pi-durable-subagents 1.0.13 → 1.0.16

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 1.0.16
+
+- A used-up usage window is found while pi is still retrying: at the second
+  quota refusal in a row (`No available accounts`, usage limit, quota
+  exceeded), not after pi's retries end. A call from a pool moves to the
+  pool's next model that is not used up and has a free slot, in the same
+  execution and session, within pi's next retry or two (refused requests use
+  no quota); one with a single model waits for its provider. Before, a call kept retrying the used-up provider for as
+  long as pi's retry settings allowed (over ten minutes with ten retries).
+- `send kind:"model"` and a follow-up's `model` accept a pool's name: the
+  first model of the pool that is not used up (for a running call, also with
+  a free slot). The reply names the model picked; a call from that pool stays
+  in it, so a later used-up window still moves it on. A follow-up naming a
+  pool starts its generation from the pool's order.
+
+## 1.0.15
+
+- The changes listed under 1.0.14, which was tagged but never published:
+  its macOS CI failed because two test files compared worktree roots (real
+  paths) with temporary paths under the `/var` symlink. Only those tests
+  changed.
+
+## 1.0.14
+
+- The running orchestrator's version is visible. `status` shows it
+  (`orchestrator: 1.0.14 (pid …)`), and when it is not the version a pi
+  session loaded (after an update, running work stays on the old one), that
+  pi says so once and `status` adds a note: the orchestrator switches by
+  itself about 10 s after all work ends. To switch sooner without stopping
+  running calls: `drain`, wait until `status` no longer shows the old
+  version, then `resume` from a pi session started after the update.
+- Two subagents editing the same worktree are pointed out. When two calls
+  that have not finished both used `edit` or `write` under the same git
+  worktree, the main session that started them gets one reminder per pair,
+  and `status` names the other call in `sharedWorktree`. A paused call that
+  wrote still counts until it ends. Nothing is blocked; the reminder closes
+  when either call ends. Writes made only through `bash`
+  are not seen; calls with `isolation: "worktree"` have their own worktree.
+
 ## 1.0.13
 
 - A subagent resumed after its execution was interrupted (the orchestrator

package/README.md

@@ -55,7 +55,8 @@ the npx cache, so `install-service` refuses to run from there.
 | You steer a subagent while it is asking you a question | Your message reaches it, in order. Nothing is rejected or lost. |
 | Two steers arrive out of order and the second replaces the first | Only the second one applies. |
 | A step is refused, or a dependency fails | The workflow stops that branch cleanly. Nothing is retried in vain. |
-| A provider's usage window runs out (`No available accounts`, usage limit, quota exceeded) | A call in a pool continues **in the same session** on the pool's next model; new calls skip that provider. After 15 minutes the next call that wants it tries it once; when it answers, new calls and new generations use it again. A call with a single model waits for it instead of failing. Billing errors (402, insufficient balance) still fail at once. |
+| A provider's usage window runs out (`No available accounts`, usage limit, quota exceeded) | Found at the second refusal in a row, while pi is still retrying. A call in a pool continues **in the same session** on the pool's next model (within pi's next retry or two); new calls skip that provider. After 15 minutes the next call that wants it tries it once; when it answers, new calls and new generations use it again. A call with a single model waits for it instead of failing. Billing errors (402, insufficient balance) still fail at once. |
+| Two subagents edit the same worktree | A reminder names both calls; neither is blocked or locked. Only observed `edit`/`write` calls count (bash-only writes are not seen). Calls with `isolation: "worktree"` have their own worktrees. |
 | A subagent waits for an answer for a long time | It releases its model slot and memory, then resumes exactly once when you answer. |
 
 ## Use it
@@ -97,9 +98,9 @@ it something. Each verb means one thing, and a refusal says what would work:
 |---|---|---|
 | `run` | — | Start one subagent, `tasks` in parallel, a `chain`, or a workflow script. An unknown agent name is refused before anything starts, with the list of agents. |
 | `send steer` | a running subagent | Reaches it at its next safe point. To a finished one: refused, use `follow-up`; To one waiting on its question: it interrupts the question, and the subagent usually asks again; `answer` answers it. |
-| `send follow-up` | a finished subagent | Continues the same session as a new generation (`key@2`). With `model`, that generation runs on it. |
+| `send follow-up` | a finished subagent | Continues the same session as a new generation (`key@2`). With `model` (a model or a pool's name), that generation runs on it. |
 | `send answer` | an open question | Answers it once. |
-| `send model` | any subagent | A running one switches at its next request; one asking, hibernated or waiting for a slot launches on it when it runs again. |
+| `send model` | any subagent | A running one switches at its next request; one asking, hibernated or waiting for a slot launches on it when it runs again. A pool's name picks its first model that is not used up (and, for a running call, has a free slot); the reply names the model picked, and a call from that pool stays in it. |
 | `stop` | a subagent or a workflow | Final: `stopped`, usage kept, edits left as they are. |
 | `drain` / `resume` | existing workflows | A reversible hold; runs started later are not held. |
 
@@ -176,6 +177,7 @@ The main agent is interrupted only when there is something to decide:
 - a finished workflow;
 - a stalled subagent (the alert names the command it is running and for how long, so a long silent command reads differently from a stuck call);
 - an unknown outcome;
+- two unfinished calls observed editing the same worktree (a reminder, never a block);
 - a reached budget.
 
 Each one arrives once. A reminder that was already resolved is shown as
@@ -320,6 +322,26 @@ On load, it checks the pi exports and API methods it uses.
 
 `smoke` runs the same checks inside your pi.
 
+## Updating Durable Subagents
+
+Running work stays on the version it started with: the orchestrator is not
+restarted under it. When the orchestrator runs another version than the one a
+pi session loaded, that pi says so once, and `status` shows the running
+version with a note. The orchestrator exits about 10 s after all work ends,
+and the next start runs the new version. To switch sooner without stopping
+running calls:
+
+1. `drain`: running calls finish and nothing new starts in existing
+   workflows. A call waiting for your answer still counts as running, and a
+   workflow started after the drain is not held.
+2. Wait until `status` no longer shows the old version (about 10 s after the
+   last call ends).
+3. `resume` from a pi session started after the update.
+
+A `resume` before the old orchestrator exits keeps it running the old
+version, and a pi session started before the update still starts the old
+version; start a new one.
+
 ## What we do not promise
 
 - Call specs are checked strictly when a call is first proposed: an unknown or

package/dist/agent/child.js

@@ -98,6 +98,8 @@ export function registerChild(pi) {
                 return { action: 'defer' };
             if (req.kind === 'model') {
                 const body = req.body;
+                if (body?.exec !== undefined && body.exec !== exec)
+                    return { action: 'reject', reason: 'stale-execution' };
                 return body && ctx.modelRegistry.find(body.provider, body.model) ? { action: 'apply' } : { action: 'reject', reason: 'unknown-model' };
             }
             if (MESSAGES.includes(req.kind)) {

package/dist/agent/main/tool.js

@@ -44,7 +44,7 @@ function call(value, cwd, where) {
  *  (a follow-up's new generation runs on it). From the orchestrator ledger's `send-note`. */
 export function sendReceipt(ledger, rid) {
     const note = ledger.find(e => e.type === "send-note" && e.rid === rid);
-    return note ? { model: String(note.model), effect: String(note.effect) } : {};
+    return note ? { model: String(note.model), effect: String(note.effect), ...(note.pool ? { pool: String(note.pool) } : {}) } : {};
 }
 export function request(args, cwd) {
     // v12 §2: Infer run only when one launch form is present; never guess a control verb.

package/dist/agent/main.js

@@ -12,7 +12,7 @@ import { OsLock } from "../platform/lock.js";
 import { dsaHome, orchInbox, orchLedger, orchLock, outboxRoot } from "../paths.js";
 import { CT, JT } from "../types.js";
 import { attention, presentText, presented, resolved, unfinishedWorkflow } from "./main/snapshots.js";
-import { isLive, pausedElsewhere, statusBrief, statusCallDetail, statusCompactDetail, statusDetail, statusView, widOfRid } from "../orchestrator/snapshot.js";
+import { isLive, pausedElsewhere, runningOrchestrator, statusBrief, statusCallDetail, statusCompactDetail, statusDetail, statusView, widOfRid } from "../orchestrator/snapshot.js";
 import { parameters, request, sendReceipt } from "./main/tool.js";
 import { discoverAgents } from "../compat/agents.js";
 let noteSink;
@@ -89,6 +89,16 @@ export function registerMain(pi, ui) {
         await new Promise((resolve, reject) => { child.once("spawn", resolve); child.once("error", reject); });
         child.unref();
     }
+    // Version visibility: say once per orchestrator process when it runs another version than this pi loaded (after an
+    // update its running work stays on the old one); status shows the same note.
+    let versionTold;
+    function tellVersion() {
+        const { orchestrator, versionNote } = runningOrchestrator(home);
+        if (!versionNote || orchestrator === versionTold || !ctx?.hasUI)
+            return;
+        versionTold = orchestrator;
+        ctx.ui.notify(`Durable Subagents: ${versionNote}.`, "warning");
+    }
     function collect() { return ctx ? attention(home, sender, [...presented(ctx), ...reserved]) : []; }
     function message(items) {
         return { type: "custom_message", customType: CT.attention, content: items.map(presentText).join("\n"), display: true, details: { items } };
@@ -146,6 +156,12 @@ export function registerMain(pi, ui) {
         await outbox.republishPending();
         await starter();
         lastStarter = Date.now();
+        try {
+            tellVersion();
+        }
+        catch (error) {
+            console.error("durable-subagents:", error);
+        }
         timer = setInterval(() => {
             if (polling || stopped)
                 return;
@@ -156,6 +172,7 @@ export function registerMain(pi, ui) {
                 if (Date.now() - lastStarter >= 30_000) {
                     lastStarter = Date.now();
                     await starter();
+                    tellVersion();
                 }
                 await idle();
             }).catch(error => console.error("durable-subagents:", error)).finally(() => { polling = false; });
@@ -325,8 +342,8 @@ export function registerMain(pi, ui) {
             "Durable asynchronous subagents; run returns {wid} when created (or {submitted:{rid}} while pending). A finished workflow (its notice carries every agent's result) or a question wakes you, so after starting work end your turn: never poll with sleep or repeated status. Crash recovery resumes sessions, not external side effects. Background helper processes (orchestrator, evaluator) exit by themselves about 10 s after all work ends: never kill processes or delete files to 'clean up'. When the user quits pi, this session's running workflows pause (nothing is spent); resume continues them.",
             "run (action optional for exactly one launch form): agent+task; tasks:[call specs] parallel; chain:[call specs] sequential ({previous}); workflow:'./script.js' or source (runs.run(key,spec), runs.all([...]), emit(value), args, runs.input(name)). Optional name, cwd, usageBudget, maxCalls, inputs. With tasks/chain, top-level model, timeoutMs, budget, isolation, context, tools, skills, once are defaults for every step (a step's own value wins); a workflow/source script sets them per runs.run call. timeoutMs is milliseconds of active time (a number); omit it unless a hard limit is needed. Explicit unknown agents are rejected BEFORE creation, with available names; unknown script agents fail only their call.",
             "agents: list names, descriptions, default models and source for this cwd; use these names for run.",
-            "send to:'<wid>/<key>' (bare '<wid>' only for a single-call workflow): steer on a running call delivers at the next safe point (receipt in status/UI); a steer to a call waiting on its question interrupts the question and the subagent usually asks again — use answer to answer it; sealed → finished:<status> — use kind 'follow-up'. follow-up continues a sealed call as generation g+1 or queues after a running turn; follow-up model:'provider/id' runs that generation on it. answer: give the qid (or just the call, or nothing when one question is open); to and rev are filled in. A question that needs the user's decision goes to the user; if you answer one yourself, tell the user what you chose. model: a running call switches at its next provider request; an asking, hibernated or queued call launches on it when it runs again; the reply's model/effect (next-request|next-execution|next-generation) says which. status model = model actually used by the last request; switching = requested, not used yet; switchFailed = refused. A provider content refusal (ToS/usage policy) fails the call at once, not retried. Unknown targets list valid addresses. replaces:[rid] supersedes an earlier send.",
-            "stop target:<wid|<wid>/<key>> is terminal stopped (usage and partial edits kept); a sealed call → already-sealed:<status>, a finished workflow → terminal:<status>. drain holds existing workflows reversibly (new runs unaffected); resume [wid] releases held workflows. status: without wid, what runs, asks (with its answer address; hibernated:true holds no slot) or failed, finished workflows one line each, provider slots held/limit, the config in effect and providers whose usage window is used up (avoided until a probe finds them answering again); wid: one workflow, outputs clipped; wid+key: one call's full result; full:true: everything. A run's rid from {submitted:{rid}} works wherever a wid is expected. revise wid + workflow/source/args starts a revision.",
+            "send to:'<wid>/<key>' (bare '<wid>' only for a single-call workflow): steer on a running call delivers at the next safe point (receipt in status/UI); a steer to a call waiting on its question interrupts the question and the subagent usually asks again — use answer to answer it; sealed → finished:<status> — use kind 'follow-up'. follow-up continues a sealed call as generation g+1 or queues after a running turn; follow-up model:'provider/id' or a pool name runs that generation on it. answer: give the qid (or just the call, or nothing when one question is open); to and rev are filled in. A question that needs the user's decision goes to the user; if you answer one yourself, tell the user what you chose. model ('provider/id' or a pool name — its first model not used up): a running call switches at its next provider request; an asking, hibernated or queued call launches on it when it runs again; the reply's model/effect (next-request|next-execution|next-generation) says which. status model = model actually used by the last request; switching = requested, not used yet; switchFailed = refused. A provider content refusal (ToS/usage policy) fails the call at once, not retried. Unknown targets list valid addresses. replaces:[rid] supersedes an earlier send.",
+            "stop target:<wid|<wid>/<key>> is terminal stopped (usage and partial edits kept); a sealed call → already-sealed:<status>, a finished workflow → terminal:<status>. drain holds existing workflows reversibly (new runs unaffected); resume [wid] releases held workflows. status: without wid, what runs, asks (with its answer address; hibernated:true holds no slot) or failed, sharedWorktree names calls sharing observed edit/write roots (reminder only), finished workflows one line each, provider slots held/limit, the config in effect and providers whose usage window is used up (avoided until a probe finds them answering again), and the orchestrator version (versionNote when it differs from the loaded one); wid: one workflow, outputs clipped; wid+key: one call's full result; full:true: everything. A run's rid from {submitted:{rid}} works wherever a wid is expected. revise wid + workflow/source/args starts a revision.",
             "Control replies are {applied:true,rid} or {applied:false,reason,rid} when decided; otherwise {submitted:{rid}} after 10s.",
             ...(agents ? [`Available agents: ${agents}.`] : []),
             "User sees a summary line above the editor; ↓ on an empty editor (or /subagents) opens the list, Enter watches live OR finished calls (finished transcripts remain on disk) and expands finished workflows. List keys: s steer (paste-capable input), x stop (confirm y), m model, a answer when asked, f follow-up on finished calls; action feedback appears in footer.",

package/dist/cli/main.js

@@ -57,7 +57,7 @@ export function renderStatus(wf) {
     return [`${wf.wid}@${wf.rev}${wf.name ? ` ${wf.name}` : ""}: ${wf.status}${wf.error ? ` (${clip(wf.error, 300)})` : ""} · ${sealed}/${total} sealed${used ? ` · ${formatUsage(wf.usage)}` : ""}`,
         ...wf.calls.map(c => {
             const last = c.result?.output?.split("\n").map(l => l.trim()).filter(Boolean).at(-1), err = c.result?.error;
-            return `  ${c.key}@${c.gen} ${c.result?.status ?? c.phase}${c.model ? ` ${c.model}` : ""}${c.tools ? ` tools:${c.tools}` : ""}${c.usage && (c.usage.input || c.usage.output) ? ` ${formatUsage(c.usage)}` : ""}${last ? ` ${JSON.stringify(clip(last, 160))}` : err ? ` (${clip(err, 160)})` : ""}`;
+            return `  ${c.key}@${c.gen} ${c.result?.status ?? c.phase}${c.model ? ` ${c.model}` : ""}${c.tools ? ` tools:${c.tools}` : ""}${c.usage && (c.usage.input || c.usage.output) ? ` ${formatUsage(c.usage)}` : ""}${last ? ` ${JSON.stringify(clip(last, 160))}` : err ? ` (${clip(err, 160)})` : ""}${c.sharedWorktree ? ` (shares worktree with ${c.sharedWorktree.join(", ")})` : ""}`;
         }),
         ...wf.attention.map(a => `  ${a.kind}: ${JSON.stringify(clip(a.text, 300))}`),
         ...(wf.scriptLog ? [`  script log: ${wf.scriptLog}`] : [])].join("\n");
@@ -65,13 +65,13 @@ export function renderStatus(wf) {
 /** P25, T10: Render the compact status projection shared with the `subagents` tool. */
 export function renderView(view) {
     const lines = view.workflows.map(w => [`${w.wid}@${w.rev}${w.name ? ` ${w.name}` : ""}: ${w.status}${w.followUps ? " (follow-up running)" : ""}${w.error ? ` (${clip(w.error, 200)})` : ""} · ${w.done}/${w.planned ?? w.calls.length}${w.planned === undefined && w.status === "running" ? "+" : ""} done${w.usage.input || w.usage.output || w.usage.costUsd ? ` · ${formatUsage(w.usage)}` : ""}`,
-        ...w.calls.map(c => `  ${c.key}@${c.gen} ${c.status ?? c.phase}${c.hibernated ? " (hibernated, no slot)" : ""}${c.model ? ` ${c.model}` : ""}${c.switching ? ` → ${c.switching} (requested)` : ""}${c.switchFailed ? ` (switch refused: ${c.switchFailed})` : ""}${c.tools ? ` tools:${c.tools}` : ""}${c.usage ? ` ${formatUsage(c.usage)}` : ""}${c.lastLine ? ` ${JSON.stringify(c.lastLine)}` : c.error ? ` (${c.error})` : ""}`),
+        ...w.calls.map(c => `  ${c.key}@${c.gen} ${c.status ?? c.phase}${c.hibernated ? " (hibernated, no slot)" : ""}${c.model ? ` ${c.model}` : ""}${c.switching ? ` → ${c.switching} (requested)` : ""}${c.switchFailed ? ` (switch refused: ${c.switchFailed})` : ""}${c.tools ? ` tools:${c.tools}` : ""}${c.usage ? ` ${formatUsage(c.usage)}` : ""}${c.lastLine ? ` ${JSON.stringify(c.lastLine)}` : c.error ? ` (${c.error})` : ""}${c.sharedWorktree ? ` (shares worktree with ${c.sharedWorktree.join(", ")})` : ""}`),
         ...w.attention.map(a => `  ${a.kind}: ${JSON.stringify(a.text.split("\n")[0])}`)].join("\n"));
     if (view.paused)
         lines.unshift(`${view.paused} (pi-durable-subagents resume)`);
     if (view.olderFinished)
         lines.push(`(+${view.olderFinished} older finished workflows; status <wid> shows one in detail)`);
-    const footer = [view.slots?.length ? `slots: ${view.slots.join(", ")}` : "", view.config ? `config: ${view.config}` : "", view.configRejected ? `config.json rejected: ${view.configRejected}` : "", ...(view.exhausted ?? [])].filter(Boolean);
+    const footer = [view.slots?.length ? `slots: ${view.slots.join(", ")}` : "", view.config ? `config: ${view.config}` : "", view.configRejected ? `config.json rejected: ${view.configRejected}` : "", view.orchestrator ? `orchestrator: ${view.orchestrator}` : "", ...(view.exhausted ?? []), view.versionNote ? `note: ${view.versionNote}` : ""].filter(Boolean);
     if (!lines.length)
         lines.push("No workflows");
     return [...lines, ...footer].join("\n");

package/dist/orchestrator/engine.js

@@ -331,7 +331,9 @@ export class Engine {
             const seal = wf.journal.entries().find(e => e.type === JT.sealed && e.call === from);
             if (seal && send.kind === 'steer')
                 return { action: 'reject', reason: `finished:${seal.result.status} — use kind "follow-up" to continue it` };
-            if (send.kind === 'follow-up' && send.model !== undefined) {
+            // A pool's name is a model too: the call keeps the pool, and its order and failover apply to the new generation.
+            const pools = this.ledgers.config.pools, pool = send.model !== undefined && pools && Object.hasOwn(pools, send.model);
+            if (send.kind === 'follow-up' && send.model !== undefined && !pool) {
                 try {
                     if (!parseModel(send.model).provider)
                         throw new Error('missing provider');
@@ -346,7 +348,7 @@ export class Engine {
                 const spec = send.model !== undefined ? { ...entry.spec, model: send.model } : entry.spec;
                 if (send.model !== undefined)
                     await this.note(req.rid, send.model, 'next-generation');
-                const opened = await wf.journal.append('generation', { rid: req.rid, key: entry.key, gen, from, spec, revision: wf.revision, opening: { rid: req.rid, kind: send.kind, message: send.message ?? '' }, ...(send.model !== undefined ? { model: send.model } : {}) });
+                const opened = await wf.journal.append('generation', { rid: req.rid, key: entry.key, gen, from, spec, revision: wf.revision, opening: { rid: req.rid, kind: send.kind, message: send.message ?? '' }, ...(send.model !== undefined && !pool ? { model: send.model } : {}) });
                 this.dispatchGeneration(wf, opened);
                 return { action: 'apply' };
             }

package/dist/orchestrator/executor/index.js

@@ -30,9 +30,12 @@ import { availableMemory } from "./memory.js";
 import { reached, sessionUsage, totalUsage } from "./usage.js";
 import { recordFenceFailure, resolveFenceAttention, serialContainment, skipLostCandidate, sweepExecutions } from "./sweep.js";
 import { gateRetired } from "./effects/gate.js";
+import { WorktreeIndex, worktreeCalls, worktreeLabel, worktreePair, worktreeRoots } from "./worktree.js";
 const MEM_RECORD_MS = 30000;
 /** A4, P29: A child admitted within this window may not show in MemAvailable yet; its share is reserved explicitly. */
 const MEM_WARMUP_MS = 30000;
+/** Quota refusals in a row that find a provider's usage window used up while pi is still retrying. */
+const QUOTA_REFUSALS = 2;
 const ignoreMissing = (error) => { if (error.code !== "ENOENT")
     throw error; };
 const callOf = (exec) => exec.slice(0, exec.lastIndexOf("#"));
@@ -60,7 +63,8 @@ export function requestedModel(journal, call, followUp) {
             wanted = m;
     }
     for (const [index, e] of all.entries()) {
-        if (e.type !== "forward" || e.dest !== call || e.envelope?.kind !== "model")
+        // A failover's switch is not a request: an execution that ends before applying it leaves the choice to the pool.
+        if (e.type !== "forward" || e.dest !== call || e.envelope?.kind !== "model" || e.failover)
             continue;
         const delivered = all.find(r => r.type === "forward-delivered" && r.call === call && r.rid2 === e.rid2);
         if (delivered) {
@@ -299,9 +303,9 @@ export default function createExecutor(ledgers, options = {}) {
     }
     /** P7, P27: Record forward-delivered once when a forward's child receipt is first observed; serial sections only. */
     /** The reply to a model send says which model and when it applies (orchestrator ledger `send-note`, once per rid). */
-    async function note(rid, model, effect) {
+    async function note(rid, model, effect, pool) {
         if (!orch.entries().some(e => e.type === "send-note" && e.rid === rid))
-            await orch.append("send-note", { rid, model, effect });
+            await orch.append("send-note", { rid, model, effect, ...(pool ? { pool } : {}) });
     }
     async function forwardsDelivered(journal, call, entries) {
         const all = journal.entries();
@@ -350,7 +354,54 @@ export default function createExecutor(ledgers, options = {}) {
             await t.journal.append(JT.attention, { item: { id, rev: 1, kind: "budget", text: "Workflow budget reached", wid: t.wid } });
         return hit;
     }
+    const roots = worktreeRoots(), writes = new WorktreeIndex();
+    const indexed = () => writes.scan(journals.values());
+    const origin = (w) => writes.origin(w.journal) ?? orch.entries().find(e => e.type === JT.created && e.wid === address(w.call).wid)?.origin;
+    // Serial sections only: wrote and attention are durable before another writer or seal can interleave.
+    /** Remind of every pair of calls that wrote in `root` and have not ended, once per pair and journal. The index must be
+     *  current; each append here is indexed at once (only that journal is read). */
+    async function remind(root) {
+        const live = writes.live(root);
+        for (let i = 0; i < live.length; i++)
+            for (let k = i + 1; k < live.length; k++) {
+                const [first, second] = WorktreeIndex.order(live[i], live[k]), id = worktreePair(first.call, second.call);
+                // A retry after a partial cross-workflow append keeps the reminder (and its writer) as first written.
+                const prior = writes.reminder(id), secondWid = address(second.call).wid;
+                const targets = origin(first) === origin(second) ? [prior && prior.wid !== secondWid ? first : second] : [second, first];
+                const item = prior ?? { id, rev: 1, kind: "conflict", call: second.call, wid: secondWid,
+                    text: `${worktreeLabel(first.call)} and ${worktreeLabel(second.call)} both write in ${root} (edit/write seen); assign one owner or move one to its own worktree` };
+                for (const target of targets)
+                    if (!writes.remindedIn(id, target.journal)) {
+                        await target.journal.append(JT.attention, { item: { ...item, wid: address(target.call).wid } });
+                        writes.scan([target.journal]);
+                    }
+            }
+    }
+    async function wrote(t, exec, cwd, path) {
+        const root = await roots(cwd, path);
+        if (!root)
+            return;
+        await serial(async () => {
+            if (sealed(t.journal, t.callId) || has(t.journal, JT.fenced, exec) || current(t.journal, t.callId) !== exec)
+                return;
+            if (indexed().has(exec, root))
+                return;
+            const after = writes.live(root).map(w => w.call).filter(c => c !== t.callId);
+            await t.journal.append("wrote", { exec, root, ...(after.length ? { after } : {}) });
+            writes.scan([t.journal]);
+            await remind(root);
+        });
+    }
+    /** Close the reminders of pairs where `call` (or, without one, any participant) ended. */
+    async function resolveWorktrees(call) {
+        for (const { id, journal, item } of indexed().open()) {
+            const pair = worktreeCalls(id);
+            if (call ? pair.includes(call) : pair.some(c => writes.ended(c)))
+                await journal.append(JT.attentionResolved, { id, rev: item.rev, resolution: "ended" });
+        }
+    }
     async function retireAttention(journal, call) {
+        await resolveWorktrees(call);
         for (const { item } of attentionEntries(journal.entries())) {
             if (item.kind === "finished" || item.id === `unknown:${call}` || item.id.startsWith("fence:"))
                 continue;
@@ -443,7 +494,7 @@ export default function createExecutor(ledgers, options = {}) {
                 const decision = await decide(), models = decision.candidates, pool = decision.pool;
                 continuation = decision.continuation;
                 for (const model of models) {
-                    if (!continuation && pool && skipped(pool, model))
+                    if (!continuation && pool && models.length > 1 && skipped(pool, model))
                         continue;
                     const provider = model.provider;
                     if (unavailable(provider))
@@ -511,14 +562,19 @@ export default function createExecutor(ledgers, options = {}) {
         const candidate = recorded && candidates.some(m => m.provider === recorded.provider && m.id === recorded.id);
         // Leave the session's model for the pool's others when its pool skips it after losses, or its provider's usage
         // window is used up; and at a new generation, go back to the pool's order of preference.
-        const skip = pool && candidate && (previous && ownSegment && skipped(pool, recorded) || unavailable(recorded.provider) || !ownSegment && !!t.continueFrom);
+        // A new generation of a pool call starts from the pool also when the session's model is not one of its models
+        // (switched outside it, or the follow-up named the pool).
+        const skip = pool && (candidate ? previous && ownSegment && skipped(pool, recorded) || unavailable(recorded.provider) || !ownSegment && !!t.continueFrom
+            : !ownSegment && !!t.continueFrom);
         // A model the call was asked to use replaces the session's: launched with it, and holding its provider's slot.
         const wanted = requestedModel(t.journal, t.callId, t.model);
         // It outranks the pool's order at a new generation too, also when it names the model the session already has.
+        // A requested model of the call's own pool keeps the pool: a used-up window still moves the call on.
+        const keep = pool && candidates.some(m => m.provider === wanted?.provider && m.id === wanted?.id) ? pool : undefined;
         if (wanted)
             return recorded && !freshFork && recorded.provider === wanted.provider && recorded.id === wanted.id
-                ? { candidates: [recorded], continuation: true, pool: undefined }
-                : { candidates: [wanted], continuation: false, pool: undefined };
+                ? { candidates: [recorded], continuation: true, pool: keep }
+                : { candidates: [wanted], continuation: false, pool: keep };
         if (recorded && !freshFork && !skip)
             return { candidates: [recorded], continuation: true, pool: candidate ? pool : undefined };
         return { candidates, continuation: false, pool };
@@ -586,15 +642,87 @@ export default function createExecutor(ledgers, options = {}) {
         // While a probe runs, its outcome alone decides: a late refusal of an execution admitted earlier changes nothing.
         if (x && (x.probe ? x.probe !== exec : now < x.nextTry))
             return;
-        if (orch.entries().some(e => e.type === "provider-exhausted" && e.exec === exec))
+        // Once per execution and provider: an execution moved on by failover can find a second provider used up too.
+        if (orch.entries().some(e => e.type === "provider-exhausted" && e.exec === exec && e.provider === provider))
             return;
         await orch.append("provider-exhausted", { provider, exec, since: x?.since ?? now, nextTry: now + (config.k?.probeMs ?? 900_000), error: error.slice(0, 300) });
     }
+    /** Quota refusals in a row per execution, from one provider (pi retries a refused request on its own). */
+    const refusals = new Map();
+    /** A used-up window shows while pi still retries: the second refusal in a row (the first for a probe) finds the
+     *  provider used up, and a call launched from a pool switches to the pool's next model at its next request. */
+    async function refused(t, exec, provider, error) {
+        if (!quotaExhausted(error))
+            return;
+        const last = refusals.get(exec), count = last?.provider === provider ? last.count + 1 : 1;
+        refusals.set(exec, { provider, count });
+        const probe = folded().exhausted.get(provider)?.probe === exec;
+        if (count < (probe ? 1 : QUOTA_REFUSALS))
+            return;
+        await serial(async () => {
+            if (has(t.journal, JT.fenced, exec) || current(t.journal, t.callId) !== exec)
+                return;
+            await recordExhausted(provider, exec, error);
+            await failover(t, exec, provider);
+        });
+        wake();
+    }
+    /** Switch a running execution off a used-up provider: to the first model of its pool on another provider that is
+     *  neither used up nor full, reserving that slot as a requested switch does. Without one, pi's retries go on and
+     *  the call waits for the provider once they end. */
+    async function failover(t, exec, provider) {
+        if (pendingSwitch(exec))
+            return;
+        const pool = t.journal.entries().findLast(e => e.type === "selected" && e.exec === exec)?.pool, pools = settings().pools;
+        if (!pool || !pools?.[pool])
+            return;
+        let models;
+        try {
+            models = resolveModel(pool, pools);
+        }
+        catch {
+            return;
+        }
+        for (const m of models) {
+            if (!m.provider || m.provider === provider || unavailable(m.provider) || skipped(pool, m))
+                continue;
+            const rid = contentHash([exec, "failover", provider]);
+            if (t.journal.entries().some(e => e.type === "forward" && e.rid === rid))
+                return;
+            const probe = folded().exhausted.has(m.provider); // its next try is due (`unavailable` said so): this is its probe
+            if (!await reserveSwitch(exec, m.provider, rid))
+                continue;
+            if (probe)
+                await orch.append("provider-probe", { provider: m.provider, exec });
+            // Bound to this execution: replayed after it ended, a later execution (which chose its model at launch) refuses it.
+            const body = { provider: m.provider, model: m.id, ...(m.thinking ? { thinking: m.thinking } : {}), exec };
+            const envelope = { to: t.callId, kind: "model", body }, hash = contentHash(envelope);
+            const entry = await t.journal.append("forward", { rid, rid2: forwardRid(rid, t.callId.slice(0, t.callId.indexOf("/")), t.key, hash), dest: t.callId, hash, envelope, failover: provider });
+            await replayForward(entry);
+            return;
+        }
+    }
+    /** Hold a slot of `provider` for a running execution's switch, unless it holds one; false when it is full. */
+    async function reserveSwitch(exec, provider, rid) {
+        if (holdings().some(h => h.exec === exec && h.pool === provider))
+            return true;
+        const target = holdings().filter(h => h.pool === provider);
+        if (!capacity({ kind: "provider", holders: target.length, capacity: settings().providers?.[provider]?.slots ?? Infinity }))
+            return false;
+        let slot = 0;
+        while (target.some(h => h.slot === slot))
+            slot++;
+        await orch.append("hold", { pool: provider, slot, exec, reserved: true, rid });
+        return true;
+    }
     /** An answer from a used-up provider, requested after it was found used up: available again. */
-    async function answered(exec, event) {
+    async function answered(t, exec, event) {
         const message = event.message, provider = message?.provider;
-        if (message?.role !== "assistant" || !provider || message.stopReason === "error")
+        if (message?.role !== "assistant" || !provider)
             return;
+        if (message.stopReason === "error")
+            return refused(t, exec, provider, String(message.errorMessage ?? ""));
+        refusals.delete(exec);
         await serial(async () => {
             const x = folded().exhausted.get(provider);
             if (x && (x.probe === exec || Number(message.timestamp) > x.since))
@@ -787,7 +915,8 @@ export default function createExecutor(ledgers, options = {}) {
                             }
                         });
                     }, recordUsage: values => recordUsage(t, values),
-                    switched: event => switched(exec, journal, event), answered: event => answered(exec, event), pendingSwitch: () => pendingSwitch(exec),
+                    wrote: path => wrote(t, exec, cwd, path),
+                    switched: event => switched(exec, journal, event), answered: event => answered(t, exec, event), pendingSwitch: () => pendingSwitch(exec),
                 });
             }
             finally {
@@ -810,7 +939,12 @@ export default function createExecutor(ledgers, options = {}) {
             journals.set(ticket.wid, ticket.journal);
             const a = { ticket, controller: new AbortController(), stopped: false, wake: () => { }, promise: undefined, onPark: new Set() };
             active.set(ticket.callId, a);
-            a.promise = execute(a).catch(error => {
+            a.promise = serial(async () => {
+                // Repair a crash between wrote and attention (or between the two origin journals).
+                for (const root of indexed().contested())
+                    await remind(root);
+                await resolveWorktrees();
+            }).then(() => execute(a)).catch(error => {
                 completed.delete(ticket.callId);
                 if (a.retired || ticket.journal.entries().some(e => e.type === "retired" && e.call === ticket.callId))
                     return buildCallResult({ key: ticket.key, gen: ticket.gen, status: "stopped", output: "", error: "retired" });
@@ -827,6 +961,9 @@ export default function createExecutor(ledgers, options = {}) {
                     for (const e of inUse.keys())
                         if (callOf(e) === ticket.callId)
                             inUse.delete(e);
+                    for (const e of refusals.keys())
+                        if (callOf(e) === ticket.callId)
+                            refusals.delete(e);
                     forgetSession(callSession(home, ticket.wid, ticket.key, ticket.gen));
                     wake();
                 }
@@ -877,6 +1014,28 @@ export default function createExecutor(ledgers, options = {}) {
                 /** P12: a model request to this call, recorded with the rid given; a reject has no effect. */
                 const requestModel = async (rid, model, hash, cond) => {
                     let body;
+                    const exec = current(ctx.journal, dest);
+                    // P28: with no live execution (not started yet, between executions, hibernated while asking) the model is
+                    // recorded and the next execution launches on it (`requestedModel`); its slot is acquired then, as for any launch.
+                    const idle = !exec || has(ctx.journal, JT.fenced, exec) || !has(ctx.journal, "selected", exec);
+                    // A pool's name asks for its first model that can take the call now: provider not used up, and (for a running
+                    // call) a free slot. The call's own pool stays, so a used-up window later moves it on as before.
+                    const pools = settings().pools, pool = pools && Object.hasOwn(pools, model) ? model : undefined;
+                    if (pool) {
+                        let models;
+                        try {
+                            models = resolveModel(pool, pools);
+                        }
+                        catch {
+                            return { action: "reject", reason: "unknown-model" };
+                        }
+                        const free = (p) => idle || holdings().some(h => h.exec === exec && h.pool === p) ||
+                            capacity({ kind: "provider", holders: holdings().filter(h => h.pool === p).length, capacity: settings().providers?.[p]?.slots ?? Infinity });
+                        const m = models.find(m => m.provider && !unavailable(m.provider) && free(m.provider));
+                        if (!m)
+                            return { action: "reject", reason: "pool-unavailable" };
+                        model = `${m.provider}/${m.id}${m.thinking ? `:${m.thinking}` : ""}`;
+                    }
                     try {
                         const m = parseModel(model);
                         if (!m.provider)
@@ -888,28 +1047,14 @@ export default function createExecutor(ledgers, options = {}) {
                     }
                     const envelope = { to: dest, kind: "model", body, ...(cond && Object.keys(cond).length ? { cond } : {}) };
                     const rid2 = forwardRid(rid, ctx.widRev, ctx.key, hash);
-                    const exec = current(ctx.journal, dest), provider = body.provider;
-                    // P28: with no live execution (not started yet, between executions, hibernated while asking) the model is
-                    // recorded and the next execution launches on it (`requestedModel`); its slot is acquired then, as for any launch.
                     // Launching (`selected`, not `tracked` yet): the child may start on the old model; ask again in a moment.
-                    const idle = !exec || has(ctx.journal, JT.fenced, exec) || !has(ctx.journal, "selected", exec);
                     if (!idle && !has(ctx.journal, "tracked", exec))
                         return { action: "reject", reason: "call-starting" };
                     if (!idle && pendingSwitch(exec))
                         return { action: "reject", reason: "switch-pending" };
-                    if (!idle) {
-                        const held = holdings().filter(h => h.exec === exec);
-                        if (!held.some(h => h.pool === provider)) {
-                            const target = holdings().filter(h => h.pool === provider);
-                            if (!capacity({ kind: "provider", holders: target.length, capacity: settings().providers?.[provider]?.slots ?? Infinity }))
-                                return { action: "reject", reason: "provider-full" };
-                            let slot = 0;
-                            while (target.some(h => h.slot === slot))
-                                slot++;
-                            await orch.append("hold", { pool: provider, slot, exec, reserved: true, rid });
-                        }
-                    }
-                    await note(req.rid, model, idle ? "next-execution" : "next-request");
+                    if (!idle && !await reserveSwitch(exec, body.provider, rid))
+                        return { action: "reject", reason: "provider-full" };
+                    await note(req.rid, model, idle ? "next-execution" : "next-request", pool);
                     const entry = await ctx.journal.append("forward", { rid, rid2, dest, hash, envelope });
                     await replayForward(entry);
                     if (idle) {
@@ -1005,6 +1150,7 @@ export default function createExecutor(ledgers, options = {}) {
         },
         async recover(wid, journal) {
             journals.set(wid, journal);
+            await serial(() => resolveWorktrees());
             await effects.recover(journal);
             for (const e of journal.entries().filter(e => e.type === JT.exec)) {
                 // F1: an exec whose fence fails stays unfenced and holding; its call parks until a sweep retires it.

package/dist/orchestrator/executor/observe.js

@@ -123,6 +123,9 @@ export async function observeExecution(d) {
             event.type === "message_end" && message?.stopReason !== "error" && (message?.usage?.output ?? 0) > 0)
             progress = performance.now();
         enqueue(async () => {
+            const args = event.args;
+            if (event.type === "tool_execution_start" && (event.toolName === "edit" || event.toolName === "write") && typeof args?.path === "string")
+                await d.wrote?.(args.path);
             const slim = observation(event);
             if (slim) {
                 await serial(() => t.journal.append("observation", { exec, event: slim }));

package/dist/orchestrator/executor/worktree.js

@@ -0,0 +1,152 @@
+import { lstat, realpath } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { JT, isEntry } from "../../types.js";
+const UNICODE_SPACES = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g;
+/** The file an edit/write tool call names, resolved as pi's tools resolve it (`resolveToCwd`): unicode spaces, an `@`
+ *  prefix, `~` and file URLs. */
+export function toolPath(cwd, input) {
+    let path = input.replace(UNICODE_SPACES, " ");
+    if (path.startsWith("@"))
+        path = path.slice(1);
+    if (path === "~")
+        path = homedir();
+    else if (path.startsWith("~/"))
+        path = join(homedir(), path.slice(2));
+    else if (/^file:\/\//.test(path))
+        path = fileURLToPath(path);
+    return resolve(cwd, path);
+}
+/** The worktree an observed edit/write path is in: the nearest real ancestor directory holding `.git` (a directory, or
+ *  a file in a linked worktree), for files and parent directories not created yet too. No git process and no cache: a
+ *  repository made inside another while calls run is seen at once; each lookup is a few `lstat`s. */
+export function worktreeRoots() {
+    return async (cwd, path) => {
+        // A path pi's tool cannot use either (e.g. a file URL with a host) is no evidence; the tool reports it to the agent.
+        let dir;
+        try {
+            dir = dirname(toolPath(cwd, path));
+        }
+        catch {
+            return;
+        }
+        for (;;) {
+            try {
+                dir = await realpath(dir);
+                break;
+            }
+            catch (error) {
+                if (!["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
+                    return;
+                const parent = dirname(dir);
+                if (parent === dir)
+                    return;
+                dir = parent;
+            }
+        }
+        for (;;) {
+            try {
+                await lstat(join(dir, ".git"));
+                return dir;
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    return;
+            }
+            const parent = dirname(dir);
+            if (parent === dir)
+                return;
+            dir = parent;
+        }
+    };
+}
+/** Pair identity is durable; it also lets readers and seal recovery identify both participants. */
+export const worktreePair = (a, b) => `worktree:${[a, b].sort().join("|")}`;
+export const worktreeCalls = (id) => id.startsWith("worktree:") ? id.slice(9).split("|") : [];
+export const worktreeLabel = (call) => call.replace(/@\d+\//, "/").replace(/@\d+$/, "");
+const callOf = (exec) => exec.slice(0, exec.lastIndexOf("#"));
+/** What the journals say about observed writes, kept up to date incrementally (each journal entry is read once):
+ *  the first `wrote` of each call per worktree, calls that ended (sealed or retired), the conflict reminders written and
+ *  whether each is still open, and each workflow's origin. Participants come from the journals, not from the calls
+ *  running now: a paused call that wrote still counts until it ends. */
+export class WorktreeIndex {
+    scanned = new Map();
+    /** Writers per root that have not ended; a root is dropped when its last writer ends. */
+    byRoot = new Map();
+    callRoots = new Map();
+    execRoots = new Set();
+    endedCalls = new Set();
+    reminders = new Map();
+    origins = new Map();
+    scan(journals) {
+        for (const journal of journals) {
+            const entries = journal.entries();
+            for (let i = this.scanned.get(journal) ?? 0; i < entries.length; i++)
+                this.apply(journal, entries[i]);
+            this.scanned.set(journal, entries.length);
+        }
+        return this;
+    }
+    apply(journal, e) {
+        if (e.type === "wrote" && typeof e.exec === "string" && typeof e.root === "string") {
+            const call = callOf(e.exec);
+            this.execRoots.add(`${e.exec}\0${e.root}`);
+            if (this.endedCalls.has(call))
+                return;
+            const calls = this.byRoot.get(e.root) ?? new Map();
+            this.byRoot.set(e.root, calls);
+            if (!calls.has(call))
+                calls.set(call, { call, journal, ...(Array.isArray(e.after) ? { after: e.after.map(String) } : {}) });
+            const roots = this.callRoots.get(call) ?? new Set();
+            roots.add(e.root);
+            this.callRoots.set(call, roots);
+        }
+        else if (e.type === JT.sealed || e.type === "retired") {
+            const call = String(e.call);
+            this.endedCalls.add(call);
+            for (const root of this.callRoots.get(call) ?? []) {
+                const calls = this.byRoot.get(root);
+                calls?.delete(call);
+                if (calls && !calls.size)
+                    this.byRoot.delete(root);
+            }
+            this.callRoots.delete(call);
+        }
+        else if (e.type === "wf-created")
+            this.origins.set(journal, e.origin);
+        else if (isEntry(e, JT.attention) && e.item?.kind === "conflict") {
+            const held = this.reminders.get(e.item.id) ?? new Map();
+            this.reminders.set(e.item.id, held);
+            if (!held.has(journal))
+                held.set(journal, { item: e.item, open: true });
+        }
+        else if (e.type === JT.attentionResolved && typeof e.id === "string" && e.id.startsWith("worktree:")) {
+            const held = this.reminders.get(e.id)?.get(journal);
+            if (held)
+                held.open = false;
+        }
+    }
+    has(exec, root) { return this.execRoots.has(`${exec}\0${root}`); }
+    ended(call) { return this.endedCalls.has(call); }
+    /** Roots where two or more calls that have not ended wrote: the only ones a reminder can be due for. */
+    contested() { return [...this.byRoot].filter(([, calls]) => calls.size > 1).map(([root]) => root); }
+    /** Calls that wrote in `root` and have not ended. */
+    live(root) { return [...this.byRoot.get(root)?.values() ?? []]; }
+    origin(journal) { return this.origins.get(journal); }
+    /** The reminder of a pair as first written (another journal may still lack its copy after a crash). */
+    reminder(id) { return this.reminders.get(id)?.values().next().value?.item; }
+    remindedIn(id, journal) { return this.reminders.get(id)?.has(journal) ?? false; }
+    open() {
+        return [...this.reminders].flatMap(([id, held]) => [...held].filter(([, r]) => r.open).map(([journal, r]) => ({ id, journal, item: r.item })));
+    }
+    /** First and second writer of a pair, from the journals: a write records the calls that had written there before it
+     *  (`after`), so the order survives a crash before the reminder; writes without it are ordered by call id. */
+    static order(x, y) {
+        if (y.after?.includes(x.call))
+            return [x, y];
+        if (x.after?.includes(y.call))
+            return [y, x];
+        return x.call < y.call ? [x, y] : [y, x];
+    }
+}

package/dist/orchestrator/ledger.js

@@ -5,6 +5,7 @@
 //   provider-*: used-up usage windows (providers.ts).
 //   config{hash,config}: the orchestrator settings in effect from here; config-rejected{error,hash?}: a change of
 //     config.json refused, while the earlier settings stay (cleared by the next config record).
+//   orchestrator{version,pid} / orchestrator-exit{pid}: the orchestrator running (its package version) and its exit.
 import { foldExhaustion } from "./providers.js";
 import { isEntry } from "../types.js";
 export function emptyLedger() {
@@ -29,6 +30,12 @@ export function applyLedger(state, e) {
     }
     else if (isEntry(e, "config-rejected"))
         state.rejected = { error: String(e.error), ts: e.ts };
+    else if (isEntry(e, "orchestrator"))
+        state.orchestrator = { version: String(e.version), pid: Number(e.pid), ...(e.start ? { start: String(e.start) } : {}), ts: e.ts };
+    else if (isEntry(e, "orchestrator-exit")) {
+        if (state.orchestrator?.pid === e.pid)
+            state.orchestrator.exited = true;
+    }
     foldExhaustion(state.exhausted, e);
 }
 /** Fold the entries appended since `state` was last folded (the ledger only grows); a ledger that is not the one
@@ -36,7 +43,7 @@ export function applyLedger(state, e) {
 export function foldLedger(state, entries) {
     // Journal readers keep the entry objects of a ledger as it grows (kernel/journal.ts), so identity tells them apart.
     if (state.seen && entries[state.seen - 1] !== state.last)
-        Object.assign(state, emptyLedger(), { config: undefined, rejected: undefined, last: undefined });
+        Object.assign(state, emptyLedger(), { config: undefined, rejected: undefined, orchestrator: undefined, last: undefined });
     for (; state.seen < entries.length; state.seen++)
         applyLedger(state, entries[state.seen]);
     state.last = entries[state.seen - 1];

package/dist/orchestrator/main.js

@@ -13,8 +13,10 @@ import { join, resolve } from 'node:path';
 import { dsaHome, orchLedger, orchLock } from "../paths.js";
 import { openJournal } from "../kernel/journal.js";
 import { OsLock } from "../platform/lock.js";
+import { captureStart } from "../platform/proctable.js";
 import { Engine } from "./engine.js";
 import { configPath, configProblem, configStamp, recordConfig, stampedConfig, watchConfig } from "./config.js";
+import { packageVersion } from "../version.js";
 /** P2, C4, K6: Acquire the single authority before opening ledgers, recover, and idle-exit. */
 export async function main(options = {}) {
     const home = options.home ?? dsaHome();
@@ -36,6 +38,10 @@ export async function main(options = {}) {
             config = raw;
         }
         ledgers = { home, config, orch: await openJournal(orchLedger(home)) };
+        // Which version runs is visible to every pi session (status; a notice when it differs from the one pi loaded).
+        // `start` (Linux) tells this process from a later one given the same pid after a crash.
+        const start = await captureStart(process.pid).catch(() => '');
+        await ledgers.orch.append('orchestrator', { version: packageVersion(), pid: process.pid, ...(start ? { start } : {}) });
         const factory = options.executor ?? (await import(__rewriteRelativeImportExtension(new URL(import.meta.url.endsWith('.ts') ? './executor/index.ts' : './executor/index.js', import.meta.url).href))).default;
         const executor = factory(ledgers);
         engine = new Engine(ledgers, executor, options);
@@ -56,6 +62,7 @@ export async function main(options = {}) {
         }
         finally {
             try {
+                await ledgers?.orch.append('orchestrator-exit', { pid: process.pid }).catch(() => { });
                 await ledgers?.orch.close();
             }
             finally {

package/dist/orchestrator/snapshot.js

@@ -7,6 +7,8 @@ import { readJournalSnapshot } from "../kernel/journal.js";
 import { journalPath, orchLedger, pinnedDir, workflowDir } from "../paths.js";
 import { JT, isEntry } from "../types.js";
 import { emptyLedger, foldLedger } from "./ledger.js";
+import { packageVersion } from "../version.js";
+import { worktreeCalls, worktreeLabel } from "./executor/worktree.js";
 /** A workflow has live work: it runs, or follow-ups opened on it after it finished have not ended yet. */
 export function isLive(wf) {
     return wf.status === "running" || (wf.followUps ?? 0) > 0;
@@ -230,6 +232,12 @@ function snapshotReducer(wid, entries) {
         const list = structuredClone([...calls.values()]);
         const openAttention = structuredClone(attention.filter(item => !resolved.has(`${item.id}@${item.rev}`)));
         for (const item of openAttention) {
+            if (item.kind === "conflict") {
+                const pair = worktreeCalls(item.id);
+                for (const c of list)
+                    if (pair.includes(c.callId))
+                        c.sharedWorktree = [...new Set([...(c.sharedWorktree ?? []), ...pair.filter(id => id !== c.callId).map(worktreeLabel)])].sort();
+            }
             const call = item.kind === "question" ? list.find(c => item.id.startsWith(`q:${c.callId}:`)) : undefined;
             if (call && (call.phase === "running" || call.phase === "queued"))
                 call.phase = "asking"; // a hibernated asker is fenced
@@ -253,7 +261,7 @@ function snapshotReducer(wid, entries) {
                 const pending = forwarded.filter(pendingMessage).length;
                 if (pending)
                     c.pending = pending;
-                const last = c.phase !== "sealed" && !retired.has(c.callId) ? forwarded.findLast(s => s.kind === "model" && s.reason !== "withdrawn") : undefined;
+                const last = c.phase !== "sealed" && !retired.has(c.callId) ? forwarded.findLast(s => s.kind === "model" && s.reason !== "withdrawn" && s.reason !== "stale-execution") : undefined;
                 if (last?.reason !== undefined)
                     c.switchFailed = `${last.model} (${last.reason})`;
                 else if (last && last.state !== "retired" && last.model !== c.model?.replace(/:(off|minimal|low|medium|high|xhigh|max)$/, ""))
@@ -420,6 +428,7 @@ export function compactWorkflow(wf) {
         calls: wf.calls.map(c => {
             const r = c.result, last = r?.output?.split("\n").map(l => l.trim()).filter(Boolean).at(-1);
             return { key: c.key, gen: c.gen, callId: c.callId, phase: c.phase, ...(r ? { status: r.status, ok: r.ok } : {}),
+                ...(c.sharedWorktree ? { sharedWorktree: c.sharedWorktree } : {}),
                 ...(c.model ? { model: c.model } : {}), ...(c.tools ? { tools: c.tools } : {}), ...(c.pending ? { pending: c.pending } : {}), ...(c.switching ? { switching: c.switching } : {}), ...(c.switchFailed ? { switchFailed: c.switchFailed } : {}), ...(nonzero(c.usage) ? { usage: c.usage } : {}),
                 ...(last ? { lastLine: clip(last, 200) } : {}), ...(r?.error ? { error: clip(r.error, 300) } : {}), ...(c.hibernated ? { hibernated: true } : {}) };
         }),
@@ -471,6 +480,57 @@ const latestCalls = (wf) => [...new Map(wf.calls.map(c => [c.key, c])).values()]
  *  the settings in effect (the latest config{hash,config}); config-rejected after it is reported too. */
 // One fold per orchestrator ledger, extended as it grows (ledger.ts; the executor folds the same entries the same way).
 const ledgerStates = new Map();
+/** The orchestrator running now (its last `orchestrator` record, without an exit, whose process lives), and a note when
+ *  its version is not the one this process loaded: running work stays on the version it started with. */
+export function orchestratorView(state, loaded = packageVersion()) {
+    const o = state.orchestrator;
+    if (!o || o.exited || !alive(o.pid, o.start))
+        return {};
+    return { orchestrator: `${o.version} (pid ${o.pid})`, ...(o.version === loaded ? {} : { versionNote: versionNote(o.version, loaded) }) };
+}
+/** Whether the recorded orchestrator still runs. On Linux its start time also tells it from a later process given the
+ *  same pid after a crash (elsewhere the pid alone is checked). */
+function alive(pid, start) {
+    try {
+        process.kill(pid, 0);
+    }
+    catch (error) {
+        if (error.code !== "EPERM")
+            return false;
+    }
+    if (!start || process.platform !== "linux")
+        return true;
+    try {
+        const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+        return stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19] === start;
+    }
+    catch {
+        return false;
+    }
+}
+const parts = (v) => v.split(/[.-]/).map(n => Number.parseInt(n, 10) || 0);
+function newer(a, b) {
+    const x = parts(a), y = parts(b);
+    for (let i = 0; i < Math.max(x.length, y.length); i++)
+        if ((x[i] ?? 0) !== (y[i] ?? 0))
+            return (x[i] ?? 0) > (y[i] ?? 0);
+    return false;
+}
+export function versionNote(running, loaded) {
+    return newer(running, loaded)
+        ? `this pi session loaded durable-subagents ${loaded}, older than the running orchestrator ${running}; start a new pi session to use ${running}`
+        : `the orchestrator runs durable-subagents ${running}, this pi loaded ${loaded}: running work stays on ${running}. ` +
+            `It exits about 10 s after all work ends and starts again on ${loaded}. To switch sooner without stopping running calls: ` +
+            `drain (running calls finish, nothing new starts in existing workflows; calls waiting for an answer keep it running), ` +
+            `wait until status no longer shows ${running}, then resume from a pi session started after the update. ` +
+            `A resume before it exits keeps ${running}, and pi sessions started before the update start ${running} again`;
+}
+/** orchestratorView of the home's orchestrator ledger. */
+export function runningOrchestrator(home) {
+    const path = orchLedger(home), state = foldLedger(ledgerStates.get(path) ?? emptyLedger(), readJournalSnapshot(path));
+    ledgerStates.set(path, state);
+    return orchestratorView(state);
+}
 export function slotsView(home, now = Date.now()) {
     const path = orchLedger(home), state = foldLedger(ledgerStates.get(path) ?? emptyLedger(), readJournalSnapshot(path));
     ledgerStates.set(path, state);
@@ -484,7 +544,7 @@ export function slotsView(home, now = Date.now()) {
             holders.set(e.pool, (holders.get(e.pool) ?? 0) + 1);
     const names = [...new Set([...Object.keys(limits), ...holders.keys()])].sort();
     const slots = names.map(p => { const n = holders.get(p) ?? 0, limit = limits[p]?.slots; return typeof limit === "number" ? `${p} ${n}/${limit}` : `${p} ${n} (no limit)`; });
-    return { ...(slots.length ? { slots } : {}), ...(config ? { config: `${config.hash} since ${age(now - config.ts)} ago` } : {}),
+    return { ...orchestratorView(state), ...(slots.length ? { slots } : {}), ...(config ? { config: `${config.hash} since ${age(now - config.ts)} ago` } : {}),
         ...(exhausted.length ? { exhausted } : {}),
         ...(rejected ? { configRejected: `${clip(rejected.error, 200)} (${age(now - rejected.ts)} ago); ${config ? config.hash : "the start settings"} stay in effect` } : {}) };
 }
@@ -504,6 +564,7 @@ export function statusBrief(home, options = {}) {
         const calls = latestCalls(w).filter(c => c.phase !== "sealed" || (c.result && !c.result.ok)).map((c) => {
             const live = c.phase !== "sealed", quiet = c.lastActivity !== undefined ? now - c.lastActivity : undefined;
             return { key: c.key, agent: c.agent, phase: c.phase, ...(c.model ? { model: c.model } : {}),
+                ...(c.sharedWorktree ? { sharedWorktree: c.sharedWorktree } : {}),
                 ...(live && c.startedAt !== undefined ? { for: age(now - c.startedAt) } : {}),
                 ...(live && c.phase !== "asking" && quiet !== undefined && quiet >= 60_000 ? { quiet: age(quiet) } : {}),
                 ...(live && c.startedAt !== undefined ? { tokens: tokens(c.usage) } : {}),

package/dist/ui/cards.js

@@ -6,6 +6,7 @@ const HEAD = {
     finished: { icon: "✓", title: "finished", tone: "success" },
     stall: { icon: "…", title: "no activity", tone: "warning" },
     unknown: { icon: "!", title: "outcome unknown", tone: "warning" },
+    conflict: { icon: "!", title: "shares a worktree", tone: "warning" },
     budget: { icon: "$", title: "budget reached", tone: "warning" },
 };
 const keyOf = (item) => item.call ? item.call.split("/").at(-1).replace(/@1$/, "") : item.wid;

package/dist/version.js

@@ -0,0 +1,14 @@
+// The version of this package, read from its package.json (src/ and dist/ both sit one level below it).
+import { readFileSync } from "node:fs";
+let cached;
+export function packageVersion() {
+    if (cached === undefined) {
+        try {
+            cached = String(JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version ?? "unknown");
+        }
+        catch {
+            cached = "unknown";
+        }
+    }
+    return cached;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-durable-subagents",
-  "version": "1.0.13",
+  "version": "1.0.16",
   "description": "Subagents for pi that never lose work and never do it twice. Crash-safe workflows, automatic recovery, and a live view just like the main agent.",
   "type": "module",
   "license": "MIT",