pi-durable-subagents 1.0.10 → 1.0.12

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.0.12
+
+- Slot, memory and model decisions read the orchestrator settings recorded in
+  its ledger, the same state `status` reports, through one fold of that ledger
+  shared by the executor and `status`; an orchestrator embedded with given
+  settings records them as well. Journal readers use typed entries instead of
+  casts. No change in behavior is intended.
+
+## 1.0.11
+
+- A gate whose processes outlive their fence is reported once: when the gate
+  and the background sweep both recorded the failure at the same moment, a
+  workflow could show the same "processes may still run" attention item twice
+  (and the failure, the gate's unknown outcome and the resolution likewise).
+
 ## 1.0.10
 
 - Provider failover for a used-up usage window. An error such as `503 No

package/dist/agent/main/snapshots.js

@@ -3,7 +3,7 @@ import { StringDecoder } from "node:string_decoder";
 import { join } from "node:path";
 import { readJournalSnapshot } from "../../kernel/journal.js";
 import { journalPath, orchLedger } from "../../paths.js";
-import { CT, JT } from "../../types.js";
+import { CT, JT, attentionEntries } from "../../types.js";
 import { holdOf, ledgerIndex } from "../../orchestrator/snapshot.js";
 /** P15, P25: Read workflow snapshots without modifying another domain's history; a wid with an orchestrator.jsonl
  *  `pruned{wid}` entry is gone (housekeeping), even while its directory is still being removed. */
@@ -76,7 +76,7 @@ function unresolved(entries) {
     if (items)
         return items;
     const done = new Set(entries.filter(e => e.type === JT.attentionResolved).map(e => `${e.id}\0${e.rev}`));
-    items = entries.filter(e => e.type === JT.attention).map(e => e.item).filter(item => !done.has(`${item.id}\0${item.rev}`));
+    items = attentionEntries(entries).map(e => e.item).filter(item => !done.has(`${item.id}\0${item.rev}`));
     open.set(entries, items);
     return items;
 }

package/dist/cli/doctor.js

@@ -11,7 +11,7 @@ import { OsLock } from "../platform/lock.js";
 import { journalPath, orchInbox, orchLedger, orchLock } from "../paths.js";
 import { snapshotFromEntries } from "../orchestrator/snapshot.js";
 import { diskUsage } from "../orchestrator/store.js";
-import { JT } from "../types.js";
+import { JT, isEntry } from "../types.js";
 import { serviceFiles } from "./service.js";
 const HOUR = 3_600_000, DAY = 24 * HOUR, CLI = "pi-durable-subagents";
 const quote = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
@@ -63,8 +63,8 @@ export async function doctor(home, env = process.env, now = Date.now()) {
         // Finished notices are delivered to the origin session and stay open in the journal by design: not counted.
         const resolved = new Set(entries.filter(e => e.type === JT.attentionResolved).map(e => `${e.id}@${e.rev}`));
         for (const e of entries) {
-            const item = e.item;
-            if (e.type === JT.attention && item && item.kind !== "finished" && !resolved.has(`${item.id}@${item.rev}`) && now - e.ts > HOUR)
+            const item = isEntry(e, JT.attention) ? e.item : undefined;
+            if (item && item.kind !== "finished" && !resolved.has(`${item.id}@${item.rev}`) && now - e.ts > HOUR)
                 report.attention.push({ wid, id: item.id, kind: item.kind, ageMs: now - e.ts });
             if (e.type !== "fence-failed")
                 continue;

package/dist/orchestrator/engine.js

@@ -17,7 +17,7 @@ import { contentHash } from "../kernel/ids.js";
 import { planDecisions, reduceLifecycle } from "../kernel/lifecycle.js";
 import { scanInbox } from "../kernel/mailbox.js";
 import { orchInbox, pinnedDir } from "../paths.js";
-import { JT } from "../types.js";
+import { JT, attentionEntries, isEntry } from "../types.js";
 import { EvaluatorClient } from "./evaluator-client.js";
 import { Store, revisionEntries, terminalEntry } from "./store.js";
 import { formatUsage, holdOf, refusedResult, snapshotFromEntries } from "./snapshot.js";
@@ -509,7 +509,7 @@ export class Engine {
         void this.executor.run(ticket).then(() => this.background(async () => {
             if (!wf.journal.entries().some(e => e.type === JT.sealed && e.call === id))
                 throw new Error(`Generation returned without seal: ${id}`);
-            if (!wf.journal.entries().some(e => e.type === JT.attention && e.item.id === `finished:${id}`))
+            if (!wf.journal.entries().some(e => isEntry(e, JT.attention) && e.item.id === `finished:${id}`))
                 await wf.journal.append(JT.attention, { item: { id: `finished:${id}`, rev: 1, kind: 'finished', wid: wf.wid, call: id, text: finishedText(wf.wid, wf.journal.entries(), id), origin: wf.origin } });
             this.generations.delete(id);
         }), error => {
@@ -686,13 +686,12 @@ export class Engine {
     async attention(wf) {
         const done = this.terminal(wf);
         const rev = wf.journal.entries().filter(e => e.type === JT.done).length;
-        if (done && !wf.journal.entries().some(e => e.type === JT.attention && e.item.id === `finished:${wf.wid}` && e.item.rev === rev)) {
+        if (done && !wf.journal.entries().some(e => isEntry(e, JT.attention) && e.item.id === `finished:${wf.wid}` && e.item.rev === rev)) {
             await wf.journal.append(JT.attention, { item: { id: `finished:${wf.wid}`, rev, kind: 'finished', wid: wf.wid, text: finishedText(wf.wid, wf.journal.entries()) } });
         }
     }
     async resolveFinished(wf) {
-        for (const e of wf.journal.entries().filter(e => e.type === JT.attention)) {
-            const item = e.item;
+        for (const { item } of attentionEntries(wf.journal.entries())) {
             if (item.kind === 'finished' && !wf.journal.entries().some(r => r.type === JT.attentionResolved && r.id === item.id && r.rev === item.rev)) {
                 await wf.journal.append(JT.attentionResolved, { id: item.id, rev: item.rev, resolution: 'resumed' });
             }

package/dist/orchestrator/executor/effects/gate.js

@@ -5,15 +5,17 @@ import { join } from "node:path";
 import { publishFile } from "../../../kernel/mailbox.js";
 import { callDir } from "../../../paths.js";
 import { validate } from "../../../agent/child/schema.js";
-import { recordFenceFailure, resolveFenceAttention } from "../sweep.js";
+import { fenceAttentionResolved, recordFenceFailure, recordOnce } from "../sweep.js";
 const tracked = (journal, id) => journal.entries().filter(e => e.type === "gate-tracked" && e.id === id).map(e => e.process);
 // Calls parked on an unfenced gate, woken when the sweep records the gate's outcome.
 const parked = new Map();
 /** P30, F1: A gate proven retired after a failed fence gets its unknown outcome once and its attention resolved. */
 export async function gateRetired(journal, id) {
-    if (!journal.entries().some(e => e.type === "gate" && e.id === id))
-        await journal.append("gate", { id, unknown: true });
-    await resolveFenceAttention(journal, id);
+    await recordOnce(journal, async () => {
+        if (!journal.entries().some(e => e.type === "gate" && e.id === id))
+            await journal.append("gate", { id, unknown: true });
+        await fenceAttentionResolved(journal, id);
+    });
     for (const wake of parked.get(id) ?? [])
         wake();
 }
@@ -52,8 +54,9 @@ async function fenceGate(journal, intent, containment) {
             console.error(`durable-subagents: fence of ${id} failed: ${String(error)}`);
         if (/Fence timeout/.test(String(error)))
             await recordFenceFailure(journal, id, String(intent.call), error);
-        else if (!journal.entries().some(e => e.type === "fence-failed" && e.exec === id))
-            await journal.append("fence-failed", { exec: id, error: String(error) });
+        else
+            await recordOnce(journal, async () => { if (!journal.entries().some(e => e.type === "fence-failed" && e.exec === id))
+                await journal.append("fence-failed", { exec: id, error: String(error) }); });
         return false;
     }
 }

package/dist/orchestrator/executor/effects/prepare.js

@@ -8,14 +8,14 @@ import { basename, dirname, join, resolve, sep } from "node:path";
 import { randomUUID } from "node:crypto";
 import { publishFile } from "../../../kernel/mailbox.js";
 import { contentHash } from "../../../kernel/ids.js";
-import { JT } from "../../../types.js";
+import { JT, isEntry } from "../../../types.js";
 const exec = promisify(execFile);
 const git = async (cwd, ...args) => (await exec("git", args, { cwd, timeout: 30000, maxBuffer: 4 * 1024 * 1024 })).stdout.trim();
 const records = (t, type) => t.journal.entries().filter(e => e.type === type && e.call === t.callId);
 /** P15, A5: Publish one stable attention item for a retained or conflicting effect. */
 export async function attention(t, kind, text) {
     const id = `${kind}:${t.callId}`;
-    if (!t.journal.entries().some(e => e.type === JT.attention && e.item?.id === id))
+    if (!t.journal.entries().some(e => isEntry(e, JT.attention) && e.item?.id === id))
         await t.journal.append(JT.attention, { item: { id, rev: 1, kind: "unknown", text, wid: t.wid, call: t.callId } });
 }
 /** Git lists worktrees by real path (macOS: /var is /private/var); compare paths in that form. */

package/dist/orchestrator/executor/index.js

@@ -11,7 +11,7 @@ import { mkdir, open, readdir, readFile, rm, unlink, writeFile } from "node:fs/p
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { CT, JT } from "../../types.js";
+import { CT, JT, attentionEntries, isEntry } from "../../types.js";
 import { callDir, callInbox, callSession, outboxRoot } from "../../paths.js";
 import { Outbox } from "../../kernel/mailbox.js";
 import { contentHash, forwardRid } from "../../kernel/ids.js";
@@ -22,7 +22,7 @@ import { buildCallResult } from "../../compat/result.js";
 import createEffects from "./effects/index.js";
 import { continueSession } from "./generation.js";
 import { hibernation, openQuestion } from "./hibernate.js";
-import { foldExhaustion } from "../providers.js";
+import { emptyLedger, foldLedger, holdings as holdingsOf, settingsOf } from "../ledger.js";
 import { evidence, fatalProviderError, quotaExhausted, refusedByProvider, forgetSession, readSessionState, receiptId, sessionModel } from "./session.js";
 import { activeTotal } from "./time.js";
 import { observeExecution } from "./observe.js";
@@ -115,25 +115,12 @@ export default function createExecutor(ledgers, options = {}) {
     };
     const wake = () => { for (const fn of waiters)
         fn(); waiters.clear(); };
-    // F3: fold only orchestrator entries appended since the last fold (holdings, observed switches, K7 skips).
-    const ledger = { seen: 0, held: new Map(), observed: new Set(), skips: new Map(), exhausted: new Map() };
-    const folded = () => {
-        const entries = orch.entries();
-        for (; ledger.seen < entries.length; ledger.seen++) {
-            const e = entries[ledger.seen], id = `${e.pool}:${e.slot}`;
-            if (e.type === "hold")
-                ledger.held.set(id, e);
-            else if (e.type === "release" && ledger.held.get(id)?.exec === e.exec)
-                ledger.held.delete(id);
-            else if (e.type === "switch-observed")
-                ledger.observed.add(`${e.exec}\n${e.rid}`);
-            else if (e.type === "skip")
-                ledger.skips.set(`${e.pool}\n${e.model}`, Math.max(Number(e.until), ledger.skips.get(`${e.pool}\n${e.model}`) ?? 0));
-            foldExhaustion(ledger.exhausted, e);
-        }
-        return ledger;
-    };
-    const holdings = () => [...folded().held.values()];
+    // F3, A1: fold only orchestrator entries appended since the last fold (ledger.ts, shared with `status`).
+    const ledger = emptyLedger();
+    const folded = () => foldLedger(ledger, orch.entries());
+    /** A4: guards read the settings recorded in the ledger (config.json changes are recorded between admissions). */
+    const settings = () => settingsOf(folded(), config);
+    const holdings = () => holdingsOf(folded());
     const skipped = (pool, model) => (folded().skips.get(`${pool}\n${model.provider}/${model.id}`) ?? 0) > Date.now();
     /** A provider whose usage window is used up admits no call until its next try, and then one probe at a time. */
     const unavailable = (provider) => {
@@ -349,13 +336,12 @@ export default function createExecutor(ledgers, options = {}) {
     }
     async function workflowReached(t) {
         const hit = reached(totalUsage(t.journal.entries()), t.workflowBudget), id = `budget:${t.wid}`;
-        if (hit && !t.journal.entries().some(e => e.type === JT.attention && e.item.id === id))
+        if (hit && !t.journal.entries().some(e => isEntry(e, JT.attention) && e.item.id === id))
             await t.journal.append(JT.attention, { item: { id, rev: 1, kind: "budget", text: "Workflow budget reached", wid: t.wid } });
         return hit;
     }
     async function retireAttention(journal, call) {
-        for (const e of journal.entries().filter(e => e.type === JT.attention)) {
-            const item = e.item;
+        for (const { item } of attentionEntries(journal.entries())) {
             if (item.kind === "finished" || item.id === `unknown:${call}` || item.id.startsWith("fence:"))
                 continue;
             if (item.call === call && !journal.entries().some(r => r.type === JT.attentionResolved && r.id === item.id && r.rev === item.rev))
@@ -365,7 +351,7 @@ export default function createExecutor(ledgers, options = {}) {
     /** P15, AC4: A call sealed `unknown` raises exactly one unknown item for its origin; seal and recovery both run this. */
     async function unknownAttention(journal, call) {
         const result = sealed(journal, call), id = `unknown:${call}`;
-        if (result?.status !== "unknown" || journal.entries().some(e => e.type === JT.attention && e.item.id === id))
+        if (result?.status !== "unknown" || journal.entries().some(e => isEntry(e, JT.attention) && e.item.id === id))
             return;
         const text = `Call ${call} ended with an unknown outcome: ${result.error || "no evidence of what it did"}. It was not re-run; check its effects before continuing.`;
         await journal.append(JT.attention, { item: { id, rev: 1, kind: "unknown", text, wid: address(call).wid, call } });
@@ -454,15 +440,15 @@ export default function createExecutor(ledgers, options = {}) {
                         continue;
                     const probe = provider !== undefined && folded().exhausted.has(provider);
                     const holders = holdings().filter(e => e.pool === provider);
-                    const limit = config.providers?.[provider ?? ""]?.slots ?? Infinity;
+                    const limit = settings().providers?.[provider ?? ""]?.slots ?? Infinity;
                     if (!capacity({ kind: "provider", holders: holders.length, capacity: limit }))
                         continue;
                     // A burst of dispatches all read the same MemAvailable before any child has grown: subtract the children
                     // admitted in the last 30 s (their memory is not visible yet), so a burst cannot over-commit the headroom.
-                    const perChild = config.memory?.perChildMb ?? 300;
+                    const perChild = settings().memory?.perChildMb ?? 300;
                     const warming = holdings().filter(e => e.pool === "memory" && Date.now() - e.ts < MEM_WARMUP_MS).length;
                     const measured = await (options.memory ?? availableMemory)(), available = measured - warming * perChild;
-                    const admitted = capacity({ kind: "memory", available, reserve: config.memory?.reserveMb ?? 2048, perChild });
+                    const admitted = capacity({ kind: "memory", available, reserve: settings().memory?.reserveMb ?? 2048, perChild });
                     // F3: every admitted dispatch is recorded; repeated refusals at most once per 30 s per call.
                     if (admitted || a.refusedAt === undefined || Date.now() - a.refusedAt >= MEM_RECORD_MS) {
                         await orch.append("mem", { available, admitted, exec, ...(warming ? { measured, warming } : {}) });
@@ -508,9 +494,10 @@ export default function createExecutor(ledgers, options = {}) {
         const recorded = sessionModel(entries);
         const ownSegment = entries.some(e => e.type === "custom" && e.customType === CT.exec && typeof e.data?.exec === "string" && e.data.exec.startsWith(`${t.callId}#`));
         const freshFork = t.spec.context === "fork" && !t.continueFrom && !ownSegment;
-        const raw = t.spec.model ?? t.agent.model ?? config.defaultModel ?? await defaultModel();
-        const pool = raw && config.pools?.[raw] ? raw : undefined;
-        const candidates = raw ? resolveModel(raw, config.pools) : [{ id: "" }];
+        const { defaultModel: configured, pools } = settings();
+        const raw = t.spec.model ?? t.agent.model ?? configured ?? await defaultModel();
+        const pool = raw && pools?.[raw] ? raw : undefined;
+        const candidates = raw ? resolveModel(raw, pools) : [{ id: "" }];
         const candidate = recorded && candidates.some(m => m.provider === recorded.provider && m.id === recorded.id);
         // Leave the session's model for the pool's others when its pool skips it after losses, or its provider's usage
         // window is used up; and at a new generation, go back to the pool's order of preference.
@@ -537,7 +524,7 @@ export default function createExecutor(ledgers, options = {}) {
                 if (typeof qid !== "string" || typeof rev !== "number")
                     continue;
                 const id = `q:${t.callId}:${qid}`;
-                if (!t.journal.entries().some(r => r.type === JT.attention && r.item.id === id && r.item.rev === rev))
+                if (!t.journal.entries().some(r => isEntry(r, JT.attention) && r.item.id === id && r.item.rev === rev))
                     await t.journal.append(JT.attention, { item: { id, rev, kind: "question", text: String(question), wid: t.wid, call: t.callId, qid, session: callSession(home, t.wid, t.key, t.gen) } });
                 const answered = entries.some(r => {
                     const details = r.message?.details ?? r.details;
@@ -783,7 +770,7 @@ export default function createExecutor(ledgers, options = {}) {
                         if (!q || interrupted(a) || segment < 0 || !entries.slice(segment + 1).some(e => e.customType === CT.question && e.data?.qid === q.qid) || journal.entries().some(e => e.type === "answer-bound" && e.call === t.callId && e.qid === q.qid && e.rev === q.rev))
                             return;
                         await serial(async () => {
-                            const attention = journal.entries().find(e => e.type === JT.attention && e.item.qid === q.qid && e.item.call === t.callId && e.item.rev === q.rev);
+                            const attention = journal.entries().find(e => isEntry(e, JT.attention) && e.item.qid === q.qid && e.item.call === t.callId && e.item.rev === q.rev);
                             if (attention && Date.now() - attention.ts >= (config.k?.hibernateMs ?? 120000) && !has(journal, JT.fenced, exec) && hibernation(journal, t.callId)?.exec !== exec) {
                                 await journal.append("hibernated", { call: t.callId, exec, qid: q.qid, rev: q.rev });
                                 a.wake();
@@ -870,7 +857,7 @@ export default function createExecutor(ledgers, options = {}) {
                         if (sleeping.qid !== req.cond?.qid || sleeping.rev !== req.cond?.rev)
                             return { action: "reject", reason: "stale-rev" };
                         const rid2 = forwardRid(req.rid, ctx.widRev, ctx.key, hash);
-                        const item = ctx.journal.entries().find(e => e.type === JT.attention && e.item.call === dest && e.item.qid === sleeping.qid && e.item.rev === sleeping.rev)?.item;
+                        const item = attentionEntries(ctx.journal.entries()).find(e => e.item.call === dest && e.item.qid === sleeping.qid && e.item.rev === sleeping.rev)?.item;
                         await ctx.journal.append("answer-bound", { call: dest, qid: sleeping.qid, rev: sleeping.rev, rid: req.rid, rid2, hash, message: `Question: ${item?.text ?? sleeping.qid}\nAnswer: ${req.body.message ?? ""}` });
                         active.get(dest)?.wake();
                         wake();
@@ -904,7 +891,7 @@ export default function createExecutor(ledgers, options = {}) {
                         const held = holdings().filter(h => h.exec === exec);
                         if (!held.some(h => h.pool === provider)) {
                             const target = holdings().filter(h => h.pool === provider);
-                            if (!capacity({ kind: "provider", holders: target.length, capacity: config.providers?.[provider]?.slots ?? Infinity }))
+                            if (!capacity({ kind: "provider", holders: target.length, capacity: settings().providers?.[provider]?.slots ?? Infinity }))
                                 return { action: "reject", reason: "provider-full" };
                             let slot = 0;
                             while (target.some(h => h.slot === slot))

package/dist/orchestrator/executor/observe.js

@@ -5,7 +5,7 @@ import { join } from "node:path";
 import { stat as fileStat } from "node:fs/promises";
 import { performance } from "node:perf_hooks";
 import { createInterface } from "node:readline";
-import { JT } from "../../types.js";
+import { JT, attentionEntries } from "../../types.js";
 import { callDir, callSession } from "../../paths.js";
 import { monotoneTime } from "../../kernel/guards.js";
 import { readSession } from "./session.js";
@@ -42,8 +42,7 @@ export async function observeExecution(d) {
     };
     const stall = () => serial(async () => {
         const id = `stall:${t.callId}`;
-        const items = t.journal.entries().filter(e => e.type === JT.attention && e.item.id === id);
-        const last = items.at(-1)?.item;
+        const items = attentionEntries(t.journal.entries(), id), last = items.at(-1)?.item;
         const open = last && !t.journal.entries().some(e => e.type === JT.attentionResolved && e.id === id && e.rev === last.rev);
         const fresh = items.at(-1)?.exec === exec ? clock.last > Number(items.at(-1)?.horizon) : clock.last > started;
         if (open && fresh)
@@ -53,8 +52,7 @@ export async function observeExecution(d) {
     });
     const noProgress = () => serial(async () => {
         const id = `noprogress:${t.callId}`;
-        const items = t.journal.entries().filter(e => e.type === JT.attention && e.item.id === id);
-        const last = items.at(-1)?.item;
+        const items = attentionEntries(t.journal.entries(), id), last = items.at(-1)?.item;
         const open = last && !t.journal.entries().some(e => e.type === JT.attentionResolved && e.id === id && e.rev === last.rev);
         const fresh = items.at(-1)?.exec === exec ? progress > Number(items.at(-1)?.horizon) : progress > started;
         if (open && fresh)

package/dist/orchestrator/executor/sweep.js

@@ -1,4 +1,4 @@
-import { JT } from "../../types.js";
+import { JT, attentionEntries, isEntry } from "../../types.js";
 import { Containment as PlatformContainment } from "../../platform/containment.js";
 import { ProcessTable } from "../../platform/proctable.js";
 /** C2, F4: A containment whose process-table snapshots never overlap (ProcessTable.list is not reentrant). */
@@ -21,12 +21,27 @@ export async function skipLostCandidate(journal, orch, exec) {
     if (tail.length === 3 && tail.every(e => e.type === "candidate-loss" && e.model === name))
         await orch.append("skip", { pool: selected.pool, model: name, until: Date.now() + 600000 });
 }
+// The gate path records outside the executor's serial section and the sweep inside it: each check-then-append of a
+// fence record runs in this per-journal section, so two recorders that both find no record still write it once (A5).
+const sections = new WeakMap();
+/** A5: Run a check-then-append of fence records alone on its journal. Not reentrant: never nest two. */
+export function recordOnce(journal, operation) {
+    const result = (sections.get(journal) ?? Promise.resolve()).then(operation);
+    const tail = result.catch(() => { });
+    sections.set(journal, tail);
+    void tail.then(() => { if (sections.get(journal) === tail)
+        sections.delete(journal); });
+    return result;
+}
 /** F1: Record a fence timeout of an execution or gate identity once, with one unknown attention item for the origin. */
-export async function recordFenceFailure(journal, id, call, error) {
+export function recordFenceFailure(journal, id, call, error) {
+    return recordOnce(journal, () => fenceFailure(journal, id, call, error));
+}
+async function fenceFailure(journal, id, call, error) {
     if (!journal.entries().some(e => e.type === "fence-failed" && e.exec === id))
         await journal.append("fence-failed", { exec: id, error: String(error) });
     const item = `fence:${id}`;
-    if (journal.entries().some(e => e.type === JT.attention && e.item.id === item))
+    if (journal.entries().some(e => isEntry(e, JT.attention) && e.item.id === item))
         return;
     const text = id.startsWith("gate:")
         ? `Processes of gate ${id} did not exit after SIGKILL (${String(error)}). Its outcome stays unknown and is recorded once they are gone; check for stuck processes (e.g. blocked I/O).`
@@ -34,8 +49,12 @@ export async function recordFenceFailure(journal, id, call, error) {
     await journal.append(JT.attention, { item: { id: item, rev: 1, kind: "unknown", text, wid: call.slice(0, call.lastIndexOf("@", call.indexOf("/"))), call } });
 }
 /** F1: Resolve the fence attention item of an identity that a later fence proved retired. */
-export async function resolveFenceAttention(journal, id) {
-    const item = journal.entries().find(e => e.type === JT.attention && e.item.id === `fence:${id}`)?.item;
+export function resolveFenceAttention(journal, id) {
+    return recordOnce(journal, () => fenceAttentionResolved(journal, id));
+}
+/** The same, inside a `recordOnce` section. */
+export async function fenceAttentionResolved(journal, id) {
+    const item = attentionEntries(journal.entries(), `fence:${id}`)[0]?.item;
     if (item && !journal.entries().some(e => e.type === JT.attentionResolved && e.id === `fence:${id}` && e.rev === item.rev))
         await journal.append(JT.attentionResolved, { id: `fence:${id}`, rev: item.rev, resolution: "fenced" });
 }

package/dist/orchestrator/ledger.js

@@ -0,0 +1,49 @@
+// A1, A4: the state of the orchestrator ledger that admission reads and `status` shows, folded by one reducer.
+//   hold/release{pool,slot,exec}: provider and memory slots held (a release frees only its holder's slot).
+//   switch-observed{exec,rid}: a model switch the execution's provider requests confirmed.
+//   skip{pool,model,until}: a pool candidate skipped after repeated losses (K7).
+//   provider-*: used-up usage windows (providers.ts).
+//   config{hash,config}: the orchestrator settings in effect from here; config-rejected{error,hash?}: a change of
+//     config.json refused, while the earlier settings stay (cleared by the next config record).
+import { foldExhaustion } from "./providers.js";
+import { isEntry } from "../types.js";
+export function emptyLedger() {
+    return { seen: 0, held: new Map(), observed: new Set(), skips: new Map(), exhausted: new Map() };
+}
+/** Apply one orchestrator ledger entry. */
+export function applyLedger(state, e) {
+    if (isEntry(e, "hold"))
+        state.held.set(`${e.pool}:${e.slot}`, e);
+    else if (isEntry(e, "release")) {
+        const id = `${e.pool}:${e.slot}`;
+        if (state.held.get(id)?.exec === e.exec)
+            state.held.delete(id);
+    }
+    else if (isEntry(e, "switch-observed"))
+        state.observed.add(`${e.exec}\n${e.rid}`);
+    else if (isEntry(e, "skip"))
+        state.skips.set(`${e.pool}\n${e.model}`, Math.max(Number(e.until), state.skips.get(`${e.pool}\n${e.model}`) ?? 0));
+    else if (isEntry(e, "config")) {
+        state.config = { hash: String(e.hash), settings: e.config, ts: e.ts };
+        delete state.rejected;
+    }
+    else if (isEntry(e, "config-rejected"))
+        state.rejected = { error: String(e.error), ts: e.ts };
+    foldExhaustion(state.exhausted, e);
+}
+/** Fold the entries appended since `state` was last folded (the ledger only grows); a ledger that is not the one
+ *  folded so far (shorter, or another entry where the last folded one was) is folded from the start. */
+export function foldLedger(state, entries) {
+    // Journal readers keep the entry objects of a ledger as it grows (kernel/journal.ts), so identity tells them apart.
+    if (state.seen && entries[state.seen - 1] !== state.last)
+        Object.assign(state, emptyLedger(), { config: undefined, rejected: undefined, last: undefined });
+    for (; state.seen < entries.length; state.seen++)
+        applyLedger(state, entries[state.seen]);
+    state.last = entries[state.seen - 1];
+    return state;
+}
+/** The provider slots held now (memory slots included). */
+export const holdings = (state) => [...state.held.values()];
+/** A4: the settings guards read: the ones recorded last, else (a ledger that records none: an embedded or test
+ *  orchestrator given its settings) the given ones. */
+export const settingsOf = (state, given) => state.config?.settings ?? given;

package/dist/orchestrator/main.js

@@ -39,8 +39,9 @@ export async function main(options = {}) {
         const factory = options.executor ?? (await import(__rewriteRelativeImportExtension(new URL(import.meta.url.endsWith('.ts') ? './executor/index.ts' : './executor/index.js', import.meta.url).href))).default;
         const executor = factory(ledgers);
         engine = new Engine(ledgers, executor, options);
+        // A4: admission reads the settings recorded last, so the ones this run starts with are recorded (given ones too).
+        await recordConfig(ledgers.orch, config);
         if (stamp !== undefined) {
-            await recordConfig(ledgers.orch, config);
             // A change applies between slot admissions, so one admission never mixes two versions of the limits.
             watcher = watchConfig({ path: configPath(home), stamp, config, orch: ledgers.orch, intervalMs: Math.min(1000, config.k?.trackerMs ?? 1000),
                 apply: change => executor.reconfigure ? executor.reconfigure(change) : change() });

package/dist/orchestrator/snapshot.js

@@ -5,8 +5,8 @@ import { join } from "node:path";
 import { compileFanout } from "../compat/fanout.js";
 import { readJournalSnapshot } from "../kernel/journal.js";
 import { journalPath, orchLedger, pinnedDir, workflowDir } from "../paths.js";
-import { JT } from "../types.js";
-import { foldExhaustion } from "./providers.js";
+import { JT, isEntry } from "../types.js";
+import { emptyLedger, foldLedger } from "./ledger.js";
 /** A workflow has live work: it runs, or follow-ups opened on it after it finished have not ended yet. */
 export function isLive(wf) {
     return wf.status === "running" || (wf.followUps ?? 0) > 0;
@@ -191,7 +191,7 @@ function snapshotReducer(wid, entries) {
                 delete call.hibernated;
                 hibernating.delete(call.callId);
             }
-            else if (e.type === JT.attention) {
+            else if (isEntry(e, JT.attention)) {
                 const item = e.item;
                 attention.push(item);
             }
@@ -469,34 +469,24 @@ const tokens = (u) => { const n = u ? u.input + u.output : 0; return n >= 1e6 ?
 const latestCalls = (wf) => [...new Map(wf.calls.map(c => [c.key, c])).values()];
 /** Provider slots from the orchestrator ledger: holders per provider (hold/release{pool,slot,exec}) and the limits of
  *  the settings in effect (the latest config{hash,config}); config-rejected after it is reported too. */
+// One fold per orchestrator ledger, extended as it grows (ledger.ts; the executor folds the same entries the same way).
+const ledgerStates = new Map();
 export function slotsView(home, now = Date.now()) {
-    const held = new Map(), used = new Map();
-    let config, rejected;
-    for (const e of readJournalSnapshot(orchLedger(home))) {
-        if (e.type === "hold")
-            held.set(`${e.pool}:${e.slot}`, e);
-        else if (e.type === "release" && held.get(`${e.pool}:${e.slot}`)?.exec === e.exec)
-            held.delete(`${e.pool}:${e.slot}`);
-        else if (e.type === "config") {
-            config = e;
-            rejected = undefined;
-        }
-        else if (e.type === "config-rejected")
-            rejected = e;
-        foldExhaustion(used, e);
-    }
+    const path = orchLedger(home), state = foldLedger(ledgerStates.get(path) ?? emptyLedger(), readJournalSnapshot(path));
+    ledgerStates.set(path, state);
+    const { held, config, rejected } = state, used = state.exhausted;
     const exhausted = [...used].sort(([a], [b]) => a.localeCompare(b)).map(([p, x]) => `${p} exhausted since ${age(now - x.since)} ago (${clip(x.error, 80)}), ` +
         (x.probe ? `probing with ${x.probe.split("#")[0]}` : x.nextTry > now ? `next try in ${age(x.nextTry - now)}` : "next call probes it"));
-    const limits = (config?.config?.providers) ?? {};
+    const limits = config?.settings.providers ?? {};
     const holders = new Map();
     for (const e of held.values())
         if (e.pool !== "memory")
-            holders.set(String(e.pool), (holders.get(String(e.pool)) ?? 0) + 1);
+            holders.set(e.pool, (holders.get(e.pool) ?? 0) + 1);
     const names = [...new Set([...Object.keys(limits), ...holders.keys()])].sort();
     const slots = names.map(p => { const n = holders.get(p) ?? 0, limit = limits[p]?.slots; return typeof limit === "number" ? `${p} ${n}/${limit}` : `${p} ${n} (no limit)`; });
-    return { ...(slots.length ? { slots } : {}), ...(config ? { config: `${String(config.hash)} since ${age(now - config.ts)} ago` } : {}),
+    return { ...(slots.length ? { slots } : {}), ...(config ? { config: `${config.hash} since ${age(now - config.ts)} ago` } : {}),
         ...(exhausted.length ? { exhausted } : {}),
-        ...(rejected ? { configRejected: `${clip(String(rejected.error), 200)} (${age(now - rejected.ts)} ago); ${config ? String(config.hash) : "the start settings"} stay in effect` } : {}) };
+        ...(rejected ? { configRejected: `${clip(rejected.error, 200)} (${age(now - rejected.ts)} ago); ${config ? config.hash : "the start settings"} stay in effect` } : {}) };
 }
 /** Tool status without a wid: what runs, what waits for an answer and what failed, with finished workflows one line each.
  *  The full view (every call's last line and usage) ran to tens of thousands of tokens on a busy home. */

package/dist/types.js

@@ -1,6 +1,12 @@
 // Pinned shared contracts for pi-durable-subagents.
 // Changing anything here needs parent approval: every module and test depends on it.
 // Design references (repo-local, not published): design/principles.md (A1-A5, V1-V8), design/spec.md (P1-P38, K1-K11).
+/** Narrow an entry to its type's fields (their shape is the writer's contract, not checked at runtime). */
+export function isEntry(e, type) { return e.type === type; }
+/** P15: the attention entries of a journal, of one item id when given (each revision of an item is an entry). */
+export function attentionEntries(entries, id) {
+    return entries.filter((e) => isEntry(e, "attention") && (id === undefined || e.item.id === id));
+}
 // ---------------------------------------------------------------------------
 // Child session entries (pi session file is the child's log; P4, P8, P23, P24)
 // customType values written by the session agent. All carry details/data as below.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-durable-subagents",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "description": "Subagents for pi that never lose work and never do it twice. Crash-safe workflows, automatic recovery, and a live view just like the main agent.",
   "type": "module",
   "license": "MIT",