pi-durable-subagents 1.0.6 → 1.0.8

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 1.0.8
+
+- pi stays responsive with a long history: the extension's polling in pi's
+  main thread no longer re-reads it all. Workflow status folds only what a
+  journal appended, the orchestrator ledger is indexed once per change, the
+  attention check reads only this session's workflows, and an open question's
+  card reads only what the child session appended. On a home with 60
+  workflows and 356 calls, the dock refresh went from 4.5 ms to under 1 ms
+  every half second, and an idle pi's busy time from about 4% to 1.5%.
+- Calls finished more than 10 s ago keep their summary only; their transcript
+  is read when shown. pi holds about 100 MB less and garbage collection no
+  longer pauses typing.
+- A change of `config.json` written twice quickly to the same size is no
+  longer missed: the orchestrator compares the file's content.
+
+## 1.0.7
+
+- Changes to `config.json` (`defaultModel`, `pools`, `providers`, `memory`,
+  `k`) apply without restarting the orchestrator: it checks the file about
+  once a second and applies a valid change between slot admissions, so a call
+  still waiting for a slot follows the new model, pool or limit. Slots already
+  held are kept when a limit drops. An invalid change is refused and the
+  settings in effect stay; `status` names the error until the file is valid
+  again.
+- `status` marks an asker whose execution hibernated with `hibernated: true`
+  (CLI: "hibernated, no slot"): it holds no provider slot until it is
+  answered. Both `status` forms list provider slots in use against their
+  limits, and the config in effect.
+
 ## 1.0.6
 
 - A follow-up on a finished workflow shows as running work: in the dock, the

package/README.md

@@ -273,6 +273,11 @@ State lives in `~/.pi/durable-subagents`; set `DSA_HOME` to move it.
   never stopped for memory.
 - **onQuit:** `"pause"` (default) pauses a session's running workflows when
   you quit that pi; `"continue"` lets them run on in the background.
+- **Changes apply without a restart:** the orchestrator re-reads the file
+  when it changes. A new slot limit, pool or default model applies to the next
+  slot acquisition; slots already held are kept when a limit drops. An
+  invalid change is not applied, and `status` reports it next to the settings
+  still in effect (`config: <hash> since …`) and the slots held per provider.
 
 ## Switching back
 

package/dist/agent/main/snapshots.js

@@ -1,13 +1,14 @@
-import { readdirSync, readFileSync } from "node:fs";
+import { closeSync, openSync, readdirSync, readSync, statSync } from "node:fs";
+import { StringDecoder } from "node:string_decoder";
 import { join } from "node:path";
 import { readJournalSnapshot } from "../../kernel/journal.js";
 import { journalPath, orchLedger } from "../../paths.js";
 import { CT, JT } from "../../types.js";
-import { holdOf } from "../../orchestrator/snapshot.js";
+import { holdOf, ledgerIndex } from "../../orchestrator/snapshot.js";
 /** P15, P25: Read workflow snapshots without modifying another domain's history; a wid with an orchestrator.jsonl
  *  `pruned{wid}` entry is gone (housekeeping), even while its directory is still being removed. */
-export function workflows(home) {
-    const ledger = readJournalSnapshot(orchLedger(home));
+export function workflows(home, origin) {
+    const ledger = readJournalSnapshot(orchLedger(home)), { created: createdBy, pruned } = ledgerIndex(ledger);
     let names;
     try {
         names = readdirSync(join(home, "w"));
@@ -17,21 +18,38 @@ export function workflows(home) {
             throw error;
         names = [];
     }
-    const pruned = new Set(ledger.filter(e => e.type === "pruned").map(e => String(e.wid)));
-    const ids = new Set([...ledger.filter(e => e.type === JT.created).map(e => String(e.wid)), ...names].filter(wid => !pruned.has(wid)));
-    const createdBy = new Map();
-    for (const e of ledger)
-        if (e.type === JT.created && !createdBy.has(e.wid))
-            createdBy.set(e.wid, e);
-    return [...ids].sort().map(wid => {
+    const ids = new Set([...[...createdBy.keys()].map(String), ...names].filter(wid => !pruned.has(wid)));
+    const result = [];
+    for (const wid of [...ids].sort()) {
+        // With an origin wanted, a workflow the ledger attributes to another session is skipped without reading its journal.
+        const known = createdBy.get(wid);
+        if (origin !== undefined && known && known.origin !== origin)
+            continue;
         const entries = readJournalSnapshot(journalPath(home, wid));
-        const created = createdBy.get(wid) ?? entries.find(e => e.type === JT.created);
-        return { wid, origin: created?.origin, entries };
-    });
+        const created = known ?? entries.find(e => e.type === JT.created);
+        if (origin !== undefined && created?.origin !== origin)
+            continue;
+        result.push({ wid, origin: created?.origin, entries });
+    }
+    return result;
 }
 /** P37: a generation opened by a send (possibly after the workflow finished) that has no seal yet is pending work. */
+const opened = new WeakMap();
 export function openGeneration(entries) {
-    return entries.some(g => g.type === "generation" && !entries.some(s => s.type === JT.sealed && String(s.call).endsWith(`/${String(g.key)}@${String(g.gen)}`)));
+    const hit = opened.get(entries);
+    if (hit?.length === entries.length)
+        return hit.open;
+    // Sealed call ids end in `/<key>@<gen>`; collect every such suffix once instead of rescanning per generation.
+    const sealed = new Set();
+    for (const s of entries)
+        if (s.type === JT.sealed) {
+            const call = String(s.call);
+            for (let i = call.indexOf("/"); i >= 0; i = call.indexOf("/", i + 1))
+                sealed.add(call.slice(i));
+        }
+    const open = entries.some(g => g.type === "generation" && !sealed.has(`/${String(g.key)}@${String(g.gen)}`));
+    opened.set(entries, { length: entries.length, open });
+    return open;
 }
 /** P1: Workflow-side pending work shared by every starter: a workflow without JT.done or with an unsealed generation,
  *  unless a drain (stop-all) holds it: held work waits for an explicit resume, which starts the orchestrator itself. */
@@ -65,9 +83,7 @@ function unresolved(entries) {
 /** P15, V7: Select only unresolved, unpresented items owned by this session. */
 export function attention(home, sender, seen) {
     const items = [], shown = new Set(seen.map(s => `${s.id}\0${s.rev}`));
-    for (const workflow of workflows(home)) {
-        if (workflow.origin !== sender)
-            continue;
+    for (const workflow of workflows(home, sender)) {
         for (const item of unresolved(workflow.entries)) {
             const key = `${item.id}\0${item.rev}`;
             if (shown.has(key))
@@ -86,37 +102,96 @@ export function presentText(item) {
         return `Question from ${call}${item.qid ? ` (qid ${item.qid})` : ""}; reply with send kind:"answer" to:"${call}": ${item.text}`;
     return item.text.includes(item.wid) ? item.text : `${where}: ${item.text}`;
 }
-/** P15: Refresh a question against durable workflow and child receipts at request time. */
-export function resolved(home, item) {
-    if (readJournalSnapshot(journalPath(home, item.wid)).some(e => e.type === JT.attentionResolved && e.id === item.id && e.rev === item.rev))
-        return true;
-    if (item.kind !== "question" || !item.session || !item.qid)
-        return false;
-    let text;
+/** Resolutions recorded in one immutable journal snapshot, keyed by id and rev. */
+const resolutions = new WeakMap();
+function resolvedIn(entries) {
+    let done = resolutions.get(entries);
+    if (!done) {
+        done = new Set(entries.filter(e => e.type === JT.attentionResolved).map(e => JSON.stringify([e.id, e.rev])));
+        resolutions.set(entries, done);
+    }
+    return done;
+}
+const asks = new Map(), ASK_SCANS = 64, MARK = 64;
+function ask(scan, line) {
+    if (!line.includes('"ask"'))
+        return;
+    let entry;
+    try {
+        entry = JSON.parse(line);
+    }
+    catch {
+        return;
+    } // a malformed line is skipped, as pi and the session tail do (E4)
+    const msg = entry?.type === "message" ? entry.message : undefined;
+    if (msg?.role === "toolResult" && msg.toolName === "ask" && !msg.isError)
+        scan.answered.add(JSON.stringify([msg.details?.qid, msg.details?.rev]));
+}
+function answeredAsks(path) {
+    let stat;
     try {
-        text = readFileSync(item.session, "utf8");
+        stat = statSync(path);
     }
     catch (error) {
-        if (error.code === "ENOENT")
-            return false;
+        if (error.code === "ENOENT") {
+            asks.delete(path);
+            return undefined;
+        }
         throw error;
     }
-    const lines = text.split("\n");
-    for (let index = 0; index < lines.length; index++) {
-        if (!lines[index])
-            continue;
-        let entry;
-        try {
-            entry = JSON.parse(lines[index]);
+    const identity = `${stat.dev}:${stat.ino}`;
+    let scan = asks.get(path);
+    if (scan) {
+        asks.delete(path);
+        asks.set(path, scan);
+    } // least recently used first
+    const fd = openSync(path, "r");
+    try {
+        // Appending keeps what was read: the bytes just before the old end are still there. Anything else (a replaced or
+        // shorter file, other bytes before the old end) is a rewrite, read again from the start. File times are too coarse
+        // to tell a quick rewrite of the same size, so the bytes are compared.
+        let kept = !!scan && scan.identity === identity && stat.size >= scan.offset;
+        if (kept && scan.mark.length) {
+            const now = Buffer.alloc(scan.mark.length);
+            kept = readSync(fd, now, 0, now.length, scan.offset - now.length) === now.length && now.equals(scan.mark);
+        }
+        if (kept && stat.size === scan.offset)
+            return scan.answered;
+        if (!kept) {
+            scan = { identity, offset: 0, mark: Buffer.alloc(0), pending: "", decoder: new StringDecoder("utf8"), answered: new Set() };
+            asks.set(path, scan);
+            if (asks.size > ASK_SCANS)
+                asks.delete(asks.keys().next().value);
         }
-        catch (error) {
-            if (index >= lines.length - 2)
+        const s = scan;
+        const buffer = Buffer.alloc(Math.min(256 * 1024, Math.max(1, stat.size - s.offset)));
+        while (s.offset < stat.size) {
+            const n = readSync(fd, buffer, 0, Math.min(buffer.length, stat.size - s.offset), s.offset);
+            if (!n)
                 break;
-            throw error;
+            s.offset += n;
+            s.pending += s.decoder.write(buffer.subarray(0, n));
+            s.mark = Buffer.concat([s.mark, buffer.subarray(0, n)]).subarray(-MARK);
+            let end;
+            while ((end = s.pending.indexOf("\n")) >= 0) {
+                ask(s, s.pending.slice(0, end));
+                s.pending = s.pending.slice(end + 1);
+            }
         }
-        const msg = entry.type === "message" ? entry.message : undefined;
-        if (msg?.role === "toolResult" && msg.toolName === "ask" && !msg.isError && msg.details?.qid === item.qid && msg.details?.rev === item.rev)
-            return true;
+        // A last line without its newline counts once it is complete JSON; it stays pending until the newline arrives.
+        if (s.pending)
+            ask(s, s.pending);
+        return s.answered;
     }
-    return false;
+    finally {
+        closeSync(fd);
+    }
+}
+/** P15: Refresh a question against durable workflow and child receipts at request time. */
+export function resolved(home, item) {
+    if (resolvedIn(readJournalSnapshot(journalPath(home, item.wid))).has(JSON.stringify([item.id, item.rev])))
+        return true;
+    if (item.kind !== "question" || !item.session || !item.qid)
+        return false;
+    return answeredAsks(item.session)?.has(JSON.stringify([item.qid, item.rev])) ?? false;
 }

package/dist/agent/main.js

@@ -325,7 +325,7 @@ export function registerMain(pi, ui) {
             "run (action optional for exactly one launch form): agent+task; tasks:[call specs] parallel; chain:[call specs] sequential ({previous}); workflow:'./script.js' or source (runs.run(key,spec), runs.all([...]), emit(value), args, runs.input(name)). Optional name, cwd, usageBudget, maxCalls, inputs. With tasks/chain, top-level model, timeoutMs, budget, isolation, context, tools, skills, once are defaults for every step (a step's own value wins); a workflow/source script sets them per runs.run call. timeoutMs is milliseconds of active time (a number); omit it unless a hard limit is needed. Explicit unknown agents are rejected BEFORE creation, with available names; unknown script agents fail only their call.",
             "agents: list names, descriptions, default models and source for this cwd; use these names for run.",
             "send to:'<wid>/<key>' (bare '<wid>' only for a single-call workflow): steer on a running call delivers at the next safe point (receipt in status/UI); a steer to a call waiting on its question interrupts the question and the subagent usually asks again — use answer to answer it; sealed → finished:<status> — use kind 'follow-up'. follow-up continues a sealed call as generation g+1 or queues after a running turn. answer: give the qid (or just the call, or nothing when one question is open); to and rev are filled in. A question that needs the user's decision goes to the user; if you answer one yourself, tell the user what you chose. model switches at next provider request. Unknown targets list valid addresses. replaces:[rid] supersedes an earlier send.",
-            "stop target:<wid|<wid>/<key>> is terminal stopped (usage and partial edits kept); a sealed call → already-sealed:<status>, a finished workflow → terminal:<status>. drain holds existing workflows reversibly (new runs unaffected); resume [wid] releases held workflows. status: without wid, what runs, asks (with its answer address) or failed, finished workflows one line each; wid: one workflow, outputs clipped; wid+key: one call's full result; full:true: everything. A run's rid from {submitted:{rid}} works wherever a wid is expected. revise wid + workflow/source/args starts a revision.",
+            "stop target:<wid|<wid>/<key>> is terminal stopped (usage and partial edits kept); a sealed call → already-sealed:<status>, a finished workflow → terminal:<status>. drain holds existing workflows reversibly (new runs unaffected); resume [wid] releases held workflows. status: without wid, what runs, asks (with its answer address; hibernated:true holds no slot) or failed, finished workflows one line each, provider slots held/limit and the config in effect; wid: one workflow, outputs clipped; wid+key: one call's full result; full:true: everything. A run's rid from {submitted:{rid}} works wherever a wid is expected. revise wid + workflow/source/args starts a revision.",
             "Control replies are {applied:true,rid} or {applied:false,reason,rid} when decided; otherwise {submitted:{rid}} after 10s.",
             ...(agents ? [`Available agents: ${agents}.`] : []),
             "User sees a summary line above the editor; ↓ on an empty editor (or /subagents) opens the list, Enter watches live OR finished calls (finished transcripts remain on disk) and expands finished workflows. List keys: s steer (paste-capable input), x stop (confirm y), m model, a answer when asked, f follow-up on finished calls; action feedback appears in footer.",

package/dist/cli/main.js

@@ -65,13 +65,16 @@ export function renderStatus(wf) {
 /** P25, T10: Render the compact status projection shared with the `subagents` tool. */
 export function renderView(view) {
     const lines = view.workflows.map(w => [`${w.wid}@${w.rev}${w.name ? ` ${w.name}` : ""}: ${w.status}${w.followUps ? " (follow-up running)" : ""}${w.error ? ` (${clip(w.error, 200)})` : ""} · ${w.done}/${w.planned ?? w.calls.length}${w.planned === undefined && w.status === "running" ? "+" : ""} done${w.usage.input || w.usage.output || w.usage.costUsd ? ` · ${formatUsage(w.usage)}` : ""}`,
-        ...w.calls.map(c => `  ${c.key}@${c.gen} ${c.status ?? c.phase}${c.model ? ` ${c.model}` : ""}${c.tools ? ` tools:${c.tools}` : ""}${c.usage ? ` ${formatUsage(c.usage)}` : ""}${c.lastLine ? ` ${JSON.stringify(c.lastLine)}` : c.error ? ` (${c.error})` : ""}`),
+        ...w.calls.map(c => `  ${c.key}@${c.gen} ${c.status ?? c.phase}${c.hibernated ? " (hibernated, no slot)" : ""}${c.model ? ` ${c.model}` : ""}${c.tools ? ` tools:${c.tools}` : ""}${c.usage ? ` ${formatUsage(c.usage)}` : ""}${c.lastLine ? ` ${JSON.stringify(c.lastLine)}` : c.error ? ` (${c.error})` : ""}`),
         ...w.attention.map(a => `  ${a.kind}: ${JSON.stringify(a.text.split("\n")[0])}`)].join("\n"));
     if (view.paused)
         lines.unshift(`${view.paused} (pi-durable-subagents resume)`);
     if (view.olderFinished)
         lines.push(`(+${view.olderFinished} older finished workflows; status <wid> shows one in detail)`);
-    return lines.join("\n") || "No workflows";
+    const footer = [view.slots?.length ? `slots: ${view.slots.join(", ")}` : "", view.config ? `config: ${view.config}` : "", view.configRejected ? `config.json rejected: ${view.configRejected}` : ""].filter(Boolean);
+    if (!lines.length)
+        lines.push("No workflows");
+    return [...lines, ...footer].join("\n");
 }
 function snapshots(home, wid) {
     if (!wid)

package/dist/orchestrator/config.js

@@ -0,0 +1,151 @@
+// $DSA_HOME/config.json for the orchestrator: read at start and again whenever the file changes, so a new slot limit,
+// pool order or K-parameter needs no orchestrator restart (a restart at the wrong moment used to cost a dispatch).
+// Orchestrator ledger entries: config{hash,config} — the settings in effect from then on (at start, or after a change);
+// config-rejected{hash,error} — a changed file that was not applied; the settings before it stay in effect.
+// A reload changes the shared config object in place: every later read sees it (the next slot acquisition, model
+// resolution or check). Slots already held are kept when a limit drops; timers of running executions keep their period.
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { contentHash } from "../kernel/ids.js";
+/** The keys the orchestrator reads; config.json also holds pi-side settings (ui, onQuit) that it ignores. */
+const KEYS = ["defaultModel", "pools", "providers", "memory", "k"];
+const K = ["lossBound", "checkpointMs", "stallMs", "progressMs", "switchTimeoutMs", "idleExitMs", "trackerMs", "hibernateMs", "spawnBudget"];
+export const configPath = (home) => join(home, "config.json");
+/** The orchestrator's part of a parsed config.json. */
+export function orchestratorSettings(raw) {
+    const value = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+    return Object.fromEntries(KEYS.filter(k => value[k] !== undefined).map(k => [k, value[k]]));
+}
+export const configHash = (config) => contentHash(orchestratorSettings(config)).slice(0, 12);
+const record = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+const count = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+/** What is wrong with a parsed config.json for the orchestrator, or undefined. Unknown keys are allowed. */
+export function configProblem(raw) {
+    if (!record(raw))
+        return "config.json must be a JSON object";
+    const { defaultModel, pools, providers, memory, k } = raw;
+    if (defaultModel !== undefined && typeof defaultModel !== "string")
+        return "defaultModel must be a string";
+    if (pools !== undefined) {
+        if (!record(pools))
+            return "pools must map names to model lists";
+        for (const [name, list] of Object.entries(pools))
+            if (!Array.isArray(list) || !list.length || !list.every(m => typeof m === "string" && m))
+                return `pools.${name} must be a nonempty list of "provider/id[:thinking]"`;
+    }
+    if (providers !== undefined) {
+        if (!record(providers))
+            return "providers must map provider names to { slots }";
+        for (const [name, p] of Object.entries(providers))
+            if (!record(p) || !Number.isSafeInteger(p.slots) || Number(p.slots) < 0)
+                return `providers.${name}.slots must be a nonnegative integer`;
+    }
+    if (memory !== undefined) {
+        if (!record(memory))
+            return "memory must be { reserveMb?, perChildMb? }";
+        for (const key of ["reserveMb", "perChildMb"])
+            if (memory[key] !== undefined && !count(memory[key]))
+                return `memory.${key} must be a nonnegative number`;
+    }
+    if (k !== undefined) {
+        if (!record(k))
+            return "k must map K-parameters to numbers";
+        for (const [key, v] of Object.entries(k)) {
+            if (!K.includes(key))
+                return `k.${key} is not a K-parameter (${K.join(", ")})`;
+            if (!count(v) || (key !== "lossBound" && key !== "spawnBudget" && v === 0))
+                return `k.${key} must be a positive number`;
+        }
+    }
+}
+/** Parse config.json; a missing file is the empty config. A JSON error throws. */
+export async function readConfig(path) {
+    try {
+        return JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return {};
+        throw error;
+    }
+}
+/** Record the settings in effect unless the ledger already ends on the same ones (a restart with an unchanged file).
+ *  After a rejection they are recorded again: that confirms the file is back to settings in effect. */
+export async function recordConfig(orch, config) {
+    const hash = configHash(config), last = orch.entries().findLast(e => e.type === "config" || e.type === "config-rejected");
+    if (last?.type !== "config" || last.hash !== hash)
+        await orch.append("config", { hash, config: orchestratorSettings(config) });
+    return hash;
+}
+/** Replace the contents of the shared config object; readers hold the object, not a copy. */
+function applyInPlace(target, next) {
+    const t = target;
+    for (const key of KEYS)
+        delete t[key];
+    Object.assign(t, orchestratorSettings(next));
+}
+/** Identity of the file's current version (taken before a read, so a change during the read is seen next time). */
+/** The version of config.json: its content. File times are too coarse to tell two quick writes of the same size apart
+ *  (a change could be missed for good), and the file is small enough to read once a second. */
+export async function configStamp(path) {
+    try {
+        return `=${await readFile(path, "utf8")}`;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return "missing";
+        throw error;
+    }
+}
+/** The settings of a version read by `configStamp`; invalid JSON throws, as `readConfig` does. */
+export function stampedConfig(stamp) { return stamp === "missing" ? {} : JSON.parse(stamp.slice(1)); }
+/** Watch config.json from the version `stamp` (read at start) and apply each valid change in place. */
+/** `apply` runs the change where readers cannot observe half of it (the executor's admission section). */
+export function watchConfig(options) {
+    const { path, config, orch } = options;
+    let stamp = options.stamp, running, rejected, stopped = false;
+    const once = async () => {
+        const now = await configStamp(path);
+        if (now === stamp || stopped)
+            return;
+        let raw;
+        // The content compared is the content applied: a second read could see another version than the stamp.
+        try {
+            raw = stampedConfig(now);
+        }
+        catch (error) {
+            // A half-written file reads as invalid JSON: retry on the next change of the file, report it once per version.
+            stamp = now;
+            const hash = `invalid:${now}`;
+            if (rejected !== hash) {
+                rejected = hash;
+                await orch.append("config-rejected", { error: `config.json is not valid JSON: ${error.message}` });
+            }
+            return;
+        }
+        stamp = now;
+        // Validate the content first: `[]` or `null` project to no settings and must not pass as "unchanged".
+        const problem = configProblem(raw), next = orchestratorSettings(raw), hash = configHash(next);
+        if (problem) {
+            if (rejected !== hash) {
+                rejected = hash;
+                await orch.append("config-rejected", { hash, error: problem });
+            }
+            return;
+        }
+        rejected = undefined;
+        let changed = false;
+        await (options.apply ?? (change => change()))(async () => {
+            changed = hash !== configHash(config);
+            if (changed)
+                applyInPlace(config, next);
+            await recordConfig(orch, config); // also confirms a return to the settings in effect after a rejection
+        });
+        if (changed)
+            options.onApplied?.();
+    };
+    const check = () => running ??= once().catch(error => console.error(`durable-subagents: config.json check failed: ${String(error)}`)).finally(() => { running = undefined; });
+    const timer = setInterval(check, options.intervalMs ?? 1000);
+    timer.unref();
+    return { stop: async () => { stopped = true; clearInterval(timer); await running; }, check };
+}

package/dist/orchestrator/executor/index.js

@@ -389,13 +389,18 @@ export default function createExecutor(ledgers, options = {}) {
     }
     const stopped = (a) => a.stopped || entriesFor(a.ticket.journal, a.ticket.callId).some(e => e.type === "stop-intent");
     const interrupted = (a) => closed || a.suspended || a.retired || stopped(a);
-    async function acquire(a, exec, models, pool, continuation = false) {
+    /** Wait for a slot. The candidates are decided again on every attempt, inside the serial section that also applies
+     *  config.json changes: a queued call follows a reloaded defaultModel, pool or limit, never a mix of two versions. */
+    async function acquire(a, exec, decide) {
+        let continuation = false;
         for (;;) {
             let signal;
             const changed = new Promise(resolve => { signal = resolve; waiters.add(resolve); });
             const chosen = await serial(async () => {
                 if (interrupted(a) || await workflowReached(a.ticket))
                     return;
+                const decision = await decide(), models = decision.candidates, pool = decision.pool;
+                continuation = decision.continuation;
                 for (const model of models) {
                     if (!continuation && pool && skipped(pool, model))
                         continue;
@@ -434,7 +439,7 @@ export default function createExecutor(ledgers, options = {}) {
             });
             if (chosen || interrupted(a) || reached(totalUsage(a.ticket.journal.entries()), a.ticket.workflowBudget)) {
                 waiters.delete(signal);
-                return chosen;
+                return { model: chosen, continuation };
             }
             const timer = setTimeout(signal, config.k?.trackerMs ?? 1000);
             try {
@@ -599,13 +604,13 @@ export default function createExecutor(ledgers, options = {}) {
             }
             let decision;
             try {
-                decision = await launchModel(t, entries, previous);
+                decision = await acquire(a, exec, () => launchModel(t, entries, previous));
             }
             catch (error) {
                 await fence(journal, exec, { park: a });
                 return finish(journal, t.callId, exec, makeResult("failed", "", String(error)));
             }
-            const model = await acquire(a, exec, decision.candidates, decision.pool, decision.continuation);
+            const model = decision.model;
             if (!model || interrupted(a)) {
                 await fence(journal, exec, { park: a });
                 return finish(journal, t.callId, exec, !interrupted(a) ? makeResult("failed", "", "workflow budget reached") : makeResult("stopped"));
@@ -687,6 +692,7 @@ export default function createExecutor(ledgers, options = {}) {
         await (await outbox).send(envelope.to, envelope.kind, envelope.body, envelope.cond, { rid: String(e.rid2) });
     }
     return {
+        async reconfigure(apply) { await serial(apply); wake(); },
         run(ticket) {
             const existing = completed.get(ticket.callId);
             if (existing)

package/dist/orchestrator/executor/observe.js

@@ -123,7 +123,7 @@ export async function observeExecution(d) {
             }
         });
     });
-    let scanning = false, scanFailures = 0;
+    let scanning = false, failingSince;
     const scan = () => {
         if (scanning)
             return;
@@ -133,12 +133,14 @@ export async function observeExecution(d) {
                 // One failed process-table scan is no evidence, not a reason to fence a live child: on macOS `ps` can miss its
                 // 2 s deadline right after the orchestrator was stopped or the machine slept (seen on CI as a spurious loss and
                 // a rerun). Only a scan that keeps failing for a minute ends the observation.
+                // Measured in elapsed time: the scan period is fixed at start while k.trackerMs can be reloaded.
                 try {
                     clock.scan(await d.track());
-                    scanFailures = 0;
+                    failingSince = undefined;
                 }
                 catch (error) {
-                    if (++scanFailures * (config.k?.trackerMs ?? 1000) >= 60_000)
+                    failingSince ??= performance.now();
+                    if (performance.now() - failingSince >= 60_000)
                         throw error;
                 }
                 const nextSize = (await fileStat(session).catch(() => ({ size: 0 }))).size;

package/dist/orchestrator/main.js

@@ -6,7 +6,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
-import { mkdir, readFile } from 'node:fs/promises';
+import { mkdir } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 import { realpathSync } from 'node:fs';
 import { join, resolve } from 'node:path';
@@ -14,6 +14,7 @@ import { dsaHome, orchLedger, orchLock } from "../paths.js";
 import { openJournal } from "../kernel/journal.js";
 import { OsLock } from "../platform/lock.js";
 import { Engine } from "./engine.js";
+import { configPath, configProblem, configStamp, recordConfig, stampedConfig, watchConfig } from "./config.js";
 /** P2, C4, K6: Acquire the single authority before opening ledgers, recover, and idle-exit. */
 export async function main(options = {}) {
     const home = options.home ?? dsaHome();
@@ -21,27 +22,35 @@ export async function main(options = {}) {
     const lock = await new OsLock().tryAcquire(orchLock(home));
     if (!lock)
         return;
-    let engine, ledgers;
+    let engine, ledgers, watcher;
     try {
-        let config = options.config;
+        let config = options.config, stamp;
         if (!config) {
-            try {
-                config = JSON.parse(await readFile(join(home, 'config.json'), 'utf8'));
-            }
-            catch (error) {
-                if (error.code !== 'ENOENT')
-                    throw error;
-                config = {};
-            }
+            // One read gives both the version and the settings: with two, a file changed and changed back in between kept
+            // the second version in effect while the watcher saw no change.
+            stamp = await configStamp(configPath(home));
+            const raw = stampedConfig(stamp);
+            const problem = configProblem(raw);
+            if (problem)
+                console.error(`durable-subagents: config.json: ${problem}`);
+            config = raw;
         }
         ledgers = { home, config, orch: await openJournal(orchLedger(home)) };
         const factory = options.executor ?? (await import(__rewriteRelativeImportExtension(new URL(import.meta.url.endsWith('.ts') ? './executor/index.ts' : './executor/index.js', import.meta.url).href))).default;
-        engine = new Engine(ledgers, factory(ledgers), options);
+        const executor = factory(ledgers);
+        engine = new Engine(ledgers, executor, options);
+        if (stamp !== undefined) {
+            await recordConfig(ledgers.orch, config);
+            // A change applies between slot admissions, so one admission never mixes two versions of the limits.
+            watcher = watchConfig({ path: configPath(home), stamp, config, orch: ledgers.orch, intervalMs: Math.min(1000, config.k?.trackerMs ?? 1000),
+                apply: change => executor.reconfigure ? executor.reconfigure(change) : change() });
+        }
         await engine.recover();
         await engine.loop(options.signal);
     }
     finally {
         try {
+            await watcher?.stop();
             await engine?.close();
         }
         finally {

package/dist/orchestrator/snapshot.js

@@ -67,16 +67,16 @@ function callKey(call) {
 export function refusedResult(key, reason) {
     return { key, gen: 0, status: "failed", ok: false, error: reason === "spawn-budget" ? "spawn budget exceeded" : String(reason), output: "" };
 }
-export function snapshotFromEntries(wid, entries) {
+function snapshotReducer(wid, entries) {
     const created = entries.find(e => e.type === "wf-created");
     const rev = Math.max(1, ...entries.filter(e => e.type === "wf-created" || e.type === "revised").map(e => Number(e.revision) || 1));
     const boundary = entries.findLastIndex(e => e.type === "revised");
     const current = entries.slice(Math.max(0, boundary));
-    const terminal = current.findLast(e => e.type === JT.done || (e.type === "resumed" && !e.call));
-    const done = terminal?.type === JT.done ? terminal : undefined;
+    let terminal = current.findLast(e => e.type === JT.done || (e.type === "resumed" && !e.call));
     const calls = new Map();
     const byExec = new Map();
-    const resolved = new Set(entries.filter(e => e.type === JT.attentionResolved).map(e => `${e.id}@${e.rev}`));
+    const hibernating = new Map(); // callId → exec that decided to hibernate and is not fenced yet
+    const resolved = new Set();
     const generations = new Set(), retired = new Set();
     const attention = [];
     // P31: usage per call id, deduplicated by message id; a seal carries the authoritative total.
@@ -84,169 +84,270 @@ export function snapshotFromEntries(wid, entries) {
     const tools = new Map();
     // P7, P27: forward / forward-delivered / forward-retired, by destination call; retirements carry only rid2.
     const sends = new Map(), byRid2 = new Map();
-    for (const e of entries) {
-        if (["call", "generation", "refused", "reused"].includes(e.type)) {
-            if (boundary >= 0 && e.seq < entries[boundary].seq)
-                continue;
-            const key = String(e.key), gen = Number(e.gen) || (e.type === "refused" ? 0 : 1);
-            const callId = e.type === "reused" ? String(e.from) : `${wid}@${rev}/${key}@${gen}`;
-            if (e.type === "generation")
-                generations.add(callId);
-            const result = e.type === "refused" ? refusedResult(key, e.reason) :
-                e.type === "reused" ? entries.find(s => s.type === JT.sealed && s.call === e.from)?.result : undefined;
-            const wanted = e.spec?.model;
-            calls.set(callId, { key, gen, callId, pos: Number(e.pos), agent: String(e.spec?.agent ?? ""),
-                // Until a slot is acquired (`selected`), show the model the call asked for, not nothing.
-                ...(typeof wanted === "string" && wanted ? { model: wanted } : {}),
-                phase: result ? "sealed" : "queued", ...(result ? { result, endedAt: e.ts } : {}),
-                ...(e.type === "refused" ? { refused: String(e.reason) } : {}), ...(e.type === "reused" ? { reused: String(e.from) } : {}) });
-        }
-        else if (e.type === "retired") {
-            retired.add(String(e.call));
-        }
-        else if (e.type === JT.exec) {
-            const call = calls.get(String(e.call));
-            if (!call)
-                continue;
-            // An execution waits for a provider slot and memory before it launches; it is running once `selected` says so
-            // (otherwise a call still waiting for a slot reads "thinking · 2m").
-            call.exec = String(e.exec);
-            call.phase = "queued";
-            call.startedAt ??= e.ts;
-            call.lastActivity = e.ts;
-            byExec.set(call.exec, call);
-        }
-        else if (e.type === JT.fenced) {
-            // A fenced execution without a seal (stop-all, a quit pi, a loss before its continuation) waits to run again.
-            const call = byExec.get(String(e.exec));
-            if (call && call.phase === "running")
+    function apply(batch, from = 0) {
+        for (let i = from; i < batch.length; i++) {
+            const e = batch[i];
+            if (i >= boundary && (e.type === JT.done || (e.type === "resumed" && !e.call)))
+                terminal = e;
+            if (e.type === JT.attentionResolved)
+                resolved.add(`${e.id}@${e.rev}`);
+            if (["call", "generation", "refused", "reused"].includes(e.type)) {
+                if (boundary >= 0 && e.seq < entries[boundary].seq)
+                    continue;
+                const key = String(e.key), gen = Number(e.gen) || (e.type === "refused" ? 0 : 1);
+                const callId = e.type === "reused" ? String(e.from) : `${wid}@${rev}/${key}@${gen}`;
+                if (e.type === "generation")
+                    generations.add(callId);
+                const result = e.type === "refused" ? refusedResult(key, e.reason) :
+                    e.type === "reused" ? entries.find(s => s.type === JT.sealed && s.call === e.from)?.result : undefined;
+                const wanted = e.spec?.model;
+                calls.set(callId, { key, gen, callId, pos: Number(e.pos), agent: String(e.spec?.agent ?? ""),
+                    // Until a slot is acquired (`selected`), show the model the call asked for, not nothing.
+                    ...(typeof wanted === "string" && wanted ? { model: wanted } : {}),
+                    phase: result ? "sealed" : "queued", ...(result ? { result, endedAt: e.ts } : {}),
+                    ...(e.type === "refused" ? { refused: String(e.reason) } : {}), ...(e.type === "reused" ? { reused: String(e.from) } : {}) });
+            }
+            else if (e.type === "retired") {
+                retired.add(String(e.call));
+            }
+            else if (e.type === JT.exec) {
+                const call = calls.get(String(e.call));
+                if (!call)
+                    continue;
+                // An execution waits for a provider slot and memory before it launches; it is running once `selected` says so
+                // (otherwise a call still waiting for a slot reads "thinking · 2m").
+                call.exec = String(e.exec);
                 call.phase = "queued";
-        }
-        else if (e.type === "selected") {
-            const call = byExec.get(String(e.exec)), m = e.model;
-            if (call && m)
-                call.model = m.provider ? `${m.provider}/${m.id}` : m.id;
-            if (call && call.phase === "queued")
-                call.phase = "running";
-        }
-        else if (e.type === "observation") {
-            // Only what the agent did counts as activity; tracker scans and time checkpoints are bookkeeping.
-            const call = byExec.get(String(e.exec));
-            if (call)
+                call.startedAt ??= e.ts;
                 call.lastActivity = e.ts;
-            if (call && e.type === "observation" && e.event?.type === "tool_execution_start")
-                tools.set(call.callId, (tools.get(call.callId) ?? 0) + 1);
-        }
-        else if (e.type === "usage") {
-            const id = `${e.call}:${e.id}`, u = e.usage;
-            if (seen.has(id) || !u)
-                continue;
-            seen.add(id);
-            const total = live.get(String(e.call)) ?? zero();
-            total.input += u.input;
-            total.output += u.output;
-            total.costUsd += u.costUsd;
-            live.set(String(e.call), total);
-        }
-        else if (e.type === JT.sealed) {
-            const usage = e.result?.usage;
-            if (usage)
-                sealedUsage.set(String(e.call), usage);
-            const call = calls.get(String(e.call));
-            if (!call)
-                continue;
-            call.phase = "sealed";
-            call.result = e.result;
-            call.endedAt = e.ts;
-        }
-        else if (e.type === JT.attention) {
-            const item = e.item;
-            if (!resolved.has(`${item.id}@${item.rev}`))
+                byExec.set(call.exec, call);
+                delete call.hibernated;
+                hibernating.delete(call.callId);
+            }
+            else if (e.type === "hibernated") {
+                // The decision to hibernate precedes the fence; the slot is released only once the execution is fenced.
+                const call = calls.get(String(e.call));
+                if (call?.exec && call.exec === e.exec)
+                    hibernating.set(call.callId, call.exec);
+            }
+            else if (e.type === "answer-bound" || (e.type === "resumed" && e.call)) {
+                const call = calls.get(String(e.call));
+                if (call) {
+                    delete call.hibernated;
+                    hibernating.delete(call.callId);
+                }
+            }
+            else if (e.type === JT.fenced) {
+                // A fenced execution without a seal (stop-all, a quit pi, a loss before its continuation) waits to run again.
+                const call = byExec.get(String(e.exec));
+                if (call && call.phase === "running")
+                    call.phase = "queued";
+                if (call && hibernating.get(call.callId) === e.exec)
+                    call.hibernated = true;
+            }
+            else if (e.type === "selected") {
+                const call = byExec.get(String(e.exec)), m = e.model;
+                if (call && m)
+                    call.model = m.provider ? `${m.provider}/${m.id}` : m.id;
+                if (call && call.phase === "queued")
+                    call.phase = "running";
+            }
+            else if (e.type === "observation") {
+                // Only what the agent did counts as activity; tracker scans and time checkpoints are bookkeeping.
+                const call = byExec.get(String(e.exec));
+                if (call)
+                    call.lastActivity = e.ts;
+                if (call && e.type === "observation" && e.event?.type === "tool_execution_start")
+                    tools.set(call.callId, (tools.get(call.callId) ?? 0) + 1);
+            }
+            else if (e.type === "usage") {
+                const id = `${e.call}:${e.id}`, u = e.usage;
+                if (seen.has(id) || !u)
+                    continue;
+                seen.add(id);
+                const total = live.get(String(e.call)) ?? zero();
+                total.input += u.input;
+                total.output += u.output;
+                total.costUsd += u.costUsd;
+                live.set(String(e.call), total);
+            }
+            else if (e.type === JT.sealed) {
+                const usage = e.result?.usage;
+                if (usage)
+                    sealedUsage.set(String(e.call), usage);
+                const call = calls.get(String(e.call));
+                if (!call)
+                    continue;
+                call.phase = "sealed";
+                call.result = e.result;
+                call.endedAt = e.ts;
+                delete call.hibernated;
+                hibernating.delete(call.callId);
+            }
+            else if (e.type === JT.attention) {
+                const item = e.item;
                 attention.push(item);
+            }
+            else if (e.type === "forward") {
+                const envelope = e.envelope;
+                const send = { rid: String(e.rid), kind: String(envelope?.kind ?? ""), state: "pending", at: e.ts,
+                    ...(envelope?.kind === "model" && envelope.body?.provider ? { model: `${envelope.body.provider}/${envelope.body.model}` } : {}) };
+                const list = sends.get(String(e.dest)) ?? [];
+                list.push(send);
+                sends.set(String(e.dest), list);
+                byRid2.set(`${e.dest}\n${e.rid2}`, send);
+                byRid2.set(String(e.rid2), send);
+            }
+            else if (e.type === "forward-delivered" || e.type === "forward-retired") {
+                const send = byRid2.get(e.type === "forward-delivered" ? `${e.call}\n${e.rid2}` : String(e.rid2));
+                if (!send || send.state !== "pending")
+                    continue;
+                send.state = e.type === "forward-delivered" ? "delivered" : "retired";
+                send.at = e.ts;
+                if (e.type === "forward-delivered" && e.reason !== undefined)
+                    send.reason = String(e.reason);
+            }
         }
-        else if (e.type === "forward") {
-            const envelope = e.envelope;
-            const send = { rid: String(e.rid), kind: String(envelope?.kind ?? ""), state: "pending", at: e.ts,
-                ...(envelope?.kind === "model" && envelope.body?.provider ? { model: `${envelope.body.provider}/${envelope.body.model}` } : {}) };
-            const list = sends.get(String(e.dest)) ?? [];
-            list.push(send);
-            sends.set(String(e.dest), list);
-            byRid2.set(`${e.dest}\n${e.rid2}`, send);
-            byRid2.set(String(e.rid2), send);
+    }
+    apply(entries);
+    function finish() {
+        const done = terminal?.type === JT.done ? terminal : undefined;
+        // Finish owns every exposed object; UI decoration and consumers cannot alter reducer history.
+        const list = structuredClone([...calls.values()]);
+        const openAttention = structuredClone(attention.filter(item => !resolved.has(`${item.id}@${item.rev}`)));
+        for (const item of openAttention) {
+            const call = item.kind === "question" ? list.find(c => item.id.startsWith(`q:${c.callId}:`)) : undefined;
+            if (call && (call.phase === "running" || call.phase === "queued"))
+                call.phase = "asking"; // a hibernated asker is fenced
         }
-        else if (e.type === "forward-delivered" || e.type === "forward-retired") {
-            const send = byRid2.get(e.type === "forward-delivered" ? `${e.call}\n${e.rid2}` : String(e.rid2));
-            if (!send || send.state !== "pending")
-                continue;
-            send.state = e.type === "forward-delivered" ? "delivered" : "retired";
-            send.at = e.ts;
-            if (e.type === "forward-delivered" && e.reason !== undefined)
-                send.reason = String(e.reason);
+        for (const c of list)
+            if (c.hibernated && c.phase !== "asking")
+                delete c.hibernated;
+        const usageOf = (callId) => sealedUsage.get(callId) ?? live.get(callId);
+        const counts = { queued: 0, running: 0, asking: 0, sealed: 0 };
+        for (const c of list) {
+            counts[c.phase]++;
+            const usage = usageOf(c.callId);
+            if (usage)
+                c.usage = { ...usage };
+            const n = tools.get(c.callId);
+            if (n)
+                c.tools = n;
+            const forwarded = sends.get(c.callId);
+            if (forwarded) {
+                c.sends = structuredClone(forwarded);
+                const pending = forwarded.filter(pendingMessage).length;
+                if (pending)
+                    c.pending = pending;
+                const switching = c.phase !== "sealed" ? forwarded.findLast(s => s.kind === "model" && s.state === "pending")?.model : undefined;
+                if (switching && switching !== c.model?.replace(/:(off|minimal|low|medium|high|xhigh|max)$/, ""))
+                    c.switching = switching;
+            }
         }
-    }
-    for (const item of attention) {
-        const call = item.kind === "question" ? [...calls.values()].find(c => item.id.startsWith(`q:${c.callId}:`)) : undefined;
-        if (call && (call.phase === "running" || call.phase === "queued"))
-            call.phase = "asking"; // a hibernated asker is fenced
-    }
-    const usageOf = (callId) => sealedUsage.get(callId) ?? live.get(callId);
-    const list = [...calls.values()];
-    const counts = { queued: 0, running: 0, asking: 0, sealed: 0 };
-    for (const c of list) {
-        counts[c.phase]++;
-        const usage = usageOf(c.callId);
-        if (usage)
-            c.usage = { ...usage };
-        const n = tools.get(c.callId);
-        if (n)
-            c.tools = n;
-        const forwarded = sends.get(c.callId);
-        if (forwarded) {
-            c.sends = forwarded;
-            const pending = forwarded.filter(pendingMessage).length;
-            if (pending)
-                c.pending = pending;
-            const switching = c.phase !== "sealed" ? forwarded.findLast(s => s.kind === "model" && s.state === "pending")?.model : undefined;
-            if (switching && switching !== c.model?.replace(/:(off|minimal|low|medium|high|xhigh|max)$/, ""))
-                c.switching = switching;
+        const after = done ? list.filter(c => generations.has(c.callId) && c.phase !== "sealed" && !retired.has(c.callId)) : [];
+        for (const c of after)
+            c.afterEnd = true;
+        const followUps = after.length;
+        const usage = zero();
+        for (const id of new Set([...live.keys(), ...sealedUsage.keys()])) {
+            const u = usageOf(id);
+            usage.input += u.input;
+            usage.output += u.output;
+            usage.costUsd += u.costUsd;
         }
+        return {
+            wid, rev, ...(typeof created?.name === "string" ? { name: created.name } : {}),
+            ...(created ? { origin: String(created.origin), cwd: String(created.cwd), startedAt: created.ts } : {}),
+            status: done ? done.status : "running",
+            ...(done?.error ? { error: String(done.error) } : {}), ...(done && "result" in done ? { result: structuredClone(done.result) } : {}),
+            ...(done ? { endedAt: done.ts } : {}),
+            ...(followUps ? { followUps } : {}),
+            calls: list, counts, attention: openAttention, usage,
+        };
     }
-    const after = done ? list.filter(c => generations.has(c.callId) && c.phase !== "sealed" && !retired.has(c.callId)) : [];
-    for (const c of after)
-        c.afterEnd = true;
-    const followUps = after.length;
-    const usage = zero();
-    for (const id of new Set([...live.keys(), ...sealedUsage.keys()])) {
-        const u = usageOf(id);
-        usage.input += u.input;
-        usage.output += u.output;
-        usage.costUsd += u.costUsd;
-    }
-    return {
-        wid, rev, ...(typeof created?.name === "string" ? { name: created.name } : {}),
-        ...(created ? { origin: String(created.origin), cwd: String(created.cwd), startedAt: created.ts } : {}),
-        status: done ? done.status : "running",
-        ...(done?.error ? { error: String(done.error) } : {}), ...(done && "result" in done ? { result: done.result } : {}),
-        ...(done ? { endedAt: done.ts } : {}),
-        ...(followUps ? { followUps } : {}),
-        calls: list, counts, attention, usage,
-    };
+    // Only the current revision's reuse looks ahead for a seal (entries before the boundary are skipped).
+    return { apply, finish, hasReuse: current.some(e => e.type === "reused") };
+}
+export function snapshotFromEntries(wid, entries) {
+    return snapshotReducer(wid, entries).finish();
 }
 /** P25: Snapshot one workflow from its durable journal (v12 §4: plus the planned total of its pinned run body). */
 // A journal snapshot is immutable and replaced on every append, so its derived workflow snapshot is reused until then:
 // re-deriving every historical workflow on each UI refresh dominated pi's main thread.
+const FOLDS = 256; // workflows whose fold state is kept; pruned and long-idle ones fall out
+const folds = new Map();
 const derived = new WeakMap();
 export function workflowSnapshot(home, wid) {
-    const entries = readJournalSnapshot(journalPath(home, wid)), hit = derived.get(entries);
-    const wf = hit?.wid === wid ? hit.snapshot : snapshotFromEntries(wid, entries);
-    if (hit?.wid !== wid && entries.length)
-        derived.set(entries, { wid, snapshot: wf });
+    const path = journalPath(home, wid), entries = readJournalSnapshot(path), hit = derived.get(entries);
+    let wf;
+    if (hit?.wid === wid)
+        wf = hit.snapshot;
+    else {
+        const prior = folds.get(path);
+        // The journal reader preserves entry identity only when extending the same committed prefix.
+        const prefix = prior?.wid === wid && entries.length >= prior.length &&
+            (prior.length === 0 || entries[prior.length - 1] === prior.last);
+        let reusable = prefix;
+        if (reusable)
+            for (let i = prior.length; i < entries.length; i++) {
+                const e = entries[i];
+                // Revisions change earlier call identities/boundaries. Reuse looks ahead for the first seal.
+                if (e.type === "revised" || e.type === "wf-created" || e.type === "reused" ||
+                    (prior.reducer.hasReuse && e.type === JT.sealed)) {
+                    reusable = false;
+                    break;
+                }
+            }
+        const reducer = reusable ? prior.reducer : snapshotReducer(wid, entries);
+        if (reusable)
+            reducer.apply(entries, prior.length);
+        wf = reducer.finish();
+        if (entries.length) {
+            folds.delete(path);
+            folds.set(path, { wid, length: entries.length, last: entries.at(-1), reducer }); // least recently folded first
+            if (folds.size > FOLDS)
+                folds.delete(folds.keys().next().value);
+            derived.set(entries, { wid, snapshot: wf });
+        }
+        else
+            folds.delete(path);
+    }
     const planned = plannedTotal(home, wid, wf.rev);
     return planned === undefined ? wf : { ...wf, planned };
 }
 /** Ops: wids archived by `prune` (orchestrator ledger `pruned{wid}`); they no longer exist for any reader. */
 function prunedIds(home) {
-    return new Set(readJournalSnapshot(orchLedger(home)).filter(e => e.type === "pruned").map(e => String(e.wid)));
+    return ledgerIndex(readJournalSnapshot(orchLedger(home))).pruned;
+}
+const ledgerIndexes = new WeakMap();
+export function ledgerIndex(ledger) {
+    let ix = ledgerIndexes.get(ledger);
+    if (!ix || ix.length > ledger.length || (ix.length && ledger[ix.length - 1] !== ix.last)) {
+        ix = { length: 0, created: new Map(), pruned: new Set(), byWid: new Map(), byOrigin: new Map() };
+        ledgerIndexes.set(ledger, ix);
+    }
+    for (let i = ix.length; i < ledger.length; i++) {
+        const e = ledger[i];
+        if (e.type === JT.created) {
+            if (!ix.created.has(e.wid))
+                ix.created.set(e.wid, e);
+        }
+        else if (e.type === "pruned")
+            ix.pruned.add(String(e.wid));
+        else if (e.type === "drain" || e.type === "undrain") {
+            if (e.type === "drain")
+                ix.lastDrain = i;
+            if (e.wid === undefined && e.origin === undefined)
+                ix.global = i;
+            if (e.wid !== undefined)
+                ix.byWid.set(e.wid, i);
+            if (e.origin !== undefined)
+                ix.byOrigin.set(e.origin, i);
+        }
+    }
+    ix.length = ledger.length;
+    ix.last = ledger[ledger.length - 1];
+    return ix;
 }
 function workflowIds(home) {
     let wids = [];
@@ -263,19 +364,21 @@ function workflowIds(home) {
 /** Drain: the one hold rule. drain/undrain entries apply to every workflow (no scope), one session's (`origin`) or one
  *  workflow (`wid`). A workflow is held when the newest entry that applies to it is a drain recorded after it was created. */
 export function holdOf(ledger, wid, origin) {
-    const applies = (e) => (e.wid === undefined && e.origin === undefined) || e.wid === wid || (origin !== undefined && e.origin === origin);
-    const last = ledger.findLast(e => (e.type === "drain" || e.type === "undrain") && applies(e));
+    // The newest applicable entry is the newest of the newest unscoped, the newest for this wid and the newest for its origin.
+    const ix = ledgerIndex(ledger);
+    const at = Math.max(ix.global ?? -1, ix.byWid.get(wid) ?? -1, origin !== undefined ? ix.byOrigin.get(origin) ?? -1 : -1);
+    const last = at >= 0 ? ledger[at] : undefined;
     if (last?.type !== "drain")
         return undefined;
-    const created = ledger.find(e => e.type === JT.created && e.wid === wid);
+    const created = ix.created.get(wid);
     return !created || created.seq < last.seq ? last : undefined;
 }
 /** Drain: the workflows a drain (stop-all, a quit pi) holds until resume, and since when. */
 export function heldWorkflows(home) {
-    const ledger = readJournalSnapshot(orchLedger(home));
-    const origin = (wid) => ledger.find(e => e.type === JT.created && e.wid === wid)?.origin;
+    const ledger = readJournalSnapshot(orchLedger(home)), ix = ledgerIndex(ledger);
+    const origin = (wid) => ix.created.get(wid)?.origin;
     const hold = (wid) => holdOf(ledger, wid, origin(wid));
-    const since = ledger.filter(e => e.type === "drain").at(-1)?.ts;
+    const since = ix.lastDrain !== undefined ? ledger[ix.lastDrain].ts : undefined;
     return { ...(since !== undefined ? { since } : {}), held: wid => hold(wid) !== undefined };
 }
 /** P25: Snapshot every workflow under DSA_HOME (newest first by wid, which is a ULID); `paused` marks work a drain holds. */
@@ -302,7 +405,7 @@ export function compactWorkflow(wf) {
             const r = c.result, last = r?.output?.split("\n").map(l => l.trim()).filter(Boolean).at(-1);
             return { key: c.key, gen: c.gen, callId: c.callId, phase: c.phase, ...(r ? { status: r.status, ok: r.ok } : {}),
                 ...(c.model ? { model: c.model } : {}), ...(c.tools ? { tools: c.tools } : {}), ...(c.pending ? { pending: c.pending } : {}), ...(c.switching ? { switching: c.switching } : {}), ...(nonzero(c.usage) ? { usage: c.usage } : {}),
-                ...(last ? { lastLine: clip(last, 200) } : {}), ...(r?.error ? { error: clip(r.error, 300) } : {}) };
+                ...(last ? { lastLine: clip(last, 200) } : {}), ...(r?.error ? { error: clip(r.error, 300) } : {}), ...(c.hibernated ? { hibernated: true } : {}) };
         }),
         attention: wf.attention.map(a => ({ id: a.id, rev: a.rev, kind: a.kind, text: clip(a.text, 300), ...(a.call ? { call: a.call } : {}), ...(a.qid ? { qid: a.qid } : {}) })),
         ...(wf.paused ? { paused: true } : {}), ...(wf.followUps ? { followUps: wf.followUps } : {}),
@@ -338,7 +441,8 @@ export function statusView(home, options = {}) {
     const hidden = all.length - shown.length;
     const paused = all.filter(w => w.paused).length;
     return { workflows: shown.map(compactWorkflow), ...(hidden ? { olderFinished: hidden, hint: "status wid=<wid> shows any workflow in detail" } : {}),
-        ...(paused ? { paused: `${paused} workflow${paused > 1 ? "s" : ""} paused (stop-all, drain or a quit pi) since ${new Date(since).toISOString()}; resume continues them (new runs are not affected)` } : {}) };
+        ...(paused ? { paused: `${paused} workflow${paused > 1 ? "s" : ""} paused (stop-all, drain or a quit pi) since ${new Date(since).toISOString()}; resume continues them (new runs are not affected)` } : {}),
+        ...slotsView(home) };
 }
 const FINAL = ["done", "failed", "stopped"];
 /** Finished with nothing left running (a follow-up on a finished workflow is live work). */
@@ -347,6 +451,33 @@ const age = (ms) => ms < 60_000 ? `${Math.max(0, Math.round(ms / 1000))}s` : ms
 const tokens = (u) => { const n = u ? u.input + u.output : 0; return n >= 1e6 ? `${(n / 1e6).toFixed(1)}M` : n >= 1e3 ? `${(n / 1e3).toFixed(1)}K` : String(n); };
 /** The latest generation of every key, in first-call order. */
 const latestCalls = (wf) => [...new Map(wf.calls.map(c => [c.key, c])).values()];
+/** Provider slots from the orchestrator ledger: holders per provider (hold/release{pool,slot,exec}) and the limits of
+ *  the settings in effect (the latest config{hash,config}); config-rejected after it is reported too. */
+export function slotsView(home, now = Date.now()) {
+    const held = new Map();
+    let config, rejected;
+    for (const e of readJournalSnapshot(orchLedger(home))) {
+        if (e.type === "hold")
+            held.set(`${e.pool}:${e.slot}`, e);
+        else if (e.type === "release" && held.get(`${e.pool}:${e.slot}`)?.exec === e.exec)
+            held.delete(`${e.pool}:${e.slot}`);
+        else if (e.type === "config") {
+            config = e;
+            rejected = undefined;
+        }
+        else if (e.type === "config-rejected")
+            rejected = e;
+    }
+    const limits = (config?.config?.providers) ?? {};
+    const holders = new Map();
+    for (const e of held.values())
+        if (e.pool !== "memory")
+            holders.set(String(e.pool), (holders.get(String(e.pool)) ?? 0) + 1);
+    const names = [...new Set([...Object.keys(limits), ...holders.keys()])].sort();
+    const slots = names.map(p => { const n = holders.get(p) ?? 0, limit = limits[p]?.slots; return typeof limit === "number" ? `${p} ${n}/${limit}` : `${p} ${n} (no limit)`; });
+    return { ...(slots.length ? { slots } : {}), ...(config ? { config: `${String(config.hash)} since ${age(now - config.ts)} ago` } : {}),
+        ...(rejected ? { configRejected: `${clip(String(rejected.error), 200)} (${age(now - rejected.ts)} ago); ${config ? String(config.hash) : "the start settings"} stay in effect` } : {}) };
+}
 /** Tool status without a wid: what runs, what waits for an answer and what failed, with finished workflows one line each.
  *  The full view (every call's last line and usage) ran to tens of thousands of tokens on a busy home. */
 export function statusBrief(home, options = {}) {
@@ -366,9 +497,11 @@ export function statusBrief(home, options = {}) {
                 ...(live && c.startedAt !== undefined ? { for: age(now - c.startedAt) } : {}),
                 ...(live && c.phase !== "asking" && quiet !== undefined && quiet >= 60_000 ? { quiet: age(quiet) } : {}),
                 ...(live && c.startedAt !== undefined ? { tokens: tokens(c.usage) } : {}),
-                ...(c.result ? { status: c.result.status, ...(c.result.error ? { error: clip(c.result.error, 200) } : {}) } : {}) };
+                ...(c.result ? { status: c.result.status, ...(c.result.error ? { error: clip(c.result.error, 200) } : {}) } : {}),
+                ...(c.hibernated ? { hibernated: true } : {}) };
         });
-        const asking = open.filter(a => a.kind === "question" && a.call).map(a => ({ to: `${w.wid}/${callKey(a.call)}`, ...(a.qid ? { qid: a.qid } : {}), question: clip(a.text, 300) }));
+        const asking = open.filter(a => a.kind === "question" && a.call).map(a => ({ to: `${w.wid}/${callKey(a.call)}`, ...(a.qid ? { qid: a.qid } : {}),
+            ...(w.calls.some(c => c.callId === a.call && c.hibernated) ? { hibernated: true } : {}), question: clip(a.text, 300) }));
         const alerts = open.filter(a => a.kind !== "question").map(a => `${a.kind}${a.call ? ` ${w.wid}/${callKey(a.call)}` : ""}: ${clip(a.text, 200)}`);
         return { wid: w.wid, ...(w.name ? { name: w.name } : {}), status: w.status, ...(w.paused ? { paused: true } : {}), ...(w.followUps ? { followUps: w.followUps } : {}),
             progress: `${p.done}/${p.total}${p.plus ? "+" : ""}`, tokens: tokens(w.usage), calls,
@@ -383,7 +516,7 @@ export function statusBrief(home, options = {}) {
     return {
         active: active.filter(mine).map(brief), ...(others.length ? { otherSessions: others.slice(0, 10).map(line) } : {}),
         finished: finished.slice(0, keep).map(line), ...(finished.length > keep ? { olderFinished: finished.length - keep } : {}),
-        ...(paused ? { paused } : {}),
+        ...(paused ? { paused } : {}), ...slotsView(home, now),
         hint: "status wid=<wid> shows one workflow (outputs clipped); add key=<key> for one call's full result, or full:true for everything",
     };
 }

package/dist/ui/data.js

@@ -44,6 +44,10 @@ export class LazyMap extends Map {
         this.produce(key); return super.get(key); }
     has(key) { return this.get(key) !== undefined; }
 }
+/** How long after its seal a call's session is still followed. A sealed execution has been fenced, so its session is
+ *  final: a follow-up or a revision runs as a new generation with its own session. A session changed after that (by
+ *  hand) shows in a new pi session only. */
+const FINAL_MS = 10_000;
 /** A1, P25: Read the UI's data from durable workflow snapshots and native session tails only. */
 export class UiData {
     workflows = [];
@@ -56,8 +60,21 @@ export class UiData {
     /** Where the dock sits: below the editor (default; never splits an editor header such as a powerline bar) or above. */
     dockAt = "above";
     /** Per-refresh budget (ms) for reading not yet read finished sessions (history) in the background. */
-    warmMs = 15;
+    warmMs = 8;
     tails = new Map();
+    /** Facts of calls sealed more than FINAL_MS ago, read once after their seal; their transcript is read when shown. */
+    final = new Map();
+    /** The transcript of one final call last asked for (the open call view asks on every frame). Keeping every
+     *  historical transcript parsed held hundreds of MB and made pi's garbage collection pause typing. */
+    opened;
+    transcript(callId, sessions) {
+        const final = this.final.get(callId);
+        if (!final)
+            return;
+        if (this.opened?.callId !== callId || this.opened.endedAt !== final.endedAt)
+            this.opened = { callId, endedAt: final.endedAt, entries: sessionBranch(new SessionTail().read(final.path)) };
+        sessions.put(callId, this.opened.entries);
+    }
     /** Branch and facts per call, reused while its session tail is unchanged: a finished call's session never grows, and
      *  re-deriving every historical call on each refresh blocked pi's main thread for over a second. */
     derived = new Map();
@@ -65,11 +82,20 @@ export class UiData {
     constructor(home) { this.home = home; }
     refresh() {
         const workflows = allWorkflows(this.home), known = new Set(), deferred = new Map();
-        const facts = new LazyMap(key => deferred.get(key)?.()), sessions = new LazyMap(key => deferred.get(key)?.());
+        const facts = new LazyMap(key => deferred.get(key)?.());
+        const sessions = new LazyMap(key => deferred.has(key) ? deferred.get(key)() : this.transcript(key, sessions));
         for (const w of workflows) {
-            const index = journalIndex(readJournalSnapshot(journalPath(this.home, w.wid)));
+            let index; // only calls still followed need it
+            const journal = () => index ??= journalIndex(readJournalSnapshot(journalPath(this.home, w.wid)));
             for (const c of w.calls) {
                 known.add(c.callId);
+                const final = this.final.get(c.callId);
+                if (final && c.phase === "sealed" && c.endedAt === final.endedAt) {
+                    facts.put(c.callId, final.facts);
+                    continue;
+                }
+                if (final)
+                    this.final.delete(c.callId);
                 const load = () => {
                     deferred.delete(c.callId);
                     let tail = this.tails.get(c.callId);
@@ -85,16 +111,23 @@ export class UiData {
                         this.derived.set(c.callId, cached);
                     }
                     const value = { ...cached.facts, live: undefined };
-                    const proposal = index.calls.get(`${c.key}\0${c.gen}`);
+                    const proposal = journal().calls.get(`${c.key}\0${c.gen}`);
                     value.task ||= String(proposal?.spec?.task ?? "");
-                    const loss = index.losses.get(String(c.exec)) ?? -1;
-                    const launch = index.execs.get(String(c.exec)) ?? -1;
+                    const loss = journal().losses.get(String(c.exec)) ?? -1;
+                    const launch = journal().execs.get(String(c.exec)) ?? -1;
                     if (c.phase !== "sealed" && loss > launch)
                         value.activity = "connection dropped, retrying";
                     if (c.phase !== "sealed")
                         value.live = readLive(join(callDir(this.home, w.wid, c.key, c.gen), LIVE_FILE));
                     sessions.put(c.callId, cached.entries);
                     facts.put(c.callId, value);
+                    // A call sealed a while ago writes nothing more (a follow-up opens a new generation and session), so its
+                    // session is not stat'ed again: polling every historical session twice a second kept pi's main thread busy.
+                    if (c.phase === "sealed" && c.endedAt !== undefined && Date.now() - c.endedAt > FINAL_MS) {
+                        this.final.set(c.callId, { endedAt: c.endedAt, path: callSession(this.home, w.wid, c.key, c.gen), facts: value });
+                        this.tails.delete(c.callId);
+                        this.derived.delete(c.callId);
+                    }
                 };
                 // A finished call never read before (history at startup) is read when first shown or by the idle warm-up below;
                 // reading every historical session up front blocked pi's startup for seconds.
@@ -109,6 +142,9 @@ export class UiData {
                 this.tails.delete(key);
                 this.derived.delete(key);
             }
+        for (const key of this.final.keys())
+            if (!known.has(key))
+                this.final.delete(key);
         // Warm the history a slice at a time, so opening the list later finds it read without one long stall now.
         const until = performance.now() + this.warmMs;
         for (const load of [...deferred.values()]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-durable-subagents",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "Subagents for pi that never lose work and never do it twice. Crash-safe workflows, automatic recovery, and a live view just like the main agent.",
   "type": "module",
   "license": "MIT",