agents 0.29.0 → 0.30.1

package/dist/harness/pi/index.js

@@ -1,30 +1,12 @@
 import { i as _classPrivateFieldInitSpec, n as _classPrivateFieldSet2, r as _assertClassBrand, t as _classPrivateFieldGet2 } from "../../classPrivateFieldGet2-DZBYAB34.js";
 import { t as _classPrivateMethodInitSpec } from "../../classPrivateMethodInitSpec-qMjJ6sHQ.js";
 import { t as LifecycleCapability } from "../../capability-DBAKc6UZ.js";
-import "../../lifecycle-ClT4DmF2.js";
+import "../../lifecycle-v1rKHV2C.js";
+import { isDurableObjectMemoryLimitReset } from "../../retries.js";
 import { Type } from "@earendil-works/pi-ai";
 import { LiveDoc, ROOT_CONVERSATION_ID, watchEvents } from "@earendil-works/pi-durable";
+import { BACKGROUND_CONTEXT, withAbortSignal } from "@earendil-works/chord/context";
 import { openDurableObjectSqliteStorage } from "@earendil-works/pi-durable/storage/sqlite/cloudflare";
-//#region src/harness/pi/context.ts
-/** chord's `BACKGROUND_CONTEXT`: no values, never cancelled. */
-const BACKGROUND_CONTEXT = Object.freeze({
-	abortSignal: void 0,
-	value: () => void 0,
-	toString: () => "[Context pi-harness background]"
-});
-/**
-* chord's `withAbortSignal`: a context cancelled by either the parent's
-* signal or `signal`, carrying the parent's values.
-*/
-function withAbortSignal(signal, parent) {
-	const abortSignal = parent.abortSignal === void 0 ? signal : AbortSignal.any([parent.abortSignal, signal]);
-	return Object.freeze({
-		abortSignal,
-		value: parent.value.bind(parent),
-		toString: () => `${parent}.WithAbortSignal`
-	});
-}
-//#endregion
 //#region src/harness/pi/session-store.ts
 const DEFAULT_PREFIX = "pi_";
 /** Open pi-durable's storage over this object's SQLite database. */
@@ -39,15 +21,10 @@ const BG = BACKGROUND_CONTEXT;
 /** The root session's id. */
 const ROOT_SESSION = String(ROOT_CONVERSATION_ID);
 /**
-* The three wake timings. They suit a real deployment; only tests change
-* them, with `setWakeTimingForTests`, so a suite does not sit on the real
+* The wake timings. They suit a real deployment; only tests change them,
+* with `setWakeTimingForTests`, so a suite does not sit on the real
 * heartbeat.
 *
-* A pi long wait further away than this is handed to the alarm, so the
-* alarm, not pi's in-memory timer, is what wakes the object.
-*/
-const SLEEP_THRESHOLD_MS = 6e4;
-/**
 * Longest one wake waits on pi. It waits inside an alarm invocation, which
 * has a 15 minute wall-time limit, so a longer run is waited on across
 * several alarms.
@@ -59,13 +36,28 @@ const WAIT_BUDGET_MS = 10 * 6e4;
 * job is still due and its alarm restarts the object.
 */
 const HEARTBEAT_MS = 3e4;
+/**
+* How often a wait re-reads `pi.wake()` when the factory did not pass
+* `onWake`, so nothing tells the harness when it changes.
+*/
+const POLL_MS = 1e3;
+/**
+* The longest a wake job whose dispatch keeps failing waits before it tries
+* again. Its delay starts at the heartbeat and doubles up to this.
+*/
+const MAX_WAKE_BACKOFF_MS = 10 * 6e4;
+/**
+* Wake dispatches that failed in a row. Stored, so the backoff holds across
+* restarts, and outside the job: a push that saved it in the job's payload
+* could overwrite a submit's due-now push.
+*/
+const WAKE_ERRORS_KEY = "pi-harness:wake-errors";
 const WAKE_FN = "wake";
-function wakeJobId(session) {
-	return `pi-wake:${session}`;
-}
-function sessionOfJob(payload) {
-	return typeof payload === "object" && payload !== null && "session" in payload && typeof payload.session === "string" ? payload.session : void 0;
-}
+/**
+* The one wake job. Before Pi 1.4 there was one per session, with ids
+* `pi-wake:<session>`; a left-over one hands over to this one.
+*/
+const WAKE_JOB_ID = "pi-wake";
 /** pi-durable's stored reference to a pi-ai model. */
 function modelRef(model) {
 	return {
@@ -88,13 +80,18 @@ function signalContext(signal) {
 	return signal ? withAbortSignal(signal, BG) : BG;
 }
 var _options = /* @__PURE__ */ new WeakMap();
-var _waits = /* @__PURE__ */ new WeakMap();
+var _waiting = /* @__PURE__ */ new WeakMap();
+var _changed = /* @__PURE__ */ new WeakMap();
 var _admitting = /* @__PURE__ */ new WeakMap();
-var _sleepThresholdMs = /* @__PURE__ */ new WeakMap();
+var _onWakeWired = /* @__PURE__ */ new WeakMap();
 var _waitBudgetMs = /* @__PURE__ */ new WeakMap();
 var _heartbeatMs = /* @__PURE__ */ new WeakMap();
+var _pollMs = /* @__PURE__ */ new WeakMap();
 var _opening = /* @__PURE__ */ new WeakMap();
+var _lastClose = /* @__PURE__ */ new WeakMap();
+var _closing = /* @__PURE__ */ new WeakMap();
 var _PiHarness_brand = /* @__PURE__ */ new WeakSet();
+var _onWake = /* @__PURE__ */ new WeakMap();
 /**
 * pi-durable hosted in a Durable Object, behind a small harness interface:
 * `harness.prompt()`, `harness.sessions`, `harness.session(id)`. How a session reaches a
@@ -107,12 +104,14 @@ var _PiHarness_brand = /* @__PURE__ */ new WeakSet();
 *
 * What pi cannot do on a Durable Object is wake itself: its scheduler runs
 * in memory, and an evicted object has no memory. The harness is that wake,
-* with one Lifecycle job per session. Input goes to pi once, in `submit()`,
-* after the session's job is scheduled. The job waits while pi has live
-* tasks in the session, rescheduling itself as a heartbeat, and completes
-* when there are none. An eviction mid-run leaves the job due, so its alarm
-* restarts the object, pi reopens and resumes its own tasks, and the job
-* waits again.
+* with one Lifecycle job driven by `pi.wake()`. Input goes to pi once, in
+* `submit()`, after the job is scheduled. While pi has work running, the
+* job waits on it, rescheduling itself as a heartbeat. While pi's tasks
+* sleep, the job is due when the first one wakes; pi tells the harness
+* through the `onWake` the factory passes to `Harness.open`. When pi has
+* nothing to do, the job completes. An eviction mid-run leaves the job due,
+* so its alarm restarts the object, pi reopens and resumes its own tasks,
+* and the job waits again.
 *
 * @beta The API may change between releases.
 */
@@ -121,25 +120,54 @@ var PiHarness = class extends LifecycleCapability {
 		super("pi-harness");
 		_classPrivateMethodInitSpec(this, _PiHarness_brand);
 		_classPrivateFieldInitSpec(this, _options, void 0);
-		_classPrivateFieldInitSpec(this, _waits, /* @__PURE__ */ new Map());
-		_classPrivateFieldInitSpec(this, _admitting, /* @__PURE__ */ new Map());
-		_classPrivateFieldInitSpec(this, _sleepThresholdMs, SLEEP_THRESHOLD_MS);
+		_classPrivateFieldInitSpec(this, _waiting, void 0);
+		_classPrivateFieldInitSpec(this, _changed, void 0);
+		_classPrivateFieldInitSpec(this, _admitting, 0);
+		_classPrivateFieldInitSpec(this, _onWakeWired, false);
 		_classPrivateFieldInitSpec(this, _waitBudgetMs, WAIT_BUDGET_MS);
 		_classPrivateFieldInitSpec(this, _heartbeatMs, HEARTBEAT_MS);
+		_classPrivateFieldInitSpec(this, _pollMs, POLL_MS);
 		_classPrivateFieldInitSpec(this, _opening, void 0);
+		_classPrivateFieldInitSpec(this, _lastClose, Promise.resolve());
+		_classPrivateFieldInitSpec(this, _closing, /* @__PURE__ */ new WeakSet());
+		_classPrivateFieldInitSpec(this, _onWake, (wake) => {
+			_classPrivateFieldSet2(_onWakeWired, this, true);
+			_classPrivateFieldGet2(_changed, this)?.call(this);
+			if (_classPrivateFieldGet2(_waiting, this)) return;
+			_assertClassBrand(_PiHarness_brand, this, _wakeFor).call(this, wake).catch((error) => _assertClassBrand(_PiHarness_brand, this, _wakeError).call(this, error));
+		});
 		_classPrivateFieldSet2(_options, this, options);
 		this.sessions = new PiSessions(this);
 	}
 	async onStart(_context) {
-		const { pi } = await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
-		const inspection = await pi.inspect(BG);
-		const sessions = new Set(inspection.tasks.map((task) => String(task.record.conversationId)));
-		for (const session of sessions) await _assertClassBrand(_PiHarness_brand, this, _wake).call(this, session);
+		await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
 	}
 	async onJob(context) {
 		if (context.job.fn !== WAKE_FN) return;
-		const session = sessionOfJob(context.job.payload);
-		if (session !== void 0) return _assertClassBrand(_PiHarness_brand, this, _wakeStep).call(this, session);
+		let outcome;
+		if (context.job.id !== WAKE_JOB_ID) {
+			await _assertClassBrand(_PiHarness_brand, this, _wake).call(this);
+			outcome = void 0;
+		} else outcome = await _assertClassBrand(_PiHarness_brand, this, _wakeStep).call(this);
+		const kv = this.lifecycle.storage.kv;
+		if (kv.get(WAKE_ERRORS_KEY) !== void 0) kv.delete(WAKE_ERRORS_KEY);
+		return outcome;
+	}
+	/**
+	* A wake dispatch that failed through Lifecycle's retries, as when pi
+	* cannot be opened. Lifecycle would complete the job, and pi's work would
+	* never be woken again, so try again later: at the heartbeat, doubling
+	* while the failures continue, up to 10 minutes.
+	*/
+	onJobError(context, error) {
+		if (context.job.fn !== WAKE_FN) return;
+		console.error(`pi wake job "${context.job.id}" failed after ${context.attempt} attempts; retrying with backoff`, error);
+		_assertClassBrand(_PiHarness_brand, this, _wakeError).call(this, error);
+		const kv = this.lifecycle.storage.kv;
+		const errors = (kv.get(WAKE_ERRORS_KEY) ?? 0) + 1;
+		kv.put(WAKE_ERRORS_KEY, errors);
+		const delay = Math.min(_classPrivateFieldGet2(_heartbeatMs, this) * 2 ** (errors - 1), MAX_WAKE_BACKOFF_MS);
+		return { rescheduleAt: Date.now() + delay };
 	}
 	/** Close pi's in-memory resources. Durable state is untouched. */
 	async dispose() {
@@ -163,6 +191,13 @@ var PiHarness = class extends LifecycleCapability {
 	abort(options = {}) {
 		return this.session(options.session).abort(options.operationId);
 	}
+	/**
+	* Run again the tasks pi's crash-loop guard parked in a session's work.
+	* False when nothing was parked.
+	*/
+	retry(options = {}) {
+		return this.session(options.session).retry();
+	}
 	wait(operationId, options = {}) {
 		return this.session(options.session).wait(operationId, options.signal);
 	}
@@ -174,10 +209,12 @@ var PiHarness = class extends LifecycleCapability {
 	async pending(options = {}) {
 		const { pi } = await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
 		const id = options.session === void 0 ? void 0 : conversationId(options.session);
-		return (await pi.inspect(BG)).submissions.filter((record) => record.requestId !== void 0 && (id === void 0 || record.conversationId === id)).map((record) => ({
+		const inspection = await pi.inspect(BG);
+		const parked = await _assertClassBrand(_PiHarness_brand, this, _parked).call(this, inspection);
+		return inspection.submissions.filter((record) => record.requestId !== void 0 && (id === void 0 || record.conversationId === id)).map((record) => ({
 			operationId: record.requestId,
 			session: String(record.conversationId),
-			status: record.status === "queued" ? "queued" : "running"
+			status: record.status === "queued" ? "queued" : parked.some((task) => task.sessions.has(record.conversationId)) ? "parked" : "running"
 		}));
 	}
 	/** The opened pi Harness, for anything the interface does not cover. */
@@ -200,30 +237,33 @@ var PiHarness = class extends LifecycleCapability {
 		const operationId = options.operationId ?? crypto.randomUUID();
 		const { storage } = await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
 		const conversation = await this.conversation(session);
-		_classPrivateFieldGet2(_admitting, this).set(session, (_classPrivateFieldGet2(_admitting, this).get(session) ?? 0) + 1);
-		let accepted;
-		try {
-			await _assertClassBrand(_PiHarness_brand, this, _wake).call(this, session);
-			accepted = await storage.submissionByRequest(conversation.id, operationId, BG) === void 0;
-			await conversation.submit({
-				type: "input",
-				content: input,
-				whenBusy: options.whenBusy ?? "followUp",
-				requestId: operationId,
-				...options.entry ? { entry: options.entry } : {}
-			}, BG);
-		} finally {
-			const left = (_classPrivateFieldGet2(_admitting, this).get(session) ?? 1) - 1;
-			if (left === 0) _classPrivateFieldGet2(_admitting, this).delete(session);
-			else _classPrivateFieldGet2(_admitting, this).set(session, left);
-		}
-		await _assertClassBrand(_PiHarness_brand, this, _wake).call(this, session);
 		return {
 			operationId,
 			session,
-			accepted
+			accepted: await _assertClassBrand(_PiHarness_brand, this, _admit).call(this, async () => {
+				const accepted = await storage.submissionByRequest(conversation.id, operationId, BG) === void 0;
+				await conversation.submit({
+					type: "input",
+					content: input,
+					whenBusy: options.whenBusy ?? "followUp",
+					requestId: operationId,
+					...options.entry ? { entry: options.entry } : {}
+				}, BG);
+				return accepted;
+			})
 		};
 	}
+	/** @internal Run again the tasks pi's restart limit parked in a session. */
+	async retryParked(session) {
+		const { pi } = await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
+		const id = conversationId(session);
+		const parked = (await _assertClassBrand(_PiHarness_brand, this, _parked).call(this, await pi.inspect(BG))).filter((task) => task.sessions.has(id));
+		if (parked.length === 0) return false;
+		await _assertClassBrand(_PiHarness_brand, this, _admit).call(this, async () => {
+			for (const task of parked) await pi.retryTask(task.id, BG);
+		});
+		return true;
+	}
 	/** @internal Withdraw a queued input, or abort the run it joined. */
 	async withdraw(session, operationId) {
 		const { pi, storage } = await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
@@ -256,94 +296,198 @@ var PiHarness = class extends LifecycleCapability {
 		};
 	}
 };
-/** Schedule the session's wake job now, or pull it forward. */
-function _wake(session, time = Date.now()) {
+/**
+* Hand pi work inside the wake. The wake is scheduled first, so if the
+* object dies after pi has the work, that job restarts it; while `hand`
+* is in flight the step will not complete. The wake steps again after, so
+* it sees the work even if it just completed.
+*/
+async function _admit(hand) {
+	var _this$admitting;
+	_classPrivateFieldSet2(_admitting, this, (_this$admitting = _classPrivateFieldGet2(_admitting, this), _this$admitting++, _this$admitting));
+	let result;
+	try {
+		await _assertClassBrand(_PiHarness_brand, this, _wake).call(this);
+		result = await hand();
+	} finally {
+		var _this$admitting3;
+		_classPrivateFieldSet2(_admitting, this, (_this$admitting3 = _classPrivateFieldGet2(_admitting, this), _this$admitting3--, _this$admitting3));
+	}
+	await _assertClassBrand(_PiHarness_brand, this, _wake).call(this);
+	return result;
+}
+/** Schedule the wake job now, or at `time`. */
+function _wake(time = Date.now()) {
 	return this.lifecycle.jobs.push({
-		id: wakeJobId(session),
+		id: WAKE_JOB_ID,
 		fn: WAKE_FN,
 		time,
-		payload: { session },
 		singleflight: true,
 		recoveryLoop: true
 	});
 }
+/** Schedule the wake job for what `pi.wake()` says, if pi needs one. */
+async function _wakeFor(wake) {
+	if (wake.active) await _assertClassBrand(_PiHarness_brand, this, _wake).call(this);
+	else if (wake.at !== void 0) await _assertClassBrand(_PiHarness_brand, this, _wake).call(this, wake.at);
+}
 /**
-* One run of a session's wake job. It never admits or replays anything:
-* it waits while pi has live tasks in the session and completes when it
-* has none. pi does all the work in between.
+* One run of the wake job. It never admits or replays anything: it reads
+* `pi.wake()`, which is all of pi's sessions at once. Running work is
+* waited on; a sleep reschedules the job for when it ends; no work
+* completes the job. pi does all the work in between.
 */
-async function _wakeStep(session) {
+async function _wakeStep() {
 	const heartbeat = { rescheduleAt: Date.now() + _classPrivateFieldGet2(_heartbeatMs, this) };
-	if (_classPrivateFieldGet2(_waits, this).has(session)) return heartbeat;
+	if (_classPrivateFieldGet2(_waiting, this)) return heartbeat;
 	const { pi } = await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
-	const conversation = await pi.conversation(conversationId(session), BG);
-	if (!conversation) return void 0;
-	const tasks = (await pi.inspect(BG)).tasks.filter((task) => task.record.conversationId === conversation.id);
-	if (tasks.length === 0) return _classPrivateFieldGet2(_admitting, this).has(session) ? heartbeat : void 0;
-	const wakeAt = await _assertClassBrand(_PiHarness_brand, this, _longWait).call(this, pi, conversation.id, BG);
-	if (wakeAt !== void 0) return { rescheduleAt: wakeAt };
-	if (tasks.every((task) => task.record.background)) return heartbeat;
-	const wait = _assertClassBrand(_PiHarness_brand, this, _waitForIdle).call(this, conversation).finally(() => {
-		_classPrivateFieldGet2(_waits, this).delete(session);
-		_assertClassBrand(_PiHarness_brand, this, _wake).call(this, session);
-	});
-	_classPrivateFieldGet2(_waits, this).set(session, wait);
-	this.lifecycle.trackAlarmWork(wait);
-	return heartbeat;
+	pi.resume();
+	const wake = pi.wake();
+	if (wake.active) {
+		const wait = _assertClassBrand(_PiHarness_brand, this, _waitWhileActive).call(this, pi).then((ended) => {
+			_classPrivateFieldSet2(_waiting, this, void 0);
+			if (ended) _assertClassBrand(_PiHarness_brand, this, _wake).call(this);
+		}, (error) => {
+			_classPrivateFieldSet2(_waiting, this, void 0);
+			throw error;
+		});
+		_classPrivateFieldSet2(_waiting, this, wait);
+		if (!this.lifecycle.trackAlarmWork(wait)) wait.catch(() => {});
+		return heartbeat;
+	}
+	if (_classPrivateFieldGet2(_admitting, this) > 0) return heartbeat;
+	if (wake.at !== void 0) return { rescheduleAt: wake.at };
 }
-async function _waitForIdle(conversation) {
-	const budget = new AbortController();
-	const timer = setTimeout(() => budget.abort(), _classPrivateFieldGet2(_waitBudgetMs, this));
+/**
+* Wait while pi has work running, up to the wait budget. With `onWake`, a
+* change ends each sleep early, and so does pi closing; without it, the
+* sleep is `pollMs`. A task sleeping beside the running work, such as a
+* retry backoff, also ends the sleep when it is due, and the wait calls
+* `pi.resume()` to run it: with `onWake`, pi arms no timer for it, and
+* the wake job's alarm is not set for it while the job waits. Whether the
+* wait ended, with pi idle or at the budget, rather than failing. Rejects
+* with a memory-limit reset.
+*/
+async function _waitWhileActive(pi) {
+	const deadline = Date.now() + _classPrivateFieldGet2(_waitBudgetMs, this);
 	try {
-		await conversation.waitForIdle(withAbortSignal(budget.signal, BG));
+		let wake = pi.wake();
+		while (wake.active) {
+			const now = Date.now();
+			const left = deadline - now;
+			if (left <= 0) return true;
+			let sleep = _classPrivateFieldGet2(_onWakeWired, this) ? left : Math.min(left, _classPrivateFieldGet2(_pollMs, this));
+			if (wake.at !== void 0) sleep = Math.min(sleep, wake.at - now);
+			await new Promise((resolve) => {
+				const timer = setTimeout(resolve, sleep);
+				_classPrivateFieldSet2(_changed, this, () => {
+					clearTimeout(timer);
+					resolve();
+				});
+			});
+			_classPrivateFieldSet2(_changed, this, void 0);
+			if (wake.at !== void 0 && Date.now() >= wake.at) pi.resume();
+			wake = pi.wake();
+		}
+		return true;
 	} catch (error) {
-		if (!budget.signal.aborted) this.lifecycle.events.emit("pi:wake_error", {
-			session: String(conversation.id),
-			error: error instanceof Error ? error.message : String(error)
-		});
-	} finally {
-		clearTimeout(timer);
+		if (!_classPrivateFieldGet2(_closing, this).has(pi)) _assertClassBrand(_PiHarness_brand, this, _wakeError).call(this, error);
+		if (isDurableObjectMemoryLimitReset(error)) throw error;
+		return false;
 	}
 }
+function _wakeError(error) {
+	this.lifecycle.events.emit("pi:wake_error", { error: error instanceof Error ? error.message : String(error) });
+}
 /**
 * pi, opened. Waits for Lifecycle startup first, so pi is only ever
 * opened inside it: startup holds the input gate (`blockConcurrencyWhile`)
 * and awaits the open in `onStart`, so an open begun before startup would
 * be awaited behind a closed gate, with its timers and I/O held back, and
 * never finish.
+*
+* pi stays open until `dispose()`, or until it closes on its own: any
+* storage error fails pi's Session for good. Then the next call, or the
+* wake job's next step, opens pi again once the failed pi has closed, and
+* pi recovers from what it had committed. Closing waits for running task
+* code to return, so code that ignores its abort signal delays the reopen.
+* An open that fails is not kept either, so the next call tries again.
 */
 async function _open() {
 	await this.lifecycle.ready();
-	_classPrivateFieldGet2(_opening, this) ?? _classPrivateFieldSet2(_opening, this, _assertClassBrand(_PiHarness_brand, this, _doOpen).call(this).catch((error) => {
-		_classPrivateFieldSet2(_opening, this, void 0);
-		throw error;
-	}));
+	if (_classPrivateFieldGet2(_opening, this) === void 0) {
+		const opening = _assertClassBrand(_PiHarness_brand, this, _doOpen).call(this, (pi, closed) => _assertClassBrand(_PiHarness_brand, this, _piClosing).call(this, opening, pi, closed)).catch((error) => {
+			if (_classPrivateFieldGet2(_opening, this) === opening) _classPrivateFieldSet2(_opening, this, void 0);
+			throw error;
+		});
+		_classPrivateFieldSet2(_opening, this, opening);
+	}
 	return _classPrivateFieldGet2(_opening, this);
 }
-async function _doOpen() {
+async function _doOpen(onClose) {
+	await _classPrivateFieldGet2(_lastClose, this);
 	const storage = await openPiSessionStore(this.lifecycle.storage);
 	const pi = await _classPrivateFieldGet2(_options, this).harness({
 		storage,
-		context: BG
+		context: BG,
+		onWake: _classPrivateFieldGet2(_onWake, this)
 	});
-	await pi.root(BG, { agent: this.agentDefaults() });
-	pi.resume();
+	try {
+		const closed = pi.closed;
+		pi.subscribeClose(() => onClose(pi, closed));
+		await pi.root(BG, { agent: this.agentDefaults() });
+		pi.resume();
+		await new Promise((resolve) => setTimeout(resolve, 0));
+		if (!_classPrivateFieldGet2(_onWakeWired, this)) console.warn("PiHarness: the harness factory did not pass onWake to Harness.open, so pi's timers keep this Durable Object in memory while a task sleeps. Pass it: harness: ({ storage, context, onWake }) => Harness.open(storage, { ...options, onWake }, context)");
+		await _assertClassBrand(_PiHarness_brand, this, _wakeFor).call(this, pi.wake());
+	} catch (error) {
+		pi.close(BG).catch(() => {});
+		throw error;
+	}
 	return {
 		pi,
 		storage
 	};
 }
+/**
+* pi began closing: on its own, as a storage error makes it, or by
+* `dispose()`.
+*/
+function _piClosing(opening, pi, closed) {
+	_classPrivateFieldGet2(_closing, this).add(pi);
+	_classPrivateFieldGet2(_changed, this)?.call(this);
+	if (_classPrivateFieldGet2(_opening, this) !== opening) return;
+	_classPrivateFieldSet2(_opening, this, void 0);
+	_classPrivateFieldSet2(_lastClose, this, closed);
+}
+/**
+* Tasks pi's restart limit parked, each with the sessions whose work it
+* is: its own, and every session that owns that one, such as the session
+* of a tool that started a subagent.
+*/
+async function _parked(inspection) {
+	const { storage } = await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
+	const parked = [];
+	for (const { record, state } of inspection.tasks) {
+		if (state.kind !== "blocked" || state.reason !== "restart_limit") continue;
+		const sessions = /* @__PURE__ */ new Set();
+		let id = record.conversationId;
+		while (id !== void 0 && !sessions.has(id)) {
+			sessions.add(id);
+			id = (await storage.conversation(id, BG))?.owner?.conversationId;
+		}
+		parked.push({
+			id: record.id,
+			sessions
+		});
+	}
+	return parked;
+}
 async function _findSubmission(id, operationId, context) {
 	const { pi, storage } = await _assertClassBrand(_PiHarness_brand, this, _open).call(this);
 	const record = await storage.submissionByRequest(id, operationId, context);
 	return record ? pi.submission(record.id, context) : void 0;
 }
-/** When pi's current wait is far enough away to hand to the alarm. */
-async function _longWait(pi, id, context) {
-	const live = await pi.snapshot(LiveDoc, id, context);
-	const at = live?.generation?.deferred?.pollAt ?? live?.generation?.retry?.at;
-	return at !== void 0 && at - Date.now() > _classPrivateFieldGet2(_sleepThresholdMs, this) ? at : void 0;
-}
 async function _result(session, operationId, settled, context) {
 	if (settled.status === "unanswered") return {
 		operationId,
@@ -407,6 +551,14 @@ var PiSession = class {
 		await (await _classPrivateFieldGet2(_harness, this).conversation(this.id)).abort(BG);
 		return true;
 	}
+	/**
+	* Run again the tasks pi's crash-loop guard (`settings.restartLimit`)
+	* parked in this session's work, including subagent sessions it owns.
+	* False when nothing was parked.
+	*/
+	retry() {
+		return _classPrivateFieldGet2(_harness, this).retryParked(this.id);
+	}
 	/** Start a new context, optionally from a handoff note. */
 	async reset(handoff) {
 		await (await _classPrivateFieldGet2(_harness, this).conversation(this.id)).reset(handoff, BG);