@zq-silk/yui 0.11.3 → 0.12.1

package/dist/controller/agentRuntimeObserver.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
-import { createRuntimeObservation, runtimeObservationFenceMatches, runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
+import { createRuntimeObservation, runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
 const DEFAULT_MAX_CONCURRENT_SAMPLES = 8;
 const MAX_CONCURRENT_SAMPLES = 64;
 /**
@@ -31,20 +31,30 @@ export class AgentRuntimeObserver {
         const dirty = new Set();
         const sequenceBase = this.#sequence;
         this.#sequence += active.length;
-        await forEachConcurrent(active, this.#maxConcurrentSamples, async ({ key, fence, source, freshSession, persistedState }, index) => {
+        await forEachConcurrent(active, this.#maxConcurrentSamples, async ({ key, fence, source, persistedState }, index) => {
             const existingState = this.#states.get(key);
             // Cursor state is intentionally process-local, but the latest canonical
             // usage/activity baseline is durable. Rehydrate it after Controller
             // restart so rereading the bounded transcript tail cannot manufacture a
             // fresh activity edge from tokens that were already observed.
             const state = existingState ?? { ...persistedState };
+            const restoredUsageEventId = existingState === undefined
+                ? persistedState.usageEventId
+                : undefined;
             const driver = this.drivers.require(fence.driverId);
             const observer = driver.runtime.observer;
             if (observer === undefined)
                 return;
             let sample;
             try {
-                sample = await observer.sample(source, state.cursor);
+                sample = await observer.sample(source, state.cursor, {
+                    ...(state.usageOccurrenceId === undefined
+                        ? {}
+                        : { latestOccurrenceId: state.usageOccurrenceId }),
+                    ...(state.usageOccurrenceCheckpoint === undefined
+                        ? {}
+                        : { latestCheckpoint: state.usageOccurrenceCheckpoint })
+                });
             }
             catch (error) {
                 sample = Object.freeze({
@@ -59,37 +69,70 @@ export class AgentRuntimeObserver {
             // latency can change completion order without changing observation
             // identity or the canonical sequence assigned to a source.
             const sequence = sequenceBase + index;
-            if (existingState === undefined && state.usage === undefined) {
-                // A fresh native Session begins at zero. A resumed Session instead
-                // freezes its first cumulative sample as this Run's lower-bound
-                // baseline so later samples can prove spend without charging usage
-                // that belongs to an earlier Run in the same native conversation.
-                const baseline = freshSession
-                    ? Object.freeze({
-                        semantics: "cumulative-session",
-                        inputTokens: 0,
-                        outputTokens: 0
-                    })
-                    : sample.usage?.semantics === "cumulative-session"
-                        ? sample.usage
-                        : undefined;
-                if (baseline !== undefined) {
-                    const baselineKey = freshSession ? "zero" : JSON.stringify(baseline);
+            let usages = sample.usages ?? [];
+            if (state.usage === undefined) {
+                // Cumulative counters need a lower bound. An exact initial sample
+                // proves the complete Session-generation history even when the
+                // current Run resumed that Session, so preserve every occurrence and
+                // anchor it at zero. A partial sample cannot prove the omitted request
+                // boundaries; retain its latest total as a partial baseline, plus the
+                // smallest ordered witness if the visible counter already rolled back.
+                // Request snapshots already describe one complete occurrence and must
+                // not be mixed with a synthetic cumulative fact.
+                const usageOccurrences = usages.filter(hasUsageSnapshot);
+                const latestOccurrence = usageOccurrences.at(-1);
+                const completeHistory = latestOccurrence?.usage.semantics === "cumulative-session"
+                    && usages.every(({ observationQuality }) => observationQuality !== "partial");
+                const rollbackWitness = latestOccurrence?.usage.semantics === "cumulative-session"
+                    && !completeHistory
+                    ? cumulativeRollbackWitness(usageOccurrences)
+                    : [];
+                const baseline = latestOccurrence?.usage.semantics !== "cumulative-session"
+                    ? undefined
+                    : completeHistory
+                        ? Object.freeze({
+                            semantics: "cumulative-session",
+                            inputTokens: 0,
+                            outputTokens: 0
+                        })
+                        : latestOccurrence.usage;
+                if (baseline !== undefined && rollbackWitness.length === 0) {
+                    const baselineKey = completeHistory ? "zero" : latestOccurrence.occurrenceId;
+                    const identity = completeHistory
+                        ? tokenObservationIdentity("baseline", fence, source.sourceId, baselineKey)
+                        : usageObservationIdentity(fence, source.sourceId, latestOccurrence);
                     this.inbox.enqueueObservation(createRuntimeObservation({
                         schemaVersion: 2,
-                        eventId: observationId("baseline", fence, source.sourceId, baselineKey),
-                        semanticKey: observationId("baseline", fence, source.sourceId, baselineKey),
+                        eventId: identity.eventId,
+                        semanticKey: identity.semanticKey,
                         kind: "activity.observed",
-                        authority: freshSession ? "controller" : "driver-inferred",
+                        authority: completeHistory ? "controller" : "driver-inferred",
                         receivedAt: at,
                         sequence,
                         ordinal: 1,
                         fence,
-                        payload: { activity: "model", usage: baseline }
+                        payload: {
+                            activity: "model",
+                            sourceId: source.sourceId,
+                            usage: baseline,
+                            ...(completeHistory
+                                ? {}
+                                : { observationQuality: "partial" })
+                        }
                     }));
                     state.usage = baseline;
-                    dirty.add(`role:${fence.taskId}/${fence.roleName}`);
+                    state.usageEventId = identity.eventId;
+                    state.usageOccurrenceId = completeHistory
+                        ? undefined
+                        : latestOccurrence.occurrenceId;
+                    state.usageOccurrenceCheckpoint = completeHistory
+                        ? undefined
+                        : latestOccurrence.resumeCheckpoint;
+                    if (!completeHistory)
+                        usages = [];
                 }
+                if (rollbackWitness.length > 0)
+                    usages = rollbackWitness;
             }
             const health = JSON.stringify([sample.status, sample.detail ?? null]);
             if (state.health !== health) {
@@ -112,32 +155,81 @@ export class AgentRuntimeObserver {
                 state.health = health;
                 dirty.add(`role:${fence.taskId}/${fence.roleName}`);
             }
-            const usageChanged = sample.usage !== undefined
-                && !sameUsage(state.usage, sample.usage);
             const activityChanged = sample.activityId !== undefined
                 && sample.activityId !== state.activityId;
-            if (usageChanged || (activityChanged && state.cursor !== undefined)) {
-                const usage = sample.usage;
+            if (restoredUsageEventId !== undefined) {
+                let persistedIndex = -1;
+                for (let usageIndex = usages.length - 1; usageIndex >= 0; usageIndex -= 1) {
+                    if (usageObservationIdentity(fence, source.sourceId, usages[usageIndex]).eventId
+                        === restoredUsageEventId) {
+                        persistedIndex = usageIndex;
+                        break;
+                    }
+                }
+                if (persistedIndex >= 0) {
+                    usages = usages.slice(persistedIndex + 1);
+                }
+                else if (state.usage?.semantics === "cumulative-session") {
+                    // The durable counter proves the latest cumulative total, but an
+                    // initial bounded read that cannot recover that occurrence may
+                    // have skipped intermediate request boundaries while the
+                    // Controller was stopped. Preserve the total and fail closed only
+                    // for the derived maximum-request metric.
+                    usages = usages.map((occurrence) => (occurrence.usage?.semantics !== "cumulative-session"
+                        ? occurrence
+                        : Object.freeze({ ...occurrence, observationQuality: "partial" })));
+                }
+            }
+            usages.forEach((occurrence, usageIndex) => {
+                const identity = usageObservationIdentity(fence, source.sourceId, occurrence);
                 this.inbox.enqueueObservation(createRuntimeObservation({
                     schemaVersion: 2,
-                    eventId: observationId("activity", fence, source.sourceId, JSON.stringify([usage ?? null, sample.activityId ?? null])),
-                    semanticKey: observationId("activity", fence, source.sourceId, JSON.stringify([usage ?? null, sample.activityId ?? null])),
+                    eventId: identity.eventId,
+                    semanticKey: identity.semanticKey,
                     kind: "activity.observed",
                     authority: "driver-inferred",
                     receivedAt: at,
                     sequence,
-                    ordinal: 2,
+                    ordinal: 2 + usageIndex,
                     fence,
                     payload: {
                         activity: sample.activity ?? "model",
-                        ...(sample.activityId === undefined ? {} : { activityId: sample.activityId }),
-                        ...(usage === undefined ? {} : { usage })
+                        sourceId: source.sourceId,
+                        ...(occurrence.usage === undefined || occurrence.activityId === undefined
+                            ? {}
+                            : { activityId: occurrence.activityId }),
+                        ...(occurrence.observationQuality === undefined
+                            ? {}
+                            : { observationQuality: occurrence.observationQuality }),
+                        ...(occurrence.usage === undefined ? {} : { usage: occurrence.usage })
+                    }
+                }));
+                if (occurrence.usage !== undefined) {
+                    state.usage = occurrence.usage;
+                    state.usageEventId = identity.eventId;
+                    state.usageOccurrenceId = occurrence.occurrenceId;
+                    state.usageOccurrenceCheckpoint = occurrence.resumeCheckpoint;
+                }
+            });
+            if (activityChanged && state.cursor !== undefined) {
+                this.inbox.enqueueObservation(createRuntimeObservation({
+                    schemaVersion: 2,
+                    eventId: observationId("activity", fence, source.sourceId, sample.activityId),
+                    semanticKey: observationId("activity", fence, source.sourceId, sample.activityId),
+                    kind: "activity.observed",
+                    authority: "driver-inferred",
+                    receivedAt: at,
+                    sequence,
+                    ordinal: 2 + usages.length,
+                    fence,
+                    payload: {
+                        activity: sample.activity ?? "model",
+                        sourceId: source.sourceId,
+                        activityId: sample.activityId
                     }
                 }));
                 dirty.add(`role:${fence.taskId}/${fence.roleName}`);
             }
-            if (sample.usage !== undefined)
-                state.usage = sample.usage;
             if (sample.activityId !== undefined)
                 state.activityId = sample.activityId;
             this.#states.set(key, state);
@@ -160,11 +252,13 @@ export class AgentRuntimeObserver {
             // by Run and sort each group once so every active Run can reuse the same
             // ordered slice instead of repeatedly filtering/sorting all E events.
             const observationsByRunId = new Map();
+            const taskObservations = [];
             for (const event of this.store.listEvents(task.id)) {
                 const observation = runtimeObservationFromTaskEvent(event);
                 const runId = observation?.fence.runId;
                 if (observation === null || runId === undefined)
                     continue;
+                taskObservations.push(observation);
                 const grouped = observationsByRunId.get(runId);
                 if (grouped === undefined) {
                     observationsByRunId.set(runId, [observation]);
@@ -176,6 +270,7 @@ export class AgentRuntimeObserver {
             for (const observations of observationsByRunId.values()) {
                 observations.sort(compareObservations);
             }
+            taskObservations.sort(compareObservations);
             for (const run of this.store.listAgentRuns(task.id)) {
                 if (run.status !== "active"
                     || this.store.getActiveAgentRun(task.id, run.roleName)?.id !== run.id)
@@ -200,12 +295,18 @@ export class AgentRuntimeObserver {
                     continue;
                 }
                 const fence = accepted.fence;
-                const exact = observations
-                    .filter((observation) => runtimeObservationFenceMatches(fence, observation.fence));
-                const persistedUsage = exact.filter((observation) => (observation.kind === "activity.observed"
+                const generation = taskObservations.filter((observation) => (sessionGenerationFenceMatches(fence, observation.fence)
+                    && observation.payload.sourceId === source.sourceId));
+                const persistedUsage = generation.filter((observation) => (observation.kind === "activity.observed"
                     && observation.payload.usage !== undefined)).at(-1);
-                const persistedHealth = exact.filter((observation) => (observation.kind === "observer.health"
+                const persistedActivity = generation.filter((observation) => (observation.kind === "activity.observed"
+                    && observation.payload.activityId !== undefined
+                    && observation.payload.usage === undefined)).at(-1);
+                const persistedHealth = generation.filter((observation) => (observation.kind === "observer.health"
                     && observation.payload.sourceId === source.sourceId)).at(-1);
+                const persistedUsageResume = persistedUsage === undefined
+                    ? undefined
+                    : usageObservationResume(persistedUsage.semanticKey);
                 result.push(Object.freeze({
                     key: JSON.stringify([
                         fence.taskId,
@@ -216,20 +317,30 @@ export class AgentRuntimeObserver {
                         fence.launchId,
                         fence.sessionGenerationId,
                         fence.nativeSessionId,
-                        fence.nativeTurnId,
-                        fence.receiptId,
                         source.sourceId
                     ]),
                     fence,
                     source,
-                    freshSession: run.mode === "new",
                     persistedState: Object.freeze({
                         ...(persistedUsage?.payload.usage === undefined
                             ? {}
                             : { usage: persistedUsage.payload.usage }),
-                        ...(persistedUsage?.payload.activityId === undefined
+                        ...(persistedUsage === undefined
                             ? {}
-                            : { activityId: persistedUsage.payload.activityId }),
+                            : {
+                                usageEventId: persistedUsage.eventId,
+                                ...(persistedUsageResume === undefined
+                                    ? {}
+                                    : {
+                                        usageOccurrenceId: persistedUsageResume.occurrenceId,
+                                        ...(persistedUsageResume.checkpoint === undefined
+                                            ? {}
+                                            : { usageOccurrenceCheckpoint: persistedUsageResume.checkpoint })
+                                    })
+                            }),
+                        ...(persistedActivity?.payload.activityId === undefined
+                            ? {}
+                            : { activityId: persistedActivity.payload.activityId }),
                         ...(persistedHealth === undefined
                             ? {}
                             : {
@@ -265,6 +376,28 @@ function sampleConcurrency(value) {
     }
     return resolved;
 }
+function hasUsageSnapshot(occurrence) {
+    return occurrence.usage !== undefined;
+}
+function cumulativeRollbackWitness(occurrences) {
+    const cumulative = occurrences.filter(({ usage }) => (usage.semantics === "cumulative-session"));
+    const latest = cumulative.at(-1);
+    for (let index = 1; index < cumulative.length; index += 1) {
+        const previous = cumulative[index - 1];
+        const current = cumulative[index];
+        if (current.usage.inputTokens >= previous.usage.inputTokens
+            && current.usage.outputTokens >= previous.usage.outputTokens)
+            continue;
+        const witness = latest === current
+            ? [previous, current]
+            : [previous, current, latest];
+        return Object.freeze(witness.map((occurrence) => Object.freeze({
+            ...occurrence,
+            observationQuality: "partial"
+        })));
+    }
+    return Object.freeze([]);
+}
 function numericCompare(left, right) {
     return left.localeCompare(right, undefined, { numeric: true });
 }
@@ -279,11 +412,74 @@ function observationId(kind, fence, sourceId, value) {
         .update(JSON.stringify([kind, fence, sourceId, value]))
         .digest("hex")}`;
 }
-function sameUsage(left, right) {
-    return left !== undefined
-        && left.semantics === right.semantics
-        && left.inputTokens === right.inputTokens
-        && left.outputTokens === right.outputTokens
-        && left.cachedInputTokens === right.cachedInputTokens
-        && left.reasoningTokens === right.reasoningTokens;
+function usageObservationIdentity(fence, sourceId, occurrence) {
+    const eventId = tokenObservationId("usage", fence, sourceId, occurrence.occurrenceId);
+    const encodedOccurrenceId = Buffer.from(occurrence.occurrenceId, "utf8").toString("base64url");
+    return Object.freeze({
+        eventId,
+        semanticKey: `${eventId}:occurrence:${encodedOccurrenceId}${occurrence.resumeCheckpoint === undefined
+            ? ""
+            : `:checkpoint:${Buffer.from(occurrence.resumeCheckpoint, "utf8").toString("base64url")}`}`
+    });
+}
+function usageObservationResume(semanticKey) {
+    const occurrenceMarker = ":occurrence:";
+    const checkpointMarker = ":checkpoint:";
+    const occurrenceIndex = semanticKey.lastIndexOf(occurrenceMarker);
+    if (occurrenceIndex < 0)
+        return undefined;
+    const checkpointIndex = semanticKey.indexOf(checkpointMarker, occurrenceIndex + occurrenceMarker.length);
+    const encodedOccurrence = semanticKey.slice(occurrenceIndex + occurrenceMarker.length, checkpointIndex < 0 ? undefined : checkpointIndex);
+    if (encodedOccurrence.length === 0)
+        return undefined;
+    try {
+        const occurrenceId = Buffer.from(encodedOccurrence, "base64url").toString("utf8");
+        if (occurrenceId.length === 0)
+            return undefined;
+        if (checkpointIndex < 0)
+            return Object.freeze({ occurrenceId });
+        const encodedCheckpoint = semanticKey.slice(checkpointIndex + checkpointMarker.length);
+        if (encodedCheckpoint.length === 0)
+            return undefined;
+        const checkpoint = Buffer.from(encodedCheckpoint, "base64url").toString("utf8");
+        return checkpoint.length === 0
+            ? undefined
+            : Object.freeze({ occurrenceId, checkpoint });
+    }
+    catch {
+        return undefined;
+    }
+}
+function tokenObservationIdentity(kind, fence, sourceId, value) {
+    const eventId = tokenObservationId(kind, fence, sourceId, value);
+    return Object.freeze({ eventId, semanticKey: eventId });
+}
+function tokenObservationId(kind, fence, sourceId, value) {
+    return `runtime-observer-${createHash("sha256").update(JSON.stringify([
+        kind,
+        fence.taskId ?? null,
+        fence.roleName,
+        fence.agentId,
+        fence.driverId,
+        fence.launchId,
+        fence.sessionGenerationId,
+        fence.nativeSessionId ?? null,
+        sourceId,
+        value
+    ])).digest("hex")}`;
+}
+function sessionGenerationFenceMatches(expected, actual) {
+    for (const field of [
+        "taskId",
+        "roleName",
+        "agentId",
+        "driverId",
+        "launchId",
+        "sessionGenerationId",
+        "nativeSessionId"
+    ]) {
+        if (expected[field] !== actual[field])
+            return false;
+    }
+    return true;
 }

package/dist/controller/clientRuntime.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { callController, readControllerDiscovery, stopOrphanedFileTaskController, stopPreviousFileTaskController } from "../core/controllerClient.js";
+import { callController, ControllerClientError, readControllerDiscovery, stopOrphanedFileTaskController, stopPreviousFileTaskController } from "../core/controllerClient.js";
 import { controllerSocketPath } from "../core/controllerEndpoint.js";
 import { FILE_TASK_CONTROLLER_PROTOCOL_VERSION } from "../core/protocol.js";
 import { AGENT_OPERATIONAL_ENVIRONMENT_NAMES, nativeAgentEnvironmentNames, operationalAgentEnvironment, selectEnvironment, YUI_MANAGED_RUNTIME_ENVIRONMENT_NAMES } from "../agent/launchEnvironment.js";
@@ -14,6 +14,7 @@ import { SessionOwnerReconciliation } from "./sessionOwnerReconciliation.js";
 import { WorkspaceCleanupBlockedError } from "../repository/taskWorkspacePreparer.js";
 import { CONTROLLER_SHUTDOWN_TIMEOUT_MS, LIFECYCLE_REQUEST_TIMEOUT_MS } from "../runtime/runtimeDeadlines.js";
 import { FileTaskRuntimeIsolation } from "../runtime/taskRuntimeIsolation.js";
+import { isForeignHandoverLockHeld } from "../release/runtimeRelease.js";
 const STARTUP_TIMEOUT_MS = 5_000;
 const POLL_INTERVAL_MS = 50;
 const ENVIRONMENT_REFRESH_TIMEOUT_MS = 500;
@@ -54,6 +55,7 @@ export async function assertFileTaskControllerStorageCompatible(home, options =
 /** Starts the per-home FileTask Controller on demand and waits until callable. */
 export async function ensureFileTaskController(home, options = {}) {
     const call = options.call ?? callController;
+    await waitForForeignHandover(home, options);
     try {
         const status = await call(home, "controller.status", {});
         assertCompatibleControllerStatus(status, options.expectedVersion);
@@ -63,6 +65,10 @@ export async function ensureFileTaskController(home, options = {}) {
         if (!isUnavailable(error))
             throw error;
     }
+    // A handover may have started after the first lock check and before the
+    // failed discovery/socket call. Re-check before spawning so a managed
+    // Session can never resurrect the old Controller during an update.
+    await waitForForeignHandover(home, options);
     const timeoutMs = positive(options.startupTimeoutMs, STARTUP_TIMEOUT_MS, "startupTimeoutMs");
     const pollMs = positive(options.pollIntervalMs, POLL_INTERVAL_MS, "pollIntervalMs");
     const spawnController = options.spawnController ?? spawnDetachedFileTaskController;
@@ -322,15 +328,22 @@ export async function callFileTaskController(home, method, params = {}, options
                 : { stopped: false, alreadyStopped: true };
         }
     }
+    await waitForForeignHandover(home, options);
     try {
         return await call(home, method, params, {
             timeoutMs: options.requestTimeoutMs
         });
     }
     catch (error) {
-        if (!isUnavailable(error))
+        if (!isUnavailable(error)
+            && !(isControllerDraining(error)
+                && isForeignHandoverLockHeld(home, options.handoverOwnerPid ?? process.pid))) {
             throw error;
+        }
     }
+    // A pre-connect unavailable result is safe to retry. Ambiguous post-send
+    // failures are classified separately by the socket client and surface.
+    await waitForForeignHandover(home, options);
     await ensureFileTaskController(home, options);
     return call(home, method, params, {
         timeoutMs: options.requestTimeoutMs
@@ -582,7 +595,7 @@ export class FileTaskWorkflowRuntime {
     async #prepareAndScan(taskId) {
         const task = this.store.getTask(taskId);
         if (task !== null
-            && (task.status === "draft" || task.status === "active")
+            && task.status === "active"
             && this.workspacePreparer !== undefined) {
             await this.workspacePreparer.prepareTaskWorkspace(taskId);
         }
@@ -631,6 +644,29 @@ function isUnavailable(error) {
     return code === "CONTROLLER_NOT_RUNNING"
         || code === "CONTROLLER_UNAVAILABLE";
 }
+function isControllerDraining(error) {
+    return typeof error === "object"
+        && error !== null
+        && "code" in error
+        && error.code === "CONTROLLER_DRAINING";
+}
+async function waitForForeignHandover(home, options) {
+    const allowedOwnerPid = options.handoverOwnerPid ?? process.pid;
+    if (!Number.isSafeInteger(allowedOwnerPid) || allowedOwnerPid < 1) {
+        throw new TypeError("handoverOwnerPid must be a positive integer");
+    }
+    if (!isForeignHandoverLockHeld(home, allowedOwnerPid))
+        return;
+    const timeoutMs = positive(options.handoverWaitTimeoutMs, LIFECYCLE_REQUEST_TIMEOUT_MS, "handoverWaitTimeoutMs");
+    const pollMs = positive(options.pollIntervalMs, POLL_INTERVAL_MS, "pollIntervalMs");
+    const deadline = Date.now() + timeoutMs;
+    do {
+        await delay(pollMs);
+        if (!isForeignHandoverLockHeld(home, allowedOwnerPid))
+            return;
+    } while (Date.now() < deadline);
+    throw new ControllerClientError("CONTROLLER_HANDOVER_TIMEOUT", `Controller handover did not finish within ${timeoutMs} ms.`);
+}
 function isDefinitelyNotRunning(error) {
     if (typeof error !== "object" || error === null || !("code" in error))
         return false;

package/dist/controller/controller.js

@@ -282,23 +282,27 @@ async function processSelectedRoleRuntimeCleanups(store, delivery, lifecycleHost
                     const reservedLaunchId = isRuntimeLaunchReservation(mailbox.processing)
                         ? mailbox.processing.batchId
                         : undefined;
-                    if (reservedLaunchId !== undefined
-                        && session?.launchId !== undefined
-                        && reservedLaunchId !== session.launchId) {
-                        throw new Error(`Task runtime cleanup launch identity is ambiguous: ${target.taskId}.`);
-                    }
-                    const launchId = reservedLaunchId ?? session?.launchId;
-                    if (launchId !== undefined
-                        && lifecycleHost.cleanupTaskLaunch !== undefined) {
+                    // A failed fresh-Conversation launch can leave two exact resource
+                    // generations: the detached Session's last committed launch and the
+                    // replacement reservation. They are not competing authorities. The
+                    // owner-wide stop has already proven physical zero, so clean both
+                    // exact launch roots idempotently before settling the mailbox.
+                    const launchIds = new Set([
+                        reservedLaunchId,
+                        session?.launchId
+                    ].filter((launchId) => launchId !== undefined));
+                    if (lifecycleHost.cleanupTaskLaunch !== undefined) {
                         const task = store.getTask(target.taskId);
                         const reason = task?.status === "completed"
                             ? "completion"
                             : "interruption";
-                        lifecycleHost.cleanupTaskLaunch({
-                            taskId: target.taskId,
-                            launchId,
-                            reason
-                        });
+                        for (const launchId of launchIds) {
+                            lifecycleHost.cleanupTaskLaunch({
+                                taskId: target.taskId,
+                                launchId,
+                                reason
+                            });
+                        }
                     }
                 }
                 if (store.completeRuntimeCleanup === undefined
@@ -1184,11 +1188,12 @@ export class FileTaskController {
                         this.#clearDeliveryRetry(key);
                         this.#scheduleTaskPassRetry({ taskId, keys: [key] });
                     }
+                    const runtimeAdvanced = (firstRuntimeDrain?.acknowledgedEventIds.length ?? 0) > 0
+                        || (secondRuntimeDrain?.acknowledgedEventIds.length ?? 0) > 0;
                     if (scope.kind === "full"
                         || scope.keys.some((key) => key !== "operator")
-                        || (firstRuntimeDrain?.acknowledgedEventIds.length ?? 0) > 0
-                        || (secondRuntimeDrain?.acknowledgedEventIds.length ?? 0) > 0) {
-                        this.#signalOperatorMailbox();
+                        || runtimeAdvanced) {
+                        this.#signalOperatorMailbox(runtimeAdvanced);
                     }
                 }
                 catch (error) {
@@ -1311,7 +1316,7 @@ export class FileTaskController {
         this.#clearEmptyOperatorRetry();
         this.#scheduleNextInputDeadline();
     }
-    #signalOperatorMailbox() {
+    #signalOperatorMailbox(retryReady = false) {
         if (this.#stopped)
             return;
         const mailbox = this.store.getWorkMailbox({ kind: "operator" });
@@ -1320,7 +1325,8 @@ export class FileTaskController {
             this.#lastOperatorSignalIdentity = undefined;
             return;
         }
-        if (identity !== this.#lastOperatorSignalIdentity) {
+        if (identity !== this.#lastOperatorSignalIdentity
+            || (retryReady && this.store.getOperatorDeliveryTarget() !== null)) {
             this.#operatorSignalScheduler.signal("operator");
             this.#lastOperatorSignalIdentity = identity;
         }
@@ -1502,7 +1508,11 @@ export class FileTaskController {
         }
         for (const wakeup of result.wakeups) {
             const key = `role:${encodeURIComponent(wakeup.taskId)}/leader`;
-            if (wakeup.reason === "writer-attached") {
+            if (wakeup.terminalized === true) {
+                settled.add(key);
+                resignal.add(key);
+            }
+            else if (wakeup.reason === "writer-attached") {
                 writerBlocked.add(key);
             }
             else if (wakeup.reason === "not-ready") {
@@ -1516,13 +1526,7 @@ export class FileTaskController {
                 && this.#operatorStartupRetryArmed));
         if (operatorRetries.length > 0) {
             retry.set("operator", {
-                identity: operatorRetries.map((notification) => ("inputRequestId" in notification
-                    ? `input:${notification.inputRequestId}`
-                    : "recoveryTaskId" in notification
-                        ? `recovery:${notification.recoveryTaskId}`
-                        : "stallTaskId" in notification
-                            ? `stall:${notification.stallTaskId}`
-                            : `terminal:${notification.terminalTaskId}`)).join("|")
+                identity: operatorRetries.map((notification) => (`${notification.sourceKind}:${notification.taskId}:${notification.sourceId}`)).join("|")
             });
         }
         else if (result.inputNotifications.some((notification) => notification.status === "sent"
@@ -1694,7 +1698,7 @@ export async function startFileTaskController(home, store, delivery, dispatcher,
         dispatcherServiceTime.started();
         try {
             if (stopping) {
-                throw controllerApplicationError("METHOD_NOT_FOUND", "Controller is stopping.");
+                throw controllerApplicationError("CONTROLLER_DRAINING", "Controller is draining.");
             }
             if (method === "scheduler.signal") {
                 runtime.signal(signalMailboxKey(params));