libfx 0.0.14-dev.1534.g6afa7c33dac5 → 0.0.14

package/durable.js

@@ -20,6 +20,11 @@
 // the input to the log, takes the lease, and runs every turn the log holds
 // until none is left, or its time runs out: then it asks the queue to
 // deliver the same message again, and the next worker continues the turn.
+//
+// TLA+ models: `tests/tla/sdk/DurableSession.tla` (the log, leases and
+// takeovers), `tests/tla/sdk/AgentRouting.tla` (agent names and routing),
+// and `tests/tla/sdk/DurableSteer.tla` (where each message a user sends is
+// placed). The drivers in `tests/tla/drivers/` run this code along them.
 
 // A write the session's chain refused because another worker continued it.
 // Harnesses recognize it by its code.
@@ -338,7 +343,14 @@ export function foldSessionLog(entries, { now = 0, alive = () => null } = {}) {
   // landed ended. Its id is kept like a turn's, so a late delivery of the
   // same message is not taken as a new cancel.
   for (const input of inputs) {
-    if (input.type !== "cancel" || consumed.has(input.messageId)) continue;
+    if (consumed.has(input.messageId)) continue;
+    // A resume only asks that its session be woken: it is spent once
+    // stored, and its id is kept so its deliveries are known.
+    if (input.type === "resume") {
+      consume(input.messageId);
+      continue;
+    }
+    if (input.type !== "cancel") continue;
     const live = typeof input.target === "string"
       ? !consumed.has(input.target) || openTurn?.id === input.target
       : openTurn !== null && input.cursor > openTurn.at;
@@ -659,6 +671,10 @@ function noAgentNamed(name) {
 // copy of this module in the process.
 const agentsByName = (globalThis[Symbol.for("libfx.durableAgents")] ??= new Map());
 
+// The backend a member opens, or null when it cannot open, as an agent
+// libfx refused to create cannot.
+const openMember = (member) => member.open().catch(() => null);
+
 // The World backend of an agent named `name` in this process whose
 // durability `matches`, the agent's copies in turn, or null.
 async function agentNamed(name, matches) {
@@ -669,8 +685,8 @@ async function agentNamed(name, matches) {
   for (let index = 0; index < members.length; index += 1) {
     const member = members[(first + index) % members.length];
     if (!matches(await member.durability())) continue;
-    const created = await member.open();
-    if (typeof created.deliverHere === "function") return created;
+    const created = await openMember(member);
+    if (typeof created?.deliverHere === "function") return created;
   }
   return null;
 }
@@ -679,30 +695,81 @@ async function agentNamed(name, matches) {
 // one on another durability can hold other sessions.
 const agentSharing = (name, durability) => agentNamed(name, (other) => other === durability);
 
-// A route takes its deployment's deliveries, which every route durability
-// of the same kind in the process shares, such as each `vercel()` an app
-// creates: the agent a message names on this durability, or on another of
-// that kind.
-const agentOnRoute = async (name, durability) => (await agentSharing(name, durability)) ??
-  agentNamed(name, (other) => other !== durability && other.name === durability.name && typeof other.world === "function" && other.create === undefined);
+// The store a World keeps its sessions in, as its queue messages name it:
+// its `store`, which is its name unless the app named the store.
+const worldStore = (durability) => durability?.store ?? durability?.name;
+
+// The store a durability keeps its sessions in, as libfx tells stores apart:
+// a memory() is its own, and a World's is its worldStore(). Two agents of one
+// name on one store are one agent.
+const storeOf = (durability) => (typeof durability?.create === "function" ? durability : `world:${worldStore(durability)}`);
+
+// A route takes its deployment's deliveries for every World in the process,
+// so a delivery goes to the agent its message names on the store it names,
+// and never to one of that name on another store
+// (`tests/tla/sdk/TenantIsolation.tla` RunsInSenderStore).
+const agentOnStore = (name, store) => agentNamed(name, (other) => typeof other.world === "function" && other.create === undefined && worldStore(other) === store);
 
 /**
  * The request handler a deployment mounts for queue deliveries, for every
  * durable agent in the process: each delivery goes to the agent its message
- * names. One route and one queue trigger serve any number of agents.
+ * names, on the store it names. One route and one queue trigger serve any
+ * number of agents.
  */
 export function wakeHandler() {
   return async (request) => {
     for (const group of agentsByName.values()) {
       for (const member of group.members) {
-        const created = await member.open();
-        if (created.viaRoute === true) return created.queueHandler(request);
+        const created = await openMember(member);
+        if (created?.viaRoute === true) return created.queueHandler(request);
       }
     }
     return new Response("no libfx agent in this process takes queue deliveries from a route", { status: 503 });
   };
 }
 
+const nameInUse = (name) => Object.assign(
+  new Error(`an agent named ${JSON.stringify(name)} with another configuration already runs on this store in this process; give each configuration its own name, or each store its own \`store\``),
+  { code: "FX_AGENT_NAME_IN_USE", agent: name },
+);
+
+// Whether two agents' options are one configuration: the same values, and
+// the same functions and objects other than plain ones. `onEvent` only
+// watches the agent, so it is left out.
+function definitionOf(options) {
+  const { onEvent: _onEvent, ...definition } = options;
+  return definition;
+}
+function sameDefinition(a, b, depth = 0) {
+  if (Object.is(a, b)) return true;
+  if (depth > 32 || a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
+  if (ArrayBuffer.isView(a) || ArrayBuffer.isView(b)) {
+    if (!ArrayBuffer.isView(a) || !ArrayBuffer.isView(b) || a.byteLength !== b.byteLength) return false;
+    const left = new Uint8Array(a.buffer, a.byteOffset, a.byteLength);
+    const right = new Uint8Array(b.buffer, b.byteOffset, b.byteLength);
+    for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
+    return true;
+  }
+  const plain = (value) => Array.isArray(value) || Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null;
+  if (!plain(a) || !plain(b) || Array.isArray(a) !== Array.isArray(b)) return false;
+  const keys = Object.keys(a);
+  if (keys.length !== Object.keys(b).length) return false;
+  return keys.every((key) => Object.hasOwn(b, key) && sameDefinition(a[key], b[key], depth + 1));
+}
+
+// Refuses `member` when another agent of `name` on its store has another
+// configuration: deliveries for a name on a store go to any of its agents,
+// so they must be one agent (`tests/tla/sdk/TenantIsolation.tla`
+// RunsOnSenderAgent). Agents created without a durability share their
+// factory's default, so they are on one store even before one of them has
+// learned which store that is.
+const sameStore = (a, b) => a.store === b.store || (a.defaults !== null && a.defaults === b.defaults);
+function claimName(name, member) {
+  for (const other of agentsByName.get(name)?.members ?? []) {
+    if (other !== member && sameStore(other, member) && !sameDefinition(other.definition, member.definition)) throw nameInUse(name);
+  }
+}
+
 // libfx starts and closes a World it `owned`, having created it; a World the
 // app passed in stays the app's.
 function createWorldBackend(world, durability) {
@@ -738,16 +805,19 @@ function createWorldBackend(world, durability) {
     if (result?.redeliver === true) throw new Error("libfx asks the queue to deliver this message again");
     return Number.isFinite(result?.timeoutSeconds) ? { timeoutSeconds: result.timeoutSeconds } : undefined;
   };
+  const store = worldStore(durability);
   // The route a deployment mounts delivers to the agent in this process the
-  // message names, whichever agent's route it is.
+  // message names, on the store it names, whichever agent's route it is. A
+  // message from before stores were named is for this World's store.
   const queueHandler = world.createQueueHandler(queuePrefix, async (message, meta) => {
     const named = agentOf(message?.input);
-    const agent = await agentOnRoute(named, durability);
+    const agent = await agentOnStore(named, typeof message?.input?.store === "string" ? message.input.store : store);
     if (!agent) throw noAgentNamed(named);
     return agent.deliverHere(message, meta);
   });
   const backend = {
     name,
+    store,
     livenessKnown,
     queueLeases,
     // A prompt runs in the request that took it, held by its backstop's
@@ -1129,10 +1199,59 @@ const errorSummary = (error) => ({ name: error?.name ?? "Error", message: String
 // The harness contract: a fenced write rejects with this code.
 const isFenced = (error) => error?.code === "FX_FENCED";
 
-// What a queue message adds to its session's log: a restored agent's first
+// The kinds of message a session's queue carries.
+const messageTypes = new Set(["prompt", "steer", "cancel", "resume"]);
+
+// What the queue carries for a message: only which input of which session
+// it names, for which agent, on which store. A delivery can arrive at a
+// public route, so its body may come from anyone: a worker acts only on a
+// message its session's log already holds, and runs only what that log
+// says (`tests/tla/sdk/TenantIsolation.tla` OnlySentRuns).
+function queuedMessage(message, store) {
+  return {
+    type: message.type,
+    messageId: message.messageId,
+    sessionId: message.sessionId,
+    agent: typeof message.agent === "string" ? message.agent : defaultAgentName,
+    ...(typeof store === "string" ? { store } : {}),
+  };
+}
+
+// The message a delivery names, as queuedMessage() has it, or null for one
+// no sender could have queued on `backend`.
+function deliveredMessage(backend, delivered) {
+  if (!delivered || typeof delivered !== "object" || !messageTypes.has(delivered.type)) return null;
+  if (!validId(delivered.messageId) || !backend.validSessionId(delivered.sessionId)) return null;
+  if (delivered.agent !== undefined && typeof delivered.agent !== "string") return null;
+  return queuedMessage(delivered);
+}
+
+// Whether the session's log holds the input `message` names, or names it
+// among those a turn already took.
+const knownMessage = (state, message) => state.inputKeys.has(`${message.type}:${message.messageId}`) || state.consumed.has(message.messageId);
+
+// The most a durable input may hold: its content blocks with its caller's
+// context and its session object's settings, as JSON. The engine refuses a
+// prompt frame over 8 MiB (`maxPromptFrameBytes` in fx-sdk.js), so a larger
+// input could never run; it is refused before anything is stored.
+const maxInputBytes = 8 * 1024 * 1024;
+const jsonBytes = (value) => (value === undefined ? 0 : encoder.encode(JSON.stringify(value)).byteLength);
+// A JSON value as it stands now, so what libfx measures is what it stores,
+// however the caller changes its object later. Pure.
+const jsonSnapshot = (value) => {
+  const text = JSON.stringify(value);
+  return text === undefined ? undefined : JSON.parse(text);
+};
+const inputTooLarge = (bytes) => Object.assign(
+  new RangeError(`a durable input with its context and settings is ${bytes} bytes; the most is ${maxInputBytes}`),
+  { code: "FX_INPUT_TOO_LARGE", bytes, limit: maxInputBytes },
+);
+
+// What a message adds to its session's log: a restored agent's first
 // checkpoint and the message's input, a prompt with its caller's context and
-// its session object's settings.
-// Nothing the log already holds. Pure.
+// its session object's settings. Only the sender calls it, before it queues
+// the message, so what a turn runs and as whom comes from the app's own
+// call, never from a queue delivery. Nothing the log already holds. Pure.
 function messageEntries(state, message) {
   const entries = [];
   const named = typeof message.agent === "string" ? { agent: message.agent } : {};
@@ -1141,7 +1260,7 @@ function messageEntries(state, message) {
   }
   const key = `${message.type}:${message.messageId}`;
   const known = state.inputKeys.has(key) || state.consumed.has(message.messageId) || idInUse(state, message);
-  if ((message.type === "prompt" || message.type === "steer" || message.type === "cancel") && !known) {
+  if (messageTypes.has(message.type) && !known) {
     entries.push({
       k: "input",
       key,
@@ -1174,9 +1293,9 @@ const messageIdInUse = (message) => Object.assign(
   { code: "FX_MESSAGE_ID_IN_USE" },
 );
 
-// Writes what a queue message adds to its session, in order, and returns how
-// many entries it wrote. The sender and the consumer can both call it. A
-// message that reuses another input's id writes nothing and throws.
+// Writes what a message adds to its session, in order, and returns how many
+// entries it wrote. Only the sender calls it, before it queues the message.
+// A message that reuses another input's id writes nothing and throws.
 async function recordMessage(log, state, message) {
   if (idInUse(state, message)) throw messageIdInUse(message);
   const entries = messageEntries(state, message);
@@ -1259,23 +1378,30 @@ class SessionWorker {
   }
 
   // One queue delivery, `delivery` its message's id and attempt when the
-  // queue reports them. Its input reaches the log at once, even while this
-  // process runs the session, so a steer or cancel reaches the running turn.
-  // Then it runs the session when no live worker holds it. Returns
-  // `{ timeoutSeconds }` to have the same message delivered again later.
+  // queue reports them. Its sender stored its input before queueing it, so a
+  // steer or cancel reaches the running turn even before this runs. A
+  // delivery the session's log does not hold is not from a sender and is
+  // dropped before anything is written, whether or not its session exists
+  // (`tests/tla/sdk/TenantIsolation.tla` OnlySentRuns). Then it runs the
+  // session when no live worker holds it. Returns `{ timeoutSeconds }` to
+  // have the same message delivered again later.
   async consume(message, delivery = null) {
     const log = await this.backend.session(this.sessionId);
+    let entries = await log.read();
+    let state = this.fold(entries, delivery);
+    if (!knownMessage(state, message)) {
+      this.agent.emit("session.refused", { sessionId: this.sessionId, messageId: message.messageId, reason: "unknown message" });
+      return undefined;
+    }
     await this.backend.refreshDeadline?.();
     // When this delivery's function stops, if it does.
     const deadline = this.backend.deadline() ?? (this.backend.maxDurationMs === null ? null : Date.now() + this.backend.maxDurationMs);
-    let entries = await log.read();
-    let state = this.fold(entries, delivery);
-    // A session runs only on the agent it belongs to, which a new one is the
-    // agent that sent its first message. A message that reached another
-    // agent, as one sent to another agent's session does, goes on to it.
+    // A session runs only on the agent it belongs to, the one its first
+    // stored input names. A message that reached another agent, as one sent
+    // to another agent's session does, goes on to it.
     const owner = state.agent ?? agentOf(message);
     if (owner !== this.agent.name) {
-      await this.backend.queue.send({ ...message, agent: owner }, {
+      await this.backend.queue.send(queuedMessage({ ...message, agent: owner }, this.backend.store), {
         idempotencyKey: `${message.sessionId}:${message.type}:${message.messageId}:to:${owner}`,
       });
       this.agent.emit("session.forwarded", { sessionId: this.sessionId, agent: owner });
@@ -1283,26 +1409,13 @@ class SessionWorker {
     }
     for (let claims = 0; claims < 8; claims += 1) {
       // A session with no open turn starts its next prompt at once: the
-      // first model request goes out while the input and the lease are
-      // written, and nothing else is written until both land.
+      // first model request goes out while the lease is written, and
+      // nothing else is written until it lands.
       const early = this.running || state.lease ? null : earlyStart(entries, state, message, (items) => this.fold(items, delivery));
       let outcome;
       if (early) {
         outcome = await this.claim(log, state, deadline, early, delivery);
       } else {
-        let wrote;
-        try {
-          wrote = await recordMessage(log, state, message);
-        } catch (error) {
-          if (error?.code !== "FX_MESSAGE_ID_IN_USE") throw error;
-          // Its sender could not hear it: a durable queue took it first.
-          this.agent.emit("session.error", { sessionId: this.sessionId, error: errorSummary(error) });
-          return undefined;
-        }
-        if (wrote > 0) {
-          entries = await log.read();
-          state = this.fold(entries, delivery);
-        }
         if (this.running) return { timeoutSeconds: runningBackstopSeconds };
         if (!state.hasWork) {
           if (message.type === "resume") await this.answerIdle(log, message);
@@ -1755,7 +1868,11 @@ class SessionWorker {
   // `{ stopped }` when its harness stopped under it, or `{ result }` for a
   // turn that ended, whose end the caller writes.
   async drive(log, harness, turn, messageId, state, ui) {
-    const applied = new Set();
+    // The inputs `state` was folded from are placed already: the fold gave
+    // each a turn, joined it to one, or spent it. The poll applies only the
+    // inputs stored after them. After an early start, that includes this
+    // message's own input, landing past `since`.
+    const applied = new Set(state.inputKeys);
     let since = String(state.maxCursor);
     let polling = false;
     let again = false;
@@ -1770,6 +1887,9 @@ class SessionWorker {
       void Promise.resolve().then(() => turn.endForSteer?.()).catch(() => {});
     };
     const steerTurn = (steer) => {
+      // One id names one input, so a steer with this turn's id is its own
+      // opener or one that reused the id, which the log never runs.
+      if (steer.messageId === messageId) return;
       if (!joinable(steer.input)) endTurn();
       else if (!ending) void turn.steer(steer.input, steer.messageId).catch(() => {});
     };
@@ -2132,10 +2252,12 @@ function turnView({ messageId, resumeRequest = null, start }) {
  * once, or ends with an error when it never started; when its harness stops
  * twice more, even to cancel it, the session runs no more turns.
  *
- * `defaultDurability()` picks the durability when the caller names none,
- * `name` is the factory's name in errors, and `label` the agent's.
+ * `defaultDurability()` picks the durability when the caller names none, and
+ * `defaultShared` says it hands every such agent the same one, as Node's
+ * does, so that agents created without a durability share a store. `name` is
+ * the factory's name in errors, and `label` the agent's.
  */
-export function createDurableAgentFactory({ harness, defaultDurability, name = "createAgent", label = "agent" }) {
+export function createDurableAgentFactory({ harness, defaultDurability, defaultShared = false, name = "createAgent", label = "agent" }) {
   return function createDurableAgent(options = {}) {
     if (!options || typeof options !== "object" || Array.isArray(options)) {
       throw new TypeError(`${name}() options must be an object`);
@@ -2181,10 +2303,29 @@ export function createDurableAgentFactory({ harness, defaultDurability, name = "
       if (closed) return Promise.reject(new Error(`${label} is closed`));
       backendPromise ??= (async () => {
         const chosen = await durabilityOf();
+        // An agent created without a durability learns its store only now.
+        if (member.store !== storeOf(chosen)) {
+          member.store = storeOf(chosen);
+          try {
+            claimName(agentName, member);
+          } catch (error) {
+            leaveGroup(agentsByName, agentName, registered, member);
+            throw error;
+          }
+        }
         chosenDurability = chosen;
         const created = await createBackend(chosen);
         await created.start?.();
-        unlisten = created.listen((message, meta) => receive(created, message, deliveryOf(meta)), agentName);
+        unlisten = created.listen((delivered, meta) => {
+          // Only which input a delivery names is read from it: the rest of
+          // its body, which a forged delivery would choose, is ignored.
+          const message = deliveredMessage(created, delivered);
+          if (!message) {
+            emit("session.refused", { reason: "malformed message" });
+            return undefined;
+          }
+          return receive(created, message, deliveryOf(meta));
+        }, agentName);
         return created;
       })();
       return backendPromise;
@@ -2192,8 +2333,13 @@ export function createDurableAgentFactory({ harness, defaultDurability, name = "
     // The durability the agent's sessions live in, chosen once.
     const durabilityOf = () => (durabilityPromise ??= durability ? Promise.resolve(durability) : defaultDurability());
     // In the process's agents from now, so a route that receives a message
-    // for this agent finds it before anything uses it.
-    const member = { open: backend, durability: durabilityOf };
+    // for this agent finds it before anything uses it. One created without a
+    // durability claims the default's store until it knows which that is:
+    // the store every such agent shares where the factory hands them all one
+    // durability, and a store of its own where each gets its own.
+    const unresolved = defaultShared ? defaultDurability : Symbol("default store");
+    const member = { open: backend, durability: durabilityOf, definition: definitionOf(harnessOptions), store: durability ? storeOf(durability) : unresolved, defaults: durability ? null : unresolved };
+    claimName(agentName, member);
     const registered = joinGroup(agentsByName, agentName, member);
     // One delivery of `message` to the session's worker here: from the
     // queue, with `delivery` naming the queue's message and attempt, or with
@@ -2235,11 +2381,17 @@ export function createDurableAgentFactory({ harness, defaultDurability, name = "
 
     const openSession = (requestedId, sessionOptions = {}) => {
       if (requestedId !== undefined && !validId(requestedId)) throw new TypeError(`session id must be ${idRule}`);
-      const context = sessionOptions?.context;
-      if (context !== undefined) {
-        try { JSON.stringify(context); } catch { throw new TypeError("session context must be JSON"); }
-      }
-      const settings = plugged.settings?.(sessionOptions ?? {});
+      let context;
+      try { context = jsonSnapshot(sessionOptions?.context); } catch { throw new TypeError("session context must be JSON"); }
+      const settings = jsonSnapshot(plugged.settings?.(sessionOptions ?? {}));
+      // What every input this session object sends carries besides itself.
+      const carried = jsonBytes(context) + jsonBytes(settings);
+      // Refuses an input too large to store before anything is stored
+      // (`tests/tla/sdk/TenantIsolation.tla` StoredWithinLimit).
+      const admit = (input) => {
+        const bytes = jsonBytes(input) + carried;
+        if (bytes > maxInputBytes) throw inputTooLarge(bytes);
+      };
       let id = requestedId ?? null;
       let seeded = seed === undefined || requestedId !== undefined;
       const resolved = backend().then((created) => {
@@ -2258,12 +2410,15 @@ export function createDurableAgentFactory({ harness, defaultDurability, name = "
           ...(settings === undefined ? {} : { settings }),
         };
         const full = { ...message, ...extra, agent: agentName, sessionId };
-        // A queue that ends with the process could lose the message, so its
-        // input reaches the log before the caller hears it was accepted.
-        if (!created.queueDurable) {
-          const log = await created.session(sessionId);
-          await recordMessage(log, foldSessionLog(await log.read()), full);
-        }
+        // The input and its caller's context reach the log here, on the
+        // app's own call, before the caller hears it was accepted. The queue
+        // carries only which input to run, so a delivery cannot choose what
+        // a turn runs or as whom (`tests/tla/sdk/TenantIsolation.tla`
+        // OnlySentRuns), and a queue that ends with the process loses no
+        // input.
+        const log = await created.session(sessionId);
+        await recordMessage(log, foldSessionLog(await log.read()), full);
+        const queued = queuedMessage(full, created.store);
         const idempotencyKey = `${sessionId}:${message.type}:${message.messageId}`;
         if (inRequest && created.runInRequest) {
           await created.refreshDeadline?.();
@@ -2275,16 +2430,16 @@ export function createDurableAgentFactory({ harness, defaultDurability, name = "
             // if the request died, the backstop takes the session over and
             // continues the turn.
             const delaySeconds = Math.ceil(Math.max(0, deadline - Date.now()) / 1000) + inlineBackstopMarginSeconds;
-            const { messageId: backstop } = await created.queue.send(full, { idempotencyKey, delaySeconds }) ?? {};
+            const { messageId: backstop } = await created.queue.send(queued, { idempotencyKey, delaySeconds }) ?? {};
             seeded = true;
             const delivery = backstop ? { messageId: backstop, attempt: 0 } : null;
             // receive() reports a failure to the host; the backstop retries it.
-            const work = receive(created, full, delivery, { inRequest: true }).then(() => {}, () => {});
+            const work = receive(created, queued, delivery, { inRequest: true }).then(() => {}, () => {});
             created.waitUntil?.(work);
             return;
           }
         }
-        await created.queue.send(full, { idempotencyKey });
+        await created.queue.send(queued, { idempotencyKey });
         seeded = true;
       };
       const startTurn = (type, messageId, input, retried = false, aborted = false) => {
@@ -2369,6 +2524,7 @@ export function createDurableAgentFactory({ harness, defaultDurability, name = "
           if (Array.isArray(input) && input.some((block) => block?.type === "image" && block.data !== undefined && typeof block.data !== "string")) {
             throw new TypeError("a durable prompt carries image data as a base64 string");
           }
+          admit(input);
           const signal = promptOptions.signal;
           if (signal !== undefined && typeof signal?.addEventListener !== "function") throw new TypeError("prompt signal must be an AbortSignal");
           const turn = startTurn("prompt", messageId, input, promptOptions.messageId !== undefined, signal?.aborted === true);
@@ -2476,6 +2632,7 @@ export function createDurableAgentFactory({ harness, defaultDurability, name = "
           if (steerOptions === null || typeof steerOptions !== "object") throw new TypeError("steer options must be an object");
           const messageId = steerOptions.messageId ?? newId("str");
           if (!validId(messageId)) throw new TypeError(`messageId must be ${idRule}`);
+          admit(input);
           await send({ type: "steer", messageId, input });
           return { messageId };
         },
@@ -2516,7 +2673,11 @@ export function createDurableAgentFactory({ harness, defaultDurability, name = "
         // Waits for what a session's running turn has written so far.
         settled: async (sessionId) => { await workers.get(sessionId)?.settled?.(); },
         // Delivers a queue message to this agent as its queue would.
-        deliver: async (message, delivery) => receive(await backend(), message, delivery),
+        deliver: async (delivered, delivery) => {
+          const created = await backend();
+          const message = deliveredMessage(created, delivered);
+          return message ? receive(created, message, delivery) : undefined;
+        },
         liveWorkers: () => workers.size,
         // A session's log as one worker holds it, with its own view of the
         // chain.