@zq-silk/yui 0.11.3 → 0.12.1

package/dist/runtime/conversationSwitch.js

@@ -0,0 +1,277 @@
+import { roleAgentSessionResumeMode } from "../executor/agentExecutor.js";
+import { effectiveLaunchSnapshotsCompatibleForTaskSession } from "../executor/effectiveLaunch.js";
+import { currentProviderActivation, currentProviderConversation } from "./providerRuntimeIdentity.js";
+import { blockingProviderContinuations } from "./runtimeContinuationProjection.js";
+import { runtimeObservationFromTaskEvent } from "./runtimeObservation.js";
+export const CONVERSATION_SWITCH_REQUESTED_EVENT = "runtime.conversation-switch-requested";
+export const CONVERSATION_SWITCH_RESOLVED_EVENT = "runtime.conversation-switch-resolved";
+export const CONVERSATION_SWITCH_DETACHED_EVENT = "runtime.conversation-switch-detached";
+export function providerConversationGeneration(sessions) {
+    const binding = sessions?.providerBinding;
+    if (binding === null || binding === undefined)
+        return null;
+    const current = currentProviderConversation(binding);
+    return `${binding.providerNamespace}:${binding.accountScope}:${current.epoch}:${current.conversationId}`;
+}
+export function projectConversationSwitch(events, roleName, sessions) {
+    const requests = events.filter((event) => (event.type === CONVERSATION_SWITCH_REQUESTED_EVENT
+        && event.payload.roleName === roleName));
+    const request = requests.at(-1);
+    if (request === undefined)
+        return null;
+    const requestId = request.payload.requestId;
+    const generation = request.payload.generation;
+    const requestedBy = request.payload.requestedBy;
+    const reason = request.payload.reason;
+    if (requestId === undefined || generation === undefined || reason === undefined
+        || (requestedBy !== "user" && requestedBy !== "operator" && requestedBy !== "leader")) {
+        return null;
+    }
+    const resolution = [...events].reverse().find((event) => (event.type === CONVERSATION_SWITCH_RESOLVED_EVENT
+        && event.payload.requestId === requestId));
+    const explicitStatus = resolution?.payload.status;
+    const currentGeneration = providerConversationGeneration(sessions);
+    const status = explicitStatus === "applied" || explicitStatus === "obsolete"
+        ? explicitStatus
+        : currentGeneration !== null && currentGeneration !== generation
+            ? "obsolete"
+            : "pending";
+    return {
+        requestId,
+        roleName,
+        generation,
+        requestedBy,
+        reason,
+        requestedAt: request.createdAt,
+        status,
+        ...(resolution === undefined ? {} : { resolvedAt: resolution.createdAt })
+    };
+}
+export function pendingConversationSwitch(events, roleName, sessions) {
+    const projected = projectConversationSwitch(events, roleName, sessions);
+    return projected?.status === "pending" ? projected : null;
+}
+export function roleSessionDispatchModeWithConversationSwitch(sessions, events, mailbox, roleName, agentId, effective) {
+    const ordinary = roleAgentSessionResumeMode(sessions, agentId, effective);
+    if (ordinary !== "resume") {
+        if (sessions?.providerBinding !== null && sessions?.providerBinding !== undefined) {
+            if (freshConversationLaunchAllowed({ sessions, events, mailbox, roleName })) {
+                return "new";
+            }
+            const existing = sessions.sessions[agentId];
+            if (existing?.nativeSessionId !== undefined
+                && (existing.status === "stopped" || existing.status === "broken")
+                && effectiveLaunchSnapshotsCompatibleForTaskSession(existing.effective, effective)) {
+                // A terminal local Activation does not prove the Provider Conversation
+                // is gone. Reattach to the same native identity by default.
+                return "resume";
+            }
+            throw new Error(`Fresh Provider Conversation is not yet safe: ${sessions.owner.taskId}/${roleName}.`);
+        }
+        return ordinary;
+    }
+    if (sessions?.providerBinding !== null && sessions?.providerBinding !== undefined
+        && freshConversationLaunchAllowed({ sessions, events, mailbox, roleName })) {
+        return "new";
+    }
+    return "resume";
+}
+export function conversationDetachmentBasis(input) {
+    const { sessions, mailbox } = input;
+    const binding = sessions.providerBinding;
+    const activation = binding === null ? null : currentProviderActivation(binding);
+    if (input.runMode !== "new" || binding === null || activation === null
+        || sessions.inFlight?.runId !== input.runId
+        || mailbox?.processing?.batchId !== sessions.inFlight.receiptId
+        || mailbox.processing.owner !== "controller"
+        || mailbox.processing.executionRef?.type !== "run"
+        || mailbox.processing.executionRef.taskId !== sessions.owner.taskId
+        || mailbox.processing.executionRef.id !== input.runId
+        || !actorRequestedSwitchBoundaryReady(sessions, mailbox)
+        || currentConversationExecutionBlockers(sessions, input.events, input.roleName).length > 0
+        || pendingConversationSwitch(input.events, input.roleName, sessions) === null) {
+        return null;
+    }
+    return "actor-request";
+}
+export function conversationReplacementBasis(input) {
+    const { sessions, mailbox } = input;
+    const binding = sessions.providerBinding;
+    if (input.runMode !== "new" || binding === null
+        || sessions.inFlight?.runId !== input.runId
+        || mailbox?.processing?.batchId !== sessions.inFlight.receiptId
+        || mailbox.processing.owner !== "controller"
+        || mailbox?.processing?.executionRef?.type !== "run"
+        || mailbox.processing.executionRef.taskId !== sessions.owner.taskId
+        || mailbox.processing.executionRef.id !== input.runId
+        || mailbox.inputDelivery !== null
+        || !conversationIsQuiescent(sessions, mailbox)
+        || currentConversationExecutionBlockers(sessions, input.events, input.roleName).length > 0) {
+        return null;
+    }
+    if (currentConversationIsExactlyUnrecoverable(sessions, input.events, input.roleName))
+        return "exact-unrecoverable";
+    return pendingConversationSwitch(input.events, input.roleName, sessions) === null
+        ? null
+        : "actor-request";
+}
+export function freshConversationLaunchAllowed(input) {
+    return freshConversationLaunchBlockers(input).length === 0;
+}
+/** Exact reasons a fresh Conversation cannot currently be admitted. */
+export function freshConversationLaunchBlockers(input) {
+    const { sessions } = input;
+    if (sessions === null)
+        return [];
+    const session = sessions.sessions[sessions.activeAgentId];
+    if (sessions.providerBinding === null) {
+        return session === undefined
+            || session.status === "stopped"
+            || session.status === "broken"
+            ? []
+            : ["native-session-not-terminal"];
+    }
+    const request = pendingConversationSwitch(input.events, input.roleName, sessions);
+    const binding = sessions.providerBinding;
+    const blockers = [];
+    if (input.mailbox?.inputDelivery != null)
+        blockers.push("provider-input-delivery-unsettled");
+    if (binding.turn !== null
+        && ["submitting", "accepted", "running", "delivery-unknown"].includes(binding.turn.status))
+        blockers.push("provider-turn-unsettled");
+    blockers.push(...currentConversationExecutionBlockers(sessions, input.events, input.roleName));
+    if (blockers.length > 0)
+        return blockers;
+    if (request !== null && actorRequestedSwitchBoundaryReady(sessions, input.mailbox, input.candidateRunId))
+        return [];
+    if (currentProviderActivation(binding) !== null)
+        blockers.push("provider-activation-active");
+    if (binding.authority.owner !== "none")
+        blockers.push("provider-writer-authority-owned");
+    if (blockers.length > 0)
+        return blockers;
+    if (currentProviderConversation(binding).recoverability === "unrecoverable") {
+        return currentConversationIsExactlyUnrecoverable(sessions, input.events, input.roleName) ? [] : ["exact-unrecoverable-evidence-missing"];
+    }
+    if (request !== null)
+        return ["actor-switch-boundary-not-ready"];
+    return ["current-conversation-recoverable"];
+}
+function actorRequestedSwitchBoundaryReady(sessions, mailbox, candidateRunId) {
+    const binding = sessions?.providerBinding;
+    if (sessions === null || sessions === undefined
+        || binding === null || binding === undefined
+        || mailbox?.inputDelivery != null)
+        return false;
+    const turnSettled = binding.turn === null
+        || ["completed", "failed", "cancelled", "rejected"].includes(binding.turn.status);
+    if (!turnSettled)
+        return false;
+    const session = sessions.sessions[sessions.activeAgentId];
+    if (session?.status === "running")
+        return false;
+    const activation = currentProviderActivation(binding);
+    if (activation === null)
+        return binding.authority.owner === "none";
+    if (binding.authority.owner !== "controller"
+        || binding.authority.holderId !== activation.activationId)
+        return false;
+    if (session === undefined)
+        return false;
+    if (sessions.inFlight === null) {
+        if (mailbox?.processing === null)
+            return true;
+        return candidateRunId !== undefined
+            && mailbox?.processing?.owner === "controller"
+            && mailbox.processing.executionRef?.type === "run"
+            && mailbox.processing.executionRef.taskId === sessions.owner.taskId
+            && mailbox.processing.executionRef.id === candidateRunId;
+    }
+    return mailbox?.processing?.batchId === sessions.inFlight.receiptId
+        && mailbox.processing.owner === "controller"
+        && mailbox.processing.executionRef?.type === "run"
+        && mailbox.processing.executionRef.taskId === sessions.owner.taskId
+        && mailbox.processing.executionRef.id === sessions.inFlight.runId;
+}
+function conversationIsQuiescent(sessions, mailbox) {
+    const binding = sessions?.providerBinding;
+    if (binding === null || binding === undefined)
+        return false;
+    const turnSettled = binding.turn === null
+        || ["completed", "failed", "cancelled", "rejected"].includes(binding.turn.status);
+    return turnSettled
+        && currentProviderActivation(binding) === null
+        && binding.authority.owner === "none"
+        && mailbox?.inputDelivery == null;
+}
+/**
+ * A projected recoverability flag is necessary but not sufficient to replace
+ * a Conversation. Require the exact structured missing-Conversation fact for
+ * the current Provider identity and latest Activation generation, so an old
+ * observation cannot authorize a later fresh Conversation. The binding's Run
+ * id is deliberately excluded: replacement work rebinds that fence before
+ * launching, while the missing fact necessarily came from the preceding Run's
+ * exact attempt to resume this same Activation.
+ */
+function currentConversationIsExactlyUnrecoverable(sessions, events, roleName) {
+    const binding = sessions.providerBinding;
+    if (binding === null)
+        return false;
+    const conversation = currentProviderConversation(binding);
+    if (conversation.recoverability !== "unrecoverable")
+        return false;
+    const activation = [...binding.activations].reverse().find((entry) => (entry.conversationId === conversation.conversationId));
+    const generationStartedAt = activation?.startedAt ?? conversation.createdAt;
+    return events.some((event) => {
+        const observation = runtimeObservationFromTaskEvent(event);
+        if (observation === null
+            || observation.kind !== "conversation.observed"
+            || observation.payload.recoverability !== "unrecoverable"
+            || (observation.authority !== "provider-structured"
+                && observation.authority !== "controller"))
+            return false;
+        const fence = observation.fence;
+        if (fence.taskId !== sessions.owner.taskId
+            || fence.roleName !== roleName
+            || fence.agentId !== binding.accountScope
+            || fence.driverId !== binding.providerNamespace
+            || fence.conversationId !== conversation.conversationId
+            || (activation !== undefined && fence.activationId !== activation.activationId)) {
+            return false;
+        }
+        return Date.parse(observation.observedAt ?? observation.receivedAt)
+            >= Date.parse(generationStartedAt);
+    });
+}
+/** Current Provider-owned work that may outlive a foreground Turn. */
+function currentConversationExecutionBlockers(sessions, events, roleName) {
+    const binding = sessions.providerBinding;
+    if (binding === null)
+        return [];
+    const conversation = currentProviderConversation(binding);
+    const activation = [...binding.activations].reverse().find((entry) => (entry.conversationId === conversation.conversationId));
+    if (activation === undefined)
+        return ["provider-activation-identity-missing"];
+    const activeOperation = events.some((event) => {
+        const observation = runtimeObservationFromTaskEvent(event);
+        if (observation?.kind !== "operation.started")
+            return false;
+        const fence = observation.fence;
+        return fence.taskId === sessions.owner.taskId
+            && fence.roleName === roleName
+            && fence.agentId === binding.accountScope
+            && fence.driverId === binding.providerNamespace
+            && (fence.conversationId ?? fence.nativeSessionId) === conversation.conversationId
+            && (fence.activationId ?? fence.launchId) === activation.activationId;
+    });
+    const blockingContinuation = blockingProviderContinuations(events).some((entry) => (entry.taskId === sessions.owner.taskId
+        && entry.roleName === roleName
+        && entry.identity.providerNamespace === binding.providerNamespace
+        && entry.identity.accountScope === binding.accountScope
+        && entry.identity.conversationId === conversation.conversationId
+        && entry.identity.activationId === activation.activationId));
+    return [
+        ...(activeOperation ? ["provider-operation-active"] : []),
+        ...(blockingContinuation ? ["provider-continuation-writer-owned"] : [])
+    ];
+}

package/dist/runtime/index.js

@@ -1,5 +1,6 @@
 export { createPromptEnvelope } from "./promptEnvelope.js";
 export { codexTranscriptUsage, codexTranscriptUsageReport, claudeTranscriptUsage, claudeTranscriptUsageReport } from "./builtinTranscriptUsage.js";
+export { projectSessionTokenMetrics, resolveSessionTokenIdentity, unobservedSessionTokenMetrics } from "./sessionTokenMetrics.js";
 export { createRuntimeBinding } from "./runtimeBinding.js";
 export { normalizeRuntimeOwner } from "./runtimeOwner.js";
 export { createSessionLaunchRequest } from "./sessionLaunchRequest.js";
@@ -13,7 +14,7 @@ export { formatRuntimeLaunchDiagnostic, redactLaunchArgument, redactLaunchText,
 export { DEFAULT_FORCED_GRACE_MS, DEFAULT_GRACEFUL_GRACE_MS, terminateSessionOwners } from "./sessionTerminationGuard.js";
 export { ProviderContinuationReconciliationService } from "./providerContinuationReconciliationService.js";
 export { codexNotificationBoundary, codexAppServerErrorIsMissing, CodexAppServerRequestError, CodexAppServerRuntime } from "./codexAppServerRuntime.js";
-export { createProviderRuntimeBinding, acceptProviderTurn, beginProviderTurn, currentProviderActivation, currentProviderAuthority, currentProviderConversation, endProviderActivation, markProviderTurnDeliveryUnknown, rebindProviderRuntimeRun, rejectProviderTurn, settleProviderTurn, startProviderActivation, supersedeProviderConversation, transferProviderAuthority, updateProviderConversationRecoverability, validateProviderRuntimeBinding } from "./providerRuntimeIdentity.js";
+export { createProviderRuntimeBinding, acceptProviderTurn, beginProviderTurn, currentProviderActivation, currentProviderAuthority, currentProviderConversation, endProviderActivation, markProviderTurnDeliveryUnknown, rebindProviderRuntimeRun, rejectProviderTurn, settleProviderTurnSubmission, settleProviderTurn, startProviderActivation, supersedeProviderConversation, transferProviderAuthority, updateProviderConversationRecoverability, validateProviderRuntimeBinding } from "./providerRuntimeIdentity.js";
 export { FencedProviderControl } from "./providerControl.js";
 export { sameProviderAuthorityFence, validateProviderAuthorityFence } from "./providerAuthorityFence.js";
 export { decideProviderRecovery } from "./providerRecoveryDecision.js";

package/dist/runtime/launchBroker.js

@@ -93,6 +93,18 @@ function validateProviderControl(control) {
     if (control.mode !== "new" && control.mode !== "resume") {
         throw new Error("Agent Host Provider control mode is invalid.");
     }
+    if (control.kind !== "new" && control.kind !== "resume" && control.kind !== "ensure") {
+        throw new Error("Agent Host Provider control kind is invalid.");
+    }
+    if ((control.kind === "new") !== (control.mode === "new")) {
+        throw new Error("Agent Host Provider control kind does not match its transport mode.");
+    }
+    if (control.kind !== "ensure" && control.initialTurn === undefined) {
+        throw new Error("Managed Provider new/resume launch requires its initial Turn.");
+    }
+    if (control.kind === "ensure" && control.initialTurn !== undefined) {
+        throw new Error("Managed Provider ensure launch cannot carry a new Turn.");
+    }
     const requiresNativeSessionId = control.mode === "resume" || control.adapterId === "claude";
     if (requiresNativeSessionId !== (control.nativeSessionId !== undefined)) {
         throw new Error("Agent Host Provider resume identity is inconsistent.");

package/dist/runtime/processExitOutbox.js

@@ -0,0 +1,88 @@
+import { createHash } from "node:crypto";
+import { readdir, readFile, unlink } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { writeTextFileAtomically } from "../storage/durableFile.js";
+import { validateRuntimeProcessExitObservation } from "./processExitObservation.js";
+/**
+ * Persist before attempting Controller delivery. The Controller also drains
+ * this outbox before it begins serving after a restart, so a Session does not
+ * have to remain alive merely to bridge a short handover window.
+ */
+export async function persistRuntimeProcessExitObservation(home, observation, submit) {
+    const validated = validateRuntimeProcessExitObservation(observation);
+    const directory = outboxDirectory(home);
+    const identity = createHash("sha256").update(validated.observationId).digest("hex");
+    writeTextFileAtomically(join(directory, `${identity}.json`), `${JSON.stringify(validated)}\n`);
+    await replayRuntimeProcessExitOutbox(home, submit);
+}
+/**
+ * Replays every record through an idempotent observation boundary. A failed
+ * record remains durable and is considered again by the next replay.
+ */
+export async function replayRuntimeProcessExitOutbox(home, submit) {
+    const directory = outboxDirectory(home);
+    let entries;
+    try {
+        entries = await readdir(directory);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return;
+        throw error;
+    }
+    for (const name of entries.filter((name) => name.endsWith(".json")).sort()) {
+        const path = join(directory, name);
+        let raw;
+        try {
+            raw = await readFile(path, "utf8");
+        }
+        catch (error) {
+            // Another Agent Host or the replacement Controller may have submitted
+            // and removed this immutable record after our directory snapshot.
+            if (error.code === "ENOENT")
+                continue;
+            throw error;
+        }
+        const observation = validateRuntimeProcessExitObservation(JSON.parse(raw));
+        await submit(observation);
+        await unlink(path).catch((error) => {
+            if (error.code !== "ENOENT")
+                throw error;
+        });
+    }
+    // One-generation bridge for observations written by an Agent Host that was
+    // already running before this release. New writers use one immutable file
+    // per observation above, so they never share an append/unlink boundary.
+    for (const name of entries.filter(isLegacyOutboxEntry).sort()) {
+        const path = join(directory, name);
+        let raw;
+        try {
+            raw = await readFile(path, "utf8");
+        }
+        catch (error) {
+            // The old writer removes its own append log only after the Controller
+            // acknowledges delivery. If it won that race, there is nothing to replay.
+            if (error.code === "ENOENT")
+                continue;
+            throw error;
+        }
+        // Only consume newline-terminated records. A legacy writer can be between
+        // append bytes and its trailing newline while this snapshot is read.
+        const completeLength = raw.lastIndexOf("\n") + 1;
+        const lines = raw.slice(0, completeLength).split("\n").filter(Boolean);
+        for (const line of lines) {
+            await submit(validateRuntimeProcessExitObservation(JSON.parse(line)));
+        }
+        // Deliberately leave the legacy path in place. A pre-upgrade Agent Host may
+        // already hold an append descriptor for this inode; renaming/unlinking it
+        // would let a later append disappear into an unlinked file. The old writer
+        // removes the path after a successful direct submission. Otherwise the
+        // durable file remains for the next idempotent replay.
+    }
+}
+function outboxDirectory(home) {
+    return resolve(join(home, "runtime", "agent-host-outbox"));
+}
+function isLegacyOutboxEntry(name) {
+    return name.endsWith(".jsonl");
+}

package/dist/runtime/providerRuntimeIdentity.js

@@ -236,6 +236,30 @@ export function rejectProviderTurn(raw, input) {
         }
     });
 }
+/** Resolves an Agent Host submission exactly once and accepts an exact acknowledgement replay. */
+export function settleProviderTurnSubmission(raw, input) {
+    const binding = validateProviderRuntimeBinding(raw);
+    const attemptId = identity(input.attemptId, "Provider input attempt id");
+    if (binding.turn?.attemptId !== attemptId) {
+        throw new Error("Provider Turn does not match a resolvable delivery state.");
+    }
+    if (binding.turn.status === input.status)
+        return binding;
+    if (binding.turn.status !== "submitting") {
+        throw new Error("Provider Turn does not match a resolvable delivery state.");
+    }
+    return input.status === "delivery-unknown"
+        ? markProviderTurnDeliveryUnknown(binding, {
+            attemptId,
+            observedAt: input.resolvedAt,
+            reason: input.reason
+        })
+        : rejectProviderTurn(binding, {
+            attemptId,
+            rejectedAt: input.resolvedAt,
+            reason: input.reason
+        });
+}
 export function settleProviderTurn(raw, input) {
     const binding = validateProviderRuntimeBinding(raw);
     const turn = binding.turn;
@@ -270,7 +294,11 @@ export function updateProviderConversationRecoverability(raw, recoverability) {
 export function supersedeProviderConversation(raw, input) {
     const binding = validateProviderRuntimeBinding(raw);
     const current = currentProviderConversation(binding);
-    if (current.recoverability !== "unrecoverable") {
+    const basis = input.basis ?? "exact-unrecoverable";
+    if (basis !== "actor-request" && basis !== "exact-unrecoverable") {
+        throw new Error("Provider Conversation switch basis is invalid.");
+    }
+    if (basis === "exact-unrecoverable" && current.recoverability !== "unrecoverable") {
         throw new Error("Current Provider Conversation is not exactly unrecoverable.");
     }
     if (!input.noUnsettledInputDelivery) {

package/dist/runtime/runtimeHealthPolicy.js

@@ -4,14 +4,14 @@
  *
  * The layers are deliberately time-based and conservative: short silence is
  * normal for high-reasoning-effort turns, large reviews, and tool waits.
- * Only deterministic dead/broken evidence or the durable semantic stall
- * window authorizes recovery; quiet time alone never resets a Run.
+ * Time-based layers authorize display hints and coalesced read-only diagnosis
+ * only. They never reset a Run or replace a Provider Conversation.
  */
 /** Runtime silence after which a live turn is surfaced as "quiet" (hint only). */
 export const RUNTIME_QUIET_AFTER_MS = 5 * 60_000;
-/** No durable semantic progress after which a read-only diagnostic is warranted. */
-export const RUNTIME_DIAGNOSTIC_AFTER_MS = 10 * 60_000;
-/** No durable semantic progress after which the scheduler raises a stall candidate. */
+/** No durable semantic progress after which the checkpoint is displayed as overdue. */
+export const RUNTIME_DIAGNOSTIC_AFTER_MS = 15 * 60_000;
+/** No durable semantic progress before one coalesced read-only runtime probe is due. */
 export const SEMANTIC_STALL_WINDOW_MS = 30 * 60_000;
 export const DEFAULT_RUNTIME_HEALTH_POLICY = Object.freeze({
     quietAfterMs: RUNTIME_QUIET_AFTER_MS,

package/dist/runtime/runtimeObservation.js

@@ -1,6 +1,19 @@
 import { createHash } from "node:crypto";
 import { requireDriverId } from "./agentDriver.js";
 export const RUNTIME_OBSERVATION_TASK_EVENT = "runtime.observation";
+/**
+ * Numeric usage and value-less partial request boundaries are both durable
+ * token-projection evidence. The latter deliberately carries no activityId so
+ * it cannot be mistaken for lifecycle progress.
+ */
+export function isRuntimeTokenEvidence(observation) {
+    return observation.kind === "activity.observed"
+        && (observation.payload.usage !== undefined
+            || (observation.payload.sourceId !== undefined
+                && observation.payload.activityId === undefined
+                && (observation.payload.observationQuality === "partial"
+                    || observation.payload.observationQuality === "unavailable")));
+}
 const KINDS = [
     "host.observed",
     "session.started",
@@ -210,6 +223,21 @@ export function runtimeObservationFromTaskEvent(event) {
         return null;
     }
 }
+/**
+ * Runtime observation events are compacted by operation identity: a terminal
+ * operation replaces its matching start. Any retained exact start therefore
+ * represents Provider-owned work that is still active for this Run.
+ */
+export function runHasActiveRuntimeOperations(events, owner) {
+    return events.some((event) => {
+        const observation = runtimeObservationFromTaskEvent(event);
+        return observation?.kind === "operation.started"
+            && observation.fence.taskId === owner.taskId
+            && observation.fence.roleName === owner.roleName
+            && observation.fence.runId === owner.runId
+            && observation.fence.agentId === owner.agentId;
+    });
+}
 function normalizeFence(input) {
     return Object.freeze({
         ...(input.taskId === undefined ? {} : { taskId: requireIdentity(input.taskId, "Task id") }),

package/dist/runtime/runtimeProjection.js

@@ -158,16 +158,23 @@ export function projectRuntimeObservation(current, raw) {
         }
         case "activity.observed": {
             const usage = event.payload.usage;
-            if (usage !== undefined && !usageAdvanced(current.usage, usage)) {
-                return next(current, { usage: Object.freeze({ ...usage }) });
-            }
-            return withActivity(next(current, {
+            const lifecycleActivity = event.payload.activityId !== undefined
+                && usage === undefined;
+            const projected = next(current, {
                 ...(usage === undefined ? {} : { usage: Object.freeze({ ...usage }) }),
-                session: current.turn === "waiting" ? "active" : current.session,
-                turn: current.turn === "waiting" ? "accepted" : current.turn,
-                waitingReason: undefined,
-                waitId: undefined
-            }), event.payload.activity, at);
+                ...(lifecycleActivity ? {
+                    session: current.turn === "waiting" ? "active" : current.session,
+                    turn: current.turn === "waiting" ? "accepted" : current.turn,
+                    waitingReason: undefined,
+                    waitId: undefined
+                } : {})
+            });
+            // Token counters are read-only measurements. Only a separate explicit
+            // activity observation may advance runtime health or waiting state;
+            // usage activityId values identify requests only for token projection.
+            if (!lifecycleActivity)
+                return projected;
+            return withActivity(projected, event.payload.activity, at);
         }
         case "observer.health":
             return next(current, {
@@ -321,11 +328,9 @@ export function runtimeDisplayStatus(current) {
  * Integration checkpoints), so token/tool/CPU activity can never masquerade
  * as business progress.
  *
- * Layers below the durable stall window are advisory: `quiet` and
- * `diagnostic-needed` never authorize a reset. The 30-minute semantic stall is
- * persisted by the scheduler and surfaced as `stalled-candidate` by the
- * caller; this function deliberately stops at `diagnostic-needed` so the
- * Leader's waiting-user/waiting-on-workers classification stays authoritative.
+ * Time-derived layers are advisory: `quiet` and `diagnostic-needed` never
+ * authorize a reset or Session switch. The scheduler owns the separate,
+ * coalesced 30-minute read-only diagnostic window.
  */
 export function classifyRuntimeHealth(input) {
     const policy = input.policy ?? DEFAULT_RUNTIME_HEALTH_POLICY;
@@ -380,7 +385,8 @@ function classifyLayer(current, operation, runtimeIdleMs, semanticIdleMs, policy
     if (current.turn === "waiting") {
         return `waiting-${current.waitingReason ?? "external"}`;
     }
-    // No durable semantic progress past the diagnostic window: read-only look.
+    // No durable semantic progress past fifteen minutes: display only. The
+    // scheduler's coalesced read-only diagnostic remains a separate 30m clock.
     if (semanticIdleMs >= policy.diagnosticAfterMs)
         return "diagnostic-needed";
     // A live turn with no recent structured activity is quiet, not dead.
@@ -413,7 +419,7 @@ function runtimeHealthReason(layer, current) {
             if (current.observer.status === "degraded" || current.observer.status === "unavailable") {
                 return `the runtime observer is ${current.observer.status}; read-only diagnostic recommended`;
             }
-            return "no durable semantic progress in the diagnostic window; read-only diagnostic recommended";
+            return "no durable semantic checkpoint in the overdue window; the runtime remains undisturbed";
         case "quiet":
             return "the Agent turn is active but has reported no structured runtime activity recently";
         case "active-quiet":
@@ -488,22 +494,6 @@ function next(current, patch) {
         runActivity
     });
 }
-function usageAdvanced(previous, current) {
-    if (current.semantics === "remaining-context")
-        return false;
-    if (current.semantics === "request-context")
-        return usageTotal(current) > 0;
-    // A first cumulative snapshot may contain history from a resumed native
-    // Session. It establishes a baseline but cannot prove current progress.
-    if (previous === undefined || previous.semantics !== "cumulative-session")
-        return false;
-    return usageTotal(current) > usageTotal(previous);
-}
-function usageTotal(usage) {
-    // cachedInputTokens and reasoningTokens are breakdowns of the normalized
-    // input/output totals, not additional usage.
-    return usage.inputTokens + usage.outputTokens;
-}
 function dominantOperation(operations) {
     const kinds = Object.values(operations).map(({ kind }) => kind);
     if (kinds.includes("subagent"))