<threadTs>` and the thread is the session. Slack-specific: the
-// client intercepts unregistered slash commands, so `stop` and `settings` are
-// bare words; reactions are short names (`reactions.add` rejects 👀 with
+// Pier never posts into a channel's main flow but the home DM's
+// (docs/design/11-im-conversation.md), which is one conversation keyed `<channel>`:
+// any other is `<channel>/<threadTs>` and the thread is the session. Slack-specific: the
+// client intercepts unregistered slash commands, so `%stop` is the spelling
+// that arrives; reactions are short names (`reactions.add` rejects 👀 with
 // `invalid_name`); unacked envelopes are redelivered, so `event_id` is deduplicated.
+import { isChatCommand } from "../core/types.js";
 import { saveInboundAll } from "../core/inbox.js";
 import { MAX_INBOUND_BYTES } from "../core/inbound-file.js";
+import { skillsText } from "../core/chain.js";
 import { awaitsTurn } from "../core/reply.js";
 import { bindHint, bindResult, picked, STALE_OPTION, STOPPED } from "./lines.js";
 import { logger } from "../log.js";
@@ -30,12 +33,9 @@ const DRAIN_TIMEOUT_MS = 5000;
 /** Only has to cover a redelivery that crossed our immediate ack. */
 const DEDUP_TTL_MS = 5 * 60_000;
 const DEDUP_MAX = 2000;
-/** Bare words with exact arity, since there is no leading `/` to key on: "stop
- *  the deploy and tell me why" is a sentence for the agent, not an abort. */
-const BARE_COMMANDS = new Map([["stop", 0], ["settings", 0], ["bind", 1]]);
 /** The only definition of the conversation id format; control.ts decodes with it. */
 const conversationId = (channel, threadTs) => `${channel}/${threadTs}`;
-export const parseConversation = (id) => {
+const parseConversation = (id) => {
     const at = id.indexOf("/");
     return at < 0
         ? { channel: id, threadTs: "" }
@@ -54,18 +54,6 @@ const sharedFiles = (share) => share.files ?? share.original_message?.files ?? [
 /** A token budget, not a Slack limit: past this the agent gets the
  *  coordinates and decides for itself. */
 const INLINE_REPLY_MAX = 30;
-/** `/stop` is accepted for muscle memory; a bare `stop` is what actually arrives. */
-function slackCommand(text) {
-    const slash = parseCommand(text);
-    if (slash)
-        return { name: slash.name, args: slash.args };
-    const words = text.trim().split(/\s+/).filter(Boolean);
-    const name = words[0]?.toLowerCase() ?? "";
-    const arity = BARE_COMMANDS.get(name);
-    if (arity === undefined || words.length - 1 !== arity)
-        return undefined;
-    return { name, args: words.slice(1).join(" ") };
-}
 export class SlackChannel {
     deps;
     id = "slack";
@@ -103,13 +91,8 @@ export class SlackChannel {
                 ? this.api.addReaction(channel, ts, emoji)
                 : this.api.removeReaction(channel, ts, WORKING),
         }, deps.receipts ?? new ReceiptLedger("slack"), this.log, WORKING, RECEIPT_STALE_MS, (conversationId) => deps.control?.working({ channelId: this.id, conversationId }) ?? false);
-        if (deps.control && deps.handoff) {
-            this.panel = new SlackPanel({
-                api: this.api,
-                control: deps.control,
-                handoff: deps.handoff,
-                log: this.log,
-            });
+        if (deps.control) {
+            this.panel = new SlackPanel({ api: this.api, control: deps.control, log: this.log });
         }
     }
     async start(onMessage) {
@@ -203,13 +186,15 @@ export class SlackChannel {
             this.deps.store.discoverChat("slack", { id: channel, name, kind });
         }
         const text = this.stripMention(raw);
-        const command = slackCommand(text);
+        const command = parseCommand(text);
         const threadTs = threadOf(event);
-        const here = { channelId: this.id, conversationId: conversationId(channel, threadTs) };
+        // Every message in the home DM, in a thread or not, is the head's, under one key.
+        const home = this.isHome(channel);
+        const here = { channelId: this.id, conversationId: home ? channel : conversationId(channel, threadTs) };
         const bindRequest = command?.name === "bind" && isDm;
         const admitted = this.gate.admit("message", channel, {
             isDm,
-            addressed: this.addressed(raw, event, here),
+            addressed: this.addressed(raw, event, here, home),
             userId: event.user,
             bindRequest,
         });
@@ -220,23 +205,30 @@ export class SlackChannel {
         }
         if (bindRequest)
             return this.bind(channel, event.user, threadTs, command?.args ?? "");
-        if (command?.name === "stop")
+        // The head has no panel and takes `/stop` and `/skills` as chat commands (core/chain.ts).
+        if (!home && command?.name === "stop")
             return this.abortTurn(here, channel, threadTs);
+        if (!home && command?.name === "skills")
+            return this.listSkills(here);
+        if (!text && !files.length && !shares.length)
+            return this.log(`empty message in ${here.conversationId}, dropped`);
         // Downloading only past the gate: an unauthorized sender must not make the
         // bot pull bytes on their behalf.
         const markers = await this.saveAttachments(files);
         const shared = await Promise.all(shares.map((share) => this.sharedBlock(share)));
-        // A bare `@bot` and `settings` are the same request; `s <text>` drafts a
-        // session, so only where this message would start one: a thread root. The
-        // held question carries its markers, so Start sends what the user sent.
+        // `/s <text>` drafts a session, so only where this message would start one:
+        // a thread root. The held question carries its markers, so Start sends what the user sent.
         const question = threadTs === ts ? settingsDraft(text) : undefined;
-        if (this.panel && (question || command?.name === "settings" || (!text && !files.length && !shares.length))) {
+        if (this.panel && !home && (question || command?.name === "settings")) {
             return this.panel.open(here, channel, threadTs, question && [question, ...shared, ...markers].join("\n"));
         }
         // Resolved before the mark: any await between mark() and dispatch is a
         // window in which a previous turn can settle and take this receipt with it.
         const sender = { id: event.user, name: await this.directory.user(this.api, event.user) };
-        this.receipts.mark(here.conversationId, channel, ts);
+        // The head answers a chat command with a note, not a turn: nothing would take a 👀 off it.
+        const answered = home && command && !command.args && isChatCommand(command.name);
+        if (!answered)
+            this.receipts.mark(here.conversationId, channel, ts);
         // Steer: a follow-up is the wrong default when the human is watching a 👀.
         onMessage({
             key: here,
@@ -267,10 +259,13 @@ export class SlackChannel {
             this.log("incomplete block_actions payload, dropped");
             return;
         }
-        const threadTs = message.thread_ts ?? message.ts;
+        // Any click in the home DM is the head's, echoed where the button was;
+        // anywhere else a top-level message roots a thread.
+        const home = this.isHome(channel);
+        const threadTs = home ? message.thread_ts : message.thread_ts ?? message.ts;
         const key = {
             channelId: this.id,
-            conversationId: conversationId(channel, threadTs),
+            conversationId: home ? channel : conversationId(channel, message.thread_ts ?? message.ts),
         };
         const admitted = this.gate.admit("action", channel, {
             isDm: (await this.directory.channel(this.api, channel)).kind === "dm",
@@ -281,7 +276,8 @@ export class SlackChannel {
             return;
         // Start's question: the card is the message the click was on, so it carries the 👀.
         const run = (text) => this.deliver(key, channel, message.ts, user, text, onMessage);
-        if (await this.panel?.onAction(interaction, key, actionId, run))
+        // The head has no panel: a card left in the DM before it became the home is stale.
+        if (!home && (await this.panel?.onAction(interaction, key, actionId, run)))
             return;
         const text = offeredLabel(message.blocks, actionId);
         if (text === undefined) {
@@ -324,6 +320,11 @@ export class SlackChannel {
         await this.deps.control?.abort(key);
         await this.api.postMessage({ channel, thread_ts: threadTs, text: STOPPED });
     }
+    /** The head's `/skills` is MainChain's; a thread has no chain, so it is answered here. */
+    async listSkills(key) {
+        const text = skillsText((await this.deps.control?.skills(key)) ?? []);
+        await this.notify(key.conversationId, { text, origin: { kind: "chat-command", command: "skills" } });
+    }
     // --- bind ------------------------------------------------------------------
     /** Channels stay silent, but a DM that swallows every message looks broken
      *  rather than locked. */
@@ -333,7 +334,7 @@ export class SlackChannel {
         await this.api.postMessage({
             channel,
             thread_ts: threadTs,
-            text: bindHint("`bind <code>`"),
+            text: bindHint("`%bind <code>`"),
         }).catch((err) => this.log(`bind hint failed: ${String(err)}`));
     }
     async bind(channel, userId, threadTs, code) {
@@ -347,11 +348,21 @@ export class SlackChannel {
     }
     // --- addressing ------------------------------------------------------------
     /** Mentioned, or continuing a thread Pier already owns — durable, so it
-     *  holds after a restart. */
-    addressed(raw, event, key) {
+     *  holds after a restart. The home key has no row to know. */
+    addressed(raw, event, key, home) {
         if (this.me && raw.includes(`<@${this.me}>`))
             return true;
-        return !!event.thread_ts && !!this.deps.control?.knows(key);
+        return !home && !!event.thread_ts && !!this.deps.control?.knows(key);
+    }
+    isHome(channel) {
+        return this.deps.control?.isHome({ channelId: this.id, conversationId: channel }) ?? false;
+    }
+    /** A thread, or the home DM's main flow (no `threadTs`); undefined for any other channel's. */
+    target(conversation) {
+        const { channel, threadTs } = parseConversation(conversation);
+        if (threadTs)
+            return { channel, threadTs };
+        return this.isHome(channel) ? { channel } : undefined;
     }
     /** Slack does not strip the mention for us. */
     stripMention(text) {
@@ -441,32 +452,27 @@ export class SlackChannel {
     }
     // --- outbound --------------------------------------------------------------
     async send(conversation, reply) {
-        const { channel, threadTs } = parseConversation(conversation);
-        // No thread is a foreign id; posting it would put a turn in the channel's
-        // main flow. Refused loudly, receipts still cleared.
-        if (!threadTs) {
+        const to = this.target(conversation);
+        // No thread outside the home DM is a foreign id; posting it would put a
+        // turn in the channel's main flow. Refused loudly, receipts still cleared.
+        if (!to) {
             this.log(`refusing to answer ${conversation}: no thread in the conversation id`);
             await this.receipts.settle(conversation);
             return;
         }
         // The turn ended either way; a 👀 left up by a failed send looks like work.
-        await this.receipts.settleAfter(conversation, () => this.out.reply(channel, threadTs, reply), reply.meta);
-    }
-    /** A web session's thread: the root is the one message Pier posts into a
-     *  channel's main flow (channels/handoff.ts). */
-    async openThread(chatId, note) {
-        return conversationId(chatId, await this.out.open(chatId, note));
+        await this.receipts.settleAfter(conversation, () => this.out.reply(to.channel, to.threadTs, reply), reply.meta);
     }
     /** The 👀 goes on the note itself: the turn it triggers has no message of
      *  the user's to carry them. */
     async notify(conversation, note) {
-        const { channel, threadTs } = parseConversation(conversation);
-        if (!threadTs) {
+        const to = this.target(conversation);
+        if (!to) {
             this.log(`refusing to post a system note to ${conversation}: no thread in the conversation id`);
             return;
         }
-        const ts = await this.out.note(channel, threadTs, note);
+        const ts = await this.out.note(to.channel, to.threadTs, note);
         if (ts && awaitsTurn(note.origin))
-            this.receipts.mark(conversation, channel, ts, note.at);
+            this.receipts.mark(conversation, to.channel, ts, note.at);
     }
 }

package/dist/channels/types.js

@@ -2,7 +2,7 @@
 // adapters and the Console view (type-only, so no node builtins here). Defaults
 // are least-privilege, and platform values are seeds copied into a chat on
 // discovery, not a runtime fallback: a switch means what it says.
-const PLATFORMS = ["slack", "lark"];
+export const PLATFORMS = ["slack", "lark"];
 /** Validate at the boundary: an unknown platform is a 404, not a new row. */
 export const isChannelPlatform = (v) => typeof v === "string" && PLATFORMS.includes(v);
 /** Every adapter spells its ids `<chatId>` or `<chatId>/<thread>`, so the chat

package/dist/config-sync.js

@@ -1,14 +1,26 @@
 // One serialized configuration subscriber, shared by Settings and the hourly
-// task. Only a successfully applied response advances its persistent ETag.
-// The source is fetched over HTTPS only, redirects followed while they stay
-// HTTPS, JSON capped at 1 MiB so a hostile or broken source cannot exhaust memory.
-import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+// task. The source is the authority: what it publishes replaces the local copy
+// of every field the document carries, and a source on another schema version
+// pauses the subscription rather than being merged. Fetched over HTTPS only,
+// redirects followed while they stay HTTPS, JSON capped at 1 MiB so a hostile
+// or broken source cannot exhaust memory.
+import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { transact } from "./db.js";
 import { logger } from "./log.js";
-import { normalizeModelMenu } from "./settings.js";
+import { parseModelMenu } from "./settings.js";
 const log = logger("config-sync");
 export const CONFIG_SYNC_BYTES = 1024 * 1024;
+/** Bumped by any change to the document's shape — a menu row's fields, the
+ *  snapshot's, the envelope's. A subscriber applies its own version and
+ *  nothing else: no field-level compatibility, the older instance upgrades. */
+export const CONFIG_SCHEMA_VERSION = 2;
 const MAX_REDIRECTS = 5;
+class SchemaMismatch extends Error {
+    constructor(published) {
+        super(`Source publishes configuration schema ${typeof published === "number" ? `v${String(published)}` : "of an unknown version"}; `
+            + `this Pier reads v${String(CONFIG_SCHEMA_VERSION)} — upgrade the older instance, then resume the subscription`);
+    }
+}
 export function configSourceUrl(raw) {
     let url;
     try {
@@ -22,16 +34,13 @@ export function configSourceUrl(raw) {
     }
     return url;
 }
-export async function downloadConfig(raw, etag, signal) {
+export async function downloadConfig(raw, signal) {
     let url = configSourceUrl(raw);
     for (let hop = 0;; hop++) {
         signal.throwIfAborted();
         let res;
         try {
-            res = await fetch(url, {
-                method: "GET", redirect: "manual", signal,
-                headers: { accept: "application/json", ...(etag ? { "if-none-match": etag } : {}) },
-            });
+            res = await fetch(url, { method: "GET", redirect: "manual", signal, headers: { accept: "application/json" } });
         }
         catch {
             throw new Error(signal.aborted ? "Configuration download timed out or was cancelled" : "Could not connect to source");
@@ -49,18 +58,17 @@ export async function downloadConfig(raw, etag, signal) {
             }
             continue;
         }
-        if (res.status !== 200 && res.status !== 304) {
+        if (res.status !== 200) {
             await res.body?.cancel().catch(() => { });
             throw new Error(res.status === 404 || res.status === 410
                 ? "Source link was revoked or does not exist"
                 : `Source returned HTTP ${String(res.status)}`);
         }
-        const status = res.status === 304 ? 304 : 200;
-        if (status === 200 && !/^application\/json(?:\s*;|$)/i.test(res.headers.get("content-type") ?? "")) {
+        if (!/^application\/json(?:\s*;|$)/i.test(res.headers.get("content-type") ?? "")) {
             await res.body?.cancel().catch(() => { });
             throw new Error("Source did not return JSON");
         }
-        return { status, etag: res.headers.get("etag"), body: await read(res, signal) };
+        return read(res, signal);
     }
 }
 async function read(res, signal) {
@@ -94,7 +102,6 @@ export function configJson(value) {
     return JSON.stringify(value, (_key, entry) => entry && typeof entry === "object" && !Array.isArray(entry)
         ? Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b, "en"))) : entry);
 }
-const hash = (value) => createHash("sha256").update(configJson(value)).digest("hex");
 export class ConfigSync {
     deps;
     #state;
@@ -102,9 +109,12 @@ export class ConfigSync {
     constructor(deps) {
         this.deps = deps;
         const row = deps.db.prepare("SELECT value FROM settings WHERE key = ?").get(KEY);
-        this.#state = row ? JSON.parse(row.value) : {
-            instanceId: randomUUID(), token: null, url: "", enabled: false, etag: null,
-            appliedHash: null, lastChecked: null, lastApplied: null, error: null, needsReload: false,
+        // Field by field: a row an older Pier wrote carries keys this one no longer keeps.
+        const stored = row ? JSON.parse(row.value) : {};
+        this.#state = {
+            instanceId: stored.instanceId ?? randomUUID(), token: stored.token ?? null, url: stored.url ?? "",
+            enabled: stored.enabled ?? false, lastChecked: stored.lastChecked ?? null, lastApplied: stored.lastApplied ?? null,
+            error: stored.error ?? null, needsReload: stored.needsReload ?? false,
         };
         if (!row)
             this.#save();
@@ -154,11 +164,11 @@ export class ConfigSync {
         const local = await this.#local();
         if (this.#state.token !== expected)
             return null;
-        const document = { schemaVersion: 1, instanceId: this.#state.instanceId, ...local };
+        const document = { schemaVersion: CONFIG_SCHEMA_VERSION, instanceId: this.#state.instanceId, ...local };
         const body = configJson(document);
         if (Buffer.byteLength(body) > CONFIG_SYNC_BYTES)
             throw new Error("Configuration exceeds 1 MiB");
-        return { body, etag: `"${hash(document)}"` };
+        return body;
     }
     #parse(raw) {
         if (Buffer.byteLength(raw) > CONFIG_SYNC_BYTES)
@@ -173,8 +183,8 @@ export class ConfigSync {
         if (!value || typeof value !== "object" || Array.isArray(value))
             throw new Error("Invalid configuration document");
         const object = value;
-        if (object.schemaVersion !== 1)
-            throw new Error("Unsupported configuration schema version");
+        if (object.schemaVersion !== CONFIG_SCHEMA_VERSION)
+            throw new SchemaMismatch(object.schemaVersion);
         if (Object.keys(object).some((key) => !["schemaVersion", "instanceId", "agent", "modelMenu"].includes(key))) {
             throw new Error("Unexpected configuration fields");
         }
@@ -182,9 +192,9 @@ export class ConfigSync {
             throw new Error("Invalid source instance ID");
         if (object.instanceId === this.#state.instanceId)
             throw new Error("An instance cannot subscribe to itself");
-        const modelMenu = normalizeModelMenu(object.modelMenu);
-        if (!modelMenu)
-            throw new Error("Invalid model menu");
+        const modelMenu = parseModelMenu(object.modelMenu);
+        if (typeof modelMenu === "string")
+            throw new Error(`Invalid model menu: ${modelMenu}`);
         return { agent: this.deps.normalizeAgent(object.agent), modelMenu };
     }
     subscribe(url) {
@@ -208,14 +218,10 @@ export class ConfigSync {
     async #sync(rawUrl, signal) {
         try {
             const url = configSourceUrl(rawUrl).href;
-            const local = await this.#local();
-            const etag = url === this.#state.url && hash(local) === this.#state.appliedHash ? this.#state.etag : null;
             const timeout = AbortSignal.timeout(15_000);
-            const response = await (this.deps.download ?? downloadConfig)(url, etag, signal ? AbortSignal.any([signal, timeout]) : timeout);
+            const response = await (this.deps.download ?? downloadConfig)(url, signal ? AbortSignal.any([signal, timeout]) : timeout);
             signal?.throwIfAborted();
-            if (response.status === 304 && !etag)
-                throw new Error("Source returned 304 without a matching local configuration");
-            const next = response.status === 304 ? local : this.#parse(response.body);
+            const next = this.#parse(response);
             let changed = false;
             const previous = structuredClone(this.#state);
             const commit = (filesChanged) => transact(this.deps.db, () => {
@@ -225,15 +231,12 @@ export class ConfigSync {
                 if (menuChanged)
                     this.deps.settings.setModelMenu(next.modelMenu);
                 this.#save({
-                    url, enabled: true, etag: response.status === 304 ? etag : response.etag,
-                    appliedHash: hash(next), lastChecked: Date.now(),
+                    url, enabled: true, lastChecked: Date.now(),
                     lastApplied: changed ? Date.now() : previous.lastApplied,
                     needsReload: changed || previous.needsReload, error: null,
                 });
             });
             try {
-                // Reconcile under the file lock even on 304: local edits may have
-                // completed while the conditional download was in flight.
                 await this.deps.config.applySnapshot(next.agent, commit);
             }
             catch (err) {
@@ -249,13 +252,15 @@ export class ConfigSync {
                 }
                 this.#save({ needsReload: false });
             }
-            return changed ? "Configuration applied; reload completed" : `Configuration unchanged (${response.status})`;
+            return changed ? "Configuration applied; reload completed" : "Configuration unchanged";
         }
         catch (err) {
             const error = err instanceof Error ? err.message : "Configuration sync failed";
             // The message is the operator's; the cause, when there is one, is the log's.
             log.error(error, err instanceof Error ? err.cause : err);
-            this.#save({ lastChecked: Date.now(), error });
+            // A version gap is not retried hourly: the fix is an upgrade, and the
+            // notice stands until the operator resumes.
+            this.#save({ lastChecked: Date.now(), error, ...(err instanceof SchemaMismatch ? { enabled: false } : {}) });
             throw new Error(error);
         }
     }