feat(pi): add piDurable() and drain, resume, and c.pi for pi()

[eersnington]

A new @rivet-dev/pi/durable entrypoint runs Pi Durable as a Rivet Actor, and pi() survives deploys and gives app code the session.

piDurable()

Pi Durable's conversations, tasks, and documents live in the actor's SQLite database. The actions mirror Pi Durable's Harness, Conversation, and Submission one to one, plus a prompt convenience action.

import { createRegistry } from "@earendil-works/pi-durable";
import { piDurable } from "@rivet-dev/pi/durable";

export const agent = piDurable({
	model: "provider/model",
	registry: createRegistry(),
	sandbox: sandboxProvider,
	documents: [Todos],
	actions: {
		// App actions get the harness as c.pi.
		addTodo: async (c, conversationId: number, item: string) => { … },
	},
});

const conn = client.agent.getOrCreate(["support"]).connect();
const root = await conn.harness.root();
conn.on("pi.events", (frame) => render(frame.events));
await conn.conversation.watchEvents(root.id);

const result = await conn.prompt("Summarize the open tickets");
if (result.status === "unanswered") console.error(result.reason);

• Runs survive sleep, deploys, and crashes, and resume when the actor wakes. Live work keeps the actor awake. A retry or poll wait longer than a minute lets it sleep, and a scheduled wake reopens it at the deadline.
• Watches (pi.events, pi.view, pi.taskGraph, pi.doc) go only to the connection that asked. A connection that survives sleep gets them back with a fresh seq 0 frame.
• Pi's coding tools run in the sandbox. Paths outside the sandbox are rejected, and commands never see the actor host's environment.
• @earendil-works/pi-durable and @earendil-works/chord are optional peers. Only /durable imports them.

pi()

	Before	After
Forced stop (deploy) during a run	run aborted	waits for the run within a 15 minute grace period; a cut-off run resumes on wake through Pi's retry
Caller disconnects or the action times out	run aborted	run continues; only abort stops it
App actions and hooks	no session access	c.pi is the AgentSession
Sandbox	connected when the session opens	connected on the first tool call
Session stored by an older pi-coding-agent	read as is	migrated with Pi's migration and rewritten

• pi() and piDurable() share one actor factory: option split, reserved names, the runtime slot on vars, action and sleep-grace defaults, and shutdown hooks.
• Versions: @rivet-dev/pi and @rivet-dev/sandbox-adapter stay at their published 0.1.0; the release script sets the next version. The docs examples move to pi-coding-agent 1.0.2.

---

This is part 1 of 11 in a stack:

•  11  fix(pi): persist migrated pi() session entries #330
•  10  feat(pi): expose the pi session to actor code as c.pi #329
•  9  perf(pi): connect the pi() sandbox on first use #328
•  8  feat(pi): drain and resume pi() runs #327
•  7  chore(examples): bump the docs examples to pi-coding-agent 1.0.2 #326
•  6  test(pi): let a run finish and the actor sleep when its caller disconnects #325
•  5  feat(pi): drain pi durable actors across upgrades #324
•  4  feat(pi): stream pi durable conversations to clients #323
•  3  feat(pi): add piDurable actor #322
•  2  feat(pi): store pi durable sessions in actor sqlite #321
•  1  feat(pi): add piDurable() and drain, resume, and c.pi for pi() #320 👈

[railway-app]

This PR was not deployed automatically as @eersnington does not have access to the Railway project.

In order to get automatic PR deploys, please add @eersnington to your workspace on Railway.