agents 0.28.1 → 0.30.0

package/dist/harness/pi/index.js

@@ -1,260 +1,30 @@
 import { i as _classPrivateFieldInitSpec, n as _classPrivateFieldSet2, r as _assertClassBrand, t as _classPrivateFieldGet2 } from "../../classPrivateFieldGet2-DZBYAB34.js";
 import { t as _classPrivateMethodInitSpec } from "../../classPrivateMethodInitSpec-qMjJ6sHQ.js";
 import { t as LifecycleCapability } from "../../capability-DBAKc6UZ.js";
-import "../../lifecycle-DGorpAmA.js";
+import "../../lifecycle-v1rKHV2C.js";
+import { isDurableObjectMemoryLimitReset } from "../../retries.js";
 import { Type } from "@earendil-works/pi-ai";
 import { LiveDoc, ROOT_CONVERSATION_ID, watchEvents } from "@earendil-works/pi-durable";
-import { SQLITE_MIGRATIONS, SqliteStorage } from "@earendil-works/pi-durable/storage/sqlite";
-//#region src/harness/pi/context.ts
-/** chord's `BACKGROUND_CONTEXT`: no values, never cancelled. */
-const BACKGROUND_CONTEXT = Object.freeze({
-	abortSignal: void 0,
-	value: () => void 0,
-	toString: () => "[Context pi-harness background]"
-});
-/**
-* chord's `withAbortSignal`: a context cancelled by either the parent's
-* signal or `signal`, carrying the parent's values.
-*/
-function withAbortSignal(signal, parent) {
-	const abortSignal = parent.abortSignal === void 0 ? signal : AbortSignal.any([parent.abortSignal, signal]);
-	return Object.freeze({
-		abortSignal,
-		value: parent.value.bind(parent),
-		toString: () => `${parent}.WithAbortSignal`
-	});
-}
-//#endregion
+import { BACKGROUND_CONTEXT, withAbortSignal } from "@earendil-works/chord/context";
+import { openDurableObjectSqliteStorage } from "@earendil-works/pi-durable/storage/sqlite/cloudflare";
 //#region src/harness/pi/session-store.ts
 const DEFAULT_PREFIX = "pi_";
 /** Open pi-durable's storage over this object's SQLite database. */
 function openPiSessionStore(storage, options = {}) {
-	return SqliteStorage.open(new DurableObjectSqliteDatabase(storage, options));
-}
-/** Names pi's migrations create: every table and index, in any version. */
-function schemaNames() {
-	const names = /* @__PURE__ */ new Set(["durable_schema"]);
-	const pattern = /\bCREATE\s+(?:UNIQUE\s+)?(?:TABLE|INDEX)\s+(?:IF\s+NOT\s+EXISTS\s+)?([A-Za-z_][A-Za-z0-9_]*)/gi;
-	for (const migration of SQLITE_MIGRATIONS) for (const statement of migration.statements) for (const match of statement.matchAll(pattern)) names.add(match[1]);
-	return [...names];
-}
-var _pattern = /* @__PURE__ */ new WeakMap();
-var _prefix = /* @__PURE__ */ new WeakMap();
-var _cache = /* @__PURE__ */ new WeakMap();
-/**
-* Rewrites pi's schema identifiers outside string literals. Identifiers are
-* matched on word boundaries, so column names such as `record_type` or
-* `document_id` are left alone.
-*/
-var Prefixer = class {
-	constructor(prefix) {
-		_classPrivateFieldInitSpec(this, _pattern, void 0);
-		_classPrivateFieldInitSpec(this, _prefix, void 0);
-		_classPrivateFieldInitSpec(this, _cache, /* @__PURE__ */ new Map());
-		if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(prefix)) throw new Error(`Invalid pi session store prefix ${JSON.stringify(prefix)}`);
-		if (prefix.startsWith("_cf_")) throw new Error("The pi session store prefix must not start with _cf_");
-		_classPrivateFieldSet2(_prefix, this, prefix);
-		_classPrivateFieldSet2(_pattern, this, new RegExp(`\\b(${schemaNames().join("|")})\\b`, "g"));
-	}
-	rewrite(sql) {
-		const cached = _classPrivateFieldGet2(_cache, this).get(sql);
-		if (cached !== void 0) return cached;
-		const rewritten = sql.split(/('(?:[^']|'')*')/).map((part, index) => index % 2 === 1 ? part : part.replace(_classPrivateFieldGet2(_pattern, this), (name) => `${_classPrivateFieldGet2(_prefix, this)}${name}`)).join("");
-		_classPrivateFieldGet2(_cache, this).set(sql, rewritten);
-		return rewritten;
-	}
-};
-/** Durable Objects bind strings, numbers, null, and ArrayBuffers. */
-function binding(value) {
-	if (typeof value === "bigint") {
-		if (value > BigInt(Number.MAX_SAFE_INTEGER) || value < BigInt(Number.MIN_SAFE_INTEGER)) throw new RangeError(`SQLite integer ${value} is outside the safe range`);
-		return Number(value);
-	}
-	if (value instanceof Uint8Array) return value.buffer.slice(value.byteOffset, value.byteOffset + value.byteLength);
-	return value;
-}
-/** Blobs come back as ArrayBuffers; pi's contract reads Uint8Arrays. */
-function row(raw) {
-	for (const key of Object.keys(raw)) {
-		const value = raw[key];
-		if (value instanceof ArrayBuffer) raw[key] = new Uint8Array(value);
-	}
-	return raw;
-}
-var _tail = /* @__PURE__ */ new WeakMap();
-var _pending = /* @__PURE__ */ new WeakMap();
-var _OperationQueue_brand = /* @__PURE__ */ new WeakSet();
-/**
-* Orders calls on the one SQLite connection. A statement runs at once,
-* directly, when nothing is waiting; while a transaction is open, it and
-* every call after it wait, in call order, for the transaction to settle,
-* so none runs inside it. A failure does not stop the calls behind it.
-*
-* The queue holds calls, not data: a caller has no result until its call
-* runs, so an isolate that dies loses only calls nobody has seen succeed,
-* as it would without the queue. pi's transactions await only their own
-* synchronous statements, so a transaction holds the queue for microtasks,
-* never for I/O.
-*/
-var OperationQueue = class {
-	constructor() {
-		_classPrivateMethodInitSpec(this, _OperationQueue_brand);
-		_classPrivateFieldInitSpec(this, _tail, Promise.resolve());
-		_classPrivateFieldInitSpec(this, _pending, 0);
-	}
-	/** A synchronous statement: runs now unless something is ahead of it. */
-	run(statement) {
-		if (_classPrivateFieldGet2(_pending, this) > 0) return _assertClassBrand(_OperationQueue_brand, this, _enqueue).call(this, statement);
-		try {
-			return Promise.resolve(statement());
-		} catch (error) {
-			return Promise.reject(error);
-		}
-	}
-	/** An asynchronous call that holds the queue until it settles. */
-	hold(call) {
-		return _assertClassBrand(_OperationQueue_brand, this, _enqueue).call(this, call);
-	}
-};
-function _enqueue(call) {
-	_classPrivateFieldSet2(_pending, this, _classPrivateFieldGet2(_pending, this) + 1);
-	const settled = _classPrivateFieldGet2(_tail, this).then(call).finally(() => {
-		_classPrivateFieldSet2(_pending, this, _classPrivateFieldGet2(_pending, this) - 1);
-	});
-	_classPrivateFieldSet2(_tail, this, settled.then(() => void 0, () => void 0));
-	return settled;
-}
-var _sql = /* @__PURE__ */ new WeakMap();
-var _prefixer = /* @__PURE__ */ new WeakMap();
-/** One statement on a Durable Object's synchronous SQL API. */
-var Statements = class {
-	constructor(sql, prefixer) {
-		_classPrivateFieldInitSpec(this, _sql, void 0);
-		_classPrivateFieldInitSpec(this, _prefixer, void 0);
-		_classPrivateFieldSet2(_sql, this, sql);
-		_classPrivateFieldSet2(_prefixer, this, prefixer);
-	}
-	exec(sql) {
-		_classPrivateFieldGet2(_sql, this).exec(_classPrivateFieldGet2(_prefixer, this).rewrite(sql));
-	}
-	run(sql, params) {
-		_classPrivateFieldGet2(_sql, this).exec(_classPrivateFieldGet2(_prefixer, this).rewrite(sql), ...params.map(binding));
-	}
-	get(sql, params) {
-		const first = _classPrivateFieldGet2(_sql, this).exec(_classPrivateFieldGet2(_prefixer, this).rewrite(sql), ...params.map(binding)).next();
-		return first.done ? void 0 : row(first.value);
-	}
-	all(sql, params) {
-		return _classPrivateFieldGet2(_sql, this).exec(_classPrivateFieldGet2(_prefixer, this).rewrite(sql), ...params.map(binding)).toArray().map((raw) => row(raw));
-	}
-};
-var _statements = /* @__PURE__ */ new WeakMap();
-var _active = /* @__PURE__ */ new WeakMap();
-var _DurableObjectSqliteTransaction_brand = /* @__PURE__ */ new WeakSet();
-/**
-* The handle pi's transaction callback gets. It runs statements directly:
-* the transaction holds the database's queue for as long as it is open.
-*/
-var DurableObjectSqliteTransaction = class {
-	constructor(statements) {
-		_classPrivateMethodInitSpec(this, _DurableObjectSqliteTransaction_brand);
-		_classPrivateFieldInitSpec(this, _statements, void 0);
-		_classPrivateFieldInitSpec(this, _active, true);
-		_classPrivateFieldSet2(_statements, this, statements);
-	}
-	/** Called once the transaction settles; the handle is unusable after. */
-	end() {
-		_classPrivateFieldSet2(_active, this, false);
-	}
-	async exec(sql) {
-		_assertClassBrand(_DurableObjectSqliteTransaction_brand, this, _assertActive).call(this);
-		_classPrivateFieldGet2(_statements, this).exec(sql);
-	}
-	async run(sql, ...params) {
-		_assertClassBrand(_DurableObjectSqliteTransaction_brand, this, _assertActive).call(this);
-		_classPrivateFieldGet2(_statements, this).run(sql, params);
-	}
-	async get(sql, ...params) {
-		_assertClassBrand(_DurableObjectSqliteTransaction_brand, this, _assertActive).call(this);
-		return _classPrivateFieldGet2(_statements, this).get(sql, params);
-	}
-	async all(sql, ...params) {
-		_assertClassBrand(_DurableObjectSqliteTransaction_brand, this, _assertActive).call(this);
-		return _classPrivateFieldGet2(_statements, this).all(sql, params);
-	}
-};
-function _assertActive() {
-	if (!_classPrivateFieldGet2(_active, this)) throw new Error("The pi SQLite transaction is no longer active");
+	const prefix = options.prefix ?? DEFAULT_PREFIX;
+	if (prefix.toLowerCase().startsWith("_cf_")) return Promise.reject(/* @__PURE__ */ new Error("The pi session store prefix must not start with _cf_"));
+	return openDurableObjectSqliteStorage(storage, { prefix });
 }
-var _storage = /* @__PURE__ */ new WeakMap();
-var _statements2 = /* @__PURE__ */ new WeakMap();
-var _queue = /* @__PURE__ */ new WeakMap();
-/**
-* pi's `SqliteDatabase` facade over `DurableObjectStorage`.
-*
-* Durable Object SQL is synchronous, but pi's facade is asynchronous and a
-* transaction's callback awaits between statements. A statement issued
-* outside the transaction while it waits would run inside it: it would see
-* uncommitted rows, and roll back with it. pi's contract therefore has the
-* adapter queue every other call until the transaction settles: every
-* call goes through one `OperationQueue`, which runs a statement at once
-* when no transaction is open. As the contract says, a call on the database from inside a
-* transaction's callback waits for that transaction and never settles; the
-* callback must use its handle.
-*
-* Transactions run in `storage.transaction()`, which rolls back when the
-* callback rejects and rejects with the same error.
-*/
-var DurableObjectSqliteDatabase = class {
-	constructor(storage, options = {}) {
-		_classPrivateFieldInitSpec(this, _storage, void 0);
-		_classPrivateFieldInitSpec(this, _statements2, void 0);
-		_classPrivateFieldInitSpec(this, _queue, new OperationQueue());
-		_classPrivateFieldSet2(_storage, this, storage);
-		_classPrivateFieldSet2(_statements2, this, new Statements(storage.sql, new Prefixer(options.prefix ?? DEFAULT_PREFIX)));
-	}
-	exec(sql) {
-		return _classPrivateFieldGet2(_queue, this).run(() => _classPrivateFieldGet2(_statements2, this).exec(sql));
-	}
-	run(sql, ...params) {
-		return _classPrivateFieldGet2(_queue, this).run(() => _classPrivateFieldGet2(_statements2, this).run(sql, params));
-	}
-	get(sql, ...params) {
-		return _classPrivateFieldGet2(_queue, this).run(() => _classPrivateFieldGet2(_statements2, this).get(sql, params));
-	}
-	all(sql, ...params) {
-		return _classPrivateFieldGet2(_queue, this).run(() => _classPrivateFieldGet2(_statements2, this).all(sql, params));
-	}
-	transaction(callback) {
-		return _classPrivateFieldGet2(_queue, this).hold(() => _classPrivateFieldGet2(_storage, this).transaction(async () => {
-			const transaction = new DurableObjectSqliteTransaction(_classPrivateFieldGet2(_statements2, this));
-			try {
-				return await callback(transaction);
-			} finally {
-				transaction.end();
-			}
-		}));
-	}
-	/** The object owns the database; there is nothing to close. */
-	close() {
-		return _classPrivateFieldGet2(_queue, this).run(() => void 0);
-	}
-};
 //#endregion
 //#region src/harness/pi/harness.ts
 const BG = BACKGROUND_CONTEXT;
 /** The root session's id. */
 const ROOT_SESSION = String(ROOT_CONVERSATION_ID);
 /**
-* The three wake timings. They suit a real deployment; only tests change
-* them, with `setWakeTimingForTests`, so a suite does not sit on the real
+* The wake timings. They suit a real deployment; only tests change them,
+* with `setWakeTimingForTests`, so a suite does not sit on the real
 * heartbeat.
 *
-* A pi long wait further away than this is handed to the alarm, so the
-* alarm, not pi's in-memory timer, is what wakes the object.
-*/
-const SLEEP_THRESHOLD_MS = 6e4;
-/**
 * Longest one wake waits on pi. It waits inside an alarm invocation, which
 * has a 15 minute wall-time limit, so a longer run is waited on across
 * several alarms.
@@ -266,13 +36,28 @@ const WAIT_BUDGET_MS = 10 * 6e4;
 * job is still due and its alarm restarts the object.
 */
 const HEARTBEAT_MS = 3e4;
+/**
+* How often a wait re-reads `pi.wake()` when the factory did not pass
+* `onWake`, so nothing tells the harness when it changes.
+*/
+const POLL_MS = 1e3;
+/**
+* The longest a wake job whose dispatch keeps failing waits before it tries
+* again. Its delay starts at the heartbeat and doubles up to this.
+*/
+const MAX_WAKE_BACKOFF_MS = 10 * 6e4;
+/**
+* Wake dispatches that failed in a row. Stored, so the backoff holds across
+* restarts, and outside the job: a push that saved it in the job's payload
+* could overwrite a submit's due-now push.
+*/
+const WAKE_ERRORS_KEY = "pi-harness:wake-errors";
 const WAKE_FN = "wake";
-function wakeJobId(session) {
-	return `pi-wake:${session}`;
-}
-function sessionOfJob(payload) {
-	return typeof payload === "object" && payload !== null && "session" in payload && typeof payload.session === "string" ? payload.session : void 0;
-}
+/**
+* The one wake job. Before Pi 1.4 there was one per session, with ids
+* `pi-wake:<session>`; a left-over one hands over to this one.
+*/
+const WAKE_JOB_ID = "pi-wake";
 /** pi-durable's stored reference to a pi-ai model. */
 function modelRef(model) {
 	return {
@@ -295,13 +80,18 @@ function signalContext(signal) {
 	return signal ? withAbortSignal(signal, BG) : BG;
 }
 var _options = /* @__PURE__ */ new WeakMap();
-var _waits = /* @__PURE__ */ new WeakMap();
+var _waiting = /* @__PURE__ */ new WeakMap();
+var _changed = /* @__PURE__ */ new WeakMap();
 var _admitting = /* @__PURE__ */ new WeakMap();
-var _sleepThresholdMs = /* @__PURE__ */ new WeakMap();
+var _onWakeWired = /* @__PURE__ */ new WeakMap();
 var _waitBudgetMs = /* @__PURE__ */ new WeakMap();
 var _heartbeatMs = /* @__PURE__ */ new WeakMap();
+var _pollMs = /* @__PURE__ */ new WeakMap();
 var _opening = /* @__PURE__ */ new WeakMap();
+var _lastClose = /* @__PURE__ */ new WeakMap();
+var _closing = /* @__PURE__ */ new WeakMap();
 var _PiHarness_brand = /* @__PURE__ */ new WeakSet();
+var _onWake = /* @__PURE__ */ new WeakMap();
 /**
 * pi-durable hosted in a Durable Object, behind a small harness interface:
 * `harness.prompt()`, `harness.sessions`, `harness.session(id)`. How a session reaches a
@@ -314,12 +104,14 @@ var _PiHarness_brand = /* @__PURE__ */ new WeakSet();
 *
 * What pi cannot do on a Durable Object is wake itself: its scheduler runs
 * in memory, and an evicted object has no memory. The harness is that wake,
-* with one Lifecycle job per session. Input goes to pi once, in `submit()`,
-* after the session's job is scheduled. The job waits while pi has live
-* tasks in the session, rescheduling itself as a heartbeat, and completes
-* when there are none. An eviction mid-run leaves the job due, so its alarm
-* restarts the object, pi reopens and resumes its own tasks, and the job
-* waits again.
+* with one Lifecycle job driven by `pi.wake()`. Input goes to pi once, in
+* `submit()`, after the job is scheduled. While pi has work running, the
+* job waits on it, rescheduling itself as a heartbeat. While pi's tasks
+* sleep, the job is due when the first one wakes; pi tells the harness
+* through the `onWake` the factory passes to `Harness.open`. When pi has
+* nothing to do, the job completes. An eviction mid-run leaves the job due,
+* so its alarm restarts the object, pi reopens and resumes its own tasks,
+* and the job waits again.
 *
 * @beta The API may change between releases.
 */
@@ -328,25 +120,54 @@ var PiHarness = class extends LifecycleCapability {
 		super("pi-harness");
 		_classPrivateMethodInitSpec(this, _PiHarness_brand);
 		_classPrivateFieldInitSpec(this, _options, void 0);
-		_classPrivateFieldInitSpec(this, _waits, /* @__PURE__ */ new Map());
-		_classPrivateFieldInitSpec(this, _admitting, /* @__PURE__ */ new Map());
-		_classPrivateFieldInitSpec(this, _sleepThresholdMs, SLEEP_THRESHOLD_MS);
+		_classPrivateFieldInitSpec(this, _waiting, void 0);
+		_classPrivateFieldInitSpec(this, _changed, void 0);
+		_classPrivateFieldInitSpec(this, _admitting, 0);
+		_classPrivateFieldInitSpec(this, _onWakeWired, false);
 		_classPrivateFieldInitSpec(this, _waitBudgetMs, WAIT_BUDGET_MS);
 		_classPrivateFieldInitSpec(this, _heartbeatMs, HEARTBEAT_MS);
+		_classPrivateFieldInitSpec(this, _pollMs, POLL_MS);
 		_classPrivateFieldInitSpec(this, _opening, void 0);
+		_classPrivateFieldInitSpec(this, _lastClose, Promise.resolve());
+		_classPrivateFieldInitSpec(this, _closing, /* @__PURE__ */ new WeakSet());
+		_classPrivateFieldInitSpec(this, _onWake, (wake) => {
+			_classPrivateFieldSet2(_onWakeWired, this, true);
+			_classPrivateFieldGet2(_changed, this)?.call(this);
+			if (_classPrivateFieldGet2(_waiting, this)) return;
+			_assertClassBrand(_PiHarness_brand, this, _wakeFor).call(this, wake).catch((error) => _assertClassBrand(_PiHarness_brand, this, _wakeError).call(this, error));
+		});
 		_classPrivateFieldSet2(_options, this, options);
 		this.sessions = new PiSessions(this);
 	}
 	async onStart(_context) {
-		const { pi } = await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
-		const inspection = await pi.inspect(BG);
-		const sessions = new Set(inspection.tasks.map((task) => String(task.record.conversationId)));
-		for (const session of sessions) await _assertClassBrand(_PiHarness_brand, this, _wake).call(this, session);
+		await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
 	}
 	async onJob(context) {
 		if (context.job.fn !== WAKE_FN) return;
-		const session = sessionOfJob(context.job.payload);
-		if (session !== void 0) return _assertClassBrand(_PiHarness_brand, this, _wakeStep).call(this, session);
+		let outcome;
+		if (context.job.id !== WAKE_JOB_ID) {
+			await _assertClassBrand(_PiHarness_brand, this, _wake).call(this);
+			outcome = void 0;
+		} else outcome = await _assertClassBrand(_PiHarness_brand, this, _wakeStep).call(this);
+		const kv = this.lifecycle.storage.kv;
+		if (kv.get(WAKE_ERRORS_KEY) !== void 0) kv.delete(WAKE_ERRORS_KEY);
+		return outcome;
+	}
+	/**
+	* A wake dispatch that failed through Lifecycle's retries, as when pi
+	* cannot be opened. Lifecycle would complete the job, and pi's work would
+	* never be woken again, so try again later: at the heartbeat, doubling
+	* while the failures continue, up to 10 minutes.
+	*/
+	onJobError(context, error) {
+		if (context.job.fn !== WAKE_FN) return;
+		console.error(`pi wake job "${context.job.id}" failed after ${context.attempt} attempts; retrying with backoff`, error);
+		_assertClassBrand(_PiHarness_brand, this, _wakeError).call(this, error);
+		const kv = this.lifecycle.storage.kv;
+		const errors = (kv.get(WAKE_ERRORS_KEY) ?? 0) + 1;
+		kv.put(WAKE_ERRORS_KEY, errors);
+		const delay = Math.min(_classPrivateFieldGet2(_heartbeatMs, this) * 2 ** (errors - 1), MAX_WAKE_BACKOFF_MS);
+		return { rescheduleAt: Date.now() + delay };
 	}
 	/** Close pi's in-memory resources. Durable state is untouched. */
 	async dispose() {
@@ -370,6 +191,13 @@ var PiHarness = class extends LifecycleCapability {
 	abort(options = {}) {
 		return this.session(options.session).abort(options.operationId);
 	}
+	/**
+	* Run again the tasks pi's crash-loop guard parked in a session's work.
+	* False when nothing was parked.
+	*/
+	retry(options = {}) {
+		return this.session(options.session).retry();
+	}
 	wait(operationId, options = {}) {
 		return this.session(options.session).wait(operationId, options.signal);
 	}
@@ -381,10 +209,12 @@ var PiHarness = class extends LifecycleCapability {
 	async pending(options = {}) {
 		const { pi } = await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
 		const id = options.session === void 0 ? void 0 : conversationId(options.session);
-		return (await pi.inspect(BG)).submissions.filter((record) => record.requestId !== void 0 && (id === void 0 || record.conversationId === id)).map((record) => ({
+		const inspection = await pi.inspect(BG);
+		const parked = await _assertClassBrand(_PiHarness_brand, this, _parked).call(this, inspection);
+		return inspection.submissions.filter((record) => record.requestId !== void 0 && (id === void 0 || record.conversationId === id)).map((record) => ({
 			operationId: record.requestId,
 			session: String(record.conversationId),
-			status: record.status === "queued" ? "queued" : "running"
+			status: record.status === "queued" ? "queued" : parked.some((task) => task.sessions.has(record.conversationId)) ? "parked" : "running"
 		}));
 	}
 	/** The opened pi Harness, for anything the interface does not cover. */
@@ -407,29 +237,33 @@ var PiHarness = class extends LifecycleCapability {
 		const operationId = options.operationId ?? crypto.randomUUID();
 		const { storage } = await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
 		const conversation = await this.conversation(session);
-		_classPrivateFieldGet2(_admitting, this).set(session, (_classPrivateFieldGet2(_admitting, this).get(session) ?? 0) + 1);
-		let accepted;
-		try {
-			await _assertClassBrand(_PiHarness_brand, this, _wake).call(this, session);
-			accepted = await storage.submissionByRequest(conversation.id, operationId, BG) === void 0;
-			await conversation.submit({
-				type: "input",
-				content: input,
-				whenBusy: options.whenBusy ?? "followUp",
-				requestId: operationId
-			}, BG);
-		} finally {
-			const left = (_classPrivateFieldGet2(_admitting, this).get(session) ?? 1) - 1;
-			if (left === 0) _classPrivateFieldGet2(_admitting, this).delete(session);
-			else _classPrivateFieldGet2(_admitting, this).set(session, left);
-		}
-		await _assertClassBrand(_PiHarness_brand, this, _wake).call(this, session);
 		return {
 			operationId,
 			session,
-			accepted
+			accepted: await _assertClassBrand(_PiHarness_brand, this, _admit).call(this, async () => {
+				const accepted = await storage.submissionByRequest(conversation.id, operationId, BG) === void 0;
+				await conversation.submit({
+					type: "input",
+					content: input,
+					whenBusy: options.whenBusy ?? "followUp",
+					requestId: operationId,
+					...options.entry ? { entry: options.entry } : {}
+				}, BG);
+				return accepted;
+			})
 		};
 	}
+	/** @internal Run again the tasks pi's restart limit parked in a session. */
+	async retryParked(session) {
+		const { pi } = await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
+		const id = conversationId(session);
+		const parked = (await _assertClassBrand(_PiHarness_brand, this, _parked).call(this, await pi.inspect(BG))).filter((task) => task.sessions.has(id));
+		if (parked.length === 0) return false;
+		await _assertClassBrand(_PiHarness_brand, this, _admit).call(this, async () => {
+			for (const task of parked) await pi.retryTask(task.id, BG);
+		});
+		return true;
+	}
 	/** @internal Withdraw a queued input, or abort the run it joined. */
 	async withdraw(session, operationId) {
 		const { pi, storage } = await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
@@ -462,94 +296,188 @@ var PiHarness = class extends LifecycleCapability {
 		};
 	}
 };
-/** Schedule the session's wake job now, or pull it forward. */
-function _wake(session, time = Date.now()) {
+/**
+* Hand pi work inside the wake. The wake is scheduled first, so if the
+* object dies after pi has the work, that job restarts it; while `hand`
+* is in flight the step will not complete. The wake steps again after, so
+* it sees the work even if it just completed.
+*/
+async function _admit(hand) {
+	var _this$admitting;
+	_classPrivateFieldSet2(_admitting, this, (_this$admitting = _classPrivateFieldGet2(_admitting, this), _this$admitting++, _this$admitting));
+	let result;
+	try {
+		await _assertClassBrand(_PiHarness_brand, this, _wake).call(this);
+		result = await hand();
+	} finally {
+		var _this$admitting3;
+		_classPrivateFieldSet2(_admitting, this, (_this$admitting3 = _classPrivateFieldGet2(_admitting, this), _this$admitting3--, _this$admitting3));
+	}
+	await _assertClassBrand(_PiHarness_brand, this, _wake).call(this);
+	return result;
+}
+/** Schedule the wake job now, or at `time`. */
+function _wake(time = Date.now()) {
 	return this.lifecycle.jobs.push({
-		id: wakeJobId(session),
+		id: WAKE_JOB_ID,
 		fn: WAKE_FN,
 		time,
-		payload: { session },
 		singleflight: true,
 		recoveryLoop: true
 	});
 }
+/** Schedule the wake job for what `pi.wake()` says, if pi needs one. */
+async function _wakeFor(wake) {
+	if (wake.active) await _assertClassBrand(_PiHarness_brand, this, _wake).call(this);
+	else if (wake.at !== void 0) await _assertClassBrand(_PiHarness_brand, this, _wake).call(this, wake.at);
+}
 /**
-* One run of a session's wake job. It never admits or replays anything:
-* it waits while pi has live tasks in the session and completes when it
-* has none. pi does all the work in between.
+* One run of the wake job. It never admits or replays anything: it reads
+* `pi.wake()`, which is all of pi's sessions at once. Running work is
+* waited on; a sleep reschedules the job for when it ends; no work
+* completes the job. pi does all the work in between.
 */
-async function _wakeStep(session) {
+async function _wakeStep() {
 	const heartbeat = { rescheduleAt: Date.now() + _classPrivateFieldGet2(_heartbeatMs, this) };
-	if (_classPrivateFieldGet2(_waits, this).has(session)) return heartbeat;
+	if (_classPrivateFieldGet2(_waiting, this)) return heartbeat;
 	const { pi } = await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
-	const conversation = await pi.conversation(conversationId(session), BG);
-	if (!conversation) return void 0;
-	const tasks = (await pi.inspect(BG)).tasks.filter((task) => task.record.conversationId === conversation.id);
-	if (tasks.length === 0) return _classPrivateFieldGet2(_admitting, this).has(session) ? heartbeat : void 0;
-	const wakeAt = await _assertClassBrand(_PiHarness_brand, this, _longWait).call(this, pi, conversation.id, BG);
-	if (wakeAt !== void 0) return { rescheduleAt: wakeAt };
-	if (tasks.every((task) => task.record.background)) return heartbeat;
-	const wait = _assertClassBrand(_PiHarness_brand, this, _waitForIdle).call(this, conversation).finally(() => {
-		_classPrivateFieldGet2(_waits, this).delete(session);
-		_assertClassBrand(_PiHarness_brand, this, _wake).call(this, session);
-	});
-	_classPrivateFieldGet2(_waits, this).set(session, wait);
-	this.lifecycle.trackAlarmWork(wait);
-	return heartbeat;
+	pi.resume();
+	const wake = pi.wake();
+	if (wake.active) {
+		const wait = _assertClassBrand(_PiHarness_brand, this, _waitWhileActive).call(this, pi).then((ended) => {
+			_classPrivateFieldSet2(_waiting, this, void 0);
+			if (ended) _assertClassBrand(_PiHarness_brand, this, _wake).call(this);
+		}, (error) => {
+			_classPrivateFieldSet2(_waiting, this, void 0);
+			throw error;
+		});
+		_classPrivateFieldSet2(_waiting, this, wait);
+		if (!this.lifecycle.trackAlarmWork(wait)) wait.catch(() => {});
+		return heartbeat;
+	}
+	if (_classPrivateFieldGet2(_admitting, this) > 0) return heartbeat;
+	if (wake.at !== void 0) return { rescheduleAt: wake.at };
 }
-async function _waitForIdle(conversation) {
-	const budget = new AbortController();
-	const timer = setTimeout(() => budget.abort(), _classPrivateFieldGet2(_waitBudgetMs, this));
+/**
+* Wait while pi has work running, up to the wait budget. With `onWake`, a
+* change ends each sleep early, and so does pi closing; without it, the
+* sleep is `pollMs`. Whether the wait ended, with pi idle or at the
+* budget, rather than failing. Rejects with a memory-limit reset.
+*/
+async function _waitWhileActive(pi) {
+	const deadline = Date.now() + _classPrivateFieldGet2(_waitBudgetMs, this);
 	try {
-		await conversation.waitForIdle(withAbortSignal(budget.signal, BG));
+		while (pi.wake().active) {
+			const left = deadline - Date.now();
+			if (left <= 0) return true;
+			await new Promise((resolve) => {
+				const timer = setTimeout(resolve, _classPrivateFieldGet2(_onWakeWired, this) ? left : Math.min(left, _classPrivateFieldGet2(_pollMs, this)));
+				_classPrivateFieldSet2(_changed, this, () => {
+					clearTimeout(timer);
+					resolve();
+				});
+			});
+			_classPrivateFieldSet2(_changed, this, void 0);
+		}
+		return true;
 	} catch (error) {
-		if (!budget.signal.aborted) this.lifecycle.events.emit("pi:wake_error", {
-			session: String(conversation.id),
-			error: error instanceof Error ? error.message : String(error)
-		});
-	} finally {
-		clearTimeout(timer);
+		if (!_classPrivateFieldGet2(_closing, this).has(pi)) _assertClassBrand(_PiHarness_brand, this, _wakeError).call(this, error);
+		if (isDurableObjectMemoryLimitReset(error)) throw error;
+		return false;
 	}
 }
+function _wakeError(error) {
+	this.lifecycle.events.emit("pi:wake_error", { error: error instanceof Error ? error.message : String(error) });
+}
 /**
 * pi, opened. Waits for Lifecycle startup first, so pi is only ever
 * opened inside it: startup holds the input gate (`blockConcurrencyWhile`)
 * and awaits the open in `onStart`, so an open begun before startup would
 * be awaited behind a closed gate, with its timers and I/O held back, and
 * never finish.
+*
+* pi stays open until `dispose()`, or until it closes on its own: any
+* storage error fails pi's Session for good. Then the next call, or the
+* wake job's next step, opens pi again once the failed pi has closed, and
+* pi recovers from what it had committed. Closing waits for running task
+* code to return, so code that ignores its abort signal delays the reopen.
+* An open that fails is not kept either, so the next call tries again.
 */
 async function _open() {
 	await this.lifecycle.ready();
-	_classPrivateFieldGet2(_opening, this) ?? _classPrivateFieldSet2(_opening, this, _assertClassBrand(_PiHarness_brand, this, _doOpen).call(this).catch((error) => {
-		_classPrivateFieldSet2(_opening, this, void 0);
-		throw error;
-	}));
+	if (_classPrivateFieldGet2(_opening, this) === void 0) {
+		const opening = _assertClassBrand(_PiHarness_brand, this, _doOpen).call(this, (pi, closed) => _assertClassBrand(_PiHarness_brand, this, _piClosing).call(this, opening, pi, closed)).catch((error) => {
+			if (_classPrivateFieldGet2(_opening, this) === opening) _classPrivateFieldSet2(_opening, this, void 0);
+			throw error;
+		});
+		_classPrivateFieldSet2(_opening, this, opening);
+	}
 	return _classPrivateFieldGet2(_opening, this);
 }
-async function _doOpen() {
+async function _doOpen(onClose) {
+	await _classPrivateFieldGet2(_lastClose, this);
 	const storage = await openPiSessionStore(this.lifecycle.storage);
 	const pi = await _classPrivateFieldGet2(_options, this).harness({
 		storage,
-		context: BG
+		context: BG,
+		onWake: _classPrivateFieldGet2(_onWake, this)
 	});
-	await pi.root(BG, { agent: this.agentDefaults() });
-	pi.resume();
+	try {
+		const closed = pi.closed;
+		pi.subscribeClose(() => onClose(pi, closed));
+		await pi.root(BG, { agent: this.agentDefaults() });
+		pi.resume();
+		await new Promise((resolve) => setTimeout(resolve, 0));
+		if (!_classPrivateFieldGet2(_onWakeWired, this)) console.warn("PiHarness: the harness factory did not pass onWake to Harness.open, so pi's timers keep this Durable Object in memory while a task sleeps. Pass it: harness: ({ storage, context, onWake }) => Harness.open(storage, { ...options, onWake }, context)");
+		await _assertClassBrand(_PiHarness_brand, this, _wakeFor).call(this, pi.wake());
+	} catch (error) {
+		pi.close(BG).catch(() => {});
+		throw error;
+	}
 	return {
 		pi,
 		storage
 	};
 }
+/**
+* pi began closing: on its own, as a storage error makes it, or by
+* `dispose()`.
+*/
+function _piClosing(opening, pi, closed) {
+	_classPrivateFieldGet2(_closing, this).add(pi);
+	_classPrivateFieldGet2(_changed, this)?.call(this);
+	if (_classPrivateFieldGet2(_opening, this) !== opening) return;
+	_classPrivateFieldSet2(_opening, this, void 0);
+	_classPrivateFieldSet2(_lastClose, this, closed);
+}
+/**
+* Tasks pi's restart limit parked, each with the sessions whose work it
+* is: its own, and every session that owns that one, such as the session
+* of a tool that started a subagent.
+*/
+async function _parked(inspection) {
+	const { storage } = await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
+	const parked = [];
+	for (const { record, state } of inspection.tasks) {
+		if (state.kind !== "blocked" || state.reason !== "restart_limit") continue;
+		const sessions = /* @__PURE__ */ new Set();
+		let id = record.conversationId;
+		while (id !== void 0 && !sessions.has(id)) {
+			sessions.add(id);
+			id = (await storage.conversation(id, BG))?.owner?.conversationId;
+		}
+		parked.push({
+			id: record.id,
+			sessions
+		});
+	}
+	return parked;
+}
 async function _findSubmission(id, operationId, context) {
 	const { pi, storage } = await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
 	const record = await storage.submissionByRequest(id, operationId, context);
 	return record ? pi.submission(record.id, context) : void 0;
 }
-/** When pi's current wait is far enough away to hand to the alarm. */
-async function _longWait(pi, id, context) {
-	const live = await pi.snapshot(LiveDoc, id, context);
-	const at = live?.generation?.deferred?.pollAt ?? live?.generation?.retry?.at;
-	return at !== void 0 && at - Date.now() > _classPrivateFieldGet2(_sleepThresholdMs, this) ? at : void 0;
-}
 async function _result(session, operationId, settled, context) {
 	if (settled.status === "unanswered") return {
 		operationId,
@@ -613,6 +541,14 @@ var PiSession = class {
 		await (await _classPrivateFieldGet2(_harness, this).conversation(this.id)).abort(BG);
 		return true;
 	}
+	/**
+	* Run again the tasks pi's crash-loop guard (`settings.restartLimit`)
+	* parked in this session's work, including subagent sessions it owns.
+	* False when nothing was parked.
+	*/
+	retry() {
+		return _classPrivateFieldGet2(_harness, this).retryParked(this.id);
+	}
 	/** Start a new context, optionally from a handoff note. */
 	async reset(handoff) {
 		await (await _classPrivateFieldGet2(_harness, this).conversation(this.id)).reset(handoff, BG);
@@ -692,7 +628,7 @@ function skillsFingerprint(sources) {
 	return sources.map((source) => `${source.id}:${source.fingerprint}`).join("|");
 }
 function textResult(text) {
-	return { content: [{
+	return { output: [{
 		type: "text",
 		text
 	}] };