reactor-effect-client 0.5.0 → 0.6.0

package/dist/orchestration/renewal.js

@@ -21,8 +21,9 @@ import * as Sequence from "../Sequence.js";
 import * as Submission from "../Submission.js";
 import * as MediaBuffer from "./media-buffer.js";
 import * as SourceSlot from "./source-slot.js";
+import * as Retention from "./retention.js";
 import { monotonicMillis } from "./elapsed.js";
-import { canHandoff, decideRenewal } from "./renewal-state.js";
+import { handoffEvidence, decideRenewal } from "./renewal-state.js";
 import { PolicyFailure, captureRequest } from "./request.js";
 import { emptyState, isIdle } from "./queries.js";
 import { activeIds, generation, resolve } from "./routing.js";
@@ -43,11 +44,39 @@ const withSessionId = (state, sessionId) => {
         })),
     });
 };
+/** A completed caller handle keeps only its Exit, not the routing or source closures. */
+const logicalSubmission = (id) => {
+    let execute;
+    let inspect;
+    let outcome;
+    return {
+        attach: (submit, state) => {
+            execute = submit;
+            inspect = state;
+        },
+        complete: (exit) => {
+            outcome ??= exit;
+            execute = undefined;
+            inspect = undefined;
+        },
+        outcome: () => outcome,
+        submission: {
+            id,
+            submit: Effect.suspend(() => outcome ?? execute ?? Effect.die(new Error("Logical submission has no execution"))),
+            state: Effect.suspend(() => outcome === undefined
+                ? (inspect ?? Effect.succeed({ _tag: "Prepared" }))
+                : Effect.succeed({
+                    _tag: "Completed",
+                    exit: outcome,
+                })),
+        },
+    };
+};
 /**
  * Explicit application policy for renewal, sequence affinity and continuous
  * recovering media. A physical source still owns each connection generation.
  */
-export const make = (options) => Effect.gen(function* () {
+const makeOwner = (options, continuous) => Effect.gen(function* () {
     const scope = yield* Effect.scope;
     const context = yield* Effect.context();
     const clock = yield* Clock.Clock;
@@ -56,7 +85,6 @@ export const make = (options) => Effect.gen(function* () {
         .pipe(Effect.mapError((cause) => errorOf(cause, "InvalidState")));
     const namespace = Array.from(random, (byte) => byte.toString(16).padStart(2, "0")).join("");
     const commands = yield* Semaphore.make(1);
-    const closeGate = yield* Semaphore.make(1);
     const affinity = yield* Sequence.makeAffinity().pipe(Effect.mapError((cause) => errorOf(cause, "InvalidInput")));
     // One ordered stream: engine events, renewals and media transitions.
     const observations = new Observations();
@@ -67,10 +95,14 @@ export const make = (options) => Effect.gen(function* () {
     const fatal = yield* Deferred.make();
     let renewing = true;
     const slots = new Map();
+    const physicalOwners = new Map();
+    const retention = continuous ? yield* Retention.make(options) : undefined;
+    let incarnation = 0n;
     const cleanups = [];
     const seenCleanups = new Set();
-    const maxSessions = options.maxSessions ?? 64;
-    if (!Number.isSafeInteger(maxSessions) || maxSessions < 1 || maxSessions > 4096) {
+    const maxSessions = options.maxSessions ?? (continuous ? Infinity : 64);
+    if ((options.maxSessions !== undefined || !continuous) &&
+        (!Number.isSafeInteger(maxSessions) || maxSessions < 1 || maxSessions > 4096)) {
         return yield* ReactorError.fromCode("InvalidInput", "Invalid orchestration bounds");
     }
     const reconnectTimeout = Duration.toMillis(yield* parsed(() => duration(options.reconnectTimeout ?? "10 seconds", "orchestration reconnectTimeout")));
@@ -82,14 +114,37 @@ export const make = (options) => Effect.gen(function* () {
     const leadSeconds = Duration.toSeconds(yield* parsed(() => duration(options.lead ?? "30 seconds", "orchestration lead", { allowZero: true })));
     let current;
     let replacement = { _tag: "Absent" };
-    let opened = 0;
+    let opened = 0n;
     let openFailures = 0;
     let retryAt = 0;
     let autoplay = true;
     let closing = false;
     let finalReport;
+    let finalSummary;
+    let firstCleanup;
+    let initializing = true;
+    // Close reports each ownership attempt's failures once. They are recorded
+    // where the attempt and its retirement end: every waiter of a cached close
+    // sees its own Cause object, and cancellation by close is not a failure.
+    const attemptFailures = new Map();
+    const recordFailure = (attempt, reasons) => {
+        const failed = reasons.filter((reason) => !Cause.isInterruptReason(reason));
+        if (failed.length > 0)
+            attemptFailures.set(attempt, [...(attemptFailures.get(attempt) ?? []), ...failed]);
+    };
+    // Every acquisition runs on a fiber this owner forks into its scope, never
+    // on a caller's fiber. Close interrupts and joins the registered ones before
+    // retiring owned slots, so no source opens after close and every attempt's
+    // cleanup is reported, without waiting on a fiber that may be waiting on it.
+    const acquisitions = new Set();
+    const admissionClosed = () => ReactorError.fromCode("Closed", "Orchestration no longer admits sources");
+    // The owner stops renewing when close begins or its scope starts closing,
+    // whichever is first: that scope's finalizers can stop an attempt, or wait
+    // on an application, before close runs. Commands stay admitted until close
+    // begins, so an application finalizer can still issue its last commands.
+    const stopping = () => closing || scope.state._tag === "Closed";
     let mediaState = { _tag: "Closed" };
-    let terminalFailure;
+    let terminal;
     let submissionSequence = 0n;
     const announce = (event) => Effect.sync(() => observations.emit({ _tag: "Renewal", event }, 256));
     const log = (message) => Effect.logDebug(message).pipe(Effect.annotateLogs({ module: "reactor.orchestration" }));
@@ -104,20 +159,33 @@ export const make = (options) => Effect.gen(function* () {
         ? undefined
         : yield* observations.subscribe({ capacity: 4096 }).pipe(Effect.flatMap((stream) => stream.pipe(Stream.filterMap(renewalsOnly), Stream.runForEach((event) => Effect.suspend(() => onRenewal(event)).pipe(Effect.catchCause((cause) => Effect.logWarning("onRenewal failed", cause).pipe(Effect.annotateLogs({ module: "reactor.orchestration" }))))), Effect.catchCause((cause) => Effect.logWarning("onRenewal reader stopped", cause).pipe(Effect.annotateLogs({ module: "reactor.orchestration" }))), Effect.forkIn(scope))));
     const fail = (cause) => Effect.suspend(() => {
-        if (terminalFailure !== undefined)
+        if (terminal !== undefined)
             return Effect.void;
-        terminalFailure = cause;
+        terminal = Exit.succeed(cause);
         // Publish the failed state and queues before waking a failure waiter.
         setMedia({ _tag: "Failed", cause });
         emit({ _tag: "SessionFailed", failure: cause });
-        buffer.fail(cause);
+        buffer.failCause(Cause.fail(cause));
         Deferred.doneUnsafe(fatal, Effect.succeed(cause));
         return announce({ _tag: "Failed", reason: cause.message });
     });
+    // A failed worker must wake observers as well as failure waiters: the
+    // scheduler consumes observations, and cannot recover a vanished worker.
+    // Claim and publish synchronously before a waiter can close this owner.
+    const supervise = (effect) => effect.pipe(Effect.onExit((exit) => Effect.sync(() => {
+        if (Exit.isSuccess(exit) ||
+            terminal !== undefined ||
+            (stopping() && Cause.hasInterruptsOnly(exit.cause)))
+            return;
+        terminal = Exit.failCause(exit.cause);
+        buffer.failCause(exit.cause);
+        observations.failCause(exit.cause);
+        Deferred.doneUnsafe(fatal, terminal);
+    })));
     // Every asynchronous activation uses this final fence. Closed/failed state
     // cannot be replaced by a reconnect or autoplay operation that finished late.
     const publishReady = (slot) => {
-        if (closing || slot.closed || slot !== current || terminalFailure !== undefined)
+        if (stopping() || slot.closed || slot !== current || terminal !== undefined)
             return false;
         setMedia({ _tag: "Ready", sessionId: slot.source.id, generation: slot.media.generation });
         return true;
@@ -128,7 +196,7 @@ export const make = (options) => Effect.gen(function* () {
         seenCleanups.add(cleanup.lease);
         cleanups.push(cleanup);
     };
-    const openSequences = (slot) => affinity.snapshots.pipe(Effect.map((entries) => entries.some((entry) => entry.owner === slot.source.id && entry.status === "open")));
+    const openSequences = (slot) => affinity.snapshots.pipe(Effect.map((entries) => entries.some((entry) => entry.owner === slot.owner && entry.status === "open")));
     const expired = (slot) => slot.expired();
     const recoveryBudget = (slot) => slot.recoveryBudget();
     // The logical output's loss: every former owner's loss while it fed the
@@ -136,18 +204,23 @@ export const make = (options) => Effect.gen(function* () {
     // replacement's loss before it fed the output is not the output's.
     let outputLoss = SourceSlot.noLoss;
     let ownerBaseline = SourceSlot.noLoss;
+    let outputOwner;
     const ownerLoss = (slot) => Effect.result(slot.pressure.pipe(Effect.timeout(recoveryBudget(slot)))).pipe(Effect.map(SourceSlot.lossOf));
     const activateOwner = (slot) => ownerLoss(slot).pipe(Effect.map((loss) => {
         ownerBaseline = loss;
+        outputOwner = slot.owner;
     }));
-    const retireOwner = (slot) => ownerLoss(slot).pipe(Effect.map((loss) => {
-        outputLoss = SourceSlot.addLoss(outputLoss, SourceSlot.subtractLoss(loss, ownerBaseline));
-        ownerBaseline = SourceSlot.noLoss;
-    }));
+    const retireOwner = (slot) => Effect.suspend(() => outputOwner !== slot.owner
+        ? Effect.void
+        : ownerLoss(slot).pipe(Effect.map((loss) => {
+            outputLoss = SourceSlot.addLoss(outputLoss, SourceSlot.subtractLoss(loss, ownerBaseline));
+            ownerBaseline = SourceSlot.noLoss;
+            outputOwner = undefined;
+        })));
     const retired = (slot) => slot.retired(buffer.forwarded);
     const closeSlot = (slot) => slot.close;
     const replace = (slot, cause) => Effect.gen(function* () {
-        if (slot.closed || closing || terminalFailure !== undefined)
+        if (slot.closed || stopping() || terminal !== undefined)
             return;
         const state = yield* slot.source.state;
         const lost = activeIds(state);
@@ -170,7 +243,8 @@ export const make = (options) => Effect.gen(function* () {
         });
         if (replacement._tag === "Ready" && replacement.slot === slot)
             replacement = { _tag: "Absent" };
-        if (slot !== current)
+        // Close retires what remains; a replacement it refuses is no failure.
+        if (slot !== current || stopping())
             return;
         const pending = replacement;
         if (!renewing && pending._tag === "Absent") {
@@ -179,10 +253,12 @@ export const make = (options) => Effect.gen(function* () {
         }
         const selected = pending._tag === "Ready"
             ? pending.slot
-            : yield* pending._tag === "Opening" ? Fiber.join(pending.fiber) : acquire;
+            : yield* pending._tag === "Opening"
+                ? Effect.uninterruptibleMask((restore) => joinAcquisition(pending.fiber, restore))
+                : acquire;
         replacement = { _tag: "Absent" };
-        if (closing || terminalFailure !== undefined) {
-            yield* selected.close;
+        if (stopping() || terminal !== undefined) {
+            yield* closeSlot(selected);
             return;
         }
         current = selected;
@@ -191,15 +267,15 @@ export const make = (options) => Effect.gen(function* () {
         if (!publishReady(current))
             return;
         yield* log("Replaced lost session; local queue resumes on the new connection");
-    }).pipe(Effect.withSpan("reactor.orchestration.renewal.replace", { attributes: { "reactor.session.id": slot.source.id } }, { captureStackTrace: false }), Effect.catch(fail));
+    }).pipe(Effect.withSpan("reactor.orchestration.renewal.replace", { attributes: { "reactor.session.id": slot.source.id } }, { captureStackTrace: false }), Effect.catch((cause) => (stopping() ? Effect.void : fail(cause))));
     const recover = (slot, cause) => Effect.gen(function* () {
-        if (slot.closed || closing || terminalFailure !== undefined)
+        if (slot.closed || stopping() || terminal !== undefined)
             return;
         if (slot === current)
             setMedia({ _tag: "Recovering", sessionId: slot.source.id, cause });
         yield* announce({ _tag: "Recovering", sessionId: slot.source.id, reason: cause.message });
         yield* slot.joinCommitted(recoveryBudget(slot));
-        if (slot.closed || closing || terminalFailure !== undefined)
+        if (slot.closed || stopping() || terminal !== undefined)
             return;
         if (slot.needsReplacement()) {
             yield* replace(slot, cause);
@@ -215,13 +291,13 @@ export const make = (options) => Effect.gen(function* () {
             return;
         }
         yield* slot.closeMedia;
-        if (slot.closed || closing || terminalFailure !== undefined)
+        if (slot.closed || stopping() || terminal !== undefined)
             return;
         const connected = yield* Effect.result(slot.source.reconnect.pipe(Effect.timeoutOrElse({
             duration: recoveryBudget(slot),
             orElse: () => Effect.fail(ReactorError.fromCode("Disconnected", "Explicit source reconnect timed out")),
         })));
-        if (slot.closed || closing || terminalFailure !== undefined)
+        if (slot.closed || stopping() || terminal !== undefined)
             return;
         if (Result.isFailure(connected)) {
             yield* replace(slot, connected.failure);
@@ -245,7 +321,7 @@ export const make = (options) => Effect.gen(function* () {
             yield* slot.replaceMedia(media, previousPressure);
             return yield* startMedia(slot);
         }));
-        if (slot.closed || closing || terminalFailure !== undefined)
+        if (slot.closed || stopping() || terminal !== undefined)
             return;
         if (Result.isFailure(restarted)) {
             yield* replace(slot, restarted.failure);
@@ -264,35 +340,54 @@ export const make = (options) => Effect.gen(function* () {
         });
     }).pipe(Effect.withSpan("reactor.orchestration.renewal.recover", { attributes: { "reactor.session.id": slot.source.id } }, { captureStackTrace: false }));
     const scheduleRecovery = (slot, cause, mode) => Effect.gen(function* () {
-        if (slot.closed || closing || terminalFailure !== undefined)
+        if (slot.closed || stopping() || terminal !== undefined)
             return;
         if (!slot.beginRecovery(mode))
             return;
-        yield* recover(slot, cause).pipe(commands.withPermits(1), Effect.forkIn(scope));
+        yield* recover(slot, cause).pipe(commands.withPermits(1), supervise, Effect.forkIn(scope));
     });
     const startMedia = (slot) => slot.startMedia({
         video: (frame) => Effect.suspend(() => {
-            if (slot !== current || terminalFailure !== undefined)
+            if (slot !== current || terminal !== undefined)
                 return Effect.void;
             if (slot.recordVideo() && replacement._tag === "Ready")
                 emit({ _tag: "HandoffReady", sessionId: slot.source.id });
             return buffer.offerVideo(frame).pipe(Effect.catch(fail));
         }),
         audio: (frame) => Effect.suspend(() => {
-            if (slot !== current || terminalFailure !== undefined)
+            if (slot !== current || terminal !== undefined)
                 return Effect.void;
             return buffer.offerAudio(frame).pipe(Effect.tap(() => Effect.sync(() => {
                 slot.recordAudio(frame.samples.length);
             })), Effect.catch(fail));
         }),
-        lost: (cause) => (closing ? Effect.void : scheduleRecovery(slot, cause, "reconnect")),
+        lost: (cause) => (stopping() ? Effect.void : scheduleRecovery(slot, cause, "reconnect")),
     });
-    const acquire = Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+    // Runs only on a fiber of its own, forked into the owner's scope.
+    const acquisition = Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+        const fiber = yield* Effect.fiber;
         if (opened >= maxSessions)
             return yield* ReactorError.fromCode("Overflow", "Orchestration session and cleanup-history bound reached");
+        if (stopping() || (continuous && (terminal !== undefined || !renewing)))
+            return yield* admissionClosed();
+        // Registered in the same synchronous step as the stopping check, so
+        // either close sees this attempt or this attempt sees close.
+        acquisitions.add(fiber);
+        const reservation = retention === undefined ? undefined : yield* retention.reserve;
+        const attemptIncarnation = reservation?.incarnation ?? ++incarnation;
+        const recordAttempt = (cleanup) => {
+            if (initializing && firstCleanup === undefined)
+                firstCleanup = cleanup;
+            return retention !== undefined && reservation !== undefined
+                ? retention.record(reservation, cleanup)
+                : Effect.sync(() => recordCleanup(cleanup));
+        };
         const owned = yield* Scope.make();
+        const attempt = {};
         let acquired;
         let acquiredSource;
+        let acquisitionCleanup;
+        let acquisitionDefect;
         return yield* restore(Effect.gen(function* () {
             // Replace the captured Scope explicitly in one context operation.
             // Dependency provision order cannot move resources to the caller's owner.
@@ -301,26 +396,66 @@ export const make = (options) => Effect.gen(function* () {
                 orElse: () => Effect.fail(ReactorError.fromCode("InvalidState", "Source acquisition timed out")),
             }));
             acquiredSource = value.source;
+            if (retention !== undefined && reservation !== undefined)
+                yield* retention.identify(reservation, value.source.id);
+            const owner = Object.freeze({
+                namespace,
+                incarnation: attemptIncarnation,
+                sessionId: value.source.id,
+            });
             const lifetime = yield* parsed(() => duration(value.lifetime, "source lifetime", { allowInfinite: true }));
             // A lead as long as the lifetime would prepare a replacement at once,
             // after every open, bounded only by maxSessions.
             if (Duration.isFinite(lifetime) && leadSeconds >= Duration.toSeconds(lifetime))
                 return yield* ReactorError.fromCode("InvalidInput", "renewal lead must be shorter than the source lifetime", { operation: "renewal", outcome: "not-submitted" });
-            if (slots.has(value.source.id))
+            if (physicalOwners.has(value.source.id))
                 return yield* ReactorError.fromCode("InvalidInput", "Orchestration sources must have distinct session identities");
             const media = yield* value.source.media;
-            const slot = yield* SourceSlot.make({
+            const local = yield* SourceSlot.make({
                 source: value.source,
                 scope: owned,
                 media,
                 openedAt: monotonicMillis(clock),
                 maxSeconds: Duration.toSeconds(lifetime),
                 cleanupBudgetMs: reconnectTimeout,
-                recordCleanup,
-                retireSequences: affinity.retire(value.source.id).pipe(Effect.asVoid),
+                recordCleanup: recordAttempt,
+                boundedHistory: continuous,
+                retired: (facts, retirementExit) => Effect.gen(function* () {
+                    const bookkeeping = yield* Effect.exit(Effect.gen(function* () {
+                        if (acquisitionCleanup !== undefined)
+                            yield* recordAttempt(acquisitionCleanup);
+                        if (retention === undefined || reservation === undefined)
+                            return;
+                        const lossExit = acquired === undefined
+                            ? Exit.void
+                            : yield* Effect.exit(retireOwner(acquired));
+                        yield* retention.finish(reservation, {
+                            ...facts,
+                            errors: [
+                                ...facts.errors,
+                                ...(acquisitionDefect === undefined ? [] : [acquisitionDefect]),
+                                ...(Exit.isFailure(lossExit)
+                                    ? [errorOf(lossExit.cause, "InvalidState", "media loss accounting")]
+                                    : []),
+                            ],
+                        });
+                        slots.delete(owner);
+                        if (physicalOwners.get(owner.sessionId) === owner)
+                            physicalOwners.delete(owner.sessionId);
+                        return yield* lossExit;
+                    }));
+                    // The slot calls this once, however many callers wait on its close.
+                    const exit = Exit.asVoidAll([retirementExit, bookkeeping]);
+                    if (Exit.isFailure(exit))
+                        recordFailure(attempt, exit.cause.reasons);
+                    return yield* bookkeeping;
+                }),
+                retireSequences: affinity.retire(owner).pipe(Effect.asVoid),
             });
+            const slot = Object.assign(local, { owner });
             acquired = slot;
-            slots.set(slot.source.id, slot);
+            slots.set(owner, slot);
+            physicalOwners.set(owner.sessionId, owner);
             opened++;
             yield* slot.source.setAutoplay(false);
             yield* slot.observe((event) => Effect.gen(function* () {
@@ -355,46 +490,127 @@ export const make = (options) => Effect.gen(function* () {
         })).pipe(Effect.onExit((exit) => Exit.isSuccess(exit)
             ? Effect.void
             : Effect.gen(function* () {
+                // Capture an acquisition failure even if the source also
+                // returns cleanup. Conflicting reports belong to this attempt.
+                // A typed failure is the attempt's result, and cancellation
+                // is not a defect: only a Die is a failure close must report.
+                const defects = exit.cause.reasons.filter(Cause.isDieReason);
+                if (defects.length > 0) {
+                    recordFailure(attempt, defects);
+                    acquisitionDefect = errorOf(Cause.fromReasons(defects), "InvalidState", "source acquisition");
+                }
+                const failure = Cause.findErrorOption(exit.cause);
+                if (Option.isSome(failure) && AcquisitionFailure.is(failure.value))
+                    acquisitionCleanup = { lease: failure.value.cleanup, policy: [] };
                 if (acquired !== undefined)
                     yield* closeSlot(acquired);
                 else {
-                    if (acquiredSource !== undefined)
-                        recordCleanup(yield* acquiredSource.close);
-                    yield* Scope.close(owned, exit);
-                    if (Exit.isFailure(exit)) {
-                        const failure = Cause.findErrorOption(exit.cause);
-                        if (Option.isSome(failure) && AcquisitionFailure.is(failure.value))
-                            recordCleanup({ lease: failure.value.cleanup, policy: [] });
+                    const sourceExit = acquiredSource === undefined
+                        ? Exit.void
+                        : yield* Effect.exit(acquiredSource.close.pipe(Effect.flatMap(recordAttempt)));
+                    const scopeExit = yield* Effect.exit(Scope.close(owned, exit));
+                    if (acquisitionCleanup !== undefined)
+                        yield* recordAttempt(acquisitionCleanup);
+                    if (retention !== undefined && reservation !== undefined) {
+                        yield* retention.finish(reservation, {
+                            accounting: "not-applicable",
+                            unknownSubmissions: 0n,
+                            affinity: "not-applicable",
+                            scope: Exit.isSuccess(scopeExit) ? "closed" : "failed",
+                            errors: [
+                                ...(acquisitionDefect === undefined ? [] : [acquisitionDefect]),
+                                ...[sourceExit, scopeExit].flatMap((result) => Exit.isFailure(result)
+                                    ? [errorOf(result.cause, "InvalidState", "acquisition retirement")]
+                                    : []),
+                            ],
+                        });
                     }
+                    const retirementExit = Exit.asVoidAll([sourceExit, scopeExit]);
+                    if (Exit.isFailure(retirementExit))
+                        recordFailure(attempt, retirementExit.cause.reasons);
+                    yield* retirementExit;
                 }
             })));
-    })).pipe(Effect.tap((slot) => Effect.annotateCurrentSpan("reactor.session.id", slot.source.id)), Effect.withSpan("reactor.orchestration.renewal.open", {}, { captureStackTrace: false }));
-    const close = closeGate.withPermit(Effect.uninterruptible(Effect.gen(function* () {
-        if (finalReport !== undefined)
-            return finalReport;
+    })).pipe(
+    // The attempt leaves the registry only after its own cleanup has run.
+    Effect.onExit(() => Effect.withFiber((fiber) => Effect.sync(() => void acquisitions.delete(fiber)))), Effect.tap((slot) => Effect.annotateCurrentSpan("reactor.session.id", slot.source.id)), Effect.withSpan("reactor.orchestration.renewal.open", {}, { captureStackTrace: false }));
+    // A forked attempt is interruptible whatever its caller is, so close and
+    // the owner's scope can stop an open that an uninterruptible caller waits on.
+    // A prepared replacement opens on its own after the tick that forks it.
+    const forkAcquisition = Effect.forkIn(acquisition, scope);
+    // To its caller, an attempt that close, stopRenewal or the owner's scope
+    // stopped is refused, not failed. Interrupted while the owner still admits
+    // sources, as by its own open, the attempt failed. A caller interrupted
+    // while it waits stops the attempt too: the handler is in place before the
+    // wait is restored, so an interruption that arrives first still reaches it.
+    const joinAcquisition = (fiber, restore) => restore(Fiber.await(fiber)).pipe(Effect.onInterrupt(() => Fiber.interrupt(fiber)), Effect.flatMap((exit) => {
+        if (Exit.isSuccess(exit))
+            return exit;
+        const failures = exit.cause.reasons.filter((reason) => !Cause.isInterruptReason(reason));
+        if (failures.length > 0)
+            return Effect.failCause(Cause.fromReasons(failures));
+        return stopping()
+            ? admissionClosed()
+            : ReactorError.fromCode("InvalidState", "Source acquisition was interrupted");
+    }));
+    // The constructor and a replacement start their attempt at once, so an open
+    // that completes without waiting is published in the same turn.
+    const acquire = Effect.uninterruptibleMask((restore) => Effect.forkIn(acquisition, scope, { startImmediately: true }).pipe(Effect.flatMap((fiber) => joinAcquisition(fiber, restore))));
+    const close = yield* SourceSlot.once(Effect.uninterruptible(Effect.gen(function* () {
         closing = true;
+        // Every registered fiber is an attempt this owner forked, never a
+        // caller's. Interrupting joins each attempt's cleanup, which records
+        // its own defects; cancelling it is not a close failure, and an
+        // Opening fiber that has not started never runs. Close does not wait
+        // for an attempt it runs on, but one issued from inside `open` cannot
+        // finish: `open` runs on a race fiber that stopping its attempt awaits.
+        const pending = new Set(acquisitions);
         if (replacement._tag === "Opening")
-            yield* Fiber.interrupt(replacement.fiber);
-        yield* Effect.forEach([...slots.values()], closeSlot, { discard: true });
+            pending.add(replacement.fiber);
+        yield* Effect.withFiber((self) => {
+            pending.delete(self);
+            return Fiber.interruptAll(pending);
+        });
+        for (const slot of [...slots.values()])
+            yield* Effect.exit(closeSlot(slot));
+        const exits = [...attemptFailures.values()].map((reasons) => Exit.failCause(Cause.fromReasons(reasons)));
         buffer.end();
         setMedia({ _tag: "Closed" });
         observations.end();
-        // The reader delivers what was announced before close, within a bound.
         if (renewalReader !== undefined)
             yield* Fiber.await(renewalReader).pipe(Effect.interruptible, Effect.timeout("1 second"), Effect.ignore);
-        finalReport = Object.freeze({ sessions: Object.freeze([...cleanups]) });
-        return finalReport;
+        if (retention === undefined)
+            finalReport = Object.freeze({ sessions: Object.freeze([...cleanups]) });
+        else
+            finalSummary = yield* retention.conclude;
+        // The closed owner stays current, so final loss totals remain readable.
+        replacement = { _tag: "Absent" };
+        return yield* Exit.asVoidAll(exits);
     })));
     yield* Effect.addFinalizer(() => close);
-    current = yield* acquire.pipe(Effect.tap((slot) => slot.source.setAutoplay(true)), Effect.catch((cause) => close.pipe(Effect.flatMap((report) => {
+    current = yield* acquire.pipe(Effect.tap((slot) => slot.source.setAutoplay(true)), 
+    // Fenced as publishReady is: construction returns no handle whose owner
+    // stopped while its first source was activated, and close retires it.
+    Effect.tap(() => Effect.gen(function* () {
+        if (stopping())
+            return yield* admissionClosed();
+    })), Effect.catch((cause) => Effect.exit(close).pipe(Effect.flatMap((closed) => {
         // An AcquisitionFailure from `open` already carries the lease it
         // recorded, by reference; any later failure takes the recorded lease.
-        const lease = report.sessions[0]?.lease;
-        return Effect.fail(AcquisitionFailure.is(cause) || (lease === undefined && ReactorError.is(cause))
+        const lease = firstCleanup?.lease;
+        const failure = AcquisitionFailure.is(cause) || (lease === undefined && ReactorError.is(cause))
             ? cause
-            : AcquisitionFailure.from(cause, lease ?? noAcquisition));
+            : AcquisitionFailure.from(cause, lease ?? noAcquisition);
+        // A defect of the close that retired the attempt stays beside the
+        // typed failure, which the caller still handles.
+        return Exit.isSuccess(closed)
+            ? Effect.fail(failure)
+            : Effect.failCause(Cause.combine(Cause.fail(failure), closed.cause));
     }))));
+    initializing = false;
+    firstCleanup = undefined;
     // The first owner's loss from its start is the output's: no baseline.
+    outputOwner = current.owner;
     setMedia({
         _tag: "Ready",
         sessionId: current.source.id,
@@ -412,7 +628,7 @@ export const make = (options) => Effect.gen(function* () {
     });
     const route = (request) => Effect.gen(function* () {
         const values = yield* Effect.suspend(() => Effect.forEach([...slots.values()], (slot) => Effect.map(slot.source.state, (state) => ({
-            owner: slot.source.id,
+            owner: slot.owner,
             state,
             accepted: slot.accepted,
             closed: slot.closed,
@@ -425,27 +641,43 @@ export const make = (options) => Effect.gen(function* () {
             : current;
         if (preferred === undefined)
             return yield* PolicyFailure.refuse("SessionRecovering", "No source is ready");
-        return yield* resolve(request, values, preferred.source.id, binding);
+        return yield* resolve(request, values, preferred.owner, binding);
     });
     const sequenceError = (error) => PolicyFailure.sequence(error.sequenceId, error.code);
     const prepare = (input, expectedSessionId) => Effect.gen(function* () {
+        const expectedOwner = expectedSessionId === undefined ? undefined : physicalOwners.get(expectedSessionId);
         const request = yield* captureRequest(input);
         const id = `${namespace}:${++submissionSequence}`;
         const gate = yield* Semaphore.make(1);
+        const logical = logicalSubmission(id);
+        let selectedOwner;
         let active;
         let activeOwner;
         const submit = gate.withPermit(Effect.gen(function* () {
+            const completed = logical.outcome();
+            if (completed !== undefined)
+                return yield* completed;
             if (active === undefined) {
                 // A committed submission remains a readable outcome after the handle
                 // closes. Only selecting or committing fresh work needs a live owner.
                 yield* guard("enqueue", Effect.void);
                 const decision = yield* route(request).pipe(commands.withPermits(1));
-                if (expectedSessionId !== undefined && decision.owner !== expectedSessionId)
+                if (expectedSessionId !== undefined && decision.owner !== expectedOwner)
                     return yield* PolicyFailure.refuse("RouteChanged", "The selected source changed before dispatch");
+                if (continuous && selectedOwner !== undefined && selectedOwner !== decision.owner) {
+                    // The selection stays fenced to its incarnation. While that
+                    // source is live, only the route moved; it has not retired.
+                    const selected = slots.get(selectedOwner);
+                    return yield* selected !== undefined && !selected.closed
+                        ? PolicyFailure.refuse("RouteChanged", "The selected source changed before dispatch")
+                        : PolicyFailure.refuse("SessionRetired", "Selected source incarnation was retired");
+                }
+                selectedOwner = decision.owner;
                 const target = slots.get(decision.owner);
                 if (target === undefined)
                     return yield* PolicyFailure.refuse("SessionRetired", "Selected source was retired");
                 const sequence = request.sequence;
+                let resultAccounted = false;
                 active = yield* target.source.prepareRouted({ request, position: decision.position }, {
                     commit: (submissionId) => commands.withPermit(guard("enqueue", Effect.gen(function* () {
                         const checked = yield* route(request);
@@ -457,28 +689,43 @@ export const make = (options) => Effect.gen(function* () {
                             return yield* Effect.die(new Error("Source committed before returning its inert submission"));
                         yield* target.register(active, Effect.gen(function* () {
                             if (sequence !== undefined) {
-                                yield* affinity.bind(sequence.id, target.source.id);
+                                yield* affinity.bind(sequence.id, target.owner);
                                 yield* affinity.begin(sequence.id, sequence.memberId ?? submissionId);
                             }
-                        }).pipe(Effect.mapError(sequenceError)));
+                        }).pipe(Effect.mapError(sequenceError)), (exit) => {
+                            logical.complete(exit);
+                            active = undefined;
+                            activeOwner = undefined;
+                        });
                     }))),
                     result: (submissionId, result) => Effect.gen(function* () {
-                        target.recordResult(result);
+                        if (resultAccounted)
+                            return;
+                        resultAccounted = true;
+                        // An accepted identity past the continuous bound is a
+                        // source-contract failure, as for Started: it is never
+                        // retained, its member cannot be attributed and the source
+                        // is replaced.
+                        const recorded = yield* Effect.result(target.recordResult(result));
                         if (sequence !== undefined) {
                             const memberId = sequence.memberId ?? submissionId;
-                            const account = Result.isSuccess(result)
-                                ? affinity.accepted(sequence.id, memberId, result.success, sequence.final)
-                                : result.failure.context.outcome === "unknown"
-                                    ? affinity.uncertain(sequence.id, memberId, result.failure.message)
-                                    : affinity.rejected(sequence.id, memberId, result.failure.message, sequence.final);
+                            const account = Result.isFailure(recorded)
+                                ? affinity.uncertain(sequence.id, memberId, recorded.failure.message)
+                                : Result.isSuccess(result)
+                                    ? affinity.accepted(sequence.id, memberId, result.success, sequence.final)
+                                    : result.failure.context.outcome === "unknown"
+                                        ? affinity.uncertain(sequence.id, memberId, result.failure.message)
+                                        : affinity.rejected(sequence.id, memberId, result.failure.message, sequence.final);
                             yield* account.pipe(Effect.catch((cause) => Effect.gen(function* () {
                                 target.markIndeterminate();
-                                yield* affinity.retire(target.source.id);
+                                yield* affinity.retire(target.owner);
                                 yield* fail(ReactorError.fromCode("InvalidState", "Committed sequence accounting failed", { detail: cause }));
                             })));
                         }
                         target.finishAccounting();
-                        if (Result.isFailure(result) &&
+                        if (Result.isFailure(recorded))
+                            yield* scheduleRecovery(target, recorded.failure, "replace");
+                        else if (Result.isFailure(result) &&
                             result.failure.context.outcome === "unknown") {
                             yield* scheduleRecovery(target, result.failure, "replace");
                         }
@@ -488,23 +735,26 @@ export const make = (options) => Effect.gen(function* () {
             }
             const selected = active;
             return yield* selected.submit.pipe(Effect.onExit(() => selected.state.pipe(Effect.flatMap((state) => Effect.sync(() => {
-                if (state._tag === "Completed")
+                if (state._tag === "Completed") {
+                    logical.complete(state.exit);
                     activeOwner?.forgetCompleted(selected);
+                    active = undefined;
+                    activeOwner = undefined;
+                }
                 if (state._tag === "Prepared" && active === selected) {
                     active = undefined;
                     activeOwner = undefined;
                 }
             })))));
         }));
-        return {
-            id,
-            submit,
-            state: Effect.suspend(() => active === undefined
-                ? Effect.succeed({ _tag: "Prepared" })
-                : active.state),
-        };
+        logical.attach(submit, Effect.suspend(() => active === undefined
+            ? Effect.succeed({ _tag: "Prepared" })
+            : active.state));
+        return logical.submission;
     });
     const state = Effect.gen(function* () {
+        if (!closing && terminal !== undefined && Exit.isFailure(terminal))
+            return yield* Effect.failCause(terminal.cause);
         const live = [...slots.values()].filter((slot) => !slot.closed);
         const values = (yield* Effect.forEach(live, (slot) => slot.source.state)).map((value, index) => withSessionId(value, live[index].source.id));
         const primary = values[live.indexOf(current)] ?? emptyState();
@@ -581,11 +831,13 @@ export const make = (options) => Effect.gen(function* () {
                 if (replacement._tag !== "Opening")
                     return;
                 const pending = replacement.fiber;
-                replacement = { _tag: "Absent" };
+                // It stays Opening until joined, so a concurrent close joins it too.
                 yield* Fiber.interrupt(pending);
                 const result = yield* Fiber.await(pending);
+                if (replacement._tag === "Opening" && replacement.fiber === pending)
+                    replacement = { _tag: "Absent" };
                 if (Exit.isSuccess(result))
-                    yield* result.value.close;
+                    yield* closeSlot(result.value);
             }));
         }),
         setAutoplay: (enabled) => commands.withPermit(guard("set_autoplay", Effect.gen(function* () {
@@ -632,7 +884,7 @@ export const make = (options) => Effect.gen(function* () {
     };
     const tick = commands
         .withPermit(Effect.gen(function* () {
-        if (closing ||
+        if (stopping() ||
             current === undefined ||
             current.closed ||
             current.recovering ||
@@ -642,6 +894,10 @@ export const make = (options) => Effect.gen(function* () {
             const result = replacement.fiber.pollUnsafe();
             if (result !== undefined) {
                 replacement = { _tag: "Absent" };
+                // Close or the owner's scope stopped this attempt, and close
+                // retires whatever it opened: that is no failed setup.
+                if (stopping())
+                    return;
                 if (Exit.isSuccess(result)) {
                     replacement = { _tag: "Ready", slot: result.value };
                     openFailures = 0;
@@ -649,6 +905,13 @@ export const make = (options) => Effect.gen(function* () {
                     yield* announce({ _tag: "Prepared" });
                 }
                 else {
+                    if (continuous) {
+                        const error = Cause.findErrorOption(result.cause);
+                        if (Option.isSome(error) &&
+                            ReactorError.is(error.value) &&
+                            error.value.reason._tag === "Overflow")
+                            return yield* fail(error.value);
+                    }
                     openFailures++;
                     retryAt = monotonicMillis(clock) + 5000;
                     yield* announce({
@@ -662,7 +925,7 @@ export const make = (options) => Effect.gen(function* () {
             }
         }
         const decision = decideRenewal({
-            running: !closing && terminalFailure === undefined,
+            running: !stopping() && terminal === undefined,
             now: monotonicMillis(clock),
             current,
             replacement: replacement._tag === "Ready" ? replacement.slot.phase : replacement._tag,
@@ -679,7 +942,7 @@ export const make = (options) => Effect.gen(function* () {
                 return;
             case "Prepare":
                 if (renewing)
-                    replacement = { _tag: "Opening", fiber: yield* acquire.pipe(Effect.forkIn(scope)) };
+                    replacement = { _tag: "Opening", fiber: yield* forkAcquisition };
                 return;
             case "InspectHandoff":
                 break;
@@ -696,14 +959,16 @@ export const make = (options) => Effect.gen(function* () {
         // The provider reports nothing playing: a lost Ended must not hold
         // the switch until expiry, so the grace also starts here.
         current.observedIdle();
-        if (!canHandoff({
+        const evidence = handoffEvidence({
             sequenceOpen: false,
             currentIdle: isIdle(oldState),
             replacementReady: nextState.availability === "Ready" && nextState.ready.length > 0,
             finalClip: current.finalClip(),
             graceMs: handoffGraceMs,
-        }))
+        });
+        if (evidence === undefined)
             return;
+        const handoff = Object.freeze({ ...evidence, replacementSessionId: next.source.id });
         // Read only for a switch that happens: it can wait on source pressure.
         const tail = yield* retired(current);
         const old = current;
@@ -718,7 +983,7 @@ export const make = (options) => Effect.gen(function* () {
             yield* closeSlot(old);
             if (!activated)
                 return;
-            yield* announce({ _tag: "Switched", ...tail });
+            yield* announce({ _tag: "Switched", ...tail, handoff });
             yield* log("Switched prepared sessions at a sequence boundary");
         }).pipe(Effect.withSpan("reactor.orchestration.renewal.switch", {
             attributes: {
@@ -730,14 +995,18 @@ export const make = (options) => Effect.gen(function* () {
         .pipe(Effect.catch(fail));
     // Spaced polling, not a fixed rate: each tick runs 100 ms after the previous one
     // finished, so a slow tick delays the next instead of overlapping it.
-    yield* Effect.forever(Effect.sleep(100).pipe(Effect.andThen(tick))).pipe(Effect.forkIn(scope));
+    yield* Effect.forever(Effect.sleep(100).pipe(Effect.andThen(tick))).pipe(supervise, Effect.forkIn(scope));
     const pressure = Effect.suspend(() => {
         if (current === undefined)
             return Effect.fail(ReactorError.fromCode("InvalidState", "No active media source"));
         const owner = current;
         return owner.pressure.pipe(Effect.flatMap((source) => {
             const queued = buffer.pressure();
-            const loss = SourceSlot.addLoss(outputLoss, SourceSlot.subtractLoss(SourceSlot.lossOf(Result.succeed(source)), ownerBaseline));
+            // A retired owner's loss is already in the output's totals, as the
+            // closed continuous owner's is once its retirement completes.
+            const loss = outputOwner === owner.owner
+                ? SourceSlot.addLoss(outputLoss, SourceSlot.subtractLoss(SourceSlot.lossOf(Result.succeed(source)), ownerBaseline))
+                : outputLoss;
             if (loss.video === null || loss.audio === null || loss.readers === null)
                 return Effect.fail(ReactorError.fromCode("InvalidState", "A former media owner's loss totals are unknown"));
             return Effect.succeed({
@@ -752,7 +1021,7 @@ export const make = (options) => Effect.gen(function* () {
             });
         }));
     });
-    return {
+    const facets = {
         engine,
         media: {
             video: buffer.video,
@@ -760,20 +1029,52 @@ export const make = (options) => Effect.gen(function* () {
             pressure,
             videoFramesPerSecond: current.media.videoFramesPerSecond,
         },
-        mediaState: Effect.sync(() => mediaState),
+        mediaState: Effect.suspend(() => !closing && terminal !== undefined && Exit.isFailure(terminal)
+            ? Effect.failCause(terminal.cause)
+            : Effect.succeed(mediaState)),
         observe: (options) => observations.observeWith(Effect.map(state, (engine) => ({ engine, media: mediaState })), options),
         sessionId: Effect.sync(() => current === undefined || current.closed ? Option.none() : Option.some(current.source.id)),
-        close,
-        cleanup: Effect.sync(() => finalReport === undefined ? Option.none() : Option.some(finalReport)),
         sequences: {
-            get: affinity.get,
-            snapshots: affinity.snapshots,
+            get: (id) => affinity
+                .get(id)
+                .pipe(Effect.map((entry) => entry === undefined
+                ? undefined
+                : Object.freeze({ ...entry, owner: entry.owner.sessionId }))),
+            snapshots: affinity.snapshots.pipe(Effect.map((entries) => Object.freeze(entries.map((entry) => Object.freeze({ ...entry, owner: entry.owner.sessionId }))))),
             seal: affinity.seal,
             acknowledgeIndeterminate: affinity.acknowledgeIndeterminate,
             release: affinity.release,
         },
     };
+    return {
+        legacy: {
+            ...facets,
+            close: close.pipe(Effect.andThen(Effect.sync(() => {
+                if (finalReport === undefined)
+                    throw new Error("Missing legacy cleanup report");
+                return finalReport;
+            }))),
+            cleanup: Effect.sync(() => Option.fromUndefinedOr(finalReport)),
+        },
+        continuous: {
+            ...facets,
+            close: close.pipe(Effect.andThen(Effect.sync(() => {
+                if (finalSummary === undefined)
+                    throw new Error("Missing continuous cleanup summary");
+                return finalSummary;
+            }))),
+            cleanup: Effect.sync(() => Option.fromUndefinedOr(finalSummary)),
+        },
+    };
 });
+/** Legacy renewal retains complete cleanup history and defaults to 64 successful opens. */
+export const make = (options) => makeOwner(options, false).pipe(Effect.map((owner) => owner.legacy));
+/**
+ * Bounded continuous renewal. Adapters must meet ContinuousOptions' unique-ID
+ * precondition. Retired anchors no longer retained can refuse as missing rather
+ * than SessionRetired; captured operations remain fenced to their exact incarnation.
+ */
+export const makeContinuous = (options) => makeOwner(options, true).pipe(Effect.map((owner) => owner.continuous));
 /**
  * The handle's `Engine`, `Media` and `Handle` services from one orchestration,
  * so the three can never come from two paid session chains. Each build of the