pi-durable-subagents 1.0.15 → 1.0.17

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 1.0.17
+
+- A silent subagent shows one warning instead of separate activity and
+  progress warnings. The message now says that no new output or tool
+  progress has been received and that the model may still be processing;
+  the ten-minute thresholds are unchanged.
+- Warning cards update in place to `recovered` when activity resumes, or
+  `ended` when the execution ends. They refresh even when the status line
+  does not change or the dock is turned off.
+- Execution checkpoints and warnings record the latest received stream
+  update's time and type for diagnosis, without recording its content.
+
+## 1.0.16
+
+- A used-up usage window is found while pi is still retrying: at the second
+  quota refusal in a row (`No available accounts`, usage limit, quota
+  exceeded), not after pi's retries end. A call from a pool moves to the
+  pool's next model that is not used up and has a free slot, in the same
+  execution and session, within pi's next retry or two (refused requests use
+  no quota); one with a single model waits for its provider. Before, a call kept retrying the used-up provider for as
+  long as pi's retry settings allowed (over ten minutes with ten retries).
+- `send kind:"model"` and a follow-up's `model` accept a pool's name: the
+  first model of the pool that is not used up (for a running call, also with
+  a free slot). The reply names the model picked; a call from that pool stays
+  in it, so a later used-up window still moves it on. A follow-up naming a
+  pool starts its generation from the pool's order.
+
 ## 1.0.15
 
 - The changes listed under 1.0.14, which was tagged but never published:

package/README.md

@@ -55,7 +55,7 @@ the npx cache, so `install-service` refuses to run from there.
 | You steer a subagent while it is asking you a question | Your message reaches it, in order. Nothing is rejected or lost. |
 | Two steers arrive out of order and the second replaces the first | Only the second one applies. |
 | A step is refused, or a dependency fails | The workflow stops that branch cleanly. Nothing is retried in vain. |
-| A provider's usage window runs out (`No available accounts`, usage limit, quota exceeded) | A call in a pool continues **in the same session** on the pool's next model; new calls skip that provider. After 15 minutes the next call that wants it tries it once; when it answers, new calls and new generations use it again. A call with a single model waits for it instead of failing. Billing errors (402, insufficient balance) still fail at once. |
+| A provider's usage window runs out (`No available accounts`, usage limit, quota exceeded) | Found at the second refusal in a row, while pi is still retrying. A call in a pool continues **in the same session** on the pool's next model (within pi's next retry or two); new calls skip that provider. After 15 minutes the next call that wants it tries it once; when it answers, new calls and new generations use it again. A call with a single model waits for it instead of failing. Billing errors (402, insufficient balance) still fail at once. |
 | Two subagents edit the same worktree | A reminder names both calls; neither is blocked or locked. Only observed `edit`/`write` calls count (bash-only writes are not seen). Calls with `isolation: "worktree"` have their own worktrees. |
 | A subagent waits for an answer for a long time | It releases its model slot and memory, then resumes exactly once when you answer. |
 
@@ -98,9 +98,9 @@ it something. Each verb means one thing, and a refusal says what would work:
 |---|---|---|
 | `run` | — | Start one subagent, `tasks` in parallel, a `chain`, or a workflow script. An unknown agent name is refused before anything starts, with the list of agents. |
 | `send steer` | a running subagent | Reaches it at its next safe point. To a finished one: refused, use `follow-up`; To one waiting on its question: it interrupts the question, and the subagent usually asks again; `answer` answers it. |
-| `send follow-up` | a finished subagent | Continues the same session as a new generation (`key@2`). With `model`, that generation runs on it. |
+| `send follow-up` | a finished subagent | Continues the same session as a new generation (`key@2`). With `model` (a model or a pool's name), that generation runs on it. |
 | `send answer` | an open question | Answers it once. |
-| `send model` | any subagent | A running one switches at its next request; one asking, hibernated or waiting for a slot launches on it when it runs again. |
+| `send model` | any subagent | A running one switches at its next request; one asking, hibernated or waiting for a slot launches on it when it runs again. A pool's name picks its first model that is not used up (and, for a running call, has a free slot); the reply names the model picked, and a call from that pool stays in it. |
 | `stop` | a subagent or a workflow | Final: `stopped`, usage kept, edits left as they are. |
 | `drain` / `resume` | existing workflows | A reversible hold; runs started later are not held. |
 

package/dist/agent/child.js

@@ -98,6 +98,8 @@ export function registerChild(pi) {
                 return { action: 'defer' };
             if (req.kind === 'model') {
                 const body = req.body;
+                if (body?.exec !== undefined && body.exec !== exec)
+                    return { action: 'reject', reason: 'stale-execution' };
                 return body && ctx.modelRegistry.find(body.provider, body.model) ? { action: 'apply' } : { action: 'reject', reason: 'unknown-model' };
             }
             if (MESSAGES.includes(req.kind)) {

package/dist/agent/main/snapshots.js

@@ -107,11 +107,15 @@ const resolutions = new WeakMap();
 function resolvedIn(entries) {
     let done = resolutions.get(entries);
     if (!done) {
-        done = new Set(entries.filter(e => e.type === JT.attentionResolved).map(e => JSON.stringify([e.id, e.rev])));
+        done = new Map(entries.filter(e => e.type === JT.attentionResolved).map(e => [JSON.stringify([e.id, e.rev]), typeof e.resolution === "string" ? e.resolution : "resolved"]));
         resolutions.set(entries, done);
     }
     return done;
 }
+/** Preserve the reason so presentation distinguishes resumed output from a terminated execution. */
+export function attentionResolution(home, item) {
+    return resolvedIn(readJournalSnapshot(journalPath(home, item.wid))).get(JSON.stringify([item.id, item.rev]));
+}
 const asks = new Map(), ASK_SCANS = 64, MARK = 64;
 function ask(scan, line) {
     if (!line.includes('"ask"'))
@@ -189,7 +193,7 @@ function answeredAsks(path) {
 }
 /** P15: Refresh a question against durable workflow and child receipts at request time. */
 export function resolved(home, item) {
-    if (resolvedIn(readJournalSnapshot(journalPath(home, item.wid))).has(JSON.stringify([item.id, item.rev])))
+    if (attentionResolution(home, item) !== undefined)
         return true;
     if (item.kind !== "question" || !item.session || !item.qid)
         return false;

package/dist/agent/main/tool.js

@@ -44,7 +44,7 @@ function call(value, cwd, where) {
  *  (a follow-up's new generation runs on it). From the orchestrator ledger's `send-note`. */
 export function sendReceipt(ledger, rid) {
     const note = ledger.find(e => e.type === "send-note" && e.rid === rid);
-    return note ? { model: String(note.model), effect: String(note.effect) } : {};
+    return note ? { model: String(note.model), effect: String(note.effect), ...(note.pool ? { pool: String(note.pool) } : {}) } : {};
 }
 export function request(args, cwd) {
     // v12 §2: Infer run only when one launch form is present; never guess a control verb.

package/dist/agent/main.js

@@ -342,7 +342,7 @@ export function registerMain(pi, ui) {
             "Durable asynchronous subagents; run returns {wid} when created (or {submitted:{rid}} while pending). A finished workflow (its notice carries every agent's result) or a question wakes you, so after starting work end your turn: never poll with sleep or repeated status. Crash recovery resumes sessions, not external side effects. Background helper processes (orchestrator, evaluator) exit by themselves about 10 s after all work ends: never kill processes or delete files to 'clean up'. When the user quits pi, this session's running workflows pause (nothing is spent); resume continues them.",
             "run (action optional for exactly one launch form): agent+task; tasks:[call specs] parallel; chain:[call specs] sequential ({previous}); workflow:'./script.js' or source (runs.run(key,spec), runs.all([...]), emit(value), args, runs.input(name)). Optional name, cwd, usageBudget, maxCalls, inputs. With tasks/chain, top-level model, timeoutMs, budget, isolation, context, tools, skills, once are defaults for every step (a step's own value wins); a workflow/source script sets them per runs.run call. timeoutMs is milliseconds of active time (a number); omit it unless a hard limit is needed. Explicit unknown agents are rejected BEFORE creation, with available names; unknown script agents fail only their call.",
             "agents: list names, descriptions, default models and source for this cwd; use these names for run.",
-            "send to:'<wid>/<key>' (bare '<wid>' only for a single-call workflow): steer on a running call delivers at the next safe point (receipt in status/UI); a steer to a call waiting on its question interrupts the question and the subagent usually asks again — use answer to answer it; sealed → finished:<status> — use kind 'follow-up'. follow-up continues a sealed call as generation g+1 or queues after a running turn; follow-up model:'provider/id' runs that generation on it. answer: give the qid (or just the call, or nothing when one question is open); to and rev are filled in. A question that needs the user's decision goes to the user; if you answer one yourself, tell the user what you chose. model: a running call switches at its next provider request; an asking, hibernated or queued call launches on it when it runs again; the reply's model/effect (next-request|next-execution|next-generation) says which. status model = model actually used by the last request; switching = requested, not used yet; switchFailed = refused. A provider content refusal (ToS/usage policy) fails the call at once, not retried. Unknown targets list valid addresses. replaces:[rid] supersedes an earlier send.",
+            "send to:'<wid>/<key>' (bare '<wid>' only for a single-call workflow): steer on a running call delivers at the next safe point (receipt in status/UI); a steer to a call waiting on its question interrupts the question and the subagent usually asks again — use answer to answer it; sealed → finished:<status> — use kind 'follow-up'. follow-up continues a sealed call as generation g+1 or queues after a running turn; follow-up model:'provider/id' or a pool name runs that generation on it. answer: give the qid (or just the call, or nothing when one question is open); to and rev are filled in. A question that needs the user's decision goes to the user; if you answer one yourself, tell the user what you chose. model ('provider/id' or a pool name — its first model not used up): a running call switches at its next provider request; an asking, hibernated or queued call launches on it when it runs again; the reply's model/effect (next-request|next-execution|next-generation) says which. status model = model actually used by the last request; switching = requested, not used yet; switchFailed = refused. A provider content refusal (ToS/usage policy) fails the call at once, not retried. Unknown targets list valid addresses. replaces:[rid] supersedes an earlier send.",
             "stop target:<wid|<wid>/<key>> is terminal stopped (usage and partial edits kept); a sealed call → already-sealed:<status>, a finished workflow → terminal:<status>. drain holds existing workflows reversibly (new runs unaffected); resume [wid] releases held workflows. status: without wid, what runs, asks (with its answer address; hibernated:true holds no slot) or failed, sharedWorktree names calls sharing observed edit/write roots (reminder only), finished workflows one line each, provider slots held/limit, the config in effect and providers whose usage window is used up (avoided until a probe finds them answering again), and the orchestrator version (versionNote when it differs from the loaded one); wid: one workflow, outputs clipped; wid+key: one call's full result; full:true: everything. A run's rid from {submitted:{rid}} works wherever a wid is expected. revise wid + workflow/source/args starts a revision.",
             "Control replies are {applied:true,rid} or {applied:false,reason,rid} when decided; otherwise {submitted:{rid}} after 10s.",
             ...(agents ? [`Available agents: ${agents}.`] : []),

package/dist/orchestrator/engine.js

@@ -331,7 +331,9 @@ export class Engine {
             const seal = wf.journal.entries().find(e => e.type === JT.sealed && e.call === from);
             if (seal && send.kind === 'steer')
                 return { action: 'reject', reason: `finished:${seal.result.status} — use kind "follow-up" to continue it` };
-            if (send.kind === 'follow-up' && send.model !== undefined) {
+            // A pool's name is a model too: the call keeps the pool, and its order and failover apply to the new generation.
+            const pools = this.ledgers.config.pools, pool = send.model !== undefined && pools && Object.hasOwn(pools, send.model);
+            if (send.kind === 'follow-up' && send.model !== undefined && !pool) {
                 try {
                     if (!parseModel(send.model).provider)
                         throw new Error('missing provider');
@@ -346,7 +348,7 @@ export class Engine {
                 const spec = send.model !== undefined ? { ...entry.spec, model: send.model } : entry.spec;
                 if (send.model !== undefined)
                     await this.note(req.rid, send.model, 'next-generation');
-                const opened = await wf.journal.append('generation', { rid: req.rid, key: entry.key, gen, from, spec, revision: wf.revision, opening: { rid: req.rid, kind: send.kind, message: send.message ?? '' }, ...(send.model !== undefined ? { model: send.model } : {}) });
+                const opened = await wf.journal.append('generation', { rid: req.rid, key: entry.key, gen, from, spec, revision: wf.revision, opening: { rid: req.rid, kind: send.kind, message: send.message ?? '' }, ...(send.model !== undefined && !pool ? { model: send.model } : {}) });
                 this.dispatchGeneration(wf, opened);
                 return { action: 'apply' };
             }

package/dist/orchestrator/executor/index.js

@@ -34,6 +34,8 @@ import { WorktreeIndex, worktreeCalls, worktreeLabel, worktreePair, worktreeRoot
 const MEM_RECORD_MS = 30000;
 /** A4, P29: A child admitted within this window may not show in MemAvailable yet; its share is reserved explicitly. */
 const MEM_WARMUP_MS = 30000;
+/** Quota refusals in a row that find a provider's usage window used up while pi is still retrying. */
+const QUOTA_REFUSALS = 2;
 const ignoreMissing = (error) => { if (error.code !== "ENOENT")
     throw error; };
 const callOf = (exec) => exec.slice(0, exec.lastIndexOf("#"));
@@ -61,7 +63,8 @@ export function requestedModel(journal, call, followUp) {
             wanted = m;
     }
     for (const [index, e] of all.entries()) {
-        if (e.type !== "forward" || e.dest !== call || e.envelope?.kind !== "model")
+        // A failover's switch is not a request: an execution that ends before applying it leaves the choice to the pool.
+        if (e.type !== "forward" || e.dest !== call || e.envelope?.kind !== "model" || e.failover)
             continue;
         const delivered = all.find(r => r.type === "forward-delivered" && r.call === call && r.rid2 === e.rid2);
         if (delivered) {
@@ -300,9 +303,9 @@ export default function createExecutor(ledgers, options = {}) {
     }
     /** P7, P27: Record forward-delivered once when a forward's child receipt is first observed; serial sections only. */
     /** The reply to a model send says which model and when it applies (orchestrator ledger `send-note`, once per rid). */
-    async function note(rid, model, effect) {
+    async function note(rid, model, effect, pool) {
         if (!orch.entries().some(e => e.type === "send-note" && e.rid === rid))
-            await orch.append("send-note", { rid, model, effect });
+            await orch.append("send-note", { rid, model, effect, ...(pool ? { pool } : {}) });
     }
     async function forwardsDelivered(journal, call, entries) {
         const all = journal.entries();
@@ -491,7 +494,7 @@ export default function createExecutor(ledgers, options = {}) {
                 const decision = await decide(), models = decision.candidates, pool = decision.pool;
                 continuation = decision.continuation;
                 for (const model of models) {
-                    if (!continuation && pool && skipped(pool, model))
+                    if (!continuation && pool && models.length > 1 && skipped(pool, model))
                         continue;
                     const provider = model.provider;
                     if (unavailable(provider))
@@ -559,14 +562,19 @@ export default function createExecutor(ledgers, options = {}) {
         const candidate = recorded && candidates.some(m => m.provider === recorded.provider && m.id === recorded.id);
         // Leave the session's model for the pool's others when its pool skips it after losses, or its provider's usage
         // window is used up; and at a new generation, go back to the pool's order of preference.
-        const skip = pool && candidate && (previous && ownSegment && skipped(pool, recorded) || unavailable(recorded.provider) || !ownSegment && !!t.continueFrom);
+        // A new generation of a pool call starts from the pool also when the session's model is not one of its models
+        // (switched outside it, or the follow-up named the pool).
+        const skip = pool && (candidate ? previous && ownSegment && skipped(pool, recorded) || unavailable(recorded.provider) || !ownSegment && !!t.continueFrom
+            : !ownSegment && !!t.continueFrom);
         // A model the call was asked to use replaces the session's: launched with it, and holding its provider's slot.
         const wanted = requestedModel(t.journal, t.callId, t.model);
         // It outranks the pool's order at a new generation too, also when it names the model the session already has.
+        // A requested model of the call's own pool keeps the pool: a used-up window still moves the call on.
+        const keep = pool && candidates.some(m => m.provider === wanted?.provider && m.id === wanted?.id) ? pool : undefined;
         if (wanted)
             return recorded && !freshFork && recorded.provider === wanted.provider && recorded.id === wanted.id
-                ? { candidates: [recorded], continuation: true, pool: undefined }
-                : { candidates: [wanted], continuation: false, pool: undefined };
+                ? { candidates: [recorded], continuation: true, pool: keep }
+                : { candidates: [wanted], continuation: false, pool: keep };
         if (recorded && !freshFork && !skip)
             return { candidates: [recorded], continuation: true, pool: candidate ? pool : undefined };
         return { candidates, continuation: false, pool };
@@ -634,15 +642,87 @@ export default function createExecutor(ledgers, options = {}) {
         // While a probe runs, its outcome alone decides: a late refusal of an execution admitted earlier changes nothing.
         if (x && (x.probe ? x.probe !== exec : now < x.nextTry))
             return;
-        if (orch.entries().some(e => e.type === "provider-exhausted" && e.exec === exec))
+        // Once per execution and provider: an execution moved on by failover can find a second provider used up too.
+        if (orch.entries().some(e => e.type === "provider-exhausted" && e.exec === exec && e.provider === provider))
             return;
         await orch.append("provider-exhausted", { provider, exec, since: x?.since ?? now, nextTry: now + (config.k?.probeMs ?? 900_000), error: error.slice(0, 300) });
     }
+    /** Quota refusals in a row per execution, from one provider (pi retries a refused request on its own). */
+    const refusals = new Map();
+    /** A used-up window shows while pi still retries: the second refusal in a row (the first for a probe) finds the
+     *  provider used up, and a call launched from a pool switches to the pool's next model at its next request. */
+    async function refused(t, exec, provider, error) {
+        if (!quotaExhausted(error))
+            return;
+        const last = refusals.get(exec), count = last?.provider === provider ? last.count + 1 : 1;
+        refusals.set(exec, { provider, count });
+        const probe = folded().exhausted.get(provider)?.probe === exec;
+        if (count < (probe ? 1 : QUOTA_REFUSALS))
+            return;
+        await serial(async () => {
+            if (has(t.journal, JT.fenced, exec) || current(t.journal, t.callId) !== exec)
+                return;
+            await recordExhausted(provider, exec, error);
+            await failover(t, exec, provider);
+        });
+        wake();
+    }
+    /** Switch a running execution off a used-up provider: to the first model of its pool on another provider that is
+     *  neither used up nor full, reserving that slot as a requested switch does. Without one, pi's retries go on and
+     *  the call waits for the provider once they end. */
+    async function failover(t, exec, provider) {
+        if (pendingSwitch(exec))
+            return;
+        const pool = t.journal.entries().findLast(e => e.type === "selected" && e.exec === exec)?.pool, pools = settings().pools;
+        if (!pool || !pools?.[pool])
+            return;
+        let models;
+        try {
+            models = resolveModel(pool, pools);
+        }
+        catch {
+            return;
+        }
+        for (const m of models) {
+            if (!m.provider || m.provider === provider || unavailable(m.provider) || skipped(pool, m))
+                continue;
+            const rid = contentHash([exec, "failover", provider]);
+            if (t.journal.entries().some(e => e.type === "forward" && e.rid === rid))
+                return;
+            const probe = folded().exhausted.has(m.provider); // its next try is due (`unavailable` said so): this is its probe
+            if (!await reserveSwitch(exec, m.provider, rid))
+                continue;
+            if (probe)
+                await orch.append("provider-probe", { provider: m.provider, exec });
+            // Bound to this execution: replayed after it ended, a later execution (which chose its model at launch) refuses it.
+            const body = { provider: m.provider, model: m.id, ...(m.thinking ? { thinking: m.thinking } : {}), exec };
+            const envelope = { to: t.callId, kind: "model", body }, hash = contentHash(envelope);
+            const entry = await t.journal.append("forward", { rid, rid2: forwardRid(rid, t.callId.slice(0, t.callId.indexOf("/")), t.key, hash), dest: t.callId, hash, envelope, failover: provider });
+            await replayForward(entry);
+            return;
+        }
+    }
+    /** Hold a slot of `provider` for a running execution's switch, unless it holds one; false when it is full. */
+    async function reserveSwitch(exec, provider, rid) {
+        if (holdings().some(h => h.exec === exec && h.pool === provider))
+            return true;
+        const target = holdings().filter(h => h.pool === provider);
+        if (!capacity({ kind: "provider", holders: target.length, capacity: settings().providers?.[provider]?.slots ?? Infinity }))
+            return false;
+        let slot = 0;
+        while (target.some(h => h.slot === slot))
+            slot++;
+        await orch.append("hold", { pool: provider, slot, exec, reserved: true, rid });
+        return true;
+    }
     /** An answer from a used-up provider, requested after it was found used up: available again. */
-    async function answered(exec, event) {
+    async function answered(t, exec, event) {
         const message = event.message, provider = message?.provider;
-        if (message?.role !== "assistant" || !provider || message.stopReason === "error")
+        if (message?.role !== "assistant" || !provider)
             return;
+        if (message.stopReason === "error")
+            return refused(t, exec, provider, String(message.errorMessage ?? ""));
+        refusals.delete(exec);
         await serial(async () => {
             const x = folded().exhausted.get(provider);
             if (x && (x.probe === exec || Number(message.timestamp) > x.since))
@@ -836,7 +916,7 @@ export default function createExecutor(ledgers, options = {}) {
                         });
                     }, recordUsage: values => recordUsage(t, values),
                     wrote: path => wrote(t, exec, cwd, path),
-                    switched: event => switched(exec, journal, event), answered: event => answered(exec, event), pendingSwitch: () => pendingSwitch(exec),
+                    switched: event => switched(exec, journal, event), answered: event => answered(t, exec, event), pendingSwitch: () => pendingSwitch(exec),
                 });
             }
             finally {
@@ -881,6 +961,9 @@ export default function createExecutor(ledgers, options = {}) {
                     for (const e of inUse.keys())
                         if (callOf(e) === ticket.callId)
                             inUse.delete(e);
+                    for (const e of refusals.keys())
+                        if (callOf(e) === ticket.callId)
+                            refusals.delete(e);
                     forgetSession(callSession(home, ticket.wid, ticket.key, ticket.gen));
                     wake();
                 }
@@ -931,6 +1014,28 @@ export default function createExecutor(ledgers, options = {}) {
                 /** P12: a model request to this call, recorded with the rid given; a reject has no effect. */
                 const requestModel = async (rid, model, hash, cond) => {
                     let body;
+                    const exec = current(ctx.journal, dest);
+                    // P28: with no live execution (not started yet, between executions, hibernated while asking) the model is
+                    // recorded and the next execution launches on it (`requestedModel`); its slot is acquired then, as for any launch.
+                    const idle = !exec || has(ctx.journal, JT.fenced, exec) || !has(ctx.journal, "selected", exec);
+                    // A pool's name asks for its first model that can take the call now: provider not used up, and (for a running
+                    // call) a free slot. The call's own pool stays, so a used-up window later moves it on as before.
+                    const pools = settings().pools, pool = pools && Object.hasOwn(pools, model) ? model : undefined;
+                    if (pool) {
+                        let models;
+                        try {
+                            models = resolveModel(pool, pools);
+                        }
+                        catch {
+                            return { action: "reject", reason: "unknown-model" };
+                        }
+                        const free = (p) => idle || holdings().some(h => h.exec === exec && h.pool === p) ||
+                            capacity({ kind: "provider", holders: holdings().filter(h => h.pool === p).length, capacity: settings().providers?.[p]?.slots ?? Infinity });
+                        const m = models.find(m => m.provider && !unavailable(m.provider) && free(m.provider));
+                        if (!m)
+                            return { action: "reject", reason: "pool-unavailable" };
+                        model = `${m.provider}/${m.id}${m.thinking ? `:${m.thinking}` : ""}`;
+                    }
                     try {
                         const m = parseModel(model);
                         if (!m.provider)
@@ -942,28 +1047,14 @@ export default function createExecutor(ledgers, options = {}) {
                     }
                     const envelope = { to: dest, kind: "model", body, ...(cond && Object.keys(cond).length ? { cond } : {}) };
                     const rid2 = forwardRid(rid, ctx.widRev, ctx.key, hash);
-                    const exec = current(ctx.journal, dest), provider = body.provider;
-                    // P28: with no live execution (not started yet, between executions, hibernated while asking) the model is
-                    // recorded and the next execution launches on it (`requestedModel`); its slot is acquired then, as for any launch.
                     // Launching (`selected`, not `tracked` yet): the child may start on the old model; ask again in a moment.
-                    const idle = !exec || has(ctx.journal, JT.fenced, exec) || !has(ctx.journal, "selected", exec);
                     if (!idle && !has(ctx.journal, "tracked", exec))
                         return { action: "reject", reason: "call-starting" };
                     if (!idle && pendingSwitch(exec))
                         return { action: "reject", reason: "switch-pending" };
-                    if (!idle) {
-                        const held = holdings().filter(h => h.exec === exec);
-                        if (!held.some(h => h.pool === provider)) {
-                            const target = holdings().filter(h => h.pool === provider);
-                            if (!capacity({ kind: "provider", holders: target.length, capacity: settings().providers?.[provider]?.slots ?? Infinity }))
-                                return { action: "reject", reason: "provider-full" };
-                            let slot = 0;
-                            while (target.some(h => h.slot === slot))
-                                slot++;
-                            await orch.append("hold", { pool: provider, slot, exec, reserved: true, rid });
-                        }
-                    }
-                    await note(req.rid, model, idle ? "next-execution" : "next-request");
+                    if (!idle && !await reserveSwitch(exec, body.provider, rid))
+                        return { action: "reject", reason: "provider-full" };
+                    await note(req.rid, model, idle ? "next-execution" : "next-request", pool);
                     const entry = await ctx.journal.append("forward", { rid, rid2, dest, hash, envelope });
                     await replayForward(entry);
                     if (idle) {

package/dist/orchestrator/executor/observe.js

@@ -23,6 +23,8 @@ export async function observeExecution(d) {
     const { home, config, ticket: t, exec, child, serial } = d;
     const session = callSession(home, t.wid, t.key, t.gen), clock = new ActiveTime(), started = clock.last;
     let progress = started, providerError;
+    // Diagnostic metadata only: checkpoint the latest received stream update, never its content.
+    let lastStream;
     const tools = new Set();
     // The tool calls running now, for the stall text: a silent long command and a stuck call read differently.
     const running = new Map();
@@ -38,7 +40,7 @@ export async function observeExecution(d) {
         const previous = t.journal.entries().findLast(e => e.type === "time" && e.exec === exec);
         if (!monotoneTime({ active: Number(previous?.active ?? 0) }, { active: clock.active }))
             throw new Error("Nonmonotone active time");
-        await t.journal.append("time", { exec, active: clock.active });
+        await t.journal.append("time", { exec, active: clock.active, ...(lastStream ? { lastStream } : {}) });
     });
     const limits = async () => {
         if (t.spec.timeoutMs !== undefined && prior + clock.active >= t.spec.timeoutMs) {
@@ -49,6 +51,11 @@ export async function observeExecution(d) {
         if (reached(totalUsage(t.journal.entries(), t.callId), t.spec.budget))
             signal();
     };
+    const openAlert = (id) => {
+        const last = attentionEntries(t.journal.entries(), id).at(-1)?.item;
+        return last && !t.journal.entries().some(e => e.type === JT.attentionResolved && e.id === id && e.rev === last.rev);
+    };
+    const progressDue = () => !clock.asking && !tools.size && performance.now() - progress >= (config.k?.progressMs ?? 600000);
     const stall = () => serial(async () => {
         const id = `stall:${t.callId}`;
         const items = attentionEntries(t.journal.entries(), id), last = items.at(-1)?.item;
@@ -56,8 +63,8 @@ export async function observeExecution(d) {
         const fresh = items.at(-1)?.exec === exec ? clock.last > Number(items.at(-1)?.horizon) : clock.last > started;
         if (open && fresh)
             await t.journal.append(JT.attentionResolved, { id, rev: last.rev, resolution: "activity" });
-        else if (!open && !clock.asking && performance.now() - clock.last >= (config.k?.stallMs ?? 600000))
-            await t.journal.append(JT.attention, { exec, horizon: clock.last, item: { id, rev: (last?.rev ?? 0) + 1, kind: "stall", text: `${t.wid}/${t.key}: no execution activity for ${Math.floor((performance.now() - clock.last) / 60000)}m` + runningText(), wid: t.wid, call: t.callId } });
+        else if (!open && !clock.asking && !progressDue() && !openAlert(`noprogress:${t.callId}`) && performance.now() - clock.last >= (config.k?.stallMs ?? 600000))
+            await t.journal.append(JT.attention, { exec, horizon: clock.last, ...(lastStream ? { lastStream } : {}), item: { id, rev: (last?.rev ?? 0) + 1, kind: "stall", text: `${t.wid}/${t.key}: no execution activity observed for ${Math.floor((performance.now() - clock.last) / 60000)}m` + runningText(), wid: t.wid, call: t.callId } });
     });
     /** "; running bash `make matrix` for 14m (no output or CPU use seen)": a silent long command, not a stuck model. */
     const runningText = () => {
@@ -73,10 +80,10 @@ export async function observeExecution(d) {
         const fresh = items.at(-1)?.exec === exec ? progress > Number(items.at(-1)?.horizon) : progress > started;
         if (open && fresh)
             await t.journal.append(JT.attentionResolved, { id, rev: last.rev, resolution: "progress" });
-        else if (!open && !clock.asking && !tools.size && performance.now() - progress >= (config.k?.progressMs ?? 600000)) {
-            const text = `${t.wid}/${t.key}: running but no progress for ${Math.floor((performance.now() - progress) / 60000)}m (no output tokens or tool results)` +
+        else if (!open && progressDue() && !openAlert(`stall:${t.callId}`)) {
+            const text = `${t.wid}/${t.key}: no new output or tool progress received for ${Math.floor((performance.now() - progress) / 60000)}m; the model may still be processing` +
                 (providerError ? `; last provider error: ${providerError.slice(0, 200)}` : "");
-            await t.journal.append(JT.attention, { exec, horizon: progress, item: { id, rev: (last?.rev ?? 0) + 1, kind: "stall", text, wid: t.wid, call: t.callId } });
+            await t.journal.append(JT.attention, { exec, horizon: progress, ...(lastStream ? { lastStream } : {}), item: { id, rev: (last?.rev ?? 0) + 1, kind: "stall", text, wid: t.wid, call: t.callId } });
         }
     });
     child.stdin.on("error", () => { });
@@ -105,6 +112,10 @@ export async function observeExecution(d) {
         // P18: Apply RPC boundaries at receipt, before any in-flight scan can resume.
         // Durable observations remain queued; clock transitions never wait on I/O.
         clock.event(event, performance.now());
+        if (event.type === "message_update") {
+            const type = event.assistantMessageEvent?.type;
+            lastStream = { type: typeof type === "string" && /^(thinking|text|toolcall)_(start|delta|end)$/.test(type) ? type : "message_update", receivedAt: Date.now() };
+        }
         const message = event.message;
         const error = event.type === "auto_retry_start" ? event.errorMessage : event.type === "auto_retry_end" ? event.finalError :
             event.type === "message_end" && message?.stopReason === "error" ? message.errorMessage : undefined;

package/dist/orchestrator/snapshot.js

@@ -261,7 +261,7 @@ function snapshotReducer(wid, entries) {
                 const pending = forwarded.filter(pendingMessage).length;
                 if (pending)
                     c.pending = pending;
-                const last = c.phase !== "sealed" && !retired.has(c.callId) ? forwarded.findLast(s => s.kind === "model" && s.reason !== "withdrawn") : undefined;
+                const last = c.phase !== "sealed" && !retired.has(c.callId) ? forwarded.findLast(s => s.kind === "model" && s.reason !== "withdrawn" && s.reason !== "stale-execution") : undefined;
                 if (last?.reason !== undefined)
                     c.switchFailed = `${last.model} (${last.reason})`;
                 else if (last && last.state !== "retired" && last.model !== c.model?.replace(/:(off|minimal|low|medium|high|xhigh|max)$/, ""))

package/dist/ui/cards.js

@@ -1,6 +1,6 @@
 import { truncateToWidth, visibleWidth, wrapTextWithAnsi } from "@earendil-works/pi-tui";
 import { CT } from "../types.js";
-import { resolved } from "../agent/main/snapshots.js";
+import { attentionResolution, resolved } from "../agent/main/snapshots.js";
 const HEAD = {
     question: { icon: "?", title: "asks the main agent", tone: "accent" },
     finished: { icon: "✓", title: "finished", tone: "success" },
@@ -33,37 +33,48 @@ export function card(theme, tone, heading, body, width, expanded = false) {
 }
 /** P15, P16: Register renderers for attention presentations and watch-view notes in the main session. */
 export function registerCards(pi, home) {
-    const done = new Set(); // resolution is monotone: once resolved, never re-read
-    // pi renders every visible message on each frame; an open question re-reads its child session at most once a second.
+    const pending = new Map();
+    const done = new Map(); // resolution is monotone: once resolved, never re-read
+    // pi renders every visible message on each frame; open cards re-read receipts at most once a second.
     const checked = new Map();
-    const isResolved = (item) => {
-        const id = `${item.id}@${item.rev}`;
-        if (done.has(id))
-            return true;
+    const resolution = (item) => {
+        if (item.kind !== "question" && item.kind !== "stall")
+            return undefined;
+        const id = `${item.wid}:${item.id}@${item.rev}`;
+        if (done.has(id)) {
+            pending.delete(id);
+            return done.get(id);
+        }
         const now = Date.now();
         if (now - (checked.get(id) ?? -Infinity) < 1000)
-            return false;
+            return undefined;
         checked.set(id, now);
         try {
-            if (resolved(home, item)) {
-                done.add(id);
+            const reason = item.kind === "question" ? (resolved(home, item) ? "answered" : undefined) : attentionResolution(home, item);
+            if (reason) {
+                done.set(id, reason);
                 checked.delete(id);
-                return true;
+                pending.delete(id);
+                return reason;
             }
         }
         catch { /* display only */ }
-        return false;
+        return undefined;
     };
     pi.registerMessageRenderer(CT.attention, (message, options, theme) => {
         const items = message.details?.items;
         if (!items?.length)
             return undefined;
-        // The lines depend only on width, expansion, theme and which questions are answered: reuse them across frames.
+        for (const item of items)
+            if (item.kind === "stall" || item.kind === "question")
+                pending.set(`${item.wid}:${item.id}@${item.rev}`, item);
+        // Reuse lines until width, theme, expansion or an attention resolution changes.
         let last;
         const draw = (width) => items.flatMap(item => {
-            const h = HEAD[item.kind] ?? HEAD.unknown, closed = item.kind === "question" && isResolved(item);
-            const title = item.kind === "stall" && item.id.startsWith("noprogress:") ? "no progress" : h.title;
-            const heading = `${h.icon} ${item.kind === "finished" && !item.call ? "Workflow" : `Subagent ${keyOf(item)}`} ${closed ? "— answered" : title}`;
+            const h = HEAD[item.kind] ?? HEAD.unknown, reason = resolution(item), closed = !!reason;
+            const title = item.kind === "stall" && item.id.startsWith("noprogress:") ? "awaiting progress" : h.title;
+            const status = item.kind === "question" ? "answered" : reason === "activity" || reason === "progress" ? "recovered" : reason === "ended" || reason === "retired" ? "ended" : "resolved";
+            const heading = `${closed ? "✓" : h.icon} ${item.kind === "finished" && !item.call ? "Workflow" : `Subagent ${keyOf(item)}`} ${closed ? `— ${status}` : title}`;
             // v12 §3: a finished digest is first line + dim per-agent lines, clipped; old single-line items read exactly as before.
             const inner = Math.max(1, Math.max(3, Math.floor(width)) - 4);
             const body = item.kind === "finished" && !closed
@@ -72,7 +83,7 @@ export function registerCards(pi, home) {
             return card(theme, closed ? "muted" : h.tone, heading, body, width, options.expanded);
         });
         return { invalidate() { last = undefined; }, render: (width) => {
-                const key = `${width}|${items.map(item => item.kind === "question" && isResolved(item) ? 1 : 0).join("")}`;
+                const key = `${width}|${items.map(item => resolution(item) ?? "").join("|")}`;
                 if (last?.key !== key)
                     last = { key, lines: draw(width) };
                 return last.lines;
@@ -87,4 +98,11 @@ export function registerCards(pi, home) {
                 return last.lines;
             } };
     });
+    // The existing UI refresh loop repaints receipts even when dock text did not change.
+    return () => {
+        const before = done.size;
+        for (const item of pending.values())
+            resolution(item);
+        return done.size !== before;
+    };
 }

package/dist/ui/index.js

@@ -7,8 +7,7 @@ import { registerCards } from "./cards.js";
 import { toolRenderers } from "./tool.js";
 /** UI §1–3, P16, P21: Register journal-backed list/watch surfaces only in interactive pi. */
 export function registerUi(pi, deps) {
-    if (typeof pi.registerMessageRenderer === "function")
-        registerCards(pi, deps.home); // P21: cards are optional
+    const refreshCards = typeof pi.registerMessageRenderer === "function" ? registerCards(pi, deps.home) : () => false; // P21: cards are optional
     // UI §5: compact tool calls and results (optional surface; without it pi shows the raw JSON).
     if (typeof pi.registerToolRenderer === "function")
         pi.registerToolRenderer((name, next) => {
@@ -38,7 +37,7 @@ export function registerUi(pi, deps) {
         const state = { folded: new Set(), done: new Map(), viewed: new Set(), finished: false };
         let screen, opening = false, stopped = false, closeScreen;
         let unsubscribe, timer;
-        let dockRows = () => [], dockAt = null, dockTui, lastDock = "";
+        let dockRows = () => [], dockAt = null, lastDock = "";
         // ↓ opens the list only from pi's own input editor. Another surface — /model's selector, a dialog, another
         // extension's overlay — has the focus instead, and its ↓ belongs to it. pi's editor (and any editor built on
         // CustomEditor) carries the app action map; the TUI comes from the dock widget, so without a dock the check
@@ -86,11 +85,9 @@ export function registerUi(pi, deps) {
                 const at = dock === "off" ? undefined : data.dockAt;
                 if (at !== dockAt) {
                     dockAt = at;
-                    dockTui = undefined;
                     // With the dock off, an empty widget below the editor still lends the TUI to the ↓ focus check; pi adds no
                     // spacer for it, so it takes no line.
                     ctx.ui.setWidget("durable-subagents", !at ? tui => { keysTui = tui; return { invalidate() { }, render: () => [] }; } : (tui, theme) => {
-                        dockTui = tui;
                         keysTui = tui;
                         return {
                             invalidate() { },
@@ -106,9 +103,10 @@ export function registerUi(pi, deps) {
                     }, { placement: at === "above" ? "aboveEditor" : "belowEditor" });
                 }
                 const shown = dockRows(200).join("\n");
-                if (shown !== lastDock) {
+                const cardsChanged = refreshCards();
+                if (shown !== lastDock || cardsChanged) {
                     lastDock = shown;
-                    dockTui?.requestRender();
+                    keysTui?.requestRender?.();
                 }
                 screen?.refresh();
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-durable-subagents",
-  "version": "1.0.15",
+  "version": "1.0.17",
   "description": "Subagents for pi that never lose work and never do it twice. Crash-safe workflows, automatic recovery, and a live view just like the main agent.",
   "type": "module",
   "license": "MIT",