libfx 0.0.15 → 0.0.17

package/durable/world.mjs

@@ -1 +1,4 @@
 var c=Symbol.for("libfx.durability");function T(r,f={}){let u=typeof r==="function";if(!u&&!(r&&typeof r==="object"))throw TypeError("world() takes a World or a function that creates one");if(!f||typeof f!=="object"||Array.isArray(f))throw TypeError("world() options must be an object");let{name:e="world",store:d=e,livenessKnown:l=!1,queueLeases:s=!1,runInRequest:w=s,waitUntil:y,queueDurable:h=!1,pollMs:t,leaseMs:o,maxDurationMs:b,reserveMs:p,alive:a,holderInfo:m,gatewayKey:g}=f;if(typeof e!=="string"||e.length===0)throw TypeError("world() name must be a non-empty string");if(typeof d!=="string"||d.length===0)throw TypeError(`${e}() store must be a non-empty string`);for(let[i,n]of Object.entries({livenessKnown:l,queueLeases:s,runInRequest:w,queueDurable:h}))if(typeof n!=="boolean")throw TypeError(`${e}() ${i} must be a boolean`);if(t!==void 0&&!(Number.isSafeInteger(t)&&t>0))throw TypeError(`${e}() pollMs must be a positive integer`);if(o!==void 0&&!(Number.isSafeInteger(o)&&o>=1000))throw TypeError(`${e}() leaseMs must be an integer of at least 1000`);for(let[i,n]of Object.entries({maxDurationMs:b,reserveMs:p}))if(n!==void 0&&!(Number.isSafeInteger(n)&&n>=0))throw TypeError(`${e}() ${i} must be a non-negative integer`);for(let[i,n]of Object.entries({alive:a,holderInfo:m,gatewayKey:g,waitUntil:y}))if(n!==void 0&&typeof n!=="function")throw TypeError(`${e}() ${i} must be a function`);if(l&&!a)throw TypeError(`${e}() livenessKnown needs alive()`);if(w&&!s)throw TypeError(`${e}() runInRequest needs queueLeases`);return{[c]:!0,name:e,store:d,world:u?r:()=>r,owned:u,livenessKnown:l,queueLeases:s,runInRequest:w,queueDurable:h,...t===void 0?{}:{pollMs:t},...o===void 0?{}:{leaseMs:o},...b===void 0?{}:{maxDurationMs:b},...p===void 0?{}:{reserveMs:p},...a===void 0?{}:{alive:a},...m===void 0?{}:{holderInfo:m},...g===void 0?{}:{gatewayKey:g},...y===void 0?{}:{waitUntil:y}}}export{T as world};
+
+//# debugId=B929A0E4F469F75F64756E2164756E21
+//# sourceMappingURL=world.mjs.map

package/durable/world.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["world.mjs"],"mappings":"AAIA,IAAM,EAAgB,OAAO,IAAI,kBAAkB,EAwC5C,SAAS,CAAK,CAAC,EAAQ,EAAU,CAAC,EAAG,CAC1C,IAAM,EAAQ,OAAO,IAAW,WAChC,GAAI,CAAC,GAAS,EAAE,GAAU,OAAO,IAAW,UAAW,MAAU,UAAU,sDAAsD,EACjI,GAAI,CAAC,GAAW,OAAO,IAAY,UAAY,MAAM,QAAQ,CAAO,EAAG,MAAU,UAAU,mCAAmC,EAC9H,IAAQ,OAAO,QAAS,QAAQ,EAAM,gBAAgB,GAAO,cAAc,GAAO,eAAe,EAAa,YAAW,eAAe,GAAO,SAAQ,UAAS,gBAAe,YAAW,QAAO,aAAY,cAAe,EAC5N,GAAI,OAAO,IAAS,UAAY,EAAK,SAAW,EAAG,MAAU,UAAU,yCAAyC,EAChH,GAAI,OAAO,IAAU,UAAY,EAAM,SAAW,EAAG,MAAU,UAAU,GAAG,sCAAyC,EACrH,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAE,gBAAe,cAAa,eAAc,cAAa,CAAC,EAClG,GAAI,OAAO,IAAU,UAAW,MAAU,UAAU,GAAG,OAAU,qBAAuB,EAE1F,GAAI,IAAW,QAAa,EAAE,OAAO,cAAc,CAAM,GAAK,EAAS,GAAI,MAAU,UAAU,GAAG,uCAA0C,EAE5I,GAAI,IAAY,QAAa,EAAE,OAAO,cAAc,CAAO,GAAK,GAAW,MAAO,MAAU,UAAU,GAAG,iDAAoD,EAC7J,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAE,gBAAe,WAAU,CAAC,EACpE,GAAI,IAAU,QAAa,EAAE,OAAO,cAAc,CAAK,GAAK,GAAS,GAAI,MAAU,UAAU,GAAG,OAAU,kCAAoC,EAEhJ,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAE,QAAO,aAAY,aAAY,WAAU,CAAC,EACpF,GAAI,IAAU,QAAa,OAAO,IAAU,WAAY,MAAU,UAAU,GAAG,OAAU,sBAAwB,EAEnH,GAAI,GAAiB,CAAC,EAAO,MAAU,UAAU,GAAG,iCAAoC,EAGxF,GAAI,GAAgB,CAAC,EAAa,MAAU,UAAU,GAAG,oCAAuC,EAChG,MAAO,EACJ,GAAgB,GACjB,OACA,QACA,MAAO,EAAQ,EAAS,IAAM,EAC9B,QACA,gBACA,cACA,eACA,kBACI,IAAW,OAAY,CAAC,EAAI,CAAE,QAAO,KACrC,IAAY,OAAY,CAAC,EAAI,CAAE,SAAQ,KACvC,IAAkB,OAAY,CAAC,EAAI,CAAE,eAAc,KACnD,IAAc,OAAY,CAAC,EAAI,CAAE,WAAU,KAC3C,IAAU,OAAY,CAAC,EAAI,CAAE,OAAM,KACnC,IAAe,OAAY,CAAC,EAAI,CAAE,YAAW,KAC7C,IAAe,OAAY,CAAC,EAAI,CAAE,YAAW,KAC7C,IAAc,OAAY,CAAC,EAAI,CAAE,WAAU,CACjD","debugId":"B929A0E4F469F75F64756E2164756E21","names":[]}

package/durable.js

@@ -747,6 +747,11 @@ function slotOf(event) {
   return Number(match[1]);
 }
 
+// The slot of the event a write returned, or NaN when the World returned none.
+function slotWritten(result) {
+  return Number(eventIdPattern.exec(String(result?.event?.eventId ?? ""))?.[1]);
+}
+
 function logEntryOf(event) {
   if (event?.eventType !== "step_created" || event.eventData?.stepName !== logStep) return null;
   const input = event.eventData.input;
@@ -766,6 +771,7 @@ const missingStreamFastMs = 2000;
 // may hold together, least recently read dropped first.
 const maxLogViews = 32;
 const maxLogViewChars = 32 * 1024 * 1024;
+const maxMintedIds = 1024;
 
 // Whether a newest-first listing showed every slot from the lowest it
 // listed to the newest. Pure.
@@ -1098,24 +1104,41 @@ function createWorldBackend(world, durability) {
         }
         return pending;
       };
+      // The newest slot the last read() returned every entry through, or
+      // null when that read could not show it had them all: 0 when it listed
+      // nothing, as for a run not created yet.
+      let covered = null;
+      // The run's creation events hold no entry, so a read that showed every
+      // entry through the slot before one still does through it.
+      const passOver = (slot) => {
+        if (covered !== null && slot === covered + 1) covered = slot;
+      };
+      // Resolves true when this call's own `run_created` made the run: the
+      // World creates a run only when none exists (a second one is refused,
+      // 409), and its first event takes the first slot. A run that did not
+      // exist held no event and no stream.
       const createRun = async () => {
+        let made = false;
         try {
           const deploymentId = typeof world.getDeploymentId === "function" ? await world.getDeploymentId() : "libfx";
-          await world.events.create(runId, {
+          const slot = slotWritten(await world.events.create(runId, {
             eventType: "run_created",
             ...spec,
             eventData: { deploymentId, workflowName: "libfx/session", input: encoder.encode("{}") },
-          });
+          }));
+          made = slot === firstEventSlot;
+          passOver(slot);
         } catch (error) {
           // Another worker created it first.
           if (!/exist|conflict|409|already/i.test(String(error?.message ?? "")) && error?.status !== 409) throw error;
         }
         try {
-          await world.events.create(runId, { eventType: "run_started", ...spec });
+          passOver(slotWritten(await world.events.create(runId, { eventType: "run_started", ...spec })));
         } catch (error) {
           if (!/exist|conflict|409|already|started|status/i.test(String(error?.message ?? "")) && error?.status !== 409) throw error;
         }
         created.add(runId);
+        return made;
       };
       // Events newest first, down to and excluding slot `stopBelow`.
       const newestFirst = async (stopBelow, stopAtCheckpoint) => {
@@ -1175,9 +1198,6 @@ function createWorldBackend(world, durability) {
           cursor = page.cursor;
         }
       };
-      // The newest slot the last read() returned every entry through, or
-      // null when that read could not show it had them all.
-      let covered = null;
       const fullRead = async () => {
         const read = await newestFirst(0, true);
         const entries = read.events.reverse();
@@ -1191,12 +1211,31 @@ function createWorldBackend(world, durability) {
           covered = read.newest;
         } else {
           forgetView(runId);
-          covered = null;
+          covered = read.missing || read.listed === 0 ? 0 : null;
         }
         return entries;
       };
       return {
         newest: () => covered,
+        // Creates the run, as its first append would, and resolves true only
+        // when this call's own write made it: the log was then empty and its
+        // stream had no line, as a read just before the write would have
+        // shown, so the sender need not read either. False, without writing,
+        // when this process already created the run or is creating it; false,
+        // after the same writes, when the run existed or the World cannot show
+        // which. The caller then reads as before.
+        async fresh() {
+          if (created.has(runId) || creating.has(runId)) return false;
+          // As a read that found no run leaves it, so the creation events
+          // this write lands pass it over. Of a run it did not make, this
+          // object knows nothing; the caller then reads it.
+          covered = 0;
+          const made = await ensureRun();
+          if (!made) covered = null;
+          // As a read that found no run notes it.
+          if (made) noteSnapshot({ seq: 0, seqInBand: inBandAtRunCreation }, "null");
+          return made;
+        },
         async read() {
           const view = viewOf(runId);
           if (!view) return fullRead();
@@ -1596,7 +1635,9 @@ async function recordMessage(log, state, message) {
  * The log a sender read and then extended with its own entries, as the
  * worker it starts in the same request may use it instead of reading the
  * log again. Only when the sender's read showed every entry through slot
- * `newestSeen`, and every entry the sender then wrote took the next slot:
+ * `newestSeen` (for a run it found missing, the run's creation events it
+ * then saw land hold none), and every entry the sender then wrote took the
+ * next slot:
  * then nothing landed in between, so the view holds every input that comes
  * before this message's. The sender's entries go on as the JSON the World
  * stored, not as the objects it wrote. Null otherwise. Pure.
@@ -1673,9 +1714,22 @@ class SessionWorker {
     this.sessionId = sessionId;
     // Set while this process runs the session; each run holds its own lease.
     this.running = false;
-    // Deliveries in progress for the session in this process.
+    // How many claims this worker has started. A read taken at a lower count
+    // may predate a turn that took the inputs it shows pending.
+    this.claimsStarted = 0;
+    // Deliveries in progress for the session in this process, and senders
+    // about to hand one a read (see consume).
     this.deliveries = 0;
     this.holder = null;
+    // A write-free early claim can give way to a backed delivery. Once its
+    // backstop succeeds, it is a normal claim and cannot be displaced here.
+    this.opening = null;
+  }
+
+  // Taken just before a read of the log, for consume to tell whether a turn
+  // ran here since: the claims started, or null while one runs.
+  mark() {
+    return this.running ? null : this.claimsStarted;
   }
 
   // The log folded as `delivery` judges whether a lease's holder lives.
@@ -1693,15 +1747,37 @@ class SessionWorker {
   // have the same message delivered again later.
   // `handoff` is the sender's own session object and the log it read and
   // extended, when the request that took the prompt runs it (see
-  // handoffEntries); the worker starts from them instead of reading again.
-  async consume(message, delivery = null, handoff = null) {
+  // handoffEntries), with `seen`, what mark() said before that read; the
+  // worker starts from them instead of reading again.
+  // `backstop`, from that request too, is its backstop's send still in
+  // flight, which settles with `delivery`. Until it does, the worker goes on
+  // only to an early start, which writes nothing before it (see claim). A
+  // send that failed ends the delivery; its sender fails the prompt.
+  async consume(message, delivery = null, handoff = null, backstop = null) {
     const log = handoff?.log ?? await this.backend.session(this.sessionId);
+    // The claims this worker had started when the read began, or null when
+    // one was running then, whose writes it may not show.
+    let seen = handoff ? handoff.seen : this.mark();
     let entries = handoff?.entries ?? await log.read();
     let state = this.fold(entries, delivery);
     if (!knownMessage(state, message)) {
       this.agent.emit("session.refused", { sessionId: this.sessionId, messageId: message.messageId, reason: "unknown message" });
       return undefined;
     }
+    // Folded again with the backstop's delivery, which can only end a lease
+    // that stood without it (see redelivers).
+    const awaitBackstop = async () => {
+      if (!backstop) return true;
+      try {
+        delivery = await backstop;
+      } catch {
+        return false;
+      } finally {
+        backstop = null;
+      }
+      state = this.fold(entries, delivery);
+      return true;
+    };
     await this.backend.refreshDeadline?.();
     // When this delivery's function stops, if it does.
     const deadline = this.backend.deadline() ?? (this.backend.maxDurationMs === null ? null : Date.now() + this.backend.maxDurationMs);
@@ -1710,20 +1786,48 @@ class SessionWorker {
     // to another agent's session does, goes on to it.
     const owner = state.agent ?? agentOf(message);
     if (owner !== this.agent.name) {
+      if (!(await awaitBackstop())) return undefined;
       await this.backend.queue.send(queuedMessage({ ...message, agent: owner }, this.backend.store), {
         idempotencyKey: `${message.sessionId}:${message.type}:${message.messageId}:to:${owner}`,
       });
       this.agent.emit("session.forwarded", { sessionId: this.sessionId, agent: owner });
       return undefined;
     }
+    // A turn this worker ran since the read may have run this message,
+    // which the read still shows pending; starting from it would send the
+    // turn's model request twice. A turn still running answers below.
+    const caughtUp = async () => {
+      while (!this.running && seen !== this.claimsStarted) {
+        seen = this.claimsStarted;
+        entries = await log.read();
+        state = this.fold(entries, delivery);
+      }
+    };
     for (let claims = 0; claims < 8; claims += 1) {
+      await caughtUp();
       // A session with no open turn starts its next prompt at once: the
       // first model request goes out while the lease is written, and
       // nothing else is written until it lands.
-      const early = this.running || state.lease ? null : earlyStart(entries, state, message, (items) => this.fold(items, delivery));
+      const startable = () => (this.running || state.lease ? null : earlyStart(entries, state, message, (items) => this.fold(items, delivery)));
+      let early = startable();
+      if (!early) {
+        if (!(await awaitBackstop())) return undefined;
+        // Only a write-free opener may be displaced. Never await a live
+        // claim here: its run/turn may be waiting for this delivery's steer.
+        const opening = this.opening;
+        if (opening) {
+          opening.stop();
+          await opening.stopped;
+        }
+        // Fold the durable log again after displacement: this delivery's
+        // backstop can recover earlier stored inputs too, in log order.
+        await caughtUp();
+        early = startable();
+      }
       let outcome;
       if (early) {
-        outcome = await this.claim(log, state, deadline, early, delivery);
+        outcome = await this.claim(log, state, deadline, early, delivery, backstop);
+        if (!(await awaitBackstop())) return undefined;
       } else {
         if (this.running) return { timeoutSeconds: runningBackstopSeconds };
         if (!state.hasWork) {
@@ -1752,6 +1856,7 @@ class SessionWorker {
       }
       // The turns ran, or another worker's write came before this claim:
       // read the log again.
+      seen = this.mark();
       entries = await log.read();
       state = this.fold(entries, delivery);
     }
@@ -1762,12 +1867,16 @@ class SessionWorker {
   // the chain there, and runs it. With `early`, what `earlyStart` returned,
   // the message's input is written with the lease and the next turn starts
   // before either lands. The lease names `delivery`, so a later delivery of
-  // the same message can tell it lost its holder. Returns what run()
-  // returns, or "refused" when another worker's write came before the claim.
-  async claim(log, state, deadline, early, delivery = null) {
+  // the same message can tell it lost its holder. With `backstop`, the send
+  // that names that delivery, still in flight: every write waits for it, so
+  // the lease names it, and the engine opens meanwhile. Returns what run()
+  // returns, "refused" when another worker's write came before the claim,
+  // or "unqueued" when the backstop failed or the write-free opener gave way.
+  async claim(log, state, deadline, early, delivery = null, backstop = null) {
     // Claimed before the first await, so a delivery that arrives meanwhile
     // sees the session running here.
     this.running = true;
+    this.claimsStarted += 1;
     this.holder = newId("wkr");
     const lease = {
       k: "lease",
@@ -1779,11 +1888,29 @@ class SessionWorker {
       ...(delivery ? { delivery } : {}),
     };
     this.backend.holding(this.holder, true);
+    let unqueued = false;
+    let opening = null;
+    let stopped;
+    let displaced = false;
+    const revoked = backstop ? new Error("early opener displaced by a backed delivery") : null;
+    const giveWay = backstop ? new Promise((_, reject) => {
+      opening = {
+        stopped: new Promise((resolve) => { stopped = resolve; }),
+        stop: () => { displaced = true; reject(revoked); },
+      };
+      this.opening = opening;
+    }) : null;
+    const sent = backstop ? Promise.race([backstop, giveWay]).then((delivered) => {
+      if (displaced) throw revoked;
+      this.opening = null;
+      if (delivered) lease.delivery = delivered;
+    }) : null;
+    void sent?.catch(() => { unqueued = true; });
     try {
       // Both writes go out at once and neither waits for the other; the
       // claim settles once both have, with the lease's cursor if it landed
-      // and the first failure.
-      const writes = [log.append(lease), ...(early?.writes ?? []).map((entry) => log.append(entry))];
+      // and the first failure. A failed backstop fails both unmade.
+      const writes = [lease, ...(early?.writes ?? [])].map((entry) => (sent ? sent.then(() => log.append(entry)) : log.append(entry)));
       const claimed = Promise.allSettled(writes).then(async ([leased, ...rest]) => {
         const head = leased.status === "fulfilled" ? leased.value : null;
         const error = leased.status === "rejected" ? leased.reason : rest.find((item) => item.status === "rejected")?.reason ?? null;
@@ -1802,7 +1929,7 @@ class SessionWorker {
       });
       let outcome;
       try {
-        outcome = await this.run(log, claimed, lease, deadline, early?.state ?? null);
+        outcome = await this.run(log, claimed, lease, deadline, early?.state ?? null, sent?.then(() => true, () => false));
       } catch (error) {
         if ((await claimed).error === null) throw error;
       }
@@ -1812,14 +1939,17 @@ class SessionWorker {
       // wrote nothing and showed nothing. A fenced one leaves the delivery
       // to read the log and try again; after any other failure the same
       // message runs the session again shortly, once a lease that landed is
-      // let go.
+      // let go. One whose backstop failed is its sender's to report.
       if (isFenced(settled.error)) return "refused";
+      if (unqueued) return "unqueued";
       this.agent.emit("session.error", { sessionId: this.sessionId, error: errorSummary(settled.error) });
       if (settled.head !== null) await log.append({ k: "release", a: settled.head, holder: this.holder }).catch(() => {});
       return "failed";
     } finally {
       this.backend.holding(this.holder, false);
       this.running = false;
+      if (this.opening === opening) this.opening = null;
+      stopped?.();
     }
   }
 
@@ -1835,8 +1965,9 @@ class SessionWorker {
   // over. With `early`, the state the session was read in, the first turn
   // starts before the claim lands: every write waits for it, and once it
   // failed nothing more is written and the turn stops. The caller answers
-  // for a claim that failed.
-  async run(raw, claimed, lease, deadline, early) {
+  // for a claim that failed. `backstopSent`, when given, resolves whether
+  // the backstop the lease names was sent without displacing this opener.
+  async run(raw, claimed, lease, deadline, early, backstopSent = null) {
     const agent = this.agent;
     let head = null;
     let failed = null;
@@ -2009,7 +2140,16 @@ class SessionWorker {
         // What the turn it runs first runs with: the open turn's context and
         // settings, or the next prompt's.
         harnessRun = runOf(state.openTurn ?? state.pending[0]);
-        harness = await agent.openHarness(this.sessionId, store, harnessRun, ready);
+        const opening = agent.openHarness(this.sessionId, store, harnessRun, ready);
+        // A failed backstop does not wait out a slow open: its sender fails
+        // the prompt once this worker stops. The late engine closes in the
+        // background, and the agent's close() waits for it.
+        if (backstopSent && !(await Promise.race([backstopSent, opening.then(() => true, () => true)]))) {
+          agent.track(opening.then((late) => late.close()).catch(() => {}));
+          await ready;
+          return broken();
+        }
+        harness = await opening;
       } catch (error) {
         // The image store failed to answer while the engine read the
         // session's images: as when the log can't be read, the delivery
@@ -2026,6 +2166,14 @@ class SessionWorker {
         agent.emit("session.error", { sessionId: this.sessionId, error: errorSummary(error) });
         return "done";
       }
+      // The opener is inert until its own backstop succeeds. A displaced
+      // opener closes without taking a turn or writing anything.
+      if (backstopSent && !(await backstopSent)) {
+        agent.track(harness.close().catch(() => {}));
+        harness = null;
+        await ready;
+        return broken();
+      }
       const yieldAt = deadline === null ? undefined : Math.max(1, deadline - this.backend.reserveMs);
       for (;;) {
         if (failed) return broken();
@@ -2645,6 +2793,15 @@ export function createDurableAgentFactory({ harness, defaultDurability, defaultS
     let closed = false;
     const workers = new Map();
     const active = new Set();
+    // Session ids this process minted whose first prompt has not yet tried
+    // to create their run, newest kept. Only a hint that the run may not
+    // exist: whether it did is what that prompt's own write shows.
+    const minted = new Set();
+    const mint = (id) => {
+      minted.add(id);
+      if (minted.size > maxMintedIds) minted.delete(minted.values().next().value);
+      return id;
+    };
     const backend = () => {
       if (closed) return Promise.reject(new Error(`${label} is closed`));
       backendPromise ??= (async () => {
@@ -2687,17 +2844,27 @@ export function createDurableAgentFactory({ harness, defaultDurability, defaultS
     const member = { open: backend, durability: durabilityOf, definition: definitionOf(harnessOptions), store: durability ? storeOf(durability) : unresolved, defaults: durability ? null : unresolved };
     claimName(agentName, member);
     const registered = joinGroup(agentsByName, agentName, member);
-    // One delivery of `message` to the session's worker here: from the
-    // queue, with `delivery` naming the queue's message and attempt, or with
-    // `inRequest` from the request that took the prompt.
-    const receive = (created, message, delivery, { inRequest = false, handoff = null } = {}) => {
-      let worker = workers.get(message.sessionId);
+    // The session's worker here, kept until as many letGo() calls.
+    const hold = (created, sessionId) => {
+      let worker = workers.get(sessionId);
       if (!worker) {
-        worker = new SessionWorker(agent, created, message.sessionId);
-        workers.set(message.sessionId, worker);
+        worker = new SessionWorker(agent, created, sessionId);
+        workers.set(sessionId, worker);
       }
       worker.deliveries += 1;
-      let work = worker.consume(message, delivery, handoff);
+      return worker;
+    };
+    const letGo = (worker, sessionId) => {
+      worker.deliveries -= 1;
+      // A worker lives while a delivery runs it.
+      if (worker.deliveries === 0 && !worker.running && workers.get(sessionId) === worker) workers.delete(sessionId);
+    };
+    // One delivery of `message` to the session's worker here: from the
+    // queue, with `delivery` naming the queue's message and attempt, or with
+    // `inRequest` from the request that took the prompt.
+    const receive = (created, message, delivery, { inRequest = false, handoff = null, backstop = null } = {}) => {
+      const worker = hold(created, message.sessionId);
+      let work = worker.consume(message, delivery, handoff, backstop);
       if (inRequest) {
         // No queue delivered this message, so none delivers it again: a turn
         // that must go on later continues in a fresh message. One whose
@@ -2718,9 +2885,7 @@ export function createDurableAgentFactory({ harness, defaultDurability, defaultS
         emit("session.error", { sessionId: message.sessionId, error: errorSummary(error) });
       }).finally(() => {
         active.delete(work);
-        worker.deliveries -= 1;
-        // A worker lives while a delivery runs it.
-        if (worker.deliveries === 0 && !worker.running && workers.get(message.sessionId) === worker) workers.delete(message.sessionId);
+        letGo(worker, message.sessionId);
       });
       return work;
     };
@@ -2741,14 +2906,17 @@ export function createDurableAgentFactory({ harness, defaultDurability, defaultS
       let id = requestedId ?? null;
       let seeded = seed === undefined || requestedId !== undefined;
       const resolved = backend().then((created) => {
-        id ??= created.newSessionId();
+        id ??= mint(created.newSessionId());
         if (!created.validSessionId(id)) throw new TypeError(`${created.name} durability cannot hold session id ${JSON.stringify(id)}`);
         return { created, id };
       });
       void resolved.catch(() => {});
       // With `inRequest`, a prompt runs here, in the request that took it,
       // where the durability allows (see `runInRequest`).
-      const send = async (message, { inRequest = false } = {}) => {
+      // `fresh` is the log whose own write just created the session's run, so
+      // the log is empty without reading it. That object, not a new one, goes
+      // on: it holds what the creation showed of the log.
+      const send = async (message, { inRequest = false, fresh = null } = {}) => {
         const { created, id: sessionId } = await resolved;
         const extra = {
           ...(seeded ? {} : { seed }),
@@ -2762,35 +2930,64 @@ export function createDurableAgentFactory({ harness, defaultDurability, defaultS
         // a turn runs or as whom (`tests/tla/sdk/TenantIsolation.tla`
         // OnlySentRuns), and a queue that ends with the process loses no
         // input.
-        const log = await created.session(sessionId);
-        const read = await log.read();
-        const newestSeen = log.newest?.();
-        const appended = await recordMessage(log, foldSessionLog(read), full);
-        const queued = queuedMessage(full, created.store);
-        const idempotencyKey = `${sessionId}:${message.type}:${message.messageId}`;
-        if (inRequest && created.runInRequest) {
-          await created.refreshDeadline?.();
-          const deadline = deliveryDeadline(created);
-          if (deadline !== null) {
-            // This request runs the turn, and the queue keeps the message as
-            // a backstop it delivers only after the request's deadline, by
-            // when the request has stopped. The lease names the backstop, so
-            // if the request died, the backstop takes the session over and
-            // continues the turn.
-            const delaySeconds = Math.ceil(Math.max(0, deadline - Date.now()) / 1000) + inlineBackstopMarginSeconds;
-            const { messageId: backstop } = await created.queue.send(queued, { idempotencyKey, delaySeconds }) ?? {};
-            seeded = true;
-            const delivery = backstop ? { messageId: backstop, attempt: 0 } : null;
-            // receive() reports a failure to the host; the backstop retries it.
-            const entries = handoffEntries(read, newestSeen, appended);
-            const handoff = entries ? { log, entries } : null;
-            const work = receive(created, queued, delivery, { inRequest: true, handoff }).then(() => {}, () => {});
-            created.waitUntil?.(work);
-            return;
+        const log = fresh ?? await created.session(sessionId);
+        const inline = inRequest && created.runInRequest;
+        // Held from before the read until receive() takes over, so a turn
+        // run here meanwhile is counted on the worker the handoff goes to,
+        // not on one dropped in between (see consume).
+        const worker = inline ? hold(created, sessionId) : null;
+        try {
+          // Taken before this message is written, so a turn here that could
+          // have run it counts, also when a fresh log is not read at all.
+          const seen = worker?.mark() ?? null;
+          // Fresh: the caller's own write just created the run, so its log
+          // held no entry, as a read before that write would have shown.
+          const read = fresh ? [] : await log.read();
+          const appended = await recordMessage(log, foldSessionLog(read), full);
+          // Taken after the writes, which pass it over a run they created.
+          const newestSeen = log.newest?.();
+          const queued = queuedMessage(full, created.store);
+          const idempotencyKey = `${sessionId}:${message.type}:${message.messageId}`;
+          if (inline) {
+            await created.refreshDeadline?.();
+            const deadline = deliveryDeadline(created);
+            if (deadline !== null) {
+              // This request runs the turn, and the queue keeps the message as
+              // a backstop it delivers only after the request's deadline, by
+              // when the request has stopped. The lease names the backstop, so
+              // if the request died, the backstop takes the session over and
+              // continues the turn.
+              const delaySeconds = Math.ceil(Math.max(0, deadline - Date.now()) / 1000) + inlineBackstopMarginSeconds;
+              const backstop = (async () => {
+                const { messageId: backstopId } = await created.queue.send(queued, { idempotencyKey, delaySeconds }) ?? {};
+                return backstopId ? { messageId: backstopId, attempt: 0 } : null;
+              })();
+              void backstop.catch(() => {});
+              // The worker opens its engine while the backstop is sent; its
+              // lease, its writes and its first model request wait for the
+              // send (see claim). receive() reports a failure to the host; the
+              // backstop retries it.
+              const entries = handoffEntries(read, newestSeen, appended);
+              const handoff = entries ? { log, entries, seen } : null;
+              const work = receive(created, queued, null, { inRequest: true, handoff, backstop }).then(() => {}, () => {});
+              created.waitUntil?.(work);
+              try {
+                await backstop;
+              } catch (error) {
+                // The worker has stopped, having stored nothing, before the
+                // caller hears: a retry finds no worker here, as if none ran.
+                await work;
+                throw error;
+              }
+              seeded = true;
+              return;
+            }
           }
+          await created.queue.send(queued, { idempotencyKey });
+          seeded = true;
+        } finally {
+          if (worker) letGo(worker, sessionId);
         }
-        await created.queue.send(queued, { idempotencyKey });
-        seeded = true;
       };
       // Settles once the latest prompt from this session object with images
       // to store is stored or has failed; null while none has. Each later
@@ -2812,20 +3009,26 @@ export function createDurableAgentFactory({ harness, defaultDurability, defaultS
             try {
               const read = input === undefined || ready === null || aborted() ? input : await ready();
               const message = { type, messageId, ...(input === undefined ? {} : { input: read }) };
+              const { created, id: sessionId } = await resolved;
+              const log = await created.session(sessionId);
+              // The first prompt to a session id this process minted creates
+              // its run before anything reads it. When that write made the
+              // run, the log held no entry and the stream no line: what this
+              // turn would read is known, retried or not, as reads just before
+              // the write would have returned it.
+              const fresh = type === "prompt" && !aborted() && minted.delete(sessionId) && typeof log.fresh === "function" && await log.fresh();
               const queue = () => {
                 if (progress) progress.sent = true;
-                return send(message, { inRequest: type === "prompt" });
+                return send(message, { inRequest: type === "prompt", fresh: fresh ? log : null });
               };
-              const { created, id: sessionId } = await resolved;
-              const log = await created.session(sessionId);
               let attaching = type === "resume";
-              let from = null;
+              let from = fresh ? 0 : null;
               // The viewer's start is read before the message is queued, so
               // every line this message's own turn writes comes after it, and
               // an end for this id before it can only be from a turn this id
               // already ran.
-              if (retried) from = await log.ui.length();
-              if (retried && !aborted()) {
+              if (retried && !fresh) from = await log.ui.length();
+              if (retried && !fresh && !aborted()) {
                 // The log, for that answer, is read alongside the one queue
                 // send.
                 const [state] = await Promise.all([
@@ -2841,7 +3044,7 @@ export function createDurableAgentFactory({ harness, defaultDurability, defaultS
                 if (outcome.unsure) return { log, from, attaching: true, endWithinMs: retryEndWaitMs, unsure: true };
                 return { log, from, attaching: outcome.follow === true };
               }
-              if (retried) {
+              if (retried && !fresh) {
                 // A turn this id already ran answers from the log, without
                 // queueing it again. The viewer's start was read first, so a
                 // turn that ends after it has its end in view.
@@ -3145,7 +3348,7 @@ export function createDurableAgentFactory({ harness, defaultDurability, defaultS
       },
       /** An id for a new session, before its first prompt. */
       async newSessionId() {
-        return (await backend()).newSessionId();
+        return mint((await backend()).newSessionId());
       },
       /** The agent's name: its sessions' turns run only on agents with this name. */
       get name() {