@zq-silk/yui 0.10.0 → 0.11.0

package/dist/execution/resourceBroker.js

@@ -0,0 +1,425 @@
+import { isDeepStrictEqual } from "node:util";
+import { requireIdentity, requireText, requireTimestamp } from "../domain/validation.js";
+import { runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
+import { validateExecutionGroup } from "./executionGroup.js";
+export const RESOURCE_BROKER_POLICY_SCHEMA_VERSION = 1;
+/** One shared hard-stop predicate for admission, recovery, and Leader routing. */
+export function executionStageSpendClosed(resources) {
+    return resources.deadlineReached || resources.exhaustedBudgets.length > 0;
+}
+const DEFAULT_ACTIVE_LANES = 4;
+const DEFAULT_ACTIVE_LANES_PER_TASK = 2;
+const DEFAULT_ACTIVE_LANES_PER_WORK_ITEM = 2;
+const DEFAULT_ACTIVE_LANES_PER_GROUP = 2;
+const DEFAULT_ACTIVE_LANES_PER_PROVIDER = 4;
+const DEFAULT_ACTIVE_LANES_PER_AGENT = 2;
+const DEFAULT_ACTIVE_LANES_PER_MODEL = 2;
+const DEFAULT_QUEUED_LANES_PER_GROUP = 4;
+export function resolveResourceBrokerPolicy(configured) {
+    const value = configured ?? {};
+    return Object.freeze({
+        schemaVersion: RESOURCE_BROKER_POLICY_SCHEMA_VERSION,
+        maxActiveLanes: positive(value.maxActiveLanes, DEFAULT_ACTIVE_LANES, "maxActiveLanes"),
+        maxActiveLanesPerTask: positive(value.maxActiveLanesPerTask, DEFAULT_ACTIVE_LANES_PER_TASK, "maxActiveLanesPerTask"),
+        maxActiveLanesPerWorkItem: positive(value.maxActiveLanesPerWorkItem, DEFAULT_ACTIVE_LANES_PER_WORK_ITEM, "maxActiveLanesPerWorkItem"),
+        maxActiveLanesPerGroup: positive(value.maxActiveLanesPerGroup, DEFAULT_ACTIVE_LANES_PER_GROUP, "maxActiveLanesPerGroup"),
+        maxActiveLanesPerProvider: positive(value.maxActiveLanesPerProvider, DEFAULT_ACTIVE_LANES_PER_PROVIDER, "maxActiveLanesPerProvider"),
+        maxActiveLanesPerAgent: positive(value.maxActiveLanesPerAgent, DEFAULT_ACTIVE_LANES_PER_AGENT, "maxActiveLanesPerAgent"),
+        maxActiveLanesPerModel: positive(value.maxActiveLanesPerModel, DEFAULT_ACTIVE_LANES_PER_MODEL, "maxActiveLanesPerModel"),
+        maxQueuedLanesPerGroup: positive(value.maxQueuedLanesPerGroup, DEFAULT_QUEUED_LANES_PER_GROUP, "maxQueuedLanesPerGroup")
+    });
+}
+/**
+ * Deterministic admission over the caller's stable request order. Capacity
+ * pressure queues a Lane; it never terminalizes that Lane or its siblings.
+ */
+export function planResourceAdmissions(input) {
+    const policy = resolveResourceBrokerPolicy(input.policy);
+    const active = input.active.map(validateLaneIdentity);
+    const queued = input.queued.map(validateLaneIdentity);
+    const decisions = [];
+    for (const raw of input.requests) {
+        const request = validateLaneIdentity(raw);
+        const directLimits = activeLimits(policy, active, request);
+        const activeLaneKeys = new Set(active.map(resourceLaneKey));
+        const queuedBefore = [
+            ...queued,
+            ...decisions.filter(({ decision }) => decision === "queued").map(({ request }) => request)
+        ].filter((candidate) => !activeLaneKeys.has(resourceLaneKey(candidate)));
+        const fairReservations = directLimits.length === 0
+            ? reservableOlderQueuedLanes(policy, active, queuedBefore, request)
+            : [];
+        const fairLimits = activeLimits(policy, [...active, ...fairReservations], request);
+        const limitedBy = fairLimits.length === 0
+            ? directLimits
+            : directLimits.length === 0 && fairReservations.length > 0
+                ? [...fairLimits, "fair-queue"]
+                : fairLimits;
+        if (limitedBy.length === 0) {
+            active.push(request);
+            decisions.push(Object.freeze({
+                request,
+                decision: "admitted",
+                limitedBy: [],
+                reason: "capacity is available at every resource scope"
+            }));
+            continue;
+        }
+        const groupQueued = queuedBefore.filter(({ taskId, executionGroupId }) => (taskId === request.taskId && executionGroupId === request.executionGroupId)).length;
+        if (groupQueued >= policy.maxQueuedLanesPerGroup) {
+            decisions.push(Object.freeze({
+                request,
+                decision: "blocked",
+                limitedBy: [...limitedBy, "group-queue"],
+                reason: `resource capacity is unavailable and the Group queue is full (${groupQueued}/${policy.maxQueuedLanesPerGroup})`
+            }));
+            continue;
+        }
+        decisions.push(Object.freeze({
+            request,
+            decision: "queued",
+            limitedBy,
+            reason: `resource backpressure: ${limitedBy.join(", ")}`
+        }));
+    }
+    return decisions;
+}
+/**
+ * Reserve only older queued Lanes that could start now. This gives released
+ * capacity to the oldest compatible waiter without letting a Provider- or
+ * Agent-blocked head prevent independent work from using other scopes.
+ */
+function reservableOlderQueuedLanes(policy, active, queued, request) {
+    const projected = [...active];
+    const reserved = [];
+    const seen = new Set();
+    for (const candidate of [...queued].sort(compareResourceQueueOrder)) {
+        const key = resourceLaneKey(candidate);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        if (sameResourceLane(candidate, request)
+            || compareResourceQueueOrder(candidate, request) >= 0
+            || activeLimits(policy, projected, candidate).length > 0)
+            continue;
+        projected.push(candidate);
+        reserved.push(candidate);
+    }
+    return reserved;
+}
+function compareResourceQueueOrder(left, right) {
+    return left.requestedAt.localeCompare(right.requestedAt)
+        || left.taskId.localeCompare(right.taskId, undefined, { numeric: true })
+        || left.executionGroupId.localeCompare(right.executionGroupId, undefined, { numeric: true })
+        || left.executionLaneId.localeCompare(right.executionLaneId, undefined, { numeric: true });
+}
+function sameResourceLane(left, right) {
+    return resourceLaneKey(left) === resourceLaneKey(right);
+}
+function resourceLaneKey(value) {
+    return `${value.taskId}\0${value.executionGroupId}\0${value.executionLaneId}`;
+}
+/** Current stage spend/completion projection used by CLI, Web, and routing. */
+export function projectExecutionStageResources(input) {
+    const group = validateExecutionGroup(input.group);
+    const stageGroups = executionStageRetryLineage(group, input.stageGroups);
+    const stage = group.stage;
+    const resources = stage?.resources;
+    const tokens = nonNegative(input.usage.tokens, "Execution token usage");
+    const toolCalls = nonNegative(input.usage.toolCalls, "Execution tool-call usage");
+    const nowMs = input.now.getTime();
+    if (!Number.isFinite(nowMs))
+        throw new Error("Execution resource projection time is invalid.");
+    const stageStartedAt = stageGroups
+        .map(({ createdAt }) => createdAt)
+        .sort()[0] ?? group.createdAt;
+    const wallClockSeconds = Math.max(0, Math.floor((nowMs - Date.parse(stageStartedAt)) / 1_000));
+    const usable = group.lanes.filter(({ status }) => isUsable(status))
+        .sort((left, right) => (left.endedAt ?? left.updatedAt).localeCompare(right.endedAt ?? right.updatedAt));
+    const activeLaneIds = group.lanes.filter(({ status }) => status === "running").map(({ id }) => id);
+    const pendingLaneIds = group.lanes.filter(({ status }) => status === "pending").map(({ id }) => id);
+    const skippedLaneIds = group.lanes.filter(({ status }) => status === "skipped").map(({ id }) => id);
+    const quorum = resources?.quorum ?? group.lanes.length;
+    const quorumMet = usable.length >= quorum;
+    const quorumReachedAt = quorumMet
+        ? (usable[quorum - 1].endedAt ?? usable[quorum - 1].updatedAt)
+        : undefined;
+    const tokensObservable = input.usage.tokensObservable ?? true;
+    const toolCallsObservable = input.usage.toolCallsObservable ?? true;
+    const exhaustedBudgets = [];
+    if (stage?.budget.maxTokens !== undefined
+        && tokens >= stage.budget.maxTokens)
+        exhaustedBudgets.push("tokens");
+    if (toolCallsObservable && stage?.budget.maxToolCalls !== undefined
+        && toolCalls >= stage.budget.maxToolCalls)
+        exhaustedBudgets.push("tool-calls");
+    if (stage?.budget.maxWallClockSeconds !== undefined
+        && wallClockSeconds >= stage.budget.maxWallClockSeconds)
+        exhaustedBudgets.push("wall-clock");
+    const deadlineReached = resources === undefined
+        ? false
+        : nowMs >= Date.parse(resources.deadlineAt);
+    const stragglerLaneIds = resources === undefined || quorumReachedAt === undefined
+        ? []
+        : nowMs - Date.parse(quorumReachedAt) < resources.stragglerAfterSeconds * 1_000
+            ? []
+            : [...activeLaneIds];
+    return Object.freeze({
+        tokens,
+        toolCalls,
+        wallClockSeconds,
+        ...(stage?.budget.maxTokens === undefined
+            ? {}
+            : { tokensRemaining: Math.max(0, stage.budget.maxTokens - tokens) }),
+        ...(stage?.budget.maxToolCalls === undefined
+            ? {}
+            : { toolCallsRemaining: Math.max(0, stage.budget.maxToolCalls - toolCalls) }),
+        ...(stage?.budget.maxWallClockSeconds === undefined
+            ? {}
+            : {
+                wallClockSecondsRemaining: Math.max(0, stage.budget.maxWallClockSeconds - wallClockSeconds)
+            }),
+        tokensObservable,
+        toolCallsObservable,
+        usableLaneCount: usable.length,
+        activeLaneIds,
+        pendingLaneIds,
+        skippedLaneIds,
+        quorumMet,
+        ...(quorumReachedAt === undefined ? {} : { quorumReachedAt }),
+        deadlineReached,
+        exhaustedBudgets,
+        stragglerLaneIds
+    });
+}
+/**
+ * Parallel-vs-sequential decision support. Evidence sufficiency is an explicit
+ * semantic input: budget pressure can block or defer work, but can never turn
+ * insufficient evidence into a successful early stop.
+ */
+export function routeExecutionStage(input) {
+    const group = validateExecutionGroup(input.group);
+    const stage = group.stage;
+    const policy = stage?.resources;
+    const marginal = input.marginalValuePercent === undefined
+        ? undefined
+        : percentage(input.marginalValuePercent, "Execution marginal value");
+    const budgetPressure = executionStageSpendClosed(input.resources);
+    const marginalLow = marginal !== undefined
+        && policy !== undefined
+        && marginal < policy.minimumMarginalValuePercent;
+    const earlyTerminationAllowed = input.evidenceSufficient && input.resources.quorumMet;
+    const stopSpending = earlyTerminationAllowed && (budgetPressure || marginalLow);
+    const cancelPendingLaneIds = stopSpending ? input.resources.pendingLaneIds : [];
+    const retainActiveLaneIds = stopSpending ? input.resources.activeLaneIds : [];
+    if (earlyTerminationAllowed) {
+        if (input.resources.activeLaneIds.length > 0) {
+            return Object.freeze({
+                action: "wait",
+                earlyTerminationAllowed,
+                cancelPendingLaneIds,
+                retainActiveLaneIds,
+                reason: stopSpending
+                    ? "quorum and sufficient evidence allow pending work to stop, but active stragglers are retained"
+                    : "evidence is sufficient, but active Lanes remain inside the stage policy"
+            });
+        }
+        if (!stopSpending && input.resources.pendingLaneIds.length > 0) {
+            return Object.freeze({
+                action: "wait",
+                earlyTerminationAllowed,
+                cancelPendingLaneIds: [],
+                retainActiveLaneIds: [],
+                reason: "evidence is sufficient, but pending Lanes remain inside the configured marginal-value policy"
+            });
+        }
+        return Object.freeze({
+            action: "resolve",
+            earlyTerminationAllowed,
+            cancelPendingLaneIds,
+            retainActiveLaneIds,
+            reason: stopSpending
+                ? "quorum and sufficient evidence make further pending spend uneconomic"
+                : "quorum and sufficient evidence are complete"
+        });
+    }
+    if (input.resources.activeLaneIds.length > 0) {
+        return Object.freeze({
+            action: "wait",
+            earlyTerminationAllowed: false,
+            cancelPendingLaneIds: [],
+            retainActiveLaneIds: [],
+            reason: budgetPressure
+                ? "evidence is insufficient; active work is retained despite budget pressure"
+                : "evidence is insufficient and active Lanes may still add evidence"
+        });
+    }
+    if (budgetPressure) {
+        return Object.freeze({
+            action: "blocked",
+            earlyTerminationAllowed: false,
+            cancelPendingLaneIds: [],
+            retainActiveLaneIds: [],
+            reason: "the stage budget or deadline is exhausted before evidence sufficiency"
+        });
+    }
+    if (input.resources.pendingLaneIds.length > 0) {
+        return Object.freeze({
+            action: "wait",
+            earlyTerminationAllowed: false,
+            cancelPendingLaneIds: [],
+            retainActiveLaneIds: [],
+            reason: "evidence is insufficient and scheduled Lanes are waiting for resource capacity"
+        });
+    }
+    const capacity = group.strategy.mode === "fixed" ? group.strategy.count : group.strategy.max;
+    if (group.strategy.mode === "adaptive"
+        && group.lanes.length < capacity
+        && (!input.resources.quorumMet || input.disagreement === "high")) {
+        return Object.freeze({
+            action: "expand-parallel",
+            earlyTerminationAllowed: false,
+            cancelPendingLaneIds: [],
+            retainActiveLaneIds: [],
+            reason: input.resources.quorumMet
+                ? "material disagreement and available Lane capacity favor another independent route"
+                : "stage quorum is open and available Lane capacity requires another independent route"
+        });
+    }
+    return Object.freeze({
+        action: "deepen-sequential",
+        earlyTerminationAllowed: false,
+        cancelPendingLaneIds: [],
+        retainActiveLaneIds: [],
+        reason: "available evidence favors the next bounded stage over more parallel fan-out"
+    });
+}
+/** Fold exact runtime observations into the spend dimensions Yui can prove. */
+export function observedExecutionResourceUsage(input) {
+    const group = validateExecutionGroup(input.group);
+    const stageGroups = executionStageRetryLineage(group, input.stageGroups);
+    const groupIds = new Set(stageGroups.map(({ id }) => id));
+    const runIds = new Set([
+        ...stageGroups.flatMap((candidate) => candidate.lanes
+            .flatMap(({ runId }) => runId === undefined ? [] : [runId])),
+        ...(input.runs ?? []).filter((run) => (run.taskId === group.taskId
+            && run.purpose === "execution"
+            && run.executionGroupId !== undefined
+            && groupIds.has(run.executionGroupId))).map(({ id }) => id)
+    ]);
+    const observations = input.events.map(runtimeObservationFromTaskEvent)
+        .filter((value) => (value !== null
+        && value.fence.taskId === group.taskId
+        && value.fence.runId !== undefined
+        && runIds.has(value.fence.runId)));
+    let tokens = 0;
+    let tokensObservable = true;
+    for (const runId of runIds) {
+        const usage = observations.filter(({ fence, payload }) => (fence.runId === runId && payload.usage !== undefined)).sort((left, right) => (left.receivedAt.localeCompare(right.receivedAt)
+            || (left.sequence ?? 0) - (right.sequence ?? 0)
+            || (left.ordinal ?? 0) - (right.ordinal ?? 0)));
+        if (usage.length === 0) {
+            tokensObservable = false;
+            continue;
+        }
+        const requestSnapshots = new Map(usage
+            .filter(({ payload }) => payload.usage.semantics === "request-context")
+            .map((observation) => [observation.semanticKey, observation.payload.usage]));
+        if (requestSnapshots.size > 0) {
+            tokens += [...requestSnapshots.values()]
+                .reduce((sum, value) => sum + value.inputTokens + value.outputTokens, 0);
+            continue;
+        }
+        const cumulative = usage
+            .filter(({ payload }) => payload.usage.semantics === "cumulative-session")
+            .map(({ payload }) => payload.usage.inputTokens + payload.usage.outputTokens);
+        if (cumulative.length >= 2 && cumulative[0] === 0) {
+            tokens += Math.max(...cumulative);
+            continue;
+        }
+        if (cumulative.length >= 2) {
+            tokens += Math.max(0, Math.max(...cumulative) - cumulative[0]);
+        }
+        if (cumulative.length > 0 || usage.some(({ payload }) => (payload.usage.semantics === "remaining-context")))
+            tokensObservable = false;
+    }
+    const toolOperationIds = new Set(observations.flatMap((observation) => (observation.kind === "operation.started" && observation.payload.operation === "tool"
+        ? [`${observation.fence.runId}\0${observation.payload.operationId ?? observation.semanticKey}`]
+        : [])));
+    const toolCallsObservable = observations.some(({ kind, payload }) => (kind === "operation.started" && payload.operation === "tool"));
+    return Object.freeze({
+        tokens,
+        toolCalls: toolOperationIds.size,
+        tokensObservable,
+        toolCallsObservable
+    });
+}
+function activeLimits(policy, active, request) {
+    const checks = [
+        ["home", policy.maxActiveLanes, () => true],
+        ["task", policy.maxActiveLanesPerTask, (value) => value.taskId === request.taskId],
+        ["work-item", policy.maxActiveLanesPerWorkItem, (value) => (request.workItemId !== undefined && value.taskId === request.taskId
+                && value.workItemId === request.workItemId)],
+        ["group", policy.maxActiveLanesPerGroup, (value) => (value.taskId === request.taskId && value.executionGroupId === request.executionGroupId)],
+        ["provider", policy.maxActiveLanesPerProvider, (value) => value.providerId === request.providerId],
+        ["agent", policy.maxActiveLanesPerAgent, (value) => value.agentId === request.agentId],
+        ["model", policy.maxActiveLanesPerModel, (value) => modelKey(value) === modelKey(request)]
+    ];
+    return checks.filter(([, limit, matches]) => active.filter(matches).length >= limit)
+        .map(([scope]) => scope);
+}
+function executionStageRetryLineage(group, candidates) {
+    const stage = group.stage;
+    if (stage === undefined || candidates === undefined)
+        return [group];
+    const lineage = candidates
+        .map(validateExecutionGroup)
+        .filter((candidate) => (candidate.taskId === group.taskId
+        && candidate.purpose === "execution"
+        && candidate.stage?.mode === stage.mode
+        && candidate.stage.stage === stage.stage
+        && candidate.stage.round === stage.round
+        && candidate.stage.stageAttempt <= stage.stageAttempt
+        && isDeepStrictEqual(candidate.stage.budget, stage.budget)
+        && isDeepStrictEqual(candidate.stage.resources, stage.resources)));
+    if (!lineage.some(({ id }) => id === group.id))
+        lineage.push(group);
+    return lineage;
+}
+function validateLaneIdentity(value) {
+    requireIdentity(value.taskId, "Resource Lane Task id");
+    if (value.workItemId !== undefined)
+        requireIdentity(value.workItemId, "Resource Lane WorkItem id");
+    requireIdentity(value.executionGroupId, "Resource Lane ExecutionGroup id");
+    requireIdentity(value.executionLaneId, "Resource Lane id");
+    requireIdentity(value.providerId, "Resource Lane Provider id");
+    requireIdentity(value.agentId, "Resource Lane Agent id");
+    if (value.model !== undefined)
+        requireText(value.model, "Resource Lane model");
+    requireTimestamp(value.requestedAt, "Resource Lane request time");
+    return Object.freeze({ ...value });
+}
+function modelKey(value) {
+    return `${value.providerId}\0${value.model ?? "default"}`;
+}
+function positive(value, fallback, label) {
+    const resolved = value ?? fallback;
+    if (!Number.isSafeInteger(resolved) || resolved < 1) {
+        throw new TypeError(`${label} must be a positive integer.`);
+    }
+    return resolved;
+}
+function nonNegative(value, label) {
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw new Error(`${label} must be a non-negative integer.`);
+    return value;
+}
+function percentage(value, label) {
+    if (!Number.isSafeInteger(value) || value < 0 || value > 100) {
+        throw new Error(`${label} must be an integer from 0 to 100.`);
+    }
+    return value;
+}
+function isUsable(status) {
+    return status === "yielded" || status === "completed";
+}

package/dist/executor/fileRoleLaunchPlanner.js

@@ -15,7 +15,7 @@ import { prefixYuiTitleInput } from "../run/runIdentity.js";
 import { resolveAgentAdapter } from "./agentAdapter.js";
 import { resolveTaskRoleSessionTitle } from "../runtime/sessionTitle.js";
 import { nativeSessionIdForLaunch } from "../runtime/preallocatedNativeSession.js";
-import { isTaskOwnedWorkspace } from "../worktree/managedWorkspace.js";
+import { classifyWorkspacePreflight, formatWorkspacePreflightError } from "./workspacePreflightClassification.js";
 import { activeLiveRoleAgentSession } from "./agentExecutor.js";
 import { effectiveLaunchSnapshotsCompatibleForTaskMain, effectiveLaunchSnapshotsCompatible, effectiveRoleForLaunch, resolveEffectiveLaunch } from "./effectiveLaunch.js";
 import { YUI_CONTROL_PLANE_DESCRIPTOR, YUI_TASK_RUNTIME_DESCRIPTOR, assertExactTaskRuntimeState, createExactControlPlaneDescriptor, createExactTaskRuntimeDescriptor, exactControlPlaneDigest, exactTaskRuntimeDescriptorPath, serializeExactDescriptor } from "../runtime/exactControlPlane.js";
@@ -141,14 +141,11 @@ export class FileRoleLaunchPlanner {
         }
         const runWorkspace = activeRun?.workspace;
         const main = this.store.getTaskWorkspace(task.id);
-        if (!isTaskOwnedWorkspace(main, task.id, task.cwd, task.projectBindings.map(({ projectId, directory }) => ({ projectId, directory })))) {
-            throw new Error(`Role workspace is not ready: ${input.taskId}/${input.roleName}.`);
-        }
-        if (runWorkspace !== undefined) {
-            const durableRunWorkspace = this.store.getManagedWorkspace(runWorkspace.owner);
-            if (durableRunWorkspace === null || !isDeepStrictEqual(durableRunWorkspace, runWorkspace)) {
-                throw new Error(`Role Run workspace is not the durable owner: ${input.taskId}/${input.roleName}.`);
-            }
+        // Quick Win (EXE-04/EXE-08): classify workspace preflight failures so
+        // split-brain state is never reported as a transient Provider failure.
+        const preflight = classifyWorkspacePreflight(this.store, task, input.roleName, activeRun === null ? null : { id: activeRun.id, workspace: activeRun.workspace });
+        if (preflight !== null) {
+            throw new Error(formatWorkspacePreflightError(preflight));
         }
         const assignedWorkItem = this.store.listWorkItems(task.id).find((item) => item.assignee === role.name
             && !["completed", "failed", "retired"].includes(item.status));

package/dist/executor/workspacePreflightClassification.js

@@ -0,0 +1,117 @@
+import { isDeepStrictEqual } from "node:util";
+import { isTaskOwnedWorkspace } from "../worktree/managedWorkspace.js";
+function ownerLabel(owner) {
+    switch (owner.type) {
+        case "task":
+            return owner.taskId;
+        case "work-item":
+            return `${owner.taskId}/${owner.workItemId}`;
+        case "review-round":
+            return `${owner.taskId}/${owner.reviewRoundId}`;
+        case "integration-attempt":
+            return `${owner.taskId}/${owner.integrationAttemptId}`;
+        case "execution-lane":
+            return `${owner.taskId}/${owner.executionGroupId}/${owner.executionLaneId}`;
+    }
+}
+/**
+ * Classify a workspace preflight failure.  Returns `null` when the workspace
+ * is healthy and the launch may proceed.
+ *
+ * This is a read-only check: it never mutates Git state, creates Sessions, or
+ * writes recovery records.
+ */
+export function classifyWorkspacePreflight(store, task, roleName, activeRun) {
+    const main = store.getTaskWorkspace(task.id);
+    const bindings = task.projectBindings.map(({ projectId, directory }) => ({ projectId, directory }));
+    // 1. Owner validation: the Task main workspace must be a durable,
+    //    Task-owned ManagedWorkspace whose root matches the Task cwd and whose
+    //    entries match the Project bindings.
+    const mainForDiagnostic = main;
+    if (!isTaskOwnedWorkspace(main, task.id, task.cwd, bindings)) {
+        const expected = `task-owned @ ${task.cwd ?? "(no cwd)"} with ${bindings.length} project binding(s)`;
+        const actual = mainForDiagnostic === null
+            ? "no ManagedWorkspace"
+            : `${mainForDiagnostic.owner.type}/${ownerLabel(mainForDiagnostic.owner)} @ ${mainForDiagnostic.root} with ${mainForDiagnostic.entries.length} entries`;
+        return {
+            kind: "owner-invalid",
+            reason: `Task main workspace is not a durable Task-owned workspace: ${task.id}/${roleName}.`,
+            taskId: task.id,
+            roleName,
+            expected,
+            actual
+        };
+    }
+    // 2. Run snapshot validation: when the active Run carries a workspace
+    //    snapshot it must match the durable ManagedWorkspace exactly.  A
+    //    mismatch means the Run was created against a stale baseline.
+    if (activeRun?.workspace !== undefined) {
+        const durableRunWorkspace = store.getManagedWorkspace(activeRun.workspace.owner);
+        if (durableRunWorkspace === null || !isDeepStrictEqual(durableRunWorkspace, activeRun.workspace)) {
+            const diff = [];
+            if (durableRunWorkspace === null) {
+                diff.push(`durable ManagedWorkspace for owner ${JSON.stringify(activeRun.workspace.owner)} is missing`);
+            }
+            else {
+                if (durableRunWorkspace.root !== activeRun.workspace.root) {
+                    diff.push(`root: durable=${durableRunWorkspace.root} run=${activeRun.workspace.root}`);
+                }
+                if (durableRunWorkspace.entries.length !== activeRun.workspace.entries.length) {
+                    diff.push(`entries: durable=${durableRunWorkspace.entries.length} run=${activeRun.workspace.entries.length}`);
+                }
+                for (const [index, entry] of activeRun.workspace.entries.entries()) {
+                    const durableEntry = durableRunWorkspace.entries[index];
+                    if (durableEntry === undefined) {
+                        diff.push(`entry[${index}] ${entry.projectId}: missing from durable`);
+                        continue;
+                    }
+                    if (durableEntry.baseCommit !== entry.baseCommit) {
+                        diff.push(`entry[${index}] ${entry.projectId} baseCommit: durable=${durableEntry.baseCommit} run=${entry.baseCommit}`);
+                    }
+                    if (durableEntry.branch !== entry.branch) {
+                        diff.push(`entry[${index}] ${entry.projectId} branch: durable=${durableEntry.branch} run=${entry.branch}`);
+                    }
+                }
+            }
+            return {
+                kind: "workspace-stale",
+                reason: `Role Run workspace is not the durable owner: ${task.id}/${roleName}.`,
+                taskId: task.id,
+                roleName,
+                runId: activeRun.id,
+                diff
+            };
+        }
+    }
+    return null;
+}
+/**
+ * Format a classification as a human-readable error message that includes the
+ * precise diff between authoritative records.
+ */
+export function formatWorkspacePreflightError(classification) {
+    const lines = [classification.reason];
+    switch (classification.kind) {
+        case "owner-invalid":
+            lines.push(`  expected: ${classification.expected}`);
+            lines.push(`  actual:   ${classification.actual}`);
+            lines.push("  Use `yui task base status " + classification.taskId
+                + "` to inspect the binding, ManagedWorkspace, and physical HEAD.");
+            break;
+        case "workspace-stale":
+            lines.push(`  Run ${classification.runId} snapshot differs from the durable ManagedWorkspace:`);
+            for (const entry of classification.diff) {
+                lines.push(`    - ${entry}`);
+            }
+            lines.push("  This is a configuration error, not a transient Provider failure.");
+            lines.push("  Use `yui task base status " + classification.taskId
+                + "` to inspect the split state, then repair or re-sync the workspace.");
+            break;
+        case "physical-drift":
+            lines.push(`  Project ${classification.projectId}: expected ${classification.expectedCommit}, physical HEAD is ${classification.physicalCommit}.`);
+            lines.push("  The physical workspace has drifted from the recorded baseline.");
+            lines.push("  Use `yui task base status " + classification.taskId + "` to inspect the drift.");
+            break;
+    }
+    return lines.join("\n");
+}

package/dist/lifecycle/exactRunTerminalization.js

@@ -11,9 +11,10 @@ import { agentRunDeliveryReceiptId, failAgentRun, withYieldReceipt, yieldAgentRu
 import { createYieldReceipt } from "../run/yieldReceipt.js";
 import { recordExecutionLaneResult } from "../execution/executionGroup.js";
 import { isRuntimeLaunchReservation, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
+import { runOwnsBlockingProviderContinuation } from "../runtime/runtimeContinuationProjection.js";
 import { clearMatchingLeaderStallAttention, latestRunDurableProgressAt, RUN_RECOVERY_APPLIED_EVENT, RUN_RECOVERY_REQUESTED_EVENT } from "../scheduler/roleRunStall.js";
 import { markTaskWakeConsumed } from "../scheduler/taskWake.js";
-import { workItemExecutionGroupById, updateWorkItemExecutionGroup, updateWorkItemStatus } from "../workItem/workItem.js";
+import { workItemExecutionGroupById, workItemOwnsUnresolvedExecutionLane, updateWorkItemExecutionGroup, updateWorkItemStatus } from "../workItem/workItem.js";
 /**
  * Validate every immutable identity and frozen Project head needed before a
  * review Run can settle any mailbox or Round state.  This is deliberately
@@ -223,6 +224,14 @@ export function terminalizeExactTaskRun(store, input, now) {
     if (!matchesLaunchFence(store, sessions, input)) {
         return obsolete(run, "launch-fence-mismatch");
     }
+    if (runOwnsBlockingProviderContinuation(store.listEvents(input.taskId), {
+        taskId: run.taskId,
+        roleName: run.roleName,
+        runId: run.id,
+        agentId: run.effective.agentId
+    })) {
+        return obsolete(run, "provider-continuation-writer-owned");
+    }
     // Validate the exact ReviewRound, Candidate, stored workspace, and frozen
     // Project heads before any mailbox or Round write.
     const reviewValidation = validateExactRunReviewRound(store, run);
@@ -480,7 +489,9 @@ function recoverExactAgentRunInTransaction(store, input) {
     const terminal = terminalization.run;
     if (terminal.purpose === "execution" && terminal.workItemId !== undefined) {
         const item = store.getWorkItem(input.taskId, terminal.workItemId);
-        if (item !== null && !["completed", "failed", "retired"].includes(item.status)) {
+        if (item !== null
+            && !["completed", "failed", "retired"].includes(item.status)
+            && !workItemOwnsUnresolvedExecutionLane(item, terminal.executionGroupId, terminal.executionLaneId)) {
             store.saveWorkItem(input.taskId, updateWorkItemStatus(item, "failed", input.now, input.reason));
         }
     }

package/dist/lifecycle/taskRoleSessionReset.js

@@ -7,7 +7,7 @@ import { createLeaderRecoveryNotification } from "../scheduler/operatorNotificat
 import { recordLeaderFailure } from "../scheduler/leaderFailure.js";
 import { RUNTIME_CLEANUP_REQUIRED_REASON, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { formatAgentRunReceiptId } from "../task/taskRecordReference.js";
-import { updateWorkItemStatus } from "../workItem/workItem.js";
+import { updateWorkItemStatus, workItemOwnsUnresolvedExecutionLane } from "../workItem/workItem.js";
 import { terminalizeExactTaskRun } from "./exactRunTerminalization.js";
 /**
  * Resets the current native generation using Yui's own persisted identities.
@@ -48,7 +48,9 @@ export function resetTaskRoleSessionGeneration(store, taskId, roleName, reason,
         }
         if (activeRun.purpose === "execution" && activeRun.workItemId !== undefined) {
             const item = store.getWorkItem(task.id, activeRun.workItemId);
-            if (item !== null && !["completed", "failed", "retired"].includes(item.status)) {
+            if (item !== null
+                && !["completed", "failed", "retired"].includes(item.status)
+                && !workItemOwnsUnresolvedExecutionLane(item, activeRun.executionGroupId, activeRun.executionLaneId)) {
                 store.saveWorkItem(task.id, updateWorkItemStatus(item, "failed", now, summary));
             }
         }