thursday-agent 0.2.0 → 0.4.0

package/features/bot/bot.runner.ts

@@ -1,8 +1,15 @@
 import type { ModelMessage } from "ai";
-import { after } from "next/server";
-import { appEventStream, appEvents } from "@/app/api/events/app-event.server";
-import { PATHS } from "@/config";
-import { modelErrorToString } from "@/features/ai/model";
+import {
+  appEventStream,
+  appEvents,
+  presence,
+} from "@/app/api/events/app-event.server";
+import { BOT_RUN, PATHS, WORKSPACE_KEEP } from "@/config";
+import {
+  type ModelFailure,
+  modelErrorToString,
+  modelFailureOf,
+} from "@/features/ai/model";
 import {
   buildTaskOpening,
   OPENING_TURNS,
@@ -14,34 +21,51 @@ import {
 } from "@/features/thursday/thursday.query";
 import { pathsIn } from "@/features/workspace/file-kind";
 import {
+  closeHiddenBrowser,
   closeJobShell,
+  jobScratch,
+  listScratchFolders,
+  pruneJobFiles,
   removeJobScratch,
+  removeUnchangedFolders,
 } from "@/features/workspace/workspace";
 import { desktopNotify } from "@/lib/desktop-notify";
 import { logger } from "@/lib/logger";
 import { publicError } from "@/lib/public-error";
 import { createKeyedLock } from "@/lib/queue";
-import { condenseThread, runBot, type TaskEvent } from "./bot.run";
-import { TASK_CONTINUE, type TaskStatus } from "./bot.schema";
+import { resumeThread, runBot, type TaskEvent } from "./bot.run";
+import {
+  TASK_CONTINUE,
+  type TaskPending,
+  type TaskSpeaker,
+  type TaskStatus,
+  tagSpeaker,
+} from "./bot.schema";
 import {
   addTaskUsage,
+  countStopsSinceSpoken,
   deleteFinishedTasks,
   deleteMessages,
   deleteTask,
   findTask,
   insertTask,
   lastSeq,
+  listAutoStoppedTasks,
+  listBorrowedTails,
   listRunningTaskIds,
+  listTaskFolders,
   listThread,
+  stopNote,
   type TaskMessageInput,
   updateTask,
   upsertMessage,
 } from "./task.query";
 
 /**
- * Runs a job under `after()` so it outlives the request, writing every event
- * to the task's thread (task_message). A run always starts from the thread;
- * `answerTask` is the one way to add to it, serialized per job by `taskLock`.
+ * Runs a job so it outlives the request, writing every event to the task's
+ * thread (task_message). A run always starts from the thread. `answerTask` is
+ * the one way a person adds to it, serialized per job by `taskLock`, and
+ * `resumeTask` the one way the app picks a job back up by itself.
  */
 
 type Run = {
@@ -58,6 +82,8 @@ type Run = {
 type Pinned = {
   __botRuns?: Map<string, Run>;
   __botTaskLock?: ReturnType<typeof createKeyedLock>;
+  __botResumes?: Map<string, ReturnType<typeof setTimeout>>;
+  __botPausing?: { current: Promise<void> };
 };
 
 /** Pinned to globalThis: next dev reloads this module under a running run, and the abort controller and lock must be the originals. */
@@ -70,20 +96,38 @@ const running: Map<string, Run> = ((globalThis as Pinned).__botRuns ??=
  */
 const taskLock = ((globalThis as Pinned).__botTaskLock ??= createKeyedLock());
 
-/** Opens a job. The opening message is the request plus the last turns of the call (bot.prompt buildTaskOpening) and is the thread's first row. */
+/** When each parked job picks itself back up (scheduleResume); one timer per job. */
+const resumes: Map<string, ReturnType<typeof setTimeout>> = ((
+  globalThis as Pinned
+).__botResumes ??= new Map());
+
+/** The pause under way, if any; a returning browser waits for it (resumeStoppedTasks). */
+const pausing = ((globalThis as Pinned).__botPausing ??= {
+  current: Promise.resolve(),
+});
+
+/** Opens a job. The opening message — who is on it, the job, the call it came from (bot.prompt buildTaskOpening) — is the thread's first row. */
 export async function startTask(input: {
   bot: string;
   request: string;
   label: string;
   callId?: string | null;
+  /** Who handed it over: Thursday during a call, or the user on screen. */
+  from: TaskSpeaker;
 }) {
-  const conversation = input.callId
-    ? await listCallTurns(input.callId, OPENING_TURNS)
+  const { from, ...row } = input;
+  const conversation = row.callId
+    ? await listCallTurns(row.callId, OPENING_TURNS)
     : [];
-  const opening = buildTaskOpening({ request: input.request, conversation });
-  const task = await insertTask({ ...input, opening });
+  const opening = buildTaskOpening({
+    bot: row.bot,
+    request: row.request,
+    conversation,
+    from,
+  });
+  const task = await insertTask({ ...row, opening });
   launch(task.id, {
-    bot: input.bot,
+    bot: row.bot,
     messages: [{ role: "user", content: opening }],
   });
   return task.id;
@@ -95,14 +139,25 @@ export async function startTask(input: {
  * before its next step; the step in flight finishes), or a follow-up to a
  * finished one. Only when the run has already ended does the running case
  * fall through to stop, append, relaunch.
+ *
+ * @param from Who said it. The words go on the thread tagged with it (bot.schema
+ * tagSpeaker): Thursday passing something on from a call and the user typing on
+ * screen reach the bot down this one pipe, and a go-ahead means something
+ * different from each. Unset for words that already carry their tags — the notes
+ * a finished run left unread (drive).
  */
-export async function answerTask(id: string, answer: string) {
+export async function answerTask(
+  id: string,
+  answer: string,
+  from?: TaskSpeaker,
+) {
+  const said = from ? tagSpeaker(from, answer) : answer;
   return taskLock(id, async () => {
     const task = await findTask(id);
     if (!task) publicError("No such job.");
 
     const live = running.get(id);
-    if (live && task.status === "running" && live.note(answer)) {
+    if (live && task.status === "running" && live.note(said)) {
       logger.debug(`task ${id}: interjection queued`);
       return;
     }
@@ -110,11 +165,13 @@ export async function answerTask(id: string, answer: string) {
       live.stop.abort();
       await live.done;
     }
+    // A person picked it up; whatever the app meant to do by itself is moot
+    forgetResume(id);
 
-    const { reply, as } = joinThread(task, answer);
+    const thread = await listThread(id);
+    const { reply, as } = joinThread(task, said, thread);
     logger.debug(`task ${id}: ${as}`);
 
-    const thread = await listThread(id);
     await upsertMessage(id, (await lastSeq(id)) + 1, {
       bot: null,
       parent: null,
@@ -125,14 +182,53 @@ export async function answerTask(id: string, answer: string) {
       status: "running",
       outcome: null,
       pending: null,
-      reported: false,
+      seen: false,
       endedAt: null,
     });
-    // Stored whole, read back folded (bot.run condenseThread)
-    launch(id, { bot: task.bot, messages: condenseThread([...thread, reply]) });
+    // Resumed on the rows as they were stored (bot.run resumeThread)
+    launch(id, {
+      bot: task.bot,
+      messages: resumeThread([...thread, reply], await listBorrowedTails(id)),
+    });
   });
 }
 
+/**
+ * The `ask_thursday` calls still open in the step a job stopped on: a model can
+ * ask twice at once, and the one answer goes to each rather than leaving the
+ * second to read as a call cut off (bot.run resumeThread). A call that already
+ * has a result — arguments the tool refused — is not open, and the words go in
+ * as a turn instead: a second result for one call is refused outright.
+ */
+function openAsks(thread: ModelMessage[], stoppedOn: string): string[] {
+  const answered = new Set(
+    thread.flatMap((message) =>
+      message.role === "tool"
+        ? message.content.flatMap((part) =>
+            part.type === "tool-result" ? [part.toolCallId] : [],
+          )
+        : [],
+    ),
+  );
+  const step = thread.findLast(
+    (message) =>
+      message.role === "assistant" &&
+      typeof message.content !== "string" &&
+      message.content.some(
+        (part) => part.type === "tool-call" && part.toolCallId === stoppedOn,
+      ),
+  );
+  const asks =
+    step?.role === "assistant" && typeof step.content !== "string"
+      ? step.content.flatMap((part) =>
+          part.type === "tool-call" && part.toolName === TOOL_NAMES.ask_thursday
+            ? [part.toolCallId]
+            : [],
+        )
+      : [stoppedOn];
+  return asks.filter((toolCallId) => !answered.has(toolCallId));
+}
+
 /**
  * How a person's words enter the thread. A job stopped on `ask_thursday` gets
  * them as that call's tool result (a call with no result would break the
@@ -140,23 +236,23 @@ export async function answerTask(id: string, answer: string) {
  * continue has no call to answer, so it is a turn as well.
  */
 function joinThread(
-  task: { status: TaskStatus; pending: { toolCallId: string | null } | null },
+  task: { status: TaskStatus; pending: TaskPending | null },
   answer: string,
+  thread: ModelMessage[],
 ): { reply: ModelMessage; as: "answer" | "interruption" | "follow-up" } {
   const pending = task.status === "waiting" ? task.pending : null;
-  if (pending?.toolCallId) {
+  const asks = pending?.toolCallId ? openAsks(thread, pending.toolCallId) : [];
+  if (asks.length) {
     return {
       as: "answer",
       reply: {
         role: "tool",
-        content: [
-          {
-            type: "tool-result",
-            toolCallId: pending.toolCallId,
-            toolName: TOOL_NAMES.ask_thursday,
-            output: { type: "text", value: answer },
-          },
-        ],
+        content: asks.map((toolCallId) => ({
+          type: "tool-result" as const,
+          toolCallId,
+          toolName: TOOL_NAMES.ask_thursday,
+          output: { type: "text" as const, value: answer },
+        })),
       },
     };
   }
@@ -175,13 +271,17 @@ export async function cancelTask(id: string) {
   return taskLock(id, async () => {
     const task = await findTask(id);
     if (!task) publicError("No such job.");
+    // A job that already ended has an answer in `outcome`; cancelling would
+    // write "Cancelled." over the thing it was run for.
+    if (task.endedAt) publicError("That job has already ended.");
+    forgetResume(id);
     running.get(id)?.stop.abort();
     await updateTask(id, {
       status: "failed",
       outcome: "Cancelled.",
       pending: null,
       // Nobody needs to be told what they just did themselves
-      reported: true,
+      seen: true,
       endedAt: new Date(),
     });
     // Cancel is a real end, so the browser session closes here; the abort in
@@ -194,6 +294,7 @@ export async function cancelTask(id: string) {
 export async function removeTask(id: string) {
   return taskLock(id, async () => {
     const task = await findTask(id);
+    forgetResume(id);
     running.get(id)?.stop.abort();
     running.delete(id);
     void closeJobShell(id);
@@ -217,57 +318,230 @@ export async function removeFinishedTasks(): Promise<number> {
 }
 
 /**
- * At boot (instrumentation): rows the last process left as running become
- * `waiting` with the one continue option, not failed. The answer resumes the
- * stored thread (answerTask). Nothing else needs to reconcile — a run that ends
- * badly records it itself (drive), and the write that does so is durable
- * (database/db.ts oneAtATime).
+ * Clears what jobs left behind by age (config WORKSPACE_KEEP), at boot and on a
+ * timer (instrumentation): a job's folder once the job ended that long ago — a job
+ * running or waiting keeps its own however old — a scratch folder no job owns once
+ * it has not changed that long, and spilled output and browser snapshots that old
+ * (pruneJobFiles). A job's folder goes under the job's lock, so a word that picks
+ * the job back up in that moment never finds its material gone. Returns the
+ * folders that went.
+ */
+export async function sweepJobFiles(): Promise<string[]> {
+  const cutoff = Date.now() - WORKSPACE_KEEP.forMs;
+  const stale = (task: {
+    status: TaskStatus;
+    endedAt: Date | null;
+    updatedAt: Date;
+  }) =>
+    (task.status === "done" || task.status === "failed") &&
+    (task.endedAt ?? task.updatedAt).getTime() < cutoff;
+
+  // Folders on disk; each one a job owns is taken out as its job is read
+  const unowned = new Set(await listScratchFolders());
+  const removed: string[] = [];
+  for (const task of await listTaskFolders()) {
+    const folder = jobScratch(task.id, task.label);
+    if (!unowned.delete(folder) || !stale(task)) continue;
+    await taskLock(task.id, async () => {
+      const now = await findTask(task.id);
+      if (!now || !stale(now)) return;
+      await removeJobScratch(task.id, task.label);
+      removed.push(folder);
+    });
+  }
+  removed.push(...(await removeUnchangedFolders([...unowned])));
+  await pruneJobFiles();
+  if (removed.length) {
+    logger.info(
+      `cleared ${removed.length} old job folder(s): ${removed.join(", ")}`,
+    );
+  }
+  return removed;
+}
+
+/**
+ * At boot (instrumentation): rows the last process left as running are not
+ * running now. Each is parked the way every stop the app causes is (parkTask),
+ * so it picks itself back up once a browser is on the app. Nothing else needs
+ * to reconcile — a run that ends badly records it itself (drive), and the write
+ * that does so is durable (database/db.ts oneAtATime).
  */
 export async function sweepTasks() {
   for (const id of await listRunningTaskIds()) {
     if (!running.has(id)) {
-      await abandon(id, "The server restarted while this was running");
+      await parkTask(id, {
+        why: "The server restarted while this was running.",
+      });
     }
   }
 }
 
 /**
- * Puts a run that is no longer running back where the user can pick it up: the
- * same shape a step limit leaves (`waiting` with the one continue option), so
- * the screen and Thursday need no third state for it. The thread stays whole,
- * and answering resumes from it.
+ * The browser closed, or the server is going down (instrumentation): every run
+ * stops where it is and is parked (parkTask). All at once — a run slow to let go
+ * must not keep the others running. The thread stays, and so does the window: a
+ * resume carries on in the page it left off at, including a sign-in the user is
+ * mid-way through, which only that window can finish.
+ */
+export async function pauseTasks(reason: string) {
+  const work = Promise.all(
+    [...running].map(([id, run]) =>
+      taskLock(id, async () => {
+        run.stop.abort();
+        await run.done;
+        const task = await findTask(id);
+        if (!task || task.status !== "running") return;
+        await parkTask(id, { why: reason });
+      }).catch((cause) => logger.error(`task ${id}: pause`, cause)),
+    ),
+  ).then(() => {});
+  pausing.current = work;
+  await work;
+}
+
+/**
+ * A browser is on the app again (instrumentation `presence.onBack`): every job
+ * the app parked picks itself back up — now, or when the wait a failed model
+ * call set runs out. A pause still under way is waited for first, so a quick
+ * reload does not miss what it parks.
  */
-async function abandon(id: string, why: string) {
-  await updateTask(id, {
+export async function resumeStoppedTasks() {
+  await pausing.current;
+  for (const task of await listAutoStoppedTasks()) {
+    scheduleResume(task.id, task.retryAt - Date.now());
+  }
+}
+
+/** One timer per job: a newer stop replaces what an older one set. */
+function scheduleResume(id: string, inMs: number) {
+  forgetResume(id);
+  resumes.set(
+    id,
+    setTimeout(
+      () => {
+        resumes.delete(id);
+        void resumeTask(id).catch((cause) =>
+          logger.error(`task ${id}: resume`, cause),
+        );
+      },
+      Math.max(0, inMs),
+    ),
+  );
+}
+
+function forgetResume(id: string) {
+  clearTimeout(resumes.get(id));
+  resumes.delete(id);
+}
+
+/**
+ * Picks a parked job back up. Only with a browser on the app — nothing runs
+ * without one, and its return tries again — and only if it is still parked: a
+ * person may have answered, cancelled or deleted it since. No turn is added,
+ * because nobody said anything; the note parkTask left is what the run reads last.
+ */
+async function resumeTask(id: string) {
+  if (!presence.watching) return;
+  await taskLock(id, async () => {
+    const task = await findTask(id);
+    if (!task || task.status !== "waiting" || !task.pending?.auto) return;
+    if (running.has(id)) return;
+    logger.debug(`task ${id}: picking back up`);
+    const thread = await listThread(id);
+    await updateTask(id, {
+      status: "running",
+      outcome: null,
+      pending: null,
+      seen: false,
+      endedAt: null,
+    });
+    launch(id, {
+      bot: task.bot,
+      messages: resumeThread(thread, await listBorrowedTails(id)),
+    });
+  });
+}
+
+/**
+ * Stops a job the app stopped, rather than the bot or a person: a restart, a
+ * closed browser, a model call a retry or a compaction can fix. It waits with
+ * the one continue option like any stop, with a line in its thread saying why —
+ * the resumed run reads it — and picks itself back up (scheduleResume). Unless
+ * the app has already stopped it `BOT_RUN.autoResumes` times since a person last
+ * spoke to it: that is what a job that keeps taking the server down looks like,
+ * and it waits for a person instead.
+ */
+async function parkTask(
+  id: string,
+  stop: {
+    why: string;
+    /** A failed model call: wait before trying again (config BOT_RUN.retryAfterMs). */
+    retry?: boolean;
+    /** Where the job compacts from now on (bot.run `budget`). */
+    budget?: number;
+  },
+) {
+  const stops = await countStopsSinceSpoken(id);
+  const auto = stops < BOT_RUN.autoResumes;
+  const waits = BOT_RUN.retryAfterMs;
+  const inMs =
+    auto && stop.retry ? waits[Math.min(stops, waits.length - 1)] : 0;
+
+  await writeNote(id, stopNote(stop.why)).catch((cause) =>
+    logger.warn(`task ${id}: stop not written`, cause),
+  );
+  await writeEnding(id, {
     status: "waiting",
-    outcome: `${why}. Everything it had done is still here. Pick it back up?`,
-    pending: { toolCallId: null, options: [TASK_CONTINUE] },
-    reported: false,
+    outcome: auto
+      ? `${stop.why} ${inMs ? `It tries again in ${spell(inMs)}.` : "It picks back up by itself."}`
+      : `${stop.why} It has stopped ${stops + 1} times in a row, so it waits for you. Everything it had done is still here.`,
+    pending: {
+      toolCallId: null,
+      options: [TASK_CONTINUE],
+      ...(auto ? { auto: true, retryAt: Date.now() + inMs } : {}),
+    },
+    ...(stop.budget ? { contextBudget: stop.budget } : {}),
+    seen: false,
     endedAt: null,
   });
+  if (auto) scheduleResume(id, inMs);
+}
+
+const spell = (ms: number) =>
+  ms < 60_000
+    ? `${Math.round(ms / 1000)} seconds`
+    : `${Math.round(ms / 60_000)} minutes`;
+
+/** A line from the app in a thread no run is writing (ThreadWriter.note is the one for a run that is). */
+async function writeNote(id: string, text: string) {
+  await upsertMessage(id, (await lastSeq(id)) + 1, {
+    bot: null,
+    parent: null,
+    role: "user",
+    content: text,
+    note: true,
+  });
 }
 
 /**
- * The browser closed (app-event.server presence): every run stops where it is
- * and waits with the one continue option, the way a restart leaves it
- * (sweepTasks). The thread stays; answering resumes it.
+ * The write that tells anyone a run ended at all. Tried again: everything else
+ * in the run has happened, and a miss leaves the row `running` until the next
+ * boot. Writes are serialised, so what is left is a database that briefly
+ * cannot be written to (database/db.ts).
  */
-export async function pauseTasks(reason: string) {
-  for (const [id, run] of [...running]) {
-    await taskLock(id, async () => {
-      run.stop.abort();
-      await run.done;
-      const task = await findTask(id);
-      if (!task || task.status !== "running") return;
-      await updateTask(id, {
-        status: "waiting",
-        outcome: `${reason} Everything it had done is still here. Pick it back up?`,
-        pending: { toolCallId: null, options: [TASK_CONTINUE] },
-        reported: false,
-        endedAt: null,
-      });
-      void closeJobShell(id);
-    });
+async function writeEnding(
+  id: string,
+  patch: Parameters<typeof updateTask>[1],
+) {
+  for (const wait of [1_000, 3_000, null]) {
+    try {
+      await updateTask(id, patch);
+      return;
+    } catch (cause) {
+      if (wait === null) throw cause;
+      logger.warn(`task ${id}: ending not written, trying again`, cause);
+      await new Promise((resolve) => setTimeout(resolve, wait));
+    }
   }
 }
 
@@ -290,14 +564,14 @@ function launch(id: string, input: { bot: string; messages: ModelMessage[] }) {
     },
   };
   running.set(id, run);
-  // The response goes out first, and the run carries on behind it
-  after(() =>
-    drive(id, input, stop.signal, notes)
-      .catch((cause) => {
-        logger.error(`task ${id}`, cause);
-      })
-      .finally(finish),
-  );
+  // Held by the server, not by a request: a run also starts from a returning
+  // browser and a retry timer, where `after()` throws (no request) or waits for
+  // the event stream to close
+  void drive(id, input, stop.signal, notes)
+    .catch((cause) => {
+      logger.error(`task ${id}`, cause);
+    })
+    .finally(finish);
 }
 
 /**
@@ -314,6 +588,9 @@ class ThreadWriter {
     { assistant: number | null; tool: number | null; parts: StepParts }
   >();
 
+  /** Set once the run is over: a borrowed run still unwinding must not write into a thread a resume has taken. */
+  private closed = false;
+
   constructor(
     private taskId: string,
     seq: number,
@@ -321,6 +598,10 @@ class ThreadWriter {
     this.seq = seq;
   }
 
+  close() {
+    this.closed = true;
+  }
+
   /**
    * A line from the app rather than from anyone in the room. A user row so a
    * resumed run reads it as something it was told, and `note` so the screen
@@ -368,6 +649,7 @@ class ThreadWriter {
   }
 
   async on(event: TaskEvent) {
+    if (this.closed) return;
     const step = this.step(event);
     switch (event.type) {
       case "text":
@@ -398,8 +680,9 @@ class ThreadWriter {
           type: "tool-result",
           toolCallId: event.id,
           toolName: event.name,
-          output:
-            typeof event.output === "string"
+          output: event.error
+            ? { type: "error-text", value: String(event.output) }
+            : typeof event.output === "string"
               ? { type: "text", value: event.output }
               : { type: "json", value: event.output as never },
         });
@@ -468,10 +751,17 @@ async function drive(
   let ending: {
     status: TaskStatus;
     outcome: string;
-    pending: { toolCallId: string | null; options: string[] } | null;
+    pending: TaskPending | null;
+  } | null = null;
+  /**
+   * What broke, as the provider said it — the thread carries it too (below) —
+   * and whose it is to fix (model.ts modelFailureOf).
+   */
+  let broken: {
+    message: string;
+    failure: ModelFailure;
+    budget?: number;
   } | null = null;
-  /** What broke, as the provider said it; the thread carries it too (below). */
-  let broken: string | null = null;
 
   try {
     await runBot(input, {
@@ -503,19 +793,23 @@ async function drive(
             outcome: event.question,
             pending: { toolCallId: event.id, options: event.options },
           };
-        } else if (event.type === "report") {
-          // An incomplete report goes back to waiting with the continue option.
-          // The outcome is the report text verbatim; the same text is the
-          // thread line (bot.query linesOf).
-          ending = {
-            status: event.complete ? "done" : "waiting",
-            outcome: event.text,
-            pending: event.complete
-              ? null
-              : { toolCallId: null, options: [TASK_CONTINUE] },
-          };
+        } else if (event.type === "answer") {
+          // An answer ends the job; one the app stopped (bot.run `stopped`) waits
+          // with the continue option. The outcome is the answer text verbatim;
+          // the same text is the thread line (bot.query linesOf).
+          ending = event.stopped
+            ? {
+                status: "waiting",
+                outcome: event.text,
+                pending: { toolCallId: null, options: [TASK_CONTINUE] },
+              }
+            : { status: "done", outcome: event.text, pending: null };
         } else if (event.type === "error") {
-          broken = event.message;
+          broken = {
+            message: event.message,
+            failure: event.failure,
+            budget: event.budget,
+          };
           ending = {
             status: "failed",
             outcome: broke(event.message),
@@ -525,17 +819,22 @@ async function drive(
       },
     });
   } catch (cause) {
-    broken = modelErrorToString(cause);
+    broken = {
+      message: modelErrorToString(cause),
+      failure: modelFailureOf(cause),
+    };
     ending = {
       status: "failed",
-      outcome: broke(broken),
+      outcome: broke(broken.message),
       pending: null,
     };
   } finally {
+    thread.close();
     running.delete(id);
   }
 
-  // Whoever aborted writes the row: cancel marks failed, answerTask relaunches.
+  // Whoever aborted writes the row: cancel marks failed, answerTask relaunches,
+  // a pause parks.
   if (signal.aborted) return;
 
   const final = ending ?? {
@@ -543,37 +842,49 @@ async function drive(
     outcome: "Stopped without handing anything back.",
     pending: null,
   };
-  // A thread that simply stops cannot be read: the room shows a tool call with
-  // no answer, and a resumed run has no idea why. The task row says it too, but
-  // the row is a status and this is the story. Never at the cost of the status
-  // write, which is what tells anyone the job ended at all.
-  if (final.status === "failed") {
-    await thread
-      .note(`The run stopped here: ${broken ?? final.outcome}`)
-      .catch((cause) => logger.warn(`task ${id}: break not written`, cause));
-  }
+  // A break a moment or a compaction can fix is the app's to pick back up, not
+  // a failure for a person to find (parkTask)
+  const park = broken && broken.failure !== "fatal" ? broken : null;
 
-  // The one write that must land: everything else in this run has already
-  // happened, and this is what tells the screen and Thursday it ended at all.
-  // Writes are serialised, so contention no longer throws here (database/db.ts);
-  // what is left is a database that cannot be written to, which a retry would
-  // not help either. Said plainly rather than thrown into `after`, where it
-  // would read as an unexplained request failure — and the row stays `running`,
-  // which the next boot reconciles (sweepTasks).
   try {
-    await updateTask(id, {
-      ...final,
-      reported: false,
-      endedAt: final.status === "waiting" ? null : new Date(),
-    });
+    if (park) {
+      await parkTask(id, {
+        why:
+          park.failure === "overflow"
+            ? `The model refused the context as too long (${park.message}); it is compacted before going on.`
+            : `The model call failed (${park.message}).`,
+        retry: park.failure === "transient",
+        budget: park.budget,
+      });
+    } else {
+      // A thread that simply stops cannot be read: the room shows a tool call
+      // with no answer, and a resumed run has no idea why. The task row says it
+      // too, but the row is a status and this is the story. Never at the cost of
+      // the status write, which is what tells anyone the job ended at all.
+      if (final.status === "failed") {
+        await thread
+          .note(`The run stopped here: ${broken?.message ?? final.outcome}`)
+          .catch((cause) =>
+            logger.warn(`task ${id}: break not written`, cause),
+          );
+      }
+      await writeEnding(id, {
+        ...final,
+        seen: false,
+        endedAt: final.status === "waiting" ? null : new Date(),
+      });
+    }
   } catch (cause) {
+    // Said plainly rather than thrown into a promise nobody awaits; the row
+    // stays `running`, which the next boot reconciles (sweepTasks)
     logger.error(`task ${id}: could not record how it ended`, cause);
     return;
   }
 
-  // Close the job's browser session (workspace.ts jobShellEnv) unless waiting:
-  // a bot stopped at a login wall needs the page the user is typing into.
-  if (final.status !== "waiting") void closeJobShell(id);
+  // A waiting job keeps its browser: answering resumes into the page it left
+  // off at. An ended one closes only what nobody can see (closeHiddenBrowser).
+  if (park || final.status === "waiting") void pruneJobFiles();
+  else void closeHiddenBrowser(id);
 
   const task = await findTask(id);
   if (!task) return;
@@ -589,6 +900,9 @@ async function drive(
     return;
   }
 
+  // A parked job picks itself back up; nobody needs telling yet
+  if (park) return;
+
   await announce(task.label, final);
 
   // A finished job naming a document opens it on the screen (workspace artifact-view).
@@ -600,7 +914,7 @@ async function drive(
   }
 }
 
-/** The document a report names: the artifacts folder first, otherwise the first drawable file. */
+/** The document an answer names: the artifacts folder first, otherwise the first drawable file. */
 function artifactIn(outcome: string): string | null {
   const paths = pathsIn(outcome);
   return (