Refactor session into runtime, log, fold, reconcile, and wire

[andreisavu]

This refactor splits the monolithic session.ts into focused modules, laid out in layers the toolchain holds, that separate concerns and enable room resumption over a persisted log.

Summary

The room now owns no state in memory. Every fact about the room — the roster, the exchange, the people, the leases, the wakes pending — is a pure fold over the log. A room that resumes over the log continues where the last run stopped. The refactor also moves module-level globals into a Runtime value that a host owns, so two hosts in one process do not share a model call, a session repository, or a register of running rooms.

Layout

packages/ambion/src is laid out in layers, and an import points down only. Biome refuses every other import, one noRestrictedImports override per layer (docs/toolchain.md §1):

• types, wire, define, render — the vocabulary
• host/ — the runtime value, a clock, an opener, a SQLite storage
• log/ — one serial queue over a Pi session
• room/ — every fact and decision, pure over the log
• tools/ — the workspace and its backends
• seat/ — one activation, the hands it holds, the actor, the in-process transport
• session.ts — the room, which composes them all

Key changes

• host/runtime.ts (new): Holds what a host owns: a clock, a model call, a Pi session opener, and a register of running rooms. startSession, readSession, and defineWorkspace take a Runtime parameter that defaults to defaultRuntime. A runtime holds a transport only when its host gave it one; the room defaults to every seat as an actor in its own process.

• host/sqlite.ts (new): Pi's SessionStorage over any SQLite a host reaches through two calls, run and all. A process wraps node:sqlite; the Cloudflare package wraps ctx.storage.sql. Every scenario, the restart suite and the widened chaos sweep run on memory, JSONL and SQLite.

• log/log.ts (new): The log commits one entry at a time on a serial queue. A repeated key lands once. A commit the record moved past is refused. Nothing observes a message before its write is confirmed. An append that fails puts the log in doubt, and the log reads the storage at once. A checkpoint replaces every row before it, and the log drops those rows from memory.

• room/fold.ts (new): Every fact about the room is a pure function over the log entries: the roster, the exchange, the people, the leases, the wakes pending, and the summaries owed. checkpointOf writes the rows a later fold still reads, behind a floor below which every wake was answered.

• room/reconcile.ts (new): decide is pure. It reads the folded state and the clock and returns the rows to write, the wakes to send, the attempts to abandon at the cap, and when to look again. The room applies a decision, and a second decision over the result writes nothing.

• wire.ts (new): What crosses between a seat and its room, and what the log holds beside a message. Every shape is plain JSON. A seat reaches the room through three calls: view, commit, lease. The room reaches a seat through two: wake, and cut for an activation whose lease the room ended.

• room/lease.ts (new): Activations named by what caused them. An activation's id is derived from the log, so a wake is safe to send twice, a retried commit lands once, and a request from an activation whose lease ended is refused. Every lease row carries heard. A wake is answered by a lease of the seat that heard it and ran to its end, or that spoke. A lease that expired or failed without speaking answers nothing: the room wakes the seat again after the backoff. No lease runs past runtime.wake.deadline from its claim. At the cap the room writes the attempt it does not make as a lease abandoned, and the host hears an abandoned event.

• room/view.ts (new): What an activation is given, read off the fold and rendered.

• seat/seat.ts and seat/hands.ts (refactored): SeatActor takes a wake, claims the lease, reads the room's view, builds the Pi Agent over it with the hands the view names, runs it, renews the lease while it runs, and releases the lease when it stops. It runs one activation at a time, queues every wake that lands meanwhile, cuts an activation the room ended and moves on even when the run ignores the abort. hands.ts holds say, summarise and seat.

• session.ts (refactored): Composes the log, fold, reconcile, and wire. It holds no state in memory. An evicted room closes its log and reaches no listener again.

• room/assistant.ts (refactored): Down to what the assistant is: the refusal of one with hands, and the threshold a summary is written above. Who is owed is a fold over the log. A draft the host revoked stands down.

• room/presence.ts, seat/activation.ts (refactored), record.ts (removed).

• cloudflare/ (new): A room as Cloudflare Durable Objects. One object holds the room, one object holds each seat. The log lives in the room object's SQLite storage through the core's storage. The alarm is the room's clock. RPC is the wire, with cut over it.

• Tests: restart.test.ts, property.test.ts, scenarios.ts, invariants.ts, log.test.ts, reconcile.test.ts, lease.test.ts, wire.test.ts, runtime.test.ts, matrix.test.ts, seat.test.ts, checkpoint.test.ts, and live/resume.test.ts prove the room resumes over its log on every storage, the record keeps its shape under a random walk, an activation is cut at its deadline, the cap is written, and the fold over a checkpointed log equals the fold over every row.

• Chaos tier (chaos.test.ts): One scenario runs once to count the appends its log takes, then once per append, crashing the room at that append before the entry lands and again after it landed with the confirmation lost. The same scenario runs in a child process on JSONL storage and is killed mid-activation. The random walk fails writes and crashes the room up to three times. pnpm chaos widens all three to JSONL and SQLite.

• Review fixes (ef252c1): A review of the whole branch found three faults and three edges, fixed with regression tests: a revoked draft that kept the summary owed for ever, a seat actor that could run two activations at once, a refused start that kept the name, a delivery directed at the assistant, and a commit from a dead lease answered missed before stale.

• Demo and report: demos/2026-09-09-the-room-comes-back.html is the report of a run on a real model that drops the runtime mid-exchange and resumes it over the same log.

https://claude.ai/code/session_017i49PfakG27M56FjqvyG1e

[andreisavu]

Live tests on anthropic/claude-sonnet-5 is red on ed04f13, and the cause is the key, not the diff. Every model call in the job returned 400 invalid_request_error: Your credit balance is too low to access the Anthropic API. Each live activation errored on that, the rooms retried after the backoff, and the tests hit their deadlines or their error caps. The same error hit every file in the tier, including ones this branch did not change.

No fix exists in the repository for this: the key CI uses needs credits. A re-run before that would fail identically, so I am not spending it. Once the key has credits, a re-run of the job on this head is the check. The scripted tier is green on this head: lint and types, CLI smoke, and the tests on Node 22 and Node 24.

---

Generated by Claude Code